diff --git a/.depend b/.depend index 4897698..45fc6b9 100644 --- a/.depend +++ b/.depend @@ -23,6 +23,7 @@ auth2-gss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com auth2-hostbased.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh2.h packet.h openbsd-compat/sys-queue.h dispatch.h kex.h mac.h crypto_api.h sshbuf.h log.h ssherr.h misc.h servconf.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h canohost.h auth2-hostbased.o: monitor_wrap.h pathnames.h match.h auth2-kbdint.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h packet.h openbsd-compat/sys-queue.h dispatch.h hostfile.h auth.h auth-pam.h audit.h loginrec.h log.h ssherr.h misc.h servconf.h +auth2-methods.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h misc.h servconf.h openbsd-compat/sys-queue.h xmalloc.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth2-none.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h atomicio.h xmalloc.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h packet.h openbsd-compat/sys-queue.h dispatch.h log.h ssherr.h misc.h servconf.h ssh2.h monitor_wrap.h auth2-passwd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h openbsd-compat/sys-queue.h dispatch.h ssherr.h log.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h monitor_wrap.h misc.h servconf.h auth2-pubkey.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h ssh2.h packet.h openbsd-compat/sys-queue.h dispatch.h kex.h mac.h crypto_api.h sshbuf.h log.h ssherr.h misc.h servconf.h compat.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h @@ -60,6 +61,7 @@ gss-serv.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-comp hash.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h hmac.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshbuf.h digest.h hmac.h hostfile.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h match.h sshkey.h hostfile.h log.h ssherr.h misc.h pathnames.h digest.h hmac.h sshbuf.h +kex-names.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h kex.h mac.h crypto_api.h log.h ssherr.h match.h digest.h misc.h xmalloc.h kex.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh.h ssh2.h atomicio.h version.h packet.h openbsd-compat/sys-queue.h dispatch.h compat.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h mac.h crypto_api.h log.h ssherr.h kex.o: match.h misc.h monitor.h myproposal.h sshbuf.h digest.h xmalloc.h kexc25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshkey.h kex.h mac.h crypto_api.h sshbuf.h digest.h ssherr.h ssh2.h @@ -69,6 +71,7 @@ kexgen.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat kexgex.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h kexgexc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h kexgexs.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h +kexmlkem768x25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshkey.h kex.h mac.h crypto_api.h sshbuf.h digest.h ssherr.h log.h kexsntrup761x25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h krl.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h sshbuf.h ssherr.h sshkey.h authfile.h misc.h log.h digest.h bitmap.h utf8.h krl.h log.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h match.h @@ -78,16 +81,17 @@ mac.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h match.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h match.h misc.h misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h misc.h log.h ssherr.h ssh.h sshbuf.h moduli.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h -monitor.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h dh.h packet.h dispatch.h auth-options.h sshpty.h channels.h session.h sshlogin.h canohost.h log.h ssherr.h misc.h servconf.h monitor.h monitor_wrap.h monitor_fdpass.h compat.h ssh2.h authfd.h match.h sk-api.h +monitor.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h dh.h packet.h dispatch.h auth-options.h sshpty.h channels.h session.h sshlogin.h canohost.h log.h ssherr.h misc.h servconf.h monitor.h monitor_wrap.h monitor_fdpass.h compat.h ssh2.h authfd.h match.h sk-api.h srclimit.h monitor.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h openbsd-compat/openssl-compat.h atomicio.h xmalloc.h ssh.h sshkey.h sshbuf.h hostfile.h auth.h auth-pam.h audit.h loginrec.h cipher.h cipher-chachapoly.h monitor_fdpass.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h monitor_fdpass.h monitor_wrap.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h sshbuf.h sshkey.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h hostfile.h auth.h auth-pam.h audit.h -monitor_wrap.o: loginrec.h auth-options.h packet.h dispatch.h log.h ssherr.h monitor.h monitor_wrap.h atomicio.h monitor_fdpass.h misc.h channels.h session.h servconf.h +monitor_wrap.o: loginrec.h auth-options.h packet.h dispatch.h log.h ssherr.h monitor.h atomicio.h monitor_fdpass.h misc.h channels.h session.h servconf.h monitor_wrap.h srclimit.h msg.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshbuf.h ssherr.h log.h atomicio.h msg.h misc.h mux.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h log.h ssherr.h ssh.h ssh2.h pathnames.h misc.h match.h sshbuf.h channels.h msg.h packet.h dispatch.h monitor_fdpass.h sshpty.h sshkey.h readconf.h clientloop.h nchan.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h ssh2.h sshbuf.h ssherr.h packet.h dispatch.h channels.h compat.h log.h packet.o: channels.h ssh.h packet.h dispatch.h sshbuf.h packet.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h compat.h ssh2.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h mac.h crypto_api.h digest.h log.h ssherr.h canohost.h misc.h +platform-listen.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h misc.h platform-misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h platform-pledge.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h platform-tracing.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h @@ -123,7 +127,7 @@ sftp-usergroup.o: includes.h config.h defines.h platform.h openbsd-compat/openbs sftp.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h log.h ssherr.h pathnames.h misc.h utf8.h sftp.h sshbuf.h sftp-common.h sftp-client.h openbsd-compat/glob.h sftp-usergroup.h sk-usbhid.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sntrup761.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h -srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h +srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h servconf.h openbsd-compat/sys-queue.h match.h ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h hostfile.h ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h ssh-dss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h @@ -146,19 +150,21 @@ ssh-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat ssh-xmss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/openssl-compat.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h canohost.h compat.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h packet.h dispatch.h sshbuf.h channels.h ssh.o: sshkey.h authfd.h authfile.h pathnames.h clientloop.h log.h ssherr.h misc.h readconf.h sshconnect.h kex.h mac.h crypto_api.h sshpty.h match.h msg.h version.h myproposal.h utf8.h -ssh_api.o: authfile.h misc.h version.h myproposal.h sshbuf.h openbsd-compat/openssl-compat.h +ssh_api.o: authfile.h dh.h misc.h version.h myproposal.h sshbuf.h openbsd-compat/openssl-compat.h ssh_api.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh_api.h openbsd-compat/sys-queue.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h mac.h crypto_api.h ssh.h ssh2.h packet.h dispatch.h compat.h log.h ssherr.h sshbuf-getput-basic.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h sshbuf.h sshbuf-getput-crypto.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshbuf-io.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h sshbuf.h atomicio.h sshbuf-misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h sshbuf.h sshbuf.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h sshbuf.h misc.h -sshconnect.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h hostfile.h ssh.h sshbuf.h packet.h openbsd-compat/sys-queue.h dispatch.h sshkey.h sshconnect.h log.h ssherr.h misc.h readconf.h atomicio.h dns.h monitor_fdpass.h ssh2.h version.h authfile.h authfd.h -sshconnect.o: kex.h mac.h crypto_api.h +sshconnect.o: authfd.h kex.h mac.h crypto_api.h +sshconnect.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h hostfile.h ssh.h sshbuf.h packet.h openbsd-compat/sys-queue.h dispatch.h sshkey.h sshconnect.h log.h ssherr.h match.h misc.h readconf.h atomicio.h dns.h monitor_fdpass.h ssh2.h version.h authfile.h sshconnect2.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h packet.h dispatch.h compat.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey.h kex.h mac.h crypto_api.h sshconnect2.o: sshconnect.h authfile.h dh.h authfd.h log.h ssherr.h misc.h readconf.h match.h canohost.h msg.h pathnames.h uidswap.h hostfile.h utf8.h ssh-sk.h sk-api.h -sshd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshpty.h packet.h dispatch.h log.h ssherr.h sshbuf.h misc.h match.h servconf.h uidswap.h compat.h cipher.h cipher-chachapoly.h chacha.h -sshd.o: poly1305.h cipher-aesctr.h rijndael.h digest.h sshkey.h kex.h mac.h crypto_api.h authfile.h pathnames.h atomicio.h canohost.h hostfile.h auth.h auth-pam.h audit.h loginrec.h authfd.h msg.h channels.h session.h monitor.h monitor_wrap.h ssh-sandbox.h auth-options.h version.h sk-api.h srclimit.h dh.h +sshd-session.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h digest.h sshkey.h kex.h mac.h crypto_api.h authfile.h pathnames.h atomicio.h canohost.h hostfile.h auth.h auth-pam.h audit.h loginrec.h authfd.h msg.h channels.h session.h monitor.h monitor_wrap.h ssh-sandbox.h auth-options.h version.h sk-api.h srclimit.h dh.h +sshd-session.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshpty.h packet.h dispatch.h log.h ssherr.h sshbuf.h misc.h match.h servconf.h uidswap.h compat.h cipher.h cipher-chachapoly.h +sshd.o: audit.h loginrec.h authfd.h msg.h version.h sk-api.h addr.h srclimit.h +sshd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h xmalloc.h ssh.h sshpty.h log.h ssherr.h sshbuf.h misc.h servconf.h compat.h digest.h sshkey.h authfile.h pathnames.h canohost.h hostfile.h auth.h auth-pam.h ssherr.o: ssherr.h sshkey-xmss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sshkey.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h ssh2.h ssherr.h misc.h sshbuf.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h digest.h sshkey.h match.h ssh-sk.h openbsd-compat/openssl-compat.h diff --git a/.git_allowed_signers b/.git_allowed_signers index 0313c1e..2a5fdc6 100644 --- a/.git_allowed_signers +++ b/.git_allowed_signers @@ -1,4 +1,6 @@ dtucker@dtucker.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKecyjh9aNmD4rb8WblA8v91JjRb0Cd2JtkzqxcggGeG +dtucker@dtucker.net sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBDV81zWQ1+XVfWH5z4L4klDQ/z/6l2GLphfSTX/Rmq6kL5H8mkfzUlryxLlkN8cD9srtVJBAmwJWfJBNsCo958YAAAAEc3NoOg== + djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBLnJo3ZVDENYZGXm5uO9lU7b0iDFq5gHpTu1MaHPWTEfPdvw+AjFQQ/q5YizuMJkXGsMdYmblJEJZYHpm9IS7ZkAAAAEc3NoOg== djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBJoAXBTQalfg+kC5wy1vE7HkIHtVnmV6AUuuIo9KQ1P+70juHwvsFKpsGaqQbrHJkTVgYDGVP02XHj8+Fb18yBIAAAAEc3NoOg== djm@mindrot.org sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBH+z1I48s6ydOhP5SJmI02zVCLf0K15B+UMHgoTIKVfUIv5oDoVX7e9f+7QiRmTeEOdZfQydiaVqsfi7qPSve+0AAAAEc3NoOg== diff --git a/.git_allowed_signers.asc b/.git_allowed_signers.asc index 5fc6118..1a8401b 100644 --- a/.git_allowed_signers.asc +++ b/.git_allowed_signers.asc @@ -1,16 +1,16 @@ -----BEGIN PGP SIGNATURE----- -iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmMMMiIACgkQKj9BTnNg -YLpyGhAAhZ1RxmD62JnT0gnor1aD0inq1fGPRadaFvXH2OScPcxXMIZWx+otnyZ/ -H9s0bIti42dPHqurgh92KS2mDGVIW8Y8MvxFUr678+hdem1U7Xvjoo0uaveNhJhe -GxuQDOvXKRmmfL2c6w3wnFChFA1o3K+JNshjCHhWz7u6+UmY0Q9yIxqbSi+vmEPP -NfWPfGdu4h8r7q11UgTxRSUQkfZXMqpBtb367B9BLduGuKRFKEJNyi6WpjBrqy38 -BvEbAaL52KX8hEp3TKMjo38RbOK+veSoPV5zlLui0WlEwwasgljal3f4RkqCAJob -hqpFJRogM5XNnA2e68TDTf3buJ3wRRjuK39/CusOJz5v4i6+VCdte+BET1Y4gD6y -v8KV4pRyumcdbN3khFUkmaQsjo+fyQjWNrgOvv60J2xUWZdchn8lxHOxrfRVKnOi -BD4bdks7tPQY/XsS5GNJIp21Ji9HGyBajjHo0BlesLodw7FEOf6YE18A3n9qzosR -RliuP4Hs/Z4sCUuDTbpKtQiUVs40kBbkhEL8kS8FsXz3VO89hAWaUqNUYom8AkKv -nfDjrZDBLXuVj1Mi8qNPXxqrB/1Cza2/W4U7SK4TlMFXfoXXWxxhefN5vIdMhAJB -u9Mdz1pY9mowKbd0c0dR+3fauvjM133dzKuyeDHMqDa5JPyd59o= -=kgnS +iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmYHnZ8ACgkQKj9BTnNg +YLquuQ/6A8E6P2jcgn3wmbbCTXP7kmxoh3nmw/e6PC8CEua1512oT3GHOKVD5cGK +cgYRObpWvjOjg7L1HRABftq7a9M2zfsGnY/WNe3/fbetfkyY8hG8c31vA1ePIOt2 +AjBLCWFblH0CtyH/MssoQ19JCLtXK/GmekB1Q0JzyOog7w/0r3CKuUnZ0juCYR1R +4FBePl5l3nFSZEcFEdptGlNGeuolS5XBCqB9Y91TCzkVkH5eXUUW+shgjNhWCEhT +pZvkxfhsmOEnwNofyPdgKVfDBVkHmvuC67EU395mJVN4c2NZ8pOztb9hOt3xr980 +q44I4kT2NpaApCx1dWIGhMy/37LJ8heI0W1B+ofTA5n34/RU8UXH3SCkj2AK6Ao5 +H2u8vbmuWKUCiECmrw35EeKGmtuK/bWJzx3KBP7fx5J9S3mWUgT4W4xlWNN9RWoU +sSvH1ppie5ARINVaAWl5k44fk60ahTf80DbQBIOZBmQn7myZZka+yGcQbAiZZ1Gc +0l8+Nf5Ao1ckmuyY5o8FyWdsyDeK3+MqjPn5Rr1CqbKCn2VnqrVWbI33Eyu8c96U +bxVgU5H1BDhNjJC8UrT3LFPvJMO8p3a0IJ3eHydjk2jVOhOdBZmA0yoqUTrhPpXq +ymIHESjDJR8TDe4TCfb46o9oEC3cdbDwgnzPqdg0n+0uIsJLYiU= +=gl+l -----END PGP SIGNATURE----- diff --git a/.gitignore b/.gitignore index 7fccc6f..41d505c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,18 +1,14 @@ Makefile buildpkg.sh config.h -config.h.in config.h.in~ config.log config.status -configure -aclocal.m4 openbsd-compat/Makefile openbsd-compat/regress/Makefile openssh.xml opensshd.init survey.sh -**/*.0 **/*.o **/*.lo **/*.so @@ -36,3 +32,4 @@ sshd !regress/misc/fuzz-harness/Makefile !regress/unittests/sshsig/Makefile tags + diff --git a/.skipped-commit-ids b/.skipped-commit-ids index 0630395..ec7831e 100644 --- a/.skipped-commit-ids +++ b/.skipped-commit-ids @@ -29,6 +29,14 @@ f9a0726d957cf10692a231996a1f34e7f9cdfeb0 moduli update 1e0a2692b7e20b126dda60bf04999d1d30d959d8 sshd relinking makefile changes e1dc11143f83082e3154d6094f9136d0dc2637ad more relinking makefile tweaks 5a636f6ca7f25bfe775df4952f7aac90a7fcbbee moduli update +ef9341d5a50f0d33e3a6fbe995e92964bc7ef2d3 Makefile relinking changes +2fe8d707ae35ba23c7916adcb818bb5b66837ba0 ssh-agent relink kit +866cfcc1955aef8f3fc32da0b70c353a1b859f2e ssh-agent relink changes +8b3820adb4da4e139c4b3cffbcc0bde9f08bf0c6 sshd-session relink kit +6d2ded4cd91d4d727c2b26e099b91ea935bed504 relink kit +fb39324748824cb0387e9d67c41d1bef945c54ea Makefile change +5f378c38ad8976d507786dc4db9283a879ec8cd0 Makefile change +112aacedd3b61cc5c34b1fa6d9fb759214179172 Makefile change Old upstream tree: diff --git a/ChangeLog b/ChangeLog index 3bbccf5..c085866 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,8300 +1,8676 @@ -commit 86bdd3853f4d32c85e295e6216a2fe0953ad93f0 -Author: Damien Miller -Date: Mon Mar 11 16:20:49 2024 +1100 - - version number in README - -commit 282721418e6465bc39ccfd39bb0133e670ee4423 +commit 46d1fb16b20e971b9ac15e86a3d3e350b49c9ad6 Author: Damien Miller -Date: Mon Mar 11 16:20:08 2024 +1100 +Date: Fri Sep 20 08:20:13 2024 +1000 - crank RPM spec versions + update version numbers -commit 3876a3bbd2ca84d23ba20f8b69ba83270c04ce3a +commit 0bdca1f218971b38728a0a129f482476baff0968 Author: djm@openbsd.org -Date: Mon Mar 11 04:59:47 2024 +0000 +Date: Thu Sep 19 22:17:44 2024 +0000 - upstream: openssh-9.7 + upstream: openssh-9.9 - OpenBSD-Commit-ID: 618ececf58b8cdae016b149787af06240f7b0cbc + OpenBSD-Commit-ID: 303417285f1a73b9cb7a2ae78d3f493bbbe31f98 -commit 8fc109cc614954a8eb2738c48c0db36a62af9a06 -Author: Darren Tucker -Date: Mon Mar 11 12:59:26 2024 +1100 +commit ef2d7f2d3e1b4c9ae71bacf963e76a92ab8be543 +Author: Damien Miller +Date: Wed Sep 18 16:03:23 2024 +1000 - Test against current OpenSSL and LibreSSL releases. - - Add LibreSSL 3.9.0, bump older branches to their respective current - releases. + include openbsd-compat/base64.c license in LICENSE -commit 26b09b45fec7b88ba09042c09be4157e58e231e2 +commit 7ef362b989c8d1f7596f557f22e5924b9c08f0ea Author: Damien Miller -Date: Sun Mar 10 16:24:57 2024 +1100 +Date: Wed Sep 18 09:01:23 2024 +1000 - quote regexes used to test for algorithm support - - Fixes test failures on Solaris 8 reported by Tom G. Christensen + conditionally include mman.h in arc4random code -commit a6a740a4948d10a622b505135bb485c10f21db5e -Author: djm@openbsd.org -Date: Sat Mar 9 05:12:13 2024 +0000 +commit 5fb2b5ad0e748732a27fd8cc16a7ca3c21770806 +Author: Damien Miller +Date: Tue Sep 17 11:53:24 2024 +1000 - upstream: avoid logging in signal handler by converting mainloop to - - ppoll() bz3670, reported by Ben Hamilton; ok dtucker@ + fix bug in recently-added sntrup761 fuzzer - OpenBSD-Commit-ID: e58f18042b86425405ca09e6e9d7dfa1df9f5f7f + key values need to be static to persist across invocations; + spotted by the Qualys Security Advisory team. -commit cd82f7526e0481720567ae41db7849ab1c27e27b +commit 0ca128c9ee894f1b0067abd473bfb33171df67f8 Author: djm@openbsd.org -Date: Fri Mar 8 22:16:32 2024 +0000 +Date: Mon Sep 16 05:37:05 2024 +0000 - upstream: skip more whitespace, fixes find-principals on + upstream: use 64 bit math to avoid signed underflow. upstream code - allowed_signers files with blank lines; reported by Wiktor Kwapisiewicz + relies on using -fwrapv to provide defined over/underflow behaviour, but we + use -ftrapv to catch integer errors and abort the program. ok dtucker@ - OpenBSD-Commit-ID: b3a22a2afd753d70766f34bc7f309c03706b5298 + OpenBSD-Commit-ID: 8933369b33c17b5f02479503d0a92d87bc3a574b -commit 2f9d2af5cb19905d87f37d1e11c9f035ac5daf3b -Author: dtucker@openbsd.org -Date: Fri Mar 8 11:34:10 2024 +0000 +commit f82e5e22cad88c81d8a117de74241328c7b101c3 +Author: jmc@openbsd.org +Date: Sun Sep 15 08:27:38 2024 +0000 - upstream: Invoke ProxyCommand that uses stderr redirection via + upstream: minor grammar/sort fixes for refuseconnection; ok djm - $TEST_SHELL. Fixes test when run by a user whose login shell is tcsh. - Found by vinschen at redhat.com. - - OpenBSD-Regress-ID: f68d79e7f00caa8d216ebe00ee5f0adbb944062a + OpenBSD-Commit-ID: 1c81f37b138b8b66abba811fec836388a0f3e6da -commit 9b3f0beb4007a7e01dfedabb429097fb593deae6 -Author: Darren Tucker -Date: Thu Mar 7 17:18:14 2024 +1100 +commit 0c1165fc78e8fe69b5df71f81a8f944554a68b53 +Author: Damien Miller +Date: Sun Sep 15 13:30:13 2024 +1000 - Prefer openssl binary from --with-ssl-dir directory. - - Use openssl in the directory specified by --with-ssl-dir as long - as it's functional. Reported by The Doctor. + avoid gcc warning in fuzz test -commit c47e1c9c7911f38b2fc2fb01b1f6ae3a3121a838 +commit ce171d0718104b643854b53443ff72f7283d33f2 Author: djm@openbsd.org -Date: Wed Mar 6 02:59:59 2024 +0000 +Date: Sun Sep 15 03:09:44 2024 +0000 - upstream: fix memory leak in mux proxy mode when requesting forwarding. - - found by RASU JSC, reported by Maks Mishin in GHPR#467 + upstream: bad whitespace in config dump output - OpenBSD-Commit-ID: 97d96a166b1ad4b8d229864a553e3e56d3116860 + OpenBSD-Commit-ID: d899c13b0e8061d209298eaf58fe53e3643e967c -commit 242742827fea4508e68097c128e802edc79addb5 -Author: djm@openbsd.org -Date: Wed Mar 6 00:31:04 2024 +0000 +commit 671c440786a5a66216922f15d0007b60f1e6733f +Author: Damien Miller +Date: Sun Sep 15 12:53:59 2024 +1000 - upstream: wrap a few PKCS#11-specific bits in ENABLE_PKCS11 + use construct_utmp to construct btmp records - OpenBSD-Commit-ID: 463e4a69eef3426a43a2b922c4e7b2011885d923 + Simpler and removes some code with the old-style BSD license. -commit d52b6509210e2043f33e5a1de58dd4a0d5d48c2a -Author: Damien Miller -Date: Wed Mar 6 11:31:36 2024 +1100 +commit 930cb02b6113df72fbc732b9feb8e4f490952a81 +Author: djm@openbsd.org +Date: Sun Sep 15 02:20:51 2024 +0000 - disable RSA tests when algorithm is not supported + upstream: update the Streamlined NTRU Prime code from the "ref" - Unbreaks "make test" when compiled --without-openssl. + implementation in SUPERCOP 20201130 to the "compact" implementation in + SUPERCOP 20240808. The new version is substantially faster. Thanks to Daniel + J Bernstein for pointing out the new implementation (and of course for + writing it). - Similar treatment to how we do DSA and ECDSA. - -commit 668d270a6c77e8b5a1da26ecad2e6de9f62c8fe4 -Author: Damien Miller -Date: Wed Mar 6 10:33:20 2024 +1100 - - add a --without-retpoline configure option + tested in snaps/ok deraadt@ - discussed with deraadt and dtucker a while ago + OpenBSD-Commit-ID: bf1a77924c125ecdbf03e2f3df8ad13bd3dafdcb -commit 3deb501f86fc47e175ef6a3eaba9b9846a80d444 +commit 9306d6017e0ce5dea6824c29ca5ba5673c2923ad Author: djm@openbsd.org -Date: Mon Mar 4 04:13:18 2024 +0000 +Date: Sun Sep 15 01:19:56 2024 +0000 - upstream: fix leak of CanonicalizePermittedCNAMEs on error path; - - spotted by Coverity (CID 438039) + upstream: document Match invalid-user - OpenBSD-Commit-ID: 208839699939721f452a4418afc028a9f9d3d8af + OpenBSD-Commit-ID: 2c84a9b517283e9711e2812c1f268081dcb02081 -commit 65a44a8a4f7d902a64d4e60eda84384b2e2a24a2 +commit 0118a4da21147a88a56dc8b90bbc2849fefd5c1e Author: djm@openbsd.org -Date: Mon Mar 4 02:16:11 2024 +0000 +Date: Sun Sep 15 01:18:26 2024 +0000 - upstream: Separate parsing of string array options from applying them + upstream: add a "Match invalid-user" predicate to sshd_config Match - to the active configuration. This fixes the config parser from erroneously - rejecting cases like: + options. - AuthenticationMethods password - Match User ivy - AuthenticationMethods any + This allows writing Match conditions that trigger for invalid username. + E.g. - bz3657 ok markus@ + PerSourcePenalties refuseconnection:90s + Match invalid-user + RefuseConnection yes - OpenBSD-Commit-ID: 7f196cba634c2a3dba115f3fac3c4635a2199491 - -commit 6886e1b1f55c90942e4e6deed930f8ac32e0f938 -Author: Darren Tucker -Date: Thu Feb 22 17:59:35 2024 +1100 - - Add nbsd10 test target. - -commit d86bf8a3f6ea4fa7887406c2aa9959db71fa41be -Author: Damien Miller -Date: Thu Feb 22 12:06:10 2024 +1100 - - more descriptive configure test name - -commit 9ee335aacc9f5bdc4cc2c19fafb45e27be7d234e -Author: djm@openbsd.org -Date: Wed Feb 21 06:17:29 2024 +0000 - - upstream: explain arguments of internal-sftp GHPR#454 from Niklas + Will effectively penalise bots try to guess passwords for bogus accounts, + at the cost of implicitly revealing which accounts are invalid. - Hambüchen - MIME-Version: 1.0 - Content-Type: text/plain; charset=UTF-8 - Content-Transfer-Encoding: 8bit + feedback markus@ - OpenBSD-Commit-ID: 0335d641ae6b5b6201b9ffd5dd06345ebbd0a3f3 + OpenBSD-Commit-ID: 93d3a46ca04bbd9d84a94d1e1d9d3a21073fbb07 -commit d1164cb1001dd208fee88aaa9b43d5e6fd917274 +commit 7875975136f275619427604900cb0ffd7020e845 Author: djm@openbsd.org -Date: Wed Feb 21 06:06:43 2024 +0000 +Date: Sun Sep 15 01:11:26 2024 +0000 - upstream: clarify permissions requirements for ChrootDirectory Part + upstream: Add a "refuseconnection" penalty class to sshd_config - of GHPR#454 from Niklas Hambüchen - MIME-Version: 1.0 - Content-Type: text/plain; charset=UTF-8 - Content-Transfer-Encoding: 8bit + PerSourcePenalties - OpenBSD-Commit-ID: d37bc8786317a11649c62ff5e2936441186ef7a0 + This allows penalising connection sources that have had connections + dropped by the RefuseConnection option. ok markus@ + + OpenBSD-Commit-ID: 3c8443c427470bb3eac1880aa075cb4864463cb6 -commit d410e17d186552d0717f18217d0d049486754365 +commit 8d21713b669b8516ca6d43424a356fccc37212bb Author: djm@openbsd.org -Date: Wed Feb 21 06:05:06 2024 +0000 +Date: Sun Sep 15 01:09:40 2024 +0000 - upstream: .Cm for a keyword. Part of GHPR#454 from Niklas Hambüchen + upstream: Add a sshd_config "RefuseConnection" option - OpenBSD-Commit-ID: d59c52559f926fa82859035d79749fbb4a3ce18a + If set, this will terminate the connection at the first authentication + request (this is the earliest we can evaluate sshd_config Match blocks) + + ok markus@ + + OpenBSD-Commit-ID: 43cc2533984074c44d0d2f92eb93f661e7a0b09c -commit ab73f9678ebf06b32d6361b88b50b42775e0565b +commit acad117e66018fe1fa5caf41b36e6dfbd61f76a1 Author: djm@openbsd.org -Date: Wed Feb 21 06:01:13 2024 +0000 +Date: Sun Sep 15 00:58:01 2024 +0000 - upstream: fix typo in match directive predicate (s/tagged/tag) GHPR#462 + upstream: switch sshd_config Match processing to the argv tokeniser - from Tobias Manske + too; ok markus@ - OpenBSD-Commit-ID: 05b23b772677d48aa82eefd7ebebd369ae758908 + OpenBSD-Commit-ID: b74b5b0385f2e0379670e2b869318a65b0bc3923 -commit 9844aa2521ccfb1a2d73745680327b79e0574445 +commit baec3f7f4c60cd5aa1bb9adbeb6dfa4a172502a8 Author: djm@openbsd.org -Date: Wed Feb 21 05:57:34 2024 +0000 +Date: Sun Sep 15 00:57:36 2024 +0000 - upstream: fix proxy multiplexing mode, broken when keystroke timing + upstream: switch "Match" directive processing over to the argv - obfuscation was added. GHPR#463 from montag451 + string tokeniser, making it possible to use shell-like quoting in Match + directives, particularly "Match exec". ok markus@ - OpenBSD-Commit-ID: 4e412d59b3f557d431f1d81c715a3bc0491cc677 + OpenBSD-Commit-ID: 0877309650b76f624b2194c35dbacaf065e769a5 -commit ee6d932acb532f80b11bb7cf161668c70ec8a117 +commit dd424d7c382c2074ab70f1b8ad4f169a10f60ee7 Author: djm@openbsd.org -Date: Tue Feb 20 04:10:03 2024 +0000 +Date: Sun Sep 15 00:47:01 2024 +0000 - upstream: don't append a gratuitous space to the end of subsystem + upstream: include pathname in some of the ssh-keygen passphrase - arguments; bz3667 + prompts. Helps the user know what's going on when ssh-keygen is invoked via + other tools. Requested in GHPR503 - OpenBSD-Commit-ID: e11023aeb3f30b77a674e37b8292c862926d5dc6 + OpenBSD-Commit-ID: 613b0bb6cf845b7e787d69a5b314057ceda6a8b6 -commit e27f032aa8fcbae9b2e7c451baaf4b8ac6fa3d45 -Author: dtucker@openbsd.org -Date: Mon Feb 19 09:25:52 2024 +0000 +commit 62bbf8f825cc390ecb0523752ddac1435006f206 +Author: djm@openbsd.org +Date: Sun Sep 15 00:41:18 2024 +0000 - upstream: Always define puttysetup function. + upstream: Do not apply authorized_keys options when signature - OpenBSD-Regress-ID: b4c0ccfa4006a1bc5dfd99ccf21c854d3ce2aee0 + verification fails. Prevents restrictive key options being incorrectly + applied to subsequent keys in authorized_keys. bz3733, ok markus@ + + OpenBSD-Commit-ID: ba3776d9da4642443c19dbc015a1333622eb5a4e -commit 84046f9991abef5f46b040b10cf3d494f933a17b -Author: dtucker@openbsd.org -Date: Fri Feb 9 08:56:59 2024 +0000 +commit 49f325fd47af4e53fcd7aafdbcc280e53f5aa5ce +Author: Wu Weixin +Date: Fri Aug 2 22:16:40 2024 +0800 - upstream: Exapnd PuTTY test coverage. - - Expand the set of ciphers, MACs and KEX methods in the PuTTY interop - tests. + Fix without_openssl always being set to 1 - OpenBSD-Regress-ID: dd28d97d48efe7329a396d0d505ee2907bf7fc57 + In Fedora systems, %{?rhel} is empty. In RHEL systems, %{?fedora} is + empty. Therefore, the original code always sets without_openssl to 1. -commit bbf541ee2afe07b08a8b56fa0dc6f38fcfceef2a -Author: dtucker@openbsd.org -Date: Fri Feb 9 08:47:42 2024 +0000 +commit c21c3a2419bbc1c59cb1a16ea356e703e99a90d9 +Author: djm@openbsd.org +Date: Thu Sep 12 00:36:27 2024 +0000 - upstream: Factor out PuTTY setup. + upstream: Relax absolute path requirement back to what it was prior to - Factor out PuTTY and call only when needed. - - This allows us to avoid PuTTY key setup when it's not needed, which - speeds up the overall test run by a couple of percent. + OpenSSH 9.8, which incorrectly required that sshd was started with an + absolute path in inetd mode. bz3717, patch from Colin Wilson - OpenBSD-Regress-ID: c25eaccc3c91bc874400f7c85ce40e9032358c1c + OpenBSD-Commit-ID: 25c57f22764897242d942853f8cccc5e991ea058 -commit d31c21c57fb4245271680a1e5043cf6470a96766 +commit 1bc426f51b0a5cfdcfbd205218f0b6839ffe91e9 Author: naddy@openbsd.org -Date: Sat Feb 10 11:28:52 2024 +0000 - - upstream: clean sshd random relinking kit; ok miod@ - - OpenBSD-Commit-ID: 509bb19bb9762a4b3b589af98bac2e730541b6d4 - -commit 4dbc5a363ff53a2fcecf6bc3bcc038badc12f118 -Author: djm@openbsd.org -Date: Fri Feb 2 00:13:34 2024 +0000 +Date: Mon Sep 9 14:41:21 2024 +0000 - upstream: whitespace + upstream: document the mlkem768x25519-sha256 key exchange algorithm - OpenBSD-Commit-ID: b24680bc755b621ea801ff8edf6f0f02b68edae1 + OpenBSD-Commit-ID: fa18dccdd9753dd287e62ecab189b3de45672521 -commit efde85dda2130272af24cc346f6c3cd326182ff1 +commit 0a2db61a5ffc64d2e2961c52964f933879952fc7 Author: Darren Tucker -Date: Mon Feb 19 17:29:31 2024 +1100 +Date: Tue Sep 10 21:11:14 2024 +1000 - Improve error message for OpenSSL header check. - - bz#3668, ok djm@ + Spell omnios test host correctly. -commit cbbdf868bce431a59e2fa36ca244d5739429408d +commit 059ed698a47c9af541a49cf754fd09f984ac5a21 Author: Darren Tucker -Date: Wed Feb 7 13:45:02 2024 +1100 +Date: Tue Sep 10 18:52:02 2024 +1000 - Interop test against PuTTY snapshot and releases. + Add omnios test target. -commit 91898bf786b0f149f962c4c96c08a46f29888c10 +commit f4ff91575a448b19176ceaa8fd6843a25f39d572 Author: Darren Tucker -Date: Tue Feb 6 16:21:05 2024 +1100 +Date: Tue Sep 10 18:45:55 2024 +1000 - Put privsep dir on OS X on /usr/local. - - On some runners we can't create /var/empty, so put it some place we can - write. Should fix test breakage on Max OS X 11. + Wrap stdint.h in ifdef. -commit be5ed8ebed8388c5056bfde4688308cc873c18b9 +commit ff714f001d20a9c843ee1fd9d92a16d40567d264 Author: Darren Tucker -Date: Tue Feb 6 11:19:42 2024 +1100 +Date: Mon Sep 9 19:31:54 2024 +1000 - Add --disable-fd-passing option. - - .. and enable for the minix3 test VM. This will cause it to more reliably - skip tests that need FD passing and should fix the current test breakage. + Also test PAM on dfly64. -commit 0f6a8a0d0a518fd78c4cbebfdac990a57a1c4e41 -Author: Darren Tucker -Date: Tue Feb 6 11:18:44 2024 +1100 +commit 509b757c052ea969b3a41fc36818b44801caf1cf +Author: Damien Miller +Date: Mon Sep 9 21:50:14 2024 +1000 - Use "skip" function instead doing it ourselves. + stubs for ML-KEM KEX functions + + used for C89 compilers -commit 3ad669f81aabbd2ba9fbd472903f680f598e1e99 +commit 273581210c99ce7275b8efdefbb9f89e1c22e341 Author: Damien Miller -Date: Thu Feb 1 14:01:18 2024 +1100 +Date: Mon Sep 9 17:30:38 2024 +1000 - ignore some vim droppings + declare defeat trying to detect C89 compilers + + I can't find a reliable way to detect the features the ML-KEM code + requires in configure. Give up for now and use VLA support (that we + can detect) as a proxy for "old compiler" and turn off ML-KEM if + it isn't supported. -commit c283f29d23611a06bbee06bcf458f2fffad721d9 -Author: djm@openbsd.org -Date: Thu Feb 1 02:37:33 2024 +0000 +commit e8a0f19b56dfa20f98ea9876d7171ec315fb338a +Author: Damien Miller +Date: Mon Sep 9 16:46:40 2024 +1000 - upstream: whitespace + fix previous; check for C99 compound literals - OpenBSD-Commit-ID: bf9e4a1049562ee4322684fbdce07142f04fdbb7 + The previous commit was incorrect (or at least insufficient), the + ML-KEM code is actually using compound literals, so test for them. -commit 0d96b1506b2f4757fefa5d1f884d49e96a6fd4c3 +commit 7c07bec1446978bebe0780ed822c8fedfb377ae8 Author: Damien Miller -Date: Tue Jan 16 14:40:18 2024 +1100 +Date: Mon Sep 9 16:06:21 2024 +1000 - skip tests that use multiplexing on Windows + test for compiler feature needed for ML-KEM - Some tests here use multiplexing, skip these if DISABLE_FD_PASSING - is set. Should unbreak tests on Windows. + The ML-KEM implementation we uses need the compiler to support + C99-style named struct initialisers (e.g foo = {.bar = 1}). We + still support (barely) building OpenSSH with older compilers, so + add a configure test for this. -commit 50080fa42f5f744b798ee29400c0710f1b59f50e +commit d469d5f348772058789d35332d1ccb0b109c28ef Author: djm@openbsd.org -Date: Thu Jan 11 04:50:28 2024 +0000 +Date: Mon Sep 9 03:13:39 2024 +0000 - upstream: don't disable RSA test when DSA is disabled; bug introduced - - in last commit + upstream: test mlkem768x25519-sha256 - OpenBSD-Regress-ID: 8780a7250bf742b33010e9336359a1c516f2d7b5 + OpenBSD-Regress-ID: 7baf6bc39ae55648db1a2bfdc55a624954847611 -commit 415c94ce17288e0cdcb9e58cc91fba78d33c8457 +commit 62fb2b51bb7f6863c3ab697f397b2068da1c993f Author: djm@openbsd.org -Date: Thu Jan 11 01:45:58 2024 +0000 +Date: Mon Sep 9 02:39:57 2024 +0000 - upstream: make DSA testing optional, defaulting to on + upstream: pull post-quantum ML-KEM/x25519 key exchange out from - ok markus + compile-time flag now than an IANA codepoint has been assigned for the + algorithm. - OpenBSD-Regress-ID: dfc27b5574e3f19dc4043395594cea5f90b8572a + Add mlkem768x25519-sha256 in 2nd KexAlgorithms preference slot. + + ok markus@ + + OpenBSD-Commit-ID: 9f50a0fae7d7ae8b27fcca11f8dc6f979207451a -commit f9311e8921d92c5efca767227a497ab63280ac39 +commit a8ad7a2952111c6ce32949a775df94286550af6b Author: djm@openbsd.org -Date: Thu Jan 11 01:51:16 2024 +0000 +Date: Fri Sep 6 02:30:44 2024 +0000 - upstream: ensure key_fd is filled when DSA is disabled; spotted by + upstream: make parsing user@host consistently look for the last '@' in - tb@ + the string rather than the first. This makes it possible to use usernames + that contain '@' characters. + MIME-Version: 1.0 + Content-Type: text/plain; charset=UTF-8 + Content-Transfer-Encoding: 8bit - OpenBSD-Commit-ID: 9dd417b6eec3cf67e870f147464a8d93f076dce7 + Prompted by Max Zettlmeißl; feedback/ok millert@ + + OpenBSD-Commit-ID: 0b16eec246cda15469ebdcf3b1e2479810e394c5 -commit 4e838120a759d187b036036610402cbda33f3203 +commit 13cc78d016b67a74a67f1c97c7c348084cd9212c Author: djm@openbsd.org -Date: Thu Jan 11 01:45:36 2024 +0000 +Date: Wed Sep 4 05:33:34 2024 +0000 - upstream: make DSA key support compile-time optional, defaulting to + upstream: be more strict in parsing key type names. Only allow - on + shortnames (e.g "rsa") in user-interface code and require full SSH protocol + names (e.g. "ssh-rsa") everywhere else. - ok markus@ + Prompted by bz3725; ok markus@ - OpenBSD-Commit-ID: 4f8e98fc1fd6de399d0921d5b31b3127a03f581d + OpenBSD-Commit-ID: b3d8de9dac37992eab78adbf84fab2fe0d84b187 -commit afcc9028bfc411bc26d20bba803b83f90cb84e26 +commit ef8472309a68e319018def6f8ea47aeb40d806f5 +Author: djm@openbsd.org +Date: Wed Sep 4 05:11:33 2024 +0000 + + upstream: fix RCSID in output + + OpenBSD-Commit-ID: 889ae07f2d2193ddc4351711919134664951dd76 + +commit ba2ef20c75c5268d4d1257adfc2ac11c930d31e1 Author: jmc@openbsd.org -Date: Wed Jan 10 06:33:13 2024 +0000 +Date: Tue Sep 3 06:17:48 2024 +0000 - upstream: fix incorrect capitalisation; + upstream: envrionment -> environment; - OpenBSD-Commit-ID: cb07eb06e15fa2334660ac73e98f29b6a1931984 + OpenBSD-Commit-ID: b719f39c20e8c671ec6135c832d6cc67a595af9c -commit 9707c8170c0c1baeb1e06e5a53f604498193885f +commit e66c0c5673a4304a3a9fbf8305c6a19f8653740f +Author: Damien Miller +Date: Wed Sep 4 15:35:29 2024 +1000 + + add basic fuzzers for our import of sntrup761 + +commit d19dea6330ecd4eb403fef2423bd7e127f4c9828 Author: djm@openbsd.org -Date: Tue Jan 9 22:19:36 2024 +0000 +Date: Tue Sep 3 05:58:56 2024 +0000 - upstream: extend ChannelTimeout regression test to exercise multiplexed - - connections and the new "global" timeout type. ok dtucker@ + upstream: regression test for Include variable expansion - OpenBSD-Regress-ID: f10d19f697024e9941acad7c2057f73d6eacb8a2 + OpenBSD-Regress-ID: 35477da3ba1abd9ca64bc49080c50a9c1350c6ca -commit b31b12d28de96e1d43581d32f34da8db27e11c03 +commit 8c4d6a628051e318bae2f283e8dc38b896400862 Author: djm@openbsd.org -Date: Tue Jan 9 22:19:00 2024 +0000 +Date: Tue Sep 3 05:29:55 2024 +0000 - upstream: add a "global" ChannelTimeout type to ssh(1) and sshd(8) - - that watches all open channels and will close all open channels if there is - no traffic on any of them for the specified interval. This is in addition to - the existing per-channel timeouts added a few releases ago. + upstream: allow the "Include" directive to expand the same set of - This supports use-cases like having a session + x11 forwarding channel - open where one may be idle for an extended period but the other is - actively used. The global timeout would allow closing both channels when - both have been idle for too long. + %-tokens that "Match Exec" and environment variables. ok dtucker@ - OpenBSD-Commit-ID: 0054157d24d2eaa5dc1a9a9859afefc13d1d7eb3 + OpenBSD-Commit-ID: 12ef521eaa966a9241e684258564f52f1f3c5d37 -commit 602f4beeeda5bb0eca181f8753d923a2997d0a51 +commit 51b82648b6827675fc0cde21175fd1ed8e89aab2 Author: djm@openbsd.org -Date: Tue Jan 9 21:39:14 2024 +0000 +Date: Mon Sep 2 12:18:35 2024 +0000 - upstream: adapt ssh_api.c code for kex-strict - - from markus@ ok me + upstream: missing ifdef - OpenBSD-Commit-ID: 4d9f256852af2a5b882b12cae9447f8f00f933ac - -commit 42ba34aba8708cf96583ff52975d95a8b47d990d -Author: Damien Miller -Date: Mon Jan 8 16:26:37 2024 +1100 - - nite that recent OSX tun/tap is unsupported + OpenBSD-Commit-ID: 85f09da957dd39fd0abe08fe5ee19393f25c2021 -commit 690bc125f9a3b20e47745fa8f5b5e1fd5820247f -Author: Sevan Janiyan -Date: Wed Dec 27 04:57:49 2023 +0000 +commit f68312eb593943127b39ba79a4d7fa438c34c153 +Author: djm@openbsd.org +Date: Mon Sep 2 12:13:56 2024 +0000 - README.platform: update tuntap url + upstream: Add experimental support for hybrid post-quantum key exchange + + ML-KEM768 with ECDH/X25519 from the Internet-draft: + https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 + + This is based on previous patches from markus@ but adapted to use the + final FIPS203 standard ML-KEM using a formally-verified implementation + from libcrux. + + Note this key exchange method is still a draft and thus subject to + change. It is therefore disabled by default; set MLKEM=yes to build it. + We're making it available now to make it easy for other SSH + implementations to test against it. + + ok markus@ deraadt@ + + OpenBSD-Commit-ID: 02a8730a570b63fa8acd9913ec66353735dea42c -commit 6b8be2ccd7dd091808f86af52066b0c2ec30483a -Author: Rose <83477269+AtariDreams@users.noreply.github.com> -Date: Tue Dec 19 11:48:20 2023 -0500 +commit 05f2b141cfcc60c7cdedf9450d2b9d390c19eaad +Author: Antonio Larrosa +Date: Fri Aug 23 12:21:06 2024 +0200 - Fix compilation error in ssh-pcks11-client.c + Don't skip audit before exitting cleanup_exit - Compilation fails becaus of an undefined reference to helper_by_ec, - because we forgot the preprocessor conditional that excludes that function - from being called in unsupported configurations. + This fixes an issue where the SSH_CONNECTION_ABANDON event is not + audited because cleanup_exit overrides the regular _exit too soon and + as a result, failed auth attempts are not logged correctly. + + The problem was introduced in 81c1099d22b81ebfd20a334ce986c4f753b0db29 + where the code from upstream was merged before the audit_event call when + it should have been merged right before the _exit call in order to honor + the comment that just mentions an override of the exit value. -commit 219c8134157744886ee6ac5b8c1650abcd981f4c +commit 16eaf9d401e70996f89f3f417738a8db421aa959 Author: djm@openbsd.org -Date: Mon Jan 8 05:11:18 2024 +0000 +Date: Wed Aug 28 12:08:26 2024 +0000 - upstream: Remove outdated note from PROTOCOL.mux - - Port forward close by control master is already implemented - by `mux_master_process_close_fwd` in `mux.c` + upstream: fix test: -F is the argument to specify a non-default - GHPR442 from bigb4ng + ssh_config, not -f (this is sadly not a new bug) - OpenBSD-Commit-ID: ad0734fe5916d2dc7dd02b588906cea4df0482fb + OpenBSD-Regress-ID: 45a7bda4cf33f2cea218507d8b6a55cddbcfb322 -commit 4c3cf362631ccc4ffd422e572f075d5d594feace -Author: djm@openbsd.org -Date: Mon Jan 8 05:05:15 2024 +0000 +commit 10ccf611ab8ecba9ce6b0548c5ccd8c1220baf92 +Author: deraadt@openbsd.org +Date: Fri Aug 23 04:51:00 2024 +0000 - upstream: fix missing field in users-groups-by-id@openssh.com reply - - documentation + upstream: As defined in the RFC, the SSH protocol has negotiable - GHPR441 from TJ Saunders + compression support (which is requested as the name "zlib"). Compression + starts very early in the session. Relative early in OpenSSH lifetime, privsep + was added to sshd, and this required a shared-memory hack so the two + processes could see what was going on in the dataflow. This shared-memory + hack was soon recognized as a tremendous complexity risk, because it put libz + (which very much trusts it's memory) in a dangerous place, and a new option + ("zlib@openssh.com") was added begins compression after authentication (aka + delayed-compression). That change also permitted removal of the + shared-memory hack. Despite removal from the server, the old "zlib" support + remained in the client, to allow negotiation with non-OpenSSH daemons which + lack the delayed-compression option. This commit deletes support for the + older "zlib" option in the client. It reduces our featureset in a small way, + and encourages other servers to move to a better design. The SSH protocol is + different enough that compressed-key-material attacks like BEAST are + unlikely, but who wants to take the chance? We encourage other ssh servers + who care about optional compression support to add delayed-zlib support. + (Some already do "zlib@openssh.com") ok djm markus - OpenBSD-Commit-ID: ff5733ff6ef4cd24e0758ebeed557aa91184c674 + OpenBSD-Commit-ID: 6df986f38e4ab389f795a6e39e7c6857a763ba72 -commit f64cede2a3c298b50a2659a8b53eb3ab2c0b8d23 +commit aee54878255d71bf93aa6e91bbd4eb1825c0d1b9 Author: djm@openbsd.org -Date: Mon Jan 8 04:10:03 2024 +0000 +Date: Thu Aug 22 23:11:30 2024 +0000 - upstream: make kex-strict section more explicit about its intent: + upstream: sntrup761x25519-sha512 now has an IANA codepoint assigned, so - banning all messages not strictly required in KEX + we can make the algorithm available without the @openssh.com suffix too. ok + markus@ deraadt@ - OpenBSD-Commit-ID: fc33a2d7f3b7013a7fb7500bdbaa8254ebc88116 + OpenBSD-Commit-ID: eeed8fcde688143a737729d3d56d20ab4353770f -commit 698fe6fd61cbcb8e3e0e874a561d4335a49fbde5 -Author: Damien Miller -Date: Mon Jan 8 14:46:19 2024 +1100 +commit a76a6b85108e3032c8175611ecc5746e7131f876 +Author: Darren Tucker +Date: Thu Aug 22 20:36:12 2024 +1000 - update fuzzer example makefile to clang16 + Move rekey test into valgrind-2. + + Now that the rekey test has been optimized it's fast enough to not be in + its own valgrind test, so move it into valgrind-2, which is currently + the quickest of the others, bringing all of them to roughly the same + runtime of ~1.1 hours. -commit fc332cb2d602c60983a8ec9f89412754ace06425 -Author: Damien Miller -Date: Mon Jan 8 14:45:49 2024 +1100 +commit 7e75e3f57c41b9a6e6401e7674d7c2ff5c33975b +Author: dtucker@openbsd.org +Date: Thu Aug 22 10:21:02 2024 +0000 - unbreak fuzzers - missing pkcs11_make_cert() + upstream: Use aes128-ctr for MAC tests since default has implicit MAC. - provide stub for use in fuzzer harness + Also verify that the Cipher or MAC we intended to use is actually the one + selected during the test. + + OpenBSD-Regress-ID: ff43fed30552afe23d1364526fe8cf88cbfafe1d -commit 9ea0a4524ae3276546248a926b6641b2fbc8421b +commit ebc890b8b4ba08c84cd1066b7b94b2b11f6c4cb4 Author: Damien Miller -Date: Mon Jan 8 14:45:14 2024 +1100 +Date: Thu Aug 22 09:45:49 2024 +1000 - unbreak fuzzers for clang16 + fix incorrect default for PasswordAuthentication - getopt() needs a throw() attribute to compile, so supply one when compiling - things with C++ + merge botch spotted by gsgleason -commit a72833d00788ef91100c643536ac08ada46440e1 -Author: djm@openbsd.org -Date: Mon Jan 8 00:34:33 2024 +0000 +commit 15ace435ea1c2fab2a1cc7d9c3157fe20c776b80 +Author: dtucker@openbsd.org +Date: Wed Aug 21 10:33:27 2024 +0000 - upstream: remove ext-info-* in the kex.c code, not in callers; + upstream: Some awks won't match on the \r so delete it instead. Fixes - with/ok markus@ + regress in portable on, eg Solaris. - OpenBSD-Commit-ID: c06fe2d3a0605c517ff7d65e38ec7b2d1b0b2799 + OpenBSD-Regress-ID: 44a96d6d2f8341d89b7d5fff777502b92ac9e9ba -commit 86f9e96d9bcfd1f5cd4bf8fb57a9b4c242df67df -Author: djm@openbsd.org -Date: Mon Jan 8 00:30:39 2024 +0000 +commit 51c96b6ed627779a04493a8fe25747996a37f3c2 +Author: dtucker@openbsd.org +Date: Wed Aug 21 07:06:27 2024 +0000 - upstream: fix typo; spotted by Albert Chin + upstream: Import regenerated moduli. - OpenBSD-Commit-ID: 77140b520a43375b886e535eb8bd842a268f9368 + OpenBSD-Commit-ID: 5db7049ad5558dee5b2079d3422e8ddab187c1cc -commit f0cbd26ec91bd49719fb3eea7ca44d2380318b9a +commit 25c52f37a82c4da48ec537de37d7c168982b8d6d Author: dtucker@openbsd.org -Date: Thu Jan 4 09:51:49 2024 +0000 +Date: Wed Aug 21 06:59:08 2024 +0000 - upstream: Import regenerated moduli. + upstream: Use curve25519-sha256 kex where possible. - OpenBSD-Commit-ID: 5a636f6ca7f25bfe775df4952f7aac90a7fcbbee + Except where we're explicitly testing a different kex, use + curve25519-sha256 since it's faster than the default and supported even + when configured without OpenSSL. Add a check to ensure that the kex we + intended to test is the one we actually tested. Speeds test up by ~5%. + + OpenBSD-Regress-ID: 3b27fcc2ae953cb08fd82a0d3155c498b226d6e0 -commit 64ddf776531ca4933832beecc8b7ebe1b937e081 -Author: jsg@openbsd.org -Date: Wed Dec 20 00:06:25 2023 +0000 +commit 3eb62b7ba49483c309b483eb9002a679014f3887 +Author: dtucker@openbsd.org +Date: Tue Aug 20 12:36:59 2024 +0000 - upstream: spelling; ok markus@ + upstream: Send only as much data as needed to trigger rekeying. Speeds - OpenBSD-Commit-ID: 9d01f2e9d59a999d5d42fc3b3efcf8dfb892e31b + up tests by about 10% in the common case, hopefully more when instrumented + with something like valgrind. + + OpenBSD-Regress-ID: 7bf9292b4803357efcf0baf7cfbdc8521f212da1 -commit 503fbe9ea238a4637e8778208bde8c09bcf78475 -Author: jmc@openbsd.org -Date: Tue Dec 19 06:57:34 2023 +0000 +commit cbd3f034bbf7853618fac99d7d868a2250154ea7 +Author: Damien Miller +Date: Wed Aug 21 09:18:29 2024 +1000 - upstream: sort -C, and add to usage(); ok djm + simplify sshkey_prekey_alloc(); always use mmap + +commit 4442bbc2fc661277a6dabfedb756a7e15ee8b8b8 +Author: dtucker@openbsd.org +Date: Tue Aug 20 09:15:49 2024 +0000 + + upstream: Merge AEAD test into main test loop. - OpenBSD-Commit-ID: 80141b2a5d60c8593e3c65ca3c53c431262c812f + Removes 3 duplicate tests and speeds overall test up by about 1%. + + OpenBSD-Regress-ID: 5e5c9ff3f7588091ed369e34ac28520490ad2619 -commit 5413b1c7ff5a19c6a7d44bd98c5a83eb47819ba6 -Author: djm@openbsd.org -Date: Tue Dec 19 06:41:14 2023 +0000 +commit 829976a63fd1efae3a4c3e7c16fded59d92edb67 +Author: dtucker@openbsd.org +Date: Tue Aug 20 09:02:45 2024 +0000 - upstream: correct section numbers; from Ed Maste + upstream: Set a default RekeyLimit of 256k. - OpenBSD-Commit-ID: e289576ee5651528404cb2fb68945556052cf83f + Used unless overridden by a command-line flag, which simplifies some of + the ssh command lines. + + OpenBSD-Regress-ID: e7cffa57027088e10336e412b34113969f88cb87 -commit 430ef864645cff83a4022f5b050174c840e275da -Author: djm@openbsd.org -Date: Mon Dec 18 15:58:56 2023 +0000 +commit 57d02c9ea36aebad4e7146d46e041b6b2e582f7f +Author: dtucker@openbsd.org +Date: Tue Aug 20 07:52:43 2024 +0000 - upstream: match flag type (s/int/u_int) + upstream: Add Compression=no to default ssh_config. - OpenBSD-Commit-ID: 9422289747c35ccb7b31d0e1888ccd5e74ad566a + All of the rekey tests use it (otherwise the encrypted byte counts would + not match) so this lets us simplify the command lines. + + OpenBSD-Regress-ID: dab7ce10f4cf6c68827eb8658141272aab3ea262 -commit 1036d77b34a5fa15e56f516b81b9928006848cbd -Author: Damien Miller -Date: Fri Dec 22 17:56:26 2023 +1100 +commit 7254eb26f7c0772c4b47c3b32f6d1b15855cdd8c +Author: dtucker@openbsd.org +Date: Tue Aug 20 07:41:35 2024 +0000 - better detection of broken -fzero-call-used-regs + upstream: Remove duplicate curve25519-sha256 kex. - gcc 13.2.0 on ppc64le refuses to compile some function, including - cipher.c:compression_alg_list() with an error: + curve25519-sha256@libssh.org is the pre-standardization name for the same + thing, so remove it as a duplicate. Speeds up test by a tiny amount. - > sorry, unimplemented: argument ‘used’ is not supportedcw - > for ‘-fzero-call-used-regs’ on this target + OpenBSD-Regress-ID: 5a5ee5fa1595a6e140b1cc16040bedf5996a5715 + +commit 749896b874928c2785256cae4d75161dc3bfcc7d +Author: dtucker@openbsd.org +Date: Tue Aug 20 07:27:25 2024 +0000 + + upstream: Unnest rekey param parsing test and use ssh not sshd. - This extends the autoconf will-it-work test with a similarly- - structured function that seems to catch this. + ssh uses the same parsing code, now has "-G" to dump its config and is + slightly faster to start up. This speeds up the test slightly (~5%) in the + common case but should help more during instrumented tests, eg under + valgrind, where startup costs are magnified. - Spotted/tested by Colin Watson; bz3645 + OpenBSD-Regress-ID: 07c3acaf4c728e641033071f4441afc88141b0d0 -commit 8241b9c0529228b4b86d88b1a6076fb9f97e4a99 -Author: Damien Miller -Date: Tue Dec 19 01:59:50 2023 +1100 +commit 2b1762115481ff2b7a60fd4db2ae69b725437462 +Author: djm@openbsd.org +Date: Tue Aug 20 11:10:04 2024 +0000 - crank versions + upstream: actually use the length parameter that was passed in rather + + than a constant (this makes no difference in practice because the length is + always the same); reported by martin AT nmkd.net + + OpenBSD-Commit-ID: 4aecce232c2fe9b16e9217ff6bcb3c848d853e7e -commit 2f2c65cb5f1518a9c556d3e8efa27ea0ca305c6b +commit d922762ca16a7381131b242f49d7376c41fabcb5 Author: Damien Miller -Date: Tue Dec 19 01:59:06 2023 +1100 +Date: Tue Aug 20 13:55:30 2024 +1000 - depend + private key coredump protection for Linux/FreeBSD + + platforms not supporting coredump exclusion using mmap/madvise flags + fall back to plain old malloc(3). -commit e48cdee8e19059203b1aeeabec2350b8375fa61f +commit cc048ca536d6bed6f2285b07040b0d57cd559ba5 Author: djm@openbsd.org -Date: Mon Dec 18 14:50:08 2023 +0000 +Date: Tue Aug 20 03:48:30 2024 +0000 - upstream: regress test for agent PKCS#11-backed certificates + upstream: place shielded keys (i.e. keys at rest in RAM) into memory - OpenBSD-Regress-ID: 38f681777cb944a8cc3bf9d0ad62959a16764df9 + allocated using mmap(3) with MAP_CONCEAL set. This prevents exposure of the + key material in coredumps, etc (this is in addition to other measures we take + in this area). + + ok deraadt@ + + OpenBSD-Commit-ID: cbbae59f337a00c9858d6358bc65f74e62261369 -commit 2f512f862df1d5f456f82a0334c9e8cc7208a2a1 +commit a0b35c791cad1f85481b23ba46373060292e1c80 Author: djm@openbsd.org -Date: Mon Dec 18 14:49:39 2023 +0000 +Date: Sat Aug 17 08:35:04 2024 +0000 - upstream: regress test for constrained PKCS#11 keys + upstream: mention that ed25519 is the default key type generated and - OpenBSD-Regress-ID: b2f26ae95d609d12257b43aef7cd7714c82618ff + clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. + Based on GHPR505 from SebastianRzk + + OpenBSD-Commit-ID: 1d90df71636a04601685d2a10a8233bcc8d4f4c5 -commit cdddd66412ca5920ed4d3ebbfa6ace12dbd9b82f +commit 127a50f2c80572ed1a021feb11ecf941e92cbbef Author: djm@openbsd.org -Date: Mon Dec 18 14:48:44 2023 +0000 +Date: Sat Aug 17 08:23:04 2024 +0000 - upstream: openssh-9.6 + upstream: fix minor memory leak in Subsystem option parsing; from - OpenBSD-Commit-ID: 21759837cf0e0092d9a2079f8fb562071c11016b + Antonio Larrosa via GHPR515 + + OpenBSD-Commit-ID: fff3bbefd1b2c45c98cbe45c6b857b15d8a2d364 -commit 6d51feab157cedf1e7ef5b3f8781ca8ff9c4ab1b +commit 171427261d2079941eb1041079dbae875da37cbc Author: djm@openbsd.org -Date: Mon Dec 18 14:48:08 2023 +0000 +Date: Sat Aug 17 08:09:50 2024 +0000 - upstream: ssh-agent: record failed session-bind attempts + upstream: fix swapping of source and destination addresses in some sshd - Record failed attempts to session-bind a connection and refuse signing - operations on that connection henceforth. + log messages - Prevents a future situation where we add a new hostkey type that is not - recognised by an older ssh-agent, that consequently causes session-bind - to fail (this situation is only likely to arise when people mix ssh(1) - and ssh-agent(1) of different versions on the same host). Previously, - after such a failure the agent socket would be considered unbound and - not subject to restriction. + OpenBSD-Commit-ID: 24d4cbb86325275df1f037545aa3b91456e52d25 + +commit 2a50a8f1fa57857a5e124a2280bcf61cc63c77f7 +Author: Darren Tucker +Date: Sat Aug 17 11:10:19 2024 +1000 + + Add compat functions for EVP_Digest{Sign,Verify}. - Spotted by Jann Horn + This should make LibreSSL 3.1.x through 3.3.x work again. Code from + tb@, ok djm@. Restore the test configs covering those. + +commit 1c3a7145260e03037cc18715b883880836fd122d +Author: Philip Hands +Date: Thu Aug 8 13:03:51 2024 +0200 + + make sure that usage & man page match - OpenBSD-Commit-ID: b0fdd023e920aa4831413f640de4c5307b53552e + SSH-Copy-ID-Upstream: da5b1abe55b72a16e0430e7598e1573da01779c0 -commit 7ef3787c84b6b524501211b11a26c742f829af1a -Author: djm@openbsd.org -Date: Mon Dec 18 14:47:44 2023 +0000 +commit cd0d681645b9adcf2467e7838bfd9d5142de4c4e +Author: Philip Hands +Date: Thu Aug 8 13:01:47 2024 +0200 - upstream: ban user/hostnames with most shell metacharacters + update copyright notices - This makes ssh(1) refuse user or host names provided on the - commandline that contain most shell metacharacters. + Bump the year to 2024, but also reflect the fact that hands.com Ltd. has + been wound up in the UK, and its assets (including this copyright) have + now reverted to its owner, Philip Hands. - Some programs that invoke ssh(1) using untrusted data do not filter - metacharacters in arguments they supply. This could create - interactions with user-specified ProxyCommand and other directives - that allow shell injection attacks to occur. + SSH-Copy-ID-Upstream: 0e4c4d072747a6568b11a790c29dd1b4ce663d7f + +commit 7fc9ccdce18841ebd0a97e31e43258512ab32a32 +Author: Philip Hands +Date: Sun Aug 4 20:45:00 2024 +0200 + + restore optionality of -i's argument - It's a mistake to invoke ssh(1) with arbitrary untrusted arguments, - but getting this stuff right can be tricky, so this should prevent - most obvious ways of creating risky situations. It however is not - and cannot be perfect: ssh(1) has no practical way of interpreting - what shell quoting rules are in use and how they interact with the - user's specified ProxyCommand. + SSH-Copy-ID-Upstream: f70e3abb510e4eeb040b47894e41828246c1b720 + +commit c37aa7012b1a3c2c322fd19e71310aadc90fc674 +Author: Philip Hands +Date: Fri Aug 2 15:52:07 2024 +0200 + + avoid exploring .ssh/id*.pub subdirectories - To allow configurations that use strange user or hostnames to - continue to work, this strictness is applied only to names coming - from the commandline. Names specified using User or Hostname - directives in ssh_config(5) are not affected. + SSH-Copy-ID-Upstream: 0b9e08b7707ad16de3c8e6a0410d9f42fbd56997 + +commit 777dce9e2e0d12f7e81e162f77749f30899869fe +Author: Philip Hands +Date: Fri Aug 2 10:07:11 2024 +0200 + + ensure that we're always told the source of keys - feedback/ok millert@ markus@ dtucker@ deraadt@ + SSH-Copy-ID-Upstream: 1bee96f4793e8ec3fab9f9361204ae58f5cc7cae + +commit fb94fd2339848e40cad6c9bb42b822244cc1a7bc +Author: Philip Hands +Date: Wed Jul 31 23:19:51 2024 +0200 + + add $HOME to ERROR if one cannot write to ~/.ssh - OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9 + SSH-Copy-ID-Upstream: ebef3e9c06e0447bff06e9d84b33023cf592e0ba -commit 0cb50eefdd29f0fec31d0e71cc4b004a5f704e67 -Author: djm@openbsd.org -Date: Mon Dec 18 14:47:20 2023 +0000 +commit eb5aafa1ffaeee75799141ec5ded406a65ec7d18 +Author: Philip Hands +Date: Wed Jul 31 23:19:03 2024 +0200 - upstream: stricter handling of channel window limits + assert that SCRATCH_DIR is a writable directory - This makes ssh/sshd more strict in handling non-compliant peers that - send more data than the advertised channel window allows. Previously - the additional data would be silently discarded. This change will - cause ssh/sshd to terminate the connection if the channel window is - exceeded by more than a small grace allowance. + SSH-Copy-ID-Upstream: ecb2b9d10883b9a16df56c83896c9bb47a80cde2 + +commit abcc460a2af46f0d812f8433d97a8eae1d80724c +Author: Philip Hands +Date: Wed Jul 31 23:17:54 2024 +0200 + + quote to avoid potential for word splitting - ok markus@ + SSH-Copy-ID-Upstream: f379adbe06ac2ef1daf0f130752234c7f8b97e3c + +commit b3f91411fd1473605f74c40c1a91a024c7171e27 +Author: Philip Hands +Date: Wed Jul 31 23:15:11 2024 +0200 + + ensure ERROR output goes to STDERR - OpenBSD-Commit-ID: 811e21b41831eba3dd7f67b3d409a438f20d3037 + SSH-Copy-ID-Upstream: ac394b05eead3b91feb7c2ae4129a3e9b892f1e2 -commit 4448a2938abc76e6bd33ba09b2ec17a216dfb491 -Author: djm@openbsd.org -Date: Mon Dec 18 14:46:56 2023 +0000 +commit 674b8f30f0dbacd787eb1e4e7e1ece34b5543d8f +Author: Philip Hands +Date: Thu Aug 1 14:03:06 2024 +0200 - upstream: Make it possible to load certs from PKCS#11 tokens + avoid extra space when no arg given to -i option - Adds a protocol extension to allow grafting certificates supplied by - ssh-add to keys loaded from PKCS#11 tokens in the agent. + SSH-Copy-ID-Upstream: feca9e67e6e37c5653445d1c733569d7abb1770e + +commit 0efa0e1c41427c0c6ba839a18c72c1afcd7b7cc0 +Author: Philip Hands +Date: Wed Jul 31 23:28:36 2024 +0200 + + put the -i before -[pP] (matching man pages) - feedback/ok markus@ + The man pages (ssh, sftp & ssh-copy-id) all list -i before the port + setting, so make the output match that order, which also seems more + natural with the port being next to the server. - OpenBSD-Commit-ID: bb5433cd28ede2bc910996eb3c0b53e20f86037f + SSH-Copy-ID-Upstream: 34d5d614172c78f9a42249466c4b81975b8883a1 -commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b -Author: djm@openbsd.org -Date: Mon Dec 18 14:46:12 2023 +0000 +commit 87831345e9745f2d13bd7a4a7972809f6788f331 +Author: Shreyas Mahangade +Date: Mon Jul 29 15:26:05 2024 +0000 - upstream: apply destination constraints to all p11 keys + Minor space issue fixed - Previously applied only to the first key returned from each token. + SSH-Copy-ID-Upstream: 335e44d7be78b03962a54c3a5c99a2ff45294a54 + +commit 2f3010f4736b4b3f5c10a4be97a24e90ff04c5e7 +Author: Shreyas Mahangade +Date: Mon Jul 29 16:55:28 2024 +0530 + + Show identity file in 'ssh' command - ok markus@ + - Previously no identity file is shown in "ssh" command output on the line "Now try logging into the..." + - This commit makes sure whenever "ssh-copy-id" with "-i" is invoked, it also reflects in "ssh" command - OpenBSD-Commit-ID: 36df3afb8eb94eec6b2541f063d0d164ef8b488d + SSH-Copy-ID-Upstream: 58e022ec26cb2315eb3be581d01e0ba787082428 -commit a7ed931caeb68947d30af8a795f4108b6efad761 -Author: djm@openbsd.org -Date: Mon Dec 18 14:45:49 2023 +0000 +commit a13856374b894397a7682b32257ed0bf67cfede9 +Author: Damien Miller +Date: Fri Aug 16 08:30:20 2024 +1000 - upstream: add "ext-info-in-auth@openssh.com" extension + more OPENSSL_HAS_ECC + +commit 4da2a1a7f648979bea6eaf3b17f5f250faed4afc +Author: Damien Miller +Date: Thu Aug 15 23:35:54 2024 +1000 + + fix merge botch that broke !OPENSSL_HAS_ECC + +commit 2c53d2f32b8e3992b61682c909ae5bc5122b6e5d +Author: Damien Miller +Date: Thu Aug 15 15:09:45 2024 +1000 + + missed OPENSSL_HAS_ECC case + +commit 342dd7a219f39119b8b686b5aaa99c8e15ede368 +Author: Damien Miller +Date: Thu Aug 15 15:06:55 2024 +1000 + + retire testing aginst older LibreSSL versions - This adds another transport protocol extension to allow a sshd to send - SSH2_MSG_EXT_INFO during user authentication, after the server has - learned the username that is being logged in to. + libressl prior to 3.4.x lack support for the EVP_DigestSign and + EVP_DigestVerify APIs that we need now that sshkey is converted + to EVP_PKEY. - This lets sshd to update the acceptable signature algoritms for public - key authentication, and allows these to be varied via sshd_config(5) - "Match" directives, which are evaluated after the server learns the - username being authenticated. + If someone makes a good case for why we should support these versions + then we could bring back support with wrappers. + +commit a7c6ea8eebe0f179141ec5dbf0c9e5354417930f +Author: Damien Miller +Date: Thu Aug 15 12:44:17 2024 +1000 + + sync TEST_MALLOC_OPTIONS for OpenBSD + +commit 60c2cf22e8f64f35d8b1175e4671257313f2e4d3 +Author: Damien Miller +Date: Thu Aug 15 12:43:47 2024 +1000 + + remove gratuitious difference from OpenBSD + +commit 339c4fc60a6250429d41fa8713f783d82aad4551 +Author: djm@openbsd.org +Date: Thu Aug 15 00:52:23 2024 +0000 + + upstream: adapt to EVP_PKEY conversion - Full details in the PROTOCOL file + OpenBSD-Regress-ID: 0e2d4efb0ed0e392e23cd8fda183fe56531ac446 + +commit 63a94f99b9d7c8a48182a40192e45879d1ba8791 +Author: djm@openbsd.org +Date: Fri Jul 19 04:33:36 2024 +0000 + + upstream: test transfers in mux proxy mode too - OpenBSD-Commit-ID: 1de7da7f2b6c32a46043d75fcd49b0cbb7db7779 + OpenBSD-Regress-ID: 2edfc980628cfef3550649cab8d69fa23b5cd6c4 -commit 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 +commit 7bdfc20516e288b58c8c847958059c7b141eeff9 Author: djm@openbsd.org -Date: Mon Dec 18 14:45:17 2023 +0000 +Date: Thu Aug 15 00:51:51 2024 +0000 - upstream: implement "strict key exchange" in ssh and sshd + upstream: Convert RSA and ECDSA key to the libcrypto EVP_PKEY API. - This adds a protocol extension to improve the integrity of the SSH - transport protocol, particular in and around the initial key exchange - (KEX) phase. + DSA remains unconverted as it will be removed within six months. - Full details of the extension are in the PROTOCOL file. + Based on patches originally from Dmitry Belyavskiy, but significantly + reworked based on feedback from Bob Beck, Joel Sing and especially + Theo Buehler (apologies to anyone I've missed). - with markus@ + ok tb@ - OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14 + OpenBSD-Commit-ID: d098744e89f1dc7e5952a6817bef234eced648b5 -commit 59d691b886c79e70b1d1c4ab744e81fd176222fd -Author: Damien Miller -Date: Mon Dec 18 14:49:11 2023 +1100 +commit 0af06e2c5b898992a18c74333e75a0136506acc6 +Author: tobias@openbsd.org +Date: Wed Aug 14 15:42:18 2024 +0000 - better detection of broken -fzero-call-used-regs + upstream: Reorder calloc arguments - Use OSSH_CHECK_CFLAG_LINK() for detection of these flags and extend - test program to exercise varargs, which seems to catch more stuff. + The first argument should be the amount, the second argument should be the + element size. Fixing this also silences some gcc compiler warnings for + portable. - ok dtucker@ + Spotted with Benny Baumann (BenBE at geshi dot org). + + ok djm@ + + OpenBSD-Commit-ID: 711ad6f7bd7fb48bf52208f2cf9f108cddb6d41a -commit aa7b21708511a6d4aed3839fc9f6e82e849dd4a1 -Author: djm@openbsd.org -Date: Wed Dec 13 03:28:19 2023 +0000 +commit 56ce0aa3c6cf28d9fcbce3207457abeac91b5050 +Author: tobias@openbsd.org +Date: Wed Aug 14 15:40:30 2024 +0000 - upstream: when invoking KnownHostsCommand to determine the order of + upstream: Extend sshbuf validation - host key algorithms to request, ensure that the hostname passed to the - command is decorated with the port number for ports other than 22. + Multiple sshbuf structs can be linked through a parent/child relationship. + Make sure that a single sshbuf cannot be its own parent. If this would ever + happen, it would result in reference counting issues. - This matches the behaviour of KnownHostsCommand when invoked to look - up the actual host key. + This is a cheap way of testing this with very little overhead. It does not + detect A->B->A linkages though for performance reason and the fact that it + takes a programming error for this to occur anyway. - bz3643, ok dtucker@ + Authored with Benny Baumann (BenBE at geshi dot org). - OpenBSD-Commit-ID: 5cfabc0b7c6c7ab473666df314f377b1f15420b1 + ok djm@ + + OpenBSD-Commit-ID: fb3fa9ee2cad3c7e842ebadfd7f5db220c4aaf16 -commit 4086bd6652c0badccc020218a62190a7798fb72c -Author: markus@openbsd.org -Date: Fri Dec 8 09:18:39 2023 +0000 +commit fc48ddf6998188517af42dce807e2088b6a0c0be +Author: tobias@openbsd.org +Date: Wed Aug 14 15:37:11 2024 +0000 - upstream: prevent leak in sshsig_match_principals; ok djm@ + upstream: Use freezero for better readability - OpenBSD-Commit-ID: 594f61ad4819ff5c72dfe99ba666a17f0e1030ae + It has the same meaning as the current pair of calling explicit_bzero + and free. Spotted with Benny Baumann (BenBE at geshi dot org). + + ok djm@ + + OpenBSD-Commit-ID: 939fbe9ccf52d0d48c5fa53694d6f3bb9927970c -commit 19d3ee2f3adf7d9a606ff015c1e153744702c4c9 -Author: djm@openbsd.org -Date: Wed Dec 6 21:06:48 2023 +0000 +commit 1ff6907ec26dac6ac59fe9fe232899a63b4c14d8 +Author: tobias@openbsd.org +Date: Wed Aug 14 15:35:23 2024 +0000 - upstream: short circuit debug log processing early if we're not going + upstream: Fix typo in comment - to log anything. From Kobe Housen + Spotted with Benny Baumann (BenBE at geshi dot org). - OpenBSD-Commit-ID: 2bcddd695872a1bef137cfff7823044dcded90ea + ok djm@ + + OpenBSD-Commit-ID: 829160ac8ef3ad3409695ce3a3ade835061cae57 -commit 947affad4831df015c498c00c6351ea6f13895d5 -Author: Darren Tucker -Date: Mon Nov 27 09:37:28 2023 +1100 +commit 487faaed8f3bb9ffb19e8f807a3da72895b16421 +Author: dlg@openbsd.org +Date: Wed Jul 31 12:00:18 2024 +0000 - Add tests for OpenSSL 3.2.0 and 3.2 stable branch. + upstream: add a random amount of time (up to 4 seconds) to the + + grace login time. + + ok deraadt@ djm@ + + OpenBSD-Commit-ID: abd3c57aaa5861517529b322df79b6be35ee67f4 -commit 747dce36206675ca6b885010a835733df469351b +commit 2865f5b7520bed3e74fbbb5f8d7a44193d7a4314 +Author: naddy@openbsd.org +Date: Fri Jul 26 15:24:49 2024 +0000 + + upstream: document the reduced logingrace penalty + + OpenBSD-Commit-ID: 9b63e0e3599d524ddc10edc4f978081382c3548b + +commit 1ec0a64c5dc57b8a2053a93b5ef0d02ff8598e5c Author: Darren Tucker -Date: Sat Nov 25 09:03:38 2023 +1100 +Date: Sun Jul 28 21:26:51 2024 +1000 - Use non-zero arg in compiler test program. + Explicitly install libssl-devel cygwin. - Now that we're running the test program, passing zero to the test function - can cause divide-by-zero exceptions which might show up in logs. + Should fix CI tests for cygwin default config. -commit 3d44a5c56585d1c351dbc006240a591b6da502b1 -Author: dtucker@openbsd.org -Date: Fri Nov 24 00:31:30 2023 +0000 +commit 0bf6e5bb750b66b25c20a1c5a471f91850de3748 +Author: djm@openbsd.org +Date: Thu Jul 25 23:44:01 2024 +0000 - upstream: Plug mem leak of msg when processing a quit message. + upstream: reduce logingrace penalty. - Coverity CID#427852, ok djm@ + A single forgotton login that times out should be below the penalty + threshold. - OpenBSD-Commit-ID: bf85362addbe2134c3d8c4b80f16601fbff823b7 + ok deraadt/claudio + + OpenBSD-Commit-ID: cee1f7d17597c97bff8e5092af5d136fdb08f81d -commit 1d7f9b6e297877bd00973e6dc5c0642dbefc3b5f -Author: dtucker@openbsd.org -Date: Thu Nov 23 03:37:05 2023 +0000 +commit 29fb6f6d46b67770084b4f12bcf8a01bd535041b +Author: djm@openbsd.org +Date: Thu Jul 25 22:40:08 2024 +0000 - upstream: Include existing mux path in debug message. + upstream: Fix proxy multiplexing (-O proxy) bug - OpenBSD-Commit-ID: 1c3641be10c2f4fbad2a1b088a441d072e18bf16 + If a mux started with ControlPersist then later has a forwarding added using + mux proxy connection and the forwarding was used, then when the mux proxy + session terminates, the mux master process will send a channel close to the + server with a bad channel ID and crash the connection. + + This was caused by my stupidly reusing c->remote_id for mux channel + associations when I should have just added another member to struct channel. + + ok markus@ + + OpenBSD-Commit-ID: c9f474e0124e3fe456c5e43749b97d75e65b82b2 -commit f29934066bd0e561a2e516b7e584fb92d2eedee0 -Author: Darren Tucker -Date: Thu Nov 23 19:41:27 2023 +1100 +commit 53d1d307438517805989c7d5616d752739a97e03 +Author: djm@openbsd.org +Date: Thu Jul 18 01:47:27 2024 +0000 - Add an Ubuntu 22.04 test VM. + upstream: mention mux proxy mode - This is the same version as Github's runners so most of the testing on - it is over there, but having a local VM makes debugging much easier. + OpenBSD-Commit-ID: fd77a77779f06d316a314e4540dc57c93fc3369a -commit a93284a780cd3972afe5f89086b75d564ba157f3 -Author: Darren Tucker -Date: Thu Nov 23 19:36:22 2023 +1100 +commit a9b90859d252c2f5a24142f985d38610ac74685f +Author: jsg@openbsd.org +Date: Sun Jul 14 10:19:23 2024 +0000 - Add gcc-12 -Werror test on Ubuntu 22.04. + upstream: fix double word; ok dtucker@ - Explictly specify gcc-11 on Ubuntu 22.04 (it's the system compiler). + OpenBSD-Commit-ID: e6aff005914fa350b896d2be030be3d3b56ec0e8 -commit 670f5a647e98b6fd95ad64f789f87ee3274b481b +commit b05fda224bbcd2f641254534ed2175c42487f3c8 Author: Darren Tucker -Date: Thu Nov 23 19:34:57 2023 +1100 +Date: Thu Jul 25 17:59:35 2024 +1000 - Check return value from write to prevent warning. + Check for SA_RESTART before using it. - ... and since we're testing for flags with -Werror, this caused - configure to mis-detect compiler flags. + ok djm@ -commit cea007d691cfedfa07a5b8599f97ce0511f53fc9 -Author: Darren Tucker -Date: Wed Nov 22 21:18:55 2023 +1100 +commit c276672fc0e99f0c4389988d54a84c203ce325b6 +Author: Yuichiro Naito +Date: Wed Sep 1 10:19:32 2021 +0900 - Run compiler test program when compiling natively. + Class-imposed login restrictions - ok djm@ + If the following functions are available, + add an additional check if users are allowed to login imposed by login class. + + * auth_hostok(3) + * auth_timeok(3) + + These functions are implemented on FreeBSD. -commit ee0d305828f13536c0a416bbf9c3e81039d9ea55 -Author: Darren Tucker -Date: Wed Nov 22 21:18:07 2023 +1100 +commit 7717b9e9155209916cc6b4b4b54f4e8fa578e889 +Author: djm@openbsd.org +Date: Wed Jul 10 21:58:34 2024 +0000 - Factor out compiler test program into a macro. + upstream: correct keyword; from Yatao Su via GHPR509 - ok djm@ + OpenBSD-Commit-ID: 81c778c76dea7ef407603caa157eb0c381c52ad2 -commit de304c76316b029df460673725a9104224b9959b -Author: Darren Tucker -Date: Wed Nov 22 08:55:36 2023 +1100 +commit f2b78bb8f149d6b4d1f62c21aa1f06995dccf4ce +Author: djm@openbsd.org +Date: Mon Jul 8 03:04:34 2024 +0000 - Add fbsd14 VM to test pool. + upstream: don't need return at end of void function + + OpenBSD-Commit-ID: 42d322d37f13aa075ae7b1ad9eef591e20b89717 -commit 99a2df5e1994cdcb44ba2187b5f34d0e9190be91 -Author: Darren Tucker -Date: Tue Nov 21 16:19:29 2023 +1100 +commit a395d37a813c0177cb5bfc4bebf5a52badb73cf0 +Author: djm@openbsd.org +Date: Thu Jul 4 22:53:59 2024 +0000 - Expand -fzero-call-used-regs test to cover gcc 11. + upstream: fix grammar: "a pattern lists" -> "one or more pattern - It turns out that gcc also has some problems with -fzero-call-used-regs, - at least v11 on mips. Previously the test in OSSH_CHECK_CFLAG_COMPILE - was sufficient to catch it with "=all", but not sufficient for "=used". - Expand the testcase and include it in the other tests for good measure. - See bz#3629. ok djm@. + lists" + + OpenBSD-Commit-ID: f3c844763398faa9800687e8ff6621225498202a -commit ff220d4010717f7bfbbc02a2400666fb9d24f250 +commit 8b664df75966e5aed8dabea00b8838303d3488b8 Author: Darren Tucker -Date: Tue Nov 21 14:04:34 2023 +1100 +Date: Sun Jul 7 18:46:19 2024 +1000 - Stop using -fzero-call-used-regs=all + Cast to sockaddr * in systemd interface. - ... since it seems to be problematic with several different versions of - clang. Only use -fzero-call-used-regs=used which is less - problematic, except with Apple's clang where we don't use it at all. - bz#3629, ok djm@ + Fixes build with musl libx. bz#3707. -commit 2a19e02f36b16f0f6cc915f7d1e60ead5e36303b +commit 30c8c81da2169e78357d08dbb0ddd823b60e93bc Author: Darren Tucker -Date: Tue Nov 21 14:02:18 2023 +1100 +Date: Thu Jul 4 20:12:26 2024 +1000 - Allow for vendor prefix on clang version numbers. + Add 9.8 branch to ci-status page. + +commit ee6b9e661633fcefd29dba0c811cecbc4d027f6f +Author: Samuel Thibault +Date: Tue Mar 26 22:15:08 2024 +0100 + + Fix detection of setres*id on GNU/Hurd - Correctly detects the version of OpenBSD's native clang, as well as - Apple's. Spotted tb@, ok djm@. + Like Linux, proper _SOURCE macros need to be set to get declarations of + various standard functions, notably setres*id. Now that Debian is using + -Werror=implicit-function-declaration this is really required. While at + it, define other _SOURCE macros like on GNU/Linux, since GNU/Hurd uses + the same glibc. -commit c52db0114826d73eff6cdbf205e9c1fa4f7ca6c6 +commit fa41f6592ff1b6ead4a652ac75af31eabb05b912 +Author: Damien Miller +Date: Mon Jul 1 14:33:26 2024 +1000 + + version numbers + +commit bfebb8a5130a792c5356bd06e1ddef72a0a0449f Author: djm@openbsd.org -Date: Mon Nov 20 02:50:00 2023 +0000 +Date: Mon Jul 1 04:31:59 2024 +0000 - upstream: set errno=EAFNOSUPPORT when filtering addresses that don't - - match AddressFamily; yields slightly better error message if no address - matches. bz#3526 + upstream: openssh-9.8 - OpenBSD-Commit-ID: 29cea900ddd8b04a4d1968da5c4a893be2ebd9e6 + OpenBSD-Commit-ID: 5f8b89e38a4c5f7c6d52ffa19f796d49f36fab19 -commit 26f3f3bbc69196d908cad6558c8c7dc5beb8d74a +commit 146c420d29d055cc75c8606327a1cf8439fe3a08 Author: djm@openbsd.org -Date: Wed Nov 15 23:03:38 2023 +0000 +Date: Mon Jul 1 04:31:17 2024 +0000 - upstream: when connecting via socket (the default case), filter + upstream: when sending ObscureKeystrokeTiming chaff packets, we - addresses by AddressFamily if one was specified. Fixes the case where, if - CanonicalizeHostname is enabled, ssh may ignore AddressFamily. bz5326; ok - dtucker + can't rely on channel_did_enqueue to tell that there is data to send. This + flag indicates that the channels code enqueued a packet on _this_ ppoll() + iteration, not that data was enqueued in _any_ ppoll() iteration in the + timeslice. ok markus@ - OpenBSD-Commit-ID: 6c7d7751f6cd055126b2b268a7b64dcafa447439 + OpenBSD-Commit-ID: 009b74fd2769b36b5284a0188ade182f00564136 -commit 050c335c8da43741ed0df2570ebfbd5d1dfd0a31 +commit 637e4dfea4ed81264e264b6200172ce319c64ead Author: djm@openbsd.org -Date: Wed Nov 15 22:51:49 2023 +0000 +Date: Mon Jul 1 03:10:19 2024 +0000 - upstream: when deciding whether to enable keystroke timing + upstream: use "lcd" to change directory before "lls" rather then "cd", - obfuscation, only consider enabling it when a channel with a tty is open. - - Avoids turning on the obfucation when X11 forwarding only is in use, - which slows it right down. Reported by Roger Marsh + since the directory we're trying to list is local. Spotted by Corinna + Vinschen - OpenBSD-Commit-ID: c292f738db410f729190f92de100c39ec931a4f1 + OpenBSD-Regress-ID: 821feca4a4bebe491944e624c8f7f2990b891415 -commit 676377ce67807a24e08a54cd60ec832946cc6cae -Author: tobhe@openbsd.org -Date: Mon Nov 13 09:18:19 2023 +0000 +commit c8cfe258cee0b8466ea84597bf15e1fcff3bc328 +Author: djm@openbsd.org +Date: Thu Jun 27 23:01:15 2024 +0000 - upstream: Make sure sftp_get_limits() only returns 0 if 'limits' - - was initialized. This fixes a potential uninitialized use of 'limits' in - sftp_init() if sftp_get_limits() returned early because of an unexpected - message type. - - ok djm@ + upstream: delete obsolete comment - OpenBSD-Commit-ID: 1c177d7c3becc1d71bc8763eecf61873a1d3884c + OpenBSD-Commit-ID: 5fb04f298ed155053f3fbfdf0c6fe7cdf84bbfa2 -commit 64e0600f23c6dec36c3875392ac95b8a9100c2d6 -Author: Darren Tucker -Date: Mon Nov 13 20:03:31 2023 +1100 +commit 94b9d37100f6fa536aaa1d1a0e4926fe44fbf04d +Author: djm@openbsd.org +Date: Thu Jun 27 22:36:44 2024 +0000 - Test current releases of LibreSSL and OpenSSL. + upstream: retire unused API - Retire some of the older releases. + OpenBSD-Commit-ID: 3e30d7b0615e2707f6bbe70f61b1c2f72f78161b -commit c8ed7cc545879ac15f6ce428be4b29c35598bb2a -Author: dtucker@openbsd.org -Date: Wed Nov 1 02:08:38 2023 +0000 - - upstream: Specify ssh binary to use - - ... instead of relying on installed one. Fixes test failures in -portable - when running tests prior to installation. - - OpenBSD-Regress-ID: b6d6ba71c23209c616efc805a60d9a445d53a685 - -commit e9fc2c48121cada1b4dcc5dadea5d447fe0093c3 -Author: Darren Tucker -Date: Wed Nov 1 13:11:31 2023 +1100 +commit 268c3a7f5783e731ed60f4e28da66ee3743581d3 +Author: jmc@openbsd.org +Date: Thu Jun 27 21:02:16 2024 +0000 - Put long-running test targets on hipri runners. + upstream: ssl(8) no longer contains a HISTORY section; - Some of the selfhosted test targets take a long time to run for various - reasons, so label them for "libvirt-hipri" runners so that they can - start immediately. This should reduce the time to complete all tests. + OpenBSD-Commit-ID: 83b7ff34433d79595e9c2a5d2a561a6660251245 -commit 7ddf27668f0e21233f08c0ab2fe9ee3fdd6ab1e2 +commit 12b6cc09ce6c430681f03af2a8069e37a664690b Author: djm@openbsd.org -Date: Wed Nov 1 00:29:46 2023 +0000 +Date: Wed Jun 26 23:47:46 2024 +0000 - upstream: add some tests of forced commands overriding Subsystem + upstream: move child process waitpid() loop out of SIGCHLD handler; - directives + ok deraadt - OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b + OpenBSD-Commit-ID: 65815a39564e431414aed7c5ace8076f4e9ca741 -commit fb06f9b5a065dfbbef5916fc4accc03c0bf026dd -Author: dtucker@openbsd.org -Date: Tue Oct 31 04:15:40 2023 +0000 +commit d6bcd13297c2ab8b528df5a6898f994734849031 +Author: deraadt@openbsd.org +Date: Wed Jun 26 23:16:52 2024 +0000 - upstream: Don't try to use sudo inside sshd log wrapper. + upstream: Instead of using possibly complex ssh_signal(), write all - We still need to check if we're using sudo since we don't want to chown - unecessarily, as on some platforms this causes an error which pollutes - stderr. We also don't want to unnecessarily invoke sudo, since it's - running in the context of the proxycommand, on *other* platforms it - may not be able to authenticate, and if we're using SUDO then it should - already be privileged. + the parts of the grace_alarm_handler() using the exact things allowed by the + signal-safe rules. This is a good rule of thumb: Handlers should be written + to either set a global volatile sig_atomic_t inspected from outside, and/or + directly perform only safe operations listed in our sigaction(2) manual page. + ok djm markus - OpenBSD-Regress-ID: 70d58df7503db699de579a9479300e5f3735f4ee + OpenBSD-Commit-ID: 14168ae8368aab76e4ed79e17a667cb46f404ecd -commit fc3cc33e88c242c704781c6c48087838f1dcfa2a -Author: dtucker@openbsd.org -Date: Tue Oct 31 02:58:45 2023 +0000 +commit b8793e2b0851f7d71b97554fa5260b23796d6277 +Author: deraadt@openbsd.org +Date: Wed Jun 26 23:14:14 2024 +0000 - upstream: Only try to chmod logfile if we have sudo. If we don't have + upstream: save_errno wrappers inside two small signal handlers that - sudo then we won't need to chmod. + perform system calls, for systems with libc that do perform libc sigtramps. + ok djm markus - OpenBSD-Regress-ID: dbad2f5ece839658ef8af3376cb1fb1cabe2e324 + OpenBSD-Commit-ID: 7749b56419a7c9dcfe4c6c04811e429813346c62 -commit 3a506598fddd3f18f9095af3fe917f24cbdd32e0 -Author: djm@openbsd.org -Date: Mon Oct 30 23:00:25 2023 +0000 +commit f23e9332c4c8df37465c4a4f38275ea98980ed7e +Author: jmc@openbsd.org +Date: Mon Jun 24 06:59:39 2024 +0000 - upstream: move PKCS#11 setup code to test-exec.sh so it can be reused + upstream: - uppercase start of sentence - correct sentence grammar - elsewhere + ok djm - OpenBSD-Regress-ID: 1d29e6be40f994419795d9e660a8d07f538f0acb + OpenBSD-Commit-ID: 1ec4b0fdb633a43667f2c8fff1d600bd647dde25 -commit f82fa227a52661c37404a6d33bbabf14fed05db0 +commit 1839e3eb71a759aa795602c1e4196300f4ac2615 Author: djm@openbsd.org -Date: Mon Oct 30 17:32:00 2023 +0000 +Date: Mon Jun 24 04:05:11 2024 +0000 - upstream: tidy and refactor PKCS#11 setup code - - Replace the use of a perl script to delete the controlling TTY with a - SSH_ASKPASS script to directly load the PIN. + upstream: mention SshdSessionPath option - Move PKCS#11 setup code to functions in anticipation of it being used - elsewhere in additional tests. - - Reduce stdout spam - - OpenBSD-Regress-ID: 07705c31de30bab9601a95daf1ee6bef821dd262 + OpenBSD-Commit-ID: c29734d36c21003973b15c1c9965c35f36cef30c -commit 3cf698c6d4ffa9be1da55672a3519e2135a6366a +commit 603193e32aef5db7d60c58066d5de89806e79312 Author: Darren Tucker -Date: Mon Oct 30 21:35:03 2023 +1100 +Date: Thu Jun 20 18:45:14 2024 +1000 - Add obsd74 test VM and retire obsd69 and obsd70. + Rerun upstream tests on .sh file changes too. -commit 3e21d58a09894acb38dc69ed615d101131f473d0 -Author: Darren Tucker -Date: Mon Oct 30 18:34:12 2023 +1100 +commit dbbf9337c19381786a8e5a8a49152fe6b80c780d +Author: dtucker@openbsd.org +Date: Thu Jun 20 08:23:18 2024 +0000 - Add OpenSSL 3.3.0 as a known dev version. + upstream: Work around dbclient cipher/mac query bug. + + Unlike earlier versions, recent Dropbear (at least v2024.85) requires + a host arg when querying supported ciphers and macs via "-c/-m + help". Earlier versions accept but do not require it, so always + provide it. If these queries fail, skip the test with a warning. + + OpenBSD-Regress-ID: 98eb863a3f0363416922efb273885e6b3c7f68d4 -commit 917ba181c2cbdb250a443589ec732aa36fd51ffa -Author: Darren Tucker -Date: Mon Oct 30 13:32:03 2023 +1100 +commit 8de2c8cebc46bbdb94b7a2c120fcadfb66a3cccc +Author: dtucker@openbsd.org +Date: Thu Jun 20 08:18:34 2024 +0000 - Restore nopasswd sudo rule on Mac OS X. + upstream: Remove dropbear key types not supported - This seems to be missing from some (but not all) github runners, so - restore it if it seems to be missing. + by current OpenSSH. Allows subsequent test runs to work if OpenSSH is + rebuilt w/out OpenSSL. + + OpenBSD-Regress-ID: e0129eb2b1d31771105903a8055216fbba20a770 -commit c5698abad6d4ec98ca20bcaaabaeacd5e1ec3f4f -Author: Darren Tucker -Date: Mon Oct 30 13:26:52 2023 +1100 +commit e9b6471c59b21e5d9ef1b3832d4bf727338add85 +Author: djm@openbsd.org +Date: Thu Jun 20 00:18:05 2024 +0000 - Don't exit early when setting up on Mac OS X. + upstream: stricter check for overfull tables in penalty record path - We probably need some of the other bits in there (specifically, setting - the perms on the home directory) so make it less of a special snowflake. + OpenBSD-Commit-ID: 7df01e648a0723418c554e64a9f2b6d38db060a6 -commit 1d6a878ceba60b9dc14037dddc8f036070c0065f -Author: dtucker@openbsd.org -Date: Sun Oct 29 06:22:07 2023 +0000 +commit d9336d344eb2a1e898c5e66147b3f108c7214694 +Author: djm@openbsd.org +Date: Wed Jun 19 23:24:47 2024 +0000 - upstream: Only try to chown logfiles that exist to prevent spurious + upstream: put back reaping of preauth child process when writes - errors. + from the monitor fail. Not sure how this got lost in the avalanche of + patches. - OpenBSD-Regress-ID: f1b20a476734e885078c481f1324c9ea03af991e + OpenBSD-Commit-ID: eb7eb36371e1ac01050b32b70fb2b3e5d98e72f5 -commit e612376427a66f835e284f6b426d16d7c85301bc -Author: anton@openbsd.org -Date: Thu Oct 26 18:52:45 2023 +0000 +commit 579d9adb70ec0206a788eb5c63804c31a67e9310 +Author: naddy@openbsd.org +Date: Mon Jun 17 13:50:18 2024 +0000 - upstream: make use of bsd.regress.mk in extra and interop targets; ok - - dtucker@ + upstream: remove one more mention of DSA - OpenBSD-Regress-ID: 7ea21b5f6fc4506165093b2123d88d20ff13a4f0 + OpenBSD-Commit-ID: 8515f55a15f02836ba657df341415f63c60526ca -commit ea0039173957d0edcd6469b9614dcedb44dcb4f9 -Author: dtucker@openbsd.org -Date: Thu Oct 26 12:44:07 2023 +0000 +commit 7089b5f8436ef0b8d3d3ad9ce01045fb9e7aab15 +Author: Darren Tucker +Date: Wed Jun 19 23:09:05 2024 +1000 - upstream: Skip conch interop tests when not enabled instead of fatal. - - OpenBSD-Regress-ID: b0abf81c24ac6c21f367233663228ba16fa96a46 + Move -f to the place needed to restart sshd. -commit d220b9ed5494252b26b95f05be118472bc3ab5c0 +commit d5f83cfd852b14a25f347f082ab539a9454702ad +Author: Darren Tucker +Date: Wed Jun 19 21:04:01 2024 +1000 + + Need to supply "-f" to restart sshd. + +commit fad34b4ca25c0ef31e5aa841d461b6f21da5b8c1 Author: dtucker@openbsd.org -Date: Wed Oct 25 05:38:08 2023 +0000 +Date: Wed Jun 19 10:15:51 2024 +0000 - upstream: Import regenerated moduli. + upstream: Provide defaults for ciphers and macs - OpenBSD-Commit-ID: 95f5dd6107e8902b87dc5b005ef2b53f1ff378b8 + if querying for them fails since on some versions of Dropbear (at least + v2024.85) "-m help" doesn't seem to work. Enable all supported pubkey + algorithms in the server. + + OpenBSD-Regress-ID: 4f95556a49ee9f621789f25217c367a33d2745ca -commit a611e4db4009447a0151f31a44e235ca32ed4429 -Author: anton@openbsd.org -Date: Wed Oct 25 08:01:59 2023 +0000 +commit 5521060e35ada9f957cecdddc06d0524e75409ef +Author: dtucker@openbsd.org +Date: Wed Jun 19 10:10:46 2024 +0000 - upstream: ssh conch interop tests requires a controlling terminal; + upstream: Use ed25519 keys for kex tests - ok dtucker@ + since that's supported by OpenSSH even when built without OpenSSL. + Only test diffie-hellman kex if OpenSSH is compiled with support for it. - OpenBSD-Regress-ID: cbf2701bc347c2f19d907f113779c666f1ecae4a + OpenBSD-Regress-ID: a5d09ef9bbd171f9e4ec73ed0d9eeb49a8878e97 -commit da951b5e08c167acb5d6e2eec6f146502f5d6ed8 -Author: anton@openbsd.org -Date: Mon Oct 23 11:30:49 2023 +0000 +commit dbd3b833f6e3815e58f2dc6e14f61a51bcd4d6bd +Author: dtucker@openbsd.org +Date: Wed Jun 19 10:08:34 2024 +0000 - upstream: Use private key that is allowed by sshd defaults in conch - - interop tests. + upstream: Rework dropbear key setup - ok dtucker@ + to always generate ed25519 keys, other types only if OpenSSH has support + for the corresponding key type. - OpenBSD-Regress-ID: 3b7f65c8f409c328bcd4b704f60cb3d31746f045 + OpenBSD-Regress-ID: 8f91f12604cddb9f8d93aa34f3f93a3f6074395d -commit 1ca166dbb3c0ce632b98869cd955f69320aa6fe8 +commit d6218504e11ae9148adf410fc69b0710a052be36 Author: Darren Tucker -Date: Fri Oct 20 20:43:00 2023 +1100 +Date: Wed Jun 19 20:20:24 2024 +1000 - Install Dropbear for interop testing. + Restart sshd after installing it for testing. + + When installing an sshd built without OpenSSL the mismatch between + the running sshd and newly installed sshd-session will cause the + remainder of the test to fail. -commit f993bb58351c5cb71e61aede63805a34a6d4daea +commit 786a4465b6bb702daf4fb17b7c3bcb42b52f0b46 Author: Darren Tucker -Date: Fri Oct 20 20:39:03 2023 +1100 +Date: Tue Jun 18 19:59:59 2024 +1000 - Resync PuTTY and Conch path handling with upstream. + Remove macos-11 runner. - Now that configure finds these for us we can remove these -portable - specific changes. + Github is retiring them soon. -commit ff85becd5f5f06a76efa45d30fb204a3c5e5215c -Author: Darren Tucker -Date: Fri Oct 20 20:35:46 2023 +1100 +commit df1c72a55edbebac14363b57de66ac6a147ecc67 +Author: Damien Miller +Date: Wed Jun 19 09:34:34 2024 +1000 - Have configure find PuTTY and Conch binaries. - - This will let us remove some -portable specific changes from - test-exec.sh. + PAMServiceName may appear in a Match block -commit c54a50359b9cecddbf3ffcdc26efcb3cd6071ec1 +commit de1c2e70e5a5dc3c8d2fe04b24cc93d8ef6930e7 Author: dtucker@openbsd.org -Date: Fri Oct 20 07:37:07 2023 +0000 +Date: Tue Jun 18 08:11:48 2024 +0000 - upstream: Allow overriding the locations of the Dropbear binaries + upstream: Re-enable ssh-dss tests - similar to what we do for the PuTTY ones. + ... if ssh is compiled with DSA support - OpenBSD-Regress-ID: 7de0e00518fb0c8fdc5f243b7f82f523c936049c + OpenBSD-Regress-ID: bbfaf8c17f2b50a2d46ac35cb97af99b990c990d -commit fbaa707d455a61d0aef8ae65e02a25bac5351e5c -Author: dtucker@openbsd.org -Date: Fri Oct 20 06:56:45 2023 +0000 +commit dabc2c7cf3c141e8e5d5a1a60d6c1d2d2422cf43 +Author: anton@openbsd.org +Date: Tue Jun 18 06:14:27 2024 +0000 - upstream: Add interop test with Dropbear. + upstream: Stop using DSA in dropbear interop tests. - Right now this is only dbclient not the Dropbear server since it won't - currently run as a ProxyCommand. - - OpenBSD-Regress-ID: 8cb898c414fcdb252ca6328896b0687acdaee496 + OpenBSD-Regress-ID: abfd4457d99d8cc1417fd22ca2c570270f74c1cf -commit c2003d0dbdcdb61ca336c3f90c5c2b4a09c8e73f -Author: Fabio Pedretti -Date: Mon Oct 16 11:59:53 2023 +0200 +commit 761438012710169445acc179e3870c53c862bda0 +Author: Damien Miller +Date: Tue Jun 18 12:29:45 2024 +1000 - Update openssl-devel dependency in RPM spec. - - Since openssh 9.4p1, openssl >= 1.1.1 is required, so - build with --without-openssl elsewhere. - According to https://repology.org/project/openssl/versions - openssl 1.1.1 is available on fedora >= 29 and rhel >= 8. - Successfully build tested, installed and run on rhel 6 + missed a bit of DSA in the fuzzer -commit 064e09cd632721c7e6889904e07767443ee23821 -Author: Fabio Pedretti -Date: Mon Oct 16 10:13:06 2023 +0200 +commit 3f9cc47da588e8de520720e59f98438043fdaf93 +Author: Damien Miller +Date: Tue Jun 18 09:35:53 2024 +1000 - Remove reference of dropped sshd.pam.old file + DSA support is disabled, so remove from fuzzers + +commit 00eb95957dea5484b2c7c043f7d2bbc87301bef2 +Author: djm@openbsd.org +Date: Mon Jun 17 08:30:29 2024 +0000 + + upstream: disable the DSA signature algorithm by default; ok - The file was removed in openssh 8.8 + markus@ + + (yes, I know this expands to "the Digitial Signature Algorithm + signature algorithm) + + OpenBSD-Commit-ID: 961ef594e46dd2dcade8dd5721fa565cee79ffed -commit 62db354b696b378a164b6e478cb6b0171dcb0c3d -Author: dtucker@openbsd.org -Date: Mon Oct 16 08:40:00 2023 +0000 +commit 5603befe11c9464ea26fe77cbacc95a7cc0b1ea7 +Author: djm@openbsd.org +Date: Mon Jun 17 08:28:31 2024 +0000 - upstream: Move declaration of "len" into the block where it's used. + upstream: promote connection-closed messages from verbose to info - This lets us compile Portable with -Werror with when OpenSSL doesn't have - Ed25519 support. + log level; they could be the only record of the connection terminating if the + client doesn't send a SSH2_MSG_DISCONNECT message. ok dtucker@ - OpenBSD-Commit-ID: e02e4b4af351946562a7caee905da60eff16ba29 + OpenBSD-Commit-ID: 0c8bfaf5e9fdff945cee09ac21e641f6c5d65d3c -commit 6eee8c972d5901d10e80634a006b4e346b2c8c19 +commit b00331402fe5c60d577f3ffcc35e49286cdc6b47 Author: Damien Miller -Date: Fri Oct 13 15:15:05 2023 +1100 +Date: Mon Jun 17 17:02:18 2024 +1000 - run t-extra regress tests + propagate PAM crashes to PerSourcePenalties - This exposes the t-extra regress tests (including agent-pkcs11.sh) as - a new extra-tests target in the top level Makefile and runs them by - default. ok dtucker@ + If the PAM subprocess crashes, exit with a crash status that will be + picked up by the sshd(8) listener process where it can be used by + PerSourcePenalties to block the client. This is similar handling to + the privsep preauth process. -commit 637624dbbac13f2bc3c8ec5b15c9d627d07f2935 -Author: Darren Tucker -Date: Thu Oct 12 22:01:23 2023 +1100 +commit 1c207f456ace38987deda047758d13fbf857f948 +Author: Damien Miller +Date: Mon Jun 17 15:06:01 2024 +1000 - Don't use make -j2. + minix doesn't have loopback, so skip penalty tests - While we have 2 cores available on github runners, not using it means - that the most recent log message is the actual failure, rather than - having to search back through the log for it. + pointed out by dtucker@ -commit 971e0cfcfd52ef1d73cf5244074c306a60006e89 -Author: Darren Tucker -Date: Thu Oct 12 16:23:05 2023 +1100 +commit 48443d202eaec52d4d39defdd709a4499a7140c6 +Author: djm@openbsd.org +Date: Sun Jun 16 11:54:49 2024 +0000 - Correct arg order for ED255519 AC_LINK_IFELSE test. + upstream: same treatment for this test + + OpenBSD-Regress-ID: d0cc9efca7833e673ea7b0cb3a679a3acee8d4c7 -commit c616e64688b2a0c1b4daad69b056099be998d121 +commit 45562a95ea11d328c22d97bf39401cd29684fb1f Author: djm@openbsd.org -Date: Thu Oct 12 03:51:08 2023 +0000 +Date: Sun Jun 16 08:18:06 2024 +0000 - upstream: typos and extra debug trace calls + upstream: penalty test is still a bit racy - OpenBSD-Regress-ID: 98a2a6b9333743274359e3c0f0e65cf919a591d1 + OpenBSD-Regress-ID: 90c9ac224db454637baf1ebee5857e007321e824 -commit c49a3fbf10162128c67c59562348de2041188974 +commit 8d0f7eb147ef72d18acb16c0b18672d44941a8ca Author: djm@openbsd.org -Date: Thu Oct 12 03:48:53 2023 +0000 +Date: Sat Jun 15 03:59:10 2024 +0000 - upstream: ensure logs are owned by correct user; feedback/ok + upstream: crank up penalty timeouts so this should work on even the - dtucker@ + slowest of test builders - OpenBSD-Regress-ID: c3297af8f07717f1d400a5d34529962f1a76b5a3 + OpenBSD-Regress-ID: 70bda39c83e3fc9d0f3c1fad4542ed33e173d468 -commit 5ec0ed79ac074c3437b25f6cba8b8cf21c8d4587 +commit 93c75471a1202ab3e29db6938648d4e2602c0475 +Author: jmc@openbsd.org +Date: Fri Jun 14 05:20:34 2024 +0000 + + upstream: sort -q in the options list; + + OpenBSD-Commit-ID: 6839b38378f38f754de638a5e988c13b4164cc7c + +commit dd7807bbe80a93ffb4616f2bd5cf83ad5a5595fb Author: djm@openbsd.org -Date: Thu Oct 12 03:36:32 2023 +0000 +Date: Fri Jun 14 05:01:22 2024 +0000 - upstream: 64 %-expansion keys ought to be enough for anybody; ok + upstream: clarify KEXAlgorithms supported vs available. Inspired by - dtucker (we just hit the previous limit in some cases) + bz3701 from Colin Watson. - OpenBSD-Commit-ID: 84070f8001ec22ff5d669f836b62f206e08c5787 + OpenBSD-Commit-ID: e698e69bea19bd52971d253f2b1094490c4701f7 -commit f59a94e22e46db2c23eddeb871aa9e8d93ab0016 +commit d172ad56df85b68316dbadbedad16761a1265874 Author: djm@openbsd.org -Date: Thu Oct 12 02:48:43 2023 +0000 +Date: Fri Jun 14 05:00:42 2024 +0000 - upstream: don't dereference NULL pointer when hashing jumphost + upstream: ssh-keyscan -q man bits - OpenBSD-Commit-ID: 251c0263e1759a921341c7efe7f1d4c73e1c70f4 + OpenBSD-Commit-ID: ba28d0e1ac609a4c99c453e57e86560c79079db1 -commit 281c79168edcc303abfd5bca983616eaa24c5f32 +commit 092e4ff9ccaacbe035f286feb1b56ed499604743 Author: Damien Miller -Date: Thu Oct 12 13:20:01 2023 +1100 +Date: Fri Jun 14 14:46:35 2024 +1000 - Solaris: prefer PRIV_XPOLICY to PRIV_LIMIT - - If the system support PRIV_XPOLICY and one is set, then don't - modify PRIV_LIMIT. bz2833, patch from Ron Jordan, ok dtucker@ + skip penalty-expire test in valgrind test env -commit 98fc34df837f3a3b79d2a111b96fe8a39adcab55 +commit 2866ad08a9c50d7b67ce9424ca990532b806a21a Author: djm@openbsd.org -Date: Thu Oct 12 02:18:18 2023 +0000 +Date: Fri Jun 14 04:43:11 2024 +0000 - upstream: add %j token that expands to the configured ProxyJump + upstream: split the PerSourcePenalties test in two: one tests penalty - hostname (or the empty string if this option is not being used). bz3610, ok - dtucker + enforcement but not penalty expiry, the other tests penalty expiry. - OpenBSD-Commit-ID: ce9983f7efe6a178db90dc5c1698df025df5e339 + This lets us disable the expiry testing in certain CI test environments. + + OpenBSD-Regress-ID: f56811064f3e3cb52ee73a206b8c2a06af1c8791 -commit 7f3180be8a85320b5d3221714b40c16e66881249 -Author: djm@openbsd.org -Date: Thu Oct 12 02:15:53 2023 +0000 +commit b2c64bc170d75823622a37cab3ca1804ca87ad16 +Author: Damien Miller +Date: Fri Jun 14 14:19:23 2024 +1000 - upstream: release GSS OIDs only at end of authentication; bz2982, + add a sshd_config PamServiceName option - ok dtucker@ + Allows selecting which PAM service name to use when UsePAM is + enabled. Defaults to "sshd" unless overridden at compile time + by defining SSHD_PAM_SERVICE. - OpenBSD-Commit-ID: 0daa41e0525ae63cae4483519ecaa37ac485d94c + bz2102, ok dtucker@ -commit a612b93de5d86e955bfb6e24278f621118eea500 +commit 9f032a4dd17bf0ae6066223d82aa5e784285d987 Author: djm@openbsd.org -Date: Thu Oct 12 02:12:53 2023 +0000 +Date: Fri Jun 14 00:26:12 2024 +0000 - upstream: mask SIGINT/TERM/QUIT/HUP before checking quit_pending + upstream: don't redirect stderr for ssh-keyscan we expect to succeed - and use ppoll() to unmask them in the mainloop. Avoids race condition between - signaling ssh to exit and polling. bz3531; ok dtucker - - OpenBSD-Commit-ID: 5c14e1aabcddedb95cdf972283d9c0d5083229e7 + OpenBSD-Regress-ID: 8878b8eb4e070ed2e343166d3eb86db4a08a216c -commit 531b27a006116fe7aff325510aaa576f24844452 +commit 1e84d0cf40e94ae3a77d6a7ca8c036d8e3d55a40 Author: djm@openbsd.org -Date: Wed Oct 11 23:23:58 2023 +0000 +Date: Fri Jun 14 00:25:25 2024 +0000 - upstream: sync usage() with ssh.1; spotted by kn@ + upstream: make host/banner comments go to stderr instead of stdout, - OpenBSD-Commit-ID: 191a85639477dcb5fa1616d270d93b7c8d5c1dfd - -commit 64f7ca881b19be754425dca60d1590d306c9d1d0 -Author: djm@openbsd.org -Date: Wed Oct 11 23:14:33 2023 +0000 - - upstream: ssh -Q does not make sense with other command-line options, + so they are useful as comments without extra shell redirection and so they + don't clutter actual errors on stderr. - so give it its own line in the manpage + Add a -q flag to shut them up. - OpenBSD-Commit-ID: 00a747f0655c12122bbb77c2796be0013c105361 + ok dtucker@ + + OpenBSD-Commit-ID: bec813de56a71adb5c1a76adcf49621130d24264 -commit a752a6c0e1001f93696d7025f0c867f0376e2ecf -Author: djm@openbsd.org -Date: Wed Oct 11 22:42:26 2023 +0000 +commit 3e806d011855d6bd648ec95b9df630ebbd11c3bf +Author: naddy@openbsd.org +Date: Thu Jun 13 15:06:33 2024 +0000 - upstream: add ChannelTimeout support to the client, mirroring the - - same option in the server. ok markus@ + upstream: separate keywords with comma - OpenBSD-Commit-ID: 55630b26f390ac063980cfe7ad8c54b03284ef02 + OpenBSD-Commit-ID: d65a99666202a8188c4991c18d14374a229f7be5 -commit 76e91e7238cdc5662bc818e2a48d466283840d23 +commit abfd1f7a3cbd0a92581a0febba254b2f6649c0d9 Author: djm@openbsd.org -Date: Wed Oct 11 22:41:05 2023 +0000 +Date: Fri Jun 14 00:23:55 2024 +0000 - upstream: add support for reading ED25519 private keys in PEM PKCS8 + upstream: specify an algorithm for ssh-keyscan, otherwise it will make - format; ok markus@ tb@ + multiple attempts simultaneously and confuse the test - OpenBSD-Commit-ID: 01b85c91757e6b057e9b23b8a23f96415c3c7174 + OpenBSD-Regress-ID: 6e910f3315c4345053db1bf5cbf61826b194d0b9 -commit fc77c8e352c0f44125425c05265e3a00c183d78a -Author: djm@openbsd.org -Date: Wed Oct 11 06:40:54 2023 +0000 +commit a8fbe2f7d0d96d299ee8e69769e3b51067978748 +Author: Damien Miller +Date: Thu Jun 13 16:41:29 2024 +1000 - upstream: mention "none" is a valid argument to IdentityFile; bz3080 + sshd: don't use argv[0] as PAM service name - OpenBSD-Commit-ID: 1b4fb590ef731099349a7d468b77f02b240ac926 - -commit c97520d23d1fe53d30725a2af25d2dddd6f2faff -Author: djm@openbsd.org -Date: Wed Oct 11 05:42:08 2023 +0000 - - upstream: in olde rcp/scp protocol mode, when rejecting a path from the + sshd would implicitly use argv[0] as the PAM service name to + allow people to select different PAM service names by making + differently-named copies/links to the sshd binary. - server as not matching the glob that the client sent, log (at debug level) - the received pathname as well as the list of possible expected paths expanded - from the glob. bz2966 + Splitting sshd into sshd/sshd-session broke this, as the process + that starts PAM is always sshd-session and the user has no control + over this. - OpenBSD-Commit-ID: 0bd8db8a595334ca86bca8f36e23fc0395315765 + Hardcode "sshd" as the default PAM service name unless/until we + figure out a better way. Should unbreak OSX integration tests. -commit 208c2b719879805983398160791d6a1ef9c2c3fc -Author: djm@openbsd.org -Date: Wed Oct 11 04:46:29 2023 +0000 +commit bf204bd05c3ae650f87e2b96527688579f59774c +Author: Damien Miller +Date: Thu Jun 13 15:00:28 2024 +1000 - upstream: s/%.100s/%s/ in SSH- banner construction as there's no + prepare for checking in autogenerated files - reason to limit its size: the version string bring included is a compile time - constant going into an allocated banner string. - - OpenBSD-Commit-ID: 0ef73304b9bf3e534c60900cd84ab699f859ebcd + We plan to check in automatically generated files (config.h.in, etc) on + release branches. These files are normally ignored by .gitignore, but + this shuffles the contents of this file to make it easy to un-ignore + them. -commit 0354790826b97c41bbd171a965574e159b58d83e -Author: tb@openbsd.org -Date: Tue Oct 10 06:49:54 2023 +0000 +commit 425f79a837489904c343b349ef00e09aeaa4e752 +Author: Damien Miller +Date: Thu Jun 13 14:41:33 2024 +1000 - upstream: Garbage collect cipher_get_keyiv_len() + typo in comment + +commit afe10313c1fa8d478af399ee7d54c8f85503013b +Author: Damien Miller +Date: Thu Jun 13 14:35:25 2024 +1000 + + fix PTY allocation on Cygwin, broken by sshd split - This is a compat20 leftover, unused since 2017. + Cygwin doesn't support FD passing and so used to disable post-auth + privilege separation entirely because privsep requires PTY allocation + to happen in the privileged monitor process with the PTY file + descriptors being passed back to the unprivileged process. - ok djm + This brings back a minimal version of the previous special treatment + for Cygwin (and any other platform that sets DISABLE_FD_PASSING): + privilege separation remains enabled, but PTY allocation happens in + the post-auth user process rather than the monitor. - OpenBSD-Commit-ID: 91fa5497c9dc6883064624ac27813a567883fdce + This either requires PTY allocation to not need privilege to begin + with (this appears to be the case on Cygwin), or the post-auth + privsep process retain privilege (other platforms that set the + DISABLE_FD_PASSING option). + + Keeping privileges here is bad, but the non-Cygwin systems that set + DISABLE_FD_PASSING are so deeply legacy that this is likely to be the + least of their problems. -commit 8d29ee4115001a02641386ae394992c65ed279e0 -Author: djm@openbsd.org -Date: Tue Oct 10 03:57:45 2023 +0000 +commit f66d4df5749551380a8c4ae642347675a0b6a2e9 +Author: Damien Miller +Date: Thu Jun 13 11:33:09 2024 +1000 - upstream: Reserve a range of "local extension" message numbers that - - OpenSSH promises not to use (comment change only) + delay lookup of privsep user until config loaded - OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03 + sshd-session attempting to use options.kerberos_authentication to + decide whether it needed to lookup the privsep user before the + configuration was loaded. This caused it to get a placeholder value + that caused it always to try to lookup the privsep user, breaking at + least one test environment. -commit 90b0d73d63a706e85f6431f05a62d2ce1b476472 -Author: djm@openbsd.org -Date: Fri Oct 6 03:32:15 2023 +0000 +commit f1c42858b94f5d9b58867b34dce3afb39c6b56a8 +Author: Damien Miller +Date: Thu Jun 13 11:16:57 2024 +1000 - upstream: typo in error message - - OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee + missing file for PerSourcePenalties regress test -commit e84517f51532ec913d8fb01a8aab7307134774bb +commit 4de80ff4e6fab5a6bb0028e7d57c6c23d1485adb Author: djm@openbsd.org -Date: Fri Oct 6 03:25:14 2023 +0000 +Date: Wed Jun 12 22:36:00 2024 +0000 - upstream: Perform the softhsm2 setup as discrete steps rather than + upstream: split PerSourcePenalties address tracking. Previously it - as a long shell pipeline. Makes it easier to figure out what has happened - when it breaks. + used one shared table and overflow policy for IPv4 and IPv6 addresses, now it + will use separate tables and optionally different overflow policies. - OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c - -commit cb54becff4d776238e0e9072943ba0872260535d -Author: claudio@openbsd.org -Date: Sun Sep 24 08:14:13 2023 +0000 - - upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to + This prevents misbehaviour from IPv6 addresses (which are vastly easier + to obtain many of) from affecting IPv4 connections and may allow for + stricter overflow policies. - overload the value here anymore. OK tb@ bluhm@ + ok deraadt@ - OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496 + OpenBSD-Commit-ID: 12637ed0aa4d5f1f3e702da42ea967cbd8bfdfd9 -commit f01f5137ceba65baf34ceac5a298c12ac01b1fef +commit 06ab4c6931b0aaa4334db2faaa7e1069e76d0df6 Author: jmc@openbsd.org -Date: Wed Oct 4 05:42:10 2023 +0000 +Date: Tue Jun 11 05:24:39 2024 +0000 - upstream: spelling fix; + upstream: do not mark up "(default: 20ms)"; - OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195 - -commit 80a2f64b8c1d27383cc83d182b73920d1e6a91f1 -Author: Damien Miller -Date: Wed Oct 4 15:34:10 2023 +1100 - - crank version numbers + OpenBSD-Commit-ID: 54151ecdecfa1b67dcdda4fd24826ef6e2148ad4 -commit f65f187b105d9b5c12fd750a211397d08c17c6d4 +commit cfe243cd9fde148ed060637876e27bb55ac78be9 Author: djm@openbsd.org -Date: Wed Oct 4 04:04:09 2023 +0000 +Date: Tue Jun 11 02:54:51 2024 +0000 - upstream: openssh-9.5 + upstream: reap preauth net child if it hangs up during privsep message - OpenBSD-Commit-ID: 5e0af680480bd3b6f5560cf840ad032d48fd6b16 + send, not just message receive + + OpenBSD-Commit-ID: 02a093f4ab4f8f83f0cd1ea2bb35b9ca420448f0 -commit ffe27e54a4bb18d5d3bbd3f4cc93a41b8d94dfd2 +commit b0a711c00b9c64afd1c9d6fb538275c6604a2676 Author: djm@openbsd.org -Date: Wed Oct 4 04:03:50 2023 +0000 +Date: Tue Jun 11 01:58:27 2024 +0000 - upstream: add some cautionary text about % token expansion and + upstream: fix PIDFILE handling, broken for SUDO=doas in last commit - shell metacharacters; based on report from vinci AT protonmail.ch + here - OpenBSD-Commit-ID: aa1450a54fcee2f153ef70368d90edb1e7019113 + OpenBSD-Regress-ID: 96fec579af228f87a036e94801eb294af9074625 -commit 60ec3d54fd1ebfe2dda75893fa1e870b8dffbb0d +commit 90fb801e2d9241be50a2a7ff79428386442a041f Author: djm@openbsd.org -Date: Tue Oct 3 23:56:10 2023 +0000 +Date: Tue Jun 11 02:00:30 2024 +0000 - upstream: fix link to agent draft; spotted by Jann Horn + upstream: reap the pre-auth [net] child if it hangs up during privsep - OpenBSD-Commit-ID: ff5bda21a83ec013db683e282256a85201d2dc4b - -commit 12e2d4b13f6f63ce2de13cbfcc9e4d0d4b4ab231 -Author: Damien Miller -Date: Wed Oct 4 10:54:04 2023 +1100 - - use portable provider allowlist path in manpage + message sending, not just receiving - spotted by Jann Horn + OpenBSD-Commit-ID: f7341605bf08c4c15830910446e6775323f2f8cb -commit 6c2c6ffde75df95fd838039850d3dd3d84956d87 -Author: deraadt@openbsd.org -Date: Tue Sep 19 20:37:07 2023 +0000 +commit ef878d58798f6688c7f4d4e417dc0c29023ea831 +Author: djm@openbsd.org +Date: Tue Jun 11 01:23:25 2024 +0000 - upstream: typo; from Jim Spath + upstream: a little more RB_TREE paranoia - OpenBSD-Commit-ID: 2f5fba917b5d4fcf93d9e0b0756c7f63189e228e + OpenBSD-Commit-ID: 8dc2fd21eebd8830c4a4d25461ac4fe228e11156 -commit b6b49130a0089b297245ee39e769231d7c763014 +commit fc4e96b2174d6a894d2033421699d091679baced Author: djm@openbsd.org -Date: Sun Sep 10 23:12:32 2023 +0000 +Date: Tue Jun 11 01:22:25 2024 +0000 - upstream: rename remote_glob() -> sftp_glob() to match other API + upstream: fix off-by-one comparison for PerSourcePenalty - OpenBSD-Commit-ID: d9dfb3708d824ec02970a84d96cf5937e0887229 + OpenBSD-Commit-ID: af4f5d01c41ef870b23e55655bfbf73474a6c02b -commit 21b79af6c8d2357c822c84cef3fbdb8001ed263b +commit 82c836df4ff41145553cd7adb11c5b985aeaa06f Author: djm@openbsd.org -Date: Sun Sep 10 03:51:55 2023 +0000 +Date: Tue Jun 11 01:21:41 2024 +0000 - upstream: typo in comment + upstream: move tree init before possible early return - OpenBSD-Commit-ID: 69285e0ce962a7c6b0ab5f17a293c60a0a360a18 + OpenBSD-Commit-ID: 72e2c5b69f151c08a7c5bf5ad929b97a92c273df -commit 41232d25532b4d2ef6c5db62efc0cf50a79d26ca -Author: Darren Tucker -Date: Sun Sep 10 15:45:38 2023 +1000 +commit a2300f015cc4939c4d9c564b58b74e71202dc978 +Author: djm@openbsd.org +Date: Tue Jun 11 01:07:35 2024 +0000 - Use zero-call-used-regs=used with Apple compilers. + upstream: update to mention that PerSourcePenalties default to - Apple's versions of clang have version numbers that do not match the - corresponding upstream clang versions. Unfortunately, they do still - have the clang-15 zero-call-used-regs=all bug, so for now use the value - that doesn't result in segfaults. We could allowlist future versions - that are known to work. bz#3584 (and probably also our github CI - failures). + being enabled and document the default values for each parameter. + + OpenBSD-Commit-ID: b981288bddfb097aad269f62df4081c688ce0034 -commit 90ccc5918ea505bf156c31148b6b59a1bf5d6dc6 +commit 41987efd356d3fc30139aeab4b09374acf8f91a0 Author: djm@openbsd.org -Date: Sun Sep 10 03:25:53 2023 +0000 +Date: Tue Jun 11 00:44:52 2024 +0000 - upstream: randomise keystroke obfuscation intervals and average + upstream: reap the [net] child if it hangs up while writing privsep - interval rate. ok dtucker@ + message payloads, not just the message header - OpenBSD-Commit-ID: 05f61d051ab418fcfc4857ff306e420037502382 + OpenBSD-Commit-ID: 24dbd400aa381ac96be7ed2dd49018487dfef6ce -commit bd1b9e52f5fa94d87223c90905c5fdc1a7c32aa6 +commit 6211aa085fa91155a24922e5329576ac9a8f3175 Author: djm@openbsd.org -Date: Fri Sep 8 06:34:24 2023 +0000 +Date: Tue Jun 11 00:40:21 2024 +0000 - upstream: fix sizeof(*ptr) instead sizeof(ptr) in realloc (pointer here - - is char**, so harmless); spotted in CID 416964 + upstream: log waitpid() status for abnormal exits - OpenBSD-Commit-ID: c61caa4a5a667ee20bb1042098861e6c72c69002 + OpenBSD-Commit-ID: b317930e06b51819c1a2bc6a4359764fecfb1c2d -commit c4f966482983e18601eec70a1563115de836616f +commit a59634c7adb9ae988748d99963dfafb3070d8d41 Author: djm@openbsd.org -Date: Fri Sep 8 06:10:57 2023 +0000 +Date: Tue Jun 11 00:36:20 2024 +0000 - upstream: regress test recursive remote-remote directories copies where - - the directory contains a symlink to another directory. - - also remove errant `set -x` that snuck in at some point + upstream: correct error message - OpenBSD-Regress-ID: 1c94a48bdbd633ef2285954ee257725cd7bc456f + OpenBSD-Commit-ID: 581f60f73099083392887206860229ab104620ed -commit 5e1dfe5014ebc194641678303e22ab3bba15f4e5 -Author: djm@openbsd.org -Date: Fri Sep 8 06:10:02 2023 +0000 +commit fa7d7a667f2ee031e72873e36de2d2a36bca973b +Author: deraadt@openbsd.org +Date: Fri Jun 7 13:23:30 2024 +0000 - upstream: fix recursive remote-remote copies of directories that + upstream: avoid shadowing issues which some compilers won't accept - contain symlinks to other directories (similar to bz3611) + ok djm - OpenBSD-Commit-ID: 7e19d2ae09b4f941bf8eecc3955c9120171da37f + OpenBSD-Commit-ID: 1e89572397dda83433d58c4fa6333a08f51170d4 -commit 7c0ce2bf98b303b6ad91493ee3247d96c18ba1f6 -Author: djm@openbsd.org -Date: Fri Sep 8 05:50:57 2023 +0000 +commit 3ad4cd9eeca5c9bc6706db44b6de88e2e4513fd6 +Author: jmc@openbsd.org +Date: Thu Jun 6 21:14:49 2024 +0000 - upstream: regress test for recursive copies of directories containing + upstream: escape the final dot at eol in "e.g." to avoid double - symlinks to other directories. bz3611, ok dtucker@ + spacing; - OpenBSD-Regress-ID: eaa4c29cc5cddff4e72a16bcce14aeb1ecfc94b9 + OpenBSD-Commit-ID: 0a9fb10bc9f7d577afe2da3f498a08bc431115b9 -commit 2de990142a83bf60ef694378b8598706bc654b08 +commit 0e0c69761a4c33ccd4a256560f522784a753d1a8 Author: djm@openbsd.org -Date: Fri Sep 8 05:56:13 2023 +0000 +Date: Thu Jun 6 20:25:48 2024 +0000 - upstream: the sftp code was one of my first contributions to + upstream: enable PerSourcePenalties by default. - OpenSSH and it shows - the function names are terrible. + ok markus - Rename do_blah() to sftp_blah() to make them less so. + NB. if you run a sshd that accepts connections from behind large NAT + blocks, proxies or anything else that aggregates many possible users + behind few IP addresses, then this change may cause legitimate traffic + to be denied. - Completely mechanical except for sftp_stat() and sftp_lstat() which - change from returning a pointer to a static variable (error-prone) to - taking a pointer to a caller-provided receiver. + Please read the PerSourcePenalties, PerSourcePenaltyExemptList and + PerSourceNetBlockSize options in sshd_config(5) for how to tune your + sshd(8) for your specific circumstances. - OpenBSD-Commit-ID: eb54d6a72d0bbba4d623e2175cf5cc4c75dc2ba4 + OpenBSD-Commit-ID: 24a0e5c23d37e5a63e16d2c6da3920a51078f6ce -commit 249d8bd0472b53e3a2a0e138b4c030a31e83346a +commit bd1f74741daabeaf20939a85cd8cec08c76d0bec Author: djm@openbsd.org -Date: Fri Sep 8 05:50:12 2023 +0000 +Date: Thu Jun 6 20:20:42 2024 +0000 - upstream: fix scp in SFTP mode recursive upload and download of + upstream: mention that PerSourcePenalties don't affect concurrent - directories that contain symlinks to other directories. In scp mode, the - links would be followed, but in SFTP mode they were not. bz3611, ok dtucker@ + in-progress connections. - OpenBSD-Commit-ID: 9760fda668eaa94a992250d7670dfbc62a45197c + OpenBSD-Commit-ID: 20389da6264f2c97ac3463edfaa1182c212d420c -commit 0e1f4401c466fa4fdaea81b6dadc8dd1fc4cf0af +commit 9774b938578327d88a651f4c63c504809717590a Author: djm@openbsd.org -Date: Wed Sep 6 23:36:09 2023 +0000 +Date: Thu Jun 6 19:49:25 2024 +0000 - upstream: regression test for override of subsystem in match blocks + upstream: regress test for PerSourcePenalties - OpenBSD-Regress-ID: 5f8135da3bfda71067084c048d717b0e8793e87c + OpenBSD-Regress-ID: a1af13d411b25a727742644459d26480b9a1b0f1 -commit 8a1450c62035e834d8a79a5d0d1c904236f9dcfe +commit b8ebd86cefe9812204a10c028dc90de29918667d Author: djm@openbsd.org -Date: Wed Sep 6 23:35:35 2023 +0000 +Date: Thu Jun 6 19:48:40 2024 +0000 - upstream: allow override of Sybsystem directives in sshd Match - - blocks + upstream: make sure logs are saved from sshd run via start_sshd - OpenBSD-Commit-ID: 3911d18a826a2d2fe7e4519075cf3e57af439722 + OpenBSD-Regress-ID: de4ef0e32e3ab85ff3a6c36eb08d1909c0dd1b4a -commit 6e52826e2a74d077147a82ead8d4fbd5b54f4e3b +commit d7b2070bdaa4ebbfafb9975c1d5a62b73289d31f Author: djm@openbsd.org -Date: Wed Sep 6 23:26:37 2023 +0000 +Date: Thu Jun 6 19:47:48 2024 +0000 - upstream: allocate the subsystems array as necessary and remove the - - fixed limit of subsystems. Saves a few kb of memory in the server and makes - it more like the other options. + upstream: simplify - OpenBSD-Commit-ID: e683dfca6bdcbc3cc339bb6c6517c0c4736a547f + OpenBSD-Regress-ID: 50316e0d1ae0c0a057a45af042253e54ce23d11c -commit e19069c9fac4c111d6496b19c7f7db43b4f07b4f +commit e6ea3d224513b6bfb93818809d4c7397f5995ba2 Author: djm@openbsd.org -Date: Wed Sep 6 23:23:53 2023 +0000 +Date: Thu Jun 6 18:48:13 2024 +0000 - upstream: preserve quoting of Subsystem commands and arguments. + upstream: prepare for PerSourcePenalties being enabled by default - This may change behaviour of exotic configurations, but the most common - subsystem configuration (sftp-server) is unlikely to be affected. + in future - OpenBSD-Commit-ID: 8ffa296aeca981de5b0945242ce75aa6dee479bf + OpenBSD-Regress-ID: 5236c6d1c823997aac5a35e2915da30f1903bec7 -commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b +commit c0cb3b8c837761816a60a3cdb54062668df09652 Author: djm@openbsd.org -Date: Wed Sep 6 23:21:36 2023 +0000 +Date: Thu Jun 6 19:50:01 2024 +0000 - upstream: downgrade duplicate Subsystem directives from being a - - fatal error to being a debug message to match behaviour with just about all - other directives. + upstream: disable stderr redirection before closing fds - OpenBSD-Commit-ID: fc90ed2cc0c18d4eb8e33d2c5e98d25f282588ce + OpenBSD-Commit-ID: d42cb895ee4542098050367fc35321c9303f003a -commit 1ee0a16e07b6f0847ff463d7b5221c4bf1876e25 +commit 81c1099d22b81ebfd20a334ce986c4f753b0db29 Author: djm@openbsd.org -Date: Wed Sep 6 23:18:15 2023 +0000 +Date: Thu Jun 6 17:15:25 2024 +0000 - upstream: handle cr+lf (instead of just cr) in sshsig signature + upstream: Add a facility to sshd(8) to penalise particular - files + problematic client behaviours, controlled by two new sshd_config(5) options: + PerSourcePenalties and PerSourcePenaltyExemptList. - OpenBSD-Commit-ID: 647460a212b916540016d066568816507375fd7f - -commit e1c284d60a928bcdd60bc575c6f9604663502770 -Author: job@openbsd.org -Date: Mon Sep 4 10:29:58 2023 +0000 - - upstream: Generate Ed25519 keys when invoked without arguments + When PerSourcePenalties are enabled, sshd(8) will monitor the exit + status of its child pre-auth session processes. Through the exit + status, it can observe situations where the session did not + authenticate as expected. These conditions include when the client + repeatedly attempted authentication unsucessfully (possibly indicating + an attack against one or more accounts, e.g. password guessing), or + when client behaviour caused sshd to crash (possibly indicating + attempts to exploit sshd). - Ed25519 public keys are very convenient due to their small size. - OpenSSH has supported Ed25519 since version 6.5 (January 2014). + When such a condition is observed, sshd will record a penalty of some + duration (e.g. 30 seconds) against the client's address. If this time + is above a minimum threshold specified by the PerSourcePenalties, then + connections from the client address will be refused (along with any + others in the same PerSourceNetBlockSize CIDR range). - OK djm@ markus@ sthen@ deraadt@ + Repeated offenses by the same client address will accrue greater + penalties, up to a configurable maximum. A PerSourcePenaltyExemptList + option allows certain address ranges to be exempt from all penalties. - OpenBSD-Commit-ID: f498beaad19c8cdcc357381a60df4a9c69858b3f + We hope these options will make it significantly more difficult for + attackers to find accounts with weak/guessable passwords or exploit + bugs in sshd(8) itself. + + PerSourcePenalties is off by default, but we expect to enable it + automatically in the near future. + + much feedback markus@ and others, ok markus@ + + OpenBSD-Commit-ID: 89ded70eccb2b4926ef0366a4d58a693de366cca -commit 694150ad92765574ff82a18f4e86322bd3231e68 -Author: djm@openbsd.org -Date: Mon Sep 4 00:08:14 2023 +0000 +commit 916b0b6174e203cf2c5ec9bcf409472eb7ffbf43 +Author: Damien Miller +Date: Fri Jun 7 03:31:02 2024 +1000 - upstream: trigger keystroke timing obfucation only if the channels - - layer enqueud some data in the last poll() cycle; this avoids triggering the - obfuscatior for non-channels data like ClientAlive probes and also fixes a - related problem were the obfucations would be triggered on fully quiescent - connections. + whitespace + +commit 49b55e44182b8294419aa580cbf043d5b9e3d953 +Author: deraadt@openbsd.org +Date: Tue Jun 4 15:14:45 2024 +0000 + + upstream: enable -fret-clean on amd64, for libc libcrypto ld.so - Based on / tested by naddy@ + kernel, and all the ssh tools. The dynamic objects are entirely ret-clean, + static binaries will contain a blend of cleaning and non-cleaning callers. - OpenBSD-Commit-ID: d98f32dc62d7663ff4660e4556e184032a0db123 + OpenBSD-Commit-ID: 112aacedd3b61cc5c34b1fa6d9fb759214179172 -commit b5fd97896b59a3a46245cf438cc8b16c795d9f74 +commit cc80d51d034bcb24fd0f2564a4bdf1612000a2a2 +Author: Damien Miller +Date: Wed Jun 5 02:21:30 2024 +1000 + + remove PRIVSEP macros for osx + +commit 8785491123d4d722b310c20f383570be758f8263 Author: djm@openbsd.org -Date: Mon Sep 4 00:04:02 2023 +0000 +Date: Sat Jun 1 07:03:37 2024 +0000 - upstream: avoid bogus "obfuscate_keystroke_timing: stopping ..." + upstream: be really strict with fds reserved for communication with the - debug messages when keystroke timing obfuscation was never started; spotted - by naddy@ + separate sshd-session process - reserve them early and fatal if we can't + dup2(2) them later. The pre-split fallback to re-reading the configuration + files is not possible, so sshd-session absolutely requires the fd the + configuration is passed over to be in order. - OpenBSD-Commit-ID: 5c270d35f7d2974db5c1646e9c64188f9393be31 + ok deraadt@ + + OpenBSD-Commit-ID: 308a98ef3c8a6665ebf92c7c9a0fc9600ccd7065 -commit ccf7d913db34e49b7a6db1b8331bd402004c840d -Author: djm@openbsd.org -Date: Mon Sep 4 00:01:46 2023 +0000 +commit f1c8918cb98459910fb159373baea053ba4108c0 +Author: Damien Miller +Date: Fri May 31 19:12:26 2024 +1000 - upstream: make channel_output_poll() return a flag indicating - - whether channel data was enqueued. Will be used to improve keystroke timing - obfuscation. Problem spotted by / tested by naddy@ + depend + +commit 94b4866cb1f4b0ed29a9f367047b30f81002316f +Author: Damien Miller +Date: Fri May 31 19:11:14 2024 +1000 + + rename need_privsep to need_chroot - OpenBSD-Commit-ID: f9776c7b0065ba7c3bbe50431fd3b629f44314d0 + privsep is mandatory, chroot is optional (disabled when running + sshd as non-root) -commit 43254b326ac6e2131dbd750f9464dc62c14bd5a7 +commit e68a95142e5024b144f8eeccd5ffdee42c34f44c +Author: Damien Miller +Date: Fri May 31 19:05:34 2024 +1000 + + remove remaining use_privsep mention + +commit b21d271f651d2536dca819cc6d74032fe98634db Author: djm@openbsd.org -Date: Sun Sep 3 23:59:32 2023 +0000 +Date: Fri May 31 09:01:08 2024 +0000 - upstream: set interactive mode for ControlPersist sessions if they + upstream: warn when -r (deprecated option to disable re-exec) is - originally requested a tty; enables keystroke timing obfuscation for most - ControlPersist sessions. Spotted by naddy@ + passed - OpenBSD-Commit-ID: 72783a26254202e2f3f41a2818a19956fe49a772 + OpenBSD-Commit-ID: 73145ef5150edbe3ce7889f0844ed8fa6155f551 -commit ff3eda68ceb2e2bb8f48e3faceb96076c3e85c20 -Author: Darren Tucker -Date: Thu Aug 31 23:02:35 2023 +1000 +commit a4b5bc246cbca476deeeb4462aa31746a56e3021 +Author: djm@openbsd.org +Date: Fri May 31 08:49:35 2024 +0000 - Set LLONG_MAX for C89 test. + upstream: typos - If we don't have LLONG_MAX, configure will figure out that it can get it - by setting -std=gnu99, at which point we won't be testing C89 any more. - To avoid this, feed it in via CFLAGS. + OpenBSD-Commit-ID: edfa72eb06bfa65da30fabf7d2fe76d2d33f77bf -commit f98031773db361424d59e3301aa92aacf423d920 +commit 8054b906983ceaed01fabd8188d3dac24c05ba39 Author: djm@openbsd.org -Date: Tue Aug 29 02:50:10 2023 +0000 +Date: Mon May 27 01:52:26 2024 +0000 - upstream: make PerSourceMaxStartups first-match-wins; ok dtucker@ + upstream: don't need sys/queue.h here - OpenBSD-Commit-ID: dac0c24cb709e3c595b8b4f422a0355dc5a3b4e7 + OpenBSD-Commit-ID: dd137396828171eb19e4911581812ca58de6c578 -commit cfa66857db90cd908de131e0041a50ffc17c7df8 -Author: djm@openbsd.org -Date: Mon Aug 28 09:52:09 2023 +0000 +commit 210d4239733da6180ce853538aeb9413d5c62ad5 +Author: naddy@openbsd.org +Date: Sun May 26 20:35:12 2024 +0000 - upstream: descriptive text shouldn't be under .Cm + upstream: remove references to SSH1 and DSA server keys - OpenBSD-Commit-ID: b1afaeb456a52bc8a58f4f9f8b2f9fa8f6bf651b + OpenBSD-Commit-ID: 57cc1c98d4f998981473734f144b904af7d178a2 -commit 01dbf3d46651b7d6ddf5e45d233839bbfffaeaec -Author: djm@openbsd.org -Date: Mon Aug 28 09:48:11 2023 +0000 +commit f0b9261d7fdd0ef86806b49fe76344bd16770cd0 +Author: jsg@openbsd.org +Date: Thu May 23 23:47:16 2024 +0000 - upstream: limit artificial login delay to a reasonable maximum (5s) + upstream: remove unused struct fwd_perm_list, no decl with complete - and don't delay at all for the "none" authentication mechanism. Patch by - Dmitry Belyavskiy in bz3602 with polish/ok dtucker@ + type ok djm@ - OpenBSD-Commit-ID: 85b364676dd84cf1de0e98fc2fbdcb1a844ce515 + OpenBSD-Commit-ID: 416fb3970b7e73c76d2963c4f00cf96f2b2ee2fb -commit 528da5b9d7c5da01ed7a73ff21c722e1b5326006 -Author: jmc@openbsd.org -Date: Mon Aug 28 05:32:28 2023 +0000 +commit 2477a98c3ef78e63b11a1393656e00288f52ae97 +Author: naddy@openbsd.org +Date: Wed May 22 15:24:55 2024 +0000 - upstream: add spacing for punctuation when macro args; + upstream: Do not pass -Werror twice when building with clang. - OpenBSD-Commit-ID: e80343c16ce0420b2aec98701527cf90371bd0db + OpenBSD-Commit-ID: 5f378c38ad8976d507786dc4db9283a879ec8cd0 -commit 3867361ca691d0956ef7d5fb8181cf554a91d84a -Author: djm@openbsd.org -Date: Mon Aug 28 04:06:52 2023 +0000 +commit 435844f5675245b4271f8581f15e6d1f34fde3bc +Author: miod@openbsd.org +Date: Wed May 22 11:49:36 2024 +0000 - upstream: explicit long long type in timing calculations (doesn't + upstream: Do not pass -Werror if building with gcc 3, for asn1.h - matter, since the range is pre-clamped) + and bio.h cause (admittedly bogus) warnings with gcc 3. - OpenBSD-Commit-ID: f786ed902d04a5b8ecc581d068fea1a79aa772de + OpenBSD-Commit-ID: fb39324748824cb0387e9d67c41d1bef945c54ea -commit 7603ba71264e7fa938325c37eca993e2fa61272f +commit fc5dc092830de23767c6ef67baa18310a64ee533 Author: djm@openbsd.org -Date: Mon Aug 28 03:31:16 2023 +0000 +Date: Wed May 22 04:20:00 2024 +0000 - upstream: Add keystroke timing obfuscation to the client. + upstream: this test has been broken since 2014, and has been - This attempts to hide inter-keystroke timings by sending interactive - traffic at fixed intervals (default: every 20ms) when there is only a - small amount of data being sent. It also sends fake "chaff" keystrokes - for a random interval after the last real keystroke. These are - controlled by a new ssh_config ObscureKeystrokeTiming keyword/ + testing the same key exchange algorithm repeatedly instead of testing all of + them. Spotted by nreilly AT blackberry.com in bz3692 - feedback/ok markus@ + Who broke the test? me. - OpenBSD-Commit-ID: 02231ddd4f442212820976068c34a36e3c1b15be + OpenBSD-Regress-ID: 48f4f5946276f975667141957d25441b3c9a50e2 -commit dce6d80d2ed3cad2c516082682d5f6ca877ef714 -Author: djm@openbsd.org -Date: Mon Aug 28 03:28:43 2023 +0000 +commit fd4816791beaed2fdae7eea3e1494d1972b2a39d +Author: anton@openbsd.org +Date: Sun May 19 19:10:01 2024 +0000 - upstream: Introduce a transport-level ping facility - - This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG - to implement a ping capability. These messages use numbers in the "local - extensions" number space and are advertised using a "ping@openssh.com" - ext-info message with a string version number of "0". + upstream: Add missing kex-names.c source file required since the - ok markus@ + ssh split. - OpenBSD-Commit-ID: b6b3c4cb2084c62f85a8dc67cf74954015eb547f + OpenBSD-Regress-ID: ca666223f828fc4b069cb9016bff1eb50faf9fbb -commit d2d247938b38b928f8a6e1a47a330c5584d3a358 -Author: tobhe@openbsd.org -Date: Mon Aug 21 21:16:18 2023 +0000 +commit beccb7319c5449f6454889013403c336446d622e +Author: naddy@openbsd.org +Date: Fri May 17 14:42:00 2024 +0000 - upstream: Log errors in kex_exchange_identification() with level + upstream: remove duplicate copy of relink kit for sshd-session - verbose instead of error to reduce preauth log spam. All of those get logged - with a more generic error message by sshpkt_fatal(). + OpenBSD-Commit-ID: 6d2ded4cd91d4d727c2b26e099b91ea935bed504 + +commit dcd79fa141311c287e0595ede684b7116122fae0 +Author: jsg@openbsd.org +Date: Fri May 17 06:42:04 2024 +0000 + + upstream: remove prototypes with no matching function; ok djm@ - feedback from sthen@ - ok djm@ + OpenBSD-Commit-ID: 6d9065dadea5f14a01bece0dbfe2fba1be31c693 + +commit 6454a05e7c6574d70adf17efe505a8581a86ca4f +Author: jsg@openbsd.org +Date: Fri May 17 06:38:00 2024 +0000 + + upstream: remove externs for removed vars; ok djm@ - OpenBSD-Commit-ID: bd47dab4695b134a44c379f0e9a39eed33047809 + OpenBSD-Commit-ID: f51ea791d45c15d4927eb4ae7d877ccc1e5a2aab -commit 9d7193a8359639801193ad661a59d1ae4dc3d302 -Author: djm@openbsd.org -Date: Mon Aug 21 04:59:54 2023 +0000 +commit f3e4db4601ef7d2feb1d6f7447e432aaf353a616 +Author: deraadt@openbsd.org +Date: Fri May 17 06:11:17 2024 +0000 - upstream: correct math for ClientAliveInterval that caused the + upstream: -Werror was turned on (probably just for development), - probes to be sent less frequently than configured; from Dawid Majchrzak + and this is a simple way to satisfy older gcc. - OpenBSD-Commit-ID: 641153e7c05117436ddfc58267aa267ca8b80038 + OpenBSD-Commit-ID: 7f698df54384b437ce33ab7405f0b86c87019e86 -commit 3c6ab63b383b0b7630da175941e01de9db32a256 -Author: Darren Tucker -Date: Fri Aug 25 14:48:02 2023 +1000 +commit 24a1f3e5ad6f4a49377d4c74c36637e9a239efd0 +Author: Damien Miller +Date: Fri May 17 14:50:43 2024 +1000 - Include Portable version in sshd version string. + attempt at updating RPM specs for sshd-session + +commit 17b566eeb7a0c6acc9c48b35c08885901186f861 +Author: djm@openbsd.org +Date: Fri May 17 04:42:13 2024 +0000 + + upstream: g/c unused variable - bz#3608, ok djm@ + OpenBSD-Commit-ID: aa6ef0778a1f1bde0d73efba72a777c48d2bd010 -commit 17fa6cd10a26e193bb6f65d21264d2fe553bcd87 -Author: Darren Tucker -Date: Mon Aug 21 19:47:58 2023 +1000 +commit 01fb82eb2aa0a4eaf5c394ea8bb37ea4c26f8a3f +Author: jsg@openbsd.org +Date: Fri May 17 02:39:11 2024 +0000 - obsd-arm64 host is real hardware... + upstream: spelling; ok djm@ - so put in the correct config location. + OpenBSD-Commit-ID: bdea29bb3ed2a5a7782999c4c663b219d2270483 -commit 598ca75c85acaaacee5ef954251e489cc20d7be9 -Author: Darren Tucker -Date: Mon Aug 21 18:38:36 2023 +1000 +commit b88b690e99145a021fc1a1a116a11e0bce0594e7 +Author: djm@openbsd.org +Date: Fri May 17 01:45:22 2024 +0000 - Add OpenBSD ARM64 test host. + upstream: allow overriding the sshd-session binary path + + OpenBSD-Regress-ID: 5058cd1c4b6ca1a15474e33546142931d9f964da -commit 1acac79bfbe207e8db639e8043524962037c8feb -Author: Darren Tucker -Date: Mon Aug 21 18:05:26 2023 +1000 +commit a68f80f2511f0e0c5cef737a8284cc2dfabad818 +Author: anton@openbsd.org +Date: Wed Apr 3 06:01:11 2024 +0000 - Add test for zlib development branch. + upstream: Since ssh-agent(1) is only readable by root by now, use + + ssh(1) while generating data in tests. + + OpenBSD-Regress-ID: 24eb40de2e6b0ace185caaba35e2d470331ffe68 -commit 84efebf352fc700e9040c8065707c63caedd36a3 +commit 92e55890314ce2b0be21a43ebcbc043b4abc232f Author: djm@openbsd.org -Date: Mon Aug 21 04:36:46 2023 +0000 +Date: Fri May 17 01:17:40 2024 +0000 - upstream: want stdlib.h for free(3) + upstream: fix incorrect debug option name introduce in previous - OpenBSD-Commit-ID: 743af3c6e3ce5e6cecd051668f0327a01f44af29 + commit + + OpenBSD-Commit-ID: 66d69e22b1c072c694a7267c847f212284614ed3 -commit cb4ed12ffc332d1f72d054ed92655b5f1c38f621 -Author: Darren Tucker -Date: Sat Aug 19 07:39:08 2023 +1000 +commit 4ad72878af7b6ec28da6e230e36a91650ebe84c1 +Author: deraadt@openbsd.org +Date: Fri May 17 00:33:25 2024 +0000 - Fix zlib version check for 1.3 and future version. + upstream: construct and install a relink-kit for sshd-session ok - bz#3604. + djm + + OpenBSD-Commit-ID: 8b3820adb4da4e139c4b3cffbcc0bde9f08bf0c6 -commit 25b75e21f16bccdaa472ea1889b293c9bd51a87b -Author: Darren Tucker -Date: Mon Aug 14 11:10:08 2023 +1000 +commit 02e679a2cb3f6df8e9dbb1519ed578226485157f +Author: Damien Miller +Date: Fri May 17 12:21:27 2024 +1000 - Add 9.4 branch to CI status page. + Makefile support for sshd-session -commit 803e22eabd3ba75485eedd8b7b44d6ace79f2052 +commit c0416035c5eaf70a8450d11c8833c5f7068ee7ad Author: djm@openbsd.org -Date: Fri Aug 18 01:37:41 2023 +0000 +Date: Fri May 17 00:32:32 2024 +0000 - upstream: fix regression in OpenSSH 9.4 (mux.c r1.99) that caused - - multiplexed sessions to ignore SIGINT under some circumstances. Reported by / - feedback naddy@, ok dtucker@ + upstream: missing files from previous - OpenBSD-Commit-ID: 4d5c6c894664f50149153fd4764f21f43e7d7e5a + OpenBSD-Commit-ID: 4b7be4434d8799f02365552b641a7a70a7ebeb2f -commit e706bca324a70f68dadfd0ec69edfdd486eed23a +commit 03e3de416ed7c34faeb692967737be4a7bbe2eb5 Author: djm@openbsd.org -Date: Wed Aug 16 16:14:11 2023 +0000 +Date: Fri May 17 00:30:23 2024 +0000 - upstream: defence-in-depth MaxAuthTries check in monitor; ok markus + upstream: Start the process of splitting sshd into separate - OpenBSD-Commit-ID: 65a4225dc708e2dae71315adf93677edace46c21 + binaries. This step splits sshd into a listener and a session binary. More + splits are planned. + + After this changes, the listener binary will validate the configuration, + load the hostkeys, listen on port 22 and manage MaxStartups only. All + session handling will be performed by a new sshd-session binary that the + listener fork+execs. + + This reduces the listener process to the minimum necessary and sets us + up for future work on the sshd-session binary. + + feedback/ok markus@ deraadt@ + + NB. if you're updating via source, please restart sshd after installing, + otherwise you run the risk of locking yourself out. + + OpenBSD-Commit-ID: 43c04a1ab96cdbdeb53d2df0125a6d42c5f19934 -commit d1ab7eb90474df656d5e9935bae6df0bd000d343 +commit 1c0d81357921f8d3bab06841df649edac515ae5b Author: djm@openbsd.org -Date: Mon Aug 14 03:37:00 2023 +0000 +Date: Thu May 9 09:46:47 2024 +0000 - upstream: add message number of SSH2_MSG_NEWCOMPRESS defined in RFC8308 + upstream: simplify exit message handling, which was more complicated - OpenBSD-Commit-ID: 6c984171c96ed67effd7b5092f3d3975d55d6028 - -commit fa8da52934cb7dff6f660a143276bdb28bb9bbe1 -Author: Darren Tucker -Date: Sun Aug 13 15:01:27 2023 +1000 - - Add obsd72 and obsd73 test targets. + than it needed to be because of unexpunged ssh1 remnants. ok markus@ + + OpenBSD-Commit-ID: 8b0cd2c0dee75fb053718f442aa89510b684610b -commit f9f18006678d2eac8b0c5a5dddf17ab7c50d1e9f -Author: djm@openbsd.org -Date: Thu Aug 10 23:05:48 2023 +0000 +commit cbbbf76aa6cd54fce32eacce1300e7abcf9461d4 +Author: tobias@openbsd.org +Date: Mon May 6 19:26:17 2024 +0000 - upstream: better debug logging of sessions' exit status + upstream: remove SSH1 leftovers - OpenBSD-Commit-ID: 82237567fcd4098797cbdd17efa6ade08e1a36b0 + Authored with Space Meyer + + ok djm + + OpenBSD-Commit-ID: 81db602e4cb407baae472689db1c222ed7b2afa3 -commit a8c57bcb077f0cfdffcf9f23866bf73bb93e185c -Author: naddy@openbsd.org -Date: Thu Aug 10 14:37:32 2023 +0000 +commit bc5dcb8ab9a4e8af54a724883732af378f42ea78 +Author: tobias@openbsd.org +Date: Tue Apr 30 15:40:43 2024 +0000 - upstream: drop a wayward comma, ok jmc@ + upstream: never close stdin - OpenBSD-Commit-ID: 5c11fbb9592a29b37bbf36f66df50db9d38182c6 + The sanitise_stdfd call makes sure that standard file descriptors are + open (if they were closed, they are connected with /dev/null). + + Do not close stdin in any case to prevent error messages when stdin is + read multiple times and to prevent later usage of fd 0 for connections, + e.g. + + echo localhost | ssh-keyscan -f - -f - + + While at it, make stdin-related error messages nicer. + + Authored with Max Kunzelmann + + ok djm + + OpenBSD-Commit-ID: 48e9b7938e2fa2f9bd47e6de6df66a31e0b375d3 -commit e962f9b318a238db1becc53c2bf79dd3a49095b4 +commit 6a42b70e56bef1aacdcdf06352396e837883e84f Author: Damien Miller -Date: Thu Aug 10 11:10:22 2023 +1000 +Date: Wed May 8 09:43:59 2024 +1000 - depend + sync getrrsetbyname.c with recent upstream changes -commit 0fcb60bf83130dfa428bc4422b3a3ac20fb528af -Author: Damien Miller -Date: Thu Aug 10 11:05:42 2023 +1000 +commit 385ecb31e147dfea59c1c488a1d2011d3867e60e +Author: djm@openbsd.org +Date: Tue Apr 30 06:23:51 2024 +0000 - update versions in RPM specs + upstream: fix home-directory extension implementation, it always + + returned the current user's home directory contrary to the spec. + + Patch from Jakub Jelen via GHPR477 + + OpenBSD-Commit-ID: 5afd775eab7f9cbe222d7fbae4c793de6c3b3d28 -commit d0cee4298491314f09afa1c4383a66d913150b26 -Author: Damien Miller -Date: Thu Aug 10 11:05:14 2023 +1000 +commit 14e2b16bc67ffcc188906f65008667e22f73d103 +Author: djm@openbsd.org +Date: Tue Apr 30 06:16:55 2024 +0000 - update version in README + upstream: flush stdout after writing "sftp>" prompt when not using + + editline. + + From Alpine Linux via GHPR480 + + OpenBSD-Commit-ID: 80bdc7ffe0358dc090eb9b93e6dedb2b087b24cd -commit 78b4dc6684f4d35943b46b24ee645edfdb9974f5 +commit 2e69a724051488e3fb3cd11531c4b5bc1764945b Author: djm@openbsd.org -Date: Thu Aug 10 01:01:07 2023 +0000 +Date: Tue Apr 30 05:53:03 2024 +0000 - upstream: openssh-9.4 + upstream: stricter validation of messaging socket fd number; disallow - OpenBSD-Commit-ID: 71fc1e01a4c4ea061b252bd399cda7be757e6e35 + usage of stderr. Based on GHPR492 by RealHurrison + + OpenBSD-Commit-ID: 73dbbe82ea16f73ce1d044d3232bc869ae2f2ce8 -commit 58ca4f0aa8c4306ac0a629c9a85fb1efaf4ff092 -Author: Darren Tucker -Date: Thu Aug 10 11:30:24 2023 +1000 +commit da757b022bf18c6f7d04e685a10cd96ed00f83da +Author: djm@openbsd.org +Date: Tue Apr 30 05:45:56 2024 +0000 - Only include unistd.h once. + upstream: add missing reserved fields to key constraint protocol + + documentation. + + from Wiktor Kwapisiewicz via GHPR487 + + OpenBSD-Commit-ID: 0dfb69998cfdb3fa00cbb0e7809e7d2f6126e3df -commit 3961ed02dc578517a9d2535128cff5c3a5460d28 +commit 16d0b82fa08038f35f1b3630c70116979f49784f Author: Damien Miller -Date: Thu Aug 10 09:08:49 2023 +1000 +Date: Tue Apr 30 12:39:34 2024 +1000 - wrap poll.h include in HAVE_POLL_H + depend -commit e535fbe2af893046c28adfcd787c1fdbae36a24a -Author: dtucker@openbsd.org -Date: Fri Aug 4 06:32:40 2023 +0000 +commit 66aaa678dbe59aa21d0d9d89a3596ecedde0254b +Author: djm@openbsd.org +Date: Tue Apr 30 02:14:10 2024 +0000 - upstream: Apply ConnectTimeout to multiplexing local socket + upstream: correctly restore sigprocmask around ppoll() reported - connections. If the multiplex socket exists but the connection times out, - ssh will fall back to a direct connection the same way it would if the socket - did not exist at all. ok djm@ + by Tõivo Leedjärv; ok deraadt@ - OpenBSD-Commit-ID: 2fbe1a36d4a24b98531b2d298a6557c8285dc1b4 + OpenBSD-Commit-ID: c0c0f89de5294a166578f071eade2501929c4686 -commit 9d92e7b24848fcc605945f7c2e3460c7c31832ce -Author: Darren Tucker -Date: Thu Aug 3 19:35:33 2023 +1000 +commit 80fb0eb21551aed3aebb009ab20aeffeb01e44e0 +Author: djm@openbsd.org +Date: Tue Apr 30 02:10:49 2024 +0000 - Fix RNG seeding for OpenSSL w/out self seeding. + upstream: add explict check for server hostkey type against - When sshd is built with an OpenSSL that does not self-seed, it would - fail in the preauth privsep process while handling a new connection. - Sanity checked by djm@ + HostkeyAlgorithms. Allows HostkeyAlgorithms to disable implicit fallback from + certificate keys to plain keys. ok markus@ + + OpenBSD-Commit-ID: 364087e4a395ff9b2f42bf3aefdb2090bb23643a -commit f70010d9b0b3e7e95de8aa0b961e1d74362cfb5d -Author: djm@openbsd.org -Date: Wed Aug 2 23:04:38 2023 +0000 +commit 5b28096d31ff7d80748fc845553a4aef5bb05d86 +Author: jsg@openbsd.org +Date: Tue Apr 23 13:34:50 2024 +0000 - upstream: CheckHostIP has defaulted to 'no' for a while; make the + upstream: correct indentation; no functional change ok tb@ - commented- out config option match. From Ed Maste + OpenBSD-Commit-ID: dd9702fd43de546bc6a3f4f025c74d6f3692a0d4 + +commit fd3cb8a82784e05f621dea5b56ac6f89bc53c067 +Author: semarie@openbsd.org +Date: Thu Apr 4 16:00:51 2024 +0000 + + upstream: set right mode on ssh-agent at boot-time - OpenBSD-Commit-ID: e66e934c45a9077cb1d51fc4f8d3df4505db58d9 + which sthen@ + ok deraadt@ + + OpenBSD-Commit-ID: 662b5056a2c6171563e1626f9c69f27862b5e7af -commit c88a8788f9865d02b986d00405b9f0be65ad0b5a -Author: dtucker@openbsd.org -Date: Tue Aug 1 08:15:04 2023 +0000 +commit 54343a260e3aa4bceca1852dde31cd08e2abd82b +Author: deraadt@openbsd.org +Date: Tue Apr 2 12:22:38 2024 +0000 - upstream: remove unnecessary if statement. + upstream: Oops, incorrect hex conversion spotted by claudio. - github PR#422 from eyalasulin999, ok djm@ + While here try to improve how it reads a bit better. Surprising the + regression tests didn't spot this error, maybe it fails to roundtrip the + values. - OpenBSD-Commit-ID: 2b6b0dde4407e039f58f86c8d2ff584a8205ea55 + OpenBSD-Commit-ID: 866cfcc1955aef8f3fc32da0b70c353a1b859f2e -commit 77b8b865cd5a8c79a47605c0c5b2bacf4692c4d5 -Author: jmc@openbsd.org -Date: Fri Jul 28 05:42:36 2023 +0000 +commit ec78c31409590ad74efc194f886273ed080a545a +Author: deraadt@openbsd.org +Date: Tue Apr 2 10:02:08 2024 +0000 - upstream: %C is a callable macro in mdoc(7) + upstream: for parse_ipqos(), use strtonum() instead of mostly - so, as we do for %D, escape it; + idiomatic strtoul(), but wow it's so gross. ok djm - OpenBSD-Commit-ID: 538cfcddbbb59dc3a8739604319491dcb8e0c0c9 + OpenBSD-Commit-ID: cec14a76af2eb7b225300c80fc0e21052be67b05 -commit e0f91aa9c2fbfc951e9ced7e1305455fc614d3f2 -Author: djm@openbsd.org -Date: Fri Jul 28 05:33:15 2023 +0000 +commit 8176e1a6c2e6da9361a7abb6fbf6c23c299f495b +Author: deraadt@openbsd.org +Date: Tue Apr 2 09:56:58 2024 +0000 - upstream: don't need to start a command here; use ssh -N instead. + upstream: can shortcut by returning strtonum() value directly; ok - Fixes failure on cygwin spotted by Darren + djm - OpenBSD-Regress-ID: ff678a8cc69160a3b862733d935ec4a383f93cfb + OpenBSD-Commit-ID: 7bb2dd3d6d1f288dac14247d1de446e3d7ba8b8e -commit f446a44f30bc680e0d026a4204844b02646c1c2d -Author: djm@openbsd.org -Date: Wed May 17 05:52:01 2023 +0000 +commit 9f543d7022a781f80bb696f9d73f1d1c6f9e31d6 +Author: deraadt@openbsd.org +Date: Tue Apr 2 09:52:14 2024 +0000 - upstream: add LTESTS_FROM variable to allow skipping of tests up to + upstream: rewrite convtime() to use a isdigit-scanner and - a specific point. e.g. "make LTESTS_FROM=t-sftp" will only run the sftp.sh - test and subsequent ones. ok dtucker@ + strtonum() instead of strange strtoul can might be fooled by garage + characters. passes regress/usr.bin/ssh/unittests/misc ok djm - OpenBSD-Regress-ID: 07f653de731def074b29293db946042706fcead3 + OpenBSD-Commit-ID: 4b1ef826bb16047aea3f3bdcb385b72ffd450abc -commit 8eb8899d612440a9b608bee7f916081d3d0b7812 -Author: djm@openbsd.org -Date: Fri May 12 06:37:42 2023 +0000 +commit 8673137f780d8d9e4cda3c4605cb5d88d5cea271 +Author: claudio@openbsd.org +Date: Tue Apr 2 09:48:24 2024 +0000 - upstream: test ChrootDirectory in Match block + upstream: Remove unused ptr[3] char array in pkcs11_decode_hex. - OpenBSD-Regress-ID: a6150262f39065939f025e546af2a346ffe674c1 + OK deraadt@ + + OpenBSD-Commit-ID: 3d14433e39fd558f662d3b0431c4c555ef920481 -commit e43f43d3f19516222e9a143468ea0dc1b3ab67b6 -Author: djm@openbsd.org -Date: Fri May 12 06:36:27 2023 +0000 +commit c7fec708f331f108343d69e4d74c9a5d86d6cfe7 +Author: deraadt@openbsd.org +Date: Tue Apr 2 09:32:28 2024 +0000 - upstream: better error messages + upstream: Replace non-idiomatic strtoul(, 16) to parse a region - OpenBSD-Regress-ID: 55e4186604e80259496d841e690ea2090981bc7a + of 2-character hex sequences with a low-level replacement designed just for + the task. ok djm + + OpenBSD-Commit-ID: 67bab8b8a4329a19a0add5085eacd6f4cc215e85 -commit 6958f00acf3b9e0b3730f7287e69996bcf3ceda4 -Author: djm@openbsd.org -Date: Thu Jul 27 22:26:49 2023 +0000 +commit 019a5f483b0f588da6270ec401d0b4bb35032f3f +Author: deraadt@openbsd.org +Date: Tue Apr 2 09:29:31 2024 +0000 - upstream: don't incorrectly truncate logged strings retrieved from + upstream: Use strtonum() instead of severely non-idomatic - PKCS#11 modules; based on GHPR406 by Jakub Jelen; ok markus + strtoul() In particular this will now reject trailing garbage, ie. + '12garbage'. ok djm - OpenBSD-Commit-ID: 7ed1082f23a13b38c373008f856fd301d50012f9 + OpenBSD-Commit-ID: c82d95e3ccbfedfc91a8041c2f8bf0cf987d1501 -commit d1ffde6b55170cd4b9a72bfd9a3f17508e6cf714 -Author: djm@openbsd.org -Date: Thu Jul 27 22:25:17 2023 +0000 +commit 8231ca046fa39ea4eb99b79e0a6e09dec50ac952 +Author: deraadt@openbsd.org +Date: Mon Apr 1 15:50:17 2024 +0000 - upstream: make sshd_config AuthorizedPrincipalsCommand and + upstream: also create a relink kit for ssh-agent, since it is a - AuthorizedKeysCommand accept the %D (routing domain) and a new %C (connection - address/port 4-tuple) as expansion sequences; ok markus + long-running setgid program carrying keys with some (not very powerful) + communication channels. solution for testing the binary from dtucker. + agreement from djm. Will add it into /etc/rc in a few days. - OpenBSD-Commit-ID: ee9a48bf1a74c4ace71b69de69cfdaa2a7388565 + OpenBSD-Commit-ID: 2fe8d707ae35ba23c7916adcb818bb5b66837ba0 -commit 999a2886ca1844a7a74b905e5f2c8c701f9838cd -Author: djm@openbsd.org -Date: Thu Jul 27 22:23:05 2023 +0000 +commit bf7bf50bd6a14e49c9c243cb8f4de31e555a5a2e +Author: deraadt@openbsd.org +Date: Mon Apr 1 15:48:16 2024 +0000 - upstream: increase default KDF work-factor for OpenSSH format + upstream: new-style relink kit for sshd. The old scheme created - private keys from 16 to 24; { feedback ok } x { deraadt markus } + a Makefile by concatenating two Makefiles and was incredibly fragile. In the + new way a narrow-purposed install.sh script is created and shipped with the + objects. A recently commited /etc/rc script understands these files. - OpenBSD-Commit-ID: a3afb1383f8ff0a49613d449f02395d9e8d4a9ec + OpenBSD-Commit-ID: ef9341d5a50f0d33e3a6fbe995e92964bc7ef2d3 -commit 0fa803a1dd1c7b546c166000e23a869cf6c4ec10 -Author: Darren Tucker -Date: Thu Jul 27 02:25:09 2023 +1000 +commit 00e63688920905e326d8667cb47f17a156b6dc8f +Author: renmingshuai +Date: Fri Apr 12 10:20:49 2024 +0800 - Prefer OpenSSL's SHA256 in sk-dummy.so + Shell syntax fix (leftover from a sync). - Previously sk-dummy.so used libc's (or compat's) SHA256 since it may be - built without OpenSSL. In many cases, however, including both libc's - and OpenSSL's headers together caused conflicting definitions. + Signed-off-by: renmingshuai + +commit 2eded551ba96e66bc3afbbcc883812c2eac02bd7 +Author: Darren Tucker +Date: Thu Apr 25 13:20:19 2024 +1000 + + Merge flags for OpenSSL 3.x versions. - We tried working around this (on OpenSSL <1.1 you could define - OPENSSL_NO_SHA, NetBSD had USE_LIBC_SHA2, various #define hacks) with - varying levels of success. Since OpenSSL >=1.1 removed OPENSSL_NO_SHA - and including most OpenSSL headers would bring sha.h in, even if it - wasn't used directly this was a constant hassle. + OpenSSL has moved to 3.4 which we don't currently accept. Based on + the OpenSSL versioning policy[0] it looks like all of the 3.x versions + should work with OpenSSH, so remove the distinction in configure and + accept all of them. - Admit defeat and use OpenSSL's SHA256 unless we aren't using OpenSSL at - all. ok djm@ + [0] https://openssl.org/policies/general/versioning-policy.html -commit 36cdb5dbf55c99c0faad06066f56a7c341258c1f +commit 8673245918081c6d1dc7fb3733c8eb2c5a902c5e Author: Darren Tucker -Date: Thu Jul 27 10:29:44 2023 +1000 +Date: Thu Apr 25 13:19:03 2024 +1000 - Retire dfly58 test VM. Add dfly64. + Remove 9.6 branch from status page. -commit 2d34205dab08ede9b0676efa57647fc49e6decbe -Author: djm@openbsd.org -Date: Wed Jul 26 23:06:00 2023 +0000 +commit 70d43049747fa3c66cf876d52271859407cec2fa +Author: Darren Tucker +Date: Thu Apr 25 13:16:58 2024 +1000 - upstream: make ssh -f (fork after authentication) work properly in + Update LibreSSL and OpenSSL versions tested. - multiplexed cases (inc. ControlPersist). bz3589 bz3589 Based on patches by - Peter Chubb; ok dtucker@ - - OpenBSD-Commit-ID: a7a2976a54b93e6767dc846b85647e6ec26969ac + Update LibreSSL versions to current releases (3.8.4 & 3.9.1). + Add newly-released OpenSSL 3.3.0, and add tests against the 3.1 and + 3.3 branches. -commit 076aeda86a7ee9be8fd2f0181ec7b9729a6ceb37 -Author: naddy@openbsd.org -Date: Sun Jul 23 20:04:45 2023 +0000 +commit 88351eca17dcc55189991ba60e50819b6d4193c1 +Author: 90 +Date: Fri Apr 5 19:36:06 2024 +0100 - upstream: man page typos; ok jmc@ + Fix missing header for systemd notification + +commit 08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c +Author: Damien Miller +Date: Wed Apr 3 14:40:32 2024 +1100 + + notify systemd on listen and reload - OpenBSD-Commit-ID: e6ddfef94b0eb867ad88abe07cedc8ed581c07f0 + Standalone implementation that does not depend on libsystemd. + With assistance from Luca Boccassi, and feedback/testing from Colin + Watson. bz2641 -commit 135e7d5fe31f700e6dfc61ce914970c5ee7175ba -Author: jmc@openbsd.org -Date: Thu Jul 20 05:43:39 2023 +0000 +commit 43e7c1c07cf6aae7f4394ca8ae91a3efc46514e2 +Author: Darren Tucker +Date: Sun Mar 31 21:51:57 2024 +1100 - upstream: tweak the allow-remote-pkcs11 text; + Port changes from selfhosted to upstream tests. - OpenBSD-Commit-ID: bc965460a89edf76865b7279b45cf9cbdebd558a + Should get them working again. -commit 5f83342b61d1f76c141de608ed2bd293990416bd +commit 281ea25a44bff53eefb4af7bab7aa670b1f8b6b2 Author: Darren Tucker -Date: Tue Jul 25 13:00:22 2023 +1000 +Date: Sat Mar 30 18:20:16 2024 +1100 - Handle a couple more OpenSSL no-ecc cases. + Check if OpenSSL implementation supports DSA. - ok djm@ + If --enable/disable-dsa-keys is not specified, set based on what OpenSSL + supports. If specified as enabled, but not supported by OpenSSL error + out. ok djm@ -commit edc2ef4e418e514c99701451fae4428ec04ce538 -Author: Damien Miller -Date: Thu Jul 20 12:53:44 2023 +1000 +commit 2d2c068de8d696fe3246f390b146197f51ea1e83 +Author: djm@openbsd.org +Date: Sat Mar 30 05:56:22 2024 +0000 - depend + upstream: in OpenSSH private key format, correct type for subsequent + + private keys in blob. From Jakub Jelen via GHPR430 + + OpenBSD-Commit-ID: d17dbf47554de2d752061592f95b5d772baab50b -commit 51fda734e0d3c2df256fc03e8b060c4305be6e59 -Author: Damien Miller -Date: Thu Jul 20 12:53:21 2023 +1000 +commit c2c0bdd3e96b3ef66d77fccb85ff4962dc76caf0 +Author: Eero Häkkinen +Date: Sat Sep 16 00:55:08 2023 +0300 - Bring back OPENSSL_HAS_ECC to ssh-pkcs11-client + Expose SSH_AUTH_INFO_0 always to PAM auth modules. + + This changes SSH_AUTH_INFO_0 to be exposed to PAM auth modules also + when a password authentication method is in use and not only + when a keyboard-interactive authentication method is in use. -commit 099cdf59ce1e72f55d421c8445bf6321b3004755 -Author: djm@openbsd.org -Date: Wed Jul 19 14:03:45 2023 +0000 +commit 02c5ad23124ae801cf248d99ea5068fc4331ca01 +Author: Darren Tucker +Date: Wed Mar 27 17:42:58 2024 +1100 - upstream: Separate ssh-pkcs11-helpers for each p11 module + Rearrange selfhosted VM scheduling. - Make ssh-pkcs11-client start an independent helper for each provider, - providing better isolation between modules and reliability if a single - module misbehaves. + Instead of trying to infer the type of the self hosted tests in each of + the driver scripts (inconsistently...), set one of the following + variables to "true" in the workflow: - This also implements reference counting of PKCS#11-hosted keys, - allowing ssh-pkcs11-helper subprocesses to be automatically reaped - when no remaining keys reference them. This fixes some bugs we have - that make PKCS11 keys unusable after they have been deleted, e.g. - https://bugzilla.mindrot.org/show_bug.cgi?id=3125 + VM: tests run in a virtual machine. + EPHEMERAL: tests run on an ephemeral virtual machine. + PERSISTENT: tests run on a persistent virtual machine + REMOTE: tests run on a physical remote host. - ok markus@ + EPHEMERAL VMs can have multiple instances of any given VM can exist + simultaneously and are run by a runner pool. The other types have a + dedicated runner instance and can only run a single test at a time. - OpenBSD-Commit-ID: 0ce188b14fe271ab0568f4500070d96c5657244e + Other settings: + SSHFS: We need to sshfs mount over the repo so the workflow can collect + build artifacts. This also implies the tests must be run over ssh. + DEBUG_ACTIONS: enable "set -x" in scripts for debugging. -commit 29ef8a04866ca14688d5b7fed7b8b9deab851f77 -Author: djm@openbsd.org -Date: Wed Jul 19 14:02:27 2023 +0000 +commit cd8a72707c02615365d0851ac51063ab6bfe258f +Author: Damien Miller +Date: Sat Mar 30 16:05:59 2024 +1100 - upstream: Ensure FIDO/PKCS11 libraries contain expected symbols - - This checks via nlist(3) that candidate provider libraries contain one - of the symbols that we will require prior to dlopen(), which can cause - a number of side effects, including execution of constructors. + add new token-based signing key for dtucker@ - Feedback deraadt; ok markus + Verified in person and via signature with old key. + Will remove old key in a bit. + +commit 8d0e46c1ddb5b7f0992591b0dc5d8aaa77cc9dba +Author: Alkaid +Date: Tue Mar 12 03:59:12 2024 -0700 + + Fix OpenSSL ED25519 support detection - OpenBSD-Commit-ID: 1508a5fbd74e329e69a55b56c453c292029aefbe + Wrong function signature in configure.ac prevents openssh from enabling + the recently new support for ED25519 priv keys in PEM PKCS8 format. -commit 1f2731f5d7a8f8a8385c6031667ed29072c0d92a +commit 697359be9c23ee43618243cdbcc9c7981e766752 Author: djm@openbsd.org -Date: Wed Jul 19 13:56:33 2023 +0000 +Date: Sat Mar 30 04:27:44 2024 +0000 - upstream: Disallow remote addition of FIDO/PKCS11 provider - - libraries to ssh-agent by default. + upstream: allow WAYLAND_DISPLAY to enable SSH_ASKPASS - The old behaviour of allowing remote clients from loading providers - can be restored using `ssh-agent -O allow-remote-pkcs11`. + From dkg via GHPR479; ok dtucker@ - Detection of local/remote clients requires a ssh(1) that supports - the `session-bind@openssh.com` extension. Forwarding access to a - ssh-agent socket using non-OpenSSH tools may circumvent this control. + OpenBSD-Commit-ID: 1ac1f9c45da44eabbae89375393c662349239257 + +commit 7844705b0364574cc70b941be72036c2c2966363 +Author: dtucker@openbsd.org +Date: Fri Mar 29 10:40:07 2024 +0000 + + upstream: Use egrep instead of grep -E. - ok markus@ + Some plaforms don't have the latter so this makes things easier + in -portable. - OpenBSD-Commit-ID: 4c2bdf79b214ae7e60cc8c39a45501344fa7bd7c + OpenBSD-Regress-ID: ff82260eb0db1f11130200b25d820cf73753bbe3 -commit 892506b13654301f69f9545f48213fc210e5c5cc -Author: djm@openbsd.org -Date: Wed Jul 19 13:55:53 2023 +0000 +commit 22b2b6c555334bffdf357a2e4aa74308b03b83c3 +Author: dtucker@openbsd.org +Date: Tue Mar 26 08:09:16 2024 +0000 - upstream: terminate process if requested to load a PKCS#11 provider + upstream: test -h is the POSIXly way of testing for a symlink. Reduces - that isn't a PKCS#11 provider; from / ok markus@ + diff vs Portable. - OpenBSD-Commit-ID: 39532cf18b115881bb4cfaee32084497aadfa05c + OpenBSD-Regress-ID: 6f31cd6e231e3b8c5c2ca0307573ccb7484bff7d -commit f3f56df8ec476b2de6cbdbdfdb77a2a61087829d -Author: Damien Miller -Date: Wed Jul 19 12:07:18 2023 +1000 +commit edcff77f82c2bb2b5653b36f1e47274c5ef3e8be +Author: Darren Tucker +Date: Tue Mar 26 18:58:58 2024 +1100 - agent_fuzz doesn't want stdint.h conditionalised + Fix name of OpenBSD upstream CI jobs. -commit 750911fd31d307a767cc86e3bfa90bbbb77b1a25 -Author: Damien Miller -Date: Tue Jul 18 15:41:12 2023 +1000 +commit 861b084429940e024f1b6e9c2779eac95d7a45db +Author: Darren Tucker +Date: Tue Mar 26 18:55:33 2024 +1100 - conditionalise stdint.h inclusion on HAVE_STDINT_H - - fixes build on AIX5 at least + Resync with upstream: ${} around DATAFILE. -commit ff047504fa6e008c4092f8929881816b8993bea0 -Author: Damien Miller -Date: Tue Jul 18 15:30:45 2023 +1000 +commit 63f248c7693e7f0a3b9a13d2980ac9a7e37f2aea +Author: djm@openbsd.org +Date: Mon Mar 25 19:28:09 2024 +0000 - conditionalise match localnetwork on ifaddrs.h + upstream: optional debugging - Fixes build breakage on platforms that lack getifaddrs() + OpenBSD-Regress-ID: b4852bf97ac8fb2e3530f2d5f999edd66058d7bc -commit b87b03282e466ca2927954ce93f5dbf0bfdc68f6 -Author: djm@openbsd.org -Date: Mon Jul 17 06:16:33 2023 +0000 +commit 16e2ebe06a62f09d4877b769876d92d6008a896f +Author: dtucker@openbsd.org +Date: Mon Mar 25 06:05:42 2024 +0000 - upstream: missing match localnetwork negation check + upstream: Verify string returned from local shell command. - OpenBSD-Commit-ID: 9a08ed8dae27d3f38cf280f1b28d4e0ff41a737a + OpenBSD-Regress-ID: 5039bde24d33d809aebfa8d3ad7fe9053224e6f8 -commit 6d6e185ba29ef4274164b77eab4dc763907f8821 -Author: jmc@openbsd.org -Date: Mon Jul 17 05:41:53 2023 +0000 +commit b326f7a1f39ff31324cc3fe2735178fb474c04a4 +Author: dtucker@openbsd.org +Date: Mon Mar 25 03:30:31 2024 +0000 - upstream: - add -P to usage() - sync the arg name to -J in usage() + upstream: Improve shell portability: grep -q is not portable so - with that in ssh.1 - reformat usage() to match what "man ssh" does on 80width + redirect stdout, and use printf instead of relying on echo to do \n + substitution. Reduces diff vs Portable. - OpenBSD-Commit-ID: 5235dd7aa42e5bf90ae54579d519f92fc107036e + Also resync somewhat with upstream. + + OpenBSD-Regress-ID: 9ae876a8ec4c4725f1e9820a0667360ee2398337 -commit f1a9898283a0638667b587ee4a950afd61ab51b0 -Author: jmc@openbsd.org -Date: Mon Jul 17 05:38:10 2023 +0000 +commit dbf2e319f0c582613fa45a735ea3c242ce56946b +Author: dtucker@openbsd.org +Date: Mon Mar 25 02:07:08 2024 +0000 - upstream: -P before -p in SYNOPSIS; + upstream: Save error code from SSH for use inside case statement, - OpenBSD-Commit-ID: 535f5257c779e26c6a662a038d241b017f8cab7c + from portable. In some shells, "case" will reset the value of $?, so save it + first. + + OpenBSD-Regress-ID: da32e5be19299cb4f0f7de7f29c11257a62d6949 -commit eef4d7e873568e1c84c36bb4034e2c3378250a61 -Author: jsg@openbsd.org -Date: Mon Jul 17 05:36:14 2023 +0000 +commit d2c8c4fa7def4fb057ed05b3db57b62c810a26f6 +Author: dtucker@openbsd.org +Date: Mon Mar 25 01:40:47 2024 +0000 - upstream: configuation -> configuration + upstream: Increase timeout. Resyncs with portable where some of - OpenBSD-Commit-ID: 4776ced33b780f1db0b2902faec99312f26a726b + the test VMs are slow enough for this to matter. + + OpenBSD-Regress-ID: 6a83a693602eb0312f06a4ad2cd6f40d99d24b26 -commit dc1dbe94cf6532bd546a3373ad436404f8850e5f -Author: djm@openbsd.org -Date: Mon Jul 17 05:26:38 2023 +0000 +commit 83621b63514a84791623db3efb59d38bc4bf9563 +Author: dtucker@openbsd.org +Date: Mon Mar 25 01:28:29 2024 +0000 - upstream: move other RCSIDs to before their respective license blocks + upstream: In PuTTY interop test, don't assume the PuTTY major - too no code change + version is 0. Patch from cjwatson at debian.org via bz#3671. - OpenBSD-Commit-ID: ef5bf46b57726e4260a63b032b0b5ac3b4fe9cd4 + OpenBSD-Regress-ID: 835ed03c1b04ad46be82e674495521f11b840191 -commit ebe11044681caff78834ca6b78311ad19c1860b8 -Author: djm@openbsd.org -Date: Mon Jul 17 05:22:30 2023 +0000 +commit 8a421b927700f3834b4d985778e252b8e3299f83 +Author: Darren Tucker +Date: Tue Mar 26 18:38:14 2024 +1100 - upstream: Move RCSID to before license block and away from #includes, - - where it caused merge conflict in -portable for each commit :( + Really mkdir /usr/local/etc in CI tests. + +commit 2946ed522c47ce045314533d426b4e379f745e59 +Author: Darren Tucker +Date: Tue Mar 26 17:19:09 2024 +1100 + + Better short name for OpenBSD upstream CI jobs too. + +commit 18dbe8eff647aacb82d7e86b4ce63d5beee11f25 +Author: Darren Tucker +Date: Tue Mar 26 17:13:52 2024 +1100 + + Ensure /usr/local/etc exists before using in tests. + +commit 5fc1085128e3348bb1b5ee4d955cc767b019b3ad +Author: Darren Tucker +Date: Tue Mar 26 16:50:46 2024 +1100 + + Be more specific about when to rerun workflows. + +commit 5516923e8ae3da0823fea0d7d28aa813627142c0 +Author: Darren Tucker +Date: Tue Mar 26 16:35:27 2024 +1100 + + Add short names for test jobs on github CI. + +commit dc37d2d2470b4a9cedcee9ac926b7362214e3305 +Author: Darren Tucker +Date: Tue Mar 26 16:26:14 2024 +1100 + + If we're using xpg4's id, remember to pass args. + +commit fe169487937780392b23d3ff3c00e5898c10f784 +Author: dtucker@openbsd.org +Date: Tue Mar 26 01:23:11 2024 +0000 + + upstream: Import regenerated moduli. - OpenBSD-Commit-ID: 756ebac963df3245258b962e88150ebab9d5fc20 + OpenBSD-Commit-ID: ad3d1486d105b008c93e952d158e5af4d9d4c531 -commit 05c08e5f628de3ecf6f7ea20947735bcfa3201e0 -Author: djm@openbsd.org -Date: Mon Jul 17 05:20:15 2023 +0000 +commit 151146f03b490d19145cd421763aa7d42f5c50e2 +Author: job@openbsd.org +Date: Thu Mar 14 06:23:14 2024 +0000 - upstream: return SSH_ERR_KRL_BAD_MAGIC when a KRL doesn't contain a + upstream: Clarify how literal IPv6 addresses can be used in -J mode - valid magic number and not SSH_ERR_MESSAGE_INCOMPLETE; the former is needed - to fall back to text revocation lists in some cases; fixes t-cert-hostkey. + OK djm@ - OpenBSD-Commit-ID: 5c670a6c0f027e99b7774ef29f18ba088549c7e1 + OpenBSD-Commit-ID: 524ddae97746b3563ad4a887dfd0a6e6ba114c50 -commit c6fad2c3d19b74f0bd0af1ef040fc74f3a1d9ebb -Author: Damien Miller -Date: Mon Jul 17 14:56:14 2023 +1000 +commit 0d5bdc87a675271862b67eb6a9fb13a202fb4894 +Author: Darren Tucker +Date: Mon Mar 25 16:14:21 2024 +1100 - avoid AF_LINK on platforms that don't define it + Add Mac OS X 14 test targets. -commit 919bc3d3b712c920de1ae6be5ac6561c98886d7e -Author: djm@openbsd.org -Date: Mon Jul 17 04:08:31 2023 +0000 +commit 2d7964a03e1f50a48040ec6912c0a956df909d21 +Author: Darren Tucker +Date: Mon Mar 25 14:05:40 2024 +1100 - upstream: Add support for configuration tags to ssh(1). + Move xpg4 'id' handling into test-exec.sh. - This adds a ssh_config(5) "Tag" directive and corresponding - "Match tag" predicate that may be used to select blocks of - configuration similar to the pf.conf(5) keywords of the same - name. + Handle replacement of 'id' the same way as we do other Portable specific + replacements in test-exec.sh. This brings percent.sh back into sync + with upstream. + +commit 75d1d49ed10d978171cdafad28bdbffdbd48f41e +Author: Darren Tucker +Date: Mon Mar 25 10:38:03 2024 +1100 + + Update branches shown on ci-status to 9.7 and 9.6. + +commit f9193f03db0029fc9c31fbdb5c66a2737446bd8f +Author: Darren Tucker +Date: Mon Mar 25 09:28:02 2024 +1100 + + Improve detection of -fzero-call-used-regs=used. - ok markus + Should better detect problems with gcc 13 on m68k. bz#3673 from Colin + Watson via bz#3673 and https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110934 - OpenBSD-Commit-ID: dc08358e70e702b59ac3e591827e5a96141b06a3 + Signed-off-by: Darren Tucker -commit 3071d85a47061c1bdaf11a0ac233b501ecba862c +commit 86bdd3853f4d32c85e295e6216a2fe0953ad93f0 +Author: Damien Miller +Date: Mon Mar 11 16:20:49 2024 +1100 + + version number in README + +commit 282721418e6465bc39ccfd39bb0133e670ee4423 +Author: Damien Miller +Date: Mon Mar 11 16:20:08 2024 +1100 + + crank RPM spec versions + +commit 3876a3bbd2ca84d23ba20f8b69ba83270c04ce3a Author: djm@openbsd.org -Date: Mon Jul 17 04:04:36 2023 +0000 +Date: Mon Mar 11 04:59:47 2024 +0000 - upstream: add a "match localnetwork" predicate. + upstream: openssh-9.7 - This allows matching on the addresses of available network interfaces - and may be used to vary the effective client configuration based on - network location (e.g. to use a ProxyJump when not on a particular - network). + OpenBSD-Commit-ID: 618ececf58b8cdae016b149787af06240f7b0cbc + +commit 8fc109cc614954a8eb2738c48c0db36a62af9a06 +Author: Darren Tucker +Date: Mon Mar 11 12:59:26 2024 +1100 + + Test against current OpenSSL and LibreSSL releases. - ok markus@ + Add LibreSSL 3.9.0, bump older branches to their respective current + releases. + +commit 26b09b45fec7b88ba09042c09be4157e58e231e2 +Author: Damien Miller +Date: Sun Mar 10 16:24:57 2024 +1100 + + quote regexes used to test for algorithm support - OpenBSD-Commit-ID: cffb6ff9a3803abfc52b5cad0aa190c5e424c139 + Fixes test failures on Solaris 8 reported by Tom G. Christensen -commit beec17bb311365b75a0a5941418d4b96df7d7888 +commit a6a740a4948d10a622b505135bb485c10f21db5e Author: djm@openbsd.org -Date: Mon Jul 17 04:01:10 2023 +0000 +Date: Sat Mar 9 05:12:13 2024 +0000 - upstream: remove vestigal support for KRL signatures - - When the KRL format was originally defined, it included support for - signing of KRL objects. However, the code to sign KRLs and verify KRL - signatues was never completed in OpenSSH. - - Now, some years later, we have SSHSIG support in ssh-keygen that is - more general, well tested and actually works. So this removes the - semi-finished KRL signing/verification support from OpenSSH and - refactors the remaining code to realise the benefit - primarily, we - no longer need to perform multiple parsing passes over KRL objects. + upstream: avoid logging in signal handler by converting mainloop to - ok markus@ + ppoll() bz3670, reported by Ben Hamilton; ok dtucker@ - OpenBSD-Commit-ID: 517437bab3d8180f695c775410c052340e038804 + OpenBSD-Commit-ID: e58f18042b86425405ca09e6e9d7dfa1df9f5f7f -commit 449566f64c21b4578d5c0c431badd0328adc53ed +commit cd82f7526e0481720567ae41db7849ab1c27e27b Author: djm@openbsd.org -Date: Mon Jul 17 03:57:21 2023 +0000 +Date: Fri Mar 8 22:16:32 2024 +0000 - upstream: Support for KRL extensions. - - This defines wire formats for optional KRL extensions and implements - parsing of the new submessages. No actual extensions are supported at - this point. + upstream: skip more whitespace, fixes find-principals on - ok markus + allowed_signers files with blank lines; reported by Wiktor Kwapisiewicz - OpenBSD-Commit-ID: ae2fcde9a22a9ba7f765bd4f36b3f5901d8c3fa7 + OpenBSD-Commit-ID: b3a22a2afd753d70766f34bc7f309c03706b5298 -commit 18ea857770e84825a3a6238bb37f54864487b59f +commit 2f9d2af5cb19905d87f37d1e11c9f035ac5daf3b Author: dtucker@openbsd.org -Date: Fri Jul 14 07:44:21 2023 +0000 +Date: Fri Mar 8 11:34:10 2024 +0000 - upstream: Include stdint.h for SIZE_MAX. Fixes OPENSSL=no build. + upstream: Invoke ProxyCommand that uses stderr redirection via - OpenBSD-Commit-ID: e7c31034a5434f2ead3579b13a7892960651e6b0 + $TEST_SHELL. Fixes test when run by a user whose login shell is tcsh. + Found by vinschen at redhat.com. + + OpenBSD-Regress-ID: f68d79e7f00caa8d216ebe00ee5f0adbb944062a -commit 20b768fcd13effe0f2d3619661b6c8592c773553 +commit 9b3f0beb4007a7e01dfedabb429097fb593deae6 Author: Darren Tucker -Date: Fri Jul 14 17:07:32 2023 +1000 - - Fix typo in declaration of nmesg. - -commit 4b94d09542e36ebde2eb9ad89bc68431609932de -Author: Damien Miller -Date: Fri Jul 14 15:34:47 2023 +1000 +Date: Thu Mar 7 17:18:14 2024 +1100 - portable-specific int overflow defence-in-depth + Prefer openssl binary from --with-ssl-dir directory. - These too are unreachable, but we want the code to be safe regardless of - context. Reported by Yair Mizrahi @ JFrog + Use openssl in the directory specified by --with-ssl-dir as long + as it's functional. Reported by The Doctor. -commit 2ee48adb9fc8692e8d6ac679dcc9f35e89ad68f0 +commit c47e1c9c7911f38b2fc2fb01b1f6ae3a3121a838 Author: djm@openbsd.org -Date: Fri Jul 14 05:31:44 2023 +0000 +Date: Wed Mar 6 02:59:59 2024 +0000 - upstream: add defence-in-depth checks for some unreachable integer + upstream: fix memory leak in mux proxy mode when requesting forwarding. - overflows reported by Yair Mizrahi @ JFrog; feedback/ok millert@ + found by RASU JSC, reported by Maks Mishin in GHPR#467 - OpenBSD-Commit-ID: 52af085f4e7ef9f9d8423d8c1840a6a88bda90bd + OpenBSD-Commit-ID: 97d96a166b1ad4b8d229864a553e3e56d3116860 -commit 4b43bc358ae6f6b19a973679246dc5172f6ac41b +commit 242742827fea4508e68097c128e802edc79addb5 Author: djm@openbsd.org -Date: Mon Jul 10 04:51:26 2023 +0000 +Date: Wed Mar 6 00:31:04 2024 +0000 - upstream: misplaced debug message + upstream: wrap a few PKCS#11-specific bits in ENABLE_PKCS11 - OpenBSD-Commit-ID: d0f12af0a5067a756aa707bc39a83fa6f58bf7e5 + OpenBSD-Commit-ID: 463e4a69eef3426a43a2b922c4e7b2011885d923 -commit 8c7203bcee4c4f98a22487b4631fe068b992099b +commit d52b6509210e2043f33e5a1de58dd4a0d5d48c2a Author: Damien Miller -Date: Wed Jul 12 11:41:19 2023 +1000 +Date: Wed Mar 6 11:31:36 2024 +1100 - replace deprecate selinux matchpathcon function + disable RSA tests when algorithm is not supported - This function is apparently deprecated. Documentation on what is the - supposed replacement is is non-existent, so this follows the approach - glibc used https://sourceware.org/git/?p=glibc.git;a=patch;h=f278835f59 + Unbreaks "make test" when compiled --without-openssl. - ok dtucker@ + Similar treatment to how we do DSA and ECDSA. -commit 7e8800f5d701efffa39ccb63ca1e095ea777c31a -Author: dtucker@openbsd.org -Date: Thu Jul 6 22:17:59 2023 +0000 +commit 668d270a6c77e8b5a1da26ecad2e6de9f62c8fe4 +Author: Damien Miller +Date: Wed Mar 6 10:33:20 2024 +1100 - upstream: minleft and maxsign are u_int so cast appropriately. Prompted - - by github PR#410, ok deraadt. + add a --without-retpoline configure option - OpenBSD-Commit-ID: 0514cd51db3ec60239966622a0d3495b15406ddd + discussed with deraadt and dtucker a while ago -commit 94842bfe9b09fc93189c6ed0dc9bbebc1d44a426 -Author: dlg@openbsd.org -Date: Tue Jul 4 03:59:21 2023 +0000 +commit 3deb501f86fc47e175ef6a3eaba9b9846a80d444 +Author: djm@openbsd.org +Date: Mon Mar 4 04:13:18 2024 +0000 - upstream: add support for unix domain sockets to ssh -W + upstream: fix leak of CanonicalizePermittedCNAMEs on error path; - ok djm@ dtucker@ + spotted by Coverity (CID 438039) - OpenBSD-Commit-ID: 3e6d47567b895c7c28855c7bd614e106c987a6d8 + OpenBSD-Commit-ID: 208839699939721f452a4418afc028a9f9d3d8af -commit a95fc5eed09a0238fb127b6c50e8498432b79dae -Author: David Seifert -Date: Fri May 12 14:06:01 2023 +0200 +commit 65a44a8a4f7d902a64d4e60eda84384b2e2a24a2 +Author: djm@openbsd.org +Date: Mon Mar 4 02:16:11 2024 +0000 - gss-serv.c: `MAXHOSTNAMELEN` -> `HOST_NAME_MAX` + upstream: Separate parsing of string array options from applying them - `MAXHOSTNAMELEN` is not defined in POSIX, which breaks on musl: - https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostname.html + to the active configuration. This fixes the config parser from erroneously + rejecting cases like: - Bug: https://bugs.gentoo.org/834044 + AuthenticationMethods password + Match User ivy + AuthenticationMethods any + + bz3657 ok markus@ + + OpenBSD-Commit-ID: 7f196cba634c2a3dba115f3fac3c4635a2199491 -commit 8a6cd08850f576e7527c52a1b086cae82fab290e +commit 6886e1b1f55c90942e4e6deed930f8ac32e0f938 Author: Darren Tucker -Date: Fri Jun 23 09:49:02 2023 +1000 +Date: Thu Feb 22 17:59:35 2024 +1100 - Update runner OS version for hardenedmalloc test. - - Hardenedmalloc dropped support for "legacy glibc" versions in their - 64dad0a69 so use a newer Ubuntu version for the runner for that test. + Add nbsd10 test target. -commit cfca6f17e64baed6822bb927ed9f372ce64d9c5b +commit d86bf8a3f6ea4fa7887406c2aa9959db71fa41be Author: Damien Miller -Date: Thu Jun 22 15:04:03 2023 +1000 +Date: Thu Feb 22 12:06:10 2024 +1100 - handle sysconf(SC_OPEN_MAX) returning > INT_MAX; - - bz3581; ok dtucker + more descriptive configure test name -commit c1c2ca1365b3f7b626683690bd2c68265f6d8ffd +commit 9ee335aacc9f5bdc4cc2c19fafb45e27be7d234e Author: djm@openbsd.org -Date: Wed Jun 21 05:10:26 2023 +0000 +Date: Wed Feb 21 06:17:29 2024 +0000 - upstream: better validate CASignatureAlgorithms in ssh_config and + upstream: explain arguments of internal-sftp GHPR#454 from Niklas - sshd_config. - - Previously this directive would accept certificate algorithm names, but - these were unusable in practice as OpenSSH does not support CA chains. - - part of bz3577; ok dtucker@ + Hambüchen + MIME-Version: 1.0 + Content-Type: text/plain; charset=UTF-8 + Content-Transfer-Encoding: 8bit - OpenBSD-Commit-ID: a992d410c8a78ec982701bc3f91043dbdb359912 + OpenBSD-Commit-ID: 0335d641ae6b5b6201b9ffd5dd06345ebbd0a3f3 -commit 4e73cd0f4ab3e5b576c56cac9732da62c8fc0565 +commit d1164cb1001dd208fee88aaa9b43d5e6fd917274 Author: djm@openbsd.org -Date: Wed Jun 21 05:08:32 2023 +0000 +Date: Wed Feb 21 06:06:43 2024 +0000 - upstream: make `ssh -Q CASignatureAlgorithms` only list signature + upstream: clarify permissions requirements for ChrootDirectory Part - algorithms that are valid for CA signing. Previous behaviour was to list all - signing algorithms, including certificate algorithms (OpenSSH certificates do - not support CA chains). part of bz3577; ok dtucker@ + of GHPR#454 from Niklas Hambüchen + MIME-Version: 1.0 + Content-Type: text/plain; charset=UTF-8 + Content-Transfer-Encoding: 8bit - OpenBSD-Commit-ID: 99c2b072dbac0f44fd1f2269e3ff6c1b5d7d3e59 + OpenBSD-Commit-ID: d37bc8786317a11649c62ff5e2936441186ef7a0 -commit a69062f1695ac9c3c3dea29d3044c72aaa6af0ea +commit d410e17d186552d0717f18217d0d049486754365 Author: djm@openbsd.org -Date: Wed Jun 21 05:06:04 2023 +0000 +Date: Wed Feb 21 06:05:06 2024 +0000 - upstream: handle rlimits > INT_MAX (rlim_t is u64); ok dtucker - - bz3581 + upstream: .Cm for a keyword. Part of GHPR#454 from Niklas Hambüchen - OpenBSD-Commit-ID: 31cf59c041becc0e5ccb0a77106f812c4cd1cd74 + OpenBSD-Commit-ID: d59c52559f926fa82859035d79749fbb4a3ce18a -commit 8d33f2aa6bb895a7f85a47189913639086347b75 +commit ab73f9678ebf06b32d6361b88b50b42775e0565b Author: djm@openbsd.org -Date: Tue Jun 20 23:59:33 2023 +0000 +Date: Wed Feb 21 06:01:13 2024 +0000 - upstream: prepare for support for connecting to unix domain sockets + upstream: fix typo in match directive predicate (s/tagged/tag) GHPR#462 - using ssh -W by explicitly decoding PORT_STREAMLOCAL (a negative number) from - the u32 that's passed over the multiplexing socket; previously code would - just cast, which is UB. + from Tobias Manske - OpenBSD-Commit-ID: e5ac5f40d354096c51e8c118a5c1b2d2b7a31384 + OpenBSD-Commit-ID: 05b23b772677d48aa82eefd7ebebd369ae758908 -commit b4ac435b4e67f8eb5932d8f59eb5b3cf7dc38df0 +commit 9844aa2521ccfb1a2d73745680327b79e0574445 Author: djm@openbsd.org -Date: Tue Jun 20 00:05:09 2023 +0000 +Date: Wed Feb 21 05:57:34 2024 +0000 - upstream: reset comment=NULL for each key in do_fingerprint(); + upstream: fix proxy multiplexing mode, broken when keystroke timing - fixes "no comment" not showing on when running `ssh-keygen -l` on multiple - keys where one has a comment and other following keys do not. Patch from - Markus Kuhn via GHPR407, bz3580 + obfuscation was added. GHPR#463 from montag451 - OpenBSD-Commit-ID: 3cce84456fdcd67dc6b84e369f92c6686d111d9b + OpenBSD-Commit-ID: 4e412d59b3f557d431f1d81c715a3bc0491cc677 -commit b53a809a549dcd4fbde554c6aa283e597b15ea33 -Author: millert@openbsd.org -Date: Mon Jun 5 13:24:36 2023 +0000 +commit ee6d932acb532f80b11bb7cf161668c70ec8a117 +Author: djm@openbsd.org +Date: Tue Feb 20 04:10:03 2024 +0000 - upstream: Store timeouts as int, not u_int as they are limited to + upstream: don't append a gratuitous space to the end of subsystem - INT_MAX. Fixes sign compare warnings systems with 32-bit time_t due to type - promotion. OK djm@ + arguments; bz3667 - OpenBSD-Commit-ID: 48081e9ad35705c5f1705711704a4c2ff94e87b7 + OpenBSD-Commit-ID: e11023aeb3f30b77a674e37b8292c862926d5dc6 -commit 2709809fd616a0991dc18e3a58dea10fb383c3f0 -Author: Philip Hands -Date: Wed May 24 19:41:14 2023 +0200 +commit e27f032aa8fcbae9b2e7c451baaf4b8ac6fa3d45 +Author: dtucker@openbsd.org +Date: Mon Feb 19 09:25:52 2024 +0000 - fixup! if -s & -p specified, mention 'sftp -P' on - - success + upstream: Always define puttysetup function. - SSH-Copy-ID-Upstream: 32686e7c65b4fa2846e474d3315102dfa0f043b0 + OpenBSD-Regress-ID: b4c0ccfa4006a1bc5dfd99ccf21c854d3ce2aee0 -commit 204e0bf05161b7641500d7ab266c21217412379f -Author: Darren Tucker -Date: Tue Aug 3 21:25:48 2021 +1000 +commit 84046f9991abef5f46b040b10cf3d494f933a17b +Author: dtucker@openbsd.org +Date: Fri Feb 9 08:56:59 2024 +0000 - Make ssh-copy-id(1) consistent with OpenSSH. - - This makes the ssh-copy-id man page more consistent with the rest of the - OpenSSH man pages: - - new sentence, new line - - no sentences >80 - - N.B. -> NB - - zap unused .Pp - - zap trailing whitespace + upstream: Exapnd PuTTY test coverage. - Report from Debian via mindrot bz#3331, diff from jmc at openbsd.org. + Expand the set of ciphers, MACs and KEX methods in the PuTTY interop + tests. - SSH-Copy-ID-Upstream: d8974cfb6242316460ed22a1ccc662800a50c5d3 + OpenBSD-Regress-ID: dd28d97d48efe7329a396d0d505ee2907bf7fc57 -commit 9de79df66d1430d290fab670bb4b18612875e518 -Author: Philip Hands -Date: Wed May 24 11:45:43 2023 +0200 +commit bbf541ee2afe07b08a8b56fa0dc6f38fcfceef2a +Author: dtucker@openbsd.org +Date: Fri Feb 9 08:47:42 2024 +0000 - if -s & -p specified, mention 'sftp -P' on success + upstream: Factor out PuTTY setup. - This was inspired by this: - https://github.com/openssh/openssh-portable/pull/321 - but I thought that it was better to not do the sed patching. + Factor out PuTTY and call only when needed. - BTW the reason one can get away with using $SSH_OPTS throughout, despite - the lowercase -p in there, even if sftp is in use, is that the sftp call - is using the already-established ssh master connection, so the port was - passed to the earlier ssh. + This allows us to avoid PuTTY key setup when it's not needed, which + speeds up the overall test run by a couple of percent. - SSH-Copy-ID-Upstream: 1c124d9bfafdbe28a00b683367ebf5750ce12eb2 + OpenBSD-Regress-ID: c25eaccc3c91bc874400f7c85ce40e9032358c1c -commit 801cda54c00e0f4e7d89345a90874c8d05dc233a -Author: Philip Hands -Date: Tue May 23 23:07:11 2023 +0200 +commit d31c21c57fb4245271680a1e5043cf6470a96766 +Author: naddy@openbsd.org +Date: Sat Feb 10 11:28:52 2024 +0000 - drop whitespace + upstream: clean sshd random relinking kit; ok miod@ - SSH-Copy-ID-Upstream: e604fae1cdee35c18055d35dcec530cf12ef00ad + OpenBSD-Commit-ID: 509bb19bb9762a4b3b589af98bac2e730541b6d4 -commit 288482f53613f3e74544eb92deeb24f7c7f1f371 -Author: Philip Hands -Date: Tue May 23 20:52:13 2023 +0200 +commit 4dbc5a363ff53a2fcecf6bc3bcc038badc12f118 +Author: djm@openbsd.org +Date: Fri Feb 2 00:13:34 2024 +0000 - make -x also apply to the target script + upstream: whitespace - SSH-Copy-ID-Upstream: 3c4214704f427bd0654adf9b0fc079253db21cf4 + OpenBSD-Commit-ID: b24680bc755b621ea801ff8edf6f0f02b68edae1 -commit b79e7b88ed44f0e4339f0ff35c96c78a92175a8d -Author: Philip Hands -Date: Tue May 23 16:46:42 2023 +0200 +commit efde85dda2130272af24cc346f6c3cd326182ff1 +Author: Darren Tucker +Date: Mon Feb 19 17:29:31 2024 +1100 - add -t option to specify the target path - - Allow the default target path (.ssh/authorized_files) to be over-riden - - This was inspired by this MR from Panagiotis Cheilaris - - https://gitlab.com/phil_hands/ssh-copy-id/-/merge_requests/8 + Improve error message for OpenSSL header check. - SSH-Copy-ID-Upstream: a942a0e076874adb6d8b2f0fb76d6c7918190fcd + bz#3668, ok djm@ -commit 914f4ad138714c471ba72fb6d5496b6235320edd -Author: Carlos Rodríguez Gili -Date: Tue Apr 20 19:23:57 2021 +0200 +commit cbbdf868bce431a59e2fa36ca244d5739429408d +Author: Darren Tucker +Date: Wed Feb 7 13:45:02 2024 +1100 - Fix test error for /bin/sh on Solaris 10 and older - - On Solaris 10 and older targets /bin/sh is not POSIX-compliant. - Test -z `...` fails with error 'sh: test: argument expected'. - Using quotes around backticks fixes this and doesn't break - POSIX compatibility. - - SSH-Copy-ID-Upstream: 98394072a3f985b2650c1e8eab2fef84e38cc065 + Interop test against PuTTY snapshot and releases. -commit bd382dca316c721aed1e45edcf4c4e0f6374afb0 -Author: Jakub Jelen -Date: Tue Mar 2 21:34:05 2021 +0000 +commit 91898bf786b0f149f962c4c96c08a46f29888c10 +Author: Darren Tucker +Date: Tue Feb 6 16:21:05 2024 +1100 - Remove outdated comment - - The commit b068122 removed the code dropping the trailing colon, but the comment stayed leaving the code confusing for future readers + Put privsep dir on OS X on /usr/local. - SSH-Copy-ID-Upstream: 930d39f238117cd53810240ec989d0356aa1c1f6 + On some runners we can't create /var/empty, so put it some place we can + write. Should fix test breakage on Max OS X 11. -commit bdcaf7939029433635d63aade8f9ac762aca2bbe +commit be5ed8ebed8388c5056bfde4688308cc873c18b9 Author: Darren Tucker -Date: Wed May 10 18:50:46 2023 +1000 +Date: Tue Feb 6 11:19:42 2024 +1100 - Special case OpenWrt instead of Dropbear. - - OpenWrt overrides the location of authorized_keys for root. Currently we - assume that all Dropbear installations behave this way, which is not the - case. Check for OpenWrt and root user before using that location instead - of assuming that for all Dropbear servers. Prompted by Github PR#250. + Add --disable-fd-passing option. - SSH-Copy-ID-Upstream: 0e1f5d443a9967483c33945793107ae3f3e4af2d + .. and enable for the minix3 test VM. This will cause it to more reliably + skip tests that need FD passing and should fix the current test breakage. -commit cf84498f67abe93f813a296167b406a0db7b288e -Author: Philip Hands -Date: Thu May 18 18:20:55 2023 +0200 +commit 0f6a8a0d0a518fd78c4cbebfdac990a57a1c4e41 +Author: Darren Tucker +Date: Tue Feb 6 11:18:44 2024 +1100 - ssh-copy-id: add -x option (for debugging) - - This option causes the ssh-copy-id to run with set -x - - SSH-Copy-ID-Upstream: a0ee367ea8c0a29c8b4515245e408d2d349e7844 + Use "skip" function instead doing it ourselves. -commit b4a1efdcb88f03394c08e7f68ed4e11676830002 -Author: Philip Hands -Date: Thu May 18 17:14:41 2023 +0200 +commit 3ad669f81aabbd2ba9fbd472903f680f598e1e99 +Author: Damien Miller +Date: Thu Feb 1 14:01:18 2024 +1100 - update copyright notices - - SSH-Copy-ID-Upstream: c284ed33b361814ea48ff68cbd01ca525b2bf117 + ignore some vim droppings -commit fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 +commit c283f29d23611a06bbee06bcf458f2fffad721d9 Author: djm@openbsd.org -Date: Wed May 24 23:01:06 2023 +0000 +Date: Thu Feb 1 02:37:33 2024 +0000 - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand + upstream: whitespace - appears previously in configuration. Reported by John Meyers in bz3574 ok - dtucker@ + OpenBSD-Commit-ID: bf9e4a1049562ee4322684fbdce07142f04fdbb7 + +commit 0d96b1506b2f4757fefa5d1f884d49e96a6fd4c3 +Author: Damien Miller +Date: Tue Jan 16 14:40:18 2024 +1100 + + skip tests that use multiplexing on Windows - OpenBSD-Commit-ID: 1c92e4517284386703936e1d3abaa36cfacf1951 + Some tests here use multiplexing, skip these if DISABLE_FD_PASSING + is set. Should unbreak tests on Windows. -commit 5ec5504f1d328d5bfa64280cd617c3efec4f78f3 -Author: dtucker@openbsd.org -Date: Wed May 10 10:04:20 2023 +0000 +commit 50080fa42f5f744b798ee29400c0710f1b59f50e +Author: djm@openbsd.org +Date: Thu Jan 11 04:50:28 2024 +0000 - upstream: Remove unused prototypes for ssh1 RSA functions. + upstream: don't disable RSA test when DSA is disabled; bug introduced - From lengyijun via github PR#396. + in last commit - OpenBSD-Commit-ID: 379a5afa8b7a0f3cba0c8a9bcceb4e5e33a5c1ef + OpenBSD-Regress-ID: 8780a7250bf742b33010e9336359a1c516f2d7b5 -commit fbf362b3891ae4b36052d1b39f37fc618b41c476 -Author: Darren Tucker -Date: Tue May 9 19:26:56 2023 +1000 +commit 415c94ce17288e0cdcb9e58cc91fba78d33c8457 +Author: djm@openbsd.org +Date: Thu Jan 11 01:45:58 2024 +0000 - main(void) to prevent unused variable warning. + upstream: make DSA testing optional, defaulting to on + + ok markus + + OpenBSD-Regress-ID: dfc27b5574e3f19dc4043395594cea5f90b8572a -commit baf854c8bb0a6d0af5c696c801e631a48dabbaba -Author: Darren Tucker -Date: Tue May 9 19:25:45 2023 +1000 +commit f9311e8921d92c5efca767227a497ab63280ac39 +Author: djm@openbsd.org +Date: Thu Jan 11 01:51:16 2024 +0000 - Remove warning pragma since clang doesn't like it. + upstream: ensure key_fd is filled when DSA is disabled; spotted by + + tb@ + + OpenBSD-Commit-ID: 9dd417b6eec3cf67e870f147464a8d93f076dce7 -commit 5fbb7a1349fbbb48ccb1b8cafff2c1854370d87d -Author: Darren Tucker -Date: Tue May 9 17:13:33 2023 +1000 +commit 4e838120a759d187b036036610402cbda33f3203 +Author: djm@openbsd.org +Date: Thu Jan 11 01:45:36 2024 +0000 - Suppress warning for snprintf truncation test. + upstream: make DSA key support compile-time optional, defaulting to + + on + + ok markus@ + + OpenBSD-Commit-ID: 4f8e98fc1fd6de399d0921d5b31b3127a03f581d -commit 47742c513e4e045ecc985c6483fc5c8b050acda2 -Author: Darren Tucker -Date: Tue May 9 17:12:50 2023 +1000 +commit afcc9028bfc411bc26d20bba803b83f90cb84e26 +Author: jmc@openbsd.org +Date: Wed Jan 10 06:33:13 2024 +0000 - Update OpenSSL compat test for 3.x. + upstream: fix incorrect capitalisation; + + OpenBSD-Commit-ID: cb07eb06e15fa2334660ac73e98f29b6a1931984 -commit 86ad25d455a2313126125540e61e0f9314283f88 -Author: Darren Tucker -Date: Mon May 8 20:23:08 2023 +1000 +commit 9707c8170c0c1baeb1e06e5a53f604498193885f +Author: djm@openbsd.org +Date: Tue Jan 9 22:19:36 2024 +0000 - Add macos13 PAM test target. + upstream: extend ChannelTimeout regression test to exercise multiplexed + + connections and the new "global" timeout type. ok dtucker@ + + OpenBSD-Regress-ID: f10d19f697024e9941acad7c2057f73d6eacb8a2 -commit 77cca2c4b13bc6e5f389565583b6202b0d1bccc2 -Author: Darren Tucker -Date: Mon May 8 20:14:46 2023 +1000 +commit b31b12d28de96e1d43581d32f34da8db27e11c03 +Author: djm@openbsd.org +Date: Tue Jan 9 22:19:00 2024 +0000 - Skip agent-peereid test on macos13. + upstream: add a "global" ChannelTimeout type to ssh(1) and sshd(8) - sudo -S nobody doesn't work on the github runners (probably a - permission issue) so skip that test. + that watches all open channels and will close all open channels if there is + no traffic on any of them for the specified interval. This is in addition to + the existing per-channel timeouts added a few releases ago. + + This supports use-cases like having a session + x11 forwarding channel + open where one may be idle for an extended period but the other is + actively used. The global timeout would allow closing both channels when + both have been idle for too long. + + ok dtucker@ + + OpenBSD-Commit-ID: 0054157d24d2eaa5dc1a9a9859afefc13d1d7eb3 -commit b356b8e91678ea295bcf44df5248c3fbf499fdcf -Author: Darren Tucker -Date: Mon May 8 20:14:28 2023 +1000 +commit 602f4beeeda5bb0eca181f8753d923a2997d0a51 +Author: djm@openbsd.org +Date: Tue Jan 9 21:39:14 2024 +0000 - Include config.guess in debug output. + upstream: adapt ssh_api.c code for kex-strict + + from markus@ ok me + + OpenBSD-Commit-ID: 4d9f256852af2a5b882b12cae9447f8f00f933ac -commit b7afd8a4ecaca8afd3179b55e9db79c0ff210237 -Author: Darren Tucker -Date: Mon May 8 20:12:59 2023 +1000 +commit 42ba34aba8708cf96583ff52975d95a8b47d990d +Author: Damien Miller +Date: Mon Jan 8 16:26:37 2024 +1100 - Handle OpenSSL >=3 ABI compatibility. - - Beyond OpenSSL 3.0, the ABI compatibility guarantees are wider (only - major must match instead of major and minor in earlier versions). - bz#3548, ok djm@ + nite that recent OSX tun/tap is unsupported -commit 0e9e2663eb2c6e9c3e10d15d70418312ae67e542 -Author: dtucker@openbsd.org -Date: Mon May 1 08:57:29 2023 +0000 +commit 690bc125f9a3b20e47745fa8f5b5e1fd5820247f +Author: Sevan Janiyan +Date: Wed Dec 27 04:57:49 2023 +0000 - upstream: Import regenerated moduli. - - OpenBSD-Commit-ID: 3d5f811cfcaed8cc4a97e1db49ac61bdf118113c + README.platform: update tuntap url -commit d9687f49682e1e93383fc15ab2018850b2ef38c3 -Author: Darren Tucker -Date: Mon May 1 11:45:14 2023 +1000 +commit 6b8be2ccd7dd091808f86af52066b0c2ec30483a +Author: Rose <83477269+AtariDreams@users.noreply.github.com> +Date: Tue Dec 19 11:48:20 2023 -0500 - Add macos-13 test target. + Fix compilation error in ssh-pcks11-client.c - Also flatten OS list for clarity. + Compilation fails becaus of an undefined reference to helper_by_ec, + because we forgot the preprocessor conditional that excludes that function + from being called in unsupported configurations. -commit aacfd6767497b8fa6d41ecdd3f8e265d1e9ef1f6 +commit 219c8134157744886ee6ac5b8c1650abcd981f4c Author: djm@openbsd.org -Date: Sun Apr 30 22:54:22 2023 +0000 +Date: Mon Jan 8 05:11:18 2024 +0000 - upstream: adjust ftruncate() logic to handle servers that reorder - - requests. - - sftp/scp will ftruncate the destination file after a transfer completes, - to deal with the case where a longer destination file already existed. - We tracked the highest contiguous block transferred to deal with this - case, but our naive tracking doesn't deal with servers that reorder - requests - a misfeature strictly permitted by the protocol but seldom - implemented. + upstream: Remove outdated note from PROTOCOL.mux - Adjust the logic to ftruncate() at the highest absolute block received - when the transfer is successful. feedback deraadt@ ok markus@ + Port forward close by control master is already implemented + by `mux_master_process_close_fwd` in `mux.c` - prompted by https://github.com/openssh/openssh-portable/commit/9b733#commitcomment-110679778 + GHPR442 from bigb4ng - OpenBSD-Commit-ID: 4af7fac75958ad8507b4fea58706f3ff0cfddb1b + OpenBSD-Commit-ID: ad0734fe5916d2dc7dd02b588906cea4df0482fb -commit c8eb3941758615c8284a48fff47872db926da63c +commit 4c3cf362631ccc4ffd422e572f075d5d594feace Author: djm@openbsd.org -Date: Wed Apr 26 01:36:03 2023 +0000 +Date: Mon Jan 8 05:05:15 2024 +0000 - upstream: Check for ProxyJump=none in CanonicalizeHostname logic. + upstream: fix missing field in users-groups-by-id@openssh.com reply - Previously ssh would incorrectly refuse to canonicalise the hostname - if ProxyJump was explicitly set to "none" when CanonicalizeHostname=yes + documentation - bz3567; ok dtucker + GHPR441 from TJ Saunders - OpenBSD-Commit-ID: 80a58e43c3a32f97361282f756ec8d3f37989efd + OpenBSD-Commit-ID: ff5733ff6ef4cd24e0758ebeed557aa91184c674 -commit ac383f3a5c6f529a2e8a5bc44af79a08c7da294e -Author: jsg@openbsd.org -Date: Wed Apr 12 14:22:04 2023 +0000 +commit f64cede2a3c298b50a2659a8b53eb3ab2c0b8d23 +Author: djm@openbsd.org +Date: Mon Jan 8 04:10:03 2024 +0000 - upstream: remove duplicate signal.h include + upstream: make kex-strict section more explicit about its intent: - OpenBSD-Commit-ID: 30c0a34d74d91ddd0e6992525da70d3293392f70 - -commit 740dafa20f3f3d325f6f5d44e990b8c8a6d3d816 -Author: jsg@openbsd.org -Date: Wed Apr 12 08:53:54 2023 +0000 - - upstream: fix double words ok dtucker@ + banning all messages not strictly required in KEX - OpenBSD-Commit-ID: 44d3223902fbce5276422bdc8063ab72a4078489 + OpenBSD-Commit-ID: fc33a2d7f3b7013a7fb7500bdbaa8254ebc88116 -commit 6452f89577ec4f22440c31b8e19b061d1a7c4b2a -Author: Darren Tucker -Date: Tue Apr 11 16:49:19 2023 +1000 +commit 698fe6fd61cbcb8e3e0e874a561d4335a49fbde5 +Author: Damien Miller +Date: Mon Jan 8 14:46:19 2024 +1100 - Test against LibreSSL 3.7.2. + update fuzzer example makefile to clang16 -commit 2138f6be595ca106fe4805a1e3ab9c4d8acc697b +commit fc332cb2d602c60983a8ec9f89412754ace06425 Author: Damien Miller -Date: Thu Apr 6 14:33:10 2023 +1000 +Date: Mon Jan 8 14:45:49 2024 +1100 - remove unused upper-case const strings in fmtfp + unbreak fuzzers - missing pkcs11_make_cert() - no float format that uses upper-case is supported nor are hex floats. - ok dtucker + provide stub for use in fuzzer harness -commit 484c5e6168fdb22cbcd73c4ff987cf9ca47989ca -Author: djm@openbsd.org -Date: Thu Apr 6 03:56:02 2023 +0000 +commit 9ea0a4524ae3276546248a926b6641b2fbc8421b +Author: Damien Miller +Date: Mon Jan 8 14:45:14 2024 +1100 - upstream: simplify sshsig_find_principals() similar to what happened to - - sshsig_check_allowed_keys() in r1.31, removing some dead code + unbreak fuzzers for clang16 - OpenBSD-Commit-ID: a493e628d4d6c08f878c276d998f4313ba61702d + getopt() needs a throw() attribute to compile, so supply one when compiling + things with C++ -commit 3a7b110fbc7e096423f8f7b459deffe4c65d70f4 +commit a72833d00788ef91100c643536ac08ada46440e1 Author: djm@openbsd.org -Date: Thu Apr 6 03:21:31 2023 +0000 +Date: Mon Jan 8 00:34:33 2024 +0000 - upstream: remove redundant ssh!=NULL check; we'd already + upstream: remove ext-info-* in the kex.c code, not in callers; - dereferenced it + with/ok markus@ - OpenBSD-Commit-ID: 852bf12591ec5a9fb12dcbde9b1fd3945ad0df3c + OpenBSD-Commit-ID: c06fe2d3a0605c517ff7d65e38ec7b2d1b0b2799 -commit 2519110659a1efac6c976895a86659d1b341c91b +commit 86f9e96d9bcfd1f5cd4bf8fb57a9b4c242df67df Author: djm@openbsd.org -Date: Thu Apr 6 03:19:32 2023 +0000 +Date: Mon Jan 8 00:30:39 2024 +0000 - upstream: match_user() shouldn't be called with user==NULL unless - - host and ipaddr are also NULL + upstream: fix typo; spotted by Albert Chin - OpenBSD-Commit-ID: fa3518346c21483e9e01a2e4b9436ae501daf8ea + OpenBSD-Commit-ID: 77140b520a43375b886e535eb8bd842a268f9368 -commit 3b9ceaad7ad63c1c03c2a89e148340ad3a62a482 -Author: djm@openbsd.org -Date: Thu Apr 6 03:12:32 2023 +0000 +commit f0cbd26ec91bd49719fb3eea7ca44d2380318b9a +Author: dtucker@openbsd.org +Date: Thu Jan 4 09:51:49 2024 +0000 - upstream: don't care about glob() return value here. + upstream: Import regenerated moduli. - OpenBSD-Commit-ID: 85bb82fea90478a482e9f65a1bec0aa24227fd66 + OpenBSD-Commit-ID: 5a636f6ca7f25bfe775df4952f7aac90a7fcbbee -commit 09d8da0849e2791b2500267cda333cd238f38754 -Author: dtucker@openbsd.org -Date: Mon Apr 3 08:10:54 2023 +0000 +commit 64ddf776531ca4933832beecc8b7ebe1b937e081 +Author: jsg@openbsd.org +Date: Wed Dec 20 00:06:25 2023 +0000 - upstream: Move up null check and simplify process_escapes. - - Based on Coverity CID 291863 which points out we check the channel - pointer for NULLness after dereferencing it. Move this to the start - of the function, and while there simplify initialization of efc a bit. - ok djm@ + upstream: spelling; ok markus@ - OpenBSD-Commit-ID: de36e5ad6fde0fe263ca134e986b9095dc59380a + OpenBSD-Commit-ID: 9d01f2e9d59a999d5d42fc3b3efcf8dfb892e31b -commit b36b162be5e6206f12b734222b7bc517c13a6bc8 -Author: Damien Miller -Date: Fri Mar 31 14:51:20 2023 +1100 +commit 503fbe9ea238a4637e8778208bde8c09bcf78475 +Author: jmc@openbsd.org +Date: Tue Dec 19 06:57:34 2023 +0000 - need va_end() after va_copy(); ok dtucker + upstream: sort -C, and add to usage(); ok djm - spotted by Coverity + OpenBSD-Commit-ID: 80141b2a5d60c8593e3c65ca3c53c431262c812f -commit f703757234a5c585553e72bba279b255a272750a -Author: dtucker@openbsd.org -Date: Fri Mar 31 05:56:36 2023 +0000 +commit 5413b1c7ff5a19c6a7d44bd98c5a83eb47819ba6 +Author: djm@openbsd.org +Date: Tue Dec 19 06:41:14 2023 +0000 - upstream: Explicitly ignore return from waitpid here too. + upstream: correct section numbers; from Ed Maste - OpenBSD-Commit-ID: eef2403df083c61028969fc679ee370373eacacb + OpenBSD-Commit-ID: e289576ee5651528404cb2fb68945556052cf83f -commit 6b73aa29035991d1448a1a76f63ac152a6bf931c -Author: dtucker@openbsd.org -Date: Fri Mar 31 04:45:08 2023 +0000 +commit 430ef864645cff83a4022f5b050174c840e275da +Author: djm@openbsd.org +Date: Mon Dec 18 15:58:56 2023 +0000 - upstream: Explictly ignore return codes - - where we don't check them. + upstream: match flag type (s/int/u_int) - OpenBSD-Commit-ID: 1ffb03038ba1b6b72667be50cf5e5e396b5f2740 + OpenBSD-Commit-ID: 9422289747c35ccb7b31d0e1888ccd5e74ad566a -commit 6f0308a3e717ebe68eeb3f95253612fab5dbf20e -Author: dtucker@openbsd.org -Date: Fri Mar 31 04:42:29 2023 +0000 +commit 1036d77b34a5fa15e56f516b81b9928006848cbd +Author: Damien Miller +Date: Fri Dec 22 17:56:26 2023 +1100 - upstream: Return immediately from get_sock_port + better detection of broken -fzero-call-used-regs - if sock <0 so we don't call getsockname on a negative FD. From Coverity - CID 291840, ok djm@ + gcc 13.2.0 on ppc64le refuses to compile some function, including + cipher.c:compression_alg_list() with an error: - OpenBSD-Commit-ID: de1c1130646230c2eda559831fc6bfd1b61d9618 - -commit 1c1124dc901fca1ea2cb762044b8f1a5793a2bed -Author: djm@openbsd.org -Date: Fri Mar 31 04:23:02 2023 +0000 - - upstream: don't leak arg2 on parse_pubkey_algos error path; ok + > sorry, unimplemented: argument ‘used’ is not supportedcw + > for ‘-fzero-call-used-regs’ on this target - dtucker@ + This extends the autoconf will-it-work test with a similarly- + structured function that seems to catch this. - OpenBSD-Commit-ID: 7d0270ad3dd102412ca76add2b3760518abdef75 + Spotted/tested by Colin Watson; bz3645 -commit 8ba2d4764bb6a4701cd447d8b52604622ffe65f4 +commit 8241b9c0529228b4b86d88b1a6076fb9f97e4a99 +Author: Damien Miller +Date: Tue Dec 19 01:59:50 2023 +1100 + + crank versions + +commit 2f2c65cb5f1518a9c556d3e8efa27ea0ca305c6b +Author: Damien Miller +Date: Tue Dec 19 01:59:06 2023 +1100 + + depend + +commit e48cdee8e19059203b1aeeabec2350b8375fa61f Author: djm@openbsd.org -Date: Fri Mar 31 04:22:27 2023 +0000 +Date: Mon Dec 18 14:50:08 2023 +0000 - upstream: clamp max number of GSSAPI mechanisms to 2048; ok dtucker + upstream: regress test for agent PKCS#11-backed certificates - OpenBSD-Commit-ID: ce66db603a913d3dd57063e330cb5494d70722c4 + OpenBSD-Regress-ID: 38f681777cb944a8cc3bf9d0ad62959a16764df9 -commit 1883841fc13d0eada8743cac5d3abe142ee2efa7 +commit 2f512f862df1d5f456f82a0334c9e8cc7208a2a1 Author: djm@openbsd.org -Date: Fri Mar 31 04:21:56 2023 +0000 +Date: Mon Dec 18 14:49:39 2023 +0000 - upstream: don't print key if printing hostname failed; with/ok - - dtucker@ + upstream: regress test for constrained PKCS#11 keys - OpenBSD-Commit-ID: ad42971a6ee5a46feab2d79f7f656f8cf4b119f3 + OpenBSD-Regress-ID: b2f26ae95d609d12257b43aef7cd7714c82618ff -commit c6011129cafe4c411f6ef670a4cf271314708eb8 +commit cdddd66412ca5920ed4d3ebbfa6ace12dbd9b82f Author: djm@openbsd.org -Date: Fri Mar 31 04:04:15 2023 +0000 +Date: Mon Dec 18 14:48:44 2023 +0000 - upstream: remove redundant test + upstream: openssh-9.6 - OpenBSD-Commit-ID: 6a0b719f9b1ae9d42ad8c5b144c7962c93792f7c + OpenBSD-Commit-ID: 21759837cf0e0092d9a2079f8fb562071c11016b -commit 4fb29eeafb40a2076c0dbe54e46b687c318f87aa +commit 6d51feab157cedf1e7ef5b3f8781ca8ff9c4ab1b Author: djm@openbsd.org -Date: Fri Mar 31 04:00:37 2023 +0000 +Date: Mon Dec 18 14:48:08 2023 +0000 - upstream: don't attempt to decode a ridiculous number of + upstream: ssh-agent: record failed session-bind attempts - attributes; harmless because of bounds elsewhere, but better to be explicit + Record failed attempts to session-bind a connection and refuse signing + operations on that connection henceforth. - OpenBSD-Commit-ID: 1a34f4b6896155b80327d15dc7ccf294b538a9f2 + Prevents a future situation where we add a new hostkey type that is not + recognised by an older ssh-agent, that consequently causes session-bind + to fail (this situation is only likely to arise when people mix ssh(1) + and ssh-agent(1) of different versions on the same host). Previously, + after such a failure the agent socket would be considered unbound and + not subject to restriction. + + Spotted by Jann Horn + + OpenBSD-Commit-ID: b0fdd023e920aa4831413f640de4c5307b53552e -commit fc437c154ef724621a4af236de9bc7e51a8381ae +commit 7ef3787c84b6b524501211b11a26c742f829af1a Author: djm@openbsd.org -Date: Fri Mar 31 03:22:49 2023 +0000 +Date: Mon Dec 18 14:47:44 2023 +0000 - upstream: remove unused variable; prompted by Coverity CID 291879 + upstream: ban user/hostnames with most shell metacharacters - OpenBSD-Commit-ID: 4c7d20ef776887b0ba1aabcfc1b14690e4ad0a40 - -commit 0eb8131e4a53b33a8fc9b9ab694e6b6778b87ade -Author: dtucker@openbsd.org -Date: Fri Mar 31 00:44:29 2023 +0000 - - upstream: Check fd against >=0 instead of >0 in error path. The + This makes ssh(1) refuse user or host names provided on the + commandline that contain most shell metacharacters. - dup could in theory return fd 0 although currently it doesn't in practice. - From Dmitry Belyavskiy vi github PR#238. + Some programs that invoke ssh(1) using untrusted data do not filter + metacharacters in arguments they supply. This could create + interactions with user-specified ProxyCommand and other directives + that allow shell injection attacks to occur. - OpenBSD-Commit-ID: 4a95f3f7330394dffee5c749d52713cbf3b54846 - -commit 7174ba6f8a431ca4257767a260fc50e204068242 -Author: dtucker@openbsd.org -Date: Thu Mar 30 07:19:50 2023 +0000 - - upstream: Ignore return value from muxclient(). It normally loops + It's a mistake to invoke ssh(1) with arbitrary untrusted arguments, + but getting this stuff right can be tricky, so this should prevent + most obvious ways of creating risky situations. It however is not + and cannot be perfect: ssh(1) has no practical way of interpreting + what shell quoting rules are in use and how they interact with the + user's specified ProxyCommand. - without returning, but it if returns on failure we immediately exit. - Coverity CID 405050. + To allow configurations that use strange user or hostnames to + continue to work, this strictness is applied only to names coming + from the commandline. Names specified using User or Hostname + directives in ssh_config(5) are not affected. - OpenBSD-Commit-ID: ab3fde6da384ea588226037c38635a6b2e015295 - -commit a4c1c2513e36f111eeaa1322c510067930e5e51e -Author: Damien Miller -Date: Fri Mar 31 14:17:22 2023 +1100 - - don't call connect() on negative socket + feedback/ok millert@ markus@ dtucker@ deraadt@ - Coverity CID 405037 + OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9 -commit 34ee842cdd981a759fe8f0d4a37521f9a1c63170 +commit 0cb50eefdd29f0fec31d0e71cc4b004a5f704e67 Author: djm@openbsd.org -Date: Thu Mar 30 03:05:01 2023 +0000 +Date: Mon Dec 18 14:47:20 2023 +0000 - upstream: return SSH_ERR_KEY_NOT_FOUND if the allowed_signers file + upstream: stricter handling of channel window limits - is empty, not SSH_ERR_INTERNAL_ERROR. Also remove some dead code spotted - by Coverity; with/ok dtucker@ + This makes ssh/sshd more strict in handling non-compliant peers that + send more data than the advertised channel window allows. Previously + the additional data would be silently discarded. This change will + cause ssh/sshd to terminate the connection if the channel window is + exceeded by more than a small grace allowance. - OpenBSD-Commit-ID: 898a1e817cda9869554b1f586a434f67bcc3b650 + ok markus@ + + OpenBSD-Commit-ID: 811e21b41831eba3dd7f67b3d409a438f20d3037 -commit f108e77a9dc9852e72215af1bf27731c48434557 -Author: dtucker@openbsd.org -Date: Thu Mar 30 00:49:37 2023 +0000 +commit 4448a2938abc76e6bd33ba09b2ec17a216dfb491 +Author: djm@openbsd.org +Date: Mon Dec 18 14:46:56 2023 +0000 - upstream: Remove dead code from inside if block. + upstream: Make it possible to load certs from PKCS#11 tokens - The only way the if statement can be true is if both dup()s fail, and - in that case the tmp2 can never be set. Coverity CID 291805, ok djm@ + Adds a protocol extension to allow grafting certificates supplied by + ssh-add to keys loaded from PKCS#11 tokens in the agent. - OpenBSD-Commit-ID: c0d6089b3fb725015462040cd94e23237449f0c8 - -commit 05b8e88ebe23db690abbfb1a91111abea09cde08 -Author: Darren Tucker -Date: Thu Mar 30 13:53:29 2023 +1100 - - child_set_eng: verify both env pointer and count. + feedback/ok markus@ - If child_set env was called with a NULL env pointer and a non-zero count - it would end up in a null deref, although we don't currently do this. - Prompted by Coverity CID 291850, tweak & ok djm@ + OpenBSD-Commit-ID: bb5433cd28ede2bc910996eb3c0b53e20f86037f -commit 28f1b8ef9b84b8cd2f6c9889a0c60aa4a90dadfa -Author: dtucker@openbsd.org -Date: Wed Mar 29 01:07:48 2023 +0000 +commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b +Author: djm@openbsd.org +Date: Mon Dec 18 14:46:12 2023 +0000 - upstream: Ignore return from sshpkt_disconnect + upstream: apply destination constraints to all p11 keys - since we set our own return value for the function. Coverity CID 291797, - ok djm@ + Previously applied only to the first key returned from each token. - OpenBSD-Commit-ID: 710b57ba954c139240895e23feea41f203201f04 + ok markus@ + + OpenBSD-Commit-ID: 36df3afb8eb94eec6b2541f063d0d164ef8b488d -commit c3da05d95922f5550bcc7815e799474d6a160175 -Author: dtucker@openbsd.org -Date: Wed Mar 29 00:59:08 2023 +0000 +commit a7ed931caeb68947d30af8a795f4108b6efad761 +Author: djm@openbsd.org +Date: Mon Dec 18 14:45:49 2023 +0000 - upstream: Plug potential mem leak in process_put. + upstream: add "ext-info-in-auth@openssh.com" extension - It allocates abs_dst inside a loop but only frees it on exit, so free - inside the loop if necessary. Coverity CID 291837, ok djm@ + This adds another transport protocol extension to allow a sshd to send + SSH2_MSG_EXT_INFO during user authentication, after the server has + learned the username that is being logged in to. - OpenBSD-Commit-ID: a01616503a185519b16f00dde25d34ceaf4ae1a3 + This lets sshd to update the acceptable signature algoritms for public + key authentication, and allows these to be varied via sshd_config(5) + "Match" directives, which are evaluated after the server learns the + username being authenticated. + + Full details in the PROTOCOL file + + OpenBSD-Commit-ID: 1de7da7f2b6c32a46043d75fcd49b0cbb7db7779 -commit 13ae327eae598b1043e5ec30e4b170edb3c898a5 +commit 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5 Author: djm@openbsd.org -Date: Wed Mar 29 00:18:35 2023 +0000 +Date: Mon Dec 18 14:45:17 2023 +0000 - upstream: fix memory leak; Coverity CID 291848 + upstream: implement "strict key exchange" in ssh and sshd - with/ok dtucker@ + This adds a protocol extension to improve the integrity of the SSH + transport protocol, particular in and around the initial key exchange + (KEX) phase. - OpenBSD-Commit-ID: 37f80cb5d075ead5a00ad1b74175684ab1156ff8 - -commit 9ffa76e1284c85bf459c3dcb8e995733a8967e1b -Author: dtucker@openbsd.org -Date: Tue Mar 28 07:44:32 2023 +0000 - - upstream: Plug more mem leaks in sftp by making + Full details of the extension are in the PROTOCOL file. - make_absolute_pwd_glob work in the same way as make_absolute: you - pass it a dynamically allocated string and it either returns it, or - frees it and allocates a new one. Patch from emaste at freebsd.org and - https://reviews.freebsd.org/D37253 ok djm@ + with markus@ - OpenBSD-Commit-ID: 85f7404e9d47fd28b222fbc412678f3361d2dffc + OpenBSD-Commit-ID: 2a66ac962f0a630d7945fee54004ed9e9c439f14 -commit 82b2b8326962b1a98af279bc5bbbbbcab15b3e45 -Author: dtucker@openbsd.org -Date: Tue Mar 28 06:12:38 2023 +0000 +commit 59d691b886c79e70b1d1c4ab744e81fd176222fd +Author: Damien Miller +Date: Mon Dec 18 14:49:11 2023 +1100 - upstream: Remove compat code for OpenSSL < 1.1.* + better detection of broken -fzero-call-used-regs - since -portable no longer supports them. + Use OSSH_CHECK_CFLAG_LINK() for detection of these flags and extend + test program to exercise varargs, which seems to catch more stuff. - OpenBSD-Commit-ID: ea2893783331947cd29a67612b4e56f818f185ff + ok dtucker@ -commit b500afcf00ae1b6b73b2ccf171111dfbfeaef74d -Author: dtucker@openbsd.org -Date: Mon Mar 27 23:56:54 2023 +0000 +commit aa7b21708511a6d4aed3839fc9f6e82e849dd4a1 +Author: djm@openbsd.org +Date: Wed Dec 13 03:28:19 2023 +0000 - upstream: Remove compat code for OpenSSL 1.0.* + upstream: when invoking KnownHostsCommand to determine the order of - versions now that -portable has dropped support for those versions. + host key algorithms to request, ensure that the hostname passed to the + command is decorated with the port number for ports other than 22. - OpenBSD-Regress-ID: 82a8eacd87aec28e4aa19f17246ddde9d5ce7fe7 - -commit 727560e6011efcb36d2f3ac6910444bc775abaa1 -Author: Darren Tucker -Date: Tue Mar 28 18:06:42 2023 +1100 - - Prevent conflicts between Solaris SHA2 and OpenSSL. + This matches the behaviour of KnownHostsCommand when invoked to look + up the actual host key. - We used to prevent conflicts between native SHA2 headers and OpenSSL's - by setting OPENSSL_NO_SHA but that was removed prior to OpenSSL 1.1.0 - -commit 46db8e14b7f186d32173dcdecd5b785334429b8b -Author: Darren Tucker -Date: Tue Mar 28 12:44:03 2023 +1100 - - Remove HEADER_SHA_H from previous... + bz3643, ok dtucker@ - since it causes more problems than it solves. + OpenBSD-Commit-ID: 5cfabc0b7c6c7ab473666df314f377b1f15420b1 -commit 72bd68d37387aa5f81da928f6e82f1c88ed8f674 -Author: Darren Tucker -Date: Tue Mar 28 10:35:18 2023 +1100 +commit 4086bd6652c0badccc020218a62190a7798fb72c +Author: markus@openbsd.org +Date: Fri Dec 8 09:18:39 2023 +0000 - Replace OPENSSL_NO_SHA with HEADER_SHA_H. + upstream: prevent leak in sshsig_match_principals; ok djm@ - Since this test doesn't use OpenSSL's SHA2 and may cause conflicts we - don't want to include it, but OPENSSL_NO_SHA was removed beginning in - OpenSSL's 1.1 series. + OpenBSD-Commit-ID: 594f61ad4819ff5c72dfe99ba666a17f0e1030ae -commit 99668f2e6e0deb833e46cfab56db59ff0fc28c7e -Author: Darren Tucker -Date: Tue Mar 28 09:50:06 2023 +1100 +commit 19d3ee2f3adf7d9a606ff015c1e153744702c4c9 +Author: djm@openbsd.org +Date: Wed Dec 6 21:06:48 2023 +0000 - Configure with --target instead of deprecated form. + upstream: short circuit debug log processing early if we're not going + + to log anything. From Kobe Housen + + OpenBSD-Commit-ID: 2bcddd695872a1bef137cfff7823044dcded90ea -commit f751d9306c62cd1061f966e6a7483d9bab9c379b +commit 947affad4831df015c498c00c6351ea6f13895d5 Author: Darren Tucker -Date: Mon Mar 27 22:05:29 2023 +1100 +Date: Mon Nov 27 09:37:28 2023 +1100 - Pass rpath when building 64bit Solaris. + Add tests for OpenSSL 3.2.0 and 3.2 stable branch. -commit a64b935cd450ee8d04c26c9cd728629cf9ca5c91 +commit 747dce36206675ca6b885010a835733df469351b Author: Darren Tucker -Date: Mon Mar 27 19:21:19 2023 +1100 +Date: Sat Nov 25 09:03:38 2023 +1100 - Explicitly disable OpenSSL on AIX test VM. + Use non-zero arg in compiler test program. + + Now that we're running the test program, passing zero to the test function + can cause divide-by-zero exceptions which might show up in logs. -commit 7ebc6f060fc2f70495a56e16d210baae6424cd96 +commit 3d44a5c56585d1c351dbc006240a591b6da502b1 Author: dtucker@openbsd.org -Date: Mon Mar 27 03:56:50 2023 +0000 +Date: Fri Nov 24 00:31:30 2023 +0000 - upstream: Add RevokedHostKeys to percent expansion test. + upstream: Plug mem leak of msg when processing a quit message. - OpenBSD-Regress-ID: c077fd12a38005dd53d878c5b944154dec88d2ff + Coverity CID#427852, ok djm@ + + OpenBSD-Commit-ID: bf85362addbe2134c3d8c4b80f16601fbff823b7 -commit f1a17de150f8d309d0c52f9abfaebf11c51a8537 +commit 1d7f9b6e297877bd00973e6dc5c0642dbefc3b5f Author: dtucker@openbsd.org -Date: Mon Mar 27 03:56:11 2023 +0000 +Date: Thu Nov 23 03:37:05 2023 +0000 - upstream: Add tilde and environment variable expansion to - - RevokedHostKeys. bz#3552, ok djm@ + upstream: Include existing mux path in debug message. - OpenBSD-Commit-ID: ce5d8e0219b63cded594c17d4c2958c06918ec0d + OpenBSD-Commit-ID: 1c3641be10c2f4fbad2a1b088a441d072e18bf16 -commit 009eb4cb48a9708ab9174684dcbcc0f942907abe -Author: djm@openbsd.org -Date: Mon Mar 27 03:31:05 2023 +0000 +commit f29934066bd0e561a2e516b7e584fb92d2eedee0 +Author: Darren Tucker +Date: Thu Nov 23 19:41:27 2023 +1100 - upstream: fix test: getnameinfo returns a non-zero value on error, not - - (neccessarily) -1. From GHPR#384 + Add an Ubuntu 22.04 test VM. - OpenBSD-Commit-ID: d35e2b71268f66f5543a7ea68751972b3ae22b25 + This is the same version as Github's runners so most of the testing on + it is over there, but having a local VM makes debugging much easier. -commit 4f0a676486700f10a4788f7e9426e94e39c1c89e -Author: djm@openbsd.org -Date: Mon Mar 27 03:25:08 2023 +0000 +commit a93284a780cd3972afe5f89086b75d564ba157f3 +Author: Darren Tucker +Date: Thu Nov 23 19:36:22 2023 +1100 - upstream: scp: when copying local->remote, check that source file - - exists before opening SFTP connection to the server. Based on GHPR#370 ok - dtucker, markus + Add gcc-12 -Werror test on Ubuntu 22.04. - OpenBSD-Commit-ID: b4dd68e15bfe22ce4fac9960a1066a2b721e54fb + Explictly specify gcc-11 on Ubuntu 22.04 (it's the system compiler). -commit 154d8baf631327163571760c2c524bc93c37567c +commit 670f5a647e98b6fd95ad64f789f87ee3274b481b Author: Darren Tucker -Date: Mon Mar 27 12:22:30 2023 +1100 +Date: Thu Nov 23 19:34:57 2023 +1100 - Also look for gdb error message from OpenIndiana. + Check return value from write to prevent warning. + + ... and since we're testing for flags with -Werror, this caused + configure to mis-detect compiler flags. -commit fbd3811ddb2b6ce2e6dba91fde7352c8978e5412 +commit cea007d691cfedfa07a5b8599f97ce0511f53fc9 Author: Darren Tucker -Date: Mon Mar 27 11:08:00 2023 +1100 +Date: Wed Nov 22 21:18:55 2023 +1100 - Explicitly disable security key test on aix51 VM. + Run compiler test program when compiling natively. - We don't know how to build the shared objects required for the security - key tests so skip them. + ok djm@ -commit 4922ac3be8a996780ef3dc220411da2e27c29d9c +commit ee0d305828f13536c0a416bbf9c3e81039d9ea55 Author: Darren Tucker -Date: Sun Mar 26 14:49:43 2023 +1100 +Date: Wed Nov 22 21:18:07 2023 +1100 - Split libcrypto and other config flags. + Factor out compiler test program into a macro. - This should allow the automatic OpenSSL version selection in the tests - to work better. + ok djm@ -commit 4a948b1469f185e871160a2d70e2a0fce2858f9e +commit de304c76316b029df460673725a9104224b9959b Author: Darren Tucker -Date: Sun Mar 26 14:39:45 2023 +1100 +Date: Wed Nov 22 08:55:36 2023 +1100 - Specify test target if we build without OpenSSL. - - When we decide we can't use the versions of OpenSSL available, also - restrict the tests we run to avoid the ones that need OpenSSL. + Add fbsd14 VM to test pool. -commit b308c636f5b5d89eecb98be00b3d56306a005a09 +commit 99a2df5e1994cdcb44ba2187b5f34d0e9190be91 Author: Darren Tucker -Date: Sun Mar 26 14:22:53 2023 +1100 +Date: Tue Nov 21 16:19:29 2023 +1100 - Find suitable OpenSSL version. + Expand -fzero-call-used-regs test to cover gcc 11. - Check the installed OpenSSL versions for a suitable one, and if there - isn't (and we don't have a specific version configured) then build - without OpenSSL. + It turns out that gcc also has some problems with -fzero-call-used-regs, + at least v11 on mips. Previously the test in OSSH_CHECK_CFLAG_COMPILE + was sufficient to catch it with "=all", but not sufficient for "=used". + Expand the testcase and include it in the other tests for good measure. + See bz#3629. ok djm@. -commit 021ea5c2860f133f44790970968e0e73208b3a87 -Author: Damien Miller -Date: Fri Mar 24 15:02:52 2023 +1100 +commit ff220d4010717f7bfbbc02a2400666fb9d24f250 +Author: Darren Tucker +Date: Tue Nov 21 14:04:34 2023 +1100 - Github testing support for BoringSSL + Stop using -fzero-call-used-regs=all + + ... since it seems to be problematic with several different versions of + clang. Only use -fzero-call-used-regs=used which is less + problematic, except with Apple's clang where we don't use it at all. + bz#3629, ok djm@ -commit 9a97cd106466a2a9bda2bfaa4c48c4f1b2cc9c1b -Author: Damien Miller -Date: Fri Mar 24 15:34:29 2023 +1100 +commit 2a19e02f36b16f0f6cc915f7d1e60ead5e36303b +Author: Darren Tucker +Date: Tue Nov 21 14:02:18 2023 +1100 - BoringSSL doesn't support EC_POINT_point2bn() + Allow for vendor prefix on clang version numbers. - so don't invoke it in unittest + Correctly detects the version of OpenBSD's native clang, as well as + Apple's. Spotted tb@, ok djm@. -commit cc5969c033a032d126ff78e5d95cf20abbede4c7 -Author: Damien Miller -Date: Fri Mar 24 15:34:05 2023 +1100 +commit c52db0114826d73eff6cdbf205e9c1fa4f7ca6c6 +Author: djm@openbsd.org +Date: Mon Nov 20 02:50:00 2023 +0000 - another ERR_load_CRYPTO_strings() vestige + upstream: set errno=EAFNOSUPPORT when filtering addresses that don't + + match AddressFamily; yields slightly better error message if no address + matches. bz#3526 + + OpenBSD-Commit-ID: 29cea900ddd8b04a4d1968da5c4a893be2ebd9e6 -commit 4974293899a068133e976f81d6693670d2b576ca -Author: Damien Miller -Date: Fri Mar 24 15:24:05 2023 +1100 +commit 26f3f3bbc69196d908cad6558c8c7dc5beb8d74a +Author: djm@openbsd.org +Date: Wed Nov 15 23:03:38 2023 +0000 - don't use obsolete ERR_load_CRYPTO_strings() + upstream: when connecting via socket (the default case), filter - OpenSSL (and elsewhere in OpenSSH) uses ERR_load_crypto_strings() - -commit 3c527d55f906e6970d17c4cab6db90ae9e013235 -Author: Damien Miller -Date: Fri Mar 24 15:23:05 2023 +1100 + addresses by AddressFamily if one was specified. Fixes the case where, if + CanonicalizeHostname is enabled, ssh may ignore AddressFamily. bz5326; ok + dtucker + + OpenBSD-Commit-ID: 6c7d7751f6cd055126b2b268a7b64dcafa447439 - Allow building with BoringSSL +commit 050c335c8da43741ed0df2570ebfbd5d1dfd0a31 +Author: djm@openbsd.org +Date: Wed Nov 15 22:51:49 2023 +0000 -commit b7e27cfd7f163fc16b4c5d041cc28ee488a5eeec -Author: Damien Miller -Date: Fri Mar 24 15:21:18 2023 +1100 - - put back SSLeay_version compat in configure test + upstream: when deciding whether to enable keystroke timing - Needed to detect old versions and give good "your version is bad" - messages at configure time; spotted by dtucker@ - -commit 7280401bdd77ca54be6867a154cc01e0d72612e0 -Author: Damien Miller -Date: Fri Mar 24 13:56:25 2023 +1100 - - remove support for old libcrypto + obfuscation, only consider enabling it when a channel with a tty is open. - OpenSSH now requires LibreSSL 3.1.0 or greater or - OpenSSL 1.1.1 or greater + Avoids turning on the obfucation when X11 forwarding only is in use, + which slows it right down. Reported by Roger Marsh - with/ok dtucker@ + OpenBSD-Commit-ID: c292f738db410f729190f92de100c39ec931a4f1 -commit abda22fb48302f2142233f71d27c74040288c518 -Author: Darren Tucker -Date: Sun Mar 19 15:36:13 2023 +1100 +commit 676377ce67807a24e08a54cd60ec832946cc6cae +Author: tobhe@openbsd.org +Date: Mon Nov 13 09:18:19 2023 +0000 - Test latest OpenSSL 1.1, 3.0 and LibreSSL 3.7. + upstream: Make sure sftp_get_limits() only returns 0 if 'limits' + + was initialized. This fixes a potential uninitialized use of 'limits' in + sftp_init() if sftp_get_limits() returned early because of an unexpected + message type. + + ok djm@ + + OpenBSD-Commit-ID: 1c177d7c3becc1d71bc8763eecf61873a1d3884c -commit 610ac1cb077cd5a1ebfc21612154bfa13d2ec825 +commit 64e0600f23c6dec36c3875392ac95b8a9100c2d6 Author: Darren Tucker -Date: Thu Mar 16 21:38:04 2023 +1100 +Date: Mon Nov 13 20:03:31 2023 +1100 - Show 9.3 branch instead of 9.2. + Test current releases of LibreSSL and OpenSSL. + + Retire some of the older releases. -commit cb30fbdbee869f1ce11f06aa97e1cb8717a0b645 -Author: Damien Miller -Date: Thu Mar 16 08:28:19 2023 +1100 +commit c8ed7cc545879ac15f6ce428be4b29c35598bb2a +Author: dtucker@openbsd.org +Date: Wed Nov 1 02:08:38 2023 +0000 - depend + upstream: Specify ssh binary to use + + ... instead of relying on installed one. Fixes test failures in -portable + when running tests prior to installation. + + OpenBSD-Regress-ID: b6d6ba71c23209c616efc805a60d9a445d53a685 -commit 1dba63eb10c40b6fda9f5012ed6ae87e2d3d028e -Author: Damien Miller -Date: Thu Mar 16 08:27:54 2023 +1100 +commit e9fc2c48121cada1b4dcc5dadea5d447fe0093c3 +Author: Darren Tucker +Date: Wed Nov 1 13:11:31 2023 +1100 - crank version + Put long-running test targets on hipri runners. + + Some of the selfhosted test targets take a long time to run for various + reasons, so label them for "libvirt-hipri" runners so that they can + start immediately. This should reduce the time to complete all tests. -commit ba7532d0dac9aaf0ad7270664c43837fc9f64a5f +commit 7ddf27668f0e21233f08c0ab2fe9ee3fdd6ab1e2 Author: djm@openbsd.org -Date: Wed Mar 15 21:19:57 2023 +0000 +Date: Wed Nov 1 00:29:46 2023 +0000 - upstream: openssh-9.3 + upstream: add some tests of forced commands overriding Subsystem - OpenBSD-Commit-ID: 8011495f2449c1029bb316bd015eab2e00509848 + directives + + OpenBSD-Regress-ID: eb48610282f6371672bdf2a8b5d2aa33cfbd322b -commit 6fd4daafb949b66bf555f3100f715a9ec64c3390 +commit fb06f9b5a065dfbbef5916fc4accc03c0bf026dd Author: dtucker@openbsd.org -Date: Tue Mar 14 07:28:47 2023 +0000 +Date: Tue Oct 31 04:15:40 2023 +0000 - upstream: Free KRL ptr in addition to its contents. + upstream: Don't try to use sudo inside sshd log wrapper. - From Coverity CID 291841, ok djm@ + We still need to check if we're using sudo since we don't want to chown + unecessarily, as on some platforms this causes an error which pollutes + stderr. We also don't want to unnecessarily invoke sudo, since it's + running in the context of the proxycommand, on *other* platforms it + may not be able to authenticate, and if we're using SUDO then it should + already be privileged. - OpenBSD-Commit-ID: f146ba08b1b43af4e0d7ad8c4dae3748b4fa31b6 + OpenBSD-Regress-ID: 70d58df7503db699de579a9479300e5f3735f4ee -commit 1d270bd303afaf6d94e9098cbbf18e5e539e2088 +commit fc3cc33e88c242c704781c6c48087838f1dcfa2a Author: dtucker@openbsd.org -Date: Tue Mar 14 07:26:25 2023 +0000 +Date: Tue Oct 31 02:58:45 2023 +0000 - upstream: Check pointer for NULL before deref. + upstream: Only try to chmod logfile if we have sudo. If we don't have - None of the existing callers seem to do that, but it's worth checking. - From Coverity CID 291834, ok djm@ + sudo then we won't need to chmod. - OpenBSD-Commit-ID: a0a97113f192a7cb1a2c97b932f677f573cda7a4 + OpenBSD-Regress-ID: dbad2f5ece839658ef8af3376cb1fb1cabe2e324 -commit d95af508e78c0cd3dce56b83853baaa59ae295cf -Author: dtucker@openbsd.org -Date: Sun Mar 12 10:40:39 2023 +0000 +commit 3a506598fddd3f18f9095af3fe917f24cbdd32e0 +Author: djm@openbsd.org +Date: Mon Oct 30 23:00:25 2023 +0000 - upstream: Limit number of entries in SSH2_MSG_EXT_INFO + upstream: move PKCS#11 setup code to test-exec.sh so it can be reused - request. This is already constrained by the maximum SSH packet size but this - makes it explicit. Prompted by Coverity CID 291868, ok djm@ markus@ + elsewhere - OpenBSD-Commit-ID: aea023819aa44a2dcb9dd0fbec10561896fc3a09 + OpenBSD-Regress-ID: 1d29e6be40f994419795d9e660a8d07f538f0acb -commit 8f287ba60d342b3e2f750e7332d2131e3ec7ecd0 -Author: dtucker@openbsd.org -Date: Sun Mar 12 09:41:18 2023 +0000 +commit f82fa227a52661c37404a6d33bbabf14fed05db0 +Author: djm@openbsd.org +Date: Mon Oct 30 17:32:00 2023 +0000 - upstream: calloc can return NULL but xcalloc can't. + upstream: tidy and refactor PKCS#11 setup code - From Coverity CID 291881, ok djm@ + Replace the use of a perl script to delete the controlling TTY with a + SSH_ASKPASS script to directly load the PIN. - OpenBSD-Commit-ID: 50204b755f66b2ec7ac3cfe379d07d85ca161d2b - -commit 83a56a49fd50f4acf900f934279482e4ef329715 -Author: dtucker@openbsd.org -Date: Fri Mar 10 07:17:08 2023 +0000 - - upstream: Explicitly ignore return from fcntl + Move PKCS#11 setup code to functions in anticipation of it being used + elsewhere in additional tests. - (... FD_CLOEXEC) here too. Coverity CID 291853. + Reduce stdout spam - OpenBSD-Commit-ID: 99d8b3da9d0be1d07ca8dd8e98800a890349e9b5 + OpenBSD-Regress-ID: 07705c31de30bab9601a95daf1ee6bef821dd262 -commit 0fda9d704d3bbf54a5e64ce02a6fecb11fe7f047 -Author: Damien Miller -Date: Fri Mar 10 15:59:46 2023 +1100 +commit 3cf698c6d4ffa9be1da55672a3519e2135a6366a +Author: Darren Tucker +Date: Mon Oct 30 21:35:03 2023 +1100 - bounds checking for getrrsetbyname() replacement; - - Spotted by Coverity in CID 405033; ok millert@ + Add obsd74 test VM and retire obsd69 and obsd70. -commit 89b8df518f21677045599df0ad3e5dd0f39909b5 -Author: dtucker@openbsd.org -Date: Fri Mar 10 04:06:21 2023 +0000 +commit 3e21d58a09894acb38dc69ed615d101131f473d0 +Author: Darren Tucker +Date: Mon Oct 30 18:34:12 2023 +1100 - upstream: Plug mem leak on error path. Coverity CID 405026, ok djm@. + Add OpenSSL 3.3.0 as a known dev version. + +commit 917ba181c2cbdb250a443589ec732aa36fd51ffa +Author: Darren Tucker +Date: Mon Oct 30 13:32:03 2023 +1100 + + Restore nopasswd sudo rule on Mac OS X. - OpenBSD-Commit-ID: 8212ca05d01966fb5e72205c592b2257708a2aac + This seems to be missing from some (but not all) github runners, so + restore it if it seems to be missing. -commit bf4dae0ad192c3e2f03f7223834b00d88ace3d3e +commit c5698abad6d4ec98ca20bcaaabaeacd5e1ec3f4f Author: Darren Tucker -Date: Fri Mar 10 14:46:57 2023 +1100 +Date: Mon Oct 30 13:26:52 2023 +1100 - Add prototypes for mkstemp replacements. + Don't exit early when setting up on Mac OS X. - Should prevent warnings due to our wrapper function. + We probably need some of the other bits in there (specifically, setting + the perms on the home directory) so make it less of a special snowflake. -commit 4e04d68d6a33cdc73b831fd4b5e6124175555d3d +commit 1d6a878ceba60b9dc14037dddc8f036070c0065f Author: dtucker@openbsd.org -Date: Fri Mar 10 03:01:51 2023 +0000 +Date: Sun Oct 29 06:22:07 2023 +0000 - upstream: Expliticly ignore return code from fcntl(.. FD_CLOEXEC) since + upstream: Only try to chown logfiles that exist to prevent spurious - there's not much we can do anyway. From Coverity CID 291857, ok djm@ + errors. - OpenBSD-Commit-ID: 051429dd07af8db3fec10d82cdc78d90bb051729 + OpenBSD-Regress-ID: f1b20a476734e885078c481f1324c9ea03af991e -commit d6d38fd77cbe091c59e1bb720c3a494df4990640 -Author: djm@openbsd.org -Date: Fri Mar 10 02:32:04 2023 +0000 +commit e612376427a66f835e284f6b426d16d7c85301bc +Author: anton@openbsd.org +Date: Thu Oct 26 18:52:45 2023 +0000 - upstream: Like sshd_config, some ssh_config options are not + upstream: make use of bsd.regress.mk in extra and interop targets; ok - first-match-wins. sshd_config.5 was fixed in r1.348, this is the same for - this file + dtucker@ - OpenBSD-Commit-ID: 7be55b9351cde449b136afcc52d07aa4113b215e + OpenBSD-Regress-ID: 7ea21b5f6fc4506165093b2123d88d20ff13a4f0 -commit 7187d3f86bf8f2066cc9941f217d23b0cacae25e +commit ea0039173957d0edcd6469b9614dcedb44dcb4f9 Author: dtucker@openbsd.org -Date: Fri Mar 10 02:24:56 2023 +0000 +Date: Thu Oct 26 12:44:07 2023 +0000 - upstream: Remove no-op (int) > INT_MAX checks - - since they can never be true. From Coverity CID 405031, ok djm@ + upstream: Skip conch interop tests when not enabled instead of fatal. - OpenBSD-Commit-ID: 9df3783b181e056595e2bb9edf7ed41d61cf8e84 + OpenBSD-Regress-ID: b0abf81c24ac6c21f367233663228ba16fa96a46 -commit 77adde4305542ebe3005dd456122624fe2347b01 -Author: Darren Tucker -Date: Fri Mar 10 13:27:29 2023 +1100 +commit d220b9ed5494252b26b95f05be118472bc3ab5c0 +Author: dtucker@openbsd.org +Date: Wed Oct 25 05:38:08 2023 +0000 - Wrap mkstemp calls with umask set/restore. + upstream: Import regenerated moduli. - glibc versions 2.06 and earlier did not set a umask on files created by - mkstemp created the world-writable. Wrap mkstemp to set and restore - the umask. From Coverity (CIDs 291826 291886 291891), ok djm@ + OpenBSD-Commit-ID: 95f5dd6107e8902b87dc5b005ef2b53f1ff378b8 -commit 633d3dc2a1e9e2a013d019a0576a0771c8423713 -Author: jcs@openbsd.org -Date: Thu Mar 9 21:06:24 2023 +0000 +commit a611e4db4009447a0151f31a44e235ca32ed4429 +Author: anton@openbsd.org +Date: Wed Oct 25 08:01:59 2023 +0000 - upstream: modify parentheses in conditionals to make it clearer what is - - being assigned and what is being checked + upstream: ssh conch interop tests requires a controlling terminal; - ok djm dtucker + ok dtucker@ - OpenBSD-Commit-ID: 19c10baa46ae559474409f75a5cb3d0eade7a9b8 + OpenBSD-Regress-ID: cbf2701bc347c2f19d907f113779c666f1ecae4a -commit 733030840c4772f858de95d5940ec0c37663e8b0 -Author: dtucker@openbsd.org -Date: Thu Mar 9 07:11:05 2023 +0000 +commit da951b5e08c167acb5d6e2eec6f146502f5d6ed8 +Author: anton@openbsd.org +Date: Mon Oct 23 11:30:49 2023 +0000 - upstream: Re-split the merge of the reorder-hostkeys test. + upstream: Use private key that is allowed by sshd defaults in conch - In the kex_proposal_populate_entries change I merged the the check for - reordering hostkeys with the actual reordering, but kex_assemble_names - mutates options.hostkeyalgorithms which renders the check ineffective. - Put the check back where it was. Spotted and tested by jsg@, ok djm@ + interop tests. - OpenBSD-Commit-ID: a7469f25a738db5567395d1881e32479a7ffc9de - -commit 54ac4ab2b53ce9fcb66b8250dee91c070e4167ed -Author: djm@openbsd.org -Date: Thu Mar 9 06:58:26 2023 +0000 - - upstream: include destination constraints for smartcard keys too. + ok dtucker@ - Spotted by Luci Stanescu; ok deraadt@ markus@ - - OpenBSD-Commit-ID: add879fac6903a1cb1d1e42c4309e5359c3d870f + OpenBSD-Regress-ID: 3b7f65c8f409c328bcd4b704f60cb3d31746f045 -commit bfd1ad01d974a316b60622759ad17537fa2d92b4 +commit 1ca166dbb3c0ce632b98869cd955f69320aa6fe8 Author: Darren Tucker -Date: Thu Mar 9 18:24:54 2023 +1100 +Date: Fri Oct 20 20:43:00 2023 +1100 - Limit the number of PAM environment variables. + Install Dropbear for interop testing. + +commit f993bb58351c5cb71e61aede63805a34a6d4daea +Author: Darren Tucker +Date: Fri Oct 20 20:39:03 2023 +1100 + + Resync PuTTY and Conch path handling with upstream. - xcalloc has its own limits, but these are specific to PAM. From - Coverity CID 405198, ok djm@ + Now that configure finds these for us we can remove these -portable + specific changes. -commit a231414970e01a35f45a295d5f93698fa1249b28 +commit ff85becd5f5f06a76efa45d30fb204a3c5e5215c Author: Darren Tucker -Date: Thu Mar 9 18:19:44 2023 +1100 +Date: Fri Oct 20 20:35:46 2023 +1100 - Limit the number of PAM environment variables. + Have configure find PuTTY and Conch binaries. - From Coverity CID 405194, tweaks and ok djm@ + This will let us remove some -portable specific changes from + test-exec.sh. -commit 36c6c3eff5e4a669ff414b9daf85f919666e8e03 +commit c54a50359b9cecddbf3ffcdc26efcb3cd6071ec1 Author: dtucker@openbsd.org -Date: Wed Mar 8 06:21:32 2023 +0000 +Date: Fri Oct 20 07:37:07 2023 +0000 - upstream: Plug mem leak. Coverity CID 405196, ok djm@ + upstream: Allow overriding the locations of the Dropbear binaries - OpenBSD-Commit-ID: 175f09349387c292f626da68f65f334faaa085f2 + similar to what we do for the PuTTY ones. + + OpenBSD-Regress-ID: 7de0e00518fb0c8fdc5f243b7f82f523c936049c -commit dfb9b736e1ccf9e6b03eea21cd961f4fd0634c98 -Author: tb@openbsd.org -Date: Wed Mar 8 05:33:53 2023 +0000 +commit fbaa707d455a61d0aef8ae65e02a25bac5351e5c +Author: dtucker@openbsd.org +Date: Fri Oct 20 06:56:45 2023 +0000 - upstream: ssh-pkcs11: synchronize error messages with errors + upstream: Add interop test with Dropbear. - A handful of error messages contained incorrect function names or - otherwise inaccurate descriptions. Fix them to match reality. + Right now this is only dbclient not the Dropbear server since it won't + currently run as a ProxyCommand. - input/ok djm + OpenBSD-Regress-ID: 8cb898c414fcdb252ca6328896b0687acdaee496 + +commit c2003d0dbdcdb61ca336c3f90c5c2b4a09c8e73f +Author: Fabio Pedretti +Date: Mon Oct 16 11:59:53 2023 +0200 + + Update openssl-devel dependency in RPM spec. - OpenBSD-Commit-ID: 165a15db52f75b31e1804b043480c36af09f3411 + Since openssh 9.4p1, openssl >= 1.1.1 is required, so + build with --without-openssl elsewhere. + According to https://repology.org/project/openssl/versions + openssl 1.1.1 is available on fedora >= 29 and rhel >= 8. + Successfully build tested, installed and run on rhel 6 -commit 51875897b81b5c21b80c256a29597916edbde454 -Author: guenther@openbsd.org -Date: Wed Mar 8 04:43:12 2023 +0000 +commit 064e09cd632721c7e6889904e07767443ee23821 +Author: Fabio Pedretti +Date: Mon Oct 16 10:13:06 2023 +0200 - upstream: Delete obsolete /* ARGSUSED */ lint comments. + Remove reference of dropped sshd.pam.old file - ok miod@ millert@ + The file was removed in openssh 8.8 + +commit 62db354b696b378a164b6e478cb6b0171dcb0c3d +Author: dtucker@openbsd.org +Date: Mon Oct 16 08:40:00 2023 +0000 + + upstream: Move declaration of "len" into the block where it's used. - OpenBSD-Commit-ID: 7be168a570264d59e96a7d2d22e927d45fee0e4c + This lets us compile Portable with -Werror with when OpenSSL doesn't have + Ed25519 support. + + OpenBSD-Commit-ID: e02e4b4af351946562a7caee905da60eff16ba29 -commit a76085bda883c2104afb33ab0334eca190927362 +commit 6eee8c972d5901d10e80634a006b4e346b2c8c19 +Author: Damien Miller +Date: Fri Oct 13 15:15:05 2023 +1100 + + run t-extra regress tests + + This exposes the t-extra regress tests (including agent-pkcs11.sh) as + a new extra-tests target in the top level Makefile and runs them by + default. ok dtucker@ + +commit 637624dbbac13f2bc3c8ec5b15c9d627d07f2935 Author: Darren Tucker -Date: Wed Mar 8 17:25:37 2023 +1100 +Date: Thu Oct 12 22:01:23 2023 +1100 - Extra brackets to prevent warning. + Don't use make -j2. + + While we have 2 cores available on github runners, not using it means + that the most recent log message is the actual failure, rather than + having to search back through the log for it. -commit 147ae57d4dfa0508109f93b78a7d8b92819e1f83 +commit 971e0cfcfd52ef1d73cf5244074c306a60006e89 +Author: Darren Tucker +Date: Thu Oct 12 16:23:05 2023 +1100 + + Correct arg order for ED255519 AC_LINK_IFELSE test. + +commit c616e64688b2a0c1b4daad69b056099be998d121 Author: djm@openbsd.org -Date: Wed Mar 8 00:05:58 2023 +0000 +Date: Thu Oct 12 03:51:08 2023 +0000 - upstream: use RSA/SHA256 when testing usability of private key in - - agent; with/ok dtucker + upstream: typos and extra debug trace calls - OpenBSD-Commit-ID: fe1382e2fdf23fcae631308e72342bad56066a56 + OpenBSD-Regress-ID: 98a2a6b9333743274359e3c0f0e65cf919a591d1 -commit 27fd251bc906a763e70ce0f27c8abdf8bbd1e416 +commit c49a3fbf10162128c67c59562348de2041188974 Author: djm@openbsd.org -Date: Wed Mar 8 00:05:37 2023 +0000 +Date: Thu Oct 12 03:48:53 2023 +0000 - upstream: use RSA/SHA256 when testing usability of private key; + upstream: ensure logs are owned by correct user; feedback/ok - based on fix in bz3546 by Dmitry Belyavskiy; with/ok dtucker + dtucker@ - OpenBSD-Commit-ID: 0ef414cc363a832f9fab92a5da0234448bce2eba + OpenBSD-Regress-ID: c3297af8f07717f1d400a5d34529962f1a76b5a3 -commit eee9f3fc3d52ae7d2106929bb06b7f291fb0b81a +commit 5ec0ed79ac074c3437b25f6cba8b8cf21c8d4587 Author: djm@openbsd.org -Date: Tue Mar 7 21:47:42 2023 +0000 +Date: Thu Oct 12 03:36:32 2023 +0000 - upstream: refactor to be more readable top to bottom. Prompted by + upstream: 64 %-expansion keys ought to be enough for anybody; ok - Coverity CID 405048 which was a false-positive fd leak; ok dtucker@ + dtucker (we just hit the previous limit in some cases) - OpenBSD-Commit-ID: fc55ec2af622a017defb9b768bf26faefc792c00 + OpenBSD-Commit-ID: 84070f8001ec22ff5d669f836b62f206e08c5787 -commit 42a06b29a4c99272bf690f9b3be520b08b448dc5 -Author: Darren Tucker -Date: Tue Mar 7 18:34:41 2023 +1100 +commit f59a94e22e46db2c23eddeb871aa9e8d93ab0016 +Author: djm@openbsd.org +Date: Thu Oct 12 02:48:43 2023 +0000 - Add header changes missed in previous. + upstream: don't dereference NULL pointer when hashing jumphost + + OpenBSD-Commit-ID: 251c0263e1759a921341c7efe7f1d4c73e1c70f4 -commit 4710077096edff2e6926dd5b15bf586491d317db -Author: dtucker@openbsd.org -Date: Tue Mar 7 06:09:14 2023 +0000 +commit 281c79168edcc303abfd5bca983616eaa24c5f32 +Author: Damien Miller +Date: Thu Oct 12 13:20:01 2023 +1100 - upstream: Fix mem leak in environment setup. - - From jjelen at redhat.com via bz#2687, ok djm@ + Solaris: prefer PRIV_XPOLICY to PRIV_LIMIT - OpenBSD-Commit-ID: 9f9e4ba3cac003e6f81da3bcebd1b9ec43e7f353 + If the system support PRIV_XPOLICY and one is set, then don't + modify PRIV_LIMIT. bz2833, patch from Ron Jordan, ok dtucker@ -commit 03acc50d0ccb78fc91d1570de1cd0fdfea646028 -Author: dtucker@openbsd.org -Date: Mon Mar 6 12:15:47 2023 +0000 +commit 98fc34df837f3a3b79d2a111b96fe8a39adcab55 +Author: djm@openbsd.org +Date: Thu Oct 12 02:18:18 2023 +0000 - upstream: Unit test for kex_proposal_populate_entries. + upstream: add %j token that expands to the configured ProxyJump - OpenBSD-Regress-ID: bdb211d80d572a08bf14b49fe2a58b9ff265c006 + hostname (or the empty string if this option is not being used). bz3610, ok + dtucker + + OpenBSD-Commit-ID: ce9983f7efe6a178db90dc5c1698df025df5e339 -commit 3f9231c2e1f374ebb08016ba00ea97b47c0ed20b +commit 7f3180be8a85320b5d3221714b40c16e66881249 Author: djm@openbsd.org -Date: Tue Mar 7 05:37:26 2023 +0000 +Date: Thu Oct 12 02:15:53 2023 +0000 - upstream: fix memory leak in process_read() path; Spotted by James + upstream: release GSS OIDs only at end of authentication; bz2982, - Robinson in GHPR363; ok markus@ + ok dtucker@ - OpenBSD-Commit-ID: cdc2d98e6478b7e7f3a36976845adae3820429d8 + OpenBSD-Commit-ID: 0daa41e0525ae63cae4483519ecaa37ac485d94c -commit c5e6e890839ec520ab9301a92cba56303749dea2 +commit a612b93de5d86e955bfb6e24278f621118eea500 Author: djm@openbsd.org -Date: Tue Mar 7 01:30:52 2023 +0000 +Date: Thu Oct 12 02:12:53 2023 +0000 - upstream: correct size for array argument when changing + upstream: mask SIGINT/TERM/QUIT/HUP before checking quit_pending - UMAC_OUTPUT_LEN Coverity CID 291845; ok dtucker@ + and use ppoll() to unmask them in the mainloop. Avoids race condition between + signaling ssh to exit and polling. bz3531; ok dtucker - OpenBSD-Commit-ID: 2eb017d10705bb623d4418691f961c930eafaec0 + OpenBSD-Commit-ID: 5c14e1aabcddedb95cdf972283d9c0d5083229e7 -commit 9641753e0fd146204d57b2a4165f552a81afade4 -Author: dtucker@openbsd.org -Date: Mon Mar 6 12:14:48 2023 +0000 +commit 531b27a006116fe7aff325510aaa576f24844452 +Author: djm@openbsd.org +Date: Wed Oct 11 23:23:58 2023 +0000 - upstream: Refactor creation of KEX proposal. - - This adds kex_proposal_populate_entries (and corresponding free) which - populates the KEX proposal array with dynamically allocated strings. - This replaces the previous mix of static and dynamic that has been the - source of previous leaks and bugs. Remove unused compat functions. - With & ok djm@. + upstream: sync usage() with ssh.1; spotted by kn@ - OpenBSD-Commit-ID: f2f99da4aae2233cb18bf9c749320c5e040a9c7b + OpenBSD-Commit-ID: 191a85639477dcb5fa1616d270d93b7c8d5c1dfd -commit aa59d6a489fb20973fa461d0fdb1110db412947b -Author: dtucker@openbsd.org -Date: Sun Mar 5 09:24:35 2023 +0000 +commit 64f7ca881b19be754425dca60d1590d306c9d1d0 +Author: djm@openbsd.org +Date: Wed Oct 11 23:14:33 2023 +0000 - upstream: Fix mem and FILE leaks in moduli screening. + upstream: ssh -Q does not make sense with other command-line options, - If multiple -Ocheckpoint= options are passed, the earlier ones would - be overwritten and leaked. If we use an input file that wasn't stdin, - close that. From Coverity CIDs 291884 and 291894. + so give it its own line in the manpage - OpenBSD-Commit-ID: a4d9d15f572926f841788912e2b282485ad09e8b + OpenBSD-Commit-ID: 00a747f0655c12122bbb77c2796be0013c105361 -commit 23b8cb41767af99a1aac24589d1882d9c8c2c205 -Author: dtucker@openbsd.org -Date: Sun Mar 5 08:18:58 2023 +0000 +commit a752a6c0e1001f93696d7025f0c867f0376e2ecf +Author: djm@openbsd.org +Date: Wed Oct 11 22:42:26 2023 +0000 - upstream: Plug mem leak in moduli checkpoint option parsing. + upstream: add ChannelTimeout support to the client, mirroring the - From Coverity CID 291894. + same option in the server. ok markus@ - OpenBSD-Commit-ID: 9b1aba2d049741ae21c8dc4560a7e29ab17310f4 + OpenBSD-Commit-ID: 55630b26f390ac063980cfe7ad8c54b03284ef02 -commit fc7f8f2188d4a4fc8ba77eddbe863c7665666db5 -Author: dtucker@openbsd.org -Date: Sun Mar 5 05:34:09 2023 +0000 +commit 76e91e7238cdc5662bc818e2a48d466283840d23 +Author: djm@openbsd.org +Date: Wed Oct 11 22:41:05 2023 +0000 - upstream: Remove unused compat.h includes. + upstream: add support for reading ED25519 private keys in PEM PKCS8 - We've previously removed a lot of the really old compatibility code, - and with it went the need to include compat.h in most of the files that - have it. + format; ok markus@ tb@ - OpenBSD-Commit-ID: 5af8baa194be00a3092d17598e88a5b29f7ea2b4 + OpenBSD-Commit-ID: 01b85c91757e6b057e9b23b8a23f96415c3c7174 -commit 6c165c36246d8004c20e1df5cec4961a5ac422d6 -Author: dtucker@openbsd.org -Date: Sat Mar 4 03:22:59 2023 +0000 +commit fc77c8e352c0f44125425c05265e3a00c183d78a +Author: djm@openbsd.org +Date: Wed Oct 11 06:40:54 2023 +0000 - upstream: Use time_t for x11 timeout. + upstream: mention "none" is a valid argument to IdentityFile; bz3080 - Use time_t instead of u_int for remaining x11 timeout checks for 64bit - time_t safety. From Coverity CIDs 405197 and 405028, ok djm@ + OpenBSD-Commit-ID: 1b4fb590ef731099349a7d468b77f02b240ac926 + +commit c97520d23d1fe53d30725a2af25d2dddd6f2faff +Author: djm@openbsd.org +Date: Wed Oct 11 05:42:08 2023 +0000 + + upstream: in olde rcp/scp protocol mode, when rejecting a path from the - OpenBSD-Commit-ID: 356685bfa1fc3d81bd95722d3fc47101cc1a4972 + server as not matching the glob that the client sent, log (at debug level) + the received pathname as well as the list of possible expected paths expanded + from the glob. bz2966 + + OpenBSD-Commit-ID: 0bd8db8a595334ca86bca8f36e23fc0395315765 -commit 4a3918f51bd2d968387e7aa87e33b32c78077fb4 -Author: dtucker@openbsd.org -Date: Fri Mar 3 10:23:42 2023 +0000 +commit 208c2b719879805983398160791d6a1ef9c2c3fc +Author: djm@openbsd.org +Date: Wed Oct 11 04:46:29 2023 +0000 - upstream: Ensure ms_remain is always initialized + upstream: s/%.100s/%s/ in SSH- banner construction as there's no - similar to what we do in ssh_packet_write_wait. bz#2687, from jjelen - at redhat.com. + reason to limit its size: the version string bring included is a compile time + constant going into an allocated banner string. - OpenBSD-Commit-ID: a50e0541cf823f8d1c72f71ccde925d3dbe6dfac + OpenBSD-Commit-ID: 0ef73304b9bf3e534c60900cd84ab699f859ebcd -commit e44846a4487d2885ac7f2610be09b1e2bf52249b -Author: dtucker@openbsd.org -Date: Fri Mar 3 09:48:51 2023 +0000 +commit 0354790826b97c41bbd171a965574e159b58d83e +Author: tb@openbsd.org +Date: Tue Oct 10 06:49:54 2023 +0000 - upstream: Check for non-NULL before string + upstream: Garbage collect cipher_get_keyiv_len() - comparison. From jjelen at redhat.com via bz#2687. + This is a compat20 leftover, unused since 2017. - OpenBSD-Commit-ID: 0d9b2e0cac88a311b5766b1aef737082583c285f + ok djm + + OpenBSD-Commit-ID: 91fa5497c9dc6883064624ac27813a567883fdce -commit 1842d523fae63b862ce8e60725c9b606cddb86a6 +commit 8d29ee4115001a02641386ae394992c65ed279e0 Author: djm@openbsd.org -Date: Fri Mar 3 05:00:34 2023 +0000 +Date: Tue Oct 10 03:57:45 2023 +0000 - upstream: guard against getsockname(-1, ...) from Coverity CID + upstream: Reserve a range of "local extension" message numbers that - 291832 + OpenSSH promises not to use (comment change only) - OpenBSD-Commit-ID: e58d5227327917d189229b7f0b37d2780f360d5f + OpenBSD-Commit-ID: e61795b453d4892d2c99ce1039112c4a00250e03 -commit 78571a5fe9847d40d7f220c92b707574ae9ec4ce +commit 90b0d73d63a706e85f6431f05a62d2ce1b476472 Author: djm@openbsd.org -Date: Fri Mar 3 04:36:20 2023 +0000 +Date: Fri Oct 6 03:32:15 2023 +0000 - upstream: some options are not first-match-wins. Mention that there - - are exceptions at the start of the manpage and label some of them in the - option description. + upstream: typo in error message - OpenBSD-Commit-ID: 3b74728446fa6fc8742769eeb8c3674e233e84c4 + OpenBSD-Regress-ID: 6a8edf0dc39941298e3780b147b10c0a600b4fee -commit d1c1b3272e8895a96c4f5889bd6e07a8525bd9f1 +commit e84517f51532ec913d8fb01a8aab7307134774bb Author: djm@openbsd.org -Date: Fri Mar 3 04:34:49 2023 +0000 +Date: Fri Oct 6 03:25:14 2023 +0000 - upstream: actually print "channeltimeout none" in config dump mode; + upstream: Perform the softhsm2 setup as discrete steps rather than - spotted via Coverity CID 405022 + as a long shell pipeline. Makes it easier to figure out what has happened + when it breaks. - OpenBSD-Commit-ID: b074b52bf138b75f08264e8da15880b29c7a630f + OpenBSD-Regress-ID: b3f1292115fed65765d0a95414df16e27772d81c -commit 8bf61e95610b48192d4e1720cc15d9004617301d -Author: Darren Tucker -Date: Fri Mar 3 14:50:03 2023 +1100 +commit cb54becff4d776238e0e9072943ba0872260535d +Author: claudio@openbsd.org +Date: Sun Sep 24 08:14:13 2023 +0000 - Add Coverity badges. + upstream: REGRESS_FAIL_EARLY defaults to yes now. So no need to + + overload the value here anymore. OK tb@ bluhm@ + + OpenBSD-Regress-ID: f063330f1bebbcd373100afccebc91a965b14496 -commit 93291bd723959adf462b1df958106cf07a7734dd -Author: dtucker@openbsd.org -Date: Fri Mar 3 03:12:24 2023 +0000 +commit f01f5137ceba65baf34ceac5a298c12ac01b1fef +Author: jmc@openbsd.org +Date: Wed Oct 4 05:42:10 2023 +0000 - upstream: Check return values of dup2. Spotted by Coverity, ok djm@ + upstream: spelling fix; - OpenBSD-Commit-ID: 19fb1b53072826d00c67df677731d2f6c1dd602b + OpenBSD-Commit-ID: 493f95121567e5ab0d9dd1150f873b5535ca0195 -commit e37261dff33af23f37202cfce0848d36f5c1055c -Author: dtucker@openbsd.org -Date: Fri Mar 3 02:37:58 2023 +0000 +commit 80a2f64b8c1d27383cc83d182b73920d1e6a91f1 +Author: Damien Miller +Date: Wed Oct 4 15:34:10 2023 +1100 - upstream: Use time_t for x11_refuse_time timeout. We need - - SSH_TIME_T_MAX for this, so move from misc.c to misc.h so it's available. - Fixes a Coverity warning for 64bit time_t safety, ok djm@ - - OpenBSD-Commit-ID: c69c4c3152cdaab953706db4ccf4d5fd682f7d8d + crank version numbers -commit 32755a98c29114b13f4c9d47454bbb265b932ad7 -Author: dtucker@openbsd.org -Date: Fri Mar 3 02:34:29 2023 +0000 +commit f65f187b105d9b5c12fd750a211397d08c17c6d4 +Author: djm@openbsd.org +Date: Wed Oct 4 04:04:09 2023 +0000 - upstream: Check return value from fctnl and warn on failure. - - Spotted by Coverity, ok djm@ + upstream: openssh-9.5 - OpenBSD-Commit-ID: 2097c7db3cf657f1e3a6c5077041bacc63143cab + OpenBSD-Commit-ID: 5e0af680480bd3b6f5560cf840ad032d48fd6b16 -commit 5fc60e8246c36b8255f72a937ebe9787b39648c6 -Author: dtucker@openbsd.org -Date: Thu Mar 2 11:10:27 2023 +0000 +commit ffe27e54a4bb18d5d3bbd3f4cc93a41b8d94dfd2 +Author: djm@openbsd.org +Date: Wed Oct 4 04:03:50 2023 +0000 - upstream: Remove SUDO in proxy command wrapper. Anything that needs + upstream: add some cautionary text about % token expansion and - sudo is already run by it, and it breaks if root isn't in sudoers. + shell metacharacters; based on report from vinci AT protonmail.ch - OpenBSD-Regress-ID: 6cf22fda32a89c16915f31a6ed9bbdbef2a3bac9 + OpenBSD-Commit-ID: aa1450a54fcee2f153ef70368d90edb1e7019113 -commit 0d514659b23a257247491179cfbb53a6dd64e164 -Author: dtucker@openbsd.org -Date: Thu Mar 2 08:24:41 2023 +0000 +commit 60ec3d54fd1ebfe2dda75893fa1e870b8dffbb0d +Author: djm@openbsd.org +Date: Tue Oct 3 23:56:10 2023 +0000 - upstream: Fix breakage on dhgex test. - - This was due to the sshd logs being written to the wrong log file. - While there, make save_debug_logs less verbose, write the name of the - tarball to regress.log and use $SUDO to remove the old symlinks (which - shouldn't be needed, but won't hurt). Initial problem spotted by anton@. + upstream: fix link to agent draft; spotted by Jann Horn - OpenBSD-Regress-ID: 9c44fb9cd418e6ff31165e7a6c1f9f11a6d19f5b + OpenBSD-Commit-ID: ff5bda21a83ec013db683e282256a85201d2dc4b -commit 860201201d4ae655702807966901682cff30a171 -Author: dtucker@openbsd.org -Date: Thu Mar 2 08:14:52 2023 +0000 +commit 12e2d4b13f6f63ce2de13cbfcc9e4d0d4b4ab231 +Author: Damien Miller +Date: Wed Oct 4 10:54:04 2023 +1100 - upstream: Quote grep and log message better. + use portable provider allowlist path in manpage - OpenBSD-Regress-ID: 3823d9063127169736aa274b1784cb28e15b64d4 + spotted by Jann Horn -commit 03a03c6002525f5ad9c8fc874a5d5826a35d9858 -Author: dtucker@openbsd.org -Date: Thu Mar 2 06:41:56 2023 +0000 +commit 6c2c6ffde75df95fd838039850d3dd3d84956d87 +Author: deraadt@openbsd.org +Date: Tue Sep 19 20:37:07 2023 +0000 - upstream: Always call fclose on checkpoints. - - In the case of an fprintf failure we would not call fclose which would - leak the FILE pointer. While we're there, try to clean up the temp file - on failure. Spotted by Coverity, ok djm@ + upstream: typo; from Jim Spath - OpenBSD-Commit-ID: 73c7ccc5d4fcc235f54c6b20767a2815408525ef + OpenBSD-Commit-ID: 2f5fba917b5d4fcf93d9e0b0756c7f63189e228e -commit 13fe8f9785e6d90400ce548939a0b0ddc11fcb3c -Author: dtucker@openbsd.org -Date: Wed Mar 1 21:54:50 2023 +0000 +commit b6b49130a0089b297245ee39e769231d7c763014 +Author: djm@openbsd.org +Date: Sun Sep 10 23:12:32 2023 +0000 - upstream: Remove old log symlinks + upstream: rename remote_glob() -> sftp_glob() to match other API - before creating new ones. In -portable some platforms don't like - overwriting existing symlinks. + OpenBSD-Commit-ID: d9dfb3708d824ec02970a84d96cf5937e0887229 + +commit 21b79af6c8d2357c822c84cef3fbdb8001ed263b +Author: djm@openbsd.org +Date: Sun Sep 10 03:51:55 2023 +0000 + + upstream: typo in comment - OpenBSD-Regress-ID: 7e7ddc0beb73e945e1c4c58d51c8a125b518120f + OpenBSD-Commit-ID: 69285e0ce962a7c6b0ab5f17a293c60a0a360a18 -commit 131fcbcaffd1e3bcf5ab766ec497b5d768955310 +commit 41232d25532b4d2ef6c5db62efc0cf50a79d26ca Author: Darren Tucker -Date: Wed Mar 1 23:23:02 2023 +1100 +Date: Sun Sep 10 15:45:38 2023 +1000 - Adjust test jobs for new log directory. + Use zero-call-used-regs=used with Apple compilers. + + Apple's versions of clang have version numbers that do not match the + corresponding upstream clang versions. Unfortunately, they do still + have the clang-15 zero-call-used-regs=all bug, so for now use the value + that doesn't result in segfaults. We could allowlist future versions + that are known to work. bz#3584 (and probably also our github CI + failures). -commit a6f4ac8a2baf77e5361cfa017d0dc250d1409bec -Author: dtucker@openbsd.org -Date: Wed Mar 1 09:29:32 2023 +0000 +commit 90ccc5918ea505bf156c31148b6b59a1bf5d6dc6 +Author: djm@openbsd.org +Date: Sun Sep 10 03:25:53 2023 +0000 - upstream: Rework logging for the regression tests. - - Previously we would log to ssh.log and sshd.log, but that is insufficient - for tests that have more than one concurent ssh/sshd. - - Instead, we'll log to separate datestamped files in a $OBJ/log/ and - leave a symlink at the previous location pointing at the most recent - instance with an entry in regress.log showing which files were created - at each point. This should be sufficient to reconstruct what happened - even for tests that use multiple instances of each program. If the test - fails, tar up all of the logs for later analysis. + upstream: randomise keystroke obfuscation intervals and average - This will let us also capture the output from some of the other tools - which was previously sent to /dev/null although most of those will be - in future commits. + interval rate. ok dtucker@ - OpenBSD-Regress-ID: f802aa9e7fa51d1a01225c05fb0412d015c33e24 + OpenBSD-Commit-ID: 05f61d051ab418fcfc4857ff306e420037502382 -commit 8ead62ed5e86c7df597d8604f332f49cd1527b85 -Author: dtucker@openbsd.org -Date: Tue Feb 28 21:31:50 2023 +0000 +commit bd1b9e52f5fa94d87223c90905c5fdc1a7c32aa6 +Author: djm@openbsd.org +Date: Fri Sep 8 06:34:24 2023 +0000 - upstream: fatal out if allocating banner string fails to avoid + upstream: fix sizeof(*ptr) instead sizeof(ptr) in realloc (pointer here - potential null deref later in sscanf. Spotted by Coverity, ok deraadt@ + is char**, so harmless); spotted in CID 416964 - OpenBSD-Commit-ID: 74e8d228ac00552e96e9e968dfcccf8dd1f46ad5 + OpenBSD-Commit-ID: c61caa4a5a667ee20bb1042098861e6c72c69002 -commit 44ca56ba0b3f531f1d85730cc701097cd49e6868 -Author: dtucker@openbsd.org -Date: Tue Feb 28 08:45:24 2023 +0000 +commit c4f966482983e18601eec70a1563115de836616f +Author: djm@openbsd.org +Date: Fri Sep 8 06:10:57 2023 +0000 - upstream: Explicitly ignore return from fchmod + upstream: regress test recursive remote-remote directories copies where - similar to other calls to prevent warning. + the directory contains a symlink to another directory. - OpenBSD-Commit-ID: fdc5287dcee0860b5a493186414226c655b0eb0a + also remove errant `set -x` that snuck in at some point + + OpenBSD-Regress-ID: 1c94a48bdbd633ef2285954ee257725cd7bc456f -commit 803392933a3a6f09f834aa5f0c2aab06a3b382f4 -Author: dtucker@openbsd.org -Date: Mon Feb 27 22:12:40 2023 +0000 +commit 5e1dfe5014ebc194641678303e22ab3bba15f4e5 +Author: djm@openbsd.org +Date: Fri Sep 8 06:10:02 2023 +0000 - upstream: Plug mem leak on globbed ls error path. + upstream: fix recursive remote-remote copies of directories that - Spotted by Coverity, ok deraadt@ + contain symlinks to other directories (similar to bz3611) - OpenBSD-Commit-ID: de28476025db29820a9a2e56e98b964d8a02861c + OpenBSD-Commit-ID: 7e19d2ae09b4f941bf8eecc3955c9120171da37f -commit aa33b4d396abf47a2a45f982f28d054fb1dcb5c3 -Author: Darren Tucker -Date: Mon Feb 27 21:04:22 2023 +1100 +commit 7c0ce2bf98b303b6ad91493ee3247d96c18ba1f6 +Author: djm@openbsd.org +Date: Fri Sep 8 05:50:57 2023 +0000 - Cast time_t's in debug output to long long. + upstream: regress test for recursive copies of directories containing - Should fix Coverity warning about truncation of 64bit time_t. + symlinks to other directories. bz3611, ok dtucker@ + + OpenBSD-Regress-ID: eaa4c29cc5cddff4e72a16bcce14aeb1ecfc94b9 -commit b0fd60a9de62a03189ad57d0c07f0ac51dc00e95 -Author: Darren Tucker -Date: Mon Feb 27 17:28:59 2023 +1100 +commit 2de990142a83bf60ef694378b8598706bc654b08 +Author: djm@openbsd.org +Date: Fri Sep 8 05:56:13 2023 +0000 - Do shadow expiry calcs using "long long". + upstream: the sftp code was one of my first contributions to - Coverity flags these as potentially not 64bit time_t safe so use - long long for the calculations and debug output. ok djm@ + OpenSSH and it shows - the function names are terrible. + + Rename do_blah() to sftp_blah() to make them less so. + + Completely mechanical except for sftp_stat() and sftp_lstat() which + change from returning a pointer to a static variable (error-prone) to + taking a pointer to a caller-provided receiver. + + OpenBSD-Commit-ID: eb54d6a72d0bbba4d623e2175cf5cc4c75dc2ba4 -commit 01dbeb3084d714bbd001ff9d03b9de542e8cdf58 -Author: Damien Miller -Date: Mon Feb 27 17:07:52 2023 +1100 +commit 249d8bd0472b53e3a2a0e138b4c030a31e83346a +Author: djm@openbsd.org +Date: Fri Sep 8 05:50:12 2023 +0000 - avoid clash between for getopt's struct option + upstream: fix scp in SFTP mode recursive upload and download of - Since we don't use getopt_long() nothing outside the getopt() - implementation itself uses this structure, so move it into the - source to remove it from visibility and clashes with libc's + directories that contain symlinks to other directories. In scp mode, the + links would be followed, but in SFTP mode they were not. bz3611, ok dtucker@ - ok dtucker@ + OpenBSD-Commit-ID: 9760fda668eaa94a992250d7670dfbc62a45197c -commit eb88d07c43afe407094e7d609248d85a15e148ef -Author: Darren Tucker -Date: Sat Feb 25 14:45:41 2023 +1100 +commit 0e1f4401c466fa4fdaea81b6dadc8dd1fc4cf0af +Author: djm@openbsd.org +Date: Wed Sep 6 23:36:09 2023 +0000 - Revert explicit chmods on private keys. + upstream: regression test for override of subsystem in match blocks - This should no longer be needed on Cygwin test runners due to previous - commit. + OpenBSD-Regress-ID: 5f8135da3bfda71067084c048d717b0e8793e87c -commit 52b75db61030a6c8baf66b73644380cf3f58e26a -Author: Darren Tucker -Date: Sat Feb 25 14:43:28 2023 +1100 +commit 8a1450c62035e834d8a79a5d0d1c904236f9dcfe +Author: djm@openbsd.org +Date: Wed Sep 6 23:35:35 2023 +0000 - Remove extended ACLs from working dirs. + upstream: allow override of Sybsystem directives in sshd Match - This should allow umask to work as expected and prevent tests from - failing due to excessive permissions on private keys. + blocks + + OpenBSD-Commit-ID: 3911d18a826a2d2fe7e4519075cf3e57af439722 -commit 0c5d4c843df5605b043a758d69f9a611ef63c479 -Author: Darren Tucker -Date: Fri Feb 24 13:44:13 2023 +1100 +commit 6e52826e2a74d077147a82ead8d4fbd5b54f4e3b +Author: djm@openbsd.org +Date: Wed Sep 6 23:26:37 2023 +0000 - Explicitly set permissions on user and host keys. + upstream: allocate the subsystems array as necessary and remove the - On cygwin, the umask might not be sufficient. Should fix tests on - Github runners. + fixed limit of subsystems. Saves a few kb of memory in the server and makes + it more like the other options. + + OpenBSD-Commit-ID: e683dfca6bdcbc3cc339bb6c6517c0c4736a547f -commit 6c9fc9d7a9f7abf82c3294d74e6d4a25735862ce +commit e19069c9fac4c111d6496b19c7f7db43b4f07b4f Author: djm@openbsd.org -Date: Wed Feb 22 03:56:43 2023 +0000 +Date: Wed Sep 6 23:23:53 2023 +0000 - upstream: fix progressmeter corruption on wide displays; bz3534 + upstream: preserve quoting of Subsystem commands and arguments. - feedback/ok dtucker@ + This may change behaviour of exotic configurations, but the most common + subsystem configuration (sftp-server) is unlikely to be affected. - OpenBSD-Commit-ID: f4affee067cec7c182f3e0b307d758e0472762a3 + OpenBSD-Commit-ID: 8ffa296aeca981de5b0945242ce75aa6dee479bf -commit fe0bd3cde9665d364e5eedd2c2c2e60d4cdc3786 -Author: dtucker@openbsd.org -Date: Tue Feb 21 06:48:18 2023 +0000 +commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b +Author: djm@openbsd.org +Date: Wed Sep 6 23:21:36 2023 +0000 - upstream: fseek to end of known_hosts before writing to it. + upstream: downgrade duplicate Subsystem directives from being a - POSIX and ANSI C require that applications call fseek or similar between - read and writing to a RW file. OpenBSD doesn't enforce this, but some - (System V derived) platforms need this to prevent it from writing a - spurious extra byte (in this case, a newline). ok djm@ deraadt@ + fatal error to being a debug message to match behaviour with just about all + other directives. - OpenBSD-Commit-ID: 33e680dcd8110582a93a40a8491024e961f45137 + OpenBSD-Commit-ID: fc90ed2cc0c18d4eb8e33d2c5e98d25f282588ce -commit 357fb8ae14c07cd025eeed66e73de91bab569849 -Author: Darren Tucker -Date: Tue Feb 21 17:51:09 2023 +1100 +commit 1ee0a16e07b6f0847ff463d7b5221c4bf1876e25 +Author: djm@openbsd.org +Date: Wed Sep 6 23:18:15 2023 +0000 - Also run unit tests on AIX VMs. + upstream: handle cr+lf (instead of just cr) in sshsig signature - In the past these tests took too long, but these days it only adds - about 5 min to the run. + files + + OpenBSD-Commit-ID: 647460a212b916540016d066568816507375fd7f -commit 17781aaa5188ee1477f7779b280d105512e3dbed -Author: Darren Tucker -Date: Tue Feb 21 17:38:55 2023 +1100 +commit e1c284d60a928bcdd60bc575c6f9604663502770 +Author: job@openbsd.org +Date: Mon Sep 4 10:29:58 2023 +0000 - Wrap stdint.h inside ifdef. + upstream: Generate Ed25519 keys when invoked without arguments + + Ed25519 public keys are very convenient due to their small size. + OpenSSH has supported Ed25519 since version 6.5 (January 2014). + + OK djm@ markus@ sthen@ deraadt@ + + OpenBSD-Commit-ID: f498beaad19c8cdcc357381a60df4a9c69858b3f -commit ef798bad38505f7bf1b5fa5c0843dfc5a2b192b9 -Author: Mayank Sharma -Date: Mon Feb 20 17:37:15 2023 +0530 +commit 694150ad92765574ff82a18f4e86322bd3231e68 +Author: djm@openbsd.org +Date: Mon Sep 4 00:08:14 2023 +0000 - Add includes to ptimeout test. + upstream: trigger keystroke timing obfucation only if the channels - Fixes test failures on AIX due to type mismatches. + layer enqueud some data in the last poll() cycle; this avoids triggering the + obfuscatior for non-channels data like ClientAlive probes and also fixes a + related problem were the obfucations would be triggered on fully quiescent + connections. + + Based on / tested by naddy@ + + OpenBSD-Commit-ID: d98f32dc62d7663ff4660e4556e184032a0db123 -commit ab69dda05d5268454209f529fa80f477e60d846a -Author: Darren Tucker -Date: Mon Feb 20 18:24:39 2023 +1100 +commit b5fd97896b59a3a46245cf438cc8b16c795d9f74 +Author: djm@openbsd.org +Date: Mon Sep 4 00:04:02 2023 +0000 - Always use the openssl binary configure tells us. + upstream: avoid bogus "obfuscate_keystroke_timing: stopping ..." - This fixes tests on platforms that do not have the openssl tool - installed at all. + debug messages when keystroke timing obfuscation was never started; spotted + by naddy@ + + OpenBSD-Commit-ID: 5c270d35f7d2974db5c1646e9c64188f9393be31 -commit 2a7e3449908571af601a4c2d12ab140096442e47 -Author: dtucker@openbsd.org -Date: Fri Feb 17 04:22:50 2023 +0000 +commit ccf7d913db34e49b7a6db1b8331bd402004c840d +Author: djm@openbsd.org +Date: Mon Sep 4 00:01:46 2023 +0000 - upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The code + upstream: make channel_output_poll() return a flag indicating - to set this was removed in OpenSSH 7.7 when support for SSH implementations - dating back to before RFC standardization were removed. "burn it all" djm@ + whether channel data was enqueued. Will be used to improve keystroke timing + obfuscation. Problem spotted by / tested by naddy@ - OpenBSD-Commit-ID: 6330935fbe23dd00be79891505e06d1ffdac7cda + OpenBSD-Commit-ID: f9776c7b0065ba7c3bbe50431fd3b629f44314d0 -commit 0833ccf2c8b7ae08b296c06f17bd53e3ab94b0b0 -Author: dtucker@openbsd.org -Date: Fri Feb 17 03:06:18 2023 +0000 +commit 43254b326ac6e2131dbd750f9464dc62c14bd5a7 +Author: djm@openbsd.org +Date: Sun Sep 3 23:59:32 2023 +0000 - upstream: Remove now-unused compat bit SSH_BUG_BIGENDIANAES. This + upstream: set interactive mode for ControlPersist sessions if they - was previously set for OpenSSH 2.3 (released in 2000) but this check was - removed in OpenSSH 7.7 (2018). ok djm@ deraadt@ + originally requested a tty; enables keystroke timing obfuscation for most + ControlPersist sessions. Spotted by naddy@ - OpenBSD-Commit-ID: 326426ea328707fc9e83305291ab135c87f678af + OpenBSD-Commit-ID: 72783a26254202e2f3f41a2818a19956fe49a772 -commit c81c2bea6e828d52b62b448b4ffdd3c163177975 -Author: Damien Miller -Date: Fri Feb 17 10:12:40 2023 +1100 +commit ff3eda68ceb2e2bb8f48e3faceb96076c3e85c20 +Author: Darren Tucker +Date: Thu Aug 31 23:02:35 2023 +1000 - whitespace fixes + Set LLONG_MAX for C89 test. + + If we don't have LLONG_MAX, configure will figure out that it can get it + by setting -std=gnu99, at which point we won't be testing C89 any more. + To avoid this, feed it in via CFLAGS. -commit 500f90b39db5f0014e6b0c49ff1f45c994b69293 -Author: Damien Miller -Date: Fri Feb 17 10:02:08 2023 +1100 +commit f98031773db361424d59e3301aa92aacf423d920 +Author: djm@openbsd.org +Date: Tue Aug 29 02:50:10 2023 +0000 - whitespace at EOL + upstream: make PerSourceMaxStartups first-match-wins; ok dtucker@ + + OpenBSD-Commit-ID: dac0c24cb709e3c595b8b4f422a0355dc5a3b4e7 -commit 68350152406339170721c15e97afdf827a5e4001 -Author: dtucker@openbsd.org -Date: Thu Feb 16 10:10:00 2023 +0000 +commit cfa66857db90cd908de131e0041a50ffc17c7df8 +Author: djm@openbsd.org +Date: Mon Aug 28 09:52:09 2023 +0000 - upstream: Remove SSH_BUG_PASSWORDPAD compat bit - - since it's no longer used. ok markus@ + upstream: descriptive text shouldn't be under .Cm - OpenBSD-Commit-ID: b92c21f56fe4b7f9a54790d6a9650725c226820b + OpenBSD-Commit-ID: b1afaeb456a52bc8a58f4f9f8b2f9fa8f6bf651b -commit 537cccd804eaf65f32bdce037cc31db4e0ab0f44 -Author: dtucker@openbsd.org -Date: Thu Feb 16 07:55:15 2023 +0000 +commit 01dbf3d46651b7d6ddf5e45d233839bbfffaeaec +Author: djm@openbsd.org +Date: Mon Aug 28 09:48:11 2023 +0000 - upstream: Remove SSH_BUG_IGNOREMSG compat flag - - since it's only applicable to SSH1 and thus no longer used. ok markus@ - "kill it with fire" djm@ + upstream: limit artificial login delay to a reasonable maximum (5s) - OpenBSD-Commit-ID: ea13318b1937795d9db4790d3ce0a6ed01584dab - -commit 285cf6cd4b91a0a0ce33193c358c99085af33e43 -Author: jmc@openbsd.org -Date: Fri Feb 10 06:41:53 2023 +0000 - - upstream: space between macro and punctuation; sort usage(); + and don't delay at all for the "none" authentication mechanism. Patch by + Dmitry Belyavskiy in bz3602 with polish/ok dtucker@ - OpenBSD-Commit-ID: 6141610cfca037700730e41f868d1d9124958f8c + OpenBSD-Commit-ID: 85b364676dd84cf1de0e98fc2fbdcb1a844ce515 -commit d39a96f70f81878c77336ed35f5c648c1804b71a +commit 528da5b9d7c5da01ed7a73ff21c722e1b5326006 Author: jmc@openbsd.org -Date: Fri Feb 10 06:40:48 2023 +0000 +Date: Mon Aug 28 05:32:28 2023 +0000 - upstream: space between macro and punctuation; + upstream: add spacing for punctuation when macro args; - OpenBSD-Commit-ID: abc95e550be9e6d9a7ff64b65c104c7be21ab19e + OpenBSD-Commit-ID: e80343c16ce0420b2aec98701527cf90371bd0db -commit 16e82bf53fc34e43e3b948d43b68d5b27a7335e6 -Author: jmc@openbsd.org -Date: Fri Feb 10 06:39:27 2023 +0000 +commit 3867361ca691d0956ef7d5fb8181cf554a91d84a +Author: djm@openbsd.org +Date: Mon Aug 28 04:06:52 2023 +0000 - upstream: sort SYNOPSIS; + upstream: explicit long long type in timing calculations (doesn't - OpenBSD-Commit-ID: dacd9da33277d5669a51213d880632599c890c1e - -commit d9685121ff6d57b8797411f3cb123884a4b96e30 -Author: Darren Tucker -Date: Sat Feb 11 12:32:19 2023 +1100 - - Improve seccomp compat on older systems. + matter, since the range is pre-clamped) - Check if flags to mmap and madvise are defined before using them. - Should fix problems building on older Linux systems that don't have - these. bz#3537, with & ok djm@. + OpenBSD-Commit-ID: f786ed902d04a5b8ecc581d068fea1a79aa772de -commit 6180b0fa4f7996687678702806257e661fd5931e +commit 7603ba71264e7fa938325c37eca993e2fa61272f Author: djm@openbsd.org -Date: Fri Feb 10 05:06:03 2023 +0000 +Date: Mon Aug 28 03:31:16 2023 +0000 - upstream: test -Ohashalg=... and that the default output contains both + upstream: Add keystroke timing obfuscation to the client. - specified hash algorithms; prompted by dtucker@ + This attempts to hide inter-keystroke timings by sending interactive + traffic at fixed intervals (default: every 20ms) when there is only a + small amount of data being sent. It also sends fake "chaff" keystrokes + for a random interval after the last real keystroke. These are + controlled by a new ssh_config ObscureKeystrokeTiming keyword/ - OpenBSD-Regress-ID: 26f309208c8d8b8fa9c5f419767b85f1e9b22f51 + feedback/ok markus@ + + OpenBSD-Commit-ID: 02231ddd4f442212820976068c34a36e3c1b15be -commit d651f5c9fe37e61491eee46c49ba9fa03dbc0e6a +commit dce6d80d2ed3cad2c516082682d5f6ca877ef714 Author: djm@openbsd.org -Date: Fri Feb 10 04:56:30 2023 +0000 +Date: Mon Aug 28 03:28:43 2023 +0000 - upstream: let ssh-keygen and ssh-keyscan accept + upstream: Introduce a transport-level ping facility - -Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm - selection. bz3493 ok dtucker@ + This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG + to implement a ping capability. These messages use numbers in the "local + extensions" number space and are advertised using a "ping@openssh.com" + ext-info message with a string version number of "0". - OpenBSD-Commit-ID: e6e07fe21318a873bd877f333e189eb963a11b3d + ok markus@ + + OpenBSD-Commit-ID: b6b3c4cb2084c62f85a8dc67cf74954015eb547f -commit 18938d11a90b74d63c20b2d3c965d5bd64786ab1 -Author: djm@openbsd.org -Date: Fri Feb 10 04:47:19 2023 +0000 +commit d2d247938b38b928f8a6e1a47a330c5584d3a358 +Author: tobhe@openbsd.org +Date: Mon Aug 21 21:16:18 2023 +0000 - upstream: add a `sshd -G` option that parses and prints the + upstream: Log errors in kex_exchange_identification() with level - effective configuration without attempting to load private keys and perform - other checks. This allows usage of the option before keys have been - generated. + verbose instead of error to reduce preauth log spam. All of those get logged + with a more generic error message by sshpkt_fatal(). - bz3460 feedback/ok dtucker@ + feedback from sthen@ + ok djm@ - OpenBSD-Commit-ID: 774504f629023fc25a559ab1d95401adb3a7fb29 + OpenBSD-Commit-ID: bd47dab4695b134a44c379f0e9a39eed33047809 -commit df7d3dbf7194db8e97730ee0425d4d9d7bdb8b10 +commit 9d7193a8359639801193ad661a59d1ae4dc3d302 Author: djm@openbsd.org -Date: Fri Feb 10 04:40:28 2023 +0000 +Date: Mon Aug 21 04:59:54 2023 +0000 - upstream: make `ssh -Q CASignatureAlgorithms` work as the manpage says + upstream: correct math for ClientAliveInterval that caused the - it should bz3532 + probes to be sent less frequently than configured; from Dawid Majchrzak - OpenBSD-Commit-ID: 0ddb17b3fcbd99bfb5baea4ac5e449620cbd3adc + OpenBSD-Commit-ID: 641153e7c05117436ddfc58267aa267ca8b80038 -commit d3b8d4198b6595f23b5859d43dc8fc701f97429b +commit 3c6ab63b383b0b7630da175941e01de9db32a256 Author: Darren Tucker -Date: Fri Feb 10 14:26:44 2023 +1100 - - Add CentOS 7 test targets. - -commit 22efb01e355bba4755b730ed417f91c081445bfc -Author: dtucker@openbsd.org -Date: Thu Feb 9 09:55:33 2023 +0000 +Date: Fri Aug 25 14:48:02 2023 +1000 - upstream: Test adding terminating newline to known_hosts. + Include Portable version in sshd version string. - OpenBSD-Regress-ID: 5fc3010ac450195b3fbdeb68e875564968800365 + bz#3608, ok djm@ -commit caec6da1a583ed8c32c6ad3b81bbcaab46ac8b61 -Author: dtucker@openbsd.org -Date: Wed Feb 8 08:06:03 2023 +0000 +commit 17fa6cd10a26e193bb6f65d21264d2fe553bcd87 +Author: Darren Tucker +Date: Mon Aug 21 19:47:58 2023 +1000 - upstream: ssh-agent doesn't actually take -v, - - so the recently-added ones will result in the test not cleaning up - after itself. Patch from cjwatson at debian.org vi bz#3536. + obsd-arm64 host is real hardware... - OpenBSD-Regress-ID: 1fc8283568f5bf2f918517c2c1e778072cf61b1a + so put in the correct config location. -commit 3c379c9a849a635cc7f05cbe49fe473ccf469ef9 -Author: dtucker@openbsd.org -Date: Thu Feb 9 09:54:11 2023 +0000 +commit 598ca75c85acaaacee5ef954251e489cc20d7be9 +Author: Darren Tucker +Date: Mon Aug 21 18:38:36 2023 +1000 - upstream: Ensure that there is a terminating newline when adding a new - - entry to known_hosts. bz#3529, with git+openssh at limpsquid.nl, ok deraadt@ - markus@ - - OpenBSD-Commit-ID: fa8d90698da1886570512b96f051e266eac105e0 + Add OpenBSD ARM64 test host. -commit 95b6bbd2553547260b324b39d602061c88b774bc +commit 1acac79bfbe207e8db639e8043524962037c8feb Author: Darren Tucker -Date: Tue Feb 7 08:43:47 2023 +1100 +Date: Mon Aug 21 18:05:26 2023 +1000 - Replace 9.1 with 9.2 on CI status page. + Add test for zlib development branch. -commit 195313dfe10a23c82e9d56d5fdd2f59beee1bdcf -Author: Damien Miller -Date: Fri Feb 3 16:33:09 2023 +1100 +commit 84efebf352fc700e9040c8065707c63caedd36a3 +Author: djm@openbsd.org +Date: Mon Aug 21 04:36:46 2023 +0000 - harden Linux seccomp sandbox - - Linux mmap(2) and madvise(2) syscalls support quite a number of funky - flags that we don't expect that sshd/libc will ever need. We can - exclude this kernel attack surface by filtering the mmap(2) flags - and the madvise(2) advice arguments. - - Similarly, the sandboxed process in sshd is a single-threaded program - that does not use shared memory for synchronisation or communication. - Therefore, there should be no reason for the advanced priority - inheritance futex(2) operations to be necessary. These can also be - excluded. - - Motivated by Jann Horn pointing out that there have been kernel bugs - in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and - CVE-2022-42703. + upstream: want stdlib.h for free(3) - Feedback Jann Horn, ok dtucker@ - -commit 6dfb65de949cdd0a5d198edee9a118f265924f33 -Author: Damien Miller -Date: Thu Feb 2 23:21:54 2023 +1100 - - crank versions in RPM specs + OpenBSD-Commit-ID: 743af3c6e3ce5e6cecd051668f0327a01f44af29 -commit d07cfb11a0ca574eb68a3931d8c46fbe862a2021 -Author: Damien Miller -Date: Thu Feb 2 23:21:45 2023 +1100 +commit cb4ed12ffc332d1f72d054ed92655b5f1c38f621 +Author: Darren Tucker +Date: Sat Aug 19 07:39:08 2023 +1000 - update version in README + Fix zlib version check for 1.3 and future version. + + bz#3604. -commit 9fe207565b4ab0fe5d1ac5bb85e39188d96fb214 -Author: Damien Miller -Date: Thu Feb 2 23:17:49 2023 +1100 +commit 25b75e21f16bccdaa472ea1889b293c9bd51a87b +Author: Darren Tucker +Date: Mon Aug 14 11:10:08 2023 +1000 - adapt compat_kex_proposal() test to portable + Add 9.4 branch to CI status page. -commit 903c556b938fff2d7bff8da2cc460254430963c5 +commit 803e22eabd3ba75485eedd8b7b44d6ace79f2052 Author: djm@openbsd.org -Date: Thu Feb 2 12:12:52 2023 +0000 - - upstream: test compat_kex_proposal(); by dtucker@ - - OpenBSD-Regress-ID: 0e404ee264db546f9fdbf53390689ab5f8d38bf2 - -commit 405fba71962dec8409c0c962408e09049e5624b5 -Author: dtucker@openbsd.org -Date: Thu Jan 19 07:53:45 2023 +0000 +Date: Fri Aug 18 01:37:41 2023 +0000 - upstream: Check if we can copy sshd or need to use sudo to do so + upstream: fix regression in OpenSSH 9.4 (mux.c r1.99) that caused - during reexec test. Skip test if neither can work. Patch from anton@, tweaks - from me. + multiplexed sessions to ignore SIGINT under some circumstances. Reported by / + feedback naddy@, ok dtucker@ - OpenBSD-Regress-ID: 731b96ae74d02d5744e1f1a8e51d09877ffd9b6d + OpenBSD-Commit-ID: 4d5c6c894664f50149153fd4764f21f43e7d7e5a -commit b2a2a8f69fd7737ea17dc044353c514f2f962f35 +commit e706bca324a70f68dadfd0ec69edfdd486eed23a Author: djm@openbsd.org -Date: Thu Feb 2 12:10:22 2023 +0000 +Date: Wed Aug 16 16:14:11 2023 +0000 - upstream: openssh-9.2 + upstream: defence-in-depth MaxAuthTries check in monitor; ok markus - OpenBSD-Commit-ID: f7389f32413c74d6e2055f05cf65e7082de03923 + OpenBSD-Commit-ID: 65a4225dc708e2dae71315adf93677edace46c21 -commit 12da7823336434a403f25c7cc0c2c6aed0737a35 +commit d1ab7eb90474df656d5e9935bae6df0bd000d343 Author: djm@openbsd.org -Date: Thu Feb 2 12:10:05 2023 +0000 +Date: Mon Aug 14 03:37:00 2023 +0000 - upstream: fix double-free caused by compat_kex_proposal(); bz3522 - - by dtucker@, ok me + upstream: add message number of SSH2_MSG_NEWCOMPRESS defined in RFC8308 - OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80 + OpenBSD-Commit-ID: 6c984171c96ed67effd7b5092f3d3975d55d6028 -commit 79efd95ab5ff99f4cb3a955e2d713b3f54fb807e +commit fa8da52934cb7dff6f660a143276bdb28bb9bbe1 Author: Darren Tucker -Date: Wed Feb 1 17:17:26 2023 +1100 +Date: Sun Aug 13 15:01:27 2023 +1000 - Skip connection-timeout test on minix3. - - Minix 3's Unix domain sockets don't seem to work the way we expect, so - skip connection-timeout test on that platform. While there, group - together all similarly skipped tests and explicitly comment. + Add obsd72 and obsd73 test targets. -commit 6b508c4e039619842bcf5a16f8a6b08dd6bec44a -Author: Damien Miller -Date: Wed Feb 1 12:12:05 2023 +1100 +commit f9f18006678d2eac8b0c5a5dddf17ab7c50d1e9f +Author: djm@openbsd.org +Date: Thu Aug 10 23:05:48 2023 +0000 - fix libfido2 detection without pkg-config + upstream: better debug logging of sessions' exit status - Place libfido2 before additional libraries (that it may depend upon) - and not after. bz3530 from James Zhang; ok dtucker@ + OpenBSD-Commit-ID: 82237567fcd4098797cbdd17efa6ade08e1a36b0 -commit 358e300fed5e6def233a2c06326e51e20ebed621 -Author: deraadt@openbsd.org -Date: Wed Jan 18 20:56:36 2023 +0000 +commit a8c57bcb077f0cfdffcf9f23866bf73bb93e185c +Author: naddy@openbsd.org +Date: Thu Aug 10 14:37:32 2023 +0000 - upstream: delete useless dependency + upstream: drop a wayward comma, ok jmc@ - OpenBSD-Commit-ID: e1dc11143f83082e3154d6094f9136d0dc2637ad + OpenBSD-Commit-ID: 5c11fbb9592a29b37bbf36f66df50db9d38182c6 -commit a4cb9be1b021b511e281ee55c356f964487d9e82 -Author: deraadt@openbsd.org -Date: Wed Jan 18 20:43:15 2023 +0000 +commit e962f9b318a238db1becc53c2bf79dd3a49095b4 +Author: Damien Miller +Date: Thu Aug 10 11:10:22 2023 +1000 - upstream: Create and install sshd random relink kit. - - ../Makefile.inc and Makfile are concatenated for reuse, which hopefully won't - be too fragile, we'll see if we need a different approach. The resulting sshd - binary is tested with the new sshd -V option before installation. As the - binary layout is now semi-unknown (meaning relative, fixed, and gadget - offsets are not precisely known), change the filesystem permissions to 511 to - prevent what I call "logged in BROP". I have ideas for improving this further - but this is a first step ok djm - - OpenBSD-Commit-ID: 1e0a2692b7e20b126dda60bf04999d1d30d959d8 + depend -commit bc7de6f91a9a0ae2f148a9d31a4027d441a51999 -Author: jmc@openbsd.org -Date: Wed Jan 18 06:55:32 2023 +0000 +commit 0fcb60bf83130dfa428bc4422b3a3ac20fb528af +Author: Damien Miller +Date: Thu Aug 10 11:05:42 2023 +1000 - upstream: tweak previous; ok djm + update versions in RPM specs + +commit d0cee4298491314f09afa1c4383a66d913150b26 +Author: Damien Miller +Date: Thu Aug 10 11:05:14 2023 +1000 + + update version in README + +commit 78b4dc6684f4d35943b46b24ee645edfdb9974f5 +Author: djm@openbsd.org +Date: Thu Aug 10 01:01:07 2023 +0000 + + upstream: openssh-9.4 - OpenBSD-Commit-ID: df71ce4180c58202dfdc1d92626cfe900b91b7c3 + OpenBSD-Commit-ID: 71fc1e01a4c4ea061b252bd399cda7be757e6e35 -commit a20b7e999773e6333c8aa9b0a7fa41966e63b037 +commit 58ca4f0aa8c4306ac0a629c9a85fb1efaf4ff092 Author: Darren Tucker -Date: Tue Jan 31 19:35:44 2023 +1100 +Date: Thu Aug 10 11:30:24 2023 +1000 - Skip connection-timeout test under Valgrind. + Only include unistd.h once. + +commit 3961ed02dc578517a9d2535128cff5c3a5460d28 +Author: Damien Miller +Date: Thu Aug 10 09:08:49 2023 +1000 + + wrap poll.h include in HAVE_POLL_H + +commit e535fbe2af893046c28adfcd787c1fdbae36a24a +Author: dtucker@openbsd.org +Date: Fri Aug 4 06:32:40 2023 +0000 + + upstream: Apply ConnectTimeout to multiplexing local socket - Valgrind slows things down so much that the timeout test fails. Skip - this test until we figure out if we can make it work. + connections. If the multiplex socket exists but the connection times out, + ssh will fall back to a direct connection the same way it would if the socket + did not exist at all. ok djm@ + + OpenBSD-Commit-ID: 2fbe1a36d4a24b98531b2d298a6557c8285dc1b4 -commit c3ffb54b4fc5e608206037921db6ccbc2f5ab25f +commit 9d92e7b24848fcc605945f7c2e3460c7c31832ce Author: Darren Tucker -Date: Wed Jan 25 21:58:40 2023 +1100 +Date: Thu Aug 3 19:35:33 2023 +1000 - Skip connection-timeout when missing FD passing. + Fix RNG seeding for OpenSSL w/out self seeding. - This tests uses multiplexing which uses file descriptor passing, so - skip it if we don't have that. Fixes test failures on Cygwin. + When sshd is built with an OpenSSL that does not self-seed, it would + fail in the preauth privsep process while handling a new connection. + Sanity checked by djm@ -commit 35253af01d8c0ab444c8377402121816e71c71f5 +commit f70010d9b0b3e7e95de8aa0b961e1d74362cfb5d Author: djm@openbsd.org -Date: Wed Jan 18 02:00:10 2023 +0000 +Date: Wed Aug 2 23:04:38 2023 +0000 - upstream: when restoring non-blocking mode to stdio fds, restore - - exactly the flags that ssh started with and don't just clobber them with - zero, as this could also remove the append flag from the set; + upstream: CheckHostIP has defaulted to 'no' for a while; make the - bz3523; ok dtucker@ + commented- out config option match. From Ed Maste - OpenBSD-Commit-ID: 1336b03e881db7564a4b66014eb24c5230e9a0c0 + OpenBSD-Commit-ID: e66e934c45a9077cb1d51fc4f8d3df4505db58d9 -commit 7d17ea151c0b2519f023bd9cc7f141128833ac47 -Author: millert@openbsd.org -Date: Wed Jan 18 01:50:21 2023 +0000 +commit c88a8788f9865d02b986d00405b9f0be65ad0b5a +Author: dtucker@openbsd.org +Date: Tue Aug 1 08:15:04 2023 +0000 - upstream: Add a -V (version) option to sshd like the ssh client + upstream: remove unnecessary if statement. - has. OK markus@ deraadt@ + github PR#422 from eyalasulin999, ok djm@ - OpenBSD-Commit-ID: abe990ec3e636fb040132aab8cbbede98f0c413e + OpenBSD-Commit-ID: 2b6b0dde4407e039f58f86c8d2ff584a8205ea55 -commit 62360feb7f08f2a4c6fc36f3b3449309203c42c9 -Author: millert@openbsd.org -Date: Tue Jan 17 18:52:44 2023 +0000 +commit 77b8b865cd5a8c79a47605c0c5b2bacf4692c4d5 +Author: jmc@openbsd.org +Date: Fri Jul 28 05:42:36 2023 +0000 - upstream: For "ssh -V" always exit 0, there is no need to check opt + upstream: %C is a callable macro in mdoc(7) - again. This was missed when the fallthrough in the switch case above it was - removed. OK deraadt@ + so, as we do for %D, escape it; - OpenBSD-Commit-ID: 5583e5d8f6d62a8a4215cfa95a69932f344c8120 + OpenBSD-Commit-ID: 538cfcddbbb59dc3a8739604319491dcb8e0c0c9 -commit 12492c0abf1eb415d08a897cc1d8b9e789888230 +commit e0f91aa9c2fbfc951e9ced7e1305455fc614d3f2 Author: djm@openbsd.org -Date: Tue Jan 17 10:15:10 2023 +0000 +Date: Fri Jul 28 05:33:15 2023 +0000 - upstream: also check that an active session inhibits + upstream: don't need to start a command here; use ssh -N instead. - UnusedConnectionTimeout idea markus@ + Fixes failure on cygwin spotted by Darren - OpenBSD-Regress-ID: 55c0fb61f3bf9e092b0a53f9041d3d2012f14003 + OpenBSD-Regress-ID: ff678a8cc69160a3b862733d935ec4a383f93cfb -commit cef2593c33ac46a58238ff998818754eabdf64ff +commit f446a44f30bc680e0d026a4204844b02646c1c2d Author: djm@openbsd.org -Date: Tue Jan 17 10:02:34 2023 +0000 +Date: Wed May 17 05:52:01 2023 +0000 - upstream: regression test for UnusedConnectionTimeout + upstream: add LTESTS_FROM variable to allow skipping of tests up to - OpenBSD-Regress-ID: 7f29001374a68e71e5e078f69e4520cf4bcca084 + a specific point. e.g. "make LTESTS_FROM=t-sftp" will only run the sftp.sh + test and subsequent ones. ok dtucker@ + + OpenBSD-Regress-ID: 07f653de731def074b29293db946042706fcead3 -commit aff9493a89c71d6a080419b49ac64eead9730491 +commit 8eb8899d612440a9b608bee7f916081d3d0b7812 Author: djm@openbsd.org -Date: Mon Jan 16 04:11:29 2023 +0000 +Date: Fri May 12 06:37:42 2023 +0000 - upstream: unbreak test: cannot access shell positional parameters - - past $9 without wrapping the position in braces (i.e. need ${10}, etc.) + upstream: test ChrootDirectory in Match block - OpenBSD-Regress-ID: 3750ec98d5d409ce6a93406fedde6f220d2ea2ac + OpenBSD-Regress-ID: a6150262f39065939f025e546af2a346ffe674c1 -commit 0293c19807f83141cdf33b443154459f9ee471f6 +commit e43f43d3f19516222e9a143468ea0dc1b3ab67b6 Author: djm@openbsd.org -Date: Tue Jan 17 09:44:48 2023 +0000 +Date: Fri May 12 06:36:27 2023 +0000 - upstream: Add a sshd_config UnusedConnectionTimeout option to terminate + upstream: better error messages - client connections that have no open channels for some length of time. This - complements the recently-added ChannelTimeout option that terminates inactive - channels after a timeout. + OpenBSD-Regress-ID: 55e4186604e80259496d841e690ea2090981bc7a + +commit 6958f00acf3b9e0b3730f7287e69996bcf3ceda4 +Author: djm@openbsd.org +Date: Thu Jul 27 22:26:49 2023 +0000 + + upstream: don't incorrectly truncate logged strings retrieved from - ok markus@ + PKCS#11 modules; based on GHPR406 by Jakub Jelen; ok markus - OpenBSD-Commit-ID: ca983be74c0350364c11f8ba3bd692f6f24f5da9 + OpenBSD-Commit-ID: 7ed1082f23a13b38c373008f856fd301d50012f9 -commit 8ec2e3123802d2beeca06c1644b0b647f6d36dab +commit d1ffde6b55170cd4b9a72bfd9a3f17508e6cf714 Author: djm@openbsd.org -Date: Sun Jan 15 23:35:10 2023 +0000 +Date: Thu Jul 27 22:25:17 2023 +0000 - upstream: adapt to ed25519 changes in src/usr.bin/ssh + upstream: make sshd_config AuthorizedPrincipalsCommand and - OpenBSD-Regress-ID: 4b3e7ba7ee486ae8a0b4790f8112eded2bb7dcd5 + AuthorizedKeysCommand accept the %D (routing domain) and a new %C (connection + address/port 4-tuple) as expansion sequences; ok markus + + OpenBSD-Commit-ID: ee9a48bf1a74c4ace71b69de69cfdaa2a7388565 -commit 9fbbfeca1ce4c7ec0001c827bbf4189a3ba0964b +commit 999a2886ca1844a7a74b905e5f2c8c701f9838cd Author: djm@openbsd.org -Date: Sun Jan 15 23:05:32 2023 +0000 +Date: Thu Jul 27 22:23:05 2023 +0000 - upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOP - - (20221122) and change the import approach to the same one we use for - Streamlined NTRUPrime: use a shell script to extract the bits we need from - SUPERCOP, make some minor adjustments and squish them all into a single file. + upstream: increase default KDF work-factor for OpenSSH format - ok tb@ tobhe@ + private keys from 16 to 24; { feedback ok } x { deraadt markus } - OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b + OpenBSD-Commit-ID: a3afb1383f8ff0a49613d449f02395d9e8d4a9ec -commit 6283f4bd83eee714d0f5fc55802eff836b06fea8 +commit 0fa803a1dd1c7b546c166000e23a869cf6c4ec10 Author: Darren Tucker -Date: Sat Jan 14 22:02:44 2023 +1100 +Date: Thu Jul 27 02:25:09 2023 +1000 - Allow writev is seccomp sandbox. + Prefer OpenSSL's SHA256 in sk-dummy.so - This seems to be used by recent glibcs at least in some configurations. - From bz#3512, ok djm@ + Previously sk-dummy.so used libc's (or compat's) SHA256 since it may be + built without OpenSSL. In many cases, however, including both libc's + and OpenSSL's headers together caused conflicting definitions. + + We tried working around this (on OpenSSL <1.1 you could define + OPENSSL_NO_SHA, NetBSD had USE_LIBC_SHA2, various #define hacks) with + varying levels of success. Since OpenSSL >=1.1 removed OPENSSL_NO_SHA + and including most OpenSSL headers would bring sha.h in, even if it + wasn't used directly this was a constant hassle. + + Admit defeat and use OpenSSL's SHA256 unless we aren't using OpenSSL at + all. ok djm@ -commit 923c3f437f439cfca238fba37e97a7041782f615 -Author: dtucker@openbsd.org -Date: Sat Jan 14 10:05:54 2023 +0000 +commit 36cdb5dbf55c99c0faad06066f56a7c341258c1f +Author: Darren Tucker +Date: Thu Jul 27 10:29:44 2023 +1000 - upstream: Shell syntax fix. From ren mingshuai vi github PR#369. - - OpenBSD-Regress-ID: 6696b2eeefe128099fc3d7ea9f23252cc35156f9 + Retire dfly58 test VM. Add dfly64. -commit 4d87a00f704e0365e11c3c38b170c1275ec461fc -Author: dtucker@openbsd.org -Date: Sat Jan 14 09:57:08 2023 +0000 +commit 2d34205dab08ede9b0676efa57647fc49e6decbe +Author: djm@openbsd.org +Date: Wed Jul 26 23:06:00 2023 +0000 - upstream: Instead of skipping the all-tokens test if we don't have + upstream: make ssh -f (fork after authentication) work properly in - OpenSSL (since we use it to compute the hash), put the hash at the end and - just omit it if we don't have it. Prompted by bz#3521. + multiplexed cases (inc. ControlPersist). bz3589 bz3589 Based on patches by + Peter Chubb; ok dtucker@ - OpenBSD-Regress-ID: c79ecba64250ed3b6417294b6c965e6b12ca5eea + OpenBSD-Commit-ID: a7a2976a54b93e6767dc846b85647e6ec26969ac -commit b05406d6f93b8c8ec11ec8b27e7c76cc7a5a55fb -Author: jmc@openbsd.org -Date: Fri Jan 13 07:13:40 2023 +0000 +commit 076aeda86a7ee9be8fd2f0181ec7b9729a6ceb37 +Author: naddy@openbsd.org +Date: Sun Jul 23 20:04:45 2023 +0000 - upstream: fix double phrase in previous; + upstream: man page typos; ok jmc@ - OpenBSD-Commit-ID: 671e6c8dc5e9230518b2bbfa143daaa88adc66c2 + OpenBSD-Commit-ID: e6ddfef94b0eb867ad88abe07cedc8ed581c07f0 -commit 40564812b659c530eb1f4b62d09e85612aef3107 -Author: dtucker@openbsd.org -Date: Fri Jan 13 03:16:29 2023 +0000 +commit 135e7d5fe31f700e6dfc61ce914970c5ee7175ba +Author: jmc@openbsd.org +Date: Thu Jul 20 05:43:39 2023 +0000 - upstream: Document "UserKnownHostsFile none". ok djm@ + upstream: tweak the allow-remote-pkcs11 text; - OpenBSD-Commit-ID: f695742d39e34ecdcc3c861c3739a84648a4bce5 + OpenBSD-Commit-ID: bc965460a89edf76865b7279b45cf9cbdebd558a -commit d03e245e034019a37388f6f5f893ce848ab6d2e2 +commit 5f83342b61d1f76c141de608ed2bd293990416bd Author: Darren Tucker -Date: Fri Jan 13 23:02:34 2023 +1100 +Date: Tue Jul 25 13:00:22 2023 +1000 - Retry package installation 3 times. + Handle a couple more OpenSSL no-ecc cases. - When setting up the CI environment, retry package installation 3 times - before going up. Should help prevent spurious failures during - infrastructure issues. + ok djm@ -commit 625f6bc39840167dafb3bf5b6a3e18503ac986e8 -Author: dtucker@openbsd.org -Date: Fri Jan 13 04:47:34 2023 +0000 +commit edc2ef4e418e514c99701451fae4428ec04ce538 +Author: Damien Miller +Date: Thu Jul 20 12:53:44 2023 +1000 - upstream: Move scp path setting to a helper function. The previous - - commit to add scp to the test sshd's path causes the t-envpass test to fail - when the test scp is given using a fully qualified path. Put this in a - helper function and only call it from the scp tests. - - OpenBSD-Regress-ID: 7533dc1c4265c1de716abb062957994195b36df4 + depend -commit 6e6f88647042b3cde54a628545c2f5fb656a9327 -Author: dtucker@openbsd.org -Date: Fri Jan 13 04:23:00 2023 +0000 +commit 51fda734e0d3c2df256fc03e8b060c4305be6e59 +Author: Damien Miller +Date: Thu Jul 20 12:53:21 2023 +1000 - upstream: Add scp's path to test sshd's PATH. - - If the scp we're testing is fully qualified (eg it's not in the system - PATH) then add its path to the under-test sshd's PATH so we can find - it. Prompted by bz#3518. - - OpenBSD-Regress-ID: 7df4f5a0be3aa135495b7e5a6719d3cbc26cc4c0 + Bring back OPENSSL_HAS_ECC to ssh-pkcs11-client -commit 8a5e99a70fcf9b022a8aa175ebf6a71f58511da3 -Author: Darren Tucker -Date: Fri Jan 13 15:49:48 2023 +1100 +commit 099cdf59ce1e72f55d421c8445bf6321b3004755 +Author: djm@openbsd.org +Date: Wed Jul 19 14:03:45 2023 +0000 - Remove skipping test when scp not in path. + upstream: Separate ssh-pkcs11-helpers for each p11 module - An upcoming change renders this obsolete by adding scp's path to the - test sshd's PATH, and removing this first will make the subsequent sync - easier. - -commit 41f36dd896c8fb8337d403fcf476762986976e9d -Author: dtucker@openbsd.org -Date: Fri Jan 13 02:58:20 2023 +0000 - - upstream: Add a "Host" line to the output of ssh -G showing the + Make ssh-pkcs11-client start an independent helper for each provider, + providing better isolation between modules and reliability if a single + module misbehaves. - original host arg. Inspired by patch from vincent at bernat.ch via bz#3343, - ok djm@ + This also implements reference counting of PKCS#11-hosted keys, + allowing ssh-pkcs11-helper subprocesses to be automatically reaped + when no remaining keys reference them. This fixes some bugs we have + that make PKCS11 keys unusable after they have been deleted, e.g. + https://bugzilla.mindrot.org/show_bug.cgi?id=3125 - OpenBSD-Commit-ID: 59c0f60a222113a44d0650cd394376e3beecc883 + ok markus@ + + OpenBSD-Commit-ID: 0ce188b14fe271ab0568f4500070d96c5657244e -commit f673b49f3be3eb51074fbb8a405beb6cd0f7d93e +commit 29ef8a04866ca14688d5b7fed7b8b9deab851f77 Author: djm@openbsd.org -Date: Fri Jan 13 02:44:02 2023 +0000 +Date: Wed Jul 19 14:02:27 2023 +0000 - upstream: avoid printf("%s", NULL) if using ssh + upstream: Ensure FIDO/PKCS11 libraries contain expected symbols - -oUserKnownHostsFile=none and a hostkey in one of the system known hosts file - changes; ok dtucker@ + This checks via nlist(3) that candidate provider libraries contain one + of the symbols that we will require prior to dlopen(), which can cause + a number of side effects, including execution of constructors. - OpenBSD-Commit-ID: 7ca87614bfc6da491315536a7f2301434a9fe614 + Feedback deraadt; ok markus + + OpenBSD-Commit-ID: 1508a5fbd74e329e69a55b56c453c292029aefbe -commit 93fc7c576563e3d88a1dc019dd213f65607784cc +commit 1f2731f5d7a8f8a8385c6031667ed29072c0d92a Author: djm@openbsd.org -Date: Wed Jan 11 05:39:38 2023 +0000 +Date: Wed Jul 19 13:56:33 2023 +0000 - upstream: clamp the minimum buffer lengths and number of inflight + upstream: Disallow remote addition of FIDO/PKCS11 provider - requests too + libraries to ssh-agent by default. - OpenBSD-Commit-ID: c4965f62fa0ba850940fd66ae3f60cf516bbcd56 - -commit 48bf234322e639d279c5a28435eae50155e9b514 -Author: djm@openbsd.org -Date: Wed Jan 11 05:36:50 2023 +0000 - - upstream: ignore bogus upload/download buffer lengths in the limits + The old behaviour of allowing remote clients from loading providers + can be restored using `ssh-agent -O allow-remote-pkcs11`. - extension + Detection of local/remote clients requires a ssh(1) that supports + the `session-bind@openssh.com` extension. Forwarding access to a + ssh-agent socket using non-OpenSSH tools may circumvent this control. - OpenBSD-Commit-ID: c5b023e0954693ba9a5376e4280c739b5db575f8 - -commit 36b00d31833ca74cb0f7c7d8eda1bde55700f929 -Author: djm@openbsd.org -Date: Wed Jan 11 02:13:52 2023 +0000 - - upstream: remove whitespace at EOL from code extracted from SUPERCOP + ok markus@ - OpenBSD-Commit-ID: 1ec524ff2fbb9387d731601437c82008f35a60f4 + OpenBSD-Commit-ID: 4c2bdf79b214ae7e60cc8c39a45501344fa7bd7c -commit d888de06c5e4d7dbf2f2b85f2b5bf028c570cf78 +commit 892506b13654301f69f9545f48213fc210e5c5cc Author: djm@openbsd.org -Date: Wed Jan 11 00:51:27 2023 +0000 +Date: Wed Jul 19 13:55:53 2023 +0000 - upstream: rewrite this test to use a multiplexed ssh session so we can + upstream: terminate process if requested to load a PKCS#11 provider - control its lifecycle without risk of race conditions; fixes some of the - Github integration tests for openssh-portable + that isn't a PKCS#11 provider; from / ok markus@ - OpenBSD-Regress-ID: 5451cad59ba0d43ae9eeda48ec80f54405fee969 + OpenBSD-Commit-ID: 39532cf18b115881bb4cfaee32084497aadfa05c -commit 4bcc737a35fdd9cc4af7423d6c23dfd0c7ef4786 +commit f3f56df8ec476b2de6cbdbdfdb77a2a61087829d Author: Damien Miller -Date: Wed Jan 11 11:45:17 2023 +1100 +Date: Wed Jul 19 12:07:18 2023 +1000 - remove buffer len workaround for NetBSD 4.x - - Switching to from pipes to a socketpair for communicating with the - ssh process avoids the (kernel bug?) problem. + agent_fuzz doesn't want stdint.h conditionalised -commit f5154d2aac3e6a32a1b13dec23a701a087850cdc +commit 750911fd31d307a767cc86e3bfa90bbbb77b1a25 Author: Damien Miller -Date: Wed Jan 11 11:44:19 2023 +1100 +Date: Tue Jul 18 15:41:12 2023 +1000 - add back use of pipes in scp.c under USE_PIPES + conditionalise stdint.h inclusion on HAVE_STDINT_H - This matches sftp.c which prefers socketpair but uses pipes on - some older platforms. + fixes build on AIX5 at least -commit eec737b59cf13841de46134967a206607000acd4 -Author: millert@openbsd.org -Date: Tue Jan 10 23:22:15 2023 +0000 +commit ff047504fa6e008c4092f8929881816b8993bea0 +Author: Damien Miller +Date: Tue Jul 18 15:30:45 2023 +1000 - upstream: Switch scp from using pipes to a socketpair for - - communication with it's ssh sub-processes. We no longer need to reserve two - descriptors to ensure that we don't end up using fd 0-2 unexpectedly, that is - handled by sanitise_stdfd() in main(). Based on an original diff from djm@. - OK deraadt@ djm@ + conditionalise match localnetwork on ifaddrs.h - OpenBSD-Commit-ID: b80c372faac462471e955ddeab9480d668a2e48d + Fixes build breakage on platforms that lack getifaddrs() -commit d213d126a4a343abd3a1eb13687d39c1891fe5c8 -Author: jmc@openbsd.org -Date: Fri Jan 6 08:44:11 2023 +0000 +commit b87b03282e466ca2927954ce93f5dbf0bfdc68f6 +Author: djm@openbsd.org +Date: Mon Jul 17 06:16:33 2023 +0000 - upstream: tweak previous; ok djm + upstream: missing match localnetwork negation check - OpenBSD-Commit-ID: 229c493452766d70a78b0f02f6ff9894f9028858 + OpenBSD-Commit-ID: 9a08ed8dae27d3f38cf280f1b28d4e0ff41a737a -commit 4a5590a5ee47b7dfd49773e9fdba48ad3089fe64 -Author: Damien Miller -Date: Mon Jan 9 16:33:56 2023 +1100 +commit 6d6e185ba29ef4274164b77eab4dc763907f8821 +Author: jmc@openbsd.org +Date: Mon Jul 17 05:41:53 2023 +0000 - try to improve logging for dynamic-forward test + upstream: - add -P to usage() - sync the arg name to -J in usage() - previously the logs from the ssh used to exercise the forwarding - channel would clobber the logs from the ssh actually doing the - forwarding + with that in ssh.1 - reformat usage() to match what "man ssh" does on 80width + + OpenBSD-Commit-ID: 5235dd7aa42e5bf90ae54579d519f92fc107036e -commit 715bc25dcfccf9fb2bee820155fe071d01a618db -Author: Darren Tucker -Date: Sat Jan 7 23:24:50 2023 +1100 +commit f1a9898283a0638667b587ee4a950afd61ab51b0 +Author: jmc@openbsd.org +Date: Mon Jul 17 05:38:10 2023 +0000 - Skip dynamic-forward test on minix3. + upstream: -P before -p in SYNOPSIS; - This test relies on loopback addresses which minix does not have. - Previously the test would not run at all since it also doesn't have - netcat, but now we use our own netcat it tries and fails. + OpenBSD-Commit-ID: 535f5257c779e26c6a662a038d241b017f8cab7c -commit dd1249bd5c45128a908395c61b26996a70f82205 -Author: Damien Miller -Date: Sun Jan 8 12:08:59 2023 +1100 +commit eef4d7e873568e1c84c36bb4034e2c3378250a61 +Author: jsg@openbsd.org +Date: Mon Jul 17 05:36:14 2023 +0000 - don't test IPv6 addresses if platform lacks support + upstream: configuation -> configuration + + OpenBSD-Commit-ID: 4776ced33b780f1db0b2902faec99312f26a726b -commit d77fc611a62f2dfee0b654c31a50a814b13310dd -Author: dtucker@openbsd.org -Date: Fri Jan 6 12:33:33 2023 +0000 +commit dc1dbe94cf6532bd546a3373ad436404f8850e5f +Author: djm@openbsd.org +Date: Mon Jul 17 05:26:38 2023 +0000 - upstream: When OpenSSL is not available, skip parts of percent test + upstream: move other RCSIDs to before their respective license blocks - that require it. Based on github pr#368 from ren mingshuai. + too no code change - OpenBSD-Regress-ID: 49a375b2cf61ccb95b52e75e2e025cd10988ebb2 + OpenBSD-Commit-ID: ef5bf46b57726e4260a63b032b0b5ac3b4fe9cd4 -commit 1cd2aac312af9172f1b5cb06c2e1cd090abb83cf -Author: Darren Tucker -Date: Sat Jan 7 23:01:11 2023 +1100 +commit ebe11044681caff78834ca6b78311ad19c1860b8 +Author: djm@openbsd.org +Date: Mon Jul 17 05:22:30 2023 +0000 - Use our own netcat for dynamic-forward test. + upstream: Move RCSID to before license block and away from #includes, - That way we can be surer about its behaviour rather than trying to - second-guess the behaviour of various netcat implementations. + where it caused merge conflict in -portable for each commit :( + + OpenBSD-Commit-ID: 756ebac963df3245258b962e88150ebab9d5fc20 -commit 26cab41c05d7b0859d2a1ea5b6ed253d91848a80 -Author: Darren Tucker -Date: Sat Jan 7 14:30:43 2023 +1100 +commit 05c08e5f628de3ecf6f7ea20947735bcfa3201e0 +Author: djm@openbsd.org +Date: Mon Jul 17 05:20:15 2023 +0000 - Use autoconf to find openssl binary. + upstream: return SSH_ERR_KRL_BAD_MAGIC when a KRL doesn't contain a - It's possible to install an OpenSSL in a path not in the system's - default library search path. OpenSSH can still use this (eg if you - specify an rpath) but the openssl binary there may not work. If one is - available on the system path just use that. + valid magic number and not SSH_ERR_MESSAGE_INCOMPLETE; the former is needed + to fall back to text revocation lists in some cases; fixes t-cert-hostkey. + + OpenBSD-Commit-ID: 5c670a6c0f027e99b7774ef29f18ba088549c7e1 -commit 5532e010a0eeb6aa264396514f9aed7948471538 -Author: Darren Tucker -Date: Sat Jan 7 10:34:18 2023 +1100 - - Check openssl_bin path is executable before using. - -commit 5d7b16cff48598d5908db970bfdc9ff9326142c8 -Author: Darren Tucker -Date: Fri Jan 6 23:19:07 2023 +1100 - - Set OPENSSL_BIN from OpenSSL directory. - -commit 344a0e8240eaf08da5d46a5e3a9ecad6e4f64c35 -Author: dtucker@openbsd.org -Date: Fri Jan 6 08:50:33 2023 +0000 +commit c6fad2c3d19b74f0bd0af1ef040fc74f3a1d9ebb +Author: Damien Miller +Date: Mon Jul 17 14:56:14 2023 +1000 - upstream: Save debug logs from ssh for debugging purposes. - - OpenBSD-Regress-ID: 109e40b06de1c006a3b8e0d8745b790b2c5870a0 + avoid AF_LINK on platforms that don't define it -commit e1ef172646f7f49c80807eea90225ef5e0be55a8 +commit 919bc3d3b712c920de1ae6be5ac6561c98886d7e Author: djm@openbsd.org -Date: Fri Jan 6 08:07:39 2023 +0000 +Date: Mon Jul 17 04:08:31 2023 +0000 - upstream: regression test for ChannelTimeout + upstream: Add support for configuration tags to ssh(1). - OpenBSD-Regress-ID: 280bfbefcfa415428ad744e43f69a8dede8ad685 + This adds a ssh_config(5) "Tag" directive and corresponding + "Match tag" predicate that may be used to select blocks of + configuration similar to the pf.conf(5) keywords of the same + name. + + ok markus + + OpenBSD-Commit-ID: dc08358e70e702b59ac3e591827e5a96141b06a3 -commit 2393ea8daf25853459eb07a528d7577688847777 +commit 3071d85a47061c1bdaf11a0ac233b501ecba862c Author: djm@openbsd.org -Date: Fri Jan 6 07:18:18 2023 +0000 +Date: Mon Jul 17 04:04:36 2023 +0000 - upstream: fix typo in verbose logging + upstream: add a "match localnetwork" predicate. - OpenBSD-Regress-ID: 0497cdb66e003b2f50ed77291a9104fba2e017e9 + This allows matching on the addresses of available network interfaces + and may be used to vary the effective client configuration based on + network location (e.g. to use a ProxyJump when not on a particular + network). + + ok markus@ + + OpenBSD-Commit-ID: cffb6ff9a3803abfc52b5cad0aa190c5e424c139 -commit 161a5378a3cc2e7aa3f9674cb7f4686ae6ce9586 +commit beec17bb311365b75a0a5941418d4b96df7d7888 Author: djm@openbsd.org -Date: Fri Jan 6 02:59:50 2023 +0000 +Date: Mon Jul 17 04:01:10 2023 +0000 - upstream: unit tests for misc.c:ptimeout_* API + upstream: remove vestigal support for KRL signatures - OpenBSD-Regress-ID: 01f8fb12d08e5aaadd4bd4e71f456b6588be9a94 - -commit 018d671d78145f03d6f07ae9d64d51321da70325 -Author: tb@openbsd.org -Date: Wed Jan 4 22:48:57 2023 +0000 - - upstream: Copy bytes from the_banana[] rather than banana() + When the KRL format was originally defined, it included support for + signing of KRL objects. However, the code to sign KRLs and verify KRL + signatues was never completed in OpenSSH. - Fixes test failure due to segfault seen on arm64 with xonly snap. + Now, some years later, we have SSHSIG support in ssh-keygen that is + more general, well tested and actually works. So this removes the + semi-finished KRL signing/verification support from OpenSSH and + refactors the remaining code to realise the benefit - primarily, we + no longer need to perform multiple parsing passes over KRL objects. - ok djm + ok markus@ - OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046 + OpenBSD-Commit-ID: 517437bab3d8180f695c775410c052340e038804 -commit ab6bb69e251faa8b24f81b25c72ec0120f20cad4 -Author: Damien Miller -Date: Fri Jan 6 19:13:36 2023 +1100 +commit 449566f64c21b4578d5c0c431badd0328adc53ed +Author: djm@openbsd.org +Date: Mon Jul 17 03:57:21 2023 +0000 - unbreak scp on NetBSD 4.x + upstream: Support for KRL extensions. - e555d5cad5 effectively increased the default copy buffer size for SFTP - transfers. This caused NetBSD 4.x to hang during the "copy local file to - remote file in place" scp.sh regression test. + This defines wire formats for optional KRL extensions and implements + parsing of the new submessages. No actual extensions are supported at + this point. - This puts back the original 32KB copy buffer size until we can properly - figure out why. + ok markus - lots of debugging assistance from dtucker@ + OpenBSD-Commit-ID: ae2fcde9a22a9ba7f765bd4f36b3f5901d8c3fa7 -commit 2d1ff2b9431393ad99ef496d5e3b9dd0d4f5ac8c -Author: djm@openbsd.org -Date: Fri Jan 6 02:47:18 2023 +0000 +commit 18ea857770e84825a3a6238bb37f54864487b59f +Author: dtucker@openbsd.org +Date: Fri Jul 14 07:44:21 2023 +0000 - upstream: Implement channel inactivity timeouts - - This adds a sshd_config ChannelTimeouts directive that allows channels that - have not seen traffic in a configurable interval to be automatically closed. - Different timeouts may be applied to session, X11, agent and TCP forwarding - channels. - - Note: this only affects channels over an opened SSH connection and not - the connection itself. Most clients close the connection when their channels - go away, with a notable exception being ssh(1) in multiplexing mode. + upstream: Include stdint.h for SIZE_MAX. Fixes OPENSSL=no build. - ok markus dtucker + OpenBSD-Commit-ID: e7c31034a5434f2ead3579b13a7892960651e6b0 + +commit 20b768fcd13effe0f2d3619661b6c8592c773553 +Author: Darren Tucker +Date: Fri Jul 14 17:07:32 2023 +1000 + + Fix typo in declaration of nmesg. + +commit 4b94d09542e36ebde2eb9ad89bc68431609932de +Author: Damien Miller +Date: Fri Jul 14 15:34:47 2023 +1000 + + portable-specific int overflow defence-in-depth - OpenBSD-Commit-ID: ae8bba3ed9d9f95ff2e2dc8dcadfa36b48e6c0b8 + These too are unreachable, but we want the code to be safe regardless of + context. Reported by Yair Mizrahi @ JFrog -commit 0e34348d0bc0b1522f75d6212a53d6d1d1367980 +commit 2ee48adb9fc8692e8d6ac679dcc9f35e89ad68f0 Author: djm@openbsd.org -Date: Fri Jan 6 02:42:34 2023 +0000 +Date: Fri Jul 14 05:31:44 2023 +0000 - upstream: Add channel_set_xtype() - - This sets an "extended" channel type after channel creation (e.g. - "session:subsystem:sftp") that will be used for setting channel inactivity - timeouts. + upstream: add defence-in-depth checks for some unreachable integer - ok markus dtucker + overflows reported by Yair Mizrahi @ JFrog; feedback/ok millert@ - OpenBSD-Commit-ID: 42564aa92345045b4a74300528f960416a15d4ca + OpenBSD-Commit-ID: 52af085f4e7ef9f9d8423d8c1840a6a88bda90bd -commit ceedf09b2977f3a756c759a6e7eb8f8e9db86a18 +commit 4b43bc358ae6f6b19a973679246dc5172f6ac41b Author: djm@openbsd.org -Date: Fri Jan 6 02:41:49 2023 +0000 +Date: Mon Jul 10 04:51:26 2023 +0000 - upstream: tweak channel ctype names - - These are now used by sshd_config:ChannelTimeouts to specify timeouts by - channel type, so force them all to use a similar format without whitespace. - - ok dtucker markus + upstream: misplaced debug message - OpenBSD-Commit-ID: 66834765bb4ae14f96d2bb981ac98a7dae361b65 + OpenBSD-Commit-ID: d0f12af0a5067a756aa707bc39a83fa6f58bf7e5 -commit c60438158ad4b2f83d8504257aba1be7d0b0bb4b -Author: djm@openbsd.org -Date: Fri Jan 6 02:39:59 2023 +0000 +commit 8c7203bcee4c4f98a22487b4631fe068b992099b +Author: Damien Miller +Date: Wed Jul 12 11:41:19 2023 +1000 - upstream: Add channel_force_close() + replace deprecate selinux matchpathcon function - This will forcibly close an open channel by simulating read/write errors, - draining the IO buffers and calling the detach function. + This function is apparently deprecated. Documentation on what is the + supposed replacement is is non-existent, so this follows the approach + glibc used https://sourceware.org/git/?p=glibc.git;a=patch;h=f278835f59 - Previously the detach function was only ever called during channel garbage - collection, but there was no way to signal the user of a channel (e.g. - session.c) that its channel was being closed deliberately (vs. by the - usual state-machine logic). So this adds an extra "force" argument to the - channel cleanup callback to indicate this condition. + ok dtucker@ + +commit 7e8800f5d701efffa39ccb63ca1e095ea777c31a +Author: dtucker@openbsd.org +Date: Thu Jul 6 22:17:59 2023 +0000 + + upstream: minleft and maxsign are u_int so cast appropriately. Prompted - ok markus dtucker + by github PR#410, ok deraadt. - OpenBSD-Commit-ID: 23052707a42bdc62fda2508636e624afd466324b + OpenBSD-Commit-ID: 0514cd51db3ec60239966622a0d3495b15406ddd -commit d478cdc7ad6edd4b1bcd1e86fb2f23194ff33d5a -Author: djm@openbsd.org -Date: Fri Jan 6 02:38:23 2023 +0000 +commit 94842bfe9b09fc93189c6ed0dc9bbebc1d44a426 +Author: dlg@openbsd.org +Date: Tue Jul 4 03:59:21 2023 +0000 - upstream: replace manual poll/ppoll timeout math with ptimeout API + upstream: add support for unix domain sockets to ssh -W - feedback markus / ok markus dtucker + ok djm@ dtucker@ - OpenBSD-Commit-ID: c5ec4f2d52684cdb788cd9cbc1bcf89464014be2 + OpenBSD-Commit-ID: 3e6d47567b895c7c28855c7bd614e106c987a6d8 -commit 4adf3817a24efe99b06e62630577d683c7cd8065 -Author: djm@openbsd.org -Date: Fri Jan 6 02:37:04 2023 +0000 +commit a95fc5eed09a0238fb127b6c50e8498432b79dae +Author: David Seifert +Date: Fri May 12 14:06:01 2023 +0200 - upstream: add ptimeout API for keeping track of poll/ppoll + gss-serv.c: `MAXHOSTNAMELEN` -> `HOST_NAME_MAX` - timeouts; ok dtucker markus + `MAXHOSTNAMELEN` is not defined in POSIX, which breaks on musl: + https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostname.html - OpenBSD-Commit-ID: 3335268ca135b3ec15a947547d7cfbb8ff929ead + Bug: https://bugs.gentoo.org/834044 -commit 8c7c69d32375d2f3ce9da0109c9bffc560842316 -Author: djm@openbsd.org -Date: Thu Jan 5 05:49:13 2023 +0000 +commit 8a6cd08850f576e7527c52a1b086cae82fab290e +Author: Darren Tucker +Date: Fri Jun 23 09:49:02 2023 +1000 - upstream: suppress "Connection closed" message when in quiet mode + Update runner OS version for hardenedmalloc test. - OpenBSD-Commit-ID: 8a3ab7176764da55f60bfacfeae9b82d84e3908f + Hardenedmalloc dropped support for "legacy glibc" versions in their + 64dad0a69 so use a newer Ubuntu version for the runner for that test. -commit 845ceecea2ac311b0c267f9ecbd34862e1876fc6 -Author: djm@openbsd.org -Date: Mon Jan 2 07:03:57 2023 +0000 +commit cfca6f17e64baed6822bb927ed9f372ce64d9c5b +Author: Damien Miller +Date: Thu Jun 22 15:04:03 2023 +1000 - upstream: regression test for PermitRemoteOpen + handle sysconf(SC_OPEN_MAX) returning > INT_MAX; - OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c + bz3581; ok dtucker -commit b3daa8dc582348d6ab8150bc1e571b7aa08c5388 +commit c1c2ca1365b3f7b626683690bd2c68265f6d8ffd Author: djm@openbsd.org -Date: Mon Jan 2 07:03:30 2023 +0000 +Date: Wed Jun 21 05:10:26 2023 +0000 - upstream: fix bug in PermitRemoteOpen which caused it to ignore its + upstream: better validate CASignatureAlgorithms in ssh_config and - first argument unless it was one of the special keywords "any" or "none". + sshd_config. - Reported by Georges Chaudy in bz3515; ok dtucker@ + Previously this directive would accept certificate algorithm names, but + these were unusable in practice as OpenSSH does not support CA chains. - OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5 + part of bz3577; ok dtucker@ + + OpenBSD-Commit-ID: a992d410c8a78ec982701bc3f91043dbdb359912 -commit 0872663a7be0301bcc3d49acdbc9b740a3d972d4 -Author: jmc@openbsd.org -Date: Mon Dec 26 19:16:03 2022 +0000 +commit 4e73cd0f4ab3e5b576c56cac9732da62c8fc0565 +Author: djm@openbsd.org +Date: Wed Jun 21 05:08:32 2023 +0000 - upstream: spelling fixes; from paul tagliamonte amendments to his + upstream: make `ssh -Q CASignatureAlgorithms` only list signature - diff are noted on tech + algorithms that are valid for CA signing. Previous behaviour was to list all + signing algorithms, including certificate algorithms (OpenSSH certificates do + not support CA chains). part of bz3577; ok dtucker@ - OpenBSD-Commit-ID: d776dd03d0b882ca9c83b84f6b384f6f9bd7de4a + OpenBSD-Commit-ID: 99c2b072dbac0f44fd1f2269e3ff6c1b5d7d3e59 -commit 797da2812a71785b34890bb6eb44767a7d09cd34 +commit a69062f1695ac9c3c3dea29d3044c72aaa6af0ea Author: djm@openbsd.org -Date: Fri Dec 16 07:13:22 2022 +0000 +Date: Wed Jun 21 05:06:04 2023 +0000 - upstream: Mention that scp uses the SFTP protocol and remove + upstream: handle rlimits > INT_MAX (rlim_t is u64); ok dtucker - reference to legacy flag. Spotted by, feedback and ok jmc@ + bz3581 - OpenBSD-Commit-ID: 9dfe04966f52e941966b46c7a2972147f95281b3 + OpenBSD-Commit-ID: 31cf59c041becc0e5ccb0a77106f812c4cd1cd74 -commit 93f2ce8c050a7a2a628646c00b40b9b53fef93ef +commit 8d33f2aa6bb895a7f85a47189913639086347b75 Author: djm@openbsd.org -Date: Fri Dec 16 06:56:47 2022 +0000 +Date: Tue Jun 20 23:59:33 2023 +0000 - upstream: Clear signal mask early in main(); sshd may have been + upstream: prepare for support for connecting to unix domain sockets - started with one or more signals masked (sigprocmask(2) is not cleared - on fork/exec) and this could interfere with various things, e.g. the - login grace timer. + using ssh -W by explicitly decoding PORT_STREAMLOCAL (a negative number) from + the u32 that's passed over the multiplexing socket; previously code would + just cast, which is UB. - Execution environments that fail to clear the signal mask before running - sshd are clearly broken, but apparently they do exist. + OpenBSD-Commit-ID: e5ac5f40d354096c51e8c118a5c1b2d2b7a31384 + +commit b4ac435b4e67f8eb5932d8f59eb5b3cf7dc38df0 +Author: djm@openbsd.org +Date: Tue Jun 20 00:05:09 2023 +0000 + + upstream: reset comment=NULL for each key in do_fingerprint(); - Reported by Sreedhar Balasubramanian; ok dtucker@ + fixes "no comment" not showing on when running `ssh-keygen -l` on multiple + keys where one has a comment and other following keys do not. Patch from + Markus Kuhn via GHPR407, bz3580 - OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae + OpenBSD-Commit-ID: 3cce84456fdcd67dc6b84e369f92c6686d111d9b -commit 4acfaabfae41badb9d334a2ee88c5c6ad041c0d5 -Author: jmc@openbsd.org -Date: Fri Dec 16 06:52:48 2022 +0000 +commit b53a809a549dcd4fbde554c6aa283e597b15ea33 +Author: millert@openbsd.org +Date: Mon Jun 5 13:24:36 2023 +0000 - upstream: add -X to usage(); + upstream: Store timeouts as int, not u_int as they are limited to - OpenBSD-Commit-ID: 1bdc3df7de11d766587b0428318336dbffe4a9d0 + INT_MAX. Fixes sign compare warnings systems with 32-bit time_t due to type + promotion. OK djm@ + + OpenBSD-Commit-ID: 48081e9ad35705c5f1705711704a4c2ff94e87b7 -commit e555d5cad5afae7d5ef2bbc02ca591178fe16fed -Author: djm@openbsd.org -Date: Fri Dec 16 03:40:03 2022 +0000 +commit 2709809fd616a0991dc18e3a58dea10fb383c3f0 +Author: Philip Hands +Date: Wed May 24 19:41:14 2023 +0200 - upstream: add a -X option to both scp(1) and sftp(1) to allow + fixup! if -s & -p specified, mention 'sftp -P' on - control over some SFTP protocol knobs: the copy buffer length and - the number of inflight requests, both of which are used during - upload/download. + success - Previously these could be controlled in sftp(1) using the -b/-R options. - This makes them available in both SFTP protocol clients using the same - option character sequence. + SSH-Copy-ID-Upstream: 32686e7c65b4fa2846e474d3315102dfa0f043b0 + +commit 204e0bf05161b7641500d7ab266c21217412379f +Author: Darren Tucker +Date: Tue Aug 3 21:25:48 2021 +1000 + + Make ssh-copy-id(1) consistent with OpenSSH. - ok dtucker@ + This makes the ssh-copy-id man page more consistent with the rest of the + OpenSSH man pages: + - new sentence, new line + - no sentences >80 + - N.B. -> NB + - zap unused .Pp + - zap trailing whitespace - OpenBSD-Commit-ID: 27502bffc589776f5da1f31df8cb51abe9a15f1c + Report from Debian via mindrot bz#3331, diff from jmc at openbsd.org. + + SSH-Copy-ID-Upstream: d8974cfb6242316460ed22a1ccc662800a50c5d3 -commit 5a7a7acab2f466dc1d7467b5d05d35268c3137aa -Author: deraadt@openbsd.org -Date: Thu Dec 15 18:20:39 2022 +0000 +commit 9de79df66d1430d290fab670bb4b18612875e518 +Author: Philip Hands +Date: Wed May 24 11:45:43 2023 +0200 - upstream: The idiomatic way of coping with signed char vs unsigned + if -s & -p specified, mention 'sftp -P' on success - char (which did not come from stdio read functions) in the presence of - ctype macros, is to always cast to (unsigned char). casting to (int) - for a "macro" which is documented to take int, is weird. And sadly wrong, - because of the sing extension risk.. same diff from florian + This was inspired by this: + https://github.com/openssh/openssh-portable/pull/321 + but I thought that it was better to not do the sed patching. - OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea + BTW the reason one can get away with using $SSH_OPTS throughout, despite + the lowercase -p in there, even if sftp is in use, is that the sftp call + is using the already-established ssh master connection, so the port was + passed to the earlier ssh. + + SSH-Copy-ID-Upstream: 1c124d9bfafdbe28a00b683367ebf5750ce12eb2 -commit b0b58222c7cc62efd8212c4fb65a545f58ebb22d +commit 801cda54c00e0f4e7d89345a90874c8d05dc233a +Author: Philip Hands +Date: Tue May 23 23:07:11 2023 +0200 + + drop whitespace + + SSH-Copy-ID-Upstream: e604fae1cdee35c18055d35dcec530cf12ef00ad + +commit 288482f53613f3e74544eb92deeb24f7c7f1f371 +Author: Philip Hands +Date: Tue May 23 20:52:13 2023 +0200 + + make -x also apply to the target script + + SSH-Copy-ID-Upstream: 3c4214704f427bd0654adf9b0fc079253db21cf4 + +commit b79e7b88ed44f0e4339f0ff35c96c78a92175a8d +Author: Philip Hands +Date: Tue May 23 16:46:42 2023 +0200 + + add -t option to specify the target path + + Allow the default target path (.ssh/authorized_files) to be over-riden + + This was inspired by this MR from Panagiotis Cheilaris + + https://gitlab.com/phil_hands/ssh-copy-id/-/merge_requests/8 + + SSH-Copy-ID-Upstream: a942a0e076874adb6d8b2f0fb76d6c7918190fcd + +commit 914f4ad138714c471ba72fb6d5496b6235320edd +Author: Carlos Rodríguez Gili +Date: Tue Apr 20 19:23:57 2021 +0200 + + Fix test error for /bin/sh on Solaris 10 and older + + On Solaris 10 and older targets /bin/sh is not POSIX-compliant. + Test -z `...` fails with error 'sh: test: argument expected'. + Using quotes around backticks fixes this and doesn't break + POSIX compatibility. + + SSH-Copy-ID-Upstream: 98394072a3f985b2650c1e8eab2fef84e38cc065 + +commit bd382dca316c721aed1e45edcf4c4e0f6374afb0 +Author: Jakub Jelen +Date: Tue Mar 2 21:34:05 2021 +0000 + + Remove outdated comment + + The commit b068122 removed the code dropping the trailing colon, but the comment stayed leaving the code confusing for future readers + + SSH-Copy-ID-Upstream: 930d39f238117cd53810240ec989d0356aa1c1f6 + +commit bdcaf7939029433635d63aade8f9ac762aca2bbe Author: Darren Tucker -Date: Mon Dec 19 18:49:51 2022 +1100 +Date: Wed May 10 18:50:46 2023 +1000 - Simply handling of SSH_CONNECTION PAM env var. + Special case OpenWrt instead of Dropbear. - Prompted by bz#3508: there's no need to cache the value of - sshpam_conninfo so remove the global. While there, add check of - return value from pam_putenv. ok djm@ + OpenWrt overrides the location of authorized_keys for root. Currently we + assume that all Dropbear installations behave this way, which is not the + case. Check for OpenWrt and root user before using that location instead + of assuming that for all Dropbear servers. Prompted by Github PR#250. + + SSH-Copy-ID-Upstream: 0e1f5d443a9967483c33945793107ae3f3e4af2d -commit ed8444572ae684fdb892f97bae342c6cb6456f04 +commit cf84498f67abe93f813a296167b406a0db7b288e +Author: Philip Hands +Date: Thu May 18 18:20:55 2023 +0200 + + ssh-copy-id: add -x option (for debugging) + + This option causes the ssh-copy-id to run with set -x + + SSH-Copy-ID-Upstream: a0ee367ea8c0a29c8b4515245e408d2d349e7844 + +commit b4a1efdcb88f03394c08e7f68ed4e11676830002 +Author: Philip Hands +Date: Thu May 18 17:14:41 2023 +0200 + + update copyright notices + + SSH-Copy-ID-Upstream: c284ed33b361814ea48ff68cbd01ca525b2bf117 + +commit fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 +Author: djm@openbsd.org +Date: Wed May 24 23:01:06 2023 +0000 + + upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand + + appears previously in configuration. Reported by John Meyers in bz3574 ok + dtucker@ + + OpenBSD-Commit-ID: 1c92e4517284386703936e1d3abaa36cfacf1951 + +commit 5ec5504f1d328d5bfa64280cd617c3efec4f78f3 +Author: dtucker@openbsd.org +Date: Wed May 10 10:04:20 2023 +0000 + + upstream: Remove unused prototypes for ssh1 RSA functions. + + From lengyijun via github PR#396. + + OpenBSD-Commit-ID: 379a5afa8b7a0f3cba0c8a9bcceb4e5e33a5c1ef + +commit fbf362b3891ae4b36052d1b39f37fc618b41c476 Author: Darren Tucker -Date: Mon Dec 19 18:42:34 2022 +1100 +Date: Tue May 9 19:26:56 2023 +1000 - Add tests for LibreSSL 3.7.0 and OpenSSL 1.1.1s. + main(void) to prevent unused variable warning. -commit abb9a8aaddfcacbd12641f6e4f203da0fa85a287 +commit baf854c8bb0a6d0af5c696c801e631a48dabbaba Author: Darren Tucker -Date: Sun Dec 18 21:36:25 2022 +1100 +Date: Tue May 9 19:25:45 2023 +1000 - Use sudo when resetting perms on directories. + Remove warning pragma since clang doesn't like it. -commit 2f5664c5908d84697cbe91302d5d5c4d83cb2121 +commit 5fbb7a1349fbbb48ccb1b8cafff2c1854370d87d Author: Darren Tucker -Date: Sun Dec 18 21:19:33 2022 +1100 +Date: Tue May 9 17:13:33 2023 +1000 - Set group perms on regress dir. + Suppress warning for snprintf truncation test. + +commit 47742c513e4e045ecc985c6483fc5c8b050acda2 +Author: Darren Tucker +Date: Tue May 9 17:12:50 2023 +1000 + + Update OpenSSL compat test for 3.x. + +commit 86ad25d455a2313126125540e61e0f9314283f88 +Author: Darren Tucker +Date: Mon May 8 20:23:08 2023 +1000 + + Add macos13 PAM test target. + +commit 77cca2c4b13bc6e5f389565583b6202b0d1bccc2 +Author: Darren Tucker +Date: Mon May 8 20:14:46 2023 +1000 + + Skip agent-peereid test on macos13. - This ensures that the tests don't fail due to StrictMode checks. + sudo -S nobody doesn't work on the github runners (probably a + permission issue) so skip that test. -commit 137196300fc1540affadde880210f02ba6cb4abf +commit b356b8e91678ea295bcf44df5248c3fbf499fdcf Author: Darren Tucker -Date: Sun Dec 18 21:13:42 2022 +1100 +Date: Mon May 8 20:14:28 2023 +1000 - Fetch regress logs from obj dir. + Include config.guess in debug output. -commit 5f93c4836527d9fda05de8944a1c7b4a205080c7 +commit b7afd8a4ecaca8afd3179b55e9db79c0ff210237 Author: Darren Tucker -Date: Tue Dec 13 20:59:54 2022 +1100 +Date: Mon May 8 20:12:59 2023 +1000 - obsdsnap test VMs runs-on libvirt too. + Handle OpenSSL >=3 ABI compatibility. + + Beyond OpenSSL 3.0, the ABI compatibility guarantees are wider (only + major must match instead of major and minor in earlier versions). + bz#3548, ok djm@ -commit 8386886fb1ab7fda73069fb0db1dbe0e5a52f758 +commit 0e9e2663eb2c6e9c3e10d15d70418312ae67e542 +Author: dtucker@openbsd.org +Date: Mon May 1 08:57:29 2023 +0000 + + upstream: Import regenerated moduli. + + OpenBSD-Commit-ID: 3d5f811cfcaed8cc4a97e1db49ac61bdf118113c + +commit d9687f49682e1e93383fc15ab2018850b2ef38c3 Author: Darren Tucker -Date: Tue Dec 13 20:55:37 2022 +1100 +Date: Mon May 1 11:45:14 2023 +1000 - Run upstream obsdsnap tests on ephemeral runners. + Add macos-13 test target. + + Also flatten OS list for clarity. -commit b6e01459b55ece85d7f296b2bc719d1841e1009e +commit aacfd6767497b8fa6d41ecdd3f8e265d1e9ef1f6 +Author: djm@openbsd.org +Date: Sun Apr 30 22:54:22 2023 +0000 + + upstream: adjust ftruncate() logic to handle servers that reorder + + requests. + + sftp/scp will ftruncate the destination file after a transfer completes, + to deal with the case where a longer destination file already existed. + We tracked the highest contiguous block transferred to deal with this + case, but our naive tracking doesn't deal with servers that reorder + requests - a misfeature strictly permitted by the protocol but seldom + implemented. + + Adjust the logic to ftruncate() at the highest absolute block received + when the transfer is successful. feedback deraadt@ ok markus@ + + prompted by https://github.com/openssh/openssh-portable/commit/9b733#commitcomment-110679778 + + OpenBSD-Commit-ID: 4af7fac75958ad8507b4fea58706f3ff0cfddb1b + +commit c8eb3941758615c8284a48fff47872db926da63c +Author: djm@openbsd.org +Date: Wed Apr 26 01:36:03 2023 +0000 + + upstream: Check for ProxyJump=none in CanonicalizeHostname logic. + + Previously ssh would incorrectly refuse to canonicalise the hostname + if ProxyJump was explicitly set to "none" when CanonicalizeHostname=yes + + bz3567; ok dtucker + + OpenBSD-Commit-ID: 80a58e43c3a32f97361282f756ec8d3f37989efd + +commit ac383f3a5c6f529a2e8a5bc44af79a08c7da294e +Author: jsg@openbsd.org +Date: Wed Apr 12 14:22:04 2023 +0000 + + upstream: remove duplicate signal.h include + + OpenBSD-Commit-ID: 30c0a34d74d91ddd0e6992525da70d3293392f70 + +commit 740dafa20f3f3d325f6f5d44e990b8c8a6d3d816 +Author: jsg@openbsd.org +Date: Wed Apr 12 08:53:54 2023 +0000 + + upstream: fix double words ok dtucker@ + + OpenBSD-Commit-ID: 44d3223902fbce5276422bdc8063ab72a4078489 + +commit 6452f89577ec4f22440c31b8e19b061d1a7c4b2a Author: Darren Tucker -Date: Tue Dec 13 20:48:56 2022 +1100 +Date: Tue Apr 11 16:49:19 2023 +1000 - Move obsdsnap test VMs to ephemeral runners. + Test against LibreSSL 3.7.2. + +commit 2138f6be595ca106fe4805a1e3ab9c4d8acc697b +Author: Damien Miller +Date: Thu Apr 6 14:33:10 2023 +1000 + + remove unused upper-case const strings in fmtfp + + no float format that uses upper-case is supported nor are hex floats. + ok dtucker + +commit 484c5e6168fdb22cbcd73c4ff987cf9ca47989ca +Author: djm@openbsd.org +Date: Thu Apr 6 03:56:02 2023 +0000 + + upstream: simplify sshsig_find_principals() similar to what happened to + + sshsig_check_allowed_keys() in r1.31, removing some dead code + + OpenBSD-Commit-ID: a493e628d4d6c08f878c276d998f4313ba61702d + +commit 3a7b110fbc7e096423f8f7b459deffe4c65d70f4 +Author: djm@openbsd.org +Date: Thu Apr 6 03:21:31 2023 +0000 + + upstream: remove redundant ssh!=NULL check; we'd already + + dereferenced it + + OpenBSD-Commit-ID: 852bf12591ec5a9fb12dcbde9b1fd3945ad0df3c + +commit 2519110659a1efac6c976895a86659d1b341c91b +Author: djm@openbsd.org +Date: Thu Apr 6 03:19:32 2023 +0000 + + upstream: match_user() shouldn't be called with user==NULL unless + + host and ipaddr are also NULL + + OpenBSD-Commit-ID: fa3518346c21483e9e01a2e4b9436ae501daf8ea + +commit 3b9ceaad7ad63c1c03c2a89e148340ad3a62a482 +Author: djm@openbsd.org +Date: Thu Apr 6 03:12:32 2023 +0000 + + upstream: don't care about glob() return value here. + + OpenBSD-Commit-ID: 85bb82fea90478a482e9f65a1bec0aa24227fd66 + +commit 09d8da0849e2791b2500267cda333cd238f38754 +Author: dtucker@openbsd.org +Date: Mon Apr 3 08:10:54 2023 +0000 + + upstream: Move up null check and simplify process_escapes. + + Based on Coverity CID 291863 which points out we check the channel + pointer for NULLness after dereferencing it. Move this to the start + of the function, and while there simplify initialization of efc a bit. + ok djm@ + + OpenBSD-Commit-ID: de36e5ad6fde0fe263ca134e986b9095dc59380a + +commit b36b162be5e6206f12b734222b7bc517c13a6bc8 +Author: Damien Miller +Date: Fri Mar 31 14:51:20 2023 +1100 + + need va_end() after va_copy(); ok dtucker + + spotted by Coverity + +commit f703757234a5c585553e72bba279b255a272750a +Author: dtucker@openbsd.org +Date: Fri Mar 31 05:56:36 2023 +0000 + + upstream: Explicitly ignore return from waitpid here too. + + OpenBSD-Commit-ID: eef2403df083c61028969fc679ee370373eacacb + +commit 6b73aa29035991d1448a1a76f63ac152a6bf931c +Author: dtucker@openbsd.org +Date: Fri Mar 31 04:45:08 2023 +0000 + + upstream: Explictly ignore return codes + + where we don't check them. + + OpenBSD-Commit-ID: 1ffb03038ba1b6b72667be50cf5e5e396b5f2740 + +commit 6f0308a3e717ebe68eeb3f95253612fab5dbf20e +Author: dtucker@openbsd.org +Date: Fri Mar 31 04:42:29 2023 +0000 + + upstream: Return immediately from get_sock_port + + if sock <0 so we don't call getsockname on a negative FD. From Coverity + CID 291840, ok djm@ + + OpenBSD-Commit-ID: de1c1130646230c2eda559831fc6bfd1b61d9618 + +commit 1c1124dc901fca1ea2cb762044b8f1a5793a2bed +Author: djm@openbsd.org +Date: Fri Mar 31 04:23:02 2023 +0000 + + upstream: don't leak arg2 on parse_pubkey_algos error path; ok + + dtucker@ + + OpenBSD-Commit-ID: 7d0270ad3dd102412ca76add2b3760518abdef75 + +commit 8ba2d4764bb6a4701cd447d8b52604622ffe65f4 +Author: djm@openbsd.org +Date: Fri Mar 31 04:22:27 2023 +0000 + + upstream: clamp max number of GSSAPI mechanisms to 2048; ok dtucker + + OpenBSD-Commit-ID: ce66db603a913d3dd57063e330cb5494d70722c4 + +commit 1883841fc13d0eada8743cac5d3abe142ee2efa7 +Author: djm@openbsd.org +Date: Fri Mar 31 04:21:56 2023 +0000 + + upstream: don't print key if printing hostname failed; with/ok + + dtucker@ + + OpenBSD-Commit-ID: ad42971a6ee5a46feab2d79f7f656f8cf4b119f3 + +commit c6011129cafe4c411f6ef670a4cf271314708eb8 +Author: djm@openbsd.org +Date: Fri Mar 31 04:04:15 2023 +0000 + + upstream: remove redundant test + + OpenBSD-Commit-ID: 6a0b719f9b1ae9d42ad8c5b144c7962c93792f7c -commit ea6fdf9a1aa71a411f7db218a986392c4fb55693 -Author: Damien Miller -Date: Fri Dec 9 18:00:21 2022 +1100 +commit 4fb29eeafb40a2076c0dbe54e46b687c318f87aa +Author: djm@openbsd.org +Date: Fri Mar 31 04:00:37 2023 +0000 - use calloc for allocating arc4random structs + upstream: don't attempt to decode a ridiculous number of - ok dtucker + attributes; harmless because of bounds elsewhere, but better to be explicit + + OpenBSD-Commit-ID: 1a34f4b6896155b80327d15dc7ccf294b538a9f2 -commit 4403b62f5548e91389cb3339d26a9d0c4bb07b34 -Author: dtucker@openbsd.org -Date: Fri Dec 9 00:22:29 2022 +0000 +commit fc437c154ef724621a4af236de9bc7e51a8381ae +Author: djm@openbsd.org +Date: Fri Mar 31 03:22:49 2023 +0000 - upstream: Warn if no host keys for hostbased auth can be loaded. + upstream: remove unused variable; prompted by Coverity CID 291879 - OpenBSD-Commit-ID: 2a0a13132000cf8d3593133c1b49768aa3c95977 + OpenBSD-Commit-ID: 4c7d20ef776887b0ba1aabcfc1b14690e4ad0a40 -commit a6183e25e3f1842e21999fe88bc40bb99b121dc3 +commit 0eb8131e4a53b33a8fc9b9ab694e6b6778b87ade Author: dtucker@openbsd.org -Date: Fri Dec 9 00:17:40 2022 +0000 +Date: Fri Mar 31 00:44:29 2023 +0000 - upstream: Add server debugging for hostbased auth. + upstream: Check fd against >=0 instead of >0 in error path. The - auth_debug_add queues messages about the auth process which is sent to - the client after successful authentication. This also sends those to - the server debug log to aid in debugging. From bz#3507, ok djm@ + dup could in theory return fd 0 although currently it doesn't in practice. + From Dmitry Belyavskiy vi github PR#238. - OpenBSD-Commit-ID: 46ff67518cccf9caf47e06393e2a121ee5aa258a + OpenBSD-Commit-ID: 4a95f3f7330394dffee5c749d52713cbf3b54846 -commit b85c3581c16aaf6e83b9a797c80705a56b1f312e -Author: cheloha@openbsd.org -Date: Sun Dec 4 23:50:49 2022 +0000 +commit 7174ba6f8a431ca4257767a260fc50e204068242 +Author: dtucker@openbsd.org +Date: Thu Mar 30 07:19:50 2023 +0000 - upstream: remove '?' from getopt(3) loops - - userspace: remove vestigial '?' cases from top-level getopt(3) loops - - getopt(3) returns '?' when it encounters a flag not present in the in - the optstring or if a flag is missing its option argument. We can - handle this case with the "default" failure case with no loss of - legibility. Hence, remove all the redundant "case '?':" lines. - - Prompted by dlg@. With help from dlg@ and millert@. - - Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2 + upstream: Ignore return value from muxclient(). It normally loops - ok naddy@ millert@ dlg@ + without returning, but it if returns on failure we immediately exit. + Coverity CID 405050. - OpenBSD-Commit-ID: b2f89346538ce4f5b33ab8011a23e0626a67e66e + OpenBSD-Commit-ID: ab3fde6da384ea588226037c38635a6b2e015295 -commit 9a067e8d28a2249fd73f004961e30c113ee85e5d -Author: dtucker@openbsd.org -Date: Wed Dec 7 11:45:43 2022 +0000 +commit a4c1c2513e36f111eeaa1322c510067930e5e51e +Author: Damien Miller +Date: Fri Mar 31 14:17:22 2023 +1100 - upstream: Fix comment typo. + don't call connect() on negative socket - OpenBSD-Regress-ID: 3b04faced6511bb5e74648c6a4ef4bf2c4decf03 + Coverity CID 405037 -commit ce3c3e78ce45d68a82c7c8dc89895f297a67f225 -Author: Darren Tucker -Date: Wed Dec 7 18:58:25 2022 +1100 +commit 34ee842cdd981a759fe8f0d4a37521f9a1c63170 +Author: djm@openbsd.org +Date: Thu Mar 30 03:05:01 2023 +0000 - Add SANDBOX_DEBUG to the kitchensink test build. + upstream: return SSH_ERR_KEY_NOT_FOUND if the allowed_signers file + + is empty, not SSH_ERR_INTERNAL_ERROR. Also remove some dead code spotted + by Coverity; with/ok dtucker@ + + OpenBSD-Commit-ID: 898a1e817cda9869554b1f586a434f67bcc3b650 -commit bc234605fa3eb10f56bf0d74c8ecb0d91ada9d05 -Author: Damien Miller -Date: Wed Dec 7 18:38:25 2022 +1100 +commit f108e77a9dc9852e72215af1bf27731c48434557 +Author: dtucker@openbsd.org +Date: Thu Mar 30 00:49:37 2023 +0000 - disable SANDBOX_SECCOMP_FILTER_DEBUG + upstream: Remove dead code from inside if block. - It was mistakenly enabled in 2580916e4872 + The only way the if statement can be true is if both dup()s fail, and + in that case the tmp2 can never be set. Coverity CID 291805, ok djm@ - Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net + OpenBSD-Commit-ID: c0d6089b3fb725015462040cd94e23237449f0c8 -commit b087c5cfa011b27992e01589314fec830266f99d -Author: Rose <83477269+AtariDreams@users.noreply.github.com> -Date: Tue Nov 29 15:12:54 2022 -0500 +commit 05b8e88ebe23db690abbfb1a91111abea09cde08 +Author: Darren Tucker +Date: Thu Mar 30 13:53:29 2023 +1100 - Update autotools + child_set_eng: verify both env pointer and count. - Regenerate config files using latest autotools + If child_set env was called with a NULL env pointer and a non-zero count + it would end up in a null deref, although we don't currently do this. + Prompted by Coverity CID 291850, tweak & ok djm@ -commit d63f5494978a185c7421d492b9c2f6f05bb54138 -Author: Darren Tucker -Date: Tue Dec 6 12:22:36 2022 +1100 +commit 28f1b8ef9b84b8cd2f6c9889a0c60aa4a90dadfa +Author: dtucker@openbsd.org +Date: Wed Mar 29 01:07:48 2023 +0000 - Fix typo in comment. Spotted by tim@ + upstream: Ignore return from sshpkt_disconnect + + since we set our own return value for the function. Coverity CID 291797, + ok djm@ + + OpenBSD-Commit-ID: 710b57ba954c139240895e23feea41f203201f04 -commit 73dcca12115aa12ed0d123b914d473c384e52651 +commit c3da05d95922f5550bcc7815e799474d6a160175 Author: dtucker@openbsd.org -Date: Sun Dec 4 11:03:11 2022 +0000 +Date: Wed Mar 29 00:59:08 2023 +0000 - upstream: Remove duplicate includes. + upstream: Plug potential mem leak in process_put. - Patch from AtariDreams via github PR#364. + It allocates abs_dst inside a loop but only frees it on exit, so free + inside the loop if necessary. Coverity CID 291837, ok djm@ - OpenBSD-Commit-ID: b9186638a05cb8b56ef7c0de521922b6723644ea + OpenBSD-Commit-ID: a01616503a185519b16f00dde25d34ceaf4ae1a3 -commit 3cec15543010bc8d6997d896b1717a650afb7e92 +commit 13ae327eae598b1043e5ec30e4b170edb3c898a5 Author: djm@openbsd.org -Date: Fri Dec 2 04:40:27 2022 +0000 +Date: Wed Mar 29 00:18:35 2023 +0000 - upstream: make struct sshbuf private + upstream: fix memory leak; Coverity CID 291848 - and remove an unused field; ok dtucker + with/ok dtucker@ - OpenBSD-Commit-ID: c7a3d77c0b8c153d463398606a8d57569186a0c3 + OpenBSD-Commit-ID: 37f80cb5d075ead5a00ad1b74175684ab1156ff8 -commit 5796bf8ca9535f9fa7d01829a540d2550e05c860 -Author: Darren Tucker -Date: Fri Dec 2 11:43:36 2022 +1100 +commit 9ffa76e1284c85bf459c3dcb8e995733a8967e1b +Author: dtucker@openbsd.org +Date: Tue Mar 28 07:44:32 2023 +0000 - Restore ssh-agent permissions on exit. + upstream: Plug more mem leaks in sftp by making - ...enough that subsequent builds can overwrite ssh-agent if necessary. + make_absolute_pwd_glob work in the same way as make_absolute: you + pass it a dynamically allocated string and it either returns it, or + frees it and allocates a new one. Patch from emaste at freebsd.org and + https://reviews.freebsd.org/D37253 ok djm@ + + OpenBSD-Commit-ID: 85f7404e9d47fd28b222fbc412678f3361d2dffc -commit ccf5a13868cbb4659107458cac1e017c98abcbda +commit 82b2b8326962b1a98af279bc5bbbbbcab15b3e45 Author: dtucker@openbsd.org -Date: Thu Dec 1 02:22:13 2022 +0000 +Date: Tue Mar 28 06:12:38 2023 +0000 - upstream: Clean up ssh-add and ssh-agent logs. + upstream: Remove compat code for OpenSSL < 1.1.* - OpenBSD-Regress-ID: 9eda8e4c3714d7f943ab2e73ed58a233bd29cd2c + since -portable no longer supports them. + + OpenBSD-Commit-ID: ea2893783331947cd29a67612b4e56f818f185ff -commit 7a8b40cf6a5eda80173140cc6750a6db8412fa87 +commit b500afcf00ae1b6b73b2ccf171111dfbfeaef74d Author: dtucker@openbsd.org -Date: Thu Dec 1 02:19:29 2022 +0000 +Date: Mon Mar 27 23:56:54 2023 +0000 - upstream: Log output of ssh-agent and ssh-add + upstream: Remove compat code for OpenSSL 1.0.* - This should make debugging easier. + versions now that -portable has dropped support for those versions. - OpenBSD-Regress-ID: 5974b02651f428d7e1079b41304c498ca7e306c8 + OpenBSD-Regress-ID: 82a8eacd87aec28e4aa19f17246ddde9d5ce7fe7 -commit 4a1805d532616233dd6072e5cd273b96dd3062e6 -Author: dtucker@openbsd.org -Date: Tue Nov 29 22:41:14 2022 +0000 +commit 727560e6011efcb36d2f3ac6910444bc775abaa1 +Author: Darren Tucker +Date: Tue Mar 28 18:06:42 2023 +1100 - upstream: Add void to client_repledge args to fix compiler warning. ok djm@ + Prevent conflicts between Solaris SHA2 and OpenSSL. - OpenBSD-Commit-ID: 7e964a641ce4a0a0a11f047953b29929d7a4b866 + We used to prevent conflicts between native SHA2 headers and OpenSSL's + by setting OPENSSL_NO_SHA but that was removed prior to OpenSSL 1.1.0 -commit 815c4704930aa449edf6e812e99d69e9ffd31f01 -Author: djm@openbsd.org -Date: Mon Nov 28 01:38:22 2022 +0000 +commit 46db8e14b7f186d32173dcdecd5b785334429b8b +Author: Darren Tucker +Date: Tue Mar 28 12:44:03 2023 +1100 - upstream: tighten pledge(2) after session establishment + Remove HEADER_SHA_H from previous... - feedback, ok & testing in snaps deraadt@ + since it causes more problems than it solves. + +commit 72bd68d37387aa5f81da928f6e82f1c88ed8f674 +Author: Darren Tucker +Date: Tue Mar 28 10:35:18 2023 +1100 + + Replace OPENSSL_NO_SHA with HEADER_SHA_H. - OpenBSD-Commit-ID: aecf4d49d28586dfbcc74328d9333398fef9eb58 + Since this test doesn't use OpenSSL's SHA2 and may cause conflicts we + don't want to include it, but OPENSSL_NO_SHA was removed beginning in + OpenSSL's 1.1 series. -commit f7cebbbf407d772ed71403d314343766782fe540 -Author: djm@openbsd.org -Date: Mon Nov 28 01:37:36 2022 +0000 +commit 99668f2e6e0deb833e46cfab56db59ff0fc28c7e +Author: Darren Tucker +Date: Tue Mar 28 09:50:06 2023 +1100 - upstream: New EnableEscapeCommandline ssh_config(5) option + Configure with --target instead of deprecated form. + +commit f751d9306c62cd1061f966e6a7483d9bab9c379b +Author: Darren Tucker +Date: Mon Mar 27 22:05:29 2023 +1100 + + Pass rpath when building 64bit Solaris. + +commit a64b935cd450ee8d04c26c9cd728629cf9ca5c91 +Author: Darren Tucker +Date: Mon Mar 27 19:21:19 2023 +1100 + + Explicitly disable OpenSSL on AIX test VM. + +commit 7ebc6f060fc2f70495a56e16d210baae6424cd96 +Author: dtucker@openbsd.org +Date: Mon Mar 27 03:56:50 2023 +0000 + + upstream: Add RevokedHostKeys to percent expansion test. - This option (default "no") controls whether the ~C escape is available. - Turning it off by default means we will soon be able to use a stricter - default pledge(2) in the client. + OpenBSD-Regress-ID: c077fd12a38005dd53d878c5b944154dec88d2ff + +commit f1a17de150f8d309d0c52f9abfaebf11c51a8537 +Author: dtucker@openbsd.org +Date: Mon Mar 27 03:56:11 2023 +0000 + + upstream: Add tilde and environment variable expansion to - feedback deraadt@ dtucker@; tested in snaps for a while + RevokedHostKeys. bz#3552, ok djm@ - OpenBSD-Commit-ID: 7e277595d60acb8263118dcb66554472257b387a + OpenBSD-Commit-ID: ce5d8e0219b63cded594c17d4c2958c06918ec0d -commit d323f7ecf52e3d4ec1f4939bf31693e02f891dca -Author: mbuhl@openbsd.org -Date: Fri Nov 18 19:47:40 2022 +0000 +commit 009eb4cb48a9708ab9174684dcbcc0f942907abe +Author: djm@openbsd.org +Date: Mon Mar 27 03:31:05 2023 +0000 - upstream: In channel_request_remote_forwarding the parameters for + upstream: fix test: getnameinfo returns a non-zero value on error, not - permission_set_add are leaked as they are also duplicated in the call. Found - by CodeChecker. ok djm + (neccessarily) -1. From GHPR#384 - OpenBSD-Commit-ID: 4aef50fa9be7c0b138188814c8fe3dccc196f61e + OpenBSD-Commit-ID: d35e2b71268f66f5543a7ea68751972b3ae22b25 -commit 62cc33e6eed847aafdc29e34aa69e9bd82a0ee16 -Author: Darren Tucker -Date: Wed Nov 30 11:23:11 2022 +1100 +commit 4f0a676486700f10a4788f7e9426e94e39c1c89e +Author: djm@openbsd.org +Date: Mon Mar 27 03:25:08 2023 +0000 - Use -fzero-call-used-regs=used on clang 15. + upstream: scp: when copying local->remote, check that source file - clang 15 seems to have a problem with -fzero-call-used-reg=all which - causes spurious "incorrect signature" failures with ED25519. On those - versions, use -fzero-call-used-regs=used instead. (We may add exceptions - later if specific versions prove to be OK). Also move the GCC version - check to match. + exists before opening SFTP connection to the server. Based on GHPR#370 ok + dtucker, markus - Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround - suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@ + OpenBSD-Commit-ID: b4dd68e15bfe22ce4fac9960a1066a2b721e54fb -commit f84b9cffd52c9c5c359a54a1929f9948e803ab1d +commit 154d8baf631327163571760c2c524bc93c37567c Author: Darren Tucker -Date: Mon Nov 28 21:09:28 2022 +1100 +Date: Mon Mar 27 12:22:30 2023 +1100 - Skip unit tests on slow riscv64 hardware. + Also look for gdb error message from OpenIndiana. -commit 9f2747e0bed3faca92679eae69aef10c95dc82f5 +commit fbd3811ddb2b6ce2e6dba91fde7352c8978e5412 Author: Darren Tucker -Date: Sun Nov 27 15:26:22 2022 +1100 +Date: Mon Mar 27 11:08:00 2023 +1100 - Rework how selfhosted tests interact with runners. - - Previously there was one runner per test target (mostly VMs). This had - a few limitations: - - multiple tests that ran on the same target (eg multiple build - configs) were serialized on availability or that runner. - - it needed manual balancing of VMs over host machines. - - To address this, make VMs that use ephemeral disks (ie most of them) - all use a pool of runners with the "libvirt" label. This requires that - we distinguish between "host" and "target" for those. Native runners - and VMs with persistent disks (eg the constantly-updated snapshot ones) - specify the same host and target. + Explicitly disable security key test on aix51 VM. - This should improve test throughput. + We don't know how to build the shared objects required for the security + key tests so skip them. -commit d664ddaec87bdc7385be8ef7f1337793e1679d48 +commit 4922ac3be8a996780ef3dc220411da2e27c29d9c Author: Darren Tucker -Date: Sun Nov 27 12:19:37 2022 +1100 +Date: Sun Mar 26 14:49:43 2023 +1100 - Run vmstartup from temp dir. + Split libcrypto and other config flags. - This will allow us to create ephemeral disk images per-runner. + This should allow the automatic OpenSSL version selection in the tests + to work better. -commit 0fa16e952b1fc1c4cf65e3dd138b0e87003e2e45 +commit 4a948b1469f185e871160a2d70e2a0fce2858f9e Author: Darren Tucker -Date: Sun Nov 27 12:14:00 2022 +1100 +Date: Sun Mar 26 14:39:45 2023 +1100 - Make "config" in matrix singular and pass in env. + Specify test target if we build without OpenSSL. - This will allow the startup scripts to adapt their behaviour based on - the type and config. - -commit e8857043af54809187be1e8b06749db61112899f -Author: Darren Tucker -Date: Sun Nov 27 11:42:22 2022 +1100 - - Add "libvirt" label to dfly30. + When we decide we can't use the versions of OpenSSL available, also + restrict the tests we run to avoid the ones that need OpenSSL. -commit 9775473d84902dc37753686cd10ae71fbe67efda +commit b308c636f5b5d89eecb98be00b3d56306a005a09 Author: Darren Tucker -Date: Sun Nov 27 09:28:20 2022 +1100 +Date: Sun Mar 26 14:22:53 2023 +1100 - Rename "os" in matrix to "target". + Find suitable OpenSSL version. - This is in preparation to distinguish this from the host that the runner - runs on in case where they are separate (eg VMs). + Check the installed OpenSSL versions for a suitable one, and if there + isn't (and we don't have a specific version configured) then build + without OpenSSL. -commit 04fd00ceff39f4544ced6f5342060abe584835d0 -Author: Darren Tucker -Date: Sun Nov 27 09:23:04 2022 +1100 +commit 021ea5c2860f133f44790970968e0e73208b3a87 +Author: Damien Miller +Date: Fri Mar 24 15:02:52 2023 +1100 - Remove unused self-hosted test targets. + Github testing support for BoringSSL -commit c9d9fcad2a11c1cd1550a541f44091d65f0b5584 -Author: Darren Tucker -Date: Sun Nov 27 09:16:15 2022 +1100 +commit 9a97cd106466a2a9bda2bfaa4c48c4f1b2cc9c1b +Author: Damien Miller +Date: Fri Mar 24 15:34:29 2023 +1100 - Remove explicit "default" test config argument. + BoringSSL doesn't support EC_POINT_point2bn() - Not specifying the test config implicitly selects default args. + so don't invoke it in unittest -commit 15a01cf15f396f87c6d221c5a6af98331c818962 -Author: Darren Tucker -Date: Wed Nov 23 13:18:54 2022 +1100 +commit cc5969c033a032d126ff78e5d95cf20abbede4c7 +Author: Damien Miller +Date: Fri Mar 24 15:34:05 2023 +1100 - Add fallback for old platforms w/out MAP_ANON. + another ERR_load_CRYPTO_strings() vestige -commit 6b9bbbfe8b26db6e9a30a7e08c223e85421aed98 -Author: Darren Tucker -Date: Wed Nov 23 13:09:11 2022 +1100 +commit 4974293899a068133e976f81d6693670d2b576ca +Author: Damien Miller +Date: Fri Mar 24 15:24:05 2023 +1100 - If we haven't found it yet, recheck for sys/stat.h. + don't use obsolete ERR_load_CRYPTO_strings() - On some very old platforms, sys/stat.h needs sys/types.h, however - autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the - opposite order, which in combination with modern autoconf's - "present but cannot be compiled" behaviour causes it to not be - detected. + OpenSSL (and elsewhere in OpenSSH) uses ERR_load_crypto_strings() -commit 8926956f22639132a9f2433fcd25224e01b900f5 -Author: Darren Tucker -Date: Fri Nov 11 11:25:37 2022 +1100 +commit 3c527d55f906e6970d17c4cab6db90ae9e013235 +Author: Damien Miller +Date: Fri Mar 24 15:23:05 2023 +1100 - Add dfly62 test target. + Allow building with BoringSSL -commit 650de7ecd3567b5a5dbf16dd1eb598bd8c20bca8 -Author: dtucker@openbsd.org -Date: Thu Nov 10 23:03:10 2022 +0000 +commit b7e27cfd7f163fc16b4c5d041cc28ee488a5eeec +Author: Damien Miller +Date: Fri Mar 24 15:21:18 2023 +1100 - upstream: Handle dynamic remote port forwarding in escape commandline's - - -R processing. bz#3499, ok djm@ + put back SSLeay_version compat in configure test - OpenBSD-Commit-ID: 194ee4cfe7ed0e2b8ad0727f493c798a50454208 + Needed to detect old versions and give good "your version is bad" + messages at configure time; spotted by dtucker@ -commit 5372db7e7985ba2c00f20fdff8942145ca99e033 -Author: Darren Tucker -Date: Thu Nov 10 12:44:51 2022 +1100 +commit 7280401bdd77ca54be6867a154cc01e0d72612e0 +Author: Damien Miller +Date: Fri Mar 24 13:56:25 2023 +1100 - Remove seed passing over reexec. + remove support for old libcrypto - This was added for the benefit of platforms using ssh-rand-helper to - prevent a delay on each connection as sshd reseeded itself. + OpenSSH now requires LibreSSL 3.1.0 or greater or + OpenSSL 1.1.1 or greater - ssh-random-helper is long gone, and since the re-exec happens before the - chroot the re-execed sshd can reseed itself normally. ok djm@ + with/ok dtucker@ -commit ca98d3f8c64cfc51af81e1b01c36a919d5947ec2 +commit abda22fb48302f2142233f71d27c74040288c518 Author: Darren Tucker -Date: Wed Nov 9 20:59:20 2022 +1100 +Date: Sun Mar 19 15:36:13 2023 +1100 - Skip reexec test on OpenSSL 1.1.1 specifically. - - OpenSSL 1.1.1 has a bug in its RNG that breaks reexec fallback, so skip - that test. See bz#3483 for details. + Test latest OpenSSL 1.1, 3.0 and LibreSSL 3.7. -commit 5ec4ebc2548e5f7f1b55b2a5cef5b67bdca8146f -Author: dtucker@openbsd.org -Date: Wed Nov 9 09:04:12 2022 +0000 +commit 610ac1cb077cd5a1ebfc21612154bfa13d2ec825 +Author: Darren Tucker +Date: Thu Mar 16 21:38:04 2023 +1100 - upstream: Fix typo in fatal error message. - - Patch from vapier at chromium.org. + Show 9.3 branch instead of 9.2. + +commit cb30fbdbee869f1ce11f06aa97e1cb8717a0b645 +Author: Damien Miller +Date: Thu Mar 16 08:28:19 2023 +1100 + + depend + +commit 1dba63eb10c40b6fda9f5012ed6ae87e2d3d028e +Author: Damien Miller +Date: Thu Mar 16 08:27:54 2023 +1100 + + crank version + +commit ba7532d0dac9aaf0ad7270664c43837fc9f64a5f +Author: djm@openbsd.org +Date: Wed Mar 15 21:19:57 2023 +0000 + + upstream: openssh-9.3 - OpenBSD-Commit-ID: 8a0c164a6a25eef0eedfc30df95bfa27644e35cf + OpenBSD-Commit-ID: 8011495f2449c1029bb316bd015eab2e00509848 -commit e6abafe9a6d809422d3432b95b3f9747b0acaa71 +commit 6fd4daafb949b66bf555f3100f715a9ec64c3390 Author: dtucker@openbsd.org -Date: Wed Nov 9 09:01:52 2022 +0000 +Date: Tue Mar 14 07:28:47 2023 +0000 - upstream: Remove errant colon and simplify format + upstream: Free KRL ptr in addition to its contents. - string in error messages. Patch from vapier at chromium.org. + From Coverity CID 291841, ok djm@ - OpenBSD-Commit-ID: fc28466ebc7b74e0072331947a89bdd239c160d3 + OpenBSD-Commit-ID: f146ba08b1b43af4e0d7ad8c4dae3748b4fa31b6 -commit db2027a687516f87c3fb141e87154bb3d8a7807c -Author: djm@openbsd.org -Date: Wed Nov 9 01:37:44 2022 +0000 +commit 1d270bd303afaf6d94e9098cbbf18e5e539e2088 +Author: dtucker@openbsd.org +Date: Tue Mar 14 07:26:25 2023 +0000 - upstream: rename client_global_hostkeys_private_confirm() to + upstream: Check pointer for NULL before deref. - client_global_hostkeys_prove_confirm(), as it handles the - "hostkeys-prove00@openssh.com" message; no functional change + None of the existing callers seem to do that, but it's worth checking. + From Coverity CID 291834, ok djm@ - OpenBSD-Commit-ID: 31e09bd3cca6eed26855b88fb8beed18e9bd026d + OpenBSD-Commit-ID: a0a97113f192a7cb1a2c97b932f677f573cda7a4 -commit 1c2be7c2004cf1abcd172fee9fe3eab57cd4c426 -Author: djm@openbsd.org -Date: Wed Nov 9 00:15:59 2022 +0000 +commit d95af508e78c0cd3dce56b83853baaa59ae295cf +Author: dtucker@openbsd.org +Date: Sun Mar 12 10:40:39 2023 +0000 - upstream: typo in comment + upstream: Limit number of entries in SSH2_MSG_EXT_INFO - OpenBSD-Commit-ID: 39c58f41e0f32d1ff31731fa6f5bbbc3ad25084a - -commit cf1a9852d7fc93e4abc4168aed09529a57427cdc -Author: Darren Tucker -Date: Wed Nov 9 09:23:47 2022 +1100 - - Defer seed_rng until after closefrom call. + request. This is already constrained by the maximum SSH packet size but this + makes it explicit. Prompted by Coverity CID 291868, ok djm@ markus@ - seed_rng will initialize OpenSSL, and some engine providers (eg Intel's - QAT) will open descriptors for their own use. bz#3483, patch from - joel.d.schuetze at intel.com, ok djm@ + OpenBSD-Commit-ID: aea023819aa44a2dcb9dd0fbec10561896fc3a09 -commit dffa64480163fbf76af7e4fb62c26bb0dd6642aa -Author: Darren Tucker -Date: Wed Nov 9 08:27:47 2022 +1100 +commit 8f287ba60d342b3e2f750e7332d2131e3ec7ecd0 +Author: dtucker@openbsd.org +Date: Sun Mar 12 09:41:18 2023 +0000 - Fix comment text. From emaste at freebsd.org. + upstream: calloc can return NULL but xcalloc can't. + + From Coverity CID 291881, ok djm@ + + OpenBSD-Commit-ID: 50204b755f66b2ec7ac3cfe379d07d85ca161d2b -commit d9df5689c29823ab830ec4f54c83c6cc3c0077ad -Author: Pierre Ossman -Date: Wed Jul 6 13:52:10 2022 +0200 +commit 83a56a49fd50f4acf900f934279482e4ef329715 +Author: dtucker@openbsd.org +Date: Fri Mar 10 07:17:08 2023 +0000 - Avoid assuming layout of fd_set + upstream: Explicitly ignore return from fcntl - POSIX doesn't specify the internal layout of the fd_set object, so let's - not assume it is just a bit mask. This increases compatibility with - systems that have a different layout. + (... FD_CLOEXEC) here too. Coverity CID 291853. - The assumption is also worthless as we already refuse to use file - descriptors over FD_SETSIZE anyway. Meaning that the default size of - fd_set is quite sufficient. + OpenBSD-Commit-ID: 99d8b3da9d0be1d07ca8dd8e98800a890349e9b5 -commit 419aa8a312e8d8f491933ca3d5933e602cb05aae -Author: Darren Tucker -Date: Tue Nov 8 12:42:52 2022 +1100 +commit 0fda9d704d3bbf54a5e64ce02a6fecb11fe7f047 +Author: Damien Miller +Date: Fri Mar 10 15:59:46 2023 +1100 - Shutdown any VM before trying to check out repo. + bounds checking for getrrsetbyname() replacement; - In the case where the previous run did not clean up, the checkout will - fail as it'll leave a stale mount. + Spotted by Coverity in CID 405033; ok millert@ -commit a32c07cbb78f65d8527642b96474a83b413f8108 -Author: Darren Tucker -Date: Tue Nov 8 11:33:25 2022 +1100 +commit 89b8df518f21677045599df0ad3e5dd0f39909b5 +Author: dtucker@openbsd.org +Date: Fri Mar 10 04:06:21 2023 +0000 - Run vm startup and shutdown from runner temp dir. + upstream: Plug mem leak on error path. Coverity CID 405026, ok djm@. - Should work even if the github workspace dir is on a stale sshfs mount. + OpenBSD-Commit-ID: 8212ca05d01966fb5e72205c592b2257708a2aac -commit 2b40a7dfcdb8e616155b9504145aa52b271455aa +commit bf4dae0ad192c3e2f03f7223834b00d88ace3d3e Author: Darren Tucker -Date: Tue Nov 8 11:03:31 2022 +1100 +Date: Fri Mar 10 14:46:57 2023 +1100 - Add valrind-5 test here too. + Add prototypes for mkstemp replacements. + + Should prevent warnings due to our wrapper function. -commit 2ea03d1f6d0a05ee2b63ed2dc0f2d54f1e4655a1 -Author: Darren Tucker -Date: Tue Nov 8 09:21:10 2022 +1100 +commit 4e04d68d6a33cdc73b831fd4b5e6124175555d3d +Author: dtucker@openbsd.org +Date: Fri Mar 10 03:01:51 2023 +0000 - Update checkout and upload actions. + upstream: Expliticly ignore return code from fcntl(.. FD_CLOEXEC) since - Update actions/checkout and actions/upload-artifact to main branch for - compatibility with node.js v16. + there's not much we can do anyway. From Coverity CID 291857, ok djm@ + + OpenBSD-Commit-ID: 051429dd07af8db3fec10d82cdc78d90bb051729 -commit 4e316ff0f18a118232bb9ac6512ee62773a9e8ea -Author: Darren Tucker -Date: Tue Nov 8 09:17:04 2022 +1100 +commit d6d38fd77cbe091c59e1bb720c3a494df4990640 +Author: djm@openbsd.org +Date: Fri Mar 10 02:32:04 2023 +0000 - Split out rekey test since it runs the longest. + upstream: Like sshd_config, some ssh_config options are not + + first-match-wins. sshd_config.5 was fixed in r1.348, this is the same for + this file + + OpenBSD-Commit-ID: 7be55b9351cde449b136afcc52d07aa4113b215e -commit 21625a6424258a92a96a3bb73ae6aabc5ed8a6b4 +commit 7187d3f86bf8f2066cc9941f217d23b0cacae25e Author: dtucker@openbsd.org -Date: Mon Nov 7 10:09:28 2022 +0000 +Date: Fri Mar 10 02:24:56 2023 +0000 - upstream: The IdentityFile option in ssh_config can also be used to + upstream: Remove no-op (int) > INT_MAX checks - specify a public key file, as documented in ssh.1 for the -i option. Document - this also for IdentityFile in ssh_config.5, for documentation completeness. - From laalsaas at systemli.org via portable github PR#352, ok jmc@ djm@ + since they can never be true. From Coverity CID 405031, ok djm@ - OpenBSD-Commit-ID: 2f943be9f96e60ef81a9a4faa25b009999f9883b + OpenBSD-Commit-ID: 9df3783b181e056595e2bb9edf7ed41d61cf8e84 -commit 747691604d3325ed2b62bad85b6fd8563ad32f6c -Author: dtucker@openbsd.org -Date: Mon Nov 7 10:05:38 2022 +0000 +commit 77adde4305542ebe3005dd456122624fe2347b01 +Author: Darren Tucker +Date: Fri Mar 10 13:27:29 2023 +1100 - upstream: Remove some set but otherwise unused variables, spotted + Wrap mkstemp calls with umask set/restore. - in -portable by clang 16's -Wunused-but-set-variable. ok djm@ + glibc versions 2.06 and earlier did not set a umask on files created by + mkstemp created the world-writable. Wrap mkstemp to set and restore + the umask. From Coverity (CIDs 291826 291886 291891), ok djm@ + +commit 633d3dc2a1e9e2a013d019a0576a0771c8423713 +Author: jcs@openbsd.org +Date: Thu Mar 9 21:06:24 2023 +0000 + + upstream: modify parentheses in conditionals to make it clearer what is - OpenBSD-Commit-ID: 3d943ddf2369b38fbf89f5f19728e7dc1daf3982 + being assigned and what is being checked + + ok djm dtucker + + OpenBSD-Commit-ID: 19c10baa46ae559474409f75a5cb3d0eade7a9b8 -commit 1d78d25653805aefc7a8dd9d86cd7359ada3823c +commit 733030840c4772f858de95d5940ec0c37663e8b0 Author: dtucker@openbsd.org -Date: Mon Nov 7 10:02:59 2022 +0000 +Date: Thu Mar 9 07:11:05 2023 +0000 - upstream: Check for and disallow MaxStartups values less than or + upstream: Re-split the merge of the reorder-hostkeys test. - equal to zero during config parsing, rather than faling later at runtime. - bz#3489, ok djm@ + In the kex_proposal_populate_entries change I merged the the check for + reordering hostkeys with the actual reordering, but kex_assemble_names + mutates options.hostkeyalgorithms which renders the check ineffective. + Put the check back where it was. Spotted and tested by jsg@, ok djm@ - OpenBSD-Commit-ID: d79c2b7a8601eb9be493629a91245d761154308b + OpenBSD-Commit-ID: a7469f25a738db5567395d1881e32479a7ffc9de -commit a00f59a645072e5f5a8d207af15916a7b23e2642 +commit 54ac4ab2b53ce9fcb66b8250dee91c070e4167ed Author: djm@openbsd.org -Date: Mon Nov 7 04:04:40 2022 +0000 +Date: Thu Mar 9 06:58:26 2023 +0000 - upstream: fix parsing of hex cert expiry time; was checking whether the - - start time began with "0x", not the expiry time. + upstream: include destination constraints for smartcard keys too. - from Ed Maste + Spotted by Luci Stanescu; ok deraadt@ markus@ - OpenBSD-Commit-ID: 6269242c3e1a130b47c92cfca4d661df15f05739 + OpenBSD-Commit-ID: add879fac6903a1cb1d1e42c4309e5359c3d870f -commit f58acaf8c7315483f4ac87d46a1aa2142a713cd8 +commit bfd1ad01d974a316b60622759ad17537fa2d92b4 Author: Darren Tucker -Date: Mon Nov 7 15:10:59 2022 +1100 +Date: Thu Mar 9 18:24:54 2023 +1100 - Fix merge conflict. + Limit the number of PAM environment variables. + + xcalloc has its own limits, but these are specific to PAM. From + Coverity CID 405198, ok djm@ -commit 162e5741020a8d996c0c12b988b118e71ed728e6 +commit a231414970e01a35f45a295d5f93698fa1249b28 Author: Darren Tucker -Date: Mon Nov 7 15:04:33 2022 +1100 +Date: Thu Mar 9 18:19:44 2023 +1100 - Branch-specific links for master status badges. + Limit the number of PAM environment variables. + + From Coverity CID 405194, tweaks and ok djm@ -commit e4b7c12ab24579312aa3ed38ce7041a439ec2d56 -Author: Darren Tucker -Date: Mon Nov 7 14:46:38 2022 +1100 +commit 36c6c3eff5e4a669ff414b9daf85f919666e8e03 +Author: dtucker@openbsd.org +Date: Wed Mar 8 06:21:32 2023 +0000 - Add CIFuzz status badge. + upstream: Plug mem leak. Coverity CID 405196, ok djm@ + + OpenBSD-Commit-ID: 175f09349387c292f626da68f65f334faaa085f2 -commit b496b9f831acd1e5bcd875e26e797488beef494a -Author: Darren Tucker -Date: Mon Nov 7 14:45:16 2022 +1100 +commit dfb9b736e1ccf9e6b03eea21cd961f4fd0634c98 +Author: tb@openbsd.org +Date: Wed Mar 8 05:33:53 2023 +0000 - Do not run CIFuzz on selfhosted tree. + upstream: ssh-pkcs11: synchronize error messages with errors - We already run it on the regular tree, no need to double up. + A handful of error messages contained incorrect function names or + otherwise inaccurate descriptions. Fix them to match reality. + + input/ok djm + + OpenBSD-Commit-ID: 165a15db52f75b31e1804b043480c36af09f3411 -commit 2138b1c4ddb300129a41a5104627b0d561184c7b -Author: Darren Tucker -Date: Mon Nov 7 14:41:58 2022 +1100 +commit 51875897b81b5c21b80c256a29597916edbde454 +Author: guenther@openbsd.org +Date: Wed Mar 8 04:43:12 2023 +0000 - Whitespace change to trigger CIFuzz workflow. + upstream: Delete obsolete /* ARGSUSED */ lint comments. + + ok miod@ millert@ + + OpenBSD-Commit-ID: 7be168a570264d59e96a7d2d22e927d45fee0e4c -commit 4670b97ef87c7b0f21283c9b07c7191be88dda05 +commit a76085bda883c2104afb33ab0334eca190927362 Author: Darren Tucker -Date: Mon Nov 7 14:34:04 2022 +1100 +Date: Wed Mar 8 17:25:37 2023 +1100 - Run cifuzz workflow on the actions as regular CI. + Extra brackets to prevent warning. -commit 79391e66ce851ace1baf3c6a35e83a23f08ec2ba -Author: David Korczynski -Date: Tue Nov 30 11:45:20 2021 +0000 +commit 147ae57d4dfa0508109f93b78a7d8b92819e1f83 +Author: djm@openbsd.org +Date: Wed Mar 8 00:05:58 2023 +0000 - Add CIFuzz integration + upstream: use RSA/SHA256 when testing usability of private key in + + agent; with/ok dtucker + + OpenBSD-Commit-ID: fe1382e2fdf23fcae631308e72342bad56066a56 -commit c1893364a0be243270014d7d34362a8101d55112 -Author: dtucker@openbsd.org -Date: Mon Nov 7 02:21:22 2022 +0000 +commit 27fd251bc906a763e70ce0f27c8abdf8bbd1e416 +Author: djm@openbsd.org +Date: Wed Mar 8 00:05:37 2023 +0000 - upstream: Import regenerated moduli. + upstream: use RSA/SHA256 when testing usability of private key; - OpenBSD-Commit-ID: b0e54ee4d703bd6929bbc624068666a7a42ecb1f + based on fix in bz3546 by Dmitry Belyavskiy; with/ok dtucker + + OpenBSD-Commit-ID: 0ef414cc363a832f9fab92a5da0234448bce2eba -commit 5c3f18fb994ef27e685b205ee2351851b80fdbd1 -Author: dtucker@openbsd.org -Date: Mon Nov 7 01:53:01 2022 +0000 +commit eee9f3fc3d52ae7d2106929bb06b7f291fb0b81a +Author: djm@openbsd.org +Date: Tue Mar 7 21:47:42 2023 +0000 - upstream: Fix typo. From pablomh via -portable github PR#344. + upstream: refactor to be more readable top to bottom. Prompted by - OpenBSD-Commit-ID: d056ee2e73691dc3ecdb44a6de68e6b88cd93827 + Coverity CID 405048 which was a false-positive fd leak; ok dtucker@ + + OpenBSD-Commit-ID: fc55ec2af622a017defb9b768bf26faefc792c00 -commit e1c6fcc142066417c9832e634463faa3dd5d116c +commit 42a06b29a4c99272bf690f9b3be520b08b448dc5 Author: Darren Tucker -Date: Mon Nov 7 12:46:58 2022 +1100 +Date: Tue Mar 7 18:34:41 2023 +1100 - Link to branch-specific queries for V_9_1 status. + Add header changes missed in previous. -commit 4f4a5fad6d8892c3f8ee9cd81ec7de6458210c9f -Author: Darren Tucker -Date: Sun Nov 6 10:55:59 2022 +1100 +commit 4710077096edff2e6926dd5b15bf586491d317db +Author: dtucker@openbsd.org +Date: Tue Mar 7 06:09:14 2023 +0000 - Use "prohibit-password" in -portable comments. + upstream: Fix mem leak in environment setup. - "without-password" is the deprecated alias for "prohibit-password", - so we should reference the latter. From emaste at freebsd.org. + From jjelen at redhat.com via bz#2687, ok djm@ + + OpenBSD-Commit-ID: 9f9e4ba3cac003e6f81da3bcebd1b9ec43e7f353 -commit 0f7e1eba55259ec037f515000b4c4afbf446230a -Author: Darren Tucker -Date: Sun Nov 6 10:50:01 2022 +1100 +commit 03acc50d0ccb78fc91d1570de1cd0fdfea646028 +Author: dtucker@openbsd.org +Date: Mon Mar 6 12:15:47 2023 +0000 - Fix tracing disable on FreeBSD. + upstream: Unit test for kex_proposal_populate_entries. - Some versions of FreeBSD do not support using id 0 to refer to the - current pid for procctl, so pass getpid() explicitly. From - emaste at freebsd.org. + OpenBSD-Regress-ID: bdb211d80d572a08bf14b49fe2a58b9ff265c006 -commit 32fddb982fd61b11a2f218a115975a87ab126d43 -Author: Darren Tucker -Date: Mon Nov 7 10:39:01 2022 +1100 +commit 3f9231c2e1f374ebb08016ba00ea97b47c0ed20b +Author: djm@openbsd.org +Date: Tue Mar 7 05:37:26 2023 +0000 - Fix setres*id checks to work with clang-16. + upstream: fix memory leak in process_read() path; Spotted by James - glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE, - and clang 16 will error out on implicit function definitions, so add - _GNU_SOURCE and the required headers to the configure checks. From - sam at @gentoo.org via bz#3497. + Robinson in GHPR363; ok markus@ + + OpenBSD-Commit-ID: cdc2d98e6478b7e7f3a36976845adae3820429d8 -commit 12af712d116f42164bcfa56db901d06e4fa27199 -Author: Sam James -Date: Sun Nov 6 04:52:38 2022 +0000 +commit c5e6e890839ec520ab9301a92cba56303749dea2 +Author: djm@openbsd.org +Date: Tue Mar 7 01:30:52 2023 +0000 - configure.ac: Fix -Wstrict-prototypes + upstream: correct size for array argument when changing - Clang 16 now warns on this and it'll be removed in C23, so let's - just be future proof. It also reduces noise when doing general - Clang 16 porting work (which is a big job as it is). github PR#355. + UMAC_OUTPUT_LEN Coverity CID 291845; ok dtucker@ - Signed-off-by: Sam James + OpenBSD-Commit-ID: 2eb017d10705bb623d4418691f961c930eafaec0 -commit 40b0a5eb6e3edfa2886b60c09c7803353b0cc7f5 -Author: Sam James -Date: Sun Nov 6 04:47:35 2022 +0000 +commit 9641753e0fd146204d57b2a4165f552a81afade4 +Author: dtucker@openbsd.org +Date: Mon Mar 6 12:14:48 2023 +0000 - configure.ac: Add include for openpty + upstream: Refactor creation of KEX proposal. - Another Clang 16ish fix (which makes -Wimplicit-function-declaration - an error by default). github PR#355. + This adds kex_proposal_populate_entries (and corresponding free) which + populates the KEX proposal array with dynamically allocated strings. + This replaces the previous mix of static and dynamic that has been the + source of previous leaks and bugs. Remove unused compat functions. + With & ok djm@. - See: 2efd71da49b9cfeab7987058cf5919e473ff466b - See: be197635329feb839865fdc738e34e24afd1fca8 + OpenBSD-Commit-ID: f2f99da4aae2233cb18bf9c749320c5e040a9c7b -commit 6b17e128879ec6cc32ca2c28b5d894b4aa72e32d -Author: Rochdi Nassah -Date: Fri Oct 28 01:26:31 2022 +0100 +commit aa59d6a489fb20973fa461d0fdb1110db412947b +Author: dtucker@openbsd.org +Date: Sun Mar 5 09:24:35 2023 +0000 - Fix broken zlib link. + upstream: Fix mem and FILE leaks in moduli screening. + + If multiple -Ocheckpoint= options are passed, the earlier ones would + be overwritten and leaked. If we use an input file that wasn't stdin, + close that. From Coverity CIDs 291884 and 291894. + + OpenBSD-Commit-ID: a4d9d15f572926f841788912e2b282485ad09e8b -commit 99500df246ccb736ddbdd04160dcc82165d81a77 -Author: Darren Tucker -Date: Fri Nov 4 16:59:26 2022 +1100 +commit 23b8cb41767af99a1aac24589d1882d9c8c2c205 +Author: dtucker@openbsd.org +Date: Sun Mar 5 08:18:58 2023 +0000 - Don't run openbsd-compat tests on Cygwin. + upstream: Plug mem leak in moduli checkpoint option parsing. - Add "compat-tests" to the default TEST_TARGET so we can override as - necessary. Override TEST_TARGET for Cygwin as the tests don't currently - compile there. + From Coverity CID 291894. + + OpenBSD-Commit-ID: 9b1aba2d049741ae21c8dc4560a7e29ab17310f4 -commit 3cae9f92a31897409666aa1e6f696f779759332b -Author: djm@openbsd.org -Date: Thu Nov 3 21:59:20 2022 +0000 +commit fc7f8f2188d4a4fc8ba77eddbe863c7665666db5 +Author: dtucker@openbsd.org +Date: Sun Mar 5 05:34:09 2023 +0000 - upstream: replace recently-added valid_domain() check for hostnames + upstream: Remove unused compat.h includes. - going to known_hosts with a more relaxed check for bad characters; previous - commit broke address literals. Reported by/feedback from florian@ + We've previously removed a lot of the really old compatibility code, + and with it went the need to include compat.h in most of the files that + have it. - OpenBSD-Commit-ID: 10b86dc6a4b206adaa0c11b58b6d5933898d43e0 + OpenBSD-Commit-ID: 5af8baa194be00a3092d17598e88a5b29f7ea2b4 -commit 9655217231c9056200bea7ae2dffcc9c0c3eb265 -Author: Darren Tucker -Date: Thu Nov 3 23:07:50 2022 +1100 +commit 6c165c36246d8004c20e1df5cec4961a5ac422d6 +Author: dtucker@openbsd.org +Date: Sat Mar 4 03:22:59 2023 +0000 - Rerun tests on changes to Makefile.in in any dir. + upstream: Use time_t for x11 timeout. + + Use time_t instead of u_int for remaining x11 timeout checks for 64bit + time_t safety. From Coverity CIDs 405197 and 405028, ok djm@ + + OpenBSD-Commit-ID: 356685bfa1fc3d81bd95722d3fc47101cc1a4972 -commit 3500f0405a3ab16b59a26f3508c4257a3fc3bce6 -Author: Darren Tucker -Date: Thu Nov 3 23:04:08 2022 +1100 +commit 4a3918f51bd2d968387e7aa87e33b32c78077fb4 +Author: dtucker@openbsd.org +Date: Fri Mar 3 10:23:42 2023 +0000 - Link libssh into compat tests. + upstream: Ensure ms_remain is always initialized - The cygwin compat code uses xmalloc, so add libssh.a so pick up that. + similar to what we do in ssh_packet_write_wait. bz#2687, from jjelen + at redhat.com. + + OpenBSD-Commit-ID: a50e0541cf823f8d1c72f71ccde925d3dbe6dfac -commit ec59effcf65b8a4c85d47ff5a271123259dd0ab8 -Author: Darren Tucker -Date: Thu Nov 3 21:44:23 2022 +1100 +commit e44846a4487d2885ac7f2610be09b1e2bf52249b +Author: dtucker@openbsd.org +Date: Fri Mar 3 09:48:51 2023 +0000 - Fix compat regress to work with non-GNU make. + upstream: Check for non-NULL before string + + comparison. From jjelen at redhat.com via bz#2687. + + OpenBSD-Commit-ID: 0d9b2e0cac88a311b5766b1aef737082583c285f -commit 73550a218e7dfbbd599534cbf856309bc924f6fd -Author: Darren Tucker -Date: Thu Nov 3 13:41:16 2022 +1100 +commit 1842d523fae63b862ce8e60725c9b606cddb86a6 +Author: djm@openbsd.org +Date: Fri Mar 3 05:00:34 2023 +0000 - Increase selfhosted job timeout. + upstream: guard against getsockname(-1, ...) from Coverity CID - The default job timeout of 360 (6h) is not enough to complete the - regress tests for some of the slow VMs depending on the load on the host. - Increase to 600 (10h). + 291832 + + OpenBSD-Commit-ID: e58d5227327917d189229b7f0b37d2780f360d5f -commit db97d8d0b90c6ce52b94b153d6f8f5f7d3b11777 -Author: Darren Tucker -Date: Thu Nov 3 10:00:43 2022 +1100 +commit 78571a5fe9847d40d7f220c92b707574ae9ec4ce +Author: djm@openbsd.org +Date: Fri Mar 3 04:36:20 2023 +0000 - Only run opensslver tests if built with OpenSSL. + upstream: some options are not first-match-wins. Mention that there + + are exceptions at the start of the manpage and label some of them in the + option description. + + OpenBSD-Commit-ID: 3b74728446fa6fc8742769eeb8c3674e233e84c4 -commit ba053709638dff2f6603df0c1f340352261d63ea -Author: Darren Tucker -Date: Wed Nov 2 14:16:04 2022 +1100 +commit d1c1b3272e8895a96c4f5889bd6e07a8525bd9f1 +Author: djm@openbsd.org +Date: Fri Mar 3 04:34:49 2023 +0000 - Add tests for OpenSSL 3.0.7 and LibreSSL 3.6.1. + upstream: actually print "channeltimeout none" in config dump mode; + + spotted via Coverity CID 405022 + + OpenBSD-Commit-ID: b074b52bf138b75f08264e8da15880b29c7a630f -commit edd24101c7e17d1a8f6576e1aaf62233b47ad6f5 +commit 8bf61e95610b48192d4e1720cc15d9004617301d Author: Darren Tucker -Date: Thu Nov 3 08:17:39 2022 +1100 +Date: Fri Mar 3 14:50:03 2023 +1100 - Run compat regress tests too. + Add Coverity badges. -commit fe88d67e7599b0bc73f6e4524add28d743e7f977 -Author: Darren Tucker -Date: Thu Nov 3 08:14:05 2022 +1100 +commit 93291bd723959adf462b1df958106cf07a7734dd +Author: dtucker@openbsd.org +Date: Fri Mar 3 03:12:24 2023 +0000 - Compat tests need libcrypto. + upstream: Check return values of dup2. Spotted by Coverity, ok djm@ - This was moved to CHANNELLIBS during the libs refactor. Spotted by - rapier at psc.edu. + OpenBSD-Commit-ID: 19fb1b53072826d00c67df677731d2f6c1dd602b -commit 96b519726b7944eee3c23a54eee3d5c031ba1533 -Author: Darren Tucker -Date: Thu Nov 3 04:24:39 2022 +1100 +commit e37261dff33af23f37202cfce0848d36f5c1055c +Author: dtucker@openbsd.org +Date: Fri Mar 3 02:37:58 2023 +0000 - Include time.h when defining timegm. + upstream: Use time_t for x11_refuse_time timeout. We need - Fixes build on some platforms eg recent AIX. - -commit da6038bd5cd55eb212eb2aec1fc8ae79bbf76156 -Author: Darren Tucker -Date: Tue Nov 1 19:10:30 2022 +1100 - - Always use compat getentropy. + SSH_TIME_T_MAX for this, so move from misc.c to misc.h so it's available. + Fixes a Coverity warning for 64bit time_t safety, ok djm@ - Have it call native getentropy and fall back as required. Should fix - issues of platforms where libc has getentropy but it is not implemented - in the kernel. Based on github PR#354 from simsergey. + OpenBSD-Commit-ID: c69c4c3152cdaab953706db4ccf4d5fd682f7d8d -commit 5ebe18cab6be3247b44c807ac145164010465b82 -Author: Darren Tucker -Date: Wed Nov 2 10:51:48 2022 +1100 +commit 32755a98c29114b13f4c9d47454bbb265b932ad7 +Author: dtucker@openbsd.org +Date: Fri Mar 3 02:34:29 2023 +0000 - Check for sockaddr_in.sin_len. + upstream: Check return value from fctnl and warn on failure. - If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan - tests on platforms with this (eg old NetBSD). + Spotted by Coverity, ok djm@ + + OpenBSD-Commit-ID: 2097c7db3cf657f1e3a6c5077041bacc63143cab -commit a1febadf426536612c2734168d409147c392e7cf +commit 5fc60e8246c36b8255f72a937ebe9787b39648c6 Author: dtucker@openbsd.org -Date: Sun Oct 30 18:42:07 2022 +0000 +Date: Thu Mar 2 11:10:27 2023 +0000 - upstream: Use variable for diff options + upstream: Remove SUDO in proxy command wrapper. Anything that needs - instead of unconditionally specifying "-rN". This will make life easier - in -portable where not all diff's understand -N. + sudo is already run by it, and it breaks if root isn't in sudoers. - OpenBSD-Regress-ID: 8b8a407115546be1c6d72d350b1e4f1f960d3cd3 + OpenBSD-Regress-ID: 6cf22fda32a89c16915f31a6ed9bbdbef2a3bac9 -commit f6d3ed9a8a9280cbb68d6a499850cfe810e92bd0 -Author: Darren Tucker -Date: Mon Oct 31 05:13:02 2022 +1100 +commit 0d514659b23a257247491179cfbb53a6dd64e164 +Author: dtucker@openbsd.org +Date: Thu Mar 2 08:24:41 2023 +0000 - OpenSSL dev branch is 302 not 320. + upstream: Fix breakage on dhgex test. - While there, also accept 301 which it shat it was previously. + This was due to the sshd logs being written to the wrong log file. + While there, make save_debug_logs less verbose, write the name of the + tarball to regress.log and use $SUDO to remove the old symlinks (which + shouldn't be needed, but won't hurt). Initial problem spotted by anton@. + + OpenBSD-Regress-ID: 9c44fb9cd418e6ff31165e7a6c1f9f11a6d19f5b -commit 25c8a2bbcc10c493d27faea57c42a6bf13fa51f2 -Author: djm@openbsd.org -Date: Fri Oct 28 02:47:04 2022 +0000 +commit 860201201d4ae655702807966901682cff30a171 +Author: dtucker@openbsd.org +Date: Thu Mar 2 08:14:52 2023 +0000 - upstream: put sshkey_check_rsa_length() back in sshkey.c to unbreak - - OPENSSL=no builds + upstream: Quote grep and log message better. - OpenBSD-Commit-ID: 99eec58abe382ecd14b14043b195ee1babb9cf6e + OpenBSD-Regress-ID: 3823d9063127169736aa274b1784cb28e15b64d4 -commit 1192588546c29ceec10775125f396555ea71850f -Author: djm@openbsd.org -Date: Fri Oct 28 02:29:34 2022 +0000 +commit 03a03c6002525f5ad9c8fc874a5d5826a35d9858 +Author: dtucker@openbsd.org +Date: Thu Mar 2 06:41:56 2023 +0000 - upstream: allow ssh-keyscan(1) to accept CIDR address ranges, e.g. + upstream: Always call fclose on checkpoints. - ssh-keyscan 192.168.0.0/24 + In the case of an fprintf failure we would not call fclose which would + leak the FILE pointer. While we're there, try to clean up the temp file + on failure. Spotted by Coverity, ok djm@ - If a CIDR range is passed, then it will be expanded to all possible - addresses in the range including the all-0s and all-1s addresses. + OpenBSD-Commit-ID: 73c7ccc5d4fcc235f54c6b20767a2815408525ef + +commit 13fe8f9785e6d90400ce548939a0b0ddc11fcb3c +Author: dtucker@openbsd.org +Date: Wed Mar 1 21:54:50 2023 +0000 + + upstream: Remove old log symlinks - bz#976 feedback/ok markus@ + before creating new ones. In -portable some platforms don't like + overwriting existing symlinks. - OpenBSD-Commit-ID: ce6c5211f936ac0053fd4a2ddb415277931e6c4b + OpenBSD-Regress-ID: 7e7ddc0beb73e945e1c4c58d51c8a125b518120f -commit 64af4209309461c79c39eda2d13f9d77816c6398 -Author: Damien Miller -Date: Fri Oct 28 12:54:35 2022 +1100 +commit 131fcbcaffd1e3bcf5ab766ec497b5d768955310 +Author: Darren Tucker +Date: Wed Mar 1 23:23:02 2023 +1100 - fix merge botch + Adjust test jobs for new log directory. -commit 27267642699342412964aa785b98afd69d952c88 -Author: djm@openbsd.org -Date: Fri Oct 28 00:44:44 2022 +0000 +commit a6f4ac8a2baf77e5361cfa017d0dc250d1409bec +Author: dtucker@openbsd.org +Date: Wed Mar 1 09:29:32 2023 +0000 - upstream: refactor sshkey_private_deserialize + upstream: Rework logging for the regression tests. - feedback/ok markus@ + Previously we would log to ssh.log and sshd.log, but that is insufficient + for tests that have more than one concurent ssh/sshd. - OpenBSD-Commit-ID: f5ca6932fdaf840a5e8250becb38315a29b5fc9f - -commit 2519a7077a9332f70935e5242ba91ee670ed6b87 -Author: djm@openbsd.org -Date: Fri Oct 28 00:44:17 2022 +0000 - - upstream: refactor sshkey_private_serialize_opt() + Instead, we'll log to separate datestamped files in a $OBJ/log/ and + leave a symlink at the previous location pointing at the most recent + instance with an entry in regress.log showing which files were created + at each point. This should be sufficient to reconstruct what happened + even for tests that use multiple instances of each program. If the test + fails, tar up all of the logs for later analysis. - feedback/ok markus@ + This will let us also capture the output from some of the other tools + which was previously sent to /dev/null although most of those will be + in future commits. - OpenBSD-Commit-ID: 61e0fe989897901294efe7c3b6d670cefaf44cbd + OpenBSD-Regress-ID: f802aa9e7fa51d1a01225c05fb0412d015c33e24 -commit 11a768adf98371fe4e43f3b06014024c033385d5 -Author: djm@openbsd.org -Date: Fri Oct 28 00:43:30 2022 +0000 +commit 8ead62ed5e86c7df597d8604f332f49cd1527b85 +Author: dtucker@openbsd.org +Date: Tue Feb 28 21:31:50 2023 +0000 - upstream: refactor certify + upstream: fatal out if allocating banner string fails to avoid - feedback/ok markus@ + potential null deref later in sscanf. Spotted by Coverity, ok deraadt@ - OpenBSD-Commit-ID: 35d742992e223eaca3537e6fb3d3002c08eed4f6 + OpenBSD-Commit-ID: 74e8d228ac00552e96e9e968dfcccf8dd1f46ad5 -commit 3fbc58bb249d967cc43ebdc554f6781bb73d4a58 -Author: djm@openbsd.org -Date: Fri Oct 28 00:43:08 2022 +0000 +commit 44ca56ba0b3f531f1d85730cc701097cd49e6868 +Author: dtucker@openbsd.org +Date: Tue Feb 28 08:45:24 2023 +0000 - upstream: refactor sshkey_sign() and sshkey_verify() + upstream: Explicitly ignore return from fchmod - feedback/ok markus@ + similar to other calls to prevent warning. - OpenBSD-Commit-ID: 368e662c128c99d05cc043b1308d2b6c71a4d3cc + OpenBSD-Commit-ID: fdc5287dcee0860b5a493186414226c655b0eb0a -commit a1deb6cdbbe6afaab74ecb08fcb62db5739267be -Author: djm@openbsd.org -Date: Fri Oct 28 00:41:52 2022 +0000 +commit 803392933a3a6f09f834aa5f0c2aab06a3b382f4 +Author: dtucker@openbsd.org +Date: Mon Feb 27 22:12:40 2023 +0000 - upstream: refactor sshkey_from_blob_internal() + upstream: Plug mem leak on globbed ls error path. - feedback/ok markus@ + Spotted by Coverity, ok deraadt@ - OpenBSD-Commit-ID: 1f46c0cbb8060ee9666a02749594ad6658c8e283 + OpenBSD-Commit-ID: de28476025db29820a9a2e56e98b964d8a02861c -commit 7d00799c935271ce89300494c5677190779f6453 -Author: djm@openbsd.org -Date: Fri Oct 28 00:41:17 2022 +0000 +commit aa33b4d396abf47a2a45f982f28d054fb1dcb5c3 +Author: Darren Tucker +Date: Mon Feb 27 21:04:22 2023 +1100 - upstream: refactor sshkey_from_private() - - feedback/ok markus@ + Cast time_t's in debug output to long long. - OpenBSD-Commit-ID: e5dbe7a3545930c50f70ee75c867a1e08b382b53 + Should fix Coverity warning about truncation of 64bit time_t. -commit 262647c2e920492ca57f1b9320d74f4a0f6e482b -Author: djm@openbsd.org -Date: Fri Oct 28 00:39:29 2022 +0000 +commit b0fd60a9de62a03189ad57d0c07f0ac51dc00e95 +Author: Darren Tucker +Date: Mon Feb 27 17:28:59 2023 +1100 - upstream: factor out key generation - - feedback/ok markus@ + Do shadow expiry calcs using "long long". - OpenBSD-Commit-ID: 5b4211bff4de8d9adb84bc72857a8c42c44e7ceb + Coverity flags these as potentially not 64bit time_t safe so use + long long for the calculations and debug output. ok djm@ -commit 401c74e7dc15eab60540653d2f94d9306a927bab -Author: djm@openbsd.org -Date: Fri Oct 28 00:38:58 2022 +0000 +commit 01dbeb3084d714bbd001ff9d03b9de542e8cdf58 +Author: Damien Miller +Date: Mon Feb 27 17:07:52 2023 +1100 - upstream: refactor and simplify sshkey_read() + avoid clash between for getopt's struct option - feedback/ok markus@ + Since we don't use getopt_long() nothing outside the getopt() + implementation itself uses this structure, so move it into the + source to remove it from visibility and clashes with libc's - OpenBSD-Commit-ID: 0d93b7a56e31cd06a8bb0d2191d084ce254b0971 + ok dtucker@ -commit 591fed94e66a016acf87f4b7cd416ce812f2abe8 -Author: djm@openbsd.org -Date: Fri Oct 28 00:37:24 2022 +0000 +commit eb88d07c43afe407094e7d609248d85a15e148ef +Author: Darren Tucker +Date: Sat Feb 25 14:45:41 2023 +1100 - upstream: factor out public key serialization - - feedback/ok markus@ + Revert explicit chmods on private keys. - OpenBSD-Commit-ID: a3570c4b97290c5662890aea7328d87f55939033 + This should no longer be needed on Cygwin test runners due to previous + commit. -commit 1e78844ae2b2dc01ba735d5ae740904c57e13685 -Author: djm@openbsd.org -Date: Fri Oct 28 00:36:31 2022 +0000 +commit 52b75db61030a6c8baf66b73644380cf3f58e26a +Author: Darren Tucker +Date: Sat Feb 25 14:43:28 2023 +1100 - upstream: factor out sshkey_equal_public() - - feedback/ok markus@ + Remove extended ACLs from working dirs. - OpenBSD-Commit-ID: 1368ba114cb37732fe6ec3d89c7e6d27ea6fdc94 + This should allow umask to work as expected and prevent tests from + failing due to excessive permissions on private keys. -commit 25de1c01a8b9a2c8ab9b1da22444a03e89c982de -Author: djm@openbsd.org -Date: Fri Oct 28 00:35:40 2022 +0000 +commit 0c5d4c843df5605b043a758d69f9a611ef63c479 +Author: Darren Tucker +Date: Fri Feb 24 13:44:13 2023 +1100 - upstream: begin big refactor of sshkey - - Move keytype data and some of the type-specific code (allocation, - cleanup, etc) out into each key type's implementation. Subsequent - commits will move more, with the goal of having each key-*.c file - owning as much of its keytype's implementation as possible. - - lots of feedback + ok markus@ + Explicitly set permissions on user and host keys. - OpenBSD-Commit-ID: 0f2b4334f73914344e9e5b3d33522d41762a57ec + On cygwin, the umask might not be sufficient. Should fix tests on + Github runners. -commit 445363433ba20b8a3e655b113858c836da46a1cb +commit 6c9fc9d7a9f7abf82c3294d74e6d4a25735862ce Author: djm@openbsd.org -Date: Mon Oct 24 22:43:36 2022 +0000 +Date: Wed Feb 22 03:56:43 2023 +0000 - upstream: Be more paranoid with host/domain names coming from the - - never write a name with bad characters to a known_hosts file. + upstream: fix progressmeter corruption on wide displays; bz3534 - reported by David Leadbeater, ok deraadt@ + feedback/ok dtucker@ - OpenBSD-Commit-ID: ba9b25fa8b5490b49398471e0c9657b0cbc7a5ad + OpenBSD-Commit-ID: f4affee067cec7c182f3e0b307d758e0472762a3 -commit 7190154de2c9fe135f0cc1ad349cb2fa45152b89 -Author: djm@openbsd.org -Date: Mon Oct 24 21:52:50 2022 +0000 +commit fe0bd3cde9665d364e5eedd2c2c2e60d4cdc3786 +Author: dtucker@openbsd.org +Date: Tue Feb 21 06:48:18 2023 +0000 - upstream: regress test for unmatched glob characters; fails before + upstream: fseek to end of known_hosts before writing to it. - previous commit but passes now. bz3488; prodded by dtucker@ + POSIX and ANSI C require that applications call fseek or similar between + read and writing to a RW file. OpenBSD doesn't enforce this, but some + (System V derived) platforms need this to prevent it from writing a + spurious extra byte (in this case, a newline). ok djm@ deraadt@ - OpenBSD-Regress-ID: 0cc5cc9ea4a6fd170dc61b9212f15badaafb3bbd + OpenBSD-Commit-ID: 33e680dcd8110582a93a40a8491024e961f45137 -commit a4821a592456c3add3cd325db433110cdaaa3e5c -Author: djm@openbsd.org -Date: Mon Oct 24 21:51:55 2022 +0000 +commit 357fb8ae14c07cd025eeed66e73de91bab569849 +Author: Darren Tucker +Date: Tue Feb 21 17:51:09 2023 +1100 - upstream: when scp(1) is using the SFTP protocol for transport (the - - default), better match scp/rcp's handling of globs that don't match the - globbed characters but do match literally (e.g. trying to transfer - "foo.[1]"). - - Previously scp(1) in SFTP mode would not match these pathnames but - legacy scp/rcp mode would. + Also run unit tests on AIX VMs. - Reported by Michael Yagliyan in bz3488; ok dtucker@ + In the past these tests took too long, but these days it only adds + about 5 min to the run. + +commit 17781aaa5188ee1477f7779b280d105512e3dbed +Author: Darren Tucker +Date: Tue Feb 21 17:38:55 2023 +1100 + + Wrap stdint.h inside ifdef. + +commit ef798bad38505f7bf1b5fa5c0843dfc5a2b192b9 +Author: Mayank Sharma +Date: Mon Feb 20 17:37:15 2023 +0530 + + Add includes to ptimeout test. - OpenBSD-Commit-ID: d8a3773f53015ba811fddba7473769a2fd343e11 + Fixes test failures on AIX due to type mismatches. -commit 18376847b8043ba967eabbe23692ef74c9a3fddc -Author: jsg@openbsd.org -Date: Thu Oct 13 09:09:28 2022 +0000 +commit ab69dda05d5268454209f529fa80f477e60d846a +Author: Darren Tucker +Date: Mon Feb 20 18:24:39 2023 +1100 - upstream: use correct type with sizeof ok djm@ + Always use the openssl binary configure tells us. - OpenBSD-Commit-ID: d6c882c2e8a42ff831a5b3cbc2c961ecb2dd6143 + This fixes tests on platforms that do not have the openssl tool + installed at all. -commit 4a4883664d6b4e9e4e459a8cdc16bd8d4b735de9 -Author: jmc@openbsd.org -Date: Fri Oct 7 06:00:58 2022 +0000 +commit 2a7e3449908571af601a4c2d12ab140096442e47 +Author: dtucker@openbsd.org +Date: Fri Feb 17 04:22:50 2023 +0000 - upstream: ssh-agent.1: - use Nm not Xr for self-ref - while here, - - wrap a long line + upstream: Remove now-unused compat bit SSH_BUG_RSASIGMD5. The code - ssh-agent.c: - - add -O to usage() + to set this was removed in OpenSSH 7.7 when support for SSH implementations + dating back to before RFC standardization were removed. "burn it all" djm@ - OpenBSD-Commit-ID: 855dac4695cef22e96d69c53436496bc408ca389 + OpenBSD-Commit-ID: 6330935fbe23dd00be79891505e06d1ffdac7cda -commit 9fd2441113fce2a83fc7470968c3b27809cc7f10 -Author: djm@openbsd.org -Date: Fri Oct 7 04:06:26 2022 +0000 +commit 0833ccf2c8b7ae08b296c06f17bd53e3ab94b0b0 +Author: dtucker@openbsd.org +Date: Fri Feb 17 03:06:18 2023 +0000 - upstream: document "-O no-restrict-websafe"; spotted by Ross L + upstream: Remove now-unused compat bit SSH_BUG_BIGENDIANAES. This - Richardson + was previously set for OpenSSH 2.3 (released in 2000) but this check was + removed in OpenSSH 7.7 (2018). ok djm@ deraadt@ - OpenBSD-Commit-ID: fe9eaa50237693a14ebe5b5614bf32a02145fe8b - -commit 614252b05d70f798a0929b1cd3d213030ad4d007 -Author: Darren Tucker -Date: Tue Oct 18 06:29:16 2022 +1100 - - OpenSSL dev branch now identifies as 3.2.0. + OpenBSD-Commit-ID: 326426ea328707fc9e83305291ab135c87f678af -commit 195e5a65fd793a738ea8451ebfdd1919db5aff3e +commit c81c2bea6e828d52b62b448b4ffdd3c163177975 Author: Damien Miller -Date: Mon Oct 17 09:41:47 2022 +1100 +Date: Fri Feb 17 10:12:40 2023 +1100 - revert c64b62338b4 and guard POLL* defines instead - - c64b62338b4 broke OSX builds, which do have poll.h but lack ppoll(2) - Spotted by dtucker + whitespace fixes -commit bc2e480d99613bd59720edae244d1764636544c4 +commit 500f90b39db5f0014e6b0c49ff1f45c994b69293 Author: Damien Miller -Date: Fri Oct 14 14:52:22 2022 +1100 +Date: Fri Feb 17 10:02:08 2023 +1100 - undef _get{short,long} before redefining + whitespace at EOL -commit 5eb796a369c64f18d55a6ae9b1fa9b35eea237fb -Author: Harmen Stoppels -Date: Thu Oct 13 16:08:46 2022 +0200 +commit 68350152406339170721c15e97afdf827a5e4001 +Author: dtucker@openbsd.org +Date: Thu Feb 16 10:10:00 2023 +0000 - Fix snprintf configure test for clang 15 + upstream: Remove SSH_BUG_PASSWORDPAD compat bit - Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. - A handful of tests have "main(..." and not "int main(..." which caused - the tests to produce incorrect results. + since it's no longer used. ok markus@ + + OpenBSD-Commit-ID: b92c21f56fe4b7f9a54790d6a9650725c226820b -commit c64b62338b46ffa08839f05f21ad69fa6234dc17 -Author: Damien Miller -Date: Mon Oct 10 12:32:43 2022 +1100 +commit 537cccd804eaf65f32bdce037cc31db4e0ab0f44 +Author: dtucker@openbsd.org +Date: Thu Feb 16 07:55:15 2023 +0000 - skip bsd-poll.h if poll.h found; ok dtucker + upstream: Remove SSH_BUG_IGNOREMSG compat flag + + since it's only applicable to SSH1 and thus no longer used. ok markus@ + "kill it with fire" djm@ + + OpenBSD-Commit-ID: ea13318b1937795d9db4790d3ce0a6ed01584dab -commit 5ee2b8ccfcf4b606f450eb0ff2305e311f68b0be -Author: djm@openbsd.org -Date: Thu Oct 6 22:42:37 2022 +0000 +commit 285cf6cd4b91a0a0ce33193c358c99085af33e43 +Author: jmc@openbsd.org +Date: Fri Feb 10 06:41:53 2023 +0000 - upstream: honour user's umask if it is more restrictive then the ssh - - default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@ + upstream: space between macro and punctuation; sort usage(); - OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d + OpenBSD-Commit-ID: 6141610cfca037700730e41f868d1d9124958f8c -commit a75cffc2700cebd3e2dd9093f7f7388d2be95cb7 -Author: Darren Tucker -Date: Fri Oct 7 03:54:56 2022 +1100 +commit d39a96f70f81878c77336ed35f5c648c1804b71a +Author: jmc@openbsd.org +Date: Fri Feb 10 06:40:48 2023 +0000 - Add LibreSSL 3.6.0 to test suite. + upstream: space between macro and punctuation; - While there, bump OpenSSL to latest 1.1.1q release. + OpenBSD-Commit-ID: abc95e550be9e6d9a7ff64b65c104c7be21ab19e -commit fcc0f0c0e96a30076683fea9a7c9eedc72931742 -Author: Darren Tucker -Date: Thu Oct 6 21:18:16 2022 +1100 +commit 16e82bf53fc34e43e3b948d43b68d5b27a7335e6 +Author: jmc@openbsd.org +Date: Fri Feb 10 06:39:27 2023 +0000 - Add 9.1 branch to CI status page. + upstream: sort SYNOPSIS; + + OpenBSD-Commit-ID: dacd9da33277d5669a51213d880632599c890c1e -commit ef211eee63821d894a8bf81f22bfba9f6899d0fe +commit d9685121ff6d57b8797411f3cb123884a4b96e30 Author: Darren Tucker -Date: Tue Oct 4 23:20:23 2022 +1100 +Date: Sat Feb 11 12:32:19 2023 +1100 - Test commits to all branches of portable. + Improve seccomp compat on older systems. - Only test OpenBSD upstream on commits to master since that's what it - tracks. + Check if flags to mmap and madvise are defined before using them. + Should fix problems building on older Linux systems that don't have + these. bz#3537, with & ok djm@. -commit fe646de03cafb6593ff4e4954bca9ec4b4b753a8 -Author: Damien Miller -Date: Wed Oct 5 03:47:26 2022 +1100 +commit 6180b0fa4f7996687678702806257e661fd5931e +Author: djm@openbsd.org +Date: Fri Feb 10 05:06:03 2023 +0000 - whitespace at EOL + upstream: test -Ohashalg=... and that the default output contains both + + specified hash algorithms; prompted by dtucker@ + + OpenBSD-Regress-ID: 26f309208c8d8b8fa9c5f419767b85f1e9b22f51 -commit a6e1852d10c63a830196e82168dadd957aaf28ec -Author: Damien Miller -Date: Wed Oct 5 03:40:01 2022 +1100 +commit d651f5c9fe37e61491eee46c49ba9fa03dbc0e6a +Author: djm@openbsd.org +Date: Fri Feb 10 04:56:30 2023 +0000 - mention libfido2 autodetection + upstream: let ssh-keygen and ssh-keyscan accept + + -Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm + selection. bz3493 ok dtucker@ + + OpenBSD-Commit-ID: e6e07fe21318a873bd877f333e189eb963a11b3d -commit 7360c2c206f33d309edbaf64036c96fadf74d640 -Author: Damien Miller -Date: Wed Oct 5 03:37:36 2022 +1100 +commit 18938d11a90b74d63c20b2d3c965d5bd64786ab1 +Author: djm@openbsd.org +Date: Fri Feb 10 04:47:19 2023 +0000 - remove mention of --with-security-key-builtin + upstream: add a `sshd -G` option that parses and prints the - it is enabled by default when libfido2 is installed + effective configuration without attempting to load private keys and perform + other checks. This allows usage of the option before keys have been + generated. + + bz3460 feedback/ok dtucker@ + + OpenBSD-Commit-ID: 774504f629023fc25a559ab1d95401adb3a7fb29 -commit 0ffb46f2ee2ffcc4daf45ee679e484da8fcf338c -Author: Damien Miller -Date: Tue Oct 4 01:51:42 2022 +1100 +commit df7d3dbf7194db8e97730ee0425d4d9d7bdb8b10 +Author: djm@openbsd.org +Date: Fri Feb 10 04:40:28 2023 +0000 - update .depend + upstream: make `ssh -Q CASignatureAlgorithms` work as the manpage says + + it should bz3532 + + OpenBSD-Commit-ID: 0ddb17b3fcbd99bfb5baea4ac5e449620cbd3adc -commit 657e676ff696c7bb787bffb0e249ea1be3b474e1 -Author: Damien Miller -Date: Tue Oct 4 01:45:52 2022 +1100 +commit d3b8d4198b6595f23b5859d43dc8fc701f97429b +Author: Darren Tucker +Date: Fri Feb 10 14:26:44 2023 +1100 - update release notes URL + Add CentOS 7 test targets. -commit f059da2b29840c0f048448809c317ce2ae014da7 -Author: Damien Miller -Date: Tue Oct 4 01:45:41 2022 +1100 +commit 22efb01e355bba4755b730ed417f91c081445bfc +Author: dtucker@openbsd.org +Date: Thu Feb 9 09:55:33 2023 +0000 - crank versions in RPM spec files + upstream: Test adding terminating newline to known_hosts. + + OpenBSD-Regress-ID: 5fc3010ac450195b3fbdeb68e875564968800365 -commit b51f3f172d87cbdb80ca4eb7b2149e56a7647557 -Author: djm@openbsd.org -Date: Mon Sep 26 22:18:40 2022 +0000 +commit caec6da1a583ed8c32c6ad3b81bbcaab46ac8b61 +Author: dtucker@openbsd.org +Date: Wed Feb 8 08:06:03 2023 +0000 - upstream: openssh-9.1 + upstream: ssh-agent doesn't actually take -v, - OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56 + so the recently-added ones will result in the test not cleaning up + after itself. Patch from cjwatson at debian.org vi bz#3536. + + OpenBSD-Regress-ID: 1fc8283568f5bf2f918517c2c1e778072cf61b1a -commit 4cf8d0c0f3030f594a238bab21a0695735515487 +commit 3c379c9a849a635cc7f05cbe49fe473ccf469ef9 Author: dtucker@openbsd.org -Date: Wed Sep 21 22:26:50 2022 +0000 +Date: Thu Feb 9 09:54:11 2023 +0000 - upstream: Fix typo. From AlexanderStohr via github PR#343. + upstream: Ensure that there is a terminating newline when adding a new - OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497 + entry to known_hosts. bz#3529, with git+openssh at limpsquid.nl, ok deraadt@ + markus@ + + OpenBSD-Commit-ID: fa8d90698da1886570512b96f051e266eac105e0 -commit 8179fed3264d5919899900ed8881d5f9bb57ca33 -Author: djm@openbsd.org -Date: Mon Sep 19 21:39:16 2022 +0000 +commit 95b6bbd2553547260b324b39d602061c88b774bc +Author: Darren Tucker +Date: Tue Feb 7 08:43:47 2023 +1100 - upstream: add RequiredRSASize to the list of keywords accepted by + Replace 9.1 with 9.2 on CI status page. + +commit 195313dfe10a23c82e9d56d5fdd2f59beee1bdcf +Author: Damien Miller +Date: Fri Feb 3 16:33:09 2023 +1100 + + harden Linux seccomp sandbox - -o; spotted by jmc@ + Linux mmap(2) and madvise(2) syscalls support quite a number of funky + flags that we don't expect that sshd/libc will ever need. We can + exclude this kernel attack surface by filtering the mmap(2) flags + and the madvise(2) advice arguments. - OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e + Similarly, the sandboxed process in sshd is a single-threaded program + that does not use shared memory for synchronisation or communication. + Therefore, there should be no reason for the advanced priority + inheritance futex(2) operations to be necessary. These can also be + excluded. + + Motivated by Jann Horn pointing out that there have been kernel bugs + in nearby Linux kernel code, e.g. CVE-2020-29368, CVE-2020-29374 and + CVE-2022-42703. + + Feedback Jann Horn, ok dtucker@ + +commit 6dfb65de949cdd0a5d198edee9a118f265924f33 +Author: Damien Miller +Date: Thu Feb 2 23:21:54 2023 +1100 + + crank versions in RPM specs -commit 5f954929e9f173dd1e279e07d0e8b14fa845814d +commit d07cfb11a0ca574eb68a3931d8c46fbe862a2021 Author: Damien Miller -Date: Mon Sep 19 20:59:34 2022 +1000 +Date: Thu Feb 2 23:21:45 2023 +1100 - no need for glob.h here - - it also causes portability problems + update version in README -commit 03d94a47207d58b3db37eba4f87eb6ae5a63168a +commit 9fe207565b4ab0fe5d1ac5bb85e39188d96fb214 Author: Damien Miller -Date: Mon Sep 19 20:59:04 2022 +1000 +Date: Thu Feb 2 23:17:49 2023 +1100 - avoid Wuninitialized false positive in gcc-12ish + adapt compat_kex_proposal() test to portable -commit 9d952529113831fb3071ab6e408d2726fd72e771 +commit 903c556b938fff2d7bff8da2cc460254430963c5 Author: djm@openbsd.org -Date: Mon Sep 19 10:46:00 2022 +0000 +Date: Thu Feb 2 12:12:52 2023 +0000 - upstream: use users-groups-by-id@openssh.com sftp-server extension - - (when available) to fill in user/group names for directory listings. - Implement a client-side cache of see uid/gid=>user/group names. ok markus@ + upstream: test compat_kex_proposal(); by dtucker@ - OpenBSD-Commit-ID: f239aeeadfa925a37ceee36ee8b256b8ccf4466e + OpenBSD-Regress-ID: 0e404ee264db546f9fdbf53390689ab5f8d38bf2 -commit 8ff680368b0bccf88ae85d4c99de69387fbad7a6 -Author: djm@openbsd.org -Date: Mon Sep 19 10:43:12 2022 +0000 +commit 405fba71962dec8409c0c962408e09049e5624b5 +Author: dtucker@openbsd.org +Date: Thu Jan 19 07:53:45 2023 +0000 - upstream: sftp client library support for + upstream: Check if we can copy sshd or need to use sudo to do so - users-groups-by-id@openssh.com; ok markus@ + during reexec test. Skip test if neither can work. Patch from anton@, tweaks + from me. - OpenBSD-Commit-ID: ddb2f33a2da6349a9a89a8b5bcb9ca7c999394de + OpenBSD-Regress-ID: 731b96ae74d02d5744e1f1a8e51d09877ffd9b6d -commit 488f6e1c582212c2374a4bf8cd1b703d2e70fb8b +commit b2a2a8f69fd7737ea17dc044353c514f2f962f35 Author: djm@openbsd.org -Date: Mon Sep 19 10:41:58 2022 +0000 +Date: Thu Feb 2 12:10:22 2023 +0000 - upstream: extend sftp-common.c:extend ls_file() to support supplied - - user/group names; ok markus@ + upstream: openssh-9.2 - OpenBSD-Commit-ID: c70c70498b1fdcf158531117e405b6245863bfb0 + OpenBSD-Commit-ID: f7389f32413c74d6e2055f05cf65e7082de03923 -commit 74b77f7497dba3a58315c8f308883de448078057 +commit 12da7823336434a403f25c7cc0c2c6aed0737a35 Author: djm@openbsd.org -Date: Mon Sep 19 10:40:52 2022 +0000 +Date: Thu Feb 2 12:10:05 2023 +0000 - upstream: sftp-server(8): add a "users-groups-by-id@openssh.com" - - extension request that allows the client to obtain user/group names that - correspond to a set of uids/gids. - - Will be used to make directory listings more useful and consistent - in sftp(1). + upstream: fix double-free caused by compat_kex_proposal(); bz3522 - ok markus@ + by dtucker@, ok me - OpenBSD-Commit-ID: 7ebabde0bcb95ef949c4840fe89e697e30df47d3 + OpenBSD-Commit-ID: 2bfc37cd2d41f67dad64c17a64cf2cd3806a5c80 -commit 231a346c0c67cc7ca098360f9a554fa7d4f1eddb -Author: djm@openbsd.org -Date: Mon Sep 19 08:49:50 2022 +0000 +commit 79efd95ab5ff99f4cb3a955e2d713b3f54fb807e +Author: Darren Tucker +Date: Wed Feb 1 17:17:26 2023 +1100 - upstream: better debugging for connect_next() + Skip connection-timeout test on minix3. - OpenBSD-Commit-ID: d16a307a0711499c971807f324484ed3a6036640 + Minix 3's Unix domain sockets don't seem to work the way we expect, so + skip connection-timeout test on that platform. While there, group + together all similarly skipped tests and explicitly comment. -commit 1875042c52a3b950ae5963c9ca3774a4cc7f0380 -Author: djm@openbsd.org -Date: Sat Sep 17 10:34:29 2022 +0000 +commit 6b508c4e039619842bcf5a16f8a6b08dd6bec44a +Author: Damien Miller +Date: Wed Feb 1 12:12:05 2023 +1100 - upstream: Add RequiredRSASize for sshd(8); RSA keys that fall - - beneath this limit will be ignored for user and host-based authentication. - - Feedback deraadt@ ok markus@ + fix libfido2 detection without pkg-config - OpenBSD-Commit-ID: 187931dfc19d51873df5930a04f2d972adf1f7f1 + Place libfido2 before additional libraries (that it may depend upon) + and not after. bz3530 from James Zhang; ok dtucker@ -commit 54b333d12e55e6560b328c737d514ff3511f1afd -Author: djm@openbsd.org -Date: Sat Sep 17 10:33:18 2022 +0000 +commit 358e300fed5e6def233a2c06326e51e20ebed621 +Author: deraadt@openbsd.org +Date: Wed Jan 18 20:56:36 2023 +0000 - upstream: add a RequiredRSASize for checking RSA key length in - - ssh(1). User authentication keys that fall beneath this limit will be - ignored. If a host presents a host key beneath this limit then the connection - will be terminated (unfortunately there are no fallbacks in the protocol for - host authentication). - - feedback deraadt, Dmitry Belyavskiy; ok markus@ + upstream: delete useless dependency - OpenBSD-Commit-ID: 430e339b2a79fa9ecc63f2837b06fdd88a7da13a + OpenBSD-Commit-ID: e1dc11143f83082e3154d6094f9136d0dc2637ad -commit 07d8771bacfefbcfb37fa8a6dc6103bcc097e0ab -Author: djm@openbsd.org -Date: Sat Sep 17 10:30:45 2022 +0000 +commit a4cb9be1b021b511e281ee55c356f964487d9e82 +Author: deraadt@openbsd.org +Date: Wed Jan 18 20:43:15 2023 +0000 - upstream: Add a sshkey_check_rsa_length() call for checking the + upstream: Create and install sshd random relink kit. - length of an RSA key; ok markus@ + ../Makefile.inc and Makfile are concatenated for reuse, which hopefully won't + be too fragile, we'll see if we need a different approach. The resulting sshd + binary is tested with the new sshd -V option before installation. As the + binary layout is now semi-unknown (meaning relative, fixed, and gadget + offsets are not precisely known), change the filesystem permissions to 511 to + prevent what I call "logged in BROP". I have ideas for improving this further + but this is a first step ok djm - OpenBSD-Commit-ID: de77cd5b11594297eda82edc594b0d32b8535134 + OpenBSD-Commit-ID: 1e0a2692b7e20b126dda60bf04999d1d30d959d8 -commit 3991a0cf947cf3ae0f0373bcec5a90e86a7152f5 -Author: djm@openbsd.org -Date: Sat Sep 17 10:11:29 2022 +0000 +commit bc7de6f91a9a0ae2f148a9d31a4027d441a51999 +Author: jmc@openbsd.org +Date: Wed Jan 18 06:55:32 2023 +0000 - upstream: actually hook up restrict_websafe; the command-line flag + upstream: tweak previous; ok djm - was never actually used. Spotted by Matthew Garrett + OpenBSD-Commit-ID: df71ce4180c58202dfdc1d92626cfe900b91b7c3 + +commit a20b7e999773e6333c8aa9b0a7fa41966e63b037 +Author: Darren Tucker +Date: Tue Jan 31 19:35:44 2023 +1100 + + Skip connection-timeout test under Valgrind. - OpenBSD-Commit-ID: 0b363518ac4c2819dbaa3dfad4028633ab9cdff1 + Valgrind slows things down so much that the timeout test fails. Skip + this test until we figure out if we can make it work. -commit 30b2a7e4291fb9e357f80a237931ff008d686d3b -Author: djm@openbsd.org -Date: Fri Sep 16 06:55:37 2022 +0000 +commit c3ffb54b4fc5e608206037921db6ccbc2f5ab25f +Author: Darren Tucker +Date: Wed Jan 25 21:58:40 2023 +1100 - upstream: correct error value + Skip connection-timeout when missing FD passing. - OpenBSD-Commit-ID: 780efcbad76281f11f14b2a5ff04eb6db3dfdad4 + This tests uses multiplexing which uses file descriptor passing, so + skip it if we don't have that. Fixes test failures on Cygwin. -commit ac1ec9545947d9f9657259f55d04cb49d3a94c8a +commit 35253af01d8c0ab444c8377402121816e71c71f5 Author: djm@openbsd.org -Date: Fri Sep 16 03:33:14 2022 +0000 +Date: Wed Jan 18 02:00:10 2023 +0000 - upstream: sftp: Be a bit more clever about completions - - There are commands (e.g. "get" or "put") that accept two - arguments, a local path and a remote path. However, the way - current completion is written doesn't take this distinction into - account and always completes remote or local paths. + upstream: when restoring non-blocking mode to stdio fds, restore - By expanding CMD struct and "cmds" array this distinction can be - reflected and with small adjustment to completer code the correct - path can be completed. + exactly the flags that ssh started with and don't just clobber them with + zero, as this could also remove the append flag from the set; - By Michal Privoznik, ok dtucker@ + bz3523; ok dtucker@ - OpenBSD-Commit-ID: 1396d921c4eb1befd531f5c4a8ab47e7a74b610b + OpenBSD-Commit-ID: 1336b03e881db7564a4b66014eb24c5230e9a0c0 -commit 590db83384f9d99fc51c84505792d26d1ef60df9 -Author: djm@openbsd.org -Date: Fri Sep 16 03:13:34 2022 +0000 +commit 7d17ea151c0b2519f023bd9cc7f141128833ac47 +Author: millert@openbsd.org +Date: Wed Jan 18 01:50:21 2023 +0000 - upstream: sftp: Don't attempt to complete arguments for + upstream: Add a -V (version) option to sshd like the ssh client - non-existent commands + has. OK markus@ deraadt@ - If user entered a non-existent command (e.g. because they made a - typo) there is no point in trying to complete its arguments. Skip - calling complete_match() if that's the case. + OpenBSD-Commit-ID: abe990ec3e636fb040132aab8cbbede98f0c413e + +commit 62360feb7f08f2a4c6fc36f3b3449309203c42c9 +Author: millert@openbsd.org +Date: Tue Jan 17 18:52:44 2023 +0000 + + upstream: For "ssh -V" always exit 0, there is no need to check opt - From Michal Privoznik + again. This was missed when the fallthrough in the switch case above it was + removed. OK deraadt@ - OpenBSD-Commit-ID: cf39c811a68cde2aeb98fc85addea4000ef6b07a + OpenBSD-Commit-ID: 5583e5d8f6d62a8a4215cfa95a69932f344c8120 -commit ff9809fdfd1d9a91067bb14a77d176002edb153c +commit 12492c0abf1eb415d08a897cc1d8b9e789888230 Author: djm@openbsd.org -Date: Wed Sep 14 00:14:37 2022 +0000 +Date: Tue Jan 17 10:15:10 2023 +0000 - upstream: sk_enroll: never drop SSH_SK_USER_VERIFICATION_REQD flag - - from response - - Now that all FIDO signing calls attempt first without PIN and then - fall back to trying PIN only if that attempt fails, we can remove the - hack^wtrick that removed the UV flag from the keys returned during - enroll. + upstream: also check that an active session inhibits - By Corinna Vinschen + UnusedConnectionTimeout idea markus@ - OpenBSD-Commit-ID: 684517608c8491503bf80cd175425f0178d91d7f + OpenBSD-Regress-ID: 55c0fb61f3bf9e092b0a53f9041d3d2012f14003 -commit 940dc10729cb5a95b7ee82c10184e2b9621c8a1d +commit cef2593c33ac46a58238ff998818754eabdf64ff Author: djm@openbsd.org -Date: Wed Sep 14 00:13:13 2022 +0000 +Date: Tue Jan 17 10:02:34 2023 +0000 - upstream: a little extra debugging + upstream: regression test for UnusedConnectionTimeout - OpenBSD-Commit-ID: edf1601c1d0905f6da4c713f4d9cecc7d1c0295a + OpenBSD-Regress-ID: 7f29001374a68e71e5e078f69e4520cf4bcca084 -commit 4b5f91cb959358141181b934156513fcb8a6c1e3 +commit aff9493a89c71d6a080419b49ac64eead9730491 Author: djm@openbsd.org -Date: Wed Sep 14 00:02:03 2022 +0000 +Date: Mon Jan 16 04:11:29 2023 +0000 - upstream: ssh-agent: attempt FIDO key signing without PIN and use + upstream: unbreak test: cannot access shell positional parameters - the error to determine whether a PIN is required and prompt only if - necessary. from Corinna Vinschen + past $9 without wrapping the position in braces (i.e. need ${10}, etc.) - OpenBSD-Commit-ID: dd6be6a0b7148608e834ee737c3479b3270b00dd + OpenBSD-Regress-ID: 3750ec98d5d409ce6a93406fedde6f220d2ea2ac -commit 113523bf0bc33600b07ebb083572c8c346b6fdf4 -Author: jmc@openbsd.org -Date: Sun Sep 11 06:38:11 2022 +0000 +commit 0293c19807f83141cdf33b443154459f9ee471f6 +Author: djm@openbsd.org +Date: Tue Jan 17 09:44:48 2023 +0000 - upstream: .Li -> .Vt where appropriate; from josiah frentsos, + upstream: Add a sshd_config UnusedConnectionTimeout option to terminate - tweaked by schwarze + client connections that have no open channels for some length of time. This + complements the recently-added ChannelTimeout option that terminates inactive + channels after a timeout. - ok schwarze + ok markus@ - OpenBSD-Commit-ID: 565046e3ce68b46c2f440a93d67c2a92726de8ed + OpenBSD-Commit-ID: ca983be74c0350364c11f8ba3bd692f6f24f5da9 -commit 86af013b56cecb5ee58ae0bd9d495cd586fc5918 -Author: jsg@openbsd.org -Date: Sat Sep 10 08:50:53 2022 +0000 +commit 8ec2e3123802d2beeca06c1644b0b647f6d36dab +Author: djm@openbsd.org +Date: Sun Jan 15 23:35:10 2023 +0000 - upstream: fix repeated words ok miod@ jmc@ + upstream: adapt to ed25519 changes in src/usr.bin/ssh - OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7 + OpenBSD-Regress-ID: 4b3e7ba7ee486ae8a0b4790f8112eded2bb7dcd5 -commit 0ba39b93b326a7d5dfab776cc9b9d326161a9b16 +commit 9fbbfeca1ce4c7ec0001c827bbf4189a3ba0964b Author: djm@openbsd.org -Date: Fri Sep 9 03:31:42 2022 +0000 +Date: Sun Jan 15 23:05:32 2023 +0000 - upstream: notifier_complete(NULL, ...) is a noop, so no need to test + upstream: update OpenSSH's Ed25519 code to the last version of SUPERCOP - that ctx!=NULL; from Corinna Vinschen + (20221122) and change the import approach to the same one we use for + Streamlined NTRUPrime: use a shell script to extract the bits we need from + SUPERCOP, make some minor adjustments and squish them all into a single file. - OpenBSD-Commit-ID: ade2f2e9cc519d01a586800c25621d910bce384a - -commit be197635329feb839865fdc738e34e24afd1fca8 -Author: Sam James -Date: Thu Sep 8 02:49:29 2022 +0100 - - openbsd-compat/bsd-asprintf: add include for vsnprintf + ok tb@ tobhe@ - Fixes the following build failure with Clang 15 on musl: - ``` - bsd-asprintf.c:51:8: error: call to undeclared library function 'vsnprintf' with type 'int (char *, unsigned long, const char *, struct __va_list_tag *)'; ISO C99 and laterclang -O2 -pipe -fdiagnostics-color=always -frecord-gcc-switches -pipe -Wunknown-warning-option -Qunused-arguments -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -Wmisleading-indentation -Wbitwise-instead-of-logical -fno-strict-aliasing -mretpoline -ftrapv -fzero-call-used-regs=all -fno-builtin-memset -fstack-protector-strong -fPIE -I. -I. -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -DSSHDIR=\"/etc/ssh\" -D_PATH_SSH_PROGRAM=\"/usr/bin/ssh\" -D_PATH_SSH_ASKPASS_DEFAULT=\"/usr/lib/misc/ssh-askpass\" -D_PATH_SFTP_SERVER=\"/usr/lib/misc/sftp-server\" -D_PATH_SSH_KEY_SIGN=\"/usr/lib/misc/ssh-keysign\" -D_PATH_SSH_PKCS11_HELPER=\"/usr/lib/misc/ssh-pkcs11-helper\" -D_PATH_SSH_SK_HELPER=\"/usr/lib/misc/ssh-sk-helper\" -D_PATH_SSH_PIDDIR=\"/run\" -D_PATH_PRIVSEP_CHROOT_DIR=\"/var/empty\" -DHAVE_CONFIG_H -c cipher-aes.c -o cipher-aes.o - do not support - implicit function declarations [-Wimplicit-function-declaration] - ret = vsnprintf(string, INIT_SZ, fmt, ap2); - ^ - bsd-asprintf.c:51:8: note: include the header or explicitly provide a declaration for 'vsnprintf' - 1 error generated. - ``` + OpenBSD-Commit-ID: 1bc0fd624cb6af440905b8ba74ac7c03311b8e3b -commit 6cb6f660bb35f77a0456dd2581ddf39c29398a5e +commit 6283f4bd83eee714d0f5fc55802eff836b06fea8 Author: Darren Tucker -Date: Fri Sep 2 16:43:27 2022 +1000 +Date: Sat Jan 14 22:02:44 2023 +1100 - Remove DEF_WEAK, it's already in defines.h. + Allow writev is seccomp sandbox. + + This seems to be used by recent glibcs at least in some configurations. + From bz#3512, ok djm@ -commit ce39e7d8b70c4726defde5d3bc4cb7d40d131153 -Author: Darren Tucker -Date: Fri Sep 2 14:28:14 2022 +1000 +commit 923c3f437f439cfca238fba37e97a7041782f615 +Author: dtucker@openbsd.org +Date: Sat Jan 14 10:05:54 2023 +0000 - Resync arc4random with OpenBSD. + upstream: Shell syntax fix. From ren mingshuai vi github PR#369. - This brings us up to current, including djm's random-reseeding change, - as prompted by logan at cyberstorm.mu in bz#3467. It brings the - platform-specific hooks from LibreSSL Portable, simplified to match our - use case. ok djm@. + OpenBSD-Regress-ID: 6696b2eeefe128099fc3d7ea9f23252cc35156f9 -commit beaddde26f30e2195b8aa4f3193970e140e17305 -Author: Darren Tucker -Date: Fri Sep 2 14:20:04 2022 +1000 +commit 4d87a00f704e0365e11c3c38b170c1275ec461fc +Author: dtucker@openbsd.org +Date: Sat Jan 14 09:57:08 2023 +0000 - Move OPENBSD ORIGINAL marker. + upstream: Instead of skipping the all-tokens test if we don't have + + OpenSSL (since we use it to compute the hash), put the hash at the end and + just omit it if we don't have it. Prompted by bz#3521. - Putting this after the copyright statement (which doesn't change) - instead of before the version identifier (which does) prevents merge - conflicts when resyncing changes. + OpenBSD-Regress-ID: c79ecba64250ed3b6417294b6c965e6b12ca5eea -commit c83e467ead67a8cb48ef4bec8085d6fb880a2ff4 -Author: Darren Tucker -Date: Fri Sep 2 14:17:28 2022 +1000 +commit b05406d6f93b8c8ec11ec8b27e7c76cc7a5a55fb +Author: jmc@openbsd.org +Date: Fri Jan 13 07:13:40 2023 +0000 - Remove arc4random_uniform from arc4random.c + upstream: fix double phrase in previous; - This was previously moved into its own file (matching OpenBSD) which - prematurely committed in commit 73541f2. + OpenBSD-Commit-ID: 671e6c8dc5e9230518b2bbfa143daaa88adc66c2 -commit 5f45c2395c60865e59fa44152ff1d003a128c5bc -Author: djm@openbsd.org -Date: Fri Sep 2 04:20:02 2022 +0000 +commit 40564812b659c530eb1f4b62d09e85612aef3107 +Author: dtucker@openbsd.org +Date: Fri Jan 13 03:16:29 2023 +0000 - upstream: sk-usbhid: fix key_lookup() on tokens with built-in UV - - explicitly test whether the token performs built-in UV (e.g. biometric - tokens) and enable UV in that case. From Pedro Martelletto via GHPR#388 + upstream: Document "UserKnownHostsFile none". ok djm@ - OpenBSD-Commit-ID: 007eb7e387d27cf3029ab06b88224e03eca62ccd + OpenBSD-Commit-ID: f695742d39e34ecdcc3c861c3739a84648a4bce5 -commit 03277a4aa49b80af541a3e691f264c0c0d8f9cec +commit d03e245e034019a37388f6f5f893ce848ab6d2e2 Author: Darren Tucker -Date: Wed Aug 31 20:26:30 2022 +1000 - - Move sftp from valgrind-2 to 3 to rebalance. - -commit fcf5365da69c516817321ba89c3a91df98d098df -Author: djm@openbsd.org -Date: Wed Aug 31 02:56:40 2022 +0000 +Date: Fri Jan 13 23:02:34 2023 +1100 - upstream: whitespace + Retry package installation 3 times. - OpenBSD-Commit-ID: c2bcbf93610d3d62ed206cdf9bf9ff98c6aaf232 - -commit e60136a3d7a223dd8e84ba8a6895bc3142360993 -Author: Damien Miller -Date: Mon Aug 29 13:27:45 2022 +1000 - - additional keys + When setting up the CI environment, retry package installation 3 times + before going up. Should help prevent spurious failures during + infrastructure issues. -commit 2b02dcb505288c462d1b5dd1ac04e603d01340eb -Author: Damien Miller -Date: Mon Aug 29 13:23:43 2022 +1000 +commit 625f6bc39840167dafb3bf5b6a3e18503ac986e8 +Author: dtucker@openbsd.org +Date: Fri Jan 13 04:47:34 2023 +0000 - cross-sign allowed_signers with PGP key + upstream: Move scp path setting to a helper function. The previous - Provides continuity of trust from legacy PGP release key to - the SSHSIG signing keys that we will use henceforth for git - signing. - -commit 51b345f177ae981b8755f6bdf8358b1cc5e83d67 -Author: Darren Tucker -Date: Sat Aug 27 21:49:27 2022 +1000 - - Add libcrypt-devel to cygwin-release deps. + commit to add scp to the test sshd's path causes the t-envpass test to fail + when the test scp is given using a fully qualified path. Put this in a + helper function and only call it from the scp tests. - Based on feedback from vinschen at redhat.com. + OpenBSD-Regress-ID: 7533dc1c4265c1de716abb062957994195b36df4 -commit 9f81736cf16dd8dda1c8942f1973a5f80b8cd78c -Author: Darren Tucker -Date: Sat Aug 27 09:37:40 2022 +1000 +commit 6e6f88647042b3cde54a628545c2f5fb656a9327 +Author: dtucker@openbsd.org +Date: Fri Jan 13 04:23:00 2023 +0000 - Add Windows 2022 test targets. + upstream: Add scp's path to test sshd's PATH. + + If the scp we're testing is fully qualified (eg it's not in the system + PATH) then add its path to the under-test sshd's PATH so we can find + it. Prompted by bz#3518. + + OpenBSD-Regress-ID: 7df4f5a0be3aa135495b7e5a6719d3cbc26cc4c0 -commit 85e1a69243f12be8520438ad6a3cfdc0b7fcbb2d +commit 8a5e99a70fcf9b022a8aa175ebf6a71f58511da3 Author: Darren Tucker -Date: Fri Aug 26 16:26:06 2022 +1000 +Date: Fri Jan 13 15:49:48 2023 +1100 - Add cygwin-release test target. + Remove skipping test when scp not in path. - This also moves the cygwin package install from the workflow file to - setup_ci.sh so that we can install different sets of Cygwin packages - for different test configs. + An upcoming change renders this obsolete by adding scp's path to the + test sshd's PATH, and removing this first will make the subsequent sync + easier. -commit 92382dbe8bf9ea1225b16858f9b9b208c15c7e8d -Author: djm@openbsd.org -Date: Fri Aug 26 08:16:27 2022 +0000 +commit 41f36dd896c8fb8337d403fcf476762986976e9d +Author: dtucker@openbsd.org +Date: Fri Jan 13 02:58:20 2023 +0000 - upstream: whitespace + upstream: Add a "Host" line to the output of ssh -G showing the - OpenBSD-Commit-ID: a5d015efbfd228dc598ffdef612d2da3a579e5d8 - -commit 70a5de0a50e84d7250eb4e4537f765599f64c4af -Author: djm@openbsd.org -Date: Fri Aug 26 08:12:56 2022 +0000 - - upstream: whitespace + original host arg. Inspired by patch from vincent at bernat.ch via bz#3343, + ok djm@ - OpenBSD-Commit-ID: d297e4387935d4aef091c5e9432578c2e513f538 - -commit 3a683a19fd116ea15ebf8aa13d02646cceb302a9 -Author: Damien Miller -Date: Fri Aug 26 14:23:55 2022 +1000 - - initial list of allowed signers - -commit 6851f4b8c3fc1b3e1114c56106e4dc31369c8513 -Author: Darren Tucker -Date: Fri Aug 19 17:22:18 2022 +1000 - - Install Cygwin packages based on OS not config. + OpenBSD-Commit-ID: 59c0f60a222113a44d0650cd394376e3beecc883 -commit f96480906893ed93665df8cdf9065865c51c1475 +commit f673b49f3be3eb51074fbb8a405beb6cd0f7d93e Author: djm@openbsd.org -Date: Fri Aug 19 06:07:47 2022 +0000 +Date: Fri Jan 13 02:44:02 2023 +0000 - upstream: attemp FIDO key signing without PIN and use the error + upstream: avoid printf("%s", NULL) if using ssh - code returned to fall back only if necessary. Avoids PIN prompts for FIDO - tokens that don't require them; part of GHPR#302 + -oUserKnownHostsFile=none and a hostkey in one of the system known hosts file + changes; ok dtucker@ - OpenBSD-Commit-ID: 4f752aaf9f2e7c28bcaaf3d4f8fc290131bd038e + OpenBSD-Commit-ID: 7ca87614bfc6da491315536a7f2301434a9fe614 -commit 5453333b5d28e313284cb9aae82899704103f98d +commit 93fc7c576563e3d88a1dc019dd213f65607784cc Author: djm@openbsd.org -Date: Fri Aug 19 05:53:28 2022 +0000 +Date: Wed Jan 11 05:39:38 2023 +0000 - upstream: remove incorrect check that can break enrolling a + upstream: clamp the minimum buffer lengths and number of inflight - resident key (introduced in r1.40) + requests too - OpenBSD-Commit-ID: 4cab364d518470e29e624af3d3f9ffa9c92b6f01 + OpenBSD-Commit-ID: c4965f62fa0ba850940fd66ae3f60cf516bbcd56 -commit ff89b1bed80721295555bd083b173247a9c0484e -Author: dtucker@openbsd.org -Date: Fri Aug 19 04:02:46 2022 +0000 +commit 48bf234322e639d279c5a28435eae50155e9b514 +Author: djm@openbsd.org +Date: Wed Jan 11 05:36:50 2023 +0000 - upstream: Strictly enforce the maximum allowed SSH2 banner size in + upstream: ignore bogus upload/download buffer lengths in the limits - ssh-keyscan and prevent a one-byte buffer overflow. Patch from Qualys, ok - djm@ + extension - OpenBSD-Commit-ID: 6ae664f9f4db6e8a0589425f74cd0bbf3aeef4e4 - -commit 1b470b9036639cef4f32fb303bb35ea0b711178d -Author: Darren Tucker -Date: Fri Aug 19 15:18:09 2022 +1000 - - Fix cygwin conditional steps. - -commit fd6ee741ab16714b7035d60aca924123ba28135a -Author: Darren Tucker -Date: Fri Aug 19 15:12:57 2022 +1000 - - Add a bit more debug output. + OpenBSD-Commit-ID: c5b023e0954693ba9a5376e4280c739b5db575f8 -commit a9305c4c739f4d91a3d3a92c0b6d4949404a36c5 -Author: Darren Tucker -Date: Fri Aug 12 15:08:47 2022 +1000 +commit 36b00d31833ca74cb0f7c7d8eda1bde55700f929 +Author: djm@openbsd.org +Date: Wed Jan 11 02:13:52 2023 +0000 - Add Cygwin (on windows-2019) test target. + upstream: remove whitespace at EOL from code extracted from SUPERCOP - In addition to installing the requisite Cygwin packages, we also need to - explicitly invoke "sh" for steps that run other scripts since the runner - environment doesn't understand #! paths. + OpenBSD-Commit-ID: 1ec524ff2fbb9387d731601437c82008f35a60f4 -commit 5062ad48814b06162511c4f5924a33d97b6b2566 +commit d888de06c5e4d7dbf2f2b85f2b5bf028c570cf78 Author: djm@openbsd.org -Date: Fri Aug 19 03:06:30 2022 +0000 +Date: Wed Jan 11 00:51:27 2023 +0000 - upstream: double free() in error path; from Eusgor via GHPR333 + upstream: rewrite this test to use a multiplexed ssh session so we can + + control its lifecycle without risk of race conditions; fixes some of the + Github integration tests for openssh-portable - OpenBSD-Commit-ID: 39f35e16ba878c8d02b4d01d8826d9b321be26d4 + OpenBSD-Regress-ID: 5451cad59ba0d43ae9eeda48ec80f54405fee969 -commit 5a5c580b48fc6006bdfa731fc2f6d4945c2c0e4e -Author: Darren Tucker -Date: Thu Aug 18 21:36:39 2022 +1000 +commit 4bcc737a35fdd9cc4af7423d6c23dfd0c7ef4786 +Author: Damien Miller +Date: Wed Jan 11 11:45:17 2023 +1100 - Check for perms to run agent-getpeereid test. + remove buffer len workaround for NetBSD 4.x - Ubuntu 22.04 defaults to private home dirs which prevents "nobody" - running ssh-add during the agent-getpeereid test. Check for this and - add the necessary permissions. + Switching to from pipes to a socketpair for communicating with the + ssh process avoids the (kernel bug?) problem. -commit cd06a76b7ccc706e2bb4f1cc4aa9e9796a28a812 +commit f5154d2aac3e6a32a1b13dec23a701a087850cdc Author: Damien Miller -Date: Wed Aug 17 16:04:16 2022 +1000 +Date: Wed Jan 11 11:44:19 2023 +1100 - on Cygwin, prefer WinHello FIDO device + add back use of pipes in scp.c under USE_PIPES - If no FIDO device was explictly specified, then prefer the - windows://hello FIDO device. An exception to this is when - probing resident FIDO keys, in which case hardware FIDO - devices are preferred. + This matches sftp.c which prefers socketpair but uses pipes on + some older platforms. -commit 47f72f534ac5cc2cd3027675a3df7b00a8f77575 -Author: djm@openbsd.org -Date: Wed Aug 17 06:01:57 2022 +0000 +commit eec737b59cf13841de46134967a206607000acd4 +Author: millert@openbsd.org +Date: Tue Jan 10 23:22:15 2023 +0000 - upstream: add an extra flag to sk_probe() to indicate whether we're + upstream: Switch scp from using pipes to a socketpair for - probing for a FIDO resident key or not. Unused here, but will make like - easier for portable + communication with it's ssh sub-processes. We no longer need to reserve two + descriptors to ensure that we don't end up using fd 0-2 unexpectedly, that is + handled by sanitise_stdfd() in main(). Based on an original diff from djm@. + OK deraadt@ djm@ - OpenBSD-Commit-ID: 432c8ff70e270378df9dbceb9bdeaa5b43b5a832 + OpenBSD-Commit-ID: b80c372faac462471e955ddeab9480d668a2e48d -commit edb0bcb3c79b16031dc87a8e57aecc3c4a3414f0 +commit d213d126a4a343abd3a1eb13687d39c1891fe5c8 Author: jmc@openbsd.org -Date: Tue Aug 16 20:24:08 2022 +0000 +Date: Fri Jan 6 08:44:11 2023 +0000 - upstream: use .Cm for "sign"; from josiah frentsos + upstream: tweak previous; ok djm - OpenBSD-Commit-ID: 7f80a53d54857ac6ae49ea6ad93c5bd12231d1e4 + OpenBSD-Commit-ID: 229c493452766d70a78b0f02f6ff9894f9028858 -commit cccb011e130cbbac538b1689d10e4a067298df8b -Author: Corinna Vinschen -Date: Thu Aug 11 20:19:35 2022 +0200 +commit 4a5590a5ee47b7dfd49773e9fdba48ad3089fe64 +Author: Damien Miller +Date: Mon Jan 9 16:33:56 2023 +1100 - Revert "check_sk_options: add temporary WinHello workaround" - - Cygwin now comes with libfido2 1.11.0, so this workaround - isn't required anymore. - - This reverts commit 242c044ab111a37aad3b0775727c36a4c5f0102c. + try to improve logging for dynamic-forward test - Signed-off-by: Corinna Vinschen + previously the logs from the ssh used to exercise the forwarding + channel would clobber the logs from the ssh actually doing the + forwarding -commit 9468cd7cf9d989dfa2ac20e2a0268ba6e93bfa5a -Author: Corinna Vinschen -Date: Thu Aug 11 20:18:17 2022 +0200 +commit 715bc25dcfccf9fb2bee820155fe071d01a618db +Author: Darren Tucker +Date: Sat Jan 7 23:24:50 2023 +1100 - fido_dev_is_winhello: return 0, not "false" - - "false" is not used anywhere in OpenSSH, so return 0 like - everywhere else. + Skip dynamic-forward test on minix3. - Signed-off-by: Corinna Vinschen + This test relies on loopback addresses which minix does not have. + Previously the test would not run at all since it also doesn't have + netcat, but now we use our own netcat it tries and fails. -commit 730a80609472ee0451c99482d75c9c41f3ebc42d -Author: djm@openbsd.org -Date: Fri Aug 12 05:20:28 2022 +0000 +commit dd1249bd5c45128a908395c61b26996a70f82205 +Author: Damien Miller +Date: Sun Jan 8 12:08:59 2023 +1100 - upstream: sftp-server: support home-directory request - - Add support to the sftp-server for the home-directory extension defined - in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the - existing expand-path@openssh.com, but uses a more official protocol name, - and so is a bit more likely to be implemented by non-OpenSSH clients. + don't test IPv6 addresses if platform lacks support + +commit d77fc611a62f2dfee0b654c31a50a814b13310dd +Author: dtucker@openbsd.org +Date: Fri Jan 6 12:33:33 2023 +0000 + + upstream: When OpenSSL is not available, skip parts of percent test - From Mike Frysinger, ok dtucker@ + that require it. Based on github pr#368 from ren mingshuai. - OpenBSD-Commit-ID: bfc580d05cc0c817831ae7ecbac4a481c23566ab + OpenBSD-Regress-ID: 49a375b2cf61ccb95b52e75e2e025cd10988ebb2 -commit 5e820bf79ce3ce99ef7e98b0ab642b0a0a4f396c +commit 1cd2aac312af9172f1b5cb06c2e1cd090abb83cf Author: Darren Tucker -Date: Fri Aug 12 14:56:55 2022 +1000 +Date: Sat Jan 7 23:01:11 2023 +1100 - Replace deprecated ubuntu-18.04 runners with 22.04 + Use our own netcat for dynamic-forward test. + + That way we can be surer about its behaviour rather than trying to + second-guess the behaviour of various netcat implementations. -commit 87b0d9c1b789d3ff958ec45df2ac912e24461bae +commit 26cab41c05d7b0859d2a1ea5b6ed253d91848a80 Author: Darren Tucker -Date: Thu Aug 11 22:48:23 2022 +1000 +Date: Sat Jan 7 14:30:43 2023 +1100 - Add a timegm implementation from Heimdal via Samba. + Use autoconf to find openssl binary. - Fixes build on (at least Solaris 10). + It's possible to install an OpenSSL in a path not in the system's + default library search path. OpenSSH can still use this (eg if you + specify an rpath) but the openssl binary there may not work. If one is + available on the system path just use that. -commit d0c4fa58594577994921b593f10037c5282597ca +commit 5532e010a0eeb6aa264396514f9aed7948471538 Author: Darren Tucker -Date: Thu Aug 11 14:23:58 2022 +1000 +Date: Sat Jan 7 10:34:18 2023 +1100 - Rerun tests if any .github config file changes. + Check openssl_bin path is executable before using. -commit 113fe6c77ab43769fc61e953d07cb619fd7ea54b +commit 5d7b16cff48598d5908db970bfdc9ff9326142c8 Author: Darren Tucker -Date: Thu Aug 11 13:33:51 2022 +1000 +Date: Fri Jan 6 23:19:07 2023 +1100 - Skip hostbased during Valgrind tests. - - Valgrind doesn't let ssh exec ssh-keysign (because it's setuid) so skip - it during the Valgrind based tests. + Set OPENSSL_BIN from OpenSSL directory. + +commit 344a0e8240eaf08da5d46a5e3a9ecad6e4f64c35 +Author: dtucker@openbsd.org +Date: Fri Jan 6 08:50:33 2023 +0000 + + upstream: Save debug logs from ssh for debugging purposes. - See https://bugs.kde.org/show_bug.cgi?id=119404 for a discussion of this - (ironically there the problematic binary was ssh(1) back when it could - still be setuid). + OpenBSD-Regress-ID: 109e40b06de1c006a3b8e0d8745b790b2c5870a0 -commit b98a42afb69d60891eb0488935990df6ee571c4d +commit e1ef172646f7f49c80807eea90225ef5e0be55a8 Author: djm@openbsd.org -Date: Thu Aug 11 01:57:50 2022 +0000 +Date: Fri Jan 6 08:07:39 2023 +0000 - upstream: add some tests for parse_absolute_time(), including cases + upstream: regression test for ChannelTimeout - where it is forced to the UTC timezone. bz3468 ok dtucker + OpenBSD-Regress-ID: 280bfbefcfa415428ad744e43f69a8dede8ad685 + +commit 2393ea8daf25853459eb07a528d7577688847777 +Author: djm@openbsd.org +Date: Fri Jan 6 07:18:18 2023 +0000 + + upstream: fix typo in verbose logging - OpenBSD-Regress-ID: ea07ca31c2f3847a38df028ca632763ae44e8759 + OpenBSD-Regress-ID: 0497cdb66e003b2f50ed77291a9104fba2e017e9 -commit ec1ddb72a146fd66d18df9cd423517453a5d8044 +commit 161a5378a3cc2e7aa3f9674cb7f4686ae6ce9586 Author: djm@openbsd.org -Date: Thu Aug 11 01:56:51 2022 +0000 +Date: Fri Jan 6 02:59:50 2023 +0000 - upstream: allow certificate validity intervals, sshsig verification + upstream: unit tests for misc.c:ptimeout_* API - times and authorized_keys expiry-time options to accept dates in the UTC time - zone in addition to the default of interpreting them in the system time zone. - YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if - suffixed with a 'Z' character. + OpenBSD-Regress-ID: 01f8fb12d08e5aaadd4bd4e71f456b6588be9a94 + +commit 018d671d78145f03d6f07ae9d64d51321da70325 +Author: tb@openbsd.org +Date: Wed Jan 4 22:48:57 2023 +0000 + + upstream: Copy bytes from the_banana[] rather than banana() - Also allow certificate validity intervals to be specified in raw - seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This - is intended for use by regress tests and other tools that call - ssh-keygen as part of a CA workflow. + Fixes test failure due to segfault seen on arm64 with xonly snap. - bz3468 ok dtucker + ok djm - OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13 - -commit 4df246ec75751da7eb925e1880498300d8bda187 -Author: Darren Tucker -Date: Thu Aug 11 10:23:55 2022 +1000 - - Fix conditional for running hostbased tests. + OpenBSD-Regress-ID: 86e2aa4bbd1dff1bc4ebb2969c0d6474485be046 -commit 2580916e48721802220c61ce9e0df1297c00bc07 +commit ab6bb69e251faa8b24f81b25c72ec0120f20cad4 Author: Damien Miller -Date: Thu Aug 11 08:58:28 2022 +1000 - - fix SANDBOX_SECCOMP_FILTER_DEBUG - -commit fdbd5bf507fc271ff813714fab8a72ff2c6cb5ca -Author: Darren Tucker -Date: Wed Aug 10 17:35:52 2022 +1000 - - Test hostbased auth on github runners. - -commit 7e2f51940ba48a1c0fae1107801ea643fa83c971 -Author: Darren Tucker -Date: Wed Aug 10 17:25:24 2022 +1000 +Date: Fri Jan 6 19:13:36 2023 +1100 - Rename our getentropy to prevent possible loops. + unbreak scp on NetBSD 4.x - Since arc4random seeds from getentropy, and we use OpenSSL for that - if enabled, there's the possibility that if we build on a system that - does not have getentropy then run on a system that does have it, then - OpenSSL could end up calling our getentropy and getting stuck in a loop. - Pointed out by deraadt@, ok djm@ - -commit 7a01f61be8d0aca0e975e7417f26371495fe7674 -Author: Darren Tucker -Date: Mon Aug 8 12:17:04 2022 +1000 - - Actually put HAVE_STDINT_H around the stdint.h. - -commit 73541f29f0b50480da6c20dceb7a7191bd8ea7d3 -Author: Darren Tucker -Date: Mon Aug 8 10:30:34 2022 +1000 - - Give unused param a name. + e555d5cad5 effectively increased the default copy buffer size for SFTP + transfers. This caused NetBSD 4.x to hang during the "copy local file to + remote file in place" scp.sh regression test. + + This puts back the original 32KB copy buffer size until we can properly + figure out why. - Fixes builds on platforms that do have fido2 but don't have - fido_dev_is_winhello. + lots of debugging assistance from dtucker@ -commit 2a108c0ea960381bd9b14ee0d84e818a23df4482 +commit 2d1ff2b9431393ad99ef496d5e3b9dd0d4f5ac8c Author: djm@openbsd.org -Date: Fri Aug 5 05:01:40 2022 +0000 +Date: Fri Jan 6 02:47:18 2023 +0000 - upstream: don't prompt for FIDO passphrase before attempting to enroll - - the credential, just let the enroll operating fail and we'll attempt to get a - PIN anyway. Might avoid some unneccessary PIN prompts. + upstream: Implement channel inactivity timeouts - Part of GHPR#302 from Corinna Vinschen; ok dtucker@ + This adds a sshd_config ChannelTimeouts directive that allows channels that + have not seen traffic in a configurable interval to be automatically closed. + Different timeouts may be applied to session, X11, agent and TCP forwarding + channels. - OpenBSD-Commit-ID: bd5342ffc353ee37d39617906867c305564d1ce2 - -commit 2886975c0ad9244e60dc5e4be34fde3aa573a4b5 -Author: Corinna Vinschen -Date: Fri Feb 11 14:33:41 2022 +0100 - - sk_sign: set FIDO2 uv attribute explicitely for WinHello + Note: this only affects channels over an opened SSH connection and not + the connection itself. Most clients close the connection when their channels + go away, with a notable exception being ssh(1) in multiplexing mode. - WinHello via libfido2 performs user verification by default. - However, if we stick to that, there's no way to differentiate - between keys created with or without "-O verify-required". - Set FIDO2 uv attribute explicitely to FIDO_OPT_FALSE, then check - if user verification has been requested. + ok markus dtucker - Signed-off-by: Corinna Vinschen + OpenBSD-Commit-ID: ae8bba3ed9d9f95ff2e2dc8dcadfa36b48e6c0b8 -commit 242c044ab111a37aad3b0775727c36a4c5f0102c -Author: Corinna Vinschen -Date: Tue Feb 15 11:28:08 2022 +0100 +commit 0e34348d0bc0b1522f75d6212a53d6d1d1367980 +Author: djm@openbsd.org +Date: Fri Jan 6 02:42:34 2023 +0000 - check_sk_options: add temporary WinHello workaround + upstream: Add channel_set_xtype() - Up to libfido 1.10.0, WinHello advertises "clientPin" rather - than "uv" capability. This is fixed in 1.11.0. For the time - being, workaround it here. + This sets an "extended" channel type after channel creation (e.g. + "session:subsystem:sftp") that will be used for setting channel inactivity + timeouts. - Signed-off-by: Corinna Vinschen - -commit 78774c08cc4b4997382975b0f414a86e06b6780c -Author: Corinna Vinschen -Date: Thu Feb 10 18:19:29 2022 +0100 - - compat code for fido_dev_is_winhello() + ok markus dtucker - Signed-off-by: Corinna Vinschen + OpenBSD-Commit-ID: 42564aa92345045b4a74300528f960416a15d4ca -commit 3d3a932a019aedfb891e0779bb4990cd5008a390 -Author: Darren Tucker -Date: Fri Aug 5 13:12:27 2022 +1000 +commit ceedf09b2977f3a756c759a6e7eb8f8e9db86a18 +Author: djm@openbsd.org +Date: Fri Jan 6 02:41:49 2023 +0000 - Factor out getrnd() and rename to getentropy(). + upstream: tweak channel ctype names - Factor out the arc4random seeding into its own file and change the - interface to match getentropy. Use native getentropy if available. - This will make it easier to resync OpenBSD changes to arc4random. - Prompted by bz#3467, ok djm@. - -commit 9385d277b787403be9dfcb229cf372202496d2f3 -Author: Darren Tucker -Date: Thu Aug 4 18:55:48 2022 +1000 - - Include CHANNEL and FIDO2 libs in configure output + These are now used by sshd_config:ChannelTimeouts to specify timeouts by + channel type, so force them all to use a similar format without whitespace. + + ok dtucker markus + + OpenBSD-Commit-ID: 66834765bb4ae14f96d2bb981ac98a7dae361b65 -commit 141535b904b6fba01724444f38193a8599201f82 +commit c60438158ad4b2f83d8504257aba1be7d0b0bb4b Author: djm@openbsd.org -Date: Mon Aug 1 11:09:26 2022 +0000 +Date: Fri Jan 6 02:39:59 2023 +0000 - upstream: avoid double-free in error path introduced in r1.70; report + upstream: Add channel_force_close() - and fix based on GHPR#332 by v-rzh ok dtucker@ + This will forcibly close an open channel by simulating read/write errors, + draining the IO buffers and calling the detach function. - OpenBSD-Commit-ID: 3d21aa127b1f37cfc5bdc21461db369a663a951f - -commit dba7099ffcba3ca07b3946f017ba6a4c3158d9b1 -Author: Darren Tucker -Date: Wed Jul 27 18:40:12 2022 +1000 - - Remove deprecated MacOS 10.15 runners. - -commit 722a56439aa5972c830e4a9a724cf52aff4a950a -Author: Darren Tucker -Date: Wed Jul 27 18:31:14 2022 +1000 - - Move stale-configure check as early as possible. + Previously the detach function was only ever called during channel garbage + collection, but there was no way to signal the user of a channel (e.g. + session.c) that its channel was being closed deliberately (vs. by the + usual state-machine logic). So this adds an extra "force" argument to the + channel cleanup callback to indicate this condition. - We added a check in Makefile to catch the case where configure needs to - be rebuilt, however this did not happen until a build was attempted in - which case all of the work done by configure was wasted. Move this check - to the start of configure to catch it as early as possible. ok djm@ - -commit 099d6b56288b421ba38531d26dc1bd6bb685e311 -Author: Darren Tucker -Date: Fri Jul 22 10:47:19 2022 +1000 - - Move libcrypto into CHANNELLIBS. + ok markus dtucker - This will result in sftp, sftp-server and scp no longer being linked - against libcrypto. ok djm@ + OpenBSD-Commit-ID: 23052707a42bdc62fda2508636e624afd466324b -commit 1bdf86725b77733bb5f17c54888b88a10b2f6538 -Author: Darren Tucker -Date: Fri Jul 22 10:45:47 2022 +1000 +commit d478cdc7ad6edd4b1bcd1e86fb2f23194ff33d5a +Author: djm@openbsd.org +Date: Fri Jan 6 02:38:23 2023 +0000 - Remove seed_rng calls from scp, sftp, sftp-server. + upstream: replace manual poll/ppoll timeout math with ptimeout API - These binaries don't use OpenSSL's random functions. The next step - will be to stop linking them against libcrypto. ok djm@ - -commit d73f77b8cb9b422f1ac4facee7890aa10ff2bc21 -Author: Darren Tucker -Date: Fri Jul 22 09:51:51 2022 +1000 - - Group libcrypto and PRNGD checks together. + feedback markus / ok markus dtucker - They're related more than the libcrypt or libiaf checks which are - currently between them. ok djm@ + OpenBSD-Commit-ID: c5ec4f2d52684cdb788cd9cbc1bcf89464014be2 -commit f117e372b3f42f2fbdb0a578d063b2609ab58e1f -Author: Darren Tucker -Date: Fri Jul 22 09:24:45 2022 +1000 +commit 4adf3817a24efe99b06e62630577d683c7cd8065 +Author: djm@openbsd.org +Date: Fri Jan 6 02:37:04 2023 +0000 - Do not link scp, sftp and sftp-server w/ zlib. + upstream: add ptimeout API for keeping track of poll/ppoll + + timeouts; ok dtucker markus - Some of our binaries (eg sftp, sftp-server, scp) do not interact with - the channels code and thus do use libraries such as zlib and libcrypto - although they are linked with them. This adds a CHANNELLIBS and starts - by moving zlib into it, which means the aformentioned binaries are no - longer linked against zlib. ok djm@ + OpenBSD-Commit-ID: 3335268ca135b3ec15a947547d7cfbb8ff929ead -commit 800c2483e68db38bd1566ff69677124be974aceb -Author: Darren Tucker -Date: Mon Jul 25 21:49:04 2022 +1000 +commit 8c7c69d32375d2f3ce9da0109c9bffc560842316 +Author: djm@openbsd.org +Date: Thu Jan 5 05:49:13 2023 +0000 - Remove workarounds for OpenSSL missing AES-CTR. + upstream: suppress "Connection closed" message when in quiet mode - We have some compatibility hacks that were added to support OpenSSL - versions that do not support AES CTR mode. Since that time, however, - the minimum OpenSSL version that we support has moved to 1.0.1 which - *does* have CTR, so this is no longer needed. ok djm@ + OpenBSD-Commit-ID: 8a3ab7176764da55f60bfacfeae9b82d84e3908f -commit b7c56b65c12f51fe0dbae798d19c8f58224a5d95 -Author: Darren Tucker -Date: Mon Jul 25 21:43:00 2022 +1000 +commit 845ceecea2ac311b0c267f9ecbd34862e1876fc6 +Author: djm@openbsd.org +Date: Mon Jan 2 07:03:57 2023 +0000 - Remove workarounds for OpenSSL missing AES-GCM. + upstream: regression test for PermitRemoteOpen - We have some compatibility hacks that were added to support OpenSSL - versions that do not support AES GCM mode. Since that time, however, - the minimum OpenSSL version that we support has moved to 1.0.1 which - *does* have GCM, so this is no longer needed. ok djm@ + OpenBSD-Regress-ID: 8271aafbf5c21950cd5bf966f08e585cebfe630c -commit 5a4a9f7a968fbf92cc1eac519c65638e79ae9f1f -Author: dtucker@openbsd.org -Date: Mon Jul 25 07:12:45 2022 +0000 +commit b3daa8dc582348d6ab8150bc1e571b7aa08c5388 +Author: djm@openbsd.org +Date: Mon Jan 2 07:03:30 2023 +0000 - upstream: Restore missing "!" in TEST_SSH_ELAPSED_TIMES test. + upstream: fix bug in PermitRemoteOpen which caused it to ignore its - OpenBSD-Regress-ID: 38783f9676ec348c5a792caecee9a16e354b37b0 - -commit 0ff886be132299386cc29d87c2aa16ff68a1aa08 -Author: dtucker@openbsd.org -Date: Sun Jul 24 23:29:10 2022 +0000 - - upstream: Test TEST_SSH_ELAPSED_TIMES for empty string not + first argument unless it was one of the special keywords "any" or "none". - executable. No-op on most platforms but should prevent warnings in -portable - on systems that don't have 'date %s'. + Reported by Georges Chaudy in bz3515; ok dtucker@ - OpenBSD-Regress-ID: e39d79867b8065e33d0c5926fa1a31f85659d2a4 + OpenBSD-Commit-ID: c5678a39f1ff79993d5ae3cfac5746a4ae148ea5 -commit f69319ad8ad1dd50f90bbcf5912e11cc8ed3e037 -Author: Darren Tucker -Date: Sat Jul 23 14:38:22 2022 +1000 +commit 0872663a7be0301bcc3d49acdbc9b740a3d972d4 +Author: jmc@openbsd.org +Date: Mon Dec 26 19:16:03 2022 +0000 - Convert "have_prog" function into "which". + upstream: spelling fixes; from paul tagliamonte amendments to his - "which" and its behaviour is not standardized, so convert the existing - have_prog function into "which" so we can rely on it being available - and what its semantics are. Add a have_prog wrapper that maintains the - existing behaviour. - -commit ea7ecc2c3ae39fdf5c6ad97b7bc0b47a98847f43 -Author: Darren Tucker -Date: Sat Jul 23 14:36:38 2022 +1000 - - Skip scp3 test if there's no scp on remote path. + diff are noted on tech - scp -3 ends up using the scp that's in the remote path and will fail if - one is not available. Based on a patch from rapier at psc.edu. - -commit c46f6fed419167c1671e4227459e108036c760f8 -Author: Damien Miller -Date: Wed Jul 20 13:39:14 2022 +1000 - - crank SSH_SK_VERSION_MAJOR in sk-dummy.so + OpenBSD-Commit-ID: d776dd03d0b882ca9c83b84f6b384f6f9bd7de4a -commit f208e3b9ffb5ee76cf9c95df7ff967adc7f51c7d +commit 797da2812a71785b34890bb6eb44767a7d09cd34 Author: djm@openbsd.org -Date: Wed Jul 20 03:33:22 2022 +0000 +Date: Fri Dec 16 07:13:22 2022 +0000 - upstream: ssh-keygen: fix touch prompt, pin retries; + upstream: Mention that scp uses the SFTP protocol and remove - part of GHPR329 from Pedro Martelletto + reference to legacy flag. Spotted by, feedback and ok jmc@ - OpenBSD-Commit-ID: 75d1005bd2ef8f29fa834c90d2684e73556fffe8 + OpenBSD-Commit-ID: 9dfe04966f52e941966b46c7a2972147f95281b3 -commit 8638a2ce7e90c8a51d9af3143404282126c524f8 +commit 93f2ce8c050a7a2a628646c00b40b9b53fef93ef Author: djm@openbsd.org -Date: Wed Jul 20 03:31:42 2022 +0000 +Date: Fri Dec 16 06:56:47 2022 +0000 - upstream: sk-usbhid: preserve error code returned by key_lookup() + upstream: Clear signal mask early in main(); sshd may have been + + started with one or more signals masked (sigprocmask(2) is not cleared + on fork/exec) and this could interfere with various things, e.g. the + login grace timer. + + Execution environments that fail to clear the signal mask before running + sshd are clearly broken, but apparently they do exist. - it conveys useful information, such as the supplied pin being wrong. + Reported by Sreedhar Balasubramanian; ok dtucker@ - Part of GHPR329 from Pedro Martelletto + OpenBSD-Commit-ID: 77078c0b1c53c780269fc0c416f121d05e3010ae + +commit 4acfaabfae41badb9d334a2ee88c5c6ad041c0d5 +Author: jmc@openbsd.org +Date: Fri Dec 16 06:52:48 2022 +0000 + + upstream: add -X to usage(); - OpenBSD-Commit-ID: c0647eb9290f793add363d81378439b273756c1b + OpenBSD-Commit-ID: 1bdc3df7de11d766587b0428318336dbffe4a9d0 -commit 9ab929ca2d820520327b41929372bcb9e261534c +commit e555d5cad5afae7d5ef2bbc02ca591178fe16fed Author: djm@openbsd.org -Date: Wed Jul 20 03:29:14 2022 +0000 +Date: Fri Dec 16 03:40:03 2022 +0000 - upstream: when enrolling a resident key on a security token, check + upstream: add a -X option to both scp(1) and sftp(1) to allow - if a credential with matching application and user ID strings already exists. - if so, prompt the user for confirmation before overwriting the credential. + control over some SFTP protocol knobs: the copy buffer length and + the number of inflight requests, both of which are used during + upload/download. - patch from Pedro Martelletto via GHPR329 + Previously these could be controlled in sftp(1) using the -b/-R options. + This makes them available in both SFTP protocol clients using the same + option character sequence. - NB. cranks SSH_SK_VERSION_MAJOR, so any third-party FIDO middleware - implementations will need to adjust + ok dtucker@ - OpenBSD-Commit-ID: e45e9f1bf2b2f32d9850669e7a8dbd64acc5fca4 + OpenBSD-Commit-ID: 27502bffc589776f5da1f31df8cb51abe9a15f1c -commit 5bcfc788b38d5b64e4c347bdc04bd9a01bbc36da -Author: djm@openbsd.org -Date: Wed Jul 20 03:13:04 2022 +0000 +commit 5a7a7acab2f466dc1d7467b5d05d35268c3137aa +Author: deraadt@openbsd.org +Date: Thu Dec 15 18:20:39 2022 +0000 - upstream: pull passphrase reading and confirmation into a separate + upstream: The idiomatic way of coping with signed char vs unsigned - function so it can be used for FIDO2 PINs; no functional change + char (which did not come from stdio read functions) in the presence of + ctype macros, is to always cast to (unsigned char). casting to (int) + for a "macro" which is documented to take int, is weird. And sadly wrong, + because of the sing extension risk.. same diff from florian - OpenBSD-Commit-ID: bf34f76b8283cc1d3f54633e0d4f13613d87bb2f + OpenBSD-Commit-ID: 65b9a49a68e22ff3a0ebd593f363e9f22dd73fea -commit eb679e2959bdb15454eb94751930eb4c9110da94 +commit b0b58222c7cc62efd8212c4fb65a545f58ebb22d Author: Darren Tucker -Date: Fri Jul 15 21:31:48 2022 +1000 +Date: Mon Dec 19 18:49:51 2022 +1100 - Move vmshutdown to first step. + Simply handling of SSH_CONNECTION PAM env var. - If a previous run on a physical runner has failed to clean up, the next - run will fail because it'll try to check out the code to a broken - directory mount. Make cleanup the first step. + Prompted by bz#3508: there's no need to cache the value of + sshpam_conninfo so remove the global. While there, add check of + return value from pam_putenv. ok djm@ -commit 46b91b70ff3cb9c147e2875ef5dc609fd64c0c96 +commit ed8444572ae684fdb892f97bae342c6cb6456f04 Author: Darren Tucker -Date: Fri Jul 15 20:25:27 2022 +1000 +Date: Mon Dec 19 18:42:34 2022 +1100 - Rename bbone test target to ARM. + Add tests for LibreSSL 3.7.0 and OpenSSL 1.1.1s. -commit 751d22cdeffed9fe921db78eedc32a29f9e80510 +commit abb9a8aaddfcacbd12641f6e4f203da0fa85a287 Author: Darren Tucker -Date: Fri Jul 15 13:37:29 2022 +1000 +Date: Sun Dec 18 21:36:25 2022 +1100 - Add AUDIT_ARCH_PPC to supported seccomp arches. - - Patch from dries.deschout at dodeco.eu. + Use sudo when resetting perms on directories. -commit a061792a6e8d235fc40a9b5d4c22a1762bb75a7b +commit 2f5664c5908d84697cbe91302d5d5c4d83cb2121 Author: Darren Tucker -Date: Thu Jul 14 19:20:24 2022 +1000 +Date: Sun Dec 18 21:19:33 2022 +1100 - Remove unintended changes. + Set group perms on regress dir. - I inadvertently included a couple of local changes with the OpenSSL - 3.0.4 change. Revert, anything that should be there will be committed - separately. + This ensures that the tests don't fail due to StrictMode checks. -commit 527cb43fa1b4e55df661feabbac51b8e608b6519 +commit 137196300fc1540affadde880210f02ba6cb4abf Author: Darren Tucker -Date: Thu Jul 14 11:22:08 2022 +1000 +Date: Sun Dec 18 21:13:42 2022 +1100 - Return ERANGE from getcwd() if buffer size is 1. - - If getcwd() is supplied a buffer size of exactly 1 and a path of "/", it - could result in a nul byte being written out of array bounds. POSIX says - it should return ERANGE if the path will not fit in the available buffer - (with terminating nul). 1 byte cannot fit any possible path with its nul, - so immediately return ERANGE in that case. - - OpenSSH never uses getcwd() with this buffer size, and all current - (and even quite old) platforms that we are currently known to work - on have a native getcwd() so this code is not used on those anyway. - Reported by Qualys, ok djm@ + Fetch regress logs from obj dir. -commit 36857fefd8849c4b0e877cfd9d1eb22f79b76650 +commit 5f93c4836527d9fda05de8944a1c7b4a205080c7 Author: Darren Tucker -Date: Thu Jul 14 10:02:35 2022 +1000 +Date: Tue Dec 13 20:59:54 2022 +1100 - Split README.platform into its own line. - - README.platform has general platform-specific information, having it - following text about FIDO2 on the same line could imply that it only - has information about FIDO2. + obsdsnap test VMs runs-on libvirt too. -commit 00a496c6c14f2d41f2a9365714d494dd5f3aac9f +commit 8386886fb1ab7fda73069fb0db1dbe0e5a52f758 Author: Darren Tucker -Date: Thu Jul 14 09:56:01 2022 +1000 +Date: Tue Dec 13 20:55:37 2022 +1100 - Clarify README.md text. - - Clarify the text about the implications of building without OpenSSL, and - prefix the "configure --help" example command with a "./" so it's likely - to work as-is in more shells. From bz#3461. + Run upstream obsdsnap tests on ephemeral runners. -commit f40b52f21fbc52eb513279168a49d3285c65256c +commit b6e01459b55ece85d7f296b2bc719d1841e1009e Author: Darren Tucker -Date: Tue Jul 12 19:48:44 2022 +1000 +Date: Tue Dec 13 20:48:56 2022 +1100 - Remove special casing of crypt(). - - Configure goes to some lengths to pick crypt() from either libcrypt - or OpenSSL's libcrypto because they can more or less featureful (eg - supporting md5-style passwords). + Move obsdsnap test VMs to ephemeral runners. + +commit ea6fdf9a1aa71a411f7db218a986392c4fb55693 +Author: Damien Miller +Date: Fri Dec 9 18:00:21 2022 +1100 + + use calloc for allocating arc4random structs - OpenSSL removed its crypt() interface in 2002: - https://github.com/openssl/openssl/commit/69deec58 so these hijinks - should no longer be necessary. This also only links sshd with libcrypt - which is the only thing that needs it. ok djm@ + ok dtucker -commit 76f4e48631d7b09fb243b47d7b393d100d3741b7 -Author: Darren Tucker -Date: Wed Jul 13 13:17:47 2022 +1000 +commit 4403b62f5548e91389cb3339d26a9d0c4bb07b34 +Author: dtucker@openbsd.org +Date: Fri Dec 9 00:22:29 2022 +0000 - Only refuse to use OpenSSL 3.0.4 on x86_64. + upstream: Warn if no host keys for hostbased auth can be loaded. - The potential RCE only impacts x86_64, so only refuse to use it if we're - targetting a potentially impacted architecture. ok djm@ + OpenBSD-Commit-ID: 2a0a13132000cf8d3593133c1b49768aa3c95977 -commit e75bbc1d88491fa85e61b2cc8783d4bbd00cd131 -Author: Darren Tucker -Date: Tue Jul 12 14:37:15 2022 +1000 +commit a6183e25e3f1842e21999fe88bc40bb99b121dc3 +Author: dtucker@openbsd.org +Date: Fri Dec 9 00:17:40 2022 +0000 - Capture stderr output from configure. + upstream: Add server debugging for hostbased auth. + + auth_debug_add queues messages about the auth process which is sent to + the client after successful authentication. This also sends those to + the server debug log to aid in debugging. From bz#3507, ok djm@ + + OpenBSD-Commit-ID: 46ff67518cccf9caf47e06393e2a121ee5aa258a -commit d9eaea4bea6271bcee6a2b9428f1271faf2d033b -Author: Darren Tucker -Date: Tue Jul 12 12:54:49 2022 +1000 +commit b85c3581c16aaf6e83b9a797c80705a56b1f312e +Author: cheloha@openbsd.org +Date: Sun Dec 4 23:50:49 2022 +0000 - Refuse to use OpenSSL 3.0.4 due to potential RCE. + upstream: remove '?' from getopt(3) loops + + userspace: remove vestigial '?' cases from top-level getopt(3) loops + + getopt(3) returns '?' when it encounters a flag not present in the in + the optstring or if a flag is missing its option argument. We can + handle this case with the "default" failure case with no loss of + legibility. Hence, remove all the redundant "case '?':" lines. + + Prompted by dlg@. With help from dlg@ and millert@. + + Link: https://marc.info/?l=openbsd-tech&m=167011979726449&w=2 + + ok naddy@ millert@ dlg@ - OpenSSL has a potential RCE in its RSA implementation (CVE-2022-2274) - so refuse to use that specific version. + OpenBSD-Commit-ID: b2f89346538ce4f5b33ab8011a23e0626a67e66e -commit fb2f3a61bf3d28fff285524535f7ffcd177c9235 -Author: Darren Tucker -Date: Tue Jul 12 12:54:24 2022 +1000 +commit 9a067e8d28a2249fd73f004961e30c113ee85e5d +Author: dtucker@openbsd.org +Date: Wed Dec 7 11:45:43 2022 +0000 - Move unset to before we set anything. + upstream: Fix comment typo. + + OpenBSD-Regress-ID: 3b04faced6511bb5e74648c6a4ef4bf2c4decf03 -commit c483a5c0fb8e8b8915fad85c5f6113386a4341ca +commit ce3c3e78ce45d68a82c7c8dc89895f297a67f225 Author: Darren Tucker -Date: Wed Jul 6 11:52:54 2022 +1000 +Date: Wed Dec 7 18:58:25 2022 +1100 - Test against openssl-3.0.5. + Add SANDBOX_DEBUG to the kitchensink test build. -commit 669a56bcfe73f8b985f2bba476ba834d55253acf -Author: Darren Tucker -Date: Tue Jul 5 18:35:53 2022 +1000 +commit bc234605fa3eb10f56bf0d74c8ecb0d91ada9d05 +Author: Damien Miller +Date: Wed Dec 7 18:38:25 2022 +1100 - Update sanitizer test targets: + disable SANDBOX_SECCOMP_FILTER_DEBUG + + It was mistakenly enabled in 2580916e4872 - - remove clang-sanitize-memory for now. It takes so long that the test - times out. - - add gcc sanitize-address and sanitize-undefined test targets. + Reported by Peter sec-openssh-com.22.fichtner AT 0sg.net -commit 48cc68b69118b3ce8d07fd4f82e00d58667d5379 -Author: Darren Tucker -Date: Tue Jul 5 16:23:28 2022 +1000 +commit b087c5cfa011b27992e01589314fec830266f99d +Author: Rose <83477269+AtariDreams@users.noreply.github.com> +Date: Tue Nov 29 15:12:54 2022 -0500 - Add GCC address sanitizer build/test. + Update autotools + + Regenerate config files using latest autotools -commit 55c60bdd39b82457e92efa77da8d16cfa6a49391 +commit d63f5494978a185c7421d492b9c2f6f05bb54138 Author: Darren Tucker -Date: Tue Jul 5 12:02:33 2022 +1000 +Date: Tue Dec 6 12:22:36 2022 +1100 - Move sanitizer logs into regress for collection. + Fix typo in comment. Spotted by tim@ -commit 35ef2b3b6ef198f8574904a45780487ec2f17858 +commit 73dcca12115aa12ed0d123b914d473c384e52651 Author: dtucker@openbsd.org -Date: Mon Jul 4 09:10:31 2022 +0000 +Date: Sun Dec 4 11:03:11 2022 +0000 - upstream: Add TEST_REGRESS_CACHE_DIR. + upstream: Remove duplicate includes. - If set, it is used to cache regress test names that have succeeded and - skip those on a re-run. + Patch from AtariDreams via github PR#364. - OpenBSD-Regress-ID: a7570dd29a58df59f2cca647c3c2ec989b49f247 - -commit 7394ed80c4de8b228a43c8956cf2fa1b9c6b2622 -Author: Darren Tucker -Date: Sun Jul 3 21:46:44 2022 +1000 - - Add clang sanitizer tests. + OpenBSD-Commit-ID: b9186638a05cb8b56ef7c0de521922b6723644ea -commit bfce0e66b6017a9bfab450b9dc7d4b16f90de817 -Author: Darren Tucker -Date: Sun Jul 3 18:14:09 2022 +1000 +commit 3cec15543010bc8d6997d896b1717a650afb7e92 +Author: djm@openbsd.org +Date: Fri Dec 2 04:40:27 2022 +0000 - Skip all rlimit tests when sandboxing disabled. + upstream: make struct sshbuf private + + and remove an unused field; ok dtucker - The rlimit tests can hang when being run with some compiler sanitizers - so skip all of them if sandbox=no. + OpenBSD-Commit-ID: c7a3d77c0b8c153d463398606a8d57569186a0c3 -commit 6208d611520f9ea94d5369f9da404b709930029d +commit 5796bf8ca9535f9fa7d01829a540d2550e05c860 Author: Darren Tucker -Date: Sun Jul 3 17:54:49 2022 +1000 +Date: Fri Dec 2 11:43:36 2022 +1100 - Move checks for pollfd.fd and nfds_t. + Restore ssh-agent permissions on exit. - Move the checks for struct pollfd.fd and nfds_t to before the sandboxing - checks. This groups all the sandbox checks together so we can skip them - all when sandboxing is disabled. + ...enough that subsequent builds can overwrite ssh-agent if necessary. -commit 322964f8f2e9c321e77ebae1e4d2cd0ccc5c5a0b +commit ccf5a13868cbb4659107458cac1e017c98abcbda Author: dtucker@openbsd.org -Date: Fri Jul 1 05:08:23 2022 +0000 +Date: Thu Dec 1 02:22:13 2022 +0000 - upstream: Remove leftover line. - - Remove extra line leftover from merge conflict. ok djm@ + upstream: Clean up ssh-add and ssh-agent logs. - OpenBSD-Commit-ID: 460e2290875d7ae64971a7e669c244b1d1c0ae2e + OpenBSD-Regress-ID: 9eda8e4c3714d7f943ab2e73ed58a233bd29cd2c -commit 7ec81daad0e03a64e8d91c5590960c48c1a899a3 -Author: djm@openbsd.org -Date: Fri Jul 1 04:45:50 2022 +0000 +commit 7a8b40cf6a5eda80173140cc6750a6db8412fa87 +Author: dtucker@openbsd.org +Date: Thu Dec 1 02:19:29 2022 +0000 - upstream: use consistent field names (s/char/byte) + upstream: Log output of ssh-agent and ssh-add - in format description + This should make debugging easier. - OpenBSD-Commit-ID: 3de33572733ee7fcfd7db33d37db23d2280254f0 + OpenBSD-Regress-ID: 5974b02651f428d7e1079b41304c498ca7e306c8 -commit 32e82a392d9f263485effdd606ff5862d289a4a0 -Author: Darren Tucker -Date: Fri Jul 1 13:55:19 2022 +1000 +commit 4a1805d532616233dd6072e5cd273b96dd3062e6 +Author: dtucker@openbsd.org +Date: Tue Nov 29 22:41:14 2022 +0000 - Skip select+rlimit check if sandboxing is disabled + upstream: Add void to client_repledge args to fix compiler warning. ok djm@ - It's not needed in that case, and the test can fail when being built - with some compiler memory sanitizer flags. bz#3441 + OpenBSD-Commit-ID: 7e964a641ce4a0a0a11f047953b29929d7a4b866 -commit 4be7184ebe2a2ccef175983517a35ee06766e1b4 +commit 815c4704930aa449edf6e812e99d69e9ffd31f01 Author: djm@openbsd.org -Date: Fri Jul 1 03:52:57 2022 +0000 +Date: Mon Nov 28 01:38:22 2022 +0000 - upstream: bump up loglevel from debug to info when unable to open + upstream: tighten pledge(2) after session establishment - authorized keys/principals file for errno != ENOENT; bz2042 ok dtucker + feedback, ok & testing in snaps deraadt@ - OpenBSD-Commit-ID: e79aa550d91ade6a80f081bda689da24c086d66b + OpenBSD-Commit-ID: aecf4d49d28586dfbcc74328d9333398fef9eb58 -commit 6c31ba10e97b6953c4f325f526f3e846dfea647a -Author: dtucker@openbsd.org -Date: Fri Jul 1 03:39:44 2022 +0000 +commit f7cebbbf407d772ed71403d314343766782fe540 +Author: djm@openbsd.org +Date: Mon Nov 28 01:37:36 2022 +0000 - upstream: Don't leak the strings allocated by order_hostkeyalgs() + upstream: New EnableEscapeCommandline ssh_config(5) option - and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of - github PR#324 from ZoltanFridrich, ok djm@ + This option (default "no") controls whether the ~C escape is available. + Turning it off by default means we will soon be able to use a stricter + default pledge(2) in the client. - This is a roll-forward of the previous rollback now that the required - changes in compat.c have been done. + feedback deraadt@ dtucker@; tested in snaps for a while - OpenBSD-Commit-ID: c7cd93730b3b9f53cdad3ae32462922834ef73eb + OpenBSD-Commit-ID: 7e277595d60acb8263118dcb66554472257b387a -commit 486c4dc3b83b4b67d663fb0fa62bc24138ec3946 -Author: dtucker@openbsd.org -Date: Fri Jul 1 03:35:45 2022 +0000 +commit d323f7ecf52e3d4ec1f4939bf31693e02f891dca +Author: mbuhl@openbsd.org +Date: Fri Nov 18 19:47:40 2022 +0000 - upstream: Always return allocated strings from the kex filtering so + upstream: In channel_request_remote_forwarding the parameters for - that we can free them later. Fix one leak in compat_kex_proposal. Based on - github PR#324 from ZoltanFridrich with some simplications by me. ok djm@ + permission_set_add are leaked as they are also duplicated in the call. Found + by CodeChecker. ok djm - OpenBSD-Commit-ID: 9171616da3307612d0ede086fd511142f91246e4 + OpenBSD-Commit-ID: 4aef50fa9be7c0b138188814c8fe3dccc196f61e -commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c -Author: djm@openbsd.org -Date: Fri Jul 1 00:36:30 2022 +0000 +commit 62cc33e6eed847aafdc29e34aa69e9bd82a0ee16 +Author: Darren Tucker +Date: Wed Nov 30 11:23:11 2022 +1100 - upstream: ignore SIGPIPE earlier in main(), specifically before - - muxclient() which performs operations that could cause one; Reported by Noam - Lewis via bz3454, ok dtucker@ + Use -fzero-call-used-regs=used on clang 15. - OpenBSD-Commit-ID: 63d8e13276869eebac6d7a05d5a96307f9026e47 - -commit 33efac790f6b09d54894ba6c3e17dfb08b6fc7e1 -Author: jmc@openbsd.org -Date: Tue Jun 28 06:09:14 2022 +0000 - - upstream: reflect the update to -D arg name in usage(); + clang 15 seems to have a problem with -fzero-call-used-reg=all which + causes spurious "incorrect signature" failures with ED25519. On those + versions, use -fzero-call-used-regs=used instead. (We may add exceptions + later if specific versions prove to be OK). Also move the GCC version + check to match. - OpenBSD-Commit-ID: abdcde4f92b1ef094ae44210ee99d3b0155aad9c + Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround + suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@ -commit c71a1442d02f0a3586109dfe2cb366de36dee08e +commit f84b9cffd52c9c5c359a54a1929f9948e803ab1d Author: Darren Tucker -Date: Wed Jun 29 18:28:47 2022 +1000 +Date: Mon Nov 28 21:09:28 2022 +1100 - Update OpenSSL tests to the most recent releases. + Skip unit tests on slow riscv64 hardware. -commit 2a822f29300b2de7335fbff65f0b187a0c582304 -Author: djm@openbsd.org -Date: Mon Jun 27 21:41:55 2022 +0000 +commit 9f2747e0bed3faca92679eae69aef10c95dc82f5 +Author: Darren Tucker +Date: Sun Nov 27 15:26:22 2022 +1100 - upstream: allow arguments to sftp -D option, e.g. sftp -D + Rework how selfhosted tests interact with runners. - "/usr/libexec/sftp-server -el debug3" + Previously there was one runner per test target (mostly VMs). This had + a few limitations: + - multiple tests that ran on the same target (eg multiple build + configs) were serialized on availability or that runner. + - it needed manual balancing of VMs over host machines. - ok markus@ + To address this, make VMs that use ephemeral disks (ie most of them) + all use a pool of runners with the "libvirt" label. This requires that + we distinguish between "host" and "target" for those. Native runners + and VMs with persistent disks (eg the constantly-updated snapshot ones) + specify the same host and target. - OpenBSD-Commit-ID: 5a002b9f3a7aef2731fc0ffa9c921cf15f38ecce + This should improve test throughput. -commit 2369a2810187e08f2af5d58b343956062fb96ee8 -Author: dtucker@openbsd.org -Date: Fri Jun 24 10:45:06 2022 +0000 +commit d664ddaec87bdc7385be8ef7f1337793e1679d48 +Author: Darren Tucker +Date: Sun Nov 27 12:19:37 2022 +1100 - upstream: Roll back previous KEX changes as they aren't safe until - - compat_pkalg_proposal and friends always allocate their returned strings. - Reported by Qualys. + Run vmstartup from temp dir. - OpenBSD-Commit-ID: 1c7a88a0d5033f42f88ab9bec58ef1cf72c81ad0 + This will allow us to create ephemeral disk images per-runner. -commit 646686136c34c2dbf6a01296dfaa9ebee029386d -Author: dtucker@openbsd.org -Date: Fri Jun 24 04:37:00 2022 +0000 +commit 0fa16e952b1fc1c4cf65e3dd138b0e87003e2e45 +Author: Darren Tucker +Date: Sun Nov 27 12:14:00 2022 +1100 - upstream: Don't leak the strings allocated by order_hostkeyalgs() - - and list_hostkey_types() that are passed to compat_pkalg_proposal(). Part of - github PR#324 from ZoltanFridrich, ok djm@ + Make "config" in matrix singular and pass in env. - OpenBSD-Commit-ID: b2f6e5f60f2bba293b831654328a8a0035ef4a1b + This will allow the startup scripts to adapt their behaviour based on + the type and config. -commit 193c6d8d905dde836b628fc07a7b9cf2d347e2a3 +commit e8857043af54809187be1e8b06749db61112899f Author: Darren Tucker -Date: Sat Jun 25 12:16:15 2022 +1000 +Date: Sun Nov 27 11:42:22 2022 +1100 - Zero out LIBFIDO2 when SK support not usable. - - Prevents us from trying to link them into ssh-sk-helper and failing to - build. + Add "libvirt" label to dfly30. -commit 40f5d849d25c60b4ae21261e78484d435f5cfd51 +commit 9775473d84902dc37753686cd10ae71fbe67efda Author: Darren Tucker -Date: Sat Jun 25 11:47:28 2022 +1000 +Date: Sun Nov 27 09:28:20 2022 +1100 - Disable SK support if FIDO libs not found. + Rename "os" in matrix to "target". + + This is in preparation to distinguish this from the host that the runner + runs on in case where they are separate (eg VMs). -commit 5fd922ade1b25880fe8a8249f5c0385e413108f9 -Author: Damien Miller -Date: Fri Jun 24 14:43:54 2022 +1000 +commit 04fd00ceff39f4544ced6f5342060abe584835d0 +Author: Darren Tucker +Date: Sun Nov 27 09:23:04 2022 +1100 - fix broken case statement in previous + Remove unused self-hosted test targets. -commit f51423bdaf0008d46b6af082bcfd7a22a87375f0 -Author: Damien Miller -Date: Fri Jun 24 14:40:42 2022 +1000 +commit c9d9fcad2a11c1cd1550a541f44091d65f0b5584 +Author: Darren Tucker +Date: Sun Nov 27 09:16:15 2022 +1100 - request 1.1x API compatibility for OpenSSL >=3.x + Remove explicit "default" test config argument. - idea/patch from Pedro Martelletto via GHPR#322; ok dtucker@ + Not specifying the test config implicitly selects default args. -commit 455cee8d6c2e4c48c5af9faead3599c49948411e -Author: djm@openbsd.org -Date: Fri Jun 24 04:27:14 2022 +0000 +commit 15a01cf15f396f87c6d221c5a6af98331c818962 +Author: Darren Tucker +Date: Wed Nov 23 13:18:54 2022 +1100 - upstream: make it clear that RekeyLimit applies to both transmitted - - and received data. GHPR#328 from Jan Pazdziora - - OpenBSD-Commit-ID: d180a905fec9ff418a75c07bb96ea41c9308c3f9 + Add fallback for old platforms w/out MAP_ANON. -commit 17904f05802988d0bb9ed3c8d1d37411e8f459c3 -Author: tobhe@openbsd.org -Date: Tue Jun 21 14:52:13 2022 +0000 +commit 6b9bbbfe8b26db6e9a30a7e08c223e85421aed98 +Author: Darren Tucker +Date: Wed Nov 23 13:09:11 2022 +1100 - upstream: Make sure not to fclose() the same fd twice in case of an - - error. - - ok dtucker@ + If we haven't found it yet, recheck for sys/stat.h. - OpenBSD-Commit-ID: e384c4e05d5521e7866b3d53ca59acd2a86eef99 + On some very old platforms, sys/stat.h needs sys/types.h, however + autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the + opposite order, which in combination with modern autoconf's + "present but cannot be compiled" behaviour causes it to not be + detected. -commit f29d6cf98c25bf044079032d22c1a57c63ab9d8e -Author: dtucker@openbsd.org -Date: Sat Jun 18 02:17:16 2022 +0000 +commit 8926956f22639132a9f2433fcd25224e01b900f5 +Author: Darren Tucker +Date: Fri Nov 11 11:25:37 2022 +1100 - upstream: Don't attempt to fprintf a null identity comment. From - - Martin Vahlensieck via tech@. - - OpenBSD-Commit-ID: 4c54d20a8e8e4e9912c38a7b4ef5bfc5ca2e05c2 + Add dfly62 test target. -commit ad1762173bb38716a106e8979806149fd0f2753e +commit 650de7ecd3567b5a5dbf16dd1eb598bd8c20bca8 Author: dtucker@openbsd.org -Date: Fri Jun 17 01:00:03 2022 +0000 +Date: Thu Nov 10 23:03:10 2022 +0000 - upstream: Log an error if pipe() fails while accepting a + upstream: Handle dynamic remote port forwarding in escape commandline's - connection. bz#3447, from vincent-openssh at vinc17 net, ok djm@ + -R processing. bz#3499, ok djm@ - OpenBSD-Commit-ID: 9d59f19872b94900a5c79da2d57850241ac5df94 + OpenBSD-Commit-ID: 194ee4cfe7ed0e2b8ad0727f493c798a50454208 -commit 9c59e7486cc8691401228b43b96a3edbb06e0412 -Author: Damien Miller -Date: Fri Jun 24 14:20:43 2022 +1000 +commit 5372db7e7985ba2c00f20fdff8942145ca99e033 +Author: Darren Tucker +Date: Thu Nov 10 12:44:51 2022 +1100 - automatically enable built-in FIDO support + Remove seed passing over reexec. - If libfido2 is found and usable, then enable the built-in - security key support unless --without-security-key-builtin - was requested. + This was added for the benefit of platforms using ssh-rand-helper to + prevent a delay on each connection as sshd reseeded itself. - ok dtucker@ + ssh-random-helper is long gone, and since the re-exec happens before the + chroot the re-execed sshd can reseed itself normally. ok djm@ -commit 7d25b37fb2a5ff4dadabcbdac6087a97479434f5 -Author: Damien Miller -Date: Fri Jun 24 13:46:39 2022 +1000 +commit ca98d3f8c64cfc51af81e1b01c36a919d5947ec2 +Author: Darren Tucker +Date: Wed Nov 9 20:59:20 2022 +1100 - fix possible NULL deref when built without FIDO + Skip reexec test on OpenSSL 1.1.1 specifically. - Analysis/fix from kircher in bz3443; ok dtucker@ + OpenSSL 1.1.1 has a bug in its RNG that breaks reexec fallback, so skip + that test. See bz#3483 for details. -commit f5ba85daddfc2da6a8dab6038269e02c0695be44 -Author: djm@openbsd.org -Date: Wed Jun 15 16:08:25 2022 +0000 +commit 5ec4ebc2548e5f7f1b55b2a5cef5b67bdca8146f +Author: dtucker@openbsd.org +Date: Wed Nov 9 09:04:12 2022 +0000 - upstream: make sure that UseDNS hostname lookup happens in the monitor + upstream: Fix typo in fatal error message. - and not in the pledge(2)'d unprivileged process; fixes regression caused by - recent refactoring spotted by henning@ + Patch from vapier at chromium.org. - OpenBSD-Commit-ID: a089870b95101cd8881a2dff65b2f1627d13e88d + OpenBSD-Commit-ID: 8a0c164a6a25eef0eedfc30df95bfa27644e35cf -commit acb2059febaddd71ee06c2ebf63dcf211d9ab9f2 -Author: djm@openbsd.org -Date: Fri Jun 3 04:47:21 2022 +0000 +commit e6abafe9a6d809422d3432b95b3f9747b0acaa71 +Author: dtucker@openbsd.org +Date: Wed Nov 9 09:01:52 2022 +0000 - upstream: move auth_openprincipals() and auth_openkeyfile() over to + upstream: Remove errant colon and simplify format - auth2-pubkeyfile.c too; they make more sense there. + string in error messages. Patch from vapier at chromium.org. - OpenBSD-Commit-ID: 9970d99f900e1117fdaab13e9e910a621b7c60ee + OpenBSD-Commit-ID: fc28466ebc7b74e0072331947a89bdd239c160d3 -commit 3d9b0845f34510111cc693bb99a667662ca50cd8 +commit db2027a687516f87c3fb141e87154bb3d8a7807c Author: djm@openbsd.org -Date: Fri Jun 3 04:31:54 2022 +0000 +Date: Wed Nov 9 01:37:44 2022 +0000 - upstream: test setenv in both client and server, test first-match-wins + upstream: rename client_global_hostkeys_private_confirm() to - too + client_global_hostkeys_prove_confirm(), as it handles the + "hostkeys-prove00@openssh.com" message; no functional change - OpenBSD-Regress-ID: 4c8804f9db38a02db480b9923317457b377fe34b + OpenBSD-Commit-ID: 31e09bd3cca6eed26855b88fb8beed18e9bd026d -commit 22e1a3a71ad6d108ff0c5f07f93c3fcbd30f8b40 +commit 1c2be7c2004cf1abcd172fee9fe3eab57cd4c426 Author: djm@openbsd.org -Date: Fri Jun 3 04:30:46 2022 +0000 +Date: Wed Nov 9 00:15:59 2022 +0000 - upstream: Make SetEnv directives first-match-wins in both - - sshd_config and sshd_config; previously if the same name was reused then the - last would win (which is the opposite to how the config is supposed to work). - - While there, make the ssh_config parsing more like sshd_config. - - bz3438, ok dtucker + upstream: typo in comment - OpenBSD-Commit-ID: 797909c1e0262c0d00e09280459d7ab00f18273b + OpenBSD-Commit-ID: 39c58f41e0f32d1ff31731fa6f5bbbc3ad25084a -commit 38ed6c57e9e592c08e020fa6e82b45b4e1040970 -Author: dtucker@openbsd.org -Date: Fri Jun 3 04:00:15 2022 +0000 +commit cf1a9852d7fc93e4abc4168aed09529a57427cdc +Author: Darren Tucker +Date: Wed Nov 9 09:23:47 2022 +1100 - upstream: Add missing *-sk types to ssh-keyscan manpage. From - - skazi0 via github PR#294. + Defer seed_rng until after closefrom call. - OpenBSD-Commit-ID: fda2c869cdb871f3c90a89fb3f985370bb5d25c0 + seed_rng will initialize OpenSSL, and some engine providers (eg Intel's + QAT) will open descriptors for their own use. bz#3483, patch from + joel.d.schuetze at intel.com, ok djm@ -commit ea97ec98c41ec2b755dfab459347db674ff9a5de -Author: dtucker@openbsd.org -Date: Fri Jun 3 03:21:09 2022 +0000 +commit dffa64480163fbf76af7e4fb62c26bb0dd6642aa +Author: Darren Tucker +Date: Wed Nov 9 08:27:47 2022 +1100 - upstream: Add period at end of "not known by any other names" - - message. github PR#320 from jschauma, ok djm@ - - OpenBSD-Commit-ID: bd60809803c4bfd3ebb7c5c4d918b10e275266f2 + Fix comment text. From emaste at freebsd.org. -commit 88e376fcd67478ad1660d94bc73ab348ac9f4527 -Author: dtucker@openbsd.org -Date: Fri Jun 3 03:17:42 2022 +0000 +commit d9df5689c29823ab830ec4f54c83c6cc3c0077ad +Author: Pierre Ossman +Date: Wed Jul 6 13:52:10 2022 +0200 - upstream: ssh-keygen -A: do not generate DSA keys by default. + Avoid assuming layout of fd_set - Based on github PR#303 from jsegitz with man page text from jmc@, ok markus@ - djm@ + POSIX doesn't specify the internal layout of the fd_set object, so let's + not assume it is just a bit mask. This increases compatibility with + systems that have a different layout. - OpenBSD-Commit-ID: 5c4c57bdd7063ff03381cfb6696659dd3f9f5b9f + The assumption is also worthless as we already refuse to use file + descriptors over FD_SETSIZE anyway. Meaning that the default size of + fd_set is quite sufficient. -commit 6b3fb624675082a1e5aa615d1b8479873d8b5731 -Author: naddy@openbsd.org -Date: Tue May 31 14:05:12 2022 +0000 +commit 419aa8a312e8d8f491933ca3d5933e602cb05aae +Author: Darren Tucker +Date: Tue Nov 8 12:42:52 2022 +1100 - upstream: ssh-keygen: implement "verify-required" certificate option. - - This was already documented when support for user-verified FIDO - keys was added, but the ssh-keygen(1) code was missing. - - ok djm@ + Shutdown any VM before trying to check out repo. - OpenBSD-Commit-ID: f660f973391b593fea4b7b25913c9a15c3eb8a06 + In the case where the previous run did not clean up, the checkout will + fail as it'll leave a stale mount. -commit b7f86ffc301be105bba9a3e0618b6fab3ae379bd -Author: jmc@openbsd.org -Date: Sat May 28 05:57:56 2022 +0000 +commit a32c07cbb78f65d8527642b96474a83b413f8108 +Author: Darren Tucker +Date: Tue Nov 8 11:33:25 2022 +1100 - upstream: keywords ref ssh_config.5; - - from caspar schutijser + Run vm startup and shutdown from runner temp dir. - OpenBSD-Commit-ID: f146a19d7d5c9374c3b9c520da43b2732d7d1a4e - -commit dc7bc52372f2744fa39191577be5306ee57aacd4 -Author: Damien Miller -Date: Mon May 30 09:29:09 2022 +1000 - - fix some bugs in the fuzzer + Should work even if the github workspace dir is on a stale sshfs mount. -commit 1781f507c113667613351c19898efaf1e311a865 +commit 2b40a7dfcdb8e616155b9504145aa52b271455aa Author: Darren Tucker -Date: Fri May 27 18:19:48 2022 +1000 +Date: Tue Nov 8 11:03:31 2022 +1100 - Test against OpenSSL 1.1.1o and 3.0.3. + Add valrind-5 test here too. -commit c53906e0c59e569691b4095d3e8db79cf78fa058 +commit 2ea03d1f6d0a05ee2b63ed2dc0f2d54f1e4655a1 Author: Darren Tucker -Date: Fri May 27 18:18:31 2022 +1000 - - Test against LibreSSL 3.5.3. - -commit 9b3ad432ad2f19319bcc089370e356c6315d682f -Author: Damien Miller -Date: Fri May 27 17:00:43 2022 +1000 - - fuzzer for authorized_keys parsing - - mostly redundant to authopt_fuzz, but it's sensitive code so IMO it - makes sense to test this layer too - -commit c83d8c4d6f3ccceef84d46de107f6b71cda06359 -Author: djm@openbsd.org -Date: Fri May 27 05:02:46 2022 +0000 +Date: Tue Nov 8 09:21:10 2022 +1100 - upstream: split the low-level file handling functions out from - - auth2-pubkey.c - - Put them in a new auth2-pubkeyfile.c to make it easier to refer to them - (e.g. in unit/fuzz tests) without having to refer to everything else - pubkey auth brings in. - - ok dtucker@ + Update checkout and upload actions. - OpenBSD-Commit-ID: 3fdca2c61ad97dc1b8d4a7346816f83dc4ce2217 + Update actions/checkout and actions/upload-artifact to main branch for + compatibility with node.js v16. -commit 3b0b142d2a0767d8cd838e2f3aefde8a0aaa41e1 -Author: djm@openbsd.org -Date: Fri May 27 05:01:25 2022 +0000 +commit 4e316ff0f18a118232bb9ac6512ee62773a9e8ea +Author: Darren Tucker +Date: Tue Nov 8 09:17:04 2022 +1100 - upstream: refactor authorized_keys/principals handling - - remove "struct ssh *" from arguments - this was only used to pass the - remote host/address. These can be passed in instead and the resulting - code is less tightly coupled to ssh_api.[ch] - - ok dtucker@ - - OpenBSD-Commit-ID: 9d4373d013edc4cc4b5c21a599e1837ac31dda0d + Split out rekey test since it runs the longest. -commit 2c334fd36f80cb91cc42e4b978b10aa35e0df236 +commit 21625a6424258a92a96a3bb73ae6aabc5ed8a6b4 Author: dtucker@openbsd.org -Date: Fri May 27 04:29:40 2022 +0000 +Date: Mon Nov 7 10:09:28 2022 +0000 - upstream: f sshpkt functions fail, then password is not cleared - - with freezero. Unconditionally call freezero to guarantee that password is - removed from RAM. + upstream: The IdentityFile option in ssh_config can also be used to - From tobias@ and c3h2_ctf via github PR#286, ok djm@ + specify a public key file, as documented in ssh.1 for the -i option. Document + this also for IdentityFile in ssh_config.5, for documentation completeness. + From laalsaas at systemli.org via portable github PR#352, ok jmc@ djm@ - OpenBSD-Commit-ID: 6b093619c9515328e25b0f8093779c52402c89cd + OpenBSD-Commit-ID: 2f943be9f96e60ef81a9a4faa25b009999f9883b -commit 5d3a77f4c5ae774c6796387266503f52c7cdc7c2 +commit 747691604d3325ed2b62bad85b6fd8563ad32f6c Author: dtucker@openbsd.org -Date: Fri May 27 04:27:49 2022 +0000 +Date: Mon Nov 7 10:05:38 2022 +0000 - upstream: Avoid kill with -1 argument. The out_ctx label can be - - reached before fork has been called. If this happens, then kill -1 would be - called, sending SIGTERM to all processes reachable by the current process. + upstream: Remove some set but otherwise unused variables, spotted - From tobias@ and c3h2_ctf via github PR#286, ok djm@ + in -portable by clang 16's -Wunused-but-set-variable. ok djm@ - OpenBSD-Commit-ID: 6277af1207d81202f5daffdccfeeaed4c763b1a8 + OpenBSD-Commit-ID: 3d943ddf2369b38fbf89f5f19728e7dc1daf3982 -commit 533b31cd08e4b97f455466f91c36915e2924c15a +commit 1d78d25653805aefc7a8dd9d86cd7359ada3823c Author: dtucker@openbsd.org -Date: Fri May 27 04:13:24 2022 +0000 +Date: Mon Nov 7 10:02:59 2022 +0000 - upstream: Note that ProxyJump also accepts the same tokens as + upstream: Check for and disallow MaxStartups values less than or - ProxyCommand. From pallxk via github PR#305. + equal to zero during config parsing, rather than faling later at runtime. + bz#3489, ok djm@ - OpenBSD-Commit-ID: 7115ac351b129205f1f1ffa6bbfd62abd76be7c5 + OpenBSD-Commit-ID: d79c2b7a8601eb9be493629a91245d761154308b -commit 9d8c80f8a304babe61ca28f2e3fb5eb6dc9c39bf +commit a00f59a645072e5f5a8d207af15916a7b23e2642 Author: djm@openbsd.org -Date: Wed May 25 06:03:44 2022 +0000 +Date: Mon Nov 7 04:04:40 2022 +0000 - upstream: revert previous; it was broken (spotted by Theo) + upstream: fix parsing of hex cert expiry time; was checking whether the - OpenBSD-Commit-ID: 457c79afaca2f89ec2606405c1059b98b30d8b0d - -commit 9e0d02ef7ce88b67643bfb1c2272c9f5f04cc680 -Author: djm@openbsd.org -Date: Wed May 25 00:31:13 2022 +0000 - - upstream: make SSHBUF_DBG/SSHBUF_TELL (off by default and only enabled + start time began with "0x", not the expiry time. - via #define) dump to stderr rather than stdout + from Ed Maste - OpenBSD-Commit-ID: 10298513ee32db8390aecb0397d782d68cb14318 - -commit 2487163630f28be28b7e2396b4bd6511b98f1d3e -Author: Tim Rice -Date: Tue May 24 10:21:25 2022 -0700 - - configure.ac: Add missing AC_DEFINE for caph_cache_tzdata test causing - HAVE_CAPH_CACHE_TZDATA to be missing from config.h.in. - Spotted by Bryan Drewery - -commit bedb93415b60db3dfd704a3d525e82adb14a2481 -Author: djm@openbsd.org -Date: Sun May 15 23:48:07 2022 +0000 + OpenBSD-Commit-ID: 6269242c3e1a130b47c92cfca4d661df15f05739 - upstream: regress test for in-place transfers and clobbering larger - - files with smaller ones; would have caught last regression in scp(1) - - OpenBSD-Regress-ID: 19de4e88dd3a4f7e5c1618c9be3c32415bd93bc2 +commit f58acaf8c7315483f4ac87d46a1aa2142a713cd8 +Author: Darren Tucker +Date: Mon Nov 7 15:10:59 2022 +1100 -commit b4f0d719c2548cb74da509fb65f384dada4ebd37 -Author: anton@openbsd.org -Date: Fri Apr 22 05:08:43 2022 +0000 + Fix merge conflict. - upstream: Only run agent-ptrace.sh if gdb is available as all - - architectures do not ship with gdb. - - OpenBSD-Regress-ID: ec53e928803e6b87f9ac142d38888ca79a45348d +commit 162e5741020a8d996c0c12b988b118e71ed728e6 +Author: Darren Tucker +Date: Mon Nov 7 15:04:33 2022 +1100 -commit 9b73345f80255a7f3048026462f2c0c6a241eeac -Author: djm@openbsd.org -Date: Sun May 15 23:47:21 2022 +0000 + Branch-specific links for master status badges. - upstream: fix in-place copies; r1.163 incorrectly skipped truncation in - - all cases, not just at the start of a transfer. This could cause overwrites - of larger files to leave junk at the end. Spotted by tb@ - - OpenBSD-Commit-ID: b189f19cd68119548c8e24e39c79f61e115bf92c +commit e4b7c12ab24579312aa3ed38ce7041a439ec2d56 +Author: Darren Tucker +Date: Mon Nov 7 14:46:38 2022 +1100 -commit 56a0697fe079ff3e1ba30a2d5c26b5e45f7b71f8 -Author: djm@openbsd.org -Date: Fri May 13 06:31:50 2022 +0000 + Add CIFuzz status badge. - upstream: arrange for scp, when in sftp mode, to not ftruncate(3) files - - early - - previous behavious of unconditionally truncating the destination file - would cause "scp ~/foo localhost:" and "scp localhost:foo ~/" to - delete all the contents of their destination. - - spotted by solene@ sthen@, also bz3431; ok dtucker@ +commit b496b9f831acd1e5bcd875e26e797488beef494a +Author: Darren Tucker +Date: Mon Nov 7 14:45:16 2022 +1100 + + Do not run CIFuzz on selfhosted tree. - OpenBSD-Commit-ID: ca39fdd39e0ec1466b9666f15cbcfddea6aaa179 + We already run it on the regular tree, no need to double up. -commit fbcef70c2832712f027bccea1aa9bc4b4103da93 -Author: dtucker@openbsd.org -Date: Mon May 9 08:25:27 2022 +0000 +commit 2138b1c4ddb300129a41a5104627b0d561184c7b +Author: Darren Tucker +Date: Mon Nov 7 14:41:58 2022 +1100 - upstream: Remove errant apostrophe. From haruyama at queen-ml org. - - OpenBSD-Commit-ID: dc6b294567cb84b384ad6ced9ca469f2bbf0bd10 + Whitespace change to trigger CIFuzz workflow. -commit 0086a286ea6bbd11ca9b664ac3bb12b27443d6eb -Author: djm@openbsd.org -Date: Mon May 9 03:09:53 2022 +0000 +commit 4670b97ef87c7b0f21283c9b07c7191be88dda05 +Author: Darren Tucker +Date: Mon Nov 7 14:34:04 2022 +1100 - upstream: Allow existing -U (use agent) flag to work with "-Y sign" - - operations, where it will be interpreted to require that the private keys is - hosted in an agent; bz3429, suggested by Adam Szkoda; ok dtucker@ - - OpenBSD-Commit-ID: a7bc69873b99c32c42c7628ed9ea91565ba08c2f + Run cifuzz workflow on the actions as regular CI. -commit cb010744cc98f651b1029bb09efa986eb54e4ccf -Author: djm@openbsd.org -Date: Sun May 8 22:58:35 2022 +0000 +commit 79391e66ce851ace1baf3c6a35e83a23f08ec2ba +Author: David Korczynski +Date: Tue Nov 30 11:45:20 2021 +0000 - upstream: improve error message when 'ssh-keygen -Y sign' is unable to - - load a private key; bz3429, reported by Adam Szkoda ok dtucker@ - - OpenBSD-Commit-ID: bb57b285e67bea536ef81b1055467be2fc380e74 + Add CIFuzz integration -commit aa61fc82c63d309a90c22ca74fb1da6c6f4372fd -Author: Tobias Heider -Date: Mon May 9 02:00:01 2022 +0200 +commit c1893364a0be243270014d7d34362a8101d55112 +Author: dtucker@openbsd.org +Date: Mon Nov 7 02:21:22 2022 +0000 - Remove duplicate bcrypt_pbkdf.o from Makefile + upstream: Import regenerated moduli. - bcrypt_pbkdf.o is duplicated in the openbsd-compat Makefile's object - file list. + OpenBSD-Commit-ID: b0e54ee4d703bd6929bbc624068666a7a42ecb1f -commit deb506d00da8d11fb04c1e7b9b1e1cc379c1705c -Author: djm@openbsd.org -Date: Sun May 8 22:32:36 2022 +0000 +commit 5c3f18fb994ef27e685b205ee2351851b80fdbd1 +Author: dtucker@openbsd.org +Date: Mon Nov 7 01:53:01 2022 +0000 - upstream: When performing operations that glob(3) a remote path, ensure - - that the implicit working directory used to construct that path escapes - glob(3) characters. - - This prevents glob characters from being processed in places they - shouldn't, e.g. "cd /tmp/a*/", "get *.txt" should have the get operation - treat the path "/tmp/a*" literally and not attempt to expand it. - - Reported by Lusia Kundel; ok markus@ + upstream: Fix typo. From pablomh via -portable github PR#344. - OpenBSD-Commit-ID: 4f647f58482cbad3d58b1eab7f6a1691433deeef + OpenBSD-Commit-ID: d056ee2e73691dc3ecdb44a6de68e6b88cd93827 -commit f38cf74f20b5da113cfa823afd5bfb5c6ba65f3d +commit e1c6fcc142066417c9832e634463faa3dd5d116c Author: Darren Tucker -Date: Fri May 6 14:50:18 2022 +1000 +Date: Mon Nov 7 12:46:58 2022 +1100 - Also retest OpenBSD upstream on .yml changes. + Link to branch-specific queries for V_9_1 status. -commit f87a132800ba3710ab130d703448a31ef1128d77 +commit 4f4a5fad6d8892c3f8ee9cd81ec7de6458210c9f Author: Darren Tucker -Date: Fri May 6 14:46:09 2022 +1000 +Date: Sun Nov 6 10:55:59 2022 +1100 - Note that, for now, we need variadic macros. + Use "prohibit-password" in -portable comments. + + "without-password" is the deprecated alias for "prohibit-password", + so we should reference the latter. From emaste at freebsd.org. -commit 217b518e0f7c52c4b909e935141a55344c61e644 +commit 0f7e1eba55259ec037f515000b4c4afbf446230a Author: Darren Tucker -Date: Fri May 6 14:39:34 2022 +1000 +Date: Sun Nov 6 10:50:01 2022 +1100 - Add ubsan minimal testcase on OpenBSD. + Fix tracing disable on FreeBSD. - As suggested by djm@. + Some versions of FreeBSD do not support using id 0 to refer to the + current pid for procctl, so pass getpid() explicitly. From + emaste at freebsd.org. -commit 457dce2cfef6a48f5442591cd8b21c7e8cba13f8 -Author: djm@openbsd.org -Date: Thu May 5 01:04:14 2022 +0000 +commit 32fddb982fd61b11a2f218a115975a87ab126d43 +Author: Darren Tucker +Date: Mon Nov 7 10:39:01 2022 +1100 - upstream: sshkey_unshield_private() contains a exact duplicate of - - the code in private2_check_padding(). Pull private2_check_padding() up so the - code can be reused. From Martin Vahlensieck, ok deraadt@ + Fix setres*id checks to work with clang-16. - OpenBSD-Commit-ID: 876884c3f0e62e8fd8d1594bab06900f971c9c85 + glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE, + and clang 16 will error out on implicit function definitions, so add + _GNU_SOURCE and the required headers to the configure checks. From + sam at @gentoo.org via bz#3497. -commit 0e44db4d9cb313e68a59a44d27884af66c02356e -Author: djm@openbsd.org -Date: Thu May 5 00:56:58 2022 +0000 +commit 12af712d116f42164bcfa56db901d06e4fa27199 +Author: Sam James +Date: Sun Nov 6 04:52:38 2022 +0000 - upstream: channel_new no longer frees remote_name. So update the + configure.ac: Fix -Wstrict-prototypes - comment accordingly. As remote_name is not modified, it can be const as - well. From Martin Vahlensieck + Clang 16 now warns on this and it'll be removed in C23, so let's + just be future proof. It also reduces noise when doing general + Clang 16 porting work (which is a big job as it is). github PR#355. - OpenBSD-Commit-ID: e4e10dc8dc9f40c166ea5a8e991942bedc75a76a + Signed-off-by: Sam James -commit 37b62fd5caf19c85a48241535277cefff65adace -Author: djm@openbsd.org -Date: Thu May 5 00:55:11 2022 +0000 +commit 40b0a5eb6e3edfa2886b60c09c7803353b0cc7f5 +Author: Sam James +Date: Sun Nov 6 04:47:35 2022 +0000 - upstream: mux.c: mark argument as const; from Martin Vahlensieck + configure.ac: Add include for openpty - OpenBSD-Commit-ID: 69a1a93a55986c7c2ad9f733c093b46a47184341 - -commit f4e67c0ad259b4cf10177277a5827fa5545bac53 -Author: markus@openbsd.org -Date: Wed May 4 07:31:22 2022 +0000 - - upstream: make sure stdout is non-blocking; ok djm@ + Another Clang 16ish fix (which makes -Wimplicit-function-declaration + an error by default). github PR#355. - OpenBSD-Commit-ID: 64940fffbd1b882eda2d7c8c7a43c79368309c0d + See: 2efd71da49b9cfeab7987058cf5919e473ff466b + See: be197635329feb839865fdc738e34e24afd1fca8 -commit e5c036d2092c00bef395e9161dc5ce42d4be9565 -Author: florian@openbsd.org -Date: Tue May 3 07:42:27 2022 +0000 +commit 6b17e128879ec6cc32ca2c28b5d894b4aa72e32d +Author: Rochdi Nassah +Date: Fri Oct 28 01:26:31 2022 +0100 - upstream: Add FIDO AUTHENTICATOR section and explain a bit how FIDO - - works. The wording came mostly from the 8.2 OpenSSH release notes, addapted - to fit the man page. Then move the -O bits into the new section as is already - done for CERTIFICATES and MODULI GENERATION. Finally we can explain the - trade-offs of resident keys. While here, consistently refer to the FIDO - thingies as "FIDO authenticators", not "FIDO tokens". - - input & OK jmc, naddy - - OpenBSD-Commit-ID: dd98748d7644df048f78dcf793b3b63db9ab1d25 + Fix broken zlib link. -commit 575771bf79bef7127be6aaccddc46031ea15529e -Author: jmc@openbsd.org -Date: Mon May 2 05:40:37 2022 +0000 +commit 99500df246ccb736ddbdd04160dcc82165d81a77 +Author: Darren Tucker +Date: Fri Nov 4 16:59:26 2022 +1100 - upstream: remove an obsolete rsa1 format example from an example; - - from megan batty - ok djm + Don't run openbsd-compat tests on Cygwin. - OpenBSD-Commit-ID: db2c89879c29bf083df996bd830abfb1e70d62bf + Add "compat-tests" to the default TEST_TARGET so we can override as + necessary. Override TEST_TARGET for Cygwin as the tests don't currently + compile there. -commit 0bc6b4c8f04e292577bdb44d5dc6b630d3448087 +commit 3cae9f92a31897409666aa1e6f696f779759332b Author: djm@openbsd.org -Date: Sun May 1 23:20:30 2022 +0000 +Date: Thu Nov 3 21:59:20 2022 +0000 - upstream: fix some integer overflows in sieve_large() that show up when + upstream: replace recently-added valid_domain() check for hostnames - trying to generate modp groups > 16k bits. Reported via GHPR#306 by Bertram - Felgenhauer, but fixed in a different way. feedback/ok tb@ + going to known_hosts with a more relaxed check for bad characters; previous + commit broke address literals. Reported by/feedback from florian@ - OpenBSD-Commit-ID: 81cbc6dd3a21c57bd6fadea10e44afe37bca558e + OpenBSD-Commit-ID: 10b86dc6a4b206adaa0c11b58b6d5933898d43e0 -commit a45615cb172bc827e21ec76750de39dfb30ecc05 -Author: djm@openbsd.org -Date: Fri Apr 29 04:55:07 2022 +0000 +commit 9655217231c9056200bea7ae2dffcc9c0c3eb265 +Author: Darren Tucker +Date: Thu Nov 3 23:07:50 2022 +1100 - upstream: be stricter in which characters will be accepted in - - specifying a mask length; allow only 0-9. From khaleesicodes via GHPR#278; ok - dtucker@ + Rerun tests on changes to Makefile.in in any dir. + +commit 3500f0405a3ab16b59a26f3508c4257a3fc3bce6 +Author: Darren Tucker +Date: Thu Nov 3 23:04:08 2022 +1100 + + Link libssh into compat tests. - OpenBSD-Commit-ID: e267746c047ea86665cdeccef795a8a56082eeb2 + The cygwin compat code uses xmalloc, so add libssh.a so pick up that. -commit 4835544d2dd31de6ffc7dba59f92093aea98155b +commit ec59effcf65b8a4c85d47ff5a271123259dd0ab8 Author: Darren Tucker -Date: Sat Apr 30 10:56:41 2022 +1000 +Date: Thu Nov 3 21:44:23 2022 +1100 - Add Mac OS X 12 test target. + Fix compat regress to work with non-GNU make. -commit 97a6a8b8c1f2da09712d0e72d0ef800e4edd34cd +commit 73550a218e7dfbbd599534cbf856309bc924f6fd Author: Darren Tucker -Date: Fri Apr 29 18:27:34 2022 +1000 +Date: Thu Nov 3 13:41:16 2022 +1100 - Only run tests when source files change. + Increase selfhosted job timeout. - Also run tests on changes to V_9_0 branch. + The default job timeout of 360 (6h) is not enough to complete the + regress tests for some of the slow VMs depending on the load on the host. + Increase to 600 (10h). -commit 6d0392b9ff4b50a56ac5685d1b9392e2cd432ca3 +commit db97d8d0b90c6ce52b94b153d6f8f5f7d3b11777 Author: Darren Tucker -Date: Fri Apr 29 18:22:34 2022 +1000 +Date: Thu Nov 3 10:00:43 2022 +1100 - Remove now-empty int32_minmax.inc. + Only run opensslver tests if built with OpenSSL. -commit af59463553b5ad52d3b42c4455ee3c5600158bb7 -Author: djm@openbsd.org -Date: Fri Apr 29 03:24:30 2022 +0000 +commit ba053709638dff2f6603df0c1f340352261d63ea +Author: Darren Tucker +Date: Wed Nov 2 14:16:04 2022 +1100 - upstream: mention that the helpers are used by ssh(1), ssh-agent(1) - - and ssh-keygen(1). Previously only ssh(1) was mentioned. From Pedro - Martelletto - - OpenBSD-Commit-ID: 30f880f989d4b329589c1c404315685960a5f153 + Add tests for OpenSSL 3.0.7 and LibreSSL 3.6.1. -commit 3e26b3a6eebcee27be177207cc0846fb844b7a56 -Author: dtucker@openbsd.org -Date: Fri Apr 29 03:16:48 2022 +0000 +commit edd24101c7e17d1a8f6576e1aaf62233b47ad6f5 +Author: Darren Tucker +Date: Thu Nov 3 08:17:39 2022 +1100 - upstream: Don't leak SK device. Patch from Pedro Martelletto via - - github PR#316. ok djm@ - - OpenBSD-Commit-ID: 17d11327545022e727d95fd08b213171c5a4585d + Run compat regress tests too. -commit 247082b5013f0d4fcae8f97453f2a2f01bcda811 -Author: djm@openbsd.org -Date: Fri Apr 29 03:13:32 2022 +0000 +commit fe88d67e7599b0bc73f6e4524add28d743e7f977 +Author: Darren Tucker +Date: Thu Nov 3 08:14:05 2022 +1100 - upstream: fix memleak on session-bind path; from Pedro Martelletto, ok + Compat tests need libcrypto. - dtucker@ + This was moved to CHANNELLIBS during the libs refactor. Spotted by + rapier at psc.edu. + +commit 96b519726b7944eee3c23a54eee3d5c031ba1533 +Author: Darren Tucker +Date: Thu Nov 3 04:24:39 2022 +1100 + + Include time.h when defining timegm. - OpenBSD-Commit-ID: e85899a26ba402b4c0717b531317e8fc258f0a7e + Fixes build on some platforms eg recent AIX. -commit e05522008092ceb86a87bdd4ad7878424315db89 -Author: djm@openbsd.org -Date: Thu Apr 28 02:53:31 2022 +0000 +commit da6038bd5cd55eb212eb2aec1fc8ae79bbf76156 +Author: Darren Tucker +Date: Tue Nov 1 19:10:30 2022 +1100 - upstream: avoid printing hash algorithm twice; from lucas AT sexy.is + Always use compat getentropy. - OpenBSD-Commit-ID: 9d24671e10a84141b7c504396cabad600e47a941 + Have it call native getentropy and fall back as required. Should fix + issues of platforms where libc has getentropy but it is not implemented + in the kernel. Based on github PR#354 from simsergey. -commit 0979e29356915261d69a9517a1e0aaade7c9fc75 -Author: dtucker@openbsd.org -Date: Wed Apr 27 11:08:55 2022 +0000 +commit 5ebe18cab6be3247b44c807ac145164010465b82 +Author: Darren Tucker +Date: Wed Nov 2 10:51:48 2022 +1100 - upstream: Add authfd path to debug output. ok markus@ + Check for sockaddr_in.sin_len. - OpenBSD-Commit-ID: f735a17d1a6f2bee63bfc609d76ef8db8c090890 + If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan + tests on platforms with this (eg old NetBSD). -commit 67b7c784769c74fd4d6b147d91e17e1ac1a8a96d +commit a1febadf426536612c2734168d409147c392e7cf Author: dtucker@openbsd.org -Date: Tue Apr 26 07:41:44 2022 +0000 +Date: Sun Oct 30 18:42:07 2022 +0000 - upstream: Check sshauthopt_new() for NULL. bz#3425, from + upstream: Use variable for diff options - tessgauthier at microsoft.com. ok djm@ + instead of unconditionally specifying "-rN". This will make life easier + in -portable where not all diff's understand -N. - OpenBSD-Commit-ID: af0315bc3e44aa406daa7e0ae7c2d719a974483f + OpenBSD-Regress-ID: 8b8a407115546be1c6d72d350b1e4f1f960d3cd3 -commit d571314d14b919fbd7c84a61f9bf2065fc0a6841 -Author: millert@openbsd.org -Date: Wed Apr 20 16:00:25 2022 +0000 +commit f6d3ed9a8a9280cbb68d6a499850cfe810e92bd0 +Author: Darren Tucker +Date: Mon Oct 31 05:13:02 2022 +1100 - upstream: Remove unnecessary includes: openssl/hmac.h and - - openssl/evp.h. From Martin Vahlensieck. + OpenSSL dev branch is 302 not 320. - OpenBSD-Commit-ID: a6debb5fb0c8a44e43e8d5ca7cc70ad2f3ea31c3 + While there, also accept 301 which it shat it was previously. -commit da8dddf8cc1f2516ff894b8183e83a7c5ba3ef80 -Author: millert@openbsd.org -Date: Wed Apr 20 15:59:18 2022 +0000 +commit 25c8a2bbcc10c493d27faea57c42a6bf13fa51f2 +Author: djm@openbsd.org +Date: Fri Oct 28 02:47:04 2022 +0000 - upstream: Add missing includes of stdlib.h and stdint.h. We need + upstream: put sshkey_check_rsa_length() back in sshkey.c to unbreak - stdlib.h for malloc(3) and stdint.h for SIZE_MAX. Unlike the other xmss - files, ssh-xmss.c does not include xmss_commons.h so ssh-xmss.c must include - those headers itself. From Martin Vahlensieck + OPENSSL=no builds - OpenBSD-Commit-ID: 70e28a9818cee3da1be2ef6503d4b396dd421e6b + OpenBSD-Commit-ID: 99eec58abe382ecd14b14043b195ee1babb9cf6e -commit fe9d87a6800a7a33be08f4d5ab662a758055ced2 -Author: millert@openbsd.org -Date: Wed Apr 20 15:56:49 2022 +0000 +commit 1192588546c29ceec10775125f396555ea71850f +Author: djm@openbsd.org +Date: Fri Oct 28 02:29:34 2022 +0000 - upstream: Avoid an unnecessary xstrdup in rm_env() when matching + upstream: allow ssh-keyscan(1) to accept CIDR address ranges, e.g. - patterns. Since match_pattern() doesn't modify its arguments (they are - const), there is no need to make an extra copy of the strings in - options->send_env. From Martin Vahlensieck + ssh-keyscan 192.168.0.0/24 - OpenBSD-Commit-ID: 2c9db31e3f4d3403b49642c64ee048b2a0a39351 - -commit 7bf2eb958fbb551e7d61e75c176bb3200383285d -Author: Darren Tucker -Date: Tue Apr 26 23:30:59 2022 +1000 - - Add debian-riscv64 test target. - -commit 3913c935523902482974c4c503bcff20bd850a6a -Author: Darren Tucker -Date: Mon Apr 25 17:20:06 2022 +1000 - - Update OpenSSL and LibreSSL versions in tests. - -commit dcd8dca29bcdb193ff6be35b96fc55e6e30d37d9 -Author: Darren Tucker -Date: Sat Apr 23 20:40:28 2022 +1000 - - Include stdlib.h for free() prototype. + If a CIDR range is passed, then it will be expanded to all possible + addresses in the range including the all-0s and all-1s addresses. - ... which is used inside the CUSTOM_SYS_AUTH_GET_LASTLOGIN_MSG block. - -commit 4cc05de568e1c3edd7834ff3bd9d8214eb34861b -Author: Darren Tucker -Date: Sat Apr 23 20:17:26 2022 +1000 - - Cache timezone data in capsicum sandbox. + bz#976 feedback/ok markus@ - From emaste at freebsd.org, originally part of FreeBSD commit r339216 - / fc3c19a9 with autoconf bits added by me. + OpenBSD-Commit-ID: ce6c5211f936ac0053fd4a2ddb415277931e6c4b -commit c31404426d212e2964ff9e5e58e1d0fce3d83f27 -Author: dtucker@openbsd.org -Date: Thu Apr 21 01:36:46 2022 +0000 +commit 64af4209309461c79c39eda2d13f9d77816c6398 +Author: Damien Miller +Date: Fri Oct 28 12:54:35 2022 +1100 - upstream: It looks like we can't completely avoid - - waiting for processes to exit so retrieve the pid via controlmaster and - use that. - - OpenBSD-Regress-ID: 8246f00f22b14e49d2ff1744c94897ead33d457b + fix merge botch -commit d19b21afab5c8e2f3df6bd8aee9766bdad3d8c58 -Author: dtucker@openbsd.org -Date: Wed Apr 20 13:25:55 2022 +0000 +commit 27267642699342412964aa785b98afd69d952c88 +Author: djm@openbsd.org +Date: Fri Oct 28 00:44:44 2022 +0000 - upstream: Use ssh -f and ControlPersist .. + upstream: refactor sshkey_private_deserialize - to start up test forwards and ssh -O stop to shut them down intead of - sleep loops. This speeds up the test by an order of magnitude. + feedback/ok markus@ - OpenBSD-Regress-ID: eb3db5f805100919b092a3b2579c611fba3e83e7 + OpenBSD-Commit-ID: f5ca6932fdaf840a5e8250becb38315a29b5fc9f -commit 5f76286a126721fa005de6edf3d1c7a265555f19 -Author: dtucker@openbsd.org -Date: Wed Apr 20 05:24:13 2022 +0000 +commit 2519a7077a9332f70935e5242ba91ee670ed6b87 +Author: djm@openbsd.org +Date: Fri Oct 28 00:44:17 2022 +0000 - upstream: Simplify forward-control test. + upstream: refactor sshkey_private_serialize_opt() - Since we no longer need to support SSH1 we don't need to run shell - commands on the other end of the connection and can use ssh -N instead. - This also makes the test less racy. + feedback/ok markus@ - OpenBSD-Regress-ID: 32e94ce272820cc398f30b848b2b0f080d10302c + OpenBSD-Commit-ID: 61e0fe989897901294efe7c3b6d670cefaf44cbd -commit 687bbf23572d8bdf25cbbcdf8ac583514e1ba710 +commit 11a768adf98371fe4e43f3b06014024c033385d5 Author: djm@openbsd.org -Date: Thu Mar 31 03:07:33 2022 +0000 +Date: Fri Oct 28 00:43:30 2022 +0000 - upstream: regression test for sftp cp command + upstream: refactor certify - OpenBSD-Regress-ID: c96bea9edde3a384b254785e7f9b2b24a81cdf82 - -commit f1233f19a6a9fe58f52946f50df4772f5b136761 -Author: dtucker@openbsd.org -Date: Wed Apr 20 01:13:47 2022 +0000 - - upstream: Import regenerated moduli + feedback/ok markus@ - OpenBSD-Commit-ID: f9a0726d957cf10692a231996a1f34e7f9cdfeb0 + OpenBSD-Commit-ID: 35d742992e223eaca3537e6fb3d3002c08eed4f6 -commit fec014785de198b9a325d1b94e324bb958c5fe7b +commit 3fbc58bb249d967cc43ebdc554f6781bb73d4a58 Author: djm@openbsd.org -Date: Wed Apr 20 04:19:11 2022 +0000 +Date: Fri Oct 28 00:43:08 2022 +0000 - upstream: Try to continue running local I/O for channels in state + upstream: refactor sshkey_sign() and sshkey_verify() - OPEN during SSH transport rekeying. The most visible benefit is that it - should make ~-escapes work in the client (e.g. to exit) if the connection - happened to have stalled during a rekey event. Based work by and ok dtucker@ + feedback/ok markus@ - OpenBSD-Commit-ID: a66e8f254e92edd4ce09c9f750883ec8f1ea5f45 + OpenBSD-Commit-ID: 368e662c128c99d05cc043b1308d2b6c71a4d3cc -commit e68154b0d4f0f5085a050ea896955da1b1be6e30 -Author: dtucker@openbsd.org -Date: Wed Apr 20 01:13:47 2022 +0000 +commit a1deb6cdbbe6afaab74ecb08fcb62db5739267be +Author: djm@openbsd.org +Date: Fri Oct 28 00:41:52 2022 +0000 - upstream: Import regenerated moduli + upstream: refactor sshkey_from_blob_internal() + + feedback/ok markus@ - OpenBSD-Commit-ID: f9a0726d957cf10692a231996a1f34e7f9cdfeb0 + OpenBSD-Commit-ID: 1f46c0cbb8060ee9666a02749594ad6658c8e283 -commit 69928b106d8f0fa15b88cf3850d992ed81c44ae0 -Author: tj@openbsd.org -Date: Sat Apr 16 00:22:31 2022 +0000 +commit 7d00799c935271ce89300494c5677190779f6453 +Author: djm@openbsd.org +Date: Fri Oct 28 00:41:17 2022 +0000 - upstream: list the correct version number + upstream: refactor sshkey_from_private() - for when usage of the sftp protocol became default and fix a typo - from ed maste + feedback/ok markus@ - OpenBSD-Commit-ID: 24e1795ed2283fdeacf16413c2f07503bcdebb31 + OpenBSD-Commit-ID: e5dbe7a3545930c50f70ee75c867a1e08b382b53 -commit 21042a05c0b304c16f655efeec97438249d2e2cc -Author: dtucker@openbsd.org -Date: Tue Apr 12 05:09:49 2022 +0000 +commit 262647c2e920492ca57f1b9320d74f4a0f6e482b +Author: djm@openbsd.org +Date: Fri Oct 28 00:39:29 2022 +0000 - upstream: Correct path for system known hosts file in description + upstream: factor out key generation - of IgnoreUserKnownHosts. Patch from Martin Vahlensieck via tech@ + feedback/ok markus@ - OpenBSD-Commit-ID: 9b7784f054fa5aa4d63cb36bd563889477127215 + OpenBSD-Commit-ID: 5b4211bff4de8d9adb84bc72857a8c42c44e7ceb -commit 53f4aff60a7c1a08a23917bd47496f8901c471f5 -Author: Darren Tucker -Date: Sat Apr 16 14:33:20 2022 +1000 +commit 401c74e7dc15eab60540653d2f94d9306a927bab +Author: djm@openbsd.org +Date: Fri Oct 28 00:38:58 2022 +0000 - Resync moduli.5 with upstream. + upstream: refactor and simplify sshkey_read() - 1.18: remove duplicate publication year; carsten dot kunze at arcor dot de - 1.19: ssh-keygen's -G/-T have been replaced with -M generate/screen. - -commit d2b888762b9844eb0d8eb59909cdf5af5159f810 -Author: Darren Tucker -Date: Sat Apr 16 14:31:13 2022 +1000 - - Retire fbsd6 test VM. + feedback/ok markus@ - It's long since out of support, relatively slow (it's i686) and the - compiler has trouble with PIE. + OpenBSD-Commit-ID: 0d93b7a56e31cd06a8bb0d2191d084ce254b0971 -commit cd1f70009860a154b51230d367c55ea5f9a4504e +commit 591fed94e66a016acf87f4b7cd416ce812f2abe8 Author: djm@openbsd.org -Date: Mon Apr 11 22:52:08 2022 +0000 +Date: Fri Oct 28 00:37:24 2022 +0000 - upstream: clear io_want/io_ready flags at start of poll() cycle; + upstream: factor out public key serialization - avoids plausible spin during rekeying if channel io_want flags are reused - across cycles. ok markus@ deraadt@ + feedback/ok markus@ - OpenBSD-Commit-ID: 91034f855b7c73cd2591657c49ac30f10322b967 + OpenBSD-Commit-ID: a3570c4b97290c5662890aea7328d87f55939033 -commit aa1920302778273f7f94c2091319aba199068ca0 -Author: dtucker@openbsd.org -Date: Fri Apr 8 05:43:39 2022 +0000 +commit 1e78844ae2b2dc01ba735d5ae740904c57e13685 +Author: djm@openbsd.org +Date: Fri Oct 28 00:36:31 2022 +0000 - upstream: Note that curve25519-sha256 was later published in + upstream: factor out sshkey_equal_public() - RFC8731. ok djm@ + feedback/ok markus@ - OpenBSD-Commit-ID: 2ac2b5d642d4cf5918eaec8653cad9a4460b2743 + OpenBSD-Commit-ID: 1368ba114cb37732fe6ec3d89c7e6d27ea6fdc94 -commit 4673fa8f2be983f2f88d5afd754adb1a2a39ec9e +commit 25de1c01a8b9a2c8ab9b1da22444a03e89c982de Author: djm@openbsd.org -Date: Fri Apr 8 04:40:40 2022 +0000 +Date: Fri Oct 28 00:35:40 2022 +0000 - upstream: two defensive changes from Tobias Stoeckmann via GHPR287 + upstream: begin big refactor of sshkey - enforce stricter invarient for sshbuf_set_parent() - never allow - a buffer to have a previously-set parent changed. + Move keytype data and some of the type-specific code (allocation, + cleanup, etc) out into each key type's implementation. Subsequent + commits will move more, with the goal of having each key-*.c file + owning as much of its keytype's implementation as possible. - In sshbuf_reset(), if the reallocation fails, then zero the entire - buffer and not the (potentially smaller) default initial alloc size. + lots of feedback + ok markus@ - OpenBSD-Commit-ID: 14583203aa5d50ad38d2e209ae10abaf8955e6a9 + OpenBSD-Commit-ID: 0f2b4334f73914344e9e5b3d33522d41762a57ec -commit 26eef015e2d2254375e13afaaf753b78932b1bf5 -Author: Damien Miller -Date: Mon Apr 11 16:07:09 2022 +1000 +commit 445363433ba20b8a3e655b113858c836da46a1cb +Author: djm@openbsd.org +Date: Mon Oct 24 22:43:36 2022 +0000 - Revert "update build-aux files to match autoconf-2.71" + upstream: Be more paranoid with host/domain names coming from the - This reverts commit 0a8ca39fac6ad19096b6c263436f8b2dd51606f2. + never write a name with bad characters to a known_hosts file. - It turns out that the checked-in copies of these files are actually newer - than autoconf-2.71's copies, so this was effectively a downgrade. - Spotted by Bo Anderson via github - -commit 0a8ca39fac6ad19096b6c263436f8b2dd51606f2 -Author: Damien Miller -Date: Fri Apr 8 14:48:58 2022 +1000 - - update build-aux files to match autoconf-2.71 + reported by David Leadbeater, ok deraadt@ - i.e. config.guess, config.sub and install-sh - -commit 94eb6858efecc1b4f02d8a6bd35e149f55c814c8 -Author: Damien Miller -Date: Wed Apr 6 10:47:48 2022 +1000 - - update version numbers for release + OpenBSD-Commit-ID: ba9b25fa8b5490b49398471e0c9657b0cbc7a5ad -commit 8e4a8eadf4fe74e65e6492f34250f8cf7d67e8da +commit 7190154de2c9fe135f0cc1ad349cb2fa45152b89 Author: djm@openbsd.org -Date: Mon Apr 4 22:45:25 2022 +0000 - - upstream: openssh-9.0 - - OpenBSD-Commit-ID: 0dfb461188f4513ec024c1534da8c1ce14c20b64 - -commit a9f23ea2e3227f406880c2634d066f6f50fa5eaa -Author: naddy@openbsd.org -Date: Thu Mar 31 17:58:44 2022 +0000 +Date: Mon Oct 24 21:52:50 2022 +0000 - upstream: ssh: document sntrup761x25519-sha512@openssh.com as + upstream: regress test for unmatched glob characters; fails before - default KEX + previous commit but passes now. bz3488; prodded by dtucker@ - OpenBSD-Commit-ID: 12545bfa10bcbf552d04d9d9520d0f4e98b0e171 + OpenBSD-Regress-ID: 0cc5cc9ea4a6fd170dc61b9212f15badaafb3bbd -commit 9ec2713d122af79d66ebb9c1d6d9ae8621a8945f -Author: naddy@openbsd.org -Date: Thu Mar 31 17:27:27 2022 +0000 +commit a4821a592456c3add3cd325db433110cdaaa3e5c +Author: djm@openbsd.org +Date: Mon Oct 24 21:51:55 2022 +0000 - upstream: man pages: add missing commas between subordinate and - - main clauses + upstream: when scp(1) is using the SFTP protocol for transport (the - jmc@ dislikes a comma before "then" in a conditional, so leave those - untouched. + default), better match scp/rcp's handling of globs that don't match the + globbed characters but do match literally (e.g. trying to transfer + "foo.[1]"). - ok jmc@ + Previously scp(1) in SFTP mode would not match these pathnames but + legacy scp/rcp mode would. - OpenBSD-Commit-ID: 9520801729bebcb3c9fe43ad7f9776ab4dd05ea3 - -commit 3741df98ffaaff92b474ee70d8ef276b5882f85a -Author: Darren Tucker -Date: Mon Apr 4 23:52:11 2022 +1000 - - Disable security key on fbsd6 test host. - -commit 32c12236f27ae83bfe6d2983b67c9bc67a83a417 -Author: Darren Tucker -Date: Mon Apr 4 15:16:51 2022 +1000 - - Specify TEST_SHELL=bash on AIX. + Reported by Michael Yagliyan in bz3488; ok dtucker@ - The system shells cause the agent-restrict test to fail due to some - quoting so explicitly specify bash until we can get configure to - autmatically work around that. + OpenBSD-Commit-ID: d8a3773f53015ba811fddba7473769a2fd343e11 -commit 90452c8b69d065b7c7c285ff78b81418a75bcd76 -Author: Darren Tucker -Date: Fri Apr 1 23:38:44 2022 +1100 +commit 18376847b8043ba967eabbe23692ef74c9a3fddc +Author: jsg@openbsd.org +Date: Thu Oct 13 09:09:28 2022 +0000 - Only return events from ppoll that were requested. + upstream: use correct type with sizeof ok djm@ - If the underlying system's select() returns bits that were not in the - request set, our ppoll() implementation can return revents for events - not requested, which can apparently cause a hang. Only return revents - for activity in the requested event set. bz#3416, analysis and fix by - yaroslav.kuzmin at vmssoftware com, ok djm@ - -commit 6c49eb5fabc56f4865164ed818aa5112d09c31a8 -Author: Darren Tucker -Date: Fri Apr 1 23:21:40 2022 +1100 - - Only run regression tests on slow VMs. - -commit f67e47903977b42cb6abcd5565a61bd7293e4dc3 -Author: Darren Tucker -Date: Fri Apr 1 23:21:06 2022 +1100 - - Increase test timeout to allow slow VMs to finish - -commit 02488c1b54065ddc4f25835dbd2618b2a2fe21f5 -Author: Darren Tucker -Date: Fri Apr 1 16:27:38 2022 +1100 - - Use bash or ksh if available for SH in Makefile. + OpenBSD-Commit-ID: d6c882c2e8a42ff831a5b3cbc2c961ecb2dd6143 -commit 34c7018c316af4773e432066de28d0ef9d0888cd -Author: Darren Tucker -Date: Fri Apr 1 14:56:54 2022 +1100 +commit 4a4883664d6b4e9e4e459a8cdc16bd8d4b735de9 +Author: jmc@openbsd.org +Date: Fri Oct 7 06:00:58 2022 +0000 - Set Makefile SHELL as determined by configure. + upstream: ssh-agent.1: - use Nm not Xr for self-ref - while here, - This should improve compatibility for users with non-POSIX shells. If - using Makefile.in directly (eg make -f Makefile.in distprep) then SHELL - will need to be specified on the command line (along with MANFMT in that - particular case). ok djm@ - -commit 5b054d76402faab38c48377efd112426469553a0 -Author: Darren Tucker -Date: Fri Apr 1 13:16:47 2022 +1100 - - Skip slow tests on (very) slow test targets. - -commit b275818065b31a865142c48c2acf6a7c1655c542 -Author: Damien Miller -Date: Thu Mar 31 14:11:36 2022 +1100 - - depend - -commit 3fa539c3ffaabd6211995512d33e29150f88c5c5 -Author: djm@openbsd.org -Date: Thu Mar 31 03:07:03 2022 +0000 - - upstream: add a sftp client "cp" command that supports server-side + wrap a long line - copying of files. Useful for this task and for testing the copy-data - extension. Patch from Mike Frysinger; ok dtucker@ + ssh-agent.c: + - add -O to usage() - OpenBSD-Commit-ID: 1bb1b950af0d49f0d5425b1f267e197aa1b57444 + OpenBSD-Commit-ID: 855dac4695cef22e96d69c53436496bc408ca389 -commit 7988bfc4b701c4b3fe9b36c8561a3d1c5d4c9a74 +commit 9fd2441113fce2a83fc7470968c3b27809cc7f10 Author: djm@openbsd.org -Date: Thu Mar 31 03:05:49 2022 +0000 +Date: Fri Oct 7 04:06:26 2022 +0000 - upstream: add support for the "corp-data" protocol extension to + upstream: document "-O no-restrict-websafe"; spotted by Ross L - allow server-side copies to be performed without having to go via the client. - Patch by Mike Frysinger, ok dtucker@ + Richardson - OpenBSD-Commit-ID: 00aa510940fedd66dab1843b58682de4eb7156d5 + OpenBSD-Commit-ID: fe9eaa50237693a14ebe5b5614bf32a02145fe8b -commit 32dc1c29a4ac9c592ddfef0a4895eb36c1f567ba -Author: djm@openbsd.org -Date: Wed Mar 30 21:13:23 2022 +0000 +commit 614252b05d70f798a0929b1cd3d213030ad4d007 +Author: Darren Tucker +Date: Tue Oct 18 06:29:16 2022 +1100 - upstream: select post-quantum KEX - - sntrup761x25519-sha512@openssh.com as the default; ok markus@ - - OpenBSD-Commit-ID: f02d99cbfce22dffec2e2ab1b60905fbddf48fb9 + OpenSSL dev branch now identifies as 3.2.0. -commit d6556de1db0822c76ba2745cf5c097d9472adf7c -Author: djm@openbsd.org -Date: Wed Mar 30 21:10:25 2022 +0000 +commit 195e5a65fd793a738ea8451ebfdd1919db5aff3e +Author: Damien Miller +Date: Mon Oct 17 09:41:47 2022 +1100 - upstream: fix poll() spin when a channel's output fd closes without - - data in the channel buffer. Introduce more exact packing of channel fds into - the pollfd array. fixes bz3405 and bz3411; ok deraadt@ markus@ + revert c64b62338b4 and guard POLL* defines instead - OpenBSD-Commit-ID: 06740737849c9047785622ad5d472cb6a3907d10 + c64b62338b4 broke OSX builds, which do have poll.h but lack ppoll(2) + Spotted by dtucker -commit 8a74a96d25ca4d32fbf298f6c0ac5a148501777d -Author: djm@openbsd.org -Date: Wed Mar 30 04:33:09 2022 +0000 +commit bc2e480d99613bd59720edae244d1764636544c4 +Author: Damien Miller +Date: Fri Oct 14 14:52:22 2022 +1100 - upstream: ssh is almost out of getopt() characters; note the - - remaining remaining available ones in a comment - - OpenBSD-Commit-ID: 48d38cef59d6bc8e84c6c066f6d601875d3253fd + undef _get{short,long} before redefining -commit 6d4fc51adb9d8a42f67b5474f02f877422379de6 -Author: djm@openbsd.org -Date: Wed Mar 30 04:27:51 2022 +0000 +commit 5eb796a369c64f18d55a6ae9b1fa9b35eea237fb +Author: Harmen Stoppels +Date: Thu Oct 13 16:08:46 2022 +0200 - upstream: avoid NULL deref via ssh-keygen -Y find-principals. - - bz3409, reported by Mateusz Adamowski + Fix snprintf configure test for clang 15 - OpenBSD-Commit-ID: a3b2c02438052ee858e0ee18e5a288586b5df2c5 + Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. + A handful of tests have "main(..." and not "int main(..." which caused + the tests to produce incorrect results. -commit e937514920335b92b543fd9be79cd6481d1eb0b6 -Author: Darren Tucker -Date: Mon Mar 28 17:51:03 2022 +1100 +commit c64b62338b46ffa08839f05f21ad69fa6234dc17 +Author: Damien Miller +Date: Mon Oct 10 12:32:43 2022 +1100 - Add AIX 5.1 test target. + skip bsd-poll.h if poll.h found; ok dtucker -commit 4bbe815ba974b4fd89cc3fc3e3ef1be847a0befe -Author: Darren Tucker -Date: Sat Mar 26 22:01:31 2022 +1100 +commit 5ee2b8ccfcf4b606f450eb0ff2305e311f68b0be +Author: djm@openbsd.org +Date: Thu Oct 6 22:42:37 2022 +0000 - Drop leading "v" from release version identifier. + upstream: honour user's umask if it is more restrictive then the ssh - It's present in the git tags but not in the release tarball names. - Also drop extra "/" from URL path. - -commit f5cdd3b3c275dffaebfca91df782dca29975e9ac -Author: Darren Tucker -Date: Sat Mar 26 16:28:04 2022 +1100 - - Use tarballs when testing LibreSSL releases. + default (022); based on patch from Alex Henrie, ok dtucker@ deraadt@ - This means they'll still work when the combination of -portable and - openbsd github repos no longer match. + OpenBSD-Commit-ID: fe1b9e15fc9a4f49fc338e848ce14d8727abe82d -commit 24dc37d198f35a7cf71bf4d5384363c7ef4209d4 +commit a75cffc2700cebd3e2dd9093f7f7388d2be95cb7 Author: Darren Tucker -Date: Sat Mar 26 15:02:45 2022 +1100 +Date: Fri Oct 7 03:54:56 2022 +1100 - Remove now-unused passwd variable. + Add LibreSSL 3.6.0 to test suite. + + While there, bump OpenSSL to latest 1.1.1q release. -commit 5b467ceef2c356f0a77f5e8ab4eb0fac367e4d24 +commit fcc0f0c0e96a30076683fea9a7c9eedc72931742 Author: Darren Tucker -Date: Sat Mar 26 13:15:44 2022 +1100 +Date: Thu Oct 6 21:18:16 2022 +1100 - Missing semicolon. + Add 9.1 branch to CI status page. -commit 2923d026e55998133c0f6e5186dca2a3c0fa5ff5 +commit ef211eee63821d894a8bf81f22bfba9f6899d0fe Author: Darren Tucker -Date: Sat Mar 26 12:49:50 2022 +1100 +Date: Tue Oct 4 23:20:23 2022 +1100 - Factor out platform-specific locked account check. + Test commits to all branches of portable. - Also fixes an incorrect free on platforms with both libiaf and shadow - passwords (probably only Unixware). Prompted by github PR#284, - originally from @c3h2_ctf and stoeckmann@. + Only test OpenBSD upstream on commits to master since that's what it + tracks. -commit d23efe4b12886ffe416be10bc0a7da6ca8aa72d1 -Author: Darren Tucker -Date: Sat Mar 26 08:13:46 2022 +1100 +commit fe646de03cafb6593ff4e4954bca9ec4b4b753a8 +Author: Damien Miller +Date: Wed Oct 5 03:47:26 2022 +1100 - Add OpenWRT mips and mipsel test targets. + whitespace at EOL -commit 16ea8b85838dd7a4dbeba4e51ac4f43fd68b1e5b -Author: djm@openbsd.org -Date: Sun Mar 20 08:52:17 2022 +0000 +commit a6e1852d10c63a830196e82168dadd957aaf28ec +Author: Damien Miller +Date: Wed Oct 5 03:40:01 2022 +1100 - upstream: don't leak argument list; bz3404, reported by Balu - - Gajjala ok dtucker@ - - OpenBSD-Commit-ID: fddc32d74e5dd5cff1a49ddd6297b0867eae56a6 + mention libfido2 autodetection -commit a72bde294fe0518c9a44ba63864093a1ef2425e3 -Author: djm@openbsd.org -Date: Sun Mar 20 08:51:21 2022 +0000 +commit 7360c2c206f33d309edbaf64036c96fadf74d640 +Author: Damien Miller +Date: Wed Oct 5 03:37:36 2022 +1100 - upstream: make addargs() and replacearg() a little more robust and - - improve error reporting - - make freeargs(NULL) a noop like the other free functions - - ok dtucker as part of bz3403 + remove mention of --with-security-key-builtin - OpenBSD-Commit-ID: 15f86da83176978b4d1d288caa24c766dfa2983d + it is enabled by default when libfido2 is installed -commit 731087d2619fa7f01e675b23f57af10d745e8af2 -Author: djm@openbsd.org -Date: Fri Mar 18 04:04:11 2022 +0000 +commit 0ffb46f2ee2ffcc4daf45ee679e484da8fcf338c +Author: Damien Miller +Date: Tue Oct 4 01:51:42 2022 +1100 - upstream: don't try to resolve ListenAddress directives in the sshd - - re-exec path - we're never going to use the result and if the operation fails - then it can prevent connections from being accepted. Reported by Aaron - Poffenberger; with / ok dtucker@ - - OpenBSD-Commit-ID: 44c53a43909a328e2f5ab26070fdef3594eded60 + update .depend -commit 1c83c082128694ddd11ac05fdf31d70312ff1763 -Author: djm@openbsd.org -Date: Fri Mar 18 02:50:21 2022 +0000 +commit 657e676ff696c7bb787bffb0e249ea1be3b474e1 +Author: Damien Miller +Date: Tue Oct 4 01:45:52 2022 +1100 - upstream: remove blank line - - OpenBSD-Commit-ID: d5e0182965b2fbfb03ad5f256d1a1ce5706bcddf + update release notes URL -commit 807be68684da7a1fe969c399ddce2fafb7997dcb -Author: djm@openbsd.org -Date: Fri Mar 18 02:32:22 2022 +0000 +commit f059da2b29840c0f048448809c317ce2ae014da7 +Author: Damien Miller +Date: Tue Oct 4 01:45:41 2022 +1100 - upstream: helpful comment - - OpenBSD-Commit-ID: e3315a45cb04e7feeb614d76ec80a9fe4ca0e8c7 + crank versions in RPM spec files -commit a0b5816f8f1f645acdf74f7bc11b34455ec30bac +commit b51f3f172d87cbdb80ca4eb7b2149e56a7647557 Author: djm@openbsd.org -Date: Fri Mar 18 02:31:25 2022 +0000 +Date: Mon Sep 26 22:18:40 2022 +0000 - upstream: ssh-keygen -Y check-novalidate requires namespace or SEGV - - will ensue. Patch from Mateusz Adamowski via GHPR#307 + upstream: openssh-9.1 - OpenBSD-Commit-ID: 99e8ec38f9feb38bce6de240335be34aedeba5fd + OpenBSD-Commit-ID: 5a467b2ee81da01a86adf1ad93b62b1728494e56 -commit 5a252d54a63be30d5ba4be76210942d754a531c0 -Author: djm@openbsd.org -Date: Tue Mar 15 05:27:37 2022 +0000 +commit 4cf8d0c0f3030f594a238bab21a0695735515487 +Author: dtucker@openbsd.org +Date: Wed Sep 21 22:26:50 2022 +0000 - upstream: improve DEBUG_CHANNEL_POLL debugging message + upstream: Fix typo. From AlexanderStohr via github PR#343. - OpenBSD-Commit-ID: 2275eb7bc4707d019b1a0194b9c92c0b78da848f + OpenBSD-Commit-ID: a134c9b4039e48803fc6a87f955b0f4a03181497 -commit ce324cf58ba2840e31afeb996935800780c8fa4b -Author: cheloha@openbsd.org -Date: Sun Mar 13 23:27:54 2022 +0000 +commit 8179fed3264d5919899900ed8881d5f9bb57ca33 +Author: djm@openbsd.org +Date: Mon Sep 19 21:39:16 2022 +0000 - upstream: ssh: xstrdup(): use memcpy(3) - - Copying the given string into the buffer with strlcpy(3) confers no - benefit in this context because we have already determined the - string's length with strlen(3) in order to allocate that buffer. - - Thread: https://marc.info/?l=openbsd-tech&m=164687525802691&w=2 + upstream: add RequiredRSASize to the list of keywords accepted by - ok dtucker@ millert@ + -o; spotted by jmc@ - OpenBSD-Commit-ID: f8bfc082e36e2d2dc4e1feece02fe274155ca11a + OpenBSD-Commit-ID: fe871408cf6f9d3699afeda876f8adbac86a035e diff --git a/LICENCE b/LICENCE index 4b0db54..aeb3017 100644 --- a/LICENCE +++ b/LICENCE @@ -367,5 +367,46 @@ OpenSSH contains no GPL code. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. + The replacement base64 implementation has the following MIT-style + licenses: + + * Copyright (c) 1996 by Internet Software Consortium. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS + * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE + * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL + * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR + * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS + * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS + * SOFTWARE. + + * Portions Copyright (c) 1995 by International Business Machines, Inc. + * + * International Business Machines, Inc. (hereinafter called IBM) grants + * permission under its copyrights to use, copy, modify, and distribute this + * Software with or without fee, provided that the above copyright notice and + * all paragraphs of this notice appear in all copies, and that the name of IBM + * not be used in connection with the marketing of any product incorporating + * the Software or modifications thereof, without specific, written prior + * permission. + * + * To the extent it has a right to do so, IBM grants an immunity from suit + * under its patents, if any, for the use, sale or manufacture of products to + * the extent that such products are used for performing Domain Name System + * dynamic updates in TCP/IP networks by means of the Software. No immunity is + * granted for any product per se or for any other function of any product. + * + * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, + * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, + * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING + * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN + * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. + ------ $OpenBSD: LICENCE,v 1.20 2017/04/30 23:26:16 djm Exp $ diff --git a/Makefile.in b/Makefile.in index 1efe11f..4243006 100644 --- a/Makefile.in +++ b/Makefile.in @@ -24,6 +24,7 @@ SSH_PROGRAM=@bindir@/ssh ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass SFTP_SERVER=$(libexecdir)/sftp-server SSH_KEYSIGN=$(libexecdir)/ssh-keysign +SSHD_SESSION=$(libexecdir)/sshd-session SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper PRIVSEP_PATH=@PRIVSEP_PATH@ @@ -37,6 +38,7 @@ PATHS= -DSSHDIR=\"$(sysconfdir)\" \ -D_PATH_SSH_ASKPASS_DEFAULT=\"$(ASKPASS_PROGRAM)\" \ -D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \ -D_PATH_SSH_KEY_SIGN=\"$(SSH_KEYSIGN)\" \ + -D_PATH_SSHD_SESSION=\"$(SSHD_SESSION)\" \ -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \ -D_PATH_SSH_SK_HELPER=\"$(SSH_SK_HELPER)\" \ -D_PATH_SSH_PIDDIR=\"$(piddir)\" \ @@ -69,7 +71,7 @@ MKDIR_P=@MKDIR_P@ .SUFFIXES: .lo -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) sshd-session$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) XMSS_OBJS=\ ssh-xmss.o \ @@ -107,9 +109,9 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \ ssh-ed25519.o digest-openssl.o digest-libc.o \ hmac.o ed25519.o hash.o \ - kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ + kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ kexgexc.o kexgexs.o \ - kexsntrup761x25519.o sntrup761.o kexgen.o \ + kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \ sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \ sshbuf-io.o @@ -118,17 +120,23 @@ SKOBJS= ssh-sk-client.o SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ sshconnect.o sshconnect2.o mux.o $(SKOBJS) -SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \ +SSHDOBJS=sshd.o \ + platform-listen.o \ + servconf.o sshpty.o srclimit.o groupaccess.o auth2-methods.o \ + dns.o fatal.o compat.o utf8.o authfd.o canohost.o \ + $(SKOBJS) + +SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \ audit.o audit-bsm.o audit-linux.o platform.o \ sshpty.o sshlogin.o servconf.o serverloop.o \ - auth.o auth2.o auth-options.o session.o \ + auth.o auth2.o auth2-methods.o auth-options.o session.o \ auth2-chall.o groupaccess.o \ auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \ auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \ monitor.o monitor_wrap.o auth-krb5.o \ auth2-gss.o gss-serv.o gss-serv-krb5.o \ loginrec.o auth-pam.o auth-shadow.o auth-sia.o \ - srclimit.o sftp-server.o sftp-common.o \ + sftp-server.o sftp-common.o \ sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \ sandbox-solaris.o uidswap.o $(SKOBJS) @@ -207,7 +215,10 @@ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS) $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(GSSLIBS) $(CHANNELLIBS) sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS) - $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS) + $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(CHANNELLIBS) + +sshd-session$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHD_SESSION_OBJS) + $(LD) -o $@ $(SSHD_SESSION_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) $(CHANNELLIBS) scp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SCP_OBJS) $(LD) -o $@ $(SCP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) @@ -399,6 +410,7 @@ install-files: $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT) + $(INSTALL) -m 0755 $(STRIP_OPT) sshd-session$(EXEEXT) $(DESTDIR)$(SSHD_SESSION)$(EXEEXT) $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT) @@ -741,6 +753,7 @@ interop-tests t-exec file-tests extra-tests: regress-prep regress-binaries $(TAR TEST_SSH_SCP="$(BUILDDIR)/scp" \ TEST_SSH_SSH="$(BUILDDIR)/ssh" \ TEST_SSH_SSHD="$(BUILDDIR)/sshd" \ + TEST_SSH_SSHD_SESSION="$(BUILDDIR)/sshd-session" \ TEST_SSH_SSHAGENT="$(BUILDDIR)/ssh-agent" \ TEST_SSH_SSHADD="$(BUILDDIR)/ssh-add" \ TEST_SSH_SSHKEYGEN="$(BUILDDIR)/ssh-keygen" \ diff --git a/PROTOCOL.agent b/PROTOCOL.agent index 7637882..9ae16bf 100644 --- a/PROTOCOL.agent +++ b/PROTOCOL.agent @@ -49,10 +49,13 @@ Where a constraint consists of: string from_username (must be empty) string from_hostname + string reserved keyspec[] from_hostkeys string to_username string to_hostname + string reserved keyspec[] to_hostkeys + string reserved And a keyspec consists of: @@ -112,4 +115,4 @@ A SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED will return SSH_AGENT_SUCCESS if any key (plain private or certificate) was successfully loaded, or SSH_AGENT_FAILURE if no key was loaded. -$OpenBSD: PROTOCOL.agent,v 1.22 2023/12/20 00:06:25 jsg Exp $ +$OpenBSD: PROTOCOL.agent,v 1.23 2024/04/30 05:45:56 djm Exp $ diff --git a/PROTOCOL.key b/PROTOCOL.key index cbf7a70..feda252 100644 --- a/PROTOCOL.key +++ b/PROTOCOL.key @@ -40,7 +40,7 @@ of the cipher block size. byte[] privatekey2 string comment2 ... - string privatekeyN + byte[] privatekeyN string commentN byte 1 byte 2 @@ -68,4 +68,4 @@ For unencrypted keys the cipher "none" and the KDF "none" are used with empty passphrases. The options if the KDF "none" are the empty string. -$OpenBSD: PROTOCOL.key,v 1.3 2022/07/01 04:45:50 djm Exp $ +$OpenBSD: PROTOCOL.key,v 1.4 2024/03/30 05:56:22 djm Exp $ diff --git a/README b/README index 89981ef..3e494c6 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ -See https://www.openssh.com/releasenotes.html#9.7p1 for the release +See https://www.openssh.com/releasenotes.html#9.9p1 for the release notes. Please read https://www.openssh.com/report.html for bug reporting diff --git a/addr.c b/addr.c index fa8c669..0e7cb1d 100644 --- a/addr.c +++ b/addr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: addr.c,v 1.7 2023/03/27 03:31:05 djm Exp $ */ +/* $OpenBSD: addr.c,v 1.8 2024/04/02 09:29:31 deraadt Exp $ */ /* * Copyright (c) 2004-2008 Damien Miller @@ -27,6 +27,7 @@ #include #include #include +#include #include "addr.h" @@ -457,8 +458,9 @@ int addr_pton_cidr(const char *p, struct xaddr *n, u_int *l) { struct xaddr tmp; - long unsigned int masklen = 999; - char addrbuf[64], *mp, *cp; + u_int masklen = 999; + char addrbuf[64], *mp; + const char *errstr; /* Don't modify argument */ if (p == NULL || strlcpy(addrbuf, p, sizeof(addrbuf)) >= sizeof(addrbuf)) @@ -467,8 +469,8 @@ addr_pton_cidr(const char *p, struct xaddr *n, u_int *l) if ((mp = strchr(addrbuf, '/')) != NULL) { *mp = '\0'; mp++; - masklen = strtoul(mp, &cp, 10); - if (*mp < '0' || *mp > '9' || *cp != '\0' || masklen > 128) + masklen = (u_int)strtonum(mp, 0, INT_MAX, &errstr); + if (errstr) return -1; } diff --git a/auth-pam.c b/auth-pam.c index b49d415..13c0a79 100644 --- a/auth-pam.c +++ b/auth-pam.c @@ -67,11 +67,6 @@ #include #endif -#if !defined(SSHD_PAM_SERVICE) -extern char *__progname; -# define SSHD_PAM_SERVICE __progname -#endif - /* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */ #ifdef PAM_SUN_CODEBASE # define sshpam_const /* Solaris, HP-UX, SunOS */ @@ -105,6 +100,7 @@ extern char *__progname; #include "ssh-gss.h" #endif #include "monitor_wrap.h" +#include "srclimit.h" extern ServerOptions options; extern struct sshbuf *loginmsg; @@ -171,13 +167,13 @@ sshpam_sigchld_handler(int sig) return; } } - if (WIFSIGNALED(sshpam_thread_status) && - WTERMSIG(sshpam_thread_status) == SIGTERM) - return; /* terminated by pthread_cancel */ - if (!WIFEXITED(sshpam_thread_status)) - sigdie("PAM: authentication thread exited unexpectedly"); - if (WEXITSTATUS(sshpam_thread_status) != 0) - sigdie("PAM: authentication thread exited uncleanly"); + if (sshpam_thread_status == -1) + return; + if (WIFSIGNALED(sshpam_thread_status)) { + if (signal_is_crash(WTERMSIG(sshpam_thread_status))) + _exit(EXIT_CHILD_CRASH); + } else if (!WIFEXITED(sshpam_thread_status)) + _exit(EXIT_CHILD_CRASH); } /* ARGSUSED */ @@ -668,7 +664,7 @@ static struct pam_conv store_conv = { sshpam_store_conv, NULL }; void sshpam_cleanup(void) { - if (sshpam_handle == NULL || (use_privsep && !mm_is_monitor())) + if (sshpam_handle == NULL || !mm_is_monitor()) return; debug("PAM: cleanup"); pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv); @@ -694,6 +690,8 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt) const char **ptr_pam_user = &pam_user; int r; + if (options.pam_service_name == NULL) + fatal_f("internal error: NULL PAM service name"); #if defined(PAM_SUN_CODEBASE) && defined(PAM_MAX_RESP_SIZE) /* Protect buggy PAM implementations from excessively long usernames */ if (strlen(user) >= PAM_MAX_RESP_SIZE) @@ -705,7 +703,8 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt) fatal("%s: called initially with no " "packet context", __func__); } - } if (sshpam_handle != NULL) { + } + if (sshpam_handle != NULL) { /* We already have a PAM context; check if the user matches */ sshpam_err = pam_get_item(sshpam_handle, PAM_USER, (sshpam_const void **)ptr_pam_user); @@ -714,9 +713,10 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt) pam_end(sshpam_handle, sshpam_err); sshpam_handle = NULL; } - debug("PAM: initializing for \"%s\"", user); - sshpam_err = - pam_start(SSHD_PAM_SERVICE, user, &store_conv, &sshpam_handle); + debug("PAM: initializing for \"%s\" with service \"%s\"", user, + options.pam_service_name); + sshpam_err = pam_start(options.pam_service_name, user, + &store_conv, &sshpam_handle); sshpam_authctxt = authctxt; if (sshpam_err != PAM_SUCCESS) { @@ -1101,20 +1101,15 @@ do_pam_account(void) } void -do_pam_setcred(int init) +do_pam_setcred(void) { sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, (const void *)&store_conv); if (sshpam_err != PAM_SUCCESS) fatal("PAM: failed to set PAM_CONV: %s", pam_strerror(sshpam_handle, sshpam_err)); - if (init) { - debug("PAM: establishing credentials"); - sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED); - } else { - debug("PAM: reinitializing credentials"); - sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED); - } + debug("PAM: establishing credentials"); + sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED); if (sshpam_err == PAM_SUCCESS) { sshpam_cred_established = 1; return; @@ -1127,6 +1122,7 @@ do_pam_setcred(int init) pam_strerror(sshpam_handle, sshpam_err)); } +#if 0 static int sshpam_tty_conv(int n, sshpam_const struct pam_message **msg, struct pam_response **resp, void *data) @@ -1182,6 +1178,7 @@ sshpam_tty_conv(int n, sshpam_const struct pam_message **msg, } static struct pam_conv tty_conv = { sshpam_tty_conv, NULL }; +#endif /* * XXX this should be done in the authentication phase, but ssh1 doesn't @@ -1190,8 +1187,8 @@ static struct pam_conv tty_conv = { sshpam_tty_conv, NULL }; void do_pam_chauthtok(void) { - if (use_privsep) - fatal("Password expired (unable to change with privsep)"); + fatal("Password expired"); +#if 0 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, (const void *)&tty_conv); if (sshpam_err != PAM_SUCCESS) @@ -1202,6 +1199,7 @@ do_pam_chauthtok(void) if (sshpam_err != PAM_SUCCESS) fatal("PAM: pam_chauthtok(): %s", pam_strerror(sshpam_handle, sshpam_err)); +#endif } void @@ -1375,6 +1373,8 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password) fatal("PAM: %s: failed to set PAM_CONV: %s", __func__, pam_strerror(sshpam_handle, sshpam_err)); + expose_authinfo(__func__); + sshpam_err = pam_authenticate(sshpam_handle, flags); sshpam_password = NULL; free(fake); diff --git a/auth-pam.h b/auth-pam.h index 9fcea27..8d801c6 100644 --- a/auth-pam.h +++ b/auth-pam.h @@ -31,7 +31,7 @@ void start_pam(struct ssh *); void finish_pam(void); u_int do_pam_account(void); void do_pam_session(struct ssh *); -void do_pam_setcred(int ); +void do_pam_setcred(void); void do_pam_chauthtok(void); int do_pam_putenv(char *, char *); char ** fetch_pam_environment(void); diff --git a/auth-rhosts.c b/auth-rhosts.c index 5672467..d5d2c7a 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-rhosts.c,v 1.57 2022/12/09 00:17:40 dtucker Exp $ */ +/* $OpenBSD: auth-rhosts.c,v 1.58 2024/05/17 00:30:23 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -46,7 +46,6 @@ /* import */ extern ServerOptions options; -extern int use_privsep; /* * This function processes an rhosts-style file (.rhosts, .shosts, or diff --git a/auth.c b/auth.c index 3b380d9..9a6e5a3 100644 --- a/auth.c +++ b/auth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.c,v 1.160 2023/03/05 05:34:09 dtucker Exp $ */ +/* $OpenBSD: auth.c,v 1.162 2024/09/15 01:18:26 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -79,7 +79,6 @@ /* import */ extern ServerOptions options; extern struct include_list includes; -extern int use_privsep; extern struct sshbuf *loginmsg; extern struct passwd *privsep_pw; extern struct sshauthopt *auth_opts; @@ -272,7 +271,7 @@ auth_log(struct ssh *ssh, int authenticated, int partial, const char *authmsg; char *extra = NULL; - if (use_privsep && !mm_is_monitor() && !authctxt->postponed) + if (!mm_is_monitor() && !authctxt->postponed) return; /* Raise logging level */ @@ -464,6 +463,9 @@ getpwnamallow(struct ssh *ssh, const char *user) { #ifdef HAVE_LOGIN_CAP extern login_cap_t *lc; +#ifdef HAVE_AUTH_HOSTOK + const char *from_host, *from_ip; +#endif #ifdef BSD_AUTH auth_session_t *as; #endif @@ -472,14 +474,15 @@ getpwnamallow(struct ssh *ssh, const char *user) struct connection_info *ci; u_int i; - ci = get_connection_info(ssh, 1, options.use_dns); + ci = server_get_connection_info(ssh, 1, options.use_dns); ci->user = user; + ci->user_invalid = getpwnam(user) == NULL; parse_server_match_config(&options, &includes, ci); log_change_level(options.log_level); log_verbose_reset(); for (i = 0; i < options.num_log_verbose; i++) log_verbose_add(options.log_verbose[i]); - process_permitopen(ssh, &options); + server_process_permitopen(ssh); #if defined(_AIX) && defined(HAVE_SETAUTHDB) aix_setauthdb(user); @@ -509,6 +512,21 @@ getpwnamallow(struct ssh *ssh, const char *user) debug("unable to get login class: %s", user); return (NULL); } +#ifdef HAVE_AUTH_HOSTOK + from_host = auth_get_canonical_hostname(ssh, options.use_dns); + from_ip = ssh_remote_ipaddr(ssh); + if (!auth_hostok(lc, from_host, from_ip)) { + debug("Denied connection for %.200s from %.200s [%.200s].", + pw->pw_name, from_host, from_ip); + return (NULL); + } +#endif /* HAVE_AUTH_HOSTOK */ +#ifdef HAVE_AUTH_TIMEOK + if (!auth_timeok(lc, time(NULL))) { + debug("LOGIN %.200s REFUSED (TIME)", pw->pw_name); + return (NULL); + } +#endif /* HAVE_AUTH_TIMEOK */ #ifdef BSD_AUTH if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 || auth_approval(as, lc, pw->pw_name, "ssh") <= 0) { @@ -637,97 +655,6 @@ fakepw(void) return (&fake); } -/* - * Returns the remote DNS hostname as a string. The returned string must not - * be freed. NB. this will usually trigger a DNS query the first time it is - * called. - * This function does additional checks on the hostname to mitigate some - * attacks on based on conflation of hostnames and IP addresses. - */ - -static char * -remote_hostname(struct ssh *ssh) -{ - struct sockaddr_storage from; - socklen_t fromlen; - struct addrinfo hints, *ai, *aitop; - char name[NI_MAXHOST], ntop2[NI_MAXHOST]; - const char *ntop = ssh_remote_ipaddr(ssh); - - /* Get IP address of client. */ - fromlen = sizeof(from); - memset(&from, 0, sizeof(from)); - if (getpeername(ssh_packet_get_connection_in(ssh), - (struct sockaddr *)&from, &fromlen) == -1) { - debug("getpeername failed: %.100s", strerror(errno)); - return xstrdup(ntop); - } - - ipv64_normalise_mapped(&from, &fromlen); - if (from.ss_family == AF_INET6) - fromlen = sizeof(struct sockaddr_in6); - - debug3("Trying to reverse map address %.100s.", ntop); - /* Map the IP address to a host name. */ - if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), - NULL, 0, NI_NAMEREQD) != 0) { - /* Host name not found. Use ip address. */ - return xstrdup(ntop); - } - - /* - * if reverse lookup result looks like a numeric hostname, - * someone is trying to trick us by PTR record like following: - * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 - */ - memset(&hints, 0, sizeof(hints)); - hints.ai_socktype = SOCK_DGRAM; /*dummy*/ - hints.ai_flags = AI_NUMERICHOST; - if (getaddrinfo(name, NULL, &hints, &ai) == 0) { - logit("Nasty PTR record \"%s\" is set up for %s, ignoring", - name, ntop); - freeaddrinfo(ai); - return xstrdup(ntop); - } - - /* Names are stored in lowercase. */ - lowercase(name); - - /* - * Map it back to an IP address and check that the given - * address actually is an address of this host. This is - * necessary because anyone with access to a name server can - * define arbitrary names for an IP address. Mapping from - * name to IP address can be trusted better (but can still be - * fooled if the intruder has access to the name server of - * the domain). - */ - memset(&hints, 0, sizeof(hints)); - hints.ai_family = from.ss_family; - hints.ai_socktype = SOCK_STREAM; - if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { - logit("reverse mapping checking getaddrinfo for %.700s " - "[%s] failed.", name, ntop); - return xstrdup(ntop); - } - /* Look for the address from the list of addresses. */ - for (ai = aitop; ai; ai = ai->ai_next) { - if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, - sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && - (strcmp(ntop, ntop2) == 0)) - break; - } - freeaddrinfo(aitop); - /* If we reached the end of the list, the address was not there. */ - if (ai == NULL) { - /* Address not found for the host name. */ - logit("Address %.100s maps to %.600s, but this does not " - "map back to the address.", ntop, name); - return xstrdup(ntop); - } - return xstrdup(name); -} - /* * Return the canonical name of the host in the other side of the current * connection. The host name is cached, so it is efficient to call this @@ -741,12 +668,10 @@ auth_get_canonical_hostname(struct ssh *ssh, int use_dns) if (!use_dns) return ssh_remote_ipaddr(ssh); - else if (dnsname != NULL) - return dnsname; - else { - dnsname = remote_hostname(ssh); + if (dnsname != NULL) return dnsname; - } + dnsname = ssh_remote_hostname(ssh); + return dnsname; } /* These functions link key/cert options to the auth framework */ diff --git a/auth.h b/auth.h index 6d2d397..98bb23d 100644 --- a/auth.h +++ b/auth.h @@ -1,4 +1,4 @@ -/* $OpenBSD: auth.h,v 1.106 2022/06/15 16:08:25 djm Exp $ */ +/* $OpenBSD: auth.h,v 1.108 2024/05/17 06:42:04 jsg Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -104,11 +104,15 @@ struct Authctxt { * the client. */ +struct authmethod_cfg { + const char *name; + const char *synonym; + int *enabled; +}; + struct Authmethod { - char *name; - char *synonym; + struct authmethod_cfg *cfg; int (*userauth)(struct ssh *, const char *); - int *enabled; }; /* @@ -151,8 +155,6 @@ void auth2_record_info(Authctxt *authctxt, const char *, ...) void auth2_update_session_info(Authctxt *, const char *, const char *); #ifdef KRB5 -int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); -int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); int auth_krb5_password(Authctxt *authctxt, const char *password); void krb5_cleanup_proc(Authctxt *authctxt); #endif /* KRB5 */ @@ -211,7 +213,6 @@ int sshd_hostkey_sign(struct ssh *, struct sshkey *, struct sshkey *, u_char **, size_t *, const u_char *, size_t, const char *); /* Key / cert options linkage to auth layer */ -const struct sshauthopt *auth_options(struct ssh *); int auth_activate_options(struct ssh *, struct sshauthopt *); void auth_restrict_session(struct ssh *); void auth_log_authopts(const char *, const struct sshauthopt *, int); diff --git a/auth2-gss.c b/auth2-gss.c index f72a389..75eb4e3 100644 --- a/auth2-gss.c +++ b/auth2-gss.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-gss.c,v 1.34 2023/03/31 04:22:27 djm Exp $ */ +/* $OpenBSD: auth2-gss.c,v 1.36 2024/05/17 04:42:13 djm Exp $ */ /* * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. @@ -51,6 +51,7 @@ #define SSH_GSSAPI_MAX_MECHS 2048 extern ServerOptions options; +extern struct authmethod_cfg methodcfg_gssapi; static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh); static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh); @@ -116,7 +117,7 @@ userauth_gssapi(struct ssh *ssh, const char *method) return (0); } - if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) { + if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, &goid))) { if (ctxt != NULL) ssh_gssapi_delete_ctx(&ctxt); free(doid); @@ -153,7 +154,7 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh) size_t len; int r; - if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + if (authctxt == NULL) fatal("No authentication or GSSAPI context"); gssctxt = authctxt->methoddata; @@ -163,8 +164,8 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh) recv_tok.value = p; recv_tok.length = len; - maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok, - &send_tok, &flags)); + maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok, + &send_tok, &flags); free(p); @@ -217,7 +218,7 @@ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh) u_char *p; size_t len; - if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + if (authctxt == NULL) fatal("No authentication or GSSAPI context"); gssctxt = authctxt->methoddata; @@ -228,8 +229,8 @@ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh) recv_tok.length = len; /* Push the error token into GSSAPI to see what it says */ - maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok, - &send_tok, NULL)); + maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok, + &send_tok, NULL); free(recv_tok.value); @@ -254,9 +255,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) { Authctxt *authctxt = ssh->authctxt; int r, authenticated; - const char *displayname; - if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + if (authctxt == NULL) fatal("No authentication or GSSAPI context"); /* @@ -267,11 +267,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) if ((r = sshpkt_get_end(ssh)) != 0) fatal_fr(r, "parse packet"); - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); - - if ((!use_privsep || mm_is_monitor()) && - (displayname = ssh_gssapi_displayname()) != NULL) - auth2_record_info(authctxt, "%s", displayname); + authenticated = mm_ssh_gssapi_userok(authctxt->user); authctxt->postponed = 0; ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); @@ -290,11 +286,10 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) int r, authenticated = 0; struct sshbuf *b; gss_buffer_desc mic, gssbuf; - const char *displayname; u_char *p; size_t len; - if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + if (authctxt == NULL) fatal("No authentication or GSSAPI context"); gssctxt = authctxt->methoddata; @@ -312,18 +307,14 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) fatal_f("sshbuf_mutable_ptr failed"); gssbuf.length = sshbuf_len(b); - if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))) - authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); + if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))) + authenticated = mm_ssh_gssapi_userok(authctxt->user); else logit("GSSAPI MIC check failed"); sshbuf_free(b); free(mic.value); - if ((!use_privsep || mm_is_monitor()) && - (displayname = ssh_gssapi_displayname()) != NULL) - auth2_record_info(authctxt, "%s", displayname); - authctxt->postponed = 0; ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); @@ -334,10 +325,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) } Authmethod method_gssapi = { - "gssapi-with-mic", - NULL, + &methodcfg_gssapi, userauth_gssapi, - &options.gss_authentication }; #endif /* GSSAPI */ diff --git a/auth2-hostbased.c b/auth2-hostbased.c index 06bb464..eb21479 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-hostbased.c,v 1.52 2023/03/05 05:34:09 dtucker Exp $ */ +/* $OpenBSD: auth2-hostbased.c,v 1.53 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -54,6 +54,7 @@ /* import */ extern ServerOptions options; +extern struct authmethod_cfg methodcfg_hostbased; static int userauth_hostbased(struct ssh *ssh, const char *method) @@ -145,10 +146,10 @@ userauth_hostbased(struct ssh *ssh, const char *method) /* test for allowed key and correct signature */ authenticated = 0; - if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser, - chost, key)) && - PRIVSEP(sshkey_verify(key, sig, slen, - sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0) + if (mm_hostbased_key_allowed(ssh, authctxt->pw, cuser, + chost, key) && + mm_sshkey_verify(key, sig, slen, + sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL) == 0) authenticated = 1; auth2_record_key(authctxt, authenticated, key); @@ -252,8 +253,6 @@ hostbased_key_allowed(struct ssh *ssh, struct passwd *pw, } Authmethod method_hostbased = { - "hostbased", - NULL, + &methodcfg_hostbased, userauth_hostbased, - &options.hostbased_authentication }; diff --git a/auth2-kbdint.c b/auth2-kbdint.c index ae7eca3..fd08e72 100644 --- a/auth2-kbdint.c +++ b/auth2-kbdint.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-kbdint.c,v 1.14 2021/12/19 22:12:07 djm Exp $ */ +/* $OpenBSD: auth2-kbdint.c,v 1.15 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -42,6 +42,7 @@ /* import */ extern ServerOptions options; +extern struct authmethod_cfg methodcfg_kbdint; static int userauth_kbdint(struct ssh *ssh, const char *method) @@ -65,8 +66,6 @@ userauth_kbdint(struct ssh *ssh, const char *method) } Authmethod method_kbdint = { - "keyboard-interactive", - NULL, + &methodcfg_kbdint, userauth_kbdint, - &options.kbd_interactive_authentication }; diff --git a/auth2-methods.c b/auth2-methods.c new file mode 100644 index 0000000..99637a8 --- /dev/null +++ b/auth2-methods.c @@ -0,0 +1,134 @@ +/* + * Copyright (c) 2012,2023 Damien Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include "includes.h" + +#include + +#include +#include + +#include "log.h" +#include "misc.h" +#include "servconf.h" +#include "xmalloc.h" +#include "hostfile.h" +#include "auth.h" + +extern ServerOptions options; + +/* + * Configuration of enabled authentication methods. Separate from the rest of + * auth2-*.c because we want to query it during server configuration validity + * checking in the sshd listener process without pulling all the auth code in + * too. + */ + +/* "none" is allowed only one time and it is cleared by userauth_none() later */ +int none_enabled = 1; +struct authmethod_cfg methodcfg_none = { + "none", + NULL, + &none_enabled +}; +struct authmethod_cfg methodcfg_pubkey = { + "publickey", + "publickey-hostbound-v00@openssh.com", + &options.pubkey_authentication +}; +#ifdef GSSAPI +struct authmethod_cfg methodcfg_gssapi = { + "gssapi-with-mic", + NULL, + &options.gss_authentication +}; +#endif +struct authmethod_cfg methodcfg_passwd = { + "password", + NULL, + &options.password_authentication +}; +struct authmethod_cfg methodcfg_kbdint = { + "keyboard-interactive", + NULL, + &options.kbd_interactive_authentication +}; +struct authmethod_cfg methodcfg_hostbased = { + "hostbased", + NULL, + &options.hostbased_authentication +}; + +static struct authmethod_cfg *authmethod_cfgs[] = { + &methodcfg_none, + &methodcfg_pubkey, +#ifdef GSSAPI + &methodcfg_gssapi, +#endif + &methodcfg_passwd, + &methodcfg_kbdint, + &methodcfg_hostbased, + NULL +}; + +/* + * Check a comma-separated list of methods for validity. If need_enable is + * non-zero, then also require that the methods are enabled. + * Returns 0 on success or -1 if the methods list is invalid. + */ +int +auth2_methods_valid(const char *_methods, int need_enable) +{ + char *methods, *omethods, *method, *p; + u_int i, found; + int ret = -1; + const struct authmethod_cfg *cfg; + + if (*_methods == '\0') { + error("empty authentication method list"); + return -1; + } + omethods = methods = xstrdup(_methods); + while ((method = strsep(&methods, ",")) != NULL) { + for (found = i = 0; !found && authmethod_cfgs[i] != NULL; i++) { + cfg = authmethod_cfgs[i]; + if ((p = strchr(method, ':')) != NULL) + *p = '\0'; + if (strcmp(method, cfg->name) != 0) + continue; + if (need_enable) { + if (cfg->enabled == NULL || + *(cfg->enabled) == 0) { + error("Disabled method \"%s\" in " + "AuthenticationMethods list \"%s\"", + method, _methods); + goto out; + } + } + found = 1; + break; + } + if (!found) { + error("Unknown authentication method \"%s\" in list", + method); + goto out; + } + } + ret = 0; + out: + free(omethods); + return ret; +} diff --git a/auth2-none.c b/auth2-none.c index 8966fd0..c3ed53f 100644 --- a/auth2-none.c +++ b/auth2-none.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-none.c,v 1.25 2023/03/05 05:34:09 dtucker Exp $ */ +/* $OpenBSD: auth2-none.c,v 1.26 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -53,9 +53,9 @@ /* import */ extern ServerOptions options; +extern struct authmethod_cfg methodcfg_none; -/* "none" is allowed only one time */ -static int none_enabled = 1; +extern int none_enabled; static int userauth_none(struct ssh *ssh, const char *method) @@ -66,13 +66,11 @@ userauth_none(struct ssh *ssh, const char *method) if ((r = sshpkt_get_end(ssh)) != 0) fatal_fr(r, "parse packet"); if (options.permit_empty_passwd && options.password_authentication) - return (PRIVSEP(auth_password(ssh, ""))); + return mm_auth_password(ssh, ""); return (0); } Authmethod method_none = { - "none", - NULL, + &methodcfg_none, userauth_none, - &none_enabled }; diff --git a/auth2-passwd.c b/auth2-passwd.c index cc12cfb..61f98c0 100644 --- a/auth2-passwd.c +++ b/auth2-passwd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-passwd.c,v 1.21 2022/05/27 04:29:40 dtucker Exp $ */ +/* $OpenBSD: auth2-passwd.c,v 1.22 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -47,6 +47,7 @@ /* import */ extern ServerOptions options; +extern struct authmethod_cfg methodcfg_passwd; static int userauth_passwd(struct ssh *ssh, const char *method) @@ -66,15 +67,13 @@ userauth_passwd(struct ssh *ssh, const char *method) if (change) logit("password change not supported"); - else if (PRIVSEP(auth_password(ssh, password)) == 1) + else if (mm_auth_password(ssh, password) == 1) authenticated = 1; freezero(password, len); return authenticated; } Authmethod method_passwd = { - "password", - NULL, + &methodcfg_passwd, userauth_passwd, - &options.password_authentication }; diff --git a/auth2-pubkey.c b/auth2-pubkey.c index 3f49e1d..7580db7 100644 --- a/auth2-pubkey.c +++ b/auth2-pubkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2-pubkey.c,v 1.119 2023/07/27 22:25:17 djm Exp $ */ +/* $OpenBSD: auth2-pubkey.c,v 1.120 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -72,6 +72,7 @@ /* import */ extern ServerOptions options; +extern struct authmethod_cfg methodcfg_pubkey; static char * format_key(const struct sshkey *key) @@ -219,11 +220,11 @@ userauth_pubkey(struct ssh *ssh, const char *method) #endif /* test for correct signature */ authenticated = 0; - if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) && - PRIVSEP(sshkey_verify(key, sig, slen, + if (mm_user_key_allowed(ssh, pw, key, 1, &authopts) && + mm_sshkey_verify(key, sig, slen, sshbuf_ptr(b), sshbuf_len(b), (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL, - ssh->compat, &sig_details)) == 0) { + ssh->compat, &sig_details) == 0) { authenticated = 1; } if (authenticated == 1 && sig_details != NULL) { @@ -281,7 +282,7 @@ userauth_pubkey(struct ssh *ssh, const char *method) * if a user is not allowed to login. is this an * issue? -markus */ - if (PRIVSEP(user_key_allowed(ssh, pw, key, 0, NULL))) { + if (mm_user_key_allowed(ssh, pw, key, 0, NULL)) { if ((r = sshpkt_start(ssh, SSH2_MSG_USERAUTH_PK_OK)) != 0 || (r = sshpkt_put_cstring(ssh, pkalg)) != 0 || @@ -813,8 +814,6 @@ user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key, } Authmethod method_pubkey = { - "publickey", - "publickey-hostbound-v00@openssh.com", + &methodcfg_pubkey, userauth_pubkey, - &options.pubkey_authentication }; diff --git a/auth2.c b/auth2.c index 271789a..67dec88 100644 --- a/auth2.c +++ b/auth2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth2.c,v 1.168 2023/12/18 14:45:49 djm Exp $ */ +/* $OpenBSD: auth2.c,v 1.169 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * @@ -156,7 +156,7 @@ userauth_banner(struct ssh *ssh) if (options.banner == NULL) return; - if ((banner = PRIVSEP(auth2_read_banner())) == NULL) + if ((banner = mm_auth2_read_banner()) == NULL) goto done; userauth_send_banner(ssh, banner); @@ -291,7 +291,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) auth_maxtries_exceeded(ssh); if (authctxt->attempt++ == 0) { /* setup auth context */ - authctxt->pw = PRIVSEP(getpwnamallow(ssh, user)); + authctxt->pw = mm_getpwnamallow(ssh, user); authctxt->user = xstrdup(user); if (authctxt->pw && strcmp(service, "ssh-connection")==0) { authctxt->valid = 1; @@ -301,21 +301,19 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) /* Invalid user, fake password information */ authctxt->pw = fakepw(); #ifdef SSH_AUDIT_EVENTS - PRIVSEP(audit_event(ssh, SSH_INVALID_USER)); + mm_audit_event(ssh, SSH_INVALID_USER); #endif } #ifdef USE_PAM if (options.use_pam) - PRIVSEP(start_pam(ssh)); + mm_start_pam(ssh); #endif ssh_packet_set_log_preamble(ssh, "%suser %s", authctxt->valid ? "authenticating " : "invalid ", user); - setproctitle("%s%s", authctxt->valid ? user : "unknown", - use_privsep ? " [net]" : ""); + setproctitle("%s [net]", authctxt->valid ? user : "unknown"); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; - if (use_privsep) - mm_inform_authserv(service, style); + mm_inform_authserv(service, style); userauth_banner(ssh); if ((r = kex_server_update_ext_info(ssh)) != 0) fatal_fr(r, "kex_server_update_ext_info failed"); @@ -379,7 +377,7 @@ userauth_finish(struct ssh *ssh, int authenticated, const char *packet_method, /* prefer primary authmethod name to possible synonym */ if ((m = authmethod_byname(method)) == NULL) fatal("INTERNAL ERROR: bad method %s", method); - method = m->name; + method = m->cfg->name; } /* Special handling for root */ @@ -387,7 +385,7 @@ userauth_finish(struct ssh *ssh, int authenticated, const char *packet_method, !auth_root_allowed(ssh, method)) { authenticated = 0; #ifdef SSH_AUDIT_EVENTS - PRIVSEP(audit_event(ssh, SSH_LOGIN_ROOT_DENIED)); + mm_audit_event(ssh, SSH_LOGIN_ROOT_DENIED); #endif } @@ -410,7 +408,7 @@ userauth_finish(struct ssh *ssh, int authenticated, const char *packet_method, #ifdef USE_PAM if (options.use_pam && authenticated) { - int r, success = PRIVSEP(do_pam_account()); + int r, success = mm_do_pam_account(); /* If PAM returned a message, send it to the user. */ if (sshbuf_len(loginmsg) > 0) { @@ -448,7 +446,7 @@ userauth_finish(struct ssh *ssh, int authenticated, const char *packet_method, authctxt->failures++; if (authctxt->failures >= options.max_authtries) { #ifdef SSH_AUDIT_EVENTS - PRIVSEP(audit_event(ssh, SSH_LOGIN_EXCEED_MAXTRIES)); + mm_audit_event(ssh, SSH_LOGIN_EXCEED_MAXTRIES); #endif auth_maxtries_exceeded(ssh); } @@ -500,16 +498,16 @@ authmethods_get(Authctxt *authctxt) if ((b = sshbuf_new()) == NULL) fatal_f("sshbuf_new failed"); for (i = 0; authmethods[i] != NULL; i++) { - if (strcmp(authmethods[i]->name, "none") == 0) + if (strcmp(authmethods[i]->cfg->name, "none") == 0) continue; - if (authmethods[i]->enabled == NULL || - *(authmethods[i]->enabled) == 0) + if (authmethods[i]->cfg->enabled == NULL || + *(authmethods[i]->cfg->enabled) == 0) continue; - if (!auth2_method_allowed(authctxt, authmethods[i]->name, + if (!auth2_method_allowed(authctxt, authmethods[i]->cfg->name, NULL)) continue; if ((r = sshbuf_putf(b, "%s%s", sshbuf_len(b) ? "," : "", - authmethods[i]->name)) != 0) + authmethods[i]->cfg->name)) != 0) fatal_fr(r, "buffer error"); } if ((list = sshbuf_dup_string(b)) == NULL) @@ -526,9 +524,9 @@ authmethod_byname(const char *name) if (name == NULL) fatal_f("NULL authentication method name"); for (i = 0; authmethods[i] != NULL; i++) { - if (strcmp(name, authmethods[i]->name) == 0 || - (authmethods[i]->synonym != NULL && - strcmp(name, authmethods[i]->synonym) == 0)) + if (strcmp(name, authmethods[i]->cfg->name) == 0 || + (authmethods[i]->cfg->synonym != NULL && + strcmp(name, authmethods[i]->cfg->synonym) == 0)) return authmethods[i]; } debug_f("unrecognized authentication method name: %s", name); @@ -543,11 +541,11 @@ authmethod_lookup(Authctxt *authctxt, const char *name) if ((method = authmethod_byname(name)) == NULL) return NULL; - if (method->enabled == NULL || *(method->enabled) == 0) { + if (method->cfg->enabled == NULL || *(method->cfg->enabled) == 0) { debug3_f("method %s not enabled", name); return NULL; } - if (!auth2_method_allowed(authctxt, method->name, NULL)) { + if (!auth2_method_allowed(authctxt, method->cfg->name, NULL)) { debug3_f("method %s not allowed " "by AuthenticationMethods", name); return NULL; @@ -555,53 +553,6 @@ authmethod_lookup(Authctxt *authctxt, const char *name) return method; } -/* - * Check a comma-separated list of methods for validity. Is need_enable is - * non-zero, then also require that the methods are enabled. - * Returns 0 on success or -1 if the methods list is invalid. - */ -int -auth2_methods_valid(const char *_methods, int need_enable) -{ - char *methods, *omethods, *method, *p; - u_int i, found; - int ret = -1; - - if (*_methods == '\0') { - error("empty authentication method list"); - return -1; - } - omethods = methods = xstrdup(_methods); - while ((method = strsep(&methods, ",")) != NULL) { - for (found = i = 0; !found && authmethods[i] != NULL; i++) { - if ((p = strchr(method, ':')) != NULL) - *p = '\0'; - if (strcmp(method, authmethods[i]->name) != 0) - continue; - if (need_enable) { - if (authmethods[i]->enabled == NULL || - *(authmethods[i]->enabled) == 0) { - error("Disabled method \"%s\" in " - "AuthenticationMethods list \"%s\"", - method, _methods); - goto out; - } - } - found = 1; - break; - } - if (!found) { - error("Unknown authentication method \"%s\" in list", - method); - goto out; - } - } - ret = 0; - out: - free(omethods); - return ret; -} - /* * Prune the AuthenticationMethods supplied in the configuration, removing * any methods lists that include disabled methods. Note that this might diff --git a/channels.c b/channels.c index ece8d30..a23fde4 100644 --- a/channels.c +++ b/channels.c @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.c,v 1.437 2024/03/06 02:59:59 djm Exp $ */ +/* $OpenBSD: channels.c,v 1.439 2024/07/25 22:40:08 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -93,13 +93,6 @@ /* -- agent forwarding */ #define NUM_SOCKS 10 -/* -- tcp forwarding */ -/* special-case port number meaning allow any port */ -#define FWD_PERMIT_ANY_PORT 0 - -/* special-case wildcard meaning allow any host */ -#define FWD_PERMIT_ANY_HOST "*" - /* -- X11 forwarding */ /* Maximum number of fake X11 displays to try. */ #define MAX_DISPLAYS 1000 @@ -1023,14 +1016,16 @@ channel_format_status(const Channel *c) { char *ret = NULL; - xasprintf(&ret, "t%d [%s] %s%u i%u/%zu o%u/%zu e[%s]/%zu " - "fd %d/%d/%d sock %d cc %d io 0x%02x/0x%02x", + xasprintf(&ret, "t%d [%s] %s%u %s%u i%u/%zu o%u/%zu e[%s]/%zu " + "fd %d/%d/%d sock %d cc %d %s%u io 0x%02x/0x%02x", c->type, c->xctype != NULL ? c->xctype : c->ctype, c->have_remote_id ? "r" : "nr", c->remote_id, + c->mux_ctx != NULL ? "m" : "nm", c->mux_downstream_id, c->istate, sshbuf_len(c->input), c->ostate, sshbuf_len(c->output), channel_format_extended_usage(c), sshbuf_len(c->extended), c->rfd, c->wfd, c->efd, c->sock, c->ctl_chan, + c->have_ctl_child_id ? "c" : "nc", c->ctl_child_id, c->io_want, c->io_ready); return ret; } @@ -4579,19 +4574,6 @@ channel_update_permission(struct ssh *ssh, int idx, int newport) } } -/* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */ -int -permitopen_port(const char *p) -{ - int port; - - if (strcmp(p, "*") == 0) - return FWD_PERMIT_ANY_PORT; - if ((port = a2port(p)) > 0) - return port; - return -1; -} - /* Try to start non-blocking connect to next host in cctx list */ static int connect_next(struct channel_connect *cctx) diff --git a/channels.h b/channels.h index bb2650f..3ac5e83 100644 --- a/channels.h +++ b/channels.h @@ -1,4 +1,4 @@ -/* $OpenBSD: channels.h,v 1.154 2023/12/18 14:47:20 djm Exp $ */ +/* $OpenBSD: channels.h,v 1.157 2024/07/25 22:40:08 djm Exp $ */ /* * Author: Tatu Ylonen @@ -85,7 +85,6 @@ struct ssh; struct Channel; typedef struct Channel Channel; -struct fwd_perm_list; typedef void channel_open_fn(struct ssh *, int, int, void *); typedef void channel_callback_fn(struct ssh *, int, int, void *); @@ -140,6 +139,8 @@ struct Channel { u_int io_ready; /* bitmask of SSH_CHAN_IO_* */ int pfds[4]; /* pollfd entries for rfd/wfd/efd/sock */ int ctl_chan; /* control channel (multiplexed connections) */ + uint32_t ctl_child_id; /* child session for mux controllers */ + int have_ctl_child_id;/* non-zero if ctl_child_id is valid */ int isatty; /* rfd is a tty */ #ifdef _AIX int wfd_isatty; /* wfd is a tty */ @@ -325,7 +326,6 @@ int channel_input_ieof(int, u_int32_t, struct ssh *); int channel_input_oclose(int, u_int32_t, struct ssh *); int channel_input_open_confirmation(int, u_int32_t, struct ssh *); int channel_input_open_failure(int, u_int32_t, struct ssh *); -int channel_input_port_open(int, u_int32_t, struct ssh *); int channel_input_window_adjust(int, u_int32_t, struct ssh *); int channel_input_status_confirm(int, u_int32_t, struct ssh *); diff --git a/cipher.c b/cipher.c index 90b139c..7d6e7d8 100644 --- a/cipher.c +++ b/cipher.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cipher.c,v 1.120 2023/10/10 06:49:54 tb Exp $ */ +/* $OpenBSD: cipher.c,v 1.123 2024/08/23 04:51:00 deraadt Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -143,8 +143,8 @@ const char * compression_alg_list(int compression) { #ifdef WITH_ZLIB - return compression ? "zlib@openssh.com,zlib,none" : - "none,zlib@openssh.com,zlib"; + return compression ? "zlib@openssh.com,none" : + "none,zlib@openssh.com"; #else return "none"; #endif @@ -255,7 +255,7 @@ cipher_init(struct sshcipher_ctx **ccp, const struct sshcipher *cipher, #endif *ccp = NULL; - if ((cc = calloc(sizeof(*cc), 1)) == NULL) + if ((cc = calloc(1, sizeof(*cc))) == NULL) return SSH_ERR_ALLOC_FAIL; cc->plaintext = (cipher->flags & CFLAG_NONE) != 0; @@ -372,7 +372,7 @@ cipher_crypt(struct sshcipher_ctx *cc, u_int seqnr, u_char *dest, if (!EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_IV_GEN, 1, lastiv)) return SSH_ERR_LIBCRYPTO_ERROR; - /* set tag on decyption */ + /* set tag on decryption */ if (!cc->encrypt && !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_SET_TAG, authlen, (u_char *)src + aadlen + len)) diff --git a/clientloop.c b/clientloop.c index 8ec36af..8ed8b1c 100644 --- a/clientloop.c +++ b/clientloop.c @@ -1,4 +1,4 @@ -/* $OpenBSD: clientloop.c,v 1.403 2024/02/21 05:57:34 djm Exp $ */ +/* $OpenBSD: clientloop.c,v 1.408 2024/07/01 04:31:17 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -156,7 +156,6 @@ static time_t control_persist_exit_time = 0; volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */ static int last_was_cr; /* Last character was a newline. */ static int exit_status; /* Used to store the command exit status. */ -static struct sshbuf *stderr_buffer; /* Used for final exit message. */ static int connection_in; /* Connection to server (input). */ static int connection_out; /* Connection to server (output). */ static int need_rekeying; /* Set to non-zero if rekeying is requested. */ @@ -194,24 +193,24 @@ TAILQ_HEAD(global_confirms, global_confirm); static struct global_confirms global_confirms = TAILQ_HEAD_INITIALIZER(global_confirms); -void ssh_process_session2_setup(int, int, int, struct sshbuf *); static void quit_message(const char *fmt, ...) __attribute__((__format__ (printf, 1, 2))); static void quit_message(const char *fmt, ...) { - char *msg; + char *msg, *fmt2; va_list args; - int r; + xasprintf(&fmt2, "%s\r\n", fmt); va_start(args, fmt); - xvasprintf(&msg, fmt, args); + xvasprintf(&msg, fmt2, args); va_end(args); - if ((r = sshbuf_putf(stderr_buffer, "%s\r\n", msg)) != 0) - fatal_fr(r, "sshbuf_putf"); + (void)atomicio(vwrite, STDERR_FILENO, msg, strlen(msg)); free(msg); + free(fmt2); + quit_pending = 1; } @@ -608,8 +607,9 @@ obfuscate_keystroke_timing(struct ssh *ssh, struct timespec *timeout, if (timespeccmp(&now, &chaff_until, >=)) { /* Stop if there have been no keystrokes for a while */ stop_reason = "chaff time expired"; - } else if (timespeccmp(&now, &next_interval, >=)) { - /* Otherwise if we were due to send, then send chaff */ + } else if (timespeccmp(&now, &next_interval, >=) && + !ssh_packet_have_data_to_write(ssh)) { + /* If due to send but have no data, then send chaff */ if (send_chaff(ssh)) nchaff++; } @@ -1446,7 +1446,7 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, struct pollfd *pfd = NULL; u_int npfd_alloc = 0, npfd_active = 0; double start_time, total_time; - int channel_did_enqueue = 0, r, len; + int channel_did_enqueue = 0, r; u_int64_t ibytes, obytes; int conn_in_ready, conn_out_ready; sigset_t bsigset, osigset; @@ -1498,10 +1498,6 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, quit_pending = 0; - /* Initialize buffer. */ - if ((stderr_buffer = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - client_init_dispatch(ssh); /* @@ -1585,7 +1581,7 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, client_wait_until_can_do_something(ssh, &pfd, &npfd_alloc, &npfd_active, channel_did_enqueue, &osigset, &conn_in_ready, &conn_out_ready); - if (sigprocmask(SIG_UNBLOCK, &bsigset, &osigset) == -1) + if (sigprocmask(SIG_SETMASK, &osigset, NULL) == -1) error_f("osigset sigprocmask: %s", strerror(errno)); if (quit_pending) @@ -1632,6 +1628,14 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, /* Terminate the session. */ + /* + * In interactive mode (with pseudo tty) display a message indicating + * that the connection has been closed. + */ + if (have_pty && options.log_level >= SYSLOG_LEVEL_INFO) + quit_message("Connection to %s closed.", host); + + /* Stop watching for window change. */ ssh_signal(SIGWINCH, SIG_DFL); @@ -1664,27 +1668,6 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, cleanup_exit(255); } - /* - * In interactive mode (with pseudo tty) display a message indicating - * that the connection has been closed. - */ - if (have_pty && options.log_level >= SYSLOG_LEVEL_INFO) - quit_message("Connection to %s closed.", host); - - /* Output any buffered data for stderr. */ - if (sshbuf_len(stderr_buffer) > 0) { - len = atomicio(vwrite, fileno(stderr), - (u_char *)sshbuf_ptr(stderr_buffer), - sshbuf_len(stderr_buffer)); - if (len < 0 || (u_int)len != sshbuf_len(stderr_buffer)) - error("Write failed flushing stderr buffer."); - else if ((r = sshbuf_consume(stderr_buffer, len)) != 0) - fatal_fr(r, "sshbuf_consume"); - } - - /* Clear and free any buffers. */ - sshbuf_free(stderr_buffer); - /* Report bytes transferred, and transfer rates. */ total_time = monotime_double() - start_time; ssh_packet_get_bytes(ssh, &ibytes, &obytes); @@ -2441,25 +2424,6 @@ client_global_hostkeys_prove_confirm(struct ssh *ssh, int type, client_repledge(); } -/* - * Returns non-zero if the key is accepted by HostkeyAlgorithms. - * Made slightly less trivial by the multiple RSA signature algorithm names. - */ -static int -key_accepted_by_hostkeyalgs(const struct sshkey *key) -{ - const char *ktype = sshkey_ssh_name(key); - const char *hostkeyalgs = options.hostkeyalgorithms; - - if (key->type == KEY_UNSPEC) - return 0; - if (key->type == KEY_RSA && - (match_pattern_list("rsa-sha2-256", hostkeyalgs, 0) == 1 || - match_pattern_list("rsa-sha2-512", hostkeyalgs, 0) == 1)) - return 1; - return match_pattern_list(ktype, hostkeyalgs, 0) == 1; -} - /* * Handle hostkeys-00@openssh.com global request to inform the client of all * the server's hostkeys. The keys are checked against the user's @@ -2504,7 +2468,7 @@ client_input_hostkeys(struct ssh *ssh) debug3_f("received %s key %s", sshkey_type(key), fp); free(fp); - if (!key_accepted_by_hostkeyalgs(key)) { + if (!hostkey_accepted_by_hostkeyalgs(key)) { debug3_f("%s key not permitted by " "HostkeyAlgorithms", sshkey_ssh_name(key)); continue; diff --git a/clientloop.h b/clientloop.h index 3163055..4bc7bcd 100644 --- a/clientloop.h +++ b/clientloop.h @@ -1,4 +1,4 @@ -/* $OpenBSD: clientloop.h,v 1.37 2020/04/03 02:40:32 djm Exp $ */ +/* $OpenBSD: clientloop.h,v 1.38 2024/05/17 06:42:04 jsg Exp $ */ /* * Author: Tatu Ylonen @@ -43,7 +43,6 @@ struct ssh; int client_loop(struct ssh *, int, int, int); int client_x11_get_proto(struct ssh *, const char *, const char *, u_int, u_int, char **, char **); -void client_global_request_reply_fwd(int, u_int32_t, void *); void client_session2_setup(struct ssh *, int, int, int, const char *, struct termios *, int, struct sshbuf *, char **); char *client_request_tun_fwd(struct ssh *, int, int, int, diff --git a/config.h.in b/config.h.in index 75a2f5a..d4dbb13 100644 --- a/config.h.in +++ b/config.h.in @@ -222,6 +222,12 @@ /* Define to 1 if you have the `aug_get_machine' function. */ #undef HAVE_AUG_GET_MACHINE +/* Define to 1 if you have the `auth_hostok' function. */ +#undef HAVE_AUTH_HOSTOK + +/* Define to 1 if you have the `auth_timeok' function. */ +#undef HAVE_AUTH_TIMEOK + /* Define to 1 if you have the `b64_ntop' function. */ #undef HAVE_B64_NTOP @@ -389,6 +395,14 @@ don't. */ #undef HAVE_DECL_OFFSETOF +/* Define to 1 if you have the declaration of `OPENSSL_IS_BORINGSSL', and to 0 + if you don't. */ +#undef HAVE_DECL_OPENSSL_IS_BORINGSSL + +/* Define to 1 if you have the declaration of `OPENSSL_NO_DSA', and to 0 if + you don't. */ +#undef HAVE_DECL_OPENSSL_NO_DSA + /* Define to 1 if you have the declaration of `O_NONBLOCK', and to 0 if you don't. */ #undef HAVE_DECL_O_NONBLOCK @@ -503,6 +517,12 @@ /* Define to 1 if you have the `EVP_DigestInit_ex' function. */ #undef HAVE_EVP_DIGESTINIT_EX +/* Define to 1 if you have the `EVP_DigestSign' function. */ +#undef HAVE_EVP_DIGESTSIGN + +/* Define to 1 if you have the `EVP_DigestVerify' function. */ +#undef HAVE_EVP_DIGESTVERIFY + /* Define to 1 if you have the `EVP_MD_CTX_cleanup' function. */ #undef HAVE_EVP_MD_CTX_CLEANUP @@ -1909,6 +1929,9 @@ /* syslog_r function is safe to use in in a signal handler */ #undef SYSLOG_R_SAFE_IN_SIGHAND +/* Have sshd notify systemd on start/reload */ +#undef SYSTEMD_NOTIFY + /* Support routing domains using Linux VRF */ #undef SYS_RDOMAIN_LINUX @@ -1963,7 +1986,7 @@ /* Define if you want to enable AIX4's authenticate function */ #undef WITH_AIXAUTHENTICATE -/* Define if to enable DSA keys. */ +/* DSA keys explicitly enabled */ #undef WITH_DSA /* Define if you have/want arrays (cluster-wide session management, not C diff --git a/configure b/configure index f43a58a..f68e94a 100755 --- a/configure +++ b/configure @@ -1467,7 +1467,7 @@ Optional Features: --disable-largefile omit support for large files --disable-pkcs11 disable PKCS#11 support code [no] --disable-security-key disable U2F/FIDO support code no - --disable-dsa-keys disable DSA key support no + --enable-dsa-keys enable DSA key support no --disable-strip Disable calling strip(1) on install --disable-etc-default-login Disable using PATH from /etc/default/login no --disable-fd-passing disable file descriptor passsing no @@ -6143,7 +6143,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6210,7 +6213,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6292,7 +6298,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6359,7 +6368,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6441,7 +6453,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6508,7 +6523,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6590,7 +6608,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6657,7 +6678,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6739,7 +6763,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6806,7 +6833,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6888,7 +6918,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -6955,7 +6988,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7037,7 +7073,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7104,7 +7143,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7186,7 +7228,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7253,7 +7298,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7335,7 +7383,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7402,7 +7453,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7484,7 +7538,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7551,7 +7608,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7633,7 +7693,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7700,7 +7763,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7782,7 +7848,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7849,7 +7918,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7931,7 +8003,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -7998,7 +8073,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8080,7 +8158,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8147,7 +8228,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8229,7 +8313,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8296,7 +8383,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8378,7 +8468,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8445,7 +8538,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8527,7 +8623,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8594,7 +8693,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8676,7 +8778,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8743,7 +8848,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8826,7 +8934,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8893,7 +9004,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -8975,7 +9089,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9043,7 +9160,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9126,7 +9246,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9194,7 +9317,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9277,7 +9403,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9345,7 +9474,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9433,7 +9565,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9500,7 +9635,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9589,7 +9727,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9656,7 +9797,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9740,7 +9884,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9807,7 +9954,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9891,7 +10041,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -9958,7 +10111,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -10042,7 +10198,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -10109,7 +10268,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -10191,7 +10353,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -10259,7 +10424,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -11676,7 +11844,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -11743,7 +11914,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -12215,6 +12389,9 @@ printf "%s\n" "#define _PATH_BTMP \"/var/log/btmp\"" >>confdefs.h printf "%s\n" "#define LINUX_OOM_ADJUST 1" >>confdefs.h + +printf "%s\n" "#define SYSTEMD_NOTIFY 1" >>confdefs.h + inet6_default_4in6=yes case `uname -r` in 1.*|2.0.*) @@ -12529,7 +12706,7 @@ printf "%s\n" "#define SSH_TUN_OPENBSD 1" >>confdefs.h printf "%s\n" "#define SYSLOG_R_SAFE_IN_SIGHAND 1" >>confdefs.h - TEST_MALLOC_OPTIONS="AFGJPRX" + TEST_MALLOC_OPTIONS="SJRU" ;; *-*-solaris*) if test "x$withval" != "xno" ; then @@ -13140,6 +13317,9 @@ EOD printf "%s\n" "#define BROKEN_SETVBUF 1" >>confdefs.h ;; +*-*-gnu*) + CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE" + ;; esac { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking compiler and flags for sanity" >&5 @@ -15367,7 +15547,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -15434,7 +15617,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -15516,7 +15702,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -15584,7 +15773,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { @@ -15686,6 +15878,18 @@ rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext CFLAGS="$SAVED_CFLAGS" +ac_fn_c_check_func "$LINENO" "auth_hostok" "ac_cv_func_auth_hostok" +if test "x$ac_cv_func_auth_hostok" = xyes +then : + printf "%s\n" "#define HAVE_AUTH_HOSTOK 1" >>confdefs.h + +fi +ac_fn_c_check_func "$LINENO" "auth_timeok" "ac_cv_func_auth_timeok" +if test "x$ac_cv_func_auth_timeok" = xyes +then : + printf "%s\n" "#define HAVE_AUTH_TIMEOK 1" >>confdefs.h + +fi ac_fn_c_check_func "$LINENO" "Blowfish_initstate" "ac_cv_func_Blowfish_initstate" if test "x$ac_cv_func_Blowfish_initstate" = xyes then : @@ -16670,22 +16874,18 @@ then : fi -disable_ecdsa= +enable_dsa= # Check whether --enable-dsa-keys was given. if test ${enable_dsa_keys+y} then : enableval=$enable_dsa_keys; - if test "x$enableval" = "xno" ; then - disable_ecdsa=1 + if test "x$enableval" != "xno" ; then + enable_dsa=1 fi fi -test -z "$disable_ecdsa" && - -printf "%s\n" "#define WITH_DSA 1" >>confdefs.h - { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5 printf %s "checking for library containing dlopen... " >&6; } @@ -18589,12 +18789,9 @@ then : *) ;; # Assume all other versions are good. esac ;; - 300*) + 30*) # OpenSSL 3; we use the 1.1x API - CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=0x10100000L" - ;; - 301*|302*|303*) - # OpenSSL development branch; request 1.1x API + # https://openssl.org/policies/general/versioning-policy.html CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=0x10100000L" ;; *) @@ -18762,6 +18959,18 @@ if test "x$ac_cv_func_DSA_generate_parameters_ex" = xyes then : printf "%s\n" "#define HAVE_DSA_GENERATE_PARAMETERS_EX 1" >>confdefs.h +fi +ac_fn_c_check_func "$LINENO" "EVP_DigestSign" "ac_cv_func_EVP_DigestSign" +if test "x$ac_cv_func_EVP_DigestSign" = xyes +then : + printf "%s\n" "#define HAVE_EVP_DIGESTSIGN 1" >>confdefs.h + +fi +ac_fn_c_check_func "$LINENO" "EVP_DigestVerify" "ac_cv_func_EVP_DigestVerify" +if test "x$ac_cv_func_EVP_DigestVerify" = xyes +then : + printf "%s\n" "#define HAVE_EVP_DIGESTVERIFY 1" >>confdefs.h + fi ac_fn_c_check_func "$LINENO" "EVP_DigestFinal_ex" "ac_cv_func_EVP_DigestFinal_ex" if test "x$ac_cv_func_EVP_DigestFinal_ex" = xyes @@ -19235,7 +19444,7 @@ main (void) unsigned char buf[64]; memset(buf, 0, sizeof(buf)); - exit(EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, + exit(EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, NULL, buf, sizeof(buf)) == NULL); ; @@ -19260,6 +19469,56 @@ printf "%s\n" "no" >&6; } fi rm -f core conftest.err conftest.$ac_objext conftest.beam \ conftest$ac_exeext conftest.$ac_ext + + openssl_dsa=no + if test ! -z "$enable_dsa" ; then + ac_fn_check_decl "$LINENO" "OPENSSL_NO_DSA" "ac_cv_have_decl_OPENSSL_NO_DSA" " #include + +" "$ac_c_undeclared_builtin_options" "CFLAGS" +if test "x$ac_cv_have_decl_OPENSSL_NO_DSA" = xyes +then : + ac_have_decl=1 +else $as_nop + ac_have_decl=0 +fi +printf "%s\n" "#define HAVE_DECL_OPENSSL_NO_DSA $ac_have_decl" >>confdefs.h +if test $ac_have_decl = 1 +then : + +else $as_nop + + ac_fn_check_decl "$LINENO" "OPENSSL_IS_BORINGSSL" "ac_cv_have_decl_OPENSSL_IS_BORINGSSL" " #include + +" "$ac_c_undeclared_builtin_options" "CFLAGS" +if test "x$ac_cv_have_decl_OPENSSL_IS_BORINGSSL" = xyes +then : + ac_have_decl=1 +else $as_nop + ac_have_decl=0 +fi +printf "%s\n" "#define HAVE_DECL_OPENSSL_IS_BORINGSSL $ac_have_decl" >>confdefs.h +if test $ac_have_decl = 1 +then : + +else $as_nop + openssl_dsa=yes +fi + + +fi + + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to enable DSA key support" >&5 +printf %s "checking whether to enable DSA key support... " >&6; } + if test "x$openssl_dsa" = "xno"; then + as_fn_error $? "DSA requested but not supported by OpenSSL" "$LINENO" 5 + else + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +printf "%s\n" "yes" >&6; } + +printf "%s\n" "#define WITH_DSA 1" >>confdefs.h + + fi + fi fi # PKCS11/U2F depend on OpenSSL and dlopen(). diff --git a/configure.ac b/configure.ac index 82e8bb7..591d5a3 100644 --- a/configure.ac +++ b/configure.ac @@ -915,6 +915,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts]) AC_DEFINE([USE_BTMP]) AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer]) + AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload]) inet6_default_4in6=yes case `uname -r` in 1.*|2.0.*) @@ -1092,7 +1093,7 @@ mips-sony-bsd|mips-sony-newsos4) AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way]) AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1], [syslog_r function is safe to use in in a signal handler]) - TEST_MALLOC_OPTIONS="AFGJPRX" + TEST_MALLOC_OPTIONS="SJRU" ;; *-*-solaris*) if test "x$withval" != "xno" ; then @@ -1347,6 +1348,13 @@ EOD AC_DEFINE([BROKEN_SETVBUF], [1], [LynxOS has broken setvbuf() implementation]) ;; +*-*-gnu*) + dnl GNU Hurd. Needs to be after the linux and the other *-gnu entries. + dnl Target SUSv3/POSIX.1-2001 plus BSD specifics. + dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE + dnl _GNU_SOURCE is needed for setres*id prototypes. + CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE" + ;; esac AC_MSG_CHECKING([compiler and flags for sanity]) @@ -1878,6 +1886,8 @@ AC_SUBST([PICFLAG]) dnl Checks for library functions. Please keep in alphabetical order AC_CHECK_FUNCS([ \ + auth_hostok \ + auth_timeok \ Blowfish_initstate \ Blowfish_expandstate \ Blowfish_expand0state \ @@ -2075,17 +2085,15 @@ AC_ARG_WITH([security-key-builtin], [ enable_sk_internal=$withval ] ) -disable_ecdsa= +enable_dsa= AC_ARG_ENABLE([dsa-keys], - [ --disable-dsa-keys disable DSA key support [no]], + [ --enable-dsa-keys enable DSA key support [no]], [ - if test "x$enableval" = "xno" ; then - disable_ecdsa=1 + if test "x$enableval" != "xno" ; then + enable_dsa=1 fi ] ) -test -z "$disable_ecdsa" && - AC_DEFINE([WITH_DSA], [1], [Define if to enable DSA keys.]) AC_SEARCH_LIBS([dlopen], [dl]) AC_CHECK_FUNCS([dlopen]) @@ -2883,12 +2891,9 @@ if test "x$openssl" = "xyes" ; then *) ;; # Assume all other versions are good. esac ;; - 300*) + 30*) # OpenSSL 3; we use the 1.1x API - CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=0x10100000L" - ;; - 301*|302*|303*) - # OpenSSL development branch; request 1.1x API + # https://openssl.org/policies/general/versioning-policy.html CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=0x10100000L" ;; *) @@ -2978,6 +2983,8 @@ if test "x$openssl" = "xyes" ; then BN_is_prime_ex \ DES_crypt \ DSA_generate_parameters_ex \ + EVP_DigestSign \ + EVP_DigestVerify \ EVP_DigestFinal_ex \ EVP_DigestInit_ex \ EVP_MD_CTX_cleanup \ @@ -3184,7 +3191,7 @@ if test "x$openssl" = "xyes" ; then ]], [[ unsigned char buf[64]; memset(buf, 0, sizeof(buf)); - exit(EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, + exit(EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, NULL, buf, sizeof(buf)) == NULL); ]])], [ @@ -3196,6 +3203,26 @@ if test "x$openssl" = "xyes" ; then AC_MSG_RESULT([no]) ] ) + + openssl_dsa=no + if test ! -z "$enable_dsa" ; then + AC_CHECK_DECLS([OPENSSL_NO_DSA], [], [ + AC_CHECK_DECLS([OPENSSL_IS_BORINGSSL], [], + [ openssl_dsa=yes ], + [ #include ] + ) + ], + [ #include ] + ) + AC_MSG_CHECKING([whether to enable DSA key support]) + if test "x$openssl_dsa" = "xno"; then + AC_MSG_ERROR([DSA requested but not supported by OpenSSL]) + else + AC_MSG_RESULT([yes]) + AC_DEFINE([WITH_DSA], [1], + [DSA keys explicitly enabled]) + fi + fi fi # PKCS11/U2F depend on OpenSSL and dlopen(). diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec index b230971..802d64d 100644 --- a/contrib/redhat/openssh.spec +++ b/contrib/redhat/openssh.spec @@ -1,4 +1,4 @@ -%global ver 9.7p1 +%global ver 9.9p1 %global rel 1%{?dist} # OpenSSH privilege separation requires a user & group ID @@ -33,10 +33,10 @@ %global without_openssl 0 # build without openssl where 1.1.1 is not available -%if 0%{?fedora} <= 28 +%if %{defined fedora} && 0%{?fedora} <= 28 %global without_openssl 1 %endif -%if 0%{?rhel} <= 7 +%if %{defined rhel} && 0%{?rhel} <= 7 %global without_openssl 1 %endif @@ -393,6 +393,7 @@ fi %defattr(-,root,root) %dir %attr(0111,root,root) %{_var}/empty/sshd %attr(0755,root,root) %{_sbindir}/sshd +%attr(0755,root,root) %{_libexecdir}/openssh/sshd-session %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server %attr(0644,root,root) %{_mandir}/man8/sshd.8* %attr(0644,root,root) %{_mandir}/man5/moduli.5* diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id index da6bd18..dcf5798 100644 --- a/contrib/ssh-copy-id +++ b/contrib/ssh-copy-id @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (c) 1999-2023 Philip Hands +# Copyright (c) 1999-2024 Philip Hands # 2021 Carlos Rodríguez Gili # 2020 Matthias Blümel # 2017 Sebastien Boyron @@ -56,19 +56,19 @@ then a bug describing your setup, and the shell you used to make it work. EOF - printf '%s: ERROR: Less dimwitted shell required.\n' "$0" + printf '%s: ERROR: Less dimwitted shell required.\n' "$0" >&2 exit 1 fi fi # shellcheck disable=SC2010 -DEFAULT_PUB_ID_FILE=$(ls -t "${HOME}"/.ssh/id*.pub 2>/dev/null | grep -v -- '-cert.pub$' | head -n 1) +DEFAULT_PUB_ID_FILE=$(ls -dt "${HOME}"/.ssh/id*.pub 2>/dev/null | grep -v -- '-cert.pub$' | head -n 1) SSH="ssh -a -x" TARGET_PATH=".ssh/authorized_keys" umask 0177 usage () { - printf 'Usage: %s [-h|-?|-f|-n|-s|-x] [-i [identity_file]] [-p port] [-F alternative ssh_config file] [-t target_path] [[-o ] ...] [user@]hostname\n' "$0" >&2 + printf 'Usage: %s [-h|-?|-f|-n|-s|-x] [-i [identity_file]] [-t target_path] [-F ssh_config] [[-o ssh_option] ...] [-p port] [user@]hostname\n' "$0" >&2 printf '\t-f: force mode -- copy keys without trying to check if they are already installed\n' >&2 printf '\t-n: dry run -- no keys are actually copied\n' >&2 printf '\t-s: use sftp -- use sftp instead of executing remote-commands. Can be useful if the remote only allows sftp\n' >&2 @@ -86,7 +86,7 @@ use_id_file() { L_ID_FILE="$1" if [ -z "$L_ID_FILE" ] ; then - printf '%s: ERROR: no ID file found\n' "$0" + printf '%s: ERROR: no ID file found\n' "$0" >&2 exit 1 fi @@ -103,11 +103,10 @@ use_id_file() { ErrMSG=$( { : < "$f" ; } 2>&1 ) || { L_PRIVMSG="" [ "$f" = "$PRIV_ID_FILE" ] && L_PRIVMSG=" (to install the contents of '$PUB_ID_FILE' anyway, look at the -f option)" - printf "\\n%s: ERROR: failed to open ID file '%s': %s\\n" "$0" "$f" "$(printf '%s\n%s\n' "$ErrMSG" "$L_PRIVMSG" | sed -e 's/.*: *//')" + printf "\\n%s: ERROR: failed to open ID file '%s': %s\\n" "$0" "$f" "$(printf '%s\n%s\n' "$ErrMSG" "$L_PRIVMSG" | sed -e 's/.*: *//')" >&2 exit 1 } done - printf '%s: INFO: Source of key(s) to be installed: "%s"\n' "$0" "$PUB_ID_FILE" >&2 GET_ID="cat \"$PUB_ID_FILE\"" } @@ -115,15 +114,31 @@ if [ -n "$SSH_AUTH_SOCK" ] && ssh-add -L >/dev/null 2>&1 ; then GET_ID="ssh-add -L" fi -while getopts "i:o:p:F:t:fnsxh?" OPT +OPTS="io:p:F:t:fnsxh?" + +while getopts "$OPTS" OPT do case "$OPT" in i) [ "${SEEN_OPT_I}" ] && { - printf '\n%s: ERROR: -i option must not be specified more than once\n\n' "$0" + printf '\n%s: ERROR: -i option must not be specified more than once\n\n' "$0" >&2 usage } SEEN_OPT_I="yes" + + # Check for -i's optional parameter + eval "nextarg=\${$OPTIND}" + # shellcheck disable=SC2154 + if [ $OPTIND = $# ]; then + if [ -r "$nextarg" ] && grep -iq ssh "$nextarg"; then + printf '\n%s: ERROR: Missing hostname. Use "-i -- %s" if you really mean to use this as the hostname\n\n' "$0" "$nextarg" >&2 + usage + fi + elif ! expr -- "$nextarg" : "-[$(echo "$OPTS" | tr -d :)-]" >/dev/null ; then + # when not at the last arg, and not followed by an option, -i has an argument + OPTARG="$nextarg" + OPTIND=$((OPTIND + 1)) + fi use_id_file "${OPTARG:-$DEFAULT_PUB_ID_FILE}" ;; o|F) @@ -176,16 +191,28 @@ if [ -z "$(eval $GET_ID)" ] && [ -r "${PUB_ID_FILE:=$DEFAULT_PUB_ID_FILE}" ] ; t use_id_file "$PUB_ID_FILE" fi +printf '%s: INFO: Source of key(s) to be installed: %s\n' "$0" "${GET_ID#cat }" >&2 + # shellcheck disable=SC2086 if [ -z "$(eval $GET_ID)" ] ; then printf '%s: ERROR: No identities found\n' "$0" >&2 exit 1 fi +# assert_scratch_ok() +# ensures that $SCRATCH_DIR is setup. +assert_scratch_ok() { + [ "$SCRATCH_DIR" ] && [ -d "$SCRATCH_DIR" ] && [ -w "$SCRATCH_DIR" ] && return 0 + + printf 'ERROR: Assertion failure: in %s(): scratch_dir was not correctly set up (SCRATCH_DIR = "%s")\n' "$1" "$SCRATCH_DIR" >&2 + return 1 +} + # filter_ids() # tries to log in using the keys piped to it, and filters out any that work filter_ids() { L_SUCCESS="$1" + assert_scratch_ok filter_ids || return L_TMP_ID_FILE="$SCRATCH_DIR"/popids_tmp_id L_OUTPUT_FILE="$SCRATCH_DIR"/popids_output @@ -288,23 +315,24 @@ installkeys_via_sftp() { # repopulate "$@" inside this function eval set -- "$SSH_OPTS" - L_KEYS=$SCRATCH_DIR/authorized_keys - L_SHARED_CON=$SCRATCH_DIR/master-conn + assert_scratch_ok installkeys_via_sftp || return 1 + L_KEYS="$SCRATCH_DIR"/authorized_keys + L_SHARED_CON="$SCRATCH_DIR"/master-conn $SSH -f -N -M -S "$L_SHARED_CON" "$@" - L_CLEANUP="$SSH -S $L_SHARED_CON -O exit 'ignored' >/dev/null 2>&1 ; $SCRATCH_CLEANUP" + L_CLEANUP="$SSH -S '$L_SHARED_CON' -O exit 'ignored' >/dev/null 2>&1 ; $SCRATCH_CLEANUP" #shellcheck disable=SC2064 trap "$L_CLEANUP" EXIT TERM INT QUIT - sftp -b - -o "ControlPath=$L_SHARED_CON" "ignored" <<-EOF || return 1 + sftp -b - -o "ControlPath='$L_SHARED_CON'" "ignored" <<-EOF || return 1 -get "$AUTH_KEY_FILE" "$L_KEYS" EOF # add a newline or create file if it's missing, same like above [ -z "$(tail -1c "$L_KEYS" 2>/dev/null)" ] || echo >> "$L_KEYS" # append the keys being piped in here cat >> "$L_KEYS" - sftp -b - -o "ControlPath=$L_SHARED_CON" "ignored" <<-EOF || return 1 + sftp -b - -o "ControlPath='$L_SHARED_CON'" "ignored" <<-EOF || return 1 -mkdir "$AUTH_KEY_DIR" chmod 700 "$AUTH_KEY_DIR" - put $L_KEYS "$AUTH_KEY_FILE" + put "$L_KEYS" "$AUTH_KEY_FILE" chmod 600 "$AUTH_KEY_FILE" EOF #shellcheck disable=SC2064 @@ -321,7 +349,7 @@ then #shellcheck disable=SC2064 trap "$SCRATCH_CLEANUP" EXIT TERM INT QUIT else - printf '%s: ERROR: failed to create required temporary directory under ~/.ssh\n' "$0" >&2 + printf '%s: ERROR: failed to create required temporary directory under ~/.ssh (HOME="%s")\n' "$0" "$HOME" >&2 exit 1 fi @@ -379,7 +407,7 @@ else Number of key(s) added: $ADDED - Now try logging into the machine, with: "${SFTP:-ssh}${SSH_PORT:+ -${PORT_OPT:-p} $SSH_PORT} ${OPTS_USER_HOST}" + Now try logging into the machine, with: "${SFTP:-ssh} ${SEEN_OPT_I:+-i${PRIV_ID_FILE:+ $PRIV_ID_FILE} }${SSH_PORT:+-${PORT_OPT:-p} $SSH_PORT }${OPTS_USER_HOST}" and check to make sure that only the key(s) you wanted were added. EOF diff --git a/contrib/ssh-copy-id.1 b/contrib/ssh-copy-id.1 index 74eec2f..dbdb45a 100644 --- a/contrib/ssh-copy-id.1 +++ b/contrib/ssh-copy-id.1 @@ -1,5 +1,5 @@ .ig \" -*- nroff -*- -Copyright (c) 1999-2023 hands.com Ltd. +Copyright (c) 1999-2024 Philip Hands Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -34,9 +34,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .Op Fl s .Op Fl x .Op Fl i Op Ar identity_file -.Op Fl p Ar port -.Op Fl o Ar ssh_option .Op Fl t Ar target_path +.Op Fl F Ar ssh_config +.Op Bo Fl o Ar ssh_option Bc ... +.Op Fl p Ar port .Op Ar user Ns @ Ns .Ar hostname .Nm @@ -67,7 +68,7 @@ command instead. .Pp The options are as follows: .Bl -tag -width Ds -.It Fl i Ar identity_file +.It Fl i Op Ar identity_file Use only the key(s) contained in .Ar identity_file (rather than looking for identities via @@ -104,11 +105,13 @@ on commands which can be used on the remote side. .It Fl t Ar target_path the path on the target system where the keys should be added (defaults to ".ssh/authorized_keys") -.It Fl p Ar port , Fl o Ar ssh_option -These two options are simply passed through untouched, along with their -argument, to allow one to set the port or other -.Xr ssh 1 -options, respectively. +.It Fl p Ar port +Specifies the port to connect to on the remote host. +.It Fl F Ar ssh_config , Fl o Ar ssh_option +These options are simply passed through untouched (with their argument) +to ssh/sftp, +allowing one to set an alternative config file, +or other options, respectively. .Pp Rather than specifying these as command line options, it is often better to use (per-host) settings in diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec index 7dbe4db..0755833 100644 --- a/contrib/suse/openssh.spec +++ b/contrib/suse/openssh.spec @@ -13,7 +13,7 @@ Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation Name: openssh -Version: 9.7p1 +Version: 9.9p1 URL: https://www.openssh.com/ Release: 1 Source0: openssh-%{version}.tar.gz @@ -211,6 +211,7 @@ rm -rf $RPM_BUILD_ROOT %attr(0755,root,root) %{_sbindir}/sshd %attr(0755,root,root) %dir %{_libdir}/ssh %attr(0755,root,root) %{_libdir}/ssh/sftp-server +%attr(0755,root,root) %{_libdir}/ssh/sshd-session %attr(4711,root,root) %{_libdir}/ssh/ssh-keysign %attr(0755,root,root) %{_libdir}/ssh/ssh-pkcs11-helper %attr(0755,root,root) %{_libdir}/ssh/ssh-sk-helper diff --git a/crypto_api.h b/crypto_api.h index 5d552ef..8bbc3a0 100644 --- a/crypto_api.h +++ b/crypto_api.h @@ -1,4 +1,4 @@ -/* $OpenBSD: crypto_api.h,v 1.8 2023/01/15 23:05:32 djm Exp $ */ +/* $OpenBSD: crypto_api.h,v 1.9 2024/09/02 12:13:56 djm Exp $ */ /* * Assembled from generated headers and source files by Markus Friedl. @@ -53,4 +53,9 @@ int crypto_kem_sntrup761_dec(unsigned char *k, const unsigned char *cstr, const unsigned char *sk); int crypto_kem_sntrup761_keypair(unsigned char *pk, unsigned char *sk); +#define crypto_kem_mlkem768_PUBLICKEYBYTES 1184 +#define crypto_kem_mlkem768_SECRETKEYBYTES 2400 +#define crypto_kem_mlkem768_CIPHERTEXTBYTES 1088 +#define crypto_kem_mlkem768_BYTES 32 + #endif /* crypto_api_h */ diff --git a/debian/.git-dpm b/debian/.git-dpm index c9f38ee..ca05761 100644 --- a/debian/.git-dpm +++ b/debian/.git-dpm @@ -1,12 +1,12 @@ # see git-dpm(1) from git-dpm package -1506d4bbf5fa2d7a3d2f8ae77914dd46b10c40ea -1506d4bbf5fa2d7a3d2f8ae77914dd46b10c40ea -cf05e8418c088a6e5712344cecaf6ee2d5eb550f -cf05e8418c088a6e5712344cecaf6ee2d5eb550f -openssh_9.7p1.orig.tar.gz -ce8985ea0ea2f16a5917fd982ade0972848373cc -1848766 +b966dccd427fba8f70e77cb1bed10e8f7393b3e3 +b966dccd427fba8f70e77cb1bed10e8f7393b3e3 +7721b4ff7705034e809e2130d1a11be2bf42dbe9 +7721b4ff7705034e809e2130d1a11be2bf42dbe9 +openssh_9.9p1.orig.tar.gz +5ded7eb0add0b02b5d1a1c4bf5cb2c89d2117b53 +1964864 debianTag="debian/%e%%%V" patchedTag="patched/%e%%%V" upstreamTag="upstream/%U" -signature:6848845450c5d5776afd10f8217f870d320cc4d5:833:openssh_9.7p1.orig.tar.gz.asc +signature:6f100e4757e1942d7b5e01310fcaf624b71f6740:833:openssh_9.9p1.orig.tar.gz.asc diff --git a/debian/NEWS b/debian/NEWS index 4e3b2ee..2ed0d9c 100644 --- a/debian/NEWS +++ b/debian/NEWS @@ -1,3 +1,105 @@ +openssh (1:9.9p1-1) unstable; urgency=medium + + OpenSSH 9.9p1 includes a number of changes that may affect existing + configurations: + + * ssh(1): remove support for pre-authentication compression. OpenSSH has + only supported post-authentication compression in the server for some + years. Compression before authentication significantly increases the + attack surface of SSH servers and risks creating oracles that reveal + information about information sent during authentication. + + * ssh(1), sshd(8): processing of the arguments to the "Match" + configuration directive now follows more shell-like rules for quoted + strings, including allowing nested quotes and \-escaped characters. If + configurations contained workarounds for the previous simplistic quote + handling then they may need to be adjusted. If this is the case, it's + most likely to be in the arguments to a "Match exec" condition. In this + case, moving the command to be evaluated from the Match line to an + external shell script is the easiest way to preserve compatibility with + both the old and new versions. + + -- Colin Watson Mon, 23 Sep 2024 21:09:59 -0700 + +openssh (1:9.8p1-5) unstable; urgency=medium + + Future Debian releases will remove GSS-API authentication and key exchange + support from openssh-client and openssh-server; this adds + pre-authentication attack surface and should only be used where + specifically needed. Users of GSS-API authentication or key exchange + should install the new openssh-client-gssapi or openssh-server-gssapi + package now; these currently just depend on openssh-client and + openssh-server respectively, but this will change in the future. + + -- Colin Watson Thu, 29 Aug 2024 12:13:32 +0100 + +openssh (1:9.8p1-1) unstable; urgency=medium + + OpenSSH 9.8p1 includes a number of changes that may affect existing + configurations: + + * DSA keys, as specified in the SSH protocol, are inherently weak: they + are limited to 160-bit private keys and the SHA-1 digest. The SSH + implementation provided by the openssh-client and openssh-server + packages has disabled support for DSA keys by default since OpenSSH + 7.0p1 in 2015, released with Debian 9 ("stretch"), although it could + still be enabled using the HostKeyAlgorithms and + PubkeyAcceptedAlgorithms configuration options for host and user keys + respectively. + + The only remaining uses of DSA at this point should be connecting to + some very old devices. For all other purposes, the other key types + supported by OpenSSH (RSA, ECDSA, and Ed25519) are superior. + + As of OpenSSH 9.8p1, DSA keys are no longer supported even with the + above configuration options. If you have a device that you can only + connect to using DSA, then you can use the ssh1 command provided by the + openssh-client-ssh1 package to do so. + + In the unlikely event that you are still using DSA keys to connect to a + Debian server (if you are unsure, you can check by adding the -v option + to the ssh command line you use to connect to that server and looking + for the "Server accepts key:" line), then you must generate replacement + keys before upgrading. + + * sshd(8): the server will now block client addresses that repeatedly + fail authentication, repeatedly connect without ever completing + authentication or that crash the server. Operators of servers that + accept connections from many users, or servers that accept connections + from addresses behind NAT or proxies may need to consider these + settings. + + * sshd(8): several log messages have changed. In particular, some log + messages will be tagged with as originating from a process named + "sshd-session" rather than "sshd". + + * ssh-keyscan(1): this tool previously emitted comment lines containing + the hostname and SSH protocol banner to standard error. This release + now emits them to standard output, but adds a new "-q" flag to silence + them altogether. + + * sshd(8): sshd will no longer use argv[0] as the PAM service name. A + new "PAMServiceName" sshd_config(5) directive allows selecting the + service name at runtime. This defaults to "sshd". + + -- Colin Watson Wed, 31 Jul 2024 17:16:04 +0100 + +openssh (1:9.7p1-6) unstable; urgency=medium + + Debian's PAM configuration for OpenSSH no longer reads the + ~/.pam_environment file. The implementation of this in pam_env has a + history of security problems and has been deprecated by the upstream + Linux-PAM maintainers due to the possibility that "user supplied + environment variables in the PAM environment could affect behavior of + subsequent modules in the stack without the consent of the system + administrator". + + Instead, environment variables need to be set somewhere that will be + handled by the session process; for most users, this will be shell + initialization files such as ~/.bash_profile or ~/.bashrc. + + -- Colin Watson Tue, 25 Jun 2024 14:20:44 +0100 + openssh (1:9.5p1-1) experimental; urgency=medium OpenSSH 9.5p1 includes a number of changes that may affect existing @@ -225,7 +327,7 @@ openssh (1:8.4p1-1) unstable; urgency=medium * ssh-keygen(1): the format of the attestation information optionally recorded when a FIDO key is generated has changed. It now includes the - authenticator data needed to validate attestation signatures. + authenticator data needed to validate attestation signatures. * The API between OpenSSH and the FIDO token middleware has changed and the SSH_SK_VERSION_MAJOR version has been incremented as a result. diff --git a/debian/README.Debian b/debian/README.Debian index 6aab9cb..32b535f 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -209,6 +209,7 @@ follows (modifying ListenStream to match your requirements): mkdir -p /etc/systemd/system/ssh.socket.d cat >/etc/systemd/system/ssh.socket.d/listen.conf < Fri, 08 Nov 2024 09:19:57 +0800 - -openssh (1:9.7p1-4deepin2) unstable; urgency=high +openssh (1:9.9p1-3) unstable; urgency=medium + + * Fix mlkem768x25519-sha256 key exchange algorithm on big-endian + architectures. + * Drop patch to define MAXHOSTNAMELEN on GNU/Hurd (no longer needed). + + -- Colin Watson Sun, 27 Oct 2024 13:58:04 +0000 + +openssh (1:9.9p1-2) unstable; urgency=medium + + * Don't prefer host-bound public key signatures if there was no initial + host key, as is the case when using GSS-API key exchange (closes: + #1041521). + * Use runuser rather than sudo in autopkgtests where possible, avoiding a + dependency. + + -- Colin Watson Mon, 21 Oct 2024 18:24:07 +0100 + +openssh (1:9.9p1-1) unstable; urgency=medium + + * Alias the old Debian-specific SetupTimeOut client option to + ConnectTimeout rather than to ServerAliveInterval. + * New upstream release (https://www.openssh.com/releasenotes.html#9.9p1): + - ssh(1): remove support for pre-authentication compression. + - ssh(1), sshd(8): processing of the arguments to the "Match" + configuration directive now follows more shell-like rules for quoted + strings, including allowing nested quotes and \-escaped characters. + - ssh(1), sshd(8): add support for a new hybrid post-quantum key + exchange based on the FIPS 203 Module-Lattice Key Enapsulation + mechanism (ML-KEM) combined with X25519 ECDH as described by + https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 + This algorithm "mlkem768x25519-sha256" is available by default. + - ssh(1): the ssh_config "Include" directive can now expand environment + as well as the same set of %-tokens "Match Exec" supports. + - sshd(8): add a sshd_config "RefuseConnection" option that, if set will + terminate the connection at the first authentication request. + - sshd(8): add a "refuseconnection" penalty class to sshd_config + PerSourcePenalties that is applied when a connection is dropped by the + new RefuseConnection keyword. + - sshd(8): add a "Match invalid-user" predicate to sshd_config Match + options that matches when the target username is not valid on the + server. + - ssh(1), sshd(8): update the Streamlined NTRUPrime code to a + substantially faster implementation. + - ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange + algorithm now has an IANA-assigned name in addition to the + "@openssh.com" vendor extension name. This algorithm is now also + available under this name "sntrup761x25519-sha512" + - ssh(1), sshd(8), ssh-agent(1): prevent private keys from being + included in core dump files for most of their lifespans. This is in + addition to pre-existing controls in ssh-agent(1) and sshd(8) that + prevented coredumps. + - All: convert key handling to use the libcrypto EVP_PKEY API, with the + exception of DSA. + - sshd(8): add a random amount of jitter (up to 4 seconds) to the grace + login time to make its expiry unpredictable. + - sshd(8): fix regression introduced in openssh-9.8 that swapped the + order of source and destination addresses in some sshd log messages. + - sshd(8): do not apply authorized_keys options when signature + verification fails. Prevents more restrictive key options being + incorrectly applied to subsequent keys in authorized_keys. + - ssh-keygen(1): include pathname in some of ssh-keygen's passphrase + prompts. Helps the user know what's going on when ssh-keygen is + invoked via other tools. + - ssh(1), ssh-add(1): make parsing user@host consistently look for the + last '@' in the string rather than the first. This makes it possible + to more consistently use usernames that contain '@' characters. + - ssh(1), sshd(8): be more strict in parsing key type names. Only allow + short names (e.g "rsa") in user-interface code and require full SSH + protocol names (e.g. "ssh-rsa") everywhere else. + - regress: many performance and correctness improvements to the + re-keying regression test. + - ssh-keygen(1): clarify that ed25519 is the default key type generated + and clarify that rsa-sha2-512 is the default signature scheme when RSA + is in use. + - sshd(8): fix minor memory leak in Subsystem option parsing. + - All: additional hardening and consistency checks for the sshbuf code. + - sshd(8): reduce default logingrace penalty to ensure that a single + forgotten login that times out will be below the penalty threshold. + - ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with + ControlPersist then later has a forwarding added using mux proxy + connection and the forwarding was used, then when the mux proxy + session terminated, the mux master process would issue a bad message + that terminated the connection. + - Sync contrib/ssh-copy-id to the latest upstream version. + - sshd(8): restore audit call before exit that regressed in openssh-9.8. + Fixes an issue where the SSH_CONNECTION_ABANDON event was not + recorded. + - Fix detection of setres*id on GNU/Hurd. + + -- Colin Watson Mon, 23 Sep 2024 21:09:59 -0700 + +openssh (1:9.8p1-8) unstable; urgency=medium + + * Source-only reupload. + + -- Colin Watson Fri, 30 Aug 2024 00:38:26 +0100 + +openssh (1:9.8p1-7) unstable; urgency=medium + + * Adjust description line-wrapping so that lintian recognizes that + openssh-client-gssapi is an intentionally empty package. + + -- Colin Watson Thu, 29 Aug 2024 14:17:13 +0100 + +openssh (1:9.8p1-6) unstable; urgency=medium + + * Upload with binaries to satisfy Debian archive NEW checks. + + -- Colin Watson Thu, 29 Aug 2024 13:46:57 +0100 + +openssh (1:9.8p1-5) unstable; urgency=medium + + * Add openssh-client-gssapi and openssh-server-gssapi packages; these + currently just depend on their non-gssapi counterparts, but will become + different in future. See + https://lists.debian.org/debian-devel/2024/04/msg00044.html. + + -- Colin Watson Thu, 29 Aug 2024 12:53:42 +0100 + +openssh (1:9.8p1-4) unstable; urgency=medium + + [ Grzegorz Szymaszek ] + * Disable listening on 22 in the port change example in README.Debian. - * Disable logging in sshsigdie. - https://seclists.org/oss-sec/2024/q3/2 + [ Colin Watson ] + * sshd: Allow exec without absolute path in inetd mode (closes: #1078429). + * Add an autopkgtest for running sshd from xinetd. + + -- Colin Watson Mon, 26 Aug 2024 15:02:45 +0100 + +openssh (1:9.8p1-3) unstable; urgency=medium + + [ Dirk Van Haerenborgh ] + * Add sshd-session to openssh-server-udeb. + + -- Colin Watson Tue, 06 Aug 2024 12:58:46 +0100 + +openssh (1:9.8p1-2) unstable; urgency=medium + + * Don't close sockets passed by systemd socket activation (closes: + #1077765). + * Add an autopkgtest for socket activation. + * Consult /etc/hosts.{allow,deny} as "sshd", not "sshd-session" (closes: + #1077799). + + -- Colin Watson Fri, 02 Aug 2024 17:08:58 +0100 + +openssh (1:9.8p1-1) unstable; urgency=medium + + * New upstream release (https://www.openssh.com/releasenotes.html#9.8p1): + - CVE-2024-39894: Fix Logic error in ssh(1) ObscureKeystrokeTiming that + made the feature ineffective. + - The DSA signature algorithm is now disabled at compile-time. + - sshd(8): the server has been split into a listener binary, sshd(8), + and a per-session binary "sshd-session". This allows for a much + smaller listener binary, as it no longer needs to support the SSH + protocol. As part of this work, support for disabling privilege + separation (which previously required code changes to disable) and + disabling re-execution of sshd(8) has been removed. Further + separation of sshd-session into additional, minimal binaries is + planned for the future. + - sshd(8): several log messages have changed. In particular, some log + messages will be tagged with as originating from a process named + "sshd-session" rather than "sshd". + - ssh-keyscan(1): this tool previously emitted comment lines containing + the hostname and SSH protocol banner to standard error. This release + now emits them to standard output, but adds a new "-q" flag to silence + them altogether. + - sshd(8): sshd will no longer use argv[0] as the PAM service name. A + new "PAMServiceName" sshd_config(5) directive allows selecting the + service name at runtime. This defaults to "sshd". + - sshd(8): penalise client addresses that, for various reasons, do not + successfully complete authentication. This feature is controlled by a + new sshd_config(5) PerSourcePenalties option and is on by default. + - ssh(8): allow the HostkeyAlgorithms directive to disable the implicit + fallback from certificate host key to plain host keys. + - misc: fix a number of inaccuracies in the PROTOCOL.* documentation + files. + - all: switch to strtonum(3) for more robust integer parsing in most + places. + - ssh(1), sshd(8): correctly restore sigprocmask around ppoll(). + - ssh-keysign(8): stricter validation of messaging socket fd. + - sftp(1): flush stdout after writing "sftp>" prompt when not using + editline. + - sftp-server(8): fix home-directory extension implementation, it + previously always returned the current user's home directory contrary + to the spec. + - ssh-keyscan(1): do not close stdin to prevent error messages when + stdin is read multiple times. + - regression tests: fix rekey test that was testing the same KEX + algorithm repeatedly instead of testing all of them. + - ssh_config(5), sshd_config(5): clarify the KEXAlgorithms directive + documentation, especially around what is supported vs available + (closes: #1073065). + - sshd(8): expose SSH_AUTH_INFO_0 always to PAM auth modules + unconditionally. The previous behaviour was to expose it only when + particular authentication methods were in use. + - build: fix OpenSSL ED25519 support detection. An incorrect function + signature in configure.ac previously prevented enabling the recently + added support for ED25519 private keys in PEM PKCS8 format. + - ssh(1), ssh-agent(8): allow the presence of the WAYLAND_DISPLAY + environment variable to enable SSH_ASKPASS, similarly to the X11 + DISPLAY environment variable (closes: #1037515, #1068044). + * Stop generating DSA host key. + * Apply X-Style: black. + + -- Colin Watson Wed, 31 Jul 2024 17:16:04 +0100 + +openssh (1:9.7p1-7) unstable; urgency=critical + + [ Salvatore Bonaccorso ] + * Disable async-signal-unsafe code from the sshsigdie() function. This is + a minimal workaround for a regression from CVE-2006-5051. + + -- Colin Watson Mon, 01 Jul 2024 10:11:27 +0100 + +openssh (1:9.7p1-6) unstable; urgency=medium + + * Stop reading ~/.pam_environment, which has a history of security + problems and is deprecated by PAM upstream (closes: #1018260). + + -- Colin Watson Tue, 25 Jun 2024 14:20:44 +0100 + +openssh (1:9.7p1-5) unstable; urgency=medium - -- Tianyu Chen Mon, 01 Jul 2024 17:13:27 +0800 + [ Colin Watson ] + * Add "After=nss-user-lookup.target" to ssh.service and sshd@.service + (closes: #1069706). + * Avoid cleanup of /tmp/sshauth.*, created by sshd if ExposeAuthInfo is + set. -openssh (1:9.7p1-4deepin1) unstable; urgency=medium + [ Andreas Hasenack ] + * Add autopkgtests for GSSAPI logins, including gssapi-keyex. - * Refresh and re-apply deepin patches: - deepin-extra-version.patch - deepin-ssh-connect-idle-timeout.patch - deepin-ssh-keygen-privatekey-file-perm.patch - * Update openssh-server.ucf-md5sum. + [ Luca Boccassi ] + * Install tmpfiles.d to avoid cleanup of ssh-agent socket in /tmp/ + (closes: #1070725). + * Only set PAM_RHOST if the remote host is not "UNKNOWN" (thanks, Daan De + Meyer). - -- Tianyu Chen Sun, 07 Apr 2024 15:23:02 +0800 + -- Colin Watson Thu, 16 May 2024 11:16:30 +0100 openssh (1:9.7p1-4) unstable; urgency=medium diff --git a/debian/control b/debian/control index 264cd15..b14d925 100644 --- a/debian/control +++ b/debian/control @@ -2,48 +2,57 @@ Source: openssh Section: net Priority: standard Maintainer: Debian OpenSSH Maintainers -Build-Depends: debhelper (>= 13.1~), - debhelper-compat (= 13), - dh-exec, - dh-runit (>= 2.8.8), - dh-sequence-movetousr, - libaudit-dev [linux-any], - libedit-dev, - libfido2-dev (>= 1.5.0) [linux-any], - libgtk-3-dev , - libkrb5-dev | heimdal-dev, - libpam0g-dev | libpam-dev, - libselinux1-dev [linux-any], - libssl-dev (>= 1.1.1), - libwrap0-dev | libwrap-dev, - pkgconf, - zlib1g-dev, - lsb-release, +Build-Depends: + debhelper (>= 13.1~), + debhelper-compat (= 13), + dh-exec, + dh-runit (>= 2.8.8), + dh-sequence-movetousr, + libaudit-dev [linux-any], + libedit-dev, + libfido2-dev (>= 1.5.0) [linux-any], + libgtk-3-dev , + libkrb5-dev | heimdal-dev, + libpam0g-dev | libpam-dev, + libselinux1-dev [linux-any], + libssl-dev (>= 1.1.1), + libwrap0-dev | libwrap-dev, + pkgconf, + zlib1g-dev, Standards-Version: 4.6.2 -Uploaders: Colin Watson , - Matthew Vernon , +Uploaders: + Colin Watson , + Matthew Vernon , Homepage: https://www.openssh.com/ Vcs-Git: https://salsa.debian.org/ssh-team/openssh.git Vcs-Browser: https://salsa.debian.org/ssh-team/openssh Rules-Requires-Root: no +X-Style: black Package: openssh-client Architecture: any -Depends: adduser, - passwd, - ${misc:Depends}, - ${shlibs:Depends}, -Recommends: xauth, -Conflicts: sftp, -Breaks: openssh-sk-helper -Replaces: openssh-sk-helper, - ssh, - ssh-krb5, -Suggests: keychain, - libpam-ssh, - monkeysphere, - ssh-askpass, -Provides: ssh-client, +Depends: + adduser, + passwd, + ${misc:Depends}, + ${shlibs:Depends}, +Recommends: + xauth, +Conflicts: + sftp, +Breaks: + openssh-sk-helper, +Replaces: + openssh-sk-helper, + ssh, + ssh-krb5, +Suggests: + keychain, + libpam-ssh, + monkeysphere, + ssh-askpass, +Provides: + ssh-client, Multi-Arch: foreign Description: secure shell (SSH) client, for secure access to remote machines This is the portable version of OpenSSH, a free implementation of @@ -68,36 +77,71 @@ Description: secure shell (SSH) client, for secure access to remote machines ssh replaces the insecure rsh, rcp and rlogin programs, which are obsolete for most purposes. +Package: openssh-client-gssapi +Priority: optional +Architecture: all +Depends: + openssh-client (>= ${binary:Version}), + ${misc:Depends}, +Multi-Arch: foreign +Description: secure shell (SSH) client, with GSS-API support + This is the portable version of OpenSSH, a free implementation of + the Secure Shell protocol as specified by the IETF secsh working + group. + . + Ssh (Secure Shell) is a program for logging into a remote machine + and for executing commands on a remote machine. + It provides secure encrypted communications between two untrusted + hosts over an insecure network. X11 connections and arbitrary TCP/IP + ports can also be forwarded over the secure channel. + It can be used to provide applications with a secure communication + channel. + . + This package provides versions of the ssh client and related programs + built with support for GSS-API authentication and key exchange, which + can be used with systems such as Kerberos. + It is currently an empty package depending on openssh-client, but + future releases will remove GSS-API support from openssh-client, so + users who need it should install this package. + Package: openssh-server Priority: optional Architecture: any -Pre-Depends: ${misc:Pre-Depends}, -Depends: adduser, - libpam-modules, - libpam-runtime, - lsb-base, - openssh-client (= ${binary:Version}), - openssh-sftp-server, - procps, - ucf, - ${misc:Depends}, - ${shlibs:Depends}, -Recommends: default-logind | logind | libpam-systemd, - ncurses-term, - xauth, - ${openssh-server:Recommends}, -Conflicts: sftp, - ssh-socks, - ssh2, -Replaces: openssh-client (<< 1:7.9p1-8), - ssh, - ssh-krb5, -Breaks: ${runit:Breaks}, -Suggests: molly-guard, - monkeysphere, - ssh-askpass, - ufw, -Provides: ssh-server, +Pre-Depends: + ${misc:Pre-Depends}, +Depends: + adduser, + libpam-modules, + libpam-runtime, + lsb-base, + openssh-client (= ${binary:Version}), + openssh-sftp-server, + procps, + ucf, + ${misc:Depends}, + ${shlibs:Depends}, +Recommends: + default-logind | logind | libpam-systemd, + ncurses-term, + xauth, + ${openssh-server:Recommends}, +Conflicts: + sftp, + ssh-socks, + ssh2, +Replaces: + openssh-client (<< 1:7.9p1-8), + ssh, + ssh-krb5, +Breaks: + ${runit:Breaks}, +Suggests: + molly-guard, + monkeysphere, + ssh-askpass, + ufw, +Provides: + ssh-server, Multi-Arch: foreign Description: secure shell (SSH) server, for secure access from remote machines This is the portable version of OpenSSH, a free implementation of @@ -120,16 +164,49 @@ Description: secure shell (SSH) server, for secure access from remote machines sshd replaces the insecure rshd program, which is obsolete for most purposes. +Package: openssh-server-gssapi +Priority: optional +Architecture: all +Depends: + openssh-client-gssapi (>= ${binary:Version}), + openssh-server (>= ${binary:Version}), + ${misc:Depends}, +Multi-Arch: foreign +Description: secure shell (SSH) server, with GSS-API key exchange + This is the portable version of OpenSSH, a free implementation of + the Secure Shell protocol as specified by the IETF secsh working + group. + . + Ssh (Secure Shell) is a program for logging into a remote machine + and for executing commands on a remote machine. + It provides secure encrypted communications between two untrusted + hosts over an insecure network. X11 connections and arbitrary TCP/IP + ports can also be forwarded over the secure channel. + It can be used to provide applications with a secure communication + channel. + . + This package provides a version of the sshd server built with support + for GSS-API authentication and key exchange, which can be used with + systems such as Kerberos. + It is currently an empty package depending on openssh-server, but + future releases will remove GSS-API support from openssh-server, so + users who need it should install this package. + Package: openssh-sftp-server Priority: optional Architecture: any -Depends: ${misc:Depends}, - ${shlibs:Depends}, -Recommends: openssh-server | ssh-server, -Breaks: openssh-server (<< 1:6.5p1-5), -Replaces: openssh-server (<< 1:6.5p1-5), -Enhances: openssh-server, - ssh-server, +Depends: + ${misc:Depends}, + ${shlibs:Depends}, +Recommends: + openssh-server | ssh-server, +Breaks: + openssh-server (<< 1:6.5p1-5), +Replaces: + openssh-server (<< 1:6.5p1-5), +Enhances: + openssh-server, + ssh-server, Multi-Arch: foreign Description: secure shell (SSH) sftp server module, for SFTP access from remote machines This is the portable version of OpenSSH, a free implementation of @@ -159,14 +236,15 @@ Description: secure shell (SSH) sftp server module, for SFTP access from remote Package: openssh-tests Priority: optional Architecture: any -Depends: openssh-client (= ${binary:Version}), - openssh-server (= ${binary:Version}), - openssh-sftp-server (= ${binary:Version}), - openssl, - putty-tools (>= 0.67-2), - python3-twisted, - ${misc:Depends}, - ${shlibs:Depends}, +Depends: + openssh-client (= ${binary:Version}), + openssh-server (= ${binary:Version}), + openssh-sftp-server (= ${binary:Version}), + openssl, + putty-tools (>= 0.67-2), + python3-twisted, + ${misc:Depends}, + ${shlibs:Depends}, Multi-Arch: foreign Description: OpenSSH regression tests This package provides OpenSSH's regression test suite. It is mainly @@ -176,9 +254,10 @@ Description: OpenSSH regression tests Package: ssh Priority: optional Architecture: all -Depends: openssh-client (>= ${binary:Version}), - openssh-server (>= ${binary:Version}), - ${misc:Depends}, +Depends: + openssh-client (>= ${binary:Version}), + openssh-server (>= ${binary:Version}), + ${misc:Depends}, Multi-Arch: foreign Description: secure shell client and server (metapackage) This metapackage is a convenient way to install both the OpenSSH client @@ -190,11 +269,14 @@ Build-Profiles: Section: gnome Priority: optional Architecture: any -Depends: openssh-client | ssh (>= 1:1.2pre7-4), - ${misc:Depends}, - ${shlibs:Depends}, -Replaces: ssh (<< 1:3.5p1-3), -Provides: ssh-askpass, +Depends: + openssh-client | ssh (>= 1:1.2pre7-4), + ${misc:Depends}, + ${shlibs:Depends}, +Replaces: + ssh (<< 1:3.5p1-3), +Provides: + ssh-askpass, Multi-Arch: foreign Description: interactive X program to prompt users for a passphrase for ssh-add This has been split out of the main openssh-client package so that @@ -209,7 +291,9 @@ Package-Type: udeb Section: debian-installer Priority: optional Architecture: any -Depends: ${shlibs:Depends}, ${misc:Depends}, +Depends: + ${misc:Depends}, + ${shlibs:Depends}, XB-Installer-Menu-Item: 99999 Description: secure shell client for the Debian installer This is the portable version of OpenSSH, a free implementation of @@ -224,7 +308,9 @@ Package-Type: udeb Section: debian-installer Priority: optional Architecture: any -Depends: ${shlibs:Depends}, ${misc:Depends}, +Depends: + ${misc:Depends}, + ${shlibs:Depends}, Description: secure shell server for the Debian installer This is the portable version of OpenSSH, a free implementation of the Secure Shell protocol as specified by the IETF secsh working diff --git a/debian/openssh-client.tmpfiles b/debian/openssh-client.tmpfiles new file mode 100644 index 0000000..aca99b4 --- /dev/null +++ b/debian/openssh-client.tmpfiles @@ -0,0 +1 @@ +x /tmp/ssh-* diff --git a/debian/openssh-server-udeb.install b/debian/openssh-server-udeb.install index 05ccbf7..900d909 100644 --- a/debian/openssh-server-udeb.install +++ b/debian/openssh-server-udeb.install @@ -1,2 +1,3 @@ sshd usr/sbin +sshd-session usr/lib/openssh ssh-keygen usr/bin diff --git a/debian/openssh-server.install b/debian/openssh-server.install index 5bf99be..7936d27 100755 --- a/debian/openssh-server.install +++ b/debian/openssh-server.install @@ -1,6 +1,7 @@ #! /usr/bin/dh-exec etc/ssh/moduli +usr/lib/openssh/sshd-session usr/sbin/sshd usr/share/man/man5/authorized_keys.5 usr/share/man/man5/moduli.5 diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst index 4114d35..a871eb1 100644 --- a/debian/openssh-server.postinst +++ b/debian/openssh-server.postinst @@ -44,8 +44,6 @@ create_keys() { create_key "Creating SSH2 RSA key; this may take some time ..." \ "$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa - create_key "Creating SSH2 DSA key; this may take some time ..." \ - "$hostkeys" /etc/ssh/ssh_host_dsa_key -t dsa create_key "Creating SSH2 ECDSA key; this may take some time ..." \ "$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa create_key "Creating SSH2 ED25519 key; this may take some time ..." \ diff --git a/debian/openssh-server.sshd.pam.in b/debian/openssh-server.sshd.pam.in index 2cad67d..adfb8b1 100644 --- a/debian/openssh-server.sshd.pam.in +++ b/debian/openssh-server.sshd.pam.in @@ -44,7 +44,7 @@ session required pam_limits.so session required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. -session required pam_env.so user_readenv=1 envfile=/etc/default/locale +session required pam_env.so envfile=/etc/default/locale # SELinux needs to intervene at login time to ensure that the process starts # in the proper default security context. Only sessions which are intended diff --git a/debian/openssh-server.tmpfiles b/debian/openssh-server.tmpfiles new file mode 100644 index 0000000..896aeb1 --- /dev/null +++ b/debian/openssh-server.tmpfiles @@ -0,0 +1 @@ +x /tmp/sshauth.* diff --git a/debian/openssh-server.ucf-md5sum b/debian/openssh-server.ucf-md5sum index 1e0caef..6100e96 100644 --- a/debian/openssh-server.ucf-md5sum +++ b/debian/openssh-server.ucf-md5sum @@ -110,13 +110,7 @@ d96ecd9064ea650c44372a5a33d3e497 4e03b4df60cd00c651777ec14ff76aef # From 1:9.2p1-1: -a2cdc592eacf8a884829729418005d27 -84066063a3f2c9412d5df7a7a0e6e293 -8933d57d77504756fdde370bbdd08ee1 -49d53e44b746ec2ad2103ac2860f97ff - -# From 1:9.7p1-4deepin3 -34f13e3344c394d1e9b8f36d55afd5e6 -c94aa65d347d95e3c30aba50187b4417 -3fecc6a74e3e70b0e65cdd8520c86aba -cc97f6a047873d4d9f3f962239601c74 +b8e751f62cf86a18bc30cdaae494b03f +b89c8626d43128cdb233536439e00566 +5f589fb3658df8cb7cce8505cf821e40 +8d7588b06f81ef23bea8d84442af8e68 diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch index 2a183b1..e9f8fe7 100644 --- a/debian/patches/authorized-keys-man-symlink.patch +++ b/debian/patches/authorized-keys-man-symlink.patch @@ -1,4 +1,4 @@ -From 8c2f7f932f143c330a74389d094117d7c85f51f9 Mon Sep 17 00:00:00 2001 +From a9fcf8497c9a34523f834e0982fee41daad78bc4 Mon Sep 17 00:00:00 2001 From: Tomas Pospisek Date: Sun, 9 Feb 2014 16:10:07 +0000 Subject: Install authorized_keys(5) as a symlink to sshd(8) @@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch 1 file changed, 1 insertion(+) diff --git a/Makefile.in b/Makefile.in -index f9488099a..e0e45c9b9 100644 +index e92bf3e31..eeea95410 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -415,6 +415,7 @@ install-files: +@@ -426,6 +426,7 @@ install-files: $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 diff --git a/debian/patches/configure-cache-vars.patch b/debian/patches/configure-cache-vars.patch index a79f5f1..d79e128 100644 --- a/debian/patches/configure-cache-vars.patch +++ b/debian/patches/configure-cache-vars.patch @@ -1,4 +1,4 @@ -From 1506d4bbf5fa2d7a3d2f8ae77914dd46b10c40ea Mon Sep 17 00:00:00 2001 +From 83dc570f464527322534494bcb75ad068c8d39e5 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Wed, 3 Apr 2024 11:52:04 +0100 Subject: Add Autoconf cache variables for OSSH_CHECK_*FLAG_* diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch index bfdf8ec..dd604f8 100644 --- a/debian/patches/debian-banner.patch +++ b/debian/patches/debian-banner.patch @@ -1,4 +1,4 @@ -From 30df3f03ff91b648414b35bdc697ce9127a9fe90 Mon Sep 17 00:00:00 2001 +From acf273b1eb60544826e13ffbd9967772c4f13e13 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Sun, 9 Feb 2014 16:10:06 +0000 Subject: Add DebianBanner server configuration option @@ -8,24 +8,24 @@ initial protocol handshake, for those scared by package-versioning.patch. Bug-Debian: http://bugs.debian.org/562048 Forwarded: not-needed -Last-Update: 2023-12-18 +Last-Update: 2024-09-22 Patch-Name: debian-banner.patch --- - kex.c | 5 +++-- - kex.h | 2 +- - servconf.c | 10 ++++++++++ - servconf.h | 2 ++ - sshconnect.c | 2 +- - sshd.c | 2 +- - sshd_config.5 | 5 +++++ + kex.c | 5 +++-- + kex.h | 2 +- + servconf.c | 10 ++++++++++ + servconf.h | 2 ++ + sshconnect.c | 2 +- + sshd-session.c | 2 +- + sshd_config.5 | 5 +++++ 7 files changed, 23 insertions(+), 5 deletions(-) diff --git a/kex.c b/kex.c -index 4e988e39b..30f2ce2b3 100644 +index 19b1fcaa8..ca6d5b53d 100644 --- a/kex.c +++ b/kex.c -@@ -1545,7 +1545,7 @@ send_error(struct ssh *ssh, char *msg) +@@ -1237,7 +1237,7 @@ send_error(struct ssh *ssh, char *msg) */ int kex_exchange_identification(struct ssh *ssh, int timeout_ms, @@ -34,7 +34,7 @@ index 4e988e39b..30f2ce2b3 100644 { int remote_major, remote_minor, mismatch, oerrno = 0; size_t len, n; -@@ -1563,7 +1563,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms, +@@ -1255,7 +1255,8 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms, if (version_addendum != NULL && *version_addendum == '\0') version_addendum = NULL; if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s\r\n", @@ -45,12 +45,12 @@ index 4e988e39b..30f2ce2b3 100644 version_addendum == NULL ? "" : version_addendum)) != 0) { oerrno = errno; diff --git a/kex.h b/kex.h -index 32da837f8..41888c0d8 100644 +index cd6a40333..6a08023d0 100644 --- a/kex.h +++ b/kex.h -@@ -208,7 +208,7 @@ void kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX], +@@ -215,7 +215,7 @@ void kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX], + const char *, const char *, const char *, const char *, const char *); void kex_proposal_free_entries(char *prop[PROPOSAL_MAX]); - int kex_gss_names_valid(const char *); -int kex_exchange_identification(struct ssh *, int, const char *); +int kex_exchange_identification(struct ssh *, int, int, const char *); @@ -58,45 +58,45 @@ index 32da837f8..41888c0d8 100644 struct kex *kex_new(void); int kex_ready(struct ssh *, char *[PROPOSAL_MAX]); diff --git a/servconf.c b/servconf.c -index 193d73cca..12aa1f4ad 100644 +index 1d5c143ba..49a066df8 100644 --- a/servconf.c +++ b/servconf.c -@@ -201,6 +201,7 @@ initialize_server_options(ServerOptions *options) - options->channel_timeouts = NULL; - options->num_channel_timeouts = 0; +@@ -219,6 +219,7 @@ initialize_server_options(ServerOptions *options) options->unused_connection_timeout = -1; + options->sshd_session_path = NULL; + options->refuse_connection = -1; + options->debian_banner = -1; } /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ -@@ -459,6 +460,8 @@ fill_default_server_options(ServerOptions *options) - options->required_rsa_size = SSH_RSA_MINIMUM_MODULUS_SIZE; - if (options->unused_connection_timeout == -1) - options->unused_connection_timeout = 0; +@@ -507,6 +508,8 @@ fill_default_server_options(ServerOptions *options) + options->sshd_session_path = xstrdup(_PATH_SSHD_SESSION); + if (options->refuse_connection == -1) + options->refuse_connection = 0; + if (options->debian_banner == -1) + options->debian_banner = 1; assemble_algorithms(options); -@@ -544,6 +547,7 @@ typedef enum { - sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, +@@ -591,6 +594,7 @@ typedef enum { sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider, sRequiredRSASize, sChannelTimeout, sUnusedConnectionTimeout, + sSshdSessionPath, sRefuseConnection, + sDebianBanner, sDeprecated, sIgnore, sUnsupported } ServerOpCodes; -@@ -717,6 +721,7 @@ static struct { - { "requiredrsasize", sRequiredRSASize, SSHCFG_ALL }, - { "channeltimeout", sChannelTimeout, SSHCFG_ALL }, +@@ -770,6 +774,7 @@ static struct { { "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL }, + { "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL }, + { "refuseconnection", sRefuseConnection, SSHCFG_ALL }, + { "debianbanner", sDebianBanner, SSHCFG_GLOBAL }, { NULL, sBadOption, 0 } }; -@@ -2637,6 +2642,10 @@ process_server_config_line_depth(ServerOptions *options, char *line, - } - goto parse_time; +@@ -2725,6 +2730,10 @@ process_server_config_line_depth(ServerOptions *options, char *line, + multistate_ptr = multistate_flag; + goto parse_multistate; + case sDebianBanner: + intptr = &options->debian_banner; @@ -105,32 +105,32 @@ index 193d73cca..12aa1f4ad 100644 case sDeprecated: case sIgnore: case sUnsupported: -@@ -3185,6 +3194,7 @@ dump_config(ServerOptions *o) - dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink); +@@ -3278,6 +3287,7 @@ dump_config(ServerOptions *o) dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash); dump_cfg_fmtint(sExposeAuthInfo, o->expose_userauth_info); + dump_cfg_fmtint(sRefuseConnection, o->refuse_connection); + dump_cfg_fmtint(sDebianBanner, o->debian_banner); /* string arguments */ dump_cfg_string(sPidFile, o->pid_file); diff --git a/servconf.h b/servconf.h -index 2ce4ae0ad..e0c0af903 100644 +index 26819aa92..00c834403 100644 --- a/servconf.h +++ b/servconf.h -@@ -236,6 +236,8 @@ typedef struct { - u_int num_channel_timeouts; +@@ -254,6 +254,8 @@ typedef struct { + char *sshd_session_path; - int unused_connection_timeout; + int refuse_connection; + + int debian_banner; } ServerOptions; /* Information about the incoming connection as used by Match */ diff --git a/sshconnect.c b/sshconnect.c -index 23f79ed2b..da20ecd88 100644 +index cbfc20735..f9d3a1ff2 100644 --- a/sshconnect.c +++ b/sshconnect.c -@@ -1581,7 +1581,7 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost, +@@ -1611,7 +1611,7 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost, lowercase(host); /* Exchange protocol version identification strings with the server. */ @@ -139,13 +139,13 @@ index 23f79ed2b..da20ecd88 100644 sshpkt_fatal(ssh, r, "banner exchange"); /* Put the connection into non-blocking mode. */ -diff --git a/sshd.c b/sshd.c -index 9c9f38e5b..8fab51ebb 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -2249,7 +2249,7 @@ main(int ac, char **av) - if (!debug_flag) - alarm(options.login_grace_time); +diff --git a/sshd-session.c b/sshd-session.c +index 1d7cdd00a..a9e1cf4f6 100644 +--- a/sshd-session.c ++++ b/sshd-session.c +@@ -1314,7 +1314,7 @@ main(int ac, char **av) + fatal("login grace time setitimer failed"); + } - if ((r = kex_exchange_identification(ssh, -1, + if ((r = kex_exchange_identification(ssh, -1, options.debian_banner, @@ -153,7 +153,7 @@ index 9c9f38e5b..8fab51ebb 100644 sshpkt_fatal(ssh, r, "banner exchange"); diff --git a/sshd_config.5 b/sshd_config.5 -index e06ef8abd..1a8febfa6 100644 +index 11a8e922f..ed2f74060 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -629,6 +629,11 @@ or diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch index ce3c1c0..5d18b45 100644 --- a/debian/patches/debian-config.patch +++ b/debian/patches/debian-config.patch @@ -1,4 +1,4 @@ -From 04acdcf452c7a88ac8c37ca6870a571125fbc8da Mon Sep 17 00:00:00 2001 +From bcafde3235b00794b6d7ee62b8687a786aa08d4f Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:18 +0000 Subject: Various Debian-specific configuration changes @@ -26,13 +26,15 @@ sshd: Change sftp subsystem path to /usr/lib/openssh/sftp-server. sshd: Include /etc/ssh/sshd_config.d/*.conf. +sshd: Document Debian's default for SshdSessionPath. + regress: Run tests with 'UsePAM yes', to match sshd_config. Document all of this. Author: Russ Allbery Forwarded: not-needed -Last-Update: 2023-01-03 +Last-Update: 2024-07-03 Patch-Name: debian-config.patch --- @@ -42,14 +44,14 @@ Patch-Name: debian-config.patch ssh_config | 8 +++++++- ssh_config.5 | 26 +++++++++++++++++++++++++- sshd_config | 18 ++++++++++++------ - sshd_config.5 | 29 +++++++++++++++++++++++++++++ - 7 files changed, 99 insertions(+), 9 deletions(-) + sshd_config.5 | 31 ++++++++++++++++++++++++++++++- + 7 files changed, 100 insertions(+), 10 deletions(-) diff --git a/readconf.c b/readconf.c -index d68658185..720062bcc 100644 +index d3c3056ef..90bf74f32 100644 --- a/readconf.c +++ b/readconf.c -@@ -2739,7 +2739,7 @@ fill_default_options(Options * options) +@@ -2773,7 +2773,7 @@ fill_default_options(Options * options) if (options->forward_x11 == -1) options->forward_x11 = 0; if (options->forward_x11_trusted == -1) @@ -59,22 +61,22 @@ index d68658185..720062bcc 100644 options->forward_x11_timeout = 1200; /* diff --git a/regress/test-exec.sh b/regress/test-exec.sh -index ad627941f..56e98159c 100644 +index 7afc28072..02b122a85 100644 --- a/regress/test-exec.sh +++ b/regress/test-exec.sh -@@ -609,6 +609,7 @@ cat << EOF > $OBJ/sshd_config - AcceptEnv _XXX_TEST_* - AcceptEnv _XXX_TEST +@@ -622,6 +622,7 @@ cat << EOF > $OBJ/sshd_config Subsystem sftp $SFTPSERVER + SshdSessionPath $SSHD_SESSION + PerSourcePenalties no + UsePAM yes EOF # This may be necessary if /usr/src and/or /usr/obj are group-writable, diff --git a/ssh.1 b/ssh.1 -index 0d56f3dc1..ddfe75b95 100644 +index 3ad246c27..9ca6e18e2 100644 --- a/ssh.1 +++ b/ssh.1 -@@ -861,6 +861,16 @@ directive in +@@ -863,6 +863,16 @@ directive in .Xr ssh_config 5 for more information. .Pp @@ -91,7 +93,7 @@ index 0d56f3dc1..ddfe75b95 100644 .It Fl x Disables X11 forwarding. .Pp -@@ -869,6 +879,20 @@ Enables trusted X11 forwarding. +@@ -871,6 +881,20 @@ Enables trusted X11 forwarding. Trusted X11 forwardings are not subjected to the X11 SECURITY extension controls. .Pp @@ -138,7 +140,7 @@ index 16197d15d..92d06ef38 100644 + HashKnownHosts yes + GSSAPIAuthentication yes diff --git a/ssh_config.5 b/ssh_config.5 -index 41d4d7406..c2789a09d 100644 +index 86258eb4f..9adc0fdb7 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -71,6 +71,29 @@ Since the first obtained value for each parameter is used, more @@ -171,7 +173,7 @@ index 41d4d7406..c2789a09d 100644 The file contains keyword-argument pairs, one per line. Lines starting with .Ql # -@@ -901,11 +924,12 @@ elapsed. +@@ -903,11 +926,12 @@ elapsed. .It Cm ForwardX11Trusted If this option is set to .Cm yes , @@ -244,7 +246,7 @@ index ecfe8d026..677f97d5d 100644 # Example of overriding settings on a per-user basis #Match User anoncvs diff --git a/sshd_config.5 b/sshd_config.5 -index 0e8891c4f..12083e839 100644 +index e177e4af8..2887ed531 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -56,6 +56,35 @@ Arguments may optionally be enclosed in double quotes @@ -283,3 +285,12 @@ index 0e8891c4f..12083e839 100644 The possible keywords and their meanings are as follows (note that keywords are case-insensitive and arguments are case-sensitive): +@@ -1865,7 +1894,7 @@ Overrides the default path to the + .Cm sshd-session + binary that is invoked to handle each connection. + The default is +-.Pa /usr/libexec/sshd-session . ++.Pa /usr/lib/openssh/sshd-session . + This option is intended for use by tests. + .It Cm StreamLocalBindMask + Sets the octal file creation mode mask diff --git a/debian/patches/deepin-extra-version.patch b/debian/patches/deepin-extra-version.patch deleted file mode 100644 index 789b2e5..0000000 --- a/debian/patches/deepin-extra-version.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/version.h -+++ b/version.h -@@ -5,7 +5,7 @@ - #define SSH_PORTABLE "p1" - #define SSH_RELEASE_MINIMUM SSH_VERSION SSH_PORTABLE - #ifdef SSH_EXTRAVERSION --#define SSH_RELEASE SSH_RELEASE_MINIMUM " " SSH_EXTRAVERSION -+#define SSH_RELEASE SSH_RELEASE_MINIMUM " " "Deepin" - #else - #define SSH_RELEASE SSH_RELEASE_MINIMUM - #endif diff --git a/debian/patches/deepin-ssh-connect-idle-timeout.patch b/debian/patches/deepin-ssh-connect-idle-timeout.patch deleted file mode 100644 index 08ea714..0000000 --- a/debian/patches/deepin-ssh-connect-idle-timeout.patch +++ /dev/null @@ -1,20 +0,0 @@ -Description: 完成 ssh、tty登录超时自动退出需求实现 - 增加sshd默认配置项，ssh连接之后900秒无操作，自动退出 - -Origin: https://gerrit.uniontech.com/plugins/gitiles/base/openssh/+/202f13d0e50e7d3fe478ad39be7c59ab3ed30b52 -Task: https://pms.uniontech.com/zentao/task-view-60279.html -Last-Update: 2022-05-19 - ---- openssh-9.0p1.orig/sshd_config -+++ openssh-9.0p1/sshd_config -@@ -97,8 +97,8 @@ PrintMotd no - #TCPKeepAlive yes - #PermitUserEnvironment no - #Compression delayed --#ClientAliveInterval 0 --#ClientAliveCountMax 3 -+# set inactive timeout for shell & subsystem connections -+ChannelTimeout session:shell=900 session:subsystem*=900 - #UseDNS no - #PidFile /var/run/sshd.pid - #MaxStartups 10:30:100 diff --git a/debian/patches/deepin-ssh-keygen-privatekey-file-perm.patch b/debian/patches/deepin-ssh-keygen-privatekey-file-perm.patch deleted file mode 100644 index 635829e..0000000 --- a/debian/patches/deepin-ssh-keygen-privatekey-file-perm.patch +++ /dev/null @@ -1,18 +0,0 @@ -Description: - TODO: Put a short summary on the line above and replace this paragraph - -Origin: https://gerrit.uniontech.com/plugins/gitiles/base/openssh/+/1aaa80cba01428f8738878a826db83fd1aeed6c4 -Task: https://pms.uniontech.com/zentao/task-view-60275.html -Last-Update: 2022-05-20 - ---- openssh-9.0p1.orig/sshbuf-io.c -+++ openssh-9.0p1/sshbuf-io.c -@@ -102,7 +102,7 @@ sshbuf_write_file(const char *path, stru - { - int fd, oerrno; - -- if ((fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644)) == -1) -+ if ((fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0400)) == -1) - return SSH_ERR_SYSTEM_ERROR; - if (atomicio(vwrite, fd, sshbuf_mutable_ptr(buf), - sshbuf_len(buf)) != sshbuf_len(buf) || close(fd) != 0) { diff --git a/debian/patches/disable-logging-in-sshsigdie.patch b/debian/patches/disable-logging-in-sshsigdie.patch deleted file mode 100644 index 322bbe3..0000000 --- a/debian/patches/disable-logging-in-sshsigdie.patch +++ /dev/null @@ -1,17 +0,0 @@ ---- a/log.c -+++ b/log.c -@@ -452,12 +452,14 @@ void - sshsigdie(const char *file, const char *func, int line, int showfunc, - LogLevel level, const char *suffix, const char *fmt, ...) - { -+#if 0 - va_list args; - - va_start(args, fmt); - sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, - suffix, fmt, args); - va_end(args); -+#endif - _exit(1); - } - diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch index 9d4cb3c..ad695cc 100644 --- a/debian/patches/dnssec-sshfp.patch +++ b/debian/patches/dnssec-sshfp.patch @@ -1,4 +1,4 @@ -From 2d07e4a73975fd8b478680e8a4490fc6c48a6390 Mon Sep 17 00:00:00 2001 +From d4727dbc1b6618e4087fd35f15adee1a971cc92c Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:01 +0000 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf @@ -51,7 +51,7 @@ index 939241440..bf47a079f 100644 verbose("DNS lookup error: %s", dns_result_totext(result)); return -1; diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c -index 8f5939840..6091a2591 100644 +index ad35148c9..add519441 100644 --- a/openbsd-compat/getrrsetbyname.c +++ b/openbsd-compat/getrrsetbyname.c @@ -214,8 +214,8 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch index 6f648b0..900d1b1 100644 --- a/debian/patches/doc-hash-tab-completion.patch +++ b/debian/patches/doc-hash-tab-completion.patch @@ -1,4 +1,4 @@ -From a783425eb21dfb3e4432dbbdb7e4e0653a436e7e Mon Sep 17 00:00:00 2001 +From e0f5ef4ccd951f2c8dc30639019c2e45451389c3 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:11 +0000 Subject: Document that HashKnownHosts may break tab-completion @@ -13,10 +13,10 @@ Patch-Name: doc-hash-tab-completion.patch 1 file changed, 3 insertions(+) diff --git a/ssh_config.5 b/ssh_config.5 -index 4afb8fb7a..41d4d7406 100644 +index 073ef69e2..86258eb4f 100644 --- a/ssh_config.5 +++ b/ssh_config.5 -@@ -1020,6 +1020,9 @@ Note that existing names and addresses in known hosts files +@@ -1022,6 +1022,9 @@ Note that existing names and addresses in known hosts files will not be converted automatically, but may be manually hashed using .Xr ssh-keygen 1 . diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch index e055cab..bca17af 100644 --- a/debian/patches/gnome-ssh-askpass2-icon.patch +++ b/debian/patches/gnome-ssh-askpass2-icon.patch @@ -1,4 +1,4 @@ -From 808d4d2c8a93272e5ec08a27024e76efd491ce14 Mon Sep 17 00:00:00 2001 +From 8542c03bc3d4325d9e8b03c7fb0340ff743e70e1 Mon Sep 17 00:00:00 2001 From: Vincent Untz Date: Sun, 9 Feb 2014 16:10:16 +0000 Subject: Give the ssh-askpass-gnome window a default icon diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch index 7c3ba4a..9fae3b1 100644 --- a/debian/patches/gssapi.patch +++ b/debian/patches/gssapi.patch @@ -1,4 +1,4 @@ -From 4431708c5c325cdbcf802e5d86ea1f4da78c1b50 Mon Sep 17 00:00:00 2001 +From 160d97105023e620b623f2f337327aa820bd0e5a Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Sun, 9 Feb 2014 16:09:48 +0000 Subject: GSSAPI key exchange support @@ -21,23 +21,23 @@ Author: Colin Watson Author: Jakub Jelen Origin: other, https://github.com/openssh-gsskex/openssh-gsskex/pull/23 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242 -Last-Updated: 2024-03-14 +Last-Updated: 2024-10-14 Patch-Name: gssapi.patch --- - Makefile.in | 5 +- + Makefile.in | 6 +- README.md | 36 +++ - auth.c | 94 +------- - auth2-gss.c | 57 ++++- + auth.c | 3 +- + auth2-gss.c | 54 ++++- + auth2-methods.c | 6 + auth2.c | 2 + - canohost.c | 91 ++++++++ - canohost.h | 3 + clientloop.c | 13 ++ configure.ac | 24 ++ gss-genr.c | 297 +++++++++++++++++++++++- gss-serv-krb5.c | 87 ++++++- - gss-serv.c | 205 +++++++++++++++-- - kex.c | 66 +++++- + gss-serv.c | 200 ++++++++++++++-- + kex-names.c | 62 ++++- + kex.c | 4 + kex.h | 29 +++ kexdh.c | 10 + kexgen.c | 2 +- @@ -58,22 +58,23 @@ Patch-Name: gssapi.patch ssh.c | 6 +- ssh_config | 2 + ssh_config.5 | 57 +++++ - sshconnect2.c | 146 +++++++++++- - sshd.c | 62 ++++- + sshconnect2.c | 148 +++++++++++- + sshd-session.c | 59 ++++- + sshd.c | 3 +- sshd_config | 2 + sshd_config.5 | 30 +++ sshkey.c | 8 +- sshkey.h | 1 + - 39 files changed, 2763 insertions(+), 164 deletions(-) + 40 files changed, 2670 insertions(+), 73 deletions(-) create mode 100644 kexgssc.c create mode 100644 kexgsss.c create mode 100644 ssh-null.c diff --git a/Makefile.in b/Makefile.in -index 1efe11f6f..f9488099a 100644 +index 4243006b0..e92bf3e31 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -101,7 +101,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ +@@ -103,14 +103,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \ atomicio.o dispatch.o mac.o misc.o utf8.o \ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \ @@ -82,22 +83,22 @@ index 1efe11f6f..f9488099a 100644 msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ ssh-pkcs11.o smult_curve25519_ref.o \ poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \ -@@ -110,6 +110,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ - kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ - kexgexc.o kexgexs.o \ - kexsntrup761x25519.o sntrup761.o kexgen.o \ -+ kexgssc.o \ + ssh-ed25519.o digest-openssl.o digest-libc.o \ + hmac.o ed25519.o hash.o \ + kex.o kex-names.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ +- kexgexc.o kexgexs.o \ ++ kexgexc.o kexgexs.o kexgssc.o \ + kexsntrup761x25519.o kexmlkem768x25519.o sntrup761.o kexgen.o \ sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \ sshbuf-io.o - -@@ -126,7 +127,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \ +@@ -134,7 +134,7 @@ SSHD_SESSION_OBJS=sshd-session.o auth-rhosts.o auth-passwd.o \ auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \ auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-pubkeyfile.o \ monitor.o monitor_wrap.o auth-krb5.o \ - auth2-gss.o gss-serv.o gss-serv-krb5.o \ + auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o \ loginrec.o auth-pam.o auth-shadow.o auth-sia.o \ - srclimit.o sftp-server.o sftp-common.o \ + sftp-server.o sftp-common.o \ sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ diff --git a/README.md b/README.md index 9431b0ffd..e5051828c 100644 @@ -144,10 +145,10 @@ index 9431b0ffd..e5051828c 100644 [![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml) diff --git a/auth.c b/auth.c -index 3b380d9bb..8ccf06370 100644 +index 9a6e5a319..e4578169b 100644 --- a/auth.c +++ b/auth.c -@@ -357,7 +357,8 @@ auth_root_allowed(struct ssh *ssh, const char *method) +@@ -356,7 +356,8 @@ auth_root_allowed(struct ssh *ssh, const char *method) case PERMIT_NO_PASSWD: if (strcmp(method, "publickey") == 0 || strcmp(method, "hostbased") == 0 || @@ -157,110 +158,12 @@ index 3b380d9bb..8ccf06370 100644 return 1; break; case PERMIT_FORCED_ONLY: -@@ -637,97 +638,6 @@ fakepw(void) - return (&fake); - } - --/* -- * Returns the remote DNS hostname as a string. The returned string must not -- * be freed. NB. this will usually trigger a DNS query the first time it is -- * called. -- * This function does additional checks on the hostname to mitigate some -- * attacks on based on conflation of hostnames and IP addresses. -- */ -- --static char * --remote_hostname(struct ssh *ssh) --{ -- struct sockaddr_storage from; -- socklen_t fromlen; -- struct addrinfo hints, *ai, *aitop; -- char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -- const char *ntop = ssh_remote_ipaddr(ssh); -- -- /* Get IP address of client. */ -- fromlen = sizeof(from); -- memset(&from, 0, sizeof(from)); -- if (getpeername(ssh_packet_get_connection_in(ssh), -- (struct sockaddr *)&from, &fromlen) == -1) { -- debug("getpeername failed: %.100s", strerror(errno)); -- return xstrdup(ntop); -- } -- -- ipv64_normalise_mapped(&from, &fromlen); -- if (from.ss_family == AF_INET6) -- fromlen = sizeof(struct sockaddr_in6); -- -- debug3("Trying to reverse map address %.100s.", ntop); -- /* Map the IP address to a host name. */ -- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -- NULL, 0, NI_NAMEREQD) != 0) { -- /* Host name not found. Use ip address. */ -- return xstrdup(ntop); -- } -- -- /* -- * if reverse lookup result looks like a numeric hostname, -- * someone is trying to trick us by PTR record like following: -- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -- hints.ai_flags = AI_NUMERICHOST; -- if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -- logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -- name, ntop); -- freeaddrinfo(ai); -- return xstrdup(ntop); -- } -- -- /* Names are stored in lowercase. */ -- lowercase(name); -- -- /* -- * Map it back to an IP address and check that the given -- * address actually is an address of this host. This is -- * necessary because anyone with access to a name server can -- * define arbitrary names for an IP address. Mapping from -- * name to IP address can be trusted better (but can still be -- * fooled if the intruder has access to the name server of -- * the domain). -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_family = from.ss_family; -- hints.ai_socktype = SOCK_STREAM; -- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -- logit("reverse mapping checking getaddrinfo for %.700s " -- "[%s] failed.", name, ntop); -- return xstrdup(ntop); -- } -- /* Look for the address from the list of addresses. */ -- for (ai = aitop; ai; ai = ai->ai_next) { -- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -- (strcmp(ntop, ntop2) == 0)) -- break; -- } -- freeaddrinfo(aitop); -- /* If we reached the end of the list, the address was not there. */ -- if (ai == NULL) { -- /* Address not found for the host name. */ -- logit("Address %.100s maps to %.600s, but this does not " -- "map back to the address.", ntop, name); -- return xstrdup(ntop); -- } -- return xstrdup(name); --} -- - /* - * Return the canonical name of the host in the other side of the current - * connection. The host name is cached, so it is efficient to call this diff --git a/auth2-gss.c b/auth2-gss.c -index f72a38998..052c7b80f 100644 +index 75eb4e3a3..3e7d18fd2 100644 --- a/auth2-gss.c +++ b/auth2-gss.c @@ -1,7 +1,7 @@ - /* $OpenBSD: auth2-gss.c,v 1.34 2023/03/31 04:22:27 djm Exp $ */ + /* $OpenBSD: auth2-gss.c,v 1.36 2024/05/17 04:42:13 djm Exp $ */ /* - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. @@ -268,7 +171,15 @@ index f72a38998..052c7b80f 100644 * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions -@@ -57,6 +57,48 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh); +@@ -51,6 +51,7 @@ + #define SSH_GSSAPI_MAX_MECHS 2048 + + extern ServerOptions options; ++extern struct authmethod_cfg methodcfg_gsskeyex; + extern struct authmethod_cfg methodcfg_gssapi; + + static int input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh); +@@ -58,6 +59,47 @@ static int input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh); static int input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh); static int input_gssapi_errtok(int, u_int32_t, struct ssh *); @@ -303,10 +214,9 @@ index f72a38998..052c7b80f 100644 + gssbuf.length = sshbuf_len(b); + + /* gss_kex_context is NULL with privsep, so we can't check it here */ -+ if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gss_kex_context, -+ &gssbuf, &mic)))) -+ authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, -+ authctxt->pw, 1)); ++ if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gss_kex_context, &gssbuf, &mic))) ++ authenticated = mm_ssh_gssapi_userok(authctxt->user, ++ authctxt->pw, 1); + + sshbuf_free(b); + free(mic.value); @@ -317,42 +227,63 @@ index f72a38998..052c7b80f 100644 /* * We only support those mechanisms that we know about (ie ones that we know * how to check local user kuserok and the like) -@@ -267,7 +309,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) +@@ -267,7 +309,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) if ((r = sshpkt_get_end(ssh)) != 0) fatal_fr(r, "parse packet"); -- authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); -+ authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, -+ authctxt->pw, 1)); +- authenticated = mm_ssh_gssapi_userok(authctxt->user); ++ authenticated = mm_ssh_gssapi_userok(authctxt->user, authctxt->pw, 1); - if ((!use_privsep || mm_is_monitor()) && - (displayname = ssh_gssapi_displayname()) != NULL) -@@ -313,7 +356,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) + authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +@@ -308,7 +350,8 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) gssbuf.length = sshbuf_len(b); - if (!GSS_ERROR(PRIVSEP(ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic)))) -- authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); -+ authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user, -+ authctxt->pw, 0)); + if (!GSS_ERROR(mm_ssh_gssapi_checkmic(gssctxt, &gssbuf, &mic))) +- authenticated = mm_ssh_gssapi_userok(authctxt->user); ++ authenticated = mm_ssh_gssapi_userok(authctxt->user, ++ authctxt->pw, 0); else logit("GSSAPI MIC check failed"); -@@ -333,6 +377,13 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) +@@ -324,6 +367,11 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) return 0; } +Authmethod method_gsskeyex = { -+ "gssapi-keyex", -+ NULL, ++ &methodcfg_gsskeyex, + userauth_gsskeyex, -+ &options.gss_authentication +}; + Authmethod method_gssapi = { + &methodcfg_gssapi, + userauth_gssapi, +diff --git a/auth2-methods.c b/auth2-methods.c +index 99637a89b..a05908cf3 100644 +--- a/auth2-methods.c ++++ b/auth2-methods.c +@@ -50,6 +50,11 @@ struct authmethod_cfg methodcfg_pubkey = { + &options.pubkey_authentication + }; + #ifdef GSSAPI ++struct authmethod_cfg methodcfg_gsskeyex = { ++ "gssapi-keyex", ++ NULL, ++ &options.gss_authentication ++}; + struct authmethod_cfg methodcfg_gssapi = { "gssapi-with-mic", NULL, +@@ -76,6 +81,7 @@ static struct authmethod_cfg *authmethod_cfgs[] = { + &methodcfg_none, + &methodcfg_pubkey, + #ifdef GSSAPI ++ &methodcfg_gsskeyex, + &methodcfg_gssapi, + #endif + &methodcfg_passwd, diff --git a/auth2.c b/auth2.c -index 271789a77..514a697ca 100644 +index 67dec88c3..f75f1d20d 100644 --- a/auth2.c +++ b/auth2.c @@ -71,6 +71,7 @@ extern Authmethod method_passwd; @@ -371,124 +302,8 @@ index 271789a77..514a697ca 100644 &method_gssapi, #endif &method_passwd, -diff --git a/canohost.c b/canohost.c -index 28f086e5a..33213ab05 100644 ---- a/canohost.c -+++ b/canohost.c -@@ -35,6 +35,97 @@ - #include "canohost.h" - #include "misc.h" - -+/* -+ * Returns the remote DNS hostname as a string. The returned string must not -+ * be freed. NB. this will usually trigger a DNS query the first time it is -+ * called. -+ * This function does additional checks on the hostname to mitigate some -+ * attacks on legacy rhosts-style authentication. -+ */ -+ -+char * -+remote_hostname(struct ssh *ssh) -+{ -+ struct sockaddr_storage from; -+ socklen_t fromlen; -+ struct addrinfo hints, *ai, *aitop; -+ char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -+ const char *ntop = ssh_remote_ipaddr(ssh); -+ -+ /* Get IP address of client. */ -+ fromlen = sizeof(from); -+ memset(&from, 0, sizeof(from)); -+ if (getpeername(ssh_packet_get_connection_in(ssh), -+ (struct sockaddr *)&from, &fromlen) == -1) { -+ debug("getpeername failed: %.100s", strerror(errno)); -+ return xstrdup(ntop); -+ } -+ -+ ipv64_normalise_mapped(&from, &fromlen); -+ if (from.ss_family == AF_INET6) -+ fromlen = sizeof(struct sockaddr_in6); -+ -+ debug3("Trying to reverse map address %.100s.", ntop); -+ /* Map the IP address to a host name. */ -+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -+ NULL, 0, NI_NAMEREQD) != 0) { -+ /* Host name not found. Use ip address. */ -+ return xstrdup(ntop); -+ } -+ -+ /* -+ * if reverse lookup result looks like a numeric hostname, -+ * someone is trying to trick us by PTR record like following: -+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -+ hints.ai_flags = AI_NUMERICHOST; -+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -+ name, ntop); -+ freeaddrinfo(ai); -+ return xstrdup(ntop); -+ } -+ -+ /* Names are stored in lowercase. */ -+ lowercase(name); -+ -+ /* -+ * Map it back to an IP address and check that the given -+ * address actually is an address of this host. This is -+ * necessary because anyone with access to a name server can -+ * define arbitrary names for an IP address. Mapping from -+ * name to IP address can be trusted better (but can still be -+ * fooled if the intruder has access to the name server of -+ * the domain). -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_family = from.ss_family; -+ hints.ai_socktype = SOCK_STREAM; -+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -+ logit("reverse mapping checking getaddrinfo for %.700s " -+ "[%s] failed.", name, ntop); -+ return xstrdup(ntop); -+ } -+ /* Look for the address from the list of addresses. */ -+ for (ai = aitop; ai; ai = ai->ai_next) { -+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -+ (strcmp(ntop, ntop2) == 0)) -+ break; -+ } -+ freeaddrinfo(aitop); -+ /* If we reached the end of the list, the address was not there. */ -+ if (ai == NULL) { -+ /* Address not found for the host name. */ -+ logit("Address %.100s maps to %.600s, but this does not " -+ "map back to the address.", ntop, name); -+ return xstrdup(ntop); -+ } -+ return xstrdup(name); -+} -+ - void - ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) - { -diff --git a/canohost.h b/canohost.h -index 26d62855a..0cadc9f18 100644 ---- a/canohost.h -+++ b/canohost.h -@@ -15,6 +15,9 @@ - #ifndef _CANOHOST_H - #define _CANOHOST_H - -+struct ssh; -+ -+char *remote_hostname(struct ssh *); - char *get_peer_ipaddr(int); - int get_peer_port(int); - char *get_local_ipaddr(int); diff --git a/clientloop.c b/clientloop.c -index 8ec36af94..a1f94a85a 100644 +index 8ed8b1c34..6d57339a1 100644 --- a/clientloop.c +++ b/clientloop.c @@ -115,6 +115,10 @@ @@ -502,7 +317,7 @@ index 8ec36af94..a1f94a85a 100644 /* Permitted RSA signature algorithms for UpdateHostkeys proofs */ #define HOSTKEY_PROOF_RSA_ALGS "rsa-sha2-512,rsa-sha2-256" -@@ -1594,6 +1598,15 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, +@@ -1590,6 +1594,15 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg, /* Do channel operations. */ channel_after_poll(ssh, pfd, npfd_active); @@ -519,7 +334,7 @@ index 8ec36af94..a1f94a85a 100644 if (conn_in_ready) client_process_net_input(ssh); diff --git a/configure.ac b/configure.ac -index 82e8bb7c1..bb3e644fe 100644 +index 591d5a388..6a0140a9d 100644 --- a/configure.ac +++ b/configure.ac @@ -774,6 +774,30 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) @@ -1061,7 +876,7 @@ index a151bc1e4..ef20401ec 100644 #endif /* KRB5 */ diff --git a/gss-serv.c b/gss-serv.c -index 00e3d118b..162fec447 100644 +index 00e3d118b..b761d12aa 100644 --- a/gss-serv.c +++ b/gss-serv.c @@ -1,7 +1,7 @@ @@ -1117,7 +932,7 @@ index 00e3d118b..162fec447 100644 + Gssctxt *ctx = NULL; + int res; + -+ res = !GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctx, oid))); ++ res = !GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctx, oid)); + ssh_gssapi_delete_ctx(&ctx); + + return (res); @@ -1152,15 +967,15 @@ index 00e3d118b..162fec447 100644 + debug("Rekeyed credentials have different mechanism"); + return GSS_S_COMPLETE; + } -+ + +- gss_buffer_desc ename; + if ((ctx->major = gss_inquire_cred_by_mech(&ctx->minor, + ctx->client_creds, ctx->oid, &new_name, + NULL, NULL, NULL))) { + ssh_gssapi_error(ctx); + return (ctx->major); + } - -- gss_buffer_desc ename; ++ + ctx->major = gss_compare_name(&ctx->minor, client->name, + new_name, &equal); + @@ -1263,7 +1078,7 @@ index 00e3d118b..162fec447 100644 /* Destroy delegated credentials if userok fails */ gss_release_buffer(&lmin, &gssapi_client.displayname); gss_release_buffer(&lmin, &gssapi_client.exportedname); -@@ -382,14 +471,90 @@ ssh_gssapi_userok(char *user) +@@ -382,14 +471,85 @@ ssh_gssapi_userok(char *user) return (0); } @@ -1306,7 +1121,7 @@ index 00e3d118b..162fec447 100644 + gssapi_client.store.envvar == NULL) + return; + -+ ok = PRIVSEP(ssh_gssapi_update_creds(&gssapi_client.store)); ++ ok = mm_ssh_gssapi_update_creds(&gssapi_client.store); + + if (!ok) + return; @@ -1318,11 +1133,6 @@ index 00e3d118b..162fec447 100644 + * for rekeying. So, use our own :) + */ +#ifdef USE_PAM -+ if (!use_privsep) { -+ debug("Not even going to try and do PAM with privsep disabled"); -+ return; -+ } -+ + ret = pam_start("sshd-rekey", gssapi_client.store.owner->pw_name, + &pamconv, &pamh); + if (ret) @@ -1360,29 +1170,22 @@ index 00e3d118b..162fec447 100644 } /* Privileged */ -diff --git a/kex.c b/kex.c -index 8a0f16513..e4a2362bd 100644 ---- a/kex.c -+++ b/kex.c -@@ -58,12 +58,17 @@ - #include "dispatch.h" - #include "monitor.h" - #include "myproposal.h" -+#include "xmalloc.h" - +diff --git a/kex-names.c b/kex-names.c +index ec840c1f9..081f78c94 100644 +--- a/kex-names.c ++++ b/kex-names.c +@@ -45,6 +45,10 @@ #include "ssherr.h" - #include "sshbuf.h" - #include "digest.h" #include "xmalloc.h" +#ifdef GSSAPI +#include "ssh-gss.h" +#endif + - /* prototype */ - static int kex_choose_conf(struct ssh *, uint32_t seq); - static int kex_input_newkeys(int, u_int32_t, struct ssh *); -@@ -119,15 +124,28 @@ static const struct kexalg kexalgs[] = { + struct kexalg { + char *name; + u_int type; +@@ -89,15 +93,28 @@ static const struct kexalg kexalgs[] = { #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ { NULL, 0, -1, -1}, }; @@ -1414,7 +1217,7 @@ index 8a0f16513..e4a2362bd 100644 if (ret != NULL) ret[rlen++] = sep; nlen = strlen(k->name); -@@ -142,6 +160,18 @@ kex_alg_list(char sep) +@@ -112,6 +129,18 @@ kex_alg_list(char sep) return ret; } @@ -1433,7 +1236,7 @@ index 8a0f16513..e4a2362bd 100644 static const struct kexalg * kex_alg_by_name(const char *name) { -@@ -151,6 +181,10 @@ kex_alg_by_name(const char *name) +@@ -121,6 +150,10 @@ kex_alg_by_name(const char *name) if (strcmp(k->name, name) == 0) return k; } @@ -1444,8 +1247,8 @@ index 8a0f16513..e4a2362bd 100644 return NULL; } -@@ -393,6 +427,29 @@ kex_proposal_free_entries(char *prop[PROPOSAL_MAX]) - free(prop[i]); +@@ -183,6 +216,29 @@ kex_names_valid(const char *names) + return 1; } +/* Validate GSS KEX method name list */ @@ -1471,10 +1274,22 @@ index 8a0f16513..e4a2362bd 100644 + return 1; +} + - /* put algorithm proposal into buffer */ + /* returns non-zero if proposal contains any algorithm from algs */ int - kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX]) -@@ -987,6 +1044,9 @@ kex_free(struct kex *kex) + kex_has_any_alg(const char *proposal, const char *algs) +diff --git a/kex.c b/kex.c +index 6b957e5e1..f09e79e6b 100644 +--- a/kex.c ++++ b/kex.c +@@ -58,6 +58,7 @@ + #include "dispatch.h" + #include "monitor.h" + #include "myproposal.h" ++#include "xmalloc.h" + + #include "ssherr.h" + #include "sshbuf.h" +@@ -739,6 +740,9 @@ kex_free(struct kex *kex) sshbuf_free(kex->session_id); sshbuf_free(kex->initial_sig); sshkey_free(kex->initial_hostkey); @@ -1485,13 +1300,13 @@ index 8a0f16513..e4a2362bd 100644 free(kex->hostkey_alg); free(kex->name); diff --git a/kex.h b/kex.h -index 0caf42b50..32da837f8 100644 +index d08988b3e..cd6a40333 100644 --- a/kex.h +++ b/kex.h -@@ -102,6 +102,15 @@ enum kex_exchange { - KEX_ECDH_SHA2, +@@ -103,6 +103,15 @@ enum kex_exchange { KEX_C25519_SHA256, KEX_KEM_SNTRUP761X25519_SHA512, + KEX_KEM_MLKEM768X25519_SHA256, +#ifdef GSSAPI + KEX_GSS_GRP1_SHA1, + KEX_GSS_GRP14_SHA1, @@ -1504,7 +1319,7 @@ index 0caf42b50..32da837f8 100644 KEX_MAX }; -@@ -164,6 +173,12 @@ struct kex { +@@ -165,6 +174,12 @@ struct kex { u_int flags; int hash_alg; int ec_nid; @@ -1517,21 +1332,17 @@ index 0caf42b50..32da837f8 100644 char *failed_choice; int (*verify_host_key)(struct sshkey *, struct ssh *); struct sshkey *(*load_host_public_key)(int, int, struct ssh *); -@@ -185,11 +200,13 @@ struct kex { - +@@ -190,7 +205,9 @@ u_int kex_type_from_name(const char *); + int kex_hash_from_name(const char *); + int kex_nid_from_name(const char *); int kex_names_valid(const char *); ++int kex_gss_names_valid(const char *); char *kex_alg_list(char); +char *kex_gss_alg_list(char); char *kex_names_cat(const char *, const char *); + int kex_has_any_alg(const char *, const char *); int kex_assemble_names(char **, const char *, const char *); - void kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX], - const char *, const char *, const char *, const char *, const char *); - void kex_proposal_free_entries(char *prop[PROPOSAL_MAX]); -+int kex_gss_names_valid(const char *); - - int kex_exchange_identification(struct ssh *, int, const char *); - -@@ -219,6 +236,12 @@ int kexgex_client(struct ssh *); +@@ -226,6 +243,12 @@ int kexgex_client(struct ssh *); int kexgex_server(struct ssh *); int kex_gen_client(struct ssh *); int kex_gen_server(struct ssh *); @@ -1544,7 +1355,7 @@ index 0caf42b50..32da837f8 100644 int kex_dh_keypair(struct kex *); int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **, -@@ -251,6 +274,12 @@ int kexgex_hash(int, const struct sshbuf *, const struct sshbuf *, +@@ -264,6 +287,12 @@ int kexgex_hash(int, const struct sshbuf *, const struct sshbuf *, const BIGNUM *, const u_char *, size_t, u_char *, size_t *); @@ -1586,7 +1397,7 @@ index c1084f214..0faab21b0 100644 break; case KEX_DH_GRP18_SHA512: diff --git a/kexgen.c b/kexgen.c -index 20f3c5711..ca704844e 100644 +index 40d688d62..15df591ca 100644 --- a/kexgen.c +++ b/kexgen.c @@ -44,7 +44,7 @@ @@ -2208,7 +2019,7 @@ index 000000000..2da431428 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */ diff --git a/kexgsss.c b/kexgsss.c new file mode 100644 -index 000000000..40d184170 +index 000000000..1fd1d1e48 --- /dev/null +++ b/kexgsss.c @@ -0,0 +1,478 @@ @@ -2310,7 +2121,7 @@ index 000000000..40d184170 + + debug2_f("Acquiring credentials"); + -+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) ++ if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, oid))) + fatal("Unable to acquire credentials for the server"); + + do { @@ -2362,8 +2173,8 @@ index 000000000..40d184170 + type); + } + -+ maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, -+ &send_tok, &ret_flags)); ++ maj_status = mm_ssh_gssapi_accept_ctx(ctxt, &recv_tok, ++ &send_tok, &ret_flags); + + gss_release_buffer(&min_status, &recv_tok); + @@ -2416,7 +2227,7 @@ index 000000000..40d184170 + gssbuf.value = hash; + gssbuf.length = hashlen; + -+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok)))) ++ if (GSS_ERROR(mm_ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))) + fatal("Couldn't get MIC"); + + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 || @@ -2506,7 +2317,7 @@ index 000000000..40d184170 + + debug2_f("Acquiring credentials"); + -+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid)))) ++ if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, oid))) + fatal("Unable to acquire credentials for the server"); + + /* 5. S generates an ephemeral key pair (do the allocations early) */ @@ -2532,7 +2343,7 @@ index 000000000..40d184170 + if (max < min || nbits < min || max < nbits) + fatal("GSS_GEX, bad parameters: %d !< %d !< %d", + min, nbits, max); -+ kex->dh = PRIVSEP(choose_dh(min, nbits, max)); ++ kex->dh = mm_choose_dh(min, nbits, max); + if (kex->dh == NULL) { + sshpkt_disconnect(ssh, "Protocol error: no matching group found"); + fatal("Protocol error: no matching group found"); @@ -2579,8 +2390,8 @@ index 000000000..40d184170 + type); + } + -+ maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok, -+ &send_tok, &ret_flags)); ++ maj_status = mm_ssh_gssapi_accept_ctx(ctxt, &recv_tok, ++ &send_tok, &ret_flags); + + gss_release_buffer(&min_status, &recv_tok); + @@ -2645,7 +2456,7 @@ index 000000000..40d184170 + gssbuf.value = hash; + gssbuf.length = hashlen; + -+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok)))) ++ if (GSS_ERROR(mm_ssh_gssapi_sign(ctxt, &gssbuf, &msg_tok))) + fatal("Couldn't get MIC"); + + if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_COMPLETE)) != 0 || @@ -2691,10 +2502,10 @@ index 000000000..40d184170 +} +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */ diff --git a/monitor.c b/monitor.c -index b3ed515ed..2bc152468 100644 +index 5966b4f96..ad7fef5a9 100644 --- a/monitor.c +++ b/monitor.c -@@ -142,6 +142,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *); +@@ -141,6 +141,8 @@ int mm_answer_gss_setup_ctx(struct ssh *, int, struct sshbuf *); int mm_answer_gss_accept_ctx(struct ssh *, int, struct sshbuf *); int mm_answer_gss_userok(struct ssh *, int, struct sshbuf *); int mm_answer_gss_checkmic(struct ssh *, int, struct sshbuf *); @@ -2733,7 +2544,7 @@ index b3ed515ed..2bc152468 100644 /* The first few requests do not require asynchronous access */ while (!authenticated) { -@@ -403,6 +416,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor) +@@ -408,6 +421,10 @@ monitor_child_postauth(struct ssh *ssh, struct monitor *pmonitor) monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1); monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1); monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1); @@ -2744,7 +2555,7 @@ index b3ed515ed..2bc152468 100644 if (auth_opts->permit_pty_flag) { monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); -@@ -1745,6 +1762,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) +@@ -1770,6 +1787,17 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) # ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; # endif @@ -2762,7 +2573,7 @@ index b3ed515ed..2bc152468 100644 #endif /* WITH_OPENSSL */ kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; -@@ -1837,8 +1865,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1863,8 +1891,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m) u_char *p; int r; @@ -2773,7 +2584,7 @@ index b3ed515ed..2bc152468 100644 if ((r = sshbuf_get_string(m, &p, &len)) != 0) fatal_fr(r, "parse"); -@@ -1870,8 +1898,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1896,8 +1924,8 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) OM_uint32 flags = 0; /* GSI needs this */ int r; @@ -2784,7 +2595,7 @@ index b3ed515ed..2bc152468 100644 if ((r = ssh_gssapi_get_buffer_desc(m, &in)) != 0) fatal_fr(r, "ssh_gssapi_get_buffer_desc"); -@@ -1891,6 +1919,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1917,6 +1945,7 @@ mm_answer_gss_accept_ctx(struct ssh *ssh, int sock, struct sshbuf *m) monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0); monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1); monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1); @@ -2792,7 +2603,7 @@ index b3ed515ed..2bc152468 100644 } return (0); } -@@ -1902,8 +1931,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1928,8 +1957,8 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) OM_uint32 ret; int r; @@ -2803,7 +2614,7 @@ index b3ed515ed..2bc152468 100644 if ((r = ssh_gssapi_get_buffer_desc(m, &gssbuf)) != 0 || (r = ssh_gssapi_get_buffer_desc(m, &mic)) != 0) -@@ -1929,13 +1958,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1955,13 +1984,17 @@ mm_answer_gss_checkmic(struct ssh *ssh, int sock, struct sshbuf *m) int mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) { @@ -2825,7 +2636,7 @@ index b3ed515ed..2bc152468 100644 sshbuf_reset(m); if ((r = sshbuf_put_u32(m, authenticated)) != 0) -@@ -1944,7 +1977,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1970,7 +2003,11 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) debug3_f("sending result %d", authenticated); mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m); @@ -2838,7 +2649,7 @@ index b3ed515ed..2bc152468 100644 if ((displayname = ssh_gssapi_displayname()) != NULL) auth2_record_info(authctxt, "%s", displayname); -@@ -1952,5 +1989,83 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1978,5 +2015,83 @@ mm_answer_gss_userok(struct ssh *ssh, int sock, struct sshbuf *m) /* Monitor loop will terminate if authenticated */ return (authenticated); } @@ -2924,7 +2735,7 @@ index b3ed515ed..2bc152468 100644 + +#endif /* GSSAPI */ diff --git a/monitor.h b/monitor.h -index 683e5e071..2b1a2d590 100644 +index fa48fc69b..7d8f3c6fa 100644 --- a/monitor.h +++ b/monitor.h @@ -63,6 +63,8 @@ enum monitor_reqtype { @@ -2937,10 +2748,10 @@ index 683e5e071..2b1a2d590 100644 struct ssh; diff --git a/monitor_wrap.c b/monitor_wrap.c -index 6270d1398..189467037 100644 +index 5358c77a1..cb3261b4d 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c -@@ -998,13 +998,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) +@@ -1054,13 +1054,15 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic) } int @@ -2957,7 +2768,7 @@ index 6270d1398..189467037 100644 mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, m); mm_request_receive_expect(pmonitor->m_recvfd, -@@ -1017,4 +1019,57 @@ mm_ssh_gssapi_userok(char *user) +@@ -1073,6 +1075,59 @@ mm_ssh_gssapi_userok(char *user) debug3_f("user %sauthenticated", authenticated ? "" : "not "); return (authenticated); } @@ -3015,11 +2826,13 @@ index 6270d1398..189467037 100644 +} + #endif /* GSSAPI */ + + /* diff --git a/monitor_wrap.h b/monitor_wrap.h -index 0df49c25b..830fdb308 100644 +index e768036ed..09b0ccaaa 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h -@@ -65,8 +65,10 @@ int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t, +@@ -64,8 +64,10 @@ void mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m); OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *); @@ -3032,7 +2845,7 @@ index 0df49c25b..830fdb308 100644 #ifdef USE_PAM diff --git a/readconf.c b/readconf.c -index 3a64a0441..91d3c0aa0 100644 +index 3d9cc6dbb..0ce392538 100644 --- a/readconf.c +++ b/readconf.c @@ -70,6 +70,7 @@ @@ -3075,7 +2888,7 @@ index 3a64a0441..91d3c0aa0 100644 #endif #ifdef ENABLE_PKCS11 { "pkcs11provider", oPKCS11Provider }, -@@ -1227,10 +1242,46 @@ parse_time: +@@ -1256,10 +1271,46 @@ parse_time: intptr = &options->gss_authentication; goto parse_flag; @@ -3122,7 +2935,7 @@ index 3a64a0441..91d3c0aa0 100644 case oBatchMode: intptr = &options->batch_mode; goto parse_flag; -@@ -2542,7 +2593,13 @@ initialize_options(Options * options) +@@ -2576,7 +2627,13 @@ initialize_options(Options * options) options->fwd_opts.streamlocal_bind_unlink = -1; options->pubkey_authentication = -1; options->gss_authentication = -1; @@ -3136,7 +2949,7 @@ index 3a64a0441..91d3c0aa0 100644 options->password_authentication = -1; options->kbd_interactive_authentication = -1; options->kbd_interactive_devices = NULL; -@@ -2705,8 +2762,18 @@ fill_default_options(Options * options) +@@ -2739,8 +2796,18 @@ fill_default_options(Options * options) options->pubkey_authentication = SSH_PUBKEY_AUTH_ALL; if (options->gss_authentication == -1) options->gss_authentication = 0; @@ -3155,7 +2968,7 @@ index 3a64a0441..91d3c0aa0 100644 if (options->password_authentication == -1) options->password_authentication = 1; if (options->kbd_interactive_authentication == -1) -@@ -3533,7 +3600,14 @@ dump_client_config(Options *o, const char *host) +@@ -3567,7 +3634,14 @@ dump_client_config(Options *o, const char *host) dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports); #ifdef GSSAPI dump_cfg_fmtint(oGssAuthentication, o->gss_authentication); @@ -3189,7 +3002,7 @@ index 9447d5d6e..f039c11bd 100644 * authentication. */ int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ diff --git a/servconf.c b/servconf.c -index 4b434909a..961cf9e45 100644 +index 89b8413e8..731f208be 100644 --- a/servconf.c +++ b/servconf.c @@ -68,6 +68,7 @@ @@ -3198,9 +3011,9 @@ index 4b434909a..961cf9e45 100644 #include "digest.h" +#include "ssh-gss.h" - static void add_listen_addr(ServerOptions *, const char *, - const char *, int); -@@ -134,8 +135,11 @@ initialize_server_options(ServerOptions *options) + #if !defined(SSHD_PAM_SERVICE) + # define SSHD_PAM_SERVICE "sshd" +@@ -137,8 +138,11 @@ initialize_server_options(ServerOptions *options) options->kerberos_ticket_cleanup = -1; options->kerberos_get_afs_token = -1; options->gss_authentication=-1; @@ -3212,7 +3025,7 @@ index 4b434909a..961cf9e45 100644 options->password_authentication = -1; options->kbd_interactive_authentication = -1; options->permit_empty_passwd = -1; -@@ -358,10 +362,18 @@ fill_default_server_options(ServerOptions *options) +@@ -378,10 +382,18 @@ fill_default_server_options(ServerOptions *options) options->kerberos_get_afs_token = 0; if (options->gss_authentication == -1) options->gss_authentication = 0; @@ -3231,15 +3044,15 @@ index 4b434909a..961cf9e45 100644 if (options->password_authentication == -1) options->password_authentication = 1; if (options->kbd_interactive_authentication == -1) -@@ -518,6 +530,7 @@ typedef enum { - sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize, +@@ -564,6 +576,7 @@ typedef enum { + sPerSourcePenalties, sPerSourcePenaltyExemptList, sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, + sGssKeyEx, sGssKexAlgorithms, sGssStoreRekey, sAcceptEnv, sSetEnv, sPermitTunnel, sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory, sUsePrivilegeSeparation, sAllowAgentForwarding, -@@ -600,12 +613,22 @@ static struct { +@@ -649,12 +662,22 @@ static struct { #ifdef GSSAPI { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, @@ -3262,7 +3075,7 @@ index 4b434909a..961cf9e45 100644 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, { "challengeresponseauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, /* alias */ -@@ -1618,6 +1641,10 @@ process_server_config_line_depth(ServerOptions *options, char *line, +@@ -1605,6 +1628,10 @@ process_server_config_line_depth(ServerOptions *options, char *line, intptr = &options->gss_authentication; goto parse_flag; @@ -3273,7 +3086,7 @@ index 4b434909a..961cf9e45 100644 case sGssCleanupCreds: intptr = &options->gss_cleanup_creds; goto parse_flag; -@@ -1626,6 +1653,22 @@ process_server_config_line_depth(ServerOptions *options, char *line, +@@ -1613,6 +1640,22 @@ process_server_config_line_depth(ServerOptions *options, char *line, intptr = &options->gss_strict_acceptor; goto parse_flag; @@ -3296,7 +3109,7 @@ index 4b434909a..961cf9e45 100644 case sPasswordAuthentication: intptr = &options->password_authentication; goto parse_flag; -@@ -3112,6 +3155,10 @@ dump_config(ServerOptions *o) +@@ -3204,6 +3247,10 @@ dump_config(ServerOptions *o) #ifdef GSSAPI dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); @@ -3308,10 +3121,10 @@ index 4b434909a..961cf9e45 100644 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); dump_cfg_fmtint(sKbdInteractiveAuthentication, diff --git a/servconf.h b/servconf.h -index ed7b72e8e..2ce4ae0ad 100644 +index 5089bc9ea..26819aa92 100644 --- a/servconf.h +++ b/servconf.h -@@ -139,8 +139,11 @@ typedef struct { +@@ -150,8 +150,11 @@ typedef struct { int kerberos_get_afs_token; /* If true, try to get AFS token if * authenticated with Kerberos. */ int gss_authentication; /* If true, permit GSSAPI authentication */ @@ -3324,10 +3137,10 @@ index ed7b72e8e..2ce4ae0ad 100644 * authentication. */ int kbd_interactive_authentication; /* If true, permit */ diff --git a/session.c b/session.c -index c821dcd44..cbb4edac5 100644 +index c9415114d..3d9a16b1e 100644 --- a/session.c +++ b/session.c -@@ -2687,13 +2687,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt) +@@ -2672,13 +2672,19 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt) #ifdef KRB5 if (options.kerberos_ticket_cleanup && @@ -3350,11 +3163,11 @@ index c821dcd44..cbb4edac5 100644 /* remove agent socket */ diff --git a/ssh-gss.h b/ssh-gss.h -index a8af117d2..6303ce185 100644 +index 7b14e74a8..0fd77cd45 100644 --- a/ssh-gss.h +++ b/ssh-gss.h @@ -1,6 +1,6 @@ - /* $OpenBSD: ssh-gss.h,v 1.15 2021/01/27 10:05:28 djm Exp $ */ + /* $OpenBSD: ssh-gss.h,v 1.16 2024/05/17 06:42:04 jsg Exp $ */ /* - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. @@ -3429,7 +3242,7 @@ index a8af117d2..6303ce185 100644 int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); -@@ -109,6 +138,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *); +@@ -108,6 +137,7 @@ OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *); struct sshbuf; int ssh_gssapi_get_buffer_desc(struct sshbuf *, gss_buffer_desc *); @@ -3437,7 +3250,7 @@ index a8af117d2..6303ce185 100644 OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *); OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int, -@@ -123,17 +153,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **); +@@ -122,17 +152,33 @@ void ssh_gssapi_delete_ctx(Gssctxt **); OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t); void ssh_gssapi_buildmic(struct sshbuf *, const char *, const char *, const char *, const struct sshbuf *); @@ -3588,10 +3401,10 @@ index 000000000..a934bda77 + +#endif /* GSSAPI */ diff --git a/ssh.1 b/ssh.1 -index 936c995ba..877c3bc64 100644 +index 710d3d4e6..8f78b3a1e 100644 --- a/ssh.1 +++ b/ssh.1 -@@ -536,7 +536,13 @@ For full details of the options listed below, and their possible values, see +@@ -538,7 +538,13 @@ For full details of the options listed below, and their possible values, see .It GatewayPorts .It GlobalKnownHostsFile .It GSSAPIAuthentication @@ -3605,7 +3418,7 @@ index 936c995ba..877c3bc64 100644 .It HashKnownHosts .It Host .It HostbasedAcceptedAlgorithms -@@ -624,6 +630,8 @@ flag), +@@ -626,6 +632,8 @@ flag), (supported message integrity codes), .Ar kex (key exchange algorithms), @@ -3652,7 +3465,7 @@ index cc5663562..16197d15d 100644 # CheckHostIP no # AddressFamily any diff --git a/ssh_config.5 b/ssh_config.5 -index 2931d807e..8e8aeb640 100644 +index 7c7c5c50d..4a48c5775 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -938,10 +938,67 @@ The default is @@ -3724,19 +3537,10 @@ index 2931d807e..8e8aeb640 100644 Indicates that .Xr ssh 1 diff --git a/sshconnect2.c b/sshconnect2.c -index 745c2a051..b7c376116 100644 +index 11fcdea8a..068da7f94 100644 --- a/sshconnect2.c +++ b/sshconnect2.c -@@ -80,8 +80,6 @@ - #endif - - /* import */ --extern char *client_version_string; --extern char *server_version_string; - extern Options options; - - /* -@@ -224,6 +222,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +@@ -222,6 +222,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, char *all_key, *hkalgs = NULL; int r, use_known_hosts_order = 0; @@ -3748,7 +3552,7 @@ index 745c2a051..b7c376116 100644 xxx_host = host; xxx_hostaddr = hostaddr; xxx_conn_info = cinfo; -@@ -259,6 +262,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +@@ -257,6 +262,42 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, free(hkalgs); @@ -3761,7 +3565,7 @@ index 745c2a051..b7c376116 100644 + if (options.gss_server_identity) { + gss_host = xstrdup(options.gss_server_identity); + } else if (options.gss_trust_dns) { -+ gss_host = remote_hostname(ssh); ++ gss_host = ssh_remote_hostname(ssh); + /* Fall back to specified host if we are using proxy command + * and can not use DNS on that socket */ + if (strcmp(gss_host, "UNKNOWN") == 0) { @@ -3791,7 +3595,7 @@ index 745c2a051..b7c376116 100644 /* start key exchange */ if ((r = kex_setup(ssh, myproposal)) != 0) fatal_r(r, "kex_setup"); -@@ -273,11 +312,31 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +@@ -271,12 +312,32 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, # ifdef OPENSSL_HAS_ECC ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; # endif @@ -3810,6 +3614,7 @@ index 745c2a051..b7c376116 100644 +#endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; + ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client; ssh->kex->verify_host_key=&verify_host_key_callback; +#if defined(GSSAPI) && defined(WITH_OPENSSL) @@ -3824,7 +3629,7 @@ index 745c2a051..b7c376116 100644 ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done); kex_proposal_free_entries(myproposal); -@@ -370,6 +429,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *); +@@ -369,6 +430,7 @@ static int input_gssapi_response(int type, u_int32_t, struct ssh *); static int input_gssapi_token(int type, u_int32_t, struct ssh *); static int input_gssapi_error(int, u_int32_t, struct ssh *); static int input_gssapi_errtok(int, u_int32_t, struct ssh *); @@ -3832,7 +3637,7 @@ index 745c2a051..b7c376116 100644 #endif void userauth(struct ssh *, char *); -@@ -386,6 +446,11 @@ static char *authmethods_get(void); +@@ -385,6 +447,11 @@ static char *authmethods_get(void); Authmethod authmethods[] = { #ifdef GSSAPI @@ -3844,7 +3649,7 @@ index 745c2a051..b7c376116 100644 {"gssapi-with-mic", userauth_gssapi, userauth_gssapi_cleanup, -@@ -757,12 +822,32 @@ userauth_gssapi(struct ssh *ssh) +@@ -756,12 +823,32 @@ userauth_gssapi(struct ssh *ssh) OM_uint32 min; int r, ok = 0; gss_OID mech = NULL; @@ -3853,7 +3658,7 @@ index 745c2a051..b7c376116 100644 + if (options.gss_server_identity) { + gss_host = xstrdup(options.gss_server_identity); + } else if (options.gss_trust_dns) { -+ gss_host = remote_hostname(ssh); ++ gss_host = ssh_remote_hostname(ssh); + /* Fall back to specified host if we are using proxy command + * and can not use DNS on that socket */ + if (strcmp(gss_host, "UNKNOWN") == 0) { @@ -3878,7 +3683,7 @@ index 745c2a051..b7c376116 100644 /* Check to see whether the mechanism is usable before we offer it */ while (authctxt->mech_tried < authctxt->gss_supported_mechs->count && -@@ -771,13 +856,15 @@ userauth_gssapi(struct ssh *ssh) +@@ -770,13 +857,15 @@ userauth_gssapi(struct ssh *ssh) elements[authctxt->mech_tried]; /* My DER encoding requires length<128 */ if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt, @@ -3895,7 +3700,7 @@ index 745c2a051..b7c376116 100644 if (!ok || mech == NULL) return 0; -@@ -1011,6 +1098,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh) +@@ -1010,6 +1099,55 @@ input_gssapi_error(int type, u_int32_t plen, struct ssh *ssh) free(lang); return r; } @@ -3951,11 +3756,22 @@ index 745c2a051..b7c376116 100644 #endif /* GSSAPI */ static int -diff --git a/sshd.c b/sshd.c -index b4f2b9742..d5c3dfe57 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -798,8 +798,8 @@ notify_hostkeys(struct ssh *ssh) +@@ -1319,7 +1457,9 @@ sign_and_send_pubkey(struct ssh *ssh, Identity *id) + + /* prefer host-bound pubkey signatures if supported by server */ + if ((ssh->kex->flags & KEX_HAS_PUBKEY_HOSTBOUND) != 0 && +- (options.pubkey_authentication & SSH_PUBKEY_AUTH_HBOUND) != 0) { ++ (options.pubkey_authentication & SSH_PUBKEY_AUTH_HBOUND) != 0 && ++ /* initial_hostkey may be NULL with GSS-API key exchange */ ++ ssh->kex->initial_hostkey != NULL) { + hostbound = 1; + method = "publickey-hostbound-v00@openssh.com"; + } +diff --git a/sshd-session.c b/sshd-session.c +index 4b79b9ba6..03a028c82 100644 +--- a/sshd-session.c ++++ b/sshd-session.c +@@ -658,8 +658,8 @@ notify_hostkeys(struct ssh *ssh) } debug3_f("sent %u hostkeys", nkeys); if (nkeys == 0) @@ -3966,17 +3782,7 @@ index b4f2b9742..d5c3dfe57 100644 sshpkt_fatal(ssh, r, "%s: send", __func__); sshbuf_free(buf); } -@@ -1930,7 +1930,8 @@ main(int ac, char **av) - free(fp); - } - accumulate_host_timing_secret(cfg, NULL); -- if (!sensitive_data.have_ssh2_key) { -+ /* The GSSAPI key exchange can run without a host key */ -+ if (!sensitive_data.have_ssh2_key && !options.gss_keyex) { - logit("sshd: no hostkeys available -- exiting."); - exit(1); - } -@@ -2402,6 +2403,48 @@ do_ssh2_kex(struct ssh *ssh) +@@ -1445,6 +1445,48 @@ do_ssh2_kex(struct ssh *ssh) free(hkalgs); @@ -4025,10 +3831,10 @@ index b4f2b9742..d5c3dfe57 100644 /* start key exchange */ if ((r = kex_setup(ssh, myproposal)) != 0) fatal_r(r, "kex_setup"); -@@ -2419,7 +2462,18 @@ do_ssh2_kex(struct ssh *ssh) - # ifdef OPENSSL_HAS_ECC +@@ -1462,7 +1504,18 @@ do_ssh2_kex(struct ssh *ssh) + #ifdef OPENSSL_HAS_ECC kex->kex[KEX_ECDH_SHA2] = kex_gen_server; - # endif + #endif -#endif +# ifdef GSSAPI + if (options.gss_keyex) { @@ -4044,7 +3850,21 @@ index b4f2b9742..d5c3dfe57 100644 +#endif /* WITH_OPENSSL */ kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; - kex->load_host_public_key=&get_hostkey_public_by_type; + kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; +diff --git a/sshd.c b/sshd.c +index df76dc78c..48b334c68 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -1558,7 +1558,8 @@ main(int ac, char **av) + free(fp); + } + accumulate_host_timing_secret(cfg, NULL); +- if (!sensitive_data.have_ssh2_key) { ++ /* The GSSAPI key exchange can run without a host key */ ++ if (!sensitive_data.have_ssh2_key && !options.gss_keyex) { + logit("sshd: no hostkeys available -- exiting."); + exit(1); + } diff --git a/sshd_config b/sshd_config index 36894ace5..ecfe8d026 100644 --- a/sshd_config @@ -4059,7 +3879,7 @@ index 36894ace5..ecfe8d026 100644 # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will diff --git a/sshd_config.5 b/sshd_config.5 -index a0f16874f..c0c1b0d9a 100644 +index dbed44f2a..6959d5f6c 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -739,6 +739,11 @@ Specifies whether to automatically destroy the user's credentials cache @@ -4107,10 +3927,10 @@ index a0f16874f..c0c1b0d9a 100644 Specifies the signature algorithms that will be accepted for hostbased authentication as a list of comma-separated patterns. diff --git a/sshkey.c b/sshkey.c -index d4356e72c..c7abbe298 100644 +index 1db83788d..c3acd4e09 100644 --- a/sshkey.c +++ b/sshkey.c -@@ -130,6 +130,9 @@ extern const struct sshkey_impl sshkey_dsa_cert_impl; +@@ -131,6 +131,9 @@ extern const struct sshkey_impl sshkey_dsa_cert_impl; extern const struct sshkey_impl sshkey_xmss_impl; extern const struct sshkey_impl sshkey_xmss_cert_impl; #endif @@ -4120,7 +3940,7 @@ index d4356e72c..c7abbe298 100644 const struct sshkey_impl * const keyimpls[] = { &sshkey_ed25519_impl, -@@ -169,6 +172,9 @@ const struct sshkey_impl * const keyimpls[] = { +@@ -170,6 +173,9 @@ const struct sshkey_impl * const keyimpls[] = { &sshkey_xmss_impl, &sshkey_xmss_cert_impl, #endif @@ -4130,7 +3950,7 @@ index d4356e72c..c7abbe298 100644 NULL }; -@@ -324,7 +330,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) +@@ -339,7 +345,7 @@ sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) for (i = 0; keyimpls[i] != NULL; i++) { impl = keyimpls[i]; @@ -4140,10 +3960,10 @@ index d4356e72c..c7abbe298 100644 if (!include_sigonly && impl->sigonly) continue; diff --git a/sshkey.h b/sshkey.h -index 708f2da86..dddb40fe2 100644 +index d0cdea0ce..cce4b93c0 100644 --- a/sshkey.h +++ b/sshkey.h -@@ -71,6 +71,7 @@ enum sshkey_types { +@@ -73,6 +73,7 @@ enum sshkey_types { KEY_ECDSA_SK_CERT, KEY_ED25519_SK, KEY_ED25519_SK_CERT, diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch index 3b207db..1c61c7c 100644 --- a/debian/patches/keepalive-extensions.patch +++ b/debian/patches/keepalive-extensions.patch @@ -1,4 +1,4 @@ -From 50a68a21649c42d5587e78cab2c63ee3add81dd4 Mon Sep 17 00:00:00 2001 +From d927628a5a54212ba64b7a703a25d63aab0fb3a3 Mon Sep 17 00:00:00 2001 From: Richard Kettlewell Date: Sun, 9 Feb 2014 16:09:52 +0000 Subject: Various keepalive extensions @@ -16,7 +16,7 @@ keepalives. Author: Ian Jackson Author: Matthew Vernon Author: Colin Watson -Last-Update: 2023-12-18 +Last-Update: 2024-09-13 Patch-Name: keepalive-extensions.patch --- @@ -26,7 +26,7 @@ Patch-Name: keepalive-extensions.patch 3 files changed, 34 insertions(+), 4 deletions(-) diff --git a/readconf.c b/readconf.c -index 0f0fb67a5..c6e609fca 100644 +index 08342f2a2..f78786964 100644 --- a/readconf.c +++ b/readconf.c @@ -182,6 +182,7 @@ typedef enum { @@ -46,16 +46,23 @@ index 0f0fb67a5..c6e609fca 100644 { NULL, oBadOption } }; -@@ -1886,6 +1889,8 @@ parse_pubkey_algos: +@@ -1166,6 +1169,7 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, + argv_consume(&ac); + break; + case oConnectTimeout: ++ case oSetupTimeOut: /* Debian-specific compatibility alias */ + intptr = &options->connection_timeout; + parse_time: + arg = argv_next(&ac, &av); +@@ -1908,6 +1912,7 @@ parse_pubkey_algos: goto parse_flag; case oServerAliveInterval: + case oProtocolKeepAlives: /* Debian-specific compatibility alias */ -+ case oSetupTimeOut: /* Debian-specific compatibility alias */ intptr = &options->server_alive_interval; goto parse_time; -@@ -2859,8 +2864,13 @@ fill_default_options(Options * options) +@@ -2893,8 +2898,13 @@ fill_default_options(Options * options) options->rekey_interval = 0; if (options->verify_host_key_dns == -1) options->verify_host_key_dns = 0; @@ -72,7 +79,7 @@ index 0f0fb67a5..c6e609fca 100644 options->server_alive_count_max = 3; if (options->control_master == -1) diff --git a/ssh_config.5 b/ssh_config.5 -index 8e8aeb640..6b482ee15 100644 +index 4a48c5775..31142f8c5 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -297,9 +297,13 @@ If set to @@ -90,7 +97,16 @@ index 8e8aeb640..6b482ee15 100644 The argument must be .Cm yes or -@@ -1923,7 +1927,14 @@ from the server, +@@ -620,6 +624,8 @@ Specifies the timeout (in seconds) used when connecting to the + SSH server, instead of using the default system TCP timeout. + This timeout is applied both to establishing the connection and to performing + the initial SSH protocol handshake and key exchange. ++.Cm SetupTimeOut ++is a Debian-specific compatibility alias for this option. + .It Cm ControlMaster + Enables the sharing of multiple sessions over a single network connection. + When set to +@@ -1933,7 +1939,12 @@ from the server, will send a message through the encrypted channel to request a response from the server. The default @@ -100,13 +116,11 @@ index 8e8aeb640..6b482ee15 100644 +.Cm BatchMode +option is set (Debian-specific). +.Cm ProtocolKeepAlives -+and -+.Cm SetupTimeOut -+are Debian-specific compatibility aliases for this option. ++is a Debian-specific compatibility alias for this option. .It Cm SessionType May be used to either request invocation of a subsystem on the remote system, or to prevent the execution of a remote command at all. -@@ -2037,6 +2048,12 @@ Specifies whether the system should send TCP keepalive messages to the +@@ -2047,6 +2058,12 @@ Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. @@ -120,10 +134,10 @@ index 8e8aeb640..6b482ee15 100644 connections will die if the route is down temporarily, and some people find it annoying. diff --git a/sshd_config.5 b/sshd_config.5 -index c0c1b0d9a..e06ef8abd 100644 +index 6959d5f6c..11a8e922f 100644 --- a/sshd_config.5 +++ b/sshd_config.5 -@@ -1859,6 +1859,9 @@ This avoids infinitely hanging sessions. +@@ -1984,6 +1984,9 @@ This avoids infinitely hanging sessions. .Pp To disable TCP keepalive messages, the value should be set to .Cm no . diff --git a/debian/patches/maxhostnamelen.patch b/debian/patches/maxhostnamelen.patch deleted file mode 100644 index bd5733b..0000000 --- a/debian/patches/maxhostnamelen.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 8bc03da34ff88845e6b10631719f872e81eaea74 Mon Sep 17 00:00:00 2001 -From: Svante Signell -Date: Fri, 5 Nov 2021 23:22:53 +0000 -Subject: Define MAXHOSTNAMELEN on GNU/Hurd - -Bug-Debian: https://bugs.debian.org/997030 -Last-Update: 2021-11-05 - -Patch-Name: maxhostnamelen.patch ---- - defines.h | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/defines.h b/defines.h -index 279e509aa..7225cbfab 100644 ---- a/defines.h -+++ b/defines.h -@@ -136,6 +136,12 @@ enum - # endif - #endif /* HOST_NAME_MAX */ - -+#ifndef MAXHOSTNAMELEN -+# if defined(_POSIX_HOST_NAME_MAX) -+# define MAXHOSTNAMELEN _POSIX_HOST_NAME_MAX -+# endif -+#endif /* MAXHOSTNAMELEN */ -+ - #if defined(HAVE_DECL_MAXSYMLINKS) && HAVE_DECL_MAXSYMLINKS == 0 - # define MAXSYMLINKS 5 - #endif diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch index a26d2b1..b0e9297 100644 --- a/debian/patches/mention-ssh-keygen-on-keychange.patch +++ b/debian/patches/mention-ssh-keygen-on-keychange.patch @@ -1,4 +1,4 @@ -From 60c7e9102d69c1b2a50fd58c9a322d8e6d1d2117 Mon Sep 17 00:00:00 2001 +From 32e848548c722c9db2bf3ae50b1f13f1fd45619c Mon Sep 17 00:00:00 2001 From: Scott Moser Date: Sun, 9 Feb 2014 16:10:03 +0000 Subject: Mention ssh-keygen in ssh fingerprint changed warning @@ -14,10 +14,10 @@ Patch-Name: mention-ssh-keygen-on-keychange.patch 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sshconnect.c b/sshconnect.c -index 1d5bcc782..23f79ed2b 100644 +index 1b7e804fb..cbfc20735 100644 --- a/sshconnect.c +++ b/sshconnect.c -@@ -1277,9 +1277,13 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo, +@@ -1307,9 +1307,13 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo, error("%s. This could either mean that", key_msg); error("DNS SPOOFING is happening or the IP address for the host"); error("and its host key have changed at the same time."); @@ -32,7 +32,7 @@ index 1d5bcc782..23f79ed2b 100644 } /* The host key has changed. */ warn_changed_key(host_key); -@@ -1291,6 +1295,9 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo, +@@ -1321,6 +1325,9 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo, error("Offending %s key in %s:%lu", sshkey_type(host_found->key), host_found->file, host_found->line); diff --git a/debian/patches/mlkem768x25519-big-endian-1.patch b/debian/patches/mlkem768x25519-big-endian-1.patch new file mode 100644 index 0000000..7201e43 --- /dev/null +++ b/debian/patches/mlkem768x25519-big-endian-1.patch @@ -0,0 +1,96 @@ +From 15cbef581b3fec7ec182fad1c3cb874c60ca01b6 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 27 Oct 2024 02:06:01 +0000 +Subject: upstream: fix ML-KEM768x25519 KEX on big-endian systems; spotted by + +jsg@ feedback/ok deraadt@ + +OpenBSD-Commit-ID: 26d81a430811672bc762687166986cad40d28cc0 + +Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?h=V_9_9&id=11f348196b3fb51c3d8d1f4f36db9d73f03149ed +Last-Update: 2024-10-27 + +Patch-Name: mlkem768x25519-big-endian-1.patch +--- + libcrux_mlkem768_sha3.h | 8 +++++--- + mlkem768.sh | 17 ++++++++++++----- + 2 files changed, 17 insertions(+), 8 deletions(-) + +diff --git a/libcrux_mlkem768_sha3.h b/libcrux_mlkem768_sha3.h +index a82d60e83..b8ac1436f 100644 +--- a/libcrux_mlkem768_sha3.h ++++ b/libcrux_mlkem768_sha3.h +@@ -1,4 +1,5 @@ +-/* $OpenBSD: libcrux_mlkem768_sha3.h,v 1.1 2024/09/02 12:13:56 djm Exp $ */ ++/* $OpenBSD: libcrux_mlkem768_sha3.h,v 1.2 2024/10/27 02:06:01 djm Exp $ */ ++ + /* Extracted from libcrux revision 84c5d87b3092c59294345aa269ceefe0eb97cc35 */ + + /* +@@ -160,18 +161,19 @@ static inline void Eurydice_slice_to_array3(uint8_t *dst_tag, char *dst_ok, + // CORE STUFF (conversions, endianness, ...) + + static inline void core_num__u64_9__to_le_bytes(uint64_t v, uint8_t buf[8]) { ++ v = htole64(v); + memcpy(buf, &v, sizeof(v)); + } + static inline uint64_t core_num__u64_9__from_le_bytes(uint8_t buf[8]) { + uint64_t v; + memcpy(&v, buf, sizeof(v)); +- return v; ++ return le64toh(v); + } + + static inline uint32_t core_num__u32_8__from_le_bytes(uint8_t buf[4]) { + uint32_t v; + memcpy(&v, buf, sizeof(v)); +- return v; ++ return le32toh(v); + } + + static inline uint32_t core_num__u8_6__count_ones(uint8_t x0) { +diff --git a/mlkem768.sh b/mlkem768.sh +index 2fdc28312..3d12b2ed8 100644 +--- a/mlkem768.sh ++++ b/mlkem768.sh +@@ -1,9 +1,10 @@ + #!/bin/sh +-# $OpenBSD: mlkem768.sh,v 1.2 2024/09/04 05:11:33 djm Exp $ ++# $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $ + # Placed in the Public Domain. + # + +-WANT_LIBCRUX_REVISION="origin/main" ++#WANT_LIBCRUX_REVISION="origin/main" ++WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35" + + FILES=" + libcrux/libcrux-ml-kem/cg/eurydice_glue.h +@@ -47,6 +48,7 @@ echo '#define KRML_NOINLINE __attribute__((noinline, unused))' + echo '#define KRML_HOST_EPRINTF(...)' + echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")' + echo ++ + for i in $FILES; do + echo "/* from $i */" + # Changes to all files: +@@ -56,11 +58,16 @@ for i in $FILES; do + -e 's/[ ]*$//' \ + $i | \ + case "$i" in +- # XXX per-file handling goes here. ++ */libcrux-ml-kem/cg/eurydice_glue.h) ++ # Replace endian functions with versions that work. ++ perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1 v = htole64(v);\n\2/' | ++ perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' | ++ perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s' ++ ;; + # Default: pass through. + *) +- cat +- ;; ++ cat ++ ;; + esac + echo + done diff --git a/debian/patches/mlkem768x25519-big-endian-2.patch b/debian/patches/mlkem768x25519-big-endian-2.patch new file mode 100644 index 0000000..b541dbd --- /dev/null +++ b/debian/patches/mlkem768x25519-big-endian-2.patch @@ -0,0 +1,35 @@ +From b966dccd427fba8f70e77cb1bed10e8f7393b3e3 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 27 Oct 2024 02:06:59 +0000 +Subject: upstream: explicitly include endian.h + +OpenBSD-Commit-ID: 13511fdef7535bdbc35b644c90090013da43a318 + +Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?h=V_9_9&id=fe8d28a7ebbaa35cfc04a21263627f05c237e460 +Last-Update: 2024-10-27 + +Patch-Name: mlkem768x25519-big-endian-2.patch +--- + kexmlkem768x25519.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c +index 679446e97..2b5d39608 100644 +--- a/kexmlkem768x25519.c ++++ b/kexmlkem768x25519.c +@@ -1,4 +1,4 @@ +-/* $OpenBSD: kexmlkem768x25519.c,v 1.1 2024/09/02 12:13:56 djm Exp $ */ ++/* $OpenBSD: kexmlkem768x25519.c,v 1.2 2024/10/27 02:06:59 djm Exp $ */ + /* + * Copyright (c) 2023 Markus Friedl. All rights reserved. + * +@@ -34,6 +34,9 @@ + #include + #include + #include ++#ifdef HAVE_ENDIAN_H ++# include ++#endif + + #include "sshkey.h" + #include "kex.h" diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch index 1fc4765..8db7ff6 100644 --- a/debian/patches/no-openssl-version-status.patch +++ b/debian/patches/no-openssl-version-status.patch @@ -1,4 +1,4 @@ -From 03ba0382a8ac499aba50aa0203d89586fa785628 Mon Sep 17 00:00:00 2001 +From 30154cd7eb49b9a5dafbdfd2d730fde5d2a9ea16 Mon Sep 17 00:00:00 2001 From: Kurt Roeckx Date: Sun, 9 Feb 2014 16:10:14 +0000 Subject: Don't check the status field of the OpenSSL version @@ -23,7 +23,7 @@ Patch-Name: no-openssl-version-status.patch 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c -index 6c65003f2..30e97c464 100644 +index 14865077e..0cea08c03 100644 --- a/openbsd-compat/openssl-compat.c +++ b/openbsd-compat/openssl-compat.c @@ -49,18 +49,18 @@ ssh_compatible_openssl(long headerver, long libver) diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch index b8eb435..9947dd5 100644 --- a/debian/patches/openbsd-docs.patch +++ b/debian/patches/openbsd-docs.patch @@ -1,4 +1,4 @@ -From 5ec3ad9b1f13f624244f7dea20d43e8972ce9e97 Mon Sep 17 00:00:00 2001 +From e868160317622303dd192460a186162dfa4b6c2e Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:09 +0000 Subject: Adjust various OpenBSD-specific references in manual pages @@ -6,21 +6,18 @@ Subject: Adjust various OpenBSD-specific references in manual pages No single bug reference for this patch, but history includes: https://bugs.debian.org/154434 (login.conf(5)) https://bugs.debian.org/513417 (/etc/rc) - https://bugs.debian.org/530692 (ssl(8)) - https://bugs.launchpad.net/bugs/456660 (ssl(8)) https://bugs.debian.org/998069 (rdomain(4)) Forwarded: not-needed -Last-Update: 2023-09-02 +Last-Update: 2024-07-03 Patch-Name: openbsd-docs.patch --- moduli.5 | 4 ++-- ssh-keygen.1 | 12 ++++-------- - ssh.1 | 4 ++++ sshd.8 | 5 ++--- sshd_config.5 | 40 ++-------------------------------------- - 5 files changed, 14 insertions(+), 51 deletions(-) + 4 files changed, 10 insertions(+), 51 deletions(-) diff --git a/moduli.5 b/moduli.5 index 5086a6d42..6dffdc7e6 100644 @@ -45,10 +42,10 @@ index 5086a6d42..6dffdc7e6 100644 .Sh SEE ALSO .Xr ssh-keygen 1 , diff --git a/ssh-keygen.1 b/ssh-keygen.1 -index c392141ea..1155cf555 100644 +index 06f0555a4..76239bcdf 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 -@@ -212,9 +212,7 @@ key in +@@ -211,9 +211,7 @@ key in .Pa ~/.ssh/id_ed25519_sk or .Pa ~/.ssh/id_rsa . @@ -59,7 +56,7 @@ index c392141ea..1155cf555 100644 .Pp Normally this program generates the key and asks for a file in which to store the private key. -@@ -279,9 +277,7 @@ If +@@ -278,9 +276,7 @@ If .Fl f has also been specified, its argument is used as a prefix to the default path for the resulting host key files. @@ -70,7 +67,7 @@ index c392141ea..1155cf555 100644 .It Fl a Ar rounds When saving a private key, this option specifies the number of KDF (key derivation function, currently -@@ -864,7 +860,7 @@ option. +@@ -860,7 +856,7 @@ option. Valid generator values are 2, 3, and 5. .Pp Screened DH groups may be installed in @@ -79,7 +76,7 @@ index c392141ea..1155cf555 100644 It is important that this file contains moduli of a range of bit lengths. .Pp A number of options are available for moduli generation and screening via the -@@ -1322,7 +1318,7 @@ on all machines +@@ -1316,7 +1312,7 @@ on all machines where the user wishes to log in using public key authentication. There is no need to keep the contents of this file secret. .Pp @@ -88,23 +85,8 @@ index c392141ea..1155cf555 100644 Contains Diffie-Hellman groups used for DH-GEX. The file format is described in .Xr moduli 5 . -diff --git a/ssh.1 b/ssh.1 -index 2d07c919e..60e97dc62 100644 ---- a/ssh.1 -+++ b/ssh.1 -@@ -939,6 +939,10 @@ implements public key authentication protocol automatically, - using one of the DSA, ECDSA, Ed25519 or RSA algorithms. - The HISTORY section of - .Xr ssl 8 -+(on non-OpenBSD systems, see -+.nh -+http://www.openbsd.org/cgi\-bin/man.cgi?query=ssl&sektion=8#HISTORY) -+.hy - contains a brief discussion of the DSA and RSA algorithms. - .Pp - The file diff --git a/sshd.8 b/sshd.8 -index 8efeacdf1..6527e28a3 100644 +index 464d402f6..bd1117bfe 100644 --- a/sshd.8 +++ b/sshd.8 @@ -64,7 +64,7 @@ over an insecure network. @@ -116,7 +98,7 @@ index 8efeacdf1..6527e28a3 100644 It forks a new daemon for each incoming connection. The forked daemons handle -@@ -935,7 +935,7 @@ This file is for host-based authentication (see +@@ -936,7 +936,7 @@ This file is for host-based authentication (see .Xr ssh 1 ) . It should only be writable by root. .Pp @@ -125,7 +107,7 @@ index 8efeacdf1..6527e28a3 100644 Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" key exchange method. The file format is described in -@@ -1033,7 +1033,6 @@ The content of this file is not sensitive; it can be world-readable. +@@ -1034,7 +1034,6 @@ The content of this file is not sensitive; it can be world-readable. .Xr ssh-keyscan 1 , .Xr chroot 2 , .Xr hosts_access 5 , @@ -134,7 +116,7 @@ index 8efeacdf1..6527e28a3 100644 .Xr sshd_config 5 , .Xr inetd 8 , diff --git a/sshd_config.5 b/sshd_config.5 -index 1a8febfa6..0e8891c4f 100644 +index ed2f74060..e177e4af8 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -1001,9 +1001,6 @@ for interactive sessions and @@ -147,7 +129,7 @@ index 1a8febfa6..0e8891c4f 100644 The default is .Cm yes . The argument to this keyword must be -@@ -1107,45 +1104,33 @@ The following forms may be used: +@@ -1117,45 +1114,33 @@ The following forms may be used: .Sm off .Ar hostname | address .Sm on @@ -194,7 +176,7 @@ index 1a8febfa6..0e8891c4f 100644 .It Cm LoginGraceTime The server disconnects after this time if the user has not successfully logged in. -@@ -1271,14 +1256,8 @@ The available criteria are +@@ -1283,14 +1268,8 @@ The available criteria are .Cm Host , .Cm LocalAddress , .Cm LocalPort , @@ -210,15 +192,15 @@ index 1a8febfa6..0e8891c4f 100644 .Pp The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the -@@ -1350,7 +1329,6 @@ Available keywords are - .Cm PubkeyAuthOptions , +@@ -1364,7 +1343,6 @@ Available keywords are + .Cm RefuseConnection , .Cm RekeyLimit , .Cm RevokedKeys , -.Cm RDomain , .Cm SetEnv , .Cm StreamLocalBindMask , .Cm StreamLocalBindUnlink , -@@ -1745,15 +1723,6 @@ an OpenSSH Key Revocation List (KRL) as generated by +@@ -1863,15 +1841,6 @@ an OpenSSH Key Revocation List (KRL) as generated by .Xr ssh-keygen 1 . For more information on KRLs, see the KEY REVOCATION LISTS section in .Xr ssh-keygen 1 . @@ -234,7 +216,7 @@ index 1a8febfa6..0e8891c4f 100644 .It Cm SecurityKeyProvider Specifies a path to a library that will be used when loading FIDO authenticator-hosted keys, overriding the default of using -@@ -2080,8 +2049,6 @@ A literal +@@ -2205,8 +2174,6 @@ A literal Identifies the connection endpoints, containing four space-separated values: client address, client port number, server address, and server port number. @@ -243,7 +225,7 @@ index 1a8febfa6..0e8891c4f 100644 .It %F The fingerprint of the CA key. .It %f -@@ -2120,9 +2087,6 @@ accepts the tokens %%, %h, %U, and %u. +@@ -2245,9 +2212,6 @@ accepts the tokens %%, %h, %U, and %u. .Pp .Cm ChrootDirectory accepts the tokens %%, %h, %U, and %u. diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch index 1a81e91..dc02110 100644 --- a/debian/patches/package-versioning.patch +++ b/debian/patches/package-versioning.patch @@ -1,4 +1,4 @@ -From eb68bf3cb81031d4a765b9c7745842bb49b7b3bb Mon Sep 17 00:00:00 2001 +From 5aeb7a317738bafded850091cb310274388d498f Mon Sep 17 00:00:00 2001 From: Matthew Vernon Date: Sun, 9 Feb 2014 16:10:05 +0000 Subject: Include the Debian version in our identification @@ -18,10 +18,10 @@ Patch-Name: package-versioning.patch 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/kex.c b/kex.c -index e4a2362bd..4e988e39b 100644 +index f09e79e6b..19b1fcaa8 100644 --- a/kex.c +++ b/kex.c -@@ -1563,7 +1563,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms, +@@ -1255,7 +1255,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms, if (version_addendum != NULL && *version_addendum == '\0') version_addendum = NULL; if ((r = sshbuf_putf(our_version, "SSH-%d.%d-%s%s%s\r\n", @@ -31,11 +31,11 @@ index e4a2362bd..4e988e39b 100644 version_addendum == NULL ? "" : version_addendum)) != 0) { oerrno = errno; diff --git a/version.h b/version.h -index 052a5817b..0124a77d3 100644 +index 8c7e37e7d..7e0cac99f 100644 --- a/version.h +++ b/version.h @@ -3,4 +3,9 @@ - #define SSH_VERSION "OpenSSH_9.7" + #define SSH_VERSION "OpenSSH_9.9" #define SSH_PORTABLE "p1" -#define SSH_RELEASE SSH_VERSION SSH_PORTABLE diff --git a/debian/patches/pam-avoid-unknown-host.patch b/debian/patches/pam-avoid-unknown-host.patch new file mode 100644 index 0000000..d6cdb4a --- /dev/null +++ b/debian/patches/pam-avoid-unknown-host.patch @@ -0,0 +1,34 @@ +From 2308e489f6a8aae2087c68eb5c33d19cdbbdf4ba Mon Sep 17 00:00:00 2001 +From: Daan De Meyer +Date: Mon, 20 Mar 2023 20:22:14 +0100 +Subject: Only set PAM_RHOST if the remote host is not "UNKNOWN" + +When using sshd's -i option with stdio that is not a AF_INET/AF_INET6 +socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then +set as the value of PAM_RHOST, causing pam to try to do a reverse DNS +query of "UNKNOWN", which times out multiple times, causing a +substantial slowdown when logging in. + +To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN". + +Author: Daan De Meyer +Last-Update: 2024-04-03 + +Patch-Name: pam-avoid-unknown-host.patch +--- + auth-pam.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/auth-pam.c b/auth-pam.c +index 13c0a792e..b22883b95 100644 +--- a/auth-pam.c ++++ b/auth-pam.c +@@ -735,7 +735,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt) + sshpam_laddr = get_local_ipaddr( + ssh_packet_get_connection_in(ssh)); + } +- if (sshpam_rhost != NULL) { ++ if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) { + debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost); + sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, + sshpam_rhost); diff --git a/debian/patches/regress-conch-dev-zero.patch b/debian/patches/regress-conch-dev-zero.patch index bdf1449..3825c86 100644 --- a/debian/patches/regress-conch-dev-zero.patch +++ b/debian/patches/regress-conch-dev-zero.patch @@ -1,4 +1,4 @@ -From 6bd1413e583b16d600b39b15203b5b78a4e77f0a Mon Sep 17 00:00:00 2001 +From 8e6bbc0c94cd203b23c13c344f46d47cfd19f31d Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 31 Mar 2024 00:24:11 +0000 Subject: regress: Redirect conch stdin from /dev/zero diff --git a/debian/patches/restore-authorized_keys2.patch b/debian/patches/restore-authorized_keys2.patch index 9e540cf..5020275 100644 --- a/debian/patches/restore-authorized_keys2.patch +++ b/debian/patches/restore-authorized_keys2.patch @@ -1,4 +1,4 @@ -From 06af6b2c9be423445bab0c964f4e85f439a91278 Mon Sep 17 00:00:00 2001 +From d6bfcde360768009d66ecc052fa5d3e1a89fa5ce Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 5 Mar 2017 02:02:11 +0000 Subject: Restore reading authorized_keys2 by default diff --git a/debian/patches/restore-tcp-wrappers.patch b/debian/patches/restore-tcp-wrappers.patch index ee53872..5c57063 100644 --- a/debian/patches/restore-tcp-wrappers.patch +++ b/debian/patches/restore-tcp-wrappers.patch @@ -1,4 +1,4 @@ -From f6856e554804e6bd6c93fb48bea73a26f912ad7f Mon Sep 17 00:00:00 2001 +From c4f6a4d2c7ce9dcd29df3d447e7bc8ddf1b5c592 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Tue, 7 Oct 2014 13:22:41 +0100 Subject: Restore TCP wrappers support @@ -18,20 +18,20 @@ but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed -Last-Update: 2022-02-23 +Last-Update: 2024-08-02 Patch-Name: restore-tcp-wrappers.patch --- - configure.ac | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++ - sshd.8 | 7 +++++++ - sshd.c | 25 +++++++++++++++++++++++ + configure.ac | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++ + sshd-session.c | 25 ++++++++++++++++++++++ + sshd.8 | 7 +++++++ 3 files changed, 89 insertions(+) diff --git a/configure.ac b/configure.ac -index bb3e644fe..2b2c4f086 100644 +index 6a0140a9d..90548dcfc 100644 --- a/configure.ac +++ b/configure.ac -@@ -1685,6 +1685,62 @@ else +@@ -1693,6 +1693,62 @@ else AC_MSG_RESULT([no]) fi @@ -94,7 +94,7 @@ index bb3e644fe..2b2c4f086 100644 # Check whether user wants to use ldns LDNS_MSG="no" AC_ARG_WITH(ldns, -@@ -5707,6 +5763,7 @@ echo " PAM support: $PAM_MSG" +@@ -5734,6 +5790,7 @@ echo " PAM support: $PAM_MSG" echo " OSF SIA support: $SIA_MSG" echo " KerberosV support: $KRB5_MSG" echo " SELinux support: $SELINUX_MSG" @@ -102,36 +102,11 @@ index bb3e644fe..2b2c4f086 100644 echo " libedit support: $LIBEDIT_MSG" echo " libldns support: $LDNS_MSG" echo " Solaris process contract support: $SPC_MSG" -diff --git a/sshd.8 b/sshd.8 -index 73d5e9232..8efeacdf1 100644 ---- a/sshd.8 -+++ b/sshd.8 -@@ -924,6 +924,12 @@ the user's home directory becomes accessible. - This file should be writable only by the user, and need not be - readable by anyone else. - .Pp -+.It Pa /etc/hosts.allow -+.It Pa /etc/hosts.deny -+Access controls that should be enforced by tcp-wrappers are defined here. -+Further details are described in -+.Xr hosts_access 5 . -+.Pp - .It Pa /etc/hosts.equiv - This file is for host-based authentication (see - .Xr ssh 1 ) . -@@ -1026,6 +1032,7 @@ The content of this file is not sensitive; it can be world-readable. - .Xr ssh-keygen 1 , - .Xr ssh-keyscan 1 , - .Xr chroot 2 , -+.Xr hosts_access 5 , - .Xr login.conf 5 , - .Xr moduli 5 , - .Xr sshd_config 5 , -diff --git a/sshd.c b/sshd.c -index d5c3dfe57..87e25d19b 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -128,6 +128,13 @@ +diff --git a/sshd-session.c b/sshd-session.c +index 03a028c82..f36d58b1b 100644 +--- a/sshd-session.c ++++ b/sshd-session.c +@@ -110,6 +110,13 @@ #include "srclimit.h" #include "dh.h" @@ -145,7 +120,7 @@ index d5c3dfe57..87e25d19b 100644 /* Re-exec fds */ #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) -@@ -2200,6 +2207,24 @@ main(int ac, char **av) +@@ -1256,6 +1263,24 @@ main(int ac, char **av) #ifdef SSH_AUDIT_EVENTS audit_connection_from(remote_ip, remote_port); #endif @@ -156,7 +131,7 @@ index d5c3dfe57..87e25d19b 100644 + if (ssh_packet_connection_is_on_socket(ssh)) { + struct request_info req; + -+ request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); ++ request_init(&req, RQ_DAEMON, "sshd", RQ_FILE, sock_in, 0); + fromhost(&req); + + if (!hosts_access(&req)) { @@ -170,3 +145,28 @@ index d5c3dfe57..87e25d19b 100644 rdomain = ssh_packet_rdomain_in(ssh); +diff --git a/sshd.8 b/sshd.8 +index 08ebf53a1..464d402f6 100644 +--- a/sshd.8 ++++ b/sshd.8 +@@ -925,6 +925,12 @@ the user's home directory becomes accessible. + This file should be writable only by the user, and need not be + readable by anyone else. + .Pp ++.It Pa /etc/hosts.allow ++.It Pa /etc/hosts.deny ++Access controls that should be enforced by tcp-wrappers are defined here. ++Further details are described in ++.Xr hosts_access 5 . ++.Pp + .It Pa /etc/hosts.equiv + This file is for host-based authentication (see + .Xr ssh 1 ) . +@@ -1027,6 +1033,7 @@ The content of this file is not sensitive; it can be world-readable. + .Xr ssh-keygen 1 , + .Xr ssh-keyscan 1 , + .Xr chroot 2 , ++.Xr hosts_access 5 , + .Xr login.conf 5 , + .Xr moduli 5 , + .Xr sshd_config 5 , diff --git a/debian/patches/revert-ipqos-defaults.patch b/debian/patches/revert-ipqos-defaults.patch index 0b33aee..cf61453 100644 --- a/debian/patches/revert-ipqos-defaults.patch +++ b/debian/patches/revert-ipqos-defaults.patch @@ -1,4 +1,4 @@ -From d9fbfaf30a64cff9b4fdad1ff0974e239f29f7db Mon Sep 17 00:00:00 2001 +From bef41555f2e735bffe89e91d4e9f5b4b157d7663 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 8 Apr 2019 10:46:29 +0100 Subject: Revert "upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP @@ -24,10 +24,10 @@ Patch-Name: revert-ipqos-defaults.patch 4 files changed, 8 insertions(+), 12 deletions(-) diff --git a/readconf.c b/readconf.c -index 720062bcc..f1d4566e2 100644 +index 90bf74f32..a321e6d8f 100644 --- a/readconf.c +++ b/readconf.c -@@ -2891,9 +2891,9 @@ fill_default_options(Options * options) +@@ -2925,9 +2925,9 @@ fill_default_options(Options * options) if (options->visual_host_key == -1) options->visual_host_key = 0; if (options->ip_qos_interactive == -1) @@ -40,10 +40,10 @@ index 720062bcc..f1d4566e2 100644 options->request_tty = REQUEST_TTY_AUTO; if (options->session_type == -1) diff --git a/servconf.c b/servconf.c -index 12aa1f4ad..23828a62d 100644 +index 49a066df8..3c7ca3287 100644 --- a/servconf.c +++ b/servconf.c -@@ -439,9 +439,9 @@ fill_default_server_options(ServerOptions *options) +@@ -483,9 +483,9 @@ fill_default_server_options(ServerOptions *options) if (options->permit_tun == -1) options->permit_tun = SSH_TUNMODE_NO; if (options->ip_qos_interactive == -1) @@ -56,10 +56,10 @@ index 12aa1f4ad..23828a62d 100644 options->version_addendum = xstrdup(""); if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1) diff --git a/ssh_config.5 b/ssh_config.5 -index c2789a09d..a793b1ddb 100644 +index 9adc0fdb7..14042dce5 100644 --- a/ssh_config.5 +++ b/ssh_config.5 -@@ -1323,11 +1323,9 @@ If one argument is specified, it is used as the packet class unconditionally. +@@ -1329,11 +1329,9 @@ If one argument is specified, it is used as the packet class unconditionally. If two values are specified, the first is automatically selected for interactive sessions and the second for non-interactive sessions. The default is @@ -74,7 +74,7 @@ index c2789a09d..a793b1ddb 100644 .It Cm KbdInteractiveAuthentication Specifies whether to use keyboard-interactive authentication. diff --git a/sshd_config.5 b/sshd_config.5 -index 12083e839..beb12acef 100644 +index 2887ed531..70d57bfdb 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -1022,11 +1022,9 @@ If one argument is specified, it is used as the packet class unconditionally. diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch index f450ef7..c564c14 100644 --- a/debian/patches/scp-quoting.patch +++ b/debian/patches/scp-quoting.patch @@ -1,4 +1,4 @@ -From 5c274c836094e9091ebad95435d79780a4316020 Mon Sep 17 00:00:00 2001 +From 7df75a1b544e1ac75377d4968b1171e005a3625e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= Date: Sun, 9 Feb 2014 16:09:59 +0000 Subject: Adjust scp quoting in verbose mode @@ -17,10 +17,10 @@ Patch-Name: scp-quoting.patch 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/scp.c b/scp.c -index 492dace12..49c86b66c 100644 +index 0779c3c2b..4f8c691b3 100644 --- a/scp.c +++ b/scp.c -@@ -239,8 +239,16 @@ do_local_cmd(arglist *a) +@@ -241,8 +241,16 @@ do_local_cmd(arglist *a) if (verbose_mode) { fprintf(stderr, "Executing:"); diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch index 4287d28..1a531a0 100644 --- a/debian/patches/selinux-role.patch +++ b/debian/patches/selinux-role.patch @@ -1,4 +1,4 @@ -From 13a9ed0149b0861aac9c6c6f078ff42a5d8839f0 Mon Sep 17 00:00:00 2001 +From c787621f9bfda401c9a289a8e0cfd00f242aad86 Mon Sep 17 00:00:00 2001 From: Manoj Srivastava Date: Sun, 9 Feb 2014 16:09:49 +0000 Subject: Handle SELinux authorisation roles @@ -9,7 +9,7 @@ SELinux maintainer, so we'll keep it until we have something better. Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641 Bug-Debian: http://bugs.debian.org/394795 -Last-Update: 2021-11-05 +Last-Update: 2024-07-03 Patch-Name: selinux-role.patch --- @@ -23,15 +23,15 @@ Patch-Name: selinux-role.patch openbsd-compat/port-linux.h | 4 ++-- platform.c | 4 ++-- platform.h | 2 +- - session.c | 10 +++++----- + session.c | 8 ++++---- session.h | 2 +- - sshd.c | 2 +- + sshd-session.c | 2 +- sshpty.c | 4 ++-- sshpty.h | 2 +- - 15 files changed, 99 insertions(+), 31 deletions(-) + 15 files changed, 98 insertions(+), 30 deletions(-) diff --git a/auth.h b/auth.h -index 6d2d39762..d16dc66b8 100644 +index 98bb23d4c..59799a812 100644 --- a/auth.h +++ b/auth.h @@ -65,6 +65,7 @@ struct Authctxt { @@ -43,7 +43,7 @@ index 6d2d39762..d16dc66b8 100644 /* Method lists for multiple authentication */ char **auth_methods; /* modified from server config */ diff --git a/auth2.c b/auth2.c -index 514a697ca..12210c043 100644 +index f75f1d20d..44558851e 100644 --- a/auth2.c +++ b/auth2.c @@ -272,7 +272,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) @@ -69,22 +69,21 @@ index 514a697ca..12210c043 100644 if (authctxt->attempt >= 1024) auth_maxtries_exceeded(ssh); -@@ -316,8 +321,9 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) - use_privsep ? " [net]" : ""); +@@ -315,7 +320,8 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) + setproctitle("%s [net]", authctxt->valid ? user : "unknown"); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; +- mm_inform_authserv(service, style); + authctxt->role = role ? xstrdup(role) : NULL; - if (use_privsep) -- mm_inform_authserv(service, style); -+ mm_inform_authserv(service, style, role); ++ mm_inform_authserv(service, style, role); userauth_banner(ssh); if ((r = kex_server_update_ext_info(ssh)) != 0) fatal_fr(r, "kex_server_update_ext_info failed"); diff --git a/monitor.c b/monitor.c -index 2bc152468..c7e6f25d7 100644 +index ad7fef5a9..05d63a8ee 100644 --- a/monitor.c +++ b/monitor.c -@@ -117,6 +117,7 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *); +@@ -118,6 +118,7 @@ int mm_answer_sign(struct ssh *, int, struct sshbuf *); int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *); int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *); int mm_answer_authserv(struct ssh *, int, struct sshbuf *); @@ -100,7 +99,7 @@ index 2bc152468..c7e6f25d7 100644 {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, #ifdef USE_PAM -@@ -817,6 +819,7 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -842,6 +844,7 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m) /* Allow service/style information on the auth context */ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); @@ -108,7 +107,7 @@ index 2bc152468..c7e6f25d7 100644 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); #ifdef USE_PAM -@@ -850,15 +853,42 @@ mm_answer_authserv(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -875,15 +878,42 @@ mm_answer_authserv(struct ssh *ssh, int sock, struct sshbuf *m) monitor_permit_authentications(1); if ((r = sshbuf_get_cstring(m, &authctxt->service, NULL)) != 0 || @@ -153,7 +152,7 @@ index 2bc152468..c7e6f25d7 100644 return (0); } -@@ -1579,7 +1609,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m) +@@ -1604,7 +1634,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m) res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); if (res == 0) goto error; @@ -163,7 +162,7 @@ index 2bc152468..c7e6f25d7 100644 if ((r = sshbuf_put_u32(m, 1)) != 0 || (r = sshbuf_put_cstring(m, s->tty)) != 0) diff --git a/monitor.h b/monitor.h -index 2b1a2d590..4d87284aa 100644 +index 7d8f3c6fa..d84415fe2 100644 --- a/monitor.h +++ b/monitor.h @@ -65,6 +65,8 @@ enum monitor_reqtype { @@ -176,10 +175,10 @@ index 2b1a2d590..4d87284aa 100644 struct ssh; diff --git a/monitor_wrap.c b/monitor_wrap.c -index 189467037..4b986ded6 100644 +index cb3261b4d..60c339d02 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c -@@ -375,10 +375,10 @@ mm_auth2_read_banner(void) +@@ -431,10 +431,10 @@ mm_auth2_read_banner(void) return (banner); } @@ -192,7 +191,7 @@ index 189467037..4b986ded6 100644 { struct sshbuf *m; int r; -@@ -388,7 +388,8 @@ mm_inform_authserv(char *service, char *style) +@@ -444,7 +444,8 @@ mm_inform_authserv(char *service, char *style) if ((m = sshbuf_new()) == NULL) fatal_f("sshbuf_new failed"); if ((r = sshbuf_put_cstring(m, service)) != 0 || @@ -202,7 +201,7 @@ index 189467037..4b986ded6 100644 fatal_fr(r, "assemble"); mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m); -@@ -396,6 +397,26 @@ mm_inform_authserv(char *service, char *style) +@@ -452,6 +453,26 @@ mm_inform_authserv(char *service, char *style) sshbuf_free(m); } @@ -230,10 +229,10 @@ index 189467037..4b986ded6 100644 int mm_auth_password(struct ssh *ssh, char *password) diff --git a/monitor_wrap.h b/monitor_wrap.h -index 830fdb308..c84f96d0c 100644 +index 09b0ccaaa..2493da591 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h -@@ -48,7 +48,8 @@ DH *mm_choose_dh(int, int, int); +@@ -45,7 +45,8 @@ DH *mm_choose_dh(int, int, int); int mm_sshkey_sign(struct ssh *, struct sshkey *, u_char **, size_t *, const u_char *, size_t, const char *, const char *, const char *, u_int compat); @@ -244,10 +243,10 @@ index 830fdb308..c84f96d0c 100644 char *mm_auth2_read_banner(void); int mm_auth_password(struct ssh *, char *); diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c -index 0457e28d0..0394f4808 100644 +index 8adfec5a7..61e239561 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c -@@ -57,7 +57,7 @@ ssh_selinux_enabled(void) +@@ -65,7 +65,7 @@ ssh_selinux_enabled(void) /* Return the default security context for the given username */ static char * @@ -256,7 +255,7 @@ index 0457e28d0..0394f4808 100644 { char *sc = NULL, *sename = NULL, *lvl = NULL; int r; -@@ -71,9 +71,16 @@ ssh_selinux_getctxbyname(char *pwname) +@@ -79,9 +79,16 @@ ssh_selinux_getctxbyname(char *pwname) #endif #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL @@ -275,7 +274,7 @@ index 0457e28d0..0394f4808 100644 #endif if (r != 0) { -@@ -103,7 +110,7 @@ ssh_selinux_getctxbyname(char *pwname) +@@ -111,7 +118,7 @@ ssh_selinux_getctxbyname(char *pwname) /* Set the execution context to the default for the specified user */ void @@ -284,7 +283,7 @@ index 0457e28d0..0394f4808 100644 { char *user_ctx = NULL; -@@ -112,7 +119,7 @@ ssh_selinux_setup_exec_context(char *pwname) +@@ -120,7 +127,7 @@ ssh_selinux_setup_exec_context(char *pwname) debug3("%s: setting execution context", __func__); @@ -293,7 +292,7 @@ index 0457e28d0..0394f4808 100644 if (setexeccon(user_ctx) != 0) { switch (security_getenforce()) { case -1: -@@ -134,7 +141,7 @@ ssh_selinux_setup_exec_context(char *pwname) +@@ -142,7 +149,7 @@ ssh_selinux_setup_exec_context(char *pwname) /* Set the TTY context for the specified user */ void @@ -302,7 +301,7 @@ index 0457e28d0..0394f4808 100644 { char *new_tty_ctx = NULL, *user_ctx = NULL, *old_tty_ctx = NULL; security_class_t chrclass; -@@ -144,7 +151,7 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) +@@ -152,7 +159,7 @@ ssh_selinux_setup_pty(char *pwname, const char *tty) debug3("%s: setting TTY context on %s", __func__, tty); @@ -312,7 +311,7 @@ index 0457e28d0..0394f4808 100644 /* XXX: should these calls fatal() upon failure in enforcing mode? */ diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h -index 3c22a854d..c88129428 100644 +index 14064f87d..6c4c37115 100644 --- a/openbsd-compat/port-linux.h +++ b/openbsd-compat/port-linux.h @@ -19,8 +19,8 @@ @@ -327,10 +326,10 @@ index 3c22a854d..c88129428 100644 void ssh_selinux_setfscreatecon(const char *); #endif diff --git a/platform.c b/platform.c -index 4fe8744ee..70c3a9b58 100644 +index 4c4fe57ea..f3dc7c3a8 100644 --- a/platform.c +++ b/platform.c -@@ -144,7 +144,7 @@ platform_setusercontext(struct passwd *pw) +@@ -99,7 +99,7 @@ platform_setusercontext(struct passwd *pw) * called if sshd is running as root. */ void @@ -339,7 +338,7 @@ index 4fe8744ee..70c3a9b58 100644 { #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM) /* -@@ -185,7 +185,7 @@ platform_setusercontext_post_groups(struct passwd *pw) +@@ -140,7 +140,7 @@ platform_setusercontext_post_groups(struct passwd *pw) } #endif /* HAVE_SETPCRED */ #ifdef WITH_SELINUX @@ -349,10 +348,10 @@ index 4fe8744ee..70c3a9b58 100644 } diff --git a/platform.h b/platform.h -index 7fef8c983..027fdfb51 100644 +index 5dec23276..1b77c3e3d 100644 --- a/platform.h +++ b/platform.h -@@ -25,7 +25,7 @@ void platform_post_fork_parent(pid_t child_pid); +@@ -26,7 +26,7 @@ void platform_post_fork_parent(pid_t child_pid); void platform_post_fork_child(void); int platform_privileged_uidswap(void); void platform_setusercontext(struct passwd *); @@ -362,10 +361,10 @@ index 7fef8c983..027fdfb51 100644 char *platform_krb5_get_principal_name(const char *); int platform_locked_account(struct passwd *); diff --git a/session.c b/session.c -index cbb4edac5..2cb7d0c71 100644 +index 3d9a16b1e..1c67f9fd1 100644 --- a/session.c +++ b/session.c -@@ -1355,7 +1355,7 @@ safely_chroot(const char *path, uid_t uid) +@@ -1344,7 +1344,7 @@ safely_chroot(const char *path, uid_t uid) /* Set login name, uid, gid, and groups. */ void @@ -374,7 +373,7 @@ index cbb4edac5..2cb7d0c71 100644 { char uidstr[32], *chroot_path, *tmp; -@@ -1383,7 +1383,7 @@ do_setusercontext(struct passwd *pw) +@@ -1372,7 +1372,7 @@ do_setusercontext(struct passwd *pw) endgrent(); #endif @@ -383,7 +382,7 @@ index cbb4edac5..2cb7d0c71 100644 if (!in_chroot && options.chroot_directory != NULL && strcasecmp(options.chroot_directory, "none") != 0) { -@@ -1527,7 +1527,7 @@ do_child(struct ssh *ssh, Session *s, const char *command) +@@ -1516,7 +1516,7 @@ do_child(struct ssh *ssh, Session *s, const char *command) /* Force a password change */ if (s->authctxt->force_pwchange) { @@ -392,7 +391,7 @@ index cbb4edac5..2cb7d0c71 100644 child_close_fds(ssh); do_pwchange(s); exit(1); -@@ -1545,7 +1545,7 @@ do_child(struct ssh *ssh, Session *s, const char *command) +@@ -1534,7 +1534,7 @@ do_child(struct ssh *ssh, Session *s, const char *command) /* When PAM is enabled we rely on it to do the nologin check */ if (!options.use_pam) do_nologin(pw); @@ -401,15 +400,6 @@ index cbb4edac5..2cb7d0c71 100644 /* * PAM session modules in do_setusercontext may have * generated messages, so if this in an interactive -@@ -1941,7 +1941,7 @@ session_pty_req(struct ssh *ssh, Session *s) - sshpkt_fatal(ssh, r, "%s: parse packet", __func__); - - if (!use_privsep) -- pty_setowner(s->pw, s->tty); -+ pty_setowner(s->pw, s->tty, s->authctxt->role); - - /* Set window size from the packet. */ - pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); diff --git a/session.h b/session.h index 344a1ddf9..20ea822a7 100644 --- a/session.h @@ -423,19 +413,19 @@ index 344a1ddf9..20ea822a7 100644 const char *session_get_remote_name_or_ip(struct ssh *, u_int, int); -diff --git a/sshd.c b/sshd.c -index 87e25d19b..9c9f38e5b 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -579,7 +579,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt) - reseed_prngs(); +diff --git a/sshd-session.c b/sshd-session.c +index f36d58b1b..1d7cdd00a 100644 +--- a/sshd-session.c ++++ b/sshd-session.c +@@ -440,7 +440,7 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt) /* Drop privileges */ -- do_setusercontext(authctxt->pw); -+ do_setusercontext(authctxt->pw, authctxt->role); + if (!skip_privdrop) +- do_setusercontext(authctxt->pw); ++ do_setusercontext(authctxt->pw, authctxt->role); - skip: /* It is safe now to apply the key state */ + monitor_apply_keystate(ssh, pmonitor); diff --git a/sshpty.c b/sshpty.c index cae0b977a..7870c6482 100644 --- a/sshpty.c diff --git a/debian/patches/series b/debian/patches/series index 2875788..53c1983 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -18,17 +18,13 @@ doc-hash-tab-completion.patch ssh-agent-setgid.patch no-openssl-version-status.patch gnome-ssh-askpass2-icon.patch -systemd-readiness.patch debian-config.patch restore-authorized_keys2.patch revert-ipqos-defaults.patch -maxhostnamelen.patch systemd-socket-activation.patch skip-utimensat-test-on-zfs.patch -zero-call-used-regs-m68k.patch regress-conch-dev-zero.patch configure-cache-vars.patch -deepin-extra-version.patch -deepin-ssh-connect-idle-timeout.patch -deepin-ssh-keygen-privatekey-file-perm.patch -disable-logging-in-sshsigdie.patch +pam-avoid-unknown-host.patch +mlkem768x25519-big-endian-1.patch +mlkem768x25519-big-endian-2.patch diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch index 40fec93..e4f84ed 100644 --- a/debian/patches/shell-path.patch +++ b/debian/patches/shell-path.patch @@ -1,4 +1,4 @@ -From 09466af13847aea5aa2ff17c29181c6e55e31dc2 Mon Sep 17 00:00:00 2001 +From db03f4eab3e6e03b8568629aee068e7221d03c51 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:00 +0000 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand @@ -16,10 +16,10 @@ Patch-Name: shell-path.patch 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sshconnect.c b/sshconnect.c -index d8efc50ce..1d5bcc782 100644 +index 7cf6b6386..1b7e804fb 100644 --- a/sshconnect.c +++ b/sshconnect.c -@@ -247,7 +247,7 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, const char *host_arg, +@@ -248,7 +248,7 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, const char *host_arg, * extra privileges above. */ ssh_signal(SIGPIPE, SIG_DFL); @@ -28,7 +28,7 @@ index d8efc50ce..1d5bcc782 100644 perror(argv[0]); exit(1); } -@@ -1680,7 +1680,7 @@ ssh_local_cmd(const char *args) +@@ -1710,7 +1710,7 @@ ssh_local_cmd(const char *args) if (pid == 0) { ssh_signal(SIGPIPE, SIG_DFL); debug3("Executing %s -c \"%s\"", shell, args); diff --git a/debian/patches/skip-utimensat-test-on-zfs.patch b/debian/patches/skip-utimensat-test-on-zfs.patch index 6a50e08..ced2069 100644 --- a/debian/patches/skip-utimensat-test-on-zfs.patch +++ b/debian/patches/skip-utimensat-test-on-zfs.patch @@ -1,4 +1,4 @@ -From c295622811895faaf4c0be0820cbb919c80b1143 Mon Sep 17 00:00:00 2001 +From 956df1764a7c31f5250122ee0642adf561b6ca41 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 11 Mar 2024 16:24:49 +0000 Subject: Skip utimensat test on ZFS diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch index 1f78cef..7799528 100644 --- a/debian/patches/ssh-agent-setgid.patch +++ b/debian/patches/ssh-agent-setgid.patch @@ -1,4 +1,4 @@ -From 93c14bbee1fee649dd5b8f0e5fa7f8904b1a2a71 Mon Sep 17 00:00:00 2001 +From da7a6ece81d3c8ed572e9b8188975c0f787ee57a Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:13 +0000 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1) diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch index b2e7bbf..6cac7ba 100644 --- a/debian/patches/ssh-argv0.patch +++ b/debian/patches/ssh-argv0.patch @@ -1,4 +1,4 @@ -From 50eb278261460a0ddc942b72b1542910c17966ad Mon Sep 17 00:00:00 2001 +From 9c28130b8475e321fb7f5d83f54de7725e53238e Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:10:10 +0000 Subject: ssh(1): Refer to ssh-argv0(1) @@ -18,10 +18,10 @@ Patch-Name: ssh-argv0.patch 1 file changed, 1 insertion(+) diff --git a/ssh.1 b/ssh.1 -index 60e97dc62..0d56f3dc1 100644 +index d80ce6bfc..3ad246c27 100644 --- a/ssh.1 +++ b/ssh.1 -@@ -1681,6 +1681,7 @@ if an error occurred. +@@ -1668,6 +1668,7 @@ if an error occurred. .Xr sftp 1 , .Xr ssh-add 1 , .Xr ssh-agent 1 , diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch index f517596..7b23f6b 100644 --- a/debian/patches/ssh-vulnkey-compat.patch +++ b/debian/patches/ssh-vulnkey-compat.patch @@ -1,4 +1,4 @@ -From 2d6d05de518be9a3b3724a951e9dcb57e4c6124e Mon Sep 17 00:00:00 2001 +From 9082cd8deab422393c5eee898a77f7dd2b505711 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:09:50 +0000 Subject: Accept obsolete ssh-vulnkey configuration options @@ -17,7 +17,7 @@ Patch-Name: ssh-vulnkey-compat.patch 2 files changed, 2 insertions(+) diff --git a/readconf.c b/readconf.c -index 91d3c0aa0..0f0fb67a5 100644 +index 0ce392538..08342f2a2 100644 --- a/readconf.c +++ b/readconf.c @@ -197,6 +197,7 @@ static struct { @@ -29,10 +29,10 @@ index 91d3c0aa0..0f0fb67a5 100644 { "useroaming", oDeprecated }, { "usersh", oDeprecated }, diff --git a/servconf.c b/servconf.c -index 961cf9e45..193d73cca 100644 +index 731f208be..1d5c143ba 100644 --- a/servconf.c +++ b/servconf.c -@@ -649,6 +649,7 @@ static struct { +@@ -698,6 +698,7 @@ static struct { { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch index 7704549..a533947 100644 --- a/debian/patches/syslog-level-silent.patch +++ b/debian/patches/syslog-level-silent.patch @@ -1,4 +1,4 @@ -From 1b1705fba0225804c8ecec8b3a911d4407248c91 Mon Sep 17 00:00:00 2001 +From fd1b38447970e7a0d5d567571f3bad35db4da90d Mon Sep 17 00:00:00 2001 From: Natalie Amery Date: Sun, 9 Feb 2014 16:09:54 +0000 Subject: "LogLevel SILENT" compatibility @@ -21,7 +21,7 @@ Patch-Name: syslog-level-silent.patch 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/log.c b/log.c -index 9fc1a2e2e..6a8b1fc4a 100644 +index 23ad10c02..133b5fa7d 100644 --- a/log.c +++ b/log.c @@ -96,6 +96,7 @@ static struct { diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch deleted file mode 100644 index 883e35b..0000000 --- a/debian/patches/systemd-readiness.patch +++ /dev/null @@ -1,224 +0,0 @@ -From 3d48cca71737962972c5bbd0171919ecbc348443 Mon Sep 17 00:00:00 2001 -From: Damien Miller -Date: Wed, 3 Apr 2024 14:40:32 +1100 -Subject: notify systemd on listen and reload - -Standalone implementation that does not depend on libsystemd. -With assistance from Luca Boccassi, and feedback/testing from Colin -Watson. bz2641 - -Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=08f579231cd38a1c657aaa6ddeb8ab57a1fd4f5c -Bug-Debian: https://bugs.debian.org/778913 -Last-Update: 2024-04-03 - -Patch-Name: systemd-readiness.patch ---- - configure.ac | 1 + - openbsd-compat/port-linux.c | 97 ++++++++++++++++++++++++++++++++++++- - openbsd-compat/port-linux.h | 5 ++ - platform.c | 11 +++++ - platform.h | 1 + - sshd.c | 2 + - 6 files changed, 115 insertions(+), 2 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 2b2c4f086..c7b563ef2 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -939,6 +939,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) - AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts]) - AC_DEFINE([USE_BTMP]) - AC_DEFINE([LINUX_OOM_ADJUST], [1], [Adjust Linux out-of-memory killer]) -+ AC_DEFINE([SYSTEMD_NOTIFY], [1], [Have sshd notify systemd on start/reload]) - inet6_default_4in6=yes - case `uname -r` in - 1.*|2.0.*) -diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c -index 0394f4808..8e2824594 100644 ---- a/openbsd-compat/port-linux.c -+++ b/openbsd-compat/port-linux.c -@@ -21,16 +21,23 @@ - - #include "includes.h" - --#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) -+#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) || \ -+ defined(SYSTEMD_NOTIFY) -+#include -+#include -+ - #include -+#include - #include - #include - #include - #include -+#include - - #include "log.h" - #include "xmalloc.h" - #include "port-linux.h" -+#include "misc.h" - - #ifdef WITH_SELINUX - #include -@@ -317,4 +324,90 @@ oom_adjust_restore(void) - return; - } - #endif /* LINUX_OOM_ADJUST */ --#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */ -+ -+#ifdef SYSTEMD_NOTIFY -+ -+static void ssh_systemd_notify(const char *, ...) -+ __attribute__((__format__ (printf, 1, 2))) __attribute__((__nonnull__ (1))); -+ -+static void -+ssh_systemd_notify(const char *fmt, ...) -+{ -+ char *s = NULL; -+ const char *path; -+ struct stat sb; -+ struct sockaddr_un addr; -+ int fd = -1; -+ va_list ap; -+ -+ if ((path = getenv("NOTIFY_SOCKET")) == NULL || strlen(path) == 0) -+ return; -+ -+ va_start(ap, fmt); -+ xvasprintf(&s, fmt, ap); -+ va_end(ap); -+ -+ /* Only AF_UNIX is supported, with path or abstract sockets */ -+ if (path[0] != '/' && path[0] != '@') { -+ error_f("socket \"%s\" is not compatible with AF_UNIX", path); -+ goto out; -+ } -+ -+ if (path[0] == '/' && stat(path, &sb) != 0) { -+ error_f("socket \"%s\" stat: %s", path, strerror(errno)); -+ goto out; -+ } -+ -+ memset(&addr, 0, sizeof(addr)); -+ addr.sun_family = AF_UNIX; -+ if (strlcpy(addr.sun_path, path, -+ sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) { -+ error_f("socket path \"%s\" too long", path); -+ goto out; -+ } -+ /* Support for abstract socket */ -+ if (addr.sun_path[0] == '@') -+ addr.sun_path[0] = 0; -+ if ((fd = socket(PF_UNIX, SOCK_DGRAM, 0)) == -1) { -+ error_f("socket \"%s\": %s", path, strerror(errno)); -+ goto out; -+ } -+ if (connect(fd, &addr, sizeof(addr)) != 0) { -+ error_f("socket \"%s\" connect: %s", path, strerror(errno)); -+ goto out; -+ } -+ if (write(fd, s, strlen(s)) != (ssize_t)strlen(s)) { -+ error_f("socket \"%s\" write: %s", path, strerror(errno)); -+ goto out; -+ } -+ debug_f("socket \"%s\" notified %s", path, s); -+ out: -+ if (fd != -1) -+ close(fd); -+ free(s); -+} -+ -+void -+ssh_systemd_notify_ready(void) -+{ -+ ssh_systemd_notify("READY=1"); -+} -+ -+void -+ssh_systemd_notify_reload(void) -+{ -+ struct timespec now; -+ -+ monotime_ts(&now); -+ if (now.tv_sec < 0 || now.tv_nsec < 0) { -+ error_f("monotime returned negative value"); -+ ssh_systemd_notify("RELOADING=1"); -+ } else { -+ ssh_systemd_notify("RELOADING=1\nMONOTONIC_USEC=%llu", -+ ((uint64_t)now.tv_sec * 1000000ULL) + -+ ((uint64_t)now.tv_nsec / 1000ULL)); -+ } -+} -+#endif /* SYSTEMD_NOTIFY */ -+ -+#endif /* WITH_SELINUX || LINUX_OOM_ADJUST || SYSTEMD_NOTIFY */ -diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h -index c88129428..6c4c37115 100644 ---- a/openbsd-compat/port-linux.h -+++ b/openbsd-compat/port-linux.h -@@ -30,4 +30,9 @@ void oom_adjust_restore(void); - void oom_adjust_setup(void); - #endif - -+#ifdef SYSTEMD_NOTIFY -+void ssh_systemd_notify_ready(void); -+void ssh_systemd_notify_reload(void); -+#endif -+ - #endif /* ! _PORT_LINUX_H */ -diff --git a/platform.c b/platform.c -index 70c3a9b58..163a54a46 100644 ---- a/platform.c -+++ b/platform.c -@@ -44,6 +44,14 @@ platform_pre_listen(void) - #endif - } - -+void -+platform_post_listen(void) -+{ -+#ifdef SYSTEMD_NOTIFY -+ ssh_systemd_notify_ready(); -+#endif -+} -+ - void - platform_pre_fork(void) - { -@@ -55,6 +63,9 @@ platform_pre_fork(void) - void - platform_pre_restart(void) - { -+#ifdef SYSTEMD_NOTIFY -+ ssh_systemd_notify_reload(); -+#endif - #ifdef LINUX_OOM_ADJUST - oom_adjust_restore(); - #endif -diff --git a/platform.h b/platform.h -index 027fdfb51..1b77c3e3d 100644 ---- a/platform.h -+++ b/platform.h -@@ -21,6 +21,7 @@ - void platform_pre_listen(void); - void platform_pre_fork(void); - void platform_pre_restart(void); -+void platform_post_listen(void); - void platform_post_fork_parent(pid_t child_pid); - void platform_post_fork_child(void); - int platform_privileged_uidswap(void); -diff --git a/sshd.c b/sshd.c -index 8fab51ebb..a18b85d1d 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -2085,6 +2085,8 @@ main(int ac, char **av) - ssh_signal(SIGTERM, sigterm_handler); - ssh_signal(SIGQUIT, sigterm_handler); - -+ platform_post_listen(); -+ - /* - * Write out the pid file after the sigterm handler - * is setup and the listen sockets are bound diff --git a/debian/patches/systemd-socket-activation.patch b/debian/patches/systemd-socket-activation.patch index d2c5284..e3462ae 100644 --- a/debian/patches/systemd-socket-activation.patch +++ b/debian/patches/systemd-socket-activation.patch @@ -1,4 +1,4 @@ -From f01545e3f9350c080a525c246b9d46ba71cb0d09 Mon Sep 17 00:00:00 2001 +From ea15be5452914d4dcf291228c73e7dfa4550537b Mon Sep 17 00:00:00 2001 From: Steve Langasek Date: Thu, 1 Sep 2022 16:03:37 +0100 Subject: Support systemd socket activation @@ -10,16 +10,16 @@ of the sshd daemon without becoming incompatible with config options like ClientAliveCountMax. Author: Colin Watson -Last-Update: 2024-04-03 +Last-Update: 2024-08-02 Patch-Name: systemd-socket-activation.patch --- configure.ac | 1 + - sshd.c | 131 +++++++++++++++++++++++++++++++++++++++++++++------ - 2 files changed, 118 insertions(+), 14 deletions(-) + sshd.c | 133 +++++++++++++++++++++++++++++++++++++++++++++------ + 2 files changed, 119 insertions(+), 15 deletions(-) diff --git a/configure.ac b/configure.ac -index c7b563ef2..cdfb505bf 100644 +index 90548dcfc..8b3a9776b 100644 --- a/configure.ac +++ b/configure.ac @@ -940,6 +940,7 @@ int main(void) { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) @@ -31,11 +31,11 @@ index c7b563ef2..cdfb505bf 100644 case `uname -r` in 1.*|2.0.*) diff --git a/sshd.c b/sshd.c -index a18b85d1d..105c688e4 100644 +index 48b334c68..142310c07 100644 --- a/sshd.c +++ b/sshd.c -@@ -136,10 +136,18 @@ int deny_severity; - #endif /* LIBWRAP */ +@@ -93,10 +93,18 @@ + #include "srclimit.h" /* Re-exec fds */ -#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) @@ -57,8 +57,8 @@ index a18b85d1d..105c688e4 100644 extern char *__progname; -@@ -1016,6 +1024,88 @@ server_accept_inetd(int *sock_in, int *sock_out) - debug("inetd sockets after dupping: %d, %d", *sock_in, *sock_out); +@@ -740,6 +748,88 @@ send_rexec_state(int fd, struct sshbuf *conf) + debug3_f("done"); } +#ifdef SYSTEMD_SOCKET_ACTIVATION @@ -146,7 +146,7 @@ index a18b85d1d..105c688e4 100644 /* * Listen for TCP connections */ -@@ -1095,22 +1185,35 @@ static void +@@ -819,6 +909,9 @@ static void server_listen(void) { u_int i; @@ -155,8 +155,10 @@ index a18b85d1d..105c688e4 100644 +#endif /* Initialise per-source limit tracking. */ - srclimit_init(options.max_startups, options.per_source_max_startups, - options.per_source_masklen_ipv4, options.per_source_masklen_ipv6); + srclimit_init(options.max_startups, +@@ -828,17 +921,27 @@ server_listen(void) + &options.per_source_penalty, + options.per_source_penalty_exempt); - for (i = 0; i < options.num_listen_addrs; i++) { - listen_on_addrs(&options.listen_addrs[i]); @@ -192,3 +194,12 @@ index a18b85d1d..105c688e4 100644 if (!num_listen_socks) fatal("Cannot bind any address."); } +@@ -1351,7 +1454,7 @@ main(int ac, char **av) + if (!test_flag && !inetd_flag && !do_dump_cfg && !path_absolute(av[0])) + fatal("sshd requires execution with an absolute path"); + +- closefrom(STDERR_FILENO + 1); ++ closefrom(STDERR_FILENO + 1 + SYSTEMD_OFFSET); + + /* Reserve fds we'll need later for reexec things */ + if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch index 163039d..a67bca8 100644 --- a/debian/patches/user-group-modes.patch +++ b/debian/patches/user-group-modes.patch @@ -1,4 +1,4 @@ -From 673c225f85e2666e10be71a1d87225de2bb2aeb2 Mon Sep 17 00:00:00 2001 +From a3be0a7259302fe037d63546c78c5d3ca7fe3609 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 9 Feb 2014 16:09:58 +0000 Subject: Allow harmless group-writability @@ -27,10 +27,10 @@ Patch-Name: user-group-modes.patch 7 files changed, 62 insertions(+), 13 deletions(-) diff --git a/auth-rhosts.c b/auth-rhosts.c -index 56724677a..e15f5bc5a 100644 +index d5d2c7a12..13c3c201b 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c -@@ -266,8 +266,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, +@@ -265,8 +265,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, return 0; } if (options.strict_modes && @@ -40,7 +40,7 @@ index 56724677a..e15f5bc5a 100644 logit("Rhosts authentication refused for %.100s: " "bad ownership or modes for home directory.", pw->pw_name); auth_debug_add("Rhosts authentication refused for %.100s: " -@@ -296,8 +295,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, +@@ -295,8 +294,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, * allowing access to their account by anyone. */ if (options.strict_modes && @@ -51,10 +51,10 @@ index 56724677a..e15f5bc5a 100644 "bad modes for %.200s", pw->pw_name, path); auth_debug_add("Bad file modes for %.200s", path); diff --git a/auth.c b/auth.c -index 8ccf06370..08a75fc4e 100644 +index e4578169b..4b878865f 100644 --- a/auth.c +++ b/auth.c -@@ -431,8 +431,7 @@ check_key_in_hostfiles(struct passwd *pw, struct sshkey *key, const char *host, +@@ -430,8 +430,7 @@ check_key_in_hostfiles(struct passwd *pw, struct sshkey *key, const char *host, user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); if (options.strict_modes && (stat(user_hostfile, &st) == 0) && @@ -65,7 +65,7 @@ index 8ccf06370..08a75fc4e 100644 "bad owner or modes for %.200s", pw->pw_name, user_hostfile); diff --git a/misc.c b/misc.c -index 5dc9d54a2..d0d9301d7 100644 +index afdf5142e..8776fc1dc 100644 --- a/misc.c +++ b/misc.c @@ -62,9 +62,9 @@ @@ -79,7 +79,7 @@ index 5dc9d54a2..d0d9301d7 100644 #ifdef SSH_TUN_OPENBSD #include #endif -@@ -1414,6 +1414,55 @@ percent_dollar_expand(const char *string, ...) +@@ -1428,6 +1428,55 @@ percent_dollar_expand(const char *string, ...) return ret; } @@ -135,7 +135,7 @@ index 5dc9d54a2..d0d9301d7 100644 int tun_open(int tun, int mode, char **ifname) { -@@ -2223,8 +2272,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, +@@ -2250,8 +2299,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, snprintf(err, errlen, "%s is not a regular file", buf); return -1; } @@ -145,7 +145,7 @@ index 5dc9d54a2..d0d9301d7 100644 snprintf(err, errlen, "bad ownership or modes for file %s", buf); return -1; -@@ -2239,8 +2287,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, +@@ -2266,8 +2314,7 @@ safe_path(const char *name, struct stat *stp, const char *pw_dir, strlcpy(buf, cp, sizeof(buf)); if (stat(buf, &st) == -1 || @@ -156,10 +156,10 @@ index 5dc9d54a2..d0d9301d7 100644 "bad ownership or modes for directory %s", buf); return -1; diff --git a/misc.h b/misc.h -index 9bacce520..a1fb74579 100644 +index 113403896..4681f79f7 100644 --- a/misc.h +++ b/misc.h -@@ -238,6 +238,8 @@ struct notifier_ctx *notify_start(int, const char *, ...) +@@ -246,6 +246,8 @@ struct notifier_ctx *notify_start(int, const char *, ...) void notify_complete(struct notifier_ctx *, const char *, ...) __attribute__((format(printf, 2, 3))); @@ -169,10 +169,10 @@ index 9bacce520..a1fb74579 100644 #define MAXIMUM(a, b) (((a) > (b)) ? (a) : (b)) #define ROUNDUP(x, y) ((((x)+((y)-1))/(y))*(y)) diff --git a/readconf.c b/readconf.c -index c6e609fca..d68658185 100644 +index f78786964..d3c3056ef 100644 --- a/readconf.c +++ b/readconf.c -@@ -2518,8 +2518,7 @@ read_config_file_depth(const char *filename, struct passwd *pw, +@@ -2552,8 +2552,7 @@ read_config_file_depth(const char *filename, struct passwd *pw, if (fstat(fileno(f), &sb) == -1) fatal("fstat %s: %s", filename, strerror(errno)); @@ -183,10 +183,10 @@ index c6e609fca..d68658185 100644 } diff --git a/ssh.1 b/ssh.1 -index 877c3bc64..2d07c919e 100644 +index 8f78b3a1e..d80ce6bfc 100644 --- a/ssh.1 +++ b/ssh.1 -@@ -1577,6 +1577,8 @@ The file format and configuration options are described in +@@ -1572,6 +1572,8 @@ The file format and configuration options are described in .Xr ssh_config 5 . Because of the potential for abuse, this file must have strict permissions: read/write for the user, and not writable by others. @@ -196,10 +196,10 @@ index 877c3bc64..2d07c919e 100644 .It Pa ~/.ssh/environment Contains additional definitions for environment variables; see diff --git a/ssh_config.5 b/ssh_config.5 -index 6b482ee15..4afb8fb7a 100644 +index 31142f8c5..073ef69e2 100644 --- a/ssh_config.5 +++ b/ssh_config.5 -@@ -2405,6 +2405,8 @@ The format of this file is described above. +@@ -2417,6 +2417,8 @@ The format of this file is described above. This file is used by the SSH client. Because of the potential for abuse, this file must have strict permissions: read/write for the user, and not writable by others. diff --git a/debian/patches/zero-call-used-regs-m68k.patch b/debian/patches/zero-call-used-regs-m68k.patch deleted file mode 100644 index 84cd0a8..0000000 --- a/debian/patches/zero-call-used-regs-m68k.patch +++ /dev/null @@ -1,30 +0,0 @@ -From f81c7307956c509e0638e8272454677d59961950 Mon Sep 17 00:00:00 2001 -From: Colin Watson -Date: Thu, 21 Mar 2024 10:20:21 +0000 -Subject: Extend -fzero-call-used-regs check to catch m68k gcc bug - -Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110934 -Bug-Debian: https://bugs.debian.org/1067243 -Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=3673 -Last-Update: 2024-03-24 - -Patch-Name: zero-call-used-regs-m68k.patch ---- - m4/openssh.m4 | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/m4/openssh.m4 b/m4/openssh.m4 -index 033df501c..176a8d1c9 100644 ---- a/m4/openssh.m4 -+++ b/m4/openssh.m4 -@@ -20,7 +20,10 @@ char *f2(char *s, ...) { - va_end(args); - return strdup(ret); - } -+int i; -+double d; - const char *f3(int s) { -+ i = (int)d; - return s ? "good" : "gooder"; - } - int main(int argc, char **argv) { diff --git a/debian/rules b/debian/rules index 285dd31..d0a45d3 100755 --- a/debian/rules +++ b/debian/rules @@ -33,7 +33,7 @@ else endif # Change the version string to reflect distribution -SSH_EXTRAVERSION := $(DEB_VENDOR)-$(shell echo '$(DEB_VERSION)' | sed -e 's/.*-//') +SSH_EXTRAVERSION := $(DEB_VENDOR)-$(shell echo '$(DEB_VERSION)' | sed -e 's/.*-//; s/+salsaci+.*/+salsaci/') UBUNTU := $(shell $(call dpkg_vendor_derives_from,Ubuntu)) ifeq ($(UBUNTU),yes) @@ -134,7 +134,7 @@ override_dh_auto_build-arch: $(MAKE) -C debian/build-deb regress-prep $(MAKE) -C debian/build-deb $(PARALLEL) regress-binaries regress-unit-binaries ifeq ($(filter noudeb,$(DEB_BUILD_PROFILES)),) - $(MAKE) -C debian/build-udeb $(PARALLEL) ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp sftp sshd ssh-keygen + $(MAKE) -C debian/build-udeb $(PARALLEL) ASKPASS_PROGRAM='/usr/bin/ssh-askpass' ssh scp sftp sshd ssh-keygen sshd-session endif ifeq ($(filter pkg.openssh.nognome,$(DEB_BUILD_PROFILES)),) @@ -195,11 +195,7 @@ override_dh_installinit: dh_installinit -R --name ssh override_dh_installsystemd: -ifeq ($(shell lsb_release -i -s),uos) - dh_installsystemd -popenssh-server --no-enable ssh.service -else dh_installsystemd -popenssh-server ssh.service -endif dh_installsystemd -popenssh-server --no-enable ssh.socket dh_installsystemd -popenssh-server --no-start rescue-ssh.target diff --git a/debian/run-tests b/debian/run-tests index def9494..df76b7f 100755 --- a/debian/run-tests +++ b/debian/run-tests @@ -27,6 +27,7 @@ make -C "$tmp/regress" \ SUDO=sudo \ TEST_SHELL=/bin/sh \ TEST_SSH_SSH=/usr/bin/ssh \ + TEST_SSH_SSHD_SESSION=/usr/lib/openssh/sshd-session \ TEST_SSH_SFTPSERVER=/usr/lib/openssh/sftp-server \ TEST_SSH_PLINK=/usr/bin/plink \ TEST_SSH_PUTTYGEN=/usr/bin/puttygen \ diff --git a/debian/systemd/ssh.service b/debian/systemd/ssh.service index 7495d9a..0eb0d67 100644 --- a/debian/systemd/ssh.service +++ b/debian/systemd/ssh.service @@ -1,7 +1,7 @@ [Unit] Description=OpenBSD Secure Shell server Documentation=man:sshd(8) man:sshd_config(5) -After=network.target auditd.service +After=network.target nss-user-lookup.target auditd.service ConditionPathExists=!/etc/ssh/sshd_not_to_be_run [Service] diff --git a/debian/systemd/sshd@.service b/debian/systemd/sshd@.service index 29864a8..38ff431 100644 --- a/debian/systemd/sshd@.service +++ b/debian/systemd/sshd@.service @@ -1,7 +1,7 @@ [Unit] Description=OpenBSD Secure Shell server per-connection daemon Documentation=man:sshd(8) man:sshd_config(5) -After=auditd.service +After=nss-user-lookup.target auditd.service [Service] EnvironmentFile=-/etc/default/ssh diff --git a/debian/tests/control b/debian/tests/control index 3c7b14d..e138981 100644 --- a/debian/tests/control +++ b/debian/tests/control @@ -1,11 +1,46 @@ -Tests: regress -Restrictions: needs-root allow-stderr isolation-container -Depends: devscripts, - dropbear, - haveged, - openssh-tests, - openssl, - putty-tools, - python3-twisted, - sudo, - sysvinit-utils, +Tests: + regress, +Restrictions: + allow-stderr, + isolation-container, + needs-root, +Depends: + devscripts, + dropbear, + haveged, + openssh-tests, + openssl, + putty-tools, + python3-twisted, + sudo, + sysvinit-utils, + +Tests: + ssh-gssapi, +Restrictions: + allow-stderr, + isolation-container, + needs-root, +Depends: + krb5-admin-server, + krb5-kdc, + openssh-server-gssapi, + +Tests: + socket-activation, +Restrictions: + allow-stderr, + isolation-container, + needs-root, +Depends: + openssh-server, + +Tests: + xinetd, +Restrictions: + allow-stderr, + isolation-container, + needs-root, +Depends: + openssh-server, + xinetd, diff --git a/debian/tests/regress b/debian/tests/regress index 72b1151..681f82f 100755 --- a/debian/tests/regress +++ b/debian/tests/regress @@ -77,7 +77,7 @@ EOF ADDED_HOST=: fi - sudo -u openssh-tests env TMP="$TMP" "$0" "$@" + runuser -u openssh-tests env TMP="$TMP" "$0" "$@" exit "$?" fi diff --git a/debian/tests/socket-activation b/debian/tests/socket-activation new file mode 100755 index 0000000..7ee4a92 --- /dev/null +++ b/debian/tests/socket-activation @@ -0,0 +1,27 @@ +#! /bin/sh +set -e + +testuser="testuser$$" +adduser --quiet --disabled-password --gecos "" "$testuser" +runuser -u "$testuser" -- mkdir -m700 "/home/$testuser/.ssh" +runuser -u "$testuser" -- \ + ssh-keygen -t ed25519 -N '' -f "/home/$testuser/.ssh/id_ed25519" +runuser -u "$testuser" -- \ + cp "/home/$testuser/.ssh/id_ed25519.pub" \ + "/home/$testuser/.ssh/authorized_keys" + +cleanup () { + if [ $? -ne 0 ]; then + echo "## Something failed" + echo + echo "## ssh server log" + journalctl -b -u ssh.service --lines 100 + fi +} + +trap cleanup EXIT + +systemctl disable --now ssh.service +systemctl enable --now ssh.socket +runuser -u "$testuser" -- \ + ssh -oStrictHostKeyChecking=accept-new "$testuser@localhost" date diff --git a/debian/tests/ssh-gssapi b/debian/tests/ssh-gssapi new file mode 100755 index 0000000..6a0fa16 --- /dev/null +++ b/debian/tests/ssh-gssapi @@ -0,0 +1,166 @@ +#!/bin/bash + +set -e +set -o pipefail + +realm="EXAMPLE.FAKE" +myhostname="sshd-gssapi.${realm,,}" +testuser="testuser$$" +testuser2="testuser$$-2" +adduser --quiet --disabled-password --gecos "" "${testuser}" +adduser --quiet --disabled-password --gecos "" "${testuser2}" +password="secret" +user_principal="${testuser}@${realm}" +service_principal="host/${myhostname}" + +ssh-keygen -t ed25519 -N '' -f "$HOME/.ssh/id_ed25519" +runuser -u "$testuser2" -- mkdir -m700 "/home/$testuser2/.ssh" +cp "$HOME/.ssh/id_ed25519.pub" "/home/$testuser2/.ssh/authorized_keys" +chown "$testuser2:" "/home/$testuser2/.ssh/authorized_keys" + +source debian/tests/util + +cleanup() { + if [ $? -ne 0 ]; then + echo "## Something failed" + echo + echo "## klist" + klist + echo + echo "## ssh server log" + journalctl -b -u ssh.service --lines 100 + echo + echo "## Kerberos KDC logs" + journalctl -b -u krb5-kdc.service --lines 100 + echo + echo "## Kerberos Admin server logs" + journalctl -b -u krb5-admin-server.service --lines 100 + echo + echo "## Skipping cleanup to facilitate troubleshooting" + else + echo "## ALL TESTS PASSED" + echo "## Cleaning up" + rm -f /etc/krb5.keytab + rm -f /etc/ssh/sshd_config.d/gssapi.conf + rm -f /etc/ssh/ssh_config.d/gssapi.conf + rm -f /etc/ssh/ssh_config.d/dep8.conf + fi +} + +trap cleanup EXIT + +setup() { + echo "## Setting up test environment" + adjust_hostname "${myhostname}" + echo "## Creating Kerberos realm ${realm}" + create_realm "${realm}" "${myhostname}" + echo "## Creating principals" + kadmin.local -q "addprinc -clearpolicy -pw ${password} ${user_principal}" + kadmin.local -q "addprinc -clearpolicy -randkey ${service_principal}" + echo "## Extracting service principal ${service_principal}" + kadmin.local -q "ktadd -k /etc/krb5.keytab ${service_principal}" + cat > /etc/ssh/ssh_config.d/dep8.conf < /etc/krb5.conf < /etc/ssh/sshd_config.d/gssapi.conf < /etc/ssh/ssh_config.d/gssapi.conf < /etc/ssh/sshd_config.d/gssapi.conf < /etc/ssh/ssh_config.d/gssapi.conf </dev/null || : + configure_sshd "${initial_auth_method}" || return $? + cursor="$(journalctl -u ssh.service --lines=1 --show-cursor | sed -n 's/^-- cursor: //p')" + echo "## Obtaining TGT" + echo "${password}" | timeout --verbose 30 kinit "${user_principal}" || return $? + klist + echo + echo "## ssh'ing into localhost using ${initial_auth_method} auth" + timeout --verbose 30 ssh "${user}@${myhostname}" date || return $? + echo + echo "## checking that we got a service ticket for ssh (host/)" + klist | grep -F "${service_principal}" || return $? + echo + echo "## Checking ssh logs to confirm ${final_auth_method} auth was used" + journalctl -u ssh.service --after-cursor="$cursor" --grep "Accepted ${final_auth_method}" +} + +test_gssapi_login() { + _test_ssh_login gssapi-with-mic "${testuser}" gssapi-with-mic +} + +test_gssapi_keyex_login() { + _test_ssh_login gssapi-keyex "${testuser}" gssapi-keyex +} + +test_gssapi_keyex_pubkey_fallback() { + # GSS-API key exchange for the wrong user, falling back to public key + # authentication for the right user. + _test_ssh_login gssapi-keyex "${testuser2}" publickey +} + +setup +echo "## TESTS" +echo +run_test test_gssapi_login +run_test test_gssapi_keyex_login +run_test test_gssapi_keyex_pubkey_fallback diff --git a/debian/tests/util b/debian/tests/util new file mode 100644 index 0000000..e6035c4 --- /dev/null +++ b/debian/tests/util @@ -0,0 +1,76 @@ +# Copyright 2018 Canonical Ltd. +# This code is licensed under the same terms as MIT Kerberos. + +set -e + +adjust_hostname() { + local myhostname="$1" + + echo "${myhostname}" > /etc/hostname + hostname "${myhostname}" + if ! grep -qE "${myhostname}" /etc/hosts; then + # just so it's resolvable + echo "127.0.1.10 ${myhostname}" >> /etc/hosts + fi +} + +create_realm() { + local realm_name="$1" + local kerberos_server="$2" + + # start fresh + rm -rf /var/lib/krb5kdc/* + rm -rf /etc/krb5kdc/* + rm -f /etc/krb5.keytab + + # setup some defaults + cat > /etc/krb5kdc/kdc.conf < /etc/krb5.conf < /etc/krb5kdc/kadm5.acl + + # create the realm + kdb5_util create -s -P secretpassword + + # restart services + systemctl restart krb5-kdc.service krb5-admin-server.service +} + +run_test() { + local testfunc="${1}" + local -i result=0 + shift + echo "## TEST ${testfunc}" + "${testfunc}" "${@}" || result=$? + if [ ${result} -ne 0 ]; then + echo "## FAIL ${testfunc}" + else + echo "## PASS ${testfunc}" + fi + echo + return ${result} +} diff --git a/debian/tests/xinetd b/debian/tests/xinetd new file mode 100755 index 0000000..4617ce1 --- /dev/null +++ b/debian/tests/xinetd @@ -0,0 +1,52 @@ +#! /bin/sh +set -e + +testuser="testuser$$" +adduser --quiet --disabled-password --gecos "" "$testuser" +runuser -u "$testuser" -- mkdir -m700 "/home/$testuser/.ssh" +runuser -u "$testuser" -- \ + ssh-keygen -t ed25519 -N '' -f "/home/$testuser/.ssh/id_ed25519" +runuser -u "$testuser" -- \ + cp "/home/$testuser/.ssh/id_ed25519.pub" \ + "/home/$testuser/.ssh/authorized_keys" + +cleanup () { + if [ $? -ne 0 ]; then + echo "## Something failed" + echo + echo "## ssh server log" + journalctl -b -u ssh.service --lines 100 + fi +} + +trap cleanup EXIT + +cat >/etc/xinetd.d/sshd </etc/systemd/system/xinetd.service.d/sshd.conf < +#include +#include +#include +#include + +#ifdef WITH_OPENSSL +#include +#include +#endif + +#include "kex.h" +#include "log.h" +#include "match.h" +#include "digest.h" +#include "misc.h" + +#include "ssherr.h" +#include "xmalloc.h" + +struct kexalg { + char *name; + u_int type; + int ec_nid; + int hash_alg; +}; +static const struct kexalg kexalgs[] = { +#ifdef WITH_OPENSSL + { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, + { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, + { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 }, + { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 }, + { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 }, + { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, +#ifdef HAVE_EVP_SHA256 + { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 }, +#endif /* HAVE_EVP_SHA256 */ +#ifdef OPENSSL_HAS_ECC + { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, + NID_X9_62_prime256v1, SSH_DIGEST_SHA256 }, + { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, + SSH_DIGEST_SHA384 }, +# ifdef OPENSSL_HAS_NISTP521 + { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, + SSH_DIGEST_SHA512 }, +# endif /* OPENSSL_HAS_NISTP521 */ +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ +#if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL) + { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, + { KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, +#ifdef USE_SNTRUP761X25519 + { KEX_SNTRUP761X25519_SHA512, KEX_KEM_SNTRUP761X25519_SHA512, 0, + SSH_DIGEST_SHA512 }, + { KEX_SNTRUP761X25519_SHA512_OLD, KEX_KEM_SNTRUP761X25519_SHA512, 0, + SSH_DIGEST_SHA512 }, +#endif +#ifdef USE_MLKEM768X25519 + { KEX_MLKEM768X25519_SHA256, KEX_KEM_MLKEM768X25519_SHA256, 0, + SSH_DIGEST_SHA256 }, +#endif +#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ + { NULL, 0, -1, -1}, +}; + +char * +kex_alg_list(char sep) +{ + char *ret = NULL, *tmp; + size_t nlen, rlen = 0; + const struct kexalg *k; + + for (k = kexalgs; k->name != NULL; k++) { + if (ret != NULL) + ret[rlen++] = sep; + nlen = strlen(k->name); + if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { + free(ret); + return NULL; + } + ret = tmp; + memcpy(ret + rlen, k->name, nlen + 1); + rlen += nlen; + } + return ret; +} + +static const struct kexalg * +kex_alg_by_name(const char *name) +{ + const struct kexalg *k; + + for (k = kexalgs; k->name != NULL; k++) { + if (strcmp(k->name, name) == 0) + return k; + } + return NULL; +} + +int +kex_name_valid(const char *name) +{ + return kex_alg_by_name(name) != NULL; +} + +u_int +kex_type_from_name(const char *name) +{ + const struct kexalg *k; + + if ((k = kex_alg_by_name(name)) == NULL) + return 0; + return k->type; +} + +int +kex_hash_from_name(const char *name) +{ + const struct kexalg *k; + + if ((k = kex_alg_by_name(name)) == NULL) + return -1; + return k->hash_alg; +} + +int +kex_nid_from_name(const char *name) +{ + const struct kexalg *k; + + if ((k = kex_alg_by_name(name)) == NULL) + return -1; + return k->ec_nid; +} + +/* Validate KEX method name list */ +int +kex_names_valid(const char *names) +{ + char *s, *cp, *p; + + if (names == NULL || strcmp(names, "") == 0) + return 0; + if ((s = cp = strdup(names)) == NULL) + return 0; + for ((p = strsep(&cp, ",")); p && *p != '\0'; + (p = strsep(&cp, ","))) { + if (kex_alg_by_name(p) == NULL) { + error("Unsupported KEX algorithm \"%.100s\"", p); + free(s); + return 0; + } + } + debug3("kex names ok: [%s]", names); + free(s); + return 1; +} + +/* returns non-zero if proposal contains any algorithm from algs */ +int +kex_has_any_alg(const char *proposal, const char *algs) +{ + char *cp; + + if ((cp = match_list(proposal, algs, NULL)) == NULL) + return 0; + free(cp); + return 1; +} + +/* + * Concatenate algorithm names, avoiding duplicates in the process. + * Caller must free returned string. + */ +char * +kex_names_cat(const char *a, const char *b) +{ + char *ret = NULL, *tmp = NULL, *cp, *p; + size_t len; + + if (a == NULL || *a == '\0') + return strdup(b); + if (b == NULL || *b == '\0') + return strdup(a); + if (strlen(b) > 1024*1024) + return NULL; + len = strlen(a) + strlen(b) + 2; + if ((tmp = cp = strdup(b)) == NULL || + (ret = calloc(1, len)) == NULL) { + free(tmp); + return NULL; + } + strlcpy(ret, a, len); + for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) { + if (kex_has_any_alg(ret, p)) + continue; /* Algorithm already present */ + if (strlcat(ret, ",", len) >= len || + strlcat(ret, p, len) >= len) { + free(tmp); + free(ret); + return NULL; /* Shouldn't happen */ + } + } + free(tmp); + return ret; +} + +/* + * Assemble a list of algorithms from a default list and a string from a + * configuration file. The user-provided string may begin with '+' to + * indicate that it should be appended to the default, '-' that the + * specified names should be removed, or '^' that they should be placed + * at the head. + */ +int +kex_assemble_names(char **listp, const char *def, const char *all) +{ + char *cp, *tmp, *patterns; + char *list = NULL, *ret = NULL, *matching = NULL, *opatterns = NULL; + int r = SSH_ERR_INTERNAL_ERROR; + + if (listp == NULL || def == NULL || all == NULL) + return SSH_ERR_INVALID_ARGUMENT; + + if (*listp == NULL || **listp == '\0') { + if ((*listp = strdup(def)) == NULL) + return SSH_ERR_ALLOC_FAIL; + return 0; + } + + list = *listp; + *listp = NULL; + if (*list == '+') { + /* Append names to default list */ + if ((tmp = kex_names_cat(def, list + 1)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + free(list); + list = tmp; + } else if (*list == '-') { + /* Remove names from default list */ + if ((*listp = match_filter_denylist(def, list + 1)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + free(list); + /* filtering has already been done */ + return 0; + } else if (*list == '^') { + /* Place names at head of default list */ + if ((tmp = kex_names_cat(list + 1, def)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + free(list); + list = tmp; + } else { + /* Explicit list, overrides default - just use "list" as is */ + } + + /* + * The supplied names may be a pattern-list. For the -list case, + * the patterns are applied above. For the +list and explicit list + * cases we need to do it now. + */ + ret = NULL; + if ((patterns = opatterns = strdup(list)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + /* Apply positive (i.e. non-negated) patterns from the list */ + while ((cp = strsep(&patterns, ",")) != NULL) { + if (*cp == '!') { + /* negated matches are not supported here */ + r = SSH_ERR_INVALID_ARGUMENT; + goto fail; + } + free(matching); + if ((matching = match_filter_allowlist(all, cp)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + if ((tmp = kex_names_cat(ret, matching)) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto fail; + } + free(ret); + ret = tmp; + } + if (ret == NULL || *ret == '\0') { + /* An empty name-list is an error */ + /* XXX better error code? */ + r = SSH_ERR_INVALID_ARGUMENT; + goto fail; + } + + /* success */ + *listp = ret; + ret = NULL; + r = 0; + + fail: + free(matching); + free(opatterns); + free(list); + free(ret); + return r; +} diff --git a/kex.c b/kex.c index 8a0f165..6b957e5 100644 --- a/kex.c +++ b/kex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kex.c,v 1.185 2024/01/08 00:34:33 djm Exp $ */ +/* $OpenBSD: kex.c,v 1.187 2024/08/23 04:51:00 deraadt Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * @@ -81,254 +81,6 @@ static const char * const proposal_names[PROPOSAL_MAX] = { "languages stoc", }; -struct kexalg { - char *name; - u_int type; - int ec_nid; - int hash_alg; -}; -static const struct kexalg kexalgs[] = { -#ifdef WITH_OPENSSL - { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, - { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, - { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 }, - { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 }, - { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 }, - { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, -#ifdef HAVE_EVP_SHA256 - { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 }, -#endif /* HAVE_EVP_SHA256 */ -#ifdef OPENSSL_HAS_ECC - { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, - NID_X9_62_prime256v1, SSH_DIGEST_SHA256 }, - { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, - SSH_DIGEST_SHA384 }, -# ifdef OPENSSL_HAS_NISTP521 - { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, - SSH_DIGEST_SHA512 }, -# endif /* OPENSSL_HAS_NISTP521 */ -#endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ -#if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL) - { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, - { KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, -#ifdef USE_SNTRUP761X25519 - { KEX_SNTRUP761X25519_SHA512, KEX_KEM_SNTRUP761X25519_SHA512, 0, - SSH_DIGEST_SHA512 }, -#endif -#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ - { NULL, 0, -1, -1}, -}; - -char * -kex_alg_list(char sep) -{ - char *ret = NULL, *tmp; - size_t nlen, rlen = 0; - const struct kexalg *k; - - for (k = kexalgs; k->name != NULL; k++) { - if (ret != NULL) - ret[rlen++] = sep; - nlen = strlen(k->name); - if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { - free(ret); - return NULL; - } - ret = tmp; - memcpy(ret + rlen, k->name, nlen + 1); - rlen += nlen; - } - return ret; -} - -static const struct kexalg * -kex_alg_by_name(const char *name) -{ - const struct kexalg *k; - - for (k = kexalgs; k->name != NULL; k++) { - if (strcmp(k->name, name) == 0) - return k; - } - return NULL; -} - -/* Validate KEX method name list */ -int -kex_names_valid(const char *names) -{ - char *s, *cp, *p; - - if (names == NULL || strcmp(names, "") == 0) - return 0; - if ((s = cp = strdup(names)) == NULL) - return 0; - for ((p = strsep(&cp, ",")); p && *p != '\0'; - (p = strsep(&cp, ","))) { - if (kex_alg_by_name(p) == NULL) { - error("Unsupported KEX algorithm \"%.100s\"", p); - free(s); - return 0; - } - } - debug3("kex names ok: [%s]", names); - free(s); - return 1; -} - -/* returns non-zero if proposal contains any algorithm from algs */ -static int -has_any_alg(const char *proposal, const char *algs) -{ - char *cp; - - if ((cp = match_list(proposal, algs, NULL)) == NULL) - return 0; - free(cp); - return 1; -} - -/* - * Concatenate algorithm names, avoiding duplicates in the process. - * Caller must free returned string. - */ -char * -kex_names_cat(const char *a, const char *b) -{ - char *ret = NULL, *tmp = NULL, *cp, *p; - size_t len; - - if (a == NULL || *a == '\0') - return strdup(b); - if (b == NULL || *b == '\0') - return strdup(a); - if (strlen(b) > 1024*1024) - return NULL; - len = strlen(a) + strlen(b) + 2; - if ((tmp = cp = strdup(b)) == NULL || - (ret = calloc(1, len)) == NULL) { - free(tmp); - return NULL; - } - strlcpy(ret, a, len); - for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) { - if (has_any_alg(ret, p)) - continue; /* Algorithm already present */ - if (strlcat(ret, ",", len) >= len || - strlcat(ret, p, len) >= len) { - free(tmp); - free(ret); - return NULL; /* Shouldn't happen */ - } - } - free(tmp); - return ret; -} - -/* - * Assemble a list of algorithms from a default list and a string from a - * configuration file. The user-provided string may begin with '+' to - * indicate that it should be appended to the default, '-' that the - * specified names should be removed, or '^' that they should be placed - * at the head. - */ -int -kex_assemble_names(char **listp, const char *def, const char *all) -{ - char *cp, *tmp, *patterns; - char *list = NULL, *ret = NULL, *matching = NULL, *opatterns = NULL; - int r = SSH_ERR_INTERNAL_ERROR; - - if (listp == NULL || def == NULL || all == NULL) - return SSH_ERR_INVALID_ARGUMENT; - - if (*listp == NULL || **listp == '\0') { - if ((*listp = strdup(def)) == NULL) - return SSH_ERR_ALLOC_FAIL; - return 0; - } - - list = *listp; - *listp = NULL; - if (*list == '+') { - /* Append names to default list */ - if ((tmp = kex_names_cat(def, list + 1)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - free(list); - list = tmp; - } else if (*list == '-') { - /* Remove names from default list */ - if ((*listp = match_filter_denylist(def, list + 1)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - free(list); - /* filtering has already been done */ - return 0; - } else if (*list == '^') { - /* Place names at head of default list */ - if ((tmp = kex_names_cat(list + 1, def)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - free(list); - list = tmp; - } else { - /* Explicit list, overrides default - just use "list" as is */ - } - - /* - * The supplied names may be a pattern-list. For the -list case, - * the patterns are applied above. For the +list and explicit list - * cases we need to do it now. - */ - ret = NULL; - if ((patterns = opatterns = strdup(list)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - /* Apply positive (i.e. non-negated) patterns from the list */ - while ((cp = strsep(&patterns, ",")) != NULL) { - if (*cp == '!') { - /* negated matches are not supported here */ - r = SSH_ERR_INVALID_ARGUMENT; - goto fail; - } - free(matching); - if ((matching = match_filter_allowlist(all, cp)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - if ((tmp = kex_names_cat(ret, matching)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto fail; - } - free(ret); - ret = tmp; - } - if (ret == NULL || *ret == '\0') { - /* An empty name-list is an error */ - /* XXX better error code? */ - r = SSH_ERR_INVALID_ARGUMENT; - goto fail; - } - - /* success */ - *listp = ret; - ret = NULL; - r = 0; - - fail: - free(matching); - free(opatterns); - free(list); - free(ret); - return r; -} - /* * Fill out a proposal array with dynamically allocated values, which may * be modified as required for compatibility reasons. @@ -527,11 +279,11 @@ kex_set_server_sig_algs(struct ssh *ssh, const char *allowed_algs) (alg = strsep(&algs, ","))) { if ((sigalg = sshkey_sigalg_by_name(alg)) == NULL) continue; - if (!has_any_alg(sigalg, sigalgs)) + if (!kex_has_any_alg(sigalg, sigalgs)) continue; /* Don't add an algorithm twice. */ if (ssh->kex->server_sig_algs != NULL && - has_any_alg(sigalg, ssh->kex->server_sig_algs)) + kex_has_any_alg(sigalg, ssh->kex->server_sig_algs)) continue; xextendf(&ssh->kex->server_sig_algs, ",", "%s", sigalg); } @@ -1090,8 +842,6 @@ choose_comp(struct sshcomp *comp, char *client, char *server) #ifdef WITH_ZLIB if (strcmp(name, "zlib@openssh.com") == 0) { comp->type = COMP_DELAYED; - } else if (strcmp(name, "zlib") == 0) { - comp->type = COMP_ZLIB; } else #endif /* WITH_ZLIB */ if (strcmp(name, "none") == 0) { @@ -1108,20 +858,18 @@ choose_comp(struct sshcomp *comp, char *client, char *server) static int choose_kex(struct kex *k, char *client, char *server) { - const struct kexalg *kexalg; - k->name = match_list(client, server, NULL); debug("kex: algorithm: %s", k->name ? k->name : "(no match)"); if (k->name == NULL) return SSH_ERR_NO_KEX_ALG_MATCH; - if ((kexalg = kex_alg_by_name(k->name)) == NULL) { + if (!kex_name_valid(k->name)) { error_f("unsupported KEX method %s", k->name); return SSH_ERR_INTERNAL_ERROR; } - k->kex_type = kexalg->type; - k->hash_alg = kexalg->hash_alg; - k->ec_nid = kexalg->ec_nid; + k->kex_type = kex_type_from_name(k->name); + k->hash_alg = kex_hash_from_name(k->name); + k->ec_nid = kex_nid_from_name(k->name); return 0; } @@ -1171,7 +919,7 @@ proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX]) static int kexalgs_contains(char **peer, const char *ext) { - return has_any_alg(peer[PROPOSAL_KEX_ALGS], ext); + return kex_has_any_alg(peer[PROPOSAL_KEX_ALGS], ext); } static int @@ -1222,10 +970,10 @@ kex_choose_conf(struct ssh *ssh, uint32_t seq) /* Check whether client supports rsa-sha2 algorithms */ if (kex->server && (kex->flags & KEX_INITIAL)) { - if (has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS], + if (kex_has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS], "rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com")) kex->flags |= KEX_RSA_SHA2_256_SUPPORTED; - if (has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS], + if (kex_has_any_alg(peer[PROPOSAL_SERVER_HOST_KEY_ALGS], "rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com")) kex->flags |= KEX_RSA_SHA2_512_SUPPORTED; } diff --git a/kex.h b/kex.h index 0caf42b..d08988b 100644 --- a/kex.h +++ b/kex.h @@ -1,4 +1,4 @@ -/* $OpenBSD: kex.h,v 1.122 2024/02/02 00:13:34 djm Exp $ */ +/* $OpenBSD: kex.h,v 1.126 2024/09/02 12:13:56 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. @@ -62,11 +62,11 @@ #define KEX_ECDH_SHA2_NISTP521 "ecdh-sha2-nistp521" #define KEX_CURVE25519_SHA256 "curve25519-sha256" #define KEX_CURVE25519_SHA256_OLD "curve25519-sha256@libssh.org" -#define KEX_SNTRUP761X25519_SHA512 "sntrup761x25519-sha512@openssh.com" +#define KEX_SNTRUP761X25519_SHA512 "sntrup761x25519-sha512" +#define KEX_SNTRUP761X25519_SHA512_OLD "sntrup761x25519-sha512@openssh.com" +#define KEX_MLKEM768X25519_SHA256 "mlkem768x25519-sha256" #define COMP_NONE 0 -/* pre-auth compression (COMP_ZLIB) is only supported in the client */ -#define COMP_ZLIB 1 #define COMP_DELAYED 2 #define CURVE25519_SIZE 32 @@ -92,7 +92,7 @@ enum kex_modes { }; enum kex_exchange { - KEX_DH_GRP1_SHA1, + KEX_DH_GRP1_SHA1 = 1, KEX_DH_GRP14_SHA1, KEX_DH_GRP14_SHA256, KEX_DH_GRP16_SHA512, @@ -102,6 +102,7 @@ enum kex_exchange { KEX_ECDH_SHA2, KEX_C25519_SHA256, KEX_KEM_SNTRUP761X25519_SHA512, + KEX_KEM_MLKEM768X25519_SHA256, KEX_MAX }; @@ -180,12 +181,18 @@ struct kex { u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 + KEM */ u_char c25519_client_pubkey[CURVE25519_SIZE]; /* 25519 */ u_char sntrup761_client_key[crypto_kem_sntrup761_SECRETKEYBYTES]; /* KEM */ + u_char mlkem768_client_key[crypto_kem_mlkem768_SECRETKEYBYTES]; /* KEM */ struct sshbuf *client_pub; }; +int kex_name_valid(const char *); +u_int kex_type_from_name(const char *); +int kex_hash_from_name(const char *); +int kex_nid_from_name(const char *); int kex_names_valid(const char *); char *kex_alg_list(char); char *kex_names_cat(const char *, const char *); +int kex_has_any_alg(const char *, const char *); int kex_assemble_names(char **, const char *, const char *); void kex_proposal_populate_entries(struct ssh *, char *prop[PROPOSAL_MAX], const char *, const char *, const char *, const char *, const char *); @@ -241,6 +248,12 @@ int kex_kem_sntrup761x25519_enc(struct kex *, const struct sshbuf *, int kex_kem_sntrup761x25519_dec(struct kex *, const struct sshbuf *, struct sshbuf **); +int kex_kem_mlkem768x25519_keypair(struct kex *); +int kex_kem_mlkem768x25519_enc(struct kex *, const struct sshbuf *, + struct sshbuf **, struct sshbuf **); +int kex_kem_mlkem768x25519_dec(struct kex *, const struct sshbuf *, + struct sshbuf **); + int kex_dh_keygen(struct kex *); int kex_dh_compute_key(struct kex *, BIGNUM *, struct sshbuf *); diff --git a/kexc25519.c b/kexc25519.c index f13d766..e106521 100644 --- a/kexc25519.c +++ b/kexc25519.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexc25519.c,v 1.17 2019/01/21 10:40:11 djm Exp $ */ +/* $OpenBSD: kexc25519.c,v 1.18 2024/09/02 12:13:56 djm Exp $ */ /* * Copyright (c) 2019 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -71,7 +71,7 @@ kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE], return SSH_ERR_KEY_INVALID_EC_VALUE; #ifdef DEBUG_KEXECDH - dump_digest("shared secret", shared_key, CURVE25519_SIZE); + dump_digest("shared secret 25519", shared_key, CURVE25519_SIZE); #endif if (raw) r = sshbuf_put(out, shared_key, CURVE25519_SIZE); diff --git a/kexgen.c b/kexgen.c index 20f3c57..40d688d 100644 --- a/kexgen.c +++ b/kexgen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexgen.c,v 1.8 2021/12/19 22:08:06 djm Exp $ */ +/* $OpenBSD: kexgen.c,v 1.10 2024/09/09 02:39:57 djm Exp $ */ /* * Copyright (c) 2019 Markus Friedl. All rights reserved. * @@ -120,6 +120,9 @@ kex_gen_client(struct ssh *ssh) case KEX_KEM_SNTRUP761X25519_SHA512: r = kex_kem_sntrup761x25519_keypair(kex); break; + case KEX_KEM_MLKEM768X25519_SHA256: + r = kex_kem_mlkem768x25519_keypair(kex); + break; default: r = SSH_ERR_INVALID_ARGUMENT; break; @@ -192,6 +195,10 @@ input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh) r = kex_kem_sntrup761x25519_dec(kex, server_blob, &shared_secret); break; + case KEX_KEM_MLKEM768X25519_SHA256: + r = kex_kem_mlkem768x25519_dec(kex, server_blob, + &shared_secret); + break; default: r = SSH_ERR_INVALID_ARGUMENT; break; @@ -243,6 +250,8 @@ input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh) explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key)); explicit_bzero(kex->sntrup761_client_key, sizeof(kex->sntrup761_client_key)); + explicit_bzero(kex->mlkem768_client_key, + sizeof(kex->mlkem768_client_key)); sshbuf_free(server_host_key_blob); free(signature); sshbuf_free(tmp); @@ -310,6 +319,10 @@ input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh) r = kex_kem_sntrup761x25519_enc(kex, client_pubkey, &server_pubkey, &shared_secret); break; + case KEX_KEM_MLKEM768X25519_SHA256: + r = kex_kem_mlkem768x25519_enc(kex, client_pubkey, + &server_pubkey, &shared_secret); + break; default: r = SSH_ERR_INVALID_ARGUMENT; break; diff --git a/kexgexs.c b/kexgexs.c index 5f025cc..100be03 100644 --- a/kexgexs.c +++ b/kexgexs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexgexs.c,v 1.46 2023/03/29 01:07:48 dtucker Exp $ */ +/* $OpenBSD: kexgexs.c,v 1.47 2024/05/17 00:30:23 djm Exp $ */ /* * Copyright (c) 2000 Niels Provos. All rights reserved. * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -98,7 +98,7 @@ input_kex_dh_gex_request(int type, u_int32_t seq, struct ssh *ssh) } /* Contact privileged parent */ - kex->dh = PRIVSEP(choose_dh(min, nbits, max)); + kex->dh = mm_choose_dh(min, nbits, max); if (kex->dh == NULL) { (void)sshpkt_disconnect(ssh, "no matching DH grp found"); r = SSH_ERR_ALLOC_FAIL; diff --git a/kexmlkem768x25519.c b/kexmlkem768x25519.c new file mode 100644 index 0000000..679446e --- /dev/null +++ b/kexmlkem768x25519.c @@ -0,0 +1,280 @@ +/* $OpenBSD: kexmlkem768x25519.c,v 1.1 2024/09/02 12:13:56 djm Exp $ */ +/* + * Copyright (c) 2023 Markus Friedl. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "includes.h" + +#include + +#include +#ifdef HAVE_STDINT_H +#include +#endif +#include +#include +#include + +#include "sshkey.h" +#include "kex.h" +#include "sshbuf.h" +#include "digest.h" +#include "ssherr.h" +#include "log.h" + +#ifdef USE_MLKEM768X25519 + +#include "libcrux_mlkem768_sha3.h" + +int +kex_kem_mlkem768x25519_keypair(struct kex *kex) +{ + struct sshbuf *buf = NULL; + u_char rnd[LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN], *cp = NULL; + size_t need; + int r = SSH_ERR_INTERNAL_ERROR; + struct libcrux_mlkem768_keypair keypair; + + if ((buf = sshbuf_new()) == NULL) + return SSH_ERR_ALLOC_FAIL; + need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE; + if ((r = sshbuf_reserve(buf, need, &cp)) != 0) + goto out; + arc4random_buf(rnd, sizeof(rnd)); + keypair = libcrux_ml_kem_mlkem768_portable_generate_key_pair(rnd); + memcpy(cp, keypair.pk.value, crypto_kem_mlkem768_PUBLICKEYBYTES); + memcpy(kex->mlkem768_client_key, keypair.sk.value, + sizeof(kex->mlkem768_client_key)); +#ifdef DEBUG_KEXECDH + dump_digest("client public key mlkem768:", cp, + crypto_kem_mlkem768_PUBLICKEYBYTES); +#endif + cp += crypto_kem_mlkem768_PUBLICKEYBYTES; + kexc25519_keygen(kex->c25519_client_key, cp); +#ifdef DEBUG_KEXECDH + dump_digest("client public key c25519:", cp, CURVE25519_SIZE); +#endif + /* success */ + r = 0; + kex->client_pub = buf; + buf = NULL; + out: + explicit_bzero(&keypair, sizeof(keypair)); + explicit_bzero(rnd, sizeof(rnd)); + sshbuf_free(buf); + return r; +} + +int +kex_kem_mlkem768x25519_enc(struct kex *kex, + const struct sshbuf *client_blob, struct sshbuf **server_blobp, + struct sshbuf **shared_secretp) +{ + struct sshbuf *server_blob = NULL; + struct sshbuf *buf = NULL; + const u_char *client_pub; + u_char rnd[LIBCRUX_ML_KEM_ENC_PRNG_LEN]; + u_char server_pub[CURVE25519_SIZE], server_key[CURVE25519_SIZE]; + u_char hash[SSH_DIGEST_MAX_LENGTH]; + size_t need; + int r = SSH_ERR_INTERNAL_ERROR; + struct libcrux_mlkem768_enc_result enc; + struct libcrux_mlkem768_pk mlkem_pub; + + *server_blobp = NULL; + *shared_secretp = NULL; + memset(&mlkem_pub, 0, sizeof(mlkem_pub)); + + /* client_blob contains both KEM and ECDH client pubkeys */ + need = crypto_kem_mlkem768_PUBLICKEYBYTES + CURVE25519_SIZE; + if (sshbuf_len(client_blob) != need) { + r = SSH_ERR_SIGNATURE_INVALID; + goto out; + } + client_pub = sshbuf_ptr(client_blob); +#ifdef DEBUG_KEXECDH + dump_digest("client public key mlkem768:", client_pub, + crypto_kem_mlkem768_PUBLICKEYBYTES); + dump_digest("client public key 25519:", + client_pub + crypto_kem_mlkem768_PUBLICKEYBYTES, + CURVE25519_SIZE); +#endif + /* check public key validity */ + memcpy(mlkem_pub.value, client_pub, crypto_kem_mlkem768_PUBLICKEYBYTES); + if (!libcrux_ml_kem_mlkem768_portable_validate_public_key(&mlkem_pub)) { + r = SSH_ERR_SIGNATURE_INVALID; + goto out; + } + + /* allocate buffer for concatenation of KEM key and ECDH shared key */ + /* the buffer will be hashed and the result is the shared secret */ + if ((buf = sshbuf_new()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto out; + } + /* allocate space for encrypted KEM key and ECDH pub key */ + if ((server_blob = sshbuf_new()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto out; + } + /* generate and encrypt KEM key with client key */ + arc4random_buf(rnd, sizeof(rnd)); + enc = libcrux_ml_kem_mlkem768_portable_encapsulate(&mlkem_pub, rnd); + /* generate ECDH key pair, store server pubkey after ciphertext */ + kexc25519_keygen(server_key, server_pub); + if ((r = sshbuf_put(buf, enc.snd, sizeof(enc.snd))) != 0 || + (r = sshbuf_put(server_blob, enc.fst.value, sizeof(enc.fst.value))) != 0 || + (r = sshbuf_put(server_blob, server_pub, sizeof(server_pub))) != 0) + goto out; + /* append ECDH shared key */ + client_pub += crypto_kem_mlkem768_PUBLICKEYBYTES; + if ((r = kexc25519_shared_key_ext(server_key, client_pub, buf, 1)) < 0) + goto out; + if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0) + goto out; +#ifdef DEBUG_KEXECDH + dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE); + dump_digest("server cipher text:", + enc.fst.value, sizeof(enc.fst.value)); + dump_digest("server kem key:", enc.snd, sizeof(enc.snd)); + dump_digest("concatenation of KEM key and ECDH shared key:", + sshbuf_ptr(buf), sshbuf_len(buf)); +#endif + /* string-encoded hash is resulting shared secret */ + sshbuf_reset(buf); + if ((r = sshbuf_put_string(buf, hash, + ssh_digest_bytes(kex->hash_alg))) != 0) + goto out; +#ifdef DEBUG_KEXECDH + dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf)); +#endif + /* success */ + r = 0; + *server_blobp = server_blob; + *shared_secretp = buf; + server_blob = NULL; + buf = NULL; + out: + explicit_bzero(hash, sizeof(hash)); + explicit_bzero(server_key, sizeof(server_key)); + explicit_bzero(rnd, sizeof(rnd)); + explicit_bzero(&enc, sizeof(enc)); + sshbuf_free(server_blob); + sshbuf_free(buf); + return r; +} + +int +kex_kem_mlkem768x25519_dec(struct kex *kex, + const struct sshbuf *server_blob, struct sshbuf **shared_secretp) +{ + struct sshbuf *buf = NULL; + u_char mlkem_key[crypto_kem_mlkem768_BYTES]; + const u_char *ciphertext, *server_pub; + u_char hash[SSH_DIGEST_MAX_LENGTH]; + size_t need; + int r; + struct libcrux_mlkem768_sk mlkem_priv; + struct libcrux_mlkem768_ciphertext mlkem_ciphertext; + + *shared_secretp = NULL; + memset(&mlkem_priv, 0, sizeof(mlkem_priv)); + memset(&mlkem_ciphertext, 0, sizeof(mlkem_ciphertext)); + + need = crypto_kem_mlkem768_CIPHERTEXTBYTES + CURVE25519_SIZE; + if (sshbuf_len(server_blob) != need) { + r = SSH_ERR_SIGNATURE_INVALID; + goto out; + } + ciphertext = sshbuf_ptr(server_blob); + server_pub = ciphertext + crypto_kem_mlkem768_CIPHERTEXTBYTES; + /* hash concatenation of KEM key and ECDH shared key */ + if ((buf = sshbuf_new()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto out; + } + memcpy(mlkem_priv.value, kex->mlkem768_client_key, + sizeof(kex->mlkem768_client_key)); + memcpy(mlkem_ciphertext.value, ciphertext, + sizeof(mlkem_ciphertext.value)); +#ifdef DEBUG_KEXECDH + dump_digest("server cipher text:", mlkem_ciphertext.value, + sizeof(mlkem_ciphertext.value)); + dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE); +#endif + libcrux_ml_kem_mlkem768_portable_decapsulate(&mlkem_priv, + &mlkem_ciphertext, mlkem_key); + if ((r = sshbuf_put(buf, mlkem_key, sizeof(mlkem_key))) != 0) + goto out; + if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub, + buf, 1)) < 0) + goto out; + if ((r = ssh_digest_buffer(kex->hash_alg, buf, + hash, sizeof(hash))) != 0) + goto out; +#ifdef DEBUG_KEXECDH + dump_digest("client kem key:", mlkem_key, sizeof(mlkem_key)); + dump_digest("concatenation of KEM key and ECDH shared key:", + sshbuf_ptr(buf), sshbuf_len(buf)); +#endif + sshbuf_reset(buf); + if ((r = sshbuf_put_string(buf, hash, + ssh_digest_bytes(kex->hash_alg))) != 0) + goto out; +#ifdef DEBUG_KEXECDH + dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf)); +#endif + /* success */ + r = 0; + *shared_secretp = buf; + buf = NULL; + out: + explicit_bzero(hash, sizeof(hash)); + explicit_bzero(&mlkem_priv, sizeof(mlkem_priv)); + explicit_bzero(&mlkem_ciphertext, sizeof(mlkem_ciphertext)); + explicit_bzero(mlkem_key, sizeof(mlkem_key)); + sshbuf_free(buf); + return r; +} +#else /* USE_MLKEM768X25519 */ +int +kex_kem_mlkem768x25519_keypair(struct kex *kex) +{ + return SSH_ERR_SIGN_ALG_UNSUPPORTED; +} + +int +kex_kem_mlkem768x25519_enc(struct kex *kex, + const struct sshbuf *client_blob, struct sshbuf **server_blobp, + struct sshbuf **shared_secretp) +{ + return SSH_ERR_SIGN_ALG_UNSUPPORTED; +} + +int +kex_kem_mlkem768x25519_dec(struct kex *kex, + const struct sshbuf *server_blob, struct sshbuf **shared_secretp) +{ + return SSH_ERR_SIGN_ALG_UNSUPPORTED; +} +#endif /* USE_MLKEM768X25519 */ diff --git a/kexsntrup761x25519.c b/kexsntrup761x25519.c index 6afb1ba..6bbca71 100644 --- a/kexsntrup761x25519.c +++ b/kexsntrup761x25519.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexsntrup761x25519.c,v 1.2 2021/12/05 12:28:27 jsg Exp $ */ +/* $OpenBSD: kexsntrup761x25519.c,v 1.3 2024/09/15 02:20:51 djm Exp $ */ /* * Copyright (c) 2019 Markus Friedl. All rights reserved. * @@ -39,6 +39,10 @@ #include "digest.h" #include "ssherr.h" +volatile crypto_int16 crypto_int16_optblocker = 0; +volatile crypto_int32 crypto_int32_optblocker = 0; +volatile crypto_int64 crypto_int64_optblocker = 0; + int kex_kem_sntrup761x25519_keypair(struct kex *kex) { diff --git a/libcrux_mlkem768_sha3.h b/libcrux_mlkem768_sha3.h new file mode 100644 index 0000000..a82d60e --- /dev/null +++ b/libcrux_mlkem768_sha3.h @@ -0,0 +1,12332 @@ +/* $OpenBSD: libcrux_mlkem768_sha3.h,v 1.1 2024/09/02 12:13:56 djm Exp $ */ +/* Extracted from libcrux revision 84c5d87b3092c59294345aa269ceefe0eb97cc35 */ + +/* + * MIT License + * + * Copyright (c) 2024 Cryspen + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +#if !defined(__GNUC__) || (__GNUC__ < 2) +# define __attribute__(x) +#endif +#define KRML_MUSTINLINE inline +#define KRML_NOINLINE __attribute__((noinline, unused)) +#define KRML_HOST_EPRINTF(...) +#define KRML_HOST_EXIT(x) fatal_f("internal error") + +/* from libcrux/libcrux-ml-kem/cg/eurydice_glue.h */ +/* + * SPDX-FileCopyrightText: 2024 Eurydice Contributors + * SPDX-FileCopyrightText: 2024 Cryspen Sarl + * + * SPDX-License-Identifier: MIT or Apache-2.0 + */ + +#pragma once + +#if defined(__cplusplus) +extern "C" { +#endif + + + +// SLICES, ARRAYS, ETC. + +// The MSVC C++ compiler does not support compound literals. +// This CLITERAL is used to turn `(type){...}` into `type{...}` when using a C++ +// compiler. +#if defined(__cplusplus) +#define CLITERAL(type) type +#else +#define CLITERAL(type) (type) +#endif + +// We represent a slice as a pair of an (untyped) pointer, along with the length +// of the slice, i.e. the number of elements in the slice (this is NOT the +// number of bytes). This design choice has two important consequences. +// - if you need to use `ptr`, you MUST cast it to a proper type *before* +// performing pointer +// arithmetic on it (remember that C desugars pointer arithmetic based on the +// type of the address) +// - if you need to use `len` for a C style function (e.g. memcpy, memcmp), you +// need to multiply it +// by sizeof t, where t is the type of the elements. +// +// Empty slices have `len == 0` and `ptr` always needs to be valid pointer that +// is not NULL (otherwise the construction in EURYDICE_SLICE computes `NULL + +// start`). +typedef struct { + void *ptr; + size_t len; +} Eurydice_slice; + +// Helper macro to create a slice out of a pointer x, a start index in x +// (included), and an end index in x (excluded). The argument x must be suitably +// cast to something that can decay (see remark above about how pointer +// arithmetic works in C), meaning either pointer or array type. +#define EURYDICE_SLICE(x, start, end) \ + (CLITERAL(Eurydice_slice){.ptr = (void *)(x + start), .len = end - start}) +#define EURYDICE_SLICE_LEN(s, _) s.len +// This macro is a pain because in case the dereferenced element type is an +// array, you cannot simply write `t x` as it would yield `int[4] x` instead, +// which is NOT correct C syntax, so we add a dedicated phase in Eurydice that +// adds an extra argument to this macro at the last minute so that we have the +// correct type of *pointers* to elements. +#define Eurydice_slice_index(s, i, t, t_ptr_t) (((t_ptr_t)s.ptr)[i]) +#define Eurydice_slice_subslice(s, r, t, _) \ + EURYDICE_SLICE((t *)s.ptr, r.start, r.end) +// Variant for when the start and end indices are statically known (i.e., the +// range argument `r` is a literal). +#define Eurydice_slice_subslice2(s, start, end, t) \ + EURYDICE_SLICE((t *)s.ptr, start, end) +#define Eurydice_slice_subslice_to(s, subslice_end_pos, t, _) \ + EURYDICE_SLICE((t *)s.ptr, 0, subslice_end_pos) +#define Eurydice_slice_subslice_from(s, subslice_start_pos, t, _) \ + EURYDICE_SLICE((t *)s.ptr, subslice_start_pos, s.len) +#define Eurydice_array_to_slice(end, x, t) \ + EURYDICE_SLICE(x, 0, \ + end) /* x is already at an array type, no need for cast */ +#define Eurydice_array_to_subslice(_arraylen, x, r, t, _) \ + EURYDICE_SLICE((t *)x, r.start, r.end) +// Same as above, variant for when start and end are statically known +#define Eurydice_array_to_subslice2(x, start, end, t) \ + EURYDICE_SLICE((t *)x, start, end) +#define Eurydice_array_to_subslice_to(_size, x, r, t, _range_t) \ + EURYDICE_SLICE((t *)x, 0, r) +#define Eurydice_array_to_subslice_from(size, x, r, t, _range_t) \ + EURYDICE_SLICE((t *)x, r, size) +#define Eurydice_slice_len(s, t) EURYDICE_SLICE_LEN(s, t) +#define Eurydice_slice_copy(dst, src, t) \ + memcpy(dst.ptr, src.ptr, dst.len * sizeof(t)) +#define core_array___Array_T__N__23__as_slice(len_, ptr_, t, _ret_t) \ + ((Eurydice_slice){.ptr = ptr_, .len = len_}) + +#define core_array___core__clone__Clone_for__Array_T__N___20__clone( \ + len, src, dst, elem_type, _ret_t) \ + (memcpy(dst, src, len * sizeof(elem_type))) +#define TryFromSliceError uint8_t + +#define Eurydice_array_eq(sz, a1, a2, t, _) \ + (memcmp(a1, a2, sz * sizeof(t)) == 0) +#define core_array_equality___core__cmp__PartialEq__Array_U__N___for__Array_T__N____eq( \ + sz, a1, a2, t, _, _ret_t) \ + Eurydice_array_eq(sz, a1, a2, t, _) +#define core_array_equality___core__cmp__PartialEq__0___Slice_U____for__Array_T__N___3__eq( \ + sz, a1, a2, t, _, _ret_t) \ + Eurydice_array_eq(sz, a1, ((a2)->ptr), t, _) + +#define Eurydice_slice_split_at(slice, mid, element_type, ret_t) \ + (CLITERAL(ret_t){ \ + .fst = EURYDICE_SLICE((element_type *)slice.ptr, 0, mid), \ + .snd = EURYDICE_SLICE((element_type *)slice.ptr, mid, slice.len)}) +#define Eurydice_slice_split_at_mut(slice, mid, element_type, ret_t) \ + (CLITERAL(ret_t){ \ + .fst = {.ptr = slice.ptr, .len = mid}, \ + .snd = {.ptr = (char *)slice.ptr + mid * sizeof(element_type), \ + .len = slice.len - mid}}) + +// Conversion of slice to an array, rewritten (by Eurydice) to name the +// destination array, since arrays are not values in C. +// N.B.: see note in karamel/lib/Inlining.ml if you change this. +#define Eurydice_slice_to_array2(dst, src, _, t_arr) \ + Eurydice_slice_to_array3(&(dst)->tag, (char *)&(dst)->val.case_Ok, src, \ + sizeof(t_arr)) + +static inline void Eurydice_slice_to_array3(uint8_t *dst_tag, char *dst_ok, + Eurydice_slice src, size_t sz) { + *dst_tag = 0; + memcpy(dst_ok, src.ptr, sz); +} + +// CORE STUFF (conversions, endianness, ...) + +static inline void core_num__u64_9__to_le_bytes(uint64_t v, uint8_t buf[8]) { + memcpy(buf, &v, sizeof(v)); +} +static inline uint64_t core_num__u64_9__from_le_bytes(uint8_t buf[8]) { + uint64_t v; + memcpy(&v, buf, sizeof(v)); + return v; +} + +static inline uint32_t core_num__u32_8__from_le_bytes(uint8_t buf[4]) { + uint32_t v; + memcpy(&v, buf, sizeof(v)); + return v; +} + +static inline uint32_t core_num__u8_6__count_ones(uint8_t x0) { +#ifdef _MSC_VER + return __popcnt(x0); +#else + return __builtin_popcount(x0); +#endif +} + +// unsigned overflow wraparound semantics in C +static inline uint16_t core_num__u16_7__wrapping_add(uint16_t x, uint16_t y) { + return x + y; +} +static inline uint8_t core_num__u8_6__wrapping_sub(uint8_t x, uint8_t y) { + return x - y; +} + +// ITERATORS + +#define Eurydice_range_iter_next(iter_ptr, t, ret_t) \ + (((iter_ptr)->start == (iter_ptr)->end) \ + ? (CLITERAL(ret_t){.tag = None}) \ + : (CLITERAL(ret_t){.tag = Some, .f0 = (iter_ptr)->start++})) + +#define core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next \ + Eurydice_range_iter_next + +// See note in karamel/lib/Inlining.ml if you change this +#define Eurydice_into_iter(x, t, _ret_t) (x) +#define core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter \ + Eurydice_into_iter + +#if defined(__cplusplus) +} +#endif + +/* from libcrux/libcrux-ml-kem/cg/libcrux_core.h */ +/* + * SPDX-FileCopyrightText: 2024 Cryspen Sarl + * + * SPDX-License-Identifier: MIT or Apache-2.0 + * + * This code was generated with the following revisions: + * Charon: 6b5e110342a771a3e1c739b10294b1778e4be8b4 + * Eurydice: 31be7d65ca5d6acdacfb33652e478d24dd85c1cb + * Karamel: 3205d3365ea2790b02368f79fcee38e38d0b5908 + * F*: a32b316e521fa4f239b610ec8f1d15e78d62cbe8-dirty + * Libcrux: 4ad532b206174114dd4140b718e7794a28fc59ee + */ + +#ifndef __libcrux_core_H +#define __libcrux_core_H + +#if defined(__cplusplus) +extern "C" { +#endif + + +/** +A monomorphic instance of core.ops.range.Range +with types size_t + +*/ +typedef struct core_ops_range_Range_b3_s { + size_t start; + size_t end; +} core_ops_range_Range_b3; + +#define Ok 0 +#define Err 1 + +typedef uint8_t Result_86_tags; + +#define None 0 +#define Some 1 + +typedef uint8_t Option_ef_tags; + +/** +A monomorphic instance of core.option.Option +with types size_t + +*/ +typedef struct Option_b3_s { + Option_ef_tags tag; + size_t f0; +} Option_b3; + +static inline uint16_t core_num__u16_7__wrapping_add(uint16_t x0, uint16_t x1); + +#define CORE_NUM__U32_8__BITS (32U) + +static inline uint64_t core_num__u64_9__from_le_bytes(uint8_t x0[8U]); + +static inline void core_num__u64_9__to_le_bytes(uint64_t x0, uint8_t x1[8U]); + +static inline uint32_t core_num__u8_6__count_ones(uint8_t x0); + +static inline uint8_t core_num__u8_6__wrapping_sub(uint8_t x0, uint8_t x1); + +#define LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE ((size_t)32U) + +#define LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT ((size_t)12U) + +#define LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT ((size_t)256U) + +#define LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT \ + (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * (size_t)12U) + +#define LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT \ + (LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT / (size_t)8U) + +#define LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE ((size_t)32U) + +#define LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE ((size_t)32U) + +typedef struct libcrux_ml_kem_utils_extraction_helper_Keypair768_s { + uint8_t fst[1152U]; + uint8_t snd[1184U]; +} libcrux_ml_kem_utils_extraction_helper_Keypair768; + +/** +A monomorphic instance of core.result.Result +with types uint8_t[24size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_6f_s { + Result_86_tags tag; + union { + uint8_t case_Ok[24U]; + TryFromSliceError case_Err; + } val; +} Result_6f; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types uint8_t[24size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_1c(Result_6f self, uint8_t ret[24U]) { + if (self.tag == Ok) { + uint8_t f0[24U]; + memcpy(f0, self.val.case_Ok, (size_t)24U * sizeof(uint8_t)); + memcpy(ret, f0, (size_t)24U * sizeof(uint8_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +/** +A monomorphic instance of core.result.Result +with types uint8_t[20size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_7a_s { + Result_86_tags tag; + union { + uint8_t case_Ok[20U]; + TryFromSliceError case_Err; + } val; +} Result_7a; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types uint8_t[20size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_34(Result_7a self, uint8_t ret[20U]) { + if (self.tag == Ok) { + uint8_t f0[20U]; + memcpy(f0, self.val.case_Ok, (size_t)20U * sizeof(uint8_t)); + memcpy(ret, f0, (size_t)20U * sizeof(uint8_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +/** +A monomorphic instance of core.result.Result +with types uint8_t[10size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_cd_s { + Result_86_tags tag; + union { + uint8_t case_Ok[10U]; + TryFromSliceError case_Err; + } val; +} Result_cd; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types uint8_t[10size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_e8(Result_cd self, uint8_t ret[10U]) { + if (self.tag == Ok) { + uint8_t f0[10U]; + memcpy(f0, self.val.case_Ok, (size_t)10U * sizeof(uint8_t)); + memcpy(ret, f0, (size_t)10U * sizeof(uint8_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +typedef struct Eurydice_slice_uint8_t_4size_t__x2_s { + Eurydice_slice fst[4U]; + Eurydice_slice snd[4U]; +} Eurydice_slice_uint8_t_4size_t__x2; + +typedef struct libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s { + uint8_t value[1088U]; +} libcrux_ml_kem_mlkem768_MlKem768Ciphertext; + +/** + A reference to the raw byte slice. +*/ +/** +This function found in impl {libcrux_ml_kem::types::MlKemCiphertext#6} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.as_slice_d4 +with const generics +- SIZE= 1088 +*/ +static inline uint8_t *libcrux_ml_kem_types_as_slice_d4_1d( + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *self) { + return self->value; +} + +/** +A monomorphic instance of libcrux_ml_kem.types.MlKemPublicKey +with const generics +- $1184size_t +*/ +typedef struct libcrux_ml_kem_types_MlKemPublicKey_15_s { + uint8_t value[1184U]; +} libcrux_ml_kem_types_MlKemPublicKey_15; + +/** +This function found in impl {(core::convert::From<@Array> for +libcrux_ml_kem::types::MlKemPublicKey)#14} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.from_b6 +with const generics +- SIZE= 1184 +*/ +static inline libcrux_ml_kem_types_MlKemPublicKey_15 +libcrux_ml_kem_types_from_b6_da(uint8_t value[1184U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_value[1184U]; + memcpy(copy_of_value, value, (size_t)1184U * sizeof(uint8_t)); + libcrux_ml_kem_types_MlKemPublicKey_15 lit; + memcpy(lit.value, copy_of_value, (size_t)1184U * sizeof(uint8_t)); + return lit; +} + +/** +A monomorphic instance of libcrux_ml_kem.types.MlKemPrivateKey +with const generics +- $2400size_t +*/ +typedef struct libcrux_ml_kem_types_MlKemPrivateKey_55_s { + uint8_t value[2400U]; +} libcrux_ml_kem_types_MlKemPrivateKey_55; + +typedef struct libcrux_ml_kem_mlkem768_MlKem768KeyPair_s { + libcrux_ml_kem_types_MlKemPrivateKey_55 sk; + libcrux_ml_kem_types_MlKemPublicKey_15 pk; +} libcrux_ml_kem_mlkem768_MlKem768KeyPair; + +/** + Create a new [`MlKemKeyPair`] from the secret and public key. +*/ +/** +This function found in impl +{libcrux_ml_kem::types::MlKemKeyPair} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.from_17 +with const generics +- PRIVATE_KEY_SIZE= 2400 +- PUBLIC_KEY_SIZE= 1184 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_types_from_17_35(libcrux_ml_kem_types_MlKemPrivateKey_55 sk, + libcrux_ml_kem_types_MlKemPublicKey_15 pk) { + return ( + CLITERAL(libcrux_ml_kem_mlkem768_MlKem768KeyPair){.sk = sk, .pk = pk}); +} + +/** +This function found in impl {(core::convert::From<@Array> for +libcrux_ml_kem::types::MlKemPrivateKey)#8} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.from_05 +with const generics +- SIZE= 2400 +*/ +static inline libcrux_ml_kem_types_MlKemPrivateKey_55 +libcrux_ml_kem_types_from_05_f2(uint8_t value[2400U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_value[2400U]; + memcpy(copy_of_value, value, (size_t)2400U * sizeof(uint8_t)); + libcrux_ml_kem_types_MlKemPrivateKey_55 lit; + memcpy(lit.value, copy_of_value, (size_t)2400U * sizeof(uint8_t)); + return lit; +} + +/** +A monomorphic instance of core.result.Result +with types uint8_t[32size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_00_s { + Result_86_tags tag; + union { + uint8_t case_Ok[32U]; + TryFromSliceError case_Err; + } val; +} Result_00; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types uint8_t[32size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_83(Result_00 self, uint8_t ret[32U]) { + if (self.tag == Ok) { + uint8_t f0[32U]; + memcpy(f0, self.val.case_Ok, (size_t)32U * sizeof(uint8_t)); + memcpy(ret, f0, (size_t)32U * sizeof(uint8_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +/** +A monomorphic instance of K. +with types libcrux_ml_kem_types_MlKemCiphertext[[$1088size_t]], +uint8_t[32size_t] + +*/ +typedef struct tuple_3c_s { + libcrux_ml_kem_mlkem768_MlKem768Ciphertext fst; + uint8_t snd[32U]; +} tuple_3c; + +/** +This function found in impl {(core::convert::From<@Array> for +libcrux_ml_kem::types::MlKemCiphertext)#2} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.from_01 +with const generics +- SIZE= 1088 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768Ciphertext +libcrux_ml_kem_types_from_01_9f(uint8_t value[1088U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_value[1088U]; + memcpy(copy_of_value, value, (size_t)1088U * sizeof(uint8_t)); + libcrux_ml_kem_mlkem768_MlKem768Ciphertext lit; + memcpy(lit.value, copy_of_value, (size_t)1088U * sizeof(uint8_t)); + return lit; +} + +/** + A reference to the raw byte slice. +*/ +/** +This function found in impl {libcrux_ml_kem::types::MlKemPublicKey#18} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.as_slice_cb +with const generics +- SIZE= 1184 +*/ +static inline uint8_t *libcrux_ml_kem_types_as_slice_cb_50( + libcrux_ml_kem_types_MlKemPublicKey_15 *self) { + return self->value; +} + +/** + Pad the `slice` with `0`s at the end. +*/ +/** +A monomorphic instance of libcrux_ml_kem.utils.into_padded_array +with const generics +- LEN= 33 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_ea2( + Eurydice_slice slice, uint8_t ret[33U]) { + uint8_t out[33U] = {0U}; + uint8_t *uu____0 = out; + Eurydice_slice_copy( + Eurydice_array_to_subslice2(uu____0, (size_t)0U, + Eurydice_slice_len(slice, uint8_t), uint8_t), + slice, uint8_t); + memcpy(ret, out, (size_t)33U * sizeof(uint8_t)); +} + +/** + Pad the `slice` with `0`s at the end. +*/ +/** +A monomorphic instance of libcrux_ml_kem.utils.into_padded_array +with const generics +- LEN= 34 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_ea1( + Eurydice_slice slice, uint8_t ret[34U]) { + uint8_t out[34U] = {0U}; + uint8_t *uu____0 = out; + Eurydice_slice_copy( + Eurydice_array_to_subslice2(uu____0, (size_t)0U, + Eurydice_slice_len(slice, uint8_t), uint8_t), + slice, uint8_t); + memcpy(ret, out, (size_t)34U * sizeof(uint8_t)); +} + +/** +This function found in impl {(core::convert::AsRef<@Slice> for +libcrux_ml_kem::types::MlKemCiphertext)#1} +*/ +/** +A monomorphic instance of libcrux_ml_kem.types.as_ref_00 +with const generics +- SIZE= 1088 +*/ +static inline Eurydice_slice libcrux_ml_kem_types_as_ref_00_24( + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *self) { + return Eurydice_array_to_slice((size_t)1088U, self->value, uint8_t); +} + +/** + Pad the `slice` with `0`s at the end. +*/ +/** +A monomorphic instance of libcrux_ml_kem.utils.into_padded_array +with const generics +- LEN= 1120 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_ea0( + Eurydice_slice slice, uint8_t ret[1120U]) { + uint8_t out[1120U] = {0U}; + uint8_t *uu____0 = out; + Eurydice_slice_copy( + Eurydice_array_to_subslice2(uu____0, (size_t)0U, + Eurydice_slice_len(slice, uint8_t), uint8_t), + slice, uint8_t); + memcpy(ret, out, (size_t)1120U * sizeof(uint8_t)); +} + +/** + Pad the `slice` with `0`s at the end. +*/ +/** +A monomorphic instance of libcrux_ml_kem.utils.into_padded_array +with const generics +- LEN= 64 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_utils_into_padded_array_ea( + Eurydice_slice slice, uint8_t ret[64U]) { + uint8_t out[64U] = {0U}; + uint8_t *uu____0 = out; + Eurydice_slice_copy( + Eurydice_array_to_subslice2(uu____0, (size_t)0U, + Eurydice_slice_len(slice, uint8_t), uint8_t), + slice, uint8_t); + memcpy(ret, out, (size_t)64U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of core.result.Result +with types int16_t[16size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_c0_s { + Result_86_tags tag; + union { + int16_t case_Ok[16U]; + TryFromSliceError case_Err; + } val; +} Result_c0; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types int16_t[16size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_f9(Result_c0 self, int16_t ret[16U]) { + if (self.tag == Ok) { + int16_t f0[16U]; + memcpy(f0, self.val.case_Ok, (size_t)16U * sizeof(int16_t)); + memcpy(ret, f0, (size_t)16U * sizeof(int16_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +/** +A monomorphic instance of core.result.Result +with types uint8_t[8size_t], core_array_TryFromSliceError + +*/ +typedef struct Result_56_s { + Result_86_tags tag; + union { + uint8_t case_Ok[8U]; + TryFromSliceError case_Err; + } val; +} Result_56; + +/** +This function found in impl {core::result::Result} +*/ +/** +A monomorphic instance of core.result.unwrap_41 +with types uint8_t[8size_t], core_array_TryFromSliceError + +*/ +static inline void unwrap_41_ac(Result_56 self, uint8_t ret[8U]) { + if (self.tag == Ok) { + uint8_t f0[8U]; + memcpy(f0, self.val.case_Ok, (size_t)8U * sizeof(uint8_t)); + memcpy(ret, f0, (size_t)8U * sizeof(uint8_t)); + } else { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "unwrap not Ok"); + KRML_HOST_EXIT(255U); + } +} + +typedef struct Eurydice_slice_uint8_t_x2_s { + Eurydice_slice fst; + Eurydice_slice snd; +} Eurydice_slice_uint8_t_x2; + +typedef struct Eurydice_slice_uint8_t_1size_t__x2_s { + Eurydice_slice fst[1U]; + Eurydice_slice snd[1U]; +} Eurydice_slice_uint8_t_1size_t__x2; + +#if defined(__cplusplus) +} +#endif + +#define __libcrux_core_H_DEFINED +#endif + +/* from libcrux/libcrux-ml-kem/cg/libcrux_ct_ops.h */ +/* + * SPDX-FileCopyrightText: 2024 Cryspen Sarl + * + * SPDX-License-Identifier: MIT or Apache-2.0 + * + * This code was generated with the following revisions: + * Charon: 6b5e110342a771a3e1c739b10294b1778e4be8b4 + * Eurydice: 31be7d65ca5d6acdacfb33652e478d24dd85c1cb + * Karamel: 3205d3365ea2790b02368f79fcee38e38d0b5908 + * F*: a32b316e521fa4f239b610ec8f1d15e78d62cbe8-dirty + * Libcrux: 4ad532b206174114dd4140b718e7794a28fc59ee + */ + +#ifndef __libcrux_ct_ops_H +#define __libcrux_ct_ops_H + +#if defined(__cplusplus) +extern "C" { +#endif + + +/** + Return 1 if `value` is not zero and 0 otherwise. +*/ +static inline uint8_t libcrux_ml_kem_constant_time_ops_inz(uint8_t value) { + uint16_t value0 = (uint16_t)value; + uint16_t result = (((uint32_t)value0 | + (uint32_t)core_num__u16_7__wrapping_add(~value0, 1U)) & + 0xFFFFU) >> + 8U & + 1U; + return (uint8_t)result; +} + +static KRML_NOINLINE uint8_t +libcrux_ml_kem_constant_time_ops_is_non_zero(uint8_t value) { + return libcrux_ml_kem_constant_time_ops_inz(value); +} + +/** + Return 1 if the bytes of `lhs` and `rhs` do not exactly + match and 0 otherwise. +*/ +static inline uint8_t libcrux_ml_kem_constant_time_ops_compare( + Eurydice_slice lhs, Eurydice_slice rhs) { + uint8_t r = 0U; + for (size_t i = (size_t)0U; i < Eurydice_slice_len(lhs, uint8_t); i++) { + size_t i0 = i; + r = (uint32_t)r | + ((uint32_t)Eurydice_slice_index(lhs, i0, uint8_t, uint8_t *) ^ + (uint32_t)Eurydice_slice_index(rhs, i0, uint8_t, uint8_t *)); + } + return libcrux_ml_kem_constant_time_ops_is_non_zero(r); +} + +static KRML_NOINLINE uint8_t +libcrux_ml_kem_constant_time_ops_compare_ciphertexts_in_constant_time( + Eurydice_slice lhs, Eurydice_slice rhs) { + return libcrux_ml_kem_constant_time_ops_compare(lhs, rhs); +} + +/** + If `selector` is not zero, return the bytes in `rhs`; return the bytes in + `lhs` otherwise. +*/ +static inline void libcrux_ml_kem_constant_time_ops_select_ct( + Eurydice_slice lhs, Eurydice_slice rhs, uint8_t selector, + uint8_t ret[32U]) { + uint8_t mask = core_num__u8_6__wrapping_sub( + libcrux_ml_kem_constant_time_ops_is_non_zero(selector), 1U); + uint8_t out[32U] = {0U}; + for (size_t i = (size_t)0U; i < LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE; + i++) { + size_t i0 = i; + out[i0] = ((uint32_t)Eurydice_slice_index(lhs, i0, uint8_t, uint8_t *) & + (uint32_t)mask) | + ((uint32_t)Eurydice_slice_index(rhs, i0, uint8_t, uint8_t *) & + (uint32_t)~mask); + } + memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); +} + +static KRML_NOINLINE void +libcrux_ml_kem_constant_time_ops_select_shared_secret_in_constant_time( + Eurydice_slice lhs, Eurydice_slice rhs, uint8_t selector, + uint8_t ret[32U]) { + libcrux_ml_kem_constant_time_ops_select_ct(lhs, rhs, selector, ret); +} + +static inline void +libcrux_ml_kem_constant_time_ops_compare_ciphertexts_select_shared_secret_in_constant_time( + Eurydice_slice lhs_c, Eurydice_slice rhs_c, Eurydice_slice lhs_s, + Eurydice_slice rhs_s, uint8_t ret[32U]) { + uint8_t selector = + libcrux_ml_kem_constant_time_ops_compare_ciphertexts_in_constant_time( + lhs_c, rhs_c); + uint8_t ret0[32U]; + libcrux_ml_kem_constant_time_ops_select_shared_secret_in_constant_time( + lhs_s, rhs_s, selector, ret0); + memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); +} + +#if defined(__cplusplus) +} +#endif + +#define __libcrux_ct_ops_H_DEFINED +#endif + +/* from libcrux/libcrux-ml-kem/cg/libcrux_sha3_portable.h */ +/* + * SPDX-FileCopyrightText: 2024 Cryspen Sarl + * + * SPDX-License-Identifier: MIT or Apache-2.0 + * + * This code was generated with the following revisions: + * Charon: 6b5e110342a771a3e1c739b10294b1778e4be8b4 + * Eurydice: 31be7d65ca5d6acdacfb33652e478d24dd85c1cb + * Karamel: 3205d3365ea2790b02368f79fcee38e38d0b5908 + * F*: a32b316e521fa4f239b610ec8f1d15e78d62cbe8-dirty + * Libcrux: 4ad532b206174114dd4140b718e7794a28fc59ee + */ + +#ifndef __libcrux_sha3_portable_H +#define __libcrux_sha3_portable_H + +#if defined(__cplusplus) +extern "C" { +#endif + + +static const uint64_t libcrux_sha3_generic_keccak_ROUNDCONSTANTS[24U] = { + 1ULL, + 32898ULL, + 9223372036854808714ULL, + 9223372039002292224ULL, + 32907ULL, + 2147483649ULL, + 9223372039002292353ULL, + 9223372036854808585ULL, + 138ULL, + 136ULL, + 2147516425ULL, + 2147483658ULL, + 2147516555ULL, + 9223372036854775947ULL, + 9223372036854808713ULL, + 9223372036854808579ULL, + 9223372036854808578ULL, + 9223372036854775936ULL, + 32778ULL, + 9223372039002259466ULL, + 9223372039002292353ULL, + 9223372036854808704ULL, + 2147483649ULL, + 9223372039002292232ULL}; + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t libcrux_sha3_portable_keccak_zero_5a(void) { + return 0ULL; +} + +static KRML_MUSTINLINE uint64_t libcrux_sha3_portable_keccak__veor5q_u64( + uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e) { + uint64_t ab = a ^ b; + uint64_t cd = c ^ d; + uint64_t abcd = ab ^ cd; + return abcd ^ e; +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t libcrux_sha3_portable_keccak_xor5_5a( + uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e) { + return libcrux_sha3_portable_keccak__veor5q_u64(a, b, c, d, e); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 1 +- RIGHT= 63 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb(uint64_t x) { + return x << (uint32_t)(int32_t)1 | x >> (uint32_t)(int32_t)63; +} + +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vrax1q_u64(uint64_t a, uint64_t b) { + uint64_t uu____0 = a; + return uu____0 ^ libcrux_sha3_portable_keccak_rotate_left_cb(b); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vrax1q_u64(a, b); +} + +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vbcaxq_u64(uint64_t a, uint64_t b, uint64_t c) { + return a ^ (b & ~c); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t libcrux_sha3_portable_keccak_and_not_xor_5a( + uint64_t a, uint64_t b, uint64_t c) { + return libcrux_sha3_portable_keccak__vbcaxq_u64(a, b, c); +} + +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__veorq_n_u64(uint64_t a, uint64_t c) { + return a ^ c; +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_constant_5a(uint64_t a, uint64_t c) { + return libcrux_sha3_portable_keccak__veorq_n_u64(a, c); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_5a(uint64_t a, uint64_t b) { + return a ^ b; +} + +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_slice_1( + Eurydice_slice a[1U], size_t start, size_t len, Eurydice_slice ret[1U]) { + ret[0U] = Eurydice_slice_subslice2(a[0U], start, start + len, uint8_t); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_slice_n_5a( + Eurydice_slice a[1U], size_t start, size_t len, Eurydice_slice ret[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_a[1U]; + memcpy(copy_of_a, a, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret0[1U]; + libcrux_sha3_portable_keccak_slice_1(copy_of_a, start, len, ret0); + memcpy(ret, ret0, (size_t)1U * sizeof(Eurydice_slice)); +} + +static KRML_MUSTINLINE Eurydice_slice_uint8_t_1size_t__x2 +libcrux_sha3_portable_keccak_split_at_mut_1(Eurydice_slice out[1U], + size_t mid) { + Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at_mut( + out[0U], mid, uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice out00 = uu____0.fst; + Eurydice_slice out01 = uu____0.snd; + Eurydice_slice_uint8_t_1size_t__x2 lit; + lit.fst[0U] = out00; + lit.snd[0U] = out01; + return lit; +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +static KRML_MUSTINLINE Eurydice_slice_uint8_t_1size_t__x2 +libcrux_sha3_portable_keccak_split_at_mut_n_5a(Eurydice_slice a[1U], + size_t mid) { + return libcrux_sha3_portable_keccak_split_at_mut_1(a, mid); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.KeccakState +with types uint64_t +with const generics +- $1size_t +*/ +typedef struct libcrux_sha3_generic_keccak_KeccakState_48_s { + uint64_t st[5U][5U]; +} libcrux_sha3_generic_keccak_KeccakState_48; + +/** + Create a new Shake128 x4 state. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakState[TraitClause@0]#1} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.new_1e +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_48 +libcrux_sha3_generic_keccak_new_1e_f4(void) { + libcrux_sha3_generic_keccak_KeccakState_48 lit; + lit.st[0U][0U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[0U][1U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[0U][2U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[0U][3U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[0U][4U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[1U][0U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[1U][1U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[1U][2U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[1U][3U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[1U][4U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[2U][0U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[2U][1U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[2U][2U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[2U][3U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[2U][4U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[3U][0U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[3U][1U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[3U][2U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[3U][3U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[3U][4U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[4U][0U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[4U][1U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[4U][2U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[4U][3U] = libcrux_sha3_portable_keccak_zero_5a(); + lit.st[4U][4U] = libcrux_sha3_portable_keccak_zero_5a(); + return lit; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_2c( + uint64_t (*s)[5U], Eurydice_slice blocks[1U]) { + for (size_t i = (size_t)0U; i < (size_t)72U / (size_t)8U; i++) { + size_t i0 = i; + uint8_t uu____0[8U]; + Result_56 dst; + Eurydice_slice_to_array2( + &dst, + Eurydice_slice_subslice2(blocks[0U], (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_slice, uint8_t[8U]); + unwrap_41_ac(dst, uu____0); + size_t uu____1 = i0 / (size_t)5U; + size_t uu____2 = i0 % (size_t)5U; + s[uu____1][uu____2] = + s[uu____1][uu____2] ^ core_num__u64_9__from_le_bytes(uu____0); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_5a +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_5a_b8( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_b[1U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_2c(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 36 +- RIGHT= 28 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb0(uint64_t x) { + return x << (uint32_t)(int32_t)36 | x >> (uint32_t)(int32_t)28; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 36 +- RIGHT= 28 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_42(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb0(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 36 +- RIGHT= 28 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_42(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 3 +- RIGHT= 61 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb1(uint64_t x) { + return x << (uint32_t)(int32_t)3 | x >> (uint32_t)(int32_t)61; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 3 +- RIGHT= 61 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_420(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb1(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 3 +- RIGHT= 61 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb0(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_420(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 41 +- RIGHT= 23 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb2(uint64_t x) { + return x << (uint32_t)(int32_t)41 | x >> (uint32_t)(int32_t)23; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 41 +- RIGHT= 23 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_421(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb2(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 41 +- RIGHT= 23 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb1(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_421(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 18 +- RIGHT= 46 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb3(uint64_t x) { + return x << (uint32_t)(int32_t)18 | x >> (uint32_t)(int32_t)46; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 18 +- RIGHT= 46 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_422(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb3(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 18 +- RIGHT= 46 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb2(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_422(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 1 +- RIGHT= 63 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_423(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 1 +- RIGHT= 63 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb3(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_423(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 44 +- RIGHT= 20 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb4(uint64_t x) { + return x << (uint32_t)(int32_t)44 | x >> (uint32_t)(int32_t)20; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 44 +- RIGHT= 20 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_424(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb4(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 44 +- RIGHT= 20 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb4(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_424(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 10 +- RIGHT= 54 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb5(uint64_t x) { + return x << (uint32_t)(int32_t)10 | x >> (uint32_t)(int32_t)54; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 10 +- RIGHT= 54 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_425(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb5(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 10 +- RIGHT= 54 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb5(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_425(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 45 +- RIGHT= 19 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb6(uint64_t x) { + return x << (uint32_t)(int32_t)45 | x >> (uint32_t)(int32_t)19; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 45 +- RIGHT= 19 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_426(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb6(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 45 +- RIGHT= 19 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb6(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_426(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 2 +- RIGHT= 62 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb7(uint64_t x) { + return x << (uint32_t)(int32_t)2 | x >> (uint32_t)(int32_t)62; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 2 +- RIGHT= 62 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_427(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb7(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 2 +- RIGHT= 62 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb7(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_427(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 62 +- RIGHT= 2 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb8(uint64_t x) { + return x << (uint32_t)(int32_t)62 | x >> (uint32_t)(int32_t)2; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 62 +- RIGHT= 2 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_428(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb8(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 62 +- RIGHT= 2 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb8(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_428(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 6 +- RIGHT= 58 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb9(uint64_t x) { + return x << (uint32_t)(int32_t)6 | x >> (uint32_t)(int32_t)58; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 6 +- RIGHT= 58 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_429(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb9(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 6 +- RIGHT= 58 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb9(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_429(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 43 +- RIGHT= 21 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb10(uint64_t x) { + return x << (uint32_t)(int32_t)43 | x >> (uint32_t)(int32_t)21; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 43 +- RIGHT= 21 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4210(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb10(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 43 +- RIGHT= 21 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb10(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4210(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 15 +- RIGHT= 49 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb11(uint64_t x) { + return x << (uint32_t)(int32_t)15 | x >> (uint32_t)(int32_t)49; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 15 +- RIGHT= 49 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4211(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb11(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 15 +- RIGHT= 49 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb11(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4211(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 61 +- RIGHT= 3 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb12(uint64_t x) { + return x << (uint32_t)(int32_t)61 | x >> (uint32_t)(int32_t)3; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 61 +- RIGHT= 3 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4212(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb12(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 61 +- RIGHT= 3 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb12(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4212(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 28 +- RIGHT= 36 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb13(uint64_t x) { + return x << (uint32_t)(int32_t)28 | x >> (uint32_t)(int32_t)36; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 28 +- RIGHT= 36 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4213(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb13(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 28 +- RIGHT= 36 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb13(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4213(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 55 +- RIGHT= 9 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb14(uint64_t x) { + return x << (uint32_t)(int32_t)55 | x >> (uint32_t)(int32_t)9; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 55 +- RIGHT= 9 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4214(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb14(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 55 +- RIGHT= 9 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb14(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4214(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 25 +- RIGHT= 39 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb15(uint64_t x) { + return x << (uint32_t)(int32_t)25 | x >> (uint32_t)(int32_t)39; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 25 +- RIGHT= 39 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4215(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb15(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 25 +- RIGHT= 39 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb15(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4215(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 21 +- RIGHT= 43 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb16(uint64_t x) { + return x << (uint32_t)(int32_t)21 | x >> (uint32_t)(int32_t)43; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 21 +- RIGHT= 43 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4216(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb16(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 21 +- RIGHT= 43 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb16(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4216(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 56 +- RIGHT= 8 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb17(uint64_t x) { + return x << (uint32_t)(int32_t)56 | x >> (uint32_t)(int32_t)8; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 56 +- RIGHT= 8 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4217(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb17(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 56 +- RIGHT= 8 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb17(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4217(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 27 +- RIGHT= 37 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb18(uint64_t x) { + return x << (uint32_t)(int32_t)27 | x >> (uint32_t)(int32_t)37; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 27 +- RIGHT= 37 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4218(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb18(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 27 +- RIGHT= 37 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb18(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4218(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 20 +- RIGHT= 44 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb19(uint64_t x) { + return x << (uint32_t)(int32_t)20 | x >> (uint32_t)(int32_t)44; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 20 +- RIGHT= 44 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4219(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb19(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 20 +- RIGHT= 44 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb19(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4219(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 39 +- RIGHT= 25 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb20(uint64_t x) { + return x << (uint32_t)(int32_t)39 | x >> (uint32_t)(int32_t)25; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 39 +- RIGHT= 25 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4220(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb20(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 39 +- RIGHT= 25 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb20(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4220(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 8 +- RIGHT= 56 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb21(uint64_t x) { + return x << (uint32_t)(int32_t)8 | x >> (uint32_t)(int32_t)56; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 8 +- RIGHT= 56 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4221(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb21(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 8 +- RIGHT= 56 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb21(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4221(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.rotate_left +with const generics +- LEFT= 14 +- RIGHT= 50 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_rotate_left_cb22(uint64_t x) { + return x << (uint32_t)(int32_t)14 | x >> (uint32_t)(int32_t)50; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak._vxarq_u64 +with const generics +- LEFT= 14 +- RIGHT= 50 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak__vxarq_u64_4222(uint64_t a, uint64_t b) { + uint64_t ab = a ^ b; + return libcrux_sha3_portable_keccak_rotate_left_cb22(ab); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.xor_and_rotate_5a +with const generics +- LEFT= 14 +- RIGHT= 50 +*/ +static KRML_MUSTINLINE uint64_t +libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb22(uint64_t a, uint64_t b) { + return libcrux_sha3_portable_keccak__vxarq_u64_4222(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.theta_rho +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_theta_rho_16( + libcrux_sha3_generic_keccak_KeccakState_48 *s) { + uint64_t c[5U] = { + libcrux_sha3_portable_keccak_xor5_5a(s->st[0U][0U], s->st[1U][0U], + s->st[2U][0U], s->st[3U][0U], + s->st[4U][0U]), + libcrux_sha3_portable_keccak_xor5_5a(s->st[0U][1U], s->st[1U][1U], + s->st[2U][1U], s->st[3U][1U], + s->st[4U][1U]), + libcrux_sha3_portable_keccak_xor5_5a(s->st[0U][2U], s->st[1U][2U], + s->st[2U][2U], s->st[3U][2U], + s->st[4U][2U]), + libcrux_sha3_portable_keccak_xor5_5a(s->st[0U][3U], s->st[1U][3U], + s->st[2U][3U], s->st[3U][3U], + s->st[4U][3U]), + libcrux_sha3_portable_keccak_xor5_5a(s->st[0U][4U], s->st[1U][4U], + s->st[2U][4U], s->st[3U][4U], + s->st[4U][4U])}; + uint64_t uu____0 = libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a( + c[((size_t)0U + (size_t)4U) % (size_t)5U], + c[((size_t)0U + (size_t)1U) % (size_t)5U]); + uint64_t uu____1 = libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a( + c[((size_t)1U + (size_t)4U) % (size_t)5U], + c[((size_t)1U + (size_t)1U) % (size_t)5U]); + uint64_t uu____2 = libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a( + c[((size_t)2U + (size_t)4U) % (size_t)5U], + c[((size_t)2U + (size_t)1U) % (size_t)5U]); + uint64_t uu____3 = libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a( + c[((size_t)3U + (size_t)4U) % (size_t)5U], + c[((size_t)3U + (size_t)1U) % (size_t)5U]); + uint64_t t[5U] = {uu____0, uu____1, uu____2, uu____3, + libcrux_sha3_portable_keccak_rotate_left1_and_xor_5a( + c[((size_t)4U + (size_t)4U) % (size_t)5U], + c[((size_t)4U + (size_t)1U) % (size_t)5U])}; + s->st[0U][0U] = libcrux_sha3_portable_keccak_xor_5a(s->st[0U][0U], t[0U]); + s->st[1U][0U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb(s->st[1U][0U], t[0U]); + s->st[2U][0U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb0(s->st[2U][0U], t[0U]); + s->st[3U][0U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb1(s->st[3U][0U], t[0U]); + s->st[4U][0U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb2(s->st[4U][0U], t[0U]); + s->st[0U][1U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb3(s->st[0U][1U], t[1U]); + s->st[1U][1U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb4(s->st[1U][1U], t[1U]); + s->st[2U][1U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb5(s->st[2U][1U], t[1U]); + s->st[3U][1U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb6(s->st[3U][1U], t[1U]); + s->st[4U][1U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb7(s->st[4U][1U], t[1U]); + s->st[0U][2U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb8(s->st[0U][2U], t[2U]); + s->st[1U][2U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb9(s->st[1U][2U], t[2U]); + s->st[2U][2U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb10(s->st[2U][2U], t[2U]); + s->st[3U][2U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb11(s->st[3U][2U], t[2U]); + s->st[4U][2U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb12(s->st[4U][2U], t[2U]); + s->st[0U][3U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb13(s->st[0U][3U], t[3U]); + s->st[1U][3U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb14(s->st[1U][3U], t[3U]); + s->st[2U][3U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb15(s->st[2U][3U], t[3U]); + s->st[3U][3U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb16(s->st[3U][3U], t[3U]); + s->st[4U][3U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb17(s->st[4U][3U], t[3U]); + s->st[0U][4U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb18(s->st[0U][4U], t[4U]); + s->st[1U][4U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb19(s->st[1U][4U], t[4U]); + s->st[2U][4U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb20(s->st[2U][4U], t[4U]); + s->st[3U][4U] = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb21(s->st[3U][4U], t[4U]); + uint64_t uu____27 = + libcrux_sha3_portable_keccak_xor_and_rotate_5a_bb22(s->st[4U][4U], t[4U]); + s->st[4U][4U] = uu____27; +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.pi +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_pi_1d( + libcrux_sha3_generic_keccak_KeccakState_48 *s) { + uint64_t old[5U][5U]; + memcpy(old, s->st, (size_t)5U * sizeof(uint64_t[5U])); + s->st[0U][1U] = old[1U][1U]; + s->st[0U][2U] = old[2U][2U]; + s->st[0U][3U] = old[3U][3U]; + s->st[0U][4U] = old[4U][4U]; + s->st[1U][0U] = old[0U][3U]; + s->st[1U][1U] = old[1U][4U]; + s->st[1U][2U] = old[2U][0U]; + s->st[1U][3U] = old[3U][1U]; + s->st[1U][4U] = old[4U][2U]; + s->st[2U][0U] = old[0U][1U]; + s->st[2U][1U] = old[1U][2U]; + s->st[2U][2U] = old[2U][3U]; + s->st[2U][3U] = old[3U][4U]; + s->st[2U][4U] = old[4U][0U]; + s->st[3U][0U] = old[0U][4U]; + s->st[3U][1U] = old[1U][0U]; + s->st[3U][2U] = old[2U][1U]; + s->st[3U][3U] = old[3U][2U]; + s->st[3U][4U] = old[4U][3U]; + s->st[4U][0U] = old[0U][2U]; + s->st[4U][1U] = old[1U][3U]; + s->st[4U][2U] = old[2U][4U]; + s->st[4U][3U] = old[3U][0U]; + s->st[4U][4U] = old[4U][1U]; +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.chi +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_chi_12( + libcrux_sha3_generic_keccak_KeccakState_48 *s) { + uint64_t old[5U][5U]; + memcpy(old, s->st, (size_t)5U * sizeof(uint64_t[5U])); + for (size_t i0 = (size_t)0U; i0 < (size_t)5U; i0++) { + size_t i1 = i0; + for (size_t i = (size_t)0U; i < (size_t)5U; i++) { + size_t j = i; + s->st[i1][j] = libcrux_sha3_portable_keccak_and_not_xor_5a( + s->st[i1][j], old[i1][(j + (size_t)2U) % (size_t)5U], + old[i1][(j + (size_t)1U) % (size_t)5U]); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.iota +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_iota_62( + libcrux_sha3_generic_keccak_KeccakState_48 *s, size_t i) { + s->st[0U][0U] = libcrux_sha3_portable_keccak_xor_constant_5a( + s->st[0U][0U], libcrux_sha3_generic_keccak_ROUNDCONSTANTS[i]); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccakf1600 +with types uint64_t +with const generics +- N= 1 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccakf1600_21( + libcrux_sha3_generic_keccak_KeccakState_48 *s) { + for (size_t i = (size_t)0U; i < (size_t)24U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_theta_rho_16(s); + libcrux_sha3_generic_keccak_pi_1d(s); + libcrux_sha3_generic_keccak_chi_12(s); + libcrux_sha3_generic_keccak_iota_62(s, i0); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_df( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice blocks[1U]) { + uint64_t(*uu____0)[5U] = s->st; + Eurydice_slice uu____1[1U]; + memcpy(uu____1, blocks, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b8(uu____0, uu____1); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_df( + uint64_t (*s)[5U], uint8_t blocks[1U][200U]) { + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, blocks[0U], uint8_t)}; + libcrux_sha3_portable_keccak_load_block_2c(s, buf); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full_5a +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_5a_d2( + uint64_t (*a)[5U], uint8_t b[1U][200U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_b[1U][200U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_df(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c7( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 6U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)72U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d2(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_58( + uint64_t (*s)[5U], Eurydice_slice out[1U]) { + for (size_t i = (size_t)0U; i < (size_t)72U / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], (size_t)8U * i0, (size_t)8U * i0 + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(s[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_2d( + uint64_t (*s)[5U], uint8_t ret[1U][200U]) { + uint8_t out[200U] = {0U}; + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, out, uint8_t)}; + libcrux_sha3_portable_keccak_store_block_58(s, buf); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_out[200U]; + memcpy(copy_of_out, out, (size_t)200U * sizeof(uint8_t)); + memcpy(ret[0U], copy_of_out, (size_t)200U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full_5a +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_5a_29( + uint64_t (*a)[5U], uint8_t ret[1U][200U]) { + libcrux_sha3_portable_keccak_store_block_full_2d(a, ret); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_and_last +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_and_last_c5( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_29(s->st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_5a +with const generics +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_5a_59( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + libcrux_sha3_portable_keccak_store_block_58(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_block +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_first_block_84( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_portable_keccak_store_block_5a_59(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_next_block +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_next_block_fc( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(s); + libcrux_sha3_portable_keccak_store_block_5a_59(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_last +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_last_cf( + libcrux_sha3_generic_keccak_KeccakState_48 s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(&s); + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_29(s.st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 72 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e9( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)72U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)72U, + (size_t)72U, ret); + libcrux_sha3_generic_keccak_absorb_block_df(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)72U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c7(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)72U; + size_t last = outlen - outlen % (size_t)72U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c5(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)72U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_84(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)72U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 72 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e9(copy_of_data, out); +} + +/** + A portable SHA3 512 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_sha512(Eurydice_slice digest, + Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce(buf0, buf); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_2c0( + uint64_t (*s)[5U], Eurydice_slice blocks[1U]) { + for (size_t i = (size_t)0U; i < (size_t)136U / (size_t)8U; i++) { + size_t i0 = i; + uint8_t uu____0[8U]; + Result_56 dst; + Eurydice_slice_to_array2( + &dst, + Eurydice_slice_subslice2(blocks[0U], (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_slice, uint8_t[8U]); + unwrap_41_ac(dst, uu____0); + size_t uu____1 = i0 / (size_t)5U; + size_t uu____2 = i0 % (size_t)5U; + s[uu____1][uu____2] = + s[uu____1][uu____2] ^ core_num__u64_9__from_le_bytes(uu____0); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_5a +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_5a_b80( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_b[1U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_2c0(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_df0( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice blocks[1U]) { + uint64_t(*uu____0)[5U] = s->st; + Eurydice_slice uu____1[1U]; + memcpy(uu____1, blocks, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b80(uu____0, uu____1); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_df0( + uint64_t (*s)[5U], uint8_t blocks[1U][200U]) { + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, blocks[0U], uint8_t)}; + libcrux_sha3_portable_keccak_load_block_2c0(s, buf); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full_5a +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_5a_d20( + uint64_t (*a)[5U], uint8_t b[1U][200U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_b[1U][200U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_df0(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c70( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 6U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)136U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d20(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_580( + uint64_t (*s)[5U], Eurydice_slice out[1U]) { + for (size_t i = (size_t)0U; i < (size_t)136U / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], (size_t)8U * i0, (size_t)8U * i0 + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(s[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_2d0( + uint64_t (*s)[5U], uint8_t ret[1U][200U]) { + uint8_t out[200U] = {0U}; + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, out, uint8_t)}; + libcrux_sha3_portable_keccak_store_block_580(s, buf); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_out[200U]; + memcpy(copy_of_out, out, (size_t)200U * sizeof(uint8_t)); + memcpy(ret[0U], copy_of_out, (size_t)200U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full_5a +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_keccak_store_block_full_5a_290(uint64_t (*a)[5U], + uint8_t ret[1U][200U]) { + libcrux_sha3_portable_keccak_store_block_full_2d0(a, ret); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_and_last +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_and_last_c50( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_290(s->st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_5a +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_5a_590( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + libcrux_sha3_portable_keccak_store_block_580(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_block +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_first_block_840( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_portable_keccak_store_block_5a_590(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_next_block +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_next_block_fc0( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(s); + libcrux_sha3_portable_keccak_store_block_5a_590(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_last +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_last_cf0( + libcrux_sha3_generic_keccak_KeccakState_48 s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(&s); + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_290(s.st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e90( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)136U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)136U, + (size_t)136U, ret); + libcrux_sha3_generic_keccak_absorb_block_df0(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)136U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c70(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)136U; + size_t last = outlen - outlen % (size_t)136U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c50(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)136U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_840(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)136U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc0(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf0(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 136 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce0( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e90(copy_of_data, out); +} + +/** + A portable SHA3 256 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_sha256(Eurydice_slice digest, + Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce0(buf0, buf); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c71( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 31U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)136U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d20(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 136 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e91( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)136U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)136U, + (size_t)136U, ret); + libcrux_sha3_generic_keccak_absorb_block_df0(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)136U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c71(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)136U; + size_t last = outlen - outlen % (size_t)136U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c50(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)136U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_840(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)136U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc0(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf0(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 136 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce1( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e91(copy_of_data, out); +} + +/** + A portable SHAKE256 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_shake256( + Eurydice_slice digest, Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce1(buf0, buf); +} + +typedef libcrux_sha3_generic_keccak_KeccakState_48 + libcrux_sha3_portable_KeccakState; + +/** + Create a new SHAKE-128 state object. +*/ +static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_48 +libcrux_sha3_portable_incremental_shake128_init(void) { + return libcrux_sha3_generic_keccak_new_1e_f4(); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_2c1( + uint64_t (*s)[5U], Eurydice_slice blocks[1U]) { + for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)8U; i++) { + size_t i0 = i; + uint8_t uu____0[8U]; + Result_56 dst; + Eurydice_slice_to_array2( + &dst, + Eurydice_slice_subslice2(blocks[0U], (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_slice, uint8_t[8U]); + unwrap_41_ac(dst, uu____0); + size_t uu____1 = i0 / (size_t)5U; + size_t uu____2 = i0 % (size_t)5U; + s[uu____1][uu____2] = + s[uu____1][uu____2] ^ core_num__u64_9__from_le_bytes(uu____0); + } +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_df1( + uint64_t (*s)[5U], uint8_t blocks[1U][200U]) { + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, blocks[0U], uint8_t)}; + libcrux_sha3_portable_keccak_load_block_2c1(s, buf); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full_5a +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_5a_d21( + uint64_t (*a)[5U], uint8_t b[1U][200U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_b[1U][200U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_df1(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c72( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 31U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)168U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d21(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** + Absorb +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake128_absorb_final( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice data0) { + Eurydice_slice buf[1U] = {data0}; + libcrux_sha3_generic_keccak_absorb_final_c72(s, buf); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_581( + uint64_t (*s)[5U], Eurydice_slice out[1U]) { + for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], (size_t)8U * i0, (size_t)8U * i0 + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(s[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_5a +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_5a_591( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + libcrux_sha3_portable_keccak_store_block_581(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_next_block +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_next_block_fc1( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(s); + libcrux_sha3_portable_keccak_store_block_5a_591(s->st, out); +} + +/** + Squeeze another block +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake128_squeeze_next_block( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out0) { + Eurydice_slice buf[1U] = {out0}; + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, buf); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_block +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_first_block_841( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_portable_keccak_store_block_5a_591(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_three_blocks +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_three_blocks_cc( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + Eurydice_slice_uint8_t_1size_t__x2 uu____0 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)168U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____0.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o10[1U]; + memcpy(o10, uu____0.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_841(s, o0); + Eurydice_slice_uint8_t_1size_t__x2 uu____1 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o10, (size_t)168U); + Eurydice_slice o1[1U]; + memcpy(o1, uu____1.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o2[1U]; + memcpy(o2, uu____1.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o1); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o2); +} + +/** + Squeeze three blocks +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake128_squeeze_first_three_blocks( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out0) { + Eurydice_slice buf[1U] = {out0}; + libcrux_sha3_generic_keccak_squeeze_first_three_blocks_cc(s, buf); +} + +#define libcrux_sha3_Sha224 0 +#define libcrux_sha3_Sha256 1 +#define libcrux_sha3_Sha384 2 +#define libcrux_sha3_Sha512 3 + +typedef uint8_t libcrux_sha3_Algorithm; + +/** + Returns the output size of a digest. +*/ +static inline size_t libcrux_sha3_digest_size(libcrux_sha3_Algorithm mode) { + size_t uu____0; + switch (mode) { + case libcrux_sha3_Sha224: { + uu____0 = (size_t)28U; + break; + } + case libcrux_sha3_Sha256: { + uu____0 = (size_t)32U; + break; + } + case libcrux_sha3_Sha384: { + uu____0 = (size_t)48U; + break; + } + case libcrux_sha3_Sha512: { + uu____0 = (size_t)64U; + break; + } + default: { + KRML_HOST_EPRINTF("KaRaMeL incomplete match at %s:%d\n", __FILE__, + __LINE__); + KRML_HOST_EXIT(253U); + } + } + return uu____0; +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_2c2( + uint64_t (*s)[5U], Eurydice_slice blocks[1U]) { + for (size_t i = (size_t)0U; i < (size_t)144U / (size_t)8U; i++) { + size_t i0 = i; + uint8_t uu____0[8U]; + Result_56 dst; + Eurydice_slice_to_array2( + &dst, + Eurydice_slice_subslice2(blocks[0U], (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_slice, uint8_t[8U]); + unwrap_41_ac(dst, uu____0); + size_t uu____1 = i0 / (size_t)5U; + size_t uu____2 = i0 % (size_t)5U; + s[uu____1][uu____2] = + s[uu____1][uu____2] ^ core_num__u64_9__from_le_bytes(uu____0); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_5a +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_5a_b81( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_b[1U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_2c2(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_df1( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice blocks[1U]) { + uint64_t(*uu____0)[5U] = s->st; + Eurydice_slice uu____1[1U]; + memcpy(uu____1, blocks, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b81(uu____0, uu____1); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_df2( + uint64_t (*s)[5U], uint8_t blocks[1U][200U]) { + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, blocks[0U], uint8_t)}; + libcrux_sha3_portable_keccak_load_block_2c2(s, buf); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full_5a +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_5a_d22( + uint64_t (*a)[5U], uint8_t b[1U][200U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_b[1U][200U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_df2(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c73( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 6U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)144U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d22(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_582( + uint64_t (*s)[5U], Eurydice_slice out[1U]) { + for (size_t i = (size_t)0U; i < (size_t)144U / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], (size_t)8U * i0, (size_t)8U * i0 + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(s[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_2d1( + uint64_t (*s)[5U], uint8_t ret[1U][200U]) { + uint8_t out[200U] = {0U}; + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, out, uint8_t)}; + libcrux_sha3_portable_keccak_store_block_582(s, buf); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_out[200U]; + memcpy(copy_of_out, out, (size_t)200U * sizeof(uint8_t)); + memcpy(ret[0U], copy_of_out, (size_t)200U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full_5a +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_keccak_store_block_full_5a_291(uint64_t (*a)[5U], + uint8_t ret[1U][200U]) { + libcrux_sha3_portable_keccak_store_block_full_2d1(a, ret); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_and_last +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_and_last_c51( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_291(s->st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_5a +with const generics +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_5a_592( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + libcrux_sha3_portable_keccak_store_block_582(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_block +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_first_block_842( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_portable_keccak_store_block_5a_592(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_next_block +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_next_block_fc2( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(s); + libcrux_sha3_portable_keccak_store_block_5a_592(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_last +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_last_cf1( + libcrux_sha3_generic_keccak_KeccakState_48 s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(&s); + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_291(s.st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 144 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e92( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)144U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)144U, + (size_t)144U, ret); + libcrux_sha3_generic_keccak_absorb_block_df1(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)144U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c73(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)144U; + size_t last = outlen - outlen % (size_t)144U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c51(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)144U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_842(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)144U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc2(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf1(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 144 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce2( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e92(copy_of_data, out); +} + +/** + A portable SHA3 224 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_sha224(Eurydice_slice digest, + Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce2(buf0, buf); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_2c3( + uint64_t (*s)[5U], Eurydice_slice blocks[1U]) { + for (size_t i = (size_t)0U; i < (size_t)104U / (size_t)8U; i++) { + size_t i0 = i; + uint8_t uu____0[8U]; + Result_56 dst; + Eurydice_slice_to_array2( + &dst, + Eurydice_slice_subslice2(blocks[0U], (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_slice, uint8_t[8U]); + unwrap_41_ac(dst, uu____0); + size_t uu____1 = i0 / (size_t)5U; + size_t uu____2 = i0 % (size_t)5U; + s[uu____1][uu____2] = + s[uu____1][uu____2] ^ core_num__u64_9__from_le_bytes(uu____0); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_5a +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_5a_b82( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_b[1U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_2c3(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_df2( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice blocks[1U]) { + uint64_t(*uu____0)[5U] = s->st; + Eurydice_slice uu____1[1U]; + memcpy(uu____1, blocks, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b82(uu____0, uu____1); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_df3( + uint64_t (*s)[5U], uint8_t blocks[1U][200U]) { + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, blocks[0U], uint8_t)}; + libcrux_sha3_portable_keccak_load_block_2c3(s, buf); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_full_5a +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_full_5a_d23( + uint64_t (*a)[5U], uint8_t b[1U][200U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_b[1U][200U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_df3(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_c74( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice last[1U]) { + size_t last_len = Eurydice_slice_len(last[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (last_len > (size_t)0U) { + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, last_len, uint8_t); + Eurydice_slice_copy(uu____0, last[i0], uint8_t); + } + blocks[i0][last_len] = 6U; + size_t uu____1 = i0; + size_t uu____2 = (size_t)104U - (size_t)1U; + blocks[uu____1][uu____2] = (uint32_t)blocks[uu____1][uu____2] | 128U; + } + uint64_t(*uu____3)[5U] = s->st; + uint8_t uu____4[1U][200U]; + memcpy(uu____4, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d23(uu____3, uu____4); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_583( + uint64_t (*s)[5U], Eurydice_slice out[1U]) { + for (size_t i = (size_t)0U; i < (size_t)104U / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], (size_t)8U * i0, (size_t)8U * i0 + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(s[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_2d2( + uint64_t (*s)[5U], uint8_t ret[1U][200U]) { + uint8_t out[200U] = {0U}; + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, out, uint8_t)}; + libcrux_sha3_portable_keccak_store_block_583(s, buf); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_out[200U]; + memcpy(copy_of_out, out, (size_t)200U * sizeof(uint8_t)); + memcpy(ret[0U], copy_of_out, (size_t)200U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full_5a +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_keccak_store_block_full_5a_292(uint64_t (*a)[5U], + uint8_t ret[1U][200U]) { + libcrux_sha3_portable_keccak_store_block_full_2d2(a, ret); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_and_last +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_and_last_c52( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_292(s->st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_5a +with const generics +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_5a_593( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + libcrux_sha3_portable_keccak_store_block_583(a, b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_block +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_first_block_843( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_portable_keccak_store_block_5a_593(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_next_block +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_next_block_fc3( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(s); + libcrux_sha3_portable_keccak_store_block_5a_593(s->st, out); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_last +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_last_cf2( + libcrux_sha3_generic_keccak_KeccakState_48 s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(&s); + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_292(s.st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 104 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e93( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)104U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)104U, + (size_t)104U, ret); + libcrux_sha3_generic_keccak_absorb_block_df2(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)104U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c74(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)104U; + size_t last = outlen - outlen % (size_t)104U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c52(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)104U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_843(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)104U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc3(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf2(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 104 +- DELIM= 6 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce3( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e93(copy_of_data, out); +} + +/** + A portable SHA3 384 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_sha384(Eurydice_slice digest, + Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce3(buf0, buf); +} + +/** + SHA3 224 + + Preconditions: + - `digest.len() == 28` +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha224_ema(Eurydice_slice digest, + Eurydice_slice payload) { + libcrux_sha3_portable_sha224(digest, payload); +} + +/** + SHA3 224 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha224(Eurydice_slice data, + uint8_t ret[28U]) { + uint8_t out[28U] = {0U}; + libcrux_sha3_sha224_ema(Eurydice_array_to_slice((size_t)28U, out, uint8_t), + data); + memcpy(ret, out, (size_t)28U * sizeof(uint8_t)); +} + +/** + SHA3 256 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha256_ema(Eurydice_slice digest, + Eurydice_slice payload) { + libcrux_sha3_portable_sha256(digest, payload); +} + +/** + SHA3 256 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha256(Eurydice_slice data, + uint8_t ret[32U]) { + uint8_t out[32U] = {0U}; + libcrux_sha3_sha256_ema(Eurydice_array_to_slice((size_t)32U, out, uint8_t), + data); + memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); +} + +/** + SHA3 384 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha384_ema(Eurydice_slice digest, + Eurydice_slice payload) { + libcrux_sha3_portable_sha384(digest, payload); +} + +/** + SHA3 384 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha384(Eurydice_slice data, + uint8_t ret[48U]) { + uint8_t out[48U] = {0U}; + libcrux_sha3_sha384_ema(Eurydice_array_to_slice((size_t)48U, out, uint8_t), + data); + memcpy(ret, out, (size_t)48U * sizeof(uint8_t)); +} + +/** + SHA3 512 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha512_ema(Eurydice_slice digest, + Eurydice_slice payload) { + libcrux_sha3_portable_sha512(digest, payload); +} + +/** + SHA3 512 +*/ +static KRML_MUSTINLINE void libcrux_sha3_sha512(Eurydice_slice data, + uint8_t ret[64U]) { + uint8_t out[64U] = {0U}; + libcrux_sha3_sha512_ema(Eurydice_array_to_slice((size_t)64U, out, uint8_t), + data); + memcpy(ret, out, (size_t)64U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.load_block_5a +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_load_block_5a_b83( + uint64_t (*a)[5U], Eurydice_slice b[1U]) { + uint64_t(*uu____0)[5U] = a; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_b[1U]; + memcpy(copy_of_b, b, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_2c1(uu____0, copy_of_b); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_block +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_block_df3( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice blocks[1U]) { + uint64_t(*uu____0)[5U] = s->st; + Eurydice_slice uu____1[1U]; + memcpy(uu____1, blocks, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b83(uu____0, uu____1); + libcrux_sha3_generic_keccak_keccakf1600_21(s); +} + +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_block_full_2d3( + uint64_t (*s)[5U], uint8_t ret[1U][200U]) { + uint8_t out[200U] = {0U}; + Eurydice_slice buf[1U] = { + Eurydice_array_to_slice((size_t)200U, out, uint8_t)}; + libcrux_sha3_portable_keccak_store_block_581(s, buf); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_out[200U]; + memcpy(copy_of_out, out, (size_t)200U * sizeof(uint8_t)); + memcpy(ret[0U], copy_of_out, (size_t)200U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_block_full_5a +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_keccak_store_block_full_5a_293(uint64_t (*a)[5U], + uint8_t ret[1U][200U]) { + libcrux_sha3_portable_keccak_store_block_full_2d3(a, ret); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_and_last +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_and_last_c53( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_293(s->st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_last +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_last_cf3( + libcrux_sha3_generic_keccak_KeccakState_48 s, Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_keccakf1600_21(&s); + uint8_t b[1U][200U]; + libcrux_sha3_portable_keccak_store_block_full_5a_293(s.st, b); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = out[i0]; + uint8_t *uu____1 = b[i0]; + core_ops_range_Range_b3 lit; + lit.start = (size_t)0U; + lit.end = Eurydice_slice_len(out[i0], uint8_t); + Eurydice_slice_copy( + uu____0, + Eurydice_array_to_subslice((size_t)200U, uu____1, lit, uint8_t, + core_ops_range_Range_b3), + uint8_t); + } +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.keccak +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_keccak_e94( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + libcrux_sha3_generic_keccak_KeccakState_48 s = + libcrux_sha3_generic_keccak_new_1e_f4(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(data[0U], uint8_t) / (size_t)168U; i++) { + size_t i0 = i; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____0 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a(copy_of_data, i0 * (size_t)168U, + (size_t)168U, ret); + libcrux_sha3_generic_keccak_absorb_block_df3(uu____0, ret); + } + size_t rem = Eurydice_slice_len(data[0U], uint8_t) % (size_t)168U; + libcrux_sha3_generic_keccak_KeccakState_48 *uu____2 = &s; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_data, Eurydice_slice_len(data[0U], uint8_t) - rem, rem, ret); + libcrux_sha3_generic_keccak_absorb_final_c72(uu____2, ret); + size_t outlen = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = outlen / (size_t)168U; + size_t last = outlen - outlen % (size_t)168U; + if (blocks == (size_t)0U) { + libcrux_sha3_generic_keccak_squeeze_first_and_last_c53(&s, out); + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____4 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)168U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____4.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o1[1U]; + memcpy(o1, uu____4.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_841(&s, o0); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____5 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o1, (size_t)168U); + Eurydice_slice o[1U]; + memcpy(o, uu____5.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice orest[1U]; + memcpy(orest, uu____5.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(&s, o); + memcpy(o1, orest, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < outlen) { + libcrux_sha3_generic_keccak_squeeze_last_cf3(s, o1); + } + } +} + +/** +A monomorphic instance of libcrux_sha3.portable.keccakx1 +with const generics +- RATE= 168 +- DELIM= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccakx1_ce4( + Eurydice_slice data[1U], Eurydice_slice out[1U]) { + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_data[1U]; + memcpy(copy_of_data, data, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccak_e94(copy_of_data, out); +} + +/** + A portable SHAKE128 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_shake128( + Eurydice_slice digest, Eurydice_slice data) { + Eurydice_slice buf0[1U] = {data}; + Eurydice_slice buf[1U] = {digest}; + libcrux_sha3_portable_keccakx1_ce4(buf0, buf); +} + +/** + SHAKE 128 + + Writes `out.len()` bytes. +*/ +static KRML_MUSTINLINE void libcrux_sha3_shake128_ema(Eurydice_slice out, + Eurydice_slice data) { + libcrux_sha3_portable_shake128(out, data); +} + +/** + SHAKE 256 + + Writes `out.len()` bytes. +*/ +static KRML_MUSTINLINE void libcrux_sha3_shake256_ema(Eurydice_slice out, + Eurydice_slice data) { + libcrux_sha3_portable_shake256(out, data); +} + +static const size_t libcrux_sha3_generic_keccak__PI[24U] = { + (size_t)6U, (size_t)12U, (size_t)18U, (size_t)24U, (size_t)3U, + (size_t)9U, (size_t)10U, (size_t)16U, (size_t)22U, (size_t)1U, + (size_t)7U, (size_t)13U, (size_t)19U, (size_t)20U, (size_t)4U, + (size_t)5U, (size_t)11U, (size_t)17U, (size_t)23U, (size_t)2U, + (size_t)8U, (size_t)14U, (size_t)15U, (size_t)21U}; + +static const size_t libcrux_sha3_generic_keccak__ROTC[24U] = { + (size_t)1U, (size_t)62U, (size_t)28U, (size_t)27U, (size_t)36U, + (size_t)44U, (size_t)6U, (size_t)55U, (size_t)20U, (size_t)3U, + (size_t)10U, (size_t)43U, (size_t)25U, (size_t)39U, (size_t)41U, + (size_t)45U, (size_t)15U, (size_t)21U, (size_t)8U, (size_t)18U, + (size_t)2U, (size_t)61U, (size_t)56U, (size_t)14U}; + +/** + A portable SHA3 224 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_neon_sha224(Eurydice_slice digest, + Eurydice_slice data) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + A portable SHA3 256 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_neon_sha256(Eurydice_slice digest, + Eurydice_slice data) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + A portable SHA3 384 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_neon_sha384(Eurydice_slice digest, + Eurydice_slice data) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + A portable SHA3 512 implementation. +*/ +static KRML_MUSTINLINE void libcrux_sha3_neon_sha512(Eurydice_slice digest, + Eurydice_slice data) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + Run SHAKE256 on both inputs in parallel. + + Writes the two results into `out0` and `out1` +*/ +static KRML_MUSTINLINE void libcrux_sha3_neon_x2_shake256(Eurydice_slice input0, + Eurydice_slice input1, + Eurydice_slice out0, + Eurydice_slice out1) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +typedef struct libcrux_sha3_neon_x2_incremental_KeccakState_s { + libcrux_sha3_generic_keccak_KeccakState_48 state[2U]; +} libcrux_sha3_neon_x2_incremental_KeccakState; + +/** + Initialise the `KeccakState2`. +*/ +static KRML_MUSTINLINE libcrux_sha3_neon_x2_incremental_KeccakState +libcrux_sha3_neon_x2_incremental_shake128_init(void) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + Shake128 absorb `data0` and `data1` in the [`KeccakState`] `s`. +*/ +static KRML_MUSTINLINE void +libcrux_sha3_neon_x2_incremental_shake128_absorb_final( + libcrux_sha3_neon_x2_incremental_KeccakState *s, Eurydice_slice data0, + Eurydice_slice data1) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + Squeeze 2 times the first three blocks in parallel in the + [`KeccakState`] and return the output in `out0` and `out1`. +*/ +static KRML_MUSTINLINE void +libcrux_sha3_neon_x2_incremental_shake128_squeeze_first_three_blocks( + libcrux_sha3_neon_x2_incremental_KeccakState *s, Eurydice_slice out0, + Eurydice_slice out1) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** + Squeeze 2 times the next block in parallel in the + [`KeccakState`] and return the output in `out0` and `out1`. +*/ +static KRML_MUSTINLINE void +libcrux_sha3_neon_x2_incremental_shake128_squeeze_next_block( + libcrux_sha3_neon_x2_incremental_KeccakState *s, Eurydice_slice out0, + Eurydice_slice out1) { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_first_five_blocks +with types uint64_t +with const generics +- N= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void +libcrux_sha3_generic_keccak_squeeze_first_five_blocks_4f( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out[1U]) { + Eurydice_slice_uint8_t_1size_t__x2 uu____0 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, (size_t)168U); + Eurydice_slice o0[1U]; + memcpy(o0, uu____0.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o10[1U]; + memcpy(o10, uu____0.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_first_block_841(s, o0); + Eurydice_slice_uint8_t_1size_t__x2 uu____1 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o10, (size_t)168U); + Eurydice_slice o1[1U]; + memcpy(o1, uu____1.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o20[1U]; + memcpy(o20, uu____1.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o1); + Eurydice_slice_uint8_t_1size_t__x2 uu____2 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o20, (size_t)168U); + Eurydice_slice o2[1U]; + memcpy(o2, uu____2.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o30[1U]; + memcpy(o30, uu____2.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o2); + Eurydice_slice_uint8_t_1size_t__x2 uu____3 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(o30, (size_t)168U); + Eurydice_slice o3[1U]; + memcpy(o3, uu____3.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice o4[1U]; + memcpy(o4, uu____3.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o3); + libcrux_sha3_generic_keccak_squeeze_next_block_fc1(s, o4); +} + +/** + Squeeze five blocks +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake128_squeeze_first_five_blocks( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out0) { + Eurydice_slice buf[1U] = {out0}; + libcrux_sha3_generic_keccak_squeeze_first_five_blocks_4f(s, buf); +} + +/** + Absorb some data for SHAKE-256 for the last time +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake256_absorb_final( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice data) { + Eurydice_slice buf[1U] = {data}; + libcrux_sha3_generic_keccak_absorb_final_c71(s, buf); +} + +/** + Create a new SHAKE-256 state object. +*/ +static KRML_MUSTINLINE libcrux_sha3_generic_keccak_KeccakState_48 +libcrux_sha3_portable_incremental_shake256_init(void) { + return libcrux_sha3_generic_keccak_new_1e_f4(); +} + +/** + Squeeze the first SHAKE-256 block +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake256_squeeze_first_block( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out) { + Eurydice_slice buf[1U] = {out}; + libcrux_sha3_generic_keccak_squeeze_first_block_840(s, buf); +} + +/** + Squeeze the next SHAKE-256 block +*/ +static KRML_MUSTINLINE void +libcrux_sha3_portable_incremental_shake256_squeeze_next_block( + libcrux_sha3_generic_keccak_KeccakState_48 *s, Eurydice_slice out) { + Eurydice_slice buf[1U] = {out}; + libcrux_sha3_generic_keccak_squeeze_next_block_fc0(s, buf); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.KeccakXofState +with types uint64_t +with const generics +- $1size_t +- $136size_t +*/ +typedef struct libcrux_sha3_generic_keccak_KeccakXofState_4f_s { + libcrux_sha3_generic_keccak_KeccakState_48 inner; + uint8_t buf[1U][136U]; + size_t buf_len; + bool sponge; +} libcrux_sha3_generic_keccak_KeccakXofState_4f; + +typedef libcrux_sha3_generic_keccak_KeccakXofState_4f + libcrux_sha3_portable_incremental_Shake256Absorb; + +/** + Consume the internal buffer and the required amount of the input to pad to + `RATE`. + + Returns the `consumed` bytes from `inputs` if there's enough buffered + content to consume, and `0` otherwise. + If `consumed > 0` is returned, `self.buf` contains a full block to be + loaded. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.fill_buffer_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static inline size_t libcrux_sha3_generic_keccak_fill_buffer_9d_b0( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, + Eurydice_slice inputs[1U]) { + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + size_t consumed = (size_t)0U; + if (self->buf_len > (size_t)0U) { + if (self->buf_len + input_len >= (size_t)136U) { + consumed = (size_t)136U - self->buf_len; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( + (size_t)136U, self->buf[i0], self->buf_len, uint8_t, size_t); + Eurydice_slice_copy( + uu____0, + Eurydice_slice_subslice_to(inputs[i0], consumed, uint8_t, size_t), + uint8_t); + } + self->buf_len = self->buf_len + consumed; + } + } + return consumed; +} + +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_full_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static inline size_t libcrux_sha3_generic_keccak_absorb_full_9d_f8( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_4f *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs0[1U]; + memcpy(copy_of_inputs0, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_consumed = + libcrux_sha3_generic_keccak_fill_buffer_9d_b0(uu____0, copy_of_inputs0); + if (input_consumed > (size_t)0U) { + Eurydice_slice borrowed[1U]; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + uint8_t buf[136U] = {0U}; + borrowed[i] = core_array___Array_T__N__23__as_slice( + (size_t)136U, buf, uint8_t, Eurydice_slice); + } + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + borrowed[i0] = + Eurydice_array_to_slice((size_t)136U, self->buf[i0], uint8_t); + } + uint64_t(*uu____2)[5U] = self->inner.st; + Eurydice_slice uu____3[1U]; + memcpy(uu____3, borrowed, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b80(uu____2, uu____3); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + self->buf_len = (size_t)0U; + } + size_t input_to_consume = + Eurydice_slice_len(inputs[0U], uint8_t) - input_consumed; + size_t num_blocks = input_to_consume / (size_t)136U; + size_t remainder = input_to_consume % (size_t)136U; + for (size_t i = (size_t)0U; i < num_blocks; i++) { + size_t i0 = i; + uint64_t(*uu____4)[5U] = self->inner.st; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_inputs, input_consumed + i0 * (size_t)136U, (size_t)136U, ret); + libcrux_sha3_portable_keccak_load_block_5a_b80(uu____4, ret); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + } + return remainder; +} + +/** + Absorb + + This function takes any number of bytes to absorb and buffers if it's not + enough. The function assumes that all input slices in `blocks` have the same + length. + + Only a multiple of `RATE` blocks are absorbed. + For the remaining bytes [`absorb_final`] needs to be called. + + This works best with relatively small `inputs`. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_9d_7b( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_4f *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_remainder_len = + libcrux_sha3_generic_keccak_absorb_full_9d_f8(uu____0, copy_of_inputs); + if (input_remainder_len > (size_t)0U) { + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____2 = Eurydice_array_to_subslice2( + self->buf[i0], self->buf_len, self->buf_len + input_remainder_len, + uint8_t); + Eurydice_slice_copy( + uu____2, + Eurydice_slice_subslice_from( + inputs[i0], input_len - input_remainder_len, uint8_t, size_t), + uint8_t); + } + self->buf_len = self->buf_len + input_remainder_len; + } +} + +/** + Shake256 absorb +*/ +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<136: usize> for +libcrux_sha3::portable::incremental::Shake256Absorb)#2} +*/ +static inline void libcrux_sha3_portable_incremental_absorb_7d( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, Eurydice_slice input) { + Eurydice_slice buf[1U] = {input}; + libcrux_sha3_generic_keccak_absorb_9d_7b(self, buf); +} + +typedef libcrux_sha3_generic_keccak_KeccakXofState_4f + libcrux_sha3_portable_incremental_Shake256Squeeze; + +/** + Absorb a final block. + + The `inputs` block may be empty. Everything in the `inputs` block beyond + `RATE` bytes is ignored. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +- DELIMITER= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_9d_25( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_4f *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_remainder_len = + libcrux_sha3_generic_keccak_absorb_full_9d_f8(uu____0, copy_of_inputs); + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (self->buf_len > (size_t)0U) { + Eurydice_slice uu____2 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, self->buf_len, uint8_t); + Eurydice_slice_copy(uu____2, + Eurydice_array_to_subslice2(self->buf[i0], (size_t)0U, + self->buf_len, uint8_t), + uint8_t); + } + if (input_remainder_len > (size_t)0U) { + Eurydice_slice uu____3 = Eurydice_array_to_subslice2( + blocks[i0], self->buf_len, self->buf_len + input_remainder_len, + uint8_t); + Eurydice_slice_copy( + uu____3, + Eurydice_slice_subslice_from( + inputs[i0], input_len - input_remainder_len, uint8_t, size_t), + uint8_t); + } + blocks[i0][self->buf_len + input_remainder_len] = 31U; + size_t uu____4 = i0; + size_t uu____5 = (size_t)136U - (size_t)1U; + blocks[uu____4][uu____5] = (uint32_t)blocks[uu____4][uu____5] | 128U; + } + uint64_t(*uu____6)[5U] = self->inner.st; + uint8_t uu____7[1U][200U]; + memcpy(uu____7, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d20(uu____6, uu____7); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); +} + +/** + Shake256 absorb final +*/ +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<136: usize> for +libcrux_sha3::portable::incremental::Shake256Absorb)#2} +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_4f +libcrux_sha3_portable_incremental_absorb_final_7d( + libcrux_sha3_generic_keccak_KeccakXofState_4f self, Eurydice_slice input) { + Eurydice_slice buf[1U] = {input}; + libcrux_sha3_generic_keccak_absorb_final_9d_25(&self, buf); + return self; +} + +/** + An all zero block +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.zero_block_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static inline void libcrux_sha3_generic_keccak_zero_block_9d_e6( + uint8_t ret[136U]) { + ret[0U] = 0U; + ret[1U] = 0U; + ret[2U] = 0U; + ret[3U] = 0U; + ret[4U] = 0U; + ret[5U] = 0U; + ret[6U] = 0U; + ret[7U] = 0U; + ret[8U] = 0U; + ret[9U] = 0U; + ret[10U] = 0U; + ret[11U] = 0U; + ret[12U] = 0U; + ret[13U] = 0U; + ret[14U] = 0U; + ret[15U] = 0U; + ret[16U] = 0U; + ret[17U] = 0U; + ret[18U] = 0U; + ret[19U] = 0U; + ret[20U] = 0U; + ret[21U] = 0U; + ret[22U] = 0U; + ret[23U] = 0U; + ret[24U] = 0U; + ret[25U] = 0U; + ret[26U] = 0U; + ret[27U] = 0U; + ret[28U] = 0U; + ret[29U] = 0U; + ret[30U] = 0U; + ret[31U] = 0U; + ret[32U] = 0U; + ret[33U] = 0U; + ret[34U] = 0U; + ret[35U] = 0U; + ret[36U] = 0U; + ret[37U] = 0U; + ret[38U] = 0U; + ret[39U] = 0U; + ret[40U] = 0U; + ret[41U] = 0U; + ret[42U] = 0U; + ret[43U] = 0U; + ret[44U] = 0U; + ret[45U] = 0U; + ret[46U] = 0U; + ret[47U] = 0U; + ret[48U] = 0U; + ret[49U] = 0U; + ret[50U] = 0U; + ret[51U] = 0U; + ret[52U] = 0U; + ret[53U] = 0U; + ret[54U] = 0U; + ret[55U] = 0U; + ret[56U] = 0U; + ret[57U] = 0U; + ret[58U] = 0U; + ret[59U] = 0U; + ret[60U] = 0U; + ret[61U] = 0U; + ret[62U] = 0U; + ret[63U] = 0U; + ret[64U] = 0U; + ret[65U] = 0U; + ret[66U] = 0U; + ret[67U] = 0U; + ret[68U] = 0U; + ret[69U] = 0U; + ret[70U] = 0U; + ret[71U] = 0U; + ret[72U] = 0U; + ret[73U] = 0U; + ret[74U] = 0U; + ret[75U] = 0U; + ret[76U] = 0U; + ret[77U] = 0U; + ret[78U] = 0U; + ret[79U] = 0U; + ret[80U] = 0U; + ret[81U] = 0U; + ret[82U] = 0U; + ret[83U] = 0U; + ret[84U] = 0U; + ret[85U] = 0U; + ret[86U] = 0U; + ret[87U] = 0U; + ret[88U] = 0U; + ret[89U] = 0U; + ret[90U] = 0U; + ret[91U] = 0U; + ret[92U] = 0U; + ret[93U] = 0U; + ret[94U] = 0U; + ret[95U] = 0U; + ret[96U] = 0U; + ret[97U] = 0U; + ret[98U] = 0U; + ret[99U] = 0U; + ret[100U] = 0U; + ret[101U] = 0U; + ret[102U] = 0U; + ret[103U] = 0U; + ret[104U] = 0U; + ret[105U] = 0U; + ret[106U] = 0U; + ret[107U] = 0U; + ret[108U] = 0U; + ret[109U] = 0U; + ret[110U] = 0U; + ret[111U] = 0U; + ret[112U] = 0U; + ret[113U] = 0U; + ret[114U] = 0U; + ret[115U] = 0U; + ret[116U] = 0U; + ret[117U] = 0U; + ret[118U] = 0U; + ret[119U] = 0U; + ret[120U] = 0U; + ret[121U] = 0U; + ret[122U] = 0U; + ret[123U] = 0U; + ret[124U] = 0U; + ret[125U] = 0U; + ret[126U] = 0U; + ret[127U] = 0U; + ret[128U] = 0U; + ret[129U] = 0U; + ret[130U] = 0U; + ret[131U] = 0U; + ret[132U] = 0U; + ret[133U] = 0U; + ret[134U] = 0U; + ret[135U] = 0U; +} + +/** + Generate a new keccak xof state. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.new_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_4f +libcrux_sha3_generic_keccak_new_9d_7e(void) { + libcrux_sha3_generic_keccak_KeccakXofState_4f lit; + lit.inner = libcrux_sha3_generic_keccak_new_1e_f4(); + uint8_t ret[136U]; + libcrux_sha3_generic_keccak_zero_block_9d_e6(ret); + memcpy(lit.buf[0U], ret, (size_t)136U * sizeof(uint8_t)); + lit.buf_len = (size_t)0U; + lit.sponge = false; + return lit; +} + +/** + Shake256 new state +*/ +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<136: usize> for +libcrux_sha3::portable::incremental::Shake256Absorb)#2} +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_4f +libcrux_sha3_portable_incremental_new_7d(void) { + return libcrux_sha3_generic_keccak_new_9d_7e(); +} + +/** +A monomorphic instance of libcrux_sha3.generic_keccak.KeccakXofState +with types uint64_t +with const generics +- $1size_t +- $168size_t +*/ +typedef struct libcrux_sha3_generic_keccak_KeccakXofState_78_s { + libcrux_sha3_generic_keccak_KeccakState_48 inner; + uint8_t buf[1U][168U]; + size_t buf_len; + bool sponge; +} libcrux_sha3_generic_keccak_KeccakXofState_78; + +typedef libcrux_sha3_generic_keccak_KeccakXofState_78 + libcrux_sha3_portable_incremental_Shake128Absorb; + +/** + Consume the internal buffer and the required amount of the input to pad to + `RATE`. + + Returns the `consumed` bytes from `inputs` if there's enough buffered + content to consume, and `0` otherwise. + If `consumed > 0` is returned, `self.buf` contains a full block to be + loaded. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.fill_buffer_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static inline size_t libcrux_sha3_generic_keccak_fill_buffer_9d_b00( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, + Eurydice_slice inputs[1U]) { + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + size_t consumed = (size_t)0U; + if (self->buf_len > (size_t)0U) { + if (self->buf_len + input_len >= (size_t)168U) { + consumed = (size_t)168U - self->buf_len; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( + (size_t)168U, self->buf[i0], self->buf_len, uint8_t, size_t); + Eurydice_slice_copy( + uu____0, + Eurydice_slice_subslice_to(inputs[i0], consumed, uint8_t, size_t), + uint8_t); + } + self->buf_len = self->buf_len + consumed; + } + } + return consumed; +} + +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_full_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static inline size_t libcrux_sha3_generic_keccak_absorb_full_9d_f80( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_78 *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs0[1U]; + memcpy(copy_of_inputs0, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_consumed = + libcrux_sha3_generic_keccak_fill_buffer_9d_b00(uu____0, copy_of_inputs0); + if (input_consumed > (size_t)0U) { + Eurydice_slice borrowed[1U]; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + uint8_t buf[168U] = {0U}; + borrowed[i] = core_array___Array_T__N__23__as_slice( + (size_t)168U, buf, uint8_t, Eurydice_slice); + } + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + borrowed[i0] = + Eurydice_array_to_slice((size_t)168U, self->buf[i0], uint8_t); + } + uint64_t(*uu____2)[5U] = self->inner.st; + Eurydice_slice uu____3[1U]; + memcpy(uu____3, borrowed, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_load_block_5a_b83(uu____2, uu____3); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + self->buf_len = (size_t)0U; + } + size_t input_to_consume = + Eurydice_slice_len(inputs[0U], uint8_t) - input_consumed; + size_t num_blocks = input_to_consume / (size_t)168U; + size_t remainder = input_to_consume % (size_t)168U; + for (size_t i = (size_t)0U; i < num_blocks; i++) { + size_t i0 = i; + uint64_t(*uu____4)[5U] = self->inner.st; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice ret[1U]; + libcrux_sha3_portable_keccak_slice_n_5a( + copy_of_inputs, input_consumed + i0 * (size_t)168U, (size_t)168U, ret); + libcrux_sha3_portable_keccak_load_block_5a_b83(uu____4, ret); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + } + return remainder; +} + +/** + Absorb + + This function takes any number of bytes to absorb and buffers if it's not + enough. The function assumes that all input slices in `blocks` have the same + length. + + Only a multiple of `RATE` blocks are absorbed. + For the remaining bytes [`absorb_final`] needs to be called. + + This works best with relatively small `inputs`. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_9d_7b0( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_78 *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_remainder_len = + libcrux_sha3_generic_keccak_absorb_full_9d_f80(uu____0, copy_of_inputs); + if (input_remainder_len > (size_t)0U) { + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + Eurydice_slice uu____2 = Eurydice_array_to_subslice2( + self->buf[i0], self->buf_len, self->buf_len + input_remainder_len, + uint8_t); + Eurydice_slice_copy( + uu____2, + Eurydice_slice_subslice_from( + inputs[i0], input_len - input_remainder_len, uint8_t, size_t), + uint8_t); + } + self->buf_len = self->buf_len + input_remainder_len; + } +} + +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<168: usize> for +libcrux_sha3::portable::incremental::Shake128Absorb)} +*/ +static inline void libcrux_sha3_portable_incremental_absorb_1c( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, Eurydice_slice input) { + Eurydice_slice buf[1U] = {input}; + libcrux_sha3_generic_keccak_absorb_9d_7b0(self, buf); +} + +typedef libcrux_sha3_generic_keccak_KeccakXofState_78 + libcrux_sha3_portable_incremental_Shake128Squeeze; + +/** + Absorb a final block. + + The `inputs` block may be empty. Everything in the `inputs` block beyond + `RATE` bytes is ignored. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.absorb_final_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +- DELIMITER= 31 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_absorb_final_9d_250( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, + Eurydice_slice inputs[1U]) { + libcrux_sha3_generic_keccak_KeccakXofState_78 *uu____0 = self; + /* Passing arrays by value in Rust generates a copy in C */ + Eurydice_slice copy_of_inputs[1U]; + memcpy(copy_of_inputs, inputs, (size_t)1U * sizeof(Eurydice_slice)); + size_t input_remainder_len = + libcrux_sha3_generic_keccak_absorb_full_9d_f80(uu____0, copy_of_inputs); + size_t input_len = Eurydice_slice_len(inputs[0U], uint8_t); + uint8_t blocks[1U][200U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)1U; i++) { + size_t i0 = i; + if (self->buf_len > (size_t)0U) { + Eurydice_slice uu____2 = Eurydice_array_to_subslice2( + blocks[i0], (size_t)0U, self->buf_len, uint8_t); + Eurydice_slice_copy(uu____2, + Eurydice_array_to_subslice2(self->buf[i0], (size_t)0U, + self->buf_len, uint8_t), + uint8_t); + } + if (input_remainder_len > (size_t)0U) { + Eurydice_slice uu____3 = Eurydice_array_to_subslice2( + blocks[i0], self->buf_len, self->buf_len + input_remainder_len, + uint8_t); + Eurydice_slice_copy( + uu____3, + Eurydice_slice_subslice_from( + inputs[i0], input_len - input_remainder_len, uint8_t, size_t), + uint8_t); + } + blocks[i0][self->buf_len + input_remainder_len] = 31U; + size_t uu____4 = i0; + size_t uu____5 = (size_t)168U - (size_t)1U; + blocks[uu____4][uu____5] = (uint32_t)blocks[uu____4][uu____5] | 128U; + } + uint64_t(*uu____6)[5U] = self->inner.st; + uint8_t uu____7[1U][200U]; + memcpy(uu____7, blocks, (size_t)1U * sizeof(uint8_t[200U])); + libcrux_sha3_portable_keccak_load_block_full_5a_d21(uu____6, uu____7); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); +} + +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<168: usize> for +libcrux_sha3::portable::incremental::Shake128Absorb)} +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_78 +libcrux_sha3_portable_incremental_absorb_final_1c( + libcrux_sha3_generic_keccak_KeccakXofState_78 self, Eurydice_slice input) { + Eurydice_slice buf[1U] = {input}; + libcrux_sha3_generic_keccak_absorb_final_9d_250(&self, buf); + return self; +} + +/** + An all zero block +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.zero_block_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static inline void libcrux_sha3_generic_keccak_zero_block_9d_e60( + uint8_t ret[168U]) { + ret[0U] = 0U; + ret[1U] = 0U; + ret[2U] = 0U; + ret[3U] = 0U; + ret[4U] = 0U; + ret[5U] = 0U; + ret[6U] = 0U; + ret[7U] = 0U; + ret[8U] = 0U; + ret[9U] = 0U; + ret[10U] = 0U; + ret[11U] = 0U; + ret[12U] = 0U; + ret[13U] = 0U; + ret[14U] = 0U; + ret[15U] = 0U; + ret[16U] = 0U; + ret[17U] = 0U; + ret[18U] = 0U; + ret[19U] = 0U; + ret[20U] = 0U; + ret[21U] = 0U; + ret[22U] = 0U; + ret[23U] = 0U; + ret[24U] = 0U; + ret[25U] = 0U; + ret[26U] = 0U; + ret[27U] = 0U; + ret[28U] = 0U; + ret[29U] = 0U; + ret[30U] = 0U; + ret[31U] = 0U; + ret[32U] = 0U; + ret[33U] = 0U; + ret[34U] = 0U; + ret[35U] = 0U; + ret[36U] = 0U; + ret[37U] = 0U; + ret[38U] = 0U; + ret[39U] = 0U; + ret[40U] = 0U; + ret[41U] = 0U; + ret[42U] = 0U; + ret[43U] = 0U; + ret[44U] = 0U; + ret[45U] = 0U; + ret[46U] = 0U; + ret[47U] = 0U; + ret[48U] = 0U; + ret[49U] = 0U; + ret[50U] = 0U; + ret[51U] = 0U; + ret[52U] = 0U; + ret[53U] = 0U; + ret[54U] = 0U; + ret[55U] = 0U; + ret[56U] = 0U; + ret[57U] = 0U; + ret[58U] = 0U; + ret[59U] = 0U; + ret[60U] = 0U; + ret[61U] = 0U; + ret[62U] = 0U; + ret[63U] = 0U; + ret[64U] = 0U; + ret[65U] = 0U; + ret[66U] = 0U; + ret[67U] = 0U; + ret[68U] = 0U; + ret[69U] = 0U; + ret[70U] = 0U; + ret[71U] = 0U; + ret[72U] = 0U; + ret[73U] = 0U; + ret[74U] = 0U; + ret[75U] = 0U; + ret[76U] = 0U; + ret[77U] = 0U; + ret[78U] = 0U; + ret[79U] = 0U; + ret[80U] = 0U; + ret[81U] = 0U; + ret[82U] = 0U; + ret[83U] = 0U; + ret[84U] = 0U; + ret[85U] = 0U; + ret[86U] = 0U; + ret[87U] = 0U; + ret[88U] = 0U; + ret[89U] = 0U; + ret[90U] = 0U; + ret[91U] = 0U; + ret[92U] = 0U; + ret[93U] = 0U; + ret[94U] = 0U; + ret[95U] = 0U; + ret[96U] = 0U; + ret[97U] = 0U; + ret[98U] = 0U; + ret[99U] = 0U; + ret[100U] = 0U; + ret[101U] = 0U; + ret[102U] = 0U; + ret[103U] = 0U; + ret[104U] = 0U; + ret[105U] = 0U; + ret[106U] = 0U; + ret[107U] = 0U; + ret[108U] = 0U; + ret[109U] = 0U; + ret[110U] = 0U; + ret[111U] = 0U; + ret[112U] = 0U; + ret[113U] = 0U; + ret[114U] = 0U; + ret[115U] = 0U; + ret[116U] = 0U; + ret[117U] = 0U; + ret[118U] = 0U; + ret[119U] = 0U; + ret[120U] = 0U; + ret[121U] = 0U; + ret[122U] = 0U; + ret[123U] = 0U; + ret[124U] = 0U; + ret[125U] = 0U; + ret[126U] = 0U; + ret[127U] = 0U; + ret[128U] = 0U; + ret[129U] = 0U; + ret[130U] = 0U; + ret[131U] = 0U; + ret[132U] = 0U; + ret[133U] = 0U; + ret[134U] = 0U; + ret[135U] = 0U; + ret[136U] = 0U; + ret[137U] = 0U; + ret[138U] = 0U; + ret[139U] = 0U; + ret[140U] = 0U; + ret[141U] = 0U; + ret[142U] = 0U; + ret[143U] = 0U; + ret[144U] = 0U; + ret[145U] = 0U; + ret[146U] = 0U; + ret[147U] = 0U; + ret[148U] = 0U; + ret[149U] = 0U; + ret[150U] = 0U; + ret[151U] = 0U; + ret[152U] = 0U; + ret[153U] = 0U; + ret[154U] = 0U; + ret[155U] = 0U; + ret[156U] = 0U; + ret[157U] = 0U; + ret[158U] = 0U; + ret[159U] = 0U; + ret[160U] = 0U; + ret[161U] = 0U; + ret[162U] = 0U; + ret[163U] = 0U; + ret[164U] = 0U; + ret[165U] = 0U; + ret[166U] = 0U; + ret[167U] = 0U; +} + +/** + Generate a new keccak xof state. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.new_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_78 +libcrux_sha3_generic_keccak_new_9d_7e0(void) { + libcrux_sha3_generic_keccak_KeccakXofState_78 lit; + lit.inner = libcrux_sha3_generic_keccak_new_1e_f4(); + uint8_t ret[168U]; + libcrux_sha3_generic_keccak_zero_block_9d_e60(ret); + memcpy(lit.buf[0U], ret, (size_t)168U * sizeof(uint8_t)); + lit.buf_len = (size_t)0U; + lit.sponge = false; + return lit; +} + +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofAbsorb<168: usize> for +libcrux_sha3::portable::incremental::Shake128Absorb)} +*/ +static inline libcrux_sha3_generic_keccak_KeccakXofState_78 +libcrux_sha3_portable_incremental_new_1c(void) { + return libcrux_sha3_generic_keccak_new_9d_7e0(); +} + +/** + `out` has the exact size we want here. It must be less than or equal to `RATE`. +*/ +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_5a +with const generics +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_5a_1c( + uint64_t (*state)[5U], Eurydice_slice out[1U]) { + size_t num_full_blocks = Eurydice_slice_len(out[0U], uint8_t) / (size_t)8U; + size_t last_block_len = Eurydice_slice_len(out[0U], uint8_t) % (size_t)8U; + for (size_t i = (size_t)0U; i < num_full_blocks; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], i0 * (size_t)8U, i0 * (size_t)8U + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(state[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } + if (last_block_len != (size_t)0U) { + Eurydice_slice uu____1 = Eurydice_slice_subslice2( + out[0U], num_full_blocks * (size_t)8U, + num_full_blocks * (size_t)8U + last_block_len, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes( + state[num_full_blocks / (size_t)5U][num_full_blocks % (size_t)5U], ret); + Eurydice_slice_copy( + uu____1, + Eurydice_array_to_subslice2(ret, (size_t)0U, last_block_len, uint8_t), + uint8_t); + } +} + +/** + Squeeze `N` x `LEN` bytes. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 136 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_9d_96( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, + Eurydice_slice out[1U]) { + if (self->sponge) { + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + } + size_t out_len = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = out_len / (size_t)136U; + size_t last = out_len - out_len % (size_t)136U; + size_t mid; + if ((size_t)136U >= out_len) { + mid = out_len; + } else { + mid = (size_t)136U; + } + Eurydice_slice_uint8_t_1size_t__x2 uu____0 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, mid); + Eurydice_slice out00[1U]; + memcpy(out00, uu____0.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice out_rest[1U]; + memcpy(out_rest, uu____0.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_store_5a_1c(self->inner.st, out00); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____1 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out_rest, + (size_t)136U); + Eurydice_slice out0[1U]; + memcpy(out0, uu____1.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice tmp[1U]; + memcpy(tmp, uu____1.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + libcrux_sha3_portable_keccak_store_5a_1c(self->inner.st, out0); + memcpy(out_rest, tmp, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < out_len) { + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + libcrux_sha3_portable_keccak_store_5a_1c(self->inner.st, out_rest); + } + self->sponge = true; +} + +/** + Shake256 squeeze +*/ +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofSqueeze<136: usize> for +libcrux_sha3::portable::incremental::Shake256Squeeze)#3} +*/ +static inline void libcrux_sha3_portable_incremental_squeeze_8a( + libcrux_sha3_generic_keccak_KeccakXofState_4f *self, Eurydice_slice out) { + Eurydice_slice buf[1U] = {out}; + libcrux_sha3_generic_keccak_squeeze_9d_96(self, buf); +} + +/** + `out` has the exact size we want here. It must be less than or equal to `RATE`. +*/ +/** +This function found in impl {(libcrux_sha3::traits::internal::KeccakItem<1: +usize> for u64)} +*/ +/** +A monomorphic instance of libcrux_sha3.portable_keccak.store_5a +with const generics +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_portable_keccak_store_5a_1c0( + uint64_t (*state)[5U], Eurydice_slice out[1U]) { + size_t num_full_blocks = Eurydice_slice_len(out[0U], uint8_t) / (size_t)8U; + size_t last_block_len = Eurydice_slice_len(out[0U], uint8_t) % (size_t)8U; + for (size_t i = (size_t)0U; i < num_full_blocks; i++) { + size_t i0 = i; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out[0U], i0 * (size_t)8U, i0 * (size_t)8U + (size_t)8U, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes(state[i0 / (size_t)5U][i0 % (size_t)5U], ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)8U, ret, uint8_t), uint8_t); + } + if (last_block_len != (size_t)0U) { + Eurydice_slice uu____1 = Eurydice_slice_subslice2( + out[0U], num_full_blocks * (size_t)8U, + num_full_blocks * (size_t)8U + last_block_len, uint8_t); + uint8_t ret[8U]; + core_num__u64_9__to_le_bytes( + state[num_full_blocks / (size_t)5U][num_full_blocks % (size_t)5U], ret); + Eurydice_slice_copy( + uu____1, + Eurydice_array_to_subslice2(ret, (size_t)0U, last_block_len, uint8_t), + uint8_t); + } +} + +/** + Squeeze `N` x `LEN` bytes. +*/ +/** +This function found in impl {libcrux_sha3::generic_keccak::KeccakXofState[TraitClause@0]#2} +*/ +/** +A monomorphic instance of libcrux_sha3.generic_keccak.squeeze_9d +with types uint64_t +with const generics +- PARALLEL_LANES= 1 +- RATE= 168 +*/ +static KRML_MUSTINLINE void libcrux_sha3_generic_keccak_squeeze_9d_960( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, + Eurydice_slice out[1U]) { + if (self->sponge) { + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + } + size_t out_len = Eurydice_slice_len(out[0U], uint8_t); + size_t blocks = out_len / (size_t)168U; + size_t last = out_len - out_len % (size_t)168U; + size_t mid; + if ((size_t)168U >= out_len) { + mid = out_len; + } else { + mid = (size_t)168U; + } + Eurydice_slice_uint8_t_1size_t__x2 uu____0 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out, mid); + Eurydice_slice out00[1U]; + memcpy(out00, uu____0.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice out_rest[1U]; + memcpy(out_rest, uu____0.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_portable_keccak_store_5a_1c0(self->inner.st, out00); + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){.start = (size_t)1U, + .end = blocks}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + if (core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3) + .tag == None) { + break; + } else { + Eurydice_slice_uint8_t_1size_t__x2 uu____1 = + libcrux_sha3_portable_keccak_split_at_mut_n_5a(out_rest, + (size_t)168U); + Eurydice_slice out0[1U]; + memcpy(out0, uu____1.fst, (size_t)1U * sizeof(Eurydice_slice)); + Eurydice_slice tmp[1U]; + memcpy(tmp, uu____1.snd, (size_t)1U * sizeof(Eurydice_slice)); + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + libcrux_sha3_portable_keccak_store_5a_1c0(self->inner.st, out0); + memcpy(out_rest, tmp, (size_t)1U * sizeof(Eurydice_slice)); + } + } + if (last < out_len) { + libcrux_sha3_generic_keccak_keccakf1600_21(&self->inner); + libcrux_sha3_portable_keccak_store_5a_1c0(self->inner.st, out_rest); + } + self->sponge = true; +} + +/** + Shake128 squeeze +*/ +/** +This function found in impl +{(libcrux_sha3::portable::incremental::XofSqueeze<168: usize> for +libcrux_sha3::portable::incremental::Shake128Squeeze)#1} +*/ +static inline void libcrux_sha3_portable_incremental_squeeze_10( + libcrux_sha3_generic_keccak_KeccakXofState_78 *self, Eurydice_slice out) { + Eurydice_slice buf[1U] = {out}; + libcrux_sha3_generic_keccak_squeeze_9d_960(self, buf); +} + +/** +This function found in impl {(core::clone::Clone for +libcrux_sha3::portable::KeccakState)} +*/ +static inline libcrux_sha3_generic_keccak_KeccakState_48 +libcrux_sha3_portable_clone_3d( + libcrux_sha3_generic_keccak_KeccakState_48 *self) { + return self[0U]; +} + +/** +This function found in impl {(core::convert::From for +u32)#1} +*/ +static inline uint32_t libcrux_sha3_from_eb(libcrux_sha3_Algorithm v) { + uint32_t uu____0; + switch (v) { + case libcrux_sha3_Sha224: { + uu____0 = 1U; + break; + } + case libcrux_sha3_Sha256: { + uu____0 = 2U; + break; + } + case libcrux_sha3_Sha384: { + uu____0 = 3U; + break; + } + case libcrux_sha3_Sha512: { + uu____0 = 4U; + break; + } + default: { + KRML_HOST_EPRINTF("KaRaMeL incomplete match at %s:%d\n", __FILE__, + __LINE__); + KRML_HOST_EXIT(253U); + } + } + return uu____0; +} + +/** +This function found in impl {(core::convert::From for +libcrux_sha3::Algorithm)} +*/ +static inline libcrux_sha3_Algorithm libcrux_sha3_from_2d(uint32_t v) { + libcrux_sha3_Algorithm uu____0; + switch (v) { + case 1U: { + uu____0 = libcrux_sha3_Sha224; + break; + } + case 2U: { + uu____0 = libcrux_sha3_Sha256; + break; + } + case 3U: { + uu____0 = libcrux_sha3_Sha384; + break; + } + case 4U: { + uu____0 = libcrux_sha3_Sha512; + break; + } + default: { + KRML_HOST_EPRINTF("KaRaMeL abort at %s:%d\n%s\n", __FILE__, __LINE__, + "panic!"); + KRML_HOST_EXIT(255U); + } + } + return uu____0; +} + +typedef uint8_t libcrux_sha3_Sha3_512Digest[64U]; + +typedef uint8_t libcrux_sha3_Sha3_384Digest[48U]; + +typedef uint8_t libcrux_sha3_Sha3_256Digest[32U]; + +typedef uint8_t libcrux_sha3_Sha3_224Digest[28U]; + +#if defined(__cplusplus) +} +#endif + +#define __libcrux_sha3_portable_H_DEFINED +#endif + +/* from libcrux/libcrux-ml-kem/cg/libcrux_mlkem768_portable.h */ +/* + * SPDX-FileCopyrightText: 2024 Cryspen Sarl + * + * SPDX-License-Identifier: MIT or Apache-2.0 + * + * This code was generated with the following revisions: + * Charon: 6b5e110342a771a3e1c739b10294b1778e4be8b4 + * Eurydice: 31be7d65ca5d6acdacfb33652e478d24dd85c1cb + * Karamel: 3205d3365ea2790b02368f79fcee38e38d0b5908 + * F*: a32b316e521fa4f239b610ec8f1d15e78d62cbe8-dirty + * Libcrux: 4ad532b206174114dd4140b718e7794a28fc59ee + */ + +#ifndef __libcrux_mlkem768_portable_H +#define __libcrux_mlkem768_portable_H + +#if defined(__cplusplus) +extern "C" { +#endif + + +#define LIBCRUX_ML_KEM_HASH_FUNCTIONS_BLOCK_SIZE ((size_t)168U) + +#define LIBCRUX_ML_KEM_HASH_FUNCTIONS_THREE_BLOCKS \ + (LIBCRUX_ML_KEM_HASH_FUNCTIONS_BLOCK_SIZE * (size_t)3U) + +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_G( + Eurydice_slice input, uint8_t ret[64U]) { + uint8_t digest[64U] = {0U}; + libcrux_sha3_portable_sha512( + Eurydice_array_to_slice((size_t)64U, digest, uint8_t), input); + memcpy(ret, digest, (size_t)64U * sizeof(uint8_t)); +} + +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_H( + Eurydice_slice input, uint8_t ret[32U]) { + uint8_t digest[32U] = {0U}; + libcrux_sha3_portable_sha256( + Eurydice_array_to_slice((size_t)32U, digest, uint8_t), input); + memcpy(ret, digest, (size_t)32U * sizeof(uint8_t)); +} + +#define LIBCRUX_ML_KEM_IND_CCA_ENCAPS_SEED_SIZE \ + (LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE) + +#define LIBCRUX_ML_KEM_IND_CCA_KEY_GENERATION_SEED_SIZE \ + (LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE + \ + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE) + +typedef uint8_t libcrux_ml_kem_ind_cca_MlKemSharedSecret[32U]; + +static const int16_t libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[128U] = + {(int16_t)-1044, (int16_t)-758, (int16_t)-359, (int16_t)-1517, + (int16_t)1493, (int16_t)1422, (int16_t)287, (int16_t)202, + (int16_t)-171, (int16_t)622, (int16_t)1577, (int16_t)182, + (int16_t)962, (int16_t)-1202, (int16_t)-1474, (int16_t)1468, + (int16_t)573, (int16_t)-1325, (int16_t)264, (int16_t)383, + (int16_t)-829, (int16_t)1458, (int16_t)-1602, (int16_t)-130, + (int16_t)-681, (int16_t)1017, (int16_t)732, (int16_t)608, + (int16_t)-1542, (int16_t)411, (int16_t)-205, (int16_t)-1571, + (int16_t)1223, (int16_t)652, (int16_t)-552, (int16_t)1015, + (int16_t)-1293, (int16_t)1491, (int16_t)-282, (int16_t)-1544, + (int16_t)516, (int16_t)-8, (int16_t)-320, (int16_t)-666, + (int16_t)-1618, (int16_t)-1162, (int16_t)126, (int16_t)1469, + (int16_t)-853, (int16_t)-90, (int16_t)-271, (int16_t)830, + (int16_t)107, (int16_t)-1421, (int16_t)-247, (int16_t)-951, + (int16_t)-398, (int16_t)961, (int16_t)-1508, (int16_t)-725, + (int16_t)448, (int16_t)-1065, (int16_t)677, (int16_t)-1275, + (int16_t)-1103, (int16_t)430, (int16_t)555, (int16_t)843, + (int16_t)-1251, (int16_t)871, (int16_t)1550, (int16_t)105, + (int16_t)422, (int16_t)587, (int16_t)177, (int16_t)-235, + (int16_t)-291, (int16_t)-460, (int16_t)1574, (int16_t)1653, + (int16_t)-246, (int16_t)778, (int16_t)1159, (int16_t)-147, + (int16_t)-777, (int16_t)1483, (int16_t)-602, (int16_t)1119, + (int16_t)-1590, (int16_t)644, (int16_t)-872, (int16_t)349, + (int16_t)418, (int16_t)329, (int16_t)-156, (int16_t)-75, + (int16_t)817, (int16_t)1097, (int16_t)603, (int16_t)610, + (int16_t)1322, (int16_t)-1285, (int16_t)-1465, (int16_t)384, + (int16_t)-1215, (int16_t)-136, (int16_t)1218, (int16_t)-1335, + (int16_t)-874, (int16_t)220, (int16_t)-1187, (int16_t)-1659, + (int16_t)-1185, (int16_t)-1530, (int16_t)-1278, (int16_t)794, + (int16_t)-1510, (int16_t)-854, (int16_t)-870, (int16_t)478, + (int16_t)-108, (int16_t)-308, (int16_t)996, (int16_t)991, + (int16_t)958, (int16_t)-1460, (int16_t)1522, (int16_t)1628}; + +#define LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR ((size_t)16U) + +#define LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT \ + (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT / \ + LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR) + +#define LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS ((int16_t)3329) + +#define LIBCRUX_ML_KEM_VECTOR_TRAITS_MONTGOMERY_R_SQUARED_MOD_FIELD_MODULUS \ + ((int16_t)1353) + +#define LIBCRUX_ML_KEM_VECTOR_TRAITS_INVERSE_OF_MODULUS_MOD_MONTGOMERY_R \ + (62209U) + +typedef struct libcrux_ml_kem_vector_portable_vector_type_PortableVector_s { + int16_t elements[16U]; +} libcrux_ml_kem_vector_portable_vector_type_PortableVector; + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_vector_type_from_i16_array( + Eurydice_slice array) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector lit; + int16_t ret[16U]; + Result_c0 dst; + Eurydice_slice_to_array2( + &dst, Eurydice_slice_subslice2(array, (size_t)0U, (size_t)16U, int16_t), + Eurydice_slice, int16_t[16U]); + unwrap_41_f9(dst, ret); + memcpy(lit.elements, ret, (size_t)16U * sizeof(int16_t)); + return lit; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_from_i16_array_0d(Eurydice_slice array) { + return libcrux_ml_kem_vector_portable_vector_type_from_i16_array(array); +} + +typedef struct uint8_t_x11_s { + uint8_t fst; + uint8_t snd; + uint8_t thd; + uint8_t f3; + uint8_t f4; + uint8_t f5; + uint8_t f6; + uint8_t f7; + uint8_t f8; + uint8_t f9; + uint8_t f10; +} uint8_t_x11; + +static KRML_MUSTINLINE uint8_t_x11 +libcrux_ml_kem_vector_portable_serialize_serialize_11_int(Eurydice_slice v) { + uint8_t r0 = (uint8_t)Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *); + uint8_t r1 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)1U, int16_t, + int16_t *) & + (int16_t)31) + << 3U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, + int16_t *) >> + 8U); + uint8_t r2 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)2U, int16_t, + int16_t *) & + (int16_t)3) + << 6U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)1U, int16_t, + int16_t *) >> + 5U); + uint8_t r3 = + (uint8_t)(Eurydice_slice_index(v, (size_t)2U, int16_t, int16_t *) >> 2U & + (int16_t)255); + uint8_t r4 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)3U, int16_t, + int16_t *) & + (int16_t)127) + << 1U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)2U, int16_t, + int16_t *) >> + 10U); + uint8_t r5 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)4U, int16_t, + int16_t *) & + (int16_t)15) + << 4U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)3U, int16_t, + int16_t *) >> + 7U); + uint8_t r6 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)5U, int16_t, + int16_t *) & + (int16_t)1) + << 7U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)4U, int16_t, + int16_t *) >> + 4U); + uint8_t r7 = + (uint8_t)(Eurydice_slice_index(v, (size_t)5U, int16_t, int16_t *) >> 1U & + (int16_t)255); + uint8_t r8 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)6U, int16_t, + int16_t *) & + (int16_t)63) + << 2U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)5U, int16_t, + int16_t *) >> + 9U); + uint8_t r9 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)7U, int16_t, + int16_t *) & + (int16_t)7) + << 5U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)6U, int16_t, + int16_t *) >> + 6U); + uint8_t r10 = + (uint8_t)(Eurydice_slice_index(v, (size_t)7U, int16_t, int16_t *) >> 3U); + return (CLITERAL(uint8_t_x11){.fst = r0, + .snd = r1, + .thd = r2, + .f3 = r3, + .f4 = r4, + .f5 = r5, + .f6 = r6, + .f7 = r7, + .f8 = r8, + .f9 = r9, + .f10 = r10}); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_11( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[22U]) { + uint8_t_x11 r0_10 = libcrux_ml_kem_vector_portable_serialize_serialize_11_int( + Eurydice_array_to_subslice2(v.elements, (size_t)0U, (size_t)8U, int16_t)); + uint8_t_x11 r11_21 = + libcrux_ml_kem_vector_portable_serialize_serialize_11_int( + Eurydice_array_to_subslice2(v.elements, (size_t)8U, (size_t)16U, + int16_t)); + uint8_t result[22U] = {0U}; + result[0U] = r0_10.fst; + result[1U] = r0_10.snd; + result[2U] = r0_10.thd; + result[3U] = r0_10.f3; + result[4U] = r0_10.f4; + result[5U] = r0_10.f5; + result[6U] = r0_10.f6; + result[7U] = r0_10.f7; + result[8U] = r0_10.f8; + result[9U] = r0_10.f9; + result[10U] = r0_10.f10; + result[11U] = r11_21.fst; + result[12U] = r11_21.snd; + result[13U] = r11_21.thd; + result[14U] = r11_21.f3; + result[15U] = r11_21.f4; + result[16U] = r11_21.f5; + result[17U] = r11_21.f6; + result[18U] = r11_21.f7; + result[19U] = r11_21.f8; + result[20U] = r11_21.f9; + result[21U] = r11_21.f10; + memcpy(ret, result, (size_t)22U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_11_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[22U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_11(a, ret); +} + +typedef struct int16_t_x8_s { + int16_t fst; + int16_t snd; + int16_t thd; + int16_t f3; + int16_t f4; + int16_t f5; + int16_t f6; + int16_t f7; +} int16_t_x8; + +static KRML_MUSTINLINE int16_t_x8 +libcrux_ml_kem_vector_portable_serialize_deserialize_11_int( + Eurydice_slice bytes) { + int16_t r0 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) & + (int16_t)7) + << 8U | + (int16_t)Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *); + int16_t r1 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) & + (int16_t)63) + << 5U | + (int16_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) >> + 3U; + int16_t r2 = + (((int16_t)Eurydice_slice_index(bytes, (size_t)4U, uint8_t, uint8_t *) & + (int16_t)1) + << 10U | + (int16_t)Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *) + << 2U) | + (int16_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) >> + 6U; + int16_t r3 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)5U, uint8_t, uint8_t *) & + (int16_t)15) + << 7U | + (int16_t)Eurydice_slice_index(bytes, (size_t)4U, uint8_t, uint8_t *) >> + 1U; + int16_t r4 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *) & + (int16_t)127) + << 4U | + (int16_t)Eurydice_slice_index(bytes, (size_t)5U, uint8_t, uint8_t *) >> + 4U; + int16_t r5 = + (((int16_t)Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *) & + (int16_t)3) + << 9U | + (int16_t)Eurydice_slice_index(bytes, (size_t)7U, uint8_t, uint8_t *) + << 1U) | + (int16_t)Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *) >> + 7U; + int16_t r6 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)9U, uint8_t, uint8_t *) & + (int16_t)31) + << 6U | + (int16_t)Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *) >> + 2U; + int16_t r7 = + (int16_t)Eurydice_slice_index(bytes, (size_t)10U, uint8_t, uint8_t *) + << 3U | + (int16_t)Eurydice_slice_index(bytes, (size_t)9U, uint8_t, uint8_t *) >> + 5U; + return (CLITERAL(int16_t_x8){.fst = r0, + .snd = r1, + .thd = r2, + .f3 = r3, + .f4 = r4, + .f5 = r5, + .f6 = r6, + .f7 = r7}); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_vector_type_zero(void) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector lit; + lit.elements[0U] = (int16_t)0; + lit.elements[1U] = (int16_t)0; + lit.elements[2U] = (int16_t)0; + lit.elements[3U] = (int16_t)0; + lit.elements[4U] = (int16_t)0; + lit.elements[5U] = (int16_t)0; + lit.elements[6U] = (int16_t)0; + lit.elements[7U] = (int16_t)0; + lit.elements[8U] = (int16_t)0; + lit.elements[9U] = (int16_t)0; + lit.elements[10U] = (int16_t)0; + lit.elements[11U] = (int16_t)0; + lit.elements[12U] = (int16_t)0; + lit.elements[13U] = (int16_t)0; + lit.elements[14U] = (int16_t)0; + lit.elements[15U] = (int16_t)0; + return lit; +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_11(Eurydice_slice bytes) { + int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_11_int( + Eurydice_slice_subslice2(bytes, (size_t)0U, (size_t)11U, uint8_t)); + int16_t_x8 v8_15 = + libcrux_ml_kem_vector_portable_serialize_deserialize_11_int( + Eurydice_slice_subslice2(bytes, (size_t)11U, (size_t)22U, uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector v = + libcrux_ml_kem_vector_portable_vector_type_zero(); + v.elements[0U] = v0_7.fst; + v.elements[1U] = v0_7.snd; + v.elements[2U] = v0_7.thd; + v.elements[3U] = v0_7.f3; + v.elements[4U] = v0_7.f4; + v.elements[5U] = v0_7.f5; + v.elements[6U] = v0_7.f6; + v.elements[7U] = v0_7.f7; + v.elements[8U] = v8_15.fst; + v.elements[9U] = v8_15.snd; + v.elements[10U] = v8_15.thd; + v.elements[11U] = v8_15.f3; + v.elements[12U] = v8_15.f4; + v.elements[13U] = v8_15.f5; + v.elements[14U] = v8_15.f6; + v.elements[15U] = v8_15.f7; + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_11_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_11(a); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_vector_type_to_i16_array( + libcrux_ml_kem_vector_portable_vector_type_PortableVector x, + int16_t ret[16U]) { + memcpy(ret, x.elements, (size_t)16U * sizeof(int16_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_to_i16_array_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector x, + int16_t ret[16U]) { + libcrux_ml_kem_vector_portable_vector_type_to_i16_array(x, ret); +} + +static const uint8_t + libcrux_ml_kem_vector_rej_sample_table_REJECTION_SAMPLE_SHUFFLE_TABLE + [256U][16U] = {{255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {6U, 7U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {6U, 7U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 255U, + 255U, 255U, 255U}, + {12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {6U, 7U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 255U, + 255U, 255U, 255U}, + {10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, + 13U, 255U, 255U}, + {14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {6U, 7U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 14U, 15U, 255U, + 255U, 255U, 255U}, + {10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 14U, + 15U, 255U, 255U}, + {12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, 255U, 255U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {4U, 5U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 10U, 11U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, 255U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {2U, 3U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, 255U, + 255U, 255U, 255U, 255U, 255U}, + {0U, 1U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 2U, 3U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, 15U, + 255U, 255U, 255U, 255U}, + {0U, 1U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, 13U, 14U, + 15U, 255U, 255U}, + {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 9U, 10U, 11U, 12U, + 13U, 14U, 15U}}; + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ZERO_0d(void) { + return libcrux_ml_kem_vector_portable_vector_type_zero(); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_add( + libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + size_t uu____0 = i0; + lhs.elements[uu____0] = lhs.elements[uu____0] + rhs->elements[i0]; + } + return lhs; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_add_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { + return libcrux_ml_kem_vector_portable_arithmetic_add(lhs, rhs); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_sub( + libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + size_t uu____0 = i0; + lhs.elements[uu____0] = lhs.elements[uu____0] - rhs->elements[i0]; + } + return lhs; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_sub_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs) { + return libcrux_ml_kem_vector_portable_arithmetic_sub(lhs, rhs); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_multiply_by_constant( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t c) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + size_t uu____0 = i0; + v.elements[uu____0] = v.elements[uu____0] * c; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_multiply_by_constant_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t c) { + return libcrux_ml_kem_vector_portable_arithmetic_multiply_by_constant(v, c); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_bitwise_and_with_constant( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t c) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + size_t uu____0 = i0; + v.elements[uu____0] = v.elements[uu____0] & c; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_bitwise_and_with_constant_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t c) { + return libcrux_ml_kem_vector_portable_arithmetic_bitwise_and_with_constant(v, + c); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_cond_subtract_3329( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + core_ops_range_Range_b3 iter = + core_iter_traits_collect___core__iter__traits__collect__IntoIterator_for_I__1__into_iter( + (CLITERAL(core_ops_range_Range_b3){ + .start = (size_t)0U, + .end = LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR}), + core_ops_range_Range_b3, core_ops_range_Range_b3); + while (true) { + Option_b3 uu____0 = + core_iter_range___core__iter__traits__iterator__Iterator_for_core__ops__range__Range_A___6__next( + &iter, size_t, Option_b3); + if (!(uu____0.tag == None)) { + size_t i = uu____0.f0; + if (v.elements[i] >= (int16_t)3329) { + size_t uu____1 = i; + v.elements[uu____1] = v.elements[uu____1] - (int16_t)3329; + } + continue; + } + return v; + } +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_cond_subtract_3329_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_arithmetic_cond_subtract_3329(v); +} + +#define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_MULTIPLIER \ + ((int32_t)20159) + +#define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_SHIFT ((int32_t)26) + +#define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_R \ + ((int32_t)1 << (uint32_t) \ + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_SHIFT) + +/** + Signed Barrett Reduction + + Given an input `value`, `barrett_reduce` outputs a representative `result` + such that: + + - result ≡ value (mod FIELD_MODULUS) + - the absolute value of `result` is bound as follows: + + `|result| ≤ FIELD_MODULUS / 2 · (|value|/BARRETT_R + 1) + + In particular, if `|value| < BARRETT_R`, then `|result| < FIELD_MODULUS`. +*/ +static inline int16_t +libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( + int16_t value) { + int32_t t = (int32_t)value * + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_MULTIPLIER + + (LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_R >> 1U); + int16_t quotient = + (int16_t)(t >> + (uint32_t) + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_BARRETT_SHIFT); + return value - quotient * LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + v.elements[i0] = + libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( + v.elements[i0]); + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_barrett_reduce_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce(v); +} + +#define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT (16U) + +#define LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_R \ + ((int32_t)1 << (uint32_t) \ + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT) + +/** + Signed Montgomery Reduction + + Given an input `value`, `montgomery_reduce` outputs a representative `o` + such that: + + - o ≡ value · MONTGOMERY_R^(-1) (mod FIELD_MODULUS) + - the absolute value of `o` is bound as follows: + + `|result| ≤ (|value| / MONTGOMERY_R) + (FIELD_MODULUS / 2) + + In particular, if `|value| ≤ FIELD_MODULUS * MONTGOMERY_R`, then `|o| < (3 · + FIELD_MODULUS) / 2`. +*/ +static inline int16_t +libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( + int32_t value) { + int32_t k = + (int32_t)(int16_t)value * + (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_INVERSE_OF_MODULUS_MOD_MONTGOMERY_R; + int32_t k_times_modulus = + (int32_t)(int16_t)k * (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + int16_t c = + (int16_t)(k_times_modulus >> + (uint32_t) + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT); + int16_t value_high = + (int16_t)(value >> + (uint32_t) + LIBCRUX_ML_KEM_VECTOR_PORTABLE_ARITHMETIC_MONTGOMERY_SHIFT); + return value_high - c; +} + +/** + If `fe` is some field element 'x' of the Kyber field and `fer` is congruent to + `y · MONTGOMERY_R`, this procedure outputs a value that is congruent to + `x · y`, as follows: + + `fe · fer ≡ x · y · MONTGOMERY_R (mod FIELD_MODULUS)` + + `montgomery_reduce` takes the value `x · y · MONTGOMERY_R` and outputs a + representative `x · y · MONTGOMERY_R * MONTGOMERY_R^{-1} ≡ x · y (mod + FIELD_MODULUS)`. +*/ +static KRML_MUSTINLINE int16_t +libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( + int16_t fe, int16_t fer) { + return libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( + (int32_t)fe * (int32_t)fer); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_by_constant( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t c) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + v.elements[i0] = + libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( + v.elements[i0], c); + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t r) { + return libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_by_constant( + v, r); +} + +/** + The `compress_*` functions implement the `Compress` function specified in the + NIST FIPS 203 standard (Page 18, Expression 4.5), which is defined as: + + ```plaintext + Compress_d: ℤq -> ℤ_{2ᵈ} + Compress_d(x) = ⌈(2ᵈ/q)·x⌋ + ``` + + Since `⌈x⌋ = ⌊x + 1/2⌋` we have: + + ```plaintext + Compress_d(x) = ⌊(2ᵈ/q)·x + 1/2⌋ + = ⌊(2^{d+1}·x + q) / 2q⌋ + ``` + + For further information about the function implementations, consult the + `implementation_notes.pdf` document in this directory. + + The NIST FIPS 203 standard can be found at + . +*/ +static inline uint8_t +libcrux_ml_kem_vector_portable_compress_compress_message_coefficient( + uint16_t fe) { + int16_t shifted = (int16_t)1664 - (int16_t)fe; + int16_t mask = shifted >> 15U; + int16_t shifted_to_positive = mask ^ shifted; + int16_t shifted_positive_in_range = shifted_to_positive - (int16_t)832; + return (uint8_t)(shifted_positive_in_range >> 15U & (int16_t)1); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_compress_1( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + v.elements[i0] = (int16_t) + libcrux_ml_kem_vector_portable_compress_compress_message_coefficient( + (uint16_t)v.elements[i0]); + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_1_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_compress_1(v); +} + +static KRML_MUSTINLINE uint32_t +libcrux_ml_kem_vector_portable_arithmetic_get_n_least_significant_bits( + uint8_t n, uint32_t value) { + return value & ((1U << (uint32_t)n) - 1U); +} + +static inline int16_t +libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( + uint8_t coefficient_bits, uint16_t fe) { + uint64_t compressed = (uint64_t)fe << (uint32_t)coefficient_bits; + compressed = compressed + 1664ULL; + compressed = compressed * 10321340ULL; + compressed = compressed >> 35U; + return (int16_t) + libcrux_ml_kem_vector_portable_arithmetic_get_n_least_significant_bits( + coefficient_bits, (uint32_t)compressed); +} + +static KRML_MUSTINLINE void libcrux_ml_kem_vector_portable_ntt_ntt_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *v, int16_t zeta, + size_t i, size_t j) { + int16_t t = + libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( + v->elements[j], zeta); + v->elements[j] = v->elements[i] - t; + v->elements[i] = v->elements[i] + t; +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_ntt_layer_1_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta0, + int16_t zeta1, int16_t zeta2, int16_t zeta3) { + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)0U, + (size_t)2U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)1U, + (size_t)3U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)4U, + (size_t)6U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)5U, + (size_t)7U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta2, (size_t)8U, + (size_t)10U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta2, (size_t)9U, + (size_t)11U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta3, (size_t)12U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta3, (size_t)13U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_layer_1_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, + int16_t zeta1, int16_t zeta2, int16_t zeta3) { + return libcrux_ml_kem_vector_portable_ntt_ntt_layer_1_step(a, zeta0, zeta1, + zeta2, zeta3); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_ntt_layer_2_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta0, + int16_t zeta1) { + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)0U, + (size_t)4U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)1U, + (size_t)5U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)2U, + (size_t)6U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta0, (size_t)3U, + (size_t)7U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)8U, + (size_t)12U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)9U, + (size_t)13U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)10U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta1, (size_t)11U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_layer_2_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, + int16_t zeta1) { + return libcrux_ml_kem_vector_portable_ntt_ntt_layer_2_step(a, zeta0, zeta1); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_ntt_layer_3_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta) { + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)0U, (size_t)8U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)1U, (size_t)9U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)2U, + (size_t)10U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)3U, + (size_t)11U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)4U, + (size_t)12U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)5U, + (size_t)13U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)6U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_ntt_step(&v, zeta, (size_t)7U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_layer_3_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta) { + return libcrux_ml_kem_vector_portable_ntt_ntt_layer_3_step(a, zeta); +} + +static KRML_MUSTINLINE void libcrux_ml_kem_vector_portable_ntt_inv_ntt_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *v, int16_t zeta, + size_t i, size_t j) { + int16_t a_minus_b = v->elements[j] - v->elements[i]; + v->elements[i] = + libcrux_ml_kem_vector_portable_arithmetic_barrett_reduce_element( + v->elements[i] + v->elements[j]); + v->elements[j] = + libcrux_ml_kem_vector_portable_arithmetic_montgomery_multiply_fe_by_fer( + a_minus_b, zeta); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_1_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta0, + int16_t zeta1, int16_t zeta2, int16_t zeta3) { + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)0U, + (size_t)2U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)1U, + (size_t)3U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)4U, + (size_t)6U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)5U, + (size_t)7U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta2, (size_t)8U, + (size_t)10U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta2, (size_t)9U, + (size_t)11U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta3, (size_t)12U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta3, (size_t)13U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_inv_ntt_layer_1_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, + int16_t zeta1, int16_t zeta2, int16_t zeta3) { + return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_1_step( + a, zeta0, zeta1, zeta2, zeta3); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_2_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta0, + int16_t zeta1) { + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)0U, + (size_t)4U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)1U, + (size_t)5U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)2U, + (size_t)6U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta0, (size_t)3U, + (size_t)7U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)8U, + (size_t)12U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)9U, + (size_t)13U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)10U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta1, (size_t)11U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_inv_ntt_layer_2_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta0, + int16_t zeta1) { + return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_2_step(a, zeta0, + zeta1); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_3_step( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t zeta) { + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)0U, + (size_t)8U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)1U, + (size_t)9U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)2U, + (size_t)10U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)3U, + (size_t)11U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)4U, + (size_t)12U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)5U, + (size_t)13U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)6U, + (size_t)14U); + libcrux_ml_kem_vector_portable_ntt_inv_ntt_step(&v, zeta, (size_t)7U, + (size_t)15U); + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_inv_ntt_layer_3_step_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, int16_t zeta) { + return libcrux_ml_kem_vector_portable_ntt_inv_ntt_layer_3_step(a, zeta); +} + +/** + Compute the product of two Kyber binomials with respect to the + modulus `X² - zeta`. + + This function almost implements Algorithm 11 of the + NIST FIPS 203 standard, which is reproduced below: + + ```plaintext + Input: a₀, a₁, b₀, b₁ ∈ ℤq. + Input: γ ∈ ℤq. + Output: c₀, c₁ ∈ ℤq. + + c₀ ← a₀·b₀ + a₁·b₁·γ + c₁ ← a₀·b₁ + a₁·b₀ + return c₀, c₁ + ``` + We say "almost" because the coefficients output by this function are in + the Montgomery domain (unlike in the specification). + + The NIST FIPS 203 standard can be found at + . +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *a, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *b, int16_t zeta, + size_t i, size_t j, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *out) { + int16_t o0 = libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( + (int32_t)a->elements[i] * (int32_t)b->elements[i] + + (int32_t) + libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( + (int32_t)a->elements[j] * (int32_t)b->elements[j]) * + (int32_t)zeta); + int16_t o1 = + libcrux_ml_kem_vector_portable_arithmetic_montgomery_reduce_element( + (int32_t)a->elements[i] * (int32_t)b->elements[j] + + (int32_t)a->elements[j] * (int32_t)b->elements[i]); + out->elements[i] = o0; + out->elements[j] = o1; +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_ntt_multiply( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs, + int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector out = + libcrux_ml_kem_vector_portable_vector_type_zero(); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, zeta0, (size_t)0U, (size_t)1U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, -zeta0, (size_t)2U, (size_t)3U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, zeta1, (size_t)4U, (size_t)5U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, -zeta1, (size_t)6U, (size_t)7U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, zeta2, (size_t)8U, (size_t)9U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, -zeta2, (size_t)10U, (size_t)11U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, zeta3, (size_t)12U, (size_t)13U, &out); + libcrux_ml_kem_vector_portable_ntt_ntt_multiply_binomials( + lhs, rhs, -zeta3, (size_t)14U, (size_t)15U, &out); + return out; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_ntt_multiply_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *lhs, + libcrux_ml_kem_vector_portable_vector_type_PortableVector *rhs, + int16_t zeta0, int16_t zeta1, int16_t zeta2, int16_t zeta3) { + return libcrux_ml_kem_vector_portable_ntt_ntt_multiply(lhs, rhs, zeta0, zeta1, + zeta2, zeta3); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_1( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[2U]) { + uint8_t result[2U] = {0U}; + for (size_t i = (size_t)0U; i < (size_t)8U; i++) { + size_t i0 = i; + size_t uu____0 = (size_t)0U; + result[uu____0] = (uint32_t)result[uu____0] | + (uint32_t)(uint8_t)v.elements[i0] << (uint32_t)i0; + } + for (size_t i = (size_t)8U; i < (size_t)16U; i++) { + size_t i0 = i; + size_t uu____1 = (size_t)1U; + result[uu____1] = + (uint32_t)result[uu____1] | (uint32_t)(uint8_t)v.elements[i0] + << (uint32_t)(i0 - (size_t)8U); + } + memcpy(ret, result, (size_t)2U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_1_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[2U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_1(a, ret); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_1(Eurydice_slice v) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector result = + libcrux_ml_kem_vector_portable_vector_type_zero(); + for (size_t i = (size_t)0U; i < (size_t)8U; i++) { + size_t i0 = i; + result.elements[i0] = (int16_t)((uint32_t)Eurydice_slice_index( + v, (size_t)0U, uint8_t, uint8_t *) >> + (uint32_t)i0 & + 1U); + } + for (size_t i = (size_t)8U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + result.elements[i0] = (int16_t)((uint32_t)Eurydice_slice_index( + v, (size_t)1U, uint8_t, uint8_t *) >> + (uint32_t)(i0 - (size_t)8U) & + 1U); + } + return result; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_1_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_1(a); +} + +typedef struct uint8_t_x4_s { + uint8_t fst; + uint8_t snd; + uint8_t thd; + uint8_t f3; +} uint8_t_x4; + +static KRML_MUSTINLINE uint8_t_x4 +libcrux_ml_kem_vector_portable_serialize_serialize_4_int(Eurydice_slice v) { + uint8_t result0 = + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) + << 4U | + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)0U, int16_t, + int16_t *); + uint8_t result1 = + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) + << 4U | + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)2U, int16_t, + int16_t *); + uint8_t result2 = + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)5U, int16_t, int16_t *) + << 4U | + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)4U, int16_t, + int16_t *); + uint8_t result3 = + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)7U, int16_t, int16_t *) + << 4U | + (uint32_t)(uint8_t)Eurydice_slice_index(v, (size_t)6U, int16_t, + int16_t *); + return (CLITERAL(uint8_t_x4){ + .fst = result0, .snd = result1, .thd = result2, .f3 = result3}); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_4( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[8U]) { + uint8_t_x4 result0_3 = + libcrux_ml_kem_vector_portable_serialize_serialize_4_int( + Eurydice_array_to_subslice2(v.elements, (size_t)0U, (size_t)8U, + int16_t)); + uint8_t_x4 result4_7 = + libcrux_ml_kem_vector_portable_serialize_serialize_4_int( + Eurydice_array_to_subslice2(v.elements, (size_t)8U, (size_t)16U, + int16_t)); + uint8_t result[8U] = {0U}; + result[0U] = result0_3.fst; + result[1U] = result0_3.snd; + result[2U] = result0_3.thd; + result[3U] = result0_3.f3; + result[4U] = result4_7.fst; + result[5U] = result4_7.snd; + result[6U] = result4_7.thd; + result[7U] = result4_7.f3; + memcpy(ret, result, (size_t)8U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_4_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[8U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_4(a, ret); +} + +static KRML_MUSTINLINE int16_t_x8 +libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( + Eurydice_slice bytes) { + int16_t v0 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)0U, + uint8_t, uint8_t *) & + 15U); + int16_t v1 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)0U, + uint8_t, uint8_t *) >> + 4U & + 15U); + int16_t v2 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)1U, + uint8_t, uint8_t *) & + 15U); + int16_t v3 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)1U, + uint8_t, uint8_t *) >> + 4U & + 15U); + int16_t v4 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)2U, + uint8_t, uint8_t *) & + 15U); + int16_t v5 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)2U, + uint8_t, uint8_t *) >> + 4U & + 15U); + int16_t v6 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)3U, + uint8_t, uint8_t *) & + 15U); + int16_t v7 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)3U, + uint8_t, uint8_t *) >> + 4U & + 15U); + return (CLITERAL(int16_t_x8){.fst = v0, + .snd = v1, + .thd = v2, + .f3 = v3, + .f4 = v4, + .f5 = v5, + .f6 = v6, + .f7 = v7}); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_4(Eurydice_slice bytes) { + int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( + Eurydice_slice_subslice2(bytes, (size_t)0U, (size_t)4U, uint8_t)); + int16_t_x8 v8_15 = libcrux_ml_kem_vector_portable_serialize_deserialize_4_int( + Eurydice_slice_subslice2(bytes, (size_t)4U, (size_t)8U, uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector v = + libcrux_ml_kem_vector_portable_vector_type_zero(); + v.elements[0U] = v0_7.fst; + v.elements[1U] = v0_7.snd; + v.elements[2U] = v0_7.thd; + v.elements[3U] = v0_7.f3; + v.elements[4U] = v0_7.f4; + v.elements[5U] = v0_7.f5; + v.elements[6U] = v0_7.f6; + v.elements[7U] = v0_7.f7; + v.elements[8U] = v8_15.fst; + v.elements[9U] = v8_15.snd; + v.elements[10U] = v8_15.thd; + v.elements[11U] = v8_15.f3; + v.elements[12U] = v8_15.f4; + v.elements[13U] = v8_15.f5; + v.elements[14U] = v8_15.f6; + v.elements[15U] = v8_15.f7; + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_4_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_4(a); +} + +typedef struct uint8_t_x5_s { + uint8_t fst; + uint8_t snd; + uint8_t thd; + uint8_t f3; + uint8_t f4; +} uint8_t_x5; + +static KRML_MUSTINLINE uint8_t_x5 +libcrux_ml_kem_vector_portable_serialize_serialize_5_int(Eurydice_slice v) { + uint8_t r0 = + (uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) | + Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) << 5U); + uint8_t r1 = + (uint8_t)((Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) >> 3U | + Eurydice_slice_index(v, (size_t)2U, int16_t, int16_t *) + << 2U) | + Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) << 7U); + uint8_t r2 = + (uint8_t)(Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) >> 1U | + Eurydice_slice_index(v, (size_t)4U, int16_t, int16_t *) << 4U); + uint8_t r3 = + (uint8_t)((Eurydice_slice_index(v, (size_t)4U, int16_t, int16_t *) >> 4U | + Eurydice_slice_index(v, (size_t)5U, int16_t, int16_t *) + << 1U) | + Eurydice_slice_index(v, (size_t)6U, int16_t, int16_t *) << 6U); + uint8_t r4 = + (uint8_t)(Eurydice_slice_index(v, (size_t)6U, int16_t, int16_t *) >> 2U | + Eurydice_slice_index(v, (size_t)7U, int16_t, int16_t *) << 3U); + return (CLITERAL(uint8_t_x5){ + .fst = r0, .snd = r1, .thd = r2, .f3 = r3, .f4 = r4}); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_5( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[10U]) { + uint8_t_x5 r0_4 = libcrux_ml_kem_vector_portable_serialize_serialize_5_int( + Eurydice_array_to_subslice2(v.elements, (size_t)0U, (size_t)8U, int16_t)); + uint8_t_x5 r5_9 = libcrux_ml_kem_vector_portable_serialize_serialize_5_int( + Eurydice_array_to_subslice2(v.elements, (size_t)8U, (size_t)16U, + int16_t)); + uint8_t result[10U] = {0U}; + result[0U] = r0_4.fst; + result[1U] = r0_4.snd; + result[2U] = r0_4.thd; + result[3U] = r0_4.f3; + result[4U] = r0_4.f4; + result[5U] = r5_9.fst; + result[6U] = r5_9.snd; + result[7U] = r5_9.thd; + result[8U] = r5_9.f3; + result[9U] = r5_9.f4; + memcpy(ret, result, (size_t)10U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_5_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[10U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_5(a, ret); +} + +static KRML_MUSTINLINE int16_t_x8 +libcrux_ml_kem_vector_portable_serialize_deserialize_5_int( + Eurydice_slice bytes) { + int16_t v0 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)0U, + uint8_t, uint8_t *) & + 31U); + int16_t v1 = (int16_t)(((uint32_t)Eurydice_slice_index(bytes, (size_t)1U, + uint8_t, uint8_t *) & + 3U) << 3U | + (uint32_t)Eurydice_slice_index(bytes, (size_t)0U, + uint8_t, uint8_t *) >> + 5U); + int16_t v2 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)1U, + uint8_t, uint8_t *) >> + 2U & + 31U); + int16_t v3 = (int16_t)(((uint32_t)Eurydice_slice_index(bytes, (size_t)2U, + uint8_t, uint8_t *) & + 15U) + << 1U | + (uint32_t)Eurydice_slice_index(bytes, (size_t)1U, + uint8_t, uint8_t *) >> + 7U); + int16_t v4 = (int16_t)(((uint32_t)Eurydice_slice_index(bytes, (size_t)3U, + uint8_t, uint8_t *) & + 1U) << 4U | + (uint32_t)Eurydice_slice_index(bytes, (size_t)2U, + uint8_t, uint8_t *) >> + 4U); + int16_t v5 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)3U, + uint8_t, uint8_t *) >> + 1U & + 31U); + int16_t v6 = (int16_t)(((uint32_t)Eurydice_slice_index(bytes, (size_t)4U, + uint8_t, uint8_t *) & + 7U) << 2U | + (uint32_t)Eurydice_slice_index(bytes, (size_t)3U, + uint8_t, uint8_t *) >> + 6U); + int16_t v7 = (int16_t)((uint32_t)Eurydice_slice_index(bytes, (size_t)4U, + uint8_t, uint8_t *) >> + 3U); + return (CLITERAL(int16_t_x8){.fst = v0, + .snd = v1, + .thd = v2, + .f3 = v3, + .f4 = v4, + .f5 = v5, + .f6 = v6, + .f7 = v7}); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_5(Eurydice_slice bytes) { + int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_5_int( + Eurydice_slice_subslice2(bytes, (size_t)0U, (size_t)5U, uint8_t)); + int16_t_x8 v8_15 = libcrux_ml_kem_vector_portable_serialize_deserialize_5_int( + Eurydice_slice_subslice2(bytes, (size_t)5U, (size_t)10U, uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector v = + libcrux_ml_kem_vector_portable_vector_type_zero(); + v.elements[0U] = v0_7.fst; + v.elements[1U] = v0_7.snd; + v.elements[2U] = v0_7.thd; + v.elements[3U] = v0_7.f3; + v.elements[4U] = v0_7.f4; + v.elements[5U] = v0_7.f5; + v.elements[6U] = v0_7.f6; + v.elements[7U] = v0_7.f7; + v.elements[8U] = v8_15.fst; + v.elements[9U] = v8_15.snd; + v.elements[10U] = v8_15.thd; + v.elements[11U] = v8_15.f3; + v.elements[12U] = v8_15.f4; + v.elements[13U] = v8_15.f5; + v.elements[14U] = v8_15.f6; + v.elements[15U] = v8_15.f7; + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_5_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_5(a); +} + +static KRML_MUSTINLINE uint8_t_x5 +libcrux_ml_kem_vector_portable_serialize_serialize_10_int(Eurydice_slice v) { + uint8_t r0 = + (uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) & + (int16_t)255); + uint8_t r1 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)1U, int16_t, + int16_t *) & + (int16_t)63) + << 2U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, + int16_t *) >> + 8U & + (int16_t)3); + uint8_t r2 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)2U, int16_t, + int16_t *) & + (int16_t)15) + << 4U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)1U, int16_t, + int16_t *) >> + 6U & + (int16_t)15); + uint8_t r3 = (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)3U, int16_t, + int16_t *) & + (int16_t)3) + << 6U | + (uint32_t)(uint8_t)(Eurydice_slice_index(v, (size_t)2U, int16_t, + int16_t *) >> + 4U & + (int16_t)63); + uint8_t r4 = + (uint8_t)(Eurydice_slice_index(v, (size_t)3U, int16_t, int16_t *) >> 2U & + (int16_t)255); + return (CLITERAL(uint8_t_x5){ + .fst = r0, .snd = r1, .thd = r2, .f3 = r3, .f4 = r4}); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_10( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[20U]) { + uint8_t_x5 r0_4 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( + Eurydice_array_to_subslice2(v.elements, (size_t)0U, (size_t)4U, int16_t)); + uint8_t_x5 r5_9 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( + Eurydice_array_to_subslice2(v.elements, (size_t)4U, (size_t)8U, int16_t)); + uint8_t_x5 r10_14 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( + Eurydice_array_to_subslice2(v.elements, (size_t)8U, (size_t)12U, + int16_t)); + uint8_t_x5 r15_19 = libcrux_ml_kem_vector_portable_serialize_serialize_10_int( + Eurydice_array_to_subslice2(v.elements, (size_t)12U, (size_t)16U, + int16_t)); + uint8_t result[20U] = {0U}; + result[0U] = r0_4.fst; + result[1U] = r0_4.snd; + result[2U] = r0_4.thd; + result[3U] = r0_4.f3; + result[4U] = r0_4.f4; + result[5U] = r5_9.fst; + result[6U] = r5_9.snd; + result[7U] = r5_9.thd; + result[8U] = r5_9.f3; + result[9U] = r5_9.f4; + result[10U] = r10_14.fst; + result[11U] = r10_14.snd; + result[12U] = r10_14.thd; + result[13U] = r10_14.f3; + result[14U] = r10_14.f4; + result[15U] = r15_19.fst; + result[16U] = r15_19.snd; + result[17U] = r15_19.thd; + result[18U] = r15_19.f3; + result[19U] = r15_19.f4; + memcpy(ret, result, (size_t)20U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_10_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[20U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_10(a, ret); +} + +static KRML_MUSTINLINE int16_t_x8 +libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( + Eurydice_slice bytes) { + int16_t r0 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) & + (int16_t)3) + << 8U | + ((int16_t)Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *) & + (int16_t)255); + int16_t r1 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) & + (int16_t)15) + << 6U | + (int16_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *) >> + 2U; + int16_t r2 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *) & + (int16_t)63) + << 4U | + (int16_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *) >> + 4U; + int16_t r3 = + (int16_t)Eurydice_slice_index(bytes, (size_t)4U, uint8_t, uint8_t *) + << 2U | + (int16_t)Eurydice_slice_index(bytes, (size_t)3U, uint8_t, uint8_t *) >> + 6U; + int16_t r4 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *) & + (int16_t)3) + << 8U | + ((int16_t)Eurydice_slice_index(bytes, (size_t)5U, uint8_t, uint8_t *) & + (int16_t)255); + int16_t r5 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)7U, uint8_t, uint8_t *) & + (int16_t)15) + << 6U | + (int16_t)Eurydice_slice_index(bytes, (size_t)6U, uint8_t, uint8_t *) >> + 2U; + int16_t r6 = + ((int16_t)Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *) & + (int16_t)63) + << 4U | + (int16_t)Eurydice_slice_index(bytes, (size_t)7U, uint8_t, uint8_t *) >> + 4U; + int16_t r7 = + (int16_t)Eurydice_slice_index(bytes, (size_t)9U, uint8_t, uint8_t *) + << 2U | + (int16_t)Eurydice_slice_index(bytes, (size_t)8U, uint8_t, uint8_t *) >> + 6U; + return (CLITERAL(int16_t_x8){.fst = r0, + .snd = r1, + .thd = r2, + .f3 = r3, + .f4 = r4, + .f5 = r5, + .f6 = r6, + .f7 = r7}); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_10(Eurydice_slice bytes) { + int16_t_x8 v0_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( + Eurydice_slice_subslice2(bytes, (size_t)0U, (size_t)10U, uint8_t)); + int16_t_x8 v8_15 = + libcrux_ml_kem_vector_portable_serialize_deserialize_10_int( + Eurydice_slice_subslice2(bytes, (size_t)10U, (size_t)20U, uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector v = + libcrux_ml_kem_vector_portable_vector_type_zero(); + v.elements[0U] = v0_7.fst; + v.elements[1U] = v0_7.snd; + v.elements[2U] = v0_7.thd; + v.elements[3U] = v0_7.f3; + v.elements[4U] = v0_7.f4; + v.elements[5U] = v0_7.f5; + v.elements[6U] = v0_7.f6; + v.elements[7U] = v0_7.f7; + v.elements[8U] = v8_15.fst; + v.elements[9U] = v8_15.snd; + v.elements[10U] = v8_15.thd; + v.elements[11U] = v8_15.f3; + v.elements[12U] = v8_15.f4; + v.elements[13U] = v8_15.f5; + v.elements[14U] = v8_15.f6; + v.elements[15U] = v8_15.f7; + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_10_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_10(a); +} + +typedef struct uint8_t_x3_s { + uint8_t fst; + uint8_t snd; + uint8_t thd; +} uint8_t_x3; + +static KRML_MUSTINLINE uint8_t_x3 +libcrux_ml_kem_vector_portable_serialize_serialize_12_int(Eurydice_slice v) { + uint8_t r0 = + (uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) & + (int16_t)255); + uint8_t r1 = + (uint8_t)(Eurydice_slice_index(v, (size_t)0U, int16_t, int16_t *) >> 8U | + (Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) & + (int16_t)15) + << 4U); + uint8_t r2 = + (uint8_t)(Eurydice_slice_index(v, (size_t)1U, int16_t, int16_t *) >> 4U & + (int16_t)255); + return (CLITERAL(uint8_t_x3){.fst = r0, .snd = r1, .thd = r2}); +} + +static KRML_MUSTINLINE void +libcrux_ml_kem_vector_portable_serialize_serialize_12( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, + uint8_t ret[24U]) { + uint8_t_x3 r0_2 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)0U, (size_t)2U, int16_t)); + uint8_t_x3 r3_5 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)2U, (size_t)4U, int16_t)); + uint8_t_x3 r6_8 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)4U, (size_t)6U, int16_t)); + uint8_t_x3 r9_11 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)6U, (size_t)8U, int16_t)); + uint8_t_x3 r12_14 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)8U, (size_t)10U, + int16_t)); + uint8_t_x3 r15_17 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)10U, (size_t)12U, + int16_t)); + uint8_t_x3 r18_20 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)12U, (size_t)14U, + int16_t)); + uint8_t_x3 r21_23 = libcrux_ml_kem_vector_portable_serialize_serialize_12_int( + Eurydice_array_to_subslice2(v.elements, (size_t)14U, (size_t)16U, + int16_t)); + uint8_t result[24U] = {0U}; + result[0U] = r0_2.fst; + result[1U] = r0_2.snd; + result[2U] = r0_2.thd; + result[3U] = r3_5.fst; + result[4U] = r3_5.snd; + result[5U] = r3_5.thd; + result[6U] = r6_8.fst; + result[7U] = r6_8.snd; + result[8U] = r6_8.thd; + result[9U] = r9_11.fst; + result[10U] = r9_11.snd; + result[11U] = r9_11.thd; + result[12U] = r12_14.fst; + result[13U] = r12_14.snd; + result[14U] = r12_14.thd; + result[15U] = r15_17.fst; + result[16U] = r15_17.snd; + result[17U] = r15_17.thd; + result[18U] = r18_20.fst; + result[19U] = r18_20.snd; + result[20U] = r18_20.thd; + result[21U] = r21_23.fst; + result[22U] = r21_23.snd; + result[23U] = r21_23.thd; + memcpy(ret, result, (size_t)24U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline void libcrux_ml_kem_vector_portable_serialize_12_0d( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + uint8_t ret[24U]) { + libcrux_ml_kem_vector_portable_serialize_serialize_12(a, ret); +} + +typedef struct int16_t_x2_s { + int16_t fst; + int16_t snd; +} int16_t_x2; + +static KRML_MUSTINLINE int16_t_x2 +libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice bytes) { + int16_t byte0 = + (int16_t)Eurydice_slice_index(bytes, (size_t)0U, uint8_t, uint8_t *); + int16_t byte1 = + (int16_t)Eurydice_slice_index(bytes, (size_t)1U, uint8_t, uint8_t *); + int16_t byte2 = + (int16_t)Eurydice_slice_index(bytes, (size_t)2U, uint8_t, uint8_t *); + int16_t r0 = (byte1 & (int16_t)15) << 8U | (byte0 & (int16_t)255); + int16_t r1 = byte2 << 4U | (byte1 >> 4U & (int16_t)15); + return (CLITERAL(int16_t_x2){.fst = r0, .snd = r1}); +} + +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_serialize_deserialize_12(Eurydice_slice bytes) { + int16_t_x2 v0_1 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)0U, (size_t)3U, uint8_t)); + int16_t_x2 v2_3 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)3U, (size_t)6U, uint8_t)); + int16_t_x2 v4_5 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)6U, (size_t)9U, uint8_t)); + int16_t_x2 v6_7 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)9U, (size_t)12U, uint8_t)); + int16_t_x2 v8_9 = libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)12U, (size_t)15U, uint8_t)); + int16_t_x2 v10_11 = + libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)15U, (size_t)18U, uint8_t)); + int16_t_x2 v12_13 = + libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)18U, (size_t)21U, uint8_t)); + int16_t_x2 v14_15 = + libcrux_ml_kem_vector_portable_serialize_deserialize_12_int( + Eurydice_slice_subslice2(bytes, (size_t)21U, (size_t)24U, uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector re = + libcrux_ml_kem_vector_portable_vector_type_zero(); + re.elements[0U] = v0_1.fst; + re.elements[1U] = v0_1.snd; + re.elements[2U] = v2_3.fst; + re.elements[3U] = v2_3.snd; + re.elements[4U] = v4_5.fst; + re.elements[5U] = v4_5.snd; + re.elements[6U] = v6_7.fst; + re.elements[7U] = v6_7.snd; + re.elements[8U] = v8_9.fst; + re.elements[9U] = v8_9.snd; + re.elements[10U] = v10_11.fst; + re.elements[11U] = v10_11.snd; + re.elements[12U] = v12_13.fst; + re.elements[13U] = v12_13.snd; + re.elements[14U] = v14_15.fst; + re.elements[15U] = v14_15.snd; + return re; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_deserialize_12_0d(Eurydice_slice a) { + return libcrux_ml_kem_vector_portable_serialize_deserialize_12(a); +} + +static KRML_MUSTINLINE size_t +libcrux_ml_kem_vector_portable_sampling_rej_sample(Eurydice_slice a, + Eurydice_slice result) { + size_t sampled = (size_t)0U; + for (size_t i = (size_t)0U; i < Eurydice_slice_len(a, uint8_t) / (size_t)3U; + i++) { + size_t i0 = i; + int16_t b1 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)0U, + uint8_t, uint8_t *); + int16_t b2 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)1U, + uint8_t, uint8_t *); + int16_t b3 = (int16_t)Eurydice_slice_index(a, i0 * (size_t)3U + (size_t)2U, + uint8_t, uint8_t *); + int16_t d1 = (b2 & (int16_t)15) << 8U | b1; + int16_t d2 = b3 << 4U | b2 >> 4U; + bool uu____0; + int16_t uu____1; + bool uu____2; + size_t uu____3; + int16_t uu____4; + size_t uu____5; + int16_t uu____6; + if (d1 < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS) { + if (sampled < (size_t)16U) { + Eurydice_slice_index(result, sampled, int16_t, int16_t *) = d1; + sampled++; + uu____1 = d2; + uu____6 = LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + uu____0 = uu____1 < uu____6; + if (uu____0) { + uu____3 = sampled; + uu____2 = uu____3 < (size_t)16U; + if (uu____2) { + uu____4 = d2; + uu____5 = sampled; + Eurydice_slice_index(result, uu____5, int16_t, int16_t *) = uu____4; + sampled++; + continue; + } + } + continue; + } + } + uu____1 = d2; + uu____6 = LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + uu____0 = uu____1 < uu____6; + if (uu____0) { + uu____3 = sampled; + uu____2 = uu____3 < (size_t)16U; + if (uu____2) { + uu____4 = d2; + uu____5 = sampled; + Eurydice_slice_index(result, uu____5, int16_t, int16_t *) = uu____4; + sampled++; + continue; + } + } + } + return sampled; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline size_t libcrux_ml_kem_vector_portable_rej_sample_0d( + Eurydice_slice a, Eurydice_slice out) { + return libcrux_ml_kem_vector_portable_sampling_rej_sample(a, out); +} + +#define LIBCRUX_ML_KEM_MLKEM768_VECTOR_U_COMPRESSION_FACTOR_768 ((size_t)10U) + +#define LIBCRUX_ML_KEM_MLKEM768_C1_BLOCK_SIZE_768 \ + (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ + LIBCRUX_ML_KEM_MLKEM768_VECTOR_U_COMPRESSION_FACTOR_768 / (size_t)8U) + +#define LIBCRUX_ML_KEM_MLKEM768_RANK_768 ((size_t)3U) + +#define LIBCRUX_ML_KEM_MLKEM768_C1_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_C1_BLOCK_SIZE_768 * LIBCRUX_ML_KEM_MLKEM768_RANK_768) + +#define LIBCRUX_ML_KEM_MLKEM768_VECTOR_V_COMPRESSION_FACTOR_768 ((size_t)4U) + +#define LIBCRUX_ML_KEM_MLKEM768_C2_SIZE_768 \ + (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ + LIBCRUX_ML_KEM_MLKEM768_VECTOR_V_COMPRESSION_FACTOR_768 / (size_t)8U) + +#define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_CIPHERTEXT_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_C1_SIZE_768 + LIBCRUX_ML_KEM_MLKEM768_C2_SIZE_768) + +#define LIBCRUX_ML_KEM_MLKEM768_T_AS_NTT_ENCODED_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_RANK_768 * \ + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ + LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT / (size_t)8U) + +#define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_PUBLIC_KEY_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_T_AS_NTT_ENCODED_SIZE_768 + (size_t)32U) + +#define LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_SECRET_KEY_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_RANK_768 * \ + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * \ + LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_COEFFICIENT / (size_t)8U) + +#define LIBCRUX_ML_KEM_MLKEM768_ETA1 ((size_t)2U) + +#define LIBCRUX_ML_KEM_MLKEM768_ETA1_RANDOMNESS_SIZE \ + (LIBCRUX_ML_KEM_MLKEM768_ETA1 * (size_t)64U) + +#define LIBCRUX_ML_KEM_MLKEM768_ETA2 ((size_t)2U) + +#define LIBCRUX_ML_KEM_MLKEM768_ETA2_RANDOMNESS_SIZE \ + (LIBCRUX_ML_KEM_MLKEM768_ETA2 * (size_t)64U) + +#define LIBCRUX_ML_KEM_MLKEM768_IMPLICIT_REJECTION_HASH_INPUT_SIZE \ + (LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE + \ + LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_CIPHERTEXT_SIZE_768) + +typedef libcrux_ml_kem_types_MlKemPrivateKey_55 + libcrux_ml_kem_mlkem768_MlKem768PrivateKey; + +typedef libcrux_ml_kem_types_MlKemPublicKey_15 + libcrux_ml_kem_mlkem768_MlKem768PublicKey; + +#define LIBCRUX_ML_KEM_MLKEM768_RANKED_BYTES_PER_RING_ELEMENT_768 \ + (LIBCRUX_ML_KEM_MLKEM768_RANK_768 * \ + LIBCRUX_ML_KEM_CONSTANTS_BITS_PER_RING_ELEMENT / (size_t)8U) + +#define LIBCRUX_ML_KEM_MLKEM768_SECRET_KEY_SIZE_768 \ + (LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_SECRET_KEY_SIZE_768 + \ + LIBCRUX_ML_KEM_MLKEM768_CPA_PKE_PUBLIC_KEY_SIZE_768 + \ + LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE + \ + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE) + +/** +A monomorphic instance of libcrux_ml_kem.polynomial.PolynomialRingElement +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector + +*/ +typedef struct libcrux_ml_kem_polynomial_PolynomialRingElement_f0_s { + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficients[16U]; +} libcrux_ml_kem_polynomial_PolynomialRingElement_f0; + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.ZERO_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_polynomial_ZERO_89_ea(void) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 lit; + lit.coefficients[0U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[1U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[2U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[3U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[4U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[5U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[6U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[7U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[8U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[9U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[10U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[11U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[12U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[13U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[14U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + lit.coefficients[15U] = libcrux_ml_kem_vector_portable_ZERO_0d(); + return lit; +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.deserialize_secret_key.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_ind_cpa_deserialize_secret_key_closure_6b(size_t _) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_to_uncompressed_ring_element with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_to_uncompressed_ring_element_af( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)24U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)24U, i0 * (size_t)24U + (size_t)24U, uint8_t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_deserialize_12_0d(bytes); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** + Call [`deserialize_to_uncompressed_ring_element`] for each ring element. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.deserialize_secret_key +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_deserialize_secret_key_24( + Eurydice_slice secret_key, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 secret_as_ntt[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + secret_as_ntt[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(secret_key, uint8_t) / + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT; + i++) { + size_t i0 = i; + Eurydice_slice secret_bytes = Eurydice_slice_subslice2( + secret_key, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT + + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + uint8_t); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____0 = + libcrux_ml_kem_serialize_deserialize_to_uncompressed_ring_element_af( + secret_bytes); + secret_as_ntt[i0] = uu____0; + } + memcpy( + ret, secret_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.ind_cpa.unpacked.IndCpaPrivateKeyUnpacked with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- $3size_t +*/ +typedef struct libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_f8_s { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 secret_as_ntt[3U]; +} libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_f8; + +/** +A monomorphic instance of +libcrux_ml_kem.ind_cpa.deserialize_then_decompress_u.closure with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- U_COMPRESSION_FACTOR= 10 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_closure_7c(size_t _) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with +const generics +- COEFFICIENT_BITS= 10 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int32_t decompressed = (int32_t)v.elements[i0] * + (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)10); + decompressed = decompressed >> (uint32_t)((int32_t)10 + (int32_t)1); + v.elements[i0] = (int16_t)decompressed; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_0d with const +generics +- COEFFICIENT_BITS= 10 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b( + v); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_then_decompress_10 with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_10_2c( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)20U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)20U, i0 * (size_t)20U + (size_t)20U, uint8_t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_deserialize_10_0d(bytes); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a( + coefficient); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with +const generics +- COEFFICIENT_BITS= 11 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b0( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int32_t decompressed = (int32_t)v.elements[i0] * + (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)11); + decompressed = decompressed >> (uint32_t)((int32_t)11 + (int32_t)1); + v.elements[i0] = (int16_t)decompressed; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_0d with const +generics +- COEFFICIENT_BITS= 11 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a0( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b0( + v); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_then_decompress_11 with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_11_8d( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)22U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)22U, i0 * (size_t)22U + (size_t)22U, uint8_t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_deserialize_11_0d(bytes); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a0( + coefficient); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_then_decompress_ring_element_u with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- COMPRESSION_FACTOR= 10 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_u_34( + Eurydice_slice serialized) { + return libcrux_ml_kem_serialize_deserialize_then_decompress_10_2c(serialized); +} + +typedef struct libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2_s { + libcrux_ml_kem_vector_portable_vector_type_PortableVector fst; + libcrux_ml_kem_vector_portable_vector_type_PortableVector snd; +} libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2; + +/** +A monomorphic instance of libcrux_ml_kem.vector.traits.montgomery_multiply_fe +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_traits_montgomery_multiply_fe_67( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v, int16_t fer) { + return libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d(v, + fer); +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_layer_int_vec_step +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE + libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 + libcrux_ml_kem_ntt_ntt_layer_int_vec_step_0c( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + libcrux_ml_kem_vector_portable_vector_type_PortableVector b, + int16_t zeta_r) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector t = + libcrux_ml_kem_vector_traits_montgomery_multiply_fe_67(b, zeta_r); + b = libcrux_ml_kem_vector_portable_sub_0d(a, &t); + a = libcrux_ml_kem_vector_portable_add_0d(a, &t); + return ( + CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2){ + .fst = a, .snd = b}); +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_4_plus +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t layer, size_t _initial_coefficient_bound) { + size_t step = (size_t)1U << (uint32_t)layer; + for (size_t i0 = (size_t)0U; i0 < (size_t)128U >> (uint32_t)layer; i0++) { + size_t round = i0; + zeta_i[0U] = zeta_i[0U] + (size_t)1U; + size_t offset = round * step * (size_t)2U; + size_t offset_vec = offset / (size_t)16U; + size_t step_vec = step / (size_t)16U; + for (size_t i = offset_vec; i < offset_vec + step_vec; i++) { + size_t j = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 uu____0 = + libcrux_ml_kem_ntt_ntt_layer_int_vec_step_0c( + re->coefficients[j], re->coefficients[j + step_vec], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]]); + libcrux_ml_kem_vector_portable_vector_type_PortableVector x = uu____0.fst; + libcrux_ml_kem_vector_portable_vector_type_PortableVector y = uu____0.snd; + re->coefficients[j] = x; + re->coefficients[j + step_vec] = y; + } + } +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_3 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_3_fd( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer, size_t _initial_coefficient_bound) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] + (size_t)1U; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_ntt_layer_3_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]]); + re->coefficients[round] = uu____0; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_2 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_2_ad( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer, size_t _initial_coefficient_bound) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] + (size_t)1U; + re->coefficients[round] = + libcrux_ml_kem_vector_portable_ntt_layer_2_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] + + (size_t)1U]); + zeta_i[0U] = zeta_i[0U] + (size_t)1U; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_1 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_1_a2( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer, size_t _initial_coefficient_bound) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] + (size_t)1U; + re->coefficients[round] = + libcrux_ml_kem_vector_portable_ntt_layer_1_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] + + (size_t)1U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] + + (size_t)2U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] + + (size_t)3U]); + zeta_i[0U] = zeta_i[0U] + (size_t)3U; + } +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.poly_barrett_reduce_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_poly_barrett_reduce_89_8b( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_barrett_reduce_0d( + self->coefficients[i0]); + self->coefficients[i0] = uu____0; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_vector_u +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- VECTOR_U_COMPRESSION_FACTOR= 10 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_vector_u_9f( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re) { + size_t zeta_i = (size_t)0U; + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)7U, + (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)6U, + (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)5U, + (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)4U, + (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_3_fd(&zeta_i, re, (size_t)3U, (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_2_ad(&zeta_i, re, (size_t)2U, (size_t)3328U); + libcrux_ml_kem_ntt_ntt_at_layer_1_a2(&zeta_i, re, (size_t)1U, (size_t)3328U); + libcrux_ml_kem_polynomial_poly_barrett_reduce_89_8b(re); +} + +/** + Call [`deserialize_then_decompress_ring_element_u`] on each ring element + in the `ciphertext`. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.deserialize_then_decompress_u +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- U_COMPRESSION_FACTOR= 10 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_f4( + uint8_t *ciphertext, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 u_as_ntt[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + u_as_ntt[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice((size_t)1088U, ciphertext, uint8_t), + uint8_t) / + (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * + (size_t)10U / (size_t)8U); + i++) { + size_t i0 = i; + Eurydice_slice u_bytes = Eurydice_array_to_subslice2( + ciphertext, + i0 * (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * + (size_t)10U / (size_t)8U), + i0 * (LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * + (size_t)10U / (size_t)8U) + + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT * + (size_t)10U / (size_t)8U, + uint8_t); + u_as_ntt[i0] = + libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_u_34( + u_bytes); + libcrux_ml_kem_ntt_ntt_vector_u_9f(&u_as_ntt[i0]); + } + memcpy( + ret, u_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with +const generics +- COEFFICIENT_BITS= 4 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b1( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int32_t decompressed = (int32_t)v.elements[i0] * + (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)4); + decompressed = decompressed >> (uint32_t)((int32_t)4 + (int32_t)1); + v.elements[i0] = (int16_t)decompressed; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_0d with const +generics +- COEFFICIENT_BITS= 4 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a1( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b1( + v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.deserialize_then_decompress_4 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_4_41( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)8U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)8U, i0 * (size_t)8U + (size_t)8U, uint8_t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_deserialize_4_0d(bytes); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a1( + coefficient); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.compress.decompress_ciphertext_coefficient with +const generics +- COEFFICIENT_BITS= 5 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b2( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int32_t decompressed = (int32_t)v.elements[i0] * + (int32_t)LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS; + decompressed = (decompressed << 1U) + ((int32_t)1 << (uint32_t)(int32_t)5); + decompressed = decompressed >> (uint32_t)((int32_t)5 + (int32_t)1); + v.elements[i0] = (int16_t)decompressed; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.vector.portable.decompress_ciphertext_coefficient_0d with const +generics +- COEFFICIENT_BITS= 5 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a2( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_decompress_ciphertext_coefficient_6b2( + v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.deserialize_then_decompress_5 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_5_4e( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)10U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)10U, i0 * (size_t)10U + (size_t)10U, uint8_t); + re.coefficients[i0] = + libcrux_ml_kem_vector_portable_deserialize_5_0d(bytes); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____1 = + libcrux_ml_kem_vector_portable_decompress_ciphertext_coefficient_0d_5a2( + re.coefficients[i0]); + re.coefficients[i0] = uu____1; + } + return re; +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_then_decompress_ring_element_v with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- COMPRESSION_FACTOR= 4 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_v_56( + Eurydice_slice serialized) { + return libcrux_ml_kem_serialize_deserialize_then_decompress_4_41(serialized); +} + +/** + Given two `KyberPolynomialRingElement`s in their NTT representations, + compute their product. Given two polynomials in the NTT domain `f^` and `ĵ`, + the `iᵗʰ` coefficient of the product `k̂` is determined by the calculation: + + ```plaintext + ĥ[2·i] + ĥ[2·i + 1]X = (f^[2·i] + f^[2·i + 1]X)·(ĝ[2·i] + ĝ[2·i + 1]X) mod (X² + - ζ^(2·BitRev₇(i) + 1)) + ``` + + This function almost implements Algorithm 10 of the + NIST FIPS 203 standard, which is reproduced below: + + ```plaintext + Input: Two arrays fˆ ∈ ℤ₂₅₆ and ĝ ∈ ℤ₂₅₆. + Output: An array ĥ ∈ ℤq. + + for(i ← 0; i < 128; i++) + (ĥ[2i], ĥ[2i+1]) ← BaseCaseMultiply(fˆ[2i], fˆ[2i+1], ĝ[2i], ĝ[2i+1], + ζ^(2·BitRev₇(i) + 1)) end for return ĥ + ``` + We say "almost" because the coefficients of the ring element output by + this function are in the Montgomery domain. + + The NIST FIPS 203 standard can be found at + . +*/ +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.ntt_multiply_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_polynomial_ntt_multiply_89_2a( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *rhs) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 out = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_ntt_multiply_0d( + &self->coefficients[i0], &rhs->coefficients[i0], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[(size_t)64U + + (size_t)4U * i0], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[(size_t)64U + + (size_t)4U * i0 + + (size_t)1U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[(size_t)64U + + (size_t)4U * i0 + + (size_t)2U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[(size_t)64U + + (size_t)4U * i0 + + (size_t)3U]); + out.coefficients[i0] = uu____0; + } + return out; +} + +/** + Given two polynomial ring elements `lhs` and `rhs`, compute the pointwise + sum of their constituent coefficients. +*/ +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.add_to_ring_element_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_to_ring_element_89_84( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *rhs) { + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)16U, self->coefficients, + libcrux_ml_kem_vector_portable_vector_type_PortableVector), + libcrux_ml_kem_vector_portable_vector_type_PortableVector); + i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_add_0d(self->coefficients[i0], + &rhs->coefficients[i0]); + self->coefficients[i0] = uu____0; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_1 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_1_83( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] - (size_t)1U; + re->coefficients[round] = + libcrux_ml_kem_vector_portable_inv_ntt_layer_1_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] - + (size_t)1U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] - + (size_t)2U], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] - + (size_t)3U]); + zeta_i[0U] = zeta_i[0U] - (size_t)3U; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_2 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_2_c3( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] - (size_t)1U; + re->coefficients[round] = + libcrux_ml_kem_vector_portable_inv_ntt_layer_2_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U] - + (size_t)1U]); + zeta_i[0U] = zeta_i[0U] - (size_t)1U; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_3 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_3_68( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t _layer) { + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t round = i; + zeta_i[0U] = zeta_i[0U] - (size_t)1U; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_inv_ntt_layer_3_step_0d( + re->coefficients[round], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]]); + re->coefficients[round] = uu____0; + } +} + +/** +A monomorphic instance of +libcrux_ml_kem.invert_ntt.inv_ntt_layer_int_vec_step_reduce with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE + libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 + libcrux_ml_kem_invert_ntt_inv_ntt_layer_int_vec_step_reduce_65( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a, + libcrux_ml_kem_vector_portable_vector_type_PortableVector b, + int16_t zeta_r) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector a_minus_b = + libcrux_ml_kem_vector_portable_sub_0d(b, &a); + a = libcrux_ml_kem_vector_portable_barrett_reduce_0d( + libcrux_ml_kem_vector_portable_add_0d(a, &b)); + b = libcrux_ml_kem_vector_traits_montgomery_multiply_fe_67(a_minus_b, zeta_r); + return ( + CLITERAL(libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2){ + .fst = a, .snd = b}); +} + +/** +A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_at_layer_4_plus +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_6e( + size_t *zeta_i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, + size_t layer) { + size_t step = (size_t)1U << (uint32_t)layer; + for (size_t i0 = (size_t)0U; i0 < (size_t)128U >> (uint32_t)layer; i0++) { + size_t round = i0; + zeta_i[0U] = zeta_i[0U] - (size_t)1U; + size_t offset = round * step * (size_t)2U; + size_t offset_vec = + offset / LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; + size_t step_vec = + step / LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; + for (size_t i = offset_vec; i < offset_vec + step_vec; i++) { + size_t j = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector_x2 uu____0 = + libcrux_ml_kem_invert_ntt_inv_ntt_layer_int_vec_step_reduce_65( + re->coefficients[j], re->coefficients[j + step_vec], + libcrux_ml_kem_polynomial_ZETAS_TIMES_MONTGOMERY_R[zeta_i[0U]]); + libcrux_ml_kem_vector_portable_vector_type_PortableVector x = uu____0.fst; + libcrux_ml_kem_vector_portable_vector_type_PortableVector y = uu____0.snd; + re->coefficients[j] = x; + re->coefficients[j + step_vec] = y; + } + } +} + +/** +A monomorphic instance of libcrux_ml_kem.invert_ntt.invert_ntt_montgomery +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_f6( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re) { + size_t zeta_i = + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT / (size_t)2U; + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_1_83(&zeta_i, re, (size_t)1U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_2_c3(&zeta_i, re, (size_t)2U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_3_68(&zeta_i, re, (size_t)3U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_6e(&zeta_i, re, + (size_t)4U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_6e(&zeta_i, re, + (size_t)5U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_6e(&zeta_i, re, + (size_t)6U); + libcrux_ml_kem_invert_ntt_invert_ntt_at_layer_4_plus_6e(&zeta_i, re, + (size_t)7U); + libcrux_ml_kem_polynomial_poly_barrett_reduce_89_8b(re); +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.subtract_reduce_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_polynomial_subtract_reduce_89_d4( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 b) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_normal_form = + libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d( + b.coefficients[i0], (int16_t)1441); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_barrett_reduce_0d( + libcrux_ml_kem_vector_portable_sub_0d(self->coefficients[i0], + &coefficient_normal_form)); + b.coefficients[i0] = uu____0; + } + return b; +} + +/** + The following functions compute various expressions involving + vectors and matrices. The computation of these expressions has been + abstracted away into these functions in order to save on loop iterations. + Compute v − InverseNTT(sᵀ ◦ NTT(u)) +*/ +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_message +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_matrix_compute_message_b3( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *v, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *secret_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *u_as_ntt) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 product = + libcrux_ml_kem_polynomial_ntt_multiply_89_2a(&secret_as_ntt[i0], + &u_as_ntt[i0]); + libcrux_ml_kem_polynomial_add_to_ring_element_89_84(&result, &product); + } + libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_f6(&result); + result = libcrux_ml_kem_polynomial_subtract_reduce_89_d4(v, result); + return result; +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.arithmetic.shift_right +with const generics +- SHIFT_BY= 15 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_arithmetic_shift_right_94( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + v.elements[i0] = v.elements[i0] >> (uint32_t)(int32_t)15; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.shift_right_0d +with const generics +- SHIFT_BY= 15 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_shift_right_0d_19( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_arithmetic_shift_right_94(v); +} + +/** +A monomorphic instance of +libcrux_ml_kem.vector.traits.to_unsigned_representative with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + libcrux_ml_kem_vector_portable_vector_type_PortableVector a) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector t = + libcrux_ml_kem_vector_portable_shift_right_0d_19(a); + libcrux_ml_kem_vector_portable_vector_type_PortableVector fm = + libcrux_ml_kem_vector_portable_bitwise_and_with_constant_0d( + t, LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_MODULUS); + return libcrux_ml_kem_vector_portable_add_0d(a, &fm); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.compress_then_serialize_message with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_message_aa( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re, uint8_t ret[32U]) { + uint8_t serialized[32U] = {0U}; + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re.coefficients[i0]); + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_compressed = + libcrux_ml_kem_vector_portable_compress_1_0d(coefficient); + uint8_t bytes[2U]; + libcrux_ml_kem_vector_portable_serialize_1_0d(coefficient_compressed, + bytes); + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + serialized, (size_t)2U * i0, (size_t)2U * i0 + (size_t)2U, uint8_t); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)2U, bytes, uint8_t), uint8_t); + } + memcpy(ret, serialized, (size_t)32U * sizeof(uint8_t)); +} + +/** + This function implements Algorithm 14 of the + NIST FIPS 203 specification; this is the Kyber CPA-PKE decryption algorithm. + + Algorithm 14 is reproduced below: + + ```plaintext + Input: decryption key dkₚₖₑ ∈ 𝔹^{384k}. + Input: ciphertext c ∈ 𝔹^{32(dᵤk + dᵥ)}. + Output: message m ∈ 𝔹^{32}. + + c₁ ← c[0 : 32dᵤk] + c₂ ← c[32dᵤk : 32(dᵤk + dᵥ)] + u ← Decompress_{dᵤ}(ByteDecode_{dᵤ}(c₁)) + v ← Decompress_{dᵥ}(ByteDecode_{dᵥ}(c₂)) + ŝ ← ByteDecode₁₂(dkₚₖₑ) + w ← v - NTT-¹(ŝᵀ ◦ NTT(u)) + m ← ByteEncode₁(Compress₁(w)) + return m + ``` + + The NIST FIPS 203 standard can be found at + . +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.decrypt_unpacked +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- VECTOR_U_ENCODED_SIZE= 960 +- U_COMPRESSION_FACTOR= 10 +- V_COMPRESSION_FACTOR= 4 +*/ +static inline void libcrux_ml_kem_ind_cpa_decrypt_unpacked_6d( + libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_f8 *secret_key, + uint8_t *ciphertext, uint8_t ret[32U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 u_as_ntt[3U]; + libcrux_ml_kem_ind_cpa_deserialize_then_decompress_u_f4(ciphertext, u_as_ntt); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 v = + libcrux_ml_kem_serialize_deserialize_then_decompress_ring_element_v_56( + Eurydice_array_to_subslice_from((size_t)1088U, ciphertext, + (size_t)960U, uint8_t, size_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 message = + libcrux_ml_kem_matrix_compute_message_b3(&v, secret_key->secret_as_ntt, + u_as_ntt); + uint8_t ret0[32U]; + libcrux_ml_kem_serialize_compress_then_serialize_message_aa(message, ret0); + memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.decrypt +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- VECTOR_U_ENCODED_SIZE= 960 +- U_COMPRESSION_FACTOR= 10 +- V_COMPRESSION_FACTOR= 4 +*/ +static inline void libcrux_ml_kem_ind_cpa_decrypt_43(Eurydice_slice secret_key, + uint8_t *ciphertext, + uint8_t ret[32U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 secret_as_ntt[3U]; + libcrux_ml_kem_ind_cpa_deserialize_secret_key_24(secret_key, secret_as_ntt); + /* Passing arrays by value in Rust generates a copy in C */ + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 copy_of_secret_as_ntt[3U]; + memcpy( + copy_of_secret_as_ntt, secret_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + libcrux_ml_kem_ind_cpa_unpacked_IndCpaPrivateKeyUnpacked_f8 + secret_key_unpacked; + memcpy( + secret_key_unpacked.secret_as_ntt, copy_of_secret_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + uint8_t ret0[32U]; + libcrux_ml_kem_ind_cpa_decrypt_unpacked_6d(&secret_key_unpacked, ciphertext, + ret0); + memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.G_f1 +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_slice input, uint8_t ret[64U]) { + libcrux_ml_kem_hash_functions_portable_G(input, ret); +} + +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF +with const generics +- LEN= 32 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRF_2b( + Eurydice_slice input, uint8_t ret[32U]) { + uint8_t digest[32U] = {0U}; + libcrux_sha3_portable_shake256( + Eurydice_array_to_slice((size_t)32U, digest, uint8_t), input); + memcpy(ret, digest, (size_t)32U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF_f1 +with const generics +- K= 3 +- LEN= 32 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRF_f1_ee( + Eurydice_slice input, uint8_t ret[32U]) { + libcrux_ml_kem_hash_functions_portable_PRF_2b(input, ret); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_ring_elements_reduced.closure with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- PUBLIC_KEY_SIZE= 1152 +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_closure_cd( + size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** + Only use with public values. + + This MUST NOT be used with secret inputs, like its caller + `deserialize_ring_elements_reduced`. +*/ +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_to_reduced_ring_element with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_to_reduced_ring_element_4c( + Eurydice_slice serialized) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(serialized, uint8_t) / (size_t)24U; i++) { + size_t i0 = i; + Eurydice_slice bytes = Eurydice_slice_subslice2( + serialized, i0 * (size_t)24U, i0 * (size_t)24U + (size_t)24U, uint8_t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_deserialize_12_0d(bytes); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_cond_subtract_3329_0d(coefficient); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** + This function deserializes ring elements and reduces the result by the field + modulus. + + This function MUST NOT be used on secret inputs. +*/ +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_ring_elements_reduced with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- PUBLIC_KEY_SIZE= 1152 +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_33( + Eurydice_slice public_key, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 deserialized_pk[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + deserialized_pk[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(public_key, uint8_t) / + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT; + i++) { + size_t i0 = i; + Eurydice_slice ring_element = Eurydice_slice_subslice2( + public_key, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT + + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + uint8_t); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____0 = + libcrux_ml_kem_serialize_deserialize_to_reduced_ring_element_4c( + ring_element); + deserialized_pk[i0] = uu____0; + } + memcpy( + ret, deserialized_pk, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of libcrux_ml_kem.matrix.sample_matrix_A.closure.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_matrix_sample_matrix_A_closure_closure_78(size_t _j) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +A monomorphic instance of libcrux_ml_kem.matrix.sample_matrix_A.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +*/ +static inline void libcrux_ml_kem_matrix_sample_matrix_A_closure_4b( + size_t _i, libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + ret[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } +} + +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PortableHash +with const generics +- $3size_t +*/ +typedef struct libcrux_ml_kem_hash_functions_portable_PortableHash_58_s { + libcrux_sha3_generic_keccak_KeccakState_48 shake128_state[3U]; +} libcrux_ml_kem_hash_functions_portable_PortableHash_58; + +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_init_absorb with const generics +- K= 3 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_hash_functions_portable_PortableHash_58 +libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_b7( + uint8_t input[3U][34U]) { + libcrux_sha3_generic_keccak_KeccakState_48 shake128_state[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + shake128_state[i] = libcrux_sha3_portable_incremental_shake128_init(); + } + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_sha3_portable_incremental_shake128_absorb_final( + &shake128_state[i0], + Eurydice_array_to_slice((size_t)34U, input[i0], uint8_t)); + } + /* Passing arrays by value in Rust generates a copy in C */ + libcrux_sha3_generic_keccak_KeccakState_48 copy_of_shake128_state[3U]; + memcpy(copy_of_shake128_state, shake128_state, + (size_t)3U * sizeof(libcrux_sha3_generic_keccak_KeccakState_48)); + libcrux_ml_kem_hash_functions_portable_PortableHash_58 lit; + memcpy(lit.shake128_state, copy_of_shake128_state, + (size_t)3U * sizeof(libcrux_sha3_generic_keccak_KeccakState_48)); + return lit; +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_init_absorb_f1 with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_hash_functions_portable_PortableHash_58 +libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_f1_8c( + uint8_t input[3U][34U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_input[3U][34U]; + memcpy(copy_of_input, input, (size_t)3U * sizeof(uint8_t[34U])); + return libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_b7( + copy_of_input); +} + +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_squeeze_three_blocks with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_hash_functions_portable_shake128_squeeze_three_blocks_ca( + libcrux_ml_kem_hash_functions_portable_PortableHash_58 *st, + uint8_t ret[3U][504U]) { + uint8_t out[3U][504U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_sha3_portable_incremental_shake128_squeeze_first_three_blocks( + &st->shake128_state[i0], + Eurydice_array_to_slice((size_t)504U, out[i0], uint8_t)); + } + memcpy(ret, out, (size_t)3U * sizeof(uint8_t[504U])); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_squeeze_three_blocks_f1 with +const generics +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_hash_functions_portable_shake128_squeeze_three_blocks_f1_69( + libcrux_ml_kem_hash_functions_portable_PortableHash_58 *self, + uint8_t ret[3U][504U]) { + libcrux_ml_kem_hash_functions_portable_shake128_squeeze_three_blocks_ca(self, + ret); +} + +/** + If `bytes` contains a set of uniformly random bytes, this function + uniformly samples a ring element `â` that is treated as being the NTT + representation of the corresponding polynomial `a`. + + Since rejection sampling is used, it is possible the supplied bytes are + not enough to sample the element, in which case an `Err` is returned and the + caller must try again with a fresh set of bytes. + + This function partially implements Algorithm + 6 of the NIST FIPS 203 standard, We say "partially" because this + implementation only accepts a finite set of bytes as input and returns an error + if the set is not enough; Algorithm 6 of the FIPS 203 standard on the other + hand samples from an infinite stream of bytes until the ring element is filled. + Algorithm 6 is reproduced below: + + ```plaintext + Input: byte stream B ∈ 𝔹*. + Output: array â ∈ ℤ₂₅₆. + + i ← 0 + j ← 0 + while j < 256 do + d₁ ← B[i] + 256·(B[i+1] mod 16) + d₂ ← ⌊B[i+1]/16⌋ + 16·B[i+2] + if d₁ < q then + â[j] ← d₁ + j ← j + 1 + end if + if d₂ < q and j < 256 then + â[j] ← d₂ + j ← j + 1 + end if + i ← i + 3 + end while + return â + ``` + + The NIST FIPS 203 standard can be found at + . +*/ +/** +A monomorphic instance of +libcrux_ml_kem.sampling.sample_from_uniform_distribution_next with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- K= 3 +- N= 504 +*/ +static KRML_MUSTINLINE bool +libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_db( + uint8_t randomness[3U][504U], size_t *sampled_coefficients, + int16_t (*out)[272U]) { + for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { + size_t i1 = i0; + for (size_t i = (size_t)0U; i < (size_t)504U / (size_t)24U; i++) { + size_t r = i; + if (sampled_coefficients[i1] < + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { + Eurydice_slice uu____0 = + Eurydice_array_to_subslice2(randomness[i1], r * (size_t)24U, + r * (size_t)24U + (size_t)24U, uint8_t); + size_t sampled = libcrux_ml_kem_vector_portable_rej_sample_0d( + uu____0, Eurydice_array_to_subslice2( + out[i1], sampled_coefficients[i1], + sampled_coefficients[i1] + (size_t)16U, int16_t)); + size_t uu____1 = i1; + sampled_coefficients[uu____1] = sampled_coefficients[uu____1] + sampled; + } + } + } + bool done = true; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + if (sampled_coefficients[i0] >= + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { + sampled_coefficients[i0] = + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT; + } else { + done = false; + } + } + return done; +} + +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_squeeze_block with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_hash_functions_portable_shake128_squeeze_block_dd( + libcrux_ml_kem_hash_functions_portable_PortableHash_58 *st, + uint8_t ret[3U][168U]) { + uint8_t out[3U][168U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_sha3_portable_incremental_shake128_squeeze_next_block( + &st->shake128_state[i0], + Eurydice_array_to_slice((size_t)168U, out[i0], uint8_t)); + } + memcpy(ret, out, (size_t)3U * sizeof(uint8_t[168U])); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of +libcrux_ml_kem.hash_functions.portable.shake128_squeeze_block_f1 with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_hash_functions_portable_shake128_squeeze_block_f1_60( + libcrux_ml_kem_hash_functions_portable_PortableHash_58 *self, + uint8_t ret[3U][168U]) { + libcrux_ml_kem_hash_functions_portable_shake128_squeeze_block_dd(self, ret); +} + +/** + If `bytes` contains a set of uniformly random bytes, this function + uniformly samples a ring element `â` that is treated as being the NTT + representation of the corresponding polynomial `a`. + + Since rejection sampling is used, it is possible the supplied bytes are + not enough to sample the element, in which case an `Err` is returned and the + caller must try again with a fresh set of bytes. + + This function partially implements Algorithm + 6 of the NIST FIPS 203 standard, We say "partially" because this + implementation only accepts a finite set of bytes as input and returns an error + if the set is not enough; Algorithm 6 of the FIPS 203 standard on the other + hand samples from an infinite stream of bytes until the ring element is filled. + Algorithm 6 is reproduced below: + + ```plaintext + Input: byte stream B ∈ 𝔹*. + Output: array â ∈ ℤ₂₅₆. + + i ← 0 + j ← 0 + while j < 256 do + d₁ ← B[i] + 256·(B[i+1] mod 16) + d₂ ← ⌊B[i+1]/16⌋ + 16·B[i+2] + if d₁ < q then + â[j] ← d₁ + j ← j + 1 + end if + if d₂ < q and j < 256 then + â[j] ← d₂ + j ← j + 1 + end if + i ← i + 3 + end while + return â + ``` + + The NIST FIPS 203 standard can be found at + . +*/ +/** +A monomorphic instance of +libcrux_ml_kem.sampling.sample_from_uniform_distribution_next with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- K= 3 +- N= 168 +*/ +static KRML_MUSTINLINE bool +libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_db0( + uint8_t randomness[3U][168U], size_t *sampled_coefficients, + int16_t (*out)[272U]) { + for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { + size_t i1 = i0; + for (size_t i = (size_t)0U; i < (size_t)168U / (size_t)24U; i++) { + size_t r = i; + if (sampled_coefficients[i1] < + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { + Eurydice_slice uu____0 = + Eurydice_array_to_subslice2(randomness[i1], r * (size_t)24U, + r * (size_t)24U + (size_t)24U, uint8_t); + size_t sampled = libcrux_ml_kem_vector_portable_rej_sample_0d( + uu____0, Eurydice_array_to_subslice2( + out[i1], sampled_coefficients[i1], + sampled_coefficients[i1] + (size_t)16U, int16_t)); + size_t uu____1 = i1; + sampled_coefficients[uu____1] = sampled_coefficients[uu____1] + sampled; + } + } + } + bool done = true; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + if (sampled_coefficients[i0] >= + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT) { + sampled_coefficients[i0] = + LIBCRUX_ML_KEM_CONSTANTS_COEFFICIENTS_IN_RING_ELEMENT; + } else { + done = false; + } + } + return done; +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.from_i16_array_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_polynomial_from_i16_array_89_c1(Eurydice_slice a) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_from_i16_array_0d( + Eurydice_slice_subslice2(a, i0 * (size_t)16U, + (i0 + (size_t)1U) * (size_t)16U, int16_t)); + result.coefficients[i0] = uu____0; + } + return result; +} + +/** +A monomorphic instance of libcrux_ml_kem.sampling.sample_from_xof.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_sampling_sample_from_xof_closure_04(int16_t s[272U]) { + return libcrux_ml_kem_polynomial_from_i16_array_89_c1( + Eurydice_array_to_subslice2(s, (size_t)0U, (size_t)256U, int16_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.sampling.sample_from_xof +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_sampling_sample_from_xof_3f( + uint8_t seeds[3U][34U], + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + size_t sampled_coefficients[3U] = {0U}; + int16_t out[3U][272U] = {{0U}}; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_seeds[3U][34U]; + memcpy(copy_of_seeds, seeds, (size_t)3U * sizeof(uint8_t[34U])); + libcrux_ml_kem_hash_functions_portable_PortableHash_58 xof_state = + libcrux_ml_kem_hash_functions_portable_shake128_init_absorb_f1_8c( + copy_of_seeds); + uint8_t randomness0[3U][504U]; + libcrux_ml_kem_hash_functions_portable_shake128_squeeze_three_blocks_f1_69( + &xof_state, randomness0); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness0[3U][504U]; + memcpy(copy_of_randomness0, randomness0, (size_t)3U * sizeof(uint8_t[504U])); + bool done = libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_db( + copy_of_randomness0, sampled_coefficients, out); + while (true) { + if (done) { + break; + } else { + uint8_t randomness[3U][168U]; + libcrux_ml_kem_hash_functions_portable_shake128_squeeze_block_f1_60( + &xof_state, randomness); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[3U][168U]; + memcpy(copy_of_randomness, randomness, + (size_t)3U * sizeof(uint8_t[168U])); + done = libcrux_ml_kem_sampling_sample_from_uniform_distribution_next_db0( + copy_of_randomness, sampled_coefficients, out); + } + } + /* Passing arrays by value in Rust generates a copy in C */ + int16_t copy_of_out[3U][272U]; + memcpy(copy_of_out, out, (size_t)3U * sizeof(int16_t[272U])); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret0[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + ret0[i] = + libcrux_ml_kem_sampling_sample_from_xof_closure_04(copy_of_out[i]); + } + memcpy( + ret, ret0, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of libcrux_ml_kem.matrix.sample_matrix_A +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_matrix_sample_matrix_A_38( + uint8_t seed[34U], bool transpose, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U][3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 A_transpose[3U][3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + libcrux_ml_kem_matrix_sample_matrix_A_closure_4b(i, A_transpose[i]); + } + for (size_t i0 = (size_t)0U; i0 < (size_t)3U; i0++) { + size_t i1 = i0; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_seed[34U]; + memcpy(copy_of_seed, seed, (size_t)34U * sizeof(uint8_t)); + uint8_t seeds[3U][34U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + memcpy(seeds[i], copy_of_seed, (size_t)34U * sizeof(uint8_t)); + } + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t j = i; + seeds[j][32U] = (uint8_t)i1; + seeds[j][33U] = (uint8_t)j; + } + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_seeds[3U][34U]; + memcpy(copy_of_seeds, seeds, (size_t)3U * sizeof(uint8_t[34U])); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 sampled[3U]; + libcrux_ml_kem_sampling_sample_from_xof_3f(copy_of_seeds, sampled); + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, sampled, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0); + i++) { + size_t j = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 sample = sampled[j]; + if (transpose) { + A_transpose[j][i1] = sample; + } else { + A_transpose[i1][j] = sample; + } + } + } + memcpy(ret, A_transpose, + (size_t)3U * + sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0[3U])); +} + +/** +A monomorphic instance of K. +with types libcrux_ml_kem_polynomial_PolynomialRingElement +libcrux_ml_kem_vector_portable_vector_type_PortableVector[3size_t], uint8_t + +*/ +typedef struct tuple_b0_s { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 fst[3U]; + uint8_t snd; +} tuple_b0; + +/** +A monomorphic instance of +libcrux_ml_kem.ind_cpa.sample_vector_cbd_then_ntt.closure with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +- ETA= 2 +- ETA_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_closure_f7(size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRFxN +with const generics +- K= 3 +- LEN= 128 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRFxN_c5( + uint8_t (*input)[33U], uint8_t ret[3U][128U]) { + uint8_t out[3U][128U] = {{0U}}; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_sha3_portable_shake256( + Eurydice_array_to_slice((size_t)128U, out[i0], uint8_t), + Eurydice_array_to_slice((size_t)33U, input[i0], uint8_t)); + } + memcpy(ret, out, (size_t)3U * sizeof(uint8_t[128U])); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRFxN_f1 +with const generics +- K= 3 +- LEN= 128 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRFxN_f1_93( + uint8_t (*input)[33U], uint8_t ret[3U][128U]) { + libcrux_ml_kem_hash_functions_portable_PRFxN_c5(input, ret); +} + +/** + Given a series of uniformly random bytes in `randomness`, for some number + `eta`, the `sample_from_binomial_distribution_{eta}` functions sample a ring + element from a binomial distribution centered at 0 that uses two sets of `eta` + coin flips. If, for example, `eta = ETA`, each ring coefficient is a value `v` + such such that `v ∈ {-ETA, -ETA + 1, ..., 0, ..., ETA + 1, ETA}` and: + + ```plaintext + - If v < 0, Pr[v] = Pr[-v] + - If v >= 0, Pr[v] = BINOMIAL_COEFFICIENT(2 * ETA; ETA - v) / 2 ^ (2 * ETA) + ``` + + The values `v < 0` are mapped to the appropriate `KyberFieldElement`. + + The expected value is: + + ```plaintext + E[X] = (-ETA)Pr[-ETA] + (-(ETA - 1))Pr[-(ETA - 1)] + ... + (ETA - 1)Pr[ETA - 1] + + (ETA)Pr[ETA] = 0 since Pr[-v] = Pr[v] when v < 0. + ``` + + And the variance is: + + ```plaintext + Var(X) = E[(X - E[X])^2] + = E[X^2] + = sum_(v=-ETA to ETA)v^2 * (BINOMIAL_COEFFICIENT(2 * ETA; ETA - v) / + 2^(2 * ETA)) = ETA / 2 + ``` + + This function implements Algorithm 7 of the NIST FIPS 203 + standard, which is reproduced below: + + ```plaintext + Input: byte array B ∈ 𝔹^{64η}. + Output: array f ∈ ℤ₂₅₆. + + b ← BytesToBits(B) + for (i ← 0; i < 256; i++) + x ← ∑(j=0 to η - 1) b[2iη + j] + y ← ∑(j=0 to η - 1) b[2iη + η + j] + f[i] ← x−y mod q + end for + return f + ``` + + The NIST FIPS 203 standard can be found at + . +*/ +/** +A monomorphic instance of +libcrux_ml_kem.sampling.sample_from_binomial_distribution_2 with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_sampling_sample_from_binomial_distribution_2_85( + Eurydice_slice randomness) { + int16_t sampled_i16s[256U] = {0U}; + for (size_t i0 = (size_t)0U; + i0 < Eurydice_slice_len(randomness, uint8_t) / (size_t)4U; i0++) { + size_t chunk_number = i0; + Eurydice_slice byte_chunk = Eurydice_slice_subslice2( + randomness, chunk_number * (size_t)4U, + chunk_number * (size_t)4U + (size_t)4U, uint8_t); + uint32_t random_bits_as_u32 = + (((uint32_t)Eurydice_slice_index(byte_chunk, (size_t)0U, uint8_t, + uint8_t *) | + (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)1U, uint8_t, + uint8_t *) + << 8U) | + (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)2U, uint8_t, + uint8_t *) + << 16U) | + (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)3U, uint8_t, + uint8_t *) + << 24U; + uint32_t even_bits = random_bits_as_u32 & 1431655765U; + uint32_t odd_bits = random_bits_as_u32 >> 1U & 1431655765U; + uint32_t coin_toss_outcomes = even_bits + odd_bits; + for (uint32_t i = 0U; i < CORE_NUM__U32_8__BITS / 4U; i++) { + uint32_t outcome_set = i; + uint32_t outcome_set0 = outcome_set * 4U; + int16_t outcome_1 = + (int16_t)(coin_toss_outcomes >> (uint32_t)outcome_set0 & 3U); + int16_t outcome_2 = + (int16_t)(coin_toss_outcomes >> (uint32_t)(outcome_set0 + 2U) & 3U); + size_t offset = (size_t)(outcome_set0 >> 2U); + sampled_i16s[(size_t)8U * chunk_number + offset] = outcome_1 - outcome_2; + } + } + return libcrux_ml_kem_polynomial_from_i16_array_89_c1( + Eurydice_array_to_slice((size_t)256U, sampled_i16s, int16_t)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.sampling.sample_from_binomial_distribution_3 with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_sampling_sample_from_binomial_distribution_3_eb( + Eurydice_slice randomness) { + int16_t sampled_i16s[256U] = {0U}; + for (size_t i0 = (size_t)0U; + i0 < Eurydice_slice_len(randomness, uint8_t) / (size_t)3U; i0++) { + size_t chunk_number = i0; + Eurydice_slice byte_chunk = Eurydice_slice_subslice2( + randomness, chunk_number * (size_t)3U, + chunk_number * (size_t)3U + (size_t)3U, uint8_t); + uint32_t random_bits_as_u24 = + ((uint32_t)Eurydice_slice_index(byte_chunk, (size_t)0U, uint8_t, + uint8_t *) | + (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)1U, uint8_t, + uint8_t *) + << 8U) | + (uint32_t)Eurydice_slice_index(byte_chunk, (size_t)2U, uint8_t, + uint8_t *) + << 16U; + uint32_t first_bits = random_bits_as_u24 & 2396745U; + uint32_t second_bits = random_bits_as_u24 >> 1U & 2396745U; + uint32_t third_bits = random_bits_as_u24 >> 2U & 2396745U; + uint32_t coin_toss_outcomes = first_bits + second_bits + third_bits; + for (int32_t i = (int32_t)0; i < (int32_t)24 / (int32_t)6; i++) { + int32_t outcome_set = i; + int32_t outcome_set0 = outcome_set * (int32_t)6; + int16_t outcome_1 = + (int16_t)(coin_toss_outcomes >> (uint32_t)outcome_set0 & 7U); + int16_t outcome_2 = (int16_t)(coin_toss_outcomes >> + (uint32_t)(outcome_set0 + (int32_t)3) & + 7U); + size_t offset = (size_t)(outcome_set0 / (int32_t)6); + sampled_i16s[(size_t)4U * chunk_number + offset] = outcome_1 - outcome_2; + } + } + return libcrux_ml_kem_polynomial_from_i16_array_89_c1( + Eurydice_array_to_slice((size_t)256U, sampled_i16s, int16_t)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.sampling.sample_from_binomial_distribution with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- ETA= 2 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_sampling_sample_from_binomial_distribution_c6( + Eurydice_slice randomness) { + return libcrux_ml_kem_sampling_sample_from_binomial_distribution_2_85( + randomness); +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_at_layer_7 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ntt_ntt_at_layer_7_f4( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re) { + size_t step = LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT / (size_t)2U; + for (size_t i = (size_t)0U; i < step; i++) { + size_t j = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector t = + libcrux_ml_kem_vector_portable_multiply_by_constant_0d( + re->coefficients[j + step], (int16_t)-1600); + re->coefficients[j + step] = + libcrux_ml_kem_vector_portable_sub_0d(re->coefficients[j], &t); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____1 = + libcrux_ml_kem_vector_portable_add_0d(re->coefficients[j], &t); + re->coefficients[j] = uu____1; + } +} + +/** +A monomorphic instance of libcrux_ml_kem.ntt.ntt_binomially_sampled_ring_element +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_ntt_ntt_binomially_sampled_ring_element_0f( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re) { + libcrux_ml_kem_ntt_ntt_at_layer_7_f4(re); + size_t zeta_i = (size_t)1U; + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)6U, + (size_t)3U); + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)5U, + (size_t)3U); + libcrux_ml_kem_ntt_ntt_at_layer_4_plus_51(&zeta_i, re, (size_t)4U, + (size_t)3U); + libcrux_ml_kem_ntt_ntt_at_layer_3_fd(&zeta_i, re, (size_t)3U, (size_t)3U); + libcrux_ml_kem_ntt_ntt_at_layer_2_ad(&zeta_i, re, (size_t)2U, (size_t)3U); + libcrux_ml_kem_ntt_ntt_at_layer_1_a2(&zeta_i, re, (size_t)1U, (size_t)3U); + libcrux_ml_kem_polynomial_poly_barrett_reduce_89_8b(re); +} + +/** + Sample a vector of ring elements from a centered binomial distribution and + convert them into their NTT representations. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.sample_vector_cbd_then_ntt +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +- ETA= 2 +- ETA_RANDOMNESS_SIZE= 128 +*/ +static KRML_MUSTINLINE tuple_b0 +libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc(uint8_t prf_input[33U], + uint8_t domain_separator) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re_as_ntt[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + re_as_ntt[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input[33U]; + memcpy(copy_of_prf_input, prf_input, (size_t)33U * sizeof(uint8_t)); + uint8_t prf_inputs[3U][33U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + memcpy(prf_inputs[i], copy_of_prf_input, (size_t)33U * sizeof(uint8_t)); + } + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + prf_inputs[i0][32U] = domain_separator; + domain_separator = (uint32_t)domain_separator + 1U; + } + uint8_t prf_outputs[3U][128U]; + libcrux_ml_kem_hash_functions_portable_PRFxN_f1_93(prf_inputs, prf_outputs); + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + re_as_ntt[i0] = + libcrux_ml_kem_sampling_sample_from_binomial_distribution_c6( + Eurydice_array_to_slice((size_t)128U, prf_outputs[i0], uint8_t)); + libcrux_ml_kem_ntt_ntt_binomially_sampled_ring_element_0f(&re_as_ntt[i0]); + } + /* Passing arrays by value in Rust generates a copy in C */ + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 copy_of_re_as_ntt[3U]; + memcpy( + copy_of_re_as_ntt, re_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + tuple_b0 lit; + memcpy( + lit.fst, copy_of_re_as_ntt, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + lit.snd = domain_separator; + return lit; +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.sample_ring_element_cbd.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +- ETA2_RANDOMNESS_SIZE= 128 +- ETA2= 2 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_ind_cpa_sample_ring_element_cbd_closure_77(size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** + Sample a vector of ring elements from a centered binomial distribution. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.sample_ring_element_cbd +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +- ETA2_RANDOMNESS_SIZE= 128 +- ETA2= 2 +*/ +static KRML_MUSTINLINE tuple_b0 +libcrux_ml_kem_ind_cpa_sample_ring_element_cbd_ac(uint8_t prf_input[33U], + uint8_t domain_separator) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 error_1[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + error_1[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input[33U]; + memcpy(copy_of_prf_input, prf_input, (size_t)33U * sizeof(uint8_t)); + uint8_t prf_inputs[3U][33U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + memcpy(prf_inputs[i], copy_of_prf_input, (size_t)33U * sizeof(uint8_t)); + } + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + prf_inputs[i0][32U] = domain_separator; + domain_separator = (uint32_t)domain_separator + 1U; + } + uint8_t prf_outputs[3U][128U]; + libcrux_ml_kem_hash_functions_portable_PRFxN_f1_93(prf_inputs, prf_outputs); + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____1 = + libcrux_ml_kem_sampling_sample_from_binomial_distribution_c6( + Eurydice_array_to_slice((size_t)128U, prf_outputs[i0], uint8_t)); + error_1[i0] = uu____1; + } + /* Passing arrays by value in Rust generates a copy in C */ + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 copy_of_error_1[3U]; + memcpy( + copy_of_error_1, error_1, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + tuple_b0 lit; + memcpy( + lit.fst, copy_of_error_1, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + lit.snd = domain_separator; + return lit; +} + +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF +with const generics +- LEN= 128 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRF_2b0( + Eurydice_slice input, uint8_t ret[128U]) { + uint8_t digest[128U] = {0U}; + libcrux_sha3_portable_shake256( + Eurydice_array_to_slice((size_t)128U, digest, uint8_t), input); + memcpy(ret, digest, (size_t)128U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.PRF_f1 +with const generics +- K= 3 +- LEN= 128 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_PRF_f1_ee0( + Eurydice_slice input, uint8_t ret[128U]) { + libcrux_ml_kem_hash_functions_portable_PRF_2b0(input, ret); +} + +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_vector_u.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_matrix_compute_vector_u_closure_d6(size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.add_error_reduce_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_polynomial_add_error_reduce_89_38( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *error) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t j = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_normal_form = + libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d( + self->coefficients[j], (int16_t)1441); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_barrett_reduce_0d( + libcrux_ml_kem_vector_portable_add_0d(coefficient_normal_form, + &error->coefficients[j])); + self->coefficients[j] = uu____0; + } +} + +/** + Compute u := InvertNTT(Aᵀ ◦ r̂) + e₁ +*/ +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_vector_u +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_matrix_compute_vector_u_59( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 (*a_as_ntt)[3U], + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *r_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *error_1, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + result[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i0 = (size_t)0U; + i0 < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, a_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0[3U]), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0[3U]); + i0++) { + size_t i1 = i0; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *row = a_as_ntt[i1]; + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, row, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0); + i++) { + size_t j = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *a_element = &row[j]; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 product = + libcrux_ml_kem_polynomial_ntt_multiply_89_2a(a_element, &r_as_ntt[j]); + libcrux_ml_kem_polynomial_add_to_ring_element_89_84(&result[i1], + &product); + } + libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_f6(&result[i1]); + libcrux_ml_kem_polynomial_add_error_reduce_89_38(&result[i1], &error_1[i1]); + } + memcpy( + ret, result, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.traits.decompress_1 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_traits_decompress_1_63( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_ZERO_0d(); + return libcrux_ml_kem_vector_portable_bitwise_and_with_constant_0d( + libcrux_ml_kem_vector_portable_sub_0d(uu____0, &v), (int16_t)1665); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_then_decompress_message with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_then_decompress_message_0d( + uint8_t serialized[32U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; i < (size_t)16U; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_compressed = + libcrux_ml_kem_vector_portable_deserialize_1_0d( + Eurydice_array_to_subslice2(serialized, (size_t)2U * i0, + (size_t)2U * i0 + (size_t)2U, + uint8_t)); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_traits_decompress_1_63(coefficient_compressed); + re.coefficients[i0] = uu____0; + } + return re; +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.add_message_error_reduce_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_polynomial_add_message_error_reduce_89_ea( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *message, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_normal_form = + libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d( + result.coefficients[i0], (int16_t)1441); + libcrux_ml_kem_vector_portable_vector_type_PortableVector tmp = + libcrux_ml_kem_vector_portable_add_0d(self->coefficients[i0], + &message->coefficients[i0]); + libcrux_ml_kem_vector_portable_vector_type_PortableVector tmp0 = + libcrux_ml_kem_vector_portable_add_0d(coefficient_normal_form, &tmp); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_barrett_reduce_0d(tmp0); + result.coefficients[i0] = uu____0; + } + return result; +} + +/** + Compute InverseNTT(tᵀ ◦ r̂) + e₂ + message +*/ +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_ring_element_v +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_matrix_compute_ring_element_v_54( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *t_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *r_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *error_2, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *message) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result = + libcrux_ml_kem_polynomial_ZERO_89_ea(); + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + size_t i0 = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 product = + libcrux_ml_kem_polynomial_ntt_multiply_89_2a(&t_as_ntt[i0], + &r_as_ntt[i0]); + libcrux_ml_kem_polynomial_add_to_ring_element_89_84(&result, &product); + } + libcrux_ml_kem_invert_ntt_invert_ntt_montgomery_f6(&result); + result = libcrux_ml_kem_polynomial_add_message_error_reduce_89_ea( + error_2, message, result); + return result; +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress +with const generics +- COEFFICIENT_BITS= 10 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_compress_02( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int16_t uu____0 = + libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( + (uint8_t)(int32_t)10, (uint16_t)v.elements[i0]); + v.elements[i0] = uu____0; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress_0d +with const generics +- COEFFICIENT_BITS= 10 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_0d_28( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_compress_02(v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_10 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- OUT_LEN= 320 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_10_fc( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, uint8_t ret[320U]) { + uint8_t serialized[320U] = {0U}; + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_compress_0d_28( + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re->coefficients[i0])); + uint8_t bytes[20U]; + libcrux_ml_kem_vector_portable_serialize_10_0d(coefficient, bytes); + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + serialized, (size_t)20U * i0, (size_t)20U * i0 + (size_t)20U, uint8_t); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)20U, bytes, uint8_t), uint8_t); + } + memcpy(ret, serialized, (size_t)320U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress +with const generics +- COEFFICIENT_BITS= 11 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_compress_020( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int16_t uu____0 = + libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( + (uint8_t)(int32_t)11, (uint16_t)v.elements[i0]); + v.elements[i0] = uu____0; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress_0d +with const generics +- COEFFICIENT_BITS= 11 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_0d_280( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_compress_020(v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_11 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- OUT_LEN= 320 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_11_e1( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, uint8_t ret[320U]) { + uint8_t serialized[320U] = {0U}; + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_compress_0d_280( + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re->coefficients[i0])); + uint8_t bytes[22U]; + libcrux_ml_kem_vector_portable_serialize_11_0d(coefficient, bytes); + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + serialized, (size_t)22U * i0, (size_t)22U * i0 + (size_t)22U, uint8_t); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)22U, bytes, uint8_t), uint8_t); + } + memcpy(ret, serialized, (size_t)320U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.compress_then_serialize_ring_element_u with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- COMPRESSION_FACTOR= 10 +- OUT_LEN= 320 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_ring_element_u_5f( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, uint8_t ret[320U]) { + uint8_t uu____0[320U]; + libcrux_ml_kem_serialize_compress_then_serialize_10_fc(re, uu____0); + memcpy(ret, uu____0, (size_t)320U * sizeof(uint8_t)); +} + +/** + Call [`compress_then_serialize_ring_element_u`] on each ring element. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.compress_then_serialize_u +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- OUT_LEN= 960 +- COMPRESSION_FACTOR= 10 +- BLOCK_LEN= 320 +*/ +static inline void libcrux_ml_kem_ind_cpa_compress_then_serialize_u_a7( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 input[3U], + Eurydice_slice out) { + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, input, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0); + i++) { + size_t i0 = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = input[i0]; + Eurydice_slice uu____0 = Eurydice_slice_subslice2( + out, i0 * ((size_t)960U / (size_t)3U), + (i0 + (size_t)1U) * ((size_t)960U / (size_t)3U), uint8_t); + uint8_t ret[320U]; + libcrux_ml_kem_serialize_compress_then_serialize_ring_element_u_5f(&re, + ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)320U, ret, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress +with const generics +- COEFFICIENT_BITS= 4 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_compress_021( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int16_t uu____0 = + libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( + (uint8_t)(int32_t)4, (uint16_t)v.elements[i0]); + v.elements[i0] = uu____0; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress_0d +with const generics +- COEFFICIENT_BITS= 4 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_0d_281( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_compress_021(v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_4 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_4_9a( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re, + Eurydice_slice serialized) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_portable_compress_0d_281( + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re.coefficients[i0])); + uint8_t bytes[8U]; + libcrux_ml_kem_vector_portable_serialize_4_0d(coefficient, bytes); + Eurydice_slice_copy( + Eurydice_slice_subslice2(serialized, (size_t)8U * i0, + (size_t)8U * i0 + (size_t)8U, uint8_t), + Eurydice_array_to_slice((size_t)8U, bytes, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress.compress +with const generics +- COEFFICIENT_BITS= 5 +*/ +static KRML_MUSTINLINE libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_compress_022( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_VECTOR_TRAITS_FIELD_ELEMENTS_IN_VECTOR; i++) { + size_t i0 = i; + int16_t uu____0 = + libcrux_ml_kem_vector_portable_compress_compress_ciphertext_coefficient( + (uint8_t)(int32_t)5, (uint16_t)v.elements[i0]); + v.elements[i0] = uu____0; + } + return v; +} + +/** +This function found in impl {(libcrux_ml_kem::vector::traits::Operations for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.vector.portable.compress_0d +with const generics +- COEFFICIENT_BITS= 5 +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_compress_0d_282( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_compress_compress_022(v); +} + +/** +A monomorphic instance of libcrux_ml_kem.serialize.compress_then_serialize_5 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_5_1f( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re, + Eurydice_slice serialized) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficients = + libcrux_ml_kem_vector_portable_compress_0d_282( + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re.coefficients[i0])); + uint8_t bytes[10U]; + libcrux_ml_kem_vector_portable_serialize_5_0d(coefficients, bytes); + Eurydice_slice_copy( + Eurydice_slice_subslice2(serialized, (size_t)10U * i0, + (size_t)10U * i0 + (size_t)10U, uint8_t), + Eurydice_array_to_slice((size_t)10U, bytes, uint8_t), uint8_t); + } +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.compress_then_serialize_ring_element_v with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- COMPRESSION_FACTOR= 4 +- OUT_LEN= 128 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_compress_then_serialize_ring_element_v_4e( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re, Eurydice_slice out) { + libcrux_ml_kem_serialize_compress_then_serialize_4_9a(re, out); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.encrypt +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] with const +generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_LEN= 960 +- C2_LEN= 128 +- U_COMPRESSION_FACTOR= 10 +- V_COMPRESSION_FACTOR= 4 +- BLOCK_LEN= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +*/ +static inline void libcrux_ml_kem_ind_cpa_encrypt_60(Eurydice_slice public_key, + uint8_t message[32U], + Eurydice_slice randomness, + uint8_t ret[1088U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 t_as_ntt[3U]; + libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_33( + Eurydice_slice_subslice_to(public_key, (size_t)1152U, uint8_t, size_t), + t_as_ntt); + Eurydice_slice seed = + Eurydice_slice_subslice_from(public_key, (size_t)1152U, uint8_t, size_t); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 A[3U][3U]; + uint8_t ret0[34U]; + libcrux_ml_kem_utils_into_padded_array_ea1(seed, ret0); + libcrux_ml_kem_matrix_sample_matrix_A_38(ret0, false, A); + uint8_t prf_input[33U]; + libcrux_ml_kem_utils_into_padded_array_ea2(randomness, prf_input); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input0[33U]; + memcpy(copy_of_prf_input0, prf_input, (size_t)33U * sizeof(uint8_t)); + tuple_b0 uu____1 = libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc( + copy_of_prf_input0, 0U); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 r_as_ntt[3U]; + memcpy( + r_as_ntt, uu____1.fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + uint8_t domain_separator0 = uu____1.snd; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input[33U]; + memcpy(copy_of_prf_input, prf_input, (size_t)33U * sizeof(uint8_t)); + tuple_b0 uu____3 = libcrux_ml_kem_ind_cpa_sample_ring_element_cbd_ac( + copy_of_prf_input, domain_separator0); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 error_1[3U]; + memcpy( + error_1, uu____3.fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + uint8_t domain_separator = uu____3.snd; + prf_input[32U] = domain_separator; + uint8_t prf_output[128U]; + libcrux_ml_kem_hash_functions_portable_PRF_f1_ee0( + Eurydice_array_to_slice((size_t)33U, prf_input, uint8_t), prf_output); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 error_2 = + libcrux_ml_kem_sampling_sample_from_binomial_distribution_c6( + Eurydice_array_to_slice((size_t)128U, prf_output, uint8_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 u[3U]; + libcrux_ml_kem_matrix_compute_vector_u_59(A, r_as_ntt, error_1, u); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_message[32U]; + memcpy(copy_of_message, message, (size_t)32U * sizeof(uint8_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 message_as_ring_element = + libcrux_ml_kem_serialize_deserialize_then_decompress_message_0d( + copy_of_message); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 v = + libcrux_ml_kem_matrix_compute_ring_element_v_54( + t_as_ntt, r_as_ntt, &error_2, &message_as_ring_element); + uint8_t ciphertext[1088U] = {0U}; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____5[3U]; + memcpy( + uu____5, u, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + libcrux_ml_kem_ind_cpa_compress_then_serialize_u_a7( + uu____5, Eurydice_array_to_subslice2(ciphertext, (size_t)0U, (size_t)960U, + uint8_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____6 = v; + libcrux_ml_kem_serialize_compress_then_serialize_ring_element_v_4e( + uu____6, Eurydice_array_to_subslice_from((size_t)1088U, ciphertext, + (size_t)960U, uint8_t, size_t)); + memcpy(ret, ciphertext, (size_t)1088U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::MlKem)#1} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.kdf_d8 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_kdf_d8_41( + Eurydice_slice shared_secret, libcrux_ml_kem_mlkem768_MlKem768Ciphertext *_, + uint8_t ret[32U]) { + uint8_t out[32U] = {0U}; + Eurydice_slice_copy(Eurydice_array_to_slice((size_t)32U, out, uint8_t), + shared_secret, uint8_t); + memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.decapsulate +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_MlKem with const generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CPA_SECRET_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- CIPHERTEXT_SIZE= 1088 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- C1_BLOCK_SIZE= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +- IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 +*/ +static inline void libcrux_ml_kem_ind_cca_decapsulate_70( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)2400U, private_key->value, uint8_t), + (size_t)1152U, uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_secret_key = uu____0.fst; + Eurydice_slice secret_key0 = uu____0.snd; + Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( + secret_key0, (size_t)1184U, uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_public_key = uu____1.fst; + Eurydice_slice secret_key = uu____1.snd; + Eurydice_slice_uint8_t_x2 uu____2 = Eurydice_slice_split_at( + secret_key, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_public_key_hash = uu____2.fst; + Eurydice_slice implicit_rejection_value = uu____2.snd; + uint8_t decrypted[32U]; + libcrux_ml_kem_ind_cpa_decrypt_43(ind_cpa_secret_key, ciphertext->value, + decrypted); + uint8_t to_hash0[64U]; + libcrux_ml_kem_utils_into_padded_array_ea( + Eurydice_array_to_slice((size_t)32U, decrypted, uint8_t), to_hash0); + Eurydice_slice_copy( + Eurydice_array_to_subslice_from( + (size_t)64U, to_hash0, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, + uint8_t, size_t), + ind_cpa_public_key_hash, uint8_t); + uint8_t hashed[64U]; + libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_array_to_slice((size_t)64U, to_hash0, uint8_t), hashed); + Eurydice_slice_uint8_t_x2 uu____3 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice shared_secret0 = uu____3.fst; + Eurydice_slice pseudorandomness = uu____3.snd; + uint8_t to_hash[1120U]; + libcrux_ml_kem_utils_into_padded_array_ea0(implicit_rejection_value, to_hash); + Eurydice_slice uu____4 = Eurydice_array_to_subslice_from( + (size_t)1120U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, + uint8_t, size_t); + Eurydice_slice_copy(uu____4, libcrux_ml_kem_types_as_ref_00_24(ciphertext), + uint8_t); + uint8_t implicit_rejection_shared_secret0[32U]; + libcrux_ml_kem_hash_functions_portable_PRF_f1_ee( + Eurydice_array_to_slice((size_t)1120U, to_hash, uint8_t), + implicit_rejection_shared_secret0); + Eurydice_slice uu____5 = ind_cpa_public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_decrypted[32U]; + memcpy(copy_of_decrypted, decrypted, (size_t)32U * sizeof(uint8_t)); + uint8_t expected_ciphertext[1088U]; + libcrux_ml_kem_ind_cpa_encrypt_60(uu____5, copy_of_decrypted, + pseudorandomness, expected_ciphertext); + uint8_t implicit_rejection_shared_secret[32U]; + libcrux_ml_kem_variant_kdf_d8_41( + Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret0, + uint8_t), + ciphertext, implicit_rejection_shared_secret); + uint8_t shared_secret[32U]; + libcrux_ml_kem_variant_kdf_d8_41(shared_secret0, ciphertext, shared_secret); + uint8_t ret0[32U]; + libcrux_ml_kem_constant_time_ops_compare_ciphertexts_select_shared_secret_in_constant_time( + libcrux_ml_kem_types_as_ref_00_24(ciphertext), + Eurydice_array_to_slice((size_t)1088U, expected_ciphertext, uint8_t), + Eurydice_array_to_slice((size_t)32U, shared_secret, uint8_t), + Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret, + uint8_t), + ret0); + memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); +} + +/** + Portable decapsulate +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.decapsulate with const generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CPA_SECRET_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- CIPHERTEXT_SIZE= 1088 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- C1_BLOCK_SIZE= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +- IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 +*/ +static inline void +libcrux_ml_kem_ind_cca_instantiations_portable_decapsulate_2e( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + libcrux_ml_kem_ind_cca_decapsulate_70(private_key, ciphertext, ret); +} + +/** + Decapsulate ML-KEM 768 + + Generates an [`MlKemSharedSecret`]. + The input is a reference to an [`MlKem768PrivateKey`] and an + [`MlKem768Ciphertext`]. +*/ +static inline void libcrux_ml_kem_mlkem768_portable_decapsulate( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + libcrux_ml_kem_ind_cca_instantiations_portable_decapsulate_2e( + private_key, ciphertext, ret); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::MlKem)#1} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.entropy_preprocess_d8 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_entropy_preprocess_d8_63( + Eurydice_slice randomness, uint8_t ret[32U]) { + uint8_t out[32U] = {0U}; + Eurydice_slice_copy(Eurydice_array_to_slice((size_t)32U, out, uint8_t), + randomness, uint8_t); + memcpy(ret, out, (size_t)32U * sizeof(uint8_t)); +} + +/** +This function found in impl {(libcrux_ml_kem::hash_functions::Hash for +libcrux_ml_kem::hash_functions::portable::PortableHash)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.hash_functions.portable.H_f1 +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_hash_functions_portable_H_f1_1a( + Eurydice_slice input, uint8_t ret[32U]) { + libcrux_ml_kem_hash_functions_portable_H(input, ret); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.encapsulate +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_MlKem with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- PUBLIC_KEY_SIZE= 1184 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- VECTOR_U_BLOCK_LEN= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +*/ +static inline tuple_3c libcrux_ml_kem_ind_cca_encapsulate_cd( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + uint8_t randomness0[32U]; + libcrux_ml_kem_variant_entropy_preprocess_d8_63( + Eurydice_array_to_slice((size_t)32U, randomness, uint8_t), randomness0); + uint8_t to_hash[64U]; + libcrux_ml_kem_utils_into_padded_array_ea( + Eurydice_array_to_slice((size_t)32U, randomness0, uint8_t), to_hash); + Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( + (size_t)64U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, + size_t); + uint8_t ret[32U]; + libcrux_ml_kem_hash_functions_portable_H_f1_1a( + Eurydice_array_to_slice((size_t)1184U, + libcrux_ml_kem_types_as_slice_cb_50(public_key), + uint8_t), + ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)32U, ret, uint8_t), uint8_t); + uint8_t hashed[64U]; + libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_array_to_slice((size_t)64U, to_hash, uint8_t), hashed); + Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice shared_secret = uu____1.fst; + Eurydice_slice pseudorandomness = uu____1.snd; + Eurydice_slice uu____2 = Eurydice_array_to_slice( + (size_t)1184U, libcrux_ml_kem_types_as_slice_cb_50(public_key), uint8_t); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness0, (size_t)32U * sizeof(uint8_t)); + uint8_t ciphertext[1088U]; + libcrux_ml_kem_ind_cpa_encrypt_60(uu____2, copy_of_randomness, + pseudorandomness, ciphertext); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_ciphertext[1088U]; + memcpy(copy_of_ciphertext, ciphertext, (size_t)1088U * sizeof(uint8_t)); + libcrux_ml_kem_mlkem768_MlKem768Ciphertext ciphertext0 = + libcrux_ml_kem_types_from_01_9f(copy_of_ciphertext); + uint8_t shared_secret_array[32U]; + libcrux_ml_kem_variant_kdf_d8_41(shared_secret, &ciphertext0, + shared_secret_array); + libcrux_ml_kem_mlkem768_MlKem768Ciphertext uu____5 = ciphertext0; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_shared_secret_array[32U]; + memcpy(copy_of_shared_secret_array, shared_secret_array, + (size_t)32U * sizeof(uint8_t)); + tuple_3c lit; + lit.fst = uu____5; + memcpy(lit.snd, copy_of_shared_secret_array, (size_t)32U * sizeof(uint8_t)); + return lit; +} + +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.encapsulate with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- PUBLIC_KEY_SIZE= 1184 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- VECTOR_U_BLOCK_LEN= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +*/ +static inline tuple_3c +libcrux_ml_kem_ind_cca_instantiations_portable_encapsulate_c6( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + libcrux_ml_kem_types_MlKemPublicKey_15 *uu____0 = public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness, (size_t)32U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_encapsulate_cd(uu____0, copy_of_randomness); +} + +/** + Encapsulate ML-KEM 768 + + Generates an ([`MlKem768Ciphertext`], [`MlKemSharedSecret`]) tuple. + The input is a reference to an [`MlKem768PublicKey`] and [`SHARED_SECRET_SIZE`] + bytes of `randomness`. +*/ +static inline tuple_3c libcrux_ml_kem_mlkem768_portable_encapsulate( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + libcrux_ml_kem_types_MlKemPublicKey_15 *uu____0 = public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness, (size_t)32U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_instantiations_portable_encapsulate_c6( + uu____0, copy_of_randomness); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::MlKem)#1} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.cpa_keygen_seed_d8 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_cpa_keygen_seed_d8_0e( + Eurydice_slice key_generation_seed, uint8_t ret[64U]) { + uint8_t seed[33U] = {0U}; + Eurydice_slice_copy( + Eurydice_array_to_subslice2( + seed, (size_t)0U, + LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t), + key_generation_seed, uint8_t); + seed[LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE] = + (uint8_t)(size_t)3U; + uint8_t ret0[64U]; + libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_array_to_slice((size_t)33U, seed, uint8_t), ret0); + memcpy(ret, ret0, (size_t)64U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_As_plus_e.closure +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_matrix_compute_As_plus_e_closure_87(size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** +A monomorphic instance of libcrux_ml_kem.vector.traits.to_standard_domain +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_traits_to_standard_domain_59( + libcrux_ml_kem_vector_portable_vector_type_PortableVector v) { + return libcrux_ml_kem_vector_portable_montgomery_multiply_by_constant_0d( + v, LIBCRUX_ML_KEM_VECTOR_TRAITS_MONTGOMERY_R_SQUARED_MOD_FIELD_MODULUS); +} + +/** +This function found in impl +{libcrux_ml_kem::polynomial::PolynomialRingElement[TraitClause@0]} +*/ +/** +A monomorphic instance of libcrux_ml_kem.polynomial.add_standard_error_reduce_89 +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_polynomial_add_standard_error_reduce_89_03( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *self, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *error) { + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t j = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector + coefficient_normal_form = + libcrux_ml_kem_vector_traits_to_standard_domain_59( + self->coefficients[j]); + libcrux_ml_kem_vector_portable_vector_type_PortableVector uu____0 = + libcrux_ml_kem_vector_portable_barrett_reduce_0d( + libcrux_ml_kem_vector_portable_add_0d(coefficient_normal_form, + &error->coefficients[j])); + self->coefficients[j] = uu____0; + } +} + +/** + Compute  ◦ ŝ + ê +*/ +/** +A monomorphic instance of libcrux_ml_kem.matrix.compute_As_plus_e +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_matrix_compute_As_plus_e_60( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 (*matrix_A)[3U], + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *s_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *error_as_ntt, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 result[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + result[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i0 = (size_t)0U; + i0 < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, matrix_A, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0[3U]), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0[3U]); + i0++) { + size_t i1 = i0; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *row = matrix_A[i1]; + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, row, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0); + i++) { + size_t j = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *matrix_element = + &row[j]; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 product = + libcrux_ml_kem_polynomial_ntt_multiply_89_2a(matrix_element, + &s_as_ntt[j]); + libcrux_ml_kem_polynomial_add_to_ring_element_89_84(&result[i1], + &product); + } + libcrux_ml_kem_polynomial_add_standard_error_reduce_89_03( + &result[i1], &error_as_ntt[i1]); + } + memcpy( + ret, result, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.serialize_uncompressed_ring_element with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics + +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_serialize_uncompressed_ring_element_5b( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *re, uint8_t ret[384U]) { + uint8_t serialized[384U] = {0U}; + for (size_t i = (size_t)0U; + i < LIBCRUX_ML_KEM_POLYNOMIAL_VECTORS_IN_RING_ELEMENT; i++) { + size_t i0 = i; + libcrux_ml_kem_vector_portable_vector_type_PortableVector coefficient = + libcrux_ml_kem_vector_traits_to_unsigned_representative_db( + re->coefficients[i0]); + uint8_t bytes[24U]; + libcrux_ml_kem_vector_portable_serialize_12_0d(coefficient, bytes); + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + serialized, (size_t)24U * i0, (size_t)24U * i0 + (size_t)24U, uint8_t); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)24U, bytes, uint8_t), uint8_t); + } + memcpy(ret, serialized, (size_t)384U * sizeof(uint8_t)); +} + +/** + Call [`serialize_uncompressed_ring_element`] for each ring element. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_secret_key +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- OUT_LEN= 1152 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_serialize_secret_key_b5( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *key, + uint8_t ret[1152U]) { + uint8_t out[1152U] = {0U}; + for (size_t i = (size_t)0U; + i < Eurydice_slice_len( + Eurydice_array_to_slice( + (size_t)3U, key, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0), + libcrux_ml_kem_polynomial_PolynomialRingElement_f0); + i++) { + size_t i0 = i; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 re = key[i0]; + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + out, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + (i0 + (size_t)1U) * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + uint8_t); + uint8_t ret0[384U]; + libcrux_ml_kem_serialize_serialize_uncompressed_ring_element_5b(&re, ret0); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)384U, ret0, uint8_t), uint8_t); + } + memcpy(ret, out, (size_t)1152U * sizeof(uint8_t)); +} + +/** + Concatenate `t` and `ρ` into the public key. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.serialize_public_key +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- RANKED_BYTES_PER_RING_ELEMENT= 1152 +- PUBLIC_KEY_SIZE= 1184 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ind_cpa_serialize_public_key_79( + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *t_as_ntt, + Eurydice_slice seed_for_a, uint8_t ret[1184U]) { + uint8_t public_key_serialized[1184U] = {0U}; + Eurydice_slice uu____0 = Eurydice_array_to_subslice2( + public_key_serialized, (size_t)0U, (size_t)1152U, uint8_t); + uint8_t ret0[1152U]; + libcrux_ml_kem_ind_cpa_serialize_secret_key_b5(t_as_ntt, ret0); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)1152U, ret0, uint8_t), uint8_t); + Eurydice_slice_copy( + Eurydice_array_to_subslice_from((size_t)1184U, public_key_serialized, + (size_t)1152U, uint8_t, size_t), + seed_for_a, uint8_t); + memcpy(ret, public_key_serialized, (size_t)1184U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.generate_keypair +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_MlKem with const generics +- K= 3 +- PRIVATE_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- RANKED_BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_utils_extraction_helper_Keypair768 +libcrux_ml_kem_ind_cpa_generate_keypair_fc(Eurydice_slice key_generation_seed) { + uint8_t hashed[64U]; + libcrux_ml_kem_variant_cpa_keygen_seed_d8_0e(key_generation_seed, hashed); + Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), (size_t)32U, + uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice seed_for_A0 = uu____0.fst; + Eurydice_slice seed_for_secret_and_error = uu____0.snd; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 A_transpose[3U][3U]; + uint8_t ret[34U]; + libcrux_ml_kem_utils_into_padded_array_ea1(seed_for_A0, ret); + libcrux_ml_kem_matrix_sample_matrix_A_38(ret, true, A_transpose); + uint8_t prf_input[33U]; + libcrux_ml_kem_utils_into_padded_array_ea2(seed_for_secret_and_error, + prf_input); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input0[33U]; + memcpy(copy_of_prf_input0, prf_input, (size_t)33U * sizeof(uint8_t)); + tuple_b0 uu____2 = libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc( + copy_of_prf_input0, 0U); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 secret_as_ntt[3U]; + memcpy( + secret_as_ntt, uu____2.fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + uint8_t domain_separator = uu____2.snd; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input[33U]; + memcpy(copy_of_prf_input, prf_input, (size_t)33U * sizeof(uint8_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 error_as_ntt[3U]; + memcpy( + error_as_ntt, + libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc(copy_of_prf_input, + domain_separator) + .fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 t_as_ntt[3U]; + libcrux_ml_kem_matrix_compute_As_plus_e_60(A_transpose, secret_as_ntt, + error_as_ntt, t_as_ntt); + uint8_t seed_for_A[32U]; + Result_00 dst; + Eurydice_slice_to_array2(&dst, seed_for_A0, Eurydice_slice, uint8_t[32U]); + unwrap_41_83(dst, seed_for_A); + uint8_t public_key_serialized[1184U]; + libcrux_ml_kem_ind_cpa_serialize_public_key_79( + t_as_ntt, Eurydice_array_to_slice((size_t)32U, seed_for_A, uint8_t), + public_key_serialized); + uint8_t secret_key_serialized[1152U]; + libcrux_ml_kem_ind_cpa_serialize_secret_key_b5(secret_as_ntt, + secret_key_serialized); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_secret_key_serialized[1152U]; + memcpy(copy_of_secret_key_serialized, secret_key_serialized, + (size_t)1152U * sizeof(uint8_t)); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_public_key_serialized[1184U]; + memcpy(copy_of_public_key_serialized, public_key_serialized, + (size_t)1184U * sizeof(uint8_t)); + libcrux_ml_kem_utils_extraction_helper_Keypair768 lit; + memcpy(lit.fst, copy_of_secret_key_serialized, + (size_t)1152U * sizeof(uint8_t)); + memcpy(lit.snd, copy_of_public_key_serialized, + (size_t)1184U * sizeof(uint8_t)); + return lit; +} + +/** + Serialize the secret key. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.serialize_kem_secret_key +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +- SERIALIZED_KEY_LEN= 2400 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_ind_cca_serialize_kem_secret_key_48( + Eurydice_slice private_key, Eurydice_slice public_key, + Eurydice_slice implicit_rejection_value, uint8_t ret[2400U]) { + uint8_t out[2400U] = {0U}; + size_t pointer = (size_t)0U; + uint8_t *uu____0 = out; + size_t uu____1 = pointer; + size_t uu____2 = pointer; + Eurydice_slice_copy( + Eurydice_array_to_subslice2( + uu____0, uu____1, uu____2 + Eurydice_slice_len(private_key, uint8_t), + uint8_t), + private_key, uint8_t); + pointer = pointer + Eurydice_slice_len(private_key, uint8_t); + uint8_t *uu____3 = out; + size_t uu____4 = pointer; + size_t uu____5 = pointer; + Eurydice_slice_copy( + Eurydice_array_to_subslice2( + uu____3, uu____4, uu____5 + Eurydice_slice_len(public_key, uint8_t), + uint8_t), + public_key, uint8_t); + pointer = pointer + Eurydice_slice_len(public_key, uint8_t); + Eurydice_slice uu____6 = Eurydice_array_to_subslice2( + out, pointer, pointer + LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t); + uint8_t ret0[32U]; + libcrux_ml_kem_hash_functions_portable_H_f1_1a(public_key, ret0); + Eurydice_slice_copy( + uu____6, Eurydice_array_to_slice((size_t)32U, ret0, uint8_t), uint8_t); + pointer = pointer + LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE; + uint8_t *uu____7 = out; + size_t uu____8 = pointer; + size_t uu____9 = pointer; + Eurydice_slice_copy( + Eurydice_array_to_subslice2( + uu____7, uu____8, + uu____9 + Eurydice_slice_len(implicit_rejection_value, uint8_t), + uint8_t), + implicit_rejection_value, uint8_t); + memcpy(ret, out, (size_t)2400U * sizeof(uint8_t)); +} + +/** + Packed API + + Generate a key pair. + + Depending on the `Vector` and `Hasher` used, this requires different hardware + features +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.generate_keypair +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_MlKem with const generics +- K= 3 +- CPA_PRIVATE_KEY_SIZE= 1152 +- PRIVATE_KEY_SIZE= 2400 +- PUBLIC_KEY_SIZE= 1184 +- BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_ind_cca_generate_keypair_8c(uint8_t randomness[64U]) { + Eurydice_slice ind_cpa_keypair_randomness = Eurydice_array_to_subslice2( + randomness, (size_t)0U, + LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t); + Eurydice_slice implicit_rejection_value = Eurydice_array_to_subslice_from( + (size_t)64U, randomness, + LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t, + size_t); + libcrux_ml_kem_utils_extraction_helper_Keypair768 uu____0 = + libcrux_ml_kem_ind_cpa_generate_keypair_fc(ind_cpa_keypair_randomness); + uint8_t ind_cpa_private_key[1152U]; + memcpy(ind_cpa_private_key, uu____0.fst, (size_t)1152U * sizeof(uint8_t)); + uint8_t public_key[1184U]; + memcpy(public_key, uu____0.snd, (size_t)1184U * sizeof(uint8_t)); + uint8_t secret_key_serialized[2400U]; + libcrux_ml_kem_ind_cca_serialize_kem_secret_key_48( + Eurydice_array_to_slice((size_t)1152U, ind_cpa_private_key, uint8_t), + Eurydice_array_to_slice((size_t)1184U, public_key, uint8_t), + implicit_rejection_value, secret_key_serialized); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_secret_key_serialized[2400U]; + memcpy(copy_of_secret_key_serialized, secret_key_serialized, + (size_t)2400U * sizeof(uint8_t)); + libcrux_ml_kem_types_MlKemPrivateKey_55 private_key = + libcrux_ml_kem_types_from_05_f2(copy_of_secret_key_serialized); + libcrux_ml_kem_types_MlKemPrivateKey_55 uu____2 = private_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_public_key[1184U]; + memcpy(copy_of_public_key, public_key, (size_t)1184U * sizeof(uint8_t)); + return libcrux_ml_kem_types_from_17_35( + uu____2, libcrux_ml_kem_types_from_b6_da(copy_of_public_key)); +} + +/** + Portable generate key pair. +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.generate_keypair with const +generics +- K= 3 +- CPA_PRIVATE_KEY_SIZE= 1152 +- PRIVATE_KEY_SIZE= 2400 +- PUBLIC_KEY_SIZE= 1184 +- BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_ind_cca_instantiations_portable_generate_keypair_d5( + uint8_t randomness[64U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[64U]; + memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_generate_keypair_8c(copy_of_randomness); +} + +/** + Generate ML-KEM 768 Key Pair +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_mlkem768_portable_generate_key_pair(uint8_t randomness[64U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[64U]; + memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_instantiations_portable_generate_keypair_d5( + copy_of_randomness); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::Kyber)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.kdf_33 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_kdf_33_f0( + Eurydice_slice shared_secret, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + uint8_t kdf_input[64U]; + libcrux_ml_kem_utils_into_padded_array_ea(shared_secret, kdf_input); + Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( + (size_t)64U, kdf_input, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, + size_t); + uint8_t ret0[32U]; + libcrux_ml_kem_hash_functions_portable_H_f1_1a( + Eurydice_array_to_slice((size_t)1088U, + libcrux_ml_kem_types_as_slice_d4_1d(ciphertext), + uint8_t), + ret0); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)32U, ret0, uint8_t), uint8_t); + uint8_t ret1[32U]; + libcrux_ml_kem_hash_functions_portable_PRF_f1_ee( + Eurydice_array_to_slice((size_t)64U, kdf_input, uint8_t), ret1); + memcpy(ret, ret1, (size_t)32U * sizeof(uint8_t)); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.decapsulate +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_Kyber with const generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CPA_SECRET_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- CIPHERTEXT_SIZE= 1088 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- C1_BLOCK_SIZE= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +- IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 +*/ +static inline void libcrux_ml_kem_ind_cca_decapsulate_700( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)2400U, private_key->value, uint8_t), + (size_t)1152U, uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_secret_key = uu____0.fst; + Eurydice_slice secret_key0 = uu____0.snd; + Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( + secret_key0, (size_t)1184U, uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_public_key = uu____1.fst; + Eurydice_slice secret_key = uu____1.snd; + Eurydice_slice_uint8_t_x2 uu____2 = Eurydice_slice_split_at( + secret_key, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice ind_cpa_public_key_hash = uu____2.fst; + Eurydice_slice implicit_rejection_value = uu____2.snd; + uint8_t decrypted[32U]; + libcrux_ml_kem_ind_cpa_decrypt_43(ind_cpa_secret_key, ciphertext->value, + decrypted); + uint8_t to_hash0[64U]; + libcrux_ml_kem_utils_into_padded_array_ea( + Eurydice_array_to_slice((size_t)32U, decrypted, uint8_t), to_hash0); + Eurydice_slice_copy( + Eurydice_array_to_subslice_from( + (size_t)64U, to_hash0, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, + uint8_t, size_t), + ind_cpa_public_key_hash, uint8_t); + uint8_t hashed[64U]; + libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_array_to_slice((size_t)64U, to_hash0, uint8_t), hashed); + Eurydice_slice_uint8_t_x2 uu____3 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice shared_secret0 = uu____3.fst; + Eurydice_slice pseudorandomness = uu____3.snd; + uint8_t to_hash[1120U]; + libcrux_ml_kem_utils_into_padded_array_ea0(implicit_rejection_value, to_hash); + Eurydice_slice uu____4 = Eurydice_array_to_subslice_from( + (size_t)1120U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, + uint8_t, size_t); + Eurydice_slice_copy(uu____4, libcrux_ml_kem_types_as_ref_00_24(ciphertext), + uint8_t); + uint8_t implicit_rejection_shared_secret0[32U]; + libcrux_ml_kem_hash_functions_portable_PRF_f1_ee( + Eurydice_array_to_slice((size_t)1120U, to_hash, uint8_t), + implicit_rejection_shared_secret0); + Eurydice_slice uu____5 = ind_cpa_public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_decrypted[32U]; + memcpy(copy_of_decrypted, decrypted, (size_t)32U * sizeof(uint8_t)); + uint8_t expected_ciphertext[1088U]; + libcrux_ml_kem_ind_cpa_encrypt_60(uu____5, copy_of_decrypted, + pseudorandomness, expected_ciphertext); + uint8_t implicit_rejection_shared_secret[32U]; + libcrux_ml_kem_variant_kdf_33_f0( + Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret0, + uint8_t), + ciphertext, implicit_rejection_shared_secret); + uint8_t shared_secret[32U]; + libcrux_ml_kem_variant_kdf_33_f0(shared_secret0, ciphertext, shared_secret); + uint8_t ret0[32U]; + libcrux_ml_kem_constant_time_ops_compare_ciphertexts_select_shared_secret_in_constant_time( + libcrux_ml_kem_types_as_ref_00_24(ciphertext), + Eurydice_array_to_slice((size_t)1088U, expected_ciphertext, uint8_t), + Eurydice_array_to_slice((size_t)32U, shared_secret, uint8_t), + Eurydice_array_to_slice((size_t)32U, implicit_rejection_shared_secret, + uint8_t), + ret0); + memcpy(ret, ret0, (size_t)32U * sizeof(uint8_t)); +} + +/** + Portable decapsulate +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.kyber_decapsulate with const +generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CPA_SECRET_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- CIPHERTEXT_SIZE= 1088 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- C1_BLOCK_SIZE= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +- IMPLICIT_REJECTION_HASH_INPUT_SIZE= 1120 +*/ +static inline void +libcrux_ml_kem_ind_cca_instantiations_portable_kyber_decapsulate_fc( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + libcrux_ml_kem_ind_cca_decapsulate_700(private_key, ciphertext, ret); +} + +/** + Decapsulate Kyber 768 + + Generates an [`MlKemSharedSecret`]. + The input is a reference to an [`MlKem768PrivateKey`] and an + [`MlKem768Ciphertext`]. +*/ +static inline void libcrux_ml_kem_mlkem768_portable_kyber_decapsulate( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext, uint8_t ret[32U]) { + libcrux_ml_kem_ind_cca_instantiations_portable_kyber_decapsulate_fc( + private_key, ciphertext, ret); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::Kyber)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.entropy_preprocess_33 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_entropy_preprocess_33_8a( + Eurydice_slice randomness, uint8_t ret[32U]) { + libcrux_ml_kem_hash_functions_portable_H_f1_1a(randomness, ret); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.encapsulate +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_Kyber with const generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- PUBLIC_KEY_SIZE= 1184 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- VECTOR_U_BLOCK_LEN= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +*/ +static inline tuple_3c libcrux_ml_kem_ind_cca_encapsulate_cd0( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + uint8_t randomness0[32U]; + libcrux_ml_kem_variant_entropy_preprocess_33_8a( + Eurydice_array_to_slice((size_t)32U, randomness, uint8_t), randomness0); + uint8_t to_hash[64U]; + libcrux_ml_kem_utils_into_padded_array_ea( + Eurydice_array_to_slice((size_t)32U, randomness0, uint8_t), to_hash); + Eurydice_slice uu____0 = Eurydice_array_to_subslice_from( + (size_t)64U, to_hash, LIBCRUX_ML_KEM_CONSTANTS_H_DIGEST_SIZE, uint8_t, + size_t); + uint8_t ret[32U]; + libcrux_ml_kem_hash_functions_portable_H_f1_1a( + Eurydice_array_to_slice((size_t)1184U, + libcrux_ml_kem_types_as_slice_cb_50(public_key), + uint8_t), + ret); + Eurydice_slice_copy( + uu____0, Eurydice_array_to_slice((size_t)32U, ret, uint8_t), uint8_t); + uint8_t hashed[64U]; + libcrux_ml_kem_hash_functions_portable_G_f1_e4( + Eurydice_array_to_slice((size_t)64U, to_hash, uint8_t), hashed); + Eurydice_slice_uint8_t_x2 uu____1 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), + LIBCRUX_ML_KEM_CONSTANTS_SHARED_SECRET_SIZE, uint8_t, + Eurydice_slice_uint8_t_x2); + Eurydice_slice shared_secret = uu____1.fst; + Eurydice_slice pseudorandomness = uu____1.snd; + Eurydice_slice uu____2 = Eurydice_array_to_slice( + (size_t)1184U, libcrux_ml_kem_types_as_slice_cb_50(public_key), uint8_t); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness0, (size_t)32U * sizeof(uint8_t)); + uint8_t ciphertext[1088U]; + libcrux_ml_kem_ind_cpa_encrypt_60(uu____2, copy_of_randomness, + pseudorandomness, ciphertext); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_ciphertext[1088U]; + memcpy(copy_of_ciphertext, ciphertext, (size_t)1088U * sizeof(uint8_t)); + libcrux_ml_kem_mlkem768_MlKem768Ciphertext ciphertext0 = + libcrux_ml_kem_types_from_01_9f(copy_of_ciphertext); + uint8_t shared_secret_array[32U]; + libcrux_ml_kem_variant_kdf_33_f0(shared_secret, &ciphertext0, + shared_secret_array); + libcrux_ml_kem_mlkem768_MlKem768Ciphertext uu____5 = ciphertext0; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_shared_secret_array[32U]; + memcpy(copy_of_shared_secret_array, shared_secret_array, + (size_t)32U * sizeof(uint8_t)); + tuple_3c lit; + lit.fst = uu____5; + memcpy(lit.snd, copy_of_shared_secret_array, (size_t)32U * sizeof(uint8_t)); + return lit; +} + +/** + Portable encapsulate +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.kyber_encapsulate with const +generics +- K= 3 +- CIPHERTEXT_SIZE= 1088 +- PUBLIC_KEY_SIZE= 1184 +- T_AS_NTT_ENCODED_SIZE= 1152 +- C1_SIZE= 960 +- C2_SIZE= 128 +- VECTOR_U_COMPRESSION_FACTOR= 10 +- VECTOR_V_COMPRESSION_FACTOR= 4 +- VECTOR_U_BLOCK_LEN= 320 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +- ETA2= 2 +- ETA2_RANDOMNESS_SIZE= 128 +*/ +static inline tuple_3c +libcrux_ml_kem_ind_cca_instantiations_portable_kyber_encapsulate_7a( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + libcrux_ml_kem_types_MlKemPublicKey_15 *uu____0 = public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness, (size_t)32U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_encapsulate_cd0(uu____0, copy_of_randomness); +} + +/** + Encapsulate Kyber 768 + + Generates an ([`MlKem768Ciphertext`], [`MlKemSharedSecret`]) tuple. + The input is a reference to an [`MlKem768PublicKey`] and [`SHARED_SECRET_SIZE`] + bytes of `randomness`. +*/ +static inline tuple_3c libcrux_ml_kem_mlkem768_portable_kyber_encapsulate( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key, + uint8_t randomness[32U]) { + libcrux_ml_kem_types_MlKemPublicKey_15 *uu____0 = public_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[32U]; + memcpy(copy_of_randomness, randomness, (size_t)32U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_instantiations_portable_kyber_encapsulate_7a( + uu____0, copy_of_randomness); +} + +/** +This function found in impl {(libcrux_ml_kem::variant::Variant for +libcrux_ml_kem::variant::Kyber)} +*/ +/** +A monomorphic instance of libcrux_ml_kem.variant.cpa_keygen_seed_33 +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +*/ +static KRML_MUSTINLINE void libcrux_ml_kem_variant_cpa_keygen_seed_33_b6( + Eurydice_slice key_generation_seed, uint8_t ret[64U]) { + libcrux_ml_kem_hash_functions_portable_G_f1_e4(key_generation_seed, ret); +} + +/** +A monomorphic instance of libcrux_ml_kem.ind_cpa.generate_keypair +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_Kyber with const generics +- K= 3 +- PRIVATE_KEY_SIZE= 1152 +- PUBLIC_KEY_SIZE= 1184 +- RANKED_BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_utils_extraction_helper_Keypair768 +libcrux_ml_kem_ind_cpa_generate_keypair_fc0( + Eurydice_slice key_generation_seed) { + uint8_t hashed[64U]; + libcrux_ml_kem_variant_cpa_keygen_seed_33_b6(key_generation_seed, hashed); + Eurydice_slice_uint8_t_x2 uu____0 = Eurydice_slice_split_at( + Eurydice_array_to_slice((size_t)64U, hashed, uint8_t), (size_t)32U, + uint8_t, Eurydice_slice_uint8_t_x2); + Eurydice_slice seed_for_A0 = uu____0.fst; + Eurydice_slice seed_for_secret_and_error = uu____0.snd; + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 A_transpose[3U][3U]; + uint8_t ret[34U]; + libcrux_ml_kem_utils_into_padded_array_ea1(seed_for_A0, ret); + libcrux_ml_kem_matrix_sample_matrix_A_38(ret, true, A_transpose); + uint8_t prf_input[33U]; + libcrux_ml_kem_utils_into_padded_array_ea2(seed_for_secret_and_error, + prf_input); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input0[33U]; + memcpy(copy_of_prf_input0, prf_input, (size_t)33U * sizeof(uint8_t)); + tuple_b0 uu____2 = libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc( + copy_of_prf_input0, 0U); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 secret_as_ntt[3U]; + memcpy( + secret_as_ntt, uu____2.fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + uint8_t domain_separator = uu____2.snd; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_prf_input[33U]; + memcpy(copy_of_prf_input, prf_input, (size_t)33U * sizeof(uint8_t)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 error_as_ntt[3U]; + memcpy( + error_as_ntt, + libcrux_ml_kem_ind_cpa_sample_vector_cbd_then_ntt_fc(copy_of_prf_input, + domain_separator) + .fst, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 t_as_ntt[3U]; + libcrux_ml_kem_matrix_compute_As_plus_e_60(A_transpose, secret_as_ntt, + error_as_ntt, t_as_ntt); + uint8_t seed_for_A[32U]; + Result_00 dst; + Eurydice_slice_to_array2(&dst, seed_for_A0, Eurydice_slice, uint8_t[32U]); + unwrap_41_83(dst, seed_for_A); + uint8_t public_key_serialized[1184U]; + libcrux_ml_kem_ind_cpa_serialize_public_key_79( + t_as_ntt, Eurydice_array_to_slice((size_t)32U, seed_for_A, uint8_t), + public_key_serialized); + uint8_t secret_key_serialized[1152U]; + libcrux_ml_kem_ind_cpa_serialize_secret_key_b5(secret_as_ntt, + secret_key_serialized); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_secret_key_serialized[1152U]; + memcpy(copy_of_secret_key_serialized, secret_key_serialized, + (size_t)1152U * sizeof(uint8_t)); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_public_key_serialized[1184U]; + memcpy(copy_of_public_key_serialized, public_key_serialized, + (size_t)1184U * sizeof(uint8_t)); + libcrux_ml_kem_utils_extraction_helper_Keypair768 lit; + memcpy(lit.fst, copy_of_secret_key_serialized, + (size_t)1152U * sizeof(uint8_t)); + memcpy(lit.snd, copy_of_public_key_serialized, + (size_t)1184U * sizeof(uint8_t)); + return lit; +} + +/** + Packed API + + Generate a key pair. + + Depending on the `Vector` and `Hasher` used, this requires different hardware + features +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.generate_keypair +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector, +libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]], +libcrux_ml_kem_variant_Kyber with const generics +- K= 3 +- CPA_PRIVATE_KEY_SIZE= 1152 +- PRIVATE_KEY_SIZE= 2400 +- PUBLIC_KEY_SIZE= 1184 +- BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_ind_cca_generate_keypair_8c0(uint8_t randomness[64U]) { + Eurydice_slice ind_cpa_keypair_randomness = Eurydice_array_to_subslice2( + randomness, (size_t)0U, + LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t); + Eurydice_slice implicit_rejection_value = Eurydice_array_to_subslice_from( + (size_t)64U, randomness, + LIBCRUX_ML_KEM_CONSTANTS_CPA_PKE_KEY_GENERATION_SEED_SIZE, uint8_t, + size_t); + libcrux_ml_kem_utils_extraction_helper_Keypair768 uu____0 = + libcrux_ml_kem_ind_cpa_generate_keypair_fc0(ind_cpa_keypair_randomness); + uint8_t ind_cpa_private_key[1152U]; + memcpy(ind_cpa_private_key, uu____0.fst, (size_t)1152U * sizeof(uint8_t)); + uint8_t public_key[1184U]; + memcpy(public_key, uu____0.snd, (size_t)1184U * sizeof(uint8_t)); + uint8_t secret_key_serialized[2400U]; + libcrux_ml_kem_ind_cca_serialize_kem_secret_key_48( + Eurydice_array_to_slice((size_t)1152U, ind_cpa_private_key, uint8_t), + Eurydice_array_to_slice((size_t)1184U, public_key, uint8_t), + implicit_rejection_value, secret_key_serialized); + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_secret_key_serialized[2400U]; + memcpy(copy_of_secret_key_serialized, secret_key_serialized, + (size_t)2400U * sizeof(uint8_t)); + libcrux_ml_kem_types_MlKemPrivateKey_55 private_key = + libcrux_ml_kem_types_from_05_f2(copy_of_secret_key_serialized); + libcrux_ml_kem_types_MlKemPrivateKey_55 uu____2 = private_key; + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_public_key[1184U]; + memcpy(copy_of_public_key, public_key, (size_t)1184U * sizeof(uint8_t)); + return libcrux_ml_kem_types_from_17_35( + uu____2, libcrux_ml_kem_types_from_b6_da(copy_of_public_key)); +} + +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.kyber_generate_keypair with const +generics +- K= 3 +- CPA_PRIVATE_KEY_SIZE= 1152 +- PRIVATE_KEY_SIZE= 2400 +- PUBLIC_KEY_SIZE= 1184 +- BYTES_PER_RING_ELEMENT= 1152 +- ETA1= 2 +- ETA1_RANDOMNESS_SIZE= 128 +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_ind_cca_instantiations_portable_kyber_generate_keypair_9b( + uint8_t randomness[64U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[64U]; + memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_generate_keypair_8c0(copy_of_randomness); +} + +/** + Generate Kyber 768 Key Pair +*/ +static inline libcrux_ml_kem_mlkem768_MlKem768KeyPair +libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair( + uint8_t randomness[64U]) { + /* Passing arrays by value in Rust generates a copy in C */ + uint8_t copy_of_randomness[64U]; + memcpy(copy_of_randomness, randomness, (size_t)64U * sizeof(uint8_t)); + return libcrux_ml_kem_ind_cca_instantiations_portable_kyber_generate_keypair_9b( + copy_of_randomness); +} + +/** + Validate an ML-KEM private key. + + This implements the Hash check in 7.3 3. + Note that the size checks in 7.2 1 and 2 are covered by the `SECRET_KEY_SIZE` + and `CIPHERTEXT_SIZE` in the `private_key` and `ciphertext` types. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.validate_private_key +with types libcrux_ml_kem_hash_functions_portable_PortableHash[[$3size_t]] +with const generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CIPHERTEXT_SIZE= 1088 +*/ +static KRML_MUSTINLINE bool libcrux_ml_kem_ind_cca_validate_private_key_e7( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *_ciphertext) { + uint8_t t[32U]; + libcrux_ml_kem_hash_functions_portable_H_f1_1a( + Eurydice_array_to_subslice2(private_key->value, (size_t)384U * (size_t)3U, + (size_t)768U * (size_t)3U + (size_t)32U, + uint8_t), + t); + Eurydice_slice expected = Eurydice_array_to_subslice2( + private_key->value, (size_t)768U * (size_t)3U + (size_t)32U, + (size_t)768U * (size_t)3U + (size_t)64U, uint8_t); + return core_array_equality___core__cmp__PartialEq__0___Slice_U____for__Array_T__N___3__eq( + (size_t)32U, t, &expected, uint8_t, uint8_t, bool); +} + +/** + Portable private key validation +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.validate_private_key with const +generics +- K= 3 +- SECRET_KEY_SIZE= 2400 +- CIPHERTEXT_SIZE= 1088 +*/ +static KRML_MUSTINLINE bool +libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_9c( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext) { + return libcrux_ml_kem_ind_cca_validate_private_key_e7(private_key, + ciphertext); +} + +/** + Validate a private key. + + Returns `true` if valid, and `false` otherwise. +*/ +static inline bool libcrux_ml_kem_mlkem768_portable_validate_private_key( + libcrux_ml_kem_types_MlKemPrivateKey_55 *private_key, + libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext) { + return libcrux_ml_kem_ind_cca_instantiations_portable_validate_private_key_9c( + private_key, ciphertext); +} + +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_ring_elements_reduced.closure with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- PUBLIC_KEY_SIZE= 1184 +- K= 3 +*/ +static inline libcrux_ml_kem_polynomial_PolynomialRingElement_f0 +libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_closure_cd0( + size_t _i) { + return libcrux_ml_kem_polynomial_ZERO_89_ea(); +} + +/** + This function deserializes ring elements and reduces the result by the field + modulus. + + This function MUST NOT be used on secret inputs. +*/ +/** +A monomorphic instance of +libcrux_ml_kem.serialize.deserialize_ring_elements_reduced with types +libcrux_ml_kem_vector_portable_vector_type_PortableVector with const generics +- PUBLIC_KEY_SIZE= 1184 +- K= 3 +*/ +static KRML_MUSTINLINE void +libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_330( + Eurydice_slice public_key, + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 ret[3U]) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 deserialized_pk[3U]; + for (size_t i = (size_t)0U; i < (size_t)3U; i++) { + deserialized_pk[i] = libcrux_ml_kem_polynomial_ZERO_89_ea(); + } + for (size_t i = (size_t)0U; + i < Eurydice_slice_len(public_key, uint8_t) / + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT; + i++) { + size_t i0 = i; + Eurydice_slice ring_element = Eurydice_slice_subslice2( + public_key, i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + i0 * LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT + + LIBCRUX_ML_KEM_CONSTANTS_BYTES_PER_RING_ELEMENT, + uint8_t); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 uu____0 = + libcrux_ml_kem_serialize_deserialize_to_reduced_ring_element_4c( + ring_element); + deserialized_pk[i0] = uu____0; + } + memcpy( + ret, deserialized_pk, + (size_t)3U * sizeof(libcrux_ml_kem_polynomial_PolynomialRingElement_f0)); +} + +/** + Validate an ML-KEM public key. + + This implements the Modulus check in 7.2 2. + Note that the size check in 7.2 1 is covered by the `PUBLIC_KEY_SIZE` in the + `public_key` type. +*/ +/** +A monomorphic instance of libcrux_ml_kem.ind_cca.validate_public_key +with types libcrux_ml_kem_vector_portable_vector_type_PortableVector +with const generics +- K= 3 +- RANKED_BYTES_PER_RING_ELEMENT= 1152 +- PUBLIC_KEY_SIZE= 1184 +*/ +static KRML_MUSTINLINE bool libcrux_ml_kem_ind_cca_validate_public_key_19( + uint8_t *public_key) { + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 deserialized_pk[3U]; + libcrux_ml_kem_serialize_deserialize_ring_elements_reduced_330( + Eurydice_array_to_subslice_to((size_t)1184U, public_key, (size_t)1152U, + uint8_t, size_t), + deserialized_pk); + libcrux_ml_kem_polynomial_PolynomialRingElement_f0 *uu____0 = deserialized_pk; + uint8_t public_key_serialized[1184U]; + libcrux_ml_kem_ind_cpa_serialize_public_key_79( + uu____0, + Eurydice_array_to_subslice_from((size_t)1184U, public_key, (size_t)1152U, + uint8_t, size_t), + public_key_serialized); + return core_array_equality___core__cmp__PartialEq__Array_U__N___for__Array_T__N____eq( + (size_t)1184U, public_key, public_key_serialized, uint8_t, uint8_t, bool); +} + +/** + Portable public key validation +*/ +/** +A monomorphic instance of +libcrux_ml_kem.ind_cca.instantiations.portable.validate_public_key with const +generics +- K= 3 +- RANKED_BYTES_PER_RING_ELEMENT= 1152 +- PUBLIC_KEY_SIZE= 1184 +*/ +static KRML_MUSTINLINE bool +libcrux_ml_kem_ind_cca_instantiations_portable_validate_public_key_4b( + uint8_t *public_key) { + return libcrux_ml_kem_ind_cca_validate_public_key_19(public_key); +} + +/** + Validate a public key. + + Returns `true` if valid, and `false` otherwise. +*/ +static inline bool libcrux_ml_kem_mlkem768_portable_validate_public_key( + libcrux_ml_kem_types_MlKemPublicKey_15 *public_key) { + return libcrux_ml_kem_ind_cca_instantiations_portable_validate_public_key_4b( + public_key->value); +} + +/** +This function found in impl {(core::clone::Clone for +libcrux_ml_kem::vector::portable::vector_type::PortableVector)} +*/ +static inline libcrux_ml_kem_vector_portable_vector_type_PortableVector +libcrux_ml_kem_vector_portable_vector_type_clone_3b( + libcrux_ml_kem_vector_portable_vector_type_PortableVector *self) { + return self[0U]; +} + +typedef int16_t libcrux_ml_kem_vector_portable_vector_type_FieldElement; + +typedef int16_t + libcrux_ml_kem_vector_portable_arithmetic_MontgomeryFieldElement; + +typedef int16_t + libcrux_ml_kem_vector_portable_arithmetic_FieldElementTimesMontgomeryR; + +#if defined(__cplusplus) +} +#endif + +#define __libcrux_mlkem768_portable_H_DEFINED +#endif + + +/* rename some types to be a bit more ergonomic */ +#define libcrux_mlkem768_keypair libcrux_ml_kem_mlkem768_MlKem768KeyPair_s +#define libcrux_mlkem768_pk_valid_result Option_92_s +#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_15_s +#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_55_s +#define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s +#define libcrux_mlkem768_enc_result tuple_3c_s +/* defines for PRNG inputs */ +#define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN 64 +#define LIBCRUX_ML_KEM_ENC_PRNG_LEN 32 diff --git a/log.c b/log.c index 9fc1a2e..23ad10c 100644 --- a/log.c +++ b/log.c @@ -1,4 +1,4 @@ -/* $OpenBSD: log.c,v 1.61 2023/12/06 21:06:48 djm Exp $ */ +/* $OpenBSD: log.c,v 1.62 2024/06/27 22:36:44 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -447,19 +447,6 @@ sshlogdie(const char *file, const char *func, int line, int showfunc, cleanup_exit(255); } -void -sshsigdie(const char *file, const char *func, int line, int showfunc, - LogLevel level, const char *suffix, const char *fmt, ...) -{ - va_list args; - - va_start(args, fmt); - sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, - suffix, fmt, args); - va_end(args); - _exit(1); -} - void sshlogv(const char *file, const char *func, int line, int showfunc, LogLevel level, const char *suffix, const char *fmt, va_list args) diff --git a/log.h b/log.h index 6218b41..8fe350b 100644 --- a/log.h +++ b/log.h @@ -1,4 +1,4 @@ -/* $OpenBSD: log.h,v 1.33 2021/04/15 16:24:31 markus Exp $ */ +/* $OpenBSD: log.h,v 1.34 2024/06/27 22:36:44 djm Exp $ */ /* * Author: Tatu Ylonen @@ -72,9 +72,6 @@ void sshlog(const char *, const char *, int, int, __attribute__((format(printf, 7, 8))); void sshlogv(const char *, const char *, int, int, LogLevel, const char *, const char *, va_list); -void sshsigdie(const char *, const char *, int, int, - LogLevel, const char *, const char *, ...) __attribute__((noreturn)) - __attribute__((format(printf, 7, 8))); void sshlogdie(const char *, const char *, int, int, LogLevel, const char *, const char *, ...) __attribute__((noreturn)) __attribute__((format(printf, 7, 8))); @@ -93,7 +90,6 @@ void sshlogdirect(LogLevel, int, const char *, ...) #define error(...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) #define fatal(...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) #define logdie(...) sshlogdie(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) -#define sigdie(...) sshsigdie(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) /* Variants that prepend the caller's function */ #define do_log2_f(level, ...) sshlog(__FILE__, __func__, __LINE__, 1, level, NULL, __VA_ARGS__) @@ -105,7 +101,6 @@ void sshlogdirect(LogLevel, int, const char *, ...) #define error_f(...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) #define fatal_f(...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, NULL, __VA_ARGS__) #define logdie_f(...) sshlogdie(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) -#define sigdie_f(...) sshsigdie(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, NULL, __VA_ARGS__) /* Variants that appends a ssh_err message */ #define do_log2_r(r, level, ...) sshlog(__FILE__, __func__, __LINE__, 0, level, ssh_err(r), __VA_ARGS__) @@ -117,7 +112,6 @@ void sshlogdirect(LogLevel, int, const char *, ...) #define error_r(r, ...) sshlog(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) #define fatal_r(r, ...) sshfatal(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) #define logdie_r(r, ...) sshlogdie(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) -#define sigdie_r(r, ...) sshsigdie(__FILE__, __func__, __LINE__, 0, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) #define do_log2_fr(r, level, ...) sshlog(__FILE__, __func__, __LINE__, 1, level, ssh_err(r), __VA_ARGS__) #define debug3_fr(r, ...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG3, ssh_err(r), __VA_ARGS__) #define debug2_fr(r, ...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_DEBUG2, ssh_err(r), __VA_ARGS__) @@ -127,6 +121,5 @@ void sshlogdirect(LogLevel, int, const char *, ...) #define error_fr(r, ...) sshlog(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) #define fatal_fr(r, ...) sshfatal(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_FATAL, ssh_err(r), __VA_ARGS__) #define logdie_fr(r, ...) sshlogdie(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) -#define sigdie_fr(r, ...) sshsigdie(__FILE__, __func__, __LINE__, 1, SYSLOG_LEVEL_ERROR, ssh_err(r), __VA_ARGS__) #endif diff --git a/loginrec.c b/loginrec.c index 4f21499..7460bb2 100644 --- a/loginrec.c +++ b/loginrec.c @@ -25,27 +25,6 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -/* - * The btmp logging code is derived from login.c from util-linux and is under - * the the following license: - * - * Copyright (c) 1980, 1987, 1988 The Regents of the University of California. - * All rights reserved. - * - * Redistribution and use in source and binary forms are permitted - * provided that the above copyright notice and this paragraph are - * duplicated in all such forms and that any documentation, - * advertising materials, and other materials related to such - * distribution and use acknowledge that the software was developed - * by the University of California, Berkeley. The name of the - * University may not be used to endorse or promote products derived - * from this software without specific prior written permission. - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED - * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. - */ - - /** ** loginrec.c: platform-independent login recording and lastlog retrieval **/ @@ -603,6 +582,9 @@ line_abbrevname(char *dst, const char *src, int dstsize) memset(dst, '\0', dstsize); + if (strcmp(src, "ssh:notty") == 0) + return dst; + /* Always skip prefix if present */ if (strncmp(src, "/dev/", 5) == 0) src += 5; @@ -1651,23 +1633,20 @@ utmpx_get_entry(struct logininfo *li) #endif /* USE_UTMPX && HAVE_SETUTXDB && UTXDB_LASTLOGIN && HAVE_GETUTXUSER */ #ifdef USE_BTMP - /* - * Logs failed login attempts in _PATH_BTMP if that exists. - * The most common login failure is to give password instead of username. - * So the _PATH_BTMP file checked for the correct permission, so that - * only root can read it. - */ - +/* + * Logs failed login attempts in _PATH_BTMP if that exists. + * The most common login failure is to give password instead of username. + * So the _PATH_BTMP file checked for the correct permission, so that only + * root can read it. + */ void record_failed_login(struct ssh *ssh, const char *username, const char *hostname, const char *ttyn) { int fd; struct utmp ut; - struct sockaddr_storage from; - socklen_t fromlen = sizeof(from); - struct sockaddr_in *a4; - struct sockaddr_in6 *a6; + struct logininfo li; + socklen_t fromlen = sizeof(li.hostaddr); time_t t; struct stat fst; @@ -1683,47 +1662,31 @@ record_failed_login(struct ssh *ssh, const char *username, const char *hostname, strerror(errno)); goto out; } - if((fst.st_mode & (S_IXGRP | S_IRWXO)) || (fst.st_uid != 0)){ + if ((fst.st_mode & (S_IXGRP | S_IRWXO)) || fst.st_uid != 0) { logit("Excess permission or bad ownership on file %s", _PATH_BTMP); goto out; } - memset(&ut, 0, sizeof(ut)); - /* strncpy because we don't necessarily want nul termination */ - strncpy(ut.ut_user, username, sizeof(ut.ut_user)); - strlcpy(ut.ut_line, "ssh:notty", sizeof(ut.ut_line)); - + /* Construct a logininfo and turn it into a utmp */ + memset(&li, 0, sizeof(li)); + li.type = LTYPE_LOGIN; + li.pid = getpid(); + strlcpy(li.line, "ssh:notty", sizeof(li.line)); + strlcpy(li.username, username, sizeof(li.username)); + strlcpy(li.hostname, hostname, sizeof(li.hostname)); time(&t); - ut.ut_time = t; /* ut_time is not always a time_t */ - ut.ut_type = LOGIN_PROCESS; - ut.ut_pid = getpid(); - - /* strncpy because we don't necessarily want nul termination */ - strncpy(ut.ut_host, hostname, sizeof(ut.ut_host)); - - if (ssh_packet_connection_is_on_socket(ssh) && - getpeername(ssh_packet_get_connection_in(ssh), - (struct sockaddr *)&from, &fromlen) == 0) { - ipv64_normalise_mapped(&from, &fromlen); - if (from.ss_family == AF_INET) { - a4 = (struct sockaddr_in *)&from; - memcpy(&ut.ut_addr, &(a4->sin_addr), - MIN_SIZEOF(ut.ut_addr, a4->sin_addr)); - } -#ifdef HAVE_ADDR_V6_IN_UTMP - if (from.ss_family == AF_INET6) { - a6 = (struct sockaddr_in6 *)&from; - memcpy(&ut.ut_addr_v6, &(a6->sin6_addr), - MIN_SIZEOF(ut.ut_addr_v6, a6->sin6_addr)); - } -#endif + li.tv_sec = t > 0 ? (unsigned long)t : 0; + if (ssh_packet_connection_is_on_socket(ssh)) { + (void)getpeername(ssh_packet_get_connection_in(ssh), + &li.hostaddr.sa, &fromlen); } + construct_utmp(&li, &ut); - if (atomicio(vwrite, fd, &ut, sizeof(ut)) != sizeof(ut)) + if (atomicio(vwrite, fd, &ut, sizeof(ut)) != sizeof(ut)) { error("Failed to write to %s: %s", _PATH_BTMP, strerror(errno)); - + } out: close(fd); } diff --git a/m4/openssh.m4 b/m4/openssh.m4 index 033df50..176a8d1 100644 --- a/m4/openssh.m4 +++ b/m4/openssh.m4 @@ -20,7 +20,10 @@ char *f2(char *s, ...) { va_end(args); return strdup(ret); } +int i; +double d; const char *f3(int s) { + i = (int)d; return s ? "good" : "gooder"; } int main(int argc, char **argv) { diff --git a/match.c b/match.c index d6af256..3ef5369 100644 --- a/match.c +++ b/match.c @@ -1,4 +1,4 @@ -/* $OpenBSD: match.c,v 1.44 2023/04/06 03:19:32 djm Exp $ */ +/* $OpenBSD: match.c,v 1.45 2024/09/06 02:30:44 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -241,7 +241,7 @@ match_user(const char *user, const char *host, const char *ipaddr, /* test mode */ if (user == NULL && host == NULL && ipaddr == NULL) { - if ((p = strchr(pattern, '@')) != NULL && + if ((p = strrchr(pattern, '@')) != NULL && match_host_and_ip(NULL, NULL, p + 1) < 0) return -1; return 0; @@ -250,11 +250,11 @@ match_user(const char *user, const char *host, const char *ipaddr, if (user == NULL) return 0; /* shouldn't happen */ - if ((p = strchr(pattern, '@')) == NULL) + if (strrchr(pattern, '@') == NULL) return match_pattern(user, pattern); pat = xstrdup(pattern); - p = strchr(pat, '@'); + p = strrchr(pat, '@'); *p++ = '\0'; if ((ret = match_pattern(user, pat)) == 1) diff --git a/misc.c b/misc.c index 5dc9d54..afdf514 100644 --- a/misc.c +++ b/misc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.c,v 1.190 2024/03/04 02:16:11 djm Exp $ */ +/* $OpenBSD: misc.c,v 1.196 2024/06/06 17:15:25 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2005-2020 Damien Miller. All rights reserved. @@ -563,6 +563,14 @@ a2tun(const char *s, int *remote) #define DAYS (HOURS * 24) #define WEEKS (DAYS * 7) +static char * +scandigits(char *s) +{ + while (isdigit((unsigned char)*s)) + s++; + return s; +} + /* * Convert a time string into seconds; format is * a sequence of: @@ -587,28 +595,31 @@ a2tun(const char *s, int *remote) int convtime(const char *s) { - long total, secs, multiplier; - const char *p; - char *endp; - - errno = 0; - total = 0; - p = s; + int secs, total = 0, multiplier; + char *p, *os, *np, c = 0; + const char *errstr; - if (p == NULL || *p == '\0') + if (s == NULL || *s == '\0') + return -1; + p = os = strdup(s); /* deal with const */ + if (os == NULL) return -1; while (*p) { - secs = strtol(p, &endp, 10); - if (p == endp || - (errno == ERANGE && (secs == INT_MIN || secs == INT_MAX)) || - secs < 0) - return -1; + np = scandigits(p); + if (np) { + c = *np; + *np = '\0'; + } + secs = (int)strtonum(p, 0, INT_MAX, &errstr); + if (errstr) + goto fail; + *np = c; multiplier = 1; - switch (*endp++) { + switch (c) { case '\0': - endp--; + np--; /* back up */ break; case 's': case 'S': @@ -630,20 +641,23 @@ convtime(const char *s) multiplier = WEEKS; break; default: - return -1; + goto fail; } if (secs > INT_MAX / multiplier) - return -1; + goto fail; secs *= multiplier; if (total > INT_MAX - secs) - return -1; + goto fail; total += secs; if (total < 0) - return -1; - p = endp; + goto fail; + p = ++np; } - + free(os); return total; +fail: + free(os); + return -1; } #define TF_BUFS 8 @@ -1859,9 +1873,9 @@ static const struct { int parse_ipqos(const char *cp) { + const char *errstr; u_int i; - char *ep; - long val; + int val; if (cp == NULL) return -1; @@ -1870,8 +1884,8 @@ parse_ipqos(const char *cp) return ipqos[i].value; } /* Try parsing as an integer */ - val = strtol(cp, &ep, 0); - if (*cp == '\0' || *ep != '\0' || val < 0 || val > 255) + val = (int)strtonum(cp, 0, 255, &errstr); + if (errstr) return -1; return val; } @@ -1990,6 +2004,19 @@ forward_equals(const struct Forward *a, const struct Forward *b) return 1; } +/* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */ +int +permitopen_port(const char *p) +{ + int port; + + if (strcmp(p, "*") == 0) + return FWD_PERMIT_ANY_PORT; + if ((port = a2port(p)) > 0) + return port; + return -1; +} + /* returns 1 if process is already daemonized, 0 otherwise */ int daemonized(void) @@ -2414,13 +2441,10 @@ const char * atoi_err(const char *nptr, int *val) { const char *errstr = NULL; - long long num; if (nptr == NULL || *nptr == '\0') return "missing"; - num = strtonum(nptr, 0, INT_MAX, &errstr); - if (errstr == NULL) - *val = (int)num; + *val = strtonum(nptr, 0, INT_MAX, &errstr); return errstr; } @@ -3076,3 +3100,19 @@ lib_contains_symbol(const char *path, const char *s) return ret; #endif /* HAVE_NLIST_H */ } + +int +signal_is_crash(int sig) +{ + switch (sig) { + case SIGSEGV: + case SIGBUS: + case SIGTRAP: + case SIGSYS: + case SIGFPE: + case SIGILL: + case SIGABRT: + return 1; + } + return 0; +} diff --git a/misc.h b/misc.h index 9bacce5..1134038 100644 --- a/misc.h +++ b/misc.h @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.h,v 1.107 2024/03/04 02:16:11 djm Exp $ */ +/* $OpenBSD: misc.h,v 1.109 2024/06/06 17:15:25 djm Exp $ */ /* * Author: Tatu Ylonen @@ -21,6 +21,12 @@ #include #include +/* special-case port number meaning allow any port */ +#define FWD_PERMIT_ANY_PORT 0 + +/* special-case wildcard meaning allow any host */ +#define FWD_PERMIT_ANY_HOST "*" + /* Data structure for representing a forwarding request. */ struct Forward { char *listen_host; /* Host (address) to listen on. */ @@ -34,6 +40,8 @@ struct Forward { }; int forward_equals(const struct Forward *, const struct Forward *); +int permitopen_port(const char *p); + int daemonized(void); /* Common server and client forwarding options. */ @@ -244,6 +252,7 @@ void notify_complete(struct notifier_ctx *, const char *, ...) typedef void (*sshsig_t)(int); sshsig_t ssh_signal(int, sshsig_t); +int signal_is_crash(int); /* On OpenBSD time_t is int64_t which is long long. */ /* #define SSH_TIME_T_MAX LLONG_MAX */ diff --git a/mlkem768.sh b/mlkem768.sh new file mode 100644 index 0000000..2fdc283 --- /dev/null +++ b/mlkem768.sh @@ -0,0 +1,148 @@ +#!/bin/sh +# $OpenBSD: mlkem768.sh,v 1.2 2024/09/04 05:11:33 djm Exp $ +# Placed in the Public Domain. +# + +WANT_LIBCRUX_REVISION="origin/main" + +FILES=" + libcrux/libcrux-ml-kem/cg/eurydice_glue.h + libcrux/libcrux-ml-kem/cg/libcrux_core.h + libcrux/libcrux-ml-kem/cg/libcrux_ct_ops.h + libcrux/libcrux-ml-kem/cg/libcrux_sha3_portable.h + libcrux/libcrux-ml-kem/cg/libcrux_mlkem768_portable.h +" + +START="$PWD" +die() { + echo "$@" 1>&2 + exit 1 +} + +set -xeuo pipefail +test -d libcrux || git clone https://github.com/cryspen/libcrux +cd libcrux +test `git diff | wc -l` -ne 0 && die "tree has unstaged changes" +git fetch +git checkout -B extract 1>&2 +git reset --hard $WANT_LIBCRUX_REVISION 1>&2 +LIBCRUX_REVISION=`git rev-parse HEAD` +set +x + +cd $START +( +printf '/* $Open'; printf 'BSD$ */\n' # Sigh +echo +echo "/* Extracted from libcrux revision $LIBCRUX_REVISION */" +echo +echo '/*' +cat libcrux/LICENSE-MIT | sed 's/^/ * /;s/ *$//' +echo ' */' +echo +echo '#if !defined(__GNUC__) || (__GNUC__ < 2)' +echo '# define __attribute__(x)' +echo '#endif' +echo '#define KRML_MUSTINLINE inline' +echo '#define KRML_NOINLINE __attribute__((noinline, unused))' +echo '#define KRML_HOST_EPRINTF(...)' +echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")' +echo +for i in $FILES; do + echo "/* from $i */" + # Changes to all files: + # - remove all includes, we inline everything required. + # - cleanup whitespace + sed -e "/#include/d" \ + -e 's/[ ]*$//' \ + $i | \ + case "$i" in + # XXX per-file handling goes here. + # Default: pass through. + *) + cat + ;; + esac + echo +done + +echo +echo '/* rename some types to be a bit more ergonomic */' +echo '#define libcrux_mlkem768_keypair libcrux_ml_kem_mlkem768_MlKem768KeyPair_s' +echo '#define libcrux_mlkem768_pk_valid_result Option_92_s' +echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_15_s' +echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_55_s' +echo '#define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s' +echo '#define libcrux_mlkem768_enc_result tuple_3c_s' +) > libcrux_mlkem768_sha3.h_new + +# Do some checks on the resultant file + +cat > libcrux_mlkem768_sha3_check.c << _EOF +#include +#include +#include +#include +#include +#include +#include +#include +#include "crypto_api.h" +#define fatal_f(x) exit(1) +#include "libcrux_mlkem768_sha3.h_new" +int main(void) { + struct libcrux_mlkem768_keypair keypair = {0}; + struct libcrux_mlkem768_pk pk = {0}; + struct libcrux_mlkem768_sk sk = {0}; + struct libcrux_mlkem768_ciphertext ct = {0}; + struct libcrux_mlkem768_enc_result enc_result = {0}; + uint8_t kp_seed[64] = {0}, enc_seed[32] = {0}; + uint8_t shared_key[crypto_kem_mlkem768_BYTES]; + + if (sizeof(keypair.pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) + errx(1, "keypair.pk bad"); + if (sizeof(keypair.sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) + errx(1, "keypair.sk bad"); + if (sizeof(pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) + errx(1, "pk bad"); + if (sizeof(sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) + errx(1, "sk bad"); + if (sizeof(ct.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) + errx(1, "ct bad"); + if (sizeof(enc_result.fst.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) + errx(1, "enc_result ct bad"); + if (sizeof(enc_result.snd) != crypto_kem_mlkem768_BYTES) + errx(1, "enc_result shared key bad"); + + keypair = libcrux_ml_kem_mlkem768_portable_generate_key_pair(kp_seed); + if (!libcrux_ml_kem_mlkem768_portable_validate_public_key(&keypair.pk)) + errx(1, "valid smoke failed"); + enc_result = libcrux_ml_kem_mlkem768_portable_encapsulate(&keypair.pk, + enc_seed); + libcrux_ml_kem_mlkem768_portable_decapsulate(&keypair.sk, + &enc_result.fst, shared_key); + if (memcmp(shared_key, enc_result.snd, sizeof(shared_key)) != 0) + errx(1, "smoke failed"); + return 0; +} +_EOF +cc -Wall -Wextra -Wno-unused-parameter -o libcrux_mlkem768_sha3_check \ + libcrux_mlkem768_sha3_check.c +./libcrux_mlkem768_sha3_check + +# Extract PRNG inputs; there's no nice #defines for these +key_pair_rng_len=`sed -e '/^libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` +enc_rng_len=`sed -e '/^static inline tuple_3c libcrux_ml_kem_mlkem768_portable_kyber_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` +test -z "$key_pair_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair randomness argument" +test -z "$enc_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_encapsulate randomness argument" + +( +echo "/* defines for PRNG inputs */" +echo "#define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN $key_pair_rng_len" +echo "#define LIBCRUX_ML_KEM_ENC_PRNG_LEN $enc_rng_len" +) >> libcrux_mlkem768_sha3.h_new + +mv libcrux_mlkem768_sha3.h_new libcrux_mlkem768_sha3.h +rm libcrux_mlkem768_sha3_check libcrux_mlkem768_sha3_check.c +echo 1>&2 +echo "libcrux_mlkem768_sha3.h OK" 1>&2 + diff --git a/moduli b/moduli index 00d293e..bebd3a9 100644 --- a/moduli +++ b/moduli @@ -1,455 +1,412 @@ -# $OpenBSD: moduli,v 1.35 2023/10/25 05:38:08 dtucker Exp $ +# $OpenBSD: moduli,v 1.38 2024/08/21 07:06:27 dtucker Exp $ # Time Type Tests Tries Size Generator Modulus -20231002030805 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EB8660D47 -20231002030808 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EB87B625B -20231002030813 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EB899E127 -20231002030815 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EB8A5B277 -20231002030836 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EB93E67BF -20231002030904 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA18CD33 -20231002030905 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA1F43E3 -20231002030909 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA35A643 -20231002030914 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA5AD7D7 -20231002030917 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA688543 -20231002030922 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBA8BC207 -20231002030930 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBAC6C757 -20231002030932 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBACF1123 -20231002030937 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBAEED413 -20231002030945 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBB278463 -20231002030948 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBB360C03 -20231002030953 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBB5351EB -20231002030957 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBB718EB7 -20231002031014 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBBF2439F -20231002031016 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBBFCAB93 -20231002031017 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBBFF4D43 -20231002031018 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBC02091B -20231002031024 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBC293BBB -20231002031030 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBC539E1F -20231002031041 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBC9F21FB -20231002031046 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBCC001EB -20231002031055 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBD054ECB -20231002031101 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBD2BEB8F -20231002031105 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBD4264E7 -20231002031111 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBD725953 -20231002031137 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBE30F30F -20231002031141 2 6 100 2047 2 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBE4B5583 -20231002031201 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBEE6277F -20231002031226 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBFA54AFF -20231002031228 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EBFAF829F -20231002031240 2 6 100 2047 5 C9221A14AD5A6D21D700B002E8DAD042C817FAAAB8D0456A14E7A99010D8C877B4838CDCFA265C3E3675B0DA35547737F9A6913F6CF3F43EC7EEC9336B620D3B4203847DDCB679BD72B32F6D2E8949E23B86EB2BA4A05C622A33C8050F0CC6868B2A0D6C813FDAE12CF6D1288B689F454C605DC5443B75B887460A05B4D0674982D714E02D579BAA26A1B044193755164E1DDB9E06281D7D59BE4289D4F0E5255896903A5164903B1B27BD10B7F2E8DAFE1257DBE4F0B7AF918229C71803CB48226B4A4B7269D1482E67F8AF49AA7B866264F5659F4069AC49ADDB799707C3BB50A3CB15109EBEAAA522FDDBE7A04CC957D507952B1AB7C8433CCE9EC0092F8F -20231002031252 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BCF330043 -20231002031302 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BCF7CB2A7 -20231002031315 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BCFD54D3B -20231002031324 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD019867B -20231002031330 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD048E5CB -20231002031333 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD058783B -20231002031336 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD06951E7 -20231002031345 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD0B15DDB -20231002031352 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD0DF392F -20231002031353 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD0E1DA4F -20231002031358 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD1024ECF -20231002031422 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD1AD9CCF -20231002031443 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD246DEB7 -20231002031446 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD25B82D7 -20231002031501 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD2BDB3B3 -20231002031503 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD2CA2913 -20231002031507 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD2DDA103 -20231002031510 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD2EE864F -20231002031512 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD2FD7593 -20231002031524 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD34B987F -20231002031529 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD36CFB43 -20231002031554 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD42296D3 -20231002031557 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD4325F13 -20231002031558 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD435523B -20231002031559 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD4378F23 -20231002031606 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD46B0D8F -20231002031609 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD47838DB -20231002031614 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD49B4D97 -20231002031616 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD4A79F1B -20231002031627 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD4F13DE7 -20231002031640 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD54C80A3 -20231002031647 2 6 100 2047 2 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD57CEE9B -20231002031657 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD5C336DF -20231002031722 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD67708D7 -20231002031726 2 6 100 2047 5 C6D9FD71BDE795C2EE4F7D579076A77F9B3890B702B6DFB925953742C053CCFB301FCA857CD81F06B3CF899EBE78D6D73BBAB02268E886B2A87D92B4F633852675AC105C0E82CE802614E36A7F390E18D4F0F78682E9695A949E8C127B82164EF1FC6F5859D66EDACDD23B9FE330B26B6D468A0A50E4C14F70F66F970895A3EE007AA67635FADEA461D164CE6D79F4DFC13EAFBE05D68275D8383AB0A4D6A658D7A1AE0202787F53F0F8D330A1D1E8BAA0B6FD51C5D694BA3790B2A80E2C7B070CA5BCD04637244CA32D64B3F07268E57F506826A8DFA31A9554168C0A9DB5FEBFBF8F9F69F654037386E0E5E256F29F68A2591707D9039231137F3BD691BEF7 -20231002032547 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12D8CBB46B -20231002032805 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DA7EE34B -20231002032822 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DAAEC6FB -20231002032842 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DAEA6C23 -20231002032914 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DB4D999B -20231002033000 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DBDC876F -20231002033013 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DBFF1573 -20231002033053 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DC7C299F -20231002033112 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DCB88C93 -20231002033119 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DCC509A3 -20231002033850 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DCD76FEB -20231002034205 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DF47D2AF -20231002034230 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DF8EE537 -20231002034248 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12DFC506C7 -20231002034330 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E0404E13 -20231002034333 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E0446EA3 -20231002034515 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E1834B9B -20231002034639 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E290DF83 -20231002034740 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E34F7147 -20231002034840 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E40DCBEB -20231002035011 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E532191B -20231002035040 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E58DBAF3 -20231002035054 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E5B2B7B3 -20231002035152 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E664D9B7 -20231002035246 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E7118207 -20231002035321 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E77B3B6B -20231002035417 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E82BC0B3 -20231002035425 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E840D433 -20231002035503 2 6 100 3071 5 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E8B63EEF -20231002035546 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12E9486AEB -20231002035730 2 6 100 3071 2 D435B9DA29C6441FE8C9693F4276E0DF5FC91028EBCB2FE2DC0EC03A9F7BF53BB1B447DC71B517B5CB363A71FE199CF790CC42C21692526421D200C39C2B41EA8E9DBF0FE4366B1B372C69B33D6381A38E1213F317D0D792C826510E72F70F2B198DDB768D19FB28E5FC20D678044D67BC6DAF6B7496AE902BB7C07BE6D2671A284A226179B73C43DA4902313D03A601BE81267B9A7D0064E386FC1B1DD31D7146BB837B5D0CED5CC5D834BC0E25F4C2EF181A881B4F5B96C34324758D5FEAF5659098F445871B6593AD4F6E2BC5CC01BF7DA5827BFEED605C26B0C50B6B308EE376528A933E01DA445D5902DCF4C937B2D575EDD33ECE07EA6738167858430515AF1B160E301ED1C4096871F2248CD83019FA381449723D2F220D94F4CE3C2E6A789D6748B0BDADE26ED2B445AE04B421342393804D7F0EBF6A53AE289FA16A0366F419EF5BA2690690836055833140A8EA541F6329E12C6C094667CE2E744DE08B6ADB36E944EE9E8721E0D7E6D6953B9C0AFB033EC9A1E229CB12EA982A83 -20231002040037 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938951705C3 -20231002040109 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938957A0E7B -20231002040120 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389599ED67 -20231002040253 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B03093896C6D78B -20231002040333 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B03093897424DDB -20231002040358 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B03093897902357 -20231002040616 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389948105F -20231002040624 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938995C6133 -20231002040627 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938995FC8B3 -20231002040642 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B03093899896D03 -20231002040758 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389A758183 -20231002040835 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389AE5E05F -20231002040911 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389B52D353 -20231002041010 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389C013C77 -20231002041047 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389C71BDC7 -20231002041152 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389D3D79CF -20231002041202 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389D565883 -20231002041216 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389D7D082B -20231002041326 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389E56387B -20231002041453 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389F70C107 -20231002041513 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B0309389FAACA93 -20231002041815 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A1ECB753 -20231002041833 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A222270B -20231002041942 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A2FDDF13 -20231002041950 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A3105EB7 -20231002041955 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A31AC273 -20231002042039 2 6 100 3071 5 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A3A1B25F -20231002042113 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A405A9EB -20231002042201 2 6 100 3071 2 CFA8C0FEA9FA30086B87B145CE1B10C850BED7B0E48D74F4104D54A0587078F777489F278BDD390E108E3535FA8DBE332D3C22F5EEEF08BF54017590B7182E3A2C0F955D437957004A29177CBD8549716E8159BD84160EF1369DC35DD34B286F9364DD5CEFB4D32DEAB497D2F80AE9C943DD623B7D064EF87EF53EC9E60512C8511B0F26C46E0A1BC9AA62B80675C3C17D28C13BDD8B40CC9C3647F4C72333CF2710F4C0319F26C2D030B77838012F58815DCC36E887ED5121B80819BFD12F127C43A839190115036D3F1075AF79D189A9F4E64DD0E811FBF4FF29D57665DE4D6FA07BF0724D829FF003079279299C2126105F084677DCB09911041CBE2B551FDAED06905986B219FC807A529BF392C8F73DFE1C57EC6E4AC3C14643813849A1F9EE1BC522C7C073817C980404116116E4A04945396190A640D2F7B1D255473470EA22A4D53D438656BDE67F95C83D00E1F184C956D7546F7D8954E6ABA6187B315BA05FF68D55CBA76E166D05D5932A3A6830CA2A2633B55B030938A4A09C1B -20231002043546 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F97BB7733 -20231002043733 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9861D57F -20231002043843 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F98C8A233 -20231002044121 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F99BD3D4B -20231002044301 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9A5765BB -20231002044414 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9ABFFEB3 -20231002044437 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9ADDE5FF -20231002044444 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9AE21BFB -20231002044502 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9AF4897B -20231002044715 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9BC8783F -20231002045021 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9CF269E3 -20231002045030 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9CF82FF3 -20231002045222 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9DA5D437 -20231002045350 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150F9E2AF5C3 -20231002045917 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA034D613 -20231002050316 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA1A8EC27 -20231002050449 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA231F75F -20231002050518 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA2566FD7 -20231002050704 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA2F8012B -20231002051424 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA5AB0EEF -20231002051430 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA5AC9567 -20231002051505 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA5DBE54B -20231002051743 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA6CA6C3B -20231002051905 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FA7475D7B -20231002052700 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FAA2FD977 -20231002052843 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FAACE8103 -20231002053332 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FAC9088BF -20231002053348 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FACA13883 -20231002053427 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FACD80957 -20231002053619 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FAD8747C3 -20231002053638 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FADA116CB -20231002054016 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FAEF247E7 -20231002054332 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB01C491B -20231002055042 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB2C6574B -20231002055303 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB3A696EB -20231002055356 2 6 100 4095 2 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB3F0234B -20231002055921 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB5E7DD1F -20231002060022 2 6 100 4095 5 C333C378E10FC8C3708C149CF7D706B80DAAA93FE362B5EB5E8AF660111D8D65BF44AC08C0393E17B84456EA4D7397E1AA57E6273381A401F425E96DD3B920B49FF097DAA659A2AC0C33F40EA13C8390BEE8BD1C3C9351076C4E114B117148246665CB5F314AF2054C69C6C9E13BB5CF6471FCE69C62DCC98D69ECDC9E9A92AAC2DF217F08CC4ED2FD87B513AA2315B1B9D23ACFEBFA8F333DABCA10A1F0A4ABC0C4A67B238D8E6D0AB68FE704A026F6EF933EE8D65B9BC314E3C3DD7B7FA6D2F964AB1B515A8A59CB5494DE98BDA70F6EC165BB541B00A1DF8A1B36BA4DA1503CD030C446D0443CB27AFC732C8136E53B69CFA21213C23B98DE5F5B513339427885AEE13B4578F8D53E03DD61AAF34FE8EB0979E29289A3661EED1954AC61CD61118AE5E4F9957198521F730D252A2B5FA51B3ECD0CBD48B1C4A2ACD8BB8131449E896C11E23F41C96BF044AADCC0DB1EEB57E3CFBE9042B06C772AB665A8FA630A2D0217E536E4538F2AE51E44161CF1FD2FA42D26C049C406AEE8D9F1B5BD01A5161E47906F3733F2EAE03F38697DDA9241C1722E5A73B229B0A270B0161208F7A1E4BE65E00B7713E38BFE7D806206D87B55D8E81F2F35F8871611DE73A47BFCA3EE2FE77EC71E20A262A3C02220A026D1E8819608D4EAE37ECFA36D9E9126033C64C4DFE951E6807E14F5B3F870EA3FA19EA754C87435A8150FB6418067 -20231002060252 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9744E5413 -20231002060407 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C974C3A0E7 -20231002060612 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9758246AF -20231002060651 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C975B74527 -20231002061114 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9774C8B23 -20231002061217 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C977A83D87 -20231002061542 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C978E6F5CB -20231002061844 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97A0144F7 -20231002061946 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97A6011B3 -20231002062202 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97B334B7B -20231002062312 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97B9ED387 -20231002062659 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97D0167CB -20231002062852 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97DB1C8BF -20231002063237 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C97F124ADB -20231002063513 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98005B663 -20231002063540 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9802AD0C3 -20231002063556 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9803CF883 -20231002063708 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C980A85467 -20231002063741 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C980D5E6E3 -20231002064635 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C984192C6F -20231002064848 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C984DE3F33 -20231002065019 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98566002F -20231002065353 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C986B1C91F -20231002065445 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C986FBEF63 -20231002065538 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9874B543F -20231002065545 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9874E6C33 -20231002065701 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C987BBE79B -20231002065747 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C987FA3B4B -20231002065946 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C988B42243 -20231002070008 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C988CE62DF -20231002070120 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98938A307 -20231002070247 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C989BCF6BF -20231002070501 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98A8905A7 -20231002070514 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98A959DB7 -20231002070804 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98B9DB8B7 -20231002070841 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98BD43657 -20231002071314 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98D7FB3C3 -20231002071325 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98D88E8EB -20231002071745 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98F149D2B -20231002072004 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C98FEA9D3F -20231002072030 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9901007BB -20231002072226 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C990C0B8B3 -20231002072853 2 6 100 4095 2 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C993192063 -20231002072941 2 6 100 4095 5 E10CECA5887CEBC483A29080A2665F35F0CA7AD441F1451C2549272D35936D1324CA62500733CA6F11AEC477CAEAA7FBB60520F6A84C052238F72F22488739C6D6A14A96A7CEBBB293123CBA3845C0EE6B4D6B5305B2FD642B339BF418BC410A3FC054C07017656805C573C065EF62661B2B638AB5B65EF9C6F90A60FA2DCC60DF4004BF0E9F8B01FD7CD71D73AFE50CCC276652E2198FF628842A84BF4BBF8B8DBCA7E609FEB204610F9D179D28FBE60F84D3E31DBCA604F14388E698B9613EFA6CD699B7AFBEEC7876691838FE7DC40803BAF56B6B96D9A975B1512B64ABECE3B1DA48E4EE3414B935B458482AD23938D4878EC3205C6570145C02753F81D2EFF8D466B09CAD48CFFD3296B963958584DE48060708B00436CDF38A23A2C6B87740CFEC4F83A706F04C0C5F21670AAC91DBB5A5AE739767BB27C60B981E7E14EF74B191FA1532BD002BBEC37FA81F9497AB3620C259A8BF7E9271BC275B2BDBE3E64485551EC9D8D2E0A35B6CF7337840A1591B7693ED5F1F2EEB16ADFE9946DB2FCDCF1A1DF8ACB4AA6E84E821269ED19AF829985AC9185ED3A320C62D0562DAC68F6C4E6A6D0924030D6721226A7985CC7086AA6B02ABF22BF80878A69415D1ED7E0FEEF5D97DC3598CF2528185137B2A3401F07BDE1B8E3883D6BDC6E9A9329D764E8861F40FA27BEDCB2B1B04908503C8A30BF19AA4564DB7C9935E137F -20231002081041 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B0333397 -20231002082147 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B18E4283 -20231002083104 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B2B4F773 -20231002083134 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B2BD2843 -20231002084350 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B44B71D3 -20231002141344 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B0333397 -20231002142442 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B18E4283 -20231002143348 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B2B4F773 -20231002143419 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B2BD2843 -20231002144651 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B44B71D3 -20231002150103 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B612B503 -20231002150136 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B61C3BEB -20231002151801 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B82F193B -20231002152637 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76B9420B8F -20231002153456 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76BA45EDCF -20231002153746 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76BA97B48F -20231002160531 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76BE29EAC3 -20231002162342 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C078F093 -20231002163511 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C1E48843 -20231002170308 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C57F3C33 -20231002170614 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C5DBDF1B -20231002172548 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C855E547 -20231002172639 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76C86B2807 -20231002175342 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76CBE853A3 -20231002180217 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76CCFBD417 -20231002184225 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76D20A9DF7 -20231002185958 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76D43A135F -20231002192316 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76D72F8AEF -20231002192445 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76D7559777 -20231002195410 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76DB15D467 -20231002200603 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76DC94115F -20231002201042 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76DD1AA643 -20231002201544 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76DDB77B67 -20231002204234 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76E11C2123 -20231002211226 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76E4DC58EB -20231002211356 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76E50579B3 -20231002213652 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76E7E66133 -20231002214032 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76E854A163 -20231002215638 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76EA552477 -20231002221259 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76EC52B343 -20231002222832 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76EE45CBAB -20231002222905 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76EE4E0293 -20231002224654 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76F081244B -20231002225640 2 6 100 6143 2 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76F1A84B23 -20231002230658 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76F2F06967 -20231002232045 2 6 100 6143 5 CFDC18EEBE159970EEDBE80A11E47B1A8BE485032522B106574399D90EC4F423A1328A4BDCFC7622AA2CC6E350C364FFBFE243DE26176C0CF4937AA4358BF4B1D83FC4A6ADD821604FBD9523C52C108BD658BC9DAAF471040A6ACA8BA818F84F784AC48F5EA6619C156F1B24246C2C35CF91C7560CB09CF96C53B2431B5292461048F66E36902B86D9352DF48E8B2D37FECB3B76A84A2BE0A419DC7D163926F15101D626A44F13C5AE5EFFD2992E49C6BC91A4AEFF174A980270F4CA8399D5B1AC018914F086C459BEDE80C02B798F580CCB22968C9C5EF85FD28D92D18AC6F39B8B0DA06B7116095C6EABC0B836B67DD741FF5D8E4561FB952DD1069018C9EC658DFF6CA7A0135B0822806A4BBFCA0F05A16756723066675D452014BFF4C40D80BD511C8CB04442A5FB4E50EAED4E9416D7332F7673E74D7A51E0AFE293881F6B8189B8A6A6092425FB7734B5D793523C3F2F2F6C6F40C8E00BA743261D8E0A4F5D2A3823C4362689C8F1249A8EDAB713A56DFCC95401F34844D51E5A43C5A2D973A01D9147323A551813F203F13C3FD16E21106332CF76CFF77AFE496A4230E1DC309F37A7FB7533301AD98B6B85D5F3D0FAF67E07538C58FDF91A610E12499B4D02FE5E94960AA8523232CDC302DD3BDBAE3633A887A4FBBCDCBEA355C54DF03F525FA519209FDF545E278592E787DB253EFCD80EE378A1575674DD389EBC3C80D1BEA7E42A0CA77EB84D278CE20F762B9838823B134311CBA91E1A3C0A71C4F59DDDB9F1465C406E1064DD1034F26EB3387F45A6C02787F73CB3D5244930EAF20096797ABCC2B02D32030C35FEA1DD34C7FD5ABC9282A6C7B8DEA0654728ABE170DA23A7CA27629B115C0D35120E29C278CA8F7B367F7D2D76745630D8ACC3FA1F8ACAE2E033B0D5944C33193AFDF44CC221099E5AE2C25C8796F7E1A71FE1D60936A2A4096D95B173E141CC0222ECEF1B41C96F3A30FFEDABAA1BC36642504E8B8AF30BDD54D12F70F3CD6A307727A55213C33AE4DF3BE726174FDFA1CC2BA74460E0C1F119374290191476F7116353A4E1AF9A48E33D1E8B76F4A69E2F -20231002234558 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A810F69E7 -20231002234915 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A817337BB -20231002235010 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A81889047 -20231002235237 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A81CC51AB -20231003001041 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A83FF7FCF -20231003001507 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A8487F873 -20231003003839 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A877676D3 -20231003004439 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A882FB0BB -20231003013638 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A8EC44FDB -20231003020602 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A92680F23 -20231003022233 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A94729617 -20231003022838 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A9533C427 -20231003030014 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A99255993 -20231003030947 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A9A55F43F -20231003033759 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49A9DDBBF27 -20231003042143 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AA34E398F -20231003042540 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AA3C73223 -20231003051219 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AA9B54CC3 -20231003051253 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AA9BFC61B -20231003051513 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AAA026323 -20231003052052 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AAAAEAB1F -20231003053941 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AAD067F87 -20231003054545 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AADC1B5EF -20231003055211 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AAE8576D3 -20231003060848 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB094C2F7 -20231003061146 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB0EDC1DB -20231003061445 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB14AF5EF -20231003062126 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB2207DD3 -20231003062948 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB32671FF -20231003065951 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB6F4703B -20231003071814 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB9393AC3 -20231003071838 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AB93E6CBF -20231003073040 2 6 100 6143 5 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49ABABC23A7 -20231003081738 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AC09DE603 -20231003082407 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AC1617963 -20231003085747 2 6 100 6143 2 E66EC740BCD486B24BA43649320948C64050E6C92B464AFE6928BCA87FA1C070DD66DC0701751137EC1E54BF664BE2E2413FC0F8E50E750818F15D3653B10F52D3F70E8BC30AA5F98A9958A73CAAB3D6EA71004E3A45FF48D7941330A6E0737EA76EBC51FD1285D843F7690CBA7C2685E747DA987A4BAAF6D13D1581C900C05AAABE5AA9E2AB2FE4D5ED2E1C1EDEA3AB0BC6158D77EA2C77D3565AB3BB83639E1E2712AEBC580CE892108F1C5D392CE075E4BFC9F98A94B341333B65CCB6010EDCE294956ED236360320912525D079609779796E11F549A893B29FC6118699EDA544D0570B91985C952A9DBE05E7EFBD8859BD1B217D24C429287F78464619B843DFC537BB96829A6C98B7C48CB2A233C48F98C853DABF495FE81A796E24FB5AE643504CEB40BB45468578433E6F5545B7939CF834857B33FE32B39ECA28C8D1E4C1EC020BFFB68CC3CB8547B9F6BB867826288D13F37F613F273373CD8742E3F2822133CEEAD8ECF136EDB0EEB06C84AA5225A389B489B4693C0BC0F4FC5B0023A06809CC4A83E0B6C8B0E72915B742396FF3F422137F73A6D399AF4E32B577E79B0F624ECD040F04C10C25AB94379FAE65036069AAF84549533C6589BE6935FBFB0FC9AFFA325C0F9972D5D5B4F8B271281ABB54597CE4D6E52F9D19824E2813D86FF6FE2ADE81B401569BD36F0D3D33FD44661AC6A0371469D731D6B0D2541E8A03638420FA4AAD41DF127FAA90E2C7C8560593E6B3C6D5895F95B7336FCD91E34CE18EF912103FBA1CDE7BC5B1C4AA81CE0FFCE0386F1AAF3555A6E5832A22CE96C0CA9D5E47BED9984F1D4E1C53B60020FE25B5083AAE62ADADBCA1F37CE843B63B8F7190CF6DACBF6690E398C26C3FA2D90439DD73E7340775AE6A83A73447B624C299720DCA85FEB67C85061BEA7A296C4CCF7342AFCC1B284D6AFE6D25273F38B44F1938205927FA1E5163A8EE8411D68A5DA3DD0ADE75A60B14C842B954117CC4A55CAC0BE44A396DC24B4BBE558C208210A3621D4914ED87674301AAFA923D7E9897A6AFFCB32BA80AB214AE2B2DD13D50FBB73E1AA49AC5927A1B -20231016131900 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA00EACECF -20231016132859 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA019290D7 -20231016142904 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA059B4417 -20231016152750 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA0999EB13 -20231016155325 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA0B553BF3 -20231016172849 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA11CB2E4B -20231016180042 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA13ECF3CB -20231016180126 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA13F1687F -20231016180748 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA14552213 -20231016195614 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA1BAD2973 -20231016201150 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA1CBAEDBB -20231016224251 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA271BE9F3 -20231016230521 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA28A3337B -20231016235753 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA2C38DA3B -20231017004035 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA2F2C3553 -20231017011243 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA314D420B -20231017011549 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA317A2D5F -20231017032411 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA3A4E69EB -20231017035035 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA3C0F1B77 -20231017040535 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA3D0B2F7B -20231017053244 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA42FECF0F -20231017061754 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA46082F6F -20231017062414 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA46692FEF -20231017064457 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA47CD78D7 -20231017080259 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA4D1F422F -20231017081616 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA4E000C6B -20231017090950 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA51A428FB -20231017100646 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA55892F1B -20231017101201 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA55DC859B -20231017114805 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA5C5D2C7F -20231017130334 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA6177B58B -20231017144733 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA686F3603 -20231017150532 2 6 100 7679 5 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA699ED29F -20231017155907 2 6 100 7679 2 EE7B7F77179CAE64DB89ACE5368617513DF050B0CBB10C2E59A189C487BA454C7576B7BEAA078CA60539C649C10086BC0B045CA609A4EC64C5DF5E4F2453B5D0691E16F17DEA71E80E00926E84D57A812BC2E23187228963F0E55C49F2676806A99BF0B482EEABAA0865954ADF181C0093376004938999A95404A56E869C3B4AD36B6F3B60846F236272DE29D8BFE6298857B7DFA5309E2724E60A87076195A480F402A0029A3D67839705EDA6F3963A995863A07A0E775236CFB6EA8658658CBD65F014FDAC4B4D504AFAB91E3E1C9CD4EA842404641153D33BA95F7D7F8285511878F6ADF344921256C07CF06112F1548542EB6BF0FF78AB8FFFA35D238216D52CA7D4FF5B43C62FEF5FF3BA7CEFBD7BC9EAB09292EE409868450E5B6A37BD52999774065131C7FAA305E81A93D086549946BB5EE3EAD0D319E724DC2646DD7F31E928BCF8FF816B9D0FB27DEB691834DC8B56FFCEEC8BC33095734363A01E493F17E6B7D692C10F951A5EE98DA6B428144C4031D089458807A8B3425E80E8D42E9D8F504B9BF9198FE13C371F2ED23C39BD6AF99C1C4D4FDC3E726B0227D8F195AFBB7B70FCB8789473CD7B46FDAE7B3FD63FF89116DB318CD3EE340371AB6F8C4CB88909DCC42B6B9D1AC5C917247E6C27DAD51D7AC998EFAE905C8D8B1381A3C2D8B7F37166AA24762E5C9C347F73AC8EC2DAFC40608221C664E85EE218D3A950B4DA358CCFB4E1B56471095E49A0BEB276A7F6CA7527EC2A80D106943E00B3977F393278C4A6AD01435C1AD72E019B4B2B43D2C9222D3C2A63D5EEA69B1442F4FBA285504F4218323C8C226246398C8059117CB36F96A312F6F8B4C442F2C8213BF4FDEED2C5D0342D9F82B492D74679F5DAFDB79BD57EEE2969471F320D3887EEF552D0548F467D24FA26CBC7FFE4684890DEC965A48689FBD713BDE3146E612B91CB10CD6AA0A3C222ADB01FFB74B4603116421BCA02BCD35992700FA954D4BEBBAF64C19E373715283ABC185C57653974A159F080939AC7BC3F385F406D9086B2B03A9B69CDBF725CC9CF8CF74A9F65753EEB48036D13413CBA8FDFC43FCF640EDB5654A44D7EE0585081B740A1481E877EA4E43C318645A61532E6E8668219AA37E2A467761D50A622599AF55D99C3FE763319F0307496F1E99664A4FEF3FC6860D68F80A07E8C259A1D2C85895D7B8E07368C052CB7C17FF2DBD6B0AD3824B2DF89C23805B42C21DA29B39FB25C6D94D8AF318AF790A59FB4B08E7430856CE11694B34156E7E4634D241D5EA5632E87F53EA0ED552C6F89C3D03C0A725BAFF8133DA9755C7499AF96A7709BB82A61F6FB42203B50B3AA6D3AFB8B -20231017181544 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175059BF743 -20231017190547 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17508FC9613 -20231017192033 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17509F702C3 -20231017200530 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1750CFB1AD7 -20231017201043 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1750D4F4543 -20231017203134 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1750EBB8757 -20231017205507 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17510485E5B -20231017224217 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175179CEF9B -20231017232528 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1751A835A53 -20231017232941 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1751AC3F17B -20231018003956 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1751F836183 -20231018005815 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17520BD845B -20231018011203 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17521AE2577 -20231018012138 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752253381F -20231018031440 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752A0C708F -20231018031950 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752A5914A7 -20231018033845 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752B977FCF -20231018040441 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752D5365D7 -20231018041121 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1752DC38AAB -20231018054013 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17533C80607 -20231018054825 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1753451216B -20231018071952 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1753A752783 -20231018083252 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1753F72808B -20231018090047 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17541479E9F -20231018093100 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175434FCD7B -20231018100316 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175457635C3 -20231018101033 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17545EBDD63 -20231018110847 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17549CE2733 -20231018113805 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1754BBD7BE7 -20231018122625 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1754EE7384F -20231018123413 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1754F632783 -20231018125726 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17550E83927 -20231018135301 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17554AA25B7 -20231018140418 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17555636167 -20231018141949 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175565EE997 -20231018142439 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17556A866DF -20231018144725 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17558217B9B -20231018160133 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1755D0F69FF -20231018172124 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E175626A63C3 -20231018173327 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1756332AFAB -20231018174338 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17563DEEBA7 -20231018182026 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1756663AE4B -20231018184456 2 6 100 7679 2 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E17568173BF3 -20231018202029 2 6 100 7679 5 FEC5FA301DA99770B0001C6661792A17D47495458B6FC55BF33FB1CD1E8CD5675550AEDED89217D8945CA01F1F68EF0F543E6E3BEADF0053FC7D706FE59F390E7758CC227C1CC6AEB6AEE82BD92CAA8DB32CD80B57E3DED4C5D5F029FA776D439EF2E069271AE4A2ED1F05C94ED9216E07DB8E0488B3E422D9F3E91618BFDFEB004ACB899A99AB89107FC3888337778FBE3D597FBD40FA4F791C96E175A163D22CDA2D84D049198083CD68D731740D4437B79383B36A33DF6650A42D497B7D7796BB3FFE02FCB5B5CB890EBE4BE4DFFB2AAA0D4134ECE4BF31AB678B16EA621A1598827179BF77A0290D34902352BEB99F92B244A402E431C47414E96A9D6EECC402B6A1CDA088E34D22D25804F3FE4C3B382AEB0DC530C6BF9C70B042256B5BE7B30896B05C5B4CBD88512B0A8B3D13A3D6BDC14670031381EC66DA8AB6C5645A79B1081EC58A0882D8FB17E0C083720C9B119CF52A88833D5600E43CD5C48C524F1643F515B30474A64118EACC834A272351048A1727438913B8F369BBF3E7A1628B3D40E77DD980BA8A1CF545CE7EAEB5B17301AB9A80A19C64227B645291AAD618D2805FAF39AF48ED5035EF23ED7FB734D929C8D0028A46162FC17302C5DB50F5E696EE451CD4C0899DB3E907185FCA1C53EB60E0131D6A199B0517A300BF136FE3BC236C884171ED76F79ADEB64DF1A50A76F8B26C7AD72AC0E2C1104566DB81C50BA607BFB379BB8FB142355D6A3D0D034E5697665FA31403241B806ED8A427DC437EBAC54DDC408DA022C4C2F8BF4AD59DD43C7BC7A4C4E5BF24D812719FFDFB03B797B366B2DA35AA280893EA813A5BD9E1E91B280299BB7A02A3FFBCE1F52219D43B308C723D0B0F25B8CE12C110491B33713E5F2C5C7E946322B28500480DB234515B5DB5370788D9DCB6D460281E91EE343B5BEE12CD367B83EFAEB4964B3051CEB8CD2E54E7ABCF0E4AF3D18D9A6B5D58B09B58DC97287BFB058DDBA94BC376BAEE117C2AB9E6CF0B13553AE4F8B91A247FD24C0D70C090E16B152CDE92456A95E5BBE98F939BBD5083EAABA538A675C3DFBB25D001D2E5A3B3811E7C6E982A7C58C3399E05C0FDBD31F80A623E6C83356D3E65BE34C6DF5445D10C27551F4D5697B9FEDCFB3A0BE6F209754A7364DE364FCC11BBF70366A2C61864F65FF203DDAB2C693C82BD35AD6C0EB9D001DD4FA520F439BFBC9E15EB6E186A59CDA292D1D9512CC67B25471F5557659228C0E663586D7E09D0FF8E6B97102A020DA9673B5BCB92800F72E36505766FAE603C886BF950A3A1C08798B9E9555A3A4E39B6DD20B1B4336C09F99D7182DBE4D1DAE287653C63E1756E9EF4F7 -20231018213032 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834379427FF -20231018232202 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638343DD5A117 -20231019004844 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834429F64F7 -20231019010247 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383443605C17 -20231019022342 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383447F1B393 -20231019031710 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638344AF828FF -20231019043555 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638344F5C458F -20231019044032 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638344F983EAB -20231019053824 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383452D8631F -20231019063745 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834562930F7 -20231019081055 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638345B642C07 -20231019100522 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383461BD232F -20231019100852 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383461E6DF8B -20231019105326 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834645F1673 -20231019111044 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383465527463 -20231019111309 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834656D78B3 -20231019115348 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383467A7C8F3 -20231019131104 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638346C0D8BDB -20231019142914 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638347067646B -20231019173223 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638347A9DF68F -20231019175446 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638347BD81D27 -20231019191611 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834806DF947 -20231019193510 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638348179CB5F -20231019211306 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383486F90F9F -20231019231750 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638348DF30017 -20231020001735 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834914CAE7B -20231020012141 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383494D94DBB -20231020014803 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834964F5923 -20231020021214 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE6383497A3C3B7 -20231020034933 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE638349D0D7D8B -20231020044258 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834A0069007 -20231020045617 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834A0BEE89B -20231020064548 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834A6D2ACC3 -20231020071102 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834A83942A7 -20231020083119 2 6 100 8191 2 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834ACC3A13B -20231020092435 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834AFB5EA3F -20231020102437 2 6 100 8191 5 FD04CC30F7BF7D987760BE4FEA189E499B09DC2781A9AA9BB317A3C7D8BF99E3CDFAC9B6CCC12703EDC9EBF48F4917314723298E5F8A43920F2098EF0CCD7A09B7841411EF6F075575B375025F228A4DF56355DDFADE746FA4A9303924B871C442B3F341C809C37A498823B276982BD02A58268F5D7DA88859801A464C41CD725B23C0E52515657B9CC4B377DCE9CBBCDAD24D411745450CC9EA6DA349E5CDAE9D5870817286B4E4AD7D152EE3200CB9A4DF18321E1A8D36560DCE6BB1C2D398594A7A907723C1BB72E40473EEF91998649FCEE5DEA29353BBEDE80A22C0904355536471CAAEDC3A9F1D1B9AAA485AD6F562865483A90A699B96ABBEC4223AD2A4B398458D63278AEB887EB433DE5EEA6D6654DB597F6C557558191A05130FB3E113E50515DD07007754FF905E55AC92E3147EC319017759A7B84D81BDB5A0EF2B9BAB184BB5B52ECE2C0C15C33B9305A41811F6E661F7C0AE6ED1F101ABEDE4EDD3EFFB81AF98C666D1EE3532C3917349ED6FE12F2D9BB0BA0C81BC0F100B5E44D2C79FA8AFD161F37C913798DD6B85CBFED8ED1109AB19E505ED9BCF2F30F3DEFD9EEE2FF67B07F2D189F7C84B941A9F2C9E81E77E1F4A92B70EB630A7BE64C3FD2C0881E42DFF118E3FE627771A1FD7F65C6480156E88D3F80E7A58939A44023B25184E53F9702096E22FDBCE23C8995A8D058117EB8F1B92DB232D74308204C394FD2DEF237BE4FA0870267BFE7F3B0A279D51C80D434669DCE6153038D653F1A55BFAFA79D68F740DD35E827475DECC6F9B55A635DFDCEE9E48252D2B0312711A32995B2F9325A4B9D7406A1A50387FDD2CF9BC9763108C2E9660935B159371387BC23599C94D68FD4BC1AE88ADCB30FABD1E8C369B13E857EC001F7D2E1746DD4F208766BB321BD5CA996E27051B83A482140D58496A54C49D584397E618E8611012F0B8070B58393B658FD365A11E76A7991AAB691B8FCE882F67FD2C7456C96EC91AFD9C7821ECC0470097F135ACBCE8AE4880C78C3DFE968D0066731EAFA5C411A6E17E4BB1A2C54F26F3AA9E900676182E218766CED65B212F7893C32990BC3C034E53216D349A3BBA4A9E94E2AB6F6D023FD9E8DB61F3D6AF9C4010BEBB06B12332DBADBEFEE8C0209B8AEC80E87AD0B4FF48E499F0722674862FA974470700F0E51D9C78CEDEB51BF06A8642BAAC990B0A0B8C44B7BAA4634E4B90788C3C6633AA14B859B743C1986435933EA19D01DEFC36ECCBCC04325B1662D9873FA24BEC87560C3E059AA491E960A5977BA569FC780744D54020C3CF3C539A629A7C8475574EF4EEA4B7BA6EE1764D95369654953938E51CBB5FA442B8517FFFA77E42269EC4270D1B2148CBA1546E4E04CE3C0CC956D10D799F9D1CF5F111D06323E08BDD8FE1C1420ADD181D4D6165C0329E3EEC0F4BE63834B2F88B67 -20231020120924 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E53BA038B -20231020135128 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E5963D87F -20231020141837 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E5ADDB3BF -20231020144225 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E5C23DA93 -20231020150405 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E5D53167B -20231020155408 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E6012AFBF -20231020161645 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E6155F8BF -20231020201740 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E6EE62BF7 -20231020212403 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E729EE083 -20231020213051 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E72F5F79F -20231020222529 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E7604BE3F -20231021020659 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E826C9DAF -20231021024826 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E84B7FDA7 -20231021060900 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E90033123 -20231021070156 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E92F5819B -20231021074615 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E95655CC3 -20231021075426 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E95D1FF3B -20231021080049 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E9624A203 -20231021094905 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E9C2D4FFB -20231021101528 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E9DA4B553 -20231021105156 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15E9FAA5047 -20231021112242 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EA159B54F -20231021121606 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EA462327B -20231021123502 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EA566E22F -20231021140626 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EAA7D27A7 -20231021144911 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EACD5272F -20231021161127 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EB1713BE3 -20231021162002 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EB1DFAA87 -20231021162540 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EB22A3C83 -20231021174652 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EB6ADB0DB -20231021190654 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBB224183 -20231021192557 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBC2D1F93 -20231021193213 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBC7ECAAB -20231021194107 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBCF4C693 -20231021195056 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBD7953DB -20231021201746 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBEF4D117 -20231021203518 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EBFE78F6B -20231021222354 2 6 100 8191 5 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EC60AEBDF -20231021223151 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EC674EB1B -20231021225247 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EC79E5D1B -20231021231628 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15EC8ECAA63 -20231022001025 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15ECBF5D973 -20231022005100 2 6 100 8191 2 E01A60D3325645E3E0DD9D0BD00BEB9715262052AA5A04F3232BE563EFD025CFE05B0A86B07BCC4CB70A1D115E3DD0E1D5B5C394B491144DF417E29A1FBE336AECCA9E68BEACD5979103B7FD2923A58AB05E3195A5AFA717AE1F5F4B19C6616CCDA2FC597B3C92CB2EA57C10580C488638BF1261AA552DB9B4BDAFA45BBA4D7BF0A3A2B066F797F1B444AB990D9797A445D752647EE9ED870002A04DCA5DB1D65F3AA9620DCC4547A640BA30B27B09B48DC3BB06C9F714A9ECA54F09AD37BD57557E5EAD0B64C5CCCD2E2592A04E009BE169B079E3DED7161AB33474304BC70861BBCB2C05776EF82E2B32F0939E1C271187713632C6F624BD13C9C714FAFB99C4D5A36C1A7EF2DE6A18D5BC2FD2DAE7450B78494FC94ED842476B5DF567D47F066A1D168483B1A693A87E831B8DA20B48A05D13A688E30E7FDCB8AAE34A46FCC6A5642BCCF1D2FBC1804789E2D1D7098BA9AF2C94C889D58F949F6B97338879A45D26A3875D8C2098E41AD429F3B7AC9DA8B6C3D714CD477049487B778E553EBB1BAF2403FFDECCB38D691F3E31A7DB9729F1651E42972284802C5C14C76CACE52F1BAD053769C9ED3052A5370B9363F0A87273CE4ED2521F41320E0BD053CB2C79F79B708F72745E2B63D0894ACF06EDF0E612CAA81B38CFBBA421A61924C6794F0B321823C411330703F0291CDEB0FE71A3D3459413933E4C6D681A765848809F787EBA5E14EFF0A52FA57003589A7039776DA11F21B12F14424F694AB810D5C8271C8A108659B190A029666F77357AFD28DCE2BC93EC38104FA250E29610F477265622BDBEE96A933D503A7F820B3B4DB8929A43B3BD2167BC1DCE61708C1D599D7A584DA5A2DD6EAE2D5D6428E8A0912CF18D9FBA71ABDD0F975B43B50056315F76148739D3FAFEA4094EC3E25A3EDC9F0133E0C435C1070B2F7C073EC33D5B7DE096DCC490D82CE8B053F24009F73450C49369B91AD381581BEDB402909A2C95CE0AFFCC64A51C5B824666A26E1C40F2A2EC104DA1F481ACB967068E6A0E4A5CEC1A37730D7A93761C6BE3F745FC245FE16B841444DF177B2F779A8D22FE67EC92166BAA7ACC6ADB84565369D0B174686783775F79C5ABF65E726911833385457DC896E150D3440504D9F7FDC087698F69B82052FE4F2B577CDA4262A7B26FA7F38CD3471AC7E433CABD3470B309A96585FF7C3889B6537ACADE1E79F7B605387BDCCC5ED8445DB923B98D11F29EFCB413FF2E09E9E543263309C87E8C7FC22F13E9BDFF2F04CD36DD2FFF425EEE50C1460C676A804CED5319C0D68B60251494EBD97C73EE0E7803B4B8414D4503954F40147885299B8EE19ECA8F2CC2FA48230781F788D9FF1AA7A9D1F23E54357EDE3DEE548C80DBD0F0DA070ED149A34EE08FB3FB01895C5D2ED1E68A5508A5BFBB7D2DBFA4C46830D15ECE33665B +20240326013051 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85DDC5DFB +20240326013055 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85DF8EE9F +20240326013100 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85E15B2AF +20240326013115 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85E8800BB +20240326013121 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85EA93D9F +20240326013127 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85ED33B77 +20240326013129 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85EDE96FB +20240326013133 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85EFDC7AB +20240326013135 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F004B07 +20240326013147 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F5A20FB +20240326013151 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F780007 +20240326013154 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F873847 +20240326013155 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F8792BF +20240326013158 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85F99602B +20240326013212 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A85FFDCCE7 +20240326013219 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86033F8F7 +20240326013239 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A860C92607 +20240326013244 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A860EACC9F +20240326013252 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8612623A3 +20240326013254 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86131122B +20240326013256 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86137AE5B +20240326013316 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A861CE9FAB +20240326013319 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A861DDF033 +20240326013322 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A861F71477 +20240326013330 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8622DF73F +20240326013333 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8623FA97B +20240326013347 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A862A6F8D3 +20240326013357 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A862EDADB3 +20240326013401 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86306A44F +20240326013402 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8630A4F4F +20240326013406 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86329C6AF +20240326013412 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8634D56D7 +20240326013433 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A863ECB6D7 +20240326013438 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8640E99FF +20240326013448 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86456D45B +20240326013455 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8648DB9CF +20240326013456 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86490C78B +20240326013506 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A864D48787 +20240326013511 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A864F4C14B +20240326013522 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A86546E877 +20240326013524 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8654FB6D3 +20240326013529 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A865742D0B +20240326013534 2 6 100 2047 2 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A8659900A3 +20240326013537 2 6 100 2047 5 D221068E02C30ED0DB86E4A0861A1E810B7BB629273F85D3706B90056B2CF34C342FF875ACADDDF5E49A87B1B038567EB05D77EADB0905CD24ECC8240F5EF15DCF197BBF61895F00DDD75D949C9BFF7066625602DBD460D9EA7D9E06F70AA721011BE246139444E9AB4ABFCCCB1A5943E67BF7D3AA5ADCF214945B1E7D8E40E44BD60D9ECD3C5E151944467F1B3DD3CFEDEA7C15CAD12F4F9AC78C7E0DEE2E15713C13FAFDC297DF06F3FB0BEBD1F481C642527085FAF48A29CB1BE20D5FE235E29345BF213C475F5A20CFA960E716987614825120EA968864837EEB68DB47A1F3336927BB9ADCC54A4341228289F92F9E23F1FFFB1E59DFCA8017A865A3FE37 +20240326013538 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F049F51F +20240326013547 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F0859D0B +20240326013554 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F0BBD077 +20240326013607 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F11279FB +20240326013628 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F1B2B0DB +20240326013645 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F22EA4A7 +20240326013653 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F266CCCB +20240326013656 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F27B8CC3 +20240326013704 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F2B6898B +20240326013728 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F3661F27 +20240326013732 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F382F33F +20240326013755 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F42B19A3 +20240326013815 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F4BFFC7F +20240326013816 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F4C4D313 +20240326013818 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F4CB895F +20240326013838 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F55F34E3 +20240326013843 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F581582B +20240326013845 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F58BB9BF +20240326013904 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F61FCE5B +20240326013920 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F69490CF +20240326013923 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F6A8041B +20240326013953 2 6 100 2047 2 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F7815AF3 +20240326014006 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F7E1576F +20240326014014 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F818E747 +20240326014019 2 6 100 2047 5 F7B6DB1359F90C032532089BF3BAE4A2ED1209EE181E517D24238A7EDF32489C1E6F3DBA19C01489FF3B6A2764E932B108218462111D8C834EB642726F08FDBEEBC08DC25A2ABD10D72DE4053EF4B48AD385A0EB97F1EF96F01BAA45AA914BAD8096B97919F724C1075FCFBA43119006C61A5F4E991B791E1056730CF19E9215B482F6047104269C1122AA14A76B5537621C0A620CE4BD63A70B898E002D19BD2897A1D036B6283EF9CB8ADF92806CAEA8AEFCDE63F945C5F098E11824BE3493225F9848E08F4AAB4E4C3621D8AF209C02058683332CE1163D158C484ECF99095C889B900127DE4367D2A8433E5D23DAB5F5AEBDA97C425F8B169759F83E49A7 +20240326014532 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3425DB7F +20240326014544 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A34464EAF +20240326014614 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A349D1663 +20240326014629 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A34C39EC3 +20240326014710 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3544B6B7 +20240326014727 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3574A89B +20240326014741 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A359DA947 +20240326014823 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A361FBA5F +20240326014832 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A36377BB3 +20240326015023 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A37A19A47 +20240326015025 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A37A30F2B +20240326015030 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A37AD1B0F +20240326015038 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A37C0B3FF +20240326015116 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A38348BB3 +20240326015159 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A38BA81C7 +20240326015331 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A39D93F9B +20240326015416 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3A61FCDF +20240326015505 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3AFA877F +20240326015516 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3B1796B3 +20240326015601 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3BA5A777 +20240326015813 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3D516827 +20240326020106 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3F7A7897 +20240326020108 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A3F7B337B +20240326020156 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A4012DDF3 +20240326020241 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A409D1FB7 +20240326020357 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A418A36C7 +20240326020359 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A418AC37F +20240326020434 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A41F5DCD3 +20240326020621 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A434E3E3F +20240326020642 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A438BE4BB +20240326020655 2 6 100 3071 5 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A43ADA137 +20240326020708 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A43D0D1CB +20240326020800 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A44709DB3 +20240326020836 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A44DBD6DB +20240326020854 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A450CF663 +20240326020934 2 6 100 3071 2 E5EBD573C64E8C90F57D2EA3086FE8A0553F6E71A29D8C629C3AA54B6648F45B3CE898928396A4E07340D3B08C83DDF2DFD73A938E8716E633EFF84055EF653423B67B0C98C1BB45E6D24662B5EC5F04E90EEB4FE7EFC4F2EE41AACB0FE5712DEF846A2454C0FAB58061046FB8EEEB7FB351ABF70069E22A9901246EF9A8640AF80DA998506C749DED56E421DCC0FFC09F2E011C237573CDE365CE2E7D41C2614602CACDA3706EF919ACD82FF79FC1DC48C2F724EF8781281F67CA0E0835455A8D2142F2A820C2A57B7E9EA2936E76044F09655E2B5EC40BCD6198DEB10DBCF87C2CBA659431D54921A880F79DCB5C9D4B7CFC688A2BFB84D40199A41461A8FD2A0EFD68F72358311886D7FA3EB29F627133C892E1E27626D476A271BC1C3970C7B52C996089A16798D2E4B7D43E6233450A89F356D9A4AB9C00E4D7683480F7618DFF43DBE5D8324B95A49F4E71874BBD0245D30B2E57DEC68E85D176122EAC0D398A0DAE7A1880BE551B47E28898FED4C40A38365830967BA1423A458A51DB +20240326021106 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585539C8487 +20240326021134 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258553F5040F +20240326021206 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855453B76F +20240326021324 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855546DBDB +20240326021407 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258555BDDCF3 +20240326021424 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258555F11B9F +20240326021450 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855644DDE3 +20240326021458 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855656D6E7 +20240326021614 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258557488DE3 +20240326021659 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258557D16D53 +20240326021718 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585580918BB +20240326021822 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258558D0013B +20240326021836 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258558F7A96B +20240326021921 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855982467F +20240326021932 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258559A0BC87 +20240326022009 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855A12A95B +20240326022029 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855A4C1027 +20240326022038 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855A608723 +20240326022102 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855AA76F27 +20240326022132 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855B050E7B +20240326022301 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855C2121F3 +20240326022441 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855D60DD03 +20240326022451 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855D7D2637 +20240326022516 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855DC6F6EF +20240326022530 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855DEDE3DB +20240326022711 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125855F35973F +20240326022824 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125856017684F +20240326022834 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125856032C153 +20240326022854 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585606C9E9F +20240326022919 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258560B97F3B +20240326023041 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258561B88E3B +20240326023119 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585622F17B3 +20240326023135 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585625E20DB +20240326023142 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585626E1567 +20240326023229 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585630054CB +20240326023255 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585634C7DFB +20240326023307 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A3512585636F2A3B +20240326023310 2 6 100 3071 5 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A35125856371CA8F +20240326023417 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258564487EA3 +20240326023451 2 6 100 3071 2 FF64FA2B9B9C1232EEECB2CB61C177D9714DAEAB27DB484855D95D7851B1CCD86068CCADB2EE0DF3C4FD76B2D7B8963DC5FBB49B5A003C23F423141B9E8FFFD771F5A40D47B74B8DC9704D7F3023637905DCE2000F5F85CE9699626BA067C7693A5CBC03598D402679D874A38904AB699D08F4E6BD73830B57BE87F9A10858EC3C342033B25D1DD6AD29D3CCB4AF01BC721AC75082CCFD5B098B15F5F154F222C33F580980904EAFE0BE926F740A3165BCC89C47E74C9B713CA0332947D1F9A5D05A52117EDABF7316C54605FEA3AE7EB7587E05EBC98A2A3ABA708E85DABC10BF48B64A6381730FA722A3FBFCA80817E1F0EDE608EAA6CF1FADDD8FABDF59825DC0DEF002BE804A59E70AD94C576E049D445656644CF2AF384220DDBEC013C0F532BC9AB8283902F8E8D6CEEBFA8E1CB4CA576A2B0500E26CF967603A69084F9D877953034E38AE87ABA7D08926790B1A37A613401CE8D42CF4384118F6CAAEA1C6B28A10DD710F681F328D73EB3E43B3EABC74C5EA8133A351258564AFE53B +20240326024347 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181186E03B3 +20240326024508 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818118EEB0A3 +20240326024849 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81811A4ECE4B +20240326025526 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81811CD141E3 +20240326025628 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81811D32676B +20240326030110 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81811EF7F1E3 +20240326030518 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818120788D47 +20240326031719 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818125002673 +20240326031926 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818125C6B433 +20240326031951 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818125E6335B +20240326032742 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818128EAC3E7 +20240326032936 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818129980033 +20240326032952 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818129AAC3DB +20240326033059 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812A0B8603 +20240326033458 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812B8E0D07 +20240326033533 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812BBB8B97 +20240326033606 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812BE87FF7 +20240326033629 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812C03788F +20240326033712 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812C3FAF07 +20240326034008 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812D534F8B +20240326034204 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812E080CA3 +20240326034508 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81812F2F5493 +20240326034751 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181302AABC7 +20240326034806 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181303CD8D3 +20240326034823 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181304F3DCB +20240326035043 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181312A3FE7 +20240326035348 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181324BFA5B +20240326035602 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF8181331F2E53 +20240326035702 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818133769453 +20240326035737 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818133AA336B +20240326035756 2 6 100 4095 2 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818133C16B8B +20240326040216 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81813553AD37 +20240326040447 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF81813644788F +20240326040552 2 6 100 4095 5 D0D3C82A946A66A83A8CC225EE93B60D6260A5167B1476B41D8FE172E9EE15CE394E23C7F35D6BB24C0D3A5266A4F21DF8FF23134101FDA61F9D92F70AF32EFBABC5408226C6F931149BF40FD4B166B21B87F0E76B95A9095E0ECED05C7F81900F7216E7DDFE22FA3E4EAD74992DB6FE68F539AAAF285CE869BDD819AF650DAE192DC217EB6988E92601FAF7FEF564AB4A01C7E24E38F7B6EF0CC17CA220E6269AB1E837FBF694B3961E5AEC0C85D4800B3334CE6E8716F94557B081927267D33F1E7A3DD7FC965718956E2364E956076C23CAF13A5145F1BD62DC073C8170BFA98D8A405717190A95C98E598613AEA578B5FC4A9A08B80782D9A3EF49A6A464DA9D5A3B14F1CDAADAC4143FA77C9FB73FD5DD650CF078010A8FC6C6946A4D991E75A0AC709DF3D028DB86995A2007913522632092292537BEB34196EBF1E2ACBD4A697056CEBA4DEEA8F7AEBC11963601C12C33B0FEA90102D87ECB40277B32067CBA52DD74CBDCE68597DAF04C4635AD5918E7AE99008008DDCC49713B68CA567D1F46C3C0A0A1403E722408647E072F6A3C543F9CCE36A025427211721D377ABFE15806AD07EBD60B5BCB23C50EC37B06F47D2AA941E3DF5AFB749C0E325ED8A4157E7695696B08015BAEDA784B3503F42019AA96CCBA41CB72E0CF3491F440116B5BA679355835BAC1164676279FA026655D285CA0F094CF818136A4C7F7 +20240326040951 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D80EA89E4B +20240326042517 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D8147E15B3 +20240326042616 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D814D61A3B +20240326043713 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D818FD20D3 +20240326043724 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D819078123 +20240326043742 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D8191EAEFF +20240326044025 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81A204197 +20240326044258 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81B145927 +20240326044447 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81BB935AB +20240326044534 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81BFCFA6F +20240326045348 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81F0CEB6B +20240326045438 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D81F582F4B +20240326045630 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82007A843 +20240326045745 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D820792B27 +20240326045949 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82142CB8F +20240326045957 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82148EA73 +20240326050355 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D822CAC6BF +20240326050713 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D8240BBCC3 +20240326050731 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D824214D3B +20240326050903 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D824ACACFB +20240326051214 2 6 100 4095 5 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D825DF67F7 +20240326051332 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D826515C63 +20240326051747 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D827E42F0B +20240326051831 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D828243B8B +20240326051843 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82831A223 +20240326052417 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82A48CE23 +20240326052731 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82B78A8F3 +20240326052959 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82C5D399B +20240326053126 2 6 100 4095 2 F52D556E0D75D910A1C4DF0D571DBCEBCAB3513CA78923277BA6240C1BB579A73E56739548C0F6882B5C8BF03A15C36CA58355E6EE2170ACDFBB13CF60BA34BD92FFDC091D9AC86141CAC874E1615508A2B1A1B4A31E81B2E1982AA3ED676B3DFBD0962400B188F56C6DFCDE7CDDBCEA57654D61272C585EDBBE0449D1AF74C537F8A022BADDCFC2E6F3050B586A6761CFD444DF39CC585715A0CC863B9B225499B3097CE62B7645485754A1A8B3010FCEF13EA07D29161D1F3E701B5BC3D99B1EF2F8916F862B4815BC0D0A3385B33FEDF1B7FBC85F615E051B8A31F32A6B4213754A5F8E4BBFCE77A292BCF482B7FC30E817A591170E72696359B3635CB393BEF4075DDD7D0734E358DB2A803EE621CBB04010EAC75F810D72C41A3D7013EE2799A59D7A8ADAB73E0FD5EE4A6498CA8DF000AC152C0F6CA1C57660D0DD750A6A5F788F89CC424FD19FBD42E9C7E2A949FBF43FC67528AFD879A37A0D1D38E05328C5216BA938C058A341AAEA8D8EACBA42610B0E7823E74CAB6CA791F17AECB532DA5BF80C056B67BDFDED51A97C95AFCD32509C87600A2D734F23944552727CF726068C04F339D206BAF472A0C2E2F22D7CF939B7A6FB3D5C67B0564537A33E6802DBD07AEE817BAD37B5287BA678E962EB3B8B5BEFAC937241725A1B8789C1609706B24C7266FAE9195B9536151FE3D65684AACF304BC664F4D82CE5BB4B +20240326060038 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A3C767FD7 +20240326060444 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A3CF77C3B +20240326070240 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A4448EF33 +20240326073131 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A47DAE05B +20240326073415 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A482BBA27 +20240326080953 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A4CB6AE7F +20240326081127 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A4CDF5A0B +20240326093032 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A56B6523B +20240326093454 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A573897EB +20240326093728 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A57820693 +20240326094259 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A5829EAF7 +20240326094948 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A58FD0FEF +20240326101231 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A5BDEBEE3 +20240326101412 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A5C09FFB3 +20240326102704 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A5DAD12BF +20240326103806 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A5F05465F +20240326105506 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A611EE2E3 +20240326112146 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A647870E3 +20240326114154 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A6707EC03 +20240326114315 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A6729353B +20240326122735 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A6CC0FBB3 +20240326123728 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A6DF24D2F +20240326130541 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A71768773 +20240326130743 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A71AF6A1B +20240326132826 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A743654E3 +20240326134513 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A76478D13 +20240326134939 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A76C9E817 +20240326135416 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A7755E8B7 +20240326143409 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A7C397F2F +20240326144117 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A7D13AF93 +20240326150017 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A7F704F7F +20240326150157 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A7F9F468F +20240326150526 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A8005826B +20240326150739 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A8045FDAF +20240326151012 2 6 100 6143 5 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A808FF207 +20240326151536 2 6 100 6143 2 E0848AB4E94DE11B8BFF81622A26C6D2145529210F586E2C145E8E26243AD47D8FB09EC8A70E1DBC3C1360EB1E511BB8657803B33D9CBAEA50236234CFD5354B08A7F9ADAEE929E263FFDB2572D56BE935DB62E8BC56ABB4594F5C0E9944B002E3A1E4DB42DEFBFEFCFB6DC014B5E20B319AC14C08FF4881E1648B39853C2D02C12EC355531BD61DCB6DE2EF99EBE4960810D43EA00A4F4CDD1E6A4F6B8037A737A306443E0E7F5B121101114FB3859ADC3C1A162DC937E6789B130DCCE01BF013CB3E79FAE8A4F6D1BA8EC5D2014D5E807DC5B1837AA025AE5A1A104C3FBC676C595DB6D27EF9F417F29C7CE3C48D2CAF46B9B79B2DD203E51E15A455B44D7EE85467BA02F922CB10CEA99C61589041CDA67D8F48A80FEC7B68CBBEEBD9DB6A82B377FFDADD912FCFD17AF6A08563F6CE7EF94153C9666CEC4D4210801E9BE697B3EDAC935E13A7D490DA08EC4F86CB2DC4497B0B4F031366918CD0ADD7B28E3E29C258CC3550EDFF59D8BCE4699296A0625AF61BA1DD74107CAD7D7EED70F3CCA27FE27E1A56C7AFEC8F92FB33BA5B322978D941FC4B39D22B1D952D975C4B1478E09F4ED4E98C054B80AD8AA5E02B5F0F84711E1464587FCF94D06CF716BA68141C3EADD9B501FA73B9DC49C19E95CCFF50613417CF6C95824E9C108B094C9AADC3E2CD6D2FEACEE698800ECF9411EAB20CD2A308B6983B25F3741D5EB12E7C9D46505CB2B0AA00FBFCFDEEF158FB28B4A93BEAB3EB4079EA6C6F9AA618A5E80560EF8966FC202ADB571DC143082E3E444149DFB3B3DD7B325440563A67147F351BF8B4C480D2635B2C78EA102E42B894489A366FFC764B502F3D48EFA342E7F0D13B15EEE257BE326265740BA62CA2DC2E6E49CEF1B11EF903CC0E756E92BCF404997D56631C817F44FCD826C6C0140EF990DF1FAA8A0A288DF2DDE4D67214C9B27F6D97A89D2067D59D1FCE0B65A27EAE0E6F065F01F0B06CF951E5D62460947DADAFF0B339CBDE45D8E6BACF1FA59676D9F65FC202FB640F3CCE10C2A5F4923F73AB1F9BEBF68906F4F36F469C7996739440380E4D5F63FF3A81343BEB +20240326162321 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5AD9F98F93F +20240326163529 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADA11D7CC3 +20240326163654 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADA142310B +20240326165530 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADA394A593 +20240326171340 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADA5C7FE3B +20240326175630 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADAB35A653 +20240326175808 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADAB62C48F +20240326184011 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB0B50FD7 +20240326184335 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB1203D2F +20240326185246 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB2435AB7 +20240326190020 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB333EDAB +20240326190122 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB34BD947 +20240326191114 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB482E3D7 +20240326192702 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADB67FBDFB +20240326195941 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADBAA83D13 +20240326200115 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADBAD40AEF +20240326201633 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADBCB670E7 +20240326203821 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADBF6DC6B3 +20240326204751 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC094E45B +20240326205334 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC1441637 +20240326211827 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC45F0E3F +20240326212459 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC52DBD1B +20240326214659 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC800E58F +20240326215635 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADC9314DBF +20240326221037 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADCAE8162F +20240326225055 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADCFEC8FA3 +20240326225519 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADD072DFCF +20240326231305 2 6 100 6143 5 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADD2AFDE1F +20240326233946 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADD60F026B +20240327001519 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADDA879EA3 +20240327002618 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADDBDFC89B +20240327003415 2 6 100 6143 2 F133729818EAD55DC3D8CA6C2754D6A78304D3CE96232D084B090E615BEAB6C63EC4B94BB1E33816ABCAFA3A08568FAD186C8873FDB17D7F9A28555871790CDA450A6EE13E97123F9A0589A77927047CE8B41B24F5505D19A3C4C18E132AFE9671423749DE1E110FB172AA66A15E405BD5CF56BE3CC6A22B13C3E03E42CA5BC3D8DA5B228C9569D7C15A2AE749A0F884A558687C2B656D94C167B47D9E3DD0691744E0D48858D0A1991FFEAAFE7E00C6284DC1E31CE3CED715F6686408BAEED6597453030DC62D033EF5A10B72D5367F7F1558F632CA86797FEBC16BF862D5CA0966122A584259FA0277B166F64F91959CC1F21E66BF0F6FD4489A00E0FC2E5C443A7AF646F32A772414D29F7A8116264C089E7D8A436870F0BB98EB134383464E2583DC569C9FC7D779D8C51A6D8BFA498FF8CF0F3CCDB631D794F1330E4E27A922BF0B0CADD66C11C885977B0AD344910D930E9D22F800FBB5A3712A5581C13D0378F82B2481969FC22C6A82E522A271C5FCA7079EEB7718D67BAC06F6A83B094B4FCD95BA2BCDC50EB547C79AAD9392DB976298511E0C270411CB37E3C1228ED8B018B15D3E2B334756DBF219624F2A2C6226FBF2EA33B9AAEC961E6BD3D7B6C9625ECF7E649D5EC21792E0A3E75E998FF6464961E74DAFB9CF95CF1CD654E4906FB725B381A325BE2D967B756072194EBAF8A2A524660EFA430957F30BE266C1105474A41964A5F7D5C9782FA193221BA23D9150CB5A08A3E231C62088D42FAA95777ADCE5D63ACB49299FBB1B29448A63B683B5799EE8DEE56B56748B7F269B43C35200716D74B5010388CF17B082AB285AC0DC827AAFF482EEC13268514B4F45AF6E0F948D3F466CE07C38A1308ED781B89837EB7332748A1BDD7E75CC904C763D44B0BA7A404046F1422B29DEC63EE2A524A123B8F971A181E8169601EBF10AABB5B71649E00E3D4600E23D2C20096CE2DB122C82F15A85238AA2337B559E7E8D0A824929956AA2394746B03E36A401565C2048D3DBF0411A8D4BB1044A9904290D264256B9085DA6001E5C208A2FB2760E94B958B4B2D5ADDCD9388B +20240327012525 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123BF06ED93 +20240327022256 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C2EB1D03 +20240327025321 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C4EE6D8F +20240327031901 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C6A6ECFB +20240327034252 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C84AA3F3 +20240327034558 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C876E36F +20240327035607 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123C91E770F +20240327043824 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123CBF90753 +20240327061734 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123D2A46DE3 +20240327071503 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123D6765ED7 +20240327080706 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123D9FC24D3 +20240327091530 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123DE8C18AB +20240327092725 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123DF4D10AF +20240327100400 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123E1BE884B +20240327102109 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123E2D9E9AF +20240327111646 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123E69B7CAB +20240327140134 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123F1C97CDB +20240327144258 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123F48C6AEB +20240327150511 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123F6023BEB +20240327153839 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123F8480A9B +20240327160724 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123FA2AE0EF +20240327170619 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54123FE1F90CB +20240327201733 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541240B20240F +20240327202608 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541240BACBC77 +20240327204230 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541240CCB39CB +20240327220340 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A5412412509EF3 +20240327230112 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A54124164279BF +20240327231350 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A5412417159137 +20240328011850 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541241F8FAF0F +20240328020121 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541242268881B +20240328020416 2 6 100 7679 5 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A5412422921477 +20240328035516 2 6 100 7679 2 EC85B1B812727C95C9C6D18B4F5700D62DBF698E4F4663A8C3298C2E301DF351147BB27E17982D2AF86FC969FB517AF57B10D864F23E8604341D97ECE9D33D31CA686CEEF872647B720A3010AFD4B85B0DBA65D3C9200D2C87BE4D4CAC50CAEBE0C92600F73FE5B5FD60D09762105BAA466DEB7809061EE3E4D0621D53DD39F5D7730324DF21FD9871E0BBCEBBB5450DBA4F30CA294BE8AE76D4318F8C543D9E6A032586BC29BE362311B3087657F3A068ED3221BA4EF3FF233C721D261FB9EE8245E171B32FFB8E7BA85ADFE304C784FF306AF7B2C8D9CDE0209AF5592BC33CAE85EAFB662808FA8B45405C4C0ED10DDC3B44C9A69AE6EFC86088D91C137046B2C2133EEAAA55EF5A55D4501B6357FEAC66EF33E521CCBCAA4BA4969EFAF7B41A2059C391AA92A387E75E02E8A018911D13899851C88B81F0592219032EB0538E6CB37E69A8FE2D7E759C7548556FF28B61F3DB0D1D945CF68BEC64497C803A4F8EB9B88F9872963A792480007310840F83966B386681071FAD8E5CF1502B6B2985C39E4D6CE509F086B53594B93A9AE3CA763C5CAD850FD1B1138B88E6741E7198ADC5768CC1737DEB702270FC8DE01042774E36AED88262D1C8B2166F84A3CEB5623B764CD85C808DB607837701D3F5BBEF83D19E927AEEF464079A9ABA5053CB0F2FD0942ABB568ACD050BF682809EAACD695F248D851CA0D7542BE8517BAEE4D0C8E22AA1C76E7650602723DD93A4834F4D87E74EEE8288F17175F481932E5FF012F903DDA99F74B547AF32937C7FD673ED79588C220D8EB60600747A32CFECC4E4E87001E6EEBB855EE56D47AFCD6B820D4130F6DB7E78948253A03E76CED6C399C058BB06253B799FD075DF738B7CEE5EF7AF153EFBA54A5A1EB9080A975B30262708B5E9CD283DCC8839CF10C28611B8D69A24A46DD926F755B84FF6C3D004313436C4E3E78A52D8FD8533DC2B1B7AFD1C3134B0AEBB0194844398262D56B442EEA1DD8731FE31FB785C2DFC32728AC502EF85A4A25EA2FA869172BDAE8872DA8EDA79020BF86E291EE8F383CCA7CFD3DAD66C92A734474A2AD7309BDB87C63F4FCD19E0C65912F9F054EB2E7A387CA81AB509E095C7331EE7DAA33E636663E0FF6DB66C3F3812C3CEC115B899FA6621B209E392DCB747F1800718A9ADAD04D48B5617D36AF518EF9A5A76FCCE8CE6BEFE567F1E91DA0FAEF318762B2E3D949C2D08A8544C80A841BF3DF01ACCF58700B804E7568F59F370DB76EEE625A7B380B38E4A1CC24F0DF6FD26C439B34B765DC4E04D6C0325DAF60A1C79057C0D94281E652E2C1CDCDCC304159440571F1B565F0A511647A541242A164FCB +20240328051250 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCB60A9A5B +20240328061956 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCBA8EE4D3 +20240328083541 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCC39DE953 +20240328104001 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCCBE8F2FF +20240328123936 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCD40450AB +20240328131851 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCD6B3842F +20240328133514 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCD7C761BB +20240328163521 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCE3D44693 +20240328184556 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCECA94E8F +20240328185443 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCED3C2EEB +20240328190404 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCEDD4DEAB +20240328193132 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCEFA3B567 +20240328194029 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCF039E777 +20240328205320 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCF523DF3F +20240328210032 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCF59C775B +20240328221220 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCFA7B3FEB +20240328221329 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCFA863653 +20240328222505 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCFB420393 +20240328224858 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FCFCDA54CF +20240329004423 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD04B953EF +20240329024223 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD0BE0B937 +20240329035503 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD10BA6927 +20240329035634 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD10CC8C1F +20240329035914 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD10F42063 +20240329045640 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD14CA5323 +20240329050935 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD159E9383 +20240329053141 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD170D04C3 +20240329054343 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD17D323FB +20240329062142 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD1A5DB2DF +20240329073301 2 6 100 7679 5 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD1F20E86F +20240329074920 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD20377F03 +20240329085033 2 6 100 7679 2 D4279A076EDA914DE80D14AF2DCB0B98294B99F706FBC061EF9007F2FA5897AEAF52D11A38EABEBA1EE590E35650894BA7669CE22689E6B50F11858063244F6BFBD664B19BA7ABD81CF1B65852069F215E8A1E1E72B3DFE09CAAFEC80797FF9F7AC81B6FB4A8813551385CD0D679E3F56BBFDC9069C7EB860A985C0170EA7899D76AD2D05AFD42205537E7BEB5782C27D2E6EF1532CEB5158BA23AC9E115AB472A1571A37E03439EFA47A04F61839D0DC47A8C7E2D13C9A018E87B5EB6B804AF7147814742D908212DBFB893171BC1713680CB1A036CBD0A6B6280F4D7B798913A9B59299E98F7553F202B0F33A2F67D6BB0071803DAD35595103E073F992321C4FFFCEB4F6AF4D3ADC9B53C41D8EFE7FE7AFE531E6485F8C087F18DD6B5A73101AE84737CAB85244E3FE085806104A9323907A94B06C437EE31D89AF7A584DE2F18DAD1A8E57FE1BAF5E2CC773EE57781F69A5D1EC4D8EB468BA9432394B5A9AD2F53B58A264B9C8E015F209DF60F865209482EDF309A575724A16E211CFC448799E4F05A9C2B1F09BDDECFB33FCC71211A646D8482F9A6EC20F10B38218A62182EB0E55BFF9BBA85585242B8BEFF20F1C88DFF9B20EA0C006D705B495750E2E78C4D1739347BF4628DF3F6A301DEDFCA7FA60D139B942338E8375471A1B33DF30316AF5584142D8B1E1F2C6966A08E2D70AED5DEC84968CAE5881587A734DEAD037A97EB384E4E07960EB4A64774579094763B71999D0783E95117BAB533C42516FE26A5F1C35F4FA2AF2B4F7A72E84B805DC31E8709BC36505F09954BDE0C86C918BC34FFD230491BECF307F1522AF4835C444D3CDBD0B00907B9CC3F483A51591659652378FF7C799373C2C40D238F8A2EBF6CDBC7FB26CE2748CCA89B85638CA12E7F5C477BB4FA0ED536BCCC7B3CFFC9E9D9126A8B1F56540A919A21439B66F3DF4C81A057B630176733B89AF3A29C297E2C0460265246AD68BF34E02391AD8C4601537B2B6BBD22C921D35574EFF85B1FE6C8A7BD6662CBF96D990929203D471F7648A7EDFC1E3AD551DFB688C6AC06E0F47844085C7485B00B5CDB3A3A449B26E104562531A12268ADC308F5095B066C0F82BD722D48A572EFC0F28865AE6EE37E39CAF2548C2B44780945AE573F8469ECC546FCEABCE9F518477ECC21B23B3E0532530795F1613B59C86EC0ACE047938CEC19C46CDCA59633F4712F989EFBDF065A5F64883C1E3960D7BCFE9FAB9B04A6DC4FB4BDA363E7A3967DF393799619DA22C6D2ECA276A6E9801CC1DCFBDBDD9985C09463B2F2CD57C922BF8FF65964A7B5EA4108F547F5D2FD328DD6A34C2B581AEDB7949AB8FD242F4BCB +20240329121808 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C124806CA43 +20240329122442 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12485AF08F +20240329153134 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C1252D3F0CF +20240329155254 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C1254053513 +20240329161124 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12550A7BDB +20240329161738 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12555C651B +20240329174531 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C125A40EEC3 +20240329191732 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C125F71710B +20240329195323 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C126178458B +20240329204827 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12648DD15F +20240329234203 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C126E5A5097 +20240329234306 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C126E615ACB +20240330005652 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12726F6443 +20240330033619 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C127B69FC23 +20240330044619 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C127F446BC3 +20240330054010 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C1282492493 +20240330055823 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C128344D603 +20240330062335 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C1284A06C1F +20240330082107 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C128B2D4E73 +20240330083555 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C128BF7E127 +20240330084121 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C128C3C894F +20240330104737 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C129350C1FB +20240330112334 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12954A50B3 +20240330133619 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C129CB0C66F +20240330135122 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C129D7F94B3 +20240330141203 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C129E9C046B +20240330155328 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12A438CDC3 +20240330164337 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12A6FF833B +20240330172236 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12A9222D1B +20240330193325 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12B07FB5BB +20240330201458 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12B2CA43B3 +20240330212712 2 6 100 8191 2 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12B6C88EF3 +20240330225844 2 6 100 8191 5 C4FF326CB002CB4F25BB4309818DE616BCD6A04CB1C8D569FC4D34148B1D5D6B439D6DB946A264765BB6EAAE20B1B737C3CE28B7047D18B47C37ABECEC047E51A0541FE6434045192CE79898A70E6D93E12C35237219A6E3E00F88F5B1EE69982F0ECDA40DE90F5181A6F6F9BF5F9C497A1589ED3E2C16C68A41EA50D544BC57DB544F81F3DD6E6E09E0261A8FB2845A73A13156EBEC90719DE167262FAA68FA08DB412A918DE0D0C5585262DAB724FE31489205D7EA7C669DF4A4423E537153DB359EF31A71FE15C0707D46EE8EFF55305742BE773C6BAD327B2DB2829BF88216A275DFEBB04B3CFA2CF45507788E1DC5EDAFA03A03AD61CFCFE40D7CF7BF3712874CAA2C711691DD189B7024520B0B07D51095E91162FCA7203ECB4DDC9FFEA8355090AB20EEBA13F7901F5B71AB397CD097E0443DFAC8FED92DBBF2B38100E3CCB0118B2C8F27876D6067AF3EE9E44C7F44472C0DC419DE40E23D9DE359138028A9423328261E625A7381012787C370BC3C933C192EFE8CBF23F80271CBCA40F39D1BE4B4173997E646FEDB7AC81006E10D96559EDF6490A56FD47945E35A102C8B00EA740A7F1B53B4CC03D2DC302A8EA16971403CA8B826F6D56E307E04C75EDC1A8565A9EFBBE0F6ECA61D976649A23C82D9A8D7AC3E5124334916A75A6C8AA3B5DFB00FFEB893E6A7E7CEF0622C41C3FFB0B83C38A329E7144F6C06E789D897E3704817C6A79548B8D394EC53A460517DFD1513896B8360156561A5668AEF0F9F2D2B1CDBD4DAA8ED0C28E774EFE72D9FF758B97DAD89B305E5EC82BBC17733DB5F550EFFF1C45CBCA807BD7461C2D3C80FFDE3C1D4410DD678A94ADA54192EABFEC129C5F33DEADEF0C15B1D13782336637544FF1433E97022E45CFD560870ECD85CFF72944596B73DC7D9F978A07A47806E97EDB253019551791D6C62DEB669F5FA5EAA31FCDA0431C07AD97004F527C72548E9D22936D47D8963ABA0D82231473AF8CA45EBC59D93FCE197B7930AD7A82E3D780391A317097CFFA545DC42341FB1B265B851BBF55D95EF63A9AAFA4B2A78036751FBAABCBE9A8215B050AD478C3BF350462A4812A4FDE66FAC8B91718AAD80B68D21E5788F7CB3711F23F25EDBBDF7AC6DD9FBC110EBA2272750936C2F2A74CE5E69DE59A0B6359076EE3FB1D4F2779A6AC5753C860C2CA448E036EA15055D4A19148FE7BCD0AFA3B140A0203548A7A456ECDA8B9B9E740620291F14E21D08EEF21CE5676BB2434233E6C7CC62E48B9B752C87DC87E6DAE0A870E81D17E44AAF6982000A95B7EA676255A17D73FF4A45FAE0C5C9513B5EC0C6414D73EA9488373B6E2FFC9BD2E2C77394BB392F0AD23D91C99D9AA5066EBEE7123D00E223CA3CE572F667DBBD243473453DEC1A44CB979EF3898056D1E3B3A66DB1CB711B232291FA7C12BBE67097 +20240331000148 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B73EA509F +20240331002043 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B74F19237 +20240331015303 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B7A08A157 +20240331021926 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B7B77B293 +20240331031147 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B7E5DF07B +20240331032001 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B7ECA5C3F +20240331054028 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B86B76577 +20240331062300 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B891AC21B +20240331063150 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B898D590B +20240331064453 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B8A3FB29B +20240331070343 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B8B4728B3 +20240331082004 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B8F78FC67 +20240331083046 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B90063753 +20240331085336 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B913BDDA3 +20240331104948 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B97AD8FBB +20240331121935 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B9CBCB66B +20240331125021 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B9E75E9EF +20240331131006 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51B9F876B2B +20240331135555 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BA21BA983 +20240331154257 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BA8151143 +20240331171643 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BAD603A0F +20240331180835 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BB042B533 +20240331184114 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BB20E55D7 +20240331190024 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BB31FB5FB +20240331193130 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BB4D5DEF3 +20240331203633 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BB878F90B +20240331215848 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BBD220A13 +20240331220718 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BBD9694FB +20240331234057 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BC2D1D8B3 +20240401015736 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BCA81EB2B +20240401044749 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BD41C3C93 +20240401051819 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BD5D2C057 +20240401061504 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BD8EDA743 +20240401062619 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BD98C438F +20240401095349 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BE51ECC83 +20240401133450 2 6 100 8191 2 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BF189CF03 +20240401134927 2 6 100 8191 5 C236B21D4EECEC7DC25307B012452FBBBA72E7AB9CAD0D72A327FD19280856FD9993CDA7989072BD8C6E597FF7E009888DDDF8383E4F27BDB40D384CE8E9E7D739F296FD74C5415A164B0746783ACF1ABF031D4E8D1F2585BB9DBF6195215D9663196D4C5D3162E95A7163CA49255C77E412FFD7230B29C42C8703726D41006EBCFDB4EE478111ED6A8B3EDFE73496070250ECEBBB15E9376DCA438A3905EE308F8E4E064C31D1399ED7BB8AC8F6E458E8B43B1AC35DC4600B3780EA5D30F0704E7EEFDA1F2BACC94196B27E4A08B622D0AD441F3FEBA78A30D49732673040D7DD905604C7A7972BF62EFA6F3E477EADF778A7B9EA91ED338B72A42E4C30C40EF3CFADFAAF1690E469AD2B160FB1C2E836090D69F42C035B81B0E3301C0A18F9CA77C54447DB2AE57EC1765D79E188073D26328E285A3B889983409DA8B28EE75E5882524878D25083126A8007E5833272A7C330221D51CB023EC3BB452518BD57AEA2EE4560E57DF5FB7017646C6A426041551E6C55FE4ED7506FDFA1A04E1F9C36B47B031FFE4AE7480780BDC916A2B5A96C7B6D20EAFC4DF2FE721B415C365FEC16D0FEC74D034727A32D8E16D5E6CD64CAF6BC6F394E8BFBD3E9895A00924C016EEB8B6932B11CEB9A15668FE87E931CE9B1F30C3B23508760DF07A7B0AEDEDA196CC2D2974A15B51087503AF06B7351854CA928C966634E4638DC49A714B9F163AFAFD29B192E5AD2F4DED6A6945D77E7F26A72B5D6D1FB5C2F3A48970E9A0D2A212FBB8C15D5EA5435DA282E4C75DC3366BED430F71FFB6A43759542D572F828533C2437F65AB6A86EB6A994D2AA49B81D28106CFBDA10BBD7CA117A6E3CBED73D53185FEDE998C0D2EBADD81AEE2CFFAF17276E110BDDDDA163CDB5F12C12F67F432143588D4FDA6EF0763BAEC70B7D43BCD0213E650FEE7CAE47A3F327605A56116F2DB500F6481AAAD8AC312CD62F6E344705C5DA741C5E30140FB702BEE43DE37D905E8688E03F2E4D84DCBFD1BAED99BC18FAE53D701B6D78A6CDC84CDD09BA52F495785135F9006C34D7FB1059200FE16D1C707302FFB775387B3BDF1833953C0090D44076F1C27F815B638A846BEFCFC4F14B5EB38136737657E4781B8EDE5D97C175AF87F1EBE97DE9EBC410CA0C14DF17E320E986181D05D7573DF744D28846A6D78B193C7E094EE4530A15385AE6865469ADA3BCA7D6582E05C046B04306DD460940D9F76A72C13E9EFAA9184F5DC17FAB86879B29A6049BF201C5F21F6442BC1225217C288066E4FA5C16C62F8923B5C4A6B218365B3806349CEC8F79EEA94170A94BB10D6127DC78D1493CBBF7E12A7C1C2C4C14F353110E01DB0FA6459344DDD60EADE8F49924280CDEBE3D563F7069746DA3A0717438169F67534B769A9DE2B9938F148854652D7DDC7E513BAB18D356C51BF2540457 diff --git a/monitor.c b/monitor.c index b3ed515..5966b4f 100644 --- a/monitor.c +++ b/monitor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.c,v 1.237 2023/08/16 16:14:11 djm Exp $ */ +/* $OpenBSD: monitor.c,v 1.244 2024/09/15 01:09:40 djm Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -96,6 +96,7 @@ #include "match.h" #include "ssherr.h" #include "sk-api.h" +#include "srclimit.h" #ifdef GSSAPI static Gssctxt *gsscontext = NULL; @@ -125,8 +126,6 @@ int mm_answer_keyverify(struct ssh *, int, struct sshbuf *); int mm_answer_pty(struct ssh *, int, struct sshbuf *); int mm_answer_pty_cleanup(struct ssh *, int, struct sshbuf *); int mm_answer_term(struct ssh *, int, struct sshbuf *); -int mm_answer_sesskey(struct ssh *, int, struct sshbuf *); -int mm_answer_sessid(struct ssh *, int, struct sshbuf *); #ifdef USE_PAM int mm_answer_pam_start(struct ssh *, int, struct sshbuf *); @@ -163,6 +162,7 @@ static char *auth_submethod = NULL; static u_int session_id2_len = 0; static u_char *session_id2 = NULL; static pid_t monitor_child_pid; +int auth_attempted = 0; struct mon_table { enum monitor_reqtype type; @@ -298,6 +298,10 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor) authenticated = (monitor_read(ssh, pmonitor, mon_dispatch, &ent) == 1); + /* Record that auth was attempted to set exit status later */ + if ((ent->flags & MON_AUTH) != 0) + auth_attempted = 1; + /* Special handling for multiple required authentications */ if (options.num_auth_methods != 0) { if (authenticated && @@ -355,6 +359,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor) fatal_f("authentication method name unknown"); debug_f("user %s authenticated by privileged process", authctxt->user); + auth_attempted = 0; ssh->authctxt = NULL; ssh_packet_set_log_preamble(ssh, "user %s", authctxt->user); @@ -707,13 +712,39 @@ mm_answer_sign(struct ssh *ssh, int sock, struct sshbuf *m) fatal_fr(r, "assemble %s", #id); \ } while (0) +void +mm_encode_server_options(struct sshbuf *m) +{ + int r; + u_int i; + + /* XXX this leaks raw pointers to the unpriv child processes */ + if ((r = sshbuf_put_string(m, &options, sizeof(options))) != 0) + fatal_fr(r, "assemble options"); + +#define M_CP_STROPT(x) do { \ + if (options.x != NULL && \ + (r = sshbuf_put_cstring(m, options.x)) != 0) \ + fatal_fr(r, "assemble %s", #x); \ + } while (0) +#define M_CP_STRARRAYOPT(x, nx) do { \ + for (i = 0; i < options.nx; i++) { \ + if ((r = sshbuf_put_cstring(m, options.x[i])) != 0) \ + fatal_fr(r, "assemble %s", #x); \ + } \ + } while (0) + /* See comment in servconf.h */ + COPY_MATCH_STRING_OPTS(); +#undef M_CP_STROPT +#undef M_CP_STRARRAYOPT +} + /* Retrieves the password entry and also checks if the user is permitted */ int mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m) { struct passwd *pwent; int r, allowed = 0; - u_int i; debug3_f("entering"); @@ -766,24 +797,18 @@ mm_answer_pwnamallow(struct ssh *ssh, int sock, struct sshbuf *m) out: ssh_packet_set_log_preamble(ssh, "%suser %s", authctxt->valid ? "authenticating" : "invalid ", authctxt->user); - if ((r = sshbuf_put_string(m, &options, sizeof(options))) != 0) - fatal_fr(r, "assemble options"); -#define M_CP_STROPT(x) do { \ - if (options.x != NULL && \ - (r = sshbuf_put_cstring(m, options.x)) != 0) \ - fatal_fr(r, "assemble %s", #x); \ - } while (0) -#define M_CP_STRARRAYOPT(x, nx) do { \ - for (i = 0; i < options.nx; i++) { \ - if ((r = sshbuf_put_cstring(m, options.x[i])) != 0) \ - fatal_fr(r, "assemble %s", #x); \ - } \ - } while (0) - /* See comment in servconf.h */ - COPY_MATCH_STRING_OPTS(); -#undef M_CP_STROPT -#undef M_CP_STRARRAYOPT + if (options.refuse_connection) { + logit("administratively prohibited connection for " + "%s%s from %.128s port %d", + authctxt->valid ? "" : "invalid user ", + authctxt->user, ssh_remote_ipaddr(ssh), + ssh_remote_port(ssh)); + cleanup_exit(EXIT_CONFIG_REFUSED); + } + + /* Send active options to unpriv */ + mm_encode_server_options(m); /* Create valid auth method lists */ if (auth2_setup_methods_lists(authctxt) != 0) { @@ -1481,7 +1506,7 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct sshbuf *m) } auth2_record_key(authctxt, ret == 0, key); - if (key_blobtype == MM_USERKEY) + if (key_blobtype == MM_USERKEY && ret == 0) auth_activate_options(ssh, key_opts); monitor_reset_key_state(); @@ -1748,6 +1773,7 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor) #endif /* WITH_OPENSSL */ kex->kex[KEX_C25519_SHA256] = kex_gen_server; kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; + kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; kex->load_host_public_key=&get_hostkey_public_by_type; kex->load_host_private_key=&get_hostkey_private_by_type; kex->host_key_index=&get_hostkey_index; diff --git a/monitor.h b/monitor.h index 683e5e0..fa48fc6 100644 --- a/monitor.h +++ b/monitor.h @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.h,v 1.23 2019/01/19 21:43:56 djm Exp $ */ +/* $OpenBSD: monitor.h,v 1.24 2024/05/17 00:30:24 djm Exp $ */ /* * Copyright 2002 Niels Provos @@ -66,6 +66,7 @@ enum monitor_reqtype { }; struct ssh; +struct sshbuf; struct monitor { int m_recvfd; @@ -92,4 +93,7 @@ void mm_request_receive(int, struct sshbuf *); void mm_request_receive_expect(int, enum monitor_reqtype, struct sshbuf *); void mm_get_keystate(struct ssh *, struct monitor *); +/* XXX: should be returned via a monitor call rather than config_fd */ +void mm_encode_server_options(struct sshbuf *); + #endif /* _MONITOR_H_ */ diff --git a/monitor_wrap.c b/monitor_wrap.c index 6270d13..5358c77 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.c,v 1.129 2023/12/18 14:45:49 djm Exp $ */ +/* $OpenBSD: monitor_wrap.c,v 1.136 2024/06/19 23:24:47 djm Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -29,6 +29,7 @@ #include #include +#include #include #include @@ -65,7 +66,6 @@ #ifdef GSSAPI #include "ssh-gss.h" #endif -#include "monitor_wrap.h" #include "atomicio.h" #include "monitor_fdpass.h" #include "misc.h" @@ -73,6 +73,8 @@ #include "channels.h" #include "session.h" #include "servconf.h" +#include "monitor_wrap.h" +#include "srclimit.h" #include "ssherr.h" @@ -119,6 +121,37 @@ mm_is_monitor(void) return (pmonitor && pmonitor->m_pid > 0); } +static void +mm_reap(void) +{ + int status = -1; + + if (!mm_is_monitor()) + return; + while (waitpid(pmonitor->m_pid, &status, 0) == -1) { + if (errno == EINTR) + continue; + pmonitor->m_pid = -1; + fatal_f("waitpid: %s", strerror(errno)); + } + if (WIFEXITED(status)) { + if (WEXITSTATUS(status) != 0) { + debug_f("preauth child exited with status %d", + WEXITSTATUS(status)); + cleanup_exit(255); + } + } else if (WIFSIGNALED(status)) { + error_f("preauth child terminated by signal %d", + WTERMSIG(status)); + cleanup_exit(signal_is_crash(WTERMSIG(status)) ? + EXIT_CHILD_CRASH : 255); + } else { + error_f("preauth child terminated abnormally (status=0x%x)", + status); + cleanup_exit(EXIT_CHILD_CRASH); + } +} + void mm_request_send(int sock, enum monitor_reqtype type, struct sshbuf *m) { @@ -131,10 +164,15 @@ mm_request_send(int sock, enum monitor_reqtype type, struct sshbuf *m) fatal_f("bad length %zu", mlen); POKE_U32(buf, mlen + 1); buf[4] = (u_char) type; /* 1st byte of payload is mesg-type */ - if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf)) - fatal_f("write: %s", strerror(errno)); - if (atomicio(vwrite, sock, sshbuf_mutable_ptr(m), mlen) != mlen) + if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf) || + atomicio(vwrite, sock, sshbuf_mutable_ptr(m), mlen) != mlen) { + if (errno == EPIPE) { + debug3_f("monitor fd closed"); + mm_reap(); + cleanup_exit(255); + } fatal_f("write: %s", strerror(errno)); + } } void @@ -142,13 +180,16 @@ mm_request_receive(int sock, struct sshbuf *m) { u_char buf[4], *p = NULL; u_int msg_len; - int r; + int oerrno, r; debug3_f("entering"); if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) { - if (errno == EPIPE) + if (errno == EPIPE) { + debug3_f("monitor fd closed"); + mm_reap(); cleanup_exit(255); + } fatal_f("read: %s", strerror(errno)); } msg_len = PEEK_U32(buf); @@ -157,8 +198,13 @@ mm_request_receive(int sock, struct sshbuf *m) sshbuf_reset(m); if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) fatal_fr(r, "reserve"); - if (atomicio(read, sock, p, msg_len) != msg_len) - fatal_f("read: %s", strerror(errno)); + if (atomicio(read, sock, p, msg_len) != msg_len) { + oerrno = errno; + error_f("read: %s", strerror(errno)); + if (oerrno == EPIPE) + mm_reap(); + cleanup_exit(255); + } } void @@ -243,6 +289,49 @@ mm_sshkey_sign(struct ssh *ssh, struct sshkey *key, u_char **sigp, size_t *lenp, return (0); } +void +mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m) +{ + const u_char *p; + size_t len; + u_int i; + ServerOptions *newopts; + int r; + + if ((r = sshbuf_get_string_direct(m, &p, &len)) != 0) + fatal_fr(r, "parse opts"); + if (len != sizeof(*newopts)) + fatal_f("option block size mismatch"); + newopts = xcalloc(sizeof(*newopts), 1); + memcpy(newopts, p, sizeof(*newopts)); + +#define M_CP_STROPT(x) do { \ + if (newopts->x != NULL && \ + (r = sshbuf_get_cstring(m, &newopts->x, NULL)) != 0) \ + fatal_fr(r, "parse %s", #x); \ + } while (0) +#define M_CP_STRARRAYOPT(x, nx) do { \ + newopts->x = newopts->nx == 0 ? \ + NULL : xcalloc(newopts->nx, sizeof(*newopts->x)); \ + for (i = 0; i < newopts->nx; i++) { \ + if ((r = sshbuf_get_cstring(m, \ + &newopts->x[i], NULL)) != 0) \ + fatal_fr(r, "parse %s", #x); \ + } \ + } while (0) + /* See comment in servconf.h */ + COPY_MATCH_STRING_OPTS(); +#undef M_CP_STROPT +#undef M_CP_STRARRAYOPT + + copy_set_server_options(&options, newopts, 1); + log_change_level(options.log_level); + log_verbose_reset(); + for (i = 0; i < options.num_log_verbose; i++) + log_verbose_add(options.log_verbose[i]); + free(newopts); +} + #define GETPW(b, id) \ do { \ if ((r = sshbuf_get_string_direct(b, &p, &len)) != 0) \ @@ -258,8 +347,6 @@ mm_getpwnamallow(struct ssh *ssh, const char *username) struct sshbuf *m; struct passwd *pw; size_t len; - u_int i; - ServerOptions *newopts; int r; u_char ok; const u_char *p; @@ -307,41 +394,10 @@ mm_getpwnamallow(struct ssh *ssh, const char *username) out: /* copy options block as a Match directive may have changed some */ - if ((r = sshbuf_get_string_direct(m, &p, &len)) != 0) - fatal_fr(r, "parse opts"); - if (len != sizeof(*newopts)) - fatal_f("option block size mismatch"); - newopts = xcalloc(sizeof(*newopts), 1); - memcpy(newopts, p, sizeof(*newopts)); - -#define M_CP_STROPT(x) do { \ - if (newopts->x != NULL && \ - (r = sshbuf_get_cstring(m, &newopts->x, NULL)) != 0) \ - fatal_fr(r, "parse %s", #x); \ - } while (0) -#define M_CP_STRARRAYOPT(x, nx) do { \ - newopts->x = newopts->nx == 0 ? \ - NULL : xcalloc(newopts->nx, sizeof(*newopts->x)); \ - for (i = 0; i < newopts->nx; i++) { \ - if ((r = sshbuf_get_cstring(m, \ - &newopts->x[i], NULL)) != 0) \ - fatal_fr(r, "parse %s", #x); \ - } \ - } while (0) - /* See comment in servconf.h */ - COPY_MATCH_STRING_OPTS(); -#undef M_CP_STROPT -#undef M_CP_STRARRAYOPT - - copy_set_server_options(&options, newopts, 1); - log_change_level(options.log_level); - log_verbose_reset(); - for (i = 0; i < options.num_log_verbose; i++) - log_verbose_add(options.log_verbose[i]); - process_permitopen(ssh, &options); - process_channel_timeouts(ssh, &options); + mm_decode_activate_server_options(ssh, m); + server_process_permitopen(ssh); + server_process_channel_timeouts(ssh); kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); - free(newopts); sshbuf_free(m); return (pw); @@ -1018,3 +1074,91 @@ mm_ssh_gssapi_userok(char *user) return (authenticated); } #endif /* GSSAPI */ + +/* + * Inform channels layer of permitopen options for a single forwarding + * direction (local/remote). + */ +static void +server_process_permitopen_list(struct ssh *ssh, int listen, + char **opens, u_int num_opens) +{ + u_int i; + int port; + char *host, *arg, *oarg; + int where = listen ? FORWARD_REMOTE : FORWARD_LOCAL; + const char *what = listen ? "permitlisten" : "permitopen"; + + channel_clear_permission(ssh, FORWARD_ADM, where); + if (num_opens == 0) + return; /* permit any */ + + /* handle keywords: "any" / "none" */ + if (num_opens == 1 && strcmp(opens[0], "any") == 0) + return; + if (num_opens == 1 && strcmp(opens[0], "none") == 0) { + channel_disable_admin(ssh, where); + return; + } + /* Otherwise treat it as a list of permitted host:port */ + for (i = 0; i < num_opens; i++) { + oarg = arg = xstrdup(opens[i]); + host = hpdelim(&arg); + if (host == NULL) + fatal_f("missing host in %s", what); + host = cleanhostname(host); + if (arg == NULL || ((port = permitopen_port(arg)) < 0)) + fatal_f("bad port number in %s", what); + /* Send it to channels layer */ + channel_add_permission(ssh, FORWARD_ADM, + where, host, port); + free(oarg); + } +} + +/* + * Inform channels layer of permitopen options from configuration. + */ +void +server_process_permitopen(struct ssh *ssh) +{ + server_process_permitopen_list(ssh, 0, + options.permitted_opens, options.num_permitted_opens); + server_process_permitopen_list(ssh, 1, + options.permitted_listens, options.num_permitted_listens); +} + +void +server_process_channel_timeouts(struct ssh *ssh) +{ + u_int i, secs; + char *type; + + debug3_f("setting %u timeouts", options.num_channel_timeouts); + channel_clear_timeouts(ssh); + for (i = 0; i < options.num_channel_timeouts; i++) { + if (parse_pattern_interval(options.channel_timeouts[i], + &type, &secs) != 0) { + fatal_f("internal error: bad timeout %s", + options.channel_timeouts[i]); + } + channel_add_timeout(ssh, type, secs); + free(type); + } +} + +struct connection_info * +server_get_connection_info(struct ssh *ssh, int populate, int use_dns) +{ + static struct connection_info ci; + + if (ssh == NULL || !populate) + return &ci; + ci.host = use_dns ? ssh_remote_hostname(ssh) : ssh_remote_ipaddr(ssh); + ci.address = ssh_remote_ipaddr(ssh); + ci.laddress = ssh_local_ipaddr(ssh); + ci.lport = ssh_local_port(ssh); + ci.rdomain = ssh_packet_rdomain_in(ssh); + return &ci; +} + diff --git a/monitor_wrap.h b/monitor_wrap.h index 0df49c2..e768036 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.h,v 1.49 2022/06/15 16:08:25 djm Exp $ */ +/* $OpenBSD: monitor_wrap.h,v 1.51 2024/05/17 06:42:04 jsg Exp $ */ /* * Copyright 2002 Niels Provos @@ -28,9 +28,6 @@ #ifndef _MM_WRAP_H_ #define _MM_WRAP_H_ -extern int use_privsep; -#define PRIVSEP(x) (use_privsep ? mm_##x : x) - enum mm_keytype { MM_NOKEY, MM_HOSTKEY, MM_USERKEY }; struct ssh; @@ -61,6 +58,8 @@ int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *, int mm_sshkey_verify(const struct sshkey *, const u_char *, size_t, const u_char *, size_t, const char *, u_int, struct sshkey_sig_details **); +void mm_decode_activate_server_options(struct ssh *ssh, struct sshbuf *m); + #ifdef GSSAPI OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID); OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *, @@ -89,14 +88,16 @@ void mm_terminate(void); int mm_pty_allocate(int *, int *, char *, size_t); void mm_session_pty_cleanup2(struct Session *); -/* Key export functions */ -struct newkeys *mm_newkeys_from_blob(u_char *, int); -int mm_newkeys_to_blob(int, u_char **, u_int *); - void mm_send_keystate(struct ssh *, struct monitor*); /* bsdauth */ int mm_bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **); int mm_bsdauth_respond(void *, u_int, char **); +/* config / channels glue */ +void server_process_permitopen(struct ssh *); +void server_process_channel_timeouts(struct ssh *ssh); +struct connection_info * + server_get_connection_info(struct ssh *, int, int); + #endif /* _MM_WRAP_H_ */ diff --git a/msg.c b/msg.c index d22c4e4..a03caeb 100644 --- a/msg.c +++ b/msg.c @@ -1,4 +1,4 @@ -/* $OpenBSD: msg.c,v 1.20 2020/10/18 11:32:01 djm Exp $ */ +/* $OpenBSD: msg.c,v 1.21 2024/05/17 00:30:24 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -47,7 +47,7 @@ ssh_msg_send(int fd, u_char type, struct sshbuf *m) u_char buf[5]; u_int mlen = sshbuf_len(m); - debug3_f("type %u", (unsigned int)type & 0xff); + debug3_f("type %u len %zu", (unsigned int)type & 0xff, sshbuf_len(m)); put_u32(buf, mlen + 1); buf[4] = type; /* 1st byte of payload is mesg-type */ @@ -59,6 +59,7 @@ ssh_msg_send(int fd, u_char type, struct sshbuf *m) error_f("write: %s", strerror(errno)); return (-1); } + debug3_f("done"); return (0); } diff --git a/mux.c b/mux.c index d598a17..0529299 100644 --- a/mux.c +++ b/mux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mux.c,v 1.101 2023/11/23 03:37:05 dtucker Exp $ */ +/* $OpenBSD: mux.c,v 1.102 2024/07/25 22:40:08 djm Exp $ */ /* * Copyright (c) 2002-2008 Damien Miller * @@ -201,8 +201,8 @@ mux_master_session_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused) fatal_f("channel %d missing control channel %d", c->self, c->ctl_chan); c->ctl_chan = -1; - cc->remote_id = 0; - cc->have_remote_id = 0; + cc->ctl_child_id = 0; + cc->have_ctl_child_id = 0; chan_rcvd_oclose(ssh, cc); } channel_cancel_cleanup(ssh, c->self); @@ -217,12 +217,12 @@ mux_master_control_cleanup_cb(struct ssh *ssh, int cid, int force, void *unused) debug3_f("entering for channel %d", cid); if (c == NULL) fatal_f("channel_by_id(%i) == NULL", cid); - if (c->have_remote_id) { - if ((sc = channel_by_id(ssh, c->remote_id)) == NULL) + if (c->have_ctl_child_id) { + if ((sc = channel_by_id(ssh, c->ctl_child_id)) == NULL) fatal_f("channel %d missing session channel %u", - c->self, c->remote_id); - c->remote_id = 0; - c->have_remote_id = 0; + c->self, c->ctl_child_id); + c->ctl_child_id = 0; + c->have_ctl_child_id = 0; sc->ctl_chan = -1; if (sc->type != SSH_CHANNEL_OPEN && sc->type != SSH_CHANNEL_OPENING) { @@ -418,7 +418,7 @@ mux_master_process_new_session(struct ssh *ssh, u_int rid, new_fd[0], new_fd[1], new_fd[2]); /* XXX support multiple child sessions in future */ - if (c->have_remote_id) { + if (c->have_ctl_child_id) { debug2_f("session already open"); reply_error(reply, MUX_S_FAILURE, rid, "Multiple sessions not supported"); @@ -463,8 +463,8 @@ mux_master_process_new_session(struct ssh *ssh, u_int rid, CHAN_EXTENDED_WRITE, "client-session", CHANNEL_NONBLOCK_STDIO); nc->ctl_chan = c->self; /* link session -> control channel */ - c->remote_id = nc->self; /* link control -> session channel */ - c->have_remote_id = 1; + c->ctl_child_id = nc->self; /* link control -> session channel */ + c->have_ctl_child_id = 1; if (cctx->want_tty && escape_char != 0xffffffff) { channel_register_filter(ssh, nc->self, @@ -1003,7 +1003,7 @@ mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid, debug3_f("got fds stdin %d, stdout %d", new_fd[0], new_fd[1]); /* XXX support multiple child sessions in future */ - if (c->have_remote_id) { + if (c->have_ctl_child_id) { debug2_f("session already open"); reply_error(reply, MUX_S_FAILURE, rid, "Multiple sessions not supported"); @@ -1035,8 +1035,8 @@ mux_master_process_stdio_fwd(struct ssh *ssh, u_int rid, free(chost); nc->ctl_chan = c->self; /* link session -> control channel */ - c->remote_id = nc->self; /* link control -> session channel */ - c->have_remote_id = 1; + c->ctl_child_id = nc->self; /* link control -> session channel */ + c->have_ctl_child_id = 1; debug2_f("channel_new: %d control %d", nc->self, nc->ctl_chan); diff --git a/myproposal.h b/myproposal.h index ee6e9f7..3bdc2e9 100644 --- a/myproposal.h +++ b/myproposal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: myproposal.h,v 1.71 2022/03/30 21:13:23 djm Exp $ */ +/* $OpenBSD: myproposal.h,v 1.73 2024/09/09 02:39:57 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -25,7 +25,9 @@ */ #define KEX_SERVER_KEX \ + "sntrup761x25519-sha512," \ "sntrup761x25519-sha512@openssh.com," \ + "mlkem768x25519-sha256," \ "curve25519-sha256," \ "curve25519-sha256@libssh.org," \ "ecdh-sha2-nistp256," \ diff --git a/nchan.c b/nchan.c index b156695..bd4758a 100644 --- a/nchan.c +++ b/nchan.c @@ -1,4 +1,4 @@ -/* $OpenBSD: nchan.c,v 1.75 2024/02/01 02:37:33 djm Exp $ */ +/* $OpenBSD: nchan.c,v 1.76 2024/07/25 22:40:08 djm Exp $ */ /* * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. * @@ -208,7 +208,7 @@ chan_send_close2(struct ssh *ssh, Channel *c) { int r; - debug2("channel %d: send close", c->self); + debug2("channel %d: send_close2", c->self); if (c->ostate != CHAN_OUTPUT_CLOSED || c->istate != CHAN_INPUT_CLOSED) { error("channel %d: cannot send close for istate/ostate %d/%d", @@ -218,6 +218,8 @@ chan_send_close2(struct ssh *ssh, Channel *c) } else { if (!c->have_remote_id) fatal_f("channel %d: no remote_id", c->self); + debug2("channel %d: send close for remote id %u", c->self, + c->remote_id); if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_CLOSE)) != 0 || (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || (r = sshpkt_send(ssh)) != 0) diff --git a/openbsd-compat/arc4random.h b/openbsd-compat/arc4random.h index 5af3a44..af2d5c1 100644 --- a/openbsd-compat/arc4random.h +++ b/openbsd-compat/arc4random.h @@ -23,7 +23,9 @@ * Stub functions for portability. From LibreSSL with some adaptations. */ +#ifdef HAVE_SYS_MMAN_H #include +#endif #include diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c index 8f59398..ad35148 100644 --- a/openbsd-compat/getrrsetbyname.c +++ b/openbsd-compat/getrrsetbyname.c @@ -328,13 +328,14 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, if (rdata) { rdata->rdi_length = rr->size; - rdata->rdi_data = malloc(rr->size); - - if (rdata->rdi_data == NULL) { - result = ERRSET_NOMEMORY; - goto fail; + if (rr->size != 0) { + rdata->rdi_data = malloc(rr->size); + if (rdata->rdi_data == NULL) { + result = ERRSET_NOMEMORY; + goto fail; + } + memcpy(rdata->rdi_data, rr->rdata, rr->size); } - memcpy(rdata->rdi_data, rr->rdata, rr->size); } } free_dns_response(response); @@ -577,12 +578,13 @@ parse_dns_rrsection(const u_char *answer, int size, const u_char **cp, /* rdata itself */ NEED(curr->size); - curr->rdata = malloc(curr->size); - if (curr->rdata == NULL) { - free_dns_rr(head); - return (NULL); + if (curr->size != 0) { + if ((curr->rdata = malloc(curr->size)) == NULL) { + free_dns_rr(head); + return (NULL); + } + memcpy(curr->rdata, *cp, curr->size); } - memcpy(curr->rdata, *cp, curr->size); *cp += curr->size; } #undef NEED diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c index 6c65003..1486507 100644 --- a/openbsd-compat/openssl-compat.c +++ b/openbsd-compat/openssl-compat.c @@ -95,4 +95,30 @@ ssh_libcrypto_init(void) #endif /* USE_OPENSSL_ENGINE */ } +#ifndef HAVE_EVP_DIGESTSIGN +int +EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, + const unsigned char *tbs, size_t tbslen) +{ + if (sigret != NULL) { + if (EVP_DigestSignUpdate(ctx, tbs, tbslen) <= 0) + return 0; + } + + return EVP_DigestSignFinal(ctx, sigret, siglen); +} +#endif + +#ifndef HAVE_EVP_DIGESTVERIFY +int +EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, size_t siglen, + const unsigned char *tbs, size_t tbslen) +{ + if (EVP_DigestVerifyUpdate(ctx, tbs, tbslen) <= 0) + return -1; + + return EVP_DigestVerifyFinal(ctx, sigret, siglen); +} +#endif + #endif /* WITH_OPENSSL */ diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index f6796b3..2b9780f 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h @@ -78,5 +78,15 @@ int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, const unsigned char *iv, size_t len); #endif /* HAVE_EVP_CIPHER_CTX_SET_IV */ +#ifndef HAVE_EVP_DIGESTSIGN +int EVP_DigestSign(EVP_MD_CTX *, unsigned char *, size_t *, + const unsigned char *, size_t); +#endif + +#ifndef HAVE_EVP_DIGESTVERIFY +int EVP_DigestVerify(EVP_MD_CTX *, const unsigned char *, size_t, + const unsigned char *, size_t); +#endif + #endif /* WITH_OPENSSL */ #endif /* _OPENSSL_COMPAT_H */ diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index 0457e28..8adfec5 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c @@ -21,16 +21,24 @@ #include "includes.h" -#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) +#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) || \ + defined(SYSTEMD_NOTIFY) +#include +#include + #include +#include #include #include #include #include +#include +#include #include "log.h" #include "xmalloc.h" #include "port-linux.h" +#include "misc.h" #ifdef WITH_SELINUX #include @@ -310,4 +318,90 @@ oom_adjust_restore(void) return; } #endif /* LINUX_OOM_ADJUST */ -#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */ + +#ifdef SYSTEMD_NOTIFY + +static void ssh_systemd_notify(const char *, ...) + __attribute__((__format__ (printf, 1, 2))) __attribute__((__nonnull__ (1))); + +static void +ssh_systemd_notify(const char *fmt, ...) +{ + char *s = NULL; + const char *path; + struct stat sb; + struct sockaddr_un addr; + int fd = -1; + va_list ap; + + if ((path = getenv("NOTIFY_SOCKET")) == NULL || strlen(path) == 0) + return; + + va_start(ap, fmt); + xvasprintf(&s, fmt, ap); + va_end(ap); + + /* Only AF_UNIX is supported, with path or abstract sockets */ + if (path[0] != '/' && path[0] != '@') { + error_f("socket \"%s\" is not compatible with AF_UNIX", path); + goto out; + } + + if (path[0] == '/' && stat(path, &sb) != 0) { + error_f("socket \"%s\" stat: %s", path, strerror(errno)); + goto out; + } + + memset(&addr, 0, sizeof(addr)); + addr.sun_family = AF_UNIX; + if (strlcpy(addr.sun_path, path, + sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) { + error_f("socket path \"%s\" too long", path); + goto out; + } + /* Support for abstract socket */ + if (addr.sun_path[0] == '@') + addr.sun_path[0] = 0; + if ((fd = socket(PF_UNIX, SOCK_DGRAM, 0)) == -1) { + error_f("socket \"%s\": %s", path, strerror(errno)); + goto out; + } + if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) { + error_f("socket \"%s\" connect: %s", path, strerror(errno)); + goto out; + } + if (write(fd, s, strlen(s)) != (ssize_t)strlen(s)) { + error_f("socket \"%s\" write: %s", path, strerror(errno)); + goto out; + } + debug_f("socket \"%s\" notified %s", path, s); + out: + if (fd != -1) + close(fd); + free(s); +} + +void +ssh_systemd_notify_ready(void) +{ + ssh_systemd_notify("READY=1"); +} + +void +ssh_systemd_notify_reload(void) +{ + struct timespec now; + + monotime_ts(&now); + if (now.tv_sec < 0 || now.tv_nsec < 0) { + error_f("monotime returned negative value"); + ssh_systemd_notify("RELOADING=1"); + } else { + ssh_systemd_notify("RELOADING=1\nMONOTONIC_USEC=%llu", + ((uint64_t)now.tv_sec * 1000000ULL) + + ((uint64_t)now.tv_nsec / 1000ULL)); + } +} +#endif /* SYSTEMD_NOTIFY */ + +#endif /* WITH_SELINUX || LINUX_OOM_ADJUST || SYSTEMD_NOTIFY */ diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h index 3c22a85..14064f8 100644 --- a/openbsd-compat/port-linux.h +++ b/openbsd-compat/port-linux.h @@ -30,4 +30,9 @@ void oom_adjust_restore(void); void oom_adjust_setup(void); #endif +#ifdef SYSTEMD_NOTIFY +void ssh_systemd_notify_ready(void); +void ssh_systemd_notify_reload(void); +#endif + #endif /* ! _PORT_LINUX_H */ diff --git a/packet.c b/packet.c index beb214f..486f851 100644 --- a/packet.c +++ b/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.313 2023/12/18 14:45:17 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.317 2024/08/23 04:51:00 deraadt Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -534,6 +534,98 @@ ssh_remote_ipaddr(struct ssh *ssh) return ssh->remote_ipaddr; } +/* + * Returns the remote DNS hostname as a string. The returned string must not + * be freed. NB. this will usually trigger a DNS query. Return value is on + * heap and no caching is performed. + * This function does additional checks on the hostname to mitigate some + * attacks based on conflation of hostnames and addresses and will + * fall back to returning an address on error. + */ + +char * +ssh_remote_hostname(struct ssh *ssh) +{ + struct sockaddr_storage from; + socklen_t fromlen; + struct addrinfo hints, *ai, *aitop; + char name[NI_MAXHOST], ntop2[NI_MAXHOST]; + const char *ntop = ssh_remote_ipaddr(ssh); + + /* Get IP address of client. */ + fromlen = sizeof(from); + memset(&from, 0, sizeof(from)); + if (getpeername(ssh_packet_get_connection_in(ssh), + (struct sockaddr *)&from, &fromlen) == -1) { + debug_f("getpeername failed: %.100s", strerror(errno)); + return xstrdup(ntop); + } + + ipv64_normalise_mapped(&from, &fromlen); + if (from.ss_family == AF_INET6) + fromlen = sizeof(struct sockaddr_in6); + + debug3("trying to reverse map address %.100s.", ntop); + /* Map the IP address to a host name. */ + if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), + NULL, 0, NI_NAMEREQD) != 0) { + /* Host name not found. Use ip address. */ + return xstrdup(ntop); + } + + /* + * if reverse lookup result looks like a numeric hostname, + * someone is trying to trick us by PTR record like following: + * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 + */ + memset(&hints, 0, sizeof(hints)); + hints.ai_socktype = SOCK_DGRAM; /*dummy*/ + hints.ai_flags = AI_NUMERICHOST; + if (getaddrinfo(name, NULL, &hints, &ai) == 0) { + logit("Nasty PTR record \"%s\" is set up for %s, ignoring", + name, ntop); + freeaddrinfo(ai); + return xstrdup(ntop); + } + + /* Names are stored in lowercase. */ + lowercase(name); + + /* + * Map it back to an IP address and check that the given + * address actually is an address of this host. This is + * necessary because anyone with access to a name server can + * define arbitrary names for an IP address. Mapping from + * name to IP address can be trusted better (but can still be + * fooled if the intruder has access to the name server of + * the domain). + */ + memset(&hints, 0, sizeof(hints)); + hints.ai_family = from.ss_family; + hints.ai_socktype = SOCK_STREAM; + if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { + logit("reverse mapping checking getaddrinfo for %.700s " + "[%s] failed.", name, ntop); + return xstrdup(ntop); + } + /* Look for the address from the list of addresses. */ + for (ai = aitop; ai; ai = ai->ai_next) { + if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, + sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && + (strcmp(ntop, ntop2) == 0)) + break; + } + freeaddrinfo(aitop); + /* If we reached the end of the list, the address was not there. */ + if (ai == NULL) { + /* Address not found for the host name. */ + logit("Address %.100s maps to %.600s, but this does not " + "map back to the address.", ntop, name); + return xstrdup(ntop); + } + return xstrdup(name); +} + /* Returns the port number of the remote host. */ int @@ -923,9 +1015,8 @@ ssh_set_newkeys(struct ssh *ssh, int mode) /* explicit_bzero(enc->iv, enc->block_size); explicit_bzero(enc->key, enc->key_len); explicit_bzero(mac->key, mac->key_len); */ - if ((comp->type == COMP_ZLIB || - (comp->type == COMP_DELAYED && - state->after_authentication)) && comp->enabled == 0) { + if (((comp->type == COMP_DELAYED && state->after_authentication)) && + comp->enabled == 0) { if ((r = ssh_packet_init_compression(ssh)) < 0) return r; if (mode == MODE_OUT) { @@ -2545,12 +2636,6 @@ sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v) return sshbuf_put_stringb(ssh->state->outgoing_packet, v); } -int -sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp) -{ - return sshbuf_froms(ssh->state->incoming_packet, valp); -} - #ifdef WITH_OPENSSL #ifdef OPENSSL_HAS_ECC int @@ -2558,8 +2643,13 @@ sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g) { return sshbuf_put_ec(ssh->state->outgoing_packet, v, g); } -#endif /* OPENSSL_HAS_ECC */ +int +sshpkt_put_ec_pkey(struct ssh *ssh, EVP_PKEY *pkey) +{ + return sshbuf_put_ec_pkey(ssh->state->outgoing_packet, pkey); +} +#endif /* OPENSSL_HAS_ECC */ int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v) @@ -2618,6 +2708,12 @@ sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp) return sshbuf_get_cstring(ssh->state->incoming_packet, valp, lenp); } +int +sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp) +{ + return sshbuf_froms(ssh->state->incoming_packet, valp); +} + #ifdef WITH_OPENSSL #ifdef OPENSSL_HAS_ECC int diff --git a/packet.h b/packet.h index b2bc321..49bb87f 100644 --- a/packet.h +++ b/packet.h @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.h,v 1.96 2023/12/18 14:45:17 djm Exp $ */ +/* $OpenBSD: packet.h,v 1.99 2024/08/15 00:51:51 djm Exp $ */ /* * Author: Tatu Ylonen @@ -20,6 +20,7 @@ #ifdef WITH_OPENSSL # include +# include # ifdef OPENSSL_HAS_ECC # include # else /* OPENSSL_HAS_ECC */ @@ -32,6 +33,7 @@ # define EC_KEY void # define EC_GROUP void # define EC_POINT void +# define EVP_PKEY void #endif /* WITH_OPENSSL */ #include @@ -124,14 +126,12 @@ int ssh_packet_send2_wrapped(struct ssh *); int ssh_packet_send2(struct ssh *); int ssh_packet_read(struct ssh *); -int ssh_packet_read_poll(struct ssh *); int ssh_packet_read_poll2(struct ssh *, u_char *, u_int32_t *seqnr_p); int ssh_packet_process_incoming(struct ssh *, const char *buf, u_int len); int ssh_packet_process_read(struct ssh *, int); int ssh_packet_read_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p); int ssh_packet_read_poll_seqnr(struct ssh *, u_char *, u_int32_t *seqnr_p); -const void *ssh_packet_get_string_ptr(struct ssh *, u_int *length_ptr); void ssh_packet_disconnect(struct ssh *, const char *fmt, ...) __attribute__((format(printf, 2, 3))) __attribute__((noreturn)); @@ -165,6 +165,7 @@ int ssh_remote_port(struct ssh *); const char *ssh_local_ipaddr(struct ssh *); int ssh_local_port(struct ssh *); const char *ssh_packet_rdomain_in(struct ssh *); +char *ssh_remote_hostname(struct ssh *); void ssh_packet_set_rekey_limits(struct ssh *, u_int64_t, u_int32_t); time_t ssh_packet_get_rekey_timeout(struct ssh *); @@ -192,6 +193,7 @@ int sshpkt_put_string(struct ssh *ssh, const void *v, size_t len); int sshpkt_put_cstring(struct ssh *ssh, const void *v); int sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v); int sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g); +int sshpkt_put_ec_pkey(struct ssh *ssh, EVP_PKEY *pkey); int sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v); int sshpkt_get(struct ssh *ssh, void *valp, size_t len); @@ -214,6 +216,7 @@ const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); # undef EC_KEY # undef EC_GROUP # undef EC_POINT +# undef EVP_PKEY #elif !defined(OPENSSL_HAS_ECC) # undef EC_KEY # undef EC_GROUP diff --git a/pathnames.h b/pathnames.h index f7ca5a7..61c5f84 100644 --- a/pathnames.h +++ b/pathnames.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pathnames.h,v 1.31 2019/11/12 19:33:08 markus Exp $ */ +/* $OpenBSD: pathnames.h,v 1.32 2024/05/17 00:30:24 djm Exp $ */ /* * Author: Tatu Ylonen @@ -47,6 +47,11 @@ #define _PATH_SSH_PROGRAM "/usr/bin/ssh" #endif +/* Binary paths for the sshd components */ +#ifndef _PATH_SSHD_SESSION +#define _PATH_SSHD_SESSION "/usr/libexec/sshd-session" +#endif + /* * The process id of the daemon listening for connections is saved here to * make it easier to kill the correct daemon when necessary. diff --git a/platform-listen.c b/platform-listen.c new file mode 100644 index 0000000..42c4040 --- /dev/null +++ b/platform-listen.c @@ -0,0 +1,84 @@ +/* + * Copyright (c) 2006 Darren Tucker. All rights reserved. + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include "includes.h" + +#include +#include +#include +#include + +#include "log.h" +#include "misc.h" +#include "platform.h" + +#include "openbsd-compat/openbsd-compat.h" + +void +platform_pre_listen(void) +{ +#ifdef LINUX_OOM_ADJUST + /* Adjust out-of-memory killer so listening process is not killed */ + oom_adjust_setup(); +#endif +} + +void +platform_post_listen(void) +{ +#ifdef SYSTEMD_NOTIFY + ssh_systemd_notify_ready(); +#endif +} + +void +platform_pre_fork(void) +{ +#ifdef USE_SOLARIS_PROCESS_CONTRACTS + solaris_contract_pre_fork(); +#endif +} + +void +platform_pre_restart(void) +{ +#ifdef SYSTEMD_NOTIFY + ssh_systemd_notify_reload(); +#endif +#ifdef LINUX_OOM_ADJUST + oom_adjust_restore(); +#endif +} + +void +platform_post_fork_parent(pid_t child_pid) +{ +#ifdef USE_SOLARIS_PROCESS_CONTRACTS + solaris_contract_post_fork_parent(child_pid); +#endif +} + +void +platform_post_fork_child(void) +{ +#ifdef USE_SOLARIS_PROCESS_CONTRACTS + solaris_contract_post_fork_child(); +#endif +#ifdef LINUX_OOM_ADJUST + oom_adjust_restore(); +#endif +} + diff --git a/platform.c b/platform.c index 4fe8744..4c4fe57 100644 --- a/platform.c +++ b/platform.c @@ -32,53 +32,8 @@ #include "openbsd-compat/openbsd-compat.h" -extern int use_privsep; extern ServerOptions options; -void -platform_pre_listen(void) -{ -#ifdef LINUX_OOM_ADJUST - /* Adjust out-of-memory killer so listening process is not killed */ - oom_adjust_setup(); -#endif -} - -void -platform_pre_fork(void) -{ -#ifdef USE_SOLARIS_PROCESS_CONTRACTS - solaris_contract_pre_fork(); -#endif -} - -void -platform_pre_restart(void) -{ -#ifdef LINUX_OOM_ADJUST - oom_adjust_restore(); -#endif -} - -void -platform_post_fork_parent(pid_t child_pid) -{ -#ifdef USE_SOLARIS_PROCESS_CONTRACTS - solaris_contract_post_fork_parent(child_pid); -#endif -} - -void -platform_post_fork_child(void) -{ -#ifdef USE_SOLARIS_PROCESS_CONTRACTS - solaris_contract_post_fork_child(); -#endif -#ifdef LINUX_OOM_ADJUST - oom_adjust_restore(); -#endif -} - /* return 1 if we are running with privilege to swap UIDs, 0 otherwise */ int platform_privileged_uidswap(void) @@ -125,7 +80,7 @@ platform_setusercontext(struct passwd *pw) */ if (getuid() == 0 || geteuid() == 0) { if (options.use_pam) { - do_pam_setcred(use_privsep); + do_pam_setcred(); } } # endif /* USE_PAM */ @@ -153,7 +108,7 @@ platform_setusercontext_post_groups(struct passwd *pw) * Reestablish them here. */ if (options.use_pam) { - do_pam_setcred(use_privsep); + do_pam_setcred(); } #endif /* USE_PAM */ diff --git a/platform.h b/platform.h index 7fef8c9..5dec232 100644 --- a/platform.h +++ b/platform.h @@ -21,6 +21,7 @@ void platform_pre_listen(void); void platform_pre_fork(void); void platform_pre_restart(void); +void platform_post_listen(void); void platform_post_fork_parent(pid_t child_pid); void platform_post_fork_child(void); int platform_privileged_uidswap(void); diff --git a/readconf.c b/readconf.c index 3a64a04..3d9cc6d 100644 --- a/readconf.c +++ b/readconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.c,v 1.386 2024/03/04 04:13:18 djm Exp $ */ +/* $OpenBSD: readconf.c,v 1.390 2024/09/15 00:57:36 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -645,25 +645,79 @@ check_match_ifaddrs(const char *addrlist) #endif /* HAVE_IFADDRS_H */ } +/* + * Expand a "match exec" command or an Include path, caller must free returned + * value. + */ +static char * +expand_match_exec_or_include_path(const char *path, Options *options, + struct passwd *pw, const char *host_arg, const char *original_host, + int final_pass, int is_include_path) +{ + char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV]; + char uidstr[32], *conn_hash_hex, *keyalias, *jmphost, *ruser; + char *host, *ret; + int port; + + port = options->port <= 0 ? default_ssh_port() : options->port; + ruser = options->user == NULL ? pw->pw_name : options->user; + if (final_pass) { + host = xstrdup(options->hostname); + } else if (options->hostname != NULL) { + /* NB. Please keep in sync with ssh.c:main() */ + host = percent_expand(options->hostname, + "h", host_arg, (char *)NULL); + } else { + host = xstrdup(host_arg); + } + if (gethostname(thishost, sizeof(thishost)) == -1) + fatal("gethostname: %s", strerror(errno)); + jmphost = option_clear_or_none(options->jump_host) ? + "" : options->jump_host; + strlcpy(shorthost, thishost, sizeof(shorthost)); + shorthost[strcspn(thishost, ".")] = '\0'; + snprintf(portstr, sizeof(portstr), "%d", port); + snprintf(uidstr, sizeof(uidstr), "%llu", + (unsigned long long)pw->pw_uid); + conn_hash_hex = ssh_connection_hash(thishost, host, + portstr, ruser, jmphost); + keyalias = options->host_key_alias ? options->host_key_alias : host; + + ret = (is_include_path ? percent_dollar_expand : percent_expand)(path, + "C", conn_hash_hex, + "L", shorthost, + "d", pw->pw_dir, + "h", host, + "k", keyalias, + "l", thishost, + "n", original_host, + "p", portstr, + "r", ruser, + "u", pw->pw_name, + "i", uidstr, + "j", jmphost, + (char *)NULL); + free(host); + free(conn_hash_hex); + return ret; +} + /* * Parse and execute a Match directive. */ static int -match_cfg_line(Options *options, char **condition, struct passwd *pw, - const char *host_arg, const char *original_host, int final_pass, - int *want_final_pass, const char *filename, int linenum) +match_cfg_line(Options *options, const char *full_line, int *acp, char ***avp, + struct passwd *pw, const char *host_arg, const char *original_host, + int final_pass, int *want_final_pass, const char *filename, int linenum) { - char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria; + char *arg, *oattrib, *attrib, *cmd, *host, *criteria; const char *ruser; - int r, port, this_result, result = 1, attributes = 0, negate; - char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV]; - char uidstr[32]; + int r, this_result, result = 1, attributes = 0, negate; /* * Configuration is likely to be incomplete at this point so we * must be prepared to use default values. */ - port = options->port <= 0 ? default_ssh_port() : options->port; ruser = options->user == NULL ? pw->pw_name : options->user; if (final_pass) { host = xstrdup(options->hostname); @@ -676,11 +730,11 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, } debug2("checking match for '%s' host %s originally %s", - cp, host, original_host); - while ((oattrib = attrib = strdelim(&cp)) && *attrib != '\0') { + full_line, host, original_host); + while ((oattrib = attrib = argv_next(acp, avp)) != NULL) { /* Terminate on comment */ if (*attrib == '#') { - cp = NULL; /* mark all arguments consumed */ + argv_consume(acp); break; } arg = criteria = NULL; @@ -689,7 +743,8 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, attrib++; /* Criterion "all" has no argument and must appear alone */ if (strcasecmp(attrib, "all") == 0) { - if (attributes > 1 || ((arg = strdelim(&cp)) != NULL && + if (attributes > 1 || + ((arg = argv_next(acp, avp)) != NULL && *arg != '\0' && *arg != '#')) { error("%.200s line %d: '%s' cannot be combined " "with other Match attributes", @@ -698,7 +753,7 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, goto out; } if (arg != NULL && *arg == '#') - cp = NULL; /* mark all arguments consumed */ + argv_consume(acp); /* consume remaining args */ if (result) result = negate ? 0 : 1; goto out; @@ -723,7 +778,7 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, continue; } /* All other criteria require an argument */ - if ((arg = strdelim(&cp)) == NULL || + if ((arg = argv_next(acp, avp)) == NULL || *arg == '\0' || *arg == '#') { error("Missing Match criteria for %s", attrib); result = -1; @@ -765,37 +820,12 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, if (r == (negate ? 1 : 0)) this_result = result = 0; } else if (strcasecmp(attrib, "exec") == 0) { - char *conn_hash_hex, *keyalias, *jmphost; - - if (gethostname(thishost, sizeof(thishost)) == -1) - fatal("gethostname: %s", strerror(errno)); - jmphost = option_clear_or_none(options->jump_host) ? - "" : options->jump_host; - strlcpy(shorthost, thishost, sizeof(shorthost)); - shorthost[strcspn(thishost, ".")] = '\0'; - snprintf(portstr, sizeof(portstr), "%d", port); - snprintf(uidstr, sizeof(uidstr), "%llu", - (unsigned long long)pw->pw_uid); - conn_hash_hex = ssh_connection_hash(thishost, host, - portstr, ruser, jmphost); - keyalias = options->host_key_alias ? - options->host_key_alias : host; - - cmd = percent_expand(arg, - "C", conn_hash_hex, - "L", shorthost, - "d", pw->pw_dir, - "h", host, - "k", keyalias, - "l", thishost, - "n", original_host, - "p", portstr, - "r", ruser, - "u", pw->pw_name, - "i", uidstr, - "j", jmphost, - (char *)NULL); - free(conn_hash_hex); + if ((cmd = expand_match_exec_or_include_path(arg, + options, pw, host_arg, original_host, + final_pass, 0)) == NULL) { + fatal("%.200s line %d: failed to expand match " + "exec '%.100s'", filename, linenum, arg); + } if (result != 1) { /* skip execution if prior predicate failed */ debug3("%.200s line %d: skipped exec " @@ -835,7 +865,6 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw, out: if (result != -1) debug2("match %sfound", result ? "" : "not "); - *condition = cp; free(host); return result; } @@ -1002,7 +1031,7 @@ static const struct multistate multistate_pubkey_auth[] = { }; static const struct multistate multistate_compression[] = { #ifdef WITH_ZLIB - { "yes", COMP_ZLIB }, + { "yes", COMP_DELAYED }, #endif { "no", COMP_NONE }, { NULL, -1 } @@ -1778,8 +1807,8 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, "option"); goto out; } - value = match_cfg_line(options, &str, pw, host, original_host, - flags & SSHCONF_FINAL, want_final_pass, + value = match_cfg_line(options, str, &ac, &av, pw, host, + original_host, flags & SSHCONF_FINAL, want_final_pass, filename, linenum); if (value < 0) { error("%.200s line %d: Bad Match condition", filename, @@ -1787,13 +1816,6 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, goto out; } *activep = (flags & SSHCONF_NEVERMATCH) ? 0 : value; - /* - * If match_cfg_line() didn't consume all its arguments then - * arrange for the extra arguments check below to fail. - */ - - if (str == NULL || *str == '\0') - argv_consume(&ac); break; case oEscapeChar: @@ -1990,6 +2012,15 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, filename, linenum, keyword); goto out; } + /* Expand %tokens and environment variables */ + if ((p = expand_match_exec_or_include_path(arg, + options, pw, host, original_host, + flags & SSHCONF_FINAL, 1)) == NULL) { + error("%.200s line %d: Unable to expand user " + "config file '%.100s'", + filename, linenum, arg); + continue; + } /* * Ensure all paths are anchored. User configuration * files may begin with '~/' but system configurations @@ -1997,17 +2028,19 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, * as living in ~/.ssh for user configurations or * /etc/ssh for system ones. */ - if (*arg == '~' && (flags & SSHCONF_USERCONF) == 0) { + if (*p == '~' && (flags & SSHCONF_USERCONF) == 0) { error("%.200s line %d: bad include path %s.", - filename, linenum, arg); + filename, linenum, p); goto out; } - if (!path_absolute(arg) && *arg != '~') { + if (!path_absolute(p) && *p != '~') { xasprintf(&arg2, "%s/%s", (flags & SSHCONF_USERCONF) ? - "~/" _PATH_SSH_USER_DIR : SSHDIR, arg); - } else - arg2 = xstrdup(arg); + "~/" _PATH_SSH_USER_DIR : SSHDIR, p); + } else { + arg2 = xstrdup(p); + } + free(p); memset(&gl, 0, sizeof(gl)); r = glob(arg2, GLOB_TILDE, NULL, &gl); if (r == GLOB_NOMATCH) { @@ -2033,8 +2066,9 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host, (oactive ? 0 : SSHCONF_NEVERMATCH), activep, want_final_pass, depth + 1); if (r != 1 && errno != ENOENT) { - error("Can't open user config file " - "%.100s: %.100s", gl.gl_pathv[i], + error("%.200s line %d: Can't open user " + "config file %.100s: %.100s", + filename, linenum, gl.gl_pathv[i], strerror(errno)); globfree(&gl); goto out; @@ -3337,7 +3371,7 @@ parse_ssh_uri(const char *uri, char **userp, char **hostp, int *portp) return r; } -/* XXX the following is a near-vebatim copy from servconf.c; refactor */ +/* XXX the following is a near-verbatim copy from servconf.c; refactor */ static const char * fmt_multistate_int(int val, const struct multistate *m) { diff --git a/readpass.c b/readpass.c index b52f3d6..d42b118 100644 --- a/readpass.c +++ b/readpass.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readpass.c,v 1.70 2022/05/27 04:27:49 dtucker Exp $ */ +/* $OpenBSD: readpass.c,v 1.71 2024/03/30 04:27:44 djm Exp $ */ /* * Copyright (c) 2001 Markus Friedl. All rights reserved. * @@ -127,8 +127,9 @@ read_passphrase(const char *prompt, int flags) const char *askpass_hint = NULL; const char *s; - if ((s = getenv("DISPLAY")) != NULL) - allow_askpass = *s != '\0'; + if (((s = getenv("DISPLAY")) != NULL && *s != '\0') || + ((s = getenv("WAYLAND_DISPLAY")) != NULL && *s != '\0')) + allow_askpass = 1; if ((s = getenv(SSH_ASKPASS_REQUIRE_ENV)) != NULL) { if (strcasecmp(s, "force") == 0) { use_askpass = 1; @@ -261,7 +262,7 @@ notify_start(int force_askpass, const char *fmt, ...) debug3_f("cannot notify: no askpass"); goto out; } - if (getenv("DISPLAY") == NULL && + if (getenv("DISPLAY") == NULL && getenv("WAYLAND_DISPLAY") == NULL && ((s = getenv(SSH_ASKPASS_REQUIRE_ENV)) == NULL || strcmp(s, "force") != 0)) { debug3_f("cannot notify: no display"); diff --git a/regress/Makefile b/regress/Makefile index c9a495f..7f73497 100644 --- a/regress/Makefile +++ b/regress/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.133 2024/01/11 04:50:28 djm Exp $ +# $OpenBSD: Makefile,v 1.135 2024/06/14 04:43:11 djm Exp $ tests: prep file-tests t-exec unit @@ -109,7 +109,9 @@ LTESTS= connect \ connection-timeout \ match-subsystem \ agent-pkcs11-restrict \ - agent-pkcs11-cert + agent-pkcs11-cert \ + penalty \ + penalty-expire INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers INTEROP_TESTS+= dropbear-ciphers dropbear-kex diff --git a/regress/cfginclude.sh b/regress/cfginclude.sh index f5b492f..d442cdd 100644 --- a/regress/cfginclude.sh +++ b/regress/cfginclude.sh @@ -1,4 +1,4 @@ -# $OpenBSD: cfginclude.sh,v 1.3 2021/06/08 06:52:43 djm Exp $ +# $OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $ # Placed in the Public Domain. tid="config include" @@ -142,7 +142,7 @@ trial a aa # cleanup rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out -# $OpenBSD: cfginclude.sh,v 1.3 2021/06/08 06:52:43 djm Exp $ +# $OpenBSD: cfginclude.sh,v 1.4 2024/09/03 05:58:56 djm Exp $ # Placed in the Public Domain. tid="config include" @@ -289,5 +289,27 @@ _EOF ${REAL_SSH} -F $OBJ/ssh_config.i -G a 2>/dev/null && \ fail "ssh include allowed infinite recursion?" # or hang... +# Environment variable expansion +cat > $OBJ/ssh_config.i << _EOF +Include $OBJ/ssh_config.\${REAL_FILE} +_EOF +cat > $OBJ/ssh_config.i.x << _EOF +Hostname xyzzy +_EOF +REAL_FILE=i.x +export REAL_FILE +trial a xyzzy + +# Environment variable expansion +cat > $OBJ/ssh_config.i << _EOF +Include $OBJ/ssh_config.i.%h%h +_EOF +cat > $OBJ/ssh_config.i.blahblah << _EOF +Hostname mekmitastdigoat +_EOF +REAL_FILE=i.x +export REAL_FILE +trial blah mekmitastdigoat + # cleanup rm -f $OBJ/ssh_config.i $OBJ/ssh_config.i.* $OBJ/ssh_config.out diff --git a/regress/cfgmatchlisten.sh b/regress/cfgmatchlisten.sh index a4fd66b..2308db1 100644 --- a/regress/cfgmatchlisten.sh +++ b/regress/cfgmatchlisten.sh @@ -1,4 +1,4 @@ -# $OpenBSD: cfgmatchlisten.sh,v 1.3 2018/07/02 14:13:30 dtucker Exp $ +# $OpenBSD: cfgmatchlisten.sh,v 1.4 2024/03/25 01:40:47 dtucker Exp $ # Placed in the Public Domain. tid="sshd_config matchlisten" diff --git a/regress/dropbear-ciphers.sh b/regress/dropbear-ciphers.sh index 2e0f9a1..1500fa0 100644 --- a/regress/dropbear-ciphers.sh +++ b/regress/dropbear-ciphers.sh @@ -1,4 +1,4 @@ -# $OpenBSD: dropbear-ciphers.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $ +# $OpenBSD: dropbear-ciphers.sh,v 1.3 2024/06/20 08:23:18 dtucker Exp $ # Placed in the Public Domain. tid="dropbear ciphers" @@ -7,13 +7,18 @@ if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then skip "dropbear interop tests not enabled" fi +# Enable all support algorithms +algs=`$SSH -Q key-sig | tr '\n' ,` cat >>$OBJ/sshd_proxy <&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '` -macs=`$DBCLIENT -m help 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '` +ciphers=`$DBCLIENT -c help hst 2>&1 | awk '/ ciphers: /{print $4}' | tr ',' ' '` +macs=`$DBCLIENT -m help hst 2>&1 | awk '/ MACs: /{print $4}' | tr ',' ' '` +if [ -z "$macs" ] || [ -z "$ciphers" ]; then + skip "dbclient query ciphers '$ciphers' or macs '$macs' failed" +fi keytype=`(cd $OBJ/.dropbear && ls id_*)` for c in $ciphers ; do diff --git a/regress/dropbear-kex.sh b/regress/dropbear-kex.sh index a25de3e..d9f1b32 100644 --- a/regress/dropbear-kex.sh +++ b/regress/dropbear-kex.sh @@ -1,4 +1,4 @@ -# $OpenBSD: dropbear-kex.sh,v 1.1 2023/10/20 06:56:45 dtucker Exp $ +# $OpenBSD: dropbear-kex.sh,v 1.3 2024/06/19 10:10:46 dtucker Exp $ # Placed in the Public Domain. tid="dropbear kex" @@ -7,21 +7,19 @@ if test "x$REGRESS_INTEROP_DROPBEAR" != "xyes" ; then skip "dropbear interop tests not enabled" fi -cat >>$OBJ/sshd_proxy <$OBJ/sshd_proxy - env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_rsa 2>$OBJ/dbclient.log \ + env HOME=$OBJ dbclient -y -i $OBJ/.dropbear/id_ed25519 2>$OBJ/dbclient.log \ -J "$OBJ/ssh_proxy.sh" somehost cat ${DATA} > ${COPY} if [ $? -ne 0 ]; then fail "ssh cat $DATA failed" diff --git a/regress/key-options.sh b/regress/key-options.sh index 2f3d66e..623128c 100644 --- a/regress/key-options.sh +++ b/regress/key-options.sh @@ -1,4 +1,4 @@ -# $OpenBSD: key-options.sh,v 1.9 2018/07/03 13:53:26 djm Exp $ +# $OpenBSD: key-options.sh,v 1.10 2024/03/25 02:07:08 dtucker Exp $ # Placed in the Public Domain. tid="key options" diff --git a/regress/misc/fuzz-harness/Makefile b/regress/misc/fuzz-harness/Makefile index 1072130..55dcc17 100644 --- a/regress/misc/fuzz-harness/Makefile +++ b/regress/misc/fuzz-harness/Makefile @@ -4,52 +4,68 @@ CXX=clang++-16 FUZZ_FLAGS=-fsanitize=address,fuzzer -fno-omit-frame-pointer FUZZ_LIBS=-L/usr/lib/llvm-16/lib -lFuzzer -CXXFLAGS=-O2 -g -Wall -Wextra -Wno-unused-parameter -Wno-exceptions -I ../../.. $(FUZZ_FLAGS) -CFLAGS=$(CXXFLAGS) -LDFLAGS=-L ../../.. -L ../../../openbsd-compat -g $(FUZZ_FLAGS) +CFLAGS=-D_GNU_SOURCE=1 -O2 -g -Wall -Wextra -Wno-unused-parameter -Wno-exceptions -Wno-deprecated -I ../../.. +CXXFLAGS=$(CFLAGS) $(FUZZ_FLAGS) +LDFLAGS=-L ../../.. -L ../../../openbsd-compat -g LIBS=-lssh -lopenbsd-compat -lmd -lcrypto -lfido2 -lcbor $(FUZZ_LIBS) SK_NULL_OBJS=ssh-sk-null.o COMMON_DEPS=../../../libssh.a TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz authkeys_fuzz sshsig_fuzz \ - sshsigopt_fuzz privkey_fuzz kex_fuzz agent_fuzz + sshsigopt_fuzz privkey_fuzz kex_fuzz agent_fuzz \ + mkcorpus_sntrup761 sntrup761_enc_fuzz sntrup761_dec_fuzz all: $(TARGETS) .cc.o: $(CXX) $(CXXFLAGS) -c $< -o $@ +.c.o: + $(CC) $(CFLAGS) -c $< -o $@ + pubkey_fuzz: pubkey_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ pubkey_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(LIBS) + $(CXX) -o $@ pubkey_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) sig_fuzz: sig_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ sig_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(LIBS) + $(CXX) -o $@ sig_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) authopt_fuzz: authopt_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ authopt_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o $(LDFLAGS) $(LIBS) + $(CXX) -o $@ authopt_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) authkeys_fuzz: authkeys_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ authkeys_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o ../../../auth2-pubkeyfile.o $(LDFLAGS) $(LIBS) + $(CXX) -o $@ authkeys_fuzz.o $(SK_NULL_OBJS) ../../../auth-options.o ../../../auth2-pubkeyfile.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) sshsig_fuzz: sshsig_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ sshsig_fuzz.o $(SK_NULL_OBJS) ../../../sshsig.o $(LDFLAGS) $(LIBS) + $(CXX) -o $@ sshsig_fuzz.o $(SK_NULL_OBJS) ../../../sshsig.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) sshsigopt_fuzz: sshsigopt_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ sshsigopt_fuzz.o $(SK_NULL_OBJS) ../../../sshsig.o $(LDFLAGS) $(LIBS) + $(CXX) -o $@ sshsigopt_fuzz.o $(SK_NULL_OBJS) ../../../sshsig.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) privkey_fuzz: privkey_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ privkey_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(LIBS) + $(CXX) -o $@ privkey_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) kex_fuzz: kex_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS) - $(CXX) -o $@ kex_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(LIBS) -lz + $(CXX) -o $@ kex_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz agent_fuzz: agent_fuzz.o agent_fuzz_helper.o sk-dummy.o ../../../ssh-sk.o $(COMMON_DEPS) - $(CXX) -o $@ agent_fuzz.o agent_fuzz_helper.o sk-dummy.o ../../../ssh-sk.o $(LDFLAGS) $(LIBS) -lz + $(CXX) -o $@ agent_fuzz.o agent_fuzz_helper.o sk-dummy.o ../../../ssh-sk.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz agent_fuzz_helper.o: agent_fuzz_helper.c ../../../ssh-agent.c sk-dummy.o: ../sk-dummy/sk-dummy.c - $(CC) $(CFLAGS) -c -o $@ ../sk-dummy/sk-dummy.c -DSK_DUMMY_INTEGRATE=1 $(LDFLAGS) + $(CC) $(CFLAGS) -c -o $@ ../sk-dummy/sk-dummy.c -DSK_DUMMY_INTEGRATE=1 $(LDFLAGS) $(FUZZ_FLAGS) + +mkcorpus_sntrup761: mkcorpus_sntrup761.o + $(CC) -o $@ mkcorpus_sntrup761.o $(LDFLAGS) -lcrypto + +sntrup761_dec_fuzz: sntrup761_dec_fuzz.o + $(CXX) -o $@ sntrup761_dec_fuzz.o $(LDFLAGS) $(FUZZ_FLAGS) $(FUZZ_LIBS) -lcrypto + +sntrup761_enc_fuzz: sntrup761_enc_fuzz.o + $(CXX) -o $@ sntrup761_enc_fuzz.o $(LDFLAGS) $(FUZZ_FLAGS) $(FUZZ_LIBS) -lcrypto clean: -rm -f *.o $(TARGETS) + +cleandir: clean + diff --git a/regress/misc/fuzz-harness/agent_fuzz_helper.c b/regress/misc/fuzz-harness/agent_fuzz_helper.c index c3051c7..321343b 100644 --- a/regress/misc/fuzz-harness/agent_fuzz_helper.c +++ b/regress/misc/fuzz-harness/agent_fuzz_helper.c @@ -112,7 +112,6 @@ reset_idtab(void) idtab_init(); // Load keys. add_key(PRIV_RSA, CERT_RSA); - add_key(PRIV_DSA, CERT_DSA); add_key(PRIV_ECDSA, CERT_ECDSA); add_key(PRIV_ED25519, CERT_ED25519); add_key(PRIV_ECDSA_SK, CERT_ECDSA_SK); diff --git a/regress/misc/fuzz-harness/kex_fuzz.cc b/regress/misc/fuzz-harness/kex_fuzz.cc index d38ca85..f126d93 100644 --- a/regress/misc/fuzz-harness/kex_fuzz.cc +++ b/regress/misc/fuzz-harness/kex_fuzz.cc @@ -144,7 +144,6 @@ static int prepare_keys(struct shared_state *st) { if (prepare_key(st, KEY_RSA, 2048) != 0 || - prepare_key(st, KEY_DSA, 1024) != 0 || prepare_key(st, KEY_ECDSA, 256) != 0 || prepare_key(st, KEY_ED25519, 256) != 0) { error_f("key prepare failed"); @@ -264,10 +263,6 @@ prepare_key(struct shared_state *st, int kt, int bits) pubstr = PUB_RSA; privstr = PRIV_RSA; break; - case KEY_DSA: - pubstr = PUB_DSA; - privstr = PRIV_DSA; - break; case KEY_ECDSA: pubstr = PUB_ECDSA; privstr = PRIV_ECDSA; @@ -325,7 +320,7 @@ int main(void) { static struct shared_state *st; struct test_state *ts; - const int keytypes[] = { KEY_RSA, KEY_DSA, KEY_ECDSA, KEY_ED25519, -1 }; + const int keytypes[] = { KEY_RSA, KEY_ECDSA, KEY_ED25519, -1 }; static const char * const kextypes[] = { "sntrup761x25519-sha512@openssh.com", "curve25519-sha256@libssh.org", @@ -399,7 +394,6 @@ static void do_kex(struct shared_state *st, struct test_state *ts, const char *kex) { do_kex_with_key(st, ts, kex, KEY_RSA); - do_kex_with_key(st, ts, kex, KEY_DSA); do_kex_with_key(st, ts, kex, KEY_ECDSA); do_kex_with_key(st, ts, kex, KEY_ED25519); } diff --git a/regress/misc/fuzz-harness/mkcorpus_sntrup761.c b/regress/misc/fuzz-harness/mkcorpus_sntrup761.c new file mode 100644 index 0000000..86a8e02 --- /dev/null +++ b/regress/misc/fuzz-harness/mkcorpus_sntrup761.c @@ -0,0 +1,82 @@ +// Makes basic seed corpora for other fuzzers +// +// Will write to ./sntrup761_pubkey_corpus (for sntrup761_enc_fuzz) and +// to ./sntrup761_ciphertext_corpus (for sntrup761_dec_fuzz) + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "crypto_api.h" +#include "hash.c" + +#undef randombytes +#define USE_SNTRUP761X25519 1 +void randombytes(unsigned char *ptr, size_t l); +volatile crypto_int16 crypto_int16_optblocker = 0; +volatile crypto_int32 crypto_int32_optblocker = 0; +volatile crypto_int64 crypto_int64_optblocker = 0; +#include "sntrup761.c" + +#define NSEEDS 1000 + +static int real_random; + +void +randombytes(unsigned char *ptr, size_t l) +{ + if (real_random) + arc4random_buf(ptr, l); + else + memset(ptr, 0, l); +} + +void write_blob(const char *path, int n, const char *suffix, + const void *ptr, size_t l) +{ + char name[256]; + FILE *f; + + snprintf(name, sizeof(name), "%s/%06d.%s", path, n, suffix); + if ((f = fopen(name, "wb+")) == NULL) + err(1, "fopen %s", name); + if (fwrite(ptr, l, 1, f) != 1) + err(1, "write %s", name); + fclose(f); +} + +int main(void) +{ + int i; + unsigned char pk[crypto_kem_sntrup761_PUBLICKEYBYTES]; + unsigned char sk[crypto_kem_sntrup761_SECRETKEYBYTES]; + unsigned char ciphertext[crypto_kem_sntrup761_CIPHERTEXTBYTES]; + unsigned char secret[crypto_kem_sntrup761_BYTES]; + + if (mkdir("sntrup761_pubkey_corpus", 0777) != 0 && errno != EEXIST) + err(1, "mkdir sntrup761_pubkey_corpus"); + if (mkdir("sntrup761_ciphertext_corpus", 0777) != 0 && errno != EEXIST) + err(1, "mkdir sntrup761_ciphertext_corpus"); + + fprintf(stderr, "making: "); + for (i = 0; i < NSEEDS; i++) { + real_random = i != 0; + if (crypto_kem_sntrup761_keypair(pk, sk) != 0) + errx(1, "crypto_kem_sntrup761_keypair failed"); + write_blob("sntrup761_pubkey_corpus", i, "pk", pk, sizeof(pk)); + if (crypto_kem_sntrup761_enc(ciphertext, secret, pk) != 0) + errx(1, "crypto_kem_sntrup761_enc failed"); + write_blob("sntrup761_ciphertext_corpus", i, "ct", + ciphertext, sizeof(ciphertext)); + if (i % 20 == 0) + fprintf(stderr, "."); + } + fprintf(stderr, "\n"); + return 0; +} diff --git a/regress/misc/fuzz-harness/sig_fuzz.cc b/regress/misc/fuzz-harness/sig_fuzz.cc index b32502b..639e4d2 100644 --- a/regress/misc/fuzz-harness/sig_fuzz.cc +++ b/regress/misc/fuzz-harness/sig_fuzz.cc @@ -26,7 +26,6 @@ int LLVMFuzzerTestOneInput(const uint8_t* sig, size_t slen) { #ifdef WITH_OPENSSL static struct sshkey *rsa = generate_or_die(KEY_RSA, 2048); - static struct sshkey *dsa = generate_or_die(KEY_DSA, 1024); static struct sshkey *ecdsa256 = generate_or_die(KEY_ECDSA, 256); static struct sshkey *ecdsa384 = generate_or_die(KEY_ECDSA, 384); static struct sshkey *ecdsa521 = generate_or_die(KEY_ECDSA, 521); @@ -41,19 +40,20 @@ int LLVMFuzzerTestOneInput(const uint8_t* sig, size_t slen) sshkey_verify(rsa, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); sshkey_sig_details_free(details); details = NULL; - sshkey_verify(dsa, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); - sshkey_sig_details_free(details); - details = NULL; + sshkey_verify(ecdsa256, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); sshkey_sig_details_free(details); details = NULL; + sshkey_verify(ecdsa384, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); sshkey_sig_details_free(details); details = NULL; + sshkey_verify(ecdsa521, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); sshkey_sig_details_free(details); details = NULL; #endif + sshkey_verify(ed25519, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); sshkey_sig_details_free(details); return 0; diff --git a/regress/misc/fuzz-harness/sntrup761_dec_fuzz.cc b/regress/misc/fuzz-harness/sntrup761_dec_fuzz.cc new file mode 100644 index 0000000..9aecae0 --- /dev/null +++ b/regress/misc/fuzz-harness/sntrup761_dec_fuzz.cc @@ -0,0 +1,74 @@ +// Basic fuzz test for depcapsulate operation, + +#include +#include +#include +#include +#include +#include +#include + +extern "C" { + +#include "crypto_api.h" +#include "hash.c" + +#undef randombytes +#define USE_SNTRUP761X25519 1 +#ifdef SNTRUP761_NO_ASM +# undef __GNUC__ +#endif +void randombytes(unsigned char *ptr, size_t l); +volatile crypto_int16 crypto_int16_optblocker = 0; +volatile crypto_int32 crypto_int32_optblocker = 0; +volatile crypto_int64 crypto_int64_optblocker = 0; +#include "sntrup761.c" + +static int real_random; + +void +randombytes(unsigned char *ptr, size_t l) +{ + if (real_random) + arc4random_buf(ptr, l); + else + memset(ptr, 0, l); +} + +void privkeys(unsigned char *zero_sk, unsigned char *rnd_sk) +{ + unsigned char pk[crypto_kem_sntrup761_PUBLICKEYBYTES]; + + real_random = 0; + if (crypto_kem_sntrup761_keypair(pk, zero_sk) != 0) + errx(1, "crypto_kem_sntrup761_keypair failed"); + real_random = 1; + if (crypto_kem_sntrup761_keypair(pk, rnd_sk) != 0) + errx(1, "crypto_kem_sntrup761_keypair failed"); +} + +int LLVMFuzzerTestOneInput(const uint8_t* input, size_t len) +{ + static bool once; + static unsigned char zero_sk[crypto_kem_sntrup761_SECRETKEYBYTES]; + static unsigned char rnd_sk[crypto_kem_sntrup761_SECRETKEYBYTES]; + unsigned char ciphertext[crypto_kem_sntrup761_CIPHERTEXTBYTES]; + unsigned char secret[crypto_kem_sntrup761_BYTES]; + + if (!once) { + privkeys(zero_sk, rnd_sk); + once = true; + } + + memset(&ciphertext, 0, sizeof(ciphertext)); + if (len > sizeof(ciphertext)) { + len = sizeof(ciphertext); + } + memcpy(ciphertext, input, len); + + (void)crypto_kem_sntrup761_dec(secret, ciphertext, zero_sk); + (void)crypto_kem_sntrup761_dec(secret, ciphertext, rnd_sk); + return 0; +} + +} // extern diff --git a/regress/misc/fuzz-harness/sntrup761_enc_fuzz.cc b/regress/misc/fuzz-harness/sntrup761_enc_fuzz.cc new file mode 100644 index 0000000..c4ebac4 --- /dev/null +++ b/regress/misc/fuzz-harness/sntrup761_enc_fuzz.cc @@ -0,0 +1,57 @@ +// Basic fuzz test for encapsulate operation. + +#include +#include +#include +#include +#include +#include +#include + +extern "C" { + +#include "crypto_api.h" +#include "hash.c" + +#undef randombytes +#define USE_SNTRUP761X25519 1 +#ifdef SNTRUP761_NO_ASM +# undef __GNUC__ +#endif +void randombytes(unsigned char *ptr, size_t l); +volatile crypto_int16 crypto_int16_optblocker = 0; +volatile crypto_int32 crypto_int32_optblocker = 0; +volatile crypto_int64 crypto_int64_optblocker = 0; +#include "sntrup761.c" + +static int real_random; + +void +randombytes(unsigned char *ptr, size_t l) +{ + if (real_random) + arc4random_buf(ptr, l); + else + memset(ptr, 0, l); +} + +int LLVMFuzzerTestOneInput(const uint8_t* input, size_t len) +{ + unsigned char pk[crypto_kem_sntrup761_PUBLICKEYBYTES]; + unsigned char ciphertext[crypto_kem_sntrup761_CIPHERTEXTBYTES]; + unsigned char secret[crypto_kem_sntrup761_BYTES]; + + memset(&pk, 0, sizeof(pk)); + if (len > sizeof(pk)) { + len = sizeof(pk); + } + memcpy(pk, input, len); + + real_random = 0; + (void)crypto_kem_sntrup761_enc(ciphertext, secret, pk); + real_random = 1; + (void)crypto_kem_sntrup761_enc(ciphertext, secret, pk); + return 0; +} + +} // extern diff --git a/regress/misc/fuzz-harness/watch-sntrup761.sh b/regress/misc/fuzz-harness/watch-sntrup761.sh new file mode 100755 index 0000000..482f831 --- /dev/null +++ b/regress/misc/fuzz-harness/watch-sntrup761.sh @@ -0,0 +1,20 @@ +#!/bin/sh + +set -e +mkdir -p sntrup761_dec_fuzzing sntrup761_enc_fuzzing +(cd sntrup761_enc_fuzzing ; + ../sntrup761_enc_fuzz -jobs=48 ../sntrup761_pubkey_corpus &) +(cd sntrup761_dec_fuzzing ; + ../sntrup761_dec_fuzz -jobs=48 ../sntrup761_ciphertext_corpus &) + +while true ; do + clear + uptime + echo + echo "Findings" + ls -1 sntrup761_dec_fuzzing sntrup761_enc_fuzzing | grep -v '^fuzz-.*log$' + printf "\n\n" + printf "ciphertext_corpus: " ; ls -1 sntrup761_ciphertext_corpus | wc -l + printf " pubkey_corpus: "; ls -1 sntrup761_pubkey_corpus | wc -l + sleep 10; +done diff --git a/regress/multiplex.sh b/regress/multiplex.sh index b992cd4..8274b9d 100644 --- a/regress/multiplex.sh +++ b/regress/multiplex.sh @@ -1,4 +1,4 @@ -# $OpenBSD: multiplex.sh,v 1.36 2023/03/01 09:29:32 dtucker Exp $ +# $OpenBSD: multiplex.sh,v 1.37 2024/07/19 04:33:36 djm Exp $ # Placed in the Public Domain. make_tmpdir @@ -56,19 +56,20 @@ if [ $? -ne 0 ]; then fail "environment not found" fi - -verbose "test $tid: transfer" -rm -f ${COPY} -trace "ssh transfer over multiplexed connection and check result" -${SSH} -F $OBJ/ssh_config -S$CTL otherhost cat ${DATA} > ${COPY} -test -f ${COPY} || fail "ssh -Sctl: failed copy ${DATA}" -cmp ${DATA} ${COPY} || fail "ssh -Sctl: corrupted copy of ${DATA}" - -rm -f ${COPY} -trace "ssh transfer over multiplexed connection and check result" -${SSH} -F $OBJ/ssh_config -S $CTL otherhost cat ${DATA} > ${COPY} -test -f ${COPY} || fail "ssh -S ctl: failed copy ${DATA}" -cmp ${DATA} ${COPY} || fail "ssh -S ctl: corrupted copy of ${DATA}" +for mode in "" "-Oproxy"; do + verbose "test $tid: transfer $mode" + rm -f ${COPY} + trace "ssh transfer over $mode multiplexed connection and check result" + ${SSH} $mode -F $OBJ/ssh_config -S$CTL otherhost cat ${DATA} > ${COPY} + test -f ${COPY} || fail "ssh -Sctl: failed copy ${DATA}" + cmp ${DATA} ${COPY} || fail "ssh -Sctl: corrupted copy of ${DATA}" + + rm -f ${COPY} + trace "ssh transfer over $mode multiplexed connection and check result" + ${SSH} $mode -F $OBJ/ssh_config -S $CTL otherhost cat ${DATA} > ${COPY} + test -f ${COPY} || fail "ssh -S ctl: failed copy ${DATA}" + cmp ${DATA} ${COPY} || fail "ssh -S ctl: corrupted copy of ${DATA}" +done rm -f ${COPY} trace "sftp transfer over multiplexed connection and check result" diff --git a/regress/penalty-expire.sh b/regress/penalty-expire.sh new file mode 100644 index 0000000..4f0bbe6 --- /dev/null +++ b/regress/penalty-expire.sh @@ -0,0 +1,35 @@ +# $OpenBSD +# Placed in the Public Domain. + +tid="penalties" + +grep -vi PerSourcePenalties $OBJ/sshd_config > $OBJ/sshd_config.bak +cp $OBJ/authorized_keys_${USER} $OBJ/authorized_keys_${USER}.bak + +conf() { + test -z "$PIDFILE" || stop_sshd + (cat $OBJ/sshd_config.bak ; + echo "PerSourcePenalties $@") > $OBJ/sshd_config + cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER} + start_sshd +} + +conf "noauth:10s authfail:10s max:20s min:1s" + +verbose "test connect" +${SSH} -F $OBJ/ssh_config somehost true || fatal "basic connect failed" + +verbose "penalty expiry" + +# Incur a penalty +cat /dev/null > $OBJ/authorized_keys_${USER} +${SSH} -F $OBJ/ssh_config somehost true && fatal "authfail connect succeeded" +sleep 2 + +# Check denied +cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER} +${SSH} -F $OBJ/ssh_config somehost true && fatal "authfail not rejected" + +# Let it expire and try again. +sleep 11 +${SSH} -F $OBJ/ssh_config somehost true || fail "authfail not expired" diff --git a/regress/penalty.sh b/regress/penalty.sh new file mode 100644 index 0000000..8b83532 --- /dev/null +++ b/regress/penalty.sh @@ -0,0 +1,52 @@ +# $OpenBSD +# Placed in the Public Domain. + +tid="penalties" + +grep -vi PerSourcePenalties $OBJ/sshd_config > $OBJ/sshd_config.bak +cp $OBJ/authorized_keys_${USER} $OBJ/authorized_keys_${USER}.bak + +conf() { + test -z "$PIDFILE" || stop_sshd + (cat $OBJ/sshd_config.bak ; + echo "PerSourcePenalties $@") > $OBJ/sshd_config + cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER} + start_sshd +} + +conf "authfail:300s min:350s max:900s" + +verbose "test connect" +${SSH} -F $OBJ/ssh_config somehost true || fatal "basic connect failed" + +verbose "penalty for authentication failure" + +# Fail authentication once +cat /dev/null > $OBJ/authorized_keys_${USER} +${SSH} -F $OBJ/ssh_config somehost true && fatal "noauth connect succeeded" +cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER} +sleep 2 + +# Should be below penalty threshold +${SSH} -F $OBJ/ssh_config somehost true || fatal "authfail not expired" +sleep 2 + +# Fail authentication again; penalty should activate +cat /dev/null > $OBJ/authorized_keys_${USER} +${SSH} -F $OBJ/ssh_config somehost true && fatal "noauth connect succeeded" +cp $OBJ/authorized_keys_${USER}.bak $OBJ/authorized_keys_${USER} +sleep 2 + +# These should be refused by the active penalty +${SSH} -F $OBJ/ssh_config somehost true && fail "authfail not rejected" +${SSH} -F $OBJ/ssh_config somehost true && fail "repeat authfail not rejected" + +conf "noauth:100s" +${SSH} -F $OBJ/ssh_config somehost true || fatal "basic connect failed" +verbose "penalty for no authentication" +${SSHKEYSCAN} -t ssh-ed25519 -p $PORT 127.0.0.1 >/dev/null || fatal "keyscan failed" +sleep 2 + +# Repeat attempt should be penalised +${SSHKEYSCAN} -t ssh-ed25519 -p $PORT 127.0.0.1 >/dev/null 2>&1 && fail "keyscan not rejected" + diff --git a/regress/percent.sh b/regress/percent.sh index 44561d4..354854f 100644 --- a/regress/percent.sh +++ b/regress/percent.sh @@ -3,11 +3,6 @@ tid="percent expansions" -if [ -x "/usr/xpg4/bin/id" ]; then - PATH=/usr/xpg4/bin:$PATH - export PATH -fi - USER=`id -u -n` USERID=`id -u` HOST=`hostname | cut -f1 -d.` diff --git a/regress/rekey.sh b/regress/rekey.sh index 61723cd..3f5e1d5 100644 --- a/regress/rekey.sh +++ b/regress/rekey.sh @@ -1,76 +1,114 @@ -# $OpenBSD: rekey.sh,v 1.19 2021/07/19 05:08:54 dtucker Exp $ +# $OpenBSD: rekey.sh,v 1.30 2024/08/28 12:08:26 djm Exp $ # Placed in the Public Domain. tid="rekey" LOG=${TEST_SSH_LOGFILE} +COPY2=$OBJ/copy2 rm -f ${LOG} cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak +echo "Compression no" >> $OBJ/ssh_proxy +echo "RekeyLimit 256k" >> $OBJ/ssh_proxy +echo "KexAlgorithms curve25519-sha256" >> ssh_proxy + # Test rekeying based on data volume only. -# Arguments will be passed to ssh. +# Arguments: rekeylimit, kex method, optional remaining opts are passed to ssh. ssh_data_rekeying() { + _bytes=$1 ; shift _kexopt=$1 ; shift _opts="$@" - if ! test -z "$_kexopts" ; then + if test -z "$_bytes"; then + _bytes=32k + fi + if ! test -z "$_kexopt" ; then cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy echo "$_kexopt" >> $OBJ/sshd_proxy _opts="$_opts -o$_kexopt" fi - rm -f ${COPY} ${LOG} - _opts="$_opts -oCompression=no" - ${SSH} <${DATA} $_opts -v -F $OBJ/ssh_proxy somehost "cat > ${COPY}" + case "$_kexopt" in + MACs=*) + # default chacha20-poly1305 cipher has implicit MAC + _opts="$_opts -oCiphers=aes128-ctr" ;; + esac + trace bytes $_bytes kex $_kexopt opts $_opts + rm -f ${COPY} ${COPY2} ${LOG} + # Create data file just big enough to reach rekey threshold. + dd if=${DATA} of=${COPY} bs=$_bytes count=1 2>/dev/null + ${SSH} <${COPY} $_opts -vv \ + -oRekeyLimit=$_bytes -F $OBJ/ssh_proxy somehost "cat >${COPY2}" if [ $? -ne 0 ]; then fail "ssh failed ($@)" fi - cmp ${DATA} ${COPY} || fail "corrupted copy ($@)" + cmp ${COPY} ${COPY2} || fail "corrupted copy ($@)" n=`grep 'NEWKEYS sent' ${LOG} | wc -l` n=`expr $n - 1` + _want=`echo $_kexopt | cut -f2 -d=` + _got="" + case "$_kexopt" in + KexAlgorithms=*) + _got=`awk '/kex: algorithm: /{print $4}' ${LOG} | \ + tr -d '\r' | sort -u` ;; + Ciphers=*) + _got=`awk '/kex: client->server cipher:/{print $5}' ${LOG} | \ + tr -d '\r' | sort -u` ;; + MACs=*) + _got=`awk '/kex: client->server cipher:/{print $7}' ${LOG} | \ + tr -d '\r' | sort -u` ;; + esac + if [ "$_want" != "$_got" ]; then + fail "unexpected algorithm, want $_want, got $_got" + fi trace "$n rekeying(s)" if [ $n -lt 1 ]; then fail "no rekeying occurred ($@)" fi + cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy } increase_datafile_size 300 opts="" -for i in `${SSH} -Q kex`; do + +# Filter out duplicate curve algo +kexs=`${SSH} -Q kex | grep -v curve25519-sha256@libssh.org` +ciphers=`${SSH} -Q cipher` +macs=`${SSH} -Q mac` + +for i in $kexs; do opts="$opts KexAlgorithms=$i" done -for i in `${SSH} -Q cipher`; do +for i in $ciphers; do opts="$opts Ciphers=$i" done -for i in `${SSH} -Q mac`; do +for i in $macs; do opts="$opts MACs=$i" done for opt in $opts; do verbose "client rekey $opt" - ssh_data_rekeying "$opt" -oRekeyLimit=256k + if ${SSH} -Q cipher-auth | sed 's/^/Ciphers=/' | \ + grep $opt >/dev/null; then + trace AEAD cipher, testing all KexAlgorithms + for kex in $kexs; do + ssh_data_rekeying "" "KexAlgorithms=$kex" "-o$opt" + done + else + ssh_data_rekeying "" "$opt" + fi done -# AEAD ciphers are magical so test with all KexAlgorithms -if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then - for c in `${SSH} -Q cipher-auth`; do - for kex in `${SSH} -Q kex`; do - verbose "client rekey $c $kex" - ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c - done - done -fi - for s in 16 1k 128k 256k; do verbose "client rekeylimit ${s}" - ssh_data_rekeying "" -oCompression=no -oRekeyLimit=$s + ssh_data_rekeying "$s" "" done for s in 5 10; do verbose "client rekeylimit default ${s}" rm -f ${COPY} ${LOG} - ${SSH} < ${DATA} -oCompression=no -oRekeyLimit="default $s" -F \ + ${SSH} < ${DATA} -oRekeyLimit="default $s" -F \ $OBJ/ssh_proxy somehost "cat >${COPY};sleep $s;sleep 10" if [ $? -ne 0 ]; then fail "ssh failed" @@ -87,7 +125,7 @@ done for s in 5 10; do verbose "client rekeylimit default ${s} no data" rm -f ${COPY} ${LOG} - ${SSH} -oCompression=no -oRekeyLimit="default $s" -F \ + ${SSH} -oRekeyLimit="default $s" -F \ $OBJ/ssh_proxy somehost "sleep $s;sleep 10" if [ $? -ne 0 ]; then fail "ssh failed" @@ -104,13 +142,13 @@ for s in 16 1k 128k 256k; do verbose "server rekeylimit ${s}" cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy echo "rekeylimit ${s}" >>$OBJ/sshd_proxy - rm -f ${COPY} ${LOG} - ${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "cat ${DATA}" \ - > ${COPY} + rm -f ${COPY} ${COPY2} ${LOG} + dd if=${DATA} of=${COPY} bs=$s count=1 2>/dev/null + ${SSH} -F $OBJ/ssh_proxy somehost "cat ${COPY}" >${COPY2} if [ $? -ne 0 ]; then fail "ssh failed" fi - cmp ${DATA} ${COPY} || fail "corrupted copy" + cmp ${COPY} ${COPY2} || fail "corrupted copy" n=`grep 'NEWKEYS sent' ${LOG} | wc -l` n=`expr $n - 1` trace "$n rekeying(s)" @@ -124,7 +162,7 @@ for s in 5 10; do cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy echo "rekeylimit default ${s}" >>$OBJ/sshd_proxy rm -f ${COPY} ${LOG} - ${SSH} -oCompression=no -F $OBJ/ssh_proxy somehost "sleep $s;sleep 10" + ${SSH} -F $OBJ/ssh_proxy somehost "sleep $s;sleep 10" if [ $? -ne 0 ]; then fail "ssh failed" fi @@ -136,9 +174,8 @@ for s in 5 10; do fi done -verbose "rekeylimit parsing" +verbose "rekeylimit parsing: bytes" for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do - for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do case $size in 16) bytes=16 ;; 1k|1K) bytes=1024 ;; @@ -147,6 +184,15 @@ for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do 4g|4G) bytes=4294967296 ;; 8g|8G) bytes=8589934592 ;; esac + b=`${SSH} -G -o "rekeylimit $size" -F $OBJ/ssh_proxy host | \ + awk '/rekeylimit/{print $2}'` + if [ "$bytes" != "$b" ]; then + fatal "rekeylimit size: expected $bytes bytes got $b" + fi +done + +verbose "rekeylimit parsing: time" +for time in 1 1m 1M 1h 1H 1d 1D 1w 1W; do case $time in 1) seconds=1 ;; 1m|1M) seconds=60 ;; @@ -154,19 +200,11 @@ for size in 16 1k 1K 1m 1M 1g 1G 4G 8G; do 1d|1D) seconds=86400 ;; 1w|1W) seconds=604800 ;; esac - - b=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \ - awk '/rekeylimit/{print $2}'` - s=`$SUDO ${SSHD} -T -o "rekeylimit $size $time" -f $OBJ/sshd_proxy | \ + s=`${SSH} -G -o "rekeylimit default $time" -F $OBJ/ssh_proxy host | \ awk '/rekeylimit/{print $3}'` - - if [ "$bytes" != "$b" ]; then - fatal "rekeylimit size: expected $bytes bytes got $b" - fi if [ "$seconds" != "$s" ]; then fatal "rekeylimit time: expected $time seconds got $s" fi - done done -rm -f ${COPY} ${DATA} +rm -f ${COPY} ${COPY2} ${DATA} diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh index 85f0e97..5640471 100644 --- a/regress/sftp-cmds.sh +++ b/regress/sftp-cmds.sh @@ -1,4 +1,4 @@ -# $OpenBSD: sftp-cmds.sh,v 1.15 2022/03/31 03:07:33 djm Exp $ +# $OpenBSD: sftp-cmds.sh,v 1.20 2024/07/01 03:10:19 djm Exp $ # Placed in the Public Domain. # XXX - TODO: @@ -28,12 +28,12 @@ rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 mkdir ${COPY}.dd verbose "$tid: lls" -(echo "lcd ${OBJ}" ; echo "lls") | ${SFTP} -D ${SFTPSERVER} 2>&1 | \ - grep copy.dd >/dev/null 2>&1 || fail "lls failed" +printf "lcd ${OBJ}\nlls\n" | ${SFTP} -D ${SFTPSERVER} 2>&1 | \ + grep copy.dd >/dev/null || fail "lls failed" verbose "$tid: lls w/path" echo "lls ${OBJ}" | ${SFTP} -D ${SFTPSERVER} 2>&1 | \ - grep copy.dd >/dev/null 2>&1 || fail "lls w/path failed" + grep copy.dd >/dev/null || fail "lls w/path failed" verbose "$tid: ls" echo "ls ${OBJ}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ @@ -41,9 +41,8 @@ echo "ls ${OBJ}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ # XXX always successful verbose "$tid: shell" -echo "!echo hi there" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ - || fail "shell failed" -# XXX always successful +echo "!echo hi there" | ${SFTP} -D ${SFTPSERVER} 2>&1 | \ + egrep '^hi there$' >/dev/null || fail "shell failed" verbose "$tid: pwd" echo "pwd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ @@ -104,7 +103,7 @@ rm -f ${COPY}.dd/* verbose "$tid: get to directory" echo "get $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed" -cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after get" +cmp $DATA ${COPY}.dd/${DATANAME} || fail "corrupted copy after get" rm -f ${COPY}.dd/* verbose "$tid: glob get to directory" @@ -116,13 +115,13 @@ done rm -f ${COPY}.dd/* verbose "$tid: get to local dir" -(echo "lcd ${COPY}.dd"; echo "get $DATA" ) | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ +printf "lcd ${COPY}.dd\nget $DATA\n" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed" -cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after get" +cmp $DATA ${COPY}.dd/${DATANAME} || fail "corrupted copy after get" rm -f ${COPY}.dd/* verbose "$tid: glob get to local dir" -(echo "lcd ${COPY}.dd"; echo "get /bin/l*") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ +printf "lcd ${COPY}.dd\nget /bin/l*\n" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed" for x in $GLOBFILES; do cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after get" @@ -150,7 +149,7 @@ rm -f ${COPY}.dd/* verbose "$tid: put to directory" echo "put $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "put failed" -cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after put" +cmp $DATA ${COPY}.dd/${DATANAME} || fail "corrupted copy after put" rm -f ${COPY}.dd/* verbose "$tid: glob put to directory" @@ -162,13 +161,13 @@ done rm -f ${COPY}.dd/* verbose "$tid: put to local dir" -(echo "cd ${COPY}.dd"; echo "put $DATA") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ +printf "cd ${COPY}.dd\nput $DATA\n" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "put failed" -cmp $DATA ${COPY}.dd/$DATANAME || fail "corrupted copy after put" +cmp $DATA ${COPY}.dd/${DATANAME} || fail "corrupted copy after put" rm -f ${COPY}.dd/* verbose "$tid: glob put to local dir" -(echo "cd ${COPY}.dd"; echo "put /bin/l?") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ +printf "cd ${COPY}.dd\nput /bin/l*\n" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \ || fail "put failed" for x in $GLOBFILES; do cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put" diff --git a/regress/test-exec.sh b/regress/test-exec.sh index ad62794..7afc280 100644 --- a/regress/test-exec.sh +++ b/regress/test-exec.sh @@ -1,4 +1,4 @@ -# $OpenBSD: test-exec.sh,v 1.108 2024/03/08 11:34:10 dtucker Exp $ +# $OpenBSD: test-exec.sh,v 1.119 2024/06/20 08:18:34 dtucker Exp $ # Placed in the Public Domain. #SUDO=sudo @@ -90,6 +90,7 @@ SSHKEYGEN=ssh-keygen SSHKEYSCAN=ssh-keyscan SFTP=sftp SFTPSERVER=/usr/libexec/openssh/sftp-server +SSHD_SESSION=/usr/libexec/sshd-session SCP=scp # Set by make_tmpdir() on demand (below). @@ -115,6 +116,9 @@ NC=$OBJ/netcat if [ "x$TEST_SSH_SSH" != "x" ]; then SSH="${TEST_SSH_SSH}" fi +if [ "x$TEST_SSH_SSHD_SESSION" != "x" ]; then + SSHD_SESSION="${TEST_SSH_SSHD_SESSION}" +fi if [ "x$TEST_SSH_SSHD" != "x" ]; then SSHD="${TEST_SSH_SSHD}" fi @@ -348,7 +352,7 @@ ssh_logfile () # [kbytes] to ensure the file is at least that large. DATANAME=data DATA=$OBJ/${DATANAME} -cat ${SSHAGENT_BIN} >${DATA} +cat ${SSH_BIN} >${DATA} chmod u+w ${DATA} COPY=$OBJ/copy rm -f ${COPY} @@ -356,7 +360,7 @@ rm -f ${COPY} increase_datafile_size() { while [ `du -k ${DATA} | cut -f1` -lt $1 ]; do - cat ${SSHAGENT_BIN} >>${DATA} + cat ${SSH_BIN} >>${DATA} done } @@ -392,6 +396,7 @@ have_prog() jot() { awk "BEGIN { for (i = $2; i < $2 + $1; i++) { printf \"%d\n\", i } exit }" } + if [ ! -x "`which rev`" ]; then rev() { @@ -399,6 +404,13 @@ rev() } fi +if [ -x "/usr/xpg4/bin/id" ]; then +id() +{ + /usr/xpg4/bin/id $@ +} +fi + # Check whether preprocessor symbols are defined in config.h. config_defined () { @@ -444,33 +456,32 @@ make_tmpdir () stop_sshd () { - if [ -f $PIDFILE ]; then - pid=`$SUDO cat $PIDFILE` - if [ "X$pid" = "X" ]; then - echo no sshd running + [ -z $PIDFILE ] && return + [ -f $PIDFILE ] || return + pid=`$SUDO cat $PIDFILE` + if [ "X$pid" = "X" ]; then + echo "no sshd running" 1>&2 + return + elif [ $pid -lt 2 ]; then + echo "bad pid for sshd: $pid" 1>&2 + return + fi + $SUDO kill $pid + trace "wait for sshd to exit" + i=0; + while [ -f $PIDFILE -a $i -lt 5 ]; do + i=`expr $i + 1` + sleep $i + done + if test -f $PIDFILE; then + if $SUDO kill -0 $pid; then + echo "sshd didn't exit port $PORT pid $pid" 1>&2 else - if [ $pid -lt 2 ]; then - echo bad pid for sshd: $pid - else - $SUDO kill $pid - trace "wait for sshd to exit" - i=0; - while [ -f $PIDFILE -a $i -lt 5 ]; do - i=`expr $i + 1` - sleep $i - done - if test -f $PIDFILE; then - if $SUDO kill -0 $pid; then - echo "sshd didn't exit " \ - "port $PORT pid $pid" - else - echo "sshd died without cleanup" - fi - exit 1 - fi - fi + echo "sshd died without cleanup" 1>&2 fi + exit 1 fi + PIDFILE="" } # helper @@ -609,6 +620,8 @@ cat << EOF > $OBJ/sshd_config AcceptEnv _XXX_TEST_* AcceptEnv _XXX_TEST Subsystem sftp $SFTPSERVER + SshdSessionPath $SSHD_SESSION + PerSourcePenalties no EOF # This may be necessary if /usr/src and/or /usr/obj are group-writable, @@ -802,17 +815,18 @@ puttysetup() { echo "ProxyLocalhost=1" >> ${OBJ}/.putty/sessions/localhost_proxy PUTTYVER="`${PLINK} --version | awk '/plink: Release/{print $3}'`" + PUTTYMAJORVER="`echo ${PUTTYVER} | cut -f1 -d.`" PUTTYMINORVER="`echo ${PUTTYVER} | cut -f2 -d.`" - verbose "plink version ${PUTTYVER} minor ${PUTTYMINORVER}" + verbose "plink version ${PUTTYVER} major ${PUTTYMAJORVER} minor ${PUTTYMINORVER}" # Re-enable ssh-rsa on older PuTTY versions since they don't do newer # key types. - if [ "$PUTTYMINORVER" -lt "76" ]; then + if [ "$PUTTYMAJORVER" -eq "0" ] && [ "$PUTTYMINORVER" -lt "76" ]; then echo "HostKeyAlgorithms +ssh-rsa" >> ${OBJ}/sshd_proxy echo "PubkeyAcceptedKeyTypes +ssh-rsa" >> ${OBJ}/sshd_proxy fi - if [ "$PUTTYMINORVER" -le "64" ]; then + if [ "$PUTTYMAJORVER" -eq "0" ] && [ "$PUTTYMINORVER" -le "64" ]; then echo "KexAlgorithms +diffie-hellman-group14-sha1" \ >>${OBJ}/sshd_proxy fi @@ -832,15 +846,25 @@ esac if test "$REGRESS_INTEROP_DROPBEAR" = "yes" ; then trace Create dropbear keys and add to authorized_keys mkdir -p $OBJ/.dropbear - for i in rsa ecdsa ed25519 dss; do + kt="ed25519" + for i in dss rsa ecdsa; do + if $SSH -Q key-plain | grep "$i" >/dev/null; then + kt="$kt $i" + else + rm -f "$OBJ/.dropbear/id_$i" + fi + done + for i in $kt; do if [ ! -f "$OBJ/.dropbear/id_$i" ]; then - ($DROPBEARKEY -t $i -f $OBJ/.dropbear/id_$i - $DROPBEARCONVERT dropbear openssh \ - $OBJ/.dropbear/id_$i $OBJ/.dropbear/ossh.id_$i - ) > /dev/null 2>&1 + verbose Create dropbear key type $i + $DROPBEARKEY -t $i -f $OBJ/.dropbear/id_$i \ + >/dev/null 2>&1 fi + $DROPBEARCONVERT dropbear openssh $OBJ/.dropbear/id_$i \ + $OBJ/.dropbear/ossh.id_$i >/dev/null 2>&1 $SSHKEYGEN -y -f $OBJ/.dropbear/ossh.id_$i \ >>$OBJ/authorized_keys_$USER + rm -f $OBJ/.dropbear/id_$i.pub $OBJ/.dropbear/ossh.id_$i done fi @@ -861,6 +885,7 @@ chmod a+x $OBJ/ssh_proxy.sh start_sshd () { + PIDFILE=$OBJ/pidfile # start sshd logfile="${TEST_SSH_LOGDIR}/sshd.`$OBJ/timestamp`.$$.log" $SUDO ${SSHD} -f $OBJ/sshd_config "$@" -t || fatal "sshd_config broken" @@ -873,6 +898,7 @@ start_sshd () i=`expr $i + 1` sleep $i done + ln -f -s ${logfile} $TEST_SSHD_LOGFILE test -f $PIDFILE || fatal "no sshd running on port $PORT" } diff --git a/regress/unittests/kex/Makefile b/regress/unittests/kex/Makefile index 981affe..ca4f0ee 100644 --- a/regress/unittests/kex/Makefile +++ b/regress/unittests/kex/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.14 2023/02/02 12:12:52 djm Exp $ +# $OpenBSD: Makefile,v 1.16 2024/09/09 03:13:39 djm Exp $ PROG=test_kex SRCS=tests.c test_kex.c test_proposal.c @@ -14,6 +14,7 @@ SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c SRCS+=ssh-ed25519-sk.c sk-usbhid.c SRCS+= kex.c +SRCS+= kex-names.c SRCS+= dh.c SRCS+= kexdh.c SRCS+= kexecdh.c @@ -24,6 +25,7 @@ SRCS+= kexc25519.c SRCS+= smult_curve25519_ref.c SRCS+= kexgen.c SRCS+= kexsntrup761x25519.c +SRCS+= kexmlkem768x25519.c SRCS+= sntrup761.c SRCS+= utf8.c diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c index dc1014e..caf8f57 100644 --- a/regress/unittests/kex/test_kex.c +++ b/regress/unittests/kex/test_kex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_kex.c,v 1.7 2024/01/11 01:45:58 djm Exp $ */ +/* $OpenBSD: test_kex.c,v 1.9 2024/09/09 03:13:39 djm Exp $ */ /* * Regress test KEX * @@ -22,6 +22,7 @@ #include "sshbuf.h" #include "packet.h" #include "myproposal.h" +#include "log.h" void kex_tests(void); static int do_debug = 0; @@ -152,6 +153,7 @@ do_kex_with_key(char *kex, int keytype, int bits) #endif /* WITH_OPENSSL */ server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server; server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; + server2->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; server2->kex->load_host_public_key = server->kex->load_host_public_key; server2->kex->load_host_private_key = server->kex->load_host_private_key; server2->kex->sign = server->kex->sign; @@ -177,6 +179,9 @@ do_kex_with_key(char *kex, int keytype, int bits) static void do_kex(char *kex) { +#if 0 + log_init("test_kex", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 1); +#endif #ifdef WITH_OPENSSL do_kex_with_key(kex, KEY_RSA, 2048); #ifdef WITH_DSA @@ -203,6 +208,9 @@ kex_tests(void) do_kex("diffie-hellman-group-exchange-sha1"); do_kex("diffie-hellman-group14-sha1"); do_kex("diffie-hellman-group1-sha1"); +# ifdef USE_MLKEM768X25519 + do_kex("mlkem768x25519-sha256"); +# endif /* USE_MLKEM768X25519 */ # ifdef USE_SNTRUP761X25519 do_kex("sntrup761x25519-sha512@openssh.com"); # endif /* USE_SNTRUP761X25519 */ diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c index 51b0d92..f325c2a 100644 --- a/regress/unittests/sshkey/common.c +++ b/regress/unittests/sshkey/common.c @@ -1,4 +1,4 @@ -/* $OpenBSD: common.c,v 1.5 2021/12/14 21:25:27 deraadt Exp $ */ +/* $OpenBSD: common.c,v 1.6 2024/08/15 00:52:23 djm Exp $ */ /* * Helpers for key API tests * @@ -89,8 +89,8 @@ rsa_n(struct sshkey *k) const BIGNUM *n = NULL; ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->rsa, NULL); - RSA_get0_key(k->rsa, &n, NULL, NULL); + ASSERT_PTR_NE(k->pkey, NULL); + RSA_get0_key(EVP_PKEY_get0_RSA(k->pkey), &n, NULL, NULL); return n; } @@ -100,8 +100,8 @@ rsa_e(struct sshkey *k) const BIGNUM *e = NULL; ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->rsa, NULL); - RSA_get0_key(k->rsa, NULL, &e, NULL); + ASSERT_PTR_NE(k->pkey, NULL); + RSA_get0_key(EVP_PKEY_get0_RSA(k->pkey), NULL, &e, NULL); return e; } @@ -111,8 +111,8 @@ rsa_p(struct sshkey *k) const BIGNUM *p = NULL; ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->rsa, NULL); - RSA_get0_factors(k->rsa, &p, NULL); + ASSERT_PTR_NE(EVP_PKEY_get0_RSA(k->pkey), NULL); + RSA_get0_factors(EVP_PKEY_get0_RSA(k->pkey), &p, NULL); return p; } @@ -122,8 +122,8 @@ rsa_q(struct sshkey *k) const BIGNUM *q = NULL; ASSERT_PTR_NE(k, NULL); - ASSERT_PTR_NE(k->rsa, NULL); - RSA_get0_factors(k->rsa, NULL, &q); + ASSERT_PTR_NE(EVP_PKEY_get0_RSA(k->pkey), NULL); + RSA_get0_factors(EVP_PKEY_get0_RSA(k->pkey), NULL, &q); return q; } diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c index 4528405..3babe60 100644 --- a/regress/unittests/sshkey/test_file.c +++ b/regress/unittests/sshkey/test_file.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_file.c,v 1.11 2024/01/11 01:45:58 djm Exp $ */ +/* $OpenBSD: test_file.c,v 1.12 2024/08/15 00:52:23 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -271,11 +271,12 @@ sshkey_file_tests(void) #ifndef OPENSSL_IS_BORINGSSL /* lacks EC_POINT_point2bn() */ a = load_bignum("ecdsa_1.param.priv"); b = load_bignum("ecdsa_1.param.pub"); - c = EC_POINT_point2bn(EC_KEY_get0_group(k1->ecdsa), - EC_KEY_get0_public_key(k1->ecdsa), POINT_CONVERSION_UNCOMPRESSED, - NULL, NULL); + c = EC_POINT_point2bn(EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(k1->pkey)), + EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(k1->pkey)), + POINT_CONVERSION_UNCOMPRESSED, NULL, NULL); ASSERT_PTR_NE(c, NULL); - ASSERT_BIGNUM_EQ(EC_KEY_get0_private_key(k1->ecdsa), a); + ASSERT_BIGNUM_EQ( + EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(k1->pkey)), a); ASSERT_BIGNUM_EQ(b, c); BN_free(a); BN_free(b); diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c index c1cbb11..5bf4b65 100644 --- a/regress/unittests/sshkey/test_sshkey.c +++ b/regress/unittests/sshkey/test_sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: test_sshkey.c,v 1.24 2024/01/11 01:45:58 djm Exp $ */ +/* $OpenBSD: test_sshkey.c,v 1.25 2024/08/15 00:52:23 djm Exp $ */ /* * Regress test for sshkey.h key management API * @@ -204,7 +204,7 @@ sshkey_tests(void) TEST_START("new/free KEY_RSA"); k1 = sshkey_new(KEY_RSA); ASSERT_PTR_NE(k1, NULL); - ASSERT_PTR_NE(k1->rsa, NULL); + ASSERT_PTR_NE(k1->pkey, NULL); sshkey_free(k1); TEST_DONE(); @@ -221,7 +221,7 @@ sshkey_tests(void) TEST_START("new/free KEY_ECDSA"); k1 = sshkey_new(KEY_ECDSA); ASSERT_PTR_NE(k1, NULL); - ASSERT_PTR_EQ(k1->ecdsa, NULL); /* Can't allocate without NID */ + ASSERT_PTR_EQ(k1->pkey, NULL); /* Can't allocate without NID */ sshkey_free(k1); TEST_DONE(); #endif @@ -270,7 +270,7 @@ sshkey_tests(void) SSH_ERR_KEY_LENGTH); ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &kr), 0); ASSERT_PTR_NE(kr, NULL); - ASSERT_PTR_NE(kr->rsa, NULL); + ASSERT_PTR_NE(EVP_PKEY_get0_RSA(kr->pkey), NULL); ASSERT_PTR_NE(rsa_n(kr), NULL); ASSERT_PTR_NE(rsa_e(kr), NULL); ASSERT_PTR_NE(rsa_p(kr), NULL); @@ -291,9 +291,11 @@ sshkey_tests(void) TEST_START("generate KEY_ECDSA"); ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &ke), 0); ASSERT_PTR_NE(ke, NULL); - ASSERT_PTR_NE(ke->ecdsa, NULL); - ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL); - ASSERT_PTR_NE(EC_KEY_get0_private_key(ke->ecdsa), NULL); + ASSERT_PTR_NE(EVP_PKEY_get0_EC_KEY(ke->pkey), NULL); + ASSERT_PTR_NE(EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(ke->pkey)), + NULL); + ASSERT_PTR_NE(EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(ke->pkey)), + NULL); TEST_DONE(); #endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ @@ -312,7 +314,7 @@ sshkey_tests(void) ASSERT_PTR_NE(k1, NULL); ASSERT_PTR_NE(kr, k1); ASSERT_INT_EQ(k1->type, KEY_RSA); - ASSERT_PTR_NE(k1->rsa, NULL); + ASSERT_PTR_NE(EVP_PKEY_get0_RSA(k1->pkey), NULL); ASSERT_PTR_NE(rsa_n(k1), NULL); ASSERT_PTR_NE(rsa_e(k1), NULL); ASSERT_PTR_EQ(rsa_p(k1), NULL); @@ -346,10 +348,12 @@ sshkey_tests(void) ASSERT_PTR_NE(k1, NULL); ASSERT_PTR_NE(ke, k1); ASSERT_INT_EQ(k1->type, KEY_ECDSA); - ASSERT_PTR_NE(k1->ecdsa, NULL); + ASSERT_PTR_NE(EVP_PKEY_get0_EC_KEY(k1->pkey), NULL); ASSERT_INT_EQ(k1->ecdsa_nid, ke->ecdsa_nid); - ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL); - ASSERT_PTR_EQ(EC_KEY_get0_private_key(k1->ecdsa), NULL); + ASSERT_PTR_NE(EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(ke->pkey)), + NULL); + ASSERT_PTR_EQ(EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(k1->pkey)), + NULL); TEST_DONE(); TEST_START("equal KEY_ECDSA/demoted KEY_ECDSA"); diff --git a/regress/unittests/test_helper/fuzz.c b/regress/unittests/test_helper/fuzz.c index 78b3665..9995b26 100644 --- a/regress/unittests/test_helper/fuzz.c +++ b/regress/unittests/test_helper/fuzz.c @@ -214,7 +214,7 @@ siginfo(int unused __attribute__((__unused__))) struct fuzz * fuzz_begin(u_int strategies, const void *p, size_t l) { - struct fuzz *ret = calloc(sizeof(*ret), 1); + struct fuzz *ret = calloc(1, sizeof(*ret)); assert(p != NULL); assert(ret != NULL); diff --git a/regress/yes-head.sh b/regress/yes-head.sh index 1bde504..9885501 100644 --- a/regress/yes-head.sh +++ b/regress/yes-head.sh @@ -6,7 +6,7 @@ tid="yes pipe head" lines=`${SSH} -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)` if [ $? -ne 0 ]; then fail "yes|head test failed" -+ lines=0 + lines=0 fi if [ $lines -ne 2000 ]; then fail "yes|head returns $lines lines instead of 2000" diff --git a/scp.c b/scp.c index 492dace..0779c3c 100644 --- a/scp.c +++ b/scp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: scp.c,v 1.260 2023/10/11 05:42:08 djm Exp $ */ +/* $OpenBSD: scp.c,v 1.261 2024/06/26 23:14:14 deraadt Exp $ */ /* * scp - secure remote copy. This is basically patched BSD rcp which * uses ssh to do the data transfer (instead of using rcmd). @@ -222,9 +222,11 @@ suspone(int pid, int signo) static void suspchild(int signo) { + int save_errno = errno; suspone(do_cmd_pid, signo); suspone(do_cmd_pid2, signo); kill(getpid(), SIGSTOP); + errno = save_errno; } static int diff --git a/servconf.c b/servconf.c index 4b43490..89b8413 100644 --- a/servconf.c +++ b/servconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.c,v 1.405 2024/03/04 02:16:11 djm Exp $ */ +/* $OpenBSD: servconf.c,v 1.418 2024/09/15 03:09:44 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -69,6 +69,10 @@ #include "myproposal.h" #include "digest.h" +#if !defined(SSHD_PAM_SERVICE) +# define SSHD_PAM_SERVICE "sshd" +#endif + static void add_listen_addr(ServerOptions *, const char *, const char *, int); static void add_one_listen_addr(ServerOptions *, const char *, @@ -77,8 +81,6 @@ static void parse_server_config_depth(ServerOptions *options, const char *filename, struct sshbuf *conf, struct include_list *includes, struct connection_info *connectinfo, int flags, int *activep, int depth); -/* Use of privilege separation or not */ -extern int use_privsep; extern struct sshbuf *cfg; /* Initializes the server options to their default values. */ @@ -90,6 +92,7 @@ initialize_server_options(ServerOptions *options) /* Portable-specific options */ options->use_pam = -1; + options->pam_service_name = NULL; /* Standard Options */ options->num_ports = 0; @@ -165,6 +168,19 @@ initialize_server_options(ServerOptions *options) options->per_source_max_startups = -1; options->per_source_masklen_ipv4 = -1; options->per_source_masklen_ipv6 = -1; + options->per_source_penalty_exempt = NULL; + options->per_source_penalty.enabled = -1; + options->per_source_penalty.max_sources4 = -1; + options->per_source_penalty.max_sources6 = -1; + options->per_source_penalty.overflow_mode = -1; + options->per_source_penalty.overflow_mode6 = -1; + options->per_source_penalty.penalty_crash = -1; + options->per_source_penalty.penalty_authfail = -1; + options->per_source_penalty.penalty_noauth = -1; + options->per_source_penalty.penalty_grace = -1; + options->per_source_penalty.penalty_refuseconnection = -1; + options->per_source_penalty.penalty_max = -1; + options->per_source_penalty.penalty_min = -1; options->max_authtries = -1; options->max_sessions = -1; options->banner = NULL; @@ -197,6 +213,8 @@ initialize_server_options(ServerOptions *options) options->channel_timeouts = NULL; options->num_channel_timeouts = 0; options->unused_connection_timeout = -1; + options->sshd_session_path = NULL; + options->refuse_connection = -1; } /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ @@ -280,6 +298,8 @@ fill_default_server_options(ServerOptions *options) /* Portable-specific options */ if (options->use_pam == -1) options->use_pam = 0; + if (options->pam_service_name == NULL) + options->pam_service_name = xstrdup(SSHD_PAM_SERVICE); /* Standard Options */ if (options->num_host_key_files == 0) { @@ -403,6 +423,30 @@ fill_default_server_options(ServerOptions *options) options->per_source_masklen_ipv4 = 32; if (options->per_source_masklen_ipv6 == -1) options->per_source_masklen_ipv6 = 128; + if (options->per_source_penalty.enabled == -1) + options->per_source_penalty.enabled = 1; + if (options->per_source_penalty.max_sources4 == -1) + options->per_source_penalty.max_sources4 = 65536; + if (options->per_source_penalty.max_sources6 == -1) + options->per_source_penalty.max_sources6 = 65536; + if (options->per_source_penalty.overflow_mode == -1) + options->per_source_penalty.overflow_mode = PER_SOURCE_PENALTY_OVERFLOW_PERMISSIVE; + if (options->per_source_penalty.overflow_mode6 == -1) + options->per_source_penalty.overflow_mode6 = options->per_source_penalty.overflow_mode; + if (options->per_source_penalty.penalty_crash == -1) + options->per_source_penalty.penalty_crash = 90; + if (options->per_source_penalty.penalty_grace == -1) + options->per_source_penalty.penalty_grace = 10; + if (options->per_source_penalty.penalty_authfail == -1) + options->per_source_penalty.penalty_authfail = 5; + if (options->per_source_penalty.penalty_noauth == -1) + options->per_source_penalty.penalty_noauth = 1; + if (options->per_source_penalty.penalty_refuseconnection == -1) + options->per_source_penalty.penalty_refuseconnection = 10; + if (options->per_source_penalty.penalty_min == -1) + options->per_source_penalty.penalty_min = 15; + if (options->per_source_penalty.penalty_max == -1) + options->per_source_penalty.penalty_max = 600; if (options->max_authtries == -1) options->max_authtries = DEFAULT_AUTH_FAIL_MAX; if (options->max_sessions == -1) @@ -447,13 +491,13 @@ fill_default_server_options(ServerOptions *options) options->required_rsa_size = SSH_RSA_MINIMUM_MODULUS_SIZE; if (options->unused_connection_timeout == -1) options->unused_connection_timeout = 0; + if (options->sshd_session_path == NULL) + options->sshd_session_path = xstrdup(_PATH_SSHD_SESSION); + if (options->refuse_connection == -1) + options->refuse_connection = 0; assemble_algorithms(options); - /* Turn privilege separation and sandboxing on by default */ - if (use_privsep == -1) - use_privsep = PRIVSEP_ON; - #define CLEAR_ON_NONE(v) \ do { \ if (option_clear_or_none(v)) { \ @@ -482,6 +526,7 @@ fill_default_server_options(ServerOptions *options) CLEAR_ON_NONE(options->chroot_directory); CLEAR_ON_NONE(options->routing_domain); CLEAR_ON_NONE(options->host_key_agent); + CLEAR_ON_NONE(options->per_source_penalty_exempt); for (i = 0; i < options->num_host_key_files; i++) CLEAR_ON_NONE(options->host_key_files[i]); @@ -498,7 +543,7 @@ fill_default_server_options(ServerOptions *options) typedef enum { sBadOption, /* == unknown option */ /* Portable-specific options */ - sUsePAM, + sUsePAM, sPAMServiceName, /* Standard Options */ sPort, sHostKeyFile, sLoginGraceTime, sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose, @@ -516,6 +561,7 @@ typedef enum { sBanner, sUseDNS, sHostbasedAuthentication, sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedAlgorithms, sHostKeyAlgorithms, sPerSourceMaxStartups, sPerSourceNetBlockSize, + sPerSourcePenalties, sPerSourcePenaltyExemptList, sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, sAcceptEnv, sSetEnv, sPermitTunnel, @@ -531,6 +577,7 @@ typedef enum { sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding, sExposeAuthInfo, sRDomain, sPubkeyAuthOptions, sSecurityKeyProvider, sRequiredRSASize, sChannelTimeout, sUnusedConnectionTimeout, + sSshdSessionPath, sRefuseConnection, sDeprecated, sIgnore, sUnsupported } ServerOpCodes; @@ -549,8 +596,10 @@ static struct { /* Portable-specific options */ #ifdef USE_PAM { "usepam", sUsePAM, SSHCFG_GLOBAL }, + { "pamservicename", sPAMServiceName, SSHCFG_ALL }, #else { "usepam", sUnsupported, SSHCFG_GLOBAL }, + { "pamservicename", sUnsupported, SSHCFG_ALL }, #endif { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, /* Standard Options */ @@ -647,6 +696,8 @@ static struct { { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, { "persourcemaxstartups", sPerSourceMaxStartups, SSHCFG_GLOBAL }, { "persourcenetblocksize", sPerSourceNetBlockSize, SSHCFG_GLOBAL }, + { "persourcepenalties", sPerSourcePenalties, SSHCFG_GLOBAL }, + { "persourcepenaltyexemptlist", sPerSourcePenaltyExemptList, SSHCFG_GLOBAL }, { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, { "maxsessions", sMaxSessions, SSHCFG_ALL }, { "banner", sBanner, SSHCFG_ALL }, @@ -693,6 +744,8 @@ static struct { { "requiredrsasize", sRequiredRSASize, SSHCFG_ALL }, { "channeltimeout", sChannelTimeout, SSHCFG_ALL }, { "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL }, + { "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL }, + { "refuseconnection", sRefuseConnection, SSHCFG_ALL }, { NULL, sBadOption, 0 } }; @@ -902,95 +955,6 @@ process_queued_listen_addrs(ServerOptions *options) options->num_queued_listens = 0; } -/* - * Inform channels layer of permitopen options for a single forwarding - * direction (local/remote). - */ -static void -process_permitopen_list(struct ssh *ssh, ServerOpCodes opcode, - char **opens, u_int num_opens) -{ - u_int i; - int port; - char *host, *arg, *oarg; - int where = opcode == sPermitOpen ? FORWARD_LOCAL : FORWARD_REMOTE; - const char *what = lookup_opcode_name(opcode); - - channel_clear_permission(ssh, FORWARD_ADM, where); - if (num_opens == 0) - return; /* permit any */ - - /* handle keywords: "any" / "none" */ - if (num_opens == 1 && strcmp(opens[0], "any") == 0) - return; - if (num_opens == 1 && strcmp(opens[0], "none") == 0) { - channel_disable_admin(ssh, where); - return; - } - /* Otherwise treat it as a list of permitted host:port */ - for (i = 0; i < num_opens; i++) { - oarg = arg = xstrdup(opens[i]); - host = hpdelim(&arg); - if (host == NULL) - fatal_f("missing host in %s", what); - host = cleanhostname(host); - if (arg == NULL || ((port = permitopen_port(arg)) < 0)) - fatal_f("bad port number in %s", what); - /* Send it to channels layer */ - channel_add_permission(ssh, FORWARD_ADM, - where, host, port); - free(oarg); - } -} - -/* - * Inform channels layer of permitopen options from configuration. - */ -void -process_permitopen(struct ssh *ssh, ServerOptions *options) -{ - process_permitopen_list(ssh, sPermitOpen, - options->permitted_opens, options->num_permitted_opens); - process_permitopen_list(ssh, sPermitListen, - options->permitted_listens, - options->num_permitted_listens); -} - -void -process_channel_timeouts(struct ssh *ssh, ServerOptions *options) -{ - int secs; - u_int i; - char *type; - - debug3_f("setting %u timeouts", options->num_channel_timeouts); - channel_clear_timeouts(ssh); - for (i = 0; i < options->num_channel_timeouts; i++) { - if (parse_pattern_interval(options->channel_timeouts[i], - &type, &secs) != 0) { - fatal_f("internal error: bad timeout %s", - options->channel_timeouts[i]); - } - channel_add_timeout(ssh, type, secs); - free(type); - } -} - -struct connection_info * -get_connection_info(struct ssh *ssh, int populate, int use_dns) -{ - static struct connection_info ci; - - if (ssh == NULL || !populate) - return &ci; - ci.host = auth_get_canonical_hostname(ssh, use_dns); - ci.address = ssh_remote_ipaddr(ssh); - ci.laddress = ssh_local_ipaddr(ssh); - ci.lport = ssh_local_port(ssh); - ci.rdomain = ssh_packet_rdomain_in(ssh); - return &ci; -} - /* * The strategy for the Match blocks is that the config file is parsed twice. * @@ -1065,43 +1029,57 @@ match_test_missing_fatal(const char *criteria, const char *attrib) * not match. */ static int -match_cfg_line(char **condition, int line, struct connection_info *ci) +match_cfg_line(const char *full_line, int *acp, char ***avp, + int line, struct connection_info *ci) { int result = 1, attributes = 0, port; - char *arg, *attrib, *cp = *condition; + char *arg, *attrib; if (ci == NULL) - debug3("checking syntax for 'Match %s'", cp); - else - debug3("checking match for '%s' user %s host %s addr %s " - "laddr %s lport %d", cp, ci->user ? ci->user : "(null)", + debug3("checking syntax for 'Match %s'", full_line); + else { + debug3("checking match for '%s' user %s%s host %s addr %s " + "laddr %s lport %d", full_line, + ci->user ? ci->user : "(null)", + ci->user_invalid ? " (invalid)" : "", ci->host ? ci->host : "(null)", ci->address ? ci->address : "(null)", ci->laddress ? ci->laddress : "(null)", ci->lport); + } - while ((attrib = strdelim(&cp)) && *attrib != '\0') { + while ((attrib = argv_next(acp, avp)) != NULL) { /* Terminate on comment */ if (*attrib == '#') { - cp = NULL; /* mark all arguments consumed */ + argv_consume(acp); /* mark all arguments consumed */ break; } arg = NULL; attributes++; /* Criterion "all" has no argument and must appear alone */ if (strcasecmp(attrib, "all") == 0) { - if (attributes > 1 || ((arg = strdelim(&cp)) != NULL && + if (attributes > 1 || + ((arg = argv_next(acp, avp)) != NULL && *arg != '\0' && *arg != '#')) { error("'all' cannot be combined with other " "Match attributes"); return -1; } if (arg != NULL && *arg == '#') - cp = NULL; /* mark all arguments consumed */ - *condition = cp; + argv_consume(acp); /* consume remaining args */ return 1; } + /* Criterion "invalid-user" also has no argument */ + if (strcasecmp(attrib, "invalid-user") == 0) { + if (ci == NULL) + continue; + if (ci->user_invalid == 0) + result = 0; + else + debug("matched invalid-user at line %d", line); + continue; + } /* All other criteria require an argument */ - if ((arg = strdelim(&cp)) == NULL || + if ((arg = argv_next(acp, avp)) == NULL || *arg == '\0' || *arg == '#') { error("Missing Match criteria for %s", attrib); return -1; @@ -1232,7 +1210,6 @@ match_cfg_line(char **condition, int line, struct connection_info *ci) } if (ci != NULL) debug3("match %sfound", result ? "" : "not "); - *condition = cp; return result; } @@ -1370,6 +1347,16 @@ process_server_config_line_depth(ServerOptions *options, char *line, case sUsePAM: intptr = &options->use_pam; goto parse_flag; + case sPAMServiceName: + charptr = &options->pam_service_name; + arg = argv_next(&ac, &av); + if (!arg || *arg == '\0') { + fatal("%s line %d: missing argument.", + filename, linenum); + } + if (*activep && *charptr == NULL) + *charptr = xstrdup(arg); + break; /* Standard Options */ case sBadOption: @@ -1966,6 +1953,7 @@ process_server_config_line_depth(ServerOptions *options, char *line, xasprintf(&options->subsystem_args[options->num_subsystems], "%s%s%s", arg, *arg2 == '\0' ? "" : " ", arg2); free(arg2); + free(arg); argv_consume(&ac); options->num_subsystems++; break; @@ -2035,6 +2023,103 @@ process_server_config_line_depth(ServerOptions *options, char *line, options->per_source_max_startups = value; break; + case sPerSourcePenaltyExemptList: + charptr = &options->per_source_penalty_exempt; + arg = argv_next(&ac, &av); + if (!arg || *arg == '\0') + fatal("%s line %d: missing argument.", + filename, linenum); + if (addr_match_list(NULL, arg) != 0) { + fatal("%s line %d: keyword %s " + "invalid address argument.", + filename, linenum, keyword); + } + if (*activep && *charptr == NULL) + *charptr = xstrdup(arg); + break; + + case sPerSourcePenalties: + while ((arg = argv_next(&ac, &av)) != NULL) { + found = 1; + value = -1; + value2 = 0; + p = NULL; + /* Allow no/yes only in first position */ + if (strcasecmp(arg, "no") == 0 || + (value2 = (strcasecmp(arg, "yes") == 0))) { + if (ac > 0) { + fatal("%s line %d: keyword %s \"%s\" " + "argument must appear alone.", + filename, linenum, keyword, arg); + } + if (*activep && + options->per_source_penalty.enabled == -1) + options->per_source_penalty.enabled = value2; + continue; + } else if (strncmp(arg, "crash:", 6) == 0) { + p = arg + 6; + intptr = &options->per_source_penalty.penalty_crash; + } else if (strncmp(arg, "authfail:", 9) == 0) { + p = arg + 9; + intptr = &options->per_source_penalty.penalty_authfail; + } else if (strncmp(arg, "noauth:", 7) == 0) { + p = arg + 7; + intptr = &options->per_source_penalty.penalty_noauth; + } else if (strncmp(arg, "grace-exceeded:", 15) == 0) { + p = arg + 15; + intptr = &options->per_source_penalty.penalty_grace; + } else if (strncmp(arg, "refuseconnection:", 17) == 0) { + p = arg + 17; + intptr = &options->per_source_penalty.penalty_refuseconnection; + } else if (strncmp(arg, "max:", 4) == 0) { + p = arg + 4; + intptr = &options->per_source_penalty.penalty_max; + } else if (strncmp(arg, "min:", 4) == 0) { + p = arg + 4; + intptr = &options->per_source_penalty.penalty_min; + } else if (strncmp(arg, "max-sources4:", 13) == 0) { + intptr = &options->per_source_penalty.max_sources4; + if ((errstr = atoi_err(arg+13, &value)) != NULL) + fatal("%s line %d: %s value %s.", + filename, linenum, keyword, errstr); + } else if (strncmp(arg, "max-sources6:", 13) == 0) { + intptr = &options->per_source_penalty.max_sources6; + if ((errstr = atoi_err(arg+13, &value)) != NULL) + fatal("%s line %d: %s value %s.", + filename, linenum, keyword, errstr); + } else if (strcmp(arg, "overflow:deny-all") == 0) { + intptr = &options->per_source_penalty.overflow_mode; + value = PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL; + } else if (strcmp(arg, "overflow:permissive") == 0) { + intptr = &options->per_source_penalty.overflow_mode; + value = PER_SOURCE_PENALTY_OVERFLOW_PERMISSIVE; + } else if (strcmp(arg, "overflow6:deny-all") == 0) { + intptr = &options->per_source_penalty.overflow_mode6; + value = PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL; + } else if (strcmp(arg, "overflow6:permissive") == 0) { + intptr = &options->per_source_penalty.overflow_mode6; + value = PER_SOURCE_PENALTY_OVERFLOW_PERMISSIVE; + } else { + fatal("%s line %d: unsupported %s keyword %s", + filename, linenum, keyword, arg); + } + /* If no value was parsed above, assume it's a time */ + if (value == -1 && (value = convtime(p)) == -1) { + fatal("%s line %d: invalid %s time value.", + filename, linenum, keyword); + } + if (*activep && *intptr == -1) { + *intptr = value; + /* any option implicitly enables penalties */ + options->per_source_penalty.enabled = 1; + } + } + if (!found) { + fatal("%s line %d: no %s specified", + filename, linenum, keyword); + } + break; + case sMaxAuthTries: intptr = &options->max_authtries; goto parse_int; @@ -2264,7 +2349,7 @@ process_server_config_line_depth(ServerOptions *options, char *line, if (cmdline) fatal("Match directive not supported as a command-line " "option"); - value = match_cfg_line(&str, linenum, + value = match_cfg_line(str, &ac, &av, linenum, (*inc_flags & SSHCFG_NEVERMATCH ? NULL : connectinfo)); if (value < 0) fatal("%s line %d: Bad Match condition", filename, @@ -2275,12 +2360,6 @@ process_server_config_line_depth(ServerOptions *options, char *line, * match block. */ *inc_flags &= ~SSHCFG_MATCH_ONLY; - /* - * If match_cfg_line() didn't consume all its arguments then - * arrange for the extra arguments check below to fail. - */ - if (str == NULL || *str == '\0') - argv_consume(&ac); break; case sPermitListen: @@ -2593,6 +2672,15 @@ process_server_config_line_depth(ServerOptions *options, char *line, } goto parse_time; + case sSshdSessionPath: + charptr = &options->sshd_session_path; + goto parse_filename; + + case sRefuseConnection: + intptr = &options->refuse_connection; + multistate_ptr = multistate_flag; + goto parse_multistate; + case sDeprecated: case sIgnore: case sUnsupported: @@ -2707,6 +2795,8 @@ int parse_server_match_testspec(struct connection_info *ci, char *spec) " specification %s\n", p+6, p); return -1; } + } else if (strcmp(p, "invalid-user") == 0) { + ci->user_invalid = 1; } else { fprintf(stderr, "Invalid test mode specification %s\n", p); @@ -2808,6 +2898,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) M_CP_INTOPT(log_level); M_CP_INTOPT(required_rsa_size); M_CP_INTOPT(unused_connection_timeout); + M_CP_INTOPT(refuse_connection); /* * The bind_mask is a mode_t that may be unsigned, so we can't use @@ -3082,6 +3173,7 @@ dump_config(ServerOptions *o) /* integer arguments */ #ifdef USE_PAM dump_cfg_fmtint(sUsePAM, o->use_pam); + dump_cfg_string(sPAMServiceName, o->pam_service_name); #endif dump_cfg_int(sLoginGraceTime, o->login_grace_time); dump_cfg_int(sX11DisplayOffset, o->x11_display_offset); @@ -3137,6 +3229,7 @@ dump_config(ServerOptions *o) dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink); dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash); dump_cfg_fmtint(sExposeAuthInfo, o->expose_userauth_info); + dump_cfg_fmtint(sRefuseConnection, o->refuse_connection); /* string arguments */ dump_cfg_string(sPidFile, o->pid_file); @@ -3167,6 +3260,8 @@ dump_config(ServerOptions *o) #if defined(__OpenBSD__) || defined(HAVE_SYS_SET_PROCESS_RDOMAIN) dump_cfg_string(sRDomain, o->routing_domain); #endif + dump_cfg_string(sSshdSessionPath, o->sshd_session_path); + dump_cfg_string(sPerSourcePenaltyExemptList, o->per_source_penalty_exempt); /* string arguments requiring a lookup */ dump_cfg_string(sLogLevel, log_level_name(o->log_level)); @@ -3254,4 +3349,27 @@ dump_config(ServerOptions *o) if (o->pubkey_auth_options & PUBKEYAUTH_VERIFY_REQUIRED) printf(" verify-required"); printf("\n"); + + if (o->per_source_penalty.enabled) { + printf("persourcepenalties crash:%d authfail:%d noauth:%d " + "grace-exceeded:%d refuseconnection:%d max:%d min:%d " + "max-sources4:%d max-sources6:%d " + "overflow:%s overflow6:%s\n", + o->per_source_penalty.penalty_crash, + o->per_source_penalty.penalty_authfail, + o->per_source_penalty.penalty_noauth, + o->per_source_penalty.penalty_grace, + o->per_source_penalty.penalty_refuseconnection, + o->per_source_penalty.penalty_max, + o->per_source_penalty.penalty_min, + o->per_source_penalty.max_sources4, + o->per_source_penalty.max_sources6, + o->per_source_penalty.overflow_mode == + PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL ? + "deny-all" : "permissive", + o->per_source_penalty.overflow_mode6 == + PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL ? + "deny-all" : "permissive"); + } else + printf("persourcepenalties no\n"); } diff --git a/servconf.h b/servconf.h index ed7b72e..5089bc9 100644 --- a/servconf.h +++ b/servconf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: servconf.h,v 1.160 2023/09/06 23:35:35 djm Exp $ */ +/* $OpenBSD: servconf.h,v 1.168 2024/09/15 01:18:26 djm Exp $ */ /* * Author: Tatu Ylonen @@ -27,11 +27,6 @@ #define PERMIT_NO_PASSWD 2 #define PERMIT_YES 3 -/* use_privsep */ -#define PRIVSEP_OFF 0 -#define PRIVSEP_ON 1 -#define PRIVSEP_NOSANDBOX 2 - /* PermitOpen */ #define PERMITOPEN_ANY 0 #define PERMITOPEN_NONE -2 @@ -52,7 +47,6 @@ #define PUBKEYAUTH_VERIFY_REQUIRED (1<<1) struct ssh; -struct fwd_perm_list; /* * Used to store addresses from ListenAddr directives. These may be @@ -71,6 +65,23 @@ struct listenaddr { struct addrinfo *addrs; }; +#define PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL 1 +#define PER_SOURCE_PENALTY_OVERFLOW_PERMISSIVE 2 +struct per_source_penalty { + int enabled; + int max_sources4; + int max_sources6; + int overflow_mode; + int overflow_mode6; + int penalty_crash; + int penalty_grace; + int penalty_authfail; + int penalty_noauth; + int penalty_refuseconnection; + int penalty_max; + int penalty_min; +}; + typedef struct { u_int num_ports; u_int ports_from_cmdline; @@ -178,6 +189,8 @@ typedef struct { int per_source_max_startups; int per_source_masklen_ipv4; int per_source_masklen_ipv6; + char *per_source_penalty_exempt; + struct per_source_penalty per_source_penalty; int max_authtries; int max_sessions; char *banner; /* SSH-2 banner message */ @@ -198,6 +211,7 @@ typedef struct { char *adm_forced_command; int use_pam; /* Enable auth via PAM */ + char *pam_service_name; int permit_tun; @@ -233,11 +247,16 @@ typedef struct { u_int num_channel_timeouts; int unused_connection_timeout; + + char *sshd_session_path; + + int refuse_connection; } ServerOptions; /* Information about the incoming connection as used by Match */ struct connection_info { const char *user; + int user_invalid; const char *host; /* possibly resolved hostname */ const char *address; /* remote address */ const char *laddress; /* local address */ @@ -280,6 +299,7 @@ TAILQ_HEAD(include_list, include_item); M_CP_STROPT(ca_sign_algorithms); \ M_CP_STROPT(routing_domain); \ M_CP_STROPT(permit_user_env_allowlist); \ + M_CP_STROPT(pam_service_name); \ M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \ M_CP_STRARRAYOPT(allow_users, num_allow_users); \ M_CP_STRARRAYOPT(deny_users, num_deny_users); \ @@ -297,20 +317,16 @@ TAILQ_HEAD(include_list, include_item); M_CP_STRARRAYOPT(subsystem_args, num_subsystems); \ } while (0) -struct connection_info *get_connection_info(struct ssh *, int, int); void initialize_server_options(ServerOptions *); void fill_default_server_options(ServerOptions *); int process_server_config_line(ServerOptions *, char *, const char *, int, int *, struct connection_info *, struct include_list *includes); -void process_permitopen(struct ssh *ssh, ServerOptions *options); -void process_channel_timeouts(struct ssh *ssh, ServerOptions *); void load_server_config(const char *, struct sshbuf *); void parse_server_config(ServerOptions *, const char *, struct sshbuf *, struct include_list *includes, struct connection_info *, int); void parse_server_match_config(ServerOptions *, struct include_list *includes, struct connection_info *); int parse_server_match_testspec(struct connection_info *, char *); -int server_match_spec_complete(struct connection_info *); void servconf_merge_subsystems(ServerOptions *, ServerOptions *); void copy_set_server_options(ServerOptions *, ServerOptions *, int); void dump_config(ServerOptions *); diff --git a/serverloop.c b/serverloop.c index f3683c2..757cc6f 100644 --- a/serverloop.c +++ b/serverloop.c @@ -1,4 +1,4 @@ -/* $OpenBSD: serverloop.c,v 1.237 2023/08/21 04:59:54 djm Exp $ */ +/* $OpenBSD: serverloop.c,v 1.240 2024/06/17 08:28:31 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -86,44 +86,23 @@ extern ServerOptions options; /* XXX */ extern Authctxt *the_authctxt; extern struct sshauthopt *auth_opts; -extern int use_privsep; static int no_more_sessions = 0; /* Disallow further sessions. */ static volatile sig_atomic_t child_terminated = 0; /* The child has terminated. */ -/* Cleanup on signals (!use_privsep case only) */ -static volatile sig_atomic_t received_sigterm = 0; - /* prototypes */ static void server_init_dispatch(struct ssh *); /* requested tunnel forwarding interface(s), shared with session.c */ char *tun_fwd_ifnames = NULL; -/* returns 1 if bind to specified port by specified user is permitted */ -static int -bind_permitted(int port, uid_t uid) -{ - if (use_privsep) - return 1; /* allow system to decide */ - if (port < IPPORT_RESERVED && uid != 0) - return 0; - return 1; -} - static void sigchld_handler(int sig) { child_terminated = 1; } -static void -sigterm_handler(int sig) -{ - received_sigterm = sig; -} - static void client_alive_check(struct ssh *ssh) { @@ -287,11 +266,11 @@ process_input(struct ssh *ssh, int connection_in) if (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK) return 0; if (errno == EPIPE) { - verbose("Connection closed by %.100s port %d", + logit("Connection closed by %.100s port %d", ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); return -1; } - verbose("Read error from remote host %s port %d: %s", + logit("Read error from remote host %s port %d: %s", ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), strerror(errno)); cleanup_exit(255); @@ -354,12 +333,6 @@ server_loop2(struct ssh *ssh, Authctxt *authctxt) connection_in = ssh_packet_get_connection_in(ssh); connection_out = ssh_packet_get_connection_out(ssh); - if (!use_privsep) { - ssh_signal(SIGTERM, sigterm_handler); - ssh_signal(SIGINT, sigterm_handler); - ssh_signal(SIGQUIT, sigterm_handler); - } - server_init_dispatch(ssh); for (;;) { @@ -380,15 +353,9 @@ server_loop2(struct ssh *ssh, Authctxt *authctxt) wait_until_can_do_something(ssh, connection_in, connection_out, &pfd, &npfd_alloc, &npfd_active, &osigset, &conn_in_ready, &conn_out_ready); - if (sigprocmask(SIG_UNBLOCK, &bsigset, &osigset) == -1) + if (sigprocmask(SIG_SETMASK, &osigset, NULL) == -1) error_f("osigset sigprocmask: %s", strerror(errno)); - if (received_sigterm) { - logit("Exiting on signal %d", (int)received_sigterm); - /* Clean up sessions, utmp, etc. */ - cleanup_exit(255); - } - channel_after_poll(ssh, pfd, npfd_active); if (conn_in_ready && process_input(ssh, connection_in) < 0) @@ -498,7 +465,7 @@ server_request_direct_streamlocal(struct ssh *ssh) /* XXX fine grained permissions */ if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 && auth_opts->permit_port_forwarding_flag && - !options.disable_forwarding && (pw->pw_uid == 0 || use_privsep)) { + !options.disable_forwarding) { c = channel_connect_to_path(ssh, target, "direct-streamlocal@openssh.com", "direct-streamlocal"); } else { @@ -792,9 +759,7 @@ server_input_global_request(int type, u_int32_t seq, struct ssh *ssh) (options.allow_tcp_forwarding & FORWARD_REMOTE) == 0 || !auth_opts->permit_port_forwarding_flag || options.disable_forwarding || - (!want_reply && fwd.listen_port == 0) || - (fwd.listen_port != 0 && - !bind_permitted(fwd.listen_port, pw->pw_uid))) { + (!want_reply && fwd.listen_port == 0)) { success = 0; ssh_packet_send_debug(ssh, "Server has disabled port forwarding."); } else { @@ -827,8 +792,7 @@ server_input_global_request(int type, u_int32_t seq, struct ssh *ssh) /* check permissions */ if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0 || !auth_opts->permit_port_forwarding_flag || - options.disable_forwarding || - (pw->pw_uid != 0 && !use_privsep)) { + options.disable_forwarding) { success = 0; ssh_packet_send_debug(ssh, "Server has disabled " "streamlocal forwarding."); diff --git a/session.c b/session.c index c821dcd..c941511 100644 --- a/session.c +++ b/session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: session.c,v 1.337 2024/02/01 02:37:33 djm Exp $ */ +/* $OpenBSD: session.c,v 1.338 2024/05/17 00:30:24 djm Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -103,6 +103,17 @@ #include #endif +/* + * Hack for systems that do not support FD passing: allocate PTYs directly + * without calling into the monitor. This requires either the post-auth + * privsep process retain root privileges (see the comment in + * sshd-session.c:privsep_postauth) or that PTY allocation doesn't require + * privileges to begin with (e.g. Cygwin). + */ +#ifdef DISABLE_FD_PASSING +#define mm_pty_allocate pty_allocate +#endif + #define IS_INTERNAL_SFTP(c) \ (!strncmp(c, INTERNAL_SFTP_NAME, sizeof(INTERNAL_SFTP_NAME) - 1) && \ (c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\0' || \ @@ -706,13 +717,13 @@ do_exec(struct ssh *ssh, Session *s, const char *command) #ifdef SSH_AUDIT_EVENTS if (command != NULL) - PRIVSEP(audit_run_command(command)); + mm_audit_run_command(command); else if (s->ttyfd == -1) { char *shell = s->pw->pw_shell; if (shell[0] == '\0') /* empty shell means /bin/sh */ shell =_PATH_BSHELL; - PRIVSEP(audit_run_command(shell)); + mm_audit_run_command(shell); } #endif if (s->ttyfd != -1) @@ -738,8 +749,6 @@ do_login(struct ssh *ssh, Session *s, const char *command) { socklen_t fromlen; struct sockaddr_storage from; - struct passwd * pw = s->pw; - pid_t pid = getpid(); /* * Get IP address of client. If the connection is not a socket, let @@ -755,26 +764,6 @@ do_login(struct ssh *ssh, Session *s, const char *command) } } - /* Record that there was a login on that tty from the remote host. */ - if (!use_privsep) - record_login(pid, s->tty, pw->pw_name, pw->pw_uid, - session_get_remote_name_or_ip(ssh, utmp_len, - options.use_dns), - (struct sockaddr *)&from, fromlen); - -#ifdef USE_PAM - /* - * If password change is needed, do it now. - * This needs to occur before the ~/.hushlogin check. - */ - if (options.use_pam && !use_privsep && s->authctxt->force_pwchange) { - display_loginmsg(); - do_pam_chauthtok(); - s->authctxt->force_pwchange = 0; - /* XXX - signal [net] parent to enable forwardings */ - } -#endif - if (check_quietlogin(s, command)) return; @@ -1924,8 +1913,7 @@ session_pty_req(struct ssh *ssh, Session *s) /* Allocate a pty and open it. */ debug("Allocating pty."); - if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, - sizeof(s->tty)))) { + if (!mm_pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty))) { free(s->term); s->term = NULL; s->ptyfd = -1; @@ -1940,9 +1928,6 @@ session_pty_req(struct ssh *ssh, Session *s) if ((r = sshpkt_get_end(ssh)) != 0) sshpkt_fatal(ssh, r, "%s: parse packet", __func__); - if (!use_privsep) - pty_setowner(s->pw, s->tty); - /* Set window size from the packet. */ pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel); @@ -2160,7 +2145,7 @@ session_signal_req(struct ssh *ssh, Session *s) signame, s->forced ? "forced-command" : "subsystem"); goto out; } - if (!use_privsep || mm_is_monitor()) { + if (mm_is_monitor()) { error_f("session signalling requires privilege separation"); goto out; } @@ -2303,7 +2288,7 @@ session_pty_cleanup2(Session *s) void session_pty_cleanup(Session *s) { - PRIVSEP(session_pty_cleanup2(s)); + mm_session_pty_cleanup2(s); } static char * @@ -2712,7 +2697,7 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt) * Cleanup ptys/utmp only if privsep is disabled, * or if running in monitor. */ - if (!use_privsep || mm_is_monitor()) + if (mm_is_monitor()) session_destroy_all(ssh, session_pty_cleanup2); } diff --git a/sftp-client.c b/sftp-client.c index 5cc8bb5..be40d20 100644 --- a/sftp-client.c +++ b/sftp-client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sftp-client.c,v 1.175 2023/11/13 09:18:19 tobhe Exp $ */ +/* $OpenBSD: sftp-client.c,v 1.176 2024/05/17 02:39:11 jsg Exp $ */ /* * Copyright (c) 2001-2004 Damien Miller * @@ -2440,7 +2440,7 @@ handle_dest_replies(struct sftp_conn *to, const char *to_path, int synchronous, * server not to have reordered replies that could have * inserted holes where none existed in the source file. * - * XXX we could get a more accutate progress bar if we updated + * XXX we could get a more accurate progress bar if we updated * the counter based on the reply from the destination... */ (*nreqsp)--; diff --git a/sftp-server.c b/sftp-server.c index 0466a0f..a4abb9f 100644 --- a/sftp-server.c +++ b/sftp-server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sftp-server.c,v 1.147 2023/04/12 08:53:54 jsg Exp $ */ +/* $OpenBSD: sftp-server.c,v 1.148 2024/04/30 06:23:51 djm Exp $ */ /* * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. * @@ -1706,14 +1706,16 @@ process_extended_home_directory(u_int32_t id) fatal_fr(r, "parse"); debug3("request %u: home-directory \"%s\"", id, username); - if ((user_pw = getpwnam(username)) == NULL) { + if (username[0] == '\0') { + user_pw = pw; + } else if ((user_pw = getpwnam(username)) == NULL) { send_status(id, SSH2_FX_FAILURE); goto out; } - verbose("home-directory \"%s\"", pw->pw_dir); + verbose("home-directory \"%s\"", user_pw->pw_dir); attrib_clear(&s.attrib); - s.name = s.long_name = pw->pw_dir; + s.name = s.long_name = user_pw->pw_dir; send_names(id, 1, &s); out: free(username); diff --git a/sftp.c b/sftp.c index 76ba4de..360c500 100644 --- a/sftp.c +++ b/sftp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sftp.c,v 1.237 2024/02/01 02:37:33 djm Exp $ */ +/* $OpenBSD: sftp.c,v 1.239 2024/06/26 23:14:14 deraadt Exp $ */ /* * Copyright (c) 2001-2004 Damien Miller * @@ -234,12 +234,14 @@ killchild(int signo) static void suspchild(int signo) { + int save_errno = errno; if (sshpid > 1) { kill(sshpid, signo); while (waitpid(sshpid, NULL, WUNTRACED) == -1 && errno == EINTR) continue; } kill(getpid(), SIGSTOP); + errno = save_errno; } static void @@ -2301,8 +2303,10 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2) break; } if (el == NULL) { - if (interactive) + if (interactive) { printf("sftp> "); + fflush(stdout); + } if (fgets(cmd, sizeof(cmd), infile) == NULL) { if (interactive) printf("\n"); diff --git a/sntrup761.c b/sntrup761.c index 57368bd..123d013 100644 --- a/sntrup761.c +++ b/sntrup761.c @@ -1,4 +1,5 @@ -/* $OpenBSD: sntrup761.c,v 1.6 2023/01/11 02:13:52 djm Exp $ */ + +/* $OpenBSD: sntrup761.c,v 1.8 2024/09/16 05:37:05 djm Exp $ */ /* * Public Domain, Authors: @@ -15,6 +16,8 @@ #include #include "crypto_api.h" +#define crypto_declassify(x, y) do {} while (0) + #define int8 crypto_int8 #define uint8 crypto_uint8 #define int16 crypto_int16 @@ -23,1251 +26,2134 @@ #define uint32 crypto_uint32 #define int64 crypto_int64 #define uint64 crypto_uint64 +extern volatile crypto_int16 crypto_int16_optblocker; +extern volatile crypto_int32 crypto_int32_optblocker; +extern volatile crypto_int64 crypto_int64_optblocker; -/* from supercop-20201130/crypto_sort/int32/portable4/int32_minmax.inc */ -#define int32_MINMAX(a,b) \ -do { \ - int64_t ab = (int64_t)b ^ (int64_t)a; \ - int64_t c = (int64_t)b - (int64_t)a; \ - c ^= ab & (c ^ b); \ - c >>= 31; \ - c &= ab; \ - a ^= c; \ - b ^= c; \ -} while(0) - -/* from supercop-20201130/crypto_sort/int32/portable4/sort.c */ - +/* from supercop-20240808/cryptoint/crypto_int16.h */ +/* auto-generated: cd cryptoint; ./autogen */ +/* cryptoint 20240806 */ -static void crypto_sort_int32(void *array,long long n) -{ - long long top,p,q,r,i,j; - int32 *x = array; +#ifndef crypto_int16_h +#define crypto_int16_h - if (n < 2) return; - top = 1; - while (top < n - top) top += top; +#define crypto_int16 int16_t +#define crypto_int16_unsigned uint16_t - for (p = top;p >= 1;p >>= 1) { - i = 0; - while (i + 2 * p <= n) { - for (j = i;j < i + p;++j) - int32_MINMAX(x[j],x[j+p]); - i += 2 * p; - } - for (j = i;j < n - p;++j) - int32_MINMAX(x[j],x[j+p]); - i = 0; - j = 0; - for (q = top;q > p;q >>= 1) { - if (j != i) for (;;) { - if (j == n - q) goto done; - int32 a = x[j + p]; - for (r = q;r > p;r >>= 1) - int32_MINMAX(a,x[j + r]); - x[j + p] = a; - ++j; - if (j == i + p) { - i += 2 * p; - break; - } - } - while (i + p <= n - q) { - for (j = i;j < i + p;++j) { - int32 a = x[j + p]; - for (r = q;r > p;r >>= 1) - int32_MINMAX(a,x[j+r]); - x[j + p] = a; - } - i += 2 * p; - } - /* now i + p > n - q */ - j = i; - while (j < n - q) { - int32 a = x[j + p]; - for (r = q;r > p;r >>= 1) - int32_MINMAX(a,x[j+r]); - x[j + p] = a; - ++j; - } - done: ; - } - } +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_load(const unsigned char *crypto_int16_s) { + crypto_int16 crypto_int16_z = 0; + crypto_int16_z |= ((crypto_int16) (*crypto_int16_s++)) << 0; + crypto_int16_z |= ((crypto_int16) (*crypto_int16_s++)) << 8; + return crypto_int16_z; } -/* from supercop-20201130/crypto_sort/uint32/useint32/sort.c */ - -/* can save time by vectorizing xor loops */ -/* can save time by integrating xor loops with int32_sort */ - -static void crypto_sort_uint32(void *array,long long n) -{ - crypto_uint32 *x = array; - long long j; - for (j = 0;j < n;++j) x[j] ^= 0x80000000; - crypto_sort_int32(array,n); - for (j = 0;j < n;++j) x[j] ^= 0x80000000; +__attribute__((unused)) +static inline +void crypto_int16_store(unsigned char *crypto_int16_s,crypto_int16 crypto_int16_x) { + *crypto_int16_s++ = crypto_int16_x >> 0; + *crypto_int16_s++ = crypto_int16_x >> 8; } -/* from supercop-20201130/crypto_kem/sntrup761/ref/uint32.c */ - -/* -CPU division instruction typically takes time depending on x. -This software is designed to take time independent of x. -Time still varies depending on m; user must ensure that m is constant. -Time also varies on CPUs where multiplication is variable-time. -There could be more CPU issues. -There could also be compiler issues. -*/ - -static void uint32_divmod_uint14(uint32 *q,uint16 *r,uint32 x,uint16 m) -{ - uint32 v = 0x80000000; - uint32 qpart; - uint32 mask; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarw $15,%0" : "+r"(crypto_int16_x) : : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_y; + __asm__ ("sbfx %w0,%w1,15,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); + return crypto_int16_y; +#else + crypto_int16_x >>= 16-6; + crypto_int16_x ^= crypto_int16_optblocker; + crypto_int16_x >>= 5; + return crypto_int16_x; +#endif +} - v /= m; +__attribute__((unused)) +static inline +crypto_int16_unsigned crypto_int16_unsigned_topbit_01(crypto_int16_unsigned crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("shrw $15,%0" : "+r"(crypto_int16_x) : : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_y; + __asm__ ("ubfx %w0,%w1,15,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); + return crypto_int16_y; +#else + crypto_int16_x >>= 16-6; + crypto_int16_x ^= crypto_int16_optblocker; + crypto_int16_x >>= 5; + return crypto_int16_x; +#endif +} - /* caller guarantees m > 0 */ - /* caller guarantees m < 16384 */ - /* vm <= 2^31 <= vm+m-1 */ - /* xvm <= 2^31 x <= xvm+x(m-1) */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_negative_01(crypto_int16 crypto_int16_x) { + return crypto_int16_unsigned_topbit_01(crypto_int16_x); +} - *q = 0; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_topbit_mask(crypto_int16 crypto_int16_x) { + return crypto_int16_negative_mask(crypto_int16_x); +} - qpart = (x*(uint64)v)>>31; - /* 2^31 qpart <= xv <= 2^31 qpart + 2^31-1 */ - /* 2^31 qpart m <= xvm <= 2^31 qpart m + (2^31-1)m */ - /* 2^31 qpart m <= 2^31 x <= 2^31 qpart m + (2^31-1)m + x(m-1) */ - /* 0 <= 2^31 newx <= (2^31-1)m + x(m-1) */ - /* 0 <= newx <= (1-1/2^31)m + x(m-1)/2^31 */ - /* 0 <= newx <= (1-1/2^31)(2^14-1) + (2^32-1)((2^14-1)-1)/2^31 */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_topbit_01(crypto_int16 crypto_int16_x) { + return crypto_int16_unsigned_topbit_01(crypto_int16_x); +} - x -= qpart*m; *q += qpart; - /* x <= 49146 */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bottombit_mask(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andw $1,%0" : "+r"(crypto_int16_x) : : "cc"); + return -crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_y; + __asm__ ("sbfx %w0,%w1,0,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); + return crypto_int16_y; +#else + crypto_int16_x &= 1 ^ crypto_int16_optblocker; + return -crypto_int16_x; +#endif +} - qpart = (x*(uint64)v)>>31; - /* 0 <= newx <= (1-1/2^31)m + x(m-1)/2^31 */ - /* 0 <= newx <= m + 49146(2^14-1)/2^31 */ - /* 0 <= newx <= m + 0.4 */ - /* 0 <= newx <= m */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bottombit_01(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andw $1,%0" : "+r"(crypto_int16_x) : : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_y; + __asm__ ("ubfx %w0,%w1,0,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); + return crypto_int16_y; +#else + crypto_int16_x &= 1 ^ crypto_int16_optblocker; + return crypto_int16_x; +#endif +} - x -= qpart*m; *q += qpart; - /* x <= m */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bitinrangepublicpos_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarw %%cl,%0" : "+r"(crypto_int16_x) : "c"(crypto_int16_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("sxth %w0,%w0\n asr %w0,%w0,%w1" : "+&r"(crypto_int16_x) : "r"(crypto_int16_s) : ); +#else + crypto_int16_x >>= crypto_int16_s ^ crypto_int16_optblocker; +#endif + return crypto_int16_bottombit_mask(crypto_int16_x); +} - x -= m; *q += 1; - mask = -(x>>31); - x += mask&(uint32)m; *q += mask; - /* x < m */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bitinrangepublicpos_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarw %%cl,%0" : "+r"(crypto_int16_x) : "c"(crypto_int16_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("sxth %w0,%w0\n asr %w0,%w0,%w1" : "+&r"(crypto_int16_x) : "r"(crypto_int16_s) : ); +#else + crypto_int16_x >>= crypto_int16_s ^ crypto_int16_optblocker; +#endif + return crypto_int16_bottombit_01(crypto_int16_x); +} - *r = x; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_shlmod(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16_s &= 15; + __asm__ ("shlw %%cl,%0" : "+r"(crypto_int16_x) : "c"(crypto_int16_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("and %w0,%w0,15\n and %w1,%w1,65535\n lsl %w1,%w1,%w0" : "+&r"(crypto_int16_s), "+r"(crypto_int16_x) : : ); +#else + int crypto_int16_k, crypto_int16_l; + for (crypto_int16_l = 0,crypto_int16_k = 1;crypto_int16_k < 16;++crypto_int16_l,crypto_int16_k *= 2) + crypto_int16_x ^= (crypto_int16_x ^ (crypto_int16_x << crypto_int16_k)) & crypto_int16_bitinrangepublicpos_mask(crypto_int16_s,crypto_int16_l); +#endif + return crypto_int16_x; } +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_shrmod(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16_s &= 15; + __asm__ ("sarw %%cl,%0" : "+r"(crypto_int16_x) : "c"(crypto_int16_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("and %w0,%w0,15\n sxth %w1,%w1\n asr %w1,%w1,%w0" : "+&r"(crypto_int16_s), "+r"(crypto_int16_x) : : ); +#else + int crypto_int16_k, crypto_int16_l; + for (crypto_int16_l = 0,crypto_int16_k = 1;crypto_int16_k < 16;++crypto_int16_l,crypto_int16_k *= 2) + crypto_int16_x ^= (crypto_int16_x ^ (crypto_int16_x >> crypto_int16_k)) & crypto_int16_bitinrangepublicpos_mask(crypto_int16_s,crypto_int16_l); +#endif + return crypto_int16_x; +} + +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bitmod_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { + crypto_int16_x = crypto_int16_shrmod(crypto_int16_x,crypto_int16_s); + return crypto_int16_bottombit_mask(crypto_int16_x); +} + +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_bitmod_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_s) { + crypto_int16_x = crypto_int16_shrmod(crypto_int16_x,crypto_int16_s); + return crypto_int16_bottombit_01(crypto_int16_x); +} + +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("tst %w1,65535\n csetm %w0,ne" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + crypto_int16_x |= -crypto_int16_x; + return crypto_int16_negative_mask(crypto_int16_x); +#endif +} -static uint16 uint32_mod_uint14(uint32 x,uint16 m) -{ - uint32 q; - uint16 r; - uint32_divmod_uint14(&q,&r,x,m); - return r; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_nonzero_01(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n testw %2,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("tst %w1,65535\n cset %w0,ne" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + crypto_int16_x |= -crypto_int16_x; + return crypto_int16_unsigned_topbit_01(crypto_int16_x); +#endif } -/* from supercop-20201130/crypto_kem/sntrup761/ref/int32.c */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_positive_mask(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovgw %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,0\n csetm %w0,gt" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + crypto_int16 crypto_int16_z = -crypto_int16_x; + crypto_int16_z ^= crypto_int16_x & crypto_int16_z; + return crypto_int16_negative_mask(crypto_int16_z); +#endif +} -static void int32_divmod_uint14(int32 *q,uint16 *r,int32 x,uint16 m) -{ - uint32 uq,uq2; - uint16 ur,ur2; - uint32 mask; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_positive_01(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n testw %2,%2\n cmovgw %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,0\n cset %w0,gt" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + crypto_int16 crypto_int16_z = -crypto_int16_x; + crypto_int16_z ^= crypto_int16_x & crypto_int16_z; + return crypto_int16_unsigned_topbit_01(crypto_int16_z); +#endif +} - uint32_divmod_uint14(&uq,&ur,0x80000000+(uint32)x,m); - uint32_divmod_uint14(&uq2,&ur2,0x80000000,m); - ur -= ur2; uq -= uq2; - mask = -(uint32)(ur>>15); - ur += mask&m; uq += mask; - *r = ur; *q = uq; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_zero_mask(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("tst %w1,65535\n csetm %w0,eq" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + return ~crypto_int16_nonzero_mask(crypto_int16_x); +#endif } +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_zero_01(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n testw %2,%2\n cmovew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("tst %w1,65535\n cset %w0,eq" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); + return crypto_int16_z; +#else + return 1-crypto_int16_nonzero_01(crypto_int16_x); +#endif +} -static uint16 int32_mod_uint14(int32 x,uint16 m) -{ - int32 q; - uint16 r; - int32_divmod_uint14(&q,&r,x,m); - return r; +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_unequal_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n cmpw %3,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("and %w0,%w1,65535\n cmp %w0,%w2,uxth\n csetm %w0,ne" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#else + return crypto_int16_nonzero_mask(crypto_int16_x ^ crypto_int16_y); +#endif } -/* from supercop-20201130/crypto_kem/sntrup761/ref/paramsmenu.h */ -/* pick one of these three: */ -#define SIZE761 -#undef SIZE653 -#undef SIZE857 +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_unequal_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n cmpw %3,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("and %w0,%w1,65535\n cmp %w0,%w2,uxth\n cset %w0,ne" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#else + return crypto_int16_nonzero_01(crypto_int16_x ^ crypto_int16_y); +#endif +} -/* pick one of these two: */ -#define SNTRUP /* Streamlined NTRU Prime */ -#undef LPR /* NTRU LPRime */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_equal_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n cmpw %3,%2\n cmovew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("and %w0,%w1,65535\n cmp %w0,%w2,uxth\n csetm %w0,eq" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#else + return ~crypto_int16_unequal_mask(crypto_int16_x,crypto_int16_y); +#endif +} -/* from supercop-20201130/crypto_kem/sntrup761/ref/params.h */ -#ifndef params_H -#define params_H +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_equal_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n cmpw %3,%2\n cmovew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("and %w0,%w1,65535\n cmp %w0,%w2,uxth\n cset %w0,eq" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#else + return 1-crypto_int16_unequal_01(crypto_int16_x,crypto_int16_y); +#endif +} -/* menu of parameter choices: */ +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_min(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpw %1,%0\n cmovgw %1,%0" : "+r"(crypto_int16_x) : "r"(crypto_int16_y) : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("sxth %w0,%w0\n cmp %w0,%w1,sxth\n csel %w0,%w0,%w1,lt" : "+&r"(crypto_int16_x) : "r"(crypto_int16_y) : "cc"); + return crypto_int16_x; +#else + crypto_int16 crypto_int16_r = crypto_int16_y ^ crypto_int16_x; + crypto_int16 crypto_int16_z = crypto_int16_y - crypto_int16_x; + crypto_int16_z ^= crypto_int16_r & (crypto_int16_z ^ crypto_int16_y); + crypto_int16_z = crypto_int16_negative_mask(crypto_int16_z); + crypto_int16_z &= crypto_int16_r; + return crypto_int16_x ^ crypto_int16_z; +#endif +} +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_max(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpw %1,%0\n cmovlw %1,%0" : "+r"(crypto_int16_x) : "r"(crypto_int16_y) : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("sxth %w0,%w0\n cmp %w0,%w1,sxth\n csel %w0,%w1,%w0,lt" : "+&r"(crypto_int16_x) : "r"(crypto_int16_y) : "cc"); + return crypto_int16_x; +#else + crypto_int16 crypto_int16_r = crypto_int16_y ^ crypto_int16_x; + crypto_int16 crypto_int16_z = crypto_int16_y - crypto_int16_x; + crypto_int16_z ^= crypto_int16_r & (crypto_int16_z ^ crypto_int16_y); + crypto_int16_z = crypto_int16_negative_mask(crypto_int16_z); + crypto_int16_z &= crypto_int16_r; + return crypto_int16_y ^ crypto_int16_z; +#endif +} -/* what the menu means: */ +__attribute__((unused)) +static inline +void crypto_int16_minmax(crypto_int16 *crypto_int16_p,crypto_int16 *crypto_int16_q) { + crypto_int16 crypto_int16_x = *crypto_int16_p; + crypto_int16 crypto_int16_y = *crypto_int16_q; +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_z; + __asm__ ("cmpw %2,%1\n movw %1,%0\n cmovgw %2,%1\n cmovgw %0,%2" : "=&r"(crypto_int16_z), "+&r"(crypto_int16_x), "+r"(crypto_int16_y) : : "cc"); + *crypto_int16_p = crypto_int16_x; + *crypto_int16_q = crypto_int16_y; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_r, crypto_int16_s; + __asm__ ("sxth %w0,%w0\n cmp %w0,%w3,sxth\n csel %w1,%w0,%w3,lt\n csel %w2,%w3,%w0,lt" : "+&r"(crypto_int16_x), "=&r"(crypto_int16_r), "=r"(crypto_int16_s) : "r"(crypto_int16_y) : "cc"); + *crypto_int16_p = crypto_int16_r; + *crypto_int16_q = crypto_int16_s; +#else + crypto_int16 crypto_int16_r = crypto_int16_y ^ crypto_int16_x; + crypto_int16 crypto_int16_z = crypto_int16_y - crypto_int16_x; + crypto_int16_z ^= crypto_int16_r & (crypto_int16_z ^ crypto_int16_y); + crypto_int16_z = crypto_int16_negative_mask(crypto_int16_z); + crypto_int16_z &= crypto_int16_r; + crypto_int16_x ^= crypto_int16_z; + crypto_int16_y ^= crypto_int16_z; + *crypto_int16_p = crypto_int16_x; + *crypto_int16_q = crypto_int16_y; +#endif +} -#if defined(SIZE761) -#define p 761 -#define q 4591 -#define Rounded_bytes 1007 -#ifndef LPR -#define Rq_bytes 1158 -#define w 286 +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_smaller_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n cmpw %3,%2\n cmovlw %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,%w2,sxth\n csetm %w0,lt" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; #else -#define w 250 -#define tau0 2156 -#define tau1 114 -#define tau2 2007 -#define tau3 287 + crypto_int16 crypto_int16_r = crypto_int16_x ^ crypto_int16_y; + crypto_int16 crypto_int16_z = crypto_int16_x - crypto_int16_y; + crypto_int16_z ^= crypto_int16_r & (crypto_int16_z ^ crypto_int16_x); + return crypto_int16_negative_mask(crypto_int16_z); #endif +} -#elif defined(SIZE653) -#define p 653 -#define q 4621 -#define Rounded_bytes 865 -#ifndef LPR -#define Rq_bytes 994 -#define w 288 +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_smaller_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n cmpw %3,%2\n cmovlw %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,%w2,sxth\n cset %w0,lt" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; #else -#define w 252 -#define tau0 2175 -#define tau1 113 -#define tau2 2031 -#define tau3 290 + crypto_int16 crypto_int16_r = crypto_int16_x ^ crypto_int16_y; + crypto_int16 crypto_int16_z = crypto_int16_x - crypto_int16_y; + crypto_int16_z ^= crypto_int16_r & (crypto_int16_z ^ crypto_int16_x); + return crypto_int16_unsigned_topbit_01(crypto_int16_z); #endif +} -#elif defined(SIZE857) -#define p 857 -#define q 5167 -#define Rounded_bytes 1152 -#ifndef LPR -#define Rq_bytes 1322 -#define w 322 +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_leq_mask(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $-1,%1\n cmpw %3,%2\n cmovlew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,%w2,sxth\n csetm %w0,le" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; #else -#define w 281 -#define tau0 2433 -#define tau1 101 -#define tau2 2265 -#define tau3 324 + return ~crypto_int16_smaller_mask(crypto_int16_y,crypto_int16_x); #endif +} +__attribute__((unused)) +static inline +crypto_int16 crypto_int16_leq_01(crypto_int16 crypto_int16_x,crypto_int16 crypto_int16_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 crypto_int16_q,crypto_int16_z; + __asm__ ("xorw %0,%0\n movw $1,%1\n cmpw %3,%2\n cmovlew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int16 crypto_int16_z; + __asm__ ("sxth %w0,%w1\n cmp %w0,%w2,sxth\n cset %w0,le" : "=&r"(crypto_int16_z) : "r"(crypto_int16_x), "r"(crypto_int16_y) : "cc"); + return crypto_int16_z; #else -#error "no parameter set defined" + return 1-crypto_int16_smaller_01(crypto_int16_y,crypto_int16_x); #endif +} -#ifdef LPR -#define I 256 +__attribute__((unused)) +static inline +int crypto_int16_ones_num(crypto_int16 crypto_int16_x) { + crypto_int16_unsigned crypto_int16_y = crypto_int16_x; + const crypto_int16 C0 = 0x5555; + const crypto_int16 C1 = 0x3333; + const crypto_int16 C2 = 0x0f0f; + crypto_int16_y -= ((crypto_int16_y >> 1) & C0); + crypto_int16_y = (crypto_int16_y & C1) + ((crypto_int16_y >> 2) & C1); + crypto_int16_y = (crypto_int16_y + (crypto_int16_y >> 4)) & C2; + crypto_int16_y = (crypto_int16_y + (crypto_int16_y >> 8)) & 0xff; + return crypto_int16_y; +} + +__attribute__((unused)) +static inline +int crypto_int16_bottomzeros_num(crypto_int16 crypto_int16_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int16 fallback = 16; + __asm__ ("bsfw %0,%0\n cmovew %1,%0" : "+&r"(crypto_int16_x) : "r"(fallback) : "cc"); + return crypto_int16_x; +#elif defined(__GNUC__) && defined(__aarch64__) + int64_t crypto_int16_y; + __asm__ ("orr %w0,%w1,-65536\n rbit %w0,%w0\n clz %w0,%w0" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); + return crypto_int16_y; +#else + crypto_int16 crypto_int16_y = crypto_int16_x ^ (crypto_int16_x-1); + crypto_int16_y = ((crypto_int16) crypto_int16_y) >> 1; + crypto_int16_y &= ~(crypto_int16_x & (((crypto_int16) 1) << (16-1))); + return crypto_int16_ones_num(crypto_int16_y); #endif +} #endif -/* from supercop-20201130/crypto_kem/sntrup761/ref/Decode.h */ -#ifndef Decode_H -#define Decode_H +/* from supercop-20240808/cryptoint/crypto_int32.h */ +/* auto-generated: cd cryptoint; ./autogen */ +/* cryptoint 20240806 */ +#ifndef crypto_int32_h +#define crypto_int32_h -/* Decode(R,s,M,len) */ -/* assumes 0 < M[i] < 16384 */ -/* produces 0 <= R[i] < M[i] */ +#define crypto_int32 int32_t +#define crypto_int32_unsigned uint32_t -#endif -/* from supercop-20201130/crypto_kem/sntrup761/ref/Decode.c */ -static void Decode(uint16 *out,const unsigned char *S,const uint16 *M,long long len) -{ - if (len == 1) { - if (M[0] == 1) - *out = 0; - else if (M[0] <= 256) - *out = uint32_mod_uint14(S[0],M[0]); - else - *out = uint32_mod_uint14(S[0]+(((uint16)S[1])<<8),M[0]); - } - if (len > 1) { - uint16 R2[(len+1)/2]; - uint16 M2[(len+1)/2]; - uint16 bottomr[len/2]; - uint32 bottomt[len/2]; - long long i; - for (i = 0;i < len-1;i += 2) { - uint32 m = M[i]*(uint32) M[i+1]; - if (m > 256*16383) { - bottomt[i/2] = 256*256; - bottomr[i/2] = S[0]+256*S[1]; - S += 2; - M2[i/2] = (((m+255)>>8)+255)>>8; - } else if (m >= 16384) { - bottomt[i/2] = 256; - bottomr[i/2] = S[0]; - S += 1; - M2[i/2] = (m+255)>>8; - } else { - bottomt[i/2] = 1; - bottomr[i/2] = 0; - M2[i/2] = m; - } - } - if (i < len) - M2[i/2] = M[i]; - Decode(R2,S,M2,(len+1)/2); - for (i = 0;i < len-1;i += 2) { - uint32 r = bottomr[i/2]; - uint32 r1; - uint16 r0; - r += bottomt[i/2]*R2[i/2]; - uint32_divmod_uint14(&r1,&r0,r,M[i]); - r1 = uint32_mod_uint14(r1,M[i+1]); /* only needed for invalid inputs */ - *out++ = r0; - *out++ = r1; - } - if (i < len) - *out++ = R2[i/2]; - } +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_load(const unsigned char *crypto_int32_s) { + crypto_int32 crypto_int32_z = 0; + crypto_int32_z |= ((crypto_int32) (*crypto_int32_s++)) << 0; + crypto_int32_z |= ((crypto_int32) (*crypto_int32_s++)) << 8; + crypto_int32_z |= ((crypto_int32) (*crypto_int32_s++)) << 16; + crypto_int32_z |= ((crypto_int32) (*crypto_int32_s++)) << 24; + return crypto_int32_z; } -/* from supercop-20201130/crypto_kem/sntrup761/ref/Encode.h */ -#ifndef Encode_H -#define Encode_H - - -/* Encode(s,R,M,len) */ -/* assumes 0 <= R[i] < M[i] < 16384 */ +__attribute__((unused)) +static inline +void crypto_int32_store(unsigned char *crypto_int32_s,crypto_int32 crypto_int32_x) { + *crypto_int32_s++ = crypto_int32_x >> 0; + *crypto_int32_s++ = crypto_int32_x >> 8; + *crypto_int32_s++ = crypto_int32_x >> 16; + *crypto_int32_s++ = crypto_int32_x >> 24; +} +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarl $31,%0" : "+r"(crypto_int32_x) : : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_y; + __asm__ ("asr %w0,%w1,31" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); + return crypto_int32_y; +#else + crypto_int32_x >>= 32-6; + crypto_int32_x ^= crypto_int32_optblocker; + crypto_int32_x >>= 5; + return crypto_int32_x; #endif - -/* from supercop-20201130/crypto_kem/sntrup761/ref/Encode.c */ - -/* 0 <= R[i] < M[i] < 16384 */ -static void Encode(unsigned char *out,const uint16 *R,const uint16 *M,long long len) -{ - if (len == 1) { - uint16 r = R[0]; - uint16 m = M[0]; - while (m > 1) { - *out++ = r; - r >>= 8; - m = (m+255)>>8; - } - } - if (len > 1) { - uint16 R2[(len+1)/2]; - uint16 M2[(len+1)/2]; - long long i; - for (i = 0;i < len-1;i += 2) { - uint32 m0 = M[i]; - uint32 r = R[i]+R[i+1]*m0; - uint32 m = M[i+1]*m0; - while (m >= 16384) { - *out++ = r; - r >>= 8; - m = (m+255)>>8; - } - R2[i/2] = r; - M2[i/2] = m; - } - if (i < len) { - R2[i/2] = R[i]; - M2[i/2] = M[i]; - } - Encode(out,R2,M2,(len+1)/2); - } } -/* from supercop-20201130/crypto_kem/sntrup761/ref/kem.c */ - -#ifdef LPR +__attribute__((unused)) +static inline +crypto_int32_unsigned crypto_int32_unsigned_topbit_01(crypto_int32_unsigned crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("shrl $31,%0" : "+r"(crypto_int32_x) : : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_y; + __asm__ ("lsr %w0,%w1,31" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); + return crypto_int32_y; +#else + crypto_int32_x >>= 32-6; + crypto_int32_x ^= crypto_int32_optblocker; + crypto_int32_x >>= 5; + return crypto_int32_x; #endif +} +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_negative_01(crypto_int32 crypto_int32_x) { + return crypto_int32_unsigned_topbit_01(crypto_int32_x); +} -/* ----- masks */ - -#ifndef LPR +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_topbit_mask(crypto_int32 crypto_int32_x) { + return crypto_int32_negative_mask(crypto_int32_x); +} -/* return -1 if x!=0; else return 0 */ -static int int16_nonzero_mask(int16 x) -{ - uint16 u = x; /* 0, else 1...65535 */ - uint32 v = u; /* 0, else 1...65535 */ - v = -v; /* 0, else 2^32-65535...2^32-1 */ - v >>= 31; /* 0, else 1 */ - return -v; /* 0, else -1 */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_topbit_01(crypto_int32 crypto_int32_x) { + return crypto_int32_unsigned_topbit_01(crypto_int32_x); } +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bottombit_mask(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andl $1,%0" : "+r"(crypto_int32_x) : : "cc"); + return -crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_y; + __asm__ ("sbfx %w0,%w1,0,1" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); + return crypto_int32_y; +#else + crypto_int32_x &= 1 ^ crypto_int32_optblocker; + return -crypto_int32_x; #endif - -/* return -1 if x<0; otherwise return 0 */ -static int int16_negative_mask(int16 x) -{ - uint16 u = x; - u >>= 15; - return -(int) u; - /* alternative with gcc -fwrapv: */ - /* x>>15 compiles to CPU's arithmetic right shift */ } -/* ----- arithmetic mod 3 */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bottombit_01(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andl $1,%0" : "+r"(crypto_int32_x) : : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_y; + __asm__ ("ubfx %w0,%w1,0,1" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); + return crypto_int32_y; +#else + crypto_int32_x &= 1 ^ crypto_int32_optblocker; + return crypto_int32_x; +#endif +} -typedef int8 small; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bitinrangepublicpos_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarl %%cl,%0" : "+r"(crypto_int32_x) : "c"(crypto_int32_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %w0,%w0,%w1" : "+r"(crypto_int32_x) : "r"(crypto_int32_s) : ); +#else + crypto_int32_x >>= crypto_int32_s ^ crypto_int32_optblocker; +#endif + return crypto_int32_bottombit_mask(crypto_int32_x); +} -/* F3 is always represented as -1,0,1 */ -/* so ZZ_fromF3 is a no-op */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bitinrangepublicpos_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarl %%cl,%0" : "+r"(crypto_int32_x) : "c"(crypto_int32_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %w0,%w0,%w1" : "+r"(crypto_int32_x) : "r"(crypto_int32_s) : ); +#else + crypto_int32_x >>= crypto_int32_s ^ crypto_int32_optblocker; +#endif + return crypto_int32_bottombit_01(crypto_int32_x); +} -/* x must not be close to top int16 */ -static small F3_freeze(int16 x) -{ - return int32_mod_uint14(x+1,3)-1; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_shlmod(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("shll %%cl,%0" : "+r"(crypto_int32_x) : "c"(crypto_int32_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("lsl %w0,%w0,%w1" : "+r"(crypto_int32_x) : "r"(crypto_int32_s) : ); +#else + int crypto_int32_k, crypto_int32_l; + for (crypto_int32_l = 0,crypto_int32_k = 1;crypto_int32_k < 32;++crypto_int32_l,crypto_int32_k *= 2) + crypto_int32_x ^= (crypto_int32_x ^ (crypto_int32_x << crypto_int32_k)) & crypto_int32_bitinrangepublicpos_mask(crypto_int32_s,crypto_int32_l); +#endif + return crypto_int32_x; } -/* ----- arithmetic mod q */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_shrmod(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarl %%cl,%0" : "+r"(crypto_int32_x) : "c"(crypto_int32_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %w0,%w0,%w1" : "+r"(crypto_int32_x) : "r"(crypto_int32_s) : ); +#else + int crypto_int32_k, crypto_int32_l; + for (crypto_int32_l = 0,crypto_int32_k = 1;crypto_int32_k < 32;++crypto_int32_l,crypto_int32_k *= 2) + crypto_int32_x ^= (crypto_int32_x ^ (crypto_int32_x >> crypto_int32_k)) & crypto_int32_bitinrangepublicpos_mask(crypto_int32_s,crypto_int32_l); +#endif + return crypto_int32_x; +} + +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bitmod_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { + crypto_int32_x = crypto_int32_shrmod(crypto_int32_x,crypto_int32_s); + return crypto_int32_bottombit_mask(crypto_int32_x); +} + +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_bitmod_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_s) { + crypto_int32_x = crypto_int32_shrmod(crypto_int32_x,crypto_int32_s); + return crypto_int32_bottombit_01(crypto_int32_x); +} + +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_nonzero_mask(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n testl %2,%2\n cmovnel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n csetm %w0,ne" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + crypto_int32_x |= -crypto_int32_x; + return crypto_int32_negative_mask(crypto_int32_x); +#endif +} -#define q12 ((q-1)/2) -typedef int16 Fq; -/* always represented as -q12...q12 */ -/* so ZZ_fromFq is a no-op */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_nonzero_01(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n testl %2,%2\n cmovnel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n cset %w0,ne" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + crypto_int32_x |= -crypto_int32_x; + return crypto_int32_unsigned_topbit_01(crypto_int32_x); +#endif +} -/* x must not be close to top int32 */ -static Fq Fq_freeze(int32 x) -{ - return int32_mod_uint14(x+q12,q)-q12; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_positive_mask(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n testl %2,%2\n cmovgl %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n csetm %w0,gt" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + crypto_int32 crypto_int32_z = -crypto_int32_x; + crypto_int32_z ^= crypto_int32_x & crypto_int32_z; + return crypto_int32_negative_mask(crypto_int32_z); +#endif } -#ifndef LPR +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_positive_01(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n testl %2,%2\n cmovgl %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n cset %w0,gt" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + crypto_int32 crypto_int32_z = -crypto_int32_x; + crypto_int32_z ^= crypto_int32_x & crypto_int32_z; + return crypto_int32_unsigned_topbit_01(crypto_int32_z); +#endif +} -static Fq Fq_recip(Fq a1) -{ - int i = 1; - Fq ai = a1; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_zero_mask(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n testl %2,%2\n cmovel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n csetm %w0,eq" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + return ~crypto_int32_nonzero_mask(crypto_int32_x); +#endif +} - while (i < q-2) { - ai = Fq_freeze(a1*(int32)ai); - i += 1; - } - return ai; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_zero_01(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n testl %2,%2\n cmovel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,0\n cset %w0,eq" : "=r"(crypto_int32_z) : "r"(crypto_int32_x) : "cc"); + return crypto_int32_z; +#else + return 1-crypto_int32_nonzero_01(crypto_int32_x); +#endif } +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_unequal_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n cmpl %3,%2\n cmovnel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n csetm %w0,ne" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return crypto_int32_nonzero_mask(crypto_int32_x ^ crypto_int32_y); #endif +} -/* ----- Top and Right */ +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_unequal_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n cmpl %3,%2\n cmovnel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n cset %w0,ne" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return crypto_int32_nonzero_01(crypto_int32_x ^ crypto_int32_y); +#endif +} -#ifdef LPR -#define tau 16 +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_equal_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n cmpl %3,%2\n cmovel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n csetm %w0,eq" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return ~crypto_int32_unequal_mask(crypto_int32_x,crypto_int32_y); +#endif +} -static int8 Top(Fq C) -{ - return (tau1*(int32)(C+tau0)+16384)>>15; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_equal_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n cmpl %3,%2\n cmovel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n cset %w0,eq" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return 1-crypto_int32_unequal_01(crypto_int32_x,crypto_int32_y); +#endif } -static Fq Right(int8 T) -{ - return Fq_freeze(tau3*(int32)T-tau2); +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpl %1,%0\n cmovgl %1,%0" : "+r"(crypto_int32_x) : "r"(crypto_int32_y) : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("cmp %w0,%w1\n csel %w0,%w0,%w1,lt" : "+r"(crypto_int32_x) : "r"(crypto_int32_y) : "cc"); + return crypto_int32_x; +#else + crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; + crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; + crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); + crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); + crypto_int32_z &= crypto_int32_r; + return crypto_int32_x ^ crypto_int32_z; +#endif } + +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_max(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpl %1,%0\n cmovll %1,%0" : "+r"(crypto_int32_x) : "r"(crypto_int32_y) : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("cmp %w0,%w1\n csel %w0,%w1,%w0,lt" : "+r"(crypto_int32_x) : "r"(crypto_int32_y) : "cc"); + return crypto_int32_x; +#else + crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; + crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; + crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); + crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); + crypto_int32_z &= crypto_int32_r; + return crypto_int32_y ^ crypto_int32_z; #endif +} -/* ----- small polynomials */ +__attribute__((unused)) +static inline +void crypto_int32_minmax(crypto_int32 *crypto_int32_p,crypto_int32 *crypto_int32_q) { + crypto_int32 crypto_int32_x = *crypto_int32_p; + crypto_int32 crypto_int32_y = *crypto_int32_q; +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmpl %2,%1\n movl %1,%0\n cmovgl %2,%1\n cmovgl %0,%2" : "=&r"(crypto_int32_z), "+&r"(crypto_int32_x), "+r"(crypto_int32_y) : : "cc"); + *crypto_int32_p = crypto_int32_x; + *crypto_int32_q = crypto_int32_y; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_r, crypto_int32_s; + __asm__ ("cmp %w2,%w3\n csel %w0,%w2,%w3,lt\n csel %w1,%w3,%w2,lt" : "=&r"(crypto_int32_r), "=r"(crypto_int32_s) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + *crypto_int32_p = crypto_int32_r; + *crypto_int32_q = crypto_int32_s; +#else + crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; + crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; + crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); + crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); + crypto_int32_z &= crypto_int32_r; + crypto_int32_x ^= crypto_int32_z; + crypto_int32_y ^= crypto_int32_z; + *crypto_int32_p = crypto_int32_x; + *crypto_int32_q = crypto_int32_y; +#endif +} -#ifndef LPR - -/* 0 if Weightw_is(r), else -1 */ -static int Weightw_mask(small *r) -{ - int weight = 0; - int i; - - for (i = 0;i < p;++i) weight += r[i]&1; - return int16_nonzero_mask(weight-w); +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_smaller_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n cmpl %3,%2\n cmovll %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n csetm %w0,lt" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + crypto_int32 crypto_int32_r = crypto_int32_x ^ crypto_int32_y; + crypto_int32 crypto_int32_z = crypto_int32_x - crypto_int32_y; + crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_x); + return crypto_int32_negative_mask(crypto_int32_z); +#endif } -/* R3_fromR(R_fromRq(r)) */ -static void R3_fromRq(small *out,const Fq *r) -{ - int i; - for (i = 0;i < p;++i) out[i] = F3_freeze(r[i]); +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_smaller_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n cmpl %3,%2\n cmovll %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n cset %w0,lt" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + crypto_int32 crypto_int32_r = crypto_int32_x ^ crypto_int32_y; + crypto_int32 crypto_int32_z = crypto_int32_x - crypto_int32_y; + crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_x); + return crypto_int32_unsigned_topbit_01(crypto_int32_z); +#endif } -/* h = f*g in the ring R3 */ -static void R3_mult(small *h,const small *f,const small *g) -{ - small fg[p+p-1]; - small result; - int i,j; - - for (i = 0;i < p;++i) { - result = 0; - for (j = 0;j <= i;++j) result = F3_freeze(result+f[j]*g[i-j]); - fg[i] = result; - } - for (i = p;i < p+p-1;++i) { - result = 0; - for (j = i-p+1;j < p;++j) result = F3_freeze(result+f[j]*g[i-j]); - fg[i] = result; - } - - for (i = p+p-2;i >= p;--i) { - fg[i-p] = F3_freeze(fg[i-p]+fg[i]); - fg[i-p+1] = F3_freeze(fg[i-p+1]+fg[i]); - } - - for (i = 0;i < p;++i) h[i] = fg[i]; +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_leq_mask(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $-1,%1\n cmpl %3,%2\n cmovlel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n csetm %w0,le" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return ~crypto_int32_smaller_mask(crypto_int32_y,crypto_int32_x); +#endif } -/* returns 0 if recip succeeded; else -1 */ -static int R3_recip(small *out,const small *in) -{ - small f[p+1],g[p+1],v[p+1],r[p+1]; - int i,loop,delta; - int sign,swap,t; - - for (i = 0;i < p+1;++i) v[i] = 0; - for (i = 0;i < p+1;++i) r[i] = 0; - r[0] = 1; - for (i = 0;i < p;++i) f[i] = 0; - f[0] = 1; f[p-1] = f[p] = -1; - for (i = 0;i < p;++i) g[p-1-i] = in[i]; - g[p] = 0; - - delta = 1; - - for (loop = 0;loop < 2*p-1;++loop) { - for (i = p;i > 0;--i) v[i] = v[i-1]; - v[0] = 0; - - sign = -g[0]*f[0]; - swap = int16_negative_mask(-delta) & int16_nonzero_mask(g[0]); - delta ^= swap&(delta^-delta); - delta += 1; - - for (i = 0;i < p+1;++i) { - t = swap&(f[i]^g[i]); f[i] ^= t; g[i] ^= t; - t = swap&(v[i]^r[i]); v[i] ^= t; r[i] ^= t; - } - - for (i = 0;i < p+1;++i) g[i] = F3_freeze(g[i]+sign*f[i]); - for (i = 0;i < p+1;++i) r[i] = F3_freeze(r[i]+sign*v[i]); - - for (i = 0;i < p;++i) g[i] = g[i+1]; - g[p] = 0; - } - - sign = f[0]; - for (i = 0;i < p;++i) out[i] = sign*v[p-1-i]; - - return int16_nonzero_mask(delta); +__attribute__((unused)) +static inline +crypto_int32 crypto_int32_leq_01(crypto_int32 crypto_int32_x,crypto_int32 crypto_int32_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 crypto_int32_q,crypto_int32_z; + __asm__ ("xorl %0,%0\n movl $1,%1\n cmpl %3,%2\n cmovlel %1,%0" : "=&r"(crypto_int32_z), "=&r"(crypto_int32_q) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int32 crypto_int32_z; + __asm__ ("cmp %w1,%w2\n cset %w0,le" : "=r"(crypto_int32_z) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); + return crypto_int32_z; +#else + return 1-crypto_int32_smaller_01(crypto_int32_y,crypto_int32_x); +#endif } +__attribute__((unused)) +static inline +int crypto_int32_ones_num(crypto_int32 crypto_int32_x) { + crypto_int32_unsigned crypto_int32_y = crypto_int32_x; + const crypto_int32 C0 = 0x55555555; + const crypto_int32 C1 = 0x33333333; + const crypto_int32 C2 = 0x0f0f0f0f; + crypto_int32_y -= ((crypto_int32_y >> 1) & C0); + crypto_int32_y = (crypto_int32_y & C1) + ((crypto_int32_y >> 2) & C1); + crypto_int32_y = (crypto_int32_y + (crypto_int32_y >> 4)) & C2; + crypto_int32_y += crypto_int32_y >> 8; + crypto_int32_y = (crypto_int32_y + (crypto_int32_y >> 16)) & 0xff; + return crypto_int32_y; +} + +__attribute__((unused)) +static inline +int crypto_int32_bottomzeros_num(crypto_int32 crypto_int32_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int32 fallback = 32; + __asm__ ("bsfl %0,%0\n cmovel %1,%0" : "+&r"(crypto_int32_x) : "r"(fallback) : "cc"); + return crypto_int32_x; +#elif defined(__GNUC__) && defined(__aarch64__) + int64_t crypto_int32_y; + __asm__ ("rbit %w0,%w1\n clz %w0,%w0" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); + return crypto_int32_y; +#else + crypto_int32 crypto_int32_y = crypto_int32_x ^ (crypto_int32_x-1); + crypto_int32_y = ((crypto_int32) crypto_int32_y) >> 1; + crypto_int32_y &= ~(crypto_int32_x & (((crypto_int32) 1) << (32-1))); + return crypto_int32_ones_num(crypto_int32_y); #endif - -/* ----- polynomials mod q */ - -/* h = f*g in the ring Rq */ -static void Rq_mult_small(Fq *h,const Fq *f,const small *g) -{ - Fq fg[p+p-1]; - Fq result; - int i,j; - - for (i = 0;i < p;++i) { - result = 0; - for (j = 0;j <= i;++j) result = Fq_freeze(result+f[j]*(int32)g[i-j]); - fg[i] = result; - } - for (i = p;i < p+p-1;++i) { - result = 0; - for (j = i-p+1;j < p;++j) result = Fq_freeze(result+f[j]*(int32)g[i-j]); - fg[i] = result; - } - - for (i = p+p-2;i >= p;--i) { - fg[i-p] = Fq_freeze(fg[i-p]+fg[i]); - fg[i-p+1] = Fq_freeze(fg[i-p+1]+fg[i]); - } - - for (i = 0;i < p;++i) h[i] = fg[i]; } -#ifndef LPR - -/* h = 3f in Rq */ -static void Rq_mult3(Fq *h,const Fq *f) -{ - int i; +#endif - for (i = 0;i < p;++i) h[i] = Fq_freeze(3*f[i]); +/* from supercop-20240808/cryptoint/crypto_int64.h */ +/* auto-generated: cd cryptoint; ./autogen */ +/* cryptoint 20240806 */ + +#ifndef crypto_int64_h +#define crypto_int64_h + +#define crypto_int64 int64_t +#define crypto_int64_unsigned uint64_t + + + +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_load(const unsigned char *crypto_int64_s) { + crypto_int64 crypto_int64_z = 0; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 0; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 8; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 16; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 24; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 32; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 40; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 48; + crypto_int64_z |= ((crypto_int64) (*crypto_int64_s++)) << 56; + return crypto_int64_z; +} + +__attribute__((unused)) +static inline +void crypto_int64_store(unsigned char *crypto_int64_s,crypto_int64 crypto_int64_x) { + *crypto_int64_s++ = crypto_int64_x >> 0; + *crypto_int64_s++ = crypto_int64_x >> 8; + *crypto_int64_s++ = crypto_int64_x >> 16; + *crypto_int64_s++ = crypto_int64_x >> 24; + *crypto_int64_s++ = crypto_int64_x >> 32; + *crypto_int64_s++ = crypto_int64_x >> 40; + *crypto_int64_s++ = crypto_int64_x >> 48; + *crypto_int64_s++ = crypto_int64_x >> 56; +} + +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_negative_mask(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarq $63,%0" : "+r"(crypto_int64_x) : : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_y; + __asm__ ("asr %0,%1,63" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); + return crypto_int64_y; +#else + crypto_int64_x >>= 64-6; + crypto_int64_x ^= crypto_int64_optblocker; + crypto_int64_x >>= 5; + return crypto_int64_x; +#endif } -/* out = 1/(3*in) in Rq */ -/* returns 0 if recip succeeded; else -1 */ -static int Rq_recip3(Fq *out,const small *in) -{ - Fq f[p+1],g[p+1],v[p+1],r[p+1]; - int i,loop,delta; - int swap,t; - int32 f0,g0; - Fq scale; - - for (i = 0;i < p+1;++i) v[i] = 0; - for (i = 0;i < p+1;++i) r[i] = 0; - r[0] = Fq_recip(3); - for (i = 0;i < p;++i) f[i] = 0; - f[0] = 1; f[p-1] = f[p] = -1; - for (i = 0;i < p;++i) g[p-1-i] = in[i]; - g[p] = 0; - - delta = 1; - - for (loop = 0;loop < 2*p-1;++loop) { - for (i = p;i > 0;--i) v[i] = v[i-1]; - v[0] = 0; - - swap = int16_negative_mask(-delta) & int16_nonzero_mask(g[0]); - delta ^= swap&(delta^-delta); - delta += 1; - - for (i = 0;i < p+1;++i) { - t = swap&(f[i]^g[i]); f[i] ^= t; g[i] ^= t; - t = swap&(v[i]^r[i]); v[i] ^= t; r[i] ^= t; - } - - f0 = f[0]; - g0 = g[0]; - for (i = 0;i < p+1;++i) g[i] = Fq_freeze(f0*g[i]-g0*f[i]); - for (i = 0;i < p+1;++i) r[i] = Fq_freeze(f0*r[i]-g0*v[i]); +__attribute__((unused)) +static inline +crypto_int64_unsigned crypto_int64_unsigned_topbit_01(crypto_int64_unsigned crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("shrq $63,%0" : "+r"(crypto_int64_x) : : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_y; + __asm__ ("lsr %0,%1,63" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); + return crypto_int64_y; +#else + crypto_int64_x >>= 64-6; + crypto_int64_x ^= crypto_int64_optblocker; + crypto_int64_x >>= 5; + return crypto_int64_x; +#endif +} - for (i = 0;i < p;++i) g[i] = g[i+1]; - g[p] = 0; - } +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_negative_01(crypto_int64 crypto_int64_x) { + return crypto_int64_unsigned_topbit_01(crypto_int64_x); +} - scale = Fq_recip(f[0]); - for (i = 0;i < p;++i) out[i] = Fq_freeze(scale*(int32)v[p-1-i]); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_topbit_mask(crypto_int64 crypto_int64_x) { + return crypto_int64_negative_mask(crypto_int64_x); +} - return int16_nonzero_mask(delta); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_topbit_01(crypto_int64 crypto_int64_x) { + return crypto_int64_unsigned_topbit_01(crypto_int64_x); } +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bottombit_mask(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andq $1,%0" : "+r"(crypto_int64_x) : : "cc"); + return -crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_y; + __asm__ ("sbfx %0,%1,0,1" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); + return crypto_int64_y; +#else + crypto_int64_x &= 1 ^ crypto_int64_optblocker; + return -crypto_int64_x; #endif - -/* ----- rounded polynomials mod q */ - -static void Round(Fq *out,const Fq *a) -{ - int i; - for (i = 0;i < p;++i) out[i] = a[i]-F3_freeze(a[i]); } -/* ----- sorting to generate short polynomial */ - -static void Short_fromlist(small *out,const uint32 *in) -{ - uint32 L[p]; - int i; - - for (i = 0;i < w;++i) L[i] = in[i]&(uint32)-2; - for (i = w;i < p;++i) L[i] = (in[i]&(uint32)-3)|1; - crypto_sort_uint32(L,p); - for (i = 0;i < p;++i) out[i] = (L[i]&3)-1; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bottombit_01(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("andq $1,%0" : "+r"(crypto_int64_x) : : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_y; + __asm__ ("ubfx %0,%1,0,1" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); + return crypto_int64_y; +#else + crypto_int64_x &= 1 ^ crypto_int64_optblocker; + return crypto_int64_x; +#endif } -/* ----- underlying hash function */ - -#define Hash_bytes 32 - -/* e.g., b = 0 means out = Hash0(in) */ -static void Hash_prefix(unsigned char *out,int b,const unsigned char *in,int inlen) -{ - unsigned char x[inlen+1]; - unsigned char h[64]; - int i; - - x[0] = b; - for (i = 0;i < inlen;++i) x[i+1] = in[i]; - crypto_hash_sha512(h,x,inlen+1); - for (i = 0;i < 32;++i) out[i] = h[i]; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bitinrangepublicpos_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); +#else + crypto_int64_x >>= crypto_int64_s ^ crypto_int64_optblocker; +#endif + return crypto_int64_bottombit_mask(crypto_int64_x); } -/* ----- higher-level randomness */ - -static uint32 urandom32(void) -{ - unsigned char c[4]; - uint32 out[4]; - - randombytes(c,4); - out[0] = (uint32)c[0]; - out[1] = ((uint32)c[1])<<8; - out[2] = ((uint32)c[2])<<16; - out[3] = ((uint32)c[3])<<24; - return out[0]+out[1]+out[2]+out[3]; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bitinrangepublicpos_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); +#else + crypto_int64_x >>= crypto_int64_s ^ crypto_int64_optblocker; +#endif + return crypto_int64_bottombit_01(crypto_int64_x); } -static void Short_random(small *out) -{ - uint32 L[p]; - int i; - - for (i = 0;i < p;++i) L[i] = urandom32(); - Short_fromlist(out,L); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_shlmod(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("shlq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("lsl %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); +#else + int crypto_int64_k, crypto_int64_l; + for (crypto_int64_l = 0,crypto_int64_k = 1;crypto_int64_k < 64;++crypto_int64_l,crypto_int64_k *= 2) + crypto_int64_x ^= (crypto_int64_x ^ (crypto_int64_x << crypto_int64_k)) & crypto_int64_bitinrangepublicpos_mask(crypto_int64_s,crypto_int64_l); +#endif + return crypto_int64_x; } -#ifndef LPR - -static void Small_random(small *out) -{ - int i; - - for (i = 0;i < p;++i) out[i] = (((urandom32()&0x3fffffff)*3)>>30)-1; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_shrmod(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); +#else + int crypto_int64_k, crypto_int64_l; + for (crypto_int64_l = 0,crypto_int64_k = 1;crypto_int64_k < 64;++crypto_int64_l,crypto_int64_k *= 2) + crypto_int64_x ^= (crypto_int64_x ^ (crypto_int64_x >> crypto_int64_k)) & crypto_int64_bitinrangepublicpos_mask(crypto_int64_s,crypto_int64_l); +#endif + return crypto_int64_x; +} + +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bitmod_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { + crypto_int64_x = crypto_int64_shrmod(crypto_int64_x,crypto_int64_s); + return crypto_int64_bottombit_mask(crypto_int64_x); +} + +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_bitmod_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { + crypto_int64_x = crypto_int64_shrmod(crypto_int64_x,crypto_int64_s); + return crypto_int64_bottombit_01(crypto_int64_x); +} + +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_nonzero_mask(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n testq %2,%2\n cmovneq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n csetm %0,ne" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + crypto_int64_x |= -crypto_int64_x; + return crypto_int64_negative_mask(crypto_int64_x); +#endif } +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_nonzero_01(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n testq %2,%2\n cmovneq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n cset %0,ne" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + crypto_int64_x |= -crypto_int64_x; + return crypto_int64_unsigned_topbit_01(crypto_int64_x); #endif - -/* ----- Streamlined NTRU Prime Core */ - -#ifndef LPR - -/* h,(f,ginv) = KeyGen() */ -static void KeyGen(Fq *h,small *f,small *ginv) -{ - small g[p]; - Fq finv[p]; - - for (;;) { - Small_random(g); - if (R3_recip(ginv,g) == 0) break; - } - Short_random(f); - Rq_recip3(finv,f); /* always works */ - Rq_mult_small(h,finv,g); } -/* c = Encrypt(r,h) */ -static void Encrypt(Fq *c,const small *r,const Fq *h) -{ - Fq hr[p]; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_positive_mask(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n testq %2,%2\n cmovgq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n csetm %0,gt" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + crypto_int64 crypto_int64_z = -crypto_int64_x; + crypto_int64_z ^= crypto_int64_x & crypto_int64_z; + return crypto_int64_negative_mask(crypto_int64_z); +#endif +} - Rq_mult_small(hr,h,r); - Round(c,hr); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_positive_01(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n testq %2,%2\n cmovgq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n cset %0,gt" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + crypto_int64 crypto_int64_z = -crypto_int64_x; + crypto_int64_z ^= crypto_int64_x & crypto_int64_z; + return crypto_int64_unsigned_topbit_01(crypto_int64_z); +#endif } -/* r = Decrypt(c,(f,ginv)) */ -static void Decrypt(small *r,const Fq *c,const small *f,const small *ginv) -{ - Fq cf[p]; - Fq cf3[p]; - small e[p]; - small ev[p]; - int mask; - int i; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_zero_mask(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n testq %2,%2\n cmoveq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n csetm %0,eq" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + return ~crypto_int64_nonzero_mask(crypto_int64_x); +#endif +} - Rq_mult_small(cf,c,f); - Rq_mult3(cf3,cf); - R3_fromRq(e,cf3); - R3_mult(ev,e,ginv); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_zero_01(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n testq %2,%2\n cmoveq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,0\n cset %0,eq" : "=r"(crypto_int64_z) : "r"(crypto_int64_x) : "cc"); + return crypto_int64_z; +#else + return 1-crypto_int64_nonzero_01(crypto_int64_x); +#endif +} - mask = Weightw_mask(ev); /* 0 if weight w, else -1 */ - for (i = 0;i < w;++i) r[i] = ((ev[i]^1)&~mask)^1; - for (i = w;i < p;++i) r[i] = ev[i]&~mask; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_unequal_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n cmpq %3,%2\n cmovneq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n csetm %0,ne" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return crypto_int64_nonzero_mask(crypto_int64_x ^ crypto_int64_y); +#endif } +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_unequal_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n cmpq %3,%2\n cmovneq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n cset %0,ne" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return crypto_int64_nonzero_01(crypto_int64_x ^ crypto_int64_y); #endif +} -/* ----- NTRU LPRime Core */ +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_equal_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n cmpq %3,%2\n cmoveq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n csetm %0,eq" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return ~crypto_int64_unequal_mask(crypto_int64_x,crypto_int64_y); +#endif +} -#ifdef LPR +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_equal_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n cmpq %3,%2\n cmoveq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n cset %0,eq" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return 1-crypto_int64_unequal_01(crypto_int64_x,crypto_int64_y); +#endif +} -/* (G,A),a = KeyGen(G); leaves G unchanged */ -static void KeyGen(Fq *A,small *a,const Fq *G) -{ - Fq aG[p]; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_min(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpq %1,%0\n cmovgq %1,%0" : "+r"(crypto_int64_x) : "r"(crypto_int64_y) : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("cmp %0,%1\n csel %0,%0,%1,lt" : "+r"(crypto_int64_x) : "r"(crypto_int64_y) : "cc"); + return crypto_int64_x; +#else + crypto_int64 crypto_int64_r = crypto_int64_y ^ crypto_int64_x; + crypto_int64 crypto_int64_z = crypto_int64_y - crypto_int64_x; + crypto_int64_z ^= crypto_int64_r & (crypto_int64_z ^ crypto_int64_y); + crypto_int64_z = crypto_int64_negative_mask(crypto_int64_z); + crypto_int64_z &= crypto_int64_r; + return crypto_int64_x ^ crypto_int64_z; +#endif +} - Short_random(a); - Rq_mult_small(aG,G,a); - Round(A,aG); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_max(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + __asm__ ("cmpq %1,%0\n cmovlq %1,%0" : "+r"(crypto_int64_x) : "r"(crypto_int64_y) : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + __asm__ ("cmp %0,%1\n csel %0,%1,%0,lt" : "+r"(crypto_int64_x) : "r"(crypto_int64_y) : "cc"); + return crypto_int64_x; +#else + crypto_int64 crypto_int64_r = crypto_int64_y ^ crypto_int64_x; + crypto_int64 crypto_int64_z = crypto_int64_y - crypto_int64_x; + crypto_int64_z ^= crypto_int64_r & (crypto_int64_z ^ crypto_int64_y); + crypto_int64_z = crypto_int64_negative_mask(crypto_int64_z); + crypto_int64_z &= crypto_int64_r; + return crypto_int64_y ^ crypto_int64_z; +#endif } -/* B,T = Encrypt(r,(G,A),b) */ -static void Encrypt(Fq *B,int8 *T,const int8 *r,const Fq *G,const Fq *A,const small *b) -{ - Fq bG[p]; - Fq bA[p]; - int i; +__attribute__((unused)) +static inline +void crypto_int64_minmax(crypto_int64 *crypto_int64_p,crypto_int64 *crypto_int64_q) { + crypto_int64 crypto_int64_x = *crypto_int64_p; + crypto_int64 crypto_int64_y = *crypto_int64_q; +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmpq %2,%1\n movq %1,%0\n cmovgq %2,%1\n cmovgq %0,%2" : "=&r"(crypto_int64_z), "+&r"(crypto_int64_x), "+r"(crypto_int64_y) : : "cc"); + *crypto_int64_p = crypto_int64_x; + *crypto_int64_q = crypto_int64_y; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_r, crypto_int64_s; + __asm__ ("cmp %2,%3\n csel %0,%2,%3,lt\n csel %1,%3,%2,lt" : "=&r"(crypto_int64_r), "=r"(crypto_int64_s) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + *crypto_int64_p = crypto_int64_r; + *crypto_int64_q = crypto_int64_s; +#else + crypto_int64 crypto_int64_r = crypto_int64_y ^ crypto_int64_x; + crypto_int64 crypto_int64_z = crypto_int64_y - crypto_int64_x; + crypto_int64_z ^= crypto_int64_r & (crypto_int64_z ^ crypto_int64_y); + crypto_int64_z = crypto_int64_negative_mask(crypto_int64_z); + crypto_int64_z &= crypto_int64_r; + crypto_int64_x ^= crypto_int64_z; + crypto_int64_y ^= crypto_int64_z; + *crypto_int64_p = crypto_int64_x; + *crypto_int64_q = crypto_int64_y; +#endif +} - Rq_mult_small(bG,G,b); - Round(B,bG); - Rq_mult_small(bA,A,b); - for (i = 0;i < I;++i) T[i] = Top(Fq_freeze(bA[i]+r[i]*q12)); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_smaller_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n cmpq %3,%2\n cmovlq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n csetm %0,lt" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + crypto_int64 crypto_int64_r = crypto_int64_x ^ crypto_int64_y; + crypto_int64 crypto_int64_z = crypto_int64_x - crypto_int64_y; + crypto_int64_z ^= crypto_int64_r & (crypto_int64_z ^ crypto_int64_x); + return crypto_int64_negative_mask(crypto_int64_z); +#endif } -/* r = Decrypt((B,T),a) */ -static void Decrypt(int8 *r,const Fq *B,const int8 *T,const small *a) -{ - Fq aB[p]; - int i; +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_smaller_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n cmpq %3,%2\n cmovlq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n cset %0,lt" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + crypto_int64 crypto_int64_r = crypto_int64_x ^ crypto_int64_y; + crypto_int64 crypto_int64_z = crypto_int64_x - crypto_int64_y; + crypto_int64_z ^= crypto_int64_r & (crypto_int64_z ^ crypto_int64_x); + return crypto_int64_unsigned_topbit_01(crypto_int64_z); +#endif +} - Rq_mult_small(aB,B,a); - for (i = 0;i < I;++i) - r[i] = -int16_negative_mask(Fq_freeze(Right(T[i])-aB[i]+4*w+1)); +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_leq_mask(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $-1,%1\n cmpq %3,%2\n cmovleq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n csetm %0,le" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return ~crypto_int64_smaller_mask(crypto_int64_y,crypto_int64_x); +#endif } +__attribute__((unused)) +static inline +crypto_int64 crypto_int64_leq_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_y) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 crypto_int64_q,crypto_int64_z; + __asm__ ("xorq %0,%0\n movq $1,%1\n cmpq %3,%2\n cmovleq %1,%0" : "=&r"(crypto_int64_z), "=&r"(crypto_int64_q) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#elif defined(__GNUC__) && defined(__aarch64__) + crypto_int64 crypto_int64_z; + __asm__ ("cmp %1,%2\n cset %0,le" : "=r"(crypto_int64_z) : "r"(crypto_int64_x), "r"(crypto_int64_y) : "cc"); + return crypto_int64_z; +#else + return 1-crypto_int64_smaller_01(crypto_int64_y,crypto_int64_x); #endif +} -/* ----- encoding I-bit inputs */ +__attribute__((unused)) +static inline +int crypto_int64_ones_num(crypto_int64 crypto_int64_x) { + crypto_int64_unsigned crypto_int64_y = crypto_int64_x; + const crypto_int64 C0 = 0x5555555555555555; + const crypto_int64 C1 = 0x3333333333333333; + const crypto_int64 C2 = 0x0f0f0f0f0f0f0f0f; + crypto_int64_y -= ((crypto_int64_y >> 1) & C0); + crypto_int64_y = (crypto_int64_y & C1) + ((crypto_int64_y >> 2) & C1); + crypto_int64_y = (crypto_int64_y + (crypto_int64_y >> 4)) & C2; + crypto_int64_y += crypto_int64_y >> 8; + crypto_int64_y += crypto_int64_y >> 16; + crypto_int64_y = (crypto_int64_y + (crypto_int64_y >> 32)) & 0xff; + return crypto_int64_y; +} + +__attribute__((unused)) +static inline +int crypto_int64_bottomzeros_num(crypto_int64 crypto_int64_x) { +#if defined(__GNUC__) && defined(__x86_64__) + crypto_int64 fallback = 64; + __asm__ ("bsfq %0,%0\n cmoveq %1,%0" : "+&r"(crypto_int64_x) : "r"(fallback) : "cc"); + return crypto_int64_x; +#elif defined(__GNUC__) && defined(__aarch64__) + int64_t crypto_int64_y; + __asm__ ("rbit %0,%1\n clz %0,%0" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); + return crypto_int64_y; +#else + crypto_int64 crypto_int64_y = crypto_int64_x ^ (crypto_int64_x-1); + crypto_int64_y = ((crypto_int64) crypto_int64_y) >> 1; + crypto_int64_y &= ~(crypto_int64_x & (((crypto_int64) 1) << (64-1))); + return crypto_int64_ones_num(crypto_int64_y); +#endif +} -#ifdef LPR +#endif -#define Inputs_bytes (I/8) -typedef int8 Inputs[I]; /* passed by reference */ +/* from supercop-20240808/crypto_sort/int32/portable4/sort.c */ +#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) -static void Inputs_encode(unsigned char *s,const Inputs r) +static void crypto_sort_int32(void *array,long long n) { - int i; - for (i = 0;i < Inputs_bytes;++i) s[i] = 0; - for (i = 0;i < I;++i) s[i>>3] |= r[i]<<(i&7); -} - -#endif + long long top,p,q,r,i,j; + int32 *x = array; -/* ----- Expand */ + if (n < 2) return; + top = 1; + while (top < n - top) top += top; -#ifdef LPR + for (p = top;p >= 1;p >>= 1) { + i = 0; + while (i + 2 * p <= n) { + for (j = i;j < i + p;++j) + int32_MINMAX(x[j],x[j+p]); + i += 2 * p; + } + for (j = i;j < n - p;++j) + int32_MINMAX(x[j],x[j+p]); -static const unsigned char aes_nonce[16] = {0}; + i = 0; + j = 0; + for (q = top;q > p;q >>= 1) { + if (j != i) for (;;) { + if (j == n - q) goto done; + int32 a = x[j + p]; + for (r = q;r > p;r >>= 1) + int32_MINMAX(a,x[j + r]); + x[j + p] = a; + ++j; + if (j == i + p) { + i += 2 * p; + break; + } + } + while (i + p <= n - q) { + for (j = i;j < i + p;++j) { + int32 a = x[j + p]; + for (r = q;r > p;r >>= 1) + int32_MINMAX(a,x[j+r]); + x[j + p] = a; + } + i += 2 * p; + } + /* now i + p > n - q */ + j = i; + while (j < n - q) { + int32 a = x[j + p]; + for (r = q;r > p;r >>= 1) + int32_MINMAX(a,x[j+r]); + x[j + p] = a; + ++j; + } -static void Expand(uint32 *L,const unsigned char *k) -{ - int i; - crypto_stream_aes256ctr((unsigned char *) L,4*p,aes_nonce,k); - for (i = 0;i < p;++i) { - uint32 L0 = ((unsigned char *) L)[4*i]; - uint32 L1 = ((unsigned char *) L)[4*i+1]; - uint32 L2 = ((unsigned char *) L)[4*i+2]; - uint32 L3 = ((unsigned char *) L)[4*i+3]; - L[i] = L0+(L1<<8)+(L2<<16)+(L3<<24); + done: ; + } } } -#endif - -/* ----- Seeds */ +/* from supercop-20240808/crypto_sort/uint32/useint32/sort.c */ -#ifdef LPR - -#define Seeds_bytes 32 +/* can save time by vectorizing xor loops */ +/* can save time by integrating xor loops with int32_sort */ -static void Seeds_random(unsigned char *s) +static void crypto_sort_uint32(void *array,long long n) { - randombytes(s,Seeds_bytes); + crypto_uint32 *x = array; + long long j; + for (j = 0;j < n;++j) x[j] ^= 0x80000000; + crypto_sort_int32(array,n); + for (j = 0;j < n;++j) x[j] ^= 0x80000000; } -#endif - -/* ----- Generator, HashShort */ +/* from supercop-20240808/crypto_kem/sntrup761/compact/kem.c */ +// 20240806 djb: some automated conversion to cryptoint -#ifdef LPR - -/* G = Generator(k) */ -static void Generator(Fq *G,const unsigned char *k) -{ - uint32 L[p]; - int i; +#define p 761 +#define q 4591 +#define w 286 +#define q12 ((q - 1) / 2) +typedef int8_t small; +typedef int16_t Fq; +#define Hash_bytes 32 +#define Small_bytes ((p + 3) / 4) +typedef small Inputs[p]; +#define SecretKeys_bytes (2 * Small_bytes) +#define Confirm_bytes 32 - Expand(L,k); - for (i = 0;i < p;++i) G[i] = uint32_mod_uint14(L[i],q)-q12; +static small F3_freeze(int16_t x) { return x - 3 * ((10923 * x + 16384) >> 15); } + +static Fq Fq_freeze(int32_t x) { + const int32_t q16 = (0x10000 + q / 2) / q; + const int32_t q20 = (0x100000 + q / 2) / q; + const int32_t q28 = (0x10000000 + q / 2) / q; + x -= q * ((q16 * x) >> 16); + x -= q * ((q20 * x) >> 20); + return x - q * ((q28 * x + 0x8000000) >> 28); +} + +static int Weightw_mask(small *r) { + int i, weight = 0; + for (i = 0; i < p; ++i) weight += crypto_int64_bottombit_01(r[i]); + return crypto_int16_nonzero_mask(weight - w); +} + +static void uint32_divmod_uint14(uint32_t *Q, uint16_t *r, uint32_t x, uint16_t m) { + uint32_t qpart, mask, v = 0x80000000 / m; + qpart = (x * (uint64_t)v) >> 31; + x -= qpart * m; + *Q = qpart; + qpart = (x * (uint64_t)v) >> 31; + x -= qpart * m; + *Q += qpart; + x -= m; + *Q += 1; + mask = crypto_int32_negative_mask(x); + x += mask & (uint32_t)m; + *Q += mask; + *r = x; } -/* out = HashShort(r) */ -static void HashShort(small *out,const Inputs r) -{ - unsigned char s[Inputs_bytes]; - unsigned char h[Hash_bytes]; - uint32 L[p]; - - Inputs_encode(s,r); - Hash_prefix(h,5,s,sizeof s); - Expand(L,h); - Short_fromlist(out,L); +static uint16_t uint32_mod_uint14(uint32_t x, uint16_t m) { + uint32_t Q; + uint16_t r; + uint32_divmod_uint14(&Q, &r, x, m); + return r; } -#endif - -/* ----- NTRU LPRime Expand */ - -#ifdef LPR - -/* (S,A),a = XKeyGen() */ -static void XKeyGen(unsigned char *S,Fq *A,small *a) -{ - Fq G[p]; - - Seeds_random(S); - Generator(G,S); - KeyGen(A,a,G); +static void Encode(unsigned char *out, const uint16_t *R, const uint16_t *M, long long len) { + if (len == 1) { + uint16_t r = R[0], m = M[0]; + while (m > 1) { + *out++ = r; + r >>= 8; + m = (m + 255) >> 8; + } + } + if (len > 1) { + uint16_t R2[(len + 1) / 2], M2[(len + 1) / 2]; + long long i; + for (i = 0; i < len - 1; i += 2) { + uint32_t m0 = M[i]; + uint32_t r = R[i] + R[i + 1] * m0; + uint32_t m = M[i + 1] * m0; + while (m >= 16384) { + *out++ = r; + r >>= 8; + m = (m + 255) >> 8; + } + R2[i / 2] = r; + M2[i / 2] = m; + } + if (i < len) { + R2[i / 2] = R[i]; + M2[i / 2] = M[i]; + } + Encode(out, R2, M2, (len + 1) / 2); + } } -/* B,T = XEncrypt(r,(S,A)) */ -static void XEncrypt(Fq *B,int8 *T,const int8 *r,const unsigned char *S,const Fq *A) -{ - Fq G[p]; - small b[p]; - - Generator(G,S); - HashShort(b,r); - Encrypt(B,T,r,G,A,b); +static void Decode(uint16_t *out, const unsigned char *S, const uint16_t *M, long long len) { + if (len == 1) { + if (M[0] == 1) + *out = 0; + else if (M[0] <= 256) + *out = uint32_mod_uint14(S[0], M[0]); + else + *out = uint32_mod_uint14(S[0] + (((uint16_t)S[1]) << 8), M[0]); + } + if (len > 1) { + uint16_t R2[(len + 1) / 2], M2[(len + 1) / 2], bottomr[len / 2]; + uint32_t bottomt[len / 2]; + long long i; + for (i = 0; i < len - 1; i += 2) { + uint32_t m = M[i] * (uint32_t)M[i + 1]; + if (m > 256 * 16383) { + bottomt[i / 2] = 256 * 256; + bottomr[i / 2] = S[0] + 256 * S[1]; + S += 2; + M2[i / 2] = (((m + 255) >> 8) + 255) >> 8; + } else if (m >= 16384) { + bottomt[i / 2] = 256; + bottomr[i / 2] = S[0]; + S += 1; + M2[i / 2] = (m + 255) >> 8; + } else { + bottomt[i / 2] = 1; + bottomr[i / 2] = 0; + M2[i / 2] = m; + } + } + if (i < len) M2[i / 2] = M[i]; + Decode(R2, S, M2, (len + 1) / 2); + for (i = 0; i < len - 1; i += 2) { + uint32_t r1, r = bottomr[i / 2]; + uint16_t r0; + r += bottomt[i / 2] * R2[i / 2]; + uint32_divmod_uint14(&r1, &r0, r, M[i]); + r1 = uint32_mod_uint14(r1, M[i + 1]); + *out++ = r0; + *out++ = r1; + } + if (i < len) *out++ = R2[i / 2]; + } } -#define XDecrypt Decrypt - -#endif +static void R3_fromRq(small *out, const Fq *r) { + int i; + for (i = 0; i < p; ++i) out[i] = F3_freeze(r[i]); +} -/* ----- encoding small polynomials (including short polynomials) */ +static void R3_mult(small *h, const small *f, const small *g) { + int16_t fg[p + p - 1]; + int i, j; + for (i = 0; i < p + p - 1; ++i) fg[i] = 0; + for (i = 0; i < p; ++i) + for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int16_t)g[j]; + for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; + for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; + for (i = 0; i < p; ++i) h[i] = F3_freeze(fg[i]); +} -#define Small_bytes ((p+3)/4) +static int R3_recip(small *out, const small *in) { + small f[p + 1], g[p + 1], v[p + 1], r[p + 1]; + int sign, swap, t, i, loop, delta = 1; + for (i = 0; i < p + 1; ++i) v[i] = 0; + for (i = 0; i < p + 1; ++i) r[i] = 0; + r[0] = 1; + for (i = 0; i < p; ++i) f[i] = 0; + f[0] = 1; + f[p - 1] = f[p] = -1; + for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; + g[p] = 0; + for (loop = 0; loop < 2 * p - 1; ++loop) { + for (i = p; i > 0; --i) v[i] = v[i - 1]; + v[0] = 0; + sign = -g[0] * f[0]; + swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); + delta ^= swap & (delta ^ -delta); + delta += 1; + for (i = 0; i < p + 1; ++i) { + t = swap & (f[i] ^ g[i]); + f[i] ^= t; + g[i] ^= t; + t = swap & (v[i] ^ r[i]); + v[i] ^= t; + r[i] ^= t; + } + for (i = 0; i < p + 1; ++i) g[i] = F3_freeze(g[i] + sign * f[i]); + for (i = 0; i < p + 1; ++i) r[i] = F3_freeze(r[i] + sign * v[i]); + for (i = 0; i < p; ++i) g[i] = g[i + 1]; + g[p] = 0; + } + sign = f[0]; + for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; + return crypto_int16_nonzero_mask(delta); +} -/* these are the only functions that rely on p mod 4 = 1 */ +static void Rq_mult_small(Fq *h, const Fq *f, const small *g) { + int32_t fg[p + p - 1]; + int i, j; + for (i = 0; i < p + p - 1; ++i) fg[i] = 0; + for (i = 0; i < p; ++i) + for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int32_t)g[j]; + for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; + for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; + for (i = 0; i < p; ++i) h[i] = Fq_freeze(fg[i]); +} -static void Small_encode(unsigned char *s,const small *f) -{ - small x; +static void Rq_mult3(Fq *h, const Fq *f) { int i; + for (i = 0; i < p; ++i) h[i] = Fq_freeze(3 * f[i]); +} - for (i = 0;i < p/4;++i) { - x = *f++ + 1; - x += (*f++ + 1)<<2; - x += (*f++ + 1)<<4; - x += (*f++ + 1)<<6; - *s++ = x; +static Fq Fq_recip(Fq a1) { + int i = 1; + Fq ai = a1; + while (i < q - 2) { + ai = Fq_freeze(a1 * (int32_t)ai); + i += 1; } - x = *f++ + 1; - *s++ = x; + return ai; } -static void Small_decode(small *f,const unsigned char *s) -{ - unsigned char x; - int i; - - for (i = 0;i < p/4;++i) { - x = *s++; - *f++ = ((small)(x&3))-1; x >>= 2; - *f++ = ((small)(x&3))-1; x >>= 2; - *f++ = ((small)(x&3))-1; x >>= 2; - *f++ = ((small)(x&3))-1; +static int Rq_recip3(Fq *out, const small *in) { + Fq f[p + 1], g[p + 1], v[p + 1], r[p + 1], scale; + int swap, t, i, loop, delta = 1; + int32_t f0, g0; + for (i = 0; i < p + 1; ++i) v[i] = 0; + for (i = 0; i < p + 1; ++i) r[i] = 0; + r[0] = Fq_recip(3); + for (i = 0; i < p; ++i) f[i] = 0; + f[0] = 1; + f[p - 1] = f[p] = -1; + for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; + g[p] = 0; + for (loop = 0; loop < 2 * p - 1; ++loop) { + for (i = p; i > 0; --i) v[i] = v[i - 1]; + v[0] = 0; + swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); + delta ^= swap & (delta ^ -delta); + delta += 1; + for (i = 0; i < p + 1; ++i) { + t = swap & (f[i] ^ g[i]); + f[i] ^= t; + g[i] ^= t; + t = swap & (v[i] ^ r[i]); + v[i] ^= t; + r[i] ^= t; + } + f0 = f[0]; + g0 = g[0]; + for (i = 0; i < p + 1; ++i) g[i] = Fq_freeze(f0 * g[i] - g0 * f[i]); + for (i = 0; i < p + 1; ++i) r[i] = Fq_freeze(f0 * r[i] - g0 * v[i]); + for (i = 0; i < p; ++i) g[i] = g[i + 1]; + g[p] = 0; } - x = *s++; - *f++ = ((small)(x&3))-1; + scale = Fq_recip(f[0]); + for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); + return crypto_int16_nonzero_mask(delta); } -/* ----- encoding general polynomials */ - -#ifndef LPR - -static void Rq_encode(unsigned char *s,const Fq *r) -{ - uint16 R[p],M[p]; +static void Round(Fq *out, const Fq *a) { int i; - - for (i = 0;i < p;++i) R[i] = r[i]+q12; - for (i = 0;i < p;++i) M[i] = q; - Encode(s,R,M,p); + for (i = 0; i < p; ++i) out[i] = a[i] - F3_freeze(a[i]); } -static void Rq_decode(Fq *r,const unsigned char *s) -{ - uint16 R[p],M[p]; +static void Short_fromlist(small *out, const uint32_t *in) { + uint32_t L[p]; int i; - - for (i = 0;i < p;++i) M[i] = q; - Decode(R,s,M,p); - for (i = 0;i < p;++i) r[i] = ((Fq)R[i])-q12; + for (i = 0; i < w; ++i) L[i] = in[i] & (uint32_t)-2; + for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; + crypto_sort_uint32(L, p); + for (i = 0; i < p; ++i) out[i] = (L[i] & 3) - 1; } -#endif - -/* ----- encoding rounded polynomials */ - -static void Rounded_encode(unsigned char *s,const Fq *r) -{ - uint16 R[p],M[p]; +static void Hash_prefix(unsigned char *out, int b, const unsigned char *in, int inlen) { + unsigned char x[inlen + 1], h[64]; int i; - - for (i = 0;i < p;++i) R[i] = ((r[i]+q12)*10923)>>15; - for (i = 0;i < p;++i) M[i] = (q+2)/3; - Encode(s,R,M,p); + x[0] = b; + for (i = 0; i < inlen; ++i) x[i + 1] = in[i]; + crypto_hash_sha512(h, x, inlen + 1); + for (i = 0; i < 32; ++i) out[i] = h[i]; } -static void Rounded_decode(Fq *r,const unsigned char *s) -{ - uint16 R[p],M[p]; +static uint32_t urandom32(void) { + unsigned char c[4]; + uint32_t result = 0; int i; - - for (i = 0;i < p;++i) M[i] = (q+2)/3; - Decode(R,s,M,p); - for (i = 0;i < p;++i) r[i] = R[i]*3-q12; + randombytes(c, 4); + for (i = 0; i < 4; ++i) result += ((uint32_t)c[i]) << (8 * i); + return result; } -/* ----- encoding top polynomials */ - -#ifdef LPR - -#define Top_bytes (I/2) - -static void Top_encode(unsigned char *s,const int8 *T) -{ +static void Short_random(small *out) { + uint32_t L[p]; int i; - for (i = 0;i < Top_bytes;++i) - s[i] = T[2*i]+(T[2*i+1]<<4); + for (i = 0; i < p; ++i) L[i] = urandom32(); + Short_fromlist(out, L); } -static void Top_decode(int8 *T,const unsigned char *s) -{ +static void Small_random(small *out) { int i; - for (i = 0;i < Top_bytes;++i) { - T[2*i] = s[i]&15; - T[2*i+1] = s[i]>>4; - } + for (i = 0; i < p; ++i) out[i] = (((urandom32() & 0x3fffffff) * 3) >> 30) - 1; } -#endif - -/* ----- Streamlined NTRU Prime Core plus encoding */ - -#ifndef LPR - -typedef small Inputs[p]; /* passed by reference */ -#define Inputs_random Short_random -#define Inputs_encode Small_encode -#define Inputs_bytes Small_bytes - -#define Ciphertexts_bytes Rounded_bytes -#define SecretKeys_bytes (2*Small_bytes) -#define PublicKeys_bytes Rq_bytes - -/* pk,sk = ZKeyGen() */ -static void ZKeyGen(unsigned char *pk,unsigned char *sk) -{ - Fq h[p]; - small f[p],v[p]; - - KeyGen(h,f,v); - Rq_encode(pk,h); - Small_encode(sk,f); sk += Small_bytes; - Small_encode(sk,v); +static void KeyGen(Fq *h, small *f, small *ginv) { + small g[p]; + Fq finv[p]; + for (;;) { + int result; + Small_random(g); + result = R3_recip(ginv, g); + crypto_declassify(&result, sizeof result); + if (result == 0) break; + } + Short_random(f); + Rq_recip3(finv, f); + Rq_mult_small(h, finv, g); } -/* C = ZEncrypt(r,pk) */ -static void ZEncrypt(unsigned char *C,const Inputs r,const unsigned char *pk) -{ - Fq h[p]; - Fq c[p]; - Rq_decode(h,pk); - Encrypt(c,r,h); - Rounded_encode(C,c); +static void Encrypt(Fq *c, const small *r, const Fq *h) { + Fq hr[p]; + Rq_mult_small(hr, h, r); + Round(c, hr); +} + +static void Decrypt(small *r, const Fq *c, const small *f, const small *ginv) { + Fq cf[p], cf3[p]; + small e[p], ev[p]; + int mask, i; + Rq_mult_small(cf, c, f); + Rq_mult3(cf3, cf); + R3_fromRq(e, cf3); + R3_mult(ev, e, ginv); + mask = Weightw_mask(ev); + for (i = 0; i < w; ++i) r[i] = ((ev[i] ^ 1) & ~mask) ^ 1; + for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; +} + +static void Small_encode(unsigned char *s, const small *f) { + int i, j; + for (i = 0; i < p / 4; ++i) { + small x = 0; + for (j = 0;j < 4;++j) x += (*f++ + 1) << (2 * j); + *s++ = x; + } + *s = *f++ + 1; } -/* r = ZDecrypt(C,sk) */ -static void ZDecrypt(Inputs r,const unsigned char *C,const unsigned char *sk) -{ - small f[p],v[p]; - Fq c[p]; - - Small_decode(f,sk); sk += Small_bytes; - Small_decode(v,sk); - Rounded_decode(c,C); - Decrypt(r,c,f,v); +static void Small_decode(small *f, const unsigned char *s) { + int i, j; + for (i = 0; i < p / 4; ++i) { + unsigned char x = *s++; + for (j = 0;j < 4;++j) *f++ = ((small)((x >> (2 * j)) & 3)) - 1; + } + *f++ = ((small)(*s & 3)) - 1; } -#endif - -/* ----- NTRU LPRime Expand plus encoding */ - -#ifdef LPR - -#define Ciphertexts_bytes (Rounded_bytes+Top_bytes) -#define SecretKeys_bytes Small_bytes -#define PublicKeys_bytes (Seeds_bytes+Rounded_bytes) - -static void Inputs_random(Inputs r) -{ - unsigned char s[Inputs_bytes]; +static void Rq_encode(unsigned char *s, const Fq *r) { + uint16_t R[p], M[p]; int i; - - randombytes(s,sizeof s); - for (i = 0;i < I;++i) r[i] = 1&(s[i>>3]>>(i&7)); + for (i = 0; i < p; ++i) R[i] = r[i] + q12; + for (i = 0; i < p; ++i) M[i] = q; + Encode(s, R, M, p); } -/* pk,sk = ZKeyGen() */ -static void ZKeyGen(unsigned char *pk,unsigned char *sk) -{ - Fq A[p]; - small a[p]; - - XKeyGen(pk,A,a); pk += Seeds_bytes; - Rounded_encode(pk,A); - Small_encode(sk,a); -} - -/* c = ZEncrypt(r,pk) */ -static void ZEncrypt(unsigned char *c,const Inputs r,const unsigned char *pk) -{ - Fq A[p]; - Fq B[p]; - int8 T[I]; - - Rounded_decode(A,pk+Seeds_bytes); - XEncrypt(B,T,r,pk,A); - Rounded_encode(c,B); c += Rounded_bytes; - Top_encode(c,T); +static void Rq_decode(Fq *r, const unsigned char *s) { + uint16_t R[p], M[p]; + int i; + for (i = 0; i < p; ++i) M[i] = q; + Decode(R, s, M, p); + for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; } -/* r = ZDecrypt(C,sk) */ -static void ZDecrypt(Inputs r,const unsigned char *c,const unsigned char *sk) -{ - small a[p]; - Fq B[p]; - int8 T[I]; - - Small_decode(a,sk); - Rounded_decode(B,c); - Top_decode(T,c+Rounded_bytes); - XDecrypt(r,B,T,a); +static void Rounded_encode(unsigned char *s, const Fq *r) { + uint16_t R[p], M[p]; + int i; + for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; + for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; + Encode(s, R, M, p); } -#endif - -/* ----- confirmation hash */ - -#define Confirm_bytes 32 - -/* h = HashConfirm(r,pk,cache); cache is Hash4(pk) */ -static void HashConfirm(unsigned char *h,const unsigned char *r,const unsigned char *pk,const unsigned char *cache) -{ -#ifndef LPR - unsigned char x[Hash_bytes*2]; +static void Rounded_decode(Fq *r, const unsigned char *s) { + uint16_t R[p], M[p]; int i; + for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; + Decode(R, s, M, p); + for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; +} - Hash_prefix(x,3,r,Inputs_bytes); - for (i = 0;i < Hash_bytes;++i) x[Hash_bytes+i] = cache[i]; -#else - unsigned char x[Inputs_bytes+Hash_bytes]; - int i; +static void ZKeyGen(unsigned char *pk, unsigned char *sk) { + Fq h[p]; + small f[p], v[p]; + KeyGen(h, f, v); + Rq_encode(pk, h); + Small_encode(sk, f); + Small_encode(sk + Small_bytes, v); +} - for (i = 0;i < Inputs_bytes;++i) x[i] = r[i]; - for (i = 0;i < Hash_bytes;++i) x[Inputs_bytes+i] = cache[i]; -#endif - Hash_prefix(h,2,x,sizeof x); +static void ZEncrypt(unsigned char *C, const Inputs r, const unsigned char *pk) { + Fq h[p], c[p]; + Rq_decode(h, pk); + Encrypt(c, r, h); + Rounded_encode(C, c); } -/* ----- session-key hash */ +static void ZDecrypt(Inputs r, const unsigned char *C, const unsigned char *sk) { + small f[p], v[p]; + Fq c[p]; + Small_decode(f, sk); + Small_decode(v, sk + Small_bytes); + Rounded_decode(c, C); + Decrypt(r, c, f, v); +} -/* k = HashSession(b,y,z) */ -static void HashSession(unsigned char *k,int b,const unsigned char *y,const unsigned char *z) -{ -#ifndef LPR - unsigned char x[Hash_bytes+Ciphertexts_bytes+Confirm_bytes]; +static void HashConfirm(unsigned char *h, const unsigned char *r, const unsigned char *cache) { + unsigned char x[Hash_bytes * 2]; int i; + Hash_prefix(x, 3, r, Small_bytes); + for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; + Hash_prefix(h, 2, x, sizeof x); +} - Hash_prefix(x,3,y,Inputs_bytes); - for (i = 0;i < Ciphertexts_bytes+Confirm_bytes;++i) x[Hash_bytes+i] = z[i]; -#else - unsigned char x[Inputs_bytes+Ciphertexts_bytes+Confirm_bytes]; +static void HashSession(unsigned char *k, int b, const unsigned char *y, const unsigned char *z) { + unsigned char x[Hash_bytes + crypto_kem_sntrup761_CIPHERTEXTBYTES]; int i; - - for (i = 0;i < Inputs_bytes;++i) x[i] = y[i]; - for (i = 0;i < Ciphertexts_bytes+Confirm_bytes;++i) x[Inputs_bytes+i] = z[i]; -#endif - Hash_prefix(k,b,x,sizeof x); + Hash_prefix(x, 3, y, Small_bytes); + for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; + Hash_prefix(k, b, x, sizeof x); } -/* ----- Streamlined NTRU Prime and NTRU LPRime */ - -/* pk,sk = KEM_KeyGen() */ -static void KEM_KeyGen(unsigned char *pk,unsigned char *sk) -{ +int crypto_kem_sntrup761_keypair(unsigned char *pk, unsigned char *sk) { int i; - - ZKeyGen(pk,sk); sk += SecretKeys_bytes; - for (i = 0;i < PublicKeys_bytes;++i) *sk++ = pk[i]; - randombytes(sk,Inputs_bytes); sk += Inputs_bytes; - Hash_prefix(sk,4,pk,PublicKeys_bytes); + ZKeyGen(pk, sk); + sk += SecretKeys_bytes; + for (i = 0; i < crypto_kem_sntrup761_PUBLICKEYBYTES; ++i) *sk++ = pk[i]; + randombytes(sk, Small_bytes); + Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); + return 0; } -/* c,r_enc = Hide(r,pk,cache); cache is Hash4(pk) */ -static void Hide(unsigned char *c,unsigned char *r_enc,const Inputs r,const unsigned char *pk,const unsigned char *cache) -{ - Inputs_encode(r_enc,r); - ZEncrypt(c,r,pk); c += Ciphertexts_bytes; - HashConfirm(c,r_enc,pk,cache); +static void Hide(unsigned char *c, unsigned char *r_enc, const Inputs r, const unsigned char *pk, const unsigned char *cache) { + Small_encode(r_enc, r); + ZEncrypt(c, r, pk); + HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); } -/* c,k = Encap(pk) */ -static void Encap(unsigned char *c,unsigned char *k,const unsigned char *pk) -{ +int crypto_kem_sntrup761_enc(unsigned char *c, unsigned char *k, const unsigned char *pk) { Inputs r; - unsigned char r_enc[Inputs_bytes]; - unsigned char cache[Hash_bytes]; - - Hash_prefix(cache,4,pk,PublicKeys_bytes); - Inputs_random(r); - Hide(c,r_enc,r,pk,cache); - HashSession(k,1,r_enc,c); + unsigned char r_enc[Small_bytes], cache[Hash_bytes]; + Hash_prefix(cache, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); + Short_random(r); + Hide(c, r_enc, r, pk, cache); + HashSession(k, 1, r_enc, c); + return 0; } -/* 0 if matching ciphertext+confirm, else -1 */ -static int Ciphertexts_diff_mask(const unsigned char *c,const unsigned char *c2) -{ - uint16 differentbits = 0; - int len = Ciphertexts_bytes+Confirm_bytes; - - while (len-- > 0) differentbits |= (*c++)^(*c2++); - return (1&((differentbits-1)>>8))-1; +static int Ciphertexts_diff_mask(const unsigned char *c, const unsigned char *c2) { + uint16_t differentbits = 0; + int len = crypto_kem_sntrup761_CIPHERTEXTBYTES; + while (len-- > 0) differentbits |= (*c++) ^ (*c2++); + return (crypto_int64_bitmod_01((differentbits - 1),8)) - 1; } -/* k = Decap(c,sk) */ -static void Decap(unsigned char *k,const unsigned char *c,const unsigned char *sk) -{ +int crypto_kem_sntrup761_dec(unsigned char *k, const unsigned char *c, const unsigned char *sk) { const unsigned char *pk = sk + SecretKeys_bytes; - const unsigned char *rho = pk + PublicKeys_bytes; - const unsigned char *cache = rho + Inputs_bytes; + const unsigned char *rho = pk + crypto_kem_sntrup761_PUBLICKEYBYTES; + const unsigned char *cache = rho + Small_bytes; Inputs r; - unsigned char r_enc[Inputs_bytes]; - unsigned char cnew[Ciphertexts_bytes+Confirm_bytes]; - int mask; - int i; - - ZDecrypt(r,c,sk); - Hide(cnew,r_enc,r,pk,cache); - mask = Ciphertexts_diff_mask(c,cnew); - for (i = 0;i < Inputs_bytes;++i) r_enc[i] ^= mask&(r_enc[i]^rho[i]); - HashSession(k,1+mask,r_enc,c); -} - -/* ----- crypto_kem API */ - - -int crypto_kem_sntrup761_keypair(unsigned char *pk,unsigned char *sk) -{ - KEM_KeyGen(pk,sk); + unsigned char r_enc[Small_bytes], cnew[crypto_kem_sntrup761_CIPHERTEXTBYTES]; + int mask, i; + ZDecrypt(r, c, sk); + Hide(cnew, r_enc, r, pk, cache); + mask = Ciphertexts_diff_mask(c, cnew); + for (i = 0; i < Small_bytes; ++i) r_enc[i] ^= mask & (r_enc[i] ^ rho[i]); + HashSession(k, 1 + mask, r_enc, c); return 0; } -int crypto_kem_sntrup761_enc(unsigned char *c,unsigned char *k,const unsigned char *pk) -{ - Encap(c,k,pk); - return 0; -} - -int crypto_kem_sntrup761_dec(unsigned char *k,const unsigned char *c,const unsigned char *sk) -{ - Decap(k,c,sk); - return 0; -} #endif /* USE_SNTRUP761X25519 */ diff --git a/sntrup761.sh b/sntrup761.sh index db4e9ae..4de8dc3 100644 --- a/sntrup761.sh +++ b/sntrup761.sh @@ -1,25 +1,18 @@ #!/bin/sh -# $OpenBSD: sntrup761.sh,v 1.7 2023/01/11 02:13:52 djm Exp $ +# $OpenBSD: sntrup761.sh,v 1.9 2024/09/16 05:37:05 djm Exp $ # Placed in the Public Domain. # -AUTHOR="supercop-20201130/crypto_kem/sntrup761/ref/implementors" -FILES=" - supercop-20201130/crypto_sort/int32/portable4/int32_minmax.inc - supercop-20201130/crypto_sort/int32/portable4/sort.c - supercop-20201130/crypto_sort/uint32/useint32/sort.c - supercop-20201130/crypto_kem/sntrup761/ref/uint32.c - supercop-20201130/crypto_kem/sntrup761/ref/int32.c - supercop-20201130/crypto_kem/sntrup761/ref/paramsmenu.h - supercop-20201130/crypto_kem/sntrup761/ref/params.h - supercop-20201130/crypto_kem/sntrup761/ref/Decode.h - supercop-20201130/crypto_kem/sntrup761/ref/Decode.c - supercop-20201130/crypto_kem/sntrup761/ref/Encode.h - supercop-20201130/crypto_kem/sntrup761/ref/Encode.c - supercop-20201130/crypto_kem/sntrup761/ref/kem.c +AUTHOR="supercop-20240808/crypto_kem/sntrup761/ref/implementors" +FILES=" supercop-20240808/cryptoint/crypto_int16.h + supercop-20240808/cryptoint/crypto_int32.h + supercop-20240808/cryptoint/crypto_int64.h + supercop-20240808/crypto_sort/int32/portable4/sort.c + supercop-20240808/crypto_sort/uint32/useint32/sort.c + supercop-20240808/crypto_kem/sntrup761/compact/kem.c " ### -set -e +set -euo pipefail cd $1 echo -n '/* $' echo 'OpenBSD: $ */' @@ -32,12 +25,19 @@ echo echo '#include ' echo '#include "crypto_api.h"' echo +echo '#define crypto_declassify(x, y) do {} while (0)' +echo # Map the types used in this code to the ones in crypto_api.h. We use #define # instead of typedef since some systems have existing intXX types and do not # permit multiple typedefs even if they do not conflict. for t in int8 uint8 int16 uint16 int32 uint32 int64 uint64; do echo "#define $t crypto_${t}" done + +for x in 16 32 64 ; do + echo "extern volatile crypto_int$x crypto_int${x}_optblocker;" +done + echo for i in $FILES; do echo "/* from $i */" @@ -57,14 +57,32 @@ for i in $FILES; do -e 's/[ ]*$//' \ $i | \ case "$i" in - # Use int64_t for intermediate values in int32_MINMAX to prevent signed - # 32-bit integer overflow when called by crypto_sort_uint32. - */int32_minmax.inc) - sed -e "s/int32 ab = b ^ a/int64_t ab = (int64_t)b ^ (int64_t)a/" \ - -e "s/int32 c = b - a/int64_t c = (int64_t)b - (int64_t)a/" + */cryptoint/crypto_int16.h) + sed -e "s/static void crypto_int16_store/void crypto_int16_store/" \ + -e "s/^[#]define crypto_int16_optblocker.*//" \ + -e "s/static void crypto_int16_minmax/void crypto_int16_minmax/" + ;; + */cryptoint/crypto_int32.h) + # Use int64_t for intermediate values in crypto_int32_minmax to + # prevent signed 32-bit integer overflow when called by + # crypto_sort_int32. Original code depends on -fwrapv (we set -ftrapv) + sed -e "s/static void crypto_int32_store/void crypto_int32_store/" \ + -e "s/^[#]define crypto_int32_optblocker.*//" \ + -e "s/crypto_int32 crypto_int32_r = crypto_int32_y ^ crypto_int32_x;/crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x;/" \ + -e "s/crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x;/crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x;/" \ + -e "s/static void crypto_int32_minmax/void crypto_int32_minmax/" + ;; + */cryptoint/crypto_int64.h) + sed -e "s/static void crypto_int64_store/void crypto_int64_store/" \ + -e "s/^[#]define crypto_int64_optblocker.*//" \ + -e "s/static void crypto_int64_minmax/void crypto_int64_minmax/" ;; */int32/portable4/sort.c) - sed -e "s/void crypto_sort/void crypto_sort_int32/g" + sed -e "s/void crypto_sort[(]/void crypto_sort_int32(/g" + ;; + */int32/portable5/sort.c) + sed -e "s/crypto_sort_smallindices/crypto_sort_int32_smallindices/"\ + -e "s/void crypto_sort[(]/void crypto_sort_int32(/g" ;; */uint32/useint32/sort.c) sed -e "s/void crypto_sort/void crypto_sort_uint32/g" diff --git a/srclimit.c b/srclimit.c index 5014ed7..33116fa 100644 --- a/srclimit.c +++ b/srclimit.c @@ -1,5 +1,6 @@ /* * Copyright (c) 2020 Darren Tucker + * Copyright (c) 2024 Damien Miller * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -18,11 +19,13 @@ #include #include +#include #include #include #include #include +#include #include "addr.h" #include "canohost.h" @@ -30,17 +33,71 @@ #include "misc.h" #include "srclimit.h" #include "xmalloc.h" +#include "servconf.h" +#include "match.h" static int max_children, max_persource, ipv4_masklen, ipv6_masklen; +static struct per_source_penalty penalty_cfg; +static char *penalty_exempt; /* Per connection state, used to enforce unauthenticated connection limit. */ static struct child_info { int id; struct xaddr addr; -} *child; +} *children; + +/* + * Penalised addresses, active entries here prohibit connections until expired. + * Entries become active when more than penalty_min seconds of penalty are + * outstanding. + */ +struct penalty { + struct xaddr addr; + time_t expiry; + int active; + const char *reason; + RB_ENTRY(penalty) by_addr; + RB_ENTRY(penalty) by_expiry; +}; +static int penalty_addr_cmp(struct penalty *a, struct penalty *b); +static int penalty_expiry_cmp(struct penalty *a, struct penalty *b); +RB_HEAD(penalties_by_addr, penalty) penalties_by_addr4, penalties_by_addr6; +RB_HEAD(penalties_by_expiry, penalty) penalties_by_expiry4, penalties_by_expiry6; +RB_GENERATE_STATIC(penalties_by_addr, penalty, by_addr, penalty_addr_cmp) +RB_GENERATE_STATIC(penalties_by_expiry, penalty, by_expiry, penalty_expiry_cmp) +static size_t npenalties4, npenalties6; + +static int +srclimit_mask_addr(const struct xaddr *addr, int bits, struct xaddr *masked) +{ + struct xaddr xmask; + + /* Mask address off address to desired size. */ + if (addr_netmask(addr->af, bits, &xmask) != 0 || + addr_and(masked, addr, &xmask) != 0) { + debug3_f("%s: invalid mask %d bits", __func__, bits); + return -1; + } + return 0; +} + +static int +srclimit_peer_addr(int sock, struct xaddr *addr) +{ + struct sockaddr_storage storage; + socklen_t addrlen = sizeof(storage); + struct sockaddr *sa = (struct sockaddr *)&storage; + + if (getpeername(sock, sa, &addrlen) != 0) + return 1; /* not remote socket? */ + if (addr_sa_to_xaddr(sa, addrlen, addr) != 0) + return 1; /* unknown address family? */ + return 0; +} void -srclimit_init(int max, int persource, int ipv4len, int ipv6len) +srclimit_init(int max, int persource, int ipv4len, int ipv6len, + struct per_source_penalty *penalty_conf, const char *penalty_exempt_conf) { int i; @@ -48,25 +105,31 @@ srclimit_init(int max, int persource, int ipv4len, int ipv6len) ipv4_masklen = ipv4len; ipv6_masklen = ipv6len; max_persource = persource; + penalty_cfg = *penalty_conf; + if (penalty_cfg.max_sources4 < 0 || penalty_cfg.max_sources6 < 0) + fatal_f("invalid max_sources"); /* shouldn't happen */ + penalty_exempt = penalty_exempt_conf == NULL ? + NULL : xstrdup(penalty_exempt_conf); + RB_INIT(&penalties_by_addr4); + RB_INIT(&penalties_by_expiry4); + RB_INIT(&penalties_by_addr6); + RB_INIT(&penalties_by_expiry6); if (max_persource == INT_MAX) /* no limit */ return; debug("%s: max connections %d, per source %d, masks %d,%d", __func__, max, persource, ipv4len, ipv6len); if (max <= 0) fatal("%s: invalid number of sockets: %d", __func__, max); - child = xcalloc(max_children, sizeof(*child)); + children = xcalloc(max_children, sizeof(*children)); for (i = 0; i < max_children; i++) - child[i].id = -1; + children[i].id = -1; } /* returns 1 if connection allowed, 0 if not allowed. */ int srclimit_check_allow(int sock, int id) { - struct xaddr xa, xb, xmask; - struct sockaddr_storage addr; - socklen_t addrlen = sizeof(addr); - struct sockaddr *sa = (struct sockaddr *)&addr; + struct xaddr xa, xb; int i, bits, first_unused, count = 0; char xas[NI_MAXHOST]; @@ -74,26 +137,19 @@ srclimit_check_allow(int sock, int id) return 1; debug("%s: sock %d id %d limit %d", __func__, sock, id, max_persource); - if (getpeername(sock, sa, &addrlen) != 0) - return 1; /* not remote socket? */ - if (addr_sa_to_xaddr(sa, addrlen, &xa) != 0) - return 1; /* unknown address family? */ - - /* Mask address off address to desired size. */ + if (srclimit_peer_addr(sock, &xa) != 0) + return 1; bits = xa.af == AF_INET ? ipv4_masklen : ipv6_masklen; - if (addr_netmask(xa.af, bits, &xmask) != 0 || - addr_and(&xb, &xa, &xmask) != 0) { - debug3("%s: invalid mask %d bits", __func__, bits); + if (srclimit_mask_addr(&xa, bits, &xb) != 0) return 1; - } first_unused = max_children; /* Count matching entries and find first unused one. */ for (i = 0; i < max_children; i++) { - if (child[i].id == -1) { + if (children[i].id == -1) { if (i < first_unused) first_unused = i; - } else if (addr_cmp(&child[i].addr, &xb) == 0) { + } else if (addr_cmp(&children[i].addr, &xb) == 0) { count++; } } @@ -116,8 +172,8 @@ srclimit_check_allow(int sock, int id) return 0; /* Connection allowed, store masked address. */ - child[first_unused].id = id; - memcpy(&child[first_unused].addr, &xb, sizeof(xb)); + children[first_unused].id = id; + memcpy(&children[first_unused].addr, &xb, sizeof(xb)); return 1; } @@ -132,9 +188,305 @@ srclimit_done(int id) debug("%s: id %d", __func__, id); /* Clear corresponding state entry. */ for (i = 0; i < max_children; i++) { - if (child[i].id == id) { - child[i].id = -1; + if (children[i].id == id) { + children[i].id = -1; + return; + } + } +} + +static int +penalty_addr_cmp(struct penalty *a, struct penalty *b) +{ + return addr_cmp(&a->addr, &b->addr); + /* Addresses must be unique in by_addr, so no need to tiebreak */ +} + +static int +penalty_expiry_cmp(struct penalty *a, struct penalty *b) +{ + if (a->expiry != b->expiry) + return a->expiry < b->expiry ? -1 : 1; + /* Tiebreak on addresses */ + return addr_cmp(&a->addr, &b->addr); +} + +static void +expire_penalties_from_tree(time_t now, const char *t, + struct penalties_by_expiry *by_expiry, + struct penalties_by_addr *by_addr, size_t *npenaltiesp) +{ + struct penalty *penalty, *tmp; + + /* XXX avoid full scan of tree, e.g. min-heap */ + RB_FOREACH_SAFE(penalty, penalties_by_expiry, by_expiry, tmp) { + if (penalty->expiry >= now) + break; + if (RB_REMOVE(penalties_by_expiry, by_expiry, + penalty) != penalty || + RB_REMOVE(penalties_by_addr, by_addr, + penalty) != penalty) + fatal_f("internal error: %s penalty table corrupt", t); + free(penalty); + if ((*npenaltiesp)-- == 0) + fatal_f("internal error: %s npenalties underflow", t); + } +} + +static void +expire_penalties(time_t now) +{ + expire_penalties_from_tree(now, "ipv4", + &penalties_by_expiry4, &penalties_by_addr4, &npenalties4); + expire_penalties_from_tree(now, "ipv6", + &penalties_by_expiry6, &penalties_by_addr6, &npenalties6); +} + +static void +addr_masklen_ntop(struct xaddr *addr, int masklen, char *s, size_t slen) +{ + size_t o; + + if (addr_ntop(addr, s, slen) != 0) { + strlcpy(s, "UNKNOWN", slen); + return; + } + if ((o = strlen(s)) < slen) + snprintf(s + o, slen - o, "/%d", masklen); +} + +int +srclimit_penalty_check_allow(int sock, const char **reason) +{ + struct xaddr addr; + struct penalty find, *penalty; + time_t now; + int bits, max_sources, overflow_mode; + char addr_s[NI_MAXHOST]; + struct penalties_by_addr *by_addr; + size_t npenalties; + + if (!penalty_cfg.enabled) + return 1; + if (srclimit_peer_addr(sock, &addr) != 0) + return 1; + if (penalty_exempt != NULL) { + if (addr_ntop(&addr, addr_s, sizeof(addr_s)) != 0) + return 1; /* shouldn't happen */ + if (addr_match_list(addr_s, penalty_exempt) == 1) { + return 1; + } + } + now = monotime(); + expire_penalties(now); + by_addr = addr.af == AF_INET ? + &penalties_by_addr4 : &penalties_by_addr6; + max_sources = addr.af == AF_INET ? + penalty_cfg.max_sources4 : penalty_cfg.max_sources6; + overflow_mode = addr.af == AF_INET ? + penalty_cfg.overflow_mode : penalty_cfg.overflow_mode6; + npenalties = addr.af == AF_INET ? npenalties4 : npenalties6; + if (npenalties >= (size_t)max_sources && + overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) { + *reason = "too many penalised addresses"; + return 0; + } + bits = addr.af == AF_INET ? ipv4_masklen : ipv6_masklen; + memset(&find, 0, sizeof(find)); + if (srclimit_mask_addr(&addr, bits, &find.addr) != 0) + return 1; + if ((penalty = RB_FIND(penalties_by_addr, by_addr, &find)) == NULL) + return 1; /* no penalty */ + if (penalty->expiry < now) { + expire_penalties(now); + return 1; /* expired penalty */ + } + if (!penalty->active) + return 1; /* Penalty hasn't hit activation threshold yet */ + *reason = penalty->reason; + return 0; +} + +static void +srclimit_early_expire_penalties_from_tree(const char *t, + struct penalties_by_expiry *by_expiry, + struct penalties_by_addr *by_addr, size_t *npenaltiesp, size_t max_sources) +{ + struct penalty *p = NULL; + int bits; + char s[NI_MAXHOST + 4]; + + /* Delete the soonest-to-expire penalties. */ + while (*npenaltiesp > max_sources) { + if ((p = RB_MIN(penalties_by_expiry, by_expiry)) == NULL) + fatal_f("internal error: %s table corrupt (find)", t); + bits = p->addr.af == AF_INET ? ipv4_masklen : ipv6_masklen; + addr_masklen_ntop(&p->addr, bits, s, sizeof(s)); + debug3_f("%s overflow, remove %s", t, s); + if (RB_REMOVE(penalties_by_expiry, by_expiry, p) != p || + RB_REMOVE(penalties_by_addr, by_addr, p) != p) + fatal_f("internal error: %s table corrupt (remove)", t); + free(p); + (*npenaltiesp)--; + } +} + +static void +srclimit_early_expire_penalties(void) +{ + srclimit_early_expire_penalties_from_tree("ipv4", + &penalties_by_expiry4, &penalties_by_addr4, &npenalties4, + (size_t)penalty_cfg.max_sources4); + srclimit_early_expire_penalties_from_tree("ipv6", + &penalties_by_expiry6, &penalties_by_addr6, &npenalties6, + (size_t)penalty_cfg.max_sources6); +} + +void +srclimit_penalise(struct xaddr *addr, int penalty_type) +{ + struct xaddr masked; + struct penalty *penalty = NULL, *existing = NULL; + time_t now; + int bits, penalty_secs, max_sources = 0, overflow_mode; + char addrnetmask[NI_MAXHOST + 4]; + const char *reason = NULL, *t; + size_t *npenaltiesp = NULL; + struct penalties_by_addr *by_addr = NULL; + struct penalties_by_expiry *by_expiry = NULL; + + if (!penalty_cfg.enabled) + return; + if (penalty_exempt != NULL) { + if (addr_ntop(addr, addrnetmask, sizeof(addrnetmask)) != 0) + return; /* shouldn't happen */ + if (addr_match_list(addrnetmask, penalty_exempt) == 1) { + debug3_f("address %s is exempt", addrnetmask); return; } } + + switch (penalty_type) { + case SRCLIMIT_PENALTY_NONE: + return; + case SRCLIMIT_PENALTY_CRASH: + penalty_secs = penalty_cfg.penalty_crash; + reason = "penalty: caused crash"; + break; + case SRCLIMIT_PENALTY_AUTHFAIL: + penalty_secs = penalty_cfg.penalty_authfail; + reason = "penalty: failed authentication"; + break; + case SRCLIMIT_PENALTY_NOAUTH: + penalty_secs = penalty_cfg.penalty_noauth; + reason = "penalty: connections without attempting authentication"; + break; + case SRCLIMIT_PENALTY_REFUSECONNECTION: + penalty_secs = penalty_cfg.penalty_refuseconnection; + reason = "penalty: connection prohibited by RefuseConnection"; + break; + case SRCLIMIT_PENALTY_GRACE_EXCEEDED: + penalty_secs = penalty_cfg.penalty_crash; + reason = "penalty: exceeded LoginGraceTime"; + break; + default: + fatal_f("internal error: unknown penalty %d", penalty_type); + } + bits = addr->af == AF_INET ? ipv4_masklen : ipv6_masklen; + if (srclimit_mask_addr(addr, bits, &masked) != 0) + return; + addr_masklen_ntop(addr, bits, addrnetmask, sizeof(addrnetmask)); + + now = monotime(); + expire_penalties(now); + by_expiry = addr->af == AF_INET ? + &penalties_by_expiry4 : &penalties_by_expiry6; + by_addr = addr->af == AF_INET ? + &penalties_by_addr4 : &penalties_by_addr6; + max_sources = addr->af == AF_INET ? + penalty_cfg.max_sources4 : penalty_cfg.max_sources6; + overflow_mode = addr->af == AF_INET ? + penalty_cfg.overflow_mode : penalty_cfg.overflow_mode6; + npenaltiesp = addr->af == AF_INET ? &npenalties4 : &npenalties6; + t = addr->af == AF_INET ? "ipv4" : "ipv6"; + if (*npenaltiesp >= (size_t)max_sources && + overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) { + verbose_f("%s penalty table full, cannot penalise %s for %s", t, + addrnetmask, reason); + return; + } + + penalty = xcalloc(1, sizeof(*penalty)); + penalty->addr = masked; + penalty->expiry = now + penalty_secs; + penalty->reason = reason; + if ((existing = RB_INSERT(penalties_by_addr, by_addr, + penalty)) == NULL) { + /* penalty didn't previously exist */ + if (penalty_secs > penalty_cfg.penalty_min) + penalty->active = 1; + if (RB_INSERT(penalties_by_expiry, by_expiry, penalty) != NULL) + fatal_f("internal error: %s penalty tables corrupt", t); + verbose_f("%s: new %s %s penalty of %d seconds for %s", t, + addrnetmask, penalty->active ? "active" : "deferred", + penalty_secs, reason); + if (++(*npenaltiesp) > (size_t)max_sources) + srclimit_early_expire_penalties(); /* permissive */ + return; + } + debug_f("%s penalty for %s %s already exists, %lld seconds remaining", + existing->active ? "active" : "inactive", t, + addrnetmask, (long long)(existing->expiry - now)); + /* Expiry information is about to change, remove from tree */ + if (RB_REMOVE(penalties_by_expiry, by_expiry, existing) != existing) + fatal_f("internal error: %s penalty table corrupt (remove)", t); + /* An entry already existed. Accumulate penalty up to maximum */ + existing->expiry += penalty_secs; + if (existing->expiry - now > penalty_cfg.penalty_max) + existing->expiry = now + penalty_cfg.penalty_max; + if (existing->expiry - now > penalty_cfg.penalty_min && + !existing->active) { + verbose_f("%s: activating %s penalty of %lld seconds for %s", + addrnetmask, t, (long long)(existing->expiry - now), + reason); + existing->active = 1; + } + existing->reason = penalty->reason; + free(penalty); + penalty = NULL; + /* Re-insert into expiry tree */ + if (RB_INSERT(penalties_by_expiry, by_expiry, existing) != NULL) + fatal_f("internal error: %s penalty table corrupt (insert)", t); +} + +static void +srclimit_penalty_info_for_tree(const char *t, + struct penalties_by_expiry *by_expiry, size_t npenalties) +{ + struct penalty *p = NULL; + int bits; + char s[NI_MAXHOST + 4]; + time_t now; + + now = monotime(); + logit("%zu active %s penalties", npenalties, t); + RB_FOREACH(p, penalties_by_expiry, by_expiry) { + bits = p->addr.af == AF_INET ? ipv4_masklen : ipv6_masklen; + addr_masklen_ntop(&p->addr, bits, s, sizeof(s)); + if (p->expiry < now) + logit("client %s %s (expired)", s, p->reason); + else { + logit("client %s %s (%llu secs left)", s, p->reason, + (long long)(p->expiry - now)); + } + } +} + +void +srclimit_penalty_info(void) +{ + srclimit_penalty_info_for_tree("ipv4", + &penalties_by_expiry4, npenalties4); + srclimit_penalty_info_for_tree("ipv6", + &penalties_by_expiry6, npenalties6); } diff --git a/srclimit.h b/srclimit.h index 6e04f32..77d951b 100644 --- a/srclimit.h +++ b/srclimit.h @@ -13,6 +13,28 @@ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ -void srclimit_init(int, int, int, int); +struct xaddr; + +struct per_source_penalty; + +void srclimit_init(int, int, int, int, + struct per_source_penalty *, const char *); int srclimit_check_allow(int, int); void srclimit_done(int); + +#define SRCLIMIT_PENALTY_NONE 0 +#define SRCLIMIT_PENALTY_CRASH 1 +#define SRCLIMIT_PENALTY_AUTHFAIL 2 +#define SRCLIMIT_PENALTY_GRACE_EXCEEDED 3 +#define SRCLIMIT_PENALTY_NOAUTH 4 +#define SRCLIMIT_PENALTY_REFUSECONNECTION 5 + +/* meaningful exit values, used by sshd listener for penalties */ +#define EXIT_LOGIN_GRACE 3 /* login grace period exceeded */ +#define EXIT_CHILD_CRASH 4 /* preauth child crashed */ +#define EXIT_AUTH_ATTEMPTED 5 /* at least one auth attempt made */ +#define EXIT_CONFIG_REFUSED 6 /* sshd_config RefuseConnection */ + +void srclimit_penalise(struct xaddr *, int); +int srclimit_penalty_check_allow(int, const char **); +void srclimit_penalty_info(void); diff --git a/ssh-add.0 b/ssh-add.0 index 6ce88e0..30eed66 100644 --- a/ssh-add.0 +++ b/ssh-add.0 @@ -13,11 +13,11 @@ SYNOPSIS DESCRIPTION ssh-add adds private key identities to the authentication agent, ssh-agent(1). When run without arguments, it adds the files - ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, - ~/.ssh/id_ed25519_sk, and ~/.ssh/id_dsa. After loading a private key, - ssh-add will try to load corresponding certificate information from the - filename obtained by appending -cert.pub to the name of the private key - file. Alternative file names can be given on the command line. + ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and + ~/.ssh/id_ed25519_sk. After loading a private key, ssh-add will try to + load corresponding certificate information from the filename obtained by + appending -cert.pub to the name of the private key file. Alternative + file names can be given on the command line. If any file requires a passphrase, ssh-add asks for the passphrase from the user. The passphrase is read from the user's tty. ssh-add retries @@ -180,13 +180,12 @@ ENVIRONMENT the built-in USB HID support. FILES - ~/.ssh/id_dsa ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa_sk ~/.ssh/id_ed25519 ~/.ssh/id_ed25519_sk ~/.ssh/id_rsa - Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, + Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity of the user. @@ -207,4 +206,4 @@ AUTHORS created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0. -OpenBSD 7.5 December 19, 2023 OpenBSD 7.5 +OpenBSD 7.5 June 17, 2024 OpenBSD 7.5 diff --git a/ssh-add.1 b/ssh-add.1 index 290ba91..c31de4d 100644 --- a/ssh-add.1 +++ b/ssh-add.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-add.1,v 1.86 2023/12/19 06:57:34 jmc Exp $ +.\" $OpenBSD: ssh-add.1,v 1.87 2024/06/17 08:30:29 djm Exp $ .\" .\" Author: Tatu Ylonen .\" Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -35,7 +35,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: December 19 2023 $ +.Dd $Mdocdate: June 17 2024 $ .Dt SSH-ADD 1 .Os .Sh NAME @@ -67,10 +67,9 @@ When run without arguments, it adds the files .Pa ~/.ssh/id_rsa , .Pa ~/.ssh/id_ecdsa , .Pa ~/.ssh/id_ecdsa_sk , -.Pa ~/.ssh/id_ed25519 , -.Pa ~/.ssh/id_ed25519_sk , +.Pa ~/.ssh/id_ed25519 and -.Pa ~/.ssh/id_dsa . +.Pa ~/.ssh/id_ed25519_sk . After loading a private key, .Nm will try to load corresponding certificate information from the @@ -314,13 +313,12 @@ the built-in USB HID support. .El .Sh FILES .Bl -tag -width Ds -compact -.It Pa ~/.ssh/id_dsa .It Pa ~/.ssh/id_ecdsa .It Pa ~/.ssh/id_ecdsa_sk .It Pa ~/.ssh/id_ed25519 .It Pa ~/.ssh/id_ed25519_sk .It Pa ~/.ssh/id_rsa -Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, +Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity of the user. .El .Pp diff --git a/ssh-add.c b/ssh-add.c index e532d5c..0035cb8 100644 --- a/ssh-add.c +++ b/ssh-add.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-add.c,v 1.172 2024/01/11 01:45:36 djm Exp $ */ +/* $OpenBSD: ssh-add.c,v 1.173 2024/09/06 02:30:44 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -698,7 +698,7 @@ parse_dest_constraint_hop(const char *s, struct dest_constraint_hop *dch, memset(dch, '\0', sizeof(*dch)); os = xstrdup(s); - if ((host = strchr(os, '@')) == NULL) + if ((host = strrchr(os, '@')) == NULL) host = os; else { *host++ = '\0'; diff --git a/ssh-ecdsa-sk.c b/ssh-ecdsa-sk.c index 5dcd3c1..27ddf90 100644 --- a/ssh-ecdsa-sk.c +++ b/ssh-ecdsa-sk.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-ecdsa-sk.c,v 1.18 2023/03/08 04:43:12 guenther Exp $ */ +/* $OpenBSD: ssh-ecdsa-sk.c,v 1.19 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -237,11 +237,13 @@ ssh_ecdsa_sk_verify(const struct sshkey *key, struct sshkey_sig_details **detailsp) { ECDSA_SIG *esig = NULL; + EVP_MD_CTX *md_ctx = NULL; BIGNUM *sig_r = NULL, *sig_s = NULL; u_char sig_flags; - u_char msghash[32], apphash[32], sighash[32]; + u_char msghash[32], apphash[32]; u_int sig_counter; - int is_webauthn = 0, ret = SSH_ERR_INTERNAL_ERROR; + u_char *sigb = NULL, *cp; + int is_webauthn = 0, ret = SSH_ERR_INTERNAL_ERROR, len = 0; struct sshbuf *b = NULL, *sigbuf = NULL, *original_signed = NULL; struct sshbuf *webauthn_wrapper = NULL, *webauthn_exts = NULL; char *ktype = NULL, *webauthn_origin = NULL; @@ -252,7 +254,7 @@ ssh_ecdsa_sk_verify(const struct sshkey *key, if (detailsp != NULL) *detailsp = NULL; - if (key == NULL || key->ecdsa == NULL || + if (key == NULL || key->pkey == NULL || sshkey_type_plain(key->type) != KEY_ECDSA_SK || sig == NULL || siglen == 0) return SSH_ERR_INVALID_ARGUMENT; @@ -363,21 +365,43 @@ ssh_ecdsa_sk_verify(const struct sshkey *key, (ret = sshbuf_putb(original_signed, webauthn_exts)) != 0 || (ret = sshbuf_put(original_signed, msghash, sizeof(msghash))) != 0) goto out; - /* Signature is over H(original_signed) */ - if ((ret = ssh_digest_buffer(SSH_DIGEST_SHA256, original_signed, - sighash, sizeof(sighash))) != 0) - goto out; details->sk_counter = sig_counter; details->sk_flags = sig_flags; #ifdef DEBUG_SK fprintf(stderr, "%s: signed buf:\n", __func__); sshbuf_dump(original_signed, stderr); - fprintf(stderr, "%s: signed hash:\n", __func__); - sshbuf_dump_data(sighash, sizeof(sighash), stderr); #endif + if ((md_ctx = EVP_MD_CTX_new()) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; + goto out; + } + if ((len = i2d_ECDSA_SIG(esig, NULL)) <= 0) { + len = 0; + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + if ((sigb = calloc(1, len)) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; + goto out; + } + cp = sigb; /* ASN1_item_i2d increments the pointer past the object */ + if (i2d_ECDSA_SIG(esig, &cp) != len) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } +#ifdef DEBUG_SK + fprintf(stderr, "%s: signed hash:\n", __func__); + sshbuf_dump_data(sigb, len, stderr); +#endif /* Verify it */ - switch (ECDSA_do_verify(sighash, sizeof(sighash), esig, key->ecdsa)) { + if (EVP_DigestVerifyInit(md_ctx, NULL, EVP_sha256(), NULL, + key->pkey) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + switch (EVP_DigestVerify(md_ctx, sigb, len, + sshbuf_ptr(original_signed), sshbuf_len(original_signed))) { case 1: ret = 0; break; @@ -397,7 +421,6 @@ ssh_ecdsa_sk_verify(const struct sshkey *key, explicit_bzero(&sig_flags, sizeof(sig_flags)); explicit_bzero(&sig_counter, sizeof(sig_counter)); explicit_bzero(msghash, sizeof(msghash)); - explicit_bzero(sighash, sizeof(msghash)); explicit_bzero(apphash, sizeof(apphash)); sshkey_sig_details_free(details); sshbuf_free(webauthn_wrapper); @@ -410,6 +433,8 @@ ssh_ecdsa_sk_verify(const struct sshkey *key, BN_clear_free(sig_r); BN_clear_free(sig_s); free(ktype); + freezero(sigb, len); + EVP_MD_CTX_free(md_ctx); return ret; } diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c index 341c324..695ed45 100644 --- a/ssh-ecdsa.c +++ b/ssh-ecdsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-ecdsa.c,v 1.26 2023/03/08 04:43:12 guenther Exp $ */ +/* $OpenBSD: ssh-ecdsa.c,v 1.27 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -45,6 +45,61 @@ #include "openbsd-compat/openssl-compat.h" +int +sshkey_ecdsa_fixup_group(EVP_PKEY *k) +{ + int nids[] = { + NID_X9_62_prime256v1, + NID_secp384r1, +#ifdef OPENSSL_HAS_NISTP521 + NID_secp521r1, +#endif + -1 + }; + int nid = -1; + u_int i; + const EC_GROUP *g; + EC_KEY *ec = NULL; + EC_GROUP *eg = NULL; + + if ((ec = EVP_PKEY_get1_EC_KEY(k)) == NULL || + (g = EC_KEY_get0_group(ec)) == NULL) + goto out; + /* + * The group may be stored in a ASN.1 encoded private key in one of two + * ways: as a "named group", which is reconstituted by ASN.1 object ID + * or explicit group parameters encoded into the key blob. Only the + * "named group" case sets the group NID for us, but we can figure + * it out for the other case by comparing against all the groups that + * are supported. + */ + if ((nid = EC_GROUP_get_curve_name(g)) > 0) + goto out; + nid = -1; + for (i = 0; nids[i] != -1; i++) { + if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) + goto out; + if (EC_GROUP_cmp(g, eg, NULL) == 0) + break; + EC_GROUP_free(eg); + eg = NULL; + } + if (nids[i] == -1) + goto out; + + /* Use the group with the NID attached */ + EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); + if (EC_KEY_set_group(ec, eg) != 1 || + EVP_PKEY_set1_EC_KEY(k, ec) != 1) + goto out; + /* success */ + nid = nids[i]; + out: + EC_KEY_free(ec); + EC_GROUP_free(eg); + return nid; +} + static u_int ssh_ecdsa_size(const struct sshkey *key) { @@ -65,30 +120,16 @@ ssh_ecdsa_size(const struct sshkey *key) static void ssh_ecdsa_cleanup(struct sshkey *k) { - EC_KEY_free(k->ecdsa); - k->ecdsa = NULL; + EVP_PKEY_free(k->pkey); + k->pkey = NULL; } static int ssh_ecdsa_equal(const struct sshkey *a, const struct sshkey *b) { - const EC_GROUP *grp_a, *grp_b; - const EC_POINT *pub_a, *pub_b; - - if (a->ecdsa == NULL || b->ecdsa == NULL) + if (a->pkey == NULL || b->pkey == NULL) return 0; - if ((grp_a = EC_KEY_get0_group(a->ecdsa)) == NULL || - (grp_b = EC_KEY_get0_group(b->ecdsa)) == NULL) - return 0; - if ((pub_a = EC_KEY_get0_public_key(a->ecdsa)) == NULL || - (pub_b = EC_KEY_get0_public_key(b->ecdsa)) == NULL) - return 0; - if (EC_GROUP_cmp(grp_a, grp_b, NULL) != 0) - return 0; - if (EC_POINT_cmp(grp_a, pub_a, pub_b, NULL) != 0) - return 0; - - return 1; + return EVP_PKEY_cmp(a->pkey, b->pkey) == 1; } static int @@ -97,11 +138,11 @@ ssh_ecdsa_serialize_public(const struct sshkey *key, struct sshbuf *b, { int r; - if (key->ecdsa == NULL) + if (key->pkey == NULL) return SSH_ERR_INVALID_ARGUMENT; if ((r = sshbuf_put_cstring(b, sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || - (r = sshbuf_put_eckey(b, key->ecdsa)) != 0) + (r = sshbuf_put_ec_pkey(b, key->pkey)) != 0) return r; return 0; @@ -118,7 +159,7 @@ ssh_ecdsa_serialize_private(const struct sshkey *key, struct sshbuf *b, return r; } if ((r = sshbuf_put_bignum2(b, - EC_KEY_get0_private_key(key->ecdsa))) != 0) + EC_KEY_get0_private_key(EVP_PKEY_get0_EC_KEY(key->pkey)))) != 0) return r; return 0; } @@ -126,31 +167,64 @@ ssh_ecdsa_serialize_private(const struct sshkey *key, struct sshbuf *b, static int ssh_ecdsa_generate(struct sshkey *k, int bits) { - EC_KEY *private; + EVP_PKEY *res = NULL; + EVP_PKEY_CTX *ctx = NULL; + int ret = SSH_ERR_INTERNAL_ERROR; if ((k->ecdsa_nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) return SSH_ERR_KEY_LENGTH; - if ((private = EC_KEY_new_by_curve_name(k->ecdsa_nid)) == NULL) + + if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) return SSH_ERR_ALLOC_FAIL; - if (EC_KEY_generate_key(private) != 1) { - EC_KEY_free(private); - return SSH_ERR_LIBCRYPTO_ERROR; + + if (EVP_PKEY_keygen_init(ctx) <= 0 || + EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, k->ecdsa_nid) <= 0 || + EVP_PKEY_keygen(ctx, &res) <= 0) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; } - EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); - k->ecdsa = private; - return 0; + /* success */ + k->pkey = res; + res = NULL; + ret = 0; + out: + EVP_PKEY_free(res); + EVP_PKEY_CTX_free(ctx); + return ret; } static int ssh_ecdsa_copy_public(const struct sshkey *from, struct sshkey *to) { + const EC_KEY *ec_from; + EC_KEY *ec_to = NULL; + int ret = SSH_ERR_INTERNAL_ERROR; + + ec_from = EVP_PKEY_get0_EC_KEY(from->pkey); + if (ec_from == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; + to->ecdsa_nid = from->ecdsa_nid; - if ((to->ecdsa = EC_KEY_new_by_curve_name(from->ecdsa_nid)) == NULL) + if ((ec_to = EC_KEY_new_by_curve_name(from->ecdsa_nid)) == NULL) return SSH_ERR_ALLOC_FAIL; - if (EC_KEY_set_public_key(to->ecdsa, - EC_KEY_get0_public_key(from->ecdsa)) != 1) - return SSH_ERR_LIBCRYPTO_ERROR; /* caller will free k->ecdsa */ - return 0; + if (EC_KEY_set_public_key(ec_to, + EC_KEY_get0_public_key(ec_from)) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + EVP_PKEY_free(to->pkey); + if ((to->pkey = EVP_PKEY_new()) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; + goto out; + } + if (EVP_PKEY_set1_EC_KEY(to->pkey, ec_to) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + ret = 0; + out: + EC_KEY_free(ec_to); + return ret; } static int @@ -159,6 +233,8 @@ ssh_ecdsa_deserialize_public(const char *ktype, struct sshbuf *b, { int r; char *curve = NULL; + EVP_PKEY *pkey = NULL; + EC_KEY *ec = NULL; if ((key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype)) == -1) return SSH_ERR_INVALID_ARGUMENT; @@ -168,31 +244,39 @@ ssh_ecdsa_deserialize_public(const char *ktype, struct sshbuf *b, r = SSH_ERR_EC_CURVE_MISMATCH; goto out; } - EC_KEY_free(key->ecdsa); - key->ecdsa = NULL; - if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL) { + if ((ec = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - if ((r = sshbuf_get_eckey(b, key->ecdsa)) != 0) + if ((r = sshbuf_get_eckey(b, ec)) != 0) goto out; - if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), - EC_KEY_get0_public_key(key->ecdsa)) != 0) { + if (sshkey_ec_validate_public(EC_KEY_get0_group(ec), + EC_KEY_get0_public_key(ec)) != 0) { r = SSH_ERR_KEY_INVALID_EC_VALUE; goto out; } + if ((pkey = EVP_PKEY_new()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto out; + } + if (EVP_PKEY_set1_EC_KEY(pkey, ec) != 1) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + EVP_PKEY_free(key->pkey); + key->pkey = pkey; + pkey = NULL; /* success */ r = 0; #ifdef DEBUG_PK - sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), - EC_KEY_get0_public_key(key->ecdsa)); + sshkey_dump_ec_point( + EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(key->pkey)), + EC_KEY_get0_public_key(EVP_PKEY_get0_EC_KEY(key->pkey))); #endif out: + EC_KEY_free(ec); + EVP_PKEY_free(pkey); free(curve); - if (r != 0) { - EC_KEY_free(key->ecdsa); - key->ecdsa = NULL; - } return r; } @@ -202,6 +286,7 @@ ssh_ecdsa_deserialize_private(const char *ktype, struct sshbuf *b, { int r; BIGNUM *exponent = NULL; + EC_KEY *ec = NULL; if (!sshkey_is_cert(key)) { if ((r = ssh_ecdsa_deserialize_public(ktype, b, key)) != 0) @@ -209,16 +294,25 @@ ssh_ecdsa_deserialize_private(const char *ktype, struct sshbuf *b, } if ((r = sshbuf_get_bignum2(b, &exponent)) != 0) goto out; - if (EC_KEY_set_private_key(key->ecdsa, exponent) != 1) { + if ((ec = EVP_PKEY_get1_EC_KEY(key->pkey)) == NULL) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + if (EC_KEY_set_private_key(ec, exponent) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - if ((r = sshkey_ec_validate_private(key->ecdsa)) != 0) + if ((r = sshkey_ec_validate_private(ec)) != 0) goto out; + if (EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } /* success */ r = 0; out: BN_clear_free(exponent); + EC_KEY_free(ec); return r; } @@ -229,34 +323,35 @@ ssh_ecdsa_sign(struct sshkey *key, const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) { ECDSA_SIG *esig = NULL; + unsigned char *sigb = NULL; + const unsigned char *psig; const BIGNUM *sig_r, *sig_s; int hash_alg; - u_char digest[SSH_DIGEST_MAX_LENGTH]; - size_t len, hlen; + size_t slen = 0; struct sshbuf *b = NULL, *bb = NULL; - int ret = SSH_ERR_INTERNAL_ERROR; + int len = 0, ret = SSH_ERR_INTERNAL_ERROR; if (lenp != NULL) *lenp = 0; if (sigp != NULL) *sigp = NULL; - if (key == NULL || key->ecdsa == NULL || + if (key == NULL || key->pkey == NULL || sshkey_type_plain(key->type) != KEY_ECDSA) return SSH_ERR_INVALID_ARGUMENT; - if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 || - (hlen = ssh_digest_bytes(hash_alg)) == 0) + if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1) return SSH_ERR_INTERNAL_ERROR; - if ((ret = ssh_digest_memory(hash_alg, data, dlen, - digest, sizeof(digest))) != 0) + + if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sigb, &slen, + data, dlen)) != 0) goto out; - if ((esig = ECDSA_do_sign(digest, hlen, key->ecdsa)) == NULL) { + psig = sigb; + if ((esig = d2i_ECDSA_SIG(NULL, &psig, slen)) == NULL) { ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - if ((bb = sshbuf_new()) == NULL || (b = sshbuf_new()) == NULL) { ret = SSH_ERR_ALLOC_FAIL; goto out; @@ -280,7 +375,7 @@ ssh_ecdsa_sign(struct sshkey *key, *lenp = len; ret = 0; out: - explicit_bzero(digest, sizeof(digest)); + freezero(sigb, slen); sshbuf_free(b); sshbuf_free(bb); ECDSA_SIG_free(esig); @@ -295,20 +390,18 @@ ssh_ecdsa_verify(const struct sshkey *key, { ECDSA_SIG *esig = NULL; BIGNUM *sig_r = NULL, *sig_s = NULL; - int hash_alg; - u_char digest[SSH_DIGEST_MAX_LENGTH]; - size_t hlen; + int hash_alg, len = 0; int ret = SSH_ERR_INTERNAL_ERROR; struct sshbuf *b = NULL, *sigbuf = NULL; char *ktype = NULL; + unsigned char *sigb = NULL, *cp; - if (key == NULL || key->ecdsa == NULL || + if (key == NULL || key->pkey == NULL || sshkey_type_plain(key->type) != KEY_ECDSA || sig == NULL || siglen == 0) return SSH_ERR_INVALID_ARGUMENT; - if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1 || - (hlen = ssh_digest_bytes(hash_alg)) == 0) + if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1) return SSH_ERR_INTERNAL_ERROR; /* fetch signature */ @@ -334,6 +427,11 @@ ssh_ecdsa_verify(const struct sshkey *key, ret = SSH_ERR_INVALID_FORMAT; goto out; } + if (sshbuf_len(sigbuf) != 0) { + ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; + goto out; + } + if ((esig = ECDSA_SIG_new()) == NULL) { ret = SSH_ERR_ALLOC_FAIL; goto out; @@ -344,28 +442,26 @@ ssh_ecdsa_verify(const struct sshkey *key, } sig_r = sig_s = NULL; /* transferred */ - if (sshbuf_len(sigbuf) != 0) { - ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; + if ((len = i2d_ECDSA_SIG(esig, NULL)) <= 0) { + len = 0; + ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - if ((ret = ssh_digest_memory(hash_alg, data, dlen, - digest, sizeof(digest))) != 0) - goto out; - - switch (ECDSA_do_verify(digest, hlen, esig, key->ecdsa)) { - case 1: - ret = 0; - break; - case 0: - ret = SSH_ERR_SIGNATURE_INVALID; + if ((sigb = calloc(1, len)) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; goto out; - default: + } + cp = sigb; /* ASN1_item_i2d increments the pointer past the object */ + if (i2d_ECDSA_SIG(esig, &cp) != len) { ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - + if ((ret = sshkey_pkey_digest_verify(key->pkey, hash_alg, + data, dlen, sigb, len)) != 0) + goto out; + /* success */ out: - explicit_bzero(digest, sizeof(digest)); + freezero(sigb, len); sshbuf_free(sigbuf); sshbuf_free(b); ECDSA_SIG_free(esig); diff --git a/ssh-gss.h b/ssh-gss.h index a8af117..7b14e74 100644 --- a/ssh-gss.h +++ b/ssh-gss.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-gss.h,v 1.15 2021/01/27 10:05:28 djm Exp $ */ +/* $OpenBSD: ssh-gss.h,v 1.16 2024/05/17 06:42:04 jsg Exp $ */ /* * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. * @@ -103,7 +103,6 @@ int ssh_gssapi_check_oid(Gssctxt *, void *, size_t); void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t); void ssh_gssapi_set_oid(Gssctxt *, gss_OID); void ssh_gssapi_supported_oids(gss_OID_set *); -ssh_gssapi_mech *ssh_gssapi_get_ctype(Gssctxt *); void ssh_gssapi_prepare_supported_oids(void); OM_uint32 ssh_gssapi_test_oid_supported(OM_uint32 *, gss_OID, int *); diff --git a/ssh-keygen.0 b/ssh-keygen.0 index b0c22f7..2e65a2b 100644 --- a/ssh-keygen.0 +++ b/ssh-keygen.0 @@ -6,7 +6,7 @@ NAME SYNOPSIS ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile] [-m format] [-N new_passphrase] [-O option] - [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa] + [-t ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa] [-w provider] [-Z cipher] ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase] [-P old_passphrase] [-Z cipher] @@ -56,10 +56,10 @@ DESCRIPTION KEY REVOCATION LISTS section for details. Normally each user wishing to use SSH with public key authentication runs - this once to create the authentication key in ~/.ssh/id_dsa, - ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, - ~/.ssh/id_ed25519_sk or ~/.ssh/id_rsa. Additionally, the system - administrator may use this to generate host keys, as seen in /etc/rc. + this once to create the authentication key in ~/.ssh/id_ecdsa, + ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, ~/.ssh/id_ed25519_sk or + ~/.ssh/id_rsa. Additionally, the system administrator may use this to + generate host keys, as seen in /etc/rc. Normally this program generates the key and asks for a file in which to store the private key. The public key is stored in a file with the same @@ -117,8 +117,7 @@ DESCRIPTION -b bits Specifies the number of bits in the key to create. For RSA keys, the minimum size is 1024 bits and the default is 3072 bits. - Generally, 3072 bits is considered sufficient. DSA keys must be - exactly 1024 bits as specified by FIPS 186-2. For ECDSA keys, + Generally, 3072 bits is considered sufficient. For ECDSA keys, the -b flag determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. Attempting to use bit lengths other than these three values for ECDSA keys will @@ -201,9 +200,9 @@ DESCRIPTION -L Prints the contents of one or more certificates. - -l Show fingerprint of specified public key file. For RSA and DSA - keys ssh-keygen tries to find the matching public key file and - prints its fingerprint. If combined with -v, a visual ASCII art + -l Show fingerprint of specified public key file. ssh-keygen will + try to find the matching public key file and prints its + fingerprint. If combined with -v, a visual ASCII art representation of the key is supplied with the fingerprint. -M generate @@ -318,14 +317,16 @@ DESCRIPTION file used to revoke certificates directly by key ID or serial number. See the KEY REVOCATION LISTS section for details. - -t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa + -t ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa Specifies the type of key to create. The possible values are - M-bM-^@M-^\dsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ecdsa-skM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], M-bM-^@M-^\ed25519-skM-bM-^@M-^], or M-bM-^@M-^\rsaM-bM-^@M-^]. + M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ecdsa-skM-bM-^@M-^], M-bM-^@M-^\ed25519 (the default),M-bM-^@M-^] M-bM-^@M-^\ed25519-skM-bM-^@M-^], or + M-bM-^@M-^\rsaM-bM-^@M-^]. This flag may also be used to specify the desired signature type when signing certificates using an RSA CA key. The available RSA signature variants are M-bM-^@M-^\ssh-rsaM-bM-^@M-^] (SHA1 signatures, not - recommended), M-bM-^@M-^\rsa-sha2-256M-bM-^@M-^], and M-bM-^@M-^\rsa-sha2-512M-bM-^@M-^] (the default). + recommended), M-bM-^@M-^\rsa-sha2-256M-bM-^@M-^], and M-bM-^@M-^\rsa-sha2-512M-bM-^@M-^] (the default for + RSA keys). -U When used in combination with -s or -Y sign, this option indicates that a CA key resides in a ssh-agent(1). See the @@ -862,13 +863,12 @@ ENVIRONMENT the built-in USB HID support. FILES - ~/.ssh/id_dsa ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa_sk ~/.ssh/id_ed25519 ~/.ssh/id_ed25519_sk ~/.ssh/id_rsa - Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, + Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity of the user. This file should not be readable by anyone but the user. It is possible to specify a passphrase when generating the @@ -878,13 +878,12 @@ FILES the private key. ssh(1) will read this file when a login attempt is made. - ~/.ssh/id_dsa.pub ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_rsa.pub - Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, + Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA public key for authentication. The contents of this file should be added to ~/.ssh/authorized_keys on all machines where the user wishes to @@ -907,4 +906,4 @@ AUTHORS created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0. -OpenBSD 7.5 September 4, 2023 OpenBSD 7.5 +OpenBSD 7.5 August 17, 2024 OpenBSD 7.5 diff --git a/ssh-keygen.1 b/ssh-keygen.1 index c392141..06f0555 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keygen.1,v 1.230 2023/09/04 10:29:58 job Exp $ +.\" $OpenBSD: ssh-keygen.1,v 1.233 2024/08/17 08:35:04 djm Exp $ .\" .\" Author: Tatu Ylonen .\" Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -35,7 +35,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: September 4 2023 $ +.Dd $Mdocdate: August 17 2024 $ .Dt SSH-KEYGEN 1 .Os .Sh NAME @@ -51,7 +51,7 @@ .Op Fl m Ar format .Op Fl N Ar new_passphrase .Op Fl O Ar option -.Op Fl t Cm dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa +.Op Fl t Cm ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa .Op Fl w Ar provider .Op Fl Z Ar cipher .Nm ssh-keygen @@ -205,7 +205,6 @@ section for details. Normally each user wishing to use SSH with public key authentication runs this once to create the authentication key in -.Pa ~/.ssh/id_dsa , .Pa ~/.ssh/id_ecdsa , .Pa ~/.ssh/id_ecdsa_sk , .Pa ~/.ssh/id_ed25519 , @@ -296,7 +295,6 @@ Show the bubblebabble digest of specified private or public key file. Specifies the number of bits in the key to create. For RSA keys, the minimum size is 1024 bits and the default is 3072 bits. Generally, 3072 bits is considered sufficient. -DSA keys must be exactly 1024 bits as specified by FIPS 186-2. For ECDSA keys, the .Fl b flag determines the key length by selecting from one of three elliptic @@ -414,9 +412,8 @@ section. Prints the contents of one or more certificates. .It Fl l Show fingerprint of specified public key file. -For RSA and DSA keys .Nm -tries to find the matching public key file and prints its fingerprint. +will try to find the matching public key file and prints its fingerprint. If combined with .Fl v , a visual ASCII art representation of the key is supplied with the @@ -579,13 +576,12 @@ by key ID or serial number. See the .Sx KEY REVOCATION LISTS section for details. -.It Fl t Cm dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa +.It Fl t Cm ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa Specifies the type of key to create. The possible values are -.Dq dsa , .Dq ecdsa , .Dq ecdsa-sk , -.Dq ed25519 , +.Dq ed25519 (the default), .Dq ed25519-sk , or .Dq rsa . @@ -598,7 +594,7 @@ The available RSA signature variants are .Dq rsa-sha2-256 , and .Dq rsa-sha2-512 -(the default). +(the default for RSA keys). .It Fl U When used in combination with .Fl s @@ -1290,13 +1286,12 @@ the built-in USB HID support. .El .Sh FILES .Bl -tag -width Ds -compact -.It Pa ~/.ssh/id_dsa .It Pa ~/.ssh/id_ecdsa .It Pa ~/.ssh/id_ecdsa_sk .It Pa ~/.ssh/id_ed25519 .It Pa ~/.ssh/id_ed25519_sk .It Pa ~/.ssh/id_rsa -Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, +Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity of the user. This file should not be readable by anyone but the user. It is possible to @@ -1308,13 +1303,12 @@ but it is offered as the default file for the private key. .Xr ssh 1 will read this file when a login attempt is made. .Pp -.It Pa ~/.ssh/id_dsa.pub .It Pa ~/.ssh/id_ecdsa.pub .It Pa ~/.ssh/id_ecdsa_sk.pub .It Pa ~/.ssh/id_ed25519.pub .It Pa ~/.ssh/id_ed25519_sk.pub .It Pa ~/.ssh/id_rsa.pub -Contains the DSA, ECDSA, authenticator-hosted ECDSA, Ed25519, +Contains the ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA public key for authentication. The contents of this file should be added to .Pa ~/.ssh/authorized_keys diff --git a/ssh-keygen.c b/ssh-keygen.c index 97c6d13..8396c40 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.472 2024/01/11 01:45:36 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.475 2024/09/15 00:47:01 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -261,7 +261,7 @@ ask_filename(struct passwd *pw, const char *prompt) if (key_type_name == NULL) name = _PATH_SSH_CLIENT_ID_ED25519; else { - switch (sshkey_type_from_name(key_type_name)) { + switch (sshkey_type_from_shortname(key_type_name)) { #ifdef WITH_DSA case KEY_DSA_CERT: case KEY_DSA: @@ -313,7 +313,7 @@ ask_filename(struct passwd *pw, const char *prompt) static struct sshkey * load_identity(const char *filename, char **commentp) { - char *pass; + char *prompt, *pass; struct sshkey *prv; int r; @@ -325,8 +325,11 @@ load_identity(const char *filename, char **commentp) fatal_r(r, "Load key \"%s\"", filename); if (identity_passphrase) pass = xstrdup(identity_passphrase); - else - pass = read_passphrase("Enter passphrase: ", RP_ALLOW_STDIN); + else { + xasprintf(&prompt, "Enter passphrase for \"%s\": ", filename); + pass = read_passphrase(prompt, RP_ALLOW_STDIN); + free(prompt); + } r = sshkey_load_private(filename, pass, &prv, commentp); freezero(pass, strlen(pass)); if (r != 0) @@ -375,7 +378,8 @@ do_convert_to_pkcs8(struct sshkey *k) { switch (sshkey_type_plain(k->type)) { case KEY_RSA: - if (!PEM_write_RSA_PUBKEY(stdout, k->rsa)) + if (!PEM_write_RSA_PUBKEY(stdout, + EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSA_PUBKEY failed"); break; #ifdef WITH_DSA @@ -386,7 +390,8 @@ do_convert_to_pkcs8(struct sshkey *k) #endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: - if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) + if (!PEM_write_EC_PUBKEY(stdout, + EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; #endif @@ -401,7 +406,8 @@ do_convert_to_pem(struct sshkey *k) { switch (sshkey_type_plain(k->type)) { case KEY_RSA: - if (!PEM_write_RSAPublicKey(stdout, k->rsa)) + if (!PEM_write_RSAPublicKey(stdout, + EVP_PKEY_get0_RSA(k->pkey))) fatal("PEM_write_RSAPublicKey failed"); break; #ifdef WITH_DSA @@ -412,7 +418,8 @@ do_convert_to_pem(struct sshkey *k) #endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: - if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) + if (!PEM_write_EC_PUBKEY(stdout, + EVP_PKEY_get0_EC_KEY(k->pkey))) fatal("PEM_write_EC_PUBKEY failed"); break; #endif @@ -490,6 +497,8 @@ do_convert_private_ssh2(struct sshbuf *b) #endif BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL; + BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL; + RSA *rsa = NULL; if ((r = sshbuf_get_u32(b, &magic)) != 0) fatal_fr(r, "parse magic"); @@ -584,15 +593,25 @@ do_convert_private_ssh2(struct sshbuf *b) buffer_get_bignum_bits(b, rsa_iqmp); buffer_get_bignum_bits(b, rsa_q); buffer_get_bignum_bits(b, rsa_p); - if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, rsa_d)) + if ((r = ssh_rsa_complete_crt_parameters(rsa_d, rsa_p, rsa_q, + rsa_iqmp, &rsa_dmp1, &rsa_dmq1)) != 0) + fatal_fr(r, "generate RSA CRT parameters"); + if ((key->pkey = EVP_PKEY_new()) == NULL) + fatal_f("EVP_PKEY_new failed"); + if ((rsa = RSA_new()) == NULL) + fatal_f("RSA_new failed"); + if (!RSA_set0_key(rsa, rsa_n, rsa_e, rsa_d)) fatal_f("RSA_set0_key failed"); rsa_n = rsa_e = rsa_d = NULL; /* transferred */ - if (!RSA_set0_factors(key->rsa, rsa_p, rsa_q)) + if (!RSA_set0_factors(rsa, rsa_p, rsa_q)) fatal_f("RSA_set0_factors failed"); rsa_p = rsa_q = NULL; /* transferred */ - if ((r = ssh_rsa_complete_crt_parameters(key, rsa_iqmp)) != 0) - fatal_fr(r, "generate RSA parameters"); - BN_clear_free(rsa_iqmp); + if (RSA_set0_crt_params(rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp) != 1) + fatal_f("RSA_set0_crt_params failed"); + rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL; + if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) + fatal_f("EVP_PKEY_set1_RSA failed"); + RSA_free(rsa); alg = "rsa-sha2-256"; break; } @@ -712,7 +731,8 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); (*k)->type = KEY_RSA; - (*k)->rsa = EVP_PKEY_get1_RSA(pubkey); + (*k)->pkey = pubkey; + pubkey = NULL; break; #ifdef WITH_DSA case EVP_PKEY_DSA: @@ -726,9 +746,11 @@ do_convert_from_pkcs8(struct sshkey **k, int *private) case EVP_PKEY_EC: if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); + if (((*k)->ecdsa_nid = sshkey_ecdsa_fixup_group(pubkey)) == -1) + fatal("sshkey_ecdsa_fixup_group failed"); (*k)->type = KEY_ECDSA; - (*k)->ecdsa = EVP_PKEY_get1_EC_KEY(pubkey); - (*k)->ecdsa_nid = sshkey_ecdsa_key_to_nid((*k)->ecdsa); + (*k)->pkey = pubkey; + pubkey = NULL; break; #endif default: @@ -750,8 +772,12 @@ do_convert_from_pem(struct sshkey **k, int *private) if ((rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL)) != NULL) { if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) fatal("sshkey_new failed"); + if (((*k)->pkey = EVP_PKEY_new()) == NULL) + fatal("EVP_PKEY_new failed"); (*k)->type = KEY_RSA; - (*k)->rsa = rsa; + if (EVP_PKEY_set1_RSA((*k)->pkey, rsa) != 1) + fatal("EVP_PKEY_set1_RSA failed"); + RSA_free(rsa); fclose(fp); return; } @@ -799,13 +825,15 @@ do_convert_from(struct passwd *pw) #endif #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: - ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL, - NULL, 0, NULL, NULL); + ok = PEM_write_ECPrivateKey(stdout, + EVP_PKEY_get0_EC_KEY(k->pkey), NULL, NULL, 0, + NULL, NULL); break; #endif case KEY_RSA: - ok = PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, - NULL, 0, NULL, NULL); + ok = PEM_write_RSAPrivateKey(stdout, + EVP_PKEY_get0_RSA(k->pkey), NULL, NULL, 0, + NULL, NULL); break; default: fatal_f("unsupported key type %s", sshkey_type(k)); @@ -1115,7 +1143,7 @@ do_gen_all_hostkeys(struct passwd *pw) } printf("%s ", key_types[i].key_type_display); fflush(stdout); - type = sshkey_type_from_name(key_types[i].key_type); + type = sshkey_type_from_shortname(key_types[i].key_type); if ((fd = mkstemp(prv_tmp)) == -1) { error("Could not save your private key in %s: %s", prv_tmp, strerror(errno)); @@ -1821,7 +1849,7 @@ do_ca_sign(struct passwd *pw, const char *ca_key_path, int prefer_agent, free(tmp); if (key_type_name != NULL) { - if (sshkey_type_from_name(key_type_name) != ca->type) { + if (sshkey_type_from_shortname(key_type_name) != ca->type) { fatal("CA key type %s doesn't match specified %s", sshkey_ssh_name(ca), key_type_name); } @@ -3108,17 +3136,22 @@ read_check_passphrase(const char *prompt1, const char *prompt2, } static char * -private_key_passphrase(void) +private_key_passphrase(const char *path) { + char *prompt, *ret; + if (identity_passphrase) return xstrdup(identity_passphrase); if (identity_new_passphrase) return xstrdup(identity_new_passphrase); - return read_check_passphrase( - "Enter passphrase (empty for no passphrase): ", + xasprintf(&prompt, "Enter passphrase for \"%s\" " + "(empty for no passphrase): ", path); + ret = read_check_passphrase(prompt, "Enter same passphrase again: ", "Passphrases do not match. Try again."); + free(prompt); + return ret; } static char * @@ -3214,7 +3247,7 @@ do_download_sk(const char *skprovider, const char *device) /* Save the key with the application string as the comment */ if (pass == NULL) - pass = private_key_passphrase(); + pass = private_key_passphrase(path); if ((r = sshkey_save_private(key, path, pass, key->sk_application, private_key_format, openssh_format_cipher, rounds)) != 0) { @@ -3811,7 +3844,7 @@ main(int argc, char **argv) if (key_type_name == NULL) key_type_name = DEFAULT_KEY_TYPE_NAME; - type = sshkey_type_from_name(key_type_name); + type = sshkey_type_from_shortname(key_type_name); type_bits_valid(type, key_type_name, &bits); if (!quiet) @@ -3913,7 +3946,7 @@ main(int argc, char **argv) exit(1); /* Determine the passphrase for the private key */ - passphrase = private_key_passphrase(); + passphrase = private_key_passphrase(identity_file); if (identity_comment) { strlcpy(comment, identity_comment, sizeof(comment)); } else { diff --git a/ssh-keyscan.0 b/ssh-keyscan.0 index e2055e7..1103990 100644 --- a/ssh-keyscan.0 +++ b/ssh-keyscan.0 @@ -4,7 +4,7 @@ NAME ssh-keyscan M-bM-^@M-^S gather SSH public keys from servers SYNOPSIS - ssh-keyscan [-46cDHv] [-f file] [-O option] [-p port] [-T timeout] + ssh-keyscan [-46cDHqv] [-f file] [-O option] [-p port] [-T timeout] [-t type] [host | addrlist namelist] DESCRIPTION @@ -66,6 +66,9 @@ DESCRIPTION -p port Connect to port on the remote host. + -q Quiet mode: do not print server host name and banners in + comments. + -T timeout Set the timeout for connection attempts. If timeout seconds have elapsed since a connection was initiated to a host or since the @@ -75,10 +78,9 @@ DESCRIPTION -t type Specify the type of the key to fetch from the scanned hosts. The - possible values are M-bM-^@M-^\dsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], M-bM-^@M-^\ecdsa-skM-bM-^@M-^], - M-bM-^@M-^\ed25519-skM-bM-^@M-^], or M-bM-^@M-^\rsaM-bM-^@M-^]. Multiple values may be specified by - separating them with commas. The default is to fetch M-bM-^@M-^\rsaM-bM-^@M-^], - M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], M-bM-^@M-^\ecdsa-skM-bM-^@M-^], and M-bM-^@M-^\ed25519-skM-bM-^@M-^] keys. + possible values are M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^], M-bM-^@M-^\ecdsa-skM-bM-^@M-^], M-bM-^@M-^\ed25519-skM-bM-^@M-^], + or M-bM-^@M-^\rsaM-bM-^@M-^]. Multiple values may be specified by separating them + with commas. The default is to fetch all the above key types. -v Verbose mode: print debugging messages about progress. @@ -104,7 +106,7 @@ EXAMPLES Find all hosts from the file ssh_hosts which have new or different keys from those in the sorted file ssh_known_hosts: - $ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \ + $ ssh-keyscan -t rsa,ecdsa,ed25519 -f ssh_hosts | \ sort -u - ssh_known_hosts | diff ssh_known_hosts - SEE ALSO @@ -118,4 +120,4 @@ AUTHORS Davison added support for protocol version 2. -OpenBSD 7.5 February 10, 2023 OpenBSD 7.5 +OpenBSD 7.5 June 17, 2024 OpenBSD 7.5 diff --git a/ssh-keyscan.1 b/ssh-keyscan.1 index aa6d34f..79cef30 100644 --- a/ssh-keyscan.1 +++ b/ssh-keyscan.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keyscan.1,v 1.49 2023/02/10 06:41:53 jmc Exp $ +.\" $OpenBSD: ssh-keyscan.1,v 1.52 2024/06/17 08:30:29 djm Exp $ .\" .\" Copyright 1995, 1996 by David Mazieres . .\" @@ -6,7 +6,7 @@ .\" permitted provided that due credit is given to the author and the .\" OpenBSD project by leaving this copyright notice intact. .\" -.Dd $Mdocdate: February 10 2023 $ +.Dd $Mdocdate: June 17 2024 $ .Dt SSH-KEYSCAN 1 .Os .Sh NAME @@ -14,7 +14,7 @@ .Nd gather SSH public keys from servers .Sh SYNOPSIS .Nm ssh-keyscan -.Op Fl 46cDHv +.Op Fl 46cDHqv .Op Fl f Ar file .Op Fl O Ar option .Op Fl p Ar port @@ -116,6 +116,9 @@ The default is to print both. Connect to .Ar port on the remote host. +.It Fl q +Quiet mode: +do not print server host name and banners in comments. .It Fl T Ar timeout Set the timeout for connection attempts. If @@ -127,7 +130,6 @@ The default is 5 seconds. .It Fl t Ar type Specify the type of the key to fetch from the scanned hosts. The possible values are -.Dq dsa , .Dq ecdsa , .Dq ed25519 , .Dq ecdsa-sk , @@ -135,14 +137,7 @@ The possible values are or .Dq rsa . Multiple values may be specified by separating them with commas. -The default is to fetch -.Dq rsa , -.Dq ecdsa , -.Dq ed25519 , -.Dq ecdsa-sk , -and -.Dq ed25519-sk -keys. +The default is to fetch all the above key types. .It Fl v Verbose mode: print debugging messages about progress. @@ -174,7 +169,7 @@ Find all hosts from the file which have new or different keys from those in the sorted file .Pa ssh_known_hosts : .Bd -literal -offset indent -$ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \e +$ ssh-keyscan -t rsa,ecdsa,ed25519 -f ssh_hosts | \e sort -u - ssh_known_hosts | diff ssh_known_hosts - .Ed .Sh SEE ALSO diff --git a/ssh-keyscan.c b/ssh-keyscan.c index f2e6b59..f34e056 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keyscan.c,v 1.155 2024/01/11 01:45:36 djm Exp $ */ +/* $OpenBSD: ssh-keyscan.c,v 1.161 2024/09/09 02:39:57 djm Exp $ */ /* * Copyright 1995, 1996 by David Mazieres . * @@ -84,6 +84,8 @@ int found_one = 0; /* Successfully found a key */ int hashalg = -1; /* Hash for SSHFP records or -1 for all */ +int quiet = 0; /* Don't print key comment lines */ + #define MAXMAXFD 256 /* The number of seconds after which to give up on a TCP connection */ @@ -104,19 +106,13 @@ typedef struct Connection { u_char c_status; /* State of connection on this file desc. */ #define CS_UNUSED 0 /* File descriptor unused */ #define CS_CON 1 /* Waiting to connect/read greeting */ -#define CS_SIZE 2 /* Waiting to read initial packet size */ -#define CS_KEYS 3 /* Waiting to read public key packet */ int c_fd; /* Quick lookup: c->c_fd == c - fdcon */ - int c_plen; /* Packet length field for ssh packet */ - int c_len; /* Total bytes which must be read. */ - int c_off; /* Length of data read so far. */ int c_keytype; /* Only one of KT_* */ sig_atomic_t c_done; /* SSH2 done */ char *c_namebase; /* Address to free for c_name and c_namelist */ char *c_name; /* Hostname of connection for errors */ char *c_namelist; /* Pointer to other possible addresses */ char *c_output_name; /* Hostname of connection for output */ - char *c_data; /* Data read from this fd */ struct ssh *c_ssh; /* SSH-connection */ struct timespec c_ts; /* Time at which connection gets aborted */ TAILQ_ENTRY(Connection) c_link; /* List of connections in timeout order. */ @@ -307,6 +303,7 @@ keygrab_ssh2(con *c) #endif c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; c->c_ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; + c->c_ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client; ssh_set_verify_host_key_callback(c->c_ssh, key_print_wrapper); /* * do the key-exchange until an error occurs or until @@ -423,9 +420,6 @@ conalloc(const char *iname, const char *oname, int keytype) fdcon[s].c_name = name; fdcon[s].c_namelist = namelist; fdcon[s].c_output_name = xstrdup(oname); - fdcon[s].c_data = (char *) &fdcon[s].c_plen; - fdcon[s].c_len = 4; - fdcon[s].c_off = 0; fdcon[s].c_keytype = keytype; monotime_ts(&fdcon[s].c_ts); fdcon[s].c_ts.tv_sec += timeout; @@ -443,8 +437,6 @@ confree(int s) fatal("confree: attempt to free bad fdno %d", s); free(fdcon[s].c_namebase); free(fdcon[s].c_output_name); - if (fdcon[s].c_status == CS_KEYS) - free(fdcon[s].c_data); fdcon[s].c_status = CS_UNUSED; fdcon[s].c_keytype = 0; if (fdcon[s].c_ssh) { @@ -459,15 +451,6 @@ confree(int s) ncon--; } -static void -contouch(int s) -{ - TAILQ_REMOVE(&tq, &fdcon[s], c_link); - monotime_ts(&fdcon[s].c_ts); - fdcon[s].c_ts.tv_sec += timeout; - TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link); -} - static int conrecycle(int s) { @@ -562,8 +545,10 @@ congreet(int s) confree(s); return; } - fprintf(stderr, "%c %s:%d %s\n", print_sshfp ? ';' : '#', - c->c_name, ssh_port, chop(buf)); + if (!quiet) { + fprintf(stdout, "%c %s:%d %s\n", print_sshfp ? ';' : '#', + c->c_name, ssh_port, chop(buf)); + } keygrab_ssh2(c); confree(s); } @@ -572,35 +557,11 @@ static void conread(int s) { con *c = &fdcon[s]; - size_t n; - if (c->c_status == CS_CON) { - congreet(s); - return; - } - n = atomicio(read, s, c->c_data + c->c_off, c->c_len - c->c_off); - if (n == 0) { - error("read (%s): %s", c->c_name, strerror(errno)); - confree(s); - return; - } - c->c_off += n; - - if (c->c_off == c->c_len) - switch (c->c_status) { - case CS_SIZE: - c->c_plen = htonl(c->c_plen); - c->c_len = c->c_plen + 8 - (c->c_plen & 7); - c->c_off = 0; - c->c_data = xmalloc(c->c_len); - c->c_status = CS_KEYS; - break; - default: - fatal("conread: invalid status %d", c->c_status); - break; - } + if (c->c_status != CS_CON) + fatal("conread: invalid status %d", c->c_status); - contouch(s); + congreet(s); } static void @@ -709,7 +670,7 @@ static void usage(void) { fprintf(stderr, - "usage: ssh-keyscan [-46cDHv] [-f file] [-O option] [-p port] [-T timeout]\n" + "usage: ssh-keyscan [-46cDHqv] [-f file] [-O option] [-p port] [-T timeout]\n" " [-t type] [host | addrlist namelist]\n"); exit(1); } @@ -736,7 +697,7 @@ main(int argc, char **argv) if (argc <= 1) usage(); - while ((opt = getopt(argc, argv, "cDHv46O:p:T:t:f:")) != -1) { + while ((opt = getopt(argc, argv, "cDHqv46O:p:T:t:f:")) != -1) { switch (opt) { case 'H': hash_hosts = 1; @@ -771,6 +732,9 @@ main(int argc, char **argv) else fatal("Too high debugging level."); break; + case 'q': + quiet = 1; + break; case 'f': if (strcmp(optarg, "-") == 0) optarg = NULL; @@ -788,7 +752,7 @@ main(int argc, char **argv) get_keytypes = 0; tname = strtok(optarg, ","); while (tname) { - int type = sshkey_type_from_name(tname); + int type = sshkey_type_from_shortname(tname); switch (type) { #ifdef WITH_DSA @@ -854,7 +818,8 @@ main(int argc, char **argv) if (argv[j] == NULL) fp = stdin; else if ((fp = fopen(argv[j], "r")) == NULL) - fatal("%s: %s: %s", __progname, argv[j], strerror(errno)); + fatal("%s: %s: %s", __progname, + fp == stdin ? "" : argv[j], strerror(errno)); while (getline(&line, &linesize, fp) != -1) { /* Chomp off trailing whitespace and comments */ @@ -876,9 +841,11 @@ main(int argc, char **argv) } if (ferror(fp)) - fatal("%s: %s: %s", __progname, argv[j], strerror(errno)); + fatal("%s: %s: %s", __progname, + fp == stdin ? "" : argv[j], strerror(errno)); - fclose(fp); + if (fp != stdin) + fclose(fp); } free(line); diff --git a/ssh-keysign.0 b/ssh-keysign.0 index c7fe6c8..577955d 100644 --- a/ssh-keysign.0 +++ b/ssh-keysign.0 @@ -22,7 +22,6 @@ FILES /etc/ssh/ssh_config Controls whether ssh-keysign is enabled. - /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key @@ -32,7 +31,6 @@ FILES are readable only by root, ssh-keysign must be set-uid root if host-based authentication is used. - /etc/ssh/ssh_host_dsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ed25519_key-cert.pub /etc/ssh/ssh_host_rsa_key-cert.pub @@ -49,4 +47,4 @@ HISTORY AUTHORS Markus Friedl -OpenBSD 7.5 March 31, 2022 OpenBSD 7.5 +OpenBSD 7.5 June 17, 2024 OpenBSD 7.5 diff --git a/ssh-keysign.8 b/ssh-keysign.8 index 6b4b9b2..3b4d35b 100644 --- a/ssh-keysign.8 +++ b/ssh-keysign.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keysign.8,v 1.17 2022/03/31 17:27:27 naddy Exp $ +.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $ .\" .\" Copyright (c) 2002 Markus Friedl. All rights reserved. .\" @@ -22,7 +22,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: March 31 2022 $ +.Dd $Mdocdate: June 17 2024 $ .Dt SSH-KEYSIGN 8 .Os .Sh NAME @@ -61,7 +61,6 @@ Controls whether .Nm is enabled. .Pp -.It Pa /etc/ssh/ssh_host_dsa_key .It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ed25519_key .It Pa /etc/ssh/ssh_host_rsa_key @@ -73,7 +72,6 @@ Since they are readable only by root, .Nm must be set-uid root if host-based authentication is used. .Pp -.It Pa /etc/ssh/ssh_host_dsa_key-cert.pub .It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub .It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub .It Pa /etc/ssh/ssh_host_rsa_key-cert.pub diff --git a/ssh-keysign.c b/ssh-keysign.c index c54a4bb..968344e 100644 --- a/ssh-keysign.c +++ b/ssh-keysign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keysign.c,v 1.73 2024/01/11 01:51:16 djm Exp $ */ +/* $OpenBSD: ssh-keysign.c,v 1.74 2024/04/30 05:53:03 djm Exp $ */ /* * Copyright (c) 2002 Markus Friedl. All rights reserved. * @@ -268,7 +268,7 @@ main(int argc, char **argv) __progname, rver, version); if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0) fatal_r(r, "%s: buffer error", __progname); - if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO) + if (fd <= STDERR_FILENO) fatal("%s: bad fd = %d", __progname, fd); if ((host = get_local_name(fd)) == NULL) fatal("%s: cannot get local name for fd", __progname); diff --git a/ssh-pkcs11-client.c b/ssh-pkcs11-client.c index 5fa8bf0..b8d1700 100644 --- a/ssh-pkcs11-client.c +++ b/ssh-pkcs11-client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-pkcs11-client.c,v 1.19 2023/12/18 14:46:56 djm Exp $ */ +/* $OpenBSD: ssh-pkcs11-client.c,v 1.20 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2010 Markus Friedl. All rights reserved. * Copyright (c) 2014 Pedro Martelletto. All rights reserved. @@ -264,14 +264,17 @@ rsa_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa, int padding) debug3_f("signing with PKCS11 provider %s", helper->path); if (padding != RSA_PKCS1_PADDING) goto fail; - key = sshkey_new(KEY_UNSPEC); - if (key == NULL) { + if ((key = sshkey_new(KEY_UNSPEC)) == NULL) { error_f("sshkey_new failed"); goto fail; } + if ((key->pkey = EVP_PKEY_new()) == NULL || + EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) { + error_f("pkey setup failed"); + goto fail; + } + key->type = KEY_RSA; - RSA_up_ref(rsa); - key->rsa = rsa; if ((r = sshkey_to_blob(key, &blob, &blen)) != 0) { error_fr(r, "encode key"); goto fail; @@ -339,21 +342,22 @@ ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv, if ((helper = helper_by_ec(ec)) == NULL || helper->fd == -1) fatal_f("no helper for PKCS11 key"); debug3_f("signing with PKCS11 provider %s", helper->path); - nid = sshkey_ecdsa_key_to_nid(ec); - if (nid < 0) { - error_f("couldn't get curve nid"); - goto fail; - } - key = sshkey_new(KEY_UNSPEC); - if (key == NULL) { + if ((key = sshkey_new(KEY_UNSPEC)) == NULL) { error_f("sshkey_new failed"); goto fail; } - key->ecdsa = ec; + if ((key->pkey = EVP_PKEY_new()) == NULL || + EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) { + error("pkey setup failed"); + goto fail; + } + if ((nid = sshkey_ecdsa_pkey_to_nid(key->pkey)) < 0) { + error("couldn't get curve nid"); + goto fail; + } key->ecdsa_nid = nid; key->type = KEY_ECDSA; - EC_KEY_up_ref(ec); if ((r = sshkey_to_blob(key, &blob, &blen)) != 0) { error_fr(r, "encode key"); @@ -408,16 +412,31 @@ ecdsa_do_finish(EC_KEY *ec) static void wrap_key(struct helper *helper, struct sshkey *k) { + RSA *rsa = NULL; + EC_KEY *ecdsa = NULL; + debug3_f("wrap %s for provider %s", sshkey_type(k), helper->path); if (k->type == KEY_RSA) { - RSA_set_method(k->rsa, helper->rsa_meth); + if ((rsa = EVP_PKEY_get1_RSA(k->pkey)) == NULL) + fatal_f("no RSA key"); + if (RSA_set_method(rsa, helper->rsa_meth) != 1) + fatal_f("RSA_set_method failed"); if (helper->nrsa++ >= INT_MAX) fatal_f("RSA refcount error"); + if (EVP_PKEY_set1_RSA(k->pkey, rsa) != 1) + fatal_f("EVP_PKEY_set1_RSA failed"); + RSA_free(rsa); #if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) } else if (k->type == KEY_ECDSA) { - EC_KEY_set_method(k->ecdsa, helper->ec_meth); + if ((ecdsa = EVP_PKEY_get1_EC_KEY(k->pkey)) == NULL) + fatal_f("no ECDSA key"); + if (EC_KEY_set_method(ecdsa, helper->ec_meth) != 1) + fatal_f("EC_KEY_set_method failed"); if (helper->nec++ >= INT_MAX) fatal_f("EC refcount error"); + if (EVP_PKEY_set1_EC_KEY(k->pkey, ecdsa) != 1) + fatal_f("EVP_PKEY_set1_EC_KEY failed"); + EC_KEY_free(ecdsa); #endif } else fatal_f("unknown key type"); @@ -437,6 +456,10 @@ pkcs11_make_cert(const struct sshkey *priv, struct helper *helper = NULL; struct sshkey *ret; int r; + RSA *rsa_priv = NULL, *rsa_cert = NULL; +#if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) + EC_KEY *ec_priv = NULL, *ec_cert = NULL; +#endif debug3_f("private key type %s cert type %s", sshkey_type(priv), sshkey_type(certpub)); @@ -449,24 +472,42 @@ pkcs11_make_cert(const struct sshkey *priv, } *certprivp = NULL; if (priv->type == KEY_RSA) { - if ((helper = helper_by_rsa(priv->rsa)) == NULL || + if ((rsa_priv = EVP_PKEY_get1_RSA(priv->pkey)) == NULL) + fatal_f("no RSA pkey"); + if ((helper = helper_by_rsa(rsa_priv)) == NULL || helper->fd == -1) fatal_f("no helper for PKCS11 RSA key"); if ((r = sshkey_from_private(priv, &ret)) != 0) fatal_fr(r, "copy key"); - RSA_set_method(ret->rsa, helper->rsa_meth); + if ((rsa_cert = EVP_PKEY_get1_RSA(ret->pkey)) == NULL) + fatal_f("no RSA cert pkey"); + if (RSA_set_method(rsa_cert, helper->rsa_meth) != 1) + fatal_f("RSA_set_method failed"); if (helper->nrsa++ >= INT_MAX) fatal_f("RSA refcount error"); + if (EVP_PKEY_set1_RSA(ret->pkey, rsa_cert) != 1) + fatal_f("EVP_PKEY_set1_RSA failed"); + RSA_free(rsa_priv); + RSA_free(rsa_cert); #if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) } else if (priv->type == KEY_ECDSA) { - if ((helper = helper_by_ec(priv->ecdsa)) == NULL || + if ((ec_priv = EVP_PKEY_get1_EC_KEY(priv->pkey)) == NULL) + fatal_f("no EC pkey"); + if ((helper = helper_by_ec(ec_priv)) == NULL || helper->fd == -1) fatal_f("no helper for PKCS11 EC key"); if ((r = sshkey_from_private(priv, &ret)) != 0) fatal_fr(r, "copy key"); - EC_KEY_set_method(ret->ecdsa, helper->ec_meth); + if ((ec_cert = EVP_PKEY_get1_EC_KEY(ret->pkey)) == NULL) + fatal_f("no EC cert pkey"); + if (EC_KEY_set_method(ec_cert, helper->ec_meth) != 1) + fatal_f("EC_KEY_set_method failed"); if (helper->nec++ >= INT_MAX) fatal_f("EC refcount error"); + if (EVP_PKEY_set1_EC_KEY(ret->pkey, ec_cert) != 1) + fatal_f("EVP_PKEY_set1_EC_KEY failed"); + EC_KEY_free(ec_priv); + EC_KEY_free(ec_cert); #endif } else fatal_f("unknown key type %s", sshkey_type(priv)); @@ -485,7 +526,7 @@ pkcs11_make_cert(const struct sshkey *priv, static int pkcs11_start_helper_methods(struct helper *helper) { - RSA_METHOD *rsa_meth; + RSA_METHOD *rsa_meth = NULL; EC_KEY_METHOD *ec_meth = NULL; #if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) int (*ec_init)(EC_KEY *key); diff --git a/ssh-pkcs11-helper.c b/ssh-pkcs11-helper.c index 5c3eaae..a8154f2 100644 --- a/ssh-pkcs11-helper.c +++ b/ssh-pkcs11-helper.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-pkcs11-helper.c,v 1.26 2021/11/18 03:31:44 djm Exp $ */ +/* $OpenBSD: ssh-pkcs11-helper.c,v 1.27 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2010 Markus Friedl. All rights reserved. * @@ -45,6 +45,9 @@ #ifdef ENABLE_PKCS11 #ifdef WITH_OPENSSL +#include +#include +#include /* borrows code from sftp-server and ssh-agent */ @@ -185,10 +188,17 @@ static void process_sign(void) { u_char *blob, *data, *signature = NULL; - size_t blen, dlen, slen = 0; - int r, ok = -1; - struct sshkey *key, *found; + size_t blen, dlen; + u_int slen = 0; + int len, r, ok = -1; + struct sshkey *key = NULL, *found; struct sshbuf *msg; +#ifdef WITH_OPENSSL + RSA *rsa = NULL; +#ifdef OPENSSL_HAS_ECC + EC_KEY *ecdsa = NULL; +#endif /* OPENSSL_HAS_ECC */ +#endif /* WITH_OPENSSL */ /* XXX support SHA2 signature flags */ if ((r = sshbuf_get_string(iqueue, &blob, &blen)) != 0 || @@ -198,41 +208,47 @@ process_sign(void) if ((r = sshkey_from_blob(blob, blen, &key)) != 0) fatal_fr(r, "decode key"); - else { - if ((found = lookup_key(key)) != NULL) { + if ((found = lookup_key(key)) == NULL) + goto reply; + + /* XXX use pkey API properly for signing */ + switch (key->type) { #ifdef WITH_OPENSSL - int ret; - - if (key->type == KEY_RSA) { - slen = RSA_size(key->rsa); - signature = xmalloc(slen); - ret = RSA_private_encrypt(dlen, data, signature, - found->rsa, RSA_PKCS1_PADDING); - if (ret != -1) { - slen = ret; - ok = 0; - } + case KEY_RSA: + if ((rsa = EVP_PKEY_get1_RSA(found->pkey)) == NULL) + fatal_f("no RSA in pkey"); + if ((len = RSA_size(rsa)) < 0) + fatal_f("bad RSA length"); + signature = xmalloc(len); + if ((len = RSA_private_encrypt(dlen, data, signature, + rsa, RSA_PKCS1_PADDING)) < 0) { + error_f("RSA_private_encrypt failed"); + goto reply; + } + slen = (u_int)len; + break; #ifdef OPENSSL_HAS_ECC - } else if (key->type == KEY_ECDSA) { - u_int xslen = ECDSA_size(key->ecdsa); - - signature = xmalloc(xslen); - /* "The parameter type is ignored." */ - ret = ECDSA_sign(-1, data, dlen, signature, - &xslen, found->ecdsa); - if (ret != 0) - ok = 0; - else - error_f("ECDSA_sign returned %d", ret); - slen = xslen; + case KEY_ECDSA: + if ((ecdsa = EVP_PKEY_get1_EC_KEY(found->pkey)) == NULL) + fatal_f("no ECDSA in pkey"); + if ((len = ECDSA_size(ecdsa)) < 0) + fatal_f("bad ECDSA length"); + slen = (u_int)len; + signature = xmalloc(slen); + /* "The parameter type is ignored." */ + if (!ECDSA_sign(-1, data, dlen, signature, &slen, ecdsa)) { + error_f("ECDSA_sign failed"); + goto reply; + } + break; #endif /* OPENSSL_HAS_ECC */ - } else - error_f("don't know how to sign with key " - "type %d", (int)key->type); #endif /* WITH_OPENSSL */ - } - sshkey_free(key); + default: + fatal_f("unsupported key type %d", key->type); } + /* success */ + ok = 0; + reply: if ((msg = sshbuf_new()) == NULL) fatal_f("sshbuf_new failed"); if (ok == 0) { @@ -243,6 +259,11 @@ process_sign(void) if ((r = sshbuf_put_u8(msg, SSH2_AGENT_FAILURE)) != 0) fatal_fr(r, "compose failure response"); } + sshkey_free(key); + RSA_free(rsa); +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) + EC_KEY_free(ecdsa); +#endif free(data); free(blob); free(signature); diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c index 35e98be..fadf9c9 100644 --- a/ssh-pkcs11.c +++ b/ssh-pkcs11.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-pkcs11.c,v 1.59 2023/07/27 22:26:49 djm Exp $ */ +/* $OpenBSD: ssh-pkcs11.c,v 1.63 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2010 Markus Friedl. All rights reserved. * Copyright (c) 2014 Pedro Martelletto. All rights reserved. @@ -502,8 +502,10 @@ pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx, memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len); } - RSA_set_method(rsa, rsa_method); - RSA_set_ex_data(rsa, rsa_idx, k11); + if (RSA_set_method(rsa, rsa_method) != 1) + fatal_f("RSA_set_method failed"); + if (RSA_set_ex_data(rsa, rsa_idx, k11) != 1) + fatal_f("RSA_set_ex_data failed"); return (0); } @@ -615,8 +617,10 @@ pkcs11_ecdsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx, k11->keyid = xmalloc(k11->keyid_len); memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len); } - EC_KEY_set_method(ec, ec_key_method); - EC_KEY_set_ex_data(ec, ec_key_idx, k11); + if (EC_KEY_set_method(ec, ec_key_method) != 1) + fatal_f("EC_KEY_set_method failed"); + if (EC_KEY_set_ex_data(ec, ec_key_idx, k11) != 1) + fatal_f("EC_KEY_set_ex_data failed"); return (0); } @@ -803,11 +807,14 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto fail; } - key->ecdsa = ec; + EVP_PKEY_free(key->pkey); + if ((key->pkey = EVP_PKEY_new()) == NULL) + fatal("EVP_PKEY_new failed"); + if (EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) + fatal("EVP_PKEY_set1_EC_KEY failed"); key->ecdsa_nid = nid; key->type = KEY_ECDSA; key->flags |= SSHKEY_FLAG_EXT; - ec = NULL; /* now owned by key */ fail: for (i = 0; i < 3; i++) @@ -899,10 +906,13 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto fail; } - key->rsa = rsa; + EVP_PKEY_free(key->pkey); + if ((key->pkey = EVP_PKEY_new()) == NULL) + fatal("EVP_PKEY_new failed"); + if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) + fatal("EVP_PKEY_set1_RSA failed"); key->type = KEY_RSA; key->flags |= SSHKEY_FLAG_EXT; - rsa = NULL; /* now owned by key */ fail: for (i = 0; i < 3; i++) @@ -1014,10 +1024,13 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; } - key->rsa = rsa; + EVP_PKEY_free(key->pkey); + if ((key->pkey = EVP_PKEY_new()) == NULL) + fatal("EVP_PKEY_new failed"); + if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) + fatal("EVP_PKEY_set1_RSA failed"); key->type = KEY_RSA; key->flags |= SSHKEY_FLAG_EXT; - rsa = NULL; /* now owned by key */ #if defined(OPENSSL_HAS_ECC) && defined(HAVE_EC_KEY_METHOD_NEW) } else if (EVP_PKEY_base_id(evp) == EVP_PKEY_EC) { if (EVP_PKEY_get0_EC_KEY(evp) == NULL) { @@ -1044,11 +1057,14 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, goto out; } - key->ecdsa = ec; + EVP_PKEY_free(key->pkey); + if ((key->pkey = EVP_PKEY_new()) == NULL) + fatal("EVP_PKEY_new failed"); + if (EVP_PKEY_set1_EC_KEY(key->pkey, ec) != 1) + fatal("EVP_PKEY_set1_EC_KEY failed"); key->ecdsa_nid = nid; key->type = KEY_ECDSA; key->flags |= SSHKEY_FLAG_EXT; - ec = NULL; /* now owned by key */ #endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ } else { error("unknown certificate key type"); @@ -1385,11 +1401,23 @@ pkcs11_rsa_generate_private_key(struct pkcs11_provider *p, CK_ULONG slotidx, return pkcs11_fetch_rsa_pubkey(p, slotidx, &pubKey); } +static int +h2i(char c) +{ + if (c >= '0' && c <= '9') + return c - '0'; + else if (c >= 'a' && c <= 'f') + return c - 'a' + 10; + else if (c >= 'A' && c <= 'F') + return c - 'A' + 10; + else + return -1; +} + static int pkcs11_decode_hex(const char *hex, unsigned char **dest, size_t *rlen) { size_t i, len; - char ptr[3]; if (dest) *dest = NULL; @@ -1402,13 +1430,14 @@ pkcs11_decode_hex(const char *hex, unsigned char **dest, size_t *rlen) *dest = xmalloc(len); - ptr[2] = '\0'; for (i = 0; i < len; i++) { - ptr[0] = hex[2 * i]; - ptr[1] = hex[(2 * i) + 1]; - if (!isxdigit(ptr[0]) || !isxdigit(ptr[1])) + int hi, low; + + hi = h2i(hex[2 * i]); + lo = h2i(hex[(2 * i) + 1]); + if (hi == -1 || lo == -1) return -1; - (*dest)[i] = (unsigned char)strtoul(ptr, NULL, 16); + (*dest)[i] = (hi << 4) | lo; } if (rlen) diff --git a/ssh-rsa.c b/ssh-rsa.c index be8f51e..3ad1fdd 100644 --- a/ssh-rsa.c +++ b/ssh-rsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-rsa.c,v 1.79 2023/03/05 05:34:09 dtucker Exp $ */ +/* $OpenBSD: ssh-rsa.c,v 1.80 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2000, 2003 Markus Friedl * @@ -36,23 +36,18 @@ #include "openbsd-compat/openssl-compat.h" -static int openssh_RSA_verify(int, u_char *, size_t, u_char *, size_t, RSA *); - static u_int -ssh_rsa_size(const struct sshkey *key) +ssh_rsa_size(const struct sshkey *k) { - const BIGNUM *rsa_n; - - if (key->rsa == NULL) + if (k->pkey == NULL) return 0; - RSA_get0_key(key->rsa, &rsa_n, NULL, NULL); - return BN_num_bits(rsa_n); + return EVP_PKEY_bits(k->pkey); } static int ssh_rsa_alloc(struct sshkey *k) { - if ((k->rsa = RSA_new()) == NULL) + if ((k->pkey = EVP_PKEY_new()) == NULL) return SSH_ERR_ALLOC_FAIL; return 0; } @@ -60,29 +55,16 @@ ssh_rsa_alloc(struct sshkey *k) static void ssh_rsa_cleanup(struct sshkey *k) { - RSA_free(k->rsa); - k->rsa = NULL; + EVP_PKEY_free(k->pkey); + k->pkey = NULL; } static int ssh_rsa_equal(const struct sshkey *a, const struct sshkey *b) { - const BIGNUM *rsa_e_a, *rsa_n_a; - const BIGNUM *rsa_e_b, *rsa_n_b; - - if (a->rsa == NULL || b->rsa == NULL) - return 0; - RSA_get0_key(a->rsa, &rsa_n_a, &rsa_e_a, NULL); - RSA_get0_key(b->rsa, &rsa_n_b, &rsa_e_b, NULL); - if (rsa_e_a == NULL || rsa_e_b == NULL) + if (a->pkey == NULL || b->pkey == NULL) return 0; - if (rsa_n_a == NULL || rsa_n_b == NULL) - return 0; - if (BN_cmp(rsa_e_a, rsa_e_b) != 0) - return 0; - if (BN_cmp(rsa_n_a, rsa_n_b) != 0) - return 0; - return 1; + return EVP_PKEY_cmp(a->pkey, b->pkey) == 1; } static int @@ -91,10 +73,14 @@ ssh_rsa_serialize_public(const struct sshkey *key, struct sshbuf *b, { int r; const BIGNUM *rsa_n, *rsa_e; + const RSA *rsa; - if (key->rsa == NULL) + if (key->pkey == NULL) return SSH_ERR_INVALID_ARGUMENT; - RSA_get0_key(key->rsa, &rsa_n, &rsa_e, NULL); + if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; + + RSA_get0_key(rsa, &rsa_n, &rsa_e, NULL); if ((r = sshbuf_put_bignum2(b, rsa_e)) != 0 || (r = sshbuf_put_bignum2(b, rsa_n)) != 0) return r; @@ -108,10 +94,13 @@ ssh_rsa_serialize_private(const struct sshkey *key, struct sshbuf *b, { int r; const BIGNUM *rsa_n, *rsa_e, *rsa_d, *rsa_iqmp, *rsa_p, *rsa_q; + const RSA *rsa; - RSA_get0_key(key->rsa, &rsa_n, &rsa_e, &rsa_d); - RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); - RSA_get0_crt_params(key->rsa, NULL, NULL, &rsa_iqmp); + if ((rsa = EVP_PKEY_get0_RSA(key->pkey)) == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; + RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d); + RSA_get0_factors(rsa, &rsa_p, &rsa_q); + RSA_get0_crt_params(rsa, NULL, NULL, &rsa_iqmp); if (!sshkey_is_cert(key)) { /* Note: can't reuse ssh_rsa_serialize_public: e, n vs. n, e */ @@ -131,28 +120,36 @@ ssh_rsa_serialize_private(const struct sshkey *key, struct sshbuf *b, static int ssh_rsa_generate(struct sshkey *k, int bits) { - RSA *private = NULL; - BIGNUM *f4 = NULL; + EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY *res = NULL; + int ret = SSH_ERR_INTERNAL_ERROR; if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE || bits > SSHBUF_MAX_BIGNUM * 8) return SSH_ERR_KEY_LENGTH; - if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { + + if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)) == NULL) { ret = SSH_ERR_ALLOC_FAIL; goto out; } - if (!BN_set_word(f4, RSA_F4) || - !RSA_generate_key_ex(private, bits, f4, NULL)) { + if (EVP_PKEY_keygen_init(ctx) <= 0) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, bits) <= 0) { + ret = SSH_ERR_KEY_LENGTH; + goto out; + } + if (EVP_PKEY_keygen(ctx, &res) <= 0 || res == NULL) { ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - k->rsa = private; - private = NULL; + /* success */ + k->pkey = res; ret = 0; out: - RSA_free(private); - BN_free(f4); + EVP_PKEY_CTX_free(ctx); return ret; } @@ -162,21 +159,33 @@ ssh_rsa_copy_public(const struct sshkey *from, struct sshkey *to) const BIGNUM *rsa_n, *rsa_e; BIGNUM *rsa_n_dup = NULL, *rsa_e_dup = NULL; int r = SSH_ERR_INTERNAL_ERROR; + const RSA *rsa_from; + RSA *rsa_to = NULL; - RSA_get0_key(from->rsa, &rsa_n, &rsa_e, NULL); + if ((rsa_from = EVP_PKEY_get0_RSA(from->pkey)) == NULL || + (rsa_to = RSA_new()) == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; + + RSA_get0_key(rsa_from, &rsa_n, &rsa_e, NULL); if ((rsa_n_dup = BN_dup(rsa_n)) == NULL || (rsa_e_dup = BN_dup(rsa_e)) == NULL) { r = SSH_ERR_ALLOC_FAIL; goto out; } - if (!RSA_set0_key(to->rsa, rsa_n_dup, rsa_e_dup, NULL)) { + if (!RSA_set0_key(rsa_to, rsa_n_dup, rsa_e_dup, NULL)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } rsa_n_dup = rsa_e_dup = NULL; /* transferred */ + + if (EVP_PKEY_set1_RSA(to->pkey, rsa_to) != 1) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } /* success */ r = 0; out: + RSA_free(rsa_to); BN_clear_free(rsa_n_dup); BN_clear_free(rsa_e_dup); return r; @@ -188,25 +197,34 @@ ssh_rsa_deserialize_public(const char *ktype, struct sshbuf *b, { int ret = SSH_ERR_INTERNAL_ERROR; BIGNUM *rsa_n = NULL, *rsa_e = NULL; + RSA *rsa = NULL; + + if ((rsa = RSA_new()) == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; if (sshbuf_get_bignum2(b, &rsa_e) != 0 || sshbuf_get_bignum2(b, &rsa_n) != 0) { ret = SSH_ERR_INVALID_FORMAT; goto out; } - if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) { + if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) { ret = SSH_ERR_LIBCRYPTO_ERROR; goto out; } rsa_n = rsa_e = NULL; /* transferred */ + if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } if ((ret = sshkey_check_rsa_length(key, 0)) != 0) goto out; #ifdef DEBUG_PK - RSA_print_fp(stderr, key->rsa, 8); + RSA_print_fp(stderr, rsa, 8); #endif /* success */ ret = 0; out: + RSA_free(rsa); BN_clear_free(rsa_n); BN_clear_free(rsa_e); return ret; @@ -219,13 +237,25 @@ ssh_rsa_deserialize_private(const char *ktype, struct sshbuf *b, int r; BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL; BIGNUM *rsa_iqmp = NULL, *rsa_p = NULL, *rsa_q = NULL; + BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL; + RSA *rsa = NULL; - /* Note: can't reuse ssh_rsa_deserialize_public: e, n vs. n, e */ - if (!sshkey_is_cert(key)) { + if (sshkey_is_cert(key)) { + /* sshkey_private_deserialize already has pubkey from cert */ + if ((rsa = EVP_PKEY_get1_RSA(key->pkey)) == NULL) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + } else { + if ((rsa = RSA_new()) == NULL) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + /* Note: can't reuse ssh_rsa_deserialize_public: e,n vs. n,e */ if ((r = sshbuf_get_bignum2(b, &rsa_n)) != 0 || (r = sshbuf_get_bignum2(b, &rsa_e)) != 0) goto out; - if (!RSA_set0_key(key->rsa, rsa_n, rsa_e, NULL)) { + if (!RSA_set0_key(rsa, rsa_n, rsa_e, NULL)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } @@ -236,33 +266,46 @@ ssh_rsa_deserialize_private(const char *ktype, struct sshbuf *b, (r = sshbuf_get_bignum2(b, &rsa_p)) != 0 || (r = sshbuf_get_bignum2(b, &rsa_q)) != 0) goto out; - if (!RSA_set0_key(key->rsa, NULL, NULL, rsa_d)) { + if ((r = ssh_rsa_complete_crt_parameters(rsa_d, rsa_p, rsa_q, + rsa_iqmp, &rsa_dmp1, &rsa_dmq1)) != 0) + goto out; + if (!RSA_set0_key(rsa, NULL, NULL, rsa_d)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } rsa_d = NULL; /* transferred */ - if (!RSA_set0_factors(key->rsa, rsa_p, rsa_q)) { + if (!RSA_set0_factors(rsa, rsa_p, rsa_q)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } rsa_p = rsa_q = NULL; /* transferred */ - if ((r = sshkey_check_rsa_length(key, 0)) != 0) + if (!RSA_set0_crt_params(rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp)) { + r = SSH_ERR_LIBCRYPTO_ERROR; goto out; - if ((r = ssh_rsa_complete_crt_parameters(key, rsa_iqmp)) != 0) + } + rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL; + if (RSA_blinding_on(rsa, NULL) != 1) { + r = SSH_ERR_LIBCRYPTO_ERROR; goto out; - if (RSA_blinding_on(key->rsa, NULL) != 1) { + } + if (EVP_PKEY_set1_RSA(key->pkey, rsa) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } + if ((r = sshkey_check_rsa_length(key, 0)) != 0) + goto out; /* success */ r = 0; out: + RSA_free(rsa); BN_clear_free(rsa_n); BN_clear_free(rsa_e); BN_clear_free(rsa_d); BN_clear_free(rsa_p); BN_clear_free(rsa_q); BN_clear_free(rsa_iqmp); + BN_clear_free(rsa_dmp1); + BN_clear_free(rsa_dmq1); return r; } @@ -317,45 +360,23 @@ rsa_hash_id_from_keyname(const char *alg) return -1; } -static int -rsa_hash_alg_nid(int type) -{ - switch (type) { - case SSH_DIGEST_SHA1: - return NID_sha1; - case SSH_DIGEST_SHA256: - return NID_sha256; - case SSH_DIGEST_SHA512: - return NID_sha512; - default: - return -1; - } -} - int -ssh_rsa_complete_crt_parameters(struct sshkey *key, const BIGNUM *iqmp) +ssh_rsa_complete_crt_parameters(const BIGNUM *rsa_d, const BIGNUM *rsa_p, + const BIGNUM *rsa_q, const BIGNUM *rsa_iqmp, BIGNUM **rsa_dmp1, + BIGNUM **rsa_dmq1) { - const BIGNUM *rsa_p, *rsa_q, *rsa_d; BIGNUM *aux = NULL, *d_consttime = NULL; - BIGNUM *rsa_dmq1 = NULL, *rsa_dmp1 = NULL, *rsa_iqmp = NULL; BN_CTX *ctx = NULL; int r; - if (key == NULL || key->rsa == NULL || - sshkey_type_plain(key->type) != KEY_RSA) - return SSH_ERR_INVALID_ARGUMENT; - - RSA_get0_key(key->rsa, NULL, NULL, &rsa_d); - RSA_get0_factors(key->rsa, &rsa_p, &rsa_q); - + *rsa_dmq1 = *rsa_dmp1 = NULL; if ((ctx = BN_CTX_new()) == NULL) return SSH_ERR_ALLOC_FAIL; if ((aux = BN_new()) == NULL || - (rsa_dmq1 = BN_new()) == NULL || - (rsa_dmp1 = BN_new()) == NULL) + (*rsa_dmq1 = BN_new()) == NULL || + (*rsa_dmp1 = BN_new()) == NULL) return SSH_ERR_ALLOC_FAIL; - if ((d_consttime = BN_dup(rsa_d)) == NULL || - (rsa_iqmp = BN_dup(iqmp)) == NULL) { + if ((d_consttime = BN_dup(rsa_d)) == NULL) { r = SSH_ERR_ALLOC_FAIL; goto out; } @@ -363,25 +384,17 @@ ssh_rsa_complete_crt_parameters(struct sshkey *key, const BIGNUM *iqmp) BN_set_flags(d_consttime, BN_FLG_CONSTTIME); if ((BN_sub(aux, rsa_q, BN_value_one()) == 0) || - (BN_mod(rsa_dmq1, d_consttime, aux, ctx) == 0) || + (BN_mod(*rsa_dmq1, d_consttime, aux, ctx) == 0) || (BN_sub(aux, rsa_p, BN_value_one()) == 0) || - (BN_mod(rsa_dmp1, d_consttime, aux, ctx) == 0)) { + (BN_mod(*rsa_dmp1, d_consttime, aux, ctx) == 0)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } - if (!RSA_set0_crt_params(key->rsa, rsa_dmp1, rsa_dmq1, rsa_iqmp)) { - r = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } - rsa_dmp1 = rsa_dmq1 = rsa_iqmp = NULL; /* transferred */ /* success */ r = 0; out: BN_clear_free(aux); BN_clear_free(d_consttime); - BN_clear_free(rsa_dmp1); - BN_clear_free(rsa_dmq1); - BN_clear_free(rsa_iqmp); BN_CTX_free(ctx); return r; } @@ -393,11 +406,10 @@ ssh_rsa_sign(struct sshkey *key, const u_char *data, size_t datalen, const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) { - const BIGNUM *rsa_n; - u_char digest[SSH_DIGEST_MAX_LENGTH], *sig = NULL; - size_t slen = 0; - u_int hlen, len; - int nid, hash_alg, ret = SSH_ERR_INTERNAL_ERROR; + u_char *sig = NULL; + size_t diff, len = 0; + int slen = 0; + int hash_alg, ret = SSH_ERR_INTERNAL_ERROR; struct sshbuf *b = NULL; if (lenp != NULL) @@ -409,41 +421,28 @@ ssh_rsa_sign(struct sshkey *key, hash_alg = SSH_DIGEST_SHA1; else hash_alg = rsa_hash_id_from_keyname(alg); - if (key == NULL || key->rsa == NULL || hash_alg == -1 || + + if (key == NULL || key->pkey == NULL || hash_alg == -1 || sshkey_type_plain(key->type) != KEY_RSA) return SSH_ERR_INVALID_ARGUMENT; - RSA_get0_key(key->rsa, &rsa_n, NULL, NULL); - if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE) - return SSH_ERR_KEY_LENGTH; - slen = RSA_size(key->rsa); + slen = EVP_PKEY_size(key->pkey); if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM) return SSH_ERR_INVALID_ARGUMENT; + if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE) + return SSH_ERR_KEY_LENGTH; - /* hash the data */ - nid = rsa_hash_alg_nid(hash_alg); - if ((hlen = ssh_digest_bytes(hash_alg)) == 0) - return SSH_ERR_INTERNAL_ERROR; - if ((ret = ssh_digest_memory(hash_alg, data, datalen, - digest, sizeof(digest))) != 0) - goto out; - - if ((sig = malloc(slen)) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - - if (RSA_sign(nid, digest, hlen, sig, &len, key->rsa) != 1) { - ret = SSH_ERR_LIBCRYPTO_ERROR; + if ((ret = sshkey_pkey_digest_sign(key->pkey, hash_alg, &sig, &len, + data, datalen)) < 0) goto out; - } - if (len < slen) { - size_t diff = slen - len; + if (len < (size_t)slen) { + diff = slen - len; memmove(sig + diff, sig, len); explicit_bzero(sig, diff); - } else if (len > slen) { + } else if (len > (size_t)slen) { ret = SSH_ERR_INTERNAL_ERROR; goto out; } + /* encode signature */ if ((b = sshbuf_new()) == NULL) { ret = SSH_ERR_ALLOC_FAIL; @@ -464,7 +463,6 @@ ssh_rsa_sign(struct sshkey *key, *lenp = len; ret = 0; out: - explicit_bzero(digest, sizeof(digest)); freezero(sig, slen); sshbuf_free(b); return ret; @@ -476,19 +474,17 @@ ssh_rsa_verify(const struct sshkey *key, const u_char *data, size_t dlen, const char *alg, u_int compat, struct sshkey_sig_details **detailsp) { - const BIGNUM *rsa_n; char *sigtype = NULL; int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR; - size_t len = 0, diff, modlen, hlen; + size_t len = 0, diff, modlen, rsasize; struct sshbuf *b = NULL; u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL; - if (key == NULL || key->rsa == NULL || + if (key == NULL || key->pkey == NULL || sshkey_type_plain(key->type) != KEY_RSA || sig == NULL || siglen == 0) return SSH_ERR_INVALID_ARGUMENT; - RSA_get0_key(key->rsa, &rsa_n, NULL, NULL); - if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE) + if (EVP_PKEY_bits(key->pkey) < SSH_RSA_MINIMUM_MODULUS_SIZE) return SSH_ERR_KEY_LENGTH; if ((b = sshbuf_from(sig, siglen)) == NULL) @@ -524,7 +520,7 @@ ssh_rsa_verify(const struct sshkey *key, goto out; } /* RSA_verify expects a signature of RSA_size */ - modlen = RSA_size(key->rsa); + modlen = EVP_PKEY_size(key->pkey); if (len > modlen) { ret = SSH_ERR_KEY_BITS_MISMATCH; goto out; @@ -540,16 +536,16 @@ ssh_rsa_verify(const struct sshkey *key, explicit_bzero(sigblob, diff); len = modlen; } - if ((hlen = ssh_digest_bytes(hash_alg)) == 0) { - ret = SSH_ERR_INTERNAL_ERROR; + + rsasize = EVP_PKEY_size(key->pkey); + if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM || + len == 0 || len > rsasize) { + ret = SSH_ERR_INVALID_ARGUMENT; goto out; } - if ((ret = ssh_digest_memory(hash_alg, data, dlen, - digest, sizeof(digest))) != 0) - goto out; + ret = sshkey_pkey_digest_verify(key->pkey, hash_alg, data, dlen, + sigblob, len); - ret = openssh_RSA_verify(hash_alg, digest, hlen, sigblob, len, - key->rsa); out: freezero(sigblob, len); free(sigtype); @@ -558,125 +554,6 @@ ssh_rsa_verify(const struct sshkey *key, return ret; } -/* - * See: - * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/ - * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn - */ - -/* - * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) - * oiw(14) secsig(3) algorithms(2) 26 } - */ -static const u_char id_sha1[] = { - 0x30, 0x21, /* type Sequence, length 0x21 (33) */ - 0x30, 0x09, /* type Sequence, length 0x09 */ - 0x06, 0x05, /* type OID, length 0x05 */ - 0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */ - 0x05, 0x00, /* NULL */ - 0x04, 0x14 /* Octet string, length 0x14 (20), followed by sha1 hash */ -}; - -/* - * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html - * id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) - * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2) - * id-sha256(1) } - */ -static const u_char id_sha256[] = { - 0x30, 0x31, /* type Sequence, length 0x31 (49) */ - 0x30, 0x0d, /* type Sequence, length 0x0d (13) */ - 0x06, 0x09, /* type OID, length 0x09 */ - 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, /* id-sha256 */ - 0x05, 0x00, /* NULL */ - 0x04, 0x20 /* Octet string, length 0x20 (32), followed by sha256 hash */ -}; - -/* - * See http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html - * id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) - * organization(1) gov(101) csor(3) nistAlgorithm(4) hashAlgs(2) - * id-sha256(3) } - */ -static const u_char id_sha512[] = { - 0x30, 0x51, /* type Sequence, length 0x51 (81) */ - 0x30, 0x0d, /* type Sequence, length 0x0d (13) */ - 0x06, 0x09, /* type OID, length 0x09 */ - 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, /* id-sha512 */ - 0x05, 0x00, /* NULL */ - 0x04, 0x40 /* Octet string, length 0x40 (64), followed by sha512 hash */ -}; - -static int -rsa_hash_alg_oid(int hash_alg, const u_char **oidp, size_t *oidlenp) -{ - switch (hash_alg) { - case SSH_DIGEST_SHA1: - *oidp = id_sha1; - *oidlenp = sizeof(id_sha1); - break; - case SSH_DIGEST_SHA256: - *oidp = id_sha256; - *oidlenp = sizeof(id_sha256); - break; - case SSH_DIGEST_SHA512: - *oidp = id_sha512; - *oidlenp = sizeof(id_sha512); - break; - default: - return SSH_ERR_INVALID_ARGUMENT; - } - return 0; -} - -static int -openssh_RSA_verify(int hash_alg, u_char *hash, size_t hashlen, - u_char *sigbuf, size_t siglen, RSA *rsa) -{ - size_t rsasize = 0, oidlen = 0, hlen = 0; - int ret, len, oidmatch, hashmatch; - const u_char *oid = NULL; - u_char *decrypted = NULL; - - if ((ret = rsa_hash_alg_oid(hash_alg, &oid, &oidlen)) != 0) - return ret; - ret = SSH_ERR_INTERNAL_ERROR; - hlen = ssh_digest_bytes(hash_alg); - if (hashlen != hlen) { - ret = SSH_ERR_INVALID_ARGUMENT; - goto done; - } - rsasize = RSA_size(rsa); - if (rsasize <= 0 || rsasize > SSHBUF_MAX_BIGNUM || - siglen == 0 || siglen > rsasize) { - ret = SSH_ERR_INVALID_ARGUMENT; - goto done; - } - if ((decrypted = malloc(rsasize)) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto done; - } - if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa, - RSA_PKCS1_PADDING)) < 0) { - ret = SSH_ERR_LIBCRYPTO_ERROR; - goto done; - } - if (len < 0 || (size_t)len != hlen + oidlen) { - ret = SSH_ERR_INVALID_FORMAT; - goto done; - } - oidmatch = timingsafe_bcmp(decrypted, oid, oidlen) == 0; - hashmatch = timingsafe_bcmp(decrypted + oidlen, hash, hlen) == 0; - if (!oidmatch || !hashmatch) { - ret = SSH_ERR_SIGNATURE_INVALID; - goto done; - } - ret = 0; -done: - freezero(decrypted, rsasize); - return ret; -} - static const struct sshkey_impl_funcs sshkey_rsa_funcs = { /* .size = */ ssh_rsa_size, /* .alloc = */ ssh_rsa_alloc, diff --git a/ssh-sk.c b/ssh-sk.c index d1c1880..a2a7d72 100644 --- a/ssh-sk.c +++ b/ssh-sk.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-sk.c,v 1.40 2023/07/19 14:02:27 djm Exp $ */ +/* $OpenBSD: ssh-sk.c,v 1.41 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2019 Google LLC * @@ -32,6 +32,7 @@ #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) #include #include +#include #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ #include "log.h" @@ -207,7 +208,9 @@ sshsk_ecdsa_assemble(struct sk_enroll_response *resp, struct sshkey **keyp) { struct sshkey *key = NULL; struct sshbuf *b = NULL; + EC_KEY *ecdsa = NULL; EC_POINT *q = NULL; + const EC_GROUP *g = NULL; int r; *keyp = NULL; @@ -217,8 +220,9 @@ sshsk_ecdsa_assemble(struct sk_enroll_response *resp, struct sshkey **keyp) goto out; } key->ecdsa_nid = NID_X9_62_prime256v1; - if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL || - (q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL || + if ((ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) == NULL || + (g = EC_KEY_get0_group(ecdsa)) == NULL || + (q = EC_POINT_new(g)) == NULL || (b = sshbuf_new()) == NULL) { error_f("allocation failed"); r = SSH_ERR_ALLOC_FAIL; @@ -229,30 +233,41 @@ sshsk_ecdsa_assemble(struct sk_enroll_response *resp, struct sshkey **keyp) error_fr(r, "sshbuf_put_string"); goto out; } - if ((r = sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa))) != 0) { + if ((r = sshbuf_get_ec(b, q, g)) != 0) { error_fr(r, "parse"); r = SSH_ERR_INVALID_FORMAT; goto out; } - if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), q) != 0) { + if (sshkey_ec_validate_public(g, q) != 0) { error("Authenticator returned invalid ECDSA key"); r = SSH_ERR_KEY_INVALID_EC_VALUE; goto out; } - if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { + if (EC_KEY_set_public_key(ecdsa, q) != 1) { /* XXX assume it is a allocation error */ error_f("allocation failed"); r = SSH_ERR_ALLOC_FAIL; goto out; } + if ((key->pkey = EVP_PKEY_new()) == NULL) { + error_f("allocation failed"); + r = SSH_ERR_ALLOC_FAIL; + goto out; + } + if (EVP_PKEY_set1_EC_KEY(key->pkey, ecdsa) != 1) { + error_f("Assigning EC_KEY failed"); + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } /* success */ *keyp = key; key = NULL; /* transferred */ r = 0; out: - EC_POINT_free(q); sshkey_free(key); sshbuf_free(b); + EC_KEY_free(ecdsa); + EC_POINT_free(q); return r; } #endif /* WITH_OPENSSL */ diff --git a/ssh.0 b/ssh.0 index f2c32af..497d816 100644 --- a/ssh.0 +++ b/ssh.0 @@ -145,25 +145,26 @@ DESCRIPTION file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally. The default is ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, - ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, ~/.ssh/id_ed25519_sk and - ~/.ssh/id_dsa. Identity files may also be specified on a per- - host basis in the configuration file. It is possible to have - multiple -i options (and multiple identities specified in - configuration files). If no certificates have been explicitly - specified by the CertificateFile directive, ssh will also try to - load certificate information from the filename obtained by - appending -cert.pub to identity filenames. + ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519_sk. + Identity files may also be specified on a per-host basis in the + configuration file. It is possible to have multiple -i options + (and multiple identities specified in configuration files). If + no certificates have been explicitly specified by the + CertificateFile directive, ssh will also try to load certificate + information from the filename obtained by appending -cert.pub to + identity filenames. -J destination Connect to the target host by first making an ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple - jump hops may be specified separated by comma characters. This - is a shortcut to specify a ProxyJump configuration directive. - Note that configuration directives supplied on the command-line - generally apply to the destination host and not any specified - jump hosts. Use ~/.ssh/config to specify configuration for jump - hosts. + jump hops may be specified separated by comma characters. IPv6 + addresses can be specified by enclosing the address in square + brackets. This is a shortcut to specify a ProxyJump + configuration directive. Note that configuration directives + supplied on the command-line generally apply to the destination + host and not any specified jump hosts. Use ~/.ssh/config to + specify configuration for jump hosts. -K Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI credentials to the server. @@ -233,7 +234,8 @@ DESCRIPTION and passed to the master process. Valid commands are: M-bM-^@M-^\checkM-bM-^@M-^] (check that the master process is running), M-bM-^@M-^\forwardM-bM-^@M-^] (request forwardings without command execution), M-bM-^@M-^\cancelM-bM-^@M-^] (cancel - forwardings), M-bM-^@M-^\exitM-bM-^@M-^] (request the master to exit), and M-bM-^@M-^\stopM-bM-^@M-^] + forwardings), M-bM-^@M-^\proxyM-bM-^@M-^] (connect to a running multiplexing master + in proxy mode), M-bM-^@M-^\exitM-bM-^@M-^] (request the master to exit), and M-bM-^@M-^\stopM-bM-^@M-^] (request the master to stop accepting further multiplexing requests). @@ -501,8 +503,7 @@ AUTHENTICATION creates a public/private key pair for authentication purposes. The server knows the public key, and only the user knows the private key. ssh implements public key authentication protocol automatically, using - one of the DSA, ECDSA, Ed25519 or RSA algorithms. The HISTORY section of - ssl(8) contains a brief discussion of the DSA and RSA algorithms. + one of the ECDSA, Ed25519 or RSA algorithms. The file ~/.ssh/authorized_keys lists the public keys that are permitted for logging in. When the user logs in, the ssh program tells the server @@ -516,18 +517,18 @@ AUTHENTICATION DEBUG or higher (e.g. by using the -v flag). The user creates their key pair by running ssh-keygen(1). This stores - the private key in ~/.ssh/id_dsa (DSA), ~/.ssh/id_ecdsa (ECDSA), - ~/.ssh/id_ecdsa_sk (authenticator-hosted ECDSA), ~/.ssh/id_ed25519 - (Ed25519), ~/.ssh/id_ed25519_sk (authenticator-hosted Ed25519), or - ~/.ssh/id_rsa (RSA) and stores the public key in ~/.ssh/id_dsa.pub (DSA), - ~/.ssh/id_ecdsa.pub (ECDSA), ~/.ssh/id_ecdsa_sk.pub (authenticator-hosted - ECDSA), ~/.ssh/id_ed25519.pub (Ed25519), ~/.ssh/id_ed25519_sk.pub - (authenticator-hosted Ed25519), or ~/.ssh/id_rsa.pub (RSA) in the user's - home directory. The user should then copy the public key to - ~/.ssh/authorized_keys in their home directory on the remote machine. - The authorized_keys file corresponds to the conventional ~/.rhosts file, - and has one key per line, though the lines can be very long. After this, - the user can log in without giving the password. + the private key in ~/.ssh/id_ecdsa (ECDSA), ~/.ssh/id_ecdsa_sk + (authenticator-hosted ECDSA), ~/.ssh/id_ed25519 (Ed25519), + ~/.ssh/id_ed25519_sk (authenticator-hosted Ed25519), or ~/.ssh/id_rsa + (RSA) and stores the public key in ~/.ssh/id_ecdsa.pub (ECDSA), + ~/.ssh/id_ecdsa_sk.pub (authenticator-hosted ECDSA), + ~/.ssh/id_ed25519.pub (Ed25519), ~/.ssh/id_ed25519_sk.pub (authenticator- + hosted Ed25519), or ~/.ssh/id_rsa.pub (RSA) in the user's home directory. + The user should then copy the public key to ~/.ssh/authorized_keys in + their home directory on the remote machine. The authorized_keys file + corresponds to the conventional ~/.rhosts file, and has one key per line, + though the lines can be very long. After this, the user can log in + without giving the password. A variation on public key authentication is available in the form of certificate authentication: instead of a set of public/private keys, @@ -879,11 +880,11 @@ FILES for the user, and not accessible by others. ~/.ssh/authorized_keys - Lists the public keys (DSA, ECDSA, Ed25519, RSA) that can be used - for logging in as this user. The format of this file is - described in the sshd(8) manual page. This file is not highly - sensitive, but the recommended permissions are read/write for the - user, and not accessible by others. + Lists the public keys (ECDSA, Ed25519, RSA) that can be used for + logging in as this user. The format of this file is described in + the sshd(8) manual page. This file is not highly sensitive, but + the recommended permissions are read/write for the user, and not + accessible by others. ~/.ssh/config This is the per-user configuration file. The file format and @@ -895,7 +896,6 @@ FILES Contains additional definitions for environment variables; see ENVIRONMENT, above. - ~/.ssh/id_dsa ~/.ssh/id_ecdsa ~/.ssh/id_ecdsa_sk ~/.ssh/id_ed25519 @@ -909,7 +909,6 @@ FILES will be used to encrypt the sensitive part of this file using AES-128. - ~/.ssh/id_dsa.pub ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub @@ -942,8 +941,6 @@ FILES Systemwide configuration file. The file format and configuration options are described in ssh_config(5). - /etc/ssh/ssh_host_key - /etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key @@ -1020,4 +1017,4 @@ AUTHORS created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0. -OpenBSD 7.5 October 11, 2023 OpenBSD 7.5 +OpenBSD 7.5 July 18, 2024 OpenBSD 7.5 diff --git a/ssh.1 b/ssh.1 index 936c995..710d3d4 100644 --- a/ssh.1 +++ b/ssh.1 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh.1,v 1.438 2023/10/11 23:14:33 djm Exp $ -.Dd $Mdocdate: October 11 2023 $ +.\" $OpenBSD: ssh.1,v 1.443 2024/07/18 01:47:27 djm Exp $ +.Dd $Mdocdate: July 18 2024 $ .Dt SSH 1 .Os .Sh NAME @@ -304,10 +304,9 @@ The default is .Pa ~/.ssh/id_rsa , .Pa ~/.ssh/id_ecdsa , .Pa ~/.ssh/id_ecdsa_sk , -.Pa ~/.ssh/id_ed25519 , -.Pa ~/.ssh/id_ed25519_sk +.Pa ~/.ssh/id_ed25519 and -.Pa ~/.ssh/id_dsa . +.Pa ~/.ssh/id_ed25519_sk . Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple @@ -331,6 +330,7 @@ connection to the jump host described by and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. +IPv6 addresses can be specified by enclosing the address in square brackets. This is a shortcut to specify a .Cm ProxyJump configuration directive. @@ -490,6 +490,8 @@ Valid commands are: (request forwardings without command execution), .Dq cancel (cancel forwardings), +.Dq proxy +(connect to a running multiplexing master in proxy mode), .Dq exit (request the master to exit), and .Dq stop @@ -928,10 +930,7 @@ key pair for authentication purposes. The server knows the public key, and only the user knows the private key. .Nm implements public key authentication protocol automatically, -using one of the DSA, ECDSA, Ed25519 or RSA algorithms. -The HISTORY section of -.Xr ssl 8 -contains a brief discussion of the DSA and RSA algorithms. +using one of the ECDSA, Ed25519 or RSA algorithms. .Pp The file .Pa ~/.ssh/authorized_keys @@ -958,8 +957,6 @@ flag). The user creates their key pair by running .Xr ssh-keygen 1 . This stores the private key in -.Pa ~/.ssh/id_dsa -(DSA), .Pa ~/.ssh/id_ecdsa (ECDSA), .Pa ~/.ssh/id_ecdsa_sk @@ -972,8 +969,6 @@ or .Pa ~/.ssh/id_rsa (RSA) and stores the public key in -.Pa ~/.ssh/id_dsa.pub -(DSA), .Pa ~/.ssh/id_ecdsa.pub (ECDSA), .Pa ~/.ssh/id_ecdsa_sk.pub @@ -1555,7 +1550,7 @@ secret, but the recommended permissions are read/write/execute for the user, and not accessible by others. .Pp .It Pa ~/.ssh/authorized_keys -Lists the public keys (DSA, ECDSA, Ed25519, RSA) +Lists the public keys (ECDSA, Ed25519, RSA) that can be used for logging in as this user. The format of this file is described in the .Xr sshd 8 @@ -1575,7 +1570,6 @@ Contains additional definitions for environment variables; see .Sx ENVIRONMENT , above. .Pp -.It Pa ~/.ssh/id_dsa .It Pa ~/.ssh/id_ecdsa .It Pa ~/.ssh/id_ecdsa_sk .It Pa ~/.ssh/id_ed25519 @@ -1591,7 +1585,6 @@ It is possible to specify a passphrase when generating the key which will be used to encrypt the sensitive part of this file using AES-128. .Pp -.It Pa ~/.ssh/id_dsa.pub .It Pa ~/.ssh/id_ecdsa.pub .It Pa ~/.ssh/id_ecdsa_sk.pub .It Pa ~/.ssh/id_ed25519.pub @@ -1632,8 +1625,6 @@ Systemwide configuration file. The file format and configuration options are described in .Xr ssh_config 5 . .Pp -.It Pa /etc/ssh/ssh_host_key -.It Pa /etc/ssh/ssh_host_dsa_key .It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ed25519_key .It Pa /etc/ssh/ssh_host_rsa_key diff --git a/ssh_api.c b/ssh_api.c index fadf2f4..5faaffd 100644 --- a/ssh_api.c +++ b/ssh_api.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh_api.c,v 1.28 2024/01/09 21:39:14 djm Exp $ */ +/* $OpenBSD: ssh_api.c,v 1.31 2024/09/09 02:39:57 djm Exp $ */ /* * Copyright (c) 2012 Markus Friedl. All rights reserved. * @@ -27,6 +27,7 @@ #include "log.h" #include "authfile.h" #include "sshkey.h" +#include "dh.h" #include "misc.h" #include "ssh2.h" #include "version.h" @@ -49,10 +50,8 @@ int _ssh_host_key_sign(struct ssh *, struct sshkey *, struct sshkey *, u_char **, size_t *, const u_char *, size_t, const char *); /* - * stubs for the server side implementation of kex. - * disable privsep so our stubs will never be called. + * stubs for privsep calls in the server side implementation of kex. */ -int use_privsep = 0; int mm_sshkey_sign(struct sshkey *, u_char **, u_int *, const u_char *, u_int, const char *, const char *, const char *, u_int); @@ -65,14 +64,20 @@ mm_sshkey_sign(struct sshkey *key, u_char **sigp, u_int *lenp, const u_char *data, u_int datalen, const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) { - return (-1); + size_t slen = 0; + int ret; + + ret = sshkey_sign(key, sigp, &slen, data, datalen, alg, + sk_provider, sk_pin, compat); + *lenp = slen; + return ret; } #ifdef WITH_OPENSSL DH * mm_choose_dh(int min, int nbits, int max) { - return (NULL); + return choose_dh(min, nbits, max); } #endif @@ -129,6 +134,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_server; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; + ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; ssh->kex->load_host_public_key=&_ssh_host_public_key; ssh->kex->load_host_private_key=&_ssh_host_private_key; ssh->kex->sign=&_ssh_host_key_sign; @@ -147,6 +153,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) #endif /* WITH_OPENSSL */ ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; + ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client; ssh->kex->verify_host_key =&_ssh_verify_host_key; } *sshp = ssh; diff --git a/ssh_config.0 b/ssh_config.0 index aaf8b14..abb4ac9 100644 --- a/ssh_config.0 +++ b/ssh_config.0 @@ -662,19 +662,19 @@ DESCRIPTION VARIABLES section. IdentityFile - Specifies a file from which the user's DSA, ECDSA, authenticator- + Specifies a file from which the user's ECDSA, authenticator- hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity is read. You can also specify a public key file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally. The default is ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, - ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, ~/.ssh/id_ed25519_sk and - ~/.ssh/id_dsa. Additionally, any identities represented by the - authentication agent will be used for authentication unless - IdentitiesOnly is set. If no certificates have been explicitly - specified by CertificateFile, ssh(1) will try to load certificate - information from the filename obtained by appending -cert.pub to - the path of a specified IdentityFile. + ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519_sk. + Additionally, any identities represented by the authentication + agent will be used for authentication unless IdentitiesOnly is + set. If no certificates have been explicitly specified by + CertificateFile, ssh(1) will try to load certificate information + from the filename obtained by appending -cert.pub to the path of + a specified IdentityFile. Arguments to IdentityFile may use the tilde syntax to refer to a user's home directory or the tokens described in the TOKENS @@ -703,14 +703,15 @@ DESCRIPTION Include Include the specified configuration file(s). Multiple pathnames - may be specified and each pathname may contain glob(7) wildcards - and, for user configurations, shell-like M-bM-^@M-^X~M-bM-^@M-^Y references to user - home directories. Wildcards will be expanded and processed in - lexical order. Files without absolute paths are assumed to be in - ~/.ssh if included in a user configuration file or /etc/ssh if - included from the system configuration file. Include directive - may appear inside a Match or Host block to perform conditional - inclusion. + may be specified and each pathname may contain glob(7) wildcards, + tokens as described in the TOKENS section, environment variables + as described in the ENVIRONMENT VARIABLES section and, for user + configurations, shell-like M-bM-^@M-^X~M-bM-^@M-^Y references to user home + directories. Wildcards will be expanded and processed in lexical + order. Files without absolute paths are assumed to be in ~/.ssh + if included in a user configuration file or /etc/ssh if included + from the system configuration file. Include directive may appear + inside a Match or Host block to perform conditional inclusion. IPQoS Specifies the IPv4 type-of-service or DSCP class for connections. Accepted values are af11, af12, af13, af21, af22, af23, af31, @@ -738,17 +739,24 @@ DESCRIPTION OpenSSH server, it may be zero or more of: bsdauth and pam. KexAlgorithms - Specifies the available KEX (Key Exchange) algorithms. Multiple - algorithms must be comma-separated. If the specified list begins - with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified algorithms will be - appended to the default set instead of replacing them. If the - specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the specified - algorithms (including wildcards) will be removed from the default - set instead of replacing them. If the specified list begins with - a M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified algorithms will be placed at - the head of the default set. The default is: + Specifies the permitted KEX (Key Exchange) algorithms that will + be used and their preference order. The selected algorithm will + be the first algorithm in this list that the server also + supports. Multiple algorithms must be comma-separated. + + If the specified list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the + specified algorithms will be appended to the default set instead + of replacing them. If the specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y + character, then the specified algorithms (including wildcards) + will be removed from the default set instead of replacing them. + If the specified list begins with a M-bM-^@M-^X^M-bM-^@M-^Y character, then the + specified algorithms will be placed at the head of the default + set. + + The default is: - sntrup761x25519-sha512@openssh.com, + sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, + mlkem768x25519-sha256, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, @@ -756,7 +764,7 @@ DESCRIPTION diffie-hellman-group18-sha512, diffie-hellman-group14-sha256 - The list of available key exchange algorithms may also be + The list of supported key exchange algorithms may also be obtained using "ssh -Q kex". KnownHostsCommand @@ -819,9 +827,9 @@ DESCRIPTION LogVerbose Specify one or more overrides to LogLevel. An override consists - of a pattern lists that matches the source file, function and - line number to force detailed logging for. For example, an - override pattern of: + of one or more pattern lists that matches the source file, + function and line number to force detailed logging for. For + example, an override pattern of: kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* @@ -1367,7 +1375,7 @@ TOKENS %t The type of the server host key, e.g. ssh-ed25519. %u The local username. - CertificateFile, ControlPath, IdentityAgent, IdentityFile, + CertificateFile, ControlPath, IdentityAgent, IdentityFile, Include, KnownHostsCommand, LocalForward, Match exec, RemoteCommand, RemoteForward, RevokedHostKeys, and UserKnownHostsFile accept the tokens %%, %C, %d, %h, %i, %j, %k, %L, %l, %n, %p, %r, and %u. @@ -1395,9 +1403,9 @@ ENVIRONMENT VARIABLES the setting for that keyword will be ignored. The keywords CertificateFile, ControlPath, IdentityAgent, IdentityFile, - KnownHostsCommand, and UserKnownHostsFile support environment variables. - The keywords LocalForward and RemoteForward support environment variables - only for Unix domain socket paths. + Include, KnownHostsCommand, and UserKnownHostsFile support environment + variables. The keywords LocalForward and RemoteForward support + environment variables only for Unix domain socket paths. FILES ~/.ssh/config @@ -1422,4 +1430,4 @@ AUTHORS created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0. -OpenBSD 7.5 February 21, 2024 OpenBSD 7.5 +OpenBSD 7.5 September 9, 2024 OpenBSD 7.5 diff --git a/ssh_config.5 b/ssh_config.5 index 2931d80..7c7c5c5 100644 --- a/ssh_config.5 +++ b/ssh_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh_config.5,v 1.394 2024/02/21 06:01:13 djm Exp $ -.Dd $Mdocdate: February 21 2024 $ +.\" $OpenBSD: ssh_config.5,v 1.402 2024/09/09 14:41:21 naddy Exp $ +.Dd $Mdocdate: September 9 2024 $ .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -1114,7 +1114,7 @@ section and environment variables as described in the .Sx ENVIRONMENT VARIABLES section. .It Cm IdentityFile -Specifies a file from which the user's DSA, ECDSA, authenticator-hosted ECDSA, +Specifies a file from which the user's ECDSA, authenticator-hosted ECDSA, Ed25519, authenticator-hosted Ed25519 or RSA authentication identity is read. You can also specify a public key file to use the corresponding private key that is loaded in @@ -1124,10 +1124,9 @@ The default is .Pa ~/.ssh/id_rsa , .Pa ~/.ssh/id_ecdsa , .Pa ~/.ssh/id_ecdsa_sk , -.Pa ~/.ssh/id_ed25519 , -.Pa ~/.ssh/id_ed25519_sk +.Pa ~/.ssh/id_ed25519 and -.Pa ~/.ssh/id_dsa . +.Pa ~/.ssh/id_ed25519_sk . Additionally, any identities represented by the authentication agent will be used for authentication unless .Cm IdentitiesOnly @@ -1183,7 +1182,12 @@ to unknown options that appear before it. Include the specified configuration file(s). Multiple pathnames may be specified and each pathname may contain .Xr glob 7 -wildcards and, for user configurations, shell-like +wildcards, +tokens as described in the +.Sx TOKENS +section, environment variables as described in the +.Sx ENVIRONMENT VARIABLES +section and, for user configurations, shell-like .Sq ~ references to user home directories. Wildcards will be expanded and processed in lexical order. @@ -1261,8 +1265,12 @@ it may be zero or more of: and .Cm pam . .It Cm KexAlgorithms -Specifies the available KEX (Key Exchange) algorithms. +Specifies the permitted KEX (Key Exchange) algorithms that will be used and +their preference order. +The selected algorithm will be the first algorithm in this list that +the server also supports. Multiple algorithms must be comma-separated. +.Pp If the specified list begins with a .Sq + character, then the specified algorithms will be appended to the default set @@ -1275,9 +1283,11 @@ If the specified list begins with a .Sq ^ character, then the specified algorithms will be placed at the head of the default set. +.Pp The default is: .Bd -literal -offset indent -sntrup761x25519-sha512@openssh.com, +sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, +mlkem768x25519-sha256, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, @@ -1286,7 +1296,7 @@ diffie-hellman-group18-sha512, diffie-hellman-group14-sha256 .Ed .Pp -The list of available key exchange algorithms may also be obtained using +The list of supported key exchange algorithms may also be obtained using .Qq ssh -Q kex . .It Cm KnownHostsCommand Specifies a command to use to obtain a list of host keys, in addition to @@ -1378,8 +1388,8 @@ DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output. .It Cm LogVerbose Specify one or more overrides to LogLevel. -An override consists of a pattern lists that matches the source file, function -and line number to force detailed logging for. +An override consists of one or more pattern lists that matches the +source file, function and line number to force detailed logging for. For example, an override pattern of: .Bd -literal -offset indent kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* @@ -2266,6 +2276,7 @@ The local username. .Cm ControlPath , .Cm IdentityAgent , .Cm IdentityFile , +.Cm Include , .Cm KnownHostsCommand , .Cm LocalForward , .Cm Match exec , @@ -2314,6 +2325,7 @@ The keywords .Cm ControlPath , .Cm IdentityAgent , .Cm IdentityFile , +.Cm Include , .Cm KnownHostsCommand , and .Cm UserKnownHostsFile diff --git a/sshbuf-getput-crypto.c b/sshbuf-getput-crypto.c index af3f397..e7bffe2 100644 --- a/sshbuf-getput-crypto.c +++ b/sshbuf-getput-crypto.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshbuf-getput-crypto.c,v 1.11 2024/02/01 02:37:33 djm Exp $ */ +/* $OpenBSD: sshbuf-getput-crypto.c,v 1.12 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -176,5 +176,15 @@ sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v) return sshbuf_put_ec(buf, EC_KEY_get0_public_key(v), EC_KEY_get0_group(v)); } + +int +sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey) +{ + const EC_KEY *ec; + + if ((ec = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) + return SSH_ERR_LIBCRYPTO_ERROR; + return sshbuf_put_eckey(buf, ec); +} #endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ diff --git a/sshbuf.c b/sshbuf.c index d7f4e4a..1b714e5 100644 --- a/sshbuf.c +++ b/sshbuf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshbuf.c,v 1.19 2022/12/02 04:40:27 djm Exp $ */ +/* $OpenBSD: sshbuf.c,v 1.23 2024/08/14 15:42:18 tobias Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -57,6 +57,7 @@ sshbuf_check_sanity(const struct sshbuf *buf) SSHBUF_TELL("sanity"); if (__predict_false(buf == NULL || (!buf->readonly && buf->d != buf->cd) || + buf->parent == buf || buf->refcount < 1 || buf->refcount > SSHBUF_REFS_MAX || buf->cd == NULL || buf->max_size > SSHBUF_SIZE_MAX || @@ -93,7 +94,7 @@ sshbuf_new(void) { struct sshbuf *ret; - if ((ret = calloc(sizeof(*ret), 1)) == NULL) + if ((ret = calloc(1, sizeof(*ret))) == NULL) return NULL; ret->alloc = SSHBUF_SIZE_INIT; ret->max_size = SSHBUF_SIZE_MAX; @@ -113,7 +114,7 @@ sshbuf_from(const void *blob, size_t len) struct sshbuf *ret; if (blob == NULL || len > SSHBUF_SIZE_MAX || - (ret = calloc(sizeof(*ret), 1)) == NULL) + (ret = calloc(1, sizeof(*ret))) == NULL) return NULL; ret->alloc = ret->size = ret->max_size = len; ret->readonly = 1; @@ -132,7 +133,8 @@ sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent) if ((r = sshbuf_check_sanity(child)) != 0 || (r = sshbuf_check_sanity(parent)) != 0) return r; - if (child->parent != NULL && child->parent != parent) + if ((child->parent != NULL && child->parent != parent) || + child == parent) return SSH_ERR_INTERNAL_ERROR; child->parent = parent; child->parent->refcount++; @@ -179,16 +181,14 @@ sshbuf_free(struct sshbuf *buf) return; /* - * If we are a child, the free our parent to decrement its reference + * If we are a child, then free our parent to decrement its reference * count and possibly free it. */ sshbuf_free(buf->parent); buf->parent = NULL; - if (!buf->readonly) { - explicit_bzero(buf->d, buf->alloc); - free(buf->d); - } + if (!buf->readonly) + freezero(buf->d, buf->alloc); freezero(buf, sizeof(*buf)); } diff --git a/sshbuf.h b/sshbuf.h index e2155f9..49c32af 100644 --- a/sshbuf.h +++ b/sshbuf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: sshbuf.h,v 1.28 2022/12/02 04:40:27 djm Exp $ */ +/* $OpenBSD: sshbuf.h,v 1.29 2024/08/15 00:51:51 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -23,6 +23,7 @@ #include #ifdef WITH_OPENSSL # include +# include # ifdef OPENSSL_HAS_ECC # include # endif /* OPENSSL_HAS_ECC */ @@ -223,6 +224,7 @@ int sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g); int sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v); int sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g); int sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v); +int sshbuf_put_ec_pkey(struct sshbuf *buf, EVP_PKEY *pkey); # endif /* OPENSSL_HAS_ECC */ #endif /* WITH_OPENSSL */ diff --git a/sshconnect.c b/sshconnect.c index d8efc50..7cf6b63 100644 --- a/sshconnect.c +++ b/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.366 2024/01/11 01:45:36 djm Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.368 2024/04/30 02:10:49 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -57,6 +57,7 @@ #include "sshkey.h" #include "sshconnect.h" #include "log.h" +#include "match.h" #include "misc.h" #include "readconf.h" #include "atomicio.h" @@ -647,7 +648,7 @@ get_hostfile_hostname_ipaddr(char *hostname, struct sockaddr *hostaddr, if (options.proxy_command == NULL) { if (getnameinfo(hostaddr, addrlen, ntop, sizeof(ntop), NULL, 0, NI_NUMERICHOST) != 0) - fatal_f("getnameinfo failed"); + fatal_f("getnameinfo failed"); *hostfile_ipaddr = put_host_port(ntop, port); } else { *hostfile_ipaddr = xstrdup("type == KEY_UNSPEC) + return 0; + if (key->type == KEY_RSA && + (match_pattern_list("rsa-sha2-256", hostkeyalgs, 0) == 1 || + match_pattern_list("rsa-sha2-512", hostkeyalgs, 0) == 1)) + return 1; + if (key->type == KEY_RSA_CERT && + (match_pattern_list("rsa-sha2-512-cert-v01@openssh.com", hostkeyalgs, 0) == 1 || + match_pattern_list("rsa-sha2-256-cert-v01@openssh.com", hostkeyalgs, 0) == 1)) + return 1; + return match_pattern_list(ktype, hostkeyalgs, 0) == 1; +} + static int hostkeys_find_by_key_cb(struct hostkey_foreach_line *l, void *_ctx) { @@ -1017,6 +1041,12 @@ check_host_key(char *hostname, const struct ssh_conn_info *cinfo, } retry: + if (!hostkey_accepted_by_hostkeyalgs(host_key)) { + error("host key %s not permitted by HostkeyAlgorithms", + sshkey_ssh_name(host_key)); + goto fail; + } + /* Reload these as they may have changed on cert->key downgrade */ want_cert = sshkey_is_cert(host_key); type = sshkey_type(host_key); diff --git a/sshconnect.h b/sshconnect.h index 79d35cc..8b0466f 100644 --- a/sshconnect.h +++ b/sshconnect.h @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.h,v 1.47 2023/10/12 02:18:18 djm Exp $ */ +/* $OpenBSD: sshconnect.h,v 1.48 2024/04/30 02:10:49 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. @@ -24,6 +24,8 @@ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +struct sshkey; + typedef struct Sensitive Sensitive; struct Sensitive { struct sshkey **keys; @@ -94,3 +96,5 @@ void maybe_add_key_to_agent(const char *, struct sshkey *, void load_hostkeys_command(struct hostkeys *, const char *, const char *, const struct ssh_conn_info *, const struct sshkey *, const char *); + +int hostkey_accepted_by_hostkeyalgs(const struct sshkey *); diff --git a/sshconnect2.c b/sshconnect2.c index 745c2a0..11fcdea 100644 --- a/sshconnect2.c +++ b/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.372 2024/01/08 00:34:34 djm Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.375 2024/09/09 02:39:57 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -80,8 +80,6 @@ #endif /* import */ -extern char *client_version_string; -extern char *server_version_string; extern Options options; /* @@ -276,6 +274,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, #endif ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; + ssh->kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_client; ssh->kex->verify_host_key=&verify_host_key_callback; ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done); diff --git a/sshd-session.c b/sshd-session.c new file mode 100644 index 0000000..4b79b9b --- /dev/null +++ b/sshd-session.c @@ -0,0 +1,1515 @@ +/* $OpenBSD: sshd-session.c,v 1.9 2024/09/09 02:39:57 djm Exp $ */ +/* + * SSH2 implementation: + * Privilege Separation: + * + * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved. + * Copyright (c) 2002 Niels Provos. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "includes.h" + +#include +#include +#include +#ifdef HAVE_SYS_STAT_H +# include +#endif +#ifdef HAVE_SYS_TIME_H +# include +#endif +#include "openbsd-compat/sys-tree.h" +#include "openbsd-compat/sys-queue.h" +#include + +#include +#include +#include +#ifdef HAVE_PATHS_H +# include +#endif +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#ifdef WITH_OPENSSL +#include +#include +#include +#include "openbsd-compat/openssl-compat.h" +#endif + +#ifdef HAVE_SECUREWARE +#include +#include +#endif + +#include "xmalloc.h" +#include "ssh.h" +#include "ssh2.h" +#include "sshpty.h" +#include "packet.h" +#include "log.h" +#include "sshbuf.h" +#include "misc.h" +#include "match.h" +#include "servconf.h" +#include "uidswap.h" +#include "compat.h" +#include "cipher.h" +#include "digest.h" +#include "sshkey.h" +#include "kex.h" +#include "authfile.h" +#include "pathnames.h" +#include "atomicio.h" +#include "canohost.h" +#include "hostfile.h" +#include "auth.h" +#include "authfd.h" +#include "msg.h" +#include "dispatch.h" +#include "channels.h" +#include "session.h" +#include "monitor.h" +#ifdef GSSAPI +#include "ssh-gss.h" +#endif +#include "monitor_wrap.h" +#include "ssh-sandbox.h" +#include "auth-options.h" +#include "version.h" +#include "ssherr.h" +#include "sk-api.h" +#include "srclimit.h" +#include "dh.h" + +/* Re-exec fds */ +#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) +#define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) +#define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3) +#define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4) + +extern char *__progname; + +/* Server configuration options. */ +ServerOptions options; + +/* Name of the server configuration file. */ +char *config_file_name = _PATH_SERVER_CONFIG_FILE; + +/* + * Debug mode flag. This can be set on the command line. If debug + * mode is enabled, extra debugging output will be sent to the system + * log, the daemon will not go to background, and will exit after processing + * the first connection. + */ +int debug_flag = 0; + +/* Flag indicating that the daemon is being started from inetd. */ +static int inetd_flag = 0; + +/* debug goes to stderr unless inetd_flag is set */ +static int log_stderr = 0; + +/* Saved arguments to main(). */ +static char **saved_argv; +static int saved_argc; + +/* Daemon's agent connection */ +int auth_sock = -1; +static int have_agent = 0; + +/* + * Any really sensitive data in the application is contained in this + * structure. The idea is that this structure could be locked into memory so + * that the pages do not get written into swap. However, there are some + * problems. The private key contains BIGNUMs, and we do not (in principle) + * have access to the internals of them, and locking just the structure is + * not very useful. Currently, memory locking is not implemented. + */ +struct { + u_int num_hostkeys; + struct sshkey **host_keys; /* all private host keys */ + struct sshkey **host_pubkeys; /* all public host keys */ + struct sshkey **host_certificates; /* all public host certificates */ +} sensitive_data; + +/* record remote hostname or ip */ +u_int utmp_len = HOST_NAME_MAX+1; + +static int startup_pipe = -1; /* in child */ + +/* variables used for privilege separation */ +struct monitor *pmonitor = NULL; +int privsep_is_preauth = 1; +static int privsep_chroot = 1; + +/* Unprivileged user */ +struct passwd *privsep_pw = NULL; + +/* global connection state and authentication contexts */ +Authctxt *the_authctxt = NULL; +struct ssh *the_active_state; + +/* global key/cert auth options. XXX move to permanent ssh->authctxt? */ +struct sshauthopt *auth_opts = NULL; + +/* sshd_config buffer */ +struct sshbuf *cfg; + +/* Included files from the configuration file */ +struct include_list includes = TAILQ_HEAD_INITIALIZER(includes); + +/* message to be displayed after login */ +struct sshbuf *loginmsg; + +/* Prototypes for various functions defined later in this file. */ +void destroy_sensitive_data(void); +void demote_sensitive_data(void); +static void do_ssh2_kex(struct ssh *); + +/* + * Signal handler for the alarm after the login grace period has expired. + * As usual, this may only take signal-safe actions, even though it is + * terminal. + */ +static void +grace_alarm_handler(int sig) +{ + /* + * Try to kill any processes that we have spawned, E.g. authorized + * keys command helpers or privsep children. + */ + if (getpgid(0) == getpid()) { + struct sigaction sa; + + /* mask all other signals while in handler */ + memset(&sa, 0, sizeof(sa)); + sa.sa_handler = SIG_IGN; + sigfillset(&sa.sa_mask); +#if defined(SA_RESTART) + sa.sa_flags = SA_RESTART; +#endif + (void)sigaction(SIGTERM, &sa, NULL); + kill(0, SIGTERM); + } + _exit(EXIT_LOGIN_GRACE); +} + +/* Destroy the host and server keys. They will no longer be needed. */ +void +destroy_sensitive_data(void) +{ + u_int i; + + for (i = 0; i < options.num_host_key_files; i++) { + if (sensitive_data.host_keys[i]) { + sshkey_free(sensitive_data.host_keys[i]); + sensitive_data.host_keys[i] = NULL; + } + if (sensitive_data.host_certificates[i]) { + sshkey_free(sensitive_data.host_certificates[i]); + sensitive_data.host_certificates[i] = NULL; + } + } +} + +/* Demote private to public keys for network child */ +void +demote_sensitive_data(void) +{ + struct sshkey *tmp; + u_int i; + int r; + + for (i = 0; i < options.num_host_key_files; i++) { + if (sensitive_data.host_keys[i]) { + if ((r = sshkey_from_private( + sensitive_data.host_keys[i], &tmp)) != 0) + fatal_r(r, "could not demote host %s key", + sshkey_type(sensitive_data.host_keys[i])); + sshkey_free(sensitive_data.host_keys[i]); + sensitive_data.host_keys[i] = tmp; + } + /* Certs do not need demotion */ + } +} + +static void +reseed_prngs(void) +{ + u_int32_t rnd[256]; + +#ifdef WITH_OPENSSL + RAND_poll(); +#endif + arc4random_stir(); /* noop on recent arc4random() implementations */ + arc4random_buf(rnd, sizeof(rnd)); /* let arc4random notice PID change */ + +#ifdef WITH_OPENSSL + RAND_seed(rnd, sizeof(rnd)); + /* give libcrypto a chance to notice the PID change */ + if ((RAND_bytes((u_char *)rnd, 1)) != 1) + fatal("%s: RAND_bytes failed", __func__); +#endif + + explicit_bzero(rnd, sizeof(rnd)); +} + +static void +privsep_preauth_child(void) +{ + gid_t gidset[1]; + + /* Enable challenge-response authentication for privilege separation */ + privsep_challenge_enable(); + +#ifdef GSSAPI + /* Cache supported mechanism OIDs for later use */ + ssh_gssapi_prepare_supported_oids(); +#endif + + reseed_prngs(); + + /* Demote the private keys to public keys. */ + demote_sensitive_data(); + + /* Demote the child */ + if (privsep_chroot) { + /* Change our root directory */ + if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1) + fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR, + strerror(errno)); + if (chdir("/") == -1) + fatal("chdir(\"/\"): %s", strerror(errno)); + + /* Drop our privileges */ + debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid, + (u_int)privsep_pw->pw_gid); + gidset[0] = privsep_pw->pw_gid; + if (setgroups(1, gidset) == -1) + fatal("setgroups: %.100s", strerror(errno)); + permanently_set_uid(privsep_pw); + } +} + +static int +privsep_preauth(struct ssh *ssh) +{ + int status, r; + pid_t pid; + struct ssh_sandbox *box = NULL; + + /* Set up unprivileged child process to deal with network data */ + pmonitor = monitor_init(); + /* Store a pointer to the kex for later rekeying */ + pmonitor->m_pkex = &ssh->kex; + + box = ssh_sandbox_init(pmonitor); + pid = fork(); + if (pid == -1) { + fatal("fork of unprivileged child failed"); + } else if (pid != 0) { + debug2("Network child is on pid %ld", (long)pid); + + pmonitor->m_pid = pid; + if (have_agent) { + r = ssh_get_authentication_socket(&auth_sock); + if (r != 0) { + error_r(r, "Could not get agent socket"); + have_agent = 0; + } + } + if (box != NULL) + ssh_sandbox_parent_preauth(box, pid); + monitor_child_preauth(ssh, pmonitor); + + /* Wait for the child's exit status */ + while (waitpid(pid, &status, 0) == -1) { + if (errno == EINTR) + continue; + pmonitor->m_pid = -1; + fatal_f("waitpid: %s", strerror(errno)); + } + privsep_is_preauth = 0; + pmonitor->m_pid = -1; + if (WIFEXITED(status)) { + if (WEXITSTATUS(status) != 0) + fatal_f("preauth child exited with status %d", + WEXITSTATUS(status)); + } else if (WIFSIGNALED(status)) + fatal_f("preauth child terminated by signal %d", + WTERMSIG(status)); + if (box != NULL) + ssh_sandbox_parent_finish(box); + return 1; + } else { + /* child */ + close(pmonitor->m_sendfd); + close(pmonitor->m_log_recvfd); + + /* Arrange for logging to be sent to the monitor */ + set_log_handler(mm_log_handler, pmonitor); + + privsep_preauth_child(); + setproctitle("%s", "[net]"); + if (box != NULL) + ssh_sandbox_child(box); + + return 0; + } +} + +static void +privsep_postauth(struct ssh *ssh, Authctxt *authctxt) +{ + int skip_privdrop = 0; + + /* + * Hack for systems that don't support FD passing: retain privileges + * in the post-auth privsep process so it can allocate PTYs directly. + * This is basically equivalent to what we did <= 9.7, which was to + * disable post-auth privsep entriely. + * Cygwin doesn't need to drop privs here although it doesn't support + * fd passing, as AFAIK PTY allocation on this platform doesn't require + * special privileges to begin with. + */ +#if defined(DISABLE_FD_PASSING) && !defined(HAVE_CYGWIN) + skip_privdrop = 1; +#endif + + /* New socket pair */ + monitor_reinit(pmonitor); + + pmonitor->m_pid = fork(); + if (pmonitor->m_pid == -1) + fatal("fork of unprivileged child failed"); + else if (pmonitor->m_pid != 0) { + verbose("User child is on pid %ld", (long)pmonitor->m_pid); + sshbuf_reset(loginmsg); + monitor_clear_keystate(ssh, pmonitor); + monitor_child_postauth(ssh, pmonitor); + + /* NEVERREACHED */ + exit(0); + } + + /* child */ + + close(pmonitor->m_sendfd); + pmonitor->m_sendfd = -1; + + /* Demote the private keys to public keys. */ + demote_sensitive_data(); + + reseed_prngs(); + + /* Drop privileges */ + if (!skip_privdrop) + do_setusercontext(authctxt->pw); + + /* It is safe now to apply the key state */ + monitor_apply_keystate(ssh, pmonitor); + + /* + * Tell the packet layer that authentication was successful, since + * this information is not part of the key state. + */ + ssh_packet_set_authenticated(ssh); +} + +static void +append_hostkey_type(struct sshbuf *b, const char *s) +{ + int r; + + if (match_pattern_list(s, options.hostkeyalgorithms, 0) != 1) { + debug3_f("%s key not permitted by HostkeyAlgorithms", s); + return; + } + if ((r = sshbuf_putf(b, "%s%s", sshbuf_len(b) > 0 ? "," : "", s)) != 0) + fatal_fr(r, "sshbuf_putf"); +} + +static char * +list_hostkey_types(void) +{ + struct sshbuf *b; + struct sshkey *key; + char *ret; + u_int i; + + if ((b = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + for (i = 0; i < options.num_host_key_files; i++) { + key = sensitive_data.host_keys[i]; + if (key == NULL) + key = sensitive_data.host_pubkeys[i]; + if (key == NULL) + continue; + switch (key->type) { + case KEY_RSA: + /* for RSA we also support SHA2 signatures */ + append_hostkey_type(b, "rsa-sha2-512"); + append_hostkey_type(b, "rsa-sha2-256"); + /* FALLTHROUGH */ + case KEY_DSA: + case KEY_ECDSA: + case KEY_ED25519: + case KEY_ECDSA_SK: + case KEY_ED25519_SK: + case KEY_XMSS: + append_hostkey_type(b, sshkey_ssh_name(key)); + break; + } + /* If the private key has a cert peer, then list that too */ + key = sensitive_data.host_certificates[i]; + if (key == NULL) + continue; + switch (key->type) { + case KEY_RSA_CERT: + /* for RSA we also support SHA2 signatures */ + append_hostkey_type(b, + "rsa-sha2-512-cert-v01@openssh.com"); + append_hostkey_type(b, + "rsa-sha2-256-cert-v01@openssh.com"); + /* FALLTHROUGH */ + case KEY_DSA_CERT: + case KEY_ECDSA_CERT: + case KEY_ED25519_CERT: + case KEY_ECDSA_SK_CERT: + case KEY_ED25519_SK_CERT: + case KEY_XMSS_CERT: + append_hostkey_type(b, sshkey_ssh_name(key)); + break; + } + } + if ((ret = sshbuf_dup_string(b)) == NULL) + fatal_f("sshbuf_dup_string failed"); + sshbuf_free(b); + debug_f("%s", ret); + return ret; +} + +static struct sshkey * +get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh) +{ + u_int i; + struct sshkey *key; + + for (i = 0; i < options.num_host_key_files; i++) { + switch (type) { + case KEY_RSA_CERT: + case KEY_DSA_CERT: + case KEY_ECDSA_CERT: + case KEY_ED25519_CERT: + case KEY_ECDSA_SK_CERT: + case KEY_ED25519_SK_CERT: + case KEY_XMSS_CERT: + key = sensitive_data.host_certificates[i]; + break; + default: + key = sensitive_data.host_keys[i]; + if (key == NULL && !need_private) + key = sensitive_data.host_pubkeys[i]; + break; + } + if (key == NULL || key->type != type) + continue; + switch (type) { + case KEY_ECDSA: + case KEY_ECDSA_SK: + case KEY_ECDSA_CERT: + case KEY_ECDSA_SK_CERT: + if (key->ecdsa_nid != nid) + continue; + /* FALLTHROUGH */ + default: + return need_private ? + sensitive_data.host_keys[i] : key; + } + } + return NULL; +} + +struct sshkey * +get_hostkey_public_by_type(int type, int nid, struct ssh *ssh) +{ + return get_hostkey_by_type(type, nid, 0, ssh); +} + +struct sshkey * +get_hostkey_private_by_type(int type, int nid, struct ssh *ssh) +{ + return get_hostkey_by_type(type, nid, 1, ssh); +} + +struct sshkey * +get_hostkey_by_index(int ind) +{ + if (ind < 0 || (u_int)ind >= options.num_host_key_files) + return (NULL); + return (sensitive_data.host_keys[ind]); +} + +struct sshkey * +get_hostkey_public_by_index(int ind, struct ssh *ssh) +{ + if (ind < 0 || (u_int)ind >= options.num_host_key_files) + return (NULL); + return (sensitive_data.host_pubkeys[ind]); +} + +int +get_hostkey_index(struct sshkey *key, int compare, struct ssh *ssh) +{ + u_int i; + + for (i = 0; i < options.num_host_key_files; i++) { + if (sshkey_is_cert(key)) { + if (key == sensitive_data.host_certificates[i] || + (compare && sensitive_data.host_certificates[i] && + sshkey_equal(key, + sensitive_data.host_certificates[i]))) + return (i); + } else { + if (key == sensitive_data.host_keys[i] || + (compare && sensitive_data.host_keys[i] && + sshkey_equal(key, sensitive_data.host_keys[i]))) + return (i); + if (key == sensitive_data.host_pubkeys[i] || + (compare && sensitive_data.host_pubkeys[i] && + sshkey_equal(key, sensitive_data.host_pubkeys[i]))) + return (i); + } + } + return (-1); +} + +/* Inform the client of all hostkeys */ +static void +notify_hostkeys(struct ssh *ssh) +{ + struct sshbuf *buf; + struct sshkey *key; + u_int i, nkeys; + int r; + char *fp; + + /* Some clients cannot cope with the hostkeys message, skip those. */ + if (ssh->compat & SSH_BUG_HOSTKEYS) + return; + + if ((buf = sshbuf_new()) == NULL) + fatal_f("sshbuf_new"); + for (i = nkeys = 0; i < options.num_host_key_files; i++) { + key = get_hostkey_public_by_index(i, ssh); + if (key == NULL || key->type == KEY_UNSPEC || + sshkey_is_cert(key)) + continue; + fp = sshkey_fingerprint(key, options.fingerprint_hash, + SSH_FP_DEFAULT); + debug3_f("key %d: %s %s", i, sshkey_ssh_name(key), fp); + free(fp); + if (nkeys == 0) { + /* + * Start building the request when we find the + * first usable key. + */ + if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || + (r = sshpkt_put_cstring(ssh, "hostkeys-00@openssh.com")) != 0 || + (r = sshpkt_put_u8(ssh, 0)) != 0) /* want reply */ + sshpkt_fatal(ssh, r, "%s: start request", __func__); + } + /* Append the key to the request */ + sshbuf_reset(buf); + if ((r = sshkey_putb(key, buf)) != 0) + fatal_fr(r, "couldn't put hostkey %d", i); + if ((r = sshpkt_put_stringb(ssh, buf)) != 0) + sshpkt_fatal(ssh, r, "%s: append key", __func__); + nkeys++; + } + debug3_f("sent %u hostkeys", nkeys); + if (nkeys == 0) + fatal_f("no hostkeys"); + if ((r = sshpkt_send(ssh)) != 0) + sshpkt_fatal(ssh, r, "%s: send", __func__); + sshbuf_free(buf); +} + +static void +usage(void) +{ + fprintf(stderr, "%s, %s\n", SSH_RELEASE, SSH_OPENSSL_VERSION); + fprintf(stderr, +"usage: sshd [-46DdeGiqTtV] [-C connection_spec] [-c host_cert_file]\n" +" [-E log_file] [-f config_file] [-g login_grace_time]\n" +" [-h host_key_file] [-o option] [-p port] [-u len]\n" + ); + exit(1); +} + +static void +parse_hostkeys(struct sshbuf *hostkeys) +{ + int r; + u_int num_keys = 0; + struct sshkey *k; + struct sshbuf *kbuf; + const u_char *cp; + size_t len; + + while (sshbuf_len(hostkeys) != 0) { + if (num_keys > 2048) + fatal_f("too many hostkeys"); + sensitive_data.host_keys = xrecallocarray( + sensitive_data.host_keys, num_keys, num_keys + 1, + sizeof(*sensitive_data.host_pubkeys)); + sensitive_data.host_pubkeys = xrecallocarray( + sensitive_data.host_pubkeys, num_keys, num_keys + 1, + sizeof(*sensitive_data.host_pubkeys)); + sensitive_data.host_certificates = xrecallocarray( + sensitive_data.host_certificates, num_keys, num_keys + 1, + sizeof(*sensitive_data.host_certificates)); + /* private key */ + k = NULL; + if ((r = sshbuf_froms(hostkeys, &kbuf)) != 0) + fatal_fr(r, "extract privkey"); + if (sshbuf_len(kbuf) != 0 && + (r = sshkey_private_deserialize(kbuf, &k)) != 0) + fatal_fr(r, "parse pubkey"); + sensitive_data.host_keys[num_keys] = k; + sshbuf_free(kbuf); + if (k) + debug2_f("privkey %u: %s", num_keys, sshkey_ssh_name(k)); + /* public key */ + k = NULL; + if ((r = sshbuf_get_string_direct(hostkeys, &cp, &len)) != 0) + fatal_fr(r, "extract pubkey"); + if (len != 0 && (r = sshkey_from_blob(cp, len, &k)) != 0) + fatal_fr(r, "parse pubkey"); + sensitive_data.host_pubkeys[num_keys] = k; + if (k) + debug2_f("pubkey %u: %s", num_keys, sshkey_ssh_name(k)); + /* certificate */ + k = NULL; + if ((r = sshbuf_get_string_direct(hostkeys, &cp, &len)) != 0) + fatal_fr(r, "extract pubkey"); + if (len != 0 && (r = sshkey_from_blob(cp, len, &k)) != 0) + fatal_fr(r, "parse pubkey"); + sensitive_data.host_certificates[num_keys] = k; + if (k) + debug2_f("cert %u: %s", num_keys, sshkey_ssh_name(k)); + num_keys++; + } + sensitive_data.num_hostkeys = num_keys; +} + +static void +recv_rexec_state(int fd, struct sshbuf *conf, uint64_t *timing_secretp) +{ + struct sshbuf *m, *inc, *hostkeys; + u_char *cp, ver; + size_t len; + int r; + struct include_item *item; + + debug3_f("entering fd = %d", fd); + + if ((m = sshbuf_new()) == NULL || (inc = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + if (ssh_msg_recv(fd, m) == -1) + fatal_f("ssh_msg_recv failed"); + if ((r = sshbuf_get_u8(m, &ver)) != 0) + fatal_fr(r, "parse version"); + if (ver != 0) + fatal_f("rexec version mismatch"); + if ((r = sshbuf_get_string(m, &cp, &len)) != 0 || /* XXX _direct */ + (r = sshbuf_get_u64(m, timing_secretp)) != 0 || + (r = sshbuf_froms(m, &hostkeys)) != 0 || + (r = sshbuf_get_stringb(m, inc)) != 0) + fatal_fr(r, "parse config"); + + if (conf != NULL && (r = sshbuf_put(conf, cp, len))) + fatal_fr(r, "sshbuf_put"); + + while (sshbuf_len(inc) != 0) { + item = xcalloc(1, sizeof(*item)); + if ((item->contents = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + if ((r = sshbuf_get_cstring(inc, &item->selector, NULL)) != 0 || + (r = sshbuf_get_cstring(inc, &item->filename, NULL)) != 0 || + (r = sshbuf_get_stringb(inc, item->contents)) != 0) + fatal_fr(r, "parse includes"); + TAILQ_INSERT_TAIL(&includes, item, entry); + } + + parse_hostkeys(hostkeys); + + free(cp); + sshbuf_free(m); + sshbuf_free(hostkeys); + sshbuf_free(inc); + + debug3_f("done"); +} + +/* + * If IP options are supported, make sure there are none (log and + * return an error if any are found). Basically we are worried about + * source routing; it can be used to pretend you are somebody + * (ip-address) you are not. That itself may be "almost acceptable" + * under certain circumstances, but rhosts authentication is useless + * if source routing is accepted. Notice also that if we just dropped + * source routing here, the other side could use IP spoofing to do + * rest of the interaction and could still bypass security. So we + * exit here if we detect any IP options. + */ +static void +check_ip_options(struct ssh *ssh) +{ +#ifdef IP_OPTIONS + int sock_in = ssh_packet_get_connection_in(ssh); + struct sockaddr_storage from; + u_char opts[200]; + socklen_t i, option_size = sizeof(opts), fromlen = sizeof(from); + char text[sizeof(opts) * 3 + 1]; + + memset(&from, 0, sizeof(from)); + if (getpeername(sock_in, (struct sockaddr *)&from, + &fromlen) == -1) + return; + if (from.ss_family != AF_INET) + return; + /* XXX IPv6 options? */ + + if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts, + &option_size) >= 0 && option_size != 0) { + text[0] = '\0'; + for (i = 0; i < option_size; i++) + snprintf(text + i*3, sizeof(text) - i*3, + " %2.2x", opts[i]); + fatal("Connection from %.100s port %d with IP opts: %.800s", + ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text); + } +#endif /* IP_OPTIONS */ +} + +/* Set the routing domain for this process */ +static void +set_process_rdomain(struct ssh *ssh, const char *name) +{ +#if defined(HAVE_SYS_SET_PROCESS_RDOMAIN) + if (name == NULL) + return; /* default */ + + if (strcmp(name, "%D") == 0) { + /* "expands" to routing domain of connection */ + if ((name = ssh_packet_rdomain_in(ssh)) == NULL) + return; + } + /* NB. We don't pass 'ssh' to sys_set_process_rdomain() */ + return sys_set_process_rdomain(name); +#elif defined(__OpenBSD__) + int rtable, ortable = getrtable(); + const char *errstr; + + if (name == NULL) + return; /* default */ + + if (strcmp(name, "%D") == 0) { + /* "expands" to routing domain of connection */ + if ((name = ssh_packet_rdomain_in(ssh)) == NULL) + return; + } + + rtable = (int)strtonum(name, 0, 255, &errstr); + if (errstr != NULL) /* Shouldn't happen */ + fatal("Invalid routing domain \"%s\": %s", name, errstr); + if (rtable != ortable && setrtable(rtable) != 0) + fatal("Unable to set routing domain %d: %s", + rtable, strerror(errno)); + debug_f("set routing domain %d (was %d)", rtable, ortable); +#else /* defined(__OpenBSD__) */ + fatal("Unable to set routing domain: not supported in this platform"); +#endif +} + +/* + * Main program for the daemon. + */ +int +main(int ac, char **av) +{ + struct ssh *ssh = NULL; + extern char *optarg; + extern int optind; + int r, opt, on = 1, remote_port; + int sock_in = -1, sock_out = -1, rexeced_flag = 0, have_key = 0; + const char *remote_ip, *rdomain; + char *line, *laddr, *logfile = NULL; + u_int i; + u_int64_t ibytes, obytes; + mode_t new_umask; + Authctxt *authctxt; + struct connection_info *connection_info = NULL; + sigset_t sigmask; + uint64_t timing_secret = 0; + struct itimerval itv; + + sigemptyset(&sigmask); + sigprocmask(SIG_SETMASK, &sigmask, NULL); + +#ifdef HAVE_SECUREWARE + (void)set_auth_parameters(ac, av); +#endif + __progname = ssh_get_progname(av[0]); + + /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */ + saved_argc = ac; + saved_argv = xcalloc(ac + 1, sizeof(*saved_argv)); + for (i = 0; (int)i < ac; i++) + saved_argv[i] = xstrdup(av[i]); + saved_argv[i] = NULL; + +#ifndef HAVE_SETPROCTITLE + /* Prepare for later setproctitle emulation */ + compat_init_setproctitle(ac, av); + av = saved_argv; +#endif + + /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ + sanitise_stdfd(); + + /* Initialize configuration options to their default values. */ + initialize_server_options(&options); + + /* Parse command-line arguments. */ + while ((opt = getopt(ac, av, + "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtV")) != -1) { + switch (opt) { + case '4': + options.address_family = AF_INET; + break; + case '6': + options.address_family = AF_INET6; + break; + case 'f': + config_file_name = optarg; + break; + case 'c': + servconf_add_hostcert("[command-line]", 0, + &options, optarg); + break; + case 'd': + if (debug_flag == 0) { + debug_flag = 1; + options.log_level = SYSLOG_LEVEL_DEBUG1; + } else if (options.log_level < SYSLOG_LEVEL_DEBUG3) + options.log_level++; + break; + case 'D': + /* ignore */ + break; + case 'E': + logfile = optarg; + /* FALLTHROUGH */ + case 'e': + log_stderr = 1; + break; + case 'i': + inetd_flag = 1; + break; + case 'r': + /* ignore */ + break; + case 'R': + rexeced_flag = 1; + break; + case 'Q': + /* ignored */ + break; + case 'q': + options.log_level = SYSLOG_LEVEL_QUIET; + break; + case 'b': + /* protocol 1, ignored */ + break; + case 'p': + options.ports_from_cmdline = 1; + if (options.num_ports >= MAX_PORTS) { + fprintf(stderr, "too many ports.\n"); + exit(1); + } + options.ports[options.num_ports++] = a2port(optarg); + if (options.ports[options.num_ports-1] <= 0) { + fprintf(stderr, "Bad port number.\n"); + exit(1); + } + break; + case 'g': + if ((options.login_grace_time = convtime(optarg)) == -1) { + fprintf(stderr, "Invalid login grace time.\n"); + exit(1); + } + break; + case 'k': + /* protocol 1, ignored */ + break; + case 'h': + servconf_add_hostkey("[command-line]", 0, + &options, optarg, 1); + break; + case 't': + case 'T': + case 'G': + fatal("test/dump modes not supported"); + break; + case 'C': + connection_info = server_get_connection_info(ssh, 0, 0); + if (parse_server_match_testspec(connection_info, + optarg) == -1) + exit(1); + break; + case 'u': + utmp_len = (u_int)strtonum(optarg, 0, HOST_NAME_MAX+1+1, NULL); + if (utmp_len > HOST_NAME_MAX+1) { + fprintf(stderr, "Invalid utmp length.\n"); + exit(1); + } + break; + case 'o': + line = xstrdup(optarg); + if (process_server_config_line(&options, line, + "command-line", 0, NULL, NULL, &includes) != 0) + exit(1); + free(line); + break; + case 'V': + fprintf(stderr, "%s, %s\n", + SSH_RELEASE, SSH_OPENSSL_VERSION); + exit(0); + default: + usage(); + break; + } + } + + /* Check that there are no remaining arguments. */ + if (optind < ac) { + fprintf(stderr, "Extra argument %s.\n", av[optind]); + exit(1); + } + + debug("sshd version %s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); + + if (!rexeced_flag) + fatal("sshd-session should not be executed directly"); + + closefrom(REEXEC_MIN_FREE_FD); + + seed_rng(); + + /* If requested, redirect the logs to the specified logfile. */ + if (logfile != NULL) { + char *cp, pid_s[32]; + + snprintf(pid_s, sizeof(pid_s), "%ld", (unsigned long)getpid()); + cp = percent_expand(logfile, + "p", pid_s, + "P", "sshd-session", + (char *)NULL); + log_redirect_stderr_to(cp); + free(cp); + } + + /* + * Force logging to stderr until we have loaded the private host + * key (unless started from inetd) + */ + log_init(__progname, + options.log_level == SYSLOG_LEVEL_NOT_SET ? + SYSLOG_LEVEL_INFO : options.log_level, + options.log_facility == SYSLOG_FACILITY_NOT_SET ? + SYSLOG_FACILITY_AUTH : options.log_facility, + log_stderr || !inetd_flag || debug_flag); + + debug("sshd version %s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); + + /* Fetch our configuration */ + if ((cfg = sshbuf_new()) == NULL) + fatal("sshbuf_new config buf failed"); + setproctitle("%s", "[rexeced]"); + recv_rexec_state(REEXEC_CONFIG_PASS_FD, cfg, &timing_secret); + close(REEXEC_CONFIG_PASS_FD); + parse_server_config(&options, "rexec", cfg, &includes, NULL, 1); + /* Fill in default values for those options not explicitly set. */ + fill_default_server_options(&options); + options.timing_secret = timing_secret; + + /* Store privilege separation user for later use if required. */ + privsep_chroot = (getuid() == 0 || geteuid() == 0); + if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { + if (privsep_chroot || options.kerberos_authentication) + fatal("Privilege separation user %s does not exist", + SSH_PRIVSEP_USER); + } else { + privsep_pw = pwcopy(privsep_pw); + freezero(privsep_pw->pw_passwd, strlen(privsep_pw->pw_passwd)); + privsep_pw->pw_passwd = xstrdup("*"); + } + endpwent(); + + if (!debug_flag) { + startup_pipe = dup(REEXEC_STARTUP_PIPE_FD); + close(REEXEC_STARTUP_PIPE_FD); + /* + * Signal parent that this child is at a point where + * they can go away if they have a SIGHUP pending. + */ + (void)atomicio(vwrite, startup_pipe, "\0", 1); + } + + /* Check that options are sensible */ + if (options.authorized_keys_command_user == NULL && + (options.authorized_keys_command != NULL && + strcasecmp(options.authorized_keys_command, "none") != 0)) + fatal("AuthorizedKeysCommand set without " + "AuthorizedKeysCommandUser"); + if (options.authorized_principals_command_user == NULL && + (options.authorized_principals_command != NULL && + strcasecmp(options.authorized_principals_command, "none") != 0)) + fatal("AuthorizedPrincipalsCommand set without " + "AuthorizedPrincipalsCommandUser"); + + /* + * Check whether there is any path through configured auth methods. + * Unfortunately it is not possible to verify this generally before + * daemonisation in the presence of Match block, but this catches + * and warns for trivial misconfigurations that could break login. + */ + if (options.num_auth_methods != 0) { + for (i = 0; i < options.num_auth_methods; i++) { + if (auth2_methods_valid(options.auth_methods[i], + 1) == 0) + break; + } + if (i >= options.num_auth_methods) + fatal("AuthenticationMethods cannot be satisfied by " + "enabled authentication methods"); + } + +#ifdef WITH_OPENSSL + if (options.moduli_file != NULL) + dh_set_moduli_file(options.moduli_file); +#endif + + if (options.host_key_agent) { + if (strcmp(options.host_key_agent, SSH_AUTHSOCKET_ENV_NAME)) + setenv(SSH_AUTHSOCKET_ENV_NAME, + options.host_key_agent, 1); + if ((r = ssh_get_authentication_socket(NULL)) == 0) + have_agent = 1; + else + error_r(r, "Could not connect to agent \"%s\"", + options.host_key_agent); + } + + if (options.num_host_key_files != sensitive_data.num_hostkeys) { + fatal("internal error: hostkeys confused (config %u recvd %u)", + options.num_host_key_files, sensitive_data.num_hostkeys); + } + + for (i = 0; i < options.num_host_key_files; i++) { + if (sensitive_data.host_keys[i] != NULL || + (have_agent && sensitive_data.host_pubkeys[i] != NULL)) { + have_key = 1; + break; + } + } + if (!have_key) + fatal("internal error: monitor received no hostkeys"); + + /* Ensure that umask disallows at least group and world write */ + new_umask = umask(0077) | 0022; + (void) umask(new_umask); + + /* Initialize the log (it is reinitialized below in case we forked). */ + if (debug_flag) + log_stderr = 1; + log_init(__progname, options.log_level, + options.log_facility, log_stderr); + for (i = 0; i < options.num_log_verbose; i++) + log_verbose_add(options.log_verbose[i]); + + /* Reinitialize the log (because of the fork above). */ + log_init(__progname, options.log_level, options.log_facility, log_stderr); + + /* + * Chdir to the root directory so that the current disk can be + * unmounted if desired. + */ + if (chdir("/") == -1) + error("chdir(\"/\"): %s", strerror(errno)); + + /* ignore SIGPIPE */ + ssh_signal(SIGPIPE, SIG_IGN); + + /* Get a connection, either from inetd or rexec */ + if (inetd_flag) { + /* + * NB. must be different fd numbers for the !socket case, + * as packet_connection_is_on_socket() depends on this. + */ + sock_in = dup(STDIN_FILENO); + sock_out = dup(STDOUT_FILENO); + } else { + /* rexec case; accept()ed socket in ancestor listener */ + sock_in = sock_out = dup(STDIN_FILENO); + } + + /* + * We intentionally do not close the descriptors 0, 1, and 2 + * as our code for setting the descriptors won't work if + * ttyfd happens to be one of those. + */ + if (stdfd_devnull(1, 1, !log_stderr) == -1) + error("stdfd_devnull failed"); + debug("network sockets: %d, %d", sock_in, sock_out); + + /* This is the child processing a new connection. */ + setproctitle("%s", "[accepted]"); + + /* Executed child processes don't need these. */ + fcntl(sock_out, F_SETFD, FD_CLOEXEC); + fcntl(sock_in, F_SETFD, FD_CLOEXEC); + + /* We will not restart on SIGHUP since it no longer makes sense. */ + ssh_signal(SIGALRM, SIG_DFL); + ssh_signal(SIGHUP, SIG_DFL); + ssh_signal(SIGTERM, SIG_DFL); + ssh_signal(SIGQUIT, SIG_DFL); + ssh_signal(SIGCHLD, SIG_DFL); + ssh_signal(SIGINT, SIG_DFL); + + /* + * Register our connection. This turns encryption off because we do + * not have a key. + */ + if ((ssh = ssh_packet_set_connection(NULL, sock_in, sock_out)) == NULL) + fatal("Unable to create connection"); + the_active_state = ssh; + ssh_packet_set_server(ssh); + + check_ip_options(ssh); + + /* Prepare the channels layer */ + channel_init_channels(ssh); + channel_set_af(ssh, options.address_family); + server_process_channel_timeouts(ssh); + server_process_permitopen(ssh); + + /* Set SO_KEEPALIVE if requested. */ + if (options.tcp_keep_alive && ssh_packet_connection_is_on_socket(ssh) && + setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) == -1) + error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); + + if ((remote_port = ssh_remote_port(ssh)) < 0) { + debug("ssh_remote_port failed"); + cleanup_exit(255); + } + + /* + * The rest of the code depends on the fact that + * ssh_remote_ipaddr() caches the remote ip, even if + * the socket goes away. + */ + remote_ip = ssh_remote_ipaddr(ssh); + +#ifdef SSH_AUDIT_EVENTS + audit_connection_from(remote_ip, remote_port); +#endif + + rdomain = ssh_packet_rdomain_in(ssh); + + /* Log the connection. */ + laddr = get_local_ipaddr(sock_in); + verbose("Connection from %s port %d on %s port %d%s%s%s", + remote_ip, remote_port, laddr, ssh_local_port(ssh), + rdomain == NULL ? "" : " rdomain \"", + rdomain == NULL ? "" : rdomain, + rdomain == NULL ? "" : "\""); + free(laddr); + + /* + * We don't want to listen forever unless the other side + * successfully authenticates itself. So we set up an alarm which is + * cleared after successful authentication. A limit of zero + * indicates no limit. Note that we don't set the alarm in debugging + * mode; it is just annoying to have the server exit just when you + * are about to discover the bug. + */ + ssh_signal(SIGALRM, grace_alarm_handler); + if (!debug_flag && options.login_grace_time > 0) { + int ujitter = arc4random_uniform(4 * 1000000); + + timerclear(&itv.it_interval); + itv.it_value.tv_sec = options.login_grace_time; + itv.it_value.tv_sec += ujitter / 1000000; + itv.it_value.tv_usec = ujitter % 1000000; + + if (setitimer(ITIMER_REAL, &itv, NULL) == -1) + fatal("login grace time setitimer failed"); + } + + if ((r = kex_exchange_identification(ssh, -1, + options.version_addendum)) != 0) + sshpkt_fatal(ssh, r, "banner exchange"); + + ssh_packet_set_nonblocking(ssh); + + /* allocate authentication context */ + authctxt = xcalloc(1, sizeof(*authctxt)); + ssh->authctxt = authctxt; + + /* XXX global for cleanup, access from other modules */ + the_authctxt = authctxt; + + /* Set default key authentication options */ + if ((auth_opts = sshauthopt_new_with_keys_defaults()) == NULL) + fatal("allocation failed"); + + /* prepare buffer to collect messages to display to user after login */ + if ((loginmsg = sshbuf_new()) == NULL) + fatal("sshbuf_new loginmsg failed"); + auth_debug_reset(); + + if (privsep_preauth(ssh) == 1) + goto authenticated; + + /* perform the key exchange */ + /* authenticate user and start session */ + do_ssh2_kex(ssh); + do_authentication2(ssh); + + /* + * The unprivileged child now transfers the current keystate and exits. + */ + mm_send_keystate(ssh, pmonitor); + ssh_packet_clear_keys(ssh); + exit(0); + + authenticated: + /* + * Cancel the alarm we set to limit the time taken for + * authentication. + */ + timerclear(&itv.it_interval); + timerclear(&itv.it_value); + if (setitimer(ITIMER_REAL, &itv, NULL) == -1) + fatal("login grace time clear failed"); + ssh_signal(SIGALRM, SIG_DFL); + authctxt->authenticated = 1; + if (startup_pipe != -1) { + /* signal listener that authentication completed successfully */ + (void)atomicio(vwrite, startup_pipe, "\001", 1); + close(startup_pipe); + startup_pipe = -1; + } + + if (options.routing_domain != NULL) + set_process_rdomain(ssh, options.routing_domain); + +#ifdef SSH_AUDIT_EVENTS + audit_event(ssh, SSH_AUTH_SUCCESS); +#endif + +#ifdef GSSAPI + if (options.gss_authentication) { + temporarily_use_uid(authctxt->pw); + ssh_gssapi_storecreds(); + restore_uid(); + } +#endif +#ifdef USE_PAM + if (options.use_pam) { + do_pam_setcred(); + do_pam_session(ssh); + } +#endif + + /* + * In privilege separation, we fork another child and prepare + * file descriptor passing. + */ + privsep_postauth(ssh, authctxt); + /* the monitor process [priv] will not return */ + + ssh_packet_set_timeout(ssh, options.client_alive_interval, + options.client_alive_count_max); + + /* Try to send all our hostkeys to the client */ + notify_hostkeys(ssh); + + /* Start session. */ + do_authenticated(ssh, authctxt); + + /* The connection has been terminated. */ + ssh_packet_get_bytes(ssh, &ibytes, &obytes); + verbose("Transferred: sent %llu, received %llu bytes", + (unsigned long long)obytes, (unsigned long long)ibytes); + + verbose("Closing connection to %.500s port %d", remote_ip, remote_port); + +#ifdef USE_PAM + if (options.use_pam) + finish_pam(); +#endif /* USE_PAM */ + +#ifdef SSH_AUDIT_EVENTS + mm_audit_event(ssh, SSH_CONNECTION_CLOSE); +#endif + + ssh_packet_close(ssh); + + mm_terminate(); + + exit(0); +} + +int +sshd_hostkey_sign(struct ssh *ssh, struct sshkey *privkey, + struct sshkey *pubkey, u_char **signature, size_t *slenp, + const u_char *data, size_t dlen, const char *alg) +{ + if (privkey) { + if (mm_sshkey_sign(ssh, privkey, signature, slenp, + data, dlen, alg, options.sk_provider, NULL, + ssh->compat) < 0) + fatal_f("privkey sign failed"); + } else { + if (mm_sshkey_sign(ssh, pubkey, signature, slenp, + data, dlen, alg, options.sk_provider, NULL, + ssh->compat) < 0) + fatal_f("pubkey sign failed"); + } + return 0; +} + +/* SSH2 key exchange */ +static void +do_ssh2_kex(struct ssh *ssh) +{ + char *hkalgs = NULL, *myproposal[PROPOSAL_MAX]; + const char *compression = NULL; + struct kex *kex; + int r; + + if (options.rekey_limit || options.rekey_interval) + ssh_packet_set_rekey_limits(ssh, options.rekey_limit, + options.rekey_interval); + + if (options.compression == COMP_NONE) + compression = "none"; + hkalgs = list_hostkey_types(); + + kex_proposal_populate_entries(ssh, myproposal, options.kex_algorithms, + options.ciphers, options.macs, compression, hkalgs); + + free(hkalgs); + + /* start key exchange */ + if ((r = kex_setup(ssh, myproposal)) != 0) + fatal_r(r, "kex_setup"); + kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); + kex = ssh->kex; + +#ifdef WITH_OPENSSL + kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; + kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; + kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server; + kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server; + kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; + kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; + kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; + #ifdef OPENSSL_HAS_ECC + kex->kex[KEX_ECDH_SHA2] = kex_gen_server; + #endif +#endif + kex->kex[KEX_C25519_SHA256] = kex_gen_server; + kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; + kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; + kex->load_host_public_key=&get_hostkey_public_by_type; + kex->load_host_private_key=&get_hostkey_private_by_type; + kex->host_key_index=&get_hostkey_index; + kex->sign = sshd_hostkey_sign; + + ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &kex->done); + kex_proposal_free_entries(myproposal); + +#ifdef DEBUG_KEXDH + /* send 1st encrypted/maced/compressed message */ + if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 || + (r = sshpkt_put_cstring(ssh, "markus")) != 0 || + (r = sshpkt_send(ssh)) != 0 || + (r = ssh_packet_write_wait(ssh)) != 0) + fatal_fr(r, "send test"); +#endif + debug("KEX done"); +} + +/* server specific fatal cleanup */ +void +cleanup_exit(int i) +{ + extern int auth_attempted; /* monitor.c */ + + if (the_active_state != NULL && the_authctxt != NULL) { + do_cleanup(the_active_state, the_authctxt); + if (privsep_is_preauth && + pmonitor != NULL && pmonitor->m_pid > 1) { + debug("Killing privsep child %d", pmonitor->m_pid); + if (kill(pmonitor->m_pid, SIGKILL) != 0 && + errno != ESRCH) { + error_f("kill(%d): %s", pmonitor->m_pid, + strerror(errno)); + } + } + } +#ifdef SSH_AUDIT_EVENTS + /* done after do_cleanup so it can cancel the PAM auth 'thread' */ + if (the_active_state != NULL && mm_is_monitor()) + audit_event(the_active_state, SSH_CONNECTION_ABANDON); +#endif + /* Override default fatal exit value when auth was attempted */ + if (i == 255 && auth_attempted) + _exit(EXIT_AUTH_ATTEMPTED); + _exit(i); +} diff --git a/sshd.0 b/sshd.0 index ef26622..2ece5c7 100644 --- a/sshd.0 +++ b/sshd.0 @@ -40,7 +40,9 @@ DESCRIPTION The keywords are M-bM-^@M-^\addrM-bM-^@M-^], M-bM-^@M-^\userM-bM-^@M-^], M-bM-^@M-^\hostM-bM-^@M-^], M-bM-^@M-^\laddrM-bM-^@M-^], M-bM-^@M-^\lportM-bM-^@M-^], and M-bM-^@M-^\rdomainM-bM-^@M-^] and correspond to source address, user, resolved source host name, local address, local port number and routing domain - respectively. + respectively. Additionally the M-bM-^@M-^\invalid-userM-bM-^@M-^] flag (which does + not take a value argument) may be specified to simulate a + connection from an unrecognised username. -c host_certificate_file Specifies a path to a certificate file to identify sshd during @@ -255,7 +257,6 @@ AUTHORIZED_KEYS FILE FORMAT ecdsa-sha2-nistp521 sk-ssh-ed25519@openssh.com ssh-ed25519 - ssh-dss ssh-rsa The comment field is not used for anything (but may be convenient for the @@ -264,8 +265,8 @@ AUTHORIZED_KEYS FILE FORMAT Note that lines in this file can be several hundred bytes long (because of the size of the public key encoding) up to a limit of 8 kilobytes, which permits RSA keys up to 16 kilobits. You don't want to type them - in; instead, copy the id_dsa.pub, id_ecdsa.pub, id_ecdsa_sk.pub, - id_ed25519.pub, id_ed25519_sk.pub, or the id_rsa.pub file and edit it. + in; instead, copy the id_ecdsa.pub, id_ecdsa_sk.pub, id_ed25519.pub, + id_ed25519_sk.pub, or the id_rsa.pub file and edit it. sshd enforces a minimum RSA key modulus size of 1024 bits. @@ -567,11 +568,11 @@ FILES for the user, and not accessible by others. ~/.ssh/authorized_keys - Lists the public keys (DSA, ECDSA, Ed25519, RSA) that can be used - for logging in as this user. The format of this file is - described above. The content of the file is not highly - sensitive, but the recommended permissions are read/write for the - user, and not accessible by others. + Lists the public keys (ECDSA, Ed25519, RSA) that can be used for + logging in as this user. The format of this file is described + above. The content of the file is not highly sensitive, but the + recommended permissions are read/write for the user, and not + accessible by others. If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the file could be modified or @@ -683,4 +684,4 @@ AUTHORS versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support for privilege separation. -OpenBSD 7.5 September 19, 2023 OpenBSD 7.5 +OpenBSD 7.5 September 15, 2024 OpenBSD 7.5 diff --git a/sshd.8 b/sshd.8 index 73d5e92..08ebf53 100644 --- a/sshd.8 +++ b/sshd.8 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd.8,v 1.325 2023/09/19 20:37:07 deraadt Exp $ -.Dd $Mdocdate: September 19 2023 $ +.\" $OpenBSD: sshd.8,v 1.327 2024/09/15 01:19:56 djm Exp $ +.Dd $Mdocdate: September 15 2024 $ .Dt SSHD 8 .Os .Sh NAME @@ -115,6 +115,10 @@ and .Dq rdomain and correspond to source address, user, resolved source host name, local address, local port number and routing domain respectively. +Additionally the +.Dq invalid-user +flag (which does not take a value argument) may be specified to simulate +a connection from an unrecognised username. .It Fl c Ar host_certificate_file Specifies a path to a certificate file to identify .Nm @@ -465,8 +469,6 @@ sk-ssh-ed25519@openssh.com .It ssh-ed25519 .It -ssh-dss -.It ssh-rsa .El .Pp @@ -477,7 +479,6 @@ Note that lines in this file can be several hundred bytes long (because of the size of the public key encoding) up to a limit of 8 kilobytes, which permits RSA keys up to 16 kilobits. You don't want to type them in; instead, copy the -.Pa id_dsa.pub , .Pa id_ecdsa.pub , .Pa id_ecdsa_sk.pub , .Pa id_ed25519.pub , @@ -881,7 +882,7 @@ secret, but the recommended permissions are read/write/execute for the user, and not accessible by others. .Pp .It Pa ~/.ssh/authorized_keys -Lists the public keys (DSA, ECDSA, Ed25519, RSA) +Lists the public keys (ECDSA, Ed25519, RSA) that can be used for logging in as this user. The format of this file is described above. The content of the file is not highly sensitive, but the recommended diff --git a/sshd.c b/sshd.c index b4f2b97..df76dc7 100644 --- a/sshd.c +++ b/sshd.c @@ -1,23 +1,5 @@ -/* $OpenBSD: sshd.c,v 1.602 2024/01/08 00:34:34 djm Exp $ */ +/* $OpenBSD: sshd.c,v 1.612 2024/09/15 01:11:26 djm Exp $ */ /* - * Author: Tatu Ylonen - * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland - * All rights reserved - * This program is the ssh daemon. It listens for connections from clients, - * and performs authentication, executes use commands or shell, and forwards - * information to/from the application to the user client over an encrypted - * connection. This can also handle forwarding of X11, TCP/IP, and - * authentication agent connections. - * - * As far as I am concerned, the code I have written for this software - * can be used freely for any purpose. Any derived versions of this - * software must be clearly marked as such, and if the derived work is - * incompatible with the protocol description in the RFC file, it must be - * called by a name other than "ssh" or "Secure Shell". - * - * SSH2 implementation: - * Privilege Separation: - * * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved. * Copyright (c) 2002 Niels Provos. All rights reserved. * @@ -77,8 +59,7 @@ #include #ifdef WITH_OPENSSL -#include -#include +#include #include #include "openbsd-compat/openssl-compat.h" #endif @@ -90,43 +71,26 @@ #include "xmalloc.h" #include "ssh.h" -#include "ssh2.h" #include "sshpty.h" -#include "packet.h" #include "log.h" #include "sshbuf.h" #include "misc.h" -#include "match.h" #include "servconf.h" -#include "uidswap.h" #include "compat.h" -#include "cipher.h" #include "digest.h" #include "sshkey.h" -#include "kex.h" #include "authfile.h" #include "pathnames.h" -#include "atomicio.h" #include "canohost.h" #include "hostfile.h" #include "auth.h" #include "authfd.h" #include "msg.h" -#include "dispatch.h" -#include "channels.h" -#include "session.h" -#include "monitor.h" -#ifdef GSSAPI -#include "ssh-gss.h" -#endif -#include "monitor_wrap.h" -#include "ssh-sandbox.h" -#include "auth-options.h" #include "version.h" #include "ssherr.h" #include "sk-api.h" +#include "addr.h" #include "srclimit.h" -#include "dh.h" /* Re-exec fds */ #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) @@ -139,9 +103,6 @@ extern char *__progname; /* Server configuration options. */ ServerOptions options; -/* Name of the server configuration file. */ -char *config_file_name = _PATH_SERVER_CONFIG_FILE; - /* * Debug mode flag. This can be set on the command line. If debug * mode is enabled, extra debugging output will be sent to the system @@ -150,33 +111,10 @@ char *config_file_name = _PATH_SERVER_CONFIG_FILE; */ int debug_flag = 0; -/* - * Indicating that the daemon should only test the configuration and keys. - * If test_flag > 1 ("-T" flag), then sshd will also dump the effective - * configuration, optionally using connection information provided by the - * "-C" flag. - */ -static int test_flag = 0; - -/* Flag indicating that the daemon is being started from inetd. */ -static int inetd_flag = 0; - -/* Flag indicating that sshd should not detach and become a daemon. */ -static int no_daemon_flag = 0; - -/* debug goes to stderr unless inetd_flag is set */ -static int log_stderr = 0; - /* Saved arguments to main(). */ static char **saved_argv; static int saved_argc; -/* re-exec */ -static int rexeced_flag = 0; -static int rexec_flag = 1; -static int rexec_argc = 0; -static char **rexec_argv; - /* * The sockets that the server is listening; this is used in the SIGHUP * signal handler. @@ -185,10 +123,6 @@ static char **rexec_argv; static int listen_socks[MAX_LISTEN_SOCKS]; static int num_listen_socks = 0; -/* Daemon's agent connection */ -int auth_sock = -1; -static int have_agent = 0; - /* * Any really sensitive data in the application is contained in this * structure. The idea is that this structure could be locked into memory so @@ -205,6 +139,8 @@ struct { } sensitive_data; /* This is set to true when a signal is received. */ +static volatile sig_atomic_t received_siginfo = 0; +static volatile sig_atomic_t received_sigchld = 0; static volatile sig_atomic_t received_sighup = 0; static volatile sig_atomic_t received_sigterm = 0; @@ -212,8 +148,9 @@ static volatile sig_atomic_t received_sigterm = 0; u_int utmp_len = HOST_NAME_MAX+1; /* - * startup_pipes/flags are used for tracking children of the listening sshd - * process early in their lifespans. This tracking is needed for three things: + * The early_child/children array below is used for tracking children of the + * listening sshd process early in their lifespans, before they have + * completed authentication. This tracking is needed for four things: * * 1) Implementing the MaxStartups limit of concurrent unauthenticated * connections. @@ -222,29 +159,33 @@ u_int utmp_len = HOST_NAME_MAX+1; * after it restarts. * 3) Ensuring that rexec'd sshd processes have received their initial state * from the parent listen process before handling SIGHUP. + * 4) Tracking and logging unsuccessful exits from the preauth sshd monitor, + * including and especially those for LoginGraceTime timeouts. * * Child processes signal that they have completed closure of the listen_socks * and (if applicable) received their rexec state by sending a char over their - * sock. Child processes signal that authentication has completed by closing - * the sock (or by exiting). + * sock. + * + * Child processes signal that authentication has completed by sending a + * second char over the socket before closing it, otherwise the listener will + * continue tracking the child (and using up a MaxStartups slot) until the + * preauth subprocess exits, whereupon the listener will log its exit status. + * preauth processes will exit with a status of EXIT_LOGIN_GRACE to indicate + * they did not authenticate before the LoginGraceTime alarm fired. */ -static int *startup_pipes = NULL; -static int *startup_flags = NULL; /* Indicates child closed listener */ +struct early_child { + int pipefd; + int early; /* Indicates child closed listener */ + char *id; /* human readable connection identifier */ + pid_t pid; + struct xaddr addr; + int have_addr; + int status, have_status; +}; +static struct early_child *children; +static int children_active; static int startup_pipe = -1; /* in child */ -/* variables used for privilege separation */ -int use_privsep = -1; -struct monitor *pmonitor = NULL; -int privsep_is_preauth = 1; -static int privsep_chroot = 1; - -/* global connection state and authentication contexts */ -Authctxt *the_authctxt = NULL; -struct ssh *the_active_state; - -/* global key/cert auth options. XXX move to permanent ssh->authctxt? */ -struct sshauthopt *auth_opts = NULL; - /* sshd_config buffer */ struct sshbuf *cfg; @@ -257,11 +198,6 @@ struct sshbuf *loginmsg; /* Unprivileged user */ struct passwd *privsep_pw = NULL; -/* Prototypes for various functions defined later in this file. */ -void destroy_sensitive_data(void); -void demote_sensitive_data(void); -static void do_ssh2_kex(struct ssh *); - static char *listener_proctitle; /* @@ -277,531 +213,317 @@ close_listen_socks(void) num_listen_socks = 0; } +/* Allocate and initialise the children array */ static void -close_startup_pipes(void) +child_alloc(void) { int i; - if (startup_pipes) - for (i = 0; i < options.max_startups; i++) - if (startup_pipes[i] != -1) - close(startup_pipes[i]); -} - -/* - * Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP; - * the effect is to reread the configuration file (and to regenerate - * the server key). - */ - -static void -sighup_handler(int sig) -{ - received_sighup = 1; + children = xcalloc(options.max_startups, sizeof(*children)); + for (i = 0; i < options.max_startups; i++) { + children[i].pipefd = -1; + children[i].pid = -1; + } } -/* - * Called from the main program after receiving SIGHUP. - * Restarts the server. - */ -static void -sighup_restart(void) +/* Register a new connection in the children array; child pid comes later */ +static struct early_child * +child_register(int pipefd, int sockfd) { - logit("Received SIGHUP; restarting."); - if (options.pid_file != NULL) - unlink(options.pid_file); - platform_pre_restart(); - close_listen_socks(); - close_startup_pipes(); - ssh_signal(SIGHUP, SIG_IGN); /* will be restored after exec */ - execv(saved_argv[0], saved_argv); - logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], - strerror(errno)); - exit(1); -} + int i, lport, rport; + char *laddr = NULL, *raddr = NULL; + struct early_child *child = NULL; + struct sockaddr_storage addr; + socklen_t addrlen = sizeof(addr); + struct sockaddr *sa = (struct sockaddr *)&addr; + + for (i = 0; i < options.max_startups; i++) { + if (children[i].pipefd != -1 || children[i].pid > 0) + continue; + child = &(children[i]); + break; + } + if (child == NULL) { + fatal_f("error: accepted connection when all %d child " + " slots full", options.max_startups); + } + child->pipefd = pipefd; + child->early = 1; + /* record peer address, if available */ + if (getpeername(sockfd, sa, &addrlen) == 0 && + addr_sa_to_xaddr(sa, addrlen, &child->addr) == 0) + child->have_addr = 1; + /* format peer address string for logs */ + if ((lport = get_local_port(sockfd)) == 0 || + (rport = get_peer_port(sockfd)) == 0) { + /* Not a TCP socket */ + raddr = get_peer_ipaddr(sockfd); + xasprintf(&child->id, "connection from %s", raddr); + } else { + laddr = get_local_ipaddr(sockfd); + raddr = get_peer_ipaddr(sockfd); + xasprintf(&child->id, "connection from %s to %s", raddr, laddr); + } + free(laddr); + free(raddr); + if (++children_active > options.max_startups) + fatal_f("internal error: more children than max_startups"); -/* - * Generic signal handler for terminating signals in the master daemon. - */ -static void -sigterm_handler(int sig) -{ - received_sigterm = sig; + return child; } /* - * SIGCHLD handler. This is called whenever a child dies. This will then - * reap any zombies left by exited children. + * Finally free a child entry. Don't call this directly. */ static void -main_sigchld_handler(int sig) +child_finish(struct early_child *child) { - int save_errno = errno; - pid_t pid; - int status; - - while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || - (pid == -1 && errno == EINTR)) - ; - errno = save_errno; + if (children_active == 0) + fatal_f("internal error: children_active underflow"); + if (child->pipefd != -1) + close(child->pipefd); + free(child->id); + memset(child, '\0', sizeof(*child)); + child->pipefd = -1; + child->pid = -1; + children_active--; } /* - * Signal handler for the alarm after the login grace period has expired. + * Close a child's pipe. This will not stop tracking the child immediately + * (it will still be tracked for waitpid()) unless force_final is set, or + * child has already exited. */ static void -grace_alarm_handler(int sig) +child_close(struct early_child *child, int force_final, int quiet) { - /* - * Try to kill any processes that we have spawned, E.g. authorized - * keys command helpers or privsep children. - */ - if (getpgid(0) == getpid()) { - ssh_signal(SIGTERM, SIG_IGN); - kill(0, SIGTERM); + if (!quiet) + debug_f("enter%s", force_final ? " (forcing)" : ""); + if (child->pipefd != -1) { + close(child->pipefd); + child->pipefd = -1; } - - /* Log error and exit. */ - sigdie("Timeout before authentication for %s port %d", - ssh_remote_ipaddr(the_active_state), - ssh_remote_port(the_active_state)); + if (child->pid == -1 || force_final) + child_finish(child); } -/* Destroy the host and server keys. They will no longer be needed. */ -void -destroy_sensitive_data(void) +/* Record a child exit. Safe to call from signal handlers */ +static void +child_exit(pid_t pid, int status) { - u_int i; + int i; - for (i = 0; i < options.num_host_key_files; i++) { - if (sensitive_data.host_keys[i]) { - sshkey_free(sensitive_data.host_keys[i]); - sensitive_data.host_keys[i] = NULL; - } - if (sensitive_data.host_certificates[i]) { - sshkey_free(sensitive_data.host_certificates[i]); - sensitive_data.host_certificates[i] = NULL; + if (children == NULL || pid <= 0) + return; + for (i = 0; i < options.max_startups; i++) { + if (children[i].pid == pid) { + children[i].have_status = 1; + children[i].status = status; + break; } } } -/* Demote private to public keys for network child */ -void -demote_sensitive_data(void) +/* + * Reap a child entry that has exited, as previously flagged + * using child_exit(). + * Handles logging of exit condition and will finalise the child if its pipe + * had already been closed. + */ +static void +child_reap(struct early_child *child) { - struct sshkey *tmp; - u_int i; - int r; + LogLevel level = SYSLOG_LEVEL_DEBUG1; + int was_crash, penalty_type = SRCLIMIT_PENALTY_NONE; - for (i = 0; i < options.num_host_key_files; i++) { - if (sensitive_data.host_keys[i]) { - if ((r = sshkey_from_private( - sensitive_data.host_keys[i], &tmp)) != 0) - fatal_r(r, "could not demote host %s key", - sshkey_type(sensitive_data.host_keys[i])); - sshkey_free(sensitive_data.host_keys[i]); - sensitive_data.host_keys[i] = tmp; + /* Log exit information */ + if (WIFSIGNALED(child->status)) { + /* + * Increase logging for signals potentially associated + * with serious conditions. + */ + if ((was_crash = signal_is_crash(WTERMSIG(child->status)))) + level = SYSLOG_LEVEL_ERROR; + do_log2(level, "session process %ld for %s killed by " + "signal %d%s", (long)child->pid, child->id, + WTERMSIG(child->status), child->early ? " (early)" : ""); + if (was_crash) + penalty_type = SRCLIMIT_PENALTY_CRASH; + } else if (!WIFEXITED(child->status)) { + penalty_type = SRCLIMIT_PENALTY_CRASH; + error("session process %ld for %s terminated abnormally, " + "status=0x%x%s", (long)child->pid, child->id, child->status, + child->early ? " (early)" : ""); + } else { + /* Normal exit. We care about the status */ + switch (WEXITSTATUS(child->status)) { + case 0: + debug3_f("preauth child %ld for %s completed " + "normally %s", (long)child->pid, child->id, + child->early ? " (early)" : ""); + break; + case EXIT_LOGIN_GRACE: + penalty_type = SRCLIMIT_PENALTY_GRACE_EXCEEDED; + logit("Timeout before authentication for %s, " + "pid = %ld%s", child->id, (long)child->pid, + child->early ? " (early)" : ""); + break; + case EXIT_CHILD_CRASH: + penalty_type = SRCLIMIT_PENALTY_CRASH; + logit("Session process %ld unpriv child crash for %s%s", + (long)child->pid, child->id, + child->early ? " (early)" : ""); + break; + case EXIT_AUTH_ATTEMPTED: + penalty_type = SRCLIMIT_PENALTY_AUTHFAIL; + debug_f("preauth child %ld for %s exited " + "after unsuccessful auth attempt %s", + (long)child->pid, child->id, + child->early ? " (early)" : ""); + break; + case EXIT_CONFIG_REFUSED: + penalty_type = SRCLIMIT_PENALTY_REFUSECONNECTION; + debug_f("preauth child %ld for %s prohibited by" + "RefuseConnection %s", + (long)child->pid, child->id, + child->early ? " (early)" : ""); + break; + default: + penalty_type = SRCLIMIT_PENALTY_NOAUTH; + debug_f("preauth child %ld for %s exited " + "with status %d%s", (long)child->pid, child->id, + WEXITSTATUS(child->status), + child->early ? " (early)" : ""); + break; } - /* Certs do not need demotion */ } -} -static void -reseed_prngs(void) -{ - u_int32_t rnd[256]; - -#ifdef WITH_OPENSSL - RAND_poll(); -#endif - arc4random_stir(); /* noop on recent arc4random() implementations */ - arc4random_buf(rnd, sizeof(rnd)); /* let arc4random notice PID change */ - -#ifdef WITH_OPENSSL - RAND_seed(rnd, sizeof(rnd)); - /* give libcrypto a chance to notice the PID change */ - if ((RAND_bytes((u_char *)rnd, 1)) != 1) - fatal("%s: RAND_bytes failed", __func__); -#endif + if (child->have_addr) + srclimit_penalise(&child->addr, penalty_type); - explicit_bzero(rnd, sizeof(rnd)); + child->pid = -1; + child->have_status = 0; + if (child->pipefd == -1) + child_finish(child); } +/* Reap all children that have exited; called after SIGCHLD */ static void -privsep_preauth_child(void) +child_reap_all_exited(void) { - gid_t gidset[1]; - - /* Enable challenge-response authentication for privilege separation */ - privsep_challenge_enable(); - -#ifdef GSSAPI - /* Cache supported mechanism OIDs for later use */ - ssh_gssapi_prepare_supported_oids(); -#endif - - reseed_prngs(); - - /* Demote the private keys to public keys. */ - demote_sensitive_data(); - - /* Demote the child */ - if (privsep_chroot) { - /* Change our root directory */ - if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1) - fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR, - strerror(errno)); - if (chdir("/") == -1) - fatal("chdir(\"/\"): %s", strerror(errno)); - - /* Drop our privileges */ - debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid, - (u_int)privsep_pw->pw_gid); - gidset[0] = privsep_pw->pw_gid; - if (setgroups(1, gidset) == -1) - fatal("setgroups: %.100s", strerror(errno)); - permanently_set_uid(privsep_pw); - } -} - -static int -privsep_preauth(struct ssh *ssh) -{ - int status, r; + int i; pid_t pid; - struct ssh_sandbox *box = NULL; - - /* Set up unprivileged child process to deal with network data */ - pmonitor = monitor_init(); - /* Store a pointer to the kex for later rekeying */ - pmonitor->m_pkex = &ssh->kex; - - if (use_privsep == PRIVSEP_ON) - box = ssh_sandbox_init(pmonitor); - pid = fork(); - if (pid == -1) { - fatal("fork of unprivileged child failed"); - } else if (pid != 0) { - debug2("Network child is on pid %ld", (long)pid); - - pmonitor->m_pid = pid; - if (have_agent) { - r = ssh_get_authentication_socket(&auth_sock); - if (r != 0) { - error_r(r, "Could not get agent socket"); - have_agent = 0; - } - } - if (box != NULL) - ssh_sandbox_parent_preauth(box, pid); - monitor_child_preauth(ssh, pmonitor); + int status; - /* Wait for the child's exit status */ - while (waitpid(pid, &status, 0) == -1) { - if (errno == EINTR) + if (children == NULL) + return; + + for (;;) { + if ((pid = waitpid(-1, &status, WNOHANG)) == 0) + break; + else if (pid == -1) { + if (errno == EINTR || errno == EAGAIN) continue; - pmonitor->m_pid = -1; - fatal_f("waitpid: %s", strerror(errno)); + if (errno != ECHILD) + error_f("waitpid: %s", strerror(errno)); + break; } - privsep_is_preauth = 0; - pmonitor->m_pid = -1; - if (WIFEXITED(status)) { - if (WEXITSTATUS(status) != 0) - fatal_f("preauth child exited with status %d", - WEXITSTATUS(status)); - } else if (WIFSIGNALED(status)) - fatal_f("preauth child terminated by signal %d", - WTERMSIG(status)); - if (box != NULL) - ssh_sandbox_parent_finish(box); - return 1; - } else { - /* child */ - close(pmonitor->m_sendfd); - close(pmonitor->m_log_recvfd); - - /* Arrange for logging to be sent to the monitor */ - set_log_handler(mm_log_handler, pmonitor); - - privsep_preauth_child(); - setproctitle("%s", "[net]"); - if (box != NULL) - ssh_sandbox_child(box); - - return 0; - } -} - -static void -privsep_postauth(struct ssh *ssh, Authctxt *authctxt) -{ -#ifdef DISABLE_FD_PASSING - if (1) { -#else - if (authctxt->pw->pw_uid == 0) { -#endif - /* File descriptor passing is broken or root login */ - use_privsep = 0; - goto skip; + child_exit(pid, status); } - /* New socket pair */ - monitor_reinit(pmonitor); - - pmonitor->m_pid = fork(); - if (pmonitor->m_pid == -1) - fatal("fork of unprivileged child failed"); - else if (pmonitor->m_pid != 0) { - verbose("User child is on pid %ld", (long)pmonitor->m_pid); - sshbuf_reset(loginmsg); - monitor_clear_keystate(ssh, pmonitor); - monitor_child_postauth(ssh, pmonitor); - - /* NEVERREACHED */ - exit(0); + for (i = 0; i < options.max_startups; i++) { + if (!children[i].have_status) + continue; + child_reap(&(children[i])); } - - /* child */ - - close(pmonitor->m_sendfd); - pmonitor->m_sendfd = -1; - - /* Demote the private keys to public keys. */ - demote_sensitive_data(); - - reseed_prngs(); - - /* Drop privileges */ - do_setusercontext(authctxt->pw); - - skip: - /* It is safe now to apply the key state */ - monitor_apply_keystate(ssh, pmonitor); - - /* - * Tell the packet layer that authentication was successful, since - * this information is not part of the key state. - */ - ssh_packet_set_authenticated(ssh); } static void -append_hostkey_type(struct sshbuf *b, const char *s) +close_startup_pipes(void) { - int r; + int i; - if (match_pattern_list(s, options.hostkeyalgorithms, 0) != 1) { - debug3_f("%s key not permitted by HostkeyAlgorithms", s); + if (children == NULL) return; + for (i = 0; i < options.max_startups; i++) { + if (children[i].pipefd != -1) + child_close(&(children[i]), 1, 1); } - if ((r = sshbuf_putf(b, "%s%s", sshbuf_len(b) > 0 ? "," : "", s)) != 0) - fatal_fr(r, "sshbuf_putf"); -} - -static char * -list_hostkey_types(void) -{ - struct sshbuf *b; - struct sshkey *key; - char *ret; - u_int i; - - if ((b = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - for (i = 0; i < options.num_host_key_files; i++) { - key = sensitive_data.host_keys[i]; - if (key == NULL) - key = sensitive_data.host_pubkeys[i]; - if (key == NULL) - continue; - switch (key->type) { - case KEY_RSA: - /* for RSA we also support SHA2 signatures */ - append_hostkey_type(b, "rsa-sha2-512"); - append_hostkey_type(b, "rsa-sha2-256"); - /* FALLTHROUGH */ - case KEY_DSA: - case KEY_ECDSA: - case KEY_ED25519: - case KEY_ECDSA_SK: - case KEY_ED25519_SK: - case KEY_XMSS: - append_hostkey_type(b, sshkey_ssh_name(key)); - break; - } - /* If the private key has a cert peer, then list that too */ - key = sensitive_data.host_certificates[i]; - if (key == NULL) - continue; - switch (key->type) { - case KEY_RSA_CERT: - /* for RSA we also support SHA2 signatures */ - append_hostkey_type(b, - "rsa-sha2-512-cert-v01@openssh.com"); - append_hostkey_type(b, - "rsa-sha2-256-cert-v01@openssh.com"); - /* FALLTHROUGH */ - case KEY_DSA_CERT: - case KEY_ECDSA_CERT: - case KEY_ED25519_CERT: - case KEY_ECDSA_SK_CERT: - case KEY_ED25519_SK_CERT: - case KEY_XMSS_CERT: - append_hostkey_type(b, sshkey_ssh_name(key)); - break; - } - } - if ((ret = sshbuf_dup_string(b)) == NULL) - fatal_f("sshbuf_dup_string failed"); - sshbuf_free(b); - debug_f("%s", ret); - return ret; } -static struct sshkey * -get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh) +/* Called after SIGINFO */ +static void +show_info(void) { - u_int i; - struct sshkey *key; + int i; - for (i = 0; i < options.num_host_key_files; i++) { - switch (type) { - case KEY_RSA_CERT: - case KEY_DSA_CERT: - case KEY_ECDSA_CERT: - case KEY_ED25519_CERT: - case KEY_ECDSA_SK_CERT: - case KEY_ED25519_SK_CERT: - case KEY_XMSS_CERT: - key = sensitive_data.host_certificates[i]; - break; - default: - key = sensitive_data.host_keys[i]; - if (key == NULL && !need_private) - key = sensitive_data.host_pubkeys[i]; - break; - } - if (key == NULL || key->type != type) + /* XXX print listening sockets here too */ + if (children == NULL) + return; + logit("%d active startups", children_active); + for (i = 0; i < options.max_startups; i++) { + if (children[i].pipefd == -1 && children[i].pid <= 0) continue; - switch (type) { - case KEY_ECDSA: - case KEY_ECDSA_SK: - case KEY_ECDSA_CERT: - case KEY_ECDSA_SK_CERT: - if (key->ecdsa_nid != nid) - continue; - /* FALLTHROUGH */ - default: - return need_private ? - sensitive_data.host_keys[i] : key; - } + logit("child %d: fd=%d pid=%ld %s%s", i, children[i].pipefd, + (long)children[i].pid, children[i].id, + children[i].early ? " (early)" : ""); } - return NULL; + srclimit_penalty_info(); } -struct sshkey * -get_hostkey_public_by_type(int type, int nid, struct ssh *ssh) -{ - return get_hostkey_by_type(type, nid, 0, ssh); -} +/* + * Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP; + * the effect is to reread the configuration file (and to regenerate + * the server key). + */ -struct sshkey * -get_hostkey_private_by_type(int type, int nid, struct ssh *ssh) +static void +sighup_handler(int sig) { - return get_hostkey_by_type(type, nid, 1, ssh); + received_sighup = 1; } -struct sshkey * -get_hostkey_by_index(int ind) +/* + * Called from the main program after receiving SIGHUP. + * Restarts the server. + */ +static void +sighup_restart(void) { - if (ind < 0 || (u_int)ind >= options.num_host_key_files) - return (NULL); - return (sensitive_data.host_keys[ind]); + logit("Received SIGHUP; restarting."); + if (options.pid_file != NULL) + unlink(options.pid_file); + platform_pre_restart(); + close_listen_socks(); + close_startup_pipes(); + ssh_signal(SIGHUP, SIG_IGN); /* will be restored after exec */ + execv(saved_argv[0], saved_argv); + logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], + strerror(errno)); + exit(1); } -struct sshkey * -get_hostkey_public_by_index(int ind, struct ssh *ssh) +/* + * Generic signal handler for terminating signals in the master daemon. + */ +static void +sigterm_handler(int sig) { - if (ind < 0 || (u_int)ind >= options.num_host_key_files) - return (NULL); - return (sensitive_data.host_pubkeys[ind]); + received_sigterm = sig; } -int -get_hostkey_index(struct sshkey *key, int compare, struct ssh *ssh) +#ifdef SIGINFO +static void +siginfo_handler(int sig) { - u_int i; - - for (i = 0; i < options.num_host_key_files; i++) { - if (sshkey_is_cert(key)) { - if (key == sensitive_data.host_certificates[i] || - (compare && sensitive_data.host_certificates[i] && - sshkey_equal(key, - sensitive_data.host_certificates[i]))) - return (i); - } else { - if (key == sensitive_data.host_keys[i] || - (compare && sensitive_data.host_keys[i] && - sshkey_equal(key, sensitive_data.host_keys[i]))) - return (i); - if (key == sensitive_data.host_pubkeys[i] || - (compare && sensitive_data.host_pubkeys[i] && - sshkey_equal(key, sensitive_data.host_pubkeys[i]))) - return (i); - } - } - return (-1); + received_siginfo = 1; } +#endif -/* Inform the client of all hostkeys */ static void -notify_hostkeys(struct ssh *ssh) +main_sigchld_handler(int sig) { - struct sshbuf *buf; - struct sshkey *key; - u_int i, nkeys; - int r; - char *fp; - - /* Some clients cannot cope with the hostkeys message, skip those. */ - if (ssh->compat & SSH_BUG_HOSTKEYS) - return; - - if ((buf = sshbuf_new()) == NULL) - fatal_f("sshbuf_new"); - for (i = nkeys = 0; i < options.num_host_key_files; i++) { - key = get_hostkey_public_by_index(i, ssh); - if (key == NULL || key->type == KEY_UNSPEC || - sshkey_is_cert(key)) - continue; - fp = sshkey_fingerprint(key, options.fingerprint_hash, - SSH_FP_DEFAULT); - debug3_f("key %d: %s %s", i, sshkey_ssh_name(key), fp); - free(fp); - if (nkeys == 0) { - /* - * Start building the request when we find the - * first usable key. - */ - if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || - (r = sshpkt_put_cstring(ssh, "hostkeys-00@openssh.com")) != 0 || - (r = sshpkt_put_u8(ssh, 0)) != 0) /* want reply */ - sshpkt_fatal(ssh, r, "%s: start request", __func__); - } - /* Append the key to the request */ - sshbuf_reset(buf); - if ((r = sshkey_putb(key, buf)) != 0) - fatal_fr(r, "couldn't put hostkey %d", i); - if ((r = sshpkt_put_stringb(ssh, buf)) != 0) - sshpkt_fatal(ssh, r, "%s: append key", __func__); - nkeys++; - } - debug3_f("sent %u hostkeys", nkeys); - if (nkeys == 0) - fatal_f("no hostkeys"); - if ((r = sshpkt_send(ssh)) != 0) - sshpkt_fatal(ssh, r, "%s: send", __func__); - sshbuf_free(buf); + received_sigchld = 1; } /* @@ -833,7 +555,7 @@ should_drop_connection(int startups) } /* - * Check whether connection should be accepted by MaxStartups. + * Check whether connection should be accepted by MaxStartups or for penalty. * Returns 0 if the connection is accepted. If the connection is refused, * returns 1 and attempts to send notification to client. * Logs when the MaxStartups condition is entered or exited, and periodically @@ -843,12 +565,17 @@ static int drop_connection(int sock, int startups, int notify_pipe) { char *laddr, *raddr; - const char msg[] = "Exceeded MaxStartups\r\n"; + const char *reason = NULL, msg[] = "Not allowed at this time\r\n"; static time_t last_drop, first_drop; static u_int ndropped; LogLevel drop_level = SYSLOG_LEVEL_VERBOSE; time_t now; + if (!srclimit_penalty_check_allow(sock, &reason)) { + drop_level = SYSLOG_LEVEL_INFO; + goto handle; + } + now = monotime(); if (!should_drop_connection(startups) && srclimit_check_allow(sock, notify_pipe) == 1) { @@ -878,12 +605,16 @@ drop_connection(int sock, int startups, int notify_pipe) } last_drop = now; ndropped++; + reason = "past Maxstartups"; + handle: laddr = get_local_ipaddr(sock); raddr = get_peer_ipaddr(sock); - do_log2(drop_level, "drop connection #%d from [%s]:%d on [%s]:%d " - "past MaxStartups", startups, raddr, get_peer_port(sock), - laddr, get_local_port(sock)); + do_log2(drop_level, "drop connection #%d from [%s]:%d on [%s]:%d %s", + startups, + raddr, get_peer_port(sock), + laddr, get_local_port(sock), + reason); free(laddr); free(raddr); /* best-effort notification to client */ @@ -903,17 +634,64 @@ usage(void) exit(1); } +static struct sshbuf * +pack_hostkeys(void) +{ + struct sshbuf *keybuf = NULL, *hostkeys = NULL; + int r; + u_int i; + + if ((keybuf = sshbuf_new()) == NULL || + (hostkeys = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + + /* pack hostkeys into a string. Empty key slots get empty strings */ + for (i = 0; i < options.num_host_key_files; i++) { + /* private key */ + sshbuf_reset(keybuf); + if (sensitive_data.host_keys[i] != NULL && + (r = sshkey_private_serialize(sensitive_data.host_keys[i], + keybuf)) != 0) + fatal_fr(r, "serialize hostkey private"); + if ((r = sshbuf_put_stringb(hostkeys, keybuf)) != 0) + fatal_fr(r, "compose hostkey private"); + /* public key */ + if (sensitive_data.host_pubkeys[i] != NULL) { + if ((r = sshkey_puts(sensitive_data.host_pubkeys[i], + hostkeys)) != 0) + fatal_fr(r, "compose hostkey public"); + } else { + if ((r = sshbuf_put_string(hostkeys, NULL, 0)) != 0) + fatal_fr(r, "compose hostkey empty public"); + } + /* cert */ + if (sensitive_data.host_certificates[i] != NULL) { + if ((r = sshkey_puts( + sensitive_data.host_certificates[i], + hostkeys)) != 0) + fatal_fr(r, "compose host cert"); + } else { + if ((r = sshbuf_put_string(hostkeys, NULL, 0)) != 0) + fatal_fr(r, "compose host cert empty"); + } + } + + sshbuf_free(keybuf); + return hostkeys; +} + static void send_rexec_state(int fd, struct sshbuf *conf) { - struct sshbuf *m = NULL, *inc = NULL; + struct sshbuf *m = NULL, *inc = NULL, *hostkeys = NULL; struct include_item *item = NULL; - int r; + int r, sz; debug3_f("entering fd = %d config len %zu", fd, sshbuf_len(conf)); - if ((m = sshbuf_new()) == NULL || (inc = sshbuf_new()) == NULL) + if ((m = sshbuf_new()) == NULL || + (inc = sshbuf_new()) == NULL) fatal_f("sshbuf_new failed"); /* pack includes into a string */ @@ -924,9 +702,17 @@ send_rexec_state(int fd, struct sshbuf *conf) fatal_fr(r, "compose includes"); } + hostkeys = pack_hostkeys(); + /* * Protocol from reexec master to child: * string configuration + * uint64 timing_secret + * string host_keys[] { + * string private_key + * string public_key + * string certificate + * } * string included_files[] { * string selector * string filename @@ -934,81 +720,26 @@ send_rexec_state(int fd, struct sshbuf *conf) * } */ if ((r = sshbuf_put_stringb(m, conf)) != 0 || + (r = sshbuf_put_u64(m, options.timing_secret)) != 0 || + (r = sshbuf_put_stringb(m, hostkeys)) != 0 || (r = sshbuf_put_stringb(m, inc)) != 0) fatal_fr(r, "compose config"); + + /* We need to fit the entire message inside the socket send buffer */ + sz = ROUNDUP(sshbuf_len(m) + 5, 16*1024); + if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sz, sizeof sz) == -1) + fatal_f("setsockopt SO_SNDBUF: %s", strerror(errno)); + if (ssh_msg_send(fd, 0, m) == -1) error_f("ssh_msg_send failed"); sshbuf_free(m); sshbuf_free(inc); + sshbuf_free(hostkeys); debug3_f("done"); } -static void -recv_rexec_state(int fd, struct sshbuf *conf) -{ - struct sshbuf *m, *inc; - u_char *cp, ver; - size_t len; - int r; - struct include_item *item; - - debug3_f("entering fd = %d", fd); - - if ((m = sshbuf_new()) == NULL || (inc = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - if (ssh_msg_recv(fd, m) == -1) - fatal_f("ssh_msg_recv failed"); - if ((r = sshbuf_get_u8(m, &ver)) != 0) - fatal_fr(r, "parse version"); - if (ver != 0) - fatal_f("rexec version mismatch"); - if ((r = sshbuf_get_string(m, &cp, &len)) != 0 || - (r = sshbuf_get_stringb(m, inc)) != 0) - fatal_fr(r, "parse config"); - - if (conf != NULL && (r = sshbuf_put(conf, cp, len))) - fatal_fr(r, "sshbuf_put"); - - while (sshbuf_len(inc) != 0) { - item = xcalloc(1, sizeof(*item)); - if ((item->contents = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - if ((r = sshbuf_get_cstring(inc, &item->selector, NULL)) != 0 || - (r = sshbuf_get_cstring(inc, &item->filename, NULL)) != 0 || - (r = sshbuf_get_stringb(inc, item->contents)) != 0) - fatal_fr(r, "parse includes"); - TAILQ_INSERT_TAIL(&includes, item, entry); - } - - free(cp); - sshbuf_free(m); - - debug3_f("done"); -} - -/* Accept a connection from inetd */ -static void -server_accept_inetd(int *sock_in, int *sock_out) -{ - if (rexeced_flag) { - close(REEXEC_CONFIG_PASS_FD); - *sock_in = *sock_out = dup(STDIN_FILENO); - } else { - *sock_in = dup(STDIN_FILENO); - *sock_out = dup(STDOUT_FILENO); - } - /* - * We intentionally do not close the descriptors 0, 1, and 2 - * as our code for setting the descriptors won't work if - * ttyfd happens to be one of those. - */ - if (stdfd_devnull(1, 1, !log_stderr) == -1) - error_f("stdfd_devnull failed"); - debug("inetd sockets after dupping: %d, %d", *sock_in, *sock_out); -} - /* * Listen for TCP connections */ @@ -1090,8 +821,12 @@ server_listen(void) u_int i; /* Initialise per-source limit tracking. */ - srclimit_init(options.max_startups, options.per_source_max_startups, - options.per_source_masklen_ipv4, options.per_source_masklen_ipv6); + srclimit_init(options.max_startups, + options.per_source_max_startups, + options.per_source_masklen_ipv4, + options.per_source_masklen_ipv6, + &options.per_source_penalty, + options.per_source_penalty_exempt); for (i = 0; i < options.num_listen_addrs; i++) { listen_on_addrs(&options.listen_addrs[i]); @@ -1113,35 +848,36 @@ server_listen(void) * from this function are in a forked subprocess. */ static void -server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) +server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s, + int log_stderr) { struct pollfd *pfd = NULL; - int i, j, ret, npfd; - int ostartups = -1, startups = 0, listening = 0, lameduck = 0; + int i, ret, npfd; + int oactive = -1, listening = 0, lameduck = 0; int startup_p[2] = { -1 , -1 }, *startup_pollfd; char c = 0; struct sockaddr_storage from; + struct early_child *child; socklen_t fromlen; - pid_t pid; u_char rnd[256]; sigset_t nsigset, osigset; /* pipes connected to unauthenticated child sshd processes */ - startup_pipes = xcalloc(options.max_startups, sizeof(int)); - startup_flags = xcalloc(options.max_startups, sizeof(int)); + child_alloc(); startup_pollfd = xcalloc(options.max_startups, sizeof(int)); - for (i = 0; i < options.max_startups; i++) - startup_pipes[i] = -1; /* * Prepare signal mask that we use to block signals that might set - * received_sigterm or received_sighup, so that we are guaranteed + * received_sigterm/hup/chld/info, so that we are guaranteed * to immediately wake up the ppoll if a signal is received after * the flag is checked. */ sigemptyset(&nsigset); sigaddset(&nsigset, SIGHUP); sigaddset(&nsigset, SIGCHLD); +#ifdef SIGINFO + sigaddset(&nsigset, SIGINFO); +#endif sigaddset(&nsigset, SIGTERM); sigaddset(&nsigset, SIGQUIT); @@ -1163,11 +899,19 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) unlink(options.pid_file); exit(received_sigterm == SIGTERM ? 0 : 255); } - if (ostartups != startups) { + if (received_sigchld) { + child_reap_all_exited(); + received_sigchld = 0; + } + if (received_siginfo) { + show_info(); + received_siginfo = 0; + } + if (oactive != children_active) { setproctitle("%s [listener] %d of %d-%d startups", - listener_proctitle, startups, + listener_proctitle, children_active, options.max_startups_begin, options.max_startups); - ostartups = startups; + oactive = children_active; } if (received_sighup) { if (!lameduck) { @@ -1188,8 +932,8 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) npfd = num_listen_socks; for (i = 0; i < options.max_startups; i++) { startup_pollfd[i] = -1; - if (startup_pipes[i] != -1) { - pfd[npfd].fd = startup_pipes[i]; + if (children[i].pipefd != -1) { + pfd[npfd].fd = children[i].pipefd; pfd[npfd].events = POLLIN; startup_pollfd[i] = npfd++; } @@ -1207,34 +951,46 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) continue; for (i = 0; i < options.max_startups; i++) { - if (startup_pipes[i] == -1 || + if (children[i].pipefd == -1 || startup_pollfd[i] == -1 || !(pfd[startup_pollfd[i]].revents & (POLLIN|POLLHUP))) continue; - switch (read(startup_pipes[i], &c, sizeof(c))) { + switch (read(children[i].pipefd, &c, sizeof(c))) { case -1: if (errno == EINTR || errno == EAGAIN) continue; if (errno != EPIPE) { error_f("startup pipe %d (fd=%d): " - "read %s", i, startup_pipes[i], + "read %s", i, children[i].pipefd, strerror(errno)); } /* FALLTHROUGH */ case 0: - /* child exited or completed auth */ - close(startup_pipes[i]); - srclimit_done(startup_pipes[i]); - startup_pipes[i] = -1; - startups--; - if (startup_flags[i]) + /* child exited preauth */ + if (children[i].early) listening--; + srclimit_done(children[i].pipefd); + child_close(&(children[i]), 0, 0); break; case 1: - /* child has finished preliminaries */ - if (startup_flags[i]) { + if (children[i].early && c == '\0') { + /* child has finished preliminaries */ listening--; - startup_flags[i] = 0; + children[i].early = 0; + debug2_f("child %lu for %s received " + "config", (long)children[i].pid, + children[i].id); + } else if (!children[i].early && c == '\001') { + /* child has completed auth */ + debug2_f("child %lu for %s auth done", + (long)children[i].pid, + children[i].id); + child_close(&(children[i]), 1, 0); + } else { + error_f("unexpected message 0x%02x " + "child %ld for %s in state %d", + (int)c, (long)children[i].pid, + children[i].id, children[i].early); } break; } @@ -1263,14 +1019,15 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) close(*newsock); continue; } - if (drop_connection(*newsock, startups, startup_p[0])) { + if (drop_connection(*newsock, + children_active, startup_p[0])) { close(*newsock); close(startup_p[0]); close(startup_p[1]); continue; } - if (rexec_flag && socketpair(AF_UNIX, + if (socketpair(AF_UNIX, SOCK_STREAM, 0, config_s) == -1) { error("reexec socketpair: %s", strerror(errno)); @@ -1280,14 +1037,6 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) continue; } - for (j = 0; j < options.max_startups; j++) - if (startup_pipes[j] == -1) { - startup_pipes[j] = startup_p[0]; - startups++; - startup_flags[j] = 1; - break; - } - /* * Got connection. Fork a child to handle it, unless * we are in debugging mode. @@ -1305,11 +1054,8 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) close(startup_p[0]); close(startup_p[1]); startup_pipe = -1; - pid = getpid(); - if (rexec_flag) { - send_rexec_state(config_s[0], cfg); - close(config_s[0]); - } + send_rexec_state(config_s[0], cfg); + close(config_s[0]); free(pfd); return; } @@ -1321,7 +1067,8 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) */ platform_pre_fork(); listening++; - if ((pid = fork()) == 0) { + child = child_register(startup_p[0], *newsock); + if ((child->pid = fork()) == 0) { /* * Child. Close the listening and * max_startup sockets. Start using @@ -1340,37 +1087,23 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) options.log_level, options.log_facility, log_stderr); - if (rexec_flag) - close(config_s[0]); - else { - /* - * Signal parent that the preliminaries - * for this child are complete. For the - * re-exec case, this happens after the - * child has received the rexec state - * from the server. - */ - (void)atomicio(vwrite, startup_pipe, - "\0", 1); - } + close(config_s[0]); free(pfd); return; } /* Parent. Stay in the loop. */ - platform_post_fork_parent(pid); - if (pid == -1) + platform_post_fork_parent(child->pid); + if (child->pid == -1) error("fork: %.100s", strerror(errno)); else - debug("Forked child %ld.", (long)pid); + debug("Forked child %ld.", (long)child->pid); close(startup_p[1]); - if (rexec_flag) { - close(config_s[1]); - send_rexec_state(config_s[0], cfg); - close(config_s[0]); - } + close(config_s[1]); + send_rexec_state(config_s[0], cfg); + close(config_s[0]); close(*newsock); /* @@ -1389,88 +1122,6 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) } } -/* - * If IP options are supported, make sure there are none (log and - * return an error if any are found). Basically we are worried about - * source routing; it can be used to pretend you are somebody - * (ip-address) you are not. That itself may be "almost acceptable" - * under certain circumstances, but rhosts authentication is useless - * if source routing is accepted. Notice also that if we just dropped - * source routing here, the other side could use IP spoofing to do - * rest of the interaction and could still bypass security. So we - * exit here if we detect any IP options. - */ -static void -check_ip_options(struct ssh *ssh) -{ -#ifdef IP_OPTIONS - int sock_in = ssh_packet_get_connection_in(ssh); - struct sockaddr_storage from; - u_char opts[200]; - socklen_t i, option_size = sizeof(opts), fromlen = sizeof(from); - char text[sizeof(opts) * 3 + 1]; - - memset(&from, 0, sizeof(from)); - if (getpeername(sock_in, (struct sockaddr *)&from, - &fromlen) == -1) - return; - if (from.ss_family != AF_INET) - return; - /* XXX IPv6 options? */ - - if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts, - &option_size) >= 0 && option_size != 0) { - text[0] = '\0'; - for (i = 0; i < option_size; i++) - snprintf(text + i*3, sizeof(text) - i*3, - " %2.2x", opts[i]); - fatal("Connection from %.100s port %d with IP opts: %.800s", - ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text); - } - return; -#endif /* IP_OPTIONS */ -} - -/* Set the routing domain for this process */ -static void -set_process_rdomain(struct ssh *ssh, const char *name) -{ -#if defined(HAVE_SYS_SET_PROCESS_RDOMAIN) - if (name == NULL) - return; /* default */ - - if (strcmp(name, "%D") == 0) { - /* "expands" to routing domain of connection */ - if ((name = ssh_packet_rdomain_in(ssh)) == NULL) - return; - } - /* NB. We don't pass 'ssh' to sys_set_process_rdomain() */ - return sys_set_process_rdomain(name); -#elif defined(__OpenBSD__) - int rtable, ortable = getrtable(); - const char *errstr; - - if (name == NULL) - return; /* default */ - - if (strcmp(name, "%D") == 0) { - /* "expands" to routing domain of connection */ - if ((name = ssh_packet_rdomain_in(ssh)) == NULL) - return; - } - - rtable = (int)strtonum(name, 0, 255, &errstr); - if (errstr != NULL) /* Shouldn't happen */ - fatal("Invalid routing domain \"%s\": %s", name, errstr); - if (rtable != ortable && setrtable(rtable) != 0) - fatal("Unable to set routing domain %d: %s", - rtable, strerror(errno)); - debug_f("set routing domain %d (was %d)", rtable, ortable); -#else /* defined(__OpenBSD__) */ - fatal("Unable to set routing domain: not supported in this platform"); -#endif -} - static void accumulate_host_timing_secret(struct sshbuf *server_cfg, struct sshkey *key) @@ -1520,14 +1171,8 @@ prepare_proctitle(int ac, char **av) } static void -print_config(struct ssh *ssh, struct connection_info *connection_info) +print_config(struct connection_info *connection_info) { - /* - * If no connection info was provided by -C then use - * use a blank one that will cause no predicate to match. - */ - if (connection_info == NULL) - connection_info = get_connection_info(ssh, 0, 0); connection_info->test = 1; parse_server_match_config(&options, &includes, connection_info); dump_config(&options); @@ -1540,24 +1185,24 @@ print_config(struct ssh *ssh, struct connection_info *connection_info) int main(int ac, char **av) { - struct ssh *ssh = NULL; extern char *optarg; extern int optind; - int r, opt, on = 1, do_dump_cfg = 0, already_daemon, remote_port; - int sock_in = -1, sock_out = -1, newsock = -1; - const char *remote_ip, *rdomain; - char *fp, *line, *laddr, *logfile = NULL; - int config_s[2] = { -1 , -1 }; + int log_stderr = 0, inetd_flag = 0, test_flag = 0, no_daemon_flag = 0; + char *config_file_name = _PATH_SERVER_CONFIG_FILE; + int r, opt, do_dump_cfg = 0, keytype, already_daemon, have_agent = 0; + int sock_in = -1, sock_out = -1, newsock = -1, rexec_argc = 0; + int devnull, config_s[2] = { -1 , -1 }, have_connection_info = 0; + int need_chroot = 1; + char *fp, *line, *logfile = NULL, **rexec_argv = NULL; + struct stat sb; u_int i, j; - u_int64_t ibytes, obytes; mode_t new_umask; struct sshkey *key; struct sshkey *pubkey; - int keytype; - Authctxt *authctxt; - struct connection_info *connection_info = NULL; + struct connection_info connection_info; sigset_t sigmask; + memset(&connection_info, 0, sizeof(connection_info)); #ifdef HAVE_SECUREWARE (void)set_auth_parameters(ac, av); #endif @@ -1629,11 +1274,10 @@ main(int ac, char **av) inetd_flag = 1; break; case 'r': - rexec_flag = 0; + logit("-r option is deprecated"); break; case 'R': - rexeced_flag = 1; - inetd_flag = 1; + fatal("-R not supported here"); break; case 'Q': /* ignored */ @@ -1676,10 +1320,10 @@ main(int ac, char **av) test_flag = 2; break; case 'C': - connection_info = get_connection_info(ssh, 0, 0); - if (parse_server_match_testspec(connection_info, + if (parse_server_match_testspec(&connection_info, optarg) == -1) exit(1); + have_connection_info = 1; break; case 'u': utmp_len = (u_int)strtonum(optarg, 0, HOST_NAME_MAX+1+1, NULL); @@ -1704,20 +1348,34 @@ main(int ac, char **av) break; } } - if (rexeced_flag || inetd_flag) - rexec_flag = 0; - if (!test_flag && !do_dump_cfg && rexec_flag && !path_absolute(av[0])) - fatal("sshd re-exec requires execution with an absolute path"); - if (rexeced_flag) - closefrom(REEXEC_MIN_FREE_FD); - else - closefrom(REEXEC_DEVCRYPTO_RESERVED_FD); + if (!test_flag && !inetd_flag && !do_dump_cfg && !path_absolute(av[0])) + fatal("sshd requires execution with an absolute path"); + + closefrom(STDERR_FILENO + 1); + + /* Reserve fds we'll need later for reexec things */ + if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) + fatal("open %s: %s", _PATH_DEVNULL, strerror(errno)); + while (devnull < REEXEC_MIN_FREE_FD) { + if ((devnull = dup(devnull)) == -1) + fatal("dup %s: %s", _PATH_DEVNULL, strerror(errno)); + } seed_rng(); /* If requested, redirect the logs to the specified logfile. */ - if (logfile != NULL) - log_redirect_stderr_to(logfile); + if (logfile != NULL) { + char *cp, pid_s[32]; + + snprintf(pid_s, sizeof(pid_s), "%ld", (unsigned long)getpid()); + cp = percent_expand(logfile, + "p", pid_s, + "P", "sshd", + (char *)NULL); + log_redirect_stderr_to(cp); + free(cp); + } + /* * Force logging to stderr until we have loaded the private host * key (unless started from inetd) @@ -1742,35 +1400,18 @@ main(int ac, char **av) * If we're not doing an extended test do not silently ignore connection * test params. */ - if (test_flag < 2 && connection_info != NULL) + if (test_flag < 2 && have_connection_info) fatal("Config test connection parameter (-C) provided without " "test mode (-T)"); /* Fetch our configuration */ if ((cfg = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - if (rexeced_flag) { - setproctitle("%s", "[rexeced]"); - recv_rexec_state(REEXEC_CONFIG_PASS_FD, cfg); - if (!debug_flag) { - startup_pipe = dup(REEXEC_STARTUP_PIPE_FD); - close(REEXEC_STARTUP_PIPE_FD); - /* - * Signal parent that this child is at a point where - * they can go away if they have a SIGHUP pending. - */ - (void)atomicio(vwrite, startup_pipe, "\0", 1); - } - } else if (strcasecmp(config_file_name, "none") != 0) + fatal("sshbuf_new config failed"); + if (strcasecmp(config_file_name, "none") != 0) load_server_config(config_file_name, cfg); - parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name, - cfg, &includes, NULL, rexeced_flag); - -#ifdef WITH_OPENSSL - if (options.moduli_file != NULL) - dh_set_moduli_file(options.moduli_file); -#endif + parse_server_config(&options, config_file_name, cfg, + &includes, NULL, 0); /* Fill in default values for those options not explicitly set. */ fill_default_server_options(&options); @@ -1790,7 +1431,7 @@ main(int ac, char **av) /* * Check whether there is any path through configured auth methods. * Unfortunately it is not possible to verify this generally before - * daemonisation in the presence of Match block, but this catches + * daemonisation in the presence of Match blocks, but this catches * and warns for trivial misconfigurations that could break login. */ if (options.num_auth_methods != 0) { @@ -1813,20 +1454,7 @@ main(int ac, char **av) debug("sshd version %s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); if (do_dump_cfg) - print_config(ssh, connection_info); - - /* Store privilege separation user for later use if required. */ - privsep_chroot = use_privsep && (getuid() == 0 || geteuid() == 0); - if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { - if (privsep_chroot || options.kerberos_authentication) - fatal("Privilege separation user %s does not exist", - SSH_PRIVSEP_USER); - } else { - privsep_pw = pwcopy(privsep_pw); - freezero(privsep_pw->pw_passwd, strlen(privsep_pw->pw_passwd)); - privsep_pw->pw_passwd = xstrdup("*"); - } - endpwent(); + print_config(&connection_info); /* load host keys */ sensitive_data.host_keys = xcalloc(options.num_host_key_files, @@ -1978,27 +1606,33 @@ main(int ac, char **av) sshkey_type(key)); } - if (privsep_chroot) { - struct stat st; + /* Ensure privsep directory is correctly configured. */ + need_chroot = ((getuid() == 0 || geteuid() == 0) || + options.kerberos_authentication); + if ((getpwnam(SSH_PRIVSEP_USER)) == NULL && need_chroot) { + fatal("Privilege separation user %s does not exist", + SSH_PRIVSEP_USER); + } + endpwent(); - if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) || - (S_ISDIR(st.st_mode) == 0)) + if (need_chroot) { + if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &sb) == -1) || + (S_ISDIR(sb.st_mode) == 0)) fatal("Missing privilege separation directory: %s", _PATH_PRIVSEP_CHROOT_DIR); - #ifdef HAVE_CYGWIN if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR) && - (st.st_uid != getuid () || - (st.st_mode & (S_IWGRP|S_IWOTH)) != 0)) + (sb.st_uid != getuid () || + (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0)) #else - if (st.st_uid != 0 || (st.st_mode & (S_IWGRP|S_IWOTH)) != 0) + if (sb.st_uid != 0 || (sb.st_mode & (S_IWGRP|S_IWOTH)) != 0) #endif fatal("%s must be owned by root and not group or " "world-writable.", _PATH_PRIVSEP_CHROOT_DIR); } if (test_flag > 1) - print_config(ssh, connection_info); + print_config(&connection_info); /* Configuration looks good, so exit if in test mode. */ if (test_flag) @@ -2014,17 +1648,22 @@ main(int ac, char **av) if (setgroups(0, NULL) < 0) debug("setgroups() failed: %.200s", strerror(errno)); - if (rexec_flag) { - if (rexec_argc < 0) - fatal("rexec_argc %d < 0", rexec_argc); - rexec_argv = xcalloc(rexec_argc + 2, sizeof(char *)); - for (i = 0; i < (u_int)rexec_argc; i++) { - debug("rexec_argv[%d]='%s'", i, saved_argv[i]); - rexec_argv[i] = saved_argv[i]; - } - rexec_argv[rexec_argc] = "-R"; - rexec_argv[rexec_argc + 1] = NULL; + /* Prepare arguments for sshd-session */ + if (rexec_argc < 0) + fatal("rexec_argc %d < 0", rexec_argc); + rexec_argv = xcalloc(rexec_argc + 3, sizeof(char *)); + /* Point to the sshd-session binary instead of sshd */ + rexec_argv[0] = options.sshd_session_path; + for (i = 1; i < (u_int)rexec_argc; i++) { + debug("rexec_argv[%d]='%s'", i, saved_argv[i]); + rexec_argv[i] = saved_argv[i]; } + rexec_argv[rexec_argc++] = "-R"; + rexec_argv[rexec_argc] = NULL; + if (stat(rexec_argv[0], &sb) != 0 || !(sb.st_mode & (S_IXOTH|S_IXUSR))) + fatal("%s does not exist or is not executable", rexec_argv[0]); + debug3("using %s for re-exec", rexec_argv[0]); + listener_proctitle = prepare_proctitle(ac, av); /* Ensure that umask disallows at least group and world write */ @@ -2032,7 +1671,7 @@ main(int ac, char **av) (void) umask(new_umask); /* Initialize the log (it is reinitialized below in case we forked). */ - if (debug_flag && (!inetd_flag || rexeced_flag)) + if (debug_flag && !inetd_flag) log_stderr = 1; log_init(__progname, options.log_level, options.log_facility, log_stderr); @@ -2067,7 +1706,11 @@ main(int ac, char **av) /* Get a connection, either from inetd or a listening TCP socket */ if (inetd_flag) { - server_accept_inetd(&sock_in, &sock_out); + /* Send configuration to ancestor sshd-session process */ + if (socketpair(AF_UNIX, SOCK_STREAM, 0, config_s) == -1) + fatal("socketpair: %s", strerror(errno)); + send_rexec_state(config_s[0], cfg); + close(config_s[0]); } else { platform_pre_listen(); server_listen(); @@ -2076,6 +1719,11 @@ main(int ac, char **av) ssh_signal(SIGCHLD, main_sigchld_handler); ssh_signal(SIGTERM, sigterm_handler); ssh_signal(SIGQUIT, sigterm_handler); +#ifdef SIGINFO + ssh_signal(SIGINFO, siginfo_handler); +#endif + + platform_post_listen(); /* * Write out the pid file after the sigterm handler @@ -2095,7 +1743,7 @@ main(int ac, char **av) /* Accept a connection and return in a forked child */ server_accept_loop(&sock_in, &sock_out, - &newsock, config_s); + &newsock, config_s, log_stderr); } /* This is the child processing a new connection. */ @@ -2109,358 +1757,40 @@ main(int ac, char **av) if (!debug_flag && !inetd_flag && setsid() == -1) error("setsid: %.100s", strerror(errno)); - if (rexec_flag) { - debug("rexec start in %d out %d newsock %d pipe %d sock %d", - sock_in, sock_out, newsock, startup_pipe, config_s[0]); + debug("rexec start in %d out %d newsock %d pipe %d sock %d/%d", + sock_in, sock_out, newsock, startup_pipe, config_s[0], config_s[1]); + if (!inetd_flag) { if (dup2(newsock, STDIN_FILENO) == -1) - debug3_f("dup2 stdin: %s", strerror(errno)); + fatal("dup2 stdin: %s", strerror(errno)); if (dup2(STDIN_FILENO, STDOUT_FILENO) == -1) - debug3_f("dup2 stdout: %s", strerror(errno)); - if (startup_pipe == -1) - close(REEXEC_STARTUP_PIPE_FD); - else if (startup_pipe != REEXEC_STARTUP_PIPE_FD) { - if (dup2(startup_pipe, REEXEC_STARTUP_PIPE_FD) == -1) - debug3_f("dup2 startup_p: %s", strerror(errno)); - close(startup_pipe); - startup_pipe = REEXEC_STARTUP_PIPE_FD; - } - + fatal("dup2 stdout: %s", strerror(errno)); + if (newsock > STDOUT_FILENO) + close(newsock); + } + if (config_s[1] != REEXEC_CONFIG_PASS_FD) { if (dup2(config_s[1], REEXEC_CONFIG_PASS_FD) == -1) - debug3_f("dup2 config_s: %s", strerror(errno)); + fatal("dup2 config_s: %s", strerror(errno)); close(config_s[1]); - - ssh_signal(SIGHUP, SIG_IGN); /* avoid reset to SIG_DFL */ - execv(rexec_argv[0], rexec_argv); - - /* Reexec has failed, fall back and continue */ - error("rexec of %s failed: %s", rexec_argv[0], strerror(errno)); - recv_rexec_state(REEXEC_CONFIG_PASS_FD, NULL); - log_init(__progname, options.log_level, - options.log_facility, log_stderr); - - /* Clean up fds */ - close(REEXEC_CONFIG_PASS_FD); - newsock = sock_out = sock_in = dup(STDIN_FILENO); - if (stdfd_devnull(1, 1, 0) == -1) - error_f("stdfd_devnull failed"); - debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d", - sock_in, sock_out, newsock, startup_pipe, config_s[0]); - } - - /* Executed child processes don't need these. */ - fcntl(sock_out, F_SETFD, FD_CLOEXEC); - fcntl(sock_in, F_SETFD, FD_CLOEXEC); - - /* We will not restart on SIGHUP since it no longer makes sense. */ - ssh_signal(SIGALRM, SIG_DFL); - ssh_signal(SIGHUP, SIG_DFL); - ssh_signal(SIGTERM, SIG_DFL); - ssh_signal(SIGQUIT, SIG_DFL); - ssh_signal(SIGCHLD, SIG_DFL); - ssh_signal(SIGINT, SIG_DFL); - - /* - * Register our connection. This turns encryption off because we do - * not have a key. - */ - if ((ssh = ssh_packet_set_connection(NULL, sock_in, sock_out)) == NULL) - fatal("Unable to create connection"); - the_active_state = ssh; - ssh_packet_set_server(ssh); - - check_ip_options(ssh); - - /* Prepare the channels layer */ - channel_init_channels(ssh); - channel_set_af(ssh, options.address_family); - process_channel_timeouts(ssh, &options); - process_permitopen(ssh, &options); - - /* Set SO_KEEPALIVE if requested. */ - if (options.tcp_keep_alive && ssh_packet_connection_is_on_socket(ssh) && - setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) == -1) - error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); - - if ((remote_port = ssh_remote_port(ssh)) < 0) { - debug("ssh_remote_port failed"); - cleanup_exit(255); - } - - if (options.routing_domain != NULL) - set_process_rdomain(ssh, options.routing_domain); - - /* - * The rest of the code depends on the fact that - * ssh_remote_ipaddr() caches the remote ip, even if - * the socket goes away. - */ - remote_ip = ssh_remote_ipaddr(ssh); - -#ifdef SSH_AUDIT_EVENTS - audit_connection_from(remote_ip, remote_port); -#endif - - rdomain = ssh_packet_rdomain_in(ssh); - - /* Log the connection. */ - laddr = get_local_ipaddr(sock_in); - verbose("Connection from %s port %d on %s port %d%s%s%s", - remote_ip, remote_port, laddr, ssh_local_port(ssh), - rdomain == NULL ? "" : " rdomain \"", - rdomain == NULL ? "" : rdomain, - rdomain == NULL ? "" : "\""); - free(laddr); - - /* - * We don't want to listen forever unless the other side - * successfully authenticates itself. So we set up an alarm which is - * cleared after successful authentication. A limit of zero - * indicates no limit. Note that we don't set the alarm in debugging - * mode; it is just annoying to have the server exit just when you - * are about to discover the bug. - */ - ssh_signal(SIGALRM, grace_alarm_handler); - if (!debug_flag) - alarm(options.login_grace_time); - - if ((r = kex_exchange_identification(ssh, -1, - options.version_addendum)) != 0) - sshpkt_fatal(ssh, r, "banner exchange"); - - ssh_packet_set_nonblocking(ssh); - - /* allocate authentication context */ - authctxt = xcalloc(1, sizeof(*authctxt)); - ssh->authctxt = authctxt; - - authctxt->loginmsg = loginmsg; - - /* XXX global for cleanup, access from other modules */ - the_authctxt = authctxt; - - /* Set default key authentication options */ - if ((auth_opts = sshauthopt_new_with_keys_defaults()) == NULL) - fatal("allocation failed"); - - /* prepare buffer to collect messages to display to user after login */ - if ((loginmsg = sshbuf_new()) == NULL) - fatal_f("sshbuf_new failed"); - auth_debug_reset(); - - if (use_privsep) { - if (privsep_preauth(ssh) == 1) - goto authenticated; - } else if (have_agent) { - if ((r = ssh_get_authentication_socket(&auth_sock)) != 0) { - error_r(r, "Unable to get agent socket"); - have_agent = 0; - } - } - - /* perform the key exchange */ - /* authenticate user and start session */ - do_ssh2_kex(ssh); - do_authentication2(ssh); - - /* - * If we use privilege separation, the unprivileged child transfers - * the current keystate and exits - */ - if (use_privsep) { - mm_send_keystate(ssh, pmonitor); - ssh_packet_clear_keys(ssh); - exit(0); } - - authenticated: - /* - * Cancel the alarm we set to limit the time taken for - * authentication. - */ - alarm(0); - ssh_signal(SIGALRM, SIG_DFL); - authctxt->authenticated = 1; - if (startup_pipe != -1) { + if (startup_pipe == -1) + close(REEXEC_STARTUP_PIPE_FD); + else if (startup_pipe != REEXEC_STARTUP_PIPE_FD) { + if (dup2(startup_pipe, REEXEC_STARTUP_PIPE_FD) == -1) + fatal("dup2 startup_p: %s", strerror(errno)); close(startup_pipe); - startup_pipe = -1; - } - -#ifdef SSH_AUDIT_EVENTS - audit_event(ssh, SSH_AUTH_SUCCESS); -#endif - -#ifdef GSSAPI - if (options.gss_authentication) { - temporarily_use_uid(authctxt->pw); - ssh_gssapi_storecreds(); - restore_uid(); - } -#endif -#ifdef USE_PAM - if (options.use_pam) { - do_pam_setcred(1); - do_pam_session(ssh); - } -#endif - - /* - * In privilege separation, we fork another child and prepare - * file descriptor passing. - */ - if (use_privsep) { - privsep_postauth(ssh, authctxt); - /* the monitor process [priv] will not return */ - } - - ssh_packet_set_timeout(ssh, options.client_alive_interval, - options.client_alive_count_max); - - /* Try to send all our hostkeys to the client */ - notify_hostkeys(ssh); - - /* Start session. */ - do_authenticated(ssh, authctxt); - - /* The connection has been terminated. */ - ssh_packet_get_bytes(ssh, &ibytes, &obytes); - verbose("Transferred: sent %llu, received %llu bytes", - (unsigned long long)obytes, (unsigned long long)ibytes); - - verbose("Closing connection to %.500s port %d", remote_ip, remote_port); - -#ifdef USE_PAM - if (options.use_pam) - finish_pam(); -#endif /* USE_PAM */ - -#ifdef SSH_AUDIT_EVENTS - PRIVSEP(audit_event(ssh, SSH_CONNECTION_CLOSE)); -#endif - - ssh_packet_close(ssh); - - if (use_privsep) - mm_terminate(); - - exit(0); -} - -int -sshd_hostkey_sign(struct ssh *ssh, struct sshkey *privkey, - struct sshkey *pubkey, u_char **signature, size_t *slenp, - const u_char *data, size_t dlen, const char *alg) -{ - int r; - - if (use_privsep) { - if (privkey) { - if (mm_sshkey_sign(ssh, privkey, signature, slenp, - data, dlen, alg, options.sk_provider, NULL, - ssh->compat) < 0) - fatal_f("privkey sign failed"); - } else { - if (mm_sshkey_sign(ssh, pubkey, signature, slenp, - data, dlen, alg, options.sk_provider, NULL, - ssh->compat) < 0) - fatal_f("pubkey sign failed"); - } - } else { - if (privkey) { - if (sshkey_sign(privkey, signature, slenp, data, dlen, - alg, options.sk_provider, NULL, ssh->compat) < 0) - fatal_f("privkey sign failed"); - } else { - if ((r = ssh_agent_sign(auth_sock, pubkey, - signature, slenp, data, dlen, alg, - ssh->compat)) != 0) { - fatal_fr(r, "agent sign failed"); - } - } } - return 0; -} - -/* SSH2 key exchange */ -static void -do_ssh2_kex(struct ssh *ssh) -{ - char *hkalgs = NULL, *myproposal[PROPOSAL_MAX]; - const char *compression = NULL; - struct kex *kex; - int r; - - if (options.rekey_limit || options.rekey_interval) - ssh_packet_set_rekey_limits(ssh, options.rekey_limit, - options.rekey_interval); - - if (options.compression == COMP_NONE) - compression = "none"; - hkalgs = list_hostkey_types(); + log_redirect_stderr_to(NULL); + closefrom(REEXEC_MIN_FREE_FD); - kex_proposal_populate_entries(ssh, myproposal, options.kex_algorithms, - options.ciphers, options.macs, compression, hkalgs); + ssh_signal(SIGHUP, SIG_IGN); /* avoid reset to SIG_DFL */ + execv(rexec_argv[0], rexec_argv); - free(hkalgs); - - /* start key exchange */ - if ((r = kex_setup(ssh, myproposal)) != 0) - fatal_r(r, "kex_setup"); - kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); - kex = ssh->kex; - -#ifdef WITH_OPENSSL - kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; - kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; - kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server; - kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server; - kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; - kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; - kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; -# ifdef OPENSSL_HAS_ECC - kex->kex[KEX_ECDH_SHA2] = kex_gen_server; -# endif -#endif - kex->kex[KEX_C25519_SHA256] = kex_gen_server; - kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; - kex->load_host_public_key=&get_hostkey_public_by_type; - kex->load_host_private_key=&get_hostkey_private_by_type; - kex->host_key_index=&get_hostkey_index; - kex->sign = sshd_hostkey_sign; - - ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &kex->done); - kex_proposal_free_entries(myproposal); - -#ifdef DEBUG_KEXDH - /* send 1st encrypted/maced/compressed message */ - if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 || - (r = sshpkt_put_cstring(ssh, "markus")) != 0 || - (r = sshpkt_send(ssh)) != 0 || - (r = ssh_packet_write_wait(ssh)) != 0) - fatal_fr(r, "send test"); -#endif - debug("KEX done"); + fatal("rexec of %s failed: %s", rexec_argv[0], strerror(errno)); } /* server specific fatal cleanup */ void cleanup_exit(int i) { - if (the_active_state != NULL && the_authctxt != NULL) { - do_cleanup(the_active_state, the_authctxt); - if (use_privsep && privsep_is_preauth && - pmonitor != NULL && pmonitor->m_pid > 1) { - debug("Killing privsep child %d", pmonitor->m_pid); - if (kill(pmonitor->m_pid, SIGKILL) != 0 && - errno != ESRCH) { - error_f("kill(%d): %s", pmonitor->m_pid, - strerror(errno)); - } - } - } -#ifdef SSH_AUDIT_EVENTS - /* done after do_cleanup so it can cancel the PAM auth 'thread' */ - if (the_active_state != NULL && (!use_privsep || mm_is_monitor())) - audit_event(the_active_state, SSH_CONNECTION_ABANDON); -#endif _exit(i); } diff --git a/sshd_config.0 b/sshd_config.0 index 8b39739..f4a8f99 100644 --- a/sshd_config.0 +++ b/sshd_config.0 @@ -616,16 +616,21 @@ DESCRIPTION cache file on logout. The default is yes. KexAlgorithms - Specifies the available KEX (Key Exchange) algorithms. Multiple - algorithms must be comma-separated. Alternately if the specified - list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified algorithms - will be appended to the default set instead of replacing them. - If the specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y character, then the - specified algorithms (including wildcards) will be removed from - the default set instead of replacing them. If the specified list - begins with a M-bM-^@M-^X^M-bM-^@M-^Y character, then the specified algorithms will - be placed at the head of the default set. The supported - algorithms are: + Specifies the permitted KEX (Key Exchange) algorithms that the + server will offer to clients. The ordering of this list is not + important, as the client specifies the preference order. + Multiple algorithms must be comma-separated. + + If the specified list begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the + specified algorithms will be appended to the default set instead + of replacing them. If the specified list begins with a M-bM-^@M-^X-M-bM-^@M-^Y + character, then the specified algorithms (including wildcards) + will be removed from the default set instead of replacing them. + If the specified list begins with a M-bM-^@M-^X^M-bM-^@M-^Y character, then the + specified algorithms will be placed at the head of the default + set. + + The supported algorithms are: curve25519-sha256 curve25519-sha256@libssh.org @@ -639,18 +644,21 @@ DESCRIPTION ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 + mlkem768x25519-sha256 + sntrup761x25519-sha512 sntrup761x25519-sha512@openssh.com The default is: - sntrup761x25519-sha512@openssh.com, + sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, + mlkem768x25519-sha256, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, diffie-hellman-group14-sha256 - The list of available key exchange algorithms may also be + The list of supported key exchange algorithms may also be obtained using "ssh -Q KexAlgorithms". ListenAddress @@ -685,9 +693,9 @@ DESCRIPTION LogVerbose Specify one or more overrides to LogLevel. An override consists - of a pattern lists that matches the source file, function and - line number to force detailed logging for. For example, an - override pattern of: + of one or more pattern lists that matches the source file, + function and line number to force detailed logging for. For + example, an override pattern of: kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* @@ -748,10 +756,12 @@ DESCRIPTION the first instance of the keyword is applied. The arguments to Match are one or more criteria-pattern pairs or - the single token All which matches all criteria. The available - criteria are User, Group, Host, LocalAddress, LocalPort, RDomain, - and Address (with RDomain representing the rdomain(4) on which - the connection was received). + one of the single token criteria: All, which matches all + criteria, or Invalid-User, which matches when the requested user- + name does not match any known account. The available criteria + are User, Group, Host, LocalAddress, LocalPort, RDomain, and + Address (with RDomain representing the rdomain(4) on which the + connection was received). The match patterns may consist of single entries or comma- separated lists and may use the wildcard and negation operators @@ -779,11 +789,12 @@ DESCRIPTION HostbasedAuthentication, HostbasedUsesNameFromPacketOnly, IgnoreRhosts, Include, IPQoS, KbdInteractiveAuthentication, KerberosAuthentication, LogLevel, MaxAuthTries, MaxSessions, - PasswordAuthentication, PermitEmptyPasswords, PermitListen, - PermitOpen, PermitRootLogin, PermitTTY, PermitTunnel, - PermitUserRC, PubkeyAcceptedAlgorithms, PubkeyAuthentication, - PubkeyAuthOptions, RekeyLimit, RevokedKeys, RDomain, SetEnv, - StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys, + PAMServiceName, PasswordAuthentication, PermitEmptyPasswords, + PermitListen, PermitOpen, PermitRootLogin, PermitTTY, + PermitTunnel, PermitUserRC, PubkeyAcceptedAlgorithms, + PubkeyAuthentication, PubkeyAuthOptions, RefuseConnection, + RekeyLimit, RevokedKeys, RDomain, SetEnv, StreamLocalBindMask, + StreamLocalBindUnlink, TrustedUserCAKeys, UnusedConnectionTimeout, X11DisplayOffset, X11Forwarding and X11UseLocalhost. @@ -821,6 +832,11 @@ DESCRIPTION M-bM-^@M-^\diffie-hellman-group-exchange-sha256M-bM-^@M-^] key exchange methods. The default is /etc/moduli. + PAMServiceName + Specifies the service name used for Pluggable Authentication + Modules (PAM) authentication, authorisation and session controls + when UsePAM is enabled. The default is sshd. + PasswordAuthentication Specifies whether password authentication is allowed. The default is yes. @@ -926,6 +942,92 @@ DESCRIPTION separated by a colon. The default is 32:128, which means each address is considered individually. + PerSourcePenalties + Controls penalties for various conditions that may represent + attacks on sshd(8). If a penalty is enforced against a client + then its source address and any others in the same network, as + defined by PerSourceNetBlockSize, will be refused connection for + a period. + + A penalty doesn't affect concurrent connections in progress, but + multiple penalties from the same source from concurrent + connections will accumulate up to a maximum. Conversely, + penalties are not applied until a minimum threshold time has been + accumulated. + + Penalties are enabled by default with the default settings listed + below but may disabled using the no keyword. The defaults may be + overridden by specifying one or more of the keywords below, + separated by whitespace. All keywords accept arguments, e.g. + "crash:2m". + + crash:duration + Specifies how long to refuse clients that cause a crash + of sshd(8) (default: 90s). + + authfail:duration + Specifies how long to refuse clients that disconnect + after making one or more unsuccessful authentication + attempts (default: 5s). + + refuseconnection:duration + Specifies how long to refuse clients that were + administratively prohibited connection via the + RefuseConnection option (default: 10s). + + noauth:duration + Specifies how long to refuse clients that disconnect + without attempting authentication (default: 1s). This + timeout should be used cautiously otherwise it may + penalise legitimate scanning tools such as + ssh-keyscan(1). + + grace-exceeded:duration + Specifies how long to refuse clients that fail to + authenticate after LoginGraceTime (default: 10s). + + max:duration + Specifies the maximum time a particular source address + range will be refused access for (default: 10m). + Repeated penalties will accumulate up to this maximum. + + min:duration + Specifies the minimum penalty that must accrue before + enforcement begins (default: 15s). + + max-sources4:number, max-sources6:number + Specifies the maximum number of client IPv4 and IPv6 + address ranges to track for penalties (default: 65536 for + both). + + overflow:mode + Controls how the server behaves when max-sources4 or + max-sources6 is exceeded. There are two operating modes: + deny-all, which denies all incoming connections other + than those exempted via PerSourcePenaltyExemptList until + a penalty expires, and permissive, which allows new + connections by removing existing penalties early + (default: permissive). Note that client penalties below + the min threshold count against the total number of + tracked penalties. IPv4 and IPv6 addresses are tracked + separately, so an overflow in one will not affect the + other. + + overflow6:mode + Allows specifying a different overflow mode for IPv6 + addresses. The default it to use the same overflow mode + as was specified for IPv4. + + PerSourcePenaltyExemptList + Specifies a comma-separated list of addresses to exempt from + penalties. This list may contain wildcards and CIDR + address/masklen ranges. Note that the mask length provided must + be consistent with the address - it is an error to specify a mask + length that is too long for the address or one with bits set in + this host portion of the address. For example, 192.0.2.0/33 and + 192.0.2.0/8, respectively. The default is not to exempt any + addresses. + PidFile Specifies the file that contains the process ID of the SSH daemon, or none to not write one. The default is @@ -998,6 +1100,13 @@ DESCRIPTION Specifies whether public key authentication is allowed. The default is yes. + RefuseConnection + Indicates that sshd(8) should unconditionally terminate the + connection. Additionally, a refuseconnection penalty may be + recorded against the source of the connection if + PerSourcePenalties are enabled. This option is only really + useful in a Match block. + RekeyLimit Specifies the maximum amount of data that may be transmitted or received before the session key is renegotiated, optionally @@ -1047,6 +1156,12 @@ DESCRIPTION environment and any variables specified by the user via AcceptEnv or PermitUserEnvironment. + SshdSessionPath + Overrides the default path to the sshd-session binary that is + invoked to handle each connection. The default is + /usr/libexec/sshd-session. This option is intended for use by + tests. + StreamLocalBindMask Sets the octal file creation mode mask (umask) used when creating a Unix-domain socket file for local or remote port forwarding. @@ -1293,4 +1408,4 @@ AUTHORS versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support for privilege separation. -OpenBSD 7.5 February 21, 2024 OpenBSD 7.5 +OpenBSD 7.5 September 15, 2024 OpenBSD 7.5 diff --git a/sshd_config.5 b/sshd_config.5 index a0f1687..dbed44f 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.355 2024/02/21 06:17:29 djm Exp $ -.Dd $Mdocdate: February 21 2024 $ +.\" $OpenBSD: sshd_config.5,v 1.374 2024/09/15 08:27:38 jmc Exp $ +.Dd $Mdocdate: September 15 2024 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -1003,9 +1003,13 @@ file on logout. The default is .Cm yes . .It Cm KexAlgorithms -Specifies the available KEX (Key Exchange) algorithms. +Specifies the permitted KEX (Key Exchange) algorithms that the server will +offer to clients. +The ordering of this list is not important, as the client specifies the +preference order. Multiple algorithms must be comma-separated. -Alternately if the specified list begins with a +.Pp +If the specified list begins with a .Sq + character, then the specified algorithms will be appended to the default set instead of replacing them. @@ -1017,6 +1021,7 @@ If the specified list begins with a .Sq ^ character, then the specified algorithms will be placed at the head of the default set. +.Pp The supported algorithms are: .Pp .Bl -item -compact -offset indent @@ -1045,12 +1050,17 @@ ecdh-sha2-nistp384 .It ecdh-sha2-nistp521 .It +mlkem768x25519-sha256 +.It +sntrup761x25519-sha512 +.It sntrup761x25519-sha512@openssh.com .El .Pp The default is: .Bd -literal -offset indent -sntrup761x25519-sha512@openssh.com, +sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, +mlkem768x25519-sha256, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, @@ -1058,7 +1068,7 @@ diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, diffie-hellman-group14-sha256 .Ed .Pp -The list of available key exchange algorithms may also be obtained using +The list of supported key exchange algorithms may also be obtained using .Qq ssh -Q KexAlgorithms . .It Cm ListenAddress Specifies the local addresses @@ -1128,8 +1138,8 @@ Logging with a DEBUG level violates the privacy of users and is not recommended. .It Cm LogVerbose Specify one or more overrides to .Cm LogLevel . -An override consists of a pattern lists that matches the source file, function -and line number to force detailed logging for. +An override consists of one or more pattern lists that matches the +source file, function and line number to force detailed logging for. For example, an override pattern of: .Bd -literal -offset indent kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* @@ -1227,9 +1237,11 @@ applied. .Pp The arguments to .Cm Match -are one or more criteria-pattern pairs or the single token -.Cm All -which matches all criteria. +are one or more criteria-pattern pairs or one of the single token criteria: +.Cm All , +which matches all criteria, or +.Cm Invalid-User , +which matches when the requested user-name does not match any known account. The available criteria are .Cm User , .Cm Group , @@ -1302,6 +1314,7 @@ Available keywords are .Cm LogLevel , .Cm MaxAuthTries , .Cm MaxSessions , +.Cm PAMServiceName , .Cm PasswordAuthentication , .Cm PermitEmptyPasswords , .Cm PermitListen , @@ -1313,6 +1326,7 @@ Available keywords are .Cm PubkeyAcceptedAlgorithms , .Cm PubkeyAuthentication , .Cm PubkeyAuthOptions , +.Cm RefuseConnection , .Cm RekeyLimit , .Cm RevokedKeys , .Cm RDomain , @@ -1368,6 +1382,13 @@ and key exchange methods. The default is .Pa /etc/moduli . +.It Cm PAMServiceName +Specifies the service name used for Pluggable Authentication Modules (PAM) +authentication, authorisation and session controls when +.Cm UsePAM +is enabled. +The default is +.Cm sshd . .It Cm PasswordAuthentication Specifies whether password authentication is allowed. The default is @@ -1557,6 +1578,91 @@ Values for IPv4 and optionally IPv6 may be specified, separated by a colon. The default is .Cm 32:128 , which means each address is considered individually. +.It Cm PerSourcePenalties +Controls penalties for various conditions that may represent attacks on +.Xr sshd 8 . +If a penalty is enforced against a client then its source address and any +others in the same network, as defined by +.Cm PerSourceNetBlockSize , +will be refused connection for a period. +.Pp +A penalty doesn't affect concurrent connections in progress, but multiple +penalties from the same source from concurrent connections will accumulate +up to a maximum. +Conversely, penalties are not applied until a minimum threshold time has been +accumulated. +.Pp +Penalties are enabled by default with the default settings listed below +but may disabled using the +.Cm no +keyword. +The defaults may be overridden by specifying one or more of the keywords below, +separated by whitespace. +All keywords accept arguments, e.g.\& +.Qq crash:2m . +.Bl -tag -width Ds +.It Cm crash:duration +Specifies how long to refuse clients that cause a crash of +.Xr sshd 8 (default: 90s). +.It Cm authfail:duration +Specifies how long to refuse clients that disconnect after making one or more +unsuccessful authentication attempts (default: 5s). +.It Cm refuseconnection:duration +Specifies how long to refuse clients that were administratively prohibited +connection via the +.Cm RefuseConnection +option (default: 10s). +.It Cm noauth:duration +Specifies how long to refuse clients that disconnect without attempting +authentication (default: 1s). +This timeout should be used cautiously otherwise it may penalise legitimate +scanning tools such as +.Xr ssh-keyscan 1 . +.It Cm grace-exceeded:duration +Specifies how long to refuse clients that fail to authenticate after +.Cm LoginGraceTime +(default: 10s). +.It Cm max:duration +Specifies the maximum time a particular source address range will be refused +access for (default: 10m). +Repeated penalties will accumulate up to this maximum. +.It Cm min:duration +Specifies the minimum penalty that must accrue before enforcement begins +(default: 15s). +.It Cm max-sources4:number , max-sources6:number +Specifies the maximum number of client IPv4 and IPv6 address ranges to +track for penalties (default: 65536 for both). +.It Cm overflow:mode +Controls how the server behaves when +.Cm max-sources4 +or +.Cm max-sources6 +is exceeded. +There are two operating modes: +.Cm deny-all , +which denies all incoming connections other than those exempted via +.Cm PerSourcePenaltyExemptList +until a penalty expires, and +.Cm permissive , +which allows new connections by removing existing penalties early +(default: permissive). +Note that client penalties below the +.Cm min +threshold count against the total number of tracked penalties. +IPv4 and IPv6 addresses are tracked separately, so an overflow in one will +not affect the other. +.It Cm overflow6:mode +Allows specifying a different overflow mode for IPv6 addresses. +The default it to use the same overflow mode as was specified for IPv4. +.El +.It Cm PerSourcePenaltyExemptList +Specifies a comma-separated list of addresses to exempt from penalties. +This list may contain wildcards and CIDR address/masklen ranges. +Note that the mask length provided must be consistent with the address - +it is an error to specify a mask length that is too long for the address +or one with bits set in this host portion of the address. +For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. +The default is not to exempt any addresses. .It Cm PidFile Specifies the file that contains the process ID of the SSH daemon, or @@ -1663,6 +1769,18 @@ options have any effect for other, non-FIDO, public key types. Specifies whether public key authentication is allowed. The default is .Cm yes . +.It Cm RefuseConnection +Indicates that +.Xr sshd 8 +should unconditionally terminate the connection. +Additionally, a +.Cm refuseconnection +penalty may be recorded against the source of the connection if +.Cm PerSourcePenalties +are enabled. +This option is only really useful in a +.Cm Match +block. .It Cm RekeyLimit Specifies the maximum amount of data that may be transmitted or received before the session key is renegotiated, optionally followed by a maximum @@ -1738,6 +1856,13 @@ via .Cm AcceptEnv or .Cm PermitUserEnvironment . +.It Cm SshdSessionPath +Overrides the default path to the +.Cm sshd-session +binary that is invoked to handle each connection. +The default is +.Pa /usr/libexec/sshd-session . +This option is intended for use by tests. .It Cm StreamLocalBindMask Sets the octal file creation mode mask .Pq umask diff --git a/sshkey.c b/sshkey.c index d4356e7..1db8378 100644 --- a/sshkey.c +++ b/sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.c,v 1.142 2024/01/11 01:45:36 djm Exp $ */ +/* $OpenBSD: sshkey.c,v 1.146 2024/09/04 05:33:34 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved. @@ -28,6 +28,7 @@ #include "includes.h" #include +#include #include #ifdef WITH_OPENSSL @@ -248,22 +249,36 @@ sshkey_ssh_name_plain(const struct sshkey *k) k->ecdsa_nid); } -int -sshkey_type_from_name(const char *name) +static int +type_from_name(const char *name, int allow_short) { int i; const struct sshkey_impl *impl; for (i = 0; keyimpls[i] != NULL; i++) { impl = keyimpls[i]; + if (impl->name != NULL && strcmp(name, impl->name) == 0) + return impl->type; /* Only allow shortname matches for plain key types */ - if ((impl->name != NULL && strcmp(name, impl->name) == 0) || - (!impl->cert && strcasecmp(impl->shortname, name) == 0)) + if (allow_short && !impl->cert && impl->shortname != NULL && + strcasecmp(impl->shortname, name) == 0) return impl->type; } return KEY_UNSPEC; } +int +sshkey_type_from_name(const char *name) +{ + return type_from_name(name, 0); +} + +int +sshkey_type_from_shortname(const char *name) +{ + return type_from_name(name, 1); +} + static int key_type_is_ecdsa_variant(int type) { @@ -481,6 +496,98 @@ sshkey_type_certified(int type) } #ifdef WITH_OPENSSL +static const EVP_MD * +ssh_digest_to_md(int hash_alg) +{ + switch (hash_alg) { + case SSH_DIGEST_SHA1: + return EVP_sha1(); + case SSH_DIGEST_SHA256: + return EVP_sha256(); + case SSH_DIGEST_SHA384: + return EVP_sha384(); + case SSH_DIGEST_SHA512: + return EVP_sha512(); + } + return NULL; +} + +int +sshkey_pkey_digest_sign(EVP_PKEY *pkey, int hash_alg, u_char **sigp, + size_t *lenp, const u_char *data, size_t datalen) +{ + EVP_MD_CTX *ctx = NULL; + u_char *sig = NULL; + int ret; + size_t slen; + const EVP_MD *evpmd; + + *sigp = NULL; + *lenp = 0; + + slen = EVP_PKEY_size(pkey); + if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM || + (evpmd = ssh_digest_to_md(hash_alg)) == NULL) + return SSH_ERR_INVALID_ARGUMENT; + + if ((sig = malloc(slen)) == NULL) + return SSH_ERR_ALLOC_FAIL; + + if ((ctx = EVP_MD_CTX_new()) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; + goto out; + } + if (EVP_DigestSignInit(ctx, NULL, evpmd, NULL, pkey) != 1 || + EVP_DigestSign(ctx, sig, &slen, data, datalen) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + + *sigp = sig; + *lenp = slen; + /* Now owned by the caller */ + sig = NULL; + ret = 0; + + out: + EVP_MD_CTX_free(ctx); + free(sig); + return ret; +} + +int +sshkey_pkey_digest_verify(EVP_PKEY *pkey, int hash_alg, const u_char *data, + size_t datalen, u_char *sigbuf, size_t siglen) +{ + EVP_MD_CTX *ctx = NULL; + int ret = SSH_ERR_INTERNAL_ERROR; + const EVP_MD *evpmd; + + if ((evpmd = ssh_digest_to_md(hash_alg)) == NULL) + return SSH_ERR_INVALID_ARGUMENT; + if ((ctx = EVP_MD_CTX_new()) == NULL) + return SSH_ERR_ALLOC_FAIL; + if (EVP_DigestVerifyInit(ctx, NULL, evpmd, NULL, pkey) != 1) { + ret = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } + switch (EVP_DigestVerify(ctx, sigbuf, siglen, data, datalen)) { + case 1: + ret = 0; + break; + case 0: + ret = SSH_ERR_SIGNATURE_INVALID; + break; + default: + ret = SSH_ERR_LIBCRYPTO_ERROR; + break; + } + + out: + EVP_MD_CTX_free(ctx); + return ret; +} + /* XXX: these are really begging for a table-driven approach */ int sshkey_curve_name_to_nid(const char *name) @@ -647,6 +754,38 @@ sshkey_sk_cleanup(struct sshkey *k) k->sk_key_handle = k->sk_reserved = NULL; } +#if defined(MAP_CONCEAL) +# define PREKEY_MMAP_FLAG MAP_CONCEAL +#elif defined(MAP_NOCORE) +# define PREKEY_MMAP_FLAG MAP_NOCORE +#else +# define PREKEY_MMAP_FLAG 0 +#endif + +static int +sshkey_prekey_alloc(u_char **prekeyp, size_t len) +{ + u_char *prekey; + + *prekeyp = NULL; + if ((prekey = mmap(NULL, len, PROT_READ|PROT_WRITE, + MAP_ANON|MAP_PRIVATE|PREKEY_MMAP_FLAG, -1, 0)) == MAP_FAILED) + return SSH_ERR_SYSTEM_ERROR; +#if defined(MADV_DONTDUMP) && !defined(MAP_CONCEAL) && !defined(MAP_NOCORE) + (void)madvise(prekey, len, MADV_DONTDUMP); +#endif + *prekeyp = prekey; + return 0; +} + +static void +sshkey_prekey_free(void *prekey, size_t len) +{ + if (prekey == NULL) + return; + munmap(prekey, len); +} + static void sshkey_free_contents(struct sshkey *k) { @@ -660,7 +799,7 @@ sshkey_free_contents(struct sshkey *k) if (sshkey_is_cert(k)) cert_free(k->cert); freezero(k->shielded_private, k->shielded_len); - freezero(k->shield_prekey, k->shield_prekey_len); + sshkey_prekey_free(k->shield_prekey, k->shield_prekey_len); } void @@ -1331,14 +1470,12 @@ int sshkey_check_rsa_length(const struct sshkey *k, int min_size) { #ifdef WITH_OPENSSL - const BIGNUM *rsa_n; int nbits; - if (k == NULL || k->rsa == NULL || + if (k == NULL || k->pkey == NULL || (k->type != KEY_RSA && k->type != KEY_RSA_CERT)) return 0; - RSA_get0_key(k->rsa, &rsa_n, NULL, NULL); - nbits = BN_num_bits(rsa_n); + nbits = EVP_PKEY_bits(k->pkey); if (nbits < SSH_RSA_MINIMUM_MODULUS_SIZE || (min_size > 0 && nbits < min_size)) return SSH_ERR_KEY_LENGTH; @@ -1346,53 +1483,26 @@ sshkey_check_rsa_length(const struct sshkey *k, int min_size) return 0; } -#ifdef WITH_OPENSSL -# ifdef OPENSSL_HAS_ECC +#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) int -sshkey_ecdsa_key_to_nid(EC_KEY *k) +sshkey_ecdsa_key_to_nid(const EC_KEY *k) { - EC_GROUP *eg; - int nids[] = { - NID_X9_62_prime256v1, - NID_secp384r1, -# ifdef OPENSSL_HAS_NISTP521 - NID_secp521r1, -# endif /* OPENSSL_HAS_NISTP521 */ - -1 - }; + const EC_GROUP *g; int nid; - u_int i; - const EC_GROUP *g = EC_KEY_get0_group(k); - /* - * The group may be stored in a ASN.1 encoded private key in one of two - * ways: as a "named group", which is reconstituted by ASN.1 object ID - * or explicit group parameters encoded into the key blob. Only the - * "named group" case sets the group NID for us, but we can figure - * it out for the other case by comparing against all the groups that - * are supported. - */ - if ((nid = EC_GROUP_get_curve_name(g)) > 0) - return nid; - for (i = 0; nids[i] != -1; i++) { - if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) - return -1; - if (EC_GROUP_cmp(g, eg, NULL) == 0) - break; - EC_GROUP_free(eg); - } - if (nids[i] != -1) { - /* Use the group with the NID attached */ - EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); - if (EC_KEY_set_group(k, eg) != 1) { - EC_GROUP_free(eg); - return -1; - } - } - return nids[i]; + if (k == NULL || (g = EC_KEY_get0_group(k)) == NULL) + return -1; + if ((nid = EC_GROUP_get_curve_name(g)) <= 0) + return -1; + return nid; } -# endif /* OPENSSL_HAS_ECC */ -#endif /* WITH_OPENSSL */ + +int +sshkey_ecdsa_pkey_to_nid(EVP_PKEY *pkey) +{ + return sshkey_ecdsa_key_to_nid(EVP_PKEY_get0_EC_KEY(pkey)); +} +#endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ int sshkey_generate(int type, u_int bits, struct sshkey **keyp) @@ -1557,10 +1667,8 @@ sshkey_shield_private(struct sshkey *k) } /* Prepare a random pre-key, and from it an ephemeral key */ - if ((prekey = malloc(SSHKEY_SHIELD_PREKEY_LEN)) == NULL) { - r = SSH_ERR_ALLOC_FAIL; + if ((r = sshkey_prekey_alloc(&prekey, SSHKEY_SHIELD_PREKEY_LEN)) != 0) goto out; - } arc4random_buf(prekey, SSHKEY_SHIELD_PREKEY_LEN); if ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH, prekey, SSHKEY_SHIELD_PREKEY_LEN, @@ -1638,7 +1746,7 @@ sshkey_shield_private(struct sshkey *k) explicit_bzero(keyiv, sizeof(keyiv)); explicit_bzero(&tmp, sizeof(tmp)); freezero(enc, enclen); - freezero(prekey, SSHKEY_SHIELD_PREKEY_LEN); + sshkey_prekey_free(prekey, SSHKEY_SHIELD_PREKEY_LEN); sshkey_free(kswap); sshbuf_free(prvbuf); return r; @@ -3226,10 +3334,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, r = SSH_ERR_ALLOC_FAIL; goto out; } - if (format == SSHKEY_PRIVATE_PKCS8 && (pkey = EVP_PKEY_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } if ((r = sshkey_unshield_private(key)) != 0) goto out; @@ -3240,6 +3344,10 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, cipher, passphrase, len, NULL, NULL); } else { + if ((pkey = EVP_PKEY_new()) == NULL) { + r = SSH_ERR_ALLOC_FAIL; + goto out; + } success = EVP_PKEY_set1_DSA(pkey, key->dsa); } break; @@ -3247,19 +3355,25 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, #ifdef OPENSSL_HAS_ECC case KEY_ECDSA: if (format == SSHKEY_PRIVATE_PEM) { - success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, + success = PEM_write_bio_ECPrivateKey(bio, + EVP_PKEY_get0_EC_KEY(key->pkey), cipher, passphrase, len, NULL, NULL); } else { - success = EVP_PKEY_set1_EC_KEY(pkey, key->ecdsa); + pkey = key->pkey; + EVP_PKEY_up_ref(key->pkey); + success = 1; } break; #endif case KEY_RSA: if (format == SSHKEY_PRIVATE_PEM) { - success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, + success = PEM_write_bio_RSAPrivateKey(bio, + EVP_PKEY_get0_RSA(key->pkey), cipher, passphrase, len, NULL, NULL); } else { - success = EVP_PKEY_set1_RSA(pkey, key->rsa); + pkey = key->pkey; + EVP_PKEY_up_ref(key->pkey); + success = 1; } break; default: @@ -3428,6 +3542,8 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, struct sshkey *prv = NULL; BIO *bio = NULL; int r; + RSA *rsa = NULL; + EC_KEY *ecdsa = NULL; if (keyp != NULL) *keyp = NULL; @@ -3461,15 +3577,21 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, r = SSH_ERR_ALLOC_FAIL; goto out; } - prv->rsa = EVP_PKEY_get1_RSA(pk); + if ((rsa = EVP_PKEY_get1_RSA(pk)) == NULL) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } prv->type = KEY_RSA; #ifdef DEBUG_PK - RSA_print_fp(stderr, prv->rsa, 8); + RSA_print_fp(stderr, rsa, 8); #endif - if (RSA_blinding_on(prv->rsa, NULL) != 1) { + if (RSA_blinding_on(rsa, NULL) != 1 || + EVP_PKEY_set1_RSA(pk, rsa) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } + EVP_PKEY_up_ref(pk); + prv->pkey = pk; if ((r = sshkey_check_rsa_length(prv, 0)) != 0) goto out; #ifdef WITH_DSA @@ -3492,21 +3614,25 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, r = SSH_ERR_ALLOC_FAIL; goto out; } - prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); + if ((prv->ecdsa_nid = sshkey_ecdsa_fixup_group(pk)) == -1 || + (ecdsa = EVP_PKEY_get1_EC_KEY(pk)) == NULL) { + r = SSH_ERR_LIBCRYPTO_ERROR; + goto out; + } prv->type = KEY_ECDSA; - prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); - if (prv->ecdsa_nid == -1 || - sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || - sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), - EC_KEY_get0_public_key(prv->ecdsa)) != 0 || - sshkey_ec_validate_private(prv->ecdsa) != 0) { + if (sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || + sshkey_ec_validate_public(EC_KEY_get0_group(ecdsa), + EC_KEY_get0_public_key(ecdsa)) != 0 || + sshkey_ec_validate_private(ecdsa) != 0) { r = SSH_ERR_INVALID_FORMAT; goto out; } -# ifdef DEBUG_PK - if (prv != NULL && prv->ecdsa != NULL) - sshkey_dump_ec_key(prv->ecdsa); -# endif + EVP_PKEY_up_ref(pk); + prv->pkey = pk; +#ifdef DEBUG_PK + if (prv != NULL && prv->pkey != NULL) + sshkey_dump_ec_key(EVP_PKEY_get0_EC_KEY(prv->pkey)); +#endif #endif /* OPENSSL_HAS_ECC */ #ifdef OPENSSL_HAS_ED25519 } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_ED25519 && @@ -3541,9 +3667,9 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, /* Append the public key to our private key */ memcpy(prv->ed25519_sk + (ED25519_SK_SZ - ED25519_PK_SZ), prv->ed25519_pk, ED25519_PK_SZ); -# ifdef DEBUG_PK +#ifdef DEBUG_PK sshbuf_dump_data(prv->ed25519_sk, ED25519_SK_SZ, stderr); -# endif +#endif #endif /* OPENSSL_HAS_ED25519 */ } else { r = SSH_ERR_INVALID_FORMAT; @@ -3557,6 +3683,10 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, out: BIO_free(bio); EVP_PKEY_free(pk); + RSA_free(rsa); +#ifdef OPENSSL_HAS_ECC + EC_KEY_free(ecdsa); +#endif sshkey_free(prv); return r; } diff --git a/sshkey.h b/sshkey.h index 708f2da..d0cdea0 100644 --- a/sshkey.h +++ b/sshkey.h @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.h,v 1.62 2023/06/21 05:10:26 djm Exp $ */ +/* $OpenBSD: sshkey.h,v 1.65 2024/09/04 05:33:34 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. @@ -31,6 +31,7 @@ #ifdef WITH_OPENSSL #include #include +#include # ifdef OPENSSL_HAS_ECC # include # include @@ -47,6 +48,7 @@ # define EC_KEY void # define EC_GROUP void # define EC_POINT void +# define EVP_PKEY void #define SSH_OPENSSL_VERSION "without OpenSSL" #endif /* WITH_OPENSSL */ @@ -125,13 +127,12 @@ struct sshkey_cert { struct sshkey { int type; int flags; - /* KEY_RSA */ - RSA *rsa; /* KEY_DSA */ DSA *dsa; /* KEY_ECDSA and KEY_ECDSA_SK */ int ecdsa_nid; /* NID of curve */ - EC_KEY *ecdsa; + /* libcrypto-backed keys */ + EVP_PKEY *pkey; /* KEY_ED25519 and KEY_ED25519_SK */ u_char *ed25519_sk; u_char *ed25519_pk; @@ -223,6 +224,7 @@ int sshkey_shield_private(struct sshkey *); int sshkey_unshield_private(struct sshkey *); int sshkey_type_from_name(const char *); +int sshkey_type_from_shortname(const char *); int sshkey_is_cert(const struct sshkey *); int sshkey_is_sk(const struct sshkey *); int sshkey_type_is_cert(int); @@ -258,7 +260,8 @@ int sshkey_curve_name_to_nid(const char *); const char * sshkey_curve_nid_to_name(int); u_int sshkey_curve_nid_to_bits(int); int sshkey_ecdsa_bits_to_nid(int); -int sshkey_ecdsa_key_to_nid(EC_KEY *); +int sshkey_ecdsa_key_to_nid(const EC_KEY *); +int sshkey_ecdsa_pkey_to_nid(EVP_PKEY *); int sshkey_ec_nid_to_hash_alg(int nid); int sshkey_ec_validate_public(const EC_GROUP *, const EC_POINT *); int sshkey_ec_validate_private(const EC_KEY *); @@ -287,6 +290,12 @@ int sshkey_check_sigtype(const u_char *, size_t, const char *); const char *sshkey_sigalg_by_name(const char *); int sshkey_get_sigtype(const u_char *, size_t, char **); +/* Signing and verification backend for libcrypto-backed keys */ +int sshkey_pkey_digest_sign(EVP_PKEY*, int, u_char **, + size_t *, const u_char *, size_t); +int sshkey_pkey_digest_verify(EVP_PKEY *, int, const u_char *, + size_t, u_char *, size_t); + /* for debug */ void sshkey_dump_ec_point(const EC_GROUP *, const EC_POINT *); void sshkey_dump_ec_key(const EC_KEY *); @@ -310,18 +319,22 @@ int sshkey_parse_pubkey_from_private_fileblob_type(struct sshbuf *blob, int sshkey_check_rsa_length(const struct sshkey *, int); /* XXX should be internal, but used by ssh-keygen */ -int ssh_rsa_complete_crt_parameters(struct sshkey *, const BIGNUM *); +int ssh_rsa_complete_crt_parameters(const BIGNUM *, const BIGNUM *, + const BIGNUM *, const BIGNUM *, BIGNUM **, BIGNUM **); /* stateful keys (e.g. XMSS) */ int sshkey_set_filename(struct sshkey *, const char *); int sshkey_enable_maxsign(struct sshkey *, u_int32_t); u_int32_t sshkey_signatures_left(const struct sshkey *); -int sshkey_forward_state(const struct sshkey *, u_int32_t, int); int sshkey_private_serialize_maxsign(struct sshkey *key, struct sshbuf *buf, u_int32_t maxsign, int); void sshkey_sig_details_free(struct sshkey_sig_details *); +#ifdef WITH_OPENSSL +int sshkey_ecdsa_fixup_group(EVP_PKEY *k); /* ssh-ecdsa.c */ +#endif + #ifdef SSHKEY_INTERNAL int sshkey_sk_fields_equal(const struct sshkey *a, const struct sshkey *b); void sshkey_sk_cleanup(struct sshkey *k); @@ -342,6 +355,7 @@ int check_rsa_length(const RSA *rsa); /* XXX remove */ # undef EC_KEY # undef EC_GROUP # undef EC_POINT +# undef EVP_PKEY #elif !defined(OPENSSL_HAS_ECC) # undef EC_KEY # undef EC_GROUP diff --git a/version.h b/version.h index 052a581..8c7e37e 100644 --- a/version.h +++ b/version.h @@ -1,6 +1,6 @@ -/* $OpenBSD: version.h,v 1.101 2024/03/11 04:59:47 djm Exp $ */ +/* $OpenBSD: version.h,v 1.103 2024/09/19 22:17:44 djm Exp $ */ -#define SSH_VERSION "OpenSSH_9.7" +#define SSH_VERSION "OpenSSH_9.9" #define SSH_PORTABLE "p1" #define SSH_RELEASE SSH_VERSION SSH_PORTABLE