From 4c21c87b8aa606d8c4906bbd49f23662b0c68ab5 Mon Sep 17 00:00:00 2001 From: Daniel Date: Thu, 20 Jul 2023 14:01:58 +0200 Subject: [PATCH] Improve ebpf connection listener --- .../ebpf/connection_listener/bpf_bpfeb.o | Bin 43080 -> 36424 bytes .../ebpf/connection_listener/bpf_bpfel.o | Bin 43080 -> 36424 bytes .../ebpf/connection_listener/packet.go | 57 ----- .../ebpf/connection_listener/worker.go | 217 +++++++++--------- .../ebpf/programs/bpf/bpf_tracing.h | 3 +- 5 files changed, 107 insertions(+), 170 deletions(-) delete mode 100644 firewall/interception/ebpf/connection_listener/packet.go diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o b/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o index bb16c6cfb8ef08944da8a5be59d9c300154b1f87..e13bd702293794b92fb928b923d6a2a45a73c866 100644 GIT binary patch literal 36424 zcmb`Q37i~9b^mKtw`9p{$+A|KERAj1IxMf&vJk>&%a)7;vMglDm~(b^c2+xRc4jm) zE3G&OaKHpZ6pmoRwZssda47*|6CfT4hr^MW;1CGcf(dcB;&79YzyIIgtLmBFwj4-E zf7D&S_v%&Et5>hi?peKH=br0&dNQtaW!%rf2}UOd@UnZ2io$cT%N##q*xl9gVPCHg z8j*7<6j{O3U0L zh4*{8-ots96%GG1h0x~(+9VG4y1CFj`DJdV_#s`kkQdb{&z&CE$LBjU=-)fbxpO5) z{&9X6K+X?(?#i!qyA*$aR!{UCve4bL)`zECYUlEcA5p&P17G?j^)ed1)hD5^(V^UJ z_dGV_e~AyN-?mgfrf+`9Bg#Efa`4mT_K6?cKh%HaoB?s&Y4o@a^!$ZE_iFUJg_>JxGLZ4r$uj6l5!kG_k?T;NUm&85RTAg~`mgraJ8Nace zYQDUsHD@jT2s_n6zw1l&yCW{El(AlikNAGq=@;u#{i5#6xyQW1xkv36N4&p2qF)^G z{`!c1am3rD(=XEb_oe#95pP%WnLZvIalT)q`{NO3mX6B}emuKTPqp(ACx3NEE}Zc# zg+ZS)mS+8!D*EAvAHKD5#E)zDO!J#gJ3gXcJbvFEW%r2ddvD2z7rfvqT2c3a^}Zf2 zJ%b=)QqIjJ%!(~$xFjYUtl*v%%Yn1pF61#=IGrZQDzU_X1O=P{i#PdKroA=bp!X6HYI&1q5%t#kr??Z8CSj3t4C03%-`BM964Z zA)F=L29wvULGWk62f!`xSHK6In;n6_=lQe6{}uQqRE6IoeMu|TdSv6J;4Jw3fFp1} zSTchI+rUo-w+MCJ3~s}}2K;Pal^!+ZbHFY5lw-IJE`TGtI6;qQA@ZD`B|z42MDV-d ztKbiUZwGGyw+MAT7u<&bb};qARIcX(JgD!22>fyI3mC%1zfTWvmf)M}~9sFW?eFT11 zz%4MgF@78Tdth{vJI#0l56bS%g5L>dSn7?y9|WUA?;!ZE!PjS8Zwvgl0aM-#wXgUu z0)IDP%AWB{;hC-%H<~HGzMgz;1)l}J0ek|iItovMRY&2I;LE_&v9}H01zzLa83Z$F zXGh)6h`=Q<`k&DP*8-jd(>}888Ex>(1D*oE8T=CG78A@=+o8|mELe4<+{FXn&w*bC zj=*0A|1P)%{tlRMaU1+2@NLd%nw$BbJV?7F!q-(t^jR_pRw3lSqy<(T(Pzmdcr7>r zx51QWGE?Bog)?r+gWwwj{#Wo};n{8pcAceqy~3Kq&7vOemEZ{es{?L<-va(U_-*jJ zz^}4qb+bMIMs8^Y{}TbXz+VWs4gQwLXA#U&9bfC*SrPp<1AZO21y&^aoYe-OM<1qb zmcg368N3@Df#s7&!7cDE8h<%7?QYlUAylBeA_1cfEfJ@3{1%e*XbABHZ8C`S!kcZlpYtEe^J@uaRo{(PUo6fRUxa26xS8>UF zKLWWzyl}1b;hax*b?nqhdi(?N=LDH=5Gr5Fn)5F~UbIbS1gqiyFzBSfL_(dE=2!5} z<>s0z+r@Y#1%*1yRi8ai63A@iaXxp%?JE+}SfzrT$MU7Qn}bdlN}fD}4s*9dDqp*T z{GTJgGsvLZ+`UAu4?yt_OSGB%MSSkLM?;>Qpp$iZA>@E~$h<7bTmpVYz>E!ZU#*HufG`pW^+9Crn;^G{ z2Yv^S#~5^T-%q$T;J=E~Lr3Cyn`sFX;|%?NT3sa~-R++|NyF7p1$*%mokHBNz&^7OqAie2O)UZ_J+`xam}ys2)HBvDaA;bi!$dw8yy(uXJo-Ifp>u-!1A$k zxg)TAOt=kJU7n5$Mc~(inKLsj@FW=D&JfOj8@K>&gXLq9cjNgd!N^!y9}Jkd`S%1o z2>t~45Hc?1W8l0k>cqkE7rg_zD_9 z*E94W(+mMD>r>AZ51Dw}$boM}rUzz7<_0AJU;dyznB|V!7tsYp$Vj|!YYLzlLy_yB+MNwubEZlJwHR z@0lW;8_`3R<0_EHnRDl?R|a8bY!{IddXfma9I2CpNb z+6yONcr_topRR@1@{s?uz`Kx<9d?1AN_c>qYhjT`fx8W^5pMBWEu4@NTu0zPPqpC6 zkcY8V803A#y%^pChzR@&!X`IY#}C@@PryL8Oay)tSUx!jz5|SYYQKed27D{{Jpq$$ z;avgW4wi2z?Iie<0k^@Q3wR2Af2b$rCH-=t{7h}%>iUqIgf^onC=%9=i`J7~s!*>*mlD3nB;BHI zgzDQ7eEE>@Aa|VaU&7xJ^1TIoQ^5G?qNfH-pII~*@Jp38=t?ke3i4L*kU11&=&zmp z|Ei1K%Z2Cb;WDIIG#2Cs#0m9O`v)wvXgrh^M78hrSJ$RS|Gwv%KGefs0PJQqeF-6F z3Az@&GGNF>_@B-aROF(!2y;``qIVE72bn$JONf8EEO)G@c(Igl`j}iYylX8nbMffJ}7BZhF zd^2|&{AI!|-qjX;GvEmR_X2K#e;RNb{GVXP9hG?c%z#^9IWK&vdiwH!#b4vGL{IMz zSbW(J`_gKD-e2mQ=Je}e2xpOb5_l3EF>XqbLT9(&KONi$o&*;HJ_%O8R@ydLeNi$~ zVEL%a2xz-kL7Ns|5Lyb_`!f%;Qs@+Ror5pV>)A>bBRc7S(! z8$1^96u1R`8zDij=BGaiBTL)bWfN;P)Y)1uyjcCBmx$UI$(q@BmnLApa%X zz*mFGV@U+w8}L5x!GH(B&kVQ*E`oO=-vT$m*mlVzcmn)>a2xy_kI!s@pYQR~2z)E} z1OCYEjMspdg2kTw>RfkW8~kVB8Z!5SX+!t5UU%VrVC-T1 zDe%|8U-!pXOVmf;t&QOS1bhLw1^!Pkc3#_N8lD0EW@mZo+_%6H{9gF~0&aoN2LCI# z4L%?IJ%99d=32&Y+B=Hi)3%w5oZBwE8%$r?-U2@vdF;Hs4ITzFj%=R-A3^3ZcBJag zd=C82gCqDag1-&C4}2RK`|c3F9U1c3F$I1*{LB0n{>*oSF9$0v{UUP(xCQ<&7(4H5 zgK0NmHP4w-JZj(wOg-GvjJs|Z_~!wmJH=SLT-O3GChb-J*ktKB;O*cD{w3gR!IFW_ zJRaNzKOy7n$`H;Kn&D|Z-@q+jlWpY?Tp4uk;NKNSKv7xp!dCHGd+EV|TZAF4d#kV< zmVD?3OP@yCWe|6R%Y?LvuBFF#2uI)-1>6F^Jm5C?H6Ba*rRs0UXChRUe+#$3I|6Pa zbEn5rb?Ki69DzR)a0`sxmA0o1{+h?K#!}fG{)`ALUleXJo~bIrZSV?@sgXPD;(#OY z)d9D_djoERhdiD|a8@JW2>il;Tj1Zb2C;Vr9UH!#_}GT3Q`|0p(#6jB!Orr-*#3Vi z9QgQQhyShwUwt-~e@}vszjyd26a0GrBzct70-R(bomxz1va zu%cU{)Kavg=@#&(#R>SeUF<$c+7HhWBV0k|jUoenQv!c3fz{?g#@$0c_dYTo&9Sje zMmolMs;%O*A1CeSLwkKf{Dmk_@JV4V>~z)xA^ua~pU?L8z$VM)d68xGSEX4tK#1DQ zwiB8OeI1f(*o?J7sM`mWK45Io!7okV=O?h{+F0-VDCbEip|+tt;xi#hEPEyo4K6Ll zo97V92PWYc3ICD14X%Vb{XMuI@E5=nsyvszQtLHfr27Zrp5HCc&J0xs*Rq%J5Y8s_ zh~S@q_eJhDchaXc-bin|625jnj8pMdZ}DZ@*8!v=DlhvZ!t=Q8O62op7?MxwZ)T?L z_@}sKcUmI1OydaoEmIlF|J#IQwd@y!$o0uIv$&N|d59P4-N!s+y2Ner4ao)n5!Cg1 zJ*;s1PNMIcL_Rkuj{FKdR3{arYEWihmGA-az(;vVFRs4l@%U$hJVL%75*;w}QH={o+CVqW2X1@4`R3%kMjJi=8d?Am8^ovi-jD2CIMm*q73G2lyx82>#o_KLED~ zmvjFV+=l;N@XvkK`j|f)ww)2d|4Z;I!7cE;0k^^OgJ1e4?E5D$W4D^1Z;Ho%(GqPi zb<0pjZv=h_d^WfR{u!7ty%(9~*fg_}b*2Mj_6#OE1Nr5r!(i+>qXnk#Waz((C6fg+ zW-N}t>tRs+#VzpV0k^@-+nFqD8wY+e_&jg~&ch(jB`xq__~&Cw$uz-hz>=ZuG8Y8= zJKzh!lD`c>bUU*R{sZ`H!BcqBE8t)0yVmkIfOmqk$h-qgSxX}@_ROH`(l+>m;0=sX zL@$TVTnv^Bw#{q;x4`#<2f)NH$F`YE@O20NHji4yEz5#wH^b+GvA1FBdG=`mQ@69# zzLKYIXP=Lu6c@37{um)Xpv%s7(Nlc$nSTSfkypR@0A&-LjV|sXa0K28{&#Q-{5bHB zz-=(=BCVe?Q{a68e-oSw_*>xdfFA(kQzoxE$*{V9sE40JZG9B;&8NLg=ADuW_)p2_ zaWlP=1ZQilB0cO1d45kskbhMdyPpaBvNEsk@-vvJBYy&$=!}nlE=&Gu(>u7i>@1$P zb`kt{6aEMHAo$M+WzQD)LnM>|3GBU81m-&X^Dy|Q^X#*y2qn*T_IG*2X@BCe+5chi zue{Ay%%+nlE%%Bggj_4u@IY|IrG!*<#p4NQ5Z-)?t)b*gD~93yKW?rSH6FB;%YvU1 z@VVfZf$OqybVxoZFmRxM)H|S zJ}qz_{wRM@y0?5MG z07pK$R#A6tnOp=umqd~$U-^vY2VJW+^H5)j!14Pv*&}4G?;2M1q4(W@;jq5K;?S2Hds+trUF#5Sw3r^!8?G}2vZ4iR##uJcfu7Z57V zD+p!JSg(5$_$*;6;Z+u4>mdahd~Nj`eZBPkXDpO?WdbYjIN#SL@H-M%?HbFh5~fkO zGWb-?SHFsJ=3L<*^Wp^m_Y(Le=r*Z}$5*hq{3R}n{<`|zp?+A1KSdUQtTN3!?l=-nl`!F8pS}lJfeU?6?WLf;&w~sXv1kutZ zv}-4C>jy!nk4h?(xm7suUq*g2{g9>V5>iLx{wsH_y<-lufIx5*5U%sWcU24iKY$tIS51Py4&DH6 zgZ~xGccQEA1^+By?6p>P693a+%^Sj>0iP4_XTkC(@jr*9N5J&$Rg}M0?ISz|-WBje zVCfEjHNo1Oc%Z}TUVP|wbS{GX;6DTYYrzrtP{1wl1o+kP+u)ZVPkC8bYhMK(1xH}@ zlLNMda%y65Lwiv}x&!;C}`D_uxVBx4`J! zR|Ee5O#S;>;9ms(34dmrp>6xxVA@yZE+<$=eN@NgS+K@j;dS6O0S|y>L-DtP)fYEp z-0}!~MZnv^I|9B2e0{*zf)55v{5si9Y4OQ*rGT#kqqp%N4?Z3+ZL&_|t>kxu-yHB0 zz_Oe4*#~}qz&C^OH>=km_|pNmz#4zB+ww^;cFWudZi62H(-vnFZ3%hGUpx4Z5_l5% z2WR>y>}hKO)s1W2&q?=W?l$;8kWt%VEBjUmf7Yd;Njk_O)?@#Sd@BM=Rx&N{S%kEU zn*`H_`kjMogU=>{TmMG^*TC-$cmn)ku+p}`e?#~Z?n&_d z=^bx>r8)gHa2IkseAGiP*KQ^3+4FA-2$@<#&Beb1tXy0)N4}21{8Rc3>)|~U%(Ylphjq{q zdEP_3aGN~k7ucsK0tfr_41!0TwM9=0Tp>^XIr(QQPw5utX&7IN^U07;a&EJ_DxVqR z%NV59c&rX6-a%n5>~7bMAvAuFFNqiAJ*z7pr-#4c=q*e>h)#CvtCSmFNSTKLE$|6& z+3UaIjRA{)C-L%`Hu!yD`Q#M%Bj9CoO!E!*g8zP=>zRWoRqitOscIwow_7&b^~gWJ z7G!9z4G)6Rt0xQoQNR)SSL9uRKS(}X;47aRpP8#}!biaK1Fj>Zv3=PL*VAB*drROS zMP_l}9|O~lmiF1;H32^dygA_Kl8@}D{GSKbxGhZozGz3lF906^e`9GzV<+!uY9_^QSDZ{Dmw ziN3{u93h#1gTyAfF8XP}kQdQj#z$tODkmAjjT$?JQE{WS1(+f?YO)f4Hu$`N@tKX* zj_~J#FAaR`vGIz4QGMgJ0h71cMERTse^21k4K`}*6n_z6T=%yp@Er;KwgmoT(jG!t z)d9ba+d>lN+t&jk%FPoB@8ULLgH#+}S@ z#e+W>a0~oJ7&rK&HiinL(?;ogB{&Pd6O1022>j;(qtnI@1-y?isUPWL{TAIG^rLS` zzm1G-S9oem#MI*u@vS1fG|`XC?3j zUA+8#U3_tW0&h;>%M&pZ-l<`Toas@$$sG$o?mF`Tc_ld^mxhoxq8@_rEd0 ze|G{W-kJ7)D#1_Gz5kyR{D1G_voGr6-gk9z|9^JzruhlHw2OQ1>f*WEyLeMJffF{_ z6ealAC-5^8_*n^jw2K#A+Qpk*lEAM@;5)i_*7tHNZ|Vu_$yu9`?)S&dQKOgk<35Q7Ml|NanrB5@&k$fIFRtSfrP*HezYTBsx)0L zw|)Qq?N7=g@g$#G98tXS^2i9Ni=9NaW>&}gHomRxfSJg_xl#|O1 zjhD*JQYAOkIF_$nx_RBY@k=+aSMi66&0Jx;UMIgC!nx+5((tBWcgHjVY|^Y2s%7F2T)Xdbr~1-5jl)=T3_CecSv=!67srbhH9^{;Tp?c=^>ndNEFCR&1%~p4!{zEB$&OU($MW^zT)s>RVwB6d z@kY^LC0{G$O2d|A;V4$N1X!Y27phgurNVKGoyZM0OcR1`xz(}aSU2NFWjJJUOnlSU z@;0(lezS2TH&V_YvPw2nH91x=9}YI26{D1W5uc>1$^D=r7C4v?Z)zTGkwjctmm6%RrQh-YowmHqU+Uh)GXvf zOBq$EPNy+^p*Y+TI@GA zN;OBz7pTsJ#5!c%NLsfpZ?ejV3N%JbBi4Sg3b9KneMg<5Zal?T#b<%&NuVYi*7d_J6+*Wz1E4K zzZA@||qTOQbL6CdNul4H%YT z(GQWr^&;9?RSFiT@vcED=Y84r!nlo8-9f658_AEA%F?A^9ZYHzd_G;I9E~c~j&7}1 zf_R02l*TSFFDcDXb)1G7E*{O5)Vm8gIivvuEj+rF+7A!Qw+cB3YL#nr7=>!}aLE@x zT&*+<)!OmgQ1MVnja#5!_~D0MR;&5p0yR&`?5fnshatvtQDL=wsm@THfa6=YSZr6h zu4YUm#Y;CM&-BrqL^T&ntI(|rx$#T33N!m6dCAtUWMee8os1aD?m*=++_7$De2nBn z#bkOM$J@)?zT({$+me}Tz(|23kCsb}oCYh!iKeU336Hv3wb3XIm5VtwRMV*yN|miv zaRcLS+*8|Ppn^TiS9zObh!`sswr(MPf%dg&1Zy$V@$4=oRFAlW7IM<2Sg}!=hC9Xt z*tLh!nCUuIsf?G)jcN7hGL&zr!j!7Y*a#<)fsXa7LFZp4SZ1?#RTYVsCM=I zv0Rr0VF~l~!f1z0q9Yv<`Zfk-kQsLIj5xk6aN$nBR*@! zl~RRqw(0V=ign((Op{98#bZ`H_!|ExDhBD>;5jRj)Ejf_{kdZvI??kK++HmVWVGK?xV&iTG>PX@9E zYZTx4_4Eu)pQQ_)Cwc?K&JKF&~c`ca*4UbG0F@lX^Ur8V$MrSOyigg<>!JqG#OSa!wsL= zsUj=|x}Q45sUlLEkJoA9ruI0d8XcPARVk;$1}ueN=jP;9wkqbRBstl$eCe3l zOpv`@qhLtR9&?-JMhrtWBwMW&>%PTVqaXHbbmk2kB8SKF%!^D!<`;V8k`*?F+H9PP zs`ZW*HJu*o;7YM{Xp|)>%`Y*Pj&~}s?B%`~$Y-O)luZYv`Vlu?aAO4%RAj^1q}#|H zR;OZ69;15W+I8Y}W8<7SkU%S6@tw81PCndlBcH1^>r5pzq5s4J!XrM<}*sI8b~q6V%V{O?5v4tcm|u?bk@W$g>jtYa1gq|cw^KC zO^tKbw}x%+X8nM=oA1Ovg2M#pM*v*1bcCt)kftA|9Sg%ST48m;YQE8l9;#RK!-YIu zm~2?bi>F@@3L>Y;FgFpaGG`8H?%j~yHA>J7m&0Kr$I7U}S`x3(3KTaRE1ToS zVd&y{cAMtAV=+)pjpL1xM$Y;_8(AYTxwn@e6}sBk(3d>8n09P1To^)a>%(dn?9Q^7 z6OV}_QWsE=eH{yK_SKkug8rlkF>9m8O&Mku_WsUWou<-3fVGq7)W<6ot?ad5w*`(F z+#O>WDOU1qT^O=PwO0mcBB@lH4Cm_8nhnPC1y&rU;W*_t$&58mrKBwb#+%M_@(gc& z+fvy$;YWzX9Ay&b_VEG(rDKR4{o+Fvu~i5h+p)9q?I0Tj%+)y_L{F9hmLbl1s5u(T zld^i0iiG5lg?b@DF@G~pc4J3MBh>`S=)$=~%%Jf65G%-OoOn#{DwxcJBn-Uu<`7GP zL^fd`)Ge2-7pqVerYa^VzcHlK(R{YI)Ih|{))_%<+u=8je$=C=I&+PUTyhTT91kd3 z?T|}?LzxVwr{cN&H|KV3-@9Ya&i%P-Z`ga|!RvSKNbm+Y$H!t_W>;|k&OJM~-`J&h z9K8Per?~wG_U_5;*}eCPxnyal;41g9;0dFNA4RU;!x{eWn{s<^*t^rk#I@V^I@|i- z*XlA2rY{R>8u$XnbXwFMt`0qm)woX6`Ryx1ExlChJazkFMm1WzR?as$Ivw-#hG&L3 zgfrI(9Hqj^W=)f|-dzkcf^g`=YOuzluu+N`42cZp&^CY=&?vydz=i;YwxudmM~im2 z-{GK3PK4j;2-S5OXALb1^~cawh!sr36+qM|@3dXC#Z7g@uUSWq`9qd*Bn)8%R45+R zYTEP)*c`&vz?y2unTE7_VqNPPAjii20PQg`W7VS??X*_M7!0SSh9CU`g9t0mpUbgd zurtNR@e0S$tkqZ>YA&<3U}x=YZF1P33lF=)EYw2^H4p1bwgPb;tRrob2mh8VG$jLbUj2#W+PWs{;- z2@KZ_vMMvSV}3@=aSjq_5?hX_o~DUhs%$5WrkC5XC%0p#d^fiPAEwU-25+UVk;4bl zN9OD$PRu*F7l|Dbk{WoO>0mw>&k~sRSpINvyyo)KAlDdYJHbAM3JjCLYQ}bm`pf;{ zH)0V_RH`hYrnBe>#RP{O)|-J2H3|zL+xEsgbLL>)pmfiatVml9 zH?+MByM)maJ7gt$dvl9NTXCL7euf`mrZeA*kr$a^+;W zTuj=e=n{ER*K+>2W24Ja3JV)MtKyxV3dNnxTd1Is`GT2AiyhHqt@j$^Lo}No3fWHN zcZ5R%e2oNVc81sv;jEiFj<}1~PLB7S)6N7rEaU*e+%$O>$(%ZB zZ-Q85>b%0<@WcmN+Ih>78LZ5o_3{T&8v=g{<`( z^GSZU9bmDEjy+eB1z%w4HIPd*Wm3Qa$PEcQ2qW<%;#d4#V)z<~5 zO7#ehw#F)5vPH&p^X5H5snTz*RPu#bzh2ag_jg{#JgxMMpz0-;KC&n~VMgRPu7CU@ z?$pK1OMaxm7{&RpedD1i(tm)Vt<}*j^m_Zsgbzn1O3h8B+7=ti^sPuIYTAb))03V0 zTajO5{Bx(dgMA2cs-_C=cO{>T=mQiLEbTE+vTh7Zzs(0Iajw&f_^m!biF3U8s{c(# z>{OHQS9CD&-*>-+^l#OF68U&P{2%l~OQ0`rx)m?gZer!fA_wia5R+`L;ES*Vti4x?K`INhB;8e z2EIN1XZ^V|q&-TXPGtXoJzT`?aq(5j#@l+iPGGzxgjhEho4jAvF$`}NjAW@_KdjYl zc$;Ed7Om{`Da=+o66_EhZ~9j*@yU>mFk{T}igl;#n=A7gtV`)Vh%JG1v}Nx=YK4Zj z@3lhR2Z`dbVO$1ZzLYt^Wby9{wX?bEaXUBV(=dITWjHL#Ipg!M4Qzen;xDvVs57MYhL-W1Ck*;&yH?6F>W@?Y&#o=!n+9{X{UPzIa;%jos^yDv*L_j1+v)H5vS!a z<}<4Cioi}v(Uc81N6hT83KXp)M}0@&M%h_Z3S~~VRn3}fvfSh&6x+qaV}WdoLwk#4 zA09|g9sX;3!O%i=E$3W)q_Ab%wk=_&7EcIrM(G7j`Fv}{_Cx35{^cbFbb!@gTChDd zZ}9b$U*tyk4uBWGU5*{k>(v?+;cGL!(ekHiI-k(_l;0@HmR2EsBx9@Z5#9uFFwcT) zq|8WRALub%arC~`4Ob|G=$LN=r;2>U5@4wd?GxwIqD5Mw8Z+SK`TYU75}O(#(j>MIf6+*#BXH(oAzm=jX_uq7&tVW;7W zr#Sq!62@4Z7i`tf85W0ImVpn-`5_klW3@z~m_{G`@RgQr(AmEq=9@0w4T`i;gguyj zu&8DXSXr`@QD$l--|6@$#=fM=UE)To^ig}~++l9U54DLRiVsx{%KV-wRG(0z^Ff9( z$MhfA;KWAYX6DftONSr+2w2?`XU3kvgr!=^e{F-AL2-{BD$#ya zj&4@>dT!DrC~bDcuIOUUUq|(7_X-J=7`j-@%_Bl`EwNCu`nmD$55zvmtb}{kM9p?{rWFF)jF+LFa@pbhI-&L0LbnEJ-|Cqv;pQbKGKwIdH3xo~vIX(yjW zb-Dh~Gswh;gxdJ&C6Bx=M46t-19SKjOuZx2;3_{0ADVCoTC9)6N1*=rF&vwBcGvcq zBcBRt>(1GfKbQ6G2;qlM4TE+*z&8*KEOojO=Ri2H=3;YI$kcR~~f zEb2(kI-dznpRGPL_RR>R?shW-f2p}UU2C}R(O+X z&0*ix%c;WIxSfVKj_DPh4i7k~89g4GUk3`w(;ffKmH(ci^O2^J`Zk05p*0qtn?)3MNH;JXuaAGn>MmHweX5Al;S>Y%@aCVkHpjeRn*zvw&oQ#br3Prp0s(EP4e zfB&XK^E<)JK!TS1wgfHtC_zhpSAv%Oz634#n-jF;2NSg9gZ)iE$=4F`l0V_;^A@?x z8p+?Dpd~+pufXU*43`P30i)kG{~QSrprtyKAWHwAId%d za!jUvadU{jjX&?A_`yKG855~rj3(%W-=D8|l|2#SAK=ftZUwgzbi(h?SA4?n*PMrm z6Mk=W!tdAYbD57nj=b*l`5BE}W4||gDfHbT{&t!~^7jV%t1ffD>L1!=jpCL5OCesg z(oY5YXD;)7+9B>2vAu1~>4&ciyIydO>zSKqhYRYir#I0KMo({to;B0kp=V8^9WHpQ z>)D3?xG3cR1=n+h;&*wPcIr8xc8cwMo9nq*@vRX5X4g|zJKdU~6LzMZddh02+e7>V zu4h8+G?}2)PQlK!Q_qCbpY-vxOV4xFPO+UuD?Zryf^WE<+xTsCY-gkUpufZ|dnsP^ ze<(pq{uc=vc^l>v^6_{S=O2$pasKgm6z8AGCh{Zy%(?`v{09;=`o!bUg;%+r+a-Uq zk2hNKg9%#lqX}B_wFE8si3BbAR)UuNtqEH4Cla*eZ%@#YzcbLUcRhD1{$wIv>F-X^ zif?;*<8jyXevRi-p5|#+JRYt2nd`YvpwCsm&~-1j=$no5ZJ&_0wpRS@KHl0oNr&>!n-Ste`7v!{qx!&H?nJ&e_KA-5 z{0-~T(fe+nU#z$FeSVAnYs*nRRBmjqV2_R-?U1kJbj9`ww9TEQkLzc?nWWpa=U#qi zUANT#%>#o4n@tn?4piXxMBNzsn`^QBLtVc9=4mW%^Hv=7lP=%pub404xa~VUbe5CF z{9hy@BtIuf2mB4fz&HPlMSjrbn_tKL)eJIP<*{ z{FFXDlK%ktsQr`IOo)5nFGw=M@Nl}7n;T{gi(@-ck^ z%+Ky)+WxOa5~9=G+wBm!j9D=xr%_ zSBkzlMUSTFi4=WnioQKX-FO8(NT)t zm!bz#bS*`-j|{WQ*9W4%XSsep%x$`Uz60yO z=D>CRF>$It5rWKr^U_^e#L=htK16S9IVz4{92(jEu!K|85W_KY{Fh7;?-2US<)i)= zLHzWImtyfdh47oSe%{D8^Fyw`aeU0eP#w4Dnrk-a9;;x$2b*(SJr#n-h`J=V#WVHy zvHmZvPm)P$-5h6o>jyltby&<)s6G*2!ZB?FS{y+bC2$gk`NCLzJbz7kTgNBU%SYnt zOhCLYk7A||UoaTxUP6}XoqERU#b+<|Xyx~4JWzBj?@8~YF@6Hz(aNs{p}72bzY*sr z{wD56ss9Ykzg)Hs^w2-!^rARVeAMz=65xu}K^!K^!#m@C;{qGNgC zwMia>sN!eOm%talEId)BglBsZT6JIIHc63g`aQu4H|_NX(

{%kLsnp-=mb@e6EDaevc13&t&;(lSeDR?NiKsh*0JGKiM|D{C89z t-eY!adEvzK){}vV{VtA6>if4ar){ufA^wZhdp)-ED5Z(_xpDpb{y(BA6qx`3 literal 43080 zcmcJ&37p(Tng3rsxf4i+91zIW2{}1JZUYE@0|bbM5JLiZU{6m^Po~YxbffSdEIitm`qNuDI&~o~*9x|NVKYzTGuVSpDt({@+)= z-}*dHJyrEo)l*N^x4zYr7i`~oc}GXaHLr~OEjVH{V*t0^XH*iNvt8!MLBsB@x)0}f z`Y?Uol{IwEUF$sO#Xfk^yv9(e1^&!hpF2zRT|S@5wY*y+`hGo}%NDxaa)Hum zZl=Qfy-CCgygWhie|9@nB<KK~&xJM?gF0(ZuwoSR6PO_>V0BqraofO}FZ2hMV*c}x~oM&YtFK~{-H z%f3(NPT7mWxI>q4pJh(ixhY_aR|2l-+)oM#rh*f0ce0m}$R6%#+}C3C5}QHr=9`>* zdZ^ah;f1U-?*m^-RT5-A3?`f;{0T65P3i)F0lXJn2mdp8pL3HF@Q*!zviQFPUyG{n zJET8prCP_SJm!J3;H3d4;B&x|=_1$yz7AX`)O9_$0Y7ohJ;zt2P1tzjt}ynj2Q{|Q{Wdk z8zvoJRwOt}@Llj+a031f7(a7T7wxOQs)M;F$afaN4Y2GR`I!V0RtKB~%Wt61%mnyI_$XL)6dnby4)_>& zE0{WVHo%vImpgX~!NhBMJQJLN_k+>@lsb4Y;88IBueLp<0shN?$G~p}zr?xO1QXSF z=rcPDRvpn{Htjm`i(t~sPQd>Jei^t9{sEY9b_4t{_!Z8nt0w*j57N#_uyxfDedct5 zJHg~Xrw&#f(Pz#mcm+5CH^6Jbk{JV^FPw36XunBM4fx04lJI0V=ik7p*DI|%+@zbp zuL39VUlVX0{1))5;Wxm41O6-PRyXN`;Mal^_@55A4*qJu4e*%9rxHw39bfO2<6+3g4NecCOUU3_@HpcIr?+*3j(Izlj#%VzZLu@Fn!@hxpif^8}Q#t zxEx&*@Q1wC)1x!D6GzfKV#I6Y@|0|CtfD=Mp*sJhl*#r7d zXyDgo27H`Q*AwB7!9Np>Z=p7Bifn*$>{C^^UX^=s;sXK{UV*)(TSxqUv#>m;8KlK@e z=LB3NJU8HSD3|*Cgr0Bjauo5HzEOLMZ^@!Qlf8(~J#{GLc^-6Jmlr^;6Azh}2ATEX zmj}E7{2EnU0)&Y`s1G7j-vqfyJn*}CY&Phoet>XGz#mW3Lnq?-Hq#O&#T~TGxVlP2 zy4yv0qSbyH-%CArs%%NVmuu>S2&XbDU|e8q-{%*C6VVdjvNQpkT&R!Q>6gTZsA($y zA|=2grC*AdgtlS)O*=DSY+~A45~!*K)9?|#Oz@>aW*fY;?NyfAK9tpLQ>B&dq-9+f z;l2nT4tZV%PkE}_v!s17;dXAWX)ouY{IlTK5bowqz^@BwF9*Mkv_WTLox8%GJZO`^ zpLPf2m7YKC{Vn-vAA`3e@IMpsd@_07-;%M|r+Arhb^H#zB;^yT&gr!)1>__Bxu-oy z$b747+K+h%Q{=QqLb)2-Y6r;^O#2n#)#9<Y8 zuZK3Az7ec3o50^1WMqdc;9bMbHT@DE!U?x2KtP)5S0K+n%_%0oPw_!sI05e^#Ex7Y zoR&KZo#yif;Z{D=p9YzThkOr@4(=>idZu}*zQT3xkdLj!Q@>5Mr}q)1ytt+h@(8#o zKT9#noC`lSeFPmAU}jnHP4HBIuIaL|rQ8WvHYVHvt1i#Pgc7joz<9{i!EXg)+nG`D zJHQ2S1AGTK@n$^z{a|FQth)jxZu&g|cY!|*W=@eP8I$hxQvY?V66ozto`BJoQPe`xEcPhp@olv@$H70H)nJNJPMu;#;#@@<30sk zC2Vk?0UqW(fMCX%JZKY4z|D|9WNkIS4!&S21lJ9E(6$)@ST?4fB_1-V-^hWVij2w* z$y}Et;H%#>2D990{~|i00GWsvu6znYK9cE!M;&#|pbcC%x8*-UEPp8;S^1Y4M*zaB z!8Z|7FI_WU#$ywA9sE~>J=~4ZZt82urY#kPPfnR4oa@y?mE%J18E>MHP}dpnf~WDp zHRE<3!ddX0$f$w0f@LEmZmt=!5#c)c(}atBQ8PXta3}ox1I~h(=S^lESp9h#@(K8d zV0=nuH~5i&uLu7j;4X@%O{8b04xRx%03HQ*hE94mJoSm>DEFi#gmc6LFXM5pL3h#$ zLfTZ$#wEJ9|6@}bZU2jM?gwcyH-hp|-{aTnSdMMF9tjY z{u=tIo|G5c<;k)$^?ki%Lv9q>gcWktxJmA4|C7H1P&Kg|n>!AJxlaBGj}h*K+XM*k zDNTGtxNUq{S}7H-rxU6i_IkX zmt|(}bu$-QCs|%ImxaCyYsZ^~x`+!HmUjgHbCp5tS6!3BIcLN>+ z{}fF9Cp--P1Nf|r;aL*{rtY)Ujc0YZ3BLeiD<<S=m*Vji+r$q2KKGfaDQ zo+FHI_|ncN1pZv`_JHY|POUK{b1Jwm@M*u!Ljj)-ep$e0fZrG}<#fI$;Dz9O16~9^ z9`ItY#-?;*e(X&3&w}X><1h77jqG9KI(WKn2PfFi`@!ftu?rd6PIf!74pv`_KMF=~ z&G8c(VDhqjRKBjifjK?-QXPocY&W3a0OfjQ`V$9 zcqH(Tg8wq$QShw+9|PY8#;ztcs0()E-skZt|0m!v_#460b27mx9}GAF-wmdJCfC8A z1YZmu1%D1q`pFGK)kyi$Uv|mnxK8;Rk2f21r~EVF9*=2_ru^f*vzVm%xGqHgw7GoI zDe6bfuUw}*$YYa19unaC0ONFSEB{k|1~16WR{URZC+yRzABF4OQU0^lr<=t?hQ3O( z9VfE_{wpMbjBNWRgKqW(84ogq=;|x!S?+CwsO9%TLVI+L=U6$5IKf&F3q0&f*X+0Q2)NnK&y>`FL+FW)F!2d@aY0X`c{zf0RW#2c=I zFZNjK&DjyK_p1$LguM z(*sVx@+0IkwGKWPOu17V;LQP#5i%dBTs86Bi+Iqt+CQ7SGhpK8-TtNNl0p_0j zBQSC{RXhUz3^;-R2k_s6>r_t-a38nl;Kg3Dm?n3I72BH-QN7YE!0epSE~@aw_bk*|Z_38ro5 zjDqg~e-YdOzsKXbb@2N=o|k~{27k$a(wRpas83H7|9HS%V9gPfb7~#@1Mok98{nUT zzwF(}yx)Mo0#4xn5sZGP)sd4Sd==aPcY?oWRdc6OKgrBb;4cM#9b5;i4etjxz!!tR z;Z5q)E5PpuC-8TJ{|Q_N?**gt=?!pqz+>QH@B{wy)TwI2P2dFnQ84XuMjiYvFm*el z0X_ysAGv^2q1|`E3HZz4F>oC$`}rQY0sbkN{#{6L>Th{G=-u6E6TsAGQ9_+(fyex( zu+!#%(Q~o*s;_Vt7`@#0!FBKjf!_eDzVzwhG4Qou+IV2~PW*=dVn_w6XieRJXDL z{vNo34CCRne+U1v)2%!X{(az&(Pt-vf8{@q%wGh?CRQczrN|0!9eg&Jc3#y0Zv@kJ z37QaP2 zAKS^i0j#vdWo`x6!4HA|8r%T?&g07+HhL0|igTAI;M2hKGVby#!Dj}%1AGpce!093 z#{M&J^xN{M6PH2nD-!rOfa%LCB-0PR4cu^C6ZG(x`g$UFr^pUHT*p*xIkni9 zmO!d;vefG{0I7`*@w>wr55N<@&K-2lJlMh=izBT3(s~^y&+kkTBV3_PG**I4hkR#> zm|HHsn+kONcq$27s_zdAPZo90(J^VQVV&n8T zbDGSe*vBpSf)`!zT|)9(z`UpKTBvxkTBxx?9t+PRoW!k!%0s*-h$g&>hjdB%`Pah1 zegt*BNe?UBbTfhzQZ;+YgyKo_O$eiN4 zU=ihK@Bx#NSwtIU*3!iZ7~h^b4_pT`7BcI=k~tH+9{=RPtHH#bB6)b4*G{Q}FMz+n zujdzC0>+2WmdsO-q588W!#r!a0X~4tX4cZM799a&3v&|ii(ruFoI3cG@V7E|N#+*t z`C!S=cNxkvd^`9;u;f{9sQczNz<0xcB6ti-dO7@y{Lor-4|qE`i;R3UWz9>#YR`+o z4KV&I^CZ@xL@#;}Onpw33~iga3|t5Q224JuN?vVyxu3olW0tOxai?WjYn~SHQt*<1 zmw{<-lc8M~qr2hd;O#V&{B%Nl{enEz(OmX@5Iw~=o58$Y19^>`FCj;;nD`83XAe_Y!Pe*OJS5Ah={7A^9yS5l$d{&P}%7(O6sZ5=3O|Tuc6n2YuzT z;I{-!8B5*+#=hjQm)sTbnczws5*e;+X8Ig7fM=Nho;#8^?A zHP29VMK)MRhVnAVp@qw0%Ncx>nkcKfqFYA--WD)nc1OUMfYm3|tK(8|G2qL&$*0N^^uzX=s0|OIq%4p;LUeFgp5X5Mk>Z z3(q0#E#BVrn}Ad(^Js+sBf`In@b4r1UlEr6>HP4=7GL9}ng14H1}K+TD?F)FlcRdQ zQ58=wFO&I^=zxEY%fPrcLIJx zz;*Cjz{*SV@9_1?FkYA688Gd%{3D^ho5(2D|6d|}tuS?=>oV5~6FxnJY5RpbWu6!K z`$LG{%fArHx*q(sfSE&=e?OF4muzTKZTGZhck8Z`%~vvr7lWV*Q_ zS1?~?3fu{pzR`LqBN=>qrpP@CUJf6hrFK|x4w(E^;tJ}V=>=!O7lLPj6Y%9=>M%i= ze#n%-bujI%-;qodM%N5JWnu%|ZeJeMED)6~h51;1?qQ96#T$cqy2?CO6=} z2K-##^()>OaMp3rxKffjt+);T4dQ{{%j1wix8g3^N{v8M>icZwS)T6``ZOy(g-n{y z=iqgPv|j}0!HH-IK!01$fWI5zZ$-FAc)A`g^F8$W8Z}jADQ3ktjqO(aRFTksASAn$ zGYKaUW(kp7xsH(PtxV4}(jP0I5^SRnyvJj=0o+Xjc1+SDbE}Pe>J2fde!$yOaJ>zwFuW-Ld4XU;o&l4 z5&qW*|2V?3S)a&ttQW>mlt(9JsgEo_+C=km7>BEVPC=8Qv&bm@CT=b}yN2#AVH%Ta z!d+nc&Tt)!pE5iOUP@i|LpQk7f_@JFtk4b@Mf|t5aON+B@zKrtlF!q{Bb1#hOntQM zFXWx6llMjv&4G0v_!7dP`)X{&Z~~t>BcpV6F!>s8fV<(n8Jb{q9}m)I#Ha5wH~Lam zKOg);a035j&SX03VA;!y;WxlGdC-k?(q*5c$v(V=+bu0u{fnQP56slz(}iKw94dBRb9z8zBSX{;c#Ofmt>_%!BZGh)$qdO}mGIvSlgobh zLb;3U@Xv;UZ&^GF*7(I97dOC90`vRI#rJ`C2K;$2>o4Pf0lYupFM?|Ue+hhJ!2du? z_khu9@p1UC4|oi$eh~j*@Vh)-LaOus|M?X#aSmIZUk7WPiGLJ)4f(tu+yG-YD))4P^#^!R$J4Xm za=@#>hXY;*mS2|4R`5%OGw$>R{OW+Wf!`4DCE(G3F9qKb@MYj*0dEI?JmAa0pAPs6 zFnwnEUkUzRz&pT?1pH+1ABE9pw{sh&1bjUhe`odT0&Bdgj&(5hrgl4h6imBi{tvhT zX70azs=Z9?khy1>-Q za3A>B0n;8El}<7v;8}!9TL&*BdCee=pVDu99=wl&xi-EKtojSz4E}h) zM+s#QTpMqN{|S#R1J#p!(%W-~gfodq-ah`XO!DM*Xx3!7dZ#Cixc`9$=26-~JRIiQ%9NMR&3rstyFFNYr zPm(A9bT)NdJCmn$OY=0myOmFdeB!yy>Z*Juh_A*V?Wgr*0E)Lym}|2S+%+LIevtpH zctPH?TJmXn_!~ce6E7}^j<)KnlpF7-%+CSp;O~R)^ZIZ6dBEcTo_N_zgXNXlQZ_jT zrVrd{Q%v(s3&0Oea~)F{*LR4|-aPS}RtQga`Yp>Q+RJ3wnWQu`*7)(D}+UJ0w4L=wB;()Pt z^XJO{`QYybK6!6?L%=Tp-wwt;WdoZ&6!6X9kAY<~qhQ+4?4$wydcb2~^2{(ds9QJv z4Ezt^1pIsOm%(*x>6zfKfE#q-R0OHB%wsco8%~gs&p!^o4qpdq)aUfaX7%lAZm!L0 zXYuRY21vtt0}rZ4kelSAklTC_@n7^&_FFOf$6q)3L!Xkl1P<+^Yx9)>LvE(Oj4zpM z1E!LjpA|4FZnnNam?Ae11U`1Oc{t!HVCzR@sQ2cV1pYMes{=;$&9?-MU$!=pJ|}^h zH%teH!RGe`Jd-fgy<<~^H%FMZY|1==v>!!Tbx>!kFC<~MeH9=9tKWsy1}3bKOFEET z_vRm2;Vz^30Tt6SGWQer2m;hme`7#?C-V)(gYOEs4n|IA;*`{Us4zO&UW@uFOFq9P z51i!Hq6!U#X9g%@Ad!dtG6@Y5n(i10{+ zZ;J5I2)`}D?~m|DBm9{Ne?7wAi*R(tX;Fl?Jlc|3^oLds`!W+xokf%=wcdJR`#MBfK=inN{Kb{DBBRKfs1Cv&Wl-V*Pd6YmiJfl1GV!8%7dk$ za&>LNp-J|V-IwQf@45Pl)sgr)+1gNbxGAmt3!s{Rf#p{WY?{^&`m4#W>+swa~)U2xffST zJ(QEnbq|;Nhf0IF?%LseW#fj`tA{skSfk?i7l(3%;cAuqatP;!_Lq8AuTi#Xj^|$7 zQ>yyLBde?T?Y-pceY-9jCqSDFl?&y5;`d&<`$DJs(l@mOwB-QpGR5)U>Be|ZMX+qE{w>(fBXk}a* z>hByp3#@KU6!I>+R3)w@MDR)#PxsG!)gNQY;?Gm3vJuA5|$1_FxfGN~#1> zHrZRM4w%;Y0s^_(P=09G%0RE7(m=7SNC98BYN5tZ z1I6lK&g=&H!E%nCFHoHki8aZpk@Rj=)?}3r6{z)%|5t&=RGHMc_ z9>$+3QACRI*Tg84+HJFQ>GFY!B!+5D1M4mg_T(ykX707V;h~=LVc*EL14Zln=M(}c zsLgx{LnF#F*Hg^*&=$qqK)J`7BJiulO1V1Z2W7BglOGZ)aX--^j^VhBjM2E@*E-$<@-yd zFXl!DN<(rOmSNGmNa1P`?W`&Vi<7^r(aU*XcC|2Uo~q@f3c23=K&fB46l{P=je^go zg_NUFrOKf#<-s66h$E%53(QJN(_J2>V|t2*awU!KLQV#006_~6ZK3u(J+iGr4uV?c zYE4F=Ts~0p#rKp4hYID&kz99ie@UHNU|e|j!zim%yt_cn6Ea&WHS@v6SS~88k}p+p z)e#)tvdLmw%C$6OA}Ma%fIQPjYYNp&EUm(@F64&SZxLqhMRNU?mSn9jZ96q$D7y)j zM^CeL2Zskp-d&8-V>rIO%cH&saG!K4&zhGhjWE~?`}+MCK=1uk9_luN@%k>E(f=8_@Jv{ zi{dCIKxeMnRr7~)Ef$0&%vTG2O*V-RHbofQG$>A{$E7pk@YcXdCq*}uFZDaw*Wo-4 zz~1XMFUbJW6(^i~JbmBUCy z*5ta6Xz|c}q|`HF4b5=C+MIl5)$K11;&dzNbWGD0M_j2_%Mw2?7yDUUG4=E_wctJ# z9M1P2AdCKkK5P6+X%Ig<6s4lfkM>eOBsxjem$0km-fR6h}yBcIf2us)s`# zS@SokgC6;&v+lu{)tm{_4Y^#uId5MrpPMa^U2&ws0FPdNyt#$`tA^^%iYXEA%n~nbvdNN0>_bOUxw>FVhp#7SF82oEJ-s^efTi&3+?=e+UW$%5 zmN-tce{9WRb=_C)?}?$eVm(;}y6$qh-{mgR)3P2KsPsEbxj4w;Fr7WC#e=eL^UgG7 z(UmJ&`!S>`H{Z`9EYFh>QuF~UE>V^t32_3hxd^k7D$CLktTA)>k*b%IYB~$LYIm+$ zW_l$wM~Xwn{h4#EFxls9Su5mNYu7aYYGKOI)%@Jc%5NB}!7?=U?eDFC4qz-|*zoUMQ4 zW(M-i6oh@uVhX)COQ-i7&bW+|)w_c9_mmqfBkp>Q!cP|EF3kb@3ism4Z0XGuh=PS9 zh5n+s5MHI27>m3Dmj^LW453)9X~Bbw$>k~sm@#;XP76zE#|v}0%CfQ74ff`Ss#>L$ zD!JP5zyRfz%jI18K>mp9-xL-ChkbaMVXDE4h4X-=>HfVm<1`>|bvuTaPxM+Fgj;i@loGd%_C^0%nf6 z+~KBG`Vo_Mz6NG<$AS7{C|ab+P}$hQov>WNO%1deQ6Nh!Q`K!KVG9!T47N_yTSSSm zHkik=>*1YTsh9Vke9dXOqSjUD73$98{_#L8mG!!14QZ`v+8G)itQPnCNgVHixN$2s z>@_)fRI3yVjNSqh%d>+-wS>pC-HqTrwVSiwb8Oo5oo+sCU}zX8TkN6k;#%DU-E520 z`?|ivO;5}cgtc`~i#Ah^C2KVv0 zL$Gu;yU-&SSJ)VucZR8`W+3@Ww&$97u*hJ;@zMPfQ|ZiS3M_j~cr=jDMz3GCfGkxH zy5WKwD43ukYkp#@`{_H{#AVM!n9Y4qt53lLsb@^6`}#` z8?c%YV$l0wi;o!Du-P+;#p2d=8`iHMM{V9@q}hy;sRmNa@%rp|%s4bg%{InAMgLQ zW^{LziKURo9gz)AC0Au-faBm@B4@9=PFrQtHC+=$>bF=2HMPl#{pvy;39-Mw+)Yib z$5g@Y;eP(3oRLaRy9@XiQ?%&kCCeeq>vGIJ<^5sLk)7NYS@!cq&g`Fdtg-VqRPHGU zCt@}53nsHvOY7t0mV(zR)duhbELo~UgQzEy_A&AyjQDENUgqgRt+Ni{CjHATo_dhC zPpn4oteDwAzZq^Ch9RD3f68okAO*D}wcc9J#y;C#M$p{8t-MEQX`=Dg+*j0UvPo!@ zv8T|D$~J!0C$u>)(d>_o9F(eng4&jqTbbn)O+La{QiPb5z9XtqjddtHh0eD)-K1?p z>m$#p4i64$A3(c%Hgi~GyTiDU;$WVQ4%}6rcGdti0^Vu}SFZ7_`IT9kWr1lpO!-4( z#v9ULNs9^^ZamM)DtyzMd+?6Iaz#_7CW|y{Pv1n)H-$8ze@jsv>~#f>ZSC=j+(b6^ z&BB@9QPEbW2x6oAhx$@^80ACMAtZ+^R0|Qs+|TsbitR1+mLn3U!Ukr_pzwURUjek# zNnLr16X!t^{B3opn|FpNo3LThDp!k7t>gTh5m9~ziLpk{+2k(&!_?PwoPJ};`#DOf zGP{_sl1WhA)P?AchzueQ#o<0r#B+PD&t17~*JV4m@5xwj`X>QNnT|09-ckFsfE-vi^T;(2?IKh8-zj4)0zVq$4Hn;2Q zUE5tsT)J(Sv+WT~S_1_S;Dd@>UBG^u%o==`8DS4=kgp#VP0#we*@NF;W0>_{g=Ju^lrnIFxNm548wPA`J&?D7 z&ys+iW80-r?kn2Ly2(M8oCv=iBE(w*FVgZ)qELSTZG~8~u%rf2qrB6Wk}YS-y?&M2 zd)RNp4kKZRR-;R3R0hazDg}R58 zBo02!gO#IA4MBi`n;W)o%G#Y^kH88t1&iY%QXxF3JOg#`o3l>4r&U+x|6H?8OLNcK zFu_?3;g7W?8kPkbd)D>dN!Q4#ACFG+^BOmtBo)|2%Xd2IAATYZ$h1f5s46tof?LR{K?9}a%0e%Lkb65Z@n<)Cz28Xb(c4-0@TTzQlkT#y!cKGA0M|NBnDgpo1o1 z$zxk%>FymfFR%KoeP=7u7Qi)aL525%z7o4@9tV@9cPeO8;zc6N(FMN^!Y&$b%FR!} zzH4c=RJX7S(pT7&#hSpjs`A6y9re341r^EYRy|vlw1&?2`kg|Fr+ww?6mjeY(>rnc zr|f-Cs6tTDrRB=VFu9bp`OrmqQP+O$5V4T8nF!qh;iQy_@Kbs zx0z}Dy@ENl&%PG3uGF5UeFaW8z4fjwL&jN|J?jH8q+S91PPtz`TEdWvdds%juH3VC z$5l+qyRP1|{hGbo_Uv^jC#7vmCVa9noX-2yDsB8dyRXXa+5S{NA*I9)W_y0&o){Ap#oy;)m2st`Vh3?Yqi9H0J>k+EfgC z@SfzURb$JIx}9oVb@jE|F4?)A%Iu|(-Mg>evzJ016TNTOQ+8c_-L5p^@*UTo zK+4u8rEZ;M@T+(Ff3a~MY}j$U3^3&S?U8^f;ztPTUH*~7$HJ;HaXoN0aCo*jF)vqrl-n8EhF zZXAnsS43ZPB{mW>Sl#Z}cU8>Uc{P?9CE0#G3r>u^H}rBpi-x$P0^O_4n=trvG{cTZ z>2R6Ob`XU_4I--Yf%=hFqV*ENwGXAt0 zNbTL5=WVZ-wFLV06DqB-oG8p%}g2V-(tkBd7f~$GdeG zth->t1?w+ZA0Gv@F9(l3QMi7~>e_*GFOH7`s&z1DA1kDx`QhOb%a&#zg0&}gj=zznZ# z9&&j`>4s3>^&1~sl&|ssT~U_i#KlaD55F?Pa9wtGR&K)|Y}F>zp-oI-c6OKJxFe;Z z^GcOXHv8xdZZm4!0o?J)PJ9OUPc;70aW-WKY){lx!GqwfDa{ z*qi1$u89BD!QM2-b1(j%jOJ!FITx($)Bk=9N7DbRK^W!pKOcFmikB+a`o#^}^E0&* z*oKVgf_WdBQBG)FMa&y88s+hXTsvu6$0g2l<@vdi3z!oSGj z*!l3`ni){kj{iTnj%iW$|F7Le+8^g$9CzN93$<76TSADvhT;(C_OxNmX$>RU9;qJC z3>{9X*fx*ehIPbvi+wn05_|;m#}Cpybk;J>{d8VQc~@8a=K48a)S~ps*%rF`2%yEg zs}ySbx>6}reGnDT+>(~TiQ;~~^RQv!3$-s8?qjV zw4GG3)11;%t4{65;8%E^vYd0(-omD>TQ~XrkLC!}3@yEw9Vnke0s1IUE&Z7Y3TOhW zzqHVsh)luPQz+NV;Yv=^wK(<#Q|Fba2uJwUmHrEaHgxs5!msqymUa+ACy#CSf}hZf`$I+OHm%tN1#(#r5zGrRbDz1Rq~Gv=N}rZv<#ZH3C)z17xp?H;+JQxmQjJ zuTd(-2YX%`R2s){TaXVtTEC|;_O(UtU;a~`$%l_XPNF2#(OZr~S=1&s++XrAC#3$V zxl&<(cIp}Q6yFD}gaM9Z6l|M>Z#R4munc_ApYLXuWS|liO4H~RHAmm|*-0Co2RJCt zfh&>bLfEvjUxBC_16G!7{U|f_k{@xLG`8dEx%IBE%mB56d`;#CY)-pQMCm<6P|fd| zLe&vo~&C zPxcdQ!%t(mIiTcbG$%3=ZLz*dQ`G9=+PN3wS=UwyGH5O9ZB@mwQ?`mY{pz;sH&0X} z%-mt?R~r;-yLsJP%Znc;CxUS5O#E*N{5Hv<-r9hUL-VG|K+yZ74oui)Yt6pO_zye- zdM(t?w)_iQDv>hnWj6?feJtCA(e8^s&1J*DzZ3Ia$7`UMTfQxuBnNfEyIe>g-u|?4 zrfsqC5lG))Y^w5~P{OA_JLcohAg1yr6n3_2kwZTAlNH)gJABbL zDurtQTl=N~MxT>-&rCliX~#Ikm>lzgw_jd#_0Fw)&VG~ksgB5)EA1AB09gNqyH%B zxzS-8eOsq77^~qdJIA|i=93?{9brz!;u)*>0S!m2j?F1MoT^Xedg1mKOwKw8sgoKe zq~98%2YuV`n}!NhhPyFIzh9;}ef+1j{CO75a(wMiRkY)!&EKrJ!xg@#SQ)p({CsW$uiXJ{E8+dLhjmwJ-hagLDEzD9=cl!j}EbwENJzVyDGS+Elh)|X*lKp&iJ zhbP`~NPUx3Zn-4<(|86xYCK~|Ue+kP>h`(uIe-}XX0{)cS8fg6vUv!sqW2b@%jlPlpPH7&vFVK>o z4X#AA^ceB|Xr(&vtd zmj1^)eO8th<8KDp|1U#&qvu06qIjjhFVHoYnJD?=5iR)#B3kkf2l{UQq`@NaqY+Je zW~K)EKltwf&W7%cX#TE?{Y_};qj>&KMP^+TFZrzzE%_v(C4Xf^OMZ7mOaA(ZmV8%4 zOTI6nC0~hX$shIf**z|^T=KU@wB$!4TJm>9wB(OPwB+xOXvsGsTJrZrwB(ORwB#R% zXvvR7wB#R(Xvsh7X`Xg<=t+B@-JmHUI_7&i9S=5^#M6b`IVbU_Vl_^t2KtFE)1!Xx zjA+?e$mg7AyUd87?9?{V_viN8mojXDoMB~WlXdIpUZvHgd`Q&v+$WJuwn2sZhp9g(+i2oT~ zCi(k3y>^4k+^_nFemht3O8E?)z+L?ap=vP18>f`B$juG|KXhf@@(sow7(jN=)Bd+6l>ZiLS zTJfQs&)e)eUcuk)N!!`z`Opt|d81YTha+0@k47}|HjU7}seJ0M()?3@mFA!NtEPN5 z%8&drt0P+ZuZw8(N&VA#uX7!@O8)u~FIw_l5iR+?h?aaMq9s2P(UPx6wB&D&XvrUq zXvyCi(UQL-&_8z_cPRc?6tDDmN3`M_p5FW=*YP3w`!P@Rv@7*T*m=is`5SR#d+vnp z=AO8B|Lrwl+@B_DivBBzC|x$sc<8jYO8GWE1KUU|DU$_X4h%bB{-s>XUghW4SFem z6is#Gh!xKwx~<#SPM7T#nLCHuN+VB zknJdq^5xobjECe?`aUp!7AmFn_pL1N5bvG{t+9~OJHgT=rMtiya4B7Bqw8(-(KdRt zjh23KevLNzcpE*|Mn62BHeV3sXMR4Wvu*P0+UTT>-rYubwb7L}y52?~ZKFrq=woek zqm4e^Mvt}8509tK&ZGL8-NkgaO@3V)owU)r+vu(~y3$71+vuZh^k^G>tc`B8(Z}29 zu{QeQ@w5%!sJ;_A+v2lr^tv`WX`^?y(OqqHrH#HBIvPI{G#+F6jyC%4Hd^B|mVcm) zeyELpbUZzAY8ySjjb7bGZ*8NmY@@Glqx;(Ekv96~Hu}~!`i?gG?l$_qHu`}!`k^-Z z(ed;o_4icn;GZUC+i3N79G|q&>hCzdtBqEF$MN+x`e++H+D0F1qZ@7X@iuy_jedAM zEmMj0ncUe%XWQs?ZFJH`?{1^J+UQCfU2mh0w$Y<)^szR&(MBI{qsQ9lhsV=4%|`t( zrL!$Q+eWWzqmwpzcN^W+MpxSCdK-PTjUH{IkG0W_Hu`uQJ=RA5Cv@cBrlxCwVDD2G zw#B#2?^89u$LTe{$MiGX=>9hPd2RG7+UR#eNB(On`&r}Y&$Q9^x6wanqqRni@|$)N zbkyI|RNt6Br;S#9cbp5Z&6^kpT-sb==NNF4>TKf`WBE*pS=esSs=ywLZ7WGdI#U|1Yk; zCzG~yc$)1yKJ1aL>r$pd*>HLZr?ff9G=eaRa16uvG1h#Ze7s#r-(tck~gb=v3a5-bPdWWWeK>2c-XUjE}wYqxrc nYz6N)7I12JX;iH5mtl^3VNZped&7vww!ft`>3efp|M~wP2>~C5 diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfel.o b/firewall/interception/ebpf/connection_listener/bpf_bpfel.o index 56f90d95ba68b723751bcda9a0724d0b30fc5900..f85c95fddcc0a18f6fdc0ef2410f193a34e19494 100644 GIT binary patch literal 36424 zcmb`Q37lM2nYV9O7CMnYjAlUrD-a-TAqgRdy%N%pXg0H81hKlhx;kB?x~fuDopeO8 zP()O~C@ygnY()oD)F>dRAf@AixWxe-7aUu097fc^6=q~O|mCYpie?%7^{XScu4NqD|96-6iU z=*|iL`Rlp8j_cmZUYuWvQ+vN!lY=f z9us~D@0e&Rviz;$o~!9E>A^nDJ%6ku@>%ouLudGVZf-JuFX!g^0_>#A%elEeKOMc7 z74I^IU$^j|W8v?R)|X3~dw!NrZ*EaC-sj3J$}LL9JICom`78g2qdAEBQ_T0i&^?as z&HMYINBeuu^4ZS6>FcxRJA-?3-cI4kslKn|x>Ew~9sbsCPn~i;+|^sC*O^_3^aY}(_oKHr^s^Y!pomxHf{sCY$aZ)dyqR=mR3|IDs4 zU4-{u;p0`luHowRD_>E6bvYg6!eesG!znh&ly-(Nn*+)6K-7j9d z%E|3^ahwyQdtdACf3{!D{xkhzwr{V`=ohnn{Ox{`4F8HmznE?PBH15jTfa#5$JxF@ zLcFSHH$EMgsOQ=0Em5?i?`QNFKR(bLqM0c=tjSkD{q)oI*?wHRH`Z?S{Ll4^3pT9L z<7c?{J=zsnQ;DkQMDAMbt5CKnCBnxXb*V(tZ837`BO7jaw)tFmmkriL)649El`xw_~}Rgh|$^G>H#*>l&+0jQ@Aelx`Us^ z{YD;Mq@jb9+ywj97)76e&*OQ9OsWlJ#3Y~vE397l8}Meh3I7P*A{#PC5qdrR6s-6% zB=#UY%5OyC<^VInG<>vi23}w`z3?*lrPwrKxvg9+cm?`bNI+%ZxMdn_#Lq>V@~hOW-Cf_bRRy{2}zpS43gm0V}^5_)G9>q^Fzghxso` z!#@So;xq6Q@Y!%LJcaUY!cBN4oQGTRk+AGl@Fy6j;l;4hlYy5TH{s3j74i$e9Dbc_ z4vnHqjhpZ*ja%?rV5Loy?t5TY=I}@1*UK;b8CYrPh5rFw3pb}nUEeZh$n5%&@oV8< z8ov(y592GRM-wO0R^<0;!kGoHhxfoo8jr#!81IA6fR)DB3ntKwK-wZsNwyyN_!ZTo3R`8Lq(lZJl2WQ|GywGgM;4_UMc}~=|$@t&k?Z&@+ zPBi&d@U{3=g)Q(QMizyc*8H%i*1}hgZRjRaah(EO)5CxxWPA%0hxx z8ogYbvDX;en*sTs|Le!QU{>5WtV&1=1@p+^PCQyM6@y3&9L5w~R~tBzmR41y5&O6Yn>h zv*0oK81x!jBHGSESmC5$xfNW2iE@&Lx8>N-4cd+-=-fK=xNe$u^fF@`q9XiGl;13R znwN7$<22GPv!|IvmmAXrqANX*o0pUhCGV{~la1Wp!J32QZZZGL>&MMMe&T6%B|vjf zmX$W=Lb&(fM{{Cuha22);VO-C*iV%I@1j4#X`<*Su)~Y=4x*HAC>Sa0l z<4k9_)TemZgI+d@cO86u%!WdAY2J+fMAKgapJcoZKG}E&jO$kZ&AB=_0YPP`@Xa~B z%2Rsp%{_5?wH@ho?X)mYagRHBxdQz{)4kDb79n42ycoXTb69(jMc0j7`@Vr^OQgWv z44>vPx*c9>{Q2?zO&g`A1){vQUNPs=PW`!b2PLvAzi$xMTvL7*KHd1|FgEQvKg0B@ zbL{{!CUZ*#KjL6Vq^_U*(TC%#C$rwr*e^FD#&cm@x7zkG#^=HdVb#CNI|FC9%k`Me zaxb=RRQ9B~?Lr#XVISgsS&T1@@oo!qrTND1#5DW{^gX7#7FPJuUk`8Kp5c0@`8^+g zKOEAG7+s)0=Fqz``3N?vOt&v)e-FIc^k0E--7n(L_hL3uzF2?Eg*=X7lL<=hYht`E z#-x9u^6+!)H7CnGYE1D(zlU+%>Kk&hSNZ=5z2$jI;^D=u_jd8I5s@Wr_ zF6PfGv0~{Ae@I=@JHYb z91;FLvr$~1G0wpE8u!9qhPPqfgztw3;THS=T#|lL6#WxCBxauYXSgh;9v+4(u=?mD za8-KN{+bij#;%4RM=#z3|F`j8cp{hdqujO8QoGv6{W)AUxW)Z&u3o6fk-}Uq z0C$BWn@h1#UgThlWx5NG1TU;tPH;#27 zc$X>|pqdtx0|7`{9=?Gvlt!iHW?210?!(4u_@gkzJ8>EO8Mw$@?q1_2{AKtEDT(as z#?#^N8K>cgj2FVHPmK#1_+Q}@;0^Hajkm&28~4JKNC4?{?Rpx#9UetL1IBe<>TZ6n z)R>_o%CMfB2cK-ukAqdFawnSKnebUKWiT-VuY)8cwtuqQnq z4fgPtf<64>U=RNZR^6uY+fB`cxDGMSpr2*jgkNCXg6G4kFO8k&!W#SJ&V$!-Z*r}I zX+slN!56`sxyuz`)p?7n3acF{un`#7y@Nlm_S{7>U3usMF0~)U>v%?$xH7sHZun>I zcF;oJgI;MtSx!<54;hvG;T}oq$xzuh0l7gjo z!7q}F=ORGy5Poo}cj7?~otqzik8jN(&K*J>1cWhleRCFkx#{hen#{u^(c`)m{yfj^ zwd3)~Dj((RRQR>B#4Ur>&of--8u!BHQlBN=$G2wRYH72ad?=zPD&2U)Td;(VcOnd+Oo6>ooxzyVYP_^5} zY2hih?+k`^t|&1)Z?^^P_L?2_I4$Ud-Mj5s&?Bb)jz4#jws(+6&ADHM+5bEDRrm&| z$@LxhM(!=HAHZ%bAhAC+&cKfvH{m}Tx8NsXH||hC6A$&=gby)RqdP3<;dwz%<5&>% z@Y(SDh(BWep!sX2n94aHy*LfO1RjMmaC;7bUyfe=eiY6d?}O{+w*~Jq{TTcP7W^=*yhJmi=-0;G@Z-kQ z;irw~z!UIu8|G=flStFN9AuUIw2Fs|+*nI^zxS7UN#{6~9oXn>@9nVaQD=Lj#=Y=|;VSwjd^`MUxCMV6 zz7y8M<}2`BU!0`e*k|LZoy;l=U`>-5wpp_zlHCXJ^VC$kL=+?D7(+go<=nr zZh;wCW%>oU3D1L-<`%rzcnt1=zldH3i0feW_YB+%t9+X9F#Hd23vR+nvo<1o;IDxh z_(u4CxC!41e;sbY_rSNodNKP|_#5IQ*dxGm!3_KpSblX_`7rFt7XGbqFFcXD`6eb! zcq;7j0?&q3r(^K3@V68WjYw_f`(Oq>9acJ9@cHl$Ws_zMf%D>dl4{^sk$K4E>Mce@3qZ ztY5=pU zy|BU=gFghHA-_G08St5K2EH9W3vR-9!)L=S_*=%&`S^!bh8g%#SYfU@Kk9nicr`4g zs~2o$z~?Bg3us#Ka>WHNg3nW2a0b3WaltQwabYbhpK=rQ=RI5#xfr5?OWhtUXd-Vi zPGOeDVm)Cg9dcWYn@)0nQt$8Z)Z6fTF*bDZiFctd!AtDp^ufv*Vm@LOP9_X2lwe^MXn@YGw#m$}r3V|+`{l0@wj zg3U()q5oJ+e``$t$(a7*G5vR9`h79|eKGx~V*0=9=qVjPmyzu#&2f4M@_CU=8eJy^#8=Y z#Z`uJ-T%m+n(+hhi03ZlgKijNOnn#ma-N0wbY`eHUb0bMvhFniJ;TuOfBCR^Rzf?v6Ne0b5f zxy$C~+!e?Z+?AGY)+Tgm=XmbweI`1&6S;>1LQMU{X`QaUFM7A>^jzObtiVqQ=Ryl7 z9}9=L-M+bk?qT!06aKmJtKom?gegjWu9Jw=-7)?J53j@?H?Ds@f;ea0>LLHIvpPX+uCeo{;&jKTi}wy4Bkz=x6743+#C{5-e`{|SCR+*0Eu5r?Zh zSZ7X#^+`|$J`~p2)r9B3N62Od?H7K5Y~bVJD`f+pY21QW!)e*Gws|Rhl zcKB%7P?imNo^0S(!^arE9zGV<8vPoWVsh{6-w7XwUh4;)Lun1C&h;MjJzyHX8CF~w z_%`@>>|5|>;1l48F-mLXli>_}AAAa|HT{F|LfOMVgcr%4w*GUts_=0e3e^uZQ#fn*^>?b)N9IzYO(Um1 z8m!@uSQ@ywbDtXt^PJ$z-&1aVYW%jC-#>Nird}V@Um0Va396mb#3!b)znSoFGJiUY zS6yegK8F53x%YB?5_WA2{v1pYE^T^GlR+o<9rOxw89Zk8(*H8%_YXl&08hhD@w^F7 ze!lbT#<=Iea`U+JC_0t9+UNz`>7vnA?n|h1wWWUeztPE6VbxU{Zb&t&$@ zs9isJHmo$rsjgwyw`QYv<%#}q*()4)uD5sVC$$;P4|0pqhjHsH7}veZ-Q1s)zH59j zdXhLXgK85z$^34GuaOzD-eDcYJ;PN%|19oJE}b{7#iRvaie9Ys_zvU!@NVPp!&kr| zFN#ZN<8pdmrnp*MIzy*ly1cv<8~UbmH^G-f8LnH6o3Oc5w}r)R+7#od+;7L0INezA zC0Ooz+|5K{O6}fU>OJr;c&;?0QT`6T$sUG2m_gQihiTZh;KzNq-G{`&InrDsI(|!vCO5Gbi$tc zg$}2dc6jO=;p2U{ZXD5mR(ljVy-yNPcar<#;(8%|6i-sW7F|N0x~mgc>Yf;XF~%Q{ z@wpwInt^pTgkuD4yVQ!9&DT1dS_$jS2<|^$N1-Kcz)ZlK7AQF@jdW*^YaDx zQt>>_Tw#`|S2jru=aBAQx{|E#cj$xeJoUTimF-c+lz)a#fLrjt!D>SH9T|1~$@pvV zgyX#ae)!qOUx$w{{sw%a@i$@ZcS%FEpD@owFV=bOD&xoC^~Q?uLRe{-4(pv;fxOIt zFG2qf^ci@YaT6YauSeg4uYw1Z_cZS};6XS8zYpGwT8pS#VdcFA-wosKN_}Jc6*zRV zufZ=-IIJ`G!)#5W4E!VbAK_m3XRz{8g?|leYHh+#m|lCpXg>2H;k4i>u;SGQZw{OF884sBcO`UTiui9Q4C zJ1NZpP1s!O{qR}XaGSUllRAIm{N>mBX80<*S$L9ma$32aL4_{)F)ed^aq=O|GxOS8*TZdJw*dG_>G{ z%|@B~515-fbDB&<7h5`~DN>4)V}$6rF!^ z{JHO~j)z}?PVN*qYkV3ke{yHT3P-L7?lZk)%F4}Q?QfRQh3}NYTqPToDb3iG8@FgR z;qaf8YseAI;|3sc7<#&1N<>kHAV-nm@lY&cIK>Wy0=-HCDTM zfpAhMdggahT~m!~u*P=T)Kk#}eM=(ViGGIJ>_Y#1<5!}eXUuP`x)vM13f6cozpsWh zZi_F6SDMXh;LR|}^ZRV$t4Ze|tnwL!hhddZ3vL>Z!Pmi6@}6&now;}mm&oU;NT{DasU%H-WOrPvJ%J?Ao zMB{GwRO2b|S;kZ0^NgPbt4x%hgW)x%C+S@m8PgO(j#D2BL~-2|;}6F8@8NCuCGBpV z8tOvjpth~~E5nr|Uhyg}b9m{z?2siSKJWiB}`r&Rf(AXhv zqSqMb*8a#EL*3dR{ve(-|E1wuV3#KNQ^u>{&lzjnG3U}Je@dG!tp#z1?7~K7U&ar2 zs+w=3%^zuu?vLpu%W2%*AJgwNdxiUb^f;=M^>2)S6Jz^O)Y(iqS(e^@R*a8{vCfu* z&4QSIag5K5aVEy=V|;Op3o)+6xEbR&$N2p*{zQyF7vuY5{Jj|eEXI$<_>VCj^^>A2 zlZgvD`PKJ8A@4I{`eR~zN{mmBvCi9r-Yu^><1ziy^x>e__acGy4M*U6V)pt?anOG`rhhQTKZ>!wAq)2U zZX>Y1oeKOfG5g=d_^B9AS=h0k5#wWGtZ&ysm{GCZh_cz`8#gY0S$5Ovi+Zw~U$&tq zn~fT~tA%JNHWxs%C=f=sD8>&rCe-OY76p8OM1nI^RpW^uD@V@%)?3P zdZRX+Z=~y${Py$-_3g)}FN>zgpjaNLq|Z+GRR^-QVtHHNF!w^eP}^CUf9!!0Oi0C7 z7AgbtEx;aS;PJYrgmhYWf?9rOsj@5A5Ep8-N-eu%xG-FBk4Es@ zm(Az$gI+G=3&ovLQP(QNBr~70nsQRPGG3pCB)5G!;wTBXXBO->!qrEz31S0D6Q=?|IRUZ|C`uH9f?u4JkCJlPqMSzD|* zk=m`PHMz`N2I_;w0at$^386{Ke>*t^UnwQZuTWD_xkS)-v-w&fM`xCtC$(x{?G{Vp zl%5+2^s(r1tPLu!3DvM~cGX&8pirax)px78l@w50fcoiwE)fN+=znb{L80BYE0-!C zs>-5KZ#S^MV!1zC9dymTJ~-Uyuk7-LT;E=BmH*1TL0)C%V`z*h%xr%l*H2j#vO|@A zR}`kN6{?k5!*@z+#m;`XOwqeksiJ(sRTbpRlI&}~IsNhp0V=Hlu91?ftN=5t^vLi#qh6W55V8IWO;#z^! zxvb>fGmUq3YB}fQuH}c_NYxpn^4WphP_d-6W2%Gc|c_+N$qeLVq7SStePv<7^-79ymX0s+DTj|WlSW6 zQx{{;^wF6_H5V&Y)~)l|;YCZu%)VGITH3L!4~DW+AzIvRR2cp3(k%}U;k~aA_fNy| z<>i`v**9CtmcWz)MhY78V5!K+>9AZFX+%{z;m)X9sn?5rr9xH})reFJ#qv^@aRfO7(I1=qMC!vCNdJ@jqXs^`cPa?6L|abctm$tqM|eR5D3!8?ARB*DX6d zb>W0jIiKCdm{Qr5&6oUe<5JBe9EOEmJEA&mQ5roljNDKi)pEPC z9TkG}n5*Rn+iE=RXq(WtDNqKP{wU0d!^=z)CdH_cE0!X)uU$C?05>0J2N_EUDWP#b zBRz{;<8b7fg@%>kfdS_)+EFT$qgrRumxzIKroUNo5seJghQi8Wq^i~w_3hT;p>KDw zf5a6u-GSB?Y0Rue+X`g{-D;SQDcZtFR24Y$a;5DAQQF~y zW?U(j8D|?&&aGl2-?&^#%C#trSz+*X`kkzRT)Jp6g%SL@b{J{QtL?Hna>d`4c6jnd z=c~L3=5|IyzQF1smo}=nanAR3 z_m_dJ&Kkvce*N_dO`pXPsv)Z)49ucl3r$7_R2`dyYi&_r zRaoplbuo`z@=C>lf}7Ox1N15t3qIkOUTUfg1w#@P^m)`~-u zVWr$(_kkVgf%8Gy5A5SW4-zRKu2IDe?QvYv=+H#3OhxkS!1?g&+^kxa+ZOGPSmH#Q z{o}3KR@Z}-QhywME7o6Dfl*(jQi`%G^w$O57^;>cnsTAc;xNpfwZaayZZ|qpl!d5L z)!L6PO}x1hi?AGj=^+JwW5p%O1&BumfvCL*b3IipOI@(e%;kHkHYc?(3r4lRY^}od z%H0j549EkLyck5U+8DeFD(T=6l4v=P7Y-m z4en}}D+3BMWq(KBS<00=5|%Wcj!c89cO)&{tCT`9SL!I4|FTMrmfh}-980JxRF(I( zvfq)o8gr#rk60vW2U=xBqxl3xTduGu?JqHsT z7$<|qErtt?!3LcqtMV+JI;1)ivbU?}9jUPgZKG5VXxWf$rCO-@8fT5Z-LKJ^H{1}} zKa^u$WFm6yLVvRH3_FGDY?zFy_I4IDo$hLLxlr6T$dZ)mmziRxb?WAVSM#NSd@x!} zx#^%-+Yt@tqoKSr)Wdq@Cf#~=yE+wv@(|e@)~=IQH#E$N10J;Ul|FLyu9J_bzn;rh z8#ShqDvtqn0gO$eV%2U-{ezLkr+G!8P*}Eb@uEfJq|=r-(X|=*Rt}V~h{bTk0fV{i56WRz3#?X%dG|A!)rrK?q zewcRL-GcnEYUWWt*KKj1wz< zzRkM!PdV1v$2Thd6&plc4*c-vTB`HwpJ`aKQL9)VVjL(HqFSR&^3Dum40EJZFT_31tUH@kz>jaA2 zmzN(EI;n9(U;N-=+_6D_zK>+PKCF77+*uZL;xV$r4f1GIz7Y#<_SF>o2>nT;zm(O% z-7YcAEbRRwU+Pqq4gy>~c};D&T-M57`*pX#aRnajVi+lub8KB0vIezR1~ieBD-DKo z^=ZukL%BRF4wu4V;%^WbYo2mZTLubmye?A9@Wt=8RBoK`BSdVDau%-HhXn?S4oErr z#fLKDRv~EIj-8cno7^DanmWgWq?2WU3y{XTtuYwv@mbkPM$9{6zLt+k%-_tDou>oE zfl5qdbm3egD2P1Q#|maN zs?Y5$H4rhgwMS65?eLpMKk5-xjk(5+TxuNTISeRT?GQ>#L!1nz2hv3ww`Nx@U$=5i z&&KR|>(_1CvbJYsT(^AP`pv6)HpW#wTbG}=Ij-2SeA6a3Kq%2}kSN!f4zxdP)Lg5s zv&Ujh#b3XHx6wqSe1#1z1CO5vZ0oH_EaJG5R=KWc^TwVFvRl@zUblMl>g8)Vsb3kC zJXpPHbI-<(X3M&uTfOdrVAfG~3^(?y=~=$1Bd^@DcJ0fejhol4$*x(w?#0=7YzNRP zbX)M)XyQkawQD%TUwvVA-THMsQ4r2szAkcGAKJCLOr7b=-KrY+j43)T>b6( zVCqpGB1bv?&2eT3o%B@({F-%Omp^0~#=;S$KoSZ&wVHP6GIkBZt${Vw4l@mD^~Ab1 zVt^bP_5-wMo(xrXYP8c@ox)%^E!O?$XNnNNKbK>_;La55yUQF$vsPnmsJYD51v~4= ztxdN3bK(AII}3I5q3U5>$yOkQ!8+1S5@tZ}%?`UaM%sC>{&x|%1Qy0U2u2K}ZvNM1 zKnE|8PDW}`rM|;<)v6+Gh8VFLjLbUjutfqTDSqJNlmFL8oy%Q`Gp%1Fte)wwjd zHW+3Jigj0Rdtta5<&=VKeVFY8`xG+Jj|Vpeu^l4+YX0c!!Nd#Y3QMT*Dmp?TrePCR z9b!vZEA1wJcH#cDlN)AB1#Ns>2eSQ&24A##rC{muH=1vQcMH4g`3f6P7iRlJpAIw3 zVpgLmeR3$bn?qyPnLozvRu_tY#}YSCej<0pkj64wxPLUoqTL7lReJSiIU!}e1;t} zt4|elZor=c$UM}Q&r?j}wwrzsr+zAa?6E9Z5~C2W8W~M4h;CAhVquZjQf_y|Mwg=$ z7B=pzig$L3l;-SO3mJ4`F7Jv-iyg@Xt@j$keN>wt3fWF%)jZ1i-K?_Ml;!B$(GCs? zXlraWe+uRol6K_4;e#LfDZmn|Rvk*P%W|g@r2<|pB2}o{*st2SdG%W6 z?RD!n_H5d`eBpXcVbhjP z8+z8UHZaTOTQ;vx>WG&0LsTPRt8H1cT3|Raj~Hl}kluVV3CAQo)Y*&1k@kEcL2v8r z9L|gUWyT~2VYp}TT76y**;u>&!sRR0^pKg&M6zMS`i+~3jA97G_Tb+YbjG6idvA9f`OMeniZ$J5* z*!%4TIzVT?#%uEs(872??ue6s4&==}^Zrit@A401<RT-m&B>NRt2RbfHu)r1f>dfqXq9MN31H7A;X>MpLFd zBT>b_K2h-(Vhi-5W_UsSWz5CJODw62PJL!n?t~eWzdHZnMcjd-nG*j&F)aNpAE1O#$3^iseSi`|Jo%jeOGj*HlkZn_Fz`QjznJyk z)PG{(_;&ce=!edOzP#yVyjZ=El^=^7Qon>J@%pm17>r|WacR53g|?_y&5hh&Xp3!c ze`8y81HlwOZKX-xQukd)`h?-SwK$EIoSn2EF}^6IBA@got%>p~3rQ9mDWe!HF#OYuk19Zf{fEmPIQ&eG0SG z9SODtjyL@)mvAzqBh0`ouUL1ge6uB9gLNdm2XRXv9c{UHAk}y4 zU%r$$!DR98BXwtUmEG>#luyI-ZI)wOlyk=CUmLjfQ53$=Vv$?Sv#wXxeXe=s#|}sZ z;dSolmJ{Pfqr|qezRlM9{-HbFbI8$}yR(yW=lQHS!>d3RyE@`@Aq@F|s=Oj_C#9s6 z4LC>4?6LAhts_T$M-UCNvnc0FoNOzb)u_R8laEl`E*>2VWVbkUZ;{-G2TG?7|Fykf zXd$~UI922$7QQKe+m7>~+DxD896gX|K>hASg zUT?@b6yS3q*HpDR(<2}KIEnKNS}iYK)E(a!8ZJHjoPll@R=l4_FWQ( zleDrRxpE2Z)(JUl#7>}@xfV@f>F~oJ0jpcmm?=*y!eX`PzqX;6q0poIiqs#OqnlOy ztv2FPLowK$cP2wB6?Z2GM8fN{0Ho6^0@Ox)!HtAGj_{@AHlDifr@q|oP#R`5EwcM} zOYJ3^rRERUPdQTP(wB*GD1 z)PB$8zAW^wGu+D$H8X9=!W(GEI+pW?K@6t8^8Lw>okz-uZK8JMwvn@=Lry#SEUKgR zhn{8=4hgmK(@P$Eoh{L&Q(;gX{sdF+2sOB>o!N&b9D){V1K|kNA3xf$d3$&5K6B(# zL2cbRoAT$fz8(?$@Tplq2yc=u{zvGTkxkK+As6^%9WZyLVRpQ-{vy20Z6+ctPm}`m~?0d8ltyeZ5QIJ(fEjwl|rs zI^4JQYE*VM?oPw&yYz}qhX5l*A%70JM{z%h_`Zk07k$OJ5(urPH z$82`ASFa3nAQpSmPJQmGax$rkRVPrE^uE*b;XWwQOEG=h&+o?{?TXU+1p#h}U2FIS zN0aMTeoLgEbo6oA&x-W>uIN2Sb>tWG;J9Nt@>*p5Btd@sPipuL9(*m=q!0RMl0VBe zZJ+-Qm*i*RZ}RQ_cU+S7?{6J{AHUaxCF}RBv&N#R*JS;B7Be5@w|*weeg^i{m^>X> zd6fT)()?Rezan2T`MJnf$K)BvdrZD5&2QEp>wY8%zy3Y zvk?}?WZ5r^$+FMHWZCOCY9Tz?>vw8Fmi^Y4Ec@P=Ec?NjEcc{=il$q!?{^!BcHyO;c2jaj{NQ=Ig(G<~@*I<0J6knjdA`Z- z$Nn&W_?0pF0r@{G<$hQJ(W`Ja+W*;Ih3>H>Bym+T|JGY zqEYkj>IpfNv*a1bp`2Yk@k8lQ&XQ*!hjRW2={@0^RJ)ud&p{65EO{34V-{bqeReJwY6#7H>CN4Q(Kb!?lgaJqg;}|ljaX@ zAD84wb0zV+X)eiIO@7SeU>}hdJ>P53yA!g?QqLza#>uIy;_Veqz~cFF*&4j z#N@w}kC5)W%s!-BeV^Z=|HXLrCgKU@5z^7J=OMqLe1g0zk-rTIS#`UPt47`aB{xC8 zWKXzXIC+AbW8#nezqvNS_072cNwa@~IOFaQrq|q+bQ7XUNtOMZc9Yy%Bl&QG|M~Yg z^-r9{f-n*OuT4LeNDu$+5dU;)C%+ra-y6_B+qGop(T&X_wTBt8bgJFS6}e`_(!=oW z+#URVwrc@ip6GAUy-x3c+$)vZq1<$TQ}cG~*ZB!~RYLAP!z&c7{Eo!rgOT^dl?@7p`33*>aZYAXX33)6bKbDX~I}hm%?Jme^ zYllHzn2@z*jORDB|6t#ncwSA&&4j!sA&(~HeF?dhkoPC#v4s3sLJnOwq<6Y?U-l>Dv4s3sLJmW()bc;wri>t` z6Y|1@oJq(V5^`@st|sJWLf(^*M-%eCgxpHV`xEk5LVheEyGpY9arsxJ#pHBCUYL+G z33)?8?oG(mgxpNXdlK?!Lf)5)%;Ll`m(NPb zn`5$ywm%^^67rP^`Rxh$g9-WWm@NE8LVhSA|0*Frm5>kC;u#m}`|yN(QbIl}Ag)#LkB$oTAzj zj*-K^WD3bzA6f zi?d6;WVh2KEy^zO%2R!b{%wE1f_IyW#szf8)n1%#>y+>?A-c9JoptYE7G>Hr9#sEv zHwWQ=^1s2>3Bivwt0206XH88d)7E(CeT~0QH@*HD9OX0k5BhcJ4ix_$i#O~GESR?c zAioGWQ2f;c#IGqJ8NdGNodd-m)*sXVLjF(uGx0YM5Wj|?Wc+tp{K+bV>hVz6|9Y{Dk;}{9Zu1r2jC#Che2*5AmB!lfn-EKU#jOEQ2Z^6|1pbD@#~+WO2&UPx(REZ qu5fE|wcWm}Jz6!k^~tn;izkUD=4|hKwfC~uJm{vphWOQQ<^CU9ehfNKmn-r>7^=rl-5pJ(EmO zq``=&sKEnJL`G48_1LV(f+Er?Dx$0L+C@bj@WLC`i}hH4?@!gYx+@QHb=UvDUOZjz z@AvsuJ#|+-^;Cu{majTL)6(r zBqws~&Po3MEAU>A_J<7@DEwWCM zhp?N0zj=06Vp86+pYu1*KEh<(O_B{gy$MN43R@;SS>du!akdlDd%vsq;gk-An3BwM z2IVawzHBlbjqb0&FEsQ^dU!|{zj%x!^4akIfit~dn3sOOmkaZJ0d}A7<-$ClpRV4^ zdhXJ_#lJ;bUoKhv;%uMZCqH+V%#tTRcdqHv&ppiPyY({P$@dnVm#CiQRF6Bj?v#Lg zv-djfq+5Q6x%vq8bx6-so#p?&{T%GVh4%A*Z6|-LT_}H(52BqNc66p|N98Mhc^}eqhRe^rSNeiezOLo!_Lpb48-I5>?c?J)WS@l&o>Wfz9Od-o zD^vYxPS*53U7P0|;p9$xziNe(JMH~gCnon^<^8|f-sk+4_CDvYwD&pw`JMKjj{nM3 zd!O@H+WVZp(%$Fn+1^#pZrnLGRnK#L``^<4h#Se29-2dPNCv=3zUD7~`Ac(-AFuAU z@#JsyiwoASa^cfIxBRRpv8Ixown(c^*OCQ;Au_0LU9${oFC2>qvX+9+=@Snz|_;Or+q)rY{6SK5HNk-%1*&@`c)tm^2&HhT) zI<9G4&-1$d_Qii2H=nPegOt1j_N_5V-VdM4{T!M62%Hm>fKR}Rs}FtvUJtk6Z^9d7 zL*{-G^za{GJugRMrw~wK6B0KYI0VeX^Ne%wiDuIWFM%({rUlDwJ`a38!6<=cW=@WF5qZo`McvRA>+H_pNfVWlSrpKaWN z*TGjREc|@<<+3?2NrsGD@R)HMel4uDX|jF`?8+Rz1Ac|V!dfFJ4Snz@;ni?!M$+>| zV}{J0ZyH|(KWhAP`1i&;W+am*(^eGr8seD+UkLAn4>KNz=Ns>Wm%_?p8$KUC3RdTS z9{fTu2XBIv{uW#{9)~Z3Rkm&TRmKzW+u*Cwvq(yAg_WKxd?&2*EQG%RzY5O5{{g=m zZoxl*TW}kG489glnCAWqR@fXonYOO<^uaS=S61+0u+lRQ9}VZ=HoU-WCg5ipKYDP| z^IYSfz-8l~9-K_Q41O(PRUtdz*MT|sI^!06GyHnR5C0SV2H8`wAA;W~d-&7FE%+=i}BkSzOFF78NSx|?eI;o>SCNr zF3Z*CdLR0u@N=Z~Bk<913%&=Q54Yh5jB`ZrZFqt7iVU|%KeX!~p??OLgXNZTiT?|| z(%*(P2#a@{&9mSM_(=2`TN2vN0$A~6VYzd-0`tfz8s5&vhHlVtG(qQ9p~v;ow3CaC zZHP(;J6T~bMNji`Zj*5qY1Hg#Cdo^UX#&Yrp7)rSlny2D_1u$<+>Nm2Ai4Kgc;)qd z7M?J1nq3Ld9F%3H&AAZo-GtGc7~Ek7_glP5qa5}cMv||gKip}O?NC< zrZ)3)uXk@$Dib+9TVejdy?IVUL2@(jQ(-+%Hb=upn9cFQ})V@+pX=1IEW?-^8>IhQAiN_TL`uKXS#u6d^X z8XT5zkHFY;>il%GQJw1zAZIdOCWH|OJJpY#_iG=Iv!2X)Lu0?(jEJ8O<9gM$k2F3T zUI43H70+344qxtEvsvcFj*ZHmGa!E6^`D-D_aQ zFa34!TKpW>n=I`4@GWpiGh%Xqe$1hFWpX<2Vv`F>{8bUJiJ0_HRvsR~UURbCPmC$PR=??m zA9$ zvKQyL*28K?Ew1p~aoAku27?gKCD`XoHvnhgESJ(5;#7XcEiQ8zt;OZ=T)!Q{<`S<; zsu7zibD-HP$P4%x!-jEwa+V6*0c-A+dks7fKgV^QaT``%+**%DbOWq8vjx8$R@)wj z-w7AtHheprgA?NafZ6C-cN*v5dyM!QEluR__yfAJK;YW-w0>8q#wth&ZTy>3;!Ul2HeJfD%U8S z?8o>3&lA(ImcVXp1)mP%dM|ZecRW^~dXeeQHJd#0b788)joG^0rytxU=vU%rCE&1e zeYS``=QRGO5V7K+JtaffC@*q#xF4V5369eA_hl<#J2q;E^Whz^%NP7=SaU#&>kaS# zew$0>=Ekue1n)8>162D5>=>!Fl8_~2d{#)R+M|8aSpB+x8Ro< zx8a?^p7h)i?BP!Zd-&VI9{vriy3G=HDm4?HwV!bg{Vd}ae7JENJ_c5OY3w``*4QVv z3|@`j;yNFu4NYDFZ-m$5%N1eOd7G;Ws~st_tuU^43qLRM+(R;5dFTc%GZVWjxkr__ zGI|X>;_r3ZK^ysX=#@6r>rJrQr0VY-@M^dPzsL9*_%EV9Z+`8ox@N|v}Ku=;t9>rCT5*j(njWau39xZWN7tT$FW-Ds>n z^CII{!g2(2W1ZF;*LYP@G8^?*bD4!otaq8$1Y$_oOazHa`@MqDB$Kfx-8jIWTe;Dgs{Cma|@GszZWAhmNXISGk z+%x$=&yT~?jsJ5}k~zruH|XaY{}w*N_;>J0#_WIfEH!?D_@52GhxpZTHo|(Y_{C-e zPih)Znw<1pZcO9rx!RbCIkVGvAM|fA?uFlBJPp3Xcsl$s<9*@J81Dyv(RhFOTgC^# zKQTTK{tc{j&LEu!(BV`*aL=K}2f-&A&m?WnFlLXhXSwkq@Fm8xu^BR+i+-!|Q{Yz{ zKNWtf@uBd0joB;gx!3q`c(?J>;O`ng9sY@N7XF>_JXjNw+QUNfB6k~C4%S*x<3=Am z4I6dK7JLva{Wv@uJ{)et^DLg-u-rd!O~A*SeKN(VllS6fjo%07;8QK^T6m>#AN(TY zI$VSGtQI_G`knBrjK|>{jd#Jf!fID-SnKxp8~-zU@dSFU?LPn~3=$tgFV4Yt!LIMX zpM9)~{%|1;c%{xq*jX2GiK;DXK3=&v>9iSQ2N z(_vg#L)eIRrRK0u0#4;c({t{f=ATXYb;j%9IBz`L&1Wx+^h5Bi*yk(^UgllK zJiIghZs^{3X*nKQX^EWEt1ZWR6Lkk=6B z_2|{E$_`>ef5mf5IO!o8QA9hFe@cEWkd3-{zVIFUHqAb&#>`B{V;}(2Y(38NGK@YDFdJ6qTK@ShZ|EhTC*LpuXL`*;3ie8+BuY~V} zb8zP!1HKl$`tdmYM&n)ZtroTo-)8y=_)g=;;LpJ?Cv3vI@NVOr-iwV}@Xw9g@E?Lb zi;U@1uEOTvxyCK{Bv@%~!>1Wfz z2p5f)!ZlcBn1f$tycT|iaUc9T<2w9ic)8LHzYA8`j>EUZUx3^2dyQMgA--3RlZ`*yV3xDWj|;W~PKNBRN$Z?L{2{Sy8XtU={>@Rz|H{1^Cja0{M>-B;i? zJOlnJtjx`YWs`&F!C!-0@X7Gk;Wm60{0&%*>H_!!U=Cgj{|DTH*TXz6X~X@-6Ywbf zAbNeEdKtVJ%)vWhl}`(PH~dYw4ex@L9&L0fZ{GuR@R#5TxCK81KMc3wU%;y0gpVG- zhaV9$;7uZ*^S~T@AUq-c(`Y}i(wT$j8TY}9;qRkw!Ka(P4POAOPAA~!!9Rf20Q=xy zf;qShE1hk4EBu&jvWy{cQG68ng_Ymj(ad%5nQ$NcFYr3J1>X%n4kyPjR+v5q{|Ee^ zsN2URy${1`1NWo<8T@N__c6(gKbn35{r=S1Z_w)l$>H$tz#M!O%wv)kd;+X;Zo`Y< z-@{=8WS)ivD$s&AA-;fpg+z)I0ooxCOr)c5MUR z313J&6Y$OOb=c^m-EHuX!5sVn_)X~7!gs-M7N1AIfECXK{1y0mg?yGI!5$tA_V8%1hhG)!r%*q^9=<);!~Y87 zdKWm){bWAg<>^yNr@4&I%>=$T5L54*NdL)5KR42UI?_KS(tjq>KQ+>SF47+w=|3Oo z59{hF9Y61p?Ig=}ANk_8dq;@h9Uk=hq=k*S%p=rY;HP!t%sf5f-57k=m(@PO7(cUL zWOH!D?$DDr%p4i%{~g^=_Y%)hk&XM9WMRLB|7&mG`)#jFNbdd*8Gjdl3gbMk_dEPN z1*Qz9svJ)6`s8eUWpN$89#h131qS0X8@%uM=qMe>Mm#Ix`4Jxz@o^FVh}fDuhjh3) z2;UX-5Y15n`(9U0Ac06=i^Hr$Cu4i=5a;xRD7l7czn9CbKH0J{tR?-tMNktA!dH- zv`*J~x4X%7x_<}}3=k&7GiLF;B8rD+yM4mz(EXQ%y%GL{@h$KlyK#y#$1CC9Wlo6r zPw3u*J#LRa_1`Eox2E;VjON*({~%#c;(h8-;`}I_vCMt~o+d{B8F)IJgFgpPf?F`d zaI!DlhQES-f7z3{Z@>r09)1Yc8lVOL)VK}*4n9!!RKTC$gTz!qhPBkeaGOf(g%>Cu zDtRV+GTega!upQWhL40#fwi`u59@rd*7m2sZf=E7hfkHwOvZnBv25Vyz&lX4;7g6$ z@Micl*|V134nITo@XO(KvWH&_FO>~**Y)r-Wdq*=pKg2`dMfEO4a37=tn6ucbXPw(A?*L%0xfSkS$x^%*7GgI_j zcs2I!T?2U?JQY93wGrM2zs2)+@jvm%{5%S~UzexC;pFF{Q91&y3TQZ8T|}w`{1v^u8qOpfl<4(Y0of+PVU#}73We|8!EDw z+t0WK&klMbmZXPqu|}fN5kJYJ_i1+@v-n9jd=~|naV>HC$9lLv*9!0 z9GA`=sQmi4LK|$sM`p>p(#f>|eu|h(odzqOTqfyRX1okuX?zZR39Njb3zv+~gGb?~ z5>JbGUJmcTrbQuM2hT&_hOdX$qHj;(dn0^|>>0!EfO83Y_#?&>@F!tCi&1;hmyIXw zlk_}nJQ;r6cnaJz&)ZLhXBqDU&x4h(UicK#PlL}go(^ANyf1vQ@qX}&jrWJgjI+!l zJK$q`NH=^fJRk0ZZ-OZTch2Gt<8kzN!zzW2TvHc;NQZ>^2QdJjRK597Ihun5k$TfVO0$ywxQqIcy9p9RlRJn*@21{+OzYBQQ2 zs=vi-5{5YMt(6ibSyvrPpy&T^DPcwcx{)c=Vu5W)D zmiq?2nMlm29h=Mi4*ntc>Fcfx_01uSPoYocFxI!|Bd~45kNbFgkBs6u$`}tz?~ab{ ztB;t={1*N*anMa%I;Sx}$j!!=*^&4e{6+Ya@GropdnM2Fz6(=;s6#@Kbz=+-ybp2)rH35)B!!g=l|^F$Q>zasua#D9$Vzaw7M<>`Ovaz_2c zTxLmEKiy@(-^lbRGsYSCtv+okhTt+k?uO0$3ck(Keg0`OnBc7xA(#Prsnc znRAWto>X2$n|UmjGyc)h1Zo?PBuT`YFyvwXKChq;8ZLD>O+;hxVkzPtzT(4jLI?k-(ehEGI z-M5`MJvuj{_;SwF+pn?s_V%m`qi0!=%vy9c;%8`d;%C8$R>Bh#!i0pv%)AhQCTYWW)98Z^3fEz?a#d@p*P~z%jm0XYnbnWFh_({B!Yf z?%UsUjE4xg&iGVr_QO*NmW4GpzYt%pivCsjIj#o$V#2lHm%vx!k8@pN+=h3+O3MV7 z?0LRR^J`$a8}OCpcbVP4;8W$vJ@`uV=kcEk?t;Gr=kVpi^Rn>Q(N~Bh2R{g3jo-)h z9n-hqkfw3?5!1KfADjII{0q}7LBEF8UbFCj!*#{ab-=NnTkv7VZTNU&Wpc$;dXB$Tdt3r7VHluJ3ej~gUZoxOf+Z4YF z4mT!y3j96jalONmad>XMrt?o#)4ktpYRDflR{rlZ-h%!su)@;hlkdX~3#&MBq|$$b z*5k=yaG8m&UFJs-|0Lo+M|_F}#&iAf$2=><7xuRl`LEDVB|TaA&u|z^HFhiQIj%`e zWa2)q1B_en9OH3#9;|Vv4V%ko59@gJxL&>2n9JM}h$Owt(oB9k+o6ALjJ_huUkhGD z+$=*U-%ot!z#;9=G0vf12P<3)e!g)V?uXqPlzT&F--frrSK_O%E{CszbMULprUkzd zeg*nA{8m`&>^3!b2Yj{c$;=1gSHdm$qp;G}hCc`JIH8ivWqyFX?{QA*eK|Y}#&c~-yhHZ5L(L|X3(1|FMSm>%u>L+Cc4<=p?=q)i z82B2C3winvyPWwMthC{|=c)`|)4i|YnMF}NVVxp1#2 z{tc1-B=o0~emvI~wQsL|Svj4<6wh#y`*F{DqdhCFUyX^LAL%oPN6*bhyidfBcGHu& zsms&f2J4#_ZXfsSe=={6Y!*cEjHB1LFr2erVfj*eE`}d;x0plVcVe3}8835kHy)SA zcW_^Mae}wY9MQGOxI-=IF>`%RbvKRckrSM5zxQxME`7hcz~8@}8`Bp0a#!0u7=EvX znFD`Td=%eJVYcOVv`EY`@cYb0|L#S}X|d090(y-t~U)dR}k548Fnm9C+OLT=;h5^Wa^^%i)h3pAUc9 z_yYKg#w*~5jrm60^SJS|;lCKKB|ZC`>eIgwo&_skeemJNE%+E%2HPaGQJJI*Z93~ z+xP=8%PsfbdpE3n$$i#13x5Tkg`ea44y=6jaXo501pn5!4rdm5n=$x6SYcaShrw6l zk8>Rh|0`)|!%NIYnOgoT z`;X$cxEe6SpF6+!Qut%&c`-7$D;h}u`;E$qr^#y+tRyi-kE*+=Rmg7>K;Ep^!)qbo}{Z;vkiUK_%ig{ zj9&u3!uX}I#&d@kD8e`M*JY$mI z^CDxC*;6uReCZiBrcd^a8na03d6{u9e6=x4tDe^zPlvBJrfc=6Oq3p8gL`fN3s9A_3Q1Kwp$i+D-I&wxKhSkmtHXhK~mnA*1HuN;@^UA%(J96`G0y2x+xW8%Rb z@D&x1L-&*UI>O`JBaf3$M5TWC4KvVqByOSC80Xgh$Qnc4+8@?li{`&9{CnbYX@d3d z8(f;;o+X|&?wE7wQ#hqfm)3%~1HLAEU|+)EQ`JfG?-q_UCNmDH48S{2Mc^gWOH`J`c55eE{yb-L|lw`EaDvz?~M4Ch(8eV z$0EKj;;%*gaKt~2SqoSzhbJPv&ISbiq-S*bz=#iz_?U>F8S#pUFN(MjaXn)FZH(|- z?GFWhNn~?P#BYlD)`&kE@jVfLF5=x0KN9f->-O;6$0L1aX;*(h#D_Vb7$J+RKJ2eyAy;rhh~qd0YDJJ@_8 z(tj>u8>3vGrRHc8}ZzT=S93Y;#|Z!yBpH^+(@spuR-4z=`~IT zz4jmjYfmZgaAbdZ#IK9^mWX#nd~d{GiujumC*|r$lFu(&w{F=b`HNOQe|diWC2N=G z^U28edMOz$jO9z!kw&@HOzOk=Vy#*&6-UaoYQD4;eKQ%YHp`o;rGadvR^8-&lH$l% zGE%Gu<77|~Y(F_xEm&}Jy;0lLC=54G99a%JMU6SE7CJ0qD^9?Z_47h>Jx5htBhFAwmXe7=9QTp1}>^Zm_jh5DjX=g%Kq zbn0<>{HD@KzBt-w5MLhS{K%&A!2IJBZHV!tvj)lyUwA}y;fD3+T)1J)d3zX8CL^_C zt-}5F=dL{?QGThL=4Q%rm~u*>igfq`jat1aXcV_rYTF7U;!>kgYvi|#mPSkN))-;? z^Tk4O$jhZ-sl2t+HRvxCH&<$#WII@EY%4Sd@`VadkfKt_k2XsVtA%(2{#Wv|(YF*q;>^y&@xg|eXDQt3? z97*M5TcbP@<)dCIZO+#QUAp|OdZ{`d&xf?DtT+!Ek$VOqrm8$wkN;TLhxJNf?qa?Ffu$ppGwYH~B!52#d z9ivUnTHbX%QXy9CYP3p~E1QD4pG)J|P@y^Gvoa7eySdb;=3TqNzFNyu^F^{VCbN#% za3ZzaP-}9Tw+u9g%7d={LJ~rgRQOJEO1@GmlwYZ#qH>9#@#c$-Qi0Aaxkzf&zB(3G`3V?WheZuPN22Z+7)YX|U9w`!%<#xm6TVM}P+Ce=ZRvtmuCoCPAUyb}E-D zAFj({q}gd;{pIRFzCPrddvj=XWT3Xq7jkoR$yNSkMT4Ts%s*jdOmXH1N`(Q+qLd%5 z4Y;B(eWO&bHAZ}=v{vlwN2?UQOO-0hCtQ`0A1I6zlrFm6XlQiBO^tfz2K}Yz8kSlu z4Qr@C4Jd>{GV~P&Tv~k>Xi}%{rXLl2YGiCBu8~9H)msxICf(!$nx~L!`J- zB6Th+MR!l*U6Wca_-8kYqi&??4pPPZU}3miQCfx7o-*RnYj%1(u7&+ee&80eI4b#$2E{iQfO z4ab+4YxY&&Y$;nJQw|s@XvjmAG9#zMYH4gFsnZF!CiPmgS?;ft@~WtjM72<^E^!%m zFq({dX=wmG*sFY&mnIAm!{y?V#e^?Xzit|#w3zAm?JgvgkI+Gjd8MXQb)zyBw~Yy~ zTOJDIimsED>S(3X+#?@dh2kw&nNl_W7wfcM6snwUR-wc$u}Y>@L28alCduuf^$z5w zWrw>io-isG^V=9xYTNR~iXU!Vs+nY5yuRnVu~7lttj>_bu&`}Q(xfd)qdSI)8>*8= zVOzedLT~{Kjp9&8O`t6u6Z$p<${;h4gc)&kscFKbn2Z$4l|=1pTY&+<&Bys6#u8#m zXnT=#qsmh>R57RM4TN+EsgIbpOdAU?!amCbAVQOLcl((%=*-R9b zEk0_-m2#DFb|fjdHEiM=mrF^tk%TcT48Bgkl@*Xn7cHhVMmX0F6ODO|ZB|FF_&d@T zPrm3}^)Qw-6K6~{8Sm*xUj+DUH=xAU2c1(W+0LOMuJVR{j*2lbRuyHmbOB z&i8fq%Rts-jp94Me!W7|XL*cj$g2ngv!vI8lT!4hsX53$M$wji$o6)_g&^&F53#o!sg#d4sNxa5;kcyHp?SPAl_;({_W0AuB zZdUG*H1_3L*VIOBWm9hY6%Gqj4Y2fkTO!q|2~ErD_8Ju!N|}A!(n+ID!g?fM9W0I{ zZvCTSX1Ksifj`77Cf|={VS3Lq7}pqN^{$}wdnu{bFi!@Z#5h^faOnm>pW#79GPm?* z3M7HW?ZryT4I#WrF)@~S1+Gsoy!lr=R$1{gEK>Y? zdBx)Wt66mI$h}Lj$ZKlxR%iU(&Va&9?$&a8-}Ns%4HmabBT1>$=u_tB2e%C{it*|d z6qQ9?-3SZJ&6J*R8H3x|dB_)(s!bZem`40dHw8P`s10}Y1EpePdwm2o_I~u!n{t^& zrdxekIcRirI8rPp3`8y&KJC<7)s3^RBQbD#HKnnw*4VtKQjOBL4nN|O<>X1>Qz4@; zpKQ zHx0Q?Un#lQGPTBmlG=V~79-)6sXssLFi(4Ti%1P1BTXh6nq{F{WL=tQzrvNfh}cVm zn$`#Gg#rWD9P{~YomT04OsITy%+8Jj`K6&~k*0>q#ty>?%N2&H;Z!3svCJ}6)kY%R zg2assZk?*Ph%$YxT3}??k00d9gS`I~nu(SxDqZ$1?fuFrOwf4 zwNcvSCvip(%$>IGy1ga`PtAI%NbfB&vAozU8f8XIx4U7(r*?BTd5xPkeWklGYH==9!O;%|(ddYV_1N~NU>Pd(+7J*3kXJJGcn1yc@` zu!Ps=gjdeaTeQYtn$VuAu>l^&25>?Hp&N`ghukttD)+-qIP@ZQQqo7t`wy@Bhut?fwQ6OR>OkL^KR4`35Tk1`ggO^6qsv(N>w#8rDQn z^1G@nn%dNg{pvy$iLj|s>nEqK#+1SS(aPp6$ymLq-37)Mm(Y@*ms|`suWMi)sBN-6 zM|N_%V$IJNdDs3a$0j>}Bej8=4I(ZFe!=8gstfDyX;`vRtK1xB9AL@P7^#vxHEDlG zV+cLIQF1Ty)S%W`TNx((%Pk{ymA6k?jow*lX2TWNaD#7MyukjHYrDe%n%kR$&AjXT zY%XcK%AA*I_D9FID5*eEWy{K~#&U`x zAEPhnhLrW8?aESqCYD^m<E0(Lcd=DbdwW?@~$S1gCLBzjgfxd8KP)x!=(FMEk3o5 z^K(Wd`5h$s8a3x8ca1+xeVu{RZ!Gz7j;A!3UEEluCP8+?5TZ9CB8W6Rj^T4}x@6tP z{EB63&Rey7UH;q)*Icw=_44y#-Lf?ou3xcyU94KZaoM@+W5wEK7hU9r1f|yv3)Kb_ zfcB6^8m=uj*@xl1i(kLVXXA&)^_qXRaUF@*4K+YF`zCzSpe?RhzJA^E3-TM*tX#8l z{mNyl_?CBGP;z7CMeCQZ>uNTv3A&YQE(m5_W!G@s@>R>1UDTD&+pv1|CCR$=YgXk~ ztz7e*eEhV%XcfCHacunX-a1Qs5!P>inXDVTUmEBq$MxGZ-nOvk)=R8p6Nbg%Q9mqu=FV_!tHwC@YNan2Ol*G4)4LXm@O)PByl3#@?Y=uS zw^#XO#p;aJpnI)QU9kI>xYfvJ|LtfX+04@4La2IJNix8PI9NHlslg2BxcO1{O=C#JxdfK>xDkvPK{Yav2fsO+X!o>{)S6pt=S@|l4HE{d5yoR}iQ2M2ea}_BAEcW^ zRbfP@_<4;VWwVhgaSIUT)1^dBs^Y#vxO64wt;(ObTx~ah9&MODZwkI#pQ8qEqQ9AU zA9{ms!x}8klaZ1^t8){DYlAj7s93iZHkU^0NkJ)KXMh(7-b~2A00G>@!Lbb-CX-^d$f!U>F#C}12m~Ep*WjoJjr_R46>kE#1*|!d4Zz!hKXGcqy_h`N& ze1F{DEV7-UJqUerXPnaaB|6L~!;?l+`s8q7yMIkL*-~Ol9=A0XcJG*ZdDZXkJG)1^ z1#nYaQ1)IhRAzV0vo%?2r%r0hyhzv_UG&=^?4t3e-1!9TtCnI5X|q+3zQP6-YXY}b zRT$OosNbzA>XGzr<+GbfSI~t)zf&mlP**-rk;c7X`azufsrj+TvS3L}!gJNgXmUYx z^I;OjMP4h~Az~rxmNQ{9N)Jsswd{8;3q@B7xqdDxopGw3)4ED z$hshD5V6&wtXTyxOjtk+)cvKm&`hq8q?_7z)%ehv2P9}y(e~iI$gft7-C>+TY2~@g z$;RpnpSSFsRm;iDdLFWN?S<>s^N=Uq-mvC5Yc9NaO}KIX%8h%ma%+=vzfLmv)jRdF zm6fID4UkWW9Z{>8W+IKJQEgt6Zb>eN&OI+l?_N5zy~3o(7`=%Rof*u1!cK-YQEHbf z&U;!OwN)Vd4k^R5!VCw?q8dJ|ekxHOO?1&du_JdH)f8NFQYft)C9sfH>&) z1hge!ldnVU{3L|E#$^s875HH#qGdSL`L3_`ERD!+iXY6E^w^Mnp4_iBvFr^-IgF#} zY>*e$;;5V9ox-mKTpor=<^U6CV>{oa@-EdEuUol(Icv1@tr;v|pX{Mx-4)3ft)Pv> z3Rbr(H>{2|t1hHvMnRTuWWh;eAGBJouxN-Y%H%<9-dN|;(F}JyN{7pIwxgsUZ5Xjb zy>{h!?(7+Uhu2>a32S5FqUgrzWg8P$kIZG{?N&^XQ&hr|2tFqtPsF z;R##W{i2hG=n;K9fR-tE?z{lL!b)!RYoD1}XGEI~n@A7J;bHx{4@-LSmSA7|^|6ah zFr|4b>s>aQS(XP;cG?k8*iE!J7fwA|inw3th#q5OVW6NMBceR9G%3c0tqJ11T&`HGU{M^U=(*#Da- zT>zb{ygXZ~G)q~X+T7ctpOmd7Az!B~R*jH~C>cIy<-b2?@j;^nIsh}epmWIO1?5XE zzo#sE@}qo?|96jaVfOx*Y4PD#dKg2OJ3Fgk!yjzbCe+r&OkwWqF2`}l$|EP2>xA|8pOXtpA}-7{&8{?|I#fm+Q~-iyKnEm_8ZTm$k)U z9JR$Iody@$qK@#56#hnA>;(G<+oBr?run%sOY)Yu^Rn6FN1N8-G~}|&+_}a0q5;R9 z48UE zZKqV+Hjmzhb;Njy`*6|`_z2{WAA~)0)-s*_bY4k$S6BJwD;zKCO8VsN7P|Tfpv8Mq zFE;gcrCw}!FM2$4OLzt+iYt8QVZ+2f)P2FIZFgUnIIp2I?~Xg$8(I~x)^hKZNjUk= zo=>^RUWl^pbIt3BO2I4K*DXG(jf`;mVYs=;7AyXy`vBsQwWjmgdUBsUc|{NBtJodT zS0ER|u#c$DS5)^giDdGgz*jgvRu$Px)K?iD&eTB`&MH>;_@_M9?c4whBo?3O*imqA z)9$2-JI$$dYSpRz7{(P|r(DeW#$a*r(xr?2{zs<=YKB(2m>qaNhXV9bo?QAf5j>y+ zF8@k}-bBh9Ln8VoQzh=9`hpA zPctbOhbgCls+aga=$|Lq1`$`N5s^Koj@~l0)?gBVjbjajHz4F zm?=*y!g9Urk1!Jm3O(ArLy|eVSP0nZE$iK?iesm26><7C zS+0NcL^f>Zwyj@nP%P-@b#DPLew>^z<1m=`e@o!ENwy9)hjkp9H%&T%-Y0cn!fm!T z-B%g^foE8+h5Bb({)H`A1f_e~H3Qqna+@&PeetKcTsQFV#C+HBDbUL;-2VDF4?o#WkZ=F>Rtc7!<@%gESZ98h6P#^85N&5XV-P6Z^O3R;T(JaT;{*Xj>ytMOgR+4RX zzNffn_>40;_<3IkGV;%Lv#5PVE@F?VYYj56?5|b;8~9 zvz{dD{#mL2+h2>}xACuKcXR1)H0hr{_jB1lQ`g@MNFG0-E8oVA%NKOzJCOBn+!cmD zwcy++zpvq%@-BZ*@?Bi}@A7{WK=L%gP5rR{y8x08MLzESBv}hf?n9nEfp4<@F54kr z_y3RVU_TT4y4_d!8OUQMZ{}}hE%~|s`v9_+JPY}n=>AOPohE;n`$s*-|NADAXCjZA z{3!Ql|B3%sL?ll|-eq!@KXh?ArKWu9d6MTMwHn+&^J%kNev|L4FD{|8?%qL0A~cvR@j>vd=}b>{mpx z?DcmN;`ld4vh4dJS@uJbtoZAZEc=}%575R=II73}zlRjR9S1|AfgT**pF&hSJ|A{h1u)Z*u4l>PvIY zRCfEFNI&6^#rDFIpM^YofO?GNsmKbW`!Cl0G2e%SJQaDq-M^0e`%|bJO@0J<>YJz+ zlYfJJ9ECU($up7bkvs!=%;aaDL_gvWM71J$7Vg?II|KGP{@S5F%=opN^dRLOM8S@KNeP|lKPAm3>5yLuYSbjn%sEaXtm zl4l}^a(4B^AM&}&!b_fse80)3k>2C4&2+{m$#an(jPB1yek_t@|3oCqKC%9x@UriX zWZBP%WZBP+WZ7pUS@!cIS@sJfS@vs9ev{IFVvhu zro3&u3GG?!x1Vb|*BICSTm|MbIkhFp|77yG$&Z+BlKZvTnvGt}+ha+CCzmQwCVPM+lEnD~~~R{G0Ks-M{T z|L@WyH)qBA-#CHzX*+2*DVdU1+5bmritFp?o0I&XGulJ_JtwiiOvV2T(@(hcc7yPD zF_W25e&<`bSE4`2wPbHQ!-A+i%#6~hb|+Wnni-{s;oG^7@OzMJ0bbVMVv@U;>mdCV zLvy|6hvz8T{kZ0vKFBLl@{KFKLh&l>u1Hq+`y=^4WQKC*WUn}%)-MY7V= z7s;}(r{q>j-kFleQ}V8q+)l~6Q}RSgek>)sOrQ(-nW02RayBI|Ov$;FtbP-R?@P(` zl-x?mJ5%y_O5T-{+bMZ>N}fo`kEP_$&O7 zcuL-tlG`bHcS@c}$&aPv&~-z8XV}mc)|J<08Z%@g0 zrR4il@`EY)(Ukl|O72xgaq{&1xhZ*mN?w|hSES^PDS0R*kEP^mQu2){`Sz52S4zG= zB|n&wA5Fjd3Q>lNXd_-zc3|NQu0ev^0g^>=Bz_zADk@UpK^>O3phEv;GFg6F9^ck{_Gq!|HF|3 zMGk|8|Fc+3?r#qAw~7Diw~L>3a&N9r-F4zOdL|I#|G` z5RM=w3!2-9op0GmR-JRssrhHfTj;%0^Gm#B-f5Cf$uIUw{sQqo?mkNtHnr^$*+<^# z#TmBl2{%)s>kHD^a1qRsT!;1qwWrw4Mfjh>hxdXI#+qpmlUb0OO0J{vFyk%eo1Q-h z>+%`G&oKQO{JlMY$ksdIJ;Ti1To+jWv$^*6{On$yuPG({e6|So`uwoonPKU`%()Og z$a>A*+w&Lh<@p-YLimvXJJBis={6A0x7_YH*~ac22zv{Ejm@9oIU!7VevtM5DUmMy z{2MKN+CD9Ri?Hc5Dee&dylW(NUAq1KJGb^$emN_@g%(upNAGpv`5|9=lib_$A9}41 z_%=lzx%Bf@CwqH--JYMb@Ou6MTwX6LYp> TH~1jh+me%~yoTqi-^%?za1Iy8 diff --git a/firewall/interception/ebpf/connection_listener/packet.go b/firewall/interception/ebpf/connection_listener/packet.go deleted file mode 100644 index 19895646..00000000 --- a/firewall/interception/ebpf/connection_listener/packet.go +++ /dev/null @@ -1,57 +0,0 @@ -//go:build linux - -package ebpf - -import ( - "fmt" - - pmpacket "github.com/safing/portmaster/network/packet" -) - -// packet implements the packet.Packet interface. -type infoPacket struct { - pmpacket.Base -} - -// InfoOnly returns whether the packet is informational only and does not -// represent an actual packet. -func (pkt *infoPacket) InfoOnly() bool { - return true -} - -// LoadPacketData does nothing on Linux, as data is always fully parsed. -func (pkt *infoPacket) LoadPacketData() error { - return fmt.Errorf("can't load data in info only packet") -} - -func (pkt *infoPacket) Accept() error { - return nil -} - -func (pkt *infoPacket) Block() error { - return nil -} - -func (pkt *infoPacket) Drop() error { - return nil -} - -func (pkt *infoPacket) PermanentAccept() error { - return pkt.Accept() -} - -func (pkt *infoPacket) PermanentBlock() error { - return pkt.Block() -} - -func (pkt *infoPacket) PermanentDrop() error { - return nil -} - -func (pkt *infoPacket) RerouteToNameserver() error { - return nil -} - -func (pkt *infoPacket) RerouteToTunnel() error { - return nil -} diff --git a/firewall/interception/ebpf/connection_listener/worker.go b/firewall/interception/ebpf/connection_listener/worker.go index c02d948f..d8aced12 100644 --- a/firewall/interception/ebpf/connection_listener/worker.go +++ b/firewall/interception/ebpf/connection_listener/worker.go @@ -2,131 +2,124 @@ package ebpf import ( "bytes" + "context" "encoding/binary" "errors" + "fmt" "net" + "sync/atomic" "github.com/cilium/ebpf/link" "github.com/cilium/ebpf/ringbuf" "github.com/cilium/ebpf/rlimit" + "github.com/safing/portbase/log" "github.com/safing/portmaster/network/packet" ) //go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang -cflags "-O2 -g -Wall -Werror" -type Event bpf ../programs/monitor.c -var stopper chan struct{} +var ebpfLoadingFailed atomic.Uint32 -// StartEBPFWorker starts the ebpf worker. -func StartEBPFWorker(ch chan packet.Packet) { - stopper = make(chan struct{}) +// ConnectionListenerWorker listens to new connections using ebpf. +func ConnectionListenerWorker(ctx context.Context, packets chan packet.Packet) error { + // Allow the current process to lock memory for eBPF resources. + if err := rlimit.RemoveMemlock(); err != nil { + return fmt.Errorf("ebpf: failed to remove ebpf memlock: %w", err) + } + + // Load pre-compiled programs and maps into the kernel. + objs := bpfObjects{} + if err := loadBpfObjects(&objs, nil); err != nil { + if ebpfLoadingFailed.Add(1) >= 5 { + log.Warningf("ebpf: failed to load ebpf object 5 times, giving up with error %s", err) + return nil + } + return fmt.Errorf("ebpf: failed to load ebpf object: %w", err) + } + defer objs.Close() //nolint:errcheck + + // Create a link to the tcp_connect program. + linkTCPConnect, err := link.AttachTracing(link.TracingOptions{ + Program: objs.bpfPrograms.TcpConnect, + }) + if err != nil { + return fmt.Errorf("ebpf: failed to attach to tcp_v4_connect: %w", err) + } + defer linkTCPConnect.Close() //nolint:errcheck + + // Create a link to the udp_v4_connect program. + linkUDPV4, err := link.AttachTracing(link.TracingOptions{ + Program: objs.bpfPrograms.UdpV4Connect, + }) + if err != nil { + return fmt.Errorf("ebpf: failed to attach to udp_v4_connect: %w", err) + } + defer linkUDPV4.Close() //nolint:errcheck + + // Create a link to the udp_v6_connect program. + linkUDPV6, err := link.AttachTracing(link.TracingOptions{ + Program: objs.bpfPrograms.UdpV6Connect, + }) + if err != nil { + return fmt.Errorf("ebpf: failed to attach to udp_v6_connect: %w", err) + } + defer linkUDPV6.Close() //nolint:errcheck + + // Create new reader to read events. + rd, err := ringbuf.NewReader(objs.bpfMaps.PmConnectionEvents) + if err != nil { + return fmt.Errorf("ebpf: failed to open ring buffer: %w", err) + } + defer rd.Close() //nolint:errcheck + + // Start watcher to close the reader when the context is canceled. + // TODO: Can we put this into a worker? go func() { - // Allow the current process to lock memory for eBPF resources. - if err := rlimit.RemoveMemlock(); err != nil { - log.Errorf("ebpf: failed to remove ebpf memlock: %s", err) - return - } - - // Load pre-compiled programs and maps into the kernel. - objs := bpfObjects{} - if err := loadBpfObjects(&objs, nil); err != nil { - log.Errorf("ebpf: failed to load ebpf object: %s", err) - return - } - defer objs.Close() //nolint:errcheck - - // Create a link to the tcp_connect program. - linkTCPConnect, err := link.AttachTracing(link.TracingOptions{ - Program: objs.bpfPrograms.TcpConnect, - }) - if err != nil { - log.Errorf("ebpf: failed to attach to tcp_v4_connect: %s ", err) - return - } - defer linkTCPConnect.Close() //nolint:errcheck - - // Create a link to the udp_v4_connect program. - linkUDPV4, err := link.AttachTracing(link.TracingOptions{ - Program: objs.bpfPrograms.UdpV4Connect, - }) - if err != nil { - log.Errorf("ebpf: failed to attach to udp_v4_connect: %s ", err) - return - } - defer linkUDPV4.Close() //nolint:errcheck - - // Create a link to the udp_v6_connect program. - linkUDPV6, err := link.AttachTracing(link.TracingOptions{ - Program: objs.bpfPrograms.UdpV6Connect, - }) - if err != nil { - log.Errorf("ebpf: failed to attach to udp_v6_connect: %s ", err) - return - } - defer linkUDPV6.Close() //nolint:errcheck - - rd, err := ringbuf.NewReader(objs.bpfMaps.PmConnectionEvents) - if err != nil { - log.Errorf("ebpf: failed to open ring buffer: %s", err) - return - } - defer rd.Close() - - go func() { - <-stopper - - if err := rd.Close(); err != nil { - log.Errorf("ebpf: failed closing ringbuf reader: %s", err) - } - }() - - for { - // Read next event - record, err := rd.Read() - if err != nil { - if errors.Is(err, ringbuf.ErrClosed) { - // Normal return - return - } - log.Errorf("ebpf: failed to read from ring buffer: %s", err) - continue - } - - var event bpfEvent - // Parse the ringbuf event entry into a bpfEvent structure. - if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.BigEndian, &event); err != nil { - log.Errorf("ebpf: failed to parse ringbuf event: %s", err) - continue - } - - info := packet.Info{ - Inbound: event.Direction == 1, - InTunnel: false, - Version: packet.IPVersion(event.IpVersion), - Protocol: packet.IPProtocol(event.Protocol), - SrcPort: event.Sport, - DstPort: event.Dport, - Src: convertArrayToIPv4(event.Saddr, packet.IPVersion(event.IpVersion)), - Dst: convertArrayToIPv4(event.Daddr, packet.IPVersion(event.IpVersion)), - PID: int(event.Pid), - } - if isEventValid(event) { - log.Debugf("ebpf: PID: %d conn: %s:%d -> %s:%d %s %s", info.PID, info.LocalIP(), info.LocalPort(), info.RemoteIP(), info.RemotePort(), info.Version.String(), info.Protocol.String()) - - p := &infoPacket{} - p.SetPacketInfo(info) - ch <- p - } else { - log.Debugf("ebpf: invalid event PID: %d conn: %s:%d -> %s:%d %s %s", info.PID, info.LocalIP(), info.LocalPort(), info.RemoteIP(), info.RemotePort(), info.Version.String(), info.Protocol.String()) - } + <-ctx.Done() + if err := rd.Close(); err != nil { + log.Errorf("ebpf: failed closing ringbuf reader: %s", err) } }() -} -// StopEBPFWorker stops the ebpf worker. -func StopEBPFWorker() { - close(stopper) + for { + // Read next event + record, err := rd.Read() + if err != nil { + if errors.Is(err, ringbuf.ErrClosed) { + // Normal return + return nil + } + log.Errorf("ebpf: failed to read from ring buffer: %s", err) + continue + } + + var event bpfEvent + // Parse the ringbuf event entry into a bpfEvent structure. + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.BigEndian, &event); err != nil { + log.Errorf("ebpf: failed to parse ringbuf event: %s", err) + continue + } + + pkt := packet.NewInfoPacket(packet.Info{ + Inbound: event.Direction == 1, + InTunnel: false, + Version: packet.IPVersion(event.IpVersion), + Protocol: packet.IPProtocol(event.Protocol), + SrcPort: event.Sport, + DstPort: event.Dport, + Src: convertArrayToIPv4(event.Saddr, packet.IPVersion(event.IpVersion)), + Dst: convertArrayToIPv4(event.Daddr, packet.IPVersion(event.IpVersion)), + PID: int(event.Pid), + }) + if isEventValid(event) { + log.Debugf("ebpf: received valid connect event: PID: %d Conn: %s", pkt.Info().PID, pkt) + packets <- pkt + } else { + log.Warningf("ebpf: received invalid connect event: PID: %d Conn: %s", pkt.Info().PID, pkt) + } + } } // isEventValid checks whether the given bpfEvent is valid or not. @@ -166,11 +159,11 @@ func convertArrayToIPv4(input [4]uint32, ipVersion packet.IPVersion) net.IP { addressBuf := make([]byte, 4) binary.LittleEndian.PutUint32(addressBuf, input[0]) return net.IP(addressBuf) - } else { - addressBuf := make([]byte, 16) - for i := 0; i < 4; i++ { - binary.LittleEndian.PutUint32(addressBuf[i*4:i*4+4], input[i]) - } - return net.IP(addressBuf) } + + addressBuf := make([]byte, 16) + for i := 0; i < 4; i++ { + binary.LittleEndian.PutUint32(addressBuf[i*4:i*4+4], input[i]) + } + return net.IP(addressBuf) } diff --git a/firewall/interception/ebpf/programs/bpf/bpf_tracing.h b/firewall/interception/ebpf/programs/bpf/bpf_tracing.h index 6fb3d0f9..b0ea3c18 100644 --- a/firewall/interception/ebpf/programs/bpf/bpf_tracing.h +++ b/firewall/interception/ebpf/programs/bpf/bpf_tracing.h @@ -2,7 +2,8 @@ #ifndef __BPF_TRACING_H__ #define __BPF_TRACING_H__ -#include +// #include +#include "bpf_helpers.h" /* Scan the ARCH passed in from ARCH env variable (see Makefile) */ #if defined(__TARGET_ARCH_x86)