Vendor import of BIND 9.4.3vendor/bind9/9.4.3

190 files changed, 17679 insertions, 8046 deletions

diff --git a/CHANGES b/CHANGES
index a8d3857a8c96..65980ea4aa4b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,14 +1,158 @@
-	--- 9.4.2-P2 released ---
-
-2406.   [bug]           Some operating systems have FD_SETSIZE set to a
-			low value by default, which can cause resource
-			exhaustion when many simultaneous connections are
-			open.  Linux in particular makes it difficult to
-			increase this value.  To use more sockets with
-			select(), set ISC_SOCKET_FDSETSIZE.  Example:
-			STD_CDEFINES="-DISC_SOCKET_FDSETSIZE=4096" ./configure
-			(This should not be necessary in most cases, and
-			never for an authoritative-only server.) [RT #18328]
+
+	--- 9.4.3 released ---
+
+2490.	[port]		aix: work around a kernel bug where IPV6_RECVPKTINFO
+			is cleared when IPV6_V6ONLY is set. [RT #18785]
+
+2489.	[port]		solaris: Workaround Solaris's kernel bug about
+			/dev/poll:
+			http://bugs.opensolaris.org/view_bug.do?bug_id=6724237
+			Define ISC_SOCKET_USE_POLLWATCH at build time to enable
+			this workaround. [RT #18870]
+
+	--- 9.4.3rc1 released ---
+
+2473.	[port]		linux: raise the limit on open files to the possible
+			maximum value before spawning threads; 'files'
+		        specified in named.conf doesn't seem to work with
+			threads as expected. [RT #18784]
+
+2472.	[port]		linux: check the number of available cpu's before
+			calling chroot as it depends on "/proc". [RT #16923]
+
+2471.	[bug]		named-checkzone was not reporting missing manditory
+			glue when sibling checks were disabled. [RT #18768]
+
+2469.	[port]		solaris: Work around Solaris's select() limitations.
+			[RT #18769]
+
+2468.	[bug]		Resolver could try unreachable servers multiple times.
+			[RT #18739]
+
+2467.	[bug]		Failure of fcntl(F_DUPFD) wasn't logged. [RT #18740]
+
+2466.	[doc]		ARM: explain max-cache-ttl 0 SERVFAIL issue.
+			[RT #18302]
+
+2465.	[bug]		Adb's handling of lame addresses was different
+			for IPv4 and IPv6. [RT #18738]
+
+2463.   [port]          linux: POSIX doesn't include the IPv6 Advanced Socket
+			API and glibc hides parts of the IPv6 Advanced Socket
+			API as a result.  This is stupid as it breaks how the
+			two halves (Basic and Advanced) of the IPv6 Socket API				were designed to be used but we have to live with it.
+			Define _GNU_SOURCE to pull in the IPv6 Advanced Socket
+			API. [RT #18388]
+
+2462.	[doc]		Document -m (enable memory usage debugging)
+			option for dig. [RT #18757]
+
+2461.	[port]		sunos: Change #2363 was not complete. [RT #17513]
+
+2458.	[doc]		ARM: update and correction for max-cache-size.
+			[RT #18294]
+
+2455.	[bug]		Stop metadata being transfered via axfr/ixfr.
+			[RT #18639]
+
+2453.	[bug]		Remove NULL pointer dereference in dns_journal_print().
+			[RT #18316]
+
+2449.	[bug]		libbind: Out of bounds reference in dns_ho.c:addrsort.
+			[RT #18044]
+
+2445.	[doc]		ARM out-of-date on empty reverse zones (list includes
+			RFC1918 address, but these are not yet compiled in).
+			[RT #18578]
+
+2444.	[port]		Linux, FreeBSD, AIX: Turn off path mtu discovery
+			(clear DF) for UDP responses and requests.
+
+	--- 9.4.3b3 released ---
+
+2443.	[bug]		win32: UDP connect() would not generate an event,
+			and so connected UDP sockets would never clean up.
+			Fix this by doing an immediate WSAConnect() rather
+			than an io completion port type for UDP.
+
+2438.	[bug]		Timeouts could be logged incorrectly under win32.
+			[RT #18617]
+
+2437.	[bug]		Sockets could be closed too early, leading to
+			inconsistent states in the socket module. [RT #18298]
+
+2436.	[security]	win32: UDP client handler can be shutdown. [RT #18576]
+
+2433.	[tuning]	Set initial timeout to 800ms.
+
+2432.	[bug]		More Windows socket handling improvements.  Stop
+			using I/O events and use IO Completion Ports
+			throughout.  Rewrite the receive path logic to make
+			it easier to support multiple simultaneous
+			requestrs in the future.  Add stricter consistency
+			checking as a compile-time option (define
+			ISC_SOCKET_CONSISTENCY_CHECKS; defaults to off).
+
+2430.	[bug]		win32: isc_interval_set() could round down to
+			zero if the input was less than NS_INTERVAL
+			nanoseconds.  Round up instead. [RT #18549]
+
+2429.	[doc]		nsupdate should be in section 1 of the man pages.
+			[RT #18283]
+
+2426.	[bug]		libbind: inet_net_pton() can sometimes return the
+			wrong value if excessively large netmasks are
+			supplied. [RT #18512]
+
+2425.	[bug]		named didn't detect unavailable query source addresses
+			at load time. [RT #18536]
+
+2424.	[port]		configure now probes for a working epoll
+			implementation.  Allow the use of kqueue,
+			epoll and /dev/poll to be selected at compile
+			time. [RT #18277]
+			
+2422.	[bug]		Handle the special return value of a empty node as
+			if it was a NXRRSET in the validator. [RT #18447]
+
+2421.	[func]		Add new command line option '-S' for named to specify
+			the max number of sockets. [RT #18493]
+			Use caution: this option may not work for some
+			operating systems without rebuilding named.
+
+2420.	[bug]		Windows socket handling cleanup.  Let the io
+			completion event send out cancelled read/write
+			done events, which keeps us from writing to memeory
+			we no longer have ownership of.  Add debugging
+			socket_log() function.  Rework TCP socket handling
+			to not leak sockets.
+
+2417.	[bug]		Connecting UDP sockets for outgoing queries could
+			unexpectedly fail with an 'address already in use'
+			error. [RT #18411]
+
+2416.	[func]		Log file descriptors that cause exceeding the
+			internal maximum. [RT #18460]
+
+2414.	[bug]		A masterdump context held the database lock too long,
+			causing various troubles such as dead lock and
+			recursive lock acquisition. [RT #18311, #18456]
+
+2413.	[bug]		Fixed an unreachable code path in socket.c. [RT #18442]
+
+2412.	[bug]		win32: address a resourse leak. [RT #18374]
+
+2411.	[bug]		Allow using a larger number of sockets than FD_SETSIZE
+			for select().  To enable this, set ISC_SOCKET_MAXSOCKETS
+			at compilation time.  [RT #18433]
+
+2410.	[bug]		Correctly delete m_versionInfo. [RT #18432]
+
+2408.	[bug]		A duplicate TCP dispatch event could be sent, which
+			could then trigger an assertion failure in
+			resquery_response().  [RT #18275]
+
+2407.	[port]		hpux: test for sys/dyntune.h. [RT #18421]
 
 2404.	[port]		hpux: files unlimited support.
 
@@ -39,15 +183,271 @@
 2392.	[bug]		remove 'grep -q' from acl test script, some platforms
 			don't support it. [RT #18253]
 
+2391	[port]		hpux: cover additional recvmsg() error codes.
+			[RT #18301]
+
+2390	[bug]		dispatch.c could make a false warning on 'odd socket'.
+			[RT #18301].
+
+2389	[bug]		Move the "working directory writable" check to after
+			the ns_os_changeuser() call. [RT #18326]
+
+2386.	[func]		Add warning about too small 'open files' limit.
+			[RT #18269]
+
+	--- 9.4.3b2 released ---
+
+2385.	[bug]		A condition variable in socket.c could leak in
+			rare error handling [RT #17968].
+
+2384.	[security]	Additional support for query port randomization (change
+			#2375) including performance improvement and port range
+			specification.  [RT #17949, #18098]
+
+2383.	[bug]		named could double queries when they resulted in
+			SERVFAIL due to overkilling EDNS0 failure detection.
+			[RT #18182]
+
+2382.	[doc]		Add descriptions of IPSECKEY, SPF and SSHFP to ARM.
+
+2381.	[port]		dlz/mysql: support multiple install layouts for
+			mysql.  <prefix>/include/{,mysql/}mysql.h and
+			<prefix>/lib/{,mysql/}. [RT #18152]
+
+2380.	[bug]		dns_view_find() was not returning NXDOMAIN/NXRRSET
+			proofs which, in turn, caused validation failures
+			for insecure zones immediately below a secure zone
+			the server was authoritative for. [RT #18112] 
+
+2379.	[contrib]	queryperf/gen-data-queryperf.py: removed redundant
+			TLDs and supported RRs with TTLs [RT #17972]
+
+2377.	[bug]		Address race condition in dnssec-signzone. [RT #18142]
+
+2376.	[bug]		Change #2144 was not complete.
+
+2375.	[security]	Fully randomize UDP query ports to improve
+			forgery resilience. [RT #17949]
+
+2372.	[bug]		fixed incorrect TAG_HMACSHA256_BITS value [RT #18047]
+
+2369.	[bug]		libbind: Array bounds overrun on read in bitncmp().
+			[RT #18054]
+
+2364.	[bug]		named could trigger a assertion when serving a
+			malformed signed zone. [RT #17828]
+
+2363.	[port]		sunos: pre-set "lt_cv_sys_max_cmd_len=4096;".
+			[RT #17513]
+
+2361.	[bug]		"recursion" statistics counter could be counted
+			multiple times for a single query.  [RT #17990]
+
+	--- 9.4.3b1 released ---
+
+2358.	[doc]		Update host's default query description. [RT #17934]
+
+2356.	[bug]		Built in mutex profiler was not scalable enough.
+			[RT #17436]
+
+2353.	[func]		libbind: nsid support. [RT #17091]
+
+2350.	[port]		win32: IPv6 support. [RT #17797]
+
+2347.	[bug]		Delete now traverses the RB tree in the canonical
+			order. [RT #17451]
+
+2345.	[bug]		named-checkconf failed to detect when forwarders
+			were set at both the options/view level and in
+			a root zone. [RT #17671]
+
+2344.	[bug]		Improve "logging{ file ...; };" documentation.
+			[RT #17888]
+
+2343.	[bug]		(Seemingly) duplicate IPv6 entries could be
+			created in ADB. [RT #17837]
+
+2341.	[bug]		libbind: add missing -I../include for off source
+			tree builds. [RT #17606]
+
+2340.	[port]		openbsd: interface configuration. [RT #17700]
+
+2339.	[port]		tru64: support for libbind. [RT #17589]
+
+2338.	[bug]		check_ds() could be called with a non DS rdataset.
+			[RT #17598]
+
+2337.	[bug]		BUILD_LDFLAGS was not being correctly set.  [RT #17614]
+
+2335.	[port]		sunos:  libbind and *printf() support for long long.
+			[RT #17513]
+
+2334.	[bug]		Bad REQUIRES in fromstruct_in_naptr(),  off by one
+			bug in fromstruct_txt(). [RT #17609]
+
+2333.	[bug]		Fix off by one error in isc_time_nowplusinterval().
+			[RT #17608]
+
+2332.	[contrib]	query-loc-0.4.0. [RT #17602]
+
+2331.	[bug]		Failure to regenerate any signatures was not being
+			reported nor being past back to the UPDATE client.
+			[RT #17570]
+
+2330.	[bug]		Remove potential race condition when handling
+			over memory events. [RT #17572]
+
+			WARNING: API CHANGE: over memory callback
+			function now needs to call isc_mem_waterack().
+			See <isc/mem.h> for details.
+
+2329.	[bug]		Clearer help text for dig's '-x' and '-i' options.
+
+2328.	[maint]		Add AAAA addresses for A.ROOT-SERVERS.NET,
+			F.ROOT-SERVERS.NET, H.ROOT-SERVERS.NET,
+			J.ROOT-SERVERS.NET, K.ROOT-SERVERS.NET and
+			M.ROOT-SERVERS.NET.
+
+2326.	[bug]		It was possible to trigger a INSIST in the acache
+			processing.
+
+2325.	[port]		Linux: use capset() function if available. [RT #17557]
+
+2323.	[port]		tru64: namespace clash. [RT #17547]
+
 2322.	[port]		MacOS: work around the limitation of setrlimit()
 			for RLIMIT_NOFILE. [RT #17526]
 
-	--- 9.4.2-P1 released ---
+2319.	[bug]		Silence Coverity warnings in
+			lib/dns/rdata/in_1/apl_42.c. [RT #17469]
 
-2375.   [security]      Fully randomize UDP query ports to improve
-			forgery resilience. [RT #17949]
+2318.	[port]		sunos fixes for libbind.  [RT #17514]
+
+2314.	[bug]		Uninitialized memory use on error path in
+			bin/named/lwdnoop.c.  [RT #17476]
+
+2313.	[cleanup]	Silence Coverity warnings. Handle private stacks.
+			[RT #17447] [RT #17478]
+
+2312.	[cleanup]	Silence Coverity warning in lib/isc/unix/socket.c.
+			[RT #17458]
+
+2311.	[func]		Update ACL regression test. [RT #17462]
+
+2310.	[bug]		dig, host, nslookup: flush stdout before emitting
+			debug/fatal messages.  [RT #17501]
+
+2308.	[cleanup]	Silence Coverity warning in bin/named/controlconf.c.
+			[RT #17495]
+
+2307.	[bug]		Remove infinite loop from lib/dns/sdb.c. [RT #17496]
+
+2306.	[bug]		Remove potential race from lib/dns/resolver.c.
+			[RT #17470]
+
+2305.	[security]	inet_network() buffer overflow. CVE-2008-0122.
+
+2304.	[bug]		Check returns from all dns_rdata_tostruct() calls.
+			[RT #17460]
+
+2303.	[bug]		Remove unnecessary code from bin/named/lwdgnba.c.
+			[RT #17471]
+
+2302.	[bug]		Fix memset() calls in lib/tests/t_api.c. [RT #17472]
+
+2301.	[bug]		Remove resource leak and fix error messages in
+			bin/tests/system/lwresd/lwtest.c. [RT #17474]
+
+2300.	[bug]		Fixed failure to close open file in
+			bin/tests/names/t_names.c. [RT #17473]
+
+2299.	[bug]		Remove unnecessary NULL check in
+			bin/nsupdate/nsupdate.c. [RT #17475]
+
+2298.	[bug]		isc_mutex_lock() failure not caught in
+			bin/tests/timers/t_timers.c. [RT #17468]
+
+2297.	[bug]		isc_entropy_createfilesource() failure not caught in
+			bin/tests/dst/t_dst.c. [RT #17467]
+
+2296.	[port]		Allow docbook stylesheet location to be specified to
+			configure. [RT #17457]
+
+2295.	[bug]		Silence static overrun error in bin/named/lwaddr.c.
+			[RT #17459]
+
+2293.	[func]		Add ACL regression test. [RT #17375]
+
+2292.	[bug]		Log if the working directory is not writable.
+			[RT #17312]
+
+2291.	[bug]		PR_SET_DUMPABLE may be set too late.  Also report
+			failure to set PR_SET_DUMPABLE. [RT #17312]
+
+2290.	[bug]		Let AD in the query signal that the client wants AD
+			set in the response. [RT #17301]
+
+2288.	[port]		win32: mark service as running when we have finished
+			loading.  [RT #17441]
+
+2287.	[bug]		Use 'volatile' if the compiler supports it. [RT #17413]
+
+2284.	[bug]		Memory leak in UPDATE prerequisite processing.
+			[RT #17377]
+
+2283.	[bug]		TSIG keys were not attaching to the memory
+			context.  TSIG keys should use the rings
+			memory context rather than the clients memory
+			context. [RT #17377]
+
+2279.	[bug]		Use setsockopt(SO_NOSIGPIPE), when available,
+			to protect applications from receiving spurious
+			SIGPIPE signals when using the resolver.
+
+2278.	[bug]		win32: handle the case where Windows returns no
+			search list or DNS suffix. [RT #17354]
+
+2277.	[bug]		Empty zone names were not correctly being caught at
+			in the post parse checks. [RT #17357]
+
+2273.	[bug]		Adjust log level to WARNING when saving inconsistent
+			stub/slave master and journal files. [RT# 17279]
+
+2272.	[bug]		Handle illegal dnssec-lookaside trust-anchor names.
+			[RT #17262]
+
+2270.	[bug]		dns_db_closeversion() version->writer could be reset
+			before it is tested. [RT #17290]
+
+2269.	[contrib]	dbus memory leaks and missing va_end calls. [RT #17232]
+
+2268.	[bug]		0.IN-ADDR.ARPA was missing from the empty zones
+			list.
+
+2266.	[bug]		client.c:get_clientmctx() returned the same mctx
+			once the pool of mctx's was filled. [RT #17218]
+
+2265.	[bug]		Test that the memory context's basic_table is non NULL
+			before freeing.  [RT #17265]
+
+2264.	[bug]		Server prefix length was being ignored. [RT #17308]
+
+2263.	[bug]		"named-checkconf -z" failed to set default value
+			for "check-integrity".  [RT #17306]
+
+2262.	[bug]		Error status from all but the last view could be
+			lost. [RT #17292]
+
+2260.	[bug]		Reported wrong clients-per-query when increasing the
+			value. [RT #17236]
+
+2247.	[doc]		Sort doc/misc/options. [RT #17067]
+
+2246.	[bug]		Make the startup of test servers (ans.pl) more
+			robust. [RT #17147]
 
 	--- 9.4.2 released ---
+
 	--- 9.4.2rc2 released ---
 
 2259.	[bug]		Reverse incorrect LIBINTERFACE bump of libisc
@@ -63,7 +463,7 @@
 2256.	[bug]		win32: Correctly register the installation location of
 			bindevt.dll. [RT #17159]
 
-2255.	[bug]		L.ROOT-SERVERS.NET is now 199.7.83.42.
+2255.	[maint]		L.ROOT-SERVERS.NET is now 199.7.83.42.
 
 2254.	[bug]		timer.c:dispatch() failed to lock timer->lock
 			when reading timer->idle allowing it to see
@@ -76,16 +476,16 @@
 			reality. Note there is behaviour change for BIND 9.5.
 			[RT #17113]
 
-2249.   [bug]           Only set Authentic Data bit if client requested
+2249.	[bug]		Only set Authentic Data bit if client requested
 			DNSSEC, per RFC 3655 [RT #17175]
 
-2248.   [cleanup]       Fix several errors reported by Coverity. [RT #17160]
+2248.	[cleanup]	Fix several errors reported by Coverity. [RT #17160]
 
 2245.	[bug]		Validating lack of DS records at trust anchors wasn't
 			working. [RT #17151]
 
 2238.	[bug]		It was possible to trigger a REQUIRE when a
-			validation was cancelled. [RT #17106]
+			validation was canceled. [RT #17106]
 
 2237.	[bug]		libbind: res_init() was not thread aware. [RT #17123]
 
@@ -94,8 +494,8 @@
 
 2235.	[bug]		<isc/atomic.h> was not being installed. [RT #17135]
 
-2234.   [port]          Correct some compiler warnings on SCO OSr5 [RT #17134]
-  
+2234.	[port]		Correct some compiler warnings on SCO OSr5 [RT #17134]
+
 2232.	[bug]		dns_adb_findaddrinfo() could fail and return
 			ISC_R_SUCCESS. [RT #17137]
 
@@ -110,7 +510,7 @@
 2227.	[cleanup]	Tidied up the FAQ. [RT #17121]
 
 2225.	[bug]		More support for systems with no IPv4 addresses.
-		        [RT #17111]
+			[RT #17111]
 
 2224.	[bug]		Defer journal compaction if a xfrin is in progress.
 			[RT #17119]
@@ -124,15 +524,15 @@
 
 2220.	[bug]		win32: Address a race condition in final shutdown of
 			the Windows socket code. [RT #17028]
-			
-2219.	[bug]		Apply zone consistancy checks to additions, not
+
+2219.	[bug]		Apply zone consistency checks to additions, not
 			removals, when updating. [RT #17049]
 
 2218.	[bug]		Remove unnecessary REQUIRE from dns_validator_create().
 			[RT #16976]
 
 2216.	[cleanup]	Fix a number of errors reported by Coverity.
-		        [RT #17094]
+			[RT #17094]
 
 2215.	[bug]		Bad REQUIRE check isc_hmacsha1_verify(). [RT #17094]
 
@@ -175,13 +575,13 @@
 			localhost;) is used.
 
 			[RT #16987]
-	
+
 2205.	[bug]		libbind: change #2119 broke thread support. [RT #16982]
 
 2203.	[security]	Query id generation was cryptographically weak.
 			[RT # 16915]
 
-2202.	[security]	The default acls for allow-query-cache and 
+2202.	[security]	The default acls for allow-query-cache and
 			allow-recursion were not being applied. [RT #16960]
 
 2200.	[bug]		The search for cached NSEC records was stopping to
@@ -216,7 +616,7 @@
 
 2187.	[bug]		query_addds(), query_addwildcardproof() and
 			query_addnxrrsetnsec() should take a version
-			arguement. [RT #16368]
+			argument. [RT #16368]
 
 2186.	[port]		cygwin: libbind: check for struct sockaddr_storage
 			independently of IPv6. [RT #16482]
@@ -243,7 +643,7 @@
 			debug level 10+. [RT #16798]
 
 2176.	[contrib]	dbus update to handle race condition during
-			initialisation (Bugzilla 235809). [RT #16842]
+			initialization (Bugzilla 235809). [RT #16842]
 
 2175.	[bug]		win32: windows broadcast condition variable support
 			was broken. [RT #16592]
@@ -274,7 +674,7 @@
 			a server address as a name to be looked up, causing
 			unexpected output. [RT #16743]
 
-2164.	[bug]		The code to determine how named-checkzone / 
+2164.	[bug]		The code to determine how named-checkzone /
 			named-compilezone was called failed under windows.
 			[RT #16764]
 
@@ -288,7 +688,7 @@
 
 2159.	[bug]		Array bounds overrun in acache processing. [RT #16710]
 
-2158.	[bug]		ns_client_isself() failed to initialise key
+2158.	[bug]		ns_client_isself() failed to initialize key
 			leading to a REQUIRE failure. [RT #16688]
 
 2156.	[bug]		Fix node reference leaks in lookup.c:lookup_find(),
@@ -363,7 +763,7 @@
 2136.	[bug]		nslookup/host looped if there was no search list
 			and the host didn't exist. [RT #16657]
 
-2135.	[bug]		Uninitialised rdataset in sdlz.c. [RT# 16656]
+2135.	[bug]		Uninitialized rdataset in sdlz.c. [RT# 16656]
 
 2133.	[port]		powerpc:  Support both IBM and MacOS Power PC
 			assembler syntaxes. [RT #16647]
@@ -379,7 +779,7 @@
 
 2127.	[port]		Improved OpenSSL 0.9.8 support. [RT #16563]
 
-2126.	[security]	Serialise validation of type ANY responses. [RT #16555]
+2126.	[security]	Serialize validation of type ANY responses. [RT #16555]
 
 2125.	[bug]		dns_zone_getzeronosoattl() REQUIRE failure if DLZ
 			was defined. [RT #16574]
@@ -419,7 +819,7 @@
 2111.	[bug]		Fix a number of errors reported by Coverity.
 			[RT #16507]
 
-2110.	[bug]		"minimal-response yes;" interacted badly with BIND 8
+2110.	[bug]		"minimal-responses yes;" interacted badly with BIND 8
 			priming queries. [RT #16491]
 
 2109.	[port]		libbind: silence aix 5.3 compiler warnings. [RT #16502]
@@ -431,7 +831,7 @@
 2103.	[port]		Add /usr/sfw to list of locations for OpenSSL
 			under Solaris.
 
-2102.	[port]		Silence solaris 10 warnings.
+2102.	[port]		Silence Solaris 10 warnings.
 
 	--- 9.4.0b4 released ---
 
@@ -441,7 +841,7 @@
 2100.	[port]		win32: copy libeay32.dll to Build\Debug.
 			Copy Debug\named-checkzone to Debug\named-compilezone.
 
-2099.	[port]		win32: more manifiest issues.
+2099.	[port]		win32: more manifest issues.
 
 2098.	[bug]		Race in rbtdb.c:no_references(), which occasionally
 			triggered an INSIST failure about the node lock
@@ -457,14 +857,14 @@
 
 2095.	[port]		libbind: alway prototype inet_cidr_ntop_ipv6() and
 			net_cidr_ntop_ipv6(). [RT #16388]
- 
+
 2094.	[contrib]	Update named-bootconf.  [RT# 16404]
 
 2093.	[bug]		named-checkzone -s was broken.
 
 2092.	[bug]		win32: dig, host, nslookup.  Use registry config
 			if resolv.conf does not exist or no nameservers
-			listed. [RT #15877] 
+			listed. [RT #15877]
 
 2091.	[port]		dighost.c: race condition on cleanup. [RT #16417]
 
@@ -507,7 +907,7 @@
 2078.	[bug]		dnssec-checkzone output style "default" was badly
 			named.  It is now called "relative". [RT #16326]
 
-2077.	[bug]		'dnssec-signzone -O raw' wasn't outputing the
+2077.	[bug]		'dnssec-signzone -O raw' wasn't outputting the
 			complete signed zone. [RT #16326]
 
 2076.	[bug]		Several files were missing #include <config.h>
@@ -592,7 +992,7 @@
 			[RT #16287]
 
 2049.	[bug]		Restore SOA before AXFR when falling back from
-			a attempted IXFR when transfering in a zone.
+			a attempted IXFR when transferring in a zone.
 			Allow a initial SOA query before attempting
 			a AXFR to be requested. [RT #16156]
 
@@ -601,7 +1001,7 @@
 			the OS always returned the same local port.
 			[RT #16182]
 
-2047.	[bug]		Failed to initialise the interface flags to zero.
+2047.	[bug]		Failed to initialize the interface flags to zero.
 			[RT #16245]
 
 2046.	[bug]		rbtdb.c:rdataset_setadditional() could cause duplicate
@@ -641,7 +1041,7 @@
 
 2034.	[bug]		gcc: set -fno-strict-aliasing. [RT #16124]
 
-2033.	[bug]		We wern't creating multiple client memory contexts
+2033.	[bug]		We weren't creating multiple client memory contexts
 			on demand as expected. [RT #16095]
 
 	--- 9.4.0a6 released ---
@@ -657,7 +1057,7 @@
 2029.	[bug]		host printed out the server multiple times when
 			specified on the command line. [RT #15992]
 
-2028.	[port]		linux: socket.c compatability for old systems.
+2028.	[port]		linux: socket.c compatibility for old systems.
 			[RT #16015]
 
 2027.	[port]		libbind: Solaris x86 support. [RT #16020]
@@ -667,7 +1067,7 @@
 
 2025.	[func]		Update "zone serial unchanged" message. [RT #16026]
 
-2024.	[bug]		named emited spurious "zone serial unchanged"
+2024.	[bug]		named emitted spurious "zone serial unchanged"
 			messages on reload. [RT #16027]
 
 2023.	[bug]		"make install" should create ${localstatedir}/run and
@@ -695,7 +1095,7 @@
 	--- 9.4.0a5 released ---
 
 2015.	[cleanup]	use-additional-cache is now acache-enable for
-			consistancy.  Default acache-enable off in BIND 9.4
+			consistency.  Default acache-enable off in BIND 9.4
 			as it requires memory usage to be configured.
 			It may be enabled by default in BIND 9.5 once we
 			have more experience with it.
@@ -715,9 +1115,9 @@
 
 	--- 9.4.0a4 released ---
 
-2009.	[bug]		libbind: coverity fixes. [RT #15808]
+2009.	[bug]		libbind: Coverity fixes. [RT #15808]
 
-2008.	[func]		It is now posssible to enable/disable DNSSEC
+2008.	[func]		It is now possible to enable/disable DNSSEC
 			validation from rndc.  This is useful for the
 			mobile hosts where the current connection point
 			breaks DNSSEC (firewall/proxy).  [RT #15592]
@@ -729,7 +1129,7 @@
 			be changed to yes in 9.5.0.  [RT #15674]
 
 2006.	[security]	Allow-query-cache and allow-recursion now default
-			to the builtin acls "localnets" and "localhost".
+			to the built in acls "localnets" and "localhost".
 
 			This is being done to make caching servers less
 			attractive as reflective amplifying targets for
@@ -777,7 +1177,7 @@
 
 1994.	[port]		OpenSSL 0.9.8 support. [RT #15694]
 
-1993.	[bug]		Log messsage, via syslog, were missing the space
+1993.	[bug]		Log messages, via syslog, were missing the space
 			after the timestamp if "print-time yes" was specified.
 			[RT #15844]
 
@@ -785,11 +1185,11 @@
 			view.  [RT #15825]
 
 1991.	[cleanup]	The configuration data, once read, should be treated
-			as readonly.  Expand the use of const to enforce this
+			as read only.  Expand the use of const to enforce this
 			at compile time. [RT #15813]
 
 1990.	[bug]		libbind:  isc's override of broken gettimeofday()
-			implementions was not always effective.
+			implementations was not always effective.
 			[RT #15709]
 
 1989.	[bug]		win32: don't check the service password when
@@ -811,7 +1211,7 @@
 			server for the zone.  Also any zones that contain
 			DLV records should be removed when upgrading a slave
 			zone.  You do not however have to upgrade all
-			servers for a zone with DLV records simultaniously.
+			servers for a zone with DLV records simultaneously.
 
 1984.	[func]		dig, nslookup and host now advertise a 4096 byte
 			EDNS UDP buffer size by default. [RT #15855]
@@ -848,7 +1248,7 @@
 1973.	[func]		TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and
 			HMACSHA512 support. [RT #13606]
 
-1972.	[contrib]	DBUS dynamic forwarders integation from
+1972.	[contrib]	DBUS dynamic forwarders integration from
 			Jason Vas Dias <jvdias@redhat.com>.
 
 1971.	[port]		linux: make detection of missing IF_NAMESIZE more
@@ -872,7 +1272,7 @@
 
 1964.	[func]		Separate out MX and SRV to CNAME checks. [RT #15723]
 
-1963.	[port]		Tru64 4.0E doesn't support send() and recv(). 
+1963.	[port]		Tru64 4.0E doesn't support send() and recv().
 			[RT #15586]
 
 1962.	[bug]		Named failed to clear old update-policy when it
@@ -898,7 +1298,7 @@
 			by native compiler.  See README for additional
 			cross compile support information. [RT #15148]
 
-1955.	[bug]		Pre-allocate the cache cleaning interator. [RT #14998]
+1955.	[bug]		Pre-allocate the cache cleaning iterator. [RT #14998]
 
 1954.	[func]		Named now falls back to advertising EDNS with a
 			512 byte receive buffer if the initial EDNS queries
@@ -915,7 +1315,7 @@
 1951.	[security]	Drop queries from particular well known ports.
 			Don't return FORMERR to queries from particular
 			well known ports.  [RT #15636]
-			
+
 1950.	[port]		Solaris 2.5.1 and earlier cannot bind() then connect()
 			a TCP socket. This prevents the source address being
 			set for TCP connections. [RT #15628]
@@ -934,10 +1334,10 @@
 1946.	[bug]		resume_dslookup() could trigger a REQUIRE failure
 			when using forwarders. [RT #15549]
 
-1945.	[cleanup]	dnssec-keygen: RSA (RSAMD5) is nolonger recommended.
+1945.	[cleanup]	dnssec-keygen: RSA (RSAMD5) is no longer recommended.
 			To generate a RSAMD5 key you must explicitly request
 			RSAMD5. [RT #13780]
-			
+
 1944.	[cleanup]	isc_hash_create() does not need a read/write lock.
 			[RT #15522]
 
@@ -1028,15 +1428,15 @@
 1917.	[doc]		funcsynopsisinfo wasn't being treated as verbatim
 			when generating man pages. [RT #15385]
 
-1916.	[func]		Integrate contibuted IDN code from JPNIC. [RT #15383]
+1916.	[func]		Integrate contributed IDN code from JPNIC. [RT #15383]
 
 1915.	[bug]		dig +ndots was broken. [RT #15215]
 
 1914.	[protocol]	DS is required to accept mnemonic algorithms
 			(RFC 4034).  Still emit numeric algorithms for
-			compatability with RFC 3658. [RT #15354]
+			compatibility with RFC 3658. [RT #15354]
 
-1913.	[func]		Integrate contibuted DLZ code into named. [RT #11382]
+1913.	[func]		Integrate contributed DLZ code into named. [RT #11382]
 
 1912.	[port]		aix: atomic locking for powerpc. [RT #15020]
 
@@ -1059,7 +1459,7 @@
 			[RT #15034]
 
 1905.	[bug]		Strings returned from cfg_obj_asstring() should be
-			treated as read-only.  The prototype for 
+			treated as read-only.  The prototype for
 			cfg_obj_asstring() has been updated to reflect this.
 			[RT #15256]
 
@@ -1108,7 +1508,7 @@
 1891.	[port]		freebsd: pthread_mutex_init can fail if it runs out
 			of memory. [RT #14995]
 
-1890.	[func]		Raise the UDP recieve buffer size to 32k if it is
+1890.	[func]		Raise the UDP receive buffer size to 32k if it is
 			less than 32k. [RT #14953]
 
 1889.	[port]		sunos: non blocking i/o support. [RT #14951]
@@ -1148,7 +1548,7 @@
 			[RT #2471]
 
 1877.	[bug]		Fix unreasonably low quantum on call to
-			dns_rbt_destroy2().  Remove unnecessay unhash_node()
+			dns_rbt_destroy2().  Remove unnecessary unhash_node()
 			call. [RT #14919]
 
 1876.	[func]		Additional memory debugging support to track size
@@ -1189,10 +1589,10 @@
 1863.	[bug]		rrset-order "fixed" error messages not complete.
 
 1862.	[func]		Add additional zone data constancy checks.
-			named-checkzone has extended checking of NS, MX and 
+			named-checkzone has extended checking of NS, MX and
 			SRV record and the hosts they reference.
 			named has extended post zone load checks.
-			New zone options: check-mx and integrity-check. 
+			New zone options: check-mx and integrity-check.
 			[RT #4940]
 
 1861.	[bug]		dig could trigger a INSIST on certain malformed
@@ -1230,24 +1630,24 @@
 1850.	[bug]		Memory leak in lwres_getipnodebyaddr(). [RT #14591]
 
 1849.	[doc]		All forms of the man pages (docbook, man, html) should
-			have consistant copyright dates.
+			have consistent copyright dates.
 
 1848.	[bug]		Improve SMF integration. [RT #13238]
 
 1847.	[bug]		isc_ondestroy_init() is called too late in
-			dns_rbtdb_create()/dns_rbtdb64_create(). 
+			dns_rbtdb_create()/dns_rbtdb64_create().
 			[RT #13661]
-			
+
 1846.	[contrib]	query-loc-0.3.0 from Stephane Bortzmeyer
 			<bortzmeyer@nic.fr>.
 
-1845.	[bug]		Improve error reporting to distingish between
+1845.	[bug]		Improve error reporting to distinguish between
 			accept()/fcntl() and socket()/fcntl() errors.
 			[RT #13745]
 
 1844.	[bug]		inet_pton() accepted more that 4 hexadecimal digits
 			for each 16 bit piece of the IPv6 address.  The text
-			representation of a IPv6 address has been tighted
+			representation of a IPv6 address has been tightened
 			to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt).
 			[RT #5662]
 
@@ -1475,7 +1875,7 @@
 1765.	[bug]		configure --with-openssl=auto failed. [RT #12937]
 
 1764.	[bug]		dns_zone_replacedb failed to emit a error message
-			if there was no SOA record in the replacment db.
+			if there was no SOA record in the replacement db.
 			[RT #13016]
 
 1763.	[func]		Perform sanity checks on NS records which refer to
@@ -1503,7 +1903,7 @@
 1755.	[func]		allow-update is now settable at the options / view
 			level. [RT #6636]
 
-1754.	[bug]		We wern't always attempting to query the parent
+1754.	[bug]		We weren't always attempting to query the parent
 			server for the DS records at the zone cut.
 			[RT #12774]
 
@@ -1523,8 +1923,8 @@
 			[RT #12866]
 
 1748.	[func]		dig now returns the byte count for axfr/ixfr.
-			
-1747.	[bug]		BIND 8 compatability: named/named-checkconf failed
+
+1747.	[bug]		BIND 8 compatibility: named/named-checkconf failed
 			to parse "host-statistics-max" in named.conf.
 
 1746.	[func]		Make public the function to read a key file,
@@ -1541,7 +1941,7 @@
 			requested number of worker threads then destruction
 			of the manager would trigger an INSIST() failure.
 			[RT #12790]
-			
+
 1742.	[bug]		Deleting all records at a node then adding a
 			previously existing record, in a single UPDATE
 			transaction, failed to leave / regenerate the
@@ -1552,7 +1952,7 @@
 
 1740.	[bug]		Replace rbt's hash algorithm as it performed badly
 			with certain zones. [RT #12729]
-			
+
 			NOTE: a hash context now needs to be established
 			via isc_hash_create() if the application was not
 			already doing this.
@@ -1567,7 +1967,7 @@
 
 1736.	[bug]		dst_key_fromnamedfile() could fail to read a
 			public key. [RT #12687]
-			
+
 1735.	[bug]		'dig +sigtrace' could die with a REQUIRE failure.
 			[RE #12688]
 
@@ -1607,7 +2007,7 @@
 			[RT #12519]
 
 1721.	[bug]		Error message from the journal processing were not
-			always identifing the relevent journal. [RT #12519]
+			always identifying the relevant journal. [RT #12519]
 
 1720.	[bug]		'dig +chase' did not terminate on a RFC 2308 Type 1
 			negative response. [RT #12506]
@@ -1664,7 +2064,7 @@
 1703.	[bug]		named would loop sending NOTIFY messages when it
 			failed to receive a response. [RT #12322]
 
-1702.	[bug]		also-notify should not be applied to builtin zones.
+1702.	[bug]		also-notify should not be applied to built in zones.
 			[RT #12323]
 
 1701.	[doc]		A minimal named.conf man page.
@@ -1744,7 +2144,7 @@
 
 1675.	[bug]		named would sometimes add extra NSEC records to
 			the authority section.
-			
+
 1674.	[port]		linux: increase buffer size used to scan
 			/proc/net/if_inet6.
 
@@ -1816,7 +2216,7 @@
 
 1648.	[func]		Update dnssec-lookaside named.conf syntax to support
 			multiple dnssec-lookaside namespaces (not yet
-			implemented).  
+			implemented).
 
 1647.	[bug]		It was possible trigger a INSIST when chasing a DS
 			record that required walking back over a empty node.
@@ -1829,7 +2229,7 @@
 			masters with keys are specified.
 
 1644.	[bug]		Update the journal modification time after a
-			sucessfull refresh query. [RT #11436]
+			successful refresh query. [RT #11436]
 
 1643.	[bug]		dns_db_closeversion() could leak memory / node
 			references. [RT #11163]
@@ -1846,11 +2246,11 @@
 
 1638.	[bug]		"ixfr-from-differences" could generate a REQUIRE
 			failure if the journal open failed. [RT #11347]
-			
+
 1637.	[bug]		Node reference leak on error in addnoqname().
 
 1636.	[bug]		The dump done callback could get ISC_R_SUCCESS even if
-			a error had occured.  The database version no longer
+			a error had occurred.  The database version no longer
 			matched the version of the database that was dumped.
 
 1635.	[bug]		Memory leak on error in query_addds().
@@ -1940,21 +2340,21 @@
 1607.	[bug]		dig, host and nslookup were still using random()
 			to generate query ids. [RT# 11013]
 
-1606.	[bug]	 	DLV insecurity proof was failing.
+1606.	[bug]		DLV insecurity proof was failing.
 
 1605.	[func]		New dns_db_find() option DNS_DBFIND_COVERINGNSEC.
 
 1604.	[bug]		A xfrout_ctx_create() failure would result in
 			xfrout_ctx_destroy() being called with a
 			partially initialized structure.
-			
+
 1603.	[bug]		nsupdate: set interactive based on isatty().
 			[RT# 10929]
 
 1602.	[bug]		Logging to a file failed unless a size was specified.
 			[RT# 10925]
 
-1601.	[bug]		Silence spurious warning 'both "recursion no;" and 
+1601.	[bug]		Silence spurious warning 'both "recursion no;" and
 			"allow-recursion" active' warning from view "_bind".
 			[RT# 10920]
 
@@ -2045,7 +2445,7 @@
 1568.	[bug]		nsupdate now reports that the update failed in
 			interactive mode. [RT# 10236]
 
-1567.	[bug]		B.ROOT-SERVERS.NET is now 192.228.79.201.
+1567.	[maint]		B.ROOT-SERVERS.NET is now 192.228.79.201.
 
 1566.	[port]		Support for the cmsg framework on Solaris and HP/UX.
 			This also solved the problem that match-destinations
@@ -2214,7 +2614,7 @@
 			type, class and responding nameserver.
 
 1511.	[bug]		delegation-only was generating false positives
-			on negative answers from subzones.
+			on negative answers from sub-zones.
 
 1510.	[func]		New view option "root-delegation-only".  Apply
 			delegation-only check to all TLDs and root.
@@ -2548,7 +2948,7 @@
 1398.	[doc]		ARM: notify-also should have been also-notify.
 			[RT #4345]
 
-1397.	[bug]		J.ROOT-SERVERS.NET is now 192.58.128.30.
+1397.	[maint]		J.ROOT-SERVERS.NET is now 192.58.128.30.
 
 1396.	[func]		dnssec-signzone: adjust the default signing time by
 			1 hour to allow for clock skew.
@@ -3895,7 +4295,7 @@
 
  954.	[bug]		When requesting AXFRs or IXFRs using dig, host, or
 			nslookup, the RD bit should not be set as zone
-			transfers are inherently nonrecursive. [RT #1575]
+			transfers are inherently non-recursive. [RT #1575]
 
  953.	[func]		The /var/run/named.key file from change #843
 			has been replaced by /etc/rndc.key.  Both
@@ -4210,7 +4610,7 @@
  860.	[func]		Drop cross class glue in zone transfers.
 
  859.	[bug]		Cache cleaning now won't swamp the CPU if there
-			is a persistent overlimit condition.
+			is a persistent over limit condition.
 
  858.	[func]		isc_mem_setwater() no longer requires that when the
 			callback function is non-NULL then its hi_water
@@ -4386,7 +4786,7 @@
  811.	[bug]		Parentheses were not quoted in zone dumps. [RT #1194]
 
  810.	[bug]		The signer name in SIG records was not properly
-			downcased when signing/verifying records. [RT #1186]
+			down-cased when signing/verifying records. [RT #1186]
 
  809.	[bug]		Configuring a non-local address as a transfer-source
 			could cause an assertion failure during load.
@@ -4398,9 +4798,9 @@
 			ignored like it should be.
 
  806.	[bug]		DNS_R_SEENINCLUDE was failing to propagate back up
-			the calling stack to the zone maintence level, causing
-			zones to not reload when an included file was touched
-			but the top-level zone file was not.
+			the calling stack to the zone maintenance level,
+			causing zones to not reload when an included file was
+			touched but the top-level zone file was not.
 
  805.	[bug]		When using "forward only", missing root hints should
 			not cause queries to fail. [RT #1143]
@@ -4440,7 +4840,7 @@
 			in rndc.conf.
 
  793.	[cleanup]	The DNSSEC tools could create filenames that were
-			illegal or contained shell metacharacters.  They
+			illegal or contained shell meta-characters.  They
 			now use a different text encoding of names that
 			doesn't have these problems. [RT #1101]
 
@@ -4464,7 +4864,7 @@
 			names when mapping them into file names.
 
  786.	[bug]		When DNSSEC signing/verifying data, owner names were
-			not properly downcased.
+			not properly down-cased.
 
  785.	[bug]		A race condition in the resolver could cause
 			an assertion failure. [RT #673, #872, #1048]
@@ -4483,7 +4883,7 @@
 
  780.	[bug]		Error handling code dealing with out of memory or
 			other rare errors could lead to assertion failures
-			by calling functions on unitialized names. [RT #1065]
+			by calling functions on uninitialized names. [RT #1065]
 
  779.	[func]		Added the "minimal-responses" option.
 
@@ -4626,7 +5026,7 @@
  735.	[doc]		Add BIND 4 migration notes.
 
  734.	[bug]		An attempt to re-lock the zone lock could occur if
-			the server was shutdown during a zone tranfer.
+			the server was shutdown during a zone transfer.
 			[RT #830]
 
  733.	[bug]		Reference counts of dns_acl_t objects need to be
@@ -4766,7 +5166,7 @@
  688.	[func]		"make tags" now works on systems with the
 			"Exuberant Ctags" etags.
 
- 687.	[bug]		Only say we have IPv6, with sufficent functionality,
+ 687.	[bug]		Only say we have IPv6, with sufficient functionality,
 			if it has actually been tested. [RT #586]
 
  686.	[bug]		dig and nslookup can now be properly aborted during
@@ -5084,7 +5484,7 @@
 	--- 9.1.0b1 released ---
 
  591.	[bug]		Work around non-reentrancy in openssl by disabling
-			precomputation in keys.
+			pre-computation in keys.
 
  590.	[doc]		There are now man pages for the lwres library in
 			doc/man/lwres.
@@ -5133,7 +5533,7 @@
 			source address for notify messages.
 
  577.	[func]		Log illegal RDATA combinations. e.g. multiple
-			singlton types, cname and other data.
+			singleton types, cname and other data.
 
  576.	[doc]		isc_log_create() description did not match reality.
 
@@ -5144,7 +5544,7 @@
 			have their responses validated and would leak memory.
 
  573.	[bug]		The journal files of IXFRed slave zones were
-			inadvertantly discarded on server reload, causing
+			inadvertently discarded on server reload, causing
 			"journal out of sync with zone" errors on subsequent
 			reloads. [RT #482]
 
@@ -5313,7 +5713,7 @@
 			others).
 
  519.	[bug]		dns_name_split() would improperly split some bitstring
-			labels, zeroing a few of the least signficant bits in
+			labels, zeroing a few of the least significant bits in
 			the prefix part.  When such an improperly created
 			prefix was returned to the RBT database, the bogus
 			label was dutifully stored, corrupting the tree.
@@ -5341,7 +5741,7 @@
  513.	[func]		New functionality added to rdnc and server to allow
 			individual zones to be refreshed or reloaded.
 
- 512.	[bug]		The zone transfer code could throw an execption with
+ 512.	[bug]		The zone transfer code could throw an exception with
 			an invalid IXFR stream.
 
  511.	[bug]		The message code could throw an assertion on an
@@ -5532,7 +5932,7 @@
  452.	[bug]		Warn if the unimplemented option "statistics-file"
 			is specified in named.conf. [RT #301]
 
- 451.	[func]		Update forwarding implememted.
+ 451.	[func]		Update forwarding implemented.
 
  450.	[func]		New function ns_client_sendraw().
 
@@ -5633,7 +6033,7 @@
 			e.g. due to corrupt zones with multiple SOA records.
 			[RT #279]
 
- 423.	[bug]		When responding to a recusive query, errors that occur
+ 423.	[bug]		When responding to a recursive query, errors that occur
 			after following a CNAME should cause the query to fail.
 			[RT #274]
 
@@ -5678,7 +6078,7 @@
 
  409.	[bug]		If named was shut down early in the startup
 			process, ns_omapi_shutdown() would attempt to lock
-			an unintialized mutex. [RT #262]
+			an uninitialized mutex. [RT #262]
 
  408.	[bug]		stub zones could leak memory and reference counts if
 			all the masters were unreachable.
@@ -5745,7 +6145,7 @@
 			making the functions dns_zone_adddbarg()
 			and dns_zone_cleardbargs() unnecessary.
 
- 389.	[bug]		Attempting to send a reqeust over IPv6 using
+ 389.	[bug]		Attempting to send a request over IPv6 using
 			dns_request_create() on a system without IPv6
 			support caused an assertion failure [RT #235].
 
@@ -5802,7 +6202,7 @@
 			of a very large RRset could cause an assertion failure
 			during logging.
 
- 370.	[bug]		The error messages for rollforward failures were
+ 370.	[bug]		The error messages for roll-forward failures were
 			overly terse.
 
  369.	[func]		Support new named.conf options, view and zone
@@ -5945,7 +6345,7 @@
 
  328.	[func]		Added isc_base64_decodestring().
 
- 327.	[bug]		rndc.conf parser wasn't correctly recognising an IP
+ 327.	[bug]		rndc.conf parser wasn't correctly recognizing an IP
 			address where a host specification was required.
 
  326.	[func]		'keys' in an 'inet' control statement is now
@@ -5975,7 +6375,7 @@
 			where they previously didn't.
 
  321.	[bug]		When synthesizing a CNAME RR for a DNAME
-			response, query_addcname() failed to intitialize
+			response, query_addcname() failed to initialize
 			the type and class of the CNAME dns_rdata_t,
 			causing random failures.
 
@@ -6251,7 +6651,7 @@
 
 	--- 9.0.0b4 released ---
 
- 253.	[func]		resolv.conf parser now recognises ';' and '#' as
+ 253.	[func]		resolv.conf parser now recognizes ';' and '#' as
 			comments (anywhere in line, not just as the beginning).
 
  252.	[bug]		resolv.conf parser mishandled masks on sortlists.
@@ -6321,7 +6721,7 @@
 			requiring a quoted string.
 
  233.	[cleanup]	Convert all config structure integer values to unsigned
-			integer (isc_uint32_t) to match grammer.
+			integer (isc_uint32_t) to match grammar.
 
  232.	[bug]		Allow slave zones to not have a file.
 
@@ -6358,7 +6758,7 @@
 			from confparser.c, because of yacc's code, are
 			unfortunately to be expected.)
 
- 223.	[func]		Several functions were reprototyped to qualify one
+ 223.	[func]		Several functions were re-prototyped to qualify one
 			or more of their arguments with "const".  Similarly,
 			several functions that return pointers now have
 			those pointers qualified with const.
@@ -6523,7 +6923,7 @@
  183.	[func]		ISC_LOG_PRINTTAG option for log channels.  Useful
 			for logging the program name or other identifier.
 
- 182.	[cleanup]	New commandline parameters for dnssec tools
+ 182.	[cleanup]	New command-line parameters for dnssec tools
 
  181.	[func]		Added dst_key_buildfilename and dst_key_parsefilename
 
@@ -6568,7 +6968,7 @@
 			--with-mit-pthreads option is no longer needed
 			and has been removed.
 
- 170.	[cleanup]	Remove inter server consistancy checks from zone,
+ 170.	[cleanup]	Remove inter server consistency checks from zone,
 			these should return as a separate module in 9.1.
 			dns_zone_checkservers(), dns_zone_checkparents(),
 			dns_zone_checkchildren(), dns_zone_checkglue().
@@ -6661,7 +7061,7 @@
 			than continuing to itemize every header which changed,
 			this changelog entry just notes that if a header file
 			did not need another header file that it was including
-			in order to provide its advertized functionality, the
+			in order to provide its advertised functionality, the
 			inclusion of the other header file was removed.  See
 			util/check-includes for how this was tested.
 
@@ -7053,7 +7453,7 @@
 
   31.	[bug]		Use ${LIBTOOL} to compile bin/named/main.@O@.
 
-  30.	[func]		config file grammer change to support optional
+  30.	[func]		config file grammar change to support optional
 			class type for a view.
 
   29.	[func]		support new config file view options:
@@ -7117,7 +7517,7 @@
   13.	[bug]		lib/dns/master.c and lib/dns/xfrin.c didn't ignore
 			out-of-zone data.
 
-  12.	[bug]		Fixed possible unitialized variable error.
+  12.	[bug]		Fixed possible uninitialized variable error.
 
   11.	[bug]		axfr_rrstream_first() didn't check the result code of
 			db_rr_iterator_first(), possibly causing an assertion
diff --git a/COPYRIGHT b/COPYRIGHT
index 2eaecb296f7d..8d6a0cef1378 100644
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 
-$Id: COPYRIGHT,v 1.9.18.4.10.1 2008/07/23 07:28:54 tbox Exp $
+$Id: COPYRIGHT,v 1.9.18.5 2008/01/02 23:46:02 tbox Exp $
 
 Portions Copyright (C) 1996-2001  Nominum, Inc.
 
diff --git a/FAQ b/FAQ
index 90b3ca045388..2c333bef3b24 100644
--- a/FAQ
+++ b/FAQ
@@ -1,6 +1,6 @@
 Frequently Asked Questions about BIND 9
 
-Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright © 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 
 Copyright © 2000-2003 Internet Software Consortium.
 
@@ -205,6 +205,8 @@ A: These indicate a malformed master zone. You can identify the exact
 Q: I get error messages like "named.conf:99: unexpected end of input"
    where 99 is the last line of named.conf.
 
+A: There are unbalanced quotes in named.conf.
+
 A: Some text editors (notepad and wordpad) fail to put a line title
    indication (e.g. CR/LF) on the last line of a text file. This can be
    fixed by "adding" a blank line to the end of the file. Named expects to
@@ -375,7 +377,60 @@ A: When reloading a zone named my have multiple copies of the zone in
    other errors in the master file as it still has an in-core copy of the
    old contents.
 
-3. General Questions
+Q: I want to use IPv6 locally but I don't have a external IPv6 connection.
+   External lookups are slow.
+
+A: You can use server clauses to stop named making external lookups over
+   IPv6.
+
+   server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix
+   server ::/0 { bogus yes; };
+
+3. Operations Questions
+
+Q: How to change the nameservers for a zone?
+
+A: Step 1: Ensure all nameservers, new and old, are serving the same zone
+   content.
+
+   Step 2: Work out the maximum TTL of the NS RRset in the parent and
+   child zones. This is the time it will take caches to be clear of a
+   particular version of the NS RRset. If you are just removing
+   nameservers you can skip to Step 6.
+
+   Step 3: Add new nameservers to the NS RRset for the zone and wait until
+   all the servers for the zone are answering with this new NS RRset.
+
+   Step 4: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long. If you are just adding nameservers you are done.
+
+   Step 6: Remove any old nameservers from the zones NS RRset and wait for
+   all the servers for the zone to be serving the new NS RRset.
+
+   Step 7: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long.
+
+   Step 9: Turn off the old nameservers or remove the zone entry from the
+   configuration of the old nameservers.
+
+   Step 10: Increment the serial number and wait for the change to be
+   visible in all nameservers for the zone. This ensures that zone
+   transfers are still working after the old servers are decommissioned.
+
+   Note: the above procedure is designed to be transparent to dns clients.
+   Decommissioning the old servers too early will result in some clients
+   not being able to look up answers in the zone.
+
+   Note: while it is possible to run the addition and removal stages
+   together it is not recommended.
+
+4. General Questions
 
 Q: I keep getting log messages like the following. Why?
 
@@ -396,8 +451,8 @@ A: Someone is trying to update your DNS data using the RFC2136 Dynamic
    Update protocol. Windows 2000 machines have a habit of sending dynamic
    update requests to DNS servers without being specifically configured to
    do so. If the update requests are coming from a Windows 2000 machine,
-   see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for
-   information about how to turn them off.
+   see <http://support.microsoft.com/support/kb/articles/q246/8/04.asp>
+   for information about how to turn them off.
 
 Q: When I do a "dig . ns", many of the A records for the root servers are
    missing. Why?
@@ -468,7 +523,7 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you
    are using then you have failed to follow RFC 1918 usage rules and are
    leaking queries to the Internet. You should establish your own zones
    for these addresses to prevent you querying the Internet's name servers
-   for these addresses. Please see http://as112.net/ for details of the
+   for these addresses. Please see <http://as112.net/> for details of the
    problems you are causing and the counter measures that have had to be
    deployed.
 
@@ -541,9 +596,16 @@ A: No. The BIND 9 bug database is kept closed for a number of reasons.
    that have been fixed post release. That is as close as we can get to
    providing a bug database.
 
-4. Operating-System Specific Questions
+Q: Why do queries for NSEC3 records fail to return the NSEC3 record?
+
+A: NSEC3 records are strictly meta data and can only be returned in the
+   authority section. This is done so that signing the zone using NSEC3
+   records does not bring names into existance that do not exist in the
+   unsigned version of the zone.
 
-4.1. HPUX
+5. Operating-System Specific Questions
+
+5.1. HPUX
 
 Q: I get the following error trying to configure BIND:
 
@@ -559,7 +621,7 @@ A: You have attempted to configure BIND with the bundled C compiler. This
 
    ./configure CC=<compiler> ...
 
-4.2. Linux
+5.2. Linux
 
 Q: Why do I get the following errors:
 
@@ -569,7 +631,20 @@ Q: Why do I get the following errors:
 
 A: This is the result of a Linux kernel bug.
 
-   See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
+   See: <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=
+   2>
+
+Q: Why does named lock up when it attempts to connect over IPSEC tunnels?
+
+A: This is due to a kernel bug where the fact that a socket is marked
+   non-blocking is ignored. It is reported that setting xfrm_larval_drop
+   to 1 helps but this may have negative side effects. See: <https://
+   bugzilla.redhat.com/show_bug.cgi?id=427629> and <http://lkml.org/lkml/
+   2007/12/4/260>.
+
+   xfrm_larval_drop can be set to 1 by the following procedure:
+
+   echo "1" > proc/sys/net/core/xfrm_larval_drop
 
 Q: Why do I see 5 (or more) copies of named on Linux?
 
@@ -594,7 +669,12 @@ Q: I get the error message "named: capset failed: Operation not permitted"
    when starting named.
 
 A: The capability module, part of "Linux Security Modules/LSM", has not
-   been loaded into the kernel. See insmod(8).
+   been loaded into the kernel. See insmod(8), modprobe(8).
+
+   The relevant modules can be loaded by running:
+
+   modprobe commoncap
+   modprobe capability
 
 Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
 
@@ -608,7 +688,7 @@ Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
 A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
 
    Red Hat have adopted the National Security Agency's SELinux security
-   policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND
+   policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND
    security , which are more secure than running named in a chroot and
    make use of the bind-chroot environment unnecessary .
 
@@ -699,7 +779,19 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
    See these man-pages for more information : selinux(8), named_selinux
    (8), chcon(1), setsebool(8)
 
-4.3. Windows
+Q: Listening on individual IPv6 interfaces does not work.
+
+A: This is usually due to "/proc/net/if_inet6" not being available in the
+   chroot file system. Mount another instance of "proc" in the chroot file
+   system.
+
+   This can be be made permanent by adding a second instance to /etc/
+   fstab.
+
+   proc /proc           proc defaults 0 0
+   proc /var/named/proc proc defaults 0 0
+
+5.3. Windows
 
 Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
    Why?
@@ -725,7 +817,7 @@ A: This is the service manager saying that named exited. You need to
            Directory "C:\windows\dns\etc";
    };
 
-4.4. FreeBSD
+5.4. FreeBSD
 
 Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
 
@@ -736,17 +828,17 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
    /etc/rc.conf
    rand_irqs="3 14 15"
 
-   See also http://people.freebsd.org/~dougb/randomness.html
+   See also <http://people.freebsd.org/~dougb/randomness.html>.
 
-4.5. Solaris
+5.5. Solaris
 
 Q: How do I integrate BIND 9 and Solaris SMF
 
 A: Sun has a blog entry describing how to do this.
 
-   http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+   <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris>
 
-4.6. Apple Mac OS X
+5.6. Apple Mac OS X
 
 Q: How do I run BIND 9 on Apple Mac OS X?
 
diff --git a/FAQ.xml b/FAQ.xml
index 0f864ef753a2..b624d06d5341 100644
--- a/FAQ.xml
+++ b/FAQ.xml
@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: FAQ.xml,v 1.4.4.16 2007/10/31 02:14:07 marka Exp $ -->
+<!-- $Id: FAQ.xml,v 1.4.4.24 2008/09/10 01:32:25 tbox Exp $ -->
 
 <article class="faq">
   <title>Frequently Asked Questions about BIND 9</title>
@@ -27,6 +27,7 @@
       <year>2005</year>
       <year>2006</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -392,6 +393,11 @@ named-checkzone example.com tmp</programlisting>
       </question>
       <answer>
 	<para>
+	  There are unbalanced quotes in named.conf.
+	</para>
+      </answer>
+      <answer>
+	<para>
 	  Some text editors (notepad and wordpad) fail to put a line
 	  title indication (e.g. CR/LF) on the last line of a
 	  text file.  This can be fixed by "adding" a blank line to
@@ -660,9 +666,98 @@ zone "list.dsbl.org" {
 	</para>
       </answer>
     </qandaentry>
+
+    <qandaentry>
+      <question>
+	<para>
+	  I want to use IPv6 locally but I don't have a external IPv6
+	  connection.  External lookups are slow.
+	</para>
+      </question>
+      <answer>
+	<para>
+	  You can use server clauses to stop named making external lookups
+	  over IPv6.
+	</para>
+        <programlisting>
+server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix
+server ::/0 { bogus yes; };
+</programlisting>
+      </answer>
+    </qandaentry>
     
     </qandadiv> <!-- Configuration and Setup Questions -->
     
+    <qandadiv><title>Operations Questions</title>
+
+    <qandaentry>
+      <question>
+	<para>
+	  How to change the nameservers for a zone?
+	</para>
+      </question>
+      <answer>
+	<para>
+	  Step 1: Ensure all nameservers, new and old, are serving the
+	  same zone content.
+	</para>
+	<para>
+	  Step 2: Work out the maximum TTL of the NS RRset in the parent and child
+	  zones.  This is the time it will take caches to be clear of a
+	  particular version of the NS RRset.
+	  If you are just removing nameservers you can skip to Step 6.
+	</para>
+	<para>
+	  Step 3: Add new nameservers to the NS RRset for the zone and
+	  wait until all the servers for the zone are answering with this
+	  new NS RRset.
+	</para>
+	<para>
+	  Step 4: Inform the parent zone of the new NS RRset then wait for all the
+	  parent servers to be answering with the new NS RRset.
+	</para>
+	<para>
+	  Step 5: Wait for cache to be clear of the old NS RRset.
+	  See Step 2 for how long.
+	  If you are just adding nameservers you are done.
+	</para>
+	<para>
+	  Step 6: Remove any old nameservers from the zones NS RRset and
+	  wait for all the servers for the zone to be serving the new NS RRset.
+	</para>
+	<para>
+	  Step 7: Inform the parent zone of the new NS RRset then wait for all the
+	  parent servers to be answering with the new NS RRset.
+	</para>
+	<para>
+	  Step 8: Wait for cache to be clear of the old NS RRset.
+	  See Step 2 for how long.
+	</para>
+	<para>
+	  Step 9: Turn off the old nameservers or remove the zone entry from
+	  the configuration of the old nameservers.
+	</para>
+	<para>
+	  Step 10: Increment the serial number and wait for the change to
+	  be visible in all nameservers for the zone.  This ensures that
+	  zone transfers are still working after the old servers are
+	  decommissioned.
+	</para>
+	<para>
+	  Note: the above procedure is designed to be transparent
+	  to dns clients.  Decommissioning the old servers too early
+	  will result in some clients not being able to look up
+	  answers in the zone.
+	</para>
+	<para>
+	  Note: while it is possible to run the addition and removal
+	  stages together it is not recommended.
+	</para>
+      </answer>
+    </qandaentry>
+
+    </qandadiv> <!-- Operations Questions -->
+
     <qandadiv><title>General Questions</title>
 	    
     <qandaentry>
@@ -705,8 +800,7 @@ zone "list.dsbl.org" {
 	  requests are coming from a Windows 2000 machine, see
 	  <ulink
 	   url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp">
-	    http://support.microsoft.com/support/kb/articles/q246/8/04.asp
-	  </ulink>
+  &lt;http://support.microsoft.com/support/kb/articles/q246/8/04.asp&gt;</ulink>
 	  for information about how to turn them off.
 	</para>
       </answer>
@@ -856,7 +950,7 @@ serial-query-rate 5; // default 20</programlisting>
 	  usage rules and are leaking queries to the Internet.  You
 	  should establish your own zones for these addresses to prevent
 	  you querying the Internet's name servers for these addresses.
-	  Please see <ulink url="http://as112.net/">http://as112.net/</ulink>
+	  Please see <ulink url="http://as112.net/">&lt;http://as112.net/&gt;</ulink>
 	  for details of the problems you are causing and the counter
 	  measures that have had to be deployed.
 	</para>
@@ -962,6 +1056,23 @@ empty:
       </answer>
     </qandaentry>
 
+    <qandaentry>
+      <question>
+	<para>
+	  Why do queries for NSEC3 records fail to return the NSEC3 record?
+	</para>
+      </question>
+      <answer>
+	<para>
+	  NSEC3 records are strictly meta data and can only be
+	  returned in the authority section.  This is done so that
+	  signing the zone using NSEC3 records does not bring names
+	  into existance that do not exist in the unsigned version
+	  of the zone.
+	</para>
+      </answer>
+    </qandaentry>
+
     </qandadiv> <!-- General Questions -->
     
     <qandadiv><title>Operating-System Specific Questions</title>
@@ -1009,7 +1120,31 @@ client: UDP client handler shutting down due to fatal receive error: unexpected
 	</para>
 	<para>
 	  See:
-	  <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2">http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2</ulink>
+	  <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2">&lt;http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2&gt;</ulink>
+	</para>
+      </answer>
+    </qandaentry>
+
+    <qandaentry>
+      <question>
+	<para>
+	  Why does named lock up when it attempts to connect over IPSEC tunnels?
+	</para>
+      </question>
+      <answer>
+	<para>
+	  This is due to a kernel bug where the fact that a socket is marked
+	  non-blocking is ignored.  It is reported that setting
+	  xfrm_larval_drop to 1 helps but this may have negative side effects.
+	  See:
+<ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=427629">&lt;https://bugzilla.redhat.com/show_bug.cgi?id=427629&gt;</ulink>
+	  and
+<ulink url="http://lkml.org/lkml/2007/12/4/260">&lt;http://lkml.org/lkml/2007/12/4/260&gt;</ulink>.
+	</para>
+	<para>
+	xfrm_larval_drop can be set to 1 by the following procedure:
+<programlisting>
+echo "1" &gt; proc/sys/net/core/xfrm_larval_drop</programlisting>
 	</para>
       </answer>
     </qandaentry>
@@ -1064,7 +1199,13 @@ client: UDP client handler shutting down due to fatal receive error: unexpected
       <answer>
 	<para>
 	  The capability module, part of "Linux Security Modules/LSM",
-	  has not been loaded into the kernel.  See insmod(8).
+	  has not been loaded into the kernel.  See insmod(8), modprobe(8).
+	</para>
+	<para>
+	  The relevant modules can be loaded by running:
+<programlisting>
+modprobe commoncap
+modprobe capability</programlisting>
 	</para>
       </answer>
     </qandaentry>
@@ -1094,8 +1235,9 @@ client: UDP client handler shutting down due to fatal receive error: unexpected
 
 	<para>
 	   Red Hat have adopted the National Security Agency's
-	   SELinux security policy ( see http://www.nsa.gov/selinux
-	   ) and recommendations for BIND security , which are more
+	   SELinux security policy (see <ulink
+   url="http://www.nsa.gov/selinux">&lt;http://www.nsa.gov/selinux&gt;</ulink>)
+	   and recommendations for BIND security , which are more
 	   secure than running named in a chroot and make use of
 	   the bind-chroot environment unnecessary .
 	</para>
@@ -1233,6 +1375,30 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d
 	</para>
       </answer>
     </qandaentry>
+
+    <qandaentry>
+      <question>
+	<para>
+	  Listening on individual IPv6 interfaces does not work.
+	</para>
+      </question>
+      <answer>
+	<para>
+	  This is usually due to "/proc/net/if_inet6" not being available
+	  in the chroot file system.  Mount another instance of "proc"
+	  in the chroot file system.
+	</para>
+	<para>
+	  This can be be made permanent by adding a second instance to
+	  /etc/fstab.
+	  <informalexample>
+	    <programlisting>
+proc /proc           proc defaults 0 0
+proc /var/named/proc proc defaults 0 0</programlisting>
+	  </informalexample>
+	</para>
+      </answer>
+    </qandaentry>
     
     </qandadiv> <!-- Linux -->
     
@@ -1310,8 +1476,7 @@ rand_irqs="3 14 15"</programlisting>
 	<para>
 	  See also
 	  <ulink url="http://people.freebsd.org/~dougb/randomness.html">
-	    http://people.freebsd.org/~dougb/randomness.html
-	  </ulink>
+	  &lt;http://people.freebsd.org/~dougb/randomness.html&gt;</ulink>.
 	</para>
       </answer>
     </qandaentry>
@@ -1333,13 +1498,77 @@ rand_irqs="3 14 15"</programlisting>
 	<para>
 	  <ulink
 	  url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris">
-	     http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+	 &lt;http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris&gt;
 	  </ulink>
 	</para>
       </answer>
     </qandaentry>
     
     </qandadiv>
+
+    <qandadiv><title>Apple Mac OS X</title>
+
+    <qandaentry>
+      <question>
+	<para>
+	  How do I run BIND 9 on Apple Mac OS X?
+	</para>
+      </question>
+      <answer>
+	<para>
+	 If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
+	</para>
+	<informalexample>
+	  <programlisting>
+% sudo rndc-confgen  > /etc/rndc.conf</programlisting>
+	</informalexample>
+	<para>
+	  Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:
+	</para>
+	<informalexample>
+	  <programlisting>
+key "rndc-key" {
+	algorithm hmac-md5;
+	secret "uvceheVuqf17ZwIcTydddw==";
+};</programlisting>
+	</informalexample>
+	<para>
+	  Then start the relevant service:
+	</para>
+	<informalexample>
+	  <programlisting>
+% sudo service org.isc.named start</programlisting>
+	</informalexample>
+	<para>
+	  This is persistent upon a reboot, so you will have to do it only once.
+	</para>
+      </answer>
+
+      <answer>
+	<para>
+	 Alternatively you can just generate /etc/rndc.key by running:
+	</para>
+	<informalexample>
+	  <programlisting>
+% sudo rndc-confgen -a</programlisting>
+	</informalexample>
+	<para>
+	  Then start the relevant service:
+	</para>
+	<informalexample>
+	  <programlisting>
+% sudo service org.isc.named start</programlisting>
+	</informalexample>
+	<para>
+	  Named will look for /etc/rndc.key when it starts if it
+	  doesn't have a controls section or the existing controls are
+	  missing keys sub-clauses.  This is persistent upon a
+	  reboot, so you will have to do it only once.
+	</para>
+      </answer>
+    </qandaentry>
+
+    </qandadiv>
     
     </qandadiv> <!-- Operating-System Specific Questions -->
 
diff --git a/README b/README
index 20fd84a13e44..0a0bc9e86f6d 100644
--- a/README
+++ b/README
@@ -42,6 +42,9 @@ BIND 9
 		Stichting NLnet - NLnet Foundation
 		Nominum, Inc.
 
+BIND 9.4.3
+
+	BIND 9.4.3 is a maintenance release, fixing bugs in 9.4.2.
 
 BIND 9.4.2
 
@@ -355,7 +358,7 @@ BIND 9.2.0
 	    This does not apply to the use of TSIG, which does not
 	    require OpenSSL.
 
-	  - The source distribution now builds on Windows NT/2000.
+	  - The source distribution now builds on Windows.
 	    See win32utils/readme1.txt and win32utils/win32-build.txt
 	    for details.
 
@@ -404,11 +407,8 @@ BIND 9.2.0
 
 		--with-libtool does not work on AIX.
 
-		--with-libtool does not work on SunOS 4.  configure
-		requires "printf" which is not available.
-
-	A bug in the Windows 2000 DNS server can cause zone transfers
-	from a BIND 9 server to a W2K server to fail.  For details,
+	A bug in some versions of the Microsoft DNS server can cause zone
+        transfers from a BIND 9 server to a W2K server to fail.  For details,
 	see the "Zone Transfers" section in doc/misc/migration.
 
 	For a detailed list of user-visible changes from
@@ -428,7 +428,11 @@ Building
 		NetBSD 1.5
 		Slackware Linux 8.1
 		Solaris 8, 9, 9 (x86)
-		Windows NT/2000/XP/2003
+		Windows XP/2003/2008
+
+        NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
+        Windows, including Windows NT and Windows 2000, are no longer
+        supported.
 
 	Additionally, we have unverified reports of success building
 	previous versions of BIND 9 from users of the following systems:
@@ -482,6 +486,14 @@ Building
 		  -DNS_CLIENT_DROPPORT=0
 		Disable support for "rrset-order fixed".
 		  -DDNS_RDATASET_FIXED=0
+		Sibling glue checking in named-checkzone is enabled by default.
+		To disable the default check set.  -DCHECK_SIBLING=0
+		named-checkzone checks out-of-zone addresses by default.
+		To disable this default set.  -DCHECK_LOCAL=0
+		Enable workaround for Solaris kernel bug about /dev/poll
+		  -DISC_SOCKET_USE_POLLWATCH=1
+		  The watch timeout is also configurable, e.g.,
+		  -DISC_SOCKET_POLLWATCH_TIMEOUT=20
 
 	    LDFLAGS
 		Linker flags. Defaults to empty string.
@@ -510,6 +522,10 @@ Building
 	To build libbind (the BIND 8 resolver library), specify
 	"--enable-libbind" on the configure command line.
 
+	On some platforms it is necessary to explictly request large
+	file support to handle files bigger than 2GB.  This can be
+	done by "--enable-largefile" on the configure command line.
+
 	On some platforms, BIND 9 can be built with multithreading
 	support, allowing it to take advantage of multiple CPUs.
 	You can specify whether to build a multithreaded BIND 9 
@@ -559,6 +575,9 @@ Building
 	on your system, and some require Perl; see bin/tests/system/README
 	for details.
 
+	SunOS 4 requires "printf" to be installed to make the shared
+	libraries.  sh-utils-1.16 provides a "printf" which compiles
+	on SunOS 4.
 
 Documentation
 
diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c
index 1f5f1cdc985b..2136a63a7588 100644
--- a/bin/check/check-tool.c
+++ b/bin/check/check-tool.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check-tool.c,v 1.10.18.18 2007/09/13 05:04:01 each Exp $ */
+/* $Id: check-tool.c,v 1.10.18.20 2008/10/24 01:43:17 tbox Exp $ */
 
 /*! \file */
 
@@ -46,6 +46,14 @@
 
 #include <isccfg/log.h>
 
+#ifndef CHECK_SIBLING
+#define CHECK_SIBLING 1
+#endif
+
+#ifndef CHECK_LOCAL
+#define CHECK_LOCAL 1
+#endif
+
 #ifdef HAVE_ADDRINFO
 #ifdef HAVE_GETADDRINFO
 #ifdef HAVE_GAISTRERROR
@@ -59,20 +67,29 @@
 		result = (r); \
 		if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
-	} while (0)   
+	} while (0)
 
 static const char *dbtype[] = { "rbt" };
 
 int debug = 0;
 isc_boolean_t nomerge = ISC_TRUE;
+#if CHECK_LOCAL
 isc_boolean_t docheckmx = ISC_TRUE;
 isc_boolean_t dochecksrv = ISC_TRUE;
 isc_boolean_t docheckns = ISC_TRUE;
-unsigned int zone_options = DNS_ZONEOPT_CHECKNS | 
+#else
+isc_boolean_t docheckmx = ISC_FALSE;
+isc_boolean_t dochecksrv = ISC_FALSE;
+isc_boolean_t docheckns = ISC_FALSE;
+#endif
+unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
 			    DNS_ZONEOPT_CHECKMX |
 			    DNS_ZONEOPT_MANYERRORS |
 			    DNS_ZONEOPT_CHECKNAMES |
 			    DNS_ZONEOPT_CHECKINTEGRITY |
+#if CHECK_SIBLING
+			    DNS_ZONEOPT_CHECKSIBLING |
+#endif
 			    DNS_ZONEOPT_CHECKWILDCARD |
 			    DNS_ZONEOPT_WARNMXCNAME |
 			    DNS_ZONEOPT_WARNSRVCNAME;
@@ -125,7 +142,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
@@ -297,7 +314,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
@@ -370,7 +387,7 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index cc63153e941a..96efd794661c 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named-checkconf.c,v 1.28.18.14 2006/02/28 03:10:47 marka Exp $ */
+/* $Id: named-checkconf.c,v 1.28.18.16 2007/11/26 23:46:18 tbox Exp $ */
 
 /*! \file */
 
@@ -224,7 +224,8 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 		else
 			zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
-	}
+	} else
+		zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 
 	obj = NULL;
 	if (get_maps(maps, "check-mx-cname", &obj)) {
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 08e958eae49c..f16053bcbb11 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named-checkzone.c,v 1.29.18.19 2007/08/28 07:19:55 tbox Exp $ */
+/* $Id: named-checkzone.c,v 1.29.18.21 2008/10/24 01:43:17 tbox Exp $ */
 
 /*! \file */
 
@@ -77,8 +77,9 @@ usage(void) {
 		"[-f inputformat] [-F outputformat] "
 		"[-t directory] [-w directory] [-k (ignore|warn|fail)] "
 		"[-n (ignore|warn|fail)] [-m (ignore|warn|fail)] "
-		"[-i (full|local|none)] [-M (ignore|warn|fail)] "
-		"[-S (ignore|warn|fail)] [-W (ignore|warn)] "
+		"[-i (full|full-sibling|local|local-sibling|none)] "
+		"[-M (ignore|warn|fail)] [-S (ignore|warn|fail)] "
+		"[-W (ignore|warn)] "
 		"zonename filename\n", prog_name);
 	exit(1);
 }
@@ -227,7 +228,7 @@ main(int argc, char **argv) {
 				zone_options &= ~DNS_ZONEOPT_FATALNS;
 			} else if (ARGCMP("fail")) {
 				zone_options |= DNS_ZONEOPT_CHECKNS|
-					        DNS_ZONEOPT_FATALNS;
+						DNS_ZONEOPT_FATALNS;
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index bf532807dcbe..c9df21eaf4b0 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dig.1,v 1.23.18.22 2007/05/16 06:11:27 marka Exp $
+.\" $Id: dig.1,v 1.23.18.24 2008/10/14 01:30:11 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -33,7 +33,7 @@
 dig \- DNS lookup utility
 .SH "SYNOPSIS"
 .HP 4
-\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
+\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
 .HP 4
 \fBdig\fR [\fB\-h\fR]
 .HP 4
@@ -59,7 +59,9 @@ Unless it is told to query a specific name server,
 will try each of the servers listed in
 \fI/etc/resolv.conf\fR.
 .PP
-When no command line arguments or options are given, will perform an NS query for "." (the root).
+When no command line arguments or options are given,
+\fBdig\fR
+will perform an NS query for "." (the root).
 .PP
 It is possible to set per\-user defaults for
 \fBdig\fR
@@ -70,9 +72,9 @@ The IN and CH class names overlap with the IN and CH top level domains names. Ei
 \fB\-t\fR
 and
 \fB\-c\fR
-options to specify the type and class or use the
+options to specify the type and class, use the
 \fB\-q\fR
-the specify the domain name or use "IN." and "CH." when looking up these top level domains.
+the specify the domain name, or use "IN." and "CH." when looking up these top level domains.
 .SH "SIMPLE USAGE"
 .PP
 A typical invocation of
@@ -139,6 +141,10 @@ operate in batch mode by reading a list of lookup requests to process from the f
 \fBdig\fR
 using the command\-line interface.
 .PP
+The
+\fB\-m\fR
+option enables memory usage debugging.
+.PP
 If a non\-standard port number is to be queried, the
 \fB\-p\fR
 option is used.
@@ -551,7 +557,7 @@ RFC1035.
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index ba5d87b24e98..5cde9c430e60 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.186.18.29 2007/08/28 07:19:55 tbox Exp $ */
+/* $Id: dig.c,v 1.186.18.33 2008/10/15 02:19:18 marka Exp $ */
 
 /*! \file */
 
@@ -50,7 +50,7 @@
 
 #define ADD_STRING(b, s) { 				\
 	if (strlen(s) >= isc_buffer_availablelength(b)) \
- 		return (ISC_R_NOSPACE); 		\
+		return (ISC_R_NOSPACE); 		\
 	else 						\
 		isc_buffer_putstr(b, s); 		\
 }
@@ -71,7 +71,7 @@ static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE;
 
 /*% opcode text */
-static const char *opcodetext[] = {
+static const char * const opcodetext[] = {
 	"QUERY",
 	"IQUERY",
 	"STATUS",
@@ -91,7 +91,7 @@ static const char *opcodetext[] = {
 };
 
 /*% return code text */
-static const char *rcodetext[] = {
+static const char * const rcodetext[] = {
 	"NOERROR",
 	"FORMERR",
 	"SERVFAIL",
@@ -144,8 +144,8 @@ help(void) {
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "                 (Use ixfr=version for type ixfr)\n"
 "        q-opt    is one of:\n"
-"                 -x dot-notation     (shortcut for in-addr lookups)\n"
-"                 -i                  (IP6.INT reverse IPv6 lookups)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
 "                 -f filename         (batch mode)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -p port             (specify port number)\n"
@@ -156,6 +156,7 @@ help(void) {
 "                 -y [hmac:]name:key  (specify named base64 tsig key)\n"
 "                 -4                  (use IPv4 query transport only)\n"
 "                 -6                  (use IPv6 query transport only)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]vc             (TCP mode)\n"
 "                 +[no]tcp            (TCP mode, alternate syntax)\n"
@@ -383,7 +384,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else 
+	else
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -392,7 +393,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
 
 	if (style != NULL)
 		dns_master_styledestroy(&style, mctx);
-  
+
 	return(result);
 }
 #endif
@@ -429,7 +430,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else 
+	else
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -638,7 +639,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 			strncat(lookup->cmdline, append, remaining);
 		}
 		if (first) {
-			snprintf(append, sizeof(append), 
+			snprintf(append, sizeof(append),
 				 ";; global options: %s %s\n",
 			       short_form ? "short_form" : "",
 			       printcmd ? "printcmd" : "");
@@ -716,7 +717,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK2("aaonly", "aaflag");
 			lookup->aaonly = state;
 			break;
-		case 'd': 
+		case 'd':
 			switch (cmd[2]) {
 			case 'd': /* additional */
 				FULLCHECK("additional");
@@ -801,13 +802,13 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK("defname");
 			usesearch = state;
 			break;
-		case 'n': /* dnssec */	
+		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			if (state && lookup->edns == -1)
 				lookup->edns = 0;
 			lookup->dnssec = state;
 			break;
-		case 'o': /* domain */	
+		case 'o': /* domain */
 			FULLCHECK("domain");
 			if (value == NULL)
 				goto need_value;
@@ -881,7 +882,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			goto invalid_option;
 		}
 		break;
-	case 'q': 
+	case 'q':
 		switch (cmd[1]) {
 		case 'r': /* qr */
 			FULLCHECK("qr");
@@ -957,11 +958,11 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			break;
 #ifdef DIG_SIGCHASE
 		case 'i': /* sigchase */
-		        FULLCHECK("sigchase");
+			FULLCHECK("sigchase");
 			lookup->sigchase = state;
 			if (lookup->sigchase)
 				lookup->dnssec = ISC_TRUE;
-			break;	
+			break;
 #endif
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -989,7 +990,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				timeout = 1;
 			break;
 #if DIG_SIGCHASE_TD
-		case 'o': /* topdown */	
+		case 'o': /* topdown */
 			FULLCHECK("topdown");
 			lookup->do_topdown = state;
 			break;
@@ -1024,7 +1025,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 #ifdef DIG_SIGCHASE
 			case 'u': /* trusted-key */
 				FULLCHECK("trusted-key");
-			  	if (value == NULL) 
+				if (value == NULL)
 					goto need_value;
 				if (!state)
 					goto invalid_option;
@@ -1158,7 +1159,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		hash = strchr(value, '#');
 		if (hash != NULL) {
 			srcport = (in_port_t)
-			  	parse_uint(hash + 1,
+				parse_uint(hash + 1,
 					   "port number", MAXPORT);
 			*hash = '\0';
 		} else
@@ -1211,7 +1212,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup) = clone_lookup(default_lookup,
 							 ISC_TRUE);
 			*need_clone = ISC_TRUE;
-			strncpy((*lookup)->textname, value, 
+			strncpy((*lookup)->textname, value,
 				sizeof((*lookup)->textname));
 			(*lookup)->textname[sizeof((*lookup)->textname)-1]=0;
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
@@ -1250,7 +1251,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->rdtypeset = ISC_TRUE;
 				(*lookup)->ixfr_serial =
 					parse_uint(&value[5], "serial number",
-					  	MAXSERIAL);
+						MAXSERIAL);
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
 			} else {
@@ -1276,7 +1277,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (ptr2 == NULL)
 			usage();
 		ptr3 = next_token(&value,":"); /* secret or NULL */
-		if (ptr3 != NULL) {	
+		if (ptr3 != NULL) {
 			if (strcasecmp(ptr, "hmac-md5") == 0) {
 				hmacname = DNS_TSIG_HMACMD5_NAME;
 				digestbits = 0;
@@ -1425,7 +1426,7 @@ getaddresses(dig_lookup_t *lookup, const char *host) {
 	char tmp[ISC_NETADDR_FORMATSIZE];
 
 	result = bind9_getaddresses(host, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count);   
+				    DIG_MAX_ADDRESSES, &count);
 	if (result != ISC_R_SUCCESS)
 	fatal("couldn't get address for '%s': %s",
 	      host, isc_result_totext(result));
@@ -1487,7 +1488,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (homedir != NULL) {
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
-			             homedir);
+				     homedir);
 			if (n < sizeof(rcfile))
 				batchfp = fopen(rcfile, "r");
 		}
@@ -1567,7 +1568,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					tr.base = rv[0];
 					tr.length = strlen(rv[0]);
 					result = dns_rdatatype_fromtext(&rdtype,
-					     	(isc_textregion_t *)&tr);
+						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
 					    rdtype == dns_rdatatype_ixfr) {
 						result = DNS_R_UNKNOWN;
@@ -1588,8 +1589,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 						lookup->rdtypeset = ISC_TRUE;
 						lookup->ixfr_serial =
 							parse_uint(&rv[0][5],
-							  	"serial number",
-							  	MAXSERIAL);
+								"serial number",
+								MAXSERIAL);
 						lookup->section_question =
 							plusquest;
 						lookup->comments = pluscomm;
@@ -1624,7 +1625,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					lookup = clone_lookup(default_lookup,
 								      ISC_TRUE);
 				need_clone = ISC_TRUE;
-				strncpy(lookup->textname, rv[0], 
+				strncpy(lookup->textname, rv[0],
 					sizeof(lookup->textname));
 				lookup->textname[sizeof(lookup->textname)-1]=0;
 				lookup->trace_root = ISC_TF(lookup->trace  ||
diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
index 6a28b8851a07..92be18050cf0 100644
--- a/bin/dig/dig.docbook
+++ b/bin/dig/dig.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dig.docbook,v 1.17.18.21 2007/08/28 07:19:55 tbox Exp $ -->
+<!-- $Id: dig.docbook,v 1.17.18.24 2008/10/14 00:54:40 marka Exp $ -->
 <refentry id="man.dig">
 
   <refentryinfo>
@@ -42,6 +42,7 @@
       <year>2005</year>
       <year>2006</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -61,6 +62,7 @@
       <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg><option>-f <replaceable class="parameter">filename</replaceable></option></arg>
       <arg><option>-k <replaceable class="parameter">filename</replaceable></option></arg>
+      <arg><option>-m</option></arg>
       <arg><option>-p <replaceable class="parameter">port#</replaceable></option></arg>
       <arg><option>-q <replaceable class="parameter">name</replaceable></option></arg>
       <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -118,8 +120,8 @@
     </para>
 
     <para>
-      When no command line arguments or options are given, will perform an
-      NS query for "." (the root).
+      When no command line arguments or options are given,
+      <command>dig</command> will perform an NS query for "." (the root).
     </para>
 
     <para>
@@ -132,8 +134,8 @@
     <para>
       The IN and CH class names overlap with the IN and CH top level
       domains names.  Either use the <option>-t</option> and
-      <option>-c</option> options to specify the type and class or
-      use the <option>-q</option> the specify the domain name or
+      <option>-c</option> options to specify the type and class, 
+      use the <option>-q</option> the specify the domain name, or
       use "IN." and "CH." when looking up these top level domains.
     </para>
 
@@ -231,6 +233,12 @@
     </para>
 
     <para>
+      The <option>-m</option> option enables memory usage debugging.
+      <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
+           documented in include/isc/mem.h -->
+    </para>
+
+    <para>
       If a non-standard port number is to be queried, the
       <option>-p</option> option is used.  <parameter>port#</parameter> is
       the port number that <command>dig</command> will send its
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index afdaa4f92e97..a8c459447f12 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dig.html,v 1.13.18.28 2007/05/16 06:11:27 marka Exp $ -->
+<!-- $Id: dig.html,v 1.13.18.30 2008/10/14 01:30:11 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -29,12 +29,12 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [<code class="option">-h</code>]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543508"></a><h2>DESCRIPTION</h2>
+<a name="id2543515"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -62,8 +62,8 @@
       <code class="filename">/etc/resolv.conf</code>.
     </p>
 <p>
-      When no command line arguments or options are given, will perform an
-      NS query for "." (the root).
+      When no command line arguments or options are given,
+      <span><strong class="command">dig</strong></span> will perform an NS query for "." (the root).
     </p>
 <p>
       It is possible to set per-user defaults for <span><strong class="command">dig</strong></span> via
@@ -74,13 +74,13 @@
 <p>
       The IN and CH class names overlap with the IN and CH top level
       domains names.  Either use the <code class="option">-t</code> and
-      <code class="option">-c</code> options to specify the type and class or
-      use the <code class="option">-q</code> the specify the domain name or
+      <code class="option">-c</code> options to specify the type and class, 
+      use the <code class="option">-q</code> the specify the domain name, or
       use "IN." and "CH." when looking up these top level domains.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543577"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543589"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -126,7 +126,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543668"></a><h2>OPTIONS</h2>
+<a name="id2543680"></a><h2>OPTIONS</h2>
 <p>
       The <code class="option">-b</code> option sets the source IP address of the query
       to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -152,6 +152,10 @@
       <span><strong class="command">dig</strong></span> using the command-line interface.
     </p>
 <p>
+      The <code class="option">-m</code> option enables memory usage debugging.
+      
+    </p>
+<p>
       If a non-standard port number is to be queried, the
       <code class="option">-p</code> option is used.  <em class="parameter"><code>port#</code></em> is
       the port number that <span><strong class="command">dig</strong></span> will send its
@@ -226,7 +230,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543939"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544028"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -545,7 +549,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545128"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545149"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -591,7 +595,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545258"></a><h2>IDN SUPPORT</h2>
+<a name="id2545211"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -605,14 +609,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545281"></a><h2>FILES</h2>
+<a name="id2545234"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545298"></a><h2>SEE ALSO</h2>
+<a name="id2545251"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -620,7 +624,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545335"></a><h2>BUGS</h2>
+<a name="id2545356"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 9e7e79659a69..8736c0cc75c5 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.259.18.43.10.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: dighost.c,v 1.259.18.49 2008/07/23 23:33:02 marka Exp $ */
 
 /*! \file
  *  \note
@@ -277,7 +277,7 @@ dns_name_t chase_name; /* the query name */
 /*
  * the current name is the parent name when we follow delegation
  */
-dns_name_t chase_current_name; 
+dns_name_t chase_current_name;
 /*
  * the child name is used for delegation (NS DS responses in AUTHORITY section)
  */
@@ -493,6 +493,7 @@ void
 fatal(const char *format, ...) {
 	va_list args;
 
+	fflush(stdout);
 	fprintf(stderr, "%s: ", progname);
 	va_start(args, format);
 	vfprintf(stderr, format, args);
@@ -510,6 +511,7 @@ debug(const char *format, ...) {
 	va_list args;
 
 	if (debugging) {
+		fflush(stdout);
 		va_start(args, format);
 		vfprintf(stderr, format, args);
 		va_end(args);
@@ -616,13 +618,13 @@ set_nameserver(char *opt) {
 		return;
 
 	result = bind9_getaddresses(opt, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count); 
+				    DIG_MAX_ADDRESSES, &count);
 	if (result != ISC_R_SUCCESS)
 		fatal("couldn't get address for '%s': %s",
 		      opt, isc_result_totext(result));
 
 	flush_server_list();
-	
+
 	for (i = 0; i < count; i++) {
 		isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
 		isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
@@ -891,7 +893,7 @@ setup_text_key(void) {
 	result = isc_base64_decodestring(keysecret, &secretbuf);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
-	
+
 	secretsize = isc_buffer_usedlength(&secretbuf);
 
 	result = dns_name_fromtext(&keyname, namebuf,
@@ -1025,7 +1027,7 @@ setup_system(void) {
 			domain  = NULL;
 		}
 	}
-			
+
 	if (ndots == -1) {
 		ndots = lwconf->ndots;
 		debug("ndots is %d.", ndots);
@@ -1088,7 +1090,7 @@ clear_searchlist(void) {
 void
 set_search_domain(char *domain) {
 	dig_searchlist_t *search;
-	
+
 	clear_searchlist();
 	search = make_searchlist_entry(domain);
 	ISC_LIST_APPEND(search_list, search, link);
@@ -1409,7 +1411,7 @@ start_lookup(void) {
 			current_lookup->qrdtype_sigchase
 				= current_lookup->qrdtype;
 			current_lookup->qrdtype = dns_rdatatype_ns;
-		   
+
 			current_lookup->rdclass_sigchase
 				= current_lookup->rdclass;
 			current_lookup->rdclass_sigchaseset
@@ -1490,7 +1492,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 	INSIST(!free_now);
 
 	debug("following up %s", query->lookup->textname);
-	
+
 	for (result = dns_message_firstname(msg, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(msg, section)) {
@@ -1545,7 +1547,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			dns_rdataset_current(rdataset, &rdata);
 
 			query->lookup->nsfound++;
-			(void)dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			check_result(result, "dns_rdata_tostruct");
 			dns_name_format(&ns.name, namestr, sizeof(namestr));
 			dns_rdata_freestruct(&ns);
 
@@ -1845,7 +1848,7 @@ setup_lookup(dig_lookup_t *lookup) {
 						&lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->oname);
-			fatal("'%s' is not in legal name syntax (%s)",
+			fatal("Origin '%s' is not in legal name syntax (%s)",
 			      lookup->origin->origin,
 			      isc_result_totext(result));
 		}
@@ -2089,7 +2092,7 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 
 	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
 	      b != NULL;
-	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
+	      b = ISC_LIST_HEAD(sevent->bufferlist))
 		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
 
 	query = event->ev_arg;
@@ -2169,7 +2172,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 				  &l->interval, global_task, connect_timeout,
 				  l, &l->timer);
 	check_result(result, "isc_timer_create");
-}	
+}
 
 static void
 connect_done(isc_task_t *task, isc_event_t *event);
@@ -2191,7 +2194,7 @@ send_tcp_connect(dig_query_t *query) {
 	query->waiting_connect = ISC_TRUE;
 	query->lookup->current_query = query;
 	get_address(query->servname, port, &query->sockaddr);
-	
+
 	if (specified_source &&
 	    (isc_sockaddr_pf(&query->sockaddr) !=
 	     isc_sockaddr_pf(&bind_address))) {
@@ -2663,7 +2666,8 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					goto next_rdata;
 				/* Now we have an SOA.  Work with it. */
 				debug("got an SOA");
-				(void)dns_rdata_tostruct(&rdata, &soa, NULL);
+				result = dns_rdata_tostruct(&rdata, &soa, NULL);
+				check_result(result, "dns_rdata_tostruct");
 				serial = soa.serial;
 				dns_rdata_freestruct(&soa);
 				if (!query->first_soa_rcvd) {
@@ -2826,13 +2830,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		char buf2[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_t any;
 
-		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET) 
+		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET)
 			isc_sockaddr_any(&any);
 		else
 			isc_sockaddr_any6(&any);
 
 		/*
-		* We don't expect a match when the packet is 
+		* We don't expect a match when the packet is
 		* sent to 0.0.0.0, :: or to a multicast addresses.
 		* XXXMPA broadcast needs to be handled here as well.
 		*/
@@ -2850,7 +2854,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
- 	result = dns_message_peekheader(b, &id, &msgflags);
+	result = dns_message_peekheader(b, &id, &msgflags);
 	if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
 		match = ISC_FALSE;
 		if (l->tcp_mode) {
@@ -2955,7 +2959,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
-            !l->ignore && !l->tcp_mode) {
+	    !l->ignore && !l->tcp_mode) {
 		printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
 		n->tcp_mode = ISC_TRUE;
@@ -2967,7 +2971,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		check_next_lookup(l);
 		UNLOCK_LOOKUP;
 		return;
-	}			
+	}
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
@@ -3093,7 +3097,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 
 			if (l->trace_root) {
 				/*
-				 * This is the initial NS query. 
+				 * This is the initial NS query.
 				 */
 				int n;
 
@@ -3108,7 +3112,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				if (!do_sigchase)
 #endif
 				printmessage(query, msg, ISC_TRUE);
-		} 
+		}
 #ifdef DIG_SIGCHASE
 		if (do_sigchase) {
 			chase_msg = isc_mem_allocate(mctx,
@@ -3127,13 +3131,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 
 			isc_buffer_usedregion(b, &r);
 			result = isc_buffer_allocate(mctx, &buf, r.length);
-	   
+
 			check_result(result, "isc_buffer_allocate");
 			result =  isc_buffer_copyregion(buf, &r);
 			check_result(result, "isc_buffer_copyregion");
-	   
+
 			result =  dns_message_parse(msg_temp, buf, 0);
- 
+
 			isc_buffer_free(&buf);
 			chase_msg->msg = msg_temp;
 
@@ -3149,9 +3153,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 #endif
 	}
-       
+
 #ifdef DIG_SIGCHASE
-	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {   
+	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {
 		sigchase(msg_temp);
 	}
 #endif
@@ -3308,7 +3312,7 @@ cancel_all(void) {
  */
 void
 destroy_libs(void) {
-#ifdef DIG_SIGCHASE 
+#ifdef DIG_SIGCHASE
 	void * ptr;
 	dig_message_t *chase_msg;
 #endif
@@ -3348,8 +3352,8 @@ destroy_libs(void) {
 	clear_searchlist();
 
 #ifdef WITH_IDN
-        result = dns_name_settotextfilter(NULL);
-        check_result(result, "dns_name_settotextfilter");
+	result = dns_name_settotextfilter(NULL);
+	check_result(result, "dns_name_settotextfilter");
 #endif
 	dns_name_destroy();
 
@@ -3421,7 +3425,7 @@ destroy_libs(void) {
 #endif
 
 	debug("Destroy memory");
-	
+
 #endif
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -3518,7 +3522,7 @@ append_textname(char *name, const char *origin, size_t namesize) {
 	(void)strcpy(name + namelen, origin);
 	return idn_success;
 }
- 
+
 static void
 idn_check_result(idn_result_t r, const char *msg) {
 	if (r != idn_success) {
@@ -3554,14 +3558,14 @@ void
 dump_database_section(dns_message_t *msg, int section)
 {
 	dns_name_t *msg_name=NULL;
- 
+
 	dns_rdataset_t *rdataset;
 
 	do {
 		dns_message_currentname(msg, section, &msg_name);
-    
+
 		for (rdataset = ISC_LIST_HEAD(msg_name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link)) {	
+		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
 			dns_name_print(msg_name, stdout);
 			printf("\n");
 			print_rdataset(msg_name, rdataset, mctx);
@@ -3578,15 +3582,15 @@ dump_database(void) {
 	for (msg = ISC_LIST_HEAD(chase_message_list);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_ANSWER);
-       
+
 		if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_AUTHORITY);
-	
+
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_ADDITIONAL);
 	}
 }
@@ -3616,7 +3620,7 @@ search_type(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers) {
 			if ((siginfo.covered == covers) ||
 			    (covers == dns_rdatatype_any)) {
 				dns_rdata_reset(&sigrdata);
-				dns_rdata_freestruct(&siginfo);	
+				dns_rdata_freestruct(&siginfo);
 				return (rdataset);
 			}
 			dns_rdata_reset(&sigrdata);
@@ -3654,7 +3658,7 @@ chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
 {
 	dns_rdataset_t *rdataset = NULL;
 	dig_message_t * msg;
- 
+
 	for (msg = ISC_LIST_HEAD(chase_message_list2);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
@@ -3747,7 +3751,7 @@ insert_trustedkey(dst_key_t * key)
 		return;
 
 	tk_list.key[tk_list.nb_tk++] = key;
-	return;   
+	return;
 }
 
 void
@@ -3770,7 +3774,7 @@ char alphnum[] =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 
 isc_result_t
-removetmpkey(isc_mem_t *mctx, const char *file) 
+removetmpkey(isc_mem_t *mctx, const char *file)
 {
 	char *tempnamekey = NULL;
 	int tempnamekeylen;
@@ -3783,7 +3787,7 @@ removetmpkey(isc_mem_t *mctx, const char *file)
 		return (ISC_R_NOMEMORY);
 
 	memset(tempnamekey, 0, tempnamekeylen);
- 
+
 	strcat(tempnamekey, file);
 	strcat(tempnamekey,".key");
 	isc_file_remove(tempnamekey);
@@ -3823,24 +3827,24 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 			isc_mem_free(mctx, tempname);
 			return (ISC_R_FAILURE);
 		}
-	    
+
 		x = cp--;
 		while (cp >= tempname && *cp == 'X') {
 			isc_random_get(&which);
 			*cp = alphnum[which % (sizeof(alphnum) - 1)];
 			x = cp--;
 		}
- 
+
 		tempnamekeylen = tempnamelen+5;
 		tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
 		if (tempnamekey == NULL)
 			return (ISC_R_NOMEMORY);
-	
+
 		memset(tempnamekey, 0, tempnamekeylen);
 		strncpy(tempnamekey, tempname, tempnamelen);
 		strcat(tempnamekey ,".key");
 
-	   
+
 		if (isc_file_exists(tempnamekey)) {
 			isc_mem_free(mctx, tempnamekey);
 			isc_mem_free(mctx, tempname);
@@ -3861,7 +3865,7 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 
  cleanup:
 	isc_mem_free(mctx, tempname);
-	
+
 	return (result);
 }
 
@@ -3875,7 +3879,7 @@ get_trusted_key(isc_mem_t *mctx)
 	char buf[1500];
 	FILE *fp, *fptemp;
 	dst_key_t *key = NULL;
- 
+
 	result = isc_file_exists(trustedkey);
 	if (result !=  ISC_TRUE) {
 		result = isc_file_exists("/etc/trusted-key.key");
@@ -3953,11 +3957,11 @@ nameFromString(const char *str, dns_name_t *p_ret) {
 
 	result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
 	check_result(result, "nameFromString");
-} 
+}
 
 
 #if DIG_SIGCHASE_TD
-isc_result_t 
+isc_result_t
 prepare_lookup(dns_name_t *name)
 {
 	isc_result_t result;
@@ -3975,7 +3979,7 @@ prepare_lookup(dns_name_t *name)
 	lookup->rdtype = lookup->rdtype_sigchase;
 	lookup->rdtypeset = ISC_TRUE;
 	lookup->qrdtype = lookup->qrdtype_sigchase;
-   
+
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p",
@@ -4008,12 +4012,11 @@ prepare_lookup(dns_name_t *name)
 
 		dns_rdataset_current(chase_nsrdataset, &rdata);
 
-		(void)dns_rdata_tostruct(&rdata, &ns, NULL);
-      
-     
-      
+		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		check_result(result, "dns_rdata_tostruct");
+
 #ifdef __FOLLOW_GLUE__
-      
+
 		result = advanced_rrsearch(&rdataset, &ns.name,
 					   dns_rdatatype_aaaa,
 					   dns_rdatatype_any, &true);
@@ -4037,12 +4040,12 @@ prepare_lookup(dns_name_t *name)
 
 
 				srv = make_server(namestr, namestr);
-	     
+
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
-      
+
 		rdataset = NULL;
 		result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
 					   dns_rdatatype_any, &true);
@@ -4064,28 +4067,28 @@ prepare_lookup(dns_name_t *name)
 				isc_buffer_free(&b);
 				dns_rdata_reset(&a);
 				printf("ns name: %s\n", namestr);
-      
+
 
 				srv = make_server(namestr, namestr);
-	     
+
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
 #else
-       
+
 		dns_name_format(&ns.name, namestr, sizeof(namestr));
 		printf("ns name: ");
 		dns_name_print(&ns.name, stdout);
 		printf("\n");
 		srv = make_server(namestr, namestr);
-	     
+
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 
-#endif 
+#endif
 		dns_rdata_freestruct(&ns);
 		dns_rdata_reset(&rdata);
-      
+
 	}
 
 	ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -4139,10 +4142,10 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)
 
 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);
-    
+
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
- 
+
 		if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
 			dns_rdata_freestruct(&siginfo);
 			dns_rdata_reset(&sigrdata);
@@ -4150,7 +4153,7 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)
 		}
 
 		dns_rdata_freestruct(&siginfo);
- 
+
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
 
 	dns_rdata_reset(&sigrdata);
@@ -4180,7 +4183,7 @@ initialization(dns_name_t *name)
 
 	return (ISC_R_SUCCESS);
 }
-#endif 
+#endif
 
 void
 print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
@@ -4204,10 +4207,10 @@ print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
 }
 
 
-void 
+void
 dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
-	isc_result_t result; 
- 
+	isc_result_t result;
+
 	if (dns_name_dynamic(target))
 		free_name(target, mctx);
 	result = dns_name_dup(source, mctx, target);
@@ -4226,7 +4229,7 @@ free_name(dns_name_t *name, isc_mem_t *mctx) {
  * return ISC_R_SUCCESS if the DNSKEY RRset contains a trusted_key
  * 			and the RRset is valid
  * return ISC_R_NOTFOUND if not contains trusted key
- 			or if the RRset isn't valid
+			or if the RRset isn't valid
  * return ISC_R_FAILURE if problem
  *
  */
@@ -4251,17 +4254,17 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(rdataset, &rdata);
 		INSIST(rdata.type == dns_rdatatype_dnskey);
-  	  
+
 		result = dns_dnssec_keyfromrdata(name, &rdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");
 
-    
+
 		for (i = 0; i < tk_list.nb_tk; i++) {
 			if (dst_key_compare(tk_list.key[i], dnsseckey)
 			    == ISC_TRUE) {
 				dns_rdata_reset(&rdata);
-	
+
 				printf(";; Ok, find a Trusted Key in the "
 				       "DNSKEY RRset: %d\n",
 				       dst_key_id(dnsseckey));
@@ -4276,7 +4279,7 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 				}
 			}
 		}
- 
+
 		dns_rdata_reset(&rdata);
 		if (dnsseckey != NULL)
 			dst_key_free(&dnsseckey);
@@ -4306,7 +4309,7 @@ sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(keyrdataset, &keyrdata);
 		INSIST(keyrdata.type == dns_rdatatype_dnskey);
-  	  
+
 		result = dns_dnssec_keyfromrdata(name, &keyrdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");
@@ -4338,22 +4341,22 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	result = dns_rdataset_first(sigrdataset);
 	check_result(result, "empty RRSIG dataset");
 	dns_rdata_init(&sigrdata);
-    
+
 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);
 
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
- 
+
 		/*
 		 * Test if the id of the DNSKEY is
 		 * the id of the DNSKEY signer's
 		 */
 		if (siginfo.keyid == dst_key_id(dnsseckey)) {
-    
+
 			result = dns_rdataset_first(rdataset);
 			check_result(result, "empty DS dataset");
-    
+
 			result = dns_dnssec_verify(name, rdataset, dnsseckey,
 						   ISC_FALSE, mctx, &sigrdata);
 
@@ -4370,7 +4373,7 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			}
 		}
 		dns_rdata_freestruct(&siginfo);
- 
+
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
 
 	dns_rdata_reset(&sigrdata);
@@ -4396,18 +4399,18 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 	dns_rdata_init(&dsrdata);
 	do {
 		dns_rdataset_current(dsrdataset, &dsrdata);
-    
+
 		result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
 		check_result(result, "dns_rdata_tostruct  for DS");
-    
+
 		result = dns_rdataset_first(keyrdataset);
 		check_result(result, "empty KEY dataset");
-		dns_rdata_init(&keyrdata);	  
+		dns_rdata_init(&keyrdata);
 
 		do {
 			dns_rdataset_current(keyrdataset, &keyrdata);
 			INSIST(keyrdata.type == dns_rdatatype_dnskey);
-  	  
+
 			result = dns_dnssec_keyfromrdata(name, &keyrdata,
 							 mctx, &dnsseckey);
 			check_result(result, "dns_dnssec_keyfromrdata");
@@ -4422,20 +4425,20 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 				result = dns_ds_buildrdata(name, &keyrdata,
 							   dsinfo.digest_type,
 							   dsbuf, &newdsrdata);
-				dns_rdata_freestruct(&dsinfo);  
+				dns_rdata_freestruct(&dsinfo);
 
 				if (result != ISC_R_SUCCESS) {
 					dns_rdata_reset(&keyrdata);
 					dns_rdata_reset(&newdsrdata);
 					dns_rdata_reset(&dsrdata);
 					dst_key_free(&dnsseckey);
-					dns_rdata_freestruct(&dsinfo);  
+					dns_rdata_freestruct(&dsinfo);
 					printf("Oops: impossible to build"
 					       " new DS rdata\n");
 					return (result);
 				}
-	
-	
+
+
 				if (dns_rdata_compare(&dsrdata,
 						      &newdsrdata) == 0) {
 					printf(";; OK a DS valids a DNSKEY"
@@ -4443,7 +4446,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 					printf(";; Now verify that this"
 					       " DNSKEY validates the "
 					       "DNSKEY RRset\n");
-	       
+
 					result = sigchase_verify_sig_key(name,
 							 keyrdataset,
 							 dnsseckey,
@@ -4454,7 +4457,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 						dns_rdata_reset(&newdsrdata);
 						dns_rdata_reset(&dsrdata);
 						dst_key_free(&dnsseckey);
-		 
+
 						return (result);
 					}
 				} else {
@@ -4468,12 +4471,12 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 			dnsseckey = NULL;
 		} while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
 		dns_rdata_reset(&keyrdata);
- 
+
 	} while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
 #if 0
 	dns_rdata_reset(&dsrdata); WARNING
 #endif
- 
+
 	return (ISC_R_NOTFOUND);
 }
 
@@ -4486,13 +4489,13 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
  * ISC_R_SUCCESS: if we found the rrset
  * ISC_R_NOTFOUND: we do not found the rrset in cache
  * and we do a query on the net
- * ISC_R_FAILURE: rrset not found 
+ * ISC_R_FAILURE: rrset not found
  */
 isc_result_t
 advanced_rrsearch(dns_rdataset_t **rdataset, dns_name_t *name,
 		  dns_rdatatype_t type, dns_rdatatype_t covers,
 		  isc_boolean_t *lookedup)
-{ 
+{
 	isc_boolean_t  tmplookedup;
 
 	INSIST(rdataset != NULL);
@@ -4567,7 +4570,7 @@ sigchase_td(dns_message_t *msg)
 		}
 	}
 
-   
+
 	if (have_answer) {
 		chase_rdataset
 			= chase_scanname_section(msg, &chase_name,
@@ -4627,7 +4630,7 @@ sigchase_td(dns_message_t *msg)
 						    chase_dsrdataset,
 						    mctx);
 		}
-      
+
 		if (result != ISC_R_SUCCESS) {
 			printf("\n;; chain of trust can't be validated:"
 			       " FAILED\n\n");
@@ -4679,7 +4682,7 @@ sigchase_td(dns_message_t *msg)
 			chase_sigrdataset = NULL;
 			have_response = ISC_FALSE;
 			have_delegation_ns = ISC_FALSE;
-	  
+
 			dns_name_init(&tmp_name, NULL);
 			result = child_of_zone(&chase_name, &chase_current_name,
 					       &tmp_name);
@@ -4758,10 +4761,10 @@ sigchase_td(dns_message_t *msg)
 		}
 		chase_keyrdataset = NULL;
 		chase_sigkeyrdataset = NULL;
-    
- 
+
+
 		prepare_lookup(&chase_authority_name);
-	
+
 		have_response = ISC_FALSE;
 		have_delegation_ns = ISC_FALSE;
 		delegation_follow = ISC_TRUE;
@@ -4855,7 +4858,7 @@ sigchase_td(dns_message_t *msg)
 	}
 }
 
-#endif 
+#endif
 
 
 #if DIG_SIGCHASE_BU
@@ -4872,7 +4875,7 @@ getneededrr(dns_message_t *msg)
 	if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
 	    != ISC_R_SUCCESS) {
 		printf(";; NO ANSWERS: %s\n", isc_result_totext(result));
-    
+
 		if (chase_name.ndata == NULL)
 			return (ISC_R_ADDRNOTAVAIL);
 	} else {
@@ -4915,7 +4918,7 @@ getneededrr(dns_message_t *msg)
 	}
 	INSIST(chase_sigrdataset != NULL);
 
- 
+
 	/* first find the DNSKEY name */
 	result = dns_rdataset_first(chase_sigrdataset);
 	check_result(result, "empty RRSIG dataset");
@@ -4926,7 +4929,7 @@ getneededrr(dns_message_t *msg)
 	dup_name(&siginfo.signer, &chase_signame, mctx);
 	dns_rdata_freestruct(&siginfo);
 	dns_rdata_reset(&sigrdata);
- 
+
 	/* Do we have a key?  */
 	if (chase_keyrdataset == NULL) {
 		result = advanced_rrsearch(&chase_keyrdataset,
@@ -4995,7 +4998,7 @@ getneededrr(dns_message_t *msg)
 			print_rdataset(&chase_signame, chase_dsrdataset, mctx);
 		}
 	}
- 
+
 	if (chase_dsrdataset != NULL) {
 		/*
 		 * if there is no RRSIG of DS,
@@ -5054,7 +5057,7 @@ sigchase_bu(dns_message_t *msg)
 		dns_name_init(&query_name, NULL);
 		dns_name_init(&rdata_name, NULL);
 		nameFromString(current_lookup->textname, &query_name);
-   
+
 		result = prove_nx(msg, &query_name, current_lookup->rdclass,
 				  current_lookup->rdtype, &rdata_name,
 				  &rdataset, &sigrdataset);
@@ -5076,7 +5079,7 @@ sigchase_bu(dns_message_t *msg)
 		}
 		printf(";; An NSEC prove the non-existence of a answers,"
 		       " Now we want validate this NSEC\n");
-	
+
 		dup_name(&rdata_name, &chase_name, mctx);
 		free_name(&rdata_name, mctx);
 		chase_rdataset =  rdataset;
@@ -5157,7 +5160,7 @@ sigchase_bu(dns_message_t *msg)
 	chase_sigdsrdataset = NULL;
 	chase_siglookedup = chase_keylookedup = ISC_FALSE;
 	chase_dslookedup = chase_sigdslookedup = ISC_FALSE;
- 
+
 	printf(";; Now, we want to validate the DS :  recursive call\n");
 	sigchase(msg);
 	return;
@@ -5250,7 +5253,7 @@ prove_nx_domain(dns_message_t *msg,
 		       " validate the non-existence : FAILED\n");
 		return (ISC_R_FAILURE);
 	}
- 
+
 	do {
 		nsecname = NULL;
 		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &nsecname);
@@ -5328,7 +5331,7 @@ prove_nx_type(dns_message_t *msg, dns_name_t *name, dns_rdataset_t *nsecset,
 
 	ret = dns_rdataset_first(nsecset);
 	check_result(ret,"dns_rdataset_first");
-	
+
 	dns_rdataset_current(nsecset, &nsec);
 
 	ret = dns_nsec_typepresent(&nsec, type);
@@ -5396,6 +5399,6 @@ prove_nx(dns_message_t *msg, dns_name_t *name, dns_rdataclass_t class,
 				      rdataset, sigrdataset);
 		return (ret);
 	}
-	/* Never get here */ 
+	/* Never get here */
 }
 #endif
diff --git a/bin/dig/host.1 b/bin/dig/host.1
index ee537bd47fa2..9993c0eac8da 100644
--- a/bin/dig/host.1
+++ b/bin/dig/host.1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: host.1,v 1.14.18.14 2007/05/09 03:33:12 marka Exp $
+.\" $Id: host.1,v 1.14.18.16 2008/04/06 01:31:04 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -154,7 +154,7 @@ option is used to select the query type.
 \fItype\fR
 can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
 \fBhost\fR
-automatically selects an appropriate query type. By default it looks for A records, but if the
+automatically selects an appropriate query type. By default it looks for A, AAAA, and MX records, but if the
 \fB\-C\fR
 option was given, queries will be made for SOA records, and if
 \fIname\fR
@@ -213,7 +213,7 @@ runs.
 \fBdig\fR(1),
 \fBnamed\fR(8).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
diff --git a/bin/dig/host.docbook b/bin/dig/host.docbook
index 8ab767902a5c..2c0ad3d7962f 100644
--- a/bin/dig/host.docbook
+++ b/bin/dig/host.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: host.docbook,v 1.5.18.11 2007/08/28 07:19:55 tbox Exp $ -->
+<!-- $Id: host.docbook,v 1.5.18.13 2008/04/05 23:46:04 tbox Exp $ -->
 <refentry id="man.host">
 
   <refentryinfo>
@@ -41,6 +41,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -199,7 +200,7 @@
       NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
       <command>host</command> automatically selects an appropriate
       query
-      type.  By default it looks for A records, but if the
+      type.  By default it looks for A, AAAA, and MX records, but if the
       <option>-C</option> option was given, queries will be made for SOA
       records, and if <parameter>name</parameter> is a
       dotted-decimal IPv4
diff --git a/bin/dig/host.html b/bin/dig/host.html
index adc9883a66fc..88cd830f033b 100644
--- a/bin/dig/host.html
+++ b/bin/dig/host.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: host.html,v 1.7.18.20 2007/05/09 03:33:12 marka Exp $ -->
+<!-- $Id: host.html,v 1.7.18.22 2008/04/06 01:31:04 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543428"></a><h2>DESCRIPTION</h2>
+<a name="id2543431"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -148,7 +148,7 @@
       NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
       <span><strong class="command">host</strong></span> automatically selects an appropriate
       query
-      type.  By default it looks for A records, but if the
+      type.  By default it looks for A, AAAA, and MX records, but if the
       <code class="option">-C</code> option was given, queries will be made for SOA
       records, and if <em class="parameter"><code>name</code></em> is a
       dotted-decimal IPv4
@@ -184,7 +184,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543725"></a><h2>IDN SUPPORT</h2>
+<a name="id2543797"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -198,12 +198,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543748"></a><h2>FILES</h2>
+<a name="id2543819"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543828"></a><h2>SEE ALSO</h2>
+<a name="id2543831"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>
diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8
index 542190b9b665..e667ba9b08e6 100644
--- a/bin/dnssec/dnssec-keygen.8
+++ b/bin/dnssec/dnssec-keygen.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-keygen.8,v 1.23.18.14 2007/05/09 03:33:12 marka Exp $
+.\" $Id: dnssec-keygen.8,v 1.23.18.16 2008/10/16 01:29:40 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -187,14 +187,14 @@ and
 .PP
 \fBdnssec\-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 2535,
+RFC 2539,
 RFC 2845,
-RFC 2539.
+RFC 4033.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
index 8e81cb4f6ee6..ec7b69be2f42 100644
--- a/bin/dnssec/dnssec-keygen.docbook
+++ b/bin/dnssec/dnssec-keygen.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dnssec-keygen.docbook,v 1.7.18.11 2007/08/28 07:20:00 tbox Exp $ -->
+<!-- $Id: dnssec-keygen.docbook,v 1.7.18.13 2008/10/15 23:46:06 tbox Exp $ -->
 <refentry id="man.dnssec-keygen">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -40,6 +40,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -340,9 +341,9 @@
         <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2535</citetitle>,
+      <citetitle>RFC 2539</citetitle>,
       <citetitle>RFC 2845</citetitle>,
-      <citetitle>RFC 2539</citetitle>.
+      <citetitle>RFC 4033</citetitle>.
     </para>
   </refsect1>
 
diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html
index 7ad747f2b031..e0b0bfe059aa 100644
--- a/bin/dnssec/dnssec-keygen.html
+++ b/bin/dnssec/dnssec-keygen.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-keygen.html,v 1.9.18.20 2007/05/09 03:33:12 marka Exp $ -->
+<!-- $Id: dnssec-keygen.html,v 1.9.18.22 2008/10/16 01:29:40 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543474"></a><h2>DESCRIPTION</h2>
+<a name="id2543477"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
       and RFC 4034.  It can also generate keys for use with
@@ -40,7 +40,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543485"></a><h2>OPTIONS</h2>
+<a name="id2543489"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -148,7 +148,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543820"></a><h2>GENERATED KEYS</h2>
+<a name="id2543824"></a><h2>GENERATED KEYS</h2>
 <p>
       When <span><strong class="command">dnssec-keygen</strong></span> completes
       successfully,
@@ -194,7 +194,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543902"></a><h2>EXAMPLE</h2>
+<a name="id2543906"></a><h2>EXAMPLE</h2>
 <p>
       To generate a 768-bit DSA key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -215,16 +215,16 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543946"></a><h2>SEE ALSO</h2>
+<a name="id2543949"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>,
+      <em class="citetitle">RFC 2539</em>,
       <em class="citetitle">RFC 2845</em>,
-      <em class="citetitle">RFC 2539</em>.
+      <em class="citetitle">RFC 4033</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544045"></a><h2>AUTHOR</h2>
+<a name="id2544049"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8
index d150c3fc15fe..680960ae8928 100644
--- a/bin/dnssec/dnssec-signzone.8
+++ b/bin/dnssec/dnssec-signzone.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-signzone.8,v 1.28.18.17 2007/05/09 03:33:12 marka Exp $
+.\" $Id: dnssec-signzone.8,v 1.28.18.19 2008/10/16 01:29:40 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -261,12 +261,12 @@ db.example.com.signed
 .PP
 \fBdnssec\-keygen\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 2535.
+RFC 4033.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 46cd4a74dfe2..9b4916910440 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.177.18.24 2007/08/28 07:20:00 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.177.18.26 2008/06/02 23:46:01 tbox Exp $ */
 
 /*! \file */
 
@@ -128,7 +128,6 @@ static dns_name_t *gorigin;		/* The database origin */
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
 static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE;
-static unsigned int assigned = 0, completed = 0;
 static isc_boolean_t nokeys = ISC_FALSE;
 static isc_boolean_t removefile = ISC_FALSE;
 static isc_boolean_t generateds = ISC_FALSE;
@@ -969,7 +968,7 @@ active_node(dns_dbnode_t *node) {
 			fatal("rdataset iteration failed: %s",
 			      isc_result_totext(result));
 	} else {
-		/* 
+		/*
 		 * Delete RRSIGs for types that no longer exist.
 		 */
 		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
@@ -1194,7 +1193,7 @@ signapex(void) {
 	dns_fixedname_t fixed;
 	dns_name_t *name;
 	isc_result_t result;
-	
+
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	result = dns_dbiterator_current(gdbiter, &node, name);
@@ -1224,16 +1223,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	dns_rdataset_t nsec;
 	isc_boolean_t found;
 	isc_result_t result;
+	static unsigned int ended = 0;		/* Protected by namelock. */
 
 	if (shuttingdown)
 		return;
 
+	LOCK(&namelock);
 	if (finished) {
-		if (assigned == completed) {
+		ended++;
+		if (ended == ntasks) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
-		return;
+		goto unlock;
 	}
 
 	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
@@ -1243,7 +1245,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	name = dns_fixedname_name(fname);
 	node = NULL;
 	found = ISC_FALSE;
-	LOCK(&namelock);
 	while (!found) {
 		result = dns_dbiterator_current(gdbiter, &node, name);
 		if (result != ISC_R_SUCCESS)
@@ -1270,14 +1271,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			fatal("failure iterating database: %s",
 			      isc_result_totext(result));
 	}
-	UNLOCK(&namelock);
 	if (!found) {
-		if (assigned == completed) {
+		ended++;
+		if (ended == ntasks) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
 		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
-		return;
+		goto unlock;
 	}
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
@@ -1288,7 +1289,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent->node = node;
 	sevent->fname = fname;
 	isc_task_send(worker, ISC_EVENT_PTR(&sevent));
-	assigned++;
+ unlock:
+	UNLOCK(&namelock);
 }
 
 /*%
@@ -1311,7 +1313,6 @@ writenode(isc_task_t *task, isc_event_t *event) {
 	isc_task_t *worker;
 	sevent_t *sevent = (sevent_t *)event;
 
-	completed++;
 	worker = (isc_task_t *)event->ev_sender;
 	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
 	cleannode(gdb, gversion, sevent->node);
@@ -1605,7 +1606,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	unsigned int filenamelen;
-	const dns_master_style_t *style = 
+	const dns_master_style_t *style =
 		(type == dns_rdatatype_dnskey) ? masterstyle : dsstyle;
 
 	isc_buffer_init(&namebuf, namestr, sizeof(namestr));
@@ -1818,13 +1819,13 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
 	printf("Signatures successfully verified:   %10d\n", nverified);
 	printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
 	runtime_ms = runtime_us / 1000;
-	printf("Runtime in seconds:                %7u.%03u\n", 
-	       (unsigned int) (runtime_ms / 1000), 
+	printf("Runtime in seconds:                %7u.%03u\n",
+	       (unsigned int) (runtime_ms / 1000),
 	       (unsigned int) (runtime_ms % 1000));
 	if (runtime_us > 0) {
 		sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
 		printf("Signatures per second:             %7u.%03u\n",
-		       (unsigned int) sig_ms / 1000, 
+		       (unsigned int) sig_ms / 1000,
 		       (unsigned int) sig_ms % 1000);
 	}
 }
@@ -1914,7 +1915,7 @@ main(int argc, char *argv[]) {
 				fatal("jitter must be numeric and positive");
 			break;
 
-		case 'l': 
+		case 'l':
 			dns_fixedname_init(&dlv_fixed);
 			len = strlen(isc_commandline_argument);
 			isc_buffer_init(&b, isc_commandline_argument, len);
@@ -2080,7 +2081,7 @@ main(int argc, char *argv[]) {
 	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
 					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
-					
+
 
 	gdb = NULL;
 	TIME_NOW(&timer_start);
@@ -2102,8 +2103,8 @@ main(int argc, char *argv[]) {
 						       DST_TYPE_PRIVATE,
 						       mctx, &newkey);
 			if (result != ISC_R_SUCCESS)
-				fatal("cannot load dnskey %s: %s", argv[i], 
-				      isc_result_totext(result)); 
+				fatal("cannot load dnskey %s: %s", argv[i],
+				      isc_result_totext(result));
 
 			key = ISC_LIST_HEAD(keylist);
 			while (key != NULL) {
@@ -2111,7 +2112,7 @@ main(int argc, char *argv[]) {
 				if (dst_key_id(dkey) == dst_key_id(newkey) &&
 				    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 				    dns_name_equal(dst_key_name(dkey),
-					    	   dst_key_name(newkey)))
+						   dst_key_name(newkey)))
 				{
 					if (!dst_key_isprivate(dkey))
 						fatal("cannot sign zone with "
@@ -2140,7 +2141,7 @@ main(int argc, char *argv[]) {
 					       mctx, &newkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("cannot load dnskey %s: %s", dskeyfile[i],
-			      isc_result_totext(result)); 
+			      isc_result_totext(result));
 
 		key = ISC_LIST_HEAD(keylist);
 		while (key != NULL) {
@@ -2148,7 +2149,7 @@ main(int argc, char *argv[]) {
 			if (dst_key_id(dkey) == dst_key_id(newkey) &&
 			    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 			    dns_name_equal(dst_key_name(dkey),
-				    	   dst_key_name(newkey)))
+					   dst_key_name(newkey)))
 			{
 				/* Override key flags. */
 				key->issigningkey = ISC_TRUE;
diff --git a/bin/dnssec/dnssec-signzone.docbook b/bin/dnssec/dnssec-signzone.docbook
index 8d928318ac27..67eacc143272 100644
--- a/bin/dnssec/dnssec-signzone.docbook
+++ b/bin/dnssec/dnssec-signzone.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dnssec-signzone.docbook,v 1.10.18.17 2007/08/28 07:20:00 tbox Exp $ -->
+<!-- $Id: dnssec-signzone.docbook,v 1.10.18.19 2008/10/15 23:46:06 tbox Exp $ -->
 <refentry id="man.dnssec-signzone">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -41,6 +41,7 @@
       <year>2005</year>
       <year>2006</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -459,7 +460,7 @@ db.example.com.signed
         <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2535</citetitle>.
+      <citetitle>RFC 4033</citetitle>.
     </para>
   </refsect1>
 
diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html
index e794d4c66a37..18d851d1fcd3 100644
--- a/bin/dnssec/dnssec-signzone.html
+++ b/bin/dnssec/dnssec-signzone.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-signzone.html,v 1.8.18.23 2007/05/09 03:33:12 marka Exp $ -->
+<!-- $Id: dnssec-signzone.html,v 1.8.18.25 2008/10/16 01:29:40 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543526"></a><h2>DESCRIPTION</h2>
+<a name="id2543529"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543541"></a><h2>OPTIONS</h2>
+<a name="id2543544"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -241,7 +241,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544327"></a><h2>EXAMPLE</h2>
+<a name="id2544330"></a><h2>EXAMPLE</h2>
 <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
       zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -270,14 +270,14 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544378"></a><h2>SEE ALSO</h2>
+<a name="id2544381"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>.
+      <em class="citetitle">RFC 4033</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544403"></a><h2>AUTHOR</h2>
+<a name="id2544406"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/bin/named/client.c b/bin/named/client.c
index 3b87d2648c0e..03cfdb6a714e 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.219.18.28.10.2 2008/07/23 07:28:54 tbox Exp $ */
+/* $Id: client.c,v 1.219.18.31 2008/05/22 23:46:03 tbox Exp $ */
 
 #include <config.h>
 
@@ -132,7 +132,7 @@ struct ns_clientmgr {
 #define MANAGER_MAGIC			ISC_MAGIC('N', 'S', 'C', 'm')
 #define VALID_MANAGER(m)		ISC_MAGIC_VALID(m, MANAGER_MAGIC)
 
-/*! 
+/*!
  * Client object states.  Ordering is significant: higher-numbered
  * states are generally "more active", meaning that the client can
  * have more dynamically allocated data, outstanding events, etc.
@@ -286,7 +286,7 @@ exit_check(ns_client_t *client) {
 	 *
 	 * Keep the view attached until any outstanding updates complete.
 	 */
-	if (client->nupdates == 0 && 
+	if (client->nupdates == 0 &&
 	    client->newstate == NS_CLIENTSTATE_FREED && client->view != NULL)
 		dns_view_detach(&client->view);
 
@@ -817,7 +817,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		if (ns_g_server->blackholeacl != NULL &&
 		    dns_acl_match(&netaddr, NULL,
-			    	  ns_g_server->blackholeacl,
+				  ns_g_server->blackholeacl,
 				  &ns_g_server->aclenv,
 				  &match, NULL) == ISC_R_SUCCESS &&
 		    match > 0)
@@ -834,7 +834,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_buffer_usedregion(buffer, &r);
 
 	CTRACE("sendto");
-	
+
 	result = isc_socket_sendto2(socket, &r, client->task,
 				    address, pktinfo,
 				    client->sendevent, sockflags);
@@ -1108,8 +1108,8 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 	/*
 	 * FORMERR loop avoidance:  If we sent a FORMERR message
 	 * with the same ID to the same client less than two
-	 * seconds ago, assume that we are in an infinite error 
-	 * packet dialog with a server for some protocol whose 
+	 * seconds ago, assume that we are in an infinite error
+	 * packet dialog with a server for some protocol whose
 	 * error responses look enough like DNS queries to
 	 * elicit a FORMERR response.  Drop a packet to break
 	 * the loop.
@@ -1534,7 +1534,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 * For IPv6 UDP queries, we get this from the pktinfo structure (if
 	 * supported).
 	 * If all the attempts fail (this can happen due to memory shortage,
-	 * etc), we regard this as an error for safety. 
+	 * etc), we regard this as an error for safety.
 	 */
 	if ((client->interface->flags & NS_INTERFACEFLAG_ANYADDR) == 0)
 		isc_netaddr_fromsockaddr(&destaddr, &client->interface->addr);
@@ -1595,7 +1595,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 							   view);
 			if (sigresult == ISC_R_SUCCESS)
 				tsig = client->message->tsigname;
-				
+
 			if (allowed(&netaddr, tsig, view->matchclients) &&
 			    allowed(&destaddr, tsig, view->matchdestinations) &&
 			    !((client->message->flags & DNS_MESSAGEFLAG_RD)
@@ -1726,7 +1726,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 
 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), ra ? "recursion available" :
-		      			     "recursion not available");
+					     "recursion not available");
 
 	/*
 	 * Adjust maximum UDP response size for this client.
@@ -1820,10 +1820,10 @@ get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {
 			return (result);
 
 		manager->mctxpool[manager->nextmctx] = clientmctx;
-		manager->nextmctx++;
-		if (manager->nextmctx == NMCTXS)
-			manager->nextmctx = 0;
 	}
+	manager->nextmctx++;
+	if (manager->nextmctx == NMCTXS)
+		manager->nextmctx = 0;
 #else
 	clientmctx = manager->mctx;
 #endif
@@ -2093,7 +2093,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {
 
 		if (ns_g_server->blackholeacl != NULL &&
 		    dns_acl_match(&netaddr, NULL,
-			    	  ns_g_server->blackholeacl,
+				  ns_g_server->blackholeacl,
 				  &ns_g_server->aclenv,
 				  &match, NULL) == ISC_R_SUCCESS &&
 		    match > 0)
@@ -2482,7 +2482,7 @@ ns_client_checkacl(ns_client_t *client,
 	isc_result_t result =
 		ns_client_checkaclsilent(client, acl, default_allow);
 
-	if (result == ISC_R_SUCCESS) 
+	if (result == ISC_R_SUCCESS)
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "%s approved", opname);
@@ -2538,16 +2538,16 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category,
 
 void
 ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,
-		 dns_rdataclass_t rdclass, char *buf, size_t len) 
+		 dns_rdataclass_t rdclass, char *buf, size_t len)
 {
-        char namebuf[DNS_NAME_FORMATSIZE];
-        char typebuf[DNS_RDATATYPE_FORMATSIZE];
-        char classbuf[DNS_RDATACLASS_FORMATSIZE];
-
-        dns_name_format(name, namebuf, sizeof(namebuf));
-        dns_rdatatype_format(type, typebuf, sizeof(typebuf));
-        dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
-        (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
+
+	dns_name_format(name, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
+	dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
+	(void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,
 		       classbuf);
 }
 
@@ -2575,7 +2575,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 			isc_mem_put(client->mctx, buf, len);
 			len += 1024;
 		} else if (result == ISC_R_SUCCESS)
-		        ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,
+			ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 				      "%s\n%.*s", reason,
 				       (int)isc_buffer_usedlength(&buffer),
@@ -2595,7 +2595,7 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 	const char *sep;
 
 	REQUIRE(VALID_MANAGER(manager));
-	      
+
 	LOCK(&manager->lock);
 	client = ISC_LIST_HEAD(manager->recursing);
 	while (client != NULL) {
diff --git a/bin/named/config.c b/bin/named/config.c
index 632960c15c37..233d9e097f26 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.47.18.32.10.3 2008/07/23 23:48:17 tbox Exp $ */
+/* $Id: config.c,v 1.47.18.35 2008/09/04 08:03:07 marka Exp $ */
 
 /*! \file */
 
@@ -403,7 +403,7 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 
 static isc_result_t
 get_masters_def(const cfg_obj_t *cctx, const char *name,
-	        const cfg_obj_t **ret)
+		const cfg_obj_t **ret)
 {
 	isc_result_t result;
 	const cfg_obj_t *masters = NULL;
@@ -521,7 +521,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			tresult = get_masters_def(config, listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ns_g_lctx, ISC_LOG_ERROR,
-                                    "masters \"%s\" not found", listname);
+				    "masters \"%s\" not found", listname);
 
 				result = tresult;
 				goto cleanup;
@@ -599,7 +599,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		if (keys[i] == NULL)
 			goto cleanup;
 		dns_name_init(keys[i], NULL);
-		
+
 		keystr = cfg_obj_asstring(key);
 		isc_buffer_init(&b, keystr, strlen(keystr));
 		isc_buffer_add(&b, strlen(keystr));
@@ -655,7 +655,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
-	
+
 	INSIST(keycount == addrcount);
 
 	*addrsp = addrs;
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index f0703cb06505..e8e36f3e5e52 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: controlconf.c,v 1.40.18.10.40.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: controlconf.c,v 1.40.18.14 2008/07/23 23:33:02 marka Exp $ */
 
 /*! \file */
 
@@ -345,9 +345,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	listener = conn->listener;
 	secret.rstart = NULL;
 
-        /* Is the server shutting down? */
-        if (listener->controls->shuttingdown)
-                goto cleanup;
+	/* Is the server shutting down? */
+	if (listener->controls->shuttingdown)
+		goto cleanup;
 
 	if (conn->ccmsg.result != ISC_R_SUCCESS) {
 		if (conn->ccmsg.result != ISC_R_CANCELED &&
@@ -364,9 +364,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	{
 		ccregion.rstart = isc_buffer_base(&conn->ccmsg.buffer);
 		ccregion.rend = isc_buffer_used(&conn->ccmsg.buffer);
-		if (secret.rstart != NULL)
-			isc_mem_put(listener->mctx, secret.rstart,
-				    REGION_SIZE(secret));
 		secret.rstart = isc_mem_get(listener->mctx, key->secret.length);
 		if (secret.rstart == NULL)
 			goto cleanup;
@@ -375,7 +372,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		result = isccc_cc_fromwire(&ccregion, &request, &secret);
 		if (result == ISC_R_SUCCESS)
 			break;
-		else if (result == ISCCC_R_BADAUTH) {
+		isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+		if (result == ISCCC_R_BADAUTH) {
 			/*
 			 * For some reason, request is non-NULL when
 			 * isccc_cc_fromwire returns ISCCC_R_BADAUTH.
@@ -396,7 +394,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(request)) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	isc_stdtime_get(&now);
@@ -407,17 +405,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	_ctrl = isccc_alist_lookup(request, "_ctrl");
 	if (_ctrl == NULL) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	if (isccc_cc_lookupuint32(_ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < now || (sent - CLOCKSKEW) > now) {
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
-			goto cleanup;
+			goto cleanup_request;
 		}
 	} else {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	/*
@@ -426,7 +424,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	if (isccc_cc_lookupuint32(_ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    now > exp) {
 		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	/*
@@ -436,16 +434,16 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	result = isccc_cc_checkdup(listener->controls->symtab, request, now);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_EXISTS)
-                        result = ISCCC_R_DUPLICATE; 
+			result = ISCCC_R_DUPLICATE;
 		log_invalid(&conn->ccmsg, result);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	if (conn->nonce != 0 &&
 	    (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS ||
 	     conn->nonce != nonce)) {
 		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
-		goto cleanup;
+		goto cleanup_request;
 	}
 
 	/*
@@ -459,7 +457,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 
 	result = isccc_cc_createresponse(request, now, now + 60, &response);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_request;
 	if (eresult != ISC_R_SUCCESS) {
 		isccc_sexpr_t *data;
 
@@ -467,7 +465,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			const char *estr = isc_result_totext(eresult);
 			if (isccc_cc_definestring(data, "err", estr) == NULL)
-				goto cleanup;
+				goto cleanup_response;
 		}
 	}
 
@@ -478,20 +476,20 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			char *str = (char *)isc_buffer_base(&text);
 			if (isccc_cc_definestring(data, "text", str) == NULL)
-				goto cleanup;
+				goto cleanup_response;
 		}
 	}
 
 	_ctrl = isccc_alist_lookup(response, "_ctrl");
 	if (_ctrl == NULL ||
 	    isccc_cc_defineuint32(_ctrl, "_nonce", conn->nonce) == NULL)
-		goto cleanup;
+		goto cleanup_response;
 
 	ccregion.rstart = conn->buffer + 4;
 	ccregion.rend = conn->buffer + sizeof(conn->buffer);
 	result = isccc_cc_towire(response, &ccregion, &secret);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_response;
 	isc_buffer_init(&b, conn->buffer, 4);
 	len = sizeof(conn->buffer) - REGION_SIZE(ccregion);
 	isc_buffer_putuint32(&b, len - 4);
@@ -500,31 +498,27 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 
 	result = isc_socket_send(conn->sock, &r, task, control_senddone, conn);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_response;
 	conn->sending = ISC_TRUE;
 
-	if (secret.rstart != NULL)
-		isc_mem_put(listener->mctx, secret.rstart,
-			    REGION_SIZE(secret));
-	if (request != NULL)
-		isccc_sexpr_free(&request);
-	if (response != NULL)
-		isccc_sexpr_free(&response);
+	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+	isccc_sexpr_free(&request);
+	isccc_sexpr_free(&response);
 	return;
 
+ cleanup_response:
+	isccc_sexpr_free(&response);
+
+ cleanup_request:
+	isccc_sexpr_free(&request);
+	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+
  cleanup:
-	if (secret.rstart != NULL)
-		isc_mem_put(listener->mctx, secret.rstart,
-			    REGION_SIZE(secret));
 	isc_socket_detach(&conn->sock);
 	isccc_ccmsg_invalidate(&conn->ccmsg);
 	conn->ccmsg_valid = ISC_FALSE;
 	maybe_free_connection(conn);
 	maybe_free_listener(listener);
-	if (request != NULL)
-		isccc_sexpr_free(&request);
-	if (response != NULL)
-		isccc_sexpr_free(&response);
 }
 
 static void
@@ -548,7 +542,7 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 	conn = isc_mem_get(listener->mctx, sizeof(*conn));
 	if (conn == NULL)
 		return (ISC_R_NOMEMORY);
-	
+
 	conn->sock = sock;
 	isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg);
 	conn->ccmsg_valid = ISC_TRUE;
@@ -660,7 +654,7 @@ ns_controls_shutdown(ns_controls_t *controls) {
 
 static isc_result_t
 cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
-	        const cfg_obj_t **objp)
+		const cfg_obj_t **objp)
 {
 	const cfg_listelt_t *element;
 	const char *str;
@@ -808,7 +802,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 		 if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
 	} while (0)
-		
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -828,14 +822,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));
 
 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	if (keyid == NULL) 
+	if (keyid == NULL)
 		CHECK(ISC_R_NOMEMORY);
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
 	keyid->secret.base = NULL;
 	keyid->secret.length = 0;
 	ISC_LINK_INIT(keyid, link);
-	if (keyid->keyname == NULL) 
+	if (keyid->keyname == NULL)
 		CHECK(ISC_R_NOMEMORY);
 
 	CHECK(bind9_check_key(key, ns_g_lctx));
@@ -891,7 +885,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		cfg_parser_destroy(&pctx);
 	return (result);
 }
-			
+
 /*
  * Ensures that both '*global_keylistp' and '*control_keylistp' are
  * valid or both are NULL.
@@ -925,7 +919,7 @@ static void
 update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *control, const cfg_obj_t *config,
 		isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
-	        const char *socktext, isc_sockettype_t type)
+		const char *socktext, isc_sockettype_t type)
 {
 	controllistener_t *listener;
 	const cfg_obj_t *allow;
@@ -945,7 +939,7 @@ update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		*listenerp = NULL;
 		return;
 	}
-		
+
 	/*
 	 * There is already a listener for this sockaddr.
 	 * Update the access list and key information.
@@ -1339,7 +1333,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
 
 				update_listener(cp, &listener, control, config,
 						&addr, aclconfctx,
-					        cfg_obj_asstring(path),
+						cfg_obj_asstring(path),
 						isc_sockettype_unix);
 
 				if (listener != NULL)
@@ -1385,10 +1379,10 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
 			isc_sockaddr_setport(&addr, NS_CONTROL_PORT);
 
 			isc_sockaddr_format(&addr, socktext, sizeof(socktext));
-			
+
 			update_listener(cp, &listener, NULL, NULL,
 					&addr, NULL, socktext,
-				        isc_sockettype_tcp);
+					isc_sockettype_tcp);
 
 			if (listener != NULL)
 				/*
diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h
index 11f3989460e9..9c86afd46d5f 100644
--- a/bin/named/include/named/globals.h
+++ b/bin/named/include/named/globals.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: globals.h,v 1.64.18.4 2006/03/02 00:37:21 marka Exp $ */
+/* $Id: globals.h,v 1.64.18.6 2008/10/24 01:43:17 tbox Exp $ */
 
 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -48,6 +48,7 @@ EXTERN isc_taskmgr_t *		ns_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	ns_g_dispatchmgr	INIT(NULL);
 EXTERN isc_entropy_t *		ns_g_entropy		INIT(NULL);
 EXTERN isc_entropy_t *		ns_g_fallbackentropy	INIT(NULL);
+EXTERN unsigned int		ns_g_cpus_detected	INIT(1);
 
 /*
  * XXXRTH  We're going to want multiple timer managers eventually.  One
diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index 2a82c9874764..08d33d9912c5 100644
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: interfacemgr.c,v 1.76.18.8.44.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: interfacemgr.c,v 1.76.18.11 2008/07/23 23:33:02 marka Exp $ */
 
 /*! \file */
 
@@ -90,7 +90,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	mgr->generation = 1;
 	mgr->listenon4 = NULL;
 	mgr->listenon6 = NULL;
-	
+
 	ISC_LIST_INIT(mgr->interfaces);
 	ISC_LIST_INIT(mgr->listenon);
 
@@ -323,7 +323,7 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 		goto tcp_listen_failure;
 	}
 
-	/* 
+	/*
 	 * If/when there a multiple filters listen to the
 	 * result.
 	 */
@@ -510,7 +510,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 	unsigned int prefixlen;
 
 	family = interface->address.family;
-	
+
 	elt.type = dns_aclelementtype_ipprefix;
 	elt.negative = ISC_FALSE;
 	elt.u.ip_prefix.address = interface->address;
@@ -550,7 +550,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 static void
 setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	       in_port_t port)
-{ 
+{
 	isc_sockaddr_t *addr;
 	isc_sockaddr_t *old;
 
@@ -564,7 +564,7 @@ setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	     old != NULL;
 	     old = ISC_LIST_NEXT(old, link))
 		if (isc_sockaddr_equal(addr, old))
-			break;	
+			break;
 
 	if (old != NULL)
 		isc_mem_put(mgr->mctx, addr, sizeof(*addr));
@@ -700,7 +700,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 	{
 		isc_interface_t interface;
 		ns_listenlist_t *ll;
-		unsigned int family; 
+		unsigned int family;
 
 		result = isc_interfaceiter_current(iter, &interface);
 		if (result != ISC_R_SUCCESS)
@@ -882,7 +882,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "interface iteration failed: %s",
 				 isc_result_totext(result));
-	else 
+	else
 		result = ISC_R_SUCCESS;
  cleanup_iter:
 	isc_interfaceiter_destroy(&iter);
@@ -913,7 +913,7 @@ ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 
 	/*
 	 * Warn if we are not listening on any interface, unless
-	 * we're in lwresd-only mode, in which case that is to 
+	 * we're in lwresd-only mode, in which case that is to
 	 * be expected.
 	 */
 	if (ext_listen == NULL &&
diff --git a/bin/named/lwaddr.c b/bin/named/lwaddr.c
index 78c2b0b85184..02e8f4de3be5 100644
--- a/bin/named/lwaddr.c
+++ b/bin/named/lwaddr.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwaddr.c,v 1.4.18.2 2005/04/29 00:15:23 marka Exp $ */
+/* $Id: lwaddr.c,v 1.4.18.4 2008/01/11 23:45:59 tbox Exp $ */
 
 /*! \file */
 
@@ -81,7 +81,7 @@ lwaddr_lwresaddr_fromnetaddr(lwres_addr_t *la, isc_netaddr_t *na) {
 	} else {
 		la->family = LWRES_ADDRTYPE_V6;
 		la->length = 16;
-		memcpy(la->address, &na->type.in, 16);
+		memcpy(la->address, &na->type.in6, 16);
 	}
 	return (ISC_R_SUCCESS);
 }
diff --git a/bin/named/lwdgnba.c b/bin/named/lwdgnba.c
index a500d278896e..a54d44375124 100644
--- a/bin/named/lwdgnba.c
+++ b/bin/named/lwdgnba.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwdgnba.c,v 1.16.18.2 2005/04/29 00:15:24 marka Exp $ */
+/* $Id: lwdgnba.c,v 1.16.18.4 2008/01/14 23:45:59 tbox Exp $ */
 
 /*! \file */
 
@@ -220,8 +220,6 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
 		goto out;
-	if (req->addr.address == NULL)
-		goto out;
 
 	client->options = 0;
 	if (req->addr.family == LWRES_ADDRTYPE_V4) {
diff --git a/bin/named/lwdnoop.c b/bin/named/lwdnoop.c
index fa591b41a245..69cc957e261c 100644
--- a/bin/named/lwdnoop.c
+++ b/bin/named/lwdnoop.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwdnoop.c,v 1.7.18.2 2005/04/29 00:15:25 marka Exp $ */
+/* $Id: lwdnoop.c,v 1.7.18.4 2008/01/22 23:27:05 tbox Exp $ */
 
 /*! \file */
 
@@ -44,7 +44,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	result = lwres_nooprequest_parse(client->clientmgr->lwctx,
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
-		goto out;
+		goto send_error;
 
 	client->pkt.recvlength = LWRES_RECVLENGTH;
 	client->pkt.authtype = 0; /* XXXMLG */
@@ -57,7 +57,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	lwres = lwres_noopresponse_render(client->clientmgr->lwctx, &resp,
 					  &client->pkt, &lwb);
 	if (lwres != LWRES_R_SUCCESS)
-		goto out;
+		goto cleanup_req;
 
 	r.base = lwb.base;
 	r.length = lwb.used;
@@ -65,7 +65,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	client->sendlength = r.length;
 	result = ns_lwdclient_sendreply(client, &r);
 	if (result != ISC_R_SUCCESS)
-		goto out;
+		goto cleanup_lwb;
 
 	/*
 	 * We can now destroy request.
@@ -76,13 +76,12 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 
 	return;
 
- out:
-	if (req != NULL)
-		lwres_nooprequest_free(client->clientmgr->lwctx, &req);
+ cleanup_lwb:
+	lwres_context_freemem(client->clientmgr->lwctx, lwb.base, lwb.length);
 
-	if (lwb.base != NULL)
-		lwres_context_freemem(client->clientmgr->lwctx,
-				      lwb.base, lwb.length);
+ cleanup_req:
+	lwres_nooprequest_free(client->clientmgr->lwctx, &req);
 
+ send_error:
 	ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);
 }
diff --git a/bin/named/lwresd.8 b/bin/named/lwresd.8
index 825645aa1eaa..827edcd65737 100644
--- a/bin/named/lwresd.8
+++ b/bin/named/lwresd.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwresd.8,v 1.15.18.12 2007/05/16 06:11:27 marka Exp $
+.\" $Id: lwresd.8,v 1.15.18.13 2008/10/17 01:29:23 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -85,9 +85,9 @@ Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/lwresd.conf\fR.
-<term>\-c</term>
+\fB\-c\fR
 can not be used with
-<term>\-C</term>.
+\fB\-C\fR.
 .RE
 .PP
 \-C \fIconfig\-file\fR
@@ -96,9 +96,9 @@ Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/resolv.conf\fR.
-<term>\-C</term>
+\fB\-C\fR
 can not be used with
-<term>\-c</term>.
+\fB\-c\fR.
 .RE
 .PP
 \-d \fIdebug\-level\fR
@@ -217,7 +217,7 @@ The default process\-id file.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
diff --git a/bin/named/lwresd.c b/bin/named/lwresd.c
index 1f7184e72dcc..8a89b1c764ce 100644
--- a/bin/named/lwresd.c
+++ b/bin/named/lwresd.c
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwresd.c,v 1.46.18.7.52.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: lwresd.c,v 1.46.18.10 2008/07/23 23:33:02 marka Exp $ */
 
-/*! \file 
+/*! \file
  * \brief
  * Main program for the Lightweight Resolver Daemon.
  *
@@ -224,7 +224,7 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
 			for (i = 0; i < lwc->searchnxt; i++) {
 				CHECK(buffer_putstr(&b, "\t\t\""));
 				CHECK(buffer_putstr(&b, lwc->search[i]));
-			        CHECK(buffer_putstr(&b, "\";\n"));
+				CHECK(buffer_putstr(&b, "\";\n"));
 			}
 			CHECK(buffer_putstr(&b, "\t};\n"));
 		}
diff --git a/bin/named/lwresd.docbook b/bin/named/lwresd.docbook
index 5b3143e6e5b4..6dd2c40adf61 100644
--- a/bin/named/lwresd.docbook
+++ b/bin/named/lwresd.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwresd.docbook,v 1.7.18.8 2007/08/28 07:20:01 tbox Exp $ -->
+<!-- $Id: lwresd.docbook,v 1.7.18.10 2008/10/16 23:46:00 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -40,6 +40,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -145,7 +146,7 @@
             configuration file instead of the default,
             <filename>/etc/lwresd.conf</filename>.
 	    <!-- Should this be an absolute path name? -->
-	    <term>-c</term> can not be used with <term>-C</term>.
+	    <option>-c</option> can not be used with <option>-C</option>.
           </para>
         </listitem>
       </varlistentry>
@@ -157,7 +158,7 @@
             Use <replaceable class="parameter">config-file</replaceable> as the
             configuration file instead of the default,
             <filename>/etc/resolv.conf</filename>.
-	    <term>-C</term> can not be used with <term>-c</term>.
+	    <option>-C</option> can not be used with <option>-c</option>.
           </para>
         </listitem>
       </varlistentry>
diff --git a/bin/named/lwresd.html b/bin/named/lwresd.html
index b59a7cc72581..463e6b0ee3cf 100644
--- a/bin/named/lwresd.html
+++ b/bin/named/lwresd.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwresd.html,v 1.5.18.18 2007/05/16 06:11:27 marka Exp $ -->
+<!-- $Id: lwresd.html,v 1.5.18.19 2008/10/17 01:29:23 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543461"></a><h2>DESCRIPTION</h2>
+<a name="id2543464"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">lwresd</strong></span>
       is the daemon providing name lookup
       services to clients that use the BIND 9 lightweight resolver
@@ -67,7 +67,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543508"></a><h2>OPTIONS</h2>
+<a name="id2543511"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -87,14 +87,14 @@
             configuration file instead of the default,
             <code class="filename">/etc/lwresd.conf</code>.
 	    
-	    <font color="red">&lt;term&gt;-c&lt;/term&gt;</font> can not be used with <font color="red">&lt;term&gt;-C&lt;/term&gt;</font>.
+	    <code class="option">-c</code> can not be used with <code class="option">-C</code>.
           </p></dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
 <dd><p>
             Use <em class="replaceable"><code>config-file</code></em> as the
             configuration file instead of the default,
             <code class="filename">/etc/resolv.conf</code>.
-	    <font color="red">&lt;term&gt;-C&lt;/term&gt;</font> can not be used with <font color="red">&lt;term&gt;-c&lt;/term&gt;</font>.
+	    <code class="option">-C</code> can not be used with <code class="option">-c</code>.
           </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
 <dd><p>
@@ -197,7 +197,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543925"></a><h2>FILES</h2>
+<a name="id2543928"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -210,14 +210,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543964"></a><h2>SEE ALSO</h2>
+<a name="id2543968"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
       <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543998"></a><h2>AUTHOR</h2>
+<a name="id2544002"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/bin/named/main.c b/bin/named/main.c
index 6b9b67e13550..d8b0a3345138 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: main.c,v 1.136.18.17 2006/11/10 18:51:14 marka Exp $ */
+/* $Id: main.c,v 1.136.18.21 2008/10/24 01:28:08 marka Exp $ */
 
 /*! \file */
 
@@ -33,6 +33,7 @@
 #include <isc/hash.h>
 #include <isc/os.h>
 #include <isc/platform.h>
+#include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -85,6 +86,7 @@ static char		program_name[ISC_DIR_NAMEMAX] = "named";
 static char		absolute_conffile[ISC_DIR_PATHMAX];
 static char		saved_command_line[512];
 static char		version[512];
+static unsigned int	maxsocks = 0;
 
 void
 ns_main_earlywarning(const char *format, ...) {
@@ -356,7 +358,8 @@ parse_command_line(int argc, char *argv[]) {
 
 	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
-			           "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) {
+					   "46c:C:d:fgi:lm:n:N:p:P:"
+					   "sS:t:u:vx:")) != -1) {
 		switch (ch) {
 		case '4':
 			if (disable4)
@@ -435,6 +438,10 @@ parse_command_line(int argc, char *argv[]) {
 			/* XXXRTH temporary syntax */
 			want_stats = ISC_TRUE;
 			break;
+		case 'S':
+			maxsocks = parse_int(isc_commandline_argument,
+					     "max number of sockets");
+			break;
 		case 't':
 			/* XXXJAB should we make a copy? */
 			ns_g_chrootdir = isc_commandline_argument;
@@ -466,17 +473,14 @@ parse_command_line(int argc, char *argv[]) {
 static isc_result_t
 create_managers(void) {
 	isc_result_t result;
-#ifdef ISC_PLATFORM_USETHREADS
-	unsigned int cpus_detected;
-#endif
+	unsigned int socks;
 
 #ifdef ISC_PLATFORM_USETHREADS
-	cpus_detected = isc_os_ncpus();
 	if (ns_g_cpus == 0)
-		ns_g_cpus = cpus_detected;
+		ns_g_cpus = ns_g_cpus_detected;
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		      cpus_detected, cpus_detected == 1 ? "" : "s",
+		      ns_g_cpus_detected, ns_g_cpus_detected == 1 ? "" : "s",
 		      ns_g_cpus, ns_g_cpus == 1 ? "" : "s");
 #else
 	ns_g_cpus = 1;
@@ -497,13 +501,19 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}
 
-	result = isc_socketmgr_create(ns_g_mctx, &ns_g_socketmgr);
+	result = isc_socketmgr_create2(ns_g_mctx, &ns_g_socketmgr, maxsocks);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
+	result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &socks);
+	if (result == ISC_R_SUCCESS) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER,
+			      ISC_LOG_INFO, "using up to %u sockets", socks);
+	}
 
 	result = isc_entropy_create(ns_g_mctx, &ns_g_entropy);
 	if (result != ISC_R_SUCCESS) {
@@ -550,6 +560,7 @@ destroy_managers(void) {
 static void
 setup(void) {
 	isc_result_t result;
+	isc_resourcevalue_t old_openfiles;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
 #endif
@@ -603,6 +614,13 @@ setup(void) {
 	}
 #endif
 
+#ifdef ISC_PLATFORM_USETHREADS
+	/*
+	 * Check for the number of cpu's before ns_os_chroot().
+	 */
+	ns_g_cpus_detected = isc_os_ncpus();
+#endif
+
 	ns_os_chroot(ns_g_chrootdir);
 
 	/*
@@ -656,6 +674,23 @@ setup(void) {
 				    &ns_g_initopenfiles);
 
 	/*
+	 * System resources cannot effectively be tuned on some systems.
+	 * Raise the limit in such cases for safety.
+	 */
+	old_openfiles = ns_g_initopenfiles;
+	ns_os_adjustnofile();
+	(void)isc_resource_getlimit(isc_resource_openfiles,
+				    &ns_g_initopenfiles);
+	if (old_openfiles != ns_g_initopenfiles) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "adjusted limit on open files from "
+			      "%" ISC_PRINT_QUADFORMAT "u to "
+			      "%" ISC_PRINT_QUADFORMAT "u",
+			      old_openfiles, ns_g_initopenfiles);
+	}
+
+	/*
 	 * If the named configuration filename is relative, prepend the current
 	 * directory's name before possibly changing to another directory.
 	 */
@@ -665,7 +700,7 @@ setup(void) {
 					       sizeof(absolute_conffile));
 		if (result != ISC_R_SUCCESS)
 			ns_main_earlyfatal("could not construct absolute path of "
-					   "configuration file: %s", 
+					   "configuration file: %s",
 					   isc_result_totext(result));
 		ns_g_conffile = absolute_conffile;
 	}
@@ -757,7 +792,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		if (debug)
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "scf_handle_create() failed: %s",
-			 		 scf_strerror(scf_error()));
+					 scf_strerror(scf_error()));
 		return (ISC_R_FAILURE);
 	}
 
diff --git a/bin/named/named.8 b/bin/named/named.8
index f5e82303024d..9487dac2e178 100644
--- a/bin/named/named.8
+++ b/bin/named/named.8
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.8,v 1.20.18.15 2007/06/20 02:26:58 marka Exp $
+.\" $Id: named.8,v 1.20.18.16 2008/09/01 02:29:00 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -33,7 +33,7 @@
 named \- Internet domain name server
 .SH "SYNOPSIS"
 .HP 6
-\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
+\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBnamed\fR
@@ -131,6 +131,21 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha
 .RE
 .RE
 .PP
+\-S \fI#max\-socks\fR
+.RS 4
+Allow
+\fBnamed\fR
+to use up to
+\fI#max\-socks\fR
+sockets.
+.RS
+.B "Warning:"
+This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because
+\fBnamed\fR
+reserves some file descriptors for its internal use.
+.RE
+.RE
+.PP
 \-t \fIdirectory\fR
 .RS 4
 Chroot to
@@ -230,7 +245,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
 .br
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 00c92a69c13a..a2ccbe07fb33 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.1.2.26 2007/08/19 23:26:13 marka Exp $
+.\" $Id: named.conf.5,v 1.1.2.27 2008/09/05 01:32:08 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -174,6 +174,7 @@ options {
 	port \fIinteger\fR;
 	querylog \fIboolean\fR;
 	recursing\-file \fIquoted_string\fR;
+	reserved\-sockets \fIinteger\fR;
 	random\-device \fIquoted_string\fR;
 	recursive\-clients \fIinteger\fR;
 	serial\-query\-rate \fIinteger\fR;
@@ -516,5 +517,5 @@ zone \fIstring\fR \fIoptional_class\fR {
 \fBrndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index 8635f9754fd6..32aa53742488 100644
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.conf.docbook,v 1.1.2.29.12.2 2008/07/23 23:48:17 tbox Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.1.2.31 2008/09/04 23:46:08 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>Aug 13, 2004</date>
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index 09e71a324cdd..f729988d4da1 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.1.2.35 2007/08/19 23:26:13 marka Exp $ -->
+<!-- $Id: named.conf.html,v 1.1.2.36 2008/09/05 01:32:08 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542042"></a><h2>DESCRIPTION</h2>
+<a name="id2543342"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
       for
       <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543367"></a><h2>ACL</h2>
+<a name="id2543370"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543383"></a><h2>KEY</h2>
+<a name="id2543386"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key <em class="replaceable"><code>domain_name</code></em> {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543402"></a><h2>MASTERS</h2>
+<a name="id2543405"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters <em class="replaceable"><code>string</code></em> [<span class="optional"
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543448"></a><h2>SERVER</h2>
+<a name="id2543451"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/pref
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543516"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543520"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543542"></a><h2>CONTROLS</h2>
+<a name="id2543545"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -117,7 +117,7 @@ controls {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543577"></a><h2>LOGGING</h2>
+<a name="id2543580"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -135,7 +135,7 @@ logging {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543616"></a><h2>LWRES</h2>
+<a name="id2543619"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -148,7 +148,7 @@ lwres {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543657"></a><h2>OPTIONS</h2>
+<a name="id2543660"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -172,6 +172,7 @@ options {<br>
 	port <em class="replaceable"><code>integer</code></em>;<br>
 	querylog <em class="replaceable"><code>boolean</code></em>;<br>
 	recursing-file <em class="replaceable"><code>quoted_string</code></em>;<br>
+	reserved-sockets <em class="replaceable"><code>integer</code></em>;<br>
 	random-device <em class="replaceable"><code>quoted_string</code></em>;<br>
 	recursive-clients <em class="replaceable"><code>integer</code></em>;<br>
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
@@ -313,7 +314,7 @@ options {<br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544401"></a><h2>VIEW</h2>
+<a name="id2544407"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -453,7 +454,7 @@ view <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544966"></a><h2>ZONE</h2>
+<a name="id2544972"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -538,12 +539,12 @@ zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><c
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545319"></a><h2>FILES</h2>
+<a name="id2545325"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545331"></a><h2>SEE ALSO</h2>
+<a name="id2545337"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
diff --git a/bin/named/named.docbook b/bin/named/named.docbook
index 74b41f5031b6..15d554c07f27 100644
--- a/bin/named/named.docbook
+++ b/bin/named/named.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.docbook,v 1.7.18.12 2007/08/28 07:20:01 tbox Exp $ -->
+<!-- $Id: named.docbook,v 1.7.18.14 2008/08/21 23:46:01 tbox Exp $ -->
 <refentry id="man.named">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -41,6 +41,7 @@
       <year>2005</year>
       <year>2006</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -64,6 +65,7 @@
       <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg>
       <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
       <arg><option>-s</option></arg>
+      <arg><option>-S <replaceable class="parameter">#max-socks</replaceable></option></arg>
       <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
       <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg>
       <arg><option>-v</option></arg>
@@ -215,6 +217,33 @@
       </varlistentry>
 
       <varlistentry>
+        <term>-S <replaceable class="parameter">#max-socks</replaceable></term>
+        <listitem>
+	  <para>
+	    Allow <command>named</command> to use up to
+	    <replaceable class="parameter">#max-socks</replaceable> sockets.
+	  </para>
+          <warning>
+            <para>
+              This option should be unnecessary for the vast majority
+              of users.
+	      The use of this option could even be harmful because the
+              specified value may exceed the limitation of the
+              underlying system API.
+	      It is therefore set only when the default configuration
+              causes exhaustion of file descriptors and the
+              operational environment is known to support the
+              specified number of sockets.
+	      Note also that the actual maximum number is normally a little
+              fewer than the specified value because
+	      <command>named</command> reserves some file descriptors
+	      for its internal use.
+            </para>
+          </warning>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term>-t <replaceable class="parameter">directory</replaceable></term>
         <listitem>
           <para>Chroot
diff --git a/bin/named/named.html b/bin/named/named.html
index 294ecce406a0..ed4f16a3e218 100644
--- a/bin/named/named.html
+++ b/bin/named/named.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.html,v 1.6.18.21 2007/06/20 02:26:58 marka Exp $ -->
+<!-- $Id: named.html,v 1.6.18.22 2008/09/01 02:29:00 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543452"></a><h2>DESCRIPTION</h2>
+<a name="id2543464"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543477"></a><h2>OPTIONS</h2>
+<a name="id2543489"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -126,6 +126,31 @@
             </p>
 </div>
 </dd>
+<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
+<dd>
+<p>
+	    Allow <span><strong class="command">named</strong></span> to use up to
+	    <em class="replaceable"><code>#max-socks</code></em> sockets.
+	  </p>
+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Warning</h3>
+<p>
+              This option should be unnecessary for the vast majority
+              of users.
+	      The use of this option could even be harmful because the
+              specified value may exceed the limitation of the
+              underlying system API.
+	      It is therefore set only when the default configuration
+              causes exhaustion of file descriptors and the
+              operational environment is known to support the
+              specified number of sockets.
+	      Note also that the actual maximum number is normally a little
+              fewer than the specified value because
+	      <span><strong class="command">named</strong></span> reserves some file descriptors
+	      for its internal use.
+            </p>
+</div>
+</dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
 <p>Chroot
@@ -191,7 +216,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543864"></a><h2>SIGNALS</h2>
+<a name="id2543911"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -212,7 +237,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543912"></a><h2>CONFIGURATION</h2>
+<a name="id2543959"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -221,7 +246,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543929"></a><h2>FILES</h2>
+<a name="id2543976"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -234,7 +259,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543969"></a><h2>SEE ALSO</h2>
+<a name="id2544016"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -247,7 +272,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544039"></a><h2>AUTHOR</h2>
+<a name="id2544086"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/bin/named/query.c b/bin/named/query.c
index 38eb9a13c15b..5cafbc9e45a8 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.257.18.40 2007/09/26 03:08:14 each Exp $ */
+/* $Id: query.c,v 1.257.18.46 2008/10/15 22:33:01 marka Exp $ */
 
 /*! \file */
 
@@ -2298,7 +2298,7 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 static isc_boolean_t
 get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 	dns_rdataset_t *keyrdataset, dst_key_t **keyp)
-{ 
+{
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	isc_boolean_t secure = ISC_FALSE;
@@ -2331,12 +2331,12 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-                                         client->mctx, keyp);
+					 client->mctx, keyp);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		if (rrsig->algorithm == (dns_secalg_t)dst_key_alg(*keyp) &&
-                    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
-                    dst_key_iszonekey(*keyp)) {
+		    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
+		    dst_key_iszonekey(*keyp)) {
 			secure = ISC_TRUE;
 			break;
 		}
@@ -2354,7 +2354,7 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
 	isc_boolean_t ignore = ISC_FALSE;
 
 	dns_fixedname_init(&fixed);
-	
+
 again:
 	result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx,
 				    rdata, NULL);
@@ -2382,7 +2382,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 
 	if (sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset))
 		return (ISC_FALSE);
-	
+
 	for (result = dns_rdataset_first(sigrdataset);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigrdataset)) {
@@ -2757,6 +2757,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 						   &olabels);
 			(void)dns_name_fullcompare(name, &nsec.next, &order,
 						   &nlabels);
+			/*
+			 * Check for a pathological condition created when
+			 * serving some malformed signed zones and bail out.
+			 */
+			if (dns_name_countlabels(name) == nlabels)
+				goto cleanup;
+
 			if (olabels > nlabels)
 				dns_name_split(name, olabels, NULL, wname);
 			else
@@ -2924,13 +2931,14 @@ query_resume(isc_task_t *task, isc_event_t *event) {
 
 static isc_result_t
 query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
-	      dns_rdataset_t *nameservers)
+	      dns_rdataset_t *nameservers, isc_boolean_t resuming)
 {
 	isc_result_t result;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	isc_sockaddr_t *peeraddr;
 
-	inc_stats(client, dns_statscounter_recursion);
+	if (!resuming)
+		inc_stats(client, dns_statscounter_recursion);
 
 	/*
 	 * We are about to recurse, which means that this client will
@@ -3162,11 +3170,11 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {
 
  cleanup:
 	if (nsec != NULL)
-                query_putrdataset(client, &nsec);
-        if (nsecsig != NULL)
-                query_putrdataset(client, &nsecsig);
-        if (fname != NULL)
-                query_releasename(client, &fname);
+		query_putrdataset(client, &nsec);
+	if (nsecsig != NULL)
+		query_putrdataset(client, &nsecsig);
+	if (fname != NULL)
+		query_releasename(client, &fname);
 }
 
 static inline void
@@ -3269,12 +3277,12 @@ warn_rfc1918(ns_client_t *client, dns_name_t *fname, dns_rdataset_t *rdataset) {
 	dns_rdata_soa_t soa;
 	dns_rdataset_t found;
 	isc_result_t result;
-	
+
 	for (i = 0; i < (sizeof(rfc1918names)/sizeof(*rfc1918names)); i++) {
 		if (dns_name_issubdomain(fname, &rfc1918names[i])) {
 			dns_rdataset_init(&found);
 			result = dns_ncache_getrdataset(rdataset,
-						        &rfc1918names[i],
+							&rfc1918names[i],
 							dns_rdatatype_soa,
 							&found);
 			if (result != ISC_R_SUCCESS)
@@ -3335,6 +3343,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	unsigned int options;
 	isc_boolean_t empty_wild;
 	dns_rdataset_t *noqname;
+	isc_boolean_t resuming;
 
 	CTRACE("query_find");
 
@@ -3360,6 +3369,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	need_wildcardproof = ISC_FALSE;
 	empty_wild = ISC_FALSE;
 	options = 0;
+	resuming = ISC_FALSE;
+	is_zone = ISC_FALSE;
 
 	if (event != NULL) {
 		/*
@@ -3369,7 +3380,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 
 		want_restart = ISC_FALSE;
 		authoritative = ISC_FALSE;
-		is_zone = ISC_FALSE;
 
 		qtype = event->qtype;
 		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
@@ -3402,6 +3412,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 
 		result = event->result;
+		resuming = ISC_TRUE;
 
 		goto resume;
 	}
@@ -3602,7 +3613,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 */
 			if (RECURSIONOK(client)) {
 				result = query_recurse(client, qtype,
-						       NULL, NULL);
+						       NULL, NULL, resuming);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -3773,10 +3784,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 */
 				if (dns_rdatatype_atparent(type))
 					result = query_recurse(client, qtype,
-							       NULL, NULL);
+							       NULL, NULL,
+							       resuming);
 				else
 					result = query_recurse(client, qtype,
-							       fname, rdataset);
+							       fname, rdataset,
+							       resuming);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -4220,7 +4233,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 						result = query_recurse(client,
 								       qtype,
 								       NULL,
-								       NULL);
+								       NULL,
+								       resuming);
 						if (result == ISC_R_SUCCESS)
 						    client->query.attributes |=
 							NS_QUERYATTR_RECURSING;
@@ -4437,6 +4451,7 @@ ns_query_start(ns_client_t *client) {
 	dns_rdataset_t *rdataset;
 	ns_client_t *qclient;
 	dns_rdatatype_t qtype;
+	isc_boolean_t want_ad;
 
 	CTRACE("ns_query_start");
 
@@ -4576,6 +4591,15 @@ ns_query_start(ns_client_t *client) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
 
 	/*
+	 * Set 'want_ad' if the client has set AD in the query.
+	 * This allows AD to be returned on queries without DO set.
+	 */
+	if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)
+		want_ad = ISC_TRUE;
+	else
+		want_ad = ISC_FALSE;
+
+	/*
 	 * This is an ordinary query.
 	 */
 	result = dns_message_reply(message, ISC_TRUE);
@@ -4594,7 +4618,7 @@ ns_query_start(ns_client_t *client) {
 	 * Set AD.  We must clear it if we add non-validated data to a
 	 * response.
 	 */
-	if (WANTDNSSEC(client))
+	if (WANTDNSSEC(client) || want_ad)
 		message->flags |= DNS_MESSAGEFLAG_AD;
 
 	qclient = NULL;
diff --git a/bin/named/server.c b/bin/named/server.c
index 79bd125c5498..784ff94d3414 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,13 +15,14 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.419.18.57.10.3 2008/07/23 12:04:32 marka Exp $ */
+/* $Id: server.c,v 1.419.18.68 2008/09/04 23:46:08 tbox Exp $ */
 
 /*! \file */
 
 #include <config.h>
 
 #include <stdlib.h>
+#include <unistd.h>
 
 #include <isc/app.h>
 #include <isc/base64.h>
@@ -31,8 +32,10 @@
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/resource.h>
+#include <isc/socket.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -197,6 +200,7 @@ static const struct {
 #endif
 
 	/* RFC 3330 */
+	{ "0.IN-ADDR.ARPA", ISC_FALSE },	/* THIS NETWORK */
 	{ "127.IN-ADDR.ARPA", ISC_FALSE },	/* LOOPBACK */
 	{ "254.169.IN-ADDR.ARPA", ISC_FALSE },	/* LINK LOCAL */
 	{ "2.0.192.IN-ADDR.ARPA", ISC_FALSE },	/* TEST NET */
@@ -438,7 +442,7 @@ configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	*target = keytable; /* Transfer ownership. */
 	keytable = NULL;
 	result = ISC_R_SUCCESS;
-	
+
  cleanup:
 	return (result);
 }
@@ -454,7 +458,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 	isc_boolean_t value;
 	isc_result_t result;
 	isc_buffer_t b;
-	
+
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	for (element = cfg_list_first(mbs);
@@ -472,7 +476,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 	}
 
 	result = ISC_R_SUCCESS;
-	
+
  cleanup:
 	return (result);
 }
@@ -482,13 +486,15 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
  */
 static isc_result_t
 get_view_querysource_dispatch(const cfg_obj_t **maps,
-			      int af, dns_dispatch_t **dispatchp)
+			      int af, dns_dispatch_t **dispatchp,
+			      isc_boolean_t is_firstview)
 {
 	isc_result_t result;
 	dns_dispatch_t *disp;
 	isc_sockaddr_t sa;
 	unsigned int attrs, attrmask;
 	const cfg_obj_t *obj = NULL;
+	unsigned int maxdispatchbuffers;
 
 	/*
 	 * Make compiler happy.
@@ -540,12 +546,18 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 		attrs |= DNS_DISPATCHATTR_IPV6;
 		break;
 	}
-
-	if (isc_sockaddr_getport(&sa) != 0) {
+	if (isc_sockaddr_getport(&sa) == 0) {
+		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
+		maxdispatchbuffers = 4096;
+	} else {
 		INSIST(obj != NULL);
-		cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
-			    "using specific query-source port suppresses port "
-			    "randomization and can be insecure.");
+		if (is_firstview) {
+			cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
+				    "using specific query-source port "
+				    "suppresses port randomization and can be "
+				    "insecure.");
+		}
+		maxdispatchbuffers = 1000;
 	}
 
 	attrmask = 0;
@@ -557,7 +569,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 	disp = NULL;
 	result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
 				     ns_g_taskmgr, &sa, 4096,
-				     1024, 32768, 16411, 16433,
+				     maxdispatchbuffers, 32768, 16411, 16433,
 				     attrs, attrmask, &disp);
 	if (result != ISC_R_SUCCESS) {
 		isc_sockaddr_t any;
@@ -609,7 +621,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 		return (result);
 
 	obj = cfg_tuple_get(ent, "name");
-	if (cfg_obj_isstring(obj)) 
+	if (cfg_obj_isstring(obj))
 		str = cfg_obj_asstring(obj);
 	else
 		str = "*";
@@ -662,7 +674,7 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	cfg_obj_asnetprefix(cfg_map_getname(cpeer), &na, &prefixlen);
 
 	peer = NULL;
-	result = dns_peer_new(mctx, &na, &peer);
+	result = dns_peer_newprefix(mctx, &na, prefixlen, &peer);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -840,7 +852,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
-	
+
 	for (element = cfg_list_first(disablelist);
 	     element != NULL;
 	     element = cfg_list_next(element))
@@ -911,9 +923,9 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	const cfg_obj_t *alternates;
 	const cfg_obj_t *zonelist;
 #ifdef DLZ
- 	const cfg_obj_t *dlz;
- 	unsigned int dlzargc;
- 	char **dlzargv;
+	const cfg_obj_t *dlz;
+	unsigned int dlzargc;
+	char **dlzargv;
 #endif
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj;
@@ -1064,7 +1076,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 				result = ISC_R_NOMEMORY;
 				goto cleanup;
 			}
-			
+
 			result = dns_dlzstrtoargv(mctx, s, &dlzargc, &dlzargv);
 			if (result != ISC_R_SUCCESS) {
 				isc_mem_free(mctx, s);
@@ -1183,8 +1195,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	 *
 	 * XXXRTH  Hardwired number of tasks.
 	 */
-	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4));
-	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6));
+	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4,
+					    ISC_TF(ISC_LIST_PREV(view, link)
+						   == NULL)));
+	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6,
+					    ISC_TF(ISC_LIST_PREV(view, link)
+						   == NULL)));
 	if (dispatch4 == NULL && dispatch6 == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "unable to obtain neither an IPv4 nor"
@@ -1223,7 +1239,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_resolver_setzeronosoattl(view->resolver, cfg_obj_asboolean(obj));
-	
+
 	/*
 	 * Set the resolver's EDNS UDP size.
 	 */
@@ -1236,7 +1252,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	if (udpsize > 4096)
 		udpsize = 4096;
 	dns_resolver_setudpsize(view->resolver, (isc_uint16_t)udpsize);
-	
+
 	/*
 	 * Set the maximum UDP response size.
 	 */
@@ -1273,7 +1289,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	(void)ns_config_get(maps, "forward", &forwardtype);
 	(void)ns_config_get(maps, "forwarders", &forwarders);
 	if (forwarders != NULL)
-		CHECK(configure_forward(config, view, dns_rootname, 
+		CHECK(configure_forward(config, view, dns_rootname,
 					forwarders, forwardtype));
 
 	/*
@@ -1293,7 +1309,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	/*
 	 * If we still have no hints, this is a non-IN view with no
 	 * "hints zone" configured.  Issue a warning, except if this
-	 * is a root server.  Root servers never need to consult 
+	 * is a root server.  Root servers never need to consult
 	 * their hints, so it's no point requiring users to configure
 	 * them.
 	 */
@@ -1416,7 +1432,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		view->transfer_format = dns_one_answer;
 	else
 		INSIST(0);
-	
+
 	/*
 	 * Set sources where additional data and CNAME/DNAME
 	 * targets for authoritative answers may be found.
@@ -1516,7 +1532,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	dns_resolver_setclientsperquery(view->resolver,
 					cfg_obj_asuint32(obj),
 					max_clients_per_query);
-			
+
 	obj = NULL;
 	result = ns_config_get(maps, "dnssec-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -1745,14 +1761,14 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			if (result == ISC_R_SUCCESS &&
 			    forwarders->fwdpolicy == dns_fwdpolicy_only)
 				continue;
-						
+
 			if (!rfc1918 && empty_zones[empty_zone].rfc1918) {
 				if (logit) {
 					isc_log_write(ns_g_lctx,
 						      NS_LOGCATEGORY_GENERAL,
 						      NS_LOGMODULE_SERVER,
 						      ISC_LOG_WARNING,
-					              "Warning%s%s: "
+						      "Warning%s%s: "
 						      "'empty-zones-enable/"
 						      "disable-empty-zone' "
 						      "not set: disabling "
@@ -1794,7 +1810,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			dns_zone_setclass(zone, view->rdclass);
 			dns_zone_settype(zone, dns_zone_master);
 			CHECK(dns_zone_setdbtype(zone, empty_dbtypec,
-					 	 empty_dbtype));
+						 empty_dbtype));
 			if (view->queryacl != NULL)
 				dns_zone_setqueryacl(zone, view->queryacl);
 			dns_zone_setdialup(zone, dns_dialuptype_no);
@@ -1809,7 +1825,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			dns_zone_detach(&zone);
 		}
 	}
-	
+
 	result = ISC_R_SUCCESS;
 
  cleanup:
@@ -2125,7 +2141,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 							       "name"));
 		else
 			vname = "<default view>";
-	
+
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': wrong class for view '%s'",
@@ -2499,7 +2515,7 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
 	}
 
 	ns_interfacemgr_adjust(server->interfacemgr, list, ISC_TRUE);
-	
+
  clean:
 	ns_listenlist_detach(&list);
 	return;
@@ -2588,7 +2604,7 @@ setstring(ns_server_t *server, char **field, const char *value) {
 
 	*field = copy;
 	return (ISC_R_SUCCESS);
-}	
+}
 
 /*
  * Replace the current value of '*field', a dynamically allocated
@@ -2630,7 +2646,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,
 	result = isc_resource_setlimit(resourceid, value);
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      result == ISC_R_SUCCESS ?
-		      	ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
+			ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
 		      "set maximum %s to %" ISC_PRINT_QUADFORMAT "d: %s",
 		      description, value, isc_result_totext(result));
 }
@@ -2647,31 +2663,48 @@ set_limits(const cfg_obj_t **maps) {
 	SETLIMIT("files", openfiles, "open files");
 }
 
-static isc_result_t
-portlist_fromconf(dns_portlist_t *portlist, unsigned int family,
-		  const cfg_obj_t *ports)
+static void
+portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports,
+		 isc_boolean_t positive)
 {
 	const cfg_listelt_t *element;
-	isc_result_t result = ISC_R_SUCCESS;
 
 	for (element = cfg_list_first(ports);
 	     element != NULL;
 	     element = cfg_list_next(element)) {
 		const cfg_obj_t *obj = cfg_listelt_value(element);
-		in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
-		
-		result = dns_portlist_add(portlist, family, port);
-		if (result != ISC_R_SUCCESS)
-			break;
+
+		if (cfg_obj_isuint32(obj)) {
+			in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
+
+			if (positive)
+				isc_portset_add(portset, port);
+			else
+				isc_portset_remove(portset, port);
+		} else {
+			const cfg_obj_t *obj_loport, *obj_hiport;
+			in_port_t loport, hiport;
+
+			obj_loport = cfg_tuple_get(obj, "loport");
+			loport = (in_port_t)cfg_obj_asuint32(obj_loport);
+			obj_hiport = cfg_tuple_get(obj, "hiport");
+			hiport = (in_port_t)cfg_obj_asuint32(obj_hiport);
+
+			if (positive)
+				isc_portset_addrange(portset, loport, hiport);
+			else {
+				isc_portset_removerange(portset, loport,
+							hiport);
+			}
+		}
 	}
-	return (result);
 }
 
 static isc_result_t
 removed(dns_zone_t *zone, void *uap) {
 	const char *type;
 
-        if (dns_zone_getview(zone) != uap)
+	if (dns_zone_getview(zone) != uap)
 		return (ISC_R_SUCCESS);
 
 	switch (dns_zone_gettype(zone)) {
@@ -2704,28 +2737,31 @@ load_configuration(const char *filename, ns_server_t *server,
 	const cfg_obj_t *maps[3];
 	const cfg_obj_t *obj;
 	const cfg_obj_t *options;
-	const cfg_obj_t *v4ports, *v6ports;
+	const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;
 	const cfg_obj_t *views;
 	dns_view_t *view = NULL;
 	dns_view_t *view_next;
 	dns_viewlist_t tmpviewlist;
 	dns_viewlist_t viewlist;
-	in_port_t listen_port;
+	in_port_t listen_port, udpport_low, udpport_high;
 	int i;
 	isc_interval_t interval;
-	isc_resourcevalue_t files;
+	isc_portset_t *v4portset = NULL;
+	isc_portset_t *v6portset = NULL;
+	isc_resourcevalue_t nfiles;
 	isc_result_t result;
 	isc_uint32_t heartbeat_interval;
 	isc_uint32_t interface_interval;
 	isc_uint32_t reserved;
 	isc_uint32_t udpsize;
+	unsigned int maxsocks;
 
 	cfg_aclconfctx_init(&aclconfctx);
 	ISC_LIST_INIT(viewlist);
 
 	/* Ensure exclusive access to configuration data. */
 	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);	
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 	/*
 	 * Parse the global default pseudo-config file.
@@ -2799,20 +2835,22 @@ load_configuration(const char *filename, ns_server_t *server,
 	set_limits(maps);
 
 	/*
-	 * Sanity check on "files" limit.
+	 * Check if max number of open sockets that the system allows is
+	 * sufficiently large.  Failing this condition is not necessarily fatal,
+	 * but may cause subsequent runtime failures for a busy recursive
+	 * server.
 	 */
-	result = isc_resource_curlimit(isc_resource_openfiles, &files);
-	if (result == ISC_R_SUCCESS && files < FD_SETSIZE) {
+	result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks);
+	if (result != ISC_R_SUCCESS)
+		maxsocks = 0;
+	result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles);
+	if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "the 'files' limit (%" ISC_PRINT_QUADFORMAT "u) "
-			      "is less than FD_SETSIZE (%d), increase "
-			      "'files' in named.conf or recompile with a "
-			      "smaller FD_SETSIZE.", files, FD_SETSIZE);
-		if (files > FD_SETSIZE)
-			files = FD_SETSIZE;
-	} else
-		files = FD_SETSIZE;
+			      "max open files (%" ISC_PRINT_QUADFORMAT "u)"
+			      " is smaller than max sockets (%u)",
+			      nfiles, maxsocks);
+	}
 
 	/*
 	 * Set the number of socket reserved for TCP, stdio etc.
@@ -2821,20 +2859,23 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ns_config_get(maps, "reserved-sockets", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	reserved = cfg_obj_asuint32(obj);
-	if (files < 128U)			/* Prevent underflow. */
-		reserved = 0;
-	else if (reserved > files - 128U)	/* Mimimum UDP space. */
-		reserved = files - 128;
-	if (reserved < 128U)			/* Mimimum TCP/stdio space. */
+	if (maxsocks != 0) {
+		if (maxsocks < 128U)			/* Prevent underflow. */
+			reserved = 0;
+		else if (reserved > maxsocks - 128U)	/* Minimum UDP space. */
+			reserved = maxsocks - 128;
+	}
+	/* Minimum TCP/stdio space. */
+	if (reserved < 128U)
 		reserved = 128;
-	if (reserved + 128U > files) {
+	if (reserved + 128U > maxsocks && maxsocks != 0) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-                              NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "less than 128 UDP sockets available after "
-			      "applying 'reserved-sockets' and 'files'");
+			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
 	isc__socketmgr_setreserved(ns_g_socketmgr, reserved);
-	
+
 	/*
 	 * Configure various server options.
 	 */
@@ -2859,24 +2900,64 @@ load_configuration(const char *filename, ns_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	server->aclenv.match_mapped = cfg_obj_asboolean(obj);
 
-	v4ports = NULL;
-	v6ports = NULL;
-	(void)ns_config_get(maps, "avoid-v4-udp-ports", &v4ports);
-	(void)ns_config_get(maps, "avoid-v6-udp-ports", &v6ports);
-	if (v4ports != NULL || v6ports != NULL) {
-		dns_portlist_t *portlist = NULL;
-		result = dns_portlist_create(ns_g_mctx, &portlist);
-		if (result == ISC_R_SUCCESS && v4ports != NULL)
-			result = portlist_fromconf(portlist, AF_INET, v4ports);
-		if (result == ISC_R_SUCCESS && v6ports != NULL)
-			portlist_fromconf(portlist, AF_INET6, v6ports);
-		if (result == ISC_R_SUCCESS)
-			dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, portlist);
-		if (portlist != NULL)
-			dns_portlist_detach(&portlist);
-		CHECK(result);
-	} else
-		dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, NULL);
+	/*
+	 * Configure sets of UDP query source ports.
+	 */
+	CHECKM(isc_portset_create(ns_g_mctx, &v4portset),
+	       "creating UDP port set");
+	CHECKM(isc_portset_create(ns_g_mctx, &v6portset),
+	       "creating UDP port set");
+
+	usev4ports = NULL;
+	usev6ports = NULL;
+	avoidv4ports = NULL;
+	avoidv6ports = NULL;
+
+	(void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports);
+	if (usev4ports != NULL)
+		portset_fromconf(v4portset, usev4ports, ISC_TRUE);
+	else {
+		CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low,
+					       &udpport_high),
+		       "get the default UDP/IPv4 port range");
+		if (udpport_low == udpport_high)
+			isc_portset_add(v4portset, udpport_low);
+		else {
+			isc_portset_addrange(v4portset, udpport_low,
+					     udpport_high);
+		}
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "using default UDP/IPv4 port range: [%d, %d]",
+			      udpport_low, udpport_high);
+	}
+	(void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports);
+	if (avoidv4ports != NULL)
+		portset_fromconf(v4portset, avoidv4ports, ISC_FALSE);
+
+	(void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports);
+	if (usev6ports != NULL)
+		portset_fromconf(v6portset, usev6ports, ISC_TRUE);
+	else {
+		CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low,
+					       &udpport_high),
+		       "get the default UDP/IPv6 port range");
+		if (udpport_low == udpport_high)
+			isc_portset_add(v6portset, udpport_low);
+		else {
+			isc_portset_addrange(v6portset, udpport_low,
+					     udpport_high);
+		}
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "using default UDP/IPv6 port range: [%d, %d]",
+			      udpport_low, udpport_high);
+	}
+	(void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports);
+	if (avoidv6ports != NULL)
+		portset_fromconf(v6portset, avoidv6ports, ISC_FALSE);
+
+	dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset);
 
 	/*
 	 * Set the EDNS UDP size when we don't match a view.
@@ -3037,7 +3118,7 @@ load_configuration(const char *filename, ns_server_t *server,
 				      NULL, &interval, ISC_FALSE));
 	}
 	server->heartbeat_interval = heartbeat_interval;
-	
+
 	isc_interval_set(&interval, 1200, 0);
 	CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL,
 			      &interval, ISC_FALSE));
@@ -3185,6 +3266,15 @@ load_configuration(const char *filename, ns_server_t *server,
 		ns_os_changeuser();
 
 	/*
+	 * Check that the working directory is writable.
+	 */
+	if (access(".", W_OK) != 0) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "the working directory is not writable");
+	}
+
+	/*
 	 * Configure the logging system.
 	 *
 	 * Do this after changing UID to make sure that any log
@@ -3277,7 +3367,7 @@ load_configuration(const char *filename, ns_server_t *server,
 		ns_os_writepidfile(lwresd_g_defaultpidfile, first_time);
 	else
 		ns_os_writepidfile(ns_g_defaultpidfile, first_time);
-	
+
 	obj = NULL;
 	if (options != NULL &&
 	    cfg_map_get(options, "memstatistics-file", &obj) == ISC_R_SUCCESS)
@@ -3344,6 +3434,12 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ISC_R_SUCCESS;
 
  cleanup:
+	if (v4portset != NULL)
+		isc_portset_destroy(ns_g_mctx, &v4portset);
+
+	if (v6portset != NULL)
+		isc_portset_destroy(ns_g_mctx, &v6portset);
+
 	cfg_aclconfctx_destroy(&aclconfctx);
 
 	if (parser != NULL) {
@@ -3414,7 +3510,7 @@ load_zones(ns_server_t *server, isc_boolean_t stop) {
 	 */
 	CHECK(dns_zonemgr_forcemaint(server->zonemgr));
  cleanup:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }
 
@@ -3442,7 +3538,7 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) {
 	 */
 	dns_zonemgr_resumexfrs(server->zonemgr);
  cleanup:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }
 
@@ -3501,7 +3597,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 		      ISC_LOG_NOTICE, "running");
 }
 
-void 
+void
 ns_server_flushonshutdown(ns_server_t *server, isc_boolean_t flush) {
 
 	REQUIRE(NS_SERVER_VALID(server));
@@ -3635,7 +3731,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	server->interface_timer = NULL;
 	server->heartbeat_timer = NULL;
 	server->pps_timer = NULL;
-	
+
 	server->interface_interval = 0;
 	server->heartbeat_interval = 0;
 
@@ -3658,7 +3754,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 
 	server->hostname_set = ISC_FALSE;
 	server->hostname = NULL;
-	server->version_set = ISC_FALSE;	
+	server->version_set = ISC_FALSE;
 	server->version = NULL;
 	server->server_usehostname = ISC_FALSE;
 	server->server_id = NULL;
@@ -3814,7 +3910,7 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {
 	result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
 				     ns_g_taskmgr, &dispatch->addr, 4096,
 				     1000, 32768, 16411, 16433,
-				     attrs, attrmask, &dispatch->dispatch); 
+				     attrs, attrmask, &dispatch->dispatch);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -3917,7 +4013,7 @@ next_token(char **stringp, const char *delim) {
 			break;
 	} while (*res == '\0');
 	return (res);
-}                       
+}
 
 /*
  * Find the zone specified in the control channel command 'args',
@@ -3975,14 +4071,14 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
 	} else {
 		rdclass = dns_rdataclass_in;
 	}
-	
+
 	if (viewtxt == NULL)
 		viewtxt = "_default";
 	result = dns_viewlist_find(&server->viewlist, viewtxt,
 				   rdclass, &view);
 	if (result != ISC_R_SUCCESS)
 		goto fail1;
-	
+
 	result = dns_zt_find(view->zonetable, dns_fixedname_name(&name),
 			     0, NULL, zonep);
 	/* Partial match? */
@@ -4001,7 +4097,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4014,7 +4110,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {
 		result = ISC_R_NOTFOUND;
 	dns_zone_detach(&zone);
 	return (result);
-}	
+}
 
 /*
  * Act on a "reload" command from the command channel.
@@ -4025,7 +4121,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
 	const char *msg = NULL;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4042,7 +4138,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		} else {
 			result = dns_zone_load(zone);
 			dns_zone_detach(&zone);
-			switch (result) {	
+			switch (result) {
 			case ISC_R_SUCCESS:
 				 msg = "zone reload successful";
 				 break;
@@ -4064,7 +4160,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		isc_buffer_putmem(text, (const unsigned char *)msg,
 				  strlen(msg) + 1);
 	return (result);
-}	
+}
 
 /*
  * Act on a "reconfig" command from the command channel.
@@ -4091,14 +4187,14 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		return (result);
 	if (zone == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	
+
 	dns_zone_notify(zone);
 	dns_zone_detach(&zone);
 	if (sizeof(msg) <= isc_buffer_availablelength(text))
 		isc_buffer_putmem(text, msg, sizeof(msg));
 
 	return (ISC_R_SUCCESS);
-}	
+}
 
 /*
  * Act on a "refresh" command from the command channel.
@@ -4125,17 +4221,17 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 			isc_buffer_putmem(text, msg1, sizeof(msg1));
 		return (ISC_R_SUCCESS);
 	}
-		
+
 	dns_zone_detach(&zone);
 	if (sizeof(msg2) <= isc_buffer_availablelength(text))
 		isc_buffer_putmem(text, msg2, sizeof(msg2));
 	return (ISC_R_FAILURE);
-}	
+}
 
 isc_result_t
 ns_server_togglequerylog(ns_server_t *server) {
 	server->log_queries = server->log_queries ? ISC_FALSE : ISC_TRUE;
-	
+
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "query logging is now %s",
@@ -4239,15 +4335,15 @@ ns_server_dumpstats(ns_server_t *server) {
 
 	CHECKMF(isc_stdio_open(server->statsfile, "a", &fp),
 		"could not open statistics dump file", server->statsfile);
-	
+
 	ncounters = DNS_STATS_NCOUNTERS;
 	fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);
-	
+
 	for (i = 0; i < ncounters; i++)
 		fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT "u\n",
 			dns_statscounter_names[i],
 			server->querystats[i]);
-	
+
 	zone = NULL;
 	for (result = dns_zone_first(server->zonemgr, &zone);
 	     result == ISC_R_SUCCESS;
@@ -4258,7 +4354,7 @@ ns_server_dumpstats(ns_server_t *server) {
 			char zonename[DNS_NAME_FORMATSIZE];
 			dns_view_t *view;
 			char *viewname;
-			
+
 			dns_name_format(dns_zone_getorigin(zone),
 					zonename, sizeof(zonename));
 			view = dns_zone_getview(zone);
@@ -4278,7 +4374,7 @@ ns_server_dumpstats(ns_server_t *server) {
 	if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
 	CHECK(result);
-	
+
 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);
 
  cleanup:
@@ -4306,7 +4402,7 @@ static isc_result_t
 add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	struct viewlistentry *vle;
 	isc_result_t result = ISC_R_SUCCESS;
-	
+
 	/*
 	 * Prevent duplicate views.
 	 */
@@ -4369,7 +4465,7 @@ dumpdone(void *arg, isc_result_t result) {
 	struct dumpcontext *dctx = arg;
 	char buf[1024+32];
 	const dns_master_style_t *style;
-	
+
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	if (dctx->mdctx != NULL)
@@ -4526,7 +4622,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 		dctx->dumpzones = ISC_TRUE;
 		dctx->dumpcache = ISC_FALSE;
 		ptr = next_token(&args, " \t");
-	} 
+	}
 
  nextview:
 	for (view = ISC_LIST_HEAD(server->viewlist);
@@ -4646,7 +4742,7 @@ ns_server_validation(ns_server_t *server, char *args) {
 	else
 		result = ISC_R_FAILURE;
  out:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }
 
@@ -4689,7 +4785,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 		else
 			result = ISC_R_FAILURE;
 	}
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }
 
@@ -4746,7 +4842,7 @@ ns_server_flushname(ns_server_t *server, char *args) {
 		result = ISC_R_NOTFOUND;
 	else
 		result = ISC_R_FAILURE;
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }
 
@@ -4798,7 +4894,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 	char *journal;
 	const char *vname, *sep;
 	isc_boolean_t frozen;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4806,7 +4902,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 		result = isc_task_beginexclusive(server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		tresult = ISC_R_SUCCESS;
-	        for (view = ISC_LIST_HEAD(server->viewlist);
+		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link)) {
 			result = dns_view_freezezones(view, freeze);
diff --git a/bin/named/unix/include/named/os.h b/bin/named/unix/include/named/os.h
index 24afdcbbcc4a..6c603dcc2a22 100644
--- a/bin/named/unix/include/named/os.h
+++ b/bin/named/unix/include/named/os.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: os.h,v 1.22.18.3 2005/04/29 00:15:39 marka Exp $ */
+/* $Id: os.h,v 1.22.18.5 2008/10/24 01:43:17 tbox Exp $ */
 
 #ifndef NS_OS_H
 #define NS_OS_H 1
@@ -46,11 +46,13 @@ void
 ns_os_changeuser(void);
 
 void
+ns_os_adjustnofile(void);
+
+void
 ns_os_minprivs(void);
 
 void
 ns_os_writepidfile(const char *filename, isc_boolean_t first_time);
-
 void
 ns_os_shutdown(void);
 
diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c
index 386461238fe5..ad26a8e9b0e9 100644
--- a/bin/named/unix/os.c
+++ b/bin/named/unix/os.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: os.c,v 1.66.18.11 2006/02/03 23:51:38 marka Exp $ */
+/* $Id: os.c,v 1.66.18.17 2008/10/24 01:43:17 tbox Exp $ */
 
 /*! \file */
 
@@ -42,6 +42,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerror.h>
 #include <isc/string.h>
@@ -116,6 +117,16 @@ static int dfd[2] = { -1, -1 };
 static isc_boolean_t non_root = ISC_FALSE;
 static isc_boolean_t non_root_caps = ISC_FALSE;
 
+#if defined(HAVE_CAPSET)
+#undef _POSIX_SOURCE
+#ifdef HAVE_SYS_CAPABILITY_H
+#include <sys/capability.h>
+#else
+#include <linux/capability.h>
+int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
+#endif
+#include <sys/prctl.h>
+#else
 /*%
  * We define _LINUX_FS_H to prevent it from being included.  We don't need
  * anything from it, and the files it includes cause warnings with 2.2
@@ -148,6 +159,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE;
 #endif
 #define SYS_capset __NR_capset
 #endif
+#endif
 
 static void
 linux_setcaps(unsigned int caps) {
@@ -165,13 +177,23 @@ linux_setcaps(unsigned int caps) {
 	cap.effective = caps;
 	cap.permitted = caps;
 	cap.inheritable = 0;
-	if (syscall(SYS_capset, &caphead, &cap) < 0) {
+#ifdef HAVE_CAPSET
+	if (capset(&caphead, &cap) < 0 ) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		ns_main_earlyfatal("capset failed: %s:"
 				   " please ensure that the capset kernel"
 				   " module is loaded.  see insmod(8)",
 				   strbuf);
 	}
+#else
+	if (syscall(SYS_capset, &caphead, &cap) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		ns_main_earlyfatal("syscall(capset) failed: %s:"
+				   " please ensure that the capset kernel"
+				   " module is loaded.  see insmod(8)",
+				   strbuf);
+	}
+#endif
 }
 
 static void
@@ -326,7 +348,7 @@ ns_os_daemonize(void) {
 		/*
 		 * Wait for the child to finish loading for the first time.
 		 * This would be so much simpler if fork() worked once we
-	         * were multi-threaded.
+		 * were multi-threaded.
 		 */
 		(void)close(dfd[1]);
 		do {
@@ -496,15 +518,37 @@ ns_os_changeuser(void) {
 		ns_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
-	linux_minprivs();
-#endif
 #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
 	 */
-	prctl(PR_SET_DUMPABLE,1,0,0,0);
+	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
+				     strbuf);
+	}
+#endif
+#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+	linux_minprivs();
+#endif
+}
+
+void
+ns_os_adjustnofile() {
+#ifdef HAVE_LINUXTHREADS
+	isc_result_t result;
+	isc_resourcevalue_t newvalue;
+
+	/*
+	 * Linux: max number of open files specified by one thread doesn't seem
+	 * to apply to other threads on Linux.
+	 */
+	newvalue = ISC_RESOURCE_UNLIMITED;
+
+	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
+	if (result != ISC_R_SUCCESS)
+		ns_main_earlywarning("couldn't adjust limit on open files");
 #endif
 }
 
@@ -665,7 +709,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	ptr = next_token(&input, " \t");
 	if (ptr == NULL)
 		return;
-	
+
 	if (strcmp(ptr, "-p") != 0)
 		return;
 
diff --git a/bin/named/update.c b/bin/named/update.c
index 98054f8b3ceb..fb6dec2f11e0 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.109.18.23 2007/08/28 07:20:01 tbox Exp $ */
+/* $Id: update.c,v 1.109.18.27 2008/02/07 03:16:08 marka Exp $ */
 
 #include <config.h>
 
@@ -114,7 +114,7 @@
 		}						\
 		update_log(client, zone, LOGLEVEL_PROTOCOL,   	\
 			      "update %s: %s (%s)", _what,	\
-		      	      msg, isc_result_totext(result));	\
+			      msg, isc_result_totext(result));	\
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)
 
@@ -403,7 +403,7 @@ foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) {
 	     result = dns_rdataset_next(rdataset))
 	{
 		rr_t rr = { 0, DNS_RDATA_INIT };
-		
+
 		dns_rdataset_current(rdataset, &rr.rdata);
 		rr.ttl = rdataset->ttl;
 		result = (*ctx->rr_action)(ctx->rr_action_data, &rr);
@@ -843,10 +843,14 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 		/* A new unique name begins here. */
 		node = NULL;
 		result = dns_db_findnode(db, name, ISC_FALSE, &node);
-		if (result == ISC_R_NOTFOUND)
+		if (result == ISC_R_NOTFOUND) {
+			dns_diff_clear(&trash);
 			return (DNS_R_NXRRSET);
-		if (result != ISC_R_SUCCESS)
+		}
+		if (result != ISC_R_SUCCESS) {
+			dns_diff_clear(&trash);
 			return (result);
+		}
 
 		/* A new unique type begins here. */
 		while (t != NULL && dns_name_equal(&t->name, name)) {
@@ -854,7 +858,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 			dns_rdataset_t rdataset;
 			dns_diff_t d_rrs; /* Database RRs with
 						this name and type */
- 			dns_diff_t u_rrs; /* Update RRs with
+			dns_diff_t u_rrs; /* Update RRs with
 						this name and type */
 
 			*typep = type = t->rdata.type;
@@ -874,6 +878,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 						     &rdataset, NULL);
 			if (result != ISC_R_SUCCESS) {
 				dns_db_detachnode(db, &node);
+				dns_diff_clear(&trash);
 				return (DNS_R_NXRRSET);
 			}
 
@@ -1119,7 +1124,7 @@ typedef struct {
 
 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr) {
-	isc_result_t result = ISC_R_SUCCESS;	
+	isc_result_t result = ISC_R_SUCCESS;
 	add_rr_prepare_ctx_t *ctx = data;
 	dns_difftuple_t *tuple = NULL;
 	isc_boolean_t equal;
@@ -1647,10 +1652,11 @@ ksk_sanity(dns_db_t *db, dns_dbversion_t *ver) {
  * Add RRSIG records for an RRset, recording the change in "diff".
  */
 static isc_result_t
-add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-	 dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
-	 unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
-	 isc_stdtime_t expire, isc_boolean_t check_ksk)
+add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
+	 dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
+	 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
+	 isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire,
+	 isc_boolean_t check_ksk)
 {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
@@ -1659,6 +1665,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	isc_buffer_t buffer;
 	unsigned char data[1024]; /* XXX */
 	unsigned int i;
+	isc_boolean_t added_sig = ISC_FALSE;
 
 	dns_rdataset_init(&rdataset);
 	isc_buffer_init(&buffer, data, sizeof(data));
@@ -1671,14 +1678,14 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	dns_db_detachnode(db, &node);
 
 	for (i = 0; i < nkeys; i++) {
-		
+
 		if (check_ksk && type != dns_rdatatype_dnskey &&
 		    (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)
 			continue;
 
 		if (!dst_key_isprivate(keys[i]))
 			continue;
-		
+
 		/* Calculate the signature, creating a RRSIG RDATA. */
 		CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
 				      &inception, &expire,
@@ -1689,6 +1696,13 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,
 				    rdataset.ttl, &sig_rdata));
 		dns_rdata_reset(&sig_rdata);
+		added_sig = ISC_TRUE;
+	}
+	if (!added_sig) {
+		update_log(client, zone, ISC_LOG_ERROR,
+			   "found no private keys, "
+			   "unable to generate any signatures");
+		result = ISC_R_NOTFOUND;
 	}
 
  failure:
@@ -1770,7 +1784,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
 	dns_rdataset_init(&rdataset);
 	CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0,
-                                  (isc_stdtime_t) 0, &rdataset, NULL));
+				  (isc_stdtime_t) 0, &rdataset, NULL));
 	CHECK(dns_rdataset_first(&rdataset));
 	dns_rdataset_current(&rdataset, &rdata);
 	CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
@@ -1820,9 +1834,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 */
 			CHECK(rrset_exists(db, newver, name, type, 0, &flag));
 			if (flag) {
-				CHECK(add_sigs(db, newver, name, type,
-					       &sig_diff, zone_keys, nkeys,
-					       client->mctx, inception,
+				CHECK(add_sigs(client, zone, db, newver, name,
+					       type, &sig_diff, zone_keys,
+					       nkeys, client->mctx, inception,
 					       expire, check_ksk));
 			}
 		skip:
@@ -2006,10 +2020,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 					dns_rdatatype_rrsig, dns_rdatatype_nsec,
 					NULL, &sig_diff));
 		} else if (t->op == DNS_DIFFOP_ADD) {
-			CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,
-				       &sig_diff, zone_keys, nkeys,
-				       client->mctx, inception, expire,
-				       check_ksk));
+			CHECK(add_sigs(client, zone, db, newver, &t->name,
+				       dns_rdatatype_nsec, &sig_diff,
+				       zone_keys, nkeys, client->mctx,
+				       inception, expire, check_ksk));
 		} else {
 			INSIST(0);
 		}
@@ -2274,7 +2288,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 				   ownerbuf, namebuf,
 				   dns_result_totext(DNS_R_MXISADDRESS));
 		}
-		
+
 		/*
 		 * Check zone integrity checks.
 		 */
@@ -2474,7 +2488,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	else if (client->signer == NULL)
 		CHECK(checkupdateacl(client, NULL, "update", zonename,
 				     ISC_FALSE));
-	
+
 	if (dns_zone_getupdatedisabled(zone))
 		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled");
 
@@ -2881,7 +2895,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	 * The reason for failure should have been logged at this point.
 	 */
 	if (ver != NULL) {
-		update_log(client, zone, LOGLEVEL_DEBUG, 
+		update_log(client, zone, LOGLEVEL_DEBUG,
 			   "rolling back");
 		dns_db_closeversion(db, &ver, ISC_FALSE);
 	}
@@ -2933,7 +2947,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 
 static void
 forward_fail(isc_task_t *task, isc_event_t *event) {
-        ns_client_t *client = (ns_client_t *)event->ev_arg;
+	ns_client_t *client = (ns_client_t *)event->ev_arg;
 
 	UNUSED(task);
 
diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in
index 6bb22f846ca2..713ec30b60f7 100644
--- a/bin/nsupdate/Makefile.in
+++ b/bin/nsupdate/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.22.18.1 2004/07/20 07:03:20 marka Exp $
+# $Id: Makefile.in,v 1.22.18.3 2008/08/29 23:46:16 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -55,7 +55,7 @@ UOBJS =
 
 SRCS =		nsupdate.c
 
-MANPAGES =	nsupdate.8
+MANPAGES =	nsupdate.1
 
 HTMLPAGES =	nsupdate.html
 
@@ -76,8 +76,8 @@ clean distclean::
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 
 install:: nsupdate@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsupdate@EXEEXT@ ${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/nsupdate.8 ${DESTDIR}${mandir}/man8
+	${INSTALL_DATA} ${srcdir}/nsupdate.1 ${DESTDIR}${mandir}/man1
diff --git a/bin/nsupdate/nsupdate.8 b/bin/nsupdate/nsupdate.1
index 8e3963acc3de..454f50560f20 100644
--- a/bin/nsupdate/nsupdate.8
+++ b/bin/nsupdate/nsupdate.1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nsupdate.8,v 1.30.18.14 2007/05/09 03:33:13 marka Exp $
+.\" $Id: nsupdate.1,v 1.1.4.2 2008/09/01 02:29:00 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -24,7 +24,7 @@
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9"
+.TH "NSUPDATE" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -342,7 +342,7 @@ base\-64 encoding of HMAC\-MD5 key created by
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 7f101744d9dd..88749e64f957 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.130.18.19 2007/08/28 07:20:01 tbox Exp $ */
+/* $Id: nsupdate.c,v 1.130.18.22 2008/01/17 23:45:58 tbox Exp $ */
 
 /*! \file */
 
@@ -311,7 +311,7 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len) {
 
 	strncpy(buf, hmacstr, len);
 	buf[len] = 0;
-	
+
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		*hmac = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
@@ -1155,7 +1155,7 @@ evaluate_key(char *cmdline) {
 	secret = isc_mem_allocate(mctx, secretlen);
 	if (secret == NULL)
 		fatal("out of memory");
-	
+
 	isc_buffer_init(&secretbuf, secret, secretlen);
 	result = isc_base64_decodestring(secretstr, &secretbuf);
 	if (result != ISC_R_SUCCESS) {
@@ -1222,8 +1222,8 @@ evaluate_class(char *cmdline) {
 	}
 
 	r.base = word;
-        r.length = strlen(word);
-        result = dns_rdataclass_fromtext(&rdclass, &r);
+	r.length = strlen(word);
+	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse class name: %s\n", word);
 		return (STATUS_SYNTAX);
@@ -1407,8 +1407,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
  failure:
 	if (name != NULL)
 		dns_message_puttempname(updatemsg, &name);
-	if (rdata != NULL)
-		dns_message_puttemprdata(updatemsg, &rdata);
+	dns_message_puttemprdata(updatemsg, &rdata);
 	return (STATUS_SYNTAX);
 }
 
@@ -1480,7 +1479,7 @@ show_message(dns_message_t *msg) {
 	setzone(userzone);
 
 	bufsz = INITTEXT;
-	do { 
+	do {
 		if (bufsz > MAXTEXT) {
 			fprintf(stderr, "could not allocate large enough "
 				"buffer to display message\n");
@@ -1662,7 +1661,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 			char buf[64];
 			isc_buffer_t b;
 			dns_rdataset_t *rds;
-			
+
 			isc_buffer_init(&b, buf, sizeof(buf) - 1);
 			result = dns_rcode_totext(answer->rcode, &b);
 			check_result(result, "dns_rcode_totext");
@@ -1678,7 +1677,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		int bufsz;
 
 		bufsz = INITTEXT;
-		do { 
+		do {
 			if (bufsz > MAXTEXT) {
 				fprintf(stderr, "could not allocate large "
 					"enough buffer to display message\n");
@@ -1766,7 +1765,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	ddebug("recvsoa()");
 
 	requests--;
-	
+
 	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
 	reqev = (dns_requestevent_t *)event;
 	request = reqev->request;
@@ -1883,7 +1882,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		section = DNS_SECTION_ANSWER;
 	else if (pass == 1)
 		section = DNS_SECTION_AUTHORITY;
-	else 
+	else
 		goto droplabel;
 
 	result = dns_message_firstname(rcvmsg, section);
@@ -1912,7 +1911,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 				break;
 			}
 		}
-				
+
 		result = dns_message_nextname(rcvmsg, section);
 	}
 
@@ -1977,7 +1976,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvsoa");
 	return;
- 
+
  droplabel:
 	result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
 	INSIST(result == ISC_R_SUCCESS);
diff --git a/bin/nsupdate/nsupdate.docbook b/bin/nsupdate/nsupdate.docbook
index 0ea49061addb..43fe69ad4853 100644
--- a/bin/nsupdate/nsupdate.docbook
+++ b/bin/nsupdate/nsupdate.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,14 +18,14 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: nsupdate.docbook,v 1.18.18.10 2007/08/28 07:20:01 tbox Exp $ -->
+<!-- $Id: nsupdate.docbook,v 1.18.18.12 2008/08/29 23:46:16 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>Jun 30, 2000</date>
   </refentryinfo>
   <refmeta>
     <refentrytitle>nsupdate</refentrytitle>
-    <manvolnum>8</manvolnum>
+    <manvolnum>1</manvolnum>
     <refmiscinfo>BIND9</refmiscinfo>
   </refmeta>
   <refnamediv>
@@ -39,6 +39,7 @@
       <year>2005</year>
       <year>2006</year>
       <year>2007</year>
+      <year>2008</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
diff --git a/bin/nsupdate/nsupdate.html b/bin/nsupdate/nsupdate.html
index d11b57ea6eb8..1fe0f9c15806 100644
--- a/bin/nsupdate/nsupdate.html
+++ b/bin/nsupdate/nsupdate.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nsupdate.html,v 1.14.18.22 2007/05/09 03:33:13 marka Exp $ -->
+<!-- $Id: nsupdate.html,v 1.14.18.23 2008/09/01 02:29:00 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543417"></a><h2>DESCRIPTION</h2>
+<a name="id2543420"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC2136
       to a name server.
@@ -153,7 +153,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543645"></a><h2>INPUT FORMAT</h2>
+<a name="id2543649"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       reads input from
       <em class="parameter"><code>filename</code></em>
@@ -402,7 +402,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544648"></a><h2>EXAMPLES</h2>
+<a name="id2544446"></a><h2>EXAMPLES</h2>
 <p>
       The examples below show how
       <span><strong class="command">nsupdate</strong></span>
@@ -456,7 +456,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544692"></a><h2>FILES</h2>
+<a name="id2544490"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -475,7 +475,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544829"></a><h2>SEE ALSO</h2>
+<a name="id2544560"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,
       <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,
       <span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>,
@@ -488,7 +488,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544900"></a><h2>BUGS</h2>
+<a name="id2542172"></a><h2>BUGS</h2>
 <p>
       The TSIG key is redundantly stored in two separate files.
       This is a consequence of nsupdate using the DST library
diff --git a/bin/rndc/rndc-confgen.c b/bin/rndc/rndc-confgen.c
index 0764104ffa22..bb7ba8151ef9 100644
--- a/bin/rndc/rndc-confgen.c
+++ b/bin/rndc/rndc-confgen.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rndc-confgen.c,v 1.18.18.3 2005/04/29 00:15:40 marka Exp $ */
+/* $Id: rndc-confgen.c,v 1.18.18.5 2008/10/15 23:46:06 tbox Exp $ */
 
 /*! \file */
 
@@ -62,7 +62,7 @@
 #define DEFAULT_PORT		953
 
 static char program[256];
-char *progname;
+const char *progname;
 
 isc_boolean_t verbose = ISC_FALSE;
 
@@ -148,7 +148,7 @@ main(int argc, char **argv) {
 	isc_boolean_t keyonly = ISC_FALSE;
 	int len;
 
- 	keydef = keyfile = RNDC_KEYFILE;
+	keydef = keyfile = RNDC_KEYFILE;
 
 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
@@ -286,7 +286,7 @@ main(int argc, char **argv) {
 				fatal("isc_mem_get(%d) failed\n", len);
 			snprintf(buf, len, "%s%s%s", chrootdir,
 				 (*keyfile != '/') ? "/" : "", keyfile);
-			
+
 			write_key_file(buf, user, keyname, &key_txtbuffer);
 			isc_mem_put(mctx, buf, len);
 		}
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index 14a51b3c62f8..6858ed77cb15 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.8,v 1.26.18.15 2007/06/20 02:26:58 marka Exp $
+.\" $Id: rndc.8,v 1.26.18.16 2007/12/14 22:37:16 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -133,6 +133,7 @@ Several error messages could be clearer.
 .SH "SEE ALSO"
 .PP
 \fBrndc.conf\fR(5),
+\fBrndc\-confgen\fR(8),
 \fBnamed\fR(8),
 \fBnamed.conf\fR(5),
 \fBndc\fR(8),
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index b916aea88bd0..772cc2975ca1 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rndc.c,v 1.96.18.17.42.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: rndc.c,v 1.96.18.21 2008/10/15 03:07:19 marka Exp $ */
 
 /*! \file */
 
@@ -61,7 +61,7 @@
 
 #define SERVERADDRS 10
 
-char *progname;
+const char *progname;
 isc_boolean_t verbose;
 
 static const char *admin_conffile;
@@ -93,7 +93,7 @@ static void
 usage(int status) {
 	fprintf(stderr, "\
 Usage: %s [-c config] [-s server] [-p port]\n\
-        [-k key-file ] [-y key] [-V] command\n\
+	[-k key-file ] [-y key] [-V] command\n\
 \n\
 command is one of the following:\n\
 \n\
@@ -106,10 +106,10 @@ command is one of the following:\n\
 		Retransfer a single zone without checking serial number.\n\
   freeze	Suspend updates to all dynamic zones.\n\
   freeze zone [class [view]]\n\
-  		Suspend updates to a dynamic zone.\n\
+		Suspend updates to a dynamic zone.\n\
   thaw		Enable updates to all dynamic zones and reload them.\n\
   thaw zone [class [view]]\n\
-  		Enable updates to a frozen dynamic zone and reload it.\n\
+		Enable updates to a frozen dynamic zone and reload it.\n\
   notify zone [class [view]]\n\
 		Resend NOTIFY messages for the zone.\n\
   reconfig	Reload configuration file and new zones only.\n\
@@ -152,7 +152,7 @@ get_addresses(const char *host, in_port_t port) {
 		result = isc_sockaddr_frompath(&serveraddrs[nserveraddrs],
 					       host);
 		if (result == ISC_R_SUCCESS)
-			nserveraddrs++; 
+			nserveraddrs++;
 	} else {
 		count = SERVERADDRS - nserveraddrs;
 		result = bind9_getaddresses(host, port,
@@ -485,7 +485,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		(void)cfg_map_get(config, "server", &servers);
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers);
-			     elt != NULL; 
+			     elt != NULL;
 			     elt = cfg_list_next(elt))
 			{
 				const char *name;
@@ -521,7 +521,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	else {
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys);
-		     elt != NULL; 
+		     elt != NULL;
 		     elt = cfg_list_next(elt))
 		{
 			key = cfg_listelt_value(elt);
@@ -599,7 +599,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 					get_addresses(name, (in_port_t) myport);
 				else
 					fprintf(stderr, "too many address: "
-					        "%s: dropped\n", name);
+						"%s: dropped\n", name);
 				continue;
 			}
 			sa = *cfg_obj_assockaddr(address);
@@ -739,7 +739,7 @@ main(int argc, char **argv) {
 		case 'y':
 			keyname = isc_commandline_argument;
 			break;
- 
+
 		case '?':
 			usage(0);
 			break;
@@ -773,7 +773,7 @@ main(int argc, char **argv) {
 	logdest.file.maximum_size = 0;
 	DO("creating log channel",
 	   isc_log_createchannel(logconfig, "stderr",
-		   		 ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest,
+				 ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest,
 				 ISC_LOG_PRINTTAG|ISC_LOG_PRINTLEVEL));
 	DO("enabling log channel", isc_log_usechannel(logconfig, "stderr",
 						      NULL, NULL));
diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
index 0719a74461b5..f2f0a0d6a84b 100644
--- a/bin/rndc/rndc.docbook
+++ b/bin/rndc/rndc.docbook
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: rndc.docbook,v 1.8.18.12 2007/08/28 07:20:01 tbox Exp $ -->
+<!-- $Id: rndc.docbook,v 1.8.18.13 2007/12/14 20:53:58 marka Exp $ -->
 <refentry id="man.rndc">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -225,6 +225,9 @@
         <refentrytitle>rndc.conf</refentrytitle><manvolnum>5</manvolnum>
       </citerefentry>,
       <citerefentry>
+        <refentrytitle>rndc-confgen</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citerefentry>
         <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index d4d0ebb693fe..c460225cb646 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.html,v 1.8.18.22 2007/06/20 02:26:58 marka Exp $ -->
+<!-- $Id: rndc.html,v 1.8.18.23 2007/12/14 22:37:16 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -149,6 +149,7 @@
 <div class="refsect1" lang="en">
 <a name="id2543683"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
+      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
@@ -156,7 +157,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543730"></a><h2>AUTHOR</h2>
+<a name="id2543738"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/configure.in b/configure.in
index fb2f2e2aac3a..6320b6a18b19 100644
--- a/configure.in
+++ b/configure.in
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
 esyscmd([sed "s/^/# /" COPYRIGHT])dnl
 AC_DIVERT_POP()dnl
 
-AC_REVISION($Revision: 1.355.18.71.8.2 $)
+AC_REVISION($Revision: 1.355.18.85 $)
 
 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.59)
@@ -232,6 +232,15 @@ case "$host" in
 		STD_CDEFINES="$STD_CDEFINES -D_XPG4_2 -D__EXTENSIONS__"
 		CPPFLAGS="$CPPFLAGS -D_XPG4_2 -D__EXTENSIONS__"
 		;;
+	# POSIX doesn't include the IPv6 Advanced Socket API and glibc hides
+	# parts of the IPv6 Advanced Socket API as a result.  This is stupid
+	# as it breaks how the two halves (Basic and Advanced) of the IPv6
+	# Socket API were designed to be used but we have to live with it.
+	# Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
+	*-linux*)
+		STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE"
+		CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
+		;;
 esac
 
 AC_HEADER_STDC
@@ -245,6 +254,7 @@ AC_CHECK_HEADERS(fcntl.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param
 
 AC_C_CONST
 AC_C_INLINE
+AC_C_VOLATILE
 AC_CHECK_FUNC(sysctlbyname, AC_DEFINE(HAVE_SYSCTLBYNAME))
 
 #
@@ -316,6 +326,78 @@ lifconf.lifc_len = 0;
 		ISC_PLATFORM_HAVELIFCONF="#undef ISC_PLATFORM_HAVELIFCONF"])
 AC_SUBST(ISC_PLATFORM_HAVELIFCONF)
 
+#
+# check if we have kqueue
+#
+AC_ARG_ENABLE(kqueue,
+	[  --enable-kqueue         use BSD kqueue when available [[default=yes]]],
+	      want_kqueue="$enableval",  want_kqueue="yes")
+case $want_kqueue in
+yes)
+	AC_CHECK_FUNC(kqueue, ac_cv_have_kqueue=yes, ac_cv_have_kqueue=no)
+	case $ac_cv_have_kqueue in
+	yes)
+		ISC_PLATFORM_HAVEKQUEUE="#define ISC_PLATFORM_HAVEKQUEUE 1"
+		;;
+	*)
+		ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE"
+		;;
+	esac
+	;;
+*)
+	ISC_PLATFORM_HAVEKQUEUE="#undef ISC_PLATFORM_HAVEKQUEUE"
+	;;
+esac
+AC_SUBST(ISC_PLATFORM_HAVEKQUEUE)
+
+#
+# check if we have epoll.  Linux kernel 2.4 has epoll_create() which fails,
+# so we need to try running the code, not just test its existence.
+#
+AC_ARG_ENABLE(epoll,
+	[  --enable-epoll          use Linux epoll when available [[default=yes]]],
+	      want_epoll="$enableval",  want_epoll="yes")
+case $want_epoll in
+yes)
+	AC_MSG_CHECKING(epoll support)
+	AC_TRY_RUN([
+#include <sys/epoll.h>
+int main() {
+	if (epoll_create(1) < 0)
+		return (1);
+	return (0);
+}
+],
+	[AC_MSG_RESULT(yes)
+	ISC_PLATFORM_HAVEEPOLL="#define ISC_PLATFORM_HAVEEPOLL 1"],
+	[AC_MSG_RESULT(no)
+	ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL"])
+	;;
+*)
+	ISC_PLATFORM_HAVEEPOLL="#undef ISC_PLATFORM_HAVEEPOLL"
+	;;
+esac
+AC_SUBST(ISC_PLATFORM_HAVEEPOLL)
+
+#
+# check if we support /dev/poll
+#
+AC_ARG_ENABLE(devpoll,
+	[  --enable-devpoll        use /dev/poll when available [[default=yes]]],
+	      want_devpoll="$enableval",  want_devpoll="yes")
+case $want_devpoll in
+yes)
+	AC_CHECK_HEADERS(sys/devpoll.h,
+	ISC_PLATFORM_HAVEDEVPOLL="#define ISC_PLATFORM_HAVEDEVPOLL 1"
+	,
+	ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL"
+	)
+	;;
+*)
+	ISC_PLATFORM_HAVEDEVPOLL="#undef ISC_PLATFORM_HAVEDEVPOLL"
+	;;
+esac
+AC_SUBST(ISC_PLATFORM_HAVEDEVPOLL)
 
 #
 # check if we need to #include sys/select.h explicitly
@@ -899,6 +981,16 @@ case "$host" in
 esac
 
 #
+# Work around Solaris's select() limitations.
+#
+case "$host" in
+	*-solaris2.[[89]]|*-solaris2.1?)
+	AC_DEFINE(FD_SETSIZE, 65536,
+		  [Solaris hack to get select_large_fdset.])
+	;;
+esac
+
+#
 # Purify support
 #
 AC_MSG_CHECKING(whether to use purify)
@@ -943,6 +1035,14 @@ AC_SUBST(PURIFY)
 #
 # GNU libtool support
 #
+case $build_os in
+sunos*)
+    # Just set the maximum command line length for sunos as it otherwise
+    # takes a exceptionally long time to work it out. Required for libtool.
+    lt_cv_sys_max_cmd_len=4096;
+    ;;
+esac
+
 AC_ARG_WITH(libtool,
 	    [  --with-libtool	use GNU libtool (following indented options supported)],
 	    use_libtool="$withval", use_libtool="no")
@@ -1695,7 +1795,8 @@ AC_ARG_ENABLE(linux-caps,
 	[  --disable-linux-caps	disable linux capabilities])
 case "$enable_linux_caps" in
 	yes|'')
-		AC_CHECK_HEADERS(linux/capability.h)
+		AC_CHECK_HEADERS(linux/capability.h sys/capability.h)
+		AC_CHECK_FUNCS(capset)
 		;;
 	no)
 		;;
@@ -1782,6 +1883,18 @@ AC_MSG_RESULT(cannot determine type of rlim_cur when cross compiling - assuming
 AC_SUBST(ISC_PLATFORM_RLIMITTYPE)
 
 #
+# Older HP-UX doesn't have gettune
+#
+case "$host" in
+  	*-hp-hpux*)
+		AC_CHECK_HEADERS(sys/dyntune.h)
+		;;
+	*)
+		;;
+esac
+
+
+#
 # Compaq TruCluster requires more code for handling cluster IP aliases
 #
 case "$host" in
@@ -1839,7 +1952,7 @@ case "$host" in
 	[*-solaris2.[89]])
 		hack_shutup_pthreadonceinit=yes
 		;;
-	*-solaris2.1[0-9])
+	*-solaris2.1[[0-9]])
 		hack_shutup_pthreadonceinit=yes
 		;;
 esac
@@ -2162,27 +2275,39 @@ AC_SUBST($1)
 ])
 
 #
-# Look for Docbook-XSL stylesheets.  Location probably varies by
-# system.  Guessing where it might be found, based on where SGML stuff
-# lives on some systems.  FreeBSD is the only one I'm sure of at the
-# moment.
+# Look for Docbook-XSL stylesheets.  Location probably varies by system.
+# If it's not explicitly specified, guess where it might be found, based on
+# where SGML stuff lives on some systems (FreeBSD is the only one we're sure
+# of at the moment).
 #
-
-docbook_xsl_trees="/usr/pkg/share/xsl /usr/local/share/xsl /usr/share/xsl"
+AC_MSG_CHECKING(for Docbook-XSL path)
+AC_ARG_WITH(docbook-xsl,
+[  --with-docbook-xsl=PATH    Specify path for Docbook-XSL stylesheets],
+   docbook_path="$withval", docbook_path="auto")
+case "$docbook_path" in
+auto)
+	AC_MSG_RESULT(auto)
+	docbook_xsl_trees="/usr/pkg/share/xsl/docbook /usr/local/share/xsl/docbook /usr/share/xsl/docbook"
+	;;
+*)
+	docbook_xsl_trees="$withval"
+    	AC_MSG_RESULT($docbook_xsl_trees)
+	;;
+esac
 
 #
 # Look for stylesheets we need.
 #
 
-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_HTML, docbook/html/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_XHTML, docbook/xhtml/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_MAN, docbook/manpages/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_HTML, docbook/html/chunk.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_XHTML, docbook/xhtml/chunk.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_HTML, docbook/html/chunktoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_XHTML, docbook/xhtml/chunktoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_HTML, docbook/html/maketoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_XHTML, docbook/xhtml/maketoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_HTML, html/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_XHTML, xhtml/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_MAN, manpages/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_HTML, html/chunk.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_XHTML, xhtml/chunk.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_HTML, html/chunktoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_XHTML, xhtml/chunktoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_HTML, html/maketoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_XHTML, xhtml/maketoc.xsl, $docbook_xsl_trees)
 
 #
 # Same dance for db2latex
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 24642c13c2b7..cdcb9d8a4108 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.82.8.3 2008/07/23 12:04:32 marka Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.241.18.97 2008/10/17 19:37:35 jreed Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -639,13 +639,11 @@
       <title>Supported Operating Systems</title>
       <para>
         ISC <acronym>BIND</acronym> 9 compiles and runs on a large
-        number
-        of Unix-like operating system and on NT-derived versions of
-        Microsoft Windows such as Windows 2000 and Windows XP.  For an
-        up-to-date
-        list of supported systems, see the README file in the top level
-        directory
-        of the BIND 9 source distribution.
+        number of Unix-like operating systems, and on some versions of
+        Microsoft Windows including Windows XP, Windows 2003, and
+        Windows 2008.  For an up-to-date list of supported systems,
+        see the README file in the top level directory of the BIND 9
+        source distribution.
       </para>
     </sect1>
   </chapter>
@@ -2930,6 +2928,33 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
             <row rowsep="0">
               <entry colname="1">
                 <para>
+                  <varname>port_list</varname>
+                </para>
+              </entry>
+              <entry colname="2">
+                <para>
+		  A list of an <varname>ip_port</varname> or a port
+		  range.
+		  A port range is specified in the form of
+		  <userinput>range</userinput> followed by
+		  two <varname>ip_port</varname>s,
+		  <varname>port_low</varname> and
+		  <varname>port_high</varname>, which represents
+		  port numbers from <varname>port_low</varname> through
+		  <varname>port_high</varname>, inclusive.
+		  <varname>port_low</varname> must not be larger than
+		  <varname>port_high</varname>.
+		  For example,
+		  <userinput>range 1024 65535</userinput> represents
+		  ports from 1024 through 65535.
+		  In either case an asterisk (`*') character is not
+		  allowed as a valid <varname>ip_port</varname>.
+                </para>
+              </entry>
+            </row>
+            <row rowsep="0">
+              <entry colname="1">
+                <para>
                   <varname>size_spec</varname>
                 </para>
               </entry>
@@ -3582,7 +3607,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
       </sect2>
       <sect2>
         <title><command>include</command> Statement Grammar</title>
-        <programlisting>include <replaceable>filename</replaceable>;</programlisting>
+        <programlisting><command>include</command> <replaceable>filename</replaceable>;</programlisting>
       </sect2>
       <sect2>
         <title><command>include</command> Statement Definition and
@@ -3603,7 +3628,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
       <sect2>
         <title><command>key</command> Statement Grammar</title>
 
-<programlisting>key <replaceable>key_id</replaceable> {
+<programlisting><command>key</command> <replaceable>key_id</replaceable> {
     algorithm <replaceable>string</replaceable>;
     secret <replaceable>string</replaceable>;
 };
@@ -4364,7 +4389,7 @@ category notify { null; };
           statement in the <filename>named.conf</filename> file:
         </para>
 
-<programlisting>options {
+<programlisting><command>options</command> {
     <optional> version <replaceable>version_string</replaceable>; </optional>
     <optional> hostname <replaceable>hostname_string</replaceable>; </optional>
     <optional> server-id <replaceable>server_id_string</replaceable>; </optional>
@@ -4425,7 +4450,9 @@ category notify { null; };
     <optional> update-check-ksk <replaceable>yes_or_no</replaceable>; </optional>
     <optional> allow-v6-synthesis { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> blackhole { <replaceable>address_match_list</replaceable> }; </optional>
+    <optional> use-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional>
     <optional> avoid-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional>
+    <optional> use-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional>
     <optional> avoid-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional>
     <optional> listen-on <optional> port <replaceable>ip_port</replaceable> </optional> { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> listen-on-v6 <optional> port <replaceable>ip_port</replaceable> </optional> { <replaceable>address_match_list</replaceable> }; </optional>
@@ -5627,11 +5654,12 @@ options {
 		  to address (A or AAAA) records and that glue
 		  address records exist for delegated zones.  For
 		  MX and SRV records only in-zone hostnames are
-		  checked (for out-of-zone hostnames use named-checkzone).
+		  checked (for out-of-zone hostnames use
+		  <command>named-checkzone</command>).
 		  For NS records only names below top of zone are
 		  checked (for out-of-zone names and glue consistency
-		  checks use named-checkzone).  The default is
-		  <command>yes</command>.
+		  checks use <command>named-checkzone</command>).
+	          The default is <command>yes</command>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -6058,7 +6086,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
           </para>
         </sect3>
 
-        <sect3>
+        <sect3 id="query_address">
           <title>Query Address</title>
           <para>
             If the server doesn't know the answer to a question, it will
@@ -6068,25 +6096,94 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
             If <command>address</command> is <command>*</command> (asterisk) or is omitted,
             a wildcard IP address (<command>INADDR_ANY</command>)
             will be used.
+	  </para>
+
+	  <para>
             If <command>port</command> is <command>*</command> or is omitted,
-	    a random unprivileged port number is picked up and will be
-	    used for each query.
-	    It is generally strongly discouraged to
-	    specify a particular port for the
-	    <command>query-source</command> or
-	    <command>query-source-v6</command> options;
-	    it implicitly disables the use of randomized port numbers
-	    and leads to insecure operation.
-            The <command>avoid-v4-udp-ports</command>
-            and <command>avoid-v6-udp-ports</command> options can be used
-            to prevent named
-            from selecting certain ports. The defaults are:
+	    a random port number from a pre-configured
+	    range is picked up and will be used for each query.
+	    The port range(s) is that specified in
+	    the <command>use-v4-udp-ports</command> (for IPv4)
+            and <command>use-v6-udp-ports</command> (for IPv6)
+	    options, excluding the ranges specified in
+	    the <command>avoid-v4-udp-ports</command>
+            and <command>avoid-v6-udp-ports</command> options, respectively.
+	  </para>
+
+          <para>
+	    The defaults of the <command>query-source</command> and
+	    <command>query-source-v6</command> options
+	    are:
           </para>
 
 <programlisting>query-source address * port *;
 query-source-v6 address * port *;
 </programlisting>
 
+          <para>
+	    If <command>use-v4-udp-ports</command> or
+            <command>use-v6-udp-ports</command> is unspecified,
+	    <command>named</command> will check if the operating
+	    system provides a programming interface to retrieve the
+	    system's default range for ephemeral ports.
+	    If such an interface is available,
+	    <command>named</command> will use the corresponding system
+	    default range; otherwise, it will use its own defaults:
+         </para>
+
+<programlisting>use-v4-udp-ports { range 1024 65535; };
+use-v6-udp-ports { range 1024 65535; };
+</programlisting>
+
+          <para>
+	    Note: make sure the ranges be sufficiently large for
+	    security.  A desirable size depends on various parameters,
+	    but we generally recommend it contain at least 16384 ports
+	    (14 bits of entropy).
+	    Note also that the system's default range when used may be
+	    too small for this purpose, and that the range may even be
+	    changed while <command>named</command> is running; the new
+	    range will automatically be applied when <command>named</command>
+	    is reloaded.
+	    It is encouraged to
+	    configure <command>use-v4-udp-ports</command> and
+            <command>use-v6-udp-ports</command> explicitly so that the
+            ranges are sufficiently large and are reasonably
+            independent from the ranges used by other applications.
+          </para>
+
+	  <para>
+	    Note: the operational configuration
+	    where <command>named</command> runs may prohibit the use
+	    of some ports.  For example, UNIX systems will not allow
+	    <command>named</command> running without a root privilege
+	    to use ports less than 1024.
+	    If such ports are included in the specified (or detected)
+	    set of query ports, the corresponding query attempts will
+	    fail, resulting in resolution failures or delay.
+	    It is therefore important to configure the set of ports
+	    that can be safely used in the expected operational environment.
+	  </para>
+
+          <para>
+	    The defaults of the <command>avoid-v4-udp-ports</command> and
+	    <command>avoid-v6-udp-ports</command> options
+	    are:
+          </para>
+
+<programlisting>avoid-v4-udp-ports {};
+avoid-v6-udp-ports {};
+</programlisting>
+
+	  <para>
+	    Note: it is generally strongly discouraged to
+            specify a particular port for the
+	    <command>query-source</command> or
+	    <command>query-source-v6</command> options;
+	    it implicitly disables the use of randomized port numbers
+	    and can be insecure.
+          </para>
+
           <note>
             <para>
               The address specified in the <command>query-source</command> option
@@ -6432,17 +6529,48 @@ query-source-v6 address * port *;
         </sect3>
 
         <sect3>
-          <title>Bad UDP Port Lists</title>
-          <para><command>avoid-v4-udp-ports</command>
-	    and <command>avoid-v6-udp-ports</command> specify a list
-            of IPv4 and IPv6 UDP ports that will not be used as system
-            assigned source ports for UDP sockets.  These lists
-            prevent named from choosing as its random source port a
-            port that is blocked by your firewall.  If a query went
-            out with such a source port, the answer would not get by
-            the firewall and the name server would have to query
-            again.
+          <title>UDP Port Lists</title>
+          <para>
+	    <command>use-v4-udp-ports</command>,
+	    <command>avoid-v4-udp-ports</command>,
+	    <command>use-v6-udp-ports</command>, and
+	    <command>avoid-v6-udp-ports</command>
+	    specify a list of IPv4 and IPv6 UDP ports that will be
+	    used or not used as source ports for UDP messages.
+	    See <xref linkend="query_address"/> about how the
+	    available ports are determined.
+	    For example, with the following configuration
           </para>
+
+<programlisting>
+use-v6-udp-ports { range 32768 65535; };
+avoid-v6-udp-ports { 40000; range 50000 60000; };
+</programlisting>
+
+	   <para>
+	     UDP ports of IPv6 messages sent
+	     from <command>named</command> will be in one
+	     of the following ranges: 32768 to 39999, 40001 to 49999,
+	     and 60001 to 65535.
+	   </para>
+
+	   <para>
+	     <command>avoid-v4-udp-ports</command> and
+	     <command>avoid-v6-udp-ports</command> can be used
+             to prevent <command>named</command> from choosing as its random source port a
+             port that is blocked by your firewall or a port that is
+             used by other applications;
+	     if a query went out with a source port blocked by a
+             firewall, the
+	     answer would not get by the firewall and the name server would
+             have to query again.
+	     Note: the desired range can also be represented only with
+	     <command>use-v4-udp-ports</command> and
+	     <command>use-v6-udp-ports</command>, and the
+	     <command>avoid-</command> options are redundant in that
+	     sense; they are provided for backward compatibility and
+	     to possibly simplify the port specification.
+	   </para>
         </sect3>
 
         <sect3>
@@ -6618,8 +6746,10 @@ query-source-v6 address * port *;
 		  transfers.  The default is <literal>512</literal>.
 		  The minimum value is <literal>128</literal> and the
 		  maximum value is <literal>128</literal> less than
-		  'files' or FD_SETSIZE (whichever is smaller).  This
-		  option may be removed in the future.
+		  maxsockets (-S).  This option may be removed in the future.
+                </para>
+                <para>
+		  This option has little effect on Windows.
                 </para>
               </listitem>
             </varlistentry>
@@ -6629,16 +6759,23 @@ query-source-v6 address * port *;
               <listitem>
                 <para>
                   The maximum amount of memory to use for the
-                  server's cache, in bytes.  When the amount of data in the
-                  cache
+                  server's cache, in bytes.
+                  When the amount of data in the cache
                   reaches this limit, the server will cause records to expire
-                  prematurely so that the limit is not exceeded.  In a server
-                  with
-                  multiple views, the limit applies separately to the cache of
-                  each
-                  view.  The default is <literal>unlimited</literal>, meaning that
-                  records are purged from the cache only when their TTLs
-                  expire.
+                  prematurely so that the limit is not exceeded.
+                  A value of 0 is special, meaning that
+                  records are purged from the cache only when their
+                  TTLs expire.
+                  Another special keyword <userinput>unlimited</userinput>
+                  means the maximum value of 32-bit unsigned integers
+                  (0xffffffff), which may not have the same effect as
+                  0 on machines that support more than 32 bits of
+                  memory space.
+                  Any positive values less than 2MB will be ignored reset
+                  to 2MB.
+                  In a server with multiple views, the limit applies
+                  separately to the cache of each view.
+                  The default is 0.
                 </para>
               </listitem>
             </varlistentry>
@@ -7041,6 +7178,10 @@ query-source-v6 address * port *;
 		  Sets the maximum time for which the server will
                   cache ordinary (positive) answers. The default is
                   one week (7 days).
+		  A value of zero may cause all queries to return
+		  SERVFAIL, because of lost caches of intermediate
+		  RRsets (such as NS and glue AAAA/A records) in the
+		  resolution process.
                 </para>
               </listitem>
             </varlistentry>
@@ -7320,9 +7461,8 @@ query-source-v6 address * port *;
 	  <para>
 	    The current list of empty zones is:
 	    <itemizedlist>
+<!-- XXX: The RFC1918 addresses are #defined out in sources currently.
 	      <listitem>10.IN-ADDR.ARPA</listitem>
-	      <listitem>127.IN-ADDR.ARPA</listitem>
-	      <listitem>254.169.IN-ADDR.ARPA</listitem>
 	      <listitem>16.172.IN-ADDR.ARPA</listitem>
 	      <listitem>17.172.IN-ADDR.ARPA</listitem>
 	      <listitem>18.172.IN-ADDR.ARPA</listitem>
@@ -7340,7 +7480,12 @@ query-source-v6 address * port *;
 	      <listitem>30.172.IN-ADDR.ARPA</listitem>
 	      <listitem>31.172.IN-ADDR.ARPA</listitem>
 	      <listitem>168.192.IN-ADDR.ARPA</listitem>
+XXX: end of RFC1918 addresses #defined out -->
+	      <listitem>0.IN-ADDR.ARPA</listitem>
+	      <listitem>127.IN-ADDR.ARPA</listitem>
+	      <listitem>254.169.IN-ADDR.ARPA</listitem>
 	      <listitem>2.0.192.IN-ADDR.ARPA</listitem>
+	      <listitem>255.255.255.255.IN-ADDR.ARPA</listitem>
 	      <listitem>0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</listitem>
 	      <listitem>1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</listitem>
 	      <listitem>D.F.IP6.ARPA</listitem>
@@ -7567,8 +7712,10 @@ query-source-v6 address * port *;
             <command>success</command>,
             <command>referral</command>,
             <command>nxrrset</command>,
-            <command>nxdomain</command>, or
-            <command>failure</command>
+            <command>nxdomain</command>,
+            <command>failure</command>,
+            <command>duplicate</command>, or
+            <command>dropped</command>
             to be incremented, and may additionally cause the
             <command>recursion</command> counter to be
             incremented.
@@ -7699,7 +7846,7 @@ query-source-v6 address * port *;
       <sect2 id="server_statement_grammar">
         <title><command>server</command> Statement Grammar</title>
 
-<programlisting>server <replaceable>ip_addr[/prefixlen]</replaceable> {
+<programlisting><command>server</command> <replaceable>ip_addr[/prefixlen]</replaceable> {
     <optional> bogus <replaceable>yes_or_no</replaceable> ; </optional>
     <optional> provide-ixfr <replaceable>yes_or_no</replaceable> ; </optional>
     <optional> request-ixfr <replaceable>yes_or_no</replaceable> ; </optional>
@@ -7908,7 +8055,7 @@ query-source-v6 address * port *;
         <sect2>
           <title><command>trusted-keys</command> Statement Grammar</title>
 
-<programlisting>trusted-keys {
+<programlisting><command>trusted-keys</command> {
     <replaceable>string</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ;
     <optional> <replaceable>string</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>number</replaceable> <replaceable>string</replaceable> ; <optional>...</optional></optional>
 };
@@ -7949,7 +8096,7 @@ query-source-v6 address * port *;
         <sect2 id="view_statement_grammar">
           <title><command>view</command> Statement Grammar</title>
 
-<programlisting>view <replaceable>view_name</replaceable>
+<programlisting><command>view</command> <replaceable>view_name</replaceable>
       <optional><replaceable>class</replaceable></optional> {
       match-clients { <replaceable>address_match_list</replaceable> };
       match-destinations { <replaceable>address_match_list</replaceable> };
@@ -8005,7 +8152,7 @@ query-source-v6 address * port *;
           <para>
             Zones defined within a <command>view</command>
             statement will
-            be only be accessible to clients that match the <command>view</command>.
+            only be accessible to clients that match the <command>view</command>.
             By defining a zone of the same name in multiple views, different
             zone data can be given to different clients, for example,
             "internal"
@@ -8090,7 +8237,7 @@ view "external" {
           <title><command>zone</command>
             Statement Grammar</title>
 
-<programlisting>zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> {
+<programlisting><command>zone</command> <replaceable>zone_name</replaceable> <optional><replaceable>class</replaceable></optional> {
     type master;
     <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-transfer { <replaceable>address_match_list</replaceable> }; </optional>
@@ -9436,6 +9583,19 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea
                   <row rowsep="0">
                     <entry colname="1">
                       <para>
+                        IPSECKEY
+                      </para>
+                    </entry>
+                    <entry colname="2">
+                      <para>
+			Provides a method for storing IPsec keying material in
+			DNS.  Described in RFC 4025.
+                      </para>
+                    </entry>
+                  </row>
+                  <row rowsep="0">
+                    <entry colname="1">
+                      <para>
                         ISDN
                       </para>
                     </entry>
@@ -9674,6 +9834,19 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea
                   <row rowsep="0">
                     <entry colname="1">
                       <para>
+                        SPF
+                      </para>
+                    </entry>
+                    <entry colname="2">
+                      <para>
+			Contains the Sender Policy Framework information
+			for a given email domain.  Described in RFC 4408.
+                      </para>
+                    </entry>
+                  </row>
+                  <row rowsep="0">
+                    <entry colname="1">
+                      <para>
                         SRV
                       </para>
                     </entry>
@@ -9687,6 +9860,19 @@ zone <replaceable>zone_name</replaceable> <optional><replaceable>class</replacea
                   <row rowsep="0">
                     <entry colname="1">
                       <para>
+                        SSHFP
+                      </para>
+                    </entry>
+                    <entry colname="2">
+                      <para>
+			Provides a way to securly publish a secure shell key's
+			fingerprint.  Described in RFC 4255.
+                      </para>
+                    </entry>
+                  </row>
+                  <row rowsep="0">
+                    <entry colname="1">
+                      <para>
                         TXT
                       </para>
                     </entry>
@@ -10469,7 +10655,7 @@ $GENERATE 1-127 $ CNAME $.0</programlisting>
             is equivalent to
           </para>
 
-<programlisting>0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE.
+<programlisting>0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 30e9e0da4724..76a4bb71ecd6 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.21 2007/10/31 01:35:57 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch01.html,v 1.16.18.26 2008/05/24 01:31:10 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -45,17 +45,17 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564117">Scope of Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564140">Organization of This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563474">Conventions Used in This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564816">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563405">Scope of Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564385">Organization of This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564524">Conventions Used in This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564637">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564837">DNS Fundamentals</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564871">Domains and Domain Names</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567208">Zones</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567285">Authoritative Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567526">Caching Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567588">Name Servers in Multiple Roles</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564659">DNS Fundamentals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564693">Domains and Domain Names</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564845">Zones</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567243">Authoritative Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567416">Caching Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567546">Name Servers in Multiple Roles</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -71,7 +71,7 @@
     </p>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2564117"></a>Scope of Document</h2></div></div></div>
+<a name="id2563405"></a>Scope of Document</h2></div></div></div>
 <p>
         The Berkeley Internet Name Domain
         (<acronym class="acronym">BIND</acronym>) implements a
@@ -87,7 +87,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2564140"></a>Organization of This Document</h2></div></div></div>
+<a name="id2564385"></a>Organization of This Document</h2></div></div></div>
 <p>
         In this document, <span class="emphasis"><em>Section 1</em></span> introduces
         the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Section 2</em></span>
@@ -116,7 +116,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2563474"></a>Conventions Used in This Document</h2></div></div></div>
+<a name="id2564524"></a>Conventions Used in This Document</h2></div></div></div>
 <p>
         In this document, we use the following general typographic
         conventions:
@@ -243,7 +243,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2564816"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
+<a name="id2564637"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
 <p>
         The purpose of this document is to explain the installation
         and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet
@@ -253,7 +253,7 @@
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2564837"></a>DNS Fundamentals</h3></div></div></div>
+<a name="id2564659"></a>DNS Fundamentals</h3></div></div></div>
 <p>
           The Domain Name System (DNS) is a hierarchical, distributed
           database.  It stores information for mapping Internet host names to
@@ -273,7 +273,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2564871"></a>Domains and Domain Names</h3></div></div></div>
+<a name="id2564693"></a>Domains and Domain Names</h3></div></div></div>
 <p>
           The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to
           organizational or administrative boundaries. Each node of the tree,
@@ -319,7 +319,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567208"></a>Zones</h3></div></div></div>
+<a name="id2564845"></a>Zones</h3></div></div></div>
 <p>
           To properly operate a name server, it is important to understand
           the difference between a <span class="emphasis"><em>zone</em></span>
@@ -372,7 +372,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567285"></a>Authoritative Name Servers</h3></div></div></div>
+<a name="id2567243"></a>Authoritative Name Servers</h3></div></div></div>
 <p>
           Each zone is served by at least
           one <span class="emphasis"><em>authoritative name server</em></span>,
@@ -389,7 +389,7 @@
         </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2567308"></a>The Primary Master</h4></div></div></div>
+<a name="id2567267"></a>The Primary Master</h4></div></div></div>
 <p>
             The authoritative server where the master copy of the zone
             data is maintained is called the
@@ -409,7 +409,7 @@
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2567338"></a>Slave Servers</h4></div></div></div>
+<a name="id2567297"></a>Slave Servers</h4></div></div></div>
 <p>
             The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
             servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
@@ -425,7 +425,7 @@
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2567360"></a>Stealth Servers</h4></div></div></div>
+<a name="id2567386"></a>Stealth Servers</h4></div></div></div>
 <p>
             Usually all of the zone's authoritative servers are listed in
             NS records in the parent zone.  These NS records constitute
@@ -460,7 +460,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567526"></a>Caching Name Servers</h3></div></div></div>
+<a name="id2567416"></a>Caching Name Servers</h3></div></div></div>
 <p>
           The resolver libraries provided by most operating systems are
           <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not
@@ -487,7 +487,7 @@
         </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2567561"></a>Forwarding</h4></div></div></div>
+<a name="id2567520"></a>Forwarding</h4></div></div></div>
 <p>
             Even a caching name server does not necessarily perform
             the complete recursive lookup itself.  Instead, it can
@@ -514,7 +514,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567588"></a>Name Servers in Multiple Roles</h3></div></div></div>
+<a name="id2567546"></a>Name Servers in Multiple Roles</h3></div></div></div>
 <p>
           The <acronym class="acronym">BIND</acronym> name server can
           simultaneously act as
diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html
index cbf6c15b65dd..f2abce42f488 100644
--- a/doc/arm/Bv9ARM.ch02.html
+++ b/doc/arm/Bv9ARM.ch02.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.21 2007/10/31 01:35:57 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch02.html,v 1.13.18.28 2008/09/12 01:32:08 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -45,16 +45,16 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567622">Hardware requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567649">CPU Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567661">Memory Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567688">Name Server Intensive Environment Issues</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567699">Supported Operating Systems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567580">Hardware requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567607">CPU Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567620">Memory Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567851">Name Server Intensive Environment Issues</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567862">Supported Operating Systems</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567622"></a>Hardware requirements</h2></div></div></div>
+<a name="id2567580"></a>Hardware requirements</h2></div></div></div>
 <p>
         <acronym class="acronym">DNS</acronym> hardware requirements have
         traditionally been quite modest.
@@ -73,7 +73,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567649"></a>CPU Requirements</h2></div></div></div>
+<a name="id2567607"></a>CPU Requirements</h2></div></div></div>
 <p>
         CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from
         i486-class machines
@@ -84,7 +84,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567661"></a>Memory Requirements</h2></div></div></div>
+<a name="id2567620"></a>Memory Requirements</h2></div></div></div>
 <p>
         The memory of the server has to be large enough to fit the
         cache and zones loaded off disk.  The <span><strong class="command">max-cache-size</strong></span>
@@ -107,7 +107,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567688"></a>Name Server Intensive Environment Issues</h2></div></div></div>
+<a name="id2567851"></a>Name Server Intensive Environment Issues</h2></div></div></div>
 <p>
         For name server intensive environments, there are two alternative
         configurations that may be used. The first is where clients and
@@ -124,16 +124,14 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567699"></a>Supported Operating Systems</h2></div></div></div>
+<a name="id2567862"></a>Supported Operating Systems</h2></div></div></div>
 <p>
         ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large
-        number
-        of Unix-like operating system and on NT-derived versions of
-        Microsoft Windows such as Windows 2000 and Windows XP.  For an
-        up-to-date
-        list of supported systems, see the README file in the top level
-        directory
-        of the BIND 9 source distribution.
+        number of Unix-like operating systems, and on some versions of
+        Microsoft Windows including Windows XP, Windows 2003, and
+        Windows 2008.  For an up-to-date list of supported systems,
+        see the README file in the top level directory of the BIND 9
+        source distribution.
       </p>
 </div>
 </div>
diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html
index 18f2711517c9..4d39c51a8520 100644
--- a/doc/arm/Bv9ARM.ch03.html
+++ b/doc/arm/Bv9ARM.ch03.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.31 2007/10/31 01:35:57 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch03.html,v 1.35.18.36 2008/05/24 01:31:10 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -47,14 +47,14 @@
 <dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568004">A Caching-only Name Server</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568020">An Authoritative-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567894">A Caching-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567910">An Authoritative-only Name Server</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568042">Load Balancing</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568001">Load Balancing</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568423">Name Server Operations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570184">Signals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568428">Tools for Use With the Name Server Daemon</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570142">Signals</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -68,7 +68,7 @@
 <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2568004"></a>A Caching-only Name Server</h3></div></div></div>
+<a name="id2567894"></a>A Caching-only Name Server</h3></div></div></div>
 <p>
           The following sample configuration is appropriate for a caching-only
           name server for use by clients internal to a corporation.  All
@@ -95,7 +95,7 @@ zone "0.0.127.in-addr.arpa" {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2568020"></a>An Authoritative-only Name Server</h3></div></div></div>
+<a name="id2567910"></a>An Authoritative-only Name Server</h3></div></div></div>
 <p>
           This sample configuration is for an authoritative-only server
           that is the master server for "<code class="filename">example.com</code>"
@@ -137,7 +137,7 @@ zone "eng.example.com" {
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2568042"></a>Load Balancing</h2></div></div></div>
+<a name="id2568001"></a>Load Balancing</h2></div></div></div>
 <p>
         A primitive form of load balancing can be achieved in
         the <acronym class="acronym">DNS</acronym> by using multiple records
@@ -280,10 +280,10 @@ zone "eng.example.com" {
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2568465"></a>Name Server Operations</h2></div></div></div>
+<a name="id2568423"></a>Name Server Operations</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2568470"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
+<a name="id2568428"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
 <p>
           This section describes several indispensable diagnostic,
           administrative and monitoring tools available to the system
@@ -739,7 +739,7 @@ controls {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2570184"></a>Signals</h3></div></div></div>
+<a name="id2570142"></a>Signals</h3></div></div></div>
 <p>
           Certain UNIX signals cause the name server to take specific
           actions, as described in the following table.  These signals can
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 09507fe53cbc..e31d85d2c33e 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.41 2007/10/31 01:35:57 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch04.html,v 1.40.18.46 2008/05/24 01:31:11 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -49,29 +49,29 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570642">Split DNS</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570660">Example split DNS setup</a></span></dt></dl></dd>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570600">Split DNS</a></span></dt>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570618">Example split DNS setup</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571095">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571169">Copying the Shared Secret to Both Machines</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571179">Informing the Servers of the Key's Existence</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571219">Instructing the Server to Use the Key</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571413">TSIG Key Based Access Control</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571458">Errors</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570985">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571127">Copying the Shared Secret to Both Machines</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571138">Informing the Servers of the Key's Existence</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571177">Instructing the Server to Use the Key</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571303">TSIG Key Based Access Control</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571416">Errors</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571472">TKEY</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571521">SIG(0)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571430">TKEY</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571547">SIG(0)</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571725">Generating Keys</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571795">Signing the Zone</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571874">Configuring Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571684">Generating Keys</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571753">Signing the Zone</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571832">Configuring Servers</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572153">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571975">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572215">Address Lookups Using AAAA Records</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572236">Address to Name Lookups Using Nibble Format</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572173">Address Lookups Using AAAA Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572195">Address to Name Lookups Using Nibble Format</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -205,7 +205,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2570642"></a>Split DNS</h2></div></div></div>
+<a name="id2570600"></a>Split DNS</h2></div></div></div>
 <p>
         Setting up different views, or visibility, of the DNS space to
         internal and external resolvers is usually referred to as a
@@ -235,7 +235,7 @@
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2570660"></a>Example split DNS setup</h3></div></div></div>
+<a name="id2570618"></a>Example split DNS setup</h3></div></div></div>
 <p>
         Let's say a company named <span class="emphasis"><em>Example, Inc.</em></span>
         (<code class="literal">example.com</code>)
@@ -481,7 +481,7 @@ nameserver 172.16.72.4
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571095"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
+<a name="id2570985"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
 <p>
           A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
           An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -489,7 +489,7 @@ nameserver 172.16.72.4
         </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2571112"></a>Automatic Generation</h4></div></div></div>
+<a name="id2571070"></a>Automatic Generation</h4></div></div></div>
 <p>
             The following command will generate a 128-bit (16 byte) HMAC-MD5
             key as described above. Longer keys are better, but shorter keys
@@ -514,7 +514,7 @@ nameserver 172.16.72.4
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2571150"></a>Manual Generation</h4></div></div></div>
+<a name="id2571109"></a>Manual Generation</h4></div></div></div>
 <p>
             The shared secret is simply a random sequence of bits, encoded
             in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -529,7 +529,7 @@ nameserver 172.16.72.4
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571169"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
+<a name="id2571127"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
 <p>
           This is beyond the scope of DNS. A secure transport mechanism
           should be used. This could be secure FTP, ssh, telephone, etc.
@@ -537,7 +537,7 @@ nameserver 172.16.72.4
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571179"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
+<a name="id2571138"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
 <p>
           Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span>
           are
@@ -566,7 +566,7 @@ key host1-host2. {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571219"></a>Instructing the Server to Use the Key</h3></div></div></div>
+<a name="id2571177"></a>Instructing the Server to Use the Key</h3></div></div></div>
 <p>
           Since keys are shared between two hosts only, the server must
           be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
@@ -598,7 +598,7 @@ server 10.1.2.3 {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571413"></a>TSIG Key Based Access Control</h3></div></div></div>
+<a name="id2571303"></a>TSIG Key Based Access Control</h3></div></div></div>
 <p>
           <acronym class="acronym">BIND</acronym> allows IP addresses and ranges
           to be specified in ACL
@@ -626,7 +626,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571458"></a>Errors</h3></div></div></div>
+<a name="id2571416"></a>Errors</h3></div></div></div>
 <p>
           The processing of TSIG signed messages can result in
           several errors. If a signed message is sent to a non-TSIG aware
@@ -652,7 +652,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2571472"></a>TKEY</h2></div></div></div>
+<a name="id2571430"></a>TKEY</h2></div></div></div>
 <p><span><strong class="command">TKEY</strong></span>
         is a mechanism for automatically generating a shared secret
         between two hosts.  There are several "modes" of
@@ -688,7 +688,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2571521"></a>SIG(0)</h2></div></div></div>
+<a name="id2571547"></a>SIG(0)</h2></div></div></div>
 <p>
         <acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0)
             transaction signatures as specified in RFC 2535 and RFC2931.
@@ -749,7 +749,7 @@ allow-update { key host1-host2. ;};
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571725"></a>Generating Keys</h3></div></div></div>
+<a name="id2571684"></a>Generating Keys</h3></div></div></div>
 <p>
           The <span><strong class="command">dnssec-keygen</strong></span> program is used to
           generate keys.
@@ -800,7 +800,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571795"></a>Signing the Zone</h3></div></div></div>
+<a name="id2571753"></a>Signing the Zone</h3></div></div></div>
 <p>
           The <span><strong class="command">dnssec-signzone</strong></span> program is used
           to
@@ -844,7 +844,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2571874"></a>Configuring Servers</h3></div></div></div>
+<a name="id2571832"></a>Configuring Servers</h3></div></div></div>
 <p>
           To enable <span><strong class="command">named</strong></span> to respond appropriately
           to DNS requests from DNSSEC aware clients,
@@ -932,7 +932,7 @@ options {
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2572153"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
+<a name="id2571975"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
 <p>
         <acronym class="acronym">BIND</acronym> 9 fully supports all currently
         defined forms of IPv6
@@ -971,7 +971,7 @@ options {
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2572215"></a>Address Lookups Using AAAA Records</h3></div></div></div>
+<a name="id2572173"></a>Address Lookups Using AAAA Records</h3></div></div></div>
 <p>
           The IPv6 AAAA record is a parallel to the IPv4 A record,
           and, unlike the deprecated A6 record, specifies the entire
@@ -990,7 +990,7 @@ host            3600    IN      AAAA    2001:db8::1
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2572236"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div>
+<a name="id2572195"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div>
 <p>
           When looking up an address in nibble format, the address
           components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 80418b9a22da..33d1d0d195a0 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.33 2007/10/31 01:35:58 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch05.html,v 1.33.18.38 2008/05/24 01:31:11 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -45,13 +45,13 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572269">The Lightweight Resolver Library</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572228">The Lightweight Resolver Library</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2572269"></a>The Lightweight Resolver Library</h2></div></div></div>
+<a name="id2572228"></a>The Lightweight Resolver Library</h2></div></div></div>
 <p>
         Traditionally applications have been linked with a stub resolver
         library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 59b9cf59a2cd..e2929068970d 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.73.8.1 2008/05/27 22:07:34 each Exp $ -->
+<!-- $Id: Bv9ARM.ch06.html,v 1.82.18.88 2008/10/18 01:29:58 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -48,52 +48,52 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573480">Comment Syntax</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573436">Comment Syntax</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574092"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574117"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574282"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574307"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574726"><span><strong class="command">include</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574736"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574753"><span><strong class="command">include</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574749"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574771"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574930"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575056"><span><strong class="command">logging</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574776"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574800"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574958"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575084"><span><strong class="command">logging</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576406"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576480"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576544"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576587"><span><strong class="command">masters</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576435"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576508"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576572"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576616"><span><strong class="command">masters</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576602"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576631"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
           Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
             Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585361"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585410"><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585614"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585666"><span><strong class="command">trusted-keys</strong></span> Statement Definition
             and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585490"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585748"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
             Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586798"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587332"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589080">Zone File</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589477">Zone File</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591101">Discussion of MX Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591500">Discussion of MX Records</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591653">Inverse Mapping in IPv4</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591848">Other Zone File Directives</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592173"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592188">Inverse Mapping in IPv4</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592384">Other Zone File Directives</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592572"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
 </dl></dd>
 </dl>
@@ -355,6 +355,33 @@
 <tr>
 <td>
                 <p>
+                  <code class="varname">port_list</code>
+                </p>
+              </td>
+<td>
+                <p>
+                  A list of an <code class="varname">ip_port</code> or a port
+                  range.
+                  A port range is specified in the form of
+                  <strong class="userinput"><code>range</code></strong> followed by
+                  two <code class="varname">ip_port</code>s,
+                  <code class="varname">port_low</code> and
+                  <code class="varname">port_high</code>, which represents
+                  port numbers from <code class="varname">port_low</code> through
+                  <code class="varname">port_high</code>, inclusive.
+                  <code class="varname">port_low</code> must not be larger than
+                  <code class="varname">port_high</code>.
+                  For example,
+                  <strong class="userinput"><code>range 1024 65535</code></strong> represents
+                  ports from 1024 through 65535.
+                  In either case an asterisk (`*') character is not
+                  allowed as a valid <code class="varname">ip_port</code>.
+                </p>
+              </td>
+</tr>
+<tr>
+<td>
+                <p>
                   <code class="varname">size_spec</code>
                 </p>
               </td>
@@ -428,7 +455,7 @@
 <a name="address_match_lists"></a>Address Match Lists</h3></div></div></div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2573277"></a>Syntax</h4></div></div></div>
+<a name="id2573302"></a>Syntax</h4></div></div></div>
 <pre class="programlisting"><code class="varname">address_match_list</code> = address_match_list_element ;
   [<span class="optional"> address_match_list_element; ... </span>]
 <code class="varname">address_match_list_element</code> = [<span class="optional"> ! </span>] (ip_address [<span class="optional">/length</span>] |
@@ -437,7 +464,7 @@
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2573305"></a>Definition and Usage</h4></div></div></div>
+<a name="id2573330"></a>Definition and Usage</h4></div></div></div>
 <p>
             Address match lists are primarily used to determine access
             control for various server operations. They are also used in
@@ -515,7 +542,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2573480"></a>Comment Syntax</h3></div></div></div>
+<a name="id2573436"></a>Comment Syntax</h3></div></div></div>
 <p>
           The <acronym class="acronym">BIND</acronym> 9 comment syntax allows for
           comments to appear
@@ -525,7 +552,7 @@
         </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2573495"></a>Syntax</h4></div></div></div>
+<a name="id2573588"></a>Syntax</h4></div></div></div>
 <p>
             </p>
 <pre class="programlisting">/* This is a <acronym class="acronym">BIND</acronym> comment as in C */</pre>
@@ -540,7 +567,7 @@
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2573525"></a>Definition and Usage</h4></div></div></div>
+<a name="id2573618"></a>Definition and Usage</h4></div></div></div>
 <p>
             Comments may appear anywhere that whitespace may appear in
             a <acronym class="acronym">BIND</acronym> configuration file.
@@ -774,7 +801,7 @@
       </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574092"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2574117"></a><span><strong class="command">acl</strong></span> Statement Grammar</h3></div></div></div>
 <pre class="programlisting"><span><strong class="command">acl</strong></span> acl-name {
     address_match_list
 };
@@ -857,7 +884,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574282"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2574307"></a><span><strong class="command">controls</strong></span> Statement Grammar</h3></div></div></div>
 <pre class="programlisting"><span><strong class="command">controls</strong></span> {
    [ inet ( ip_addr | * ) [ port ip_port ] allow { <em class="replaceable"><code> address_match_list </code></em> }
                 keys { <em class="replaceable"><code>key_list</code></em> }; ]
@@ -979,12 +1006,12 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574711"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
-<pre class="programlisting">include <em class="replaceable"><code>filename</code></em>;</pre>
+<a name="id2574736"></a><span><strong class="command">include</strong></span> Statement Grammar</h3></div></div></div>
+<pre class="programlisting"><span><strong class="command">include</strong></span> <em class="replaceable"><code>filename</code></em>;</pre>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574726"></a><span><strong class="command">include</strong></span> Statement Definition and
+<a name="id2574753"></a><span><strong class="command">include</strong></span> Statement Definition and
           Usage</h3></div></div></div>
 <p>
           The <span><strong class="command">include</strong></span> statement inserts the
@@ -999,8 +1026,8 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574749"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
-<pre class="programlisting">key <em class="replaceable"><code>key_id</code></em> {
+<a name="id2574776"></a><span><strong class="command">key</strong></span> Statement Grammar</h3></div></div></div>
+<pre class="programlisting"><span><strong class="command">key</strong></span> <em class="replaceable"><code>key_id</code></em> {
     algorithm <em class="replaceable"><code>string</code></em>;
     secret <em class="replaceable"><code>string</code></em>;
 };
@@ -1008,7 +1035,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574771"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2574800"></a><span><strong class="command">key</strong></span> Statement Definition and Usage</h3></div></div></div>
 <p>
           The <span><strong class="command">key</strong></span> statement defines a shared
           secret key for use with TSIG (see <a href="Bv9ARM.ch04.html#tsig" title="TSIG">the section called &#8220;TSIG&#8221;</a>)
@@ -1055,7 +1082,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2574930"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2574958"></a><span><strong class="command">logging</strong></span> Statement Grammar</h3></div></div></div>
 <pre class="programlisting"><span><strong class="command">logging</strong></span> {
    [ <span><strong class="command">channel</strong></span> <em class="replaceable"><code>channel_name</code></em> {
      ( <span><strong class="command">file</strong></span> <em class="replaceable"><code>path name</code></em>
@@ -1079,7 +1106,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2575056"></a><span><strong class="command">logging</strong></span> Statement Definition and
+<a name="id2575084"></a><span><strong class="command">logging</strong></span> Statement Definition and
           Usage</h3></div></div></div>
 <p>
           The <span><strong class="command">logging</strong></span> statement configures a
@@ -1113,7 +1140,7 @@
         </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2575108"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
+<a name="id2575137"></a>The <span><strong class="command">channel</strong></span> Phrase</h4></div></div></div>
 <p>
             All log output goes to one or more <span class="emphasis"><em>channels</em></span>;
             you can make as many of them as you want.
@@ -1632,7 +1659,7 @@ category notify { null; };
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2576406"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2576435"></a><span><strong class="command">lwres</strong></span> Statement Grammar</h3></div></div></div>
 <p>
            This is the grammar of the <span><strong class="command">lwres</strong></span>
           statement in the <code class="filename">named.conf</code> file:
@@ -1647,7 +1674,7 @@ category notify { null; };
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2576480"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2576508"></a><span><strong class="command">lwres</strong></span> Statement Definition and Usage</h3></div></div></div>
 <p>
           The <span><strong class="command">lwres</strong></span> statement configures the
           name
@@ -1698,14 +1725,14 @@ category notify { null; };
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2576544"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2576572"></a><span><strong class="command">masters</strong></span> Statement Grammar</h3></div></div></div>
 <pre class="programlisting">
 <span><strong class="command">masters</strong></span> <em class="replaceable"><code>name</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] { ( <em class="replaceable"><code>masters_list</code></em> | <em class="replaceable"><code>ip_addr</code></em> [<span class="optional">port <em class="replaceable"><code>ip_port</code></em></span>] [<span class="optional">key <em class="replaceable"><code>key</code></em></span>] ) ; [<span class="optional">...</span>] };
 </pre>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2576587"></a><span><strong class="command">masters</strong></span> Statement Definition and
+<a name="id2576616"></a><span><strong class="command">masters</strong></span> Statement Definition and
           Usage</h3></div></div></div>
 <p><span><strong class="command">masters</strong></span>
           lists allow for a common set of masters to be easily used by
@@ -1714,12 +1741,12 @@ category notify { null; };
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2576602"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
+<a name="id2576631"></a><span><strong class="command">options</strong></span> Statement Grammar</h3></div></div></div>
 <p>
           This is the grammar of the <span><strong class="command">options</strong></span>
           statement in the <code class="filename">named.conf</code> file:
         </p>
-<pre class="programlisting">options {
+<pre class="programlisting"><span><strong class="command">options</strong></span> {
     [<span class="optional"> version <em class="replaceable"><code>version_string</code></em>; </span>]
     [<span class="optional"> hostname <em class="replaceable"><code>hostname_string</code></em>; </span>]
     [<span class="optional"> server-id <em class="replaceable"><code>server_id_string</code></em>; </span>]
@@ -1780,7 +1807,9 @@ category notify { null; };
     [<span class="optional"> update-check-ksk <em class="replaceable"><code>yes_or_no</code></em>; </span>]
     [<span class="optional"> allow-v6-synthesis { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
     [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
+    [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
     [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
+    [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
     [<span class="optional"> avoid-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
     [<span class="optional"> listen-on [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
     [<span class="optional"> listen-on-v6 [<span class="optional"> port <em class="replaceable"><code>ip_port</code></em> </span>] { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
@@ -1797,6 +1826,7 @@ category notify { null; };
     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-idle-out <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> tcp-clients <em class="replaceable"><code>number</code></em>; </span>]
+    [<span class="optional"> reserved-sockets <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> recursive-clients <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> serial-query-rate <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> serial-queries <em class="replaceable"><code>number</code></em>; </span>]
@@ -2739,11 +2769,12 @@ options {
                   to address (A or AAAA) records and that glue
                   address records exist for delegated zones.  For
                   MX and SRV records only in-zone hostnames are
-                  checked (for out-of-zone hostnames use named-checkzone).
+                  checked (for out-of-zone hostnames use
+                  <span><strong class="command">named-checkzone</strong></span>).
                   For NS records only names below top of zone are
                   checked (for out-of-zone names and glue consistency
-                  checks use named-checkzone).  The default is
-                  <span><strong class="command">yes</strong></span>.
+                  checks use <span><strong class="command">named-checkzone</strong></span>).
+                  The default is <span><strong class="command">yes</strong></span>.
                 </p></dd>
 <dt><span class="term"><span><strong class="command">check-mx-cname</strong></span></span></dt>
 <dd><p>
@@ -2789,7 +2820,7 @@ options {
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2580536"></a>Forwarding</h4></div></div></div>
+<a name="id2580525"></a>Forwarding</h4></div></div></div>
 <p>
             The forwarding facility can be used to create a large site-wide
             cache on a few servers, reducing traffic over links to external
@@ -2833,7 +2864,7 @@ options {
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2580595"></a>Dual-stack Servers</h4></div></div></div>
+<a name="id2580721"></a>Dual-stack Servers</h4></div></div></div>
 <p>
             Dual-stack servers are used as servers of last resort to work
             around
@@ -2988,7 +3019,7 @@ options {
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2581153"></a>Interfaces</h4></div></div></div>
+<a name="id2581142"></a>Interfaces</h4></div></div></div>
 <p>
             The interfaces and ports that the server will answer queries
             from may be specified using the <span><strong class="command">listen-on</strong></span> option. <span><strong class="command">listen-on</strong></span> takes
@@ -3068,7 +3099,7 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2581241"></a>Query Address</h4></div></div></div>
+<a name="query_address"></a>Query Address</h4></div></div></div>
 <p>
             If the server doesn't know the answer to a question, it will
             query other name servers. <span><strong class="command">query-source</strong></span> specifies
@@ -3077,23 +3108,83 @@ listen-on-v6 port 1234 { !2001:db8::/32; any; };
             If <span><strong class="command">address</strong></span> is <span><strong class="command">*</strong></span> (asterisk) or is omitted,
             a wildcard IP address (<span><strong class="command">INADDR_ANY</strong></span>)
             will be used.
+          </p>
+<p>
             If <span><strong class="command">port</strong></span> is <span><strong class="command">*</strong></span> or is omitted,
-	    a random unprivileged port number is picked up and will be
-            used for each query.
-	    It is generally strongly discouraged to
-	    specify a particular port for the
-	    <span><strong class="command">query-source</strong></span> or
-	    <span><strong class="command">query-source-v6</strong></span>
-	    options; it implicitly disables the use of randomized port numbers
-	    and leads to insecure operation.
-	    The <span><strong class="command">avoid-v4-udp-ports</strong></span>
-	    and <span><strong class="command">avoid-v6-udp-ports</strong></span> options can be used
-	    to prevent named
-	    from selecting certain ports. The defaults are:
+            a random port number from a pre-configured
+            range is picked up and will be used for each query.
+            The port range(s) is that specified in
+            the <span><strong class="command">use-v4-udp-ports</strong></span> (for IPv4)
+            and <span><strong class="command">use-v6-udp-ports</strong></span> (for IPv6)
+            options, excluding the ranges specified in
+            the <span><strong class="command">avoid-v4-udp-ports</strong></span>
+            and <span><strong class="command">avoid-v6-udp-ports</strong></span> options, respectively.
+          </p>
+<p>
+            The defaults of the <span><strong class="command">query-source</strong></span> and
+            <span><strong class="command">query-source-v6</strong></span> options
+            are:
           </p>
 <pre class="programlisting">query-source address * port *;
 query-source-v6 address * port *;
 </pre>
+<p>
+            If <span><strong class="command">use-v4-udp-ports</strong></span> or
+            <span><strong class="command">use-v6-udp-ports</strong></span> is unspecified,
+            <span><strong class="command">named</strong></span> will check if the operating
+            system provides a programming interface to retrieve the
+            system's default range for ephemeral ports.
+            If such an interface is available,
+            <span><strong class="command">named</strong></span> will use the corresponding system
+            default range; otherwise, it will use its own defaults:
+         </p>
+<pre class="programlisting">use-v4-udp-ports { range 1024 65535; };
+use-v6-udp-ports { range 1024 65535; };
+</pre>
+<p>
+            Note: make sure the ranges be sufficiently large for
+            security.  A desirable size depends on various parameters,
+            but we generally recommend it contain at least 16384 ports
+            (14 bits of entropy).
+            Note also that the system's default range when used may be
+            too small for this purpose, and that the range may even be
+            changed while <span><strong class="command">named</strong></span> is running; the new
+            range will automatically be applied when <span><strong class="command">named</strong></span>
+            is reloaded.
+            It is encouraged to
+            configure <span><strong class="command">use-v4-udp-ports</strong></span> and
+            <span><strong class="command">use-v6-udp-ports</strong></span> explicitly so that the
+            ranges are sufficiently large and are reasonably
+            independent from the ranges used by other applications.
+          </p>
+<p>
+            Note: the operational configuration
+            where <span><strong class="command">named</strong></span> runs may prohibit the use
+            of some ports.  For example, UNIX systems will not allow
+            <span><strong class="command">named</strong></span> running without a root privilege
+            to use ports less than 1024.
+            If such ports are included in the specified (or detected)
+            set of query ports, the corresponding query attempts will
+            fail, resulting in resolution failures or delay.
+            It is therefore important to configure the set of ports
+            that can be safely used in the expected operational environment.
+          </p>
+<p>
+            The defaults of the <span><strong class="command">avoid-v4-udp-ports</strong></span> and
+            <span><strong class="command">avoid-v6-udp-ports</strong></span> options
+            are:
+          </p>
+<pre class="programlisting">avoid-v4-udp-ports {};
+avoid-v6-udp-ports {};
+</pre>
+<p>
+            Note: it is generally strongly discouraged to
+            specify a particular port for the
+            <span><strong class="command">query-source</strong></span> or
+            <span><strong class="command">query-source-v6</strong></span> options;
+            it implicitly disables the use of randomized port numbers
+            and can be insecure.
+          </p>
 <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
 <p>
@@ -3356,21 +3447,49 @@ query-source-v6 address * port *;
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2581988"></a>Bad UDP Port Lists</h4></div></div></div>
-<p><span><strong class="command">avoid-v4-udp-ports</strong></span>
-            and <span><strong class="command">avoid-v6-udp-ports</strong></span> specify a list
-            of IPv4 and IPv6 UDP ports that will not be used as system
-            assigned source ports for UDP sockets.  These lists
-            prevent named from choosing as its random source port a
-            port that is blocked by your firewall.  If a query went
-            out with such a source port, the answer would not get by
-            the firewall and the name server would have to query
-            again.
+<a name="id2582140"></a>UDP Port Lists</h4></div></div></div>
+<p>
+            <span><strong class="command">use-v4-udp-ports</strong></span>,
+            <span><strong class="command">avoid-v4-udp-ports</strong></span>,
+            <span><strong class="command">use-v6-udp-ports</strong></span>, and
+            <span><strong class="command">avoid-v6-udp-ports</strong></span>
+            specify a list of IPv4 and IPv6 UDP ports that will be
+            used or not used as source ports for UDP messages.
+            See <a href="Bv9ARM.ch06.html#query_address" title="Query Address">the section called &#8220;Query Address&#8221;</a> about how the
+            available ports are determined.
+            For example, with the following configuration
           </p>
+<pre class="programlisting">
+use-v6-udp-ports { range 32768 65535; };
+avoid-v6-udp-ports { 40000; range 50000 60000; };
+</pre>
+<p>
+             UDP ports of IPv6 messages sent
+             from <span><strong class="command">named</strong></span> will be in one
+             of the following ranges: 32768 to 39999, 40001 to 49999,
+             and 60001 to 65535.
+           </p>
+<p>
+             <span><strong class="command">avoid-v4-udp-ports</strong></span> and
+             <span><strong class="command">avoid-v6-udp-ports</strong></span> can be used
+             to prevent <span><strong class="command">named</strong></span> from choosing as its random source port a
+             port that is blocked by your firewall or a port that is
+             used by other applications;
+             if a query went out with a source port blocked by a
+             firewall, the
+             answer would not get by the firewall and the name server would
+             have to query again.
+             Note: the desired range can also be represented only with
+             <span><strong class="command">use-v4-udp-ports</strong></span> and
+             <span><strong class="command">use-v6-udp-ports</strong></span>, and the
+             <span><strong class="command">avoid-</strong></span> options are redundant in that
+             sense; they are provided for backward compatibility and
+             to possibly simplify the port specification.
+           </p>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2582003"></a>Operating System Resource Limits</h4></div></div></div>
+<a name="id2582200"></a>Operating System Resource Limits</h4></div></div></div>
 <p>
             The server's usage of many system resources can be limited.
             Scaled values are allowed when specifying resource limits.  For
@@ -3429,7 +3548,7 @@ query-source-v6 address * port *;
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2582186"></a>Server  Resource Limits</h4></div></div></div>
+<a name="id2582452"></a>Server  Resource Limits</h4></div></div></div>
 <p>
             The following options set limits on the server's
             resource consumption that are enforced internally by the
@@ -3478,19 +3597,42 @@ query-source-v6 address * port *;
                   connections that the server will accept.
                   The default is <code class="literal">100</code>.
                 </p></dd>
+<dt><span class="term"><span><strong class="command">reserved-sockets</strong></span></span></dt>
+<dd>
+<p>
+                  The number of file descriptors reserved for TCP, stdio,
+                  etc.  This needs to be big enough to cover the number of
+                  interfaces named listens on, tcp-clients as well as
+                  to provide room for outgoing TCP queries and incoming zone
+                  transfers.  The default is <code class="literal">512</code>.
+                  The minimum value is <code class="literal">128</code> and the
+                  maximum value is <code class="literal">128</code> less than
+                  maxsockets (-S).  This option may be removed in the future.
+                </p>
+<p>
+                  This option has little effect on Windows.
+                </p>
+</dd>
 <dt><span class="term"><span><strong class="command">max-cache-size</strong></span></span></dt>
 <dd><p>
                   The maximum amount of memory to use for the
-                  server's cache, in bytes.  When the amount of data in the
-                  cache
+                  server's cache, in bytes.
+                  When the amount of data in the cache
                   reaches this limit, the server will cause records to expire
-                  prematurely so that the limit is not exceeded.  In a server
-                  with
-                  multiple views, the limit applies separately to the cache of
-                  each
-                  view.  The default is <code class="literal">unlimited</code>, meaning that
-                  records are purged from the cache only when their TTLs
-                  expire.
+                  prematurely so that the limit is not exceeded.
+                  A value of 0 is special, meaning that
+                  records are purged from the cache only when their
+                  TTLs expire.
+                  Another special keyword <strong class="userinput"><code>unlimited</code></strong>
+                  means the maximum value of 32-bit unsigned integers
+                  (0xffffffff), which may not have the same effect as
+                  0 on machines that support more than 32 bits of
+                  memory space.
+                  Any positive values less than 2MB will be ignored reset
+                  to 2MB.
+                  In a server with multiple views, the limit applies
+                  separately to the cache of each view.
+                  The default is 0.
                 </p></dd>
 <dt><span class="term"><span><strong class="command">tcp-listen-queue</strong></span></span></dt>
 <dd><p>
@@ -3507,7 +3649,7 @@ query-source-v6 address * port *;
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2582320"></a>Periodic Task Intervals</h4></div></div></div>
+<a name="id2582682"></a>Periodic Task Intervals</h4></div></div></div>
 <div class="variablelist"><dl>
 <dt><span class="term"><span><strong class="command">cleaning-interval</strong></span></span></dt>
 <dd><p>
@@ -3837,6 +3979,10 @@ query-source-v6 address * port *;
                   Sets the maximum time for which the server will
                   cache ordinary (positive) answers. The default is
                   one week (7 days).
+                  A value of zero may cause all queries to return
+                  SERVFAIL, because of lost caches of intermediate
+                  RRsets (such as NS and glue AAAA/A records) in the
+                  resolution process.
                 </p></dd>
 <dt><span class="term"><span><strong class="command">min-roots</strong></span></span></dt>
 <dd>
@@ -4062,27 +4208,11 @@ query-source-v6 address * port *;
             The current list of empty zones is:
             </p>
 <div class="itemizedlist"><ul type="disc">
-<li>10.IN-ADDR.ARPA</li>
+<li>0.IN-ADDR.ARPA</li>
 <li>127.IN-ADDR.ARPA</li>
 <li>254.169.IN-ADDR.ARPA</li>
-<li>16.172.IN-ADDR.ARPA</li>
-<li>17.172.IN-ADDR.ARPA</li>
-<li>18.172.IN-ADDR.ARPA</li>
-<li>19.172.IN-ADDR.ARPA</li>
-<li>20.172.IN-ADDR.ARPA</li>
-<li>21.172.IN-ADDR.ARPA</li>
-<li>22.172.IN-ADDR.ARPA</li>
-<li>23.172.IN-ADDR.ARPA</li>
-<li>24.172.IN-ADDR.ARPA</li>
-<li>25.172.IN-ADDR.ARPA</li>
-<li>26.172.IN-ADDR.ARPA</li>
-<li>27.172.IN-ADDR.ARPA</li>
-<li>28.172.IN-ADDR.ARPA</li>
-<li>29.172.IN-ADDR.ARPA</li>
-<li>30.172.IN-ADDR.ARPA</li>
-<li>31.172.IN-ADDR.ARPA</li>
-<li>168.192.IN-ADDR.ARPA</li>
 <li>2.0.192.IN-ADDR.ARPA</li>
+<li>255.255.255.255.IN-ADDR.ARPA</li>
 <li>0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</li>
 <li>1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA</li>
 <li>D.F.IP6.ARPA</li>
@@ -4292,8 +4422,10 @@ query-source-v6 address * port *;
             <span><strong class="command">success</strong></span>,
             <span><strong class="command">referral</strong></span>,
             <span><strong class="command">nxrrset</strong></span>,
-            <span><strong class="command">nxdomain</strong></span>, or
-            <span><strong class="command">failure</strong></span>
+            <span><strong class="command">nxdomain</strong></span>,
+            <span><strong class="command">failure</strong></span>,
+            <span><strong class="command">duplicate</strong></span>, or
+            <span><strong class="command">dropped</strong></span>
             to be incremented, and may additionally cause the
             <span><strong class="command">recursion</strong></span> counter to be
             incremented.
@@ -4397,7 +4529,7 @@ query-source-v6 address * port *;
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="server_statement_grammar"></a><span><strong class="command">server</strong></span> Statement Grammar</h3></div></div></div>
-<pre class="programlisting">server <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
+<pre class="programlisting"><span><strong class="command">server</strong></span> <em class="replaceable"><code>ip_addr[/prefixlen]</code></em> {
     [<span class="optional"> bogus <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
     [<span class="optional"> provide-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
     [<span class="optional"> request-ixfr <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
@@ -4587,8 +4719,8 @@ query-source-v6 address * port *;
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2585361"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
-<pre class="programlisting">trusted-keys {
+<a name="id2585614"></a><span><strong class="command">trusted-keys</strong></span> Statement Grammar</h3></div></div></div>
+<pre class="programlisting"><span><strong class="command">trusted-keys</strong></span> {
     <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ;
     [<span class="optional"> <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>number</code></em> <em class="replaceable"><code>string</code></em> ; [<span class="optional">...</span>]</span>]
 };
@@ -4596,7 +4728,7 @@ query-source-v6 address * port *;
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2585410"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<a name="id2585666"></a><span><strong class="command">trusted-keys</strong></span> Statement Definition
             and Usage</h3></div></div></div>
 <p>
             The <span><strong class="command">trusted-keys</strong></span> statement defines
@@ -4627,7 +4759,7 @@ query-source-v6 address * port *;
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="view_statement_grammar"></a><span><strong class="command">view</strong></span> Statement Grammar</h3></div></div></div>
-<pre class="programlisting">view <em class="replaceable"><code>view_name</code></em>
+<pre class="programlisting"><span><strong class="command">view</strong></span> <em class="replaceable"><code>view_name</code></em>
       [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
       match-clients { <em class="replaceable"><code>address_match_list</code></em> };
       match-destinations { <em class="replaceable"><code>address_match_list</code></em> };
@@ -4639,7 +4771,7 @@ query-source-v6 address * port *;
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2585490"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2585748"></a><span><strong class="command">view</strong></span> Statement Definition and Usage</h3></div></div></div>
 <p>
             The <span><strong class="command">view</strong></span> statement is a powerful
             feature
@@ -4680,7 +4812,7 @@ query-source-v6 address * port *;
 <p>
             Zones defined within a <span><strong class="command">view</strong></span>
             statement will
-            be only be accessible to clients that match the <span><strong class="command">view</strong></span>.
+            only be accessible to clients that match the <span><strong class="command">view</strong></span>.
             By defining a zone of the same name in multiple views, different
             zone data can be given to different clients, for example,
             "internal"
@@ -4759,7 +4891,7 @@ view "external" {
 <div class="titlepage"><div><div><h3 class="title">
 <a name="zone_statement_grammar"></a><span><strong class="command">zone</strong></span>
             Statement Grammar</h3></div></div></div>
-<pre class="programlisting">zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
+<pre class="programlisting"><span><strong class="command">zone</strong></span> <em class="replaceable"><code>zone_name</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em></span>] {
     type master;
     [<span class="optional"> allow-query { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
     [<span class="optional"> allow-transfer { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
@@ -4891,10 +5023,10 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2586798"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
+<a name="id2587332"></a><span><strong class="command">zone</strong></span> Statement Definition and Usage</h3></div></div></div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2586806"></a>Zone Types</h4></div></div></div>
+<a name="id2587339"></a>Zone Types</h4></div></div></div>
 <div class="informaltable"><table border="1">
 <colgroup>
 <col>
@@ -5103,7 +5235,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2587362"></a>Class</h4></div></div></div>
+<a name="id2587690"></a>Class</h4></div></div></div>
 <p>
               The zone's name may optionally be followed by a class. If
               a class is not specified, class <code class="literal">IN</code> (for <code class="varname">Internet</code>),
@@ -5125,7 +5257,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2587395"></a>Zone Options</h4></div></div></div>
+<a name="id2587723"></a>Zone Options</h4></div></div></div>
 <div class="variablelist"><dl>
 <dt><span class="term"><span><strong class="command">allow-notify</strong></span></span></dt>
 <dd><p>
@@ -5613,7 +5745,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2589080"></a>Zone File</h2></div></div></div>
+<a name="id2589477"></a>Zone File</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="types_of_resource_records_and_when_to_use_them"></a>Types of Resource Records and When to Use Them</h3></div></div></div>
@@ -5626,7 +5758,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
           </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2589098"></a>Resource Records</h4></div></div></div>
+<a name="id2589495"></a>Resource Records</h4></div></div></div>
 <p>
               A domain name identifies a node.  Each node has a set of
               resource information, which may be empty.  The set of resource
@@ -5890,6 +6022,19 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 <tr>
 <td>
                       <p>
+                        IPSECKEY
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        Provides a method for storing IPsec keying material in
+                        DNS.  Described in RFC 4025.
+                      </p>
+                    </td>
+</tr>
+<tr>
+<td>
+                      <p>
                         ISDN
                       </p>
                     </td>
@@ -6128,6 +6273,19 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 <tr>
 <td>
                       <p>
+                        SPF
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        Contains the Sender Policy Framework information
+                        for a given email domain.  Described in RFC 4408.
+                      </p>
+                    </td>
+</tr>
+<tr>
+<td>
+                      <p>
                         SRV
                       </p>
                     </td>
@@ -6141,6 +6299,19 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 <tr>
 <td>
                       <p>
+                        SSHFP
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        Provides a way to securly publish a secure shell key's
+                        fingerprint.  Described in RFC 4255.
+                      </p>
+                    </td>
+</tr>
+<tr>
+<td>
+                      <p>
                         TXT
                       </p>
                     </td>
@@ -6277,7 +6448,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2590513"></a>Textual expression of RRs</h4></div></div></div>
+<a name="id2590912"></a>Textual expression of RRs</h4></div></div></div>
 <p>
               RRs are represented in binary form in the packets of the DNS
               protocol, and are usually represented in highly encoded form
@@ -6480,7 +6651,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2591101"></a>Discussion of MX Records</h3></div></div></div>
+<a name="id2591500"></a>Discussion of MX Records</h3></div></div></div>
 <p>
             As described above, domain servers store information as a
             series of resource records, each of which contains a particular
@@ -6738,7 +6909,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2591653"></a>Inverse Mapping in IPv4</h3></div></div></div>
+<a name="id2592188"></a>Inverse Mapping in IPv4</h3></div></div></div>
 <p>
             Reverse name resolution (that is, translation from IP address
             to name) is achieved by means of the <span class="emphasis"><em>in-addr.arpa</em></span> domain
@@ -6799,7 +6970,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2591848"></a>Other Zone File Directives</h3></div></div></div>
+<a name="id2592384"></a>Other Zone File Directives</h3></div></div></div>
 <p>
             The Master File Format was initially defined in RFC 1035 and
             has subsequently been extended. While the Master File Format
@@ -6814,7 +6985,7 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
           </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2591870"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
+<a name="id2592406"></a>The <span><strong class="command">$ORIGIN</strong></span> Directive</h4></div></div></div>
 <p>
               Syntax: <span><strong class="command">$ORIGIN</strong></span>
               <em class="replaceable"><code>domain-name</code></em>
@@ -6842,7 +7013,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2592000"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
+<a name="id2592467"></a>The <span><strong class="command">$INCLUDE</strong></span> Directive</h4></div></div></div>
 <p>
               Syntax: <span><strong class="command">$INCLUDE</strong></span>
               <em class="replaceable"><code>filename</code></em>
@@ -6878,7 +7049,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2592069"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
+<a name="id2592536"></a>The <span><strong class="command">$TTL</strong></span> Directive</h4></div></div></div>
 <p>
               Syntax: <span><strong class="command">$TTL</strong></span>
               <em class="replaceable"><code>default-ttl</code></em>
@@ -6897,7 +7068,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2592173"></a><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
+<a name="id2592572"></a><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</h3></div></div></div>
 <p>
             Syntax: <span><strong class="command">$GENERATE</strong></span>
             <em class="replaceable"><code>range</code></em>
@@ -6922,7 +7093,7 @@ $GENERATE 1-127 $ CNAME $.0</pre>
 <p>
             is equivalent to
           </p>
-<pre class="programlisting">0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE.
+<pre class="programlisting">0.0.0.192.IN-ADDR.ARPA. NS SERVER1.EXAMPLE.
 0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
 1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
 2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 96acfe607e2f..4ddbcedc9a8b 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.63 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch07.html,v 1.75.18.76 2008/10/16 01:29:41 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -46,10 +46,10 @@
 <p><b>Table of Contents</b></p>
 <dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592714"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2593181"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592791">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592851">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2593326">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2593386">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
 </dl>
@@ -118,7 +118,7 @@ zone "example.com" {
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2592714"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
+<a name="id2593181"></a><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span>
 </h2></div></div></div>
 <p>
           On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment
@@ -142,7 +142,7 @@ zone "example.com" {
         </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2592791"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
+<a name="id2593326"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
 <p>
             In order for a <span><strong class="command">chroot</strong></span> environment
             to
@@ -170,7 +170,7 @@ zone "example.com" {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2592851"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
+<a name="id2593386"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
 <p>
             Prior to running the <span><strong class="command">named</strong></span> daemon,
             use
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index a475378f70bd..65f8cec8d3ba 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.64 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch08.html,v 1.75.18.77 2008/10/16 01:29:41 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -45,18 +45,18 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592999">Common Problems</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593004">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593016">Incrementing and Changing the Serial Number</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593033">Where Can I Get Help?</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593466">Common Problems</a></span></dt>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593472">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593483">Incrementing and Changing the Serial Number</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593500">Where Can I Get Help?</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2592999"></a>Common Problems</h2></div></div></div>
+<a name="id2593466"></a>Common Problems</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2593004"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div>
+<a name="id2593472"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div>
 <p>
             The best solution to solving installation and
             configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2593016"></a>Incrementing and Changing the Serial Number</h2></div></div></div>
+<a name="id2593483"></a>Incrementing and Changing the Serial Number</h2></div></div></div>
 <p>
           Zone serial numbers are just numbers &#8212; they aren't
           date related.  A lot of people set them to a number that
@@ -95,7 +95,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2593033"></a>Where Can I Get Help?</h2></div></div></div>
+<a name="id2593500"></a>Where Can I Get Help?</h2></div></div></div>
 <p>
           The Internet Systems Consortium
           (<acronym class="acronym">ISC</acronym>) offers a wide range
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 3c2e779607f0..71ea617e6afb 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.66 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch09.html,v 1.75.18.80 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -45,21 +45,21 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593300">Acknowledgments</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593630">Acknowledgments</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593472">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593802">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596683">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2597082">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
 </dl></dd>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2593300"></a>Acknowledgments</h2></div></div></div>
+<a name="id2593630"></a>Acknowledgments</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="historical_dns_information"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
@@ -164,7 +164,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2593472"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div>
+<a name="id2593802"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div>
@@ -252,17 +252,17 @@
           </p>
 <div class="bibliography">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2593659"></a>Bibliography</h4></div></div></div>
+<a name="id2593990"></a>Bibliography</h4></div></div></div>
 <div class="bibliodiv">
 <h3 class="title">Standards</h3>
 <div class="biblioentry">
-<a name="id2593670"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p>
+<a name="id2594001"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593693"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p>
+<a name="id2594024"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593717"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Implementation and
+<a name="id2594048"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Implementation and
                   Specification</i>. </span><span class="pubdate">November 1987. </span></p>
 </div>
 </div>
@@ -270,42 +270,42 @@
 <h3 class="title">
 <a name="proposed_standards"></a>Proposed Standards</h3>
 <div class="biblioentry">
-<a name="id2593753"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym>
+<a name="id2594084"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym>
                   Specification</i>. </span><span class="pubdate">July 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593780"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym>
+<a name="id2594110"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym>
                   Queries</i>. </span><span class="pubdate">March 1998. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593805"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p>
+<a name="id2594136"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593830"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p>
+<a name="id2594161"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593853"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p>
+<a name="id2594184"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593909"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p>
+<a name="id2594240"></a><p>[<abbr class="abbrev">RFC2671</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Extension Mechanisms for DNS (EDNS0)</i>. </span><span class="pubdate">August 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593936"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p>
+<a name="id2594266"></a><p>[<abbr class="abbrev">RFC2672</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Non-Terminal DNS Name Redirection</i>. </span><span class="pubdate">August 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2593962"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p>
+<a name="id2594293"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594024"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p>
+<a name="id2594423"></a><p>[<abbr class="abbrev">RFC2930</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secret Key Establishment for DNS (TKEY RR)</i>. </span><span class="pubdate">September 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594054"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p>
+<a name="id2594453"></a><p>[<abbr class="abbrev">RFC2931</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DNS Request and Transaction Signatures (SIG(0)s)</i>. </span><span class="pubdate">September 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594084"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p>
+<a name="id2594483"></a><p>[<abbr class="abbrev">RFC3007</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secure Domain Name System (DNS) Dynamic Update</i>. </span><span class="pubdate">November 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594110"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret
+<a name="id2594509"></a><p>[<abbr class="abbrev">RFC3645</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Kwan</span>, <span class="firstname">P.</span> <span class="surname">Garg</span>, <span class="firstname">J.</span> <span class="surname">Gilroy</span>, <span class="firstname">L.</span> <span class="surname">Esibov</span>, <span class="firstname">J.</span> <span class="surname">Westhead</span>, and <span class="firstname">R.</span> <span class="surname">Hall</span>. </span><span class="title"><i>Generic Security Service Algorithm for Secret
                        Key Transaction Authentication for DNS
                        (GSS-TSIG)</i>. </span><span class="pubdate">October 2003. </span></p>
 </div>
@@ -314,19 +314,19 @@
 <h3 class="title">
 <acronym class="acronym">DNS</acronym> Security Proposed Standards</h3>
 <div class="biblioentry">
-<a name="id2594193"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p>
+<a name="id2594592"></a><p>[<abbr class="abbrev">RFC3225</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Conrad</span>. </span><span class="title"><i>Indicating Resolver Support of DNSSEC</i>. </span><span class="pubdate">December 2001. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594288"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p>
+<a name="id2594618"></a><p>[<abbr class="abbrev">RFC3833</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Atkins</span> and <span class="firstname">R.</span> <span class="surname">Austein</span>. </span><span class="title"><i>Threat Analysis of the Domain Name System (DNS)</i>. </span><span class="pubdate">August 2004. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594324"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p>
+<a name="id2594654"></a><p>[<abbr class="abbrev">RFC4033</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>DNS Security Introduction and Requirements</i>. </span><span class="pubdate">March 2005. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594389"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p>
+<a name="id2594720"></a><p>[<abbr class="abbrev">RFC4044</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Resource Records for the DNS Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594454"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS
+<a name="id2594785"></a><p>[<abbr class="abbrev">RFC4035</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Arends</span>, <span class="firstname">R.</span> <span class="surname">Austein</span>, <span class="firstname">M.</span> <span class="surname">Larson</span>, <span class="firstname">D.</span> <span class="surname">Massey</span>, and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Protocol Modifications for the DNS
                        Security Extensions</i>. </span><span class="pubdate">March 2005. </span></p>
 </div>
 </div>
@@ -334,146 +334,146 @@
 <h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym>
                 Implementation</h3>
 <div class="biblioentry">
-<a name="id2594596"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely
+<a name="id2594858"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely
                   Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594621"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation
+<a name="id2594884"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation
                   Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594690"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p>
+<a name="id2594952"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594725"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym>
+<a name="id2594987"></a><p>[<abbr class="abbrev">RFC4074</abbr>] <span class="authorgroup"><span class="firstname">Y.</span> <span class="surname">Morishita</span> and <span class="firstname">T.</span> <span class="surname">Jinmei</span>. </span><span class="title"><i>Common Misbehaviour Against <acronym class="acronym">DNS</acronym>
                 Queries for IPv6 Addresses</i>. </span><span class="pubdate">May 2005. </span></p>
 </div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Resource Record Types</h3>
 <div class="biblioentry">
-<a name="id2594771"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p>
+<a name="id2595033"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594828"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p>
+<a name="id2595091"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594866"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using
+<a name="id2595128"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using
                   the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594901"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the
+<a name="id2595163"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the
                   Domain
                   Name System</i>. </span><span class="pubdate">January 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594955"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the
+<a name="id2595218"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the
                   Location of
                   Services.</i>. </span><span class="pubdate">October 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2594994"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to
+<a name="id2595256"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to
                   Distribute MIXER
                   Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595019"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p>
+<a name="id2595282"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595045"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2595307"></a><p>[<abbr class="abbrev">RFC2536</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>DSA KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595072"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2595334"></a><p>[<abbr class="abbrev">RFC2537</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/MD5 KEYs and SIGs in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595098"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2595361"></a><p>[<abbr class="abbrev">RFC2538</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Storing Certificates in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595138"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2595400"></a><p>[<abbr class="abbrev">RFC2539</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Storage of Diffie-Hellman Keys in the Domain Name System (DNS)</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595168"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2595430"></a><p>[<abbr class="abbrev">RFC2540</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Detached Domain Name System (DNS) Information</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595197"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p>
+<a name="id2595460"></a><p>[<abbr class="abbrev">RFC2782</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span>. </span><span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="author"><span class="firstname">L.</span> <span class="surname">Esibov</span>. </span><span class="title"><i>A DNS RR for specifying the location of services (DNS SRV)</i>. </span><span class="pubdate">February 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595240"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p>
+<a name="id2595502"></a><p>[<abbr class="abbrev">RFC2915</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="author"><span class="firstname">R.</span> <span class="surname">Daniel</span>. </span><span class="title"><i>The Naming Authority Pointer (NAPTR) DNS Resource Record</i>. </span><span class="pubdate">September 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595273"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p>
+<a name="id2595536"></a><p>[<abbr class="abbrev">RFC3110</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)</i>. </span><span class="pubdate">May 2001. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595300"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p>
+<a name="id2595562"></a><p>[<abbr class="abbrev">RFC3123</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Koch</span>. </span><span class="title"><i>A DNS RR Type for Lists of Address Prefixes (APL RR)</i>. </span><span class="pubdate">June 2001. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595323"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP
+<a name="id2595586"></a><p>[<abbr class="abbrev">RFC3596</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">C.</span> <span class="surname">Huitema</span>, <span class="firstname">V.</span> <span class="surname">Ksinant</span>, and <span class="firstname">M.</span> <span class="surname">Souissi</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP
                   version 6</i>. </span><span class="pubdate">October 2003. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595381"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p>
+<a name="id2595643"></a><p>[<abbr class="abbrev">RFC3597</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Gustafsson</span>. </span><span class="title"><i>Handling of Unknown DNS Resource Record (RR) Types</i>. </span><span class="pubdate">September 2003. </span></p>
 </div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">
 <acronym class="acronym">DNS</acronym> and the Internet</h3>
 <div class="biblioentry">
-<a name="id2595413"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names
+<a name="id2595675"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names
                   and Other Types</i>. </span><span class="pubdate">April 1989. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595438"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and
+<a name="id2595701"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and
                   Support</i>. </span><span class="pubdate">October 1989. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595461"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p>
+<a name="id2595723"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595484"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p>
+<a name="id2595747"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595530"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p>
+<a name="id2595793"></a><p>[<abbr class="abbrev">RFC2826</abbr>] <span class="authorgroup"><span class="surname">Internet Architecture Board</span>. </span><span class="title"><i>IAB Technical Comment on the Unique DNS Root</i>. </span><span class="pubdate">May 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595554"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p>
+<a name="id2595816"></a><p>[<abbr class="abbrev">RFC2929</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, <span class="firstname">E.</span> <span class="surname">Brunner-Williams</span>, and <span class="firstname">B.</span> <span class="surname">Manning</span>. </span><span class="title"><i>Domain Name System (DNS) IANA Considerations</i>. </span><span class="pubdate">September 2000. </span></p>
 </div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">
 <acronym class="acronym">DNS</acronym> Operations</h3>
 <div class="biblioentry">
-<a name="id2595611"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p>
+<a name="id2595874"></a><p>[<abbr class="abbrev">RFC1033</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Lottor</span>. </span><span class="title"><i>Domain administrators operations guide.</i>. </span><span class="pubdate">November 1987. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595635"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File
+<a name="id2595897"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File
                   Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595661"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and
+<a name="id2595924"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and
                   Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595688"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p>
+<a name="id2595950"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595724"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for
+<a name="id2595987"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for
                   Network Services.</i>. </span><span class="pubdate">October 1997. </span></p>
 </div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Internationalized Domain Names</h3>
 <div class="biblioentry">
-<a name="id2595770"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names,
+<a name="id2596033"></a><p>[<abbr class="abbrev">RFC2825</abbr>] <span class="authorgroup"><span class="surname">IAB</span> and <span class="firstname">R.</span> <span class="surname">Daigle</span>. </span><span class="title"><i>A Tangled Web: Issues of I18N, Domain Names,
                        and the Other Internet protocols</i>. </span><span class="pubdate">May 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595802"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p>
+<a name="id2596065"></a><p>[<abbr class="abbrev">RFC3490</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Faltstrom</span>, <span class="firstname">P.</span> <span class="surname">Hoffman</span>, and <span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Internationalizing Domain Names in Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595848"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p>
+<a name="id2596110"></a><p>[<abbr class="abbrev">RFC3491</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Hoffman</span> and <span class="firstname">M.</span> <span class="surname">Blanchet</span>. </span><span class="title"><i>Nameprep: A Stringprep Profile for Internationalized Domain Names</i>. </span><span class="pubdate">March 2003. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595883"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode
+<a name="id2596146"></a><p>[<abbr class="abbrev">RFC3492</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Costello</span>. </span><span class="title"><i>Punycode: A Bootstring encoding of Unicode
                        for Internationalized Domain Names in
                        Applications (IDNA)</i>. </span><span class="pubdate">March 2003. </span></p>
 </div>
@@ -489,47 +489,47 @@
                 </p>
 </div>
 <div class="biblioentry">
-<a name="id2595928"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String
+<a name="id2596190"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String
                   Attributes</i>. </span><span class="pubdate">May 1993. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595950"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p>
+<a name="id2596213"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2595976"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load
+<a name="id2596238"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load
                   Balancing</i>. </span><span class="pubdate">April 1995. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596002"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p>
+<a name="id2596332"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596025"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p>
+<a name="id2596356"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596071"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p>
+<a name="id2596402"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596094"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p>
+<a name="id2596425"></a><p>[<abbr class="abbrev">RFC3071</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>. </span><span class="title"><i>Reflections on the DNS, RFC 1591, and Categories of Domains</i>. </span><span class="pubdate">February 2001. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596121"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via
+<a name="id2596452"></a><p>[<abbr class="abbrev">RFC3258</abbr>] <span class="authorgroup"><span class="firstname">T.</span> <span class="surname">Hardie</span>. </span><span class="title"><i>Distributing Authoritative Name Servers via
                        Shared Unicast Addresses</i>. </span><span class="pubdate">April 2002. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596147"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p>
+<a name="id2596477"></a><p>[<abbr class="abbrev">RFC3901</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Durand</span> and <span class="firstname">J.</span> <span class="surname">Ihren</span>. </span><span class="title"><i>DNS IPv6 Transport Operational Guidelines</i>. </span><span class="pubdate">September 2004. </span></p>
 </div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Obsolete and Unimplemented Experimental RFC</h3>
 <div class="biblioentry">
-<a name="id2596190"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical
+<a name="id2596521"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical
                   Location</i>. </span><span class="pubdate">November 1994. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596248"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p>
+<a name="id2596579"></a><p>[<abbr class="abbrev">RFC2673</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span>. </span><span class="title"><i>Binary Labels in the Domain Name System</i>. </span><span class="pubdate">August 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596275"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation
+<a name="id2596605"></a><p>[<abbr class="abbrev">RFC2874</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Crawford</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i>DNS Extensions to Support IPv6 Address Aggregation
                        and Renumbering</i>. </span><span class="pubdate">July 2000. </span></p>
 </div>
 </div>
@@ -543,39 +543,39 @@
                 </p>
 </div>
 <div class="biblioentry">
-<a name="id2596323"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p>
+<a name="id2596653"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596362"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p>
+<a name="id2596693"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596389"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p>
+<a name="id2596720"></a><p>[<abbr class="abbrev">RFC2535</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">March 1999. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596419"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC)
+<a name="id2596818"></a><p>[<abbr class="abbrev">RFC3008</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Domain Name System Security (DNSSEC)
                        Signing Authority</i>. </span><span class="pubdate">November 2000. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596444"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p>
+<a name="id2596843"></a><p>[<abbr class="abbrev">RFC3090</abbr>] <span class="authorgroup"><span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>DNS Security Extension Clarification on Zone Status</i>. </span><span class="pubdate">March 2001. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596471"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p>
+<a name="id2596870"></a><p>[<abbr class="abbrev">RFC3445</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Massey</span> and <span class="firstname">S.</span> <span class="surname">Rose</span>. </span><span class="title"><i>Limiting the Scope of the KEY Resource Record (RR)</i>. </span><span class="pubdate">December 2002. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596507"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p>
+<a name="id2596906"></a><p>[<abbr class="abbrev">RFC3655</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Wellington</span> and <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Redefinition of DNS Authenticated Data (AD) bit</i>. </span><span class="pubdate">November 2003. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596544"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p>
+<a name="id2596942"></a><p>[<abbr class="abbrev">RFC3658</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Gudmundsson</span>. </span><span class="title"><i>Delegation Signer (DS) Resource Record (RR)</i>. </span><span class="pubdate">December 2003. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596570"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p>
+<a name="id2596969"></a><p>[<abbr class="abbrev">RFC3755</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Weiler</span>. </span><span class="title"><i>Legacy Resolver Compatibility for Delegation Signer (DS)</i>. </span><span class="pubdate">May 2004. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596597"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record
+<a name="id2596996"></a><p>[<abbr class="abbrev">RFC3757</abbr>] <span class="authorgroup"><span class="firstname">O.</span> <span class="surname">Kolkman</span>, <span class="firstname">J.</span> <span class="surname">Schlyter</span>, and <span class="firstname">E.</span> <span class="surname">Lewis</span>. </span><span class="title"><i>Domain Name System KEY (DNSKEY) Resource Record
                       (RR) Secure Entry Point (SEP) Flag</i>. </span><span class="pubdate">April 2004. </span></p>
 </div>
 <div class="biblioentry">
-<a name="id2596642"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p>
+<a name="id2597041"></a><p>[<abbr class="abbrev">RFC3845</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Schlyter</span>. </span><span class="title"><i>DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format</i>. </span><span class="pubdate">August 2004. </span></p>
 </div>
 </div>
 </div>
@@ -596,14 +596,14 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2596683"></a>Other Documents About <acronym class="acronym">BIND</acronym>
+<a name="id2597082"></a>Other Documents About <acronym class="acronym">BIND</acronym>
 </h3></div></div></div>
 <p></p>
 <div class="bibliography">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2596693"></a>Bibliography</h4></div></div></div>
+<a name="id2597092"></a>Bibliography</h4></div></div></div>
 <div class="biblioentry">
-<a name="id2596695"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p>
+<a name="id2597094"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p>
 </div>
 </div>
 </div>
diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html
index 03cce5aae1f4..892ab16b942a 100644
--- a/doc/arm/Bv9ARM.ch10.html
+++ b/doc/arm/Bv9ARM.ch10.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch10.html,v 1.2.2.6 2007/01/30 00:23:46 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch10.html,v 1.2.2.9 2008/05/24 01:31:12 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 8a33041d76ac..6de42bcee192 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.html,v 1.85.18.68 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.html,v 1.85.18.82 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -40,8 +40,8 @@
 <div class="titlepage">
 <div>
 <div><h1 class="title">
-<a name="id2563155"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="copyright">Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")</p></div>
+<a name="id2563174"></a>BIND 9 Administrator Reference Manual</h1></div>
+<div><p class="copyright">Copyright © 2004-2008 Internet Systems Consortium, Inc. ("ISC")</p></div>
 <div><p class="copyright">Copyright © 2000-2003 Internet Software Consortium.</p></div>
 </div>
 <hr>
@@ -51,39 +51,39 @@
 <dl>
 <dt><span class="chapter"><a href="Bv9ARM.ch01.html">1. Introduction</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564117">Scope of Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564140">Organization of This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563474">Conventions Used in This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564816">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2563405">Scope of Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564385">Organization of This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564524">Conventions Used in This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2564637">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564837">DNS Fundamentals</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564871">Domains and Domain Names</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567208">Zones</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567285">Authoritative Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567526">Caching Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567588">Name Servers in Multiple Roles</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564659">DNS Fundamentals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564693">Domains and Domain Names</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2564845">Zones</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567243">Authoritative Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567416">Caching Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2567546">Name Servers in Multiple Roles</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch02.html">2. <acronym class="acronym">BIND</acronym> Resource Requirements</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567622">Hardware requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567649">CPU Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567661">Memory Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567688">Name Server Intensive Environment Issues</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567699">Supported Operating Systems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567580">Hardware requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567607">CPU Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567620">Memory Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567851">Name Server Intensive Environment Issues</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2567862">Supported Operating Systems</a></span></dt>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch03.html">3. Name Server Configuration</a></span></dt>
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568004">A Caching-only Name Server</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568020">An Authoritative-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567894">A Caching-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2567910">An Authoritative-only Name Server</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568042">Load Balancing</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568465">Name Server Operations</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568001">Load Balancing</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2568423">Name Server Operations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568470">Tools for Use With the Name Server Daemon</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570184">Signals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2568428">Tools for Use With the Name Server Daemon</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2570142">Signals</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch04.html">4. Advanced DNS Features</a></span></dt>
@@ -92,34 +92,34 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570642">Split DNS</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570660">Example split DNS setup</a></span></dt></dl></dd>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2570600">Split DNS</a></span></dt>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570618">Example split DNS setup</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571095">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571169">Copying the Shared Secret to Both Machines</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571179">Informing the Servers of the Key's Existence</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571219">Instructing the Server to Use the Key</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571413">TSIG Key Based Access Control</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571458">Errors</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2570985">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571127">Copying the Shared Secret to Both Machines</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571138">Informing the Servers of the Key's Existence</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571177">Instructing the Server to Use the Key</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571303">TSIG Key Based Access Control</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571416">Errors</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571472">TKEY</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571521">SIG(0)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571430">TKEY</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571547">SIG(0)</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571725">Generating Keys</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571795">Signing the Zone</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571874">Configuring Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571684">Generating Keys</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571753">Signing the Zone</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2571832">Configuring Servers</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2572153">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2571975">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572215">Address Lookups Using AAAA Records</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572236">Address to Name Lookups Using Nibble Format</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572173">Address Lookups Using AAAA Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2572195">Address to Name Lookups Using Nibble Format</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572269">The Lightweight Resolver Library</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2572228">The Lightweight Resolver Library</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</a></span></dt>
@@ -127,83 +127,83 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573480">Comment Syntax</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2573436">Comment Syntax</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574092"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574117"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574282"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574307"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574711"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574726"><span><strong class="command">include</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574736"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574753"><span><strong class="command">include</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574749"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574771"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574930"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575056"><span><strong class="command">logging</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574776"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574800"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2574958"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575084"><span><strong class="command">logging</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576406"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576480"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576544"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576587"><span><strong class="command">masters</strong></span> Statement Definition and
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576435"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576508"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576572"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576616"><span><strong class="command">masters</strong></span> Statement Definition and
           Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576602"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576631"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and
           Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and
             Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585361"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585410"><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585614"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585666"><span><strong class="command">trusted-keys</strong></span> Statement Definition
             and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585490"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2585748"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
             Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586798"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587332"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589080">Zone File</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589477">Zone File</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591101">Discussion of MX Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591500">Discussion of MX Records</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591653">Inverse Mapping in IPv4</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591848">Other Zone File Directives</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592173"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592188">Inverse Mapping in IPv4</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592384">Other Zone File Directives</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2592572"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zonefile_format">Additional File Formats</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt>
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2592714"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2593181"><span><strong class="command">Chroot</strong></span> and <span><strong class="command">Setuid</strong></span></a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592791">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592851">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2593326">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2593386">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592999">Common Problems</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593004">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593016">Incrementing and Changing the Serial Number</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593033">Where Can I Get Help?</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593466">Common Problems</a></span></dt>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2593472">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593483">Incrementing and Changing the Serial Number</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2593500">Where Can I Get Help?</a></span></dt>
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593300">Acknowledgments</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593630">Acknowledgments</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#historical_dns_information">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593472">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2593802">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2596683">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2597082">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt>
diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 586aaafd0e72..29637452ec51 100644
--- a/doc/arm/Bv9ARM.pdf
+++ b/doc/arm/Bv9ARM.pdf
@@ -561,7 +561,7 @@ endobj
 << /S /GoTo /D (subsubsection.6.2.16.8) >>
 endobj
 380 0 obj
-(6.2.16.8 Bad UDP Port Lists)
+(6.2.16.8 UDP Port Lists)
 endobj
 381 0 obj
 << /S /GoTo /D (subsubsection.6.2.16.9) >>
@@ -1170,14 +1170,16 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 678 0 obj <<
-/Length 994       
+/Length 999       
 /Filter /FlateDecode
 >>
 stream
-xÚµVË’¢JÝû,5¢­©¯Z҈ʂ83³°»‰hÅ+8ý÷7¡ªDÐÛ›‰.*«ò˜yòd@4?¢&29åšÅud`bh›ý
-Qm]»ÀÒíÏ¡[?NùËk5ú�~ÕŒ,ÌrÀ¦v|™ý*Ô˜"ËäV£ŠÂýí´›•"("6 Š±þ0SצњfkZÂòUv:d•Ø%e•íK±q‹CYœªü¼PØ
�ÁÀÂÀ¿(ÕýÄ­Ø’šÔÀK/‚F‘aš¦féZÏ�ÏÕUèñ5üŽºÌ‚¾Z¼�ú_êÒÿS]ÜêHZ“¶&»«n±«Þק±‡Y_bÔ×ÏĈSÓÖ,Ê€'ŸÉ§Àãkô­z¦�8¶I³.g™�öyYæÅApª
-±žËLÖ³
yG„�¡Üï‹m¾ëœ¬[aló²:åÏçJX½æršÊ›âwÅIýûCÇóéX”ÒýžW¯ÂR¸ú¤8K1w™ÄA‚ºëpß
AÜ0hSÚk&ò=Ëø/§54d+Igñ'ßf[Åv])KF_?²V1eÍöPTù&ëÕßÖ{ìÉÚ��ÙZ•Kÿúí­©ƒpšTß„ëJ wž•Í�ÀàbŽ˜Îêb-ĵH:÷ä˜EÓôiÄéЉ剟ˆuGßý‰7»úæ:‰BÔ;a;áDºÂ˜€8þB‚� †Ì;aê{Òùä§saÅÞ̉'âJÂó•‘nIi­~$ é\Q¼C>tƒÕÄg½äþbøª–{L¢©X^ìÎÁ1²ô¡óè~ú£-´fg"®Û–bGvS?
½$AŠƒXCÉ×ûîA<AxÞ2Rz=Jê�ï<ÒžF±Ê*Ó'KÏõ�àAi{nÃQ=mÛ#Ñ
-½YàϼÐõº™¢&ró°Ðµ	é¶\d<b­’ëœ2²ûÉE‹h•v©D=Ú@-ô®(·WãrWA NkëË—^ópÚz¦ŸÝš›7‰úôbª¿ˆî~x©|ýá5VÙƺ…˜mÓûo"jÃËbRÍ{õ†8Ì9e&½Ãü_®…dµendstream
+xÚµV]“¢:}÷Wð¨UC6|å‘AT¶\À�ÚÚÝGq†ªQ¼‚;5ÿþ6$Qï¼lÝò!�ô±ûôI'„h~D3-dqÊ5›ÈÄÄÔÖ»
Ö^À7‰ÁšŽãNëügðó7Ö6
+�;IgÒÎdwÕ-·õûê8"Î0¿–]ëgaÄ©åh6eÀŒÏäS`ý}«že"ŽÒÅlÊYäÇ]QUE¹œêRŒ§*—õ¬AÞ!d(ç»rSl{+«ýF›¢ª�Åó©–Ö¯…ì¦ê¦ømyTÿþÆát<”•t¿õ«°®Y)ORÌm.q� Ùu8øŒ€„ nš´-í5ùžeü—ã
+6d#IZgù§ØäÅvU+KF_=—òNÑeít_ÖÅ:¿ª¿«÷p%k~8ä+YT!ý«··¶Âؤæ$\V¹‹¼j›sÄŒæR"6âŒÚ-$›ù²ÍâIö4âtè&r%HŸHâïÁØ‹YsrÝT!š™°Ýh¬=aŒÁ
+Ý`.Án
+CfIÜ(|é|
+²™°ê&cq$á¢e¤_RÖ¨h6Sï��¼p9¢éUò`¾UË=&ñDŒs?ñfàÙÆÐ} ûÑÚ°³7[±#-»I�E~š"ÅAŒ‘äë÷!ž <ë)½%õ0pCiOâDe•éÓ…ïnø 4N|¯å¨nÛèf	B´
@029ç}=½8JýoK AeLwîNÏr\çïyŸfn“(Kc¨-Q˜.Ãvõ¬þ$‰ç²¶8ítnXa÷âÕ/S_•'·{ÐçM	b§Š‡�œôewÕèeAõwÊη'SäOÃ`êGžßÏ·‘ÛËÂ@Ô!¤¿å¢!“³¡àx™^攑Ý$HÏZÄˬO%¾¢
Ô"ÿ‚rw4Îgêmmsøá�Ðqá'Ð<s·«gòÙ©¹ù’¨73Qó4ºûSùþú¦«lºa#æ8ôþ—ˆ:ðŲٙTû]½!}N™Eï0ÿýžf�endstream
 endobj
 677 0 obj <<
 /Type /Page
@@ -1583,26 +1585,17 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 743 0 obj <<
-/Length 3153      
+/Length 3152      
 /Filter /FlateDecode
 >>
 stream
-xÚí�[w·Çßõ)ø(=ÅýòèkNÒÖvlõ¥iÖÔZæ	ÉUI*®ûé‹å.€Y;ÚȵD&'‘líìŒæÿ#ì…M¨ÿ—M”&Úq71NE™šÌ–gtríöÃë�™†ƒ¦ð¨ç—gz-Ìħ¹ž\~šH¥W»“YB­e“Ë«_Î_¼}sùêÍ凋_/:{uÏ
-=3*ÚSþóì—_éäÊðÓ%ÂY5ùâÿ@	sŽO–gR	¢¤áogÎ~Ž'?Ý™fF	šg~.À¯ÒþP±‰QŽháÒþ"’XÂ.¦ŒSzþC½ª×Õv¾º¾˜rEÏÿ\Ý\L­æçäbªü
�ï‹tî;Ù]©©Ïº:åsO›õõ¤ûæ=T+ØM¡á¾Zûçoõâz/Ž ~.ŒÔ{`E¢)Õ‘Þ³òa~½Š l?×Ý7oVþ;Cõ‰”˜�Õbb€!FT
#&Fê=#QÚºHŒè‰yѬþA)¿¾]Gn>Ôëßëu;Æ0q¬¨Œ2òXÌ0Ä�:q3ÎH&ŒÔ»a~ÈѾ<r_Õ„á=$Î#B=?¾û]÷dÜÞÜ4ëm÷‡ùªûúüÇ7/»ï¼�ãìñ2ß �ãb€€!Ô�Ûq€2q`
-#%FÊž÷ì˜+(±Ôu˜ê~ÌÝjSWmçÍ*�ó©^׫Y=ž¹pò{�·À
-¨ãx›MÍëy˜[¼ZÔËzµõÅ̱ö+£|„”²€!öÉ‚’aœdâÀxA½‡I+ÕÄH­.ã�Ê_«íìs(Ê›mø©§½ƒJHg1*ÀCÊ%ø8*™80TPïŒk"“å¡1LÚËÑ®‡|]m«]L…S§¥Õ{€SY
-
-4D@H…€’‹
÷ž@±œh+
-™80Pï}]Q†­<
-�
-ê=
ÊÍœI°œêÊJHe1(ÀJ…�’‰õž@‘š(›šÊ©®ì3²TÌ
-5ÎS&Œ'Ô{àÉ.�ˆ8ñ‡Àép)³Ž=½a¨Om15Ƀ‡1³†æº'F:K¤Ž�'â 2³fµ]7‹M†áe‚†”uOrC'渔hˆÀ3С'‚î=ðcýÜ—»TÁäƒñs�)´â�
—QNB.‹9
†'P+Œ“L'¨÷À‰‘íØu“ùj¶¸½ªs”hb;4Ù±ŒÕ<9d¸žd‡±ôãWÄf‚ÀÈÁ\p´¯IZ§9�~(r�/ßz?ÿ¾X#¦²`ˆ1¥Â ÉÄ�Q‚z˜(J„
-©-¦&ÙaÐ
-¹,æbœ@­äø¥¹80NP逸Š8%AEÒaçyÓ,êªõmOÇT	wÄ»M1]Å0
-Ô{¢Bbô°û0ÝSh[(./=_W«Í§Ý¤BvÂ"&®`ˆa
…Á°ÈÄ�a�zOXpFŒö!¶oJ«°¸ðò]÷Í»øˆÑþ‘+–«ãb!d«˜`ˆ±
-k|ë+
-æ:q‘æN‡¢;PžßÎÛixµÉô+óէݫâUÿnVíú·1îQ^-³P¬/0Ädy|ó"&1ê=iÌ‘òNbr¿ZÞl¿¦÷dµ;ÒÇþULR1ÀC` ÂøE.
Ô{B€2"™`Ó³[aò“C?‰œÏ6ðÙiÎòcÜÎ	+¦!Ùa0@9Æן3A`(`®#	Öa¥�à:ž]]í.t«áJ‡Yá_T³Ï»)ƒÓúéȲQ*3°CdäzüÚ·LˆÌ¨ëðò)C„âàã~øQ
}yÏt�Ô3¢Þ'ÍÍSž3Ž¾ÍªOtñˬ’ö.+(ãøÄ2A`o²Â\‡w("8hìásŸçÜ=…5ˆ>Ÿåïe	fè[Y’V
-y'ËÝö‰ïñ�rç¥Í¾ŒÄÿLjSŠÿï¯
No7–ííeväÊ,n)qí¹„ŸëŠþ®L䶖ÝA òÿ
+xÚí�[wÛ6Çßý)ôh?‹ûå1מvw“4q_¶ÛVf�J¢W’›f?ý‚"
-pdìÖÙØR{Z;1‡3žÿO’lBý¿l¢4ÑŽ»‰q’(ÊÔd¶<£“kÿ³ïÎXÌ44…G=¿<ûËka&Ž8ÍõäòãD*E¸Ú�Ìj-›\^ý|þâí›ËWo.?\ürùÃÙ«ËxVè™QÑžò_g?ÿB'W>€Î(ΪÉgÿJ˜s|²<“J%…³8ûpöc<!øéÎ4û›0J¸Ð<ó«p
~•ö‡ŠMŒrDÿ“ö‘Äv1eœÒóïêU½®¶óÕõÅ”+zþ×úËæbj5?'Såx|_¤sÚÉîJM}Ö�Ð)Ÿ{Ú¬¯'Ý7ï¡ZÁn
+
÷ÕÚ?«×{qõsq`¬ Þ+ÒM©Ž¬ðž•óëUeû©î¾ùG³òߪOÄ Ä„¬1b j1™80bPï�¡ˆÒÖEbDOÌ‹fõOJùõí:ró¡^ÿ^¯Û1†‰cEe”‘�ÇbF€!ÆÔ‰›qF2q`Œ Þ
óCŽöå‘ûª&ï!qêyøþÝïº'ãöæ¦Yo»?ÌWÝ×çß¿yÙ}ç
g�w�ù*
+0ÄH�ba¤dâÀHÙóžs%–ºSÝ�¹{Cmêàªí¼Yr>Öëz5«Ç3N~ïñ`ã-Z°ñŒ�Óa™ÚóšýL1KŒéW
uo³©y=s‹W‹zY¯¶~¢˜9Ö~e”��ÒâO0Ä>YP2Œ“L/¨÷0i¥š©UÀe¼Qù{µ�}
+EyÓ¢¢
?õ´wP	é,Fb¨@¹G%†
+ê�qM¤`r¢<4†I›`Ùá"Úõ�/«mõÇÅT8uZZ½(1•¥ @C”�T(¹8Ppï	ˉ¶‚
PxÊ˺­C«yªBÕê*ô½Õu»:ÿ-Ìô¿Æ*{ÌR1Àc
+�
+ƒ$F	ê=`¢(tRæ &¿Õ_rS__‚œ!ìiÕ7漘'`ˆñ5ÅxÊÄ�ñ„z<	KM£Ž}œ�8Š>½N*¤¶˜šd‡A„ãÛò3A`È`®1ÜsbXBÆDfÑ\_·;É2…Êø!Ï©Cë9JÕnØâbt€!Æ”ƒ'Fê=àä?Üé´HŠŸ{Ltþ?»¬þ´†;䲘`ˆqµÂ8ÉÄ�q‚z�W™$å„Sã
 endobj
 742 0 obj <<
 /Type /Page
@@ -1874,7 +1867,7 @@ endobj
 785 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 292.7672 511.2325 301.7235]
+/Rect [499.2773 292.7672 511.2325 301.873]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.2) >>
 >> endobj
@@ -1909,7 +1902,7 @@ endobj
 790 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 232.6088 511.2325 241.5651]
+/Rect [499.2773 232.6088 511.2325 241.7146]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.7) >>
 >> endobj
@@ -1965,14 +1958,14 @@ endobj
 798 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 136.3554 511.2325 145.3117]
+/Rect [499.2773 136.3554 511.2325 145.4611]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.15) >>
 >> endobj
 799 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 124.3237 511.2325 133.4295]
+/Rect [499.2773 124.3237 511.2325 133.28]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.16) >>
 >> endobj
@@ -1986,14 +1979,14 @@ endobj
 801 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 100.2604 511.2325 109.2166]
+/Rect [499.2773 100.2604 511.2325 109.3661]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.18) >>
 >> endobj
 802 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [499.2773 88.2287 511.2325 97.3344]
+/Rect [499.2773 88.2287 511.2325 97.185]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.16.19) >>
 >> endobj
@@ -2019,23 +2012,17 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 807 0 obj <<
-/Length 3353      
+/Length 3350      
 /Filter /FlateDecode
 >>
 stream
-xÚí�Ks7€ïú<¤j¥ƒ°x€ÝÖ^v”rd¯$W¶6É�&ÇËâPáÃŽ÷×/†`š"¦%8~È�J‘’¦§›Ýß4º
Ì�õ¨û�õŒ"TXÙÓVE™ê
&;´7r{¾Ãü1ûá }xÔáåÎߟ	ݳļè]¾ç2„Ãz—Ã_w�^ž]žœ]^ìý~ùÓÎÉe<)T̨¨ÏøÇί¿ÓÞÐéÿi‡a�ê}p?P¬å½ÉŽT‚()DøÍõÎÅοã	Á_W¢©¢„!Êp�ø$\€OÂ8'Æjg�²¤îoõG)wŠëâgàpÁˆ1T:õa‹Ùr¾(‡ûïÊ�s0<·2ÄrSøƒ/ýE9)«ÅÞ>Wt÷ù¬?™ôg{ûFÒ]²·¯èx‘Ö~ŠÜ­€+nHÁ)k}º¡Ù¨×¼9‡1rûPp3f›ç_Ŭذ#0�²#ÕÞ#5)´f‘N¿(1Çåo”òj¼O«æ7ýjؼy=ï�Êú­x˜œt\˜
Ä
-"Ь…MÓNhRv ÐàÚ™’Dkm{…ÑÄR&
-âfèŠ�æý«éõx0®G©Ô£
{pLvØ� vèx-»Ãž°;ªÝÕÖÑ+$%ÔÐÐ߸DÀèZ&x6¾vßýò K؆lÆ€ Æ³VÝŒ%ìÀCµ·}�3ƒqúQׯŒÓµ²µfmú¶y=/çÓål�™ÝA~3˜®~1œßjh~¹*}�³˜†'ÅWåĵ:Z<¼iÛè‘ìxA,ÞÐãX¼v`ñFµ·C	+ÓT´ñ^E\ÜZ#Ø“¬,‚òq
-"x¬Èt/å¦ì@ðØÔÎ÷”HíJ}^¯è­¥Û¼\”ƒål¼øØüt4uùaXÎúͺ§ß©�
÷óØ´xó¼+‰n�Óa~ÚКZû”'Z*߉®jüzíó`0(çóè–Å*¯Mýõb<_¬þ&·kžùW]pxöU±«£(aFª=Ò¤(Ñ–ú%7’Ú[îÒ·e’ùóèj6�.«�„J«W:cµ%Â
aÿg¹XŽ‡©SâP5þ°'¾‚ÿ)Ć f1b!4¦{ïGÊŒXT{[F8
#”ȶëòÉúP1Ç¥	Ì
:ñe„kê“ê}SN«fƒ²(ÄÓIˆ�\Ïgs1®`d1®v`\¡Ú[®êžÔP¹
-K}¯çqæ=Ý‚¸ÄXRß¼3­9¼ilŒŸ-«A³Õ]ê§0ØvBÜž
Ä ‚aÅ JØ�A…j�Ã+“Äré—&ãFµÎ­‰my«UñÄ;�	>ÍbÀÀ˜aÀ$ìÀ€ÙОꂄ­ç'ü�«ÆwA—{Œ±ÝÙtù溜_¹ñ«ÎG]î‰g¸o³�fgݲî;ÚàéwljM]?¸Ñ[ù)òØëM'“°ïâU3L;ÏLêi)·­Mö¼œ{A
9äzZ‹!Âͦ>˜ê8¤‹Âjý]˜Æoè[­­/þæ{åjêo?û0�½s×Õ?›Ÿ®¦š7ƒ~Xlo^ê{ÔFÍ^@Ÿ³§Ëp†«~<í_=ŽþåR93h¼�>ÉŽ6Ľæs$Þ	;°€£Úc¾Pš¸^Õ÷Ò«
-®N§Õ ‰X]ÌÇb.îÆ=ºêW£µÏƳq˜’<[NÞÔ3ÔÎŒGPÈG7e3
-Ê
-ÑY¹(@A…µ` (¤ì@PÀµ‡$Â�&’
-æIàMy^Vå,TX1Èçå[?RWán›Óêíj!x5]Vاµþ}—
ÄÀ€±±ÝÛ‹Rv`` ÚÛ¡‘~ïõA3™_§ˆÓWï͇áÞšpÇÝo®ž;pÿÜ«;¼z»5 ¸1›‘VC	#dÓLuL… ÒòÀ‡hÇáøÍõx:šõo®>¶HÄÑáb9•õóöBBé]w×Ð"8"i#x.	 ˆ1
#ƒA‘°£ÕÞ¦
ňº\„¼q^þ±t¡oï�°!bâËÔÀÊù³£y„üiÔšÑeÙ@
-Íýñ¬ÿ¶ÆÀZ¾mLîÃLðj63@cFÍv¯µ¤ìÀ˜Aµ·Ìp]?QDfDÃ¸«æx:X‚Ôqð&Îö6-ˆbO%{_e“
-¦h»}þ:àŒv‰)C0ÜPõ·ÂãïÏ<\
öuj«æórP?™}T?“GJµeê3ÁäÝ�ÍR+‡¡‚Éh÷Í
-	+0�0Ý‘#¥‰qÿ<Hr
¤ùxT­ëP[†þ*CÁÕÙ
AŒ"JF»ëΔ!G¨ú’TÄ
-Qx�TRÕŸ”ÃýÁU9x7˜Vo÷ê‡âm	úd‚‚�³	‚A0†Œv¯P§ÁBÕG‚„ Vß¹Ô·VÞ"ȧ"µÍAŸNPðq6A@#Æ�Ñî¥ÁBÕG‚8'”‹Ðði@�k„­Ú–Ý_¡ì1È&b„Á3†”Ý	C0ÂPõ‘0F	-LèòLCجœw™Ù¶w_·�lÜ€ †8cÝ·4¦ÁpCÕܬ!Œ…tæ¿ÌMØÎkɪÎJ<,€Õ߶¢·7"~
}˜rlÅ
+xÚí�Ks7€ïú<¤j¥ƒ°x€ÝÖ^v”rd¯$W¶6É�&ÇËâPáÃŽ÷×/†`š"¦%8~È�J‘’¦§›Ýß4º
Ì�õ¨û�õŒ"TXÙÓVE™ê
&;´7r{¾Ãü1ûá }xÔáåÎߟ	ݳļè]¾ç2„Ãz—Ã_w�^ž]žœ]^ìý~ùÓÎÉe<)T̨¨ÏøÇί¿ÓÞÐéÿi‡a�ê}p?P¬å½ÉŽT‚()DøÍõÎÅοã	Á_W¢©¢„!Êp�ø$\€OÂ8'Æjg�²¤îoõG)wŠëâgàpÁˆ1T:õa‹Ùr¾(‡ûïÊ�s0<·2ÄrSøƒ/ýE9)«ÅÞ>Wt÷ù¬?™ôg{ûFÒ]²·¯èx‘Ö~ŠÜ­€+nHÁ)k}º¡Ù¨×¼9‡1rûPp3f›ç_ÅLoØHÙ�ƒjo‰‘šZ³H§_”˜ãò7Jy5^Œ§Uó›~5lÞ¼ž÷GeýV<LN:
	.Ìb€¬…
$aª½D(¢9³- ìN@Þ�Ë	0¸tH«;R‰âÁ¤’Ï™_î	Spw6L@ƒi-œL	;0˜Pí-L\]¦…‰˜îÎ2…-¾?v:¡	n͆bЬ…
�&a
ª½…†9+ZhÄ�ÐüoZ•ih¨¶ú®dÌcN=wÁÜ�
Ä`Z§í†)aª=ÂTXKŒ*d“ü"0Ý��´b�gØŠnÍ…
+"Ь…M³NhRv ÐàÚ™’Dkm{…ÑÄR&
+A(2
^ñ•úôN‚«²A
+nφ
+bPÁ°bP%ìÀ BµÇá•Ib¹ôK“q£ZçÖĶ¼Õªx⋃�ÀŸf1``Ì0`v`ÀlhOuAÂÖóþÎUã» Ë=ÆØîlº|s]ίÜøUç£.÷Ä3Ü·Ù�H³³nY÷*;<âŽM­©ëG7z+?E{�£édö]¼j†iç™I=M 嶵ɾ¢‚—s/( ‡\Ok1D¸Ù4ÃS‡tQXB­¿Óø
}«µõÅß|¯\Mýíg¦³wîºúgóÓÕôCófЋíÍK}�Ú¨ÙèsötÎpÕ�§ýà«ÇÑ¿\*gæ
�·Ñ'ÙÑ‚X¸×|ŽÄ;apT{ÌJ׫ú^zUÁÕ	ã´4«‹ùXÌÅݸGWýj´VãùÁx6S’gËÉ›z†Ú™ñ
+ùè¦l€ ÆÀZv` Ú#Rfü��&Ö\¿Ô;%Ú«öèÖuý¼ôWñ�åõ�»h¥ÜŽ÷B)x;% ˆ¡´M¥„JÚ“Õ„~BüÀerÎwnnÊj8”ÝóÍQìÞ%ÀJ0hŽí^¾�§Ã|°¡5y91FªñA=‚jí¼0xWM?\—ÃQ�Rë=ðÜn+¯ü«'87ûê
‚ØÕƒ‡“°#ÕË/nëù^#:5<¶¾„šL{8—~×ô�ãùb:û¸¾•:ÄÇg·Fìf]¨ ìñ �•‹DPX‚BÊ\{H"Üh"©`žÞ$‘çeUÎB…ƒ|^¾õ#uî¶9­Þ®‚WÓe…}ZëOÑwÙ`
+.fÑJ6q8\
«ÂîÇ£G•4¿Ÿ›_c<r¯;(ˆ\wkñF KÙ�À†k�°F´µÌÃÆØ®¦u
§ô–¶¯G› …0º
È}iórûP0EÛíó×
g´»HL‚ᆪ�¸–æáj°¯S[5Ÿ—ƒúÉì£ú™<Rª-SŸ	&ïîl–Z9%LFe7I›V` aº#GJãþy�äHóñ¨Z=þÖ¡$¶ýU†‚«³!‚E0”Œv×�)C0ŽPõ$©ˆ¢ð ©¤ª?)‡ûƒ«rðn0­ÞîÕÅÛôÉg1‚`í^¡N‚„ª�	A¬6¾s©o­¼E�OEj›ƒ>� àãl‚€ FŒ!cÝI‚„ª�qN(¡áÓ€ ×[µ-»¿BÙb�Mă1f)»†`„¡ê#aŒZ˜Ð噆°Y58ï2³mï¾:n! Ù¸
A7pƺoiL‚ᆪ¸YCéÌ™›°�74Ö’U�•xX
 endobj
 806 0 obj <<
 /Type /Page
@@ -2083,14 +2070,14 @@ endobj
 814 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 698.7008 539.579 707.6571]
+/Rect [527.6238 698.8005 539.579 707.8065]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.6.2.24) >>
 >> endobj
 815 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 686.7456 539.579 695.7019]
+/Rect [527.6238 686.8453 539.579 695.8514]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.24.1) >>
 >> endobj
@@ -2104,14 +2091,14 @@ endobj
 817 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 662.935 539.579 671.7916]
+/Rect [527.6238 662.8353 539.579 671.7916]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.24.3) >>
 >> endobj
 818 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 650.9798 539.579 659.9859]
+/Rect [527.6238 650.8801 539.579 659.8364]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.2.24.4) >>
 >> endobj
@@ -2167,21 +2154,21 @@ endobj
 826 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 555.2388 539.579 564.1951]
+/Rect [527.6238 555.2388 539.579 564.3445]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.6.3.5) >>
 >> endobj
 827 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 543.2836 539.579 552.2399]
+/Rect [527.6238 543.2836 539.579 552.3894]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.3.5.1) >>
 >> endobj
 828 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 531.3284 539.579 540.2847]
+/Rect [527.6238 531.3284 539.579 540.4342]
 /Subtype /Link
 /A << /S /GoTo /D (subsubsection.6.3.5.2) >>
 >> endobj
@@ -2223,28 +2210,28 @@ endobj
 834 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 449.6348 539.579 458.7405]
+/Rect [527.6238 449.6348 539.579 458.5911]
 /Subtype /Link
 /A << /S /GoTo /D (section.7.2) >>
 >> endobj
 835 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 437.6796 539.579 446.7854]
+/Rect [527.6238 437.6796 539.579 446.6359]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.7.2.1) >>
 >> endobj
 836 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 425.7245 539.579 434.8302]
+/Rect [527.6238 425.7245 539.579 434.6807]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.7.2.2) >>
 >> endobj
 837 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 413.7693 539.579 422.875]
+/Rect [527.6238 413.7693 539.579 422.7256]
 /Subtype /Link
 /A << /S /GoTo /D (section.7.3) >>
 >> endobj
@@ -2286,21 +2273,21 @@ endobj
 843 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 322.0931 539.579 330.8253]
+/Rect [527.6238 322.0931 539.579 330.9498]
 /Subtype /Link
 /A << /S /GoTo /D (appendix.A) >>
 >> endobj
 844 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 310.1578 539.579 319.1141]
+/Rect [527.6238 310.1578 539.579 319.2636]
 /Subtype /Link
 /A << /S /GoTo /D (section.A.1) >>
 >> endobj
 845 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 298.2027 539.579 307.1589]
+/Rect [527.6238 298.2027 539.579 307.3084]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.A.1.1) >>
 >> endobj
@@ -2335,14 +2322,14 @@ endobj
 850 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 238.4268 539.579 247.5326]
+/Rect [527.6238 238.4268 539.579 247.3831]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.A.3.2) >>
 >> endobj
 851 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [527.6238 226.4717 539.579 235.5774]
+/Rect [527.6238 226.4717 539.579 235.4279]
 /Subtype /Link
 /A << /S /GoTo /D (subsection.A.3.3) >>
 >> endobj
@@ -2398,7 +2385,7 @@ endobj
 859 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [522.6425 120.8677 539.579 129.9734]
+/Rect [522.6425 120.9673 539.579 129.9734]
 /Subtype /Link
 /A << /S /GoTo /D (section.B.7) >>
 >> endobj
@@ -2412,7 +2399,7 @@ endobj
 864 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [522.6425 97.057 539.579 106.0631]
+/Rect [522.6425 96.9573 539.579 106.0631]
 /Subtype /Link
 /A << /S /GoTo /D (section.B.9) >>
 >> endobj
@@ -2795,12 +2782,13 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 933 0 obj <<
-/Length 611       
+/Length 608       
 /Filter /FlateDecode
 >>
 stream
-xÚ¥TMs›0½ó+t3EÕtÌI�;ŽÁÓvÒ£$šbp$Í¿¯@Â&Mzêx<ˆ÷vŸvßzM
-ˆ,}Q7c‚}vû ­ƒbÓJP*ݾ-Wfü¦=»DÖ+ýÉ\Kií“ù'çs·?0¦¥ÃUõW`[ïí¡”Ï²´ÇB
>Ém[7¯ŠšæWN¸ênÈÚÊQD·�ºïZ3ô¯åcõóÁª˜¯›æ/æñß*ŒKzܹénÐ8AabD\Q½Í„¾«|Üà÷¥ÿ
¦œ@šendstream
+xÚ¥TKs›0¾ó+8Š™ ê�@:&I�'ài;iŽ‘S¦¹<’æßW aÓÆ9uFûüv÷v‘~°ËB
+"ÜH�!ÌÜÍÎAî³ö];ØÆøc�?�ºÈœOW4r!	Ýl;ÁâqŽÝ,
+@6¿½6¦ô[šÅ‹Ôó©0˜}>_fqb\Ä]Ìom~§w«d�ÚýjžÄ‹ø6K½ÇìƉ³ÃÓ91¢ý
 endobj
 932 0 obj <<
 /Type /Page
@@ -3772,22 +3760,30 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 1097 0 obj <<
-/Length 3638      
-/Filter /FlateDecode
->>
-stream
-xÚÍ[Ýsã¶÷_¡>EÎœ`|$Ó‡KâK/M.iâL’Ì…–h›s”¨ˆÔùœ¶ÿ{w
")Jvje¦s“ÁÅb±ûÛÀlBá›(M´ãnbœ$Š25™/ÏèäÞ}yÆâ˜Y;hÖõÙÕÙÅ+a&Ž8Íõäê¦CËj-›\-~šjÂÈ9P ÓÏ¿}óêõ—?~ÿòÜÈéÕëoߜϸ¢ÓW¯¿¾­Ë¯/¿¹|sõü¢ÂM?ÿÛËï®.¿ït$òÙë7_„¨~ùêòûË7Ÿ_žÿrõÕÙåUZLwÁŒ
-\Éog?ýB'X÷Wg”gÕä~PÂœã“å™T‚()DÛSžýpö�D°óÖ:&@)Ñ\‰ÉÌjÂ�V‡§
SP˜66•#Æ(;˜u¦-ÑŒâžPK8ïl‰ël‰‘ÄY31@D.üŽë¡L¬!J8·ö¡p lí¸Hf-ÁY—â>wŽŇ쭫Mƒ^¼‚ŽÝXÆ¡mN�£^®PKìôõwø4�¯z3HCŒ°:~´Ú.¯óÍq¡ˆÕJÅa jÜééÕ]>B‘ƒÚXù(ACœ€ï°¢̖ŲhòEษB'�?ï6çÌN«íí]è~„z�´'3&1œCƒ§÷T23}Ÿ•Û¼í뼬î±i§Œr:›‡u1ÏÊò!üô3åu³)æ�Ù�îí9›Öyh_ÇñëÀÚ<¯k˜9¢}V6çðájU¬nÏg‚êiVãS…‰ªª
‰J›µ
-¯ëj™‡
ó(¾€6§ÓlÕ~Ü䛢~FüLýõã�àÁÂëù]¶É€ïMü	Ÿõ8
-°s�(3ÝÖ¸@lyž�?×e6Ïïªrá	© 
-üx›6búªÚ„îüC¶\—ù‹Hˆ
Œ¼“�”7vl>M”¡¬ã‘n<,¬Qjb©8¸Öòög/ ’¦I	ÅcŽšÂ¶Ž8ºL•d„¶æ
-u>ßnŠ&?bSm}ž
mJœÒ¦(…äØÏ`5Ó„*µ©vÜélªCñˆMuù+‹ºyŠUA¸$Ã`ßBeBM«U;6Ṭ‚V�˜!n5-�F
^J¹ÓI&Q|D4ý#`_6ãxõ?¬Â'„J�–¯!ÕkB|)c|‰ÝËb^•ÕªýÑó‚	F¸šž9å«E0`0›�ËZ;Š¤ŽØPG;OeCm¹áé$Û/ÙðÄhqÔ„”ãà§!{:Z¹ÀRƒbÒu”Ã�j5[å·YS¼GÝÔt*øâïð¶X5ù­Ï£á†õÉ	n¢5!…ÞÅï8ââº#||AC_»‰ƒÈd&�6Ü)$'5L5/·5p�iÖ…›¾Æ4@p˜k>Ï×Mv]"�\‡ºHxµ„´½	½7Û
 ù&ôG(Tv…ò�Âþ¡1¯`½šð£ˆ�|WÌ£rí«:<Ñ+Xg랧&F+p£V�»?ª`JÃ2¦ÛYs·Ò
;qøl�Žg]Šûü1ʉ´ÐÕãð@4À˜%”ÙŽþk;ým[‚6ÖÍ|¡K›v×±û¾(ËÐòµ'xÆÚ´|•
-±ç‹
,݇(!úWi»Q#Ú%ÿº]µø¶?§Ä8Û)õ å‡>a*Hʸ0m0½Èo²m9IF¬LE7²«(ø¸§ð/GKk •
-
-»ͤâ£;.8d®Å}uÐ=?j)κ$G⠈…´|7ó‘=ç�3ÖÏE~Û‚‰×aiƒ•ÄœûôBQá·	;SY…	ôøÆôå¹Ì>ËíÆRð»ï³¢Óÿ\VÛ–ë
¸æÑ´O:B)uƒýÅ ~TìxòeSE-l­0Ï{¢8ë’Ü»”’X𔆻!ÖÉd í1(;H�ñAå2Ù�ß‹Ö6²ØºÏê~hp¬eÞ�¯nöì©Î7ïóÍàóºÉ6MŒ†N`tk@yÊ.MaI*iØ<‹qXµÆô2œáïp€âB™7Ôx±7¾õQ¸ÂyV_ˆ#!C­6ŸŒ`gñ§E²¿�p™½"Ró�®V›rLNU»‚w#Ô±4�˜O£…•ÓwEY]?4xà´OTQ™¾ùæ
-|+qÆÙ>ï2V¾JãNV¾êR<\¾êñ�£Ë,Â-˜ådü%Š�0È' ¬Çઋ–ÁÍK%Z'sYø$E?Ó"\Ü‹a8
-
w "p	?Œ%ì&yŒ?±.&/Â_Z3©Ô9�¹µ
-ÍGXÿ/Õ/oendstream
+/Length 3978      
+/Filter /FlateDecode
+>>
+stream
+xÚÍ;ks#Çqßù+èO
UÂܼvåÃYæ)çH'G¢ËdÕe	.É­°vq<:ÉO÷¼°
+áªën³3===ýîYvIá�]*M´ãîÒ8Ieêr¶¸ —ðîÛÇLÓ épÔo.Þ¼æÒ§¹¾¼¹À²„ZË.oî~žhÂÈ@ “o~øðîý·ýñí•‘“›÷?|¸šrE'ïÞwZ×ß]ýáæ'øE…›|óooÿrsýcx§#�?¾ÿð§ÐãÂcÔ¯ß]ÿxýá›ë«_nþ|q}“73Ü0£wòëÅÏ¿ÐË;Ø÷Ÿ/(ΪËgøA	sŽ_..¤DI!RÏü⧋ÿÈ
+¨Íꮃe#:Feu—Ëfùp5TOªŸ*,Ô¶=PT8¬exݵ‹:˜U
+À‡ŸOójV?¶ó;H೫çõ¬�]UË»vÚ�ÍÃã4ž;Rñ®DäF²-eÒ
S0쾑Ø×é
+ö¾�Ï[PÏž@Ôž�2ݼê£ú2ÀðN뱈zÉ~%["-—
+°5ÅÈÒ	s¥ÃN ‘yäq DUF”p"}ÃK$’ÒŒ\†€ç4ÑH™q3¢=âà/0!Çë–ÎÅ
M䡇ɣ€»äÉÿdimà…±ÙµÚg‡öæ\V1è-ù@&M·×*‚û§„µ‡­¢~±Tûª_¶÷ì ``FmƽVE$€Ó!Ä‚Y!D¡á×ÜM"ÐÁe‡ømɶQ"
Oœ
îQÕ,w”!¾Æœo§â‘­rèq­Æ{]V‹º¬œ úHÂܺ§è#×ËÞ{µô¡·.Øðp %½)ž*<:ðM£Wèãá3ÆÐdrã‚�
Ý·Qí8eØXë�•{»
+�Ð|Þ¦]†Ž®ž­WM€�©
·¾N
+ýQoe6‰â¯…½ú‡Æ¬…ý~éÃ�&ªäçÇf™«I¯ºðD�¾ŸÁG÷:føgêhfÔ*0÷LiXAÆp»êw”4xÃHœ¾ZIG€Ó!Ä]üåDZèa¸Ç`ÌÊì€ÿµ�üºnƒ‚6æÍ|¢K›têØýÜÌç¡åsOðŒ¹'hù,
>Ãiƒ«#O;3éÖ	FÕTüv°
+æ¡{³ðY²7‹Ò×]O6þ×ön4Û£þ÷ð„Ï¥çœ"Z²ßâ‡ûù‚)Â;¢è·d£tr‘ÓÀóñá
+ÐCŠq>Þ+–AŽ0Ø7©D2’’ñÝภ¹AdqDp“°r`
NíØ;»ÙÚE‰�àq£3V	–Â~fÏ�“H§C�¥œ„
+ÅÈ4E„ÖnÛ2£²g(-Ç4EsˆúC
¾”Ñpœ\ïK¢«o•'ulf}å…°5*ùc‡_¶f˜ÆZ¹Ç2¬¦Æ°nBË�ó%ôÐ
+t:( c切î'l
+èøÓG©Îó`’W`ÅÎð€ˆº¹;£<Np}(8—R‚Ì:ózÿ$CœAÔ®Ð`€A?æaGq4ZÆ!¯m6Ѧ¯Õ¿%[›§ì‹—ÄPy8·
+Ä!Vò`Ø»æõ¾x)<[¼4„x ^cÎú)ñ’¯c…´“‘>?Lâ<‡œê]Ac8F´ËÑÓz™²A»k‚Ö6Î,BÎYû–MÉÑuˆU”ú¾ZÏK|	ªÊÊ|E�lª¦Êȱjx[4@•Ë¯›�{Æ‹'.Àñ5Æ‹ã=
s�!AœAŒ¼,Vvà̹%’±qåæ×uÝy·¶¶µÓ5hJá�	;sš	Ì�³eƒ«/Íbíc?ІŸ«fò‹þç¢]/ñr“Q®\$“|
+ªº¯ç/Iƒõ£:d d¼ ‹š2EwÛ^Ì~�tèé½Ò{üg^ ábC·/CRA!fÃ
+3Òö%X—R±?�;[±q±„_ÐCô`£àna¡î\øeˆGôihPa#—mÉ[¦à:)‘ŒÌu(wU  hg’†‹g±í€¿¬ò%·}š”:“ïá·Gï
+Ÿ"Îä³Û¯�†¢ýÿ÷¦fÚß—´‹
+ˆ[F$Ö ¼×Þ€)ÜIh€
)Ú<öÕBž N‡ KB.‰„ž’Á!-
+º&TóÄ®?àÝ"­D¹Œ…©d­ÜAigx:Ã+9‡ÐrùNé	²~Œ¾¹9úÝΉp¦OU‡îBI\@´­>¯U}¿ª»Ç¢ƒ,¬œá§8è2ÜïŽ)Ú½Èmç
+I"øæ<=¡y
õÿGÁ0Lendstream
 endobj
 1096 0 obj <<
 /Type /Page
@@ -3800,98 +3796,89 @@ endobj
 /D [1096 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 250 0 obj <<
-/D [1096 0 R /XYZ 56.6929 304.8746 null]
+/D [1096 0 R /XYZ 56.6929 194.962 null]
 >> endobj
 1094 0 obj <<
-/D [1096 0 R /XYZ 56.6929 277.1668 null]
+/D [1096 0 R /XYZ 56.6929 163.332 null]
 >> endobj
 254 0 obj <<
-/D [1096 0 R /XYZ 56.6929 277.1668 null]
+/D [1096 0 R /XYZ 56.6929 163.332 null]
 >> endobj
 1099 0 obj <<
-/D [1096 0 R /XYZ 56.6929 249.2319 null]
->> endobj
-258 0 obj <<
-/D [1096 0 R /XYZ 56.6929 169.6708 null]
->> endobj
-1100 0 obj <<
-/D [1096 0 R /XYZ 56.6929 141.5207 null]
+/D [1096 0 R /XYZ 56.6929 131.4748 null]
 >> endobj
 1095 0 obj <<
-/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F14 685 0 R >>
+/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1103 0 obj <<
-/Length 2809      
-/Filter /FlateDecode
->>
-stream
-xÚ­]sÛ6òÝ¿B™{¨œX4@ðóúÔ¸NÏ�Öí%ÎÜÍ4�9Š‚$Ž)R%©8þ÷·‹]€¤DÛ¹kG
-ùÆÓauÌF
ã�Ü–ºš Ÿ³²X�´šå9ùZL6_:ú •oÈ>ŽHd4 ©Ñˆ�€m=ÔÆ�´õås9o[°%•Èù-1ȱ„C/¦tîTÛéfG3ã
/Ä2h
ZkEÉÆqp¡¢Û*õaÃӪΨ+cÚ“vô¯­F‹U% üt¾)>[ÈͯqŠ(\`çB×úB+È*®äõnÏ~¸¢´!f�…¾>®áõÁ\T�ÒU,Œæ¢k²Ïº1‚0àÊ1‡ê£›0²C2Ù¤åÊthÎiDLhÔlDìd
-c
¸2d²I\à€�hªV‹°8�.ƒk5¼ò¢ª»b=UP‡ÝqÌÈô"/Œý`Dí�ƒn&‰…ž
-üÿƒÖ‚ê¨ø¼$QÉØÆó,wEéð4¬IÓ(|済ÄjtDŽª]S„8¢AO˜$ÑKôÆìö&ûLPƒŽPªÿ‘;¢¶
-RQ™útàè™&šBÍõ¡ØeÖ”�çRJò�6
-ÊQX‚’¬¶5,=PÚ3•Õ0é`c«›ÏS%es,ÖêŽÈ Gí;¢‘¦å
-G¨I°>¢»‹+*ýÍ´§÷’Э�†…Mß«šƒ^Ý�¤v'ñÂGá�jú·Ú^S¦Ä–o·

->tÑÏMÚ…±ÂhÊi
-â±?W[ì/Ùn_êÉ6…n{òŽá¥RÚ6Xz¾§.ýà[Ì%éüÕù"ç1POªo'<Z_»ðME�¯Üüò{¡ãU^FŽÀi§ÁÍXRÉþŠ%4›®8ªÎDè“Ü
1lÒCœê‘ü<�=ðŽqp.ëúþ°GKP¦F�I0àÁÆ3¥U¦TN&FÉ—Üí€2“ùǶ|£`&!Wù�
|¯»¥±qGûT°qì%ÒåS¹[GÙ	®kë%pDKæÑ
-¶Ùgª£ä@Ô�CÖò(hF¶±„öô~ê嫯‰\'¸´Õ{f‹üº¯®è°×ô�M
-�µCô
ž“›ãe�V«/¢g
-|EõÏR1¿ªw}½ö
[½/rƒí�GHVƒöê-~Ç…F)åvÍ‘ƒ�–ÈQ‡ÅeÂ׶»bìvØŒA·ßëŒ1Àðú
-Ê`‘žbôè¢Óí>˹3Üe�Ç‚'¢¶(¶ìÃŠJ´†Í¡±:‰c¥Æ>/’ó»óԟ״`(i§áF¶šM“Á�š–€&øà†’±ïh0bÅ&×<Ò25¹°lš\À!;ÍÀ‚Ù!Ë
ÀÕ�oÞRþ|º3h¡--/÷ºqo
-�x�S·BëˆÀ:â�}x’-dh*}Ú(.
PÑÄ1–
^("÷Ú,XñîÌC$¨qÄ1£�ô‚3gOfÕbW4^aŒ–"”g23ø%û«H=_BU4êD./‰îŸæëÍ›©Fço
u\¬yþñöæß43º¶ô°•Á‰Qý3êê¶
á{nûÐä:¾�m¶Ñ/G‡«Þ«MñÃ�Ïy¥!9rkÀ²ÎUR½[?Eà¨GíÿO:ud|paGžPÊÕÂx>øƒx¤ bm»¬éh�O•}òDP÷P$ßfM–wÆçqáò5ÁñÝ´-³Û;9|D%,j7ñå•&Ã3^_ÄP€]ü~fˆ A¤‚ƒ…‰«§+.,D<xñ¸B€ï•.¡2§N>™a^(Z»Ç]ñ‚‹HØŽ<=ˆ
-Š^8r/(8ò¡\«ÀG]Ù³3ð‚_…LZ›ˆh%”äãÇŠŽ‹m0VöîPvžtuv…:ÏiÞiÞW扗ŠwXéÓ[*
•P\Ô•†ðeßS
¼®1ÝñëºO%¦²�	
-endobj
 1102 0 obj <<
+/Length 2913      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sÛ6òÝ¿B™{ˆœX4Aðóú”8vëNëægîfšÎ”¢`‹cŠTIÊŽÿýíb DÓòõÚÑÁÅb±Øï%f>üÄ,�<_fá,ÉB/òE4+6Gþìæ¾?Œ³0HëýõÑé…Lf™—ÅA<»¾qh¥žŸ¦bv½úu~öû�×矎AäÏcïxÅþüýåÕ‚dô8ûåêâòû/ŸÞ'áüúò—+:¿8ÿt~uv¯@Ö¦ðÌ‚‹ËŸÎitþÓùÏçWן�»þñèüÚÆ=°ð%žä�£_óg+8÷�G¾'³4š=À‹ï‰,f›£0’^Ji ÕÑç£Y‚ά^:%ÀH¦^”É„1%Á(óbH-A<´ð‚ã…ð}þA}õý .û²©é¤y½¢Á—.¿Ux^ *ªþlÄžïÇ™¦÷nµj�E:W]ë9ßä}±¦aUv½†óœ�¾mËMÞ–Õ#½î:µ¢QßÐs¥zÕnÊZñ⢰䋦î5­¦"ÀMÓÒàH6;Þ¯Sí½â‰f«ÚOØ�ºe’ͯ×êO†gÂË¢(Ðgq˜„M«®¡ÑîXÌ™Å`^Öôì×F8{"OA©1hOÓÃó«z
¢}*ÆPz~%Œ‰RJMd^”„‚qº¦í‘â1z�L
±®Ï{µQuOç�ð¼Ä´ªNoë’4%Pª]_ö»ÞžO™ïk7`í¢ììKøajd(ì™É€ŠœMj©Œi=Ò ¹¡g¿æ™›¦ªš‡²¾ýçsgÂóA\Šƒ¤½A„ŽŒ2¦r „Ì~õE2ÞŽkÂäà–éÉž{z>ŒÃxoO#•Ë�,•=à«ù—ïC–UkÐïc˜Ï
+(	0bd/HÈÁ: "ƒõ²Œíêi¼í´”ÜmÇbÚ’�0\}äT2Ö璘iP7½võƒ¢‚›„~ú‚¨¬¢2X/‹êЮŽ¨ÆÛN‹ÊÝ6§£ß)v¯Ë'lZlQ+ŠòŠ#ûòqp¿‰ Q'…‰:w*Ç|d½R98ÏJ\Â
+/)Í¡`„Úµ¯`=�‚ñ¡i$R7µ"ÐDA„USäÕºéz^¼¹ÌÄ€P«¾ÃÛB
+_8r[S‡¢$
Î~n$7Ôqæì¸Ê<{Øš	ñYp¨ÅŒƒ%ÏÝ4;ÃSiWªý3‘¾Vª+Úr;T¼Oªt+=°¾ãYBŽâ©ªŠb4/[@ÇL.2äb—ã9hw×1p“¯ÔÏÄC"†©²£Q÷X÷yÑ—­á:Žçš�LmEÎâœP7eWB‹��Né¼+ëBM©»SÅ®-{.Ë�o]ô…lÔ	µS±‡¶b¿Ï«r•SùîìhóÍ®§Rù-ÙLjDN45š0…=ØÖC£=
I_Æ¢\¸©˜_�ƒ+ØôdJçVµØVpõ€ÞðB\ ƒÖÑ 3QVl;*ú55$»[>¨kL«¦Ø¡®´iOÚÑ¿×
+-Vú(
dóÛòÞ@°úAЧ8�²Á‰ý²g�Uœ)šÍ–ýpE3(hMÌl·G&øø8‡Çs‘aFG10B,™‹¾Í¡ËÒ‚ÐàÚ2‡ê£›0²]
2Ùd1åÊÌ5ç,&&j6cv2
+c
l¸ÒdC²Iœà€�hªV‹±8ÉS«á‘О”7SuL˜˜þd‚^ìEIîQûc§ÚIb‘'Ãàÿ µ :*>/M娳/òb=u!„5iG¶‹€H"÷¶ƒÈQw7!FôâÐi¿DoŸýÝVgŸ	j¾'…ü“ܵ8ûCÞêm¢ÌxýaÙÐÁ2}æ"/Ì@ŽŒº¬òânÝTSì†)`J1pƒ‘5�ëºái"€çBF‚E±®O�ЗpM¡æú\nÊ*o«Çc!„fÙ&
+Š½°%Ycj$˜z ´§+/ªa2g¡½lC`CO°t"ƒµí	ˆFVêz”+<|ÒµnFt7`qe­^O{ú 	Õ™hXšô½jì}À“Ônã$x5é÷ÊœRdÄU`V

+²ªSÍ”4I‚u€—„PûàÄ=aÄïL\ëK†Ø§ÎŸ9=H/8²ö¤g
vMÏ3"ŒñÒ�ÄĞ̌?e�õ3/Píµ"§§D÷/óõöíT§ó�¿‡:N6<þruùi]zØËà@«þ€º¥£î¿ï»ìÙàÕºúáÐg½’¾Ç¹n­CXÞÛRjpë猚Ôá;üSGÖßkÈ‘'”r¶Ð^�·��$”¬]Ÿ·=MÐí©4wžê‚ë¼Í‹^û<Nœ¾!8^œvUÞa'#"§¿
i,ê7ñê•îoN	¢)À*¾@ÓD� RÁ¿D©­§ož°ðçNÔOökx_©
+JsjuᕹðõEgÖØ#žpù
+ s/
²Ä0…ç•r̹ýÆSÖÿœÐådendstream
+endobj
+1101 0 obj <<
 /Type /Page
-/Contents 1103 0 R
-/Resources 1101 0 R
+/Contents 1102 0 R
+/Resources 1100 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1093 0 R
 >> endobj
+1103 0 obj <<
+/D [1101 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+258 0 obj <<
+/D [1101 0 R /XYZ 85.0394 769.5949 null]
+>> endobj
 1104 0 obj <<
-/D [1102 0 R /XYZ 85.0394 794.5015 null]
+/D [1101 0 R /XYZ 85.0394 749.6335 null]
 >> endobj
 262 0 obj <<
-/D [1102 0 R /XYZ 85.0394 438.8479 null]
+/D [1101 0 R /XYZ 85.0394 336.0663 null]
 >> endobj
 1105 0 obj <<
-/D [1102 0 R /XYZ 85.0394 409.9891 null]
+/D [1101 0 R /XYZ 85.0394 307.6963 null]
 >> endobj
 266 0 obj <<
-/D [1102 0 R /XYZ 85.0394 349.7918 null]
+/D [1101 0 R /XYZ 85.0394 248.6123 null]
 >> endobj
 1106 0 obj <<
-/D [1102 0 R /XYZ 85.0394 323.4555 null]
+/D [1101 0 R /XYZ 85.0394 222.7648 null]
 >> endobj
 270 0 obj <<
-/D [1102 0 R /XYZ 85.0394 249.9022 null]
+/D [1101 0 R /XYZ 85.0394 150.9902 null]
 >> endobj
 1107 0 obj <<
-/D [1102 0 R /XYZ 85.0394 222.3206 null]
+/D [1101 0 R /XYZ 85.0394 123.8975 null]
 >> endobj
-1101 0 obj <<
-/Font << /F37 747 0 R /F14 685 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
+1100 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F14 685 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1111 0 obj <<
-/Length 2453      
+/Length 2398      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZëoÛFÿî¿B@?TB¢Í>¹Üö“ë8>—´µ}8ÚGS´E”"U>â:ý;ȕDKN¢+Œ
-©ˆF“›»€WŒp“ÉÍâ×i„(š
<=ûéûˋ]�Î$ŸÞ\þôa6§Oß]þóܶ.®Nß¿?½šÍI,Èôì§?ßœ_Ù©ÈñøáòÃ[;¢ìç	¦WçïίÎ?œ�Ï~¿ùñäü¦—%”—`¦ùóä×ßñd
bÿx‚S±˜<@#¢�¬N¸`HpÆüHqr}òKÏ0˜5KGõG0¢,¢#
-¤lL�B¡ˆÁ”VàÙ«Wó¦},2�Œ«iZ­VYÙ6¶×´IÝÚæCÞ.m«]:Úö¡r‹–I�¤mV»eoÞØïoXà¦HšåkÇN·a�ØnR.ü¦e›—�g[mí“yºênkf½|læÚ ˆ9!H	A�Tyš³9£Ñ´ÈËL[—ÅÓ›eöhÓ¤,«Ö¶o37æ±°Ý$­g$žVMcû«®hóuáˆõÆ›{4ßC;âæôzl™|t´UéEu?¬qŠ¶�f�”cb›ê[g¶ymÛY’.‡QÛZuMk[]ㆬ¦ aLßu’×ú.£~;‰£Òl÷®ª÷¿’lû�&/TÁ%ê—Äf‰æaºÍÛò_³µn¸K¤›Ú€ú›Ø�Ó
˜‡PÃí(³¿Ü#܆bÈƶ~³Ä/|ØàüÚö²�YéUu÷K·¶ÝäáÌS<ŽYÂo¸Þ‘¥—s]góªk¶d3*ÜðC`MŠc©ëëeV¡j·ñ–Xgµ›s>”;x¬:Gaîiv—Õƒgòâþf„Î;blF)âãpd}ÒoF„‰�
-¶Üõw­è9c)ÞT¸‰á
¶Q@XÅoÌÎèýÁ9IÒØo^ºhþê•mxý˾ù›�€†»þ
>@Âý¾ÈÆ’¤`¹z^–$)%øx–„ƒÆI…ùÓ¼ì:¼\Ó¯Ød5 ÎcDU¬ÂdÚ«ÿnQÄ$‰&.B‹È¨èß�‡ˆˆMk„„kc]ätC§Wæ@™^öm:½ØÖì‚%\L.
jt5ù´ çÌ…m#ý 3ðærÅ&o+�qˆéÏCÎFL
-3Ð>÷Èè¢NV«¤~"×Æ(’Šyï£àfçCKÙOºÃ?bz°É“E�Ĥø3ùì
-}›ÕŸTæŒËéõ]æé\ÖKG¡Â•£°¶OêÂ'S±‘ëaØ¢
Ûq9^ßjˆè¦•Y@Ý.“ÖqIJÇ`½Î’Ú¶õI«ÎPèûœU“—÷vî@CfdÅjú>)ÿ@;#Y'þÄgãÄ~n‹*ýc3³7Ýí|`ä’ùÃ2÷�wRwŠÆC…¬^å%,s@a
-LY;fij©uÊ�[h‹»bÌÉ’h‚ÿÔ}AÕìF`	Iž29	õñuÖ¶$’ÉžÏÒ¯xÊhÐ�ì²×hò<#JöîZWEóË¥…s‹Æ#ìAÇv`	0!+Ü´G÷·Y¯_§ôÛÇ
ÝÛmÃc…uAâÁT].Ò‘ÃAÕ¢"æ×µy‘·�3BÈt�
õ|�·mHŽhC)�”ñ
‚H,â�æµ»EvЂŽ®Ùˆ—íÑÙpœc©Ìú?b¬Å‘Œè,’ 7ºø#{<¨¯f�¥¹Ö�QY„Í"Ø
-ô‚Ϊ‡ØÆ =c_e"W�Â7éà–C)œö Æ?Š¹ÉjÔù§
-ë{sšx¹æÂaÐð~k)ŽmN)êìpB	‹$“TvS
‡œEþåÉ¢„]¶ŒøgŽÈ¼Íj0` £Aië†6AG‘ß/ÛùC¦?v¤*ÌýÐ#‹Ä�ôyuƒà±‰Õ½ƒê’wäüT ˜CѵŒ
-
-kJÞãGñŒLG£DKaA"™$ØØ‚Ütí|Óv·Žeé85…~ÞñéOUÿï73è§HöCÈP-/ÖÛ	Té*㶓ÉÈ=Uk�©žåð/j•©xz_T·æM`|–a|·T¿�¡°ÑZéhnj6˜_dwIWl¥Ödwþ½7ÀûCÍ·Çd�6^,ê'œ#*É
Ôv@±�Ò¥%£ìƒé4óqšÕCUŸŽ½ÔæÑ�Íúm3ê¼·±.’&ߧù@¨‹Õ	£PIŠsL …©ÅêmÝAÈXÌ
J~V°3åR=‹§f¹í¿ýp}}~fÛšßeç<®.�y‹)¬�ð�‡h÷âÒ&��yöð¹Jt7Ò,UtO±žçå*
DåXº�š‹¢Aöú2¥é¥{œåX
-{þõÿã]�(‚¸„è’‚ñð§;?Ñ ä�PÇQÁäþ_hD1ŠUÿ,9ö‚@	=z|²b.ªòðQgÆQ^Lô ùéŒÍ"cÒÇÿ­gÑUòèã{á[iÚùÜZ¦ÙïÇ2Å“&„©
-ÐXÓqõvt‡ÒŠ`|çäþ9»Gÿ²Ë÷endstream
+xÚÍYYoãF~÷¯ �‡P™Ý7ÙÉ“ãx;“ÄãÅb‘XšjKD(R!);š_¿ÕÙ’écÖÞ 0`öQ]Ý]U_-!øÉ�DF©d	G˜GÅúEK˜;?ÂŽfî‰æ!Õ·WGÇïhÉD
+"¢«›€W– ,ÃÑÕâ—X$$™
ŸþøáÝÅù?/Of)‹¯.~ü0›Žâwÿ8³­óË“÷ïO.gsœqŸ~òÓÕÙ¥�ŽÇ·¾³#Ò~`zyöîìòìÃéÙì·«ŽÎ®†»„÷ňê‹üqôËo(ZÀµ8B	•�î ƒ,%‰ÖGŒÓ„3JýHuôñèç�a0k–NÊ£„PA&Hè”
+vIS°6ŒõY¢?@ë-5MØ6—…bŽ/Ö4ú®�+FÁ-=ßyÀØ\2öÑÊ¡¨
"Ø]rpWÂÚú¿g˜�êÁû04FRÝ6QG7Œ=èF§ÖeÑ@’c»Ú=üç›/­G`)2¾g†Át�ÿ±k·
+#¡0ÿØ«Ï=ÿàW€Ù]iN ,F,
¡DšÐŒâˆ`€�áÙæE5
NŒ2(GSJC°6ŽTHã.!>ÔùÚÔc0rñ“Ê«‚Α®ó¾X}éé
+06C¥M¶ŽYQXjqÀmaWMÙh>$™
+ß|vup1$5þEÌM6“Y@[~
+² m7Dª«�ç�¨+�Äkù©×W…¢
+?eâ,M2žÚÐõêRKàó4FSH(Lò-÷°ŸA‚ÐÞŸƒÀפÌ¿Z˜%j|÷ÖZË`
Q&_BÙwvÀ'jì&³úA[£ ^WYì•fˆ?¥-Í…¥6¨Tw­z:¢„5’‰*÷c
“‰¿:Ù,á>[Ê žQGdÞeu2`2F“IèŸÌÐ~ÒQ•ËU?¿Súc'ÜAšÊ؇Yä.GŸgPÆPyðà¿öøÔïÄù	ÔÓ
+4ŠeòPÜg4x\Ã�˜L Ž¿-ÀAXLò§Ü1B	¢ßë¼3?+|Nú˜r«I6¤�0♎N-…ÍaÈÄÀΖã¦kç»~{íXÖŽSWé—ý‰ç¸OÍðï73ÙO•?žABùÛ*N HçùãzKE‚‰°zk6:F=ë>WÔâ’Y¼¬škó”üà‘aü~‘~CaµÔŽÜTk0¿P7ù¶š.Goü3o�ê�ÕÞÃêEñ2Ñê‡ÃŒ¢´Å̱œúEÞÂ^ü«ýø
”f™þAž¤àG2`¢g)µ¦MÙ½7\ÿû¾'ÿ_À�¶endstream
 endobj
 1110 0 obj <<
 /Type /Page
@@ -3924,16 +3911,16 @@ endobj
 /D [1110 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 274 0 obj <<
-/D [1110 0 R /XYZ 56.6929 426.5656 null]
+/D [1110 0 R /XYZ 56.6929 330.9243 null]
 >> endobj
 1113 0 obj <<
-/D [1110 0 R /XYZ 56.6929 394.7216 null]
+/D [1110 0 R /XYZ 56.6929 299.0803 null]
 >> endobj
 1114 0 obj <<
-/D [1110 0 R /XYZ 56.6929 335.9523 null]
+/D [1110 0 R /XYZ 56.6929 240.311 null]
 >> endobj
 1115 0 obj <<
-/D [1110 0 R /XYZ 56.6929 323.9972 null]
+/D [1110 0 R /XYZ 56.6929 228.3558 null]
 >> endobj
 1109 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R /F21 658 0 R >>
@@ -3941,23 +3928,16 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 1118 0 obj <<
-/Length 2937      
+/Length 2415      
 /Filter /FlateDecode
 >>
 stream
-xÚÅZ_sÛ6÷§ÐÛÉ7ÿ	$O®ãäÜiÓ\â>µ�-Ñ6/驸ž»~÷ÛÅ$%Q¶çæFÀb±»Øý-(1áðgW^O2¯™áÂLæ«#>¹†¾·G"Ž™¥A³á¨ï.ŽþöFeϼ•vrq5àåwNL.¿LOÿ~òþâìÃñL>µìxf,Ÿ~wþî5Q<=Nz÷æüíÏNŽ3=½8ÿé‘?œ½9ûpöîôìx&œ0_F&¼9ÿáŒZo?œüøãɇãß.¾?:»èö2ܯà
-7ò¯£_~ã“lûû#Δwfr/œ	ïådu¤�bF+•(Ë£�GÿèzÃÔ1ýå˜q2Q !˜7FniÐxf•TAƒ¸i

-àœOóù’¶÷±ÍÛbUTmÜí:_­ò5îŒâFá“™ÔÌk¡³ÀÀ§Y•¯
-zû7ÎœHÅ<*eÖ‰„3‹uÑ4ŸVy;¿ù´,›6Œ�í&kÿñŠDØÞÈ 3Æ­q݆ä#z]üʹ¬Ê¶¬+¢äÕ‚?7ùu—Q‡wzqSt²ôƒ„gB8ƒ“6ö	ÄUiL3L›iÞ4åuÕÄz4÷«ËzYÎé�´Š­¶ŽÃªøU7u"ÁNƒN©¾­¸›žÇ¥®‹6®S¦FÏû*pªW[‚Ü®Kð‚{zÙ4YJi&�tÛf­¯¢Z·dB’	š(Só„|z2ŸwCN몥å£ñ~À�Ôü•~rúCOÁÂú`‘1¯Àÿqáwu[P
-Ôs“·Ø²AAHÙ;¢0؇Âü%’I
H]mšÈã2Rä9Å‚Èwe{3â2sÌóL<ìœVgqÌeqU“t´Pž'éI‹Š_¥X6ÅÝMA³^
-óÓªŽçB�ÏÄŽY`‰»<Œ�ÞNs¯"�
-Œí–D	/Ëe}W,Fõ�ç ºªqTY]Ó+i„Õå¦\¶³²z¹9…Ð,Ë291V1§´~Jì„`*̲íØùu³’ ¼×ØA	h^±™fl³šu›šAc.ór™ž ¢¼1†éÈòê~Äk¼bJ½æGôàÎhËx`nj80lWņ;¦µÕ“(ŒzþHc-ôÿOt¦`×R‹Çt¦!E
-NîXÕUñç”VÕOÓÙ@˜o¥³”ãžÎ2Í8¬3*B¹Çt¦_3AËzž/qûBq™‚øŠg:“Óó÷_4‘(‰ÉFRsÓÄ�`¹+ª¢½«×Ÿé¥¬Úb}•Ï‹c1Mª.òbY›"Osß@
-}Àt�<OϽé
-clk¿©ÊßãNs¨4¨
ŒZÕfuYDuÖwUjÉ×ëzs»OþS;Ú‰’{¢ín%;Ñè`ñŽhTt^«Ÿâµ_Y¿Üy¼~—pªM–J²N„Ñ(&¹Ú¯á•õ�bæËXô`A™Å½¤Š‡Ìoòª*–±y¤†
-ž±ÂƒžË{¢Ä<hùÒXj�·õº¡þÄa{¡Œb}0‰åÌX¾sTkp¥<êÐf”Ó¬‹	ñ>
-™IS²J>Ÿ·-%<ö†
-5®èÄÂ¥ÂpU›é(dà³SsY§§Ç^bá‡ýÑh­2`J^ì÷:‚Ë˼À«k.Â
­#pÞ²ƒÞ*,„J™™‰Pž�Úg{kÇq6d9r£`=„
¨ºay+6šG¼5ƒS‡¼|9–¥¢"Sí7ÓüìŠÔw_o°ò÷ÉGÓ†[ñkÃÎ<}•ÉGA‚6Î¢82$7‡ÕbŒ4¬X;£†Ü·3²¾½Ì矣µè4‹ÝA½¡øÙWÞÍdI&�À~bDz8Èu_”êõ¸â�5ºSü›„Èù ŒB@R6C ƒ	ðR±HWúët}ð{¹Ú¬†™oÖˆ³„ÆÌœgšk›ÐLXäüjû‚•ª³á¢ƒúbwŒ7j{0"GF‹ºo)ÄÅoCRêõ@Æ‚¢#…Qs0Œæ³ÌN£ÇÀ2Ý8á7Œ¢—¨WÔˆw
-&\÷
h
Häõ�.xø€«Ÿ�
+xÚÍZÝS#7ç¯ðÛ™«X§oi²O„e÷Hí’= O›­­Á`níÎ3@È]þ÷ëVKã±óHUŠ‡‘ZR«õëVȈ‡?1ò†q•é‘Ë43\˜Ñt±ÃG0ö~GÄ9“4iÒŸõÃéÎ?Þ)7ÊXf¥�ž÷xyƽ£ÓÙçñþ?÷>�ïN¤ácËv'Æòñ‡Go‰’Ñgÿ§£w‡ï>ÞÛuz|zøÓ‘�ÞíìN„7ÖËÈaË‚w‡¨õþxïãǽãÝ/§?îœvgéŸWp…ùÏÎç/|4ƒcÿ¸Ã™Ê¼ÝB‡3‘er´ØÑF1£•J”ùÎÉο:†½Ñ°t?-“2S£‰òLã·oK[pØ66…`™1›»N„0L…:1–qm\§)z:R0'33r&cVI”ÒË›b‰ØÀtÕŸÎ=Úá64¯mÎi±ló²Š�ºú…syq½ÌÛ²ŽÄú
+Ûqz"æô¹‚Í„Oâ¾�v–7eÃ6õc¸cÞq1êëeP©L2#¬CÐhÂk¢¯5ã7�¡¯³ÎÑ•h—×M[Ì&ߊ»æqÌ
+ĺ*"²ír×�Ãzê¿=:99ا62|
+‹ü.ùûyjM§×ËDœ+ÿ?9X'YÒ=l	&-™Í,˜4Üq!¸
{cì�p8�¿“$PúË|±Èc`SYï´¦Y¦
Xâ4©òEA½ÿâÊ\�sƒî’†³Ù²hš¯‹¼�^~�—MæN6&“‡ÿýÍÐÁ@ÜßH>r ·tóÊU˜Eu†ÆÏM~1tw7NºÝ”„O¦„»8

+BÑ€;�Íã}¹¬á¾¤P$ipÿ}a^šB(f!ÿ9˜�3Í Ay3ˆFy²ïj8ïz
+¡D²‘´ò¸iaˆ0‰¬UÑÞÖËoÔ)«¶Xžç�àˆqZPu~§çÉÚäwš;(ÚÛ5ׇäe0¯4醗ü95tZ±]sÚ3)ùcÖ®<¼Ñ÷ÕUÆŸ¬:‘éàX ¡‚Í	³ ¢RjYÒ—tŠc�¾�|žÆo/K¥8!¨i¤š!í]æ¨\¡(wr¥wHRdæÇ'uÈD`1ihÚ¬&bU·Ô¸¢DáÌ¥œÅ9}nC
�ãºY
Û,Jr+¡DϤ¤ŽLC ÿ•(ó¢&íeCý`ÄHG
P3=´ÖŒ>$]b|XÑXs²IRaš7ÅwC¾l@.ÙU%ÛU=é殧`]í°è;¼îâ$Ù¡e_Ï׊æ;¢ý;$A”±}Êz%§Ò«¾¬[<Šæ�BÛ”=pk{×áeWlukŸSæ¾~b! \åFP—a<ÒË\%¡œk™C¯öIï®ü‚6Jt�ŠÐ“ézÞ¼¬®[qY•s)\3ºÏ4nXK-LØ#íêk°®Ðù±»�FGÈœŽyÏßã1í
`ÎO«ã.Wõ²íx¯:_b	Šùhx"$çCÅ&
üNIs2¡5·žü
 endobj
 1117 0 obj <<
 /Type /Page
@@ -3970,57 +3950,61 @@ endobj
 /D [1117 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 278 0 obj <<
-/D [1117 0 R /XYZ 85.0394 769.5949 null]
+/D [1117 0 R /XYZ 85.0394 656.7756 null]
 >> endobj
 1120 0 obj <<
-/D [1117 0 R /XYZ 85.0394 752.4085 null]
+/D [1117 0 R /XYZ 85.0394 632.436 null]
 >> endobj
 282 0 obj <<
-/D [1117 0 R /XYZ 85.0394 683.64 null]
+/D [1117 0 R /XYZ 85.0394 563.6675 null]
 >> endobj
 1121 0 obj <<
-/D [1117 0 R /XYZ 85.0394 653.5261 null]
+/D [1117 0 R /XYZ 85.0394 533.5536 null]
 >> endobj
 1122 0 obj <<
-/D [1117 0 R /XYZ 85.0394 576.1881 null]
+/D [1117 0 R /XYZ 85.0394 456.2156 null]
 >> endobj
 1123 0 obj <<
-/D [1117 0 R /XYZ 85.0394 564.2329 null]
+/D [1117 0 R /XYZ 85.0394 444.2604 null]
 >> endobj
 286 0 obj <<
-/D [1117 0 R /XYZ 85.0394 417.9499 null]
+/D [1117 0 R /XYZ 85.0394 307.3784 null]
 >> endobj
 1124 0 obj <<
-/D [1117 0 R /XYZ 85.0394 388.7174 null]
+/D [1117 0 R /XYZ 85.0394 280.2293 null]
 >> endobj
 290 0 obj <<
-/D [1117 0 R /XYZ 85.0394 267.384 null]
+/D [1117 0 R /XYZ 85.0394 163.9859 null]
 >> endobj
 976 0 obj <<
-/D [1117 0 R /XYZ 85.0394 235.1866 null]
+/D [1117 0 R /XYZ 85.0394 133.872 null]
 >> endobj
 1116 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1127 0 obj <<
-/Length 3451      
-/Filter /FlateDecode
->>
-stream
-xÚ­Z_sã¶÷§Ð#=sB
-jz_ŠÙÞçx	
$|R†<ÖéæXàe‚)ÝÅ9–Y
çÁ�í–jÜŽ¡Ï>ýyðÔQáR½-6”þLšÜä>í™ü�CwE½ïòàÏ$3c?=ÕšA˜’ÙOð^Gõ‚È°%
-5ؤéãH"˜°&¹]5Ÿ�AΔ‘�†„
-`²Ñ �_c>:©ê±à’B0¶Ðëu3-pÖî7m9@™
-Q=–ë51oŠ0 OÿÌé1/ù~Ɔ‘
-ˆQFˆäº"’vU†ÏfyS¼!øÜñÌ×MMt�«¢¢¾3à	ê7‘éW쬂ü º\ÔÛY¿ˆXú8tS®†p²·ßX:©äaóºðåš]èZåŸjåc&Ÿ¼w²—Ø›qžfT cÌÒ Rãö†åžŠ×‚¶AjŸ�R4�|zVa\‹/‡RVù,í¿Z�-n_R(€âYeÖ
-+Ô ^PPDO7„r+zá€pœ8n’>ÀŠ^xE~S´£‘Ò¦„®Øáü8XXÇçXGk4�ÎÞ †“[`�sÊ?Kaõ:ZÜ£¯z€ù°H†Ž8@¶Ž­pö‚}qða_®[ŒÓX°Ãûý¥K“šÆfdŸ9e_
o 7–ÿÌf樰|^ËPšÈN=¸ko¨¤Ú]ÚdÔ®lßÖ`Ù¡8d>Eý,qa ëdš�LdÄ\i†!^ ®æ™1àf,ÖF6öDsó*ÃÉœŠ1w
Ûw•¢µAÙÖõ:§:ýpÐÕÚp�]^5eÈ“ÖQ]ýt¼ö†ÂöBË¢B�Ã*éR$¾Pêy¦¥ =>¨x½ÎR¥Ž\j^.Ë6_ãQLo·0²œêi£`ÍÍÁ©±·sj|Ù@ÄÏ—ñÃŽ¦]íC——»¼tØ �çÉÇ‚”2,SJ¼òãîÇ}ÈC\9àº%æ›ü‰…ëñÚ@®… =TǶnšòÁŸsÉ€µ¥IöMèÈ+z_ OR–„á°)Ðoéq@9Is8@‚2ð‰_R
-û
-5º,渻ґq
-Ö
á¢)7ÛõõùA ¢Ê‡´¯â)Š:œ¢œÆ–2¸€þÇ‚”lB¥qMù¢õUUOL»r¿�úW�{ż§H@†õzü鮬f¤¶£JA!ª»Àó|„‚�Uc
-¹{ÐϺB}J.@.€zóbf¯é	’Ö��<%"¾G:›ƒâ6[0kï$HµGŸ¼ô$á—–:@ÙSR•“Ìà©ÐI^ï;‹ÎÒ ( ö/t%cÄ“.Â(IE0²*—«@],éã‚F|Ä•®ï°åºlŸ. NÀ�%ÿðùr(!ÞÑDå›Ò§¤S»e˜6úúa­=Ü¢–G
:âkh4P臡Å`H
º¹¥õ¾�›DñäeCŠU½_Ï©#µÆR:Ø.¿Òz«B‡3+€V²ƒV�¥¿  YƒðõcE�n�åb ™†ÏšÉØÖÁexÑ =r™N‹~áuÓ5ÁÛñØKb<“ÈñÀJÔWù	Ob
-BȤ†µ‡%ãâCÉåS ^Fçc6Š8’ªðÀÙÒ¤ÖÀ�ÇkàxR`8òh&¡¥:“T�ÏÙnþ
²FyFË€Ÿf Ë3nh2­Ž­Waæàò¯9¨‡^ûã
-K¹Îº{}9œ#L™­÷ó ¹»Þñ^úïrÐöXQËñ �´
u`‚¨jQ®>ß�IÄ£$¦“${…$?hûU¬šü&#øÅ‘Sít"ša!x|ƒËà9J0b	V$jä”OjDzÅÎg£;4†U»ì]¥Ã`ÞQoë2²{Ä ¡ÎÙË08gÒì+%BU8�ëßzN%Þ¶[a‡qá¬"µ|�8]ÏŒˆcM²Èg˜ ¯üw
-­qjˆ>û"»‘zG*À‹ëäP�»’x L$ð«Ã½=öl¡^î‡�¡ôÕ”Óü]ž1É{D‚Ø[|É¡âÁÓ¨å"׃CGŽ¦�¦8Ò9öowågŸqðá�Hš(K¾�7Ü#õ(A€OE ÃIuý
+/Length 4048      
+/Filter /FlateDecode
+>>
+stream
+xÚ­;ÛrÛ8–ïþ
+¿­¼eqp%€ä)“NzÝ5“îMÜU»ÕݵEK´ÄŠDjD*Žgjþ}ÎÁ
x‘ Û³IùA$
+¾«Ð+>«�़Çq¹(<°%²
+	5õæ‘ž�ħ¤u&“ÒDxûz¹H¡.3¥m�zM
+Ü„úŸšM
!lÉyä(<xÇݶ!
+€�!—8’c8�föß¡õ°Ý Nø²Ûm*ÏaD¤™ dAúhmÝÑIJ
+iC×ì€ö¹Cxò�WôÒÏU×–›{"E†€è(4zZûY"¹›íöÕ¶ð8ÂKqèÖ;ú{�

mKTäªÅ'·dÿa¸‹ß‡p5¼ô:/^?ÂÒD¨‰¨»>öKøJ¡Á¡	f*ìee�§Mp„8ƒL˜`q½ÓÖ/{ql‚Éëëj±&Š¡aˆQÐ�‡åŸbÁ`‚À\ª<Ó¹OG
+‘ 8물ÔNdBéo/‘D€ó1ÄSp<˜Àõ«ÎF>ÿ�†ÊÛegï
+r¹Ç„G£ÆÜy™ÀŽÃ
+Îw;oñ™£Ùv,w/81‡(C«è½;rç¼�°™âO(
 Œ¢è¾ã�#Äg, @·<âäÀç”À@ৣ�õšGŽæÄ›M$AC¿å×rqðN^†|ß(ß�ô‚sYàde‚(}*Ëså`mY&|þA3ûÕ%=|L•Á‡Õçk¸a
ò·�å–<Ÿ³…÷xFÎ~(`¸¦Ñ·ÌaÒ;‘…·®œ¤Zg` äë“’s¿æId�ÇÜ{„mUŸìÁºæ‚¿ŒJýê§w>‚é½8¥ëD™ÉŸӔ€gJª'ÏÞ¯yƒcH#�nb‚Œ¨jŒJŠ
±â®9t4ò†ÑÜê?˜�å‹K4î'r55ÌUªºÍ}�Ë=S‚e™2ò¨€Ä1£s‰’!×X2LX
ªÞd¼Â4›TÁŒ¤1°o»¢óÉ�öj¿»�ÃÄuºvgtq®AòSFB.ûT˜
+×¼-Ãngúß‚~–å}qØ„¹©ÊóQ‰_ƹ
×!lÒ1lÒC5š‚%púFkõDÞ/­UšáUúÐÔ�W]XÚ äPwåb¾Ž¦^½â`Œç³›š–t¾6�s‹¢-¯)Pîa›¶¡ukßy±ê\”¤]ÆsýÎ*†e—ü”³þ1Éq¨Ÿìˆ#~c’¤fw‡ð°lJŸ¸¡Ø…¡uñ¥¤§"%ó‚S1ç鲟„¨�	(›HIäd̾@Ð ±“SACô: À.`í=�@Ñ(–adŽ1°ø2$­Ê»cÿÕ=Éâvø’l
¤É
+«¥“0<d›‰fD¶Ûò‘=È‚Ã?v6™¤‡ø!ÙØÀÊ
+pâ—Æß΀�C�]QgR:""NÀvÞúÂÒÈÑ“î.ÁÔ3AdÂD�höŸÃQ£å…
+×¼
+HÈYgGÆǜ˩L¡…žhUÂlD1á«°àìó÷·TáÇBÚ5Ýê(܆MÂõ13«KªÄÙ~ÿIh�ø$óˆ?Í—'ÔÐ÷­z©EÀuØ9¨¼ÃŽ�Á_€×€Ñ²¸‹ßzŸ‘ƒHb…„œÈÞŠïOáJÒ¨þ®ã•5º¡´cëp
k0M,Úglõ{ùE*ÊôY
+,[Vm@y¼Í�]â¢×=ñ.
ýbºšŠ[V’tþ‚ê/\ŠãÀ«”|a!(wI˜\�…ºÿ«dê\‘‘÷¯Sâš)ÇòqäAô\ľ‡™qRâSÆÃ]Y¼l¬¯æœ1ŒS›Ã2îÓ¨~…7�÷;•ÕÛ 
+ÜôvöÕ-?ºdz–�Z¾ƒŠgèX3»/è`¬�Ü€4q¹­jH¾úX{ã÷4wšvÙHì–VÐõ
o§‘{ƒ�²Ÿ¡+–ÔÊ°NN)𰯺pc7±¯z¡¨…F}ÝCê«É¥ù¦�1³÷âhùµÀûUèh‹
¸ž&˜Þ˜âL¯,8¾ÛW_¼ÃÁŒ~èÂ"‹¡	>Å^v"@=òšõq#Ò�Íobñnî+^F¥-Ï©¢› è!^üÿX;DÔ9Aú?,.àó?üÑÀ�;ü…iiz³j€gë-­Äû›õêuê¾=Ûà/›Á%Âýóõ¹>¶]¥Lu]XO£oþ—Š¡Ñ¦BÅ™’±™²
 endobj
 1126 0 obj <<
 /Type /Page
@@ -4028,135 +4012,137 @@ endobj
 /Resources 1125 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1093 0 R
-/Annots [ 1129 0 R 1130 0 R 1135 0 R 1136 0 R ]
+/Annots [ 1129 0 R 1130 0 R ]
 >> endobj
 1129 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [55.6967 676.8938 256.3816 688.9534]
+/Rect [55.6967 576.4843 256.3816 588.5439]
 /Subtype /Link
 /A << /S /GoTo /D (rndc) >>
 >> endobj
 1130 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [268.5158 676.8938 332.4306 688.9534]
+/Rect [268.5158 576.4843 332.4306 588.5439]
 /Subtype /Link
 /A << /S /GoTo /D (admin_tools) >>
 >> endobj
-1135 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [378.2799 73.4705 428.5017 85.5301]
-/Subtype /Link
-/A << /S /GoTo /D (tsig) >>
->> endobj
-1136 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [112.234 62.1828 168.4527 73.5749]
-/Subtype /Link
-/A << /S /GoTo /D (controls_statement_definition_and_usage) >>
->> endobj
 1128 0 obj <<
 /D [1126 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 294 0 obj <<
-/D [1126 0 R /XYZ 56.6929 403.8784 null]
+/D [1126 0 R /XYZ 56.6929 311.2132 null]
 >> endobj
 1131 0 obj <<
-/D [1126 0 R /XYZ 56.6929 377.7405 null]
+/D [1126 0 R /XYZ 56.6929 286.8682 null]
 >> endobj
 298 0 obj <<
-/D [1126 0 R /XYZ 56.6929 339.6466 null]
+/D [1126 0 R /XYZ 56.6929 252.8569 null]
 >> endobj
 1132 0 obj <<
-/D [1126 0 R /XYZ 56.6929 308.8302 null]
+/D [1126 0 R /XYZ 56.6929 223.8335 null]
 >> endobj
 302 0 obj <<
-/D [1126 0 R /XYZ 56.6929 236.1221 null]
+/D [1126 0 R /XYZ 56.6929 155.208 null]
 >> endobj
 1133 0 obj <<
-/D [1126 0 R /XYZ 56.6929 207.0192 null]
->> endobj
-306 0 obj <<
-/D [1126 0 R /XYZ 56.6929 125.1654 null]
->> endobj
-1134 0 obj <<
-/D [1126 0 R /XYZ 56.6929 93.2531 null]
+/D [1126 0 R /XYZ 56.6929 127.8981 null]
 >> endobj
 1125 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F14 685 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1140 0 obj <<
-/Length 2602      
+1137 0 obj <<
+/Length 2663      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sÛ6òÝ¿B�ôLˆâƒàÇå)M�œ{WçÎqçÒL†– ‰S‰TEÊ:_¯ÿýv±
-Olxwý÷+½¿}óÓOon/?ßýxqu×Ë2”Wp…‚üvñé3Ÿ-@ì/8SE®gG˜p&ŠBζ‰VL'JyÈæâãÅ?{‚ƒU»5¤?­r¦s™(UH�º`©‚%TàÝÚ €*¨"g™à9ÐGœ_Í£ÃQcœ4Êá´]Ù™­©;ÐO¢yYÓ ™Ï{–n­ƒ#a £®ÙdcÌÆá/GH@©©á\®û²«G!‡Ð8òUÝV+2)®™–™ê¡2Ç€T..ãz*Ø…,tô7óØÒ	ãîY¬ÒŒqÍÁ|…`…ÖÒnDk³
-´{Zܯf4¸8J�7œ;Ê9]d⣙;´¡F²äŒ
¢%€>$æ®=Ös\œQsªÄÂöÐv4²ÿs2;˜–n™\	Öß``��‘Æ3År.Aá’3ÎÁòGQAOíÌ}l£#H	ñ'Mg™°,'/	€’yž‡Ã_ÜSŒ‡$­²Æ¬IÍ’B'§“‘Åjò"gX$Å+4i
žÑ60’YôkÝk–-ý“q
D†AÕåÖØ�2ªRI+‹f[Vn?bÑèPW¿Ìæ‘f¦ê®Z>VõŠ6�BDÖ5etݘ\÷žº¶½>
v(„ûË×.Qi^x÷3û³y)Xƒ��ànãEˆyÙ‡†ý¥È#2¶Ž4Pž¢wëÒAÜ©m†QöU«>p«ní÷V.HyYõç‘R}ˆ[,ˆ—ÖáoËn¾vÁDOeáuEĦ"–óŒXÉóxƒÛq0bFU=o¶te€3Ö×僡µ{cj‚õÂÀØ	ë%
Èš``Yì);Qó¬·²¬k³jö@`ëç5Ý?_|kæÄXÇüòón
i¦¼[÷'�9w
-.
-†“Bù
-›°MK0¿Á@éRu�ß•pPðع«@,Q¯&pÕ,UÑ
ÜÕÂí;ìv;s¹Oc(иàb|këm9�·�(ÉX.yÖ«s’ît_7XJíº
RPIB鬞#•OHI™ˆ¥ˆ«’?Ë—Ôé“ÄôŸ%¦ò g�5Ó¾,u~2!'`˜%zBOù$=	ï>^¿‡Ø,ÀH±/Y ƒ*•�ÃÊÐb0šKÝ]âFÙ
-§`ÿf+¶b
eP%§ç< íL°LùÚô–@n~"j¥�ÇÒ>CAà3Ý4d)‘²
-æT*DEñÍ!ËŒ‡ÏC–Ó…ÈOSµ
(Xg:׃°…š¥›-Ä ¨»…ÆÝ„[wuþànÜV>LÖV%T{ÊÆÜáí¢“ØºÐ�…"�ç�”S%„ÿ®à,[§	MäÅ…G$Y_wôÇ,ѤɸÌèP¬ áy. 9E›fµrÍ£�ƒb_Úûr»-÷
ÃÂä–�#ç¤ÞžH
-·ò
-XVø0Jû‰0æë²®ñÕ9˜|¡Šm@Àí¹6¾FiYmú®ÄäŽ#K÷âÕc t8T-†–f'‚Þoqü_ú;Ô›j[Ù›p¸‚FŸCŽêè·ÕÌÙ2ÝpgÎ�Ú>¶ Ïáø˲œWH‡¡cý®naöû¯ Ô‡Íæ$Çë!ḃÄ`1‡öŠšÃâêf¤$8µ«íXîëÞüé
ì4„g»p3)ž—ÍhÛÂÜ!Ç•ëW�.G¨�pýÕ|(âPã¡ãÉøMc^
-ðÔUÞ'ž£2µ("öÇxËígϹ£ËMg¾ûztYO®3ƾ‘{¤@[C�æ�×O„A�IA&}üqðzÜW§D¶nË•	ä•I€·úð} 2Ÿ|<Á$%UqÞ¶‰•ÊM:z{!Ô¾spñhÛr8z(÷•A›Ä	Ö%ˆÕm�»Žâ"Nl
-6Ÿ!.Ý!‚Ü2K°Jо•ÛPÓÞP›øÒÑýsñ ŒË˜ÎòI¼Þ­÷%½q1	¶Í¼¹[ê4‡nwèhmkºu³h_ћߖn¥—ȶì•©a\Ù�'刯zöR‘¥¸o$(Þ¿¡…o÷Ù:Á�è	-NÝ�‰[»¨k	”U0®}åÜ»dàQÆÜ«´×�v•	V
fcæÎn×Í‘xùÍÁó
hÓ¸	U¨¨Ä-Ùקb˜<Ã,|˪`Y2~Ù~¨ms%I¢¦‰•G‘ô<ÅÊ3¨�’<Ð÷
-9‰s.:ØÞì0-tù×îíèÙtïÏå$¬üÒwŸÆý›T²ôÔËŠW϶ù-!bj7ˆIþ]k»€¶H9&ôMWÁm*ú¤Ãûþù{ïécx–›ç2ümHñ”å²È<S(¢Ê¦œ÷†ÏYÿ�~þØendstream
+xÚ¥]sÜ6îÝ¿b噈å‡(Š—§4urî]“«ãÎ=¤™Œ¼K{5ÕJÛ•6;¾öþ{A‚ÔJ+ú£ãñ  
+É`=÷Xðîòß½¿zóÓOo®Î¿\ÿxvq=è2Ö—QaùýìóºX�Ú?žQ"t!P´æ‹ÍY&‘™
SŸ}:ûy`8šuKcö“¢ ²à*b@ÎŒ-%ŸXPj’.œ­Ò€RšüfîQ½O}Ù›�izþ`~¥”7U_µ
bÊf…À/]yg¬`31:-ºHyFtÆ2·Ëõ:±§$ϸbKcwŸ3©¬
Mw쑬P0Óá°ÄŸn]îÎY‘˜•›%Žý*§¦nÛûÎ p¨ú5Bן.ß#ô+•´3æô¬3ªHÎAH%2’kª­Õqrw·@àjtL}:^€Ç4VxÎ×*þÉ,ÑúV"8å™4Rða=‘fæ*ÕS2̸YÀvë×ÞnËv³±>
R-R¡()—‹tp>X½\—Mcjt›lÊ2§�«…âœ(!Õ6èÓñ‚¹>s¾›bòà$›É£Á<tÌ~fÕ�ê))fÜ‚U	Ž1JT.¬áÑ‚«Gb‡D1Z<;@“g,;œfɲlh—ËýÁÒϹsåT&}»ELm¾¹³³ô·"àÔ66ïö»ÒÛ�S{‚Ö³¯š®Zy\ÑIPI$WA©o•9Ä2äVEå©V�º¹–É¿Ì}‡;¬Lêý1Wü-›ú#f›Æ„•AßU�K§œÉ×�Y¼Cîhr
+NÕ�¬æ,%Qr¨'x¡°+xìÁëV<Ū8aÅya–[Z‘ý]¹¸Ìd&ÿ.3QD%ƒ[3ÊR''ì€*“'ü$ãò™Ð?Ü8É>
%Ü BÓH{ŒÍæœ&×çšBÞ€ax¼¥3HÝÚ:—"ñ/Kœðn„t"¹¹Gt¹ÝB‘†ÙÐþr	¤¦j³ß Q³ßܸ®¢–Ç]
ÏWǶrùæ·ˆO§yÅ?¯–… €“C»¨²ÃˆÿÊÞV,1äŽDŒ­¡>f‚ŸzhZЈµƒ·K¨
ÁnÜÍd­î±|¸¡ ñ™þ4e	–“
+fxã®sö┦cŽó”%ÀÁ¤fÅqc¼E]ŠVÄJr”¶¬eñd5›tÜDëOÂÏû:t6~)_ÎW9È#\ΟîÐoq[ÛB÷NJ±²¿¾à,;“æÜ‹«@ˆ:’¡î5ˆÀ¥à½¯T¦†Ö�ö­¡º½»ó=k½ß•ðúßEë¤40É�ãNßPÒN"ó3RƒÑà+Vl#^üÙk‰n«Ú“oK{¹[ȱ°k¹ Ú¶é&kýæPat�:†¸µðŸø³oêjS¹“ð´¡/±Àóïªÿ™7ÝxeUÎïÚÝw`Ï1üõ¶\V5\‡±üVõ+³ÛÅäú3èW×G=^�å`QCuÆc°é`¨%!¯Ö#Á®íÔl‡r×Þvoa¥	(»·O7'Åóm;Y¶27{ÏÈKåûhË	é=µ«8¶øt»É‰m!núÔÞ±^Ý{ã$èÖ´¯£gÏ眦†{	§¾
+1ñ—S�BÿÿŒ�¦z‡ÑóÂq»¯'‡õà<!ä…Ò[¸tšhxXOƒYN÷OT›}F|I›\<Þ&§B…Ë'H½¤¸Ð,Ò*jԤ÷—ÅbÇ\؇�mËYè[¹«ŒõI;°u‰¥”vÈm�yÑ°ƒ.üÜÒâZ”BªÌV	RÙ·rkúIM 6	¥cHúsõ ŒSDªâ$_o×»߸öìÚezwØ3h÷ývßãÜÆôëvÕ½Â7'¾)ýÌ ‘k3¸#ã¼fG.Ÿx’ƒ}�ೋ,AC#AÐá
ÍB»ÏÕ	Â'4;vNÜÕ¿@}K(b,M¨•ó’‘G	<‹`ÒÁBÒW&¶
+0µYz¿]·ìá·{_H,k°¦ñ¬P­;ëÉ¡Ö8ÃfZVš¨lÚ°úظæJ–%mS-ƒb#d~ÄËÔGYé{
+СBxñGýã<d |Qðø×AsRp­‚PVq¡N%¾þÏEÿ(^Øendstream
 endobj
-1139 0 obj <<
+1136 0 obj <<
 /Type /Page
-/Contents 1140 0 R
-/Resources 1138 0 R
+/Contents 1137 0 R
+/Resources 1135 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1145 0 R
-/Annots [ 1142 0 R ]
+/Annots [ 1140 0 R 1141 0 R 1142 0 R ]
+>> endobj
+1140 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [406.6264 730.8852 456.8481 742.9449]
+/Subtype /Link
+/A << /S /GoTo /D (tsig) >>
+>> endobj
+1141 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [140.5805 719.5976 196.7992 730.9897]
+/Subtype /Link
+/A << /S /GoTo /D (controls_statement_definition_and_usage) >>
 >> endobj
 1142 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [103.6195 731.9163 159.8382 743.9759]
+/Rect [103.6195 677.087 159.8382 689.1466]
 /Subtype /Link
 /A << /S /GoTo /D (controls_statement_definition_and_usage) >>
 >> endobj
-1141 0 obj <<
-/D [1139 0 R /XYZ 85.0394 794.5015 null]
+1138 0 obj <<
+/D [1136 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+306 0 obj <<
+/D [1136 0 R /XYZ 85.0394 769.5949 null]
+>> endobj
+1139 0 obj <<
+/D [1136 0 R /XYZ 85.0394 749.4437 null]
 >> endobj
 310 0 obj <<
-/D [1139 0 R /XYZ 85.0394 589.1911 null]
+/D [1136 0 R /XYZ 85.0394 543.6821 null]
 >> endobj
 1143 0 obj <<
-/D [1139 0 R /XYZ 85.0394 558.8491 null]
+/D [1136 0 R /XYZ 85.0394 516.3776 null]
 >> endobj
 314 0 obj <<
-/D [1139 0 R /XYZ 85.0394 294.8462 null]
+/D [1136 0 R /XYZ 85.0394 259.6272 null]
 >> endobj
 1144 0 obj <<
-/D [1139 0 R /XYZ 85.0394 261.6947 null]
+/D [1136 0 R /XYZ 85.0394 229.5133 null]
 >> endobj
-1138 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F39 863 0 R >>
+1135 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F53 962 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1148 0 obj <<
-/Length 4109      
-/Filter /FlateDecode
->>
-stream
-xÚ­]sã¶ñÝ¿ÂÓ—È3'?zO—Ô—\Ú\Ò«ûÐI2J¢$ö(R)ëœNÿ{w±�”!Ûio<‚X,ö{!y-àO^›$Jr•_§y!Íõrw%®7Ð÷Í•ä1s7h>õÕÝÕ—ouz�Gy¢’ë»õh®,Y&¯ïV?Í’HE70ƒ˜}ýÃû·ï¾ùû‡77i<»{÷Ãû›¹2bööÝ_n©õ͇7ßÿæÃÍ\fFξþöÍ�w·¨+á9¾z÷þOÉéqaÒ·oo?ܾÿúöæ—»ï®nïü^Æû•BãFþuõÓ/âzÛþîJD:ÏÌõ	^D$ó\]ï®b£#kí õÕß®þê'õÚOƒô“"R:Q
*" É£D+í	ßK ‹bv·-i‹ËmÑ4eM/?nEWâfaJ=šR\ÏÌà&{Sóu»¡F{ì÷ÇžÚ›¶ì¨Õ·ÜÛðjí�ž;hÈlÆKÅãã—I*p׸ã×�Ò&&ãq¯iâ‡öÈû*^ªøÈ‹�ƒ4ŒÎšñÜ–»é?Ï©hú¿~Ê#i€!¡eÈ�ßÞ—œ.IG´L’ÙªüYÕT}Õ6Ô½;v=õUͲ>®Jn|×WM1_Öű+©³ß=A»â¡#Øi[Þž»ìºbc鎃ʺ\öå�œ­°ny|a7*e”#ÇT†1™�ó£gÏOD0Kf¸�º|/y<í3³}qè«å±.ôÞ=tÄÐ^˪®ú‡)åììóÞ²!~Ðͪ°L±¢åʃ}kÝŒ=qL±ã)\GÁœd_VU·äYÊ{,Íì]O"GL¶®ìÖÛ=’¼¨k<D
ÇQwˆœÎfuµ«zž
-ò±w§Qª�*òÀ±Ü̵LvÃ<?|zFÆ—"€HI”ņWkŠl< É"ÊsíŸoʦ<–Fv±jÇ+
--¸ŽÏÞ¬¥½´ +I;;=»âÞ-\Ë-kõ€JÔE´–­Ýƒ2Yùãà¤ãœl½†¢Häœ$‰b¡çøý=æ`ó$IRh
!Îê�Å¥ˆéQBR«ÊšÀz¹‚i´zNwÆQœj§9ˆ”¸ñd_ lj+P(›ØCg„­E±üxÜSÿp^ØÓ®JØîAPÀÏK‰4™²š2�*^ÐÙ$¹WØ:áNmÏ קéì­UÔ
-ô>Vìag«Vû¢ÿœy#x™²Äœs
-öˆGÔ0‡–’½­kbe“Iø„èay¨¼hïùŽ®•

-àÑ”'jÀF%M«@ä7Çõ`n˜©¬ó2¬¬˜Uáû6Ä)ˤ™y‘ãªr%'E
-£ii…];^wUôGà
-ò`ÀG*µéúõƺâ[_ŒøSpðã<~–`*ÿÉÅZ»‚ç܃Äa|+’ÙŸ›öÄPN‡W%GÚŸ2=®b'í%ècyhÂIAq€MÓ‘’Ò!'we»@V“T½t–]QÕa­{t/NâøoU€ªíÈz&*{)2Ålÿ%d^¼¥‹‡«²˜(}é<õ>H_=¹¡yÌ*Ð×™0+¸!…	j!ÍÅS(™Œ€ãÛãq¹Í¢¢$‹³çfqnÃò<,àœ\™—¢‚g*ï>tê9úñKgZ÷ûKtò¥“Ôí²¨CQ´L„ú]óÈÿ}3žG}&|ôgš'þLû2Ÿ	Ÿ$4Vf}Êê¢?'>}k§J_€Ò\%óÛ6b£ÐI`®/ÖSKÎéê-r¢ém‡�7à¥;î÷í�s
rFÆÕŒ	b,�Q†Ã­Á´Ù­gßRŽÿ¼²
æÊäƒëö”}Ïü9ùk€Å^Ռ޸V$}­ˆË
-[@Ŧ?Òõ|ß*NR4p¼:/å,½Cy¼ãfkkòÒU'ãIuÒø^TæÔTØ�ÇEÿxdñ�W0ttÁ¡Ë<ZÈHŠL=-Ńϧ]ˆ…L.†ˆ~q¼Æá¯<,Ž=aG&±†›³ÑÏcp¦„™*“M˜« ÐH³<Ÿl$:‡f>) Á†TìóFU8…¥ã—1S<ŽÏ\FRÓlª‘lb‡-ôÌšLõ›„,NŸ¾j¡y¦=Ë_ôJñŽ«p*¦Z–áRà²éQQ
]0ú+bØýÞ›P�¥Q®³lÊÙ6y,Üý�!
.ƒÀëiÈ)W¶BϦ\½¢ò„M³ö` -�y¾!´wÀ}�
W€á0Äy!Ç0ŽR;F½ÌI˜ÎV>/CÉ`ãT.p¶ÝU~©Àþ8ùÓlYh[¨¢$�ÏÌÅ©=Öll’�õ¶SäSsà2¾œM+«{oVèlwaÛÌû^ö”Œ¯Ëvý
-/X†#©X¥ÁäŸÉGžS~–üK<vùøÎ;&z»ò`«_p_ð—g×?aÐøú'~㯢“ 3Ø$¹“ùÌ?›ÞV
9H§M¨3ÕN6:StÓG�jçjkær“™òèaÛÎ�ae
ë¤ênË[¥#áántp
ðh¯EÁg{z_ÂY¿¢°ÎcPúäü«›7Ã:ô
+/Length 4006      
+/Filter /FlateDecode
+>>
+stream
+xÚ­Û’ã:ñ}¾bŠ2U£«/ìÓr˜=ì�³À2<PŠò$žÄlb‡ØÞì@ñït«[²�Qvfa+–[r«Õê»y-à'¯mš¤…*®³Â$VH{½Ú_‰ë
ô}%yÌÒZNGýêîêouv]$EªÒ뻇	®<y.¯ïÖ]¤‰Jn
+Ö.ÊÝ!z±k7›Ð½¯º®ÜTüéñFæ‹jSºç:꛾üLíêè:Û#R7ôì·¡_µÍOB¨Íp,ûºå^„ì*joZþ¢�}iëê¡v=î°c)eRX«ÜÚVÛ²iª]÷Šv­=ÒQà–ܬ™j‚2éµ~àp.lü¤”Á‰@2‹	ceª€³9l’›v¹¡13æ{ºhˆCDDh½Ø>•Sv¨V5®¾Z'ŒKNp-ef’Ôj{½Ô&)t®ƒ.€(H�p!ÄâÎSÍl —?l�eWEÞ)›dFäÙ›
+ßQ²$¹—uÝ­jÇÒH»x×B”ˆÙÒÉI�Ž�)ÃMÔ°»‰ÓùbWï란D'À˜Ïí*Ø{\
‡·�§zÇ°{þ¨\­ªC_­©ÿþñl‚q'
+&§Yÿ¢ezÇ­Â7Þ*lz“†›4ÉužÎ902Í>ˆ¦íç6nÔi4#Í#26	71wÛ*Æ't»Âo]3€Ø<e“’I–zO27E:ŒyÍŽàÎM#pb$
+š!FpÅÙ‚ÄåAJ¡^ȹùŠ€MÚº§h!'J‘lñ¼x@˜[ù�©ÏQ�!0ø”¿Ü öÍIŽ�JÄòG
f§
+¯>¶ x	>ª.|ô��ÃþÞe2ÐvŽž~B\hÒ;GcÌ\ºÈý”]ý¯˜C¿ŸÚ =!µœµ”º®]Õw"}§}ë$2J9á-Ælˆìa!+ÎÂÒ}!Î¢²–£HôÙ.í€ÖšsdË&a¥£—ƒîûŠ±¤ÞR8põyUUëîìúY×+^BÎ$(ÐÙâ}K#¼ÀöÔ£�»ÑYàõ2jÝs&Í1òëþrÍäsÝõLï¤Z0®g¨»ì>V`eë^ûbüœ'xYòÔžK
+÷Ür/i4†¦¯ùË®Ýso;ôËöayO\À¾Â«îöôJ”í�»pdüÇ›P¢)ì.Íèi!a¦1ç%£`Ù}%ñs½öÞ€‘q•“êê¬tp_mËOu¨_*$x9Í��A;/YNmiÔRÞR,Mã®[�áˆdi’AŽõ¬)•…ñƒBttn’µÍô‹´Ù\êº_F¡¥ÌRØ“ÏײìT ïù;çŸÁÿí8¤tRàÙËl?jdúŠÑÕÏ4š|Óô ýÀ–û×19ë¦_RÆŠã«îu̯Ҹ±„5»Œ’ûŸ×ñ
+½†(H+ùe'ióPúà"mÄe€c)ä…:“šÔ™Ô¼ô�
+œôÂܽ«¹C#ÙôG‹w)†=רÇhÎNò÷Ši.0ƒ¹t•X
+ŒufÖ
Â�˜Á³�âK$ÙDJãåvV‡•¤¹ÉŸÃâÆÕ1ºY 9…²/%÷
+Lާخ{˜—bzè—ø,äK‘ìÚU¹‹eÑ
+D0ê«ðÈÿ��âQ߈ý�ð˜o´.û�èIcxðh6”¬.Æ#&
å[‡*{
IK•j¬o»Œ�R'�µ>sæ–¹Â!ýy‹œYz×ò
xé†Ã¡=r­A.ȹ†�±@ŒG`”�ápç0]5DëÅo¨Æ~²
îÊcèö%ÿž‡rñæ
+›Î®`\`qŠ·ƒ‚ßÇ‚�ƒg¢x|ÕÑ×…#ÈH©8Eä9ßòéMg¥žè×QoN)¹Þƒ98l¦-^X÷QR{;Žy#Í+í’@•]œÚãGÏ]ý1"!+~a ðóŽÐãmðxíÑ|{5V쨌fÃþº
+Ë#Áø‹ñ7\í�žT�Â>º…d½P›i�n¬áÐávj’"ËõyÁçXÖ›-ή
+’x¢ ëI�@`Œè¶	Û:Ú 5tŒÿIèš'2Ͼ2¸r•½øq´=0…×DUL6>qF(?wUÙqÓe¸ÚgÉ
+MÄ
+Ëé×xÃ2žI•E‹¶˜DNÅYñ/
ÔÓ;[TØbìíª£;ý‚ø9y~ݺ˜_·.&÷?1HÐ9,’ÂÉbžMïN
9I†uf ÈGçŠnú(0í|ÚšûÚd®yØv¸s<YÀó2õwÇ[9•#ááotðàà®EÁgz_Á^¿¢´.PP…âüŒ
+g›7ã<ô˜Ü€_FO$`’Kÿ7Ð6Á?	Dþ ÂÍóÿû¿ã5L–€áQñ¿(Œ¥Á&z¢�x�?¡Üÿiá)éÿ—±hendstream
 endobj
 1147 0 obj <<
 /Type /Page
@@ -4169,33 +4155,31 @@ endobj
 /D [1147 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 318 0 obj <<
-/D [1147 0 R /XYZ 56.6929 769.5949 null]
+/D [1147 0 R /XYZ 56.6929 728.4063 null]
 >> endobj
 1150 0 obj <<
-/D [1147 0 R /XYZ 56.6929 752.0323 null]
+/D [1147 0 R /XYZ 56.6929 705.2957 null]
 >> endobj
 1146 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1153 0 obj <<
-/Length 2579      
+/Length 2604      
 /Filter /FlateDecode
 >>
 stream
-xÚÅËrÛFò®¯`ùb¨J„ç�ÇÀ>9Žd+µq²ŠrJR.’¨

-îoúHà»ë›ë»ë�ï®/—\ÅÎ{ÃÜÜþãšVïïÞþøãÛ»Ë?¾y™òË™DFþ¼øí¶(�í.X(3/öðÁBžeb±½ˆbÆ‘”R_ürñÏñÂÉ®9ê“_,U+‘z(¸O€q&RH#À®)d)†./42ÇääX…‰ÈbxñA@R&ÁýFÓ©uÝ>ä5­Ký°[ãRµþ¬-´ÈZ<hÚëõ`_lé÷?º»ä*h¯à3áAÞ”„hî[W͚жmiv]£KZ·+<»2gYðp hw©‚]ÓàYâh*©TELY–Œ
-ú
¶€´®—œóàŠ`«¶£…þw¾}¬õk¹Ì&"g@(ø”¤†Ð‚¨¹\&Ì‘PŸÌ;Ÿ¬
âÎ
¯B†?Õî
-ø$¤«¶}ñÆ`2‡CQf$ÖàY.p)	}é½ù¯7“�›%ãÊàì+´	Ág�^�‹‰ÙÈQø´¶n~-g¸”v§#쌌 ys ÅPmµ]mìÂÙž¨,>äÙóÜ8¨G¦I@V³ÎÍoy|	¨šÉŒ¸§Ç”#„TÑìrØ2|€]¥`G»Â�}5l<ž+Ê.uÁ¨<4ù¶*|AK†œK‹vT^½ë53RèÄ
±þeO{G¢¥Ó7‚�à

-Á‹T�O��9�î¶U£É ÷£›L¢
-cä.Ž¿�úm~˜>2	/Ž
 Ô’(TIÍ•’{ÈI!½&Ž˜þÐá¾@ÏC%™E³AçʦµÝ@éª2JMÁÀvy]øØä+¸×W͘I¦dðR’YýJBòºoé^#Æžž$�
Ðê,v‰@(h“¥߲xÄB¨BÒ™v
-¸gÝv=I¦‰t™$@y4J€&æQ”âÇŸ;ݺDá)î,
¢Q�ÆÁøšùÂ�‡¿ã¶u :d
Àv›�ÖÆÚáw¯kŒ2R%ÁMÕݸ¬£DPùä #*ŒèS9ŒqÄ#‡(L¹šÈ�ˆoì†M
‹÷K.¦¡
-¾\¸�¥	ýœ1G9à‡M#°z°ç€Ë(£jÍã‰2¥H¢�ÞDµìX
->´{ƒ‰èT>-Ãa+*:)#,¶L£º/ºêa7§-(O±_Ñ"f"dèÞÐÒf·^ÐânÒ=ŽøËé
ê§b8¿	üEht®ÿ)BqJ¤æPbÅ;}á¬�±ž!äü6j¾<Îc )Ñ=ƒÕã'›qŸë¦he®·móì^¢á¿ze»�
WX݈9„–s<FOðš~9�îžU^TµÍ6 �9ªðô%U³jϨi›úpJÄ“v~ÌG�˜Q“»Ã¶Õ´m¦yÂÀ_cE"Œ¾,õI+å:?mÑŒ“†c^ §P­9ÝKz.øÛqú<Ÿ&ƒ˜ëÚî_Ƨ
½U†nK ÓNÇýØ�¬È5�}Õê�|™è€
-(/}IaTÛêŒá§ž®V'Ô»–fJ@?äݠ˧î1m×ü¦—ËÕKK“É/¡×½}2uggŠ£¶‡ê—ýój*v]§›á¬!§ŠÉkœÂkœò‰�0QâS!Á !—é™9ö'�€n|vÂðÿ÷ä¯V³«g3ž†™ÄYäl‚HÈO6åghûÞQt6£¯õ£^m‹-yÊ¿§ÀI{�£kÊPô-#™ÌÕ%ÞÉt4®pÉÿ4õJ]
-p�H�ÅïPâyxå‘UÆÝÌi¹ó0é4D(æ"s%4~[jêࣦ™XÛtBP£:øÅih£VÎC‡ùßÅØ=#óTdÎeG�N^+¬D¨�D’ÐtI°)ô\D󘓯íí$pX Äs�„ãXñÙ,.N�ÿÑÈg7vžcMC�Þä×Ûï¯h5þÄ´ÖfÐsüÇ‹ó0SŸFÜÅèpXGyf,#•¥ßD¾v™¢Âª
-v�V|\	…º¯³#ï;·‰¦ÿ¨1ß4³±ÆÚ¶ÈI*í@%Gè;6Ã
©αÌÞ¡ÝÑ¢ÑÚ¾c¤	¿Eþ8ìÆÖ0•6iàÉËŒiØñŠí®¦ôÙëhÿWk7©öοM,ñ{$5¡2–ë¯u¨˜='fΘõîc¤°‘e
-e$³SÊÇŽž“þ7½6Òóendstream
+xÚÅ]sÛ6òÝ¿B“—Ð3B
+òûÅ/¿…‹Äþþ"d2Sñb!ãY&Û‹(–,Ž¤t�úâç‹Œ'³f©O±T,V"õ(PHŸãŒ%¦P�÷
e<èu÷Uw8ƒ"o,p÷øX¨ÿtÓW_-~©vëuÕ¬é³jVm·Í‡ªm}¿Ñ–H5ØÿžfªÆC!¶m©Aý‘ÁÍŠ0†SæÀ¯{T:H¾äœeq,Œëº}Èk@V	ÑÅaÔú«¶P³;ü¯»K®�FXÀ6FZ˜ú·6síÜ4ÆÝB™r
+xÈ)Mì«ú’5}<hšÎ‹
´„¢ðÌêf½&GSäÐ#Y¯A}Y®€¡Ç°Õ�`ý�wƒá¿P]@
ÌÎ'fç\0!e„‘^“ouiѦÞ!ÁcãŒ[,§p$»‡�iÛq™MV¦!S2v+—>â<f\„±Eù5eny^µuÝî�£™\9ý=¶}5�ïªôÔ
|�€‘¤ŒƒÖ2éVv—*Ø5
êä\K!“‘’NÅDº¦,ðXgÁÐå…öðE,
—°ü3Ü:±¦…U£iaìL«Ñ´
+S@õ�º¨VúÈ'0ðxQÐ÷è 0¬uÕp¸äœ£?#l…�ýG¾}¬õ;Ï�Ã
90JRÃhAÜ\.“бP_Ì>_¬âÌŒ¬B²ŒŸZwrÒ«UÛ¾z?�CÜFˬÁ³RàPúÒKùÏ÷—
Ê2daÈ•Á� 
+,B	Ö&ÖÅ³Ô GåÓøºù·’áPÚ™Ž°kp2‚äÍ�CµÕv´±ƒ1ÂÁŠÊâ£CžmÏÍ¡Ãp“&
yÍ:7ÿåq'àÊ»i3%Ç!U4#SFð«|àèW8câîùÉ!ê.uÁ¨<@D¯
+_Ð’Œs9tg>$½ë513r8Ï°fîÈ´töF°S<@!x‘éq+Œï§HwÛªÑäÐûñ˜L¢
+�¡ mƒ1’.ûã´	O0WBÑ@#
+:8gAäÅD˜þëv½Ö%ó™0Féâø¯s¿ÍÓM&áÅ	€
„‚Z1•ÄÑÜ(¹‡�JÌÄ1Óz`Üè9¤Î$³h6è¼±im7Pº2UVœ‚ƒíòÚTŽ1¦q��Î
+ÎõUSx•R’EýFFòºo‰®QcO[’Í
+TâéÌ:ÐY·ÝÁÃO’°4‘.“Ú*nE	HŠ“RÃÄ�ßwºt‰ÊSÜyDâ:�ƒq7ó…!ÿÇi{€h‘u<
+ûßÈr$¸œP¤Œ8oÚ8Kp¹Ã"ñPxÊÁb9Þ}Ž¶Äs= ÓÔ6
 endobj
 1152 0 obj <<
 /Type /Page
@@ -4208,7 +4192,7 @@ endobj
 1155 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [173.6261 500.8708 242.2981 510.2804]
+/Rect [173.6261 465.0053 242.2981 474.4149]
 /Subtype /Link
 /A << /S /GoTo /D (the_category_phrase) >>
 >> endobj
@@ -4216,25 +4200,22 @@ endobj
 /D [1152 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1151 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1159 0 obj <<
-/Length 2502      
+/Length 2725      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZ_sÛ6÷§Ðô%ÔL„#’ /OnjçÜ9;9W÷Ðk;J„,N(RH»ºN¿ûíbAŠ”)É>;3?˜\,Àoÿƒâ#þø(Y{ñHÆ>\Œæ«3wtcθå™4L“.×÷Ó³¿]
-9ŠYzáhºèÈŠ˜E|4MqBæ±1Hp�÷o.¯>üûö|,}gzõñf<ñ×¹¼úç=}¸=¿¾>¿Oxpçý?Î?M/ni(´2¾¿ºù�(1ý; ôöâòâöâæýÅø·é�gÓö,ÝórWàA~?ûå7w”±<s™ˆ£`ô
-쌚©ƒøq—y"ô
-δR.z¾b
rQnzü­vÈ8Áq@1Á6‰m¥´Nî”Ý3Øzï|d
-æ#¸ëü<Ž=§¬ß¤Ä±ó¿npnu~T’ô×ä1ÔÀjû¹�âsoàO³WO°˜»þž�e¹"¦ïºÓ‘üÝ»!'Õ¾Ø8)+%±MÅÿõn¦¾ÕíÔwp¯´ôÀùÅï›ìkÀCà�<¶ê®M�V­CfzN¹Æê8ÁØeñ.¢ŸÚôœìå8­ãq|óxÀ¤ˆ¤�\E
‹=Þ®ÇY
-lC–ç—ÌEa}ëéê�…ÚL0=uC.ÛÇõ
å�9Ö1	ÇÃÈe'*ºþ.·ã¹Rï“,Of9\–Ò«b�:>Ì€¶ ÇTéù&[WYYX®rÑ,œj»V{c”æà
ýa³Jpz;kkW/‹*É
-6ÐuÙa ÚZ%Û&¢X£IS•öíhQWuWÆ®È'j® jÒl¿”çn˜�„X ƒ'ó�·˜tå^1ÿÿÍj6‚µ äê0ï€æ¹ Ë>63ú¢&í¡ ¼ŒaÍ8Úµ
-½ê
-·“°§
P§Ú ‘-�@·=èí6ˆÉÊ>iµ1]£Q­-5tÕËÿ-µgódÞvü°¥ÃzîøZzn"ÊÓE6Ö³-	ÿ¸š½H°
-GMtlï‘`‡úøæqÊОî>SCW‚ÝE[&èW¥9ç´†<ºu‹8~³îæþÜÕæêÕ*1ßå„�}µ—èžàæ–Ã	Âö,âÐ5&`;~5—”‡<Á“L
-ì§Á;S¼`‡
-fºÌ´ýž"Í…¡8t)„0{‡Ò¿y!Å~XšiꀒÐkS³"ÉèK`'Ÿª�)UÞR{7ÛÒÀî«.bfzø›^ã°M[7x—ËcñÜ‹Þ#ž¿s©—yé×�£žÏžŠ£^„?D 8Z¨ê¡Ü|9é÷7–�"(T»¦C9+;{ù–S÷ Qãá	Èx.Ù`¹NÁ/N·[ˆ‰Ù¼¹DÂ9Çàêìã[†ËuYè†'.¸ë3t¿Z“¯uµ`•ñœ$NG^‹’¤&>	Æ%]]ìÿÇ�,5Ÿúßݯ¢|ÉDyÿéñdZ
+xÚÍZKsÛF¾ëW°r1Tebç�Ác}Rl9«ÔZö:Ê!›M¹ r(¢
Há¦òß·{º
HÚk¹Ê¥ƒ€ž™žž¯ßʉ€?91¡&*™DIà!Íd¶:“;ûáLòœi;iÚŸõýÍÙß^ëh’øI¨ÂÉÍ¢Ç+öEËÉÍüW/ô•„÷òíõë«~~qÞÍÕÛëó©2Â{}õÏKzúáýÅ›7ïϧ26Ò{ù�‹w7—ïi(dß_]¿"JBÿ0}ùúòýåõËËóßn~<»¼éÎÒ?¯òûÙ¯¿‰ÉŽýã™ðu›É¼_&‰š¬Î£}hÝRò³ŸÎþÕ1ì�º¥£øIá+ª
+ï?J§Nú6#}'	Ã9½A¼eGSDZ\×YYÐ3ƒ Àì<£ÿ³š¨ žbΈÅnÚ
½’Á
V•[Ÿµ¨}Tbä'ZENŒ·Å–·$	�ý6'šƒþÏ-r*ì�Õ"ò²šè3˜[òó­%,y»Ô¡w³l˜ie°8ôÒ¼¶çÒÛÐ��<›,¯§YÁH´Š&í°É·çRJïù˜Þn†Ž¶…Ø–Vå<[l·V½s»H›œ×äåÝ;ƒðnyêºÌŠº£ÎÀ!ïÊMf+ž—ödío¾Lï»�:€û°pÚ’²é1ÐAüB
+f?2ŒZÇH	/�é¸+‚Ø챸P´µ
�a³,8ädv$@ü±°›)f§~„Àm1`_!CP
¹cãp ŠD‰ã÷ºE°KíøBn„Ôû4ËÓÛê-¦ŠœáªPx¸Ú‚続m2Wªò¬r1`eøvm÷Æ(ËÁúÃf•r¥K«¶¼{YÔiVøc
+.Y‰®È4m�h‚Ž9/ÂJœ@›vS€B¶4½ö±;¼ÓâR ½ºéÝ}Tõ iü·,ìž
ÌÒY×ïƒHGÔ¼Ã充ܚ觳l!8¬eû"�§ãj¤F‘áb•KËSj¾X¯é‚é>Í÷PœÛ"k‰.ßw9õ÷ÆVuuÖžÀ_Â>®êIqU¡/µ9‘$`‘â+å6›œÄõå~ÚÙ]×ñ5Sº©ºŽ©Ãœ•1çƒÁ#÷D*„¿FòÊWÊœJ>PvGaDa}c«2¿ïîí#üêú§ó©�²”lV5ˆôsüÜyU3[â0]Qã4]�À׊
àoi,/Ë�ͺ¢ñ5e‡Ñ¤ƒEn[�¶ZÅv7_ýd–gÔŒ÷oÓ]tê4ÿ(Ô¹žù Ú{x>mÀzRÇ’‰ðU$ÔqµËDû±	)/aåP§²£šÿwñëMZT°²Ú»Iè§�ö^ˆÕn³û£žÕ—ýŽ]2æý¯a£ÇÀFÈpˆ0ß±~ˆñ¢ø8¸$µüÖÁ
C_›äD•!Ђ�.÷öŸT2#T×oo®^ÿ2úu9+ó#Øõ„ú–±3�ˆàDR•pª$‘œT]°<‰Ý»An‹·ŸS£ôå|*8
T
+‘‰?ƒe»â œ
+*ñebøv\ôIÙRnÞš"½Í-ÏäÎln¡ª_eEK^òƒëæƲ'jKljûš©A_T�ð°Ì0]#­î}½Â‘´":ö÷Hp‡Cý�|óˆ±ùt÷™}»TP8…í‡\hX#{´=º�š$þn£ßŸäî¨JC kV«Ô}—Óý´à[t¥¥»æpU‚æ®EºÇ”Ä�Æ»½¥<ä	
+*$
µýÞw¼4Åv(anð9}O‰Ü�¡>t©5}¡×:€Ú¿y!…?,iú�””^Û¢IN_[ù9~˜†Zå95x·[Ø}õÁM˜a6jUç°mc7x—€Rásoz{~Ï¥¾ÌK¿j�ز>FãÐW¡ (ZØú¡Ü|<éõ×<�›`©A9){’|Ãy'~$ãQ€
+y!B�xôS±öW[<«'úÿ
 endobj
 1158 0 obj <<
 /Type /Page
@@ -4247,40 +4228,35 @@ endobj
 /D [1158 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 322 0 obj <<
-/D [1158 0 R /XYZ 56.6929 729.6823 null]
+/D [1158 0 R /XYZ 56.6929 687.8392 null]
 >> endobj
 1156 0 obj <<
-/D [1158 0 R /XYZ 56.6929 704.9004 null]
+/D [1158 0 R /XYZ 56.6929 663.0573 null]
 >> endobj
 1161 0 obj <<
-/D [1158 0 R /XYZ 56.6929 387.929 null]
+/D [1158 0 R /XYZ 56.6929 346.0859 null]
 >> endobj
 1162 0 obj <<
-/D [1158 0 R /XYZ 56.6929 375.9738 null]
+/D [1158 0 R /XYZ 56.6929 334.1307 null]
 >> endobj
 1157 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1165 0 obj <<
-/Length 2770      
+/Length 2655      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]oÛFòÝ¿BÀ=�žî'ÉôÉ�•œ‹ÄéÙ.p@´´’ˆR¤*Rv}‡ûï7³³K‘eÅqt—»³3»ó=#³QÿØ(Qa$R9ŠSªˆ©Ñtu�°÷áŒ9˜±w¡~º;{ó^Ä£4L5×£»yWFIÂFw³/Á»^ür7¹9s:<+?]]_ÒJJûÏ×ï¯>üzsqËàîêó5-ßLÞOn&×ï&çc–(ç¹ÃpäÀû«�š}¸¹øôéâæüëÝÏg“»ö-Ý÷²HàCþ<ûò5ÍàÙ?ŸE¡H5z„�(diÊG«3©D¨¤~¥8»=ûW‹°³k�ñOF,d\‰¼‚…)‹“ãt‰FtÝ”)JïÓ3‡RÅ Íx¨…—
-g©0)ÂD5ŠUjÁ…ËŸ[³ÉM�ì
xÑ�ÆÄJÆ@án×fšÏŸˆ§�K³9gI`èÓã°õ²Ú3šß;€¢Z,Œ[kª‰
Ú1(Å-þ‹æ|Üê&Û4Ûõ?à+
dD5/´Û,
M¦YcÕæÉÝ»÷N-C®™p?þ@
Ú3îàó¢ ÜYQWöŠcñP®úW5ev_àËⱟ³`óD_øN{WüØ–…©ë¡ò8ä’'�>ÁÉ�‚ÄbÉ\µnòª$ÜË¹'ÀaSÒ]Y…i"W²:ËÀߢˆ›Ù Ûï–†Ù[Ðïb'¦lü‰{]mG¸ñ§EpwËW¿Ð³ÙŒŽÔn#+gCôãùXè8(·«{Ð*°b�½Hµ=aw,)œ¸;
-­ƒ2[7-2$‚
-Pë#øÇþ¦Áê·àÉyD¾ãéí õÇÇÐü•­Ö…	§ÕŠ°\]Óx
ÿÑì‡ÛÉÐé.é·o‰hüQv@´4Í1¢c"Ú
("J¬5u½ð+]»�I( ‚‚'."ùœtB�*IBq"ZèÜ)sì™åõ:k¦Ë“áâÒ
’7<¨æ4æ%ÈÒ­²`�Mÿ0Öð`«©Üh&µÙ<XC„ùªšmrãŠÒ�FpÜ…©¬·\õcÒÚnVSðPÎ7J³Ë¥×q~'L¯p/P÷ÜãÂŒu³„Ÿ¦J€H$f	OŸžåõííä�ãhé¼ÀÝíÕ‡›jZœA?ÃÚÎ�_LJk…
-­ÔPúÇY+£0QüTV¥4ÜA¦Úò¬€ð4&õ=�Z}`[*u
-_cä1ÆæÚm´šŒ«¼žV%õÅv“aR`Ã_d#
-ÊD:ßj
-³°âWeñtÚ.[x�$¤Möc,
-xk	=ÌŽˆ©#
"0”ð®ò¦±¤v%‘¿¹í»Ûu·‹A/õ½9ï Û^›ÃD—¶?³pö]�-é���&ñþz ›IDpŸ—³š¦Ä
-œí¿lFcF(Ä9v:�k}Ä/x‹¸ê! Ot<eGŠz¦0ÁÀP{)!eczÏ:³)¶—¹HÛ'¶
-�ªÍ…oœ
-ß:®×P€
Áíú¸w`àdêfsžÛ)IÊ…Çê€j«p¶ÊÊ’º^TPq²Êj³Êvz,úν=ºk¹9È+,‡Rn#VÄœ®ÊVWe_WEà—wÚ)„Ë�q{fæ™-ð†¸�3
-­ÂÚNêÚó¸×’lÝ—Ù£ìbí­ù¬$³!Gºi©ØU³ÉßãØÓÿäyýg2m3uJ~Hb!¸
_ËeBõ„´†œ?dE»nÕV¦Ç*	À©õ.ïù>Òå@ÂyBÞ˜fúfc-ëX‘*ÜÌÇOP¥ø›Š½»bù̸Wf4P ÁY5'3Å<Ý+”mžì½Û2Ç,û s›­×¦œí~?ìzÇŠìg­º_E¹ÎÇËDÎÛß)õ,àÒ$eCœt¤êÖéâê�§±Ô¯¢|DÞ‰jñ~—Ä!­µWè·f9þöZ»7Q‘ž'¿çº8؃å�ö~ŠÌWÛ “ÚÿÔsêá9¸bû0’rïÉ™@Qih×¥øÒûgœµ™€ì7 pÏŸËó%ÿ°d�'­UõÇvMË÷Æõ¾Ž4SIU½â®³ÆÍLáÍ£
-û£HÚ%ýä°ŸzGm=÷ê?XØý5‡Ä~D÷·ƒž‡ñ}w)|µdõ�HB•ðxàêÿ5‘Cendstream
+xÚ­ZmoÛ8þž_aà>œŒ=©")RR÷S¶I{Y´é^’èEfládÉkÉÉå÷ßo†CêÅ–ë¦Ý()r8CÎçá¸lÂ_6KdŠ4šÅiÈ�ÉY¾>gK˜{wÆ,�ïˆü!ÕOwg¯ÞŠx–©âjv÷0à•a’°ÙÝâ“÷æïç¿Ü]ÞÌ}.COs_ªÐûéêú‚FRjÞ|¼~{õî×›óyywW¯iøæòíåÍåõ›Ë¹ÏÉ`=·Ž,x{õþ’zïnÎ?|8¿™¾ûùìò®;Ëð¼,x�?Î>}g8öÏga ÒDΞà#XšòÙú,’"�‘n¤<»=ûGÇp0k–Né/
+YÀ¸3_$A$er\,‰A¬í2¤RîKõ™ˆ�SŒ6‘*¡ÛÙ„³�MX$‚D9‹e(Á…1Ên³ÈZí7:ßm‹ö•ëÄ`¨'–QÂ�þ|³ÙÎYâÕ�YIêͪuº*Ü`ý@-±§¾Y§ÿØé¦m‚}kD`ŽX)>âû#¢$à} ")ƒˆÅü%<Ý’£ÚVa(žÈSÚŽâ@Å1…
+)á8œsϧ
š�^U·¬c–êòâúv$VØ­íM(æ×Ðx½s¶GSV­Æ!ÖÓŲrñ‹\o‘k@+Ò�Ãî”|cŽ“‡^Â_öÙF½†¬ÉCº;ž_Oiééé)ÐÿÎÖ›Ry½&.W×ÔžÃêýp{9µ÷¡èׯIhü2¡•n�	õIèdºÞÂßyµ÷ù‚‹ ý"$8àéVÍ2VAÌ~"[È”\¦©QÏ¢h6Y›¯N¦‹KH·¡à”~¡-*°¥eÞ&Ëÿ¥MàÁT[ÛÖ8&t½}4�ýu½Ø•t�Ølœ�`¹MSÙh¸ç$r¸¡ìÝ8iÍ¡–¾Oóƒäo7ÿ'-	I/Vâ”-l!JÙ²‚“ç§-y}{{ùfXÝÝ^½©±­óº<P,Øùší·üg¡*!ƒDÉ—Dž[q\±<	’4>…©$`D€î‘QY	ÉÉ'ç=
¬Þ1$-™Zwo0o‰3sc':?Æ�uÑäu…)}¹Ûf	LòÍý�D¼®
äN‹‚øŠ+Œç¼~Ô]&)ó¥wöRj Î*ê
,0!lú5µG³H»ªsN'Î
Þ›{ âM]îð@_ð™�5¾Ï½Ó
+ËÁµ„B ³´<FUœ�xÙ1,¡DÒºíëP6‰‹ãf¼cƒâ‡Fø:à3Ž=¾�
+P›RŽÓE©_Opô9ø!KÀh,
TÂØ`çêþ×xºÃ4#?ÿDeÑ´£Ì-0M±ùÝ<ÍÇ'zçÙqüøL_?ÚùoX
uìðÿ~tŸw‰ðX觾÷;jpzÕè€�ζ€y‡§[Ô묨ƒ©ƒ›þÊ=�¤W‹ºµ¶ 7òh�¿g:.ðuÞ9ˆ¤áPG}ñ“!t¡ÑyªÂ†(ð×&[ꯉ­ÉXIƒ¤/n
•$SÁcEpæõ8ˆò�R¹
+ËŸéÞûÅE ÝEÏœŠú®ìŒý,Ïõ²q‰Ÿf”ù˜îê�ªšZ[‹„^aIÕS,6r5 I9#	Žxgê#ÎVÈi`
0x×EÛQû?Nز»)Q‹tRWšstWj³œhÓæ-Î^àk@�Åò!“:',Âý«	0“ﾨ
uIØë¿ ‚6£bμÞ'pl�8âo×#”áIŽ“lEQÉ:˜wCF€ØØ€ßd9V—¹H<S&6�®Í…«›
+W9n6ð×D‚Ý—ôqoÉà’iÚí<ñv9YÊ…ãj‰“«°·ÎªŠŠ^ô â-ØTõv�Yîtt…{³´¯¸Ùœ€FC)7+dÖW£ÎW£±¯
+Ï
÷Þ)„…Ç8½Ð™yà!
i{nF…‰�ÔVçq®Ù]ÿCA�Ñ�³èvmÅgÑè-]¤ÛNêTb[,—®Èñ2ÿgQÚ
uB�¿#±€GÑÄ]Ë£„ž‘	äâ1+»qã¶Qzì!
<•êqÏ·‰®&ð¾T}Zx¥ÛüÕÖDÖ±gD*1—?ÁeD˜âO*fïîw×b¡í)3j(‘`¯~ 0
+Å|ï2'˜ìn·U� û p›m6ºZô?oÇÙ�–ÎDõøe+Á±Ú
á¯ã'œ�,Ò~í�ðýÿPˆðÝ7,¸�LéÞÃvS¨Ÿˆ
 endobj
 1164 0 obj <<
 /Type /Page
@@ -4293,14 +4269,14 @@ endobj
 1169 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [519.8432 252.798 539.579 264.8576]
+/Rect [519.8432 216.1999 539.579 228.2596]
 /Subtype /Link
 /A << /S /GoTo /D (lwresd) >>
 >> endobj
 1170 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [84.0431 240.8428 117.8035 252.9024]
+/Rect [84.0431 204.2448 117.8035 216.3044]
 /Subtype /Link
 /A << /S /GoTo /D (lwresd) >>
 >> endobj
@@ -4308,32 +4284,33 @@ endobj
 /D [1164 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 326 0 obj <<
-/D [1164 0 R /XYZ 85.0394 451.0558 null]
+/D [1164 0 R /XYZ 85.0394 429.0696 null]
 >> endobj
 1167 0 obj <<
-/D [1164 0 R /XYZ 85.0394 423.9067 null]
+/D [1164 0 R /XYZ 85.0394 399.3522 null]
 >> endobj
 330 0 obj <<
-/D [1164 0 R /XYZ 85.0394 301.4703 null]
+/D [1164 0 R /XYZ 85.0394 269.1889 null]
 >> endobj
 1168 0 obj <<
-/D [1164 0 R /XYZ 85.0394 271.3564 null]
+/D [1164 0 R /XYZ 85.0394 236.5067 null]
 >> endobj
 1163 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1173 0 obj <<
-/Length 1216      
+/Length 1372      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥XKsÛ6¾ëWðh€‚o²99Žœ:Ó8­¢œ�"A	c’`ЖÛô¿@Š”Õš’G£Ás?ì~X,°´-$¶å0ˆ�Ø
-cúÈö­¤˜ k-Ç>Nl3´“@Öûùä—7´bN`ͳVQÙÖ<]\Ð�—
]\¹»¹ýømvuzóÛ/w—ÀñÑÅÍíïS]û8»úüùjv	ìÈ·/®»úc>�é¡À`¼¿½û {b]üèlz3�Mﮧ—÷óO“é¼³¥o¯�\eÈ�ÉâY©4ûÓA7Ž|ëI6´ãرŠ‰ç»Ð÷\·íÉ'_'v€½Ñ�èQþl7pŽèØ–mÃØ÷�
ƒ~×q;mW²‚º(0¤æÚʯR�Rþj\¸V&Ë�‰{;ƒ,à†RMï;�@"–¸ º¶¨X-t•VKո׭¿uñùH×À2§ÜüìäpšÖ¯à-ȳ®ÉÊ}nëÚ;3	BhÆþy§m’%�ò"è»N¼§ÉAÓò!§¤‚²R÷à2Õ•o¯I·Ö€?LJ~ä‡þôD·7Q²ìzq Ô<E�Ñ
ç9{ÒՌզO	+ŠVNŒ’,ÓåÀÁt¹"º$˜ÓüY×NŒ+ÓS4¹ UnærѬ¬å9~4£±’pxŒeКÜ
-VfGV	èA«�r»œüz81‚~J–¥
nh{õÍ!”r–ãÂXÅ-Ðm‘œ·Ð3¥£ì|º×XrQÓrmÎÔýµÒv_zøØÇ‚¶õ¿òƒÕ9©åš€¦ýæ’¦ãRZ“D°ÚĆ
-‹ÍRé0ByGÀi⃕w›¶©O—»µY�©a^×G*®¥7ý€¸Üï‚j	<†»'2š“Ó-H›¢/:P¿ …:;2ÎÑ„Ÿ¹|EÓ3%å~7ÒËËõ™Ú¿Yu6ÁEw>¾dõ²d#
-srÆI/9'	 %^ågœ#þˆsšb1–Ác9còÙ™’þeg‘®ŒËdÃêþèxó
-°’!Umô‘ÎÐ'	©„Œ�•|¤gDV?á:=Ì€”Ç<9£u›©TfLüÓÈ]"f²¬Å)™”YF¦JízmÂ4âÖ—!CÆ�ä
è·5Ü?@½!äž½[ËIåÏ\ËË€ q¶÷3F°´j5NŽ}p}¨òø#	<ê¢7.ØKñd^EÎþK@?qpB™ÇDÄ(¥,ñœš·ß^ªþ/#„¹rendstream
+xÚ¥XKsÛ6¾ëWèH€
+#lvqA-h)”‹\‹qõô,ú½e÷$ßÏ‹JÏ‹i¹†QàúGI¶_�\j'Ûz{ÜWTįÊ«üÆU™Nˆˆ<è»Ø12>¤Ã¬K¡•geÂb)”›¤-Ý|!ec(¸%p”›}.
–FyžÝ!±¢-$˜ë[e[li£èÀªR=×ÙÛÍH¤n†èas†C‹æD°{Úo-ˆÞX%)̬ȈÐϪ6O†Ü¼ÍÍZÏGŒº#±ÐSq¦góªúÖÖzzKÓJ£tÆ¡±Qœ’nQqªü¨‰0Í»“ázD„Ô5-šÀ}ì!S%Àñ¡k;î>ͱ#S!$Uä‚6òóððe’7¤(¤˜ç èŽ.{_"jÿ)ꦮ¡IVoÔàV�þÖ�¯ÈCš2
+õ¢ë’
iŒp–?jºåÔ±53…yVçf/íö‰µ<'÷fõGUR>Œ 7ÉĤwp¶gœ]ÕÊ•GÄäÈUO|ºÎ˜A蟦² ëÎ`ŒóB
Å!t=×3Ðk6qP²&"LUQÔ•ˆ‘ŒQ2D�õeZ¦OòR!õmhû~¯�
+»œþ6
	ìA/
+¤—¥
ŽmJËÞ±:	Uñ±©ËuT‚nôŽ{(]L.VÞ™œº�*`†;«¸8Ô‚~ôS~<äç´‘2
K†Ã
KŽ× a
�EÕ˜Ú 
+éFép«¬#à4ö‘îÝ!‚]J›ÓE‹N¶¹�:3:ú$îlX7‡SP#AŽñ~L⌂”åôt’¶¨g²´P¹#ë‹ùñ#Õk–Ì”.Ï»•Q^ÞÍäÿeÕUÙ=ùHù¦j6eu„¤(wÃð9…=¡ê^QݨJ@wL…�ÇYGrÕéè�®;GÈOÉ7
+Ø÷–öIwŠò©lD3p—·ôt¥Ó¼åèn-e9ÏZ‘T3<˜	�' ΙnÕN�…òÔÀ?

 endobj
 1172 0 obj <<
 /Type /Page
@@ -4346,36 +4323,35 @@ endobj
 /D [1172 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 334 0 obj <<
-/D [1172 0 R /XYZ 56.6929 769.5949 null]
+/D [1172 0 R /XYZ 56.6929 716.8068 null]
 >> endobj
 1175 0 obj <<
-/D [1172 0 R /XYZ 56.6929 752.2028 null]
+/D [1172 0 R /XYZ 56.6929 691.8907 null]
 >> endobj
 338 0 obj <<
-/D [1172 0 R /XYZ 56.6929 693.9224 null]
+/D [1172 0 R /XYZ 56.6929 633.7645 null]
 >> endobj
 1176 0 obj <<
-/D [1172 0 R /XYZ 56.6929 663.1642 null]
+/D [1172 0 R /XYZ 56.6929 603.0741 null]
 >> endobj
 342 0 obj <<
-/D [1172 0 R /XYZ 56.6929 628.9495 null]
+/D [1172 0 R /XYZ 56.6929 569.0137 null]
 >> endobj
 1177 0 obj <<
-/D [1172 0 R /XYZ 56.6929 601.0964 null]
+/D [1172 0 R /XYZ 56.6929 541.2283 null]
 >> endobj
 1171 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1180 0 obj <<
-/Length 1186      
+/Length 1187      
 /Filter /FlateDecode
 >>
 stream
-xÚÕYËrÛ6Ýë+¸´:O’˜¬WN�iœVUWªGC“�Ìš"‚’í4ù÷Bâ[¢lR�Ìt¼òž{îÁp
cé?lØ"*˜a	9ÂÜpç=dÌô»=œ}ò�@õ«÷£ÞÏ×Ô2&1�Ñ´‚eCdÛØyã‹«_/
†}@8º0ap]¼¿¹ý%íéÏÕçÛë›
/û»Ý|¾M»‡ƒëÁpp{5èls¬íI†°Çàúæ·AÚú0¼üôérØ¿}ì
FE,Õx1¢ë@¾ôÆwÈðtØ{RasãI? ˆ… ƼÇ8…œQš÷½?{€•·Ó&ý8µ!·‰Õ$ ¨ˆ‘
–aq
MJèFÁq˜]¸Ò}¡3—*íøq”¶æŽJdœ¶¿¥?*pV²ÖKµˆB%c¼ÖÆ Šµ
-¦Q¬SÕ+òébdÈi²>ªÇCueõ&RùêdÁߎûøòtc¿Š|¬Xz°ˆâ¤NvÝÓu€RDótˆë¯eòÌ—@ÙZ´˜”w'“¦p«ƒ9»çZÀéÚ¡¢eìî,ÍeË_°ÉÚK¾.¯ñ°% %×°Ðb”oPJ_e~*/Š­`Ó‚Ô"¬‘NbÕy%òÌ7ÖõŽÅpæ›íóÍJßUݾeL‡œÚœ­©¨­” d6c”¨V'˜	Ȩ0O(H
-e!¶i½kO­š:EÞ6g�¹«™° 1é0‚)#];SýÔ8f?F¬=ÙCZe�ù?Èž®Ó©möÔÆjî<åHü¹Ôemú&\ÎïeÜbíÚ…ˆ–É1¾´£�_‡èN#qÀ
|æ[Xkˬ–ZÉöö5öJƾd5d\”O­ýWì}©;Ûû4ÀRvä^¨®‹3½ùmgzJ ?xÚ:•Î�ð%ëW�N¹;µÉL:EZضJÜl»Ð±†�EÎUÚÞå;îê
-Ë2›£ñN¡r׸"l­Þ¯ñ¬m)¯l!´aÕªRe‡Q%ˆBB-±ç“€N²VÐÎ +AÌùž3Â×7¥%Cl!óLt‰1³I#Ý¥Ò“vŸ¼oœ�jc”ß�'ç%_ªÜ(ôT¥æ‰“!´š6eQÛ(?nÚXR&ÄÛ,ßž4å<äÁC²¹clœ4*jºTÑ€%Ë·�°�Öê•ï-ëÿyƒ š
å•Ôÿè!	õÞXš¯[µ�n›{³HW�»–­³×sçû©äûy+ãzU‘8îã1ÞÝ@:¡Î6—�ñÊ	öéßt¯N9\_†7Ü‚£¢ =úνü‡Ós߶Iq�Nhå:�"ÚDX9©uŒŒn3/.çw©ÿÏ@wJendstream
+xÚ½Y[s£6~÷¯à1îŒT]
Í>eSg›�n¶uݧ4ã! $L¸xvÖ³Ûÿ^a.Ç“L°è;ßùt$)Ø@ú6‡ˆ
+fX‚AŽ07Üp„ŒýîÓ߀ò#Pÿêãlôë%µ
…ILcv_ò!²ml̼›³‹ßÏÿœM¦c@8:3áp�}¼ºþ-·ˆüqñõúòêÓ?Óó±ÅÎfW_¯sótr9™N®/&c€mŽuR èpyõÇ$ÿõizþåËùt|;û<šÌªXêñbD³@¾�nn‘áé°?�¤ÂæƳn ˆ… F8bœBÎ(--ÁèïÑ_`íí¦k›~œÚ�ÛÄjPÔÄȆ‚	Ë°¸€&%t£à͘�ÝÇɳ“x2QyûGþ(Þú‹¹ãyIa[ÄIZÙ³ÆmÞú�? „ù�Âü߇²©ÕÒ”
ÆPpNêî½¥
+œ•lX©q¤d�g‹txG:�QæÞñƒ†Áˆâ¤†Ú7¢ðûn8'úD/8{öÏÕù�ÛÖRÍãdÅíýñ~?JåCâ§ëN
 endobj
 1179 0 obj <<
 /Type /Page
@@ -4392,16 +4368,16 @@ endobj
 /ProcSet [ /PDF /Text ]
 >> endobj
 1185 0 obj <<
-/Length 1615      
+/Length 1261      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sÓ8ð=¿"oçÎ`!ùÛÃS�–+s”»žJ§§ØJâÁ±Œ¤ôëà¿ßÊ’;1%	ɃV«Õîj?%“1†?‡ŠR/Çi€BLÂq¶áñÖÞ�ˆ¥q["·Kõz2zyîÇ㥑�'³¯á$!ãI~íDÈC'À
;o>^ž_¼û|uzÎäâãå‰ë…Ø9¿øëÌ@ï®N?|8½:qIçÍŸ§OήÌRdy¼¾¸|k0©~ÂôêìüìêìòÍÙÉÍäýèl²>K÷¼ûú ßF×7xœÃ±ß�0òÓ$ßÃ#’¦Þx9
-B…�ï·˜rôiôÏšagµÙ:h?‚‘çGÞ�
ÓŽ
Œ"¬â0E‘ïù�
¯OÜcgÁ¨PSF•[TŠ‰;Z|µZN™xe&7ú¸ Ó%¥aèu4Ûf4cÇ2�ŠªBª"“p ]Š×¼äóG3ûÏ4Ï“òvIU¶¸-A‚Áÿ¸yõœ2\¨
ío±B2år‘3ÑãÖ`neÍ23·¼~v!ÔÚ¡;üxõŒYJºd®R‡úcIÜ*£ÙâØÍìíé+‹¹Î/òB=†BÏ"ÏjQT®à\ɵ_Iˆâ‡™ôÈä-·NnïµàwE>Ècé‚}[1©ŽÜ­„NâL¸Tº²†|<ö�ñØ"~áªbÉŽó
-mˆH‚Ò4��XÓ´ì2ó�“Nv”ó}.ðÒ@«ÚŒó’Ouþkxs,˜(®ÇÀ™2»A²Ü@ÓG3ê7&2àdQØm[—Ôë®H…•ÓÔzeÌx&µÚ^ß3º¨úQäP=Ĥ‚¶í|%¨±®^Ó˜’éÇD˜:3ƒTÈ8’8ÌlÔÊi4Å€a£%iJ~mÙ@œl[öðNC𲑵6¢8-yöÕ€÷…¾1i
-Ájp†ÖÀ೬
¯…’6hq„’0Mû¶ÉÙŒ®Jt÷EY¨qWØÜüs´ó¨'(&$‚0÷	
-Á2Å¡þnINcIò¼ä–h@r×{+Øë‹ÖYãú^èÜsñz›™€BM@
%ŽÖ«Áò™U»ÇÖè8pô÷ˆúÓÊ’Vp7¡SÉË•²´úz©kžv±˜íòÚ�R@š(µþ$û8ê»ÓxÐLÂù
$ ýÊ*ƒ¢ÒŒæ,%ð½k‰¸YQMjhsb}\BHs¤”XiŠ6r4ÐVMX‚¶g€%—Ê@�iÀxv�¯T½²KæP²�„˜¡92‰Óû\³Uõñr$VÕ@Ž…>ŠÓij9fº­niÊKÜžSCƒçô¯©
š€Ñõ˜U\@ßZ
-}–C6{	6ÞÔKëhä
¦mÓØSDS7�öß
Cø‘� µE

+xÚ­X[wÚ8~çWøÎY¹¾`cŸ<¥)ɦgKº”>¥9aÐÖ¶\I$!Ûýï;²ÌÅ@RÛ<i>�梑dümÃóM?tBcöMϲ=#J;–±€¾›Ž]ŽA›AhÔûIçݵ;0B3ôߘÌ÷°Ó
+Û˜Ä÷]ßtÌ XÝ«»ÑõíÍ×ñeoÐïNnïF=äxV÷úö¯¡¦nÆ—Ÿ>]Ž{È<»{õçåçÉp¬»üãýíèƒæ„úó
+èxx=GWÃÞÃäcg8Ù®e½¶åª…üèÜ?XFËþرL7<ã	–i‡¡c¤�¾çš^ßu7œ¤ó¥ó÷p¯·=i?Û2×wN0Ü3``™¾P/4}×qÞ÷�oY]œ†2&é|­ÿêͧ8Ž¹nÜçŒË-_5të¢ìo!cš¦&Jö›&˜Ö‡lÛ=ÏÙW6Åψ>Ï9JØ	úB4;[¥3ÂkÊÿÃV<ÃÉž¸¢¦"'Ñi{!bœœ�¬¬ì-
b,ñ9òsšÑ@¸¢¼�8ú~ÎìQBpF³¢™$ü'
í¿$˜ËÁ²
@e…ØG¤­`I…¤‘h‹ YÎ üªÙ¢Âž1M±Œ–Óf(ƒúáâ-@RìÆ6…ªhŹ 1^A+8ÇN¾³÷05wúº	N	’²©CUFfŽ–5…�Ò¹­¬ Χ1•ë“¡P;«Rš!Θ
5X	Rlfºµ&bÊø4cµ“1çì‘Æ'1jhÍÉ�²¾t5	¸Jâˆ#,�È!Û.¢0™CÄ/‘¤)iç
ˆƒ6 '4‘|}D¡GSˆÊRŽŠf�iaÇ ’2UÔ朥¯ä²­?±Šôj
+i“´É!Îç
+»R-†‡ì·Ï¥ƒa $S*´N=
rîKù·J˜êA7¡$“å„£Â7­wÄß…$ÔÑŽ¿hÎ8¤ó.÷$y–?9~RIU{}$Í¡ð°ðF‰F»’�XGjÙZþ…eD4ûTàï5_QÍvÚÂÕU	†wªæq|
+¥‰¯/H9—»ww†©Ï´]OO5Y’­B»Av`†a8€ÁjÌFƒc0ׇû·ë•ãÄžr®Û…¼ÐÔ*×ßEÂf*ÿ½[4$Sß~wFJ
AbMÍÖú«4LMN–´;˜0Åå`U1/ç)özMED{Æó”ÚNÕÛjSu}¿‹Õg
 endobj
 1184 0 obj <<
 /Type /Page
@@ -4414,37 +4390,38 @@ endobj
 /D [1184 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 346 0 obj <<
-/D [1184 0 R /XYZ 56.6929 215.7523 null]
+/D [1184 0 R /XYZ 56.6929 122.4687 null]
 >> endobj
 1187 0 obj <<
-/D [1184 0 R /XYZ 56.6929 183.9675 null]
+/D [1184 0 R /XYZ 56.6929 92.1609 null]
 >> endobj
 1183 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1190 0 obj <<
-/Length 3744      
-/Filter /FlateDecode
->>
-stream
-xÚ½]sã¶ñÝ¿Âo¥'�ø"�ÉSrçKœ6—ôΙN'É-Rç$R'Rçs}w±
-¥
[
-
-îæw%Ï2'‚¿�?Áñ3g\A¦eü,Kø«ËtEʵôª31¿	‰\¥…2¢�ºƒc>1g¤Y?ƒxöOM�».À¯8ÿμ …K„D˜ÊÆ‚Ô�5ß3��,s|ž[YæF8F÷�
-u[ÞºþBƒªyDG:#GpŽ9Óf,G öqqŽ&ø�ÉÿZŽP@Œ;.eƒLÃÔ¶ó¹Ì²ìmšÈ�POM4÷Æ„_1b¥>ÃOyžûh哾8e²›È’“¿ôòžÇHàlÄPêx
*r1bÄXç#FÀ:Šz�7›DÉˤ=ÒiqšB‰1m08¸˜7”ÛÔsñC½Ùlmži4yD¡¬A2ø·½\qÒk€ùð@ÐØ,8¹´žF6nXr½§fójn¢°¡.3`#­:ùf oR×­t&ͱîSê?™ô10á‡IjðÝ°n¤F™:@­Ú
¤|ظ‘•	Ìlº²rÿ	_ñØÚÊ
}qƒP'*­(½Ú:÷/Tš>©‹B„
-í;@¨W¬êÏÕ+Xyݹ×ά
-Ϥ:�¶Gš¡=�„r�OˆS–+òQ™årx~Úñ�®
-�¸Š~òRUåh»wô|¢TFMÛû�–”ùFH•{ö‘:“/ Zjƒ;NÛömµtf	\Ug�Êy”$£­®&úµ¦[Õ«ò°‚Ú�&
Ö§0SÄ¥ßtƒ¡”MEVä×R©*„ú3�8ž­õ|n¾¸ˆ?IMʘ;!YÊQr
Íëb:+0@×R° °sV‚>^©—¬$º`%Ë&<õ¶Ê¡
s^öçÌ%—àÅ�¹ÌEÀšacd0`'¹f|ֱ̌ÁhC£}�¡ÍÑ`b`0
-MèzÃBÀÈEk“l Tï	6�W ãÊÄV`àfÆê4OµÙ®µºÔ)Ï\†¯lrì$7s:
-·ËÎs°™&'°m÷ÎÚ©€ÌUä/eà1Öy;
X¶dnªsÖ	ºÀ ]¤°fˆ�+\¨UY>&~?ß4¤hV×1šé¹hV�û–ƒkeºŽÜ²îàî�ïlbÉVØn‚� †…(&
DäÙ‘\Pe×h=Ue™™ÌÝûÜW¾¼ÝQfÒ°û\î_íí+ÒwØ„—‹Yz<s	¸ñÎÙß”KI_«
-Ÿ"ò¿øaŒÃ
-ˆÞzêçËcH&Ñ»´áÒ` |Ï@¶g’I×ãÛvŸAi@ˆKÞuƒ›³{:Ócϲ´(„wEgÇUZpæ‘ì9|²¤;P<!ikÌŒÇN&¸×AS€À™ÁŸv­ºã©—tù ÏSiðˆqÔÎö	]Ý.7]ïà/éªîðà£Ø§ ?ë7y‘C
›¿Ð뎱ÎûÍ€esV<ýÃ:ýœ÷”*…Àž_æ `Í°0=¼b‚ó*òžøËj5<‡–xŒ£ŸPÞ€Õ±‚‡±+FóŸØ;ß7u˜ §¡’Òo%þˆ7Ïrµ5	ˆ@¶ŠðGš��-aRYĹKåž}çSžÙÊ‚e�ôA©äÛ†¡¤5ß˃TZþª
-=Êo.ñ¤Áïå¢x)qçB`‚ñ’bGXÛc�³š³šÍÓ,ƒ�»ÈBÀšáaܛˡ<ÊÕ˜	JÀOD‰
zF{ôî[÷
-7BªÜÓV¸€zèç×{’2Sc'}„Ä'9—ØJ™†Àš˜cGyE¯�·ÅwÇé‰áþCFéI.Îh"HšáˆXÏqµ”€¨áãAKD51mjáÜø~
-�üúæ—W÷¯¡–A¦rØ>�3ð¥C¦#�õ»-2ø §·uóÙåd!ŸÑ6;Ð7ï>Ы.úe·q´öeèÍ/1WÓ2(>;ÌÙØAD‘¤W”°wxè˜áºÇñÂ
-‡‘‹ªþÜ,Oã"ìc"¿L>`ÍÐg|f¥3`µ�̆èîÙÒýFG‰ÏÚ7vÏ@ùâóÁ!Ruh!#|3.а_r;ý*>wûf[î›�Ó
[�Ã
lЇÛ×.åÓ�›M+Ãn‡gd ÌöÒãIX®Ñx@=zzÚs);sjûÒ:V{Hf¼EfÑE½,º¨—ù‹z™-ck‡l/é¡9*ãïP!æÎ}XøûÅœBÛÈ‹X,ÜðÃÀk•
ÆX©Ì:æS€0ú°ì¯§uc˨°Fy<$Ã_ñFúët™K	,ùÆ1⟥g
É~íN胈cŸÍž\Ø„ÎhÉ<¶á6¶l܈Ò%^ø“¼"
-Ë0^ãîáì–µþ².ý`ëVQÐB›\Cq’e¾
Ü£o¼Ïåæà(ͦ9BPQjå»0°?¯Ü%‚™4G§Rú¬Ëíi,S©‘r’Å¡è€>ÈŒö•Kã¥
£ñí„P›¶ê¶£Îß«HéúçýüÅ8Ž¡Žç£K‘ß™,£ÈR®ë„
Ô†ò£­Þ`X»‹žË�~WR‹22ƒ-¬|RŽ7m34Þñ.»wéñ@šE@w¸‹ž}{º®õ~8ìœ7o¶á6g5NäÀN»ãIyÔ¢î=ÞljÝÇ		‰ÎTþ¡Ë™âõæÿnOÿç[ÔÇ+æxoPë3EŽÈòTsSx¦P¨RM9WB§Jób†õŸ¶›‰endstream
+/Length 3581      
+/Filter /FlateDecode
+>>
+stream
+xÚµ]sÛ6òÝ¿Âo•§‚‚¦Oiâ´î]Ó\âÎÍMÛ™£%ÊâD"‘Šãûõ·‹H�"åÜÝÜx<„ìb±Ÿ
+®p!Ÿ.~ÿ“_®aÙ?_p¦¬Ñ—�ðƒ3a­¼Ü_$Z1�( »‹ë&ŒzÝÐ)ùie˜62› TSÔ–¥
+ºP€ëb“w-­ê±Üí¨uWÐ÷Økv²Jθ†
ȤeR$Éô®z¤eŒEL‰)¦–cª<«¶><�)©™µZ�'ÝaMÐŽ"g6KÓ!ñÛ-¬]I½x¬Ëêž~
+°‡	s
+PhØ\~i‘Øš\¤2rq³!„|
+o0YU·ÔhŠU‰«)Öß
ÄpÚMìê´ir.P°vÀ	³!@[î?'¡RÅRÎ3¿<6%
+_ʱÏ
+)Ƕà<ìý!ßcà�œáÆ)‰éòX³°MR
�†~7ÅC~ÈÛ)ŽD’1¥´øŽ4¤‹ü3BT\xƒoUëbý=² eë¡›cµÂ�Ëweû
+P?bRþDm/KEÁ¿sk ËÔ†Úã
+	Îå5e¿.é\þTìv{—aZC>
+�ünç[N&г«óµ‡„)B­ãTke
B½¨ ÕÕÐäø•f©•fèø»ÚU9¨t§úýá�æ3PsÝøaó¦êÀX”mý‡·íæ>ooÜ‚“�Ež7¸ëŒÅ,™òÕ¶Xö§`ÃÓÁŒ¥ƒÓ§ƒk‚üðtP²TòlHŸÊ·Iþë"¾ä-Ý&ÕÕn°7¯k/µºíNVg¥§29|òÌiEŒ5/½˹âãþaVx–™ôÚ
i‚öPt	3‰§üV¥ƒËg3ðmC·ç/ö®
+�¸Šf4h�·ùh»×ô}¤$ZeÕ´‡+³8®(ç��ÖþÛÔDj&^Bœ4ýul·‡j½òf	\­ïfBœNe”£­nFú0::ŒÍppF_6áßùa³¸èo0±Lñ,½T)Tˆ˜AÅí„dÖ3}7±ìf\ÆSÒÍÍà´2L¢ä:´ ‹lR`€n%âÃÍI+Q)ÏYI„uÆJ–KuŠ}Óæm	æ¼jæÌ¢qj­=ÏE‡5ÁÆÀ`RËR#ä�2cbƒ1–Æ„
+ÃØÞ`b`g0
+Fƒ[Tz”&žœ�õÁ$¢0}Ù„l¶Eˆ}õh|X%yWúWá(ΰÄÉO…\Ô]ÂB,ÓòÑÚ.vªó·

+)Že}Èê㘙ŠcYo–xVÙúãK
+·*¸yN3±LËè^
+;è�Be£Ð¡RÞ“ëïçèpõT‰1»
CÞöE(©Ak´Ò}Î/Çêi:ìÀó,†;É}ê­U¼mî7eQI¨R
+s5“tŠ/ÀS1tQ$ɺçZ¹w²;+ͺ'ý#
¼l-«ÝS÷JÀ_qc�?Q�î'ð¾›NW¿§‡ù)B¸yÐYè%yb_í:¤‡AÄçÔ#žþX¢¥Ýã�.ë‹âýþX•«<¼äñ·"±ñßïê»ÜO	¢gso†!äâCß	Uƒ/óÿù=qÿØŸ‰3g™<eFÚ,0…‚Iô˜óîáñ)ëÿÍ6RÀendstream
 endobj
 1189 0 obj <<
 /Type /Page
@@ -4457,7 +4434,7 @@ endobj
 1192 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [250.9056 208.6872 324.559 218.0968]
+/Rect [250.9056 118.4935 324.559 127.9031]
 /Subtype /Link
 /A << /S /GoTo /D (statsfile) >>
 >> endobj
@@ -4465,30 +4442,27 @@ endobj
 /D [1189 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1188 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1196 0 obj <<
-/Length 3362      
+/Length 3429      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sÛÈíÝ¿ÂsOòLÄrÉår9yrbçêëÅnm§íÍÝ=PâJâ„"u"e'×é/°À®H™’“i2c‚K‹Å7@‰óþ‹óD*‹²ó4“AŠä|¾>Ï—ðìÇ3Á8S‡4íc½{<ûˇ8=Ï‚LEêüqÑ£¥ƒPkqþXü:QA\
-Bë¾nA¿…IxIÍ––.á,Z}.«ŠÖgLȬËÎSš™¼'ô„6°Ó±²°‹eÍÛ:^ò¢(§('ÔN�Å)
-@€r:NW6u^‘1µfŽ·tÓ,èšÓå��Ù~%�˜h7MÝ0×X„“G»<+Ì"ßUÝ”-]놺†®"±°üã5“fi
„Òº½»½Fñ/Œ›-He*FŸ6³>Öq3óX(•mÓtÓÂTf™£D¦M]}}alID±ˆOsá±FØ[’‘ˆÔ��Ç‹,œì¶ ’XƒJìU€
ˆIÍÆ07kSw´Ž*C¼CÆíbÉD¾j	EÜ5Z®Ì“©øõf�—uK†‰y]ÐvG
ÙSJÄÞž(þÙÔ†Õþ\v+§_¶©MßÜÌ—yµ+Xßè3VÏ 6ˆ‹W3"xÛtŒÒ6k†è–²÷ˆ¾�íÀûZ)8³2Á’Íö·(’W×ø÷
?ðç‹,šüó`ñÓþu§)ö>~z¸þô!o©�-²žfá<q„R’Ñ€}†“ÿØË4ÐQ˜sÔíK^nDÁ^~(Ìo¬ž<¸k=¸Þµf·v·ÿ}Ë1a¸5‰œŽ9\’bHÒÓ×Ç:îp·,Ê6ŸUfšWËfv³n_¸›Œ©Âä4k„‰�»ÁÁ¥zÈÅq
ÚU’C¨Šû‘žž\Ý><\¿§‡=†í³¼ã«5@˜™ªy~�b�¯m(…rà#„O±Uh	|cS²²�T…
-„„¤žç�´¢D»WÚ.ïl,󬼂C˜‚ÝæλSçâþºiÙ÷üÙæ.
-Tìï3Gl³©J$vÌÈbL·ê•â¡�uÂÈ–•JÝBŠ›VMó9oËâeùË 
3}š�5ÂÂÀÄâxbÈÿVƒ’Ò�m»7#Š”*€RË+r„åC5†�Òšñ)³6O€ÚÒ6ltzò”We‘w¶ö€[ŽÎ
-œŒ‘J6¦’­bV?Ð3�’…iFBL¬ý	ÛಷÙW¸Vžn{ÄlS[™´åº¬ò­-Ù�|sàÏ9?qï?—SÑ*áF¬Ù‡mÇ€m%ï!"
w0òµ)†µ»‹â{û9È!ÁiôZ ïcä«çTk4Ç™™¼Û¾Œæ	Ò@æ4k„�A4W2HÒ42ò€Qc�>¥“Ui¶”5ç
-MöIÎ$¨‚íaØ£¹D9+YÖV+»ÎÀ
-_†žO54áéAhÓµHê~
-�B^K@_ÍX± Rh#ÝRdÿtD–X‡.$EˆJV„òùÜl:†ëöÙl[ºA·Ä+Pr¨î¸"S½ãÔc�²%q ³ÌEкãŸepŒ®»àŠp/¸Z‘FÔ—¡:(ɨ¢AßÎ$ÕJe½Ä»x²°¡–¡£êéÒ":A žõuXœ¹‡Vb¶äJ¥ ñ¥#"ú$0Y¢92»º0Ì@>’«ãÂÖ:ôÃÝK&8ó"„s�T¡"Ð*‘ßU¼$!x½ÀÒ¯ç]ùd‚‘­¦"GÔz—Qf~‡µ0¨/„>ç]ÓTƵŸwÜz	Wqœa¿ÒÜô±Ž‡+�eÍc×­¦õÖÔ‹™|”‰'·÷X#û‹N
öÉ!£^“i,³ïsú8ì4q¨]ÅpXÀBE(SÁ/]^ŽÑÕA¢„C™¹œì+·
-Ã6'áf
j·ÿ¾ºûxysÛÏ|4‹j™AóäªC—ô9�bͽ}2[¿—;"ˆR}Ð~S$ÖZà\ú+ß�*±£‚*9'ËœJˆ¾4ÿ‚çûù—Ö¼Ã�ØDåT'êÛƒÕ['m›–awÍé2_åõÒЖªÿ×ô„§È
-
-É0=½­CÙ¶o
™@zb¸í±¡×Ý'í•H"ô%RÆâCDí"i*·S£ÐŠè�›ãZKK�ñÞÕzýàâØÙÚ–{™q·P%-¸\Ä`Lñ­u¤i�.W˜5Ú…5±$N441ÖÈ4N’IUÖŸ1cèÈ鸊}¡l•@—I;î–«Ž¸÷q$€W`q�(<óÂw C,Ë„­
g–íÖCbQ¦;KP;/>²m<+JK?– °ên¬£3Œ3GEÄÂÖ�Ü°dKL¸’tíŠýÜbÑm.àüM=‡=¶Ü«
-@ßÃ:¦ƒÐ
-ÝC"�op`‰&«fc;Êüp[ì¶ûÜ×5Ës8§�r�b™÷¼j9ˆ¶»
ñ‚zØU™†ª#=h$öŸ8Üç7Äüø`ö›X{š ¶¼g�¯}�i¥T¤©þöâ„[Í(M œŒ#÷í†3Ñè¤:ƒj]g~RíbäÁ6qh™¹ÎÀ‡þLs1�Ñ€$K¶]€ëp°6Çqða%Ñ�@c·ÉSižG8‰’@„:éÙÇè¡tìË«ŸBPè0}1pCjr¼º‘
°?Ï[>™­Ž2íRàùk
”TX*¾ñø·o?˪™yóﳞ…T¦ß �Xé¡>Xù"D](ßÎÈtÂá
-ÿðÀ}Ýñ…�·Þ¬_¬ƒôiÜ%³=Þ>�åºbq_|5uÝÿ]�+N]g?ŒP¾pñ�TÞö[ƒÃÜçüœÂûµöû¸eÅ
f{Þ¨€iªÊUųѴ…Vœ†‘�‹ŠaÄIÂ@(õj¨ˆ“ÔÍH0†M�Ò“Y%Þ7]¬Í`©õð;¹íì”ËM
-}Š ífû·0Ûª„p@Ó9 ÂüaO
óÛÁ´¼ÜU9¿…_Ê÷œa-eñºâ“?´+úÅ˜Žé}Á{®Ø’Uj¥B£Wåf£
+xÚ¥]sÛ6òÝ¿BÓ'y&B	 Áé“›8½ôçÎvîcÚ>Ð$dqB‘ªHÙñÝÜ¿]ì‚"%JÎÍ%3æX‹Å~¯ä,€ÿr¦c§a:KR%t õ,__³G˜ûéB2ÎÂ#-†X?Þ_|ÿ>Jf©Hã0žÝ/k#g÷ůóX„âVæo?ݼÿðÓçÛ«ËDÍï?|º¹\„:˜¿ÿðË5A?Ý^}üxu{¹�FËùÛ?]ýåþú–¦b^ãÇ7ïh$¥Ç‰Eo¯ß_ß^ß¼½¾üýþç‹ëûþ,ÃóÊ ÂƒüqñëïÁ¬€cÿ|ˆ(5zö/��iÎÖJGB«(ò#ÕÅÝÅ_û³îÓ)þ)m„UœŒD¤âpšËR$RR¢¤�ZG=—C9Åe�…\ÞfuѬ…}*s{xf*‘ĉœ
>ھǚØ?ì/ÃT$ʨ1
÷+÷–ó¶Ùm/¥™çüÞ,éiëÎ�7›èz>0⮵�xŒ~M»}²[¼aƒ®+[zn¶å:Û–×Ö~Õe³%àÝÍÝÝõ[dÜŒR�l)Eª5‰l³±Û¬+›º}s¹ˆd8owù
+  ˜g-=ïÿ|ýO‚:`}›å‰Kçp4U¼ÔÙºÌée·)²ÎŒ<Ág[>Ö–‘ÿÕÔ¶…ã)�3KÞ§ÙðÂ}córá<Å¡£ø· -bIE\C€…
àt€çÇqD®,ŒHz_+×ôö¼*Ýaá#¼!ró6+èmx‘RJ¼0	óK¿}É„øgæIÀm‘£Q0`ñp‹?v嶬�÷™8òsYUÀï.6+z^Ù!ILÀ!Ú•àÞÎ>\ʹõ¨öë*Ûµ�-à QBAìºéplw.Þàˆö«K`ñ2ÛUŒ÷”U;Þ	Ž$ƒyLŠ©D(4�;À÷p?ß“ÞòHËb#Œ€¯×ÝI¬Ô"UJ�EYûÏè^C•zn
+i¢yU¢®Z÷²±¡„_š)º‚,Ì0Êêã¼�]—]¿Òƒ]òñ"(Ì4õHZ	ƒeÍÛzZ²¢`{
+fW¤:¿¡x¡yéjm¾—*4àNPè
°}
+@»
ËæIäqno-¢EfF“?Ä'+ëÒËhVóÒÌ-8nÝ|º¹Föœ³
+nÓÉS‰XFòä|<]ásÙ­üý²Lm†âf¿æÕ®àûF�½Ï�Ä©[ð¦é¥m¼ñ¢3¸•{�ÊÙž
Þ”U/{±²â‘Åö·0Tï®ñïžð—Ë4œÿí`ðóþ=0�8ôñóÝõç�õ’zàá<Q TÊ�‡
+îñ]a¿û�Áê©wm®!øÜ­ýë~`›0ÞšH¤É)…SFb
+ðŠ]b�V¸·,Ê6{¨ì"«›-Èͺ=R7
+ú<
=Ö#uÃ@EI3¦âQ
·s�ÆÑÐÒÓG×nr@°›s.ŸNH
+•]v4Äk¨ùËçØaæiæ.)äû<D*%‚Ðèƒ@‘ñY�¯ˆ§	+7q—Y»ÙX*$”\ï¯6¦íqíã{äŒPÞ‘û¥±±ÀœÚykyv·nƒ’1RÉÂT²Tä õ£{&ÉefÚ	¹
+
0ÜËì+TÇýºí	±M\dÒ–ë²Ê¶.dÃå›ÕxÎxÆwšOEc)„›�æÞl{\=ñ,Ò8p!_ûtÐÇîÞŠïåç¤!�$ÒAôJx>Ä:mÈ{¬�R­QìàÝöØšëThXæ<=Ö#k+¡“D�	¹C«±D�
+“ùª´[òš9€-
r­	A$— ÇÃ�L“›Éx	Š`îhÞ‡^J¨¤†ïd&
+ÆõWç0#¨§¶/´qîò
-¹ûèXÍSûV³!”ë†@[s)Û+›!ÑÐÜet·j×
…!o´Ù—vÜ8@¸Š�¤�¨¤€‡�áXÙÒÃD{P^ž§/¿y3á*Êvd­¿s„ŸnSHAP%¯ˆÂ
 endobj
 1195 0 obj <<
 /Type /Page
@@ -4501,31 +4475,33 @@ endobj
 /D [1195 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 350 0 obj <<
-/D [1195 0 R /XYZ 56.6929 387.6589 null]
+/D [1195 0 R /XYZ 56.6929 293.8263 null]
 >> endobj
 1005 0 obj <<
-/D [1195 0 R /XYZ 56.6929 362.5676 null]
+/D [1195 0 R /XYZ 56.6929 268.1652 null]
 >> endobj
 1194 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1200 0 obj <<
-/Length 3390      
+/Length 3311      
 /Filter /FlateDecode
 >>
 stream
-xÚÍ]sã¶ñÝ¿Bo•gŽ>Iàñrñ]�éùŸ3�4ÍO¢,62鈔}î¯ï. H‘’®i:½ñx´\,€Åb¿I1ãð'fÖ0®œžeN3Ã…™-.øìÆÞ]ˆ@“D¢¤OõíÝÅ7oU6sÌ¥2�Ý­zkYÆ­³»åÏó7~ý×»«ÛËD>OÙebR>ÿöúæ;Â8úyóáæíõ»o__fz~wýá†Ð·Wo¯n¯nÞ\]&Â
óeXáÈ„·×¹"èÝíë÷ï_ß^þr÷ýÅÕ]w–þyWx�ß.~þ…Ï–pìï/8SΚÙ3<p&œ“³‡m3Z©ˆÙ\|¼ø¡[°7ê§NÉÏ(ËŒ•Ù„
-ã†îæ÷ÍŠŒð½6å€æqX+€qÆp©¤;T’º”¥ÚsfÒ2™Á:çdœ(õe™ov�$½‡z‰¦eµ9-iÅ…"EJP“ŽP‰Le#ª½Këßx`¦$7³þ	þ;© üµÈôÿFÐV³Ô)µ´˜tj=à‚;�°
-

-«çK§á¶¼äa¬~l˺¢Ñ¢ÂraIMù°Ûä-]<ûÊ©êOM½)ü½ú»›�Ð!=EûòF¯øñêöRÙŸ.…p
~ÌÜ…Y1´ÄA‘XAå¿
uLk˜Þzþ92YWGïVƒ1hËõé»íS¿ÛŽÊßmÑ.ÖÉýfWŒ¯–ÃÔÔžÞ»£šØ|pµÊ€áõO‚»ßÑ
¦vƒi6ïpáŽ@à*U¤€‚ÈNö0 öÔVÅFï€IÊù‘*|e°cäç,ò]ã5ö �
®(•ý]"²¦ß¼m‹‡Ç–"ÒïH*
hf•êñ"�
SSï<°`µÿÅ.
-ñOË
'ó7®”
-Í0YhþPD%Å�âsÙ64´Ü„ºU”O^9pìãõ»»«Û÷¯ˆ œ�†ê°Ò²;`€ëSy%‡‚Rm9låÕK˜Eµì"%Ê� çmÙ
Z¶à ?
jßN—Æ1Ó÷GT·üü…:a¡0ÖbŸ_MTãA«Ï„ZÈe˜æ©;­^}ªãúÕQùÞ\§Ø,“Ŧ,ªv”îApdS�“tTkR8­CȘU–v>áç< ËK1¯À9Mj}·ñ�›â
˜ö�nD„™dÊaÜÖ<½]$‰kÞWuç!ñ	6y9œî@[Rkçw—T“tOgŒLÈûî(tÜ÷-Q`³³Z¡ÁZt)=ƒË›P6HߵË9P±Š=%t¯´žP±Œ9%㚘Êp9o‹VëC–Ûç:¶ƒómÞ4Ýˤuh컊¨¿ù®]'Õçeý�—S
a-'‡â›f[Bå';»ëº¾ÃíDÑ,FÑíj!·	&RbJX²}Ò5ˆßÄ.r	‘­È—Ç�RÂNžñù}ªF©ü½×M›4-dhM[.ÆF©ÁŒlªO3ÐQMp04JtòY6dÁç>Fôâ¢O‚�ˆI0@”ø†ÐøkQ<·+(žÃoïžhUoÃÔ'J{
ÄË¡ð¾ÅGa1a©˜

ì_#ä²°IɸÙÁÛ’²]oˤ�Ëðˆjý�Þ6ä'øêàLFܧ:~ÛrŠ¶ÒÂR~¦Vvò)oÆÙ1˜ºKõi6"ј
�
<‚‚ÜØð“*½Ï�
&œÚ×/¹¬e&㮋aP?‹ùuKó½G d¸¸dX:J
-,ÚÃ'´ð¸„}¶%…n�É&(Ä–rúi·yÕ€
-€ßîXÝÔ÷¤ÂHäHh„çDPUŸADúÀuµ x€Úá“U@þ�’Í1ð9î¸62íÏq%
-V‹!׫	á9È9múaÝöºÉÐqzc0±Bètl[&TW
‘kz^V(7šA¯øõ
ãšèH{Ëå»ð.ßiûî WÑ®kHÊqeHõ©SbX2b)A%£±dl¨|´ˆ‹[„&ø·]¹¯�ßxìÞÛzšMqï;!^õ•
³Âg_çõ@Vø†ŒMÙä¾}È_ºPC�»§®ÓWÄúd»Â^_µˆ–º: —üÌÙre 8ìAq£ÿ€šC€_ÙÓfק:nv•7;8B	‘8Yø
-réSNšÓtT›¦LeÊY7æz�<€)B¸4Æ*@•a(¸z€,‘x]‡Ç|³ñ­é'd¿ž*ä/€�ô±‡b:1å››×ï¯ÈX JÒø.i`,cƒ“Š¸“rþTÖÔÏ#´×(@“F
‚Ú�€�„¬Zæa
o]Š£àuÂÕs>Ø(ß<ç/M\c[R†#EµªC7©9Øu$~x;ßu™ã§º]Ó±‡ïÐ|�‚[v¤]»fù’-!Z=‚�ÀÚþ˜"+É2ÇÏô©ûT'9R
ßxôW
-ÈN”Vÿž†·÷3nû÷é“þ„‰{­‹|}Œ]MäM31jÓ)Žß)Ù
7ã>]¤:ÃÃxµ�€ëÔRÐ@6zÆ{!‡Â…qJ½q¸]wCx;
=l ˆó­ (Ãé:J¼Ú?…Õ½Âp5òV”–—N«Çæòç…ÏÉ¡‰íEÝy
„÷mF�ÝÛª-Ñ/x–ƒ©?¼&à½wAô6˨ޘ�Ta¾?<üúâ~»†ºÃì4N�Ò‚|ÓÔÉѯ" —Èt¨)±
+xÚÍ]sã¶ñÝ¿Âo•gŽñE�—‹}u¦çkg:i’Z¢,6©ˆ”}î¯ï.vA‘%]Ó›é�Çøvû
ˆËþÄ¥5q¢œ¾ÌœŽM"Ìåtu‘\>Á»÷‚q¢€õ±¾}¸øæFe—.v©L/æ½¹lœX+.f¿LÞýõíß®ï¯"i’I_E&M&ßÞÞ}G#Žï>ÞÝܾÿéþíU¦'·ïhøþúæúþúîÝõU$¬ð½äŽ|psû·k‚Þß¿ýðáíýÕoß_\?t¼ôù‰BFþ¸øå·ärl‘ÄÊYsù?’X8'/WÚ¨Øh¥ÂÈòâÇ‹º	{oý§cò3ÊÆÆÊlD€Rõ(€uz™§
+^¡
+þ]W•
=sz¬ò¦-6;¤7W‘?¬ö¦hŠÍsÀ|)—Ë0Zͪ·í`æ»�·7?¼¹vRü±-ÆikÆ
óì–YæÏEƒ[
+ㆩߟû*ÒºG) ï˜‹Á°颎©(M¸ÉLI,¥�eó¤	äŸN‘7›AÚäHoUÏ|Ò¦ÍiI«D(R¤5é–ÈTv€µsiý}
�+	¾ÏÁÿ&”¿�tü
¦'¦'g1&gã$dð6eo:b
+_ìÞûo¦ù¶ñkpë-ëõê,7–ì$oÛbµnûÝ&K+r¯)Íb«ÜP'ˆé,LM½õÀt0:­ý»
+æúX^ÕЗY9TŒ¼zå°ÉØýŽMÙÍþ¡—À�F�ôü±K*”îêæ{²ï„�S§Å.Ë)Ê™…3
W%6Ö:;ã”ûX't,`ù]\,gÑtYU{�ôAˆŒ&'	è°F(0EdWbHŸÁeiç™~Éy°¼“
+\kRë{Î8¾Z/‹íûÝ8À_’A#„Ñ['|œàQÂœOUÝù	x„E^÷?wxHhíäáÊ�j’îi¨â¦åÝ£¾û®1ê
lyV³‚Û¬E—¨Ñop|#Ê&Q.]š6²9{*e¸UB÷*ìóÇ	aNLh9iÖÅÔŸHn_êÐ^盼åaÚ—QëÐØ}Aóm»ˆªO³z•—c
ÁU@‚½w 2N¶Lb-;»;u béf>• Y¦SbLXP!u²:Ö"ÓÚ„^r	ñ­ÈgG�RBÁ�juÆñ÷±Že‡å÷½nÚ¨i!OkÚrzh”ÌȦú4
ÖC£„­H³lH‚Ï€ŒèEGŸ
+Ra€(ýå
+>“iîO-ñÓgJ~
Df‡%‘ØAcˆá©BN°?Lȧ|Di'Rd{g&e»`oŠ¥�ËðÕAp|·EgXÐ�ÞíÖ‰ÝXH)ÚJÿQù‰ÚÑcÞæÈ`ê.Õ§ÉH‡dèlàdÈf�Ž�Zé]†0�©]3’ÑÚØd‰ëbX¤¤˜Ü¶ô½÷ãpž‹SòÔAêPfÑtWACT†ý]•º5¦œ ú‘Ó£ÝäU*
+H¨0™æl~­k¨ôÁ¢xöÛùØ•‰×zÒÔ ÅáŠ_ñ-ŒmûTïúü
’£–y'mÛfô,=u18”ÐXoðúJAj;r.ySÿ|÷hò#Î%?Xf9—œñ³}¬ã–×ayË+«r•/£
W‡ž6
+!(Ÿ&¡Ã¡aˆÓØb>8 âv>"<9§M?#¬Û^X7Y¸øaL¨Ó
+̦i¬2e‡$ðŽ¹^?`Š.
±
+†J~Å® K(^×�¡xÒƒ³_�Åù‹3~褘N„ùîîí‡k2¨’´Äjª¯c‡'Q'å乬©«GÃ^£d¸ËÔt”x[ì,ç9¼
t)¼¯ÃT/ù`¡|ù’¿6aŽMIe¾)ªyÍ=¥foÕKÉ>/v²í2ÇǺ]Ó±p­a(¸e‡Ú5mf¯ ÙrÊÑj�—ÏšøØÍ[eb¼.;¢EÉåٮϽ•»»²%¢²öȽ•@�.D¡8tvpÖ®ï’þ§ÿÛendstream
 endobj
 1199 0 obj <<
 /Type /Page
@@ -4533,121 +4509,126 @@ endobj
 /Resources 1198 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1182 0 R
-/Annots [ 1204 0 R ]
->> endobj
-1204 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [182.6146 117.0296 231.8861 129.0892]
-/Subtype /Link
-/A << /S /GoTo /D (notify) >>
 >> endobj
 1201 0 obj <<
 /D [1199 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1202 0 obj <<
-/D [1199 0 R /XYZ 85.0394 720.9574 null]
+/D [1199 0 R /XYZ 85.0394 625.316 null]
 >> endobj
 1203 0 obj <<
-/D [1199 0 R /XYZ 85.0394 709.0022 null]
+/D [1199 0 R /XYZ 85.0394 613.3608 null]
 >> endobj
 1198 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F48 885 0 R /F21 658 0 R /F47 879 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1207 0 obj <<
-/Length 3814      
-/Filter /FlateDecode
->>
-stream
-xÚ­]sÛ6òÝ¿BoGÏD,@$0÷ä&NÎ�‹sç¸s½iû@K”Í	Eª"Õ÷ëo» H‘’Òiã™
-òÛÕÏ¿ŠÙ–ýÕ•5z¶‡"”ÖF³õU¬U¨c¥üHyõùêßÂÞ¬ûtrÿ¤#•D©Þjkõ,Õ6LLá>¾ä¸
-
²jOˆ*ÁÌ{@$¨rJÓinóÅnÛà*ŽÈZ*¥gÉz˜1ÙþñH‡‘‰dïVtŽ±é
ÚPá•ã6l|Ô2
­ŠÀý «pŸ-t°‘Á»ûÏôû·]îκ[<Àš¶!(áÕ3&ΊàQL]§É· Àôɾ(K¦Ô‚”mZvòƒKn3‚’$ûzû…Ž]£9JÍðà=sup5"&´BÁòš½ã
-S)†´i0Û¡ìV
-ýeíä¦Aëøƒ’PgËWšùRÕû#®˜U0ê°¡‘T¨
¸lá×KÞ…÷12Ì-+üÎúÃ+0Ù
-îë–©´/™#‘ÂFµmQ=O˜1pBo‹¶½c
-&�$HiÊH«#ÛQ
-¿êM¾ÍZ2+‘²A³÷8¡Ž"Ä=÷ŸïÞÿ—úÙrɲΓe]ÙmÜ‚¤>ç9Ãa
-öb^,盺.G†Q@Ø R=ë£F5¦§5„Å…È?RšúÝ¥9¤ë4öÔÔeÞN¹ضX'¦Gɉ@Vî³×Æ÷Ëz
yÿôa;tïÞñX/€À¨Á­9é²â8¼t, 3§Â@>Ožc’Y@±hFæß$2=K½“ú+P³>ùyS:ùGó¦Ä§'º—ãè.ljƒE]–ü ˆ_²‹q`€c;‹¡ µœöh·G
áøEh±«J
-f�/R
-ækº¾™‚>y¡ØƒíJ�°…‹‰E÷Ûð*�9ÄØÖmZF<ŽôQiÁU:td¬t¸ÝÖ	X˜i˜C€öiLµ\Ð×HtJºbƶs]ôjã‹BøËP\îÖƒ}Zs¯¦9G@ù(s,a‘ÄnJ¾CŸ*!E­�¶·´AsÆ7‘|�¿KtßR©.ÂNº{*$‰…EßàüÍmŸÙ»>|˜ˆúð§+ˆ¦‹ƒÙÅz¬„°ÍŒŽVà©Á±õ)Œ-Ž‡ºÀÈÛd`æͧJÁÁ$ZŸ·±}¨ÓF¶ƒê\ßï`ó�‹RÕÈœ'ì�Æ„^Ï&XÚ”CÂäôTz¨ía¿;íôl*Ùwz‰M]MF¼Ö;BPå®8›R�ÛeÑdO(ìøãî§÷Ã錚M¶IÞ•Ù–‚�
çðCw#;Þ`uVJøÅhY_0 
-0œq{ÿH­[´ï>}¦ÎÚ]ñÐ¥ 	îÜ‹PØ7Ô>ÕX&Çs	½Sç/S*@~ãùWS� JN£Þùûå,ýz¾ã%èSl€©´Kh¿U
-‡+éKá_´'¶1�õq™¡Ê÷eQù:^Öïq½o±È7pÒoüÃòÈ)MU‹çªæûñÓ¶œc¢ÕSz
-vj»8×ÈÃû�²¥–˜€MÝ4…++âpþû&¯žrG5b#ê¬ôÄ1xÍåw)uéì)”Ã?¯D­DÁÚMÞ©ÝÕ‘`�bÙÕ
-¿ˆ£·L80zÊ‚ƒèEnøZŸnày;üÅ:u¼õ‘ÀÌþRm°€SÈ•ñÕ÷D
-endobj
 1206 0 obj <<
+/Length 3763      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sÛ6òÝ¿Bo•g"Ÿ$0÷”&NÏ7çÎqçzÓö�¦(‹ŠTE*®ï×ß. H‘’Üi'3&,v‹Å~
á3ÿøLÇQl…�%VEšq=Ë6Wlöc?\q³@‹>Ô÷Wo?Êdf#‹xö°êá23†Ï–?ÏãHD×€�Íß¾ûxûÃ�÷ï®5¸ý|w½šÍ?Þþó†Z?Ü¿ûôéÝýõ‚Íçïÿþî_7÷4{ßßÞ} KŸHïo>ÞÜßܽ¿¹þõáW7ÝZúëåLâB~»úùW6[²ÿqÅ"i�ž=ÃqkÅls¥´Œ´’2ô”W_®þÝ!ì�º©SòSÚDZ¨x¶�*2@ZÊ<J8 DÛ(–BvR|JÊ

+¥\Õm±z9^¬Q‘Œ�™õŽÈ 	²²GÖØHÂÖÉÞ®�äÛ�Êô 9‹„N,`G�—¼!˜
6Á#͵ñ0¿0ÍÚu~½�°ÅË|•îËúøè1ÉüÃÝhh;¿ûüpûñ¿¶É›&}än$Ý]s3÷š¼j©õ¼Î+@ÿ«+Dô`¤Éwßòu
ݾ]×»¢MÛâ[ŽìÃÎYÜB9[pY­…c|UãD&çÙ:­€d˜k@™o×:±R³D%Qœ$¥Lƒ»§5î{»ÒÁ/úÆÛ2Æ‹|}ɳ¶¨+â
ý˜Á)mùH3:¨<Œ±!pbUlæNÎÀFoØèmù
ƒV[Óp»î†pwúQM›/	¢ð«ë qk¿óØ�Â@Éj÷]6´“\°È*i†[‰:˜ÿžå[äD*�›ˆî¨Ýé
+´‹%p]ü˜p,aOu4õËçwÔøt÷îÓ
5Ý„rÔ[ëyZùùnñðM«—>¹†~t‹?¢D‡«o!XXmDZ6õâ` Ž6­ŽÒÚŸÄz‹z‘ ÂØãì¥8}ämd’$ñ8H`‹º*§èÅ:J´TE ­3_N0¸VÑ×Áç‘ëöz}tð «ÛèD
hÐQuÂ2¡Ñ7`õ‰xþû¶,²¢�àÙ–ü
.o¢ã—㆒íà	ÚÌá¶t›‹þ*°‚3ñwØllzšØf.ˆ2	¢<¿ÍÊ‚QVÁàFh§Ø	!)ØuðUÌ;–	dáÜtÒA6
ÒRÂß�”ðJÉk—`1ø;1Ô®‡I…†®:–N¬Qr
+jàjùR
@Z5ÏŽæý26hiœs4„Â:oáË"Niaè ËLy¡…è{º•B{Y;­…a8{~BI¨Óå�|­êç#®<«�Ç EårNžéØ�{9
+ã¹õÇ
~§ýî˜�t
+CIÏßz¢�Î…b£iI
K{D½iã¿

	ÁÀ±ˆ$z\á*§¬ð«Þæ»´%³" êjöà$'ÎAêã‹�ºXc¹ôºî˺þºß6>Þù’û0Ä…
SÎ=Ž¬AWy›­Oå~ÊÅ+)liúîú¤ÒÂFLšø¼êC�vA”;#«LHfíË6åxŽ$ã±<O¾ƒš ?8ß�±[›ÄC¾„Ó!Yâ¼kÕf$†¸2¾à¡0336ÈŸ,"tQA ’“vv¹t_/—Ô¢0e€njZÖ�éç¢]'>k°áÜ�<ÆW‰�¨¸à7¢š
©™³èAûÈäjÖ3¹š�0¹Ú‚VXþú |¤|`MµµôT�e¶¯ªtIã
+wfºÒç/�›Åú4.šÇ
+ �3ùÆL‰$Ò‰[Ëì·øe­$˜^Û­ô 
×ñöv#fjXϬ¿$�wÑCìV‹Á9’�
+*9SREÕ‘þÜ9‡•˜ù˵€dÐÿ(6ÛÒådã�Kð뫠в£}W1dzÆšY_²n³$ìBl!m^jœN• 芌ÁS$À*$üBtŽÈ8
+ð¬iì P¢`/År±­ërd„
6¨�vlÔ˜ºJÇ6: ÿ@Éœï.Ù¡³N}�M]æí”[
$JÇGyú¨ê�–ÏéKȯ˲Π{ó?CØÍÛ¾¯@àú hNº,ˆ÷À½Iya_zPgö%@…„y�Ùf
qDÖŒö<€‰AÎ2ÐAMp0tZ:2p֜Ȟb8™4{ŠC’¢{™Žî25Ï겤Aª]¤>³Ò×'?šJY„“ûª¤�Ñ„‚àqa$ôaàŒâò‰ŠsWh6
8�
+…á”>oጅ¯�CÏcÚ¾äúøâë°Huõr¢¡d,zE‘þ;“>Ü€‘<¸¹~Iw¢d"ýø…ÂÕ®l×5°ØêÊÑ�pJËGb„K•)0åJh5Œ7]ÕC'ó4êçâ“Å9F C2S-3š�D§´KÉHY¡ú%5
+D8ÏëP\î7[ê9m|«¦1RGè@ý(sê<Ôò úT9I0p·ŒÛžüH@�o"¯ë¾½’]œwqöT`"ñH%æÂEH)ôá'®§Ž±®Aè
+Q€}Ž¸_ÍÈHÄàÞúÆ6'@]`dŒm2<6TX%§î
;CÛ‡:mh;¨Î
þ–ÿ¸:Åñ™ó„ИðÀ÷ÙËœ|H˜\ŸLu>lw}§]Ÿ‘ä}×ÛÄUf¤aó—zOªÜjª7âwY4é#*;þ¸ýéãýp8¥Ï6Ý�&ïËtGÁ
+ð¹Ï ৻OHÂm ^ä)ÎÝE![ûk@ŽGD³£dQA°IʾÓçÌhˆ�ü:·»ú[±<ìÕñùJ°þ§�jÚ.˜¤¯
+̆èöä…“À}ø‰Û½c¬Ó'kt¬ÀüEqÌõ€�‘¦uP¸cëÅG£¼~ÀGŽC±W‹¥ƒ¿ÄÑïH0*’£ðœë¼ú©tPxc;olå�¢œ·5 3¦ÆMið°
‘��C}Žt4¦=LxAcHûÄ»­oÙu“íŠÞA©WGÐ&êÂø¦<ð>àu•ç^
+)¶»<måDi³h¶i6~Î#,„>–Ÿg£ƒšàc tREZ0=dÄ×?¸}h?§¾Óß“*FA=ôø2
´}\Z
+’w/*à×S^á}	邯$@wê¿wôuKƒï‡Ï_¨±q—;thæ·<¨P<·oèûXc�[žKh�ÚžPéñ•û_M=J€È8½ýËY†õ¼õKЧØHt$“.‰}­WÒ׿hNm–µ>Jªü¹,ªÉ3ƒJ_†ÏÓòå›p»°<rJSµÆ⩪ýÍøi[Ê�qÃ.\Põ¡ÎØÒ
+endobj
+1205 0 obj <<
 /Type /Page
-/Contents 1207 0 R
-/Resources 1205 0 R
+/Contents 1206 0 R
+/Resources 1204 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1182 0 R
-/Annots [ 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R ]
+/Annots [ 1208 0 R 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R ]
+>> endobj
+1208 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [154.2681 743.8714 203.5396 755.9311]
+/Subtype /Link
+/A << /S /GoTo /D (notify) >>
 >> endobj
 1209 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [80.6033 407.9328 154.2566 417.1482]
+/Rect [80.6033 320.3921 154.2566 329.6075]
 /Subtype /Link
 /A << /S /GoTo /D (statsfile) >>
 >> endobj
 1210 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [265.4578 363.0047 326.6578 375.0643]
+/Rect [265.4578 275.0376 326.6578 287.0973]
 /Subtype /Link
 /A << /S /GoTo /D (server_statement_definition_and_usage) >>
 >> endobj
 1211 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [367.5441 363.0047 416.2908 375.0643]
+/Rect [367.5441 275.0376 416.2908 287.0973]
 /Subtype /Link
 /A << /S /GoTo /D (incremental_zone_transfers) >>
 >> endobj
 1212 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [280.9692 332.6817 342.1692 344.7414]
+/Rect [280.9692 244.2883 342.1692 256.348]
 /Subtype /Link
 /A << /S /GoTo /D (server_statement_definition_and_usage) >>
 >> endobj
 1213 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [277.6219 302.3588 338.8219 314.4184]
+/Rect [277.6219 213.539 338.8219 225.5987]
 /Subtype /Link
 /A << /S /GoTo /D (server_statement_definition_and_usage) >>
 >> endobj
-1208 0 obj <<
-/D [1206 0 R /XYZ 56.6929 794.5015 null]
+1207 0 obj <<
+/D [1205 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1205 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F62 995 0 R /F47 879 0 R /F14 685 0 R /F39 863 0 R >>
+1204 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F62 995 0 R /F47 879 0 R /F14 685 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1217 0 obj <<
-/Length 3673      
-/Filter /FlateDecode
->>
-stream
-xÚ­Ërã6òî¯ðmåª!
ðuœL<Y§’ÉìØS9$9ÐdqM‘
-Ö8_¿ÝèHJ”&³»¥�Fh4ú
…×
üÂë4�Êôu’iat½Ú]×O0öÃUÈ8K‡´c}÷põí;•\g"‹e|ý°­•Š MÃë‡õo‹·ÿ|óááöãÍRFÁ"7Ë(ßݽÿž }ÞþòþÝÝŸ>¾¹Iôâáî—÷þxûîöãíû··7Ë0�B˜/y…3ÞÝýtK­>¾ùùç7oþxøñêöÁŸe|Þ0Px�?¯~û#¸^ñ¼
-„ÊÒèú
-%Ò$Ô^‡Pàyõ¼l݆{³*6¯,¯3»@3á%³ê›XL‹Ìn¥"�‹Ÿ*. ¯rËlÜ’®`^ÊF(žªÚ« ñ�)Eæ%É”‹ƒúX¡YS£¬ŸBŸCÞTxBÛÙ™¶ÍŸÌ¬0Ý_â†NEÆm�ù妩wËU¾²çÒòÌm„‰ã0tÓW]Ÿ—V³`ÆHeµSChË QoŽF&»uŒT¹åH15+&2é¦åcG"KŽ4‘VÅȺú¹ß£EÙâå¡$/Ø:lÑ~â bZ¦"¸ßÐhgXFïV1Vè)Ú!*xõ¾e ÐO\›¶ 
X3ÞlÙÉ•[N©æÔïÜKZdOà,
-#´ª‚¯º
-D„€–ñ,d<‹›¹ˆŽDèúm?/a¿n�ÿÉÉõTùŽ}Š' Eë<PµdªPõ^Œ= üÙ›¦p¾�î 9Ïâ5ѱåÎ…µ¼Ÿói�¦¬Þý1M{ó™Zöà¸bõ:¢n=Çt´ÞhUjÍ·’
lÒìønåȘcí�Ó÷w)u¿?�Á^3zcš&/
¡¡µ8JÒâÐêš·eM+1cÜéè†Vlë�™;TÝ¡˜€¨I
-¨¹g¯RuÔ·«8lj
¼–Wjâ% ìëdq_T+s„éTN²HKâ|§¼
-yèÑÈñHÈú–†˜œ”ïRaDS®ú2¶´�}bG¶Ębje¬~&ëö<
-¯9Tw2rœ3g+ë§'kÎ4Wð´«àéȲñ-
ÿ
ŠMÅ+è¸;Á6›b9ã>¬ «m^=^b•ó�¼¾½œ]ÑuŽk«á»†l¢íˆþ|Çû H´41Ÿ5?>³<‰iýl,Óü3²Ë|‡!%Šb	É™rè�.êåLŽä¬ånMßG¼¦)4Õ
µQ~ׯ�+BÃõ¬#A±¢�UŠM4¶[fÌ~aZÎÝé¡XÛü1€Ô´£/‡ja>ïMe­x@	,ýÙrK&‚Þ~øÄ+TÙ™]mó6hƒwnû�ó§ûhg_¨¶¡ã2	Â
-}¯’a‚Uè™ûäèZ’ÞaÃëv¨î ©€%ýK®4Øp_šŽê
‘4®
-WsB[Y#HUG’°ñ”-“8}°U(ºW®0�ðÚÕ³:1“LÕš¾5¹æ,�h»‚1׈³„£ÊvfÃ(‘Œ\®Ãzqº°RBeq<òù3µfˆdâ^|ÈGÎD±��²&9ãà
Xn§GºÖ,Uˆ¡SšSrû°-¬q‡&Çë§D�-RBBozû_ÍØD¤‰d¢ÝíC¬]	DNÂvDD¬DÙ™,E&c·KÝÌñ8ié/ñ8?-X³=)ì1w±•È0gƒa™H§’är0<Æ:{,Ë�¾ìŠåÀ‡I쫤óizyw�5³ýô]-q„Óý¹ž¶Ã×sbIVaÖ^Bƒ*åØz­{ÂÙÚÀAöûÒõìYÚÉ«e›±Oþ¼©Þ鎒4ùò£ÖÜ*|—ÑáQÙÿȼ å)ت|µs‹Ñ˜Ê²ù"Ø
-„êoT9Ò¡Ê!ÓÄ–E×´—ÚRW“JÝËM’9•Úúm‘»	ýîÑÚ”êg¢‹ÿ±m¯
-¦’¾]�߀±ÕÀòÌŠô°RƤ¢YîÇ#§´ÛÜ2((\µæÚlr¸Xÿ&0SJ•HPò.½Ûñ
ÊyýBö&`V.ë×ë‚~9,+HÓŠ‹&§
-–	¦úòökfÿÉQ#�:H¦ÜV¤éâû÷÷÷·o±�u×=¸ØŽl@@{I‡Éhñ©rל²¦™?�fª�†Qø•â~Å‹oJSVí`—œ·µÿ9€~Ád®k‡�2Î/™àSTMÅn8È�ZPçkÄKk¡Ó8þŠs�•¯0
áˆÃì²|�±ÎË—ÇÉ×K^ë܆ÙÇ2GBÆIv™�5CÃô¸��:SS"œŒáK‡“1l�¨²ý‚¿NÌ¢T-Þ×�™ñ®¶”gŽ±'jtDWœˆ(ž“é…w‚в¥fW�ŸbØ·ðÀéå/áREMMü™"Ö~”>ŠHYÎ{ëæÿ'!MõÿÁÄ…Ó„Äù²Ž°.ˆ ÃÝ
¶KÈ‹†Þ6§u4ü÷C¤.“á±fè˜ÖÑ20:!ä�¥
-vÀ1´§Qj#W0…QƒØ™½Áe´±G9Ïß¹I+,îPG¹�ÏõG!/¾í‚ŒÒ¯ýï†a£:uÀ/}YŸ#óéŒû2wYW×å«çó�RpR…_¨ÐŽ�ΔCÂsÛg_Œ]ŽEò• ˆôÅm=Òé¾Ó¿ó"Kãd²1ÿa…ªH TÒÆ¿~ðK4±F×�¥&³úZ•Z´]Þø:G^Z{öã,Ä°ñN�ú€ðè!ø†NÆ9:ˆÆlP;Up
�ÿÆ¢ñ¡ö&\¬–·‚(jY5~ÈýÆ¿TVGo–îôôg '/ŒN×�b7;WSlñu²
-	×Ù1åþ¢§¤ÿðDÂendstream
+/Length 3807      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥]sÛ6òÝ¿ÂoGÏT<àøè¦N/�6Í%ÎôfÚ>ÐeñB‘ªHÚq}÷ )ÑÎåj?X,€Åb¿!uÁ¿º´I™<¾Ìò8L"•\®÷Ñå=Œ}¡gå�VS¬oo/þùÚd—y˜§:½¼ÝNÖ²ad­º¼Ýü¼ú×õ»Û›÷W+�DA^­’4
+¾}óö;†äüyõóÛ×o¾ÿøþú*‹ƒÛ7?¿eðû›×7ïoÞ¾º¹Z)›(˜¯e…g&¼~óã
·¾ýÓO×ï¯~¿ýáâæÖŸez^<È¿þ]nàØ?\D¡Émrù�(Ty®/÷qbÂ$6ÆAê‹ÿöNFiêÿcÃÄêl��ÚL¨"hÇée–äaj`ø[éº.7p¬<ª¿6ºª¹gЦèn�WÊížám¿+�<Pý®=V}ÑW%�þÙ6e'£�,>�o˜Îàu±Þ•À÷8I‚7
úv/£]Õ°nÛtnZÕ	­rX°R*Ì“DÓy†fSvÕ±¸«Ëo®V&2A7¬w8CÍ4Áã®lBg
+ï·”þÝ#M¼ÂKîÝp•(�ű¯Ê.Ťip]w-Cƒ*mµaÑHÝÂô®,h:1ú[8îì(¬¬rwV#µ^jQc_9!ƒ‘ǪXw(‰<
+m×U .?ʦ“!ºª32tðÇPáÜK×з¬ø|Q][Ó¥
+lœ­ØHÞuz±E(ˆ
♞¸YtŸ:nmÛ+Èì¢áïOÿá¯Hvë×Úº­vm×#)`›ó‰iÑÆ„™Í3 )Û¶m(D…kPxš0³ELPj¾PN‚‹»7pßsZ�öÁá‰	X�1ÁRÆó+ûMëx�Ö8Ì­2²3:�¢@EüÝUíIoÊ~�teÙ4—p¢_M{ÜuMÜŽÜ!èJEj:ÌO%Àߢ$º–	|¾(¸†?€+î‰V�²^G¡Î”P3£_˜“¤!˜|=gÎòÙ`­(5V]T10|O dSáûXÖ5²A+@}jÚÇF`å™\€‚«îÑN(2¨O²Œ7ÃÐiÚž•Ÿ##S¡"
+ÚLÅ^…PÞeõ©lx(×ÕöIÄuah:ãx,×ñó"‹›&6ÌàÞçzÈ나�[ò­ÌÙ„
Õ}Óz
d>ˆYd^–͹8jO"Ö
+u{/ñ‡Å±áX
:{°~Å}¹$K^bFlC«¼±%~µ=¶û…X°A¬Ÿ¹•…*UÎ:k&É@㌉ÂÆN	¡ÁƒE	Ó‘Ùn½ 5n9VËXÔä˜5“بÒ$̳=du5)r®ý4P…ˆÒP\Êâ‚-Xq1‰§Æ°�D Í õÅœlbjrPS´B8TÉêC'@ ŸH13ÝÿFˆðF‹&7ný%�ZÒB]DÐ(Jíi¸sIcô´=ÅBÆ‹”‰‘KøH,€®ß
‹öËÎ9Ÿ‚ýNSìÅ¡x•Dÿä~š•…Š÷PÒ�
+ž
+&AêV„Üg ˜KLð!é,6¦JÂëVâ’�îвS±’wå.‹ˆKÒdf¿c„÷7¯?~¸ù.d8>š¸si™=Lrñ‹"Ȫ7¦jp{136g¼³BÏ{²JS{';Ä?†ÑÚR¤ÕO,žO3‡ž=ÿHÒìdxVx‚x7±X/RaÇËu6ÁYM�¸J¤Êl‰³Š~½[í‹Ã¡Ü¬0�
8MžÒ £(Lmœ¿H„G:§bžˆ$� BD3%ãÍ–¥1¶³h)ÔƉòSudanô$Ù4–r
+ò©–m@’oÞ=ÄrH
+­xŠÎH
+@®jm>»ºêÐD
+ÍK·‰´x»] É¶$šT¡H]8*€q<#LÈÀúZ7
X�É9
+bB@Ç
w̆º¯öŽЙíP/Ù:ÑŒöNW%nB¢
�«føÌÍî	tßQ))eÅèc{üÄ-ÖÎî©ÏŸOå±)kn£â¶xYh‘2wž€˜[·¯ÞÉpÛ4\DY,ì8â8•…¯K‹`�#¸Ñ­$DZl‘’rLX¯Ë×РÇjª$Q"=8¯kן(Ã
+–ú–]h&É4Ø
gNˆr`[5Û‹uG�sÏ‚Ãp<´n�å2.Äæëv8BÆ°yÖÖ™T…&ù‚­› =oëî\}fïξpSm±2P‚õ?3y
+ö‰u”½H‹G:'ff¥€š8Ò3b~ñ|fótŽþ×¼hô´
+ãÜøÄ©Ù°%bë
6ÊG"
+"±)þ厽¹g¡7p’ëyL¿ÛXÊŸ=SSºÉ=Àaý¶=ÇÊ•™PÅÖd¹ÎÈ6�²kÝ»œèžø^¥¨tÆkWÂêÃ…z®ë_ŒN<snCÈ­]…XŠÂy&ád·°_’„‰NRÿÆCjq¾°1¡ÉÓtâòŠË:è̽ð°‹\ÒPGþˆ,rž¹—íŒêë³ÇýlR†N]>”µ´w¿¿g.P?'j…ï‡zóËÿjÆf¡Í´í.‚ìúD
+–µ"R&*Ê¿Èdæ:u»¸'¹9�UhÓ$þ�“é[‚{Ûsÿ&-T|TJÏFÁʦ¡³ðr<Åz>öXÄ�¡î«ÕȇYÜÈâ­}yw�µ°ýü͆i©ùþRÂ
ÓáK8©–ß;(1—Ð�s@ë©g'¿˜P|†Cízt–nöŠÆifê³>o©Æw¹“ìŒA¾â#¨­<¶âCL¬N“™¹u¡_*à[ózÖ–~f‘çËÕ
°:Ræ(oØÉ[ºÍ¨ºá}ÜO*\ʺ§š,wܳ®ôd©d[n°¿ã\D’ãç#¢ÿ±Í?쀅¹ˆOëÉk
°nÕŒLaÇ<þn‘ŠVy8:9¥ÝÄ q´JÖºÜp±þ`¡(dñ÷Ö¾øP'7Ä(Ïë—QaAöö²~M°^Ð/‡ERÑ€4­¥Zr®`y¨•�_ÞÞc-ì?;jã�˲9
7�„Öß½ýðá涱Ôz
+œt᳆“.lOH¢~%_'`‰5ÁÛ¶/ü*ÕŽÓܱôL�NÈJ³0ÉƧc~MÅ� ¦ì¸Ù·Ówñ*2p~í+¸NˆúæõLõK>&>‰EÜïÀJñäàÿë¦ó0²ñß1n®ð•„øãÒ…»�üû7¬ã|ã,4Ö>˜(…ÐŒ”…„Çù)åþÇ®ç¤ÿ"‹™‘endstream
 endobj
 1216 0 obj <<
 /Type /Page
@@ -4660,29 +4641,34 @@ endobj
 /D [1216 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1215 0 obj <<
-/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1222 0 obj <<
-/Length 3453      
-/Filter /FlateDecode
->>
-stream
-xÚÅZYs#7~÷¯ðÛÊUã/>*3žY'�Wvö¨$m©eu�Ôí¨[vœ_€
-˜âЊÈhÓXY«1+{.´òb�-¾L‹t›UÃ+
-@ßî°Â®é¦#]i˜§6ñ÷뼺€ÉÙIùTçe
eXOÛWÙ’(uI”Ý…J&YUïòEÍ-댚ët—.êlGô*«‰žK*T¯E�þF­åŠ;e»:ÍYì²ÜRÈ"¤M�–�%HD¬ƒ
-û*}„Át,')i“‚ëÉ
-�4%™ì]êÈLVÎœ@Þd�é†h벪9À±Åe¤oÑÁ‰R
ÁQÁ-ÙŽ­
•Žµ�oþá‘a�¸gÁŒÜd&‰V,”ß–Ë|ÚKÅf•Ú¯êÃ+ïNn((¾3bVÙ·É »ŒI›Øûyúô´qÉC+Ê·ZZ^Q ”/¦9¤yË)J£Hš]R}6›Q�&-ŸþMöTÎHøº¶ÑäºföMÅOkÁÚy�×¾—Ë|Ú–ñÄeré(æïi¯Ç?3jsÛ
-™<]Àš¶ºÝI•èP•˜U‰&·÷óQ�c.ò²Î×L|ø%ªY, ¡Aˆ˜Ë|‘ÖÎ¥sZsCMÜu±žR•F~†ÄÃoÊòËþ‰%¬ˆ–RÕ1¿œÖ%+†¢åÃ5C÷¾¾™ÎÞ¿Ÿ‹ÙüöÂjr/$ßFC’‹nnº¾¹Ç\$ ã£HZØÁMrDu¹Žƒ¨†«
³íoCÁÖŠ$”ÉiÁžiDpo—“€
-gbCñ¿}o"ÄZ–î*îQvWÍ@LNéçú–«Ë%cŒ£,§_hêä~C>EÃ&+
-P9@µ‰Eûtð:ŠYT l`lzÂ�^Qg,k_�¢ól¬54õ|ŃK-"Úþ¢“ј­öœTRúÁ´¦>¾R‰DñáÛá:¾ž«
ß¼¨³GXÝ×Ãø…ƒ¹OË÷L#òûñ+…N"ÓWà6Û�m�WIL¸ÎŸà„tI4ô*µZ:§zEM.îá×»¶{ÂUã,
m/åáPݧ=䄦»ùENþÉ!œˆ(‰!<„Vp8VÝ�ÏM˜
È��Žè¼3*Òù^!ì�‘+bÏÑÑ	O¯8–7ûŒzÈ"û-¯¸+¹´ÁÓkÔ�Dsˆ`:U&„guÂ
-¦Háˆqø±‰­�#8�U¬{@>‰hcò»›Ù§«;¾IQ&‚ÃGbú®zÔ™è’gÊÇFÄ‘6_‡ä�8•IPùÞírwª†«]°j÷|Ò«NË÷L#òG|Êô8âS&H¾Æ¥`U×¥¢„]*²Þ¥€ä]*6Þ¥€HwaIߥ [»DcùˆìWM3ùJ,‰|àW¡"çÿ·_è¦;íV-Ó	¯b¦ŽSÁYñöÁJ"”Ôú¤ì†éPxÿ
Å™˜°'ý_´ÞA4y"0F ?ˆ{ˆ+à
¹º¤6¾nƒ’‡ÉA“9€è'ãȼG
ÙáBeص]K`ßp"8F©äkpýñ5”ÐEFol8]®«è¹VÊvå´(§U™Nëzs¦µƒÐœV áÑ ¿”1l$QÜW�×RyøWïá`
Ç.·@M÷õÏqi�?ó}h�à�kjøº„$�Àèî5‘ðë>Û5÷«”6�Í_°Þßÿ@‚AþN8!êPX«Ñ‡N*oÚixŠ¿ßk
-üœõTp¢¤‹
-À…ý7B
-þ@’�Ò]r
-äÝ—ŠŠtµe
Ð�Û»»P¤Òë–X*~iâŸ8�Jfüc-–¸^P¨É²3ºcs—+Xl@‡ëôJÒY
-w¢[±
-�GF|‰”Ç�=¾¡-�†©lçÐV´Ž©Ä_Ò(Úø¢æ

+/Length 3299      
+/Filter /FlateDecode
+>>
+stream
+xÚÍZ[sã¶~ϯð£3³æò"Q⣛Mö¤ífSÇ=—iû µåÄGr-9Ùô×€
+Ìf¥ŸiÎg†E+âJd×±¶Uv�ðN š’6:}¢‡W0Á!¶	Ix§l ÙJ»„Ùþ(å“àLIë`Bj8˜:¢ÒTè(V<Ç"[®úŽ¤XDN%­#	æîW]cMkµ‚£§gBg Øþ}š¿d›¢O�
&Ý£¹’ÕK¾©|r$ ë ¯ŒI;ðt⃇Ï`Ë••Ö"ÆS‰ÔÙ0Nû¢¹OæBЂéÔž¸�}â#ö�øïâ#ä/å¦w+œ0Æ%íð8€I®��Ž4ØB3Œ½Gh«Á(épëýP[3\xsy•ßg+¢=”UÍŽ=>B ý	
æI
+x
+ö
+î�HNÖ†‡–µ�oruAdØ'Y0#w™aªåÉŸÊùrÔuKÍfÅã®{TÑ4ЀC׈³Ê`“¾à¾g[+Eb’
+8‘Æ2=-80õî–PÐ¥#ù%£L«€Ćü~»h"øZžm*Q¶ÍDLÎèçú–çsNe|} G_èj…~é·áÄc?GŽ¥pÒéo=#AÚg¿T:¡–2é~Z¶.«jÙ�ÏÙjjÌÌ{ŽlÈ#¢4z#Ù€ä5Õ�	ÃDÏA
+‡Vœ˜ÿálëƒm„‘Nº7Rÿ6×qØ6\;ؾ,WóY¶9¼
ÑVDR�˜zÄwŒfì�:ò)÷×&Ú]@;Ð(÷׆1”ƒšt¨¬ ‹Uuþl
+¯§	ÓFFNš”%.N�ç:4r"IõÞÓÌ
ìš¿Ùê	‚ ¶#h¿d¯pTüX臇|ž½*¡;ò¸Û6a]óòáw[@ê
5¹?Zuðqh´WL”§¬ž=P™êUƒ"uY?<‘
+¾þˆØ*R
ñ~FËž½ÃN^?t‡åñK¾*_ˆZ—kf\�­�Q¤jzvFÁ�-£xغT8e\oqãcOˆG"	µ:
+¯�z eDbµù¶:⨴5ØÞxÙæ:ª†k·aÕæù$ªNËL=ò{0eº
+Á”‰Òo�ì¢jCʦ)뤀 •˜
+Š]Lø^á¤BI­O‹o¸zäw_á!S8/:
+ü‹ßÚášB~í˜t²¾ˆ“‚êõñ•´Bª5ñˆa=žÌ‡�}^IÒŽu·£ÀÜ{襜J¿¥¶8º“*5Ô8¹“m®ã;Ùpù|-ß”£¢Ue6ªëÕaB¯EÅæ´
W�ݽ„-Ô6éªÀ{©B
+Zo¡¸�ÒÏïP³mý€µdV/ŸùN¶À”ŸÔþ.$yÅ�>�‰^†z*d—¼Óé�Dñé”
+÷š@À(«�…Ó‰:‘Õ‡‹óÝ2e¹ÿÚ8¬‰Ó¦
+ªÚƒ¯þ ‹ÖòÛÓ�8!�ü[ŒëibÕÈkq�@^àêAÞh–�S~#EC¦rR�†«G�îK»X$¤3E
+2TÁ
+k=‡ú‘²þÑcõx˜—@.aÝiñ
Ó¡ü.Ì!}‰eW
9:¼Û¿Ïñ»þœÈ?…îÉäîúcEÄE¹‚ò‹o¸œ¿Š
êÏ·ü^å²=!쾿š0ìÎ;~põÖM›óuÛ»ö]cxÑ9ÏÞý2iåâáw?Pêü«”&»'¢.Þq}¸¹ûáò?Ä8™pgI¿Íg)Ô½\„±>7�ÖcþJ]Íg<@üÂ3ó5)€8ÍS²
ó=-¼EßUA¸Š�wË0vh»„mÎê¨[/ àqWíâç
+þÛÓZ;'žòKY?PëeI-ËE-“ $f*ÑÀ΂Z|™ÛúòÁëØç{à¡BcbóWŽýP!Æ?cì�¿l>ŠûË_Kî>%�ð­Fz$Á×I
+E4LÂJ¡ât¥Ú
R€�t�êÿ£„‹�endstream
 endobj
 1221 0 obj <<
 /Type /Page
@@ -4694,149 +4680,149 @@ endobj
 1223 0 obj <<
 /D [1221 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-354 0 obj <<
-/D [1221 0 R /XYZ 56.6929 183.6365 null]
->> endobj
-1224 0 obj <<
-/D [1221 0 R /XYZ 56.6929 158.6249 null]
->> endobj
 1220 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1227 0 obj <<
-/Length 3161      
-/Filter /FlateDecode
->>
-stream
-xÚ¥]sÛ6òÝ¿Bo•g*ß
-ò÷ÅñÙ
-ŽýÛg*ófö/œ‰,“³Í…6Š­T‚TŸ.þÕmØ›
K§äg”gÆK7!@©zÆÚΜɘU0…l8‘7ó¦Ø})v8Öó粪
-Ó[Uuý™f×õ®›¤A¾mž‹K1�ð²mŠj
¢ÔBϯ×($¸Ë¬ÇŠ†9é28
-j@P�8[®ñk’N±m	oh("kçA&0ù˜)†ç£x�“{>Þ’¼Kßè´cÎðä]¢µÑrô?á}îšvÂ/yɬWÍ£H�™ƒPñc\¿£ç¶niÐ;
ò8
W×4E1¶se=:9³”ÔM˜&w3ÜöL¾Ã_ôÛüñ¾Áæ‹%ªO
-¥’I5fHË 37`èÈótX¯°q¼²Á&®j¡ÀC;!ÀšåI™‘Ia™‚ðÍ9Ÿ¿ÛçÕ¢ióåg:ç
š‰¥�ØÂ3Ú¦¿N)KQãDCïtq½�SS
-Œºé¡®	¶‚À*G…�è%ë]K3¨þ®wŸûû×ûíŠÞŸB$EÐ}Ul"4P|Òvùò1¿/«M7[í#{)¦�̾ê„ŒÕmÿôxŠêIƒ¢„
âøúã=Tg€Ød ô$׃Ǻ‰{m€·r[œŒ—Æ8¸÷J¼ìc�Ž—žqÕ]ã¢9Üü nZq>3çyè°&˜DNZk¹r1ˆœJ›(¥í|›o%ŠÏQE¬ A0å<ÃÅÐ|¾\6Aƒ.
쾦Y/-lÔ	&í…8ff„öCÕhw�½¡* o·™Å„m¡œGWª\øGÎ	ˆQ¡h?b‚4Î¥ìç7ûpj€ÞÉA™	¸H²ŒêKšxŒ¸‰Ò
Åóz£LG'ô¼;fxQz>æx8Í]8BbÊ(“˜#~COT%©yЧ˜hò.–‰þH/AÿY†Þ‰ŸÑÈq01Lðl´$ĵ@!d5ð,b$[Ƴì·Þ¸P°x&<ªê F
	ZÇ8_{òA«Í#Ú}QlSälð¦V'ì|Yo6A³ð¥"ÁÁÓ°‚=Lùné¡Úpàåé€xµqùBOˆCæ¼»KÒŽ‚
¿o!zO›ž ÞÖÛvWW¯ƒn�–$<�RP
-m^VÍPƒëç¡E„2rý’"[4“Á]oÚÓµŸ†šÉjãÏDz>ÖéXÖaÆJ`
é#r8Žb`"Ú»W¨wXäQLƒ½X?¢?¬ÿ¤˜??–ËGÊ"´ËŒx¦Ê'Ö‚ðŒGíc×E;Š	³tT �RWàþ"(X
àþ·ÞF�ólCT?I¼±2¨9DËŒ”zèC¼ñ)¼À€¶ÄÑÒ´TÜ�î%ó,ëãû	tU	e"ò&¡Ý©LÄÑ}¤×ë] ¤u‘·c„’ŒkmãÆ�ï‰6‰aÚtHoÀ1@Ƀá”(ÄÄá¼R”xK—�

¢hB·LEbÈA൅@<É&$BÎféø]Šk^YXëƬc&â ™‰|”q³þ!jù\áz_á{l0zôŠDCZÚoM ,ËÂñ…Ãxmåðø£S?ü:ðRŽbì%퇘Ó)?¦Å
-¯ ¸“ILYší»‘\F‡1žIaeßÈä
Èê<ø.ÄDk®yà#\<§}„—°—Î^qÃd6á"¤ç�$^AÔ[zÖ`ýpš

-ç°˜y\q^n c!ı/ˆ2S¨Ç#S½^�-ßj»�3"{e2Ô‘y†–r,w�Ó‚Ô`Gm
×�}Mûu�{ï§ÛÿÛ·–­>½­ã°W¦í‰;›
-R;øJÐ	.Pf¥v�¹�K$}Ó»0cµ 
-Ì(™nú8Y1¿ƒÿr~u$ØTIÈ.¤r,èKÆìø–eŠ°zãpÚƒà§ë�œ½«áL³þ±Ò΋þÖá\vàbÀ³dÊuÐMæœÌ:K¾P_­Äºaþ²XæËK$õSî™[F­³Þ7	¨\·´	½Ä¾w¬tñyÈ5±®NF�”Ôah^Âö:R.�A~¦àHýëû>�P¶Ì8äü‡¯Kߧ¯Ôu÷¡¥n!²ž‰Hpsý!äèó
©Ã9Þ‰ê¨ÅDfz˦[<k‚‡a‹G1ã ?01lñ¨.9ÆaK8ìµ
Å!,)ÅcPÌŠ6Îâ÷³]\wp9øFI+Âqñó¤QÝ7µ�À‡’X[s£)9dÐü¡íÄ8Ž�ó}E×":Z-b¯_ÇžÈ17ܵ5nÀÌ®XîwMLÖGä@ÒÎólDnß•ÏåšÈ
]tìZÍklU>—Ídâ/N|]¼·¡»ÌÿM+¡†2Ù¸±6x°S2Á°
›†t$òPÕ˼Úmós¬BñUëç©’gž[Õë˜Cädê(´b^ÈW*Ø>ÖKMX'n|`§D&_¡Ÿ�&è¬ÔB©Ë1ˆõZ©=@0LVj{Écxé¬ÔÆ6¥Åñsœ&Ôp¢/Ô%aÅcìä?<&@§/Ö"ÖL›ðb”6vôÑò+ŒGƒOÖn”’­b5lÕ‰“¶ªÄú	¿qÊ7xˤÉĈ^Š{’,Ɖd1νb¬Ò%þÕÉ5×æ,é.Çöœ‹a+ 2„XÇЙ,ñ„±
-¨š�úÛ­U~›µBò!•Pç�µ‡tÚVÒAàû§dÜÇedW’¥s¤;¤cÚÃ
-¥å€ø°Æã‡�»®Æãý�÷Ì‘B
-Àf¿	µ
-Œß½lóM¹$ªð
-%ì¸ð8¨‰Í¢ÆbÞWÅö… ’
-ðAN›™Åt\¼Òmî°ôc…ïyô•Ú±£OÔÒræ¥w=>ŽôµÃ9OR%ÀVzÔÇ=fvê`Ê0üÕÖuÞÕZßýã°Ã/ç´#�þÜþÕËÌ%¦ð ætƒþ˜õÿ
ØúÎÆendstream
-endobj
 1226 0 obj <<
+/Length 3218      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥ZKsã6¾ûWèºj„/¬œ&3ž¬S›IÖã=l%9Ðe±†"‘²ãýõÛ�nB$EÉ»›r•	6@£Ñ�¯AÉErᬈufif„�¥]¬vWñâú~¸’̳왖C®ïﯾý¤ÓE&²D%‹ûÍ`.'bçäâ~ýkôáoﹿ¹»^*G‰¸^Ú$Ž¾¿ýü‘(=>üüùÓíÿ¼{�šèþöçÏD¾»ùtswóùÃÍõR:+a¼âÎøtû÷jýp÷þ§ŸÞß]ÿ~ÿãÕÍ}ØËp¿2Ö¸‘?®~ý=^¬aÛ?^ÅBgÎ.^à%2ËÔbwe¬ÖhÝSª«/WÿzýÐ9ýYí„u*�Q ’s
+´™H´Ò^�¸g	ÿ@q;lö/ù~]Ö�¸5˜@&ˆ°wa•IýÐûmq½Ôqmü ké"?h6Ú䫲*»WâXå5‘xÈ¡-ÖDéfñyÇ9uW4ñ#SÛ²+–/庠ÞU¾ê…hx…œe*^xD±.öí;x“YD‹¬+4‰º}¾Aâoq¬V¸iܦ”"³–L¬�áÀjâ¨*ë¯-5½Ô:‹Š?»b_çQë|WP‹WEsJ³è¶#*©
yÕ6Ôzà
 �k­³{¶ªy¡æ‡b_¼úÃ+­Î«ð mÎˬyxÝ0a›?ã­)¿µuIúX!ŸJ£|µ*Ú–Ú^å`Ú‚·5nµèP“&‰1¼”ív8$�ª¦ùJ­Ãñx5•Íž¨¨&^%¯__ò×k)e„º2Š-p`LÀÕ¬V‡=�hêê•&…ŸÙS·m@•ÞIƒÎðeƒ«cãe[®¶Ôô{Ã)’Ú%ðÚÃF~€9÷e—wå3óçõš릘²{e�§Ïëö%L_ó³ã�Þ†ÅI$‰El!È%I
+{KÕ|äd¦å�ë¼ã.Ô9ízº®TRØTf—\3+#†T‰°Â×héû-êXg*jžºÒ;n&£@£Ê®Èk°�Í¡¢žrCt2I ¹
Ъ²íÆ’
+ÇörÆr�Ϙ�˳pŒËöxô£Ì	ˆÖ¤™½,Càšb”;SÀ
IìÆRŒr§6–5ƒåW_C
Ñ—UðœäQäò]¬GðCý¡à3\ˆca×P¯åCóS{s‚Nj>Ó%JXiܤøÚxCSÀàžd	B¶¥N�¯Ê¡Fù¹H¢è@E7@¼,{h}=þÂþÝÁ慨ZJÆL/ušϨžûŽ-óöëá:`ø2z¤7®3 ubçr¼ÄxP}ðs›ãæLœúÍ!…A£êÕÌü-=Ñ”°¥#oO5ã
+�Í;i./¸fVG!ùâþhùq:Ú0`Š…ÐÍBú1
+9‚šžØ~%BÓß™ät˜E?¡®þ–t6¨`Z�ÝD/“ÍX'”LÔ0¨>�×9ˆ-±”3—3pÌ£�êà9#œ‚¹LöFˆ0 B4†åâ°@¯ÞÔPˆ Õ;z6àýÇxp^	—*c¦Ñ
+1PJdêuHÔB©A„»–P`{«ÄÂ!z]®òÕ54zóW¸[F—gƒÏPºÖ4	½ðÕ7—ºø<bM,¬û
+cÀ@Fš:þ<s�—É
+Í^éâÝù[u
+Ød(ÁøzG\ŒMÎHØ\ÊcFÒºÿ‚Œ‹Ž{ý§3wŒ6øFxü½yi­_ÔFÊÒ1”Ã&±§éiÙãb`NÓÉ·Ì Ãi¶H$<7´q#9ÆÉý†ïCN¥I R'6	³/ð÷
+endobj
+1225 0 obj <<
 /Type /Page
-/Contents 1227 0 R
-/Resources 1225 0 R
+/Contents 1226 0 R
+/Resources 1224 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1219 0 R
-/Annots [ 1229 0 R 1232 0 R 1233 0 R ]
+/Annots [ 1229 0 R 1232 0 R ]
 >> endobj
 1229 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [367.5469 658.7781 428.747 670.6783]
+/Rect [367.5469 543.9652 428.747 555.8654]
 /Subtype /Link
 /A << /S /GoTo /D (zone_statement_grammar) >>
 >> endobj
 1232 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [483.4431 456.4665 539.579 468.5262]
+/Rect [483.4431 345.7585 539.579 357.8182]
 /Subtype /Link
 /A << /S /GoTo /D (address_match_lists) >>
 >> endobj
-1233 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [213.0783 62.7905 261.825 73.5749]
-/Subtype /Link
-/A << /S /GoTo /D (dynamic_update_security) >>
+1227 0 obj <<
+/D [1225 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+354 0 obj <<
+/D [1225 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
 1228 0 obj <<
-/D [1226 0 R /XYZ 85.0394 794.5015 null]
+/D [1225 0 R /XYZ 85.0394 749.7875 null]
 >> endobj
 358 0 obj <<
-/D [1226 0 R /XYZ 85.0394 642.7523 null]
+/D [1225 0 R /XYZ 85.0394 528.8451 null]
 >> endobj
 1230 0 obj <<
-/D [1226 0 R /XYZ 85.0394 619.131 null]
+/D [1225 0 R /XYZ 85.0394 505.7912 null]
 >> endobj
 362 0 obj <<
-/D [1226 0 R /XYZ 85.0394 502.2708 null]
+/D [1225 0 R /XYZ 85.0394 390.6092 null]
 >> endobj
 1231 0 obj <<
-/D [1226 0 R /XYZ 85.0394 478.809 null]
+/D [1225 0 R /XYZ 85.0394 367.7147 null]
 >> endobj
-1225 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F63 998 0 R /F62 995 0 R >>
+1224 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F63 998 0 R /F62 995 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1238 0 obj <<
-/Length 3053      
-/Filter /FlateDecode
->>
-stream
-xÚ­]sã6î=¿Â÷fÏÄ\‘ú Õ}J·I››ëv›ÍÍ=´}�m%ÖÔ–\KN껹ÿ~
->™§±�F¡DR¤q¬,ÿ®JûIÌŸÄjºÈé�‡|­,3°E(€ºfœmV7ù�
,2”zúèvVùSvØ4ôRÔÈ»»Èt¦T"�©XNþ3›'A0-�¡÷´ü/}ÔÓ2˜ø“ûæšÈ;�"CyVÖÌì:ããKf›4D» Š6'Ý(�
-#Uì”CÎêÄGÛ™«HO_‹ÍW†”�]¾JÛ|…òéôq–ªiE8y™-6Œç�†uG±@ùš�k4”§ã˜žR)d¬Ë|Á¸AÂ
û—̪ÍÊ£Óìû7U‹ÂÎgbËj ƒéK¶9 Áàº3ØÓt]Ž°.Ã\™?vÅÃ¥®i„®Ié>ÙŽxcTA12Hø“‚E8ÔÐç‘^–Õ¡kÞÙ«©V‡%G(A3!Æ«®R›â%¿ÆK'+Ê%Þmê<l€ºÞUe],ŠMÑ	
íÎ"x‹
-hc·>VÈn¶Jž:'ã
-D'iŸ²}8[uõ½Ê›¬Ø�ÑõŠ.
iD¨ Š\¬ºXçë�Õ†Ò—d^K°ÝšÒT¯DˆÀ„¥/óà±F˜è•Q"Œ‰úL<®1)O«ß¬_3LÀ<�¬ñÁ&éäó°¨·Ue
÷�G*™>Ñ÷[Ú½�ÿ¯bHBϬ\
>°Ñ/‰…2QÔ÷¦Ÿ•ŠÊbAé
>Ùd‹|S#”Þ‰¶ž.Š2Û»8˜'M:ý*œ62)ÓQÀ\°,	ó–8ÞÆÒú5÷…ǯó’ðW9…ó|	
iu=º
-ÔÕ’	[œžH)#Õ
Øô6/[ŽJ‚+­a¹Ìj[À‚i7©@QûbeˆóÜh#TlœÆÈÇj'jG}`Ðk%ýzä²úÒ@GC
œ_>9dí(ñšÓôÚ' ß«´Žì“8òÈ Ö€´°†zÞ{Bî¼ì½¬Þë°PôŪŒuµ9)/d EIçòÑkäìžã‰
-Ù9�„¯,7Eý [ÉDÄ3°h°î±OzÊ 9Ò+tö;{ªol_‚!ÅdûÊé°±«övKîÙSåÚé
׬Fûqýê Þð¥s+¶:xÁÍQ?”ÂÆ¡¦ük‹_tÃéí:/çU9"ùÜãö̈BÞh6
=±ùÒQ(ãb]“ýJ=¸=ГÎÈ6ÔÉ¢F±á‹%i™1-Ù0í5èøôÍ6Z.¶5Ã6êÕØHCe}Bc½·æ„J¤Æ˜ñ)áÜSœwIÒµË_¨ 6ihÛ=¥Ê’Ò�ÉXaËþ…L:Šo1	5AÁ­÷˜´
ðmœƒ•��à%ùè:cÇ_tIWŒI‡ò¦RB%íèŠl®çl.‹¹ø²8àI§K¶K<|�S3z •
‹ß³É¶EŽÃaLt¡¢õjtôð=ľb·uÏ@À*ýRÂh_nùzÁ)¨Û‘²¶Xì;׶æ¿g[àâzÄ‘æ&1º2ó­ìعª ‚Z˜Þ,nØ”¾$íá
-Š»¨Gíobs("&oïdriΠûA4‡2Â9é ÞõóJí¦I
-´žÑÀ|ƒE¡ŸoHIó
€€ñ7Åò°ÉöôNzEŒáä6—¶qƒMû«`„ô3}¨´-Tp‡‡qô½�lHÉ“Ù™œ0wöÆ-ƒî(‡×qÓàŒ{vUÁþÙ/BN‡ëî8ã™­hã;ŠŠk£×uN?&puÑ–“at
-06�³-ÞàÆôÿÙ=œ
›Zzäv�‰?
fåX+óåíCªE…¦oj=~º5ÿð—ü³ÝƒÿðR¡‚@~µZ˜¯¾zª÷ã'ŒýÑPüKŸ‘™"üÏÜüé?(jÿÚ*Âq”93œTÚˆÈ
-µ«ÓQ,äé0Q#¬ÿ?-�endstream
+1236 0 obj <<
+/Length 3335      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sÛ6òÝ¿B÷tòŒ…ÀéSš:­o®iêøæÚ>Pi"‘ªHÙÕÝÜ¿],
+¶>¼lêbd{žhÆe"ÎÙT7QéÕ­aÑd&­e6Ix%Y¿g,²eÈ=Â
–Å*?nzø%I“1†¹ãÊ3±­ù¶,šúkZåžQž²¥ÃYaN‹ÜIàOÂμ„7Em
K$ºj¯]¬Ëö±Z™÷˼)ÎŒ•b¢ÕõÝ#ÖÈö=cpÖ˜þþ=cI4V‘˜`¬�Æꂱ"+ëã|·ihüí©Ìw›!|ûþ#Aé�5AWÕ� »¼n
+?þOU5˜©Èôô‰ô|&øSkE_�ZeÑ™×Å„X�çeQžÒn	àùˆMÁ!ìNÉÐYdÓ÷US´YçMD¬^6å'‚·ajž“ö¼ñ°öH``LuƒGÿów¿êáƒ;X2ð5Ë%-©ë¾^nÊ�›óz^çºbSfЗh-ÂEš<|šÐ౫5
Ö]0¢5gt�Ö‹fãŽÜ&‡Ü)˜²€Ü%~¦¹ë„T,3h9]HƒœãhòͶ¾l»°�sH×m·ƒuÅvÖÐvgÀÎK~X¢¢¯Æp\#¯3±F8é]ˆÑÌØî±ÎÍXËhÆ0fÃÖŒñ!š1<�íÈÖŒaÜš1>83†AǦ:˶ù³·×,eÜ
+Þ×ngÙx]~I*¦ó‚žIpÈ×Ò1S„"Cl�ÁIP—Ü8ïàf:QC¢É8¿¯lW{„f	WÒ;þÿB�$¢K´&þo,ØIÉkXsGäƒL‘¡"/kÏ,y
+
+‚�´ª“%!ßÇúò<Ñâ:– Í{
+GËãÂ+‡ä ‰ÅAW9ÈxïðÒÁÈ6åï6–
:àcƾ*ëÍ|³Ý4'B ïQ#
+dª©Ö=FÎKä€t}%(=uÖc ¦»ª+éׄì\‚Oºž t±.'«õ¡ÏzVŸJÐÚšâS/7€Â9K„¹ÎCÄa¢—(ͬU}&žÖ”§Ójï¯Æ/¹jPÌ&:"*åR/G�±Ã ÞU•ó
+T»!H‚:l–®r¸Ì�±L¤6HŒl¬G툋GÃõ_–5<@°ËU°Go !Þ]kmCŽáyô V�4ð­ŠKÖ›€Ä!¼b½¬+Ö°ðèó-äëj{ÞtH8KëêÖkdo9èFª,lÞï&á’7øÙn07ÅQµòm"p}
+éF
b¦'„¯³pänÑ�ŒkïÇm‹Zkv{z
+G—
+ªjà9¨¶ÏE`—*&Ål¦QŽZ­œó©WªŸÂŽxÛ�¸JÊZ¦ƒƒ’ï:õqî±Û
+a"ESùýž.ièy-$Á”IB1T^6z|›Š»‘N»Ä¶5 R±Ô$6¾Âæî-¨”VX!­rÈ~G6�ø
+>>5™ò	Ž«HЧÄE®B¡ ûêà: Õz&B!ãFàØËÑ-®_4*>t®ÅUA'Ï}YÔ÷¥vÈ)
+”
„¤!‡©ÀzCþu‚¯pù€{íÒåÐù¾×�oúAÖ�ןjŽ#R	Å%].Æ
+™B0¡‡íªž™…
+Öâ÷|\Ü�XÐÌJ–¢
{¶ù€׊ò½)È™a¶×~–#ƒ•$<AZ§zÔþÆÁ)K¦<9xúŠëk­=ØI‚!áûšt�éÆ¥	
$
+lz–‡>…ko¨Á@1–Uø€œ €æ·˜ÇÅ	KöùÁ1Á—ëL‰¶Ž÷ß—T‹ÏÎÙJë�\wN­ëŒ�FѤé±ïå¥×Ui|"²(­SžØÊo¸öäª}
Œ’
Âc}qíh¼Î=�¢¤Ï”püæÃÇ<î�	,>ìeá–¾Ž‰V¶ 7KˆA_ÿdļu¯ð­aMP'€>¾{K
 endobj
-1237 0 obj <<
+1235 0 obj <<
 /Type /Page
-/Contents 1238 0 R
-/Resources 1236 0 R
+/Contents 1236 0 R
+/Resources 1234 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1219 0 R
-/Annots [ 1240 0 R ]
+/Annots [ 1238 0 R 1239 0 R ]
 >> endobj
-1240 0 obj <<
+1238 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [369.8158 645.68 418.5625 657.7397]
+/Rect [184.7318 660.5919 233.4785 671.3763]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update_security) >>
 >> endobj
 1239 0 obj <<
-/D [1237 0 R /XYZ 56.6929 794.5015 null]
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [369.8158 538.8963 418.5625 550.9559]
+/Subtype /Link
+/A << /S /GoTo /D (dynamic_update_security) >>
+>> endobj
+1237 0 obj <<
+/D [1235 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 366 0 obj <<
-/D [1237 0 R /XYZ 56.6929 475.2364 null]
+/D [1235 0 R /XYZ 56.6929 372.9462 null]
 >> endobj
-1241 0 obj <<
-/D [1237 0 R /XYZ 56.6929 451.0522 null]
+1240 0 obj <<
+/D [1235 0 R /XYZ 56.6929 349.997 null]
 >> endobj
-1236 0 obj <<
+1234 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1244 0 obj <<
-/Length 2371      
+/Length 3002      
 /Filter /FlateDecode
 >>
 stream
-xÚÍY_sÛF÷§ÐÛQ7áfÿ/™<¹±“s§uRG}¸kû@K”ͱD*"eŸsÓï^`±¤H›rÒ±n<c­°X,ü
-çåœ-[µ¯èñJÉpxþxÇÇr�eNØ40W›¦h�×ï­´Éç^q¾xõ„
)¢žiJ6rofOÁ
-h¹÷e¤˜ÜB WëpŒr³-n‹U~åfCpèܭ/}L	„Ù’ô"¬Ý�p
­•ZÉ[SÅ
-
-¦{bXõ"=»jwñ˜œ„ìµ\-iŠùn•EÂñûº!"Ž
-©¥ÏAR¹¨XoVżhÐlR%h6¬~kš¥¼d,eü
-îÍ艋|™íVM(î(5äo¾]¹J
_§ö2àDHÃŒ„Â*F¯Uf]“öÚ{-4NdÊ0<^dXêœé¯yÜÉ)¦tš>�ëë§ÓV†�ô#õä¤71TÏ¥#«¼~¶¿èí¡¦Xkˆua¾+%jÈf©O¶cIn$
”y*»Ò2¢ÂÐ/€{}�^»ÇeEè~ïÜYÖ;·	4ä2a*¡›8ï�±Z„œeTŽát_±•ÑéC»€H-@3•hÈ7ž|
Kr¸UE<½±?éÞ
-pu¢9¦)ê|p
-?»ä`û8 ”†{Nû¥96'ùåTbp†e}…,”-Jë
˜ß.èA �”åTqŸïñËe…=5Ž~=ùDœ
Ó Íá‚%F«a”ÌÞaí—èV7€_€~øÀš1±Ñ%*¹C`OB“�Ì¿!¤D¢gH!>cÀ\UúL‚ìQ¼.Hx¸âT™ã:�äÕ2fxÈû°Ahª5ÿ0ë’À;1_Ùàw¬lHfWÞ ¹;
{è‹:uÌ‚Z“~</²0„M
-å[¼»zvØCÛj
+xÚ­ZKsÛF¾ëWpO¡¶óÂÃ>)¶ìUj­8Z¥j·’@Q
†
+íœxö‡JC'¤òïUWî*{`¸a1¸a…ÐÊ`$©MÀÍÑà¡:˜8LD?¸ÙueS3wö:-_ÌΡ-V!Êl —ã§|l¼ ¥U6X:È’Pi•:ƳÄQ4ÿ}òúáµþûÊw‹�'¢è¨%¤Ò£Åþ"£H¼\-Ò—/¿Wò•‡‰$`?ö%%íw,«
+ΙyQç‹
+õ1Ò¬˜@¬ó-“zªÕJ kH1Š(Vñ�
+`ª)Úú»Ž:>ÖÍq26¯Û#�bCsrúùÇ¡hQŒh§	
/‡ ³8¥¡À‚Tv9=^a@h%0î¾ìJAÛöËÂsà >Ž˜ý�¢;Šc>U<rÔCNìò`†	¢‘ÓƒF{°1:‘¡²
+~1Îtr’*ÅŒ@›(”Ò¤c+99´1@ò 5¯¶€×ÒiÌ›Yóñp$Â$SŸÓ…QÖûg¿ª¨,N‰Q)²””"ËJaA=uîÁª›-
Ø�ƒBÓÆõa»(x…µÕ7Œgr¼–M�þãîpÀ0Ö½+ÆûïJˆï+¢v¼VÍ–0�ßDfÊÄcC&‡cy¢ã%Þ‰|©€Ã�åB"5¿Ý0;>VB|¡z·l==ƒ	£¤ŒR»!>o#Á{¨4vv
L÷:8¬v
nìóij
+d@¦à×9j6Rln
+²–ü>/+,Œø®)Ã,*6_¾¦D¦z|M°&Êvº ,›½s¢MMñûûK‚!½@°ÃÆ›Wx{	ePDz-Ч‘M·pŒg¿’TÎæ¨"=I‹šc=öË/¿œÏ?2¯aNÏxÈ–° ÜR+6F™'JaÂo^ß°æSÕ‚Ç×Mþ`CÌe% (}Ú¥®–žb;´LkkŠv¼,!›«ˆ^Q,¸ã¹(ã‹åa_v'œ–j[“†.¬¢¢Å¸.ÿ]¸¾]Q¯xoª½¥óû|_6&îòÀ'A°É´Úh-æ‹êà—#*‚Bkð²�d:÷²ÙnMaDÉ3
+DÄq“O3˜ç/Z|1/Kò6pŒ–�CºG­G	‰pø”§@>™$“‚˜ÇŸÙæÉŸQír5‚¼CøŸ·
¾#ðIJ&ße+]öaê”M¨ŽOW]?5§W'«bËÜÂno	‚]z�y&ÿ„y€±Š§‹Ï©Î‹Äc_oóèA‡ÂÄ—ÔV"ˆuð�Œ¬¥Õ­écƒñÒ¦\”QH
+UΉá5}Ûfˇh  j"‡�R
+ÃY»{Â$¯×6ÈQÑ
 endobj
 1243 0 obj <<
 /Type /Page
@@ -4849,42 +4835,27 @@ endobj
 /D [1243 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 370 0 obj <<
-/D [1243 0 R /XYZ 85.0394 644.6312 null]
+/D [1243 0 R /XYZ 85.0394 558.6856 null]
 >> endobj
 1246 0 obj <<
-/D [1243 0 R /XYZ 85.0394 617.8313 null]
->> endobj
-374 0 obj <<
-/D [1243 0 R /XYZ 85.0394 131.6963 null]
->> endobj
-1006 0 obj <<
-/D [1243 0 R /XYZ 85.0394 108.3585 null]
+/D [1243 0 R /XYZ 85.0394 533.2657 null]
 >> endobj
 1242 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >>
-/XObject << /Im2 984 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1249 0 obj <<
-/Length 3641      
-/Filter /FlateDecode
->>
-stream
-xÚÝ[Ýs·×_¡·P3&Š¯»GN•il×V'Ó&y8‘GñÆä�Â#-«}w±‹ûâ‘RÚÌ´ÓÑqÀX,~»Ø]@êRŸºLR‘zí/3oE"Ur¹Ø^ÈË{hûþB1Í<ÍûTßÞ^üé­É.½ð©N/oW½±œ�ΩËÛåϳThq#ÈÙ›÷ïÞÞ|ÿ·�¯¯2;»½yÿîj®9{{ó—k*}ÿñõ�?¾þx5W.Q³7~ýáöú#5¥<Æ·7ï¾£O?'ýxýöúãõ»7×W¿Þþpq}Û®¥¿^%
.ä·‹Ÿ•—KXöRï’ËGø�By¯/·61"±ÆÄšÍŧ‹¿¶öZC×)ùÙĉDÛôrn¬p0ÿ´”•È”¢,ñ"5Ú´RÖjJÊ‘
-¥œošz^Õûrõ4^±’‰ð6Ë.ûÃMÞRMÌnz³+%ÅÑìß¿H©«¢¹šíf9þd³ûM}—o¨jS6{*Õ+j½ùÀÄËåîJ¹YÑ4Ô?c7«òmA¥¦Ø})vܼ_ç<VN=ùD@MQ1Á»÷·7oÿNå-Ì�ßà ŸË¹öÂhoaáJø$Ña�ë¢*`"è
-€åñœN§“¸U=1,
-toù"T(-hqʈMÅu}Ø5´ÛÃá`/ÊíaK_òÍ¡Ž¬O›?õFµÒŒf<�$�
-—
Î#©GuI‘jIår3‰$›	>ÔyNZª	V†hÒ"óÊ
yéФZ4©!š¢ã3!	ʨ©øûx¯ï£­£ÚàO¨YªE–JPèWjÆà‚o—bp©¸œqztl¼\é)l©[ÿ5h%Î
-è’œ‡VŸê4´ZªÓFª>ì�­T*”òê<+-Õ/l¥°Y08`æýaÏàBo„OqôJ;págßTá÷@ÂÖ*PkE¥èK¦B©Ýޞãè`Ã.}@y3¥ÿw
õ?n­«2V=©ÕHEªÓÖjRà,[ÿ+-Õ/Cså„1rÄL)##¤Œ”{%Ug¯ ìüNØ+è알آ¾Á^IÂÖbˆ[Ø^I‚WèÅ"a€¥"+6òÿa³¬÷Óì<ÀúT§
ÖRo½Ø•ùfþÛ¡Ø=Íw ¬#`”çy˜fbþ
¨L
-X�jÀÀ§Mþ%ft'kÓš¨~
-Ü@càààjM<;?[€�¼³:�]ç‹5Õ7‡XŠÌBñ@1	”rú¡­çª-èòç(¥‚uäºãp›vFZåÕ<³³ox´ªØ?Ö»Ïôq—WËÇr¹_‹©@ûöÊCD
-”pàoÊmˆVÁ ‰ ®åÊ�tâˆD«ÀˆÖ*&ï€Æ÷†lFcXÑè<ÝãºÝ^ð€(!ÊC I›ª€�&D²L9Ö7 &›H�vå©ü®Ä«£N¡~×,º�ò) ÇU+5G¢ÄL¾À“v‚[‚ÎKNý IgdÄQDf»µK#A0«uµÁÞÒÊ0·g„K’Ñq:iÖ´<mT48Ú?ãc÷©Î•H5oIé¹�EQN¤ÏÌÎ4“,Š6"µhQú³ßàöhÁ©ÝÌáösiÁ9h¸<ÁûhÒÔ
-m­
-œ+Ã6t`1OŸ%,Ml÷ô³¬i>ò�œ
J˜vÍóÅUc{½šÔÛ>G¤õ,€#Û9:÷UÍ®Dgk&ò9¶Ö·i¥—l­’:l-›Ÿ›
-sšd÷4%ùæ.¦—€—±¹³hîÀÖQ–Úzˆ¬2?´ÊmŠ¦[.|t¦p�%Ê›èÅPŽ~IŸ‡†ÈŸ	idN$ ’ßg3›¹‘@N˜“X‘�»tÞœô©N›“–*H§ï
-XÍíôÃ2“8ÔÂ9õRÔ;!U{	RòìÛºóN³Yô8$ÉK¾
-¤Â/iÏ+PŸê´µTCÁO¥­
ó™‡húìô-ÕÄüCœx‘eI6d h�U½h?¢YMo_°®nÜøE*„¥ž
-!9©6ÂÂSöUIO¨¿Í*KÕpç)È{­zø¢! XköMßê]„„zØÿÕxÿ9Å—´�xz&ŸÆ\¡+}6C>Ljk°I„Ù­gõ">…BÐÃT=BöˆÎ`�‰†ŒÇXuœ•ÒNXkÔYZ¢cÌè5�… gÀ'0ûðÑå9)¤dgÈñƒSÔjpÍ>é%ˆdbÕS¡nÐÇæ2HÔé±[B¯ãê-=ÞÊé'¾Ÿò5ÛzÏo¾èM_÷ÐÓ¡!îyɾ'ßÁÉŸ€“¶ í©Š†[OYká³,í�F¾è<
+/Length 2437      
+/Filter /FlateDecode
+>>
+stream
+xÚÝYYsÛÈ~ׯÀ[Àª%vn`’'¯-;ÚÊÊŽÌ­T²»	Š(ã 	PŠüëÓ==
+\÷
+£ašOt/2QQbyÜ·ÜD1Ö1Œ…«+_û.fœóÐÝVʧ•;:e‚E#]=u~Ò˜p“6D”Ùr“VySú1WøÜ©i@º~ÇÄá:]æ3!³MÛŒ¦>9US¯…R "&E^æ­[{!A‘½¬÷•gÄÎÀ-¨ÓIi7i;:2]ë@*»î¢:ê;šç¦ÍJ,~
+�îDú«+ñÊ¥J‘¸®WÄáCQߧMyÓå.ÞÞ¼óÌ�]›Ö4´>ö,IX¥eFT“í	EÂ_<­¥•~€�Ë14Yånß.n^ÿ•è$@»Þø"â�°G5øÓÚþG—û
5ïÅ×^½
Í.ëí3QIÞá•õ¸gTdÀ+Dk¶úS}â�È958"?ìr8+ÐnîptëGò~ç%ݾû}""Õ—µ{®
+
+Ç€ÄG+Çí¢Q]E˜rT½ƒR‡SJÃ%C@ÙH3v”ûþo¢Ub#!¹¼Œ¨
Óy@uLçCÕ$ž FVö²=Ó©"ãH•DR²±&0IÖ�I26ŠTŒ"Ð.RÁs"R1F‘Šu¨¢µ.R1BÕÑãßøHÅXn•·‡‡–‰bˆ_ãX›ü�G«îs€Žð·ò‰eýͯþI~ðÁ*†n+ÓØPÁª6ñJ¡¡µ:u
+ÿÛý©êÿ
 endobj
 1248 0 obj <<
 /Type /Page
@@ -4896,31 +4867,38 @@ endobj
 1250 0 obj <<
 /D [1248 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
+374 0 obj <<
+/D [1248 0 R /XYZ 56.6929 401.1388 null]
+>> endobj
+1006 0 obj <<
+/D [1248 0 R /XYZ 56.6929 376.7118 null]
+>> endobj
 1247 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >>
+/XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1253 0 obj <<
-/Length 2555      
-/Filter /FlateDecode
->>
-stream
-xÚÝZ_sÛ8ϧðÛ)3µ–ÿI=vÛ´—�Ý´—un¶û Ør£©l¹–œlúé HE²e7�fçæn:S�$H‚ ˆ
-G&¼¹üõ‚¨·×/ûíåõùŸ³_Î.fÝYúçåLâA¾œýñ'›,àØ¿œ±TfNOî¡ÁRžeb²:SZ¦ZI{ª³ßÏþÕ-ØõSÇô§¥KµvD�BöÈÐÊL¬ÎR#a˜¯x"“Ô›¶¬×yU=P»½-�°É‡×ï©gSoÛÔ·kŠQËz;à7Éöœ»¤XÒ§¹¥Î/»b[
5º=aò}îq½ÅÃ:_•sßmy[4p)R¸ärI,ëºE½Ã᧜§™ÖŸ¤)¼tÀX¶ø°è2ßUmC­¶¦oNŸæ¡i‹ÑózÝz1êªò‚@ß]^í
-"ïoËùm ˪"j×삲 q8I	¸Ébv¯Qx!“öœ'Ä$“rÝÛe>s>
-¡æUÝLÇNW4-j
¨‘é°vÒ^«º-h X/Ð’A³Û²!ž�HÈ´ÚÅ5óͦ€{ð½å:ìsÖ®-qí4("˜ï™—ä&ÕÜd ¹7¬ªªï§í6_7Ëbøûæhlªô;™í€6…*˜J'ӌ㪠7OJ–2ùZƒ2סqS”ëOH‚Z¦$ù­Bš¤\cM3à¤
u4›b^~dL¨4ÉTPškÁ
-7/‚B¬H�0bh7;¼G®“yŽäÆÛ#vÔw …r±(Ö¡Æsjn‚lweq¶ÄG¾zmáÈMÞxKBò�˜Êõ¼Ú-¼Ú±;5
-ðHâ{5ÂS&Œ
-s¯ Ø„�財
-îËö-}óøÕ(›ZÍ¢šý‰w
-®ÏFiëíÈ:°«3:
-çõ3º³™	L7U=ÿL²õeô¸4½O»mN
-í&†é”+î¡wòe–¤²LW�ö§}Ô‚ïøér%&¯k8Ó¤¬¸ò´¿´?¼Ãž]h8¢c 
·€ý–|Õïu…Ž^‡<&KàêRN¤ÇA$ŠÀS•Å–zuøí<Ñì6|ž
-¬'ômK¯䯱—ží
-Þì㤑iDŽáÝ
rKð>A^"[‹ÛuîC,k/Ç¢p(¥ÔÐÆ@¿ôâ��0zªbÚEàZ�Ø€
-€ˆ�„ô8$1—rÞå¿ÇÕ°'½S©âJaÉ>Kà%-³=X¢g¡À;aÕðYœöÅ
-¯NG5}®V¹]ÐéȯÞàÕŸ¦ã‘f`HØ›rf(·MÀE/á²�Iaÿ£I¹¬gR

×a
-ÄþzÄB¦ðj,z`	ëzäÒ¹“�¶TÃù¶
+/Length 3630      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sÛ6òÝ¿Bo'ÏD(>�xL§çÎ5Í%îÜ̵} %ÊæD"]‘²ëþúÛÅ.(’¢dgz£`±Øo@Í$üÔ,³BŸÌRŸ+•�-·rv}?\(†YD Eêû›‹ï>˜tæ…wÚÍnÖ½¹2!³LÍnV¿Îßýóí§›«Ï—må܉˅urþýõÇ÷Ôâéóîç�®øåóÛË4™ß\ÿü‘š?_}¸ú|õñÝÕåBeVÁxÍ3œðáú_WTúáóÛŸ~zûùò÷›/®nº½ô÷«¤Á�üqñëïr¶‚mÿx!…ñ™�=AE
+彞m/k„MŒ‰-›‹/ÿî&ìõ†¡SôKl&¬NÜla‘9˜c’ÊRHT[¤Ög´é¨¬Õ•#R¹)ve¾Yü±/vÏ‹]Þã}+'…öÎÎú“¡ÐAMà`z8(g…NÓlˆÄ—MþX
+,Ñn~•/墳ÙÇRDŠû¦h¨”Óg[Vû–gÊ·õ¾Bü²l^¯©­½çÎfÓ­H»¼\
+¹Ó[ó
G«$ûGËÚçº3““Ú±oÇÚ.‰ÚÎi»µ¨ºpŒ:ñà¤~xŽ4dõ°]¨4!TX1`3w¯Š`Ú𠱺oˆ€P<A�ü	 É·iÀ4I³AN)¥…² aÏk“Ôu¡uvyÕ¬‹@�źÞm�®c¥b˜�G¢ƒšÀb¨V¼� Ì‡hü7ø
+ÊÛ¡†ªK´X¸å~:+,ñ¡„AO5Và|ÀNxC(m¬y3eºL*2ß©œªXÀúO0þøÄ`‡Vu6fJ,D&}”Š->Ï7)ÌŒŽLC.º:B%#ãs3ÍuÔ%@ÈsG9f;%¬ËÌXÅÚŒmZ\j‰=,BÙÁ!°è*€š¾«ºÁïbp’Í
+‚��Ž;y^‚Œ(hòMØêO@êýÇ/Ô²-š&¿ãÖà`+kÁz
+ˢߺ$¹¢!‘ôÔ·šÚ“¶N
++ÉdØä-XcœÀHt󟨓£�P¤˜V7:á¨ÛÃ!Èèa‹0�%‡¾LüÉÀhX±pèK„–ëê)çÓÀ0BŒiQ7Þƒ®H|ŸÄ|þ±gB(¦Èo@ÿfkur‰wCß|ÓàÑKÓ£jè@úá—Ù¨s§*—¡©nê57ýçÒZà¡UýÔÐTUDôì¹Û
öàY»‡ãL�O^Þ½~i÷àû¦2í«ÜÑZVØÔ«oÕ©I7d›?“§pËÞE
{Þ•«UQq�¿9}xöƒ>…¡y#ŒÛçWº Ô�é¬Ï6A
+Ôš¶‰AßâÏ%x<|þëñùsvŠœKí)|šs�~´ +Ç
’H,ÁœO:–`c
„ØJ‹ŸâBP}™Sî.ìA�áÂ5äÂhǪ㬸¾iæÝy,:¨	4†™n%ÒâÆ
œÁ”½´T)AN)yPçXáµ’}^Õ{òŠ˜±é–!�xo0~ÇJŒ(`=öLÖä(!~ž\
+@-d†l1vœ0rY:ðœp«Á:°0K°ÝéÈ»
6Cq"Ø(=a3%�±³óèÕÁfè”m¦•[‚#ë€-d§”Y‡Þ’Š­¡u`Ó?Dì C¨ôñ˜†£ë„×L¬íùƈz¦ÉûÈÌÀýÄöš¿9u�ÝÏ0”ÜÏP|&0v?±é„û™@Lcœ3ÀÂ`u\ÒåHîwD\ÄmM«M/
¡.Äÿ‰RéÿæéíÁš,uê´Žì Ž‚É—Ç—�`X½N^@¢ƒz
eSá¥}cnª¥Y̽t	�pñ'»ŒŽ9¸@FÍóÕŠó
ŒïYiâ—u.@Óå!¨”O�	•nÞ}¢ˆqU,1%Å„J�1Îù!CO뢥LSF"νôgŸ:ýo=GW½×@Ëî0'«¢ë˜
i2Û϶@�7Ëôôfêâ�’ïÖq>Ž/c¡Îs§ó_Þ¢ŒÇßu!»6€wÑáU况—
w‡5apÌAÄùVÏ ²Ê%õïV :µ
›Z^LL\84%k8˧»è¾¡Z80´~Èy¦2~KÖq³	ˆ@[´fPŒ¬‡Eb/(í›=K“ÆkÜsaÈ—ZóÕè—K5' ®wë|Éc~Ó:Ynêf1uNà%"`‚á°ÌËaã@íCGn­ÆûÕ O
f€m÷qÎüá¡ÈwÔZV¼Î=Ï5œÛàÜÿ˜Ì”('¬rчëªE'ùɸT$R�ÓÁ¸ò›`#<ÄRS×*Æ€¼
1+®Ü”¥À7CáׄŽ˜y÷6 ä9 
lþ²Ä„9Í2a¢…¾¨»ãs‚¶9wéh$ÄÎ]ZýÕjOËÎÕ&y‚òøN‚"HªÁ³;DÄùìNð•œY`hX`¬sNÕh�KJAÀŽ
+u±­wSgð­��ÈúLÎ#SÙ[0X_‡!^Î�êAÖ»Ûïòx"CöyS¹JÂ
+‰›i¼¿rIöšK&ﯲéK dR'\ªÝé¹hœ„¹¸G§ZDìÊX‘x­ûATwVH@DNÒ™ò™ðœ*¤ÑÇ­G!Á
7:’úçË…Sóø×ó«#ÒÀ¤,_¸2̤o¯fÌ€“>9(‡Ý¨¾»ÞêÙûö4ëo+μèOör8~´ 
ѤsÄ—_ê
*V2eàEú¹V(*R~
+ÃlÊàC_ÃC‰®á�çŒ8ÄDÀ=ÜR´-IŸã7E¡•ÄŠV
+×é%ÁD�ì„ÒÓ—'õ0Xè,ëò¸oÉ©N#ýu”Úšzã
+‘È—ëž|¼Ú;‡¬órÓ0Ò“Ïð||÷€
+„’:^•�æôft{þj÷Ȥ�½�wS úĩ缨•Ìä½�ììÐß~ê{x
Ž¨"=}úF:pØ|‘Â=X;ÆÜšLØL§¨ÿß»xÊendstream
 endobj
 1252 0 obj <<
 /Type /Page
@@ -4933,25 +4911,29 @@ endobj
 /D [1252 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1251 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F62 995 0 R /F63 998 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1258 0 obj <<
-/Length 3193      
+/Length 2802      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZKs㸾ûWè¶tÕŠ
+§yx&ÞÚ�™ØÞÊa³Š¢mf(R+Rö8¿>Ýè%ï$)—‹x4»@ãë%þä"6¡I£t‘¤:Œ…ŒùæB,`îã…dš¥'ZŽ©ÞÞ]üåƒJi˜šÈ,îîG¼l(¬•‹»õo�	£ð8ˆàÝçO®?þzóæ2ÑÁÝõçO—Ë(Á‡ëŸ¯¨õñæÍ/¿¼¹¹\JËàÝßÞ|¹»º¡)Ã<Þ^zO#)=N0½¹úpusõéÝÕåïw?]\Ýõk¯W
-…ùãâ·ßÅb
ËþéB„*µñâ:"”i-6:Va¬•ò#ÕÅíÅß{†£Y÷êìþIFÊD3ɹ
ŒÓШHõ(Mha[„€ÈÖ´Ä_ß¡Æ—f×Qëç²íZ\1ˆ]FI¨Œ%ÙSS®—Oz¹_o—[ wT ]�¤§°ebx×½R¯™f¬¡LÃÄHëiˆ­ùl5¿Òn‹¼¼
}SdøAjÓ@sO#×_ž4“Ôë~ÈÐ-$ÑÍv�³x.«ŠÆꆇV…Û“e$D¨•NK)Ã4ŽÉ@÷m�"¬2dfeо´]±ñcmùPÌ4ûÝ¥´A^Ь×
-0ºõPa°¨\v�§
-nš}µýØŽ³‡ê…ú`v÷{Än£\žŒc=ž3¦qþ°› Ì7Þ{ 9߀1©?"±&
+8Újžð¼M�d¹Ð7
V{Ž.)Þ4œ4A™Ô䪄âíê]V¶<éé'>=ùtãï+´bÇ!®éC\CîƒÞ¦aú
eÀ¨ÏÍñ%t.Ý ½ÏœÝK³b
[Ù¢=�i9ÍaÄËÅ!g<0ÖcŒàLÆúK ¬_?Œ®^^�n¨L�v ™	�!¢JTê‘ n™gùc±ô�{
-5ú_ñj²£g³êµ0C
�T¯éˆêÌ‘z*‡D]–��3’ЀÏ</ÙÍHV%
#!㛈ž�þzÅNI¦õxp*“¦ó¥XúûÃC¥DhElÿ›ðð°r¢
bcb_É‹Æ•<)¸”w;Òý{kwÑ°�*JÇ9ŸÂb�Çœs96|
-ç(jë<‡ƒêõ‰ ø¡¡ŽpWZÁÙ÷:.ËèKw(¤¨ûRÈš¦Ëº+v5x”ꚟ«àŽO\Û£oƒ¼Ã’J3­‹’ó;y©"­À|yþR�©N_ªžÊ»“òÕê—U󰜻`XVÔJëójôT3zL®ؘ–`¸E(ôU©‚¤”ƒ$[µMUtÅ_±ª]è1žÎò¼ØºlÕõê5O?Ô‰ñŒ+`ƒ>Ä!�¥�¼Ùlá8VeUv=–&€½wáWD+‡@<9»™+¥d¨D4vÚÿ‚û–tÒmÛÐÆ=sðÙN’ÊîC•±IÝïëQ�§äçèãi[!œ·¥Õ[òT§VyhF"~E
O4£À¡	p^S
n‡Úm>z¼Æ…’Ø";€F‘¹’
-´Xqê�oöíX´ÅqQRÛPBŠ>Y͹jž§eaÇ|'Õ<ÔH#.×óTab|vw{ªW´8æFA˜Çå2¶"ø‡+£6„È'v�âÉH‚S‰ÓéÕɶ\nÃ`
=ña4Üw
äáÂh€³ÃxÙ*®£á sºãךj]¸�±8¸Ëê6Ë}0
-#î’ŒÉ{�±Ãé%´V<�í»f �;üŸÉ�[6ÍS_ÿÿ-E‚0˜þÿ"/©!Œ:±ÇT§/vO…›¶[BdÓ•-ìF»„[ut·µ“ÄØóJôT3ZLn·ŽÃ$¶rªÆ5žŸ±äLX4‰$™KK$tÄÐ63
-Ã
gmðĵÑì°@š�°zWÄ’AÃáùüMH‰ó§¦#;7:·OͼÄouàåk©ßÕRÈPZóJÉnLuæD=Õ4å¥uS¬f�ÑYzª¦hm TzªÄ\T-‡CGÕ0]uY]4û–¨èêñ"¸HÝ4_÷ÛvgÉ駫ÒŠ;@Òð×±Xc)ÒNÏoU<fÕ=ý\Á©àÇ{æ~¡xv|çí‰ê TihSÙŸ…¨zîC’
-S)ô¨4(¢àm‘g{ÿr[ØíƒÿqiGÓü¥ÐÒ�UðWY¹£�UÙ�WÕWF1öqHkû�‘FAª!íLÔ«¤ûŠUHÜe%	•q8ÔÿZV
~³ÅÏʳÄ	÷	�YÜÓÐ|	DZŒ…9ªWœ®I$	„SQ:©I�(—u¡,ʪqÈ}�–üÊ-%§}ͨP†‹â­ˆdEFÅSG€ Òz£_„ˆ`øt<$ƒXžøQ—ŠCü%ÖÌEƒÞøÿù_ïá4$fÖFó76‚xT[`ÂJá*csŒSüË°cÕÿ¿ëìendstream
+xÚµZÝsÛ6÷_¡·£f"ß/OibçÜI�œã<Ü´} DÊæD&‘²êÞÜÿ~»X€"%Êv'm2c‚Àr±Ø�ßîÂæÿùD›Ø¤"�$©Š5ãz²¸?c“[X{Æ=Í,ÍúT?Þœýp!“I§F˜ÉͲÇËÆÌZ>¹É‰L,â)p`ÑÛ�W—ï¿\¿™&*º¹üx5�	Í¢‹Ëç4zýæçŸß\OgÜj½ý×›O7ç×´d<�/¯ÞÑLJ�L¯Ï/ίϯޞO»ùéìü¦;Kÿ¼œI<È·³_~c“ŽýÓ‹ejõd/,æi*&÷gJËX+)ÃÌêìóÙ¿;†½U÷é˜þ”°±‘&�‘�/ØVZ§E;¾-›Ì¬Œ�’éi^ô^~¾²šYë4Õ“™1ä´ª3¯�ÎãTk�öµI,+&‰”1Ã)0ï*ئ±6Š#g±–B
s¤ø8�ÝÀO™Ãš8SL6å7ž|›ð˜©4•DÓ»“î5à&~¸¼“w5œgÒ?’ç;ë1v'2¢ç°\€B¤’“„%@•¦NàËåt&‹§‚Eõ–^òŸ<ªê–&vesG£ö® A¶j‹
ú_Te­Ÿk7S+U³œJá2riêíf(jzÎýû¶)òW84C	š»z»Êý¸hIïFöŽ>AÖ¢ÈF3iÖnÜöÜmg¸;@b2Ð	±Ð:ñÖËÖëM½±¹ŽJ8Õêq
+îœÀ‰r Œ<�ê)�¶´ÄıSòb]T~r»®+Ü…õ[Í:'ƒo‹¶-«[Ðcb£Ì?ªÕ·ó‡psól�‡øJo¨E÷DcààWÆĦiéeS,7Ú_¾mÉ(:è2>ôIeÒXØÔNúáð}&!tL
+p3Û£Ä÷ÅÿL¤±µIêLs>Ü<N87²™u‘ÍG€»£r–ï\ÔÅ-¹Í¢˜=˜C…q€@©
+
ÅÀ¼"‘È>a’11t,YÄ(ÊŠ
+¦Ÿv£Ñi/
+DÇt$õЋÀî ö'%鈎Eø�
_cBdùÒ ñmÀ›œ	ç÷΋{gjh¹ö€j1B™v™WÊb×x–îÏ°Y‹�ȹ¬¶w¥g–Ël»jýW€^Ǿ�y9a0ÀcU�˜›C1ÃMêÍ]Ã
7�Ÿ
+²zÙÒ³·¥fã[BE'"5žÑ#}d³$VRiOó+ÓléT£û噥Ǣ¾_gm9/Weû¤ü´ÿI@]ÁÅ3Ø£zÂ)¬-—�§œÞÛ==³;`¦böéí´‰žª
÷ÚÌðÈû²BŸ“LE»»ráÊ­êE¶¢Ù>ÎáR–çävMƒ•·”ž‘´^·e]e+ÌÛøþåÝ'úf]oZO¼+Wžñ¼ð™ý
++Üf•=„a±yÀ…jÿ͈KHÞ\tÅç}8¿óbic-d@È?03xä…T­´"ïb•m1ž¤TðéÄ”t="ˆ¡�ú¯w3r…Yt'‰E{¹†‡åÁvM@u_T­-Z¿€j	e•sjÓ¸¡QXlPÞ
+gÌœgÀ
+”0ÐFp±ƒÍ„ŠYÒ!.œ|Ä”<¶F—vÊåcDÌ=´øêá¿ò€WL®0'Ýn7bMâ̪8BçÐ*­ ¡Jø_Ò¸&
+\ÇÏ„Î_<8§û^w
+ÚâÀ§ VPt–‚»¨Ã)
+&œÙÃ.ÎìâüÒÙ¢¾«W!ëB¸Te÷E>Ö�AQn�ôT¾	þ"vpý•ð—v}á¨ô@övÄy§–æŸP²ht�d®[…u™Â¿W&ÜW%‡wϨd>L+Š>"ÿsX£IÕtÎÀcÉ´¥ÃþîåÀÝ£²A5ãøË!='2ù“øÛc‹ÝÛL0N8ÈD
+~ê:ò¶Âpf,ÌáxŠwWÐîÚ±!¾]ÚƯöm•gÎ�aÊ
=5΀n›âµ7ï]ñ8äC
 endobj
 1257 0 obj <<
 /Type /Page
@@ -4959,1448 +4941,1515 @@ endobj
 /Resources 1256 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1255 0 R
-/Annots [ 1262 0 R 1264 0 R ]
+/Annots [ 1261 0 R ]
 >> endobj
-1262 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [361.118 590.715 409.8647 602.7746]
-/Subtype /Link
-/A << /S /GoTo /D (configuration_file_elements) >>
->> endobj
-1264 0 obj <<
+1261 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [347.1258 196.3262 404.2417 208.3859]
+/Rect [442.7768 250.2874 511.2325 262.347]
 /Subtype /Link
-/A << /S /GoTo /D (journal) >>
+/A << /S /GoTo /D (query_address) >>
 >> endobj
 1259 0 obj <<
 /D [1257 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 378 0 obj <<
-/D [1257 0 R /XYZ 56.6929 769.5949 null]
+/D [1257 0 R /XYZ 56.6929 318.8054 null]
 >> endobj
 1260 0 obj <<
-/D [1257 0 R /XYZ 56.6929 751.6696 null]
+/D [1257 0 R /XYZ 56.6929 288.9425 null]
+>> endobj
+1256 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R /F39 863 0 R >>
+/XObject << /Im2 984 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1264 0 obj <<
+/Length 3378      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥ZK“Û6¾Ï¯Ðm9U$kOŽc{�JììÌlí!›EQ3\K¤"R¶'¿~»Ñ
”(M\©©)âÑD7€î¯”\ø“‹ÌÄBçÉ"Í“ØiåîF,aîÝ�dš¥'Z†Tß?Üüý­Nyœ[e›`­,Y&ë_£×ÿ|õËÛ»Û¥2"²ñíÒX}ÿþÃ4’ÓãõÇoß¿û÷Ý«Û4‰Þü@ÃwoÞ¾¹{óáõ›Û¥ÌŒ„÷¯pá…·ïzC­ww¯~þùÕÝío?Þ¼yöîW
+�ùýæ×ßÄb
ÛþñFÄ:ÏÌâtD,ó\-v7‰Ñ±I´ö#Û›û›
³îÕ¹ó3:‹M¦Ò™Trî
+&«§tK�€E[ÀÁ‰òmÚAëÐAmjÑêÐðÖæ¦Ý¢8Ø6	¶]U'/­«®<Ôû¾ny¹Y‚‰ØèÔðÖºú�ê5 V–fja
«e&íŸ
B…–ÍÃàrXq.yŽqÚX¸ŸtdìD��¹"¥âD¯àtâ“]ä"N¬H'» ÉÃã‚w
ô32NTãl]ä_•ãÁÛXžJ“è4V2É'Òœù‚�êÎWCbV:0}™J—
\È
+�»=ãäÃ�öþ\¢è|‚(CSû¢wHÀ‹$Z2ÝÅ{1¹‰U’æ×ï%¤º|/•“¬è‹ù{
ˇ á:ç�j†õô^ÒXäŽNxÓyæ2¸è�Ë¥¶»™\8)™´Úµ‡gj÷þý

+ÜZ<zŽá—V#ŸñÞ 3{o¢0ˆŠ¾ýÞ€‘FÎȆÅѨ8ͬšš©Û‹‰ž(þ\SÏ›*4øÃsÜWlÜP¸Œ<½ßÐFø„/= Í"Y¨HÕò wYôüJ¸vͼ«¯ˆ¦,ÏÀƒ÷u;NôïxS/‡õ,È“AŸ€
[±u
K�Ј£|q–%°Q<pk[ŸyÕaùq›`�#6$hé	¨ÞcG�>Ü�oÕ%Å ã.˜ Ãç 
+Fðд륶Š=µýØ�“ˆí3õAí6GDp«£‚i
+z|)˜Æy
Ë΂�ßz‚äl
!©¿"f±&+¸Úgj^ð|L�k¹ð7�VGTlÃIó“Ò'6]úÄ
[î8aæPÔO±�zvxvëíZŒ²a˜k‡0×’SÂÀ·m™~W85�æê™æØ�c·¨ï3Û|n�@, q«;Ô'P-'9Œx¾8ä”ÆŒœpÂØ`"óû‡ÑÕóÉ«Ó•)ÒŽ$3A2dâ©Î=R
+©.»¥�
+¥ø¯j[ug^IÀÖ’,½Îx šá<ñJ"‹3=eÌÁmf…iÔw+Š5SÒxz]§÷¯�Qiʈ)çÁ¾¼w	´Ê¶�k#ìhz@)eätÜŒBŒV©Ápg}Vª!‹Ð>}¹–4ôn�;½m$Vank^¸Ö€êʵz*‡F}Q~š7Lœ§Æ^g=PÍðž\¬ ø6Ÿ2Ÿ(A'&ÓzT¸”SÓ%S\ýíq¢I³1õü¦8ñ´†’
+)±Eš
+#ÎLBòAbìpš	­OǾÝ
,”Î\ü‚³k?ñoðàR¤€&ÿÓÑ—~)úRÂ×Ü^·ì€è²a{"d÷Ôvý›¾îà(º%˜Ô¹iç±TZ]•` :abØ)~÷LìD†÷xs6ó
+`’™z1‘ÎëXÿ|<ñVîEk—ÆĉÒ×�= ºlëžÈ]S¹¿häZÁª*½Êy :g=MšSà=eýà«­A…ÞŽm*
ÛS‡‘A‹¡ýðúl›¦œy>”ÇÊn:©ìŽEcÊø»$~NÈN´ù|¶U˜F<÷[‹4εJ_rÖRêX&òoR]¹tOE6âÎa½ìÚòS5sõ�wÁ¹˜ëT3"LñÝÄ+eSÜ‘Bp3Ü8L¸Ç1\cÛÿ^ =t4ÀY¼Û
½æbuœB]��…GÝ®_×-¶MU}	`™	ˉ¤c]Ukn¢•ãsUÑ’«ú‘qßÄZ�èF&]5íñÑY2ׂáY¶ìJrï_²À]qL
OW1Øôû" ƯÎkšÚB„QQ}ñ�ÖŠ‰�º™‚ßüR‘Çò#£,6®×‘R¿ÝÍ…¨ü!NÿØ?¶\s÷v�ß�‡:®@ÏÅûº�Œx þÃýÇÕß1¦ÞT‡Žkê\o´a½Ñ^(X	Ê*}µØHuÑv²ÑÿEMÀ’ºñ•Uë];gùAÖ
ÎÔ&')»TÙœß�L?¡¢cH<²$!Š%#çÄ\põ2ÇhbøA֟ล/fŽ¥«OoÁ®�yèòžS0dÎ
;89zí™+–=HRh nÆݱ“1ÀüI~¶9öTG«âK¿QÔ
+endobj
+1263 0 obj <<
+/Type /Page
+/Contents 1264 0 R
+/Resources 1262 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1255 0 R
+/Annots [ 1267 0 R 1269 0 R ]
+>> endobj
+1267 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [389.4645 694.3759 438.2112 706.4356]
+/Subtype /Link
+/A << /S /GoTo /D (configuration_file_elements) >>
+>> endobj
+1269 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [375.4723 314.3269 432.5882 326.3865]
+/Subtype /Link
+/A << /S /GoTo /D (journal) >>
+>> endobj
+1265 0 obj <<
+/D [1263 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 382 0 obj <<
-/D [1257 0 R /XYZ 56.6929 674.5298 null]
+/D [1263 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1261 0 obj <<
-/D [1257 0 R /XYZ 56.6929 647.321 null]
+1266 0 obj <<
+/D [1263 0 R /XYZ 85.0394 749.7681 null]
 >> endobj
 386 0 obj <<
-/D [1257 0 R /XYZ 56.6929 331.2658 null]
+/D [1263 0 R /XYZ 85.0394 443.842 null]
 >> endobj
-1263 0 obj <<
-/D [1257 0 R /XYZ 56.6929 306.5278 null]
+1268 0 obj <<
+/D [1263 0 R /XYZ 85.0394 420.887 null]
 >> endobj
-1256 0 obj <<
+1262 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1267 0 obj <<
-/Length 3155      
-/Filter /FlateDecode
->>
-stream
-xÚ­Ërã6òî¯Ðm媃'GgâÉ:•8Y¯w÷�Í�–(›5©)kœ¯O7ºA‚%g+[:°Ñh4@?
É™€Ÿœ¥6:3³$3‘ÒΖ›+1{†¾ï¯$Ó,<Ñ"¤úöñê›O:™eQ«xö¸x¥‘HS9{\ý:ÿø÷›_o®ÊŠy]/l,æßÞÝG˜Œ>¾ÿt÷ý¿n®3¼ûùžÐ·Ÿnnï?Þ^/dj%ŒWÌáÌ€Ow?ÞôýÃÍO?Ý<\ÿöøÃÕíc¿–p½Rh\È—«_³,û‡+é,µ³4D$³LÍ6WÆêÈ­=¦ºúçÕ?z†A¯:µƦ‘U&ž-€XYi¦wYD®-#�JÈ~—•œÚeO…»Ü-·‹eUuׯXj|U2ÙžLÞSMÌ®ƒÙ¥N`ú£Ù_
-Øô,žoò¯åf¿¡F½ß<;‚›5}[论¼.š}K’šàÇ�¿0²©ëbÙ•MÍTÝKÞyÈÍ•ÌÛb÷êÙʪ"(_.‹má&Ì*A=„ÅÉ(³V²‚‚¬Šu²P£tÛúœk�UdScaƒp ‚hÆû‘D™†m#šèDÝøLc0‰Ì&ñ僩Î|O…3ÂŽ/–ùò¥X´åïÅÉÙƒ¾‰Œôâü=Õ„
-,qaËÊ	øÞÚ±1iíÒðàÆ›ò¾vâ«	£{�§™õQf Ýy]ÖÏ4í<B'ç‹ÈÜ*6¶t–Ï0•k¯]³ÙxNLFË&¿&@©3=Þ–¦vûÎìà¬
-¨.¸+OåãTU¶]Q/¾ì‹ý„ÃÊ"™ˆì²=Õ„#‡C�·€ÉÀ+›“ “4íö{q%hýAçV¯Ø”5»<Š!©yìÝzäвùçbWÁí~»mv]KC{o:¨D¬ÇæL1
(Ódþ_!TÕ¡Gq-¥ú-öJ«7DPù%„ò
-ý
BV;R®Šû^š
›¼~#Èa¦‚0±ÌY
-òd=áÚÒ”öoE8ðŸfëW¯¤œ·Û|YxÈËΙ
6\p͆ûÙ-KS­›ÞBÏSÑ�Ûæm‹³#ì¼|}&à’…£OÈ«½s9ÐY-C°¨š Í‘—v²0e)ʱ«¥Uíò²EwIN"Ôÿ…2Q&bHú´‰b%µ£ÇVÆ‘”�Ñ
-ð°¿»²Y•K6Òk‰’·Ÿ©yWÃI¿Âù�³S+U”ØX^¶Ó�ê¼�öTÎÇVäÍ%‹pb¨˜	ð�Eè©&dj™ìs$„3>£cw ¾ Öc“N!‡Í«#´�k[…mC.vÉd'>I·‹$�Ÿ›£�ã‘üm⤵Ê"a¤äxÐï™´NcL#“±Þ„ûz´:ÃÊħ�àböœà$‚ýQd¯Øp–ßXÐ÷̘!AƒÆ+ZÃx¸J™wþæ0¼�Fh5æXɶ—uä¯Ðñ¡ú¶g×Î$á+>зæöv¤ü~ß8ˆ‘Ô,—p|�ž
W®¾é;eUHuÞz*\ÉK‘ﺧ"ï.ØAéT§—eè©&„W2Ò±•c)ÈÄ�á]0baÁ1ný{S3ñ&G™ë¼vZ]ø•–úœŸE\î™à¸–p›|÷ÙÙ óvJß¡ÔP첆®JP¥í„"ƒv¤`Íi6VLO
-·�¤>N%Ù`?˜²ÓãÌçrÐè~:÷£I÷ÓP÷aÌC‘·M�?U<ô•c
-MÛdrˆ	LnŠwLÖ•Äl]@â¬κREÖxRì	Uab5u)
i¹:f}ø_-Qg*‚dõ�Ä1¤:o‰=Uï/×�5\°DÅÒ\ÁMˆ0ŽG`~™Õcøê Šºaw
-Ô;àËê�¼Q½±Ç©7¨ÞÈÞ©7¸',`‡�ÄÜx8&Ja>ž4óõQæÕØ!¹TJý™

-bÈ?܇í¾$„ž'¦®šg¾ÓHϺ8™Ù|¬wXgV|êã F>M�Mªý…Ï�$�ǃ̪ä8gˆzH)†»á!lÛ>Sækb÷uaÛúL¡0l[q¶�÷ŸNŠÃ�köKA{¢�RÀ™x¦À½›X˜?ó¶�ö&Ò4�~Û
-`·Ôaâ›»�š}×À‚fáš<ãEÀÙ­)V£›EX^*`~{ZB‹rw®�j¾]+1/¸Qn¶U±)êÎ]g ¢¦/?™
”�œ¼É’(Ö1ìc°·í¸ ‹�âD]ïZM™Æ`¬}§ûƒØ‚™‡×&Š¯M袤Ù6`o.4W�áS%¿qeŽ€…¥�ÄÛeˆ-¡ù*	ÑÅ—}^�I+9; â‚(û�Ë—¦if‘Ó§vÎ{Jº“BÆë7B×
~´âœÐ	º&Œã7‘w¼b×™œãµºÞÖЃÍw�øÊQ“3qéihË%Äô7êZV¸°Î÷3}×Õ+Ó'“Ç¡^€ÖØ,c«ìÎ�1pÊ�×w:ÏóA‚—.Xº¼ž˜”Óĉ7þ|ÅW-¯#lrt1¾Úáeß„³4$X®42ù3
-®ÀŒ/ª·á3°<Õo)Ud$X\OFïxÝòåDH#¢8êÿ(¤çøž�ê¤8“c!�zN¾�&Zùë/º×	åY¬‘î¢q�ïÃoŒz�Ív[,KWùCcH¸6‘ó[zÛ�P§E™DEcÉX°£¨¼ú kž*oÛò¹.XžòàË`¾¾JâÒ¢£âû¦^ÔÅsî\°ÆG1b�|ÁS?£«FtNmÏ’�Oy뇹|\õ�0ˆÚ6mIEv¸Mð�sˆÀ¡EkW˜ô鶞D’eîŽ�¤<¤§­coáLX§<؃ȻŽpî
Mûg
-@x)bп4;zu¹K×|£1ÿë…{W
’’ga­¦aÿènà íü†ðÃÖµ_à9ÁÔX-MUzÁy«~šðÒS�†VðÐŽfø!‡(†3Éx½”¸aÛÉú!|ó
d¾Zñ-Só2 ‹)#Ýiâ
-f\ÃÔ¾"zóùd Æ¾â@RèãÊëÖ9†!3fÁÉí'ƒT|Í1�ùpîo7ÚFFëÉÇ1ó§ù—ÿ“3üaÉ$d%jºÜÑ"ŽR•%½T¸Ó69–Ýê4²©J¦„ÿ1VONendstream
+1272 0 obj <<
+/Length 3275      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sã6î=¿Âoç̬U~ˆúxL·Ù^:mÚÛó]z}Pl:Ö¬,y-9Þô×@€ËÞÞô&3‚ ⋤åLÀŸœ™$Jr•ÏÒ<ŽŒ�f¶Ú݈Ù3ô}#™fá‰!Õ·Ë›o>èt–Gy¢’ÙrðÊ"‘er¶\ÿ6O"Ý1ÿó㇇ïÿõñî6�çˇŸoʈù‡‡ï	úþãÝO?Ý}¼]ÈÌÈùû¿ßý²¼ÿH]	óøöáñ;Âäô¹Àôãý‡û�÷�ïïo_þps¿ì×®W
+�ù|óÛïb¶†eÿp#"�gfv‚†ˆdž«Ùî&6:2±ÖSÝüóæ=à×
�ÔŸ‘Ò‰šP Ò�3™<7³ÔäQ¢¡¸Ü–--ªÙweS¼-Y•]WY‚íæVfó�]u<€‰½5f^ÖëæÔFg
+‘Q*e2KÌgé…Ñ"¤"ùå”
x*”W|Y¬ŠÕÖ.Úòûvz©â(�S}}þžjB€P�zS•%c	–[Ð�Ž3¥ÜwØÈçÅ®9Öu4&°»æðJý]C¸cË£7Í�{<¿Ö^, ÁôþÖÊ­ôÀ©�îéµ³ øE"Ìü×­­. ŒÙ"Î"�W)£ÜådöÒ©D9éð».º‚ äŒ_'	nZhÛh!‰"g@ÐU•»²{‡°†úE |*«Ê3të®÷]3+Ô~í—}IÔÞScWtG‚ªW·Já—GQ¡Åá šn[tBqJBÎÉ
ߺa„ý²²vm× L-òùa_Šêh	tª‚¯¤óvoWeQáÒAó;[ÔeýL]ƒçëdÑ/{ZÓ³]S{ãšÍnXÁh©´“¼5Z¢?Vh\RÎOd€ƒQå��Ëå�-!­ÂJã\Îï@[Ët¼"ýd_O,2Îþ͇8B¥i”ô#åX;åZ¦¹øn–‹Œ)QEm/ Më½Ç­Ö18˜LÇkõ;aØhá«ÕâÉí§Ñ0[>×N{�¸³ÏöÐRë?Âñ…Øõ@)ßÃÓ¶\miü®x%`¶ÅËB¶@[ì,Q�C¥š,†`ék"ÛÁæ•5xÒ„
“åÈâÀq¿oÜØ5Þd°D5AZÑ´Ñ„*r#8ê8Vûb…›®r›ÎÈ}Ó–]ùÂ,�’™EeÛöíDê§o	 ovsòPÐ>K·ž2Uêj-êDjòqøC”HªùCM˜‚>}è
+B«¦î(zWÜ·mNì
+ô;„–ïé©kP}µžeÁR�“!„N¦³Œô·&$ê	[ô«W.˜ƒÃx*ÀË]^‚†«6A³ã~ÎÿàOvÓGìy²ý¸}Ѷ.ÂLî#Yk.ª¤ó£‹pÁN
+!ŽÜ…„4D倛�…)+[wos:G�¢l15Sn	íÒc”‹$Å´Å:8È$’b“bþ‹=”ͺ\‘G.o%JÞ~¢æ$‹D¾ö’Ÿ�5s¦¯ûiHuÙO{*—¿+*%‹pî¨p”Hdv]„žjB†±£æ‘Œµáœ/Ö‰¹·rŽV�MÚ!„¸îj^¡	JˆuHÐ6Tì˜ì¬èAÒ¡®A’ÎÏÍÁ×q‡¸ÿ:±ÓênK_pôºã¢!K"“ÅoŠ†P¯o”�ºÚø¢¤¬�\I§‚ãQtl8O‡o"è{aÌp€W-áp•1ïâÕa¤«Ob¡Õ˜/Ö"/Že­íaCæK9Ã[Ã	ç}knïGÆïõF-vC<ЭV°}pܸ˜®bcà¤Å
BªËnÐSáJ¶¶8tO¶è®ø
ûáÜs]†žjBˆ‘Ä:2KÆR�ˆáè‚Z„À¸#ôMÍÄ»e®‹ÚY=tuWZêsqq…g‚ãZÂíŠÃ'ç?€.Ú){×i¤áÜϺ†²ü¸Ÿ0d°Ž
+qH»£t†Ç
+
+]ç){Ú´ÎïÓ¤Éβ‡ÖTÍRØNE¤Í›”Ô»•Ìg øE·ÂïÀiNíí[B‘ÅöGûÆ/Ù7B�}|Ù¾‘÷Æzœ}#€ö�ì�}C|*¡‰=¨w—9&Œ›w'Ëù"BåÞŽ’î$¢-
+3®›Â^ÑùæŽÏ<q†ä
+ìm©4S3µ/ìmÔc`&‰¥³HŠZÅl?C¥'áä¼HÔüìåÎ^yšÇ38ƃØZáÔ³Ï3°¢8Ï5°[ê ‡øæa§fß5° Y¸&f¼9»E%jô6£á<u¼’Yë4¦E¹ÛZ¨2_o•˜[n”»}ew¶îÜM"júòû@ùÙÎÇIAÉf�nÿÚnAý
+ÁHÀYexÜûk¶@ö©Ìõ((I8`Œ.L_˜ÐI³oÀ^'"®2 Œ¤áw#è)!v«�ZBó%¢íç£{-‰�ªˆý-,Rö‡/@®¶MÓZfQЧv±{Jº�B&êWB
~´âZÐ	º!Œã7QÐw¼]Ö¹œã�²ž 6îiA'šoñ!­¶S0qéiH�å
+’ù+u­*\Xçû™¾kmµÁ#UÜ‘os¼
+MND_ÿýåŸ$
¿×ŠÓê5}Ì�**‚ÂöB¡žMv~²ãß.�‹þ_±ïŸ5endstream
 endobj
-1266 0 obj <<
+1271 0 obj <<
 /Type /Page
-/Contents 1267 0 R
-/Resources 1265 0 R
+/Contents 1272 0 R
+/Resources 1270 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1255 0 R
 >> endobj
-1268 0 obj <<
-/D [1266 0 R /XYZ 85.0394 794.5015 null]
+1273 0 obj <<
+/D [1271 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 390 0 obj <<
-/D [1266 0 R /XYZ 85.0394 568.5356 null]
+/D [1271 0 R /XYZ 56.6929 564.5444 null]
 >> endobj
-1269 0 obj <<
-/D [1266 0 R /XYZ 85.0394 542.9142 null]
+1274 0 obj <<
+/D [1271 0 R /XYZ 56.6929 539.4426 null]
 >> endobj
 394 0 obj <<
-/D [1266 0 R /XYZ 85.0394 177.2349 null]
+/D [1271 0 R /XYZ 56.6929 176.3615 null]
 >> endobj
-1270 0 obj <<
-/D [1266 0 R /XYZ 85.0394 152.7841 null]
+1275 0 obj <<
+/D [1271 0 R /XYZ 56.6929 152.4304 null]
 >> endobj
-1265 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R >>
+1270 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F62 995 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1273 0 obj <<
-/Length 3133      
+1278 0 obj <<
+/Length 3129      
 /Filter /FlateDecode
 >>
 stream
-xÚ­]sÛFîÝ¿B÷tôLDs¿Èåä)MœÔ�ÖißÜCÛZ¢lN$Ò©8žLÿû
,µ¤(;7ÉdœýÂb±
-pÙ8±VÌ®—Fi,ãSÀ�D¯ß_¾½x÷Ÿ«W§™Ž®/Þ_žÎ¥I¢·¿žSïÝÕ«ß~{uu:Öˆèõϯ~¿>¿¢¥”qütqù†frjŽ ½:{~u~ùúüôïë_Nίû»„÷‰Â‹|:ùóïd¶„kÿr’Ä*·fö
-1¹Þ?´g>y"-ž½J÷—@ôYœ+iÌCµ^ƒL¬ˆî·§ÂFåªÜÒ¸-·ŸËm‹55MÖe÷Ðl?Ò@$Ôvw%Amš¶{�Ý<Z5ëuóP.	âæ‘Ú;
-]¿`ÔŽPEÝ!™
-é$˜¸¬Ë@µgGETÜSìÐÜo+�†Y
-XŠŽÖ«ÖMeÑ®¥g…{êGî,—Lj[2>²Ó>–ƒŽóëÔ­K�”�‚PÛzÁ{œ=Ad€e;qðNAð3†È!辘ÒròÚb˜C��±-M-Ü3‚ÎÕ9P^ñR³åí´�Ꮁ�{Ònªþ+Iä펃/$/É£ÿÞ•Œº ̽ˆ5û1h=[=”í]¶'î~LS�V7N-º�Í¢›’Úûr‹V‘b茘oSmg£S@'oŠÖ7Œ«¦;ü»¥Q ´ŠýLÕú­Ž?Ö«é§]Å°Œ©çq <Å™ÔIƒìr‰ä¼H¾Ær„꽑Ù
nÍiª½™ë½ä¡�S�Ú	›Ú8n
«³§8¸)!ua×”ƒðŠ�xw\)ê)
-xy3òø:eŸ¤’r¦2ˆ²Ì~K 
a†µöH˜Ñcœ‡(ãim,a¦‡B*7EÉȈF–¢ûãhì1>C£1êL¥C"�H”B¥Jx~cʇ© –ܲiêX`UG2{SÓ̦ñV
Gí}¹¨P�ÎÓ“áµ@‚Vv¨Â`ZñM¥âˆ»E%Ðy6#¨×*Ç2åk
÷²qÏ’ÔÈC¿›@ÈhA‡Šð=çw~n˜ò»c¼C¿„y¿+õZ‚ä ®�˜ð»õ%Ø¿« c>/\�bhᮉi#nVOJLhУ¼ÏVž6Bi¸Ùµ×–ëi�N
-b
-jH,¾
-ýCåû¾Ô±(+GµCBåµ
�ú]ÎÍ„‡�jiˆì
-¹»S>À0àæTµÕ_W™Ìë$ôŸà˜kºØ«¼!â‡)&¢u¡†ñÑŒåá�:ßjÆ¡ÅógB{n™|Ì-3xÆûŒ‡¹…‘uM3LXÞŸ®ùtŸ-M€˜1�´ìYh}L¸ÏϘ™93sâ6ã·Œ±î
bµå¯ûÕ ”�uÓàc…5äØèSÿ¨ªºÿ®8þýŠ’6ñý_ºO”gg´rñ”°éîa©ëX~ô·1_K là¾þùü’z«jë‰]UÜA¥|ðý¤çá;@üÆãw4>瑈)ùø_ãêûr8¥öSÿ¶T*Êb¦çIÌžÊ\NqØ_x±.Гc÷õhÿ³ÅS'¥v’ß»–…ãïX··<!Gcuì—ÊÄø¬‰Â`ÒÿÄâ»éµÿìŽu=k�}ÙËàq[@ÂD!GŒ= Üÿ$ì�ôÿ
ú±½8endstream
+xÚ­]sÛ6òÝ¿B÷tôLDã“&Oiâ$î´NëøæÚ>Ðes"‘ŽHÅñtúßoP EÙ¹I&ã`
,‹Åb¿(>cð�ÏŒN™´j–[•jÆõl±9a³[˜{wÂ=Î< Íc¬Ÿ®OÎÞÊ|fS›‰lv½Šh™”Ãg×Ë?’×ï_ýv}~u:š%Yz:×K~º¸|C#–š×.ß^¼ûÏÕ«Ó\%×.iøêüíùÕùåëóÓ97šÃzá)Yðöâ—s‚Þ]½úõ×WW§]ÿ|r~ÝŸ%>/gòùä�¿Øl	Çþù„¥Ò={€K¹µb¶9QZ¦ZIFÖ'O~ï	F³né”ü´4©6"Ÿ � ¶i&…tìšûfÝÜ>žÎ3Æ’¿ñ@3!S‹ÜÏ9O­ÖÂ!rvf^ºi6œø±É3¡F³tAaÀ9ãÙKêH¤ä hÍ|rGš<{œî�äóÔJaÎCµ^Ã�žÜoO¹IÊU¹¥~[n¿”Û;"ij¬Ëî¡Ù~¢gÔvw%amš¶{� MVÍzÝ<”K¸y¤öž¤’`©'û'Óf7Eû‰–­Sü˜ãSÒ*jÜQ©ˆ¬’‰D¦”†Ãvw4M,P~]”÷]å¸
ÌfEÃ�Q
+àÜa|
+ÔëŸð'ʨ47Â:™¡åYÊÁºpï©Òm³íÖU°»¢sÒ›6ñB¥VÁóØ©²1í}S·nDÂMÒLAÝ7—©ÿyWn	Ü�4¹€e´=Œ:Cƒ02Üã`ƒfç€Å`tѸvÙÒB´šWW­³ãkÕl7U}K³ÅÿCoÂd¶%òiUئìp#ˆMØg’LÖÅÆCäëöç�%°´�Ô£m»Ý¶¦>¹« VvwÕpV%nwÃ\QÓÂêÜß²ìJ<9\'�ús
;þ
Ïs³Cz,®Kºðfê6ZKÿ·[àcÞl=á‘Êh–
+ÎnÛ+—#|�ž!¼¼”ñl¦¤»À�~ÓÜöÖÛ¦«(À
+èó?ØØÈ	�©"/Ë…7"ÀIxjÌ�ä
+Ì�rtèõXÏ0rHÍËUHØÌ«0´XW½˜‚¶®I•p¶Yz¼ö®Ù­—1^±Ýõmt�@]¢€N€}chÂc½.œåIqO‘Cs¿­àª0ÀÈ3 Rt4_µn(Ov-½)\S?z`¹ô¬¶¥§GF:Dr
+±­~�3&H¨l'¶ÙIÈÞCXˆðÅ”Š“ƒPƒbÁ¶4´po€%nª,p^ù©fë—Ó2�ßøkѹ÷ì†ê?·;z!{Ì&ÿ½+=é‚(÷W¬¼ƒ6ˆ5`™^`
+õyáü<Y^,(i†:¶UÆ�8[ÔN'#ä
÷èãžh/÷Î W@•<ðºÒB6 @‰´I…
+ì(Óû��»µäj”ü�LŠÏ1™ëTäàªLSI@ÉAÍYoöü�­¨-�õCÈY?¼õs &“N
¡ƒÁ¶‹»rñÉÁß©4c¨¦·EU‡¢B·¯5D)7†j{-"û¡b
+�tSº 
 endobj
-1272 0 obj <<
+1277 0 obj <<
 /Type /Page
-/Contents 1273 0 R
-/Resources 1271 0 R
+/Contents 1278 0 R
+/Resources 1276 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1255 0 R
-/Annots [ 1276 0 R 1277 0 R ]
+/Annots [ 1281 0 R 1282 0 R ]
 >> endobj
-1276 0 obj <<
+1281 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [213.6732 432.1255 286.8984 444.1851]
+/Rect [242.0197 432.1255 315.2448 444.1851]
 /Subtype /Link
 /A << /S /GoTo /D (rrset_ordering) >>
 >> endobj
-1277 0 obj <<
+1282 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [209.702 354.4169 283.4678 366.4765]
+/Rect [238.0484 354.4169 311.8142 366.4765]
 /Subtype /Link
 /A << /S /GoTo /D (topology) >>
 >> endobj
-1274 0 obj <<
-/D [1272 0 R /XYZ 56.6929 794.5015 null]
+1279 0 obj <<
+/D [1277 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 398 0 obj <<
-/D [1272 0 R /XYZ 56.6929 498.9148 null]
+/D [1277 0 R /XYZ 85.0394 498.9148 null]
 >> endobj
-1275 0 obj <<
-/D [1272 0 R /XYZ 56.6929 477.595 null]
+1280 0 obj <<
+/D [1277 0 R /XYZ 85.0394 477.595 null]
 >> endobj
-1271 0 obj <<
+1276 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1280 0 obj <<
-/Length 2260      
-/Filter /FlateDecode
->>
-stream
-xÚÅYÝsÛ6÷_¡É“|SÁø&�>¹9;uçêÜ)¾¹¹IóÀH”Í)%ª¢G×éÿ~,@�eûêdnô@\ìÇ‹ÅîŠ�(üØÈ(B…•£ÌJ¢(S£Ùò„ŽnáÛÛh&‘h’Rýpsrv)²‘%Vs=ºY$¼¡Æ°ÑÍüÃøÍ�翹˜žN¸¢cMN'JÓñW×Å‹�7ï®/¯Þþsz~šÉñÍÕ»kœž^\^L/®ß\œN˜QÖóÀáÈ‚Ë«¿]àèíôüçŸÏ§§o~:¹¸imIíeT8C~;ùð‘Žæ`öO'”kÔè
^(aÖòÑòD*A”"ÎT'ïOþÑ2L¾ú¥Cø)aˆ2<Ð&
-n<ÍÍ`ε/ꪪÊÕ-¾_òåº
-ßʪÂÑmù9ÌmN™yS¯òO‘îSq—.�EÈ1¶QFUÏòÀè®n¶8ÊWóýTƒCçtî9/QÌl[ípfV¯VðŻÐ
-ÐÚ‹•2p€©àÒÞ9]¼
_uýpG˜`‚�
þŽíf;0©øÈ+JTÆm m¶ù¶XbØ‘ëb³,ýaEööçÛÒŸ' ðv³ղÅ
¯Xw@2$ ®aÛ»†1ÜR à‘x¼uù¤s{�¿/}^55Ž¶Ã¸™òc©"ñ‚&$¡œ÷1û®ŸÁ%‰ÎÔHº¤ZYæRiü¶¹á`šäÞ‘|’ÒûÔ»+¼ÏÕ)ñ¢$nŠ¯]ðŠ¾B’k"„2�j€–ê	E¹9Mî§�à„VËn
-r¾Â]»B'p¶Žš*θ£
§�œXö¬jˆkŒ®…&-ÇIÊ�ì(Ç-ìµÜö[¾.fnÁ9‘TÅsW†;a^¸cƒñÈya˜Æ$¬yâ-@i©ìÞ0÷‚TG�&PY² ¨¥ê &9T¶1ʉ¶B¿±Èq’²ôˆu”cþ:�{Á>]s·í
-Ãt7‰éª/Ûƒºî%FÇ_à„
)N
xJ{Fþ2 ¶Ë CEÏREóf~Òü
-cî#ÆTdC%1¬ªŠÛ<dîŸóê¾hƒôf@9c€ƒO;%Ü�™m“«�¨¾>Õ"#RAÄ„ú‰dÔšç^!
Ðf½Vߟ[¡ûæÂQ
p^aWôo‹hL¨%¬UGîW)ˆ�,Œg’Ìûœ}Á¿)&Þ×Òi§�4)$ëðÙç“2ú$�¤i;Îïu¯pXÔãBÇÿ©WÅPFïVU9HÃ ¢5¥Ð¼n·±P˜}úü|–qÅñ¤°GRŠ§v�ÂA-VùjŽ­�ÿaUŠ{›Í·¨h[4õ2Ò  ÞM’Éñ#°'ö¼£o
-;·P™4û„�[Ed¦0eœífU9ûf°ç	A}¿šOpô)~椖}­
Øÿ©ñÿ�L["2@|âê&uZYTX‚êPìh„gz¸ÀŠÿ
-‹ÉC¿
áxkÙ.‰Ž3-(‘㣹_8mýÍé2¯ŒÅÞ%dj†P(x»€æÕC¾kºMÊã'ÿ‘0ë»,ç±ñ™´Fa|~¤	�ìHTé{øÕ¢× :LÚ¤…êQ>»)¦ÝÁë5x¢ëu‘{]öînÀ¸¶û
-2Z;˜õ2cð¨@ê‰(¤*‹†ûWÊB÷Wî@ÿ†Žž¼‹žû�ñþïtér}Ã�t¤b8J9ДíkÞþµ|¨ú
~
+1285 0 obj <<
+/Length 2262      
+/Filter /FlateDecode
+>>
+stream
+xÚÅY[sÛ6~÷¯Ðä‰Þ©`Ü	¤OnÖNÝi�]Å;;;i‰²9¥HU¤ãhwúß{p£À‹lï:™Ï pp.€ƒsŽÈÙ	‰¤¦z–jŽ&b¶ÜœàÙ-̽=!žfˆæ1Õ7'g—,�i¤%•³›uÄK!¬™Ý¬>$Qt
+pòæÝõåÕÛ,ÎOSžÜ\½»>�S�“Ë«Ÿ/\ïíâü—_Χs¢IÞüxþ·›‹…›’žÇW×u#Ú5G˜.../×o.N?ÞütrqÓÙÛK03†ü~òá#ž­ÀìŸN0bZ‰Ù|`D´¦³Í		ÎX)OÞŸü½cÍÚ¥“øŒ(“t
+@
H¨BœÂP*4’Œ2‹àNçã„hŠˆTˆžQþ}ˆ†þ·€ÀlÎS¤(NgsB�‚>Â>aðìÌM^]šý€N]¹�e™5�뾬·¢(Cš`þ,IRE’n~¼¸v½û&wD¿s�zçÈà›E2Y�I¦d’o†{!nìÙ¸±çâÆžÂ�¾7ú2ÜøX€èHcs‹µ7�LÞæí._ç~°½ËZ׫òÖj†û*}'‘p“g—p—Ô0H‘fTYš›;ÀœJ™¬ë²¬ŠêÖ}æ_²Í¶ôsEYºÞmñÙ�íN‰Jò¬©«ìS û”ßeŸc‘ãè;m�QÖËÌ3º«›Öõ²juj\×:Ó®
+'fÙ–{7²¬«
+>óÕ
+T[·l$Dûg±†!'‰ú[fFšl“÷¸‚ñ÷÷&ÁäGÌ�÷;ÚRt‚^U·®ó)w­9Cù
+¹kÚ{K»kšZÞ†°,š6x #^
+”
+6íqí	1 ~}ƒMMßÏáI×y„x>)°s2¤¯=§ŒuA‘ˆ€Ë#.Mî‘x·[
Tàu&=…‹Ä	·Lþy—[¯ ’Í}Ù�sòÇ£¶íªq$™�)Úû]eÏLUð=ž¼jìÞ™9ï—6ÙÞ
|òlàyZß—nÌÞ]há,þŠ1½½�åy'¯Sîý õ)fñÝÕ'¶d[fK«5g µ˹ç
+ŠàCyá¨n^¾Výf0
+î%dZ‹#,Ìr¸ßœ;„.ð3çç‹ËüˆBfbÃC‡è¢—
peœ³
˜¶
%GHâ¸Ý�ïGŒú/8,pÁÉ¿ë*Ÿ
+éͪ2GÃýæ"Eœ@¼#ó2´Í¾Â+¥ñóóY†Ç73¤8gOl «ÐÛ¬#«V®´ñ_쟈aï¢ùnÿÞ'hðŒ¤<yõÈœ—AôMQ§R"‡ÞS¨S
m*\¼¸Ü/ËbùÍPÏ"‚ú¾ZÍ]ïS˜&þ±a_ÿÃoÿ¿I¤F,¥&_‚œ‡pgU£ìŠ¦
+¶ŽÑ™

ÑTN'Wá J!SaÞ1^Ö¾î䫶¯§JæEç\�
+
+…îN–»ž“%¨ˆÊ�[_{šTìX�Rqo
+×ËÌþºàŠ>û¸ür¨ìÉ4ªY[Mïüh™Ivu$��é„'_T4uí,ÔÌQMok¨¦pPHˆ†øMØ×[šºX/Ê1¦y%2×4÷k£­}7MØ•’Pº„0M!Lè ´’•Ù¾é×(�ßüG¼¬-²œ‡ºgTÃø|OãÙ¯2<áWëA}h±qðª‡êÉš˜dZë;Á‚í6Ϭ.‡ðv?a\W
†},„La1œ(Ojˆ ¤,òûQRBóKîDíÏž|Šžûƒñá×tn}E§ý”wg,(eËÀx¤yøey¬úŸåF˜endstream
 endobj
-1279 0 obj <<
+1284 0 obj <<
 /Type /Page
-/Contents 1280 0 R
-/Resources 1278 0 R
+/Contents 1285 0 R
+/Resources 1283 0 R
 /MediaBox [0 0 595.2756 841.8898]
 /Parent 1255 0 R
-/Annots [ 1282 0 R ]
+/Annots [ 1287 0 R ]
 >> endobj
-1282 0 obj <<
+1287 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [353.6787 434.7534 427.332 446.813]
+/Rect [325.3322 434.7534 398.9856 446.813]
 /Subtype /Link
 /A << /S /GoTo /D (the_sortlist_statement) >>
 >> endobj
-1281 0 obj <<
-/D [1279 0 R /XYZ 85.0394 794.5015 null]
+1286 0 obj <<
+/D [1284 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 402 0 obj <<
-/D [1279 0 R /XYZ 85.0394 505.3435 null]
+/D [1284 0 R /XYZ 56.6929 505.3435 null]
 >> endobj
 955 0 obj <<
-/D [1279 0 R /XYZ 85.0394 477.7522 null]
+/D [1284 0 R /XYZ 56.6929 477.7522 null]
 >> endobj
-1283 0 obj <<
-/D [1279 0 R /XYZ 85.0394 352.0635 null]
+1288 0 obj <<
+/D [1284 0 R /XYZ 56.6929 352.0635 null]
 >> endobj
-1284 0 obj <<
-/D [1279 0 R /XYZ 85.0394 340.1083 null]
+1289 0 obj <<
+/D [1284 0 R /XYZ 56.6929 340.1083 null]
 >> endobj
-1278 0 obj <<
+1283 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1287 0 obj <<
-/Length 3153      
+1292 0 obj <<
+/Length 3119      
 /Filter /FlateDecode
 >>
 stream
-xÚ­Z[wÜ6~÷¯˜·•Ï©TÞD‰�iâdÓ³uºŽ³/mä‘ÆÖfFru±ãþú’’æÖtÓ“s"	�>óƒ|•êDaV™QIÊxºZï.ØêÆÞ]pÇ{¦xÎõÃíÅ÷oe¶2‰ÑB¯n7³µò„å9_Ý–¿D:É%¬À¢×®ß¾÷éæÕe¦¢Û÷®/c‘²èíû]QëÝÍ«Ÿ~zusó<åÑë¾úùöꆆ´[ã‡÷×oˆbèsbÑ›«·W7Wׯ¯.»ýñâê6ìe¾_Î$nä÷‹_~c«¶ýãK¤ÉÓÕ3tXÂ�«Ý…Je’*)=e{ññâßaÁÙ¨�zìüè–H–ò¯ËEbLªŽ‹epY¢µ>³šÇ`-×ô3–KM׫
ORÉx¸^!Wœ'&MÞ¯‰Ì¸^ei
-w®é~¯ñ„-§IR­82rËÐÜr|¸Œ5�náܬÉ2‘­2�“KaE¯~_ñ„)c$1ÍÚv¯ÓXÂ÷ïwbõ¦…­f›òÇó•í¦´˜Ù,˜*p�|¡’ô·ß>T´+-g¬‚%*S¹ÛU×]ò4ê«!n»KÁ¢²êÜœùòpñyn¸›ÓÅPíªf¸Œ¥QÝÓ·iáªlGF›q»}qŒ»Ç­�W•ŽÐЗÜ
[„es
-}Öc£bp*‘ZÂ5Ó•Òõu°*ŠY•mÕSËj„
§6ûññ¶+¹Á_…P¿2&¾\JP»Ä.
´žFçS7÷Éþ•+m‘›|57·o³`ô•ÔhØÛä…ßæ_K§àÌ>8?‚yBJ0�넧pŒ1°}.L46pxÄ0P½Ò<GmøqüuLñœëŒ.žuÙ»*†í¾`þaðÎ	öLGÏ=Ãd€÷œ/¬´&%¢
Ü	2jÆÝÛ
}ûjÝ6eOCKÄu±¦9"*h·á'tO~‘º)ëu1Ômæ/Y1¢—u_Üm+·*®†GÏ#Çõ+KÙíCíÔƒ/AØü,em.Rç¹×ng8ç™À
->Ρ¯™Dç*óžÆŽ»š‰RÆ‹�@tµŽG͇vì&¯ÛÓ<‡÷�)ñÿi¾.
-@Jõe]ÙË…væΫxqÚ ýÚ†'4av,â�çz»%Œ¸søÓ×[“ \u—9¼œ
-ì:O3qþžç\§/:pÙ›®›¸kÛ¡?¸eÆ0}’çE®#²÷!ˆQ�Á,„;àÊQ½fŠ¿`ÀÆ_ðµ7Õ’+w³=

Å@-:kãPù÷±v¯�:[ÉÉÑ&®ªöœ™…Ô|OjK,wÎ 1“j²Ú_±^W�
-#Ö–£n*ûÚHH„ÊõB›C\¢Ãáj.½tY5E x2Õ—G÷2Á» §wÁž¦pÂñà\síãny,èæ
-ø’K6•\Šh¨{_3»‚€“F>½ù™Hw£­oÈѲÈjoYlÒ‚/CeL²è?huÎX€%€	–ߦ7:‹R.\%§%‚bFOEC7�"ëR™-
¦‡¾.mI·C¥]uÃDtÕ hÝ9ʬœ'pëÿ
¶JÌ`4M¹;ŒM¹;Ló?H@Ó‹Ae÷çŒýX8�¾8Nåẩ3D�ÁýòvàØë€WÔ�Îì£ݦmâI1­ƒbÚ)¦hô]#.ŠÒ3¶Ç¢ïixx \ïhèŽúŸ1Á>zíë$Ì*†cî|7EF›®¸™.ô‹õgg‡ÖŸ¿÷Q×lŽ³½=f_bsK:RK¾†ZÎȘ·ÐŸCV'ùŸ”WgL§ýÝ3ùòêIoljƒËž˜e˽R3R/„“«Ë\¹Ç,Ÿý¦�òslÙ³¶ãUß÷Ž™Œ[�úÙtš.»Ááªq4ûó?|=d\Ì1
+xÚ­Û’Û¶î}¿ÂoGž‰^tãã6Ùô¤Ónzvݾ4}�-ÚÖ‰-9ºìfûõR–lÙM&Mf"	@
+.y|t
+>ó∡â‰Q*†)<0ÆÀö¹P^W‚6ÎâX>ƒ4<aÉtüµDþ�êŠ,Ž
+eÙe{í·íî”1Gkñ®qî©&XË‘EA(’xÌûQ·hP¡ðZp(
+õKcQ“®€¾+”ºÎ¿§š`ä
+¨€s9–`1W`ð 
+YëÈ»ª[„^©ÛçªþD“m�­qëŠæéâFÓ­ÍM˜ƒ®×U½ÏÊ•~…e/WDG'�š¶¢…
Í•z.ód)³²yÖuLø€ÂaâHŽÍû\�':À“óÞ*�—	éu�Î	2Nß;2’óh�€#‰[x À¹íºÂ„
+¤Ÿ;]Ú²oí
+¹ºº¤ñ#Ô¿ ªßßa±zûþçW´v©iG<$;J"eêíªÆ”Š4Ú–f„1°â½Î°fšyxh̵"Œ'o:¼0¤Í,öþ‘¾æQÁ‰�9>¢náÏë[‚]C—g³âIÆ
+›IЬuÓ”"Ý‘J7í	�u^5âšžp­ˆdi�Êc¦'q;[­ô
brð5É-TÎ}±ÊíÄUÆb⩉•@EAg†ÃP†1déð"¥\|Mɇ´,MÓË-(HõM©YqV=:é@-	$ÄâRK…ó(ˆ¼ó2‰‚$bêßè©à¦îp&%‡tÊâ«©Òïì·žèª@�U)C	 ¡‚èX®«0êgDI_ÛH]nUú}·$SØR1ù-mƒë6äC¸ÀIlôEñÕri¡¢€’âz4³T¤Â¦Øøð`yѾø&üÃèìþÑ–ÒT—NF6GåÉ&"ˆ›`@	òxЫkó&1›g#à¢Âæ¡‚/¥g’a¹Ž�e´`ÝÁKib�Ÿ·º$èíýããÝ‚áäeæ-Ϭk«}ÖºþR!£q„*VµÑ <mt©kJ!%çô"r“âÐîl¢�ì€Ï_Êl_¬ÙrØ ¡|`Ou/TÉuŸ¨ Lc
4Yo¬{=n¡§÷‡Îoá|_ÊáVT¡lð
+åŠJp
ÀšÎULëÊñuwV]MøÒUB6£ÔD»]õL Mú:iW싾ÚÊöUçv©l�µÚU«O¶Öú¤Ÿ±¿q1»ƒZƒÙõän@t%Z¢>µÓëZ7[ÏöªïjM¢
u[¿œÓ:ä™û`0‚ˆwMþžèü
+­ÝfKSKÂjÇèDt´g"ýªl2a[³£u�múbƇlõÉš¢qé×.ó¬±æwBì:AlhL-m +	²vÆœ‘^øß02
+Âé&3ë»ßý?eŽ?©‡I 1a™N”°3$Ày­Pæ·O~*y$SxÔD2!úßL*úhendstream
 endobj
-1286 0 obj <<
+1291 0 obj <<
 /Type /Page
-/Contents 1287 0 R
-/Resources 1285 0 R
+/Contents 1292 0 R
+/Resources 1290 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1255 0 R
-/Annots [ 1290 0 R ]
+/Parent 1296 0 R
+/Annots [ 1295 0 R ]
 >> endobj
-1290 0 obj <<
+1295 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [297.8955 313.5049 347.2449 325.5646]
+/Rect [326.242 275.682 375.5914 287.7416]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update) >>
 >> endobj
-1288 0 obj <<
-/D [1286 0 R /XYZ 56.6929 794.5015 null]
+1293 0 obj <<
+/D [1291 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 406 0 obj <<
-/D [1286 0 R /XYZ 56.6929 670.419 null]
+/D [1291 0 R /XYZ 85.0394 667.0947 null]
 >> endobj
-1289 0 obj <<
-/D [1286 0 R /XYZ 56.6929 646.4658 null]
+1294 0 obj <<
+/D [1291 0 R /XYZ 85.0394 641.059 null]
 >> endobj
-1285 0 obj <<
+1290 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1293 0 obj <<
-/Length 3875      
+1299 0 obj <<
+/Length 3888      
 /Filter /FlateDecode
 >>
 stream
-xÚ­Z_oã6ϧȣ¬Uþ“H¡‡¶»Ù6‡ë¶—M´}P,ÚV–\KN6ýô7Ã!iÉ–ã.î°‹ˆŽÈápfø›‘ù5ƒüÚ¤	“¹ºÖ¹JRÆÓëÅæŠ]¯`ìû+îyæ�i>äúîáê›R_çIž‰ìúa9˜Ë$Ì~ýPþ:{÷ÃÛŸnïoæ"e³,¹™§›}w÷ñ=Qrz¼ûéㇻï¹{£Õìáî§�D¾¿ýp{ûñÝíÍœ›”ÃûÂÏpæ…wÿ¼¥Ö÷÷oüñíýÍïÿ¸º}ˆ{î—3‰ùãê×ßÙu	ÛþÇKdnÒëg谄繸Þ\©T&©’2Pê«OWÿŠFÝ«SúK¥IR#ô„…(�3h«ìZ§y’IB>în¸™µŸms3—"�ýƘp$û\ÔuGÄ~]ôÔz¬ÛÅgj.wÅjc›Þ–Ôߋ϶÷oMùM»;yç—÷?O0¦/hiꬨSôvùÔ8l{Îy’§©p{H¹ Sy|émG(9›=¬«Ž¨ñÙ”vkáOÓ¡]Ò³_[jå“ÝõU‡[Â>	°°Õ“gxÜ/‘´D‰°ÿKJšæMm@Ã<AQ>[6Ý|_nç]õ§õìÃÉÀXtî™aJžœØKX
-&¯y–HÆÌ´y¦ù�‹Ì€OùQàÂU7EjÆïí|Ùî6p"G2ðL&™�æu!"ׄ#cÌ@Ep$Ƨ­]T(…EÓ
-¥‚åöEMòË-=:ðçõ‹›3jö¡¢ÓÇyz¶0ñŽšd;-ÊÑF¥È©Eva§:‘ܳâŠú²­<_¨k¿ÌI2͒̈¨ºÁÀâ]pÓô->!bZê¯lcw…ò‹g[Û‰ Ã¥L”ÔÊ‹Ô[ÎífúpÞqº…<MxªÓ°Ï¶­1x9ûØö–֤،«>¯ñŽ@ZAr9$çDj5f*«1QCMOºî¬\åc“Ž-´<w6à`yÎô…£
EKˆAÄäâ?ÌX·EiË7ªSi"M*‡š›˜ô«¹ö¿)^hÚvSy
uíÆzÚ2lÂke±¶‹Ï^oøN§íþ†Ïjü�þí­Ý¡&‚U@›”Æ3–h¼ç‡:C=ƒ•Å#
-hD†SÁ•ÛMÝ�./™y;Z§liWMÛ¡ØnÑ·y3
No•ž¤B—ØÏS[h%õÔN„ ×Õ°™çc×ÝØ¢qØBºSHEp	 Äó€¶;�Tž’¥‰ÉT~IH•²t$%MºÙw=-þè—F
è>Wýš<Α³®Øø–S45kûdkb,º pX¥‹sémÑYHªÆÆH–'ÏD(Œ˜iž]v3ÅÓh	mƒË®ö»‚îPœž”ëNÉ d¸5z»!x‡]0Ï‹Ã�ûŒaâ:’΀�²l`.´„{j to°
ñzï%Y^ðGëíI
-6=uÆ4y
-O/—¯¯¹&–¨J“`Ùx}ºV5„H'
ç|†îb|>¬º.]¶d°úÑ?[‡Ÿ«À>‘ƒÕU2¿7¢ml×+gÝ:\‡@.è�ÁÛµò¡@ជNLñaú¸Fl0™2
H"r–Á˜ÁäUYñÏàÿÍp
›}·¯ê~ÒŠðÂ@I9UÌ*\ê8aHà��9s¡ÍA¯Ò&“†Ï¨Ú>U¥µ8ê�¶Ö¶Þ.÷51–U±jZïI�„~MSíWkz£ zOHrEwƒŸCÂæ°Gò;p;ÏO0
-w׶³û²�÷ívî
-ó²Åè?U‘"ÉR"ùcÕ”ÓÕX¡yð6'¬r¦
WƒŒðüÝoú41#¿‰xÚÁr¬0C(òÙ
.öŒu¬
ãöŠ]O-§+Êâ±;Pô(cÇá3*‚g‹ÓììÒwŠø)uÈê°'³Ž¾Rž;3ü4lHHl˜‰36<×)Ng$. ƒsvx2¢Ñ1J¬Ò›ìÂ1bRÃc	0Ô^aZç9¸–Ã:ðë’¬Cc/çƒ�
_g	"Â[çDÌ$
-Œ×¯~÷qê:„€¡U°ÜoãÂdN!á )2Ÿ�ên‹�¸¥&Ñ’†c¬ÉñnÇ£í¨Óí�
-r�u¾©‹�'F˜àoE
ïì]+Ky]©67¾T�PªÍµWeî®ïÎ7�÷€S)@2í¥ÝSci]927áU=k(Q@’_©¬ºâ±ÍKå\êãpî‹s23³½sa¥ÂG'uP’ÄÚ�…mßäbæØ©Ö†ô5DØ£÷¢KOœ?Üp2æR¨Áâ·ÖÚÍüB‹–˜$ŠÆ]ˆH/zÚ/ÛºZ80
½ð^J1G©³f		sšh“§ãœá•HÈy@qH¶°äÔ/Ö1G¨2¦üg
->?ÆU^¶öÌw2™‡‹óá?Sáš2}õû/?ܨS>£ðº—ºN2ogDx¹ðЇïÚÐq_—sÿùþw%5õâ‘a'¢h;/ÊCÝ	[þµÂ5ääî÷
-Ët̉û‰
¤4úè(ü:ÓõmŒL€cäQÜòQÎ{šÇzÀ½¾´1ñS–Xy8ã…øûÈzäë^8ä:ï…‘e]¸¶9rCü¨Îå릉…G6&!ƒÌÕÑÊä„YvÁõú@Ž^˜
ÊpÚG^cä…Ue²,z!4�š‡sžóBÃ¥³ðU$tÎ
]Õa세ȴÀoÂÏÕ#ùKÞï¦çñÃ,N~µãÁ”TêÁ‚çuDÇkÚ=)g
’)�ˆÃ)Ü(‹uÕxéʲ„·³Aþ“z$–ö`Ôñ¯
-\@(MÃTˆ¢Ê•à‚HˆÀ=øŽå¾Yø•HrGxa»«6…3ììwX@ 7œm
-xú4àéË
ðv®²<îÞ'Ÿnïÿ}{?•2d	à}õWÃ`ÎYö5˜ÃI|ûBÆ	˜Ü˜±™ýåp'Î9D ¢�øÉD�IðIyŒ hpÃg€Â`ª‚憀áh
¨Ä¯ÐÆß:RÓ .`o ëãB¦‡22ñz\L'"‹¿g;‰›ìlpp¿LRÇÁÁ½s2}lœú|õÑ4ÁßROx"»Æð?ÿdûP„Q:
;g~*Ê2H³s„rÅÓŠKüm÷©èÿ”Ãendstream
+xÚ¥]oã6ò=¿"�«üE	=°ÝfÛ=\·½Ýôp@¯ŠEÛº•%×’’uýÍpHZ’å¸E±ÁŠŽ†Ãá|Ëü–Á?~«’(ÉDv«³8RŒ«ÛÕî†Ýn`í»îp–i9Äúæñæ«wRßfQ–ˆäöq= •F,MùícñË"‰DtØâí�Þ½ÿîç�oît¼x|ÿㇻ¥Plñîý?hôÝÇ7?üðæãÝ’§Š/Þ~ÿæ§Ç‡�´”8ß¼ÿð-A2z\ úñáÝÃLJoî~}üÇÍÃc8Ëð¼œI<Èo7¿üÊn8ö?nX$³TݾÀ„E<ËÄíî&V2R±”RÝ|ºùW 8Xµ¯ÎÉ/Vi¤DœÜ.e¥°ÿ¼”y¤9$­²(‘B)>'e�…RÞå_–}±_¶åïfzdÎÓˆs@Ò=Û=`Íl/ÛJÄ2™Œ÷ÿdºön)ÓxÑm

€¥r×ïhòðí‡O4úù۟ܺiÛ|ã�-ßvTç;SÐð¥¬*·lj+kz>;Ó‚Rh.ÿ¾ËÄ"¯J‡òœW½iQ
+ yÅYŒ§‹2¥„å5?ÜñtaPQäBq�à»!@̲„ ÿeŠ9Zv¥é»¶,ŒCß–|Èë�Ã|r�¶¬LÝUG‚æÅÿú¶3PæÀ»lñ¸u˜…Yç}բݖà~ä˾Ãí;x:6>Wßö9nÏÄ‚N˜·MMóus Akº®¬74)�…X!À3§GÝÔË_
+còiåùD>èN6N¼�9¼zîFœr± ­’ã�Ó•²ExÖ…Ùƒ†ÏhÖôìH9(γ9te‹GÂ91°2å³Cxê×Z#G8GÝEŽ&¾Cèl|³ü™¢nGncbë	øH�9dRÚ©;u>+ÑY”*xëUÇ6ĺìØ960˜^~e– Æ;¸‘©“*Zǯ3°f¸ù·˜EB¥zÌƧ½Y•È:	’&7b�ÆŽ?;Æ;ÄçïM=ÂlýD±ÖœùjЦd Gg¡ÅÃæ–§
+øWNuN—¼öª+ÑG GI$#}ÆOÊ¢TBt{U¶
ëgÔNŠZ“7Df‚×Á‰ó:8,[RS™
¯ŒAHbÂéig¾t3ºa+ÀOH÷.<ˆ$â—‡žçe[®¶°]Ì­…â“n;ÿÙ�!gP¸%ØÎú]œ�]îé
A«ËQ¾x8ˆKïJº}¤[Ó³
Â’î´´�w(“ƒJ‘ER‹äÊIu$¹C9ù-dõ¸/Wà<�45_–$‰–—Šdì¼@ã­ÚG­(¬Á|cjsÈÝ2€�mkfœ—2Š%X±dürÕìö kçGÈTÄ•VþœMS¡óLåâCÓÚ“|3îú²Å�°œ
+zÊ’�ºÐ¹-I`€ÐÞãvï8YåŽñ'ãô	–N"bÙç¡,
+ëg¥^ØÓÊÔê<öäC—NÇá0^y.Í­<å­
+,Ú¨
 ²^U}AU‰%:s?JCÑ™ˆ?''`þº†W
+�².»’jhuªu›¬ï`q×ï0Y¥õ[¸8©ûÝ“	aQÀ�ë‰o¦âNù®?´å3„ZCÐHU�d–MßRÀ‰Ž–ɬî~¤å
Ô€5ÁH¨¡wAÚÅGv$u”Å!UøÛŒêHÇ©÷"¿¡+¼ÿ
GøUaí~N4›„$åï—h¦ƒ:’øõN<öJ
Ç7‡gªa]7…œ\yʲi~±Z™=H0 d\[æuö{r+
+zHó’¦<Šuâ?Šx†.¢í8ŒÍ7™7CH®ÁžðsõÈ þ�=»êr2Âá§Üô€$u:�1o{-Á1FÛ'Õ+ëA0ÕaYA8YmËz€KñnˆâßNµ�riÌí2…d+�Çö³¦€ˆ5}‹½�mγ„é·Ë<
cÝ×+÷£É|Ý/ìå.·ê€“þ€ÍzÃê
+X€ú¤”èÌMö§‚™ûM\Óïij÷„'ä„«Ü~f™“‹ýù_ê~?+üùŒÍÄ,>þfÐýB1Äë@£S¿Rd×è–H…šè8ÑA÷õ\È‘‘V©wïÁ³Q›I¨¡Ù$‡ýkþ.4E"üíðŒÏa·~³¿üåSéëH¦©¸ðÁL£ŽÇ”íˆsOÍ°A&fXÿ?A
 endobj
-1292 0 obj <<
+1298 0 obj <<
 /Type /Page
-/Contents 1293 0 R
-/Resources 1291 0 R
+/Contents 1299 0 R
+/Resources 1297 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
-/Annots [ 1295 0 R 1300 0 R ]
+/Parent 1296 0 R
+/Annots [ 1301 0 R 1306 0 R ]
 >> endobj
-1295 0 obj <<
+1301 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [353.2799 712.4951 410.176 724.5548]
+/Rect [324.9335 676.047 381.8296 688.1066]
 /Subtype /Link
 /A << /S /GoTo /D (zonefile_format) >>
 >> endobj
-1300 0 obj <<
+1306 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [84.0431 287.1511 144.9365 299.2107]
+/Rect [55.6967 244.9849 116.59 257.0445]
 /Subtype /Link
 /A << /S /GoTo /D (view_statement_grammar) >>
 >> endobj
-1294 0 obj <<
-/D [1292 0 R /XYZ 85.0394 794.5015 null]
+1300 0 obj <<
+/D [1298 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 410 0 obj <<
-/D [1292 0 R /XYZ 85.0394 361.2567 null]
+/D [1298 0 R /XYZ 56.6929 320.529 null]
 >> endobj
-1299 0 obj <<
-/D [1292 0 R /XYZ 85.0394 334.109 null]
->> endobj
-1291 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F11 1298 0 R >>
-/ProcSet [ /PDF /Text ]
->> endobj
-1306 0 obj <<
-/Length 2000      
-/Filter /FlateDecode
->>
-stream
-xÚ½š]oÛ8†ïó+|·60æðC”È�+·qºLÝ®›
3�Õ–¡Ž”±äf³¿~EJ¢ešŒ0À LQ/ÏËç�¢ŽÓ�	†dÂcK*'‰ŒÇ„O¶�7xòî½»!F3oEs[õæþæÇ;–L$’1�'÷{+–@X2¹ßý>�E3ˆ€§o?¬ïVï~Ý,fI4½_}XÏæ”ãéÝê—¥n½Û,Þ¿_lfs"8™¾ý×âãýr£oÅ&Æ›ÕúV÷Hýq%èfy·Ü,×o—³?î¾YÞw,6/ÁL�üyóûx²ìŸo0bRðÉ3\`D¤¤“Ç›ˆ3Ä#ÆÚžÃͧ›w
­»ÍPgþF”ÅÔ‘@ʬ
-‚¸”|’p‰b·T?=eÛ|ÿ’_Œ Öˆ„R
-°QÒ*;~ÏŽ3"¦ó|7›3F¦eUécö“lÛI†d¤üœzÌ6=U™jâ©j"Õ¥þìîÕÙ¹‡¾J+}{_ž
-3ôË‹	ñ`†~Íj5h®&5™“ˆ¡8a1´’œÓf>*âgÌ1ü½¨ûS±­ó²€½ÀžÞ«hª—íÓÓ¡v¤‡P

#w~.Q”`È¿Vç•#"ä›°6^Q™#¥°(�)rD™S˜˜HÀjÎ`Cɺg…Ĉ$ð`»ý”êy^hÌåãSý¢›¿�qåpÆ™#Î㤉·6«ÇÙô¡YM«²Y(èúÒEWW™Ž®$ÿk¢7½j
>}Xèþ´0ÁÖŸôg“Êl[6Ÿ;cP‡µf°J1mV©2†©Öë‹=ŒºÕimfùPžÍ)¦³mQÓÃA%BÆÓ/™þL‹êY¯¬V=‡rÛʸž¹ê}~È·ºùç);æÊY]¿¦]”õyð*+L�zT¼f#«ŽUQgÇ"«ÿaâ4S(Û
-O e¬¨.¢nÎп-ÕþmšµÎ«jª'¥zJ·™ óPŸŽ…¾¿þÏí‡÷‹ÕZ_é»ÕSYTz
-ê3$<7ÞÒV5‰¬XB ð‰­XjÖŸ1¼¦	Ä#‚úM[Ñ¥©³ì:3…’mµž/no7h±ù8“tº¸
-uC³@íl«<à­*î3íÁ‡¦npÛ”ÐäõäªhBd€ÜRyÈ[U�ÜgÚ“MÝä¶)åpË×ÓcŽ’X‰ðÐ[*}«
-ÒûL{ú¡©›Þ6m
-OújøH$(Â"öÃÛªëð�*ï5íà/L�ðg¦$»ó$ÀÞ‹<èF$÷8öàG7·åï†QØÃ$¸-•¼UÉ}¦=úÐÔÍn›9žQx‘²Ð¢[*|«
-ÂûL{ø¡©Þ6¥x<‰|C!
xKå�oUAxŸi?4uÃÛ¦”Œ‚g’£ÎJ?¼­ºß©Bð^ÓþÂÔ	fJé8ø$AT
-€·TøV„÷™öðCS7¼mJÙ8x.�Œ’@Ik«<ð­*ï3íᇦnxÛTÕ:cà#AxhÛ[*|«
-ÂûL{ø¡©Þ6¥|<<&4b�ÊÖVyà[UÞgÚÃMÝð¶)WÛ1Ì��4PØÚ*|«
-ÂûL{ø¡©Þ6¥ãj;*8ⶶê:|§
-Á{M;øS'ü™)WáÑ’%»ÞyÐ�(HîqìÁŽnnË‘Ž«íh$�`I`ÃÛ*x«
-’ûL{ô¡©›Ý6eãj;
-úH„¾ÍØ*|«
-ÂûL{ø¡©Þ6eãj;J bQ °µUøV„÷™öðCS7¼mJbxÜåëé‰d(4ð…ÎV]§ïT!z¯iGaê¤?3¥�£O8Š”¶¶ÊCߪ‚ô>Óž~hꦷM1úkÿVãpÆx‚p"õ°­òd¬U3æ3í364ugÌ6%GƘ@	ME´­òd¬U3æ3í364ugÌ6½EwŠöuä#–ð@-a«<ä­*Hî3íɇ¦nrÛT åvg�Bω¥ò°·ª »Ï´gšºÙmS9Š]¨?æ �òÙ]'oE!pŸcÇ=ttbÛŽ‹QÔ1G,ôë±^s�ÙhBÈ»Žx`ç¶ìÞŒâeêÍã,]áÇüÿù_þÛ*ë7‹	bB\Ù´4PÿA3©æOièÅÌÛ?ºœúÿ
L[ŠÃendstream
-endobj
 1305 0 obj <<
-/Type /Page
-/Contents 1306 0 R
-/Resources 1304 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
->> endobj
-1307 0 obj <<
-/D [1305 0 R /XYZ 56.6929 794.5015 null]
->> endobj
-414 0 obj <<
-/D [1305 0 R /XYZ 56.6929 729.3676 null]
->> endobj
-1308 0 obj <<
-/D [1305 0 R /XYZ 56.6929 703.3028 null]
+/D [1298 0 R /XYZ 56.6929 292.5255 null]
 >> endobj
-1304 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F14 685 0 R >>
+1297 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F11 1304 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1311 0 obj <<
-/Length 2689      
+/Length 2800      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥]sã6î=¿ÂÓ—“§k•%‘lŸö#ÙËN›ÜeÓ§n[N4'K^KNšþúHIŽœìmfgÖ‚
-Ôþt"Bit:{€FÆijÍI’Ê0M¤t˜êäóÉ=ÃÁªÝ:e¿Tê0Õ±š0`,§˜š0“°„<Ýl»GÐ)Jƒ¿›ºhL‚|7�tP¾-º.¿©ø+»cÄ}Y<T÷EÅêᚺböùvK ìmú­-Ó­iiYå-£Î/B>”-ž¿"ŠbBâÔKVYDQhÒ4¶*²2
Êú®Ø•�å$³`m÷4Zl¶]ÙÔ--•kB‚–Þ€îíkuCÈU/`�x°àÄl»-–å!bw¶5#@6£d3‚êR¤ÁõÜÄ
ŸÓÜ»]¹šÔ‘Ø€cöZÀGU¶£×ô;�¾¬€o~lö,ózDKþ
-´IªÀpYª­È×ö®•v9§	¶ù®¨;ÂÂ5cZ
-îç1¼Sä±:XÏ
E¡cú8ÑÁßsû|Læ3PÙd<�1³Ób^U¸×ˆÜ~ZØ׫bGà‘0÷’j=Ü«•Ý
-�óõ~scK
€m)
¿[öÚÚ6-/òoN?`ˆz•ûB0¿×å_‹¶{¬˜³õÁ.ßlAñ$†–»ÈÛ½ŸŸ0+h¨™¼?õÊ}”õ’¹|Êë}
ðDyáÜŤAd D sKUpÖTUó@S‡,å{—Yf/€ ‘H�®uC€qxæv´DeÞ²f¶™Ûµlöugm‡G=n–‡*1 ¸Ï«=ä¸ú5·ÙºóÔÓ¦Hî�œHúÔÃ9
-€7„¤ù+
-õ--³Lt¨„:øÒ÷íLêêXü?c
-?uõß½ûá>¸‹Ô:žnÚ¤ÈÀ™@A™â°œ:yhÿr¦ˆþMw&Lendstream
+xÚ½ZÝoÛ8Ï_aìËÉ@Í凨�½§´qz^\“^â;,n»Š-ÇBÉ•äd½ýÍp(™rd9E�CˆÎ×oHšňßEšqû£0ö™æB�O|ô}/„å™4L—ëýüâçkŽb2ÍWŽ®ˆñ(£ùòwïÃ?.?ϧwã‰ÔÜØx¢Ý\%¦Ç‡Û›ëÙÇß]ŽCß›Ïnoˆ|7½žÞMo>LÇi
òÒj8!p=ûç”Zï.?}º¼ÿ1ÿõb:o±¸xWäÛÅïðÑ`ÿzÁ™Š#=z�ÎDËÑÓ…¯Ó¾R
esqñ¯V¡ÓkDûâçëˆi飉òY€ŽÞ(sÆ5Dmê˜Jª6ÊRôE¹áÂ(Wiùœ–cy“lyŒYHͤŽäÈUüÊ|ËÕc_9ö…âLªXw˜¯Sˆ{z3Ø ðŠ½×Ô4.bµ.v›%Ñ�×é¶(kê{ÎêHèýÛ.-÷'tæÉSŠha"ÆŽ‹2à,öãÛìŠÝOïþ3½#Ö0Aßr¾dõš4×û­ÕÜ	¾¯™<°ìóßæ=*4•¶,ïÈãÅ&©ª}ŸKª(‚øk-›Es{ߣZ…,�QhuÃR�±´¡�…·-³§ÄÄ
+¨Û]¹-ª”^LààYíkâŨfiEäÌ>ë¾/Ó¼/[Ye/댪Òóh†¯Øm�zóý"©jkÕŒ¼�+ÀBèà5@˜’E½K6›½}Ë«ð2¤×}±+Sœü*�Þý6]€§È÷:À’‡Db²î:1Êò"OÿÞë�³Hˆff,³*yؤÖÏ-¡^¤UÕºw49/
nBRcÕ
+Pê]™SÿÍoW·Ÿ.g7ôF½Õ¶È+P�Nþä>À$†mRÖÙbÒ7.»
/|hánÉVU¨[§Ã&nÐ '£%´ð5 Ù�ôd¹´“·@ZQ�Ÿèíîú‰ˆXDVÆŒö¡O{
+’B‰…½eÛT‰fùb³[¦}°Èc%�<†dæzýä1ÐgŸŸ"™)HDõáÂ:LQ“6«ì1O—¸t0†*h5	o“å_‡t¦•Á-¹ñØu¤ØNúæÞC²øJ¥ë LµMóØ°ú µË¿æÅKþJÒndh$b2rs�”±Ýa°•Ô5æôŽÓìâ2…µô”å)½f+ËK“­HÀ$D aæ°<r!Yî‰�þ™UuEmN_È›È³Äa ùÙ¤4µ?X6YùB©k9ÁäÖH‡‡v{³-Á']™àŽuØÃÚ°Ú`@‹ò�ÛXX4µ�|B�ô°
XèÚÃSÒH'UÚ3ív¹Ø•¤?·›¬²-ó�òÚ’�YõË©³’†mB1x2<ð˜ìQζ
+ÍHµzÐß/öÁãc
+÷Aćìµ<Ç»_à<Æï× g³›ÉåÕÕ»¼û<†�ÒË“hñ‹Qñsx®
Ä
×yÌCVÔÇfûq»f…ߌÝ�ð“ŠËaì.×iì-×YìƒVØ_™íÅÞ1+5œòƒøíøá£?Ïâw¸ð7\çñYuð›íÇïš•kòíøµd*æê~‡k
+*X	ævË­3Þ	™
8÷~b?õ•Ü'}:f+*ÔØÎX{;{€åǦìØ­Ö`Ý1É›Zf·ž
„f®¼Ã±fÜ¢g·‚f×ÉsêÔ4ÛÊW|˜?�­Ž=Å‘£Öw�ØØa­bHejŒHÙ–X Y¤ôV¯3+ë4MJûb.#àiJ&Øx0üvÞ"
« Ô¢;l=%¹-q·Å_’5ˆc™ºôkLö:*_•IU—ãÈÛ-ê];`¡pŠ·ðb™¶\HMS²	Å¡F
+2۱𰂋ë+TÞ}AtòØZAtñĶªdQfNù؉—Ôõ/OÓ¥™¡¹Ôé
÷Ð^¬l7žY•&;âB\'yžnŽ–Us‹ëªH¬Hò’Xš“Ó\©Sa„®¶x~b‹oNô›®ç…„Ïí÷_ÏøH1úò´.’ã Ë6‰®*çgœ…¼»E¶†­zE;¯Gߧï£'_èÀ´™2
©½Jº…•" ÷Âzñ¦Çq
�>äGqÀbAf£o#ÔÇŠxœ¶Azˆ€!ü<{’£«ðŒH�Þ‰£Ø@
+dç¦-d"ð€äwjŽaä•)M̯¨ðÔ
+ï¤ä±„
Šfkä­Æ@¢eÖHäý56ûvjÙÚì\&�%¦têLLqͶL�<uìò%ÝJD§–xëi¹²Ýß‚±=õuQ £]Ä×-�(²S>jC
jJÚ®¢ž@€ܘbn 2Ñ3´Ø€`Û²8öçôl ë!dÆ«žÜ<'õ[�ƘåÝ`‚ëO¶U4ÃY›‹vøØhfÔR¬,s¼Yéò/ÓtÛD;ËQ§F™¦­îŒöáܨ@�œÅôcË�Žƒx49ü燓ÇÀvø¨‰õÿˆÈ­-2E'j|Š,’1|ËkøúV4È�:­VÓ‘<°9Îÿê°
Üendstream
 endobj
 1310 0 obj <<
 /Type /Page
 /Contents 1311 0 R
 /Resources 1309 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
+/Parent 1296 0 R
 >> endobj
 1312 0 obj <<
 /D [1310 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-418 0 obj <<
-/D [1310 0 R /XYZ 85.0394 357.3908 null]
->> endobj
-1193 0 obj <<
-/D [1310 0 R /XYZ 85.0394 335.0796 null]
+414 0 obj <<
+/D [1310 0 R /XYZ 85.0394 693.6703 null]
 >> endobj
 1313 0 obj <<
-/D [1310 0 R /XYZ 85.0394 147.1444 null]
->> endobj
-1314 0 obj <<
-/D [1310 0 R /XYZ 85.0394 135.1892 null]
+/D [1310 0 R /XYZ 85.0394 667.7108 null]
 >> endobj
 1309 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F62 995 0 R /F21 658 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F14 685 0 R /F62 995 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1317 0 obj <<
-/Length 3355      
-/Filter /FlateDecode
->>
-stream
-xÚÍZ[oã6~ϯ𣌹¼ˆ’ø8�fÚm¦›IÑÚ>È’œ+[®%åÒ_¿çð�åÈIf;,DÔáíð\¿CY,8ü‰…ŽYl¤Y$&bš½È·g|q}ß�	7få­ÂQßÜœýã£J†™XÆ‹›M°VÊxšŠÅMñÛ2f’�Ã
-|ùáÓÕÇËï~¹~žDË›ËOWç+©ùòãå�ÔúîúýO?½¿>_‰T‹å‡ïßÿ|sqM]±[ã›Ë«o‰bèqbÑë‹�×W.Îÿ¸ùáìâf8Kx^Áäϳßþà‹ŽýÃgʤzñ
-{A)Ái¿®R¢¯©”Ø@”ŠMúŠR@
-DR?4Úl[RçåÏsa>+
-ˆÚwÀbb–ûæÐÙfê—ÆØS®{‡Š¥{ëžö.8e»‚y�µ­£Õ´vV<Í{]Ò!À0÷v`“eñ‚mJÿ{†ô?µM�Ä,©xÅ6EÌDÂIÅ¡ÙïÁJÞ™¢dŒLQL‘	hcd‚ˆ$Ôð!
-v~ö– =تª˜SØ]¤¡óõSÝ—øj°9@™&Ø*	A£yéÈ%ö#—3fIŒšÈÛ/´ÐðÐê¸vV‡DkuØpVÐ
-eéØrœPGשں\ïŽÒùaÅI]
-„F¨k)Ó€YèÌXy×Ñ¥|h”6Òâ`‡ø-õúšQãªéJ¿IÖÍFI
¹Àè×Lœ]D›Ú‚eØñZ¦�X¡k[æPšVí–ôª¸+Ó&A†.6&W‚Ç
£jý
RVMuæî:F�
-¢o¯>ûˆâÒ|DÐÞô;+a6¨€�NéZ ôcDÀ£ç…¦£@ËEc‹ÄÌÈ�í‡Cß–:߹Ƒݣ
Áz` V¯øþ;×Á×¾;šz}
™Âm2…Ä€sœîâå3TÚ•bŠX¡••D^—uó
-ÞŸ¨‡ü]ù×s¼YÎ
-w¸A+C‘ŒÊÄõö®@D…:vÂUúY.€®©wÆCZÑ>­Ä›»Ž
-$îïaÌÀ?!¡´ývïŒ2¦¼iõT’ñàðvľ
-ã»Y„2‹¿
ìj#ä”k_~�0
-ù±ožà™öe^mžÑ%lH�†éôØ»ûýÞC•ºÚVGN>Ø­>Ò»õéÆMÌï]»Ñ};/U©¡ðT*öJËWN²mõל\¡ÆæJ'ƒDè,xwå„~§BÙ~Dhx“JT>³*ʾð¾­väŸQ�ÿ©‹V‰&ÄD´)`²(Ãí;à—)DÒž;N~=×ò»»Ù‹ü¦ïf
”%‰J¿´Ôz¾àsûü—?åu•Ï­“2
çpÃB„À
Å
-3–Œ{!Æc×òfR¸{cÛ€Jfáä�_rÓÔP•ëùk€ÌáÚ~»Í|ôy±ÙûÂëÄ5ÁLâƒpÍ…J¾,\?ûz
-?²Ißá�¢ ã¹Ô$!ŒF9À(cNïÓ9—ê%¨€)£!G±Èˆ~ï
-endobj
 1316 0 obj <<
+/Length 2594      
+/Filter /FlateDecode
+>>
+stream
+xÚÍZÝsÛ8Ï_á·S¦µNü’¨½§l›ôÒÙ&{ivæf¶û Xr¢9YòZr>î¯?€ )Ù–O?ævvº‚A$�@�›Dð›¨8ŒSžN’T†*bj2[œD“{hûp¬ÌÔ	M‡R?ßžüýB$“4LcOnç]:Œ´f“Ûü÷ yx
+¢àÝõÕÅå‡ßnÎNÜ^^_�N¹Š‚‹Ë_ΉúpsöéÓÙÍé”iÅ‚wÿ<ûõöü†šb«ãçË«÷ÄIé³GéÍùÅùÍùÕ»óÓ?n?žœßúµ×Ë"�ùóä÷?¢IËþx…"Õjò?¢�¥)Ÿ,N¤¡’B8Nuòùä_^á Õt³ŸT:T\Æ`Iêˆ�™…	c “HsL{#s6fd'…F.ËîeÚ«Çbµ½bÐÊXóÉPïÎè^jdx1žqJ	­ã^³rþr:"
ž²Ž(;!C×Ù¢°íeU•-—EfÛËš¾Ýƒ[�2ÝzU9q>_Ÿ
›f�ùÚÆyc[ùߦ.ZDN¢ƒË9f2i¨ešâŠÃT)næ_ƒ 
§léÛ⊾D/ò·Ä�‰Õž"õÿÍv õ!EëCêÎrÖm‘‡;H´þ#†ZÅò0(†RûAá¥zPÌšºËfÝ*xBˆ&‡‡÷R#ão¢B…:›ã{Pp--(¸V�›�a[«
ÛZ
xH#*°•LŒMT`“AEßÔ£çÍ)VD[` ¨†dÒCÊ�ÇB~0¾p.Cüß×

²DÄ„x©@pR=Ìš§E�ÝUÅ$$(•¤‡çà¥F&±�L‰2åÆ,ÎidcŒUüæeÛ33g-ç(aè(Á ÷[^^̳uÕyã[vFþ·*Ì`lÍu }-èRlí¤p•vEÓÞ滶ŽC�Jvx^jd›¶f¡N ucï{»
+ˆ¡¼|,óuVÑoo^90ojÍ+‡æÿbh^áV™cW·"h–]ÙÔDϲš4ÞaIòDm¥ÞA<‘ë0x¹t èÊÎúoY
+¡–F1xIˆ�±Aµ
;ÓPDDÎÌêùÜe]Ùvå̆ñEIQ°eΈôB^0ê|÷v«;NØMñ¾¨‹UÖ¹ùßY<î”*>ƒ”‹²sBÁb3ÈÝÚ¢¹n,QæE
£e•Ë1�ƒ{Ö9ª6Vñ$LO¯(_/–.YÝ—uëRX÷`Ë>UYoùŸâ§ÏøµñÍ›7ã.xïGô"_"¥‰€2•)ü`ã.ÚY�ÐIP¯w¦Ø
+dăj«4kº™÷=Z’2ûnY[µ±ë5kÖugì†C½,;ªÃ@à1«Öv §Õ·¹ÎÊ#‹£t
+ �ü&ƒûª¹ƒt¹±"J0aË6e'T¡
+–‚‚xdäè€e£
+p”ND¢B•¨£ÕjÉ$J¶Õ_×ËMV-“Pó(Ù?ê�.Kº›ª¦~Qˆ’
+¬x¼dL…R''!�b²w»žÍŠ¶qL*QWcô‘€aíÀ´I²¦VÉ|]ÿϵËïðc‘嶫
²K¦Ÿ¿ØÉÆæ DÇb<ü
+åìa,:ú3vfçÅÏÕõùÍÍ5ÞðˆØ
+µË¦nj¶™å;úV°ñZ’²¶ÕíÓøronvÊ©’PÂN;:õÛ€‚�‘ÖP8Š0=x¥´£ÒõØ�½H„ZJñ
+öX
+“­‹y±ZÑÞõ:ö$ã{H#ö$=Ö�I~5¤uäyÄ
r°Òê[ìØFq¦£›¨ñr{À=ƒu›-¨{xÖò°wx
+ßDQf¨ŸW«¶èŽÌz°-
m2ƒ�9ÊZ;ï ¹éäPœúHÛœÖ#ÛEm�yÖeû½50Ã÷u–ü®Î‚óz™æo%,T±=F×ÏyƒßqîâJyw!�î¯wþ°îBrÓ]0=ºí‚–«¿¿þtvy5–Õ6üuÀ'ƒÕþ•#HÀy}ïm–w
+äÞØ
vž•ÕzUBxÆ
+º¦Ó1^ÎÂ�6×/æyá�Ræh¥U_AÇn;í_1 F·Ïqpùëئœå¹MC-^Ç$i°lV�!µS�™§Ìm³9®³ÀþÂk›²êœˆY•µ­åU¤;ËG/¤î
+>\Á�#wéšC§¯búG`“qØÚÙ+
+p'4>£ÊG,çUÚ—óŠ
+Fä4ñR㞃$Fýô äWô˜:Kšh*~Sé.ðD¤,ê�I—N@XÔ
xP
ù;£i}×0vÝU£h¤80^8
+8ƒ¦$S¼¢IX�ýÇ6
Ç|-:ZÑÞ…TpˆJÔ±š°
+�îûë¡Ð c‹ðÏF×7ÿåKÿgALpÚä㨳ànRæ™Nî>ÌF!WøÈÔÿ^»îùendstream
+endobj
+1315 0 obj <<
 /Type /Page
-/Contents 1317 0 R
-/Resources 1315 0 R
+/Contents 1316 0 R
+/Resources 1314 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
+/Parent 1296 0 R
 >> endobj
-1318 0 obj <<
-/D [1316 0 R /XYZ 56.6929 794.5015 null]
+1317 0 obj <<
+/D [1315 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-422 0 obj <<
-/D [1316 0 R /XYZ 56.6929 493.5807 null]
+418 0 obj <<
+/D [1315 0 R /XYZ 56.6929 598.1755 null]
 >> endobj
-930 0 obj <<
-/D [1316 0 R /XYZ 56.6929 466.9981 null]
+1193 0 obj <<
+/D [1315 0 R /XYZ 56.6929 575.8643 null]
 >> endobj
-1315 0 obj <<
+1318 0 obj <<
+/D [1315 0 R /XYZ 56.6929 387.929 null]
+>> endobj
+1319 0 obj <<
+/D [1315 0 R /XYZ 56.6929 375.9738 null]
+>> endobj
+1314 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1321 0 obj <<
-/Length 2924      
+1322 0 obj <<
+/Length 3098      
 /Filter /FlateDecode
 >>
 stream
-xÚµ]sÛ6òÝ¿Bo'ßD(>I`ò”¦NÎ�kr—ºs7“z2´DÉœH¤JRvÜ»þ÷ÛÅü�éؾLÇ‹ýÂîb²˜qø3kWNÏR§™áÂÌ–»>ÛÀÚÛpi1Äúþâä»7*�9æ™Ì.ÖZ–qkÅìbõqþúo¯þqqöát!
Ÿ'ìta>ÿþüÝqôyýþÝ›ó·¿|xušêùÅùûwþpöæìÃÙ»×g§a�€ý2Px`Ûó¿ŸÑèí‡W?ýôêÃéåÅ�'g�.C}W¨Èo'/ùljÿx™rÖÌna™pNÎv'Ú(f´R²=ùùäŸÁÁªß:e?m,3R'³…ÑLí¦­Ì7`µEª�“N’ÎÊRLY9b¡•wÙ—E¶Ì–×ù¢)~Ï�µ 
-e)v‡M²]u([Wë€�ïªúŽÆEIß«»6ohØVô=4�ສÃJdÑäõM@8û¿„]¤=x‡NÜü_×yÙo
c€å‚ƒÁœ1ÒË¥“F{éð»ÊÚŒF(~=[קÂÎsœ7«£m±+Ú86ýÞ(2Žo‹í–FËmž.`O2°ÚlhÚ4ÅM¾½DªÈ+k{ÙP?>VÌ‹€bNRÉyY@þe™ç«|¶RBÏÏKgôéå” g{MÐÝaÛûmN³›"¿m^NPPYfûý¶ » Á}VgmÐAúãEx·±·ªÄCiC9ÍëÒxΧNÎQv.Éç¾Ê׈HЈ@rrC§œI-5ÐF’‡ÒË›¯uäßà*�ÂTÀD=§Íʢ܇`åe[“ª0ɺ„Éþàg`áçk?­v‘B@ë´‡qUz#!´íѼûŠD3®y:>æ}^ÕªXRÊóÎD2¬-v¤d€¸k=[H͇¨]@ø*n”'…©U¤�g9ç'àóŸ[8¼]NayµÎv;Pô¾…áÐdʤ””"�èûOÙjUün_çëâË6//iá?^;©˜Ãd<Òí#a\U›CCû¼ùTÕŸÊŠ¦/és9åÿaó¾®nŠU¾(¾¬ëgÐCuþÛ!oÚçÒÉ‘¯Êæ[ö.«=%v*»«hÚ'h€—Ãs	ŒDhë¬lÖyÝ|Óîäñ:6å†Ó¨*ó ÜFŠÿ�B—w
Þt[Ęé×”þœß5ÑÇü§�@ÅØøøð
-cì2øèÏ×´©õ2ï5-öÚ@ÔIˆÔ1%S”Xª•ö„þê—sišÌð^÷�ûªn»¨ÂÉå„|X.al‹§È¹¸I†¢&÷Eu׉Ð?ATÉ“*u“Ç·V±¾{šA“”©Tê ¥9–ÒÌðç4ULiç&
:’òqsögógœ¼LZ™N
-
-©¬[3, ŒPkgHÜCé¥pQðdBúÈpRüË¿^—³L¥R¦­ÖÏf6¶‰²’™ÄèIÚ¤;»ç›E9l(¦¼/òœt¿o1‹y6³±Y bšÛ£¢ø�—SUd<#1è¾\°�—?ä¿r.Ë¢-ª’ Y¹¢Á/M¶É'ʯ®ŽH»¾"Ê3(ç,K,7¡Fܧ%KRèÙÚ@6. hô²ùê
¦Ëk¨S—-”TM[,ÐW«ð½Êé›5Mµ,²ÖWu0%2§ú>TîªÖo€²;Û…­AHèY z•NÍÏ×£�{ÚŠ2}¡½Po‹y¹
t\šG—Ž�Ø—÷
-¨ïóe�{ó•¯X}íˆ&WÒ3
-S«v쪦=â¼$2�7 ©mæÛ8÷]�ŠfÚPżÚúÃÍÇ

-Qf¾ê†»~ý˜*|HÅ„¦j¾ô ªåòPÓ0k¤8¸L[í	²Í¡øëPªJ<‡Í
ú-Š7
--îRµ_Ð	‡»Ü0+Ž*£ªŒ/%]¿‰1Zlʪ�Z�r�n
-È&È'½ÙÚ‘	û¤)$Okž`ŸÄY9e%RÒ�ÞuºóŠ-ÿ_^ö€¼³
-à&T
� �ÕÄáé a]âD½7¡6ó»ê@ƒUÑPzô3zP:ñ6À0ûã<æBczÅ隸ñ펫CØ•­ƒ¬ÍÐr‰ƒ¨þÜa-}³@%ôÅ8¤ç$…+äÆG’]jð»z*§bÙixpRH¨>z/+
-3ï/«€†ÊoâŽ}Õ4ÅÕ6gt�çážöŠ!�IÅ f†sýtŸÇÈgÛPžiü´•r\š¦ý+úPI”Ä÷ârt
­�LÒ¯:¢¤«MÃk3@i”ÓBPÌ"0¬z;]]¥†ÑÕg�…(\WFÅx®ö¡êEÙs!	è
-¶¡N€ïf[]a4x˜ßÚÐä
-Âös @þf!Ë(™Ìÿª’j6Ê “÷˃U¥¶*Þr£È	µ
s½Ot·•”™BZ’Vôi	ƒ-DLK°t}ZB<¯•¥fqCPKë¢óX9oÚ5up¬š;3¶å ™&c?=œ§Ñ‹RÂÆŽmŽô2^ŸQ12m"3	Þêw¶/†ö�µè­°Z­{&28 –Ý¥õø±ÙÄÜóV ^„ô
5'ÔDNå¦x1Ç2’‡Z—÷>Œ°Î‡a}/ø
-
ø¾Œ†ס}]‡‚Ø7Ä>üûfยæ×aÞ…¯�—¹7@ˆ–cå!Ê·yAý/Þö…ÿyJ¹¡òv¨¡ë4t¡è‡õÁ>*éq´Šì«ö%ŒtLß°Ô¯²ƒªwO•bZAÅâœùêE¹è°F¶h®«Ã¥„"4ÛÞfø’ŽãÛªþŒ‘“$¡>ØþPï©íIHâJçV2­”yr:שŒE"Zm2QÝÑã—:7Ê“A¯"|ýIûÂû³WÈúªÛknô�ªh“!fŽ^d EÈÕÆÓ³á×lL,tåu>£œ™U¡ÞB¬«Ê¿+Y“–“ïÀÀg_ÂMŠ]`V…ÕÎó`B?E;A?£{~_²–ŽQÆ"HD	تNÄ~\î½|�P®›ÍÝÑ߲ΚëØbÄ,µ¬êúÔÎû6,ÄÜyTFÁ8G	‹=ôßÊ cMýSïÞ0¿ù?=úƒÑ)SÖÊéÿŽ€Ê•YéÒ(”-5Ç’<|¥¿/úÿ
+xÚ¥ZYsÜ6~ׯ˜·U™‚Gí“ãÈŽR‰¼++•Çåâp03¬ðó�<ÙÝÿ¾Ýh€Ç˜’ìré�@£
4}|�_1øã«XùL&Á*J_1®VYyÁV{{sÁ-�瘼)×�w?¼–Ñ*ñ“P„«»Ýd­ØgqÌWwÛ÷ëW?¿ü×ÝÕí¥'[‡þ¥§B¶þñúæ'¢$ôyõöæõõ›ßo_^FÁúîúí
‘o¯^_Ý^ݼººôx¬8Ìv…G&¼¾þõŠZon_þöÛËÛËw¿\\Ý
g™ž—3‰ùtñþ[máØ¿\0_&±Z=@‡ù<IĪ¼”ôU ¥£ï.þ=,85S—ô§dì«XD
+|I�*ñC)¤Q`ßh<°Ê	+ü$�1¬�</,Çt1å"pÛþXäYÚ--?ÖñD¢Öu³°�ü0Pn½¦>õvi5GMË×Õ°b®7¿j�WYsÉãµ.uÕé­Ý/­¶4\¦'âO·Û¼Ëë*-Š
eißjìzA>!@@ÆÝÎ�Îú¦…%–dÝ(%,gV÷ Kc×®i»�ÙbåÉDù"dáÊãÜOpN9;†¿ ƒ¹`a˜h¹<KfŒ­_$s}§3ìZoH³C^í$‡U…ò¹ŒÈ6î@žÔD_ØÖ­[3XNƒªe¯Ó¢­‰%Ý78»è\CÄ�UOj¦/È"?Ž¢ÑÍúykªh—UkŲ’Ð@W)/�F•õ½=Jç8HÃí±®Z;tÔÍ®6d�nG€0Šùí”i•¡©DɺÞáu
(	pÔõ]Ñêî’¯‡Û
+£³ÔÆà/\°
¼0‰ž
°Ò�¶ZF6ˆb"g
+·\#
+5ž”®h„äáYͶùßKz�$Ôµ*4BgP
+‡‰|NM@eû¡ÁˆÕ t™URö…~™WäŸÁ$ÿÓ­4 Eˆ‰hsÀdP†ÝwÀ/sˆ¤œtœüq© äwoÉIê¾[.ª£h(㿺ÔZªö#ºü—�2¨ö—Ö‰}ç°lS„ÀŠ
ð=ÃLH2f‚

+LИ%|6…½8hWzÐE1§Ð|Ά:Äš…
‹²Nڶ΋¹'PÚÏÌÞà&T½�ëŸë�h ˆ)	³Ü65$55$A¤ùÙDåC©skPp4w<ÎlÚn\SÛêPYä<ÎÀ€d�m²	
+¹h-ƒäɇ£‘Q©ãP‡HäºMKM¤3™“À¡I@!¾™ª
[ƺqý>Ë´65°›6M;­Ý˜hû”ö(tÛÚMw3y‚!»ÑgQ^ÓÀ¯nÐkb¨)P†Ï`ôðÁÙƒKQ�Ã11s
+`Ÿ¾ØucgQ„ c‘R®3óAŠƒwœÊWœdo›@óÈ™óÜÚ°?ºr�ŽÖŽÝYfvŒyµ0&âW®……<
+
+lÏÑŽû¡E™�/A×Â…G5‰Ðq™G&³ˆÂ|—VúÊÈ»øc+˜J”Är’/%üÌVÿⱕ:épƒÐ9ö¦·§@ª¦}ÂÙε²pÑP»‘Í>r>X4WÌ$XaÖ.kå¥BfíÀ»

 endobj
-1320 0 obj <<
+1321 0 obj <<
 /Type /Page
-/Contents 1321 0 R
-/Resources 1319 0 R
+/Contents 1322 0 R
+/Resources 1320 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
+/Parent 1296 0 R
 >> endobj
-1322 0 obj <<
-/D [1320 0 R /XYZ 85.0394 794.5015 null]
+1323 0 obj <<
+/D [1321 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-426 0 obj <<
-/D [1320 0 R /XYZ 85.0394 670.6895 null]
+422 0 obj <<
+/D [1321 0 R /XYZ 85.0394 732.0195 null]
 >> endobj
-1323 0 obj <<
-/D [1320 0 R /XYZ 85.0394 644.0686 null]
+930 0 obj <<
+/D [1321 0 R /XYZ 85.0394 704.3916 null]
 >> endobj
-430 0 obj <<
-/D [1320 0 R /XYZ 85.0394 402.7331 null]
+426 0 obj <<
+/D [1321 0 R /XYZ 85.0394 215.3041 null]
 >> endobj
-1214 0 obj <<
-/D [1320 0 R /XYZ 85.0394 370.338 null]
+1324 0 obj <<
+/D [1321 0 R /XYZ 85.0394 190.7685 null]
 >> endobj
-1319 0 obj <<
+1320 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1326 0 obj <<
-/Length 3698      
-/Filter /FlateDecode
->>
-stream
-xÚÅË’Û¸ñ>_¡[4U&ƒ
�µ§Y{ì8Éz73³Imy} DŽ†1EÊ"åñl*ÿžn4À—¨yìR:l
-~Y:ÃۦߵRðVRGS+åÒ[)´œ•ˆ«Ø¶ø!:w(�ÉbÞ4éÆ
vö-o•Ðô¾V
-ˆ`gi$J-é-
¡cK$ãζ,zÇGœV8¼ma¿Ó6€žPäÏU}?Õ˜—+æï×6g+RoéËŠñ”‚o•½ýbû°ÛÕ{rôѲ½¯	ü[]¹Á-0»¹õ÷p`×hy`üч`»«¦}5w*QœêVy
-›-ÇPMòìEщ�Æ	Æé`åÁBD‚�B9;±ž‘`ÙÑø¤�3i óêøß´)ä$A1ÿ‘/J CÓ&›ÙʹrP…YÿÂÆq¾ßöøL)â¡MBŒ-wÞ¤,¶EKM
-€ Q¶+T8‡Z�°u]­û> DXQ­êƒµ&ø £Á¢îȲƒch¸Èˆÿ8mœAÁR9HÉÜVFÊYÕsþ\—ˆ£‰Vœ`D&ñ$žµcEˆžgÃѹ¤kï’»sÚ²Z�R,
y™I¦6Ô;§Î³Zf¢PDlœ�¹”PB@Ã’„?#Ô„•¹ž]Ÿó‡i»bZLÓöÒŽ4�XÔ$�3TF=©°È´"ˆ5
SPB‡U#žª‚ˆ0‰ãx¾tƒ
FªoŒwþ;Öº[×J6—z‹0îE”å¸åʺ�ȹ�(9!]8Vb©&»Ÿr˜¡_:rèþŒtyVB#ü“	c‹Î	\•&]»à?ÂLlµ€t­} ¥
-à:
-MÌ'!æ ¤(]æy:W�-™pÈÆç‚AÌšÖs•H?¥H|
-Î’X¿HäA7käVl²&„c üœš-
‰å5|eº”"%w¥H¡—4ßx™
däp„oçžØ–P’(¡^¬q2LLw³òô~Þé¦ÏÑ)t”1äs±ëK–·iQ6¯¼ïÌ'Þ5Ë›õ¾ð%3e�לς`
ï¸^j¤FEO©2òw©àÒ£.ªiÜ!
°@±ˆ˜c¡Í1P7>N8Ž@ŽñŽ¢ º^à@B3%	œq¨Á³ŒH:
-…ºQOrŒmp¯$ñ^IÈø¹Î—{þÃ1
-þí´Dµ€“ˈ§Ýn—›�0ÎËÒèP3%^îp•w¸ú¤ÃUÏt¸¶….�<¯1aÌ"5ÍY[¢Åt%ʆ¾—SG./—cb|qÖZ¡INº[	}dÜ&"¿SÝnO"õ~	æžr·F…¶ñ\!Ë�u¥MtG”ƃÂɈMxÒTc'ÅÙŒÓÞÿ¤ÎXœÜ½‘usO9]ˆ¦€oêeú¦ºëîµ'ev+dN`ÎLrù¼œ\ꮄl/?µ¦„1ý¨5
BuÉëáÉÍë©1I_²±ÕLí#wÃüin˜÷¡�„b§ŒÉ“ESSÇÊ
D/±¥\ÍE/RÛ�tqi|`‹OŽ�`üîí˜Sö£´³œB7˜ÚoPšH}¸¢N‡+ (uNòi©*=>Îq±UîËaI³xIÿíG û5êù¦@®ú¹ÖcWëvŠQf*©°Ô…÷9q÷²‡'ç
g˜6ííå^`3#‹õº/ÄÚÇ=.Ù²øe2.±KO1iÀý+
F3c´{›Šâ0_C}¬=ÿÝ\ÆûñxÜËñÚ¿�a~úäŠAs´ÿ÷»9f=‘�óÝt<ì¹<~Cu²¢lè°…ÆÏövîX3&Ì?pDX9gÇš¹:LB!º{‚A9^Ĭ«ä5ôùæÃõõåkjS­} /*+Ô-^pb<Y4†Á+
- ¸:ßdG°5® 3§×^�”Ýð`0~.Œ›`‡“@IÆG¤€kMäÔÇ�¤ô
S\FÚäÿÂ33è]—`‰>*§%ï8M_–·ð?(¹
-Ù½ö�î6v‡UY¬©m}†&éÚþªº
-ÒC{WÃz):~»›ɺõìÝ£MÕ”»¢ xªÊ¶rS­šX¿I®qjÀõ
-r'*sŒ?i{¶øƒ
+1327 0 obj <<
+/Length 3841      
+/Filter /FlateDecode
+>>
+stream
+xÚµÙrÛÈñ]_ÁG*e"˜3SûäìÚ§obksÔÆ•‚HPBL\”¬TòïéžîÁ%Ð’²•âgz®îž¾b‘ÂO,L–d^ú…õ:1©0‹õþ"]ÜÀØ÷‚ç¬â¤ÕpÖo®.~ýVÙ…O|&³ÅÕv°—KRçÄâjóÓ2Kdr	;¤ËoxÿöÝ÷?~x}iõòêÝï/WҤ˷ï~ÿ†Zßxý‡?¼þp¹Έ巿}ýÇ«7h(ã=~óîýwñôwfÓoÞ¾ùðæý·o.?]ýîâÍUGË�^‘*$äç‹Ÿ>¥‹
�ý»‹4QÞ™Å=tÒDx/ûmTb´R²»øxñ§nÃÁhX:Ë?‘&RerŽ�~À@—&Y
+[Yã“LIøÓå*KÓe{Ì«f[WM}:®þ=5iyÐÿÈ7›#Aþ�/„õ‰’Ö,V"±Z™°Ñ¯Â�I¼µÙb
+̬øý¶˜6f‹–:Ñ©Óc™þÏ78úë·Rt<»—Ât—èLg�ËÜ@
+Û5Åñ®8’UÿØæm±/ª–ºßOSY•mYWÉ«
5~lò›‚�R'I“cl8éê¶èðé'	—d.50ç0�÷’`¤-øž6À-Ë
áV4Ô]ßæÇ|ÝDziË5Ûšþ¯úÏ›¦^—°Í†ú÷e{Ë#ôw¼nYìë6,�Ë*ßóRF| 8JéÕòÝv´ò@K§/´vW\Šeu'Ðu¹D?QìU°û¡X—¸¶Ø¼BˆY¶·²\Ép
+2SÓü(leEw>òÐàì½Í<ß9ò“¬ëj;#àÃÁ/Ä©	P¡k¤C'
+_“B�
…~J
+ÆVÌH¡UËu^Q£^¯OGjæ<FtƒÄ´õ� »â®ØñüíhìTWx
7§cÎê@„ìxBÍÛ—USnxç|†,%L"ŒrŒð]YÜÏé–Nœq�¨B‘±ž„ûÌþ`�}âR;1<çϱ)@sÏX¤¹Í�ì¹e]”`O3{w:Mœ5Ϲ<©Å£ãÔ2ãáÈ pV{[7|<Šz„ÖbvD%Í"Kè ñÀ“êÊn˜]¹Iœ˜Fu0X*)aÚ‚Š–7UÝ+­¶i¸�0�&Ü•`LðhìôlÃU=ÇkÁv:óþdÞÉ9þ(a‰6<dDÛô,¡!fÑò=k†`v6n8
+v[13ÄžAB*†ßò�Þ	;ôGT)áÉð
+¢ÕYLˆ©
D#žžEAÑŠ@³æéí|te!
]xö”Š‚»2*ês}àv/«þ€\°ã8
þovõ5jC€…¥
u®Am?ó6
+ž…8£X2?I+s6ªùÈ‚Îú—³Q¥v*z¹#©ËY²Mâ{™èâm'É2±Y’Nôf	™"š%„�XúÞ,á¼@•£\ç²RKç£ð89ToZ5«up­:õfÌ5²AÒfc96Ë-iÛžIšM4D¶™ÐÁ8üޢ¢fºŒ53ci
+ÛWCþÀX”V­·=3–	PËÎi=}m.3�¤v/Ù|CÌ	1‘Wg2¡F¦립#¬“aèDFÏ ŠŽ‚”>_Zßýõ-–z•ž˜qP²602H(5ÇG8¼áaâ4Î;¨¨�£ýÆ,J
+"ïÍW媛5âEs[Ÿvˆ%¡ùî>h¨}_?£ædLJ
+’ùsæÜÉD+ežmε•1HD®ÍJ£;%zZã¬÷#;Ét•ün:ÞŸA.DÝ�JöèÝ<Š M�±c
…!§©.Þ4:«L.¯“yhdÈœâxg]ס¬06Z¡M²�`}i&PRîù°šG;ɃNIþW,·5ïR|É÷:FKƈ°SŠ|�SUé¥|`P®O77“ßú˜7·1ňVj]�—ny:´<€µ˜|h1s&ëe.Ôimq±©š3…ÝÉcÔ‡Sï:1‰í#zá8hŒè
Ö%zÐæ8sßòÓCËËjúçCìòÍwï?ò
+Š³–3öûSF/8^òr*£ÆwÀeGLÝ¢CyA“ŽË�çsºÙôŸRR)ôÂì˜�9À2è>+˺²^Òê´9¬šò_sea@ÉgÎO<&äèµñžW'ļ…Ö�ßý‘ƶ
Äi»#é±|¬jK*
+Ï°÷`B;¡9#GB¢»rFDi¦îÜ¡3Œ°€7ÒñWÛFÃÌê®x5µe}Ø12hló°<KÃ÷ÝàPû”j—±ÅÖÐc°GQ;ôv$E7£�BþeÆÔ‚¦³æíó/_US0WªËG:¡*ª©PÑ‚¢sûRîO{ìÈÎ*ÖY/šðHDëI�¡ÕR¨ÎØböR…ʧŸh•ŠZEZª¥Ò‰švª&¥$U“’Ÿ~
+V®°}L$?ÓÀT.gqè#I&?WõýTd^.™ÿ»¸±²ô¹ôèi朂uíkªk‚ɆÜâ¾&0¯œ¯0p—]o@ÎW6:?²Šfü‘M!vY”ݪXÁ†÷³•h#c¥éK1Z„Ê
+†°þcŽ®ø?£À2|pÐ)põÀ„͹õüX£CžÕÐÑ!O„ãöôXÑ!óu'‹‡q4(â¦PÜ›4GÂJx|•3cûü4)²{	U÷$=	I"vÂëe	ʈÖ[C~‰uyœL‹d|å
*REÀ€½æ’ôOÕðhëzÃð‚óQ
+ÆÖWß}ÿjz%�bg&‹´ïÀ?:Þ,¨ñaðEoœ½L'v©œî‰|,"Ò΂75S<„Ê›efˆÈ£Š»I_?ÿÑ^ý{xz,;dË6ßñç
 endobj
-1325 0 obj <<
+1326 0 obj <<
 /Type /Page
-/Contents 1326 0 R
-/Resources 1324 0 R
+/Contents 1327 0 R
+/Resources 1325 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1301 0 R
-/Annots [ 1328 0 R 1329 0 R 1332 0 R ]
+/Parent 1296 0 R
+/Annots [ 1329 0 R ]
 >> endobj
-1328 0 obj <<
+1329 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [87.6538 510.6542 137.7628 522.7138]
+/Rect [87.6538 61.5153 137.7628 73.5749]
 /Subtype /Link
 /A << /S /GoTo /D (tsig) >>
 >> endobj
-1329 0 obj <<
+1328 0 obj <<
+/D [1326 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+430 0 obj <<
+/D [1326 0 R /XYZ 56.6929 659.7801 null]
+>> endobj
+1214 0 obj <<
+/D [1326 0 R /XYZ 56.6929 629.052 null]
+>> endobj
+1325 0 obj <<
+/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1332 0 obj <<
+/Length 2654      
+/Filter /FlateDecode
+>>
+stream
+xÚÅZÝsÛ¸÷_¡·R3HLžœÄN}í9w¶ï¡“Ëx(‰–8¡HE¤¬º�ûßoðKTl7ÓéøA ¸X,»¿ý ƒ	ƒ¿`KŸ	N"ú’r²Øœ±É
+Þ}<,ÍÌͺTïîÎþz)¢‰öµâjr÷Ðáû,ŽƒÉÝò³÷þoç¿Ü]ÜLg\2OùÓ™TÌ{wuý�f4ý¼ÿt}yõñ·›óizwWŸ®iúæâòâæâúýÅtÄ2€õÜr8±àòê4úxsþóÏç7Ó/w?�]Ü5géž7`òíìó6Y±:c¾Ð±œà�ù�Ö|²9¥ðe(„›ÉÏnÏ~mvÞš¥cú“"öeÌ£r1¦@©}%à*0™Î„ÔÞnÄ^úmŸV5MTÙªHê=ÍãTì²<§—ó”~Wi‘î’:]Òã¾ÊŠ
ëµ]ô5}²·é"û�1î¨×iË\{Ia§“í6-–Ž¨ž^Ùc©½MZUÉ*…«R"òÎñ@³ ðµ”Üœªw¼¯r—­28�'I¹¡'ôpSÖö¹Jw� §gýeÝ%þ¶Ïh°´¼Jú�; I÷nþäösÌP?Ax~sŒÈׂÇæçy½.÷«õt2+$V»d³IvôP>´o�Üyйó@h?RR
gd»U–ªk,#PÂ-òd_Ù­’</�J»åfŸ×Ù6·$Èó
¨³€ëÊŸp>@ËÂ×hRlSËÊéÇ™
4 B?Ší®”<}±ß‘š‹:·Z¬öÛm¹óUÞݸB´pÎíQë]RTdˆ³ªÜïéˆz"p>®c»-u”¯ušïìQ�°Ž
'T÷4�–Jr˜<j¨¬�ÂìÕ/�!M�±SÊ.)Éa©%Y.Ig•åil^Ì-7Ømi•®9¨.ûJ7W.Xèý»,Ðû˜l�fæY½¶óÆ=aªëBøÂ^1
+ùø3
wþ}ÇŸ8€žb™ ßÝ}ß�4cê»îe¨õÓ§‹D[ok½I(—¼GÌÅóˆÙŒÞÑ­˜%o2$]o2lJz1·�ü%6’†ò¡ÌI2#”ä@8mø‰~ÆçÖ�°†9å@RYÂ%&aʶgêy:a�‹
+Â%Ÿ¿U©ú
7›Û8rH¦Y¬ûzù?:Gü�äË-L½ªà¥þc¶kŽŠ‰mJ
‰œ€*GÙ²×ÄM
u?ÃÒi·¯ Š˜™êÈp½­¡ªÝÎbµo.Ã_èŽtPs€‚u‰3¥]N
+xÿÇ\‡°‰	Mÿê�)G‘¬Øoæ˜SoÜ¥Û¯z)d|>¦{=_óóÙ÷ý/_È‚Feÿã혲Až0‚R®×)™³—*ùCŠ×XdmrCñ¿aô±��öOæa[bõÄ8æ(µÏ1«eö†Z	cÌ^�„&Ãã‡ëÛÛ‹÷4®R¨O³ú‰ž¨·PÖ•O¥p—2«3L…ç&Àéã¬a@‡ñ$¸FJ=—U:úYwÁX27äÛÏ*A˜Ð�‡ÒHš	uO˜ãN”%zF‚#^”Mš&À¹Óç¬Å/Îô°sʆúÈ)›žŒzá×ݪW0ï°NzAy¶ûyž-hlm¡&L÷Š²˜%ûz]Â~	¢?MS9ŒŒÝ~_‹òP˜ŠMzó½Ъp‚ÍíRc)<	‡N\Ρ„2rC"
+zÌ3º1ê
¶ô£¶GñbÇ@¬]~�¸ž2r_¦
+«P5Ú�ñ¸v¢Øg<~±râ8vé¼IÉlq[VépëVwðàêTÕT°Îþ{å±
•¿_üÓ¥
+
+r5H6onª´Z«Ò¿8{·lÈiH_z=w—÷¡|£Fz2	`Rê—k-Pj$	Úf "FˆB¤¦Ù¶%ŽO6œh<–B@’d±nÖVpÑÖE´59í‚“á`ô´ä¼4]$›ô
é›Ô;€™"Y¹þ›E¦º\”ù+eëÍ›AŠÕ´èÞ%{UØŨ­õj8MÒkÝõWÒ©-ù'òÃaΛ>féáÇ’oâ ,¯{Ô•Ql+9ÐÔg¨U«êK7IâMR/Ö³Ež�$M2o~°,´¸7÷¹
œÿãíX >�îÕæTYü8³bvÙÈŒ\éŸÒê¾ÜÝåó‚QOiº°6ßÇtl;»
+0t¤²ŸÅRÈ�ÊCº{ØÌŠ¼H5 h¾¡â9�j>Q+úD�xšXžyZ÷¹C6«Û¯‘Øo¨͘~l@ÝŽ'.!¹�í]›Ûu×
+endobj
+1331 0 obj <<
+/Type /Page
+/Contents 1332 0 R
+/Resources 1330 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1339 0 R
+/Annots [ 1334 0 R 1337 0 R ]
+>> endobj
+1334 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [370.941 403.021 439.613 415.0807]
+/Rect [399.2874 660.1853 467.9594 672.2449]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1332 0 obj <<
+1337 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [432.8521 151.1974 481.8988 163.257]
+/Rect [461.1985 408.6709 510.2452 420.7306]
 /Subtype /Link
 /A << /S /GoTo /D (DNSSEC) >>
 >> endobj
-1327 0 obj <<
-/D [1325 0 R /XYZ 56.6929 794.5015 null]
+1333 0 obj <<
+/D [1331 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 434 0 obj <<
-/D [1325 0 R /XYZ 56.6929 305.0663 null]
+/D [1331 0 R /XYZ 85.0394 562.3583 null]
 >> endobj
-1330 0 obj <<
-/D [1325 0 R /XYZ 56.6929 277.7349 null]
+1335 0 obj <<
+/D [1331 0 R /XYZ 85.0394 535.0538 null]
 >> endobj
 438 0 obj <<
-/D [1325 0 R /XYZ 56.6929 199.9149 null]
+/D [1331 0 R /XYZ 85.0394 457.3433 null]
 >> endobj
-1331 0 obj <<
-/D [1325 0 R /XYZ 56.6929 169.7741 null]
+1336 0 obj <<
+/D [1331 0 R /XYZ 85.0394 427.2294 null]
 >> endobj
-1324 0 obj <<
+442 0 obj <<
+/D [1331 0 R /XYZ 85.0394 274.9785 null]
+>> endobj
+1308 0 obj <<
+/D [1331 0 R /XYZ 85.0394 250.6389 null]
+>> endobj
+446 0 obj <<
+/D [1331 0 R /XYZ 85.0394 122.1428 null]
+>> endobj
+1338 0 obj <<
+/D [1331 0 R /XYZ 85.0394 92.0289 null]
+>> endobj
+1330 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1335 0 obj <<
-/Length 3052      
+1342 0 obj <<
+/Length 2718      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZÝsã¶÷_¡ÉKä™�ÄIôž|‰/q¦qÒ‹ÓÎôrsCS�Å9ŠTDÊŽÛéÿÞ]ì‚"e8r›Œ¸øàb±øí¨dÃ/™å:Š¥Q³Ì¨Hljž•›³xvcßœ%<gá'-ƳÞÞœ½~'³™‰L*ÒÙÍjÄ+�â<Of7Ë󯾽øñæòýùBèxžFç�Æó·W×_S�¡ÇW?\¿»úæç÷癚ß\ýpMÝï/ß]¾¿¼þêò|‘ä:�÷sxæ…wW½$ê›÷ßñþüãÍwg—7Ã^ÆûMb‰ùõìÃÇx¶„mwGÒäzö
-Z*™Û¢\ïvU×WÍÍkWôì×_v4wÙn†ešbc_¡Ä š,Ê3¡g‹$‰ŒÖÂÉúKËâέgºÝ�'ù¼íÛ²­¹«¨ïÚ]Õ¯7¾Ý,‰ •�x[tv‘*j8–øØvSôUÛИ“yü&íˆeÑÑpƒ|+PèB¦‘̵rÒ"<EX�ãx~_Ùzý§‘™»b³)vÄOšÑ9
;¡´yâ�2¯O¨+§*©£<ÕGšúPÖE×}¤ùÿvób?ƒ,qSôåzQÖHÒùyîQ,—;ÛuŸÜŒO5$õÿçÍ”�ñYZ<n§¾?ÎlgËý®«îí¢mêGšÿh»OíîSÓRóMhKFêi·(Ëꉢèch9~á_mc?
vpüÎ"¨`’?€
-
_[ÀµhªöØþÜw6`ÂGÐxÖ)a¶s·üSNBEižç
g ÓyÕѳ Ç¶}°»Õ¾ÆV6_Ù¢?Oæ{²ê#£I�ž’GOÁŠ
-æYÛ~ÊÕ
Ù½ÝÙݽÝñ`Ó=4=¾¾þ‰ˆ_÷v÷Hä²Záò+ë¤XÐ�)™$3ÓƒM!–D.Çnm³$ïM§ux>¬["ܶáYtŸa„iäüªŸn‹]_•ûºØy¶ûÎ’r€^µ;ž¾
·‰–ë¶użhGØgûý–?€ÿj÷}àëâžØ _j½ƒ•7#7
-Rg
œ
-°aÐm‹’û	0H=TuMSny¬³¶!êöq²N·¿MNWb§¨Œž_0B0¢¦G¡™ »<#G„»Àâ/Ïç÷€v²ahT+«zžÔµd	¸
l_ýÈ/ƒ¤øÒћֽ·Ü‰çcˆ!ë˜}èqò"s°ÝX¦3•)È°¤xIú""ãÌ=”¼,Ž‹1KJíÆòÉ<‹´ê°òà¼�…T€º8ƒìïOràxBH%’(Ná�'Bº
-_1!"HÉòÆBY™”�í¥^ßàNÁ9E$Ö�E[ê@°¹©c°aÇ
-ÅÄS+¿‡u…Å£L•/ëî«%D*ç(
-gÓeê-�F"ço}±	‡*b3=TV•ÈЄq7
Ôáà/8ìãPGe0t5å`%&×o‚walZÿˆaŠ_ǸË*ê#GÄ-Ý�ƒà.¶àdg¼z_…îP¨Ò…3°¿XëòÍؘªÀvMQ#}t±�]`GÃ׃¸õ—!\ÍrÙŒ&tSÙ|TßæNªï‹ÆÝH¾’�ÞÌ cË·TØð:
-Çóš`Ÿ9_(
-&Êv³­j»\ø#<À—ë‚ÞÛ©Oã% =Ü.'#õè6P"K8ãøžQ)Ê�/‰ê
-t€Öðh洞$9AZã]‰ášÈΡïpå‡/QdJY'®ê÷}³«N•Œ<Ç
-îÈ-—¤
-Ì=1$vbØuuqÑ<S6AðÊr>( ,¨1ÍÓï¼ÄÄëàòmCN{Žh·4RÛ{[S†äѤdPñ~ÇwZ8Jš&z8yžÝUKFÆÒ§ÖY”iq”Y£õå1…Xxâ•=QtÁ‡(vŠÏÇÈÌêÝØR°ÌŸó@I&À™ŎؘзàÍeP>äæñ°¾ˆôbž¸¨=Ž¥qL†ƒ,f`ƒ´©¬ú`�C¡oL(ß^ØÐG–98öÎg±sQ
½AÌ…Dž
+xÚ­ZÝsÛ¸÷_¡ÉK陈!
+“X)?²>ûåìïÃÁ¬ûtÒ~"
+¥Jå„
¥š2`bÂTÁp•Êê©ÕÖôÜ�ë`_½Ù¯Ûr»¶ôÖØÝÁîšõ†Íç2
+SkÇé2/V8»ŠÁ®2ÉJû‰
E“I(c¡yQÓæ­Ýت=Ÿ+!ƒ…ý-Šde|AN£Ž“£ê%M´+K?\ÿB#U¾±Í6/x¼]åÌòS¹^Ó’;žk¬­ˆº»íÓìïÛŽw*Ö%Hf˜Ç&	.œ5€«¦
+©b¶1²ÀÏ�
+‰75™Gà|"%ÁÁèdÌñ	Õ~"²°Ëò"i‚YŸŽæRg@ð»0–JŽ}5Ç´#Á¯²˜G”Jƒ«ª›+Éñ�’²	ÀçŠ�œª
e‚c>SªBúÍ4T"'ZO…±Šä­'LÇIò5ÖÓø‰ìQî]7¬\›´[Í•
d£{�¬øÑÞOíª¦Iìá÷iU‚7Ã9ÄÁÖ™¨>”tˆT(
+Õå-åù-Ig¤îX˜�'𒩃œ{íFIÖßÙb¿kʃ�×Õú~
+½�‚µÏ(àn2K½}d&ÀyÕI%’Ì¢À±rc0Þb8ôÇŽ�?\’�7ÌÑû‚cåñ榨ôê
¶u~âŽÎ{`\%Á­K¡*	j·çÂîøuIÏ.'�]ƒ†Ù'êÐ8Œ³ì¸mˆoÉϦüP¹ƒCmiè7)3¤bW×Á@W÷
=0
°	€º³Ã%M½> ÜfU¯Œc\ÔUk?·�ªÎZPÐ…*ŠŽüƒ¾�r…Üuch
fV]äܩ̼ÉÀ¶ä'WÔ
Ì!™èTˆqSðïÚÕíP3ue<*)0B»rJFh´‰0I8%žQ¤iü°q@¶lgØŒÁ‘×¹-‹bfyç:›ˆ¢8Ž÷X�b¯r¤:¬Fñ#ð…¡l‹³'Ä•¡À�
ž%ô¯îi6PŸB ø%1Zt”B0Hˆà?`X¤"J÷©o€h ë¡©Š)áà„#};‡£(eƒéZˆt
+«®,p\kÏÕ‚iM”Ä^.–'9f$”	œ•XiÄã0òÏó’:„[ŒõI�“Èô�RÃã½Êœ°qÂ	‡èñÚ’Ÿ¼RÄÃé«ëñ2˜Øoì‚ù^×-ïî“\Ê݉۬šûϽЛ½«`P
+(Fòc§èòšâÇX„$‡ò¦ìχB
+ãĈ¯i ú}¦€Hcó6ŒX?Ú¡Jo{\³ ËQ]ÛÞoÑÛŸ(r™/rAY,—Ñû†ûŽã¾úf¨­þ?=ÿ:q7Z«0Òñ‘ÚìR@Þ3_ì?£÷ÿ:c©ºËä¨Ñ}ñ‚–Ü:çCªYÕûõ‚hîÙ�Ä¿£8Âó¦·Ê¶ŸêÝÇ>u<¼[é	Å=Dº/ôKøóe—{ ‚p8’îýŽ¯žðe×_¤8yíîPü‚>úPÈ‘˜6'¥e¾òpݽmN—)ç�jE˃ý� Ìœx+žb†^÷à€w¸c¡ün�ö×û…«ëÝ~ô÷
 endobj
-1334 0 obj <<
+1341 0 obj <<
 /Type /Page
-/Contents 1335 0 R
-/Resources 1333 0 R
+/Contents 1342 0 R
+/Resources 1340 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
->> endobj
-1336 0 obj <<
-/D [1334 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-442 0 obj <<
-/D [1334 0 R /XYZ 85.0394 728.7887 null]
+/Parent 1339 0 R
 >> endobj
-1303 0 obj <<
-/D [1334 0 R /XYZ 85.0394 703.8893 null]
->> endobj
-446 0 obj <<
-/D [1334 0 R /XYZ 85.0394 574.0702 null]
->> endobj
-1337 0 obj <<
-/D [1334 0 R /XYZ 85.0394 543.3965 null]
+1343 0 obj <<
+/D [1341 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1333 0 obj <<
+1340 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1341 0 obj <<
-/Length 1191      
+1346 0 obj <<
+/Length 1045      
 /Filter /FlateDecode
 >>
 stream
-xÚµX[sÚ8~çWxò;#Å|›>¥Y’Mg“v)}¢FØ2ÑÖ·JBKÿûÊ–llâ$@¶ÃƒuýÎwŽÎ9:ÂÐtñ34Û�Žoúšë¡­¶$=][ˆ¹ëž¡Ö€jh®z?é�_Y®æCß1m5°<¨{ž¡MÂiß�&½ùñîêæúËøbàû“›�w`Úzÿêæï‘l]�/no/Æ`x¶Ñ¿üëâÓd4–SŽÂxs÷§ñåçÐñèj4Ý]Ž÷“½Ñ¤Ö¥©¯¡[…"ß{Ó{]…Úz:´|ÏÖÖ¢£CÃ÷M-é
mÚC˪FâÞçÞ?5`c¶ÜÚi?C‡¦å˜]ô4LM1äÚ>t,Ó*-È79
-�SÙò«nëkDÓm„H¼%‹4£XŒ-I/ÙW"&�§Ãu\“8UioƒÙ,£³"�¸¿¸”ðÍÀÁZ…Å˼ٞe9¯sù
Dv	«ÈáU–=`£éb;ˆ2*\~gY.RÞ–¢õQôo¶ÜÝWGrÖõ1Š[bÊøQ§ªp0mßÑ¿Ñë[& �sÄN;�r7Orð†#%åeöˆï—	z” q¶
+xÚÍXÛrÛ6}×WðÑêP€o“'Ç•]g§UÔ'U£�IHFÍ[
+Âñ>¬E
+’T²iže“œw‰™¥\nìùC9C9Áè
 endobj
-1340 0 obj <<
+1345 0 obj <<
 /Type /Page
-/Contents 1341 0 R
-/Resources 1339 0 R
+/Contents 1346 0 R
+/Resources 1344 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
+/Parent 1339 0 R
 >> endobj
-1342 0 obj <<
-/D [1340 0 R /XYZ 56.6929 794.5015 null]
+1347 0 obj <<
+/D [1345 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 450 0 obj <<
-/D [1340 0 R /XYZ 56.6929 516.9892 null]
+/D [1345 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1234 0 obj <<
-/D [1340 0 R /XYZ 56.6929 489.6463 null]
+1233 0 obj <<
+/D [1345 0 R /XYZ 85.0394 748.6299 null]
 >> endobj
-1339 0 obj <<
-/Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >>
+1344 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1345 0 obj <<
-/Length 1111      
+1350 0 obj <<
+/Length 1052      
 /Filter /FlateDecode
 >>
 stream
-xÚÍX]sÚ8}çWø1ìŒK²lkò”fI7�mÚeÙ'–a‰6Æv-Ñ„”þ÷•-clbÉL‡ñ`]ù�û!éJȲõY>…6aŽå1RQk2ïØÖ­îûØAÅ7`ý¨~õaÐ9½$žÅ s±k
f,Ú¾�¬ÁtxrñÇù×A¯ß˜Ú'.ìêÚ'®®7fþ.¾\_^}ü§Þõœ“ÁÕ—k#î÷.{ýÞõE¯�O‘ÖÇÂ…Ë«?{æícÿüóçó~w4øÔé
J[ªö"›d†|ëG¶5ÕfêØ�0ŸZºaCĶæ‡HBÖ’°ów篰қ«6ù�R{Md"Û‡ÌažåQ]‚IîÁa¸¶}rÏ—`*R>Qqº4¢$Pwã(˜ó3ÓeÖê!
B�QŠ«êO<�A@©Ð—\ŽãtŦYƒ
˜@–¹¨†öól=ƺ;“>Å/†Ño9%ÓNÂ@Ê‘iüÈUaÕ2)4d|çguCPÕ� ãm‰³å×tL§)—r<Ôän
-©ŒügïÐož¾5¦JƒHÎxzlƒý‹d(fqú¤SݾíyrÇ'÷à^ÞoeJ+ÃeÜ ‘Œ3bEf$qªJyÖÕ’px€„pÍ®µ;��YÆJ#øצ¶öi´š"\‰Û(N¹–¡†)ÒlþTá"©¾�ãD‰8j�0áz6¨´Œmcæ�T<ÍÔ³ÌÐÑߘ¤ø£Z¥ÁÃ^¦ü/Ò(Ûr©aRsà ŽÂåj&R©^ã€px*kÉôŽùQ3C<ÎRpH~�rm5OÀ!‘ÒØ"òÒÒÝÌÅ$‡|ÅU?6
«©UV‘Õ>®ê}«ÜÀF%x=þC™=b2�;ÂøHñT¸$ZÌoÖm+Ï>–«3S=gDÔ¿/ÔñHJÌ÷¡„^:”Rußʹ"øcŠ‰¨'‡É�ÍùÖC%‹›2Yª,w½ï9“JH½ªMø&ÏEâT2y•C �A‚=ª‘ çšý–wQÈ<ϵ*òM>¿¶¥•.f!ÑJ�nØâ	¾»UªîsªÌƒØÍ+ªw Šm1ñØŽ�^�½ÜZAË89;¸:‡re#JwÔMϸ¾êZŒDží¾“k±‘ããæ2Lr°Ó½ûTcf·Kz׃ÄÃήèУ¢ƒ<‰ÃXctj,_OùÍüy�ÙÉÄùq­é¥8@ª@éíPLä¡›±®±ƒ}ªŠúê®Ë�”Ït‰—/îï5ǃäLTºÜ=ç±/D�Å"T˜-çЀ}>F�çcçØó1Ú:ßérð¬ÉŽ]æ9ÈC~d'“Ê>ÝÊsop‚:=5ÿ×q1#¯æIÈç<R|
-…{µ¸9{ÿƒ_ç,ÚtKF(Ì®¶î´ôSŒvô
ÚæzÑÑÛ�ïãòr“Êå±]ècæ­IeVºl›yyÕöœúÿÖrqendstream
+xÚíXË’â6Ýó^Bª¤ÖÃ/Õ¬z:t‡©“²"åA«ÆØŒ$ÒM‡ù÷ÈØæ
‹<Š¢,YÖѹGWÒ½Â2?l9.ta–Çlè ìXýqY#ÓöTÁÙ7`ù(~õ±]¹{¤žÅ s‰kµ‡,"ßÇV{Щº�ÀšA@Õ‡/ÍÇÆÓï­ûšgWÛ�/Í ª>6~®§¥§ÖýçÏ÷­À¾ƒ«?ÝÿÒ®·Ò&7ÃøØhþ˜¾aéch«þXoÕ›õZ·ý©Roç¶íň&†|«tºÈ³?U¤Ìw¬WSA3F¬qÅv(tlJ—oÂÊo•_sÀBë¢k©~AB]R& +è#è"å9º”Ð…€�pªŽióâm(Ás xú~ÆU/–½(N«ÒG7±Û0†ÌqÈ:’Ò\ª´Ò™ÄR§E1é%•nZû+}ü�´Ö­
+•u˜çý‚Á@Àë|å³´d
+ݯÑî@³¶ïGYò–ÊÆ# Ä{&I4?s¹O¼‰¢e©!—@BDt,ÙOõåHZŒO¡„÷�K)ŠµÎJ}.óþ6	E_¬;Gê5 ŽÂÙÑCM¦Ï¹³Yî*+-E4:Z“\OeŸ¯ü\Lì‚'ÏØc�Ï1Hг©³
+©ÍXé쬱<ìò«õs‹ÕÉ0$>ñJå|�#”´9E_�{¬ów²±	$J®^›ûÙgÍå &ZÎN‚ÀÛ<N…Xg1
µ
+%±j>RéC8¸'O¨²éeØäg9Þ	)п)™;7
Ã×Jžnœ‡�kå!W˜7óüÍC®Îu=!WÎC®�6mä!ø&yÈÿ�ó?<p.»N¥Lî@K.?Í?ïâ«ÖÕ=´mòSß'ù-*¡…[TâùÐö
HF*±ÓC[Ì—w²ÛÔÿgCúwendstream
 endobj
-1344 0 obj <<
+1349 0 obj <<
 /Type /Page
-/Contents 1345 0 R
-/Resources 1343 0 R
+/Contents 1350 0 R
+/Resources 1348 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
+/Parent 1339 0 R
 >> endobj
-1346 0 obj <<
-/D [1344 0 R /XYZ 85.0394 794.5015 null]
+1351 0 obj <<
+/D [1349 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1343 0 obj <<
+1348 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1349 0 obj <<
-/Length 1074      
+1354 0 obj <<
+/Length 1867      
 /Filter /FlateDecode
 >>
 stream
-xÚÕWÝsÚ8ç¯ð#ÜŒUIþ�4yJS’KçšÞQúRÊ0Dâ9cs’åšûß+Y¶±‰)	LnüàÕ×ow+íJÈ�úCN‚�aææƒ
-Çâb0”ðšC:Ç
-ì°=3&Ú»¸OÒ¨´p4K")«ú”ïî6Xµ]ñF¥½8^Œÿ‡E�u×Ú�n�ˆwnDð^Döì¼8jË›kŒœª{aLÓWMˆwWuìëë7,Œ³wéO:Wð%O•m¾ã_!ÄilÔÚž(�[᳌îy¥gw¯5ø€ùÈ«é
¨Ðô¥Ò4ì1ÍóŠËý[;E 	r0A
-ÕX±Uf¾t×&N+MyÛ9�¦Is•ÙÿJôíf�ñ¼ˆÖê!±)T�eW*7yN0
k‡bö÷‹O}@C/têìž0SSú‰Ž2Ež²¶§¬N×ÙËÝ«[ûàQŠ«Ò9&øTƒx
0X†]Ÿ={Ëh1«fúpÍýýendstream
+xÚ¥XK“Û6¾ûWè(ÏÄ_zMN›t7ÝN³i7Î¥ÉN†¶¨µZYr-z÷ñߤÖv´}e|‚
+»‘_'îhT¶¿›P"Š<‰ö0 „�Ö™’H!§™¼›ü8(<šuKÇâ—ˆœ$9ÏÆXŒ0)H*¸p
üó…Ý(šqA
+F¥ãþÖµz:K)uÔ§V­ýðòQ}‡ƒßÝR\'¢c¤HÌ‹9lüŠªÛîն̠wRNDpð‘&´k›ÃU½í
Œò_àçîŸõèmüCŸñSo>©²ÜzÞ¦Ûš�ow'f!Ážûü9nž›/u£ï•©»vf7€Ìƒî?uÛOm7²‹ÙYèøhFÄ×f„ŸeäÌÏÿèËó+΢�]Y×
+ªŠçE¬pìu9zÙmHu
+™ ¢TÆ/€êDb˜ó`±:€µ¯›©…«tµh|ÖM‡ßÍvÊò¸{¨K?¡vfÕmk€_ýXm¿w]ÁÐ jCÎc£ô±M¾>_¬Hápã,
J°ÿ¢—<�
žBeö$ d²,�d^�òë"Ø7êA�A€‘L0�€›–ÌË:2ä*�ë9
+?.üzÓÔK…ó�a~À‰W}Urî0öeÉsZ�ÌnˆáµñVd$ãÁÛ¦î�wx£—õÌ74™™æò@¶i‡„,ö\Þ"cÝánptýκSòû~XYùas †ÅâÌJ™@y#!˜À[BëC·QK8x§ñnä—Õ8™†zIƒ•!ÄBÐø��žð1	èþ¶-UªE¶júnìpƒ:œ	­=qz$­Q÷«[KæC¦ßÚêÁ	ÈPüò€¼RWjטg˜}³…’¬†*„]8À”£¥_a¡¯ÁÝŒÅx~óŒÇ‰@Ž;Wà‹¡
+ñ^rB3žÞ?ÿû
ä�.“zñýJûóåKÍ‚�b)�hãŒÀ;1„ÃÈ�ÀË+;MÝÏ;$èN˜ ì·wß!ÑL¡p�¿�ÀØÕßñ2  ,tˆ}䮌ÞtAYp‡³Çá†ý
ªyý¾Wˆ)b
 endobj
-1348 0 obj <<
+1353 0 obj <<
 /Type /Page
-/Contents 1349 0 R
-/Resources 1347 0 R
+/Contents 1354 0 R
+/Resources 1352 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
+/Parent 1339 0 R
 >> endobj
-1350 0 obj <<
-/D [1348 0 R /XYZ 56.6929 794.5015 null]
+1355 0 obj <<
+/D [1353 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 454 0 obj <<
-/D [1348 0 R /XYZ 56.6929 337.9712 null]
+/D [1353 0 R /XYZ 85.0394 589.0297 null]
 >> endobj
-1351 0 obj <<
-/D [1348 0 R /XYZ 56.6929 307.8573 null]
+1356 0 obj <<
+/D [1353 0 R /XYZ 85.0394 558.9158 null]
 >> endobj
 458 0 obj <<
-/D [1348 0 R /XYZ 56.6929 307.8573 null]
+/D [1353 0 R /XYZ 85.0394 558.9158 null]
 >> endobj
-1352 0 obj <<
-/D [1348 0 R /XYZ 56.6929 283.4459 null]
+1357 0 obj <<
+/D [1353 0 R /XYZ 85.0394 534.5045 null]
 >> endobj
-1353 0 obj <<
-/D [1348 0 R /XYZ 56.6929 283.4459 null]
+1358 0 obj <<
+/D [1353 0 R /XYZ 85.0394 534.5045 null]
 >> endobj
-1354 0 obj <<
-/D [1348 0 R /XYZ 56.6929 271.4908 null]
+1359 0 obj <<
+/D [1353 0 R /XYZ 85.0394 522.5493 null]
 >> endobj
-1347 0 obj <<
+1352 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1357 0 obj <<
-/Length 3651      
-/Filter /FlateDecode
->>
-stream
-xÚ¥ÙrÛFò]_¡GºJ‚çÂ
-°Õ:êöц±ƒe„(â0`Pi¾©
-­g¥%Ú–iË9éí*wÍg@I»ÅCÙ+
-@÷ãŠE7 ÂŒ|Båd�,'<À´OõjØ ’kµ¸ëE°áJl7l©…‚oõ¬ä~Q©ª‘áÁ"Ùf¬ÚžQty
³9´rËV¡g-´›îÐÃÞz˜IO»4iMÏT;’`4v¡‰UŠ¸ŒçŠeĪ³;°r�ÍâÐWŒ(ù{xê®PÙ†±`þɺaW¿Ü€a<³� 
-�(2
âf•�ŠîR$°N,
-1â8ßÀ„ÇÎÎÂb&Ð_ˆ0ô)wŸ°Í£s£–L6t’]6|Ãá3$ˆ³
-f²\ô]s®Éû$‡\[.0N¶¯Ô®gîz
-V#K!¥´ÔBæ_Ëüß<†Ô68ãÁ÷8Ö¡J[›�Ç–Œd!ÐVOÀvP{R*ʘÒBâgègíC¨à¦?ì0W›�ä(�Ê=Û‚Hð9K'Ç´m[´À=•bö!ý…½Þ
-©¬�{�c„¦‹ KÀ�¤Ã^òk™?*ÖläDÚf|04Æ£¡Y6bâùÆ
€z�ÝÏ,vNrk kŒ
ʦnD-Z�
�ØULÕÌÞXÐ¥n«’nEÆA5E¨šÙ¨¾ÛJ|¼,9½Åø®ó^†/»C³bð±’°¶DFJ2F¢;/«è˜¥€.pÜ�y>‚)µg,Ë¡ºåN©$ø±Ìƒ#Â�
¼Ô
-Bùz§F
-
†
Gî$‘yÿL+†ÏÇøÀû¨ž�Ós÷}&ˆðëö7‘”û]9ãÛ€×ytHfI`Ö!«%
Yñ’÷Vû¶l˜JXê'UrJ‰{uXì4 9•5Ý–±Öª3'ֱ䅴kšÍ|eŠ4æ]2ëTù’ËÅ!/æ]:͈µìKyL§Ñ‰3iÊEònÿTîWsï;Y’©Ü�y—sÅâc‘ô
-Š=ç1EÈp�’¶Œ;co@éϘø<g`�öÔ‡òg·£ôpî6û¤ˆ|Žš�1±O!&>„ÅÖ¼=šGNÈØ>ñ”¬úpóL¦Ý©¾È³$z/´?ôÊÀ‰ºŠ%õ1šä÷ i<‰/X묃ƒc¸ùˆ•×î
\ñÌM€=¹ô\¡æøQ$ʨ"ò-(—¸¬8{c—×Ag¨|+^ÙáSåÎ=w;Ø+ecö<8x许¨ÊŠJóÍ
ÄÄ
;dr~«Ñ‹Ï5•îa†
-åì»ßÃa�gGNP5W±åGûPµñ·ƒ4êá�±’ä6ì‰n
-ëØE†
±ÃœÙ“=©ƒ¸>ÍÍH6Ùüÿ
pϢaendstream
+1362 0 obj <<
+/Length 3416      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥ÙnãFòÝ_¡·Ð€ÕÓ/ì“3ñLìx²/v�$´DYL$R){”¯ßºš¢$:“ìÀ0ºX}UWU×Õ2
f'*Ém>Is¯bmâÉl}¡'OÐ÷þÂȘi4ŽúöáâÍ;—Nr•'6™<,keJg™™<ÌŠeÕ%¬ £·ïÞݾÿ÷ýõe꣇Û�w—SëèÝí?ozýáÃõýåÔd±‰Þ~ýãÃÍ=w%²Æ··wß1&çæ•EïoÞÝÜßܽ½¹üåᇋ›‡þ,Ãóíð ¿_üô‹žÌáØ?\håò,ž¼À‡V&Ïíd}ác§bï\À¬.>]ü«_pÐKSÇøçm¦â$Èf¹Š�÷¯ïË{hØW@›8¥
0úxßifT’¤(íUž
Ô%ÅX­rXh’ƹJœu$•¶Û="kÞ¼Äap’©Ô[Ü]/]Êc
J¢?šºd\ÕJ_µ®VÅ–»»†‘…ô­Šçò0ñ
+Á<*?ÏÊMÇ#ºe!PÕñÀí¥É¢r³ªfEWÊM½Ú#­@ÕԕDZ%òº%¬îlÝ}Â6“ɳ†ÚyË�Í‚;þ\mWnÅÇAlU¶˜Ïè×/ë®âµóP}}>žÒ†C�|m¢"LµZGuÓ	–¿Û®¨ç<bΛbÛqÒ�¢ßÝ}úG�Ú3n°z¿è¢,ºÝßnÊYõ³ÖvvL+ßPÜÞ'^²j½Y•k8ÑUM­ÆNJ
+øPÕUý$3Ï×aÑ÷ÙîÇx
ÒFÎ’:Ú&—“°¡­‹uº¶Ï¨©4z>gúÛ–Ô
+Pp@º¿Ç—=ITf³T.0.6W³¦^ŒÜu0)Ø
+ú윋–•¬¿k‹'¡Px”©µ`<µOŽ9M*íàž¡¬Aaæ$D@²
¨Ë€Tŧݖ”ª»àâœ9ƒý¬}åÜ´»Í¦Ùví¨˜qï,aA	>cédq„ZÖ1€{)ö—Æ<l
+´ÞÊPÙ ÿ&r¼Éƒ,
×m‹º]”ÛVvZÖïk:&lÒ6›Cc44³ÕŽ˜ƒx¾q
+Á˜ŽÚ2–勆�Ì;@‹N3Â�
<i22>2Ø1Â+8MŠ2Ðl—´,bÖÕg¼‚v
œxIûÁ2âçE,q/:ÂWü]êÉ@tï+4ŽV^V£ê>P`§ñ¶ÊRÖö±6ªPØça#ö œ›že–Í3ÿ0áˆQ½£DhY´°˜FHýÔþp®xpçiÝ9Òi\T¬VÜ/.Î÷1ƒ²lÏÂŽ<¢:„Fè)Vm3&Uö,äéÄã-y³¡ïkÅþê^ÉgŠu¦XŸ�éϼ£Îzï {G
+$lœÎÝ÷	QF«ªž"ªØnŠž;^Ûˆ§Ð*ÉX`ü@Áß$ 'þ
[dÊm]¬x”°”–&¢€äLJvÿa³ã€æXÖt[ú‹|qc|@¬cê43ó™WYâ’É0ŸùÊÉk’hv2×$û‹öS^K¼\ê”Ï8‰I¼ˆM.žøÂ&“%Ä/àÇK±��È2MUªaTŸ{yŸG?[ëyŠ¤ˆD=ÂþB?Ž-ÞN/†¿éúB{¢ŸŒ¬Iš�8¼CýBy´)Ç"ÖÌ`&¬‰£Ç¢­àbO-ø­k9—žÔƇc‘•>?»u*=‚¤¨£¬ƒ7 ¨Âën¿)ÇÖO1äu2÷uþºL%ir[²Á¸:°§“³ ù8_âd{�‹˜Ý©DÄ©Ui§§^z”
+Ë
!2[&‘(Ç$¡r“HìNPÈ QoRVxZ!·�&Æ�z  Õ§Á6lF½ •Õû3q’,Cô3Ðÿ×Cža$ñ•ÑÉ!äI
8Õ¿EÉ„WÃ
ý>w_¨3ÃTû¤Ä"ðÝëÌÄ:ƒE‡ª«ˆwðÁ¥1
+e40Ä›¸„´}É“r>@ì8„Ç…
+Æ J}ô‚ªÑ4î?¬à&1Зî
+¬O¼Û šÛ˜KÚˆà’Ýpîð$9ñ(Œh¸E©Rhr¦öt�~ä¾ôTaöB+
+¯ùg¯ú6Í hsn‚¿W€Ø'=ü,⸀ ?90>Uij’þglXPP
·™œÉˆBhÜF´ð}¤drV¹oZ†Ù%#DµI8o—¿eÀ¢Y­š¾pš2ulnÈÝÒ5ÑäÎO»¬Â®|õГ³2úü:@f	)¯	õ
+p�#fݩ̧!ßAÓ9^*5©Êµ
�·TÐ,ÇBM�å!�4œhL=XZŸÛ“ò@Höà;|<Å$@÷ÞE÷ý³f+·¬;+tŠÕx.Zé[¿Š•&€ô v7så]œõb92€:Ü[–mÕ¼–	æ.Ô�Drøh^IK¯ÂöOìá½¾B¹&ô<4“·ù��¯·ßÈ’?rǯl–
+ϘÚ3Ê�VÖ�!>'ýlßEendstream
 endobj
-1356 0 obj <<
+1361 0 obj <<
 /Type /Page
-/Contents 1357 0 R
-/Resources 1355 0 R
+/Contents 1362 0 R
+/Resources 1360 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
+/Parent 1339 0 R
 >> endobj
-1358 0 obj <<
-/D [1356 0 R /XYZ 85.0394 794.5015 null]
+1363 0 obj <<
+/D [1361 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1355 0 obj <<
+462 0 obj <<
+/D [1361 0 R /XYZ 56.6929 167.2075 null]
+>> endobj
+1364 0 obj <<
+/D [1361 0 R /XYZ 56.6929 139.8789 null]
+>> endobj
+1360 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1361 0 obj <<
-/Length 3077      
-/Filter /FlateDecode
->>
-stream
-xÚµZKsã6¾ûWèº*Bð"	�‰=q*cg=NÕî&9Ðe1‘HE¤ìñþúíFƒ_¢&›Ùr¹Í~ ?4€n‰‡?1#Yig±Õ,ä"œ-¶|öcï/„§™×Dó6Õ·�ßܨxf™�d4{\µxÆ�³Çå/AÄ$»<xwwsûþ燫ËX�·÷w—sòàæöÇkj½¸úðáêár.L(‚wß_ýôxý@C‘çñííÝwÔcéq‚éÃõÍõÃõÝ»ëË߸¸~lliÛ+¸BCþ¼øå7>[‚Ù?\p¦¬	g¯ð™°Vζ:T,ÔJÕ=›‹�ÿh¶Fݧcó§¥aad¡%01‘9-—dp�ë›F±ÈD}±s#XÅЈŒfJèøèÛò‰
Wh%gqhY¤¤r>Y¦›ô9©²"Ÿùæ
çè›;~&8°Æ‚,üàq�•8±2¨Ÿ‡2]R«*è™æ«b)L°H±CÕ:¥‘¾8×YVIuðÌŠ•gž¯öIYí/MpXTÇ-Eí@
˜:fÃP:}þSä)~ËEð+yz)ö‘V">|MCw×�ˆ
-÷ƃû‡÷@+�]åoÔ�äåkº§Îj�TÔ›yî¤Â"Í^@„³:_³j]ª1Å’ür®t¤Ÿv›l‘Uøf˜×›mÛ½Çiñ£þéæ
	’ÈÙgÕõ—é¢&6 ÃfCÝO½¢eW‘æI…J+ƒ¤Ä§
-îþùÝý‡«Û;FÝäYl-‹Ô“äEå¿ÙíÐ]ØD/ã˜S;Ð5UúÉͽ n#ÓRÂ|m–´4wl<¥ôD)YêG	M<ؤɊZÎ׌0Ú�vOÆyP[ÅD¨¤ÇôgD9…ð	î¯pÖV0ÑÔåf;¬Aâé�˜@¥±g床-}ä—ÁÜMļÚñÎkâH–À“õ#”†õl"ÍÚûïÅ
-ÍA	…³ù1H��zðMhÃnÐûŸ>ªÕ
-jm“ß}”ķ‡�ERú°á…aÒÆQãæ“¡ÉÃzöÖi™Ëƒ•eÜ*ãɼç”ÔNu|"^–ÔtJcÃí
-Hƒ[ä¶ùÐQ¦û—÷KG~Œ"ðöáöñ+Ïò'ø�Ât\Á,ä	‰”n«®´3cc©’!Dߤµ•ÎC쵺癶jˆÑä	·8Õ_’}V¸½
ùVV鶤‘eR%O8Ñ€M;cyX¬ýçž´ÙÓ(žÉŽÃ®&ßí3„–çœäKú¦,èYä`¢V‚&öü‘¾½Rt]žß¾ÿ8¶4Ó:¬ý×à‘å[^äoÛä¥yý}QW°\×îaBt64D÷—tSì¶i^ш“Ïwë¤(a=ႆ-5¡Þ¯îè»MSU,Š

-Ú›¹ã”)­èØfK1Ç£…þívgA1„_{}€Ë‘ͺޗ[¡‡:ðÜs\…Ãù‡­.äõÔÂñý~Ì
J2›¨½€üæÞ	ës
‘Ù˜(šÁ!v·»ò�Ý›	Ý»˜\Žû‚Åb¢†u.ǯ7žhÞ¦:½Ó4TîÀ‡!þÏVo}á­Ð'¥7T#â;ÈÄ	)»â?¦i/..Ór±Ïv~!S@N¯�—ºöU߈ždÊèzÍä};
KLÆJtì¤ÁýóŒí­½¦?cñ�/™¼8‡xÓ}•à€–gßP�QdÈ
a'ÁÆ-SÓ`kQM€­¦:úéÏCºÁšd\i;-¼¡‘ÞÅàCDª+þK‚­1¢�58P¨æä1†5Åx$âŽ�“Xóôg,òý|¬iËb-äôÔ7Tgr›ÄšŠá@ëhkmªÓXk¨ŽnªöpõY¥û
Ü$‡è,Âiù
Õˆ¸a¬�ú|I¸µíè	�Àúت“ˆƒ“‹Cm;¦N ®¡?cô�ïç#.Š™VZMÏ~CuN‘
·iÄig~ŸA\‹jq5ÕÑS‡œXÒax§òHOKo¨FÄwññÜÄqWþßÛíàíhEm’®Åéø‡(Îuwš§â[MÆä!ß¿°—Z-¦ç¾¡:£È�Û4Ú¦N�=ƒ¶ÕÚj*”HšïŠM¶ÙM!Ç¡�ßP�ÈïÂMÃJ�UW��Íñº{	ùUJý3…„à£:êÞvŠ#½{„�¿O#�û>T0UÎpmM§‚XMÆ´!ßQXÁae
Óy§ç¸¡:§È€Û$¬¤1L‰HLêMuV
UùÏáÆõšì—Yþ<
-MHë,�þ"†5êúŠIVW^½b_QË°ñ”öt¡B!MLC(DØ+þ¸4În
-ÈQWGLÅ2ü,mC	—Ĩֶ5G$Á¥€�Só¥ï!Ç™z¥jg��Hœ‡ÉhŽ9I�3DV³VÉaS“®h4T£Ù=Ø­#¬u‹§Ó–B@Ô¡îen›jb'Ö´Ó·euxêT}Í¡Ù½ÖíúC³c¦Û]]XÀÕr2”¸:YcÍt(oS�å
•K�®ÓÅs\�åð�2@àá
Õˆôî!•’TO<•f”¶¾èEõκϗ|Ù{<úª}F%T^/r–${×@è–´¢~—öÇFù–WÉ'uðÁ�Ò}•d^ì²ØR[S¼òõX:h¸àK­Ç‚ª(ÀÕ¹q_Áˆý¦ð«]ë¿+ò²¦ëU{¡§U§�7²yZ½û?ÜUá»�«^°’Ò(°XøR§ˆWqêÇ–o»Ôã÷¦®Ûu EŒÃ1¬Þ=ÈöѼ…˜èÉêStOŠÝU1²mcÒ@Ô‡½U’mÆŽ„°%ZÑŠ¥§U— y‰´Ü$/c×g²X)õ5‡ól>&HÁ¥E5?µî1s%£3é·6Õĺ¯©Žë~û©/ØZf°È2)¸&Üý‘�Æd«èJþ2i·¶þý
6d‘n*@#)�7¥;6N¥@jú3æùžº&ˆÁ]¾€-ùÌ´7Tgr›Ä˜
Y«3[K‹è4Âj¢£ƒàŒ»\À�n˜ß…Ë“²kš¡ìîOS»Z¿ÌÕthBOvÞ´æt1
Ïg1Vó[L%Ejòi‹\?fø›ˆo“ÓÞ�Ñ¢ÏkcpwÁ@0	±#Íįpˆæè,ð?»_g¤<œ’\“$wñÅ™4‘j‹þ’ðêÐÇ—`‚O«à
-G€ñ,üûSÎßþîñÊ:†hcN”ëß”y¥PñX× JÁñh¨ú
L§®endstream
+1367 0 obj <<
+/Length 3031      
+/Filter /FlateDecode
+>>
+stream
+xÚµ[Ksã6¾ûW¨ö²rU„àE8:OÖ©ÄÎzœÃn’%Ñc–%R!©qœ_¿
6$:oM¹Ñ|h
+R±bŸoWL'´ßK&—ÿ-Û²M›Á�¥Õ0·úlÒÂø°bŒè(â­5ë‡§>d›üWJy+*^òæ	KF.¼	äÒ=ßhp3UÐ�%ÕÝ'yœˆDŵ٥5èŒ0Öƒ­�ˆRq¼X‰„…Ž6äâ’ॴ³º;4yYÔ#*QB#`yœ0qyfêXЪ�‘g#ïPF¡t·+_V0üùãëP8“ŒH•ÌHw¨	ñ}¿1«�üOYv‘¶°ÍêM•·îÀŠòq½:!”KmGahÅ@t¤ˆ Áy14T0Ab¦cÏPl¬>/°pß3ÙágL÷‹&oNÆB0pÌH%T®õŒïjN‘QoFr–mMÌâ¶õP
¶u¨Ó8ý~̪	²
N1îPÒ}²EÐ
+ÑÐÿždsF¹–%@ðy®Át¡'¹fñ3�û};׳–&qØõ5§È¨·0ר†%O%3\ë¡\ëP§ajª´¨aiÑMÎUX|šï‘-’„S-|ù�lÊ#[ߊ�ð8&q²Ïò�ƒN”	ÏÒß:üŒÑã~ßÎ7‘DÑç;Ôœ"£Þ‚|‹=E4÷>ê<ßê4RÇìW²1Û E\‡¥;Ô„xŸo0±„ä¾ü÷äÛÉŠ!Û8Q$Ÿg˜ïæ Û,~Æäq¿a%5oÐ8ì{‡šSdÔ[˜m°éQ	„�0Ûz¨
+ЪC
§ÿ
+Î[/iµÍ‹ÏC=8¿Áf>¬ˆCMhÒ7žÓˆØ7ëÿÏ
iÎiÅÎÆ6)¨9FhÏè
+ƒü%Ã2¦7 Ð<uÍ–Ef¢"ˇ'«³À~Ô2Ý<åEVw/§¶ý%ßY½1þn2'*�H~ð8"2QÝÚþím›ü
+d�~Šåöîáæ㦲#pÔ–¬ËŽì³ºN?gÆkŸ) }‚ªÖ>¬ÃcÌÖÖøkÌ4ØÔXƒ¯[Ä.¯Û„’)éÞÖÖYõ%«¬€_iDmj_M‹A'‡*ߧx’3»
+b*è‰Á’[; €}HÑ™
U‡Ý±ÆRZ¼báæ'[±Ýâ8ÔuVã{^‚Ê`ÚÕ˜b¶]<ŠO1Í›£YXÙ@M*S%Ë+«^Y5XÚ§V½u6Ðå’-At¸
6]‘?ö˜E3ÞÍ€yêÂ&½IÛˆÁãNÛž�PBSvƒZlm
œêf²y潤̎¤a4šš”¤e‚3AÁòò˜wô[aï3•ÜÓŠÄ&Oë9fÆRFÉ~
+ÄòÕæGŸ²ÍóÊÌÎz¼K$VzF¸CMH÷3>0$&Nyâ0ÔH#vß ¬›Lݱn'žqX‰5–}M•oÛ‚“\ƒ%iáº%�–&ŠÅ¤-9
S¿MúV¶2ïeU“æVò¶ÜcYbȪ­B…‹?	—ƒX‹ñ€"^š	ºkß‚ûuiL¸nÖ‚CYÔ®þ·Xóˆú=>¡‰P(²æ¥¬žÛë…3Õ§‰
_Ò*w
+l6eÛS»¥Â¾Ê©ŒüŸ.Ïݼ2Ká�e51µâ˜PØŠuÚ>™…×-¬�£Ý¢?1&Vî„Hq¶�Ç4ßMmaUÔ¬NÏ«ÎA'%ºµ¯Þ¥_¦ŽÐöVBˆwÔö´Å” 
~ÒüÌÔþ�…á‰ÂœŸösšôû?F3žÃ‰S'<$ÓaFBý�œIÍ-LOêûúºWÖˆÄÒíôÆîP=óLJ:ìóÜÑ€�ŽÌ°r%L‹�¯&¨Â°§0›˜†=a3|ê¡ŒêP§q�=ívG¸³"	«k…å;Ô„þœ×‡•ò5xO~õíO¸Ébªó)6iNÕ”{¦†r!~Æèq¿o暤&{¡“°÷jF‘qoAÆÁ8�Rr†q}ÔyÆ9Ôi¤ò¢É>Wy3>ŠÂ´ˆá¤VÀ¡&4ð)§Ìu¼òUxOÊy†9Ç£<À9‘ÀÁH	ÏÖç:üŒÕã~ÿç$‰y’„ÝïP3ŠŒ{s.SÆg8×C8סNCUçëÝDÖ­½A—°èÅ;Ô„|ŸqŒH®µ¯Àû\‘ŽÌ^#¢´Ö�kóÁ÷-
^#XüŒÍã~ß¾žjJ8çaßw 95†}…Éf>$jŽl=T€lªÝ{f•9¯®ê2]5Ínà(ŒSajBŸnКæ«ð>t›0dH8E„\’ÂqBr¥=SƒñÍâgŒ÷ûøfîW•{ß¡æõ¤Ó“h&ÐG�§œCõ®­0><×Ï#ÎÅ ‹g4p¨	<Î%”$:èð>‹ê”%ÃOíà
+§/Å:쇚QdÜ[˜u°,DŒÏ±®‡
+°®C‰æÂuZ�¯å¹„˜‡« d‡ší±�k¢bˆæžìöž´ÍSÊ.™$t›Á*LÑ“ŽØ^bíÚ¢l¦JÚ¼ �ÔMYaÚÅu,i—Š†vÓa›ý¥]&Ǽszå±4Wc^S_1B™EÜψ÷ý9ºÌ‚8㾡|Î^_l†¤ð3oæ6£~'šaŸ«ejSü1	K,µ>ÀËSÞdõ!Ýd«m¶Ë÷¹}5YvRLzxk14˜„YÕõ3Ðe›M¾²·Vo/må®·ubƒNÕVÃ@~…©â6hêÚÔ¿)ÔÇu�ý~ÄïguOK‹s÷âðpHëvŒÛðùh¾ÀíÔ(ÃêØæu6•†y�cî±ÿ’¾¾žÝØhY£æI²KìuB5á4Il
+Ö $륵à¡KkA<õ¾.Œv«TëæÓ7iJ¹›4ó
²Ý×Þгþç%[ÖX.R{½f$«}¶/«W|D/lWë]
+
¼ÁÇNSkY{õ–Ø$2÷&i+³NNÙ �t{x�}·7é³u’7 oámë�½¢rù%Ý1Ó*NT1
‡²6[ë›òG¬M·ÛÜøt‡õý€"—Û*··bÐôd2“mõ:Ë
+¬ƒ�ú3¦‡¥áI‰µ6`I{«f>„o³Ãlù©Ü8†±¡NOß~8¡'Û³Žt›Ýq;ý]6¾š›Xµ>ž–,(wW&E6Ñeg@ŸÓëW/£JÎ}©/""§ïàÏŽäßþŠÿô_¤ù üìVͤ?¸I RÆ©‰jî>÷«þ?.1Š\endstream
 endobj
-1360 0 obj <<
+1366 0 obj <<
 /Type /Page
-/Contents 1361 0 R
-/Resources 1359 0 R
+/Contents 1367 0 R
+/Resources 1365 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1338 0 R
-/Annots [ 1365 0 R 1366 0 R 1367 0 R 1368 0 R 1369 0 R 1370 0 R 1371 0 R 1372 0 R 1373 0 R ]
+/Parent 1382 0 R
+/Annots [ 1370 0 R 1371 0 R 1372 0 R 1373 0 R 1374 0 R 1375 0 R 1376 0 R 1377 0 R 1378 0 R 1379 0 R 1380 0 R 1381 0 R ]
 >> endobj
-1365 0 obj <<
+1370 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [284.2769 435.7745 352.9489 447.8341]
+/Rect [312.6233 667.7189 381.2953 679.7785]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1366 0 obj <<
+1371 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [282.0654 405.5217 350.7374 417.5813]
+/Rect [310.4119 636.5559 379.0839 648.6156]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1367 0 obj <<
+1372 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [299.7586 375.2689 368.4306 387.3285]
+/Rect [328.1051 605.393 396.7771 617.4526]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1368 0 obj <<
+1373 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [292.0084 345.016 360.6804 357.0757]
+/Rect [320.3548 574.23 389.0268 586.2897]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1369 0 obj <<
+1374 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [330.7921 314.7632 399.4641 326.8228]
+/Rect [359.1386 543.0671 427.8106 555.1267]
 /Subtype /Link
 /A << /S /GoTo /D (dynamic_update_policies) >>
 >> endobj
-1370 0 obj <<
+1375 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [401.5962 284.5104 470.2682 296.57]
+/Rect [429.9426 511.9042 498.6146 523.9638]
 /Subtype /Link
 /A << /S /GoTo /D (access_control) >>
 >> endobj
-1371 0 obj <<
-/Type /Annot
-/Border[0 0 0]/H/I/C[1 0 0]
-/Rect [257.6971 122.0209 326.3691 134.0806]
-/Subtype /Link
-/A << /S /GoTo /D (boolean_options) >>
->> endobj
-1372 0 obj <<
+1376 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [310.7975 91.7681 379.4695 103.8277]
+/Rect [286.0435 346.6843 354.7155 358.744]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1373 0 obj <<
+1377 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [308.6055 61.5153 377.2775 73.5749]
+/Rect [339.144 315.5214 407.816 327.581]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1362 0 obj <<
-/D [1360 0 R /XYZ 56.6929 794.5015 null]
->> endobj
-462 0 obj <<
-/D [1360 0 R /XYZ 56.6929 639.5425 null]
->> endobj
-1363 0 obj <<
-/D [1360 0 R /XYZ 56.6929 613.8858 null]
->> endobj
-466 0 obj <<
-/D [1360 0 R /XYZ 56.6929 492.501 null]
->> endobj
-1364 0 obj <<
-/D [1360 0 R /XYZ 56.6929 467.2627 null]
->> endobj
-1359 0 obj <<
-/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R >>
-/ProcSet [ /PDF /Text ]
->> endobj
-1376 0 obj <<
-/Length 3026      
-/Filter /FlateDecode
->>
-stream
-xÚµ[[oã6~ϯ0úR¨¹â�|œ¶™nŠíÌn&Å.ÐöA±åD�,¹–<iúë÷ð&ëJMÑ)�)ò3Ï…Ï¡<x•À?¼R%T³•ÔñóÕöp•¬aì»+ì1›
-ótÙee“oŒ@i¯··“XõÍ—3PŠhéƒ4.e»a!¿‚ù½NË�ëKËWרÏuöÛĸçVK�sö»‡cZÛ5¶=Àãù
-Â0DÙ}z.÷
-3[¬áõ‡ê0ɱ:=‹À� ôb{H·-λ@Á—¼y’+7±êá|9² í¥
q£)ƒ
]N?¼†ÞRoöäá渠:~òtQó'O‹²‘2‡E<ŽÎÌ ªJ—Û¢&÷ÎU¦LíIþ<9õEÿQõ„¨9âær"Ä ÷ê™ÉmZü‚±ãy?=�&a®¼Þ¢ÏÍm˜RH(†ãë¢æÖ¢ì
-eEö˜ë7UY¼Žk7�4Qù
4!¿G4
û\&\|×Âœ–4}4m¾¶ªØÞôx,rwˆ
-<‰õSîŽDM
©ÉùÁµL
-cÎqÆäúvïG3�‡Æç¡PÜ0,<_³z‚±X"
IÄåØ0¡6GéUf¸ÊÈzÉ‹ÂQÔ^s°š%Z
Œ¤íášúàg‚´ýô1,AÑM|9~‡ËÙž­®e”›çƒ²ˆ
%ãë "(cäœ/éi7NŸ1âë¸à5!¹Ÿ>Ä9¥}Ñï­(åëC––�­îÏ…?¤ö®ßQ¼M}œoµëJ݇Óߦ^þd6»´G³Bp7’‰ÙHØ\ÃxD¡•Øƒì‘ídnSÈÙ½¬VÅ¢ªž!œ:½+7¸OóÂqŠhŒ0ŸϩtߘŒ€HàÁéÕæëDbÏW™ŒŒ3ƒnWÁàcÖ4íWÊÊu¦eýâÎr“<IaòêbÚö¹
-7&!—žð‚½(
^x©Î…—ŸšÃëäzÊêt0)Šé
-î°¶U®/l0"	J”`ýÊr‚l7»
(80áK ‹šß
-�Ûÿ½½C®	ö@mù­{Ðî#,]Uos³´q�íl[ d	j}Þ6Ã/8ûM—ÝL—!¼ö:\°ÎØ
-Ç8³ÒÓ†%r›Óî…A‚ë¨QØ]¾·ç€_Ëb1‹²b¦o¼1®Ì˜ÛwÎ’Ù�C4EŒ²…xÞEÍoœÕÛ8Íá¸ñî½`3¯É‚-jB‹žÛ §Á’Ôh·�‹A>””»jkoBYuj¶PÙ^Þ¶*sK�“õmKÄÝTÏ{ZH¾ØÂÕkñt@YyâŽ*`ˆ"Œ‰¸à5!¹œ(Ä$®û¢ßøÜC…}¤HçJµ›êËÚ=:xÞÖRZÙŒÄ~úcw—•¦8I¸¯|îÏjOóõ0jè>'ÃÞ|¸ &H­�3Ûª5²24½QÁ%'l´Q] 0§•e�¿Ûê–$¦`Û¦á'T\½µÆL"!X˜þ�Ö&I�¼&ЗSßDÁ‰¹4‚èÌ©s95a‡ MÊ׈sl6k±Àæ*Âæ€rvþ¾±GÑ>óñ#?d›ñí6ï;ˆ`qMZÔ„*=z+XËDª¾.Ÿç5VÌ¢�Z *¥œ�¥bZ‘žÑ±×Y
¿`þxÞ¹+9z�ÅMØ�£ëТϽòÁ ·¢záR±‹šga‹š\³|WL³²fóú-ªI‹šP¥ÏBS�Â2ôtù<׌1‹†,¤H$ŠDX!ÇÔN]k¢,ôøóÇó~:äÎT‰ø:´¨EƳÅYÈ!cÉÂÅcaa@ÍGŽêÜŒh¨b‚‹¸*-jB—>
5‚”@÷•ù›hØ5i¨Gç4‘ß-i�¸¼gvŒˆ
¿à€ñ¼ŸND
#K@jŒæŠ³�€£¤#qvPÔ|ä˜d!FB‹UZÔ„.}
-$ÌO,zÊüMGrפa44ß±Ÿ˜hN“¼gu”„¿`ÿxÞ?AÂO_‡
-許Ã9g‰ÅÇ	%C�œˆ˜Ã[L\‡ÁLÓ´
-½™_ OHƒ?Eð—è~ù_
-qEä„êÿŸÉVrendstream
-endobj
-1375 0 obj <<
-/Type /Page
-/Contents 1376 0 R
-/Resources 1374 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
-/Annots [ 1378 0 R 1379 0 R 1380 0 R 1381 0 R 1382 0 R 1383 0 R 1384 0 R 1385 0 R 1386 0 R 1387 0 R ]
->> endobj
 1378 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [322.5463 736.902 391.2183 748.9617]
+/Rect [336.952 284.3584 405.624 296.4181]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
 1379 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [331.4327 706.0223 400.1047 718.082]
+/Rect [322.5463 253.1955 391.2183 265.2551]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
 1380 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [361.2812 675.1426 429.9532 687.2022]
+/Rect [331.4327 222.0326 400.1047 234.0922]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
 1381 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [259.4835 515.7582 328.1555 527.8178]
+/Rect [361.2812 190.8696 429.9532 202.9292]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1382 0 obj <<
+1368 0 obj <<
+/D [1366 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+466 0 obj <<
+/D [1366 0 R /XYZ 85.0394 726.6924 null]
+>> endobj
+1369 0 obj <<
+/D [1366 0 R /XYZ 85.0394 700.1172 null]
+>> endobj
+1365 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1385 0 obj <<
+/Length 2958      
+/Filter /FlateDecode
+>>
+stream
+xÚµ[ÛrÜ6}×WÌÛŽª2X\	àÑqd¯R;++µ[ç�šáHŒ)rv.R”¯ßÆuxí�].×€À!º8Ý
+ UõýíÅßß0¹ÐHg4[Ün[})„•"‹ÛͯËQt	=àåë÷ïÞ\¿ýåæÕ¥äËÛë÷ï.WTàå›ë^¹ÒÛ›W?ýôêærE” Ë×ÿxõóíÕ�kÊ|ß_¿ûÁÕh÷3ÑéÍÕ›«›«w¯¯.»ýñâê6ÚÒ¶—`fùïů¿áÅÌþñ#¦•X<ÃFDkºx¼à‚!Á5ÕŇ‹Å[­öÕ±ñãB!Ay#É�ÔL��2A’
+è*ß“É(bŒ©ƒ•uß>
+
+(BÒàz¶×ãþ’¨e‘‹�ãa~p¿åÖÿý¯¯÷›RpÐîl:÷}Ùyÿ5ÊMò+Ë2¤5#i‚µQÓ‹(cÖ¶Ù?çûM_®fˆR!ÒrhDn'~)Dq¦ºrßÛ`L,‹¼.ëûí©2ÏÜŽ§©·³f
+nÖLÓƒsS•»§¼™—M±?8LUŽvÉâ–¾Ãc
�IÏ–àXƒ@î/‰=A˜ôÚ¬óӡ𲢊UÓ|‚8êôn\ã6/+G(
+œ0Bº„Ê·ÇbS/�û
S&ž¬PÙ7Î4:—‚ÆûâxŒ¯Ô�«ÌëÃ3t	Ëñw¦"[>?”Õø”)żuàÝt8Ž�‚]ZÃ(<7§ÊËÏ«ªyö:¹šºÙ?æ•«
+Ãamk\]ð.*)lQ2ƒxï*‹Í4û	
+±òŸA	î{P‹úfpû�ÃÊŒ
ý‚#h(¹›ÀL®ý[¢9Ø(B¤˜ãæ©ØïËMák|Á°Ù•š­ÞWÍ�g¨ëR™0¦]\…ÆÒ¿hã@êÆWvź4st(k‡ÈÝ£�’Q¦tAjH#&4’4£ž­PÒßMÀH1šÅøl‰
+9¥(:ø
+~åk;«Íïu5»q²bœÏ4=ßñƸSÅ”Ë9K¦}†ÀVÎúL•ð™€êøÌñq·òÃÙ�è0Š‹%"jD‹nLÏ`�œõÔˆ¾ãÂ��"õ¦YŸ‹:î›Ö­ô¿çõf2‚—בˆ›)¨ži®`3¯O�t5=ÒeYä‰Û?í‘Ál’rhDng·È‘’šwå¾òÛ
œHQXò¶ù©:ºZ¯ØßîÑ‘À“°–ÏÊnBì¯_m7Em#Xø“´tzµ+Žy=´®OÉx.�>üÀ¾XjÝuÀ)F0&<xð¸—Â^T›ŒIßK]”0«”¥ÌíCX!ãÄÐÖù]UD·®â„K”e<èð˜̾t4% Ï‹½	�#}ÁR"dÐôPåOŘ=Â3ý™pŠÊpüV3Tn¡T(gç+»m<ÊÇb5Ìt8.•ÖÃcFÔèD
!�Èëêñu9)kúû)ådj‡eAº&'R;?cþ°ß©ÔŽì«d¶ŠŠšž…ˆšQdØ[2µÃ1¼ª˜œa`•``@�ÎY¹©FªiM"jD•.)’ÚLC[—oÄ–E}BtÇŠN³Pp'&Ù1:Å€Ÿ1Øï°� ª)MÏCDÍ(2ì-ÉB&5"xfEo�¦9@Óa£9‡QkD“¤4T¤ÃÀŒ@#0µ­É·ƒÞž‘�&°‰›¤ „b¸csŠ�
ž¶~Ðëçó�Ánë4"(­Å ¯4ù¸B°ë˜IÀ´Q	úÔtÀåCŒëU"jD—nTpöÅ=eþu2ŽSP›ÜvÜ.�-Å�tŒN®Ä>cý ×/` …½ƒñÜÔ,DÔŒÃÞÒ$„Ã*ã|f'ØF%HP.çt4©‹þ™†›¬ˆJ‹
 ±mK•Ù—o‹ý:t;+ߟeØmeYâ�J$)´Úª§nð~ÆÖa¿_pƒÇÇJ§Ç<¢æô–¤U⟹Âk£¦éQçZmŠ*ÞàŠ„¦*-=¢FÄwÓ	ÉIWþ×YYûVôD›€ªq6Í6ð"%ïšb[ÀϘ<ìw’mb¸Åp€=hrð#jF“aoiº™Ã 3É°6*A·€2w§»OÅ€hæ8»'¥z̈ÐÞñQp8¼w„^›±–<$§ ¤¾é›Œ€š˜÷‚òsî+ËúhSæIø|>Tût²¿áâÛ*“ï5eŸv„·Œ¹¶*¾þTìíÇ:?‹´yK@Êû:_ùD
Gš³þEïéœ
+Ræ–wýàj×y¿e°¿›Óã®Ø8¶ÃÁCaLz¯­LÿÈE±4w—aqž˜V–½¿hÄE|cS`ÝÏaG’Å¡9_ÉM2ŽåÏDÌ6jšseÍ*ïWOyUnÊãËʤýÓ0ÅmÒ+œ«’jDÔˆý$‡šŽ_gC8iÍ0
C™æ‰CJBLl[’LÀxüŒéÃ~?ÅæೂÍP!€fôô•\®	xVsù—6*A¾€r>´ŽŠ‡æ´_ﮨ¹d’3JDÔˆݸ§‘=-¾Îq–žéO$ˆ‡•9“Ž¹)âüŒáÃ~?ûÜË$7÷}"=5§È ·$õ`ÃkÔLú¹š&^
+3СK8Ž¸96·”ø:kl”>ã@4Ö‰kðL¸jY›$œG'íî÷ùtã0k°'N}Ä$Uè÷4ε�ŒÈ|Å?"
þûƒÙ_þc�ó_RÀ�)E'ò	b™‚N¼RFqɇ^‚aógå¡êÿXÔ€9endstream
+endobj
+1384 0 obj <<
+/Type /Page
+/Contents 1385 0 R
+/Resources 1383 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1382 0 R
+/Annots [ 1387 0 R 1388 0 R 1389 0 R 1390 0 R 1391 0 R 1392 0 R 1393 0 R 1394 0 R 1395 0 R 1396 0 R 1397 0 R ]
+>> endobj
+1387 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [387.5019 215.9139 456.1739 227.9736]
+/Rect [231.137 736.902 299.809 748.9617]
 /Subtype /Link
-/A << /S /GoTo /D (zone_transfers) >>
+/A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1383 0 obj <<
+1388 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [381.9629 185.0342 450.6349 197.0938]
+/Rect [359.1555 437.0578 427.8275 449.1174]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1384 0 obj <<
+1389 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [398.5803 154.1545 467.2523 166.2141]
+/Rect [353.6164 406.178 422.2884 418.2377]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1385 0 obj <<
+1390 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [393.0412 123.2747 461.7132 135.3344]
+/Rect [370.2338 375.2983 438.9058 387.358]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1386 0 obj <<
+1391 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [255.0796 92.395 323.7516 104.4547]
+/Rect [364.6948 344.4186 433.3668 356.4782]
 /Subtype /Link
-/A << /S /GoTo /D (boolean_options) >>
+/A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1387 0 obj <<
+1392 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [311.5276 61.5153 385.1809 73.5749]
+/Rect [226.7331 313.5389 295.4051 325.5985]
 /Subtype /Link
-/A << /S /GoTo /D (tuning) >>
->> endobj
-1377 0 obj <<
-/D [1375 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-1374 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >>
-/ProcSet [ /PDF /Text ]
->> endobj
-1391 0 obj <<
-/Length 3018      
-/Filter /FlateDecode
->>
-stream
-xÚµ[Ksã6¾ûWè(WEžX{šL<³Nm&Y�S{Hr`$Êf�D:$eGùõÛ`ƒŸ Sq*5!~lôãC ÚlEá?¶R‰b¯t,‰¢L­¶Ç+ºz€g¯˜ÃlZЦ‹úæþêëB¯bG<ZÝï;²¡Æ°ÕýîçuD8¹	týþ‡On?þt÷îZËõýퟮ7\Ñõ‡ÛÿÜ`ëãÝ»ï¿ww½aF±õû¿ûñþæENÆ7·Ÿ¾Åž/3Bïn>ÜÜÝ|zsýëýwW7÷Þ–®½Œ
-kÈïW?ÿJW;0û»+JDlÔên(aqÌWÇ+©QRˆ¶çpõùê¿^`çióê”ÿ¤2Dq�'‘’ñi/3¢�–ŒÐ•k¼ÌÙ”—[”õòÓé·/éyhl̈Šøª+o4ªÃL*:ƒÆ‘5Rö½ÍÁÙàvh™¯àjغ~Ì*ì)žê¬p¸—Äufy�æ»tgïÔz_”Ø]=¥ÛlÎò¼Oð¶²-¶ÿ,òß²æ6]þõç´Ì~¡”o“Ë�ÅÑUö�'ëŸÕ†IKa ÁH¬ol©Oå53ëÔjÈ­†xýöÓçÏ7ï±me4:sÔÃA_S®� • 0¼9É®}oß<(Žx·Ëª/@lAYëCèŒÝ³¢ /jlX÷ç‹2ÉEikm-‰׸
-¶ð°õ#©¯' à°s "
-k1’dŸ´H¨\8òvQóüó(;â©J7¯Í‚–5üTÆ£&´éq0ªRÎûê¼ÍB¼`ÔPHŒ™hž†kgÏð[ü‚Ær_ÏD	ìa"Š´ ÆHV˜‰%±Öz�‰T€‰-ÊŽ˜u¶?Ïq�A€—FoA£÷όıýáß&ý�ŒŒqb˜Ð³Tãp(¦öcOׄ
-ÈLJE}…ÞfG·hÖðd¡‰	,„ýäÚ7<x²pøŒåÎ~ZYŽak
-Ù(�ZÐd,Í“oàß��’(&m�ø*·äZ=¹$6£”Òõ·ç<96eD`ÃOO»¤vAü±8dÛlr/CAI8@Š{JW£#£¦F.Õéé©(k[–!Õº~)°;9@„ó¤ÎžSì8¦õc±«ð¦)I‚ëC™äuvÍÖM¹tlYš×…ƒF™=<Ö®¯À�žÒÒ;wÞ.¸95vU]8¨Ó¯â¾àÆ�l¶EnéøàŠ‰\½ÆoçPq£À€ˆÿíùP¼lpô™o/T¶l¶eHa·dwî;b#jódc3¹ð+Øšø¯9X>âÌq…MO–³Ïéá|ÍCÞØh
-bbÈBÌÀû9u?maL´P¯´¯Ù†Þ’S•b!ÐKQ~©:5A¶Q%ÇöirÆFâ0¶HFÐhý„F<gÅÉ=yNËÊ–Èà�å�½ZFlÞÖxmhå`à€›-¹7Ø+S˜&ýj 6«
½ŽYUù	ß–	�:“&ÉÏ]oo±œlç³`”7OV
YOP
-Š±ßùëI")�aáB¬›J*¸æé‹ë°z	ÞNqè‰ñ‚5s¶a)à^;¾¾î°ÌiŽÏ°Ú	ú`NÕXêw@ÁÖ:Á£—ǤÆÖe¶ZùN$òV§\‹]H˜îl¼¹X¿³þSë*µÂ”«t„kymÖ§ö)4T¹ÒJ«hºk¦Ij@êI½€M“¦”ì"Ãug¬´äj,ñù.ͳÔõ]¨ã:ö-
-ë6;¯yN$'Ë+À($Ÿ‘XÔ÷è³�ë<c'
-·�t½¨Xg5h	¾“LÚZ¿†,Ä%‰ú!�b~?¥U�A±*ypO3§¤¯…ö/TÑúõ¡]YårTV·Óa{8íÚ*Ì‹§iSû
-—ûÏ·ݤr ÃAálj
-Úþ¯“Ì9àÜŸž—J<«¾�U„6ÿû=Nmƒš[âu§©KžwŽk‘î½ÂM‡p¶#Âé¹õ„	B£ËÏHË3[KÖ.(®(„_ÍÜÔí+Ëo~8c÷1Mò,ØŸx�\µð ÐÀ›B_;å"¶þŸ­ôÅb
ç-ªâq�0
¶´šª×[Õ­ºL�<Ë­ÈñM·ËC¬­±BBu	Þ^–ö¶¢:Ó3S‰·h¶™‹‡½°?û,¯ƒ,Š¦ulj¬-¯
-14¼ïÁŽaÖçZϬÊÀÞÐ/¸¯aK¬ã	½4où Å:ý#±<¯°gtûÙaÁ{ìKðÖ%ƒu³‰}£À­Ô6EX²Û9»*dn[Ù�|⶘÷>¾tHŸ뎙?d€-¯ý냉­6üs®ýÛäpù©‰0fîÈ
-ÓB┲Fh9>/ÂéJD|Bõÿ1Ýnendstream
-endobj
-1390 0 obj <<
-/Type /Page
-/Contents 1391 0 R
-/Resources 1389 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
-/Annots [ 1393 0 R 1394 0 R 1395 0 R 1396 0 R 1397 0 R 1398 0 R 1399 0 R 1400 0 R 1401 0 R 1402 0 R 1403 0 R 1404 0 R 1405 0 R ]
+/A << /S /GoTo /D (boolean_options) >>
 >> endobj
 1393 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [352.879 640.3349 426.5323 652.3945]
+/Rect [283.1811 282.6591 356.8344 294.7188]
 /Subtype /Link
 /A << /S /GoTo /D (tuning) >>
 >> endobj
 1394 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [307.1508 609.8077 375.8228 621.8674]
+/Rect [352.879 154.1545 426.5323 166.2141]
 /Subtype /Link
-/A << /S /GoTo /D (zone_transfers) >>
+/A << /S /GoTo /D (tuning) >>
 >> endobj
 1395 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [334.8268 579.2806 403.4988 591.3402]
+/Rect [307.1508 123.2747 375.8228 135.3344]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
 1396 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [337.0185 548.7534 405.6905 560.8131]
+/Rect [334.8268 92.395 403.4988 104.4547]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
 1397 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [364.6945 518.2263 433.3665 530.2859]
+/Rect [337.0185 61.5153 405.6905 73.5749]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1398 0 obj <<
+1386 0 obj <<
+/D [1384 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1383 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1400 0 obj <<
+/Length 3140      
+/Filter /FlateDecode
+>>
+stream
+xÚµZÝ“Û¶¿¿B�º€Ú''9»N;=_¦ÓIò@KÔk‰¼ˆÔ�•éß],ñKäuâNÆ!¸X,v¿ý
+ÈÅ�gŒ0]þ�/¹	äe-&P§,J,;ÆN¡®áŸ1{(÷åYNh–DÚLû?pÍ(2”6�º(Âeu-®	Ô5\¸ã>/V‡l{Ȫ‡U�ï³Wä„}úe”ì¸ëÃiÈÛ‡Á
+èÈL›¸Flè·LVª¨k„ƒ­°¶8èÀ	#…¶ÔÜDŦ
+iÃ?£âPnb¨Œ‡˜Ð}�àjÂt"ä´³׌&Ci“Ó6b‘†`cm®Ë\.¼¿l©ëÙÊýj“oñ:¡¬XgÕ°±ãLE<™V'p�èÓ½ch¦àÆÔÑçëôu³Võo	3I4qÉ:PÓ±{ò’áùg<0”{)ã‰A„À½SÄq4}�kF‘¡´i4Bc"“™»n‹i‹ž	·ûœ�à¨`}y8�5u6âjrïÀ4ܼßÒY®½û×)¯ú�„
E2ÑÑEˆˆ¨mædCçÙ§
H½
+TˆÍ6.PbP’Oì
+p±;yŸ¥E^Üo�;z'¬âÝ;ÊFØÈX,ÿù�Ÿ"1PÓ\%é¥ÐÓðï¿\¿Ü2+uÃ]ÕÀ¼‡ÃClÅoIS*˜@[­&@µ8Rz=÷Ô·p@Ì”™ôJf›K')hÜÅ‹¡ˆãqÝ)�Ä•s¡„N?ÁïŒí×2}ž$ê€6,â¡â¾-6±#z%Qƒ‡D.³/)â¼":E�Ct ó–h)½údð—v6Á%5SëŒØÒÍÆÛUCî÷(ÊÚã)’PØlÔÅ-ÚeO)ºc´Hæ>u4χò¹“?Z™CÙ•ªüÜÍïÊòsõgr™´½Þ×2cú~…çzC#í*
+•“&J-Ù²¡1%6%=·Çƒ¯°¢Õ
+,‘‘킺rWè&.tÒ.Ë.wDN]@Ö’HîûôcÃê<s�jÓeFÂÅñnÔ£ S±Šæ]Š¿Ê1±¸¶ÛݵÔÀûlJ	Œ’Ð\M\ývLw­4ž)÷©û°å?º@Sh4þT£Ã½OŒ[#,4–¡ƒ	|Ü!FŒá¾¤ã'Lz<¥;ÈcÍ�LÊà:—Þ†;adž¿�%¦W#b³F4˜`9ÇcJKèOM4'ªÙË£p3	3ø÷âJª²Ýö¢iê‘æ�©#˜QRAþ³ÐfDb¤Àçá�(Íœ5qð·!¦ðKbh‹¥}Éo—¥2,áÉ…ß.ãÏ‘•0pc‰™–|ôÇ
+ðχûþ©ôùwä`©4æÒ—zƒl²�š�,Ê3Éð§Ò0m¢3[KùÿÿÞY[endstream
+endobj
+1399 0 obj <<
+/Type /Page
+/Contents 1400 0 R
+/Resources 1398 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1382 0 R
+/Annots [ 1402 0 R 1403 0 R 1404 0 R 1405 0 R 1406 0 R 1407 0 R 1408 0 R 1409 0 R 1410 0 R ]
+>> endobj
+1402 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [374.6372 487.6992 443.3092 499.7588]
+/Rect [393.041 737.8938 461.713 749.9535]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1399 0 obj <<
+1403 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [292.0276 457.172 360.6996 469.2317]
+/Rect [402.9837 708.0059 471.6557 720.0656]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1400 0 obj <<
+1404 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [319.7036 426.6449 388.3756 438.7045]
+/Rect [320.374 678.118 389.046 690.1776]
 /Subtype /Link
 /A << /S /GoTo /D (zone_transfers) >>
 >> endobj
-1401 0 obj <<
+1405 0 obj <<
+/Type /Annot
+/Border[0 0 0]/H/I/C[1 0 0]
+/Rect [348.05 648.2301 416.722 660.2897]
+/Subtype /Link
+/A << /S /GoTo /D (zone_transfers) >>
+>> endobj
+1406 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [460.1655 396.1178 533.2211 408.1774]
+/Rect [488.512 618.3422 561.5676 630.4018]
 /Subtype /Link
 /A << /S /GoTo /D (tuning) >>
 >> endobj
-1402 0 obj <<
+1407 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [362.144 365.5906 430.816 377.6502]
+/Rect [390.4905 588.4542 459.1625 600.5139]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1403 0 obj <<
+1408 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [293.1435 335.0635 354.3435 347.1231]
+/Rect [321.49 558.5663 382.69 570.626]
 /Subtype /Link
 /A << /S /GoTo /D (options) >>
 >> endobj
-1404 0 obj <<
+1409 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [288.6803 304.5363 357.3523 316.596]
+/Rect [317.0267 528.6784 385.6987 540.738]
 /Subtype /Link
 /A << /S /GoTo /D (boolean_options) >>
 >> endobj
-1405 0 obj <<
+1410 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [328.5503 274.0092 402.2036 286.0688]
+/Rect [356.8967 498.7905 430.5501 510.8501]
 /Subtype /Link
 /A << /S /GoTo /D (tuning) >>
 >> endobj
-1392 0 obj <<
-/D [1390 0 R /XYZ 56.6929 794.5015 null]
+1401 0 obj <<
+/D [1399 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 470 0 obj <<
-/D [1390 0 R /XYZ 56.6929 258.3212 null]
+/D [1399 0 R /XYZ 85.0394 484.6014 null]
 >> endobj
 1051 0 obj <<
-/D [1390 0 R /XYZ 56.6929 232.6002 null]
->> endobj
-1389 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R >>
-/ProcSet [ /PDF /Text ]
->> endobj
-1408 0 obj <<
-/Length 2918      
-/Filter /FlateDecode
->>
-stream
-xÚÅZÝsÛ¸÷_¡G¹c¡ø$Á¾årNê¶ã´²o:÷õ@S´Å†"u"Ç3ý㻋ø!QQrÉMG
-f­‡Î.�D6:öýµ Éü\]Q[׉ �Lºö¸k·�
‘‹Šˆi–Õn¹«”6Úž‹v=Á…à8àäEAÕNì�5„Uªõ>n÷´f›g…ã¾òG´šèL5/ëæŽY¢À&ПPa2Ô€ÌåU–R§^aG@Iéó¹(WacÕë�†àóÛz·IïBˆù�kÉÒ ã]MòxÐtwóv<?Иpg+&4ý>‡õ)žÌ÷
ê
kmMb!ä<ù»NÛªÐÛçM‹øÿÛÁÛR*îÿ~ý#Õò�Ù:­žüPwÚqŠ‡üRÌÝ ø8�
-'ÑbÊ—Ú¤Á«®½}qžæ‚®¾BÂZƵÔßBƒ½ùVR†ÙÈ|	*È“Ò°ç1TÏ@H'–I�ÄO_Q‡š<° ¯ñeÇÌ{‚*¢ËΙS|;gˆÎ™ÃÊØ™CÊÀ™[¨$î‚AP
¨=ŠÝxrÀåÀ ê¡A„o¡æ=féÁ�==ø‘Ø�ØCz_Á1˜€>ø/…7š�àÇPv•áROãq¸Ñ_ž�V±ÈF_ñ0â$•�7ɹ+PG’©8Ÿrt¦¬™Hî¹H¢~C±…6kN¹ØNÛ…$¿¡Hì6é#Þ¾îfoŒ”Ô�I}ÂE	ƒ+-þׂ�¨Cƒ^„<qò
-³<:þ	ɸåö³‚Y4Ô>P"L¹	ñ]‡ªãw9å@u¼ßIÄ,�p#Á&‚9A~šÜr“€9Ò`˜§cÌSoŽÓ¦ÍwEóžžÇÇ/�ÁÝÍÒ&?m™‡&ïëÌèêl*õ…NÎ9›*¶,Jxr&xœt5£QFÃ?WGø6¸)ÊtGD@ûĆ–¨.È>ù‚—DÁ€ä³|ÛÒí:m‰{çû©ëljل°¨ÿßg/²9eã㞇|+}*ƒ=ø¶q‰þ¦PQp‡)kÏA‚øÎá¹G�)¬(>ô̸÷¦ ì°‚ÓX
gßtÏ‘§±’Àb°âx:¬`­®Ê?é
-5!5Kb£žOƒµ‹6:Ì|>R[ð­�Òç9ÿO.#ƒŽZ20—É0áz”x…ë†Y™Ä˜^Œ tÑúÓ‰W+ð.4%^oºZö¼¹úTYÀ´�_Aú|“‹õ‰¥Ç—Qšwò-–Ï}ïêý“ël!œ	+—h‰	e7�t?º¤¢Š»T�ú$"Ð!Ø(‹¬hÝKõø>Åõ«.W¤†ïÜjàHc)½‚0MÜÛ[ /—w7o¯ˆ~{wEÄ»w¯<‰R @º½»~͈v™ð¹ã6™•|	OþMá0=÷ðÒ¿N\ùgˆ*+÷«î‰â)õ«Û±ð¸å�p”
¢OŠ~yО
-$…ËhCÕb�!ÿàÒ¹$ï„kçO7ºŒ’P·u›‡T�»ª0ËGo/.¯éÓm›o¶í8“·IW>�çžÙ4f›Ë¼õ4ZŠ¶>ÁR¬�gØ4uVø——XùÖ´Ï+v9Ä<pêRÔºOQOEEë<{6è1¼ìäô
-LÄDLþZÄ„gœóùOνv)ʼ¤r#á‹"¸ýP&üà‚£@|™7õ~—åáD\5ýk¸«øÙà­ó‡Æ
-endobj
-1407 0 obj <<
-/Type /Page
-/Contents 1408 0 R
-/Resources 1406 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
->> endobj
-1409 0 obj <<
-/D [1407 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-1410 0 obj <<
-/D [1407 0 R /XYZ 85.0394 566.7855 null]
+/D [1399 0 R /XYZ 85.0394 459.8194 null]
 >> endobj
 1411 0 obj <<
-/D [1407 0 R /XYZ 85.0394 554.8303 null]
->> endobj
-474 0 obj <<
-/D [1407 0 R /XYZ 85.0394 184.6798 null]
+/D [1399 0 R /XYZ 85.0394 84.3175 null]
 >> endobj
 1412 0 obj <<
-/D [1407 0 R /XYZ 85.0394 145.5857 null]
->> endobj
-478 0 obj <<
-/D [1407 0 R /XYZ 85.0394 145.5857 null]
->> endobj
-899 0 obj <<
-/D [1407 0 R /XYZ 85.0394 108.7415 null]
+/D [1399 0 R /XYZ 85.0394 72.3624 null]
 >> endobj
-1406 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F21 658 0 R >>
+1398 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1415 0 obj <<
-/Length 3250      
+/Length 3076      
 /Filter /FlateDecode
 >>
 stream
-xÚÍksÛ6ò»…>Ò3O¸ûäú‘¸M�œåÌÜ]Û´DÇœJ¤N¤â¸¿þv±€DÊz¤ggêv&\.°ï]ÀbÀá10)K�tƒÌif¸0ƒñìˆ>÷·G"Ð#Ñ°KõÃÍÑß.T6pÌ¥2ÜÜu沌[+7“_’”)v3ðä?®Î�‡Òðäâò=@Bi#“Ów'oίéCH¸¼:#Œ£Ç釫‹Ë·Ÿ®OŽ3�Ü\~¸"ôõùÅùõùÕéùño7?�߬–ÜÝ–à
-×ûߣ_~ãƒ	ìîÇ#Δ³fð
-	óÒÛõuƒ*œÄ÷6BæPûeN
-üîŽ#€Äæüª�¼v´xVu@4åçÊsœW
•W“@T“
râ³Kæ�_Å⋧�߸}´AS`nüºh¼ØôŠÃÓ®Žëoïa+[†ì„%K-îQm‹2DÄÙÕˆê]ýPÀ¬hÔ0±YÒÔ †êsäl9mËù4÷¼’�'ˆ˜‹YÙzÑâë.¿×󶜕-ð”ËŠ°	?¶¢,¾æ3˜ÿͶ�´5a3/ÆåÝ#½´÷yKPN�®úà{Uä‹Û@Lì$ø6˜t»(ýz
D!.š–‘4FE±éÌ”PÌ
-XNjSf3.Ñ­ÐÇÅç

×?´¢v�ê:�§óâ~GÅ80Ì;dÉDÊ„z²&k˜ÎÒÞ’ž8ÄHth68Mûë@mÞøQÍ3Ú÷­|ˆä~þɬ;¹ Ÿ,(³ÌYm÷³aEuh!OfÕ�?j)™t‚°
-0Ë´þ–Xª´eÏ6béÿ7*.¤c–;W@ã8ÌÀ8¢?Õpµ©aªØ€Û!!@�m6H5<¹!ž×U´fr™Òºl-‰|;ß
z@?‰Žþ#Š!d>e�Û]½¬&쉞™Œiáp!ëå>�Èl¼ ”R1·7Gz2e±›«¨£Üº\UŠiÃSr³�s`IªS“œ ÷\šÕ’ÔOg‘oË–>|ɧ˂Ààˆ�Àûç˜ÝЧHã§FoÝO$“¡71«ˆQ½x½i64 šÎAu8ð<®®¥3f%ÏþÄ”qÄNA™Œcª~Hý�ÞhN‰êÍÍ{�“q<¨|ì,gÅâ¤H†ÓòK@z^g‘×™
Ug„¹¹÷Ú(/®é„Йӫ’Aà€*«¶øì�éªmâ"g¹¬Jï
e§øl@ZÕć|Hâ|Ž„è2�Íå,_”ÓGz]ú¡Û€é¥?„c®¶%w°U”ŠdytA ¥„JËÀ/@y"0)šñ¢¼õ¯÷õ<™Ö>J}vJ“Äy+n‹m¹ŠÿÙIÌ4îê®Ë)CÂÒÜ×Ë餟�LÊfœ‡Ìt�Rwµåyø]½�Ñ«³ì€÷1©`™pä}ÆS(@­•ÖÁý¸®û±÷ãÖîÇ®Ü�Û¨®ð[N(ã®Ûz\O	s—ÏPßvúœ:D—²jÚ¼Šžg#¢w§Ý#±+^Ê
�~Q‰ar“fæ€Ä(w䆮Ϩ€ÿ@Ù«]ªC•h嶢°“¼ÍÁ3nÖ”T&ì‹1+ÈcÅ
ùòžJú•RÔí®¨©g:Æؽ†Á Ñ©&|ù¶Gx®¼”ðÖí‹¿"‡©c*á‚#g<ë÷QžäÍòamðU;Í2ÇwèGì§@©Á¬É62ã»z:­¨¦\ç¹ÔKÑÝö•Å%[Xù*ÙÖq
)Ò@�\B9‰]³;‰ÖàtR§³¿0‰þWƒaf–JƒÝæ‹-4±+vªÒL§¾c%D¾¦%(ŸL‚õúNŠtÉeE_È,
¸¼¢§7©7Ôxi}N�XzjßA�טFø�·üp¦·ðYΓè�ƒ|/N	
-B`nt›7¡CÇÙ+ÅŽjÍñ=Ú¶é!$V»¥ÐÙÞ+v°ÊhÆÝ¡
-[Á®Rlýy)|„òÐ%’“¾]óžúfZ®ZÇ›l_;a¨Ìwúa%ä>.w–ÿR~ø{pYK&´:ÀdmX&CÅwz~}¥ü�/xò®žNš^�5)?—mt°ãbцӖ¶8à€Ù‘·`(vo׋~Ž<%,“JqJ…î°çíÕÉÏçÀ¤TCöÖ¯‹¡Z[5„Àk×U9ö<|h–f¡MïÕ±#4-sï[¬îqHÊ@‚ê¼Å³�[ÛŸ©u7øŠ[u2ã°ÞC~ÈmªiÛgAØv]̧ù˜ZYÒ‚ŽR4[÷«
"
-OÖ#·áWùG]­ýþp·¦ï—•æjO^ÙåÂ+nÖI)!c‚­„È'”
-žh„5�4=A	LD8ƒ—Lî	B£ÀgNQ†ˆò2ôß:2D"’áj”YÉa”áNyõäú,áu¸ò²é¨xÉDI
-ÎR¼£´_xB3Ø¥£o?~áí ¨‹F½3¶®çú<­oc²4¯›+‡x£a9/ Þ,šb²:›¶øþÃéŽv–ú²ùÑ‹šƒ°)d•Æà(÷½\Ê=ß]^]|
-+7ó#‘žpúñ
T¬ƒÙ  N©D8¥tØ
-`#©ka°‡H¤²×¶(0;’™�Ìãž0ö—ÀÝ�¾”@¾C“LÈö{@Pgj�:ÏØ�AýÀ®”wïøˆA
aü·î?xWüÖ£|0G
+xÚÍZÝsãÆ
÷_¡Gºcm¸$—}»Üù’Ëd|­¬L§ùx ¤µÅ†"‘:Ÿû×X`)J–,_}™v<c.±Ø/à,
+©=k#,¬ÿ’eµ±"‹³ËÆ£±Ò"—±9=�‹a.nÒ}0ÕXƹ�ðÔ¨‘)™ïÔ˜Ô(e"ŒÍFY"…JAèƺX9ò7ï•ðf±È•ÆÕ‘éús1ïÆ«¢›//Ç:ÓQëVEÝ•óôšÚ8š.Ë–z6—6ÚVŽ^üÇ=KWcËDÝ’ûÃâ()Ež$ʯ7se}OHØ®Eçô‚‹øçÂáêEE¯]ÃOœó¦î€ƒ¹›»]·?i2<©’(
cù¨'ä¡R
(`ž_ãX¹j!Ái’L™ƒ„zx�nEl.ÀEU¸ÀÑ­”鸨LèDôv;[4«¢¬Ïb† ¡¹ƒ¾ô�À‚¶Xu’äï[=ä2
+Óôð;C‘ß&#àŠ›
+˜VÎ…!F1/DŠŽ‡QYÌ‘<{¤àËq¤@œŸ$æ,Rr8ê
Rüœ)Øjêê‘`Æ÷ÃÌX*#ò,ÑûNü¨ö‰F�˜—ãd €¯…“]må¿«š¼®Ö"!*ÒÈh¬`CJçÃ"Ï“b�Ê,@@3N
+B´¡É„c?�.H@¯Ã·§ìS$©H+¹R)L%À]G·`ÀŽ¨´[°ÞÎÀ}�¯”`�ß1<éÈÐGV	vˆÅC¤×î�¦˜Lx©eñ‰§Ÿ¹°!ÊLرqD½¾ËÕºr+`î‹ÞõAÉæÝÍ­è
°°óÅ{á!¹*¾ï=`÷p¢
¢rðAGöˆ=ͳ`{ƒ^Çö¶9Œ³¡Zê+˜¥Y8Ô
d�פ8&R‹²Í{ë:šÐë(.hR@-kp
«"à]©àS±Ó;~l̘ýß㥔2Ç€6]rjM‹CÃ/nä±ÅM<\œ“ö�GÄwòˆ¾‡ëbÓ•ó-… Föµ¾PÀ¢ôjÝ´a‚°~ë`dÑ1/€Ë8 Ééñr[™ÛÐý@"̼Рµ‘¥Ê8È:ç09µ0¡-ïk¯L¸ž˜äA왜[°“œóhÍòr›OžGÒëy)è© wÓ^QÍ(H¸К°ÿnyXâ 8£8Ñ—Æä|T.šØÒ÷àéðNÍL„·‘Ì¢¶ÙðÕ1¹ÚV]¹®x¸—•b™ aí6«²#‹…Wº‘psë’Š3
+<çvƒ*ly±žÓ}.Ði,øý½
+›@êê]øC¬™k¨¢š^‡ÙèÙÕt÷¢‰ÉdÿÛú]³­Ÿ)·û:–‘¾ê/!¤�œ?ÉÎ55Âæ–€LeøÔ¤Iô…—§‘«çƒ <ó$’éxVvÔñ©¨¶Žšì‡�a—9¶¡+ðø©‘ÇÅ°‹TBŸ¯­&9íy¬f?™yFO;
|­*ŽÉ„Uñ—LFœVS,E¢S}FO�‘�š8�™þˆ_cò˜
Ÿ�4Ë•Ã-)£qU~b¢uD�%
+rÀ´6†]O>t=vàzò�ë±½ëÉ+ì+¨ƒ‚í¦kæME”»b…`;‰àþ2uÛuð:—ùpÚg~ÃÒËáu’5q,2•¢‚(ˆ*Ó‡!NÜß2¯þEàîW‘
 endobj
 1414 0 obj <<
 /Type /Page
 /Contents 1415 0 R
 /Resources 1413 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
-/Annots [ 1418 0 R 1419 0 R ]
+/Parent 1382 0 R
+/Annots [ 1419 0 R 1420 0 R ]
 >> endobj
-1418 0 obj <<
+1419 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [312.8189 683.0645 386.4723 695.1242]
+/Rect [312.8189 214.5127 386.4723 226.5723]
 /Subtype /Link
 /A << /S /GoTo /D (the_sortlist_statement) >>
 >> endobj
-1419 0 obj <<
+1420 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[1 0 0]
-/Rect [406.3277 683.0645 479.981 695.1242]
+/Rect [406.3277 214.5127 479.981 226.5723]
 /Subtype /Link
 /A << /S /GoTo /D (rrset_ordering) >>
 >> endobj
 1416 0 obj <<
 /D [1414 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-482 0 obj <<
-/D [1414 0 R /XYZ 56.6929 769.5949 null]
+474 0 obj <<
+/D [1414 0 R /XYZ 56.6929 424.823 null]
 >> endobj
 1417 0 obj <<
-/D [1414 0 R /XYZ 56.6929 752.4444 null]
+/D [1414 0 R /XYZ 56.6929 392.7174 null]
 >> endobj
-1420 0 obj <<
-/D [1414 0 R /XYZ 56.6929 666.1281 null]
+478 0 obj <<
+/D [1414 0 R /XYZ 56.6929 392.7174 null]
+>> endobj
+899 0 obj <<
+/D [1414 0 R /XYZ 56.6929 362.8617 null]
+>> endobj
+482 0 obj <<
+/D [1414 0 R /XYZ 56.6929 306.2038 null]
+>> endobj
+1418 0 obj <<
+/D [1414 0 R /XYZ 56.6929 283.8925 null]
 >> endobj
 1421 0 obj <<
-/D [1414 0 R /XYZ 56.6929 654.1729 null]
+/D [1414 0 R /XYZ 56.6929 197.5762 null]
 >> endobj
 1422 0 obj <<
-/D [1414 0 R /XYZ 56.6929 474.0484 null]
->> endobj
-1423 0 obj <<
-/D [1414 0 R /XYZ 56.6929 462.0932 null]
+/D [1414 0 R /XYZ 56.6929 185.621 null]
 >> endobj
 1413 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
+/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F53 962 0 R /F21 658 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1426 0 obj <<
-/Length 3051      
+1425 0 obj <<
+/Length 2926      
 /Filter /FlateDecode
 >>
 stream
-xÚíZÝsÛ6÷_¡·Ò3‹O¼>¹ŽÝ¸M�œ¬^3×ö�i‹WIÔ‰”�Ü_»X€¢}$�2—‡ÏX‹%
-D+9‹^õxYŽŠœ:”s¯ŒsÝ\-R®ãm¡+�ºIÑë®õóö/•�%ØHÂw8¥H•ŠYÊô1‘*'Æ�9ßÝ_¾
‰›D—$ŠyÑ<WË?©Q˧r=uÝ‘ò–|AžÛ"òå†%äÛYø©ä+dœô”¦#öËW@OËÄ1ùJØ–à©—ïy?á‰�†”¢4­¹fMùäYs²e PÞ`»Ž~¨a£&Í«YVÎQêLoX5t‘ƒxA”(ì‹”¼V“‡Ì¼³¿Ï“ÙZ
`kV°Oñœ0b¯#b©Ó£f°œ'^
× e•�~©Qd°Bg¥øûâî�ÊššME¿u1^-Ϲ�Šéû0 /ÇYSø~“¬!j0ðCŸËfBT¶SÂ-¦zž£Ž•à^óJ·ädô3.–MF<Ñöâ‘mOÙ”øyåg©"ŠweÝlχë`›ñŸjŽ›Ð	¬3'¢³7h=ÓÞ€è·y¿(p—,˜¤Bü5êbî8³¥©é×-ª¿¹D9ô16x$X†à¯ö›p×6>ÏÞÖ&'�1Ÿtø…ûM˜‹X[yìðKp¯”ùHòvHAqé-XÙ””lƒÍ7Í—z»~NÅH9óE‚Ì©ÿ›ïG›oª‚ù*%¼n�é,7•ÄúÇrŽ{F.iê;jлÓl�ÞÓ/Å+?ÍŽW·!ë#½PÜ�Àß5ÇÏ3ñíóW�òüÕÖp‘ò˜×0îMÅ
F�Èá�Tª…‡®A¡^�®+8d=s‘-¢ªßmRA0ÑdÕHÕP ÂxÐö‹¢¿ßsëèðáÜÝü©ç/€‘t¢`½ÇT¤-¼ƒ)K*z	4zãü¡z*stUaM4Ëð2ß
2-Š95Hl@X!ˆp±
-2Ã,i¹£¶iÚqGȲ[¼Žô–/"+ø"Ò(‘B±€Ä- Üš�)¹Þ™’ÈÄ'>\ Ë�`µqâÚ’G£UCꦜN©Ï
-W´ÃÈ®AÝ0ëïL3ÿøÑ�]¯
ª¯2ÍóP““ü€ÕtÔq*«ù‡.ä009?f42‰­Pî__b¢aã6×+gL8@døú­‡RÝIü@¿u¡ähãA[ 圻¢¨Ù,Šñø»'Æ“†#ÔÎV¿âsU¦F³ä˜F %J¥ t?8×:ú&‰Ú„B2
�9ªœ›$6z.œ—
-;²ùŠS7	TÂÕ1\*µŒ9Ä('Ì·B#öÐ�*�*Wˆ[VRy~ßÆØ©u¤‚Æ6"4,ÝB„9�>»»=•RÖלÇîMqŒafëÞô¯�
-áIKJƒ3°îæ}ë÷®’
©é¡Ç`{ô.…E*bÁ4Å¿‰¿¬{¨¦Óê“ó·7ª{±�(X¤Uð62žf¨aê·ñ‘ÆÎ
-ßÏÁ‰6”ÖAÖp9¸`½“T‹�ñjIÍy3õwµOٴܲ‘&l
-e1`•®
-~\bÄ–¿Œs“‡áþ­ƒALÄMåg.ÞeðÚ¿s–Íßïº;õ_Û€R t·Kšî¦çÙÔEjxˆ‹#ª!_(¨Ÿ‹¶À�dõ„85t°ÑjŠxu;�?ñC;oÆ+ú ö÷V*O(•±š®ä‘»†)¨1¯r‡ÄWN#;6G+ÀœˆêÍŠ»+p¡„eM¬5.S¡¦šÞ¹H½'E–»CÂ=Ð/ÐqÁJ`ôôpø
-ËÔÏçƒ8¼ôoãUPݸëul“P C†ù"-/ÌE‚Pî#ì‚¡%Ãk¤…ì}7xAZâ¿K¿ž�l·ÖÔ[s^
¨lÛ>Û
rGEûÉJRœ¸]ž…$á�ÕÌŠŒ4�57gÂ&Ü'¤GWã›æÔpîO3ß»œùîÓrV6Ät‘~'Õ³VÑ[è`AŽûô
ÚãÌ÷ùiþ,~–r¾ñ¦q6žàEv
+xÚí[[S9~çWø±©Š5º_vŸ—„™a�TÍîÌ<4v]1nÖÝ@2¿~ÏÑQÛm»“ÅÔò°IUt¤–dé;wIÅÀÆUÐ43\˜Áèv‡®áÛ»‘úÛNÃn¯·;?)7,XiW�¹<ãÞ‹ÁÅø÷lÿýÞéÅáÙîPžY¶;4–go�O¨%P±ÿñäèøݧ³½]§³‹ã�'Ô|vxtxvx²¸;J	¨4Å¿>žR§£ã‡»^ü¼sx1_rw[‚+\ï¿w~ÿ“Æ°»Ÿw8SÁ›Á#T8!ÈÁíŽ6Š­TÛ2Ù9ßùÇ|ÂÎ×8ô)˜4LH£CÙbý¯Ò/pøÕDJÅ®sùGaÓŽiãy­|�¼Tä…VÌ+eÎf|CèÏNügow¨ƒ…ÊM±;T^f³]á³¢®î#1J­ã¼É
`ÇÍ¢çU5»Í¢«+,EÖÜtUÖT6_ïÒ·?¸áùtŒ¼xØ 1¸%�„Œ¬«Û¢)o‹š9šäu
ƒUë»bTþÁ¹±Uöj௳Vº°<j¥=S µƒá‚Ã}"ƒcw+"óß�j"l`Ê
‡Ò1î–Eí‘SÜ2/ƒ
–Y¡ÖH«TÓzî#ü‘ÈôU5™T�åôšª9É‚þÓ‘^Òp\²‡•ÇñÈéšz-ý l$	ê…"ƒ³>ä“rœÔú¬þÛ*Kç¢nATŒpîÅ
+Lze	?€ÌJþõè	0`eë:ò„Üe4i%«wù¬)óÉ7P§è ’³¹¿ÂOèn¾,\z/šnº^Ê鸤yGMY¡"B ÒT©Œ
+	Ä4¿MÔãM‘,TÅ¢GZ[Cµèi»,­põøÆ‚�Kº£žÝÝ
+i¬²b¸1HdÄ.&D�´EÛ/�AË]MËQÚÉ—à‡ho %Zv¨CŒ�GóâõìÐ¥L]P ×—ÍñZw‡Û²%ÂxÉdÊvÄZFè !ëK•Án@*äÈ¢$>Àí¬¸›ä£Èƒà²¤4²
èqu›G�N<
+jœåik5O]óÔÖ3i;RlTÅrLßóš¾Ñ/´’
#ô•OD4mÙ´9kÒJ'}Ñ´´N®—îŽØ<O_ÔÊh“KÝge4ÄÞZ�¤ûü—ûUàÙyS%_‰Q\ˆƒâîþrRŽˆþ\|M¾®«Q	–|L’d/FÕåõ´…~…ÿª¦Ó?\/ê›™¥¹Ú]vaØ–)z�èRk
a£î‹.5$ÂÁØd‹Î1õ‘f‰S"$%Ád7y}Cª–9õh™ˆM‘‰ñ[‡‰Ø‰˜8eæLD™¸–aKŒ}÷:°l7(Ýj´¤•*ˆ>î)Ë8Œˆ½;ýüÓò£ó¹c¨WŒ×õ¤ºl#¦»ª.1�HÀžßßa:«‹qîeÒÆ÷7@ÚYë+’4÷Ìh˜¼RÏu)}|rô0^®IÂ%P�Ø?ýDeí 8È	l¸¯#”@E(áKNU<RCß–“]ø:>#Zênu»&j«�P‘YåûÂ%ÍaBÏiãǧç‡ûÑ¥H§tvÍTõPŽÉTÍíÑmÑÜTɲ\�1#sf-†+X9>­‹…Áš7ß‚¹šÅƒ¬!3’qzò,R|×Y¤ær·º0¼b‡¢,gNú>“¤œeÒ†@Ü:?8�D™‡±mr)˜ýÒ¹…‘tÚdðô—ºÊ¥ã¦3
+! þ\ÉœcÛ3\üæ“‹îV·Å‘8Ý„(zȾœZÉ”	&ÂU0ZŽÆ [<‘‡¢uäHGG¿u9ÖÉ‘wFÅ	Øã=©É>Õm÷rº^w@#¯ËitI4è÷ß©BË‹)јZ¢¥ndhòÎÐËï¤òÙå}óTvQ7å$ù¿dœ�JÑ%PçÇïðt“ãÙeoÀQÏ�ÌÒ©-4ÈñÖËW‡qÛ= Ü®}Ã@7ûäKX¦Åû¿ü¤PbÕ[‚
ˆg6¾�ð�±_F�»]ÇDªÑH#Ѥ£uŸÂzãZ¡Rjùh
ºl’¬Eò%ßÀŒÎ._qD(½g!¸>ó+!•4^QDa¨"D/ÙQDlæÜJ b<§ÖrzUÅ£wµ0t‰Ò.}„w6u]¶Éëðí.ü_�3Ü>c*=gVz
+i‡À÷iG'†…‚h¢œÕŠ;ÕHÚÛkS0?õ€ÆdŽ¤j§–®I‘NnôjƒïK·<Óx`â^€ß'�Û¤zŒZçy¼ŽÅæË¢�°']Ø@�îå£àׯTÒba]cS: 

+ùævžx$$€j‘øÎ|.8ýæ‡îv»œÜ–u}	…Ö‚	guŸÀAŠ—(æÉÞéŤ#\ñì„€G§s¡î¬l¾¶Y]9^âÓ›8b¢´TóʯÀ<1)EŸ¿’�¯zî(B=9ß;D���ŠiÑ<V³Ïér¶˜=”£èÑhq̓(¯àx®�7ßp›Þ]ø+Π%7L‰^$9óFº/ÆÖ§?ÊÍ¥5ǃdjJ6(º¥$šL¤òÉ„¨ö<:³$Ôj]  —�»±ØÞ+¾b¨Àû„\Ë‚–:qáp?žù6(×±XÎãfªÆçPBrLôè´?—x·–úÝÄ—y@��¥¡)+
+®û|¯LiC‘M�U!¾âÔzÆ
+™y½¸'Ž=òYCT¼¢Õéâ‰6=A:=(ÓéR�{‚zÖiÜF¿ÜÙúóÐăd'-æ�À)ÊHWß5óAï£ï}¸¿øÏ`d•÷k^ÍR8ÂåÜ*øJÅx9ïÕYú
 endobj
-1425 0 obj <<
+1424 0 obj <<
 /Type /Page
-/Contents 1426 0 R
-/Resources 1424 0 R
+/Contents 1425 0 R
+/Resources 1423 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
+/Parent 1382 0 R
+>> endobj
+1426 0 obj <<
+/D [1424 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1427 0 obj <<
-/D [1425 0 R /XYZ 85.0394 794.5015 null]
+/D [1424 0 R /XYZ 85.0394 695.8713 null]
 >> endobj
 1428 0 obj <<
-/D [1425 0 R /XYZ 85.0394 289.3956 null]
+/D [1424 0 R /XYZ 85.0394 683.9162 null]
 >> endobj
-1429 0 obj <<
-/D [1425 0 R /XYZ 85.0394 277.4405 null]
+1423 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R >>
+/ProcSet [ /PDF /Text ]
 >> endobj
-1424 0 obj <<
+1431 0 obj <<
+/Length 3069      
+/Filter /FlateDecode
+>>
+stream
+xÚÍZYsÛF~ׯà[À*	Á¸6OŽ,ÅÊ&²–b6®Mò
+øZˆÃ»Ò
ìʤT~ŠçÜÞôB©/àH^k?Hƒ�ä¥êI^ˆÐ×I<ˆÃÔ�t¡äïÞ
/"8Žw×EâÕ�ÅÌ´ ·$öÙrYTsnML÷dLE�Ñõ%‰”DdÕŒˆw¾æÍfvQÓ¶¦õQúƒXûiJ8´ ÏðÚ´Ó¦˜˜髨Xov ¤ˆ”¿«<Æ ¾^§÷ÒŸ'H¥_�M.Ü€—Ô�„‘I OèF…~,Ejå2º³º‘ÞMõP7‹¬+jM,=÷\š¦­«–,ë%0ŠIiˆ	‘P^—3gV/²¢Rqì]}€%pÞÅ>õ�sSuY‰3DpRYB$ǔՓÂË*K¿¤²¢4òe”&'”RJ„ˆHY£û›†:Œ”wYƒÀ
+Ô‹N„÷úöþþêrRئôÚb^eÝŠ´E¬YÖe ^a_¾Ø…òÅ'Ê÷ é@éÃ2ï¿ÌKÉÌ4‰ÂÿÇçÜŒÃ2�
+¥¨0¶R±Î&iÚsF
+Þ4<¢‘Þ«~Å!PG~,’!P˜J_†)…@÷w×èƪïÆ:H¼n(<TÒ÷¦šAc黺,¦ÏD_7ÙÂ0ÊB³èQÈ°^ƒDvÏçÅ£a�16•DnB¨Oˆ
+‡�KÁPŽß�ÑÓ@Ìãa*=ó¡#yp8ZÛç¬ýÔ$îèuÓ?Þç½òõ�*ˆOÝ6
+ìIæ+F2
%E|\�:Ñ~)mEùN†.„±72KΩ0…âk'Q62Ãç;‡"µ¹h ±›ŠÅAº“Šýí*ÖñL¬ÿ²/¥“MòTYçÄA¼SÖü{³ÜA¼‘ŠAgÝúpon•C?*‹ÂÝꛄkHø‘ÖÔîj¶
+‚X«…é>V÷`H,üX	{Ä&{ÊþŠËoJj!Ox¨‚üH…œü½�@*`@oÈi†²M´—ÙRÇN*ŽŽ’¨13�¦¬—TIlÍŸ`“ß´Dr’ò_,³´ÂW`³ó Fön0Õ”ÒÃ"¼’Î$‘cÓà´ù·íÀ­|ú]¾
+}�YSÔ+^©}nwʲä•�Yð}€5ÅIÖ®-ìãxNÓ¸Þ9ׯ—Ža³èߩѵ5=ÁÛWOq/e__KP
�€sûÄ  Ëd¢ŽRÉ‚4Ù
+@{D$«lÁL2$è|èLŬŲ,¦Eg¸‰×d`€<x„Ve?G`Ã1QÁó![K[_¤ÅÝtÞu4ò‰¸®yeó!ƒm
ï¹Èªç}XHçF$´ßtC»oSe¥jèÄÃÕ‘/gÁ¸y†)>rZ�x«©«ž·ëx~ÎS{;/³©ÅõT¹¯ÅÚ›æ”Ç$XçEà­aÉjTõÌâZh«‘=/G'À„ˆ¾óh
káSZQ¶ÄÚDeÚs5U†Âû`ÁÚ¹Él-a™©{^Ú3kE#ÓãñOXW¢qœâô‚7›â7Ø,££6Éd˜/Ò	ÝZ$mË&8Ñ%Ãï·{@…LÝ7zM¿tÀ¯ø<[Ù"¾]×•1.RuÁíºo”;1$XÄ2—äøîxÜÇ"‰z.§Y˜Œ”�õnkÅ1Û2@zıõõrF
ëQЛñèbÁÃËbQtÄ´`ϼ~⾚v¡»9¨zlO3;áeÞ›%¯RT[;M³inÀÄ"¡Æ¹;íºÇÜfµ­ŒÅ‚¾ªüx¹´…°˜«cÈâÊ?Ü �†ºð ŠÀqÇwøx÷ñâYÙòR(‰1á
+:Çšµû<½·1I×éð�U™³„·ÄÒxáÎŽ¹ïÖ²«¤Ú
ó_°Ë±ã‘ÞRVºq‹ŸÐìáRþ¸•êÍÙ Ü
+endobj
+1430 0 obj <<
+/Type /Page
+/Contents 1431 0 R
+/Resources 1429 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1382 0 R
+>> endobj
+1432 0 obj <<
+/D [1430 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1433 0 obj <<
+/D [1430 0 R /XYZ 56.6929 420.9025 null]
+>> endobj
+1434 0 obj <<
+/D [1430 0 R /XYZ 56.6929 408.9473 null]
+>> endobj
+1429 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1432 0 obj <<
-/Length 2961      
+1437 0 obj <<
+/Length 3129      
 /Filter /FlateDecode
 >>
 stream
-xÚÍ]sÛFîÝ¿B�ÊŒÍã~ðcï-qìÖ�Öé9êMæš>P$-í…"U‘²£þúXŠ’©8×zî2ž1A,‹°
-^
‡pú¯w·W¯.dN¯o~H(Ééå÷¯ž]ÝÑ@̤onnßÆÐãòÝíõÍw¿Ü½~•èéìæÝ-¡ï®®¯î®n/¯^ý6ûáìjÖ‹<Ü–ÊûûÙ¯¿…“v÷ÃY(“F“Gx	aŒœ¬Ît¤‚H+å1ÕÙû³ô£nꨚDHË=I5¦§È±‚!ÔS»l6ì*ÓÙìÇ– <«	˜—ôܶeAP×Ðsek»²”~B¾´õâßÌ4«™8£Çåæ•H§M¿
kÂ.íÜvíŸnÉìa™U¶³%S6÷ô¼©»rS—ZÔq!D`¢Hº½­ËÍ}³Yeu|””Óv»X”mG/Ý2롲eŠÎ®pG¼l¶UA𜇛ºŸÁ'Z
¤×{zÙŽ¹€
-Û'zŽ‰]“7žåP±�aì@®m»®v_Ò‰1rê–v±tSc3…ãÚäŒÆËŸ„ÓG:‚€k»†C½[Ægô@ס)m¹yp–lÃO–¨©pÎ	„:'´i
-Ÿ%�âs¶ZWÎcã•ð`‹ãEï®/i&$W}>æß=CÞÝ®*„(UezqÁ+ìƒèSâp|®2ˆbLÿ1¥“_3J¶ÙÏæ‚~)�yäÑ/Ê"A¨„8Ù17—4à	úÑqìôCl;¶I—Õ:›2š®Ìh–&fà)ðÀõkݹd;�(R•„ªlíâ°ÔÓ¬ê õ-–4€²ÚzëCLCÒ–ÀÁB`¶ŽÞ¼âe·-E\`²Ú%Úö(â&È«Àr™+H
-<dÄz>2ÎË£ ØÒY„VrÓa(ë‰ù´?ØfÛú(ð¥%ÐÛê8²7÷Ý ÇVÛÂuW¯ Ày·Èæê®�‹µ£–»Þ§W<Ûää
-*…ÅMsPŸÀak¹„FÅeƤۆÒ^¹îUâ^÷þ/…mÿ�)ÙªÔ*SñÖ[G•ì¡]#@»,†oé¹U�®rFÃÒX…šƒÐÝÜ¥Im}
Iæñ…à3G YÙ®ëO
-@dùœ£€†Bm(Ü÷J€E@Ñt0àþíe˜?Ï8ì(€'Åøƒ³
†¾
’‚ZdrR-ÿ]×P©€À<ã*�`‚‰]ßuZ	ö/¤„}kùÿ‘ëDJ3�P„Éa�ûI¯ÂI S§çHyd¾ÜëV*„Vb_p)©\ÌVRSÕ€ˆeöÀCÔ&}RkáP_káËãÒæK"åÆ'³¢°¢6®žŠøbn;BÕÛÕœ:ÅŠ›’Ô{ÕÓùn0Iõ½9ÂK0Vêö�¼¬(¸k�Š!÷Ù3(€àÛº.¨ä
-éæç<¨ÅpØÊÃV@vTS)Iûë‹aìųüBùñçÕAé·/óXšÖ~î·æëBúFGñ›£}{ÁË,_>“L§š £•é{ê ùèXEZ–OªI“±Rz"
‘Ñ_wÀÌŸ:`æTLú=á—f C-Oÿ
-n_‚Ä„dð‚/ß?Ý̸¤”&¡O:,›à�Å‘py
-¹Þp,Y„
¦sê�͉5Ln ŽÚùh¯¶,”»‚†Þ=˜„‹$À·Ö5¾°vx÷±#´»Öîn›ÌˆrÊÒ3Ä®¾¢œøžù'OÜ­�O
+xÚÍ]sÛ8î=¿Â�ÊL£?ôÁ{KÛdÏ;Ý´çzo:·ÝÙ–m^eÉgÉIýï @Yv䶷ۙk3SA$ 
+ôûŠ¢hnV?:çH|4NòL³tâ€UÑ„ß^‘9à/ëN`‚xC·*ÊÊ¡…F@ì‡^ÓpþX[ÏÕffW{<bƒ‚³¡ç1»n›�Bb(í•‹àQ%îõh/ð²°Íj�ɪ…Âbч•7!© ©{›á[L:DjåS~`kQ)‘æà
+õ&·Ì–W¡Äjê3Ÿ|±à<¬9K…ÜGO/ý�/ëjA© çGãwhP��s,þ\ÅB@~–Q)Iòu©pU´ÏH~!ù�ùãê$ñ;&yÌMc?w¢ù¬�¾Ð‘½§úLnÏx‘Ï×çÏÄ“OEYÑ£¢‡+ï©~ä
+fòÑ¢xžKÊ$4 5
+•(d�.ÀÂ7¯Þ‡¿Œ§œQ‚#ÓfMàeI,Ü=€Z?���`ìïýWc ùÞ÷ÀQC:…Œ.\�Â(4Cd�RÉm€¾.DpTŽÂ½]VJo»ï¤”ÿåbøþv+RÈ)ébˆC�$Ù7^JÊPƱúòÅ 0Å’8æB‘m¾€ºÓ‹jÅ1TRoáÔÀë…‚Žl ‘�£d‰`ô—‡Ý…]"ËÂ×U»ŠG[×L鮋%*13aÐ.ÃÔÇ`l§øfÊkÛÌ÷­¼,]t-æõnñ
m”[W…“Á¢hæ;;swÖ͸†¦Ì1îâ8u
xM×k 9[Ñ=D×.Ì猗wkmÁCTTµœ¥Ñ9ÕLJ`ýöWÓ½>pÝòåçJSƒr¥¶ÖÎ÷®¹àÞmáŠ7
+—5[<£¹u%nÞÁ¦âJøsöÉsI�íÎÖ®–JƒÕÂϨ©3�röìnOâÆz´tÒ—³¡ùÖ#öÛyðJ4“.õ‡!'=�=õ nC¸yǽm‹Út*¼™öwÁÏ
+ÃíxxÚUUMGƒÍ�+¸¶sÄ#ßsÊŒD& rb�4DQÇøýô~0ƒð¶wM:.*^åÒ‚�
+Ì€áÀØ»³½­tv8kš¹ƒ
+/ý,LÁw—RC?âŠF_ý`þÖŸŒ6§ÓPe™þnë¾ï˜)'5çœw¿-{Îúð{¼£endstream
 endobj
-1431 0 obj <<
+1436 0 obj <<
 /Type /Page
-/Contents 1432 0 R
-/Resources 1430 0 R
+/Contents 1437 0 R
+/Resources 1435 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1388 0 R
+/Parent 1445 0 R
 >> endobj
-1433 0 obj <<
-/D [1431 0 R /XYZ 56.6929 794.5015 null]
+1438 0 obj <<
+/D [1436 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 486 0 obj <<
-/D [1431 0 R /XYZ 56.6929 675.8841 null]
+/D [1436 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1434 0 obj <<
-/D [1431 0 R /XYZ 56.6929 651.1818 null]
+1439 0 obj <<
+/D [1436 0 R /XYZ 85.0394 750.0533 null]
 >> endobj
-1435 0 obj <<
-/D [1431 0 R /XYZ 56.6929 465.6376 null]
+1440 0 obj <<
+/D [1436 0 R /XYZ 85.0394 564.5091 null]
 >> endobj
-1436 0 obj <<
-/D [1431 0 R /XYZ 56.6929 453.6824 null]
+1441 0 obj <<
+/D [1436 0 R /XYZ 85.0394 552.554 null]
 >> endobj
-1437 0 obj <<
-/D [1431 0 R /XYZ 56.6929 285.5131 null]
+1442 0 obj <<
+/D [1436 0 R /XYZ 85.0394 384.3846 null]
 >> endobj
-1438 0 obj <<
-/D [1431 0 R /XYZ 56.6929 273.5579 null]
+1443 0 obj <<
+/D [1436 0 R /XYZ 85.0394 372.4294 null]
 >> endobj
 490 0 obj <<
-/D [1431 0 R /XYZ 56.6929 185.3546 null]
+/D [1436 0 R /XYZ 85.0394 286.7057 null]
 >> endobj
-1439 0 obj <<
-/D [1431 0 R /XYZ 56.6929 160.9016 null]
+1444 0 obj <<
+/D [1436 0 R /XYZ 85.0394 262.3661 null]
 >> endobj
-1430 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
+1435 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1442 0 obj <<
-/Length 2995      
+1448 0 obj <<
+/Length 2766      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZ_sã6ϧðÃ=(3µÊ¿Õ·´ÍöÜéf÷\ßLçÚ>(¶kN–|–¼Ùܧ?€
-¾ŒŒrêm‹Ýš%‹J¾\7mQS}—׫fS=^J)££ù]T7ÌØósw\Rq_~ VYXå#
Èg*eœY«üf+v:¢z»mêUYßãz3ÅÛp&ÚäeEt,¨v}æ÷EÝÍCY1Í]N5ÝæËó¸†ËÀ².>2�Šr_´Ì©_4ïßH½m~�SKä«æÔîê¹)­ó8¥Ê¢¼~¤¦ü¶mª}WÐצÈkØ3Ñü¦TJÍ°Ò@Þ
-¨^òš'hêŠ	ƒ‹eW†IýÆ‘
-øí¨úö—!«eãËUK�wÍ.Ìï�è@ò²>Þ$Ùu
êJ”Š(XmM öuì§ëVQå°ìˆM¾\—5àz±|X—ËõBTßëk·aÚ¢*Q«qK+^Ó¬ÃEýÆ],LŠ‹[Øì[¦:2OD"K˜ˆÎ§ÉI àÞl’ŽTºm›e™wÅŠ¼R¾Zñ™´Ôp,rjûMXqEU/{(¯à4K& �@ysõ–^ÉIÏ Òîï�)º�e	V÷–Æ™VÎ/ð�Ÿ!!SM¦
-U:7´¼TEå5z¥aåƒO?)”· MXKŸ°°Ä=Ý"ÎV÷*½
->!æÉÉFÏR
—’F%s,v¾hàòðŒ´Ÿö„Ö²§È„W,Ëûº9¨Ž
�ŸÕmWä¸"-DðYpD0ä)“#
¤&ò:�‡†Þõbì´Äã
-Ô~+8
-<vàE��PhÛ6eÝ
¦:á…nI9h
AƒFª‘THŠ�ùf[ߌ¯Ó,�…¾‰Nb—¨O¹OUÛT¦Ç÷éÿ7*¬c°Å³+ qxq5Œ8f5
{waâL¦P“
¼
 ‡Ø©'‰‚Û]Ò#T¼l6èp´1Ñ0‹VTÀJôHq9M;°øhØHÆV%°^g&Ãõ|ÙQ˜2Õê‘šT(#}Zj€b­e6Id¸Ée^j,¢Ì«¶¯°x´�úDùf~]ùÈ×”��p�¤ê%ù@Š™vg䣆ò‰Óì·q³»F:ƒyÿºÚc]w¨zÁäl¦
-#F—P¿)pB*çÆ�K%
—i;1
-˜…‹U’¨ÉP!¾LÉP�µp<¸†N|N„Fœ×[ã ô¶ö½Õ‰‰�LI¸óîÂà³%½ÑÁmLmùƒgâ—+vⳟVüˆŒ4]³¥t@¾!ð!?‚5ò#Ô�úÊ#f`¤?ØŠÏO-Ïz^�WÅ]¾¯º‘óë•¢8@€9§
-6„®}žÊ¥µh—DïsªŒrc€ÄR%¢kpH>㊃hpÂW›o-ÁwÍÓ_‰Ð±ÉWÅ1§ª
-,ZQ0ëAæWA�²Ï«Š«»²›ž‚ˆ]QûÌFyû–Ó2yHÊpþ�ò2>5…úÅéZÈH=ëvHp‘±Â
-÷.?­@KÞåÔ8f\ÿtÀåp1�º`Ÿcì?8uÈËi�…®ÄŸ:¦Ø}«Ž6àüËmÅh3Pyš¥Î8?ÙÿB
+xÚÍZÝoÛ8Ï_¡‡}P€ŠË/QÔ¾uÛ´—Å6é¹>`qÝ>(¶'K^KnÚûëo†Cʲc;éµÅ
"j8’Ãß|Q‡?¥†™\æQ–k–r‘F³å�î ïõ™ð<I`JÆ\¿NÏ~~¥²(g¹‘&šÞŽdYÆ­Ñtþ>6L±s�Àã__]œ'2åñ«Ëß¡%”NeüâÏßN/&Ôa<믗W/‰’ÓãÅõÕ«Ë×ÿš<?Ït<½¼¾"òäâÕÅäâêÅÅù‡éogÓaÉãm	®p½�½ÿÀ£9ìî·3ÎTnÓè^8y.£å™NKµR�RŸ½;ûç pÔë†T“àL*#èIªCzJsft¡ž^µkÚSù©X®êò—ý-ËLf³(Óšiÿ¤=Éœ¥™Èv÷ôÿ�
+ëàQ"ËÓôÄ
+hY¾FìŠJž’LI–
+½ÅU>ÒW–2žjeÊÀarãôåÕÄfí@c”Öñ% BIžÇoþp
~žd06^UÍv†ìiW糩€CÙ®äëö†Z í»¨Kr–¦ÖÖ¨€�deЯ¡�
+Û×N´£œväÕC3ç?¸~8´88§Gô#$Èãêˆ~äX?즘ýg³bíúî„vFóþ¸Ú198 mÓG¬�£7KÉ‹?´ŸD�LÎÆÏái¦þ‰£*Oþ«ÈjðÑJ�V‘±–É,ÏíQ"³:’ÇuD³S'´�[GÐ@“³\§¨„ñl7€>¤2³L[\µI3&…ѧ©Q9“VQ`xç
+º¶†síˆt¿(jÁ&=Û¬˜¹
Cs2é0hëÕ$Ð*5æe7[W7¥—´hï©Q·î
+[J´…ÁVªÃ®ì?‡ÀÑ�YH,Üñ½»†ˆ	…—‡¦ãºèœ
©±¡)¯gÌQÑP¤�=¨Ð£ÁÕݽ·c™‡€Ã/#¦é"Œ#ëÝù¶uG}ˆfÄšIÉŒvìÉ#<Mã68ÔLuíÍ
+3¸¶t0&h6m.v‘Ì[ð”
ÑÐÇ_ýñòúÍóË+ôèDõ†ºj›®ìaþ–V»$œ}n7ì�ÝV°,>UË�çF?Œc"ÃV]|¬.îUËcE°ÆuÐ�rµÀE?L•38s‘gÑ_‡0IJâP%R�lþ%"È£ …Cgò$f¡Ÿq
I?*ö'ç%4d#¤cA˜hJfà�èüf¤Rì,zzöÄ
!¥]ýŽ#9ä>°EQÙc¹#쀰ƒÔ;˜´ó³‚°wšåm±©û=Ÿ7
+—9ÛÔ•ý	PlÕýu¸�	ý-1�7F˜Ó Ð/žÈ‘E¹´²ÛLÅ`I˜¢¥Ô)S¡±(œ¹A« éß;z’3“©O¨½uˆðR5{œ“‰ËÁÿ,ª0sȈӱ—;îÛ(ŒÃ6‚“ã['ÇÇNŽû½x‡"jhT§
+
tλ|Ñóì@±°ÄBñC…T�Öf¡Î8Rxžµ�öµÁeƒÐõð|S¬VÛçq|ùö£~¼`˜”^ŽÊ!rL•Í·Éõ¦¯Ú†zÑk÷çü�£"ƒ½®‹¦«Ï=ÛpŽ£.ßµ˜Ï½ÐŽ:Ü!BNê~NÚ±CÔ†¥Í‰Š9?R—%ÌE$:p²Q·K�?ŠªIÜü™ŽY±^ô’*0…4T«!«
°R¡¢¬‰ßN'ÔðÑW¯XTd’Çà�*­`
6>¬9ÂÞ\÷Î<C8„Že1/w%Õ%$’XÒ-[H(]…Ö¼»ê®¡0V4à¬Ü–Ù8;:U€<MV̉£.o¯rÇ‚”uu·
+ûDvÞÞÃSîÃSz|a‡
+]‰;u!QU¼ç_­j?€6�=K$¢»"Êì á&ƒæ[žs¹­Ò?¡Ö8q?-eü×®qpó<„È�9¼]’}ðwQÎæ9VHK,¤ñ6î﫤¿Ùåô�€Ja˜ÌÓ#_Ë|*±’¶¤ÀŸ®'—¯ñ:ŠÇ»¶0¸ðƒùØxª¯[ý6û
+áš)Íåi…ðŒåÒXòç‰Í@¨þÍÙ
 endobj
-1441 0 obj <<
+1447 0 obj <<
 /Type /Page
-/Contents 1442 0 R
-/Resources 1440 0 R
+/Contents 1448 0 R
+/Resources 1446 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
+/Parent 1445 0 R
 >> endobj
-1443 0 obj <<
-/D [1441 0 R /XYZ 85.0394 794.5015 null]
+1449 0 obj <<
+/D [1447 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1444 0 obj <<
-/D [1441 0 R /XYZ 85.0394 649.2264 null]
+1450 0 obj <<
+/D [1447 0 R /XYZ 56.6929 756.8229 null]
 >> endobj
-1445 0 obj <<
-/D [1441 0 R /XYZ 85.0394 637.2712 null]
+1451 0 obj <<
+/D [1447 0 R /XYZ 56.6929 744.8677 null]
 >> endobj
 494 0 obj <<
-/D [1441 0 R /XYZ 85.0394 501.7371 null]
+/D [1447 0 R /XYZ 56.6929 609.3337 null]
 >> endobj
-1446 0 obj <<
-/D [1441 0 R /XYZ 85.0394 474.4327 null]
+1452 0 obj <<
+/D [1447 0 R /XYZ 56.6929 582.0292 null]
 >> endobj
-1447 0 obj <<
-/D [1441 0 R /XYZ 85.0394 432.9601 null]
+1453 0 obj <<
+/D [1447 0 R /XYZ 56.6929 540.5567 null]
 >> endobj
-1448 0 obj <<
-/D [1441 0 R /XYZ 85.0394 421.005 null]
+1454 0 obj <<
+/D [1447 0 R /XYZ 56.6929 528.6015 null]
 >> endobj
 498 0 obj <<
-/D [1441 0 R /XYZ 85.0394 252.2904 null]
+/D [1447 0 R /XYZ 56.6929 359.8869 null]
 >> endobj
-1449 0 obj <<
-/D [1441 0 R /XYZ 85.0394 222.301 null]
+1455 0 obj <<
+/D [1447 0 R /XYZ 56.6929 329.8975 null]
 >> endobj
-1450 0 obj <<
-/D [1441 0 R /XYZ 85.0394 133.0078 null]
+1456 0 obj <<
+/D [1447 0 R /XYZ 56.6929 240.6043 null]
 >> endobj
-1451 0 obj <<
-/D [1441 0 R /XYZ 85.0394 121.0526 null]
+1457 0 obj <<
+/D [1447 0 R /XYZ 56.6929 228.6491 null]
 >> endobj
-1440 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R /F21 658 0 R >>
+1446 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F47 879 0 R /F62 995 0 R /F63 998 0 R >>
+/XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1455 0 obj <<
-/Length 2169      
+1460 0 obj <<
+/Length 2195      
 /Filter /FlateDecode
 >>
 stream
-xÚ­Y_oÛ8ϧÐÃ=È@ÍåQ‡Å
ÙÔéyÑ${©w{Øn›‰ØRjÉI{Ÿþ†R–%Í]ƒÕ˜g†3¿2,¡ð�%J�ó<ÉrIe*Yn�hrsïŽXà™F¦iŸë—ÅÑO§"Kr’k®“ÅuO–!Ô–,VŸRM™€šþyq>›L¹¢ééü=PLHÅÓ“ÿ¶˜]ℬ¿ÌÏßâHŽŸ“‹óÓù»ß/�'™Ló‹s¾œ�Î.gç'³ÉçůG³E§rß,F…Ó÷ËѧÏ4Y�u¿Q"r£’{øA	Ësžl�¤DI!âÈæèÃÑ¿:�½Y¿tÌMÏTÂÈxɶŒ“<Wr|[šL� Fƒ3Ÿ”…ë(È
-d\1u8E­9‘Lòî¹H#¹RÜ#ÌŠŒé$‚P7§xîìs¢´dŽ�Q¢Å=ÇÅdªYº€ÿyúè8@$Íx–hcHÎŒÛ8ù’0BežäéÑÞÒƒüÀOó-OÞÖ`OÒ3)Ê�ö{‹4ïÅ%„#0eIF3ð€2^ßÅÚ¢MZôX9è¡X´éo—ówó`û@¤”Ä(ªߦ¬l3™Šœ¦e…ßÄ{ÂNM¿ÛÛMd)vaêÚMÕ;üq»«'L¥w媬nphYW-.oƒÐú9á %8B‘œòdÚ�'¨WW›oÀÏhúçRN§i_Õø­ê6vi›¦
-©¢
-<k•§Íþª±_ö¶j£´+k+¤ì×ÖV+»r11òqí´Ä$z£ìîLx£3
è²mìæ:Ð
~—›¢	$IJ½u{V�ŒDb7a Ð²ößUǸžÛ~»o‚°«0R:½›bk{º�ÎH85¡¼�ã²á Q/<ì Ôr³_,…¸:œ<ƒúa2ÍÆÀt"L94È÷fD”$¹a"
-šŸŸ¼ÿýílD’‚ÊøAº«Z�ˆä’a²(s±x�~˜r
u-§�?"'†)uHÂBB,¢+£QÃ<x.
´÷á[Õ_ÿ>¢—PD1­Æœ¦Nˈ`œ¾U½-ÊjZ¹“}¼¹†vDÊxŸF¤	–ÅM—õvëBrä¤1RDAŸGÔ‡ Ò„×õÂ陳3¸ŒÇÐØÖ‡‹ÁÊ‚eŽæi—EÜê¾Äœa!Þ¹¯R.�g�ߢú†Ä¾úuªt‚<üa¶W“
-Š.ÜFLbÃ×ã©›ÃNìX„éŠW¹,Û±¤b
-º3“�ŤŒ%bxüŒ"ï1d$“ÆgZ/z’ «…Ž>ŠúLjRQd,/‰TyL0s¹ß¡ª1K!—MvHЧ#¨o(zRöcÀ¹»îÜŽŽAå�Mà2npnÍ­]öbä
-p‰(bS&2¸ñ¸è¯ÝEg0=�py·±#Ñ T•”æEc¦C�"ìàÓ¶öé¿ï0ìf±•	ê••‡�½ütÑÆÉ2¿­a‰«T§óë±–ƒÁ…ÚpñÝS¢à?‘÷!
Ä÷	ë
u—ÐüAÁ麼NÙŒô\qí¾l×£uQtHõRDƒÞ%{€ËØìmhÉjW
-S)‹<.|¸ÑÞƒ	4ëz¿Y!§kÎÝØÎ6m½³a´¸ö·L7QT#ÏqBp¢Õ!ã¡öǦ-L"µø“…tå“®…RªôʽHí�îRû‚àV¸oSbßâèºBžûµÅw7ˆ.
+xÚ½YooÛ6ŸOá{¡
+�µ@…víõîTèY£S
è²mÌæÖÓ
>—›¢ñd	ÛÝÙ=+¿”DbwJA eíž«n¹_õ©í·ûÆ3»ñ#µ “»)¶&’…tJ*"¤Âãf'�‚ái{©–›ýÊø£§ÑÑSΉÊ3ë�–å7×óéËélÀG„ Š�{âºoX	¢å�Ñtv~ùë‹É
+”J‰`Ó�TÐe>à\†@�“¡ôöúõkð~rç³³+[ê( ¯Î¦³ñ«Éü7¨�Á-Þ/È™¶üPl:ÝàŽe~ô-lO&¿Ÿ]ýr9!ç×W…ö¢d}Iú�ÏXƒo(NEáìÂC:ùjÞËW=Ø•PzAÉåÞB¢}Á%z´Ë€Ï"x½+ß¡{?â’©LÊÀ�ÎCìÀ�™Ìÿ—„
+˜#òP—ñ<¹sî_/�«ˆ`ãx3à.|U
+¡>ËdTuðQø\|ÁÖ.¾àýþ€Ãv‹/^Y9Ü�ËMm˜,=ó»>±É#Í’éíPÑA9ô"Œ?{L)�ëÓ€}I˜pR¨P¤ÎŸ(P;a#‰L€í¾l׃‰N‘wPõ¹�¼‹v�—¡,Ø_”Õ6Þ—�yTœ~:%ÐN?ÿT¦ ü¾±å=‚~žC™’ª~Ù‹  T8G£»ŠàB÷„t3]�´¯Q€Â5Ìίr9ðQh�yÂàŽ®¿ßÝ®¬wÇŸàMFIÞÿ§êcÀ!‚_ÕÕÒôØ‚GAQÐpö=*v$ì¥\aª¸[)дC}/ç²#ûs_ʈÖR7¾
+˜¯èˆS»,E4‹�NfP[[ï„Æ

+@oÝkÈW4YÀ–Ýh›ò@4–[¨„ʶ½¹ÍqQD;]6pßM·lô¢�F‘R�ñ8æì”ÊXH,'©
$¦¡4c
¢m-rí{h¡ÒsœÂpFÊà.ì¨õX*;Ьëýf…+m…nÇv¦ië�ñ£Å­ë5íDáÑ0ë¡!¸O&Q@¨ÜüDÏ[#çïéíäPzh…�ÉÍ)\°²‹Ì%;hñÂ>›‹K×®¹_¼±ƒh &€—€v9¢�cì
+/dr¼�ùÉÂ/²¼LÑîwæöô“ëàiõ8‚¡s’qp‹8X¿,þ-ÒH
ããÃ-Ú—¡SR¤€uÑ•ÛñÕ$K�¾)‹ÊS~Tž.—_¯4µÌ�‹?I@èînÁÜûM;nÛÍ¿|·
 endobj
-1454 0 obj <<
+1459 0 obj <<
 /Type /Page
-/Contents 1455 0 R
-/Resources 1453 0 R
+/Contents 1460 0 R
+/Resources 1458 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
+/Parent 1445 0 R
 >> endobj
-1456 0 obj <<
-/D [1454 0 R /XYZ 56.6929 794.5015 null]
+1461 0 obj <<
+/D [1459 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 502 0 obj <<
-/D [1454 0 R /XYZ 56.6929 637.1539 null]
+/D [1459 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1457 0 obj <<
-/D [1454 0 R /XYZ 56.6929 611.4253 null]
+1462 0 obj <<
+/D [1459 0 R /XYZ 85.0394 752.162 null]
 >> endobj
 506 0 obj <<
-/D [1454 0 R /XYZ 56.6929 538.4006 null]
+/D [1459 0 R /XYZ 85.0394 685.5532 null]
 >> endobj
-1458 0 obj <<
-/D [1454 0 R /XYZ 56.6929 510.9165 null]
+1463 0 obj <<
+/D [1459 0 R /XYZ 85.0394 660.2382 null]
 >> endobj
 510 0 obj <<
-/D [1454 0 R /XYZ 56.6929 308.8105 null]
+/D [1459 0 R /XYZ 85.0394 468.978 null]
 >> endobj
-1459 0 obj <<
-/D [1454 0 R /XYZ 56.6929 279.7922 null]
+1464 0 obj <<
+/D [1459 0 R /XYZ 85.0394 442.1289 null]
 >> endobj
-1453 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F62 995 0 R /F63 998 0 R /F21 658 0 R /F53 962 0 R /F11 1298 0 R /F39 863 0 R >>
+514 0 obj <<
+/D [1459 0 R /XYZ 85.0394 217.1462 null]
+>> endobj
+1465 0 obj <<
+/D [1459 0 R /XYZ 85.0394 194.0979 null]
+>> endobj
+518 0 obj <<
+/D [1459 0 R /XYZ 85.0394 110.3497 null]
+>> endobj
+1466 0 obj <<
+/D [1459 0 R /XYZ 85.0394 82.4166 null]
+>> endobj
+1458 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F53 962 0 R /F11 1304 0 R /F39 863 0 R /F62 995 0 R /F63 998 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1462 0 obj <<
-/Length 3059      
+1469 0 obj <<
+/Length 3190      
 /Filter /FlateDecode
 >>
 stream
-xÚÝÉrÛ8öî¯Ð!¹ÊDc!¸ôÍ�(O¥�Œ£éêšt”HÛ¬¡HµHÅI¾~ÞøX�ìžt×T�}
-åœÏ—÷!÷b¹|K½Wå®Xwåçqˆj‘ϲ4¡�õákÝe_~´ÇG+Í´ˆBØ€ëp³H�¡Éˆ%!P€åÅm¶¯º ë*ÏÉQÂd
-»ö£šbJÄÚ.X7›MQw@¡€C•ô	WÌØÈâø=–*™zE$Iù¼3T‚Ž½#ýXžk=/7…û•ÊyCý·H=Óû�kÈC#hà¶ÙQ§Ý¯Úâ÷=^ÒüÞ�‹d^¬Óæ-
>”Ý=õöu^üƹ¬‹Üž·|Û‚ˆ†ŠÏÁ£³ªÍ`OÌ3JÃÍí€"
¼‚¥Z“þì²úÎʤã0QQÓH«s8ï�Ó|J³�Õò�ÕŽêeK`Ç(Áϲ¶Úøú%u¤âÉp&ÝV"¸ÀÁ@ЄàQ/Ú‘ìAóÎÚ®ØY.+‹ãâKWÔmÙÔ?žJ8£"¼Y\/À>
-¢œl"grH6‚{ɦ¾`ÂA´¸OÒ æúµ7¿,n^°Å¯—?¿»x(!cê¾ æåõåÏvòã~;ÆÈùäâç¬"ÿ	¿�‰'¨AÎ		pHRâRâæ$ORGœ4¢­{&÷ä3�Êç
%”ó# ãç¢`W9oT
UÇá,”Š‰D$Ï	«UªXÌãGaõ·Ë]„›ø"‰´>~ÚÇ
–íºSPA�T ’|U¤üA»�‚)¥4xª�%BÉQp¨qH,"[º¼7Ú%dU±ƒVÛ¦6�˜¼t
u "Ý´h€B0z]¶ë‚¶k¶v׎Úaü¦¶
¢š_9P÷öŒævmç<ãÏ”Z´óh÷Àë¦xP±�.k)OɃB+0êÕÑü²ªh€Û”.i!Z
-¹Ùh+$
-hÊù)X²l²¯D�f‹ÁbVUö·Q hoA–›Ã9
Ú”+-&lš¼DëÁ/äá¾ÄB… µ÷”žâ0‰ChŒ2&Æzãï!ûÀ-ý²q†�¤Ž•q"E•Ûcʼ»§.r�±^e-ŠmŒ™>\ò\̇{¦ñ **�@h;ºF¾7Ê‚0çÁ¹ÌÃ^C¼	',·^’§àF¢*n;‚¸Ú�J’�ÀƒJHIóÌUeOú®ü`R™LiÌ1‚-CyDS”i¡Ã“La�”d­Ï	ª)Œ	&z{LÆÝ‚�ñ/÷>^ ‹>}ò@Náì¨/%Ü=C;�ç¯MTD)¾d›mU\x®i&”ÖOa>«@òu‘ûL@Ê”:�Á„�TZ–Ë$ªQ<ey"ƒ‰¬är.9¶jœ·sic-^ïw$Ú&
‚cÀA‡¤�óíD½}´ÃúZª_ÂDfd4�ër“U4fœ×0÷­ KÞp)Ës—ÝöÊ‹?L`¦¹Sb©Å«êèÄMuàsVVÙÊUäÈ�PßĤÔ|l¶ê5“œE²¯/ä¾
-ãI,¥ö
-ë.«,b0íXŸšðçÈ‘“ÚSã«Ï1­úB·5	`çMlŠöðD¹Ç
gŽ”¤,T½Â|ñÚ£0ìµÅ£ð’%Œ_}a„—¼õLÅï´ßnI֠ψ„Iò½!à‚¾:Ž?�A(–>ãPŸ(Eõ¹üï°Bü‚ûµ2iÕËÆQ‹Ž,Ž–6Ñ	�Xa%°¦ŸŒät:)¼ºé¨“­Ú¦ÚwF}‡„*œ(¹�“À(ÙWÕ]­ÇƒS§ËøÑéð³FÍ%�~Æñàƒl°ØØêŠ+�c,ï
·�UVRcíu›u媬ÊÎD¡}ÆÀÉ"ÛU¥	ÆRÖÉ|\Ä1KÒ´÷m>ç&¤Ac¬ð„¶+11Dø.�¸«Ëoæhcô°-ë¼tÞÜOW1×€ƒñ¾hƒlíÝD+Öú¼˜–óz‘;ž:Ž3²ïLó†Üñ/¨Rˆ$d<NÂ'2G0´LÇ:<ñ°0Í?lÁÎÀbÚ\ÐtÊMtMPÑ댂3Õ¹U®
-¤P>²]7Íîû(¨…X''•·»¾Ñ«“­¸D“ûì0Bv´
+xÚåËrÛ8òî¯ðÁU+WY<H‚Ø›&±³žÊ8YÛ»5µ™(¶XC‰‘²ã|ýt£
’’!ÙÙ¤jk
+çÛÕeÉhÓ˜‚zm�m:š­Oy62ykh<§¦1ëÒ¸Mõµ´²©7¶33€Fgµm·¥�ç­Û¼¬ž¨W”w¸äάé÷�ÝQ/ŒÉgs·£�û%S·5_R[¶f�·pp5rH)5öX�9�t’ˆ×‘
+xžrîH5ÃÃdšŽ¦[åh†#H3lMÞ”ˆöïÍïäÖÂÕi¸1mC=¤N=£NÒàŸ›’:[ç¨Q³Y­êuë n¦ÔùIÄÃÍfÝÄ
+°wˆla_˜ÊÜçmY/R‚Â4³u9µ‚
+E¼øp}ùîÔ1elÄ"Ô
àN,»ë9�{v€š«joίÿ}~}�ÿ6ùõãûó×�âBQ÷„š7W“_ÝäIÄⲃQ鈃\|È+³lé70ñ
+
+£Ä¼ªÜo«?ÐÞ�(×�–?¢—´':ŽwÂÙE]”hÙ!ê%‚<ÎKÌdJ;·ŽÉ“8ÄÖ cÖa-7þîÓÜÒ-¦Hj%­1UáŽ)‹vN]4â
-Ÿæ
Š­‚ØïW¸ä)õ÷ԪשSÚ–®Ql¬®àLvp.°—ƒéd)÷Âr$¹–<ˆÊܵqº�$û€•‹…)J°V•;è?v4W
+í�L�.lDD1_òŪ2g�+AÜÄe’¼„UüZ¬Æ‚�ɳ"dt$å
¶8
+ó%h�â¸ÓfP”€Â‹(ëaüŠ: ´„;zÝ°Üi³Z‘Ì@Ÿ	›ÜIë­ì‚ÂÜåVºðGï1Å2d|ÆãNŠº]-øn+ÄÎXX[!ƒ–�lìµ8ñÀâ$Â%9ñ+,9V¿’¹DoÕ
Þ²n©“O›ºÚ´V}ûd*ÞRò'�QB{l|‘'€“‚Ó…Ú9=~.QsIà�ŸJ=kWV™;-ÅP>X°VYŠd4««¼-§eU¶6âˆm4L“&_W¥	ÆÈBœ+eZw¾-äܸŒ0ë±Âš¶Ä¤áû,â~Y~¥0'±FÛrY”Þû‚bz·|9¬÷EDMe£g}N¶ëx�ÈŒíO‡éØw¦x}ÞøãËRÆQ&y0k”©ˆ¤NTÚêŬñfFÎZ”ÁØå�¶S.̸­ÇäÜ4b½GÌú%¾æ[ÐÏ�ÑVUa–T:Mwdá�$S´ëÆ­Ü §ÆóvnÖeë}›Ë3¶Õ
•—$Àp_¾œ¹UëÓl´©L½œíÌ°ö £ˆ#–hod\,¼«3Š$Ê«L˜`ýãXŠaÕ}ˆ2ÓŇòmJ÷>€"N$7ýƒ@XÒ"ô£
+$?^Ð…†Ø;чË#R ýNÕAõÄÇa‰tûíEHƒ¹¡ŒÃx@ƹò%>XîªX°r‘·ö%[È�<¼¯Xó{wà°‹ÒJ{ùÊú@qþ¿äv(?Jn…Øì[TÁïØ+·*‰X¬“ƒr+4‹Í��~Z½\>ž´$c+—-ØôBrŸ²Ã=-â�{(³®&~C3}Ö
ão¯ÏhØ>œÑèÛ®Ÿ�&gÁúü9ÿ»t\½º9À¶
A¾�ƃz¬»Î7øj·c/ÛR	ÁF|دŠ–g°Ü–ý! „8;c¶÷œ½d@Ðapׇ,E½È½*PèfÓ¯Ë]'n×3Ó4^�šr
ÙÙÚ>#Ó»Å@óæ
+òëü1Ep”–¾ ±Àï\lçÒ¹A¢LenÈôúòÒ0ñËÝ5ó
;û»º«^î€Ï©™–Ë|ý4\ï2H¸ŸàJlĽËôŽ´KNýÍGaÀt²Uämî•Ë&³vÓ×ÁØ@µ
[Îùè¬Óš˜>ùÌ-òõ@	7V.œ¹xžÏTu^ô£å0×è)U`5•µ-7.,a„æø
Óƒé
+ú¬[äŒô:£ ]¡Q
+ÜÛ¡$„}�sÛ# Nw¤Ão¨5_ òá£ÅÕxZMíÔÝbvÃÏAÉr÷ït0ˆŒ«$Ä‘ÈøN%ÁN®aý8î*Õ裋1–PÀºøà}×áÇQš
+oåaíÌED´&Έ¸ÿ lV£-yê¾/{ð_yÕþƒ°�-Å\¢œÑ¼Ê–tù�Ó	»|ÓBpÑ–3û²´çË>Œñs¼ÀwxìøÅàêµ_ýõ_>ƶÚ.Ân·sÏîRH½L<»¹ÿ<ðùÕÿäoendstream
 endobj
-1461 0 obj <<
+1468 0 obj <<
 /Type /Page
-/Contents 1462 0 R
-/Resources 1460 0 R
+/Contents 1469 0 R
+/Resources 1467 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
->> endobj
-1463 0 obj <<
-/D [1461 0 R /XYZ 85.0394 794.5015 null]
+/Parent 1445 0 R
 >> endobj
-514 0 obj <<
-/D [1461 0 R /XYZ 85.0394 769.5949 null]
+1470 0 obj <<
+/D [1468 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1464 0 obj <<
-/D [1461 0 R /XYZ 85.0394 751.488 null]
+1471 0 obj <<
+/D [1468 0 R /XYZ 56.6929 586.2823 null]
 >> endobj
-518 0 obj <<
-/D [1461 0 R /XYZ 85.0394 670.5492 null]
+1472 0 obj <<
+/D [1468 0 R /XYZ 56.6929 574.3272 null]
 >> endobj
-1465 0 obj <<
-/D [1461 0 R /XYZ 85.0394 643.3882 null]
+522 0 obj <<
+/D [1468 0 R /XYZ 56.6929 166.8772 null]
 >> endobj
-1466 0 obj <<
-/D [1461 0 R /XYZ 85.0394 435.5355 null]
+1307 0 obj <<
+/D [1468 0 R /XYZ 56.6929 140.1236 null]
 >> endobj
 1467 0 obj <<
-/D [1461 0 R /XYZ 85.0394 423.5803 null]
->> endobj
-1460 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F53 962 0 R /F39 863 0 R /F14 685 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F14 685 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1470 0 obj <<
-/Length 1570      
+1475 0 obj <<
+/Length 1085      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥WKsÛ6¾ëWèVi&Bñ"	�ÔJ•É8­£^šæ
-Žœ–0ö X<ÂX·‡­©ºâˆ,ý¤M¡7ÎK~vê §>óçIÙ ëêB¼Æac*ÝÏ÷{$ä,="mñ
-58XÐÌT1g¹ýSpSuy;W¦;â½kçjvØv”Ö
ζÎZÆØìÍ�¸°9"g¥n
‰À3%êT?

-
‰TÔ:;qM™“Á×	IWÞ²¥‹žr‡‹šÖ”ž²™ÍÛ'Њ”‹Q:lÂ(rFÒ.lÜØ]�ŽD)™úïè D‰4¾ˆ/Üâ˜kæÌ¡•gá´ÇMÐâ!¯òVË;ħDƒ‚þC^5ã
-y 	¥jœgØŠX^5;¤;ðÊÞçL†´ºçÙ&ß_±ÃßK‹W°„KËÝ9I€¦Ô’
-´8å뜊NUÿÞ$ $ß÷yuå¤�äÈkWDðKúèu…5Ø…uˆÞÅpï(¸V¿
-¦c �g÷õ¡È�~pvE1-˜‡b�x‘B¯øK@�ëÍv?ƒÉ	öŠ(QãâÔ
q²	ñä°í��h8õìŠÜÑVÇ=ž¶]KL
må?ˆ$ÑÉÑÚT¶®Qôà£ê¦èÀò‡½ž½r·Äœ¨T°ï5PúÄeã
26·'鞨òî¹nq²9v�]c'ç›"˜z+<ñT›,ÈÀno»7]>Üô‹,oò*ƒìÇ=ØøÝ…y¨h¿‚æž9ŽæÒÿÄ%ŸÙÇn¯Çô£KI)|_äæåÁ
P®ľÉÍúõ¦¶Öl0Ȥ¼Ó·
-—ëE»i�PÛKȬ8Ž±±ŽÕê8ÅþØ Œ28žFVhi�Ñ4Çõ=¬ûñjÀ@m!cß�˜˜ÊB}
‡”ú1érÂÛ17zûxh‚=»“>ž1ä9<À¼ܪ±!xO—H^ëB]þ¸`ºHê�ë>Ôøké?~�ø¥¡Ð
çYÓë‹yíq
-¯-÷¢¼ò”¤Ã»ì?\O�w™À«øõ7)O‘
-„¥zŠ¿Ð¼á¾Tý_õ 9·endstream
+xÚ¥VK�Û6¾ûWè(Ç(QÇÍÖ›:(vÛ�{i’mѶ°zU’³q}‡J~¬ƒ¢(ÎŒ†óüfLPøc�’„Š,Ò,&’2lª
vðíÃŒy�hTŠÎµÞ¯fïDd$Kx¬¶g¶¡J±`•ï¹ûmµxžG\Ò0!óH&4|¿|ü%÷O�Ë<ßÍÓ8\-ŸQü¼xX</ïóˆ‰Xr0 ¼‰?Ÿ¨ô°üu1ÿºú8[¬¦�ÏÓbTØxÿš}þJƒ²û8£DdJ¯ÀP²ŒÕ,–‚ÈXˆQRÎ>Í~Ÿž}uWo•I
+E¤âé�:qq«N2#‰€O¶N;S›N&ŸG"‰Ã/TÒb‹ô0gá¾è‘Ù6]¥¤GYßšMñ…R>Þ^í)ÂaoleÀ?;óéÙèRˆÚz®t?˜Î^/MäÍ㥋 9áT�wšv(š‚dèðuoêž’˜P'þR­+ð­i“„¥Êk凪õyÙðñwS»D‚H(h€â*ˆ#™”ÜÝÙ4õ`ê¡G@è-䃤»è¨¡Óu¿å�?]Üx©mËcQï�k»bT9´9´¥'Î?¿)É`ý.¡CœÆ¡ÆÃ{£¶}¶šHõ…Òº¨uwDzl¦¥kcòÉJ×]zºÉ]k7ÚVü'2ÃÉM×{¦:ŒÔÚy–¶,ß
+~¸ˆ/›Z¹K<æaßà9ìµ—ãiG2¡î‘¯4@µM7èµràÆïmÓ÷ÅAÇWf¸Ý+•îŠòˆ¬ù›1d½û(ÖÞ&Ï)ê¾ÈÍ£Á�z€‡öVi.Sì�°Û+˜¬$IÂem·©º(u’9·VÁ@J(Ó(Â…fãB³Ò¢öov‘0Eÿ†˜„ÆoF›�TúÅ\Ärª·®õæåÐú|¶§xœ`šsø©v-°_¡8
+<%ŒÉør³!˜ìüX0]
µŸõ«	Ÿvü­ñï@0âu46-Z`Ð]‹G8tK�üè#$±o��ø÷íþßOœÓ3/Ná7VñÛ¯A¢x–ŽAÙê)qùôzú?ro«³endstream
 endobj
-1469 0 obj <<
+1474 0 obj <<
 /Type /Page
-/Contents 1470 0 R
-/Resources 1468 0 R
+/Contents 1475 0 R
+/Resources 1473 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
->> endobj
-1471 0 obj <<
-/D [1469 0 R /XYZ 56.6929 794.5015 null]
->> endobj
-522 0 obj <<
-/D [1469 0 R /XYZ 56.6929 741.6375 null]
+/Parent 1445 0 R
 >> endobj
-1302 0 obj <<
-/D [1469 0 R /XYZ 56.6929 717.2979 null]
+1476 0 obj <<
+/D [1474 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1468 0 obj <<
+1473 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1474 0 obj <<
+1479 0 obj <<
+/Length 69        
+/Filter /FlateDecode
+>>
+stream
+xÚ3T0
+endobj
+1478 0 obj <<
+/Type /Page
+/Contents 1479 0 R
+/Resources 1477 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1445 0 R
+>> endobj
+1480 0 obj <<
+/D [1478 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1477 0 obj <<
+/ProcSet [ /PDF ]
+>> endobj
+1483 0 obj <<
 /Length 1368      
 /Filter /FlateDecode
 >>
@@ -6408,35 +6457,35 @@ stream
 xÚ•]oÛ6ð=¿ÂÈ“Ä)ês}jÓvëPCã>­{ eÚ*‰šD%͆þ÷ñx¤,Ǫ·À0t<ïŽ÷M¶ æÇYL(Ï£EšG$¦,^õ]ìÍÞÏWÌÑD1'qĹYÌì®bž‘8ÓÅjÊäÍúêö}È!%IÆ‹õn”•¤)ÉÒ8_¬·wÑjÙ-WaLƒtùçúW<‘4K£FDB²(Ïì�7~{‹Ô9~îe1t¥~ÂÕ�júr+;¡K�üXDx”„Ž_‘Œå¨@JØrÅ(¥Áë¢�}?²Ñ�ªpñ±ìµgÅ9É“0qœ8%!��Óñ|Œç—,�Gäxؽ/4¦¯ï>öæËn
 Ñ ÐK·5´Žg³E )‹¯�¨�¨�ê�n7èaªÃÐ; lFž\œ1’Çqh/.ªJ=®¥ËÝÓŒ™Œ÷¢(MÍ) ¾™á‘<cÜ ·¿ÙÍ2‹�#Cö2f„Hob†aÊÏXòn*Q|=¨JΰŠLX…ì…Õ�hú�É€s~&LY–U³Á(uA€ÖÄ	£Inœ‘‘<7‚�ìs_6{Cš˜€6A†�å`Œh…߃x�}¡4ll2&,(Ô’Ó(68õ€»4x<¸Ós Ç?Êpt.ÖÔËN§‘½IƒÇRÔ ›jЦ€îp¹g†a<ò5P¡Ðv�+
 ôU”N|æ$LŒ/ÐW{¥¶îÌVŠ¹Pa$ËSÆà	 ¶Y
-ýM#
+ýM#
 endobj
-1473 0 obj <<
+1482 0 obj <<
 /Type /Page
-/Contents 1474 0 R
-/Resources 1472 0 R
+/Contents 1483 0 R
+/Resources 1481 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
+/Parent 1487 0 R
 >> endobj
-1475 0 obj <<
-/D [1473 0 R /XYZ 85.0394 794.5015 null]
+1484 0 obj <<
+/D [1482 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 526 0 obj <<
-/D [1473 0 R /XYZ 85.0394 769.5949 null]
+/D [1482 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1476 0 obj <<
-/D [1473 0 R /XYZ 85.0394 574.5824 null]
+1485 0 obj <<
+/D [1482 0 R /XYZ 85.0394 574.5824 null]
 >> endobj
 530 0 obj <<
-/D [1473 0 R /XYZ 85.0394 574.5824 null]
+/D [1482 0 R /XYZ 85.0394 574.5824 null]
 >> endobj
-1477 0 obj <<
-/D [1473 0 R /XYZ 85.0394 544.7049 null]
+1486 0 obj <<
+/D [1482 0 R /XYZ 85.0394 544.7049 null]
 >> endobj
-1472 0 obj <<
+1481 0 obj <<
 /Font << /F21 658 0 R /F23 682 0 R /F47 879 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1480 0 obj <<
+1490 0 obj <<
 /Length 3343      
 /Filter /FlateDecode
 >>
@@ -6452,96 +6501,96 @@ QØ´£³À›ÐÉ^Å‚³É
 \Tü·”Ã'ºm¶†É«üØ×qêðÀöæ0gUOÖ¨I2ı?¸ƒœœÚåJ…Ü.GòÖô›¦àe0
Š4N×

 @µÜœÖh¹»†X܃s]àŒ®$�Áý"pó³Š�å$ƒÑâøé
žnˆ-”üáƒdX–ɺÒ20~¦fÐÚ,väï«®áoúa©™ñ|¶ø˜´x¾hÃÓØó¥6lB¦ðªfTª|)høÍÌö‰Ú¦±�$Û1¡Z,ÎOÖÊñ
]º*{aÖáÃ
 ìÍ´phÛŽ0<PyÇEØHêRð†vc¿Œ)qZÒ6ƒz¬�2üœzÚfdN‹�m.A�œõ=궠‡+¦vC5:7ÕÈ44Ã3ç²@°»¾£ñ€ñÔðuE�÷H�è[Ë„(Þ
¿o›!~¼ðl2\½`Ï `›
-.
júl?Qëœ&=aÏl7úReQnï¾�›îù†b:óÄ'ž·�ÍÉÖ|:‹�b}Y±C¦}CL˜õmÿnmóÀÀ‹
|c›ÜVA¨ÁèfÅÒóö¸ë›u›í6®×€�³=¬ ÆöCoXЊçØš¬ž>[4A
+.
júl?Qëœ&=aÏl7úReQnï¾�›îù†b:óÄ'ž·�ÍÉÖ|:‹�b}Y±C¦}CL˜õmÿnmóÀÀ‹
|c›ÜVA¨ÁèfÅÒóö¸ë›u›í6®×€�³=¬ ÆöCoXЊçØš¬ž>[4A
 endobj
-1479 0 obj <<
+1489 0 obj <<
 /Type /Page
-/Contents 1480 0 R
-/Resources 1478 0 R
+/Contents 1490 0 R
+/Resources 1488 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1452 0 R
-/Annots [ 1485 0 R ]
+/Parent 1487 0 R
+/Annots [ 1495 0 R ]
 >> endobj
-1485 0 obj <<
+1495 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [63.4454 757.0719 452.088 767.2337]
 /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-1999.004.dns_dos)>>
 >> endobj
-1481 0 obj <<
-/D [1479 0 R /XYZ 56.6929 794.5015 null]
+1491 0 obj <<
+/D [1489 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 534 0 obj <<
-/D [1479 0 R /XYZ 56.6929 739.5018 null]
+/D [1489 0 R /XYZ 56.6929 739.5018 null]
 >> endobj
-1486 0 obj <<
-/D [1479 0 R /XYZ 56.6929 704.7645 null]
+1496 0 obj <<
+/D [1489 0 R /XYZ 56.6929 704.7645 null]
 >> endobj
 538 0 obj <<
-/D [1479 0 R /XYZ 56.6929 563.5308 null]
+/D [1489 0 R /XYZ 56.6929 563.5308 null]
 >> endobj
-1487 0 obj <<
-/D [1479 0 R /XYZ 56.6929 535.7626 null]
+1497 0 obj <<
+/D [1489 0 R /XYZ 56.6929 535.7626 null]
 >> endobj
 542 0 obj <<
-/D [1479 0 R /XYZ 56.6929 418.2412 null]
+/D [1489 0 R /XYZ 56.6929 418.2412 null]
 >> endobj
-1488 0 obj <<
-/D [1479 0 R /XYZ 56.6929 389.5504 null]
+1498 0 obj <<
+/D [1489 0 R /XYZ 56.6929 389.5504 null]
 >> endobj
 546 0 obj <<
-/D [1479 0 R /XYZ 56.6929 228.1296 null]
+/D [1489 0 R /XYZ 56.6929 228.1296 null]
 >> endobj
-1235 0 obj <<
-/D [1479 0 R /XYZ 56.6929 194.8993 null]
+1241 0 obj <<
+/D [1489 0 R /XYZ 56.6929 194.8993 null]
 >> endobj
-1478 0 obj <<
-/Font << /F37 747 0 R /F67 1484 0 R /F11 1298 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F53 962 0 R /F48 885 0 R /F62 995 0 R /F63 998 0 R >>
+1488 0 obj <<
+/Font << /F37 747 0 R /F67 1494 0 R /F11 1304 0 R /F39 863 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F53 962 0 R /F48 885 0 R /F62 995 0 R /F63 998 0 R >>
 /XObject << /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1491 0 obj <<
+1501 0 obj <<
 /Length 533       
 /Filter /FlateDecode
 >>
 stream
-xÚ¥TM�›0½ó+|©¸6Æ`³IÚ²RÓ4a«ÕxT‚Ó@6Úýõµ3·¶ôTEóÆoÞ|x€"b~	Ž	“1JeŒ9¡•[� µ9ûêQÇ	Ϥð–u—{Ÿ¿°I,“(AùË�–ÀDŠòêÉÍóé"#Nü!Oˆ—Í&à‘ðXNÇ‹,4þ1[f“éb¤±Ÿga,ˆ0ñÌ)Lg£ïÙøó	P§Ôžó{oš_¹m–f»øí==T™žï=‚™
 ˜J¡­s†yÌØÙÓxKïçEðæô:4<Îæ"J¦±¡éq‰fŽìô–z«lO‰ßÕ½êÀ,7ZwÎÝkûäþ/¥và)šŒê­-¶uið[xØUE¯*8˜ØyžE_€U· ã`wXUz[€×H¶.²R�Z!—{Sô7üÐŽÛôRŠ%çÑ©
'ÂTÊä)…��Ú{�2è]·ÊÜ,#‰Ÿoê˜Çâ- ”úŸŒ‰I§Àßë]بWÕ\cÁ*uÛ›|u»vx_÷v
+xÚ¥TM�›0½ó+|©¸6Æ`³IÚ²RÓ4a«ÕxT‚Ó@6Úýõµ3·¶ôTEóÆoÞ|x€"b~	Ž	“1JeŒ9¡•[� µ9ûêQÇ	Ϥð–u—{Ÿ¿°I,“(AùË�–ÀDŠòêÉÍóé"#Nü!Oˆ—Í&à‘ðXNÇ‹,4þ1[f“éb¤±Ÿga,ˆ0ñÌ)Lg£ïÙøó	P§Ôžó{oš_¹m–f»øí==T™žï=‚™
 ˜J¡­s†yÌØÙÓxKïçEðæô:4<Îæ"J¦±¡éq‰fŽìô–z«lO‰ßÕ½êÀ,7ZwÎÝkûäþ/¥và)šŒê­-¶uið[xØUE¯*8˜ØyžE_€U· ã`wXUz[€×H¶.²R�Z!—{Sô7üÐŽÛôRŠ%çÑ©
'ÂTÊä)…��Ú{�2è]·ÊÜ,#‰Ÿoê˜Çâ- ”úŸŒ‰I§Àßë]بWÕ\cÁ*uÛ›|u»vx_÷v
 endobj
-1490 0 obj <<
+1500 0 obj <<
 /Type /Page
-/Contents 1491 0 R
-/Resources 1489 0 R
+/Contents 1501 0 R
+/Resources 1499 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
+/Parent 1487 0 R
 >> endobj
-1492 0 obj <<
-/D [1490 0 R /XYZ 85.0394 794.5015 null]
+1502 0 obj <<
+/D [1500 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1489 0 obj <<
+1499 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1496 0 obj <<
+1505 0 obj <<
 /Length 69        
 /Filter /FlateDecode
 >>
 stream
 xÚ3T0
 endobj
-1495 0 obj <<
+1504 0 obj <<
 /Type /Page
-/Contents 1496 0 R
-/Resources 1494 0 R
+/Contents 1505 0 R
+/Resources 1503 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
+/Parent 1487 0 R
 >> endobj
-1497 0 obj <<
-/D [1495 0 R /XYZ 56.6929 794.5015 null]
+1506 0 obj <<
+/D [1504 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1494 0 obj <<
+1503 0 obj <<
 /ProcSet [ /PDF ]
 >> endobj
-1500 0 obj <<
+1509 0 obj <<
 /Length 1964      
 /Filter /FlateDecode
 >>
@@ -6553,86 +6602,86 @@ i	·¥Ý3éÀ–yíˆùðŠ&�Â8K<æc�ø¡›‚hïCû™<»úÐŒ­êhüýÔï Æס\@�•‰ó÷w= vV
 ýf3GÕ51b‘æi‘diNŒ�‘Œâ�±ˆ±0·"ð0àâÄßZÕ7’\sÂw
"ó‡&0ÍåþF
—?$cRÍZº”í(õåŠ:é�H^�04g¢°û(½ÀÙWáÓ
7�˜¿S,[>°úŒ¹…;î3`ô¦'b�ÕÀ¤Ö^ïöEy˜]¹œ­Þv‹íçÞa¯Úák@n@þzh|ÇütÓOÓ0J¿mºã—¿ÞeÚâš(°ÁiÇEðá
êÍ�âÀz҃ѣm§žæˆ§çOŒ$ 
 ­è×ØÚ:‰óÎÐÃBYn?z·XdÌqâd¾©Üä¤ÚNí:ørðï»QÕaáƒL·CÕMucVìâªV.Wª�4 Û8Hü»Uoy)”@»Zìo+B)ˆ×­©ôD9ƒ©;B.ÊõTyåvÂ)Î6™îZds§¡ÁÓÏMí­µ°r=¶ö�ä&vÓž®é^/yr€�¡¶¯ÓP;«y Â1{9B€FãŸà{ËוÂM>p\×-ž‘7>å	èWˆÌ¨W
 ¥Ìrcø-Š¼ûãËü
-“¤%œ¡i±Iæ² —â~ÚøÑŸ/¯6³Âv¡ám’rá÷Î.zïá°ú‹EØûÛxà8KQ”×ñܼÍBw1\­ýÎÆð»•s^ÀÍQŠ’säjMkç/Ú,ÜÚmR¡ÈEz�ís³ã¾‡ê
+“¤%œ¡i±Iæ² —â~ÚøÑŸ/¯6³Âv¡ám’rá÷Î.zïá°ú‹EØûÛxà8KQ”×ñܼÍBw1\­ýÎÆð»•s^ÀÍQŠ’säjMkç/Ú,ÜÚmR¡ÈEz�ís³ã¾‡ê
 endobj
-1499 0 obj <<
+1508 0 obj <<
 /Type /Page
-/Contents 1500 0 R
-/Resources 1498 0 R
+/Contents 1509 0 R
+/Resources 1507 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
-/Annots [ 1507 0 R 1508 0 R ]
+/Parent 1487 0 R
+/Annots [ 1516 0 R 1517 0 R ]
 >> endobj
-1507 0 obj <<
+1516 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [348.3486 128.9523 463.9152 141.0119]
 /Subtype/Link/A<</Type/Action/S/URI/URI(mailto:info@isc.org)>>
 >> endobj
-1508 0 obj <<
+1517 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [147.3629 116.9971 364.5484 129.0567]
 /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.isc.org/services/support/)>>
 >> endobj
-1501 0 obj <<
-/D [1499 0 R /XYZ 85.0394 794.5015 null]
+1510 0 obj <<
+/D [1508 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 550 0 obj <<
-/D [1499 0 R /XYZ 85.0394 769.5949 null]
+/D [1508 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1502 0 obj <<
-/D [1499 0 R /XYZ 85.0394 576.7004 null]
+1511 0 obj <<
+/D [1508 0 R /XYZ 85.0394 576.7004 null]
 >> endobj
 554 0 obj <<
-/D [1499 0 R /XYZ 85.0394 576.7004 null]
+/D [1508 0 R /XYZ 85.0394 576.7004 null]
 >> endobj
-1503 0 obj <<
-/D [1499 0 R /XYZ 85.0394 548.3785 null]
+1512 0 obj <<
+/D [1508 0 R /XYZ 85.0394 548.3785 null]
 >> endobj
 558 0 obj <<
-/D [1499 0 R /XYZ 85.0394 548.3785 null]
+/D [1508 0 R /XYZ 85.0394 548.3785 null]
 >> endobj
-1504 0 obj <<
-/D [1499 0 R /XYZ 85.0394 518.5228 null]
+1513 0 obj <<
+/D [1508 0 R /XYZ 85.0394 518.5228 null]
 >> endobj
 562 0 obj <<
-/D [1499 0 R /XYZ 85.0394 460.6968 null]
+/D [1508 0 R /XYZ 85.0394 460.6968 null]
 >> endobj
-1505 0 obj <<
-/D [1499 0 R /XYZ 85.0394 425.0333 null]
+1514 0 obj <<
+/D [1508 0 R /XYZ 85.0394 425.0333 null]
 >> endobj
 566 0 obj <<
-/D [1499 0 R /XYZ 85.0394 260.2468 null]
+/D [1508 0 R /XYZ 85.0394 260.2468 null]
 >> endobj
-1506 0 obj <<
-/D [1499 0 R /XYZ 85.0394 224.698 null]
+1515 0 obj <<
+/D [1508 0 R /XYZ 85.0394 224.698 null]
 >> endobj
-1498 0 obj <<
-/Font << /F21 658 0 R /F23 682 0 R /F11 1298 0 R /F39 863 0 R >>
+1507 0 obj <<
+/Font << /F21 658 0 R /F23 682 0 R /F11 1304 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1511 0 obj <<
+1520 0 obj <<
 /Length 69        
 /Filter /FlateDecode
 >>
 stream
 xÚ3T0
 endobj
-1510 0 obj <<
+1519 0 obj <<
 /Type /Page
-/Contents 1511 0 R
-/Resources 1509 0 R
+/Contents 1520 0 R
+/Resources 1518 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
+/Parent 1487 0 R
 >> endobj
-1512 0 obj <<
-/D [1510 0 R /XYZ 56.6929 794.5015 null]
+1521 0 obj <<
+/D [1519 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1509 0 obj <<
+1518 0 obj <<
 /ProcSet [ /PDF ]
 >> endobj
-1515 0 obj <<
+1524 0 obj <<
 /Length 2543      
 /Filter /FlateDecode
 >>
@@ -6645,41 +6694,41 @@ RÜŠ1ÏuL~”6�`l�¿‚~ZѨ¢<ÓCƒÚ̓
 ’
r�”OœBç=Á	1j"«¢ºÑpQɧUäzý"GöÄÙ	G,ØÝfS6äÐBdz˜€z²Ó„Q™DÏ
B0q
 �ã”U#7Cã@Q²€.ÿ¾ô
 ÝD‘øñðñ^=:\è±æí
-®o¬ƒñ+ñ'E\2}8Ç’;i%Ò‡ï&ª°Wõ\~jÀaÛÍ{³˜¢GË!zeoA
_�^†NmÞxš^Xð”Ð;’ù‚Ïr{z8Ø'"Hóȃ…×UØNÑô�
+®o¬ƒñ+ñ'E\2}8Ç’;i%Ò‡ï&ª°Wõ\~jÀaÛÍ{³˜¢GË!zeoA
_�^†NmÞxš^Xð”Ð;’ù‚Ïr{z8Ø'"Hóȃ…×UØNÑô�
 endobj
-1514 0 obj <<
+1523 0 obj <<
 /Type /Page
-/Contents 1515 0 R
-/Resources 1513 0 R
+/Contents 1524 0 R
+/Resources 1522 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
+/Parent 1529 0 R
 >> endobj
-1516 0 obj <<
-/D [1514 0 R /XYZ 85.0394 794.5015 null]
+1525 0 obj <<
+/D [1523 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 570 0 obj <<
-/D [1514 0 R /XYZ 85.0394 769.5949 null]
+/D [1523 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
-1517 0 obj <<
-/D [1514 0 R /XYZ 85.0394 573.5449 null]
+1526 0 obj <<
+/D [1523 0 R /XYZ 85.0394 573.5449 null]
 >> endobj
 574 0 obj <<
-/D [1514 0 R /XYZ 85.0394 573.5449 null]
+/D [1523 0 R /XYZ 85.0394 573.5449 null]
 >> endobj
-1518 0 obj <<
-/D [1514 0 R /XYZ 85.0394 539.0037 null]
+1527 0 obj <<
+/D [1523 0 R /XYZ 85.0394 539.0037 null]
 >> endobj
 578 0 obj <<
-/D [1514 0 R /XYZ 85.0394 539.0037 null]
+/D [1523 0 R /XYZ 85.0394 539.0037 null]
 >> endobj
-1519 0 obj <<
-/D [1514 0 R /XYZ 85.0394 510.2426 null]
+1528 0 obj <<
+/D [1523 0 R /XYZ 85.0394 510.2426 null]
 >> endobj
-1513 0 obj <<
+1522 0 obj <<
 /Font << /F21 658 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1522 0 obj <<
+1532 0 obj <<
 /Length 2893      
 /Filter /FlateDecode
 >>
@@ -6694,67 +6743,67 @@ hfáyN†¾9fùVT²"ŸFÒÐg[Ø>k$ŒÓ­%ya4P’~¯$œø#Ìùp
 ©—´¦5õÃD 	œ$ŒlH„r«å&Âçݳ5º?¾·hdµÁk+ §/-UçI0>
 è¾ÏÝG$”uf,Õ­DC¡Æüx¾;˜t
 (–
"—ÜYi4¹B™º¦qfèY'ÉíŽÑ–�\z
¬nÌ\³&ÊKŸ	‰•v(Äð1“‘㣓Æ|ÒØŠž«�ˈ�p}µ6eè£[SWöj›ŸMñ¢Âú`K@®Ö j]¼©VP%Û
-·KÊÿóWÞþCw;"Iüé¸~œ8
Ô¥V(<AêžHn?ŸŠþ_`Ý2ƒendstream
+·KÊÿóWÞþCw;"Iüé¸~œ8
Ô¥V(<AêŸHn?ŸŠþ_a52…endstream
 endobj
-1521 0 obj <<
+1531 0 obj <<
 /Type /Page
-/Contents 1522 0 R
-/Resources 1520 0 R
+/Contents 1532 0 R
+/Resources 1530 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1493 0 R
-/Annots [ 1526 0 R 1527 0 R ]
+/Parent 1529 0 R
+/Annots [ 1536 0 R 1537 0 R ]
 >> endobj
-1526 0 obj <<
+1536 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [253.7995 146.8976 417.685 158.9572]
 /Subtype/Link/A<</Type/Action/S/URI/URI(ftp://www.isi.edu/in-notes/)>>
 >> endobj
-1527 0 obj <<
+1537 0 obj <<
 /Type /Annot
 /Border[0 0 0]/H/I/C[0 1 1]
 /Rect [63.4454 108.9117 208.8999 119.0735]
 /Subtype/Link/A<</Type/Action/S/URI/URI(http://www.ietf.org/rfc/)>>
 >> endobj
-1523 0 obj <<
-/D [1521 0 R /XYZ 56.6929 794.5015 null]
+1533 0 obj <<
+/D [1531 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 582 0 obj <<
-/D [1521 0 R /XYZ 56.6929 652.1213 null]
+/D [1531 0 R /XYZ 56.6929 652.1213 null]
 >> endobj
-1524 0 obj <<
-/D [1521 0 R /XYZ 56.6929 614.8935 null]
+1534 0 obj <<
+/D [1531 0 R /XYZ 56.6929 614.8935 null]
 >> endobj
 586 0 obj <<
-/D [1521 0 R /XYZ 56.6929 614.8935 null]
+/D [1531 0 R /XYZ 56.6929 614.8935 null]
 >> endobj
 1072 0 obj <<
-/D [1521 0 R /XYZ 56.6929 584.5024 null]
+/D [1531 0 R /XYZ 56.6929 584.5024 null]
 >> endobj
 590 0 obj <<
-/D [1521 0 R /XYZ 56.6929 289.5256 null]
+/D [1531 0 R /XYZ 56.6929 289.5256 null]
 >> endobj
-1525 0 obj <<
-/D [1521 0 R /XYZ 56.6929 251.3901 null]
+1535 0 obj <<
+/D [1531 0 R /XYZ 56.6929 251.3901 null]
 >> endobj
 594 0 obj <<
-/D [1521 0 R /XYZ 56.6929 251.3901 null]
+/D [1531 0 R /XYZ 56.6929 251.3901 null]
 >> endobj
 900 0 obj <<
-/D [1521 0 R /XYZ 56.6929 222.7156 null]
+/D [1531 0 R /XYZ 56.6929 222.7156 null]
 >> endobj
-1528 0 obj <<
-/D [1521 0 R /XYZ 56.6929 53.7852 null]
+1538 0 obj <<
+/D [1531 0 R /XYZ 56.6929 53.7852 null]
 >> endobj
-1529 0 obj <<
-/D [1521 0 R /XYZ 56.6929 53.7852 null]
+1539 0 obj <<
+/D [1531 0 R /XYZ 56.6929 53.7852 null]
 >> endobj
-1520 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F11 1298 0 R /F39 863 0 R >>
+1530 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F11 1304 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1532 0 obj <<
-/Length 2825      
+1542 0 obj <<
+/Length 2824      
 /Filter /FlateDecode
 >>
 stream
@@ -6766,870 +6815,872 @@ lðÇ"¿–EWrܧ¹®ÈŒÆe‚©£G²I¥¯ÃC$d´ß
fÇø«`VØôëžêÞ^"ˆ|nÝÛRú7RF÷‘洞�Ð�îÏ°ûuß_&
 ¶º/ÓÃi&·hÞêß¡fÔ_¦/Å«=sß²²~e|–pu?øCœejîú*ló£ýû›<€æ©»¿Ù4ª
mõÖÒwm{RßCKqšµ-5lÖFʘ5!³vB7f}†ÝoÖ-ð»|SÛ˜n+Ÿ“²È^µ¢—§Ã¡8Vgçr1ëËÔ
ƒØ±þØ?+ò£¡zž¬Ûá†
 ±ŠSzIï–”CïZÊè=¢Ô¡w´¥÷.ö€ÞmðÕNFƒ”/
]xœ½•i)Źµfk
®ÕÖ\éL ®íLÐð©p’f¯M¬Šxõ%Í´Ü-ƒ‹g=	�P’Š�àã@wFªžV‹¶êi Ó$“pŒ"^Ø#µ¥†É4RšLßs‘é„nÈ<Ãî'³^Ìí¼€y¾U
É|\lN*²‹ÑZÁBX”disæлsùбØÅ”ÕĈç§òYèzº†11ú FŒ�ª;òdw$^æ!.ËDGn¹9ª [œ6LjHp•IÿnÐφé0
 =|a¿Ô–rЯ¥,ú1Ô	mÑßÅ ßWgU±.Ä.øÌC±él FD¥oíÕbD&&áÈMb‚;¹û}nýlŸ3C¯îs;s,“&,Ú63a;²}PâÚ,”G«•[ìëÞ2–Îñò_´¨‚™èÌÝvaI9ìBK5vá;΃�Ж]t±ì¹TÖó¢8„È#ëB”õMm”F*ÊSU׉‹ÆÄ�Ù�ì5,>}ñ­}ʸÞ´#š‰È21ú ÄMŒƒsu\bZFñ÷ÃY
‚©À²¸ ¡£ùÈ

-’Xï*
+’Xï*
 endobj
-1531 0 obj <<
+1541 0 obj <<
 /Type /Page
-/Contents 1532 0 R
-/Resources 1530 0 R
+/Contents 1542 0 R
+/Resources 1540 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
->> endobj
-1533 0 obj <<
-/D [1531 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-1534 0 obj <<
-/D [1531 0 R /XYZ 85.0394 752.3015 null]
->> endobj
-1535 0 obj <<
-/D [1531 0 R /XYZ 85.0394 752.3015 null]
->> endobj
-1536 0 obj <<
-/D [1531 0 R /XYZ 85.0394 752.3015 null]
->> endobj
-1537 0 obj <<
-/D [1531 0 R /XYZ 85.0394 746.3107 null]
->> endobj
-1538 0 obj <<
-/D [1531 0 R /XYZ 85.0394 731.5461 null]
->> endobj
-1539 0 obj <<
-/D [1531 0 R /XYZ 85.0394 728.1497 null]
->> endobj
-1540 0 obj <<
-/D [1531 0 R /XYZ 85.0394 713.3851 null]
->> endobj
-1541 0 obj <<
-/D [1531 0 R /XYZ 85.0394 709.9887 null]
->> endobj
-1542 0 obj <<
-/D [1531 0 R /XYZ 85.0394 651.9592 null]
->> endobj
-1016 0 obj <<
-/D [1531 0 R /XYZ 85.0394 651.9592 null]
+/Parent 1529 0 R
 >> endobj
 1543 0 obj <<
-/D [1531 0 R /XYZ 85.0394 651.9592 null]
+/D [1541 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1544 0 obj <<
-/D [1531 0 R /XYZ 85.0394 648.8377 null]
+/D [1541 0 R /XYZ 85.0394 752.3015 null]
 >> endobj
 1545 0 obj <<
-/D [1531 0 R /XYZ 85.0394 634.0731 null]
+/D [1541 0 R /XYZ 85.0394 752.3015 null]
 >> endobj
 1546 0 obj <<
-/D [1531 0 R /XYZ 85.0394 630.6767 null]
+/D [1541 0 R /XYZ 85.0394 752.3015 null]
 >> endobj
 1547 0 obj <<
-/D [1531 0 R /XYZ 85.0394 615.9121 null]
+/D [1541 0 R /XYZ 85.0394 746.3107 null]
 >> endobj
 1548 0 obj <<
-/D [1531 0 R /XYZ 85.0394 612.5156 null]
+/D [1541 0 R /XYZ 85.0394 731.5461 null]
 >> endobj
 1549 0 obj <<
-/D [1531 0 R /XYZ 85.0394 585.7959 null]
+/D [1541 0 R /XYZ 85.0394 728.1497 null]
 >> endobj
 1550 0 obj <<
-/D [1531 0 R /XYZ 85.0394 582.3994 null]
+/D [1541 0 R /XYZ 85.0394 713.3851 null]
 >> endobj
 1551 0 obj <<
-/D [1531 0 R /XYZ 85.0394 567.6349 null]
+/D [1541 0 R /XYZ 85.0394 709.9887 null]
 >> endobj
 1552 0 obj <<
-/D [1531 0 R /XYZ 85.0394 564.2384 null]
+/D [1541 0 R /XYZ 85.0394 651.9592 null]
+>> endobj
+1016 0 obj <<
+/D [1541 0 R /XYZ 85.0394 651.9592 null]
 >> endobj
 1553 0 obj <<
-/D [1531 0 R /XYZ 85.0394 549.5337 null]
+/D [1541 0 R /XYZ 85.0394 651.9592 null]
 >> endobj
 1554 0 obj <<
-/D [1531 0 R /XYZ 85.0394 546.0774 null]
+/D [1541 0 R /XYZ 85.0394 648.8377 null]
 >> endobj
 1555 0 obj <<
-/D [1531 0 R /XYZ 85.0394 531.3128 null]
+/D [1541 0 R /XYZ 85.0394 634.0731 null]
 >> endobj
 1556 0 obj <<
-/D [1531 0 R /XYZ 85.0394 527.9163 null]
+/D [1541 0 R /XYZ 85.0394 630.6767 null]
 >> endobj
 1557 0 obj <<
-/D [1531 0 R /XYZ 85.0394 513.1518 null]
+/D [1541 0 R /XYZ 85.0394 615.9121 null]
 >> endobj
 1558 0 obj <<
-/D [1531 0 R /XYZ 85.0394 509.7553 null]
+/D [1541 0 R /XYZ 85.0394 612.5156 null]
 >> endobj
 1559 0 obj <<
-/D [1531 0 R /XYZ 85.0394 483.0356 null]
+/D [1541 0 R /XYZ 85.0394 585.7959 null]
 >> endobj
 1560 0 obj <<
-/D [1531 0 R /XYZ 85.0394 479.6391 null]
+/D [1541 0 R /XYZ 85.0394 582.3994 null]
 >> endobj
 1561 0 obj <<
-/D [1531 0 R /XYZ 85.0394 464.8745 null]
+/D [1541 0 R /XYZ 85.0394 567.6349 null]
 >> endobj
 1562 0 obj <<
-/D [1531 0 R /XYZ 85.0394 461.4781 null]
+/D [1541 0 R /XYZ 85.0394 564.2384 null]
 >> endobj
 1563 0 obj <<
-/D [1531 0 R /XYZ 85.0394 446.7135 null]
+/D [1541 0 R /XYZ 85.0394 549.5337 null]
 >> endobj
 1564 0 obj <<
-/D [1531 0 R /XYZ 85.0394 443.3171 null]
+/D [1541 0 R /XYZ 85.0394 546.0774 null]
 >> endobj
 1565 0 obj <<
-/D [1531 0 R /XYZ 85.0394 428.5525 null]
+/D [1541 0 R /XYZ 85.0394 531.3128 null]
 >> endobj
 1566 0 obj <<
-/D [1531 0 R /XYZ 85.0394 425.156 null]
+/D [1541 0 R /XYZ 85.0394 527.9163 null]
 >> endobj
 1567 0 obj <<
-/D [1531 0 R /XYZ 85.0394 355.0758 null]
+/D [1541 0 R /XYZ 85.0394 513.1518 null]
 >> endobj
 1568 0 obj <<
-/D [1531 0 R /XYZ 85.0394 355.0758 null]
+/D [1541 0 R /XYZ 85.0394 509.7553 null]
 >> endobj
 1569 0 obj <<
-/D [1531 0 R /XYZ 85.0394 355.0758 null]
+/D [1541 0 R /XYZ 85.0394 483.0356 null]
 >> endobj
 1570 0 obj <<
-/D [1531 0 R /XYZ 85.0394 352.0499 null]
+/D [1541 0 R /XYZ 85.0394 479.6391 null]
 >> endobj
 1571 0 obj <<
-/D [1531 0 R /XYZ 85.0394 337.3452 null]
+/D [1541 0 R /XYZ 85.0394 464.8745 null]
 >> endobj
 1572 0 obj <<
-/D [1531 0 R /XYZ 85.0394 333.8889 null]
+/D [1541 0 R /XYZ 85.0394 461.4781 null]
 >> endobj
 1573 0 obj <<
-/D [1531 0 R /XYZ 85.0394 309.8192 null]
+/D [1541 0 R /XYZ 85.0394 446.7135 null]
 >> endobj
 1574 0 obj <<
-/D [1531 0 R /XYZ 85.0394 303.7727 null]
+/D [1541 0 R /XYZ 85.0394 443.3171 null]
 >> endobj
 1575 0 obj <<
-/D [1531 0 R /XYZ 85.0394 278.3282 null]
+/D [1541 0 R /XYZ 85.0394 428.5525 null]
 >> endobj
 1576 0 obj <<
-/D [1531 0 R /XYZ 85.0394 273.6565 null]
+/D [1541 0 R /XYZ 85.0394 425.156 null]
 >> endobj
 1577 0 obj <<
-/D [1531 0 R /XYZ 85.0394 246.9367 null]
+/D [1541 0 R /XYZ 85.0394 355.0758 null]
 >> endobj
 1578 0 obj <<
-/D [1531 0 R /XYZ 85.0394 243.5403 null]
+/D [1541 0 R /XYZ 85.0394 355.0758 null]
 >> endobj
 1579 0 obj <<
-/D [1531 0 R /XYZ 85.0394 173.5556 null]
+/D [1541 0 R /XYZ 85.0394 355.0758 null]
 >> endobj
 1580 0 obj <<
-/D [1531 0 R /XYZ 85.0394 173.5556 null]
+/D [1541 0 R /XYZ 85.0394 352.0499 null]
 >> endobj
 1581 0 obj <<
-/D [1531 0 R /XYZ 85.0394 173.5556 null]
+/D [1541 0 R /XYZ 85.0394 337.3452 null]
 >> endobj
 1582 0 obj <<
-/D [1531 0 R /XYZ 85.0394 170.4341 null]
+/D [1541 0 R /XYZ 85.0394 333.8889 null]
 >> endobj
 1583 0 obj <<
-/D [1531 0 R /XYZ 85.0394 144.9896 null]
+/D [1541 0 R /XYZ 85.0394 309.8192 null]
 >> endobj
 1584 0 obj <<
-/D [1531 0 R /XYZ 85.0394 140.3179 null]
+/D [1541 0 R /XYZ 85.0394 303.7727 null]
 >> endobj
 1585 0 obj <<
-/D [1531 0 R /XYZ 85.0394 113.5982 null]
+/D [1541 0 R /XYZ 85.0394 278.3282 null]
 >> endobj
 1586 0 obj <<
-/D [1531 0 R /XYZ 85.0394 110.2017 null]
+/D [1541 0 R /XYZ 85.0394 273.6565 null]
 >> endobj
 1587 0 obj <<
-/D [1531 0 R /XYZ 85.0394 95.4372 null]
+/D [1541 0 R /XYZ 85.0394 246.9367 null]
 >> endobj
 1588 0 obj <<
-/D [1531 0 R /XYZ 85.0394 92.0407 null]
+/D [1541 0 R /XYZ 85.0394 243.5403 null]
 >> endobj
-1530 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
-/ProcSet [ /PDF /Text ]
+1589 0 obj <<
+/D [1541 0 R /XYZ 85.0394 173.5556 null]
+>> endobj
+1590 0 obj <<
+/D [1541 0 R /XYZ 85.0394 173.5556 null]
 >> endobj
-1592 0 obj <<
-/Length 2889      
-/Filter /FlateDecode
->>
-stream
-xÚµšÝw›:ÀßóWøÑ>§ÑEŸ�$v·‰›µ“·ÄVN0¤·Í¿#ô�À zwÏž<¤AƒõÓŒfFà‰xâùÈ�H4	"yö&Ûý™3ù}WgXÊœ+¡sSêâþì�÷4˜D(ò‰?¹2Æ
-‘†xr¿û2�E3Á™^,/n–Ÿ®ÖñÝõ_³sâ9Ó¿ωWsq³y¸ºZlîòv½ˆçËÕˆàÙyàGÎ4¾»[¬æË?EÌGutëåb3ûzÿálq¯_ÛüiØ¡ü�¿Ÿ}ùêLvð?œ9ˆF¡7ù	7ÂQD&û3×£Ès)U-ÙÙæì_z@£·~´wª°ƒõIÏ\<ÁEžGZ“åEȧ„Ö“µfeq<l™œ¶-;q}?ƒx{eå௤€°4¤ÄKÑ>€JŠ¿Ó—õûKŒCúµ«ÓávÕZêT·k.Lä‘ ­{Å~ÂÏÇt:_mÄÅz-ØߎCò´J‹¼ž“ÎOÁŽÓJ}x	>Ð;xŠ8ÓKô~‘)c,~°Ã‡ÓçäPÕxz#»âú?™Þ&ûä¥(eïZö>dÙ>És9h’ïDóÝ“H
~[l_’WVRxÞfB½Ò¹XÂ>>m«âÞ£¦‹ÎAC„ý(B¡ïŽ6¥†	k)M8püaÂVÕ
áݽ„[ºXøé«M|§–=7¦m½˜Aw‘�ä/�ø�Òü›¸˜øh²÷²ÈX–%ò™.w˜C
-jt¼G¯
~c¬�úqe×õ‚ÐZÂNû{ÞH`dJY¨*)Mû–}ÕªÚ ÚÕÝOÕÔý ,fBò‚‹e^±CÎ*q'€óþB6¤%ìe�ÇJŠß.ÿ\¬Ååe!ì?—Ï^eÅc’‰ëx·SÎC>—¼¾rå=FïFÈÅ.5ð»"ΫÊÎ¥Q+±ìØnŸÓbÀhÃA¼^è"⮯)5ŒWKxÃa¼VÕ
Þݽx[ºùš¥;¦~m|„Ó‡<å Dcg›…–åŽåUÊã*v(EÓQº|ª|9´i_Nµ/§V_NQzÔôå‘Ø„ù`Iž²L!|14Þ"å¿å£-Ô°Ge¼–b}Ì™ƒö¢ADG@RÐJJƒ&Ô±€¶©6@wu÷ƒ6udr�/~mŸ“ü›œˆ9ËØ7µw	±­Ã…àÉ¥W›¾È*ô ‘¡íÀJ…NqÕÚ#»±“…%Èuý1
-†”…‚’Ò`¯·P°©6(tu÷S0uÏ7±øé•�°b³¼’MiÞ�weG<úvÄv¤óc SçÀ=Û%uQømBsIh‘”U–¼0ÙLkCß½Sq±°ûgM,&†af0s�†”…˜’2ˆb6Õ±®î~b¦îõ&þãvîÁÎ(j4À2¢5~Å
ñÿb›E�7
-jõ’¿¡æG(p�ÐØå���n`s¿k°‰`F�ÔÊ'­0ÝÐA>Lº¦)5SK0-»�UuóDw/Ì–îMUê]
-GtzÉbƒà“•¼Í­ò¾š!oPy£`ȯC.1Â�P„!ílòç9Cþ¬izŽ§
-™z…ñ‹ORøê¸Û!¨•Á�¹Å´ñ´ÿÄr]ˆã�؆”¶’2`GØ6Õì®î~ئn;û\(â/‚Øô©ŽZίY]™½°9–¢?•-Òõ††ë�´ë

×�-€ÀE
ÄÒ†ë
¥ë�Züý–ëõñ‰
Ë�þ�	CºÑUCÊBUI5T]KcUmPíêî§jêž³*Ù>³Ý³1Šìݨ@ôà‚Ù¥ÔõþÏ[%…42ÂþSj�–Òh‚ÐR
-5 ‰¥ngÓk�ì(îGi(Ž›t]$ãk}4HøÑ`'¿¿IËJ¦žÂ÷:íbo¸·<xúÅJãPöîFé�= ààö–j¸^È«ŠíóI�Æ
-<¢8²3„†�)!
Ì‹,¥
›ÞXWq/0S±¨¡†þªX^Ö'•°;¢¦
-ÿËãëkq¨„ÐòN4þ`‡R”Í¡Ñï«Ì9~dl„.ñ¦$ž¸.ö"_à­—²õú˜‚­&²õ³.˜C×Ç2Í“¼’]"†fUƒÓÚÚδ8¦e™öÕ€0&Ì‹·ÔClHY+)²¥š`UmPîêîÇl꾆IËô9£2¶‡ü%/~æ]£8ÜllOš\Ë´ËÞòFnu,0–Æwu,«ä©l2ÇÓí�ª3˜Öw	à—¬`Jx �Bãö9­®lé:–>8`ù,ä8Έ6¥†™k©æË3·ªn˜ŸèîeÞÒ­çc‘o‹Ý	ü«~‡—&‡éÖ?Áô~²"âø¡ÅÍ~6oZ_ˆñzH3•¼„ÃÉö"â±j�)e¡¤¤J¶ýÒªÚ ÔÕÝOÉÔ½fß�©Øãö,WÛ¡Þ"›#/~w]è
ó\ÍÝk–n�BzSÖ•ž»Ï,HžÜNáüâ�ìØ@¹Ü…Â�	Ý‘z�)e�¢¤4/²™ŽMµ
¥«»Š©{<½ßT‡ã¶n’ufÞ8ÛèÙ#ù
uÛ“ÿAÇ
-¶}ÎÁ=eês¦=÷qrê6=äé÷#ë#@ wÓ!(ôü 
¶í,c‰ÂÊŽ¥^I§‚ö;•“~f8ö•…!4LK	5eb©TÛô6¬ºŠ{Q™Šµ�sCåã܈û¸¤Õµ›s£N$—ñ*W—�+¤;vH†¾oä%MŸ´Nÿ`Ä:¥†ÇÍ”š�”šwJ¡‹º°•çâ#Èó×Ö–ei²W_,j%­Ø_kç3»Á@ÓRgñÿž¶gò“þÏŸíUñ
-endobj
 1591 0 obj <<
-/Type /Page
-/Contents 1592 0 R
-/Resources 1590 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
+/D [1541 0 R /XYZ 85.0394 173.5556 null]
+>> endobj
+1592 0 obj <<
+/D [1541 0 R /XYZ 85.0394 170.4341 null]
 >> endobj
 1593 0 obj <<
-/D [1591 0 R /XYZ 56.6929 794.5015 null]
+/D [1541 0 R /XYZ 85.0394 144.9896 null]
 >> endobj
 1594 0 obj <<
-/D [1591 0 R /XYZ 56.6929 748.5056 null]
+/D [1541 0 R /XYZ 85.0394 140.3179 null]
 >> endobj
 1595 0 obj <<
-/D [1591 0 R /XYZ 56.6929 748.5056 null]
+/D [1541 0 R /XYZ 85.0394 113.5982 null]
 >> endobj
 1596 0 obj <<
-/D [1591 0 R /XYZ 56.6929 748.5056 null]
+/D [1541 0 R /XYZ 85.0394 110.2017 null]
 >> endobj
 1597 0 obj <<
-/D [1591 0 R /XYZ 56.6929 743.7078 null]
+/D [1541 0 R /XYZ 85.0394 95.4372 null]
 >> endobj
 1598 0 obj <<
-/D [1591 0 R /XYZ 56.6929 719.6381 null]
->> endobj
-1599 0 obj <<
-/D [1591 0 R /XYZ 56.6929 711.8197 null]
+/D [1541 0 R /XYZ 85.0394 92.0407 null]
 >> endobj
-1600 0 obj <<
-/D [1591 0 R /XYZ 56.6929 697.0552 null]
+1540 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
+/ProcSet [ /PDF /Text ]
 >> endobj
 1601 0 obj <<
-/D [1591 0 R /XYZ 56.6929 691.8868 null]
+/Length 2889      
+/Filter /FlateDecode
+>>
+stream
+xÚµš[w›º€ßó+üh¯Õh£·G»‰ÛÄͱ“ž½WwˆMV0¤·Í¿?#tA`Ý笳ò�
֧͌ÀþðÄõ�’pâ‡¹v'Ûý™3ù}WgXÊœ+¡sSêâþì�÷ÔŸ„(ôˆ7¹2Æ
+�xr¿û2�E3Á™^,/n–Ÿ®ÖÑÝõ_³sâ:Ó¿׉Vsq³y¸ºZlîòv½ˆæËÕˆàÙ¹ï…Î4º»[¬æË?EÄGutëåb3ûzÿálq¯_ÛüiØ¡ü�¿Ÿ}ùêLvð?œ9ˆ†�;ù	7ÂaH&û3æRä2JUKv¶9û—Ðè­í�*ì B=Ò3WO0F¡ë’Öd¹!ò(¡õd­“²8¶‰œ‚d[vâú~3ðöš”ƒ¿’bä»
+vL+õà%ø@ïà)âL/ÑûYH¦HŒ±ø‘f8˜>LJªÀÓÙÕÿÉô6ÞÇ/E){ײ÷!ËöqžËAã|'šïf˜„jðÛbû¿&Õ!…§áý`&Ô+�‹e ìãÓ¶*á=jÊ°è4DØCxl„°)5LXKi¾ã
¶ªnŸèî%ÜÒ-ÀÂO_m¢;µì¹p0mCèÅºýÐ
Ì �Äÿ[€”æßÄ�ÀÄG“½—E–dY,Ÿér`Ã|ÐO±?ÂÁ�²pPRšCàÛ8ØTººû9˜º#¾–ýémƒ9Á¥7}*¢mñ뵦‘”¥˜Lè¼)¶17=!±ÌAx¯¼i*;ªçD\Ì‹}œÊÎU¼—­›·²Jö=X©ƒ‘˽hƒ•b°^9Xü#-e[csÐñyæºÓôWšH‹ÓÃœkÇ£ÝÏ|6Eï:«b)WÅ<ݾ¤yYäRàCœãÛ^Þðº`°í1:fŸ†”e]()µ.ˆã˺°©6ÖEWwÿº0uú ØfJ1«ý/o¨W¿Ø¼&Ûôé­^ü¾FÎ%›%›‹')ž~¤Û¤D=Ô‰"L‰A�aîŠù“WÇìñ
+jt¼G¯
~c¬�úqe×õ‚ÐZÂN{»îH`dJY¨*)M{–}ÕªÚ ÚÕÝOÕÔý ,fBò‚‹e^%‡<©Ä�
+
+
+þC§)vŽ¶á‘�·‘±02Š ÅØâ^-J
~m­ýô­<ÐÝ\GçX`Èl„ÈP—Â%D‹L^àJj±ªÞ£z‹uõ7®G¶Ë
+<¢8´3„†�)!
Ì
-¥
›ÞXWq/0S±¨¡þª’¼¬O*avDMþ—Ç××âP	¡å�hü‘JQ6‡F¯¯2ãcäx¡±2âN7H<qÿ\ìE¾À[/eëõ1[�eëg]0‡®�ešÇy%»D
+ͪ§µµ�iqLË2í«ÿ
+w,!0¥,””Në(¶ìZVÕ†®î~¦îË,.ËL‡‚ËÕy4Ÿ¯Q´Þ%ú�é†åw&ûZUUÒ]ž('t%w’æU=÷EQu¿Âèx¶æ(¿Ùð¹.†ìÎÁÁȱ½)eA¦¤4²€X¢I«jYWw?2S÷2ºP[/Q$ÛçÜS¦>gÚs'÷¡îaÓCž~?&Ý`ôn:®ç·Á¶�e$Q@XÙ±Ô‹"îTÐ~§rÀÏƾ²0„†i)¡¦lB,•j›Þ†UWq/*S±öq,P>Ž…ÜÇÍ ­®Ý;UL�\F«H\]B®�î’C<ô}#/iz¤uú#Ö)5<n¦ÔÐl¤Ô¼S
+]Ô…­<Ažÿ»¶¶,Kã½úbQ+iÅþÚX;ŸÙ
š–:‹‹ø÷´=“ïè˜ôþlרŠûˆÁ@ðBü
+endobj
+1600 0 obj <<
+/Type /Page
+/Contents 1601 0 R
+/Resources 1599 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1529 0 R
 >> endobj
 1602 0 obj <<
-/D [1591 0 R /XYZ 56.6929 665.1671 null]
+/D [1600 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 1603 0 obj <<
-/D [1591 0 R /XYZ 56.6929 659.9987 null]
+/D [1600 0 R /XYZ 56.6929 748.5056 null]
 >> endobj
 1604 0 obj <<
-/D [1591 0 R /XYZ 56.6929 635.929 null]
+/D [1600 0 R /XYZ 56.6929 748.5056 null]
 >> endobj
 1605 0 obj <<
-/D [1591 0 R /XYZ 56.6929 628.1106 null]
+/D [1600 0 R /XYZ 56.6929 748.5056 null]
 >> endobj
 1606 0 obj <<
-/D [1591 0 R /XYZ 56.6929 601.3909 null]
+/D [1600 0 R /XYZ 56.6929 743.7078 null]
 >> endobj
 1607 0 obj <<
-/D [1591 0 R /XYZ 56.6929 596.2225 null]
+/D [1600 0 R /XYZ 56.6929 719.6381 null]
 >> endobj
 1608 0 obj <<
-/D [1591 0 R /XYZ 56.6929 569.5028 null]
+/D [1600 0 R /XYZ 56.6929 711.8197 null]
 >> endobj
 1609 0 obj <<
-/D [1591 0 R /XYZ 56.6929 564.3344 null]
+/D [1600 0 R /XYZ 56.6929 697.0552 null]
 >> endobj
 1610 0 obj <<
-/D [1591 0 R /XYZ 56.6929 549.6297 null]
+/D [1600 0 R /XYZ 56.6929 691.8868 null]
 >> endobj
 1611 0 obj <<
-/D [1591 0 R /XYZ 56.6929 544.4015 null]
+/D [1600 0 R /XYZ 56.6929 665.1671 null]
 >> endobj
 1612 0 obj <<
-/D [1591 0 R /XYZ 56.6929 529.6968 null]
+/D [1600 0 R /XYZ 56.6929 659.9987 null]
 >> endobj
 1613 0 obj <<
-/D [1591 0 R /XYZ 56.6929 524.4686 null]
+/D [1600 0 R /XYZ 56.6929 635.929 null]
 >> endobj
 1614 0 obj <<
-/D [1591 0 R /XYZ 56.6929 500.3989 null]
+/D [1600 0 R /XYZ 56.6929 628.1106 null]
 >> endobj
 1615 0 obj <<
-/D [1591 0 R /XYZ 56.6929 492.5805 null]
+/D [1600 0 R /XYZ 56.6929 601.3909 null]
 >> endobj
 1616 0 obj <<
-/D [1591 0 R /XYZ 56.6929 467.136 null]
+/D [1600 0 R /XYZ 56.6929 596.2225 null]
 >> endobj
 1617 0 obj <<
-/D [1591 0 R /XYZ 56.6929 460.6924 null]
+/D [1600 0 R /XYZ 56.6929 569.5028 null]
 >> endobj
 1618 0 obj <<
-/D [1591 0 R /XYZ 56.6929 436.6227 null]
+/D [1600 0 R /XYZ 56.6929 564.3344 null]
 >> endobj
 1619 0 obj <<
-/D [1591 0 R /XYZ 56.6929 428.8043 null]
+/D [1600 0 R /XYZ 56.6929 549.6297 null]
 >> endobj
 1620 0 obj <<
-/D [1591 0 R /XYZ 56.6929 414.0996 null]
+/D [1600 0 R /XYZ 56.6929 544.4015 null]
 >> endobj
 1621 0 obj <<
-/D [1591 0 R /XYZ 56.6929 408.8714 null]
+/D [1600 0 R /XYZ 56.6929 529.6968 null]
 >> endobj
 1622 0 obj <<
-/D [1591 0 R /XYZ 56.6929 382.1516 null]
+/D [1600 0 R /XYZ 56.6929 524.4686 null]
 >> endobj
 1623 0 obj <<
-/D [1591 0 R /XYZ 56.6929 376.9833 null]
+/D [1600 0 R /XYZ 56.6929 500.3989 null]
 >> endobj
 1624 0 obj <<
-/D [1591 0 R /XYZ 56.6929 350.2636 null]
+/D [1600 0 R /XYZ 56.6929 492.5805 null]
 >> endobj
 1625 0 obj <<
-/D [1591 0 R /XYZ 56.6929 345.0952 null]
+/D [1600 0 R /XYZ 56.6929 467.136 null]
 >> endobj
 1626 0 obj <<
-/D [1591 0 R /XYZ 56.6929 321.0255 null]
+/D [1600 0 R /XYZ 56.6929 460.6924 null]
 >> endobj
 1627 0 obj <<
-/D [1591 0 R /XYZ 56.6929 313.2071 null]
+/D [1600 0 R /XYZ 56.6929 436.6227 null]
 >> endobj
 1628 0 obj <<
-/D [1591 0 R /XYZ 56.6929 298.5024 null]
+/D [1600 0 R /XYZ 56.6929 428.8043 null]
 >> endobj
 1629 0 obj <<
-/D [1591 0 R /XYZ 56.6929 293.2742 null]
+/D [1600 0 R /XYZ 56.6929 414.0996 null]
 >> endobj
 1630 0 obj <<
-/D [1591 0 R /XYZ 56.6929 267.8297 null]
+/D [1600 0 R /XYZ 56.6929 408.8714 null]
 >> endobj
 1631 0 obj <<
-/D [1591 0 R /XYZ 56.6929 261.3861 null]
+/D [1600 0 R /XYZ 56.6929 382.1516 null]
 >> endobj
 1632 0 obj <<
-/D [1591 0 R /XYZ 56.6929 199.468 null]
+/D [1600 0 R /XYZ 56.6929 376.9833 null]
 >> endobj
 1633 0 obj <<
-/D [1591 0 R /XYZ 56.6929 199.468 null]
+/D [1600 0 R /XYZ 56.6929 350.2636 null]
 >> endobj
 1634 0 obj <<
-/D [1591 0 R /XYZ 56.6929 199.468 null]
+/D [1600 0 R /XYZ 56.6929 345.0952 null]
 >> endobj
 1635 0 obj <<
-/D [1591 0 R /XYZ 56.6929 191.7053 null]
+/D [1600 0 R /XYZ 56.6929 321.0255 null]
 >> endobj
 1636 0 obj <<
-/D [1591 0 R /XYZ 56.6929 176.9408 null]
+/D [1600 0 R /XYZ 56.6929 313.2071 null]
 >> endobj
 1637 0 obj <<
-/D [1591 0 R /XYZ 56.6929 171.7724 null]
+/D [1600 0 R /XYZ 56.6929 298.5024 null]
 >> endobj
 1638 0 obj <<
-/D [1591 0 R /XYZ 56.6929 157.0677 null]
+/D [1600 0 R /XYZ 56.6929 293.2742 null]
 >> endobj
 1639 0 obj <<
-/D [1591 0 R /XYZ 56.6929 151.8395 null]
+/D [1600 0 R /XYZ 56.6929 267.8297 null]
 >> endobj
 1640 0 obj <<
-/D [1591 0 R /XYZ 56.6929 137.1348 null]
+/D [1600 0 R /XYZ 56.6929 261.3861 null]
 >> endobj
 1641 0 obj <<
-/D [1591 0 R /XYZ 56.6929 131.9066 null]
+/D [1600 0 R /XYZ 56.6929 199.468 null]
 >> endobj
 1642 0 obj <<
-/D [1591 0 R /XYZ 56.6929 117.2018 null]
+/D [1600 0 R /XYZ 56.6929 199.468 null]
 >> endobj
 1643 0 obj <<
-/D [1591 0 R /XYZ 56.6929 111.9736 null]
+/D [1600 0 R /XYZ 56.6929 199.468 null]
 >> endobj
 1644 0 obj <<
-/D [1591 0 R /XYZ 56.6929 97.2091 null]
+/D [1600 0 R /XYZ 56.6929 191.7053 null]
 >> endobj
 1645 0 obj <<
-/D [1591 0 R /XYZ 56.6929 92.0407 null]
+/D [1600 0 R /XYZ 56.6929 176.9408 null]
 >> endobj
-1590 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
-/ProcSet [ /PDF /Text ]
+1646 0 obj <<
+/D [1600 0 R /XYZ 56.6929 171.7724 null]
 >> endobj
-1648 0 obj <<
-/Length 2544      
-/Filter /FlateDecode
->>
-stream
-xÚ¥ZKs㸾ûWè(U�€ øÈM¶l�&3¶#y²IÍî�–`™ŠTHʳ³¿>
âA�" É¦|0	4ñýu7º›ÂxS‘$˜DIàQ„éd{¸B“=ÌÝ_a)3WBsSêúùê/w$š$^úáäùÕX+öPãÉóîÛtñôtû°\ýs6÷)š.¼Ùœ"¤Fon7³y&|‚ð©M¯WןW�÷ëÅÓlj‡~E-–âfóõþþvó|+o×·‹åêáDðì·çOW·ÏúµÍ­aDø;ÿçêÛoh²ƒ~ºBIb:ù7ÈÃIâOW
%
Q#ùÕæêïzAc¶}tLU”Ä�ýhDW>ž`ì%”ú=eÑĉOZe-6b[�GV¥MVµuWÃ[\ Kˈ cd	Žþm}wŠ"¿
11E^œÀû;@µÌ50MSêÅ¡&ì²<¤Y!ö�îY‘Õ
l¾¬j1Vvºhï÷§lÇ<þŽƒ-á�zAÆðB|ÝBü‹'þ.Xsjâ¡|g‡V‰;œÄ‘gU6çKr¨Û�r(\Ii•S9Tî‚6”>Ķ¨Ý¿)‡R*^[Þ2mRqu—åL\ݔůùû“àAÞVÕÇSNÓ Ì HŸŠ§ö“©äãš±ªa‡TÎ=n›Ò #!V2ÂúªL);ZJ“‘`ßN†º#ã{œŒø(:¤¹ô�b÷g)ñ1õÂ8öû”,ieúÆ{©fñô”V?4#¡�‘vNQ|�CÊÁˆ’RŒø##.hƒ‘!¶…üLù7UÖ°*“îñZJc]—e##Jz�³aÕ;«êÑ(Åà‚qØçáZòð%-Š¬ØØî9Î?f”N³ß3fñO �0Âhê„,I!M’�I\ƒ£
°…"ùk-Õ]¾g‘giÍê
S¬ù^Vÿî(ʶlœ£0ö"?ÆO’�é!Ëåtš¤µœþ…ûQ•íßA‘‚ì%sŸ$¥�WÌ߃V¸*Àæ
-i‡ÙL‚™‡&7;kž@£Ä‹¾�)˜RvÖµ”¦=ö©�v'tÇûö8ñ=ðì<§Ï3Œ10°Ï[½„(ßGSöò×ÙœþtUקÖ
-`¦µxf…ã‡âR+¦[%òñHQ
-ͳ�pUÉç[BX#îŽ"â6å¶ÌÇ¢.ñ¡Ä<
`µ¸ëj¤uk“¹–ŸÓ†¾L3Ø¢2ÃTÆd!dõuD^FhK!E:	G@vᜀ-”È?1’ÐŽCHGh‡Å�.ŽÇ<ÛêôFx5±Z>,TÉ0<&	`&„ÁC]
-/¦”�O-ÕñIÉ£ºãó{œÏøB÷FßYѵEï”Kɬ`à|*û㽜ÚÑ]9+áU}ŒÖÛtÙî&6Fãà/��ƒ)¤Sz9j8®AÊ
-§ý©n4‰•%ˆtÓ`ÙYPBÝ'©ÈQG»p;†Àã˜ÈÂÉb
§áY…Hvà¾)ù³¸†A•áÊ8åÀ~/öê»~¬¼VY³âÄ-}¼'`(ŠÌ¦Gœºâ>]ݲòÜ”öÜêF}î<eÆï4>�òŸùüÄÓ
-2jëHøÿûYF2òHlë¹B¦žDê¥øæ2|sýË­óWÿ/§÷Áendstream
-endobj
 1647 0 obj <<
-/Type /Page
-/Contents 1648 0 R
-/Resources 1646 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
+/D [1600 0 R /XYZ 56.6929 157.0677 null]
+>> endobj
+1648 0 obj <<
+/D [1600 0 R /XYZ 56.6929 151.8395 null]
 >> endobj
 1649 0 obj <<
-/D [1647 0 R /XYZ 85.0394 794.5015 null]
+/D [1600 0 R /XYZ 56.6929 137.1348 null]
 >> endobj
 1650 0 obj <<
-/D [1647 0 R /XYZ 85.0394 748.4854 null]
+/D [1600 0 R /XYZ 56.6929 131.9066 null]
 >> endobj
 1651 0 obj <<
-/D [1647 0 R /XYZ 85.0394 748.4854 null]
+/D [1600 0 R /XYZ 56.6929 117.2018 null]
 >> endobj
 1652 0 obj <<
-/D [1647 0 R /XYZ 85.0394 748.4854 null]
+/D [1600 0 R /XYZ 56.6929 111.9736 null]
 >> endobj
 1653 0 obj <<
-/D [1647 0 R /XYZ 85.0394 743.3452 null]
+/D [1600 0 R /XYZ 56.6929 97.2091 null]
 >> endobj
 1654 0 obj <<
-/D [1647 0 R /XYZ 85.0394 728.6405 null]
+/D [1600 0 R /XYZ 56.6929 92.0407 null]
 >> endobj
-1655 0 obj <<
-/D [1647 0 R /XYZ 85.0394 723.1655 null]
->> endobj
-1656 0 obj <<
-/D [1647 0 R /XYZ 85.0394 708.4607 null]
+1599 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
+/ProcSet [ /PDF /Text ]
 >> endobj
 1657 0 obj <<
-/D [1647 0 R /XYZ 85.0394 702.9857 null]
+/Length 2544      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥ZKs㸾ûWè(U�€ øÈM¶l�&3¶#y²IÍî�–`™ŠTHʳ³¿>
âA�" É¦|0	4ñýu7º›ÂxS‘$˜DIàQ„éd{¸B“=ÌÝ_a)3WBsSêúùê/w$š$^úáäùÕX+öPãÉóîÛtñôtû°\ýs6÷)š.¼Ùœ"¤Fon7³y&|‚ð©M¯WןW�÷ëÅÓlj‡~E-–âfóõþþvó|+o×·‹åêáDðì·çOW·ÏúµÍ­aDø;ÿçêÛoh²ƒ~ºBIb:ù7ÈÃIâOW
%
Q#ùÕæêïzAc¶}tLU”Ä�ýhDW>ž`ì%”ú=eÑĉOZe-6b[�GV¥MVµuWÃ[\ Kˈ cd	Žþm}wŠ"¿
11E^œÀû;@µÌ50MSêÅ¡&ì²<¤Y!ö�îY‘Õ
l¾¬j1Vvºhï÷§lÇ<þŽƒ-á�zAÆðB|ÝBü‹'þ.Xsjâ¡|g‡V‰;œÄ‘gU6çKr¨Û�r(\Ii•S9Tî‚6”>Ķ¨Ý¿)‡R*^[Þ2mRqu—åL\ݔůùû“àAÞVÕÇSNÓ Ì HŸŠ§ö“©äãš±ªa‡TÎ=n›Ò #!V2ÂúªL);ZJ“‘`ßN†º#ã{œŒø(:¤¹ô�b÷g)ñ1õÂ8öû”,ieúÆ{©fñô”V?4#¡�‘vNQ|�CÊÁˆ’RŒø##.hƒ‘!¶…üLù7UÖ°*“îñZJc]—e##Jz�³aÕ;«êÑ(Åà‚qØçáZòð%-Š¬ØØî9Î?f”N³ß3fñO �0Âhê„,I!M’�I\ƒ£
°…"ùk-Õ]¾g‘giÍê
S¬ù^Vÿî(ʶlœ£0ö"?ÆO’�é!Ëåtš¤µœþ…ûQ•íßA‘‚ì%sŸ$¥�WÌ߃V¸*Àæ
+i‡ÙL‚™‡&7;kž@£Ä‹¾�)˜RvÖµ”¦=ö©�v'tÇûö8ñ=ðì<§Ï3Œ10°Ï[½„(ßGSöò×ÙœþtUקÖ
+`¦µxf…ã‡âR+¦[%òñHQ
+ͳ�pUÉç[BX#îŽ"â6å¶ÌÇ¢.ñ¡Ä<
`µ¸ëj¤uk“¹–ŸÓ†¾L3Ø¢2ÃTÆd!dõuD^FhK!E:	G@vᜀ-”È?1’ÐŽCHGh‡Å�.ŽÇ<ÛêôFx5±Z>,TÉ0<&	`&„ÁC]
+/¦”�O-ÕñIÉ£ºãó{œÏøB÷FßYѵEï”Kɬ`à|*û㽜ÚÑ]9+áU}ŒÖÛtÙî&6Fãà/��ƒ)¤Sz9j8®AÊ
+§ý©n4‰•%ˆtÓ`ÙYPBÝ'©ÈQG»p;†Àã˜ÈÂÉb
§áY…Hvà¾)ù³¸†A•áÊ8åÀ~/öê»~¬¼VY³âÄ-}¼'`(ŠÌ¦Gœºâ>]ݲòÜ”öÜêF}î<eÆï4>�òŸùüÄÓ
+2jëHøÿûYF2òHlë¹B¦žDê¥øæ:|sýË­óWÿ/ÿ÷Ãendstream
+endobj
+1656 0 obj <<
+/Type /Page
+/Contents 1657 0 R
+/Resources 1655 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1529 0 R
 >> endobj
 1658 0 obj <<
-/D [1647 0 R /XYZ 85.0394 688.2211 null]
+/D [1656 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1659 0 obj <<
-/D [1647 0 R /XYZ 85.0394 682.8059 null]
+/D [1656 0 R /XYZ 85.0394 748.4854 null]
 >> endobj
 1660 0 obj <<
-/D [1647 0 R /XYZ 85.0394 668.0414 null]
+/D [1656 0 R /XYZ 85.0394 748.4854 null]
 >> endobj
 1661 0 obj <<
-/D [1647 0 R /XYZ 85.0394 662.6262 null]
+/D [1656 0 R /XYZ 85.0394 748.4854 null]
 >> endobj
 1662 0 obj <<
-/D [1647 0 R /XYZ 85.0394 599.7666 null]
+/D [1656 0 R /XYZ 85.0394 743.3452 null]
 >> endobj
 1663 0 obj <<
-/D [1647 0 R /XYZ 85.0394 599.7666 null]
+/D [1656 0 R /XYZ 85.0394 728.6405 null]
 >> endobj
 1664 0 obj <<
-/D [1647 0 R /XYZ 85.0394 599.7666 null]
+/D [1656 0 R /XYZ 85.0394 723.1655 null]
 >> endobj
 1665 0 obj <<
-/D [1647 0 R /XYZ 85.0394 591.7571 null]
+/D [1656 0 R /XYZ 85.0394 708.4607 null]
 >> endobj
 1666 0 obj <<
-/D [1647 0 R /XYZ 85.0394 565.0374 null]
+/D [1656 0 R /XYZ 85.0394 702.9857 null]
 >> endobj
 1667 0 obj <<
-/D [1647 0 R /XYZ 85.0394 559.6222 null]
+/D [1656 0 R /XYZ 85.0394 688.2211 null]
 >> endobj
 1668 0 obj <<
-/D [1647 0 R /XYZ 85.0394 534.1777 null]
+/D [1656 0 R /XYZ 85.0394 682.8059 null]
 >> endobj
 1669 0 obj <<
-/D [1647 0 R /XYZ 85.0394 527.4872 null]
+/D [1656 0 R /XYZ 85.0394 668.0414 null]
 >> endobj
 1670 0 obj <<
-/D [1647 0 R /XYZ 85.0394 502.0427 null]
+/D [1656 0 R /XYZ 85.0394 662.6262 null]
 >> endobj
 1671 0 obj <<
-/D [1647 0 R /XYZ 85.0394 495.3523 null]
+/D [1656 0 R /XYZ 85.0394 599.7666 null]
 >> endobj
 1672 0 obj <<
-/D [1647 0 R /XYZ 85.0394 420.5376 null]
+/D [1656 0 R /XYZ 85.0394 599.7666 null]
 >> endobj
 1673 0 obj <<
-/D [1647 0 R /XYZ 85.0394 420.5376 null]
+/D [1656 0 R /XYZ 85.0394 599.7666 null]
 >> endobj
 1674 0 obj <<
-/D [1647 0 R /XYZ 85.0394 420.5376 null]
+/D [1656 0 R /XYZ 85.0394 591.7571 null]
 >> endobj
 1675 0 obj <<
-/D [1647 0 R /XYZ 85.0394 412.5281 null]
+/D [1656 0 R /XYZ 85.0394 565.0374 null]
 >> endobj
 1676 0 obj <<
-/D [1647 0 R /XYZ 85.0394 388.4584 null]
+/D [1656 0 R /XYZ 85.0394 559.6222 null]
 >> endobj
 1677 0 obj <<
-/D [1647 0 R /XYZ 85.0394 380.3932 null]
+/D [1656 0 R /XYZ 85.0394 534.1777 null]
 >> endobj
 1678 0 obj <<
-/D [1647 0 R /XYZ 85.0394 365.6884 null]
+/D [1656 0 R /XYZ 85.0394 527.4872 null]
 >> endobj
 1679 0 obj <<
-/D [1647 0 R /XYZ 85.0394 360.2134 null]
+/D [1656 0 R /XYZ 85.0394 502.0427 null]
 >> endobj
 1680 0 obj <<
-/D [1647 0 R /XYZ 85.0394 345.4488 null]
+/D [1656 0 R /XYZ 85.0394 495.3523 null]
 >> endobj
 1681 0 obj <<
-/D [1647 0 R /XYZ 85.0394 340.0336 null]
+/D [1656 0 R /XYZ 85.0394 420.5376 null]
 >> endobj
 1682 0 obj <<
-/D [1647 0 R /XYZ 85.0394 325.269 null]
+/D [1656 0 R /XYZ 85.0394 420.5376 null]
 >> endobj
 1683 0 obj <<
-/D [1647 0 R /XYZ 85.0394 319.8539 null]
+/D [1656 0 R /XYZ 85.0394 420.5376 null]
 >> endobj
 1684 0 obj <<
-/D [1647 0 R /XYZ 85.0394 295.7842 null]
+/D [1656 0 R /XYZ 85.0394 412.5281 null]
 >> endobj
 1685 0 obj <<
-/D [1647 0 R /XYZ 85.0394 287.7189 null]
+/D [1656 0 R /XYZ 85.0394 388.4584 null]
 >> endobj
 1686 0 obj <<
-/D [1647 0 R /XYZ 85.0394 272.9543 null]
+/D [1656 0 R /XYZ 85.0394 380.3932 null]
 >> endobj
 1687 0 obj <<
-/D [1647 0 R /XYZ 85.0394 267.5392 null]
+/D [1656 0 R /XYZ 85.0394 365.6884 null]
 >> endobj
 1688 0 obj <<
-/D [1647 0 R /XYZ 85.0394 252.7746 null]
+/D [1656 0 R /XYZ 85.0394 360.2134 null]
 >> endobj
 1689 0 obj <<
-/D [1647 0 R /XYZ 85.0394 247.3594 null]
+/D [1656 0 R /XYZ 85.0394 345.4488 null]
 >> endobj
 1690 0 obj <<
-/D [1647 0 R /XYZ 85.0394 223.2897 null]
+/D [1656 0 R /XYZ 85.0394 340.0336 null]
 >> endobj
 1691 0 obj <<
-/D [1647 0 R /XYZ 85.0394 215.2245 null]
+/D [1656 0 R /XYZ 85.0394 325.269 null]
 >> endobj
 1692 0 obj <<
-/D [1647 0 R /XYZ 85.0394 149.4956 null]
+/D [1656 0 R /XYZ 85.0394 319.8539 null]
 >> endobj
 1693 0 obj <<
-/D [1647 0 R /XYZ 85.0394 149.4956 null]
+/D [1656 0 R /XYZ 85.0394 295.7842 null]
 >> endobj
 1694 0 obj <<
-/D [1647 0 R /XYZ 85.0394 149.4956 null]
+/D [1656 0 R /XYZ 85.0394 287.7189 null]
 >> endobj
 1695 0 obj <<
-/D [1647 0 R /XYZ 85.0394 144.3554 null]
+/D [1656 0 R /XYZ 85.0394 272.9543 null]
 >> endobj
 1696 0 obj <<
-/D [1647 0 R /XYZ 85.0394 120.2857 null]
+/D [1656 0 R /XYZ 85.0394 267.5392 null]
 >> endobj
 1697 0 obj <<
-/D [1647 0 R /XYZ 85.0394 112.2205 null]
+/D [1656 0 R /XYZ 85.0394 252.7746 null]
 >> endobj
 1698 0 obj <<
-/D [1647 0 R /XYZ 85.0394 97.4559 null]
+/D [1656 0 R /XYZ 85.0394 247.3594 null]
 >> endobj
 1699 0 obj <<
-/D [1647 0 R /XYZ 85.0394 92.0407 null]
+/D [1656 0 R /XYZ 85.0394 223.2897 null]
 >> endobj
-1646 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
-/ProcSet [ /PDF /Text ]
+1700 0 obj <<
+/D [1656 0 R /XYZ 85.0394 215.2245 null]
 >> endobj
-1702 0 obj <<
-/Length 2122      
-/Filter /FlateDecode
->>
-stream
-xÚ¥YKs㸾ûWèª*Bðà37ÙÒ8žñÚŽå­d33š‚%–)R+RžÑþú4Ð J$µ•”�n ?ôQø±‘ç?âÑ(ˆ\âQæ�’Í­`ìöŠžIÍ4±¹®_®þöI£ˆD>÷G/o–¬�Ð0d£—åWgJƒê\ß]ßß=Þ>OŸþñÛxÂ=ê|£�>Ì°³øõöv¾x™›îó|:»{¸6ž~D�éÓÓüav÷oŸ*©´¡ÞÌãï/Ÿ¯æ/Ͳí­1*Ôš¿úú�Ž–°ÃÏW”ˆ(ôF? C	‹">Ú\¹ž ž+DMÉ®WÿlZ£zj§©%\ø¼ÃVœ�#‘çñ–±¼ˆø‚m¬ÇײÈd%—¸ÇÙÃÂØF&û]ZŒi>Ý”½›.4ht
G‹×&ºp¬¹ÔÒ¾‚VN}ïû©fÆ9XņU7\çº]û1�mݳb§ùxârê<Ä©ZÌYÊJn�z4�™ÿ¬d^¦E®Ít²;R„�ëR²ÿ
-S|á̈™—U¿Ë1Ã×»1�%ê‰sÓ¸1ü_âýÛ&Î�”Ïq¾�w¥¶\+š4°ƒ>8W
éE�º$Ä£:
-‰"ïÀà—Xw“uƒCÔ�ƒ’Hò’Í5€CÍUã (
pRmápª»[w�ƒCƒƒjÕ8èvƒƒ�'!,æ7˜5GºÊÓ|…�é¾Zšÿ'î3HW‘î8w®	Nü×8âŽÌ2�T:Šqá<ró*wÆêù­(Æ)¥ý˜‰ˆP7º„™Å5€YÍuÄ,¢˜
©¶0;ÕÝ�™­»'7.‚Ý›,Þ¥ß(åI\5ÄúûŸ"¯]®Š«}—Sqð°íUsãU÷òGZv;
-p¹™Ll«ežúï…ÔƒÈyx¡Î³¹ú!m¸H}o
-ÌWP%ºQ�…A=-Í@Rà:Mb;4ظýØp�¸`ÂØX\ØÔ\6—¥AÕ6§º»±±u7õ¹[×…ªÕÔçÐÖL5LI}ãE@;ñ"M1^df/B±öåúó¼Ú°ùT¤yuœµ˜?§}ÊâUÎ.»|±
ZÇĆڊ‰µs~)²w¼;«ÞgC]$ëìPµŽ„Ž¾}…�u£<1PÈ/¼t“°¹úOLÃÕœ˜p¨T}<1gº;OLKwOUzzaÐ>ù³BëB®øZ\ϳéØóœå™S$}*v›¸3�ú°ò�»mçÀqº_íËê«Ó‡±‰€�á2ª!áA¹Gýæ‘�'.Î]rsi$Ívñ[ÕULSHÊ.Dæj	֬ЫgA¾»Yi¬
-ë˜èÊÿ€\åºØg†ªµªÆ«ÄïïûßU�Qg5 %©!¹Ú>Zcn„½©SŸ!Ñƺû<3þ$)6“.|¶qžjéŒ:¯ü≀Æ2-“,N7:‡ê�¸jXóñBçç®:s%võrá‹(+d-K¢øp��uüa„ÄøÉÒ7YÂò°§O+|Ëô'66E^­Í\8ïõ¬S¸lvlԬسW�¥´^²“©¶~Ö3¯f*IM=ëÇŒ²38Ðó  LPxuµbá¥ÂÎk±7±âúîav”ëB±ê7r)‰X}y“;åF½Ïì<„RïÂõËæ:O&°lâ(LgÖŸGµóÈ™ÚÎ<ÒÒŠy„zÆ­¨o[Ê^´
5Vć9Oñ>ÃIÓ.\œHº�Sá¤É»ŽпO÷j"s¡âÜvéj­“ˈ!lÀ
Õß+Ô¼ '¸ˆàÇ%L8	üöiñ}£ÌëºpØbXWŸ,ŠB\ÛB¾ÆeUlM ÈÞLÿŽ#�y†‚43OøÜSºN®tM52…kE’ÂY.{‹8¬ê£¼hs¬ÿïÿ¥¬ê% "컊p°¯‚³(µ—È=[yýÖùÒÿš`�£endstream
-endobj
 1701 0 obj <<
-/Type /Page
-/Contents 1702 0 R
-/Resources 1700 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
+/D [1656 0 R /XYZ 85.0394 149.4956 null]
+>> endobj
+1702 0 obj <<
+/D [1656 0 R /XYZ 85.0394 149.4956 null]
 >> endobj
 1703 0 obj <<
-/D [1701 0 R /XYZ 56.6929 794.5015 null]
+/D [1656 0 R /XYZ 85.0394 149.4956 null]
 >> endobj
 1704 0 obj <<
-/D [1701 0 R /XYZ 56.6929 749.4437 null]
+/D [1656 0 R /XYZ 85.0394 144.3554 null]
 >> endobj
 1705 0 obj <<
-/D [1701 0 R /XYZ 56.6929 749.4437 null]
+/D [1656 0 R /XYZ 85.0394 120.2857 null]
 >> endobj
 1706 0 obj <<
-/D [1701 0 R /XYZ 56.6929 749.4437 null]
+/D [1656 0 R /XYZ 85.0394 112.2205 null]
 >> endobj
 1707 0 obj <<
-/D [1701 0 R /XYZ 56.6929 746.6461 null]
+/D [1656 0 R /XYZ 85.0394 97.4559 null]
 >> endobj
 1708 0 obj <<
-/D [1701 0 R /XYZ 56.6929 722.5763 null]
->> endobj
-1709 0 obj <<
-/D [1701 0 R /XYZ 56.6929 716.7581 null]
+/D [1656 0 R /XYZ 85.0394 92.0407 null]
 >> endobj
-1710 0 obj <<
-/D [1701 0 R /XYZ 56.6929 701.9936 null]
+1655 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R >>
+/ProcSet [ /PDF /Text ]
 >> endobj
 1711 0 obj <<
-/D [1701 0 R /XYZ 56.6929 698.8254 null]
+/Length 2122      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥YKs㸾ûWèª*Bðà37ÙÒ8žñÚŽå­d33š‚%–)R+RžÑþú4Ð J$µ•”�n ?ôQø±‘ç?âÑ(ˆ\âQæ�’Í­`ìöŠžIÍ4±¹®_®þöI£ˆD>÷G/o–¬�Ð0d£—åWgJƒê\ß]ßß=Þ>OŸþñÛxÂ=ê|£�>Ì°³øõöv¾x™›îó|:»{¸6ž~D�éÓÓüav÷oŸ*©´¡ÞÌãï/Ÿ¯æ/Ͳí­1*Ôš¿úú�Ž–°ÃÏW”ˆ(ôF? C	‹">Ú\¹ž ž+DMÉ®WÿlZ£zj§©%\ø¼ÃVœ�#‘çñ–±¼ˆø‚m¬ÇײÈd%—¸ÇÙÃÂØF&û]ZŒi>Ý”½›.4ht
G‹×&ºp¬¹ÔÒ¾‚VN}ïû©fÆ9XņU7\çº]û1�mݳb§ùxârê<Ä©ZÌYÊJn�z4�™ÿ¬d^¦E®Ít²;R„�ëR²ÿ
+S|á̈™—U¿Ë1Ã×»1�%ê‰sÓ¸1ü_âýÛ&Î�”Ïq¾�w¥¶\+š4°ƒ>8W
éE�º$Ä£:
+‰"ïÀà—Xw“uƒCÔ�ƒ’Hò’Í5€CÍUã (
pRmápª»[w�ƒCƒƒjÕ8èvƒƒ�'!,æ7˜5GºÊÓ|…�é¾Zšÿ'î3HW‘î8w®	Nü×8âŽÌ2�T:Šqá<ró*wÆêù­(Æ)¥ý˜‰ˆP7º„™Å5€YÍuÄ,¢˜
©¶0;ÕÝ�™­»'7.‚Ý›,Þ¥ß(åI\5ÄúûŸ"¯]®Š«}—Sqð°íUsãU÷òGZv;
+p¹™Ll«ežúï…ÔƒÈyx¡Î³¹ú!m¸H}o
+ÌWP%ºQ�…A=-Í@Rà:Mb;4ظýØp�¸`ÂØX\ØÔ\6—¥AÕ6§º»±±u7õ¹[×…ªÕÔçÐÖL5LI}ãE@;ñ"M1^df/B±öåúó¼Ú°ùT¤yuœµ˜?§}ÊâUÎ.»|±
ZÇĆڊ‰µs~)²w¼;«ÞgC]$ëìPµŽ„Ž¾}…�u£<1PÈ/¼t“°¹úOLÃÕœ˜p¨T}<1gº;OLKwOUzzaÐ>ù³BëB®øZ\ϳéØóœå™S$}*v›¸3�ú°ò�»mçÀqº_íËê«Ó‡±‰€�á2ª!áA¹Gýæ‘�'.Î]rsi$Ívñ[ÕULSHÊ.Dæj	֬ЫgA¾»Yi¬
+ë˜èÊÿ€\åºØg†ªµªÆ«ÄïïûßU�Qg5 %©!¹Ú>Zcn„½©SŸ!Ñƺû<3þ$)6“.|¶qžjéŒ:¯ü≀Æ2-“,N7:‡ê�¸jXóñBçç®:s%võrá‹(+d-K¢øp��uüa„ÄøÉÒ7YÂò°§O+|Ëô'66E^­Í\8ïõ¬S¸lvlԬسW�¥´^²“©¶~Ö3¯f*IM=ëÇŒ²38Ðó  LPxuµbá¥ÂÎk±7±âúîav”ëB±ê7r)‰X}y“;åF½Ïì<„RïÂõËæ:O&°lâ(LgÖŸGµóÈ™ÚÎ<ÒÒŠy„zÆ­¨o[Ê^´
5Vć9Oñ>ÃIÓ.\œHº�Sá¤É»ŽпO÷j"s¡âÜvéj­“ˈ!lÀ
Õß+Ô¼ '¸ˆàÇ%L8	üöiñ}£ÌëºpØbXWŸ,ŠB\ÛB¾ÆeUlM ÈÞLÿŽ#�y†‚43OøÜSºN®tM52…kE’ÂY.{‹8¬ê£¼hs¬ÿïÿ¥¬ê% "컊p°¯‚³(µ—È?[yýÖùÒÿš¸�¥endstream
+endobj
+1710 0 obj <<
+/Type /Page
+/Contents 1711 0 R
+/Resources 1709 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1529 0 R
 >> endobj
 1712 0 obj <<
-/D [1701 0 R /XYZ 56.6929 684.1207 null]
+/D [1710 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 1713 0 obj <<
-/D [1701 0 R /XYZ 56.6929 680.8926 null]
+/D [1710 0 R /XYZ 56.6929 749.4437 null]
 >> endobj
 1714 0 obj <<
-/D [1701 0 R /XYZ 56.6929 656.8229 null]
+/D [1710 0 R /XYZ 56.6929 749.4437 null]
 >> endobj
 1715 0 obj <<
-/D [1701 0 R /XYZ 56.6929 651.0047 null]
+/D [1710 0 R /XYZ 56.6929 749.4437 null]
 >> endobj
 1716 0 obj <<
-/D [1701 0 R /XYZ 56.6929 636.3 null]
+/D [1710 0 R /XYZ 56.6929 746.6461 null]
 >> endobj
 1717 0 obj <<
-/D [1701 0 R /XYZ 56.6929 633.072 null]
+/D [1710 0 R /XYZ 56.6929 722.5763 null]
 >> endobj
 1718 0 obj <<
-/D [1701 0 R /XYZ 56.6929 609.0023 null]
+/D [1710 0 R /XYZ 56.6929 716.7581 null]
 >> endobj
 1719 0 obj <<
-/D [1701 0 R /XYZ 56.6929 603.184 null]
+/D [1710 0 R /XYZ 56.6929 701.9936 null]
 >> endobj
 1720 0 obj <<
-/D [1701 0 R /XYZ 56.6929 579.1143 null]
+/D [1710 0 R /XYZ 56.6929 698.8254 null]
 >> endobj
 1721 0 obj <<
-/D [1701 0 R /XYZ 56.6929 573.2961 null]
+/D [1710 0 R /XYZ 56.6929 684.1207 null]
 >> endobj
 1722 0 obj <<
-/D [1701 0 R /XYZ 56.6929 558.5914 null]
+/D [1710 0 R /XYZ 56.6929 680.8926 null]
 >> endobj
 1723 0 obj <<
-/D [1701 0 R /XYZ 56.6929 555.3634 null]
+/D [1710 0 R /XYZ 56.6929 656.8229 null]
 >> endobj
 1724 0 obj <<
-/D [1701 0 R /XYZ 56.6929 540.5988 null]
+/D [1710 0 R /XYZ 56.6929 651.0047 null]
 >> endobj
 1725 0 obj <<
-/D [1701 0 R /XYZ 56.6929 537.4306 null]
+/D [1710 0 R /XYZ 56.6929 636.3 null]
 >> endobj
 1726 0 obj <<
-/D [1701 0 R /XYZ 56.6929 510.7109 null]
+/D [1710 0 R /XYZ 56.6929 633.072 null]
 >> endobj
 1727 0 obj <<
-/D [1701 0 R /XYZ 56.6929 507.5427 null]
->> endobj
-598 0 obj <<
-/D [1701 0 R /XYZ 56.6929 477.5928 null]
+/D [1710 0 R /XYZ 56.6929 609.0023 null]
 >> endobj
 1728 0 obj <<
-/D [1701 0 R /XYZ 56.6929 453.2532 null]
->> endobj
-602 0 obj <<
-/D [1701 0 R /XYZ 56.6929 369.7201 null]
+/D [1710 0 R /XYZ 56.6929 603.184 null]
 >> endobj
 1729 0 obj <<
-/D [1701 0 R /XYZ 56.6929 345.3805 null]
+/D [1710 0 R /XYZ 56.6929 579.1143 null]
 >> endobj
 1730 0 obj <<
-/D [1701 0 R /XYZ 56.6929 310.6805 null]
+/D [1710 0 R /XYZ 56.6929 573.2961 null]
 >> endobj
 1731 0 obj <<
-/D [1701 0 R /XYZ 56.6929 310.6805 null]
+/D [1710 0 R /XYZ 56.6929 558.5914 null]
 >> endobj
 1732 0 obj <<
-/D [1701 0 R /XYZ 56.6929 310.6805 null]
+/D [1710 0 R /XYZ 56.6929 555.3634 null]
 >> endobj
 1733 0 obj <<
-/D [1701 0 R /XYZ 56.6929 310.6805 null]
+/D [1710 0 R /XYZ 56.6929 540.5988 null]
 >> endobj
-1700 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F14 685 0 R >>
-/ProcSet [ /PDF /Text ]
+1734 0 obj <<
+/D [1710 0 R /XYZ 56.6929 537.4306 null]
 >> endobj
-1736 0 obj <<
-/Length 1917      
-/Filter /FlateDecode
->>
-stream
-xÚµX[�Ûº~ϯ0Ð>h�ˆáE¤¤óÔÜÚì
²)š-ú�ìƒÖ¦m!²¤#É»1Šþ÷ÎpHÙòÊÇ(ŠÖäpøq8wJ,8ü‰E¦Wy²Hó„i.ôb¹{ÅXûÛ+áy­˜N”‚ÉÌj¬UÆt&ÓE|
-òîþÕ›¿J±�œ#õâ~=žeÒ”ñ|q¿ú½m[[¯ÊŸ7±Ô<zwópÿ+íJXš¥wq8!eFiãv|.ê}Q[ll?î	S‰‘~�ÑÌp�¹=‰ç<Z•äG•2e‰qWì¬ÇQ‹œåF£SÈŒ\¸Ù�û]Ê”Fî¾Ò jšû–Æû¡¬ÊápL°\ë X"˜Ì]æë¡nÚ¾twxõñ~Ô©áL(Ðh":Wsz §ÔÉ£dœÁíw„p6QùÉ
ƒIF®ñž´õí/½ížl÷à§ñ#ÝIŸ*Ið”éÜh87«Ug{o•ÉYpñ,QÂó�˜ËL¥Yft€\VÅ, ÌY–¥ù9àú*ຬl=š|*dÊ2ÉÓsÌÿÌv3Vèë:Ëñè5°§mºáO—4��ÿvUØ‚JÅrÁÕ9Þpo8´ÿÞÏ«xèDsx	“æ…½Wá¾mwÅò—¼õ/?ìa9ç,ɹ9‡NÆ‘ypy#V€œ+.§öù†Ð�•ÆÎuÃä·½íM;0Æ.E¼J%KRñG"þârÄ�\Óˆ�·—EÓ’™\¥D´ˆß-pMEÛTÍcQÅ-ÆBŽš
j½’s?|üúþ·¿¿ýr7rOR¾ÄÇ”ÿ².(ŠGüÎ5_5»¢¬!ý'<*ëuÓ튡l� òhÓ݈,jZÛ
«ðL=­4ýι²?ËÇÊyhšŠV
-ë.¦‰’vÏnbÅÓèv *�rõÄ�ÛœC‡»Lü™ª°*
"Ö+H,ž}[O¶–ÈEÝ?Ãq�Z~›“ÕóÐxØwµ]Ñòš®²;£[ ‰n�ÊíIm¸|„‡#>ÌÐ
J»‚+k˜}nú!”ùÓk9])# ¿ìʺ¼Q?tÅÐ8á�¼ïíŒK€0ùXg.¸ô@Ê„?48Ð%÷`×~Û4(ºáG1ZZ†Õ]OK�vY n¹YÓo9øÕà%Ô^€\ÑkXÈ@ÅùÂ�õÈЊ3	
RP‰µµC0׸àf÷»Úý€þ#xôlÓ½lrÐC{?´è!D¤ßmñdýìÜh½¯—E5žÖ¬g®0›h�þ¾Â–'*Ô>²s²<×pÇœ¥iJÿ¶¶Í~³�9*ÑÐg*uÍ´2¥çÁÀUJF5ÆxUpæÔ½"ús9l‰¶lv;Ð~\•µ¥5
-‰Í~gë¡GÓi	Æ%î¢êâÚ½'Ñü±–r׬<”³3þBXSªq
-0	¤PžLÝ~L!1ÅŠ’GrbPÈ´�Ô>GCgÇL%+ër‹‰ÞíboMÃ~—î4i<Ñ90ž1U‰C=U‰'9oÂí-^¬æLD·¦Eä7Iô¼µ5�0�¼,òi΄0‰7d¼�÷*�™Ð�
-;‘
-¢ô­]–è„Kš‡²§|Á¸IÈŠ/(yÎàõ!¯)PÂ[Æó<—UåBØCQú
-o§¾÷�P�c
µ·ž­¥>"†ÞÑÒÊ®ŒžÖQ¨™ž 5P~DrÍ›ÏC‰z*‹9?€ww¼àÏÿþôåóÇÿ¼a€×-g3ÅLfähg¨ð*ºß†«Rn>½~6æ|â C¹¨D97ù2"ó„%BžÕ®ç&/ÚòÞ*dT×qñrn˜q²YkÞ»ÆJÍíýR7
-ƒ÷Ÿè—¾¸VsAOÔb±*Zšøš£á*ÜдVÙ'[�º{�ì
Õ'i},©9B:u\þŒ™�
-endobj
 1735 0 obj <<
-/Type /Page
-/Contents 1736 0 R
-/Resources 1734 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
+/D [1710 0 R /XYZ 56.6929 510.7109 null]
+>> endobj
+1736 0 obj <<
+/D [1710 0 R /XYZ 56.6929 507.5427 null]
+>> endobj
+598 0 obj <<
+/D [1710 0 R /XYZ 56.6929 477.5928 null]
 >> endobj
 1737 0 obj <<
-/D [1735 0 R /XYZ 85.0394 794.5015 null]
+/D [1710 0 R /XYZ 56.6929 453.2532 null]
 >> endobj
-606 0 obj <<
-/D [1735 0 R /XYZ 85.0394 769.5949 null]
+602 0 obj <<
+/D [1710 0 R /XYZ 56.6929 369.7201 null]
 >> endobj
 1738 0 obj <<
-/D [1735 0 R /XYZ 85.0394 573.0107 null]
->> endobj
-610 0 obj <<
-/D [1735 0 R /XYZ 85.0394 573.0107 null]
+/D [1710 0 R /XYZ 56.6929 345.3805 null]
 >> endobj
 1739 0 obj <<
-/D [1735 0 R /XYZ 85.0394 538.4209 null]
+/D [1710 0 R /XYZ 56.6929 310.6805 null]
 >> endobj
 1740 0 obj <<
-/D [1735 0 R /XYZ 85.0394 504.6118 null]
+/D [1710 0 R /XYZ 56.6929 310.6805 null]
 >> endobj
 1741 0 obj <<
-/D [1735 0 R /XYZ 85.0394 432.7569 null]
+/D [1710 0 R /XYZ 56.6929 310.6805 null]
 >> endobj
 1742 0 obj <<
-/D [1735 0 R /XYZ 85.0394 303.3232 null]
+/D [1710 0 R /XYZ 56.6929 310.6805 null]
 >> endobj
-1734 0 obj <<
-/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >>
+1709 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F14 685 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1745 0 obj <<
-/Length 3971      
+/Length 1944      
 /Filter /FlateDecode
 >>
 stream
-xÚÍZÝsÛ6÷_á™>T™‰X€
-ç\9æ=5`½Z7õ¼êñ¼j×Ëâ©œ'Ç<uf!úéÌ|ÞS÷G÷ÔqîÑ3½·¨I. |vÑ0èpÑÁÉÙôOçÃE«ö¨èš»½®`�[ߘ
¨32¿ù¾¤ãüM´U
-Æ—K½]6Ø�çtBؽQŸv…ûÑ{TØŸ[t'ìýEÇ…Ý_´ªç€x:o&N*ðR‚–çÆ·¼ÐáIAÍ7+N‚þ´­¨1'êoij°€òêŸSÇ?ßýÌ�ëË7Ü+OÆœœÓ“"8ƒ#
-“mÃ
-[Á6ÄÚé=¨ôœ
>QܼjÃOð`ì™xSÈó×’øEˆL·eÉPÜš÷ýv—"õrO_v¨÷bÑNV±ê
l?TkðI.ØOrñ5¤/	ZÆÅsœêñ %Lší«°T¡Ê5�\
-)¶;)	~cSÔ-î둾Ò:ºC“b<ˆÈ'ÿÿÝbÎN�¾rv¨‡1ý�ÉA+#¯Óîþ;Ì«Œy•‘!p‰†�õ#Æó$@�	À‰S‰<8v¼dÚEm˜ù²£¸rÎòz D)û¨zÇÑ㢢0,#ÅTdWòkOýâòê»
~ ßGžÎód’H{�Þ¨Ýâi\<å•O.ð?ríd[/)‘3é‘Ð"]ùüNiÿ8r\¹=<®Ýº±O+5ÜËuS‘\E™w‚z¼çûç.Û”�:·ç*½^Þù0ƒÑM
~ð15MûˆÑg{ØõD]>
¼£9Ò"“(‘à(P.~þîCB$º~@bX¨ªg´ÖW|ò	�žiß=dϧ[0eVþõv˜kÊ^ÕWèz>V	RIžŠì„†ƒVíÊcã¶ì"z)ˆ`$^RTÜmþq52¬Dd=ã�	o1	ØY,*í‹èʱE蘈.L6[õ}Ù†¬%ä„ý£:ƒ5z³§!´ª�¢ÀU¹WÒ…ÈZ…+Øå3¾ëÄi¾æ(yýãÅñÒïcѹ?�d8ŘDùÞ4””>1;‘þEw°=ø¼é§qûU:Û‡†�Éw«ÃŽõÎݪÝ5Æ1w˜Q@ŽG’¤Cw+L
-œk,]IvfRqé`%ýK»q—Ž8$ÏNW`r
-0+–þ*J÷,ø‚¤/€D)�ïãúµI$‚éAðe_'œÿ^fĪ0ÊĪ&¼)ÓDªŽ©ª§¨XI±Y£Î7K2mÌàæ–a×+ƒë»j-4ÚI±{!p}ïo>!òe]¹»é-g]õP.Ãw"0�
-”Ø¢/Û†H½m„ËH Ž0]um¹¼#"‰*ß+—R‰ÊõÔ¸9.Ã;ÈGtzX†«¡à ±Jôtäj£	�;þ۱ˣ,DŽÅª˜�C¹—)‰�‚ˆ˜:¾—èuÝÐgØŒé9|ûîâåôÝ«l,§ÌÒw"¨#KñÐx¢@u”'jáÑñwÞFÔÐ
ñ`ìA<Å>s"Q2ïC=Lbò
-œÀ4d‹V ½K²Üì]½„Á…s¯I°Måz°“âcÉÝ�‹ÐbKöýãjmÁL­8¥×BªÃ>]ÁãsZVM!äm˜¿§ürK?ŠvÇ€oxóEÉSy¤·‡‡ª­|0ÆØ8È9÷]Wá
-ê­yŽvQ.—_3¤¼Ý5TÉ
-weþ>Kô@yð�Ðd·cá„`
+xÚµX[�Ûº~ϯ0Ð>h�#†wQ穹µÙdS4[ô!Ù­MÛBdI‘äÝEÿ{‡R¶¼ò1Šƒb�9~œÎ�f
+la¡"—‹,—DQ¦ËÝ+ºØÀÚß^±À#• J
+
“™ÕT	C”áÙ"=y{ÿêõ_9[pJ´æjq¿ÏÒYFh¾¸_}MÞ´­­WåÏ›”+š¼½y¸ÿ
wI’™Œ¹]NȈJûŸŠz_TÈßÛ�{˜$BjöhE4UÆïyKØMÊ(¥ÉªÜ8~Ç 2"´F1îŠ�
8b‘“\s`#€̎Ëmöç~ã<ÃÑû»/8¨šæû¾Åñ~(«r8c$W*
+&ᆡ2_uÓö¥×áÕ‡ûѦš&À¢’iÂT.æìÎ@N®ä…K1”€öÌw„ðw"ò
ã•Œ\£ž¬õõ/½ížl÷¦é#ê¤N�ÄhFT®œë6«Ugûp+“³@q#|#ærS(b´Š�˪˜ä91&ËÏ
×W
×eeëñʧBfÄpš�c~ÿ?`îÆQ;ƒž
+çõʘE:úìn›nøÓ%[˜ó#~\û‚È\�œQqŽ7\Åíÿ€÷ó*žs§9<I¸~qó‡«p_·»bùëƒÓú×ïö0ƒœS"sªÏ¡å8Ò>ƒ¤�sAùô~¾:èÈëŒÇÞ‰ãäÇÞv‡¦!—b_dœÈŒý‘Ø?…¸û#×4öÓíeÑ':ÙíâwD‹\SÑ6UóXTéÄŠ)ã£e£Y¯dß÷¾¼ûÇíßïo?ß�Ü“äÏ]²còY!A£#~£Š®š]QÖP$MÊzÝt»b(Gy²én˜IšÖvÀÊS�kN¿Q*ìÏò±²Hš¦ÂÀŠ°ƒíiàõ9±Áº�iOÂôÝ“›TÐ,¹�
+Ç;¹zävÛ¼CG]&þŒu
Xë¸+£}[‡@¶ÉEÝ?Ãq‘Za›—5ðàxØwµ]áòUÙ��¡Ž„Z8ãöh6·|„‡##>Ìœ”v*+˜}jú!üSµ¼­„f�_ve]Þ°¤ºbh¼ð@Þ÷vÆ%@è|¬8\º!¡c¶PÉ=Ük¿m'º¦G1Z\†Õ]�K�vY8)ür³Æo9„Õè%Øh€\É/°`À
+Åùž
+ÔÞ¶û‘*A‡K+». Àz\wÂÍô™†2Æä5»hšG»<•Åœ?�
+Yô¦?ÿûãçOþóš
+ž{äÅ\Äî6]^ªŠ\Lªb(‡Óòúp,¿8p¿øõà0Íê¢Wõr½f9$
5Jöã¢d1|ÆsO¤GêøHƒ±³~�¢	E;H#|ú¸½‹	VÆú@¨ÂÙYíß}ŒüàŽ¡	5»-÷a;zs»icŸì½Ä
ƒ—�ówøñyLÜϲ³íÀ’yðÙÉo#TÃó,9òìü´ñ÷Ý—ÇýóUžéendstream
 endobj
 1744 0 obj <<
 /Type /Page
 /Contents 1745 0 R
 /Resources 1743 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1589 0 R
+/Parent 1752 0 R
 >> endobj
 1746 0 obj <<
-/D [1744 0 R /XYZ 56.6929 794.5015 null]
+/D [1744 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+606 0 obj <<
+/D [1744 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
 1747 0 obj <<
-/D [1744 0 R /XYZ 56.6929 752.2728 null]
+/D [1744 0 R /XYZ 85.0394 573.0107 null]
+>> endobj
+610 0 obj <<
+/D [1744 0 R /XYZ 85.0394 573.0107 null]
 >> endobj
 1748 0 obj <<
-/D [1744 0 R /XYZ 56.6929 504.0748 null]
+/D [1744 0 R /XYZ 85.0394 538.4209 null]
+>> endobj
+1749 0 obj <<
+/D [1744 0 R /XYZ 85.0394 504.6118 null]
+>> endobj
+1750 0 obj <<
+/D [1744 0 R /XYZ 85.0394 432.7569 null]
+>> endobj
+1751 0 obj <<
+/D [1744 0 R /XYZ 85.0394 303.3232 null]
 >> endobj
 1743 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R /F11 1298 0 R >>
+/Font << /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1751 0 obj <<
-/Length 2762      
+1755 0 obj <<
+/Length 3825      
 /Filter /FlateDecode
 >>
 stream
-xÚ­ZßoÛ8~Ï_áG»QI‘”Äö!m²EÝ6»I�=´yP,9jKYKNÎÿý
9Cê‡%åpw(PKÃ!gøñãÌ�
-_0ølj
-˜Ðrk(ÆÕbµ;c‹'hûxÆIçÂ)]tµÞߟ½ûUÄè(Œ÷ëÎXIÀ’„/î³oËËÛÛëÏW7�_„Š-ß犱åï—Ÿ¿^~BÙí¹——¯ïà5R,%nÔ"¶¼ºùxþpÿÛÙõ½w¦ë0gÂxò÷Ù·¶ÈÀïßÎX t¢¯ð®u¸Ø�I%%…p’íÙÝÙ~ÀN«í:€I ’0A c(Dšu¾É÷f®zÙlÒÆ<%Ë¢FÉ߇|_ä¾”yžÕØÞT(úQV¯®oŽM?ò#JÒ’ú¥Û§j_4›õ%+Ú[yÌ‹ò	už
¼BDË›[ßß|¾úÙ)꾃YUæ4ÈÑ, rÁy •
-íôž÷ç<YV/EF&Ø2}&áó¾H›Üô x(ÎX ­a03†™*uÑä:`:¤c&;2�„Š�A}:”€¥�¢È©5àÕ./›ý-Jì"t§Kj&©K™î
-ûþµ²Æiù‘³ù*Ï&z<o4x]<‘¹ïL±‘
|’(Ih;ü4¶qÇ.*À0&ï„Z;ñ¤ëa�Ö�.œXÄû,2Ž–ÈWÁà ‘‘ì¯'Âdͨå=q“IØ
-fžLA¤FÁ
-ê<æ@ˆÂìcóf¢–Q±”C³øðõê–¨Žk5Øчr›×nåJü½üë×?)&Sì¾ñ3Éb~¡¡n£zAC¹Ä
�«´¦(žâ�…öTe‰Y¥?0ÖzS4
-EÀB½A£ŽÖ�œ–§ÑËê„E!,wªyÃ^ëÔò€EØ&’¾id‘ô,bÄ"éY$=‹˜c‘ä=1Ç"Ùe‘J ã9°…SÚPiÕŽe“þŸŠ¶ªWÊ$‰/@»m˜’x2ÍI±  )C(.T?jt*<JäkÇ·Çtõã5m—%Éî9mŠÇb[4Çsι	S‚3ÜFã{Ê—•ùßÕ
P!Ôƒ‘­R±oé–Æ-¬™Õ¡hLÛ$ßd¬ƒP†jžo]­i¾y-�&d�jŸŸpN1(š¡n™5îµN­÷9§ú’÷ÍßË®ª…³m³?‡SV¹Jq?‘73ÃHbT3<CÌ·Å93vša;fÙNaFù8Ç<Ô14æ¡6«hÞQL΄îBDg$(êˆR*HÂd˜†ýDL™™ïMvœ	!R¨@*-ÞXÒŽÖÌ’:-»¤YµK‹òSOÛÝ8\W<JX<ï�×:u¡¿®àCÉ»çÂ�)èDäJx¨s„ÇÄc™2¤v*þBnR³Øý~°x[zÆy�Dˆ�C1ª¥;Dv'>ðVB
-™+î`�…†€TãøÅ}«Ÿó•¯¼my•Ž./„Ð�‚’§O†®¯ýÓtÈH»`–Tª6…­®">~ VB pGõwy³z·Ïëjû2u¬Ö°*¦Nh'šÐIÑLàyÜ’½þÊðÎÊPˆ\AŠÆð­}¬¸;z
„ë$€³€ó÷'cÆ?uÜ‚ZQ‹h¬Ò§$žw÷ÕàTNî)
±%†0¿§ºZÓ{Êkù0ÙÎb4LÎoÃä‰õñ0Ù3oS³	I65ƒS³‘`j6Otæн5
¸¢¦%Ë
­K<2:Žö¤>œª0ø%Fã8}ÚšæQÚBN‡g¥ˆDY:ã�®ü�¡°‘Œ·‡Mfø‡Uã‘Ξ½l܃@y:åHuåý£;ÿÛ,0Í2uZÄñ,ëhÍ°Ìiµ,ÛT¯L‹e3ñ†^ëÔƒÁ…—†
--Ø»ãžή3®o¡ë#ëXÝÿbð楀¹
ØæM^B5<Éa®Â Iâ7Ît]­i{-ÏáÕ<‡g�·>±>ÎážyËa`
Uð€A‰Ãæ	#(<|¸Â_ÃáÕ&_ýÀb
-LCÖ ç©ÐÑš¡‚Ój©°�¼!œ5ÜÞžX¿!왾Â/†SÅ!}P|$ÔŸ.ïîÜ…l^v>Ãù"ÑëRmä?‰L€ÇAGo`ÛQš†Ö)µ7‹
¬ú	¸R	ìˆYÃ^éÄrZ	;8õLÿwÈÞßú?áêJe˜¿æ™óäÿç?iÿ$FÆ�
+xÚÍZÝoã6Ï_ õk•)‘ê}à²ÝMÑM÷6)®EÛÙVbamÉkÉ›¦ýÍp†´$KÉ÷rÑCŠçã7CÉs
ò<I£4‹³s“é(29_nÏÄùô½9“<fîÍ»£^Üœ}ó�2çY”¥qz~sÛ™ËFÂZy~³úuö"’Ñ3˜AÌ^]¾y6�ÓDij‹÷ï__½ºü~'†À
+…œ|:ûõwq¾¾¿?‘Êlr~?D$³,>ßžéDE‰VÊS6g×gÿvzÝ«£�"ŠU�H –çRFY’Ä=$Y”ªX9\_¾{ÿÃkÚ×O×°)ܼ©:²çÐcS÷Ê�nvå2ßÐ�²ú\/ó¶¬+ú]ßò<²3ˆ$¦nžUy7²˜4‘V:á1›ºþØД›òcñ-½ ²Îs)u¤�Ý\ZØlÂìóNî_M±ÿ\ìéG•oj
ûÅÈòó$ÊŒIý\´ãû5¼/íŒÖï�¸ŒŒ”éyš¦pBbê„hм;Ê�¶#*FáÒÌü`Ù,Ž’ÄêÇ—õƒN—íí83Q¢2Ó_¶D¡[�ÒÄ›Œ‡¤zOÏË÷Ô“¯V$œ†ß�³Ÿz×RÛšhŸÅþá™”r¦¦²lv³ö«/óŠÆ.ø}÷Û­ýYO¬^ò�UݶÅjŽ’ƒÃ„SÕ5Ä›jH±,·N�­šUuëÕ~ѯ§p½”)ýõ¯§fËzSWóU±)·%,ÜŸv¦E6ûϺàÑ$h4‡ÝnSÂx§ŠI÷`”1‘ÍŒdS8jÂà
+÷íãö¨¤[ô(êá¢ã²î.ZV+À:­3�LpR‚–ãƵœÐáIáÌ5KN‚þt(©±"êoql°PòêÿžSÇ?ßýÌ�ëË7ÜûŽÆÜ[F'…wÐ&N#+…öNÅÅ6˜sÁÈ+fûs¾)WÝÍ8ÃVð: ƒ´oظԗ8`
¨[fêIµ�=ç;«|Èu®6²ÚÊ¿€0ïË
cØ]±‡(´íDÔöÃŽ�UÍŽ(g�{1fGQઽç1 �Td =e@Q|sùãÕõcˆ;	îóÔ÷Ëp?LEû˜/ƶŠ	AæãH½ó
+vr€Ä~T½=QÑgâÓÙô¹˜)>@Š€P픿W2J”õ[›ïÆwŸe
šoVÖ°Ùb5
 ˜(Ñ
£_�€,Žm'
+Öop}èzîÇì­“»ZH5ˆ“GYa4­zÅ©Z»Üƒä‚ý$WØêÔôq6Y8ǹ¨ÂÄÉP…¥ò¥·åxT0dB,™Œª"•Þ:œ
´u…UlÁaQƒÊ¶Øb\§$ø´}^5¸,’ºòïèMŒ±*ø¨ôÿw‹)û8H*³}=©’ènü¯ 'e¤çuÞNaÓӜϟó郪8âëPÊ0b<‡D
ÔyªÆ
++µÌ;ÁPÞó�ýó˜	KÈU³là*�^Þº0ƒHM
¶q15Ž»hÖe¢Øõ@].E½¥Â=Òs"“(‘àÐ1P.~þîCD$ºA¢_¨¬–´–~\b�Ži×ÝgÏ¥‚0e}îõf,Öàž�©
+\ƒj3DÖÒ߇(ŸðÍ\w Nó5GÉë/¦«Ò÷y3q©‰º?Š1‰òe®()}
+bÎDü…îR
+ïóæŸÆíWéd
!ËôîVû룻UÇ»•)w˜‘GŽ	Ü©»ƃ(˜ùð5óö°¡Ÿ«šŸ€YÀFe³>ò7Æ‚…Œ:
+”®DXð9I;܉
+ô½¿ù@„0È•œåñú¹X¶åçbã?^¡€™	À°õW¶ÖƒMw›gÂW%fèÂphðRØ.]¡Ã‰h¾,¤ª\,6<ÏËe³8´Z9ÿký�¾ÅEÓèâ}ÂÆLÁ©—îÀS7ØQóëEÚP8d½¡é“löá»—)Rú±-Ú5˜³Àe’ù¸Ÿ9.¯nè­NmÆ�ÇácÕyW­	µãrâÖK…zº÷¿
+"BV˜ñ�I§ë†¾xÀfHÏqàÛw/çï^%cÁ8`–Y(bOud)ú	O¨&y¢álD
 ×Tˆc÷Âà)†Ì‰HÉ´õ0QÉÓÁù âþ“I‘r5Æ|Äï4K‹0AN�EÞóTS_Q-ëÁ'ïÑþ´ôŸõnx’»¢ÂK2œvE”'0«
+‚ÕrœÀ4d‹VM}­°¢Æ¾ÌáK‰ÿù{éã×àÚDÊÚ‰o|bc#mafʆìé§Lüaõ)ëÿÜÈûendstream
 endobj
-1750 0 obj <<
+1754 0 obj <<
 /Type /Page
-/Contents 1751 0 R
-/Resources 1749 0 R
+/Contents 1755 0 R
+/Resources 1753 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1752 0 R
 >> endobj
-1752 0 obj <<
-/D [1750 0 R /XYZ 85.0394 794.5015 null]
+1756 0 obj <<
+/D [1754 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1757 0 obj <<
+/D [1754 0 R /XYZ 56.6929 752.1413 null]
+>> endobj
+1758 0 obj <<
+/D [1754 0 R /XYZ 56.6929 501.191 null]
 >> endobj
 1753 0 obj <<
-/D [1750 0 R /XYZ 85.0394 695.9587 null]
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R /F11 1304 0 R >>
+/ProcSet [ /PDF /Text ]
 >> endobj
-1749 0 obj <<
-/Font << /F37 747 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F48 885 0 R /F53 962 0 R >>
+1761 0 obj <<
+/Length 2980      
+/Filter /FlateDecode
+>>
+stream
+xÚ­Zmoã6þž_áoç µJŠ¤$ÐÙͶHÑnÓ&‹ëa›Š%ÇBl)µääüïo†CR/–”ÃÝa�5EŽ8Çç…
+_0ølj
+˜Ðrk(ÆÕb½¿`‹'ûñ‚[™•Zu¥>Ü_|÷ƒˆ:ÐQ-î7�¹’€%	_Üg_—W··Ÿ>_ßüq¹
+[~.WŠ±å/WŸ¿\ýL}·—:\^ýøé#ÅBâ(±åõÍ�—÷?]|º÷Æt
æL %]|}`‹ìþé‚B'jñ,àZ‡‹ý…T"PR׳»¸»øÍOØ5¯Ž
 D¨$ŒGÅJ‘€!DàczlŠª¼\	/ëmuÜeÔ~Ìé·IŸs;ü¶u­c]”Ov|›#
+€¶îèâ‰’„)°µ¬N$Ó³‡ƒ=\p+R½´v¸ßýq׫c�¬}§ºÉ÷5=¤uk€i<ç'lDËuZö×ðZÔÅãÎ>%Ú²X
ÚA¢E-h¥Bc†™-ŒÅ²:6/ÇÛr¹9\òdYíiä¥þ“
Ê𷢃™Í³Ÿ£Þæ»ÝßjzØuSN$ú'cá."‰„-ÿapE‹+6ïï€^Fvšb�B8úV4[)ï@*tH‘„Ó¬xÃ]„¬Ì·8¡nm.Ó}N
+¶L_lçË¡H›|uÎX ­-¢¸¢ÔuÀt"¬.vd";õùT\EEN¬
«ö@�šì%~Îcj&í+¸ÇY°®ÊÍÈìàbpV4ðfzl«Pƒ?ŠpºB2–±‘ýí˧ß/•Zþ“ùõöþæ×Ïw#ëÐÃ(HT¬çh<ä±µ£Ý˜×É�&ø“,ËãþѺª
õ!
O¶Ë¸ûÊÛ¶¸äËõÖN°Á)7ùº¡g¢$t½¥öes ±c[¸—vUõ||q&£ì[û4Ëm·a2OÜŒzIr5¸³Ú:»¸ÞÙÊŠúe—žˆÑàÇîª=¾/Z˜0¾®¶]uÞر�Y®<ŒHŸ¨ýXrˆ˜V$œe¢…
+ƶ9¬àp	��dËÚëÏò&?ì‹Ò>:<à¥à³
+€[ELÛ�
+6D¼{&ÜaB'"—*@£Î	ôÇ"Â4¤v"ý‚nRÜìþ{°y;Û¦u�xˆ�C2ª¥+"»XQ3	YÜ^FÍèjæ/6d[ý’¯}æm¬UéHq¹P“*HyúII×Ö~5�2Ò‘¿2±©jS˜ì*âãµ’à…+Õ¿Ë›õw‡¼®v¯Seµ†]Á<¡]hb+E\ÀCT ¯¿3¼³3ÖE®!D“{‡Ñ>V¼½�SýÛ‡$€ZÀÙû
êXoG̳ W<»óñ¼{®ž
+Sz¸þ|w÷é#µ_Ó]‘¥m!Rmzùqy’
+:¢K§Y&t„¦‰à„Zì&¯ç´¶·ƒCµã—ƒ]½×ô­p*-´Ÿ¡ôãÏWwwî*6/;à|zèemVä?†LÀ
+ÁD„ïÜ™´2Ó Z™öB±�Í>ƒUÊ á@˜­^f¨vðGŽ_¤ºzÿ;Lïïþ?!ê*à_üŒ¬�ù�ðÿóµ6%ñ¯<’‰j>;†:vF!LZ-÷�tnú¿
1W@endstream
+endobj
+1760 0 obj <<
+/Type /Page
+/Contents 1761 0 R
+/Resources 1759 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1752 0 R
+>> endobj
+1762 0 obj <<
+/D [1760 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+1763 0 obj <<
+/D [1760 0 R /XYZ 85.0394 674.4719 null]
+>> endobj
+1759 0 obj <<
+/Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1757 0 obj <<
-/Length 2840      
+1766 0 obj <<
+/Length 2837      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥Z[oܺ~÷¯ØGITR¤(©@$=ÈA{êž8h�ÄòŠ¶…h¥ÍJÃùõrHŠÔmO[ìƒ(qÄÎ|s£–îüè.±(’b—<N	MwûÃÙ=ÂÜ/WÔм±Do|ªw·Wú+ËvE\ˆDìn¼µò˜ä9ÝÝV_¢w1�¯a½ÿøËõ›D¤$‰ÞÞÜ|øíýÇÃ}J€‰þþö·Ïoÿ†Ïn® ûåçë»Û_¯>Ü:a|�)aJ’ïW_îÈ®¹½"1+òt÷7$¦E‘ìW<eqʳOš«OWÿtz³úÕ%ð4�Ó„‹ÝÆãø/«‰Æ¥@”¥E,XÂœšx¾¤&K¥ÔôêKÛÝ�äþ|êåtË4Écž0ï�%îŽjΆ#{ÊXÌIš„üo•¾»ÇÇF^¿a9�†'=H¢^Ã5�êöﻇ€€F¿¿ÇëW’’Ó5Í#½‰ºk‘¾’}��+  H{_8¨Û	»ïgyz¹¦”F
-oν¬â™ßçL€h°ö¶zTh©œú*	\üž«À·ÉÞQÍùO\°ˆ
·y(À¿´õÍÀzâ0B%áØ>Ø¿^€-%EL“,ÝÆmAÓ£y8fÙ¡ÃëWB’¶²‚H
-1‰`ÑñT·†kx¬€7Í¡â«…�²Áû}w8Èv°““źóp<ÛÉ
-èꇷ¶£RðÐÅp\p,!bFT‘¿]Ô¥µ4*©h×á
-28B¡Í{®R78†Óª\€V×`“¥l³ÏÕ®¶×¡ruZ6©xzm·
-ƒCYÉת
¥#]_ÿ”ŽÁzOã€N|l^&^Üswí&:î%T/µmpÿHÊôê¡që«b˜ŸB$ÝD�OµŽ Gåôý4å[äqÊ.°54s®“ª˜Aõœ±�íͨ‘/•Ñ’ŽÉN]wëú²­G=qÍœÐXé]Xý½^_̾rß8Wc�ûhF/Œ>Õ†),Õh
-•Ä”­×Möcp�ñ_®�
-¤YA·ù;ª¹
-ïýEpÌÔ#x®NÍ\Zö<½È×~«Íç/¯}ûŸþàk#¥ü~.›°<û)ñøjÚv-„¥ú}\Ý@µm[q\êܺ“0ý1ÛãF×ÿ‘ÅI&.TÑÆ ‘ôI:6
+xÚ¥Z[oܺ~÷¯ØGITÞ%èC‚¤9hOÝ-�øA^Ѷ­´Yic8¿¾Ã«HÝö´Å>ˆ"GœáÌ7’‹w~xÇE*
+R첂¥a¾Û®ÐîÆ~¹Â–æ�#zR½»½úÓ_i¶+ÒB±»}æÊS”çxw[}IÞ¥8½†Pòþã/×oˆàˆ$oon>üöþã¿á�# 
„’¿¿ýíóÛ¿™¾›ëÈ~ùðéúîö׫·^˜P`Œ¨’äûÕ—;´«@î_¯PJ‹œïžá¥¸(ÈîpÅ8M9£Ôõ4WŸ®þé'Fõ§K
+`<O9aTAS‚2²¬&œfQÆpJ
+F½šX¾¤&G¥ÔôêKÛÝ�äþ|êåtɘä)#4øb‰»§š³'4`�)Mâ$æ«ôÝ=>6òú
Íq2<éIz9×8©ÛGóÞ=D8ùý½y~E�®qžèEÔ]kè+Ùצ»
+lhïëÁ4êvÂîûYž^®1Æ	€"C,¹}ªûéG¶D3Ý¿(•iäˆg œ–¨VVɇòÜ¯�“äù©Þ?
ÄŠ"9ȲíÕ‡  (Ð+2Î@«úóúÑÒDJÌÒ‚ˆÂÒ´ÝéP6Í‹™·—m¥$Dúø!ͨZ`-{X€*ù=PЫ•)¢ò<t‡r¨÷fV5TÕ}yßÈʬ`–
+"EK}~’­q¥O-5¥f`ùLp+õ«¶ïeyuÌ×%yîÖ×�&ƹðjz5œÊ½\˜‰æ)å‚X2c^-bw`ݽy)�¦Ì˹—U:ó{ë\"ÏRT |ÛCªuôTÞC•D.H8
¾MöžjÎâ‚E
+¸Íc
þ¥­GqÖÓ‡–Q’i»>€ýëØbT¤˜d|·9MgŒräá8Øi‡Î<¿"DÚÊ	"M
+@ãâ]0ƒ±î½±½&Óè�‰wç<ÐE0…lõKžLQ–	¹ìÉ>ÊoÒ:`=È“wÓÜå»t¡Fà8^»ö|B­{ô]£¿%ÌêF¬¡e=Q�z•A·QEÉÇÁ>×P44�yy蚦{™<ÈÓ©lz;<Ú<ÓÀæ@d-­Ò8ƒÔÿÔ={A\¤ñŽi*OÈîÏÎwG�§C+ôï1<—ý˜‰ì`†«£Èë•:”Vüž‘f$Û~R­û½§ò~¿?T3¯GP«cz�³§š³ŽáÙ…lÂ{ôz¥0aCMŽ§ºLІn
+”]H¹!Õ†aÕh{Ö;ßM0”Ò¬ÀÛü=Õ\€Ø6PfS�X,ÁhælÃœmXdæOŠQ2Š¬_GóИ‡ó°%ó Ìš‡…æaÖ<Ìš‡E§ËÛæ�`E1»°ë©6Ìã¨FóTU­VW6sûu×’mà©æÄö
I)Íc	ógáÌ#"ódÎ<"	DÖï£}˜°öÆ>bÉ>…³�í#¬}„µOæí£ƒ©(Ҍ擊hÃh¸ )b]@´n2G4Z¬iVç¶ØŽgsS¾ËGs!ãOÒÆW¶íYÚ¦’go¾"DËÇõ*
u
+®’ñÌÜß.äPŸøÛPðƒ®­ú8‘äF&+¶ˆ'	7�øû·­Ö\ëy9-é° 0(Žd0‰ÝdYpØK¹SQ—°2
+Óš8³tüÌÕÿoœ'xL:´U�œnþëvßœ«éᢾŠsPÿ~µòÇ;à«þ-·€´sÎõÿ)oüË!Ë cædO$ã)|,œPJ¡¹ã ”PH»sÙÿm˜þŸendstream
 endobj
-1756 0 obj <<
+1765 0 obj <<
 /Type /Page
-/Contents 1757 0 R
-/Resources 1755 0 R
+/Contents 1766 0 R
+/Resources 1764 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1752 0 R
 >> endobj
-1758 0 obj <<
-/D [1756 0 R /XYZ 56.6929 794.5015 null]
+1767 0 obj <<
+/D [1765 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1755 0 obj <<
+1764 0 obj <<
 /Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1761 0 obj <<
-/Length 3318      
-/Filter /FlateDecode
->>
-stream
-xÚ­ZÝsÛ6÷_¡™¾ÐÓ
-!¾HâfòàÔNÎmš¸µÓ»›¶”HÛœJ¤*RNÜ¿þv�DŠ”|Ó^2	
p�]
-×R&“ʦŽÉSá1}]M×¾¾<Ü.—‚eIÌgý5GœÕ˜µ�=Ö\¦,Sü€÷mÙ�Ï¥L£î±t�z·^”[l'QsïÆP>O–Ó„Çü‰ft�{æ›MyΣ|ëºU�zõV÷¥±aI¦ÈŽìë|]:ª�¬"e"I8Áúã…¸`±’Dq9±†aR
-E÷�ªëËœDÚò©Ûª€}ó,*ÚÏ¢mV»®d¸úl.²„	ÁñÈ93Z»ò�=7
gTÞç»Uç:OùjGãUëžtr–ò×8µeÝ][Á©ÕžŒæÕtèÐl»¼+×eMóýÁJÓ?²L1
Ø¢
¿*»å«m	xb°·û©Ò,QÜá7°v¦"{NÀƒ+€N¢ºqg S ‚­΀DF[Qa7$-ŽTôfÃp¼i„iá5è¹R*ú
-ìÓÞ6Šf�Wuë:«ªíü”>åøÖxš±Œ§¦Èqù8qW2cp
^k@Š‰¥8˜
íWrò]É«VQ¹£ZÒI9�Ç‹kÁx"“¿
-.6²äd.“T‚š&Ùi›Ú§:nS•µ©‹Ý}[ýY¾~3²ªJÁ‘rOòTcæC«ªKM¢‡Ü­U^›±ñéòÆ5
-:�Ó¸$h-ó]Kú˜»Þºký±+·Ï´M\­3«Çt�gLHi^еÕ	]óTV×Ê¢n_5R4‘0€¡>Í8P�9„/hßd6d}�¨îíid^Ù²pVYJÔVMMï÷˜Y�c¡¯ü}UÍW—õÐ�x¸˜Ðš
-H=
-D�Š2ðA'�ا:Ä@e÷õKÝü¶† ¬ZUu9Âc’±lëiþ�j,À�`ïÓ81C	n¶Æ=JdtNËÆ>‹Ö
®ªßKײç‰�Û�ØH§'`ø€ÏÜ=àhMK3íNçv«¶ÑÉ:'î.”ÂÖãn�×s‡ºdNb3´oŽo^ä‹.s†×¿¡SH휎‡;hXdlˆAìohë0TæËG78Ü“CuDªÜuѱ9Æ"½@ ª¤	ËÞçK¸M€ÉÖ¦ËÝj§>
-±™”¢ÜmB,Ÿ<
©Ë…,°¯T�âEµ>÷±B°ÚÈwÚÔ¡9+‡ ªQÓÈT·ÝnÑ'ǨØ/¾(!K®
-,˜|A€@5–à@[lb¯‡"\t�¸n0Nœ¥	˜‘ªÝ¬òg´‡

H$:4:ŽÆž4ŒR¸Üºž¿¬„÷|2Rå+4~eañC_ü`§jÉ
-BÈ.3=Ä„w¥T6ÌRB'0 Ÿ\·�Ÿ¶Ç¯P—diú•ö¨N\©§
-W
-®»-—£ëÔ1d"";Í<P�¹¯š4U|Èþ§‚�ïˆCÖÿöê[×9/îÒjûlm1ÀŽ<ûŠ•°c!p¸àÇïiFES�u|ùþç®�ž‘›d?ûãÍÝ”,îΕf™ÈøÐó�²ø¼(ªB— Û˜p4õØ£ô1ò
‚41ƒœü$ö4ÇA@4
mõ°|ÌÛ‰G°V8Áדò^?ä�©0²Ïø[Ëp. ¦ð%æ¬uÞí‚:
-,˜`-u6b†ª­{�îÖ6lØ*°ø¶ÞT+«\!tÁÖür¢¬2Á”‘ª·Ç—ŠÀ\Z–M—€ça½“¢à&€RôäöúÝ·ÿ¼¸½:~ûvƒ[zéþ{T'à©,ºíKLóßËç×_ÁŸ²„%:“§ETc†h0œ%Ò$C!lî…•ÌÒª»ÍTð�C«ÒµÑ¨HÕAw¶çY´sÕ1ìƒü4í/>4s×z‹‡‰‚§TL›P:ûº¯òk{!¨	Ũ¹€e¯l�Š
-.a*£©ƒ#÷5Φo®¯âÀNÙ‰ÃîÙ){;­I;%R4¡ÊÌ@jÜœüÛ–*¬8ï/9VW
¦%å2ÝsþŸ¬•HÀå'æ… ¥OuÜZªà±ºfcg£¨%�8#V§¹ª1û·ÅYªy:äÿ/æ\ØJ~N"7{'/�÷N̵7åÃ?×ÉÝtØÐœJ�Ü–‹ª"ïlÙ®ÇÂ	&�ºb&ƲX§Có×0Ʊ®ƒ7­1}Súïc̯8ï/9�1Tk%ôžócÖv…-Þc.š‚½�6äaàEÜíüðé=¦Gw×7ï¯ÜVütõÓõÕí„mˆ
-‡Â™àø2'éå^úUe¿�¨Ã?Ž[§jWü\¥ýtíx¸â	‹…9Hì@V™?´ß�K¶¢¶>�+F%U"˜öÖx)Rú¯
-ÐZBÀ�+ËĽÆ_cR
˜÷Ο‰�r‚‰8óíRÛ‡}C6ÎŽÐ×Î6ç$OUÕSUìlÚ"EØŽ}åE.Ib‡9*âHûjòŵ‹²]n«}™ó<WŸ¼óEóTâ¯4À¨ÑM‹Ø}A·¹!öì½sü’óÜ”=a£í@ŒÜGTHî_Û»ÁÆþþö?S€aûË
·bã¦/¨�±NI“wšga&üõæ«©=ýÂúó¦<ÀÈr•·‡¸±»›PøÒCQHûØìVÅ0žÈ=Ôûµüý”ƒüò�w«fá.>u*!è‡øHH¼\­&TRp’—Œ~�Ͻdô[	;h£IZ4˜–Z:âû¶q3ü2^™m*hË26ƒ
-’z¢ŠK"K¬@`á×ÆÛÒVš©šX”A»´ud0ºÛ¬hÜY!aAƒ€àÊ]'µñ¶mS÷N	_ô°=ÉX¶;Ÿ,LÓY*E>@{ ú>@Sž
+1770 0 obj <<
+/Length 3317      
+/Filter /FlateDecode
+>>
+stream
+xÚ­]sÛFîÝ¿B3}¡§Õ†ûÅ�›ÉƒS;9·iâÖNïnÚ>P"ms*‘ªH9qý
,EŠ”|Ó^2	w—Øß
+hGôU¶.j@«Š…Š"É@pþø ©Dh4C\Nœ‘
+­•a€ûÚÕöiŽ‚ßaYWM™Ã½e9ßgÑÔ«][<}6WI$”’Èr)Rk•;ùÎñÍ�Šûl·jiò”­v¼^6ôdÎ9È_ÃPU
LwM	\«<齃é0lÚ¬-ÖEÅû=cuÚgYb„Ýâ¿*Úå«m
xp·û)YéYø
œ�˜Àñ	pHF…
+`£ ª‰:NA‰àê0©*µŽT¸
S‹+%¿ÙÀ2°7PGx
vnŒ	>€
+0Èç²}Ä‘	î‹Ï¨ƒ¸èÏ6¨X(>¶j‹í†VZd¥ƒàƒhy•µåSAoª=–¬bèÏåjEK§„À	¾¹¯¦ ŒËGw>¸+§F8
+
+¸Þ¥¸8AÇj bCÄù†¯KE¶|¤Åá�h
Í¡2šb`#Ä*À»@"jtÚ{Ÿ-Aš˜
+q•”áÚm‚,_<
¨#‹R¸W¬‡ŠâIu1÷±Deu™ï´«CwV•ªBKcWÝ´»E³bø¢€*¹í‡ÛUCÔÖžV�>ÔqÕé :ÕYP‹ÜƒkhG
+ð`ú:¨1Öâ
+{;$ᢅÂuƒÉpDžBEàFÊf³ÊžyÑ1PH´ètÆqV9]nhæ…É^LF¨l…ίÈ�þ°ÇÂ�þà¤lØBÊ®;Ô	J�R¹4¯£&ŽÉUõis\¤ uQÇ/ˆ´uB¤ª)„î¦XŽÄiC¨DTry5Æ>'¤5qläýO$
ÊHBÕ
ÿöê[�‚—¤²Ú=×p+Ï~…s%œ88<ðã÷¼£ä­¿†6¼üÿKšcd”i´ßýñænŠ’¹±"Q‰F¾QŸåyÙBêÒÙ6u5Ž(½DŒRþ#Š ÓP@M~R
ö0Ç•€a:hʇåcÖLä8JÄpÂ	¼äïPüPCÆ*Õ}Äß:„s9…”RX³>TY»ëÌQaÃ{!h‹°Qg¸ËÐÐk·nàÒV…Í·õ¦\9ãêRÍ/'šÀ&Q¤ÚôîøRXAHK’éð¼;ï$CH UŸ!·×ï¾ýçÅíÕqéCÚ
aé%ù÷ Nh€‡r:ÐnwØbšÿ^<¿þ
+þŒô ‰Dd}š„jLÃPR)"�FC"\í…�Ì™»«Tð�K«‚ÆèÔAØÔÁv¶çI°£îÎ�~ÞŒþŸÞ¹k<ŒÓ‡‰†§6¦]ëìë¾IÐo!í…¤¦kFÍ{å’TD
+F“~JÅèBM:ªñrúo{ªîÄyÿȱ¹*p-±Ôñóÿä­T!?J_HZúPǽUÕE¬¶Þ¸ÆÙ(k‰ ÏÍiìÔýAØ’"¶2âÿ*æ\¹N~Æ¢L÷A^1éƒ�7ÅÓ?šd´.4çV tí¢2ÏZ×ö
+°¸¦ÌfÅ„aŠX:@*Z$_Øg¡V·Iêãà3Ý’‰ÆŒ”}¦äi"õÐ×Ñýt¨©,�§ÏQäÖ§¿<…,:ôás>õG‘Æ©çÍ"k1b"
+Pç2À[â´Þ ˜šã7½XrlEäî2€´�®m…KOp}™1õ‹bOýªtßFa•ô×]Pu'~®Ò}º&Ä ‰P¥…Ъ³‡æÉŽÔÆ—qù¨¥Ê
+hÈ�ð×Φ[Θž²Ê˧2ß¹²E«î:î•'¹`ŠIç¸mˆ+Í3˜ÉçE³Ü–þ2—!Di>yg‹ú©À_i€ScI«�¾ »ÚgNî¿ä<÷WO8hZ #óÂv²Á×N68ØËoÿ3Xv¿ kÚ¾à9æ:oÞmxŸS3åÅ›­¦>ôôëÏ›â@G–«¬9Ôw»iê¾ôpÒ<Ö»U>Ì'2¯êý^þ~ËA}y¨�¤w«zA‚�É$ÿpŸ�&Dž.§­i×IÁMž2þ9>÷”ño%Ü¢Ë&ùT°`>jIjˆï›švøc¼1»Rеe\	LõD—IÖØ)î¿.ßÖ®ÓÌÝļ W¤ðýÒ–À`u·Yñ:y!å”B'�QÚnh{\Â=݃©d¨Ž’×�O6¦™—Æp°>˜~°\'ÀYIpáT
+…²‘Ü»w&9ãK,øà¶Û2Ï‹Ê÷\AM£$š×âyðAËÝeÞÕ;Kßqi‡Ý–)×쾯¾õßc‹/Fûûµ˜†Ê]멼2ìÒ“¿ýK²ýïäL,4~}ŸL› n	àŽôD!_ ’n1+IT<Aû
œÓ4endstream
 endobj
-1760 0 obj <<
+1769 0 obj <<
 /Type /Page
-/Contents 1761 0 R
-/Resources 1759 0 R
+/Contents 1770 0 R
+/Resources 1768 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1752 0 R
 >> endobj
-1762 0 obj <<
-/D [1760 0 R /XYZ 85.0394 794.5015 null]
+1771 0 obj <<
+/D [1769 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1763 0 obj <<
-/D [1760 0 R /XYZ 85.0394 204.5196 null]
+1772 0 obj <<
+/D [1769 0 R /XYZ 85.0394 204.5196 null]
 >> endobj
-1759 0 obj <<
+1768 0 obj <<
 /Font << /F37 747 0 R /F48 885 0 R /F23 682 0 R /F53 962 0 R /F39 863 0 R /F21 658 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1766 0 obj <<
+1775 0 obj <<
 /Length 2180      
 /Filter /FlateDecode
 >>
@@ -7642,50 +7693,50 @@ C¦#Xs ºfÓ
˜Gñ¨É?Ø	$âÎ…~u])ÀE/31K6›²È3T¹”^Û¶['݈3G’ùQœWœâ“�ŽÆÞâ™PÔEW˜“ÃÀ
 Tú˜¨Æ{X
 �7tÀâõ¶§z9(6�_fÉ»¬¬·íòùé›C¥c¥§Â&A»Ôš–IÛŽö)ÌICÔ3¼aZŠß¹b�5Ý«üÂø˜á§ówÕC>Ú@LJ-Ž9vg9vûÍX¶‘
 ¬Íõ1¿?Îò{NŠîU~ªçG-ZzŽË£/³jd—C�Veò8¶‹f:ŒN´ {(°U2G¥Á·Ñ *Lâ0h\ß,Þ}šß/çw·#ya$,Ž·�JGÃÒ/–4øk‹jƒéHÄQ'Í„©%Øä[€+S¬áØ\gì;$MC®ìëø×°&)KË�CÂzÿ¶<¤�M9z8?¿·rfÅ@ˆä­-tí�,IÕ1”OOEj1|~HL
¦¼?¨Klmk@
-­�;,Z[ymíŸç�ΰ½Çâ)¯ßŒ˜BB”àÚw>óš)$„Jß]nÓå¹]lí¸6e†
wU•˜Pû6¶„,½{<"…„ø¾xÜ1Û'¥>‹¼QF]'IÂ?Ší”Õɽêñ
+­�;,Z[ymíŸç�ΰ½Çâ)¯ßŒ˜BB”àÚw>óš)$„Jß]nÓå¹]lí¸6e†
wU•˜Pû6¶„,½{<"…„ø¾xÜ1Û'¥>‹¼QF]'IÂ?Ší”Õɽêñ
 endobj
-1765 0 obj <<
+1774 0 obj <<
 /Type /Page
-/Contents 1766 0 R
-/Resources 1764 0 R
+/Contents 1775 0 R
+/Resources 1773 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1752 0 R
 >> endobj
-1767 0 obj <<
-/D [1765 0 R /XYZ 56.6929 794.5015 null]
+1776 0 obj <<
+/D [1774 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1768 0 obj <<
-/D [1765 0 R /XYZ 56.6929 626.4701 null]
+1777 0 obj <<
+/D [1774 0 R /XYZ 56.6929 626.4701 null]
 >> endobj
-1769 0 obj <<
-/D [1765 0 R /XYZ 56.6929 517.4334 null]
+1778 0 obj <<
+/D [1774 0 R /XYZ 56.6929 517.4334 null]
 >> endobj
-1770 0 obj <<
-/D [1765 0 R /XYZ 56.6929 438.0429 null]
+1779 0 obj <<
+/D [1774 0 R /XYZ 56.6929 438.0429 null]
 >> endobj
-1771 0 obj <<
-/D [1765 0 R /XYZ 56.6929 376.8269 null]
+1780 0 obj <<
+/D [1774 0 R /XYZ 56.6929 376.8269 null]
 >> endobj
 614 0 obj <<
-/D [1765 0 R /XYZ 56.6929 339.1376 null]
+/D [1774 0 R /XYZ 56.6929 339.1376 null]
 >> endobj
-1772 0 obj <<
-/D [1765 0 R /XYZ 56.6929 306.6767 null]
+1781 0 obj <<
+/D [1774 0 R /XYZ 56.6929 306.6767 null]
 >> endobj
-1773 0 obj <<
-/D [1765 0 R /XYZ 56.6929 271.6646 null]
+1782 0 obj <<
+/D [1774 0 R /XYZ 56.6929 271.6646 null]
 >> endobj
-1774 0 obj <<
-/D [1765 0 R /XYZ 56.6929 207.5268 null]
+1783 0 obj <<
+/D [1774 0 R /XYZ 56.6929 207.5268 null]
 >> endobj
-1775 0 obj <<
-/D [1765 0 R /XYZ 56.6929 137.3205 null]
+1784 0 obj <<
+/D [1774 0 R /XYZ 56.6929 137.3205 null]
 >> endobj
-1764 0 obj <<
+1773 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F53 962 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1778 0 obj <<
+1787 0 obj <<
 /Length 4062      
 /Filter /FlateDecode
 >>
@@ -7708,24 +7759,24 @@ LÇ_“F&ÉÌ—³,÷ÜQ_"!>ƒÿºÛp´CZÓ]�‰êœYšpj�½§=Ž
 �?œr0òP�Ñœœ
 .é€xkêR�6‘Mb}31RŠN’ˆ•‰aPjA�C¼£ã,Ò&õ#¹‹Cç.ÚáÑÛÔ��ÇÚzꆾ¸öŠö_ÿ=@ÿçq
 ¾ÎªpÕ¼v
ɌΤg
-—B³þrà”÷ÿúF¹öendstream
+—B³þrà”÷ÿúž¹øendstream
 endobj
-1777 0 obj <<
+1786 0 obj <<
 /Type /Page
-/Contents 1778 0 R
-/Resources 1776 0 R
+/Contents 1787 0 R
+/Resources 1785 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1789 0 R
 >> endobj
-1779 0 obj <<
-/D [1777 0 R /XYZ 85.0394 794.5015 null]
+1788 0 obj <<
+/D [1786 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1776 0 obj <<
+1785 0 obj <<
 /Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F21 658 0 R /F39 863 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1782 0 obj <<
-/Length 2136      
+1792 0 obj <<
+/Length 2137      
 /Filter /FlateDecode
 >>
 stream
@@ -7736,51 +7787,51 @@ V̳÷Ë%p&ìQ	 �-ñø‰QJT$^ó'4NÇ”ï÷‡KP¥ÙʼÓÕÞQ4õIºÖ­îóC^€wp©ë¢Y—õWÍƯ"RwzÓØܺ
 €ž	ÄÄ�®ÙûoË›Õò뵧0�÷9ÔžAj¬
 ¸âÁ±uïÜð
 3ñº±¹—¨€ýfæ.3;åî`�ˆbÔJio¾±½x‚£<À€µ©ˆÈj§4õÛWËÜ(+±ŸÑÍ=Ù|$ ME³§ƒê×zm‡ÑàC\²÷ž›Î
�JBG¼äƒ¿¡ø©(�¿©Ù8v0…we‘WÕÃÙx‚áDø£G-*ò-y3 dP¨^ÁŒ×˜ÑsMšÅ	fÀ
-'8
åÑ£àÉKCàSÿ
åÉݱêJ
+'8
åÑ£àÉKCàSÿ
åÉݱêJ
 endobj
-1781 0 obj <<
+1791 0 obj <<
 /Type /Page
-/Contents 1782 0 R
-/Resources 1780 0 R
+/Contents 1792 0 R
+/Resources 1790 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1754 0 R
+/Parent 1789 0 R
 >> endobj
-1783 0 obj <<
-/D [1781 0 R /XYZ 56.6929 794.5015 null]
+1793 0 obj <<
+/D [1791 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1784 0 obj <<
-/D [1781 0 R /XYZ 56.6929 751.8114 null]
+1794 0 obj <<
+/D [1791 0 R /XYZ 56.6929 751.8114 null]
 >> endobj
-1785 0 obj <<
-/D [1781 0 R /XYZ 56.6929 637.809 null]
+1795 0 obj <<
+/D [1791 0 R /XYZ 56.6929 637.809 null]
 >> endobj
-1786 0 obj <<
-/D [1781 0 R /XYZ 56.6929 571.6272 null]
+1796 0 obj <<
+/D [1791 0 R /XYZ 56.6929 571.6272 null]
 >> endobj
 618 0 obj <<
-/D [1781 0 R /XYZ 56.6929 530.4875 null]
+/D [1791 0 R /XYZ 56.6929 530.4875 null]
 >> endobj
-1787 0 obj <<
-/D [1781 0 R /XYZ 56.6929 492.9536 null]
+1797 0 obj <<
+/D [1791 0 R /XYZ 56.6929 492.9536 null]
 >> endobj
-1788 0 obj <<
-/D [1781 0 R /XYZ 56.6929 459.984 null]
+1798 0 obj <<
+/D [1791 0 R /XYZ 56.6929 459.984 null]
 >> endobj
-1789 0 obj <<
-/D [1781 0 R /XYZ 56.6929 390.8804 null]
+1799 0 obj <<
+/D [1791 0 R /XYZ 56.6929 390.8804 null]
 >> endobj
-1790 0 obj <<
-/D [1781 0 R /XYZ 56.6929 303.7532 null]
+1800 0 obj <<
+/D [1791 0 R /XYZ 56.6929 303.7532 null]
 >> endobj
-1791 0 obj <<
-/D [1781 0 R /XYZ 56.6929 225.6163 null]
+1801 0 obj <<
+/D [1791 0 R /XYZ 56.6929 225.6163 null]
 >> endobj
-1780 0 obj <<
+1790 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1794 0 obj <<
-/Length 2915      
+1804 0 obj <<
+/Length 2916      
 /Filter /FlateDecode
 >>
 stream
@@ -7788,81 +7839,83 @@ xÚ¥Z[sÛ6~÷¯Ð£<�\y™}rçÒ´v6Rf·Ûö�–(›ŠTEÊÞô×ï98
 Y\!O^ýöŸ¬`?]q¦`µÉ<p&ÒTN6WÚ(f´R~¤¼š_ý³[0˜µ¯‰B›„©£ÉÀšGé°À8ã0‹µ`<¸˜Có(جÂ�¾~gL€‚%©
Î,¤Ê6yû}›KDhÍbc‚‡˜ëPÜ©�¦NY¬¢¸ÏÞ|›/‹ß9—yÇ%Óö)§NýRå;ì¦SË
®�Pßòï×Bˆ)œ°ŠÌtAãéô9+÷‡w¬Tp#EÌDlÄ€Žø6œéTiÜì›––Í`bGýGõ?÷w·4ò;7|]»é—�Ì�™6 '3�jŒ´+’RÔö¯ºÂ•Ra÷e‡p!PØ×
 Rúb‚>Ý;IWffB¥ðR2•èähSGœÈˆ	nú
 5⛿R-Ú£HÓ”lì[·P’%ÉX
-Š±—šê_*û{#oÜ÷{ ñ4yȨ°ƒÑºr¯ÛTæ,ç~–ÛPb&#Åb.Gü4CQ
•¿J±ÔV!¡7vÅ鱸·û‡Ò«òÑGL—ÜŸ$‹ c¡ƒÁÆž15:eKhÌt7Õcì¸÷{üŒ‹2Y4 ¸¼Kþï0ÌNÇ�&'r8s�Z�)’qLá&WǬ¨”Lb8åý6A&Æendstream
+Š±—šê_*û{#oÜ÷{ ñ4yȨ°ƒÑºr¯ÛTæ,ç~–ÛPb&#Åb.Gü4CQ
•¿J±ÔV!¡7vÅ鱸·û‡Ò«òÑGL—ÜŸ$‹ c¡ƒÁÆž15:eKhÌt7Õcì¸÷{üŒ‹2Y4 ¸¼Kþï0ÌNÇ�&'r8s�Z�)’qLá&!_>fÝ@¥dÃ)ïÿ6™&Èendstream
 endobj
-1793 0 obj <<
+1803 0 obj <<
 /Type /Page
-/Contents 1794 0 R
-/Resources 1792 0 R
+/Contents 1804 0 R
+/Resources 1802 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1789 0 R
 >> endobj
-1795 0 obj <<
-/D [1793 0 R /XYZ 85.0394 794.5015 null]
+1805 0 obj <<
+/D [1803 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1796 0 obj <<
-/D [1793 0 R /XYZ 85.0394 181.7045 null]
+1806 0 obj <<
+/D [1803 0 R /XYZ 85.0394 181.7045 null]
 >> endobj
-1792 0 obj <<
+1802 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F14 685 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1800 0 obj <<
-/Length 1931      
+1809 0 obj <<
+/Length 1934      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥XKsã6¾ëWè°¹2D
-©=h„Ô‡—HPXÒh,6J€“G¬D¢(Œb�¯yÐê`˜zòB
C,-ÓWŒÃ\]‹Ñ²*›$+k3Kô_¤Ñ6ó_&¿™ÁîŠÄ#µ¬ÚÿÔКMÒX!IiOÊ
+xÚ¥X[wâ8~çWð°äL[#Y[ûF't3’
ô93Û�ðŒ/6ée~ý–,ÉÁD„žÝÃR©\*}Uª‹ÈÃ�¹@B†rI†8&|¸,x¸†µ�byÇs½_~ü@£¡DR„b¸XÉŠŽc2\¤_FïCW 
�nfóùä:˜O?Îþ}7›\$ŽH4ßßOf7Ó_¯‚�c`fŒG·ãÙçñ'C»¿’áhüq2¿z\ü<˜,:ÅŽ•'˜j­þ|yÄÃÎðó
+©=h„Ô‡—HPXÒh,6J€“G¬D¢(Œb�¯yÐê`˜zòB
C,-ÓWŒÃ\]‹Ñ²*›$+k3Kô_¤Ñ6ó_&¿™ÁîŠÄ#µ¬ÚÿÔКMÒX!IiOÊ
 i¥ì÷eÕÀ"Ð7¤Ø&yV¯µ*Õ.ÉÍÄn“šÙV튬®³ªôâø¾#y€dˆðõ·}4B‚I‡vR¦~‹ÌÅwY„s)zÑ(D|”˜鉰G5ž
 k«wÔ‡¢PÍ.[š©*—»Ã¶�c›Ï:CZ™õ~¹±Ò-å§ÛñµuOÇ' VíÛþÎ@ªžUiFͦگ7nl�±Ý?åZ
=Ö ¢=x;Ñpšew²VìŸ{àÉÁë‘Ň;VÚp#I9kÕ™ü:¾½ÿ4ñ 	Œ`&¥a\èx
-·9¤Ä�wEÚ=��˜¿HÄÁSÖè	DîùØP�š@iAÖsF ¤U
—Äl×èØÞD_Afí¨þ—Û\¡eUx4Eœ:^�.en»æyõ-+×fKQ8aí[µÏSC²ìàä{•þÛ£S
+·9¤Ä�wEÚ=��˜¿HÄÁSÖè	DîùØP�š@iAÖsF ¤U
—Äl×èØÞD_Afí¨þ“Û\¡eUx4Eœ:^�.en»æyõ-+×fKQ8aí[µÏSC²ìàä{•þÓ£S
 �âh=×OËîg
 ÈCAbþ[Z“ù€,Áršœ¦GoѶZc¿œ&î4ÆOÊÆ:‡‹…;ƒ
Œ«Õ‰¯�e
 ß‘O¶ýåHIôÆô‡P�/ë;mÓw�
-3wÜw�‹¾|1Ä0
­9ûðzŒCº¿´Q«i/}»£2ºPð:¶@PÄDº uæŒgb lË7ƒ !q—„»
L� ò8ã'1ùdóóñŽPxXte€ïÊSïêÏ'6MŽ?Íï.
-…!O%Î.J¬«$€N5KòóÚ¨A‰_Ý�ê¢thÖÇjw^„9E˜ž6kΕÏB¡ǯ<mÛ�vž½ú7`ULU¤êùÌýÆüàõeÀ›dל»áJ ¨+:©M7z>«´“ŸC7•”ûëÑV_±„l&edkÛ`a¸áN#„½™Z<‰¡é%“›Éüúaz¿˜ÞÍ<õíÛu•''‚MiÈܽԌ:;Ö–öÐþëÏT¹œŒ¦�!¹öÖ2ÎL–„Ó,
-!@¿‹zª"Ü]¢üüúòÐù‹ÆqèYL£h•ÒÇ$˜½RÝ=Ô¾Öýÿ�~·endstream
+3wÜw�‹¾|1Ä0
­9ûðzŒCº¿´Q«i/}»£2ºPð:¶@PÄDº uæŒgb lË7ƒ !q—„»
L� ò8ã'1ùdóóñŽPxXte€ïÊSïêÏ'6MŽ?Íï.
+Ue4Yá«ÆYYG§2W™

cÄetÒTûf»o‚U–ûä÷ˇNþºmºÑž=áê	ÖÝæ.Mô3@[téÄå—±>*�zûl�Äì¢ÄL_ögW¿è©h�Ê#Ò·Ä
+oq†j"iü™6¢¯œã÷‹:ÿž5 ´�Â�…§g%ÖU@§š%ùym	Ô ‚įnHuQ:´ë¿cµ;/Âœ"LO›5çÊg!ŽP„ãWž¶íF;Ï^ý°ƒ*¦*Rõ|æ~cþ
+ðú2àM²kÎÝp%PÔ•�Ô¦=ŸUÚÉÏ¡›Ê¿?Êýõh«¯XB6“²²Žµm°0Üp§B�ÞÌ-žÄPŠô’ÉÍd~ý0½_LïfžúöíºÊ“Á¦4dî^jF��kK{hÿõgª\NFÓÆ�\{kg&K‚i€ôð0Ÿ~4´þ�“m)´š\¥û¥êo«QVÚ³ÚÕm“¬ª•}m°z÷°5=‡Œ�ÖŒÛÎHé: ±<XB“4úDÐv-@KU®Ö‰îÉíÂÊhX˜ånƒN? Úâ
+ے
ŽšqWÞ–Uûe&™-®RÕèW£$ÌŸ§O
 endobj
-1799 0 obj <<
+1808 0 obj <<
 /Type /Page
-/Contents 1800 0 R
-/Resources 1798 0 R
+/Contents 1809 0 R
+/Resources 1807 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1789 0 R
 >> endobj
-1801 0 obj <<
-/D [1799 0 R /XYZ 56.6929 794.5015 null]
+1810 0 obj <<
+/D [1808 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1802 0 obj <<
-/D [1799 0 R /XYZ 56.6929 635.5323 null]
+1811 0 obj <<
+/D [1808 0 R /XYZ 56.6929 635.5323 null]
 >> endobj
-1803 0 obj <<
-/D [1799 0 R /XYZ 56.6929 476.3563 null]
+1812 0 obj <<
+/D [1808 0 R /XYZ 56.6929 476.3563 null]
 >> endobj
-1804 0 obj <<
-/D [1799 0 R /XYZ 56.6929 407.9215 null]
+1813 0 obj <<
+/D [1808 0 R /XYZ 56.6929 407.9215 null]
 >> endobj
 622 0 obj <<
-/D [1799 0 R /XYZ 56.6929 365.2162 null]
+/D [1808 0 R /XYZ 56.6929 365.2162 null]
 >> endobj
-1805 0 obj <<
-/D [1799 0 R /XYZ 56.6929 326.9947 null]
+1814 0 obj <<
+/D [1808 0 R /XYZ 56.6929 326.9947 null]
 >> endobj
-1806 0 obj <<
-/D [1799 0 R /XYZ 56.6929 293.3376 null]
+1815 0 obj <<
+/D [1808 0 R /XYZ 56.6929 293.3376 null]
 >> endobj
-1807 0 obj <<
-/D [1799 0 R /XYZ 56.6929 221.9809 null]
+1816 0 obj <<
+/D [1808 0 R /XYZ 56.6929 221.9809 null]
 >> endobj
-1808 0 obj <<
-/D [1799 0 R /XYZ 56.6929 108.6903 null]
+1817 0 obj <<
+/D [1808 0 R /XYZ 56.6929 108.6903 null]
 >> endobj
-1798 0 obj <<
+1807 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1811 0 obj <<
+1820 0 obj <<
 /Length 3191      
 /Filter /FlateDecode
 >>
@@ -7880,26 +7933,26 @@ S|=R�‰
 ’Uc3�®è±G 
PÅ…sÈA×�Æ¿)ס¾œ€¬´/ì®'“�Ã>L0ƒ�¾â4j¸;m$ï;ªúé««˜ÚnØ;n*n&Φ^#c8Šì
 Yw9ÔαK[é§>qA2ä:Œ]—Ç®»Ùb9ÉtÐT½kwíâ®\ï£$T&Môqñ:®ùÆé™��MÓ±€¾LÕ2‰ªÿ!£
4˜†…&þ’M IX"úºç…Xh¡Î¥{`mÃÄx‰â�Dº¥‚\+ífÛƒ·/®XÓ3Ês€–¤±4P9�cF)¥b¨¤åØú,Á¡’Nñ{wYùÍöå–à‡}H¸X›ìÄ…Ë�ëˆ.ïC{ø¸1'–L3KŽ*0Î`'K¾ß–Uˇ~ÎÁC½ee4»Í&ß>¸Œ k®0¸â¢,÷A~¿ÛÝÄ-ÎHÊ8ÀÕ]%U
Àì-ˆ¾3cÃÔĉs#?˜³ŽJ3˜×�ÈN†\‡­Óqy딧®Ã@•Åª�ýä|4¶£²u\3Â�““Ú©K÷¯.ÓÈéç‘N�Oe½kÖÏ‹œØåì[%'�yÓ„Þœi>(ðlj>5ñW›Ø¸-†	­ÄÙ
 ÿLLƒí�2fFo“Í.t»5 óQ ‡ÖqRÝL3ýçå:”a	ÿ”3gÎS€kƒäwtg0©\„g5Méæ‹jaÒ]V£:k_Y¨®²ÈižP×e¬Û¹¦Ï
Qîàû®õar!h„Íf²Û,/ƒ½·LæÑ4b¸7“�ºçV¿OeS»iÊUA#W¼rM¿·¼ª—’®Và©©ëÊOæ<4Ìå.íñ{–Çu¾ä*Ä…PK´ëÏ2	‰Rw¤H§‚�Þ›Û?5ÄÀn¯£¿w�q ñ
q
{ÛnÒ’Ü�·[-™~[´OEÙ€{ôª‹H*T]vˆÍþ2ª�k%
âÞÑrÅ—ûñc- …Ô_�«	<B†?{'Š¸/.jCÈæa¿(ð´¬� ©O[Œür Oc­º´)ÔK
¯5z³îðó–Ëi	…›R“rºV§tK„Í„ëa aªŠLUÑi�sâ	ñ”
˜@‡?�
-…<põ	:*¯-ýjØäJæ_+á°¢¿šr
+…<põ	:*¯-ýjØäJæ_+á°¢¿šr
 endobj
-1810 0 obj <<
+1819 0 obj <<
 /Type /Page
-/Contents 1811 0 R
-/Resources 1809 0 R
+/Contents 1820 0 R
+/Resources 1818 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1789 0 R
 >> endobj
-1812 0 obj <<
-/D [1810 0 R /XYZ 85.0394 794.5015 null]
+1821 0 obj <<
+/D [1819 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1813 0 obj <<
-/D [1810 0 R /XYZ 85.0394 751.8312 null]
+1822 0 obj <<
+/D [1819 0 R /XYZ 85.0394 751.8312 null]
 >> endobj
-1809 0 obj <<
+1818 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1816 0 obj <<
+1825 0 obj <<
 /Length 2975      
 /Filter /FlateDecode
 >>
@@ -7919,76 +7972,75 @@ U×ëì$Mé±°!Љ=¾úUSÿ_ùó]Eúžù‘|;¬r©¤S�Áq@ä3
 
e nYÝ_Ö“ëT=]èO�bžÁƒ]
 ×Ä‘«8½RHiñ±üýõ¿©“HXÓ}tÕ
 ¿öˆÖšÑX
9ø*øå�fCbDk7•ùGÅuSž/…ËS
æ4¹öÓ=[®�ZÄ?G€NÖæÏ-Ï7hÁú'¨'LJM_ÿvõë§_®G"8„ì�Ã%�kœà“Òv[=7 þ§º#&Âî_S³	ý‘”;$oŸP
À%³õh´Œ~Þ$
4²Ø¢y Í›@ÔÛ›+j�Q††
§ãóòÈËú
-c­ß!+kÈ_W°L
wáŽÆ&¼–aã}ç$ì{pß
ž‹˜OCN%C7å;Œ�j!K}ö?vǺ!È�‡¢áHæî(wí6
+c­ß!+kÈ_W°L
wáŽÆ&¼–aã}ç$ì{pß
ž‹˜OCN%C7å;Œ�j!K}ö?vǺ!È�‡¢áHæî(wí6
 endobj
-1815 0 obj <<
+1824 0 obj <<
 /Type /Page
-/Contents 1816 0 R
-/Resources 1814 0 R
+/Contents 1825 0 R
+/Resources 1823 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1789 0 R
 >> endobj
-1817 0 obj <<
-/D [1815 0 R /XYZ 56.6929 794.5015 null]
+1826 0 obj <<
+/D [1824 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1818 0 obj <<
-/D [1815 0 R /XYZ 56.6929 119.3275 null]
+1827 0 obj <<
+/D [1824 0 R /XYZ 56.6929 119.3275 null]
 >> endobj
-1814 0 obj <<
+1823 0 obj <<
 /Font << /F37 747 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R /F55 970 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1821 0 obj <<
-/Length 1544      
+1830 0 obj <<
+/Length 1542      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥XmsÚ8þίàËÍÀ´VõbÉöGJH›¶!¹@çn¦Í¸5rÎ6´ô×ßÚ’ŒmÍÍMf‚-¯wWÏ>û"“>†?Ò÷9Â,pû^à"Ž	ï/¶=Ü_ów=¢e#ä4¥ÞÎ{o®™×P ¨èÏW
]>¾Oúóå—Áèþ~2½ºù{èPŽoÑÐánGÓÏ£Ojí~ÐÁèÝd6tˆ'˜B¼x0ÝN®œñûÉøãønz=|œèMæµcMç	f¥Wÿô¾<âþöð¡‡|Þÿ
7‘  ýmÏåq—1³’ôf½?k…�§Õ«608ó÷©gC#°¡Á$e
Û_Ê<�N¯å¯TFjÑYëßTýF?Ãís¡EºÕo=¡“µ¯„¹%,à›C
-8§•¡�
Iô
-cöŠxÔõl¢mµ¨t*Z¶‰vß\ÃVŽ»,E|$|�W"7RÅ´ØDå„Oé~HúNÛy­‘†¢ @„ø.(¬|ê
-Wo6™(´FŸfwöúAÂPF›yá[Gò+,ûð�èzᶚ
A.6åâíÍôJ™	´µå6–q^d!G-=4óK-݆r&¶,~™B«·ÙwQàS®ÇJ#åŒ[ô¹Q—“ºhXpshÀ‘xmøFŸçïï~�Û�„”�‘fæì�CuÐiœÊ<ÍŠx·=šus…	—K‘çCå­€Dº0žTuÂYl¢ÅwS,ªØrä	îUÂS9ãZPª<Ö›†U%)õÔUõX'X*ËŠ³ÞAÐâTZêéAáO-\*ŒåZ'iš&/!ãA¦Ï9T¬Î!``Ð
-†ÖÎ
-ÁœâÙÑô�¸¼
-ý¢sµ”Å»9E�늶{ãMUsÓ2>e›=å¥3•/<;ƒ[F¸@ÐI�džj¥›P«�å"Ù-#uslÐñ¾œ+
F¥yKË� \4…§¼®gˆòF�0é"‚N¥Ú"@Ä‘+:3]¨™kâeC°Óìz:´È˜ÇÛ8	³ä`j›ÁÌPT
mg¹I&°`¿áVCê·ŒTÅ­}×dÀ G‰ß˜4B“ÍXÂ)Ñ÷¼ŽÉû,–ÝTÞôW'¦ÉãòéiÅ�S r],šÃî¨8:¶k˜1u€¤Ž@ô3.Î
+xÚ¥Xm“šHþî¯ðËUi%Læøh\7Ù$ëýÀ**	 ‰ùõ×038š½ºÚª†¦»çé§_ÒÇðGúž@˜ù¼ïú	LD±íáþž½ë-ã!§)õvÞ{sÍܾ�|Ie¾jèòö<ÒŸ/¿F÷÷“éÕÍßC‡
+<x‹†ŽÀxp;š~}Rk÷CŸFï&³¡C\É8‰RLâÁtt;¹rÆï'ã�ã»éõðqþ¡7™×Ž5�'˜•^ýÓûòˆûKØÇFÌ÷DÿÜ`D|Ÿö·=.œ1³÷f½?k…�§Õ«60ó�ð¨kC÷¡!|$e	Û_&y.œ<Z'¿Ò$T‹ÎZÿ¦ê7ülŸã-Ò­~ë	�¬}%Œ—°€o!È‚V†>6$Ñ+ŒÙ+âRîÚDÛjQéT¸lí<,¾¹†­wYŠxHz®¨DnÓb–d<¥û!è;mçµVDŠ|âqPXùÔ
èÔ°ëB
+J~‘
‰7ƒ"Ì[
+�gAè˜%T A}¦_ž2BóM”·ÌU×ù&ÝÅKµó§Ê…¾Ã¤‹0a¤åý*T¿É"\*
‘†3P?Š+•ê¶º
“¢+wºO"€ˆ¾ô´ÇI°
—°ÇdeÙ�¤ˆJ)´¨ÚRŽSâ"&!5Zñ6¯C[ÞP½Ÿ*|úq <«'û(ÝåñA=ÒXW×f‡tð#*6jm®‚]\hA(Â,¯ çà�æÖsí
%ö=<ÃÊ¢Zò|·í’[… H„OaÒšH‹]¦Ã£A_Fê~Q¤ÙaH€È'At
X<ÛRÚÐΖí—/“Kš¿ ÐV= ýzµÚ/s¡à	Uðf“‰Bkôivg¯T"e´™÷¾u˜|…eþ]/x«Ùı)oo¦WÊŒ¯­-·QåE@pÔÒC3¿ÔÒm�ì‚Ø–åÒ+Ajõ6ûù1eàáz¬4r̘E'ˆrAê¢aÁÍ¡¾@žï¶á}ž¿¿{ø=n7	¤DjfÎ9T]‘Æi’§Yí¶G³1.M¸8E®•·	èÂxRÕ	g±	ßM±¨b+�+…[	OAäŒk~©òXozT•¤ÔUWÕc�`iRVœõ‚¥‰¥ž’"ø©…K…Q²ÖIš¦ñKÈxHÒç*VgŽ�00hCkg
+DœcÙvÿCÅѱ]ÃŒ©”è„?£âl
 endobj
-1820 0 obj <<
+1829 0 obj <<
 /Type /Page
-/Contents 1821 0 R
-/Resources 1819 0 R
+/Contents 1830 0 R
+/Resources 1828 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1839 0 R
 >> endobj
-1822 0 obj <<
-/D [1820 0 R /XYZ 85.0394 794.5015 null]
+1831 0 obj <<
+/D [1829 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1823 0 obj <<
-/D [1820 0 R /XYZ 85.0394 562.7154 null]
+1832 0 obj <<
+/D [1829 0 R /XYZ 85.0394 562.7154 null]
 >> endobj
-1824 0 obj <<
-/D [1820 0 R /XYZ 85.0394 499.03 null]
+1833 0 obj <<
+/D [1829 0 R /XYZ 85.0394 499.03 null]
 >> endobj
 626 0 obj <<
-/D [1820 0 R /XYZ 85.0394 459.6249 null]
+/D [1829 0 R /XYZ 85.0394 459.6249 null]
 >> endobj
-1825 0 obj <<
-/D [1820 0 R /XYZ 85.0394 426.4105 null]
+1834 0 obj <<
+/D [1829 0 R /XYZ 85.0394 426.4105 null]
 >> endobj
-1826 0 obj <<
-/D [1820 0 R /XYZ 85.0394 390.6449 null]
+1835 0 obj <<
+/D [1829 0 R /XYZ 85.0394 390.6449 null]
 >> endobj
-1827 0 obj <<
-/D [1820 0 R /XYZ 85.0394 324.0377 null]
+1836 0 obj <<
+/D [1829 0 R /XYZ 85.0394 324.0377 null]
 >> endobj
-1828 0 obj <<
-/D [1820 0 R /XYZ 85.0394 263.3171 null]
+1837 0 obj <<
+/D [1829 0 R /XYZ 85.0394 263.3171 null]
 >> endobj
-1829 0 obj <<
-/D [1820 0 R /XYZ 85.0394 199.6317 null]
+1838 0 obj <<
+/D [1829 0 R /XYZ 85.0394 199.6317 null]
 >> endobj
-1819 0 obj <<
+1828 0 obj <<
 /Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F47 879 0 R /F53 962 0 R /F55 970 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1832 0 obj <<
+1842 0 obj <<
 /Length 1880      
 /Filter /FlateDecode
 >>
@@ -8001,50 +8053,50 @@ xÚíY[sÛ¶~ׯÐ#5S!¸’à£b«­{;µ•¶Ó$´Ù<¡HE¤âª¿¾‹ER”�LÜNÏÌϘ °Ü;>`WdŒá�ŒEˆÂ˜Æã(æH
 =×gP[¨Ë&oÀ�´ƒ
 ÔZµ'(Ý÷Ný�Zz·Ã-'欇—®ñe[c¾6f8×۹ľ¶šdvÞ«:£(˜¥PFge‘äù~BÑf1k“Í&ÏtzVõ6[Ö;³d\erõYå•�¾ÝÛ§kÁi~TGôGô‚ñ„þJ{Ç÷Ú–•»z£½Êìª,ÏíH÷õ²;µ£¤rÏÂ=—µî»˜±õ²5®!vgú¯o÷)A

)Ä`À0ŠcvèãL¦Á¯
 cØ¡Qø”—â’7ÂQó·ééœh„aª2ˆ»�°+s^7ôÝ5^cAß<zÕo�î¬{"-tšöåA¤p=.ÏÓËk{)‚ë~$»òæEr›7]ÕÛÝÝ@,:e3\!àH|ÜäÍi‹�1øÓ)ƒÖØÛ6dnKØÏ»Ìw,ÍýÇŒ¦ýöô²Y*‡UèÔÏ:L_wØ�’¸I±oþÉçðãÜ}Í¥jÐ`
-‡9|z¥´ÅËã`bDYHtÿÑ®vendstream
+‡9|z¥´Å„àã`bDYHtÿÏå®oendstream
 endobj
-1831 0 obj <<
+1841 0 obj <<
 /Type /Page
-/Contents 1832 0 R
-/Resources 1830 0 R
+/Contents 1842 0 R
+/Resources 1840 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1797 0 R
+/Parent 1839 0 R
 >> endobj
-1833 0 obj <<
-/D [1831 0 R /XYZ 56.6929 794.5015 null]
+1843 0 obj <<
+/D [1841 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1834 0 obj <<
-/D [1831 0 R /XYZ 56.6929 687.0104 null]
+1844 0 obj <<
+/D [1841 0 R /XYZ 56.6929 687.0104 null]
 >> endobj
-1835 0 obj <<
-/D [1831 0 R /XYZ 56.6929 626.5588 null]
+1845 0 obj <<
+/D [1841 0 R /XYZ 56.6929 626.5588 null]
 >> endobj
-1836 0 obj <<
-/D [1831 0 R /XYZ 56.6929 566.1072 null]
+1846 0 obj <<
+/D [1841 0 R /XYZ 56.6929 566.1072 null]
 >> endobj
 630 0 obj <<
-/D [1831 0 R /XYZ 56.6929 528.949 null]
+/D [1841 0 R /XYZ 56.6929 528.949 null]
 >> endobj
-1837 0 obj <<
-/D [1831 0 R /XYZ 56.6929 496.7215 null]
+1847 0 obj <<
+/D [1841 0 R /XYZ 56.6929 496.7215 null]
 >> endobj
-1838 0 obj <<
-/D [1831 0 R /XYZ 56.6929 461.9427 null]
+1848 0 obj <<
+/D [1841 0 R /XYZ 56.6929 461.9427 null]
 >> endobj
-1839 0 obj <<
-/D [1831 0 R /XYZ 56.6929 398.5692 null]
+1849 0 obj <<
+/D [1841 0 R /XYZ 56.6929 398.5692 null]
 >> endobj
-1840 0 obj <<
-/D [1831 0 R /XYZ 56.6929 263.2909 null]
+1850 0 obj <<
+/D [1841 0 R /XYZ 56.6929 263.2909 null]
 >> endobj
-1841 0 obj <<
-/D [1831 0 R /XYZ 56.6929 125.0477 null]
+1851 0 obj <<
+/D [1841 0 R /XYZ 56.6929 125.0477 null]
 >> endobj
-1830 0 obj <<
+1840 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1844 0 obj <<
+1854 0 obj <<
 /Length 2946      
 /Filter /FlateDecode
 >>
@@ -8056,421 +8108,421 @@ xÚÝZY“·~ß_ÁGn•ˆà>ײìȉÖr´‰U±ý0KÎ.Ç&9kÎP²òëÓ8çr#U*m•ˆÁô
 ѨôÌÑi›jš‘ÊAóðYÁÑ,_):ò5uk²MÆœç½&Kç|í³+‘16R"c49_Kpª!ÉùºjIóP5qçØŒç;(¶ô�/â�²è|;_Ž_`�ÚÕ2úµ—t+d¸øÁÅ—
 ŠÌ3<»0ÿÿQÑ
 I†ÏÜiSM[f¢r–YžOîA£VJëäQpñóÌ%ªî:öÉmÙS«.{?^+¾<õ Ë‹I|¨I»50ӳǯbd
½‰¹¿�nþ„œø.%®ñwêÎêòøiZö1ÿ¹MLë_HÄ$;ã™ÛT3ú�TNÿÕÙK-Uýi—O^j™å¬¹Ô2dmôRK‡·Æ9k2}ƒ;®ÏUÛïleÀù_èXѦ©
-rnW€—÷^5ŽWyʹt“øKO—Áñ,#N;Ó¨ó°™»2í�ä˜ï2[¯ž˜È—b²{É \«èî
+rnW€—÷^5ŽWyʹt“øKO—Áñ,#N;Ó¨ó°™»2í�ä˜ï2[¯ž˜È—b²{É \«èî
 endobj
-1843 0 obj <<
+1853 0 obj <<
 /Type /Page
-/Contents 1844 0 R
-/Resources 1842 0 R
+/Contents 1854 0 R
+/Resources 1852 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
+/Parent 1839 0 R
 >> endobj
-1845 0 obj <<
-/D [1843 0 R /XYZ 85.0394 794.5015 null]
+1855 0 obj <<
+/D [1853 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1842 0 obj <<
+1852 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F55 970 0 R /F39 863 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1849 0 obj <<
-/Length 2037      
+1858 0 obj <<
+/Length 2056      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥YKsÛ8¾ûW¨j÷ UYž$pt,eÖS‰âµä�­Jr )Jb…
öx~ý6�"%HJÕ–l‚­îF÷×Àd„á�Œ„‡<EÕÈW	LÄ(Loðhß~»!–gÚ2Mû\W7>1¤�ò¨7Zmz²$ÂR’Ñjýmüùhðxq÷e>›L)çÌß=>γ‡ÿ»ÀÀ,�¿Ü-žï>›µÇ‰¢ã»ßæËÉ�Õï7óUgNßd‚™¶åÏ›o?ðh
–ÿ~ƒSRŒÞà#¢¥7\0$8cíJr³¼ùw'°÷µù©Ë\H$(÷À1ß;ã(‚|B€Éçzð%.?Y&í¦i¥·ùá“=F¥?û Zs¬ã"
-«¼x?ö!
-yÄ;ÈsYÖ1�šÆz	…
-ã
$SÞømAîæEg“~†»(ü©I¿	G³Á�B’§q¦#Üü4NÖ¡éëís9^\æ2K‡Î
-‚$ÍËÊVÈ.
Ùe‹�™‡:¤pjÓ#¡¬“ʼçóÌcÄIÝji~˜›g�­£¢¬‚l}$°o¦Y
ô†»8ÛZÁÉ6/âj—š×ïXà§O÷æf*DƒËñc^–1
-BÙµl>A\ÀÔw1›ú\糩ãÒu’ë¬?i¹˜!"%¿¬¹ãr¨&ŒD0óùCÝ«®¹äiЖ»Æ˜†Ê7G=èP'_" f¾�œº0ÏhÜ0i“+žëq]ð\Ëe0Ñví“R#Lïü²ê–É¡zè9øêyþPwç¹_ò–±u`ígÇ	Ž ~Ai`>ÂŒšYèi¾z~Z˜ÿgóÒøîó³9ÿyÒJ /ë÷’3ÝCr8Ú°6=LªVu‘µÉkQýWv,©‚ª.‡{$Ãa8*̈[X¶·¨+Q\QSKÛM…[‘ºJ¿Åå÷´æܳœÏÍ�ï>/¿:öèrŠ® R׎ÛÞn<¥G¢ÞçF÷C2´"•uš©�Ú
˜	‡z়«@.� GÚšóña13ò”ÝÕÚL\Vp€Éí8øm¬O³ÐºõK�ÕЋNÕŠ¨×ÀÜ~…î	µ˜¨¡cïžWÿúútÉ£†ï!ƒ^˜E!Ëw˜’Sûû<+ó¢Šëô bÈ=jåp
-KˆöJ`5Ûp´�J¿ÀX5,›ßƒàAY/Ä6Ù(õ
5´Ò]ãʨx�
-—‹ðæÞ³|_Æåq­aPÁ¤ÇFDR$ˆûÚÚ¿¢BÇûb
ì‹0w*ÊQ;®Þ¾=ðà·)ÿÑR^G…vV
-Š·ÇIûóMl]ÇŽ¸/ɱŽÌ!oÊÀ«„é[‘þTó�p_—.É
-Ié«cÉû«NÙCj¸ä1¤ƒQ'¯ì¨Ê!yè£ñ:Á |âˆúª¹p¼,ÜŽ¥ÞÉî_;꯫ֆ
TÞs�žE¸Û&ÅÈ#À?HÒÙ|yÿôð¸zøºøÅ^éš
6¼»Ñç:¨^z
-hhÝIf‹¥Sõ‚-1>‡V
+xÚ¥Y[oÛ¸~ϯ0°çÁb–w‰�iìîÉ¢usbg»@ÛE–m¡ºduIšýõ;)Y²i»ÀA4¢G3Ùo.dÈÃ	‰¤¢jä)Ž&b¦Wx´…ß~¿"–gÚ2Mû\ïWWï>0o¤�’TŽV›ž,aß'£Õúëø=òÐ$àñâæÓ|6™RΙßÜßϳ»¿à]``ŒÇŸn�7ÍÚýDÑñÍïóåäûê�«ùª3§o2ÁLÛò÷Õ×ïx´Ëÿ¸Âˆ)_Œ^á#¢¥W\0$8cíJrµ¼ú_'°÷kó©Ë\øHP.Áa!O8Š �`ò8AœïýD‰ËO–I»iZém¾û D�Q!B…¢5Ç:.¢°Ê‹·C¢�$r/ÏeYÇtlëi$¬|:°ívWLˆ?Îój2eX�«ÜØÊTïK.�ð¥t{ ¶ï{·œen…î+>Τ^GæiÝ ,~‰JË0!ã¬ýÊò…yö
cº­‹ Šsû«^I,C`䘗g³¡0*Ëh­MÁ¸l<…”¼Ai°o̳˜øã:3ôÓ›yæQÆiœEbWÃÎg  YÉ‚4Z£#0[ÄH¥ãÞXõ¹Nãªãj€õê
+âëÚqݼ�§ôÔû¹‘ǽÁ`í†øÊ:ÍÔGíÌ„C=pSÞU —@Ð#mÍy·˜yÊîj
m&.+8´äv|ˆ6Ö§YhÝú)ÈjèEÇê	DTv‡.·_¡{B-&jèØ›ÇÕ??œó¨©öwôÂ,²Y¾ÁdœÚØßæY™U\§{½C.©•Þ!D´·
+_C™òjhݦf‹¥™�õ‚-`‡>3e?Ee~ÒÍZ?Ím¦ÑhJ™ÇZ7™ø©¶wc°²1�Üj»[Þ"C}hNK@¤ù~º÷ØÝ²&Î̹ڴøì`2‚\·õ×.AO-»¦Ê®;’_Œ
ºç¢îS­ïµ_vQ£G_¾ä?L?ðáüSíòº2¿˜£É¶N£¬*¯Q$ÂCÌ÷dÿ8îŠ"CÂÃ-XሕùÆ7�Um÷«Æöäb^Žî$5«½w8F+ñ0⬫
ï¢*|wöòÆWHJæ÷‡}OM YRo˜&}kµ‡ßÚ{�¸ŠÛÛŽuP‡!H
 endobj
-1848 0 obj <<
+1857 0 obj <<
 /Type /Page
-/Contents 1849 0 R
-/Resources 1847 0 R
+/Contents 1858 0 R
+/Resources 1856 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
+/Parent 1839 0 R
 >> endobj
-1850 0 obj <<
-/D [1848 0 R /XYZ 56.6929 794.5015 null]
+1859 0 obj <<
+/D [1857 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1851 0 obj <<
-/D [1848 0 R /XYZ 56.6929 496.4666 null]
+1860 0 obj <<
+/D [1857 0 R /XYZ 56.6929 499.6076 null]
 >> endobj
-1852 0 obj <<
-/D [1848 0 R /XYZ 56.6929 433.6488 null]
+1861 0 obj <<
+/D [1857 0 R /XYZ 56.6929 438.3307 null]
 >> endobj
-1853 0 obj <<
-/D [1848 0 R /XYZ 56.6929 370.8311 null]
+1862 0 obj <<
+/D [1857 0 R /XYZ 56.6929 377.0537 null]
 >> endobj
 634 0 obj <<
-/D [1848 0 R /XYZ 56.6929 332.0288 null]
+/D [1857 0 R /XYZ 56.6929 339.322 null]
 >> endobj
-1854 0 obj <<
-/D [1848 0 R /XYZ 56.6929 299.0792 null]
+1863 0 obj <<
+/D [1857 0 R /XYZ 56.6929 306.8426 null]
 >> endobj
-1855 0 obj <<
-/D [1848 0 R /XYZ 56.6929 263.5784 null]
+1864 0 obj <<
+/D [1857 0 R /XYZ 56.6929 271.8119 null]
 >> endobj
-1856 0 obj <<
-/D [1848 0 R /XYZ 56.6929 197.8388 null]
+1865 0 obj <<
+/D [1857 0 R /XYZ 56.6929 207.6131 null]
 >> endobj
-1857 0 obj <<
-/D [1848 0 R /XYZ 56.6929 126.0307 null]
+1866 0 obj <<
+/D [1857 0 R /XYZ 56.6929 125.3906 null]
 >> endobj
-1847 0 obj <<
+1856 0 obj <<
 /Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1860 0 obj <<
-/Length 2811      
+1869 0 obj <<
+/Length 3024      
 /Filter /FlateDecode
 >>
 stream
-xÚÝZÝoÛF÷_!àJáf¿—D8±/pÑ8¾ÆA´} ©•ÄV"‘t’þõ7ûE‘%ù�ôå Z.ggggg~óA“†d–„YÊg*åH`"fùæÏ–ðîÍñ4q ŠûT¯.^þ›©YŠRIåìaÑã• œ$dö0ÿ5ºº¿¿¹»¾ýå2¦G¯Ðe,0ŽÞ^Ý}¸úÑÍÝ_¦4ºzsó9gˆ”!“8º»z{s}ùûÃ7�8}‘	fF–�¿þŽgs�ü‡ŒXšˆÙ'xÀˆ¤)�m.¸`HpÆÂÌúâýÅ:†½·vé”
-K�H¨šÐ
%3BP*(A¤H2ʬÞÝ?ܾ»{pŒ°
-d¢—ôŒô©Ž[AGµ|Ê
-NnÙYÁá–SV0زoòï·þd 5KÙ9+èQ�°‚@eÏ�àBôLj2À2'x^•‹b/
-PñH<"	”³ÓòuTô%%ÂX¨¡„Æhœˆ}ZŠ‘T‰šqÄWæ&€ÃþÀjX*œu�>Ìâß0¦Ëv—5EUº·ff­Ý¸(ëFgsGmìk°|®Y»n^LÙ‘ˆ‹4HùR7ùË2Ûè¹½çYÌ$EI!&v¡‚t‡™8e(5�Íñ‚P˜H=˜(Y]Æœ‰H—ulÌ<7«¬1#¹Ùu•Í‹r^zªƒÓ›Épz³š¢luíúÝ>U»?A¶hônĵֻ§0¹�Ûã†Ä]`4§]eåRå²4*šÚ
w+«y˜î
-Ñ
tsrË@4±å ÍQˆ&‡[þÔ–#Í8tú½\x/Ý·¥wêß°À¯�
åVn¶¬|*äì´øK9®W¸V&å9½ö¨Nè5PY½.'ÒÇ$•g¶D[ŽÒÇD©Ñ–ßH¯Yx‚<ØóÚ[ìº
-^(ö®>J"!£‘]d¨›¹Þí¦œN dOvô’¸JMÕ™KêS¿¤ŽÊ^Òf
-9à H°Xg7I RKÂåiÁ:ª	ɸH¡HNE:
2µ;)9‹lÄä<Ú€MÛsm�-µÎ÷Èh¨ ®²lY›v
-=1‘}ëÄŸË>¡R†ì›³¾|*l̤nêÛAe¾`žPUn\¯ÇL¯ü l7�6äswCkäw3[�)ºlÜ„ö0È÷a×T{ÎA‰žEà\‘£½]¸™Â3-ünméûNœû<
Ô08`ÿ}`ëNÑëX™S¼ð©ˆOo â…¾V¸wǦ'²yW„Ô%‚ûÓÎ�:"³á¢ÅIOìSwÅŽÊúâö¬/n«]sèŠ%\œ–+MÈ5Ì9 TR9ìÇ¢nB“Ñ$vð±Õ»BסéKf/ß8ò
ÈÒ½/î©Î‡¾ÛÅ(8Ö¸�²-¥a—ÓnfG‚¿S	åçî´GuâN•½Óz¢ŒR	¨âä–�hbËQ¥$‘Ã-¾T<Ú¡‹RC3ö©¡Uc“5p­E^ŸÈ×Mi.9ݧëU;uq,�ÄF†
->Ø‚þ\4
-'–� €• :NŸæYb¿€	ô€Êt(Àh�òrë0ðòC·‚�s† ]Ld-)}µ÷>K¨þ%…Ä0F‚aa~×S��œø–°`4÷w—±$�ÂÇ’F7ª
¦ŒŠª$	’K»ùìãOSæ¨zc{Ú½ìÄËÛ
�]Wp¦YÿX�sÜgmÏ%iÿº¡<KœØ,ŸS¸[q¬œ+©®“gÆnNF›¬ðŸ"”GdxWzk÷íAùìTE¯nï®ÝšÔMÌõ%ÃÑÓ%¦É
-ñÃoãM¼
Á·ÈA´‚,S]á×ͧ¢‡…(•ì{¤æÁֹ𛹟EÛ´;íÆ;½6]ÃõÀ`¹	ÀL¥o_ge,�ùÔ4t÷ŸH¿Îb_(ÅÔÈHø	0r‰Ï¡XGeQ¬™ˆL)‚h¡¦ÚÁ«hJ%c³þ¶‡á)PMH7$r~oâ½vq½²!‚Êé6£IÉ{N÷tÈ»ªÓwé
[—$U¹®k×æ0[Ù؃¼ÚlœáÂÃÚe.` ®’^¶Ȭl–ÂHôØz9õbß&„ç��$Ü”8�Ì»‹wÍs_¬Ðµ>
-¼DrD¡¾	ð¦ñ„§ÿƒK„Ç€Wa¤0 ÐÜ%èêãÝìBí§h¨¿®,àþdÿg!ø¶ÓèÍQ †Œ’¦„{ Æ�žpîÀ·?>Äì÷YŸ
+xÚÝZÝ�ÛÆ¿¿B@J
Öz¿—Šgûj\_®ñ
�ä�'Q'Ö)‹¤Ïî_ß™ý HŠ’\ÄyiXËåpvv>~3³{lFá6‹¡"‘3“H¢(S³åöŠÎžàÝÛ+æi�hѧzõpõòÂÌ’h®g믘Ð8f³‡Õ¯ÑõýýÍÝ›Û_æ®hôŠÌŠÒèÝõ݇ëÝÜý<áÑõÛ›÷ð(¥Ð@d�LÓèîúÝÍ›ùï?\Ý<tâôEfT ,Ÿ®~ý�ÎV ùW”ˆ$V³gx „%	Ÿm¯¤DI!ÂLqõþêŸÃÞ[ûé”
+”ˆ‰Š¹™Ð
g3ÆH¢(A%D.¬~º¸ýéîýÑN(¡
+ôd8'LédZùžhѧ
+O(?Páº9^2Dˆ˜Ÿ_2M,)zK‚™KÔpÉuæÌz{ÿYºQU_Ý(ûœ•n”¯Ýo³ñ䛪nÜh›.7yé§óÚý.Ó]úXøÉjÝ-¡	î1é	Æ•"Ilp?-Œ„g’H©bO’–«	>,!BØèËlösG^ÊmÛ´iÑmý˲hëüsFNy�N‰�:ï=¢Ó>ˆRO¹À¹õ:8ZoÊ
úëõí¯ÿ|ûËÿ#ûkFT".Øÿ@tÆþžÈJ½tR+Õ—š.
+:EâÙI#Ið6
�tÞH}ªÓFꨬ‘¶Sø+
e@‚u‘Y’A¦ÖLêó‚uT’
p‘Ccœ¨d(T.4j÷˜)¥ˆlÆ”2Ú‚OÛsm�>en¸: #RA^éS�G
+.¸Õßòzù•lþþ
•Í)ÈS”Hj.äû>ÕÈTòÊ‹%ç_–»¶>Æ<Mbäg%ë¨&D„ˆ€éH´×¾j¦
+/l'¿[è^ó]á‰^ߨýì­'°%¾«wÙ2Ǧ&[½˜¨DÑK©¦—*Qèš¡—bÔû<ç6ÿj7˜
ì ²¾à¤Ðan݉Noü l·�6ýK·¤EùÝÌÎãKV6nÂ%~,†°ßTÎA‰žEà\‰£½]»™Ü3ÍýjméOŸ¤ô5¨a
+wñ—%¾Ô�ìN·‚Ý›žÈø.eLh
+»]�G‘h(dAгáا:Ž•
ÇÝÅpÜUûæ8)‰¡R8+W š�kX@Úäz$Ø�yÝ„£F,íàS›í󬇒¾}öò�³ `-?Äâ�êr¼]�jùA`�›*{¼4<ë´‹Ùô'm
+PœÁ/Ø´GuƦ�ÊÚ´žh©Lª8»d šXrÔRÍôpÉÍ�Œöy8Ñe"Ž}™hÕؤ
˜5_ÖgjwlÓµä‡Ò½j§'b(rtèæƒ/d_òæHáŒÂgP
¡\Ks)Ý‹ØÞ€�Hø€O+ô™»+÷^~¾ÕA:�_CNjï]K1zá��ÇÃZíÂ䮧¥%ógÃJð�âš/4ƒr~¡yts¤`*¸ŠgÜ@âL¸
ÑÙ§¬ “D8ªÞØîö ;ñòvËgo*ØÓ¬¿­ÀyÑgm÷¥yßÜЪ%1	b˜d¾•|ظP2Ý©ŽÝœŽ¶iî/$ŒGdxWzgîÂøJÕD¯nïÞ¸o7±Êæ‚FŸç\á�+ä¿Œo:
ðF‚¯î#Ñ*þm5gÊ·f
¢L|8/ÅÛóÂoê~ÖmÓî37Þgž¸ ×#‡•˜€¸Šw	öǽLÄ0ŸàáîáŠô�ÅÀÂ7M�Q‰ òÜ­-3lÔ.ÜztTÅÞ_.·é—E]-?W‹ 8èžõ>NP�jB¾áÑ$å±d(àuQTÏeèÅzÒ3ç}2–a'¡³jCûÕî†9Hm
+4.º>s¨…q¹Ï	׺;
ª¬©O"$§s¦þ.ÉDB¤áòpÞî“S©)1x«y
"´‚1Õ±ÏM	ýšá¡cº¶àø³ý÷ÎÂåm7æÑÛ“ ‰°´ò I
¿¤t@ÙŸ
+OÛôßH
¨•7ö3�ÀÈ´F4µx¶�TâaB÷b1±}XÔçöV‰÷np pRã°Ù¥#|ÌÜ›MjÃh»n7ó˜-SDHæoD¿~snSEëßw �_Ùå¾,¦D^fÈ@2ÏZBóUäÛ¼	Wsðw%™t½ÊœÆŠ¯îzÞÖ_¡ºÝ:‚ëû[âfoç,jÜUâ×ÙgÞ0~Å:küR˜'™ç
êIRí…€ÁÊñp•*NîÃæPðùñª¯vc§‰
ÌÞÛýÑÞ¤å^/½Sìšjï¿ö‡Sc:£@ŒaöíOÑ~l 9cçûªÜÚÆ)­ÀË�¥ÍÂÏ¥›¶4L×ín‡N)iä?èÖhK\Ñ7tVˆõ”Œ€“(ÆGüðÒ;5”½Ñ]ÕX3@ÅPÔxÕÊâp‘sÞèðr‰9àÆ
++­¦%WãZïÈúNµ—Ê,—UØwHTF™%IBµ>&*ÚeÁ?ü§t‡?”†€h'º@¨ø Ižy#/4
cb¬âî�î<YOöÿ�O•ªendstream
 endobj
-1859 0 obj <<
+1868 0 obj <<
 /Type /Page
-/Contents 1860 0 R
-/Resources 1858 0 R
+/Contents 1869 0 R
+/Resources 1867 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
+/Parent 1839 0 R
 >> endobj
-1861 0 obj <<
-/D [1859 0 R /XYZ 85.0394 794.5015 null]
+1870 0 obj <<
+/D [1868 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1862 0 obj <<
-/D [1859 0 R /XYZ 85.0394 751.3856 null]
+1871 0 obj <<
+/D [1868 0 R /XYZ 85.0394 752.2237 null]
 >> endobj
-1858 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R /F53 962 0 R /F62 995 0 R >>
+1867 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R >>
 /XObject << /Im2 984 0 R /Im3 1108 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1865 0 obj <<
-/Length 2226      
+1874 0 obj <<
+/Length 2332      
 /Filter /FlateDecode
 >>
 stream
-xÚµY_oÛ8ϧÐÛÉ@Íð¿DìSzMr^´n/q±ìîƒbщP[òZR’~û›!)G²e÷½C
-4Ël›=ë¢ùîç»|ÊÊ¢Þà4ÁHsËù®ÚúQ¶^ûÁ®ªšàµÜAªÎkYðÚÉ”©8¸.JÓAã×¥Ý6~î5Ô&~Ó
WCxÓ·¢
-ìRÔ~óÆfeàêS‡Ùq
A!½ÒA"ú"'å,�T[ÌhžgU‚
-ît<Á$	
:8Ýziå
÷
¯“›øåÉ–#^¸"™‘?öZ‘òη‹ÀÒh18xŠyÑ­8°É	',õ¨®­3ÌèÊœe¿>ÂÀ
-DS…žñâ§ÇA‹ÎyaÓƒõó�m²¢tn‹†{^_íàó\Ä@õ
S‡ñGøy‹ð𵟿${m vš¾•<?‡Y€¦$M@P	@¤â|}Ö
raÎ×G{*Vχ–Ñ Iõ™‰ìˆFDöC'AP£"ï,B¾—1qðlwµ^œ”íæÁ{õ‰öµhŽ®±;ºâŒ@Rc?°O�êŒ}:*gŸ×±ú‘’
-Èà[Ëlùd§+ðñCí‡$¯àÖΪ·§ÑO R„0z¨àÇ*ʳ&ó£•+ݪÍHY	7¢©GU?�§AœÖÝ)‹wpgn·V«ƒw¹]eí:Üòsa_°ï8YåIˆ©ù?©ò’ªŒÔü
ív˜“%ž„ûÖ,U?(ñ
-túõS>ú€œ�ÛCõÐË•=§ï’¥À#)ãûšûÙíüêãýH.¡X‡
µ‹#œ¡ý8T–.OµÐ§Z¿°ïK¡*á‚AUòXfXoàËú©j×x<8.>„�èT~äò<—UÙx
k¿Ç''xƒ54Ô€9¿]û8 @Ó„§]Á·+óåXë
53¤Ç@ô¦Ú±FèÃÐgùIô`i°vz½úT§ÑkO.ä_¿}ÜH5Œ�Û�ˆ€å„&зäÞTÎðË
-Ò­†0(òÔÌÌ«—ò¼yàŽ$ �Âï+24	)ÙöÍ]ïQ¸3wmËÜÐqåÕ÷ðÄ„’ë-èPz5®…�¨-sû¥¼´Þɳ„¿„RPùo_ÿ<¿™Ý~½»Bƒ/fŸç?N‹®E\%[3ò=aÀJHB™î:mÈ
-¨écëóv"Æ•µëG¤‡"XkªÊü·´Wÿ¶	‹¹­—»â¡ÛSv«Ðˬý͉@°¦÷H>ÌÙ>—í›"^¸ÄÎ	Whб—aíùs‘w_Њž£¸ãËÁ÷cE¤f]#ä�©�\团,êÌQ…[½³« {ÙEð§¬l³õˆq™N±JÔý>ëðö!Â
8¶1Þ|åz3û8ò:Ä°�«•šŸ�ó‘‹/(JŽã¼#B‘—¶Y^:?!à«ãð†ÆNéä¬ô=Ñ‘øƒð†"]¤ñ‹ÑêøÈ#qÑ{äÉ4Vgà'çÍÓ#:mžŽÈ™ç9Û]îÚ2˜h[äGÒ+yV�=Ñ‘®¥CˆÑWaÜD!ð“Ô´ÈÏ[¨ÃAp{1Ú/Ó½oþôÿ8Þþ‡#!Y¥é	_€$M`³î”ƒ2Æ�/
-.
¾r¬û¿
IË!endstream
+xÚÅYÝ�Û6ß¿Bo•�˜á‡ø…>m.›ÜÉ6—lÐm´6½VcK[KÊfÿûr(Y²e§‡¤8ˆIj8gæ73Ë
+ÿX"Q–ÛDÛŒHÊd²Ø^Ðä¾½¾`‘fÞ͇T/n/ž¿:±Ä*®’ÛÕ€—!Ô–Ü.K_MfÀ�¦7—o¯^Îæ<Ë„J/ß½»ºyyý+Ì%" ¡4}{yóñò
®½›Yž^¾¾ú0ûãö§‹«Û^œ¡ÈŒ
+/Ë_¿ýA“%HþÓ%™<„f-O¶™DfBt+›‹ÿ龆­S*Ȥ!’g*(.pBQŒhÆ€HP�Ú뉳)=E"¯¦yã¯ùü•”BK—X{Še±s‹¦Ú=êƒ1KS{~S’õDÇ¢‰Á‰ŒÃ[ÃG²ýk½›1“VU/ÃUÚTQÖáÎL+àRÂœ
ק™é(óUãvÈ÷
�Y¸º.ÊûxÖÚá`Qm·y¹Äɦ(òLó°ç¾Ýº²©ŸÁš`é]½s«*|�<pœ/=w�´’qb
ͼ~ˆ•’‘ðL0ÁEUþN)¿owyST%.ú•�#‡¯`(ÎÊDY67ýf)Lp3m–4™[A2“ÙÓ¼p^qØí³šwÒÍ¥ÕDS­‡Ïßß}•M¸†çWÈ<’×Ç/ƒG”*cÁP€¡æ�m^Î抧ïÃÿ7ð?K¯û1O_éJÞ›(n‰‘2¸pòhÁ2�h8·ßk%,<¿ÞŠäewL†×ŒŒçCÎᚊ�¬\%€»’�çÇkÞ®‹žØê´zˆÏmUZ¯«v³Äõ;‡¿míâJ©ÀRþlËE·M§�E³Æ‘·¦ ?a"pp4îÍ8o‘f,fJ`Y$A¡ÀÄei%]¬wà–½=sa	?4ç¶0
Þ<'àqL¦mYGó+y÷%¸¹`<]V®.hpÙ•ë¼\8œÔnÑ"‡¢yÂ%oÿ»­ê¸£~ª·­„™ �¼Q£lˆ�3`’Ï€àiJI”PªyT
+-Ž
+Þ
ÇæÅæ(Œd
+^ÐX“õÛ|_€S+@9ßãÛ·E¦¹÷.£
L¸†»b€:
†î¤U&ΣaO5ô‡‚>�•">/8áîP{–“Ì•O<’«#š�kS ÿLÛ¹>¸¦-‚ïó0ȉî2°æŠfõ
K
+ðÒ2r/Ñ€�$ð¦vlÀ#Q
+)‘‚w1úç€}·
õ®N¡^&½�ŒEÔc�
Y‹H7Ÿ@=~õ†œÏ ^¤@ƒþÙÇíL¥o
+I¤Ôzoú5²é”|šqšS—ié6?ÌÀŒ"
DÏü®Ø œÀ|ë€7E½õS¬_^îªAÇAˆ§h¶ì!“‡f{µá�à|Y¸‡ç(¡²é^¿ZM@`"ë0é®(—ç)�ì!<\8çø3–m‰"€_ÍÀ:Ó(ZHyý vM·«šÇìÕø`#ÕRÅ|�µsuÕî<hgBƒ§oð8Š-?éÇråõÐ�×–yã6O`4…è’
ª5!#ò›·./#WŒ8šÌl¸5ç3ðNÊÙ(³AžU¹yŠ¹ŒöQ’êñ{>z+­PqŸüsr›>®]9aµ¾Pc6ûºÕ
+ÃÍ gð,»üÈÏ&7°z`Àø‘N˜A/˜_Ûä>¤Ë H0–~}‚�P:ÙùÃÎ	¼9T†r>¾x`
™ßˆ5Õ)”J!-£-‚a.ª¶FâƒóâêÒ#˜ßP†Tϧ“]N„Óc§�Å`¼°éÎá|çš¼YUà@ìØò½:àçÙNmMò§ó£a
+lü¨£¯Æ%áYñzª	ùF=
!BX5ðM•G-ó&ÇÑ
+ Û‰¼^DéLMŠ~pž‚ã”ênY”¡F¾YØ�ÃjuðméVy»‰¯ü¹p�¾w2Í QH+ôwIó´†,ãéuÄ
§R<îõn²¯µ: |'šÿ³�.9‘Féïßèr>“òqp|Å4:„Ü7:üxò¿P½Ã¡AbÏÃÿúž‡ïÒ¸rüÔsñ˜�£UüR8ä…E²_}q}óG–ˆW3@'·ñµM=îÄÒ9D(˜·±Q&¡¿;·
Ð…\"¥K,·óò¾[½mºR|Õ6í®g²qyí09:…8C{ú&ýðf`ô�<0‚A¨}+™É‡\‹Úë×7—o>L„x	AáÒÁ×å �ZµMìª}];°uq_æ>Ýðû�f…­Yü�­4[)¡Ñ[6xÀ÷ô-`ŸÂAA
�óc”u±†÷‰žº+—‹©ÒRfˆŽ‘h/Ú±DÞŠ¡6Η'Á‹q
+&ÕçÁkHu¼zªø ÿþø¡	õÅÝÙc;¢‰cG˜D9¡êÖѹ¯°[¾ˆXQ	
+›¯Ž0ßd¦³ô¤ª ^�ñŠóš�VTGõt}sëêJ·Wïßá9
+ÇÄŒkïtþôjZŠ0."Q[ö½Qrê¯lPù?�MhŒö�å›ÿ·ÿc¦!E7|Z÷ 5¨”`…òzƒêúØè f	ˆ�Dzÿbƒ¼žendstream
 endobj
-1864 0 obj <<
+1873 0 obj <<
 /Type /Page
-/Contents 1865 0 R
-/Resources 1863 0 R
+/Contents 1874 0 R
+/Resources 1872 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
->> endobj
-1866 0 obj <<
-/D [1864 0 R /XYZ 56.6929 794.5015 null]
->> endobj
-1867 0 obj <<
-/D [1864 0 R /XYZ 56.6929 361.2723 null]
+/Parent 1839 0 R
 >> endobj
-1868 0 obj <<
-/D [1864 0 R /XYZ 56.6929 210.791 null]
+1875 0 obj <<
+/D [1873 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
-1869 0 obj <<
-/D [1864 0 R /XYZ 56.6929 130.947 null]
+1876 0 obj <<
+/D [1873 0 R /XYZ 56.6929 175.2854 null]
 >> endobj
-1863 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F53 962 0 R /F62 995 0 R /F63 998 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >>
-/XObject << /Im2 984 0 R /Im3 1108 0 R >>
+1872 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F53 962 0 R /F62 995 0 R /F39 863 0 R /F63 998 0 R >>
+/XObject << /Im3 1108 0 R /Im2 984 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1872 0 obj <<
-/Length 2455      
+1879 0 obj <<
+/Length 1937      
 /Filter /FlateDecode
 >>
 stream
-xÚ­YYoÛH~÷¯ÐÛÊÀ°Ó÷ñè8Nƃ±ã��ÅIŠ²S¤F¤ìõþú­¾(’¢ä
-Á	1¶î3]tX•Q}v,_ý¨�230ž�GÁq%âZ²aêIËÇz&\ƒhÉœ·Ùçï7—ÉÍaW4dþ²*²•ŸÙ5yàIý£YyÚµÝ{žù÷Ö¿ÛxhŸyEä•cå.DZ‚Ç"Fê
-NLr3XE�zAª‰õ^÷ן’¦}-�(=6�£-m`RÅõ>lدö_»¼iƒŒ8ÓñÐKÕ�Âø?šþ÷Íð“[ýa‡e9XhRõÆÃϺ{Wnv
![¥`“Ps®wMàüÃà<Æ–Ÿ¯!&øÇTî‡Ò™1j¬¢?÷G‰I_¤ï6þ
-zº+ésÅû‡Ã¶¤ã²ëv͈èÇIEš`G›‘¾†V—›Ó*v\:ë(ÛQR:Tòk“OÞC
*ʼn–i ü†iû�Ôe=³+uß[xf¹Ÿ°‚|x	œ>–
gø„ô‚g�U�FždÍ
-£D¹rá
Œö¹Žc´ãrͦ0Š¡$GÚÚ
@%A˜rvZ¿ŽkBÁá•�DŒNÔ60¤óÈ•
-xï¡“˜€$b&b¤%ÆiÇ5Yý‹=wbØþóE¾L
d¿Mõ¼NF‘¨å»¼ÍÞÙ`î.ɦÜhpópøm§ÁÐã:
†ÈåÀðôfÀê_F�À9´ê‚ŸV®ãšÐnpºÐ*(L†êE‚QœN^–„B»†¹2=PËgÊB¦
J—)Û½�p.Ocú‰£'B#M�>8úPÈŒtS
-"²Þ_VBiL ^ëÕ¬:K	è0�’ý•|D„ê)‰Ã"ù„`u£IÔù¥°õ%Ê×gð„|»ð#áÙol,Eö{B¢b5ØûÂ�ìkN;.–ûɉd¤CäW}ÝCע΃"UÝF£Ä¥5^ùŠ¦=êpÚØxÈNû[�鸻E&çmÍ›¡wM7ð5F�–ã¤^Ó�bCïa¢Ô@³þíà°ƒPóÎ×üm†‰-œ‰å Œüí„fz7±}ÓÁ
-®K¦Qu3¸ÅéC¯(:rÙÇ #ãì
B; ™Ú;û¸Á½þÇ Õk"m�BÇ~¼dÙ{Õ	‡Á]ñ·ØÜÿnËm]¬�”;sÄ E¥ì~	acÕ»Ÿ@uÿ‚D|Õendstream
+xÚÅX[oÛ8~ϯðÛ:Àˆå]⣛¤Ú4›¸‹:}P$9*K]’ñþú=¼É’¬&Ìyxxxxø�I~d	„™â‹Pq$0‹d�O0öñ‚8žÀ3C®÷›‹wX¸PHI*›í@V„p‘Å&ý¶\ÝÝÝÜ^¯ÿ}P�—ïÑe 0^~^Ý~]}²´»KE—«�7ºó�)Òl/ïo¯¯.¿o~»¸ÙôÚ5&˜iUþ¸øö/RPü·Œ˜ŠÄâ:¥èbÁC‚3æ)ÅÅÃÅ?{�ƒQ3u΂EHD4œ1
%B�‚Žl ’Œ2cƒ«/·Ö¿Þ¯ôN7ë/·zO0“
Œ‡

QD±4S6»Ì1‘

¡JEÀ¬yÊxŸ¥3¢G˜H긒ªücúÔÕq›WåeÀ0[jJ‘é6_æ�¥µUeIµ?ÙŸv´uÄ4k’:ôsJOmã¼°í]V_’h™ÁÙñ/W–Ó
+k³¡”ÃI»8_ÌÜ*ÐÛÑæF!‘‹ 7,ìã9Oa·1zuým½‘ø†B .	sÛ¿¾½¶ÜÊ~Vé>/ó¦sTµ%Ýg[§{™d–ô9.»¸˜1.‘¢RJ'õ§4
+Ûéú$ä(Äì
z®s
ÆÖ	
¡c4˜�UÓlwEk;gÀÔDLôS+a‰„l¿n¥
×+Vò\ÆJÏqý®îJg©CžžJQðh¡^סç:Wbl("IB:ÖbÞPÎ7’¬i‚<=³Óú¡H„a4FßÃÍ�s€O_fÜf€î?\]Ânðb,›ñŽ‘äÒ‡¢_fê8ɈcŠãÿ[qâ/ˆ(¦6^É.K~hOøÁ9þOUfÓáºL“)­x±a£Ig…!¿Œ°#ç›
+ÃHq9‰uÿ— Õ3�`³úºùõËýÛ	k]¶Y]f²ǦÍö�í\UeSÕmÞíOërĸ¤N—("�ÖÌÖQ'‹¡FÐ7é
+/
IΠú°œÖÚÀ•tµ+ŽZ;Ú70Â�ðÔÿ  ÐHò71̱ôF­Ñ=ýÍK:Ô}ª�ƒ«Ò«ÏÁŽÅѶ†(S#ãéxäW"ÉÞ|¶LŠ‹§ªîA´tmøþúyu|¾zEE–/»<ÙÙ‘®ÉOl?ÍÎbP¯múYbû­í›;<|³Ø‹ÈJÃÊMˆÔ‹)ÉzŒT%œ˜ä
+®:^£A�j|½7ÄÁæaý1hÚ£y¯�ÑÔ†¶Õ€ÉÐ/�†îXµÿ貦u2üHÏï@/ÃôÆÿÑç7À�~Þ�°ÃUQŒšU½±ðÓîÞ—›}@Hv1ØÄÕœû®qœ�>¼
+¡¤€
+î•PÈ«¿Ÿú½À` ñü«“†Â\õëºÄoõ,«ÿTSMv?Ì•ç¤S“-Ñ\Œ‹ÞHä*R¾N³‡ÛHlc½ s¯
§g0Í`54OZY½·yÈ»êÅÒí¸ÔÆIëˆ;Çæ¯lpµ >®k¡	ÀÛ¶_lžÖý‹Z?vÛ»±O
úÐíë—
+d¯®pƒ]3ófânPìêòiæš�ûBëo?¢žÞˆ¡‡ÿ“g†áâqÇ+¥wHˆ˜ªÞ?·žëþ_'x—êendstream
 endobj
-1871 0 obj <<
+1878 0 obj <<
 /Type /Page
-/Contents 1872 0 R
-/Resources 1870 0 R
+/Contents 1879 0 R
+/Resources 1877 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
->> endobj
-1873 0 obj <<
-/D [1871 0 R /XYZ 85.0394 794.5015 null]
->> endobj
-1874 0 obj <<
-/D [1871 0 R /XYZ 85.0394 752.1052 null]
->> endobj
-1875 0 obj <<
-/D [1871 0 R /XYZ 85.0394 676.9839 null]
->> endobj
-638 0 obj <<
-/D [1871 0 R /XYZ 85.0394 637.9396 null]
->> endobj
-1876 0 obj <<
-/D [1871 0 R /XYZ 85.0394 604.8838 null]
->> endobj
-1877 0 obj <<
-/D [1871 0 R /XYZ 85.0394 569.2766 null]
->> endobj
-1878 0 obj <<
-/D [1871 0 R /XYZ 85.0394 503.1887 null]
->> endobj
-1879 0 obj <<
-/D [1871 0 R /XYZ 85.0394 431.0324 null]
+/Parent 1889 0 R
 >> endobj
 1880 0 obj <<
-/D [1871 0 R /XYZ 85.0394 247.0209 null]
+/D [1878 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
-1870 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F47 879 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >>
-/ProcSet [ /PDF /Text ]
+1881 0 obj <<
+/D [1878 0 R /XYZ 85.0394 751.4893 null]
 >> endobj
-1883 0 obj <<
-/Length 2199      
-/Filter /FlateDecode
->>
-stream
-xÚ­]sÛ6òÝ¿Bo'µ€
-I
-„Y…±^{Úš;ÉÒeï
Æ;£Ó[×á5Ûj_¸®n´ìmªŽM$Q9Ümúì@�Y™Õ©»Øâv­em_ Ë9ìMÓ— !Œ(7N)i„ù`N‰ØÙ@(”æ©È
-
-é8êÂ
-²ªÄ<N(ÏÐf)+ÈÇÛO·K3lâËÛÏw‹€4àÒ\	ñ¶8>§®«¬ùå!óÎlýÀ‰Z�[‡"ÄÏ@ÝöqJBþÒAóíý'Ì*Ó8Ý{ÿÙ·y‘·‡clê½R­ÆjåÜß
-¾ô�×smÓ(ü®öµó ¶8X�IÂðû’:@ë
-–Gq༇²zj Ï�“	ƒá	QÈ$‘"ø 9Vsó|÷êSJŸÄiöðO)Ö…Ÿ‹¾÷7‹ë/·÷XØÎè;{!}Ç0åP¯o3ŠHæz÷�²q×·¢ˆ€Ùû´X1è²"h­ÿ^³3Àñf�x�¶
-©
£U»÷å¡f†6ÛhËÿg×m°”$Bùw±c&
-_,“.™Ìe$§?ï4îê>�¢ŠÊ´ôvdèC�®²fÄ)dHu¦µ7ßæ!Ái�˜´ùprIqjAÅïrÈÕEU?"Ók3™Á‡ÛgÍüXÄ�ÓYc7ŽÃ~MåÐ:ªî|Çœ»eé	)p€„½”öPx.ü%�ù«kÓêv{õóÚõpHë';¤\þ`a?\üøcàÈå°«íÚ}»Wäevî¯Ø“GQ(¯Ð.üã¿Œÿd$b%É™çgK‡•g
-%fLœ¾/Slnx€÷ÿ°×…àendstream
-endobj
 1882 0 obj <<
-/Type /Page
-/Contents 1883 0 R
-/Resources 1881 0 R
-/MediaBox [0 0 595.2756 841.8898]
-/Parent 1846 0 R
+/D [1878 0 R /XYZ 85.0394 670.0469 null]
+>> endobj
+1883 0 obj <<
+/D [1878 0 R /XYZ 85.0394 556.7566 null]
 >> endobj
 1884 0 obj <<
-/D [1882 0 R /XYZ 56.6929 794.5015 null]
+/D [1878 0 R /XYZ 85.0394 475.3142 null]
+>> endobj
+638 0 obj <<
+/D [1878 0 R /XYZ 85.0394 431.8777 null]
 >> endobj
 1885 0 obj <<
-/D [1882 0 R /XYZ 56.6929 546.7712 null]
+/D [1878 0 R /XYZ 85.0394 396.8929 null]
 >> endobj
 1886 0 obj <<
-/D [1882 0 R /XYZ 56.6929 448.103 null]
+/D [1878 0 R /XYZ 85.0394 359.3568 null]
 >> endobj
 1887 0 obj <<
-/D [1882 0 R /XYZ 56.6929 386.1077 null]
->> endobj
-642 0 obj <<
-/D [1882 0 R /XYZ 56.6929 347.8768 null]
+/D [1878 0 R /XYZ 85.0394 286.9477 null]
 >> endobj
 1888 0 obj <<
-/D [1882 0 R /XYZ 56.6929 315.1782 null]
->> endobj
-1889 0 obj <<
-/D [1882 0 R /XYZ 56.6929 279.9283 null]
->> endobj
-1890 0 obj <<
-/D [1882 0 R /XYZ 56.6929 215.0111 null]
->> endobj
-1891 0 obj <<
-/D [1882 0 R /XYZ 56.6929 155.9807 null]
+/D [1878 0 R /XYZ 85.0394 208.4702 null]
 >> endobj
-1881 0 obj <<
-/Font << /F37 747 0 R /F53 962 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >>
+1877 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F47 879 0 R /F48 885 0 R /F39 863 0 R /F53 962 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1894 0 obj <<
-/Length 2682      
+1892 0 obj <<
+/Length 2634      
 /Filter /FlateDecode
 >>
 stream
-xÚ­YÝsÛ6÷_¡é=”ž‹P| ˜<9‰Ós¦ù¸‹;Ó™^h‰²x¡HU¤ìsnú¿ß.€(šŠÓ¹=\€‹Å~þ3?1³šq•§³,O™æBÏ›3>»…¹Ï„_3‹æÃU/¯Ï~x£²YÎr#Íìz5àe·VÌ®—¿&?^¾}õËù\jž¼dçsÍyòîâýÏ?íãy.“‹/?Á«Ì3‹rvþÛõÛÞh5`¯òœe©F©�ñ?Þ¿~Å^}xÿ—ž]^Gq‡G\¡¬¿ŸýúŸ-ádoÏ8S¹Õ³{xáL乜mÎR­˜N•
-”úìÓÙß#ÃÁ¬ûtJEZY¦­Ì&t$Õ”ŽtÎŒ‚)<ÊÏMõoÒE×?Ôåóó¹<ù‘ú–že³¤A»¢g]5%©Iåƒøl.,Ë…&Þ»f¹`‹¶YÑÒ#a´a2S^ŸUlS›lö‹5Žò¤«6ۺܹ_ÍÄn¹fÊFM±)—'wóeÚú¥àŠçÉõº¤Íþɹ¬KÚkß•Qûõî\ؤô]_ôå¦lúî9}2¹uí¶¯Ú¦­zF“
-3›K!Xª¹ÖÒÉÑ•»;wF§}ÿ!½Aã=>—£uÎMÇÇ#=V”€Ó+ä}¬¥4e9—ÁÉ)ž% Ù¾¨ðœø†*»+ýL] Ö@«©§D0)ãÚhÏ{Y®Š}ÝϽ‹b
Æ›ôËiÚ­ò¬ÚºnïË%½Ý<г_ûeè¤{%4KS>Ò}zWR$ÅrIfî:" ‹»	z8>nˆÄ‰›¥èBZ*8lå?[·]O£ûª®itã¿Ù—~n]6žo‹O~ÄŸ¼
Ç�ëmu>(<©ïNìÛ½·P ZI‘b’ƒccHN¨[r–ÆH³¥ú„!eÆl&íÈŽèž�¹šœq©Í؈ÒúóåC#ÕQæÞˆ@ÊɽU,YÅR8 ý~]aÊò¬– ‘
-tÌ·˜:O.˜ÈLrú R0ÉÓ|sr®TBli™-Sá¡øœc’+ÜX´÷ãÍ!	BÊW‡½«åÄî
-J€Îõ W*“'[gÿö®¯\º“±mèI„m�½iÑn6.« ó7d(()‰§åÓJ‘±Œëì)õžª±��'	kÁÎû°MÕ© ×MÑ/Ö^™`#f�°Ç.[5·S	꼌9•FT:me48z*hÉÉgEðcz!ç²<D²õ‘lc$[*�H)ö kð·°&
-é–„€†tñ½ßÇÁ¿‘êa%e ¯�1c³q©ØBʦ›e'BÓ,ëé(4·í®ŸÐL–bE|›Üø«�¬ñ	V‡kÇ×�zðÀ–†P$šrè-}âœßéSí�»i{Ïʇ9Œ¼Ê\‚uÊÊ°”Ûãðr1ÅOÄ”„B“ª� Nœ^Bà
:ªˆÄ3”—^[0VÄãcH‡Øâ‡Ø’2‰´’*�"¦Ýoõ`(;¨„û°Oåe,hÆ×tü`Å
-ƒ«�w)Í@$’ñËA8tÚ…_<€6eçÃ)ÈvO~Õ"ðFýp.„H&ñåŪ?€ò)㤂e˜¼žÊË–)eÓCU¹o�Ëg
{Ô ò[ÓkÕ,êý²ôÀ»ð}C¿Cw¤ ìÔÆ#òE¸FiÇAx¿ÃDªݑâ,tgRëc¯((ÊJQGéð¡¡ÃÍÀ4|²&4'‡M¾nÛ®«njÿ‘w�çSA€U"��dº.CíÎUÄjϦ
-6Ê—TY|.iD�õª”ð¢&êÝm#Vðk§”i
-Ý�ªËðúÁWüdX]pÉÈG4ÿuäDeçÐK¥ò뽆dœçöñEÊÑ5oÝ
Žï«~�0Ÿ;7A
-5†«W �@Å!L(9H¥ä�#42ˆS(�ižYKy�‰á²;úû6´‰,3éȡõÉcE ز*¸eQ߶;8Íf*È!9ïÑ­/ÖåS‘R2)›Åî!à\˜80u¯«àÌG—"Èdcÿtêò
-ÀÌË«÷¯iqNß‘ÝîŠÍ„«ú‹;pÕã+šQnÄ‹bºÓáA¡nÒ5¯¥d
-¶õÉ4%-àó g{"î …¶û>£WB›Ù
AÇ\n™ä±+Ülœ¯•S±/™´<€è�zü>EÝy	?7í}ãÅë¦öä–¥*
¬6ÕW6UL¨¸é3¯b-×øÄ0lIuÆ#†Øò!…àP>T]Fwݸ<º½
-ãÐS¶åðR¬§½»uµ%‘‹âlî%ß÷áÎÙ2žK9ºÉòa[ÜU]Ä
i`S4á’ÿ

-õå/ï>þtéc¹
<\„9j� Ð8^O„¿nºÑâ°ØA}Qdw{Œ­ZžQÊûNT,è$öG®³Ëó£æ†óä?N3�÷twí‘¢�°¾nE�mÚ‹)l<¼x†ìÀÃ�áý…ou§vú#2ƒŠl¡‰:úÆ·ýŠÔ"â€
ÿ¿­!Q÷Ã÷§ö–©ÿ(î<ª3‡îÀó›:!õ(8ÒJ«4üãÏœÄD2Cm<i÷
IÑäëM±˜o–zò0X)J’”'ß™7ïVÿJÕ‡îKZ?ÜÈôÃU)«/¿äõJÔõÛ­¿|7}18ÃÔ_·àÉøëÄ­<žâþ[÷ð·vš1e­œþÇ-F“B¡äBè±èñàDzÿ1'¹endstream
+xÚ­Z[oÛ:~ϯðÛ:@ÌòNñ1mÓ³9h“lã.8=Š-ÇBm)kÉÉæßï/ºYvzpŠ5EŽ†Ã¹~C…M(üc¥‰¶ÜNŒ•DQ¦&‹í�<ÂÚog,ÐÌ"ѬKõ~~öî“0K¬æz2_ux%„&	›Ì—LßKÎÿœÿþî“ZΈæ‰þHôõæãòáö擧ìqå	¶ŠÒË»»«›�×ÿ9ŸqE�ûùLQ:ýryóíò³Ÿ»;·|zùÛÕ=2;»š7çèž•Q�‡øïÙÒÉŽüû%Â&jò”0kùd{&• J
+g6g÷gÿjvVÝ«£ºc”p¡ùˆò8›0F¬‚³uµ§,Ñ‚wÚÛ»ùõíÍáI1Œé‰áœFÍ‘�=ѬK7±Z¤Â}gÁfªC	Â&¬è
Q•ûÝ"›¥Ëå.«ª¡„LqÂ�”§El¨FdìzS†p¥L_ÈoU6æY”H©ÕQ)¬CDœ=yZ�Ï„aÓz�ျ÷ÏY2]d~
á32s«rç)Ã+lº(‹"[ÔyY^倠ÊvÏÙîÜÈ©‹PC"ˆLPCã Ë—ý¦ÎŸ6™÷꼨ê´Xd•L½þá)ÛmóºÎ–þ7t4›Mùâ‡UV×yñèÊ•ÿ}(ëuxc8]ß=Ëðr±l¦t`ÒÑ…#iu‘Uä˜�êbÇ$ü´�v©ŽûhCå|t1æ£m,ZL±Êg«|“8¨€´bŒ=-_C5"`ÏA…!ZA‚èI8î ,!ZS;. ¶ÚÈŽw2<	ðòwJùã~—zÃIœÙôš,]ú´;³¢}}™­Rp²‹�um/Š(¡†E)ßeõâÝ®X.Ê;F‚èDÇ$}Ü°¥ì
_h‰N¸B ržðãÍlõ#{w¦‰¤‰=)YCt(ZÏ°PÔ„¥¼'ÛQ°Fòá<‘“4¶ã
+�`5ëïúÍ™N‡|�ƒ€õbMIÐ%UÇuÉ£þ…ºŒGtÙÙœÐæ˜2‡�´aöʇôvpüì“>«“Ñ„wÖWŒ€®1¡â×)&2|C1`.
+ðÇÂC²:<×»p¡¡B±—߀béñ€òW38di5Ý°KÃŽÏé&_6uZ…;ì‹‹òLp�‡pðС©ÀP¦9?nj	Ü‚j¥†‡TöwMÝ0œu8š*0á	c;G-
ÐÒg¾g‡õ(@¦§l‘£³gË‹�IÀ2®ß
+Y¦ªÂM0‡0¢XÙ„-çÞ×>¹·d¼†�î¾âi“9/%j?íL�ÃÂ,vi
+þc¡kÇ….@Jǵ¤³æ`îèä(+àÔ!v"ÉágnJiŽÎÅC8É ‰ÂÔ0‰ÂT›D‡vÖ`­u÷ÍA®’Š"‘í+óòÛüŸ·_OiÑç§ë¢ÎvEL6÷¯€Ÿ`Õ€? óäûm»/v�:O2¼>6ñ/‚~’.8¾6²‹0»ß¢zg‘vu„†�q7XëCa	£RŒòýëž4³ð�sÓzIstôÞïÈ#`¥b¬}§�mþö*´Á!ñs÷±¯˜Ü(/ë(“1}xeþ¤áPöÿ-pUbendstream
 endobj
-1893 0 obj <<
+1891 0 obj <<
 /Type /Page
-/Contents 1894 0 R
-/Resources 1892 0 R
+/Contents 1892 0 R
+/Resources 1890 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1897 0 R
+/Parent 1889 0 R
+>> endobj
+1893 0 obj <<
+/D [1891 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1894 0 obj <<
+/D [1891 0 R /XYZ 56.6929 752.2728 null]
 >> endobj
 1895 0 obj <<
-/D [1893 0 R /XYZ 85.0394 794.5015 null]
+/D [1891 0 R /XYZ 56.6929 348.0801 null]
 >> endobj
 1896 0 obj <<
-/D [1893 0 R /XYZ 85.0394 368.0049 null]
+/D [1891 0 R /XYZ 56.6929 250.1909 null]
 >> endobj
-1892 0 obj <<
-/Font << /F37 747 0 R /F53 962 0 R /F23 682 0 R /F39 863 0 R /F21 658 0 R >>
+1897 0 obj <<
+/D [1891 0 R /XYZ 56.6929 188.746 null]
+>> endobj
+642 0 obj <<
+/D [1891 0 R /XYZ 56.6929 150.8976 null]
+>> endobj
+1898 0 obj <<
+/D [1891 0 R /XYZ 56.6929 118.3669 null]
+>> endobj
+1899 0 obj <<
+/D [1891 0 R /XYZ 56.6929 83.2849 null]
+>> endobj
+1890 0 obj <<
+/Font << /F37 747 0 R /F53 962 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F47 879 0 R /F48 885 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1900 0 obj <<
-/Length 1897      
+1902 0 obj <<
+/Length 2930      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥X_sÛ6÷§ðåeò]ÅŠ¤(ŠÛíÁMÒ6[㶉»Û­íƒ"1±®²äYòÜìÏwHP²l+Kz;?˜A
-'"ä¼¥£ëÑûN`oÕntXÃxĆ|¡z¾PŒ‡cJI‰¾ø¢ï'~ö5ºnºÉ_Æ°1¥D	
rÛ�Ù�wÕ:oKä\,“Ô_fâ»#hyQx­ÓµnÀg!pž\ñ×ñ»èÅÏ[õÛö×íŒÿòÛÏ›÷?þx‚{ýÁãþ±‹Ï_2Þ³Äç‚Ä‘0
-£{Ú
½3
-”º=Æ^;žã<´g^8ÔlãöºcïõåôÔ¿<8KŠ	õº´«#òÆmÝ)‹ó´Hð¢Ì¸*›$/-§Ür“ÔÚ�Bœè2­²¼¼ÃYuû�Búï
@	¢Šª¶	3{‘ðŸU›{0þ}S�“H+ŒAøóHb>ßdkL \?Y!¨ç‹8³(æâ8‰eLâ�»½y�;7¨·ñUœ(B"Cþ8>H)ð
¤ƒ¿K�6î€
-‰;4 ž�N¾ŸoÀºªÖ
..x«)^
-oó
hhߘሑ ÜÔŽ=¯ÎMíªÐùwºÔ�"î*ü[CDUKާ͛cÑ<¬ç#,¿½ëÚ÷UµŒpÌß#G÷ñ�ŠÐœîT�Ÿ"÷ |¦�©P²2ùÖhÜ°W… Q¸‡üÄH-$`ª Ž‘0-gçâLsœ½;7B².‹{$´ÎÎ�±�F†ŒY0(hþ·�ä
Šb«¾x
-�„Tm†8Œ:Œô€„¬Kƒ>ráB¶<sÖUQùB
ôvŒ„Öm·Õz@xè„ÚT3`�=tm#,ŠZVôVìXu`´ZçÆ%.i8‹	åÐ}[Òì
-Á)oÕã˜}F}“�–ÒëTÌ4/Õ�ÌñS’L((}¢Õ�&TÊ»Öú@�ºçanË^»<„C”HÊÇ
ÄA$ƒÉ~ÒkÆz�–M󨻘�áHáß4[æe^7�Ø&éJßj¼÷2uÛ.“r“;pÂnFCGU`ó`jp«Öõ¹ËŒé›ë·�¿‰ó,ˆÍsà™«Î½x¸Ö&©}J ‘¢ÿ"¦ÒÔ2Ö‚âÿóı	4Š
æF]8xÅç!¼ß �ÞŽé‡ùë·W�»å°k]¶àz}_ÃU»Šq
-
�S¾YîÎ
¡	ŠºÛ�„4ê>À›?‚£Î°r	}ŸDÖ™AŸAÅà
*åqwbµùožÝ­á¶]Á牉ͪ*ž€®×÷eµªóúð˃Ñ#Ž¸éq¹dCß	 (+&L­þˆ`^Á�F;
Ç_ºÏÈslµ)ýäs;ºA‹Ä^„€ª"è RP=F��šv½ºNf: ³ýЉ¼Í‹o¹èF_„C-E×ñ€ð²‹†§_=ª¯mö�å1@ðCyë
yð&åD°ðàã	¶òøq;>_?ªn’ek]×O÷@ó¨Èt±®ª&ˇú=xQÑ…K'tó¨PxÙ
Éc!
+xÚ¥]oÜ6òÝ¿b�{¨Üz~ˆ™<9ŽÓsѸ¹Æ
+ôú ìʶP­ä®´v�Ãý÷›á�ZI«uRü°Ô�šÎ÷Œ,þÄÂjÆ•K™K™æB/V›¾¸ƒ½ïOD8³Œ‡–ÃSooN^½WÙÂ1g¤YÜÜpYÆ­‹›õoÉùÇ�—×ï®~=]JÍ“·ìt©9O>œ_ÿrþ#Á>ž:™œù	¥Ërìô÷›^½×j€^9DzT#Wˆøçëwìâ§ë÷xôäò¦gwx%ÁòúçÉo¿óÅnöÃ	gÊY½x‚΄sr±9Iµb:U*Bª“O'ÿêvý«s"ÒÊ2me6##)B0§µ	I;f”Tþ.Ÿžëæ¡-ÛéUð£
+›4m*»çS!DÖo„Lnîé^|À¹Hîó
+ Ý=©4lì­ê5½ž×t®yÀÕNN�Ñftr°‡T11ŒPHúáEzÌ£Äsúù£xžœcs¶�Wšñ¸½êÝ?ò{(¥4eŽË˜yAHõ//ñžø„"{,Ây#z�ÇX0)d(£îuq›ïªn$pÈŠ5XÈpœ(µ2ppÛTUóä#	<}~¦_Šã°ðaÛË^	ÍÒ”OdßøØ
+ñ`½&5·-
ÐÄýý„ð/1
+�ŠÄ³›¥>0JC<ìÞ7mG«§²ªhõ9¼¹Ñöî‹:àmð—�ð‡ôëˆõ®|Œ/ä
”ÇgÏöÝ.h 1ö�R"畯I‰x·TQ¤Ì˜Í¤�èÍó«qŒKm¦J”6ÜÏ
•P¯Dé‚
…ã‚V,iÅ’; üé¾Ä�1ÄY®A"%èo>w'˜ÈLdrþ"R@U“º¡c,ɸ Šb™–nl\äŸKcLr…Œ‹ú>$AêPµ§]®g¨C±¦µÓÃZɸä�Ê�Ǭrío
+@_*™(A ëõíA˜¹(ã7V>Άäf9”"c×Ù—Äcxª¦zœÄ¬=ï"_ Ò$<nònu„	:bÖ;fYßÍh>d¯‘caDAõ�uñ$¢ÁÕS¡@Jž?+¢Ó—åÑ“mðdÛ{²¥Ôˆ�|²{[
j‚�ìáHthß:A	á‰D'))@ill&&õà„lŠ±YvÄ5�ÀV#�¸&–3’ÉR̈¾ÉM°z`M°:X“x¼~Õ�6´„$Q«oèo”<ÖØ
+n« 2`½0„2,å‹ð>Å�ø´
+¸èÃîW±ºW”dÂ]¤SsÚñÎ5ï?˜1
+
$„ø² mÑ€¯Taqõñ1¥=*	dÂñ†úÃU8<(mŠ6¸Säm¤ôpê
<ê�*6±3õåùm·/Ê甓
+–aðúR\¶Ð§ÛtŸUžÏÄú,ÖÞ±êŽ%ò°¶¦ÇúÎݺ…wú†n‹öîAQØ©íŒ/–kv|	(ŒŠA„1ƒ°©õA{Š^«5
+_Pj1üΠ˜†Wh
+-!£IÍM„R<ÃU½Û|öv‰¸Àq¨Þl'XâùàÒ
+DÐo!KaÀ›YKq��ØðÑÝSÛD–™tbÐqlr(,¶¬Šf™WwÍn³™Ÿ£¡ú9Ú¾õÅü¢B(RJâ”vûë\ØØ#õ�Gæé”L¶ïŸŽ
 ¤ïùjNùræ
Öui²ÚmÉ2ê®z¦Í¦¦•Lþùáübùá�s2§¡úRr){›ý µàÑNÖŸØ÷,Åž¡9=¶ÅŠøè܇DX÷µÂpÐ…¡b
 endobj
-1899 0 obj <<
+1901 0 obj <<
 /Type /Page
-/Contents 1900 0 R
-/Resources 1898 0 R
+/Contents 1902 0 R
+/Resources 1900 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1897 0 R
->> endobj
-1901 0 obj <<
-/D [1899 0 R /XYZ 56.6929 794.5015 null]
->> endobj
-1902 0 obj <<
-/D [1899 0 R /XYZ 56.6929 449.4646 null]
+/Parent 1889 0 R
 >> endobj
 1903 0 obj <<
-/D [1899 0 R /XYZ 56.6929 355.3738 null]
+/D [1901 0 R /XYZ 85.0394 794.5015 null]
 >> endobj
 1904 0 obj <<
-/D [1899 0 R /XYZ 56.6929 285.1933 null]
->> endobj
-646 0 obj <<
-/D [1899 0 R /XYZ 56.6929 241.275 null]
+/D [1901 0 R /XYZ 85.0394 749.0409 null]
 >> endobj
 1905 0 obj <<
-/D [1899 0 R /XYZ 56.6929 202.5209 null]
+/D [1901 0 R /XYZ 85.0394 687.8191 null]
 >> endobj
 1906 0 obj <<
-/D [1899 0 R /XYZ 56.6929 168.3311 null]
+/D [1901 0 R /XYZ 85.0394 186.4649 null]
 >> endobj
-1907 0 obj <<
-/D [1899 0 R /XYZ 56.6929 95.2288 null]
->> endobj
-1898 0 obj <<
-/Font << /F37 747 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R /F53 962 0 R >>
+1900 0 obj <<
+/Font << /F37 747 0 R /F53 962 0 R /F21 658 0 R /F39 863 0 R /F23 682 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1910 0 obj <<
-/Length 3181      
+1909 0 obj <<
+/Length 1762      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥ZK�ã6¾÷¯ðÑ
Ä>%{šd&A›™ÙLX ›ƒÚ’»…Ø’cÉÝéüúTñeI¦ì>ˆ¦Jd©ê«'Å~l¡¡ÂÈEn$Q”©ÅzwC�pï‡æiV�h5¤úöþæÝ÷"_b2ž-î7ƒµ4¡Z³Å}ùëòý—/?}¸ûïíŠ+ºü–Ü®¥ËŸÞúåý¿ÝÜ—[×ïøøõvÅŒÌ%1Št]þüéÃw«ï>úþ‡�Ÿn»ÿñæã}dkÈ:£yúãæ×ß袄7øñ†a´Z¼ÀJ˜1|±»‘J%…3Û›¯7ÿ‰îÚGS¢PB¥yž�gƈQŠ�„¡ÉV>~ýîç»/÷wŸíÛØgNò£‹7„K–YâCS®Wë¶Ù<V�§êLN¹„§�hªCÑWÈT›%<ö?Jùãæê¶q“8³
›ö�`�IAr
-’¡‘…ÄÖœ™Oš’<_Þõ~çÂïöP¹ë±«J7*üÖEäñ¹jêªñOÛ¾:4Àï³²oÝõåP÷+däÃs"´Ì«(j`¡n�ÒdËþ©rì
-3`Wb¬Zã;kâÅTFrɵ§tòr+
¾„Qv;³n‡[¦—U·o›YHˆ$Å•1~Aص?´Û.±³0Df¹§ÃÍ‹¢ªù½zM,4 ”@Óõ€ˆ¸s,×MB:#ÚhæiŠ]UΉ'ã$ç4@îáÕ­úì§É$˜Ž4cõ¼?)vûzË[~OJà5/¥ÇŒT30q¸ÕË£Ÿ{©û'7µ;‹Ò„id·*Rb¡$*  Ý{›€Õ-Æ`í®êÝÄqï&Š„¨rMel¤´ª=çSÁòG¸þs[—ž‡'ÿÚMUù)´ÎY6WDåùˆ/.H¦”òg
v)mòŒHʦ<‚Cv<â !npÄý&DS&ΠèWÞöíc/~¸‡Oâ>ºbT)`±•” wî¼âgë=¿žJ¨gøW:Ç<ÑjH|÷y‹T'\
·4‚¡ùå-QbË¡° b
-fÔxËÖÿ�ï9öíÌg�P˜¤ÎÁ^ö×Àç/4Œ
è¿Á�Ý?Õ�ÛníÜZ&™ó×Y€H�RA<Èø›ì"Ë©ò„IwP2bû]Õ¯ÓÐͳ
vµöL¾<
ßÏÕ!±2b-T�B÷Ú¡]”õ!±þJdšhPÆØ‘½`5-»}µ®Qh¯8n¼<A¬¶£oï>}ðsáæñÞöÀ,s{`Õ¦<ËÚxÁû5Ñ¿Úkð\ó\)gWTωdÑóÍxWªÍ0¤ì™s_ë_ìúÐ÷C
¥ð�²äYvî® Ë‚x«õØ]ÍF6“E&£»¢rYVø¯±h¥Ê¢ÕÎnŠã¶wÖín缬!`5ÕÖ݉³`d·l	ê;9L#3Žp»m_ÒQ^0E´4êª&5A]6îxÎŽ
nYy™@8<WäÕi@@–R^Óœ RK1к`u`°m×ÅÖ
ŸÚÎ;huaÔ´îº9¬¿¶Î|ˆåÒ'Î5äÆ�öh´OÜïçcÓ¤å&¸ãè–Fé.l’§Cy	ªÈ˜¬V:Gî,Ž«liÜD현yÕcRAõPY° MO`}ŸÒâ~ïÒšn»_ÕžwgÊûm±Ž	<èÂú€×|©Cb+¡fÊ&g6*æßé`Q&IÑ7sJE[x´–ƒˆh'Ȩþ¬»Þ%×X»yž©ãyê·sà*�r½–G‚?P#[öâyŽŒ�!t·Á}]á
-yeË@”ØrTƬ^'[~9Ô>
¢6‚£ÔŸÚƒ7„î©ùÁ+ ÝL2§²nÚ—°®òñ3+«ÏtøæœçoYïØ°˜W�bࢴ¼¢š
ÕÕ*«šßßâƒ1´Ìúà‹¼�|ð9sI<ânäƒ1—õ:Ê|‰Ëš9=h\Æ‚£©[+`^B\Øö­¸±;ºz$‹©wá.ÏÅÖvÏ`X¶»¢nN�¤vQþ>àjê‹E+”kZË„Õ%‹Î®Â†fÄè+}©
ÑÐx"‹™ýUÌìÑÔ¦€Áì^îS�æœ)1éEBq?æj¯}_Þb!.Ì Ç;–M;zÁ*Óæ÷	‹¦�¼ñL\«x%1"VH[¨bªÆ³bómÇ
-l¾öîÙÙ¸n—ª¸%ŒÆBû�Ç"¹Ô¡#±�B´ãLŽ
™Ì	@w³0â˜=²\]ÆÑ�jH‘Ê"é�@’!™Ñ@qí.™(¨ü‹ÜEª{#H)ˆ"š²1cL)ìŒÃE-»öhõ¶®Ü´Íáê¸u4eÑnÖi¾ú³Å-’8„â²àŸÚCýWè�f\Øúïy"a)<ìtkˆrâkºW@ÝÎyek½fÆ ðîÝÔÞ¡í¹.+7‘ìô3MD<>zWVÏïü{%Â�f±·j«JXNp–®ñûÃõº²µg8x@þ"�d(Q¼i�9\ÝÎMÕuî­™Î0N¨I�ÚEŸþк@íuÝì�=I¼¥Æc×S#Ón|¦+1!óØÂ�
Iç‘ÈÇ
p9‡J,[s+/
Oyp×ÓIˆõ=ßÉ–'ác85àf'æl�†B´ùeF]Ü‚ÿ¾e3u¸(J7íd««	âŠ¯2Ÿ¦Ú.Ѐ>�©>+—*Ëa
-�(Ó}xɲءhJÛ€ô=µH&:„{V‡¾Sc4ÔÑZLPï[	èÇ|°ÅwŸuhL3ìt\Ét‡Tó-RY‡Ö]-rŠ²<x8§Šœ‹¬Å"眵d‘3âmœLñ Ζw_ܲæN—=Å¥¨È ÞQ¨¢®÷�™ÖÙ4*âê®ûŸ:åœ:圎ã¥}f>^B>D¸ÿ,^úÌŒ°éùþlÚ6md·û‡bý»/F´¥vN
-O—%»Žx“ÇO&^êíÖ-¿/€1HÞ⸵�·•7ÿÞß*JÿÙ‰`¬xzPUÖønÎ+°�ýë0`Š™¯Q4¸M�¿í°TŠh®žyXÖ…a?‹¹wm{Ñðß	k> AÚÀˆµô1ÃÍ.9·/Üg¸A½…õ'»nÚ£u8õzŠ„­GFÍr(àTã7ÇcÌ«¾‹cÄÕ*¯Z]ÉŽDóöˆ,Î�W«,ˆq‡¹*ëS±Ê:c*Ye
¹òVke­6“ó�²<WìJ§Ìpf¦VA¾�ñ°¶ƒö¥±‰7“ýÇi¬à�)Ró6Ì觧¼°C<®ÁÔPu·I¼h®ˆ¢±^wÜ¢"€T><›�Å‹mÞrp²ïÏc1¹§flúm³}�DŸá4õôŒõdÃVåÛaOá í¬ ÚxD—H b‰àÇm	pÑø9ÍÿýiäéPi{µ<�SA%¶Ž,S(*Æò)ëñ#ÊsÞÿFðl“endstream
+xÚ¥XÝsÓ8Ï_‘éË9sXX’eKÇðJÚB†�×VZŽ]b‡ÐÞÝÿ~+­ì:©Ka?XZ­Vû¡ýíÚtÀCÇ""‘bj«�ˆ€ŠqºãsX{6¢ŽÇo™ü>דÙèá>�ÇŠ¨ˆEãÙ¼'K’@J:že½'D‘ÉçÙ‹‡û‚÷x%“
+䦓£§»d÷øh97¤2É@¬`ŽuúúõÞÑÓƒ÷Ÿ‰
+NDÈyK)F§£7�ÀÞªÝ:è;Æ#6ä<Õ3S1"„DZP$âŒ[cÿ{dl
+%Ó:/
+”{v…Gezž¬
+4Õ[ÕN
Ô(í·Z9®Þ¥4äO
d‹I
+£Ú
½3
+*Q?Y!¨ç‹8ë”ÛIK"Cîöæ5î\¡zÜÞ¯ràD’8ä÷ãCÇ[ø
+ê8I
+û´�/eµ.]ÿ[$Æäï®	6n¶ƒÄu³¶kÛÁÉ¿øÚRŽv½!æ]È	Œ&pæÑôpí>Ý;™@U~/;7ŸHÏÞžL�7gÇGw$±$‚Kìél�å4rE™SÑ¡§¡baFgnõ¦ôÛd¸jÓÞIšêË9±xªièjÇVfÈÓîCaiu^æ×N!ÌDà±l(õ¥Nssx{j^ÕH×Æl§LD”id‹€“Æ·°ˆ3ÕVNy«Çì3ê›´”^§b¦y9¨Ü"!&Éà‹*_«9 M¨”wªõ–uÏÃÜ–½vy‡(‰yß ~3˜lö!½f¬×x`Ù4ÞGOq¤ð5Íy™×
$¶ÉC:Ñs�q/S·í0)WIqNØÍh訊šü05„UëtÏeÆôÕéñ.¿ê.�ù*�ækà�+ν¸½Öæ¨ý’@:Eÿ�M)c-&þž#n[@#i 7ênÀS|ÂçtÑ›¸1};{~|r?$
 endobj
-1909 0 obj <<
+1908 0 obj <<
 /Type /Page
-/Contents 1910 0 R
-/Resources 1908 0 R
+/Contents 1909 0 R
+/Resources 1907 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1897 0 R
+/Parent 1889 0 R
+>> endobj
+1910 0 obj <<
+/D [1908 0 R /XYZ 56.6929 794.5015 null]
 >> endobj
 1911 0 obj <<
-/D [1909 0 R /XYZ 85.0394 794.5015 null]
+/D [1908 0 R /XYZ 56.6929 253.0811 null]
 >> endobj
 1912 0 obj <<
-/D [1909 0 R /XYZ 85.0394 751.0357 null]
+/D [1908 0 R /XYZ 56.6929 157.3292 null]
 >> endobj
 1913 0 obj <<
-/D [1909 0 R /XYZ 85.0394 641.026 null]
+/D [1908 0 R /XYZ 56.6929 85.4876 null]
 >> endobj
-1908 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F55 970 0 R >>
+1907 0 obj <<
+/Font << /F37 747 0 R /F53 962 0 R /F39 863 0 R /F23 682 0 R /F21 658 0 R /F48 885 0 R /F47 879 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
 1916 0 obj <<
-/Length 733       
+/Length 2868      
 /Filter /FlateDecode
 >>
 stream
-xÚ¥UßO£@~ç¯à’co³ûˆZ=/Z{¶&&êì‘+‹4Æÿþ†(�.MÚaùæ›™of§Ì§ða¾ÒD[nýØJ¢(Sþºô¨¿�wgë1Ñ
-¤ÛmõÒ»°‘‹„*„íRë<j—­'x9Ú„ ¶§|Ìñw×äZ/Eû-×cÊÔíÒ-ÚëÊÝSÊ7»:m‹Ê}ÃÓ:4ÁÎaPiFA#- %Üø‹‰`FÀô´É]iès”N+�^ñ�‚êà¹.\‹fŠ?MZ>osdvÄbpð®
é"O„ƒFH�]‘@‡\†Æºªë�™ ož+—n3Ñ@b˜�=ÄjëjÛLÄ–¨NØ™`“iÕcþä¯<€Ñ*6mÚæeîÚsn{Åûb°™ÛW|*\Ô1ú‘àŒ0©5H>ŒnG–×í0 x5!¯´DÒ!¸KË<ûT_Kb¸=ôËÉaÔ[{8£3è5ºm03BÆ(—³ÆI.–W__¶Žýž*jà‹
#Ó½P£ûbGh¬a¼™ä„5ÌÔÑùü]mŸTV®hZ¸KU�G×ùSŽ3æÖýÕ¼Äë7Ñxm×Ð3¤'SzDö”T\ºè=6¹Yý¸ºþZ�s×æµË[ÌdùÚÀl5øp\¹¦ªÛbW~¶�!`·D'¶'}Kñ¿wõû’Œ‰0†¿¯áƒí+ÎzHª+Ž1ó!õa«Ìý ˳Øendstream
+xÚ¥ZKoãF¾ûWè(QO¿ÙÄž&™I0ÁÆ3›q€’d‘¶ˆH¢"Qvœ_¿_?ER-ÉÁ¶šÅêꪯ^ÝfŠ?61ŠPQÊIQJ¢(S“Åú†Nžðî‡hf‘hÖ§úöþæÝ÷¢˜”¤Ô\Oî{¼¡Æ°É}õëôý—/ï>|úïíŒ+:ý–ÜÎ¥ÓŸÞßýòþß~îËmɧïøøõvÆJYH1jé4�þ|÷á»ÙwŸï¾ÿáãÝíï÷?Þ|¼ObõEgTX™þ¼ùõw:©°ƒo(¥Q“ü „•%Ÿ¬o¤DI!âÌêæëÍÃÞ[÷iNJ¢/2ºàlÂ$Ró�2TI¸)¸S†ÝvI¡�ݦZÌíæñ©ÞØ��ýL(bX©éÝ|]Ûyð=ƒŠ—ÄHÏoÀÄ)ó7Î?²ïüè�úÕ@Uïæ]Óâ®mWa
ÈÎH©‹ˆ‚*˜ðëë¦Ýî›ýØ
+€kÌ~UÜyUíêýþí讲\,wmÛUÍ.''âŠÒå˜éá*ÓþÎñã’ð»ŒãÍãAfè>~ýîçO_î?}¾K
#‚F\‘ìÔ-N㇄S!B½G<0åŸýF):¤ �I;³Š�í.#“‚ñ”&2KsJdA…ø.y1ýÔ…•çaµ‡Ú?¡ÂÊ�æaéy’ñ¹Þ4õ&|9_uõnyŸÃ—]ëŸ/»¦›¹È:CL$ÂH=Äh³ye©§Ý2‡R
'pÉ í‰Xµf6¦4)$�xöúòœáv ÜnfÑîv·ÌLëý¶ÝTV„Œ:¡)®Êˆ¬ÚíÚÕ>³²(‰ÔE„½]-Ã
é‚1~"> �V"Ÿ}H¬¡á½—¹ÙdÔ£áq¥‰lm`ªÎéGsRðN^=×%Ä%Þ>ÒæÍR–Ñ>¡r8ZvõzË›~ƒ/%䱦—2€F*LìnÍôæ^šnég“y‡jQ†0#‹ ÕlžS%…PQðvœÜÈÀ{_w~â°õóŒª
+CJÊXIy3(k÷‚��öH–ÿsÛTA†eØö¦®Ã”uϳb0®ˆ*Š�Aÿøˆ^règ¬‰`#)ˈjÂËhu#BP¨ûM�¦¨*ÆPœW]ûTcã»[Ô‰$B5D
+01Ôo泟_OjÈP€HÉ›‘@.V)}ªXò�V)‰êˆ«þ’È—B@ª‹KF¢Ì’}e¡Ð¬TÃ%?¸
+	Aó7ù….hÌ®Ùp(™°ý®îy躇]E�¿@È—%ä~ÎfmT+F¨¨…ýëÞúE*ø°Òu
+E¥æìŠé9‘,E¾3‰{¥¦ìg€œ?sRÕ׆m¯wÝaKl*à
++øBŸíº¾sÐtºn½výd½š?´¶÷ñ?O[L"ÔG�ç[¦Ê¿xxÍù—D‡[z‡>DËó5E�K« õ2ÿyhü ²6Ñ<Bûøk¾Þ®b
+Û®ÛC’Ë°éQ]€M¤r°Ù^…M¼`†Sb÷wQ®H”‘KŒ$Ñá�fíp<ï©e¯·oœ¤nôb{MWågüš¢„ãZ\ë{%)Eê“VèeêMÅUÝ^,¾AÆŠóè;¹u®ïÔ^ÏÈv;RHÏE&3‰²†r&ßPÀ|çÁÄa’]©úTÀ©˜v0•D‘<ap!8@”B’(�¹,]¢Êˆ7ÀŠi(Ê7Ä”²çãx¨é¾=8»-j?íªA<½´ž¦šws?ë­�A¼G·-®%ñµl¥Ú]ów<!Õ\¸.Ô¾D
+É)~ìm[%$fí_�ºµoõªÖÅNÍÐ~w~jëÑöÜTµŸÈž÷£éé]U?¿ûÊ$1�êtÂêzKpµm'B¦?~Çú`Ñ,j×�Æë+_‚!Húµ/]HÇÓ¯¼	··¶O×6[ŒÎ«b
+Ù!g7G£å:o´(wþy¼q1¢CŠ	!zzT¾Mª%"íÈ�Ь]•©©Ï^øŽ0Ól€‹y姽ncÙãìã,A|«á³–Ū;«
ìy¨³—Óýe¿�·¨ò§ñð«tN±©Ü1d€èñ ddC¼s6ç5¨taÄõá@ÁƱ‡�ríÞɹýŠØ+ÚLÀ éNèÿþ· ã¿?I{�lÎd3AÑXÛƒz¡ì†+Ç¢§ :•ýÚ
5½endstream
 endobj
 1915 0 obj <<
 /Type /Page
 /Contents 1916 0 R
 /Resources 1914 0 R
 /MediaBox [0 0 595.2756 841.8898]
-/Parent 1897 0 R
+/Parent 1889 0 R
 >> endobj
 1917 0 obj <<
-/D [1915 0 R /XYZ 56.6929 794.5015 null]
+/D [1915 0 R /XYZ 85.0394 794.5015 null]
+>> endobj
+646 0 obj <<
+/D [1915 0 R /XYZ 85.0394 769.5949 null]
 >> endobj
 1918 0 obj <<
-/D [1915 0 R /XYZ 56.6929 752.4085 null]
+/D [1915 0 R /XYZ 85.0394 744.3535 null]
 >> endobj
 1919 0 obj <<
-/D [1915 0 R /XYZ 56.6929 626.6031 null]
+/D [1915 0 R /XYZ 85.0394 712.0918 null]
 >> endobj
 1920 0 obj <<
-/D [1915 0 R /XYZ 56.6929 566.5511 null]
+/D [1915 0 R /XYZ 85.0394 645.3077 null]
+>> endobj
+1921 0 obj <<
+/D [1915 0 R /XYZ 85.0394 572.4552 null]
+>> endobj
+1922 0 obj <<
+/D [1915 0 R /XYZ 85.0394 472.7274 null]
 >> endobj
 1914 0 obj <<
-/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F48 885 0 R /F39 863 0 R /F47 879 0 R >>
+/Font << /F37 747 0 R /F21 658 0 R /F23 682 0 R /F39 863 0 R /F53 962 0 R /F55 970 0 R >>
 /ProcSet [ /PDF /Text ]
 >> endobj
-1137 0 obj
+1925 0 obj <<
+/Length 1422      
+/Filter /FlateDecode
+>>
+stream
+xÚ¥WMoÛ8½ûWè(k–ß"�nëvS´I¶q�mŠ%'BeÉ+Ékäßw(’Šd3ñaaÀ¢ÈçÍÌ›’D~$IMu”hŽ&"Úìf8z€µ�3âd^h1–z»ž½ùÀ’H#-©ŒÖÛÑ^
+a¥H´Î~ÄoÁh[àøëõûw‹w7×>®®ç¢yÂãåííêúýÕ÷ù‚
+ ‰qüeyýmùÙÎÝÎ5�—Wwó_ëO³Õz€5†N03˜þ�ýø…£,ø4Èi%¢#¼`D´¦ÑnÆC‚3ægÊÙÝìŸaÃÑjÿiÈ\($(—àŠ¦a”2	'€Q?û‹’�¿¼”ñ×¢5v¾ù ÄH\H¸÷"i–5yÛžúƒ`…™ˆh¬õÛ 
+ï[››ˆk‹îÑŽŒWÏ+RLùZ¤�¨Bàh"}èë½aŒÛ²¶ÏÖ°ûd_RóP±±ÜkÓÕ�[y•ñB#L8¹Ìx�ꤎEYÚ­›¹Šx¾çqÝåÔM.d¼tKi¶°¬d�ÅX+5¥eVÛR³§d�{\Ò¸ÞÚ™Á…L�0)…¤Jè(5Ðïü)
+à»@'P.õ	.—º}´úÔ•ü¥Ôå(Iy5uÁÉ”èÓÔ˜Äã6ïž¹Ýêc•7n¸=Ñ?á=a=ë¿À{Î<!L—,�®‡t¥6O0ëj°3p¶Âþs_y§žDÀV�Ħ‹Ó²õFÝ9séÕF0|’þuU>�t 
¬iOÕÉâs¸eS1µo�©kSEçÞ³Â6âc¶7wÀ±�PÒ5–‰�‰Á²·ú¾ürûÙžöN¬ÇöNlñ_›ƒaí •e}ø”C×dš\hç†CÜ:·å½³þ`‰
+#GTUNN‡¾ŒŠþ˜a¼øp€@ýþ²³®`÷J¹)]H8Ô`jB“ Í`à.`§íƒ)ŽŽÂA¾cÿU2ñÃ2Þ7EÕÙajmºÛ—Á‚NczÌk£9Dl‰€Ÿòº×`*ªlêÆ�Yöu•ÕC¨õa†ÎV «kê²
ÕL`mB}y2J»Á�HßÐÃ	iÎ"ñ
+Û2p—W†¦sç<vÁ4©aÞŠÊ·PJÌÁîäd%³ó¼
+endobj
+1924 0 obj <<
+/Type /Page
+/Contents 1925 0 R
+/Resources 1923 0 R
+/MediaBox [0 0 595.2756 841.8898]
+/Parent 1889 0 R
+>> endobj
+1926 0 obj <<
+/D [1924 0 R /XYZ 56.6929 794.5015 null]
+>> endobj
+1927 0 obj <<
+/D [1924 0 R /XYZ 56.6929 591.7686 null]
+>> endobj
+1928 0 obj <<
+/D [1924 0 R /XYZ 56.6929 465.9632 null]
+>> endobj
+1929 0 obj <<
+/D [1924 0 R /XYZ 56.6929 405.9112 null]
+>> endobj
+1923 0 obj <<
+/Font << /F37 747 0 R /F21 658 0 R /F55 970 0 R /F23 682 0 R /F39 863 0 R /F48 885 0 R /F47 879 0 R >>
+/ProcSet [ /PDF /Text ]
+>> endobj
+1134 0 obj
 [650 0 R /Fit]
 endobj
-1921 0 obj <<
+1930 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 1/dotaccent/fi/fl/fraction/hungarumlaut/Lslash/lslash/ogonek/ring 10/.notdef 11/breve/minus 13/.notdef 14/Zcaron/zcaron/caron/dotlessi/dotlessj/ff/ffi/ffl/notequal/infinity/lessequal/greaterequal/partialdiff/summation/product/pi/grave/quotesingle/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 127/.notdef 128/Euro/integral/quotesinglbase/florin/quotedblbase/ellipsis/dagger/daggerdbl/circumflex/perthousand/Scaron/guilsinglleft/OE/Omega/radical/approxequal 144/.notdef 147/quotedblleft/quotedblright/bullet/endash/emdash/tilde/trademark/scaron/guilsinglright/oe/Delta/lozenge/Ydieresis 160/.notdef 161/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/hyphen/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]
 >> endobj
-1483 0 obj <<
+1493 0 obj <<
 /Length1 1628
 /Length2 8040
 /Length3 532
@@ -8480,7 +8532,7 @@ endobj
 stream
 xÚíte\Ôí¶6Ò ˆtÃÐÝÝÝÝ¡Ä000Ì ÝÝÝÝ’‚R"‚´t	ÒÈ‹>ïÞûüž³?�³?½¿w¾Ìÿ^×Z׺î7�¶‡Œ5Ü
 ¬‡¹rðpr‹t�´�P(ÐWç�…C­
�f
L9g0ЇÉ]Á¢
-Äü{fXE
+Äü{fXE
 0Üú÷äè¹aÖ�ÃöOÃoäæìüØã?ûÿxýœÿŒ=ì	a.ÌÁAb¡ö™9Y®
Ä£ò/z{x�Âœ*Þè—ÖÁ»2#×Dj,ïêÃ8›ÇEµyÍî;Ýoª²n
öA™ºÓÁß‹(üèX>ã.3v±ms™W`gÅúϨ¯"›
 rn­�êèš—ß¡RŽwð9£_²Ò¹Ð_8=óe4%v>oFÀk(Ù?`LÙ½¼`êú4ð±ûåÃ&9[~ƒ˜;26cLà«|r)Sƒj…×Íl(ßÛ
 b¬Å7ÎßÊçÏVð™h9�Žù,¢I‚°RÊ• e®äß·RÆ%=²ìÙ
êt›œ(†Ì%³LÇ�î)®Ž>1Ù¥‘„µ…^Ñ2¼éˆO£Ý	%õ‰>•pjÕr{2–Âw�Í<–g¬™-j—!3cäáakIè,AŒ$ÁLˆÇÆ‹J¯³nöùU»Ïm›Þ‰D3
@@ -8503,35 +8555,35 @@ $O�íœàÅ€DÈ
 t�‡Í=žÝbóÆÃwî6ß"£“˵?�”JËOP2RÐoQo+†â1)©w†¦ÜèådîI½ÈZ¿VÍ�­(e÷åû È
"QÔüFØs(úF�$'‘qL ®/¶!õÔ
¤HvkÖ‰Œh¼È‰¬ê؉á¶o?Ùa:Šÿ±qêcŒ°gã!_QÇ~ÏWê¡1üaœ¯UÝGmã§Yñmn%ìRãr9÷¬ß0qˆ5†/‚E…(êÚ“�†,W‚˜$Ù½ï¶åçLxËÎÔ|ú奕£w†Z|ÂV€ãž÷,éOd
 ÞyŠGÝ
 ŽÎ¨Ý3lÍ4©¿Î\×T2Zª½Ag—.7Ù#ÏPæï™v¼eŦQLÞ»±Oþ¼Ô\’	¬ÿĵJÅñ¾(š3Ç].Å*,MÎ>ÛBx�(ÃSÃó|D³uû‚Þ¡ï†{:Ò‘Á¨2G9¡Cê{É•<|?�ÒK áéá@F)Ø,êw÷ó?�È ¸¢Ëa„Çh%Ù±o^Œñ{‹6™Ý@¥-«ä%
Å~jÉwXjz1�îi´·î¬%uÕ3^¿±g�¸`d+ÎK[ŽDe—„]âò†Yè�ÖýÇ?Ï>£³HjË,èkѸÍhÔ8Š”™v_Å
[ªJÖ®²9m=·�âú?\‹k>¼à¬‡¤*³Ñ³ž,Y
ê<‹ý¹uÓZ/ZV$S·é#ƒmNOš¨5M@¿§rãÝ0Hõ7¬&7[àçŽAØñêOõƧÈêÚ5±pE6~d»Ž^.x¨T1¬µ¤$£Í7¿ÿ4òÆêüj§‹G1¬èípoóÌ3³QýÐZ:œNÍÆéç,0½‹Š‡Zg‹ðâ£à)‹Q©¯³‹X""œÛÆ0�ÏÁ¾äBvFA‚)Y9(ÎYÖý…ì¬S…|¸Ôü¾“qbæÇN.LÔX§…_�ï‚¿œ%�%½¥åŒìé|°
D>W²7}C–Í#—ZR¸
­$º`bÛGο…a¿9gÝS%\”Á/œîñ�hC|�?s§Ø…šg¯ÎÙÈ)ª¬m}ÐvÖËk†Ÿ.bÉ&O
 üõí+uqfº`Îa‡„°£â,I§ã¯½/‘�˜÷�ÇÝ›Á¤'P6ߢH‚
Ú?÷›½šÙ¹˜Žà9¦ŠmHr7:pMRYŸ#£ 'æW¥¿ðKCß|-¡mWÝ躖nᲶË0–«ÞÐ3äÛÙ=j’
¸Ë-,n–³e±€¢üb½iÙ;‘˜Hâ°l<)žL.ßÐYÖÿ°Ú·)�wL=(‚Œ£± L|�)=å'ÀÆ-Å@²öò¾µ<ÃNrä³6îµEôʃ3±d¶kÓ»¬ÿ‹%ôµøü·(kD~ô(¬_yñ‡Í;¯åä²fùOî{&*‰äyÒ¯9Û�B±T¨d>è.<Sâ¢éX3p7«Á~ª"럽Ÿ“lË´ÍÔDQÿfŒ°Ì
-*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ}
+*s"}Y
;Ò‰¢ú{YÌÝÇí]p¶Òݯ€Ž¶Xo³êÙ}
 endobj
-1484 0 obj <<
+1494 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 67
 /LastChar 85
-/Widths 1922 0 R
-/BaseFont /IQTQDN+URWPalladioL-Bold-Slant_167
-/FontDescriptor 1482 0 R
+/Widths 1931 0 R
+/BaseFont /AUEZLU+URWPalladioL-Bold-Slant_167
+/FontDescriptor 1492 0 R
 >> endobj
-1482 0 obj <<
+1492 0 obj <<
 /Ascent 708
 /CapHeight 672
 /Descent -266
-/FontName /IQTQDN+URWPalladioL-Bold-Slant_167
+/FontName /AUEZLU+URWPalladioL-Bold-Slant_167
 /ItalicAngle -9
 /StemV 123
 /XHeight 471
 /FontBBox [-152 -301 1000 935]
 /Flags 4
 /CharSet (/C/D/E/H/I/O/R/S/T/U)
-/FontFile 1483 0 R
+/FontFile 1493 0 R
 >> endobj
-1922 0 obj
+1931 0 obj
 [722 833 611 0 0 833 389 0 0 0 0 0 833 0 0 722 611 667 778 ]
 endobj
-1297 0 obj <<
+1303 0 obj <<
 /Length1 771
 /Length2 1151
 /Length3 532
@@ -8539,42 +8591,45 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚíRkTבª¡¬òRIÕzX%rÉKCH(`€"†¢�ðFbfB¦Lfè0@R">¨P•e‹.yŠŠRaU¨”Zbn
_¤U„KX^‹T­Š€¯XWWéÏö×]÷œ?gû;{ç;›á¦ðCøXŠc¤—Å�
-Àˆø+D|
�
ð�$iIàÀœ$	€XˆZ…
¹ŠÔÂ:ª†Z…®F`ÒÀbë&o¤‚up*L¤Ã‹ÆåQ“`œ„`4ö¤&¦Á�à
¥¥¼M¥ÃD*%
-¸MÉdJ$„c¨
@°†ÆÅ©n0¥åŸ�5½¸4
ECUºÉòSNý%¯Ò!¨áw®KI#aÈq&°éÔHø�89!iºéY©BµKBaàÁ]Éâ¬|ƒ#©RDCa©Ö�
-M…§pƒ¦+¡ü›ÒÁö—*ÃbBÝÿÚ©d˜
-ÁÈpC
-8°§bî1e�èA,‡Åáp)"µßžâ§5“`jB°$Àã{A¨4jˆ¨ˆ2¹
-fÖÞ¼ñòqNòÆÎ~“Í—�ëP	-¾üôš=°ò¿wŠ®LÜ«qSÍ¥ùqûž:¾2ÑÛn÷$ß²-–Ë­®—ú¼˜Ãaê5�4îþäŦ¨2áj…höBÏkÊŠR`ñ¾�Ki”oKsˆü—ÙƒÝLá Ké»=²¼ì’àHYÄè‚£•êÚ¨OP
Ýnh‹iÕùbòÍ
kó’ºx>ÅÜ”¦=Œu‰ã/¿.Ù1óIüóç}Ï^Ò[¨3],œ�ψt÷Úï—îæ>ÌìàЭ¯~ft‰Vi¿¸KŠý‚ûlV¶ëþí7�Õ2&QÂë¹N7Ž|æjâÑî‰Æu{+þ%�qÿºÙ¸;N¢·F_Ä>¨zøóÅÖÂý¼i@l_â™ð›î—êÏW:ÖåÏŒ76K¥ÕKšg㽃þó]|zϵÇ™Ã�v§éB�¾è¾öl–b|Ñ1‘ç�žÞC?”D›F{.ʱÚ¼ y'ë~øòL¯_¬Î…Ô%º¼êN¿Ÿ·l/žå±voò±Ú�Úm:Ã#áœ=G…
¹VYgŸˆ›¿Ó”E Þ-dãÓåÌvÆúËu�H»¢°çU‰,"ÚïLkF`æãã™é¼3­ç{Ç%½êñ=¼î`Mæ®�Ý\¹hûzšÈf wPHO‘|Z’ózËhoPš�½¤¹#Ö„Ý=Zzûû~D8¸ùìAû4WŸ¨¯–ú¶ÒëÏÿglÕZž½&<“ƒF»XL0 –*]�r2_òW%¹™œ�rÇoeOœ1cKJá6)É8ôòDu‰’�cî]uÒÓ…\3V%ÂKe§Ðå3nÏ{\âl~Jl:p5XÐX±ò»U3Z9ás§{"-×ñòHAçO§WÈ5ò×±Š=‰ó5}×¼Œæî²vú
-µ®É€°Ã­x mh_“C»+7W\æß}}çˆ6¡±óZyîOX„¢‘>Ñ^½o7"—íÛ>‹X,´šuïƒ+ÑŸ~“X#;/i�¿ÚûùèÚ‚¦x63¾ÈCE®êáÏ3mx’v(¯š^7Àù›‹öÿÿÔ(¬"H\§"’i¿
팦endstream
+xÚíRiTSבª¡¬2©¤j=,Œyn4„„H
+¯€iá
Ëg‘ªUpêëê*ýÙþzë�óçìogïï|g3\Âå,1Œo@¤8F² 6$þ2Y0Äԙ˥1þ¢ QP�ˆ@B¡X­Ó
+Àˆø+D|
�
üñT�&«IàæÏœ$	€X‹¨R�
™‚T#Zª†R¡
r\‰"¤�
Ä
X;y#
¬EÒ"�Ù40ª$Á$ÅhœIMÁ˜
+‚70¬K}›JGˆ4Jp›’É”HÇ4
+G0xºÊ¿)œPÿ@™4Ìý÷¯�J†+PŒŒ0¤"€û{*†þˆ)“Tâ¸l.¢ˆÔ~{J˜ÖL‚)qÅ’
�ï
¡0Ш!¢">È„
+‘ý2{ ‹)p)y·;8/»8(:8rtÁÑ
+eÍ�w`5Ý©o]×¢õÁ.äÖ¯ÉsH©ïäyA©�{k“Æ_2~]²cæ“„çÏ{Ÿ½6Ò[(3],œ�ψv÷Üï›îæ>ÌlçÒ­¯~fr‰U¨¿¸KŠ}ƒzmVÛ´ÿöíÏj“�áõ\§G>s5óh÷DãÚ½åÿ’­sÿºÉ´;^¢·Æ^Ä>ì¯|øóÅã~^¢Ô?®7éLÄM÷Kµ
ç«kóg&˜š¤Òª%M³ñž
¿ù.>Ž½æÚ‰ã#€z§ùB·¾ð¾úl–b|Ñ1‘Ç�î^C?GšG{,ʱÚ¼ e'û~ÄòLÏ_¬Î…Ô&:=kO˜¾Ÿ·l/‘ÅZ³7åXMHÍ6­á‘pΞ£Âú‡�UyÖÙ'â¦ïTeD!¨sÙøt9³�±þrí#Ò®0üye›ˆõ=ÓÒŠØàññÌtÞ™�Öó½â“_uû^{°:s×Æ�n®\´}=MdÓß3 ¤§J>-Îy½e´'Pgc/ij�3cw�–Üþ¾l>{Ð^çêóÕRŸzÝùÿŒ­ZÃâÙ«"2¹šX÷Ëþ	Ü\©­ubÀNƒ—üÉnfg“ÌñÛà'Θ©9Õ¸MJ2½<QUÅÉìYuÒÃ…«aò¥Á§4Ë-fÜž9ö¸Øyð)±éÀÕ ACùNØ÷VEøºÑŠ	ï;]º\ÇË#?�^!SÉ^ÇÉ÷$ÍWeô�ó2šºJØ•ëýYn[N”ù9ï‹SÆÆMóˆ°àpøKuû¶kŽW‚¢lµÐæh¡ž÷ìHLGžÕ»Ù«éôO0ãÒº1ý¾º ÒÁ¾#;.fD¾Ÿoºãå\*)~eU7ÔnYˆ'rhT6Öw_¨,²ý0JãO”Fä)Ûn%n^=,«k8¾Ëf;tP�UÔ57¿yÖ›~tz´,]^ñå:Ÿs‚¼ô¨³R~Ÿïœo]ªI81ûÄP¡¤ú@ò]IOPÖ3ßïރ߱]ò8úLIAþóAuïiÏò¢àáË�â›­»µ]š¦êÒüݲ¹5ëß	´;Ô~YtÕÎ{W{Q;ÿ“¶qú2òÅ«¸“Ë�¾6$B
ÝƇ�-¡0v¸°
ëmthóeçæŠKýº®ïQ'6t\+Ëý	‹”7Ð'ÚªöÍ�"s9>m³ˆÅB«Y÷>¸ûé7IÕ‚�±ó’–„«=Ÿ�®Ù!xaNà0
+Y
+rU7žyÓŒðCyUôÚ~îß\´ÿøŸ( Ô 
+‵
+"…ö#FŒ‡endstream
 endobj
-1298 0 obj <<
+1304 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1923 0 R
+/Encoding 1932 0 R
 /FirstChar 60
 /LastChar 62
-/Widths 1924 0 R
-/BaseFont /BFVPZN+CMMI10
-/FontDescriptor 1296 0 R
+/Widths 1933 0 R
+/BaseFont /LCGMFN+CMMI10
+/FontDescriptor 1302 0 R
 >> endobj
-1296 0 obj <<
+1302 0 obj <<
 /Ascent 694
 /CapHeight 683
 /Descent -194
-/FontName /BFVPZN+CMMI10
+/FontName /LCGMFN+CMMI10
 /ItalicAngle -14.04
 /StemV 72
 /XHeight 431
 /FontBBox [-32 -250 1048 750]
 /Flags 4
 /CharSet (/less/greater)
-/FontFile 1297 0 R
+/FontFile 1303 0 R
 >> endobj
-1924 0 obj
+1933 0 obj
 [778 0 778 ]
 endobj
-1923 0 obj <<
+1932 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 60/less 61/.notdef 62/greater 63/.notdef]
 >> endobj
@@ -8589,7 +8644,7 @@ stream
 xÚívgPTݶ-HPPÉ™&çÐÉ™–œƒº�–††î&K�(HÎQÉH�’sÎ 9#$ˆ€øÐïžsn}ïüº÷üzõvÕ®ÚkιÆsŽ¹VmVF-]^Yª„p@óùž4`ö–Î(]°ƒ¯
ÜEXYå‘P0†pP
 G8ÚCзÿã�ºP(
 �²BÂÑ€Û¬Z
-JñDÛ‚Ñ¿s£`·n
+JñDÛ‚Ñ¿s£`·n
 uƒZ|™BX‰¼LLIB—Qdt
(<ok
bu:æ}Ò{ŸíûÑ쓼,Vôâº4�¯rèéM�ûäŽãÏõg\=-äpöæxèA­3gkö£¶Qî
~ó<¤]ÃpÏÃ	µ%l“Ç+Ú:æ¹×w醄�x‡ß9}™]²}IYΉ¼­*"ÉVb—åìì²Å|ý~ÎÞÑÛÝÕÙ|ŒÓºNÃ�‰Ï*î‚MÈæë”N#m¢_äa™ŒéøÛÔªÏ!´0sL^µ$0ÙÂÿTh5ë¹[­Fúù{ª\™ÏíßÉúÐâ¦Ùé%üföC ~–fí*!Î:‰E�výÔzð­´÷Û6гßÕ•Ü 곺£�Âgü«e‰;}ƒv©b]ùßÖÒï6”�‡ùÚ}sø.Gj¢T«$Kñ£•I
âQ–®‹Â~ÒìEÛ1w.ì*Çbr|¬½}$oÖ‡·Gs]> Ã?V1ñŸx£+w¿³^õ9’e‡Ð†ŠÚ¥ÍäÊu””7œœ¸äN­Ñ÷ˆ¨/ùŠõ.‹ú…'Ð)á0äPùÝÚ…ke
 ¸éÛR§ö
 ]8sô&sß±­|*åŸî#>cÕ¯‡‹úœ‚œEëÑymeê÷AÆ€>8m„1œ4¬jõõr¦XÜâd8„²³¤¿V>M¼çÀ7ÁÜ&N\€*ÄJÒÜOµøï8•^Ýçôáö¼J%qõ‡  ‘®.µ&у;ìXBÒ0ÊÚcVKŸ0-SÛ·ߌG?óí·Eƒòñ(€(§¸Ëš’=´øô•ú
+y\J6.æꔋ‚œÞ»ó^eúÞ‚·V„(õb*$Ã=AÁžéÌmEé�ïa9žoñ€Rý3™ÙÑS×!÷8ÎãÒ9‹ÅÕçÜrƒÅ£‘C™Äù\‹-ÕÕ²k±ò¡øáÃÍ�8
@@ -8621,23 +8676,23 @@ QH;ǘ¢&šùŸe“ô¿žUÙ|µ°S�c0R2YE]¨
 �‡á{__bçâ.°ßþ
 LóÃI8GU–¿Bã¡\‚–Ÿˆ{éõ´Sû›7M‹Š–…;ûÛ䃵h¹0GQœ&÷

<‹"œ_ý¼ÈAze‰ÀN2ÿPÜJ"u]©¶ÕLòs.}æQùü‰iõHö5¨ñ‹‚‘öqLðëƒýUj[’
	=Á®…1Ñè²YÆHOŠåoq ’„!¿‡RÒ¯¸ð%ê«~u¯³¿0Š×·6î;>nE=m½a�Ô\{\ÄcïQq”&T/bµ^þü‹}m“¹ò
A’ü陈×O/ÍI>c×b%ÒÌ&ìýºªú· ¶mJ;û7žb{ª6eC‰Æô_è<@ÀbW’+Q'‘šäçÚU›‚ݧ/ˆ+ƒË°a
 <¤þdÑ
_IÒõ.˜ê¢Ï\9¾§é-xÚÖ-9?›
ìÐv_wóý}¾éH`…Ñ'>Êß4¬�>äŽT‹¬ÌÛúGäµGÔà…$Í	ï‚7LI›u`žUJ2ì„΃79ç¯~f´lá­ÊΚìïW5�?|¸':U—.ûrJoÇÓlÔË5áAÜçxE ³º×ا‰3Ç•ÚTñ#åKþtâ•.iKW@ö/É›ÔÑ÷ û�j&Q �¦Œ²È˜¥t°Èð§Äh-ؤ1íý b?e¾™F	Š– ÉXrÙ/&Šjz©�¨rAÁM°re.�2Òe%ÉÍ£™6"�5[¹(H4:\mdb“™[i:ýP½2“�¿Ýä÷ö0JÑ»pÕh¯QšQ¨ý±�Q�ó_»Ã7;mþã«÷Aú^ÁÐ;Óèvñ¡Õñ¥ã«*’Hóß�¹,QëtT½�}…ÁbWý€�g”ùxÔ$Ó¬GÞ×™®'}¡uÞói õ´’D§ùõ; ¼xðÞÔ¡Æ°~.
°öâ%ÅÅ4O”˜»ª¡Þ»Bï­\ÿÆÈæ 
-†ìvm…$t§³ÎLd?莑ˆ+í–«I&VñZ"-¿35MGöÊìä§7À Ñ4‰>ÅauA×W¯½r‚…`Hã×W{Ûw1Û®­¹E¥^["W¬%BŽ… >«íÜMÑ#nNCuy‹¼Hû%Tž,TÜþ0]4.�ïdîžk0œPañœ„5ðYÓë�F–?ª
U'?Õ‹«žäfü¸Š·Ö¤qCr®až1j,†º¿÷2Ó“=²õáÿ¶D4ÏØeÊÀ¿I
Üóv¼vþ´
b„dîÿ¼ø)xý)\+"oÜ´¦ÜD1å�[|�)h$úØûeGUeŸ?õ¾†Ó<å�ízznKB†Éd–¬ö…Àÿò!øÿ
+†ìvm…$t§³ÎLd?莑ˆ+í–«I&VñZ"-¿35MGöÊìä§7À Ñ4‰>ÅauA×W¯½r‚…`Hã×W{Ûw1Û®­¹E¥^["W¬%BŽ… >«íÜMÑ#nNCuy‹¼Hû%Tž,TÜþ0]4.�ïdîžk0œPañœ„5ðYÓë�F–?ª
U'?Õ‹«žäfü¸Š·Ö¤qCr®až1j,†º¿÷2Ó“=²õáÿ¶D4ÏØeÊÀ¿I
Üóv¼vþ´
b„dîÿ¼ø)xý)\+"oÜ´¦ÜD1å�[|�)h$úØûeGUeŸ?õ¾†Ó<å�ízznKB†Éd–¬ö…Àÿò!øÿ
 endobj
 998 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 36
 /LastChar 121
-/Widths 1925 0 R
-/BaseFont /EVPEDX+NimbusSanL-Bold
+/Widths 1934 0 R
+/BaseFont /NHCECU+NimbusSanL-Bold
 /FontDescriptor 996 0 R
 >> endobj
 996 0 obj <<
 /Ascent 722
 /CapHeight 722
 /Descent -217
-/FontName /EVPEDX+NimbusSanL-Bold
+/FontName /NHCECU+NimbusSanL-Bold
 /ItalicAngle 0
 /StemV 141
 /XHeight 532
@@ -8646,7 +8701,7 @@ endobj
 /CharSet (/dollar/hyphen/semicolon/C/D/E/F/G/I/L/N/O/R/T/U/Y/a/c/d/e/f/g/h/i/l/m/n/o/p/q/r/s/t/u/w/y)
 /FontFile 997 0 R
 >> endobj
-1925 0 obj
+1934 0 obj
 [556 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 722 722 667 611 778 0 278 0 0 611 0 722 778 0 0 722 0 611 722 0 0 0 667 0 0 0 0 0 0 0 556 0 556 611 556 333 611 611 278 0 0 278 889 611 611 611 611 389 556 333 611 0 778 0 556 ]
 endobj
 994 0 obj <<
@@ -8658,7 +8713,7 @@ endobj
 >>
 stream
 xÚízUX\[Ö-4�Á½p'hpw×*(¤€*Ü!‚»înÁ]ƒ»kÜÝ/çôºoŸîûtßîw«öZcÌ=æœcÍýíz(*r%U&3[ÐG[¨+3� 
-në3Áù
+në3Áù
 |ØGè´£ÇÀNâ¨Ð×	éÛb®=R‡äEÚTBbCøª
¶DÞ¤W:›[öŠ¨$dEY%Š[Ót¼/oü¥¬½”ùP'û[Ä�–~�	X2­µc×42:Xµ{—%ÍøFSÓ]¢8œÞ“
’˜•G&$ÚÜ|-C­l7…�à›ò~»,Nv}»Æî,@HíŒÅfMè\ƒ•jLw~˜,r
ÿMüF]_©
 ýÍ8¶öOáÏoëÓ‚úïLîÓ¼¿œ+è¶kÎ6ÙA
Ý$=43Žºoô°Jü¨rOwVsr¶Ê¬ðšz¾Ž~ÿ²ºþëÁ‹êËõ-!蔄Wd=R9‹ò”l:VŽhÔïÀ³¼Lô
Ãaìtþ8QIVæy
U&Á¡û�«ü\žj_E‘{<ó�éYàôDËæúløa½ê£D–Îîç„xô�?¹é$Ì|’"Xûü"rø—Xu[ÊÚ6·èNâ÷�AŒ»®qmƒ½É�ý¢¹Hx7žMxÃ
_Õ[±½z
 ¼*K«™Zú¹úÕ°×Wý¢Øø¹.ÔR¯�æESúLkéDÐ?«áäv%.
@@ -8681,23 +8736,23 @@ g.£Êù5õ\Ïc¯ªO]ffå,§m¾¼@+¬—q[¹ ,<¸¡ÎIPŸ©if8§”MIe({—Jœ~À$:­`š‘-éé;±‘¬y~�`²
 Ú=;ˆðá:ØÓÏäÁÏ/én¼¡,*¢`\ÜäK}["ÊHTÆÞˆo`ÝÙýz„N¢&j¸'µ2ó‹|K×c6Qén)'	üÖœëv?.ßüê´–®PÌ£§åZ]GOŸIªvIbŒµ³ÉЄH\Ô‡óÉ}vÆé¾°å1ù{'¾ógâ݇ûmœ‡½*œ‰VákÑJÃÙ9ÿ¾�<§µÈ
i¥ßg
CL⦇X
±rX¯=Gó‹Ûìö.BÒÓ	oû~o‡´~8:_ª˜WzåHTº{‚,×d?u-ôR,ýá²ÍþcQk®‰î•üâŒ'ÄݹQì�ª¡³¾§�Æç‰g\&ÚQ„#J©Yð#Õ²á[ƒ�ËEßE(@˵¸x†üœ³/ö®:g]!$…US	](%v¨	åÑÜ팼`‰jî&^Ûœ?-ó@öùàjÙ÷<³ï�lY?XRr$Š™£-ÑTù†~ŠÇ/0‰ÌB¯7Ù×ìYSB{@&A^UEs	$DH@
 ٦ϭÓ%"Òð9Ó
 -ý¸Bç
hµ0ÊnnL¿ñE~„éMÇv¡“LYd< gñÕ¾ìQ±í�Å EþoÉ|Ľ„\cvê´
-Y	

É4j"¼ÒÜçÞ»6ð¯ø»(~7qBËb“½L*&=¤ö4P'©ð·@Xáѧ†÷§€R§ ÙiîÌ#k]3§&M<~èêÆŽ¬y×–=¶÷.Ö}ìh�"rr
²Ë«À±æ<³$wt•°CnEÕ@�¸*ùwN.߆Z r™LŽ:øõŒªOâTãPêŽ".!ÉMù?dð<Ÿ½h·Õð¯=B­›B]	oº×dûJèoÛ°Æ°­TFØQêP¢úC@qSÁÅùÖ÷¥7_±�¸Ôˆ²»ÞÌ3å�³_Ž¾«š’ñ #¼Ì‚�
¸~sOsÔ|ùƱ-J?§>8�_@1.æXIg5ßRic¹Rc
+Y	

É4j"¼ÒÜçÞ»6ð¯ø»(~7qBËb“½L*&=¤ö4P'©ð·@Xáѧ†÷§€R§ ÙiîÌ#k]3§&M<~èêÆŽ¬y×–=¶÷.Ö}ìh�"rr
²Ë«À±æ<³$wt•°CnEÕ@�¸*ùwN.߆Z r™LŽ:øõŒªOâTãPêŽ".!ÉMù?dð<Ÿ½h·Õð¯=B­›B]	oº×dûJèoÛ°Æ°­TFØQêP¢úC@qSÁÅùÖ÷¥7_±�¸Ôˆ²»ÞÌ3å�³_Ž¾«š’ñ #¼Ì‚�
¸~sOsÔ|ùƱ-J?§>8�_@1.æXIg5ßRic¹Rc
 endobj
 995 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1926 0 R
-/BaseFont /CORQZL+NimbusSanL-Regu
+/Widths 1935 0 R
+/BaseFont /GNUWIN+NimbusSanL-Regu
 /FontDescriptor 993 0 R
 >> endobj
 993 0 obj <<
 /Ascent 712
 /CapHeight 712
 /Descent -213
-/FontName /CORQZL+NimbusSanL-Regu
+/FontName /GNUWIN+NimbusSanL-Regu
 /ItalicAngle 0
 /StemV 85
 /XHeight 523
@@ -8706,71 +8761,70 @@ endobj
 /CharSet (/fi/quoteright/parenleft/parenright/comma/hyphen/period/zero/one/two/three/five/eight/nine/semicolon/A/B/C/D/F/I/L/N/O/P/R/S/T/U/Y/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash)
 /FontFile 994 0 R
 >> endobj
-1926 0 obj
+1935 0 obj
 [500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 0 0 278 333 278 0 556 556 556 556 0 556 0 0 556 556 0 278 0 0 0 0 0 667 667 722 722 0 611 0 0 278 0 0 556 0 722 778 667 0 722 667 611 722 0 0 0 667 0 0 0 0 0 0 222 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 556 333 500 278 556 500 722 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 1000 ]
 endobj
 969 0 obj <<
 /Length1 1624
-/Length2 8351
+/Length2 8579
 /Length3 532
-/Length 9216      
-/Filter /FlateDecode
->>
-stream
-xÚíweT›ë¶.R´¸;A‹»Cq-î H!P¼x‘Bq)-îîPZ(VÜÝݵ-íº{ï3ÖÝ¿ÎÙ¿î¸#ß;Ÿ9Ÿ©ï_˜è´t9el V E(ÎÉËÅ#Ð
-°…Â
-°
»¹8
½}?’¹ÀÀÂpwCìþ

-~‡9Jéá0ÚšÖNjì¨C«h">Ï—xA–DM;IJ¶Úa¦1ò“ò¡%+#TÅQ*Ýçæ/ì2�ë„…ëZʃËtõJÑÛÂÞsáQí4ÔÜ0ÑPÍú0¯mÓ�ï>ב'ÆEO+€lŽÑŽ£R<"N~øjë$/:…ÈŸï9šÕÒÚi¥U6-LXz�I"ø`M‹·´¶W¨‡CÎV3“H~ý8!^䥗NW÷¶	x¯X€J|õFÎ�g/H&•À…é=³mþÛÖ�W­6Þrm_C‹a¨©³‹ùTá¦ôíuD}:}ƒ_¢ªÞ•ô¯Å’wši•«¿Ím9ÄXà'wݪÇk °ÚåÎæ¹ö}Ç>ð}}k›6˜Qú,E´¹âùbîœÖê©ÑX\®ÐÏÑn6RÚø`šùOÎ1j$§^•dŽ›xNæ­Wb«Ž¥nYO׃jM’D‚Ö–‡a­Û¹Çv•ýUOtñ]}Ť½°¶¥�¶ãž‹c&jžüõ«{Aî.5ûÛd
-Ž{âA‚ݧL3bü
J?ÙnÁ›C#ŒGV:ÂûSÅŸ†¸XJ½·5^9%4•Õó’‚Ò¨î_Zúäu¼AÁ�Ü݇€,23sËÛZÉzÎgIÞf­35TìQ›Ã_
?Ôn¹)-ödÙ­¤!á-æÔ‡$J›½Àzö‚õ˜»‹Š)Nü‹:¸¶’{ý[}ð|ͯÍ*Úe™à€\‡v,­�:j±ªÖÙH’R<[ݧ¹}I¡ÊíÐRò
´hst4ý¯3¥{Þë—àe¶A¥ÆÈ)f!ÁîÎÈW
n];FuéÅTK&|Õ‹æ¾\c…GîàèE9#½‘lý¤z‡X,¾t8íèëàvO¿šåj›@’ò»²·1Z1–ÈÈWc7Ü^q7÷õÛHm®#Í4š‹9.<�qÆ–7]Ï>é"घ»Ž;ʆW=™PNïÞmMj§%·™Gô(àØ/õ�]-÷'?E4œ¥ºŸê��ЗBáNI�V}ÄkËÏþÊÄi¡þy×°eD
-idguÊ ÛáÜ‚Ñ9¤ëË‘'jM.~×ÿfêKÃÔŸ’ SêkÉ'ë,Fèø.JìíÜÎXѶ%Ænvâš’¤c}å¹H×­òså|Îêœ
“SYÐЧŢIŸ1¾rl_—Á¨©*GŠ¯ú"ÎùfÅx®[áqdÿk�3@ÄëÛÀÆþ´/úÎÕÇ·þßì/6ü-ZœG�%Θ”ék�L:õÔ¾²u9·2N&°ÌAéâ*ê&�\D_cŸºâi$g¿Ð ÿ
-grØÝÙ)
[¸³Ø´ÔÍR½§ƒÔî{•wåì>ktµZ±œ
s–¦ÝÙb�</â;ÐÂ{«zÕ!H,Ÿ-ÇÞ°8+�sH”>5ýÕ‚“ÈŸ	$i‘åqHÝ[óÕýÒË.é©ŽxÝdïUf¿K K
ÎZ§4ÕÛ&eO°Ò`+sD�ë‰%ÝÞñ!z�Sµ‚Ðëâ̺r“–dø$.³nש–¶ê<±HƒD8ÆïÇSJüZâ=ÆôÒªµi3íü”‡ùµ^Ф9Ýö@»Àø†Ð­á÷˜ò.øwœô/[¡ÄŒ\~Á‘�¯>3=Ó”
£½—©Àé¤YEp¢`
‰¡QÙ¨’ºa®zżžÊ*Þœzgç}¼;Ð#U’ýé
-#ÄÎÝSDº“l
¹ügTù®„B'æ|pÙž2SXÁÖ=‹ç~õÎK–DÛ+Ïk¢·­ÀICÇCÜ0SApðäcZ:³ísž÷½Z÷•âKíÀDÙl”osúòÖ'+˜EŒ;�úØÏb]RN;-¿Œº(·]({5ׄX’³øö÷ô~™Ÿ=ÇŒpy¾7�rB>Ý#ÛÁr{Yƒ©3ßrƒlšê¼õ~±Y¬Ø)Õ`qyûT±ŸIJ\^Òª2¶5ù¶…Œ�¨ÆÙ½C+âa¹ÜmyüÊ€=YÙGzm’ÕŸ>ÖÃI)ª~•¢•¾·wZ䥗Q�yyŒRÂf�ff8û“‚
-Ãz¹Ÿ	ËR@T©k¡õúš{þbl?Àí§�<x0+NúÜá„	^ä•Q½Èå‚›SH�y­d³²šç¦æèÃþ¶ƒ@¡®2è©^ª\ñ�œq>Ž(	±®íKßéÏÈ(A??—�µåæ>ÇB¯pˆœ`ø$éLæ&ê3sRý@û²J¶µ»ãi†�Ђï–Ð0º7ñ¤‡>–"OhIåà"5àÊtþ]ÛŸe»ÝÁ†UyåÞå¼ë\_¹j†œO"	o‰¾é~iŒµ
-b�âÔwyu«�•¾Ö:°N¶ £Ñ(ðíî 
vú¬v¹f~)›³š+|ØÿÖÞÜ.ÙVÂ�7îEŒæ¶Ü‘™î>ÏGôâ“!çžûTEqõM7<'€3È4³kÎ}$Án0þ¿4âf’‰Ã7nÙ8–ýµ[+–Ž˜vHÁ9cœÆò©R€u·ÔÏfɦŽoEZö›o´G»¥Î¬-e±ƒ^,	ÃÂìÀÝ,}	Úa:Ü]7Щ ztŽ¡)�—ÏbŸ9qà·x2WÐ{ë•Ú'm£èw/ªÌ÷3z=çØ@ð¹ºæKvYùÝõådav£Û5ö#…C_«tþÙµTKÉ/ô#oÖÞ@øžè´Æz¹‘H4´DµÀzGÔ A~bDy›Ö�‚×dÕR´¿�ÍÀ(¥H‰ªØÏŽ¥Z
öŸ’>»&,UïM6ꑼ+‚C)iÀvw®_�.Fzõ³§r$b¸y<¿/}{X3_Ë®~ª¯m¤Z¨}?äÛtMðí® ôZ�ks"ÄN,ˆ¡8ݪ–“§is«ú+|L]éþ,íC|O&qƇWÓ5ï=
-•µD¬&TÕ�Ò¥­Jäd[•ã¯½¹Ý¹f= Á¶ç	zð
/¾N¤.‰'Ÿèe×1Qf&úþ™�»´9D¹•”~V&qéEmÁVÌuedµßØS±’˜¬„ë©*r{~œBU‚ÓvзYOaM:Çþž“IÄ·fùH©GgöÊÊr¨|úíëÉQÒtÚèˆ1ªÓ"u=ë'/¨c,_B½˜i$8K¬ºßáFK\ [�²'H9󛱃aóM
j?Ÿ3Ÿgµ7:^
-õŠ+/‡)Bä$€¹‡Rh¸—þUɼ™9"j²ŽP¥C«ÃȬL‰Á�
«mËùü�ˆs5�F¸°´Z+Ç*
--Ëðš±ÅwWë+Š'Ñ5ḗå–33Ь|‚±85ó)PD~LÖ
@Lx׆z1Â
-$¨éå,3£¨{Q¾Qê�5¨§6µh¸‰Üüß<ü‡ŸP1[½;džF�oU—%÷UÒÞ�,²Éš5Vo1
-Í/.qù{„l7LØ
-¯b(æ¨@<¨�é·ü�r±Êü%†þ0SËÉW)}{¢ÕÜ„,§5š{ºì1Ul‡.ÈK0ð!–�ÉÚd¥¢q\„˸nûËÀ€CÀ3œŒ$�‡e=ÆmX¡	{?ñ–QJ�~¥“!Þu×Mè8‚ΜƎ²G!Tõ„¡OïP5¨ƒå&z[4ûDeÄMpgÝRM³Éeçû’Ìeò)Œéw—wtæP伂Ø!Ô&ÝÃ+Aÿôn&;³‰_ÊŒ¿jß÷3–4Ó¼k7vQèÑ7eäqU½~¥Aä?D>…ÁC†_¿f&e,´ù<ªéae€ò@íÃléüDë‹œ’æÇK’r!¥0»	S¸Ú�Btü‘¥ò7>:}}趵U�ÿ̶gG;«Xô¼ïp?Jy<Ú¡m»=á}2ö<ì
Îî½�‹ì,ç;k=Ÿ˜ rZŽ¤ØFlù@IÜxþ§bÓ§ê<ïÓ»¤ü¢¢yx¥å!‘9óØ3�D—î¡Js«ú¡ÎëmŸ˜º'AS[ă=7Ö»ÆE|§s"ÒeÁ릅Ùò§•#ÚÖµ…©Œùn±Ù\KúSÓÌC¸›SrÜ‘âò¯ƒÜ�ÑçD“RšÙaŠËUÊòzäYÉs'¨‡mx˜b¶ž<Ç!ÒµgÂE\™$ĽÞÊ!¨�â+äC-ȃô_�«žF͸V�†¤ÈŸÆóÐÓÁM06éV0Âe‹80º¿£	xg;³Ã	:3³4b"‚˜ø5ÅËQä›é¯ñLs‰ï­‘w±œÃx³ôEeßß ¡8-«á)‹¦¼¡óÖŒRDÚÔë�ctÀ—Ç›½ß.Þ]
R ¶¨iðÂ=8§»5(e¶YnFÎÁÂA·é
Îi·XyI
-‹u1+i\nxíÚX´Ñ\/ŸÈU?‹�yunæm„„¼ðü•š95â"—tBiE½Þ»qVzÜ(•¡€˜—¸pCüCq^F=‚$@hoÚ‰º?¨¼o˜D5B||Ǥ?ïR<Õ6µßOuA«_Š?)°Ø+ê‹ÉaÄ%ÎD\ïÅ8mkÉè4¤Ò—•ýÄá):‘LtyøŽ‡8Eè¡t÷a¹]óWô†]GÒbN
¾Æõ„0WÝ9n·_	„öas‘™SvF™¡nÏie�R!
¶Ð¾Xˆ¯:·¬][Ó¿K'Kmh‘fÊìàÁº<6nõ«Òá U¯b•ÊVµ�‹=ÙJ:Lœ][E Ìu4Ž&Õð3Ö“*IÓfóZ¬‹�0Ñ›ÙÅ7Ïö»eZ7Ù Ýz»w²d3j¶Ã}
-%9‰üÅ*rêTÈ€¶³qXõ¬ ßyä ˜ib€ÞW`ÆW‹do÷>²ãçóÐNgJueÑɲ0!¦'E0-\cØ^ödæÓpÏ5wÉžüS£‚JJt‘Ù;*tw›)¥xd3†'‡š±Á®N…±Ž
ÊŽõ_c£õ­6XÞDê¤F—
®ˆ<'x1šÿ Ô³!xõ‰¿?¸ðpYÛûK¯KFé5	¦M3Q©²ÖëJ¯õ´åCm¤ê{œÜV1Ò¾
-…möÍ}ñí‹V—óiÅ'˜f{ü…O¬«k¶M,Ðy‡ƒÙpÓÖ Ü^©,{åcùÖg bºº#2Iµ"$_âݧîl€hXÏSÝá‘=°S,úç@P�Y“,Þ+xM‰z’k½
-=œ�.†Ü}{Š�½a�r nüB¬t„ë”}N<§˜¿:r¥Ëí±QÀ¿CÐ}<„ºŽ5»¶_fþ­—·Ìnn¼ý%H¹¬¢�ö×p²­–!rqݹü§¶\49wßà…ÞlÇù‘™ÛNȳþm|ç”v^ËJc>ÖÆ!öã›D¤îb›õåEºÂijê´öëQöG?[¸Rªkñ¡Ž6´ˆ4?Û­¡sì‘јɬa¢z·Î™*yAd+F>S§9
-$¼IH	!íƒ^e¾Ë¸wc
5+5
.'­Õ;~VóX•çÏè½¹Â)Œ7�v<7jk^Œ¬!Ëìnò²¶‚"Uøv�\È‘jÂÂå0åÜ	µf$”›g´­ƒé[AùØ¥ZŽƒ´XÒ2Á[~øŒ´ˆ/gï“tÕæ
çz{ƒö(žµ,-h�X¿&ãåJÉõÀô{.åñ
×MŒÞMe¦9�”´w•=K™»>`Á©8RJN=V,¡1XÄ—Öü
-ÙæÃ/ÚÝç†Ã…@9¬°YbÒ �sìw·+ø•@±ø>ñ){„£ØݯU¬^E›÷ª†´ë?¼d‰}½X!!Œ4¥r Ö³Œèã¿ÁþPûrÕ/±úÍ[Bg_/©xqñ²õ¹È9†�„–b½9Ãû_¶òò¾º·Õ´â|?¨ª/I~!ºofÐWÉ8ºBoÏÍXaö‘0+º³ÃLM­A›ª¸rr[„–!—PäÖ&.��²…ƒs}2GzÌ"ya½�*‚Eà,f^Cn^ÙZœ‹± æz1’~­aŸå Ã�þŒ-•œ—Å-�¸¦’m-
wê™O	‘âû§l‚þ56*Q$£µÇ6Ý,þô ™Ë	ß'¸‰5â[®�ØTz‹‰ÄñöZõ'¬	MÙál
-¾Ôœ%HüÆN…-¦–Èë/g6¹ä`¿êŸÛò©ó�ÄbÖ¾O_CÜ+3å·°R\`WU>õµ©ž{õ-QDO]h}Ø'sjìBU.&ueØ/¨bu‡AnÃO…7[²‹T�+"èŸÓ¾[}M=NœBŠ}¹Èéj’"Emî‰æ<ã·55b`J@iÒ“øå“®ãr}WM‹ÏU!Ïï’-Ç#úz�*?½åÃÏßhRJ¢Û—¢rXŠ\ý4D¤‰ë¶~v`—þ/õ«”WÕw°Õ‚I ¾ª@+a®ó(©±ãA5¡=y=£­ñxç>USåD»<çÆÍMU�Ô›€ÙlE—û†wRŽ{ÞÉíkGo-îçDq±¯R®¾…ù ¤í€‹p¼ìoB:04B»Ëß
*pº¤¯O*=¾oFäÉ°�ïCÀIüŠkú$ÛÆ�ò
wLv'
-�OêX¡gŠÛm9#Êó2Ôq
-ÓRLvÏÍŒÆ/Ï7Xy!r8Ë!MÔ4ócKv&½›Ä4á”UO-EyÂTóT�ñèjvŠ¾ïU«P¤[JÎY‘&•Ç
-N57üçØw>
-íûkIÙǽùît&Öð+JV(3ÎÕì~££yxbŸZ¦ûn Äd»7FPütM÷ªÜú»;PÝ“Ñï#¹ƒe87»ì˜ íŒzÐ[Ýy.ž:Oôa±aØCk´¨G5b‹±xÏVE¢8G=–>\Ÿ˜9§x1×®Ÿ&¹”¹¶«bÀè}ò
-ãL5Å8!á—˜ÐÀÀ�7fyÀ,Ô‡(Ý�œA£öùŠ´ÍÈ;L=SÞëÑ~Ø„&åQ§ú4»Oˆ~¸J­
-�aàùÚîjäßÜš¨SÞ‚{ÈTvø…ùî)x“›”Vˆc†šçùÁüÿÿOX;�€08ÔsÄü/t[ÐJendstream
+/Length 9443      
+/Filter /FlateDecode
+>>
+stream
+xÚíwePœë–.îîNCpwM‚»Üh ±†¦qw'H°à’àAîî48A“
+‹ß5á\�ãb�­Þsß]v”Ùv»I™»Ò@§Tþ/X¿â¯1µ³ï†p›•`géÇùžÍªn 	ñèín�ji›}ü�B=ÞÎE;»e
záQDÄpã‚`•^ÿ–¸¯Ž ¶èûSÊÁí
sßÐ×�þ®ä/;”ì¹oÑÅ=�°™bƒ\s)%Œt+|£^Ë
�àcš¤H�Ó¯øbD{ˆÂÓ®hå_ãO•Ñ8V§%Ål¢¾Æ3Ö`éT¤¼‚cØÄÍùÉDF͸
wvÎ%™îåH%ãc×ÊÎrYÓÀfhجØ
³_Ë7åCüUœB>þ¾o¤
²:ØÏ Ô÷¾î}'CL!Ôk‡»Pôë*/Ìò[!
­â‚Y?ËSR]¸
½ní΄Ê~ŜŽ#DiþqõÒ�i!�Oï
+ùÊaº5B
Osö;5¤²nÛ®”‡1?ß×!¶Õ¼Fä›`¾EïÎf%¥üÍNJ]Ë`|
ü^VÒ#5“Ù>U¶,lT*$A�6	/WÍo¿D)9A[ßÞE�»¯oOäÁçeˆbAÔ²²O,m£a’ «>+^¾1AU«Ôsi¦l›sÚ(,ÜØV¹ZùF§­#â=Õþ§‚[Fª½Ph7Æ�M&âCo#ù»¤ø²ù2y=�õ)êilºGôÙO=?-íw¡ë#Ž'a²—¥¦
4#¶š™5-+3>S¯áŒÌͱæEÆÛÚ?W«EAì/6sRI~ߟ¯òÒË
+g©ùX½—ÿˆN|)ãÆs"•AàÂøžÉ&?®}߳ݚÀG¦ãkx%cqµˆ*Ê„þs#Ñ öàH_líÛòþЭDò.SÍò2µ¸‚¶cô~r×Ý&¼¶aËnàbAˆëàö‘·hàm|¢MæHvsºhkõ«Õ‚%ÍÍsu¢©¤¡Ÿ“=l¤´É¡¾4Ë_œœÅ¨””Ò8n“9�1Vh½#àÛµ-ÞTöw?Y¢Ô§¾LÑÜõÐop+–¹?µ­ªEzƒïê'&é�µ'	´™öZ�2VõzIÁ¿Ò$¼yíîRÿ}�LÎáP<D°çœqAì%ÿ'…Ÿl¿Þ�wF'N,µ…¿Ï™—}å’cý)á)nc´qNhªlâ%eR=ZøvF"ãÆ|‡é�Ìsr
+ª:ÚÉú/Iâr·?UP›…Â…ÆŸv]NVûsm72ðVó›ÂÞIš*c1+³žrwS1&‰÷©�j¸·ÇšB—ëïÔÒ®K…ØŸ±ci7úRëY‹Õ¶GKÇ�TàÙ¼Á,L
ïTü© –B�7ÓFCÕýºPñòÐgûjœ­È6¢Ð3Ǥç+$سÁãäÖ½oИUFµfÌW·jæÇ5UrâŽ_•1ЙÈÓMm²OÁâË‚ÑN†~öò¯_¯³ö ió%O·­ŒKÐL°@D¼žºÕãöNº}lÚCèp�h¥ÑXÍw1çéJ2²¸ífþò'ÝÌ�p’ØA:ªöÉÀX�ræô{ïA{êg*PZ‡Yt¿ŽÝZ?ÙõúPÚ«p¸ýEªÇ¹þ©ðå˜ ]	dîôŒxf ^GQÞWFNsµÞý¶	
¬8uIÔ¢0Ÿ®µômºwʼn«¿jD‰ó>Š3”×/”})WCÄç^<"Ô¾±®ïÚáÆHýôbºY‘)ù O1€öúÊø½:†æ‡t�У+ÕÖ7v
+\F	P2ç´¢•ácƒÑ‹Ù‘…rò‹'ŽÔZOê�Þ£ÐËT5ù„–ämýÂÆ¡\ƒO¬nÎhY¯ÊT£˜(3‚'Iáq&ÝàL‹x¸8'`‹r›—¸]k�ãï²—8x¯ô6»ŠÝw‹®A3‘3hÉÂä'O,˜G9¹5j v@Í�¥×b*’ÅI
œOb?¬ÐÔP
M%gxWªIVÈ!ñhÅÒø['¯¼¿.:°ÅλÒ6ù€@š<.œ»M=b¢³G<Éžb©ÎV逖4–Hº·ïK¤ŒS»7àâĺq›™ª�””Óx`�Ð@[{ù®Hš€@8ÅïÏSAø²�ýäʲ½e#óòœ‡)P'dÖŒno¸”]`ú›Ð/ý»„ª6.˜²;NVßn81—hL°g/#³†õ½T5N•È&œ#kX�Ò·Z‰[¦ZO¦íVñ¨ÖŒ[ŸÓƒá~‰ò¼/×èa¶î^"’]d³¨ˆU?c«<œ)´ NGWŸÓJª"Z!ÉÜžo½¥I´¼½g:>:ªk{ˆëçÈ	Žœ}ÊÌbÒ¡}Åó~@ó±F|íƒ-˜(��2.°p{¶šIĨËq�
þ"AßEðI ý¼Ë¢oÒE±ã‡¢÷§Ðú0r¿¡þ�â°åÅKŒh—W‡ÃégäË�C²},7Øzíå¶[D“ð§Ý÷3ð­beÖz«ë{çòCŒⲯÍ-kÛÓ~µ‘ñQÔ;¹F׌~Z¯r[Ÿ¾ÖcOSô•Üše
 O4CwT(„¨]§kfž—zëd̹:E.g3G5Õ_üIA…nµ>Ĉe! ªÐ½×~sýücê{�?ê…s’.âÈÑ¢8é+û3FX©wvÝ*—n~	,!PÁzc³ÐMÕÁ—=®“@
®±&Ó/C¦ì>š�#ö¥X÷Þ•ß|/"rÈÏÞJð‚WXhÕö13/¾¼v"sõ]8«{¢5¬•n/ÁîÄÌÖZñÛÕêÇDßõÓ'R
+­)ýHF	º6Y~Ûé»n{0òiSÖ^q _±ð¦ÀO¦îEþ‘”8¢±7_'š-CØ¢bùu]<ÉeA$o4�¬ÒÌ)¦hÔ?úõt’†:öª^m™]IçoÅÙY�?¿î(g‡$
ÀOÆs[ìKÍ÷\!�xóI‘s/}©¥¸{•Äb’Ó½ä>‘b;’|†_};ËÈá—´nT
+ƒPÒ€m\ûVO~LDiåÍå¿Làæñº[{Ú2ÛÊ«ÃÔM–�7P)‘�uJl¹!{øXq£‚ʵ3f+ò¢,˲�“§eg·î+lê
šÂãEfqrqv±ç|ý{�EMË
5ƒ,IËrévÅä›ß‘¿öoX�H°íxBâ‚Æð’ESyŠˆ»O‰Ú0r¨Ð¾/�é¹Kš9+¶“Ò/J½[Snø¸›°F]Sç?…)Vž�›r3WKn'Â�S¢Bp?o‰ËÅ„¶DkŸxͦ;é›!dœ\Ø)ª+þ�AáÓý¼�+I§…Ÿ Â1/ÒØO±}¦L�hoañf¢yÉYnÙó7XîÙu®DBÈ_ÞI‰^nù¤úóÓÝ2«�Áé
+hãÓ‡¦øªB“ÞÉ�,
+M…ߎ9_³œü§Ó©7\y9Làbf
Lý”Bãôžå˦fð(iÚB5ö±¬r/Ö@¦•
+/ôÙ°úQw�.#EœêhüYУ„%UÛ96‘iYÆ·ŒÌï\]”¬®)”ÏâõŽê£p¯ª, ¹ESIªfs èLü„Ü#€˜ð�5õ
|ºóX�ŠÜ´Ñ;1*ýó$]˜o4^|œÖarAG–´@îõ´\ph®«`�­
+ãDáð£ìÆU¦1*]	ÓýQ„dl¯}ߨ¨7(cKqÞ9–ã¨[k�wOŽÌ|ö$·¨íŸí«æ|sŠR¿
+�ÞgÔ h¥%Ñî›!«RèPêé]å’qh”ö$Õk<©6–ìùŒ“=Ý°ãs8Ëqçsïï>®ê
še{Þ1#ìgŠ²8egç~¤’+J˜gÑ“¯©�²j>�-Z’µ×v�i™4/CTÊ´Š]±‡|ë‰
+)¯…=ղŻ†â	&И2Ù‘)„j‘^êK¡„4
+uHöó¾¤Ç|X(ÂÎiá—0åÁ¯ýîׇ%ɸìÚƒ]~2¦ˆ8­¢3¤PBþã^äK,l<0�‰”¡ÄºwRÃÃRù‰Ú—ÉÂ	I³OFAãÃI•�B„íŒ	Lõ¾
b­*ÒW{pͦa¦öùŸÙÞâdW-Ë'ŸÜH£û´Í`7$^¤©W‘8�z.êЋü;*Ö&>0A̼I™µØú‘‚ø3àU$NõŽoíeá—·©E¥¥Ë°‹c¸3¦)fõwÖ.=£5f–MmB]7{¾ùP5/‚–Žè';n¬·ÍýòøŽ—D¤ë"‚ÙV+Œ)r‹U˜5ZV
%En‰y\kºsóL£¸;s2¹c:ÅeCÜ�ñ—D³Ùyò뵊²:ä¹iKg(Ç3æxb6^<§a’
êÂ¥\9$Ä>Ša(Íâä£mˆ#ô}ˆµ˜±®uS%aéA²çÉF<ôÄt0côz¸
ô(é²Oè=wÈF£>yN¬F0‚®w9¹ê	Ñ!ŒüâUȲ­Áô7ø÷ó\â‡[äÝ,—PÞ\]Qé÷·¨ÈŽëªxŠ¢é‘t¾£ã‰£ò;:�2öø²x‹�{e@
+ø6Uu^˜ç|�:¥ÔËíäð%X8ä—@Ö�ONÙ™¿°
+S
Ò±H�]^åí?ÒS”:j>ù^±$•MËÔ°Ö~�¨ù®Ó›¨òëŠÖhé¸Zêî @­!5“Ößꦶüþyö{¶=êÇ{§	9¶$â[Ùo„5òѨÛç³-ïoGóù/.	ÈR+¿”Ûû²W}˜x÷�aî¶bK‚+52gõK䯰’Oß󅤧d0ð¨3”âK9ìºXÃø¹Ê'=ñÜdÇY–µBø
Üc‰­’Þ�RNªzcÐØ2•¼eཙüœ/ŒB+‚YK°>]3çÚàÔô‰é(±œÌ×
üq]ÔÒ•h»¦éyù>¬oG{åM\4Ù™§©	ÌÔîå«îTäfo¢d¥SʆuÓµ‘´F”T�/¤*ÜÄ"Úé‚&‘v”gHæ�ÅBY+*z âÛ“kȺªñŒ¯W¾q ¶Nr1=æÁ{F³N·>©)‡kêøW}À{×.¬´;UBòœ•$‡3/ï�twG¤òt$qËoGćâ·éçë][
+‘mv¿`€÷˜¶”¬d檥—ˆT®•¨U~Ì:¼dLTФo*`›ð=Csì„	:Ó‚$G£C‹*zÒÛüªˆ�ÇzY]R?Ž§iÊ­6&ldr¹á}Ö¢�ç2D’©cŽ–RŽ½4õ1@@Üzå©jF
¿Ê%™RQݤóvš•7Vi4(Á¦�¿ o-ÎË C�
+È<S
+ò`]Ÿš¶ü]c”¡S½‰Be­])Àžm''Îk¨%æ:™F•øô3Ñ‹*UÃzçF¬›�0Þ‡ÉůÐæÎ"³‡l„nû³OÚëV”<ûÇtJr!˜ò&b,Ê\Ø°–=“QXåâã�ÓÄQ(ãÌ0½ŸÀ‚5®&ÉáÁcLçÏWá]¾N”jŠ¢Ñ¯+#„‘J¡š¸FÐüÙÌàþ	jîòCYLƒ�5”h"‹ThîÖå
+Ɉ¦/�Ž5C]K‚š¾&ÆëZ~c‰ŒÑÎ Œ/«ÙyE <Yô$ÔÿMðúÿPhÉñ"¢–O߀KvÅ
	†
MQ…¢f`�÷væú±BÝ#NA»é`7aÌý钲Ɣ K•{=‚0ê]=	v…;ŽT³wz{b×ôqÑ	™‚NûbîE?Z½ ‚˸¯ƒÉ˜2\qÄ‘ž2_ŸhÀ(7„÷7Æçm
+÷ÅžA>Œ./–ûš¡�`¥ßV¬åÅù=uë�sôŠæò‚~ÃñQß‹?{Ù*.z{ö­`!ŒOÍžE¡â‹ù'™Ï<LõêoŠz–»lfvùt®ï¶6•�@!	éÚñ´}›¾z8õpƧ¤˜<|Ø¡
+c.8=ƒ¹-ýؽ`硈‚Œ/>mQ5%ä,fÝOýjïøÖî—_e^Š¬
+ÒÆ°9QðÙsý‚v�9êÎu12g‰j=I^Û¸å<¦¶±q;~?”,
+:Ö¯}‰÷v,}çx>¯‡j+’¼ ¨XRÔi q8;­‘½–„¿¬Ÿ6mF\©%šÆžéƒàÉÒ�i?6‡/9ÒiHö^Å’ÕÃ&y{&Ìe$66Úr‘oMí’ÉÉ*Ëû†±	õR¡ð•Á¯k7Î[ì…$"+•zSàCz¥ØöUP‹µ;«3ËP:1Ž�.ÿ
Û{‘q.ŸI´¬o^Ã{ßH¼÷ê£LMëV¢Z@eð»¾Ô•w^6'þƒ¼¾
+ˆÒ�—³AÕ÷Üì4*‡
ËGFO„’P°Áñd‡�œ¾×vu¼v£¬}  J6J(c�8'Nj×mÕ‰kݸBgdî?PPÐuȈŒG/ýTø›!ž|¹$dKX]ò6ÃÑb~þÝäÄðå²W/]\î¢ã¸;cùb•zÿÔ�9¿ßÊÍ^Ð`ö¶¨«QíÛ$
ÂÐ2Òn«Ã­+³Çø/Bîr/–YÖmí‘×…¯ñ™I"Wâ}-è¨>¢×6n#°Öӧ˿ÏT‹YeFÚ@ìT‰¨Ç¶&TGŒN·p/SòÖŽgzaN»zµú8#Xáü=ö6Œ¬ªˆ§)xû#YÄ)´9pÍd™"üF‚š¯€ÉŽ÷Ó±ü—j" F!m:™­•0./1S¿À
þ4×<¼ý@(°tÈ£^ž<bâfvßf£ZÏùÌ6�G%2À1-øu"
gŸü55KS½©¥ÛX'ó”±ÜIlÛbßÖ.’Vð*£Ð´Ëk,nñIl�ìØî­ƒ|4xn¸·"‹p,€˜,©VÞFôkÍ÷™Ÿ0¦ûÛ~ĵ·_"muFÛF�,V¬+×)ö³1|¡n”"Ü3÷QÑjªßõ…°^rÚŠ
.áÓ®ÓÅY¹YD§HÚ
+ćPí�ˆb}Õö#çù_~0þ?ÁÿVŽ  qB0þa
*endstream
 endobj
 970 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 35
 /LastChar 122
-/Widths 1927 0 R
-/BaseFont /RONGGN+NimbusMonL-BoldObli
+/Widths 1936 0 R
+/BaseFont /FEIHRQ+NimbusMonL-BoldObli
 /FontDescriptor 968 0 R
 >> endobj
 968 0 obj <<
 /Ascent 624
 /CapHeight 552
 /Descent -126
-/FontName /RONGGN+NimbusMonL-BoldObli
+/FontName /FEIHRQ+NimbusMonL-BoldObli
 /ItalicAngle -12
 /StemV 103
 /XHeight 439
 /FontBBox [-61 -278 840 871]
 /Flags 4
-/CharSet (/numbersign/hyphen/period/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y/z)
+/CharSet (/numbersign/hyphen/period/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/x/y/z)
 /FontFile 969 0 R
 >> endobj
-1927 0 obj
-[600 0 0 0 0 0 0 0 0 0 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 0 600 600 ]
+1936 0 obj
+[600 0 0 0 0 0 0 0 0 0 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 ]
 endobj
 961 0 obj <<
 /Length1 1630
@@ -8780,69 +8834,60 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚíteTœí’-îîNÜ%¸{4îN
4Ò¸»»Kpw‚Ü'H°@p‚‡\ò}sæÌ:w~Íœ_wÝ^ëíõ>µ«vU=»Þ¢§QÓd—²t4Ë;BÝع9¸„
*swWeG(�]lí®jn
¼
-±†^^<ÀöŽN`¨ÛÅÿ8P¸Ù€
V{0@FUM_Aå
€é�Š6à

-v
ÙÔÜ_Z±
-
-rrq|ñpxÁ^ÈÔ]Ý\-\ Nn€—¬j²ò×éfrû“Ûò­^<--Üÿ´ôöBó‚º� PW€ØËíO.s0Àâêdò~ÉýBæäù«wWÔúŸ°
\ÀÖ K{°«ëÍ÷ŸÛùgŸ€ÿÒ=ÈÉÉÞû¯hÇ¿¼þ³ˆ›+ØÞŠ�›ç%§…ÛKnk�óÏ°(@­
Ü\Û-Ý�þ�y€]þº ¦?3ÃüRÈÒjï
°[¡qª8º½¤0ýÏTæø÷‰üo�øß"ð¿EÞÿ�¸ÿªÑùˆÿ·ßó¿RË»ÛÛ«€^àï%xÙ2Ž
-dÿrgÙµ¡–`{ü¢í_×úÄÅõ/˜–
ÄÂúG¾¿!0Ôò_Ë‘ë¯â9�*ÚúZŠ¬ÿ݆ýËSíeÜ´¼�À€ÿH£«ìhùŸ‡?<ÒÒŽ^
-Zæ¾bÜu†N
ÖÝN“
-̬#Ý8ß³yà‚
?—ÎîÖgu
“òG$Ê©Î×.(g7ÌA´ÅAt×NX
ï	»pšaðJ�R÷o®ÇF†‡zÎû¾“³æ'¢Ò‹x `2Ä9ç“Kh×øF³îÀ}Ø¥NèK)àáY�Êߥ‡MgÎWª;hk]ðtåûå*	À—§wkü@)7ù•gKØ™C"uSï3¸M_èKaKð³Õ^`ŸUrwªJY®ê	E‚ÞÿÝoÕíâ_y-p¿žrž¬«Ý†:wb�“Ivd«RƒˆÉ•Ôݧ~€ïñ?ò
-äŸoÓÛ,0!�í¤ŽØ‡}ˆµùÆxÕ8H»ç¸÷M×»A%=Ú¾â#ÞtØ'§T¡���h´ÏE2ïËÓºh®ã¡Ñ+r}Ó­À˺A´žÄ ‘‹ÍPEÛ¬ssáBâì¹�ß|dé$;«ò€ì›@Ë\_—íä¹úô‚ï«®ž³¦ô‚a‚ÌWM5cxø8¡RèáÉŠ
ÚtK?5B:¿…’Gèñ~-ÁL‘¹+�˜Ù¤KsÍüݪ/©ãÈa4÷IÚAÙaM“GêruŸM’8[&
eöfï @[öˆ­dF¼ž1"ùCŸ÷�ÕAtÈ<ÒÎeq³îÏ¥YTÄË
TüiþLFêë
¿»˜[#$ùPî	ä�y7“¿Û(lÅÍ�Pq…Æœë
ø.¼lø¿¬Ðšv)GÔ+ Kö³ž†„1¹6ó|oŠú’�ìÝSjÂíѺ±ó_ ð£v^�¢9SXžÜ´¬�W"nw§Y%\ãîÅÓ.Ã3*µ ýö!1/½öý÷œ=ƒˆF°-Š´q©dàÛëw»§÷Ów
„_—ÈÜHRbpàYtÖú+x΄'-íÉóañ‹zSß9øØe˵ÊL;©w÷ÝÇÛÅ«––n×h1³Ó®J}5â·KB§‡I‹ð,Gý@{á([ª¨6÷–5€­`ÜãÐh°}Wxæ ï­n#´Š�•†ßV¤­´%"ð< vÙ(1ÒsRrÐ'”Eƒ1¿Qu½p°fñÝF„áRîð&—ô’FÅâͲѦ•ŠÑ³2îÕ ²¢‚o¯X®%ýùUmeöò$Œªÿäµ WNOÃ-ÁÓ™%;E¯ír$y§»€{))ý¶pîÕXðNã¦(©¹Ó¼5Bx¿ƒ]ìç)={ýÙ'öæ©mQU� õòÃ	ÅSQbÔgaך¶æc“,IÄú™ø_ŽÜ�N§ñt\)*¶cèÃ~Úĉü—g=YÌjÎY°fx,FÜ3GËÑ{ײrž¯Í¯Cðq³Ç…6bÚÝŒtýׂ&21ºÖ¢SÝ’â?öú½ŸãΗÍ/ùn�™oƒO{^U‹áªž ô¸ù)•=U·•àSÍÊj¹9‚A
-�0�ëe�áéEl²ýAÕŠÓ Þåt)µUq¶ÀÀý[NŽ·Õ:2J�ºIÀÕòNÎ~5úîö·&BŸ3'\<–'±ß»wÉ(Ìšù›
�oŽá1Ä´•.ÉZe
-xD¥4¶æÔ{syÐï¢ǘ0ßñ2ƶgÀ6 HfƶE¬¦¿·‹ÂSõ€P)â]�¬_9ЋN‰ÂæfK†[
�Ÿ®Hýg†_SkÊòöj?�øÙ×ÇdˆØÊeR£ž91J$gtÈq*
-QÕ©/iöq7i*¡¼™ïG×OŽjäq`Ÿ’1³Ë-G(z(·ú;ñªîý‡D�Å
-vèfÆŒ²§²V	äLÔ´¡£=«µF0åQ
h0ÞFªâKw¿Œh
-UÉn‰‹™âÚ“Vt*%ÆêõÓ0jt‚Š¡H”œfiBôwíqßL‹Ût4ÆYeC¤ùÉÝÖ³,ÝÔääÖÙÈ=M€uï)K�¼9à3uðËÅvßàEc<Ô|§¢±.¯ÓDFÂ]›¤µoŒè-ÙÂ4:hXUó%Þ£µA¤î¬8ü¾�ñœA�†YüP9ôe!Þªò™“Ïx}tOª"ÓµÖæûík*(™—ÛÝ�ì��Â�ÉtiÎ[ß]ø�eŒkBo|©F_ÑRý�ós§}DŒ‘Ëæ·ëDœ7¦
:ûbpÃÅÆ5Š[öÅ!‹£ƒž¢}œ?õÉÞÊJií¬)9õ[kY†\ˆ$äFÃSé¦ð¾z¸ÁkÛ…ìßš£ºM’AbNéH–83újØ|ž GüVF
xùƒ�î“’ò~sÂÝûð7n&@ŠÌ†™¥ƒ™	΋LQ‰{¬$¹8q„€ð+Ì~'¬åà*U[_žÜõgέèän¬*;½[нT¿Òæ1
-†�…EËØ®
-Ô~%@&š82—}õ`ÌM±Z¢”è“|{ã…¨m)�Ù”š—Û´UµEð¡Å”�2ÇÙv¬IÅg¾¶ÚD¸ƒµTŽAb)Înh0*iXppªN¼Õ÷eÌIœùˆûÔ©Ìåjb¾þ¾?¯·¿
ñÐA¸5ÎM›®{øm’Š«ü‡Äžžš;¦ïë™é‡ïгgA¥´ÊŠK‚ÉÞïžC0ßj3ewH³©FÊi»ù¤Ðì	ŒÛ��ƘvH?+z²'²ÚU¿ËR-±2�ªS§¡�ïAäÂொ¸b¯Þ4Œ	ÛHñ
-Ú/XZ88VÂC&-Çy9?ß°ì•ÒŠz6ð&Âg
-Ú
-æi:[|º÷(J;n¸>Î…é$Æ+46wIš¥¼/
-s!ÅeÎ::‰í
Í
-�ƒ°[Ñ»·æ	4�¨‘‘	yóéÂt*?D2o
",[Ž¾ŽÒÀ~´Ì‡¦°{^�ê:²sæq¶þ\Ã@öu‡„}œ×	¾o
×òç¡IÕË3¬Œ“�þ_žª­Ä\·ðBfœèÔا‡
ÛRñŒ¿Æ—w]Ó®š=?iÄñ[ÿ„½ÉA¡k÷{³ÿ¤fVfC¢|Ã6©º˜³½'8óq
´õ�ý}ÒE¢Tò�ù¸´kß'$¬=êÏoÄnõZ'‹¿°Þ·‡"[Á¹À`Œ�”­R2�uv ¦�mž…·@.êÞû”­1™”`S=Ô †·àø‡.
¥É!Sý�ìUWÜDÉ}`ØI<µ-°lÒs÷;ÿ}“U©æÏ:zG]Ú#šÓ7(kuÜ,ü–�Çwee&‚^ÔæôVLÜtUwÔi�?»øH+¸Ï0\Ñ//9l74“/à¹eã:©hi<û|tˆ,ýo”ƒYL	Ĉx¼ÝÚ/?Þ¯„51o¢¹˜‘­$ömòÁ.³ÛTíëL²âÐú…˜�Û%¸B÷ãWôÍ­÷½îý<Z¾\ñp÷›�¬ï¬p[2,»:‹úŠ>?sÀü�FxÕ0<_eDß?L£„!¹ZÝ1‹´»qÊ!·‹`p@šOÄ9÷‹@ùÂ÷‘¦µp‡oc0Û†ñÉvÒy bÈ>:}·76
-¤.°÷Ÿ¤˜E0»H·¨R¢Û‘ê÷l“x¸ž@jùٌ뙴1óȽù<�f/ʶØU©o[?áRø`*�IzËDûv)Y¨™`mÈW1£W·!_¨�Àjšwç?¨Sp �œªóQZò‘5�²iuN™M#@*
Q8)Vkkü֥׉CÍ¥T²ÄM‘Èò÷:smj†b»¨g,ÞüÖX‹
-|^í÷g#h‹/«gD³JvfMµ,´7„”»MUÎKÿ¤~‘ÊÓ†Ö±·”KAñ3Ýw{¸|›Ø!4A.@Hš¹™
-,Túñ;býÚÚ÷®-BÁ]áÀÉĆ_-{&”†FÅ‚‡-L!ž0«Çn�:öIÖñd¾‹‡)óFüð/&©(£}1ô¥,ªÚµ»†>bþÑc’«eGo¢äȺvÕDy_¢™Û!
-¤„pƒ¨ÀŸ‘r8–ÄÈ(ÈœiÔ´rHð	ÇøÃR�dQ¼ô”´çr~ Ö·'JgòŸÜ^ËCFd•Æl’
Ô¯N“ØÙ¤‡³ƒ˜!Ù†xmIªþŸõNÍšì_o<a{,¾&ºŸe.~¿øNZYA´�¦”]O$a0Az™\pC7sÐ	¢\åئf×t »I¹‹�!Þ�ƒàSˆÓ£™a=´â vÐYÛÐm|w¼–Ê‚�ƒ±s[�GÂØ}FÇ*jF.æ‘»Âj¥Ã±±«…Ú~Ñ#üìÈN¥÷	“SX¬!—1�cãƹ<a@Mþ\ÇQ_·Å0 $›ae»RȤ!©¨–L`æq Ÿ6'cr‚x¶Ãp
3úƒÉÒµÆ:Nò`’ºPÖíF±qã»!ƒeë•ÌÂÙé-L)Rì�šA£á`Ó¼Š®¬WÜ
Ñn$âA%¿K£èÇbû‘›heEb§DÀœªû
-•ê"ó¶ŒÜ”E(�°!I¢/™3¯ØûAŠ›z»ÐÊú�št올+iÚu§õÑRêmX®ó.CŽ-_q¡°=)ÖífÖÏ"pa‹5gAßí›M•v *«Ë˜?ʨÎä¤ê{3céKì4wé�¶UýÅÒ©>lµ
È#Ô G²Ž2ÿÑt$rqð*Àì+œšº¯Ö«[[PÑR6Ó8+WJÃÎ+Š¾_ô}ˆê…9úΛbUè¹–¦&Ìc†j_0Ô`§º4ÄÑ++w¿a8šMœ¬éÝ̸ȷ*çПÓêÁ¬%Dá]¯Ÿ£	OQX°h�o˜eѹ.­ä¦ˆ¥ÅÞöèLÃ1·.Œ©²Œ$W™^º`ûuv¢w5—W¾9±rIƒ«&!š—¡ÇÛ†Œùe.ÉΫÍ[y^­ª‹å'éVq*?[Ó8K¦-b§R†ÂP³"’å„�2�Ì‘0¶ÿÑ,»b@w€&ÁQÙ­˜»PxGöøpþî⹺Ôu¤X§$#iή…:>Õ™.3
-%~hÍšäf2inm~Åf ˜ÿ»MÁÐs‡ò&ºÍ¨Á‹
-sÑÖm{A³‰@ùŒ½^ô‹R°bGîr“5ïc4’rë¦b§Í�´bjaUI‡*%ùýzc(ŒÔñeÆ
-ž,뮕�¶¥;b"ï¨û”3ñw××–H]oÚ,•^ýˆƒò‰)\=8ªvÌùà,”ë�+ A$÷y m9Vt¹ØsgÔç;”Xý�iç£u‚ðê
-Aϱ¸ŸÚé_ŸÄ­e»ˆì’aõÚÔdæ5ã¨�:’™³Ã¨R=>çw:›ån!Eû©n �QŒá©¡sJß7ŒºukGÃÖzŠs¶Ÿuý.ãÎì–à“
CqTÑ„ŽBYiÜ„‰4ù®ó€ÛøÈLö–e{ɶ€¿sÞ»\œiNC“°ôÊÅ1ÞuÓ|ù—„ñ6¯5­¯€N]Û³QD©ü¤fíí§«ù&‡È¤¢à’ù¬˜FÍêÒ¯ê��¹e¹÷ÈiË=÷#ˆU¦õ0í†VX}”°Åö¤™…[ŒŽé $¤æC£…Éq÷Ê—M#QÌB¸{¯€¬À;S†‘”ëYêzö§W¯±OgHëYÚßâ蜼•Õ;öy]ç”
§:ª6¢½>L^­à%1²)©‰MýòœE{d„­|\˜�¶�<Éo³íi
¿ã7T?"”ïÜ¡CMoR5G™elí˜$6f@«€:}Å�¶¥™áï'R.l$ž‚ÿe3#˜�]é˜Û…™nÝdpø2…78�´
-_ió!Øn*ÿ)ΠŒ
-U¡Ý¡¡}”ÐGï»3WЖ�ŸÓÉ37mé–Τ¥dü•¿Z”yS¯|ª!ÍÚãÈN5N`
µ³× ïëG¦Öù¼ÑåÛè8éÖë§	k-‹…9¡q2!ë×ÎûÈK^˜ð´b=A‹ëãš"Ï㊺jëû`‹`ñ”°2¬‰ÁhÃln[¤–nQú…±bF&ŽÁOI¾"
ÏÍ’ÁV—HE„¶¥�ã,‚ÃZ$ª÷sXSViHd²fÔÃíä
)
K+Ë»Lóo…/œøÕ…ÜÑü�|yZ	«´3mtŒ}\�4Ndž)èlk¶ÃÕCt:L(EË\{'ÃÁÌN6fI<ô�9§¼X‘!Y•F°Ž}BG/‘ÈzßârÒéâ¡ŸêX"ÏÀù‰ðÛ‰–³KÈ›½OÔ1œŸ€`ôÅ/3µ“›ë§¿ef؞з´=;Ì"æQ{²¦Î9¦€ªÊê£íj;E²\cbgJk§5ôÇ=!=L*°
-ÒFö’ÝÒµŸoÝ3P}¹éI º<ç�š¾=LõGó—¶w-0Fº·%°݇,5à
-©þ(‚ÁFzxPÙ
x…Uœª?1?vHÔ›DþøÚ—íŒ`�Nç–,
-.%<@ ÉbX
ò¾ù¼F:±qí’LOŒ
im>X,I½f:—¼;}O'?[Ü#</ú†­WVy¿qº;A�2ÑÃô6·{ë]ètõÆÀû›þQ;-sæ:«íW¸cM:,4y¡�kSƒŒ¾<ÌÜݯâÅS¨Ù
-ïe†òsÿ²L]†ý™ÿ®¿Â+Í@êÛ¾Kü7gÜbNq˜Ÿx»r6T§†ñ,•·[ŠÞú®dnkJ4Æ
½éGû¶c
o¹ù/rËÅ,f=ÍX¯
-—`Ïæ–ûMÛ‚Y€ðj"dÉ^¤Sêl-%Ä’{}¶µ�žKëùMwä»íiò.=¹Ïžx+{T'LÑ
t³ÑþaÙ¡¬ŸôU�±WõMÎ/J83°%ýª+ºzæÍ_©¢(÷ËÈe<íéjN5ù…G#lnÕg€ý‹
-‘pšR^Í°Ú+øt,Òr »Œœû#Ñ“‚~´”Šz5eûÎ+qbYß­	.M椨š÷9
>z+ÙÒ‘c¬õÎÐâšStzÃq)uu“WšW7ØŸâÓÔé’¨�ëH•ïŽ°Ó×}PÏÚÒ�%§S¨7Û.êOò¼ÑöŽ:Ñá]©Ø…jé¼übs±åm`ÝúìÝOò>þ
ÑÈ‹ô»�k•12û¢ýpOØñ–¼cuG N-óæ]õ2ú
׫B³¼0®Ó©MoAG“ÙÔÇÌÝ]Ì“Ðk�U
yeótÚ½³7pn#Adk";†ÊMOËîk]\8°…Æ@ï§
 ém�¦�jÕÓˆ¼�îxýŽÑ\y­ëü:ØÎe’C$¦z)s³È´Èú:4}Ö¥§�Úú3©Ÿµ{1)NÏ�†Ú•åÙDúüN÷|ÈÚë˜dT\¼x¯ñÎ2Ä%¾ót{‡ŽIßðm«-n3\oZ¢zf3¨ÁÀ©Ì1
ÄÜï{±Ð$�(eõÃáMâñ
-"ÇZz‹ÉZáÜc“ç_éB|/iJíÊH·	AçnÏANÒ(‚´+¿n_»òæFõÖ6ÑÔ2<
˦È^?KfÕ…õï4(|ïÙøŒ¢iäûZ×Ò´’Ôìw]5–²áö!	»ä‡&ófjN)Ëö�x®/z“ç„'UΟppv¦]W›9ÔeÓ1êfi
-­P•¦C¨ð-a÷¬ójHhÀãÈŒŠŒðÅ–7€¿‘OÉÿÐy×Ð)L{Ìœ¨èg®á¦û
•�Ñ#½#$eÃæ¤è3KcEþnnYœ†@XE®4ÖgË‚ö+HB$£·=ù€A·œµ´Ù$UFEp)Øt ¼#=Y•¦u0W™vƒ\Ãu£àÖNJJíƒb
-\Žúñb£¼ÿ‡&fCñ
-©wf)“¡JïÏšiv»ÚüêK:ÚüÉvv©šŽÒAž¤	M­Òræ’µˆ
-î+<)þùGÔÙȘãbœÈ¨IbGâaì´£+is_G0QÝìý¸‡ßy#]2Y&AÒxoï¨ÖÏÚ#ã‚X…U㩺öùF;óR—88¿ÖßAy¤Ü¹ÉòÍ$Y�í^IÞ
-…¦ß[å×r`ÕSKâDø�jiÆ¢º3NÄîOm‡úMhî6ŸõDÜ;ÏÃ^V�- y9¯@‰'5‘¨Ðè7ÄFíßÆå”BÓá—,†Gqäeoèš›Ó÷¶µ4£® J!Þ¼À«®xK"ác¨tÿkå¦Øåõ}Ÿö©
 ‹_
-�”°+ÊØöÿ�`ûS�:KhÖϤfÊúwà¼0�²RõŽXÇ­bÛ£=á{_;X®/L$Ͷ…0Î=o3_5ý
-´Êûð)ŠQl Â‰Ëo;›ò¬³Mp
è�<d·jøîÇ>nÝÈ…¥°ØM«(EæêÓHSÆH+†|ÒæG!ëÙ["m¸OU×¹.ï·ä^‘á†Èš:ÙÑ©J窘O–œ»lð~GúÅÙ½Û­µÇLRH[L(e}©*‡wGJ‹ m²«i÷S¸`q„t<IêwØØžµ9Ÿªù,;±UÒ‘I&X'X|s2„e	+�=¬¬¼¬Ž7=>=�âõæœF—shÏ(²(Oe¦²Õǯ
-ÕçaΗŒ3SxÃïéšßOc:û~�NBÒÜ.%Qò¡Æ[즉}’åÉäÐéŒ,IÚ˜f�@úÚˆð­�Þ»gX¤ì]ñÆ·‚ÚþhŸ´re»§gB„¾�û.¹Ôøâ•#’¹½Z¦X•ÑoI[Ph¾ãô4A3¿­JLðïDuõÝïEs«
Ì–µŸ7í;èTÚ˜òÞ+êò/¼4½üå{†–åx™Sy€ŠÚ{¯Òµ1ÇëóÈ ×ðÑFI=p
k51»i¬¯Ž>ìÊ$k,½}2åzPkq+HÝòöSÕwnÛª}¶¸°5­U¯¢é’Œ¡ðvÜžw
K.aACsQ�Òœ,…ýj\„åÚ
¦.©
0—Lœe³m\gSÅrm1aç÷ÖâóJ’Ýqª§ÅºÃó|8ýFnáßRÑx©(˜p/E77ûØ)FC[µÔöÒÜyK™ÑÙ·5(¹þ—?´ÿOðÿ�…=äâæè
+xÚíteTœí’-îîNÜ%¸{‚»k
4ÒXãîîÜ� Áƒ÷
+t
+rvuzñp|Á^ÈÔ�Ü n–®`g(à%«º¬üßuBm�Ð?¹ÝÀ/0ÀÉúÅÓÊÉÒýOKa/4/(†¸
  /èŸ\ €ØÍÙ
èý’û…ÌÙüWîn`ˆÍ?+`¸‚l€®V 7·šî?·óÏ>
ÿ¥{ ³³ƒ÷_ÑNyýg
`¨ÈÁš�›ç%§%ô%·
‚ÆùgX ÖN
+:‚¼ÿ›ÀuÔý]ìðý+¬
+äê
+°|טHØ…Óƒ×PrxÄ�ºsÍ8862<ÔsŽØ÷�œ5?•^Ä
“!6È%Ÿ\ÂP§Æ7šuîÃ.uB_J
?ÏúTþ.=Œh28s¾ºPÃQGû‚? +ß/WI
+;‚Ÿ­û¬’»SU*rUO(|ðþï~«m¯ÿÊk�ûõ”ódS
ê܉5I&Ù‘­J
z &WÒpŸø
ºÇÿÈ+�cr¾Mo»À8„<¶o˜:b;ö!ÖöãUÿá UìœÓÞ7=ïQ”|ôh‡Š�xÓaŸœS…~v¢Ñ>ɼ{,O뢹Ž‡D¯ÈõM·*_Ö}¢õ$&ˆ\¤h…*Úe�[gÈ}üæ#K'ÙY•§Ì¾©l•+‚â‹ãº�<WŸ^ð}ÕÍsÖŒ^0L�ùª©f'T
+Ý2<Y±A‡nÉã§fHç·Pòè=Þ¯%˜)2w¥³3›ôh®™¿[÷%u9Ž&â>I›"¨8®¢iñH]® .â³IgË$ ÌÞìè¨Á±•Ìˆ×3F$èóþ±:ˆžGÚ¹,nÖû¹4‹Šx9€Š?Í‚ÉH}½áwskŒ$Ê=�ü1ïfòw…�¸…3
+#®Ð‚K½!ß…—-ÿ—Z³.•ˆzdÉ~ÖÓ�0&·fžïMQ_ò‘½{JM¹]ÁÚ7bþ~”Á.«sB4g
+Ë“›V2báJÄíŽÃá4k£„kܽx:exÆ墖¤ß>$æ¥×¾ÿž³gѲC‘6)õ
|{ýn÷ô~ú®��áë”$%žEw­¿‚áLxÒÊ�<¿¨7åAð�£?Œy¶\«Ì´³qwß}¼}¼Ziév�63;íªÔWc~ûô Dqz˜´ˆ
ÏrÔ´N²¥Šêsßa)QØ
+Æ=�Ûw…gúѺà6"€«ØXiø-ðgE:
+A["Ïb—�#='%}BY4óK`5·GßmD.•ÿarI/iT,Þ,[Z©}k“^M"‡'*øÆðú�åŠQòП_ÕWf/O¨úO^;zåô5¡qž.,Ù)úm—#É;=ØÜKIé·…s¯Æ‚w7ÍÙ€IÍ�­ÂÊ÷;ØÅ~žÒ³×Ÿ}b¿P`žÚUÅÑ	Ú,?œP<%F}v«ik>6Í’D¬Ÿ‰ÿåÄݨé<pOÇ•¢j7†>ì§CœˆÁy֓Ŭî’kŽÇbÌ=s´½w-+çùÚâ:
7{\h#¦Ú`¬ç¿4©��‰Ñµ�ê^�ÿ±×ï½Xøw¾l~ÉwÃüË|[DxÚóªZ7�¥ÇÍO©ì©zí¨ŸjVVcÈ-XÐõ‘Ê•ÓõL…X5=€švÔ9qZA]·àÇùR„!�¯ç'ø›“dYªõöÑà‰¶[$uÅz³-.*óÃ2”XmÍÙSÎ~" lœÂƃXfÎ%C킲!¤æ³åQv_EŒar¬é'µòSÙ®.ÜÁ±üZqž2óã¹»qÍÝò±aT‡Ëï[3íížBÙ1Õì*{<£Í´q.‹êŒÉ`jÛ�P’õ
R°¦Çk‰UK+ú�Ó@pWjaÝVçoC×õ:„÷-dr¬M³
+…š)ZP~§‘²GÆw¶:è6‹%ïHkxš*òšç$z¥‚²'Ku†Y<Z(Ý0c\1ÎWmNæ'Ÿ_Ñ9±þZÄf¬ïÖ7ã>ê7꣇®ÁÂY€kìÁ˜¬®·V'£9Àt#úGB-6�ûÉ7š‡FÈbfd½ß´‘Ϩ[¹ØUóàçÃ{k8
§¼9ùò>dDî"^W/艞hq«¼ŽD$j³Ȱ#²§Ýâ_‡£u¼á$=Wx„i\/O/b“íªíPœõ.§K©¯Š³Ö
+vèfÆŒ²§²V	äLÕu £=«µÆ0åQ
h0ÞÆjâKw¿Œi
+ÕÈo‰‹™ãÚ“Vt+%Æê
Ò0jtƒŠ!H”œæi†BôwíqßÌŠÛt5ÇYeC¤ùÉ¡ëYVPu9¹u6rOSåº÷”¥ÆÞŒð™ºøe‹b»oð¢1j¾SÑØ”×i!#a�®MÒ:4Fô–la4¬ªûïÑÚ"RwV~_ÈxΣGì?~(ú²oU
+ùÌÉg¼¿Ž>º§
V‘ŒéÙèðýö…5”ÌËíîFöÀƒLáÎdº6g‡­ï.üÎ2Á5¥7¹T§¯hj„þÎù¹Ó>"ÆÈeûÛ’õ
"Î3‰Ý}1¸áb“šÅ-‡â�EŽÑAOÑ>Οdo	e¥¿´vÖ”œú­µ‰,ƒ/Dr£á…©ôRx_=ÜàµíŒ
Cöo-P¡“dà˜‡S:’%ÎŒ¾6Ÿ‡'ð¿µq
+³ßk9ø‡jÕÖ—'è Á̹5�Ü�ue§wº—ÚWÚü#FÁ²°h»U�Ú¯ÈDçC²¯LX£	#VKÔââ•å:Ã$ßÞx!jCZJ`6¥æå6íÔì|h1e§,p¶Ý«GRñ™¯­7î`­T„c�XŠ„³ŒK�«o
|sg>â>uªp¹™Z¬¿ïÏÃ+Çío@<´En�…sÓf…ë~›¤â*ÿ
;ÐSsÇô}=3ûpãzö,¨”VYqI0ÙûÝs¦â[m† ìi6ÕhC9m7Ÿš�I»‹ñÓéïgEOöDVûêwYj%ÖQu4´ñ=ˆ\|ãUWìÕ›F1a)^�BûKÁJxȤå8ï#çç–½RZQÏ~ÁDøLAZA<Mg‹O÷EiÇ
×ǹ0�Äx…&®I³”÷å
ÀxfN/<	²
+
+CÍŠHV†*t2GÂØþG³ìŠ
mÜ
ZxGe·bîBáÙãÃù»‹çRבb�’Œh¤9W¸–øTgR¸Ì(”ø¡5kºà›É¤¹µùÛ�bþï¶-Ê~˜;”7ÑmÆ
^T˜‹vÐí­&•3özÑ/JÁŽˆ¹ËM6¼�ÑH*­›Š=Hœ¶CPHÅÔª’.UJòûõÆP©ãËŒ
++ìöù[Õ2š
+ÒñW:N<YÖ]k!+1vÄDÞQ÷):âïn#þn-‘zªÞ´Yª½åS<¸úp"Tíª˜òÁY(×!WÊ‘Üç�´åXÑåbÏ�QŸïPb
v¦]ŽÖÁ\¨+=cÄâ~ê¤}·‘í"²O†ÕoS—™×Š£6îHNdΣJõøœßébž»…í§¶E€>F1R„§ŽÎ)}ß0
+í>Ö‰†­õçl?ë&ú]Æ�Ù-Á'†â¤ª?…²Ò0$¸	iú]÷
·ñ‘™ì-Ëö’]
ç¼w¹8Óœ¦aé•«S¼Û¦;èò#.	ãm^kZ_
�†Žg#(¢X¥ò“º�·ŸA¬Ö›"ÓŠ‚Kæ³buëK¿ªwöVåÞ#§-÷Ü�@VM<˜ÖÊi7´Â£„-v'�È,ÜbtL%!5--IŽ»W¾l‹ºbÂÝ{dÞ™áð0Œ¤\ÏR׳?½z�}:CZÏÒþG÷ä­¬þ±Ï›pÈ:§lÈ8ÕQµ1íåðaòj/‰±m¡HMlê—ç,Ú#cl•ãZÀ„´]äI~›]O踑ơ|Gàjz“šÊ,ûckÇ$±	ZäÐù+†´Í?‘Ja#ñü/ÛùÁ|ìJ§Ü.̤pPë&ƒã—)¼Ái¤UøJÛÁöSùOq†eT¨
+=èŽ
íóÀ„>zß�¹‚¶ìüœNžé¸i+h:“¶’IðWþjQæMýò©†4�#{µ8�<Ô2Ì^þ¯™ZçóF—o£ã¤[¯Ÿ&l´-æ„ÆÉ„l^»ì#K,yaÂÓŠ	ô-®�k‰<�+ꩯïƒ,ƒÅSÂÊ°&£�²¹í�jXºEéÆŠ™8?%ùŠ4<7K[_"Ú•vŽ³Fk“¨ÝÏaMY§!‘ÉšS·“7¤4,­,ï2Í¿¾pæ×rGð?òåi%h¬ÒÉ´UÐ5ñýq5Ò8¦ »=¬óÙWÑù0YL \-síaœ3;Ù„%ñÐwæœ~ðbE†dUÁ&ö	½D"ë}‹ëI§«‡AªS‰<ç'Âo'rX.®!oö>QÇp~R¡/~™©�Ü\?ý-3³Àö„¾¥ãÙaÙ0�Ú“5ÅpÎ1¥¬¦¢1Ú®¾S$Ë5&fy¦´vZC_p|ÐÒä
+P€{�åN¢4­DŸÌ5ßv‹ ë
+ãR×uÓëM>«YVB°éHŠdŽÈÙf?+ð6±§}1º,B-¤Ylùö®sJÏwŠ:—(Ëë·‚ÁÑ!
+™P9ʃ�ëu²‡2†F
ƒbtnh–!jTV>Ì×A}ŸÁt=Lo–Ä¢Ë9þòVôª_eá½ÌP~Îà_V©Ë°?SâßõWx¥J}Ûw�ÿæ‚[Ì)"óó
+ðÈÅžŒ
/)÷±^&·Ò�L#0¢8yX¼ÀI¤¦žX½;ys1iUü3/ç
+ʊО=ô
+k…H8M)¯‰fXý|:i¹²»&Œœû#Ñ“‚6~´”ªF5eûÎ+qbYß­	.-椨š÷9
>ú+ÙÒ‘c¬õ`ÎÐâšStz£q)

Ó7šW7ØŸâÓ4è’¨�ëHUÓ×}PÏÚÒ�%§S¨7Û.êOò¼ÑöŽ:Ñáݨ؅jé¼übs±åma¡}î'yŸ?ÿ†‹häEúÝǵÊ™}Qƒ~¸'ªÜñ–¼cuG N=óæ]õ2ú
׫Bó¼0®Ó©M]oA'ÓÙÔÇÌÝ]Ì“Ðk�U
y‹tÚ½³7–pБ ²5‘#•¦§e÷µ..ØBeïç
eÒÛ -Cµ<ª§yC½ñúã
¸òZ·ùu�½1Ê$ÿ†HLõRæf‘Y½2ëëÐôYמ6j›Ï¤~6îEĤ88=wšêWVgéó;Ýó!k¯c`f8�ýQqñJà½Æ;Ë—øn,Ò;n$}÷­·Le¸Íq½iYˆvè-™Íe †§2Ç4`¿DìÅBÓ@¢”Õ‡o´ˆKÄP1ùƒƒ†×‘àLÒ$5œæj—ð$‹Uë%&¼;¸û?åH£€h Š*{df”÷xuFYãîVÌ’‰Å0L´§Ë1]�*EBìYT=ò¶ˆRZ†Â
+|)Ž¯âðœl\H˜ÝIC>–ù‡»…R©-/	ã–‡%Ü©Ù̺žÖ{ªûN�{o6]”½óÚ#X1P™f`EŽ²=Ã(H¬ûO=CšÛw“ÑKÖß”s÷Ó“Ú�7ª‰]ì„k+óJçmô/Ö
³ôCû™)¸¦ñç‡ÝL*ØúÃ/:;<±á4Ó$Bo:€+?ÅÂìd/\:¢N/ØDR�“à~«�ù²¹á5LÑí©ÆÏÞw9‡ù¡þ Pz«×jQ
+s½vI½6Få½=QZ&Iª r¬­¿˜¬Î=6yþ•.Ä÷’¦Ô¾Œt›x}Zp–F¤]ùuãôÚ�77ª/°¶‰ž –áiX6EöúY2«.̸§Aá{ÏƧ`-cß×zV¶À•¤f¿ëª±”
ÿ°IØ%?´˜7SsJY¶Äs}ÑŸ<'<±¬rù„ƒ³3í¶ÚÌ¡!›öˆÁP7KûC:A�iz¤öö˜ýSñð~ºrúsÏQY¾ƒ‚Š/ýthÊÕÔ±8‚Q-_:¥¶L+€6*£Ý0r’¡œ±ëDäª:✇'à
g‚Ç×T[‘–m\ù„|-9ÝÙ%¯e?µ�•Ñ¸;ªø·•âìO¤»Ÿõèó<êÈ|ô¡¹ÛÛ6b•œšÄjijÇP`÷f›¯zcÙŸMÛ¼Ê	À‘[Œ}_|.ýÐä‡O•_‡Ìc–¼ûUݹ
‚oŸ–?‡@2u_{¶¢j¤ÉÊÂäk
!"¿{&ŒÍ•©ê6Æ›¢sgŸeœ™øjº=‹Èp³ªCigæõ”õˆ®Æ³?Ú¸z
ãûQïÓ\µêžëc{Ï( [ZHº¬‹éÎgð-ÆÅ
ïâ+ë¶æªõÜäï|õœJý�Èm£ÐJ
Uiª1„
+ßvÏ:¯†„6
+ÍDãw§¸°:Mý
²qù.ûþGõ&‹F:ê1΃Ю,%†·¯(µL{vf‚¦ç¹(�@´šdqˆ2onnôþ�7ëc©�„¿cì•î®úŽ¢Z^ÿ)Óax3'�µ¹Ÿ‚e>u¿mðs§¤ü牥+
+ª³èì:œD^U3Œ»º÷ÅðRîfE$¥¤…~;,º-YvÎ$àu™‘·¬Áú[“l �°Â°a7ÛÙ%w¬Û‚ÕWnî<Øíl¥»õ"YA~FÚå	âDëþôa’–H��¸‚óU
+@üY¬öÌ_{½õN‡Ù$åÇ7ѯVxàK9>:t|3QëØñ¦É?ð?ÍÌà\6ú³_+¿¥§ÀÆ4…çf¼lŠl”0Ât|Lòâ÷0ÌA«œ�ê–¹¢D fhtV",µÊK3óÅ
.IÄÕ x0>›µ@²åliØd‘žqÔö5£3=@ß2œï’XÏ·‹|B
•ÃT«õÄ8×AþwbCƒÙlÕÏ¿‘*>Œ¸¼—Ôb_i'TOHÙûÝéÊɆ}3®Ñôn×…wÍ…Dˆa@FÐz<ýkd?]‰ ¤Ë‚h8à[b�úÖIî£åƒ0
!Öú¶UŒßëÓö:vtÏê<­'ºb²/gH¯Æp3.Þ¯.µÐõPµ�ê>µ¼ˆÅ½®zò-Ù2#Êle°<Z¿–0†CšbƒxoàFÄÁ£�Ý^–Gž¼!÷›¾ñRhb»pÛC«¶6ò�¼)P‹)Nö¤Øß^�a¦rüH€þ3ü˜|j›Æ­¹<rÅ{zRSŨ ¼¥ð­_NO�Á
¿�Õ°Ã×sÚ稭…[?K4a9J)&´ÈðÔ>§æK‘�­t‰tîîÉõ½3cc‚	-s²µäéEô¤³Ÿñ nhR¡×¨a/ŸÎü{
+À/6ñü>pF‡)Ö“‡Q÷Ïõ·om1ùÞ^Nˆ–­Žz±�5Ÿ~ÜÉzŸŸ¨»~^ªì®�—Ö7\JTÂS!õÎ<e2TéýY3#ÍnW›_}	AGC›?Ù.Ã.UÂBÓQ:Г4¡©UZÎB²QÁ}c…G Å?ÿˆ:s\ŒY‚5IìH<Œ�vt%mîë&*ÔÁ�{ø�·r¤k&Ë$PïíÕZâY{dA«°Z<•@÷Ï>ßh^êG—×;(��”;7Y¾¢™$ë±Ý+ÉÊ_`åuPèýQYð·õâE¼sÎ	[‡71Jš³VjÆ-ýô
ÕæÓ°QñdNk{VßH–œyåv	ŽÁØ›MÖ)3Û†þžÔ+wݘY­’Á¦>K;m¼kxó¡øxdGò�{çDþ•Ox§WJ½(ÎçöÏŸ°Îáu3ÊäkŽ›¤ÞÓ¨öUŒ1‡å
�ÜçcŒà¸ò UÀ/ˆ�¶Têëµ±¹ˆÈ5W×±#àìJªÕ–Þ
+Tßl_µ›ëb+eÊ¡ýºž�MDÁ¸ß7 ”¶cœå¸X®7�ݽ›™7t¤Ý«‹Ù“ãS+I4f=Öçâ\™Fƒœ^­‹ñòðIö˜B¡é÷VýµXõÔ’8~ Vš±¨á‚±ûSDZ~’»�Ág3÷Îó°—Us†C[Ù¢œW Ä“šHThôb£«ÎoŠrJ!KŒéðK££8ò²7t
ÍÍé{ÛÚZQW¥o^å«®x+"ácˆ#dÿkå¦Øåõ}ŸÎ©! ‹_
+�”°+ÊØöÿ�`ûS�KhÖϤfÊúw ¼0ݲR�ŽXU§­b»£=á{_{X®/L$šÍv…0.=o3_5ý
+ÕçaΗŒ3SxÃïéšßOs:û~�NBÜÜ.%Qò¡Æ[즉}’åÉôÐéŒ,IÚ„f�@úÚ˜ð­�þ»X¤ì]ñÆ·‚:þhŸ´se»§gB„¾�û.¹Öøâ•#’A_­+§X•ÑoI[Rh½ãô4E³¸­JLðïDuõÝ™ìEs«Ì—už7:èTÛ˜òÞ+êñ/¾4»üå{†–åt™Sy€ŠÚ{¯Úµ1ÇëóÈ ×ðÑVI#p
k51»i¬¯Ž>ìÊ4k,½}2årPky+HÝòöSÕwn»ª}¶¸°5­U¯¢é’L ðöÜžw
K®aACsQ�Òœ,…ýê\–„å:
f®©
0—Lœe³m\gSÅrm1aç÷6âóJ’Ýqj§ÅzÃó|8ýÆÐðo©h<�TL¸—¢››}죡­Úê{iî¼¥Ìèì…Ûš”\ÿËÚÿ'ø‚ÀÒ
t…:9]íÑþ†w–}endstream
 endobj
 962 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 34
 /LastChar 122
-/Widths 1928 0 R
-/BaseFont /LNUYTJ+NimbusMonL-ReguObli
+/Widths 1937 0 R
+/BaseFont /VYFYRB+NimbusMonL-ReguObli
 /FontDescriptor 960 0 R
 >> endobj
 960 0 obj <<
 /Ascent 625
 /CapHeight 557
 /Descent -147
-/FontName /LNUYTJ+NimbusMonL-ReguObli
+/FontName /VYFYRB+NimbusMonL-ReguObli
 /ItalicAngle -12
 /StemV 43
 /XHeight 426
@@ -8851,97 +8896,112 @@ endobj
 /CharSet (/quotedbl/numbersign/parenleft/parenright/plus/hyphen/period/colon/B/C/D/F/N/O/R/T/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z)
 /FontFile 961 0 R
 >> endobj
-1928 0 obj
+1937 0 obj
 [600 600 0 0 0 0 600 600 0 600 0 600 600 0 0 0 0 0 0 0 0 0 0 0 600 0 0 0 0 0 0 0 600 600 600 0 600 0 0 0 0 0 0 0 600 600 0 0 600 0 600 0 0 0 0 0 0 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 884 0 obj <<
 /Length1 1606
-/Length2 16237
+/Length2 16371
 /Length3 532
-/Length 17113     
-/Filter /FlateDecode
->>
-stream
-xÚ¬¶ct§_Ó%œ¤cÛøŶmÛ¶mÛ¶�Ží¤£N:¶mÛvòöÿ¾gæ™u¿óiæùp­u�ª:»vÕ®sÖ!%TP¦4±72³·s¡e¤càÈYÚ¹:ËÚÛÉÐ
-ÙÛ˜
-"bÿæébaèòOngË¿n€½ÙßH{c×Jú—ï/Ì_¯‹¡¥�3ÀÅÔÃåŸ\F¦
-IŒ‡1†
-	í:Œ}V
-T§:jâV6ðë>z1ZVª=à
šì™ÓvÓFÑÐ54½ú!§�¶å9A6P0ð®+MG¼bê¢Y‘ßçGa�ƒæ¶ËV­c3çY?â!_¸Ù
þZk
-ÍdÖC÷Á1Ðò“#MH}:²ad†ßêÆ“5½F•çJgbqà&§¾ù4ãèØHûù”ƒyÆ<˜^ÙÎ/ÓnÉçË,³t?P“©†œê!(‡n'¼|HøúøÁ“fQ"Žë3ã²ø½6<‚QÇ?#^vyì„Q!³P¶9aíˆPJM”–Õý´ø5mœ
-�ÄGìÏÌOÍ!ö®p¥æh-	
Ìp	d‘ÕÌê0Å‘N\dǬþsÐòa[” ##ŽW”å$�‘ŒªàãFAžiXã»â�Ï4ÃÂÕüàm÷àÚ(3Ÿ)qŒ_0\¨�pZ
#rûº\ÊF/�¿«·¹Wë08÷nQ±¬,RjU‡"vÈ—7ùB7ôy¯GJfô[ˆì¥/·“ÂC
-†ØŒÌHÜ—�`¢o(8äÉJàÕª££ðèÚ>¡YÒ{§žæ¾òfƒ†/’€môú¤»AËý`˜
-q;w¾æûD"'š0@=÷a#èQÏ÷ç«î³¿k^G6ÊP ó'9TʤŽ!è§ËéסT;éîŠjè¦~C
OÃúHm~Ë.!H!§[8=f÷‹âƒ|ÝtÛ²��È€ú!"L7wðÍV¦Jq˜œT#pÊw„áËàçýÚ@ZRÏÇ&—~¿w
-
bÛŸ=ÆMF"PÆ�‹C×™‰X1±
-AUä]<·õ—™ñÉ*1EQðÎ!A&åÔ@x*aÛ 99¬®
-
8"T¾ «¥Ìˬx"-Ô¦[ð=@%ê⨹µAÇ!øÑ=wàûàÄÔ‹î3ížl4íõ¾s3&ê�š)\l^ÒÌÄšÍQõlëŒoúÞƒ´m9EMé`:Áóñ8ÕÇ7d@8‚f¸Òá`
-ì�Ÿ–
-Z€«¬_Žˆ9¶Nž9l Ú:Î\zäÏYÑ�Ž>}8êÕ:¬ÆJywkPÃíñÖ¸ÛJt�Çlɬº‘;H•"@ë]P•½ƒ¼+æ%0)¨–úKÎ3á¯>KAÍHjú…L’Ÿ[ŸÞKI-?<š	ØQAŸ@éÛ™
-be2d5ÚÜÃ%Ìœ�&Ø9«a7\Ô¦ï†F#Â#ÂìÑò#f¸E庲¨NÈ<ê¤yÈ(¢õ
œjŸZ^á&#Ø
-•¤§q^Ñ+�!d®g¬~3ûužíNO=³“Øý.�E²ª%UâÊ1Ô¬}+lF†�b
~ö°�®–V¥Þ;ç£]£ÕKï o-K�‡_JO«×<G«ºøõªA%ÉÙx¥³ºVšÈÀöáÅoˆ{YæTA”…Áø"ý5TŸnH®om"ˆ–Œ-Ç:Æ#Wj¥G]§îHJ,¨Å14Ü×X2j®éP„
ðÐ0t–›G'3¥PšS/—]†"ÃdC·2|¼ÛC»ú˜8¥ŒêKÂ&ØHHU„.×I²ä’ùZAøý9‘ÍP&FÞù˜•Ü+Œz-«Žèc¬Vd½xP!Öœ-lÌw«5¹6‹yZÄX]½!­_68T�_̧–K*)Ü•\€ þ�gŽï)—°t
�5DBv¿, UÂo·P‡Üô*¢�€\o�z.;~ATyš#^ìs·]ÔUû(\’$D÷¸%ó»LeU™¶†þ�X•ùÈJ£j}kEOž^–d˜°ØÕ¶2"ÿ",£Då“pSì c;ûÏjr[­�Vq?p úB!µ÷픞„�œ{b?eV)”Õç‹Ÿ³âô7Ë÷—*ï„=„ÜBZïH_SHbűõ�“O2æU®‘¿
-ƒ�+”{¾ÊôóóÜ–oã<�j=`Seƒ
-àLÿCîCÒê¸wCŠYøqxþ:Üzø65|Yúö ½uYN²Æp¿ý"SëPy!W8½¤¡ÐWzFµ?¢V¢²ŠËHí’qn1Ux`	º(9žì7¿P…óU@U¦6—z
-xa™ëi†µ'°'cÏæ͆�Ñ’Ãxt }EjR—ᔚöc’ËÎ(ë‡Ñ#ÔI]†kÑ›(‘…,·�:®þ&q{iIÿHR[”ÅO—ÛÒßc,n7!Úhœè”>}yä¥GöÐ
-Â=ŠÚÅ׉_ó/7——1»—¬û¦£K`«¨àrøY±|Gõ`È=ÃÖápDÏŇ`™ Ý’(ÌZ“ Röâ.¨ñ”“¬Ù’ŒZ 	eR:Ž™Ÿñs͉æ„DuaïkÕOSA`«Ñó�uÎÝU'VAŸý^RõÂly�ÄspèÈ^4ô—�Ó$¥?ÝÛõ„$x¼@§å�ËÇÅÛoÔ$Z\—¬O„Z]È\(‚u
-8-y¨u'ö8÷ó\9b€Btï1³‰+/áu?ÌeóBjŸ(³ÂMEAé¬%»…> :þ
-aÍ×#êT/ãÜp·$3x»f'Óc;‚“Zà�Cq‹4:-žørf›B!èè‰<2©ÄP¶¿°wFôŽ.¨S:=<o(vY\×ø]l 6ÃÜX2ÌçJÕºûë:ƒ €˜LôÁ‡×V•GÒËôaq!´ÏU¹"õ‚WÕ§³o®Ç¦ ’êZæf3@¼eŽY{á>ØܹDñF-M0î’s%
-ÑÁQ|®gšnîòøÃ>_adÿæþ©£ñ!Îò¦_ 'Á™Œž$\­	ÌÓÞbHz¹×szrP'ðÌïã];7wÿ]@Ë/c™&ïÑj©ØMËùgº ˆàRŠ*6?á<Q±¿h9“µ›PåÀª;g¼¿W�e�ø§eî¥Åu¸<Å]f†ß½ÒÅ{üÚEG2kI2’‰aªˆûÃ
ׂ^µñ2€Ž¾‚ºeT�R.™ã·”sÉ„5šT“ÃpÏ	ÆJa¦s#
-ª
-ˆ¤ÅúÀÌ^wrËMb�vÖºQv¸”ÀÕM€’û•}«9»\û®­µñ¶hý(t
=�Ð!yØôѼèãL[±I–ºîîfÖ ÷k6«6Ü´‚W·
-ú4.Q¶É;X¸%ÝC³‹£w1¹G[è£ëWc/hl·÷­-Ò
2[Ÿï«+Çë9?èAaOc·t�o1b
-'úrxxÅ¡®bâò¡¶(»�EìæF‘ÚòQ2Ž'™'y•Û%
-]L­÷ú0bK„‡‡sMßTÕw÷ˆž7ÛÄ1�Mˆ2çµZ¶‹h/+׃ùgo•Þ#(úyék)@;4ð•ôò,zfM?H€H€Q,Cw9ø€†¯Æm·;8^vWâ×g×Õg*¶v£2ãˆ~½s
-:ï5€.X¯N¡Cx™kãºÇ6°=T¯6d‰;͇W.‚ìeœ1Gx²MÕkÍÇ~¶]
-ÉѨzJ±[س¡£•ûLç}Ÿ’8QŸ†žèóÇ8ç°ŠÁIZ‡6§¡Ã¾¤ŽÝCkÀ.`ƒ�\oàZÌZkif»?“䀅x`mH;ÐÒSVÅÁ°¸€ÈØ%à’ŒLN•ÿQ»Ž>19½)içíö	q€ú#ó¸adã|-‘³÷ $ç¹%@»µÒó³g�x«
ÖŽ¾—©ý$œ.¹gL<§ÍòÕõñ7bƒS¢£éj%;"Á2k)à"ÿx×9=FY‡ŸwjçJ’�
R�ö‹$›¿a,~LoÇôÚ«Ñäå³8Y}òç¢I6E�ÁÑ«ÿ¨œUX¬ÍÂ\>
HnŠNß–YÁ ðV
-t/˜~ü;™�nCÌ’}8êÂ)(Û8·ñËq]>\=n;‘:NœÞãË2hk]yt5Ï2NŠºœ¹ìI*œšuÚ D.²QQD‹°•6c8r…*Øê	Í
-ÉJ2kç¤%o72mÝIËKèo5š�n$éÒŠY~èp™î/íy\mT§ë4çN²jÆjKSO}Óé†6Ñ
gô]æÉ•\Gu²Ô2%LzI|’µ–ʽ۳:½TÇÔõöãOA©!
·\x,{"ÌF‘Ýwz§ÇY2­Îž•OdçÊúÎ`/â•<Á³Û9ˆÖˆH!‹¾Ó„ˆv�Ž–,ÕõMÄ[ñ«
Ïõ^‘9¹Õ3Nr‘17'rùJÒ¢î•"bPŒÆ(#é˜�ÛSˆËZZƒ•õuÄþà35<¥¥½::ãÞ‡
�®™!‚oš”,~�"‚\Õ
U¿{’áYAäÌ(q«Í€Š�µf­Ágß‘ãÓÅ:%§££ð¨±ræ'ô*"
-Sdü=zÔýKò*<gÙ e
-ä’
-t�mQbà¯mq™‹Ó™Ãþ<}~µ[$ÌE(-$Â÷p¯¦Ãk"†½®"ÂÔÑóM¯r=PUÏ£<z`YOû€Ñ¶¡éœp¡.¼2#ëî=™j'Îgª±Ï†ÕP…êf
-ínø‡ç¨H,d10PP�
ñÌG7¼_dêÜšÃjSX[‡sò9–øî}J·tqü´óįö±jFˆ~å�^xíVî°¶+'žÔ�i¤‰Å>Œäç(–©N'Ù¦7ÍÌu<TF[•÷EÔf±ôÒðÑ¢­äj›Ü!|íó€t_ŸŒ&âɈ%Ðóm“õC#¸\!…øí…§kÃ+襴aÔÁd–ÈÀáFb�Çä‹ù­™7,jûJ<Îy|»£Ên§†“±S¸J[äA
°óc¸`tÈËu*ÉËšÇð)µßŒÒšŠz̤¨ï‘�Yq«@¡ôÒFó¤iIl.¼3� h뉵óØ}ü„qÓ~|lHþèDYYnCè&Ì´çAdúsÀíe*ª¤õ
--„xUdÛ¨û+õÇñ	Ñhå3MLÐ�Ìg•¼´æ´[Ðånd&N[I�³œ9u»Ž;h‚¦h	Ã&±v¤ðcý‚Æg[ÙÏ©R#*
-ñ¥ØDˆƒ¥™Pþh÷�ioi1ÂÿðïîÅíº”a¬M(añêâiùÃ
êÌ‹þîÜ0Æ«ŠÉ,zÃĵ:ûc
-‡ÓÕà¦^=µ®ãF–:%)Wmq
f`чÃyÜ©˜¯*Ò2|í~ð�µÜæf˜wÔªóŽ6‚ê¶SÖÞ¹†öJya×
-§[ªhÃàz\^-B}‹,�Kþý×nc�]O;EÎ�Ám±dé¹cxá˜g¸=%T]ãë÷�\†ƒ»jïÑÅðdêÅâºì´Z>»M4–‹ÎUìé´wâ; 0eÑ©€©KE*Ѽ—`0‘Êêk6_í„.‹6wVv>OÜ€@w¿‹Ê«ˆüŽnËé(Õä�^…õšjóFkƒ^Ù*® cJ#,ÆÆß“Û§FõçÆÅ¢Ê ôó¶‡aÞx’)ï
B'ƒ=Z°?é�uÊiŽ% 1~fÌ3Aù/A€NÖß
Bl‡wÜB+<{ÔÄŠ	€£iÝìG{K¿/è~¶ïõÄøìϥʰq˜X†bÝ>tÇ^hÜBÆ´½¾[â.1óÿb´$&ÄæEU¢láa/ëÔ tï˜Åpç7�/îEbØ…>	åÅ`YךŸ"3^›r¿ê‰Š;Ú�Q€µScÚï|Ö%Æûêæ%ÎÖ@äR›„L19ÒíQa[ˆb}[�2"¨œIÍžïš‰MÅîùÐÛ	Ïü.ùœ©e‡2yÇœóé(-å5Óü´�õö	´6¬±Ãþ<v‚sÖ£Ù¿1
-(led7)ÒÙsýœ¨p')ú¸ã]ž¾Îã»:N2àp6,Í×ê[®¿HÑÇn€R±PZ“Tª®¼Ø¡!Û$aìºï&Ĭ½oßlfS,åµ¢ÚxµÊ QœK;cå›@¤W?陉é�ÍBËzîrè&
’1i¶üžÅ…‘ŠI3w¨)§tÇœÅþ>Ú
™D;Ùäþºˆ_4×}‘ZQ%“›½™·]+ŒO‹àZâÃì&äÉ›Ã.²]ÝHŠöç˜ÉuÜPè95ÿ	�뢗ÁfDZbŠDl~r’nü%n†MmÂ7áC¢†æ‰‰b Msû¹(ŽãŒ¬--¿ò^Žö垌½ª»1”Ék^-ý•‹Dúft^t,¦£®ud˜'½ã0"©1oQòŠýAÕؽ6$-0,µy±ZdR3cÛ^„OKoÿ(r¯”Šµß‚¢ùe :3ĆԱhº¡³Œº:
-¤öÎ� "¦ýŽ :B;«ø&&c€'I”…Òn|]ãh¥ƒµ•
-%‘åwÕkïvm—wàpÇJ¹¾U	œ÷&“³�oP�1‘\œfr;Š|Y[âéÂn†ö¹ë°¾LTÁ¸Ÿ£d«ãÇ­!5ñ樹õS^¤X#Ûwô¨$c#Õp×RqE.84A•„�#ËPÆ4UÄ«SÚíÉ°ª\bÚô„ÑÑ`“ÇH­0åɹr,_QwæÖB“V
Ÿ4	O=“½´†?â;ežÞ¿(‡½
-7©¨�—.q`~K±
-¯3}â›ÛÉAj¸*óbŽ$k3VgzØOÜæ*PÛ=Idi)~*0vyÊ�î
-9ŽJ $W‚`ú­ýRÂ#Ëí"?æ’²†øo£qErl>í�Ïÿˆ!!(šÐ(ìÍ^÷H®²€Â#½7§”dËO€š>Äá}¿½8$�	4ûÝJ—ó^wÅý$-ZÇ;¯'ÉÔï{œU¡f
-Rs2$Ñ%º‹ë!n�ß%BÛ»C)uv÷'\ó&6Éu¨ë=Ôä:Æ	k‡z½ÌèœýU9S/ƒœþÀϨŠïw1~µ0D6Y+e»ø�ݼF‚z—P÷«údoÀ·
“T”,û«ðrJvº™‡ô¦ä‰_q ¸‰¸Oñ>Ëz0å™ð3ü™&UK&g&¥Ä²è÷˜‘[zÄ KR"áš…�Ê�Ž®è/¶ß~+˜àÔó†pJ§ã•<êw­òöViåhúyufRµÕ–4êåp\W a‚Ó\—B
-':o´ù]9>áÉ¡-Ö™)yãXp<âo_jð½äÂUZ帥þ06_VnO¨nórzcúî×Õ:L“5uþ¨8Ýi÷™¦»‚w®P€RJaa¨êé4
¯a²¿{LÑ™B”³è\@oE…Ð;çA‰
Èø,È+”qË�ájŒÂ¹’dV8G³}cÖÀdâæî‚^.ìÍûÚ�˜ÿà>*Õk …ÇÄx>2øµ•_&9¯!Æx˜ÙG"¼ï*“¹±ÌÝ»á‰V0�D)É¢‚k‹÷ž:å¯P4û
-Œ›?�yUGáõcç’£Ä%³¤™š€î°®÷�š�TYØô
-®V´:cMG	 ÏÌR\Y^( [#¶æÉù´*Ž|J¾¿µ°æêÇߎR/ð÷hïšý®dèÍß!HŨ¦µ—`èH�ÜÙ•õiÒ¥8Ÿ¢—"ƿ첈ïæÇ`é"¹º’ÆSð’ÞÈÏ–<$¸Î�â‰ã
-y#K×2ª®q1g¬›“‘-öæÙú݃ÓIÝFÍ×½Mx°<?ÑgýÆkµB-ÝNlr¥A¤M/šÅƒ¾Iµä;5
÷£,Ø¿W‰`ˆiÈäLJ©x’ ʪѾÓF/Gc à"Ç»_¹�,Ó¯+¢¸&lwsä`“ïS�&®ÖyGpˆ$9>O	cׇK2ºëAÆö¹Ì,b

šO)Ù˜•䪎ۖÜå×ïLlˆ¨¯Ø:
-:^fËër¡ó5‘ª‹�ê(foC;a'¥'Ô'pq84«Åq†‚iµ‡„
-¤¬™·yæN¡ÒÍ=Ñxhwí‡Ð¦-LêÅoR„µ ”3'ÅžŽ7vF£¼êb•r1uºÄ…›Ùaml³§W·áFIöõ»_ìß±#EÂp¯Î\R8ú�rî	,¸©n²o‰¨¡2V;�ëÃrÁÿßþî[gƶé¾ï—OžBË&í)Ü\ù#�ûÌÿ7õ|®æov·E|’ïÙ}…I%\ÜrŸø¥
7K¢ì´v,_Zµ¢e¥ÐŠÒyÛÕíŽ%_ÿœ÷ã�yìÍ2#íO¯Ö8_^{ñšÃÿ9ÊçC'±2]ØÓÔyÕáùÍ)Óç©X÷\�â~¡æô}Ù’—§Ëøb�y³Äó{K9ì™ül“íÙtß9³äí2Ë~ŸÏ�MÖYYzࢄ°TƒÎŸ8ë6‰B9ûdIF†Æ{úáª:OãÊ.,|©–u‰•Énãk“9u³3zX&jîû7WD‹ý î9�“fGÝÏòTNo½ª÷À’Ñž3(È'Pôè§b/©ˆóy§?nIËy¶ÚH©îš©ÖšÖæ-×¾$êMS|á*¹áö±k¬«¼+§Yå–óŸ}˜á·ÓÂ;œ¬ëönüÍ¢°i�òüêÕþ™6íŸLÂ6/èžµý±æc‰][K8–¾‰KQùiš¾ZnrKb]Ÿ:ß˃ü—ü¬²��´o\gl­V“Üèãë]šwó¹KÿM
“?
ÌÉ{EÝf3Ë…¼×Q©‘éÏÙ¼‚ýCÒR¥Èk_g-äM·´ÊQüµõ­öf
-
ר
ÀäœÔÄ¢’üÜÄ¢l.
+/Length 17252     
+/Filter /FlateDecode
+>>
+stream
+xÚ¬¸c”å_“%œ¶í¼iÛª´mÛ¶³Ò6+mÛÎJÛ¶ÍJ[oýŸgº{V¿ói¦?ܵ~'"ÎŽ±ãœuÖ%#RP¦4±72³·s¡c¢gäÈYÚ¹:ËÚÛÉÐ	ÙÛ˜
+–WД”PŠË©ÄMíL�m
+®F6–Æ
+…$ØVW˃÷æ¹)Àõá}@Jš2»œœ$~P–D™ˆ‡…:Nq©ó#5ßì"	󧈼ˆÎQ僶J–©Èµôc“Êç؉/Wñýê›X²˜HO÷|¬®-“[ÿƒn2ç¡‚÷`Œà�
õÉùKH}&¢~t–ßêÆ“-µZ•÷�ÎäÒàMV]ÓYÚñ‰‘06Îó'ˬy?‚²9¼oºÝ²Ï—YzÉA€&s5õC`ýnXÙ°ðõɃ
í’D,÷gÚUÑ{MX8“Ž_ZœìÊø)“bz�lS âz/ˆPr m¤–ÕýŒø86
]¬
++½ÄGL~Ö§æ0GW˜RS4Œ–¢V˜,ŠÈZzU¨âè(ŠcÆÀXÙˆ-jà±*ç+êJ"ÈhZåðIƒ ïŒ
œƒŠñ]Ñîç/µÜhà÷ šEh3ŸiqÌVHXn´Nx
-ÿQ9ƒ]ne£(‰ßU;<kµ˜\û·h8V)‡5ª#ñá»+[?C6õy‘®G‹gõ›ˆí¥¯vÂó†Ù�ÌHÝ—Q`£n(9åÉ‹Ôª†¢"ñéÛ>aXSû¦Ÿæ¿rçG.�môú¥»ÁÊ|a™
â¡^>#þ»ˆ^驵]M»qÁO>Z6Úl ¯=µ)¢_¬¾rÔ—!U;:±å$z2»?Ô?÷,|gP¨Ö:`Ì�G*p²Sí»Ï³œ.ÞJ;"8çÉK­�ñs·Ìúe”%±¶ Ü-.EÊ’JÿLئh·ý,hïY«M÷s<ùi“©Ò£úþÕ›j2�žE)m
œÀî;Ÿ¡å×)× ÄãÜùšë�_`ÂýÜ�ƒ4¨G³0 œ{¢zÀñ®yÑ C‰ÁŸèP!“2Ž¨Ÿ*§_‹Z夻'ªá¯›ò
=2ç#µõ-»Œ(…’jáô˜iÜS$J
+éèóQ.ž¾,Èv‹®Ç'Ÿ¤Îûz5+Éí.þÇÌHF.'_6®DWeN‡´¦j×I*92RÖ¾Ø.}ùÚu¯c†ß±©ŸoL¼`Åa\¯²ZÕãLƒÒË+-(þÍHUëO˵Íè|ºZÖe±šÜ.¢{sN"p6¨Wvg‘¨Ú�TzVóeÿºŠÉ�ßDbþ}fìkG�a<ÊaÆ#sSs&ÓçQ�‹Ö:“m€¦ý)®ý]ѺΈ¼ÂP€œ_—ÁJîY*ùEÇd@–NËoÀ*EëgšþÐ*Eì/5
+fe}®ÒTÌòl"kã&|]	‰Í0ìIâ8z}ÞàÒÛq­IIØ!R9/�žðb¦¢T$ý5—yYÀ;cÉÝb–Õ©¡á<GÄŠµä™UOäÅšT‹Ð	º¸jnm0±ˆ¾ô�#>xyÑu¢Ì{§›�û}ï<L	zcf
+—[W´³1fóÔ=;:[?ïAÚ¶€œ"§u°œ~ð:ÕÅÕ§A:‚¥¹Òãb	ìRœéÞÄJú�àÀÂT•º’8ȯ}j�@hjž¤v!äåõÊg>-L«YO×]1‰’œâÕ1•°ZÅ	ÿ*ý²o�ªìž²t
É�Èux^I'ön2*°5ÏY\]Øé½o
ËÃSÖ/CÂß 
+K1Pm™`)9öã*ïÀÀ˜9ójQc£º»5¨æñxkØk!>Ìa±dQÝÌ¢N–�ð§óΫÌÜ‹FÙó˜TKi•óLsè¯KÅÖ_T3’šy!—ägÀÑ&`pÆÆVRË
‹b¶ERÐ'Túv¦†\�
+^‹2÷p‰7ÿAäœQˆ‹¸&jÓC+Šînöhù=Ò,‚z]QX+dyÚ4lÞŽö
+�ÚNÝÑä0‹ø¯ñ$´lÓápàá˜7-ÎN*¡_~�}ÜviŠôŒSõ±ø<ÊqníêãâT2ª/ñ—Xà£Á•áºÜ§¥(’Ëæëya÷Ä6Ãé˜9ãVr¯°Z5l:¢�1Zuâ�Øó¶pÑß-ÖÚ¬æ¿ÂÇkëé|3! ëé}£?µ\RÈ(áÿÈù€>ƒ°šp~O»„¦jx¬ƒ qøf
+0Q1w+övæ”Nuê{„'®wäÕÒcɚΡë
lnm
+[1ȯ
@€ÂZ6Wj™Àtù'î,ž¹t$P} 'g"])²¡ÏãèæiØb¢Aù:5¹vòQüæøTzÿŸ^=�‚­².iXƒ×GéJµL«Šï’®ý#
¶†Ý:Ô»‚�u¼û.×'“Cãl¡Kè�m²¢4¸Ž“iašµ×B
É>íJò�j˜Û7¤&Å?ázKÂxYrY§EÛ^÷ò,,ne2üäέ†¬<Z¶×™øã‹?à¢
[c™«U¹NÀ¤ÊÉÙýHmaCsT|79O|f¬®‚’³i	ÉpÃ(ë*³’²!í:•ðt;Çün»L»÷Šæ?��öõ9ý2ÙbkÙ±!Y‡—çJb²Z?³Ÿ
+	Õƒcf„W
+*€Œ#Ç3&ìߣöbY�Ê_w‘&[þÜÈ_lˆèyIõÞqù&;è;ˆ¿/ÎÎ"Ëüè‚ð7Ñç–u’DŽzwÞŸ/é¼Õ†x³ëŠìb*]ü2)u§·O¨Wñ5òx‰1ò4˜•�3MäŠ`AÁøý4g<üÔâ‡?yi�ûÇ©¹$sç£ñs}7š
‹•†‰µê~
‡¥’ž·÷•ªm/�:N–lÀD t˜p
ÆÑùö5Æ„
¯ú9ø[ìœÍý�ßÖty37ѹ­øCËiqgõ Þdx‘Ó²¨„$¬Üá”1ëR• .Yú›ÊL�ûo›03´Â£X‹,‘ÖpŸ—;ôq¸ 5iÉɪf1`CÏ_®9^¥��u¢­­Ï¼%¹þêlóùŠèTžÅbàV0v¶?ž÷)mÌ?£B—ÎÞé
+àò0߬éwŸ³=ÛåËLX·AõfQÑ9]Ч
+sxX
‰Z–¸¤œ�!D°‚¶åßà½y¶õè’Ê«ÔùY-”¬Q>tkøH†•¶½@Sÿ6M¯çÆo퀱1“Z(}‡lš‹HñxŽ¤pOz’.t¸q(ò錣íB�.¸Ò™Å™ôÅ.ýX\Àª�ºö’¥«.ïÿ…ãÚ£È?¹¨®XH.
+Å׆ˆbïÜ÷ƒˆwêß
+n
+‹÷ƒ}öÜü\XGÔOCèÒ9®ÍŠ]Âdç šuFðê£ì§1œB'ÿ[©pT‘©#êìÊLT™µ+àaGØIF“FÆVåÑi²+®ñ^
+ÒÇý2¬‚�£Ó°ï�‘–£ïÐé… «’·éí«2ÒuÆû˜™‡ŠK¹‚™e
…þ’sêƒQµb•5<&—´‹è‚CK°%ɉ$ß…ÅJÄèè¯
+êRµù”C°†F¦)¸Ÿ5/7Õ²ai6Œ`U›�Úq‚¼]´nz€?öÉ
¿QŒ'éË‡c�MxiM
+Õ©Á<@J´¨ƒ¢	“ˆ{¥“o=‚K]—-x÷¹–’ð꧆)fè¾ZøÁ×.Ré*nßs¿š –apB üÒó´¸Ü
+4ù™ÅBj.B{J+–$hR¯*U)›–»À°ð!>PýuH€Oi·¬­x¥Æ·Ù€F0½Š“¬/!€k¶†.œº¼×tæ%ÝP"�˜®_cc_ÜV¸ë׌GÙõ¢àÄŽ_åk+ß6¢½J†ÿŽBhWˆ~ƒÍ«#b8Ý=¸åª
þ�œQÖ*È-"4íÙGZwò�¾P_q¯Bw±îÏ‚$ª$²u(ÈÙÆh?ZVÚÇ�´ƒ. «¶ïDæáæx£án¡Çò½Ã{Úmw.v~¯Q?óó°�%/%àÃÅðo‚/ƒ¬¸tëÛ¾ob¾»ëñ�XœòLšÅ©cx"Šsøy™á'n�²è3¶
Ÿ’YNuRŽ½}øªNµ©¡±`s‡¸ŠÕù¸¼È1FŽ:ÛW.Ÿ`1�´¬x€ùe€Ì$ïµ_ß |™þu*Ö~èîÕ¤©%•Ø©ü�Zf/ksWü0ÿÙG.öËÖPî±w¬¡¹s9™†£?<à2qŸ <˜¸Qþ·»
+,óa{¢ìÙÙù3†Õ}œI
	Ïà…u¾§	ΞОœ#“/!ZKóÑ�îe¸mX]†KjÆ—=P.G8­t
+C‡‘7MBñ®Þ’¨ÌÞB`Ô4Ü]òP~OăóOò^Æ_n+�¯ò݉ؖмprÅÝ<œJæ­³y¬l´ößÇ׎d6Vþ¸£ÈÙæÅ­X®üÍM#§f}ed‰J7Ò™ôT¬Ö©lÙ‰3·|¯¿Ì!U>„{ñWaa§¡VÔìùo'm
#K®™ Ú"åÄw4âïâÓ‚Äšóã
;üú­ŽÙGF!…Iå÷RòªÑ
+uŸÆŒ©“6Ô¯ùÙênñH0ûg›±së,)SÚŒxÝÃ/kzëð§ î#&ý!zçȳױ8“2jY‚G¤u¾˜â%ŸéÃóÉ7!Ißú&^úu*æöCP®»í½§	]Ö†¸Rða\ÓD!)�å1»ù”b$l1xZñ‰ LñûŽ/-
+4‹z�H8‘–	š‡‹ÔéA ‰‡A"Ðj�q&âGîè¿„‡­û•™ËË‚˜ÝKÖ�ÓÓdz——s;ä—¯ÜQ¿
+Ò×%¨•½xòª=å$«·å
+6¿Îá;8td.úÉÆj’1ƒmŠíyB>^bÐqÊåLà‰bƒ4h/mHÖ%B¯-¦/Â9€L:»¤Üó¡ÿ÷]mÎ|ùY.¨#+Ÿ8úT¹Ù9}FmOj
orn4ý
+Û…Ú²)•>PQÑSWüÂŽà8COÚ9Ì.½zQ”OÔ
B—F,ÇD“¸”Ãп€[Der-ãɉU`�øîìWr! ”‚ªsB‘–«f—¹¼Ñ€Õª.=K×$"Læ"òY-Ñ;N4·*r&þ†Ÿ+z
+α6
``…¾ÞïG0­o¸N'‘Ñ{-¢ŸîŠJf—Et~£vÍšAOÝÑ´m
­Ön7S¨D˜sªŽ’9F÷¤ûFš™%¤�[Âv¼˜d„žÌq£]‹ù„Á"•©!w67Ë?—ˆ«¦‡�š~Çt³‰=Èϵè|=WU�Œ	,Yª¢j»ª¶N!GÖ©ºCbtÍíÃþŒ=šhƒiu5Eé‘pºÐ”:ÍFAr4`›$ñ�?¯6¥·Õs•ÎлÉ,³¥f›LóÍ«ÕO“=Wþ…ëSrªAñ:½5­¤s“Ê"oxDöõ¨‡$8Ì�bµ*Ü9¡âë¤cvˆÚ(’ ÓƒìFÙ

÷N÷GÐ�sÎkÉhÕ»ù.C3
+;©4’¼ÄÿKýI·W|%½cøÅ]h…GœMùDîa&Ru�ãu>€�’-ÛSÝpÞ¶
+ŽW–%ÆÔ^葸Ú"¼E* 8
á	u8�üÙ•§Çì'Í
o�›u
+yDœ–NrešB#êè‰<2«DSµ¿pt†÷�-ªS9><o*vY\Wû^n"5ÁÞX2.dKÕ¸ûé:ƒ ‚˜Lö#„ÕT–E0Èôcó#¶ÏWº"÷ATÖ¥rlmÄ$£‘éYeg2B¾¥�[{á=ØܹDòF.Oû3íQpÇ�¢fÖBE(öo^;’S³§ßÎbf|…rˆ÷}Ž4F]žvB…„þ´ñ~M
U�PÙ^íâDaôXUùóžþ£Ð®`­{·Rª”@Â?
Y—º˜þ›Ï¶£Þ|aéeì€ÜùZmlô*ŒË×B‹àŠè]‰¸_ {%DOù¹‘nºµÇë÷ü3ó7O¾ŽÆ‡8ë›~žžWF¢p•&00oD³!ÙÕ~ÏÙéa­À3¿�wÍüüýw¿Œå/y�#(Ån:.PÜ™¼@Â+)ê˜Ü(Ä‹Å"‚Â]”t¶
"•C«î¬‰�>Ö
D’|ËP¼+Êë0yÊ»ô4ß{¥mÊ÷¸s ôIÊŽ$¶â$dÃ÷‡CîE½*ã
+g+�´sñ¤5ºT£ÃHÏ)æjAº1K
+ˆ`
+e_ÍQPš}IAÏžc°ß‹zá#P}ò †^eî~µhÎ,ò°Š˜€CøØùf
+}B$oÒ1>ÊóHM{PmÏårœQDç|Ù¼ð
:QS�v€šâ’ùP‡Ú6>t>Ë
+ã0Ï�Q®œã_%+­oHÞƒSm3ªþ¼øÚe'¾¥LmHdR§ù‚óÃ*�¦Ÿ? “M¡.ɼÄq4I¾8¥Ëø>ÀèzþÅ÷õ3ò
„_·eÝGnGky}žña“D9ä÷ô½ëjT‰à•ÿv«ý
Ù9ÅÝ77�½ÂIq)ÜÉì–Nâ�)	Þ‚ú!ÑçÌáeƒÉüý
+BÎ÷
IK ºÏ8V?Ò±ÞH;3¥YFjàQÚ;13+ܼ—/nIû†<Rt;˜v³s$*ØNþE�äNÎ>ñ{,Úü#0lËßJëšä(šYùXu“Ø£�gŸV<î‚<½°ÊyVˆMa[íSšYMJäÒwnÕ‚Q~dÈw€c¬h°œ§× ˆ]KŸé3é
+±„4GjïnŠŸ�Þ¹
­^v³ùÌZgØ}¶�*b«ªDýŠÍp�qP`Cκ,¸„då=œCΓʨrÂ\¬qc„ƒ>e-–$Éÿ…­¶FôÔÄŽ�QÐÑÔŽÛ„6}9E¡€­:¬v�°6ÈöŒxvý=\Ò›7ÞÙJÄ6ˆÚŒåHJŸÎ)½Jßj½˜_%½@l»,ÖÙký� ¡Û™Uf
+êáE'ÒõÕJUŠ•�la"í]©}Ë¡—ÅÅ`;¶f‰È<‰âÈÖ½ûAy�ãA6ÐîÚ±lì„S’ÜZdõ"àBk
+U}½òõÛ02y jp³K´=Í5eñnª“ÄJã^°É©ƒRÓ3Í’cÛT̯ÌÑ+�ik›=tcg�E†tÁ¶£Ë g§›0ý#å�“ÍÝ,½âI<©
Çñ9OAÁ÷XÉ�Uy¤”�ÝaN!
´ê§gÐI‚Û–
+nÈ” m+åÉcßd_µFt펆¯9�AFˆKÊùÓP/�` :òÔ0éîyÖ2É'†íÉ@¡C®�½SàT>…Ý4�™à�’†µÒšæ=*¹à’
+بïÇ‘ö"W,GÀÚgçà8Ó#þåiÁÜ,ÿ7äŽ\ñÆ‚âA}ñ</æö¾ÞA[q<XŠôâ/ÑH½!»èéü£RÙbÛÉétFÄ´ûuýˆüº‰©ÑÂy ±'©%âûÞ¹Hù*Ï$vRïÅ&©z
+`ÿ‡âÞ[
B´†Îìz%}”fM°–Û–BÆŒÒ�½Ô™)ì9R{ª+YËÛ.”ð†$Ž$ì–o�¹Æ>eûeç1T±NÀ°óZjbêTSØ�‘DSÂo¿Ÿê¶@v Ú•ôˆfP„2<ö4MÁ T`¿SvØÑÔ‡Ã\&ðHmøÆ
+E R^íÒ~áWžš';>�àð‰ä™ L€Ëÿf=ºMi)ÔH³w‰!ŠŠÉúæ´øjÑ <ˆ¸
ÒÂN³@Ñ6#;Q¨
+rcÅQH	ícûOÔ†ŽÕÌ|­�‘@WËO„]–ü½[@™}?ùãTuÆC“ˆ¡ªðÏ¡0å¯jAÇç%´�D0¥€iB�3‘à>!u㉽®Èßó’y1ÕwŠr;üoö)w‰¯öáJ¡„SЮ|ߍêZ‹%ªv8³¹¬Y2WQD[k`b‘¤àPx±¯lÓm¼µ{Çq&F|¥U~zZãÅ2m‘§§àwL€M:�«Þ‘¢:‚¡ˆh¢[Hò8¯ØÑ‘~ÜØ.®åŒ2»†ÍFW%°P¦]­lfÚH,´Rr„Äå<Hµ�ÏÄž&sÂd™±oGÜ}Éü±~ 
qŒ¢9‹´†H·:i÷.yñS>Qo«¼]µL÷c½ó89Ľ¼½~–RA²ª¡0ÒÛr’Ft¾‚_±<4ó�ìWîÝòiïÆEJÎŒCgy,7Ûĺi–O¾ÃÀÊ/Z‹ñu9X>±fOº:*Û› &ÔÁY.O?8K\{Râ¨jÈ7„K®îëlÛ²³ÉœËR;>Ôг2:œ…Žè¦ÿ`¶´ÑÈÆ2#ûûj²Á?<9€õÚ‚:Bî¡EQ@8á<kûÕ³ÝÍWóäcÃXeŽÌé.¤C�砄ʨ=±E%%²Älµ–	2õD¿&R»½qd¾9q—·}{´W*@—…Í©-O_nK,ûlT&~²²3gÂ{B€K$±6Nr_)¢LœP­�Ÿ£³zËN1¹,ÐA˜•¯W¡V*eØE1ƒºHÏ.z ˆ¯ÆGŸ5ÆA‘Ã{ÆY+�ì,l)ü�dÏåiKŠÝÕ&Ú2¼ž©Ïxaì2ç].åëVPÈý½.è\ssã%‡,“7{÷gåÃ
DȘuÃ'ð²—ä\=ßKϵ¨^f>ºŸIh™h7¹÷¢HNõ™
+Q?ôVïóTöIK¿òöÞM•|ieÚ‡Ÿ¹Dœ­2^B È…“	äOøD„ñ��Hñrø»ÌÞ¶á🺞[S§¨”OuáLïxÕt‘Àì×ÙÆ·Ùâ‡5�5ùweʾ?)•f<p·¯Ý­
+VCV^uNA	a÷¦BRj÷—Üs•“}”}Ú"zÁú»™9î`ÎT	ýld—>_¢’F|�·ßƒcè÷z):§Ù펰‰ÇÙîo¼{å[­Üûš”½yÂ.àB´�4
+Ø©U¢•¯‡º{YzEWY2e³ �º%½8ŸùßJ~±`„
+;Œ€ô3Ã%m1
Ýè?ÒmR�ºêc\žÅ
+Ì ¸¥õ£—»`4Œ­F™Ô¿ãR<sstB˜
Æ7/?+òŠ¯F:Ó]LîgÿéÃCÛS–Ú•Ó‹,}|` Þây÷8õ7�h›pG–JuÕ@,Ë�Š3TÙz uëqñ"�:<5}D?Í6Œ#Ú¼i1�²‚Ñ£›r>¾<Ì|£Š [ÝeRäßn@Ë\¿T�OØ€¦qZBQãc¥âäwÞ^%<tq\v^�Ôà…¾MtZ¡Wï¶ò �ó )ÍÁ8a{øV’Û˜Û‡8ì«îFâ´#•‡Wx½
+k1H�¤üô]–®$ÂþNeáŠ�t_?-{3h’úžû´ßñn¾ÚJíЭQ€”l(SêQŒ‘5­…Š²>¥­(ñƒZˆ¸Z…+Œ,îHÿͦ.—·Quç¥Gž™­½¯À+÷Ç×÷e¶ƒ(Å0®åÎJ掴9>ò‹qD~ßqÊlC¤þ.Á¼¦A€Xe
+D·nuWŽÎx(ȱ䒸W¬JÇ~‚¿‘º£eúT™aŸƒ^ï½–
Þ7ž§ç~hw™™_‡QÌ¢cñsÌÂå)H&^Æ1¼žC©g³¯®{‹DË
+Δ(47ö´@¿|¹­rƒË̓æ�U€ü;"H‘p�w›7l®è¢ÖÙ±_3 Ë²á	“x°÷�mŸa[­<�B5
+m©è—ðò–õáÇYêšstùá&%OŒ¶oëˆð•—ìO»Î[‹¡
¹:Ñœa#�âiîÓ`5ð½éÕ;)fñûqL˜\ Zž®°	@D~äõû«~ Ú¬u£¥,ºa+ט^¤.ïj±%šE–J�Ÿ5¨«ã_\A�á�Ž&©b´Hµ‘cïE&Ù‡¿²±~0·Ç2:y$¡0ËUÜ:Öã­”ðô
+Dղέñw¹Q‘Ƽ#Q›4Ž‡!¥VŠzÎEhϤŒ/RVÆLüˆ³MˆUÁj÷brkLP°…žz1ï/Qº™±€°šÑ@vbÍy¦,ÙQ«·/nÍáD'
+y“�(c¥‰´Á÷w„{n„Æ<iïDʲæ£aîþÊ`àðä=:ªH?Äçðâ€:n’TÚö:j>¥ZrÉO<xþ	¸� Û7:ôžPZ(´Pä%îB¡Ô$l®×Î�£UõCu6ÂwÆñxì§ç†ÑÐS­…Ã1@°UIÌ+KÏXŽë_`“BP'�oJÊðÅŠ¨Òq§¤3µv‘”_aè‡WUQŒˆ9H0݉P¯ù½gM9µ3ŸS£ã(-“ŽògPº@eãÛž°.µB…8ZQ•AÊÈ
+ö™…„-ì‰ÛïzD�Xy²®
+¿©²Ô
+r
_å~ŒÙsK=pÿëxoײ^�I'níça„SpÃ÷ëáòþ½ñ3|K0À¦
²=z,çÝ•âïcíñÌIér‹‘�¦
+Ѐ­)-E›Dë|8¤FH’=ÊÛÈã·pórHÚKG
+0öÞÛù®_3g(\¸ÜÁ¯úàòž–Ç
°¡³!}0}þ8ÁÀEþL†2Ì{
+WBˆuÀB="÷Mª†ß|j¤E˜&µ»“=W¸õNtéÁ¶5dPGŽj¿wj‡Sy®¾"‘Ê UW#¡4‚0‡©¸¿ô3‚´RÅÒ]ʽM§ù
�Z–T‹0ž0Å•$í£[É‹Ícãu1ÞeEpv¡„(�©šóˆí濸A·Â’ò·äûtô±(s¦“Fi2Åx\èE(×(9Å?UËÇ|O½¤2o{¸¯}a£ˆ²zŸ��–�δ€R"ô¥²¶‡ÀØßš)ë*m ô�Ds§úä}á·D
+À€èö}»!Xö&#’Qƒ÷ÄQo”Cþ¸G
FòñͳH³3ànGZ(ÎF_¯AYÔ%õˆøcŸ=ß0�ßpMv¨ú�¶Lbã1†ŽêÁ³†L	*öVt°Á�ëh-½m—œ(<ÊxSæN£X»œ$ÚÛع4›ŒbŸ…±´þÂÞ±Üã‹eõ”~ð�^•ËÄ·¹©ëPXƼŒð;ö2nµ *’ç#i¥¥ÈÇNÚÝü…+3÷3ÌÌ^ë�t]XW¨²¸DLèi[Ó8OÛþ>M6¬˜NJ3ÆzU1nç€6QÐ19‹—Û¥ŒPÖáZvõ'P¶—YãšUrAIîžÅÅ€1›MejùzV+ÕÖù7¤¯¼/E^;æ{/ZÀHgâ×j\œÿ+jÚ¹U7ÿ1œ6Þõ‡cuªæ®öèT8ÀõÅXý]¿0Ô¦‹Y‡½ZybÅvë$n§ýõ£±#ù2 [*ÃwÅYårÄ9V@»”d5ÙKˆÙ"ûº°yóv	ƒ®'XiH!ó á3wIykÿ#J÷lÒ<¦s(sUø®û¤Tð|á:/pœs§Ô ëP’–<ˆrÞbL|}ä’0ω´üûÿÛÏgÌ_ögk�=úÚú¥�¯®®‚_{íÜíÿíü®Ò§à1ñƽœ�[.I$Þhè
+¶�Ù½äÝîØðmŽR/´Ï8e°ûœ“|ñîëszC<’^'¬üš~xõ¹l­SÒ|úcä',ü~Ç+L`áƒm¡à¸Ô›;ΘÍfyüØb�Ïþ9%¼Wû^š¦ù¬ãFáuž©ªcMŸîVÿšW:áõd�ÝÂ}L“â��ÝK?ϼ|BóÂú–UvÞ•‹w|›&óyvÓê—šß²CÙvOË*|ð(-´zé>û‚Û\y–'$*·ñóÓÌ¿åÌoßoßîËÇ6Éý¯ÝI)–ö÷]³=ž+·ô»@siÿ–R¿‹Âs2š5ª¹rwö¤˜q	-¨
+�¸wëB€tIÉ>NÖÃïÚ&ÇÚ4ä†11>Ú"³OzÓúv«_§ö°÷ßâW�3ïý¿”é–7Òv(/z¼`ÖrËm_姷´—+vÙW²ÅÔfî�K0庡û×2,¾ÝÜùÞºsÞÙÕ÷ïíK;b÷Ž9]„m/—èϵÏê7~ùp&,kÚÖŽ óKâ>„(vú^K¿{uYMd«WT~Ë5�Û/Í}(ïÜnXªÃYÖðíÆ™þÙ�®%|´<þ¯ÁuJx´nÎ�Ö×Þqr%M=6åŠÚ3ÆY�·=4k<±;ä�ã­ÿ]ßµâÜÙ“ŽI¢Éÿ­C—̈0Ø¢•–óñ‹õáü.Óë�œùv%ÍÙÐ8³÷ eYU›ï&™·µg#žÝò¾ËuÉ5€Ã¤QÝ€BÀ5jÀ°0 9'5±¨$?7±(›
 endobj
 885 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 34
 /LastChar 125
-/Widths 1929 0 R
-/BaseFont /HHRTRX+NimbusMonL-Bold
+/Widths 1938 0 R
+/BaseFont /TBYCOO+NimbusMonL-Bold
 /FontDescriptor 883 0 R
 >> endobj
 883 0 obj <<
 /Ascent 624
 /CapHeight 552
 /Descent -126
-/FontName /HHRTRX+NimbusMonL-Bold
+/FontName /TBYCOO+NimbusMonL-Bold
 /ItalicAngle 0
 /StemV 101
 /XHeight 439
 /FontBBox [-43 -278 681 871]
 /Flags 4
-/CharSet (/quotedbl/numbersign/plus/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/A/B/D/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
+/CharSet (/quotedbl/numbersign/plus/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/semicolon/equal/A/B/D/E/F/G/H/K/M/N/O/R/S/T/W/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
 /FontFile 884 0 R
 >> endobj
-1929 0 obj
-[600 600 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 0 600 600 600 600 0 0 600 0 600 0 0 0 600 600 0 600 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
+1938 0 obj
+[600 600 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 0 0 600 0 600 0 0 0 600 600 0 600 600 600 600 600 0 0 600 0 600 600 600 0 0 600 600 600 0 0 600 0 0 600 600 0 600 0 0 0 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 878 0 obj <<
 /Length1 1620
@@ -8951,71 +9011,71 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚ¬ºct¤]·.Ûv*I§cul'[£b§bÛ¶mÛ¶­Ží¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë5FQ’)ª0›Ø
%ìlA,ŒÌ<
-o(:¨Ñ_‚ä¤ñOFuØI)Q’¬¥®‰Í:T\+kÀ2ñ´Ò(ÏË2+­Ô»Ð]é¾çAM�¾×Q­?A"tto¯�$ÏÊAœÇÛwÎB�¼ã¢ü1lþUx�q¨eÝÒäöt¼d"�$ÀÇŒ‡™M ,tEÃ2g§ö“0AC�ª•ƒÇ“IyàbL�żê|c
-)/
úh½0HéZ=`|K›@?ôî3Ob¨cËL<Bß1d÷h•ß$™§”±ù¡î]C¶Y™�GOýú!‰�ëŠ.=÷«Ý¹½.oÇ°,½ƒšt­¯”3sƒÆÖ®·qbé§0ŠÅ°ÈDY~–iÃøu(Ò˾‰ªæ³?ž�
cŠÔbdS7sYð§>ádÍíìÉQûcz‹þú7¾cèü¹$	Æ>2Í%—¹ß°%F
->@í£dJî'�¾T¨WÝ–
’ÆÑë«úþ®@Zl—,P* ï™7o6x©bäÀ×ZëíùOרc ‰^à°HY¹ê¶]¼„qGÝx-
$v·úyüJŠÑ‹lüwÝ„ze|5lÇ¢‰Û&^^Y†¯d¤å¸=眫Ø'ZðþžQ.,°#p¯ü°Éøù¨~j‡|i¯ÖÍ_)¢é<-ëqHb_Ò»S3‚4~«Ò/²Jú
-ó»kœAUyÑ®
D‰<aº/Q߆W}á{N·râ‹0¢ž¦¸2üuŠþK!Ìe§óç-õœ_…Éæé&·öŽtºö›)×öÜÑiÞÜ=39^TùyÖVÑúA`›Ë¯“Š×1³[´³Cr!F\YÔT¯É$0¹âv¬]1¹â2õ¦2˜÷¨ÏQï<^™2ÄH‘,Fð«­Ѐö

�ÕúSöËö$§f@ÂÝ}7EŠqÂl™ûÑ0†R
-CùV¿�·¬�žg&�>ˆ„’"µpVk_í+t·—$ïÒBh�tçß’¼`ª-�‘C†<l®I4@‚ŠÕÆ6Ã0;˜‚û;>Èù}îÒôƒ¡OQN¢¾hÉlÙ‚¦X©ÍÉÃÚ-ðÝ󜚮Ӳå‰f]D–„]fp`Ý
-‘ו‡ošDƒŒ¾”¹�yÙÚ<1Þö÷Š3
-9àÙ÷:Å„Ÿ\ÉFlý¹ŽNÁçµ±½F¥1¢{1I#�ù�#gÐM!Å&Ð!ùf¸¸<:â‘�[Ç‚êÞ
—dx²U�Ãü9‰Åm³{¦¨F�®Aº/b›ƒÞŸ&ŽiÊù0ÆÊ<É{–3Á—)t;¾
-I…ÆÄ8á J’«2ðÚÁF–û†t÷+àK‘D:rtËSα£³ÒFX°Y¿ƒw0¢ºãÎo‰Õ"Ú-P¼L>Vš˜ñפ2 Ynîë|CVÞZsZú Ó†x9�„ĶU&bNž\@š'üýlNÔÞû1ãWÎèjöE¡¬¨ÿI1©~´Ç)¨¥P#çP&¦B5ãrEò¬é&Ü�ìPÿgÖ©‘ŽrÏ3ä5ë(h“‹£66q¨	JÄ·­ï|à·Ë Ç#·û:[‘úìƒîi0žì­ÎÚoœ*3ö8¡|SgrJ_ˆ·¬»TáZ‡%{ÍbË„pøTþÃiK¢`È$Ñò-ž—
r
-g}%ž�¿<ÿš¦¢§y>ÕdsŸZˆ—ŸäØt‘ùB<*C�uù­
Xò4RWJY¾?Ôse4¿¦öÁGGøË=1nI6ö>â¶�dxøÛzÀÛö§úø÷^`K­™u ÒZ¹$gMÍÍE®Ý§R‰³› |~Π
;âIךÚCXFçÔ[ �"9Û
-%Všy¯Žç½wd`õ\¥
-?>Lîw\_¼__º‚+�úˆ—Ï*×5²,Üâ~‡
-ËGBÐ×4
$<]q…x\6_Ì�I_ϱȸtÓ<< ±ã[ôV(“K—�ê£hAÑLÿ�ž�ƒ«±î�«k”“Á™-H¼~„ÈëRtàÆ;ê¬ԧОSŸ«,Ä>x›ºQmMΠà¸ÀöH|’MÇD-2:s»ÁK¾jÍ)yu$–©Ó:ž•([mq!+G�Œ™SÞz‚PùÒ†�ÞjLñpö«Ys%²Ý¶p¬z.M[›t]Þ§ÀŽKxÀKPų½×ÕêL•ªçLý=à'd{ì-¥?Ö­�#†‚­¢E^+#6#–
ñ/–“õ­ñ¼ÍTñÖ<ínÀZ‰/”Ú8Y2ÓØ/gÓAÓ›øæ±,dx
-v]šÑØ}a(ôÉ:eÝX!±«AÏ�[–Ž×ÊÜ’ÀæƹƣÞ3a‘^£ãxR°šË\ì2ª<2€ÿŒÍmxÕîQžæ‘QáE‚ž�È¿¼=±HF,ÃØðªÊжÌ>Èü]¼¾Ø¨ÍqZ\Q0³“×-|/SS´æ;ª?
 [B�«˜jÜë&BØ’ÆIRòu“$€„ƒƒj°�i&ÝY³$——½å£
-ç
¨÷i
¼%0¸)xëõdïIG•&Ž¿œÃtɳ6†ž7|¸.&õ
-	-ΈŸçf™ÕÈPMC°3p§î¸eÚìq²áBÞæh‡~ò¨,þ�¶¢Æ®¹ÿã
-¥;Kƒ{jPÌ�CÛf¯¨“Ø£_:©Ãb*¬Ž–Ôº°AïhµûÞÈq‚F΃a¹¦Ô9›X´Öò€)t‘ÚQPAng©§âÏíÿ4»š†ü˜©>¹I¡Îúîá
--5ù\;³½�2>V®±*T#
+
-@0‡cz´ëðcL"¸¶©ˆ1tQ mhž7OyÙK/=mŽ1Ü´iüŒÇŠ··ôŒÄŒ%¥”v=
\lB­×9Ɔ½‰ü‘“WŽÄõÝ©s;Ú¾†øðýa_ 7,Z±jg[À6¾bV¤ÊY—qá=›TLÀTæù4¸©ŒZä¹xæÇ©D
 S7Aof„ûoŽ¦¹¶†d¬Å(?#	Í”¡4÷Ú7©¯;˜Ác%$P„P|¹Ú“k½T˜d
�pR(áæÓþ;	@UÂŽåo.P
-·?å?«ì:º;rº¶;(œåÒHBÐUQ%Wy¯ÇûcEàÝÚóÌãÁÏbמgo@¦
ð­q´ÔDÖèÈ'
)øóÁ�«ÄhåHø*²ï›#™·ZÏYHá(%Òïg!›µß¿ûW{|êõhñGÆq¡ÄL»»o–DTèd·ºãú±‚e6D²]�}~Ç¢jé‰
-S(xÚ#oÓÜõçç‚
-¦cô)E}dðHÓœGNoj<]Sç¬<âu½âyקûU�7Áê­²‹E«¤py÷á8'ËÍibHö� qT?q::جöì(ݽïRgÝý>^ØûûWM€Õ}ýÐ駋–Ê{ÅóZˆÔ(sï[6ìÂO‘zü
-I³ÙêéÇ–T©-˜R§5߇›‡þÚ@ÂÇŒçoT§÷uf‘‚‚Ÿ£;?®IÖB,$ÊqªG¶vÚâ¯PIJ	•£Æ»¨(¡àœ•SÕ`RHáRp�·É/i¼™É6rƳ¬È»ÚôÊvökU;]äW¸é­�ysV†$Zk›o��ÀëãõK„ö Î£
æe�*|LÞ¹*p¼§}¸ò× }an²éÜ¥ºÏ¡öÚò´Ú7dîyˆg9ÏÅõð¤éFOdtã’ý‰,5FYrè¼c}í¤Ná§à:†KÐe
fŸvE#Ÿ?Íю˪̘í‘0S(Ó¿£ME J+dL©¬¼I­ð^>|$½g'IàŠ´?"týy0ïù4=:9W8ùÉÝ1Õ
-6AdQ›¹Í,>N)¥Ò©ðOã’ÛÍ·o}ŠÓ3U¢ªõ3“ÏŠC…}àp)Æó
¿a™FK›ó+	•W1{‘¨íœiNŒZ?¿~Ô<îZÛ
×Áˆô~ô}“IU?û
-^ºö*ÕÊ;â˜<\éæj�B† :æ‹ãk‡o™ùžËýta�A=« ÓÔ'ŸÔÐH•ÄN!z^“«ÿw¢ëKËÌ´«vߪý'ZÎØS³_-Ÿ!¡ÑÐ9†˜­yƒ±<`–ìÜkÚìƒ8˹‚®UF¡èýÒ¿äâôëO‹¦3xª©‡ì†°b$pãÀfN2rI[	÷Ð�`-IêѸ\\AIëÇz£AÅ
;²;»¬·Ó@sûÑ’Ðë"ø	,méG(;vø™�Ùd×"|‘"¦ŠÄ`྅Óé‘«¬óõlýÖ!|t]Œjø0Š–¬¿Ö¾ª0Z
)ˆM&çEî+
É÷ÉœGÌ7kʱ—Ed`X]ŒÚE•ÀQd¸À'D5õüDU°p¯)+7sZz Ce´–
-Ý)k=g<
-ýÀ”å•LâàÛìàwD#XY«yû¸é ‰z�p£^àž¡�°óRÈÒˆþ‰B
˜D²¼¾Ý_v|˜÷ÕìÆ”¡v’S|*B‰ã˜D#ÑŒ¹N7uˆ'ôx’ÎvïNEy-‡UI9̽Ç|iýB[}¥­Ó¨�ÜE>T”;pf4_·Ñ%ÙøN} T…—Äï÷uĘ¿”õ‰¦ûñ,Ri.ï
-„y„ÑŠ<¦ª�òÐYtÍþz`Õ4ŠMÇ>f·ÅH
3¯�ð(±…¼]¨!9‡çߤ–�šà›c�à
-è°ƒXC#Ä1ž7róѧƒ†1÷‹þØ*:½Ý
-¾¬üš"¨�ùᶓ°P
¾¢®tþkºô¡�ßs˜8ÁºÌÈ8õc°ã9­•Qæ3EåŠü±¹ÙΆq«¿tÔöÙËCCY
^"fDzJ 
-ÛnÂ÷Ù'Î{ü®ÒÿŒŒ®AiD–Xg‰¸N
-Ã2k}„‡�Œ°±hd7,
=½åÒp3{9uN4Ò�œ°T—£b؆F–i$ïó‹'p‘}¾Ÿt¥™´ð^ɨ�"3±Ut¢¡zx²ØÆx4D	K¬ZógÜ–z‘xC6‹]äÂØý9&yóï³t6�?ðÌ"%
-‘¼FøCAÌÑð}>€¶6‡¢ÓVÛþ\ý	diB´«Ù�Q¯è.Ç~Þ‚´ÈÌ=ìäm’6yS$ý-Ñ¥ª¶™)P‚�´)keÅÃvM¡Gã¶Ëe·5%¬_ØYûMŠKÒ}ƒ†Œ8îÕŸÃl5wìóµ Ô<öÅ·£„²3Ç��³’œVÉ÷
-žóø.Ñ°\éd¥(š˜>¯–LãPÊ Ôš3,¿Ô16še¤³Û²˜BG»O�åÔÏæ¦_�ƵW‚®e	oÎP×½'”�@ç×ÒKLýº-/ÞJ[ýŒxw]öG8förˆVƒÉcvÄþh;Ìšé£è‡µŸõ!qîL¾ÂmÕBÇïã@håR}ºûür†¢'rû⣖í5qq!Š¥¥¾Üt¿°wô¯µžQ8É@Œ‹«}Hë%‚Õ›E1TâìGäìï¢vF9Õ´�½Öœþó«õ‚y¦
-°YN0Û�æxôÞù¾•
·Z1#‘pÐG�)œïò±ž{+¿ÝªjwÒ±E©áš=P´Þ7±ÙÑ[7û¦“¸NYYÇU¸yd
-¢ˆÉd)$±¶Š¸[a# :‘�ÁÜ.‹ÍÉü�7LÓ„�(èòGÚyö é안øžwb�MŽÓüÇÞN�Ëe?ZÎÂfRc¯PÌeš²ªéQÚ"äI8�
-4Æg÷ÎüôL¬¾¾Ò?Âlœ�á6_±Â؈u‡ëî$àÝÌ;ÇDpBÝu¢Cbî›#13º;Ï
-*‡Kò·¶‡;¼-’"+ܦ˳-ý<ÎÈt_üöYëÎ’áBÁ‚¡$üé©Ò.&�>Ùe¸R¸¡3›Áÿ]u7üaÌõñ.R8‹zAµÓãvnXLûçpYTÓôª['ÒøUÒà=|¹üº*ÚÜO�AŒ/–*CØ
¿?CÞêh67÷
Wáïx,V½ªŽ_RÆò^/H–}èÈ;‡¨=+mä káÕÊuS®ÉẇNbnN’²‹Y)êctž-yá¬JHw‡d`‹£Mó®úí}KÕ4¬�«–!øWù…�sYÚá•MS
|•Ð§DNß"æµdYDé
-Á4õ5’KÄó}†#‘.§­¤‹R�‹«
-õS—¸­oïV‚•¦x{ì—?]Ž{øjA}øé{¶$õ†BÇÃh>/o†"U¹»ý´P‡SkwUçn0þ€8âàB¶ü¾F;u¶pL)#–�à
-}c6!„L¹âP’{ƒá;D¾dçqí¨ˆz`Ë2«f§µ­])ÊFDŠÜ›/˜[öÃð"§Ê^w�HZÁ‘³"¯�oD{�¼_7züä5àb«;ýS@$ú¡W °²ZðDò¢òuÙ
Ù‡W{fMÞ2ó¥I*,~…Ä©¹#xÖÖŠì�z‰KkVß�L™E�›)¹‚¢ÞIXbÄSóùÈ»´[N[lº3íLX¬˜
üçw^@dqór
-G%vA)ÁÃ
G¬³¤f‹o¥¿ñ`Ý­LF™óVõ‹ÔK‰óÔÝwø`ø?qŸàÁ¨Í	tj@®È<a‹÷
÷äIFÞµåüïñõñ
Ú1*Oîc=÷Sï×Rf•«xh¡«>Îê3cçÈ
-ž(—NÑÄåi¾%¦�Še¿€Ù?ó‡Ÿ›o†`ƒbîª0Ø– õÚ MR�¾
-Xá�…<§õ0ØC"ôñŸjè(–ŸÚŠeÂÑ_{Ú#‹p7ƒLìÙ5`:ì¥~Áì4«¼„?ãL®Ý8Qó\‡,OÇ™ÒÀ;ŒmhT Î§µVÄ! ¿h¥¦ž;t*ê¿ôŸçq
!·Ë,·*¤Z…ΟÐWŸ¼T‘*”„6C‰:(ç›ø9ÖɵQçQÈÔGæǦߑ_<Â9ç×YÛ­ÐÚºMîƒ3u"JL	üüÒ¦Q#ÆV
_©©…vYTóVKYðçæÄÞU™gÔ»ð¼òù‘Ïz‘Z(ßC?¢1Ý=�žâD®jŠR8€‘%öøg×Èži2v»n›„¸MM¢t
Qd�Â*l%–¿‡RS7ÌÖgj¿¤‚<ÿWßÊ}#ó9¼ˆ¯†eç
^™êgÞÀ
Ïõ#²z:Ý¢
-�Ha\»¤ÿE�H
Ü„Ôçì¾f•%bA
¯üIÃvÊ¥lPsw‰8º8Ö­æŽÚz1IÝûQgÜûØÍMw­©•—#ŠC$=ꤡ ºí=ŒjâwÔŸD*/ÜÒdêÅÎV
-�ž‘�õ÷¦ÝÔÆ.3±õƒ¤9ù]v\_17OnS{‡71¼ôtÝêÅËCgû!Ìõ’+
Ì\\j·Äž¸,1Èßß62–e€Æ§¥ì¶£þ&kL¿ÜêWÎc½aàJÚQà&AY¸Úãt�¼Å+«8•�õà�ZõÐ
³…V|Òœ½ÅÆú¡/½99t<�g¸`^B?h¸Ç0Àûµ©¢ûOÛâD¥¿¸ÆŽAôÅöŸÐˆ"&üÒÙGZ‘úáMŠ÷1Ó.Ø›ÉÕ
-}É6¡©†þÇÈE…<ÊP&öÌ>sDõbÛ_ÇÜÛWp	vµe�>‡ÿö²fßé(!‡°~i0bkzì¾ÕIä­ÖÙ²¥©@ œæ‰R&ï…Ãi$|i ׶Î
³�ùòR¥ñ-f	—ºŸæžæœby,I꾟pXðØ©»›¦Æ)bF°¡K·b¬H‰ÌçubØ<A¨õ¨Y*ÓIÄ�w7y	èÃokSI‡&úÆΤ Kʱ¯¨/ÞQ�wŽŸž±“&×í1™>JŽ%Yô¶y�X}<¹ƒùÂ3éîe›i0Û~4f$­z6n/¾˜z¤ðvÀÓx$×ÂìÀˆæÑnmeõaàtçTŠEð­*>÷ËMÉCJÁ0Ýg¿WæWk¡
0[(ÃL�(”ÂÁÒ/;í�:1JÛÙÞ¯£ùþŽŠ's
-†‚˜!Y5ª¬h›Âø
-’9„©²Íºi=ÿ¨nuþò©­'h¾N«˜4Õ 
7<±–¹ûIíÓö†�÷Õ=Î)iÇN{À$dQñãTË0¿‡h¹KÝçµÙÚÒ9äó
ÌèÍï@¢ËG¢�$éðfKvHÀÑ:ÓÝ&îûAoà `žŽ“DGO?Ìd¨ö3ìŒÂ̪i¢ì'Y"-°ö-¸™¸O-õÂ5¾4¡Ã­š6rMŸ4Éì’‰üË¢¸U9F4Ò±SÑU-ÚÆ
-¡à£"Ð,‘gÏKîD~^ººÓÜÉ/Zn\Æ$ÿM­Œù–1ÄŒ)Á×�BoÅ�£E[âcQóh¨X*úêÊÒO>0”�ëw+ÇœðaÚ¨F~¶zñyþþ{‡gS(êá9‡&IdÑX2)Fžb¡8ÚËp¤‹PX,Gæ(xõš2œS`º	faj�e‰ªh.,w¤á«7
-cLÇý2 Ža®
-L­ysŽ<q›é;u	%ý¡xCߤi67k]|Õ•ðÓ�*‰I
-Ñœ±îÙª
Zˆ¼¿›7Ã_ÆvN¹—Ks6Ù\£÷ˆ[�wåÝ4
-ÒÝzI6…®uê+¤S9ü$±ì
-³î^x½«nŸN)ýŠ‚Ÿƒ.Îq:¢:+ùá�Ž{ÎúsX~²‚e–yÚÊYTº¾ws!k�œ(IÛÌÀB(ëÊ#’ØMëü««}d˜D2è9 ‰‹â—'Ì¡ø´ïƒšÛE’,6bOöO;fôu-~_Çx�ð¿7¾ØÄ(Òñ÷í/Ú݈9?’WÛïµÈßFgùè`æ}ô}4*¦
-…3©	¤ô1.aõÂ’ AÜÿJ&ªƒ0E|R*�ü(ô¯[\eZ¢¬ ÏÑZõçú½á¸sÅ%¶_,sEjìœÌ.�®Ü¨llüqÒé;¼ô½ë|i*VÖŸ
-¸Kþ­Óp’¹«³>ú±ägWüD³É÷?æKåÖ�ôm#|žZ¡£¢Ieí"b0G`½t¢n¢J¯q¨ÜÜPé¢G08mÜ8Ùªç µÝ¯Ýã¤ßRf§2e±;$D/Æ&.m�È—(Ân¹\çU"S#�Ð!=7±æ
-’Š±à÷+ÐáËú­qJ®lHsIw¹eòªzDëÞªÔ• NÚšO%ÒçÕñr‰�½¯=W¸Ë„TF%��:uÀ䀙2º,~u‘\ıáýú”�oC}xù‘Žq"4{‰
-@ûÅ#\t£¼ó�¿º™/K®Ÿ±UgR¯H€d~È
-a«Ç|…Á|e¿g½¯
}ð”uT©ûa3s+³Ì¥•¿½ã1KÇ×1¼tþ~¸O`Ë’tyQ[ýÈ—M!›ªo®J¿¦½Á'‚K›ð⊿Sî|
ÿ˜û\W�Aƒ#‰Å9Žê2]2Z³lp‰Fûû–†ÜûO¯†O
&¤ ÜDpªV¦8ï…ñ™÷óìº
è™zgØùÝg¢‚5¹’-É}P«�†öž/£y+
¢rC*î‹#&ï]:x"v˜rNµ4¥‹|ÓWíJû`føZ1mü-msFYîÐ:8[Ž–?[¯+v~ôðá²›	ó&pÀs–K‘v£y¨¤}�Üšÿˆ÷[â01%¸.cœY‰]j�˜ª:Ç¿ùö:Qqæ!åµ¾©ÏÁÈégƒ¡¾{£6jÊÑõ({ö;¯`ôô«î½A$äÆä¥=ÿ7<‰†ÐZLLSXëFŠ}Db62×,èÿv;=›#˜‡Ãc�(íˆFrEƒÎUA7Á¾ºñ°¤‘ïμ	Ÿ³ËØ
0
-·‘—Vh/†¸MƒD:•ÄÇNñü°†•:#Þþ>PLÇÒwïÿQ5GbÄñ
Òû¦ªð@`	Ìz(iVþÉOëµ6‘
-³ãÆY§uïèœÙ+�èï°9¤- ˆíRUöMxöOþúíú¡ÅsC¨3‚Džú›„àyEà·£¸q›—Rôd}ŽO±æé[ÞÄ™G`c·§;[�‰^L–çÎ(Ön^v轈î½—’‚IA?‡�Zdߦx¶ë‡0Þê5/„·ï0iñUE°—,¿"7ZE�"Y÷­à ŒçÂëáÂBG¾8˜¯§�µ#êÂ^	êa¹bÙø´­b÷VîæלuHmzæî	
-P�̪è¥Ôqõ D·Š@ÞDzˆ‹òuçöÿäüfN?ag>-šŒÊM©a7šµjª)Ð¥0c1å˜Åêž&¶Á0®ï¸‚«n9¯ÀMæW )õêP&°C˜Ù‹÷¥J@eôOqðȾÿçx˜¡ù3ÜÏú\åušà$å·=„þ’»:0¥äí
¬	{]Û7°PPÎþm1ˆ’=pËvÑ18Zµ±ˆ
ÀºrG»%±6.«ßÌ¢8Î8П«woZKÉ9'çêí#úG—ïj²X+§ÃšP8†»Œݸ¼0J…®D“-ýf¸=_U0óA­ú¤‰Lÿé-àK�‘ú¥Ïã&zŽ^Lqêm²ù›_º´~æ9ö$ |òÔ«*9k+ôûÒ—eL€<•Ëu¼É]ý	v¨Œº�_rœ!¬ß§Ìèèn"X[,#ѬR;Ry\³¥»VXÀƒ±AA+w
-©õŠÊ»üyž+¾û™%’I†2£mÞá­¥\÷¤uçó:µš¥WbÕ‘¹éˆ×h'¢I��µCŒºÛ 
-JÎtŒa½µ~öB¿çn
8b¦”W»VŽn$èÍñ�)4Üê¤÷VûËÌ�Œ;µ•èN ‰R£ËÐŪ§ýÿ×>Y¶5
(QD‰!%ÝH�îfà¨Ñ9º‘n	i’"]Ò-Ý1ºK�Ýݵ÷þ‡÷Û}îù
çÃyžã•�”4|œ"ïñ`Ûý]_€ßÿ¼�ݲí\£$«:ê¯{¶F†Æ»lìÏ3¢?ÑL$G@Öóå×vmôãŠ#Žª×°tή4ËFIñê\é±¹†òã–ÊcLÏBÙðn¶²e™i¤ÿs;<¶ ¼ÿñÏ7JŸ�¨ie/þ5÷“FàEZUuç!í¯îðœJMþ•³ŽôÓ�	}Ëß–~¸
+xÚ¬ºct¤]·.Ûv*I§cul'ÛFÅNÅFǶm۶͎í¤cwý¼ï·÷>cŸóëœý£jÜk^s^×Zë5FQ’)ª0›Ú%ìí@,ŒÌ<
+ükì{ýÒÂv¹+
?j06Íðün÷X>wø<”¦=ëñ¡êM
^çùPÐô o}íä¤;
+dÒ/EN¿ÐˆòºY’Ý�Òæ`V?Ú›RRÖ/ù€!žédu‚»y¦ñ§p-ðÇúòä€âk’Ú‹Ý…Ö†QWx~ñ5ñôù‰jh|td¸÷ºÿ��.'ž’×
+ùk¤¿c¡ ¶Z…xUó«óö”ê&BÏØ>Ÿ¿ù‡PvE‘妷�‚ïÕàO͘ƒá†Àl
¬„ÔÈW"æþx² 
ãŽïIx%Q¼Kâf†Îo¿møWcwúŸò‚‘ßÄÎ׊�ü;L§Ö‘;æT°£6®ãGvíÌÓ.õ=n¾Õ.7èX¬JÌ[ÃZUýùbªÜÁ+_®›xF»-b¨À(¥ã©ƒw¸ÜÄ$ÌÓ…
(_,Ó	¡Ã4ŒS4r-Ù“©¾ˆ3‚2Ž‰Œ�Ž$¿ d­ô“„}¼Dä9%G¹<á¬;Ö6®£ÛA‘œ´Øpÿ(w�ßöìWŸ.S?62=ú0z‘ßãš@΀ƒë��ì˜ç3¹>9È%æÒðOÞ`zŒ—6"Aïܪ“³ÖSªÒ¼qRÉŒ!ÝMë–›Å/˜6 pöpò>ÙOB�ˆÁrêO<õlb­‚‡ˆà\jÑhŽ!··qè™•íº”…u=5±—ª——‡³ŸG
¿:×KÎ{òɵÅéKœJC·ÒBµ¾/)qpgŸ”­µí‚ ¨•ŠgœuºœÚ]_ÕÞ´c¸Cûô¿Y‹ü	n¿3ÇaÉ»ðSr
+o(:¨Ñ_‚å¤ñOFõØI)Q’l¤®‰Í;TÜ*kÀ2ñ´Ò(ÏË2+­Õ»ÐÝé¾›äAM�¾×Q­?A"tto¯�$ÏÊAœÇ;tÎB�¾ã¢ü1jþUx�q¨eÓÒäþtþcÉTI€�3!š@X芆eÎ^í'a‚†:U+�“òÀÅ$˜ ‹EÕùÆ
+a®;�?o®åü+L7O7¹uv¤ÓuÞ̸¶çŽNóæî™Éñ¢ÊÏC°¶ŠæЂÚ\�„P¼®ˆ™ß¢�’1âÊ¢Þ zO&�É·c튩È—©7•Á¼G}Žúäñʬ�!FŠd1‚_mÅ€th¬×Ÿ2°?X¶'9­1îî»�(RŒæËÜ�F1”P (Ê·úí¼eô<syôA$”¨…³Z‡j?¡»½¤`y×Ê ›¤»€–ä…@3éŒ2äaMÊà
T¬6¶†ÙÁÜßñÁ.ïs—f}ŠrõEKæË–4ÅJmþHž6î€ï^çÔt�V-O4ë"²$ì2ƒë†`zê%ž¦,"�þ¢ý_…Ù÷4Ô›øãö•÷ï¼f=hR àˆ¼®<|Ó$ddð£Ì…ÌËÖá‰ñq¸WœQÈ
GðdȾ×-&üäJ6fëÏurþq^KÐk\#º“4”ÿ8rÝäRlºQ
+Æ9vrQÚûaÞßïèóQÝiç·Äjí(^&+
MÌäkRÐ<7÷u¾!+o­¹
-}�iC¼HBb×*
1'O. Íþ~6'jïó˜ñ+gt5û¢PV4घ¿Ô ÚóÔR¨�s(S¡šq¹"yV‡ôîHvhp„3ëÜHG¹çòšu¼ÉÅQ›8Ô%âÛU†w>ðÛg�ã‘Ûˆ}�­H}öE÷2OöÑgí
+‚7I•{œP¾©3½¥Œ�/Ä[Ö[ªp«Cƒ’½f±cB8|*×vÞ’(2M´:G‹çeƒÀü‘H7þ5'is=½ó{LXwÜëiì>Aº„ï=Ëo?F—Aµb©�ÜħcL·¼ž…×›ÂY_‰g Ï¿¦©èe‘O5ÙÀܧâí/96]d±�ÊPàH]~+B†<�Ô•R–…€
õ\ͯ©sðÑþrOŒ…[’�½�¸m+þ¶ø¶ý©>þ½ØRkn„´VÁÁE.ÉYSssF‘kÿ©Tââ.ŸŸ3hÈŽxÒµ¦ö–Ñ9õd¨HÎ6
+á]ô
+ØI:ý}Ÿð…îŒr\Òv-`÷’¶­»j³œ³·í}
+]rSÓ|¬U]Iƒsuoé$½9¢c÷U¹“äx°Ð¶¾Ø¤Û‹«bÜIÅQ¶?³…á6.S¼à‡n|ÑG{×BõwK�¢»™(‡§òq°4N�qéåé»iÁ;í¶¹öU‘PÈœ¯æxÊ&ô•¤1S¶2�ó¥w\·+zê›DJ´�v¸$ÌLßòÈîk>^µ².L±¿²!ð4^¸“PÔ¿¦.¬äïŸ(¿'Ú¶£Pb¥i‘÷êzÝûDUoÀõQ
+0E†IÃZ^ŠÿŽ¦Ö‚0›2%“ýJ§^ˆVÄÉk"y
+4ÑÃ¥Ë2š=
¥«UkW3G­{—ð̪K¦¾(ÞØ–WŽÓÓ�üý®9’ã‘<džâö—ŠäÓ^Rƒÿ°PŠÊ·Zl—›Tj­5¾9.¢"¥³f>89ù�IÆvp3Ý�é9çáCDq
	€¯¹/�W4=¹¶dopso´�‘
‡À1¶¬´’møÚÉ6]ó|"쮘V»ÃJhO5‚°2ÓË�±‡7Nß¼hC;
+®@ê#^>«\×Ȳp‹Ç*,	A_Ó�ðtÅ
âqÙb1?&}=Ä2ãÒ]óð€ÆžoÑG¡PL.]Bª�¢E3ý7z®Æn¸c<®žepNwd¶\ñú"¯kÑ�;ïX¨‹ЀBgN}®²ûàóÃÌ�òhkrŸÀ¶Gâ{°l:&j‘ñ™û
^òÕPkNÉ«±L�Öñü«DÙj‹+Y9‚dÌœòÖ„Ê—6<€ôVcŠ§‹Íš‘Ýþ³¥SÕsiÚÚ¤Ûò>vü[Âë
+Ð"$©p@�zŸÖÐGƒ›‚·^_fñžtDPiÂñøËɘ.yÖÆÐó†·ÅDã^!¡¥ 1âóÜ,óšªiÖc.â4£÷LÛ}cN6\ÈÛ�Ð�C•Å?ÐÖÔØ5÷Ü tbgipO
‹¹shÛtƒt{J'uYÌ„ÕÑ’Z6è�¬wßù/NÐÈy0¬Ö‚;g‹ÖZ0….R;
+*Èí­´âT¸žfWÓ�3Õ'7)ÔYß=á!`ƒSé‰7ˆv¤U¿È!~{£Ø1�Çœj÷àºßŨ�žG]¬ßg•,½[
W,{ukRÿÔj•Å‚�èÒ<’…æp_íÖ©ÛRV·((þ22ߊvóÇÝl.ˆÏÜs/¬U¡¥&‚ko¾÷ñ@ÆÇÊ5V…jj¬a
`N}ÕÆêŽáOú
+–ÙýÉvuöù‹ª¥'NP
+SèÇ´FÞ¦…ÛÏÎ
š13±©É'æztƒÞm~ ¹Hº&¶Ñ~ñÍhŸŠ�pu¢�h^Âc0xÆ(ë7\×�[:‹¶q¢Íš-µj“’"z¾r§YJ÷-Ù6ÔïnnÔãõÍÌI·n ïS7ýö4¦¦ì¾•ôÈ@؈F9x&«sî|×`pu¡e
F`{i~¶ÙƒË!$jmJt†œ/üaâ\èÎÅNià"û*±z˜Ãt3¬Gs€µ/Yn ~³1&¾âÆ0tYœVáqð(ê™w†—V†Ÿ÷ :·ÉóÇ�otxøí…*˜®ñ§õ‘á#Ms9½C¨9ðtIL�³òXˆ×íŠçÝ€îWÞ«�Ê.­’Âå݇Ӝ,7§©Ù7‚ÆQƒÄéèd`³Ú³“t÷¾k
œM÷ûx}Pïïo\5�Ö÷ôC§Ÿ®Z*ïÏkm Rã̽oÙ°?1DêñeÄ'ŸÆ à6…©jb6LÒë¦Xšá|—?÷tKÒ:6™Ëühï;¬p€Gˆ*z µ-Ox—�
oÂܽš°¶çÈÝÔÆ	Ñb„,I­£±½é¸NiÉõÇ{^èd–PL[‘îc±Ø™Q¯dZÃÙ&ËŽA¯î/Ú;�!òùpÁBßÙs�ÝO‘΃3ײ³2¨%ÖuzøÄ[cé‘Ù§‰ÂïŠRfUÔgçúW·­ºì;§Øø8ÍLŠ¨ék˜"­¢¬tµ2¹ešòK¬ Á¾9c$rMe©€€Ô˜6T¡Ð‘1­QçTè{O–ÅË]Ñ’f³ÕÓ9�-©þR[0£Nk¾·ýµ�„ŽÏߨNïçÂ"?Gw~\“¬…XH”ã\�lã¼Å_¡’”*G�wQQBÁ9+§ªÁ¤�Â¥à(-n›_Òx3“mì‚gU‘wµé�íâߪv6ºÈ¯pÓ[óæ¢I´2Ö6ß ‡
×ÇëŸíI�Gûƒ—e<ªð1}xçªÀéž~ôá*@O€ô…¹É¶s—ê>‡Ú{#ØËz߈¹ç!žå<×Ó‹¦g=‘Ñ�GHö'²Ôe	ȱóŽõµ“:…Ÿ‚ëR,q@�õû´ùüqhŽN\VeÆdh�„ɘB™Ám*QZ!cJeåMj…Ïòá#éå8;¡H‚
+¾zT…¢gôOÿ’‹Óo0-šÎ०²Š˜hÈ�›9ÉÈ%m-ÜC7‚µ$©OãzAp9%mëƒf7ìÄîâºÞNÍíOKB¯Wˆà/°´e¡ìÔáo~f›]{ˆðEŠ˜*ƒ�ûN·G®²ÎÏ«Eô[‡ðQðu1ªÑÃ(X²ÁZû¨Âx5¤ 6™œ¹¯$ß's.1߬)Ç^r‘�au5nUG‘áŸÕÔ÷TÁzÀ½¦¬ÜÌ
lé�Ldi\”aÐZj(ô ¬õ\œñ,ôS–W2�ƒo³‡CÜ�`e­æí㦃F$êuÆ�z�{†ÂÎK!K#$
+bÉbðúuÙ9ðeÞWsS†ÚINñ­E$Œc�D3>ä:ÝÔ%žÐçIr<Û½;åµV}$1â°ðô£õmõ“¶)L£BòùP-PîÀ™ÑD|=ÜF—dã;õ…R^jºßsÒcþRÖ'šîϳH¥¹¼+jìF+ò˜ªB~ÈCgÙ5ûë	€UÓ(6û˜Ý#̼vÀ£Äòq¥þ…äž“ZrtjŠo�e|‚+ gÈb
�ÇXxÞÈÍGŸÆÜ/bøc§èüv+ø²òkbˆ BFÛ;l'a¡|E]éü×6téC¿×0q‚M™±I0êÇ`ÇsZ+£.ÌgŠÊ)ùcs³½-ãVé¨Ý³·††²¼&D̘ô”@¶Ý”ï³Oœöø]¥ÿ]ƒÒ˜,±Î
+qœ
+Çp\=Nü¬4··
+d;uÌ’‘ÜsÛ„÷_]e pxßÁÀ:Ïhâ�î|k±·¾ö'nTdÇ2å2fu·0¼e}XÇc*IÃoô}xFe6;acÑÈîXúúË¥áær,–êœh¤/º9;`©®GÅ–°
�,ÓH>%Oà"û|?éJ3iὓQ!Efb«èDCõñd±Mðhˆ–Xµæϸ­6ô#ñ†l»È…±ûsLóæßgél;µñÌ#%
+‘¼GøCAÌÑð}¾€¶6Ç¢³V»þ\ƒ	diKB´«Ù�Qïè.§~Þ‚´ÈÌ=ìäm’yS$ý-Ñ¥ªŽ¹P‚�´)keÅÓnM¡Gã¶Ëu·5%¬_ØEçMŠKÒcƒ†Œ8î5€Ã|5wìóµ Ô"öů£„²3ÇŸ�³’œVÉ÷
+žóø.Ѩ\éd¥(š˜>¯–LãPÚ Ôš3,¿Ô16še¬»Û²˜BG»O�åÜÏænP�ƵW‚®eoÁP×½'”�@çßÒKLýº-/ÞJ[ýŒxw]öG8förˆVƒÉsvÄþh;Ìšé£HÛF�Ïæ�8w&_a†¶j¡ã÷q´r©
Ý}~9ÃQ‡³¹Ã
ñQËöš‚¸¸ÅÒRŸv7Ý/샃ð+B­gN2ãâjÒz	ÂE‡`õfQ•8{Æ
Á9û»¨½qN5mc¯
gÀ<Åj½`ž@.vS;눂DÊknDÔš™˜�±ºO�ZÖµÜÑ–HJ”ää&¶[óX=
+<ÊîòÈYŸ­ØìZ
Ê£÷íé™ùÈ�TxÇSêhD¯Óe{Ð’ÖMÂÒé*�’­D#ôTtهͼÔ<~WêšÏ¯,Äѵ—úHLÆücœcyµ¼‡ÅÒîÇ<Ï	EÇvž¹t�ú“H;:±[æ¥�@B³CoјI3åÕŽ+´s«©Æ?™À“0�”VðÍíÉ ¾¹Ùì�ʃ¼ãA�œ'7¶ÆÁ&¢GL6öÝ¥
+Õ.¹YO¬êªœ©Û×™¥
o;å
+ˆçŒ¼™¬ï›»E|ÜÌÐðXuãý–üÂ˨µÎ¯ˆr ‰¯ûV™�ÆZù
+ÙòsøeìÕÙÂ1Y¤t�Yv~
+³L7,òH
+É_AWš…*QÙk4‹†ÊSgïë}“æý
ÝH>•b5?þ‘ÄœbÇ‘þ[½²%?QÃÔu­2NѼ5¯|F„=ktåÂnïìÈòæ‹ô'†<³Ç‡_Æn|Vœ	“mpéU÷YX ­|NHô¥kÊ rO6ágÌf
+SS˜K"
+Ï~~C®x®'ñ0yÉ#ñÚºƒ.UŠq/öÑŸ˜*Îö¥ýµ4Çï`àIm­Š´¦Ç”Ní.zßF6ù‰‘¡Dž³�¢,t°Í(¸™8é±%iXK{Ëlò\‘Vñ}g
x7wÏbðb¬½‰jÁ½`û'ü�Nf ÌB Ì´Ð¯1fBÈŒ+%¹7¾CäKvÇÑŽŠ¨'¶,³jvZÛÚ•¢lD¤È½Å‚…U?/rªìuGш¤59+òúøF´'Éûu£÷ÁO^C.¶ºó×?D¡ú
+Ë!«O$!*_—‘}	qufÖä­2¿ÐAQ”¤ÂâWH,‘Z8�gm­ÈÞ¨gA‘¸¶vaõÈ”YÖ¹›‘k (
+á�„%F<5Ÿ�¼K»ç´Åö Û3Ó΄ÕÁŠÂ~çD7/âšÅ	Œˆ¼êÇ™©E½ŽîûFí<gðSL2R\”˜um’|Ø¿I"-‘Ê�Q:‡‘w˜°ƒ„~U—ÒÛãäÚ"(ùy—k1WÀqr±·}§MNÉðÉ�†a0’~åBnJèÔ$¶\
áyq!~Y!Ê`Eõâïá$ìµòs¹íÒfØT\à\þL
+Pb”<pÂ*1oAjV±üVªñÖÃÚt”9oÕ H½”8OÝ#q‡æ€ÿ÷	ŒÚ‚€@·äV�̶xxOždhìQ[Îÿ_¨£òDà1Ös?õ~-e^¹Š‡ºêëé¢>3vŽ,€
+Ôù´6Š8ä­ÔÔs‡ÎCý—
ó<n!äö™…ãÖ…T«Ðùê“—J8R…’Ðæ(Qå|?Ç:¹6ê<™úÈüÙ:ò‹G8çü;k»Z[·É}ñ b¦ND‰)�Ÿ_ÚT jÄØ*à+5µÐ.‹j´aµ”n^@ì]•yE}±Ï» Ÿù¬w©…ò;ô'ÓÛéû#N䪦(…Yòg�v�ì™%c·ëµIˆÛÖ$J×E+¬ÂVbx*5uÃl}¦öKZ#Èóq%ñ­Ü72ŸÃ‹øiXu€á•©~Öá
œÑð\?"«§Ó-ªˆ„ƵKÑQˆÔÀMH@}ÎîkVÉP" ñZß4l§\Ê7w'œˆ£‹cÝj“Ô½?P…qƽ¯�ÝÑtךY{;¡8FÒ£N	ªÛÝè&~GýI¤ò’Á-M¦Qìb
pÚÀÒ”{»äüóMgyôجؒ/9…Áj(—¥x1ž}*Ú•ò£"jðr„-!…ÎÂÀ=ûð$eþš‰¢©c@“ Ÿi.��÷Ñ6*äl
BK±cn
+‡fð¦ZUiÎã0$¿Ü|MïШC¼ìí29†ÀeðOµY(FŒÔ�³ù-^¬–ŽŸ>Ó:2±èë5/•l†%†ÖhCÓ˜]¨w'hX6Í—¹Sº†U¬Òú|“L�AÒÁcçpÏ:i³ˆc¤ÖûúÆIX—m¥ù|(Ÿ:²�zS¶ÃÁ˜¦ß–ãòßÆîÖjb-�­
+ৗÛ"ÛX›?ÕSDâJªÌGú¬Ú‘o�°Ùð¤®÷ÐȳžñÏKv×F$-ã`÷5
+a�-‹Pšê�Êi^(5aò÷Þ8œÆ—†rmëÜ0Û™//UªŸÑbVPp©ûÉ`i.‰ –§Á’¤Þ¡áû	ÇÏ�º»ijì‘"f[ºtköÁŠ”È|^g†Í„ZÏš¥2ÝDÜyÓ—À>ü¶6•thâàoì\Á
+z¤ûŠâuÐyçøé›1irÝžã‘é£äX’Eßa›×ˆÕÇ“;˜/¼’>ì[ö±™³FcFÒªgãö‚á‹©G
+oL1MFr-ÍŒ™a=áÖVVF
ÎwÎ¥Xߪâs¿Ü”<¤Ómpö{g~ű
+Ϊ¶yY5Tl�´«œ+Ã2Ê$WÄ0�Ñ3˜K_Óm£âç¡^‚Ü<çëþ,�õ˲
šDÐ)ôà”2Ÿå\[EªâW&Ç'ÒN³…Í(JJÚØ~;Î×ÚÍ+噞¼ULJ;Œ¤3ä%…Óô
X¼©ê+ÎbTØ+E¸¸Ä	ßpzeÅ^÷.Ê“ îìÚA–£Ì‘lH¸“iM«™Àþ(ÊnS1¢e…•,vû©œ+½Ôä0euT¯w}Ý.8
+^ÝúãÝ9ÑF˜.ÛgÛ«q\V�ßr_g|œx[D&w—=€wÑ6ÊÐE�’tœ>-LEøbµ˜öbo…ç
m»7oÕ–7æWÀG»JáoÔbÐ5z^oDB°w\<à /r¸Š\רrRjþBõ�âÿÂ�èù!&†Žh„Ž6‹$˜WóˆB-3ã½ä�—K`­¼ò‡‰”zó°™ò‹N`zd åÇB™�£+sÕýN<‹-8�‡òŽ0;ë)Eµ&Ì.P¹$ݾM€ñ’@ݸ¦/Ã2HœQ…„IJEzïe‚q™ŸÑzÆ-tàQÍÔ¤rÆ‚}ô˜8kí±ÊäXë‚ël²iÀDâñJ”FR‡AÏŽ-H›2²ãXÒç+Ý"Ã�ð�ûÍÓšÿ+;Wó¸_G±.OÒxè"ƒ%u°¯“¿>Wû^ï.7 åòƒ  ž0ôuS¼2 ©'w²áÁ™ãi¨šFNù6ýUv“-«>]
xñÕ—*æ®çÅÔv‘?‡Ýâ–Ü©.M +0·dæ´ëžÿÇTcz¡JÍÜæŒ.5aö$¿¥Ê­°�D
ÜE…q3„f›ÊœÎ.lªdX±îÚûp}�˜•7M“ÈœÀÓªkQ4N5Åç­-…@²!G©¢6š
VœiˆR7\ÐMj„dcäî€doû4�~<”Òe6äm?Ð0I×�€ŒÔK›ÛS£ò£Ê%Šv¥Õï^+„¬Æ³ÒÛø!&à1:¥Çã‚'„D=ìà«&€©IãY
¯€äÂWƺ¥„RÒŠHw²ˆsë.üÙ­gäè÷mïyo�µ©ltx�ebmH÷fïêïo&Hì*âj]
¦Î¾kÒrX›0 —
ó=ø^‡,›�.Âõ˜/�Z—[’áXýõ~™?4ÒdÈÅ7�
€äñq´¤ª^JÙ[K™†OøDÊW÷ãº�ò"îf/’’u.3éªZšœ˜­9µÀµ”…”Û±†mùlË—‡Ï³'´4/Éu×µF�±‹gGŽ‚Ç;`Žøç:í·úGj¹ÃÊH‡Íi¤Î@É÷²ÇÖiFèÅžoºÃ‹…õXWAú�ŒF˜g	=çÇ$¥�¶¸i\üh¸Ôè¢ë9ÃËñüw<d;BvŠÄŸ„Œï6È™*cf[š—ÇImAÌžëIdM8R«DVUê‚ú�x×aÊÁ]Ÿ±þ%ܵ>¹UÇüv"¢îjÕiÐS+�4ã%⎩ñaoä{Zg=!$Î3å�õ1'Éê\ªWä¼sÖ†Ílâ4,N9Ã4¼�½þÄ‚;w ½'U‡z~”Š¡+É6ÉÎù¸©õ—õ€ðËÂT‡4çjôA¢ÞŒ Ó[‰ôïq�Wűd‰¶ÛŸ€¢Kªî1šÒÉ|Ö´øÐÉøKœ-`@XƲœ»Þj”§§¡øð©Öµ„ËÍñšüÀ¨ɯ¡žßÒ
#ZVöÏeÁr²lã[�cѽ·aײ‡xþѿnÊí"p¯½6Ö8wK
+†‚™!Y5ª¬h›Âø
+Ü`¹}ÊWÆÖý&_cWs£åÔlÓ¿›
+.«þvÐŽ–%u‰ ¯¤’¨]5�H4�Øe"›ƒhQ‰‰ôM“ªRM-D>í¡)rüˆ(Ëê­©è¥ÔYÇ9ÓQHŽÝ\(]
+Öð5,(x	J)ÜÀÞÁg0ý{wýçêŒx”
+Ô&‘#àfîÉ×kBq‚ÂõÅ{à1æˆè#žw­KH×\’Ëœ!w[‰‹Ë)ƒ?q[ø,YçÔYÿª²‡¶Ë•:Žè“tG½­3èÔ*þmèÊžÜ`m
+(¯-üü2ÉòFM:ãM¨sv¶Ä÷Эv"¥}
kædJî
+×cºŸËã+DoÇ–ãÉ­)ýe¯¶ôŒã¢—WÖ™eBdeìºf|íö˜-Œ‹Zw�4Vçvž&Ê=®ýÂ¥H‡,d|Làâ�3N‹'¹²,šK°#L„Ô]øm³)n-@Ü´¬N&…¬$ÿÈçÃíKðt|]Øl‡¢ËJ>h–
+’9„©²Í¦i=ÿ¨nuþò©­'x¾N»˜4Õ0
7<±–¹ûIíÓÏÕ=Î)iÇN{à$dQñãTË0¿§h¹kÝçµùÚÒ9äó
ÌèÍï ¢ËG¢�$éðf+vHÀÑ:ÓÝ&îûAoР`ž®³DGO?Ìd¨Î3ìŒ+Â̪Y¢ì'Y"-¨öíG3qŸZê…[|i<B‡{5mäš
i’ù%ù—	DqërŒh¤c碫Z´�BÁGE y"Ïž·Ü‰ü¼ tu¦…³´Ü¸ŒHþ›Zó-%bˆ9S‚®;…þŠG‹ŽÄÇ0¢æÑP±TôÕ••¿|P(×ïVŽ38áôQ�ülõâóüý÷}ΦPÔÃsM’È6¢±dRŒ<ÅBq´—áHW¡°XŽ0ÌQðê5e8ç tKÌÂÔ«UÑ\XîH£WƘŽ+úe@Ã\

+~º8Çùˆê¬ä{„W<:î9ëÏaùÉ
+–YæikQ9èúÞÍ…¬Ar¢$sCK¡¬+ÏHbw­ó¯n‘aÉ çÀ$.Š_ºœ0‡âÐ~jîI²Øˆ!<Ù3<í˜mÐ×µø}ãuÂgü>øb£HÇß·¿lè t#æh'¯¶ßk‘¿�
+ÎòÑÁÌûøjTL,
+gRH`\Âê‡%Aþ‚¸ÿ•LTa†ø¤6T:ùQè^·.¸Ê´DYAž£µ$À<ô{ÃiçŠKl¿XæŠÔÄ%ã»<ºr£²‰ÉÇI§ßðÒ÷®ó¥©XX;|¨‰êbuÊ	X‡jÂÕX£Ô†ØÒïI7Ù¡™
G;³*‡Òe÷ŽnInî‚(¿æ2ÞÅ¡æbE§4!0{šÕ?ÞñŠ”’nô0g™²ä}»O4,ä]Èhö3g"l˜\¡Ì±Óp•Í»6²Z“šÿêŠ/¦¶ƒûeÝ$³®"tÕ¤È:ôƒòõ
‰›îxÿœŒ¥?Àh[MND.ÇðL7|SɶtÑð„ö&øyDZÌû*Gmpr8\UÛ¬gTÀ­X
+h�†“Ì]�õ5ˆ%?»â'º˜M¾×ž/•[C2°‹ð}j…Ž.ˆ&•µ7ˆˆÁ�õÖ
ÿ‰r¸‰*½Æ¡rsC¥‡Áà¼qãl§ž_€Ôv¿vwŒSX�~K™�Ê”	Ç›¸´5"_¢»åz�W‰8L�B‡ôÚÄš+H*Ƃ߯@K„/ë·Á)¹²%Í%]Üå–=È«V,è
­{«RW‚:ik>•HŸSTÇÿÉ%6vô¾ö\áñ-R•@BêÔ“fÊø²øÕUrÇ–÷ëSv¾]õáåG:ƉÐì%*
+ÖäJ¶$÷A­B:{~PŒ­|ˆÊ
©¸/N˜¼wéàý‰ØaÊ9ÕÒ”®òM_u*u~0Ã׊éào‰èX0Êr‡ÖÁÙqh[ýl½®ØÑîáÃe7æMà€;æ,—"íFóTIû ¹²ÐŽ÷_â05#¸.cœY‰]j�˜ª:Ç¿ùö:Qqæ!å½¾iÀÁÈéo‹¡¾{£6jÆÑõ({öû^ÁèéWÝ{ƒHÈ%ŒéK!zþox
  µ˜˜¦°Ö�ûˆÄll¡Y:Ðÿ3ìvz6G0†Ç&QÚ	�äŠ�«‚n‚}uãaI#߃y>g—/¨`.n+/­Ð^q›‰t*+ˆ��âõa+uF¼ý} ˜Ž¥ï>à£jŽÄ˜;â¤ÏLUá�À˜ÍPÒ¬ü“žÖkm"
,Á(\~éGP»Oªt[‚ÜŽŽ6nxf³lTÆíØH�'ºSÍõw<²qs)‘‘Ç~*Ún¥
ÑBëRËÏ++¥È›!®)™øÄ•™þîêñþœCåaIyÃγ<–äxßsG²)¬•¢×®8zÅJäó`ãn©ÌsÌ™æEHœX-zoè=O!�å™B?Êóíwö»
+†�»·=z/¢ÇCï¥ä‡`RðÏ!¤Ù·)žíú!Œ·zÍáí;LZ|FÕGì%«¯ˆÅ�Ö¤H6}+8ã¹ðú¸°ÐÀÑ�/Žë)díˆz°W‚úXƒX¶¾m«Ø½•„»ù5gR›žF¹{‚$³*ú)u\=(Ñ-‚"Ð…÷±,â¢|]ǹý?9¿YÐOØ[L‹&ãÀŸrS*AØ�f­ši
+t)ÌXN9¥D±z¤‰-D0Œ8­àª;ÁEÎ+p“ùhJ½:–Éîföâ}©PýSücd?àó	<ÌÈ“|Šˆîç}®rw‚RÕ:Í�$å·=„~mÉ]]˜RòöÖ„½®íX((—€¶Ä?Éž¸‹e»¿èœ¬ÛXÄ
+Ü�¯*˜Œù¢V}ÒD¦ÿôð£ÎÈ
+}ˆ2àq=G/¦8õ1ÝüÍ/]Z?ó{P>yêU•œµú}éÇ2&@žÊå6Þä¡þ;TÆ
+Ý‚Æo
+©õŠÊ§üyž+¾û™’i†2£]Þá­•\÷¤Mçó:µš•wbÕ‘…Ùˆ×hg¢I��µ#ŒºÛà@ïuJ*³É<¸S!ÙÖdNPÂD )­×cÅkø2æòò›b«ë
+JÎtŒ.a½�AöB¿×n
8b¦”w»VŽn$øÍé�)4Üú¤÷VçËÌ�ŒµµèN‰R£ëÐŪ—Ãÿ×>Y¶5
(QD‰!%ÝH�îfà¨Ñ9º‘n	i’"]Ò-Ý1ºK�Ýݵ÷þ‡÷Û}îù
çÃyžã•�”4|œ"ïñ`Ûý]_€ßÿ¼�ݲí\£$«:ê¯{¶F†Æ»lìÏ3¢?ÑL$G@Öóå×vmôãŠ#Žª×°tή4ËFIñê\é±¹†òã–ÊcLÏBÙðn¶²e™i¤ÿs;<¶ ¼ÿñÏ7JŸ�¨ie/þ5÷“FàEZUuç!í¯îðœJMþ•³ŽôÓ�	}Ëß–~¸
 Âòé€z{JE‰FªM Û„�u–æG0iž³ÍÀ†�^µYkúzþ'ôÍòH¬n“È([ÒKFR}ÿ^÷ôdk
 ±5b�$ßì}Cd%#vﱓ*š°ßÉ
‘ú°»­¥8hñÀÜ_Œ»Ð7¥U½2f
 b›oÒm÷ãÅY…½jãnQŒ˜�fýÊm½­�ªm&*þ8”Èç1|ñ˜a¬~– F‘«•¢ûÎòXQ;(_ÆSI0ü+p˜ý&�á¸$BF
@@ -9033,23 +9093,23 @@ JÎtŒa½µ~öB¿çn
8b¦”W»VŽn$èÍñ�)4Üê¤÷VûËÌ�Œ;µ•èN ‰R£ËÐŪ§ýÿ×>Y¶5
(QD‰!%Ý
 å�UÔwUMõ»gÕ"&
 C•Á&ûA×"4ÂÌ]iÅÎ|,›ž(mÍ…pêÖ.‰ý³oRŽÕ]¸kŽ¬¢PÖ¡ZÛZŒŽT2Ê©‚pC¯–dô.Rn®f™7£žØær
ðk®–-!OõŽž1t¿9~‚ó–�‰æ·q¼mxYæó”9gK’}ÃÜÕè×å HéÏAf™\pCÊˬM‚._óBâÚjq
À¶]qL÷‡Âa¯¡n—ˆ›´¢('â¥&Cv­pñf–¿�‡OFÙ2ö
 # ð:øF(‰¥YäsäLèÆùxÂJßÓ%ÌgæÂîˆñe:‡¯#0®ÿëÊ»3¯‡óíLM¤\“wŒgßRkHäŽÅ_KØwÓªÂìni–ŠØ±
¨wŠlNþjsßÑ8v<o¸ÞâÖ²ãU8^ë|Wš�
-ÆúÁÿ%ž†ëÿ	öÿÿsK¨«»³#ÔÕûÿ
+ÆúÁÿ%ž†ëÿ	öÿÿsK¨«»³#ÔÕûÿ
 endobj
 879 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1930 0 R
-/BaseFont /TGOVHI+URWPalladioL-Ital
+/Widths 1939 0 R
+/BaseFont /HZZZJN+URWPalladioL-Ital
 /FontDescriptor 877 0 R
 >> endobj
 877 0 obj <<
 /Ascent 722
 /CapHeight 693
 /Descent -261
-/FontName /TGOVHI+URWPalladioL-Ital
+/FontName /HZZZJN+URWPalladioL-Ital
 /ItalicAngle -9.5
 /StemV 78
 /XHeight 482
@@ -9058,7 +9118,7 @@ endobj
 /CharSet (/fi/fl/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash)
 /FontFile 878 0 R
 >> endobj
-1930 0 obj
+1939 0 obj
 [528 545 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 333 0 0 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 0 0 0 0 0 0 722 611 667 778 611 556 722 778 333 0 667 556 944 778 778 611 778 667 556 611 778 722 944 722 667 667 0 0 0 0 0 0 444 463 407 500 389 278 500 500 278 0 444 278 778 556 444 500 463 389 389 333 556 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1000 ]
 endobj
 862 0 obj <<
@@ -9070,7 +9130,7 @@ endobj
 >>
 stream
 xÚ¬·ctåßÖ&›£’Û¶mWœT²cÛ¶m§bÛ¶]±*¶­[ÿsºûíqnß/}ß{Œßšxæ3ç3×c“)ªÐ	ÛþŠÛÚ8Ñ1Ñ3räÍ­:;ÊÙÚÈÒ)M�
�lpdd"@C's[QC' 7@h
˜™
L\\\pd
-ŠšRò
+ŠšRò
 P7É;8hôJÓÏ4¢<¯e·!´ØÕv'•”õŠß¡¾Ow°8À\=Qù‘¸ø¡“>Ú!ù¥ÖÇbt¢4‚|«-<=#O<~z¤ê¹�ìÛǣɉ…%ãq�@$�ô³ÏÁÐR«ð§‚JoBÀ»i¿ú$ÔèöÔË##Å%�°–}U4Í_³i—}O‚LoàM”s�lݯü�y=?É+”8Í5—ûµîL&æˆÅÛ„?Ø;kI8“	]O0ü
 ôX‹ýv5�FMç|.òöZSª‡æâû÷eµo®ºG¦�|ß^£dìfÈ婯?ÿxñ¤}GðrçXQ†�•¥ïí«°nãÄ"‘ìv¢t³íg•×ÛudkàXþæš1­´¹û±¢þúgÔ\Ô®:è'&
 yY·ŽeFÞÜÉe$WemDGóÒaž@²§—ñqfS–ô6BÙßõȽÒU?ùÏ ž�RÀ=²ÜçqEË4|Y²Õ7˜Yàýe•çŠuóL*”ÅK	ãŸ	$HÙU&�Ä–ÒòÈõ×€®8ƒw}_þ×ïÝ�k0žGFÔÃó'€r¥wŽ—m�­ølËsöxRxÏ¢ªVæ±Y�D
@@ -9156,23 +9216,24 @@ eËè2R¼ÄûÛûyŸ?à	·Cžtж‰ä€¢rªØt°W¨ÂÃ^Ã>
 ŠwêˆVM¤¬Èôv£äG�Ótøu #£yå\x¦CžšƒÇŸÇ˜ZçU.æ�@ÈÄôÄe²˜=æ÷ÉáyÜuù^é"HÄÇ׬íôœ™Í ®h;@‰¦$ˆ;ï¼ã>ÛL‰†¸æVìP¤ýÄJÍÏD{¤>pV$QJ¬©ô=˜Ð9Úp€Õâ«ùD¤å0ù_‡b>éRêVtÃÖ ÄM
 Úð­,6äX€qÐ-}nJ®k^¨£ô@l€¼ÜI>Œ˜×TqÅOшتxín°úâ…õµ4JÌäÅV�kw¨Š‘þI’€¥¤\°^0Vò˘íep«%"h*
êm�QôB±Ýë“ÙÏXšEÿ¶Éµú0üöA•ÚªÏPbÑËöê6EL7‹:Æ6
 ϥ
-mŽ[A±Ræ¦ØíŸeµ1£¿YÝÒ~kð¢�|Xžë,|@î~èÒ<¦maöè“žÉGJPòíRWù˜ž‰P	ŠïMÏÜ£Ëÿx½qì’‡î“ü\Ÿ,³›}ÛÃë½E#û¼ÐÄ!áosA8G'Ñ´2›_ð‹¿Ào8�V  qqML2ÔËÜIVœ�má\©ü:’P -wÇrµ?
²T§‹ÏlKðKáJì}Z%=�|Ó˜~¹´ê¡¿QL-jÅ¿Vq†/¥ökåàM×±Û÷a”÷1•£Ôq/dWµ8Ã
UnˆÇrÉ•Ü	“6ŸùÙ¥»R̓AczCËSåã§
+mŽ[A±Ræ¦ØíŸeµ1£¿YÝÒ~kð¢�|Xžë,|@î~èÒ<¦maöè“žÉGJPòíRWù˜ž‰P	ŠïMÏÜ£Ëÿx½qì’‡î“ü\Ÿ,³›}ÛÃë½E#û¼ÐÄ!áosA8G'Ñ´2›_ð‹¿Ào8�V  qqML2ÔËÜIVœ�má\©ü:’P -wÇrµ?
²T§‹ÏlKðKáJì}Z%=�|Ó˜~¹´ê¡¿QL-jÅ¿Vq†/¥ökåàM×±Û÷a”÷1•£Ôq/dWµ8Ã
UnˆÇrÉ•Ü	“6ŸùÙ¥»R̓AczCËSåã§
+endstream
 endobj
 863 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 33
 /LastChar 125
-/Widths 1931 0 R
-/BaseFont /NZBOXG+NimbusMonL-Regu
+/Widths 1940 0 R
+/BaseFont /HXBZDR+NimbusMonL-Regu
 /FontDescriptor 861 0 R
 >> endobj
 861 0 obj <<
 /Ascent 625
 /CapHeight 557
 /Descent -147
-/FontName /NZBOXG+NimbusMonL-Regu
+/FontName /HXBZDR+NimbusMonL-Regu
 /ItalicAngle 0
 /StemV 41
 /XHeight 426
@@ -9181,7 +9242,7 @@ endobj
 /CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright)
 /FontFile 862 0 R
 >> endobj
-1931 0 obj
+1940 0 obj
 [600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 ]
 endobj
 746 0 obj <<
@@ -9195,7 +9256,7 @@ stream
 xÚ¬¹cx¥]³-Ûv¯ØfǶm¯$+6:ìض“Žm;éØè°culãëç}ÏÞû\ûœ_çÛ¿Ö=kT�ªY£æ¼îûZ”¤ÊjŒ"æ¦@I{WFV&^€†ª–²‰­­‰9ÈAžQÕÁÎð×̉@I)æ4q9Ø‹›¸y
Z@s€8ÐÀÆ`ýúõ+%@ÌÁÑËdiå
  ùËAKOÏð_–\
 ø›UY\òßuºZ™¸þ“Ûô8Xüõ4w0sûgKÿÂþÒüE]M@ö.
-`abû·Wÿ²kØ›�mAöÀ¿šþ«�
+`abû·Wÿ²kØ›�mAöÀ¿šþ«�
 ™**À)—PHW£B¢ªU³m·W�ÛÔOrí]VÉ• $«ùqyĤ"õÂzŒf<0ëûë£Îðf}/Ÿí¤>bêFè,VØUd‹ÕƒæÔJlNÍo’©+¬O�XÏ1Ï-¼§c-NÂ1ipÝ›í\AÖ
 úêì`uvdé,RHžê$žkK‚>&Y	¤ºÛ”OØ&â„o™kâÆœm§Ù WëÙÉ
 ¨œ/û«Ð[BÒó´`Ûtä¯äÍN¿GfáĈHªýmVéDÇÏ“Ÿ�”Ä÷¦Y_kÉóÍ+èü1pÇÒ¨å�Á³ñÂjD•jÊ
@@ -9257,23 +9318,23 @@ MIª\ÂuTØjGI-gý�ÂÓ–GâydføæÅxÃÃ,�oÛ.رÌ*�_ùSÕúƒóØCkëÚ™­¨·>]ÙrÿÅ:K¥ÓS%œx
 ¿n$rÝ	Xð�D˜t
ÎõÓ…”2§—n„sÞmOÆ„
 ˆ;²ÃßshuåU9ñÖ�&;y-sõP~K*ªÅz4rnp´�}ª÷œõ)RB—+«å—>¢cI£Ž¹w×	éhz€Ì\mm £MúHþ×<×|Ìï­&‰� Ÿw³s£Üë+\?VË´<=yò‹ØH»M'²ñÑ67Cøoí+A5x5
½·x¯'_Ë
 c!vÜ~óÓ4¶bIpµP]ãH^ŒúÀnkLßYßÙ„æÀ,•‰)tCœrÀ‘Çi†Ï±m$�hýÈn.ÿ¶»öO¿ªWÂ[–{OFChÓ'ž
WùÆ*6L‡1±’g^H]u Ââa3ð¸g@—TÕL_1@d7¾ùÁ“†µ�‹Œ:…‘XF.ÿ§�Òfb1\ÄñSÙ£�Ö®TÁIS ÒŽã{9.´ v´ôPš_$ƒºÃ™.T€Áj”¤RÚ.z�àÂiXÎ^;-”ûkwå0HMKyÃûSc-‘tkâôk'a.*bí	Û¶4ŠdÇ&ž*qÉŸX‡ÒÝÓä"c°4	*+9‚3£
 cáE¢Lg%ãŸïÁó§KíÚï©=ëg‡~Q)œu‘Še7@ô`­¥¡c˜„s2¬ìe/ï´Ã÷
5ØI*·[ÔrH�îD4;"«hntRÉ´c¬¥ŸýÝ„u å{ÿÁØ}hë 
…
-¯41¶{ºQµÚâl·Pãg;‹($@
QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
ä­ë6Å͆ÇIjË‚¶{Al ¸¸
²œísè¹”Lª £ÈàýÞùqœöÇ=*Y€þK
+¯41¶{ºQµÚâl·Pãg;‹($@
QQ~:ú4¥ /麞e„¼æª't“Ê>~œÍÆTÂ={š÷ÈcW
ä­ë6Å͆ÇIjË‚¶{Al ¸¸
²œísè¹”Lª £ÈàýÞùqœöÇ=*Y€þK
 endobj
 747 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 40
 /LastChar 90
-/Widths 1932 0 R
-/BaseFont /DISRUE+URWPalladioL-Roma-Slant_167
+/Widths 1941 0 R
+/BaseFont /VXUVES+URWPalladioL-Roma-Slant_167
 /FontDescriptor 745 0 R
 >> endobj
 745 0 obj <<
 /Ascent 715
 /CapHeight 680
 /Descent -282
-/FontName /DISRUE+URWPalladioL-Roma-Slant_167
+/FontName /VXUVES+URWPalladioL-Roma-Slant_167
 /ItalicAngle -9
 /StemV 84
 /XHeight 469
@@ -9282,7 +9343,7 @@ endobj
 /CharSet (/parenleft/parenright/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/X/Y/Z)
 /FontFile 746 0 R
 >> endobj
-1932 0 obj
+1941 0 obj
 [333 333 0 0 0 333 250 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 778 611 709 774 611 556 763 832 337 0 726 611 946 831 786 604 786 668 525 613 778 722 0 667 667 667 ]
 endobj
 684 0 obj <<
@@ -9294,31 +9355,28 @@ endobj
 >>
 stream
 xÚíUkTgnõJÀ+Å€€¸
-æ2�@	Š,š–K
-x -—úÁKæ<`_*\Î2$�€Ïv`€
-‹$‹g‹ÿmÍåc#ƒaÌÆõt!l§Ä�ܪ¤ò˜ÏÎÝþþ’΋Ö
-M�v“MLŸsÔ—zÖÛ,XR2R¤ºr\�U~Îv:©�^6J÷LûrªXÿ•ÔÂ2ÿÌ8j#±Û™�*_õÊÆr„¡ß*ÿk•1­}xæ›-[{¦¶Ä¶ê�å¨éÏ5Ìté®·ö9am¾Ñ¡ç¼vÿûð‘ý�;6OÔÄæ^ßοuÏ�ÁÄ‹ÝR-•\gÝ )hæŽÅ�P*m¼‡]šïªUG9sk½ÒdOLSÌ“-žµø–ɦScŒ£¿¦�¿“2š^4ý•—®Ñ”~­ÿ¶"ñºŠ”·»ÁÔݤõ¡-ïåÆVOùGÁä
Û‡kŒÚBíû¹L~­ÖÞXó¼
-ͯÎ1Ýõ$*ü»ºí³ûðéG‰_T�:ð´¤N¡ÛUg
-éø„5
÷Ô+ÔšS&a´{
-Vù(±¶ õü¯ž;
-TÉIs›ò¯5”ïØŸËhòm~àplÝLãË+õ7•Ló•¦E½óÅ
-ða�søÇÔ3›½ìÇ&³h.y�‡Båãàèsf?|uX=°:|äçÞfCumíáS�I~1îæ³m²äÓªÉõÛÛºÇwdy=bœèýœî~Z«oV¡³2±,†ÓRg‡Æ�vÍòÑê‘óòWöä”sßÓ#ÿ‡îÿ
þ'`W7„J!„†âþ'þ[endstream
+æ2�@	Š&X4-."(R’		$˜$ \(PÁ Bå"Pi¥´^€ÊÅ`EÁS#BAn¬\uÝ
ôØ¥?wíÙ™?ó>Ïó½ß3Ïû�óY˜yúè$vEDHi€‹»Ï~�€D2ÎÂÂ…!	í‚$0

+àÀ\ÉÁö‚1'ÿ
SË›»JH¸Ð~1¥¿ð��/ˆz£@„áR	ŒîFEË¥~ð’9w˜Ã—
+—³L	$à³é¢
@;"Ù–ºDðÅ®|ÌñäKØ<€	Äð"‹8Ë­`ñ-!íbyøîñ±y3×EÒâ‹${£Âa€üN½Xƒïj,%”/ÈD2Ä„Øûö+pÙfŸ‰Ø‡/
+
(T{
+‡� ¬¢1 Àq`
+T©)s‘›ò¯5”ïØ—Ëlòi~àpdÝLãË$+õ7™•žæ+M‹zç‹+
 endobj
 685 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1933 0 R
+/Encoding 1942 0 R
 /FirstChar 13
 /LastChar 110
-/Widths 1934 0 R
-/BaseFont /FQGISL+CMSY10
+/Widths 1943 0 R
+/BaseFont /DONUHS+CMSY10
 /FontDescriptor 683 0 R
 >> endobj
 683 0 obj <<
 /Ascent 750
 /CapHeight 683
 /Descent -194
-/FontName /FQGISL+CMSY10
+/FontName /DONUHS+CMSY10
 /ItalicAngle -14.035
 /StemV 85
 /XHeight 431
@@ -9327,10 +9385,10 @@ endobj
 /CharSet (/circlecopyrt/bullet/braceleft/braceright/bar/backslash)
 /FontFile 684 0 R
 >> endobj
-1934 0 obj
+1943 0 obj
 [1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ]
 endobj
-1933 0 obj <<
+1942 0 obj <<
 /Type /Encoding
 /Differences [ 0 /.notdef 13/circlecopyrt 14/.notdef 15/bullet 16/.notdef 102/braceleft/braceright 104/.notdef 106/bar 107/.notdef 110/backslash 111/.notdef]
 >> endobj
@@ -9343,7 +9401,7 @@ endobj
 >>
 stream
 xÚ¬ºc”¤]°%\]èª.uÙȲmÛ¶]YV—mÛ¶mtÙ¶ºlÛÖ×ï{çÎ�ug~Í7?r­çDÄÙ±#ö9±Ö“™$òJ4ƶ†@Q[GZzN€Š¢š¼�••�±¹­4�¢­µ
௙š„DÈhàhnk#làä¨
�
Â@#
-
Ó¿rÐÓÒÿ‡ÑÜAÔÜh,oîhd01°úÛ§í*6Æ@{+sà_=ÿm%€†�žþ¿ù”ÍÌ�,mþi<˸€6Æÿ�û_‰þeN'%£ ©.Mõ¿ÏÔãäÿjï¨ìf÷—Úÿ(EÆÖø.þA´uxÐ0°²hÙ™þ^9F
+
Ó¿rÐÓÒÿ‡ÑÜAÔÜh,oîhd01°úÛ§í*6Æ@{+sà_=ÿm%€†�žþ¿ù”ÍÌ�,mþi<˸€6Æÿ�û_‰þeN'«"%$«Fõ¿ÏÔãäÿjï¨ìf÷—Úÿ(EÆÖø.þA´uxÐ0°²hÙ™þ^9F
 4‚^ùckÄh‘š‘æX‹ž34!¬Õ×Ã
 ¥$T³ØÄ^×âs:‰¿�„³Ó�t»©È i+3«0�€Ö~Z¦Ò‹Áº*ã¹®.òzbdÄhn“<£c¿§¯
 ë³ü>Ëä1os´˜™(ÏÂß_�Ø⟣
@@ -9432,23 +9490,23 @@ Z¦Ûæûa„Ék6kUqèL£%hp—´rÛ° ÍèE–r:-ÃdÆÊHP:ì‡2;P®…ÓêF{Ư<Q,JšãÁ~	+¡h[ÅRN]~�¾
 »áY€»}€cù‡Câˤêðq£þ¤ÂeSê]èûgÚò6\LÀž/*X«–Ü>ДÏ@ÏœüO©ªtºG©÷Ž’4Å%ü’Y×ÞöPðüid‘˃8LÖU/p�„h[×ÿ1õ˜åô×îE¥JP(òCˆ¤‚§t¢8ꜧÝÎQ‹‚j%U×¼±†ÙŸJXµ¿LF-.=5†Oí~Ñ
 \jË9gWØÅ."FˆmßÝÔÇ‘ÓßAÌõ|ˆWj
p7MÐ"Kc20ȧåOh]9J°F®×Ò‡õíTNì)mC\Rà‰æ8
èÄ�З|-	µÂ¸ÅæßËlÏB@\�ë®4Ʋó˜•k™_̦CÍö˜T!Ô½\!ƒÂD×$×&miÀ槻ÁLÝ¢»?a�|ÿ¤þë™ú*$÷¼66ÛëðÞºR¨p`N‹8¹Îs©2õóŸÉ×®aLç%¢)K–9CJN
 iÿót:ùÃûxxñÍš6ïÛ÷ÄKZ·ÏlŽ¸ŠŒbd|Oá±–kË¥þÎÏB�™E‹¤»
-èlLäšOnRZ~‡î&I°=w¦}æ‰l§b””Î÷g Å�TÍ‘ûûÁ{Ë1LxméÌ­�?b†‘Ü€±%Öé]¶çÛ'$5ˆç
}~Ü‹{Á47
ŒCS
+èlLäšOnRZ~‡î&I°=w¦}æ‰l§b””Î÷g Å�TÍ‘ûûÁ{Ë1LxméÌ­�?b†‘Ü€±%Öé]¶çÛ'$5ˆç
}~Ü‹{Á47
ŒCS
 endobj
 682 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 2
 /LastChar 216
-/Widths 1935 0 R
-/BaseFont /KMQZXL+URWPalladioL-Roma
+/Widths 1944 0 R
+/BaseFont /NUKCNW+URWPalladioL-Roma
 /FontDescriptor 680 0 R
 >> endobj
 680 0 obj <<
 /Ascent 715
 /CapHeight 680
 /Descent -282
-/FontName /KMQZXL+URWPalladioL-Roma
+/FontName /NUKCNW+URWPalladioL-Roma
 /ItalicAngle 0
 /StemV 84
 /XHeight 469
@@ -9457,7 +9515,7 @@ endobj
 /CharSet (/fi/fl/exclam/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/circumflex/quotedblright/emdash/Oslash)
 /FontFile 681 0 R
 >> endobj
-1935 0 obj
+1944 0 obj
 [605 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 500 500 840 0 278 333 333 389 606 250 333 250 606 500 500 500 500 500 500 500 500 500 500 250 250 0 606 0 444 747 778 611 709 774 611 556 763 832 337 333 726 611 946 831 786 604 786 668 525 613 778 722 1000 667 667 667 333 0 333 0 0 278 500 553 444 611 479 333 556 582 291 234 556 291 883 582 546 601 560 395 424 326 603 565 834 516 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 ]
 endobj
 657 0 obj <<
@@ -9468,7 +9526,7 @@ endobj
 /Filter /FlateDecode
 >>
 stream
-xÚ¬zS�m]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ92GÎ{G,RBy%
c;CQ;[gZzNE5ykkc;iA;kc‚3)©�£‰�³…�­°�³	'�š‰1�°‰
##
)���½‡£…™¹3
ùõYþ	!0ôøÏÏN'3[²ŸWk;{[çˆÿç�J&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú,
''{#‹Ÿm&îF&öÿ¸¨	ìMm,œœ~Þ	,œÌ
l�zàlG`akdíbü�»©Ý¿Ù;ÚýDØüø~Àä휜�Œ-ì�	~²Ê‹þOgsçr;Yü¸	ìL"�íŒ\þ)é_¾˜¯³�…­�³‰»ó?¹MŒ-œì­
<~rÿ€Ù;Zü‹†‹“…­Ù1 &p413p4¶6qrú�ùÁþ§;ÿU'ÁÿV½�½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfaE÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%
ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþw�þ·Cüÿ{žÿ;´¨‹µµ¬��É¿6üÇC MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìGzZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk[“5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:%uI!MyªÿóFýWœü�òÎÊö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`Dl�ìŒÿ™%g[ãŸñúOÃ?n#GÇUÿuâŠþ�õ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†szîÈ”°Ö@ðHˆ}i£rQ��]¯_zøG¥þGmmÓçW»ÇòûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛd�lTÇ�tº¥°jÑ^7KÒ» š¬ôªÇûS
+xÚ¬zS�m]³eÙ¶]uʶmÛ¶mÛö)Û¶mÛæ)ó”«ëû¯:n÷S÷}Xkfæ92GÎ{G,RBy%
c;CQ;[gZzNE5ykkc;iA;kc‚3)©�£‰�³…�­°�³	'�š‰1�°‰
##
)���½‡£…™¹3
ùõYþ	!0ôøÏÏN'3[²ŸWk;{[çˆÿç�J&&Îæ&¦Ö&Brò²bäb²*b&¶&ŽÖò.†ÖFÒF&¶N&¦vŽÖÿ¶ 0²³5¶ø§4'Ú,
''{#‹Ÿm&îF&öÿ¸¨	ìMm,œœ~Þ	,œÌ
l�zàlG`akdíbü�»©Ý¿Ù;ÚýDØüø~Àä휜�Œ-ì�	~²Ê‹þOgsçr;Yü¸	ìL"�íŒ\þ)é_¾˜¯³�…­�³‰»ó?¹MŒ-œì­
<~rÿ€Ù;Zü‹†‹“…­Ù1 &p413p4¶6qrú�ùÁþ§;ÿU'ÁÿV½�½½µÇ¿vÛý+ê?9X8;™X›ÒB10þä4rþÉmfaE÷ϨHØšÚ0Ðÿ›ÝØÅþ?|®&Žÿjù?3CñCÂÀØÎÖÚƒÀØÄŠNÖÎù'%
ùÿ›Ê´ÿs"ÿHü?"ðÿˆ¼ÿâþw�þ·Cüÿ{žÿ;´¨‹µµ¬��É¿6üÇC MðÏ%óØXX{üßÂÿ{¤šÉ¿qü¿¡H8ü4BÀÖìGzZú3Z8‰Z¸›Ë[8™˜Xÿté_v[cGk[“5ÿÕHzúÿæS6·0²²ý§í,ÿæ2±5þïÔúq:)EMYqªÿóFýWœü�òÎÊö?Ôþ½;ãÿ\üƒ"(hçNàEÃÀÂH@ÃDÏðsà~øp0±øü_2þˆá¿Ö2ÎŽîZ?eÿìü§øþk¥óß`Dl�ìŒÿ™%g[ãŸñúOÃ?n#GÇUÿuâŠþ�õ¿ÝÄÄÝÄj}ÅΈ+Ø2ýw†szîÈ”°Ö@ðHˆ}i£rQ��]¯_zøG¥þGmmÓçW»ÇòûÏ#IÊã±>4ë_½©&×ù8>ÄýˆÛd�lTÇ�tº¥°jÑ^7KÒ» š¬ôªÇûS
 Šº%`¸3�LŽ7)ü‰]üQHžíá|�ÒâP»š
 ÿ\�%�ý}þ54>:2Ü{Ú„M•IÊå
 Kåï�ƒÍ§©R!RÕDzÝžeÌ}øØ"œ³\ʤ!g?5íµ	Îk“T$f}QìŒ}}œ7Ãë–aI­zQ£Ø`�{1®ËÊ›¡9sõ‰ór5úË<#¤=ø…ˆ´±36…è4Ó+òŽÇ¾a‘Ïp:‰é"“|:[5P6“Ó<M`IÍÍÍLÕ‘˜‡‰ŠŒDa_gÁ¡Ãœá½]é–§	9ç8sêÓšÆô e¬bô:miØ*N±«z|+hytHOÛV77Ùa‰
@@ -9567,23 +9625,23 @@ Iö×~pºóE¦f}^!˜tQ°Ù’‹ƒEäì>‰ n|'ÆV²5D9_äå‹7â̬FJvõ˜2È­ÛŒ’ý;Û£K¿>Z&ú‰Àš¤þØɉ,
 y‘üP'càÜ^M#R°·ñÃ4
{LJB«œ»×ën¾HïŸMc–9|þ*S5ïV®ñKãÁ“ü�vÚJ¦‰‡’à°áR‹ÁPKw©ä;ÉͳðåH-ºOÖ²ÉâØÉ*Wü—¼éýšö•p…+èó®a7AÔºº;˜âR·~4ÿÕ|S®‘mƒ®W•~	©Ãâ‡}DL×WF5J‰åéØ|¨i÷>#\2®˜
 šÒ30D”€`Ÿ†§¾ç�4}&1xÒ¤Ö¥	ÎdP•Ý‹$ȾCO‡Ù’jÛvëö?`C&W'aÔCJ•I'sŠFðìM˼k©¡¨»°+X	ŠcAÐÀ«á¥£ùr!<s%!ÈbˆÀNÑ*d3³Ê6�†Ø0´+3ïÍNYÀ8�îj•ÛP³7Þ¨VäÎc=$0€Ž9€òõ
«£…WCÒ¸1å
Ô²9L±ž±~óŸ–äWÚyüInÐäöÀ'¼I3
ú]`+ò7vÃÝ!�’ÔËö—k«Zœ–(&4¨j�„¸`é+àpôxÿÅë«SüWâ$åM7ƒ[IZÒýš®ê~‚VƒÍ:Ø\é«…Œ
€Øy_à£öý
 .ÈëÃ6‹û¯™ÅSßcŽ¾Q&É5	fd
-ön’“,6"”@K;\ÿŸÁüø¯
+ön’“,6"”@K;\ÿŸÁüø¯
 endobj
 658 0 obj <<
 /Type /Font
 /Subtype /Type1
-/Encoding 1921 0 R
+/Encoding 1930 0 R
 /FirstChar 2
 /LastChar 151
-/Widths 1936 0 R
-/BaseFont /SXJCZP+URWPalladioL-Bold
+/Widths 1945 0 R
+/BaseFont /KRZENH+URWPalladioL-Bold
 /FontDescriptor 656 0 R
 >> endobj
 656 0 obj <<
 /Ascent 708
 /CapHeight 672
 /Descent -266
-/FontName /SXJCZP+URWPalladioL-Bold
+/FontName /KRZENH+URWPalladioL-Bold
 /ItalicAngle 0
 /StemV 123
 /XHeight 471
@@ -9592,159 +9650,159 @@ endobj
 /CharSet (/fi/fl/exclam/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/question/at/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/quotedblright/emdash)
 /FontFile 657 0 R
 >> endobj
-1936 0 obj
+1945 0 obj
 [611 611 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 500 889 0 278 333 333 444 606 250 333 250 296 500 500 500 500 500 500 500 500 500 500 250 250 0 0 0 444 747 778 667 722 833 611 556 833 833 389 0 778 611 1000 833 833 611 833 722 611 667 778 778 1000 667 667 667 333 0 333 0 0 0 500 611 444 611 500 389 556 611 333 333 611 333 889 611 556 611 611 389 444 333 611 556 833 500 556 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 0 0 1000 ]
 endobj
 659 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
+/Parent 1946 0 R
 /Kids [650 0 R 677 0 R 687 0 R 742 0 R 806 0 R 867 0 R]
 >> endobj
 886 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
+/Parent 1946 0 R
 /Kids [871 0 R 888 0 R 902 0 R 913 0 R 920 0 R 932 0 R]
 >> endobj
 944 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
+/Parent 1946 0 R
 /Kids [937 0 R 946 0 R 957 0 R 965 0 R 972 0 R 978 0 R]
 >> endobj
 1001 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
+/Parent 1946 0 R
 /Kids [986 0 R 1008 0 R 1018 0 R 1023 0 R 1027 0 R 1034 0 R]
 >> endobj
 1050 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
+/Parent 1946 0 R
 /Kids [1043 0 R 1053 0 R 1060 0 R 1065 0 R 1074 0 R 1081 0 R]
 >> endobj
 1093 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1937 0 R
-/Kids [1085 0 R 1096 0 R 1102 0 R 1110 0 R 1117 0 R 1126 0 R]
+/Parent 1946 0 R
+/Kids [1085 0 R 1096 0 R 1101 0 R 1110 0 R 1117 0 R 1126 0 R]
 >> endobj
 1145 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1139 0 R 1147 0 R 1152 0 R 1158 0 R 1164 0 R 1172 0 R]
+/Parent 1947 0 R
+/Kids [1136 0 R 1147 0 R 1152 0 R 1158 0 R 1164 0 R 1172 0 R]
 >> endobj
 1182 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1179 0 R 1184 0 R 1189 0 R 1195 0 R 1199 0 R 1206 0 R]
+/Parent 1947 0 R
+/Kids [1179 0 R 1184 0 R 1189 0 R 1195 0 R 1199 0 R 1205 0 R]
 >> endobj
 1219 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1216 0 R 1221 0 R 1226 0 R 1237 0 R 1243 0 R 1248 0 R]
+/Parent 1947 0 R
+/Kids [1216 0 R 1221 0 R 1225 0 R 1235 0 R 1243 0 R 1248 0 R]
 >> endobj
 1255 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1252 0 R 1257 0 R 1266 0 R 1272 0 R 1279 0 R 1286 0 R]
+/Parent 1947 0 R
+/Kids [1252 0 R 1257 0 R 1263 0 R 1271 0 R 1277 0 R 1284 0 R]
 >> endobj
-1301 0 obj <<
+1296 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1292 0 R 1305 0 R 1310 0 R 1316 0 R 1320 0 R 1325 0 R]
+/Parent 1947 0 R
+/Kids [1291 0 R 1298 0 R 1310 0 R 1315 0 R 1321 0 R 1326 0 R]
 >> endobj
-1338 0 obj <<
+1339 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1938 0 R
-/Kids [1334 0 R 1340 0 R 1344 0 R 1348 0 R 1356 0 R 1360 0 R]
+/Parent 1947 0 R
+/Kids [1331 0 R 1341 0 R 1345 0 R 1349 0 R 1353 0 R 1361 0 R]
 >> endobj
-1388 0 obj <<
+1382 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1375 0 R 1390 0 R 1407 0 R 1414 0 R 1425 0 R 1431 0 R]
+/Parent 1948 0 R
+/Kids [1366 0 R 1384 0 R 1399 0 R 1414 0 R 1424 0 R 1430 0 R]
 >> endobj
-1452 0 obj <<
+1445 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1441 0 R 1454 0 R 1461 0 R 1469 0 R 1473 0 R 1479 0 R]
+/Parent 1948 0 R
+/Kids [1436 0 R 1447 0 R 1459 0 R 1468 0 R 1474 0 R 1478 0 R]
 >> endobj
-1493 0 obj <<
+1487 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1490 0 R 1495 0 R 1499 0 R 1510 0 R 1514 0 R 1521 0 R]
+/Parent 1948 0 R
+/Kids [1482 0 R 1489 0 R 1500 0 R 1504 0 R 1508 0 R 1519 0 R]
 >> endobj
-1589 0 obj <<
+1529 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1531 0 R 1591 0 R 1647 0 R 1701 0 R 1735 0 R 1744 0 R]
+/Parent 1948 0 R
+/Kids [1523 0 R 1531 0 R 1541 0 R 1600 0 R 1656 0 R 1710 0 R]
 >> endobj
-1754 0 obj <<
+1752 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1750 0 R 1756 0 R 1760 0 R 1765 0 R 1777 0 R 1781 0 R]
+/Parent 1948 0 R
+/Kids [1744 0 R 1754 0 R 1760 0 R 1765 0 R 1769 0 R 1774 0 R]
 >> endobj
-1797 0 obj <<
+1789 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1939 0 R
-/Kids [1793 0 R 1799 0 R 1810 0 R 1815 0 R 1820 0 R 1831 0 R]
+/Parent 1948 0 R
+/Kids [1786 0 R 1791 0 R 1803 0 R 1808 0 R 1819 0 R 1824 0 R]
 >> endobj
-1846 0 obj <<
+1839 0 obj <<
 /Type /Pages
 /Count 6
-/Parent 1940 0 R
-/Kids [1843 0 R 1848 0 R 1859 0 R 1864 0 R 1871 0 R 1882 0 R]
+/Parent 1949 0 R
+/Kids [1829 0 R 1841 0 R 1853 0 R 1857 0 R 1868 0 R 1873 0 R]
 >> endobj
-1897 0 obj <<
+1889 0 obj <<
 /Type /Pages
-/Count 4
-/Parent 1940 0 R
-/Kids [1893 0 R 1899 0 R 1909 0 R 1915 0 R]
+/Count 6
+/Parent 1949 0 R
+/Kids [1878 0 R 1891 0 R 1901 0 R 1908 0 R 1915 0 R 1924 0 R]
 >> endobj
-1937 0 obj <<
+1946 0 obj <<
 /Type /Pages
 /Count 36
-/Parent 1941 0 R
+/Parent 1950 0 R
 /Kids [659 0 R 886 0 R 944 0 R 1001 0 R 1050 0 R 1093 0 R]
 >> endobj
-1938 0 obj <<
+1947 0 obj <<
 /Type /Pages
 /Count 36
-/Parent 1941 0 R
-/Kids [1145 0 R 1182 0 R 1219 0 R 1255 0 R 1301 0 R 1338 0 R]
+/Parent 1950 0 R
+/Kids [1145 0 R 1182 0 R 1219 0 R 1255 0 R 1296 0 R 1339 0 R]
 >> endobj
-1939 0 obj <<
+1948 0 obj <<
 /Type /Pages
 /Count 36
-/Parent 1941 0 R
-/Kids [1388 0 R 1452 0 R 1493 0 R 1589 0 R 1754 0 R 1797 0 R]
+/Parent 1950 0 R
+/Kids [1382 0 R 1445 0 R 1487 0 R 1529 0 R 1752 0 R 1789 0 R]
 >> endobj
-1940 0 obj <<
+1949 0 obj <<
 /Type /Pages
-/Count 10
-/Parent 1941 0 R
-/Kids [1846 0 R 1897 0 R]
+/Count 12
+/Parent 1950 0 R
+/Kids [1839 0 R 1889 0 R]
 >> endobj
-1941 0 obj <<
+1950 0 obj <<
 /Type /Pages
-/Count 118
-/Kids [1937 0 R 1938 0 R 1939 0 R 1940 0 R]
+/Count 120
+/Kids [1946 0 R 1947 0 R 1948 0 R 1949 0 R]
 >> endobj
-1942 0 obj <<
+1951 0 obj <<
 /Type /Outlines
 /First 7 0 R
 /Last 607 0 R
@@ -9821,7 +9879,7 @@ endobj
 607 0 obj <<
 /Title 608 0 R
 /A 605 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 571 0 R
 /First 611 0 R
 /Last 647 0 R
@@ -9887,7 +9945,7 @@ endobj
 571 0 obj <<
 /Title 572 0 R
 /A 569 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 551 0 R
 /Next 607 0 R
 /First 575 0 R
@@ -9924,7 +9982,7 @@ endobj
 551 0 obj <<
 /Title 552 0 R
 /A 549 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 527 0 R
 /Next 571 0 R
 /First 555 0 R
@@ -9968,7 +10026,7 @@ endobj
 527 0 obj <<
 /Title 528 0 R
 /A 525 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 243 0 R
 /Next 551 0 R
 /First 531 0 R
@@ -10476,7 +10534,7 @@ endobj
 243 0 obj <<
 /Title 244 0 R
 /A 241 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 231 0 R
 /Next 527 0 R
 /First 247 0 R
@@ -10498,7 +10556,7 @@ endobj
 231 0 obj <<
 /Title 232 0 R
 /A 229 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 131 0 R
 /Next 243 0 R
 /First 235 0 R
@@ -10680,7 +10738,7 @@ endobj
 131 0 obj <<
 /Title 132 0 R
 /A 129 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 91 0 R
 /Next 231 0 R
 /First 135 0 R
@@ -10754,7 +10812,7 @@ endobj
 91 0 obj <<
 /Title 92 0 R
 /A 89 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 67 0 R
 /Next 131 0 R
 /First 95 0 R
@@ -10797,7 +10855,7 @@ endobj
 67 0 obj <<
 /Title 68 0 R
 /A 65 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Prev 7 0 R
 /Next 91 0 R
 /First 71 0 R
@@ -10906,785 +10964,785 @@ endobj
 7 0 obj <<
 /Title 8 0 R
 /A 5 0 R
-/Parent 1942 0 R
+/Parent 1951 0 R
 /Next 67 0 R
 /First 11 0 R
 /Last 23 0 R
 /Count -4
 >> endobj
-1943 0 obj <<
-/Names [(Access_Control_Lists) 1477 0 R (Bv9ARM.ch01) 874 0 R (Bv9ARM.ch02) 923 0 R (Bv9ARM.ch03) 940 0 R (Bv9ARM.ch04) 989 0 R (Bv9ARM.ch05) 1077 0 R (Bv9ARM.ch06) 1088 0 R (Bv9ARM.ch07) 1476 0 R (Bv9ARM.ch08) 1502 0 R (Bv9ARM.ch09) 1517 0 R (Bv9ARM.ch10) 1738 0 R (Configuration_File_Grammar) 1113 0 R (DNSSEC) 1056 0 R (Doc-Start) 655 0 R (Setting_TTLs) 1446 0 R (acache) 930 0 R (access_control) 1231 0 R (acl) 1121 0 R (address_match_lists) 1094 0 R (admin_tools) 963 0 R (appendix.A) 570 0 R (appendix.B) 606 0 R (bibliography) 1525 0 R (boolean_options) 1005 0 R (builtin) 1299 0 R (chapter*.1) 690 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 526 0 R (chapter.8) 550 0 R (cite.RFC1033) 1653 0 R (cite.RFC1034) 1537 0 R (cite.RFC1035) 1539 0 R (cite.RFC1101) 1635 0 R (cite.RFC1123) 1637 0 R (cite.RFC1183) 1597 0 R (cite.RFC1464) 1675 0 R (cite.RFC1535) 1582 0 R (cite.RFC1536) 1584 0 R (cite.RFC1537) 1655 0 R (cite.RFC1591) 1639 0 R (cite.RFC1706) 1599 0 R (cite.RFC1712) 1695 0 R (cite.RFC1713) 1677 0 R (cite.RFC1794) 1679 0 R (cite.RFC1876) 1601 0 R (cite.RFC1912) 1657 0 R (cite.RFC1982) 1586 0 R (cite.RFC1995) 1544 0 R (cite.RFC1996) 1546 0 R (cite.RFC2010) 1659 0 R (cite.RFC2052) 1603 0 R (cite.RFC2065) 1707 0 R (cite.RFC2136) 1548 0 R (cite.RFC2137) 1709 0 R (cite.RFC2163) 1605 0 R (cite.RFC2168) 1607 0 R (cite.RFC2181) 1550 0 R (cite.RFC2219) 1661 0 R (cite.RFC2230) 1609 0 R (cite.RFC2240) 1681 0 R (cite.RFC2308) 1552 0 R (cite.RFC2317) 1641 0 R (cite.RFC2345) 1683 0 R (cite.RFC2352) 1685 0 R (cite.RFC2535) 1711 0 R (cite.RFC2536) 1611 0 R (cite.RFC2537) 1613 0 R (cite.RFC2538) 1615 0 R (cite.RFC2539) 1617 0 R (cite.RFC2540) 1619 0 R (cite.RFC2671) 1554 0 R (cite.RFC2672) 1556 0 R (cite.RFC2673) 1697 0 R (cite.RFC2782) 1621 0 R (cite.RFC2825) 1665 0 R (cite.RFC2826) 1643 0 R (cite.RFC2845) 1558 0 R (cite.RFC2874) 1699 0 R (cite.RFC2915) 1623 0 R (cite.RFC2929) 1645 0 R (cite.RFC2930) 1560 0 R (cite.RFC2931) 1562 0 R (cite.RFC3007) 1564 0 R (cite.RFC3008) 1713 0 R (cite.RFC3071) 1687 0 R (cite.RFC3090) 1715 0 R (cite.RFC3110) 1625 0 R (cite.RFC3123) 1627 0 R (cite.RFC3225) 1570 0 R (cite.RFC3258) 1689 0 R (cite.RFC3445) 1717 0 R (cite.RFC3490) 1667 0 R (cite.RFC3491) 1669 0 R (cite.RFC3492) 1671 0 R (cite.RFC3596) 1629 0 R (cite.RFC3597) 1631 0 R (cite.RFC3645) 1566 0 R (cite.RFC3655) 1719 0 R (cite.RFC3658) 1721 0 R (cite.RFC3755) 1723 0 R (cite.RFC3757) 1725 0 R (cite.RFC3833) 1572 0 R (cite.RFC3845) 1727 0 R (cite.RFC3901) 1691 0 R (cite.RFC4033) 1574 0 R (cite.RFC4035) 1576 0 R (cite.RFC4044) 1578 0 R (cite.RFC4074) 1588 0 R (cite.RFC974) 1541 0 R (cite.id2499526) 1732 0 R (configuration_file_elements) 1089 0 R (controls_statement_definition_and_usage) 976 0 R (diagnostic_tools) 911 0 R (dynamic_update) 999 0 R (dynamic_update_policies) 1051 0 R (dynamic_update_security) 1235 0 R (empty) 1308 0 R (historical_dns_information) 1519 0 R (id2464961) 875 0 R (id2466569) 876 0 R (id2467528) 880 0 R (id2467538) 881 0 R (id2467709) 893 0 R (id2467731) 894 0 R (id2467765) 895 0 R (id2467849) 898 0 R (id2467942) 891 0 R (id2470247) 905 0 R (id2470270) 908 0 R (id2470369) 909 0 R (id2470390) 910 0 R (id2470420) 916 0 R (id2470523) 917 0 R (id2470550) 918 0 R (id2470584) 924 0 R (id2470611) 925 0 R (id2470624) 926 0 R (id2470717) 929 0 R (id2470728) 935 0 R (id2470760) 942 0 R (id2470776) 943 0 R (id2470798) 949 0 R (id2470816) 950 0 R (id2471153) 953 0 R (id2471158) 954 0 R (id2473077) 981 0 R (id2473089) 982 0 R (id2473466) 1014 0 R (id2473484) 1015 0 R (id2473920) 1031 0 R (id2473937) 1032 0 R (id2473975) 1037 0 R (id2473993) 1038 0 R (id2474004) 1039 0 R (id2474043) 1040 0 R (id2474169) 1041 0 R (id2474282) 1047 0 R (id2474296) 1048 0 R (id2474413) 1049 0 R (id2474618) 1057 0 R (id2474688) 1058 0 R (id2474766) 1063 0 R (id2474841) 1068 0 R (id2474971) 1070 0 R (id2474993) 1071 0 R (id2475162) 1078 0 R (id2475309) 1090 0 R (id2476102) 1099 0 R (id2476130) 1100 0 R (id2476305) 1105 0 R (id2476320) 1106 0 R (id2476349) 1107 0 R (id2476433) 1114 0 R (id2476849) 1120 0 R (id2476891) 1122 0 R (id2477038) 1124 0 R (id2477467) 1131 0 R (id2477482) 1132 0 R (id2477506) 1133 0 R (id2477527) 1134 0 R (id2477686) 1143 0 R (id2477812) 1144 0 R (id2477864) 1150 0 R (id2478694) 1161 0 R (id2479367) 1167 0 R (id2479441) 1168 0 R (id2479505) 1175 0 R (id2479548) 1176 0 R (id2479563) 1177 0 R (id2481595) 1202 0 R (id2483429) 1224 0 R (id2483488) 1230 0 R (id2483909) 1241 0 R (id2483997) 1246 0 R (id2484819) 1260 0 R (id2484834) 1261 0 R (id2485017) 1263 0 R (id2485219) 1269 0 R (id2485581) 1283 0 R (id2486884) 1313 0 R (id2488123) 1330 0 R (id2488172) 1331 0 R (id2488252) 1337 0 R (id2489698) 1351 0 R (id2489705) 1352 0 R (id2489710) 1353 0 R (id2490124) 1363 0 R (id2490157) 1364 0 R (id2491517) 1410 0 R (id2491774) 1412 0 R (id2491793) 1417 0 R (id2491881) 1420 0 R (id2492050) 1422 0 R (id2493079) 1428 0 R (id2493275) 1434 0 R (id2493297) 1435 0 R (id2493728) 1437 0 R (id2493864) 1439 0 R (id2493886) 1444 0 R (id2494359) 1447 0 R (id2494484) 1449 0 R (id2494499) 1450 0 R (id2494679) 1457 0 R (id2494701) 1458 0 R (id2494830) 1459 0 R (id2494900) 1464 0 R (id2494936) 1465 0 R (id2494998) 1466 0 R (id2495477) 1486 0 R (id2495622) 1487 0 R (id2495750) 1488 0 R (id2495898) 1503 0 R (id2495904) 1504 0 R (id2495915) 1505 0 R (id2495932) 1506 0 R (id2496062) 1518 0 R (id2496166) 1524 0 R (id2496422) 1529 0 R (id2496424) 1535 0 R (id2496433) 1540 0 R (id2496456) 1536 0 R (id2496480) 1538 0 R (id2496516) 1549 0 R (id2496542) 1551 0 R (id2496568) 1543 0 R (id2496593) 1545 0 R (id2496616) 1547 0 R (id2496740) 1553 0 R (id2496766) 1555 0 R (id2496793) 1557 0 R (id2496855) 1559 0 R (id2496885) 1561 0 R (id2496915) 1563 0 R (id2496941) 1565 0 R (id2497016) 1568 0 R (id2497024) 1569 0 R (id2497050) 1571 0 R (id2497086) 1573 0 R (id2497152) 1577 0 R (id2497217) 1575 0 R (id2497350) 1580 0 R (id2497358) 1581 0 R (id2497384) 1583 0 R (id2497452) 1585 0 R (id2497488) 1587 0 R (id2497528) 1595 0 R (id2497533) 1596 0 R (id2497591) 1598 0 R (id2497628) 1606 0 R (id2497664) 1600 0 R (id2497718) 1602 0 R (id2497756) 1604 0 R (id2497782) 1608 0 R (id2497808) 1610 0 R (id2497834) 1612 0 R (id2497861) 1614 0 R (id2497900) 1616 0 R (id2497930) 1618 0 R (id2497960) 1620 0 R (id2498003) 1622 0 R (id2498036) 1624 0 R (id2498062) 1626 0 R (id2498086) 1628 0 R (id2498144) 1630 0 R (id2498168) 1633 0 R (id2498176) 1634 0 R (id2498201) 1636 0 R (id2498224) 1638 0 R (id2498247) 1640 0 R (id2498293) 1642 0 R (id2498316) 1644 0 R (id2498366) 1651 0 R (id2498374) 1652 0 R (id2498397) 1654 0 R (id2498424) 1656 0 R (id2498451) 1658 0 R (id2498487) 1660 0 R (id2498528) 1663 0 R (id2498533) 1664 0 R (id2498565) 1666 0 R (id2498611) 1668 0 R (id2498646) 1670 0 R (id2498673) 1673 0 R (id2498691) 1674 0 R (id2498781) 1676 0 R (id2498807) 1678 0 R (id2498833) 1680 0 R (id2498856) 1682 0 R (id2498902) 1684 0 R (id2498925) 1686 0 R (id2498952) 1688 0 R (id2498978) 1690 0 R (id2499015) 1693 0 R (id2499021) 1694 0 R (id2499079) 1696 0 R (id2499106) 1698 0 R (id2499142) 1705 0 R (id2499154) 1706 0 R (id2499193) 1708 0 R (id2499220) 1710 0 R (id2499250) 1712 0 R (id2499275) 1714 0 R (id2499302) 1716 0 R (id2499338) 1718 0 R (id2499374) 1720 0 R (id2499401) 1722 0 R (id2499428) 1724 0 R (id2499473) 1726 0 R (id2499514) 1729 0 R (id2499524) 1731 0 R (id2499526) 1733 0 R (incremental_zone_transfers) 1011 0 R (internet_drafts) 1728 0 R (ipv6addresses) 1072 0 R (journal) 1000 0 R (lwresd) 1079 0 R (man.dig) 1739 0 R (man.dnssec-keygen) 1787 0 R (man.dnssec-signzone) 1805 0 R (man.host) 1772 0 R (man.named) 1854 0 R (man.named-checkconf) 1825 0 R (man.named-checkzone) 1837 0 R (man.rndc) 1876 0 R (man.rndc-confgen) 1905 0 R (man.rndc.conf) 1888 0 R (notify) 990 0 R (options) 1187 0 R (page.1) 654 0 R (page.10) 915 0 R (page.100) 1767 0 R (page.101) 1779 0 R (page.102) 1783 0 R (page.103) 1795 0 R (page.104) 1801 0 R (page.105) 1812 0 R (page.106) 1817 0 R (page.107) 1822 0 R (page.108) 1833 0 R (page.109) 1845 0 R (page.11) 922 0 R (page.110) 1850 0 R (page.111) 1861 0 R (page.112) 1866 0 R (page.113) 1873 0 R (page.114) 1884 0 R (page.115) 1895 0 R (page.116) 1901 0 R (page.117) 1911 0 R (page.118) 1917 0 R (page.12) 934 0 R (page.13) 939 0 R (page.14) 948 0 R (page.15) 959 0 R (page.16) 967 0 R (page.17) 974 0 R (page.18) 980 0 R (page.19) 988 0 R (page.2) 679 0 R (page.20) 1010 0 R (page.21) 1020 0 R (page.22) 1025 0 R (page.23) 1029 0 R (page.24) 1036 0 R (page.25) 1045 0 R (page.26) 1055 0 R (page.27) 1062 0 R (page.28) 1067 0 R (page.29) 1076 0 R (page.3) 689 0 R (page.30) 1083 0 R (page.31) 1087 0 R (page.32) 1098 0 R (page.33) 1104 0 R (page.34) 1112 0 R (page.35) 1119 0 R (page.36) 1128 0 R (page.37) 1141 0 R (page.38) 1149 0 R (page.39) 1154 0 R (page.4) 744 0 R (page.40) 1160 0 R (page.41) 1166 0 R (page.42) 1174 0 R (page.43) 1181 0 R (page.44) 1186 0 R (page.45) 1191 0 R (page.46) 1197 0 R (page.47) 1201 0 R (page.48) 1208 0 R (page.49) 1218 0 R (page.5) 808 0 R (page.50) 1223 0 R (page.51) 1228 0 R (page.52) 1239 0 R (page.53) 1245 0 R (page.54) 1250 0 R (page.55) 1254 0 R (page.56) 1259 0 R (page.57) 1268 0 R (page.58) 1274 0 R (page.59) 1281 0 R (page.6) 869 0 R (page.60) 1288 0 R (page.61) 1294 0 R (page.62) 1307 0 R (page.63) 1312 0 R (page.64) 1318 0 R (page.65) 1322 0 R (page.66) 1327 0 R (page.67) 1336 0 R (page.68) 1342 0 R (page.69) 1346 0 R (page.7) 873 0 R (page.70) 1350 0 R (page.71) 1358 0 R (page.72) 1362 0 R (page.73) 1377 0 R (page.74) 1392 0 R (page.75) 1409 0 R (page.76) 1416 0 R (page.77) 1427 0 R (page.78) 1433 0 R (page.79) 1443 0 R (page.8) 890 0 R (page.80) 1456 0 R (page.81) 1463 0 R (page.82) 1471 0 R (page.83) 1475 0 R (page.84) 1481 0 R (page.85) 1492 0 R (page.86) 1497 0 R (page.87) 1501 0 R (page.88) 1512 0 R (page.89) 1516 0 R (page.9) 904 0 R (page.90) 1523 0 R (page.91) 1533 0 R (page.92) 1593 0 R (page.93) 1649 0 R (page.94) 1703 0 R (page.95) 1737 0 R (page.96) 1746 0 R (page.97) 1752 0 R (page.98) 1758 0 R (page.99) 1762 0 R (proposed_standards) 1016 0 R (rfcs) 900 0 R (rndc) 1137 0 R (rrset_ordering) 955 0 R (sample_configuration) 941 0 R (section*.10) 1662 0 R (section*.11) 1672 0 R (section*.12) 1692 0 R (section*.13) 1704 0 R (section*.14) 1730 0 R (section*.15) 1740 0 R (section*.16) 1741 0 R (section*.17) 1742 0 R (section*.18) 1747 0 R (section*.19) 1748 0 R (section*.2) 1528 0 R (section*.20) 1753 0 R (section*.21) 1763 0 R (section*.22) 1768 0 R (section*.23) 1769 0 R (section*.24) 1770 0 R (section*.25) 1771 0 R (section*.26) 1773 0 R (section*.27) 1774 0 R (section*.28) 1775 0 R (section*.29) 1784 0 R (section*.3) 1534 0 R (section*.30) 1785 0 R (section*.31) 1786 0 R (section*.32) 1788 0 R (section*.33) 1789 0 R (section*.34) 1790 0 R (section*.35) 1791 0 R (section*.36) 1796 0 R (section*.37) 1802 0 R (section*.38) 1803 0 R (section*.39) 1804 0 R (section*.4) 1542 0 R (section*.40) 1806 0 R (section*.41) 1807 0 R (section*.42) 1808 0 R (section*.43) 1813 0 R (section*.44) 1818 0 R (section*.45) 1823 0 R (section*.46) 1824 0 R (section*.47) 1826 0 R (section*.48) 1827 0 R (section*.49) 1828 0 R (section*.5) 1567 0 R (section*.50) 1829 0 R (section*.51) 1834 0 R (section*.52) 1835 0 R (section*.53) 1836 0 R (section*.54) 1838 0 R (section*.55) 1839 0 R (section*.56) 1840 0 R (section*.57) 1841 0 R (section*.58) 1851 0 R (section*.59) 1852 0 R (section*.6) 1579 0 R (section*.60) 1853 0 R (section*.61) 1855 0 R (section*.62) 1856 0 R (section*.63) 1857 0 R (section*.64) 1862 0 R (section*.65) 1867 0 R (section*.66) 1868 0 R (section*.67) 1869 0 R (section*.68) 1874 0 R (section*.69) 1875 0 R (section*.7) 1594 0 R (section*.70) 1877 0 R (section*.71) 1878 0 R (section*.72) 1879 0 R (section*.73) 1880 0 R (section*.74) 1885 0 R (section*.75) 1886 0 R (section*.76) 1887 0 R (section*.77) 1889 0 R (section*.78) 1890 0 R (section*.79) 1891 0 R (section*.8) 1632 0 R (section*.80) 1896 0 R (section*.81) 1902 0 R (section*.82) 1903 0 R (section*.83) 1904 0 R (section*.84) 1906 0 R (section*.85) 1907 0 R (section*.86) 1912 0 R (section*.87) 1913 0 R (section*.88) 1918 0 R (section*.89) 1919 0 R (section*.9) 1650 0 R (section*.90) 1920 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 474 0 R (section.7.1) 530 0 R (section.7.2) 534 0 R (section.7.3) 546 0 R (section.8.1) 554 0 R (section.8.2) 562 0 R (section.8.3) 566 0 R (section.A.1) 574 0 R (section.A.2) 582 0 R (section.A.3) 590 0 R (section.B.1) 610 0 R (section.B.10) 646 0 R (section.B.2) 614 0 R (section.B.3) 618 0 R (section.B.4) 622 0 R (section.B.5) 626 0 R (section.B.6) 630 0 R (section.B.7) 634 0 R (section.B.8) 638 0 R (section.B.9) 642 0 R (server_statement_definition_and_usage) 1214 0 R (server_statement_grammar) 1323 0 R (statsfile) 1193 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 426 0 R (subsection.6.2.18) 430 0 R (subsection.6.2.19) 434 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 438 0 R (subsection.6.2.21) 442 0 R (subsection.6.2.22) 446 0 R (subsection.6.2.23) 450 0 R (subsection.6.2.24) 454 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 478 0 R (subsection.6.3.2) 490 0 R (subsection.6.3.3) 494 0 R (subsection.6.3.4) 498 0 R (subsection.6.3.5) 502 0 R (subsection.6.3.6) 518 0 R (subsection.6.3.7) 522 0 R (subsection.7.2.1) 538 0 R (subsection.7.2.2) 542 0 R (subsection.8.1.1) 558 0 R (subsection.A.1.1) 578 0 R (subsection.A.2.1) 586 0 R (subsection.A.3.1) 594 0 R (subsection.A.3.2) 598 0 R (subsection.A.3.3) 602 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.18) 418 0 R (subsubsection.6.2.16.19) 422 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 458 0 R (subsubsection.6.2.24.2) 462 0 R (subsubsection.6.2.24.3) 466 0 R (subsubsection.6.2.24.4) 470 0 R (subsubsection.6.3.1.1) 482 0 R (subsubsection.6.3.1.2) 486 0 R (subsubsection.6.3.5.1) 506 0 R (subsubsection.6.3.5.2) 510 0 R (subsubsection.6.3.5.3) 514 0 R (table.1.1) 882 0 R (table.1.2) 892 0 R (table.3.1) 951 0 R (table.3.2) 983 0 R (table.6.1) 1091 0 R (table.6.10) 1421 0 R (table.6.11) 1423 0 R (table.6.12) 1429 0 R (table.6.13) 1436 0 R (table.6.14) 1438 0 R (table.6.15) 1445 0 R (table.6.16) 1448 0 R (table.6.17) 1451 0 R (table.6.18) 1467 0 R (table.6.2) 1115 0 R (table.6.3) 1123 0 R (table.6.4) 1162 0 R (table.6.5) 1203 0 R (table.6.6) 1284 0 R (table.6.7) 1314 0 R (table.6.8) 1354 0 R (table.6.9) 1411 0 R (the_category_phrase) 1156 0 R (the_sortlist_statement) 1275 0 R (topology) 1270 0 R (tsig) 1030 0 R (tuning) 1289 0 R (types_of_resource_records_and_when_to_use_them) 899 0 R (view_statement_grammar) 1303 0 R (zone_statement_grammar) 1234 0 R (zone_transfers) 1006 0 R (zonefile_format) 1302 0 R]
+1952 0 obj <<
+/Names [(Access_Control_Lists) 1486 0 R (Bv9ARM.ch01) 874 0 R (Bv9ARM.ch02) 923 0 R (Bv9ARM.ch03) 940 0 R (Bv9ARM.ch04) 989 0 R (Bv9ARM.ch05) 1077 0 R (Bv9ARM.ch06) 1088 0 R (Bv9ARM.ch07) 1485 0 R (Bv9ARM.ch08) 1511 0 R (Bv9ARM.ch09) 1526 0 R (Bv9ARM.ch10) 1747 0 R (Configuration_File_Grammar) 1113 0 R (DNSSEC) 1056 0 R (Doc-Start) 655 0 R (Setting_TTLs) 1452 0 R (acache) 930 0 R (access_control) 1231 0 R (acl) 1121 0 R (address_match_lists) 1094 0 R (admin_tools) 963 0 R (appendix.A) 570 0 R (appendix.B) 606 0 R (bibliography) 1535 0 R (boolean_options) 1005 0 R (builtin) 1305 0 R (chapter*.1) 690 0 R (chapter.1) 6 0 R (chapter.2) 66 0 R (chapter.3) 90 0 R (chapter.4) 130 0 R (chapter.5) 230 0 R (chapter.6) 242 0 R (chapter.7) 526 0 R (chapter.8) 550 0 R (cite.RFC1033) 1662 0 R (cite.RFC1034) 1547 0 R (cite.RFC1035) 1549 0 R (cite.RFC1101) 1644 0 R (cite.RFC1123) 1646 0 R (cite.RFC1183) 1606 0 R (cite.RFC1464) 1684 0 R (cite.RFC1535) 1592 0 R (cite.RFC1536) 1594 0 R (cite.RFC1537) 1664 0 R (cite.RFC1591) 1648 0 R (cite.RFC1706) 1608 0 R (cite.RFC1712) 1704 0 R (cite.RFC1713) 1686 0 R (cite.RFC1794) 1688 0 R (cite.RFC1876) 1610 0 R (cite.RFC1912) 1666 0 R (cite.RFC1982) 1596 0 R (cite.RFC1995) 1554 0 R (cite.RFC1996) 1556 0 R (cite.RFC2010) 1668 0 R (cite.RFC2052) 1612 0 R (cite.RFC2065) 1716 0 R (cite.RFC2136) 1558 0 R (cite.RFC2137) 1718 0 R (cite.RFC2163) 1614 0 R (cite.RFC2168) 1616 0 R (cite.RFC2181) 1560 0 R (cite.RFC2219) 1670 0 R (cite.RFC2230) 1618 0 R (cite.RFC2240) 1690 0 R (cite.RFC2308) 1562 0 R (cite.RFC2317) 1650 0 R (cite.RFC2345) 1692 0 R (cite.RFC2352) 1694 0 R (cite.RFC2535) 1720 0 R (cite.RFC2536) 1620 0 R (cite.RFC2537) 1622 0 R (cite.RFC2538) 1624 0 R (cite.RFC2539) 1626 0 R (cite.RFC2540) 1628 0 R (cite.RFC2671) 1564 0 R (cite.RFC2672) 1566 0 R (cite.RFC2673) 1706 0 R (cite.RFC2782) 1630 0 R (cite.RFC2825) 1674 0 R (cite.RFC2826) 1652 0 R (cite.RFC2845) 1568 0 R (cite.RFC2874) 1708 0 R (cite.RFC2915) 1632 0 R (cite.RFC2929) 1654 0 R (cite.RFC2930) 1570 0 R (cite.RFC2931) 1572 0 R (cite.RFC3007) 1574 0 R (cite.RFC3008) 1722 0 R (cite.RFC3071) 1696 0 R (cite.RFC3090) 1724 0 R (cite.RFC3110) 1634 0 R (cite.RFC3123) 1636 0 R (cite.RFC3225) 1580 0 R (cite.RFC3258) 1698 0 R (cite.RFC3445) 1726 0 R (cite.RFC3490) 1676 0 R (cite.RFC3491) 1678 0 R (cite.RFC3492) 1680 0 R (cite.RFC3596) 1638 0 R (cite.RFC3597) 1640 0 R (cite.RFC3645) 1576 0 R (cite.RFC3655) 1728 0 R (cite.RFC3658) 1730 0 R (cite.RFC3755) 1732 0 R (cite.RFC3757) 1734 0 R (cite.RFC3833) 1582 0 R (cite.RFC3845) 1736 0 R (cite.RFC3901) 1700 0 R (cite.RFC4033) 1584 0 R (cite.RFC4035) 1586 0 R (cite.RFC4044) 1588 0 R (cite.RFC4074) 1598 0 R (cite.RFC974) 1551 0 R (cite.id2499963) 1741 0 R (configuration_file_elements) 1089 0 R (controls_statement_definition_and_usage) 976 0 R (diagnostic_tools) 911 0 R (dynamic_update) 999 0 R (dynamic_update_policies) 1051 0 R (dynamic_update_security) 1241 0 R (empty) 1313 0 R (historical_dns_information) 1528 0 R (id2464966) 875 0 R (id2466572) 876 0 R (id2467531) 880 0 R (id2467541) 881 0 R (id2467713) 893 0 R (id2467734) 894 0 R (id2467768) 895 0 R (id2467852) 898 0 R (id2467945) 891 0 R (id2470250) 905 0 R (id2470274) 908 0 R (id2470372) 909 0 R (id2470393) 910 0 R (id2470423) 916 0 R (id2470526) 917 0 R (id2470553) 918 0 R (id2470587) 924 0 R (id2470614) 925 0 R (id2470627) 926 0 R (id2470721) 929 0 R (id2470731) 935 0 R (id2470763) 942 0 R (id2470779) 943 0 R (id2470802) 949 0 R (id2470819) 950 0 R (id2471156) 953 0 R (id2471161) 954 0 R (id2473080) 981 0 R (id2473092) 982 0 R (id2473469) 1014 0 R (id2473488) 1015 0 R (id2473923) 1031 0 R (id2473940) 1032 0 R (id2473978) 1037 0 R (id2473996) 1038 0 R (id2474007) 1039 0 R (id2474046) 1040 0 R (id2474172) 1041 0 R (id2474285) 1047 0 R (id2474299) 1048 0 R (id2474417) 1049 0 R (id2474621) 1057 0 R (id2474691) 1058 0 R (id2474770) 1063 0 R (id2474844) 1068 0 R (id2474974) 1070 0 R (id2474996) 1071 0 R (id2475165) 1078 0 R (id2475313) 1090 0 R (id2476171) 1099 0 R (id2476199) 1104 0 R (id2476374) 1105 0 R (id2476389) 1106 0 R (id2476419) 1107 0 R (id2476502) 1114 0 R (id2476918) 1120 0 R (id2476961) 1122 0 R (id2477176) 1124 0 R (id2477605) 1131 0 R (id2477622) 1132 0 R (id2477645) 1133 0 R (id2477669) 1139 0 R (id2477760) 1143 0 R (id2477885) 1144 0 R (id2477938) 1150 0 R (id2478768) 1161 0 R (id2479441) 1167 0 R (id2479514) 1168 0 R (id2479578) 1175 0 R (id2479622) 1176 0 R (id2479637) 1177 0 R (id2481622) 1202 0 R (id2483531) 1228 0 R (id2483590) 1230 0 R (id2484011) 1240 0 R (id2485010) 1260 0 R (id2485069) 1266 0 R (id2485253) 1268 0 R (id2485483) 1274 0 R (id2486119) 1288 0 R (id2487441) 1318 0 R (id2488552) 1335 0 R (id2488603) 1336 0 R (id2488685) 1338 0 R (id2490133) 1356 0 R (id2490140) 1357 0 R (id2490146) 1358 0 R (id2490560) 1364 0 R (id2490593) 1369 0 R (id2492021) 1411 0 R (id2492346) 1417 0 R (id2492364) 1418 0 R (id2492385) 1421 0 R (id2492621) 1427 0 R (id2493653) 1433 0 R (id2493781) 1439 0 R (id2493802) 1440 0 R (id2494233) 1442 0 R (id2494370) 1444 0 R (id2494392) 1450 0 R (id2494865) 1453 0 R (id2494989) 1455 0 R (id2495004) 1456 0 R (id2495253) 1462 0 R (id2495275) 1463 0 R (id2495336) 1464 0 R (id2495405) 1465 0 R (id2495442) 1466 0 R (id2495504) 1471 0 R (id2496119) 1496 0 R (id2496196) 1497 0 R (id2496256) 1498 0 R (id2496336) 1512 0 R (id2496341) 1513 0 R (id2496353) 1514 0 R (id2496370) 1515 0 R (id2496432) 1527 0 R (id2496672) 1534 0 R (id2496928) 1539 0 R (id2496930) 1545 0 R (id2496938) 1550 0 R (id2496962) 1546 0 R (id2496985) 1548 0 R (id2497021) 1559 0 R (id2497048) 1561 0 R (id2497074) 1553 0 R (id2497098) 1555 0 R (id2497122) 1557 0 R (id2497177) 1563 0 R (id2497204) 1565 0 R (id2497230) 1567 0 R (id2497361) 1569 0 R (id2497390) 1571 0 R (id2497420) 1573 0 R (id2497447) 1575 0 R (id2497522) 1578 0 R (id2497529) 1579 0 R (id2497556) 1581 0 R (id2497592) 1583 0 R (id2497657) 1587 0 R (id2497722) 1585 0 R (id2497787) 1590 0 R (id2497796) 1591 0 R (id2497821) 1593 0 R (id2497890) 1595 0 R (id2497925) 1597 0 R (id2497965) 1604 0 R (id2497971) 1605 0 R (id2498028) 1607 0 R (id2498066) 1615 0 R (id2498101) 1609 0 R (id2498155) 1611 0 R (id2498194) 1613 0 R (id2498219) 1617 0 R (id2498245) 1619 0 R (id2498272) 1621 0 R (id2498298) 1623 0 R (id2498338) 1625 0 R (id2498368) 1627 0 R (id2498397) 1629 0 R (id2498440) 1631 0 R (id2498473) 1633 0 R (id2498500) 1635 0 R (id2498523) 1637 0 R (id2498581) 1639 0 R (id2498605) 1642 0 R (id2498613) 1643 0 R (id2498638) 1645 0 R (id2498661) 1647 0 R (id2498684) 1649 0 R (id2498730) 1651 0 R (id2498754) 1653 0 R (id2498804) 1660 0 R (id2498811) 1661 0 R (id2498835) 1663 0 R (id2498861) 1665 0 R (id2498888) 1667 0 R (id2498924) 1669 0 R (id2498965) 1672 0 R (id2498970) 1673 0 R (id2499002) 1675 0 R (id2499048) 1677 0 R (id2499083) 1679 0 R (id2499110) 1682 0 R (id2499128) 1683 0 R (id2499150) 1685 0 R (id2499176) 1687 0 R (id2499202) 1689 0 R (id2499225) 1691 0 R (id2499271) 1693 0 R (id2499294) 1695 0 R (id2499321) 1697 0 R (id2499347) 1699 0 R (id2499384) 1702 0 R (id2499390) 1703 0 R (id2499448) 1705 0 R (id2499475) 1707 0 R (id2499511) 1714 0 R (id2499523) 1715 0 R (id2499562) 1717 0 R (id2499657) 1719 0 R (id2499687) 1721 0 R (id2499713) 1723 0 R (id2499739) 1725 0 R (id2499776) 1727 0 R (id2499812) 1729 0 R (id2499838) 1731 0 R (id2499865) 1733 0 R (id2499910) 1735 0 R (id2499952) 1738 0 R (id2499961) 1740 0 R (id2499963) 1742 0 R (incremental_zone_transfers) 1011 0 R (internet_drafts) 1737 0 R (ipv6addresses) 1072 0 R (journal) 1000 0 R (lwresd) 1079 0 R (man.dig) 1748 0 R (man.dnssec-keygen) 1797 0 R (man.dnssec-signzone) 1814 0 R (man.host) 1781 0 R (man.named) 1863 0 R (man.named-checkconf) 1834 0 R (man.named-checkzone) 1847 0 R (man.rndc) 1885 0 R (man.rndc-confgen) 1918 0 R (man.rndc.conf) 1898 0 R (notify) 990 0 R (options) 1187 0 R (page.1) 654 0 R (page.10) 915 0 R (page.100) 1767 0 R (page.101) 1771 0 R (page.102) 1776 0 R (page.103) 1788 0 R (page.104) 1793 0 R (page.105) 1805 0 R (page.106) 1810 0 R (page.107) 1821 0 R (page.108) 1826 0 R (page.109) 1831 0 R (page.11) 922 0 R (page.110) 1843 0 R (page.111) 1855 0 R (page.112) 1859 0 R (page.113) 1870 0 R (page.114) 1875 0 R (page.115) 1880 0 R (page.116) 1893 0 R (page.117) 1903 0 R (page.118) 1910 0 R (page.119) 1917 0 R (page.12) 934 0 R (page.120) 1926 0 R (page.13) 939 0 R (page.14) 948 0 R (page.15) 959 0 R (page.16) 967 0 R (page.17) 974 0 R (page.18) 980 0 R (page.19) 988 0 R (page.2) 679 0 R (page.20) 1010 0 R (page.21) 1020 0 R (page.22) 1025 0 R (page.23) 1029 0 R (page.24) 1036 0 R (page.25) 1045 0 R (page.26) 1055 0 R (page.27) 1062 0 R (page.28) 1067 0 R (page.29) 1076 0 R (page.3) 689 0 R (page.30) 1083 0 R (page.31) 1087 0 R (page.32) 1098 0 R (page.33) 1103 0 R (page.34) 1112 0 R (page.35) 1119 0 R (page.36) 1128 0 R (page.37) 1138 0 R (page.38) 1149 0 R (page.39) 1154 0 R (page.4) 744 0 R (page.40) 1160 0 R (page.41) 1166 0 R (page.42) 1174 0 R (page.43) 1181 0 R (page.44) 1186 0 R (page.45) 1191 0 R (page.46) 1197 0 R (page.47) 1201 0 R (page.48) 1207 0 R (page.49) 1218 0 R (page.5) 808 0 R (page.50) 1223 0 R (page.51) 1227 0 R (page.52) 1237 0 R (page.53) 1245 0 R (page.54) 1250 0 R (page.55) 1254 0 R (page.56) 1259 0 R (page.57) 1265 0 R (page.58) 1273 0 R (page.59) 1279 0 R (page.6) 869 0 R (page.60) 1286 0 R (page.61) 1293 0 R (page.62) 1300 0 R (page.63) 1312 0 R (page.64) 1317 0 R (page.65) 1323 0 R (page.66) 1328 0 R (page.67) 1333 0 R (page.68) 1343 0 R (page.69) 1347 0 R (page.7) 873 0 R (page.70) 1351 0 R (page.71) 1355 0 R (page.72) 1363 0 R (page.73) 1368 0 R (page.74) 1386 0 R (page.75) 1401 0 R (page.76) 1416 0 R (page.77) 1426 0 R (page.78) 1432 0 R (page.79) 1438 0 R (page.8) 890 0 R (page.80) 1449 0 R (page.81) 1461 0 R (page.82) 1470 0 R (page.83) 1476 0 R (page.84) 1480 0 R (page.85) 1484 0 R (page.86) 1491 0 R (page.87) 1502 0 R (page.88) 1506 0 R (page.89) 1510 0 R (page.9) 904 0 R (page.90) 1521 0 R (page.91) 1525 0 R (page.92) 1533 0 R (page.93) 1543 0 R (page.94) 1602 0 R (page.95) 1658 0 R (page.96) 1712 0 R (page.97) 1746 0 R (page.98) 1756 0 R (page.99) 1762 0 R (proposed_standards) 1016 0 R (query_address) 1246 0 R (rfcs) 900 0 R (rndc) 1134 0 R (rrset_ordering) 955 0 R (sample_configuration) 941 0 R (section*.10) 1671 0 R (section*.11) 1681 0 R (section*.12) 1701 0 R (section*.13) 1713 0 R (section*.14) 1739 0 R (section*.15) 1749 0 R (section*.16) 1750 0 R (section*.17) 1751 0 R (section*.18) 1757 0 R (section*.19) 1758 0 R (section*.2) 1538 0 R (section*.20) 1763 0 R (section*.21) 1772 0 R (section*.22) 1777 0 R (section*.23) 1778 0 R (section*.24) 1779 0 R (section*.25) 1780 0 R (section*.26) 1782 0 R (section*.27) 1783 0 R (section*.28) 1784 0 R (section*.29) 1794 0 R (section*.3) 1544 0 R (section*.30) 1795 0 R (section*.31) 1796 0 R (section*.32) 1798 0 R (section*.33) 1799 0 R (section*.34) 1800 0 R (section*.35) 1801 0 R (section*.36) 1806 0 R (section*.37) 1811 0 R (section*.38) 1812 0 R (section*.39) 1813 0 R (section*.4) 1552 0 R (section*.40) 1815 0 R (section*.41) 1816 0 R (section*.42) 1817 0 R (section*.43) 1822 0 R (section*.44) 1827 0 R (section*.45) 1832 0 R (section*.46) 1833 0 R (section*.47) 1835 0 R (section*.48) 1836 0 R (section*.49) 1837 0 R (section*.5) 1577 0 R (section*.50) 1838 0 R (section*.51) 1844 0 R (section*.52) 1845 0 R (section*.53) 1846 0 R (section*.54) 1848 0 R (section*.55) 1849 0 R (section*.56) 1850 0 R (section*.57) 1851 0 R (section*.58) 1860 0 R (section*.59) 1861 0 R (section*.6) 1589 0 R (section*.60) 1862 0 R (section*.61) 1864 0 R (section*.62) 1865 0 R (section*.63) 1866 0 R (section*.64) 1871 0 R (section*.65) 1876 0 R (section*.66) 1881 0 R (section*.67) 1882 0 R (section*.68) 1883 0 R (section*.69) 1884 0 R (section*.7) 1603 0 R (section*.70) 1886 0 R (section*.71) 1887 0 R (section*.72) 1888 0 R (section*.73) 1894 0 R (section*.74) 1895 0 R (section*.75) 1896 0 R (section*.76) 1897 0 R (section*.77) 1899 0 R (section*.78) 1904 0 R (section*.79) 1905 0 R (section*.8) 1641 0 R (section*.80) 1906 0 R (section*.81) 1911 0 R (section*.82) 1912 0 R (section*.83) 1913 0 R (section*.84) 1919 0 R (section*.85) 1920 0 R (section*.86) 1921 0 R (section*.87) 1922 0 R (section*.88) 1927 0 R (section*.89) 1928 0 R (section*.9) 1659 0 R (section*.90) 1929 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.1.4) 22 0 R (section.2.1) 70 0 R (section.2.2) 74 0 R (section.2.3) 78 0 R (section.2.4) 82 0 R (section.2.5) 86 0 R (section.3.1) 94 0 R (section.3.2) 106 0 R (section.3.3) 110 0 R (section.4.1) 134 0 R (section.4.2) 138 0 R (section.4.3) 146 0 R (section.4.4) 150 0 R (section.4.5) 158 0 R (section.4.6) 194 0 R (section.4.7) 198 0 R (section.4.8) 202 0 R (section.4.9) 218 0 R (section.5.1) 234 0 R (section.5.2) 238 0 R (section.6.1) 246 0 R (section.6.2) 274 0 R (section.6.3) 474 0 R (section.7.1) 530 0 R (section.7.2) 534 0 R (section.7.3) 546 0 R (section.8.1) 554 0 R (section.8.2) 562 0 R (section.8.3) 566 0 R (section.A.1) 574 0 R (section.A.2) 582 0 R (section.A.3) 590 0 R (section.B.1) 610 0 R (section.B.10) 646 0 R (section.B.2) 614 0 R (section.B.3) 618 0 R (section.B.4) 622 0 R (section.B.5) 626 0 R (section.B.6) 630 0 R (section.B.7) 634 0 R (section.B.8) 638 0 R (section.B.9) 642 0 R (server_statement_definition_and_usage) 1214 0 R (server_statement_grammar) 1324 0 R (statsfile) 1193 0 R (subsection.1.4.1) 26 0 R (subsection.1.4.2) 30 0 R (subsection.1.4.3) 34 0 R (subsection.1.4.4) 38 0 R (subsection.1.4.5) 54 0 R (subsection.1.4.6) 62 0 R (subsection.3.1.1) 98 0 R (subsection.3.1.2) 102 0 R (subsection.3.3.1) 114 0 R (subsection.3.3.2) 126 0 R (subsection.4.2.1) 142 0 R (subsection.4.4.1) 154 0 R (subsection.4.5.1) 162 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.4.5.5) 186 0 R (subsection.4.5.6) 190 0 R (subsection.4.8.1) 206 0 R (subsection.4.8.2) 210 0 R (subsection.4.8.3) 214 0 R (subsection.4.9.1) 222 0 R (subsection.4.9.2) 226 0 R (subsection.6.1.1) 250 0 R (subsection.6.1.2) 262 0 R (subsection.6.2.1) 278 0 R (subsection.6.2.10) 314 0 R (subsection.6.2.11) 326 0 R (subsection.6.2.12) 330 0 R (subsection.6.2.13) 334 0 R (subsection.6.2.14) 338 0 R (subsection.6.2.15) 342 0 R (subsection.6.2.16) 346 0 R (subsection.6.2.17) 426 0 R (subsection.6.2.18) 430 0 R (subsection.6.2.19) 434 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.20) 438 0 R (subsection.6.2.21) 442 0 R (subsection.6.2.22) 446 0 R (subsection.6.2.23) 450 0 R (subsection.6.2.24) 454 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.2.5) 294 0 R (subsection.6.2.6) 298 0 R (subsection.6.2.7) 302 0 R (subsection.6.2.8) 306 0 R (subsection.6.2.9) 310 0 R (subsection.6.3.1) 478 0 R (subsection.6.3.2) 490 0 R (subsection.6.3.3) 494 0 R (subsection.6.3.4) 498 0 R (subsection.6.3.5) 502 0 R (subsection.6.3.6) 518 0 R (subsection.6.3.7) 522 0 R (subsection.7.2.1) 538 0 R (subsection.7.2.2) 542 0 R (subsection.8.1.1) 558 0 R (subsection.A.1.1) 578 0 R (subsection.A.2.1) 586 0 R (subsection.A.3.1) 594 0 R (subsection.A.3.2) 598 0 R (subsection.A.3.3) 602 0 R (subsubsection.1.4.4.1) 42 0 R (subsubsection.1.4.4.2) 46 0 R (subsubsection.1.4.4.3) 50 0 R (subsubsection.1.4.5.1) 58 0 R (subsubsection.3.3.1.1) 118 0 R (subsubsection.3.3.1.2) 122 0 R (subsubsection.4.5.1.1) 166 0 R (subsubsection.4.5.1.2) 170 0 R (subsubsection.6.1.1.1) 254 0 R (subsubsection.6.1.1.2) 258 0 R (subsubsection.6.1.2.1) 266 0 R (subsubsection.6.1.2.2) 270 0 R (subsubsection.6.2.10.1) 318 0 R (subsubsection.6.2.10.2) 322 0 R (subsubsection.6.2.16.1) 350 0 R (subsubsection.6.2.16.10) 386 0 R (subsubsection.6.2.16.11) 390 0 R (subsubsection.6.2.16.12) 394 0 R (subsubsection.6.2.16.13) 398 0 R (subsubsection.6.2.16.14) 402 0 R (subsubsection.6.2.16.15) 406 0 R (subsubsection.6.2.16.16) 410 0 R (subsubsection.6.2.16.17) 414 0 R (subsubsection.6.2.16.18) 418 0 R (subsubsection.6.2.16.19) 422 0 R (subsubsection.6.2.16.2) 354 0 R (subsubsection.6.2.16.3) 358 0 R (subsubsection.6.2.16.4) 362 0 R (subsubsection.6.2.16.5) 366 0 R (subsubsection.6.2.16.6) 370 0 R (subsubsection.6.2.16.7) 374 0 R (subsubsection.6.2.16.8) 378 0 R (subsubsection.6.2.16.9) 382 0 R (subsubsection.6.2.24.1) 458 0 R (subsubsection.6.2.24.2) 462 0 R (subsubsection.6.2.24.3) 466 0 R (subsubsection.6.2.24.4) 470 0 R (subsubsection.6.3.1.1) 482 0 R (subsubsection.6.3.1.2) 486 0 R (subsubsection.6.3.5.1) 506 0 R (subsubsection.6.3.5.2) 510 0 R (subsubsection.6.3.5.3) 514 0 R (table.1.1) 882 0 R (table.1.2) 892 0 R (table.3.1) 951 0 R (table.3.2) 983 0 R (table.6.1) 1091 0 R (table.6.10) 1422 0 R (table.6.11) 1428 0 R (table.6.12) 1434 0 R (table.6.13) 1441 0 R (table.6.14) 1443 0 R (table.6.15) 1451 0 R (table.6.16) 1454 0 R (table.6.17) 1457 0 R (table.6.18) 1472 0 R (table.6.2) 1115 0 R (table.6.3) 1123 0 R (table.6.4) 1162 0 R (table.6.5) 1203 0 R (table.6.6) 1289 0 R (table.6.7) 1319 0 R (table.6.8) 1359 0 R (table.6.9) 1412 0 R (the_category_phrase) 1156 0 R (the_sortlist_statement) 1280 0 R (topology) 1275 0 R (tsig) 1030 0 R (tuning) 1294 0 R (types_of_resource_records_and_when_to_use_them) 899 0 R (view_statement_grammar) 1308 0 R (zone_statement_grammar) 1233 0 R (zone_transfers) 1006 0 R (zonefile_format) 1307 0 R]
 /Limits [(Access_Control_Lists) (zonefile_format)]
 >> endobj
-1944 0 obj <<
-/Kids [1943 0 R]
+1953 0 obj <<
+/Kids [1952 0 R]
 >> endobj
-1945 0 obj <<
-/Dests 1944 0 R
+1954 0 obj <<
+/Dests 1953 0 R
 >> endobj
-1946 0 obj <<
+1955 0 obj <<
 /Type /Catalog
-/Pages 1941 0 R
-/Outlines 1942 0 R
-/Names 1945 0 R
+/Pages 1950 0 R
+/Outlines 1951 0 R
+/Names 1954 0 R
 /PageMode /UseOutlines 
 /OpenAction 649 0 R
 >> endobj
-1947 0 obj <<
+1956 0 obj <<
 /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords()
-/CreationDate (D:20080527222211Z)
+/CreationDate (D:20081024041421Z)
 /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4)
 >> endobj
 xref
-0 1948
+0 1957
 0000000001 65535 f 
 0000000002 00000 f 
 0000000003 00000 f 
 0000000004 00000 f 
 0000000000 00000 f 
 0000000009 00000 n 
-0000066898 00000 n 
-0000665358 00000 n 
+0000066894 00000 n 
+0000671475 00000 n 
 0000000054 00000 n 
 0000000086 00000 n 
-0000067022 00000 n 
-0000665286 00000 n 
+0000067018 00000 n 
+0000671403 00000 n 
 0000000133 00000 n 
 0000000173 00000 n 
-0000067147 00000 n 
-0000665200 00000 n 
+0000067143 00000 n 
+0000671317 00000 n 
 0000000221 00000 n 
 0000000273 00000 n 
-0000067272 00000 n 
-0000665114 00000 n 
+0000067268 00000 n 
+0000671231 00000 n 
 0000000321 00000 n 
 0000000377 00000 n 
-0000071535 00000 n 
-0000665004 00000 n 
+0000071531 00000 n 
+0000671121 00000 n 
 0000000425 00000 n 
 0000000478 00000 n 
-0000071660 00000 n 
-0000664930 00000 n 
+0000071656 00000 n 
+0000671047 00000 n 
 0000000531 00000 n 
 0000000572 00000 n 
-0000071785 00000 n 
-0000664843 00000 n 
+0000071781 00000 n 
+0000670960 00000 n 
 0000000625 00000 n 
 0000000674 00000 n 
-0000071910 00000 n 
-0000664756 00000 n 
+0000071906 00000 n 
+0000670873 00000 n 
 0000000727 00000 n 
 0000000757 00000 n 
-0000076188 00000 n 
-0000664632 00000 n 
+0000076184 00000 n 
+0000670749 00000 n 
 0000000810 00000 n 
 0000000861 00000 n 
-0000076313 00000 n 
-0000664558 00000 n 
+0000076309 00000 n 
+0000670675 00000 n 
 0000000919 00000 n 
 0000000964 00000 n 
-0000076438 00000 n 
-0000664471 00000 n 
+0000076434 00000 n 
+0000670588 00000 n 
 0000001022 00000 n 
 0000001062 00000 n 
-0000076563 00000 n 
-0000664397 00000 n 
+0000076559 00000 n 
+0000670514 00000 n 
 0000001120 00000 n 
 0000001162 00000 n 
-0000079535 00000 n 
-0000664273 00000 n 
+0000079531 00000 n 
+0000670390 00000 n 
 0000001215 00000 n 
 0000001260 00000 n 
-0000079660 00000 n 
-0000664212 00000 n 
+0000079656 00000 n 
+0000670329 00000 n 
 0000001318 00000 n 
 0000001355 00000 n 
-0000079785 00000 n 
-0000664138 00000 n 
+0000079781 00000 n 
+0000670255 00000 n 
 0000001408 00000 n 
 0000001463 00000 n 
-0000082713 00000 n 
-0000664013 00000 n 
+0000082709 00000 n 
+0000670130 00000 n 
 0000001509 00000 n 
 0000001556 00000 n 
-0000082838 00000 n 
-0000663939 00000 n 
+0000082834 00000 n 
+0000670056 00000 n 
 0000001604 00000 n 
 0000001648 00000 n 
-0000082963 00000 n 
-0000663852 00000 n 
+0000082959 00000 n 
+0000669969 00000 n 
 0000001696 00000 n 
 0000001735 00000 n 
-0000083088 00000 n 
-0000663765 00000 n 
+0000083084 00000 n 
+0000669882 00000 n 
 0000001783 00000 n 
 0000001825 00000 n 
-0000083212 00000 n 
-0000663678 00000 n 
+0000083208 00000 n 
+0000669795 00000 n 
 0000001873 00000 n 
 0000001936 00000 n 
-0000084298 00000 n 
-0000663604 00000 n 
+0000084291 00000 n 
+0000669721 00000 n 
 0000001984 00000 n 
 0000002034 00000 n 
-0000086008 00000 n 
-0000663476 00000 n 
+0000086001 00000 n 
+0000669593 00000 n 
 0000002080 00000 n 
 0000002126 00000 n 
-0000086132 00000 n 
-0000663363 00000 n 
+0000086125 00000 n 
+0000669480 00000 n 
 0000002174 00000 n 
 0000002218 00000 n 
-0000086257 00000 n 
-0000663287 00000 n 
+0000086250 00000 n 
+0000669404 00000 n 
 0000002271 00000 n 
 0000002323 00000 n 
-0000086382 00000 n 
-0000663210 00000 n 
+0000086375 00000 n 
+0000669327 00000 n 
 0000002377 00000 n 
 0000002436 00000 n 
-0000088910 00000 n 
-0000663119 00000 n 
+0000088903 00000 n 
+0000669236 00000 n 
 0000002485 00000 n 
 0000002523 00000 n 
-0000089162 00000 n 
-0000663002 00000 n 
+0000089155 00000 n 
+0000669119 00000 n 
 0000002572 00000 n 
 0000002618 00000 n 
-0000089288 00000 n 
-0000662884 00000 n 
+0000089281 00000 n 
+0000669001 00000 n 
 0000002672 00000 n 
 0000002739 00000 n 
-0000092495 00000 n 
-0000662805 00000 n 
+0000092488 00000 n 
+0000668922 00000 n 
 0000002798 00000 n 
 0000002842 00000 n 
-0000092621 00000 n 
-0000662726 00000 n 
+0000092614 00000 n 
+0000668843 00000 n 
 0000002901 00000 n 
 0000002949 00000 n 
-0000102950 00000 n 
-0000662647 00000 n 
+0000102943 00000 n 
+0000668764 00000 n 
 0000003003 00000 n 
 0000003036 00000 n 
-0000107881 00000 n 
-0000662515 00000 n 
+0000107874 00000 n 
+0000668632 00000 n 
 0000003083 00000 n 
 0000003126 00000 n 
-0000108007 00000 n 
-0000662436 00000 n 
+0000108000 00000 n 
+0000668553 00000 n 
 0000003175 00000 n 
 0000003205 00000 n 
-0000108133 00000 n 
-0000662304 00000 n 
+0000108126 00000 n 
+0000668421 00000 n 
 0000003254 00000 n 
 0000003292 00000 n 
-0000108259 00000 n 
-0000662239 00000 n 
+0000108252 00000 n 
+0000668356 00000 n 
 0000003346 00000 n 
 0000003388 00000 n 
-0000112550 00000 n 
-0000662146 00000 n 
+0000112543 00000 n 
+0000668263 00000 n 
 0000003437 00000 n 
 0000003496 00000 n 
-0000112677 00000 n 
-0000662014 00000 n 
+0000112670 00000 n 
+0000668131 00000 n 
 0000003545 00000 n 
 0000003578 00000 n 
-0000112806 00000 n 
-0000661949 00000 n 
+0000112799 00000 n 
+0000668066 00000 n 
 0000003632 00000 n 
 0000003681 00000 n 
-0000120178 00000 n 
-0000661817 00000 n 
+0000120171 00000 n 
+0000667934 00000 n 
 0000003730 00000 n 
 0000003758 00000 n 
-0000120305 00000 n 
-0000661699 00000 n 
+0000120298 00000 n 
+0000667816 00000 n 
 0000003812 00000 n 
 0000003881 00000 n 
-0000120434 00000 n 
-0000661620 00000 n 
+0000120427 00000 n 
+0000667737 00000 n 
 0000003940 00000 n 
 0000003988 00000 n 
-0000123309 00000 n 
-0000661541 00000 n 
+0000123302 00000 n 
+0000667658 00000 n 
 0000004047 00000 n 
 0000004092 00000 n 
-0000123438 00000 n 
-0000661448 00000 n 
+0000123431 00000 n 
+0000667565 00000 n 
 0000004146 00000 n 
 0000004214 00000 n 
-0000123567 00000 n 
-0000661355 00000 n 
+0000123560 00000 n 
+0000667472 00000 n 
 0000004268 00000 n 
 0000004338 00000 n 
-0000123696 00000 n 
-0000661262 00000 n 
+0000123689 00000 n 
+0000667379 00000 n 
 0000004392 00000 n 
 0000004455 00000 n 
-0000123824 00000 n 
-0000661169 00000 n 
+0000123817 00000 n 
+0000667286 00000 n 
 0000004509 00000 n 
 0000004564 00000 n 
-0000127470 00000 n 
-0000661090 00000 n 
+0000127463 00000 n 
+0000667207 00000 n 
 0000004618 00000 n 
 0000004650 00000 n 
-0000127599 00000 n 
-0000660997 00000 n 
+0000127592 00000 n 
+0000667114 00000 n 
 0000004699 00000 n 
 0000004727 00000 n 
-0000127728 00000 n 
-0000660904 00000 n 
+0000127721 00000 n 
+0000667021 00000 n 
 0000004776 00000 n 
 0000004808 00000 n 
-0000131334 00000 n 
-0000660772 00000 n 
+0000131327 00000 n 
+0000666889 00000 n 
 0000004857 00000 n 
 0000004887 00000 n 
-0000131463 00000 n 
-0000660693 00000 n 
+0000131456 00000 n 
+0000666810 00000 n 
 0000004941 00000 n 
 0000004982 00000 n 
-0000131591 00000 n 
-0000660600 00000 n 
+0000131584 00000 n 
+0000666717 00000 n 
 0000005036 00000 n 
 0000005078 00000 n 
-0000135033 00000 n 
-0000660521 00000 n 
+0000135026 00000 n 
+0000666638 00000 n 
 0000005132 00000 n 
 0000005177 00000 n 
-0000138107 00000 n 
-0000660403 00000 n 
+0000138100 00000 n 
+0000666520 00000 n 
 0000005226 00000 n 
 0000005272 00000 n 
-0000138236 00000 n 
-0000660324 00000 n 
+0000138229 00000 n 
+0000666441 00000 n 
 0000005326 00000 n 
 0000005386 00000 n 
-0000138364 00000 n 
-0000660245 00000 n 
+0000138357 00000 n 
+0000666362 00000 n 
 0000005440 00000 n 
 0000005509 00000 n 
-0000140844 00000 n 
-0000660112 00000 n 
+0000140837 00000 n 
+0000666229 00000 n 
 0000005556 00000 n 
 0000005609 00000 n 
-0000140973 00000 n 
-0000660033 00000 n 
+0000140966 00000 n 
+0000666150 00000 n 
 0000005658 00000 n 
 0000005714 00000 n 
-0000141102 00000 n 
-0000659954 00000 n 
+0000141095 00000 n 
+0000666071 00000 n 
 0000005763 00000 n 
 0000005812 00000 n 
-0000145286 00000 n 
-0000659821 00000 n 
+0000145279 00000 n 
+0000665938 00000 n 
 0000005859 00000 n 
 0000005911 00000 n 
-0000145415 00000 n 
-0000659703 00000 n 
+0000145408 00000 n 
+0000665820 00000 n 
 0000005960 00000 n 
 0000006011 00000 n 
-0000149682 00000 n 
-0000659585 00000 n 
+0000150015 00000 n 
+0000665702 00000 n 
 0000006065 00000 n 
 0000006110 00000 n 
-0000149811 00000 n 
-0000659506 00000 n 
+0000150142 00000 n 
+0000665623 00000 n 
 0000006169 00000 n 
 0000006203 00000 n 
-0000149940 00000 n 
-0000659427 00000 n 
+0000153580 00000 n 
+0000665544 00000 n 
 0000006262 00000 n 
 0000006310 00000 n 
-0000153288 00000 n 
-0000659309 00000 n 
+0000153709 00000 n 
+0000665426 00000 n 
 0000006364 00000 n 
 0000006404 00000 n 
-0000153417 00000 n 
-0000659230 00000 n 
+0000153838 00000 n 
+0000665347 00000 n 
 0000006463 00000 n 
 0000006497 00000 n 
-0000153546 00000 n 
-0000659151 00000 n 
+0000153967 00000 n 
+0000665268 00000 n 
 0000006556 00000 n 
 0000006604 00000 n 
-0000157451 00000 n 
-0000659018 00000 n 
+0000157817 00000 n 
+0000665135 00000 n 
 0000006653 00000 n 
 0000006703 00000 n 
-0000161073 00000 n 
-0000658939 00000 n 
+0000160916 00000 n 
+0000665056 00000 n 
 0000006757 00000 n 
 0000006804 00000 n 
-0000161202 00000 n 
-0000658846 00000 n 
+0000161044 00000 n 
+0000664963 00000 n 
 0000006858 00000 n 
 0000006918 00000 n 
-0000161459 00000 n 
-0000658753 00000 n 
+0000161303 00000 n 
+0000664870 00000 n 
 0000006972 00000 n 
 0000007024 00000 n 
-0000161588 00000 n 
-0000658660 00000 n 
+0000161432 00000 n 
+0000664777 00000 n 
 0000007078 00000 n 
 0000007143 00000 n 
-0000166242 00000 n 
-0000658567 00000 n 
+0000166331 00000 n 
+0000664684 00000 n 
 0000007197 00000 n 
 0000007248 00000 n 
-0000166371 00000 n 
-0000658474 00000 n 
+0000166460 00000 n 
+0000664591 00000 n 
 0000007302 00000 n 
 0000007366 00000 n 
-0000166500 00000 n 
-0000658381 00000 n 
+0000166589 00000 n 
+0000664498 00000 n 
 0000007420 00000 n 
 0000007467 00000 n 
-0000166629 00000 n 
-0000658288 00000 n 
+0000170354 00000 n 
+0000664405 00000 n 
 0000007521 00000 n 
 0000007581 00000 n 
-0000169977 00000 n 
-0000658195 00000 n 
+0000170483 00000 n 
+0000664312 00000 n 
 0000007635 00000 n 
 0000007686 00000 n 
-0000170106 00000 n 
-0000658063 00000 n 
+0000170612 00000 n 
+0000664180 00000 n 
 0000007741 00000 n 
 0000007806 00000 n 
-0000174741 00000 n 
-0000657984 00000 n 
+0000175144 00000 n 
+0000664101 00000 n 
 0000007866 00000 n 
 0000007913 00000 n 
-0000180920 00000 n 
-0000657905 00000 n 
+0000181571 00000 n 
+0000664022 00000 n 
 0000007973 00000 n 
 0000008021 00000 n 
-0000184667 00000 n 
-0000657812 00000 n 
+0000185205 00000 n 
+0000663929 00000 n 
 0000008076 00000 n 
 0000008126 00000 n 
-0000184796 00000 n 
-0000657719 00000 n 
+0000185334 00000 n 
+0000663836 00000 n 
 0000008181 00000 n 
 0000008244 00000 n 
-0000186525 00000 n 
-0000657626 00000 n 
+0000187219 00000 n 
+0000663743 00000 n 
 0000008299 00000 n 
 0000008351 00000 n 
-0000186654 00000 n 
-0000657533 00000 n 
+0000187348 00000 n 
+0000663650 00000 n 
 0000008406 00000 n 
 0000008471 00000 n 
-0000186783 00000 n 
-0000657440 00000 n 
+0000187477 00000 n 
+0000663557 00000 n 
 0000008526 00000 n 
 0000008578 00000 n 
-0000190468 00000 n 
-0000657307 00000 n 
+0000190809 00000 n 
+0000663424 00000 n 
 0000008633 00000 n 
 0000008698 00000 n 
-0000198661 00000 n 
-0000657228 00000 n 
+0000198905 00000 n 
+0000663345 00000 n 
 0000008758 00000 n 
 0000008802 00000 n 
-0000216022 00000 n 
-0000657135 00000 n 
+0000220055 00000 n 
+0000663252 00000 n 
 0000008862 00000 n 
 0000008901 00000 n 
-0000220238 00000 n 
-0000657042 00000 n 
+0000220184 00000 n 
+0000663159 00000 n 
 0000008961 00000 n 
 0000009008 00000 n 
-0000220366 00000 n 
-0000656949 00000 n 
+0000220313 00000 n 
+0000663066 00000 n 
 0000009068 00000 n 
 0000009111 00000 n 
-0000224175 00000 n 
-0000656856 00000 n 
+0000224587 00000 n 
+0000662973 00000 n 
 0000009171 00000 n 
 0000009210 00000 n 
-0000227072 00000 n 
-0000656763 00000 n 
+0000228114 00000 n 
+0000662880 00000 n 
 0000009270 00000 n 
 0000009312 00000 n 
-0000227201 00000 n 
-0000656670 00000 n 
+0000231064 00000 n 
+0000662787 00000 n 
 0000009372 00000 n 
 0000009415 00000 n 
-0000238324 00000 n 
-0000656577 00000 n 
+0000238656 00000 n 
+0000662694 00000 n 
 0000009475 00000 n 
-0000009522 00000 n 
-0000238453 00000 n 
-0000656484 00000 n 
-0000009582 00000 n 
-0000009643 00000 n 
-0000238581 00000 n 
-0000656391 00000 n 
-0000009704 00000 n 
-0000009756 00000 n 
-0000242249 00000 n 
-0000656298 00000 n 
-0000009817 00000 n 
-0000009870 00000 n 
-0000242378 00000 n 
-0000656205 00000 n 
-0000009931 00000 n 
-0000009969 00000 n 
-0000246412 00000 n 
-0000656112 00000 n 
-0000010030 00000 n 
-0000010082 00000 n 
-0000249427 00000 n 
-0000656019 00000 n 
-0000010143 00000 n 
-0000010187 00000 n 
-0000253418 00000 n 
-0000655926 00000 n 
-0000010248 00000 n 
-0000010284 00000 n 
-0000258233 00000 n 
-0000655833 00000 n 
-0000010345 00000 n 
-0000010408 00000 n 
-0000260759 00000 n 
-0000655740 00000 n 
-0000010469 00000 n 
-0000010519 00000 n 
-0000263961 00000 n 
-0000655647 00000 n 
-0000010580 00000 n 
-0000010629 00000 n 
-0000268000 00000 n 
-0000655568 00000 n 
-0000010690 00000 n 
-0000010746 00000 n 
-0000271423 00000 n 
-0000655475 00000 n 
-0000010801 00000 n 
-0000010852 00000 n 
-0000271552 00000 n 
-0000655382 00000 n 
-0000010907 00000 n 
-0000010971 00000 n 
-0000276264 00000 n 
-0000655289 00000 n 
-0000011026 00000 n 
-0000011083 00000 n 
-0000276393 00000 n 
-0000655196 00000 n 
-0000011138 00000 n 
-0000011208 00000 n 
-0000279958 00000 n 
-0000655103 00000 n 
-0000011263 00000 n 
-0000011312 00000 n 
-0000280087 00000 n 
-0000655010 00000 n 
-0000011367 00000 n 
-0000011429 00000 n 
-0000281791 00000 n 
-0000654917 00000 n 
-0000011484 00000 n 
-0000011533 00000 n 
-0000284860 00000 n 
-0000654799 00000 n 
-0000011588 00000 n 
-0000011650 00000 n 
-0000284989 00000 n 
-0000654720 00000 n 
-0000011710 00000 n 
-0000011749 00000 n 
-0000294301 00000 n 
-0000654627 00000 n 
-0000011809 00000 n 
-0000011843 00000 n 
-0000294430 00000 n 
-0000654534 00000 n 
-0000011903 00000 n 
-0000011944 00000 n 
-0000305297 00000 n 
-0000654455 00000 n 
-0000012004 00000 n 
-0000012056 00000 n 
-0000308858 00000 n 
-0000654337 00000 n 
-0000012105 00000 n 
-0000012138 00000 n 
-0000308987 00000 n 
-0000654219 00000 n 
-0000012192 00000 n 
-0000012264 00000 n 
-0000313123 00000 n 
-0000654140 00000 n 
-0000012323 00000 n 
-0000012367 00000 n 
-0000320422 00000 n 
-0000654061 00000 n 
-0000012426 00000 n 
-0000012479 00000 n 
-0000320811 00000 n 
-0000653968 00000 n 
-0000012533 00000 n 
-0000012583 00000 n 
-0000324449 00000 n 
-0000653875 00000 n 
-0000012637 00000 n 
-0000012675 00000 n 
-0000324707 00000 n 
-0000653782 00000 n 
-0000012729 00000 n 
-0000012778 00000 n 
-0000327531 00000 n 
-0000653650 00000 n 
-0000012832 00000 n 
-0000012884 00000 n 
-0000327660 00000 n 
-0000653571 00000 n 
-0000012943 00000 n 
-0000012995 00000 n 
-0000327789 00000 n 
-0000653478 00000 n 
-0000013054 00000 n 
-0000013107 00000 n 
-0000331442 00000 n 
-0000653399 00000 n 
-0000013166 00000 n 
-0000013215 00000 n 
-0000331570 00000 n 
-0000653306 00000 n 
-0000013269 00000 n 
-0000013349 00000 n 
-0000333809 00000 n 
-0000653227 00000 n 
-0000013403 00000 n 
-0000013452 00000 n 
-0000335690 00000 n 
-0000653094 00000 n 
-0000013499 00000 n 
-0000013551 00000 n 
-0000335819 00000 n 
-0000653015 00000 n 
-0000013600 00000 n 
-0000013644 00000 n 
-0000339912 00000 n 
-0000652883 00000 n 
-0000013693 00000 n 
-0000013734 00000 n 
-0000340041 00000 n 
-0000652804 00000 n 
-0000013788 00000 n 
-0000013836 00000 n 
-0000340170 00000 n 
-0000652725 00000 n 
-0000013890 00000 n 
-0000013941 00000 n 
-0000340299 00000 n 
-0000652646 00000 n 
-0000013990 00000 n 
-0000014037 00000 n 
-0000344562 00000 n 
-0000652513 00000 n 
-0000014084 00000 n 
-0000014121 00000 n 
-0000344691 00000 n 
-0000652395 00000 n 
-0000014170 00000 n 
-0000014209 00000 n 
-0000344820 00000 n 
-0000652330 00000 n 
-0000014263 00000 n 
-0000014341 00000 n 
-0000344949 00000 n 
-0000652237 00000 n 
-0000014390 00000 n 
-0000014457 00000 n 
-0000345078 00000 n 
-0000652158 00000 n 
-0000014506 00000 n 
-0000014551 00000 n 
-0000348517 00000 n 
-0000652025 00000 n 
-0000014599 00000 n 
-0000014631 00000 n 
-0000348646 00000 n 
-0000651907 00000 n 
-0000014680 00000 n 
-0000014719 00000 n 
-0000348775 00000 n 
-0000651842 00000 n 
-0000014773 00000 n 
-0000014834 00000 n 
-0000352540 00000 n 
-0000651710 00000 n 
-0000014883 00000 n 
-0000014940 00000 n 
-0000352669 00000 n 
-0000651645 00000 n 
-0000014994 00000 n 
-0000015043 00000 n 
-0000352798 00000 n 
-0000651527 00000 n 
-0000015092 00000 n 
-0000015154 00000 n 
-0000352927 00000 n 
-0000651448 00000 n 
-0000015208 00000 n 
-0000015263 00000 n 
-0000376951 00000 n 
-0000651355 00000 n 
-0000015317 00000 n 
-0000015358 00000 n 
-0000377080 00000 n 
-0000651276 00000 n 
-0000015412 00000 n 
-0000015464 00000 n 
-0000379783 00000 n 
-0000651156 00000 n 
-0000015512 00000 n 
-0000015546 00000 n 
-0000379912 00000 n 
-0000651077 00000 n 
-0000015595 00000 n 
-0000015622 00000 n 
-0000397852 00000 n 
-0000650984 00000 n 
-0000015671 00000 n 
-0000015699 00000 n 
-0000405388 00000 n 
-0000650891 00000 n 
-0000015748 00000 n 
-0000015785 00000 n 
-0000411702 00000 n 
-0000650798 00000 n 
-0000015834 00000 n 
-0000015873 00000 n 
-0000421224 00000 n 
-0000650705 00000 n 
-0000015922 00000 n 
-0000015961 00000 n 
-0000424111 00000 n 
-0000650612 00000 n 
-0000016010 00000 n 
-0000016049 00000 n 
-0000430484 00000 n 
-0000650519 00000 n 
-0000016098 00000 n 
-0000016127 00000 n 
-0000440080 00000 n 
-0000650426 00000 n 
-0000016176 00000 n 
-0000016204 00000 n 
-0000443285 00000 n 
-0000650333 00000 n 
-0000016253 00000 n 
-0000016286 00000 n 
-0000449281 00000 n 
-0000650254 00000 n 
-0000016336 00000 n 
-0000016373 00000 n 
-0000016742 00000 n 
-0000016864 00000 n 
-0000024693 00000 n 
-0000016426 00000 n 
-0000024567 00000 n 
-0000024630 00000 n 
-0000646135 00000 n 
-0000620192 00000 n 
-0000645961 00000 n 
-0000647160 00000 n 
-0000019727 00000 n 
-0000019944 00000 n 
-0000020013 00000 n 
-0000020082 00000 n 
-0000020150 00000 n 
-0000020218 00000 n 
-0000020267 00000 n 
-0000020314 00000 n 
-0000020647 00000 n 
-0000020669 00000 n 
-0000020837 00000 n 
-0000021002 00000 n 
-0000021171 00000 n 
-0000021350 00000 n 
-0000021659 00000 n 
-0000021819 00000 n 
-0000026052 00000 n 
-0000025867 00000 n 
-0000024793 00000 n 
-0000025989 00000 n 
-0000618980 00000 n 
-0000592501 00000 n 
-0000618806 00000 n 
-0000591816 00000 n 
-0000589671 00000 n 
-0000591652 00000 n 
-0000037758 00000 n 
-0000029108 00000 n 
-0000026137 00000 n 
-0000037632 00000 n 
-0000037695 00000 n 
-0000029642 00000 n 
-0000029796 00000 n 
-0000029953 00000 n 
-0000030110 00000 n 
-0000030266 00000 n 
-0000030423 00000 n 
-0000030585 00000 n 
-0000030746 00000 n 
-0000030907 00000 n 
-0000031069 00000 n 
-0000031236 00000 n 
-0000031403 00000 n 
-0000031568 00000 n 
-0000031730 00000 n 
-0000031896 00000 n 
-0000032057 00000 n 
-0000032212 00000 n 
-0000032369 00000 n 
-0000032525 00000 n 
-0000032682 00000 n 
-0000032839 00000 n 
-0000032996 00000 n 
-0000033150 00000 n 
-0000033306 00000 n 
-0000033468 00000 n 
-0000033630 00000 n 
-0000033786 00000 n 
-0000033943 00000 n 
-0000034105 00000 n 
-0000034272 00000 n 
-0000034438 00000 n 
-0000034599 00000 n 
-0000034754 00000 n 
-0000034911 00000 n 
-0000035068 00000 n 
-0000035230 00000 n 
-0000035387 00000 n 
-0000035544 00000 n 
-0000035706 00000 n 
-0000035863 00000 n 
-0000036025 00000 n 
-0000036192 00000 n 
-0000036358 00000 n 
-0000036520 00000 n 
-0000036682 00000 n 
-0000036844 00000 n 
-0000037005 00000 n 
-0000037167 00000 n 
-0000037322 00000 n 
-0000037477 00000 n 
-0000051128 00000 n 
+0000009518 00000 n 
+0000242961 00000 n 
+0000662601 00000 n 
+0000009578 00000 n 
+0000009639 00000 n 
+0000243090 00000 n 
+0000662508 00000 n 
+0000009700 00000 n 
+0000009752 00000 n 
+0000246876 00000 n 
+0000662415 00000 n 
+0000009813 00000 n 
+0000009866 00000 n 
+0000247005 00000 n 
+0000662322 00000 n 
+0000009927 00000 n 
+0000009965 00000 n 
+0000251036 00000 n 
+0000662229 00000 n 
+0000010026 00000 n 
+0000010078 00000 n 
+0000254054 00000 n 
+0000662136 00000 n 
+0000010139 00000 n 
+0000010183 00000 n 
+0000258009 00000 n 
+0000662043 00000 n 
+0000010244 00000 n 
+0000010280 00000 n 
+0000262835 00000 n 
+0000661950 00000 n 
+0000010341 00000 n 
+0000010404 00000 n 
+0000266161 00000 n 
+0000661857 00000 n 
+0000010465 00000 n 
+0000010515 00000 n 
+0000269322 00000 n 
+0000661764 00000 n 
+0000010576 00000 n 
+0000010625 00000 n 
+0000273049 00000 n 
+0000661685 00000 n 
+0000010686 00000 n 
+0000010742 00000 n 
+0000273177 00000 n 
+0000661592 00000 n 
+0000010797 00000 n 
+0000010848 00000 n 
+0000277701 00000 n 
+0000661499 00000 n 
+0000010903 00000 n 
+0000010967 00000 n 
+0000281213 00000 n 
+0000661406 00000 n 
+0000011022 00000 n 
+0000011079 00000 n 
+0000281342 00000 n 
+0000661313 00000 n 
+0000011134 00000 n 
+0000011204 00000 n 
+0000281471 00000 n 
+0000661220 00000 n 
+0000011259 00000 n 
+0000011308 00000 n 
+0000281600 00000 n 
+0000661127 00000 n 
+0000011363 00000 n 
+0000011425 00000 n 
+0000286259 00000 n 
+0000661034 00000 n 
+0000011480 00000 n 
+0000011529 00000 n 
+0000290062 00000 n 
+0000660916 00000 n 
+0000011584 00000 n 
+0000011646 00000 n 
+0000290191 00000 n 
+0000660837 00000 n 
+0000011706 00000 n 
+0000011745 00000 n 
+0000294250 00000 n 
+0000660744 00000 n 
+0000011805 00000 n 
+0000011839 00000 n 
+0000299864 00000 n 
+0000660651 00000 n 
+0000011899 00000 n 
+0000011940 00000 n 
+0000310269 00000 n 
+0000660572 00000 n 
+0000012000 00000 n 
+0000012052 00000 n 
+0000314360 00000 n 
+0000660454 00000 n 
+0000012101 00000 n 
+0000012134 00000 n 
+0000314488 00000 n 
+0000660336 00000 n 
+0000012188 00000 n 
+0000012260 00000 n 
+0000314616 00000 n 
+0000660257 00000 n 
+0000012319 00000 n 
+0000012363 00000 n 
+0000325410 00000 n 
+0000660178 00000 n 
+0000012422 00000 n 
+0000012475 00000 n 
+0000325798 00000 n 
+0000660085 00000 n 
+0000012529 00000 n 
+0000012579 00000 n 
+0000329220 00000 n 
+0000659992 00000 n 
+0000012633 00000 n 
+0000012671 00000 n 
+0000329479 00000 n 
+0000659899 00000 n 
+0000012725 00000 n 
+0000012774 00000 n 
+0000332384 00000 n 
+0000659767 00000 n 
+0000012828 00000 n 
+0000012880 00000 n 
+0000332512 00000 n 
+0000659688 00000 n 
+0000012939 00000 n 
+0000012991 00000 n 
+0000332641 00000 n 
+0000659595 00000 n 
+0000013050 00000 n 
+0000013103 00000 n 
+0000332769 00000 n 
+0000659516 00000 n 
+0000013162 00000 n 
+0000013211 00000 n 
+0000332898 00000 n 
+0000659423 00000 n 
+0000013265 00000 n 
+0000013345 00000 n 
+0000336811 00000 n 
+0000659344 00000 n 
+0000013399 00000 n 
+0000013448 00000 n 
+0000340557 00000 n 
+0000659211 00000 n 
+0000013495 00000 n 
+0000013547 00000 n 
+0000340686 00000 n 
+0000659132 00000 n 
+0000013596 00000 n 
+0000013640 00000 n 
+0000344779 00000 n 
+0000659000 00000 n 
+0000013689 00000 n 
+0000013730 00000 n 
+0000344908 00000 n 
+0000658921 00000 n 
+0000013784 00000 n 
+0000013832 00000 n 
+0000345037 00000 n 
+0000658842 00000 n 
+0000013886 00000 n 
+0000013937 00000 n 
+0000345166 00000 n 
+0000658763 00000 n 
+0000013986 00000 n 
+0000014033 00000 n 
+0000349429 00000 n 
+0000658630 00000 n 
+0000014080 00000 n 
+0000014117 00000 n 
+0000349558 00000 n 
+0000658512 00000 n 
+0000014166 00000 n 
+0000014205 00000 n 
+0000349687 00000 n 
+0000658447 00000 n 
+0000014259 00000 n 
+0000014337 00000 n 
+0000349816 00000 n 
+0000658354 00000 n 
+0000014386 00000 n 
+0000014453 00000 n 
+0000349945 00000 n 
+0000658275 00000 n 
+0000014502 00000 n 
+0000014547 00000 n 
+0000353384 00000 n 
+0000658142 00000 n 
+0000014595 00000 n 
+0000014627 00000 n 
+0000353513 00000 n 
+0000658024 00000 n 
+0000014676 00000 n 
+0000014715 00000 n 
+0000353642 00000 n 
+0000657959 00000 n 
+0000014769 00000 n 
+0000014830 00000 n 
+0000357407 00000 n 
+0000657827 00000 n 
+0000014879 00000 n 
+0000014936 00000 n 
+0000357536 00000 n 
+0000657762 00000 n 
+0000014990 00000 n 
+0000015039 00000 n 
+0000357665 00000 n 
+0000657644 00000 n 
+0000015088 00000 n 
+0000015150 00000 n 
+0000357794 00000 n 
+0000657565 00000 n 
+0000015204 00000 n 
+0000015259 00000 n 
+0000381817 00000 n 
+0000657472 00000 n 
+0000015313 00000 n 
+0000015354 00000 n 
+0000381946 00000 n 
+0000657393 00000 n 
+0000015408 00000 n 
+0000015460 00000 n 
+0000384676 00000 n 
+0000657273 00000 n 
+0000015508 00000 n 
+0000015542 00000 n 
+0000384805 00000 n 
+0000657194 00000 n 
+0000015591 00000 n 
+0000015618 00000 n 
+0000402812 00000 n 
+0000657101 00000 n 
+0000015667 00000 n 
+0000015695 00000 n 
+0000410349 00000 n 
+0000657008 00000 n 
+0000015744 00000 n 
+0000015781 00000 n 
+0000416667 00000 n 
+0000656915 00000 n 
+0000015830 00000 n 
+0000015869 00000 n 
+0000426187 00000 n 
+0000656822 00000 n 
+0000015918 00000 n 
+0000015957 00000 n 
+0000429074 00000 n 
+0000656729 00000 n 
+0000016006 00000 n 
+0000016045 00000 n 
+0000435466 00000 n 
+0000656636 00000 n 
+0000016094 00000 n 
+0000016123 00000 n 
+0000444851 00000 n 
+0000656543 00000 n 
+0000016172 00000 n 
+0000016200 00000 n 
+0000448491 00000 n 
+0000656450 00000 n 
+0000016249 00000 n 
+0000016282 00000 n 
+0000457889 00000 n 
+0000656371 00000 n 
+0000016332 00000 n 
+0000016369 00000 n 
+0000016738 00000 n 
+0000016860 00000 n 
+0000024689 00000 n 
+0000016422 00000 n 
+0000024563 00000 n 
+0000024626 00000 n 
+0000652234 00000 n 
+0000626291 00000 n 
+0000652060 00000 n 
+0000653259 00000 n 
+0000019723 00000 n 
+0000019940 00000 n 
+0000020009 00000 n 
+0000020078 00000 n 
+0000020146 00000 n 
+0000020214 00000 n 
+0000020263 00000 n 
+0000020310 00000 n 
+0000020643 00000 n 
+0000020665 00000 n 
+0000020833 00000 n 
+0000020998 00000 n 
+0000021167 00000 n 
+0000021346 00000 n 
+0000021655 00000 n 
+0000021815 00000 n 
+0000026053 00000 n 
+0000025868 00000 n 
+0000024789 00000 n 
+0000025990 00000 n 
+0000625079 00000 n 
+0000598600 00000 n 
+0000624905 00000 n 
+0000597915 00000 n 
+0000595770 00000 n 
+0000597751 00000 n 
+0000037759 00000 n 
+0000029109 00000 n 
+0000026138 00000 n 
+0000037633 00000 n 
+0000037696 00000 n 
+0000029643 00000 n 
+0000029797 00000 n 
+0000029954 00000 n 
+0000030111 00000 n 
+0000030267 00000 n 
+0000030424 00000 n 
+0000030586 00000 n 
+0000030747 00000 n 
+0000030908 00000 n 
+0000031070 00000 n 
+0000031237 00000 n 
+0000031404 00000 n 
+0000031569 00000 n 
+0000031731 00000 n 
+0000031897 00000 n 
+0000032058 00000 n 
+0000032213 00000 n 
+0000032370 00000 n 
+0000032526 00000 n 
+0000032683 00000 n 
+0000032840 00000 n 
+0000032997 00000 n 
+0000033151 00000 n 
+0000033307 00000 n 
+0000033469 00000 n 
+0000033631 00000 n 
+0000033787 00000 n 
+0000033944 00000 n 
+0000034106 00000 n 
+0000034273 00000 n 
+0000034439 00000 n 
+0000034600 00000 n 
+0000034755 00000 n 
+0000034912 00000 n 
+0000035069 00000 n 
+0000035231 00000 n 
+0000035388 00000 n 
+0000035545 00000 n 
+0000035707 00000 n 
+0000035864 00000 n 
+0000036026 00000 n 
+0000036193 00000 n 
+0000036359 00000 n 
+0000036521 00000 n 
+0000036683 00000 n 
+0000036845 00000 n 
+0000037006 00000 n 
+0000037168 00000 n 
+0000037323 00000 n 
+0000037478 00000 n 
+0000051124 00000 n 
 0000041076 00000 n 
-0000037843 00000 n 
-0000051065 00000 n 
-0000589120 00000 n 
-0000572039 00000 n 
-0000588936 00000 n 
+0000037844 00000 n 
+0000051061 00000 n 
+0000595219 00000 n 
+0000578138 00000 n 
+0000595035 00000 n 
 0000041666 00000 n 
 0000041829 00000 n 
 0000041991 00000 n 
@@ -11723,1175 +11781,1184 @@ xref
 0000047361 00000 n 
 0000047525 00000 n 
 0000047694 00000 n 
-0000047863 00000 n 
-0000048032 00000 n 
-0000048201 00000 n 
-0000048370 00000 n 
-0000048539 00000 n 
-0000048708 00000 n 
-0000048877 00000 n 
-0000049046 00000 n 
-0000049216 00000 n 
-0000049386 00000 n 
-0000049556 00000 n 
-0000049725 00000 n 
-0000049895 00000 n 
-0000050065 00000 n 
-0000050235 00000 n 
-0000050404 00000 n 
-0000050574 00000 n 
-0000050742 00000 n 
-0000050903 00000 n 
-0000063950 00000 n 
-0000054659 00000 n 
-0000051226 00000 n 
-0000063887 00000 n 
-0000055225 00000 n 
-0000055388 00000 n 
-0000055551 00000 n 
-0000055714 00000 n 
-0000055877 00000 n 
-0000056039 00000 n 
-0000056202 00000 n 
-0000056370 00000 n 
-0000056538 00000 n 
-0000056705 00000 n 
-0000056873 00000 n 
-0000057029 00000 n 
-0000057191 00000 n 
-0000057358 00000 n 
-0000057525 00000 n 
-0000057687 00000 n 
-0000057849 00000 n 
-0000058011 00000 n 
-0000058173 00000 n 
-0000058340 00000 n 
-0000058507 00000 n 
-0000058673 00000 n 
-0000058835 00000 n 
-0000058997 00000 n 
-0000059152 00000 n 
-0000059307 00000 n 
-0000059464 00000 n 
-0000059626 00000 n 
-0000059788 00000 n 
-0000059944 00000 n 
-0000060099 00000 n 
-0000060256 00000 n 
-0000060418 00000 n 
-0000060574 00000 n 
-0000060731 00000 n 
-0000060887 00000 n 
-0000061044 00000 n 
-0000061206 00000 n 
-0000061363 00000 n 
-0000061525 00000 n 
-0000061682 00000 n 
-0000061843 00000 n 
-0000062005 00000 n 
-0000062167 00000 n 
-0000062322 00000 n 
-0000062478 00000 n 
-0000062635 00000 n 
-0000062792 00000 n 
-0000062949 00000 n 
-0000063105 00000 n 
-0000063262 00000 n 
-0000063419 00000 n 
-0000571073 00000 n 
-0000551106 00000 n 
-0000570900 00000 n 
-0000063576 00000 n 
-0000063731 00000 n 
-0000064395 00000 n 
-0000064210 00000 n 
-0000064061 00000 n 
-0000064332 00000 n 
-0000067523 00000 n 
-0000066713 00000 n 
-0000064436 00000 n 
-0000066835 00000 n 
-0000066959 00000 n 
-0000067084 00000 n 
-0000067209 00000 n 
-0000550217 00000 n 
-0000528885 00000 n 
-0000550043 00000 n 
-0000067334 00000 n 
-0000067397 00000 n 
-0000067460 00000 n 
-0000528118 00000 n 
-0000510710 00000 n 
-0000527945 00000 n 
-0000647278 00000 n 
-0000072034 00000 n 
-0000070852 00000 n 
-0000067647 00000 n 
-0000071346 00000 n 
-0000071409 00000 n 
-0000071472 00000 n 
-0000071597 00000 n 
-0000071722 00000 n 
-0000071847 00000 n 
-0000071002 00000 n 
-0000071195 00000 n 
-0000071972 00000 n 
-0000309051 00000 n 
-0000352991 00000 n 
-0000076688 00000 n 
-0000075652 00000 n 
-0000072158 00000 n 
-0000076125 00000 n 
-0000076250 00000 n 
-0000075802 00000 n 
-0000075964 00000 n 
-0000076375 00000 n 
-0000076500 00000 n 
-0000076625 00000 n 
-0000092558 00000 n 
-0000079910 00000 n 
-0000079350 00000 n 
-0000076812 00000 n 
-0000079472 00000 n 
-0000079597 00000 n 
-0000079722 00000 n 
-0000079847 00000 n 
-0000083337 00000 n 
-0000082196 00000 n 
-0000080021 00000 n 
-0000082650 00000 n 
-0000082775 00000 n 
-0000082900 00000 n 
-0000083025 00000 n 
-0000083150 00000 n 
-0000082346 00000 n 
-0000082498 00000 n 
-0000083274 00000 n 
-0000268064 00000 n 
-0000084423 00000 n 
-0000084113 00000 n 
-0000083422 00000 n 
-0000084235 00000 n 
-0000084360 00000 n 
-0000086508 00000 n 
-0000085823 00000 n 
-0000084521 00000 n 
-0000085945 00000 n 
-0000086070 00000 n 
-0000086194 00000 n 
-0000086319 00000 n 
-0000086445 00000 n 
-0000647396 00000 n 
-0000089413 00000 n 
-0000088545 00000 n 
-0000086606 00000 n 
-0000088847 00000 n 
-0000088973 00000 n 
-0000089036 00000 n 
-0000089099 00000 n 
-0000088687 00000 n 
-0000089225 00000 n 
-0000089351 00000 n 
-0000249491 00000 n 
-0000092747 00000 n 
-0000092310 00000 n 
-0000089524 00000 n 
-0000092432 00000 n 
-0000510054 00000 n 
-0000498468 00000 n 
-0000509877 00000 n 
-0000092684 00000 n 
-0000096532 00000 n 
-0000096347 00000 n 
-0000092871 00000 n 
-0000096469 00000 n 
-0000497933 00000 n 
-0000488419 00000 n 
-0000497756 00000 n 
-0000100916 00000 n 
-0000100525 00000 n 
-0000096695 00000 n 
-0000100853 00000 n 
-0000100667 00000 n 
-0000161651 00000 n 
-0000103202 00000 n 
-0000102765 00000 n 
-0000101053 00000 n 
-0000102887 00000 n 
-0000103013 00000 n 
-0000103076 00000 n 
-0000103139 00000 n 
-0000105854 00000 n 
-0000108386 00000 n 
-0000105703 00000 n 
-0000103326 00000 n 
-0000107818 00000 n 
-0000107944 00000 n 
-0000108070 00000 n 
-0000107496 00000 n 
-0000107657 00000 n 
-0000487560 00000 n 
-0000478188 00000 n 
-0000487388 00000 n 
-0000477626 00000 n 
-0000468543 00000 n 
-0000477453 00000 n 
-0000108196 00000 n 
-0000108322 00000 n 
-0000647514 00000 n 
-0000107325 00000 n 
-0000107383 00000 n 
-0000107473 00000 n 
-0000198725 00000 n 
-0000227265 00000 n 
-0000112935 00000 n 
-0000112001 00000 n 
-0000108538 00000 n 
-0000112485 00000 n 
-0000112613 00000 n 
-0000112157 00000 n 
-0000112323 00000 n 
-0000112741 00000 n 
-0000112870 00000 n 
-0000357017 00000 n 
-0000116427 00000 n 
-0000116047 00000 n 
-0000113086 00000 n 
-0000116362 00000 n 
-0000116194 00000 n 
-0000117661 00000 n 
-0000117470 00000 n 
-0000116552 00000 n 
-0000117596 00000 n 
-0000120563 00000 n 
-0000119987 00000 n 
-0000117760 00000 n 
-0000120113 00000 n 
-0000120240 00000 n 
-0000120369 00000 n 
-0000120498 00000 n 
-0000123953 00000 n 
-0000123118 00000 n 
-0000120701 00000 n 
-0000123244 00000 n 
-0000123373 00000 n 
-0000123502 00000 n 
-0000123631 00000 n 
-0000123759 00000 n 
-0000123888 00000 n 
-0000127856 00000 n 
-0000127088 00000 n 
-0000124091 00000 n 
-0000127405 00000 n 
-0000127235 00000 n 
-0000127534 00000 n 
-0000127663 00000 n 
-0000127792 00000 n 
-0000647638 00000 n 
-0000305361 00000 n 
-0000131720 00000 n 
-0000131143 00000 n 
-0000127968 00000 n 
-0000131269 00000 n 
-0000131398 00000 n 
-0000131526 00000 n 
-0000131655 00000 n 
-0000135162 00000 n 
-0000134842 00000 n 
-0000131858 00000 n 
-0000134968 00000 n 
-0000135097 00000 n 
-0000138493 00000 n 
-0000137734 00000 n 
-0000135274 00000 n 
-0000138042 00000 n 
-0000138171 00000 n 
-0000137881 00000 n 
-0000138300 00000 n 
-0000138428 00000 n 
-0000352733 00000 n 
-0000141231 00000 n 
-0000140653 00000 n 
-0000138659 00000 n 
-0000140779 00000 n 
-0000140908 00000 n 
-0000141037 00000 n 
-0000141166 00000 n 
-0000141671 00000 n 
-0000141480 00000 n 
-0000141330 00000 n 
-0000141606 00000 n 
-0000145673 00000 n 
-0000144907 00000 n 
-0000141713 00000 n 
-0000145221 00000 n 
-0000145350 00000 n 
-0000145478 00000 n 
-0000145543 00000 n 
-0000145608 00000 n 
-0000145054 00000 n 
-0000647763 00000 n 
-0000149746 00000 n 
-0000150069 00000 n 
-0000149491 00000 n 
-0000145772 00000 n 
-0000149617 00000 n 
-0000149875 00000 n 
-0000150004 00000 n 
-0000153675 00000 n 
-0000153097 00000 n 
-0000150207 00000 n 
-0000153223 00000 n 
-0000153352 00000 n 
-0000153481 00000 n 
-0000153610 00000 n 
-0000156460 00000 n 
-0000157710 00000 n 
-0000156334 00000 n 
-0000153800 00000 n 
-0000157386 00000 n 
-0000157515 00000 n 
-0000157580 00000 n 
-0000157645 00000 n 
-0000161715 00000 n 
-0000160882 00000 n 
-0000157864 00000 n 
-0000161008 00000 n 
-0000161137 00000 n 
-0000161264 00000 n 
-0000161329 00000 n 
-0000161394 00000 n 
-0000161523 00000 n 
-0000166757 00000 n 
-0000165359 00000 n 
-0000161827 00000 n 
-0000166177 00000 n 
-0000165533 00000 n 
-0000165684 00000 n 
-0000166306 00000 n 
-0000166435 00000 n 
-0000166564 00000 n 
-0000166693 00000 n 
-0000165843 00000 n 
-0000165993 00000 n 
-0000454734 00000 n 
-0000170235 00000 n 
-0000169578 00000 n 
-0000166895 00000 n 
-0000169912 00000 n 
-0000169725 00000 n 
-0000170041 00000 n 
-0000170170 00000 n 
-0000647888 00000 n 
-0000174870 00000 n 
-0000174550 00000 n 
-0000170360 00000 n 
-0000174676 00000 n 
-0000174805 00000 n 
-0000178034 00000 n 
-0000177655 00000 n 
-0000174995 00000 n 
-0000177969 00000 n 
-0000177802 00000 n 
-0000180984 00000 n 
-0000181178 00000 n 
-0000180729 00000 n 
-0000178146 00000 n 
-0000180855 00000 n 
-0000181049 00000 n 
-0000181113 00000 n 
-0000184925 00000 n 
-0000184141 00000 n 
-0000181290 00000 n 
-0000184602 00000 n 
-0000184731 00000 n 
-0000184860 00000 n 
-0000184297 00000 n 
-0000184449 00000 n 
-0000186912 00000 n 
-0000186334 00000 n 
-0000185037 00000 n 
-0000186460 00000 n 
-0000186589 00000 n 
-0000186718 00000 n 
-0000186847 00000 n 
-0000188482 00000 n 
-0000188291 00000 n 
-0000187024 00000 n 
-0000188417 00000 n 
-0000648013 00000 n 
-0000190597 00000 n 
-0000190277 00000 n 
-0000188581 00000 n 
-0000190403 00000 n 
-0000190532 00000 n 
-0000194902 00000 n 
-0000194534 00000 n 
-0000190709 00000 n 
-0000194837 00000 n 
-0000194681 00000 n 
-0000264025 00000 n 
-0000198790 00000 n 
-0000198470 00000 n 
-0000195027 00000 n 
-0000198596 00000 n 
-0000202882 00000 n 
-0000202386 00000 n 
-0000198915 00000 n 
-0000202687 00000 n 
-0000202752 00000 n 
-0000202817 00000 n 
-0000202533 00000 n 
-0000208035 00000 n 
-0000206902 00000 n 
-0000203007 00000 n 
-0000207970 00000 n 
-0000207085 00000 n 
-0000207241 00000 n 
-0000207426 00000 n 
-0000207600 00000 n 
-0000207785 00000 n 
-0000271616 00000 n 
-0000212172 00000 n 
-0000211981 00000 n 
-0000208227 00000 n 
-0000212107 00000 n 
-0000648138 00000 n 
-0000216151 00000 n 
-0000215831 00000 n 
-0000212297 00000 n 
-0000215957 00000 n 
-0000216086 00000 n 
-0000220494 00000 n 
-0000219505 00000 n 
-0000216263 00000 n 
-0000220173 00000 n 
-0000219670 00000 n 
-0000220302 00000 n 
-0000220430 00000 n 
-0000219839 00000 n 
-0000220005 00000 n 
-0000281855 00000 n 
-0000340363 00000 n 
-0000224304 00000 n 
-0000223794 00000 n 
-0000220660 00000 n 
-0000224110 00000 n 
-0000223941 00000 n 
-0000224239 00000 n 
-0000227330 00000 n 
-0000226881 00000 n 
-0000224429 00000 n 
-0000227007 00000 n 
-0000227136 00000 n 
-0000231409 00000 n 
-0000231218 00000 n 
-0000227496 00000 n 
-0000231344 00000 n 
-0000234348 00000 n 
-0000234157 00000 n 
-0000231521 00000 n 
-0000234283 00000 n 
-0000648263 00000 n 
-0000238710 00000 n 
-0000237775 00000 n 
-0000234501 00000 n 
-0000238259 00000 n 
-0000238388 00000 n 
-0000238517 00000 n 
-0000237931 00000 n 
-0000238645 00000 n 
-0000238104 00000 n 
-0000242507 00000 n 
-0000242058 00000 n 
-0000238822 00000 n 
-0000242184 00000 n 
-0000242313 00000 n 
-0000242442 00000 n 
-0000246540 00000 n 
-0000245874 00000 n 
-0000242660 00000 n 
-0000246347 00000 n 
-0000246476 00000 n 
-0000246030 00000 n 
-0000246192 00000 n 
-0000249685 00000 n 
-0000249047 00000 n 
-0000246706 00000 n 
-0000249362 00000 n 
-0000249194 00000 n 
-0000249555 00000 n 
-0000249620 00000 n 
-0000253546 00000 n 
-0000253044 00000 n 
-0000249810 00000 n 
-0000253353 00000 n 
-0000253481 00000 n 
-0000253191 00000 n 
-0000258361 00000 n 
-0000257681 00000 n 
-0000253725 00000 n 
-0000258168 00000 n 
-0000257837 00000 n 
-0000468188 00000 n 
-0000466190 00000 n 
-0000468023 00000 n 
-0000258297 00000 n 
-0000257999 00000 n 
-0000648388 00000 n 
-0000333873 00000 n 
-0000280022 00000 n 
-0000260888 00000 n 
-0000260568 00000 n 
-0000258487 00000 n 
-0000260694 00000 n 
-0000260823 00000 n 
-0000264220 00000 n 
-0000263770 00000 n 
-0000261000 00000 n 
-0000263896 00000 n 
-0000264090 00000 n 
-0000264155 00000 n 
-0000268128 00000 n 
-0000267809 00000 n 
-0000264373 00000 n 
-0000267935 00000 n 
-0000271680 00000 n 
-0000271232 00000 n 
-0000268227 00000 n 
-0000271358 00000 n 
-0000271487 00000 n 
-0000276522 00000 n 
-0000275571 00000 n 
-0000271792 00000 n 
-0000276199 00000 n 
-0000275736 00000 n 
-0000275887 00000 n 
-0000276328 00000 n 
-0000276457 00000 n 
-0000276046 00000 n 
-0000280216 00000 n 
-0000279767 00000 n 
-0000276634 00000 n 
-0000279893 00000 n 
-0000280151 00000 n 
-0000648513 00000 n 
-0000281920 00000 n 
-0000281600 00000 n 
-0000280328 00000 n 
-0000281726 00000 n 
-0000283415 00000 n 
-0000283224 00000 n 
-0000282032 00000 n 
-0000283350 00000 n 
-0000285248 00000 n 
-0000284669 00000 n 
-0000283514 00000 n 
-0000284795 00000 n 
-0000284924 00000 n 
-0000285053 00000 n 
-0000285118 00000 n 
-0000285183 00000 n 
-0000289283 00000 n 
-0000289092 00000 n 
-0000285360 00000 n 
-0000289218 00000 n 
-0000294558 00000 n 
-0000292553 00000 n 
-0000289395 00000 n 
-0000294236 00000 n 
-0000294365 00000 n 
-0000294493 00000 n 
-0000292772 00000 n 
-0000292934 00000 n 
-0000293096 00000 n 
-0000293258 00000 n 
-0000293419 00000 n 
-0000293590 00000 n 
-0000293750 00000 n 
-0000293913 00000 n 
-0000294075 00000 n 
-0000299681 00000 n 
-0000297777 00000 n 
-0000294670 00000 n 
-0000299616 00000 n 
-0000298005 00000 n 
-0000298167 00000 n 
-0000298329 00000 n 
-0000298492 00000 n 
-0000298655 00000 n 
-0000298817 00000 n 
-0000298979 00000 n 
-0000299141 00000 n 
-0000299303 00000 n 
-0000299464 00000 n 
-0000648638 00000 n 
-0000305426 00000 n 
-0000302905 00000 n 
-0000299806 00000 n 
-0000305232 00000 n 
-0000303160 00000 n 
-0000303313 00000 n 
-0000303475 00000 n 
-0000303637 00000 n 
-0000303799 00000 n 
-0000303961 00000 n 
-0000304123 00000 n 
-0000304284 00000 n 
-0000304446 00000 n 
-0000304600 00000 n 
-0000304761 00000 n 
-0000304916 00000 n 
-0000305078 00000 n 
-0000309115 00000 n 
-0000308537 00000 n 
-0000305538 00000 n 
-0000308663 00000 n 
-0000308728 00000 n 
-0000308793 00000 n 
-0000308922 00000 n 
-0000313512 00000 n 
-0000312571 00000 n 
-0000309240 00000 n 
-0000313058 00000 n 
-0000313187 00000 n 
-0000312727 00000 n 
-0000312897 00000 n 
-0000313252 00000 n 
-0000313317 00000 n 
-0000313382 00000 n 
-0000313447 00000 n 
-0000317077 00000 n 
-0000316756 00000 n 
-0000313624 00000 n 
-0000316882 00000 n 
-0000316947 00000 n 
-0000317012 00000 n 
-0000320940 00000 n 
-0000320231 00000 n 
-0000317189 00000 n 
-0000320357 00000 n 
-0000320486 00000 n 
-0000320551 00000 n 
-0000320616 00000 n 
-0000320681 00000 n 
-0000320746 00000 n 
-0000320875 00000 n 
-0000324965 00000 n 
-0000324128 00000 n 
-0000321052 00000 n 
-0000324254 00000 n 
-0000324319 00000 n 
-0000324384 00000 n 
-0000324513 00000 n 
-0000324578 00000 n 
-0000324643 00000 n 
-0000324771 00000 n 
-0000324835 00000 n 
-0000324900 00000 n 
-0000648763 00000 n 
-0000327918 00000 n 
-0000327340 00000 n 
-0000325090 00000 n 
-0000327466 00000 n 
-0000327595 00000 n 
-0000327724 00000 n 
-0000327853 00000 n 
-0000331829 00000 n 
-0000331251 00000 n 
-0000328111 00000 n 
-0000331377 00000 n 
-0000331506 00000 n 
-0000331634 00000 n 
-0000331699 00000 n 
-0000331764 00000 n 
-0000333938 00000 n 
-0000333618 00000 n 
-0000331967 00000 n 
-0000333744 00000 n 
-0000335948 00000 n 
-0000335499 00000 n 
-0000334050 00000 n 
-0000335625 00000 n 
-0000335754 00000 n 
-0000335883 00000 n 
-0000340428 00000 n 
-0000339484 00000 n 
-0000336060 00000 n 
-0000339847 00000 n 
-0000465869 00000 n 
-0000456656 00000 n 
-0000465683 00000 n 
-0000339631 00000 n 
-0000339976 00000 n 
-0000340105 00000 n 
-0000340234 00000 n 
-0000341466 00000 n 
-0000341275 00000 n 
-0000340661 00000 n 
-0000341401 00000 n 
-0000648888 00000 n 
-0000341893 00000 n 
-0000341702 00000 n 
-0000341552 00000 n 
-0000341828 00000 n 
-0000345206 00000 n 
-0000343980 00000 n 
-0000341935 00000 n 
-0000344497 00000 n 
-0000344626 00000 n 
-0000344755 00000 n 
-0000344884 00000 n 
-0000345013 00000 n 
-0000345142 00000 n 
-0000344136 00000 n 
-0000344308 00000 n 
-0000345660 00000 n 
-0000345469 00000 n 
-0000345319 00000 n 
-0000345595 00000 n 
-0000348904 00000 n 
-0000348326 00000 n 
-0000345702 00000 n 
-0000348452 00000 n 
-0000348581 00000 n 
-0000348710 00000 n 
-0000348839 00000 n 
-0000353183 00000 n 
-0000351964 00000 n 
-0000348990 00000 n 
-0000352475 00000 n 
-0000352604 00000 n 
-0000352862 00000 n 
-0000352120 00000 n 
-0000352299 00000 n 
-0000353055 00000 n 
-0000353119 00000 n 
-0000360069 00000 n 
-0000356241 00000 n 
-0000353335 00000 n 
-0000356367 00000 n 
-0000356432 00000 n 
-0000356497 00000 n 
-0000356562 00000 n 
-0000356627 00000 n 
-0000356692 00000 n 
-0000356757 00000 n 
-0000356822 00000 n 
-0000356887 00000 n 
-0000356952 00000 n 
-0000357082 00000 n 
-0000357147 00000 n 
-0000357212 00000 n 
-0000357277 00000 n 
+0000047862 00000 n 
+0000048031 00000 n 
+0000048200 00000 n 
+0000048369 00000 n 
+0000048538 00000 n 
+0000048707 00000 n 
+0000048876 00000 n 
+0000049045 00000 n 
+0000049215 00000 n 
+0000049385 00000 n 
+0000049555 00000 n 
+0000049724 00000 n 
+0000049894 00000 n 
+0000050064 00000 n 
+0000050232 00000 n 
+0000050401 00000 n 
+0000050571 00000 n 
+0000050738 00000 n 
+0000050899 00000 n 
+0000063946 00000 n 
+0000054652 00000 n 
+0000051222 00000 n 
+0000063883 00000 n 
+0000055218 00000 n 
+0000055381 00000 n 
+0000055544 00000 n 
+0000055707 00000 n 
+0000055870 00000 n 
+0000056032 00000 n 
+0000056195 00000 n 
+0000056363 00000 n 
+0000056531 00000 n 
+0000056699 00000 n 
+0000056867 00000 n 
+0000057023 00000 n 
+0000057185 00000 n 
+0000057352 00000 n 
+0000057519 00000 n 
+0000057681 00000 n 
+0000057843 00000 n 
+0000058005 00000 n 
+0000058167 00000 n 
+0000058334 00000 n 
+0000058501 00000 n 
+0000058667 00000 n 
+0000058829 00000 n 
+0000058991 00000 n 
+0000059146 00000 n 
+0000059301 00000 n 
+0000059458 00000 n 
+0000059620 00000 n 
+0000059782 00000 n 
+0000059939 00000 n 
+0000060094 00000 n 
+0000060251 00000 n 
+0000060413 00000 n 
+0000060569 00000 n 
+0000060726 00000 n 
+0000060882 00000 n 
+0000061039 00000 n 
+0000061201 00000 n 
+0000061358 00000 n 
+0000061520 00000 n 
+0000061677 00000 n 
+0000061838 00000 n 
+0000062000 00000 n 
+0000062162 00000 n 
+0000062317 00000 n 
+0000062473 00000 n 
+0000062630 00000 n 
+0000062787 00000 n 
+0000062944 00000 n 
+0000063100 00000 n 
+0000063257 00000 n 
+0000063414 00000 n 
+0000577172 00000 n 
+0000557205 00000 n 
+0000576999 00000 n 
+0000063571 00000 n 
+0000063727 00000 n 
+0000064391 00000 n 
+0000064206 00000 n 
+0000064057 00000 n 
+0000064328 00000 n 
+0000067519 00000 n 
+0000066709 00000 n 
+0000064432 00000 n 
+0000066831 00000 n 
+0000066955 00000 n 
+0000067080 00000 n 
+0000067205 00000 n 
+0000556316 00000 n 
+0000534984 00000 n 
+0000556142 00000 n 
+0000067330 00000 n 
+0000067393 00000 n 
+0000067456 00000 n 
+0000534210 00000 n 
+0000516663 00000 n 
+0000534037 00000 n 
+0000653377 00000 n 
+0000072030 00000 n 
+0000070848 00000 n 
+0000067643 00000 n 
+0000071342 00000 n 
+0000071405 00000 n 
+0000071468 00000 n 
+0000071593 00000 n 
+0000071718 00000 n 
+0000071843 00000 n 
+0000070998 00000 n 
+0000071191 00000 n 
+0000071968 00000 n 
+0000314552 00000 n 
+0000357858 00000 n 
+0000076684 00000 n 
+0000075648 00000 n 
+0000072154 00000 n 
+0000076121 00000 n 
+0000076246 00000 n 
+0000075798 00000 n 
+0000075960 00000 n 
+0000076371 00000 n 
+0000076496 00000 n 
+0000076621 00000 n 
+0000092551 00000 n 
+0000079906 00000 n 
+0000079346 00000 n 
+0000076808 00000 n 
+0000079468 00000 n 
+0000079593 00000 n 
+0000079718 00000 n 
+0000079843 00000 n 
+0000083333 00000 n 
+0000082192 00000 n 
+0000080017 00000 n 
+0000082646 00000 n 
+0000082771 00000 n 
+0000082896 00000 n 
+0000083021 00000 n 
+0000083146 00000 n 
+0000082342 00000 n 
+0000082494 00000 n 
+0000083270 00000 n 
+0000273113 00000 n 
+0000084416 00000 n 
+0000084106 00000 n 
+0000083418 00000 n 
+0000084228 00000 n 
+0000084353 00000 n 
+0000086501 00000 n 
+0000085816 00000 n 
+0000084514 00000 n 
+0000085938 00000 n 
+0000086063 00000 n 
+0000086187 00000 n 
+0000086312 00000 n 
+0000086438 00000 n 
+0000653495 00000 n 
+0000089406 00000 n 
+0000088538 00000 n 
+0000086599 00000 n 
+0000088840 00000 n 
+0000088966 00000 n 
+0000089029 00000 n 
+0000089092 00000 n 
+0000088680 00000 n 
+0000089218 00000 n 
+0000089344 00000 n 
+0000254118 00000 n 
+0000092740 00000 n 
+0000092303 00000 n 
+0000089517 00000 n 
+0000092425 00000 n 
+0000516007 00000 n 
+0000504421 00000 n 
+0000515830 00000 n 
+0000092677 00000 n 
+0000096525 00000 n 
+0000096340 00000 n 
+0000092864 00000 n 
+0000096462 00000 n 
+0000503882 00000 n 
+0000494141 00000 n 
+0000503705 00000 n 
+0000100909 00000 n 
+0000100518 00000 n 
+0000096688 00000 n 
+0000100846 00000 n 
+0000100660 00000 n 
+0000161496 00000 n 
+0000103195 00000 n 
+0000102758 00000 n 
+0000101046 00000 n 
+0000102880 00000 n 
+0000103006 00000 n 
+0000103069 00000 n 
+0000103132 00000 n 
+0000105847 00000 n 
+0000108379 00000 n 
+0000105696 00000 n 
+0000103319 00000 n 
+0000107811 00000 n 
+0000107937 00000 n 
+0000108063 00000 n 
+0000107489 00000 n 
+0000107650 00000 n 
+0000493282 00000 n 
+0000483910 00000 n 
+0000493110 00000 n 
+0000483348 00000 n 
+0000474265 00000 n 
+0000483175 00000 n 
+0000108189 00000 n 
+0000108315 00000 n 
+0000653613 00000 n 
+0000107318 00000 n 
+0000107376 00000 n 
+0000107466 00000 n 
+0000198969 00000 n 
+0000231128 00000 n 
+0000112928 00000 n 
+0000111994 00000 n 
+0000108531 00000 n 
+0000112478 00000 n 
+0000112606 00000 n 
+0000112150 00000 n 
+0000112316 00000 n 
+0000112734 00000 n 
+0000112863 00000 n 
+0000361883 00000 n 
+0000116420 00000 n 
+0000116040 00000 n 
+0000113079 00000 n 
+0000116355 00000 n 
+0000116187 00000 n 
+0000117654 00000 n 
+0000117463 00000 n 
+0000116545 00000 n 
+0000117589 00000 n 
+0000120556 00000 n 
+0000119980 00000 n 
+0000117753 00000 n 
+0000120106 00000 n 
+0000120233 00000 n 
+0000120362 00000 n 
+0000120491 00000 n 
+0000123946 00000 n 
+0000123111 00000 n 
+0000120694 00000 n 
+0000123237 00000 n 
+0000123366 00000 n 
+0000123495 00000 n 
+0000123624 00000 n 
+0000123752 00000 n 
+0000123881 00000 n 
+0000127849 00000 n 
+0000127081 00000 n 
+0000124084 00000 n 
+0000127398 00000 n 
+0000127228 00000 n 
+0000127527 00000 n 
+0000127656 00000 n 
+0000127785 00000 n 
+0000653737 00000 n 
+0000310333 00000 n 
+0000131713 00000 n 
+0000131136 00000 n 
+0000127961 00000 n 
+0000131262 00000 n 
+0000131391 00000 n 
+0000131519 00000 n 
+0000131648 00000 n 
+0000135155 00000 n 
+0000134835 00000 n 
+0000131851 00000 n 
+0000134961 00000 n 
+0000135090 00000 n 
+0000138486 00000 n 
+0000137727 00000 n 
+0000135267 00000 n 
+0000138035 00000 n 
+0000138164 00000 n 
+0000137874 00000 n 
+0000138293 00000 n 
+0000138421 00000 n 
+0000357600 00000 n 
+0000141224 00000 n 
+0000140646 00000 n 
+0000138652 00000 n 
+0000140772 00000 n 
+0000140901 00000 n 
+0000141030 00000 n 
+0000141159 00000 n 
+0000141664 00000 n 
+0000141473 00000 n 
+0000141323 00000 n 
+0000141599 00000 n 
+0000145666 00000 n 
+0000144900 00000 n 
+0000141706 00000 n 
+0000145214 00000 n 
+0000145343 00000 n 
+0000145471 00000 n 
+0000145536 00000 n 
+0000145601 00000 n 
+0000145047 00000 n 
+0000653862 00000 n 
+0000150078 00000 n 
+0000150270 00000 n 
+0000149824 00000 n 
+0000145765 00000 n 
+0000149950 00000 n 
+0000150205 00000 n 
+0000154096 00000 n 
+0000153389 00000 n 
+0000150395 00000 n 
+0000153515 00000 n 
+0000153644 00000 n 
+0000153773 00000 n 
+0000153902 00000 n 
+0000154031 00000 n 
+0000156826 00000 n 
+0000158075 00000 n 
+0000156700 00000 n 
+0000154221 00000 n 
+0000157752 00000 n 
+0000157881 00000 n 
+0000157946 00000 n 
+0000158010 00000 n 
+0000161559 00000 n 
+0000160725 00000 n 
+0000158229 00000 n 
+0000160851 00000 n 
+0000160980 00000 n 
+0000161108 00000 n 
+0000161173 00000 n 
+0000161238 00000 n 
+0000161367 00000 n 
+0000166717 00000 n 
+0000165800 00000 n 
+0000161671 00000 n 
+0000166266 00000 n 
+0000165956 00000 n 
+0000166107 00000 n 
+0000166395 00000 n 
+0000166524 00000 n 
+0000166652 00000 n 
+0000460456 00000 n 
+0000170741 00000 n 
+0000169599 00000 n 
+0000166855 00000 n 
+0000170289 00000 n 
+0000170418 00000 n 
+0000169764 00000 n 
+0000169916 00000 n 
+0000170103 00000 n 
+0000170547 00000 n 
+0000170676 00000 n 
+0000653987 00000 n 
+0000175273 00000 n 
+0000174953 00000 n 
+0000170866 00000 n 
+0000175079 00000 n 
+0000175208 00000 n 
+0000178462 00000 n 
+0000178083 00000 n 
+0000175398 00000 n 
+0000178397 00000 n 
+0000178230 00000 n 
+0000181635 00000 n 
+0000181830 00000 n 
+0000181380 00000 n 
+0000178574 00000 n 
+0000181506 00000 n 
+0000181700 00000 n 
+0000181765 00000 n 
+0000185463 00000 n 
+0000184678 00000 n 
+0000181942 00000 n 
+0000185140 00000 n 
+0000185269 00000 n 
+0000185398 00000 n 
+0000184834 00000 n 
+0000184987 00000 n 
+0000187606 00000 n 
+0000187028 00000 n 
+0000185575 00000 n 
+0000187154 00000 n 
+0000187283 00000 n 
+0000187412 00000 n 
+0000187541 00000 n 
+0000189177 00000 n 
+0000188986 00000 n 
+0000187718 00000 n 
+0000189112 00000 n 
+0000654112 00000 n 
+0000190937 00000 n 
+0000190618 00000 n 
+0000189276 00000 n 
+0000190744 00000 n 
+0000190873 00000 n 
+0000195079 00000 n 
+0000194711 00000 n 
+0000191049 00000 n 
+0000195014 00000 n 
+0000194858 00000 n 
+0000269386 00000 n 
+0000199034 00000 n 
+0000198714 00000 n 
+0000195204 00000 n 
+0000198840 00000 n 
+0000202871 00000 n 
+0000202551 00000 n 
+0000199159 00000 n 
+0000202677 00000 n 
+0000202742 00000 n 
+0000202806 00000 n 
+0000208134 00000 n 
+0000206840 00000 n 
+0000202996 00000 n 
+0000208069 00000 n 
+0000207032 00000 n 
+0000207186 00000 n 
+0000207342 00000 n 
+0000207527 00000 n 
+0000207701 00000 n 
+0000207885 00000 n 
+0000277765 00000 n 
+0000212392 00000 n 
+0000212201 00000 n 
+0000208313 00000 n 
+0000212327 00000 n 
+0000654237 00000 n 
+0000216088 00000 n 
+0000215897 00000 n 
+0000212517 00000 n 
+0000216023 00000 n 
+0000220442 00000 n 
+0000219499 00000 n 
+0000216200 00000 n 
+0000219990 00000 n 
+0000220119 00000 n 
+0000219655 00000 n 
+0000220248 00000 n 
+0000220377 00000 n 
+0000219824 00000 n 
+0000286323 00000 n 
+0000224715 00000 n 
+0000224024 00000 n 
+0000220608 00000 n 
+0000224522 00000 n 
+0000224180 00000 n 
+0000224351 00000 n 
+0000224651 00000 n 
+0000345230 00000 n 
+0000228243 00000 n 
+0000227923 00000 n 
+0000224840 00000 n 
+0000228049 00000 n 
+0000228178 00000 n 
+0000231193 00000 n 
+0000230873 00000 n 
+0000228355 00000 n 
+0000230999 00000 n 
+0000235248 00000 n 
+0000235057 00000 n 
+0000231346 00000 n 
+0000235183 00000 n 
+0000654362 00000 n 
+0000238785 00000 n 
+0000238284 00000 n 
+0000235401 00000 n 
+0000238591 00000 n 
+0000238720 00000 n 
+0000238431 00000 n 
+0000243217 00000 n 
+0000242410 00000 n 
+0000238951 00000 n 
+0000242896 00000 n 
+0000243025 00000 n 
+0000242566 00000 n 
+0000243153 00000 n 
+0000242741 00000 n 
+0000247134 00000 n 
+0000246685 00000 n 
+0000243329 00000 n 
+0000246811 00000 n 
+0000246940 00000 n 
+0000247069 00000 n 
+0000251164 00000 n 
+0000250497 00000 n 
+0000247287 00000 n 
+0000250971 00000 n 
+0000251100 00000 n 
+0000250653 00000 n 
+0000250815 00000 n 
+0000254312 00000 n 
+0000253673 00000 n 
+0000251330 00000 n 
+0000253989 00000 n 
+0000253820 00000 n 
+0000254182 00000 n 
+0000254247 00000 n 
+0000258137 00000 n 
+0000257637 00000 n 
+0000254437 00000 n 
+0000257944 00000 n 
+0000258073 00000 n 
+0000257784 00000 n 
+0000654487 00000 n 
+0000262963 00000 n 
+0000262285 00000 n 
+0000258316 00000 n 
+0000262770 00000 n 
+0000262441 00000 n 
+0000473910 00000 n 
+0000471912 00000 n 
+0000473745 00000 n 
+0000262898 00000 n 
+0000262603 00000 n 
+0000336875 00000 n 
+0000281535 00000 n 
+0000266290 00000 n 
+0000265970 00000 n 
+0000263089 00000 n 
+0000266096 00000 n 
+0000266225 00000 n 
+0000269580 00000 n 
+0000269131 00000 n 
+0000266456 00000 n 
+0000269257 00000 n 
+0000269451 00000 n 
+0000269515 00000 n 
+0000273306 00000 n 
+0000272858 00000 n 
+0000269679 00000 n 
+0000272984 00000 n 
+0000273241 00000 n 
+0000277829 00000 n 
+0000277340 00000 n 
+0000273418 00000 n 
+0000277636 00000 n 
+0000277487 00000 n 
+0000281728 00000 n 
+0000280676 00000 n 
+0000277941 00000 n 
+0000281148 00000 n 
+0000280832 00000 n 
+0000281277 00000 n 
+0000281406 00000 n 
+0000280994 00000 n 
+0000281664 00000 n 
+0000654612 00000 n 
+0000284830 00000 n 
+0000284639 00000 n 
+0000281840 00000 n 
+0000284765 00000 n 
+0000286388 00000 n 
+0000286068 00000 n 
+0000284942 00000 n 
+0000286194 00000 n 
+0000287824 00000 n 
+0000287633 00000 n 
+0000286500 00000 n 
+0000287759 00000 n 
+0000290450 00000 n 
+0000289871 00000 n 
+0000287923 00000 n 
+0000289997 00000 n 
+0000290126 00000 n 
+0000290255 00000 n 
+0000290320 00000 n 
+0000290385 00000 n 
+0000294379 00000 n 
+0000294059 00000 n 
+0000290562 00000 n 
+0000294185 00000 n 
+0000294314 00000 n 
+0000299993 00000 n 
+0000297603 00000 n 
+0000294491 00000 n 
+0000299799 00000 n 
+0000299928 00000 n 
+0000297849 00000 n 
+0000298011 00000 n 
+0000298173 00000 n 
+0000298334 00000 n 
+0000298494 00000 n 
+0000298665 00000 n 
+0000298827 00000 n 
+0000298989 00000 n 
+0000299149 00000 n 
+0000299310 00000 n 
+0000299473 00000 n 
+0000299636 00000 n 
+0000654737 00000 n 
+0000305217 00000 n 
+0000303157 00000 n 
+0000300118 00000 n 
+0000305152 00000 n 
+0000303394 00000 n 
+0000303554 00000 n 
+0000303716 00000 n 
+0000303877 00000 n 
+0000304038 00000 n 
+0000304200 00000 n 
+0000304363 00000 n 
+0000304517 00000 n 
+0000304670 00000 n 
+0000304832 00000 n 
+0000304992 00000 n 
+0000310526 00000 n 
+0000308563 00000 n 
+0000305342 00000 n 
+0000310204 00000 n 
+0000308782 00000 n 
+0000308942 00000 n 
+0000309104 00000 n 
+0000309263 00000 n 
+0000309422 00000 n 
+0000309575 00000 n 
+0000309738 00000 n 
+0000309888 00000 n 
+0000310050 00000 n 
+0000310398 00000 n 
+0000310462 00000 n 
+0000314874 00000 n 
+0000313808 00000 n 
+0000310651 00000 n 
+0000314295 00000 n 
+0000314423 00000 n 
+0000314680 00000 n 
+0000313964 00000 n 
+0000314134 00000 n 
+0000314745 00000 n 
+0000314810 00000 n 
+0000318327 00000 n 
+0000318006 00000 n 
+0000314999 00000 n 
+0000318132 00000 n 
+0000318197 00000 n 
+0000318262 00000 n 
+0000321897 00000 n 
+0000321576 00000 n 
+0000318426 00000 n 
+0000321702 00000 n 
+0000321767 00000 n 
+0000321832 00000 n 
+0000325927 00000 n 
+0000325219 00000 n 
+0000322009 00000 n 
+0000325345 00000 n 
+0000325474 00000 n 
+0000325539 00000 n 
+0000325604 00000 n 
+0000325668 00000 n 
+0000325733 00000 n 
+0000325862 00000 n 
+0000654862 00000 n 
+0000329738 00000 n 
+0000328899 00000 n 
+0000326052 00000 n 
+0000329025 00000 n 
+0000329090 00000 n 
+0000329155 00000 n 
+0000329284 00000 n 
+0000329349 00000 n 
+0000329414 00000 n 
+0000329543 00000 n 
+0000329608 00000 n 
+0000329673 00000 n 
+0000333026 00000 n 
+0000332193 00000 n 
+0000329917 00000 n 
+0000332319 00000 n 
+0000332448 00000 n 
+0000332576 00000 n 
+0000332704 00000 n 
+0000332833 00000 n 
+0000332962 00000 n 
+0000336940 00000 n 
+0000336490 00000 n 
+0000333219 00000 n 
+0000336616 00000 n 
+0000336681 00000 n 
+0000336746 00000 n 
+0000338422 00000 n 
+0000338231 00000 n 
+0000337065 00000 n 
+0000338357 00000 n 
+0000338875 00000 n 
+0000338684 00000 n 
+0000338534 00000 n 
+0000338810 00000 n 
+0000340815 00000 n 
+0000340366 00000 n 
+0000338917 00000 n 
+0000340492 00000 n 
+0000340621 00000 n 
+0000340750 00000 n 
+0000654987 00000 n 
+0000345295 00000 n 
+0000344351 00000 n 
+0000340927 00000 n 
+0000344714 00000 n 
+0000471591 00000 n 
+0000462378 00000 n 
+0000471405 00000 n 
+0000344498 00000 n 
+0000344843 00000 n 
+0000344972 00000 n 
+0000345101 00000 n 
+0000346333 00000 n 
+0000346142 00000 n 
+0000345528 00000 n 
+0000346268 00000 n 
+0000346760 00000 n 
+0000346569 00000 n 
+0000346419 00000 n 
+0000346695 00000 n 
+0000350073 00000 n 
+0000348847 00000 n 
+0000346802 00000 n 
+0000349364 00000 n 
+0000349493 00000 n 
+0000349622 00000 n 
+0000349751 00000 n 
+0000349880 00000 n 
+0000350009 00000 n 
+0000349003 00000 n 
+0000349175 00000 n 
+0000350527 00000 n 
+0000350336 00000 n 
+0000350186 00000 n 
+0000350462 00000 n 
+0000353771 00000 n 
+0000353193 00000 n 
+0000350569 00000 n 
+0000353319 00000 n 
+0000353448 00000 n 
+0000353577 00000 n 
+0000353706 00000 n 
+0000655112 00000 n 
+0000358050 00000 n 
+0000356831 00000 n 
+0000353857 00000 n 
 0000357342 00000 n 
-0000357407 00000 n 
-0000357472 00000 n 
-0000357537 00000 n 
-0000357602 00000 n 
-0000357667 00000 n 
-0000357732 00000 n 
-0000357797 00000 n 
-0000357862 00000 n 
-0000357927 00000 n 
-0000357992 00000 n 
-0000358057 00000 n 
-0000358122 00000 n 
-0000358187 00000 n 
-0000358252 00000 n 
-0000358317 00000 n 
-0000358382 00000 n 
-0000358447 00000 n 
-0000358512 00000 n 
-0000358577 00000 n 
-0000358641 00000 n 
-0000358706 00000 n 
-0000358771 00000 n 
-0000358836 00000 n 
-0000358901 00000 n 
-0000358966 00000 n 
-0000359031 00000 n 
-0000359096 00000 n 
-0000359161 00000 n 
-0000359226 00000 n 
-0000359291 00000 n 
-0000359356 00000 n 
-0000359421 00000 n 
-0000359486 00000 n 
-0000359551 00000 n 
-0000359616 00000 n 
-0000359681 00000 n 
-0000359746 00000 n 
-0000359811 00000 n 
-0000359876 00000 n 
-0000359941 00000 n 
-0000360005 00000 n 
-0000649013 00000 n 
-0000366715 00000 n 
-0000363151 00000 n 
-0000360181 00000 n 
-0000363277 00000 n 
-0000363342 00000 n 
-0000363407 00000 n 
-0000363472 00000 n 
-0000363537 00000 n 
-0000363602 00000 n 
-0000363667 00000 n 
-0000363732 00000 n 
-0000363797 00000 n 
-0000363862 00000 n 
-0000363927 00000 n 
-0000363992 00000 n 
-0000364056 00000 n 
-0000364121 00000 n 
-0000364186 00000 n 
-0000364251 00000 n 
-0000364316 00000 n 
-0000364381 00000 n 
-0000364446 00000 n 
-0000364511 00000 n 
-0000364576 00000 n 
-0000364641 00000 n 
-0000364706 00000 n 
-0000364771 00000 n 
-0000364835 00000 n 
-0000364900 00000 n 
-0000364965 00000 n 
-0000365030 00000 n 
-0000365095 00000 n 
-0000365160 00000 n 
-0000365225 00000 n 
-0000365290 00000 n 
-0000365355 00000 n 
-0000365420 00000 n 
-0000365485 00000 n 
-0000365550 00000 n 
-0000365615 00000 n 
-0000365680 00000 n 
-0000365745 00000 n 
-0000365810 00000 n 
-0000365874 00000 n 
-0000365938 00000 n 
-0000366002 00000 n 
-0000366067 00000 n 
-0000366132 00000 n 
-0000366197 00000 n 
-0000366262 00000 n 
-0000366327 00000 n 
-0000366392 00000 n 
-0000366457 00000 n 
-0000366522 00000 n 
-0000366587 00000 n 
-0000366651 00000 n 
-0000372890 00000 n 
-0000369452 00000 n 
-0000366827 00000 n 
-0000369578 00000 n 
-0000369643 00000 n 
-0000369708 00000 n 
-0000369773 00000 n 
-0000369838 00000 n 
-0000369903 00000 n 
-0000369968 00000 n 
-0000370033 00000 n 
-0000370098 00000 n 
-0000370163 00000 n 
-0000370228 00000 n 
-0000370293 00000 n 
-0000370358 00000 n 
-0000370423 00000 n 
-0000370488 00000 n 
-0000370553 00000 n 
-0000370618 00000 n 
-0000370683 00000 n 
-0000370748 00000 n 
-0000370813 00000 n 
-0000370878 00000 n 
-0000370943 00000 n 
-0000371008 00000 n 
-0000371073 00000 n 
-0000371138 00000 n 
-0000371203 00000 n 
-0000371268 00000 n 
-0000371333 00000 n 
-0000371398 00000 n 
-0000371463 00000 n 
-0000371528 00000 n 
-0000371593 00000 n 
-0000371658 00000 n 
-0000371723 00000 n 
-0000371787 00000 n 
-0000371852 00000 n 
-0000371917 00000 n 
-0000371982 00000 n 
-0000372047 00000 n 
-0000372112 00000 n 
-0000372177 00000 n 
-0000372242 00000 n 
-0000372307 00000 n 
-0000372372 00000 n 
-0000372437 00000 n 
-0000372502 00000 n 
-0000372567 00000 n 
-0000372632 00000 n 
-0000372697 00000 n 
-0000372762 00000 n 
-0000372826 00000 n 
-0000377469 00000 n 
-0000375205 00000 n 
-0000373002 00000 n 
-0000375331 00000 n 
-0000375396 00000 n 
-0000375461 00000 n 
-0000375526 00000 n 
-0000375591 00000 n 
-0000375656 00000 n 
-0000375721 00000 n 
-0000375786 00000 n 
-0000375851 00000 n 
-0000375916 00000 n 
-0000375981 00000 n 
-0000376046 00000 n 
-0000376111 00000 n 
-0000376176 00000 n 
-0000376238 00000 n 
-0000376302 00000 n 
-0000376367 00000 n 
-0000376431 00000 n 
-0000376496 00000 n 
-0000376561 00000 n 
-0000376626 00000 n 
-0000376691 00000 n 
-0000376756 00000 n 
-0000376821 00000 n 
-0000376886 00000 n 
-0000377015 00000 n 
-0000377144 00000 n 
-0000377209 00000 n 
-0000377274 00000 n 
-0000377339 00000 n 
-0000377404 00000 n 
-0000380236 00000 n 
-0000379592 00000 n 
-0000377594 00000 n 
-0000379718 00000 n 
-0000379847 00000 n 
-0000379976 00000 n 
-0000380041 00000 n 
-0000380106 00000 n 
-0000380171 00000 n 
-0000384721 00000 n 
-0000384400 00000 n 
-0000380348 00000 n 
-0000384526 00000 n 
-0000384591 00000 n 
-0000384656 00000 n 
-0000387972 00000 n 
-0000387716 00000 n 
-0000384873 00000 n 
-0000387842 00000 n 
-0000387907 00000 n 
-0000649138 00000 n 
-0000391222 00000 n 
-0000391031 00000 n 
-0000388110 00000 n 
-0000391157 00000 n 
-0000395002 00000 n 
-0000394746 00000 n 
-0000391347 00000 n 
-0000394872 00000 n 
-0000394937 00000 n 
-0000398176 00000 n 
-0000397401 00000 n 
-0000395140 00000 n 
-0000397527 00000 n 
-0000397592 00000 n 
-0000397657 00000 n 
-0000397722 00000 n 
-0000397787 00000 n 
-0000397916 00000 n 
-0000397981 00000 n 
-0000398046 00000 n 
-0000398111 00000 n 
-0000402648 00000 n 
-0000402457 00000 n 
-0000398314 00000 n 
-0000402583 00000 n 
-0000405776 00000 n 
-0000405003 00000 n 
-0000402786 00000 n 
-0000405129 00000 n 
-0000405194 00000 n 
-0000405259 00000 n 
-0000405323 00000 n 
-0000405452 00000 n 
-0000405517 00000 n 
-0000405581 00000 n 
-0000405646 00000 n 
-0000405711 00000 n 
-0000409166 00000 n 
-0000408910 00000 n 
-0000405914 00000 n 
-0000409036 00000 n 
-0000409101 00000 n 
-0000649263 00000 n 
-0000412026 00000 n 
-0000411316 00000 n 
-0000409304 00000 n 
-0000411442 00000 n 
-0000411507 00000 n 
-0000411572 00000 n 
-0000411637 00000 n 
-0000411766 00000 n 
-0000411831 00000 n 
-0000411896 00000 n 
-0000411961 00000 n 
-0000415705 00000 n 
-0000415449 00000 n 
-0000412177 00000 n 
-0000415575 00000 n 
-0000415640 00000 n 
-0000419142 00000 n 
-0000418886 00000 n 
-0000415830 00000 n 
-0000419012 00000 n 
-0000419077 00000 n 
-0000421613 00000 n 
-0000420905 00000 n 
-0000419280 00000 n 
-0000421031 00000 n 
-0000421096 00000 n 
-0000421161 00000 n 
-0000421288 00000 n 
-0000421353 00000 n 
-0000421418 00000 n 
-0000421483 00000 n 
-0000421548 00000 n 
-0000424499 00000 n 
-0000423725 00000 n 
-0000421764 00000 n 
+0000357471 00000 n 
+0000357729 00000 n 
+0000356987 00000 n 
+0000357166 00000 n 
+0000357922 00000 n 
+0000357986 00000 n 
+0000364935 00000 n 
+0000361107 00000 n 
+0000358202 00000 n 
+0000361233 00000 n 
+0000361298 00000 n 
+0000361363 00000 n 
+0000361428 00000 n 
+0000361493 00000 n 
+0000361558 00000 n 
+0000361623 00000 n 
+0000361688 00000 n 
+0000361753 00000 n 
+0000361818 00000 n 
+0000361948 00000 n 
+0000362013 00000 n 
+0000362078 00000 n 
+0000362143 00000 n 
+0000362208 00000 n 
+0000362273 00000 n 
+0000362338 00000 n 
+0000362403 00000 n 
+0000362468 00000 n 
+0000362533 00000 n 
+0000362598 00000 n 
+0000362663 00000 n 
+0000362728 00000 n 
+0000362793 00000 n 
+0000362858 00000 n 
+0000362923 00000 n 
+0000362988 00000 n 
+0000363053 00000 n 
+0000363118 00000 n 
+0000363183 00000 n 
+0000363248 00000 n 
+0000363313 00000 n 
+0000363378 00000 n 
+0000363443 00000 n 
+0000363507 00000 n 
+0000363572 00000 n 
+0000363637 00000 n 
+0000363702 00000 n 
+0000363767 00000 n 
+0000363832 00000 n 
+0000363897 00000 n 
+0000363962 00000 n 
+0000364027 00000 n 
+0000364092 00000 n 
+0000364157 00000 n 
+0000364222 00000 n 
+0000364287 00000 n 
+0000364352 00000 n 
+0000364417 00000 n 
+0000364482 00000 n 
+0000364547 00000 n 
+0000364612 00000 n 
+0000364677 00000 n 
+0000364742 00000 n 
+0000364807 00000 n 
+0000364871 00000 n 
+0000371581 00000 n 
+0000368017 00000 n 
+0000365047 00000 n 
+0000368143 00000 n 
+0000368208 00000 n 
+0000368273 00000 n 
+0000368338 00000 n 
+0000368403 00000 n 
+0000368468 00000 n 
+0000368533 00000 n 
+0000368598 00000 n 
+0000368663 00000 n 
+0000368728 00000 n 
+0000368793 00000 n 
+0000368858 00000 n 
+0000368922 00000 n 
+0000368987 00000 n 
+0000369052 00000 n 
+0000369117 00000 n 
+0000369182 00000 n 
+0000369247 00000 n 
+0000369312 00000 n 
+0000369377 00000 n 
+0000369442 00000 n 
+0000369507 00000 n 
+0000369572 00000 n 
+0000369637 00000 n 
+0000369701 00000 n 
+0000369766 00000 n 
+0000369831 00000 n 
+0000369896 00000 n 
+0000369961 00000 n 
+0000370026 00000 n 
+0000370091 00000 n 
+0000370156 00000 n 
+0000370221 00000 n 
+0000370286 00000 n 
+0000370351 00000 n 
+0000370416 00000 n 
+0000370481 00000 n 
+0000370546 00000 n 
+0000370611 00000 n 
+0000370676 00000 n 
+0000370740 00000 n 
+0000370804 00000 n 
+0000370868 00000 n 
+0000370933 00000 n 
+0000370998 00000 n 
+0000371063 00000 n 
+0000371128 00000 n 
+0000371193 00000 n 
+0000371258 00000 n 
+0000371323 00000 n 
+0000371388 00000 n 
+0000371453 00000 n 
+0000371517 00000 n 
+0000377756 00000 n 
+0000374318 00000 n 
+0000371693 00000 n 
+0000374444 00000 n 
+0000374509 00000 n 
+0000374574 00000 n 
+0000374639 00000 n 
+0000374704 00000 n 
+0000374769 00000 n 
+0000374834 00000 n 
+0000374899 00000 n 
+0000374964 00000 n 
+0000375029 00000 n 
+0000375094 00000 n 
+0000375159 00000 n 
+0000375224 00000 n 
+0000375289 00000 n 
+0000375354 00000 n 
+0000375419 00000 n 
+0000375484 00000 n 
+0000375549 00000 n 
+0000375614 00000 n 
+0000375679 00000 n 
+0000375744 00000 n 
+0000375809 00000 n 
+0000375874 00000 n 
+0000375939 00000 n 
+0000376004 00000 n 
+0000376069 00000 n 
+0000376134 00000 n 
+0000376199 00000 n 
+0000376264 00000 n 
+0000376329 00000 n 
+0000376394 00000 n 
+0000376459 00000 n 
+0000376524 00000 n 
+0000376589 00000 n 
+0000376653 00000 n 
+0000376718 00000 n 
+0000376783 00000 n 
+0000376848 00000 n 
+0000376913 00000 n 
+0000376978 00000 n 
+0000377043 00000 n 
+0000377108 00000 n 
+0000377173 00000 n 
+0000377238 00000 n 
+0000377303 00000 n 
+0000377368 00000 n 
+0000377433 00000 n 
+0000377498 00000 n 
+0000377563 00000 n 
+0000377628 00000 n 
+0000377692 00000 n 
+0000382335 00000 n 
+0000380071 00000 n 
+0000377868 00000 n 
+0000380197 00000 n 
+0000380262 00000 n 
+0000380327 00000 n 
+0000380392 00000 n 
+0000380457 00000 n 
+0000380522 00000 n 
+0000380587 00000 n 
+0000380652 00000 n 
+0000380717 00000 n 
+0000380782 00000 n 
+0000380847 00000 n 
+0000380912 00000 n 
+0000380977 00000 n 
+0000381042 00000 n 
+0000381104 00000 n 
+0000381168 00000 n 
+0000381233 00000 n 
+0000381297 00000 n 
+0000381362 00000 n 
+0000381427 00000 n 
+0000381492 00000 n 
+0000381557 00000 n 
+0000381622 00000 n 
+0000381687 00000 n 
+0000381752 00000 n 
+0000381881 00000 n 
+0000382010 00000 n 
+0000382075 00000 n 
+0000382140 00000 n 
+0000382205 00000 n 
+0000382270 00000 n 
+0000385129 00000 n 
+0000384485 00000 n 
+0000382460 00000 n 
+0000384611 00000 n 
+0000384740 00000 n 
+0000384869 00000 n 
+0000384934 00000 n 
+0000384999 00000 n 
+0000385064 00000 n 
+0000655237 00000 n 
+0000389467 00000 n 
+0000389147 00000 n 
+0000385241 00000 n 
+0000389273 00000 n 
+0000389338 00000 n 
+0000389403 00000 n 
+0000392936 00000 n 
+0000392680 00000 n 
+0000389619 00000 n 
+0000392806 00000 n 
+0000392871 00000 n 
+0000396183 00000 n 
+0000395992 00000 n 
+0000393074 00000 n 
+0000396118 00000 n 
+0000399962 00000 n 
+0000399706 00000 n 
+0000396308 00000 n 
+0000399832 00000 n 
+0000399897 00000 n 
+0000403136 00000 n 
+0000402361 00000 n 
+0000400100 00000 n 
+0000402487 00000 n 
+0000402552 00000 n 
+0000402617 00000 n 
+0000402682 00000 n 
+0000402747 00000 n 
+0000402876 00000 n 
+0000402941 00000 n 
+0000403006 00000 n 
+0000403071 00000 n 
+0000407608 00000 n 
+0000407417 00000 n 
+0000403274 00000 n 
+0000407543 00000 n 
+0000655362 00000 n 
+0000410737 00000 n 
+0000409964 00000 n 
+0000407746 00000 n 
+0000410090 00000 n 
+0000410155 00000 n 
+0000410220 00000 n 
+0000410284 00000 n 
+0000410413 00000 n 
+0000410478 00000 n 
+0000410542 00000 n 
+0000410607 00000 n 
+0000410672 00000 n 
+0000414128 00000 n 
+0000413872 00000 n 
+0000410875 00000 n 
+0000413998 00000 n 
+0000414063 00000 n 
+0000416991 00000 n 
+0000416281 00000 n 
+0000414266 00000 n 
+0000416407 00000 n 
+0000416472 00000 n 
+0000416537 00000 n 
+0000416602 00000 n 
+0000416731 00000 n 
+0000416796 00000 n 
+0000416861 00000 n 
+0000416926 00000 n 
+0000420670 00000 n 
+0000420414 00000 n 
+0000417142 00000 n 
+0000420540 00000 n 
+0000420605 00000 n 
+0000424107 00000 n 
 0000423851 00000 n 
-0000423916 00000 n 
-0000423981 00000 n 
-0000424046 00000 n 
-0000424174 00000 n 
-0000424239 00000 n 
-0000424304 00000 n 
-0000424369 00000 n 
-0000424434 00000 n 
-0000427855 00000 n 
-0000427664 00000 n 
-0000424637 00000 n 
-0000427790 00000 n 
-0000649388 00000 n 
-0000430808 00000 n 
-0000430098 00000 n 
-0000427980 00000 n 
-0000430224 00000 n 
-0000430289 00000 n 
-0000430354 00000 n 
-0000430419 00000 n 
-0000430548 00000 n 
-0000430613 00000 n 
-0000430678 00000 n 
-0000430743 00000 n 
-0000434107 00000 n 
-0000433851 00000 n 
-0000430959 00000 n 
-0000433977 00000 n 
-0000434042 00000 n 
-0000436991 00000 n 
-0000436607 00000 n 
-0000434300 00000 n 
-0000436733 00000 n 
-0000436798 00000 n 
-0000436863 00000 n 
-0000436927 00000 n 
-0000440469 00000 n 
-0000439759 00000 n 
-0000437223 00000 n 
-0000439885 00000 n 
-0000439950 00000 n 
-0000440015 00000 n 
-0000440144 00000 n 
-0000440209 00000 n 
-0000440274 00000 n 
-0000440339 00000 n 
-0000440404 00000 n 
-0000443609 00000 n 
-0000442900 00000 n 
-0000440620 00000 n 
-0000443026 00000 n 
-0000443091 00000 n 
-0000443156 00000 n 
-0000443220 00000 n 
-0000443349 00000 n 
-0000443414 00000 n 
-0000443479 00000 n 
-0000443544 00000 n 
-0000446792 00000 n 
-0000446536 00000 n 
-0000443773 00000 n 
-0000446662 00000 n 
-0000446727 00000 n 
-0000649513 00000 n 
-0000449538 00000 n 
-0000448895 00000 n 
-0000446917 00000 n 
-0000449021 00000 n 
-0000449086 00000 n 
-0000449151 00000 n 
-0000449216 00000 n 
-0000449344 00000 n 
-0000449409 00000 n 
-0000449474 00000 n 
-0000453271 00000 n 
-0000452951 00000 n 
-0000449689 00000 n 
-0000453077 00000 n 
-0000453142 00000 n 
-0000453207 00000 n 
-0000454596 00000 n 
-0000454210 00000 n 
-0000453396 00000 n 
-0000454336 00000 n 
-0000454401 00000 n 
-0000454466 00000 n 
-0000454531 00000 n 
-0000454767 00000 n 
-0000466111 00000 n 
-0000468435 00000 n 
-0000468404 00000 n 
-0000477923 00000 n 
-0000487979 00000 n 
-0000498217 00000 n 
-0000510423 00000 n 
-0000528556 00000 n 
-0000550644 00000 n 
-0000571654 00000 n 
-0000589472 00000 n 
-0000592303 00000 n 
-0000592073 00000 n 
-0000619561 00000 n 
-0000646670 00000 n 
-0000649620 00000 n 
-0000649743 00000 n 
-0000649869 00000 n 
-0000649995 00000 n 
-0000650085 00000 n 
-0000650177 00000 n 
-0000665468 00000 n 
-0000682734 00000 n 
-0000682775 00000 n 
-0000682815 00000 n 
-0000682949 00000 n 
+0000420795 00000 n 
+0000423977 00000 n 
+0000424042 00000 n 
+0000426576 00000 n 
+0000425868 00000 n 
+0000424245 00000 n 
+0000425994 00000 n 
+0000426059 00000 n 
+0000426124 00000 n 
+0000426251 00000 n 
+0000426316 00000 n 
+0000426381 00000 n 
+0000426446 00000 n 
+0000426511 00000 n 
+0000655487 00000 n 
+0000429462 00000 n 
+0000428688 00000 n 
+0000426727 00000 n 
+0000428814 00000 n 
+0000428879 00000 n 
+0000428944 00000 n 
+0000429009 00000 n 
+0000429137 00000 n 
+0000429202 00000 n 
+0000429267 00000 n 
+0000429332 00000 n 
+0000429397 00000 n 
+0000432818 00000 n 
+0000432627 00000 n 
+0000429600 00000 n 
+0000432753 00000 n 
+0000435789 00000 n 
+0000435080 00000 n 
+0000432943 00000 n 
+0000435206 00000 n 
+0000435271 00000 n 
+0000435336 00000 n 
+0000435401 00000 n 
+0000435529 00000 n 
+0000435594 00000 n 
+0000435659 00000 n 
+0000435724 00000 n 
+0000439301 00000 n 
+0000439045 00000 n 
+0000435940 00000 n 
+0000439171 00000 n 
+0000439236 00000 n 
+0000442176 00000 n 
+0000441920 00000 n 
+0000439507 00000 n 
+0000442046 00000 n 
+0000442111 00000 n 
+0000445175 00000 n 
+0000444400 00000 n 
+0000442382 00000 n 
+0000444526 00000 n 
+0000444591 00000 n 
+0000444656 00000 n 
+0000444721 00000 n 
+0000444786 00000 n 
+0000444915 00000 n 
+0000444980 00000 n 
+0000445045 00000 n 
+0000445110 00000 n 
+0000655612 00000 n 
+0000448684 00000 n 
+0000448041 00000 n 
+0000445326 00000 n 
+0000448167 00000 n 
+0000448232 00000 n 
+0000448297 00000 n 
+0000448362 00000 n 
+0000448427 00000 n 
+0000448555 00000 n 
+0000448620 00000 n 
+0000452245 00000 n 
+0000451859 00000 n 
+0000448848 00000 n 
+0000451985 00000 n 
+0000452050 00000 n 
+0000452115 00000 n 
+0000452180 00000 n 
+0000454598 00000 n 
+0000454213 00000 n 
+0000452370 00000 n 
+0000454339 00000 n 
+0000454404 00000 n 
+0000454469 00000 n 
+0000454534 00000 n 
+0000458278 00000 n 
+0000457698 00000 n 
+0000454749 00000 n 
+0000457824 00000 n 
+0000457953 00000 n 
+0000458018 00000 n 
+0000458083 00000 n 
+0000458148 00000 n 
+0000458213 00000 n 
+0000460305 00000 n 
+0000459919 00000 n 
+0000458416 00000 n 
+0000460045 00000 n 
+0000460110 00000 n 
+0000460175 00000 n 
+0000460240 00000 n 
+0000460489 00000 n 
+0000471833 00000 n 
+0000474157 00000 n 
+0000474126 00000 n 
+0000483645 00000 n 
+0000493701 00000 n 
+0000504168 00000 n 
+0000516376 00000 n 
+0000534653 00000 n 
+0000556743 00000 n 
+0000577753 00000 n 
+0000595571 00000 n 
+0000598402 00000 n 
+0000598172 00000 n 
+0000625660 00000 n 
+0000652769 00000 n 
+0000655737 00000 n 
+0000655860 00000 n 
+0000655986 00000 n 
+0000656112 00000 n 
+0000656202 00000 n 
+0000656294 00000 n 
+0000671585 00000 n 
+0000688895 00000 n 
+0000688936 00000 n 
+0000688976 00000 n 
+0000689110 00000 n 
 trailer
 <<
-/Size 1948
-/Root 1946 0 R
-/Info 1947 0 R
-/ID [<A4072AF3D8FA19F5AE39BAC528A783EF> <A4072AF3D8FA19F5AE39BAC528A783EF>]
+/Size 1957
+/Root 1955 0 R
+/Info 1956 0 R
+/ID [<B3E059B0906A0C00E3685A1538A2E1E1> <B3E059B0906A0C00E3685A1538A2E1E1>]
 >>
 startxref
-683207
+689368
 %%EOF
diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 7d0e43779e09..e6aa96d26227 100644
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.dig.html,v 1.2.2.48 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.dig.html,v 1.2.2.65 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -47,12 +47,12 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [<code class="option">-h</code>]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2564025"></a><h2>DESCRIPTION</h2>
+<a name="id2563849"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -80,8 +80,8 @@
       <code class="filename">/etc/resolv.conf</code>.
     </p>
 <p>
-      When no command line arguments or options are given, will perform an
-      NS query for "." (the root).
+      When no command line arguments or options are given,
+      <span><strong class="command">dig</strong></span> will perform an NS query for "." (the root).
     </p>
 <p>
       It is possible to set per-user defaults for <span><strong class="command">dig</strong></span> via
@@ -92,13 +92,13 @@
 <p>
       The IN and CH class names overlap with the IN and CH top level
       domains names.  Either use the <code class="option">-t</code> and
-      <code class="option">-c</code> options to specify the type and class or
-      use the <code class="option">-q</code> the specify the domain name or
+      <code class="option">-c</code> options to specify the type and class, 
+      use the <code class="option">-q</code> the specify the domain name, or
       use "IN." and "CH." when looking up these top level domains.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2569712"></a><h2>SIMPLE USAGE</h2>
+<a name="id2563944"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -144,7 +144,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623002"></a><h2>OPTIONS</h2>
+<a name="id2569789"></a><h2>OPTIONS</h2>
 <p>
       The <code class="option">-b</code> option sets the source IP address of the query
       to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -170,6 +170,10 @@
       <span><strong class="command">dig</strong></span> using the command-line interface.
     </p>
 <p>
+      The <code class="option">-m</code> option enables memory usage debugging.
+      
+    </p>
+<p>
       If a non-standard port number is to be queried, the
       <code class="option">-p</code> option is used.  <em class="parameter"><code>port#</code></em> is
       the port number that <span><strong class="command">dig</strong></span> will send its
@@ -244,7 +248,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2649413"></a><h2>QUERY OPTIONS</h2>
+<a name="id2624336"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -563,7 +567,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2650468"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2625254"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -609,7 +613,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2650553"></a><h2>IDN SUPPORT</h2>
+<a name="id2625408"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -623,14 +627,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2650582"></a><h2>FILES</h2>
+<a name="id2625436"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2650603"></a><h2>SEE ALSO</h2>
+<a name="id2625458"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -638,7 +642,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2650641"></a><h2>BUGS</h2>
+<a name="id2625495"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>
diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index 3b8d2d8c87ee..ac3fbe8be9ec 100644
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.dnssec-keygen.html,v 1.2.2.47 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.dnssec-keygen.html,v 1.2.2.66 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597830"></a><h2>DESCRIPTION</h2>
+<a name="id2598403"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
       and RFC 4034.  It can also generate keys for use with
@@ -58,7 +58,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597844"></a><h2>OPTIONS</h2>
+<a name="id2598417"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -166,7 +166,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2598187"></a><h2>GENERATED KEYS</h2>
+<a name="id2598692"></a><h2>GENERATED KEYS</h2>
 <p>
       When <span><strong class="command">dnssec-keygen</strong></span> completes
       successfully,
@@ -212,7 +212,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2598295"></a><h2>EXAMPLE</h2>
+<a name="id2600711"></a><h2>EXAMPLE</h2>
 <p>
       To generate a 768-bit DSA key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -233,16 +233,16 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2600195"></a><h2>SEE ALSO</h2>
+<a name="id2601518"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>,
+      <em class="citetitle">RFC 2539</em>,
       <em class="citetitle">RFC 2845</em>,
-      <em class="citetitle">RFC 2539</em>.
+      <em class="citetitle">RFC 4033</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2600226"></a><h2>AUTHOR</h2>
+<a name="id2601549"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index 2d0ce069d392..a12d3551e3f4 100644
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.dnssec-signzone.html,v 1.2.2.46 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.dnssec-signzone.html,v 1.2.2.65 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2598823"></a><h2>DESCRIPTION</h2>
+<a name="id2599262"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -61,7 +61,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2598842"></a><h2>OPTIONS</h2>
+<a name="id2599282"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -259,7 +259,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2641307"></a><h2>EXAMPLE</h2>
+<a name="id2653693"></a><h2>EXAMPLE</h2>
 <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
       zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -288,14 +288,14 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2641380"></a><h2>SEE ALSO</h2>
+<a name="id2653766"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>.
+      <em class="citetitle">RFC 4033</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2641404"></a><h2>AUTHOR</h2>
+<a name="id2653790"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index 6bc2188dfb9f..f180544a3f0a 100644
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.host.html,v 1.2.2.46 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.host.html,v 1.2.2.64 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597000"></a><h2>DESCRIPTION</h2>
+<a name="id2597501"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -166,7 +166,7 @@
       NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
       <span><strong class="command">host</strong></span> automatically selects an appropriate
       query
-      type.  By default it looks for A records, but if the
+      type.  By default it looks for A, AAAA, and MX records, but if the
       <code class="option">-C</code> option was given, queries will be made for SOA
       records, and if <em class="parameter"><code>name</code></em> is a
       dotted-decimal IPv4
@@ -202,7 +202,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597514"></a><h2>IDN SUPPORT</h2>
+<a name="id2597947"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -216,12 +216,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597543"></a><h2>FILES</h2>
+<a name="id2598044"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2597557"></a><h2>SEE ALSO</h2>
+<a name="id2598058"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>
diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index 7db50219b30b..3d5cdd233c66 100644
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.named-checkconf.html,v 1.2.2.49 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.named-checkconf.html,v 1.2.2.67 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,14 +50,14 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2599604"></a><h2>DESCRIPTION</h2>
+<a name="id2599904"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a named
       configuration file.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2599618"></a><h2>OPTIONS</h2>
+<a name="id2599917"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -88,21 +88,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2599720"></a><h2>RETURN VALUES</h2>
+<a name="id2600020"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2599734"></a><h2>SEE ALSO</h2>
+<a name="id2600034"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2599764"></a><h2>AUTHOR</h2>
+<a name="id2600064"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index 93e17ec82f16..264e960696d6 100644
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.named-checkzone.html,v 1.2.2.52 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.named-checkzone.html,v 1.2.2.70 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2600689"></a><h2>DESCRIPTION</h2>
+<a name="id2601603"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
       same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -71,7 +71,7 @@
      </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2600739"></a><h2>OPTIONS</h2>
+<a name="id2601653"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -251,14 +251,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2655177"></a><h2>RETURN VALUES</h2>
+<a name="id2656364"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2655191"></a><h2>SEE ALSO</h2>
+<a name="id2656378"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <em class="citetitle">RFC 1035</em>,
@@ -266,7 +266,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2655224"></a><h2>AUTHOR</h2>
+<a name="id2656480"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 70539b477f32..b08e7383820b 100644
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.named.html,v 1.2.2.53 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.named.html,v 1.2.2.72 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -47,10 +47,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2601798"></a><h2>DESCRIPTION</h2>
+<a name="id2602169"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -65,7 +65,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2601829"></a><h2>OPTIONS</h2>
+<a name="id2602200"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -144,6 +144,31 @@
             </p>
 </div>
 </dd>
+<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
+<dd>
+<p>
+	    Allow <span><strong class="command">named</strong></span> to use up to
+	    <em class="replaceable"><code>#max-socks</code></em> sockets.
+	  </p>
+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Warning</h3>
+<p>
+              This option should be unnecessary for the vast majority
+              of users.
+	      The use of this option could even be harmful because the
+              specified value may exceed the limitation of the
+              underlying system API.
+	      It is therefore set only when the default configuration
+              causes exhaustion of file descriptors and the
+              operational environment is known to support the
+              specified number of sockets.
+	      Note also that the actual maximum number is normally a little
+              fewer than the specified value because
+	      <span><strong class="command">named</strong></span> reserves some file descriptors
+	      for its internal use.
+            </p>
+</div>
+</dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
 <p>Chroot
@@ -209,7 +234,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604492"></a><h2>SIGNALS</h2>
+<a name="id2603333"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -230,7 +255,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604542"></a><h2>CONFIGURATION</h2>
+<a name="id2605226"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -239,7 +264,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604562"></a><h2>FILES</h2>
+<a name="id2605245"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -252,7 +277,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604605"></a><h2>SEE ALSO</h2>
+<a name="id2645430"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -265,7 +290,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604881"></a><h2>AUTHOR</h2>
+<a name="id2645500"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index 056bcbdb2f7c..fa5924db3e86 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.rndc-confgen.html,v 1.2.2.55 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.rndc-confgen.html,v 1.2.2.76 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -48,7 +48,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2605524"></a><h2>DESCRIPTION</h2>
+<a name="id2605546"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
       generates configuration files
       for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -64,7 +64,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2605590"></a><h2>OPTIONS</h2>
+<a name="id2605612"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -171,7 +171,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2606454"></a><h2>EXAMPLES</h2>
+<a name="id2606203"></a><h2>EXAMPLES</h2>
 <p>
       To allow <span><strong class="command">rndc</strong></span> to be used with
       no manual configuration, run
@@ -188,7 +188,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2609036"></a><h2>SEE ALSO</h2>
+<a name="id2607830"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -196,7 +196,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2609075"></a><h2>AUTHOR</h2>
+<a name="id2607868"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index 4e8154c140b2..47a5d9d83c26 100644
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.rndc.conf.html,v 1.2.2.55 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.rndc.conf.html,v 1.2.2.75 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603676"></a><h2>DESCRIPTION</h2>
+<a name="id2604313"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
       for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
       utility.  This file has a similar structure and syntax to
@@ -135,7 +135,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604121"></a><h2>EXAMPLE</h2>
+<a name="id2604485"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
       options {
         default-server  localhost;
@@ -209,7 +209,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2604994"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2604743"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
       The name server must be configured to accept rndc connections and
       to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -219,7 +219,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2605019"></a><h2>SEE ALSO</h2>
+<a name="id2604769"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -227,7 +227,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2605058"></a><h2>AUTHOR</h2>
+<a name="id2604807"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 96ed54726541..351267be0825 100644
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: man.rndc.html,v 1.2.2.54 2007/10/31 01:35:59 marka Exp $ -->
+<!-- $Id: man.rndc.html,v 1.2.2.74 2008/10/18 01:29:59 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603169"></a><h2>DESCRIPTION</h2>
+<a name="id2603601"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
       controls the operation of a name
       server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -79,7 +79,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603219"></a><h2>OPTIONS</h2>
+<a name="id2603651"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -151,7 +151,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603512"></a><h2>LIMITATIONS</h2>
+<a name="id2603876"></a><h2>LIMITATIONS</h2>
 <p><span><strong class="command">rndc</strong></span>
       does not yet support all the commands of
       the BIND 8 <span><strong class="command">ndc</strong></span> utility.
@@ -165,8 +165,9 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603543"></a><h2>SEE ALSO</h2>
+<a name="id2604043"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
+      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
@@ -174,7 +175,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2603590"></a><h2>AUTHOR</h2>
+<a name="id2604099"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/misc/Makefile.in b/doc/misc/Makefile.in
index 40a62fe22411..c5df0cbd8b2f 100644
--- a/doc/misc/Makefile.in
+++ b/doc/misc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3.18.3 2007/08/28 07:20:03 tbox Exp $
+# $Id: Makefile.in,v 1.3.18.4 2007/12/02 22:36:01 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -40,6 +40,7 @@ CFG_TEST = ../../bin/tests/cfg_test
 options: FORCE
 	if test -x ${CFG_TEST} && \
 	   ${CFG_TEST} --named --grammar | \
+	   ${PERL} ${srcdir}/sort-options.pl | \
 	   ${PERL} ${srcdir}/format-options.pl >$@.new ; then \
 		mv -f $@.new $@ ; \
 	else \
diff --git a/doc/misc/format-options.pl b/doc/misc/format-options.pl
index 70b334e31e1e..aa433b3d168d 100644
--- a/doc/misc/format-options.pl
+++ b/doc/misc/format-options.pl
@@ -1,9 +1,9 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: format-options.pl,v 1.2 2004/03/05 05:04:53 marka Exp $
+# $Id: format-options.pl,v 1.2.18.2 2007/12/02 23:46:31 tbox Exp $
 
 print <<END;
 
@@ -26,11 +26,24 @@ END
 
 # Break long lines
 while (<>) {
+	chomp;
 	s/\t/        /g;
-	if (length >= 79) {
-		m!^( *)!;
-		my $indent = $1;
-		s!^(.{0,75}) (.*)$!\1\n$indent    \2!;
+	my $line = $_;
+	m!^( *)!;
+	my $indent = $1;
+	my $comment = "";
+	if ( $line =~ m!//.*! ) {
+		$comment = $&;
+		$line =~ s!//.*!!;
 	}
-	print;
+	my $start = "";
+	while (length($line) >= 79 - length($comment)) {
+		$_ = $line;
+		# this makes sure that the comment has something in front of it
+		$len = 75 - length($comment);
+		m!^(.{0,$len}) (.*)$!;
+		$start = $start.$1."\n";
+		$line = $indent."    ".$2;
+	}
+	print $start.$line.$comment."\n";
 }
diff --git a/doc/misc/migration b/doc/misc/migration
index b48371bebf01..4116b636e64d 100644
--- a/doc/misc/migration
+++ b/doc/misc/migration
@@ -1,4 +1,4 @@
-Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 
@@ -26,6 +26,16 @@ understand the many-answers zone transfer format (e.g., BIND 4.9.5 or
 older) you need to explicitly specify "transfer-format one-answer;" in
 either the options block or a server statement.
 
+BIND 9.4 onwards implements "allow-query-cache".  The "allow-query"
+option is no longer used to specify access to the cache.  The
+"allow-query" option continues to specify which hosts are allowed
+to ask ordinary DNS questions.  The new "allow-query-cache" option
+is used to specify which hosts are allowed to get answers from the
+cache. Since BIND 9.4.1, if "allow-query-cache" is not set then
+"allow-recursion" is used if it is set, otherwise "allow-query" is
+used if it is set, otherwise the default localnets and localhost
+is used.
+
 1.2. Handling of Configuration File Errors
 
 In BIND 9, named refuses to start if it detects an error in
@@ -254,4 +264,4 @@ necessary, the umask should be set explicitly in the script used to
 start the named process.
 
 
-$Id: migration,v 1.45.18.2 2007/09/07 06:34:21 marka Exp $
+$Id: migration,v 1.45.18.3 2008/03/18 15:45:43 jreed Exp $
diff --git a/doc/misc/options b/doc/misc/options
index a17c52274eb9..c9a29a7223c6 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -2,480 +2,488 @@
 This is a summary of the named.conf options supported by 
 this version of BIND 9.
 
+acl <string> { <address_match_element>; ... };
+
+controls {
+        inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | *
+            ) ] allow { <address_match_element>; ... } [ keys { <string>;
+            ... } ];
+        unix <quoted_string> perm <integer> owner <integer> group <integer>
+            [ keys { <string>; ... } ];
+};
+
+dlz <string> {
+        database <string>;
+};
+
+key <string> {
+        algorithm <string>;
+        secret <string>;
+};
+
+logging {
+        category <string> { <string>; ... };
+        channel <string> {
+                file <quoted_string> [ versions ( "unlimited" | <integer> )
+                    ] [ size <size> ];
+                null;
+                print-category <boolean>;
+                print-severity <boolean>;
+                print-time <boolean>;
+                severity <log_severity>;
+                stderr;
+                syslog <optional_facility>;
+        };
+};
+
+lwres {
+        listen-on [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
+            [ port <integer> ]; ... };
+        ndots <integer>;
+        search { <string>; ... };
+        view <string> <optional_class>;
+};
+
+masters <string> [ port <integer> ] { ( <masters> | <ipv4_address> [ port
+    <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ]; ... };
+
 options {
-        avoid-v4-udp-ports { <port>; ... };
-        avoid-v6-udp-ports { <port>; ... };
+        acache-cleaning-interval <integer>;
+        acache-enable <boolean>;
+        additional-from-auth <boolean>;
+        additional-from-cache <boolean>;
+        allow-notify { <address_match_element>; ... };
+        allow-query { <address_match_element>; ... };
+        allow-query-cache { <address_match_element>; ... };
+        allow-recursion { <address_match_element>; ... };
+        allow-transfer { <address_match_element>; ... };
+        allow-update { <address_match_element>; ... };
+        allow-update-forwarding { <address_match_element>; ... };
+        allow-v6-synthesis { <address_match_element>; ... }; // obsolete
+        also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
+            ) [ port <integer> ]; ... };
+        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
+            * ) ];
+        auth-nxdomain <boolean>; // default changed
+        avoid-v4-udp-ports { <portrange>; ... };
+        avoid-v6-udp-ports { <portrange>; ... };
         blackhole { <address_match_element>; ... };
+        cache-file <quoted_string>;
+        check-integrity <boolean>;
+        check-mx ( fail | warn | ignore );
+        check-mx-cname ( fail | warn | ignore );
+        check-names ( master | slave | response ) ( fail | warn | ignore );
+        check-sibling <boolean>;
+        check-srv-cname ( fail | warn | ignore );
+        check-wildcard <boolean>;
+        cleaning-interval <integer>;
+        clients-per-query <integer>;
         coresize <size>;
         datasize <size>;
         deallocate-on-exit <boolean>; // obsolete
+        dialup <dialuptype>;
         directory <quoted_string>;
+        disable-algorithms <string> { <string>; ... };
+        disable-empty-zone <string>;
+        dnssec-accept-expired <boolean>;
+        dnssec-enable <boolean>;
+        dnssec-lookaside <string> trust-anchor <string>;
+        dnssec-must-be-secure <string> <boolean>;
+        dnssec-validation <boolean>;
+        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
+            <integer> ] | <ipv4_address> [ port <integer> ] |
+            <ipv6_address> [ port <integer> ] ); ... };
         dump-file <quoted_string>;
+        edns-udp-size <integer>;
+        empty-contact <string>;
+        empty-server <string>;
+        empty-zones-enable <boolean>;
         fake-iquery <boolean>; // obsolete
+        fetch-glue <boolean>; // obsolete
         files <size>;
+        flush-zones-on-shutdown <boolean>;
+        forward ( first | only );
+        forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
+            [ port <integer> ]; ... };
         has-old-clients <boolean>; // obsolete
         heartbeat-interval <integer>;
         host-statistics <boolean>; // not implemented
         host-statistics-max <integer>; // not implemented
         hostname ( <quoted_string> | none );
         interface-interval <integer>;
+        ixfr-from-differences <ixfrdiff>;
+        key-directory <quoted_string>;
+        lame-ttl <integer>;
         listen-on [ port <integer> ] { <address_match_element>; ... };
         listen-on-v6 [ port <integer> ] { <address_match_element>; ... };
+        maintain-ixfr-base <boolean>; // obsolete
+        masterfile-format ( text | raw );
         match-mapped-addresses <boolean>;
+        max-acache-size <size_no_default>;
+        max-cache-size <size_no_default>;
+        max-cache-ttl <integer>;
+        max-clients-per-query <integer>;
+        max-ixfr-log-size <size>; // obsolete
+        max-journal-size <size_no_default>;
+        max-ncache-ttl <integer>;
+        max-refresh-time <integer>;
+        max-retry-time <integer>;
+        max-transfer-idle-in <integer>;
+        max-transfer-idle-out <integer>;
+        max-transfer-time-in <integer>;
+        max-transfer-time-out <integer>;
+        max-udp-size <integer>;
         memstatistics-file <quoted_string>;
+        min-refresh-time <integer>;
+        min-retry-time <integer>;
+        min-roots <integer>; // not implemented
+        minimal-responses <boolean>;
+        multi-master <boolean>;
         multiple-cnames <boolean>; // obsolete
         named-xfer <quoted_string>; // obsolete
+        notify <notifytype>;
+        notify-delay <integer>;
+        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
         pid-file ( <quoted_string> | none );
         port <integer>;
+        preferred-glue <string>;
+        provide-ixfr <boolean>;
+        query-source <querysource4>;
+        query-source-v6 <querysource6>;
         querylog <boolean>;
-        recursing-file <quoted_string>;
         random-device <quoted_string>;
+        recursing-file <quoted_string>;
+        recursion <boolean>;
         recursive-clients <integer>;
+        request-ixfr <boolean>;
+        reserved-sockets <integer>;
+        rfc2308-type1 <boolean>; // not yet implemented
+        root-delegation-only [ exclude { <quoted_string>; ... } ];
+        rrset-order { [ class <string> ] [ type <string> ] [ name
+            <quoted_string> ] <string> <string>; ... };
         serial-queries <integer>; // obsolete
         serial-query-rate <integer>;
         server-id ( <quoted_string> | none |;
+        sig-validity-interval <integer>;
+        sortlist { <address_match_element>; ... };
         stacksize <size>;
         statistics-file <quoted_string>;
         statistics-interval <integer>; // not yet implemented
+        suppress-initial-notify <boolean>; // not yet implemented
         tcp-clients <integer>;
         tcp-listen-queue <integer>;
         tkey-dhkey <quoted_string> <integer>;
-        tkey-gssapi-credential <quoted_string>;
         tkey-domain <quoted_string>;
-        transfers-per-ns <integer>;
+        tkey-gssapi-credential <quoted_string>;
+        topology { <address_match_element>; ... }; // not implemented
+        transfer-format ( many-answers | one-answer );
+        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
         transfers-in <integer>;
         transfers-out <integer>;
+        transfers-per-ns <integer>;
         treat-cr-as-space <boolean>; // obsolete
+        update-check-ksk <boolean>;
+        use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // obsolete
         use-ixfr <boolean>;
+        use-v4-udp-ports { <portrange>; ... };
+        use-v6-udp-ports { <portrange>; ... };
         version ( <quoted_string> | none );
-        flush-zones-on-shutdown <boolean>;
-        allow-query-cache { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-v6-synthesis { <address_match_element>; ... }; // obsolete
-        sortlist { <address_match_element>; ... };
-        topology { <address_match_element>; ... }; // not implemented
-        auth-nxdomain <boolean>; // default changed
-        minimal-responses <boolean>;
-        recursion <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
+        zero-no-soa-ttl <boolean>;
+        zero-no-soa-ttl-cache <boolean>;
+        zone-statistics <boolean>;
+};
+
+server <netprefix> {
+        bogus <boolean>;
+        edns <boolean>;
+        edns-udp-size <integer>;
+        keys <server_key>;
+        max-udp-size <integer>;
+        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
         provide-ixfr <boolean>;
-        request-ixfr <boolean>;
-        fetch-glue <boolean>; // obsolete
-        rfc2308-type1 <boolean>; // not yet implemented
-        additional-from-auth <boolean>;
-        additional-from-cache <boolean>;
         query-source <querysource4>;
         query-source-v6 <querysource6>;
-        cleaning-interval <integer>;
-        min-roots <integer>; // not implemented
-        lame-ttl <integer>;
-        max-ncache-ttl <integer>;
-        max-cache-ttl <integer>;
+        request-ixfr <boolean>;
+        support-ixfr <boolean>; // obsolete
         transfer-format ( many-answers | one-answer );
-        max-cache-size <size_no_default>;
-        check-names ( master | slave | response ) ( fail | warn | ignore );
-        cache-file <quoted_string>;
-        suppress-initial-notify <boolean>; // not yet implemented
-        preferred-glue <string>;
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [port
-            <integer>] | <ipv4_address> [port <integer>] | <ipv6_address> [port <integer>] ); ... };
-        edns-udp-size <integer>;
-        max-udp-size <integer>;
-        root-delegation-only [ exclude { <quoted_string>; ... } ];
-        disable-algorithms <string> { <string>; ... };
-        dnssec-enable <boolean>;
-        dnssec-validation <boolean>;
-        dnssec-lookaside <string> trust-anchor <string>;
-        dnssec-must-be-secure <string> <boolean>;
-        dnssec-accept-expired <boolean>;
-        ixfr-from-differences <ixfrdiff>;
-        acache-enable <boolean>;
+        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
+        transfers <integer>;
+};
+
+trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... };
+
+view <string> <optional_class> {
         acache-cleaning-interval <integer>;
-        max-acache-size <size_no_default>;
-        clients-per-query <integer>;
-        max-clients-per-query <integer>;
-        empty-server <string>;
-        empty-contact <string>;
-        empty-zones-enable <boolean>;
-        disable-empty-zone <string>;
-        zero-no-soa-ttl-cache <boolean>;
+        acache-enable <boolean>;
+        additional-from-auth <boolean>;
+        additional-from-cache <boolean>;
+        allow-notify { <address_match_element>; ... };
         allow-query { <address_match_element>; ... };
+        allow-query-cache { <address_match_element>; ... };
+        allow-recursion { <address_match_element>; ... };
         allow-transfer { <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
-        allow-notify { <address_match_element>; ... };
-        masterfile-format ( text | raw );
-        notify <notifytype>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
+        allow-v6-synthesis { <address_match_element>; ... }; // obsolete
         also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
             ) [ port <integer> ]; ... };
-        notify-delay <integer>;
+        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
+            * ) ];
+        auth-nxdomain <boolean>; // default changed
+        cache-file <quoted_string>;
+        check-integrity <boolean>;
+        check-mx ( fail | warn | ignore );
+        check-mx-cname ( fail | warn | ignore );
+        check-names ( master | slave | response ) ( fail | warn | ignore );
+        check-sibling <boolean>;
+        check-srv-cname ( fail | warn | ignore );
+        check-wildcard <boolean>;
+        cleaning-interval <integer>;
+        clients-per-query <integer>;
+        database <string>;
         dialup <dialuptype>;
+        disable-algorithms <string> { <string>; ... };
+        disable-empty-zone <string>;
+        dlz <string> {
+                database <string>;
+        };
+        dnssec-accept-expired <boolean>;
+        dnssec-enable <boolean>;
+        dnssec-lookaside <string> trust-anchor <string>;
+        dnssec-must-be-secure <string> <boolean>;
+        dnssec-validation <boolean>;
+        dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
+            <integer> ] | <ipv4_address> [ port <integer> ] |
+            <ipv6_address> [ port <integer> ] ); ... };
+        edns-udp-size <integer>;
+        empty-contact <string>;
+        empty-server <string>;
+        empty-zones-enable <boolean>;
+        fetch-glue <boolean>; // obsolete
         forward ( first | only );
         forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
             [ port <integer> ]; ... };
+        ixfr-from-differences <ixfrdiff>;
+        key <string> {
+                algorithm <string>;
+                secret <string>;
+        };
+        key-directory <quoted_string>;
+        lame-ttl <integer>;
         maintain-ixfr-base <boolean>; // obsolete
+        masterfile-format ( text | raw );
+        match-clients { <address_match_element>; ... };
+        match-destinations { <address_match_element>; ... };
+        match-recursive-only <boolean>;
+        max-acache-size <size_no_default>;
+        max-cache-size <size_no_default>;
+        max-cache-ttl <integer>;
+        max-clients-per-query <integer>;
         max-ixfr-log-size <size>; // obsolete
         max-journal-size <size_no_default>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
+        max-ncache-ttl <integer>;
+        max-refresh-time <integer>;
+        max-retry-time <integer>;
         max-transfer-idle-in <integer>;
         max-transfer-idle-out <integer>;
-        max-retry-time <integer>;
-        min-retry-time <integer>;
-        max-refresh-time <integer>;
+        max-transfer-time-in <integer>;
+        max-transfer-time-out <integer>;
+        max-udp-size <integer>;
         min-refresh-time <integer>;
+        min-retry-time <integer>;
+        min-roots <integer>; // not implemented
+        minimal-responses <boolean>;
         multi-master <boolean>;
+        notify <notifytype>;
+        notify-delay <integer>;
+        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
+        preferred-glue <string>;
+        provide-ixfr <boolean>;
+        query-source <querysource4>;
+        query-source-v6 <querysource6>;
+        recursion <boolean>;
+        request-ixfr <boolean>;
+        rfc2308-type1 <boolean>; // not yet implemented
+        root-delegation-only [ exclude { <quoted_string>; ... } ];
+        rrset-order { [ class <string> ] [ type <string> ] [ name
+            <quoted_string> ] <string> <string>; ... };
+        server <netprefix> {
+                bogus <boolean>;
+                edns <boolean>;
+                edns-udp-size <integer>;
+                keys <server_key>;
+                max-udp-size <integer>;
+                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
+                    ) ];
+                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
+                    | * ) ];
+                provide-ixfr <boolean>;
+                query-source <querysource4>;
+                query-source-v6 <querysource6>;
+                request-ixfr <boolean>;
+                support-ixfr <boolean>; // obsolete
+                transfer-format ( many-answers | one-answer );
+                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
+                    * ) ];
+                transfer-source-v6 ( <ipv6_address> | * ) [ port (
+                    <integer> | * ) ];
+                transfers <integer>;
+        };
         sig-validity-interval <integer>;
+        sortlist { <address_match_element>; ... };
+        suppress-initial-notify <boolean>; // not yet implemented
+        topology { <address_match_element>; ... }; // not implemented
+        transfer-format ( many-answers | one-answer );
         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ];
+        trusted-keys { <string> <integer> <integer> <integer>
+            <quoted_string>; ... };
+        update-check-ksk <boolean>;
         use-alt-transfer-source <boolean>;
-        zone-statistics <boolean>;
-        key-directory <quoted_string>;
-        check-wildcard <boolean>;
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-sibling <boolean>;
         zero-no-soa-ttl <boolean>;
-        update-check-ksk <boolean>;
-};
-
-controls {
-        inet ( <ipv4_address> | <ipv6_address> | * ) [ port ( <integer> | *
-            ) ] allow { <address_match_element>; ... } [ keys { <string>; ... } ];
-        unix <quoted_string> perm <integer> owner <integer> group <integer>
-            [ keys { <string>; ... } ];
-};
-
-acl <string> { <address_match_element>; ... };
-
-masters <string> [ port <integer> ] { ( <masters> | <ipv4_address> [port
-    <integer>] | <ipv6_address> [port <integer>] ) [ key <string> ]; ... };
-
-logging {
-        channel <string> {
-                file <log_file>;
-                syslog <optional_facility>;
-                null;
-                stderr;
-                severity <log_severity>;
-                print-time <boolean>;
-                print-severity <boolean>;
-                print-category <boolean>;
-        };
-        category <string> { <string>; ... };
-};
-
-view <string> <optional_class> {
-        match-clients { <address_match_element>; ... };
-        match-destinations { <address_match_element>; ... };
-        match-recursive-only <boolean>;
-        key <string> {
-                algorithm <string>;
-                secret <string>;
-        };
+        zero-no-soa-ttl-cache <boolean>;
         zone <string> <optional_class> {
-                type ( master | slave | stub | hint | forward |
-                    delegation-only );
-                file <quoted_string>;
-                journal <quoted_string>;
-                ixfr-base <quoted_string>; // obsolete
-                ixfr-tmp-file <quoted_string>; // obsolete
-                masters [ port <integer> ] { ( <masters> | <ipv4_address>
-                    [port <integer>] | <ipv6_address> [port <integer>] ) [ key <string> ]; ... };
-                pubkey <integer> <integer> <integer> <quoted_string>; //
-                    obsolete
-                update-policy { ( grant | deny ) <string> ( name |
-                    subdomain | wildcard | self | selfsub | selfwild ) <string> <rrtypelist>; ... };
-                database <string>;
-                delegation-only <boolean>;
-                check-names ( fail | warn | ignore );
-                ixfr-from-differences <boolean>;
+                allow-notify { <address_match_element>; ... };
                 allow-query { <address_match_element>; ... };
                 allow-transfer { <address_match_element>; ... };
                 allow-update { <address_match_element>; ... };
                 allow-update-forwarding { <address_match_element>; ... };
-                allow-notify { <address_match_element>; ... };
-                masterfile-format ( text | raw );
-                notify <notifytype>;
-                notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
-                    ) ];
-                notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
-                    | * ) ];
                 also-notify [ port <integer> ] { ( <ipv4_address> |
                     <ipv6_address> ) [ port <integer> ]; ... };
-                notify-delay <integer>;
+                alt-transfer-source ( <ipv4_address> | * ) [ port (
+                    <integer> | * ) ];
+                alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
+                    <integer> | * ) ];
+                check-integrity <boolean>;
+                check-mx ( fail | warn | ignore );
+                check-mx-cname ( fail | warn | ignore );
+                check-names ( fail | warn | ignore );
+                check-sibling <boolean>;
+                check-srv-cname ( fail | warn | ignore );
+                check-wildcard <boolean>;
+                database <string>;
+                delegation-only <boolean>;
                 dialup <dialuptype>;
+                file <quoted_string>;
                 forward ( first | only );
                 forwarders [ port <integer> ] { ( <ipv4_address> |
                     <ipv6_address> ) [ port <integer> ]; ... };
+                ixfr-base <quoted_string>; // obsolete
+                ixfr-from-differences <boolean>;
+                ixfr-tmp-file <quoted_string>; // obsolete
+                journal <quoted_string>;
+                key-directory <quoted_string>;
                 maintain-ixfr-base <boolean>; // obsolete
+                masterfile-format ( text | raw );
+                masters [ port <integer> ] { ( <masters> | <ipv4_address> [
+                    port <integer> ] | <ipv6_address> [ port <integer> ] )
+                    [ key <string> ]; ... };
                 max-ixfr-log-size <size>; // obsolete
                 max-journal-size <size_no_default>;
-                max-transfer-time-in <integer>;
-                max-transfer-time-out <integer>;
+                max-refresh-time <integer>;
+                max-retry-time <integer>;
                 max-transfer-idle-in <integer>;
                 max-transfer-idle-out <integer>;
-                max-retry-time <integer>;
-                min-retry-time <integer>;
-                max-refresh-time <integer>;
+                max-transfer-time-in <integer>;
+                max-transfer-time-out <integer>;
                 min-refresh-time <integer>;
+                min-retry-time <integer>;
                 multi-master <boolean>;
-                sig-validity-interval <integer>;
-                transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
-                    * ) ];
-                transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ];
-                alt-transfer-source ( <ipv4_address> | * ) [ port (
-                    <integer> | * ) ];
-                alt-transfer-source-v6 ( <ipv6_address> | * ) [ port (
-                    <integer> | * ) ];
-                use-alt-transfer-source <boolean>;
-                zone-statistics <boolean>;
-                key-directory <quoted_string>;
-                check-wildcard <boolean>;
-                check-integrity <boolean>;
-                check-mx ( fail | warn | ignore );
-                check-mx-cname ( fail | warn | ignore );
-                check-srv-cname ( fail | warn | ignore );
-                check-sibling <boolean>;
-                zero-no-soa-ttl <boolean>;
-                update-check-ksk <boolean>;
-        };
-        dlz <string> {
-                database <string>;
-        };
-        server <netprefix> {
-                bogus <boolean>;
-                provide-ixfr <boolean>;
-                request-ixfr <boolean>;
-                support-ixfr <boolean>; // obsolete
-                transfers <integer>;
-                transfer-format ( many-answers | one-answer );
-                keys <server_key>;
-                edns <boolean>;
-                edns-udp-size <integer>;
-                max-udp-size <integer>;
+                notify <notifytype>;
+                notify-delay <integer>;
                 notify-source ( <ipv4_address> | * ) [ port ( <integer> | *
                     ) ];
                 notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer>
                     | * ) ];
-                query-source <querysource4>;
-                query-source-v6 <querysource6>;
+                pubkey <integer> <integer> <integer>
+                    <quoted_string>; // obsolete
+                sig-validity-interval <integer>;
                 transfer-source ( <ipv4_address> | * ) [ port ( <integer> |
                     * ) ];
                 transfer-source-v6 ( <ipv6_address> | * ) [ port (
                     <integer> | * ) ];
+                type ( master | slave | stub | hint | forward |
+                    delegation-only );
+                update-check-ksk <boolean>;
+                update-policy { ( grant | deny ) <string> ( name |
+                    subdomain | wildcard | self | selfsub | selfwild )
+                    <string> <rrtypelist>; ... };
+                use-alt-transfer-source <boolean>;
+                zero-no-soa-ttl <boolean>;
+                zone-statistics <boolean>;
         };
-        trusted-keys { <string> <integer> <integer> <integer>
-            <quoted_string>; ... };
-        allow-query-cache { <address_match_element>; ... };
-        allow-recursion { <address_match_element>; ... };
-        allow-v6-synthesis { <address_match_element>; ... }; // obsolete
-        sortlist { <address_match_element>; ... };
-        topology { <address_match_element>; ... }; // not implemented
-        auth-nxdomain <boolean>; // default changed
-        minimal-responses <boolean>;
-        recursion <boolean>;
-        rrset-order { [ class <string> ] [ type <string> ] [ name
-            <quoted_string> ] <string> <string>; ... };
-        provide-ixfr <boolean>;
-        request-ixfr <boolean>;
-        fetch-glue <boolean>; // obsolete
-        rfc2308-type1 <boolean>; // not yet implemented
-        additional-from-auth <boolean>;
-        additional-from-cache <boolean>;
-        query-source <querysource4>;
-        query-source-v6 <querysource6>;
-        cleaning-interval <integer>;
-        min-roots <integer>; // not implemented
-        lame-ttl <integer>;
-        max-ncache-ttl <integer>;
-        max-cache-ttl <integer>;
-        transfer-format ( many-answers | one-answer );
-        max-cache-size <size_no_default>;
-        check-names ( master | slave | response ) ( fail | warn | ignore );
-        cache-file <quoted_string>;
-        suppress-initial-notify <boolean>; // not yet implemented
-        preferred-glue <string>;
-        dual-stack-servers [ port <integer> ] { ( <quoted_string> [port
-            <integer>] | <ipv4_address> [port <integer>] | <ipv6_address> [port <integer>] ); ... };
-        edns-udp-size <integer>;
-        max-udp-size <integer>;
-        root-delegation-only [ exclude { <quoted_string>; ... } ];
-        disable-algorithms <string> { <string>; ... };
-        dnssec-enable <boolean>;
-        dnssec-validation <boolean>;
-        dnssec-lookaside <string> trust-anchor <string>;
-        dnssec-must-be-secure <string> <boolean>;
-        dnssec-accept-expired <boolean>;
-        ixfr-from-differences <ixfrdiff>;
-        acache-enable <boolean>;
-        acache-cleaning-interval <integer>;
-        max-acache-size <size_no_default>;
-        clients-per-query <integer>;
-        max-clients-per-query <integer>;
-        empty-server <string>;
-        empty-contact <string>;
-        empty-zones-enable <boolean>;
-        disable-empty-zone <string>;
-        zero-no-soa-ttl-cache <boolean>;
+        zone-statistics <boolean>;
+};
+
+zone <string> <optional_class> {
+        allow-notify { <address_match_element>; ... };
         allow-query { <address_match_element>; ... };
         allow-transfer { <address_match_element>; ... };
         allow-update { <address_match_element>; ... };
         allow-update-forwarding { <address_match_element>; ... };
-        allow-notify { <address_match_element>; ... };
-        masterfile-format ( text | raw );
-        notify <notifytype>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
         also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
             ) [ port <integer> ]; ... };
-        notify-delay <integer>;
-        dialup <dialuptype>;
-        forward ( first | only );
-        forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
-            [ port <integer> ]; ... };
-        maintain-ixfr-base <boolean>; // obsolete
-        max-ixfr-log-size <size>; // obsolete
-        max-journal-size <size_no_default>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
-        max-transfer-idle-in <integer>;
-        max-transfer-idle-out <integer>;
-        max-retry-time <integer>;
-        min-retry-time <integer>;
-        max-refresh-time <integer>;
-        min-refresh-time <integer>;
-        multi-master <boolean>;
-        sig-validity-interval <integer>;
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ];
+        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
         alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
             * ) ];
-        use-alt-transfer-source <boolean>;
-        zone-statistics <boolean>;
-        key-directory <quoted_string>;
-        check-wildcard <boolean>;
         check-integrity <boolean>;
         check-mx ( fail | warn | ignore );
         check-mx-cname ( fail | warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
+        check-names ( fail | warn | ignore );
         check-sibling <boolean>;
-        zero-no-soa-ttl <boolean>;
-        update-check-ksk <boolean>;
-        database <string>;
-};
-
-lwres {
-        listen-on [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
-            [ port <integer> ]; ... };
-        view <string> <optional_class>;
-        search { <string>; ... };
-        ndots <integer>;
-};
-
-key <string> {
-        algorithm <string>;
-        secret <string>;
-};
-
-zone <string> <optional_class> {
-        type ( master | slave | stub | hint | forward | delegation-only );
-        file <quoted_string>;
-        journal <quoted_string>;
-        ixfr-base <quoted_string>; // obsolete
-        ixfr-tmp-file <quoted_string>; // obsolete
-        masters [ port <integer> ] { ( <masters> | <ipv4_address> [port
-            <integer>] | <ipv6_address> [port <integer>] ) [ key <string> ]; ... };
-        pubkey <integer> <integer> <integer> <quoted_string>; // obsolete
-        update-policy { ( grant | deny ) <string> ( name | subdomain |
-            wildcard | self | selfsub | selfwild ) <string> <rrtypelist>; ... };
+        check-srv-cname ( fail | warn | ignore );
+        check-wildcard <boolean>;
         database <string>;
         delegation-only <boolean>;
-        check-names ( fail | warn | ignore );
-        ixfr-from-differences <boolean>;
-        allow-query { <address_match_element>; ... };
-        allow-transfer { <address_match_element>; ... };
-        allow-update { <address_match_element>; ... };
-        allow-update-forwarding { <address_match_element>; ... };
-        allow-notify { <address_match_element>; ... };
-        masterfile-format ( text | raw );
-        notify <notifytype>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
-        also-notify [ port <integer> ] { ( <ipv4_address> | <ipv6_address>
-            ) [ port <integer> ]; ... };
-        notify-delay <integer>;
         dialup <dialuptype>;
+        file <quoted_string>;
         forward ( first | only );
         forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> )
             [ port <integer> ]; ... };
+        ixfr-base <quoted_string>; // obsolete
+        ixfr-from-differences <boolean>;
+        ixfr-tmp-file <quoted_string>; // obsolete
+        journal <quoted_string>;
+        key-directory <quoted_string>;
         maintain-ixfr-base <boolean>; // obsolete
+        masterfile-format ( text | raw );
+        masters [ port <integer> ] { ( <masters> | <ipv4_address> [ port
+            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
+            <string> ]; ... };
         max-ixfr-log-size <size>; // obsolete
         max-journal-size <size_no_default>;
-        max-transfer-time-in <integer>;
-        max-transfer-time-out <integer>;
+        max-refresh-time <integer>;
+        max-retry-time <integer>;
         max-transfer-idle-in <integer>;
         max-transfer-idle-out <integer>;
-        max-retry-time <integer>;
-        min-retry-time <integer>;
-        max-refresh-time <integer>;
+        max-transfer-time-in <integer>;
+        max-transfer-time-out <integer>;
         min-refresh-time <integer>;
+        min-retry-time <integer>;
         multi-master <boolean>;
+        notify <notifytype>;
+        notify-delay <integer>;
+        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
+        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
+        pubkey <integer> <integer> <integer> <quoted_string>; // obsolete
         sig-validity-interval <integer>;
         transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
         transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
-        alt-transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * )
-            ];
-        alt-transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> |
-            * ) ];
+        type ( master | slave | stub | hint | forward | delegation-only );
+        update-check-ksk <boolean>;
+        update-policy { ( grant | deny ) <string> ( name | subdomain |
+            wildcard | self | selfsub | selfwild ) <string> <rrtypelist>;
+            ... };
         use-alt-transfer-source <boolean>;
-        zone-statistics <boolean>;
-        key-directory <quoted_string>;
-        check-wildcard <boolean>;
-        check-integrity <boolean>;
-        check-mx ( fail | warn | ignore );
-        check-mx-cname ( fail | warn | ignore );
-        check-srv-cname ( fail | warn | ignore );
-        check-sibling <boolean>;
         zero-no-soa-ttl <boolean>;
-        update-check-ksk <boolean>;
-};
-
-dlz <string> {
-        database <string>;
-};
-
-server <netprefix> {
-        bogus <boolean>;
-        provide-ixfr <boolean>;
-        request-ixfr <boolean>;
-        support-ixfr <boolean>; // obsolete
-        transfers <integer>;
-        transfer-format ( many-answers | one-answer );
-        keys <server_key>;
-        edns <boolean>;
-        edns-udp-size <integer>;
-        max-udp-size <integer>;
-        notify-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        notify-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
-        query-source <querysource4>;
-        query-source-v6 <querysource6>;
-        transfer-source ( <ipv4_address> | * ) [ port ( <integer> | * ) ];
-        transfer-source-v6 ( <ipv6_address> | * ) [ port ( <integer> | * ) ];
+        zone-statistics <boolean>;
 };
 
-trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... };
-
diff --git a/doc/misc/sort-options.pl b/doc/misc/sort-options.pl
new file mode 100755
index 000000000000..f516159ae051
--- /dev/null
+++ b/doc/misc/sort-options.pl
@@ -0,0 +1,50 @@
+#!/bin/perl
+#
+# Copyright (C) 2007  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: sort-options.pl,v 1.3.36.2 2007/12/02 23:46:31 tbox Exp $
+
+sub sortlevel() {
+	my @options = ();
+	my $fin = "";
+	my $i = 0;
+	while (<>) {
+		if (/^\s*};$/) {
+			$fin = $_;
+			# print 2, $_;
+			last;
+		}
+		next if (/^$/);
+		if (/{$/) {
+			# print 3, $_;
+			my $sec = $_;
+			push(@options, $sec . sortlevel());
+		} else {
+			push(@options, $_);
+			# print 1, $_;
+		}
+		$i++;
+	}
+	my $result = "";
+	foreach my $i (sort @options) {
+		$result = ${result}.${i};
+		$result = $result."\n" if ($i =~ /^[a-z]/i);
+		# print 5, ${i};
+	}
+	$result = ${result}.${fin};
+	return ($result);
+}
+
+print sortlevel();
diff --git a/doc/rfc/index b/doc/rfc/index
index 990d4a90be04..fea5f7181928 100644
--- a/doc/rfc/index
+++ b/doc/rfc/index
@@ -9,7 +9,7 @@
 1183:	New DNS RR Definitions (AFSDB, RP, X25, ISDN and RT)
 1348:	DNS NSAP RRs
 1535:	A Security Problem and Proposed Correction
-	   With Widely Deployed DNS Software
+	 With Widely Deployed DNS Software
 1536:	Common DNS Implementation Errors and Suggested Fixes
 1537:	Common DNS Data File Configuration Errors
 1591:	Domain Name System Structure and Delegation
@@ -63,6 +63,7 @@
 2931:	DNS Request and Transaction Signatures ( SIG(0)s )
 3007:	Secure Domain Name System (DNS) Dynamic Update
 3008:	Domain Name System Security (DNSSEC) Signing Authority
+3056:	Connection of IPv6 Domains via IPv4 Clouds
 3071:	Reflections on the DNS, RFC 1591, and Categories of Domains
 3090:	DNS Security Extension Clarification on Zone Status
 3110:	RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS)
@@ -81,17 +82,17 @@
 3490:	Internationalizing Domain Names In Applications (IDNA)
 3491:	Nameprep: A Stringprep Profile for Internationalized Domain Names (IDN)
 3492:	Punycode:A Bootstring encoding of Unicode for
-	  Internationalized Domain Names in Applications (IDNA)
+	 Internationalized Domain Names in Applications (IDNA)
 3493:	Basic Socket Interface Extensions for IPv6
 3513:	Internet Protocol Version 6 (IPv6) Addressing Architecture
 3596:	DNS Extensions to Support IP Version 6
 3597:	Handling of Unknown DNS Resource Record (RR) Types
 3645:	Generic Security Service Algorithm for
-	  Secret Key Transaction Authentication for DNS (GSS-TSIG)
+	 Secret Key Transaction Authentication for DNS (GSS-TSIG)
 3655:	Redefinition of DNS Authenticated Data (AD) bit
 3658:	Delegation Signer (DS) Resource Record (RR)
 3757:	Domain Name System KEY (DNSKEY) Resource Record (RR)
-	  Secure Entry Point (SEP) Flag
+	 Secure Entry Point (SEP) Flag
 3833:	Threat Analysis of the Domain Name System (DNS)
 3845:	DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format
 3901:	DNS IPv6 Transport Operational Guidelines
@@ -112,3 +113,7 @@
 4470:	Minimally Covering NSEC Records and DNSSEC On-line Signing
 4634:	US Secure Hash Algorithms (SHA and HMAC-SHA)
 4641:	DNSSEC Operational Practices
+4648:	The Base16, Base32, and Base64 Data Encodings
+4701:	A DNS Resource Record (RR) for Encoding
+         Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)
+5155:	DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
diff --git a/doc/rfc/rfc4648.txt b/doc/rfc/rfc4648.txt
new file mode 100644
index 000000000000..c7599b4330cb
--- /dev/null
+++ b/doc/rfc/rfc4648.txt
@@ -0,0 +1,1011 @@
+
+
+
+
+
+
+Network Working Group                                       S. Josefsson
+Request for Comments: 4648                                           SJD
+Obsoletes: 3548                                             October 2006
+Category: Standards Track
+
+
+             The Base16, Base32, and Base64 Data Encodings
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2006).
+
+Abstract
+
+   This document describes the commonly used base 64, base 32, and base
+   16 encoding schemes.  It also discusses the use of line-feeds in
+   encoded data, use of padding in encoded data, use of non-alphabet
+   characters in encoded data, use of different encoding alphabets, and
+   canonical encodings.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 1]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Table of Contents
+
+   1. Introduction ....................................................3
+   2. Conventions Used in This Document ...............................3
+   3. Implementation Discrepancies ....................................3
+      3.1. Line Feeds in Encoded Data .................................3
+      3.2. Padding of Encoded Data ....................................4
+      3.3. Interpretation of Non-Alphabet Characters in Encoded Data ..4
+      3.4. Choosing the Alphabet ......................................4
+      3.5. Canonical Encoding .........................................5
+   4. Base 64 Encoding ................................................5
+   5. Base 64 Encoding with URL and Filename Safe Alphabet ............7
+   6. Base 32 Encoding ................................................8
+   7. Base 32 Encoding with Extended Hex Alphabet ....................10
+   8. Base 16 Encoding ...............................................10
+   9. Illustrations and Examples .....................................11
+   10. Test Vectors ..................................................12
+   11. ISO C99 Implementation of Base64 ..............................14
+   12. Security Considerations .......................................14
+   13. Changes Since RFC 3548 ........................................15
+   14. Acknowledgements ..............................................15
+   15. Copying Conditions ............................................15
+   16. References ....................................................16
+      16.1. Normative References .....................................16
+      16.2. Informative References ...................................16
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 2]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+1.  Introduction
+
+   Base encoding of data is used in many situations to store or transfer
+   data in environments that, perhaps for legacy reasons, are restricted
+   to US-ASCII [1] data.  Base encoding can also be used in new
+   applications that do not have legacy restrictions, simply because it
+   makes it possible to manipulate objects with text editors.
+
+   In the past, different applications have had different requirements
+   and thus sometimes implemented base encodings in slightly different
+   ways.  Today, protocol specifications sometimes use base encodings in
+   general, and "base64" in particular, without a precise description or
+   reference.  Multipurpose Internet Mail Extensions (MIME) [4] is often
+   used as a reference for base64 without considering the consequences
+   for line-wrapping or non-alphabet characters.  The purpose of this
+   specification is to establish common alphabet and encoding
+   considerations.  This will hopefully reduce ambiguity in other
+   documents, leading to better interoperability.
+
+2.  Conventions Used in This Document
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [2].
+
+3.  Implementation Discrepancies
+
+   Here we discuss the discrepancies between base encoding
+   implementations in the past and, where appropriate, mandate a
+   specific recommended behavior for the future.
+
+3.1.  Line Feeds in Encoded Data
+
+   MIME [4] is often used as a reference for base 64 encoding.  However,
+   MIME does not define "base 64" per se, but rather a "base 64 Content-
+   Transfer-Encoding" for use within MIME.  As such, MIME enforces a
+   limit on line length of base 64-encoded data to 76 characters.  MIME
+   inherits the encoding from Privacy Enhanced Mail (PEM) [3], stating
+   that it is "virtually identical"; however, PEM uses a line length of
+   64 characters.  The MIME and PEM limits are both due to limits within
+   SMTP.
+
+   Implementations MUST NOT add line feeds to base-encoded data unless
+   the specification referring to this document explicitly directs base
+   encoders to add line feeds after a specific number of characters.
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 3]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+3.2.  Padding of Encoded Data
+
+   In some circumstances, the use of padding ("=") in base-encoded data
+   is not required or used.  In the general case, when assumptions about
+   the size of transported data cannot be made, padding is required to
+   yield correct decoded data.
+
+   Implementations MUST include appropriate pad characters at the end of
+   encoded data unless the specification referring to this document
+   explicitly states otherwise.
+
+   The base64 and base32 alphabets use padding, as described below in
+   sections 4 and 6, but the base16 alphabet does not need it; see
+   section 8.
+
+3.3.  Interpretation of Non-Alphabet Characters in Encoded Data
+
+   Base encodings use a specific, reduced alphabet to encode binary
+   data.  Non-alphabet characters could exist within base-encoded data,
+   caused by data corruption or by design.  Non-alphabet characters may
+   be exploited as a "covert channel", where non-protocol data can be
+   sent for nefarious purposes.  Non-alphabet characters might also be
+   sent in order to exploit implementation errors leading to, e.g.,
+   buffer overflow attacks.
+
+   Implementations MUST reject the encoded data if it contains
+   characters outside the base alphabet when interpreting base-encoded
+   data, unless the specification referring to this document explicitly
+   states otherwise.  Such specifications may instead state, as MIME
+   does, that characters outside the base encoding alphabet should
+   simply be ignored when interpreting data ("be liberal in what you
+   accept").  Note that this means that any adjacent carriage return/
+   line feed (CRLF) characters constitute "non-alphabet characters" and
+   are ignored.  Furthermore, such specifications MAY ignore the pad
+   character, "=", treating it as non-alphabet data, if it is present
+   before the end of the encoded data.  If more than the allowed number
+   of pad characters is found at the end of the string (e.g., a base 64
+   string terminated with "==="), the excess pad characters MAY also be
+   ignored.
+
+3.4.  Choosing the Alphabet
+
+   Different applications have different requirements on the characters
+   in the alphabet.  Here are a few requirements that determine which
+   alphabet should be used:
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 4]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   o  Handled by humans.  The characters "0" and "O" are easily
+      confused, as are "1", "l", and "I".  In the base32 alphabet below,
+      where 0 (zero) and 1 (one) are not present, a decoder may
+      interpret 0 as O, and 1 as I or L depending on case.  (However, by
+      default it should not; see previous section.)
+
+   o  Encoded into structures that mandate other requirements.  For base
+      16 and base 32, this determines the use of upper- or lowercase
+      alphabets.  For base 64, the non-alphanumeric characters (in
+      particular, "/") may be problematic in file names and URLs.
+
+   o  Used as identifiers.  Certain characters, notably "+" and "/" in
+      the base 64 alphabet, are treated as word-breaks by legacy text
+      search/index tools.
+
+   There is no universally accepted alphabet that fulfills all the
+   requirements.  For an example of a highly specialized variant, see
+   IMAP [8].  In this document, we document and name some currently used
+   alphabets.
+
+3.5.  Canonical Encoding
+
+   The padding step in base 64 and base 32 encoding can, if improperly
+   implemented, lead to non-significant alterations of the encoded data.
+   For example, if the input is only one octet for a base 64 encoding,
+   then all six bits of the first symbol are used, but only the first
+   two bits of the next symbol are used.  These pad bits MUST be set to
+   zero by conforming encoders, which is described in the descriptions
+   on padding below.  If this property do not hold, there is no
+   canonical representation of base-encoded data, and multiple base-
+   encoded strings can be decoded to the same binary data.  If this
+   property (and others discussed in this document) holds, a canonical
+   encoding is guaranteed.
+
+   In some environments, the alteration is critical and therefore
+   decoders MAY chose to reject an encoding if the pad bits have not
+   been set to zero.  The specification referring to this may mandate a
+   specific behaviour.
+
+4.  Base 64 Encoding
+
+   The following description of base 64 is derived from [3], [4], [5],
+   and [6].  This encoding may be referred to as "base64".
+
+   The Base 64 encoding is designed to represent arbitrary sequences of
+   octets in a form that allows the use of both upper- and lowercase
+   letters but that need not be human readable.
+
+
+
+
+Josefsson                   Standards Track                     [Page 5]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   A 65-character subset of US-ASCII is used, enabling 6 bits to be
+   represented per printable character.  (The extra 65th character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 24-bit groups of input bits as output
+   strings of 4 encoded characters.  Proceeding from left to right, a
+   24-bit input group is formed by concatenating 3 8-bit input groups.
+   These 24 bits are then treated as 4 concatenated 6-bit groups, each
+   of which is translated into a single character in the base 64
+   alphabet.
+
+   Each 6-bit group is used as an index into an array of 64 printable
+   characters.  The character referenced by the index is placed in the
+   output string.
+
+                      Table 1: The Base 64 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A            17 R            34 i            51 z
+         1 B            18 S            35 j            52 0
+         2 C            19 T            36 k            53 1
+         3 D            20 U            37 l            54 2
+         4 E            21 V            38 m            55 3
+         5 F            22 W            39 n            56 4
+         6 G            23 X            40 o            57 5
+         7 H            24 Y            41 p            58 6
+         8 I            25 Z            42 q            59 7
+         9 J            26 a            43 r            60 8
+        10 K            27 b            44 s            61 9
+        11 L            28 c            45 t            62 +
+        12 M            29 d            46 u            63 /
+        13 N            30 e            47 v
+        14 O            31 f            48 w         (pad) =
+        15 P            32 g            49 x
+        16 Q            33 h            50 y
+
+   Special processing is performed if fewer than 24 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a quantity.  When fewer than 24 input
+   bits are available in an input group, bits with value zero are added
+   (on the right) to form an integral number of 6-bit groups.  Padding
+   at the end of the data is performed using the '=' character.  Since
+   all base 64 input is an integral number of octets, only the following
+   cases can arise:
+
+   (1) The final quantum of encoding input is an integral multiple of 24
+       bits; here, the final unit of encoded output will be an integral
+       multiple of 4 characters with no "=" padding.
+
+
+
+Josefsson                   Standards Track                     [Page 6]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   (2) The final quantum of encoding input is exactly 8 bits; here, the
+       final unit of encoded output will be two characters followed by
+       two "=" padding characters.
+
+   (3) The final quantum of encoding input is exactly 16 bits; here, the
+       final unit of encoded output will be three characters followed by
+       one "=" padding character.
+
+5.  Base 64 Encoding with URL and Filename Safe Alphabet
+
+   The Base 64 encoding with an URL and filename safe alphabet has been
+   used in [12].
+
+   An alternative alphabet has been suggested that would use "~" as the
+   63rd character.  Since the "~" character has special meaning in some
+   file system environments, the encoding described in this section is
+   recommended instead.  The remaining unreserved URI character is ".",
+   but some file system environments do not permit multiple "." in a
+   filename, thus making the "." character unattractive as well.
+
+   The pad character "=" is typically percent-encoded when used in an
+   URI [9], but if the data length is known implicitly, this can be
+   avoided by skipping the padding; see section 3.2.
+
+   This encoding may be referred to as "base64url".  This encoding
+   should not be regarded as the same as the "base64" encoding and
+   should not be referred to as only "base64".  Unless clarified
+   otherwise, "base64" refers to the base 64 in the previous section.
+
+   This encoding is technically identical to the previous one, except
+   for the 62:nd and 63:rd alphabet character, as indicated in Table 2.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 7]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+         Table 2: The "URL and Filename safe" Base 64 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A            17 R            34 i            51 z
+         1 B            18 S            35 j            52 0
+         2 C            19 T            36 k            53 1
+         3 D            20 U            37 l            54 2
+         4 E            21 V            38 m            55 3
+         5 F            22 W            39 n            56 4
+         6 G            23 X            40 o            57 5
+         7 H            24 Y            41 p            58 6
+         8 I            25 Z            42 q            59 7
+         9 J            26 a            43 r            60 8
+        10 K            27 b            44 s            61 9
+        11 L            28 c            45 t            62 - (minus)
+        12 M            29 d            46 u            63 _
+        13 N            30 e            47 v           (underline)
+        14 O            31 f            48 w
+        15 P            32 g            49 x
+        16 Q            33 h            50 y         (pad) =
+
+6.  Base 32 Encoding
+
+   The following description of base 32 is derived from [11] (with
+   corrections).  This encoding may be referred to as "base32".
+
+   The Base 32 encoding is designed to represent arbitrary sequences of
+   octets in a form that needs to be case insensitive but that need not
+   be human readable.
+
+   A 33-character subset of US-ASCII is used, enabling 5 bits to be
+   represented per printable character.  (The extra 33rd character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 40-bit groups of input bits as output
+   strings of 8 encoded characters.  Proceeding from left to right, a
+   40-bit input group is formed by concatenating 5 8bit input groups.
+   These 40 bits are then treated as 8 concatenated 5-bit groups, each
+   of which is translated into a single character in the base 32
+   alphabet.  When a bit stream is encoded via the base 32 encoding, the
+   bit stream must be presumed to be ordered with the most-significant-
+   bit first.  That is, the first bit in the stream will be the high-
+   order bit in the first 8bit byte, the eighth bit will be the low-
+   order bit in the first 8bit byte, and so on.
+
+
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 8]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   Each 5-bit group is used as an index into an array of 32 printable
+   characters.  The character referenced by the index is placed in the
+   output string.  These characters, identified in Table 3, below, are
+   selected from US-ASCII digits and uppercase letters.
+
+                     Table 3: The Base 32 Alphabet
+
+     Value Encoding  Value Encoding  Value Encoding  Value Encoding
+         0 A             9 J            18 S            27 3
+         1 B            10 K            19 T            28 4
+         2 C            11 L            20 U            29 5
+         3 D            12 M            21 V            30 6
+         4 E            13 N            22 W            31 7
+         5 F            14 O            23 X
+         6 G            15 P            24 Y         (pad) =
+         7 H            16 Q            25 Z
+         8 I            17 R            26 2
+
+   Special processing is performed if fewer than 40 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a body.  When fewer than 40 input bits
+   are available in an input group, bits with value zero are added (on
+   the right) to form an integral number of 5-bit groups.  Padding at
+   the end of the data is performed using the "=" character.  Since all
+   base 32 input is an integral number of octets, only the following
+   cases can arise:
+
+   (1) The final quantum of encoding input is an integral multiple of 40
+       bits; here, the final unit of encoded output will be an integral
+       multiple of 8 characters with no "=" padding.
+
+   (2) The final quantum of encoding input is exactly 8 bits; here, the
+       final unit of encoded output will be two characters followed by
+       six "=" padding characters.
+
+   (3) The final quantum of encoding input is exactly 16 bits; here, the
+       final unit of encoded output will be four characters followed by
+       four "=" padding characters.
+
+   (4) The final quantum of encoding input is exactly 24 bits; here, the
+       final unit of encoded output will be five characters followed by
+       three "=" padding characters.
+
+   (5) The final quantum of encoding input is exactly 32 bits; here, the
+       final unit of encoded output will be seven characters followed by
+       one "=" padding character.
+
+
+
+
+
+Josefsson                   Standards Track                     [Page 9]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+7.  Base 32 Encoding with Extended Hex Alphabet
+
+   The following description of base 32 is derived from [7].  This
+   encoding may be referred to as "base32hex".  This encoding should not
+   be regarded as the same as the "base32" encoding and should not be
+   referred to as only "base32".  This encoding is used by, e.g.,
+   NextSECure3 (NSEC3) [10].
+
+   One property with this alphabet, which the base64 and base32
+   alphabets lack, is that encoded data maintains its sort order when
+   the encoded data is compared bit-wise.
+
+   This encoding is identical to the previous one, except for the
+   alphabet.  The new alphabet is found in Table 4.
+
+                 Table 4: The "Extended Hex" Base 32 Alphabet
+
+         Value Encoding  Value Encoding  Value Encoding  Value Encoding
+             0 0             9 9            18 I            27 R
+             1 1            10 A            19 J            28 S
+             2 2            11 B            20 K            29 T
+             3 3            12 C            21 L            30 U
+             4 4            13 D            22 M            31 V
+             5 5            14 E            23 N
+             6 6            15 F            24 O         (pad) =
+             7 7            16 G            25 P
+             8 8            17 H            26 Q
+
+8.  Base 16 Encoding
+
+   The following description is original but analogous to previous
+   descriptions.  Essentially, Base 16 encoding is the standard case-
+   insensitive hex encoding and may be referred to as "base16" or "hex".
+
+   A 16-character subset of US-ASCII is used, enabling 4 bits to be
+   represented per printable character.
+
+   The encoding process represents 8-bit groups (octets) of input bits
+   as output strings of 2 encoded characters.  Proceeding from left to
+   right, an 8-bit input is taken from the input data.  These 8 bits are
+   then treated as 2 concatenated 4-bit groups, each of which is
+   translated into a single character in the base 16 alphabet.
+
+   Each 4-bit group is used as an index into an array of 16 printable
+   characters.  The character referenced by the index is placed in the
+   output string.
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 10]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+                         Table 5: The Base 16 Alphabet
+
+         Value Encoding  Value Encoding  Value Encoding  Value Encoding
+             0 0             4 4             8 8            12 C
+             1 1             5 5             9 9            13 D
+             2 2             6 6            10 A            14 E
+             3 3             7 7            11 B            15 F
+
+   Unlike base 32 and base 64, no special padding is necessary since a
+   full code word is always available.
+
+9.  Illustrations and Examples
+
+   To translate between binary and a base encoding, the input is stored
+   in a structure, and the output is extracted.  The case for base 64 is
+   displayed in the following figure, borrowed from [5].
+
+            +--first octet--+-second octet--+--third octet--+
+            |7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|7 6 5 4 3 2 1 0|
+            +-----------+---+-------+-------+---+-----------+
+            |5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|5 4 3 2 1 0|
+            +--1.index--+--2.index--+--3.index--+--4.index--+
+
+   The case for base 32 is shown in the following figure, borrowed from
+   [7].  Each successive character in a base-32 value represents 5
+   successive bits of the underlying octet sequence.  Thus, each group
+   of 8 characters represents a sequence of 5 octets (40 bits).
+
+                        1          2          3
+             01234567 89012345 67890123 45678901 23456789
+            +--------+--------+--------+--------+--------+
+            |< 1 >< 2| >< 3 ><|.4 >< 5.|>< 6 ><.|7 >< 8 >|
+            +--------+--------+--------+--------+--------+
+                                                    <===> 8th character
+                                              <====> 7th character
+                                         <===> 6th character
+                                   <====> 5th character
+                             <====> 4th character
+                        <===> 3rd character
+                  <====> 2nd character
+             <===> 1st character
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 11]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   The following example of Base64 data is from [5], with corrections.
+
+      Input data:  0x14fb9c03d97e
+      Hex:     1   4    f   b    9   c     | 0   3    d   9    7   e
+      8-bit:   00010100 11111011 10011100  | 00000011 11011001 01111110
+      6-bit:   000101 001111 101110 011100 | 000000 111101 100101 111110
+      Decimal: 5      15     46     28       0      61     37     62
+      Output:  F      P      u      c        A      9      l      +
+
+      Input data:  0x14fb9c03d9
+      Hex:     1   4    f   b    9   c     | 0   3    d   9
+      8-bit:   00010100 11111011 10011100  | 00000011 11011001
+                                                      pad with 00
+      6-bit:   000101 001111 101110 011100 | 000000 111101 100100
+      Decimal: 5      15     46     28       0      61     36
+                                                         pad with =
+      Output:  F      P      u      c        A      9      k      =
+
+      Input data:  0x14fb9c03
+      Hex:     1   4    f   b    9   c     | 0   3
+      8-bit:   00010100 11111011 10011100  | 00000011
+                                             pad with 0000
+      6-bit:   000101 001111 101110 011100 | 000000 110000
+      Decimal: 5      15     46     28       0      48
+                                                  pad with =      =
+      Output:  F      P      u      c        A      w      =      =
+
+10.  Test Vectors
+
+   BASE64("") = ""
+
+   BASE64("f") = "Zg=="
+
+   BASE64("fo") = "Zm8="
+
+   BASE64("foo") = "Zm9v"
+
+   BASE64("foob") = "Zm9vYg=="
+
+   BASE64("fooba") = "Zm9vYmE="
+
+   BASE64("foobar") = "Zm9vYmFy"
+
+   BASE32("") = ""
+
+   BASE32("f") = "MY======"
+
+   BASE32("fo") = "MZXQ===="
+
+
+
+Josefsson                   Standards Track                    [Page 12]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+   BASE32("foo") = "MZXW6==="
+
+   BASE32("foob") = "MZXW6YQ="
+
+   BASE32("fooba") = "MZXW6YTB"
+
+   BASE32("foobar") = "MZXW6YTBOI======"
+
+   BASE32-HEX("") = ""
+
+   BASE32-HEX("f") = "CO======"
+
+   BASE32-HEX("fo") = "CPNG===="
+
+   BASE32-HEX("foo") = "CPNMU==="
+
+   BASE32-HEX("foob") = "CPNMUOG="
+
+   BASE32-HEX("fooba") = "CPNMUOJ1"
+
+   BASE32-HEX("foobar") = "CPNMUOJ1E8======"
+
+   BASE16("") = ""
+
+   BASE16("f") = "66"
+
+   BASE16("fo") = "666F"
+
+   BASE16("foo") = "666F6F"
+
+   BASE16("foob") = "666F6F62"
+
+   BASE16("fooba") = "666F6F6261"
+
+   BASE16("foobar") = "666F6F626172"
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 13]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+11.  ISO C99 Implementation of Base64
+
+   An ISO C99 implementation of Base64 encoding and decoding that is
+   believed to follow all recommendations in this RFC is available from:
+
+      http://josefsson.org/base-encoding/
+
+   This code is not normative.
+
+   The code could not be included in this RFC for procedural reasons
+   (RFC 3978 section 5.4).
+
+12.  Security Considerations
+
+   When base encoding and decoding is implemented, care should be taken
+   not to introduce vulnerabilities to buffer overflow attacks, or other
+   attacks on the implementation.  A decoder should not break on invalid
+   input including, e.g., embedded NUL characters (ASCII 0).
+
+   If non-alphabet characters are ignored, instead of causing rejection
+   of the entire encoding (as recommended), a covert channel that can be
+   used to "leak" information is made possible.  The ignored characters
+   could also be used for other nefarious purposes, such as to avoid a
+   string equality comparison or to trigger implementation bugs.  The
+   implications of ignoring non-alphabet characters should be understood
+   in applications that do not follow the recommended practice.
+   Similarly, when the base 16 and base 32 alphabets are handled case
+   insensitively, alteration of case can be used to leak information or
+   make string equality comparisons fail.
+
+   When padding is used, there are some non-significant bits that
+   warrant security concerns, as they may be abused to leak information
+   or used to bypass string equality comparisons or to trigger
+   implementation problems.
+
+   Base encoding visually hides otherwise easily recognized information,
+   such as passwords, but does not provide any computational
+   confidentiality.  This has been known to cause security incidents
+   when, e.g., a user reports details of a network protocol exchange
+   (perhaps to illustrate some other problem) and accidentally reveals
+   the password because she is unaware that the base encoding does not
+   protect the password.
+
+   Base encoding adds no entropy to the plaintext, but it does increase
+   the amount of plaintext available and provide a signature for
+   cryptanalysis in the form of a characteristic probability
+   distribution.
+
+
+
+
+Josefsson                   Standards Track                    [Page 14]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+13.  Changes Since RFC 3548
+
+   Added the "base32 extended hex alphabet", needed to preserve sort
+   order of encoded data.
+
+   Referenced IMAP for the special Base64 encoding used there.
+
+   Fixed the example copied from RFC 2440.
+
+   Added security consideration about providing a signature for
+   cryptoanalysis.
+
+   Added test vectors.
+
+   Fixed typos.
+
+14.  Acknowledgements
+
+   Several people offered comments and/or suggestions, including John E.
+   Hadstate, Tony Hansen, Gordon Mohr, John Myers, Chris Newman, and
+   Andrew Sieber.  Text used in this document are based on earlier RFCs
+   describing specific uses of various base encodings.  The author
+   acknowledges the RSA Laboratories for supporting the work that led to
+   this document.
+
+   This revised version is based in parts on comments and/or suggestions
+   made by Roy Arends, Eric Blake, Brian E Carpenter, Elwyn Davies, Bill
+   Fenner, Sam Hartman, Ted Hardie, Per Hygum, Jelte Jansen, Clement
+   Kent, Tero Kivinen, Paul Kwiatkowski, and Ben Laurie.
+
+15.  Copying Conditions
+
+   Copyright (c) 2000-2006 Simon Josefsson
+
+   Regarding the abstract and sections 1, 3, 8, 10, 12, 13, and 14 of
+   this document, that were written by Simon Josefsson ("the author",
+   for the remainder of this section), the author makes no guarantees
+   and is not responsible for any damage resulting from its use.  The
+   author grants irrevocable permission to anyone to use, modify, and
+   distribute it in any way that does not diminish the rights of anyone
+   else to use, modify, and distribute it, provided that redistributed
+   derivative works do not contain misleading author or version
+   information and do not falsely purport to be IETF RFC documents.
+   Derivative works need not be licensed under similar terms.
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 15]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+16.  References
+
+16.1.  Normative References
+
+   [1]   Cerf, V., "ASCII format for network interchange", RFC 20,
+         October 1969.
+
+   [2]   Bradner, S., "Key words for use in RFCs to Indicate Requirement
+         Levels", BCP 14, RFC 2119, March 1997.
+
+16.2.  Informative References
+
+   [3]   Linn, J., "Privacy Enhancement for Internet Electronic Mail:
+         Part I: Message Encryption and Authentication Procedures", RFC
+         1421, February 1993.
+
+   [4]   Freed, N. and N. Borenstein, "Multipurpose Internet Mail
+         Extensions (MIME) Part One: Format of Internet Message Bodies",
+         RFC 2045, November 1996.
+
+   [5]   Callas, J., Donnerhacke, L., Finney, H., and R. Thayer,
+         "OpenPGP Message Format", RFC 2440, November 1998.
+
+   [6]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+         "DNS Security Introduction and Requirements", RFC 4033, March
+         2005.
+
+   [7]   Klyne, G. and L. Masinter, "Identifying Composite Media
+         Features", RFC 2938, September 2000.
+
+   [8]   Crispin, M., "INTERNET MESSAGE ACCESS PROTOCOL - VERSION
+         4rev1", RFC 3501, March 2003.
+
+   [9]   Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
+         Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986,
+         January 2005.
+
+   [10]  Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNSSEC Hash
+         Authenticated Denial of Existence", Work in Progress, June
+         2006.
+
+   [11]  Myers, J., "SASL GSSAPI mechanisms", Work in Progress, May
+         2000.
+
+   [12]  Wilcox-O'Hearn, B., "Post to P2P-hackers mailing list",
+         http://zgp.org/pipermail/p2p-hackers/2001-September/
+         000315.html, September 2001.
+
+
+
+
+Josefsson                   Standards Track                    [Page 16]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Author's Address
+
+   Simon Josefsson
+   SJD
+   EMail: simon@josefsson.org
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 17]
+
+RFC 4648                    Base-N Encodings                October 2006
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (2006).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
+   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
+   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is provided by the IETF
+   Administrative Support Activity (IASA).
+
+
+
+
+
+
+
+Josefsson                   Standards Track                    [Page 18]
+
diff --git a/doc/rfc/rfc4701.txt b/doc/rfc/rfc4701.txt
new file mode 100644
index 000000000000..03e3c54376f4
--- /dev/null
+++ b/doc/rfc/rfc4701.txt
@@ -0,0 +1,675 @@
+
+
+
+
+
+
+Network Working Group                                           M. Stapp
+Request for Comments: 4701                           Cisco Systems, Inc.
+Category: Standards Track                                       T. Lemon
+                                                           Nominum, Inc.
+                                                           A. Gustafsson
+                                          Araneus Information Systems Oy
+                                                            October 2006
+
+
+                A DNS Resource Record (RR) for Encoding
+   Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2006).
+
+Abstract
+
+   It is possible for Dynamic Host Configuration Protocol (DHCP) clients
+   to attempt to update the same DNS Fully Qualified Domain Name (FQDN)
+   or to update a DNS FQDN that has been added to the DNS for another
+   purpose as they obtain DHCP leases.  Whether the DHCP server or the
+   clients themselves perform the DNS updates, conflicts can arise.  To
+   resolve such conflicts, RFC 4703 proposes storing client identifiers
+   in the DNS to unambiguously associate domain names with the DHCP
+   clients to which they refer.  This memo defines a distinct Resource
+   Record (RR) type for this purpose for use by DHCP clients and
+   servers:  the "DHCID" RR.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 1]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Table of Contents
+
+   1. Introduction ....................................................3
+   2. Terminology .....................................................3
+   3. The DHCID RR ....................................................3
+      3.1. DHCID RDATA Format .........................................3
+      3.2. DHCID Presentation Format ..................................4
+      3.3. The DHCID RR Identifier Type Codes .........................4
+      3.4. The DHCID RR Digest Type Code ..............................4
+      3.5. Computation of the RDATA ...................................5
+           3.5.1. Using the Client's DUID .............................5
+           3.5.2. Using the Client Identifier Option ..................6
+           3.5.3. Using the Client's htype and chaddr .................6
+      3.6. Examples ...................................................6
+           3.6.1. Example 1 ...........................................6
+           3.6.2. Example 2 ...........................................7
+           3.6.3. Example 3 ...........................................7
+   4. Use of the DHCID RR .............................................8
+   5. Updater Behavior ................................................8
+   6. Security Considerations .........................................8
+   7. IANA Considerations .............................................9
+   8. Acknowledgements ................................................9
+   9. References ......................................................9
+      9.1. Normative References .......................................9
+      9.2. Informative References ....................................10
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 2]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+1.  Introduction
+
+   A set of procedures to allow DHCP [7] [11] clients and servers to
+   automatically update the DNS ([3], [4]) is proposed in [1].
+
+   Conflicts can arise if multiple DHCP clients wish to use the same DNS
+   name or a DHCP client attempts to use a name added for another
+   purpose.  To resolve such conflicts, [1] proposes storing client
+   identifiers in the DNS to unambiguously associate domain names with
+   the DHCP clients using them.  In the interest of clarity, it is
+   preferable for this DHCP information to use a distinct RR type.  This
+   memo defines a distinct RR for this purpose for use by DHCP clients
+   or servers: the "DHCID" RR.
+
+   In order to obscure potentially sensitive client identifying
+   information, the data stored is the result of a one-way SHA-256 hash
+   computation.  The hash includes information from the DHCP client's
+   message as well as the domain name itself, so that the data stored in
+   the DHCID RR will be dependent on both the client identification used
+   in the DHCP protocol interaction and the domain name.  This means
+   that the DHCID RDATA will vary if a single client is associated over
+   time with more than one name.  This makes it difficult to 'track' a
+   client as it is associated with various domain names.
+
+2.  Terminology
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [2].
+
+3.  The DHCID RR
+
+   The DHCID RR is defined with mnemonic DHCID and type code 49.  The
+   DHCID RR is only defined in the IN class.  DHCID RRs cause no
+   additional section processing.
+
+3.1.  DHCID RDATA Format
+
+   The RDATA section of a DHCID RR in transmission contains RDLENGTH
+   octets of binary data.  The format of this data and its
+   interpretation by DHCP servers and clients are described below.
+
+   DNS software should consider the RDATA section to be opaque.  DHCP
+   clients or servers use the DHCID RR to associate a DHCP client's
+   identity with a DNS name, so that multiple DHCP clients and servers
+   may deterministically perform dynamic DNS updates to the same zone.
+   From the updater's perspective, the DHCID resource record RDATA
+   consists of a 2-octet identifier type, in network byte order,
+
+
+
+Stapp, et al.               Standards Track                     [Page 3]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+   followed by a 1-octet digest type, followed by one or more octets
+   representing the actual identifier:
+
+           < 2 octets >    Identifier type code
+           < 1 octet >     Digest type code
+           < n octets >    Digest (length depends on digest type)
+
+3.2.  DHCID Presentation Format
+
+   In DNS master files, the RDATA is represented as a single block in
+   base-64 encoding identical to that used for representing binary data
+   in [8], Section 3.  The data may be divided up into any number of
+   white-space-separated substrings, down to single base-64 digits,
+   which are concatenated to form the complete RDATA.  These substrings
+   can span lines using the standard parentheses.
+
+3.3.  The DHCID RR Identifier Type Codes
+
+   The DHCID RR Identifier Type Code specifies what data from the DHCP
+   client's request was used as input into the hash function.  The
+   identifier type codes are defined in a registry maintained by IANA,
+   as specified in Section 7.  The initial list of assigned values for
+   the identifier type code and that type's identifier is:
+
+
+   +------------------+------------------------------------------------+
+   |  Identifier Type | Identifier                                     |
+   |       Code       |                                                |
+   +------------------+------------------------------------------------+
+   |      0x0000      | The 1-octet 'htype' followed by 'hlen' octets  |
+   |                  | of 'chaddr' from a DHCPv4 client's DHCPREQUEST |
+   |                  | [7].                                           |
+   |      0x0001      | The data octets (i.e., the Type and            |
+   |                  | Client-Identifier fields) from a DHCPv4        |
+   |                  | client's Client Identifier option [10].        |
+   |      0x0002      | The client's DUID (i.e., the data octets of a  |
+   |                  | DHCPv6 client's Client Identifier option [11]  |
+   |                  | or the DUID field from a DHCPv4 client's       |
+   |                  | Client Identifier option [6]).                 |
+   |  0x0003 - 0xfffe | Undefined; available to be assigned by IANA.   |
+   |      0xffff      | Undefined; RESERVED.                           |
+   +------------------+------------------------------------------------+
+
+3.4.  The DHCID RR Digest Type Code
+
+   The DHCID RR Digest Type Code is an identifier for the digest
+   algorithm used.  The digest is calculated over an identifier and the
+   canonical FQDN as described in the next section.
+
+
+
+Stapp, et al.               Standards Track                     [Page 4]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+   The digest type codes are defined in a registry maintained by IANA,
+   as specified in Section 7.  The initial list of assigned values for
+   the digest type codes is: value 0 is reserved, and value 1 is
+   SHA-256.  Reserving other types requires IETF standards action.
+   Defining new values will also require IETF standards action to
+   document how DNS updaters are to deal with multiple digest types.
+
+3.5.  Computation of the RDATA
+
+   The DHCID RDATA is formed by concatenating the 2-octet identifier
+   type code with variable-length data.
+
+   The RDATA for all type codes other than 0xffff, which is reserved for
+   future expansion, is formed by concatenating the 2-octet identifier
+   type code, the 1-octet digest type code, and the digest value (32
+   octets for SHA-256).
+
+       < identifier-type > < digest-type > < digest >
+
+   The input to the digest hash function is defined to be:
+
+       digest = SHA-256(< identifier > < FQDN >)
+
+   The FQDN is represented in the buffer in the canonical wire format as
+   described in [9], Section 6.2.  The identifier type code and the
+   identifier are related as specified in Section 3.3: the identifier
+   type code describes the source of the identifier.
+
+   A DHCPv4 updater uses the 0x0002 type code if a Client Identifier
+   option is present in the DHCPv4 messages and it is encoded as
+   specified in [6].  Otherwise, the updater uses 0x0001 if a Client
+   Identifier option is present, and 0x0000 if not.
+
+   A DHCPv6 updater always uses the 0x0002 type code.
+
+3.5.1.  Using the Client's DUID
+
+   When the updater is using the Client's DUID (either from a DHCPv6
+   Client Identifier option or from a portion of the DHCPv4 Client
+   Identifier option encoded as specified in [6]), the first two octets
+   of the DHCID RR MUST be 0x0002, in network byte order.  The third
+   octet is the digest type code (1 for SHA-256).  The rest of the DHCID
+   RR MUST contain the results of computing the SHA-256 hash across the
+   octets of the DUID followed by the FQDN.
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 5]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+3.5.2.  Using the Client Identifier Option
+
+   When the updater is using the DHCPv4 Client Identifier option sent by
+   the client in its DHCPREQUEST message, the first two octets of the
+   DHCID RR MUST be 0x0001, in network byte order.  The third octet is
+   the digest type code (1 for SHA-256).  The rest of the DHCID RR MUST
+   contain the results of computing the SHA-256 hash across the data
+   octets (i.e., the Type and Client-Identifier fields) of the option,
+   followed by the FQDN.
+
+3.5.3.  Using the Client's htype and chaddr
+
+   When the updater is using the client's link-layer address as the
+   identifier, the first two octets of the DHCID RDATA MUST be zero.
+   The third octet is the digest type code (1 for SHA-256).  To generate
+   the rest of the resource record, the updater computes a one-way hash
+   using the SHA-256 algorithm across a buffer containing the client's
+   network hardware type, link-layer address, and the FQDN data.
+   Specifically, the first octet of the buffer contains the network
+   hardware type as it appeared in the DHCP 'htype' field of the
+   client's DHCPREQUEST message.  All of the significant octets of the
+   'chaddr' field in the client's DHCPREQUEST message follow, in the
+   same order in which the octets appear in the DHCPREQUEST message.
+   The number of significant octets in the 'chaddr' field is specified
+   in the 'hlen' field of the DHCPREQUEST message.  The FQDN data, as
+   specified above, follows.
+
+3.6.  Examples
+
+3.6.1.  Example 1
+
+   A DHCP server allocates the IPv6 address 2001:DB8::1234:5678 to a
+   client that included the DHCPv6 client-identifier option data 00:01:
+   00:06:41:2d:f1:66:01:02:03:04:05:06 in its DHCPv6 request.  The
+   server updates the name "chi6.example.com" on the client's behalf and
+   uses the DHCP client identifier option data as input in forming a
+   DHCID RR.  The DHCID RDATA is formed by setting the two type octets
+   to the value 0x0002, the 1-octet digest type to 1 for SHA-256, and
+   performing a SHA-256 hash computation across a buffer containing the
+   14 octets from the client-id option and the FQDN (represented as
+   specified in Section 3.5).
+
+     chi6.example.com.     AAAA    2001:DB8::1234:5678
+     chi6.example.com.     DHCID   ( AAIBY2/AuCccgoJbsaxcQc9TUapptP69l
+                                     OjxfNuVAA2kjEA= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+
+
+Stapp, et al.               Standards Track                     [Page 6]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+     \# 35 ( 000201636fc0b8271c82825bb1ac5c41cf5351aa69b4febd94e8f17cd
+             b95000da48c40 )
+
+3.6.2.  Example 2
+
+   A DHCP server allocates the IPv4 address 192.0.2.2 to a client that
+   included the DHCP client-identifier option data 01:07:08:09:0a:0b:0c
+   in its DHCP request.  The server updates the name "chi.example.com"
+   on the client's behalf and uses the DHCP client identifier option
+   data as input in forming a DHCID RR.  The DHCID RDATA is formed by
+   setting the two type octets to the value 0x0001, the 1-octet digest
+   type to 1 for SHA-256, and performing a SHA-256 hash computation
+   across a buffer containing the seven octets from the client-id option
+   and the FQDN (represented as specified in Section 3.5).
+
+     chi.example.com.      A       192.0.2.2
+     chi.example.com.      DHCID   ( AAEBOSD+XR3Os/0LozeXVqcNc7FwCfQdW
+                                     L3b/NaiUDlW2No= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+     \# 35 ( 0001013920fe5d1dceb3fd0ba3379756a70d73b17009f41d58bddbfcd
+             6a2503956d8da )
+
+3.6.3.  Example 3
+
+   A DHCP server allocating the IPv4 address 192.0.2.3 to a client with
+   the Ethernet MAC address 01:02:03:04:05:06 using domain name
+   "client.example.com" uses the client's link-layer address to identify
+   the client.  The DHCID RDATA is composed by setting the two type
+   octets to zero, the 1-octet digest type to 1 for SHA-256, and
+   performing an SHA-256 hash computation across a buffer containing the
+   1-octet 'htype' value for Ethernet, 0x01, followed by the six octets
+   of the Ethernet MAC address, and the domain name (represented as
+   specified in Section 3.5).
+
+     client.example.com.   A       192.0.2.3
+     client.example.com.   DHCID   ( AAABxLmlskllE0MVjd57zHcWmEH3pCQ6V
+                                     ytcKD//7es/deY= )
+
+   If the DHCID RR type is not supported, the RDATA would be encoded
+   [13] as:
+
+     \# 35 ( 000001c4b9a5b249651343158dde7bcc77169841f7a4243a572b5c283
+             fffedeb3f75e6 )
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 7]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+4.  Use of the DHCID RR
+
+   This RR MUST NOT be used for any purpose other than that detailed in
+   [1].  Although this RR contains data that is opaque to DNS servers,
+   the data must be consistent across all entities that update and
+   interpret this record.  Therefore, new data formats may only be
+   defined through actions of the DHC Working Group, as a result of
+   revising [1].
+
+5.  Updater Behavior
+
+   The data in the DHCID RR allows updaters to determine whether more
+   than one DHCP client desires to use a particular FQDN.  This allows
+   site administrators to establish policy about DNS updates.  The DHCID
+   RR does not establish any policy itself.
+
+   Updaters use data from a DHCP client's request and the domain name
+   that the client desires to use to compute a client identity hash, and
+   then compare that hash to the data in any DHCID RRs on the name that
+   they wish to associate with the client's IP address.  If an updater
+   discovers DHCID RRs whose RDATA does not match the client identity
+   that they have computed, the updater SHOULD conclude that a different
+   client is currently associated with the name in question.  The
+   updater SHOULD then proceed according to the site's administrative
+   policy.  That policy might dictate that a different name be selected,
+   or it might permit the updater to continue.
+
+6.  Security Considerations
+
+   The DHCID record as such does not introduce any new security problems
+   into the DNS.  In order to obscure the client's identity information,
+   a one-way hash is used.  Further, in order to make it difficult to
+   'track' a client by examining the names associated with a particular
+   hash value, the FQDN is included in the hash computation.  Thus, the
+   RDATA is dependent on both the DHCP client identification data and on
+   each FQDN associated with the client.
+
+   However, it should be noted that an attacker that has some knowledge,
+   such as of MAC addresses commonly used in DHCP client identification
+   data, may be able to discover the client's DHCP identify by using a
+   brute-force attack.  Even without any additional knowledge, the
+   number of unknown bits used in computing the hash is typically only
+   48 to 80.
+
+   Administrators should be wary of permitting unsecured DNS updates to
+   zones, whether or not they are exposed to the global Internet.  Both
+   DHCP clients and servers SHOULD use some form of update
+   authentication (e.g., [12]) when performing DNS updates.
+
+
+
+Stapp, et al.               Standards Track                     [Page 8]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+7.  IANA Considerations
+
+   IANA has allocated a DNS RR type number for the DHCID record type.
+
+   This specification defines a new number-space for the 2-octet
+   identifier type codes associated with the DHCID RR.  IANA has
+   established a registry of the values for this number-space.  Three
+   initial values are assigned in Section 3.3, and the value 0xFFFF is
+   reserved for future use.  New DHCID RR identifier type codes are
+   assigned through Standards Action, as defined in [5].
+
+   This specification defines a new number-space for the 1-octet digest
+   type codes associated with the DHCID RR.  IANA has established a
+   registry of the values for this number-space.  Two initial values are
+   assigned in Section 3.4.  New DHCID RR digest type codes are assigned
+   through Standards Action, as defined in [5].
+
+8.  Acknowledgements
+
+   Many thanks to Harald Alvestrand, Ralph Droms, Olafur Gudmundsson,
+   Sam Hartman, Josh Littlefield, Pekka Savola, and especially Bernie
+   Volz for their review and suggestions.
+
+9.  References
+
+9.1.  Normative References
+
+   [1]  Stapp, M. and B. Volz, "Resolution of Fully Qualified Domain
+        Name (FQDN) Conflicts among Dynamic Host Configuration Protocol
+        (DHCP) Clients", RFC 4703, October 2006.
+
+   [2]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
+        Levels", BCP 14, RFC 2119, March 1997.
+
+   [3]  Mockapetris, P., "Domain names - concepts and facilities",
+        STD 13, RFC 1034, November 1987.
+
+   [4]  Mockapetris, P., "Domain names - implementation and
+        specification", STD 13, RFC 1035, November 1987.
+
+   [5]  Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA
+        Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
+
+   [6]  Lemon, T. and B. Sommerfeld, "Node-specific Client Identifiers
+        for Dynamic Host Configuration Protocol Version Four (DHCPv4)",
+        RFC 4361, February 2006.
+
+
+
+
+
+Stapp, et al.               Standards Track                     [Page 9]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+9.2.  Informative References
+
+   [7]   Droms, R., "Dynamic Host Configuration Protocol", RFC 2131,
+         March 1997.
+
+   [8]   Josefsson, S., "The Base16, Base32, and Base64 Data Encodings",
+         RFC 3548, July 2003.
+
+   [9]   Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+         "Resource Records for the DNS Security Extensions", RFC 4034,
+         March 2005.
+
+   [10]  Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
+         Extensions", RFC 2132, March 1997.
+
+   [11]  Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., and M.
+         Carney, "Dynamic Host Configuration Protocol for IPv6
+         (DHCPv6)", RFC 3315, July 2003.
+
+   [12]  Vixie, P., Gudmundsson, O., Eastlake, D., and B. Wellington,
+         "Secret Key Transaction Authentication for DNS (TSIG)",
+         RFC 2845, May 2000.
+
+   [13]  Gustafsson, A., "Handling of Unknown DNS Resource Record (RR)
+         Types", RFC 3597, September 2003.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 10]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Authors' Addresses
+
+   Mark Stapp
+   Cisco Systems, Inc.
+   1414 Massachusetts Ave.
+   Boxborough, MA  01719
+   USA
+
+   Phone: 978.936.1535
+   EMail: mjs@cisco.com
+
+
+   Ted Lemon
+   Nominum, Inc.
+   950 Charter St.
+   Redwood City, CA  94063
+   USA
+
+   EMail: mellon@nominum.com
+
+
+   Andreas Gustafsson
+   Araneus Information Systems Oy
+   Ulappakatu 1
+   02320 Espoo
+   Finland
+
+   EMail: gson@araneus.fi
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 11]
+
+RFC 4701                      The DHCID RR                  October 2006
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (2006).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
+   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
+   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is provided by the IETF
+   Administrative Support Activity (IASA).
+
+
+
+
+
+
+
+Stapp, et al.               Standards Track                    [Page 12]
+
diff --git a/doc/rfc/rfc5155.txt b/doc/rfc/rfc5155.txt
new file mode 100644
index 000000000000..d4b729761925
--- /dev/null
+++ b/doc/rfc/rfc5155.txt
@@ -0,0 +1,2915 @@
+
+
+
+
+
+
+Network Working Group                                          B. Laurie
+Request for Comments: 5155                                     G. Sisson
+Category: Standards Track                                      R. Arends
+                                                                 Nominet
+                                                               D. Blacka
+                                                          VeriSign, Inc.
+                                                              March 2008
+
+
+     DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Abstract
+
+   The Domain Name System Security (DNSSEC) Extensions introduced the
+   NSEC resource record (RR) for authenticated denial of existence.
+   This document introduces an alternative resource record, NSEC3, which
+   similarly provides authenticated denial of existence.  However, it
+   also provides measures against zone enumeration and permits gradual
+   expansion of delegation-centric zones.
+
+Table of Contents
+
+   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.1.  Rationale  . . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.2.  Requirements . . . . . . . . . . . . . . . . . . . . . . .  4
+     1.3.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  5
+   2.  Backwards Compatibility  . . . . . . . . . . . . . . . . . . .  6
+   3.  The NSEC3 Resource Record  . . . . . . . . . . . . . . . . . .  7
+     3.1.  RDATA Fields . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.1.  Hash Algorithm . . . . . . . . . . . . . . . . . . . .  8
+       3.1.2.  Flags  . . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.3.  Iterations . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.4.  Salt Length  . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.5.  Salt . . . . . . . . . . . . . . . . . . . . . . . . .  8
+       3.1.6.  Hash Length  . . . . . . . . . . . . . . . . . . . . .  9
+       3.1.7.  Next Hashed Owner Name . . . . . . . . . . . . . . . .  9
+       3.1.8.  Type Bit Maps  . . . . . . . . . . . . . . . . . . . .  9
+     3.2.  NSEC3 RDATA Wire Format  . . . . . . . . . . . . . . . . .  9
+       3.2.1.  Type Bit Maps Encoding . . . . . . . . . . . . . . . . 10
+     3.3.  Presentation Format  . . . . . . . . . . . . . . . . . . . 11
+
+
+
+Laurie, et al.              Standards Track                     [Page 1]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   4.  The NSEC3PARAM Resource Record . . . . . . . . . . . . . . . . 12
+     4.1.  RDATA Fields . . . . . . . . . . . . . . . . . . . . . . . 12
+       4.1.1.  Hash Algorithm . . . . . . . . . . . . . . . . . . . . 12
+       4.1.2.  Flag Fields  . . . . . . . . . . . . . . . . . . . . . 12
+       4.1.3.  Iterations . . . . . . . . . . . . . . . . . . . . . . 13
+       4.1.4.  Salt Length  . . . . . . . . . . . . . . . . . . . . . 13
+       4.1.5.  Salt . . . . . . . . . . . . . . . . . . . . . . . . . 13
+     4.2.  NSEC3PARAM RDATA Wire Format . . . . . . . . . . . . . . . 13
+     4.3.  Presentation Format  . . . . . . . . . . . . . . . . . . . 14
+   5.  Calculation of the Hash  . . . . . . . . . . . . . . . . . . . 14
+   6.  Opt-Out  . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
+   7.  Authoritative Server Considerations  . . . . . . . . . . . . . 16
+     7.1.  Zone Signing . . . . . . . . . . . . . . . . . . . . . . . 16
+     7.2.  Zone Serving . . . . . . . . . . . . . . . . . . . . . . . 17
+       7.2.1.  Closest Encloser Proof . . . . . . . . . . . . . . . . 18
+       7.2.2.  Name Error Responses . . . . . . . . . . . . . . . . . 19
+       7.2.3.  No Data Responses, QTYPE is not DS . . . . . . . . . . 19
+       7.2.4.  No Data Responses, QTYPE is DS . . . . . . . . . . . . 19
+       7.2.5.  Wildcard No Data Responses . . . . . . . . . . . . . . 19
+       7.2.6.  Wildcard Answer Responses  . . . . . . . . . . . . . . 20
+       7.2.7.  Referrals to Unsigned Subzones . . . . . . . . . . . . 20
+       7.2.8.  Responding to Queries for NSEC3 Owner Names  . . . . . 20
+       7.2.9.  Server Response to a Run-Time Collision  . . . . . . . 21
+     7.3.  Secondary Servers  . . . . . . . . . . . . . . . . . . . . 21
+     7.4.  Zones Using Unknown Hash Algorithms  . . . . . . . . . . . 21
+     7.5.  Dynamic Update . . . . . . . . . . . . . . . . . . . . . . 21
+   8.  Validator Considerations . . . . . . . . . . . . . . . . . . . 23
+     8.1.  Responses with Unknown Hash Types  . . . . . . . . . . . . 23
+     8.2.  Verifying NSEC3 RRs  . . . . . . . . . . . . . . . . . . . 23
+     8.3.  Closest Encloser Proof . . . . . . . . . . . . . . . . . . 23
+     8.4.  Validating Name Error Responses  . . . . . . . . . . . . . 24
+     8.5.  Validating No Data Responses, QTYPE is not DS  . . . . . . 24
+     8.6.  Validating No Data Responses, QTYPE is DS  . . . . . . . . 24
+     8.7.  Validating Wildcard No Data Responses  . . . . . . . . . . 25
+     8.8.  Validating Wildcard Answer Responses . . . . . . . . . . . 25
+     8.9.  Validating Referrals to Unsigned Subzones  . . . . . . . . 25
+   9.  Resolver Considerations  . . . . . . . . . . . . . . . . . . . 26
+     9.1.  NSEC3 Resource Record Caching  . . . . . . . . . . . . . . 26
+     9.2.  Use of the AD Bit  . . . . . . . . . . . . . . . . . . . . 26
+   10. Special Considerations . . . . . . . . . . . . . . . . . . . . 26
+     10.1. Domain Name Length Restrictions  . . . . . . . . . . . . . 26
+     10.2. DNAME at the Zone Apex . . . . . . . . . . . . . . . . . . 27
+     10.3. Iterations . . . . . . . . . . . . . . . . . . . . . . . . 27
+     10.4. Transitioning a Signed Zone from NSEC to NSEC3 . . . . . . 28
+     10.5. Transitioning a Signed Zone from NSEC3 to NSEC . . . . . . 28
+   11. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 29
+   12. Security Considerations  . . . . . . . . . . . . . . . . . . . 30
+     12.1. Hashing Considerations . . . . . . . . . . . . . . . . . . 30
+
+
+
+Laurie, et al.              Standards Track                     [Page 2]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       12.1.1. Dictionary Attacks . . . . . . . . . . . . . . . . . . 30
+       12.1.2. Collisions . . . . . . . . . . . . . . . . . . . . . . 31
+       12.1.3. Transitioning to a New Hash Algorithm  . . . . . . . . 31
+       12.1.4. Using High Iteration Values  . . . . . . . . . . . . . 31
+     12.2. Opt-Out Considerations . . . . . . . . . . . . . . . . . . 32
+     12.3. Other Considerations . . . . . . . . . . . . . . . . . . . 33
+   13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 33
+     13.1. Normative References . . . . . . . . . . . . . . . . . . . 33
+     13.2. Informative References . . . . . . . . . . . . . . . . . . 34
+   Appendix A.  Example Zone  . . . . . . . . . . . . . . . . . . . . 35
+   Appendix B.  Example Responses . . . . . . . . . . . . . . . . . . 40
+     B.1.  Name Error . . . . . . . . . . . . . . . . . . . . . . . . 40
+     B.2.  No Data Error  . . . . . . . . . . . . . . . . . . . . . . 42
+       B.2.1.  No Data Error, Empty Non-Terminal  . . . . . . . . . . 43
+     B.3.  Referral to an Opt-Out Unsigned Zone . . . . . . . . . . . 44
+     B.4.  Wildcard Expansion . . . . . . . . . . . . . . . . . . . . 45
+     B.5.  Wildcard No Data Error . . . . . . . . . . . . . . . . . . 46
+     B.6.  DS Child Zone No Data Error  . . . . . . . . . . . . . . . 48
+   Appendix C.  Special Considerations  . . . . . . . . . . . . . . . 48
+     C.1.  Salting  . . . . . . . . . . . . . . . . . . . . . . . . . 49
+     C.2.  Hash Collision . . . . . . . . . . . . . . . . . . . . . . 49
+       C.2.1.  Avoiding Hash Collisions During Generation . . . . . . 50
+       C.2.2.  Second Preimage Requirement Analysis . . . . . . . . . 50
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 3]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+1.  Introduction
+
+1.1.  Rationale
+
+   The DNS Security Extensions included the NSEC RR to provide
+   authenticated denial of existence.  Though the NSEC RR meets the
+   requirements for authenticated denial of existence, it introduces a
+   side-effect in that the contents of a zone can be enumerated.  This
+   property introduces undesired policy issues.
+
+   The enumeration is enabled by the set of NSEC records that exists
+   inside a signed zone.  An NSEC record lists two names that are
+   ordered canonically, in order to show that nothing exists between the
+   two names.  The complete set of NSEC records lists all the names in a
+   zone.  It is trivial to enumerate the content of a zone by querying
+   for names that do not exist.
+
+   An enumerated zone can be used, for example, as a source of probable
+   e-mail addresses for spam, or as a key for multiple WHOIS queries to
+   reveal registrant data that many registries may have legal
+   obligations to protect.  Many registries therefore prohibit the
+   copying of their zone data; however, the use of NSEC RRs renders
+   these policies unenforceable.
+
+   A second problem is that the cost to cryptographically secure
+   delegations to unsigned zones is high, relative to the perceived
+   security benefit, in two cases: large, delegation-centric zones, and
+   zones where insecure delegations will be updated rapidly.  In these
+   cases, the costs of maintaining the NSEC RR chain may be extremely
+   high and use of the "Opt-Out" convention may be more appropriate (for
+   these unsecured zones).
+
+   This document presents the NSEC3 Resource Record which can be used as
+   an alternative to NSEC to mitigate these issues.
+
+   Earlier work to address these issues include [DNSEXT-NO], [RFC4956],
+   and [DNSEXT-NSEC2v2].
+
+1.2.  Requirements
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 4]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+1.3.  Terminology
+
+   The reader is assumed to be familiar with the basic DNS and DNSSEC
+   concepts described in [RFC1034], [RFC1035], [RFC4033], [RFC4034],
+   [RFC4035], and subsequent RFCs that update them: [RFC2136],
+   [RFC2181], and [RFC2308].
+
+   The following terminology is used throughout this document:
+
+   Zone enumeration:  the practice of discovering the full content of a
+      zone via successive queries.  Zone enumeration was non-trivial
+      prior to the introduction of DNSSEC.
+
+   Original owner name:  the owner name corresponding to a hashed owner
+      name.
+
+   Hashed owner name:  the owner name created after applying the hash
+      function to an owner name.
+
+   Hash order:  the order in which hashed owner names are arranged
+      according to their numerical value, treating the leftmost (lowest
+      numbered) octet as the most significant octet.  Note that this
+      order is the same as the canonical DNS name order specified in
+      [RFC4034], when the hashed owner names are in base32, encoded with
+      an Extended Hex Alphabet [RFC4648].
+
+   Empty non-terminal:  a domain name that owns no resource records, but
+      has one or more subdomains that do.
+
+   Delegation:  an NS RRSet with a name different from the current zone
+      apex (non-zone-apex), signifying a delegation to a child zone.
+
+   Secure delegation:  a name containing a delegation (NS RRSet) and a
+      signed DS RRSet, signifying a delegation to a signed child zone.
+
+   Insecure delegation:  a name containing a delegation (NS RRSet), but
+      lacking a DS RRSet, signifying a delegation to an unsigned child
+      zone.
+
+   Opt-Out NSEC3 resource record:  an NSEC3 resource record that has the
+      Opt-Out flag set to 1.
+
+   Opt-Out zone:  a zone with at least one Opt-Out NSEC3 RR.
+
+   Closest encloser:  the longest existing ancestor of a name.  See also
+      Section 3.3.1 of [RFC4592].
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 5]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Closest provable encloser:  the longest ancestor of a name that can
+      be proven to exist.  Note that this is only different from the
+      closest encloser in an Opt-Out zone.
+
+   Next closer name:  the name one label longer than the closest
+      provable encloser of a name.
+
+   Base32:  the "Base 32 Encoding with Extended Hex Alphabet" as
+      specified in [RFC4648].  Note that trailing padding characters
+      ("=") are not used in the NSEC3 specification.
+
+   To cover:  An NSEC3 RR is said to "cover" a name if the hash of the
+      name or "next closer" name falls between the owner name and the
+      next hashed owner name of the NSEC3.  In other words, if it proves
+      the nonexistence of the name, either directly or by proving the
+      nonexistence of an ancestor of the name.
+
+   To match:  An NSEC3 RR is said to "match" a name if the owner name of
+      the NSEC3 RR is the same as the hashed owner name of that name.
+
+2.  Backwards Compatibility
+
+   This specification describes a protocol change that is not generally
+   backwards compatible with [RFC4033], [RFC4034], and [RFC4035].  In
+   particular, security-aware resolvers that are unaware of this
+   specification (NSEC3-unaware resolvers) may fail to validate the
+   responses introduced by this document.
+
+   In order to aid deployment, this specification uses a signaling
+   technique to prevent NSEC3-unaware resolvers from attempting to
+   validate responses from NSEC3-signed zones.
+
+   This specification allocates two new DNSKEY algorithm identifiers for
+   this purpose.  Algorithm 6, DSA-NSEC3-SHA1 is an alias for algorithm
+   3, DSA.  Algorithm 7, RSASHA1-NSEC3-SHA1 is an alias for algorithm 5,
+   RSASHA1.  These are not new algorithms, they are additional
+   identifiers for the existing algorithms.
+
+   Zones signed according to this specification MUST only use these
+   algorithm identifiers for their DNSKEY RRs.  Because these new
+   identifiers will be unknown algorithms to existing, NSEC3-unaware
+   resolvers, those resolvers will then treat responses from the NSEC3
+   signed zone as insecure, as detailed in Section 5.2 of [RFC4035].
+
+   These algorithm identifiers are used with the NSEC3 hash algorithm
+   SHA1.  Using other NSEC3 hash algorithms requires allocation of a new
+   alias (see Section 12.1.3).
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 6]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Security aware resolvers that are aware of this specification MUST
+   recognize the new algorithm identifiers and treat them as equivalent
+   to the algorithms that they alias.
+
+   A methodology for transitioning from a DNSSEC signed zone to a zone
+   signed using NSEC3 is discussed in Section 10.4.
+
+3.  The NSEC3 Resource Record
+
+   The NSEC3 Resource Record (RR) provides authenticated denial of
+   existence for DNS Resource Record Sets.
+
+   The NSEC3 RR lists RR types present at the original owner name of the
+   NSEC3 RR.  It includes the next hashed owner name in the hash order
+   of the zone.  The complete set of NSEC3 RRs in a zone indicates which
+   RRSets exist for the original owner name of the RR and form a chain
+   of hashed owner names in the zone.  This information is used to
+   provide authenticated denial of existence for DNS data.  To provide
+   protection against zone enumeration, the owner names used in the
+   NSEC3 RR are cryptographic hashes of the original owner name
+   prepended as a single label to the name of the zone.  The NSEC3 RR
+   indicates which hash function is used to construct the hash, which
+   salt is used, and how many iterations of the hash function are
+   performed over the original owner name.  The hashing technique is
+   described fully in Section 5.
+
+   Hashed owner names of unsigned delegations may be excluded from the
+   chain.  An NSEC3 RR whose span covers the hash of an owner name or
+   "next closer" name of an unsigned delegation is referred to as an
+   Opt-Out NSEC3 RR and is indicated by the presence of a flag.
+
+   The owner name for the NSEC3 RR is the base32 encoding of the hashed
+   owner name prepended as a single label to the name of the zone.
+
+   The type value for the NSEC3 RR is 50.
+
+   The NSEC3 RR RDATA format is class independent and is described
+   below.
+
+   The class MUST be the same as the class of the original owner name.
+
+   The NSEC3 RR SHOULD have the same TTL value as the SOA minimum TTL
+   field.  This is in the spirit of negative caching [RFC2308].
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 7]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+3.1.  RDATA Fields
+
+3.1.1.  Hash Algorithm
+
+   The Hash Algorithm field identifies the cryptographic hash algorithm
+   used to construct the hash-value.
+
+   The values for this field are defined in the NSEC3 hash algorithm
+   registry defined in Section 11.
+
+3.1.2.  Flags
+
+   The Flags field contains 8 one-bit flags that can be used to indicate
+   different processing.  All undefined flags must be zero.  The only
+   flag defined by this specification is the Opt-Out flag.
+
+3.1.2.1.  Opt-Out Flag
+
+   If the Opt-Out flag is set, the NSEC3 record covers zero or more
+   unsigned delegations.
+
+   If the Opt-Out flag is clear, the NSEC3 record covers zero unsigned
+   delegations.
+
+   The Opt-Out Flag indicates whether this NSEC3 RR may cover unsigned
+   delegations.  It is the least significant bit in the Flags field.
+   See Section 6 for details about the use of this flag.
+
+3.1.3.  Iterations
+
+   The Iterations field defines the number of additional times the hash
+   function has been performed.  More iterations result in greater
+   resiliency of the hash value against dictionary attacks, but at a
+   higher computational cost for both the server and resolver.  See
+   Section 5 for details of the use of this field, and Section 10.3 for
+   limitations on the value.
+
+3.1.4.  Salt Length
+
+   The Salt Length field defines the length of the Salt field in octets,
+   ranging in value from 0 to 255.
+
+3.1.5.  Salt
+
+   The Salt field is appended to the original owner name before hashing
+   in order to defend against pre-calculated dictionary attacks.  See
+   Section 5 for details on how the salt is used.
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 8]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+3.1.6.  Hash Length
+
+   The Hash Length field defines the length of the Next Hashed Owner
+   Name field, ranging in value from 1 to 255 octets.
+
+3.1.7.  Next Hashed Owner Name
+
+   The Next Hashed Owner Name field contains the next hashed owner name
+   in hash order.  This value is in binary format.  Given the ordered
+   set of all hashed owner names, the Next Hashed Owner Name field
+   contains the hash of an owner name that immediately follows the owner
+   name of the given NSEC3 RR.  The value of the Next Hashed Owner Name
+   field in the last NSEC3 RR in the zone is the same as the hashed
+   owner name of the first NSEC3 RR in the zone in hash order.  Note
+   that, unlike the owner name of the NSEC3 RR, the value of this field
+   does not contain the appended zone name.
+
+3.1.8.  Type Bit Maps
+
+   The Type Bit Maps field identifies the RRSet types that exist at the
+   original owner name of the NSEC3 RR.
+
+3.2.  NSEC3 RDATA Wire Format
+
+   The RDATA of the NSEC3 RR is as shown below:
+
+                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |   Hash Alg.   |     Flags     |          Iterations           |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Salt Length  |                     Salt                      /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Hash Length  |             Next Hashed Owner Name            /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   /                         Type Bit Maps                         /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+   Hash Algorithm is a single octet.
+
+   Flags field is a single octet, the Opt-Out flag is the least
+   significant bit, as shown below:
+
+    0 1 2 3 4 5 6 7
+   +-+-+-+-+-+-+-+-+
+   |             |O|
+   +-+-+-+-+-+-+-+-+
+
+
+
+
+Laurie, et al.              Standards Track                     [Page 9]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Iterations is represented as a 16-bit unsigned integer, with the most
+   significant bit first.
+
+   Salt Length is represented as an unsigned octet.  Salt Length
+   represents the length of the Salt field in octets.  If the value is
+   zero, the following Salt field is omitted.
+
+   Salt, if present, is encoded as a sequence of binary octets.  The
+   length of this field is determined by the preceding Salt Length
+   field.
+
+   Hash Length is represented as an unsigned octet.  Hash Length
+   represents the length of the Next Hashed Owner Name field in octets.
+
+   The next hashed owner name is not base32 encoded, unlike the owner
+   name of the NSEC3 RR.  It is the unmodified binary hash value.  It
+   does not include the name of the containing zone.  The length of this
+   field is determined by the preceding Hash Length field.
+
+3.2.1.  Type Bit Maps Encoding
+
+   The encoding of the Type Bit Maps field is the same as that used by
+   the NSEC RR, described in [RFC4034].  It is explained and clarified
+   here for clarity.
+
+   The RR type space is split into 256 window blocks, each representing
+   the low-order 8 bits of the 16-bit RR type space.  Each block that
+   has at least one active RR type is encoded using a single octet
+   window number (from 0 to 255), a single octet bitmap length (from 1
+   to 32) indicating the number of octets used for the bitmap of the
+   window block, and up to 32 octets (256 bits) of bitmap.
+
+   Blocks are present in the NSEC3 RR RDATA in increasing numerical
+   order.
+
+      Type Bit Maps Field = ( Window Block # | Bitmap Length | Bitmap )+
+
+      where "|" denotes concatenation.
+
+   Each bitmap encodes the low-order 8 bits of RR types within the
+   window block, in network bit order.  The first bit is bit 0.  For
+   window block 0, bit 1 corresponds to RR type 1 (A), bit 2 corresponds
+   to RR type 2 (NS), and so forth.  For window block 1, bit 1
+   corresponds to RR type 257, bit 2 to RR type 258.  If a bit is set to
+   1, it indicates that an RRSet of that type is present for the
+   original owner name of the NSEC3 RR.  If a bit is set to 0, it
+   indicates that no RRSet of that type is present for the original
+   owner name of the NSEC3 RR.
+
+
+
+Laurie, et al.              Standards Track                    [Page 10]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Since bit 0 in window block 0 refers to the non-existing RR type 0,
+   it MUST be set to 0.  After verification, the validator MUST ignore
+   the value of bit 0 in window block 0.
+
+   Bits representing Meta-TYPEs or QTYPEs as specified in Section 3.1 of
+   [RFC2929] or within the range reserved for assignment only to QTYPEs
+   and Meta-TYPEs MUST be set to 0, since they do not appear in zone
+   data.  If encountered, they must be ignored upon reading.
+
+   Blocks with no types present MUST NOT be included.  Trailing zero
+   octets in the bitmap MUST be omitted.  The length of the bitmap of
+   each block is determined by the type code with the largest numerical
+   value, within that block, among the set of RR types present at the
+   original owner name of the NSEC3 RR.  Trailing octets not specified
+   MUST be interpreted as zero octets.
+
+3.3.  Presentation Format
+
+   The presentation format of the RDATA portion is as follows:
+
+   o  The Hash Algorithm field is represented as an unsigned decimal
+      integer.  The value has a maximum of 255.
+
+   o  The Flags field is represented as an unsigned decimal integer.
+      The value has a maximum of 255.
+
+   o  The Iterations field is represented as an unsigned decimal
+      integer.  The value is between 0 and 65535, inclusive.
+
+   o  The Salt Length field is not represented.
+
+   o  The Salt field is represented as a sequence of case-insensitive
+      hexadecimal digits.  Whitespace is not allowed within the
+      sequence.  The Salt field is represented as "-" (without the
+      quotes) when the Salt Length field has a value of 0.
+
+   o  The Hash Length field is not represented.
+
+   o  The Next Hashed Owner Name field is represented as an unpadded
+      sequence of case-insensitive base32 digits, without whitespace.
+
+   o  The Type Bit Maps field is represented as a sequence of RR type
+      mnemonics.  When the mnemonic is not known, the TYPE
+      representation as described in Section 5 of [RFC3597] MUST be
+      used.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 11]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.  The NSEC3PARAM Resource Record
+
+   The NSEC3PARAM RR contains the NSEC3 parameters (hash algorithm,
+   flags, iterations, and salt) needed by authoritative servers to
+   calculate hashed owner names.  The presence of an NSEC3PARAM RR at a
+   zone apex indicates that the specified parameters may be used by
+   authoritative servers to choose an appropriate set of NSEC3 RRs for
+   negative responses.  The NSEC3PARAM RR is not used by validators or
+   resolvers.
+
+   If an NSEC3PARAM RR is present at the apex of a zone with a Flags
+   field value of zero, then there MUST be an NSEC3 RR using the same
+   hash algorithm, iterations, and salt parameters present at every
+   hashed owner name in the zone.  That is, the zone MUST contain a
+   complete set of NSEC3 RRs with the same hash algorithm, iterations,
+   and salt parameters.
+
+   The owner name for the NSEC3PARAM RR is the name of the zone apex.
+
+   The type value for the NSEC3PARAM RR is 51.
+
+   The NSEC3PARAM RR RDATA format is class independent and is described
+   below.
+
+   The class MUST be the same as the NSEC3 RRs to which this RR refers.
+
+4.1.  RDATA Fields
+
+   The RDATA for this RR mirrors the first four fields in the NSEC3 RR.
+
+4.1.1.  Hash Algorithm
+
+   The Hash Algorithm field identifies the cryptographic hash algorithm
+   used to construct the hash-value.
+
+   The acceptable values are the same as the corresponding field in the
+   NSEC3 RR.
+
+4.1.2.  Flag Fields
+
+   The Opt-Out flag is not used and is set to zero.
+
+   All other flags are reserved for future use, and must be zero.
+
+   NSEC3PARAM RRs with a Flags field value other than zero MUST be
+   ignored.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 12]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.1.3.  Iterations
+
+   The Iterations field defines the number of additional times the hash
+   is performed.
+
+   Its acceptable values are the same as the corresponding field in the
+   NSEC3 RR.
+
+4.1.4.  Salt Length
+
+   The Salt Length field defines the length of the salt in octets,
+   ranging in value from 0 to 255.
+
+4.1.5.  Salt
+
+   The Salt field is appended to the original owner name before hashing.
+
+4.2.  NSEC3PARAM RDATA Wire Format
+
+   The RDATA of the NSEC3PARAM RR is as shown below:
+
+                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
+    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |   Hash Alg.   |     Flags     |          Iterations           |
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+   |  Salt Length  |                     Salt                      /
+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+   Hash Algorithm is a single octet.
+
+   Flags field is a single octet.
+
+   Iterations is represented as a 16-bit unsigned integer, with the most
+   significant bit first.
+
+   Salt Length is represented as an unsigned octet.  Salt Length
+   represents the length of the following Salt field in octets.  If the
+   value is zero, the Salt field is omitted.
+
+   Salt, if present, is encoded as a sequence of binary octets.  The
+   length of this field is determined by the preceding Salt Length
+   field.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 13]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+4.3.  Presentation Format
+
+   The presentation format of the RDATA portion is as follows:
+
+   o  The Hash Algorithm field is represented as an unsigned decimal
+      integer.  The value has a maximum of 255.
+
+   o  The Flags field is represented as an unsigned decimal integer.
+      The value has a maximum value of 255.
+
+   o  The Iterations field is represented as an unsigned decimal
+      integer.  The value is between 0 and 65535, inclusive.
+
+   o  The Salt Length field is not represented.
+
+   o  The Salt field is represented as a sequence of case-insensitive
+      hexadecimal digits.  Whitespace is not allowed within the
+      sequence.  This field is represented as "-" (without the quotes)
+      when the Salt Length field is zero.
+
+5.  Calculation of the Hash
+
+   The hash calculation uses three of the NSEC3 RDATA fields: Hash
+   Algorithm, Salt, and Iterations.
+
+   Define H(x) to be the hash of x using the Hash Algorithm selected by
+   the NSEC3 RR, k to be the number of Iterations, and || to indicate
+   concatenation.  Then define:
+
+      IH(salt, x, 0) = H(x || salt), and
+
+      IH(salt, x, k) = H(IH(salt, x, k-1) || salt), if k > 0
+
+   Then the calculated hash of an owner name is
+
+      IH(salt, owner name, iterations),
+
+   where the owner name is in the canonical form, defined as:
+
+   The wire format of the owner name where:
+
+   1.  The owner name is fully expanded (no DNS name compression) and
+       fully qualified;
+
+   2.  All uppercase US-ASCII letters are replaced by the corresponding
+       lowercase US-ASCII letters;
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 14]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   3.  If the owner name is a wildcard name, the owner name is in its
+       original unexpanded form, including the "*" label (no wildcard
+       substitution);
+
+   This form is as defined in Section 6.2 of [RFC4034].
+
+   The method to calculate the Hash is based on [RFC2898].
+
+6.  Opt-Out
+
+   In this specification, as in [RFC4033], [RFC4034] and [RFC4035], NS
+   RRSets at delegation points are not signed and may be accompanied by
+   a DS RRSet.  With the Opt-Out bit clear, the security status of the
+   child zone is determined by the presence or absence of this DS RRSet,
+   cryptographically proven by the signed NSEC3 RR at the hashed owner
+   name of the delegation.  Setting the Opt-Out flag modifies this by
+   allowing insecure delegations to exist within the signed zone without
+   a corresponding NSEC3 RR at the hashed owner name of the delegation.
+
+   An Opt-Out NSEC3 RR is said to cover a delegation if the hash of the
+   owner name or "next closer" name of the delegation is between the
+   owner name of the NSEC3 RR and the next hashed owner name.
+
+   An Opt-Out NSEC3 RR does not assert the existence or non-existence of
+   the insecure delegations that it may cover.  This allows for the
+   addition or removal of these delegations without recalculating or re-
+   signing RRs in the NSEC3 RR chain.  However, Opt-Out NSEC3 RRs do
+   assert the (non)existence of other, authoritative RRSets.
+
+   An Opt-Out NSEC3 RR MAY have the same original owner name as an
+   insecure delegation.  In this case, the delegation is proven insecure
+   by the lack of a DS bit in the type map and the signed NSEC3 RR does
+   assert the existence of the delegation.
+
+   Zones using Opt-Out MAY contain a mixture of Opt-Out NSEC3 RRs and
+   non-Opt-Out NSEC3 RRs.  If an NSEC3 RR is not Opt-Out, there MUST NOT
+   be any hashed owner names of insecure delegations (nor any other RRs)
+   between it and the name indicated by the next hashed owner name in
+   the NSEC3 RDATA.  If it is Opt-Out, it MUST only cover hashed owner
+   names or hashed "next closer" names of insecure delegations.
+
+   The effects of the Opt-Out flag on signing, serving, and validating
+   responses are covered in following sections.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 15]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.  Authoritative Server Considerations
+
+7.1.  Zone Signing
+
+   Zones using NSEC3 must satisfy the following properties:
+
+   o  Each owner name within the zone that owns authoritative RRSets
+      MUST have a corresponding NSEC3 RR.  Owner names that correspond
+      to unsigned delegations MAY have a corresponding NSEC3 RR.
+      However, if there is not a corresponding NSEC3 RR, there MUST be
+      an Opt-Out NSEC3 RR that covers the "next closer" name to the
+      delegation.  Other non-authoritative RRs are not represented by
+      NSEC3 RRs.
+
+   o  Each empty non-terminal MUST have a corresponding NSEC3 RR, unless
+      the empty non-terminal is only derived from an insecure delegation
+      covered by an Opt-Out NSEC3 RR.
+
+   o  The TTL value for any NSEC3 RR SHOULD be the same as the minimum
+      TTL value field in the zone SOA RR.
+
+   o  The Type Bit Maps field of every NSEC3 RR in a signed zone MUST
+      indicate the presence of all types present at the original owner
+      name, except for the types solely contributed by an NSEC3 RR
+      itself.  Note that this means that the NSEC3 type itself will
+      never be present in the Type Bit Maps.
+
+   The following steps describe a method of proper construction of NSEC3
+   RRs.  This is not the only such possible method.
+
+   1.  Select the hash algorithm and the values for salt and iterations.
+
+   2.  For each unique original owner name in the zone add an NSEC3 RR.
+
+       *  If Opt-Out is being used, owner names of unsigned delegations
+          MAY be excluded.
+
+       *  The owner name of the NSEC3 RR is the hash of the original
+          owner name, prepended as a single label to the zone name.
+
+       *  The Next Hashed Owner Name field is left blank for the moment.
+
+       *  If Opt-Out is being used, set the Opt-Out bit to one.
+
+       *  For collision detection purposes, optionally keep track of the
+          original owner name with the NSEC3 RR.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 16]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       *  Additionally, for collision detection purposes, optionally
+          create an additional NSEC3 RR corresponding to the original
+          owner name with the asterisk label prepended (i.e., as if a
+          wildcard existed as a child of this owner name) and keep track
+          of this original owner name.  Mark this NSEC3 RR as temporary.
+
+   3.  For each RRSet at the original owner name, set the corresponding
+       bit in the Type Bit Maps field.
+
+   4.  If the difference in number of labels between the apex and the
+       original owner name is greater than 1, additional NSEC3 RRs need
+       to be added for every empty non-terminal between the apex and the
+       original owner name.  This process may generate NSEC3 RRs with
+       duplicate hashed owner names.  Optionally, for collision
+       detection, track the original owner names of these NSEC3 RRs and
+       create temporary NSEC3 RRs for wildcard collisions in a similar
+       fashion to step 1.
+
+   5.  Sort the set of NSEC3 RRs into hash order.
+
+   6.  Combine NSEC3 RRs with identical hashed owner names by replacing
+       them with a single NSEC3 RR with the Type Bit Maps field
+       consisting of the union of the types represented by the set of
+       NSEC3 RRs.  If the original owner name was tracked, then
+       collisions may be detected when combining, as all of the matching
+       NSEC3 RRs should have the same original owner name.  Discard any
+       possible temporary NSEC3 RRs.
+
+   7.  In each NSEC3 RR, insert the next hashed owner name by using the
+       value of the next NSEC3 RR in hash order.  The next hashed owner
+       name of the last NSEC3 RR in the zone contains the value of the
+       hashed owner name of the first NSEC3 RR in the hash order.
+
+   8.  Finally, add an NSEC3PARAM RR with the same Hash Algorithm,
+       Iterations, and Salt fields to the zone apex.
+
+   If a hash collision is detected, then a new salt has to be chosen,
+   and the signing process restarted.
+
+7.2.  Zone Serving
+
+   This specification modifies DNSSEC-enabled DNS responses generated by
+   authoritative servers.  In particular, it replaces the use of NSEC
+   RRs in such responses with NSEC3 RRs.
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 17]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   In the following response cases, the NSEC RRs dictated by DNSSEC
+   [RFC4035] are replaced with NSEC3 RRs that prove the same facts.
+   Responses that would not contain NSEC RRs are unchanged by this
+   specification.
+
+   When returning responses containing multiple NSEC3 RRs, all of the
+   NSEC3 RRs MUST use the same hash algorithm, iteration, and salt
+   values.  The Flags field value MUST be either zero or one.
+
+7.2.1.  Closest Encloser Proof
+
+   For many NSEC3 responses a proof of the closest encloser is required.
+   This is a proof that some ancestor of the QNAME is the closest
+   encloser of QNAME.
+
+   This proof consists of (up to) two different NSEC3 RRs:
+
+   o  An NSEC3 RR that matches the closest (provable) encloser.
+
+   o  An NSEC3 RR that covers the "next closer" name to the closest
+      encloser.
+
+   The first NSEC3 RR essentially proposes a possible closest encloser,
+   and proves that the particular encloser does, in fact, exist.  The
+   second NSEC3 RR proves that the possible closest encloser is the
+   closest, and proves that the QNAME (and any ancestors between QNAME
+   and the closest encloser) does not exist.
+
+   These NSEC3 RRs are collectively referred to as the "closest encloser
+   proof" in the subsequent descriptions.
+
+   For example, the closest encloser proof for the nonexistent
+   "alpha.beta.gamma.example." owner name might prove that
+   "gamma.example." is the closest encloser.  This response would
+   contain the NSEC3 RR that matches "gamma.example.", and would also
+   contain the NSEC3 RR that covers "beta.gamma.example." (which is the
+   "next closer" name).
+
+   It is possible, when using Opt-Out (Section 6), to not be able to
+   prove the actual closest encloser because it is, or is part of an
+   insecure delegation covered by an Opt-Out span.  In this case,
+   instead of proving the actual closest encloser, the closest provable
+   encloser is used.  That is, the closest enclosing authoritative name
+   is used instead.  In this case, the set of NSEC3 RRs used for this
+   proof is referred to as the "closest provable encloser proof".
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 18]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.2.2.  Name Error Responses
+
+   To prove the nonexistence of QNAME, a closest encloser proof and an
+   NSEC3 RR covering the (nonexistent) wildcard RR at the closest
+   encloser MUST be included in the response.  This collection of (up
+   to) three NSEC3 RRs proves both that QNAME does not exist and that a
+   wildcard that could have matched QNAME also does not exist.
+
+   For example, if "gamma.example." is the closest provable encloser to
+   QNAME, then an NSEC3 RR covering "*.gamma.example." is included in
+   the authority section of the response.
+
+7.2.3.  No Data Responses, QTYPE is not DS
+
+   The server MUST include the NSEC3 RR that matches QNAME.  This NSEC3
+   RR MUST NOT have the bits corresponding to either the QTYPE or CNAME
+   set in its Type Bit Maps field.
+
+7.2.4.  No Data Responses, QTYPE is DS
+
+   If there is an NSEC3 RR that matches QNAME, the server MUST return it
+   in the response.  The bits corresponding with DS and CNAME MUST NOT
+   be set in the Type Bit Maps field of this NSEC3 RR.
+
+   If no NSEC3 RR matches QNAME, the server MUST return a closest
+   provable encloser proof for QNAME.  The NSEC3 RR that covers the
+   "next closer" name MUST have the Opt-Out bit set (note that this is
+   true by definition -- if the Opt-Out bit is not set, something has
+   gone wrong).
+
+   If a server is authoritative for both sides of a zone cut at QNAME,
+   the server MUST return the proof from the parent side of the zone
+   cut.
+
+7.2.5.  Wildcard No Data Responses
+
+   If there is a wildcard match for QNAME, but QTYPE is not present at
+   that name, the response MUST include a closest encloser proof for
+   QNAME and MUST include the NSEC3 RR that matches the wildcard.  This
+   combination proves both that QNAME itself does not exist and that a
+   wildcard that matches QNAME does exist.  Note that the closest
+   encloser to QNAME MUST be the immediate ancestor of the wildcard RR
+   (if this is not the case, then something has gone wrong).
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 19]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+7.2.6.  Wildcard Answer Responses
+
+   If there is a wildcard match for QNAME and QTYPE, then, in addition
+   to the expanded wildcard RRSet returned in the answer section of the
+   response, proof that the wildcard match was valid must be returned.
+
+   This proof is accomplished by proving that both QNAME does not exist
+   and that the closest encloser of the QNAME and the immediate ancestor
+   of the wildcard are the same (i.e., the correct wildcard matched).
+
+   To this end, the NSEC3 RR that covers the "next closer" name of the
+   immediate ancestor of the wildcard MUST be returned.  It is not
+   necessary to return an NSEC3 RR that matches the closest encloser, as
+   the existence of this closest encloser is proven by the presence of
+   the expanded wildcard in the response.
+
+7.2.7.  Referrals to Unsigned Subzones
+
+   If there is an NSEC3 RR that matches the delegation name, then that
+   NSEC3 RR MUST be included in the response.  The DS bit in the type
+   bit maps of the NSEC3 RR MUST NOT be set.
+
+   If the zone is Opt-Out, then there may not be an NSEC3 RR
+   corresponding to the delegation.  In this case, the closest provable
+   encloser proof MUST be included in the response.  The included NSEC3
+   RR that covers the "next closer" name for the delegation MUST have
+   the Opt-Out flag set to one.  (Note that this will be the case unless
+   something has gone wrong).
+
+7.2.8.  Responding to Queries for NSEC3 Owner Names
+
+   The owner names of NSEC3 RRs are not represented in the NSEC3 RR
+   chain like other owner names.  As a result, each NSEC3 owner name is
+   covered by another NSEC3 RR, effectively negating the existence of
+   the NSEC3 RR.  This is a paradox, since the existence of an NSEC3 RR
+   can be proven by its RRSIG RRSet.
+
+   If the following conditions are all true:
+
+   o  the QNAME equals the owner name of an existing NSEC3 RR, and
+
+   o  no RR types exist at the QNAME, nor at any descendant of QNAME,
+
+   then the response MUST be constructed as a Name Error response
+   (Section 7.2.2).  Or, in other words, the authoritative name server
+   will act as if the owner name of the NSEC3 RR did not exist.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 20]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Note that NSEC3 RRs are returned as a result of an AXFR or IXFR
+   query.
+
+7.2.9.  Server Response to a Run-Time Collision
+
+   If the hash of a non-existing QNAME collides with the owner name of
+   an existing NSEC3 RR, then the server will be unable to return a
+   response that proves that QNAME does not exist.  In this case, the
+   server MUST return a response with an RCODE of 2 (server failure).
+
+   Note that with the hash algorithm specified in this document, SHA-1,
+   such collisions are highly unlikely.
+
+7.3.  Secondary Servers
+
+   Secondary servers (and perhaps other entities) need to reliably
+   determine which NSEC3 parameters (i.e., hash, salt, and iterations)
+   are present at every hashed owner name, in order to be able to choose
+   an appropriate set of NSEC3 RRs for negative responses.  This is
+   indicated by an NSEC3PARAM RR present at the zone apex.
+
+   If there are multiple NSEC3PARAM RRs present, there are multiple
+   valid NSEC3 chains present.  The server must choose one of them, but
+   may use any criteria to do so.
+
+7.4.  Zones Using Unknown Hash Algorithms
+
+   Zones that are signed according to this specification, but are using
+   an unrecognized NSEC3 hash algorithm value, cannot be effectively
+   served.  Such zones SHOULD be rejected when loading.  Servers SHOULD
+   respond with RCODE=2 (server failure) responses when handling queries
+   that would fall under such zones.
+
+7.5.  Dynamic Update
+
+   A zone signed using NSEC3 may accept dynamic updates [RFC2136].
+   However, NSEC3 introduces some special considerations for dynamic
+   updates.
+
+   Adding and removing names in a zone MUST account for the creation or
+   removal of empty non-terminals.
+
+   o  When removing a name with a corresponding NSEC3 RR, any NSEC3 RRs
+      corresponding to empty non-terminals created by that name MUST be
+      removed.  Note that more than one name may be asserting the
+      existence of a particular empty non-terminal.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 21]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   o  When adding a name that requires adding an NSEC3 RR, NSEC3 RRs
+      MUST also be added for any empty non-terminals that are created.
+      That is, if there is not an existing NSEC3 RR matching an empty
+      non-terminal, it must be created and added.
+
+   The presence of Opt-Out in a zone means that some additions or
+   delegations of names will not require changes to the NSEC3 RRs in a
+   zone.
+
+   o  When removing a delegation RRSet, if that delegation does not have
+      a matching NSEC3 RR, then it was opted out.  In this case, nothing
+      further needs to be done.
+
+   o  When adding a delegation RRSet, if the "next closer" name of the
+      delegation is covered by an existing Opt-Out NSEC3 RR, then the
+      delegation MAY be added without modifying the NSEC3 RRs in the
+      zone.
+
+   The presence of Opt-Out in a zone means that when adding or removing
+   NSEC3 RRs, the value of the Opt-Out flag that should be set in new or
+   modified NSEC3 RRs is ambiguous.  Servers SHOULD follow this set of
+   basic rules to resolve the ambiguity.
+
+   The central concept to these rules is that the state of the Opt-Out
+   flag of the covering NSEC3 RR is preserved.
+
+   o  When removing an NSEC3 RR, the value of the Opt-Out flag for the
+      previous NSEC3 RR (the one whose next hashed owner name is
+      modified) should not be changed.
+
+   o  When adding an NSEC3 RR, the value of the Opt-Out flag is set to
+      the value of the Opt-Out flag of the NSEC3 RR that previously
+      covered the owner name of the NSEC3 RR.  That is, the now previous
+      NSEC3 RR.
+
+   If the zone in question is consistent with its use of the Opt-Out
+   flag (that is, all NSEC3 RRs in the zone have the same value for the
+   flag) then these rules will retain that consistency.  If the zone is
+   not consistent in the use of the flag (i.e., a partially Opt-Out
+   zone), then these rules will not retain the same pattern of use of
+   the Opt-Out flag.
+
+   For zones that partially use the Opt-Out flag, if there is a logical
+   pattern for that use, the pattern could be maintained by using a
+   local policy on the server.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 22]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+8.  Validator Considerations
+
+8.1.  Responses with Unknown Hash Types
+
+   A validator MUST ignore NSEC3 RRs with unknown hash types.  The
+   practical result of this is that responses containing only such NSEC3
+   RRs will generally be considered bogus.
+
+8.2.  Verifying NSEC3 RRs
+
+   A validator MUST ignore NSEC3 RRs with a Flag fields value other than
+   zero or one.
+
+   A validator MAY treat a response as bogus if the response contains
+   NSEC3 RRs that contain different values for hash algorithm,
+   iterations, or salt from each other for that zone.
+
+8.3.  Closest Encloser Proof
+
+   In order to verify a closest encloser proof, the validator MUST find
+   the longest name, X, such that
+
+   o  X is an ancestor of QNAME that is matched by an NSEC3 RR present
+      in the response.  This is a candidate for the closest encloser,
+      and
+
+   o  The name one label longer than X (but still an ancestor of -- or
+      equal to -- QNAME) is covered by an NSEC3 RR present in the
+      response.
+
+   One possible algorithm for verifying this proof is as follows:
+
+   1.  Set SNAME=QNAME.  Clear the flag.
+
+   2.  Check whether SNAME exists:
+
+       *  If there is no NSEC3 RR in the response that matches SNAME
+          (i.e., an NSEC3 RR whose owner name is the same as the hash of
+          SNAME, prepended as a single label to the zone name), clear
+          the flag.
+
+       *  If there is an NSEC3 RR in the response that covers SNAME, set
+          the flag.
+
+       *  If there is a matching NSEC3 RR in the response and the flag
+          was set, then the proof is complete, and SNAME is the closest
+          encloser.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 23]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+       *  If there is a matching NSEC3 RR in the response, but the flag
+          is not set, then the response is bogus.
+
+   3.  Truncate SNAME by one label from the left, go to step 2.
+
+   Once the closest encloser has been discovered, the validator MUST
+   check that the NSEC3 RR that has the closest encloser as the original
+   owner name is from the proper zone.  The DNAME type bit must not be
+   set and the NS type bit may only be set if the SOA type bit is set.
+   If this is not the case, it would be an indication that an attacker
+   is using them to falsely deny the existence of RRs for which the
+   server is not authoritative.
+
+   In the following descriptions, the phrase "a closest (provable)
+   encloser proof for X" means that the algorithm above (or an
+   equivalent algorithm) proves that X does not exist by proving that an
+   ancestor of X is its closest encloser.
+
+8.4.  Validating Name Error Responses
+
+   A validator MUST verify that there is a closest encloser proof for
+   QNAME present in the response and that there is an NSEC3 RR that
+   covers the wildcard at the closest encloser (i.e., the name formed by
+   prepending the asterisk label to the closest encloser).
+
+8.5.  Validating No Data Responses, QTYPE is not DS
+
+   The validator MUST verify that an NSEC3 RR that matches QNAME is
+   present and that both the QTYPE and the CNAME type are not set in its
+   Type Bit Maps field.
+
+   Note that this test also covers the case where the NSEC3 RR exists
+   because it corresponds to an empty non-terminal, in which case the
+   NSEC3 RR will have an empty Type Bit Maps field.
+
+8.6.  Validating No Data Responses, QTYPE is DS
+
+   If there is an NSEC3 RR that matches QNAME present in the response,
+   then that NSEC3 RR MUST NOT have the bits corresponding to DS and
+   CNAME set in its Type Bit Maps field.
+
+   If there is no such NSEC3 RR, then the validator MUST verify that a
+   closest provable encloser proof for QNAME is present in the response,
+   and that the NSEC3 RR that covers the "next closer" name has the Opt-
+   Out bit set.
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 24]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+8.7.  Validating Wildcard No Data Responses
+
+   The validator MUST verify a closest encloser proof for QNAME and MUST
+   find an NSEC3 RR present in the response that matches the wildcard
+   name generated by prepending the asterisk label to the closest
+   encloser.  Furthermore, the bits corresponding to both QTYPE and
+   CNAME MUST NOT be set in the wildcard matching NSEC3 RR.
+
+8.8.  Validating Wildcard Answer Responses
+
+   The verified wildcard answer RRSet in the response provides the
+   validator with a (candidate) closest encloser for QNAME.  This
+   closest encloser is the immediate ancestor to the generating
+   wildcard.
+
+   Validators MUST verify that there is an NSEC3 RR that covers the
+   "next closer" name to QNAME present in the response.  This proves
+   that QNAME itself did not exist and that the correct wildcard was
+   used to generate the response.
+
+8.9.  Validating Referrals to Unsigned Subzones
+
+   The delegation name in a referral is the owner name of the NS RRSet
+   present in the authority section of the referral response.
+
+   If there is an NSEC3 RR present in the response that matches the
+   delegation name, then the validator MUST ensure that the NS bit is
+   set and that the DS bit is not set in the Type Bit Maps field of the
+   NSEC3 RR.  The validator MUST also ensure that the NSEC3 RR is from
+   the correct (i.e., parent) zone.  This is done by ensuring that the
+   SOA bit is not set in the Type Bit Maps field of this NSEC3 RR.
+
+   Note that the presence of an NS bit implies the absence of a DNAME
+   bit, so there is no need to check for the DNAME bit in the Type Bit
+   Maps field of the NSEC3 RR.
+
+   If there is no NSEC3 RR present that matches the delegation name,
+   then the validator MUST verify a closest provable encloser proof for
+   the delegation name.  The validator MUST verify that the Opt-Out bit
+   is set in the NSEC3 RR that covers the "next closer" name to the
+   delegation name.
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 25]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+9.  Resolver Considerations
+
+9.1.  NSEC3 Resource Record Caching
+
+   Caching resolvers MUST be able to retrieve the appropriate NSEC3 RRs
+   when returning responses that contain them.  In DNSSEC [RFC4035], in
+   many cases it is possible to find the correct NSEC RR to return in a
+   response by name (e.g., when returning a referral, the NSEC RR will
+   always have the same owner name as the delegation).  With this
+   specification, that will not be true, nor will a cache be able to
+   calculate the name(s) of the appropriate NSEC3 RR(s).
+   Implementations may need to use new methods for caching and
+   retrieving NSEC3 RRs.
+
+9.2.  Use of the AD Bit
+
+   The AD bit, as defined by [RFC4035], MUST NOT be set when returning a
+   response containing a closest (provable) encloser proof in which the
+   NSEC3 RR that covers the "next closer" name has the Opt-Out bit set.
+
+   This rule is based on what this closest encloser proof actually
+   proves: names that would be covered by the Opt-Out NSEC3 RR may or
+   may not exist as insecure delegations.  As such, not all the data in
+   responses containing such closest encloser proofs will have been
+   cryptographically verified, so the AD bit cannot be set.
+
+10.  Special Considerations
+
+10.1.  Domain Name Length Restrictions
+
+   Zones signed using this specification have additional domain name
+   length restrictions imposed upon them.  In particular, zones with
+   names that, when converted into hashed owner names exceed the 255
+   octet length limit imposed by [RFC1035], cannot use this
+   specification.
+
+   The actual maximum length of a domain name in a particular zone
+   depends on both the length of the zone name (versus the whole domain
+   name) and the particular hash function used.
+
+   As an example, SHA-1 produces a hash of 160 bits.  The base-32
+   encoding of 160 bits results in 32 characters.  The 32 characters are
+   prepended to the name of the zone as a single label, which includes a
+   length field of a single octet.  The maximum length of the zone name,
+   when using SHA-1, is 222 octets (255 - 33).
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 26]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+10.2.  DNAME at the Zone Apex
+
+   The DNAME specification in Section 3 of [RFC2672] has a 'no-
+   descendants' limitation.  If a DNAME RR is present at node N, there
+   MUST be no data at any descendant of N.
+
+   If N is the apex of the zone, there will be NSEC3 and RRSIG types
+   present at descendants of N.  This specification updates the DNAME
+   specification to allow NSEC3 and RRSIG types at descendants of the
+   apex regardless of the existence of DNAME at the apex.
+
+10.3.  Iterations
+
+   Setting the number of iterations used allows the zone owner to choose
+   the cost of computing a hash, and therefore the cost of generating a
+   dictionary.  Note that this is distinct from the effect of salt,
+   which prevents the use of a single precomputed dictionary for all
+   time.
+
+   Obviously the number of iterations also affects the zone owner's cost
+   of signing and serving the zone as well as the validator's cost of
+   verifying responses from the zone.  We therefore impose an upper
+   limit on the number of iterations.  We base this on the number of
+   iterations that approximates the cost of verifying an RRSet.
+
+   The limits, therefore, are based on the size of the smallest zone
+   signing key, rounded up to the nearest table value (or rounded down
+   if the key is larger than the largest table value).
+
+   A zone owner MUST NOT use a value higher than shown in the table
+   below for iterations for the given key size.  A resolver MAY treat a
+   response with a higher value as insecure, after the validator has
+   verified that the signature over the NSEC3 RR is correct.
+
+                         +----------+------------+
+                         | Key Size | Iterations |
+                         +----------+------------+
+                         | 1024     | 150        |
+                         | 2048     | 500        |
+                         | 4096     | 2,500      |
+                         +----------+------------+
+
+   This table is based on an approximation of the ratio between the cost
+   of an SHA-1 calculation and the cost of an RSA verification for keys
+   of size 1024 bits (150 to 1), 2048 bits (500 to 1), and 4096 bits
+   (2500 to 1).
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 27]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   The ratio between SHA-1 calculation and DSA verification is higher
+   (1500 to 1 for keys of size 1024).  A higher iteration count degrades
+   performance, while DSA verification is already more expensive than
+   RSA for the same key size.  Therefore the values in the table MUST be
+   used independent of the key algorithm.
+
+10.4.  Transitioning a Signed Zone from NSEC to NSEC3
+
+   When transitioning an already signed and trusted zone to this
+   specification, care must be taken to prevent client validation
+   failures during the process.
+
+   The basic procedure is as follows:
+
+   1.  Transition all DNSKEYs to DNSKEYs using the algorithm aliases
+       described in Section 2.  The actual method for safely and
+       securely changing the DNSKEY RRSet of the zone is outside the
+       scope of this specification.  However, the end result MUST be
+       that all DS RRs in the parent use the specified algorithm
+       aliases.
+
+       After this transition is complete, all NSEC3-unaware clients will
+       treat the zone as insecure.  At this point, the authoritative
+       server still returns negative and wildcard responses that contain
+       NSEC RRs.
+
+   2.  Add signed NSEC3 RRs to the zone, either incrementally or all at
+       once.  If adding incrementally, then the last RRSet added MUST be
+       the NSEC3PARAM RRSet.
+
+   3.  Upon the addition of the NSEC3PARAM RRSet, the server switches to
+       serving negative and wildcard responses with NSEC3 RRs according
+       to this specification.
+
+   4.  Remove the NSEC RRs either incrementally or all at once.
+
+10.5.  Transitioning a Signed Zone from NSEC3 to NSEC
+
+   To safely transition back to a DNSSEC [RFC4035] signed zone, simply
+   reverse the procedure above:
+
+   1.  Add NSEC RRs incrementally or all at once.
+
+   2.  Remove the NSEC3PARAM RRSet.  This will signal the server to use
+       the NSEC RRs for negative and wildcard responses.
+
+   3.  Remove the NSEC3 RRs either incrementally or all at once.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 28]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   4.  Transition all of the DNSKEYs to DNSSEC algorithm identifiers.
+       After this transition is complete, all NSEC3-unaware clients will
+       treat the zone as secure.
+
+11.  IANA Considerations
+
+   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm
+   parameter, this document does not define a particular mechanism for
+   safely transitioning from one NSEC3 hash algorithm to another.  When
+   specifying a new hash algorithm for use with NSEC3, a transition
+   mechanism MUST also be defined.
+
+   This document updates the IANA registry "DOMAIN NAME SYSTEM
+   PARAMETERS" (http://www.iana.org/assignments/dns-parameters) in sub-
+   registry "TYPES", by defining two new types.  Section 3 defines the
+   NSEC3 RR type 50.  Section 4 defines the NSEC3PARAM RR type 51.
+
+   This document updates the IANA registry "DNS SECURITY ALGORITHM
+   NUMBERS -- per [RFC4035]"
+   (http://www.iana.org/assignments/dns-sec-alg-numbers).  Section 2
+   defines the aliases DSA-NSEC3-SHA1 (6) and RSASHA1-NSEC3-SHA1 (7) for
+   respectively existing registrations DSA and RSASHA1 in combination
+   with NSEC3 hash algorithm SHA1.
+
+   Since these algorithm numbers are aliases for existing DNSKEY
+   algorithm numbers, the flags that exist for the original algorithm
+   are valid for the alias algorithm.
+
+   This document creates a new IANA registry for NSEC3 flags.  This
+   registry is named "DNSSEC NSEC3 Flags".  The initial contents of this
+   registry are:
+
+     0   1   2   3   4   5   6   7
+   +---+---+---+---+---+---+---+---+
+   |   |   |   |   |   |   |   |Opt|
+   |   |   |   |   |   |   |   |Out|
+   +---+---+---+---+---+---+---+---+
+
+      bit 7 is the Opt-Out flag.
+
+      bits 0 - 6 are available for assignment.
+
+   Assignment of additional NSEC3 Flags in this registry requires IETF
+   Standards Action [RFC2434].
+
+   This document creates a new IANA registry for NSEC3PARAM flags.  This
+   registry is named "DNSSEC NSEC3PARAM Flags".  The initial contents of
+   this registry are:
+
+
+
+Laurie, et al.              Standards Track                    [Page 29]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+     0   1   2   3   4   5   6   7
+   +---+---+---+---+---+---+---+---+
+   |   |   |   |   |   |   |   | 0 |
+   +---+---+---+---+---+---+---+---+
+
+      bit 7 is reserved and must be 0.
+
+      bits 0 - 6 are available for assignment.
+
+   Assignment of additional NSEC3PARAM Flags in this registry requires
+   IETF Standards Action [RFC2434].
+
+   Finally, this document creates a new IANA registry for NSEC3 hash
+   algorithms.  This registry is named "DNSSEC NSEC3 Hash Algorithms".
+   The initial contents of this registry are:
+
+      0 is Reserved.
+
+      1 is SHA-1.
+
+      2-255 Available for assignment.
+
+   Assignment of additional NSEC3 hash algorithms in this registry
+   requires IETF Standards Action [RFC2434].
+
+12.  Security Considerations
+
+12.1.  Hashing Considerations
+
+12.1.1.  Dictionary Attacks
+
+   The NSEC3 RRs are still susceptible to dictionary attacks (i.e., the
+   attacker retrieves all the NSEC3 RRs, then calculates the hashes of
+   all likely domain names, comparing against the hashes found in the
+   NSEC3 RRs, and thus enumerating the zone).  These are substantially
+   more expensive than enumerating the original NSEC RRs would have
+   been, and in any case, such an attack could also be used directly
+   against the name server itself by performing queries for all likely
+   names, though this would obviously be more detectable.  The expense
+   of this off-line attack can be chosen by setting the number of
+   iterations in the NSEC3 RR.
+
+   Zones are also susceptible to a pre-calculated dictionary attack --
+   that is, a list of hashes for all likely names is computed once, then
+   NSEC3 RR is scanned periodically and compared against the precomputed
+   hashes.  This attack is prevented by changing the salt on a regular
+   basis.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 30]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   The salt SHOULD be at least 64 bits long and unpredictable, so that
+   an attacker cannot anticipate the value of the salt and compute the
+   next set of dictionaries before the zone is published.
+
+12.1.2.  Collisions
+
+   Hash collisions between QNAME and the owner name of an NSEC3 RR may
+   occur.  When they do, it will be impossible to prove the non-
+   existence of the colliding QNAME.  However, with SHA-1, this is
+   highly unlikely (on the order of 1 in 2^160).  Note that DNSSEC
+   already relies on the presumption that a cryptographic hash function
+   is second pre-image resistant, since these hash functions are used
+   for generating and validating signatures and DS RRs.
+
+12.1.3.  Transitioning to a New Hash Algorithm
+
+   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm
+   parameter, this document does not define a particular mechanism for
+   safely transitioning from one NSEC3 hash algorithm to another.  When
+   specifying a new hash algorithm for use with NSEC3, a transition
+   mechanism MUST also be defined.  It is possible that the only
+   practical and palatable transition mechanisms may require an
+   intermediate transition to an insecure state, or to a state that uses
+   NSEC records instead of NSEC3.
+
+12.1.4.  Using High Iteration Values
+
+   Since validators should treat responses containing NSEC3 RRs with
+   high iteration values as insecure, presence of just one signed NSEC3
+   RR with a high iteration value in a zone provides attackers with a
+   possible downgrade attack.
+
+   The attack is simply to remove any existing NSEC3 RRs from a
+   response, and replace or add a single (or multiple) NSEC3 RR that
+   uses a high iterations value to the response.  Validators will then
+   be forced to treat the response as insecure.  This attack would be
+   effective only when all of following conditions are met:
+
+   o  There is at least one signed NSEC3 RR that uses a high iterations
+      value present in the zone.
+
+   o  The attacker has access to one or more of these NSEC3 RRs.  This
+      is trivially true when the NSEC3 RRs with high iteration values
+      are being returned in typical responses, but may also be true if
+      the attacker can access the zone via AXFR or IXFR queries, or any
+      other methodology.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 31]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   Using a high number of iterations also introduces an additional
+   denial-of-service opportunity against servers, since servers must
+   calculate several hashes per negative or wildcard response.
+
+12.2.  Opt-Out Considerations
+
+   The Opt-Out Flag (O) allows for unsigned names, in the form of
+   delegations to unsigned zones, to exist within an otherwise signed
+   zone.  All unsigned names are, by definition, insecure, and their
+   validity or existence cannot be cryptographically proven.
+
+   In general:
+
+   o  Resource records with unsigned names (whether existing or not)
+      suffer from the same vulnerabilities as RRs in an unsigned zone.
+      These vulnerabilities are described in more detail in [RFC3833]
+      (note in particular Section 2.3, "Name Chaining" and Section 2.6,
+      "Authenticated Denial of Domain Names").
+
+   o  Resource records with signed names have the same security whether
+      or not Opt-Out is used.
+
+   Note that with or without Opt-Out, an insecure delegation may be
+   undetectably altered by an attacker.  Because of this, the primary
+   difference in security when using Opt-Out is the loss of the ability
+   to prove the existence or nonexistence of an insecure delegation
+   within the span of an Opt-Out NSEC3 RR.
+
+   In particular, this means that a malicious entity may be able to
+   insert or delete RRs with unsigned names.  These RRs are normally NS
+   RRs, but this also includes signed wildcard expansions (while the
+   wildcard RR itself is signed, its expanded name is an unsigned name).
+
+   Note that being able to add a delegation is functionally equivalent
+   to being able to add any RR type: an attacker merely has to forge a
+   delegation to name server under his/her control and place whatever
+   RRs needed at the subzone apex.
+
+   While in particular cases, this issue may not present a significant
+   security problem, in general it should not be lightly dismissed.
+   Therefore, it is strongly RECOMMENDED that Opt-Out be used sparingly.
+   In particular, zone signing tools SHOULD NOT default to using Opt-
+   Out, and MAY choose to not support Opt-Out at all.
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 32]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+12.3.  Other Considerations
+
+   Walking the NSEC3 RRs will reveal the total number of RRs in the zone
+   (plus empty non-terminals), and also what types there are.  This
+   could be mitigated by adding dummy entries, but certainly an upper
+   limit can always be found.
+
+13.  References
+
+13.1.  Normative References
+
+   [RFC1034]         Mockapetris, P., "Domain names - concepts and
+                     facilities", STD 13, RFC 1034, November 1987.
+
+   [RFC1035]         Mockapetris, P., "Domain names - implementation and
+                     specification", STD 13, RFC 1035, November 1987.
+
+   [RFC2119]         Bradner, S., "Key words for use in RFCs to Indicate
+                     Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC2136]         Vixie, P., Thomson, S., Rekhter, Y., and J. Bound,
+                     "Dynamic Updates in the Domain Name System (DNS
+                     UPDATE)", RFC 2136, April 1997.
+
+   [RFC2181]         Elz, R. and R. Bush, "Clarifications to the DNS
+                     Specification", RFC 2181, July 1997.
+
+   [RFC2308]         Andrews, M., "Negative Caching of DNS Queries (DNS
+                     NCACHE)", RFC 2308, March 1998.
+
+   [RFC2434]         Narten, T. and H. Alvestrand, "Guidelines for
+                     Writing an IANA Considerations Section in RFCs",
+                     BCP 26, RFC 2434, October 1998.
+
+   [RFC2929]         Eastlake, D., Brunner-Williams, E., and B. Manning,
+                     "Domain Name System (DNS) IANA Considerations",
+                     BCP 42, RFC 2929, September 2000.
+
+   [RFC3597]         Gustafsson, A., "Handling of Unknown DNS Resource
+                     Record (RR) Types", RFC 3597, September 2003.
+
+   [RFC4033]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "DNS Security Introduction and
+                     Requirements", RFC 4033, March 2005.
+
+   [RFC4034]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "Resource Records for the DNS Security
+                     Extensions", RFC 4034, March 2005.
+
+
+
+Laurie, et al.              Standards Track                    [Page 33]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   [RFC4035]         Arends, R., Austein, R., Larson, M., Massey, D.,
+                     and S. Rose, "Protocol Modifications for the DNS
+                     Security Extensions", RFC 4035, March 2005.
+
+   [RFC4648]         Josefsson, S., "The Base16, Base32, and Base64 Data
+                     Encodings", RFC 4648, October 2006.
+
+13.2.  Informative References
+
+   [DNSEXT-NO]       Josefsson, S., "Authenticating Denial of Existence
+                     in DNS with Minimum Disclosure", Work in Progress,
+                     July 2000.
+
+   [DNSEXT-NSEC2v2]  Laurie, B., "DNSSEC NSEC2 Owner and RDATA Format",
+                     Work in Progress, December 2004.
+
+   [RFC2672]         Crawford, M., "Non-Terminal DNS Name Redirection",
+                     RFC 2672, August 1999.
+
+   [RFC2898]         Kaliski, B., "PKCS #5: Password-Based Cryptography
+                     Specification Version 2.0", RFC 2898,
+                     September 2000.
+
+   [RFC3833]         Atkins, D. and R. Austein, "Threat Analysis of the
+                     Domain Name System (DNS)", RFC 3833, August 2004.
+
+   [RFC4592]         Lewis, E., "The Role of Wildcards in the Domain
+                     Name System", RFC 4592, July 2006.
+
+   [RFC4956]         Arends, R., Kosters, M., and D. Blacka, "DNS
+                     Security (DNSSEC) Opt-In", RFC 4956, July 2007.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 34]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Appendix A.  Example Zone
+
+   This is a zone showing its NSEC3 RRs.  They can also be used as test
+   vectors for the hash algorithm.
+
+   The overall TTL and class are specified in the SOA RR, and are
+   subsequently omitted for clarity.
+
+   The zone is preceded by a list that contains the hashes of the
+   original ownernames.
+
+   ; H(example)       = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
+   ; H(a.example)     = 35mthgpgcu1qg68fab165klnsnk3dpvl
+   ; H(ai.example)    = gjeqe526plbf1g8mklp59enfd789njgi
+   ; H(ns1.example)   = 2t7b4g4vsa5smi47k61mv5bv1a22bojr
+   ; H(ns2.example)   = q04jkcevqvmu85r014c7dkba38o0ji5r
+   ; H(w.example)     = k8udemvp1j2f7eg6jebps17vp3n8i58h
+   ; H(*.w.example)   = r53bq7cc2uvmubfu5ocmm6pers9tk9en
+   ; H(x.w.example)   = b4um86eghhds6nea196smvmlo4ors995
+   ; H(y.w.example)   = ji6neoaepv8b5o6k4ev33abha8ht9fgc
+   ; H(x.y.w.example) = 2vptu5timamqttgl4luu9kg21e0aor3s
+   ; H(xx.example)    = t644ebqk9bibcna874givr6joj62mlhv
+   ; H(2t7b4g4vsa5smi47k61mv5bv1a22bojr.example)
+   ;                  = kohar7mbb8dc2ce8a9qvl8hon4k53uhi
+   example. 3600  IN SOA  ns1.example. bugs.x.w.example. 1 3600 300 (
+                          3600000 3600 )
+                  RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                          q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                          VI2LmKusbZsT0Q== )
+                  NS      ns1.example.
+                  NS      ns2.example.
+                  RRSIG   NS 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ
+                          qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv
+                          CnMXjtz6SyObxA== )
+                  MX      1 xx.example.
+                  RRSIG   MX 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          GgQ1A9xs47k42VPvpL/a1BWUz/6XsnHkjotw
+                          9So8MQtZtl2wJBsnOQsaoHrRCrRbyriEl/GZ
+                          n9Mto/Kx+wBo+w== )
+                  DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU (
+                          sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h
+                          TY4hHn9npWFRw5BYubE= )
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 35]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ (
+                          j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9
+                          AbsUdblMFin8CVF3n4s= )
+                  RRSIG   DNSKEY 7 1 3600 20150420235959 (
+                          20051021000000 12708 example.
+                          AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31
+                          uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm
+                          MGQZf3bH+QsCtg== )
+                  NSEC3PARAM 1 0 12 aabbccdd
+                  RRSIG   NSEC3PARAM 7 1 3600 20150420235959 (
+                          20051021000000 40430 example.
+                          C1Gl8tPZNtnjlrYWDeeUV/sGLCyy/IHie2re
+                          rN05XSA3Pq0U3+4VvGWYWdUMfflOdxqnXHwJ
+                          TLQsjlkynhG6Cg== )
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                          2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                          SOA NSEC3PARAM RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                          IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                          BOCXJZMnpuwhpA== )
+   2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. A 192.0.2.127
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          h6c++bzhRuWWt2bykN6mjaTNBcXNq5UuL5Ed
+                          K+iDP4eY8I0kSiKaCjg3tC1SQkeloMeub2GW
+                          k8p6xHMPZumXlw== )
+                  NSEC3   1 1 12 aabbccdd (
+                          2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN
+                          4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq
+                          NI6mRk/r1dOSUw== )
+   2vptu5timamqttgl4luu9kg21e0aor3s.example. NSEC3 1 1 12 aabbccdd (
+                          35mthgpgcu1qg68fab165klnsnk3dpvl MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          KL1V2oFYghNV0Hm7Tf2vpJjM6l+0g1JCcVYG
+                          VfI0lKrhPmTsOA96cLEACgo1x8I7kApJX+ob
+                          TuktZ+sdsZPY1w== )
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                          b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 36]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                          Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                          XtAIR3chwgW+SA== )
+   a.example.     NS      ns1.a.example.
+                  NS      ns2.a.example.
+                  DS      58470 5 1 (
+                          3079F1593EBAD6DC121E202A8B766A6A4837206C )
+                  RRSIG   DS 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          XacFcQVHLVzdoc45EJhN616zQ4mEXtE8FzUh
+                          M2KWjfy1VfRKD9r1MeVGwwoukOKgJxBPFsWo
+                          o722vZ4UZ2dIdA== )
+   ns1.a.example. A       192.0.2.5
+   ns2.a.example. A       192.0.2.6
+   ai.example.    A       192.0.2.9
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F
+                          tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+
+                          rznEn8sQ64UdqA== )
+                  HINFO   "KLH-10" "ITS"
+                  RRSIG   HINFO 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Yi42uOq43eyO6qXHNvwwfFnIustWgV5urFcx
+                          enkLvs6pKRh00VBjODmf3Z4nMO7IOl6nHSQ1
+                          v0wLHpEZG7Xj2w== )
+                  AAAA    2001:db8:0:0:0:0:f00:baa9
+                  RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W
+                          uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG
+                          cHueLuXkMjBArQ== )
+   b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
+                          gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh
+                          5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3
+                          pOv0TSTyiTxIZg== )
+   c.example.     NS      ns1.c.example.
+                  NS      ns2.c.example.
+   ns1.c.example. A       192.0.2.7
+   ns2.c.example. A       192.0.2.8
+   gjeqe526plbf1g8mklp59enfd789njgi.example. NSEC3 1 1 12 aabbccdd (
+                          ji6neoaepv8b5o6k4ev33abha8ht9fgc HINFO A AAAA
+                          RRSIG )
+
+
+
+Laurie, et al.              Standards Track                    [Page 37]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IVnezTJ9iqblFF97vPSmfXZ5Zozngx3KX3by
+                          LTZC4QBH2dFWhf6scrGFZB980AfCxoD9qbbK
+                          Dy+rdGIeRSVNyw== )
+   ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
+                          k8udemvp1j2f7eg6jebps17vp3n8i58h )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7
+                          2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0
+                          MpzVSKfTwx4uYA== )
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
+                          kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK
+                          S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt
+                          Otx7w9WfcIg62A== )
+   kohar7mbb8dc2ce8a9qvl8hon4k53uhi.example. NSEC3 1 1 12 aabbccdd (
+                          q04jkcevqvmu85r014c7dkba38o0ji5r A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          VrDXs2uVW21N08SyQIz88zml+y4ZCInTwgDr
+                          6zz43yAg+LFERjOrj3Ojct51ac7Dp4eZbf9F
+                          QJazmASFKGxGXg== )
+   ns1.example.   A       192.0.2.1
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          bu6kx73n6XEunoVGuRfAgY7EF/AJqHy7hj0j
+                          kiqJjB0dOrx3wuz9SaBeGfqWIdn/uta3SavN
+                          4FRvZR9SCFHF5Q== )
+   ns2.example.   A       192.0.2.2
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          ktQ3TqE0CfRfki0Rb/Ip5BM0VnxelbuejCC4
+                          zpLbFKA/7eD7UNAwxMgxJPtbdST+syjYSJaj
+                          4IHfeX6n8vfoGA== )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 38]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
+                          t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C
+                          ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+
+                          HF1FWKW7RIJdtQ== )
+   t644ebqk9bibcna874givr6joj62mlhv.example. NSEC3 1 1 12 aabbccdd (
+                          0p9mhaveqvm6t7vbl5lop2u3t2rp3tom HINFO A AAAA
+                          RRSIG )
+                  RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          RAjGECB8P7O+F4Pa4Dx3tC0M+Z3KmlLKImca
+                          fb9XWwx+NWUNz7NBEDBQHivIyKPVDkChcePI
+                          X1xPl1ATNa+8Dw== )
+   *.w.example.   MX      1 ai.example.
+                  RRSIG   MX 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb
+                          9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM
+                          ivEBP6+4KS3ldA== )
+   x.w.example.   MX      1 xx.example.
+                  RRSIG   MX 7 3 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IrK3tq/tHFIBF0scHiE/1IwMAvckS/55hAVv
+                          QyxTFbkAdDloP3NbZzu+yoSsr3b3OX6qbBpY
+                          7WCtwwekLKRAwQ== )
+   x.y.w.example. MX      1 xx.example.
+                  RRSIG   MX 7 4 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          MqSt5HqJIN8+SLlzTOImrh5h9Xa6gDvAW/Gn
+                          nbdPc6Z7nXvCpLPJj/5lCwx3VuzVOjkbvXze
+                          8/8Ccl2Zn2hbug== )
+   xx.example.    A       192.0.2.10
+                  RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          T35hBWEZ017VC5u2c4OriKyVn/pu+fVK4AlX
+                          YOxJ6iQylfV2HQIKjv6b7DzINB3aF/wjJqgX
+                          pQvhq+Ac6+ZiFg== )
+                  HINFO   "KLH-10" "TOPS-20"
+                  RRSIG   HINFO 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          KimG+rDd+7VA1zRsu0ITNAQUTRlpnsmqWrih
+                          FRnU+bRa93v2e5oFNFYCs3Rqgv62K93N7AhW
+                          6Jfqj/8NzWjvKg== )
+                  AAAA    2001:db8:0:0:0:0:f00:baaa
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 39]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+                  RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          IXBcXORITNwd8h3gNwyxtYFvAupS/CYWufVe
+                          uBUX0O25ivBCULjZjpDxFSxfohb/KA7YRdxE
+                          NzYfMItpILl/Xw== )
+
+Appendix B.  Example Responses
+
+   The examples in this section show response messages using the signed
+   zone example in Appendix A.
+
+B.1.  Name Error
+
+   An authoritative name error.  The NSEC3 RRs prove that the name does
+   not exist and that there is no wildcard RR that should have been
+   expanded.
+
+;; Header: QR AA DO RCODE=3
+;;
+;; Question
+a.c.x.w.example.         IN A
+
+;; Answer
+;; (empty)
+
+;; Authority
+
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
+;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
+
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                       2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                       SOA NSEC3PARAM RRSIG )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                       IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                       BOCXJZMnpuwhpA== )
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 40]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+;; NSEC3 RR that matches the closest encloser (x.w.example)
+;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
+
+b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd (
+                       gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh
+                       5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3
+                       pOv0TSTyiTxIZg== )
+
+;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
+;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
+
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                       b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                       Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                       XtAIR3chwgW+SA== )
+
+;; Additional
+;; (empty)
+
+   The query returned three NSEC3 RRs that prove that the requested data
+   does not exist and that no wildcard expansion applies.  The negative
+   response is authenticated by verifying the NSEC3 RRs.  The
+   corresponding RRSIGs indicate that the NSEC3 RRs are signed by an
+   "example" DNSKEY of algorithm 7 and with key tag 40430.  The resolver
+   needs the corresponding DNSKEY RR in order to authenticate this
+   answer.
+
+   One of the owner names of the NSEC3 RRs matches the closest encloser.
+   One of the NSEC3 RRs prove that there exists no longer name.  One of
+   the NSEC3 RRs prove that there exists no wildcard RRSets that should
+   have been expanded.  The closest encloser can be found by applying
+   the algorithm in Section 8.3.
+
+   In the above example, the name 'x.w.example' hashes to
+   'b4um86eghhds6nea196smvmlo4ors995'.  This indicates that this might
+   be the closest encloser.  To prove that 'c.x.w.example' and
+   '*.x.w.example' do not exist, these names are hashed to,
+   respectively, '0va5bpr2ou0vk0lbqeeljri88laipsfh' and
+   '92pqneegtaue7pjatc3l3qnk738c6v5m'.  The first and last NSEC3 RRs
+   prove that these hashed owner names do not exist.
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 41]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.2.  No Data Error
+
+   A "no data" response.  The NSEC3 RR proves that the name exists and
+   that the requested RR type does not.
+
+;; Header: QR AA DO RCODE=0
+;;
+;; Question
+ns1.example.        IN MX
+
+;; Answer
+;; (empty)
+
+;; Authority
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set.
+
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd (
+                       2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 7 2 3600 (
+                       20150420235959 20051021000000 40430 example.
+                       OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN
+                       4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq
+                       NI6mRk/r1dOSUw== )
+;; Additional
+;; (empty)
+
+   The query returned an NSEC3 RR that proves that the requested name
+   exists ("ns1.example." hashes to "2t7b4g4vsa5smi47k61mv5bv1a22bojr"),
+   but the requested RR type does not exist (type MX is absent in the
+   type code list of the NSEC3 RR), and was not a CNAME (type CNAME is
+   also absent in the type code list of the NSEC3 RR).
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 42]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.2.1.  No Data Error, Empty Non-Terminal
+
+   A "no data" response because of an empty non-terminal.  The NSEC3 RR
+   proves that the name exists and that the requested RR type does not.
+
+ ;; Header: QR AA DO RCODE=0
+ ;;
+ ;; Question
+ y.w.example.        IN A
+
+ ;; Answer
+ ;; (empty)
+
+ ;; Authority
+ example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                        3600000 3600 )
+ example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                        40430 example.
+                        Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                        q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                        VI2LmKusbZsT0Q== )
+
+ ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
+
+ ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd (
+                        k8udemvp1j2f7eg6jebps17vp3n8i58h )
+ ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 7 2 3600 (
+                        20150420235959 20051021000000 40430 example.
+                        gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7
+                        2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0
+                        MpzVSKfTwx4uYA== )
+
+ ;; Additional
+ ;; (empty)
+
+   The query returned an NSEC3 RR that proves that the requested name
+   exists ("y.w.example." hashes to "ji6neoaepv8b5o6k4ev33abha8ht9fgc"),
+   but the requested RR type does not exist (Type A is absent in the
+   Type Bit Maps field of the NSEC3 RR).  Note that, unlike an empty
+   non-terminal proof using NSECs, this is identical to a No Data Error.
+   This example is solely mentioned to be complete.
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 43]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.3.  Referral to an Opt-Out Unsigned Zone
+
+   The NSEC3 RRs prove that nothing for this delegation was signed.
+   There is no proof that the unsigned delegation exists.
+
+   ;; Header: QR DO RCODE=0
+   ;;
+   ;; Question
+   mc.c.example.       IN MX
+
+   ;; Answer
+   ;; (empty)
+
+   ;; Authority
+   c.example.     NS      ns1.c.example.
+                  NS      ns2.c.example.
+
+   ;; NSEC3 RR that covers the "next closer" name (c.example)
+   ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
+
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd (
+                          b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
+   35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ
+                          Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ
+                          XtAIR3chwgW+SA== )
+
+   ;; NSEC3 RR that matches the closest encloser (example)
+   ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
+
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                          2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                          SOA NSEC3PARAM RRSIG )
+   0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                          IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                          BOCXJZMnpuwhpA== )
+
+   ;; Additional
+   ns1.c.example. A       192.0.2.7
+   ns2.c.example. A       192.0.2.8
+
+   The query returned a referral to the unsigned "c.example." zone.  The
+   response contains the closest provable encloser of "c.example" to be
+   "example", since the hash of "c.example"
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 44]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ("4g6p9u5gvfshp30pqecj98b3maqbn1ck") is covered by the first NSEC3 RR
+   and its Opt-Out bit is set.
+
+B.4.  Wildcard Expansion
+
+   A query that was answered with a response containing a wildcard
+   expansion.  The label count in the RRSIG RRSet in the answer section
+   indicates that a wildcard RRSet was expanded to produce this
+   response, and the NSEC3 RR proves that no "next closer" name exists
+   in the zone.
+
+   ;; Header: QR AA DO RCODE=0
+   ;;
+   ;; Question
+   a.z.w.example. IN MX
+
+   ;; Answer
+   a.z.w.example. MX      1 ai.example.
+   a.z.w.example. RRSIG   MX 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb
+                          9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM
+                          ivEBP6+4KS3ldA== )
+
+   ;; Authority
+   example.       NS      ns1.example.
+   example.       NS      ns2.example.
+   example.       RRSIG   NS 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ
+                          qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv
+                          CnMXjtz6SyObxA== )
+
+   ;; NSEC3 RR that covers the "next closer" name (z.w.example)
+   ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
+
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 45]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ;; Additional
+   ai.example.    A       192.0.2.9
+   ai.example.    RRSIG   A 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F
+                          tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+
+                          rznEn8sQ64UdqA== )
+   ai.example.    AAAA    2001:db8:0:0:0:0:f00:baa9
+   ai.example.    RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W
+                          uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG
+                          cHueLuXkMjBArQ== )
+
+   The query returned an answer that was produced as a result of a
+   wildcard expansion.  The answer section contains a wildcard RRSet
+   expanded as it would be in a traditional DNS response.  The RRSIG
+   Labels field value of 2 indicates that the answer is the result of a
+   wildcard expansion, as the "a.z.w.example" name contains 4 labels.
+   This also shows that "w.example" exists, so there is no need for an
+   NSEC3 RR that matches the closest encloser.
+
+   The NSEC3 RR proves that no closer match could have been used to
+   answer this query.
+
+B.5.  Wildcard No Data Error
+
+   A "no data" response for a name covered by a wildcard.  The NSEC3 RRs
+   prove that the matching wildcard name does not have any RRs of the
+   requested type and that no closer match exists in the zone.
+
+   ;; Header: QR AA DO RCODE=0
+   ;;
+   ;; Question
+   a.z.w.example.      IN AAAA
+
+   ;; Answer
+   ;; (empty)
+
+   ;; Authority
+   example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                          3600000 3600 )
+   example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                          40430 example.
+                          Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                          q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                          VI2LmKusbZsT0Q== )
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 46]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+   ;; NSEC3 RR that matches the closest encloser (w.example)
+   ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
+
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd (
+                          kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
+   k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK
+                          S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt
+                          Otx7w9WfcIg62A== )
+
+   ;; NSEC3 RR that covers the "next closer" name (z.w.example)
+   ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
+
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd (
+                          r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
+   q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3
+                          ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN
+                          NlkxWcLsIlMmUg== )
+
+   ;; NSEC3 RR that matches a wildcard at the closest encloser.
+   ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
+
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd (
+                          t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
+   r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 7 2 3600 (
+                          20150420235959 20051021000000 40430 example.
+                          aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C
+                          ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+
+                          HF1FWKW7RIJdtQ== )
+
+   ;; Additional
+   ;; (empty)
+
+   The query returned the NSEC3 RRs that prove that the requested data
+   does not exist and no wildcard RR applies.
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 47]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+B.6.  DS Child Zone No Data Error
+
+   A "no data" response for a QTYPE=DS query that was mistakenly sent to
+   a name server for the child zone.
+
+;; Header: QR AA DO RCODE=0
+;;
+;; Question
+example.            IN DS
+
+;; Answer
+;; (empty)
+
+;; Authority
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 (
+                       3600000 3600 )
+example.       RRSIG   SOA 7 1 3600 20150420235959 20051021000000 (
+                       40430 example.
+                       Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i
+                       q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd
+                       VI2LmKusbZsT0Q== )
+
+;; NSEC3 RR matches the QNAME and shows that the DS type bit is not set.
+
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd (
+                       2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS
+                       SOA NSEC3PARAM RRSIG )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 7 2 3600
+                       20150420235959 20051021000000 40430 example.
+                       OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL
+                       IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762
+                       BOCXJZMnpuwhpA== )
+
+;; Additional
+;; (empty)
+
+   The query returned an NSEC3 RR showing that the requested was
+   answered by the server authoritative for the zone "example".  The
+   NSEC3 RR indicates the presence of an SOA RR, showing that this NSEC3
+   RR is from the apex of the child, not from the zone cut of the
+   parent.  Queries for the "example" DS RRSet should be sent to the
+   parent servers (which are in this case the root servers).
+
+Appendix C.  Special Considerations
+
+   The following paragraphs clarify specific behavior and explain
+   special considerations for implementations.
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 48]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+C.1.  Salting
+
+   Augmenting original owner names with salt before hashing increases
+   the cost of a dictionary of pre-generated hash-values.  For every bit
+   of salt, the cost of a precomputed dictionary doubles (because there
+   must be an entry for each word combined with each possible salt
+   value).  The NSEC3 RR can use a maximum of 2040 bits (255 octets) of
+   salt, multiplying the cost by 2^2040.  This means that an attacker
+   must, in practice, recompute the dictionary each time the salt is
+   changed.
+
+   Including a salt, regardless of size, does not affect the cost of
+   constructing NSEC3 RRs.  It does increase the size of the NSEC3 RR.
+
+   There MUST be at least one complete set of NSEC3 RRs for the zone
+   using the same salt value.
+
+   The salt SHOULD be changed periodically to prevent pre-computation
+   using a single salt.  It is RECOMMENDED that the salt be changed for
+   every re-signing.
+
+   Note that this could cause a resolver to see RRs with different salt
+   values for the same zone.  This is harmless, since each RR stands
+   alone (that is, it denies the set of owner names whose hashes, using
+   the salt in the NSEC3 RR, fall between the two hashes in the NSEC3
+   RR) -- it is only the server that needs a complete set of NSEC3 RRs
+   with the same salt in order to be able to answer every possible
+   query.
+
+   There is no prohibition with having NSEC3 RRs with different salts
+   within the same zone.  However, in order for authoritative servers to
+   be able to consistently find covering NSEC3 RRs, the authoritative
+   server MUST choose a single set of parameters (algorithm, salt, and
+   iterations) to use when selecting NSEC3 RRs.
+
+C.2.  Hash Collision
+
+   Hash collisions occur when different messages have the same hash
+   value.  The expected number of domain names needed to give a 1 in 2
+   chance of a single collision is about 2^(n/2) for a hash of length n
+   bits (i.e., 2^80 for SHA-1).  Though this probability is extremely
+   low, the following paragraphs deal with avoiding collisions and
+   assessing possible damage in the event of an attack using hash
+   collisions.
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 49]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+C.2.1.  Avoiding Hash Collisions During Generation
+
+   During generation of NSEC3 RRs, hash values are supposedly unique.
+   In the (academic) case of a collision occurring, an alternative salt
+   MUST be chosen and all hash values MUST be regenerated.
+
+C.2.2.  Second Preimage Requirement Analysis
+
+   A cryptographic hash function has a second-preimage resistance
+   property.  The second-preimage resistance property means that it is
+   computationally infeasible to find another message with the same hash
+   value as a given message, i.e., given preimage X, to find a second
+   preimage X' != X such that hash(X) = hash(X').  The work factor for
+   finding a second preimage is of the order of 2^160 for SHA-1.  To
+   mount an attack using an existing NSEC3 RR, an adversary needs to
+   find a second preimage.
+
+   Assuming an adversary is capable of mounting such an extreme attack,
+   the actual damage is that a response message can be generated that
+   claims that a certain QNAME (i.e., the second pre-image) does exist,
+   while in reality QNAME does not exist (a false positive), which will
+   either cause a security-aware resolver to re-query for the non-
+   existent name, or to fail the initial query.  Note that the adversary
+   can't mount this attack on an existing name, but only on a name that
+   the adversary can't choose and that does not yet exist.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 50]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Authors' Addresses
+
+   Ben Laurie
+   Nominet
+   17 Perryn Road
+   London  W3 7LR
+   England
+
+   Phone: +44 20 8735 0686
+   EMail: ben@links.org
+
+
+   Geoffrey Sisson
+   Nominet
+   Minerva House
+   Edmund Halley Road
+   Oxford Science Park
+   Oxford  OX4 4DQ
+   UNITED KINGDOM
+
+   Phone: +44 1865 332211
+   EMail: geoff-s@panix.com
+
+
+   Roy Arends
+   Nominet
+   Minerva House
+   Edmund Halley Road
+   Oxford Science Park
+   Oxford  OX4 4DQ
+   UNITED KINGDOM
+
+   Phone: +44 1865 332211
+   EMail: roy@nominet.org.uk
+
+
+   David Blacka
+   VeriSign, Inc.
+   21355 Ridgetop Circle
+   Dulles, VA  20166
+   US
+
+   Phone: +1 703 948 3200
+   EMail: davidb@verisign.com
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 51]
+
+RFC 5155                         NSEC3                        March 2008
+
+
+Full Copyright Statement
+
+   Copyright (C) The IETF Trust (2008).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
+   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
+   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+
+
+
+
+
+
+
+
+
+
+
+Laurie, et al.              Standards Track                    [Page 52]
+
diff --git a/lib/bind/api b/lib/bind/api
index a87852a873f1..7ffeba810f24 100644
--- a/lib/bind/api
+++ b/lib/bind/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 4
-LIBREVISION = 10
-LIBAGE = 0
+LIBINTERFACE = 5
+LIBREVISION = 2
+LIBAGE = 1
diff --git a/lib/bind/bsd/Makefile.in b/lib/bind/bsd/Makefile.in
index cf70c10b1e40..72a52f61ff1a 100644
--- a/lib/bind/bsd/Makefile.in
+++ b/lib/bind/bsd/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.7 2004/03/05 05:05:07 marka Exp $
+# $Id: Makefile.in,v 1.7.18.2 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=         @srcdir@
 VPATH =         @srcdir@
@@ -34,6 +34,6 @@ SRCS=	daemon.c ftruncate.c gettimeofday.c mktemp.c putenv.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/bsd/strerror.c b/lib/bind/bsd/strerror.c
index 5743398eed54..325cd5204425 100644
--- a/lib/bind/bsd/strerror.c
+++ b/lib/bind/bsd/strerror.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strerror.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strerror.c,v 1.4.332.1 2005/04/27 05:00:46 sra Exp $";
+static const char rcsid[] = "$Id: strerror.c,v 1.4.332.2 2008/02/18 04:04:06 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -60,12 +60,14 @@ isc_strerror(int num) {
 	static char ebuf[40] = UPREFIX;		/*%< 64-bit number + slop */
 	u_int errnum;
 	char *p, *t;
+#ifndef USE_SYSERROR_LIST
 	const char *ret;
+#endif
 	char tmp[40];
 
 	errnum = num;				/*%< convert to unsigned */
 #ifdef USE_SYSERROR_LIST
-	if (errnum < sys_nerr)
+	if (errnum < (u_int)sys_nerr)
 		return (sys_errlist[errnum]);
 #else
 #undef strerror
diff --git a/lib/bind/bsd/strtoul.c b/lib/bind/bsd/strtoul.c
index f419227e9878..c2efeda197cf 100644
--- a/lib/bind/bsd/strtoul.c
+++ b/lib/bind/bsd/strtoul.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strtoul.c,v 1.2.164.1 2005/04/27 05:00:47 sra Exp $";
+static const char rcsid[] = "$Id: strtoul.c,v 1.2.164.2 2008/02/18 04:04:06 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -70,7 +70,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 	 * See strtol for comments as to the logic used.
 	 */
 	do {
-		c = *(unsigned char *)s++;
+		c = *(const unsigned char *)s++;
 	} while (isspace(c));
 	if (c == '-') {
 		neg = 1;
@@ -87,7 +87,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 		base = c == '0' ? 8 : 10;
 	cutoff = (u_long)ULONG_MAX / (u_long)base;
 	cutlim = (u_long)ULONG_MAX % (u_long)base;
-	for (acc = 0, any = 0;; c = *(unsigned char*)s++) {
+	for (acc = 0, any = 0;; c = *(const unsigned char*)s++) {
 		if (isdigit(c))
 			c -= '0';
 		else if (isalpha(c))
@@ -96,7 +96,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 			break;
 		if (c >= base)
 			break;
-		if (any < 0 || acc > cutoff || acc == cutoff && c > cutlim)
+		if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
 			any = -1;
 		else {
 			any = 1;
@@ -110,7 +110,7 @@ strtoul(const char *nptr, char **endptr, int base) {
 	} else if (neg)
 		acc = -acc;
 	if (endptr != 0)
-		*endptr = (char *)(any ? s - 1 : nptr);
+		DE_CONST((any ? s - 1 : nptr), *endptr);
 	return (acc);
 }
 
diff --git a/lib/bind/configure.in b/lib/bind/configure.in
index 6e98c5c0fddf..9b9b53b81cb4 100644
--- a/lib/bind/configure.in
+++ b/lib/bind/configure.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-AC_REVISION($Revision: 1.90.18.34.10.2 $)
+AC_REVISION($Revision: 1.90.18.43 $)
 
 AC_INIT(resolv/herror.c)
 AC_PREREQ(2.13)
@@ -169,7 +169,7 @@ AC_PROG_CC
 AC_HEADER_STDC
 
 
-AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h)
+AC_CHECK_HEADERS(fcntl.h db.h paths.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/timers.h stropts.h memory.h)
 
 AC_C_CONST
 AC_C_INLINE
@@ -461,6 +461,7 @@ AC_SUBST(WANT_THREADS_OBJS)
 AC_CHECK_FUNC(strlcat, AC_DEFINE(HAVE_STRLCAT))
 AC_CHECK_FUNC(memmove, AC_DEFINE(HAVE_MEMMOVE))
 AC_CHECK_FUNC(memchr, AC_DEFINE(HAVE_MEMCHR))
+AC_CHECK_FUNC(strtoul, , AC_DEFINE(NEED_STRTOUL))
 
 AC_CHECK_FUNC(if_nametoindex,
 	[USE_IFNAMELINKID="#define USE_IFNAMELINKID 1"],
@@ -490,6 +491,16 @@ AC_CHECK_FUNC(strerror, [NEED_STRERROR="#undef NEED_STRERROR"],
 [NEED_STRERROR="#define NEED_STRERROR 1"])
 AC_SUBST(NEED_STRERROR)
 
+if test -n "$NEED_STRERROR"
+then
+	AC_MSG_CHECKING([for extern char * sys_errlist[]])
+	AC_TRY_LINK([ extern int sys_nerr; extern char *sys_errlist[]; ],
+		    [ const char *p = sys_errlist[0]; ],
+		    AC_MSG_RESULT(yes)
+		    AC_DEFINE(USE_SYSERROR_LIST),
+		    AC_MSG_RESULT(no))
+fi
+
 #
 # flockfile is usually provided by pthreads, but we may want to use it
 # even if compiled with --disable-threads.
@@ -666,6 +677,14 @@ AC_SUBST(PURIFY)
 #
 # GNU libtool support
 #
+case $host in
+sunos*)
+    # Just set the maximum command line length for sunos as it otherwise
+    # takes a exceptionally long time to work it out. Required for libtool.
+    lt_cv_sys_max_cmd_len=4096;
+    ;;
+esac
+
 AC_ARG_WITH(libtool,
 	    [  --with-libtool	use GNU libtool (following indented options supported)],
 	    use_libtool="$withval", use_libtool="no")
@@ -976,6 +995,8 @@ AC_SUBST(ISC_PLATFORM_NEEDATON)
 #
 case "$host" in
 	*-dec-osf*)
+		# Tru64 broke send() by defining it to send_OBSOLETE
+		AC_DEFINE(REENABLE_SEND)
 		# Turn on 4.4BSD style sa_len support.
 		AC_DEFINE(_SOCKADDR_LEN)
 		;;
@@ -1050,6 +1071,7 @@ case "$host" in
 	*-qnx*)		PORT_DIR="port/qnx";;
 	*-rhapsody*)	PORT_DIR="port/rhapsody";;
 	*-sunos4*)
+			AC_DEFINE(NEED_SUN4PROTOS)
 			PORT_NONBLOCK="#define PORT_NONBLOCK O_NDELAY"
 			PORT_DIR="port/sunos";;
 	*-solaris2.[[01234]])
@@ -1246,6 +1268,38 @@ found_rt_iflist
 AC_CHECK_FUNC(strsep,
 	[ISC_PLATFORM_NEEDSTRSEP="#undef ISC_PLATFORM_NEEDSTRSEP"],
 	[ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1"])
+
+
+AC_MSG_CHECKING(for char *sprintf)
+AC_TRY_COMPILE([
+#include <stdio.h>
+],
+[ char buf[2]; return(*sprintf(buf,"x"));],
+AC_DEFINE(SPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+,
+AC_MSG_RESULT(no)
+)
+
+AC_MSG_CHECKING(for char *vsprintf)
+case $host in
+*sunos4*) # not decared in any header file.
+AC_DEFINE(VSPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+;;
+*)
+AC_TRY_COMPILE([
+#include <stdio.h>
+],
+[ char buf[2]; return(*vsprintf(buf,"x"));],
+AC_DEFINE(VSPRINTF_CHAR)
+AC_MSG_RESULT(yes)
+,
+AC_MSG_RESULT(no)
+)
+;;
+esac
+
 AC_CHECK_FUNC(vsnprintf,
 	[ISC_PLATFORM_NEEDVSNPRINTF="#undef ISC_PLATFORM_NEEDVSNPRINTF"],
 	[ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS print.$O"
@@ -1256,12 +1310,7 @@ AC_SUBST(ISC_PLATFORM_NEEDVSNPRINTF)
 
 AC_SUBST(ISC_EXTRA_OBJS)
 AC_SUBST(ISC_EXTRA_SRCS)
-AC_CHECK_FUNC(strerror,
-	[USE_SYSERROR_LIST="#undef USE_SYSERROR_LIST"],
-	[USE_SYSERROR_LIST="#define USE_SYSERROR_LIST 1"])
-AC_SUBST(USE_SYSERROR_LIST)
 
-#
 # Determine the printf format characters to use when printing
 # values of type isc_int64_t.  We make the assumption that platforms
 # where a "long long" is the same size as a "long" (e.g., Alpha/OSF1)
@@ -1865,19 +1914,37 @@ AC_SUBST(SETGRENT_VOID)
 
 case $host in
 ia64-hp-hpux11.*)
+NGR_R_CONST="#define NGR_R_CONST"
 ;;
+*-hp-hpux11.*)
+#
+# HPUX doesn't have a prototype for getnetgrent_r().
+#
+NGR_R_CONST="#define NGR_R_CONST"
+NGR_R_ARGS="#define NGR_R_ARGS char *buf, int buflen"
+NGR_R_BAD="#define NGR_R_BAD (0)"
+NGR_R_COPY="#define NGR_R_COPY buf, buflen"
+NGR_R_COPY_ARGS="#define NGR_R_COPY_ARGS NGR_R_ARGS"
+NGR_R_OK="#define NGR_R_OK 1"
+NGR_R_RETURN="#define NGR_R_RETURN int"
+;;
+
 *)
 AC_CHECK_FUNC(getnetgrent_r,
 AC_TRY_COMPILE(
 [
 #undef __USE_MISC
 #define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
 #include <netdb.h>
+#include <unistd.h>
 int getnetgrent_r(char **m, char **u, char **d, char *b, int l) {}
 ]
 ,
 [return (0);],
 [
+NGR_R_CONST="#define NGR_R_CONST"
 NGR_R_ARGS="#define NGR_R_ARGS char *buf, int buflen"
 NGR_R_BAD="#define NGR_R_BAD (0)"
 NGR_R_COPY="#define NGR_R_COPY buf, buflen"
@@ -1890,12 +1957,16 @@ AC_TRY_COMPILE(
 [
 #undef __USE_MISC
 #define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
 #include <netdb.h>
+#include <unistd.h>
 int getnetgrent_r(char **m, char **u, char **d, char *b, size_t l) {}
 ]
 ,
 [return (0);],
 [
+NGR_R_CONST="#define NGR_R_CONST"
 NGR_R_ARGS="#define NGR_R_ARGS char *buf, size_t buflen"
 NGR_R_BAD="#define NGR_R_BAD (0)"
 NGR_R_COPY="#define NGR_R_COPY buf, buflen"
@@ -1908,12 +1979,16 @@ AC_TRY_COMPILE(
 [
 #undef __USE_MISC
 #define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
 #include <netdb.h>
-extern int getnetgrent_r( char **, char **, char **, void **);
+#include <unistd.h>
+extern int getnetgrent_r(char **, char **, char **, void **);
 ]
 ,
 [return (0);],
 [
+NGR_R_CONST="#define NGR_R_CONST"
 NGR_R_ARGS="#define NGR_R_ARGS void **buf"
 NGR_R_BAD="#define NGR_R_BAD (0)"
 NGR_R_COPY="#define NGR_R_COPY buf"
@@ -1923,10 +1998,35 @@ NGR_R_RETURN="#define NGR_R_RETURN int"
 NGR_R_PRIVATE="#define NGR_R_PRIVATE 1"
 ]
 ,
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
+#include <netdb.h>
+#include <unistd.h>
+extern int getnetgrent_r(const char **, const char **, const char **, void *);
+]
+,
+[return (0);],
+[
+NGR_R_CONST="#define NGR_R_CONST const"
+NGR_R_ARGS="#define NGR_R_ARGS void *buf"
+NGR_R_BAD="#define NGR_R_BAD (0)"
+NGR_R_COPY="#define NGR_R_COPY buf"
+NGR_R_COPY_ARGS="#define NGR_R_COPY_ARGS NGR_R_ARGS"
+NGR_R_OK="#define NGR_R_OK 1"
+NGR_R_RETURN="#define NGR_R_RETURN int"
+NGR_R_PRIVATE="#define NGR_R_PRIVATE 2"
+]
+,
+)
 )
 )
 )
 ,
+NGR_R_CONST="#define NGR_R_CONST"
 NGR_R_ARGS="#define NGR_R_ARGS char *buf, int buflen"
 NGR_R_BAD="#define NGR_R_BAD (0)"
 NGR_R_COPY="#define NGR_R_COPY buf, buflen"
@@ -1935,6 +2035,7 @@ NGR_R_OK="#define NGR_R_OK 1"
 NGR_R_RETURN="#define NGR_R_RETURN int"
 )
 esac
+AC_SUBST(NGR_R_CONST)
 AC_SUBST(NGR_R_ARGS)
 AC_SUBST(NGR_R_BAD)
 AC_SUBST(NGR_R_COPY)
@@ -1948,7 +2049,10 @@ AC_TRY_COMPILE(
 [
 #undef __USE_MISC
 #define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
 #include <netdb.h>
+#include <unistd.h>
 void endnetgrent_r(void **ptr);
 ]
 ,
@@ -1957,44 +2061,128 @@ void endnetgrent_r(void **ptr);
 [
 NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  /* empty */"
 NGR_R_END_RETURN="#define NGR_R_END_RETURN void"
-NGR_R_ENT_ARGS="#define NGR_R_ENT_ARGS NGR_R_ARGS"
+NGR_R_END_ARGS="#define NGR_R_END_ARGS NGR_R_ARGS"
+]
+,
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
+#include <netdb.h>
+#include <unistd.h>
+void endnetgrent_r(void *ptr);
+]
+,
+[return (0);]
+,
+[
+NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  /* empty */"
+NGR_R_END_RETURN="#define NGR_R_END_RETURN void"
+NGR_R_END_ARGS="#define NGR_R_END_ARGS void *buf"
 ]
 ,
 [
 NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  return (x)"
 NGR_R_END_RETURN="#define NGR_R_END_RETURN int"
-NGR_R_ENT_ARGS="#define NGR_R_ENT_ARGS NGR_R_ARGS"
+NGR_R_END_ARGS="#define NGR_R_END_ARGS NGR_R_ARGS"
 ]
 )
+)
 ,
 NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  /*empty*/"
 NGR_R_END_RETURN="#define NGR_R_END_RETURN void"
-NGR_R_ENT_ARGS="#undef NGR_R_ENT_ARGS /*empty*/"
+NGR_R_END_ARGS="#undef NGR_R_END_ARGS /*empty*/"
 AC_DEFINE(NEED_ENDNETGRENT_R)
 )
 AC_SUBST(NGR_R_END_RESULT)
 AC_SUBST(NGR_R_END_RETURN)
-AC_SUBST(NGR_R_ENT_ARGS)
+AC_SUBST(NGR_R_END_ARGS)
 
 AC_CHECK_FUNC(setnetgrent_r,
 [
 case "$host" in
 *bsdi*)
+	#
+	# No prototype
+	#
 	NGR_R_SET_RESULT="#undef NGR_R_SET_RESULT /*empty*/"
 	NGR_R_SET_RETURN="#define NGR_R_SET_RETURN void"
+	NGR_R_SET_ARGS="#define NGR_R_SET_ARGS NGR_R_ARGS"
+	NGR_R_SET_CONST="#define NGR_R_SET_CONST"
 	;;
-*)
+*hpux*)
+	#
+	# No prototype
+	#
 	NGR_R_SET_RESULT="#define NGR_R_SET_RESULT NGR_R_OK"
 	NGR_R_SET_RETURN="#define NGR_R_SET_RETURN int"
+	NGR_R_SET_ARGS="#undef NGR_R_SET_ARGS /* empty */"
+	NGR_R_SET_CONST="#define NGR_R_SET_CONST"
 	;;
+*)
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
+#include <netdb.h>
+#include <unistd.h>
+void setnetgrent_r(void **ptr);
+]
+,
+[return (0);]
+,
+[
+NGR_R_SET_RESULT="#undef NGR_R_SET_RESULT /* empty */"
+NGR_R_SET_RETURN="#define NGR_R_SET_RETURN void"
+NGR_R_SET_ARGS="#define NGR_R_SET_ARGS void **buf"
+NGR_R_SET_CONST="#define NGR_R_SET_CONST"
+]
+,
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#undef _REEENTRANT
+#define _REEENTRANT
+#include <netdb.h>
+#include <unistd.h>
+extern int setnetgrent_r(char *, void **);
+]
+,
+[return (0);]
+,
+[
+NGR_R_SET_RESULT="#define NGR_R_SET_RESULT NGR_R_OK"
+NGR_R_SET_RETURN="#define NGR_R_SET_RETURN int"
+NGR_R_SET_ARGS="#define NGR_R_SET_ARGS void **buf"
+NGR_R_SET_CONST="#define NGR_R_SET_CONST"
+]
+,
+[
+NGR_R_SET_RESULT="#define NGR_R_SET_RESULT NGR_R_OK"
+NGR_R_SET_RETURN="#define NGR_R_SET_RETURN int"
+NGR_R_SET_ARGS="#undef NGR_R_SET_ARGS"
+NGR_R_SET_CONST="#define NGR_R_SET_CONST const"
+]
+))
+;;
 esac
 ]
 ,
 NGR_R_SET_RESULT="#undef NGR_R_SET_RESULT /*empty*/"
 NGR_R_SET_RETURN="#define NGR_R_SET_RETURN void"
+NGR_R_SET_ARGS="#undef NGR_R_SET_ARGS"
+NGR_R_SET_CONST="#define NGR_R_SET_CONST const"
 )
+
 AC_SUBST(NGR_R_SET_RESULT)
 AC_SUBST(NGR_R_SET_RETURN)
+AC_SUBST(NGR_R_SET_ARGS)
+AC_SUBST(NGR_R_SET_CONST)
 
 AC_CHECK_FUNC(innetgr_r,,AC_DEFINE(NEED_INNETGR_R))
 
@@ -2590,7 +2778,7 @@ case "$host" in
 	*-solaris2.9)
 		hack_shutup_in6addr_init_macros=yes
 		;;
-	*-solaris2.1[0-9])
+	*-solaris2.1[[0-9]])
 		hack_shutup_in6addr_init_macros=yes
 		;;
 esac
@@ -2675,6 +2863,7 @@ AC_OUTPUT(
 	port/Makefile
 	${PORT_DIR}/Makefile
 	${PORT_INCLUDE}/Makefile
+	include/isc/platform.h
 )
 
 # Tell Emacs to edit this file in shell mode.
diff --git a/lib/bind/dst/Makefile.in b/lib/bind/dst/Makefile.in
index c802840613fa..a841d4900862 100644
--- a/lib/bind/dst/Makefile.in
+++ b/lib/bind/dst/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6 2004/03/05 05:05:09 marka Exp $
+# $Id: Makefile.in,v 1.6.18.2 2008/03/20 23:46:01 tbox Exp $
  
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -26,7 +26,7 @@ TARGETS= ${OBJS}
 
 CRYPTFLAGS=     -DCYLINK_DSS -DHMAC_MD5 -DUSE_MD5 -DDNSSAFE
 
-CINCLUDES= -I.. -I${srcdir}/../include ${CRYPTINCL}
+CINCLUDES= -I.. -I../include -I${srcdir}/../include ${CRYPTINCL}
 CDEFINES= ${CRYPTFLAGS}
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/dst/dst_api.c b/lib/bind/dst/dst_api.c
index a622ae3eb4c6..5bcd80a5c877 100644
--- a/lib/bind/dst/dst_api.c
+++ b/lib/bind/dst/dst_api.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.10.332.7 2007/09/26 04:41:47 each Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/dst_api.c,v 1.10.332.7 2007/09/26 04:41:47 each Exp $";
 #endif
 
 /*
diff --git a/lib/bind/dst/hmac_link.c b/lib/bind/dst/hmac_link.c
index b97a996d26e6..cbd68f482780 100644
--- a/lib/bind/dst/hmac_link.c
+++ b/lib/bind/dst/hmac_link.c
@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.5 2007/09/26 04:41:47 each Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/hmac_link.c,v 1.3.164.5 2007/09/26 04:41:47 each Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
diff --git a/lib/bind/dst/support.c b/lib/bind/dst/support.c
index ec228d0142c5..263f9578615b 100644
--- a/lib/bind/dst/support.c
+++ b/lib/bind/dst/support.c
@@ -1,4 +1,4 @@
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.c,v 1.3.332.3 2005/10/11 00:25:09 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/Attic/support.c,v 1.3.332.3 2005/10/11 00:25:09 marka Exp $";
 
 
 /*
diff --git a/lib/bind/include/Makefile.in b/lib/bind/include/Makefile.in
index d07ea7abfafd..17a69bf30057 100644
--- a/lib/bind/include/Makefile.in
+++ b/lib/bind/include/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4 2004/03/05 05:05:11 marka Exp $
+# $Id: Makefile.in,v 1.4.18.2 2008/01/23 02:15:02 tbox Exp $
 
 srcdir =        @srcdir@
 VPATH =         @srcdir@
@@ -24,7 +24,7 @@ HEADERS=fd_setsize.h hesiod.h irp.h irs.h netdb.h netgroup.h res_update.h \
 AHEADERS= arpa/inet.h arpa/nameser.h arpa/nameser_compat.h
 IHEADERS= isc/assertions.h isc/ctl.h isc/dst.h isc/eventlib.h isc/heap.h \
 	isc/irpmarshall.h isc/list.h isc/logging.h isc/memcluster.h \
-	isc/misc.h isc/tree.h
+	isc/misc.h isc/tree.h isc/platform.h.in
 
 all:
 
diff --git a/lib/bind/include/arpa/nameser.h b/lib/bind/include/arpa/nameser.h
index b3a7849b5465..8f8d8a7cc286 100644
--- a/lib/bind/include/arpa/nameser.h
+++ b/lib/bind/include/arpa/nameser.h
@@ -49,7 +49,7 @@
  */
 
 /*
- *	$Id: nameser.h,v 1.7.18.1 2005/04/27 05:00:50 sra Exp $
+ *	$Id: nameser.h,v 1.7.18.2 2008/04/03 23:15:15 marka Exp $
  */
 
 #ifndef _ARPA_NAMESER_H_
@@ -427,9 +427,10 @@ typedef enum __ns_cert_types {
 #define NS_NXT_MAX 127
 
 /*%
- * EDNS0 extended flags, host order.
+ * EDNS0 extended flags and option codes, host order.
  */
 #define NS_OPT_DNSSEC_OK	0x8000U
+#define NS_OPT_NSID             3
 
 /*%
  * Inline versions of get/put short/long.  Pointer is advanced.
diff --git a/lib/bind/include/isc/assertions.h b/lib/bind/include/isc/assertions.h
index 2ed768dcaec4..100e586658b0 100644
--- a/lib/bind/include/isc/assertions.h
+++ b/lib/bind/include/isc/assertions.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: assertions.h,v 1.2.18.1 2005/04/27 05:00:50 sra Exp $
+ * $Id: assertions.h,v 1.2.18.2 2008/10/15 03:57:21 marka Exp $
  */
 
 #ifndef ASSERTIONS_H
@@ -29,18 +29,19 @@ typedef enum {
 typedef void (*assertion_failure_callback)(const char *, int, assertion_type,
 					   const char *, int);
 
+/* coverity[+kill] */
 extern assertion_failure_callback __assertion_failed;
 void set_assertion_failure_callback(assertion_failure_callback f);
 const char *assertion_type_to_text(assertion_type type);
 
-#ifdef CHECK_ALL
+#if defined(CHECK_ALL) || defined(__COVERITY__)
 #define CHECK_REQUIRE		1
 #define CHECK_ENSURE		1
 #define CHECK_INSIST		1
 #define CHECK_INVARIANT		1
 #endif
 
-#ifdef CHECK_NONE
+#if defined(CHECK_NONE) && !defined(__COVERITY__)
 #define CHECK_REQUIRE		0
 #define CHECK_ENSURE		0
 #define CHECK_INSIST		0
diff --git a/lib/bind/include/isc/eventlib.h b/lib/bind/include/isc/eventlib.h
index 598c71ca80fc..50038231c852 100644
--- a/lib/bind/include/isc/eventlib.h
+++ b/lib/bind/include/isc/eventlib.h
@@ -18,7 +18,7 @@
 /* eventlib.h - exported interfaces for eventlib
  * vix 09sep95 [initial]
  *
- * $Id: eventlib.h,v 1.3.18.2 2005/07/28 07:38:07 marka Exp $
+ * $Id: eventlib.h,v 1.3.18.3 2008/01/23 02:12:01 marka Exp $
  */
 
 #ifndef _EVENTLIB_H
@@ -29,6 +29,8 @@
 #include <sys/time.h>
 #include <stdio.h>
 
+#include <isc/platform.h>
+
 #ifndef __P
 # define __EVENTLIB_P_DEFINED
 # ifdef __STDC__
diff --git a/lib/bind/include/isc/misc.h b/lib/bind/include/isc/misc.h
index d2e98acf5ddc..0cd1487a4b93 100644
--- a/lib/bind/include/isc/misc.h
+++ b/lib/bind/include/isc/misc.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: misc.h,v 1.4.18.1 2005/04/27 05:00:52 sra Exp $
+ * $Id: misc.h,v 1.4.18.2 2008/02/18 04:04:06 marka Exp $
  */
 
 #ifndef _ISC_MISC_H
@@ -25,6 +25,7 @@
 /*! \file */
 
 #include <stdio.h>
+#include <sys/types.h>
 
 #define	bitncmp		__bitncmp
 /*#define isc_movefile	__isc_movefile */
diff --git a/lib/bind/include/isc/platform.h.in b/lib/bind/include/isc/platform.h.in
new file mode 100644
index 000000000000..40ab5d725f83
--- /dev/null
+++ b/lib/bind/include/isc/platform.h.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: platform.h.in,v 1.2.6.2 2008/01/23 02:15:02 tbox Exp $ */
+
+/*! \file */
+
+#ifndef ISC_PLATFORM_H
+#define ISC_PLATFORM_H
+
+/*
+ * Define if the OS does not define struct timespec.
+ */
+@ISC_PLATFORM_NEEDTIMESPEC@
+#ifdef ISC_PLATFORM_NEEDTIMESPEC
+#include <time.h>               /* For time_t */
+struct timespec {
+	time_t  tv_sec;         /* seconds */
+	long    tv_nsec;        /* nanoseconds */
+};
+#endif
+
+#endif
diff --git a/lib/bind/include/netdb.h b/lib/bind/include/netdb.h
index 66dd13d21e78..b74c6462b622 100644
--- a/lib/bind/include/netdb.h
+++ b/lib/bind/include/netdb.h
@@ -86,7 +86,7 @@
 
 /*
  *      @(#)netdb.h	8.1 (Berkeley) 6/2/93
- *	$Id: netdb.h,v 1.15.18.6 2006/10/02 01:23:09 marka Exp $
+ *	$Id: netdb.h,v 1.15.18.7 2008/02/28 05:49:37 marka Exp $
  */
 
 #ifndef _NETDB_H_
@@ -481,7 +481,7 @@ int		endservent_r __P((struct servent_data *));
 void		endservent_r __P((struct servent_data *));
 #endif
 #ifdef _AIX
-int		setnetgrent_r __P((const char *, void **));
+int		setnetgrent_r __P((char *, void **));
 void		endnetgrent_r __P((void **));
 /*
  * Note: AIX's netdb.h declares innetgr_r() as: 
diff --git a/lib/bind/include/resolv.h b/lib/bind/include/resolv.h
index 66d84fc713b0..eebc62e05eb7 100644
--- a/lib/bind/include/resolv.h
+++ b/lib/bind/include/resolv.h
@@ -50,7 +50,7 @@
 
 /*%
  *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
- *	$Id: resolv.h,v 1.19.18.3 2005/08/25 04:43:51 marka Exp $
+ *	$Id: resolv.h,v 1.19.18.4 2008/04/03 23:15:15 marka Exp $
  */
 
 #ifndef _RESOLV_H_
@@ -250,6 +250,7 @@ union res_sockaddr_union {
 #define	RES_NOCHECKNAME	0x00008000	/*%< do not check names for sanity. */
 #define	RES_KEEPTSIG	0x00010000	/*%< do not strip TSIG records */
 #define	RES_BLAST	0x00020000	/*%< blast all recursive servers */
+#define RES_NSID	0x00040000      /*%< request name server ID */
 #define RES_NOTLDQUERY	0x00100000	/*%< don't unqualified name as a tld */
 #define RES_USE_DNSSEC	0x00200000	/*%< use DNSSEC using OK bit in OPT */
 /* #define RES_DEBUG2	0x00400000 */	/* nslookup internal */
@@ -396,6 +397,7 @@ extern const struct res_sym __p_rcode_syms[];
 #define sym_ntos		__sym_ntos
 #define sym_ston		__sym_ston
 #define res_nopt		__res_nopt
+#define res_nopt_rdata       	__res_nopt_rdata
 #define res_ndestroy		__res_ndestroy
 #define	res_nametoclass		__res_nametoclass
 #define	res_nametotype		__res_nametotype
@@ -482,6 +484,8 @@ int		res_findzonecut2 __P((res_state, const char *, ns_class, int,
 				      union res_sockaddr_union *, int));
 void		res_nclose __P((res_state));
 int		res_nopt __P((res_state, int, u_char *, int, int));
+int		res_nopt_rdata __P((res_state, int, u_char *, int, u_char *,
+				    u_short, u_short, u_char *));
 void		res_send_setqhook __P((res_send_qhook));
 void		res_send_setrhook __P((res_send_rhook));
 int		__res_vinit __P((res_state, int));
diff --git a/lib/bind/inet/Makefile.in b/lib/bind/inet/Makefile.in
index 7eb297c13d15..7b848966841b 100644
--- a/lib/bind/inet/Makefile.in
+++ b/lib/bind/inet/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5 2004/03/05 05:05:13 marka Exp $
+# $Id: Makefile.in,v 1.5.18.2 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -30,6 +30,6 @@ SRCS=	inet_addr.c inet_cidr_ntop.c inet_cidr_pton.c inet_data.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/inet/inet_net_pton.c b/lib/bind/inet/inet_net_pton.c
index d3de33bf10a4..71a871510393 100644
--- a/lib/bind/inet/inet_net_pton.c
+++ b/lib/bind/inet/inet_net_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_pton.c,v 1.7.18.1 2005/04/27 05:00:53 sra Exp $";
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.7.18.2 2008/08/26 04:42:43 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -133,11 +133,11 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 			INSIST(n >= 0 && n <= 9);
 			bits *= 10;
 			bits += n;
+			if (bits > 32)
+				goto enoent;
 		} while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
 		if (ch != '\0')
 			goto enoent;
-		if (bits > 32)
-			goto emsgsize;
 	}
 
 	/* Firey death and destruction unless we prefetched EOS. */
diff --git a/lib/bind/inet/inet_network.c b/lib/bind/inet/inet_network.c
index 4758a00f2651..47976cff68d8 100644
--- a/lib/bind/inet/inet_network.c
+++ b/lib/bind/inet/inet_network.c
@@ -84,9 +84,9 @@ again:
 	}
 	if (!digit)
 		return (INADDR_NONE);
+	if (pp >= parts + 4 || val > 0xffU)
+		return (INADDR_NONE);
 	if (*cp == '.') {
-		if (pp >= parts + 4 || val > 0xffU)
-			return (INADDR_NONE);
 		*pp++ = val, cp++;
 		goto again;
 	}
diff --git a/lib/bind/irs/Makefile.in b/lib/bind/irs/Makefile.in
index ce6f5f2e4b50..e4f38f7e09aa 100644
--- a/lib/bind/irs/Makefile.in
+++ b/lib/bind/irs/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.8.18.2 2004/12/07 00:53:48 marka Exp $
+# $Id: Makefile.in,v 1.8.18.4 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -65,6 +65,6 @@ WANT_IRS_THREADSGR_OBJS=getgrent_r.@O@
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/irs/dns_ho.c b/lib/bind/irs/dns_ho.c
index d1d6f5a9ff9a..db7ff02c9c55 100644
--- a/lib/bind/irs/dns_ho.c
+++ b/lib/bind/irs/dns_ho.c
@@ -52,7 +52,7 @@
 /* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_ho.c,v 1.14.18.7 2006/12/07 03:54:24 marka Exp $";
+static const char rcsid[] = "$Id: dns_ho.c,v 1.14.18.8 2008/09/24 05:59:50 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -958,7 +958,7 @@ gethostans(struct irs_ho *this,
 					}
 					if (m == 0)
 						continue;
-					if (hap < &pvt->h_addr_ptrs[MAXADDRS-1])
+					if (hap < &pvt->h_addr_ptrs[MAXADDRS])
 						hap++;
 					*hap = NULL;
 					bp += m;
@@ -980,9 +980,10 @@ gethostans(struct irs_ho *this,
 			*ap = NULL;
 			*hap = NULL;
 
-			if (pvt->res->nsort && haveanswer > 1 && qtype == T_A)
+			if (pvt->res->nsort && hap != pvt->h_addr_ptrs &&
+			    qtype == T_A)
 				addrsort(pvt->res, pvt->h_addr_ptrs,
-					 haveanswer);
+					 hap - pvt->h_addr_ptrs);
 			if (pvt->host.h_name == NULL) {
 				n = strlen(qname) + 1;	/*%< for the \\0 */
 				if (n > (ep - bp) || n >= MAXHOSTNAMELEN)
@@ -1049,7 +1050,7 @@ add_hostent(struct pvt *pvt, char *bp, char **hap, struct addrinfo *ai)
 	/* Avoid overflows. */
 	if (bp + addrlen > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1])
 		return(-1);
-	if (hap >= &pvt->h_addr_ptrs[MAXADDRS-1])
+	if (hap >= &pvt->h_addr_ptrs[MAXADDRS])
 		return(0); /*%< fail, but not treat it as an error. */
 	/* Suppress duplicates. */
 	for (tap = (const char **)pvt->h_addr_ptrs;
diff --git a/lib/bind/irs/getnetgrent.c b/lib/bind/irs/getnetgrent.c
index a11fa0840467..1e6ff9bab538 100644
--- a/lib/bind/irs/getnetgrent.c
+++ b/lib/bind/irs/getnetgrent.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getnetgrent.c,v 1.3.18.1 2005/04/27 05:00:58 sra Exp $";
+static const char rcsid[] = "$Id: getnetgrent.c,v 1.3.18.2 2008/02/27 00:08:30 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -76,7 +76,9 @@ innetgr(INNETGR_ARGS) {
 }
 
 int
-getnetgrent(char **host, char **user, char **domain) {
+getnetgrent(NGR_R_CONST char **host, NGR_R_CONST char **user,
+	    NGR_R_CONST char **domain)
+{
 	struct net_data *net_data = init();
 	const char *ch, *cu, *cd;
 	int ret;
diff --git a/lib/bind/irs/getnetgrent_r.c b/lib/bind/irs/getnetgrent_r.c
index 261d9b785aca..3ff554288def 100644
--- a/lib/bind/irs/getnetgrent_r.c
+++ b/lib/bind/irs/getnetgrent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.7.18.4 2005/09/03 12:45:15 marka Exp $";
+static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.7.18.6 2008/02/28 05:49:37 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -33,10 +33,13 @@ static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.7.18.4 2005/09/03 12:45:15
 #include <port_after.h>
 
 #ifdef NGR_R_RETURN
+#ifndef NGR_R_PRIVATE
+#define NGR_R_PRIVATE 0
+#endif
 
 static NGR_R_RETURN 
-copy_protoent(char **, char **, char **, const char *, const char *,
-	      const char *, NGR_R_COPY_ARGS);
+copy_protoent(NGR_R_CONST char **, NGR_R_CONST char **, NGR_R_CONST char **,
+	      const char *, const char *, const char *, NGR_R_COPY_ARGS);
 
 NGR_R_RETURN
 innetgr_r(const char *netgroup, const char *host, const char *user,
@@ -58,8 +61,10 @@ innetgr_r(const char *netgroup, const char *host, const char *user,
  */
 
 NGR_R_RETURN
-getnetgrent_r(char **machinep, char **userp, char **domainp, NGR_R_ARGS) {
-	char *mp, *up, *dp;
+getnetgrent_r(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+	      NGR_R_CONST char **domainp, NGR_R_ARGS)
+{
+	NGR_R_CONST char *mp, *up, *dp;
 	int res = getnetgrent(&mp, &up, &dp);
 
 	if (res != 1) 
@@ -69,15 +74,24 @@ getnetgrent_r(char **machinep, char **userp, char **domainp, NGR_R_ARGS) {
 				mp, up, dp, NGR_R_COPY));
 }
 
+#if NGR_R_PRIVATE == 2
+struct private {
+	char *buf;
+};
+
+#endif
 NGR_R_SET_RETURN
-#ifdef NGR_R_ENT_ARGS
-setnetgrent_r(const char *netgroup, NGR_R_ENT_ARGS)
+#ifdef NGR_R_SET_ARGS
+setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS)
 #else
-setnetgrent_r(const char *netgroup)
+setnetgrent_r(NGR_R_SET_CONST char *netgroup)
 #endif
 {
+#if NGR_R_PRIVATE == 2
+	struct private *p;
+#endif
 	char *tmp;
-#if defined(NGR_R_ENT_ARGS) && !defined(NGR_R_PRIVATE)
+#if defined(NGR_R_SET_ARGS) && NGR_R_PRIVATE == 0
 	UNUSED(buf);
 	UNUSED(buflen);
 #endif
@@ -85,8 +99,17 @@ setnetgrent_r(const char *netgroup)
 	DE_CONST(netgroup, tmp);
 	setnetgrent(tmp);
 
-#ifdef NGR_R_PRIVATE
+#if NGR_R_PRIVATE == 1
 	*buf = NULL;
+#elif NGR_R_PRIVATE == 2
+	*buf = p = malloc(sizeof(struct private));
+	if (p == NULL)
+#ifdef NGR_R_SET_RESULT
+		return (NGR_R_BAD);
+#else
+		return;
+#endif
+	p->buf = NULL;
 #endif
 #ifdef NGR_R_SET_RESULT
 	return (NGR_R_SET_RESULT);
@@ -94,22 +117,29 @@ setnetgrent_r(const char *netgroup)
 }
 
 NGR_R_END_RETURN
-#ifdef NGR_R_ENT_ARGS
-endnetgrent_r(NGR_R_ENT_ARGS)
+#ifdef NGR_R_END_ARGS
+endnetgrent_r(NGR_R_END_ARGS)
 #else
 endnetgrent_r(void)
 #endif
 {
-#if defined(NGR_R_ENT_ARGS) && !defined(NGR_R_PRIVATE)
+#if NGR_R_PRIVATE == 2
+	struct private *p = buf;
+#endif
+#if defined(NGR_R_SET_ARGS) && NGR_R_PRIVATE == 0
 	UNUSED(buf);
 	UNUSED(buflen);
 #endif
 
 	endnetgrent();
-#ifdef NGR_R_PRIVATE
+#if NGR_R_PRIVATE == 1
 	if (*buf != NULL)
 		free(*buf);
 	*buf = NULL;
+#elif NGR_R_PRIVATE == 2
+	if (p->buf != NULL)
+		free(p->buf);
+	free(p);
 #endif
 	NGR_R_END_RESULT(NGR_R_OK);
 }
@@ -117,9 +147,13 @@ endnetgrent_r(void)
 /* Private */
 
 static int
-copy_protoent(char **machinep, char **userp, char **domainp,
-	      const char *mp, const char *up, const char *dp,
-	      NGR_R_COPY_ARGS) {
+copy_protoent(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+	      NGR_R_CONST char **domainp, const char *mp, const char *up,
+	      const char *dp, NGR_R_COPY_ARGS)
+{
+#if NGR_R_PRIVATE == 2
+	struct private *p = buf;
+#endif
 	char *cp;
 	int n;
 	int len;
@@ -130,12 +164,20 @@ copy_protoent(char **machinep, char **userp, char **domainp,
 	if (up != NULL) len += strlen(up) + 1;
 	if (dp != NULL) len += strlen(dp) + 1;
 	
-#ifdef NGR_R_PRIVATE
-	free(*buf);
+#if NGR_R_PRIVATE == 1
+	if (*buf != NULL)
+		free(*buf);
 	*buf = malloc(len);
 	if (*buf == NULL)
 		return(NGR_R_BAD);
 	cp = *buf;
+#elif NGR_R_PRIVATE == 2
+	if (p->buf)
+		free(p->buf);
+	p->buf = malloc(len);
+	if (p->buf == NULL)
+		return(NGR_R_BAD);
+	cp = p->buf;
 #else
 	if (len > (int)buflen) {
 		errno = ERANGE;
@@ -144,7 +186,6 @@ copy_protoent(char **machinep, char **userp, char **domainp,
 	cp = buf;
 #endif
 
-
 	if (mp != NULL) {
 		n = strlen(mp) + 1;
 		strcpy(cp, mp);
diff --git a/lib/bind/irs/irp.c b/lib/bind/irs/irp.c
index 85a053d7e6f8..aae4e7bb627b 100644
--- a/lib/bind/irs/irp.c
+++ b/lib/bind/irs/irp.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: irp.c,v 1.6.18.3 2006/03/10 00:20:08 marka Exp $";
+static const char rcsid[] = "$Id: irp.c,v 1.6.18.5 2008/02/28 05:49:37 marka Exp $";
 #endif
 
 /* Imports */
@@ -528,7 +528,8 @@ irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...) {
 	}
 
 	va_start(ap, fmt);
-	todo = vsprintf(buffer, fmt, ap);
+	(void) vsprintf(buffer, fmt, ap);
+	todo = strlen(buffer);
 	va_end(ap);
 	if (todo > (int)sizeof(buffer) - 3) {
 		syslog(LOG_CRIT, "memory overrun in irs_irp_send_command()");
diff --git a/lib/bind/isc/Makefile.in b/lib/bind/isc/Makefile.in
index 3cbb640f99ff..70b0548eccae 100644
--- a/lib/bind/isc/Makefile.in
+++ b/lib/bind/isc/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.7 2004/03/05 05:05:38 marka Exp $
+# $Id: Makefile.in,v 1.7.18.2 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -30,6 +30,6 @@ SRCS=	assertions.c base64.c bitncmp.c ctl_clnt.c ctl_p.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/isc/assertions.c b/lib/bind/isc/assertions.c
index c03464d2b332..e4bd42ab6ed2 100644
--- a/lib/bind/isc/assertions.c
+++ b/lib/bind/isc/assertions.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: assertions.c,v 1.2.18.1 2005/04/27 05:01:05 sra Exp $";
+static const char rcsid[] = "$Id: assertions.c,v 1.2.18.2 2008/10/15 03:57:21 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -78,6 +78,7 @@ assertion_type_to_text(assertion_type type) {
  * Private.
  */
 
+/* coverity[+kill] */
 static void
 default_assertion_failed(const char *file, int line, assertion_type type,
 			 const char *cond, int print_errno)
diff --git a/lib/bind/isc/bitncmp.c b/lib/bind/isc/bitncmp.c
index 8764db19cd9d..9bbbd24ab263 100644
--- a/lib/bind/isc/bitncmp.c
+++ b/lib/bind/isc/bitncmp.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: bitncmp.c,v 1.2.18.1 2005/04/27 05:01:05 sra Exp $";
+static const char rcsid[] = "$Id: bitncmp.c,v 1.2.18.2 2008/05/12 00:21:22 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -48,7 +48,7 @@ bitncmp(const void *l, const void *r, int n) {
 
 	b = n / 8;
 	x = memcmp(l, r, b);
-	if (x)
+	if (x || (n % 8) == 0)
 		return (x);
 
 	lb = ((const u_char *)l)[b];
diff --git a/lib/bind/isc/ctl_clnt.c b/lib/bind/isc/ctl_clnt.c
index eca8e7fc05a6..7627200b56b0 100644
--- a/lib/bind/isc/ctl_clnt.c
+++ b/lib/bind/isc/ctl_clnt.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.2 2007/05/18 06:24:39 marka Exp $";
+static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.3 2008/02/18 04:04:06 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -38,6 +38,9 @@ static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.2 2007/05/18 06:24:39 mark
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
+#ifdef HAVE_MEMORY_H
+#include <memory.h>
+#endif
 
 #include <isc/assertions.h>
 #include <isc/ctl.h>
diff --git a/lib/bind/isc/ctl_srvr.c b/lib/bind/isc/ctl_srvr.c
index 52137c077d36..1ab3f8aa243f 100644
--- a/lib/bind/isc/ctl_srvr.c
+++ b/lib/bind/isc/ctl_srvr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_srvr.c,v 1.6.18.2 2006/12/07 04:53:02 marka Exp $";
+static const char rcsid[] = "$Id: ctl_srvr.c,v 1.6.18.3 2008/02/18 04:04:06 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -40,6 +40,9 @@ static const char rcsid[] = "$Id: ctl_srvr.c,v 1.6.18.2 2006/12/07 04:53:02 mark
 #include <time.h>
 #include <unistd.h>
 #include <fcntl.h>
+#ifdef HAVE_MEMORY_H
+#include <memory.h>
+#endif
 
 #include <isc/assertions.h>
 #include <isc/ctl.h>
diff --git a/lib/bind/isc/logging.c b/lib/bind/isc/logging.c
index ca7049c74eb6..0cabc4d27220 100644
--- a/lib/bind/isc/logging.c
+++ b/lib/bind/isc/logging.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: logging.c,v 1.6.18.1 2005/04/27 05:01:07 sra Exp $";
+static const char rcsid[] = "$Id: logging.c,v 1.6.18.2 2008/02/28 05:49:37 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -43,12 +43,6 @@ static const char rcsid[] = "$Id: logging.c,v 1.6.18.1 2005/04/27 05:01:07 sra E
 
 #include "port_after.h"
 
-#ifdef VSPRINTF_CHAR
-# define VSPRINTF(x) strlen(vsprintf/**/x)
-#else
-# define VSPRINTF(x) ((size_t)vsprintf x)
-#endif
-
 #include "logging_p.h"
 
 static const int syslog_priority[] = { LOG_DEBUG, LOG_INFO, LOG_NOTICE,
@@ -363,8 +357,8 @@ log_vwrite(log_context lc, int category, int level, const char *format,
 			continue;
 
 		if (!did_vsprintf) {
-			if (VSPRINTF((lc->buffer, format, args)) >
-			    (size_t)LOG_BUFFER_SIZE) {
+			(void)vsprintf(lc->buffer, format, args);
+			if (strlen(lc->buffer) > (size_t)LOG_BUFFER_SIZE) {
 				syslog(LOG_CRIT,
 				       "memory overrun in log_vwrite()");
 				exit(1);
diff --git a/lib/bind/nameser/Makefile.in b/lib/bind/nameser/Makefile.in
index d033eee1ea08..fcb7ed725c0e 100644
--- a/lib/bind/nameser/Makefile.in
+++ b/lib/bind/nameser/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5 2004/03/16 05:22:19 marka Exp $
+# $Id: Makefile.in,v 1.5.18.2 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -26,6 +26,6 @@ SRCS=	ns_date.c ns_name.c ns_netint.c ns_parse.c ns_print.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/port_after.h.in b/lib/bind/port_after.h.in
index f248d23f5614..daddae6cdf46 100644
--- a/lib/bind/port_after.h.in
+++ b/lib/bind/port_after.h.in
@@ -16,12 +16,20 @@
 #include <sys/select.h>
 #endif /* HAVE_SYS_SELECT_H */
 
+#ifdef REENABLE_SEND
+#undef send
+#endif
+
 @NEED_PSELECT@
 @HAVE_SA_LEN@
 @HAVE_MINIMUM_IFREQ@
 @NEED_DAEMON@
 @NEED_STRSEP@
 @NEED_STRERROR@
+#ifdef NEED_STRERROR
+const char *isc_strerror(int);
+#define strerror isc_strerror
+#endif
 @HAS_INET6_STRUCTS@
 @HAVE_SIN6_SCOPE_ID@
 @NEED_IN6ADDR_ANY@
@@ -30,12 +38,18 @@
 @NEED_GETTIMEOFDAY@
 @HAVE_STRNDUP@
 @USE_FIONBIO_IOCTL@
-@USE_SYSERROR_LIST@
 @INNETGR_ARGS@
 @SETNETGRENT_ARGS@
 @USE_IFNAMELINKID@
 @PORT_NONBLOCK@
 
+#ifndef _POSIX_PATH_MAX
+#define _POSIX_PATH_MAX 255
+#endif
+#ifndef PATH_MAX
+#define PATH_MAX _POSIX_PATH_MAX
+#endif
+
 /*
  * We need to know the IPv6 address family number even on IPv4-only systems.
  * Note that this is NOT a protocol constant, and that if the system has its
@@ -309,16 +323,16 @@ innetgr_r(const char *, const char *, const char *, const char *);
 #endif
 
 #ifdef NEED_SETNETGRENT_R
-#ifdef NGR_R_ENT_ARGS
-NGR_R_SET_RETURN setnetgrent_r(const char *netgroup, NGR_R_ENT_ARGS);
+#ifdef NGR_R_SET_ARGS
+NGR_R_SET_RETURN setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS);
 #else
-NGR_R_SET_RETURN setnetgrent_r(const char *netgroup);
+NGR_R_SET_RETURN setnetgrent_r(NGR_R_SET_CONST char *netgroup);
 #endif
 #endif
 
 #ifdef NEED_ENDNETGRENT_R
-#ifdef NGR_R_ENT_ARGS
-NGR_R_END_RETURN endnetgrent_r(NGR_R_ENT_ARGS);
+#ifdef NGR_R_END_ARGS
+NGR_R_END_RETURN endnetgrent_r(NGR_R_END_ARGS);
 #else
 NGR_R_END_RETURN endnetgrent_r(void);
 #endif
@@ -384,10 +398,12 @@ int isc__gettimeofday(struct timeval *tvp, struct _TIMEZONE *tzp);
 int isc__gettimeofday(struct timeval *tp, struct timezone *tzp);
 #endif
 
-int getnetgrent(char **machinep, char **userp, char **domainp);
+int getnetgrent(NGR_R_CONST char **machinep, NGR_R_CONST char **userp,
+	        NGR_R_CONST char **domainp);
 
 #ifdef NGR_R_ARGS
-int getnetgrent_r(char **machinep, char **userp, char **domainp, NGR_R_ARGS);
+int getnetgrent_r(NGR_R_CONST char **machinep, NGR_R_CONST char **userp, 
+		  NGR_R_CONST char **domainp, NGR_R_ARGS);
 #endif
 
 #ifdef SETNETGRENT_ARGS
@@ -405,11 +421,87 @@ int innetgr(const char *netgroup, const char *machine,
 	    const char *user, const char *domain);
 #endif
 
-#ifdef NGR_R_ENT_ARGS
+#ifdef NGR_R_SET_ARGS
 NGR_R_SET_RETURN
-setnetgrent_r(const char *netgroup, NGR_R_ENT_ARGS);
+setnetgrent_r(NGR_R_SET_CONST char *netgroup, NGR_R_SET_ARGS);
 #else
 NGR_R_SET_RETURN
-setnetgrent_r(const char *netgroup);
+setnetgrent_r(NGR_R_SET_CONST char *netgroup);
+#endif
+
+#ifdef NEED_STRTOUL
+unsigned long strtoul(const char *, char **, int);
+#endif
+
+#ifdef NEED_SUN4PROTOS
+#include <stdarg.h>
+#ifndef __SIZE_TYPE__
+#define __SIZE_TYPE__ int
+#endif
+struct sockaddr;
+struct iovec;
+struct timeval;
+struct timezone;
+int fprintf(FILE *, const char *, ...);
+int getsockname(int, struct sockaddr *, int *);
+int getpeername(int, struct sockaddr *, int *);
+int socket(int, int, int);
+int connect(int, const struct sockaddr *, int);
+int writev(int, struct iovec *, int);
+int readv(int, struct iovec *, int);
+int send(int, const char *, int, int);
+void bzero(char *, int);
+int recvfrom(int, char *, int, int, struct sockaddr *, int *);
+int syslog(int, const char *, ... );
+int printf(const char *, ...);
+__SIZE_TYPE__ fread(void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+__SIZE_TYPE__ fwrite(const void *, __SIZE_TYPE__, __SIZE_TYPE__, FILE *);
+int fclose(FILE *);
+int ungetc(int, FILE *);
+int scanf(const char *, ...);
+int sscanf(const char *, const char *, ... );
+int tolower(int);
+int toupper(int);
+int strcasecmp(const char *, const char *);
+int strncasecmp(const char *, const char *, int);
+int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+#ifdef gettimeofday
+#undef gettimeofday
+int gettimeofday(struct timeval *, struct timezone *);
+#define gettimeofday isc__gettimeofday
+#else
+int gettimeofday(struct timeval *, struct timezone *);
+#endif
+long strtol(const char*, char **, int);
+int fseek(FILE *, long, int);
+int setsockopt(int, int, int, const char *, int);
+int bind(int, const struct sockaddr *, int);
+void bcopy(char *, char *, int);
+int fputc(char, FILE *);
+int listen(int, int);
+int accept(int, struct sockaddr *, int *);
+int getsockopt(int, int, int, char *, int *);
+int vfprintf(FILE *, const char *, va_list);
+int fflush(FILE *);
+int fgetc(FILE *);
+int fputs(const char *, FILE *);
+int fchown(int, int, int);
+void setbuf(FILE *, char *);
+int gethostname(char *, int);
+int rename(const char *, const char *);
+time_t time(time_t *);
+int fscanf(FILE *, const char *, ...);
+int sscanf(const char *, const char *, ...);
+int ioctl(int, int, caddr_t);
+void perror(const char *);
+
+#if !defined(__USE_FIXED_PROTOTYPES__) && !defined(__cplusplus) && !defined(__STRICT_ANSI__)
+/*
+ * 'gcc -ansi' changes the prototype for vsprintf().
+ * Use this prototype when 'gcc -ansi' is not in effect.
+ */
+char *vsprintf(char *, const char *, va_list);
 #endif
+#endif 
+
 #endif
diff --git a/lib/bind/port_before.h.in b/lib/bind/port_before.h.in
index 1f6ff1a00b9c..eb0c3fc9ba33 100644
--- a/lib/bind/port_before.h.in
+++ b/lib/bind/port_before.h.in
@@ -2,6 +2,10 @@
 #define port_before_h
 #include <config.h>
 
+#ifdef NEED_SUN4PROTOS
+#define _PARAMS(x) x
+#endif
+
 struct group;           /* silence warning */
 struct passwd;          /* silence warning */
 struct timeval;         /* silence warning */
@@ -81,15 +85,22 @@ struct timespec {
 @NGR_R_BAD@
 @NGR_R_COPY@
 @NGR_R_COPY_ARGS@
+@NGR_R_CONST@
 @NGR_R_END_RESULT@
 @NGR_R_END_RETURN@
-@NGR_R_ENT_ARGS@
+@NGR_R_END_ARGS@
 @NGR_R_OK@
 @NGR_R_RETURN@
+@NGR_R_SET_CONST@
 @NGR_R_SET_RESULT@
 @NGR_R_SET_RETURN@
+@NGR_R_SET_ARGS@
 @NGR_R_PRIVATE@
 
+#if !defined(NGR_R_SET_ARGS) && defined(NGR_R_END_ARGS)
+#define NGR_R_SET_ARGS NGR_R_END_ARGS
+#endif
+
 @PROTO_R_ARGS@
 @PROTO_R_BAD@
 @PROTO_R_COPY@
diff --git a/lib/bind/resolv/Makefile.in b/lib/bind/resolv/Makefile.in
index cc661b62a7e9..557f02023b08 100644
--- a/lib/bind/resolv/Makefile.in
+++ b/lib/bind/resolv/Makefile.in
@@ -1,7 +1,7 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.18.2 2005/07/29 00:12:55 marka Exp $
+# $Id: Makefile.in,v 1.4.18.4 2008/03/20 23:46:01 tbox Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
@@ -28,7 +28,7 @@ SRCS=	herror.c mtctxres.c res_comp.c res_data.c res_debug.c \
 
 TARGETS= ${OBJS}
 
-CINCLUDES= -I.. -I${srcdir}/../include
+CINCLUDES= -I.. -I../include -I${srcdir}/../include
 CWARNINGS=
 
 @BIND9_MAKE_RULES@
diff --git a/lib/bind/resolv/res_debug.c b/lib/bind/resolv/res_debug.c
index 2ed234e159ed..71dc676a5397 100644
--- a/lib/bind/resolv/res_debug.c
+++ b/lib/bind/resolv/res_debug.c
@@ -95,7 +95,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_debug.c,v 1.10.18.5 2005/07/28 07:38:11 marka Exp $";
+static const char rcsid[] = "$Id: res_debug.c,v 1.10.18.6 2008/04/03 23:15:15 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -189,10 +189,56 @@ do_section(const res_state statp,
 				p_type(ns_rr_type(rr)),
 				p_class(ns_rr_class(rr)));
 		else if (section == ns_s_ar && ns_rr_type(rr) == ns_t_opt) {
+			u_int16_t optcode, optlen, rdatalen = ns_rr_rdlen(rr);
 			u_int32_t ttl = ns_rr_ttl(rr);
+
 			fprintf(file,
 				"; EDNS: version: %u, udp=%u, flags=%04x\n",
 				(ttl>>16)&0xff, ns_rr_class(rr), ttl&0xffff);
+
+			while (rdatalen >= 4) {
+				const u_char *cp = ns_rr_rdata(rr);
+				int i;
+
+				GETSHORT(optcode, cp);
+				GETSHORT(optlen, cp);
+
+				if (optcode == NS_OPT_NSID) {
+					fputs("; NSID: ", file);
+					if (optlen == 0) {
+						fputs("; NSID\n", file);
+					} else {
+						fputs("; NSID: ", file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i])?
+								cp[i] : '.');
+						fputs(")\n", file);
+					}
+				} else {
+					if (optlen == 0) {
+						fprintf(file, "; OPT=%u\n",
+							optcode);
+					} else {
+						fprintf(file, "; OPT=%u: ",
+							optcode);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%02x ",
+								cp[i]);
+						fputs(" (",file);
+						for (i = 0; i < optlen; i++)
+							fprintf(file, "%c",
+								isprint(cp[i]) ?
+									cp[i] : '.');
+						fputs(")\n", file);
+					}
+				}
+				rdatalen -= 4 + optlen;
+			}
 		} else {
 			n = ns_sprintrr(handle, &rr, NULL, NULL,
 					buf, buflen);
@@ -204,7 +250,7 @@ do_section(const res_state statp,
 						buf = malloc(buflen += 1024);
 					if (buf == NULL) {
 						fprintf(file,
-				              ";; memory allocation failure\n");
+					      ";; memory allocation failure\n");
 					      return;
 					}
 					continue;
@@ -381,7 +427,7 @@ const struct res_sym __p_default_section_syms[] = {
 	{ns_s_an,	"ANSWER",	(char *)0},
 	{ns_s_ns,	"AUTHORITY",	(char *)0},
 	{ns_s_ar,	"ADDITIONAL",	(char *)0},
-	{0,             (char *)0,	(char *)0}
+	{0,		(char *)0,	(char *)0}
 };
 
 const struct res_sym __p_update_section_syms[] = {
@@ -389,7 +435,7 @@ const struct res_sym __p_update_section_syms[] = {
 	{S_PREREQ,	"PREREQUISITE",	(char *)0},
 	{S_UPDATE,	"UPDATE",	(char *)0},
 	{S_ADDT,	"ADDITIONAL",	(char *)0},
-	{0,             (char *)0,	(char *)0}
+	{0,		(char *)0,	(char *)0}
 };
 
 const struct res_sym __p_key_syms[] = {
@@ -617,6 +663,7 @@ p_option(u_long option) {
 	case RES_USE_INET6:	return "inet6";
 #ifdef RES_USE_EDNS0	/*%< KAME extension */
 	case RES_USE_EDNS0:	return "edns0";
+	case RES_NSID:		return "nsid";
 #endif
 #ifdef RES_USE_DNAME
 	case RES_USE_DNAME:	return "dname";
diff --git a/lib/bind/resolv/res_mkquery.c b/lib/bind/resolv/res_mkquery.c
index 50e4a9e165d7..049f6c54035a 100644
--- a/lib/bind/resolv/res_mkquery.c
+++ b/lib/bind/resolv/res_mkquery.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_mkquery.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_mkquery.c,v 1.5.18.1 2005/04/27 05:01:11 sra Exp $";
+static const char rcsid[] = "$Id: res_mkquery.c,v 1.5.18.2 2008/04/03 23:15:15 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -203,9 +203,6 @@ res_nmkquery(res_state statp,
 
 #ifdef RES_USE_EDNS0
 /* attach OPT pseudo-RR, as documented in RFC2671 (EDNS0). */
-#ifndef T_OPT
-#define T_OPT	41
-#endif
 
 int
 res_nopt(res_state statp,
@@ -230,13 +227,14 @@ res_nopt(res_state statp,
 	if ((ep - cp) < 1 + RRFIXEDSZ)
 		return (-1);
 
-	*cp++ = 0;	/*%< "." */
-	ns_put16(T_OPT, cp);	/*%< TYPE */
+	*cp++ = 0;				/*%< "." */
+	ns_put16(ns_t_opt, cp);			/*%< TYPE */
 	cp += INT16SZ;
-	ns_put16(anslen & 0xffff, cp);	/*%< CLASS = UDP payload size */
+	ns_put16(anslen & 0xffff, cp);		/*%< CLASS = UDP payload size */
 	cp += INT16SZ;
-	*cp++ = NOERROR;	/*%< extended RCODE */
-	*cp++ = 0;		/*%< EDNS version */
+	*cp++ = NOERROR;			/*%< extended RCODE */
+	*cp++ = 0;				/*%< EDNS version */
+
 	if (statp->options & RES_USE_DNSSEC) {
 #ifdef DEBUG
 		if (statp->options & RES_DEBUG)
@@ -246,12 +244,60 @@ res_nopt(res_state statp,
 	}
 	ns_put16(flags, cp);
 	cp += INT16SZ;
-	ns_put16(0, cp);	/*%< RDLEN */
+
+	ns_put16(0U, cp);			/*%< RDLEN */
 	cp += INT16SZ;
+
 	hp->arcount = htons(ntohs(hp->arcount) + 1);
 
 	return (cp - buf);
 }
+
+/*
+ * Construct variable data (RDATA) block for OPT psuedo-RR, append it
+ * to the buffer, then update the RDLEN field (previously set to zero by
+ * res_nopt()) with the new RDATA length.
+ */
+int
+res_nopt_rdata(res_state statp,
+	  int n0,	 	/*%< current offset in buffer */
+	  u_char *buf,	 	/*%< buffer to put query */
+	  int buflen,		/*%< size of buffer */
+	  u_char *rdata,	/*%< ptr to start of opt rdata */
+	  u_short code,		/*%< OPTION-CODE */
+	  u_short len,		/*%< OPTION-LENGTH */
+	  u_char *data)		/*%< OPTION_DATA */
+{
+	register u_char *cp, *ep;
+
+#ifdef DEBUG
+	if ((statp->options & RES_DEBUG) != 0U)
+		printf(";; res_nopt_rdata()\n");
+#endif
+
+	cp = buf + n0;
+	ep = buf + buflen;
+
+	if ((ep - cp) < (4 + len))
+		return (-1);
+
+	if (rdata < (buf + 2) || rdata >= ep)
+		return (-1);
+
+	ns_put16(code, cp);
+	cp += INT16SZ;
+
+	ns_put16(len, cp);
+	cp += INT16SZ;
+
+	memcpy(cp, data, len);
+	cp += len;
+
+	len = cp - rdata;
+	ns_put16(len, rdata - 2);	/* Update RDLEN field */
+
+	return (cp - buf);
+}
 #endif
 
 /*! \file */
diff --git a/lib/bind/resolv/res_query.c b/lib/bind/resolv/res_query.c
index c160e939cdf0..8c01cb007ba7 100644
--- a/lib/bind/resolv/res_query.c
+++ b/lib/bind/resolv/res_query.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_query.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_query.c,v 1.7.18.1 2005/04/27 05:01:11 sra Exp $";
+static const char rcsid[] = "$Id: res_query.c,v 1.7.18.2 2008/04/03 23:15:15 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -116,8 +116,9 @@ res_nquery(res_state statp,
 {
 	u_char buf[MAXPACKET];
 	HEADER *hp = (HEADER *) answer;
-	int n;
 	u_int oflags;
+	u_char *rdata;
+	int n;
 
 	oflags = statp->_flags;
 
@@ -132,8 +133,14 @@ again:
 			 buf, sizeof(buf));
 #ifdef RES_USE_EDNS0
 	if (n > 0 && (statp->_flags & RES_F_EDNS0ERR) == 0 &&
-	    (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC)) != 0U)
+	    (statp->options & (RES_USE_EDNS0|RES_USE_DNSSEC|RES_NSID))) {
 		n = res_nopt(statp, n, buf, sizeof(buf), anslen);
+		rdata = &buf[n];
+		if (n > 0 && (statp->options & RES_NSID) != 0U) {
+			n = res_nopt_rdata(statp, n, buf, sizeof(buf), rdata,
+					   NS_OPT_NSID, 0, NULL);
+		}
+	}
 #endif
 	if (n <= 0) {
 #ifdef DEBUG
@@ -143,6 +150,7 @@ again:
 		RES_SET_H_ERRNO(statp, NO_RECOVERY);
 		return (n);
 	}
+
 	n = res_nsend(statp, buf, n, answer, anslen);
 	if (n < 0) {
 #ifdef RES_USE_EDNS0
diff --git a/lib/bind/resolv/res_send.c b/lib/bind/resolv/res_send.c
index 39dc998da797..5154fe2720e2 100644
--- a/lib/bind/resolv/res_send.c
+++ b/lib/bind/resolv/res_send.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_send.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_send.c,v 1.9.18.8 2006/10/16 23:00:58 marka Exp $";
+static const char rcsid[] = "$Id: res_send.c,v 1.9.18.10 2008/01/27 02:06:26 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*! \file
@@ -293,7 +293,7 @@ int
 res_nsend(res_state statp,
 	  const u_char *buf, int buflen, u_char *ans, int anssiz)
 {
-	int gotsomewhere, terrno, try, v_circuit, resplen, ns, n;
+	int gotsomewhere, terrno, tries, v_circuit, resplen, ns, n;
 	char abuf[NI_MAXHOST];
 
 #ifdef USE_POLL
@@ -405,7 +405,7 @@ res_nsend(res_state statp,
 	/*
 	 * Send request, RETRY times, or until successful.
 	 */
-	for (try = 0; try < statp->retry; try++) {
+	for (tries = 0; tries < statp->retry; tries++) {
 	    for (ns = 0; ns < statp->nscount; ns++) {
 		struct sockaddr *nsap;
 		int nsaplen;
@@ -453,7 +453,7 @@ res_nsend(res_state statp,
 
 		if (v_circuit) {
 			/* Use VC; at most one attempt per server. */
-			try = statp->retry;
+			tries = statp->retry;
 			n = send_vc(statp, buf, buflen, ans, anssiz, &terrno,
 				    ns);
 			if (n < 0)
@@ -464,7 +464,7 @@ res_nsend(res_state statp,
 		} else {
 			/* Use datagrams. */
 			n = send_dg(statp, buf, buflen, ans, anssiz, &terrno,
-				    ns, try, &v_circuit, &gotsomewhere);
+				    ns, tries, &v_circuit, &gotsomewhere);
 			if (n < 0)
 				goto fail;
 			if (n == 0)
@@ -601,6 +601,9 @@ send_vc(res_state statp,
 	u_short len;
 	u_char *cp;
 	void *tmp;
+#ifdef SO_NOSIGPIPE
+	int on = 1;
+#endif
 
 	nsap = get_nsaddr(statp, ns);
 	nsaplen = get_salen(nsap);
@@ -646,6 +649,17 @@ send_vc(res_state statp,
 				return (-1);
 			}
 		}
+#ifdef SO_NOSIGPIPE
+		/*
+		 * Disable generation of SIGPIPE when writing to a closed
+		 * socket.  Write should return -1 and set errno to EPIPE
+		 * instead. 
+		 *
+		 * Push on even if setsockopt(SO_NOSIGPIPE) fails.
+		 */
+		(void)setsockopt(statp->_vcsock, SOL_SOCKET, SO_NOSIGPIPE, &on,
+			         sizeof(on));
+#endif
 		errno = 0;
 		if (connect(statp->_vcsock, nsap, nsaplen) < 0) {
 			*terrno = errno;
@@ -773,7 +787,7 @@ send_vc(res_state statp,
 
 static int
 send_dg(res_state statp, const u_char *buf, int buflen, u_char *ans,
-	int anssiz, int *terrno, int ns, int try, int *v_circuit,
+	int anssiz, int *terrno, int ns, int tries, int *v_circuit,
 	int *gotsomewhere)
 {
 	const HEADER *hp = (const HEADER *) buf;
@@ -855,7 +869,7 @@ send_dg(res_state statp, const u_char *buf, int buflen, u_char *ans,
 	/*
 	 * Wait for reply.
 	 */
-	seconds = (statp->retrans << try);
+	seconds = (statp->retrans << tries);
 	if (ns > 0)
 		seconds /= statp->nscount;
 	if (seconds <= 0)
diff --git a/lib/bind9/api b/lib/bind9/api
index 93632d140408..3a74aee14444 100644
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 31
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 1
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 6cfdc93c6141..2967650ef055 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.44.18.35 2007/09/13 05:04:01 each Exp $ */
+/* $Id: check.c,v 1.44.18.41 2008/03/29 23:46:10 tbox Exp $ */
 
 /*! \file */
 
@@ -222,13 +222,24 @@ check_dual_stack(const cfg_obj_t *options, isc_log_t *logctx) {
 }
 
 static isc_result_t
-check_forward(const cfg_obj_t *options, isc_log_t *logctx) {
+check_forward(const cfg_obj_t *options,  const cfg_obj_t *global,
+	      isc_log_t *logctx)
+{
 	const cfg_obj_t *forward = NULL;
 	const cfg_obj_t *forwarders = NULL;
 
 	(void)cfg_map_get(options, "forward", &forward);
 	(void)cfg_map_get(options, "forwarders", &forwarders);
 
+	if (forwarders != NULL && global != NULL) {
+		const char *file = cfg_obj_file(global);
+		unsigned int line = cfg_obj_line(global);
+		cfg_obj_log(forwarders, logctx, ISC_LOG_ERROR,
+			    "forwarders declared in root zone and "
+			    "in general configuration: %s:%u",
+			    file, line);
+		return (ISC_R_FAILURE);
+	}
 	if (forward != NULL && forwarders == NULL) {
 		cfg_obj_log(forward, logctx, ISC_LOG_ERROR,
 			    "no matching 'forwarders' statement");
@@ -391,7 +402,7 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 {
 	isc_result_t result = ISC_R_SUCCESS, tresult;
 	int i = 0;
-	
+
 	static const char *acls[] = { "allow-query", "allow-query-cache",
 		"allow-recursion", "blackhole", "match-clients",
 		"match-destinations", "sortlist", NULL };
@@ -400,7 +411,7 @@ check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 		tresult = checkacl(acls[i++], actx, NULL, voptions, config,
 				   logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
-			result = tresult;  
+			result = tresult;
 	}
 	return (result);
 }
@@ -464,8 +475,8 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 	(void)cfg_map_get(options, "preferred-glue", &obj);
 	if (obj != NULL) {
 		const char *str;
-                str = cfg_obj_asstring(obj);
-                if (strcasecmp(str, "a") != 0 &&
+		str = cfg_obj_asstring(obj);
+		if (strcasecmp(str, "a") != 0 &&
 		    strcasecmp(str, "aaaa") != 0 &&
 		    strcasecmp(str, "none") != 0)
 			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
@@ -494,7 +505,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 				isc_buffer_add(&b, strlen(str));
 				tresult = dns_name_fromtext(name, &b,
 							   dns_rootname,
-                                                           ISC_FALSE, NULL);
+							   ISC_FALSE, NULL);
 				if (tresult != ISC_R_SUCCESS) {
 					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 						    "bad domain name '%s'",
@@ -504,7 +515,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 			}
 		}
 	}
-       
+
 	/*
 	 * Set supported DNSSEC algorithms.
 	 */
@@ -552,6 +563,7 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 					    "bad domain name '%s'", dlv);
 				result = tresult;
+				continue;
 			}
 			if (symtab != NULL) {
 				tresult = nameexist(obj, dlv, 1, symtab,
@@ -699,7 +711,7 @@ get_masters_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret)
 
 static isc_result_t
 validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
-	         isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx)
+		 isc_uint32_t *countp, isc_log_t *logctx, isc_mem_t *mctx)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
@@ -721,7 +733,7 @@ validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
  newlist:
 	list = cfg_tuple_get(obj, "addresses");
 	element = cfg_list_first(list);
- resume:	
+ resume:
 	for ( ;
 	     element != NULL;
 	     element = cfg_list_next(element))
@@ -818,7 +830,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 		isc_buffer_init(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
-                                            dns_rootname, ISC_FALSE, NULL);
+					    dns_rootname, ISC_FALSE, NULL);
 		if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, logctx, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -851,7 +863,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			const cfg_obj_t *typeobj;
 			isc_textregion_t r;
 			dns_rdatatype_t type;
-			
+
 			typeobj = cfg_listelt_value(element2);
 			DE_CONST(cfg_obj_asstring(typeobj), r.base);
 			r.length = strlen(r.base);
@@ -859,7 +871,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			tresult = dns_rdatatype_fromtext(&type, &r);
 			if (tresult != ISC_R_SUCCESS) {
 				cfg_obj_log(typeobj, logctx, ISC_LOG_ERROR,
-                                            "'%s' is not a valid type", r.base);
+					    "'%s' is not a valid type", r.base);
 				result = tresult;
 			}
 		}
@@ -897,6 +909,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	dns_rdataclass_t zclass;
 	dns_fixedname_t fixedname;
 	isc_buffer_t b;
+	isc_boolean_t root = ISC_FALSE;
 
 	static optionstable options[] = {
 	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | CHECKACL },
@@ -1014,21 +1027,24 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	isc_buffer_init(&b, zname, strlen(zname));
 	isc_buffer_add(&b, strlen(zname));
 	tresult = dns_name_fromtext(dns_fixedname_name(&fixedname), &b,
-				   dns_rootname, ISC_TRUE, NULL);
-	if (result != ISC_R_SUCCESS) {
+				    dns_rootname, ISC_TRUE, NULL);
+	if (tresult != ISC_R_SUCCESS) {
 		cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
 			    "zone '%s': is not a valid name", zname);
-		tresult = ISC_R_FAILURE;
+		result = ISC_R_FAILURE;
 	} else {
 		char namebuf[DNS_NAME_FORMATSIZE];
 
 		dns_name_format(dns_fixedname_name(&fixedname),
 				namebuf, sizeof(namebuf));
 		tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 : 2,
-				   symtab, "zone '%s': already exists "
-				   "previous definition: %s:%u", logctx, mctx);
+				    symtab, "zone '%s': already exists "
+				    "previous definition: %s:%u", logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
+		if (dns_name_equal(dns_fixedname_name(&fixedname),
+				   dns_rootname))
+			root = ISC_TRUE;
 	}
 
 	/*
@@ -1059,7 +1075,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		    (options[i].allowed & CHECKACL) != 0) {
 
 			tresult = checkacl(options[i].name, actx, zconfig,
-				           voptions, config, logctx, mctx);
+					   voptions, config, logctx, mctx);
 			if (tresult != ISC_R_SUCCESS)
 				result = tresult;
 		}
@@ -1148,7 +1164,18 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	/*
 	 * Check that forwarding is reasonable.
 	 */
-	if (check_forward(zoptions, logctx) != ISC_R_SUCCESS)
+	obj = NULL;
+	if (root) {
+		if (voptions != NULL)
+			(void)cfg_map_get(voptions, "forwarders", &obj);
+		if (obj == NULL) {
+			const cfg_obj_t *options = NULL;
+			(void)cfg_map_get(config, "options", &options);
+			if (options != NULL)
+				(void)cfg_map_get(options, "forwarders", &obj);
+		}
+	}
+	if (check_forward(zoptions, obj, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
 	/*
@@ -1178,7 +1205,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			result = tresult;
 		}
 	}
-	
+
 	return (result);
 }
 
@@ -1207,7 +1234,7 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 		{ "hmac-sha512", 512 },
 		{  NULL, 0 }
 	};
-	
+
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
 	if (secretobj == NULL || algobj == NULL) {
@@ -1258,7 +1285,7 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 			     (digestbits < 80U)))
 				cfg_obj_log(algobj, logctx, ISC_LOG_WARNING,
 					    "key '%s' digest-bits too small "
-					    "[<%u]", keyname, 
+					    "[<%u]", keyname,
 					    algorithms[i].size/2);
 		} else {
 			cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
@@ -1389,7 +1416,7 @@ check_servers(const cfg_obj_t *servers, isc_log_t *logctx) {
 	}
 	return (result);
 }
-		
+
 static isc_result_t
 check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	       dns_rdataclass_t vclass, isc_log_t *logctx, isc_mem_t *mctx)
@@ -1452,7 +1479,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		isc_symtab_destroy(&symtab);
 		return (tresult);
 	}
-	
+
 	if (voptions != NULL) {
 		keys = NULL;
 		(void)cfg_map_get(voptions, "key", &keys);
@@ -1474,10 +1501,11 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
-			if (check_forward(options, logctx) != ISC_R_SUCCESS)
+			if (check_forward(options, NULL,
+					  logctx) != ISC_R_SUCCESS)
 				result = ISC_R_FAILURE;
 	} else {
-		if (check_forward(voptions, logctx) != ISC_R_SUCCESS)
+		if (check_forward(voptions, NULL, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 	/*
@@ -1574,10 +1602,10 @@ bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
 	const char *channelname;
 	const char *catname;
 	const cfg_obj_t *fileobj = NULL;
-        const cfg_obj_t *syslogobj = NULL;
-        const cfg_obj_t *nullobj = NULL;
-        const cfg_obj_t *stderrobj = NULL;
-        const cfg_obj_t *logobj = NULL;
+	const cfg_obj_t *syslogobj = NULL;
+	const cfg_obj_t *nullobj = NULL;
+	const cfg_obj_t *stderrobj = NULL;
+	const cfg_obj_t *logobj = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 	isc_symtab_t *symtab = NULL;
@@ -1638,9 +1666,9 @@ bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
 	cfg_map_get(logobj, "category", &categories);
 
 	for (element = cfg_list_first(categories);
-             element != NULL;
-             element = cfg_list_next(element))
-        {
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
 		category = cfg_listelt_value(element);
 		catname = cfg_obj_asstring(cfg_tuple_get(category, "name"));
 		if (isc_log_categorybyname(logctx, catname) == NULL) {
@@ -1656,7 +1684,7 @@ bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
 			channel = cfg_listelt_value(delement);
 			channelname = cfg_obj_asstring(channel);
 			tresult = isc_symtab_lookup(symtab, channelname, 1,
-                                          	    &symvalue);
+						    &symvalue);
 			if (tresult != ISC_R_SUCCESS) {
 				cfg_obj_log(channel, logctx, ISC_LOG_ERROR,
 					    "undefined channel: '%s'",
@@ -1674,12 +1702,12 @@ key_exists(const cfg_obj_t *keylist, const char *keyname) {
 	const cfg_listelt_t *element;
 	const char *str;
 	const cfg_obj_t *obj;
-	
+
 	if (keylist == NULL)
 		return (ISC_R_NOTFOUND);
 	for (element = cfg_list_first(keylist);
-	     element != NULL;   
-	     element = cfg_list_next(element)) 
+	     element != NULL;
+	     element = cfg_list_next(element))
 	{
 		obj = cfg_listelt_value(element);
 		str = cfg_obj_asstring(cfg_map_getname(obj));
@@ -1697,7 +1725,7 @@ bind9_check_controlskeys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	const cfg_obj_t *control_keylist;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *key;
-	
+
 	control_keylist = cfg_tuple_get(control, "keys");
 	if (cfg_obj_isvoid(control_keylist))
 		return (ISC_R_SUCCESS);
@@ -1849,7 +1877,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 	if (bind9_check_controls(config, logctx, mctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
-	if (options != NULL && 
+	if (options != NULL &&
 	    check_order(options, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
@@ -1911,7 +1939,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 				const char *file;
 				unsigned int line;
 				RUNTIME_CHECK(isc_symtab_lookup(symtab, key,
-				           vclass, &symvalue) == ISC_R_SUCCESS);
+					   vclass, &symvalue) == ISC_R_SUCCESS);
 				file = cfg_obj_file(symvalue.as_cpointer);
 				line = cfg_obj_line(symvalue.as_cpointer);
 				cfg_obj_log(view, logctx, ISC_LOG_ERROR,
@@ -1919,7 +1947,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 					    "previous definition: %s:%u",
 					    key, file, line);
 				result = tresult;
-			} else if (result != ISC_R_SUCCESS) {
+			} else if (tresult != ISC_R_SUCCESS) {
 				result = tresult;
 			} else if ((strcasecmp(key, "_bind") == 0 &&
 				    vclass == dns_rdataclass_ch) ||
@@ -1951,8 +1979,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 		}
 	}
 
-        tresult = cfg_map_get(config, "acl", &acls);
-        if (tresult == ISC_R_SUCCESS) {
+	tresult = cfg_map_get(config, "acl", &acls);
+	if (tresult == ISC_R_SUCCESS) {
 		const cfg_listelt_t *elt;
 		const cfg_listelt_t *elt2;
 		const char *aclname;
@@ -1971,7 +1999,7 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 					cfg_obj_log(acl, logctx, ISC_LOG_ERROR,
 						    "attempt to redefine "
 						    "builtin acl '%s'",
-				    		    aclname);
+						    aclname);
 					result = ISC_R_FAILURE;
 					break;
 				}
@@ -2001,8 +2029,8 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 		}
 	}
 
-        tresult = cfg_map_get(config, "kal", &kals);
-        if (tresult == ISC_R_SUCCESS) {
+	tresult = cfg_map_get(config, "kal", &kals);
+	if (tresult == ISC_R_SUCCESS) {
 		const cfg_listelt_t *elt;
 		const cfg_listelt_t *elt2;
 		const char *aclname;
diff --git a/lib/dns/acache.c b/lib/dns/acache.c
index 5787a5a79fe3..cd56c3c8bbff 100644
--- a/lib/dns/acache.c
+++ b/lib/dns/acache.c
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acache.c,v 1.3.2.16 2006/07/19 00:34:56 marka Exp $ */
+/* $Id: acache.c,v 1.3.2.18 2008/02/07 23:45:56 tbox Exp $ */
 
 #include <config.h>
 
@@ -137,7 +137,7 @@ struct acache_cleaner {
 						      in seconds. */
 
 	isc_stdtime_t		last_cleanup_time; /* The time when the last
-      						      cleanup task completed */
+						      cleanup task completed */
 
 	isc_timer_t 		*cleaning_timer;
 	isc_event_t		*resched_event;	/* Sent by cleaner task to
@@ -347,11 +347,11 @@ shutdown_buckets(dns_acache_t *acache) {
 			INSIST(ISC_LIST_EMPTY(dbent->originlist) &&
 			       ISC_LIST_EMPTY(dbent->referlist));
 			ISC_LIST_UNLINK(acache->dbbucket[i], dbent, link);
-						
+
 			dns_db_detach(&dbent->db);
 
 			isc_mem_put(acache->mctx, dbent, sizeof(*dbent));
-				    
+
 			acache->dbentries--;
 		}
 	}
@@ -513,7 +513,7 @@ clear_entry(dns_acache_t *acache, dns_acacheentry_t *entry) {
 		if (dns_name_dynamic(entry->foundname))
 			dns_name_free(entry->foundname, acache->mctx);
 		isc_mem_put(acache->mctx, entry->foundname,
-			    sizeof(*entry->foundname)); 
+			    sizeof(*entry->foundname));
 		entry->foundname = NULL;
 	}
 
@@ -558,7 +558,7 @@ acache_cleaner_init(dns_acache_t *acache, isc_timermgr_t *timermgr,
 
 	if (timermgr != NULL) {
 		cleaner->acache->live_cleaners++;
-		
+
 		result = isc_task_onshutdown(acache->task,
 					     acache_cleaner_shutdown_action,
 					     acache);
@@ -677,7 +677,7 @@ end_cleaning(acache_cleaner_t *cleaner, isc_event_t *event) {
 	 */
 	if (isc_refcount_current(&cleaner->current_entry->references) == 1) {
 		INSIST(cleaner->current_entry->callback == NULL);
-		
+
 		if (ISC_LINK_LINKED(cleaner->current_entry, link)) {
 			ISC_LIST_UNLINK(acache->entries,
 					cleaner->current_entry, link);
@@ -701,7 +701,7 @@ end_cleaning(acache_cleaner_t *cleaner, isc_event_t *event) {
 		      acache->stats.queries,
 		      acache->stats.adds, acache->stats.deleted,
 		      acache->stats.cleaned, acache->stats.cleaner_runs,
-		      acache->stats.overmem, acache->stats.overmem_nocreates, 
+		      acache->stats.overmem, acache->stats.overmem_nocreates,
 		      acache->stats.nomem);
 	reset_stats(acache);
 
@@ -913,7 +913,7 @@ static void
 acache_overmem_cleaning_action(isc_task_t *task, isc_event_t *event) {
 	acache_cleaner_t *cleaner = event->ev_arg;
 	isc_boolean_t want_cleaning = ISC_FALSE;
-	
+
 	UNUSED(task);
 
 	INSIST(event->ev_type == DNS_EVENT_ACACHEOVERMEM);
@@ -965,10 +965,14 @@ water(void *arg, int mark) {
 
 	LOCK(&acache->cleaner.lock);
 
-	acache->cleaner.overmem = overmem;
+	if (acache->cleaner.overmem != overmem) {
+		acache->cleaner.overmem = overmem;
 
-	if (acache->cleaner.overmem_event != NULL)
-		isc_task_send(acache->task, &acache->cleaner.overmem_event);
+		if (acache->cleaner.overmem_event != NULL)
+			isc_task_send(acache->task,
+				      &acache->cleaner.overmem_event);
+		isc_mem_waterack(acache->mctx, mark);
+	}
 
 	UNLOCK(&acache->cleaner.lock);
 }
@@ -1102,7 +1106,7 @@ dns_acache_create(dns_acache_t **acachep, isc_mem_t *mctx,
 	}
 
 	acache->live_cleaners = 0;
-	result = acache_cleaner_init(acache, timermgr, &acache->cleaner); 
+	result = acache_cleaner_init(acache, timermgr, &acache->cleaner);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1177,7 +1181,7 @@ dns_acache_detach(dns_acache_t **acachep) {
 		isc_task_shutdown(acache->task);
 		should_free = ISC_FALSE;
 	}
-	
+
 	if (should_free)
 		destroy(acache);
 }
@@ -1366,14 +1370,14 @@ dns_acache_createentry(dns_acache_t *acache, dns_db_t *origdb,
 	REQUIRE(entryp != NULL && *entryp == NULL);
 	REQUIRE(origdb != NULL);
 
-	/* 
-	 * Should we exceed our memory limit for some reason (for 
-	 * example, if the cleaner does not run aggressively enough), 
+	/*
+	 * Should we exceed our memory limit for some reason (for
+	 * example, if the cleaner does not run aggressively enough),
 	 * then we will not create additional entries.
 	 *
 	 * XXXSK: It might be better to lock the acache->cleaner->lock,
-	 * but locking may be an expensive bottleneck. If we misread 
-	 * the value, we will occasionally refuse to create a few 
+	 * but locking may be an expensive bottleneck. If we misread
+	 * the value, we will occasionally refuse to create a few
 	 * cache entries, or create a few that we should not. I do not
 	 * expect this to happen often, and it will not have very bad
 	 * effects when it does. So no lock for now.
@@ -1391,7 +1395,7 @@ dns_acache_createentry(dns_acache_t *acache, dns_db_t *origdb,
 
 	isc_random_get(&r);
 	newentry->locknum = r % DEFAULT_ACACHE_ENTRY_LOCK_COUNT;
-	
+
 	result = isc_refcount_init(&newentry->references, 1);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(acache->mctx, newentry, sizeof(*newentry));
@@ -1738,7 +1742,7 @@ dns_acache_setcleaninginterval(dns_acache_t *acache, unsigned int t) {
 					 isc_timertype_ticker,
 					 NULL, &interval, ISC_FALSE);
 	}
-	if (result != ISC_R_SUCCESS)	
+	if (result != ISC_R_SUCCESS)
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_ACACHE, ISC_LOG_WARNING,
 			      "could not set acache cleaning interval: %s",
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index c65c474530e7..ae5dec85ec33 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.c,v 1.215.18.17 2007/09/11 02:23:26 marka Exp $ */
+/* $Id: adb.c,v 1.215.18.24 2008/10/17 03:35:14 marka Exp $ */
 
-/*! \file 
+/*! \file
  *
  * \note
  * In finds, if task == NULL, no events will be generated, and no events
@@ -71,7 +71,7 @@
 #define DNS_ADBFETCH6_MAGIC	  ISC_MAGIC('a', 'd', 'F', '6')
 #define DNS_ADBFETCH6_VALID(x)	  ISC_MAGIC_VALID(x, DNS_ADBFETCH6_MAGIC)
 
-/*! 
+/*!
  * The number of buckets needs to be a prime (for good hashing).
  *
  * XXXRTH  How many buckets do we need?
@@ -119,6 +119,7 @@ struct dns_adb {
 
 	isc_mutex_t			lock;
 	isc_mutex_t			reflock; /*%< Covers irefcnt, erefcnt */
+	isc_mutex_t                     overmemlock; /*%< Covers overmem */
 	isc_mem_t		       *mctx;
 	dns_view_t		       *view;
 	isc_timermgr_t		       *timermgr;
@@ -494,6 +495,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	isc_boolean_t new_addresses_added;
 	dns_rdatatype_t rdtype;
 	unsigned int findoptions;
+	dns_adbnamehooklist_t *hookhead;
 
 	INSIST(DNS_ADBNAME_VALID(adbname));
 	adb = adbname->adb;
@@ -518,10 +520,12 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 			INSIST(rdata.length == 4);
 			memcpy(&ina.s_addr, rdata.data, 4);
 			isc_sockaddr_fromin(&sockaddr, &ina, 0);
+			hookhead = &adbname->v4;
 		} else {
 			INSIST(rdata.length == 16);
 			memcpy(in6a.s6_addr, rdata.data, 16);
 			isc_sockaddr_fromin6(&sockaddr, &in6a, 0);
+			hookhead = &adbname->v6;
 		}
 
 		INSIST(nh == NULL);
@@ -550,7 +554,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 
 			link_entry(adb, addr_bucket, entry);
 		} else {
-			for (anh = ISC_LIST_HEAD(adbname->v4);
+			for (anh = ISC_LIST_HEAD(*hookhead);
 			     anh != NULL;
 			     anh = ISC_LIST_NEXT(anh, plink))
 				if (anh->entry == foundentry)
@@ -563,12 +567,8 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		}
 
 		new_addresses_added = ISC_TRUE;
-		if (nh != NULL) {
-			if (rdtype == dns_rdatatype_a)
-				ISC_LIST_APPEND(adbname->v4, nh, plink);
-			else
-				ISC_LIST_APPEND(adbname->v6, nh, plink);
-		}
+		if (nh != NULL)
+			ISC_LIST_APPEND(*hookhead, nh, plink);
 		nh = NULL;
 		result = dns_rdataset_next(rdataset);
 	}
@@ -1738,8 +1738,11 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *qname,
 			bucket = entry->lock_bucket;
 			LOCK(&adb->entrylocks[bucket]);
 
-			if (entry_is_lame(adb, entry, qname, qtype, now))
+			if (!FIND_RETURNLAME(find)
+			    && entry_is_lame(adb, entry, qname, qtype, now)) {
+				find->options |= DNS_ADBFIND_LAMEPRUNED;
 				goto nextv6;
+			}
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
 			if (addrinfo == NULL) {
 				find->partial_result |= DNS_ADBFIND_INET6;
@@ -1773,12 +1776,15 @@ shutdown_task(isc_task_t *task, isc_event_t *ev) {
 	INSIST(DNS_ADB_VALID(adb));
 
 	/*
+	 * Wait for lock around check_exit() call to be released.
+	 */
+	LOCK(&adb->lock);
+	/*
 	 * Kill the timer, and then the ADB itself.  Note that this implies
 	 * that this task was the one scheduled to get timer events.  If
 	 * this is not true (and it is unfortunate there is no way to INSIST()
 	 * this) badness will occur.
 	 */
-	LOCK(&adb->lock);
 	isc_timer_detach(&adb->timer);
 	UNLOCK(&adb->lock);
 	isc_event_free(&ev);
@@ -1990,6 +1996,7 @@ destroy(dns_adb_t *adb) {
 	DESTROYLOCK(&adb->reflock);
 	DESTROYLOCK(&adb->lock);
 	DESTROYLOCK(&adb->mplock);
+	DESTROYLOCK(&adb->overmemlock);
 
 	isc_mem_putanddetach(&adb->mctx, adb, sizeof(dns_adb_t));
 }
@@ -2060,6 +2067,10 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 	if (result != ISC_R_SUCCESS)
 		goto fail0d;
 
+	result = isc_mutex_init(&adb->overmemlock);
+	if (result != ISC_R_SUCCESS)
+		goto fail0e;
+
 	/*
 	 * Initialize the bucket locks for names and elements.
 	 * May as well initialize the list heads, too.
@@ -2162,6 +2173,8 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 	if (adb->afmp != NULL)
 		isc_mempool_destroy(&adb->afmp);
 
+	DESTROYLOCK(&adb->overmemlock);
+ fail0e:
 	DESTROYLOCK(&adb->reflock);
  fail0d:
 	DESTROYLOCK(&adb->mplock);
@@ -3133,8 +3146,10 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 		address_type = DNS_ADBFIND_INET6;
 		fetch = name->fetch_aaaa;
 		name->fetch_aaaa = NULL;
-	}
-	INSIST(address_type != 0);
+	} else
+		fetch = NULL;
+
+	INSIST(address_type != 0 && fetch != NULL);
 
 	dns_resolver_destroyfetch(&fetch->fetch);
 	dev->fetch = NULL;
@@ -3582,12 +3597,21 @@ water(void *arg, int mark) {
 	DP(ISC_LOG_DEBUG(1),
 	   "adb reached %s water mark", overmem ? "high" : "low");
 
-	adb->overmem = overmem;
-	if (overmem) {
-		isc_interval_set(&interval, 0, 1);
-		(void)isc_timer_reset(adb->timer, isc_timertype_once, NULL,
-				      &interval, ISC_TRUE);
+	/*
+	 * We can't use adb->lock as there is potential for water
+	 * to be called when adb->lock is held.
+	 */
+	LOCK(&adb->overmemlock);
+	if (adb->overmem != overmem) {
+		adb->overmem = overmem;
+		if (overmem) {
+			isc_interval_set(&interval, 0, 1);
+			(void)isc_timer_reset(adb->timer, isc_timertype_once,
+					      NULL, &interval, ISC_TRUE);
+		}
+		isc_mem_waterack(adb->mctx, mark);
 	}
+	UNLOCK(&adb->overmemlock);
 }
 
 void
diff --git a/lib/dns/api b/lib/dns/api
index 7ad55061cc58..7949ab0bbf8a 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 35
+LIBINTERFACE = 36
 LIBREVISION = 1
 LIBAGE = 0
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 011dbf755c4f..c9b4a9588558 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.c,v 1.57.18.16 2006/08/01 01:06:48 marka Exp $ */
+/* $Id: cache.c,v 1.57.18.18 2008/02/07 23:45:56 tbox Exp $ */
 
 /*! \file */
 
@@ -42,16 +42,16 @@
 #define CACHE_MAGIC		ISC_MAGIC('$', '$', '$', '$')
 #define VALID_CACHE(cache)	ISC_MAGIC_VALID(cache, CACHE_MAGIC)
 
-/*! 
+/*!
  * Control incremental cleaning.
  * DNS_CACHE_MINSIZE is how many bytes is the floor for dns_cache_setcachesize().
  * See also DNS_CACHE_CLEANERINCREMENT
  */
 #define DNS_CACHE_MINSIZE 		2097152	/*%< Bytes.  2097152 = 2 MB */
-/*! 
+/*!
  * Control incremental cleaning.
  * CLEANERINCREMENT is how many nodes are examined in one pass.
- * See also DNS_CACHE_MINSIZE 
+ * See also DNS_CACHE_MINSIZE
  */
 #define DNS_CACHE_CLEANERINCREMENT	1000U	/*%< Number of nodes. */
 
@@ -173,7 +173,7 @@ adjust_increment(cache_cleaner_t *cleaner, unsigned int remaining,
 	unsigned int pps = dns_pps;
 	unsigned int interval;
 	unsigned int names;
-	
+
 	/*
 	 * Tune for minumum of 100 packets per second (pps).
 	 */
@@ -194,7 +194,7 @@ adjust_increment(cache_cleaner_t *cleaner, unsigned int remaining,
 		      ISC_LOG_DEBUG(1), "adjust_increment interval=%u "
 		      "names=%u usec=%" ISC_PLATFORM_QUADFORMAT "u",
 		      interval, names, usecs);
-	
+
 	if (usecs == 0) {
 		/*
 		 * If we cleaned all the nodes in unmeasurable time
@@ -537,7 +537,7 @@ dns_cache_setcleaninginterval(dns_cache_t *cache, unsigned int t) {
 					 isc_timertype_ticker,
 					 NULL, &interval, ISC_FALSE);
 	}
-	if (result != ISC_R_SUCCESS)	
+	if (result != ISC_R_SUCCESS)
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
 			      "could not set cache cleaning interval: %s",
@@ -624,7 +624,7 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 			result = ISC_R_NOMEMORY;
 			goto cleanup;
 		}
-		
+
 		cleaner->overmem_event =
 			isc_event_allocate(cache->mctx, cleaner,
 					   DNS_EVENT_CACHEOVERMEM,
@@ -662,7 +662,7 @@ begin_cleaning(cache_cleaner_t *cleaner) {
 
 	/*
 	 * Create an iterator, if it does not already exist, and
-         * position it at the beginning of the cache.
+	 * position it at the beginning of the cache.
 	 */
 	if (cleaner->iterator == NULL)
 		result = dns_db_createiterator(cleaner->cache->db, ISC_FALSE,
@@ -701,7 +701,7 @@ begin_cleaning(cache_cleaner_t *cleaner) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
 			      "begin cache cleaning, mem inuse %lu",
-		            (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
+			    (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
 		cleaner->state = cleaner_s_busy;
 		isc_task_send(cleaner->task, &cleaner->resched_event);
 	}
@@ -761,7 +761,7 @@ static void
 overmem_cleaning_action(isc_task_t *task, isc_event_t *event) {
 	cache_cleaner_t *cleaner = event->ev_arg;
 	isc_boolean_t want_cleaning = ISC_FALSE;
-	
+
 	UNUSED(task);
 
 	INSIST(task == cleaner->task);
@@ -980,9 +980,12 @@ water(void *arg, int mark) {
 	REQUIRE(VALID_CACHE(cache));
 
 	LOCK(&cache->cleaner.lock);
-	
-	dns_db_overmem(cache->db, overmem);
-	cache->cleaner.overmem = overmem;
+
+	if (overmem != cache->cleaner.overmem) {
+		dns_db_overmem(cache->db, overmem);
+		cache->cleaner.overmem = overmem;
+		isc_mem_waterack(cache->mctx, mark);
+	}
 
 	if (cache->cleaner.overmem_event != NULL)
 		isc_task_send(cache->cleaner.task,
@@ -1106,7 +1109,7 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
 	dns_rdatasetiter_t *iter = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_db_t *db = NULL;
-	
+
 	LOCK(&cache->lock);
 	if (cache->db != NULL)
 		dns_db_attach(cache->db, &db);
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 617fde8a2dad..794cdb5e5aac 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.c,v 1.116.18.19.12.5 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: dispatch.c,v 1.116.18.37 2008/09/04 00:24:41 jinmei Exp $ */
 
 /*! \file */
 
@@ -24,10 +24,12 @@
 #include <stdlib.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <stdlib.h>
 
 #include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/string.h>
@@ -46,13 +48,8 @@
 
 typedef ISC_LIST(dns_dispentry_t)	dns_displist_t;
 
-typedef struct dns_qid {
-	unsigned int	magic;
-	unsigned int	qid_nbuckets;	/*%< hash table size */
-	unsigned int	qid_increment;	/*%< id increment on collision */
-	isc_mutex_t	lock;
-	dns_displist_t	*qid_table;	/*%< the table itself */
-} dns_qid_t;
+typedef struct dispsocket dispsocket_t;
+typedef ISC_LIST(dispsocket_t)		dispsocketlist_t;
 
 /* ARC4 Random generator state */
 typedef struct arc4ctx {
@@ -60,14 +57,26 @@ typedef struct arc4ctx {
 	isc_uint8_t	j;
 	isc_uint8_t	s[256];
 	int		count;
+	isc_entropy_t	*entropy;	/*%< entropy source for ARC4 */
+	isc_mutex_t	*lock;
 } arc4ctx_t;
 
+typedef struct dns_qid {
+	unsigned int	magic;
+	unsigned int	qid_nbuckets;	/*%< hash table size */
+	unsigned int	qid_increment;	/*%< id increment on collision */
+	isc_mutex_t	lock;
+	dns_displist_t	*qid_table;	/*%< the table itself */
+	dispsocketlist_t *sock_table;	/*%< socket table */
+} dns_qid_t;
+
 struct dns_dispatchmgr {
 	/* Unlocked. */
 	unsigned int			magic;
 	isc_mem_t		       *mctx;
 	dns_acl_t		       *blackhole;
 	dns_portlist_t		       *portlist;
+	isc_entropy_t		       *entropy; /*%< entropy source */
 
 	/* Locked by "lock". */
 	isc_mutex_t			lock;
@@ -91,8 +100,27 @@ struct dns_dispatchmgr {
 	isc_mempool_t		       *rpool;	/*%< memory pool for replies */
 	isc_mempool_t		       *dpool;  /*%< dispatch allocations */
 	isc_mempool_t		       *bpool;	/*%< memory pool for buffers */
-
-	isc_entropy_t		       *entropy; /*%< entropy source */
+	isc_mempool_t		       *spool;	/*%< memory pool for dispsocs */
+
+	/*%
+	 * Locked by qid->lock if qid exists; otherwise, can be used without
+	 * being locked.
+	 * Memory footprint considerations: this is a simple implementation of
+	 * available ports, i.e., an ordered array of the actual port numbers.
+	 * This will require about 256KB of memory in the worst case (128KB for
+	 * each of IPv4 and IPv6).  We could reduce it by representing it as a
+	 * more sophisticated way such as a list (or array) of ranges that are
+	 * searched to identify a specific port.  Our decision here is the saved
+	 * memory isn't worth the implementation complexity, considering the
+	 * fact that the whole BIND9 process (which is mainly named) already
+	 * requires a pretty large memory footprint.  We may, however, have to
+	 * revisit the decision when we want to use it as a separate module for
+	 * an environment where memory requirement is severer.
+	 */
+	in_port_t	*v4ports;	/*%< available ports for IPv4 */
+	unsigned int	nv4ports;	/*%< # of available ports for IPv4 */
+	in_port_t	*v6ports;	/*%< available ports for IPv4 */
+	unsigned int	nv6ports;	/*%< # of available ports for IPv4 */
 };
 
 #define MGR_SHUTTINGDOWN		0x00000001U
@@ -111,17 +139,65 @@ struct dns_dispentry {
 	isc_taskaction_t		action;
 	void			       *arg;
 	isc_boolean_t			item_out;
+	dispsocket_t			*dispsocket;
 	ISC_LIST(dns_dispatchevent_t)	items;
 	ISC_LINK(dns_dispentry_t)	link;
 };
 
+/*%
+ * Maximum number of dispatch sockets that can be pooled for reuse.  The
+ * appropriate value may vary, but experiments have shown a busy caching server
+ * may need more than 1000 sockets concurrently opened.  The maximum allowable
+ * number of dispatch sockets (per manager) will be set to the double of this
+ * value.
+ */
+#ifndef DNS_DISPATCH_POOLSOCKS
+#define DNS_DISPATCH_POOLSOCKS			2048
+#endif
+
+/*%
+ * Quota to control the number of dispatch sockets.  If a dispatch has more
+ * than the quota of sockets, new queries will purge oldest ones, so that
+ * a massive number of outstanding queries won't prevent subsequent queries
+ * (especially if the older ones take longer time and result in timeout).
+ */
+#ifndef DNS_DISPATCH_SOCKSQUOTA
+#define DNS_DISPATCH_SOCKSQUOTA			3072
+#endif
+
+struct dispsocket {
+	unsigned int			magic;
+	isc_socket_t			*socket;
+	dns_dispatch_t			*disp;
+	isc_sockaddr_t			host;
+	in_port_t			localport;
+	dns_dispentry_t			*resp;
+	isc_task_t			*task;
+	ISC_LINK(dispsocket_t)		link;
+	unsigned int			bucket;
+	ISC_LINK(dispsocket_t)		blink;
+};
+
 #define INVALID_BUCKET		(0xffffdead)
 
+/*%
+ * Number of tasks for each dispatch that use separate sockets for different
+ * transactions.  This must be a power of 2 as it will divide 32 bit numbers
+ * to get an uniformly random tasks selection.  See get_dispsocket().
+ */
+#define MAX_INTERNAL_TASKS	64
+
 struct dns_dispatch {
 	/* Unlocked. */
 	unsigned int		magic;		/*%< magic */
 	dns_dispatchmgr_t      *mgr;		/*%< dispatch manager */
-	isc_task_t	       *task;		/*%< internal task */
+	int			ntasks;
+	/*%
+	 * internal task buckets.  We use multiple tasks to distribute various
+	 * socket events well when using separate dispatch sockets.  We use the
+	 * 1st task (task[0]) for internal control events.
+	 */
+	isc_task_t	       *task[MAX_INTERNAL_TASKS];
 	isc_socket_t	       *socket;		/*%< isc socket attached to */
 	isc_sockaddr_t		local;		/*%< local address */
 	in_port_t		localport;	/*%< local UDP port */
@@ -143,10 +219,14 @@ struct dns_dispatch {
 				tcpmsg_valid : 1,
 				recv_pending : 1; /*%< is a recv() pending? */
 	isc_result_t		shutdown_why;
+	ISC_LIST(dispsocket_t)	activesockets;
+	ISC_LIST(dispsocket_t)	inactivesockets;
+	unsigned int		nsockets;
 	unsigned int		requests;	/*%< how many requests we have */
 	unsigned int		tcpbuffers;	/*%< allocated buffers */
 	dns_tcpmsg_t		tcpmsg;		/*%< for tcp streams */
 	dns_qid_t		*qid;
+	arc4ctx_t		arc4ctx;	/*%< for QID/UDP port num */
 };
 
 #define QID_MAGIC		ISC_MAGIC('Q', 'i', 'd', ' ')
@@ -155,6 +235,9 @@ struct dns_dispatch {
 #define RESPONSE_MAGIC		ISC_MAGIC('D', 'r', 's', 'p')
 #define VALID_RESPONSE(e)	ISC_MAGIC_VALID((e), RESPONSE_MAGIC)
 
+#define DISPSOCK_MAGIC		ISC_MAGIC('D', 's', 'o', 'c')
+#define VALID_DISPSOCK(e)	ISC_MAGIC_VALID((e), DISPSOCK_MAGIC)
+
 #define DISPATCH_MAGIC		ISC_MAGIC('D', 'i', 's', 'p')
 #define VALID_DISPATCH(e)	ISC_MAGIC_VALID((e), DISPATCH_MAGIC)
 
@@ -163,16 +246,33 @@ struct dns_dispatch {
 
 #define DNS_QID(disp) ((disp)->socktype == isc_sockettype_tcp) ? \
 		       (disp)->qid : (disp)->mgr->qid
+#define DISP_ARC4CTX(disp) ((disp)->socktype == isc_sockettype_udp) ? \
+			(&(disp)->arc4ctx) : (&(disp)->mgr->arc4ctx)
+
+/*%
+ * Locking a query port buffer is a bit tricky.  We access the buffer without
+ * locking until qid is created.  Technically, there is a possibility of race
+ * between the creation of qid and access to the port buffer; in practice,
+ * however, this should be safe because qid isn't created until the first
+ * dispatch is created and there should be no contending situation until then.
+ */
+#define PORTBUFLOCK(mgr) if ((mgr)->qid != NULL) LOCK(&((mgr)->qid->lock))
+#define PORTBUFUNLOCK(mgr) if ((mgr)->qid != NULL) UNLOCK((&(mgr)->qid->lock))
+
 /*
  * Statics.
  */
-static dns_dispentry_t *bucket_search(dns_qid_t *, isc_sockaddr_t *,
-				      dns_messageid_t, in_port_t, unsigned int);
+static dns_dispentry_t *entry_search(dns_qid_t *, isc_sockaddr_t *,
+				     dns_messageid_t, in_port_t, unsigned int);
 static isc_boolean_t destroy_disp_ok(dns_dispatch_t *);
 static void destroy_disp(isc_task_t *task, isc_event_t *event);
-static void udp_recv(isc_task_t *, isc_event_t *);
+static void destroy_dispsocket(dns_dispatch_t *, dispsocket_t **);
+static void deactivate_dispsocket(dns_dispatch_t *, dispsocket_t *);
+static void udp_exrecv(isc_task_t *, isc_event_t *);
+static void udp_shrecv(isc_task_t *, isc_event_t *);
+static void udp_recv(isc_event_t *, dns_dispatch_t *, dispsocket_t *);
 static void tcp_recv(isc_task_t *, isc_event_t *);
-static void startrecv(dns_dispatch_t *);
+static isc_result_t startrecv(dns_dispatch_t *, dispsocket_t *);
 static isc_uint32_t dns_hash(dns_qid_t *, isc_sockaddr_t *, dns_messageid_t,
 			     in_port_t);
 static void free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len);
@@ -184,6 +284,11 @@ static dns_dispentry_t *linear_first(dns_qid_t *disp);
 static dns_dispentry_t *linear_next(dns_qid_t *disp,
 				    dns_dispentry_t *resp);
 static void dispatch_free(dns_dispatch_t **dispp);
+static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
+				  dns_dispatch_t *disp,
+				  isc_socketmgr_t *sockmgr,
+				  isc_sockaddr_t *localaddr,
+				  isc_socket_t **sockp);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
@@ -194,8 +299,13 @@ static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr);
 static void destroy_mgr(dns_dispatchmgr_t **mgrp);
 static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-				 unsigned int increment, dns_qid_t **qidp);
+				 unsigned int increment, dns_qid_t **qidp,
+				 isc_boolean_t needaddrtable);
 static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
+static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
+				unsigned int options, isc_socket_t **sockp);
+static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
+				   isc_sockaddr_t *sockaddrp);
 
 #define LVL(x) ISC_LOG_DEBUG(x)
 
@@ -275,7 +385,7 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp,
 	}
 }
 
-/*
+/*%
  * ARC4 random number generator derived from OpenBSD.
  * Only dispatch_arc4random() and dispatch_arc4uniformrandom() are expected
  * to be called from general dispatch routines; the rest of them are subroutines
@@ -298,13 +408,15 @@ request_log(dns_dispatch_t *disp, dns_dispentry_t *resp,
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 static void
-dispatch_arc4init(arc4ctx_t *actx) {
+dispatch_arc4init(arc4ctx_t *actx, isc_entropy_t *entropy, isc_mutex_t *lock) {
 	int n;
 	for (n = 0; n < 256; n++)
 		actx->s[n] = n;
 	actx->i = 0;
 	actx->j = 0;
 	actx->count = 0;
+	actx->entropy = entropy; /* don't have to attach */
+	actx->lock = lock;
 }
 
 static void
@@ -348,7 +460,7 @@ dispatch_arc4get16(arc4ctx_t *actx) {
 }
 
 static void
-dispatch_arc4stir(dns_dispatchmgr_t *mgr) {
+dispatch_arc4stir(arc4ctx_t *actx) {
 	int i;
 	union {
 		unsigned char rnd[128];
@@ -356,51 +468,55 @@ dispatch_arc4stir(dns_dispatchmgr_t *mgr) {
 	} rnd;
 	isc_result_t result;
 
-	if (mgr->entropy != NULL) {
+	if (actx->entropy != NULL) {
 		/*
 		 * We accept any quality of random data to avoid blocking.
 		 */
-		result = isc_entropy_getdata(mgr->entropy, rnd.rnd,
+		result = isc_entropy_getdata(actx->entropy, rnd.rnd,
 					     sizeof(rnd), NULL, 0);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	} else {
 		for (i = 0; i < 32; i++)
 			isc_random_get(&rnd.rnd32[i]);
 	}
-	dispatch_arc4addrandom(&mgr->arc4ctx, rnd.rnd, sizeof(rnd.rnd));
+	dispatch_arc4addrandom(actx, rnd.rnd, sizeof(rnd.rnd));
 
 	/*
 	 * Discard early keystream, as per recommendations in:
 	 * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
 	 */
 	for (i = 0; i < 256; i++)
-		(void)dispatch_arc4get8(&mgr->arc4ctx);
+		(void)dispatch_arc4get8(actx);
 
 	/*
 	 * Derived from OpenBSD's implementation.  The rationale is not clear,
 	 * but should be conservative enough in safety, and reasonably large
 	 * for efficiency.
 	 */
-	mgr->arc4ctx.count = 1600000;
+	actx->count = 1600000;
 }
 
 static isc_uint16_t
-dispatch_arc4random(dns_dispatchmgr_t *mgr) {
+dispatch_arc4random(arc4ctx_t *actx) {
 	isc_uint16_t result;
 
-	LOCK(&mgr->arc4_lock);
-	mgr->arc4ctx.count -= sizeof(isc_uint16_t);
-	if (mgr->arc4ctx.count <= 0)
-		dispatch_arc4stir(mgr);
-	result = dispatch_arc4get16(&mgr->arc4ctx);
-	UNLOCK(&mgr->arc4_lock);
+	if (actx->lock != NULL)
+		LOCK(actx->lock);
+
+	actx->count -= sizeof(isc_uint16_t);
+	if (actx->count <= 0)
+		dispatch_arc4stir(actx);
+	result = dispatch_arc4get16(actx);
+
+	if (actx->lock != NULL)
+		UNLOCK(actx->lock);
+
 	return (result);
 }
 
 static isc_uint16_t
-dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) {
+dispatch_arc4uniformrandom(arc4ctx_t *actx, isc_uint16_t upper_bound) {
 	isc_uint16_t min, r;
-	/* The caller must hold the manager lock. */
 
 	if (upper_bound < 2)
 		return (0);
@@ -422,7 +538,7 @@ dispatch_arc4uniformrandom(dns_dispatchmgr_t *mgr, isc_uint16_t upper_bound) {
 	 * to re-roll.
 	 */
 	for (;;) {
-		r = dispatch_arc4random(mgr);
+		r = dispatch_arc4random(actx);
 		if (r >= min)
 			break;
 	}
@@ -505,13 +621,15 @@ destroy_disp_ok(dns_dispatch_t *disp)
 	if (disp->recv_pending != 0)
 		return (ISC_FALSE);
 
+	if (!ISC_LIST_EMPTY(disp->activesockets))
+		return (ISC_FALSE);
+
 	if (disp->shutting_down == 0)
 		return (ISC_FALSE);
 
 	return (ISC_TRUE);
 }
 
-
 /*
  * Called when refcount reaches 0 (and safe to destroy).
  *
@@ -523,6 +641,8 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 	dns_dispatch_t *disp;
 	dns_dispatchmgr_t *mgr;
 	isc_boolean_t killmgr;
+	dispsocket_t *dispsocket;
+	int i;
 
 	INSIST(event->ev_type == DNS_EVENT_DISPATCHCONTROL);
 
@@ -536,10 +656,16 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 
 	dispatch_log(disp, LVL(90),
 		     "shutting down; detaching from sock %p, task %p",
-		     disp->socket, disp->task);
+		     disp->socket, disp->task[0]); /* XXXX */
 
-	isc_socket_detach(&disp->socket);
-	isc_task_detach(&disp->task);
+	if (disp->socket != NULL)
+		isc_socket_detach(&disp->socket);
+	while ((dispsocket = ISC_LIST_HEAD(disp->inactivesockets)) != NULL) {
+		ISC_LIST_UNLINK(disp->inactivesockets, dispsocket, link);
+		destroy_dispsocket(disp, &dispsocket);
+	}
+	for (i = 0; i < disp->ntasks; i++)
+		isc_task_detach(&disp->task[i]);
 	isc_event_free(&event);
 
 	dispatch_free(&disp);
@@ -550,14 +676,210 @@ destroy_disp(isc_task_t *task, isc_event_t *event) {
 		destroy_mgr(&mgr);
 }
 
+/*%
+ * Find a dispsocket for socket address 'dest', and port number 'port'.
+ * Return NULL if no such entry exists.
+ */
+static dispsocket_t *
+socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port,
+	      unsigned int bucket)
+{
+	dispsocket_t *dispsock;
+
+	REQUIRE(bucket < qid->qid_nbuckets);
+
+	dispsock = ISC_LIST_HEAD(qid->sock_table[bucket]);
+
+	while (dispsock != NULL) {
+		if (isc_sockaddr_equal(dest, &dispsock->host) &&
+		    dispsock->localport == port)
+			return (dispsock);
+		dispsock = ISC_LIST_NEXT(dispsock, blink);
+	}
+
+	return (NULL);
+}
+
+/*%
+ * Make a new socket for a single dispatch with a random port number.
+ * The caller must hold the disp->lock and qid->lock.
+ */
+static isc_result_t
+get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+	       isc_socketmgr_t *sockmgr, dns_qid_t *qid,
+	       dispsocket_t **dispsockp, in_port_t *portp)
+{
+	int i;
+	isc_uint32_t r;
+	dns_dispatchmgr_t *mgr = disp->mgr;
+	isc_socket_t *sock = NULL;
+	isc_result_t result = ISC_R_FAILURE;
+	in_port_t port;
+	isc_sockaddr_t localaddr;
+	unsigned int bucket = 0;
+	dispsocket_t *dispsock;
+	unsigned int nports;
+	in_port_t *ports;
+
+	if (isc_sockaddr_pf(&disp->local) == AF_INET) {
+		nports = disp->mgr->nv4ports;
+		ports = disp->mgr->v4ports;
+	} else {
+		nports = disp->mgr->nv6ports;
+		ports = disp->mgr->v6ports;
+	}
+	if (nports == 0)
+		return (ISC_R_ADDRNOTAVAIL);
+
+	dispsock = ISC_LIST_HEAD(disp->inactivesockets);
+	if (dispsock != NULL) {
+		ISC_LIST_UNLINK(disp->inactivesockets, dispsock, link);
+		sock = dispsock->socket;
+		dispsock->socket = NULL;
+	} else {
+		dispsock = isc_mempool_get(mgr->spool);
+		if (dispsock == NULL)
+			return (ISC_R_NOMEMORY);
+
+		disp->nsockets++;
+		dispsock->socket = NULL;
+		dispsock->disp = disp;
+		dispsock->resp = NULL;
+		isc_random_get(&r);
+		dispsock->task = NULL;
+		isc_task_attach(disp->task[r % disp->ntasks], &dispsock->task);
+		ISC_LINK_INIT(dispsock, link);
+		ISC_LINK_INIT(dispsock, blink);
+		dispsock->magic = DISPSOCK_MAGIC;
+	}
+
+	/*
+	 * Pick up a random UDP port and open a new socket with it.  Avoid
+	 * choosing ports that share the same destination because it will be
+	 * very likely to fail in bind(2) or connect(2).
+	 */
+	localaddr = disp->local;
+	for (i = 0; i < 64; i++) {
+		port = ports[dispatch_arc4uniformrandom(DISP_ARC4CTX(disp),
+							nports)];
+		isc_sockaddr_setport(&localaddr, port);
+
+		bucket = dns_hash(qid, dest, 0, port);
+		if (socket_search(qid, dest, port, bucket) != NULL)
+			continue;
+
+		result = open_socket(sockmgr, &localaddr, 0, &sock);
+		if (result == ISC_R_SUCCESS || result != ISC_R_ADDRINUSE)
+			break;
+	}
+
+	if (result == ISC_R_SUCCESS) {
+		dispsock->socket = sock;
+		dispsock->host = *dest;
+		dispsock->localport = port;
+		dispsock->bucket = bucket;
+		ISC_LIST_APPEND(qid->sock_table[bucket], dispsock, blink);
+		*dispsockp = dispsock;
+		*portp = port;
+	} else {
+		/*
+		 * We could keep it in the inactive list, but since this should
+		 * be an exceptional case and might be resource shortage, we'd
+		 * rather destroy it.
+		 */
+		if (sock != NULL)
+			isc_socket_detach(&sock);
+		destroy_dispsocket(disp, &dispsock);
+	}
+
+	return (result);
+}
+
+/*%
+ * Destroy a dedicated dispatch socket.
+ */
+static void
+destroy_dispsocket(dns_dispatch_t *disp, dispsocket_t **dispsockp) {
+	dispsocket_t *dispsock;
+	dns_qid_t *qid;
+
+	/*
+	 * The dispatch must be locked.
+	 */
+
+	REQUIRE(dispsockp != NULL && *dispsockp != NULL);
+	dispsock = *dispsockp;
+	REQUIRE(!ISC_LINK_LINKED(dispsock, link));
+
+	disp->nsockets--;
+	dispsock->magic = 0;
+	if (dispsock->socket != NULL)
+		isc_socket_detach(&dispsock->socket);
+	if (ISC_LINK_LINKED(dispsock, blink)) {
+		qid = DNS_QID(disp);
+		LOCK(&qid->lock);
+		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
+				blink);
+		UNLOCK(&qid->lock);
+	}
+	if (dispsock->task != NULL)
+		isc_task_detach(&dispsock->task);
+	isc_mempool_put(disp->mgr->spool, dispsock);
+
+	*dispsockp = NULL;
+}
+
+/*%
+ * Deactivate a dedicated dispatch socket.  Move it to the inactive list for
+ * future reuse unless the total number of sockets are exceeding the maximum.
+ */
+static void
+deactivate_dispsocket(dns_dispatch_t *disp, dispsocket_t *dispsock) {
+	isc_result_t result;
+	dns_qid_t *qid;
+
+	/*
+	 * The dispatch must be locked.
+	 */
+	ISC_LIST_UNLINK(disp->activesockets, dispsock, link);
+	if (dispsock->resp != NULL) {
+		INSIST(dispsock->resp->dispsocket == dispsock);
+		dispsock->resp->dispsocket = NULL;
+	}
+
+	if (disp->nsockets > DNS_DISPATCH_POOLSOCKS)
+		destroy_dispsocket(disp, &dispsock);
+	else {
+		result = isc_socket_close(dispsock->socket);
+
+		qid = DNS_QID(disp);
+		LOCK(&qid->lock);
+		ISC_LIST_UNLINK(qid->sock_table[dispsock->bucket], dispsock,
+				blink);
+		UNLOCK(&qid->lock);
+
+		if (result == ISC_R_SUCCESS)
+			ISC_LIST_APPEND(disp->inactivesockets, dispsock, link);
+		else {
+			/*
+			 * If the underlying system does not allow this
+			 * optimization, destroy this temporary structure (and
+			 * create a new one for a new transaction).
+			 */
+			INSIST(result == ISC_R_NOTIMPLEMENTED);
+			destroy_dispsocket(disp, &dispsock);
+		}
+	}
+}
 
 /*
- * Find an entry for query ID 'id' and socket address 'dest' in 'qid'.
+ * Find an entry for query ID 'id', socket address 'dest', and port number
+ * 'port'.
  * Return NULL if no such entry exists.
  */
 static dns_dispentry_t *
-bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
-	      in_port_t port, unsigned int bucket)
+entry_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
+	     in_port_t port, unsigned int bucket)
 {
 	dns_dispentry_t *res;
 
@@ -566,7 +888,7 @@ bucket_search(dns_qid_t *qid, isc_sockaddr_t *dest, dns_messageid_t id,
 	res = ISC_LIST_HEAD(qid->qid_table[bucket]);
 
 	while (res != NULL) {
-		if ((res->id == id) && isc_sockaddr_equal(dest, &res->host) &&
+		if (res->id == id && isc_sockaddr_equal(dest, &res->host) &&
 		    res->port == port) {
 			return (res);
 		}
@@ -640,6 +962,26 @@ allocate_event(dns_dispatch_t *disp) {
 	return (ev);
 }
 
+static void
+udp_exrecv(isc_task_t *task, isc_event_t *ev) {
+	dispsocket_t *dispsock = ev->ev_arg;
+
+	UNUSED(task);
+
+	REQUIRE(VALID_DISPSOCK(dispsock));
+	udp_recv(ev, dispsock->disp, dispsock);
+}
+
+static void
+udp_shrecv(isc_task_t *task, isc_event_t *ev) {
+	dns_dispatch_t *disp = ev->ev_arg;
+
+	UNUSED(task);
+
+	REQUIRE(VALID_DISPATCH(disp));
+	udp_recv(ev, disp, NULL);
+}
+
 /*
  * General flow:
  *
@@ -655,14 +997,13 @@ allocate_event(dns_dispatch_t *disp) {
  *	restart.
  */
 static void
-udp_recv(isc_task_t *task, isc_event_t *ev_in) {
+udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 	isc_socketevent_t *ev = (isc_socketevent_t *)ev_in;
-	dns_dispatch_t *disp = ev_in->ev_arg;
 	dns_messageid_t id;
 	isc_result_t dres;
 	isc_buffer_t source;
 	unsigned int flags;
-	dns_dispentry_t *resp;
+	dns_dispentry_t *resp = NULL;
 	dns_dispatchevent_t *rev;
 	unsigned int bucket;
 	isc_boolean_t killit;
@@ -671,8 +1012,8 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	dns_qid_t *qid;
 	isc_netaddr_t netaddr;
 	int match;
-
-	UNUSED(task);
+	int result;
+	isc_boolean_t qidlocked = ISC_FALSE;
 
 	LOCK(&disp->lock);
 
@@ -683,7 +1024,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		     "got packet: requests %d, buffers %d, recvs %d",
 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
 
-	if (ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
+	if (dispsock == NULL && ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
 		/*
 		 * Unless the receive event was imported from a listening
 		 * interface, in which case the event type is
@@ -693,6 +1034,19 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		disp->recv_pending = 0;
 	}
 
+	if (dispsock != NULL &&
+	    (ev->result == ISC_R_CANCELED || dispsock->resp == NULL)) {
+		/*
+		 * dispsock->resp can be NULL if this transaction was canceled
+		 * just after receiving a response.  Since this socket is
+		 * exclusively used and there should be at most one receive
+		 * event the canceled event should have been no effect.  So
+		 * we can (and should) deactivate the socket right now.
+		 */
+		deactivate_dispsocket(disp, dispsock);
+		dispsock = NULL;
+	}
+
 	if (disp->shutting_down) {
 		/*
 		 * This dispatcher is shutting down.
@@ -705,12 +1059,32 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		killit = destroy_disp_ok(disp);
 		UNLOCK(&disp->lock);
 		if (killit)
-			isc_task_send(disp->task, &disp->ctlevent);
+			isc_task_send(disp->task[0], &disp->ctlevent);
 
 		return;
 	}
 
-	if (ev->result != ISC_R_SUCCESS) {
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		if (dispsock != NULL) {
+			resp = dispsock->resp;
+			id = resp->id;
+			if (ev->result != ISC_R_SUCCESS) {
+				/*
+				 * This is most likely a network error on a
+				 * connected socket.  It makes no sense to
+				 * check the address or parse the packet, but it
+				 * will help to return the error to the caller.
+				 */
+				goto sendresponse;
+			}
+		} else {
+			free_buffer(disp, ev->region.base, ev->region.length);
+
+			UNLOCK(&disp->lock);
+			isc_event_free(&ev_in);
+			return;
+		}
+	} else if (ev->result != ISC_R_SUCCESS) {
 		free_buffer(disp, ev->region.base, ev->region.length);
 
 		if (ev->result != ISC_R_CANCELED)
@@ -729,7 +1103,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	isc_netaddr_fromsockaddr(&netaddr, &ev->address);
 	if (disp->mgr->blackhole != NULL &&
 	    dns_acl_match(&netaddr, NULL, disp->mgr->blackhole,
-		    	  NULL, &match, NULL) == ISC_R_SUCCESS &&
+			  NULL, &match, NULL) == ISC_R_SUCCESS &&
 	    match > 0)
 	{
 		if (isc_log_wouldlog(dns_lctx, LVL(10))) {
@@ -771,18 +1145,32 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		goto restart;
 	}
 
-	/* response */
-	bucket = dns_hash(qid, &ev->address, id, disp->localport);
-	LOCK(&qid->lock);
-	resp = bucket_search(qid, &ev->address, id, disp->localport, bucket);
-	dispatch_log(disp, LVL(90),
-		     "search for response in bucket %d: %s",
-		     bucket, (resp == NULL ? "not found" : "found"));
-
+	/*
+	 * Search for the corresponding response.  If we are using an exclusive
+	 * socket, we've already identified it and we can skip the search; but
+	 * the ID and the address must match the expected ones.
+	 */
 	if (resp == NULL) {
+		bucket = dns_hash(qid, &ev->address, id, disp->localport);
+		LOCK(&qid->lock);
+		qidlocked = ISC_TRUE;
+		resp = entry_search(qid, &ev->address, id, disp->localport,
+				    bucket);
+		dispatch_log(disp, LVL(90),
+			     "search for response in bucket %d: %s",
+			     bucket, (resp == NULL ? "not found" : "found"));
+
+		if (resp == NULL) {
+			free_buffer(disp, ev->region.base, ev->region.length);
+			goto unlock;
+		}
+	} else if (resp->id != id || !isc_sockaddr_equal(&ev->address,
+							 &resp->host)) {
+		dispatch_log(disp, LVL(90),
+			     "response to an exclusive socket doesn't match");
 		free_buffer(disp, ev->region.base, ev->region.length);
 		goto unlock;
-	} 
+	}
 
 	/*
 	 * Now that we have the original dispatch the query was sent
@@ -792,7 +1180,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	if (disp != resp->disp) {
 		isc_sockaddr_t a1;
 		isc_sockaddr_t a2;
-		
+
 		/*
 		 * Check that the socket types and ports match.
 		 */
@@ -805,11 +1193,11 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 
 		/*
 		 * If both dispatches are bound to an address then fail as
-		 * the addresses can't be equal (enforced by the IP stack).  
+		 * the addresses can't be equal (enforced by the IP stack).
 		 *
 		 * Note under Linux a packet can be sent out via IPv4 socket
 		 * and the response be received via a IPv6 socket.
-		 * 
+		 *
 		 * Requests sent out via IPv6 should always come back in
 		 * via IPv6.
 		 */
@@ -827,6 +1215,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		}
 	}
 
+  sendresponse:
 	queue_response = resp->item_out;
 	rev = allocate_event(resp->disp);
 	if (rev == NULL) {
@@ -841,7 +1230,7 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 */
 	isc_buffer_init(&rev->buffer, ev->region.base, ev->region.length);
 	isc_buffer_add(&rev->buffer, ev->n);
-	rev->result = ISC_R_SUCCESS;
+	rev->result = ev->result;
 	rev->id = id;
 	rev->addr = ev->address;
 	rev->pktinfo = ev->pktinfo;
@@ -860,14 +1249,23 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		isc_task_send(resp->task, ISC_EVENT_PTR(&rev));
 	}
  unlock:
-	UNLOCK(&qid->lock);
+	if (qidlocked)
+		UNLOCK(&qid->lock);
 
 	/*
 	 * Restart recv() to get the next packet.
 	 */
  restart:
-	startrecv(disp);
-
+	result = startrecv(disp, dispsock);
+	if (result != ISC_R_SUCCESS && dispsock != NULL) {
+		/*
+		 * XXX: wired. There seems to be no recovery process other than
+		 * deactivate this socket anyway (since we cannot start
+		 * receiving, we won't be able to receive a cancel event
+		 * from the user).
+		 */
+		deactivate_dispsocket(disp, dispsock);
+	}
 	UNLOCK(&disp->lock);
 
 	isc_event_free(&ev_in);
@@ -930,7 +1328,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		switch (tcpmsg->result) {
 		case ISC_R_CANCELED:
 			break;
-			
+
 		case ISC_R_EOF:
 			dispatch_log(disp, LVL(90), "shutting down on EOF");
 			do_cancel(disp);
@@ -967,7 +1365,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		killit = destroy_disp_ok(disp);
 		UNLOCK(&disp->lock);
 		if (killit)
-			isc_task_send(disp->task, &disp->ctlevent);
+			isc_task_send(disp->task[0], &disp->ctlevent);
 		return;
 	}
 
@@ -1010,8 +1408,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 */
 	bucket = dns_hash(qid, &tcpmsg->address, id, disp->localport);
 	LOCK(&qid->lock);
-	resp = bucket_search(qid, &tcpmsg->address, id, disp->localport,
-			     bucket);
+	resp = entry_search(qid, &tcpmsg->address, id, disp->localport, bucket);
 	dispatch_log(disp, LVL(90),
 		     "search for response in bucket %d: %s",
 		     bucket, (resp == NULL ? "not found" : "found"));
@@ -1052,7 +1449,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 	 * Restart recv() to get the next packet.
 	 */
  restart:
-	startrecv(disp);
+	(void)startrecv(disp, NULL);
 
 	UNLOCK(&disp->lock);
 
@@ -1062,22 +1459,33 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 /*
  * disp must be locked.
  */
-static void
-startrecv(dns_dispatch_t *disp) {
+static isc_result_t
+startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
 	isc_result_t res;
 	isc_region_t region;
+	isc_socket_t *socket;
 
 	if (disp->shutting_down == 1)
-		return;
+		return (ISC_R_SUCCESS);
 
 	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
-		return;
+		return (ISC_R_SUCCESS);
 
-	if (disp->recv_pending != 0)
-		return;
+	if (disp->recv_pending != 0 && dispsock == NULL)
+		return (ISC_R_SUCCESS);
 
 	if (disp->mgr->buffers >= disp->mgr->maxbuffers)
-		return;
+		return (ISC_R_NOMEMORY);
+
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+	    dispsock == NULL)
+		return (ISC_R_SUCCESS);
+
+	if (dispsock != NULL)
+		socket = dispsock->socket;
+	else
+		socket = disp->socket;
+	INSIST(socket != NULL);
 
 	switch (disp->socktype) {
 		/*
@@ -1087,28 +1495,38 @@ startrecv(dns_dispatch_t *disp) {
 		region.length = disp->mgr->buffersize;
 		region.base = allocate_udp_buffer(disp);
 		if (region.base == NULL)
-			return;
-		res = isc_socket_recv(disp->socket, &region, 1,
-				      disp->task, udp_recv, disp);
-		if (res != ISC_R_SUCCESS) {
-			free_buffer(disp, region.base, region.length);
-			disp->shutdown_why = res;
-			disp->shutting_down = 1;
-			do_cancel(disp);
-			return;
+			return (ISC_R_NOMEMORY);
+		if (dispsock != NULL) {
+			res = isc_socket_recv(socket, &region, 1,
+					      dispsock->task, udp_exrecv,
+					      dispsock);
+			if (res != ISC_R_SUCCESS) {
+				free_buffer(disp, region.base, region.length);
+				return (res);
+			}
+		} else {
+			res = isc_socket_recv(socket, &region, 1,
+					      disp->task[0], udp_shrecv, disp);
+			if (res != ISC_R_SUCCESS) {
+				free_buffer(disp, region.base, region.length);
+				disp->shutdown_why = res;
+				disp->shutting_down = 1;
+				do_cancel(disp);
+				return (ISC_R_SUCCESS); /* recover by cancel */
+			}
+			INSIST(disp->recv_pending == 0);
+			disp->recv_pending = 1;
 		}
-		INSIST(disp->recv_pending == 0);
-		disp->recv_pending = 1;
 		break;
 
 	case isc_sockettype_tcp:
-		res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task,
+		res = dns_tcpmsg_readmessage(&disp->tcpmsg, disp->task[0],
 					     tcp_recv, disp);
 		if (res != ISC_R_SUCCESS) {
 			disp->shutdown_why = res;
 			disp->shutting_down = 1;
 			do_cancel(disp);
-			return;
+			return (ISC_R_SUCCESS); /* recover by cancel */
 		}
 		INSIST(disp->recv_pending == 0);
 		disp->recv_pending = 1;
@@ -1117,6 +1535,8 @@ startrecv(dns_dispatch_t *disp) {
 		INSIST(0);
 		break;
 	}
+
+	return (ISC_R_SUCCESS);
 }
 
 /*
@@ -1169,6 +1589,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 	isc_mempool_destroy(&mgr->rpool);
 	isc_mempool_destroy(&mgr->dpool);
 	isc_mempool_destroy(&mgr->bpool);
+	isc_mempool_destroy(&mgr->spool);
 
 	DESTROYLOCK(&mgr->pool_lock);
 
@@ -1182,32 +1603,46 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 	if (mgr->blackhole != NULL)
 		dns_acl_detach(&mgr->blackhole);
 
-	if (mgr->portlist != NULL)
-		dns_portlist_detach(&mgr->portlist);
-
+	if (mgr->v4ports != NULL) {
+		isc_mem_put(mctx, mgr->v4ports,
+			    mgr->nv4ports * sizeof(in_port_t));
+	}
+	if (mgr->v6ports != NULL) {
+		isc_mem_put(mctx, mgr->v6ports,
+			    mgr->nv6ports * sizeof(in_port_t));
+	}
 	isc_mem_put(mctx, mgr, sizeof(dns_dispatchmgr_t));
 	isc_mem_detach(&mctx);
 }
 
 static isc_result_t
-create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
-	      unsigned int options, isc_socket_t **sockp)
+open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
+	    unsigned int options, isc_socket_t **sockp)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
 
-	sock = NULL;
-	result = isc_socket_create(mgr, isc_sockaddr_pf(local),
-				   isc_sockettype_udp, &sock);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	sock = *sockp;
+	if (sock == NULL) {
+		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
+					   isc_sockettype_udp, &sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	} else {
+		result = isc_socket_open(sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	}
 
 #ifndef ISC_ALLOW_MAPPED
 	isc_socket_ipv6only(sock, ISC_TRUE);
 #endif
 	result = isc_socket_bind(sock, local, options);
 	if (result != ISC_R_SUCCESS) {
-		isc_socket_detach(&sock);
+		if (*sockp == NULL)
+			isc_socket_detach(&sock);
+		else
+			isc_socket_close(sock);
 		return (result);
 	}
 
@@ -1215,6 +1650,24 @@ create_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
 	return (ISC_R_SUCCESS);
 }
 
+/*%
+ * Create a temporary port list to set the initial default set of dispatch
+ * ports: [1024, 65535].  This is almost meaningless as the application will
+ * normally set the ports explicitly, but is provided to fill some minor corner
+ * cases.
+ */
+static isc_result_t
+create_default_portset(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_result_t result;
+
+	result = isc_portset_create(mctx, portsetp);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_portset_addrange(*portsetp, 1024, 65535);
+
+	return (ISC_R_SUCCESS);
+}
+
 /*
  * Publics.
  */
@@ -1225,6 +1678,8 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 {
 	dns_dispatchmgr_t *mgr;
 	isc_result_t result;
+	isc_portset_t *v4portset = NULL;
+	isc_portset_t *v6portset = NULL;
 
 	REQUIRE(mctx != NULL);
 	REQUIRE(mgrp != NULL && *mgrp == NULL);
@@ -1237,7 +1692,6 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 	isc_mem_attach(mctx, &mgr->mctx);
 
 	mgr->blackhole = NULL;
-	mgr->portlist = NULL;
 
 	result = isc_mutex_init(&mgr->lock);
 	if (result != ISC_R_SUCCESS)
@@ -1292,20 +1746,43 @@ dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 	mgr->buffersize = 0;
 	mgr->maxbuffers = 0;
 	mgr->bpool = NULL;
+	mgr->spool = NULL;
 	mgr->entropy = NULL;
 	mgr->qid = NULL;
 	mgr->state = 0;
 	ISC_LIST_INIT(mgr->list);
+	mgr->v4ports = NULL;
+	mgr->v6ports = NULL;
+	mgr->nv4ports = 0;
+	mgr->nv6ports = 0;
 	mgr->magic = DNS_DISPATCHMGR_MAGIC;
 
+	result = create_default_portset(mctx, &v4portset);
+	if (result == ISC_R_SUCCESS) {
+		result = create_default_portset(mctx, &v6portset);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_dispatchmgr_setavailports(mgr,
+							       v4portset,
+							       v6portset);
+		}
+	}
+	if (v4portset != NULL)
+		isc_portset_destroy(mctx, &v4portset);
+	if (v6portset != NULL)
+		isc_portset_destroy(mctx, &v6portset);
+	if (result != ISC_R_SUCCESS)
+		goto kill_dpool;
+
 	if (entropy != NULL)
 		isc_entropy_attach(entropy, &mgr->entropy);
 
-	dispatch_arc4init(&mgr->arc4ctx);
+	dispatch_arc4init(&mgr->arc4ctx, mgr->entropy, &mgr->arc4_lock);
 
 	*mgrp = mgr;
 	return (ISC_R_SUCCESS);
 
+ kill_dpool:
+	isc_mempool_destroy(&mgr->dpool);
  kill_rpool:
 	isc_mempool_destroy(&mgr->rpool);
  kill_epool:
@@ -1344,22 +1821,88 @@ dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
 				 dns_portlist_t *portlist)
 {
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	if (mgr->portlist != NULL)
-		dns_portlist_detach(&mgr->portlist);
-	if (portlist != NULL)
-		dns_portlist_attach(portlist, &mgr->portlist);
+	UNUSED(portlist);
+
+	/* This function is deprecated: use dns_dispatchmgr_setavailports(). */
+	return;
 }
 
 dns_portlist_t *
 dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr) {
 	REQUIRE(VALID_DISPATCHMGR(mgr));
-	return (mgr->portlist);
+	return (NULL);		/* this function is deprecated */
+}
+
+isc_result_t
+dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+			      isc_portset_t *v6portset)
+{
+	in_port_t *v4ports, *v6ports, p;
+	unsigned int nv4ports, nv6ports, i4, i6;
+
+	REQUIRE(VALID_DISPATCHMGR(mgr));
+
+	nv4ports = isc_portset_nports(v4portset);
+	nv6ports = isc_portset_nports(v6portset);
+
+	v4ports = NULL;
+	if (nv4ports != 0) {
+		v4ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv4ports);
+		if (v4ports == NULL)
+			return (ISC_R_NOMEMORY);
+	}
+	v6ports = NULL;
+	if (nv6ports != 0) {
+		v6ports = isc_mem_get(mgr->mctx, sizeof(in_port_t) * nv6ports);
+		if (v6ports == NULL) {
+			if (v4ports != NULL) {
+				isc_mem_put(mgr->mctx, v4ports,
+					    sizeof(in_port_t) *
+					    isc_portset_nports(v4portset));
+			}
+			return (ISC_R_NOMEMORY);
+		}
+	}
+
+	p = 0;
+	i4 = 0;
+	i6 = 0;
+	do {
+		if (isc_portset_isset(v4portset, p)) {
+			INSIST(i4 < nv4ports);
+			v4ports[i4++] = p;
+		}
+		if (isc_portset_isset(v6portset, p)) {
+			INSIST(i6 < nv6ports);
+			v6ports[i6++] = p;
+		}
+	} while (p++ < 65535);
+	INSIST(i4 == nv4ports && i6 == nv6ports);
+
+	PORTBUFLOCK(mgr);
+	if (mgr->v4ports != NULL) {
+		isc_mem_put(mgr->mctx, mgr->v4ports,
+			    mgr->nv4ports * sizeof(in_port_t));
+	}
+	mgr->v4ports = v4ports;
+	mgr->nv4ports = nv4ports;
+
+	if (mgr->v6ports != NULL) {
+		isc_mem_put(mgr->mctx, mgr->v6ports,
+			    mgr->nv6ports * sizeof(in_port_t));
+	}
+	mgr->v6ports = v6ports;
+	mgr->nv6ports = nv6ports;
+	PORTBUFUNLOCK(mgr);
+
+	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
 dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
-			unsigned int buffersize, unsigned int maxbuffers,
-			unsigned int buckets, unsigned int increment)
+		       unsigned int buffersize, unsigned int maxbuffers,
+		       unsigned int maxrequests, unsigned int buckets,
+		       unsigned int increment)
 {
 	isc_result_t result;
 
@@ -1386,24 +1929,39 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 		maxbuffers = 8;
 
 	LOCK(&mgr->buffer_lock);
+
+	/* Create or adjust buffer pool */
 	if (mgr->bpool != NULL) {
 		isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
 		mgr->maxbuffers = maxbuffers;
+	} else {
+		result = isc_mempool_create(mgr->mctx, buffersize, &mgr->bpool);
+		if (result != ISC_R_SUCCESS) {
+			UNLOCK(&mgr->buffer_lock);
+			return (result);
+		}
+		isc_mempool_setname(mgr->bpool, "dispmgr_bpool");
+		isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
+		isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock);
+	}
+
+	/* Create or adjust socket pool */
+	if (mgr->spool != NULL) {
+		isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
 		UNLOCK(&mgr->buffer_lock);
 		return (ISC_R_SUCCESS);
 	}
-
-	if (isc_mempool_create(mgr->mctx, buffersize,
-			       &mgr->bpool) != ISC_R_SUCCESS) {
+	result = isc_mempool_create(mgr->mctx, sizeof(dispsocket_t),
+				    &mgr->spool);
+	if (result != ISC_R_SUCCESS) {
 		UNLOCK(&mgr->buffer_lock);
-		return (ISC_R_NOMEMORY);
+		goto cleanup;
 	}
+	isc_mempool_setname(mgr->spool, "dispmgr_spool");
+	isc_mempool_setmaxalloc(mgr->spool, maxrequests);
+	isc_mempool_associatelock(mgr->spool, &mgr->pool_lock);
 
-	isc_mempool_setname(mgr->bpool, "dispmgr_bpool");
-	isc_mempool_setmaxalloc(mgr->bpool, maxbuffers);
-	isc_mempool_associatelock(mgr->bpool, &mgr->pool_lock);
-
-	result = qid_allocate(mgr, buckets, increment, &mgr->qid);
+	result = qid_allocate(mgr, buckets, increment, &mgr->qid, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1414,8 +1972,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 
  cleanup:
 	isc_mempool_destroy(&mgr->bpool);
+	if (mgr->spool != NULL)
+		isc_mempool_destroy(&mgr->spool);
 	UNLOCK(&mgr->buffer_lock);
-	return (ISC_R_NOMEMORY);
+	return (result);
 }
 
 void
@@ -1441,30 +2001,56 @@ dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp) {
 		destroy_mgr(&mgr);
 }
 
+static int
+port_cmp(const void *key, const void *ent) {
+	in_port_t p1 = *(const in_port_t *)key;
+	in_port_t p2 = *(const in_port_t *)ent;
+
+	if (p1 < p2)
+		return (-1);
+	else if (p1 == p2)
+		return (0);
+	else
+		return (1);
+}
+
 static isc_boolean_t
-blacklisted(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
-	    isc_sockaddr_t *sockaddrp)
+portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
+	      isc_sockaddr_t *sockaddrp)
 {
 	isc_sockaddr_t sockaddr;
 	isc_result_t result;
+	in_port_t *ports, port;
+	unsigned int nports;
+	isc_boolean_t available = ISC_FALSE;
 
 	REQUIRE(sock != NULL || sockaddrp != NULL);
 
-	if (mgr->portlist == NULL)
-		return (ISC_FALSE);
-
+	PORTBUFLOCK(mgr);
 	if (sock != NULL) {
 		sockaddrp = &sockaddr;
 		result = isc_socket_getsockname(sock, sockaddrp);
 		if (result != ISC_R_SUCCESS)
-			return (ISC_FALSE);
+			goto unlock;
 	}
 
-	if (mgr->portlist != NULL &&
-	    dns_portlist_match(mgr->portlist, isc_sockaddr_pf(sockaddrp),
-			       isc_sockaddr_getport(sockaddrp)))
-		return (ISC_TRUE);
-	return (ISC_FALSE);
+	if (isc_sockaddr_pf(sockaddrp) == AF_INET) {
+		ports = mgr->v4ports;
+		nports = mgr->nv4ports;
+	} else {
+		ports = mgr->v6ports;
+		nports = mgr->nv6ports;
+	}
+	if (ports == NULL)
+		goto unlock;
+
+	port = isc_sockaddr_getport(sockaddrp);
+	if (bsearch(&port, ports, nports, sizeof(in_port_t), port_cmp) != NULL)
+		available = ISC_TRUE;
+
+unlock:
+	PORTBUFUNLOCK(mgr);
+	return (available);
 }
 
 #define ATTRMATCH(_a1, _a2, _mask) (((_a1) & (_mask)) == ((_a2) & (_mask)))
@@ -1474,17 +2060,20 @@ local_addr_match(dns_dispatch_t *disp, isc_sockaddr_t *addr) {
 	isc_sockaddr_t sockaddr;
 	isc_result_t result;
 
+	REQUIRE(disp->socket != NULL);
+
 	if (addr == NULL)
 		return (ISC_TRUE);
 
 	/*
-	 * Don't match wildcard ports against newly blacklisted ports.
+	 * Don't match wildcard ports unless the port is available in the
+	 * current configuration.
 	 */
-	if (disp->mgr->portlist != NULL &&
-	    isc_sockaddr_getport(addr) == 0 &&
+	if (isc_sockaddr_getport(addr) == 0 &&
 	    isc_sockaddr_getport(&disp->local) == 0 &&
-	    blacklisted(disp->mgr, disp->socket, NULL))
+	    !portavailable(disp->mgr, disp->socket, NULL)) {
 		return (ISC_FALSE);
+	}
 
 	/*
 	 * Check if we match the binding <address,port>.
@@ -1526,10 +2115,10 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local,
 	isc_result_t result;
 
 	/*
-	 * Make certain that we will not match a private dispatch.
+	 * Make certain that we will not match a private or exclusive dispatch.
 	 */
-	attributes &= ~DNS_DISPATCHATTR_PRIVATE;
-	mask |= DNS_DISPATCHATTR_PRIVATE;
+	attributes &= ~(DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE);
+	mask |= (DNS_DISPATCHATTR_PRIVATE|DNS_DISPATCHATTR_EXCLUSIVE);
 
 	disp = ISC_LIST_HEAD(mgr->list);
 	while (disp != NULL) {
@@ -1556,7 +2145,8 @@ dispatch_find(dns_dispatchmgr_t *mgr, isc_sockaddr_t *local,
 
 static isc_result_t
 qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
-	     unsigned int increment, dns_qid_t **qidp)
+	     unsigned int increment, dns_qid_t **qidp,
+	     isc_boolean_t needsocktable)
 {
 	dns_qid_t *qid;
 	unsigned int i;
@@ -1578,16 +2168,35 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 		return (ISC_R_NOMEMORY);
 	}
 
+	qid->sock_table = NULL;
+	if (needsocktable) {
+		qid->sock_table = isc_mem_get(mgr->mctx, buckets *
+					      sizeof(dispsocketlist_t));
+		if (qid->sock_table == NULL) {
+			isc_mem_put(mgr->mctx, qid, sizeof(*qid));
+			isc_mem_put(mgr->mctx, qid->qid_table,
+				    buckets * sizeof(dns_displist_t));
+			return (ISC_R_NOMEMORY);
+		}
+	}
+
 	result = isc_mutex_init(&qid->lock);
 	if (result != ISC_R_SUCCESS) {
+		if (qid->sock_table != NULL) {
+			isc_mem_put(mgr->mctx, qid->sock_table,
+				    buckets * sizeof(dispsocketlist_t));
+		}
 		isc_mem_put(mgr->mctx, qid->qid_table,
 			    buckets * sizeof(dns_displist_t));
 		isc_mem_put(mgr->mctx, qid, sizeof(*qid));
 		return (result);
 	}
 
-	for (i = 0; i < buckets; i++)
+	for (i = 0; i < buckets; i++) {
 		ISC_LIST_INIT(qid->qid_table[i]);
+		if (qid->sock_table != NULL)
+			ISC_LIST_INIT(qid->sock_table[i]);
+	}
 
 	qid->qid_nbuckets = buckets;
 	qid->qid_increment = increment;
@@ -1609,6 +2218,10 @@ qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp) {
 	qid->magic = 0;
 	isc_mem_put(mctx, qid->qid_table,
 		    qid->qid_nbuckets * sizeof(dns_displist_t));
+	if (qid->sock_table != NULL) {
+		isc_mem_put(mctx, qid->sock_table,
+			    qid->qid_nbuckets * sizeof(dispsocketlist_t));
+	}
 	DESTROYLOCK(&qid->lock);
 	isc_mem_put(mctx, qid, sizeof(*qid));
 }
@@ -1652,6 +2265,10 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
 	disp->requests = 0;
 	disp->tcpbuffers = 0;
 	disp->qid = NULL;
+	ISC_LIST_INIT(disp->activesockets);
+	ISC_LIST_INIT(disp->inactivesockets);
+	disp->nsockets = 0;
+	dispatch_arc4init(&disp->arc4ctx, mgr->entropy, NULL);
 
 	result = isc_mutex_init(&disp->lock);
 	if (result != ISC_R_SUCCESS)
@@ -1704,6 +2321,8 @@ dispatch_free(dns_dispatch_t **dispp)
 	INSIST(disp->tcpbuffers == 0);
 	INSIST(disp->requests == 0);
 	INSIST(disp->recv_pending == 0);
+	INSIST(ISC_LIST_EMPTY(disp->activesockets));
+	INSIST(ISC_LIST_EMPTY(disp->inactivesockets));
 
 	isc_mempool_put(mgr->epool, disp->failsafe_ev);
 	disp->failsafe_ev = NULL;
@@ -1749,7 +2368,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		return (result);
 	}
 
-	result = qid_allocate(mgr, buckets, increment, &disp->qid);
+	result = qid_allocate(mgr, buckets, increment, &disp->qid, ISC_FALSE);
 	if (result != ISC_R_SUCCESS)
 		goto deallocate_dispatch;
 
@@ -1757,8 +2376,9 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	disp->socket = NULL;
 	isc_socket_attach(sock, &disp->socket);
 
-	disp->task = NULL;
-	result = isc_task_create(taskmgr, 0, &disp->task);
+	disp->ntasks = 1;
+	disp->task[0] = NULL;
+	result = isc_task_create(taskmgr, 0, &disp->task[0]);
 	if (result != ISC_R_SUCCESS)
 		goto kill_socket;
 
@@ -1771,7 +2391,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		goto kill_task;
 	}
 
-	isc_task_setname(disp->task, "tcpdispatch", disp);
+	isc_task_setname(disp->task[0], "tcpdispatch", disp);
 
 	dns_tcpmsg_init(mgr->mctx, disp->socket, &disp->tcpmsg);
 	disp->tcpmsg_valid = 1;
@@ -1785,7 +2405,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	UNLOCK(&mgr->lock);
 
 	mgr_log(mgr, LVL(90), "created TCP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task);
+	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]);
 
 	*dispp = disp;
 
@@ -1795,7 +2415,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 	 * Error returns.
 	 */
  kill_task:
-	isc_task_detach(&disp->task);
+	isc_task_detach(&disp->task[0]);
  kill_socket:
 	isc_socket_detach(&disp->socket);
  deallocate_dispatch:
@@ -1830,13 +2450,13 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	REQUIRE((attributes & DNS_DISPATCHATTR_TCP) == 0);
 
 	result = dns_dispatchmgr_setudp(mgr, buffersize, maxbuffers,
-					buckets, increment);
+					maxrequests, buckets, increment);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
 	LOCK(&mgr->lock);
 
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) {
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
 		REQUIRE(isc_sockaddr_getport(localaddr) == 0);
 		goto createudp;
 	}
@@ -1857,7 +2477,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		{
 			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
 			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, disp->task,
+				isc_socket_cancel(disp->socket, disp->task[0],
 						  ISC_SOCKCANCEL_RECV);
 		}
 
@@ -1894,6 +2514,101 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 #endif
 
 static isc_result_t
+get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
+	      isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr,
+	      isc_socket_t **sockp)
+{
+	unsigned int i, j;
+	isc_socket_t *held[DNS_DISPATCH_HELD];
+	isc_sockaddr_t localaddr_bound;
+	isc_socket_t *sock = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_boolean_t anyport;
+
+	INSIST(sockp != NULL && *sockp == NULL);
+
+	localaddr_bound = *localaddr;
+	anyport = ISC_TF(isc_sockaddr_getport(localaddr) == 0);
+
+	if (anyport) {
+		unsigned int nports;
+		in_port_t *ports;
+
+		/*
+		 * If no port is specified, we first try to pick up a random
+		 * port by ourselves.
+		 */
+		if (isc_sockaddr_pf(&disp->local) == AF_INET) {
+			nports = disp->mgr->nv4ports;
+			ports = disp->mgr->v4ports;
+		} else {
+			nports = disp->mgr->nv6ports;
+			ports = disp->mgr->v6ports;
+		}
+		if (nports == 0)
+			return (ISC_R_ADDRNOTAVAIL);
+
+		for (i = 0; i < 1024; i++) {
+			in_port_t prt;
+
+			prt = ports[dispatch_arc4uniformrandom(
+					DISP_ARC4CTX(disp),
+					nports)];
+			isc_sockaddr_setport(&localaddr_bound, prt);
+			result = open_socket(sockmgr, &localaddr_bound,
+					     0, &sock);
+			if (result == ISC_R_SUCCESS ||
+			    result != ISC_R_ADDRINUSE) {
+				disp->localport = prt;
+				*sockp = sock;
+				return (result);
+			}
+		}
+
+		/*
+		 * If this fails 1024 times, we then ask the kernel for
+		 * choosing one.
+		 */
+	}
+
+	memset(held, 0, sizeof(held));
+	i = 0;
+
+	for (j = 0; j < 0xffffU; j++) {
+		result = open_socket(sockmgr, localaddr, 0, &sock);
+		if (result != ISC_R_SUCCESS)
+			goto end;
+		else if (!anyport)
+			break;
+		else if (portavailable(mgr, sock, NULL))
+			break;
+		if (held[i] != NULL)
+			isc_socket_detach(&held[i]);
+		held[i++] = sock;
+		sock = NULL;
+		if (i == DNS_DISPATCH_HELD)
+			i = 0;
+	}
+	if (j == 0xffffU) {
+		mgr_log(mgr, ISC_LOG_ERROR,
+			"avoid-v%s-udp-ports: unable to allocate "
+			"an available port",
+			isc_sockaddr_pf(localaddr) == AF_INET ? "4" : "6");
+		result = ISC_R_FAILURE;
+		goto end;
+	}
+	*sockp = sock;
+
+end:
+	for (i = 0; i < DNS_DISPATCH_HELD; i++) {
+		if (held[i] != NULL)
+			isc_socket_detach(&held[i]);
+	}
+
+	return (result);
+}
+
+static isc_result_t
 dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		   isc_taskmgr_t *taskmgr,
 		   isc_sockaddr_t *localaddr,
@@ -1904,10 +2619,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	isc_result_t result;
 	dns_dispatch_t *disp;
 	isc_socket_t *sock = NULL;
-	isc_socket_t *held[DNS_DISPATCH_HELD];
-	unsigned int i = 0, j = 0, k = 0;
-	isc_sockaddr_t localaddr_bound;
-	in_port_t localport = 0;
+	int i = 0;
 
 	/*
 	 * dispatch_allocate() checks mgr for us.
@@ -1917,67 +2629,46 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	/*
-	 * Try to allocate a socket that is not on the blacklist.
-	 * Hold up to DNS_DISPATCH_HELD sockets to prevent the OS
-	 * from returning the same port to us too quickly.
-	 */
-	memset(held, 0, sizeof(held));
-	localaddr_bound = *localaddr;
- getsocket:
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) != 0) {
-		in_port_t prt;
-
-		/* XXX: should the range be configurable? */
-		prt = 1024 + dispatch_arc4uniformrandom(mgr, 65535 - 1023);
-		isc_sockaddr_setport(&localaddr_bound, prt);
-		if (blacklisted(mgr, NULL, &localaddr_bound)) {
-			if (++k == 1024)
-				attributes &= ~DNS_DISPATCHATTR_RANDOMPORT;
-			goto getsocket;
-		}
-		result = create_socket(sockmgr, &localaddr_bound, 0, &sock);
-		if (result == ISC_R_ADDRINUSE) {
-			if (++k == 1024)
-				attributes &= ~DNS_DISPATCHATTR_RANDOMPORT;
-			goto getsocket;
-		}
-		localport = prt;
-	} else
-		result = create_socket(sockmgr, localaddr,
-				       ISC_SOCKET_REUSEADDRESS, &sock);
-	if (result != ISC_R_SUCCESS)
-		goto deallocate_dispatch;
-	if ((attributes & DNS_DISPATCHATTR_RANDOMPORT) == 0 &&
-	    isc_sockaddr_getport(localaddr) == 0 &&
-	    blacklisted(mgr, sock, NULL))
-	{
-		if (held[i] != NULL)
-			isc_socket_detach(&held[i]);
-		held[i++] = sock;
-		sock = NULL;
-		if (i == DNS_DISPATCH_HELD)
-			i = 0;
-		if (j++ == 0xffffU) {
-			mgr_log(mgr, ISC_LOG_ERROR, "avoid-v%s-udp-ports: "
-				"unable to allocate a non-blacklisted port",
-				isc_sockaddr_pf(localaddr) == AF_INET ?
-					"4" : "6");
-			result = ISC_R_FAILURE;
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
+		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock);
+		if (result != ISC_R_SUCCESS)
 			goto deallocate_dispatch;
+	} else {
+		isc_sockaddr_t sa_any;
+
+		/*
+		 * For dispatches using exclusive sockets with a specific
+		 * source address, we only check if the specified address is
+		 * available on the system.  Query sockets will be created later
+		 * on demand.
+		 */
+		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
+		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
+			result = open_socket(sockmgr, localaddr, 0, &sock);
+			if (sock != NULL)
+				isc_socket_detach(&sock);
+			if (result != ISC_R_SUCCESS)
+				goto deallocate_dispatch;
 		}
-		goto getsocket;
 	}
-
 	disp->socktype = isc_sockettype_udp;
 	disp->socket = sock;
 	disp->local = *localaddr;
-	disp->localport = localport;
 
-	disp->task = NULL;
-	result = isc_task_create(taskmgr, 0, &disp->task);
-	if (result != ISC_R_SUCCESS)
-		goto kill_socket;
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		disp->ntasks = MAX_INTERNAL_TASKS;
+	else
+		disp->ntasks = 1;
+	for (i = 0; i < disp->ntasks; i++) {
+		disp->task[i] = NULL;
+		result = isc_task_create(taskmgr, 0, &disp->task[i]);
+		if (result != ISC_R_SUCCESS) {
+			while (--i >= 0)
+				isc_task_destroy(&disp->task[i]);
+			goto kill_socket;
+		}
+		isc_task_setname(disp->task[i], "udpdispatch", disp);
+	}
 
 	disp->ctlevent = isc_event_allocate(mgr->mctx, disp,
 					    DNS_EVENT_DISPATCHCONTROL,
@@ -1988,8 +2679,6 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		goto kill_task;
 	}
 
-	isc_task_setname(disp->task, "udpdispatch", disp);
-
 	attributes &= ~DNS_DISPATCHATTR_TCP;
 	attributes |= DNS_DISPATCHATTR_UDP;
 	disp->attributes = attributes;
@@ -2000,26 +2689,25 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	ISC_LIST_APPEND(mgr->list, disp, link);
 
 	mgr_log(mgr, LVL(90), "created UDP dispatcher %p", disp);
-	dispatch_log(disp, LVL(90), "created task %p", disp->task);
-	dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
+	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); /* XXX */
+	if (disp->socket != NULL)
+		dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
 
 	*dispp = disp;
-
-	goto cleanheld;
+	return (result);
 
 	/*
 	 * Error returns.
 	 */
  kill_task:
-	isc_task_detach(&disp->task);
+	for (i = 0; i < disp->ntasks; i++)
+		isc_task_detach(&disp->task[i]);
  kill_socket:
-	isc_socket_detach(&disp->socket);
+	if (disp->socket != NULL)
+		isc_socket_detach(&disp->socket);
  deallocate_dispatch:
 	dispatch_free(&disp);
- cleanheld:
-	for (i = 0; i < DNS_DISPATCH_HELD; i++)
-		if (held[i] != NULL)
-			isc_socket_detach(&held[i]);
+
 	return (result);
 }
 
@@ -2045,6 +2733,7 @@ dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp) {
 void
 dns_dispatch_detach(dns_dispatch_t **dispp) {
 	dns_dispatch_t *disp;
+	dispsocket_t *dispsock;
 	isc_boolean_t killit;
 
 	REQUIRE(dispp != NULL && VALID_DISPATCH(*dispp));
@@ -2059,8 +2748,14 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, disp->task,
+			isc_socket_cancel(disp->socket, disp->task[0],
+					  ISC_SOCKCANCEL_RECV);
+		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
+		     dispsock != NULL;
+		     dispsock = ISC_LIST_NEXT(dispsock, link)) {
+			isc_socket_cancel(dispsock->socket, dispsock->task,
 					  ISC_SOCKCANCEL_RECV);
+		}
 		disp->shutting_down = 1;
 	}
 
@@ -2069,26 +2764,32 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
 	killit = destroy_disp_ok(disp);
 	UNLOCK(&disp->lock);
 	if (killit)
-		isc_task_send(disp->task, &disp->ctlevent);
+		isc_task_send(disp->task[0], &disp->ctlevent);
 }
 
 isc_result_t
-dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
-			 isc_task_t *task, isc_taskaction_t action, void *arg,
-			 dns_messageid_t *idp, dns_dispentry_t **resp)
+dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			  isc_task_t *task, isc_taskaction_t action, void *arg,
+			  dns_messageid_t *idp, dns_dispentry_t **resp,
+			  isc_socketmgr_t *sockmgr)
 {
 	dns_dispentry_t *res;
 	unsigned int bucket;
+	in_port_t localport = 0;
 	dns_messageid_t id;
 	int i;
 	isc_boolean_t ok;
 	dns_qid_t *qid;
+	dispsocket_t *dispsocket = NULL;
+	isc_result_t result;
 
 	REQUIRE(VALID_DISPATCH(disp));
 	REQUIRE(task != NULL);
 	REQUIRE(dest != NULL);
 	REQUIRE(resp != NULL && *resp == NULL);
 	REQUIRE(idp != NULL);
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		REQUIRE(sockmgr != NULL);
 
 	LOCK(&disp->lock);
 
@@ -2102,23 +2803,75 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 		return (ISC_R_QUOTA);
 	}
 
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0 &&
+	    disp->nsockets > DNS_DISPATCH_SOCKSQUOTA) {
+		dispsocket_t *oldestsocket;
+		dns_dispentry_t *oldestresp;
+		dns_dispatchevent_t *rev;
+
+		/*
+		 * Kill oldest outstanding query if the number of sockets
+		 * exceeds the quota to keep the room for new queries.
+		 */
+		oldestsocket = ISC_LIST_HEAD(disp->activesockets);
+		oldestresp = oldestsocket->resp;
+		if (oldestresp != NULL && !oldestresp->item_out) {
+			rev = allocate_event(oldestresp->disp);
+			if (rev != NULL) {
+				rev->buffer.base = NULL;
+				rev->result = ISC_R_CANCELED;
+				rev->id = oldestresp->id;
+				ISC_EVENT_INIT(rev, sizeof(*rev), 0,
+					       NULL, DNS_EVENT_DISPATCH,
+					       oldestresp->action,
+					       oldestresp->arg, oldestresp,
+					       NULL, NULL);
+				oldestresp->item_out = ISC_TRUE;
+				isc_task_send(oldestresp->task,
+					      ISC_EVENT_PTR(&rev));
+			}
+		}
+
+		/*
+		 * Move this entry to the tail so that it won't (easily) be
+		 * examined before actually being canceled.
+		 */
+		ISC_LIST_UNLINK(disp->activesockets, oldestsocket, link);
+		ISC_LIST_APPEND(disp->activesockets, oldestsocket, link);
+	}
+
+	qid = DNS_QID(disp);
+	LOCK(&qid->lock);
+
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		/*
+		 * Get a separate UDP socket with a random port number.
+		 */
+		result = get_dispsocket(disp, dest, sockmgr, qid, &dispsocket,
+					&localport);
+		if (result != ISC_R_SUCCESS) {
+			UNLOCK(&qid->lock);
+			UNLOCK(&disp->lock);
+			return (result);
+		}
+	} else {
+		localport = disp->localport;
+	}
+
 	/*
 	 * Try somewhat hard to find an unique ID.
 	 */
-	id = (dns_messageid_t)dispatch_arc4random(disp->mgr);
-	qid = DNS_QID(disp);
-	LOCK(&qid->lock);
-	bucket = dns_hash(qid, dest, id, disp->localport);
+	id = (dns_messageid_t)dispatch_arc4random(DISP_ARC4CTX(disp));
+	bucket = dns_hash(qid, dest, id, localport);
 	ok = ISC_FALSE;
 	for (i = 0; i < 64; i++) {
-		if (bucket_search(qid, dest, id, disp->localport, bucket) ==
-		    NULL) {
+		if (entry_search(qid, dest, id, localport, bucket) == NULL) {
 			ok = ISC_TRUE;
 			break;
 		}
 		id += qid->qid_increment;
 		id &= 0x0000ffff;
-		bucket = dns_hash(qid, dest, id, disp->localport);
+		bucket = dns_hash(qid, dest, id, localport);
 	}
 
 	if (!ok) {
@@ -2131,6 +2884,8 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	if (res == NULL) {
 		UNLOCK(&qid->lock);
 		UNLOCK(&disp->lock);
+		if (dispsocket != NULL)
+			destroy_dispsocket(disp, &dispsocket);
 		return (ISC_R_NOMEMORY);
 	}
 
@@ -2140,11 +2895,14 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 	isc_task_attach(task, &res->task);
 	res->disp = disp;
 	res->id = id;
-	res->port = disp->localport;
+	res->port = localport;
 	res->bucket = bucket;
 	res->host = *dest;
 	res->action = action;
 	res->arg = arg;
+	res->dispsocket = dispsocket;
+	if (dispsocket != NULL)
+		dispsocket->resp = res;
 	res->item_out = ISC_FALSE;
 	ISC_LIST_INIT(res->items);
 	ISC_LINK_INIT(res, link);
@@ -2156,27 +2914,62 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 		    "attached to task %p", res->task);
 
 	if (((disp->attributes & DNS_DISPATCHATTR_UDP) != 0) ||
-	    ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0))
-		startrecv(disp);
+	    ((disp->attributes & DNS_DISPATCHATTR_CONNECTED) != 0)) {
+		result = startrecv(disp, dispsocket);
+		if (result != ISC_R_SUCCESS) {
+			LOCK(&qid->lock);
+			ISC_LIST_UNLINK(qid->qid_table[bucket], res, link);
+			UNLOCK(&qid->lock);
+
+			if (dispsocket != NULL)
+				destroy_dispsocket(disp, &dispsocket);
+
+			disp->refcount--;
+			disp->requests--;
+
+			UNLOCK(&disp->lock);
+			isc_task_detach(&res->task);
+			isc_mempool_put(disp->mgr->rpool, res);
+			return (result);
+		}
+	}
+
+	if (dispsocket != NULL)
+		ISC_LIST_APPEND(disp->activesockets, dispsocket, link);
 
 	UNLOCK(&disp->lock);
 
 	*idp = id;
 	*resp = res;
 
+	if ((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+		INSIST(res->dispsocket != NULL);
+
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			 isc_task_t *task, isc_taskaction_t action, void *arg,
+			 dns_messageid_t *idp, dns_dispentry_t **resp)
+{
+	REQUIRE(VALID_DISPATCH(disp));
+	REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0);
+
+	return (dns_dispatch_addresponse2(disp, dest, task, action, arg,
+					  idp, resp, NULL));
+}
+
 void
 dns_dispatch_starttcp(dns_dispatch_t *disp) {
 
 	REQUIRE(VALID_DISPATCH(disp));
 
-	dispatch_log(disp, LVL(90), "starttcp %p", disp->task);
+	dispatch_log(disp, LVL(90), "starttcp %p", disp->task[0]);
 
 	LOCK(&disp->lock);
 	disp->attributes |= DNS_DISPATCHATTR_CONNECTED;
-	startrecv(disp);
+	(void)startrecv(disp, NULL);
 	UNLOCK(&disp->lock);
 }
 
@@ -2187,6 +2980,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	dns_dispatchmgr_t *mgr;
 	dns_dispatch_t *disp;
 	dns_dispentry_t *res;
+	dispsocket_t *dispsock;
 	dns_dispatchevent_t *ev;
 	unsigned int bucket;
 	isc_boolean_t killit;
@@ -2224,8 +3018,14 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, disp->task,
+			isc_socket_cancel(disp->socket, disp->task[0],
 					  ISC_SOCKCANCEL_RECV);
+		for (dispsock = ISC_LIST_HEAD(disp->activesockets);
+		     dispsock != NULL;
+		     dispsock = ISC_LIST_NEXT(dispsock, link)) {
+			isc_socket_cancel(dispsock->socket, dispsock->task,
+					  ISC_SOCKCANCEL_RECV);
+		}
 		disp->shutting_down = 1;
 	}
 
@@ -2261,6 +3061,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	request_log(disp, res, LVL(90), "detaching from task %p", res->task);
 	isc_task_detach(&res->task);
 
+	if (res->dispsocket != NULL) {
+		isc_socket_cancel(res->dispsocket->socket,
+				  res->dispsocket->task, ISC_SOCKCANCEL_RECV);
+		res->dispsocket->resp = NULL;
+	}
+
 	/*
 	 * Free any buffered requests as well
 	 */
@@ -2277,12 +3083,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	if (disp->shutting_down == 1)
 		do_cancel(disp);
 	else
-		startrecv(disp);
+		(void)startrecv(disp, NULL);
 
 	killit = destroy_disp_ok(disp);
 	UNLOCK(&disp->lock);
 	if (killit)
-		isc_task_send(disp->task, &disp->ctlevent);
+		isc_task_send(disp->task[0], &disp->ctlevent);
 }
 
 static void
@@ -2297,13 +3103,15 @@ do_cancel(dns_dispatch_t *disp) {
 	qid = DNS_QID(disp);
 
 	/*
-	 * Search for the first response handler without packets outstanding.
+	 * Search for the first response handler without packets outstanding
+	 * unless a specific hander is given.
 	 */
 	LOCK(&qid->lock);
 	for (resp = linear_first(qid);
-	     resp != NULL && resp->item_out != ISC_FALSE;
+	     resp != NULL && resp->item_out;
 	     /* Empty. */)
 		resp = linear_next(qid, resp);
+
 	/*
 	 * No one to send the cancel event to, so nothing to do.
 	 */
@@ -2336,6 +3144,16 @@ dns_dispatch_getsocket(dns_dispatch_t *disp) {
 	return (disp->socket);
 }
 
+isc_socket_t *
+dns_dispatch_getentrysocket(dns_dispentry_t *resp) {
+	REQUIRE(VALID_RESPONSE(resp));
+
+	if (resp->dispsocket != NULL)
+		return (resp->dispsocket->socket);
+	else
+		return (NULL);
+}
+
 isc_result_t
 dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp) {
 
@@ -2369,11 +3187,27 @@ dns_dispatch_cancel(dns_dispatch_t *disp) {
 	return;
 }
 
+unsigned int
+dns_dispatch_getattributes(dns_dispatch_t *disp) {
+	REQUIRE(VALID_DISPATCH(disp));
+
+	/*
+	 * We don't bother locking disp here; it's the caller's responsibility
+	 * to use only non volatile flags.
+	 */
+	return (disp->attributes);
+}
+
 void
 dns_dispatch_changeattributes(dns_dispatch_t *disp,
 			      unsigned int attributes, unsigned int mask)
 {
 	REQUIRE(VALID_DISPATCH(disp));
+	/* Exclusive attribute can only be set on creation */
+	REQUIRE((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0);
+	/* Also, a dispatch with randomport specified cannot start listening */
+	REQUIRE((disp->attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0 ||
+		(attributes & DNS_DISPATCHATTR_NOLISTEN) == 0);
 
 	/* XXXMLG
 	 * Should check for valid attributes here!
@@ -2385,13 +3219,13 @@ dns_dispatch_changeattributes(dns_dispatch_t *disp,
 		if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 &&
 		    (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) {
 			disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN;
-			startrecv(disp);
+			(void)startrecv(disp, NULL);
 		} else if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN)
 			   == 0 &&
 			   (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) {
 			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
 			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, disp->task,
+				isc_socket_cancel(disp->socket, disp->task[0],
 						  ISC_SOCKCANCEL_RECV);
 		}
 	}
@@ -2415,7 +3249,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	INSIST(sevent->n <= disp->mgr->buffersize);
 	newsevent = (isc_socketevent_t *)
 		    isc_event_allocate(disp->mgr->mctx, NULL,
-				      DNS_EVENT_IMPORTRECVDONE, udp_recv,
+				      DNS_EVENT_IMPORTRECVDONE, udp_shrecv,
 				      disp, sizeof(isc_socketevent_t));
 	if (newsevent == NULL)
 		return;
@@ -2434,8 +3268,8 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	newsevent->timestamp = sevent->timestamp;
 	newsevent->pktinfo = sevent->pktinfo;
 	newsevent->attributes = sevent->attributes;
-	
-	isc_task_send(disp->task, ISC_EVENT_PTR(&newsevent));
+
+	isc_task_send(disp->task[0], ISC_EVENT_PTR(&newsevent));
 }
 
 #if 0
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index aad79984960a..ce361ef2d128 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -18,7 +18,7 @@
 
 /*%
  * Principal Author: Brian Wellington
- * $Id: dst_parse.c,v 1.1.6.7 2006/05/16 03:59:26 marka Exp $
+ * $Id: dst_parse.c,v 1.1.6.9 2008/01/22 23:27:05 tbox Exp $
  */
 
 #include <config.h>
@@ -260,6 +260,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 	REQUIRE(priv != NULL);
 
 	priv->nelements = 0;
+	memset(priv->elements, 0, sizeof(priv->elements));
 
 #define NEXTTOKEN(lex, opt, token)				\
 	do {							\
@@ -351,7 +352,6 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
 			goto fail;
 		}
 
-		memset(&priv->elements[n], 0, sizeof(dst_private_element_t));
 		tag = find_value(DST_AS_STR(token), alg);
 		if (tag < 0 || TAG_ALG(tag) != alg) {
 			ret = DST_R_INVALIDPRIVATEKEY;
diff --git a/lib/dns/dst_parse.h b/lib/dns/dst_parse.h
index 8656f5964fb4..665fcfc0c98c 100644
--- a/lib/dns/dst_parse.h
+++ b/lib/dns/dst_parse.h
@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2000-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_parse.h,v 1.1.6.5 2006/01/27 23:57:44 marka Exp $ */
+/* $Id: dst_parse.h,v 1.1.6.7 2008/05/15 23:46:06 tbox Exp $ */
 
 /*! \file */
 #ifndef DST_DST_PARSE_H
@@ -75,7 +75,7 @@
 
 #define HMACSHA256_NTAGS	2
 #define TAG_HMACSHA256_KEY	((DST_ALG_HMACSHA256 << TAG_SHIFT) + 0)
-#define TAG_HMACSHA256_BITS	((DST_ALG_HMACSHA224 << TAG_SHIFT) + 1)
+#define TAG_HMACSHA256_BITS	((DST_ALG_HMACSHA256 << TAG_SHIFT) + 1)
 
 #define HMACSHA384_NTAGS	2
 #define TAG_HMACSHA384_KEY	((DST_ALG_HMACSHA384 << TAG_SHIFT) + 0)
diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
index 914993bf9e8a..8c143207b9ea 100644
--- a/lib/dns/include/dns/dispatch.h
+++ b/lib/dns/include/dns/dispatch.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.h,v 1.48.18.5.12.2 2008/07/23 07:28:56 tbox Exp $ */
+/* $Id: dispatch.h,v 1.48.18.9 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef DNS_DISPATCH_H
 #define DNS_DISPATCH_H 1
@@ -105,7 +105,7 @@ struct dns_dispatchevent {
  *	The dispatcher is a TCP or UDP socket.
  *
  * _IPV4, _IPV6
- *	The dispatcher uses an ipv4 or ipv6 socket.
+ *	The dispatcher uses an IPv4 or IPv6 socket.
  *
  * _NOLISTEN
  *	The dispatcher should not listen on the socket.
@@ -115,7 +115,12 @@ struct dns_dispatchevent {
  *	accept replies from them.
  *
  * _RANDOMPORT
- *	Allocate UDP port randomly.
+ *	Previously used to indicate that the port of a dispatch UDP must be
+ *	chosen randomly.  This behavior now always applies and the attribute
+ *	is obsoleted.
+ *
+ * _EXCLUSIVE
+ *	A separate socket will be used on-demand for each transaction.
  */
 #define DNS_DISPATCHATTR_PRIVATE	0x00000001U
 #define DNS_DISPATCHATTR_TCP		0x00000002U
@@ -125,7 +130,8 @@ struct dns_dispatchevent {
 #define DNS_DISPATCHATTR_NOLISTEN	0x00000020U
 #define DNS_DISPATCHATTR_MAKEQUERY	0x00000040U
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
-#define DNS_DISPATCHATTR_RANDOMPORT	0x00000100U
+/*#define DNS_DISPATCHATTR_RANDOMPORT	0x00000100U*/
+#define DNS_DISPATCHATTR_EXCLUSIVE	0x00000200U
 /*@}*/
 
 isc_result_t
@@ -187,26 +193,34 @@ dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr);
 
 void
 dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
-                                 dns_portlist_t *portlist);
+				 dns_portlist_t *portlist);
 /*%<
- * Sets a list of UDP ports that won't be used when creating a udp
- * dispatch with a wildcard port.
+ * This function is deprecated.  Use dns_dispatchmgr_setavailports() instead.
  *
  * Requires:
  *\li	mgr is a valid dispatchmgr
- *\li	portlist to be NULL or a valid port list.
  */
 
 dns_portlist_t *
 dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr);
 /*%<
- * Return the current port list.
+ * This function is deprecated and always returns NULL.
  *
  * Requires:
  *\li	mgr is a valid dispatchmgr
  */
 
-
+isc_result_t
+dns_dispatchmgr_setavailports(dns_dispatchmgr_t *mgr, isc_portset_t *v4portset,
+			      isc_portset_t *v6portset);
+/*%<
+ * Sets a list of UDP ports that can be used for outgoing UDP messages.
+ *
+ * Requires:
+ *\li	mgr is a valid dispatchmgr
+ *\li	v4portset is NULL or a valid port set
+ *\li	v6portset is NULL or a valid port set
+ */
 
 isc_result_t
 dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
@@ -319,6 +333,12 @@ dns_dispatch_starttcp(dns_dispatch_t *disp);
  */
 
 isc_result_t
+dns_dispatch_addresponse2(dns_dispatch_t *disp, isc_sockaddr_t *dest,
+			  isc_task_t *task, isc_taskaction_t action, void *arg,
+			  isc_uint16_t *idp, dns_dispentry_t **resp,
+			  isc_socketmgr_t *sockmgr);
+
+isc_result_t
 dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 			 isc_task_t *task, isc_taskaction_t action, void *arg,
 			 isc_uint16_t *idp, dns_dispentry_t **resp);
@@ -341,6 +361,10 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
  *
  *\li	"resp" be non-NULL and *resp be NULL
  *
+ *\li	"sockmgr" be NULL or a valid socket manager.  If 'disp' has
+ *	the DNS_DISPATCHATTR_EXCLUSIVE attribute, this must not be NULL,
+ *	which also means dns_dispatch_addresponse() cannot be used.
+ *
  * Ensures:
  *
  *\li	&lt;id, dest> is a unique tuple.  That means incoming messages
@@ -367,10 +391,12 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
  *\li	"resp" != NULL and "*resp" contain a value previously allocated
  *	by dns_dispatch_addresponse();
  *
- *\li	May only be called from within the task given as the 'task' 
+ *\li	May only be called from within the task given as the 'task'
  * 	argument to dns_dispatch_addresponse() when allocating '*resp'.
  */
 
+isc_socket_t *
+dns_dispatch_getentrysocket(dns_dispentry_t *resp);
 
 isc_socket_t *
 dns_dispatch_getsocket(dns_dispatch_t *disp);
@@ -384,7 +410,7 @@ dns_dispatch_getsocket(dns_dispatch_t *disp);
  *\li	The socket the dispatcher is using.
  */
 
-isc_result_t 
+isc_result_t
 dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp);
 /*%<
  * Return the local address for this dispatch.
@@ -395,7 +421,7 @@ dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp);
  *\li	addrp to be non null.
  *
  * Returns:
- *\li	ISC_R_SUCCESS	
+ *\li	ISC_R_SUCCESS
  *\li	ISC_R_NOTIMPLEMENTED
  */
 
@@ -408,6 +434,16 @@ dns_dispatch_cancel(dns_dispatch_t *disp);
  *\li	disp is valid.
  */
 
+unsigned int
+dns_dispatch_getattributes(dns_dispatch_t *disp);
+/*%<
+ * Return the attributes (DNS_DISPATCHATTR_xxx) of this dispatch.  Only the
+ * non-changeable attributes are expected to be referenced by the caller.
+ *
+ * Requires:
+ *\li	disp is valid.
+ */
+
 void
 dns_dispatch_changeattributes(dns_dispatch_t *disp,
 			      unsigned int attributes, unsigned int mask);
@@ -421,7 +457,7 @@ dns_dispatch_changeattributes(dns_dispatch_t *disp,
  *	new = (old & ~mask) | (attributes & mask)
  * \endcode
  *
- * This function has a side effect when #DNS_DISPATCHATTR_NOLISTEN changes. 
+ * This function has a side effect when #DNS_DISPATCHATTR_NOLISTEN changes.
  * When the flag becomes off, the dispatch will start receiving on the
  * corresponding socket.  When the flag becomes on, receive events on the
  * corresponding socket will be canceled.
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 6cfb5aff5acb..4e4010fcb6f9 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.86.18.12 2007/09/07 05:21:41 marka Exp $ */
+/* $Id: journal.c,v 1.86.18.14 2008/09/25 04:01:36 tbox Exp $ */
 
 #include <config.h>
 
@@ -41,7 +41,7 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 
-/*! \file 
+/*! \file
  * \brief Journalling.
  *
  * A journal file consists of
@@ -107,7 +107,7 @@ static isc_boolean_t bind8_compat = ISC_TRUE; /* XXX config */
 	} while (0)
 
 #define CHECK(op) \
-     	do { result = (op); 					\
+	do { result = (op); 					\
 		if (result != ISC_R_SUCCESS) goto failure; 	\
 	} while (0)
 
@@ -149,11 +149,11 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_soa, 0,
 				     (isc_stdtime_t)0, &rdataset, NULL);
- 	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS)
 		goto freenode;
 
 	result = dns_rdataset_first(&rdataset);
- 	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS)
 		goto freenode;
 
 	dns_rdataset_current(&rdataset, &rdata);
@@ -674,7 +674,7 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write,
 	isc_result_t result;
 	int namelen;
 	char backup[1024];
-	
+
 	result = journal_open(mctx, filename, write, write, journalp);
 	if (result == ISC_R_NOTFOUND) {
 		namelen = strlen(filename);
@@ -1367,7 +1367,7 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) {
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "journal open failure: %s: %s",
-			      isc_result_totext(result), j->filename);
+			      isc_result_totext(result), filename);
 		return (result);
 	}
 
@@ -1405,9 +1405,9 @@ dns_journal_print(isc_mem_t *mctx, const char *filename, FILE *file) {
 		if (n_soa == 3)
 			n_soa = 1;
 		if (n_soa == 0) {
-		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
-					 "%s: journal file corrupt: missing "
-					 "initial SOA", j->filename);
+			isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
+				      "%s: journal file corrupt: missing "
+				      "initial SOA", j->filename);
 			FAIL(ISC_R_UNEXPECTED);
 		}
 		CHECK(dns_difftuple_create(diff.mctx, n_soa == 1 ?
@@ -1984,7 +1984,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 		dns_journal_destroy(&j);
 		return (ISC_R_SUCCESS);
 	}
-		
+
 	if (DNS_SERIAL_GT(j->header.begin.serial, serial) ||
 	    DNS_SERIAL_GT(serial, j->header.end.serial)) {
 		dns_journal_destroy(&j);
@@ -2008,7 +2008,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 	}
 
 	CHECK(journal_open(mctx, newname, ISC_TRUE, ISC_TRUE, &new));
-	
+
 	/*
 	 * Remove overhead so space test below can succeed.
 	 */
@@ -2066,7 +2066,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 			result = ISC_R_NOMEMORY;
 			goto failure;
 		}
-	
+
 		CHECK(journal_seek(j, best_guess.offset));
 		CHECK(journal_seek(new, indexend));
 		for (i = 0; i < copy_length; i += size) {
@@ -2139,7 +2139,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
 			goto failure;
 		}
 	}
-		
+
 	dns_journal_destroy(&j);
 	result = ISC_R_SUCCESS;
 
diff --git a/lib/dns/master.c b/lib/dns/master.c
index aa04be014125..b04f2eb63623 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master.c,v 1.148.18.18 2007/08/28 07:20:04 tbox Exp $ */
+/* $Id: master.c,v 1.148.18.21 2008/01/17 23:45:58 tbox Exp $ */
 
 /*! \file */
 
@@ -536,7 +536,7 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 
 	lctx->inc = NULL;
 	result = incctx_create(mctx, origin, &lctx->inc);
-	if (result != ISC_R_SUCCESS) 
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_ctx;
 
 	lctx->format = format;
@@ -708,7 +708,7 @@ openfile_raw(dns_loadctx_t *lctx, const char *master_file) {
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_stdio_open() failed: %s",
-				 isc_result_totext(result));		
+				 isc_result_totext(result));
 	}
 
 	return (result);
@@ -912,7 +912,7 @@ check_ns(dns_loadctx_t *lctx, isc_token_t *token, const char *source,
 		callback = lctx->callbacks->error;
 	else
 		callback = lctx->callbacks->warn;
-		
+
 	if (token->type == isc_tokentype_string) {
 		struct in_addr addr;
 		struct in6_addr addr6;
@@ -1237,7 +1237,7 @@ load_text(dns_loadctx_t *lctx) {
 				/* CLASS? */
 				GETTOKEN(lctx->lex, 0, &token, ISC_FALSE);
 				if (dns_rdataclass_fromtext(&rdclass,
-                                            &token.value.as_textregion)
+					    &token.value.as_textregion)
 						== ISC_R_SUCCESS) {
 					GETTOKEN(lctx->lex, 0, &token,
 						 ISC_FALSE);
@@ -1421,7 +1421,7 @@ load_text(dns_loadctx_t *lctx) {
 					target_save = target;
 					ictx->glue = new_name;
 					ictx->glue_in_use = new_in_use;
-					ictx->in_use[ictx->glue_in_use] = 
+					ictx->in_use[ictx->glue_in_use] =
 						ISC_TRUE;
 				} else {
 					result = commit(callbacks, lctx,
@@ -1689,7 +1689,7 @@ load_text(dns_loadctx_t *lctx) {
 				dns_name_format(name, namebuf, sizeof(namebuf));
 				result = DNS_R_BADOWNERNAME;
 				desc = dns_result_totext(result);
-			        if ((lctx->options & DNS_MASTER_CHECKNAMESFAIL) != 0) {
+				if ((lctx->options & DNS_MASTER_CHECKNAMESFAIL) != 0) {
 					(*callbacks->error)(callbacks,
 							    "%s:%lu: %s: %s",
 							    source, line,
@@ -1739,9 +1739,9 @@ load_text(dns_loadctx_t *lctx) {
 			dns_name_format(ictx->current, namebuf,
 					sizeof(namebuf));
 			(*callbacks->error)(callbacks,
-				            "%s:%lu: SOA "
-			                    "record not at top of zone (%s)",
-				            source, line, namebuf);
+					    "%s:%lu: SOA "
+					    "record not at top of zone (%s)",
+					    source, line, namebuf);
 			result = DNS_R_NOTZONETOP;
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
@@ -1801,7 +1801,9 @@ load_text(dns_loadctx_t *lctx) {
 
 		if (type == dns_rdatatype_rrsig && lctx->warn_sigexpired) {
 			dns_rdata_rrsig_t sig;
-			(void)dns_rdata_tostruct(&rdata[rdcount], &sig, NULL);
+			result = dns_rdata_tostruct(&rdata[rdcount], &sig,
+						    NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (isc_serial_lt(sig.timeexpire, now)) {
 				(*callbacks->warn)(callbacks,
 						   "%s:%lu: "
@@ -1813,7 +1815,7 @@ load_text(dns_loadctx_t *lctx) {
 
 		if ((type == dns_rdatatype_sig || type == dns_rdatatype_nxt) &&
 		    lctx->warn_tcr && (lctx->options & DNS_MASTER_ZONE) != 0 &&
-                    (lctx->options & DNS_MASTER_SLAVE) == 0) {
+		    (lctx->options & DNS_MASTER_SLAVE) == 0) {
 			(*callbacks->warn)(callbacks, "%s:%lu: old style DNSSEC "
 					   " zone detected", source, line);
 			lctx->warn_tcr = ISC_FALSE;
@@ -1871,7 +1873,7 @@ load_text(dns_loadctx_t *lctx) {
 				ISC_LIST_INITANDPREPEND(glue_list, this, link);
 			else
 				ISC_LIST_INITANDPREPEND(current_list, this,
-						        link);
+							link);
 		} else if (this->ttl != lctx->ttl) {
 			(*callbacks->warn)(callbacks,
 					   "%s:%lu: "
@@ -1881,7 +1883,7 @@ load_text(dns_loadctx_t *lctx) {
 		}
 
 		ISC_LIST_APPEND(this->rdata, &rdata[rdcount], link);
-		if (ictx->glue != NULL) 
+		if (ictx->glue != NULL)
 			ictx->glue_line = line;
 		else
 			ictx->current_line = line;
@@ -2222,7 +2224,7 @@ load_raw(dns_loadctx_t *lctx) {
 			isc_uint16_t rdlen;
 
 			dns_rdata_init(&rdata[i]);
-			
+
 			if (sequential_read &&
 			    isc_buffer_availablelength(&target) < MINTSIZ) {
 				unsigned int j;
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 03716e246c69..1ffdfcb717ab 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.c,v 1.73.18.14 2006/08/08 06:39:36 marka Exp $ */
+/* $Id: masterdump.c,v 1.73.18.16 2008/08/13 23:46:04 tbox Exp $ */
 
 /*! \file */
 
@@ -183,7 +183,7 @@ struct dns_dumpctx {
 					    isc_buffer_t *buffer, FILE *f);
 };
 
-#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 
+#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
 
 /*%
  * Output tabs and spaces to go from column '*current' to
@@ -1071,13 +1071,13 @@ dns_dumpctx_detach(dns_dumpctx_t **dctxp) {
 
 dns_dbversion_t *
 dns_dumpctx_version(dns_dumpctx_t *dctx) {
-        REQUIRE(DNS_DCTX_VALID(dctx));
+	REQUIRE(DNS_DCTX_VALID(dctx));
 	return (dctx->version);
 }
 
 dns_db_t *
 dns_dumpctx_db(dns_dumpctx_t *dctx) {
-        REQUIRE(DNS_DCTX_VALID(dctx));
+	REQUIRE(DNS_DCTX_VALID(dctx));
 	return (dctx->db);
 }
 
@@ -1412,12 +1412,11 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 				      "dumptostreaminc(%p) new nodes -> %d\n",
 				      dctx, dctx->nodes);
 		}
-		result = dns_dbiterator_pause(dctx->dbiter);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		result = DNS_R_CONTINUE;
 	} else if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
  fail:
+	RUNTIME_CHECK(dns_dbiterator_pause(dctx->dbiter) == ISC_R_SUCCESS);
 	isc_mem_put(dctx->mctx, buffer.base, buffer.length);
 	return (result);
 }
@@ -1703,10 +1702,10 @@ dns_master_dumpnode(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 
 isc_result_t
 dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
-                       unsigned int ttl_column, unsigned int class_column,
-                       unsigned int type_column, unsigned int rdata_column,
-                       unsigned int line_length, unsigned int tab_width,
-                       isc_mem_t *mctx)
+		       unsigned int ttl_column, unsigned int class_column,
+		       unsigned int type_column, unsigned int rdata_column,
+		       unsigned int line_length, unsigned int tab_width,
+		       isc_mem_t *mctx)
 {
 	dns_master_style_t *style;
 
diff --git a/lib/dns/message.c b/lib/dns/message.c
index e8e494861877..8c56377d879e 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.222.18.14 2007/08/28 07:20:04 tbox Exp $ */
+/* $Id: message.c,v 1.222.18.16 2008/07/28 23:46:20 tbox Exp $ */
 
 /*! \file */
 
@@ -592,6 +592,9 @@ msgreset(dns_message_t *msg, isc_boolean_t everything) {
 		msg->tsigkey = NULL;
 	}
 
+	if (msg->tsigctx != NULL)
+		dst_context_destroy(&msg->tsigctx);
+
 	if (msg->query.base != NULL) {
 		if (msg->free_query != 0)
 			isc_mem_put(msg->mctx, msg->query.base,
@@ -987,7 +990,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		if (name == NULL)
 			return (ISC_R_NOMEMORY);
 		free_name = ISC_TRUE;
-		
+
 		offsets = newoffsets(msg);
 		if (offsets == NULL) {
 			result = ISC_R_NOMEMORY;
@@ -1297,7 +1300,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			}
 			/*
 			 * When the rdata is empty, the data pointer is
-			 * never dereferenced, but it must still be non-NULL. 
+			 * never dereferenced, but it must still be non-NULL.
 			 * Casting 1 rather than "" avoids warnings about
 			 * discarding the const attribute of a string,
 			 * for compilers that would warn about such things.
@@ -1436,7 +1439,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 							       rdataset)
 				      == ISC_R_SUCCESS);
 
-			if (rdtype != dns_rdatatype_opt && 
+			if (rdtype != dns_rdatatype_opt &&
 			    rdtype != dns_rdatatype_tsig &&
 			    !issigzero)
 			{
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index b8db99a50aa1..4d3ca3aa449e 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.128.18.7 2005/10/13 01:26:06 marka Exp $ */
+/* $Id: rbt.c,v 1.128.18.10 2008/03/31 13:32:59 fdupont Exp $ */
 
 /*! \file */
 
@@ -203,7 +203,7 @@ static inline void
 rotate_right(dns_rbtnode_t *node, dns_rbtnode_t **rootp);
 
 static void
-dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order, 
+dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 		   dns_rbtnode_t **rootp);
 
 static void
@@ -227,7 +227,7 @@ dns_rbt_create(isc_mem_t *mctx, void (*deleter)(void *, void *),
 	isc_result_t result;
 #endif
 	dns_rbt_t *rbt;
-	
+
 
 	REQUIRE(mctx != NULL);
 	REQUIRE(rbtp != NULL && *rbtp == NULL);
@@ -576,7 +576,7 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) {
 				rbt->nodecount++;
 				dns_name_getlabelsequence(name,
 							  nlabels - hlabels,
-						          hlabels, new_name);
+							  hlabels, new_name);
 				hash_node(rbt, new_current, new_name);
 
 				if (common_labels ==
@@ -772,7 +772,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
 			dns_name_init(&hash_name, NULL);
 
 		hashagain:
-			/* 
+			/*
 			 * Hash includes tail.
 			 */
 			dns_name_getlabelsequence(name,
@@ -832,7 +832,7 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
 			 */
 			current = NULL;
 			continue;
-			    
+
 		nohash:
 #endif /* DNS_RBT_USEHASH */
 			/*
@@ -1375,7 +1375,7 @@ dns_rbt_fullnamefromnode(dns_rbtnode_t *node, dns_name_t *name) {
 		result = dns_name_concatenate(name, &current, name, NULL);
 		if (result != ISC_R_SUCCESS)
 			break;
-		
+
 		node = find_up(node);
 	} while (! dns_name_isabsolute(name));
 
@@ -1642,7 +1642,7 @@ rotate_right(dns_rbtnode_t *node, dns_rbtnode_t **rootp) {
  * true red/black tree on a single level.
  */
 static void
-dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order, 
+dns_rbt_addonlevel(dns_rbtnode_t *node, dns_rbtnode_t *current, int order,
 		   dns_rbtnode_t **rootp)
 {
 	dns_rbtnode_t *child, *root, *parent, *grandparent;
@@ -2051,10 +2051,6 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum,
 		node = LEFT(node);
 		goto traverse;
 	}
-	if (RIGHT(node) != NULL) {
-		node = RIGHT(node);
-		goto traverse;
-	}
 	if (DOWN(node) != NULL) {
 		node = DOWN(node);
 		goto traverse;
@@ -2065,20 +2061,21 @@ dns_rbt_deletetreeflat(dns_rbt_t *rbt, unsigned int quantum,
 
 	/*
 	 * Note: we don't call unhash_node() here as we are destroying
-	 * the complete rbt tree. 
-         */
+	 * the complete rbt tree.
+	 */
 #if DNS_RBT_USEMAGIC
 	node->magic = 0;
 #endif
 	parent = PARENT(node);
+	if (RIGHT(node) != NULL)
+		PARENT(RIGHT(node)) = parent;
 	if (parent != NULL) {
 		if (LEFT(parent) == node)
-			LEFT(parent) = NULL;
+			LEFT(parent) = RIGHT(node);
 		else if (DOWN(parent) == node)
-			DOWN(parent) = NULL;
-		else if (RIGHT(parent) == node)
-			RIGHT(parent) = NULL;
-	}
+			DOWN(parent) = RIGHT(node);
+	} else
+		parent = RIGHT(node);
 	isc_mem_put(rbt->mctx, node, NODE_SIZE(node));
 	rbt->nodecount--;
 	node = parent;
@@ -2191,6 +2188,7 @@ dns_rbtnodechain_init(dns_rbtnodechain_t *chain, isc_mem_t *mctx) {
 	chain->end = NULL;
 	chain->level_count = 0;
 	chain->level_matches = 0;
+	memset(chain->levels, 0, sizeof(chain->levels));
 
 	chain->magic = CHAIN_MAGIC;
 }
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 1d729d027634..462a718dfa0e 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.196.18.48 2007/08/28 07:20:04 tbox Exp $ */
+/* $Id: rbtdb.c,v 1.196.18.53 2008/01/31 23:46:05 tbox Exp $ */
 
 /*! \file */
 
@@ -195,7 +195,7 @@ struct noqname {
 	void *	   nsecsig;
 };
 
-typedef struct acachectl acachectl_t;  
+typedef struct acachectl acachectl_t;
 
 typedef struct rdatasetheader {
 	/*%
@@ -219,7 +219,7 @@ typedef struct rdatasetheader {
 	 * Otherwise, it points up to the header whose down pointer points
 	 * at this header.
 	 */
-	  
+
 	struct rdatasetheader		*down;
 	/*%<
 	 * Points to the header for the next older version of
@@ -387,7 +387,7 @@ static void rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
 static void rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target);
 static unsigned int rdataset_count(dns_rdataset_t *rdataset);
 static isc_result_t rdataset_getnoqname(dns_rdataset_t *rdataset,
-				        dns_name_t *name,
+					dns_name_t *name,
 					dns_rdataset_t *nsec,
 					dns_rdataset_t *nsecsig);
 static isc_result_t rdataset_getadditional(dns_rdataset_t *rdataset,
@@ -604,13 +604,13 @@ adjust_quantum(unsigned int old, isc_time_t *start) {
 
 	/* Smooth */
 	new = (new + old * 3) / 4;
-	
+
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
 		      ISC_LOG_DEBUG(1), "adjust_quantum -> %d", new);
 
 	return (new);
 }
-		
+
 static void
 free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
 	unsigned int i;
@@ -647,7 +647,7 @@ free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
 			if (event == NULL)
 				event = isc_event_allocate(rbtdb->common.mctx,
 							   NULL,
-						         DNS_EVENT_FREESTORAGE,
+							 DNS_EVENT_FREESTORAGE,
 							   free_rbtdb_callback,
 							   rbtdb,
 							   sizeof(isc_event_t));
@@ -890,7 +890,7 @@ free_acachearray(isc_mem_t *mctx, rdatasetheader_t *header,
 	/*
 	 * Sanity check: since an additional cache entry has a reference to
 	 * the original DB node (in the callback arg), there should be no
-	 * acache entries when the node can be freed. 
+	 * acache entries when the node can be freed.
 	 */
 	for (i = 0; i < count; i++)
 		INSIST(array[i].entry == NULL && array[i].cbarg == NULL);
@@ -1241,7 +1241,7 @@ decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 						    isc_rwlocktype_write);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS ||
 			      result == ISC_R_LOCKBUSY);
- 
+
 		write_locked = ISC_TF(result == ISC_R_SUCCESS);
 	} else
 		write_locked = ISC_TRUE;
@@ -1388,6 +1388,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 	rbtdb_serial_t serial, least_serial;
 	dns_rbtnode_t *rbtnode;
 	unsigned int refs;
+	isc_boolean_t writer;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	version = (rbtdb_version_t *)*versionp;
@@ -1407,6 +1408,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 
 	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 	serial = version->serial;
+	writer = version->writer;
 	if (version->writer) {
 		if (commit) {
 			unsigned cur_ref;
@@ -1539,7 +1541,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 	/*
 	 * Update the zone's secure status.
 	 */
-	if (version->writer && commit && !IS_CACHE(rbtdb))
+	if (writer && commit && !IS_CACHE(rbtdb))
 		rbtdb->secure = iszonesecure(db, rbtdb->origin_node);
 
 	if (cleanup_version != NULL) {
@@ -1751,7 +1753,7 @@ zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 			if (header != NULL) {
 				if (header->type == dns_rdatatype_dname)
 					dname_header = header;
-				else if (header->type == 
+				else if (header->type ==
 					   RBTDB_RDATATYPE_SIGDNAME)
 					sigdname_header = header;
 				else if (node != onode ||
@@ -1983,7 +1985,7 @@ valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type,
 	count = raw[0] * 256 + raw[1];
 #if DNS_RDATASET_FIXED
 	raw += 2 + (4 * count);
-#else 
+#else
 	raw += 2;
 #endif
 
@@ -2997,7 +2999,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 	UNUSED(name);
 
 	lock = &(search->rbtdb->node_locks[node->locknum].lock);
-	locktype = isc_rwlocktype_read; 
+	locktype = isc_rwlocktype_read;
 	NODE_LOCK(lock, locktype);
 
 	/*
@@ -3026,7 +3028,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 				 * will eventually take the job as the last
 				 * resort.
 				 * We won't downgrade the lock, since other
-				 * rdatasets are probably stale, too. 
+				 * rdatasets are probably stale, too.
 				 */
 				locktype = isc_rwlocktype_write;
 
@@ -3262,7 +3264,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 	matchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_nsec, 0);
 	sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig,
 					     dns_rdatatype_nsec);
-	
+
 	do {
 		node = NULL;
 		dns_fixedname_init(&fname);
@@ -3289,7 +3291,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 				 * This rdataset is stale.  If no one else is
 				 * using the node, we can clean it up right
 				 * now, otherwise we mark it as stale, and the
-				 * node as dirty, so it will get cleaned up 
+				 * node as dirty, so it will get cleaned up
 				 * later.
 				 */
 				if ((header->ttl <= now - RBTDB_VIRTUAL) &&
@@ -4211,7 +4213,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 				 * can get write access.
 				 */
 				locktype = isc_rwlocktype_write;
-				
+
 				/*
 				 * We don't check if refcurrent(rbtnode) == 0
 				 * and try to free like we do in cache_find(),
@@ -4482,7 +4484,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			for (topheader = rbtnode->data;
 			     topheader != NULL;
 			     topheader = topheader->next) {
-				if (topheader->type == 
+				if (topheader->type ==
 				    RBTDB_RDATATYPE_NCACHEANY)
 					break;
 			}
@@ -4496,7 +4498,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 					 * The NXDOMAIN/NODATA(QTYPE=ANY)
 					 * is more trusted.
 					 */
-					
+
 					free_rdataset(rbtdb->common.mctx,
 						      newheader);
 					if (addedrdataset != NULL)
@@ -4576,7 +4578,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			INSIST(rbtversion->serial >= header->serial);
 			merged = NULL;
 			result = ISC_R_SUCCESS;
-			
+
 			if ((options & DNS_DBADD_EXACT) != 0)
 				flags |= DNS_RDATASLAB_EXACT;
 			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
@@ -4622,9 +4624,9 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 		    header->trust >= newheader->trust &&
 		    dns_rdataslab_equalx((unsigned char *)header,
 					 (unsigned char *)newheader,
-				         (unsigned int)(sizeof(*newheader)),
+					 (unsigned int)(sizeof(*newheader)),
 					 rbtdb->common.rdclass,
-				         (dns_rdatatype_t)header->type)) {
+					 (dns_rdatatype_t)header->type)) {
 			/*
 			 * Honour the new ttl if it is less than the
 			 * older one.
@@ -4649,7 +4651,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 		    header->trust >= newheader->trust &&
 		    dns_rdataslab_equal((unsigned char *)header,
 					(unsigned char *)newheader,
-				        (unsigned int)(sizeof(*newheader)))) {
+					(unsigned int)(sizeof(*newheader)))) {
 			/*
 			 * Honour the new ttl if it is less than the
 			 * older one.
@@ -5050,7 +5052,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		if ((options & DNS_DBSUB_EXACT) != 0)
 			result = DNS_R_NOTEXACT;
 		else
-			result = DNS_R_UNCHANGED;			
+			result = DNS_R_UNCHANGED;
 	}
 
 	if (result == ISC_R_SUCCESS && newrdataset != NULL)
@@ -5514,7 +5516,7 @@ dns_rbtdb_create
 		}
 		rbtdb->node_locks[i].exiting = ISC_FALSE;
 	}
-	
+
 	/*
 	 * Attach to the mctx.  The database will persist so long as there
 	 * are references to it, and attaching to the mctx ensures that our
@@ -5661,7 +5663,7 @@ rdataset_first(dns_rdataset_t *rdataset) {
 		rdataset->private5 = NULL;
 		return (ISC_R_NOMORE);
 	}
-	
+
 #if DNS_RDATASET_FIXED
 	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0)
 		raw += 2 + (4 * count);
@@ -5928,7 +5930,7 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
 	if (rdtype == 0) {
 		covers = RBTDB_RDATATYPE_EXT(header->type);
 		negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
-	} else 
+	} else
 		negtype = RBTDB_RDATATYPE_VALUE(0, rdtype);
 	for (header = header->next; header != NULL; header = top_next) {
 		top_next = header->next;
@@ -6517,12 +6519,13 @@ acache_callback(dns_acacheentry_t *entry, void **arg) {
 	}
 
 	count = cbarg->count;
-	if (acarray[count].entry == entry)
+	if (acarray != NULL && acarray[count].entry == entry) {
 		acarray[count].entry = NULL;
-	INSIST(acarray[count].cbarg != NULL);
-	isc_mem_put(rbtdb->common.mctx, acarray[count].cbarg,
-		    sizeof(acache_cbarg_t));
-	acarray[count].cbarg = NULL;
+		INSIST(acarray[count].cbarg == cbarg);
+		isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
+		acarray[count].cbarg = NULL;
+	} else
+		isc_mem_put(rbtdb->common.mctx, cbarg, sizeof(acache_cbarg_t));
 
 	dns_acache_detachentry(&entry);
 
@@ -6664,9 +6667,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
 	NODE_UNLOCK(nodelock, isc_rwlocktype_write);
 
 	if (oldentry != NULL) {
-		if (oldcbarg != NULL)
-			acache_cancelentry(rbtdb->common.mctx, oldentry,
-					   &oldcbarg); 
+		acache_cancelentry(rbtdb->common.mctx, oldentry, &oldcbarg);
 		dns_acache_detachentry(&oldentry);
 	}
 
@@ -6692,7 +6693,7 @@ rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
 static isc_result_t
 rdataset_putadditional(dns_acache_t *acache, dns_rdataset_t *rdataset,
 		       dns_rdatasetadditional_t type, dns_rdatatype_t qtype)
-{ 
+{
 	dns_rbtdb_t *rbtdb = rdataset->private1;
 	dns_rbtnode_t *rbtnode = rdataset->private2;
 	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
@@ -6751,8 +6752,7 @@ rdataset_putadditional(dns_acache_t *acache, dns_rdataset_t *rdataset,
 	NODE_UNLOCK(nodelock, isc_rwlocktype_write);
 
 	if (entry != NULL) {
-		if (cbarg != NULL)
-			acache_cancelentry(rbtdb->common.mctx, entry, &cbarg);
+		acache_cancelentry(rbtdb->common.mctx, entry, &cbarg);
 		dns_acache_detachentry(&entry);
 	}
 
diff --git a/lib/dns/rdata/generic/nsec_47.c b/lib/dns/rdata/generic/nsec_47.c
index f3e56ca237ad..dd391052c399 100644
--- a/lib/dns/rdata/generic/nsec_47.c
+++ b/lib/dns/rdata/generic/nsec_47.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec_47.c,v 1.7 2004/03/05 05:10:15 marka Exp $ */
+/* $Id: nsec_47.c,v 1.7.20.2 2008/07/15 23:46:14 tbox Exp $ */
 
 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
 
-/* draft-ietf-dnsext-nsec-rdata-01.txt */
+/* RFC 3845 */
 
 #ifndef RDATA_GENERIC_NSEC_47_C
 #define RDATA_GENERIC_NSEC_47_C
@@ -255,7 +255,7 @@ fromstruct_nsec(ARGS_FROMSTRUCT) {
 		window = nsec->typebits[i];
 		len = nsec->typebits[i+1];
 		i += 2;
-		INSIST(first || window > lastwindow); 
+		INSIST(first || window > lastwindow);
 		INSIST(len > 0 && len <= 32);
 		INSIST(i + len <= nsec->len);
 		INSIST(nsec->typebits[i + len - 1] != 0);
diff --git a/lib/dns/rdata/generic/nsec_47.h b/lib/dns/rdata/generic/nsec_47.h
index ff034833b9f8..5c52447a5b5d 100644
--- a/lib/dns/rdata/generic/nsec_47.h
+++ b/lib/dns/rdata/generic/nsec_47.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -18,10 +18,10 @@
 #ifndef GENERIC_NSEC_47_H
 #define GENERIC_NSEC_47_H 1
 
-/* $Id: nsec_47.h,v 1.4.20.2 2005/04/29 00:16:37 marka Exp $ */
+/* $Id: nsec_47.h,v 1.4.20.4 2008/07/15 23:46:14 tbox Exp $ */
 
 /*!
- * \brief Per draft-ietf-dnsext-nsec-rdata-01.txt */
+ * \brief Per RFC 3845 */
 
 typedef struct dns_rdata_nsec {
 	dns_rdatacommon_t	common;
diff --git a/lib/dns/rdata/generic/txt_16.c b/lib/dns/rdata/generic/txt_16.c
index fa3ffef8d59a..01ca87ac0885 100644
--- a/lib/dns/rdata/generic/txt_16.c
+++ b/lib/dns/rdata/generic/txt_16.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: txt_16.c,v 1.41 2004/03/05 05:10:18 marka Exp $ */
+/* $Id: txt_16.c,v 1.41.18.2 2008/02/15 23:45:53 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */
 
@@ -142,7 +142,7 @@ fromstruct_txt(ARGS_FROMSTRUCT) {
 	while (region.length > 0) {
 		length = uint8_fromregion(&region);
 		isc_region_consume(&region, 1);
-		if (region.length <= length)
+		if (region.length < length)
 			return (ISC_R_UNEXPECTEDEND);
 		isc_region_consume(&region, length);
 	}
diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index 42b2e7f5d942..2fce328507a7 100644
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: apl_42.c,v 1.8.18.2 2005/04/29 00:16:42 marka Exp $ */
+/* $Id: apl_42.c,v 1.8.18.4 2008/01/22 23:27:06 tbox Exp $ */
 
 /* RFC3123 */
 
@@ -49,7 +49,7 @@ fromtext_in_apl(ARGS_FROMTEXT) {
 					      isc_tokentype_string, ISC_TRUE));
 		if (token.type != isc_tokentype_string)
 			break;
-	
+
 		cp = DNS_AS_STR(token);
 		neg = ISC_TF(*cp == '!');
 		if (neg)
@@ -259,7 +259,7 @@ fromstruct_in_apl(ARGS_FROMSTRUCT) {
 	REQUIRE(apl->common.rdtype == type);
 	REQUIRE(apl->common.rdclass == rdclass);
 	REQUIRE(apl->apl != NULL || apl->apl_len == 0);
-	
+
 	isc_buffer_init(&b, apl->apl, apl->apl_len);
 	isc_buffer_add(&b, apl->apl_len);
 	isc_buffer_setactive(&b, apl->apl_len);
@@ -306,37 +306,88 @@ freestruct_in_apl(ARGS_FREESTRUCT) {
 
 isc_result_t
 dns_rdata_apl_first(dns_rdata_in_apl_t *apl) {
+	isc_uint32_t length;
+
+	REQUIRE(apl != NULL);
 	REQUIRE(apl->common.rdtype == 42);
 	REQUIRE(apl->common.rdclass == 1);
 	REQUIRE(apl->apl != NULL || apl->apl_len == 0);
 
+	/*
+	 * If no APL return ISC_R_NOMORE.
+	 */
+	if (apl->apl == NULL)
+		return (ISC_R_NOMORE);
+
+	/*
+	 * Sanity check data.
+	 */
+	INSIST(apl->apl_len > 3U);
+	length = apl->apl[apl->offset + 3] & 0x7f;
+	INSIST(length <= apl->apl_len);
+
 	apl->offset = 0;
-	return ((apl->apl_len != 0) ? ISC_R_SUCCESS : ISC_R_NOMORE);
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 dns_rdata_apl_next(dns_rdata_in_apl_t *apl) {
+	isc_uint32_t length;
+
+	REQUIRE(apl != NULL);
 	REQUIRE(apl->common.rdtype == 42);
 	REQUIRE(apl->common.rdclass == 1);
 	REQUIRE(apl->apl != NULL || apl->apl_len == 0);
 
-	if (apl->offset + 3 < apl->apl_len)
+	/*
+	 * No APL or have already reached the end return ISC_R_NOMORE.
+	 */
+	if (apl->apl == NULL || apl->offset == apl->apl_len)
 		return (ISC_R_NOMORE);
+
+	/*
+	 * Sanity check data.
+	 */
+	INSIST(apl->offset < apl->apl_len);
+	INSIST(apl->apl_len > 3U);
+	INSIST(apl->offset <= apl->apl_len - 4U);
+	length = apl->apl[apl->offset + 3] & 0x7f;
+	/*
+	 * 16 to 32 bits promotion as 'length' is 32 bits so there is
+	 * no overflow problems.
+	 */
+	INSIST(length + apl->offset <= apl->apl_len);
+
 	apl->offset += apl->apl[apl->offset + 3] & 0x7f;
 	return ((apl->offset >= apl->apl_len) ? ISC_R_SUCCESS : ISC_R_NOMORE);
 }
 
 isc_result_t
 dns_rdata_apl_current(dns_rdata_in_apl_t *apl, dns_rdata_apl_ent_t *ent) {
+	isc_uint32_t length;
 
+	REQUIRE(apl != NULL);
 	REQUIRE(apl->common.rdtype == 42);
 	REQUIRE(apl->common.rdclass == 1);
 	REQUIRE(ent != NULL);
 	REQUIRE(apl->apl != NULL || apl->apl_len == 0);
+	REQUIRE(apl->offset <= apl->apl_len);
 
-	if (apl->offset >= apl->apl_len)
+	if (apl->offset == apl->apl_len)
 		return (ISC_R_NOMORE);
 
+	/*
+	 * Sanity check data.
+	 */
+	INSIST(apl->apl_len > 3U);
+	INSIST(apl->offset <= apl->apl_len - 4U);
+	length = apl->apl[apl->offset + 3] & 0x7f;
+	/*
+	 * 16 to 32 bits promotion as 'length' is 32 bits so there is
+	 * no overflow problems.
+	 */
+	INSIST(length + apl->offset <= apl->apl_len);
+
 	ent->family = (apl->apl[apl->offset] << 8) + apl->apl[apl->offset + 1];
 	ent->prefix = apl->apl[apl->offset + 2];
 	ent->length = apl->apl[apl->offset + 3] & 0x7f;
diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/in_1/naptr_35.c
index 0e5961a9e64a..9a880ea8433d 100644
--- a/lib/dns/rdata/in_1/naptr_35.c
+++ b/lib/dns/rdata/in_1/naptr_35.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.47.18.2 2005/04/29 00:16:42 marka Exp $ */
+/* $Id: naptr_35.c,v 1.47.18.4 2008/02/15 23:45:53 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
@@ -154,7 +154,7 @@ totext_in_naptr(ARGS_TOTEXT) {
 
 static inline isc_result_t
 fromwire_in_naptr(ARGS_FROMWIRE) {
-        dns_name_t name;
+	dns_name_t name;
 	isc_region_t sr;
 
 	REQUIRE(type == 35);
@@ -165,7 +165,7 @@ fromwire_in_naptr(ARGS_FROMWIRE) {
 
 	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
 
-        dns_name_init(&name, NULL);
+	dns_name_init(&name, NULL);
 
 	/*
 	 * Order, preference.
@@ -321,8 +321,8 @@ fromstruct_in_naptr(ARGS_FROMSTRUCT) {
 	REQUIRE(naptr->common.rdtype == type);
 	REQUIRE(naptr->common.rdclass == rdclass);
 	REQUIRE(naptr->flags != NULL || naptr->flags_len == 0);
-	REQUIRE(naptr->service != NULL && naptr->service_len == 0);
-	REQUIRE(naptr->regexp != NULL && naptr->regexp_len == 0);
+	REQUIRE(naptr->service != NULL || naptr->service_len == 0);
+	REQUIRE(naptr->regexp != NULL || naptr->regexp_len == 0);
 
 	UNUSED(type);
 	UNUSED(rdclass);
diff --git a/lib/dns/request.c b/lib/dns/request.c
index c0348fe94f8f..64a3a4e31cfa 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: request.c,v 1.72.18.5.42.2 2008/07/23 07:28:56 tbox Exp $ */
+/* $Id: request.c,v 1.72.18.8 2008/07/22 03:51:44 marka Exp $ */
 
 /*! \file */
 
@@ -121,6 +121,7 @@ static isc_result_t req_render(dns_message_t *message, isc_buffer_t **buffer,
 static void req_senddone(isc_task_t *task, isc_event_t *event);
 static void req_response(isc_task_t *task, isc_event_t *event);
 static void req_timeout(isc_task_t *task, isc_event_t *event);
+static isc_socket_t * req_getsocket(dns_request_t *request);
 static void req_connected(isc_task_t *task, isc_event_t *event);
 static void req_sendevent(dns_request_t *request, isc_result_t result);
 static void req_cancel(dns_request_t *request);
@@ -146,6 +147,7 @@ dns_requestmgr_create(isc_mem_t *mctx,
 	isc_socket_t *socket;
 	isc_result_t result;
 	int i;
+	unsigned int dispattr;
 
 	req_log(ISC_LOG_DEBUG(3), "dns_requestmgr_create");
 
@@ -154,13 +156,14 @@ dns_requestmgr_create(isc_mem_t *mctx,
 	REQUIRE(socketmgr != NULL);
 	REQUIRE(taskmgr != NULL);
 	REQUIRE(dispatchmgr != NULL);
+	UNUSED(socket);
 	if (dispatchv4 != NULL) {
-		socket = dns_dispatch_getsocket(dispatchv4);
-		REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp);
+		dispattr = dns_dispatch_getattributes(dispatchv4);
+		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
 	}
 	if (dispatchv6 != NULL) {
-		socket = dns_dispatch_getsocket(dispatchv6);
-		REQUIRE(isc_socket_gettype(socket) == isc_sockettype_udp);
+		dispattr = dns_dispatch_getattributes(dispatchv6);
+		REQUIRE((dispattr & DNS_DISPATCHATTR_UDP) != 0);
 	}
 
 	requestmgr = isc_mem_get(mctx, sizeof(*requestmgr));
@@ -425,12 +428,19 @@ req_send(dns_request_t *request, isc_task_t *task, isc_sockaddr_t *address) {
 	isc_region_t r;
 	isc_socket_t *socket;
 	isc_result_t result;
+	unsigned int dispattr;
 
 	req_log(ISC_LOG_DEBUG(3), "req_send: request %p", request);
 
 	REQUIRE(VALID_REQUEST(request));
-	socket = dns_dispatch_getsocket(request->dispatch);
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	socket = req_getsocket(request);
 	isc_buffer_usedregion(request->query, &r);
+	/*
+	 * We could connect the socket when we are using an exclusive dispatch
+	 * as we do in resolver.c, but we prefer implementation simplicity
+	 * at this moment.
+	 */
 	result = isc_socket_sendto(socket, &r, task, req_senddone,
 				  request, address, NULL);
 	if (result == ISC_R_SUCCESS)
@@ -685,7 +695,7 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 	REQUIRE(action != NULL);
 	REQUIRE(requestp != NULL && *requestp == NULL);
 	REQUIRE(timeout > 0);
-	if (srcaddr != NULL) 
+	if (srcaddr != NULL)
 		REQUIRE(isc_sockaddr_pf(srcaddr) == isc_sockaddr_pf(destaddr));
 
 	mctx = requestmgr->mctx;
@@ -733,7 +743,7 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		result = DNS_R_FORMERR;
 		goto cleanup;
 	}
-		
+
 	if ((options & DNS_REQUESTOPT_TCP) != 0 || r.length > 512)
 		tcp = ISC_TRUE;
 
@@ -742,14 +752,16 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	socket = dns_dispatch_getsocket(request->dispatch);
-	INSIST(socket != NULL);
-	result = dns_dispatch_addresponse(request->dispatch, destaddr, task,
-					  req_response, request, &id,
-					  &request->dispentry);
+	result = dns_dispatch_addresponse2(request->dispatch, destaddr, task,
+					   req_response, request, &id,
+					   &request->dispentry,
+					   requestmgr->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
+	socket = req_getsocket(request);
+	INSIST(socket != NULL);
+
 	result = isc_buffer_allocate(mctx, &request->query,
 				     r.length + (tcp ? 2 : 0));
 	if (result != ISC_R_SUCCESS)
@@ -857,7 +869,7 @@ dns_request_createvia2(dns_requestmgr_t *requestmgr, dns_message_t *message,
 				       udpretries, task, action, arg,
 				       requestp));
 }
-					
+
 isc_result_t
 dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		       isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
@@ -883,7 +895,7 @@ dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message,
 	REQUIRE(action != NULL);
 	REQUIRE(requestp != NULL && *requestp == NULL);
 	REQUIRE(timeout > 0);
-	if (srcaddr != NULL) 
+	if (srcaddr != NULL)
 		REQUIRE(isc_sockaddr_pf(srcaddr) == isc_sockaddr_pf(destaddr));
 
 	mctx = requestmgr->mctx;
@@ -935,13 +947,14 @@ dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	socket = dns_dispatch_getsocket(request->dispatch);
-	INSIST(socket != NULL);
-	result = dns_dispatch_addresponse(request->dispatch, destaddr, task,
-					  req_response, request, &id,
-					  &request->dispentry);
+	result = dns_dispatch_addresponse2(request->dispatch, destaddr, task,
+					   req_response, request, &id,
+					   &request->dispentry,
+					   requestmgr->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
+	socket = req_getsocket(request);
+	INSIST(socket != NULL);
 
 	message->id = id;
 	if (setkey) {
@@ -1137,7 +1150,7 @@ do_cancel(isc_task_t *task, isc_event_t *event) {
 	if (!DNS_REQUEST_CANCELED(request))
 		req_cancel(request);
 	send_if_done(request, ISC_R_CANCELED);
-	UNLOCK(&request->requestmgr->locks[request->hash]);	
+	UNLOCK(&request->requestmgr->locks[request->hash]);
 }
 
 void
@@ -1226,6 +1239,21 @@ dns_request_destroy(dns_request_t **requestp) {
  *** Private: request.
  ***/
 
+static isc_socket_t *
+req_getsocket(dns_request_t *request) {
+	unsigned int dispattr;
+	isc_socket_t *socket;
+
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+		INSIST(request->dispentry != NULL);
+		socket = dns_dispatch_getentrysocket(request->dispentry);
+	} else
+		socket = dns_dispatch_getsocket(request->dispatch);
+
+	return (socket);
+}
+
 static void
 req_connected(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
@@ -1425,6 +1453,7 @@ req_destroy(dns_request_t *request) {
 static void
 req_cancel(dns_request_t *request) {
 	isc_socket_t *socket;
+	unsigned int dispattr;
 
 	REQUIRE(VALID_REQUEST(request));
 
@@ -1437,16 +1466,23 @@ req_cancel(dns_request_t *request) {
 
 	if (request->timer != NULL)
 		isc_timer_detach(&request->timer);
+	dispattr = dns_dispatch_getattributes(request->dispatch);
+	socket = NULL;
+	if (DNS_REQUEST_CONNECTING(request) || DNS_REQUEST_SENDING(request)) {
+		if ((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
+			if (request->dispentry != NULL) {
+				socket = dns_dispatch_getentrysocket(
+					request->dispentry);
+			}
+		} else
+			socket = dns_dispatch_getsocket(request->dispatch);
+		if (DNS_REQUEST_CONNECTING(request) && socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT);
+		if (DNS_REQUEST_SENDING(request) && socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
+	}
 	if (request->dispentry != NULL)
 		dns_dispatch_removeresponse(&request->dispentry, NULL);
-	if (DNS_REQUEST_CONNECTING(request)) {
-		socket = dns_dispatch_getsocket(request->dispatch);
-		isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_CONNECT);
-	}
-	if (DNS_REQUEST_SENDING(request)) {
-		socket = dns_dispatch_getsocket(request->dispatch);
-		isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
-	}
 	dns_dispatch_detach(&request->dispatch);
 }
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index cdf5788d7a3b..dc648c9c3673 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.284.18.66.8.4 2008/07/24 05:00:48 jinmei Exp $ */
+/* $Id: resolver.c,v 1.284.18.79 2008/10/17 22:02:13 jinmei Exp $ */
 
 /*! \file */
 
@@ -121,6 +121,7 @@ typedef struct query {
 	isc_mem_t *			mctx;
 	dns_dispatchmgr_t *		dispatchmgr;
 	dns_dispatch_t *		dispatch;
+	isc_boolean_t			exclusivesocket;
 	dns_adbaddrinfo_t *		addrinfo;
 	isc_socket_t *			tcpsocket;
 	isc_time_t			start;
@@ -213,7 +214,7 @@ struct fetchctx {
 	unsigned int			restarts;
 
 	/*%
-	 * The number of timeouts that have occurred since we 
+	 * The number of timeouts that have occurred since we
 	 * last successfully received a response packet.  This
 	 * is used for EDNS0 black hole detection.
 	 */
@@ -221,7 +222,7 @@ struct fetchctx {
 	/*%
 	 * Look aside state for DS lookups.
 	 */
-	dns_name_t 			nsname; 
+	dns_name_t 			nsname;
 	dns_fetch_t *			nsfetch;
 	dns_rdataset_t			nsrrset;
 
@@ -296,8 +297,8 @@ struct dns_resolver {
 	unsigned int			magic;
 	isc_mem_t *			mctx;
 	isc_mutex_t			lock;
-	isc_mutex_t			nlock;	
-	isc_mutex_t			primelock;	
+	isc_mutex_t			nlock;
+	isc_mutex_t			primelock;
 	dns_rdataclass_t		rdclass;
 	isc_socketmgr_t *		socketmgr;
 	isc_timermgr_t *		timermgr;
@@ -307,7 +308,9 @@ struct dns_resolver {
 	unsigned int			options;
 	dns_dispatchmgr_t *		dispatchmgr;
 	dns_dispatch_t *		dispatchv4;
+	isc_boolean_t			exclusivev4;
 	dns_dispatch_t *		dispatchv6;
+	isc_boolean_t			exclusivev6;
 	unsigned int			nbuckets;
 	fctxbucket_t *			buckets;
 	isc_uint32_t			lame_ttl;
@@ -331,7 +334,7 @@ struct dns_resolver {
 	isc_eventlist_t			whenshutdown;
 	unsigned int			activebuckets;
 	isc_boolean_t			priming;
-	unsigned int			spillat;
+	unsigned int			spillat;	/* clients-per-query */
 	/* Locked by primelock. */
 	dns_fetch_t *			primefetch;
 	/* Locked by nlock. */
@@ -369,8 +372,10 @@ static isc_result_t ncache_adderesult(dns_message_t *message,
 				      isc_stdtime_t now, dns_ttl_t maxttl,
 				      dns_rdataset_t *ardataset,
 				      isc_result_t *eresultp);
-static void validated(isc_task_t *task, isc_event_t *event); 
+static void validated(isc_task_t *task, isc_event_t *event);
 static void maybe_destroy(fetchctx_t *fctx);
+static void add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
+		    isc_result_t reason);
 
 static isc_result_t
 valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
@@ -562,6 +567,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	unsigned int factor;
 	dns_adbfind_t *find;
 	dns_adbaddrinfo_t *addrinfo;
+	isc_socket_t *socket;
 
 	query = *queryp;
 	fctx = query->fctx;
@@ -643,35 +649,48 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 							   0, factor);
 	}
 
-	if (query->dispentry != NULL)
-		dns_dispatch_removeresponse(&query->dispentry, deventp);
-
-	ISC_LIST_UNLINK(fctx->queries, query, link);
-
-	if (query->tsig != NULL)
-		isc_buffer_free(&query->tsig);
-
-	if (query->tsigkey != NULL)
-		dns_tsigkey_detach(&query->tsigkey);
-
 	/*
 	 * Check for any outstanding socket events.  If they exist, cancel
 	 * them and let the event handlers finish the cleanup.  The resolver
 	 * only needs to worry about managing the connect and send events;
 	 * the dispatcher manages the recv events.
 	 */
-	if (RESQUERY_CONNECTING(query))
+	if (RESQUERY_CONNECTING(query)) {
 		/*
 		 * Cancel the connect.
 		 */
-		isc_socket_cancel(query->tcpsocket, NULL,
-				  ISC_SOCKCANCEL_CONNECT);
-	else if (RESQUERY_SENDING(query))
+		if (query->tcpsocket != NULL) {
+			isc_socket_cancel(query->tcpsocket, NULL,
+					  ISC_SOCKCANCEL_CONNECT);
+		} else if (query->dispentry != NULL) {
+			INSIST(query->exclusivesocket);
+			socket = dns_dispatch_getentrysocket(query->dispentry);
+			if (socket != NULL)
+				isc_socket_cancel(socket, NULL,
+						  ISC_SOCKCANCEL_CONNECT);
+		}
+	} else if (RESQUERY_SENDING(query)) {
 		/*
 		 * Cancel the pending send.
 		 */
-		isc_socket_cancel(dns_dispatch_getsocket(query->dispatch),
-				  NULL, ISC_SOCKCANCEL_SEND);
+		if (query->exclusivesocket && query->dispentry != NULL)
+			socket = dns_dispatch_getentrysocket(query->dispentry);
+		else
+			socket = dns_dispatch_getsocket(query->dispatch);
+		if (socket != NULL)
+			isc_socket_cancel(socket, NULL, ISC_SOCKCANCEL_SEND);
+	}
+
+	if (query->dispentry != NULL)
+		dns_dispatch_removeresponse(&query->dispentry, deventp);
+
+	ISC_LIST_UNLINK(fctx->queries, query, link);
+
+	if (query->tsig != NULL)
+		isc_buffer_free(&query->tsig);
+
+	if (query->tsigkey != NULL)
+		dns_tsigkey_detach(&query->tsigkey);
 
 	if (query->dispatch != NULL)
 		dns_dispatch_detach(&query->dispatch);
@@ -777,6 +796,8 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 	unsigned int count = 0;
 	isc_interval_t i;
 	isc_boolean_t logit = ISC_FALSE;
+	unsigned int old_spillat;
+	unsigned int new_spillat = 0;	/* initialized to silence compiler warnings */
 
 	/*
 	 * Caller must be holding the appropriate bucket lock.
@@ -800,7 +821,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 		       fctx->type == dns_rdatatype_any ||
 		       fctx->type == dns_rdatatype_rrsig ||
 		       fctx->type == dns_rdatatype_sig);
-		
+
 		/*
 		 * Negative results must be indicated in event->result.
 		 */
@@ -819,11 +840,15 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 	    (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) {
 		LOCK(&fctx->res->lock);
 		if (count == fctx->res->spillat && !fctx->res->exiting) {
+			old_spillat = fctx->res->spillat;
 			fctx->res->spillat += 5;
 			if (fctx->res->spillat > fctx->res->spillatmax &&
 			    fctx->res->spillatmax != 0)
 				fctx->res->spillat = fctx->res->spillatmax;
-			logit = ISC_TRUE;
+			new_spillat = fctx->res->spillat;
+			if (new_spillat != old_spillat) {
+				logit = ISC_TRUE;
+			}
 			isc_interval_set(&i, 20 * 60, 0);
 			result = isc_timer_reset(fctx->res->spillattimer,
 						 isc_timertype_ticker, NULL,
@@ -835,7 +860,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 				      "clients-per-query increased to %u",
-				      count + 1);
+				      new_spillat);
 	}
 }
 
@@ -864,43 +889,25 @@ fctx_done(fetchctx_t *fctx, isc_result_t result) {
 }
 
 static void
-resquery_senddone(isc_task_t *task, isc_event_t *event) {
+process_sendevent(resquery_t *query, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
-	resquery_t *query = event->ev_arg;
 	isc_boolean_t retry = ISC_FALSE;
 	isc_result_t result;
 	fetchctx_t *fctx;
 
-	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
-
-	QTRACE("senddone");
-
-	/*
-	 * XXXRTH
-	 *
-	 * Currently we don't wait for the senddone event before retrying
-	 * a query.  This means that if we get really behind, we may end
-	 * up doing extra work!
-	 */
-
-	UNUSED(task);
-
-	INSIST(RESQUERY_SENDING(query));
-
-	query->sends--;
 	fctx = query->fctx;
 
 	if (RESQUERY_CANCELED(query)) {
-		if (query->sends == 0) {
+		if (query->sends == 0 && query->connects == 0) {
 			/*
 			 * This query was canceled while the
-			 * isc_socket_sendto() was in progress.
+			 * isc_socket_sendto/connect() was in progress.
 			 */
 			if (query->tcpsocket != NULL)
 				isc_socket_detach(&query->tcpsocket);
 			resquery_destroy(&query);
 		}
-	} else 
+	} else {
 		switch (sevent->result) {
 		case ISC_R_SUCCESS:
 			break;
@@ -914,6 +921,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 			/*
 			 * No route to remote.
 			 */
+			add_bad(fctx, query->addrinfo, sevent->result);
 			fctx_cancelquery(&query, NULL, NULL, ISC_TRUE);
 			retry = ISC_TRUE;
 			break;
@@ -922,6 +930,7 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 			fctx_cancelquery(&query, NULL, NULL, ISC_FALSE);
 			break;
 		}
+	}
 
 	isc_event_free(&event);
 
@@ -939,9 +948,51 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 	}
 }
 
+static void
+resquery_udpconnected(isc_task_t *task, isc_event_t *event) {
+	resquery_t *query = event->ev_arg;
+
+	REQUIRE(event->ev_type == ISC_SOCKEVENT_CONNECT);
+
+	QTRACE("udpconnected");
+
+	UNUSED(task);
+
+	INSIST(RESQUERY_CONNECTING(query));
+
+	query->connects--;
+
+	process_sendevent(query, event);
+}
+
+static void
+resquery_senddone(isc_task_t *task, isc_event_t *event) {
+	resquery_t *query = event->ev_arg;
+
+	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
+
+	QTRACE("senddone");
+
+	/*
+	 * XXXRTH
+	 *
+	 * Currently we don't wait for the senddone event before retrying
+	 * a query.  This means that if we get really behind, we may end
+	 * up doing extra work!
+	 */
+
+	UNUSED(task);
+
+	INSIST(RESQUERY_SENDING(query));
+
+	query->sends--;
+
+	process_sendevent(query, event);
+}
+
 static inline isc_result_t
 fctx_addopt(dns_message_t *message, unsigned int version, isc_uint16_t udpsize)
-{ 
+{
 	dns_rdataset_t *rdataset;
 	dns_rdatalist_t *rdatalist;
 	dns_rdata_t *rdata;
@@ -1001,9 +1052,9 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
 	 * list, and then we do exponential back-off.
 	 */
 	if (fctx->restarts < 3)
-		us = 500000;
+		us = 800000;
 	else
-		us = (500000 << (fctx->restarts - 2));
+		us = (800000 << (fctx->restarts - 2));
 
 	/*
 	 * Double the round-trip time.
@@ -1077,6 +1128,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	 */
 	query->dispatchmgr = res->dispatchmgr;
 	query->dispatch = NULL;
+	query->exclusivesocket = ISC_FALSE;
 	query->tcpsocket = NULL;
 	if (res->view->peers != NULL) {
 		dns_peer_t *peer = NULL;
@@ -1159,53 +1211,21 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			if (result != ISC_R_SUCCESS)
 				goto cleanup_query;
 		} else {
-			isc_sockaddr_t localaddr;
-			unsigned int attrs, attrmask;
-			dns_dispatch_t *disp_base;
-
-			attrs = 0;
-			attrs |= DNS_DISPATCHATTR_UDP;
-			attrs |= DNS_DISPATCHATTR_RANDOMPORT;
-
-			attrmask = 0;
-			attrmask |= DNS_DISPATCHATTR_UDP;
-			attrmask |= DNS_DISPATCHATTR_TCP;
-			attrmask |= DNS_DISPATCHATTR_IPV4;
-			attrmask |= DNS_DISPATCHATTR_IPV6;
-
 			switch (isc_sockaddr_pf(&addrinfo->sockaddr)) {
-			case AF_INET:
-				disp_base = res->dispatchv4;
-				attrs |= DNS_DISPATCHATTR_IPV4;
+			case PF_INET:
+				dns_dispatch_attach(res->dispatchv4,
+						    &query->dispatch);
+				query->exclusivesocket = res->exclusivev4;
 				break;
-			case AF_INET6:
-				disp_base = res->dispatchv6;
-				attrs |= DNS_DISPATCHATTR_IPV6;
+			case PF_INET6:
+				dns_dispatch_attach(res->dispatchv6,
+						    &query->dispatch);
+				query->exclusivesocket = res->exclusivev6;
 				break;
 			default:
 				result = ISC_R_NOTIMPLEMENTED;
 				goto cleanup_query;
 			}
-
-			result = dns_dispatch_getlocaladdress(disp_base,
-							      &localaddr);
-			if (result != ISC_R_SUCCESS)
-				goto cleanup_query;
-			if (isc_sockaddr_getport(&localaddr) == 0) {
-				result = dns_dispatch_getudp(res->dispatchmgr,
-							     res->socketmgr,
-							     res->taskmgr,
-							     &localaddr,
-							     4096, 1000, 32768,
-							     16411, 16433,
-							     attrs, attrmask,
-							     &query->dispatch);
-				if (result != ISC_R_SUCCESS)
-					goto cleanup_query;
-			} else {
-				dns_dispatch_attach(disp_base,
-						    &query->dispatch);
-			}
 		}
 		/*
 		 * We should always have a valid dispatcher here.  If we
@@ -1378,13 +1398,14 @@ resquery_send(resquery_t *query) {
 	/*
 	 * Get a query id from the dispatch.
 	 */
-	result = dns_dispatch_addresponse(query->dispatch,
-					  &query->addrinfo->sockaddr,
-					  task,
-					  resquery_response,
-					  query,
-					  &query->id,
-					  &query->dispentry);
+	result = dns_dispatch_addresponse2(query->dispatch,
+					   &query->addrinfo->sockaddr,
+					   task,
+					   resquery_response,
+					   query,
+					   &query->id,
+					   &query->dispentry,
+					   res->socketmgr);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_temps;
 
@@ -1593,12 +1614,24 @@ resquery_send(resquery_t *query) {
 	 */
 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
 
-	socket = dns_dispatch_getsocket(query->dispatch);
+	if (query->exclusivesocket)
+		socket = dns_dispatch_getentrysocket(query->dispentry);
+	else
+		socket = dns_dispatch_getsocket(query->dispatch);
 	/*
 	 * Send the query!
 	 */
-	if ((query->options & DNS_FETCHOPT_TCP) == 0)
+	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
 		address = &query->addrinfo->sockaddr;
+		if (query->exclusivesocket) {
+			result = isc_socket_connect(socket, address, task,
+						    resquery_udpconnected,
+						    query);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup_message;
+			query->connects++;
+		}
+	}
 	isc_buffer_usedregion(buffer, &r);
 
 	/*
@@ -1731,7 +1764,7 @@ resquery_connected(isc_task_t *task, isc_event_t *event) {
 	}
 
 	isc_event_free(&event);
-	
+
 	if (retry) {
 		/*
 		 * Behave as if the idle timer has expired.  For TCP
@@ -1921,8 +1954,8 @@ add_bad(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_result_t reason) {
 	if (reason == DNS_R_LAME)	/* already logged */
 		return;
 
-	if (reason == DNS_R_UNEXPECTEDRCODE && 
-	    fctx->rmessage->opcode == dns_rcode_servfail &&
+	if (reason == DNS_R_UNEXPECTEDRCODE &&
+	    fctx->rmessage->rcode == dns_rcode_servfail &&
 	    ISFORWARDER(addrinfo))
 		return;
 
@@ -2196,6 +2229,13 @@ fctx_getaddresses(fetchctx_t *fctx) {
 	}
 
 	while (sa != NULL) {
+		if ((isc_sockaddr_pf(sa) == AF_INET &&
+			 fctx->res->dispatchv4 == NULL) ||
+		    (isc_sockaddr_pf(sa) == AF_INET6 &&
+			fctx->res->dispatchv6 == NULL)) {
+				sa = ISC_LIST_NEXT(sa, link);
+				continue;
+		}
 		ai = NULL;
 		result = dns_adb_findaddrinfo(fctx->adb,
 					      sa, &ai, 0);  /* XXXMLG */
@@ -2366,7 +2406,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr)
 	isc_netaddr_fromsockaddr(&ipaddr, sa);
 	blackhole = dns_dispatchmgr_getblackhole(res->dispatchmgr);
 	(void) dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer);
-	
+
 	if (blackhole != NULL) {
 		int match;
 
@@ -2799,7 +2839,7 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
 		dns_validator_cancel(validator);
 		validator = ISC_LIST_NEXT(validator, link);
 	}
-	
+
 	if (fctx->nsfetch != NULL)
 		dns_resolver_cancelfetch(fctx->nsfetch);
 
@@ -3252,9 +3292,9 @@ is_lame(fetchctx_t *fctx) {
 static inline void
 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
 	char namebuf[DNS_NAME_FORMATSIZE];
-	char domainbuf[DNS_NAME_FORMATSIZE];	
+	char domainbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
-	
+
 	dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
@@ -3822,9 +3862,9 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 					     sizeof(typebuf));
 			dns_rdataclass_format(rdataset->rdclass, classbuf,
 					      sizeof(classbuf));
-			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,  
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
-				      "check-names %s %s/%s/%s", 
+				      "check-names %s %s/%s/%s",
 				      fail ? "failure" : "warning",
 				      namebuf, typebuf, classbuf);
 			if (fail) {
@@ -4411,7 +4451,7 @@ chase_additional(fetchctx_t *fctx) {
 
  again:
 	rescan = ISC_FALSE;
-	
+
 	for (result = dns_message_firstname(fctx->rmessage, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(fctx->rmessage, section)) {
@@ -4491,7 +4531,7 @@ dname_target(dns_rdataset_t *rdataset, dns_name_t *qname, dns_name_t *oname,
 		return (DNS_R_FORMERR);
 	}
 	dns_fixedname_init(&prefix);
-	dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL); 
+	dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL);
 	dns_fixedname_init(fixeddname);
 	result = dns_name_concatenate(dns_fixedname_name(&prefix),
 				      &dname.dname,
@@ -4650,7 +4690,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 	}
 
 	/*
-	 * A negative response has a SOA record (Type 2) 
+	 * A negative response has a SOA record (Type 2)
 	 * and a optional NS RRset (Type 1) or it has neither
 	 * a SOA or a NS RRset (Type 3, handled above) or
 	 * rcode is NXDOMAIN (handled above) in which case
@@ -5363,7 +5403,7 @@ checknamessection(dns_message_t *message, dns_section_t section) {
 	dns_name_t *name;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdataset_t *rdataset;
-	
+
 	for (result = dns_message_firstname(message, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(message, section))
@@ -5382,7 +5422,7 @@ checknamessection(dns_message_t *message, dns_section_t section) {
 							  ISC_FALSE) ||
 				    !dns_rdata_checknames(&rdata, name, NULL))
 				{
-					rdataset->attributes |= 
+					rdataset->attributes |=
 						DNS_RDATASETATTR_CHECKNAMES;
 				}
 				dns_rdata_reset(&rdata);
@@ -5512,6 +5552,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * There's no hope for this query.
 			 */
 			keep_trying = ISC_TRUE;
+
+			/*
+			 * If this is a network error on an exclusive query
+			 * socket, mark the server as bad so that we won't try
+			 * it for this fetch again.
+			 */
+			if (query->exclusivesocket &&
+			    (devent->result == ISC_R_HOSTUNREACH ||
+			     devent->result == ISC_R_NETUNREACH ||
+			     devent->result == ISC_R_CONNREFUSED ||
+			     devent->result == ISC_R_CANCELED)) {
+				    broken_server = devent->result;
+			}
 		}
 		goto done;
 	}
@@ -5662,12 +5715,17 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (message->rcode != dns_rcode_noerror &&
 	    message->rcode != dns_rcode_nxdomain) {
-		if ((message->rcode == dns_rcode_formerr ||
-		     message->rcode == dns_rcode_notimp ||
-		     message->rcode == dns_rcode_servfail) &&
+		if (((message->rcode == dns_rcode_formerr ||
+		     message->rcode == dns_rcode_notimp) ||
+		    (message->rcode == dns_rcode_servfail &&
+		     dns_message_getopt(message) == NULL)) &&
 		    (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 			/*
 			 * It's very likely they don't like EDNS0.
+			 * If the response code is SERVFAIL, also check if the
+			 * response contains an OPT RR and don't cache the
+			 * failure since it can be returned for various other
+			 * reasons.
 			 *
 			 * XXXRTH  We should check if the question
 			 *	   we're asking requires EDNS0, and
@@ -6154,7 +6212,7 @@ spillattimer_countdown(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(VALID_RESOLVER(res));
 
 	UNUSED(task);
-	
+
 	LOCK(&res->lock);
 	INSIST(!res->exiting);
 	if (res->spillat > res->spillatmin) {
@@ -6181,7 +6239,7 @@ isc_result_t
 dns_resolver_create(dns_view_t *view,
 		    isc_taskmgr_t *taskmgr, unsigned int ntasks,
 		    isc_socketmgr_t *socketmgr,
-		    isc_timermgr_t *timermgr, 
+		    isc_timermgr_t *timermgr,
 		    unsigned int options,
 		    dns_dispatchmgr_t *dispatchmgr,
 		    dns_dispatch_t *dispatchv4,
@@ -6193,6 +6251,7 @@ dns_resolver_create(dns_view_t *view,
 	unsigned int i, buckets_created = 0;
 	isc_task_t *task = NULL;
 	char name[16];
+	unsigned dispattr;
 
 	/*
 	 * Create a resolver.
@@ -6259,11 +6318,20 @@ dns_resolver_create(dns_view_t *view,
 	}
 
 	res->dispatchv4 = NULL;
-	if (dispatchv4 != NULL)
+	if (dispatchv4 != NULL) {
 		dns_dispatch_attach(dispatchv4, &res->dispatchv4);
+		dispattr = dns_dispatch_getattributes(dispatchv4);
+		res->exclusivev4 =
+			ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0);
+	}
+
 	res->dispatchv6 = NULL;
-	if (dispatchv6 != NULL)
+	if (dispatchv6 != NULL) {
 		dns_dispatch_attach(dispatchv6, &res->dispatchv6);
+		dispattr = dns_dispatch_getattributes(dispatchv6);
+		res->exclusivev6 =
+			ISC_TF((dispattr & DNS_DISPATCHATTR_EXCLUSIVE) != 0);
+	}
 
 	res->references = 1;
 	res->exiting = ISC_FALSE;
@@ -6380,7 +6448,7 @@ prime_done(isc_task_t *task, isc_event_t *event) {
 	UNLOCK(&res->primelock);
 
 	UNLOCK(&res->lock);
-	
+
 	if (fevent->result == ISC_R_SUCCESS &&
 	    res->view->cache != NULL && res->view->hints != NULL) {
 		dns_cache_attachdb(res->view->cache, &db);
@@ -6546,12 +6614,12 @@ dns_resolver_shutdown(dns_resolver_t *res) {
 			     fctx != NULL;
 			     fctx = ISC_LIST_NEXT(fctx, link))
 				fctx_shutdown(fctx);
-			if (res->dispatchv4 != NULL) {
+			if (res->dispatchv4 != NULL && !res->exclusivev4) {
 				sock = dns_dispatch_getsocket(res->dispatchv4);
 				isc_socket_cancel(sock, res->buckets[i].task,
 						  ISC_SOCKCANCEL_ALL);
 			}
-			if (res->dispatchv6 != NULL) {
+			if (res->dispatchv6 != NULL && !res->exclusivev6) {
 				sock = dns_dispatch_getsocket(res->dispatchv6);
 				isc_socket_cancel(sock, res->buckets[i].task,
 						  ISC_SOCKCANCEL_ALL);
@@ -6665,6 +6733,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 	isc_event_t *event;
 	unsigned int count = 0;
 	unsigned int spillat;
+	unsigned int spillatmin;
 
 	UNUSED(forwarders);
 
@@ -6695,6 +6764,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 
 	LOCK(&res->lock);
 	spillat = res->spillat;
+	spillatmin = res->spillatmin;
 	UNLOCK(&res->lock);
 	LOCK(&res->buckets[bucketnum].lock);
 
@@ -6711,7 +6781,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 				break;
 		}
 	}
-	
+
 	/*
 	 * Is this a duplicate?
 	 */
@@ -6728,7 +6798,8 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 			count++;
 		}
 	}
-	if (count >= res->spillatmin && res->spillatmin != 0) {
+	if (count >= spillatmin && spillatmin != 0) {
+		INSIST(fctx != NULL);
 		if (count >= spillat)
 			fctx->spilled = ISC_TRUE;
 		if (fctx->spilled) {
@@ -7004,7 +7075,7 @@ free_algorithm(void *node, void *arg) {
 
 	isc_mem_put(mctx, algorithms, *algorithms);
 }
- 
+
 void
 dns_resolver_reset_algorithms(dns_resolver_t *resolver) {
 
@@ -7048,7 +7119,7 @@ dns_resolver_disable_algorithm(dns_resolver_t *resolver, dns_name_t *name,
 	mask = 1 << (alg%8);
 
 	result = dns_rbt_addnode(resolver->algorithms, name, &node);
-	
+
 	if (result == ISC_R_SUCCESS || result == ISC_R_EXISTS) {
 		algorithms = node->data;
 		if (algorithms == NULL || len > *algorithms) {
@@ -7064,7 +7135,7 @@ dns_resolver_disable_algorithm(dns_resolver_t *resolver, dns_name_t *name,
 			*new = len;
 			node->data = new;
 			if (algorithms != NULL)
-				isc_mem_put(resolver->mctx, algorithms, 
+				isc_mem_put(resolver->mctx, algorithms,
 					    *algorithms);
 		} else
 			algorithms[len-1] |= mask;
@@ -7132,7 +7203,7 @@ dns_resolver_resetmustbesecure(dns_resolver_t *resolver) {
 	RWUNLOCK(&resolver->mbslock, isc_rwlocktype_write);
 #endif
 }
- 
+
 static isc_boolean_t yes = ISC_TRUE, no = ISC_FALSE;
 
 isc_result_t
@@ -7152,7 +7223,7 @@ dns_resolver_setmustbesecure(dns_resolver_t *resolver, dns_name_t *name,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 	}
-	result = dns_rbt_addname(resolver->mustbesecure, name, 
+	result = dns_rbt_addname(resolver->mustbesecure, name,
 				 value ? &yes : &no);
  cleanup:
 #if USE_MBSLOCK
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
index f20a49da1855..a988bea1e4ff 100644
--- a/lib/dns/rootns.c
+++ b/lib/dns/rootns.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rootns.c,v 1.26.18.5 2007/10/31 03:02:45 tbox Exp $ */
+/* $Id: rootns.c,v 1.26.18.7 2008/02/05 23:46:09 tbox Exp $ */
 
 /*! \file */
 
@@ -45,8 +45,6 @@ static char root_ns[] =
 ";\n"
 "; Internet Root Nameservers\n"
 ";\n"
-"; Thu Sep 23 17:57:37 PDT 1999\n"
-";\n"
 "$TTL 518400\n"
 ".                       518400  IN      NS      A.ROOT-SERVERS.NET.\n"
 ".                       518400  IN      NS      B.ROOT-SERVERS.NET.\n"
@@ -62,25 +60,31 @@ static char root_ns[] =
 ".                       518400  IN      NS      L.ROOT-SERVERS.NET.\n"
 ".                       518400  IN      NS      M.ROOT-SERVERS.NET.\n"
 "A.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.4\n"
+"A.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:BA3E::2:30\n"
 "B.ROOT-SERVERS.NET.     3600000 IN      A       192.228.79.201\n"
 "C.ROOT-SERVERS.NET.     3600000 IN      A       192.33.4.12\n"
 "D.ROOT-SERVERS.NET.     3600000 IN      A       128.8.10.90\n"
 "E.ROOT-SERVERS.NET.     3600000 IN      A       192.203.230.10\n"
 "F.ROOT-SERVERS.NET.     3600000 IN      A       192.5.5.241\n"
+"F.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:2F::F\n"
 "G.ROOT-SERVERS.NET.     3600000 IN      A       192.112.36.4\n"
 "H.ROOT-SERVERS.NET.     3600000 IN      A       128.63.2.53\n"
+"H.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:500:1::803F:235\n"
 "I.ROOT-SERVERS.NET.     3600000 IN      A       192.36.148.17\n"
 "J.ROOT-SERVERS.NET.     3600000 IN      A       192.58.128.30\n"
+"J.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:503:C27::2:30\n"
 "K.ROOT-SERVERS.NET.     3600000 IN      A       193.0.14.129\n"
+"K.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:7FD::1\n"
 "L.ROOT-SERVERS.NET.     3600000 IN      A       199.7.83.42\n"
-"M.ROOT-SERVERS.NET.     3600000 IN      A       202.12.27.33\n";
+"M.ROOT-SERVERS.NET.     3600000 IN      A       202.12.27.33\n"
+"M.ROOT-SERVERS.NET.     3600000 IN      AAAA    2001:DC3::35\n";
 
 static isc_result_t
 in_rootns(dns_rdataset_t *rootns, dns_name_t *name) {
 	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_ns_t ns;
-	
+
 	if (!dns_rdataset_isassociated(rootns))
 		return (ISC_R_NOTFOUND);
 
@@ -99,7 +103,7 @@ in_rootns(dns_rdataset_t *rootns, dns_name_t *name) {
 	return (result);
 }
 
-static isc_result_t 
+static isc_result_t
 check_node(dns_rdataset_t *rootns, dns_name_t *name,
 	   dns_rdatasetiter_t *rdsiter) {
 	isc_result_t result;
@@ -227,7 +231,7 @@ dns_rootns_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 		 * Default to using the Internet root servers.
 		 */
 		result = dns_master_loadbuffer(&source, &db->origin,
-					       &db->origin, db->rdclass, 
+					       &db->origin, db->rdclass,
 					       DNS_MASTER_HINT,
 					       &callbacks, db->mctx);
 	} else
@@ -262,11 +266,11 @@ report(dns_view_t *view, dns_name_t *name, isc_boolean_t missing,
 	isc_buffer_t buffer;
 	isc_result_t result;
 
-        if (strcmp(view->name, "_bind") != 0 &&
-            strcmp(view->name, "_default") != 0) {
-                viewname = view->name;
-                sep = ": view ";
-        }
+	if (strcmp(view->name, "_bind") != 0 &&
+	    strcmp(view->name, "_default") != 0) {
+		viewname = view->name;
+		sep = ": view ";
+	}
 
 	dns_name_format(name, namebuf, sizeof(namebuf));
 	dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
@@ -346,7 +350,7 @@ check_address_records(dns_view_t *view, dns_db_t *hints, dns_db_t *db,
 				report(view, name, ISC_FALSE, &rdata);
 			result = dns_rdataset_next(&hintrrset);
 		}
-	} 
+	}
 	if (hresult == ISC_R_NOTFOUND &&
 	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
 		result = dns_rdataset_first(&rootrrset);
@@ -387,7 +391,7 @@ check_address_records(dns_view_t *view, dns_db_t *hints, dns_db_t *db,
 			dns_rdata_reset(&rdata);
 			result = dns_rdataset_next(&hintrrset);
 		}
-	} 
+	}
 	if (hresult == ISC_R_NOTFOUND &&
 	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
 		result = dns_rdataset_first(&rootrrset);
@@ -421,11 +425,11 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 
 	isc_stdtime_get(&now);
 
-        if (strcmp(view->name, "_bind") != 0 &&
-            strcmp(view->name, "_default") != 0) {
-                viewname = view->name;
-                sep = ": view ";
-        }
+	if (strcmp(view->name, "_bind") != 0 &&
+	    strcmp(view->name, "_default") != 0) {
+		viewname = view->name;
+		sep = ": view ";
+	}
 
 	dns_rdataset_init(&hintns);
 	dns_rdataset_init(&rootns);
@@ -453,7 +457,7 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 			      dns_result_totext(result));
 		goto cleanup;
 	}
-	
+
 	/*
 	 * Look for missing root NS names.
 	 */
@@ -472,7 +476,7 @@ dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
 				      "checkhints%s%s: unable to find root "
 				      "NS '%s' in hints", sep, viewname,
 				      namebuf);
-		} else 
+		} else
 			check_address_records(view, hints, db, &ns.name, now);
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(&rootns);
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index fe53778782cf..effb2bf0c293 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdb.c,v 1.45.18.13 2007/08/28 07:20:05 tbox Exp $ */
+/* $Id: sdb.c,v 1.45.18.16 2008/01/17 23:45:58 tbox Exp $ */
 
 /*! \file */
 
@@ -310,7 +310,7 @@ dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t typeval, dns_ttl_t ttl
 		ISC_LIST_INIT(rdatalist->rdata);
 		ISC_LINK_INIT(rdatalist, link);
 		ISC_LIST_APPEND(lookup->lists, rdatalist, link);
-	} else 
+	} else
 		if (rdatalist->ttl != ttl)
 			return (DNS_R_BADTTL);
 
@@ -337,7 +337,7 @@ dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t typeval, dns_ttl_t ttl
 		isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
 	return (result);
 }
-	
+
 
 isc_result_t
 dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
@@ -380,7 +380,7 @@ dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
 
 	datalen = strlen(data);
 	size = initial_size(datalen);
-	for (;;) {
+	do {
 		isc_buffer_init(&b, data, datalen);
 		isc_buffer_add(&b, datalen);
 		result = isc_lex_openbuffer(lex, &b);
@@ -638,7 +638,7 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 }
 
 static void
-attachversion(dns_db_t *db, dns_dbversion_t *source, 
+attachversion(dns_db_t *db, dns_dbversion_t *source,
 	      dns_dbversion_t **targetp)
 {
 	REQUIRE(source != NULL && source == (void *) &dummy);
@@ -792,7 +792,7 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 			return (result);
 		}
 	}
-	
+
 	*nodep = node;
 	return (ISC_R_SUCCESS);
 }
@@ -1120,7 +1120,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	sdb_rdatasetiter_t *iterator;
 
 	REQUIRE(version == NULL || version == &dummy);
-	
+
 	UNUSED(version);
 	UNUSED(now);
 
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index e4dbdc7bf248..998ea36dacda 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tkey.c,v 1.76.18.5 2005/11/30 03:44:39 marka Exp $
+ * $Id: tkey.c,v 1.76.18.7 2008/01/02 23:46:02 tbox Exp $
  */
 /*! \file */
 #include <config.h>
@@ -379,7 +379,7 @@ process_dhtkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 				  isc_buffer_base(&secret),
 				  isc_buffer_usedlength(&secret),
 				  ISC_TRUE, signer, tkeyin->inception,
-				  tkeyin->expire, msg->mctx, ring, NULL));
+				  tkeyin->expire, ring->mctx, ring, NULL));
 
 	/* This key is good for a long time */
 	tkeyout->inception = tkeyin->inception;
@@ -440,7 +440,7 @@ process_gsstkey(dns_message_t *msg, dns_name_t *signer, dns_name_t *name,
 	result = dns_tsigkey_createfromkey(name, &tkeyin->algorithm,
 					   dstkey, ISC_TRUE, signer,
 					   tkeyin->inception, tkeyin->expire,
-					   msg->mctx, ring, NULL);
+					   ring->mctx, ring, NULL);
 #if 1
 	if (result != ISC_R_SUCCESS)
 		goto failure;
@@ -1106,7 +1106,7 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 	result = dns_tsigkey_create(tkeyname, &rtkey.algorithm,
 				    r.base, r.length, ISC_TRUE,
 				    NULL, rtkey.inception, rtkey.expire,
-				    rmsg->mctx, ring, outkey);
+				    ring->mctx, ring, outkey);
 	isc_buffer_free(&shared);
 	dns_rdata_freestruct(&rtkey);
 	dst_key_free(&theirkey);
@@ -1176,7 +1176,7 @@ dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 	RETERR(dns_tsigkey_createfromkey(tkeyname, DNS_TSIG_GSSAPI_NAME,
 					 dstkey, ISC_TRUE, NULL,
 					 rtkey.inception, rtkey.expire,
-					 rmsg->mctx, ring, outkey));
+					 ring->mctx, ring, outkey));
 
 	dns_rdata_freestruct(&rtkey);
 	return (result);
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index cca1f99f1e68..f21832f451f4 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.117.18.11 2007/09/26 23:46:34 tbox Exp $
+ * $Id: tsig.c,v 1.117.18.14 2008/01/17 23:46:03 tbox Exp $
  */
 /*! \file */
 #include <config.h>
@@ -105,12 +105,12 @@ static unsigned char hmacsha1_ndata[] = "\011hmac-sha1";
 static unsigned char hmacsha1_offsets[] = { 0, 10 };
 
 static dns_name_t  hmacsha1 = {
-        DNS_NAME_MAGIC,
-        hmacsha1_ndata, 11, 2,
-        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-        hmacsha1_offsets, NULL,
-        {(void *)-1, (void *)-1},
-        {NULL, NULL}
+	DNS_NAME_MAGIC,
+	hmacsha1_ndata, 11, 2,
+	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+	hmacsha1_offsets, NULL,
+	{(void *)-1, (void *)-1},
+	{NULL, NULL}
 };
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha1_name = &hmacsha1;
@@ -119,12 +119,12 @@ static unsigned char hmacsha224_ndata[] = "\013hmac-sha224";
 static unsigned char hmacsha224_offsets[] = { 0, 12 };
 
 static dns_name_t hmacsha224 = {
-        DNS_NAME_MAGIC,
-        hmacsha224_ndata, 13, 2,
-        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-        hmacsha224_offsets, NULL,
-        {(void *)-1, (void *)-1},
-        {NULL, NULL}
+	DNS_NAME_MAGIC,
+	hmacsha224_ndata, 13, 2,
+	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+	hmacsha224_offsets, NULL,
+	{(void *)-1, (void *)-1},
+	{NULL, NULL}
 };
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha224_name = &hmacsha224;
@@ -133,12 +133,12 @@ static unsigned char hmacsha256_ndata[] = "\013hmac-sha256";
 static unsigned char hmacsha256_offsets[] = { 0, 12 };
 
 static dns_name_t hmacsha256 = {
-        DNS_NAME_MAGIC,
-        hmacsha256_ndata, 13, 2,
-        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-        hmacsha256_offsets, NULL,
-        {(void *)-1, (void *)-1},
-        {NULL, NULL}
+	DNS_NAME_MAGIC,
+	hmacsha256_ndata, 13, 2,
+	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+	hmacsha256_offsets, NULL,
+	{(void *)-1, (void *)-1},
+	{NULL, NULL}
 };
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha256_name = &hmacsha256;
@@ -147,12 +147,12 @@ static unsigned char hmacsha384_ndata[] = "\013hmac-sha384";
 static unsigned char hmacsha384_offsets[] = { 0, 12 };
 
 static dns_name_t hmacsha384 = {
-        DNS_NAME_MAGIC,
-        hmacsha384_ndata, 13, 2,
-        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-        hmacsha384_offsets, NULL,
-        {(void *)-1, (void *)-1},
-        {NULL, NULL}
+	DNS_NAME_MAGIC,
+	hmacsha384_ndata, 13, 2,
+	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+	hmacsha384_offsets, NULL,
+	{(void *)-1, (void *)-1},
+	{NULL, NULL}
 };
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha384_name = &hmacsha384;
@@ -161,12 +161,12 @@ static unsigned char hmacsha512_ndata[] = "\013hmac-sha512";
 static unsigned char hmacsha512_offsets[] = { 0, 12 };
 
 static dns_name_t hmacsha512 = {
-        DNS_NAME_MAGIC,
-        hmacsha512_ndata, 13, 2,
-        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-        hmacsha512_offsets, NULL,
-        {(void *)-1, (void *)-1},
-        {NULL, NULL}
+	DNS_NAME_MAGIC,
+	hmacsha512_ndata, 13, 2,
+	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+	hmacsha512_offsets, NULL,
+	{(void *)-1, (void *)-1},
+	{NULL, NULL}
 };
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha512_name = &hmacsha512;
@@ -323,7 +323,8 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 	tkey->generated = generated;
 	tkey->inception = inception;
 	tkey->expire = expire;
-	tkey->mctx = mctx;
+	tkey->mctx = NULL;
+	isc_mem_attach(mctx, &tkey->mctx);
 
 	tkey->magic = TSIG_MAGIC;
 
@@ -509,7 +510,7 @@ tsigkey_free(dns_tsigkey_t *key) {
 		isc_mem_put(key->mctx, key->creator, sizeof(dns_name_t));
 	}
 	isc_refcount_destroy(&key->refs);
-	isc_mem_put(key->mctx, key, sizeof(dns_tsigkey_t));
+	isc_mem_putanddetach(&key->mctx, key, sizeof(dns_tsigkey_t));
 }
 
 void
@@ -981,7 +982,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 			return (DNS_R_FORMERR);
 		}
 		if (tsig.siglen > 0 && digestbits != 0 &&
-		    tsig.siglen < ((digestbits + 1) / 8)) { 
+		    tsig.siglen < ((digestbits + 1) / 8)) {
 			msg->tsigstatus = dns_tsigerror_badtrunc;
 			tsig_log(msg->tsigkey, 2,
 				 "truncated signature length too small");
@@ -1442,7 +1443,8 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
 		return (result);
 	}
 
-	ring->mctx = mctx;
+	ring->mctx = NULL;
+	isc_mem_attach(mctx, &ring->mctx);
 
 	*ringp = ring;
 	return (ISC_R_SUCCESS);
@@ -1460,5 +1462,5 @@ dns_tsigkeyring_destroy(dns_tsig_keyring_t **ringp) {
 
 	dns_rbt_destroy(&ring->keys);
 	isc_rwlock_destroy(&ring->lock);
-	isc_mem_put(ring->mctx, ring, sizeof(dns_tsig_keyring_t));
+	isc_mem_putanddetach(&ring->mctx, ring, sizeof(dns_tsig_keyring_t));
 }
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 9538b3023823..e68633646ac5 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.119.18.35 2007/09/26 04:39:45 each Exp $ */
+/* $Id: validator.c,v 1.119.18.41 2008/08/21 04:59:42 marka Exp $ */
 
 /*! \file */
 
@@ -55,7 +55,7 @@
  *	dlv_validator_start -> validator_start -> validate -> proveunsecure
  *
  * validator_start -> validate -> nsecvalidate	(secure wildcard answer)
- * 
+ *
  * \li When called with rdataset, sigrdataset and with DNS_VALIDATOR_DLV:
  * validator_start -> startfinddlvsep -> dlv_validator_start ->
  *	validator_start -> validate -> proveunsecure
@@ -134,7 +134,8 @@ static isc_result_t
 nsecvalidate(dns_validator_t *val, isc_boolean_t resume);
 
 static isc_result_t
-proveunsecure(dns_validator_t *val, isc_boolean_t resume);
+proveunsecure(dns_validator_t *val, isc_boolean_t have_ds,
+	      isc_boolean_t resume);
 
 static void
 validator_logv(dns_validator_t *val, isc_logcategory_t *category,
@@ -365,7 +366,7 @@ dsfetched(isc_task_t *task, isc_event_t *event) {
 			      "falling back to insecurity proof (%s)",
 			      dns_result_totext(eresult));
 		val->attributes |= VALATTR_INSECURITY;
-		result = proveunsecure(val, ISC_FALSE);
+		result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
 		if (result != DNS_R_WAIT)
 			validator_done(val, result);
 	} else {
@@ -444,7 +445,7 @@ dsfetched2(isc_task_t *task, isc_event_t *event) {
 					validator_done(val, result);
 			}
 		} else {
-			result = proveunsecure(val, ISC_TRUE);
+			result = proveunsecure(val, ISC_FALSE, ISC_TRUE);
 			if (result != DNS_R_WAIT)
 				validator_done(val, result);
 		}
@@ -453,11 +454,12 @@ dsfetched2(isc_task_t *task, isc_event_t *event) {
 		   eresult == DNS_R_NCACHENXDOMAIN)
 	{
 		/*
-		 * There is a DS which may or may not be a zone cut. 
+		 * There is a DS which may or may not be a zone cut.
 		 * In either case we are still in a secure zone resume
 		 * validation.
 		 */
-		result = proveunsecure(val, ISC_TRUE);
+		result = proveunsecure(val, ISC_TF(eresult == ISC_R_SUCCESS),
+				       ISC_TRUE);
 		if (result != DNS_R_WAIT)
 			validator_done(val, result);
 	} else {
@@ -558,7 +560,7 @@ dsvalidated(isc_task_t *task, isc_event_t *event) {
 		validator_log(val, ISC_LOG_DEBUG(3),
 			      "dsset with trust %d", val->frdataset.trust);
 		if ((val->attributes & VALATTR_INSECURITY) != 0)
-			result = proveunsecure(val, ISC_TRUE);
+			result = proveunsecure(val, ISC_TRUE, ISC_TRUE);
 		else
 			result = validatezonekey(val);
 		if (result != DNS_R_WAIT)
@@ -779,7 +781,7 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
 	} else {
 		dns_name_t **proofs = val->event->proofs;
 		dns_name_t *wild = dns_fixedname_name(&val->wild);
-		
+
 		if (rdataset->trust == dns_trust_secure)
 			val->seensig = ISC_TRUE;
 
@@ -787,7 +789,7 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
 		    rdataset->trust == dns_trust_secure &&
 		    ((val->attributes & VALATTR_NEEDNODATA) != 0 ||
 		     (val->attributes & VALATTR_NEEDNOQNAME) != 0) &&
-	            (val->attributes & VALATTR_FOUNDNODATA) == 0 &&
+		    (val->attributes & VALATTR_FOUNDNODATA) == 0 &&
 		    (val->attributes & VALATTR_FOUNDNOQNAME) == 0 &&
 		    nsecnoexistnodata(val, val->event->name, devent->name,
 				      rdataset, &exists, &data, wild)
@@ -900,7 +902,7 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
 			/* End of zone chain. */
 			if (!dns_name_issubdomain(name, &nsec.next)) {
 				/*
- 				 * XXXMPA We could look for a parent NSEC
+				 * XXXMPA We could look for a parent NSEC
 				 * at nsec.next and if found retest with
 				 * this NSEC.
 				 */
@@ -937,10 +939,11 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) {
 		dns_rdata_freestruct(&nsec);
 		result = DNS_R_NCACHENXDOMAIN;
 	} else if (result != ISC_R_SUCCESS &&
-                   result != DNS_R_NCACHENXDOMAIN &&
-                   result != DNS_R_NCACHENXRRSET &&
-                   result != DNS_R_NXRRSET &&
-                   result != ISC_R_NOTFOUND) {
+		   result != DNS_R_NCACHENXDOMAIN &&
+		   result != DNS_R_NCACHENXRRSET &&
+		   result != DNS_R_EMPTYNAME &&
+		   result != DNS_R_NXRRSET &&
+		   result != ISC_R_NOTFOUND) {
 		goto  notfound;
 	}
 	return (result);
@@ -1196,6 +1199,7 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) {
 		return (DNS_R_WAIT);
 	} else if (result ==  DNS_R_NCACHENXDOMAIN ||
 		   result == DNS_R_NCACHENXRRSET ||
+		   result == DNS_R_EMPTYNAME ||
 		   result == DNS_R_NXDOMAIN ||
 		   result == DNS_R_NXRRSET)
 	{
@@ -1246,7 +1250,8 @@ isselfsigned(dns_validator_t *val) {
 	{
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(rdataset, &rdata);
-		(void)dns_rdata_tostruct(&rdata, &key, NULL);
+		result = dns_rdata_tostruct(&rdata, &key, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		keytag = compute_keytag(&rdata, &key);
 		for (result = dns_rdataset_first(sigrdataset);
 		     result == ISC_R_SUCCESS;
@@ -1254,7 +1259,8 @@ isselfsigned(dns_validator_t *val) {
 		{
 			dns_rdata_reset(&sigrdata);
 			dns_rdataset_current(sigrdataset, &sigrdata);
-			(void)dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 			if (sig.algorithm == key.algorithm &&
 			    sig.keyid == keytag)
@@ -1514,7 +1520,8 @@ dlv_validatezonekey(dns_validator_t *val) {
 	     result = dns_rdataset_next(&val->dlv)) {
 		dns_rdata_reset(&dlvrdata);
 		dns_rdataset_current(&val->dlv, &dlvrdata);
-		dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
+		result = dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
 						      val->event->name,
@@ -1534,12 +1541,13 @@ dlv_validatezonekey(dns_validator_t *val) {
 	{
 		dns_rdata_reset(&dlvrdata);
 		dns_rdataset_current(&val->dlv, &dlvrdata);
-		(void)dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
+		result = dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (!dns_resolver_digest_supported(val->view->resolver,
 						   dlv.digest_type))
 			continue;
-		
+
 		if (dlv.digest_type != digest_type)
 			continue;
 
@@ -1559,7 +1567,8 @@ dlv_validatezonekey(dns_validator_t *val) {
 		{
 			dns_rdata_reset(&keyrdata);
 			dns_rdataset_current(&trdataset, &keyrdata);
-			(void)dns_rdata_tostruct(&keyrdata, &key, NULL);
+			result = dns_rdata_tostruct(&keyrdata, &key, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			keytag = compute_keytag(&keyrdata, &key);
 			if (dlv.key_tag != keytag ||
 			    dlv.algorithm != key.algorithm)
@@ -1594,7 +1603,8 @@ dlv_validatezonekey(dns_validator_t *val) {
 			dns_rdata_reset(&sigrdata);
 			dns_rdataset_current(val->event->sigrdataset,
 					     &sigrdata);
-			(void)dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (dlv.key_tag != sig.keyid &&
 			    dlv.algorithm != sig.algorithm)
 				continue;
@@ -1691,7 +1701,8 @@ validatezonekey(dns_validator_t *val) {
 			dns_rdata_reset(&sigrdata);
 			dns_rdataset_current(val->event->sigrdataset,
 					     &sigrdata);
-			(void)dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			result = dns_keytable_findkeynode(val->keytable,
 							  val->event->name,
 							  sig.algorithm,
@@ -1745,7 +1756,7 @@ validatezonekey(dns_validator_t *val) {
 			 * the RRset is invalid.
 			 */
 			dns_name_format(val->event->name, namebuf,
-				        sizeof(namebuf));
+					sizeof(namebuf));
 			validator_log(val, ISC_LOG_DEBUG(2),
 				      "unable to find a DNSKEY which verifies "
 				      "the DNSKEY RRset and also matches one "
@@ -1796,8 +1807,9 @@ validatezonekey(dns_validator_t *val) {
 			if (result != ISC_R_SUCCESS)
 				return (result);
 			return (DNS_R_WAIT);
-		 } else if (result ==  DNS_R_NCACHENXDOMAIN ||
+		} else if (result ==  DNS_R_NCACHENXDOMAIN ||
 			   result == DNS_R_NCACHENXRRSET ||
+			   result == DNS_R_EMPTYNAME ||
 			   result == DNS_R_NXDOMAIN ||
 			   result == DNS_R_NXRRSET)
 		{
@@ -1848,7 +1860,8 @@ validatezonekey(dns_validator_t *val) {
 	     result = dns_rdataset_next(val->dsset)) {
 		dns_rdata_reset(&dsrdata);
 		dns_rdataset_current(val->dsset, &dsrdata);
-		dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
 						      val->event->name,
@@ -1868,7 +1881,8 @@ validatezonekey(dns_validator_t *val) {
 	{
 		dns_rdata_reset(&dsrdata);
 		dns_rdataset_current(val->dsset, &dsrdata);
-		(void)dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (!dns_resolver_digest_supported(val->view->resolver,
 						   ds.digest_type))
@@ -1896,7 +1910,8 @@ validatezonekey(dns_validator_t *val) {
 		{
 			dns_rdata_reset(&keyrdata);
 			dns_rdataset_current(&trdataset, &keyrdata);
-			(void)dns_rdata_tostruct(&keyrdata, &key, NULL);
+			result = dns_rdata_tostruct(&keyrdata, &key, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			keytag = compute_keytag(&keyrdata, &key);
 			if (ds.key_tag != keytag ||
 			    ds.algorithm != key.algorithm)
@@ -1915,7 +1930,7 @@ validatezonekey(dns_validator_t *val) {
 				      "no DNSKEY matching DS");
 			continue;
 		}
-		
+
 		for (result = dns_rdataset_first(val->event->sigrdataset);
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdataset_next(val->event->sigrdataset))
@@ -1923,7 +1938,8 @@ validatezonekey(dns_validator_t *val) {
 			dns_rdata_reset(&sigrdata);
 			dns_rdataset_current(val->event->sigrdataset,
 					     &sigrdata);
-			(void)dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (ds.key_tag != sig.keyid ||
 			    ds.algorithm != sig.algorithm)
 				continue;
@@ -1994,7 +2010,7 @@ start_positive_validation(dns_validator_t *val) {
  * exclusive we stop when one is found.
  *
  * Returns
- * \li	ISC_R_SUCCESS 
+ * \li	ISC_R_SUCCESS
  */
 static isc_result_t
 checkwildcard(dns_validator_t *val) {
@@ -2213,7 +2229,7 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
 	validator_log(val, ISC_LOG_DEBUG(3),
 		      "nonexistence proof(s) not found");
 	val->attributes |= VALATTR_INSECURITY;
-	return (proveunsecure(val, ISC_FALSE));
+	return (proveunsecure(val, ISC_FALSE, ISC_FALSE));
 }
 
 static isc_boolean_t
@@ -2226,7 +2242,8 @@ check_ds(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset) {
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(rdataset)) {
 		dns_rdataset_current(rdataset, &dsrdata);
-		(void)dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		if (dns_resolver_digest_supported(val->view->resolver,
 						  ds.digest_type) &&
@@ -2242,7 +2259,7 @@ check_ds(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset) {
 
 /*%
  * Callback from fetching a DLV record.
- * 
+ *
  * Resumes the DLV lookup process.
  */
 static void
@@ -2316,7 +2333,7 @@ dlvfetched(isc_task_t *task, isc_event_t *event) {
 
 /*%
  * Start the DLV lookup proccess.
- * 
+ *
  * Returns
  * \li	ISC_R_SUCCESS
  * \li	DNS_R_WAIT
@@ -2450,6 +2467,7 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) {
 		}
 		if (result != DNS_R_NXRRSET &&
 		    result != DNS_R_NXDOMAIN &&
+		    result != DNS_R_EMPTYNAME &&
 		    result != DNS_R_NCACHENXRRSET &&
 		    result != DNS_R_NCACHENXDOMAIN)
 			return (result);
@@ -2486,7 +2504,8 @@ finddlvsep(dns_validator_t *val, isc_boolean_t resume) {
  * \li	DNS_R_NOTINSECURE
  */
 static isc_result_t
-proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
+proveunsecure(dns_validator_t *val, isc_boolean_t have_ds, isc_boolean_t resume)
+{
 	isc_result_t result;
 	dns_fixedname_t fixedsecroot;
 	dns_name_t *secroot;
@@ -2508,7 +2527,7 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
 			dns_name_split(secroot, 1, NULL, secroot);
 		result = dns_keytable_finddeepestmatch(val->keytable,
 						       secroot, secroot);
-	
+
 		if (result == ISC_R_NOTFOUND) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "not beneath secure root");
@@ -2534,12 +2553,19 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
 		val->labels = dns_name_countlabels(secroot) + 1;
 	} else {
 		validator_log(val, ISC_LOG_DEBUG(3), "resuming proveunsecure");
-		if (val->frdataset.trust >= dns_trust_secure &&
+		/*
+		 * If we have a DS rdataset and it is secure then check if
+		 * the DS rdataset has a supported algorithm combination.
+		 * If not this is a insecure delegation as far as this
+		 * resolver is concerned.  Fall back to DLV if available.
+		 */
+		if (have_ds && val->frdataset.trust >= dns_trust_secure &&
 		    !check_ds(val, dns_fixedname_name(&val->fname),
 			      &val->frdataset)) {
 			dns_name_format(dns_fixedname_name(&val->fname),
 					namebuf, sizeof(namebuf));
-			if (val->mustbesecure) {
+			if ((val->view->dlv == NULL || DLVTRIED(val)) &&
+			    val->mustbesecure) {
 				validator_log(val, ISC_LOG_WARNING,
 					      "must be secure failure at '%s'",
 					      namebuf);
@@ -2784,7 +2810,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 			validator_log(val, ISC_LOG_DEBUG(3),
 				      "falling back to insecurity proof");
 			val->attributes |= VALATTR_INSECURITY;
-			result = proveunsecure(val, ISC_FALSE);
+			result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
 			if (result == DNS_R_NOTINSECURE)
 				result = saved_result;
 		}
@@ -2798,7 +2824,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 			      "attempting insecurity proof");
 
 		val->attributes |= VALATTR_INSECURITY;
-		result = proveunsecure(val, ISC_FALSE);
+		result = proveunsecure(val, ISC_FALSE, ISC_FALSE);
 	} else if (val->event->rdataset == NULL &&
 		   val->event->sigrdataset == NULL)
 	{
diff --git a/lib/dns/view.c b/lib/dns/view.c
index d5a78d5ede14..4851cf008455 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.126.18.14 2007/08/28 07:20:05 tbox Exp $ */
+/* $Id: view.c,v 1.126.18.16 2008/06/17 23:46:03 tbox Exp $ */
 
 /*! \file */
 
@@ -315,7 +315,7 @@ destroy(dns_view_t *view) {
 			name = ISC_LIST_HEAD(view->rootexclude[i]);
 			while (name != NULL) {
 				ISC_LIST_UNLINK(view->rootexclude[i],
-					 	name, link);
+						name, link);
 				dns_name_free(name, view->mctx);
 				isc_mem_put(view->mctx, name, sizeof(*name));
 				name = ISC_LIST_HEAD(view->rootexclude[i]);
@@ -846,17 +846,6 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	}
 
  cleanup:
-	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		/*
-		 * We don't care about any DNSSEC proof data in these cases.
-		 */
-		if (dns_rdataset_isassociated(rdataset))
-			dns_rdataset_disassociate(rdataset);
-		if (sigrdataset != NULL &&
-		    dns_rdataset_isassociated(sigrdataset))
-			dns_rdataset_disassociate(sigrdataset);
-	}
-
 	if (dns_rdataset_isassociated(&zrdataset)) {
 		dns_rdataset_disassociate(&zrdataset);
 		if (dns_rdataset_isassociated(&zsigrdataset))
@@ -936,7 +925,7 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 isc_result_t
 dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		     isc_stdtime_t now, unsigned int options,
-		     isc_boolean_t use_hints, 
+		     isc_boolean_t use_hints,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
 {
 	return(dns_view_findzonecut2(view, name, fname, now, options,
@@ -1348,7 +1337,7 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) {
 	return (ISC_TRUE);
 }
 
-void 
+void
 dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	view->rootdelonly = value;
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index f95773f41063..7171a37ef111 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.135.18.16.10.3 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: xfrin.c,v 1.135.18.23 2008/09/25 04:15:52 marka Exp $ */
 
 /*! \file */
 
@@ -248,7 +248,7 @@ static isc_result_t
 axfr_init(dns_xfrin_ctx_t *xfr) {
 	isc_result_t result;
 
- 	xfr->is_ixfr = ISC_FALSE;
+	xfr->is_ixfr = ISC_FALSE;
 
 	if (xfr->db != NULL)
 		dns_db_detach(&xfr->db);
@@ -426,6 +426,10 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl,
 {
 	isc_result_t result;
 
+	if (rdata->type == dns_rdatatype_none ||
+	    dns_rdatatype_ismeta(rdata->type))
+		FAIL(DNS_R_FORMERR);
+
  redo:
 	switch (xfr->state) {
 	case XFRST_SOAQUERY:
@@ -892,8 +896,8 @@ render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf) {
 	CHECK(dns_message_renderend(msg));
 	result = ISC_R_SUCCESS;
  failure:
- 	if (cleanup_cctx)
-	 	dns_compress_invalidate(&cctx);
+	if (cleanup_cctx)
+		dns_compress_invalidate(&cctx);
 	return (result);
 }
 
@@ -1051,6 +1055,8 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
 	xfr->id++;
 	xfr->nmsg = 0;
 	msg->id = xfr->id;
+	if (xfr->tsigctx != NULL)
+		dst_context_destroy(&xfr->tsigctx);
 
 	CHECK(render(msg, xfr->mctx, &xfr->qbuffer));
 
@@ -1186,7 +1192,10 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
 
 	CHECK(dns_message_settsigkey(msg, xfr->tsigkey));
 	CHECK(dns_message_setquerytsig(msg, xfr->lasttsig));
+
 	msg->tsigctx = xfr->tsigctx;
+	xfr->tsigctx = NULL;
+
 	if (xfr->nmsg > 0)
 		msg->tcp_continuation = 1;
 
@@ -1299,9 +1308,11 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
 	xfr->nmsg++;
 
 	/*
-	 * Copy the context back.
+	 * Take the context back.
 	 */
+	INSIST(xfr->tsigctx == NULL);
 	xfr->tsigctx = msg->tsigctx;
+	msg->tsigctx = NULL;
 
 	dns_message_destroy(&msg);
 
@@ -1397,6 +1408,9 @@ maybe_free(dns_xfrin_ctx_t *xfr) {
 	if (xfr->tcpmsg_valid)
 		dns_tcpmsg_invalidate(&xfr->tcpmsg);
 
+	if (xfr->tsigctx != NULL)
+		dst_context_destroy(&xfr->tsigctx);
+
 	if ((xfr->name.attributes & DNS_NAMEATTR_DYNAMIC) != 0)
 		dns_name_free(&xfr->name, xfr->mctx);
 
@@ -1438,7 +1452,7 @@ xfrin_logv(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
 
 static void
 xfrin_log1(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
-           const char *fmt, ...)
+	   const char *fmt, ...)
 {
 	va_list ap;
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fa6ac46aaa04..36f303c375f8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.410.18.52 2007/08/30 05:15:03 marka Exp $ */
+/* $Id: zone.c,v 1.410.18.55 2008/10/24 01:43:17 tbox Exp $ */
 
 /*! \file */
 
@@ -813,10 +813,10 @@ dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	void *mem;
 	char **tmp, *tmp2;
-	
+
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(argv != NULL && *argv == NULL);
-	
+
 	LOCK_ZONE(zone);
 	size = (zone->db_argc + 1) * sizeof(char *);
 	for (i = 0; i < zone->db_argc; i++)
@@ -927,7 +927,7 @@ void
 dns_zone_setacache(dns_zone_t *zone, dns_acache_t *acache) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(acache != NULL);
-	
+
 	LOCK_ZONE(zone);
 	if (zone->acache != NULL)
 		dns_acache_detach(&zone->acache);
@@ -1425,7 +1425,7 @@ zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	dns_fixedname_t fixed;
 	dns_name_t *foundname;
 	int level;
-	
+
 	/*
 	 * Outside of zone.
 	 */
@@ -1507,7 +1507,7 @@ zone_check_srv(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	dns_fixedname_t fixed;
 	dns_name_t *foundname;
 	int level;
-	
+
 	/*
 	 * "." means the services does not exist.
 	 */
@@ -1598,7 +1598,7 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	dns_rdataset_t a;
 	dns_rdataset_t aaaa;
 	int level;
-	
+
 	/*
 	 * Outside of zone.
 	 */
@@ -1636,7 +1636,7 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 		if (tresult == ISC_R_SUCCESS) {
 			dns_rdataset_disassociate(&aaaa);
 			return (ISC_TRUE);
-		} 
+		}
 		if (tresult == DNS_R_DELEGATION)
 			dns_rdataset_disassociate(&aaaa);
 		if (result == DNS_R_GLUE || tresult == DNS_R_GLUE) {
@@ -1660,14 +1660,16 @@ zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
 	    result == DNS_R_EMPTYNAME || result == DNS_R_DELEGATION) {
 		const char *what;
-		if (dns_name_issubdomain(name, owner))
+		isc_boolean_t required = ISC_FALSE;
+		if (dns_name_issubdomain(name, owner)) {
 			what = "REQUIRED GLUE ";
-		else if (result == DNS_R_DELEGATION)
+			required = ISC_TRUE;
+		 } else if (result == DNS_R_DELEGATION)
 			what = "SIBLING GLUE ";
 		else
 			what = "";
 
-		if (result != DNS_R_DELEGATION ||
+		if (result != DNS_R_DELEGATION || required ||
 		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSIBLING)) {
 			dns_zone_log(zone, level, "%s/NS '%s' has no %s"
 				     "address records (A or AAAA)",
@@ -1749,7 +1751,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 		if (dns_name_equal(name, &zone->origin))
 			goto checkmx;
 
-		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ns, 
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ns,
 					     0, 0, &rdataset, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto checkmx;
@@ -1771,7 +1773,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
 		dns_rdataset_disassociate(&rdataset);
 
  checkmx:
-		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_mx, 
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_mx,
 					     0, 0, &rdataset, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto checksrv;
@@ -1790,7 +1792,7 @@ integrity_checks(dns_zone_t *zone, dns_db_t *db) {
  checksrv:
 		if (zone->rdclass != dns_rdataclass_in)
 			goto next;
-		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_srv, 
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_srv,
 					     0, 0, &rdataset, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto next;
@@ -1848,12 +1850,12 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
 
 	for (result = dns_rdataset_first(&rdataset);
 	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(&rdataset)) 
+	     result = dns_rdataset_next(&rdataset))
 	{
 		dns_rdataset_current(&rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
 		INSIST(result == ISC_R_SUCCESS);
-		
+
 		if ((dnskey.algorithm == DST_ALG_RSASHA1 ||
 		     dnskey.algorithm == DST_ALG_RSAMD5) &&
 		     dnskey.datalen > 1 && dnskey.data[0] == 1 &&
@@ -1885,7 +1887,7 @@ zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
 		dns_db_detachnode(db, &node);
 	if (version != NULL)
 		dns_db_closeversion(db, &version, ISC_FALSE);
-	
+
 }
 
 static isc_result_t
@@ -2039,7 +2041,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			} else if (!isc_serial_ge(serial, zone->serial))
 				dns_zone_log(zone, ISC_LOG_ERROR,
 					     "zone serial has gone backwards");
-			else if (serial == zone->serial && !hasinclude) 
+			else if (serial == zone->serial && !hasinclude)
 				dns_zone_log(zone, ISC_LOG_ERROR,
 					     "zone serial unchanged. "
 					     "zone may fail to transfer "
@@ -2171,7 +2173,7 @@ zone_check_ns(dns_zone_t *zone, dns_db_t *db, dns_name_t *name) {
 	dns_fixedname_t fixed;
 	dns_name_t *foundname;
 	int level;
-	
+
 	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOCHECKNS))
 		return (ISC_TRUE);
 
@@ -2760,7 +2762,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 	}
 
 	LOCK_ZONE(zone);
-	/* 
+	/*
 	 * The refresh code assumes that 'masters' wouldn't change under it.
 	 * If it will change then kill off any current refresh in progress
 	 * and update the masters info.  If it won't change then we can just
@@ -2815,7 +2817,7 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 		goto unlock;
 	}
 	memcpy(new, masters, count * sizeof(*new));
-	
+
 	/*
 	 * Similarly for mastersok.
 	 */
@@ -4834,7 +4836,7 @@ add_opt(dns_message_t *message, isc_uint16_t udpsize) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	dns_rdataset_init(rdataset);
-	
+
 	rdatalist->type = dns_rdatatype_opt;
 	rdatalist->covers = 0;
 
@@ -4871,7 +4873,7 @@ add_opt(dns_message_t *message, isc_uint16_t udpsize) {
 		dns_message_puttemprdataset(message, &rdataset);
 	if (rdata != NULL)
 		dns_message_puttemprdata(message, &rdata);
-	
+
 	return (result);
 }
 
@@ -5161,7 +5163,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 		}
 	}
 	if (key == NULL)
-		(void)dns_view_getpeertsig(zone->view, &masterip, &key);	
+		(void)dns_view_getpeertsig(zone->view, &masterip, &key);
 
 	if (zone->view->peers != NULL) {
 		dns_peer_t *peer = NULL;
@@ -5181,7 +5183,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 				  dns_resolver_getudpsize(zone->view->resolver);
 			(void)dns_peer_getudpsize(peer, &udpsize);
 		}
-		
+
 	}
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
 		result = add_opt(message, udpsize);
@@ -5315,7 +5317,7 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 		if (zone->writeio != NULL)
 			zonemgr_cancelio(zone->writeio);
 
-		if (zone->dctx != NULL) 
+		if (zone->dctx != NULL)
 			dns_dumpctx_cancel(zone->dctx);
 	}
 
@@ -6664,7 +6666,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		}
 		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDCOMPACT);
 	}
-	
+
 	/*
 	 * This transfer finishing freed up a transfer quota slot.
 	 * Let any other zones waiting for quota have it.
@@ -6702,7 +6704,7 @@ zone_loaddone(void *arg, isc_result_t result) {
 	ENTER;
 
 	tresult = dns_db_endload(load->db, &load->callbacks.add_private);
-	if (tresult != ISC_R_SUCCESS && 
+	if (tresult != ISC_R_SUCCESS &&
 	    (result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE))
 		result = tresult;
 
@@ -7725,7 +7727,7 @@ zone_saveunique(dns_zone_t *zone, const char *path, const char *templat) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	dns_zone_log(zone, ISC_LOG_INFO, "saved '%s' as '%s'",
+	dns_zone_log(zone, ISC_LOG_WARNING, "saved '%s' as '%s'",
 		     path, buf);
 
  cleanup:
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
index 71e42521da13..82afe5fc6b97 100644
--- a/lib/isc/Makefile.in
+++ b/lib/isc/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.81.18.8 2007/09/14 23:46:18 tbox Exp $
+# $Id: Makefile.in,v 1.81.18.10 2008/06/24 23:45:55 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -56,7 +56,7 @@ OBJS =		@ISC_EXTRA_OBJS@ \
 		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ hmacsha.@O@\
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ md5.@O@ \
 		mem.@O@ mutexblock.@O@ netaddr.@O@ netscope.@O@ ondestroy.@O@ \
-		parseint.@O@ quota.@O@ random.@O@ \
+		parseint.@O@ portset.@O@ quota.@O@ random.@O@ \
 		ratelimiter.@O@ refcount.@O@ region.@O@ result.@O@ rwlock.@O@ \
 		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ string.@O@ \
 	        strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ timer.@O@ \
@@ -69,7 +69,7 @@ SRCS =		@ISC_EXTRA_SRCS@ \
 		heap.c hex.c hmacmd5.c hmacsha.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c netaddr.c netscope.c ondestroy.c \
-		parseint.c quota.c random.c \
+		parseint.c portset.c quota.c random.c \
 		ratelimiter.c refcount.c region.c result.c rwlock.c \
 		serial.c sha1.c sha2.c sockaddr.c string.c strtoul.c symtab.c \
 		task.c taskpool.c timer.c version.c
diff --git a/lib/isc/api b/lib/isc/api
index f40dfe0239bf..0b8a3bc5beea 100644
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 35
-LIBREVISION = 0
+LIBINTERFACE = 36
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/lib/isc/assertions.c b/lib/isc/assertions.c
index b3fcf4a050de..3eb27e0be2dc 100644
--- a/lib/isc/assertions.c
+++ b/lib/isc/assertions.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: assertions.c,v 1.17.18.2 2005/04/29 00:16:44 marka Exp $ */
+/* $Id: assertions.c,v 1.17.18.4 2008/10/15 23:46:06 tbox Exp $ */
 
 /*! \file */
 
@@ -30,6 +30,7 @@
 /*%
  * Forward.
  */
+/* coverity[+kill] */
 static void
 default_callback(const char *, int, isc_assertiontype_t, const char *);
 
diff --git a/lib/isc/include/isc/assertions.h b/lib/isc/include/isc/assertions.h
index c1e68a127a2e..fcf0eb89151f 100644
--- a/lib/isc/include/isc/assertions.h
+++ b/lib/isc/include/isc/assertions.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: assertions.h,v 1.18.18.2 2005/04/29 00:16:52 marka Exp $
+ * $Id: assertions.h,v 1.18.18.4 2008/10/15 23:46:06 tbox Exp $
  */
 /*! \file assertions.h
  */
@@ -40,6 +40,7 @@ typedef enum {
 typedef void (*isc_assertioncallback_t)(const char *, int, isc_assertiontype_t,
 					const char *);
 
+/* coverity[+kill] */
 LIBISC_EXTERNAL_DATA extern isc_assertioncallback_t isc_assertion_failed;
 
 void
@@ -48,14 +49,14 @@ isc_assertion_setcallback(isc_assertioncallback_t);
 const char *
 isc_assertion_typetotext(isc_assertiontype_t type);
 
-#ifdef ISC_CHECK_ALL
+#if defined(ISC_CHECK_ALL) || defined(__COVERITY__)
 #define ISC_CHECK_REQUIRE		1
 #define ISC_CHECK_ENSURE		1
 #define ISC_CHECK_INSIST		1
 #define ISC_CHECK_INVARIANT		1
 #endif
 
-#ifdef ISC_CHECK_NONE
+#if defined(ISC_CHECK_NONE) && !defined(__COVERITY__)
 #define ISC_CHECK_REQUIRE		0
 #define ISC_CHECK_ENSURE		0
 #define ISC_CHECK_INSIST		0
diff --git a/lib/isc/include/isc/lex.h b/lib/isc/include/isc/lex.h
index 8c6624a4988d..cb9cc181d26c 100644
--- a/lib/isc/include/isc/lex.h
+++ b/lib/isc/include/isc/lex.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lex.h,v 1.30.18.3 2005/06/04 00:39:05 marka Exp $ */
+/* $Id: lex.h,v 1.30.18.5 2008/05/30 23:46:01 tbox Exp $ */
 
 #ifndef ISC_LEX_H
 #define ISC_LEX_H 1
@@ -86,7 +86,7 @@ ISC_LANG_BEGINDECLS
 #define ISC_LEXOPT_DNSMULTILINE		0x20	/*%< Handle '(' and ')'. */
 #define ISC_LEXOPT_NOMORE		0x40	/*%< Want "no more" token. */
 
-#define ISC_LEXOPT_CNUMBER		0x80    /*%< Regognize octal and hex. */
+#define ISC_LEXOPT_CNUMBER		0x80    /*%< Recognize octal and hex. */
 #define ISC_LEXOPT_ESCAPE		0x100	/*%< Recognize escapes. */
 #define ISC_LEXOPT_QSTRINGMULTILINE	0x200	/*%< Allow multiline "" strings */
 #define ISC_LEXOPT_OCTAL		0x400	/*%< Expect a octal number. */
diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index dc68bcb2a2d9..2c3c54e4f4d7 100644
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.h,v 1.59.18.9 2006/01/04 23:50:23 marka Exp $ */
+/* $Id: mem.h,v 1.59.18.11 2008/02/07 23:45:56 tbox Exp $ */
 
 #ifndef ISC_MEM_H
 #define ISC_MEM_H 1
@@ -156,7 +156,7 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 #define isc_mem_strdup(c, p)	isc__mem_strdup((c), (p) _ISC_MEM_FILELINE)
 #define isc_mempool_get(c)	isc__mempool_get((c) _ISC_MEM_FILELINE)
 
-/*% 
+/*%
  * isc_mem_putanddetach() is a convienence function for use where you
  * have a structure with an attached memory context.
  *
@@ -215,7 +215,7 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 #endif
 
 /*@{*/
-isc_result_t 
+isc_result_t
 isc_mem_create(size_t max_size, size_t target_size,
 	       isc_mem_t **mctxp);
 
@@ -223,12 +223,12 @@ isc_result_t
 isc_mem_create2(size_t max_size, size_t target_size,
 		isc_mem_t **mctxp, unsigned int flags);
 
-isc_result_t 
+isc_result_t
 isc_mem_createx(size_t max_size, size_t target_size,
 		isc_memalloc_t memalloc, isc_memfree_t memfree,
 		void *arg, isc_mem_t **mctxp);
 
-isc_result_t 
+isc_result_t
 isc_mem_createx2(size_t max_size, size_t target_size,
 		 isc_memalloc_t memalloc, isc_memfree_t memfree,
 		 void *arg, isc_mem_t **mctxp, unsigned int flags);
@@ -265,9 +265,9 @@ isc_mem_createx2(size_t max_size, size_t target_size,
 /*@}*/
 
 /*@{*/
-void 
+void
 isc_mem_attach(isc_mem_t *, isc_mem_t **);
-void 
+void
 isc_mem_detach(isc_mem_t **);
 /*!<
  * \brief Attach to / detach from a memory context.
@@ -275,7 +275,7 @@ isc_mem_detach(isc_mem_t **);
  * This is intended for applications that use multiple memory contexts
  * in such a way that it is not obvious when the last allocations from
  * a given context has been freed and destroying the context is safe.
- * 
+ *
  * Most applications do not need to call these functions as they can
  * simply create a single memory context at the beginning of main()
  * and destroy it at the end of main(), thereby guaranteeing that it
@@ -283,13 +283,13 @@ isc_mem_detach(isc_mem_t **);
  */
 /*@}*/
 
-void 
+void
 isc_mem_destroy(isc_mem_t **);
 /*%<
  * Destroy a memory context.
  */
 
-isc_result_t 
+isc_result_t
 isc_mem_ondestroy(isc_mem_t *ctx,
 		  isc_task_t *task,
 		  isc_event_t **event);
@@ -298,13 +298,13 @@ isc_mem_ondestroy(isc_mem_t *ctx,
  * been successfully destroyed.
  */
 
-void 
+void
 isc_mem_stats(isc_mem_t *mctx, FILE *out);
 /*%<
  * Print memory usage statistics for 'mctx' on the stream 'out'.
  */
 
-void 
+void
 isc_mem_setdestroycheck(isc_mem_t *mctx,
 			isc_boolean_t on);
 /*%<
@@ -313,9 +313,9 @@ isc_mem_setdestroycheck(isc_mem_t *mctx,
  */
 
 /*@{*/
-void 
+void
 isc_mem_setquota(isc_mem_t *, size_t);
-size_t 
+size_t
 isc_mem_getquota(isc_mem_t *);
 /*%<
  * Set/get the memory quota of 'mctx'.  This is a hard limit
@@ -324,7 +324,7 @@ isc_mem_getquota(isc_mem_t *);
  */
 /*@}*/
 
-size_t 
+size_t
 isc_mem_inuse(isc_mem_t *mctx);
 /*%<
  * Get an estimate of the number of memory in use in 'mctx', in bytes.
@@ -336,13 +336,29 @@ void
 isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
 		 size_t hiwater, size_t lowater);
 /*%<
- * Set high and low water marks for this memory context.  
- * 
- * When the memory
- * usage of 'mctx' exceeds 'hiwater', '(water)(water_arg, #ISC_MEM_HIWATER)'
- * will be called.  When the usage drops below 'lowater', 'water' will
- * again be called, this time with #ISC_MEM_LOWATER.
- *
+ * Set high and low water marks for this memory context.
+ *
+ * When the memory usage of 'mctx' exceeds 'hiwater',
+ * '(water)(water_arg, #ISC_MEM_HIWATER)' will be called.  'water' needs to
+ * call isc_mem_waterack() with #ISC_MEM_HIWATER to acknowlege the state
+ * change.  'water' may be called multiple times.
+ *
+ * When the usage drops below 'lowater', 'water' will again be called, this
+ * time with #ISC_MEM_LOWATER.  'water' need to calls isc_mem_waterack() with
+ * #ISC_MEM_LOWATER to acknowlege the change.
+ *
+ *	static void
+ *	water(void *arg, int mark) {
+ *		struct foo *foo = arg;
+ *
+ *		LOCK(&foo->marklock);
+ *		if (foo->mark != mark) {
+ * 			foo->mark = mark;
+ *			....
+ *			isc_mem_waterack(foo->mctx, mark);
+ *		}
+ *		UNLOCK(&foo->marklock);
+ *	}
  * If 'water' is NULL then 'water_arg', 'hi_water' and 'lo_water' are
  * ignored and the state is reset.
  *
@@ -353,6 +369,12 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
  */
 
 void
+isc_mem_waterack(isc_mem_t *ctx, int mark);
+/*%<
+ * Called to acknowledge changes in signalled by calls to 'water'.
+ */
+
+void
 isc_mem_printactive(isc_mem_t *mctx, FILE *file);
 /*%<
  * Print to 'file' all active memory in 'mctx'.
@@ -520,22 +542,22 @@ isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit);
 /*
  * Pseudo-private functions for use via macros.  Do not call directly.
  */
-void *		
+void *
 isc__mem_get(isc_mem_t *, size_t _ISC_MEM_FLARG);
-void 		
+void
 isc__mem_putanddetach(isc_mem_t **, void *,
 				      size_t _ISC_MEM_FLARG);
-void 		
+void
 isc__mem_put(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
-void *		
+void *
 isc__mem_allocate(isc_mem_t *, size_t _ISC_MEM_FLARG);
-void		
+void
 isc__mem_free(isc_mem_t *, void * _ISC_MEM_FLARG);
-char *		
+char *
 isc__mem_strdup(isc_mem_t *, const char *_ISC_MEM_FLARG);
-void *		
+void *
 isc__mempool_get(isc_mempool_t * _ISC_MEM_FLARG);
-void 		
+void
 isc__mempool_put(isc_mempool_t *, void * _ISC_MEM_FLARG);
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/msgs.h b/lib/isc/include/isc/msgs.h
index 97b21085eddf..0970647dafcd 100644
--- a/lib/isc/include/isc/msgs.h
+++ b/lib/isc/include/isc/msgs.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: msgs.h,v 1.9.18.2 2005/04/29 00:16:59 marka Exp $ */
+/* $Id: msgs.h,v 1.9.18.4 2008/08/08 06:27:56 tbox Exp $ */
 
 #ifndef ISC_MSGS_H
 #define ISC_MSGS_H 1
@@ -57,7 +57,7 @@
 
 /*@{*/
 /*!
- * Message numbers  
+ * Message numbers
  * are only required to be unique per message set,
  * but are unique throughout the entire catalog to not be as confusing when
  * debugging.
@@ -153,7 +153,10 @@
 #define ISC_MSG_ACCEPTRETURNED 1418 /*%< accept() returned %d/%s */
 #define ISC_MSG_TOOMANYFDS     1419 /*%< %s: too many open file descriptors */
 #define ISC_MSG_ZEROPORT       1420 /*%< dropping source port zero packet */
-#define ISC_MSG_FILTER	       1420 /*%< setsockopt(SO_ACCEPTFILTER): %s */
+#define ISC_MSG_FILTER	       1421 /*%< setsockopt(SO_ACCEPTFILTER): %s */
+
+#define ISC_MSG_TOOMANYHANDLES 1422 /*%< %s: too many open WSA event handles: %s */
+
 
 #define ISC_MSG_AWAKE	       1502 /*%< "awake" */
 #define ISC_MSG_WORKING	       1503 /*%< "working" */
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
index 0531edfa020e..afcd4df01ccb 100644
--- a/lib/isc/include/isc/platform.h.in
+++ b/lib/isc/include/isc/platform.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: platform.h.in,v 1.34.18.9 2007/09/13 05:04:01 each Exp $ */
+/* $Id: platform.h.in,v 1.34.18.11 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef ISC_PLATFORM_H
 #define ISC_PLATFORM_H 1
@@ -140,6 +140,21 @@
  */
 @ISC_PLATFORM_FIXIN6ISADDR@
 
+/*! \brief
+ * Define if the system supports kqueue multiplexing
+ */
+@ISC_PLATFORM_HAVEKQUEUE@
+
+/*! \brief
+ * Define if the system supports epoll multiplexing
+ */
+@ISC_PLATFORM_HAVEEPOLL@
+
+/*! \brief
+ * Define if the system supports /dev/poll multiplexing
+ */
+@ISC_PLATFORM_HAVEDEVPOLL@
+
 /*
  *** Printing.
  ***/
@@ -224,19 +239,19 @@
 
 /*
  * If the "xadd" operation is available on this architecture,
- * ISC_PLATFORM_HAVEXADD will be defined. 
+ * ISC_PLATFORM_HAVEXADD will be defined.
  */
 @ISC_PLATFORM_HAVEXADD@
 
 /*
  * If the "atomic swap" operation is available on this architecture,
- * ISC_PLATFORM_HAVEATOMICSTORE" will be defined. 
+ * ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
  */
 @ISC_PLATFORM_HAVEATOMICSTORE@
 
 /*
  * If the "compare-and-exchange" operation is available on this architecture,
- * ISC_PLATFORM_HAVECMPXCHG will be defined. 
+ * ISC_PLATFORM_HAVECMPXCHG will be defined.
  */
 @ISC_PLATFORM_HAVECMPXCHG@
 
diff --git a/lib/isc/include/isc/portset.h b/lib/isc/include/isc/portset.h
new file mode 100644
index 000000000000..6396e5ced3d5
--- /dev/null
+++ b/lib/isc/include/isc/portset.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: portset.h,v 1.3.4.1 2008/06/24 03:42:10 marka Exp $ */
+
+/*! \file isc/portset.h
+ * \brief Transport Protocol Port Manipuration Module
+ *
+ * This module provides simple utilities to handle a set of transport protocol
+ * (UDP or TCP) port numbers, e.g., for creating an ACL list.  An isc_portset_t
+ * object is an opaque instance of a port set, for which the user can add or
+ * remove a specific port or a range of consecutive ports.  This object is
+ * expected to be used as a temporary work space only, and does not protect
+ * simultaneous access from multiple threads.  Therefore it must not be stored
+ * in a place that can be accessed from multiple threads.
+ */
+
+#ifndef ISC_PORTSET_H
+#define ISC_PORTSET_H 1
+
+/***
+ ***	Imports
+ ***/
+
+#include <isc/net.h>
+
+/***
+ *** Functions
+ ***/
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp);
+/*%<
+ * Create a port set and initialize it as an empty set.
+ *
+ * Requires:
+ *\li	'mctx' to be valid.
+ *\li	'portsetp' to be non NULL and '*portsetp' to be NULL;
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ */
+
+void
+isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp);
+/*%<
+ * Destroy a port set.
+ *
+ * Requires:
+ *\li	'mctx' to be valid and must be the same context given when the port set
+ *       was created.
+ *\li	'*portsetp' to be a valid set.
+ */
+
+isc_boolean_t
+isc_portset_isset(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Test whether the given port is stored in the portset.
+ *
+ * Requires:
+ *\li	'portset' to be a valid set.
+ *
+ * Returns
+ * \li	#ISC_TRUE if the port is found, ISC_FALSE otherwise.
+ */
+
+unsigned int
+isc_portset_nports(isc_portset_t *portset);
+/*%<
+ * Provides the number of ports stored in the given portset.
+ *
+ * Requires:
+ *\li	'portset' to be a valid set.
+ *
+ * Returns
+ * \li	the number of ports stored in portset.
+ */
+
+void
+isc_portset_add(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Add the given port to the portset.  The port may or may not be stored in
+ * the portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ */
+
+void
+isc_portset_remove(isc_portset_t *portset, in_port_t port);
+/*%<
+ * Remove the given port to the portset.  The port may or may not be stored in
+ * the portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ */
+
+void
+isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo,
+		     in_port_t port_hi);
+/*%<
+ * Add a subset of [port_lo, port_hi] (inclusive) to the portset.  Ports in the
+ * subset may or may not be stored in portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ *\li	port_lo <= port_hi
+ */
+
+void
+isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo,
+			in_port_t port_hi);
+/*%<
+ * Subtract a subset of [port_lo, port_hi] (inclusive) from the portset.  Ports
+ * in the subset may or may not be stored in portset.
+ *
+ * Requires:
+ *\li	'portlist' to be valid.
+ *\li	port_lo <= port_hi
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif	/* ISC_NETADDR_H */
diff --git a/lib/isc/include/isc/resource.h b/lib/isc/include/isc/resource.h
index 18cd0ad81e24..8c33c89db025 100644
--- a/lib/isc/include/isc/resource.h
+++ b/lib/isc/include/isc/resource.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.h,v 1.5.18.2.52.2 2008/07/23 23:48:17 tbox Exp $ */
+/* $Id: resource.h,v 1.5.18.4 2008/08/01 23:45:58 tbox Exp $ */
 
 #ifndef ISC_RESOURCE_H
 #define ISC_RESOURCE_H 1
@@ -82,16 +82,13 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value);
  */
 
 isc_result_t
-isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value);
-/*
- * Get the current limit on a resource.
- *
- * Requires:
- *	'resource' is a valid member of the isc_resource_t enumeration.
+isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value);
+/*%<
+ * Same as isc_resource_getlimit(), but returns the current (soft) limit.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
- *	ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
+ *\li	#ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h
index 951a06316ed2..a9a22c87c57c 100644
--- a/lib/isc/include/isc/socket.h
+++ b/lib/isc/include/isc/socket.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.h,v 1.57.18.6.46.4 2008/07/23 23:16:43 marka Exp $ */
+/* $Id: socket.h,v 1.57.18.15 2008/09/04 08:03:08 marka Exp $ */
 
 #ifndef ISC_SOCKET_H
 #define ISC_SOCKET_H 1
@@ -318,8 +318,53 @@ isc_socket_detach(isc_socket_t **socketp);
  */
 
 isc_result_t
+isc_socket_open(isc_socket_t *sock);
+/*%<
+ * Open a new socket file descriptor of the given socket structure.  It simply
+ * opens a new descriptor; all of the other parameters including the socket
+ * type are inherited from the existing socket.  This function is provided to
+ * avoid overhead of destroying and creating sockets when many short-lived
+ * sockets are frequently opened and closed.  When the efficiency is not an
+ * issue, it should be safer to detach the unused socket and re-create a new
+ * one.  This optimization may not be available for some systems, in which
+ * case this function will return ISC_R_NOTIMPLEMENTED and must not be used.
+ *
+ * Requires:
+ *
+ * \li	there must be no other reference to this socket.
+ *
+ * \li	'socket' is a valid and previously closed by isc_socket_close()
+ *
+ * Returns:
+ *	Same as isc_socket_create().
+ * \li	ISC_R_NOTIMPLEMENTED
+ */
+
+isc_result_t
+isc_socket_close(isc_socket_t *sock);
+/*%<
+ * Close a socket file descriptor of the given socket structure.  This function
+ * is provided as an alternative to destroying an unused socket when overhead
+ * destroying/re-creating sockets can be significant, and is expected to be
+ * used with isc_socket_open().  This optimization may not be available for some
+ * systems, in which case this function will return ISC_R_NOTIMPLEMENTED and
+ * must not be used.
+ *
+ * Requires:
+ *
+ * \li	The socket must have a valid descriptor.
+ *
+ * \li	There must be no other reference to this socket.
+ *
+ * \li	There must be no pending I/O requests.
+ *
+ * Returns:
+ * \li	#ISC_R_NOTIMPLEMENTED
+ */
+
+isc_result_t
 isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *addressp,
-	        unsigned int options);
+		unsigned int options);
 /*%<
  * Bind 'socket' to '*addressp'.
  *
@@ -644,8 +689,15 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
 
 isc_result_t
 isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp);
+
+isc_result_t
+isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp,
+		      unsigned int maxsocks);
 /*%<
- * Create a socket manager.
+ * Create a socket manager.  If "maxsocks" is non-zero, it specifies the
+ * maximum number of sockets that the created manager should handle.
+ * isc_socketmgr_create() is equivalent of isc_socketmgr_create2() with
+ * "maxsocks" being zero.
  *
  * Notes:
  *
@@ -666,6 +718,23 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp);
  *\li	#ISC_R_SUCCESS
  *\li	#ISC_R_NOMEMORY
  *\li	#ISC_R_UNEXPECTED
+ *\li	#ISC_R_NOTIMPLEMENTED
+ */
+
+isc_result_t
+isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp);
+/*%<
+ * Returns in "*nsockp" the maximum number of sockets this manager may open.
+ *
+ * Requires:
+ *
+ *\li	'*manager' is a valid isc_socketmgr_t.
+ *\li	'nsockp' is not NULL.
+ *
+ * Returns:
+ *
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOTIMPLEMENTED
  */
 
 void
@@ -738,7 +807,7 @@ isc_socket_cleanunix(isc_sockaddr_t *addr, isc_boolean_t active);
 
 isc_result_t
 isc_socket_permunix(isc_sockaddr_t *sockaddr, isc_uint32_t perm,
-                    isc_uint32_t owner, isc_uint32_t group);
+		    isc_uint32_t owner, isc_uint32_t group);
 /*%<
  * Set ownership and file permissions on the UNIX domain socket.
  *
diff --git a/lib/isc/include/isc/timer.h b/lib/isc/include/isc/timer.h
index 6e78be9d0269..7a7f614cb6ce 100644
--- a/lib/isc/include/isc/timer.h
+++ b/lib/isc/include/isc/timer.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.h,v 1.31.18.3.52.2 2008/07/24 23:48:09 tbox Exp $ */
+/* $Id: timer.h,v 1.31.18.5 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef ISC_TIMER_H
 #define ISC_TIMER_H 1
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
index 35a0be7ae262..b501b2cdcf24 100644
--- a/lib/isc/include/isc/types.h
+++ b/lib/isc/include/isc/types.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.35.18.2 2005/04/29 00:17:04 marka Exp $ */
+/* $Id: types.h,v 1.35.18.4 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef ISC_TYPES_H
 #define ISC_TYPES_H 1
@@ -65,6 +65,7 @@ typedef struct isc_mempool		isc_mempool_t;		/*%< Memory Pool */
 typedef struct isc_msgcat		isc_msgcat_t;		/*%< Message Catalog */
 typedef struct isc_ondestroy		isc_ondestroy_t;	/*%< On Destroy */
 typedef struct isc_netaddr		isc_netaddr_t;		/*%< Net Address */
+typedef struct isc_portset		isc_portset_t;		/*%< Port Set */
 typedef struct isc_quota		isc_quota_t;		/*%< Quota */
 typedef struct isc_random		isc_random_t;		/*%< Random */
 typedef struct isc_ratelimiter		isc_ratelimiter_t;	/*%< Rate Limiter */
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index aec6118252d7..408770d82c4c 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.c,v 1.116.18.18 2007/10/30 23:31:43 marka Exp $ */
+/* $Id: mem.c,v 1.116.18.21 2008/02/07 23:45:56 tbox Exp $ */
 
 /*! \file */
 
@@ -193,7 +193,7 @@ struct isc_mempool {
 		if ((isc_mem_debugging & (ISC_MEM_DEBUGTRACE | \
 					  ISC_MEM_DEBUGRECORD)) != 0 && \
 		     b != NULL) \
-		         add_trace_entry(a, b, c, d, e); \
+			 add_trace_entry(a, b, c, d, e); \
 	} while (0)
 #define DELETE_TRACE(a, b, c, d, e)	delete_trace_entry(a, b, c, d, e)
 
@@ -314,7 +314,7 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, unsigned int size,
 static inline size_t
 rmsize(size_t size) {
 	/*
- 	 * round down to ALIGNMENT_SIZE
+	 * round down to ALIGNMENT_SIZE
 	 */
 	return (size & (~(ALIGNMENT_SIZE - 1)));
 }
@@ -603,7 +603,7 @@ mem_get(isc_mem_t *ctx, size_t size) {
 
 	ret = (ctx->memalloc)(ctx->arg, size);
 	if (ret == NULL)
-		ctx->memalloc_failures++;	
+		ctx->memalloc_failures++;
 
 #if ISC_MEM_FILL
 	if (ret != NULL)
@@ -705,7 +705,7 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 {
 	return (isc_mem_createx2(init_max_size, target_size, memalloc, memfree,
 				 arg, ctxp, ISC_MEMFLAG_DEFAULT));
-				 
+
 }
 
 isc_result_t
@@ -882,7 +882,7 @@ destroy(isc_mem_t *ctx) {
 				     dl != NULL;
 				     dl = ISC_LIST_HEAD(ctx->debuglist[i])) {
 					ISC_LIST_UNLINK(ctx->debuglist[i],
-						 	dl, link);
+							dl, link);
 					free(dl);
 				}
 		}
@@ -907,7 +907,8 @@ destroy(isc_mem_t *ctx) {
 		for (i = 0; i < ctx->basic_table_count; i++)
 			(ctx->memfree)(ctx->arg, ctx->basic_table[i]);
 		(ctx->memfree)(ctx->arg, ctx->freelists);
-		(ctx->memfree)(ctx->arg, ctx->basic_table);
+		if (ctx->basic_table != NULL)
+			(ctx->memfree)(ctx->arg, ctx->basic_table);
 	}
 
 	ondest = ctx->ondestroy;
@@ -1085,7 +1086,6 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
 	ADD_TRACE(ctx, ptr, size, file, line);
 	if (ctx->hi_water != 0U && !ctx->hi_called &&
 	    ctx->inuse > ctx->hi_water) {
-		ctx->hi_called = ISC_TRUE;
 		call_water = ISC_TRUE;
 	}
 	if (ctx->inuse > ctx->maxinuse) {
@@ -1141,10 +1141,8 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 	 * when the context was pushed over hi_water but then had
 	 * isc_mem_setwater() called with 0 for hi_water and lo_water.
 	 */
-	if (ctx->hi_called && 
+	if (ctx->hi_called &&
 	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) {
-		ctx->hi_called = ISC_FALSE;
-
 		if (ctx->water != NULL)
 			call_water = ISC_TRUE;
 	}
@@ -1154,6 +1152,18 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
 }
 
+void
+isc_mem_waterack(isc_mem_t *ctx, int flag) {
+	REQUIRE(VALID_CONTEXT(ctx));
+
+	MCTXLOCK(ctx, &ctx->lock);
+	if (flag == ISC_MEM_LOWATER)
+		ctx->hi_called = ISC_FALSE;
+	else if (flag == ISC_MEM_HIWATER)
+		ctx->hi_called = ISC_TRUE;
+	MCTXUNLOCK(ctx, &ctx->lock);
+}
+
 #if ISC_MEM_TRACKLINES
 static void
 print_active(isc_mem_t *mctx, FILE *out) {
@@ -1169,11 +1179,11 @@ print_active(isc_mem_t *mctx, FILE *out) {
 					    "memory allocations:\n"));
 		found = ISC_FALSE;
 		format = isc_msgcat_get(isc_msgcat, ISC_MSGSET_MEM,
-				        ISC_MSG_PTRFILELINE,
+					ISC_MSG_PTRFILELINE,
 					"\tptr %p size %u file %s line %u\n");
 		for (i = 0; i <= mctx->max_size; i++) {
 			dl = ISC_LIST_HEAD(mctx->debuglist[i]);
-			
+
 			if (dl != NULL)
 				found = ISC_TRUE;
 
@@ -1371,7 +1381,7 @@ isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) {
 	 * when the context was pushed over hi_water but then had
 	 * isc_mem_setwater() called with 0 for hi_water and lo_water.
 	 */
-	if (ctx->hi_called && 
+	if (ctx->hi_called &&
 	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) {
 		ctx->hi_called = ISC_FALSE;
 
@@ -1461,7 +1471,7 @@ isc_mem_inuse(isc_mem_t *ctx) {
 
 void
 isc_mem_setwater(isc_mem_t *ctx, isc_mem_water_t water, void *water_arg,
-                 size_t hiwater, size_t lowater)
+		 size_t hiwater, size_t lowater)
 {
 	isc_boolean_t callwater = ISC_FALSE;
 	isc_mem_water_t oldwater;
@@ -1492,7 +1502,7 @@ isc_mem_setwater(isc_mem_t *ctx, isc_mem_water_t water, void *water_arg,
 		ctx->hi_called = ISC_FALSE;
 	}
 	MCTXUNLOCK(ctx, &ctx->lock);
-	
+
 	if (callwater && oldwater != NULL)
 		(oldwater)(oldwater_arg, ISC_MEM_LOWATER);
 }
@@ -1931,7 +1941,7 @@ isc_mem_printallactive(FILE *file) {
 #endif
 }
 
-void    
+void
 isc_mem_checkdestroyed(FILE *file) {
 
 	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
diff --git a/lib/isc/portset.c b/lib/isc/portset.c
new file mode 100644
index 000000000000..0265c89efd3c
--- /dev/null
+++ b/lib/isc/portset.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: portset.c,v 1.2.4.3 2008/06/24 23:27:11 marka Exp $ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <isc/mem.h>
+#include <isc/portset.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#define ISC_PORTSET_BUFSIZE (65536 / (sizeof(isc_uint32_t) * 8))
+
+/*%
+ * Internal representation of portset.  It's an array of 32-bit integers, each
+ * bit corresponding to a single port in the ascending order.  For example,
+ * the second most significant bit of buf[0] corresponds to port 1.
+ */
+struct isc_portset {
+	unsigned int nports;	/*%< number of ports in the set */
+	isc_uint32_t buf[ISC_PORTSET_BUFSIZE];
+};
+
+static inline isc_boolean_t
+portset_isset(isc_portset_t *portset, in_port_t port) {
+	return (ISC_TF((portset->buf[port >> 5] & (1 << (port & 31))) != 0));
+}
+
+static inline void
+portset_add(isc_portset_t *portset, in_port_t port) {
+	if (!portset_isset(portset, port)) {
+		portset->nports++;
+		portset->buf[port >> 5] |= (1 << (port & 31));
+	}
+}
+
+static inline void
+portset_remove(isc_portset_t *portset, in_port_t port) {
+	if (portset_isset(portset, port)) {
+		portset->nports--;
+		portset->buf[port >> 5] &= ~(1 << (port & 31));
+	}
+}
+
+isc_result_t
+isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_portset_t *portset;
+
+	REQUIRE(portsetp != NULL && *portsetp == NULL);
+
+	portset = isc_mem_get(mctx, sizeof(*portset));
+	if (portset == NULL)
+		return (ISC_R_NOMEMORY);
+
+	/* Make the set 'empty' by default */
+	memset(portset, 0, sizeof(*portset));
+	*portsetp = portset;
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc_portset_destroy(isc_mem_t *mctx, isc_portset_t **portsetp) {
+	isc_portset_t *portset;
+
+	REQUIRE(portsetp != NULL);
+	portset = *portsetp;
+
+	isc_mem_put(mctx, portset, sizeof(*portset));
+}
+
+isc_boolean_t
+isc_portset_isset(isc_portset_t *portset, in_port_t port) {
+	REQUIRE(portset != NULL);
+
+	return (portset_isset(portset, port));
+}
+
+unsigned int
+isc_portset_nports(isc_portset_t *portset) {
+	REQUIRE(portset != NULL);
+
+	return (portset->nports);
+}
+
+void
+isc_portset_add(isc_portset_t *portset, in_port_t port) {
+	REQUIRE(portset != NULL);
+
+	portset_add(portset, port);
+}
+
+void
+isc_portset_remove(isc_portset_t *portset, in_port_t port) {
+	portset_remove(portset, port);
+}
+
+void
+isc_portset_addrange(isc_portset_t *portset, in_port_t port_lo,
+		     in_port_t port_hi)
+{
+	in_port_t p;
+
+	REQUIRE(portset != NULL);
+	REQUIRE(port_lo <= port_hi);
+
+	p = port_lo;
+	do {
+		portset_add(portset, p);
+	} while (p++ < port_hi);
+}
+
+void
+isc_portset_removerange(isc_portset_t *portset, in_port_t port_lo,
+			in_port_t port_hi)
+{
+	in_port_t p;
+
+	REQUIRE(portset != NULL);
+	REQUIRE(port_lo <= port_hi);
+
+	p = port_lo;
+	do {
+		portset_remove(portset, p);
+	} while (p++ < port_hi);
+}
diff --git a/lib/isc/print.c b/lib/isc/print.c
index 59c528b866c0..191ad24a664f 100644
--- a/lib/isc/print.c
+++ b/lib/isc/print.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.c,v 1.27.18.3 2006/04/17 18:27:33 explorer Exp $ */
+/* $Id: print.c,v 1.27.18.5 2008/02/18 23:46:01 tbox Exp $ */
 
 /*! \file */
 
@@ -246,8 +246,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 						head = "";
 					tmpui = tmpi;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lu",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 1000000000;
+					tmpui /= 1000000000;
+					mid = tmpui % 1000000000;
+					hi = tmpui / 1000000000;
+					if (hi != 0)
+						sprintf(buf, "%lu", hi);
+					else
+						buf[0] = '\n';
+					sprintf(buf + strlen(buf), "%lu", mid);
+					sprintf(buf + strlen(buf), "%lu", lo);
+				}
 				goto printint;
 			case 'o':
 				if (q)
@@ -256,10 +272,29 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					tmpui = va_arg(ap, long int);
 				else
 					tmpui = va_arg(ap, int);
-				sprintf(buf,
-					alt ? "%#" ISC_PRINT_QUADFORMAT "o"
-					    : "%" ISC_PRINT_QUADFORMAT "o",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, alt ?  "%#lo" : "%lo",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 010000000000;
+					tmpui /= 010000000000;
+					mid = tmpui % 010000000000;
+					hi = tmpui / 010000000000;
+					if (hi != 0) {
+						sprintf(buf,
+							alt ?  "%#lo" : "%lo",
+							hi);
+						sprintf(buf + strlen(buf),
+							"%lo", mid);
+					} else
+						sprintf(buf,
+							alt ?  "%#lo" : "%lo",
+							mid);
+					sprintf(buf + strlen(buf), "%lo", lo);
+				}
 				goto printint;
 			case 'u':
 				if (q)
@@ -268,8 +303,24 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					tmpui = va_arg(ap, unsigned long int);
 				else
 					tmpui = va_arg(ap, unsigned int);
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "u",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lu",
+						(unsigned long)tmpui);
+				else {
+					unsigned long mid;
+					unsigned long lo;
+					unsigned long hi;
+					lo = tmpui % 1000000000;
+					tmpui /= 1000000000;
+					mid = tmpui % 1000000000;
+					hi = tmpui / 1000000000;
+					if (hi != 0)
+						sprintf(buf, "%lu", hi);
+					else
+						buf[0] = '\n';
+					sprintf(buf + strlen(buf), "%lu", mid);
+					sprintf(buf + strlen(buf), "%lu", lo);
+				}
 				goto printint;
 			case 'x':
 				if (q)
@@ -283,8 +334,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					if (precision > 2)
 						precision -= 2;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "x",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lx",
+						(unsigned long)tmpui);
+				else {
+					unsigned long hi = tmpui>>32;
+					unsigned long lo = tmpui & 0xffffffff;
+					sprintf(buf, "%lx", hi);
+					sprintf(buf + strlen(buf), "%lx", lo);
+				}
 				goto printint;
 			case 'X':
 				if (q)
@@ -298,8 +356,15 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 					if (precision > 2)
 						precision -= 2;
 				}
-				sprintf(buf, "%" ISC_PRINT_QUADFORMAT "X",
-					tmpui);
+				if (tmpui <= 0xffffffffU)
+					sprintf(buf, "%lX",
+						(unsigned long)tmpui);
+				else  {
+					unsigned long hi = tmpui>>32;
+					unsigned long lo = tmpui & 0xffffffff;
+					sprintf(buf, "%lX", hi);
+					sprintf(buf + strlen(buf), "%lX", lo);
+				}
 				goto printint;
 			printint:
 				if (precision != 0 || width != 0) {
diff --git a/lib/isc/pthreads/mutex.c b/lib/isc/pthreads/mutex.c
index 7716980e10a2..afbc861c2ef7 100644
--- a/lib/isc/pthreads/mutex.c
+++ b/lib/isc/pthreads/mutex.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.c,v 1.8.18.4 2005/07/12 01:22:32 marka Exp $ */
+/* $Id: mutex.c,v 1.8.18.6 2008/04/04 23:46:02 tbox Exp $ */
 
 /*! \file */
 
@@ -36,23 +36,23 @@
 /*% Operations on timevals; adapted from FreeBSD's sys/time.h */
 #define timevalclear(tvp)      ((tvp)->tv_sec = (tvp)->tv_usec = 0)
 #define timevaladd(vvp, uvp)                                            \
-        do {                                                            \
-                (vvp)->tv_sec += (uvp)->tv_sec;                         \
-                (vvp)->tv_usec += (uvp)->tv_usec;                       \
-                if ((vvp)->tv_usec >= 1000000) {                        \
-                        (vvp)->tv_sec++;                                \
-                        (vvp)->tv_usec -= 1000000;                      \
-                }                                                       \
-        } while (0)
+	do {                                                            \
+		(vvp)->tv_sec += (uvp)->tv_sec;                         \
+		(vvp)->tv_usec += (uvp)->tv_usec;                       \
+		if ((vvp)->tv_usec >= 1000000) {                        \
+			(vvp)->tv_sec++;                                \
+			(vvp)->tv_usec -= 1000000;                      \
+		}                                                       \
+	} while (0)
 #define timevalsub(vvp, uvp)                                            \
-        do {                                                            \
-                (vvp)->tv_sec -= (uvp)->tv_sec;                         \
-                (vvp)->tv_usec -= (uvp)->tv_usec;                       \
-                if ((vvp)->tv_usec < 0) {                               \
-                        (vvp)->tv_sec--;                                \
-                        (vvp)->tv_usec += 1000000;                      \
-                }                                                       \
-        } while (0)
+	do {                                                            \
+		(vvp)->tv_sec -= (uvp)->tv_sec;                         \
+		(vvp)->tv_usec -= (uvp)->tv_usec;                       \
+		if ((vvp)->tv_usec < 0) {                               \
+			(vvp)->tv_sec--;                                \
+			(vvp)->tv_usec += 1000000;                      \
+		}                                                       \
+	} while (0)
 
 /*@}*/
 
@@ -77,8 +77,11 @@ struct isc_mutexstats {
 	isc_mutexlocker_t	lockers[ISC_MUTEX_MAX_LOCKERS];
 };
 
-#define TABLESIZE (8 * 1024)
-static isc_mutexstats_t stats[TABLESIZE];
+#ifndef ISC_MUTEX_PROFTABLESIZE
+#define ISC_MUTEX_PROFTABLESIZE (16 * 1024)
+#endif
+static isc_mutexstats_t stats[ISC_MUTEX_PROFTABLESIZE];
+static int stats_next = 0;
 static isc_boolean_t stats_init = ISC_FALSE;
 static pthread_mutex_t statslock = PTHREAD_MUTEX_INITIALIZER;
 
@@ -95,21 +98,19 @@ isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) {
 
 	RUNTIME_CHECK(pthread_mutex_lock(&statslock) == 0);
 
-	if (stats_init == ISC_FALSE) {
-		for (i = 0; i < TABLESIZE; i++) {
-			stats[i].file = NULL;
-		}
+	if (stats_init == ISC_FALSE)
 		stats_init = ISC_TRUE;
-	}
 
-	mp->stats = NULL;
-	for (i = 0; i < TABLESIZE; i++) {
-		if (stats[i].file == NULL) {
-			mp->stats = &stats[i];
-			break;
-		}
-	}
-	RUNTIME_CHECK(mp->stats != NULL);
+	/*
+	 * If all statistics entries have been used, give up and trigger an
+	 * assertion failure.  There would be no other way to deal with this
+	 * because we'd like to keep record of all locks for the purpose of
+	 * debugging and the number of necessary locks is unpredictable.
+	 * If this failure is triggered while debugging, named should be
+	 * rebuilt with an increased ISC_MUTEX_PROFTABLESIZE.
+	 */
+	RUNTIME_CHECK(stats_next < ISC_MUTEX_PROFTABLESIZE);
+	mp->stats = &stats[stats_next++];
 
 	RUNTIME_CHECK(pthread_mutex_unlock(&statslock) == 0);
 
@@ -196,10 +197,9 @@ void
 isc_mutex_statsprofile(FILE *fp) {
 	isc_mutexlocker_t *locker;
 	int i, j;
+
 	fprintf(fp, "Mutex stats (in us)\n");
-	for (i = 0; i < TABLESIZE; i++) {
-		if (stats[i].file == NULL)
-			continue;
+	for (i = 0; i < stats_next; i++) {
 		fprintf(fp, "%-12s %4d: %10u  %lu.%06lu %lu.%06lu\n",
 			stats[i].file, stats[i].line, stats[i].count,
 			stats[i].locked_total.tv_sec,
@@ -236,7 +236,7 @@ isc_mutex_init_errcheck(isc_mutex_t *mp)
 
 	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0)
 		return (ISC_R_UNEXPECTED);
-  
+
 	err = pthread_mutex_init(mp, &attr) != 0)
 	if (err == ENOMEM)
 		return (ISC_R_NOMEMORY);
@@ -251,6 +251,7 @@ pthread_mutexattr_t isc__mutex_attrs = {
 };
 #endif
 
+#if !(ISC_MUTEX_DEBUG && defined(PTHREAD_MUTEX_ERRORCHECK)) && !ISC_MUTEX_PROFILE
 isc_result_t
 isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -268,3 +269,4 @@ isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line) {
 	}
 	return (result);
 }
+#endif
diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index d594307d953c..c27281de1264 100644
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.c,v 1.73.18.7.10.3 2008/07/29 18:35:53 jinmei Exp $ */
+/* $Id: timer.c,v 1.73.18.10 2008/08/22 05:59:04 marka Exp $ */
 
 /*! \file */
 
@@ -225,7 +225,7 @@ schedule(isc_timer_t *timer, isc_time_t *now, isc_boolean_t signal_ok) {
 				      "*** POKED TIMER ***");
 		}
 	}
-		
+
 	if (timer->index == 1 && signal_ok) {
 		XTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TIMER,
 				      ISC_MSG_SIGNALSCHED,
diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
index b71d766eb551..c119362581cd 100644
--- a/lib/isc/unix/app.c
+++ b/lib/isc/unix/app.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: app.c,v 1.50.18.2.50.1 2008/07/29 04:47:31 each Exp $ */
+/* $Id: app.c,v 1.50.18.8 2008/10/15 03:41:17 marka Exp $ */
 
 /*! \file */
 
@@ -30,6 +30,9 @@
 #include <unistd.h>
 #include <signal.h>
 #include <sys/time.h>
+#ifdef HAVE_EPOLL
+#include <sys/epoll.h>
+#endif
 
 #include <isc/app.h>
 #include <isc/boolean.h>
@@ -59,11 +62,11 @@ static isc_boolean_t		running = ISC_FALSE;
 /*!
  * We assume that 'want_shutdown' can be read and written atomically.
  */
-static isc_boolean_t		want_shutdown = ISC_FALSE;
+static volatile isc_boolean_t	want_shutdown = ISC_FALSE;
 /*
  * We assume that 'want_reload' can be read and written atomically.
  */
-static isc_boolean_t		want_reload = ISC_FALSE;
+static volatile isc_boolean_t	want_reload = ISC_FALSE;
 
 static isc_boolean_t		blocked  = ISC_FALSE;
 #ifdef ISC_PLATFORM_USETHREADS
@@ -87,13 +90,13 @@ static pthread_t		main_thread;
 #ifndef HAVE_SIGWAIT
 static void
 exit_action(int arg) {
-        UNUSED(arg);
+	UNUSED(arg);
 	want_shutdown = ISC_TRUE;
 }
 
 static void
 reload_action(int arg) {
-        UNUSED(arg);
+	UNUSED(arg);
 	want_reload = ISC_TRUE;
 }
 #endif
@@ -297,14 +300,13 @@ isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
  * Event loop for nonthreaded programs.
  */
 static isc_result_t
-evloop() {
+evloop(void) {
 	isc_result_t result;
 	while (!want_shutdown) {
 		int n;
 		isc_time_t when, now;
 		struct timeval tv, *tvp;
-		fd_set *readfds, *writefds;
-		int maxfd;
+		isc_socketwait_t *swait;
 		isc_boolean_t readytasks;
 		isc_boolean_t call_timer_dispatch = ISC_FALSE;
 
@@ -331,15 +333,15 @@ evloop() {
 			}
 		}
 
-		isc__socketmgr_getfdsets(&readfds, &writefds, &maxfd);
-		n = select(maxfd, readfds, writefds, NULL, tvp);
+		swait = NULL;
+		n = isc__socketmgr_waitevents(tvp, &swait);
 
 		if (n == 0 || call_timer_dispatch) {
 			/*
 			 * We call isc__timermgr_dispatch() only when
 			 * necessary, in order to reduce overhead.  If the
 			 * select() call indicates a timeout, we need the
-			 * dispatch.  Even if not, if we set the 0-timeout 
+			 * dispatch.  Even if not, if we set the 0-timeout
 			 * for the select() call, we need to check the timer
 			 * events.  In the 'readytasks' case, there may be no
 			 * timeout event actually, but there is no other way
@@ -352,8 +354,7 @@ evloop() {
 			isc__timermgr_dispatch();
 		}
 		if (n > 0)
-			(void)isc__socketmgr_dispatch(readfds, writefds,
-						      maxfd);
+			(void)isc__socketmgr_dispatch(swait);
 		(void)isc__taskmgr_dispatch();
 
 		if (want_reload) {
@@ -423,7 +424,7 @@ isc__nothread_signal_hack(isc_condition_t *cp) {
 	signalled = ISC_TRUE;
 	return (ISC_R_SUCCESS);
 }
-	
+
 #endif /* ISC_PLATFORM_USETHREADS */
 
 isc_result_t
@@ -434,10 +435,10 @@ isc_app_run(void) {
 #ifdef ISC_PLATFORM_USETHREADS
 	sigset_t sset;
 	char strbuf[ISC_STRERRORSIZE];
-#endif /* ISC_PLATFORM_USETHREADS */
 #ifdef HAVE_SIGWAIT
 	int sig;
 #endif
+#endif /* ISC_PLATFORM_USETHREADS */
 
 #ifdef HAVE_LINUXTHREADS
 	REQUIRE(main_thread == pthread_self());
@@ -676,7 +677,7 @@ isc_app_unblock(void) {
 	REQUIRE(blockedthread == pthread_self());
 
 	RUNTIME_CHECK(sigemptyset(&sset) == 0 &&
-		      sigaddset(&sset, SIGINT) == 0 && 
+		      sigaddset(&sset, SIGINT) == 0 &&
 		      sigaddset(&sset, SIGTERM) == 0);
 	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
 #endif /* ISC_PLATFORM_USETHREADS */
diff --git a/lib/isc/unix/include/isc/net.h b/lib/isc/unix/include/isc/net.h
index bdd8c14c9fd5..948e7b19d3d4 100644
--- a/lib/isc/unix/include/isc/net.h
+++ b/lib/isc/unix/include/isc/net.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.h,v 1.39.18.4 2005/04/27 05:02:37 sra Exp $ */
+/* $Id: net.h,v 1.39.18.6 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef ISC_NET_H
 #define ISC_NET_H 1
@@ -104,7 +104,7 @@
 /*%
  * Required for some pre RFC2133 implementations.
  * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in
- * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.  
+ * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.
  * If 's6_addr' is defined then assume that there is a union and three
  * levels otherwise assume two levels required.
  */
@@ -202,7 +202,7 @@ extern const struct in6_addr isc_net_in6addrloop;
 
 #ifdef ISC_PLATFORM_FIXIN6ISADDR
 #undef  IN6_IS_ADDR_GEOGRAPHIC
-/*! 
+/*!
  * \brief
  * Fix UnixWare 7.1.1's broken IN6_IS_ADDR_* definitions.
  */
@@ -324,6 +324,23 @@ isc_net_probeunix(void);
  * Returns whether UNIX domain sockets are supported.
  */
 
+isc_result_t
+isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high);
+/*%<
+ * Returns system's default range of ephemeral UDP ports, if defined.
+ * If the range is not available or unknown, ISC_NET_PORTRANGELOW and
+ * ISC_NET_PORTRANGEHIGH will be returned.
+ *
+ * Requires:
+ *
+ *\li	'low' and 'high' must be non NULL.
+ *
+ * Returns:
+ *
+ *\li	*low and *high will be the ports specifying the low and high ends of
+ *	the range.
+ */
+
 #ifdef ISC_PLATFORM_NEEDNTOP
 const char *
 isc_net_ntop(int af, const void *src, char *dst, size_t size);
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index 1de6b32a19d7..600ac9292c70 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,10 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.c,v 1.29.18.6 2007/09/13 23:46:26 tbox Exp $ */
+/* $Id: net.c,v 1.29.18.9 2008/07/04 05:52:05 each Exp $ */
 
 #include <config.h>
 
+#include <sys/types.h>
+
+#if defined(HAVE_SYS_SYSCTL_H)
+#if defined(HAVE_SYS_PARAM_H)
+#include <sys/param.h>
+#endif
+#include <sys/sysctl.h>
+#endif
+
 #include <errno.h>
 #include <unistd.h>
 
@@ -30,6 +39,59 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
+/*%
+ * Definitions about UDP port range specification.  This is a total mess of
+ * portability variants: some use sysctl (but the sysctl names vary), some use
+ * system-specific interfaces, some have the same interface for IPv4 and IPv6,
+ * some separate them, etc...
+ */
+
+/*%
+ * The last resort defaults: use all non well known port space
+ */
+#ifndef ISC_NET_PORTRANGELOW
+#define ISC_NET_PORTRANGELOW 1024
+#endif	/* ISC_NET_PORTRANGELOW */
+#ifndef ISC_NET_PORTRANGEHIGH
+#define ISC_NET_PORTRANGEHIGH 65535
+#endif	/* ISC_NET_PORTRANGEHIGH */
+
+#ifdef HAVE_SYSCTLBYNAME
+
+/*%
+ * sysctl variants
+ */
+#if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	"net.inet.ip.portrange.hifirst"
+#define SYSCTL_V4PORTRANGE_HIGH	"net.inet.ip.portrange.hilast"
+#define SYSCTL_V6PORTRANGE_LOW	"net.inet.ip.portrange.hifirst"
+#define SYSCTL_V6PORTRANGE_HIGH	"net.inet.ip.portrange.hilast"
+#endif
+
+#ifdef __NetBSD__
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	"net.inet.ip.anonportmin"
+#define SYSCTL_V4PORTRANGE_HIGH	"net.inet.ip.anonportmax"
+#define SYSCTL_V6PORTRANGE_LOW	"net.inet6.ip6.anonportmin"
+#define SYSCTL_V6PORTRANGE_HIGH	"net.inet6.ip6.anonportmax"
+#endif
+
+#else /* !HAVE_SYSCTLBYNAME */
+
+#ifdef __OpenBSD__
+#define USE_SYSCTL_PORTRANGE
+#define SYSCTL_V4PORTRANGE_LOW	{ CTL_NET, PF_INET, IPPROTO_IP, \
+				  IPCTL_IPPORT_HIFIRSTAUTO }
+#define SYSCTL_V4PORTRANGE_HIGH	{ CTL_NET, PF_INET, IPPROTO_IP, \
+				  IPCTL_IPPORT_HILASTAUTO }
+/* Same for IPv6 */
+#define SYSCTL_V6PORTRANGE_LOW	SYSCTL_V4PORTRANGE_LOW
+#define SYSCTL_V6PORTRANGE_HIGH	SYSCTL_V4PORTRANGE_HIGH
+#endif
+
+#endif /* HAVE_SYSCTLBYNAME */
+
 #if defined(ISC_PLATFORM_HAVEIPV6)
 # if defined(ISC_PLATFORM_NEEDIN6ADDRANY)
 const struct in6_addr isc_net_in6addrany = IN6ADDR_ANY_INIT;
@@ -338,6 +400,101 @@ isc_net_probe_ipv6pktinfo(void) {
 	return (ipv6pktinfo_result);
 }
 
+#if defined(USE_SYSCTL_PORTRANGE)
+#if defined(HAVE_SYSCTLBYNAME)
+static isc_result_t
+getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) {
+	int port_low, port_high;
+	size_t portlen;
+	const char *sysctlname_lowport, *sysctlname_hiport;
+
+	if (af == AF_INET) {
+		sysctlname_lowport = SYSCTL_V4PORTRANGE_LOW;
+		sysctlname_hiport = SYSCTL_V4PORTRANGE_HIGH;
+	} else {
+		sysctlname_lowport = SYSCTL_V6PORTRANGE_LOW;
+		sysctlname_hiport = SYSCTL_V6PORTRANGE_HIGH;
+	}
+	portlen = sizeof(portlen);
+	if (sysctlbyname(sysctlname_lowport, &port_low, &portlen,
+			 NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+	portlen = sizeof(portlen);
+	if (sysctlbyname(sysctlname_hiport, &port_high, &portlen,
+			 NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+	if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0)
+		return (ISC_R_RANGE);
+
+	*low = (in_port_t)port_low;
+	*high = (in_port_t)port_high;
+
+	return (ISC_R_SUCCESS);
+}
+#else /* !HAVE_SYSCTLBYNAME */
+static isc_result_t
+getudpportrange_sysctl(int af, in_port_t *low, in_port_t *high) {
+	int mib_lo4[4] = SYSCTL_V4PORTRANGE_LOW;
+	int mib_hi4[4] = SYSCTL_V4PORTRANGE_HIGH;
+	int mib_lo6[4] = SYSCTL_V6PORTRANGE_LOW;
+	int mib_hi6[4] = SYSCTL_V6PORTRANGE_HIGH;
+	int *mib_lo, *mib_hi, miblen;
+	int port_low, port_high;
+	size_t portlen;
+
+	if (af == AF_INET) {
+		mib_lo = mib_lo4;
+		mib_hi = mib_hi4;
+		miblen = sizeof(mib_lo4) / sizeof(mib_lo4[0]);
+	} else {
+		mib_lo = mib_lo6;
+		mib_hi = mib_hi6;
+		miblen = sizeof(mib_lo6) / sizeof(mib_lo6[0]);
+	}
+
+	portlen = sizeof(portlen);
+	if (sysctl(mib_lo, miblen, &port_low, &portlen, NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	portlen = sizeof(portlen);
+	if (sysctl(mib_hi, miblen, &port_high, &portlen, NULL, 0) < 0) {
+		return (ISC_R_FAILURE);
+	}
+
+	if ((port_low & ~0xffff) != 0 || (port_high & ~0xffff) != 0)
+		return (ISC_R_RANGE);
+
+	*low = (in_port_t) port_low;
+	*high = (in_port_t) port_high;
+
+	return (ISC_R_SUCCESS);
+}
+#endif /* HAVE_SYSCTLBYNAME */
+#endif /* USE_SYSCTL_PORTRANGE */
+
+isc_result_t
+isc_net_getudpportrange(int af, in_port_t *low, in_port_t *high) {
+	int result = ISC_R_FAILURE;
+
+	REQUIRE(low != NULL && high != NULL);
+
+#if defined(USE_SYSCTL_PORTRANGE)
+	result = getudpportrange_sysctl(af, low, high);
+#else
+	UNUSED(af);
+#endif
+
+	if (result != ISC_R_SUCCESS) {
+		*low = ISC_NET_PORTRANGELOW;
+		*high = ISC_NET_PORTRANGEHIGH;
+	}
+
+	return (ISC_R_SUCCESS);	/* we currently never fail in this function */
+}
+
 void
 isc_net_disableipv4(void) {
 	initialize();
diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c
index 0264976f8816..e9bc5fd6bd17 100644
--- a/lib/isc/unix/resource.c
+++ b/lib/isc/unix/resource.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.c,v 1.12.944.4 2008/07/28 22:44:46 marka Exp $ */
+/* $Id: resource.c,v 1.12.18.6 2008/08/05 07:17:05 marka Exp $ */
 
 #include <config.h>
 
@@ -32,7 +32,7 @@
 #include <linux/fs.h>	/* To get the large NR_OPEN. */
 #endif
 
-#ifdef __hpux
+#if defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H)
 #include <sys/dyntune.h>
 #endif
 
@@ -48,13 +48,13 @@ resource2rlim(isc_resource_t resource, int *rlim_resource) {
 		break;
 	case isc_resource_cputime:
 		*rlim_resource = RLIMIT_CPU;
-		break;		
+		break;
 	case isc_resource_datasize:
 		*rlim_resource = RLIMIT_DATA;
-		break;		
+		break;
 	case isc_resource_filesize:
 		*rlim_resource = RLIMIT_FSIZE;
-		break;		
+		break;
 	case isc_resource_lockedmemory:
 #ifdef RLIMIT_MEMLOCK
 		*rlim_resource = RLIMIT_MEMLOCK;
@@ -87,7 +87,7 @@ resource2rlim(isc_resource_t resource, int *rlim_resource) {
 		*rlim_resource = RLIMIT_STACK;
 		break;
 	default:
-                /*
+		/*
 		 * This test is not very robust if isc_resource_t
 		 * changes, but generates a clear assertion message.
 		 */
@@ -140,51 +140,6 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
 		rlim_value = value;
 	}
 
-	/*
-	 * The BIND 8 documentation reports:
-	 *
-	 *	Note: on some operating systems the server cannot set an
-	 *	unlimited value and cannot determine the maximum number of
-	 *	open files the kernel can support. On such systems, choosing
-	 *	unlimited will cause the server to use the larger of the
-	 *	rlim_max for RLIMIT_NOFILE and the value returned by
-	 *	sysconf(_SC_OPEN_MAX). If the actual kernel limit is larger
-	 *	than this value, use limit files to specify the limit
-	 *	explicitly.
-	 *
-	 * The CHANGES for 8.1.2-T3A also mention:
-	 *
-	 *	352. [bug] Because of problems with setting an infinite
-	 *	rlim_max for RLIMIT_NOFILE on some systems, previous versions
-	 *	of the server implemented "limit files unlimited" by setting
-	 *	the limit to the value returned by sysconf(_SC_OPEN_MAX).  The
-	 *	server will now use RLIM_INFINITY on systems which allow it.
-	 *
-	 * At some point the BIND 8 server stopped using SC_OPEN_MAX for this
-	 * purpose at all, but it isn't clear to me when or why, as my access
-	 * to the CVS archive is limited at the time of this writing.  What
-	 * BIND 8 *does* do is to set RLIMIT_NOFILE to either RLIMIT_INFINITY
-	 * on a half dozen operating systems or to FD_SETSIZE on the rest,
-	 * the latter of which is probably fewer than the real limit.  (Note
-	 * that libisc's socket module will have problems with any fd over
-	 * FD_SETSIZE.  This should be fixed in the socket module, not a
-	 * limitation here.  BIND 8's eventlib also has a problem, making
-	 * its RLIMIT_INFINITY setting useless, because it closes and ignores
-	 * any fd over FD_SETSIZE.)
-	 *
-	 * More troubling is the reference to some operating systems not being
-	 * able to set an unlimited value for the number of open files.  I'd
-	 * hate to put in code that is really only there to support archaic
-	 * systems that the rest of libisc won't work on anyway.  So what this
-	 * extremely verbose comment is here to say is the following:
-	 *
-	 *   I'm aware there might be an issue with not limiting the value
-	 *   for RLIMIT_NOFILE on some systems, but since I don't know yet
-	 *   what those systems are and what the best workaround is (use
-	 *   sysconf()?  rlim_max from getrlimit()?  FD_SETSIZE?) so nothing
-	 *   is currently being done to clamp the value for open files.
-	 */
-
 	rl.rlim_cur = rl.rlim_max = rlim_value;
 	unixresult = setrlimit(unixresource, &rl);
 
@@ -215,7 +170,7 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
 		if (unixresult == 0)
 			return (ISC_R_SUCCESS);
 	}
-#elif defined(__hpux)
+#elif defined(__hpux) && defined(HAVE_SYS_DYNTUNE_H)
 	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
 		uint64_t maxfiles;
 		if (gettune("maxfiles_lim", &maxfiles) == 0) {
@@ -255,7 +210,7 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
 }
 
 isc_result_t
-isc_resource_curlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
+isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
 	int unixresult;
 	int unixresource;
 	struct rlimit rl;
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 1b4da78c2436..32396148ae02 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.237.18.29.10.6 2008/07/29 04:47:31 each Exp $ */
+/* $Id: socket.c,v 1.237.18.56 2008/11/12 03:58:36 marka Exp $ */
 
 /*! \file */
 
@@ -25,9 +25,6 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
-#ifdef ISC_PLATFORM_HAVESYSUNH
-#include <sys/un.h>
-#endif
 #include <sys/time.h>
 #include <sys/uio.h>
 
@@ -58,6 +55,19 @@
 #include <isc/thread.h>
 #include <isc/util.h>
 
+#ifdef ISC_PLATFORM_HAVESYSUNH
+#include <sys/un.h>
+#endif
+#ifdef ISC_PLATFORM_HAVEKQUEUE
+#include <sys/event.h>
+#endif
+#ifdef ISC_PLATFORM_HAVEEPOLL
+#include <sys/epoll.h>
+#endif
+#ifdef ISC_PLATFORM_HAVEDEVPOLL
+#include <sys/devpoll.h>
+#endif
+
 #include "errno2result.h"
 
 #ifndef ISC_PLATFORM_USETHREADS
@@ -65,9 +75,46 @@
 #endif /* ISC_PLATFORM_USETHREADS */
 
 /*%
- * Max number of open sockets.  In the vast majority of cases the default size  
- * of FD_SETSIZE should be fine, and this constant should be increased only
- * when absolutely necessary and possible, i.e., the server is exhausting all   
+ * Choose the most preferable multiplex method.
+ */
+#ifdef ISC_PLATFORM_HAVEKQUEUE
+#define USE_KQUEUE
+#elif defined (ISC_PLATFORM_HAVEEPOLL)
+#define USE_EPOLL
+#elif defined (ISC_PLATFORM_HAVEDEVPOLL)
+#define USE_DEVPOLL
+typedef struct {
+	unsigned int want_read : 1,
+		want_write : 1;
+} pollinfo_t;
+#else
+#define USE_SELECT
+#endif	/* ISC_PLATFORM_HAVEKQUEUE */
+
+#ifndef ISC_PLATFORM_USETHREADS
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+struct isc_socketwait {
+	int nevents;
+};
+#elif defined (USE_SELECT)
+struct isc_socketwait {
+	fd_set *readset;
+	fd_set *writeset;
+	int nfds;
+	int maxfd;
+};
+#endif	/* USE_KQUEUE */
+#endif /* !ISC_PLATFORM_USETHREADS */
+
+/*%
+ * Maximum number of allowable open sockets.  This is also the maximum
+ * allowable socket file descriptor.
+ *
+ * Care should be taken before modifying this value for select():
+ * The API standard doesn't ensure select() accept more than (the system default
+ * of) FD_SETSIZE descriptors, and the default size should in fact be fine in
+ * the vast majority of cases.  This constant should therefore be increased only
+ * when absolutely necessary and possible, i.e., the server is exhausting all
  * available file descriptors (up to FD_SETSIZE) and the select() function
  * and FD_xxx macros support larger values than FD_SETSIZE (which may not
  * always by true, but we keep using some of them to ensure as much
@@ -78,18 +125,72 @@
  * As a special note, this value shouldn't have to be touched if
  * this is a build for an authoritative only DNS server.
  */
-
-#ifndef ISC_SOCKET_FDSETSIZE
-#define ISC_SOCKET_FDSETSIZE FD_SETSIZE
-#endif
-
+#ifndef ISC_SOCKET_MAXSOCKETS
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+#define ISC_SOCKET_MAXSOCKETS 4096
+#elif defined(USE_SELECT)
+#define ISC_SOCKET_MAXSOCKETS FD_SETSIZE
+#endif	/* USE_KQUEUE... */
+#endif	/* ISC_SOCKET_MAXSOCKETS */
+
+#ifdef USE_SELECT
 /*%
- * Mac OS X needs a special definition to support larger values in select()
+ * Mac OS X needs a special definition to support larger values in select().
+ * We always define this because a larger value can be specified run-time.
  */
-#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE
 #ifdef __APPLE__
 #define _DARWIN_UNLIMITED_SELECT
 #endif	/* __APPLE__ */
+#endif	/* USE_SELECT */
+
+#ifdef ISC_SOCKET_USE_POLLWATCH
+/*%
+ * If this macro is defined, enable workaround for a Solaris /dev/poll kernel
+ * bug: DP_POLL ioctl could keep sleeping even if socket I/O is possible for
+ * some of the specified FD.  The idea is based on the observation that it's
+ * likely for a busy server to keep receiving packets.  It specifically works
+ * as follows: the socket watcher is first initialized with the state of
+ * "poll_idle".  While it's in the idle state it keeps sleeping until a socket
+ * event occurs.  When it wakes up for a socket I/O event, it moves to the
+ * poll_active state, and sets the poll timeout to a short period
+ * (ISC_SOCKET_POLLWATCH_TIMEOUT msec).  If timeout occurs in this state, the
+ * watcher goes to the poll_checking state with the same timeout period.
+ * In this state, the watcher tries to detect whether this is a break
+ * during intermittent events or the kernel bug is triggered.  If the next
+ * polling reports an event within the short period, the previous timeout is
+ * likely to be a kernel bug, and so the watcher goes back to the active state.
+ * Otherwise, it moves to the idle state again.
+ *
+ * It's not clear whether this is a thread-related bug, but since we've only
+ * seen this with threads, this workaround is used only when enabling threads.
+ */
+
+typedef enum { poll_idle, poll_active, poll_checking } pollstate_t;
+
+#ifndef ISC_SOCKET_POLLWATCH_TIMEOUT
+#define ISC_SOCKET_POLLWATCH_TIMEOUT 10
+#endif	/* ISC_SOCKET_POLLWATCH_TIMEOUT */
+#endif	/* ISC_SOCKET_USE_POLLWATCH */
+
+/*%
+ * Size of per-FD lock buckets.
+ */
+#ifdef ISC_PLATFORM_USETHREADS
+#define FDLOCK_COUNT		1024
+#define FDLOCK_ID(fd)		((fd) % FDLOCK_COUNT)
+#else
+#define FDLOCK_COUNT		1
+#define FDLOCK_ID(fd)		0
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+/*%
+ * Maximum number of events communicated with the kernel.  There should normally
+ * be no need for having a large number.
+ */
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+#ifndef ISC_SOCKET_MAXEVENTS
+#define ISC_SOCKET_MAXEVENTS	64
+#endif
 #endif
 
 /*%
@@ -230,22 +331,50 @@ struct isc_socketmgr {
 	unsigned int		magic;
 	isc_mem_t	       *mctx;
 	isc_mutex_t		lock;
+	isc_mutex_t		*fdlock;
+#ifdef USE_KQUEUE
+	int			kqueue_fd;
+	int			nevents;
+	struct kevent		*events;
+#endif	/* USE_KQUEUE */
+#ifdef USE_EPOLL
+	int			epoll_fd;
+	int			nevents;
+	struct epoll_event	*events;
+#endif	/* USE_EPOLL */
+#ifdef USE_DEVPOLL
+	int			devpoll_fd;
+	int			nevents;
+	struct pollfd		*events;
+#endif	/* USE_DEVPOLL */
+#ifdef USE_SELECT
 	int			fd_bufsize;
-	int			fdsize;
+#endif	/* USE_SELECT */
+	unsigned int		maxsocks;
+#ifdef ISC_PLATFORM_USETHREADS
+	int			pipe_fds[2];
+#endif
+
+	/* Locked by fdlock. */
+	isc_socket_t	       **fds;
+	int			*fdstate;
+#ifdef USE_DEVPOLL
+	pollinfo_t		*fdpollinfo;
+#endif
+
 	/* Locked by manager lock. */
 	ISC_LIST(isc_socket_t)	socklist;
+#ifdef USE_SELECT
 	fd_set			*read_fds;
 	fd_set			*read_fds_copy;
 	fd_set			*write_fds;
 	fd_set			*write_fds_copy;
-	isc_socket_t	       **fds;
-	int			*fdstate;
 	int			maxfd;
-	int			reserved; 	/* unlocked */
+#endif	/* USE_SELECT */
+	int			reserved;	/* unlocked */
 #ifdef ISC_PLATFORM_USETHREADS
 	isc_thread_t		watcher;
 	isc_condition_t		shutdown_ok;
-	int			pipe_fds[2];
 #else /* ISC_PLATFORM_USETHREADS */
 	unsigned int		refs;
 #endif /* ISC_PLATFORM_USETHREADS */
@@ -284,8 +413,9 @@ static void build_msghdr_send(isc_socket_t *, isc_socketevent_t *,
 			      struct msghdr *, struct iovec *, size_t *);
 static void build_msghdr_recv(isc_socket_t *, isc_socketevent_t *,
 			      struct msghdr *, struct iovec *, size_t *);
-static void cleanup_fdsets(isc_socketmgr_t *, isc_mem_t *);
-static isc_result_t create_fdsets(isc_socketmgr_t *, isc_mem_t *);
+#ifdef ISC_PLATFORM_USETHREADS
+static isc_boolean_t process_ctlfd(isc_socketmgr_t *manager);
+#endif
 
 #define SELECT_POKE_SHUTDOWN		(-1)
 #define SELECT_POKE_NOTHING		(-2)
@@ -354,9 +484,195 @@ socket_log(isc_socket_t *sock, isc_sockaddr_t *address,
 	}
 }
 
+#if defined(_AIX) && defined(ISC_NET_BSD44MSGHDR) && \
+    defined(USE_CMSG) && defined(IPV6_RECVPKTINFO)
+/*
+ * AIX has a kernel bug where IPV6_RECVPKTINFO gets cleared by
+ * setting IPV6_V6ONLY.
+ */
+static void
+FIX_IPV6_RECVPKTINFO(isc_socket_t *sock)
+{
+	char strbuf[ISC_STRERRORSIZE];
+	int on = 1;
+
+	if (sock->pf != AF_INET6 || sock->type != isc_sockettype_udp)
+		return;
+
+	if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
+		       (void *)&on, sizeof(on)) < 0) {
+	
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "setsockopt(%d, IPV6_RECVPKTINFO) "
+				 "%s: %s", sock->fd,
+				 isc_msgcat_get(isc_msgcat,
+						ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED,
+						"failed"),
+				 strbuf);
+	}
+}
+#else
+#define FIX_IPV6_RECVPKTINFO(sock) (void)0
+#endif
+
+static inline isc_result_t
+watch_fd(isc_socketmgr_t *manager, int fd, int msg) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+#ifdef USE_KQUEUE
+	struct kevent evchange;
+
+	memset(&evchange, 0, sizeof(evchange));
+	if (msg == SELECT_POKE_READ)
+		evchange.filter = EVFILT_READ;
+	else
+		evchange.filter = EVFILT_WRITE;
+	evchange.flags = EV_ADD;
+	evchange.ident = fd;
+	if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0)
+		result = isc__errno2result(errno);
+
+	return (result);
+#elif defined(USE_EPOLL)
+	struct epoll_event event;
+
+	if (msg == SELECT_POKE_READ)
+		event.events = EPOLLIN;
+	else
+		event.events = EPOLLOUT;
+	event.data.fd = fd;
+	if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 &&
+	    errno != EEXIST) {
+		result = isc__errno2result(errno);
+	}
+
+	return (result);
+#elif defined(USE_DEVPOLL)
+	struct pollfd pfd;
+	int lockid = FDLOCK_ID(fd);
+
+	memset(&pfd, 0, sizeof(pfd));
+	if (msg == SELECT_POKE_READ)
+		pfd.events = POLLIN;
+	else
+		pfd.events = POLLOUT;
+	pfd.fd = fd;
+	pfd.revents = 0;
+	LOCK(&manager->fdlock[lockid]);
+	if (write(manager->devpoll_fd, &pfd, sizeof(pfd)) == -1)
+		result = isc__errno2result(errno);
+	else {
+		if (msg == SELECT_POKE_READ)
+			manager->fdpollinfo[fd].want_read = 1;
+		else
+			manager->fdpollinfo[fd].want_write = 1;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
+
+	return (result);
+#elif defined(USE_SELECT)
+	LOCK(&manager->lock);
+	if (msg == SELECT_POKE_READ)
+		FD_SET(fd, manager->read_fds);
+	if (msg == SELECT_POKE_WRITE)
+		FD_SET(fd, manager->write_fds);
+	UNLOCK(&manager->lock);
+
+	return (result);
+#endif
+}
+
+static inline isc_result_t
+unwatch_fd(isc_socketmgr_t *manager, int fd, int msg) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+#ifdef USE_KQUEUE
+	struct kevent evchange;
+
+	memset(&evchange, 0, sizeof(evchange));
+	if (msg == SELECT_POKE_READ)
+		evchange.filter = EVFILT_READ;
+	else
+		evchange.filter = EVFILT_WRITE;
+	evchange.flags = EV_DELETE;
+	evchange.ident = fd;
+	if (kevent(manager->kqueue_fd, &evchange, 1, NULL, 0, NULL) != 0)
+		result = isc__errno2result(errno);
+
+	return (result);
+#elif defined(USE_EPOLL)
+	struct epoll_event event;
+
+	if (msg == SELECT_POKE_READ)
+		event.events = EPOLLIN;
+	else
+		event.events = EPOLLOUT;
+	event.data.fd = fd;
+	if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 &&
+	    errno != ENOENT) {
+		char strbuf[ISC_STRERRORSIZE];
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "epoll_ctl(DEL), %d: %s", fd, strbuf);
+		result = ISC_R_UNEXPECTED;
+	}
+	return (result);
+#elif defined(USE_DEVPOLL)
+	struct pollfd pfds[2];
+	size_t writelen = sizeof(pfds[0]);
+	int lockid = FDLOCK_ID(fd);
+
+	memset(pfds, 0, sizeof(pfds));
+	pfds[0].events = POLLREMOVE;
+	pfds[0].fd = fd;
+
+	/*
+	 * Canceling read or write polling via /dev/poll is tricky.  Since it
+	 * only provides a way of canceling per FD, we may need to re-poll the
+	 * socket for the other operation.
+	 */
+	LOCK(&manager->fdlock[lockid]);
+	if (msg == SELECT_POKE_READ &&
+	    manager->fdpollinfo[fd].want_write == 1) {
+		pfds[1].events = POLLOUT;
+		pfds[1].fd = fd;
+		writelen += sizeof(pfds[1]);
+	}
+	if (msg == SELECT_POKE_WRITE &&
+	    manager->fdpollinfo[fd].want_read == 1) {
+		pfds[1].events = POLLIN;
+		pfds[1].fd = fd;
+		writelen += sizeof(pfds[1]);
+	}
+
+	if (write(manager->devpoll_fd, pfds, writelen) == -1)
+		result = isc__errno2result(errno);
+	else {
+		if (msg == SELECT_POKE_READ)
+			manager->fdpollinfo[fd].want_read = 0;
+		else
+			manager->fdpollinfo[fd].want_write = 0;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
+
+	return (result);
+#elif defined(USE_SELECT)
+	LOCK(&manager->lock);
+	if (msg == SELECT_POKE_READ)
+		FD_CLR(fd, manager->read_fds);
+	else if (msg == SELECT_POKE_WRITE)
+		FD_CLR(fd, manager->write_fds);
+	UNLOCK(&manager->lock);
+
+	return (result);
+#endif
+}
+
 static void
 wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) {
-	isc_socket_t *sock;
+	isc_result_t result;
+	int lockid = FDLOCK_ID(fd);
 
 	/*
 	 * This is a wakeup on a socket.  If the socket is not in the
@@ -364,27 +680,54 @@ wakeup_socket(isc_socketmgr_t *manager, int fd, int msg) {
 	 * or writes.
 	 */
 
-	INSIST(fd >= 0 && fd < manager->fdsize);
+	INSIST(fd >= 0 && fd < (int)manager->maxsocks);
 
-	if (manager->fdstate[fd] == CLOSE_PENDING) {
+	if (msg == SELECT_POKE_CLOSE) {
+		/* No one should be updating fdstate, so no need to lock it */
+		INSIST(manager->fdstate[fd] == CLOSE_PENDING);
 		manager->fdstate[fd] = CLOSED;
-		FD_CLR(fd, manager->read_fds);
-		FD_CLR(fd, manager->write_fds);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
 		(void)close(fd);
 		return;
 	}
-	if (manager->fdstate[fd] != MANAGED)
-		return;
 
-	sock = manager->fds[fd];
+	LOCK(&manager->fdlock[lockid]);
+	if (manager->fdstate[fd] == CLOSE_PENDING) {
+		UNLOCK(&manager->fdlock[lockid]);
+		/*
+		 * We accept (and ignore) any error from unwatch_fd() as we are
+		 * closing the socket, hoping it doesn't leave dangling state in
+		 * the kernel.
+		 * Note that unwatch_fd() must be called after releasing the
+		 * fdlock; otherwise it could cause deadlock due to a lock order
+		 * reversal.
+		 */
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+		return;
+	}
+	if (manager->fdstate[fd] != MANAGED) {
+		UNLOCK(&manager->fdlock[lockid]);
+		return;
+	}
+	UNLOCK(&manager->fdlock[lockid]);
 
 	/*
 	 * Set requested bit.
 	 */
-	if (msg == SELECT_POKE_READ)
-		FD_SET(sock->fd, manager->read_fds);
-	if (msg == SELECT_POKE_WRITE)
-		FD_SET(sock->fd, manager->write_fds);
+	result = watch_fd(manager, fd, msg);
+	if (result != ISC_R_SUCCESS) {
+		/*
+		 * XXXJT: what should we do?  Ignoring the failure of watching
+		 * a socket will make the application dysfunctional, but there
+		 * seems to be no reasonable recovery process.
+		 */
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+			      "failed to start watching FD (%d): %s",
+			      fd, isc_result_totext(result));
+	}
 }
 
 #ifdef ISC_PLATFORM_USETHREADS
@@ -452,7 +795,7 @@ select_readmsg(isc_socketmgr_t *mgr, int *fd, int *msg) {
 					   "read() failed "
 					   "during watcher poke: %s"),
 			    strbuf);
-		
+
 		return;
 	}
 	INSIST(cc == sizeof(buf));
@@ -557,7 +900,7 @@ cmsg_space(ISC_SOCKADDR_LEN_T len) {
 		return ((char *)cmsgp - (char *)msg.msg_control);
 	else
 		return (0);
-#endif	
+#endif
 }
 #endif /* USE_CMSG */
 
@@ -631,7 +974,7 @@ process_cmsg(isc_socket_t *sock, struct msghdr *msg, isc_socketevent_t *dev) {
 				   "interface received on ifindex %u",
 				   dev->pktinfo.ipi6_ifindex);
 			if (IN6_IS_ADDR_MULTICAST(&pktinfop->ipi6_addr))
-				dev->attributes |= ISC_SOCKEVENTATTR_MULTICAST;				
+				dev->attributes |= ISC_SOCKEVENTATTR_MULTICAST;
 			goto next;
 		}
 #endif
@@ -679,7 +1022,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 
 	memset(msg, 0, sizeof(*msg));
 
-	if (sock->type == isc_sockettype_udp) {
+	if (!sock->connected) {
 		msg->msg_name = (void *)&dev->address.type.sa;
 		msg->msg_namelen = dev->address.length;
 	} else {
@@ -964,15 +1307,17 @@ dump_msg(struct msghdr *msg) {
 	unsigned int i;
 
 	printf("MSGHDR %p\n", msg);
-	printf("\tname %p, namelen %d\n", msg->msg_name, msg->msg_namelen);
-	printf("\tiov %p, iovlen %d\n", msg->msg_iov, msg->msg_iovlen);
+	printf("\tname %p, namelen %ld\n", msg->msg_name,
+	       (long) msg->msg_namelen);
+	printf("\tiov %p, iovlen %ld\n", msg->msg_iov,
+	       (long) msg->msg_iovlen);
 	for (i = 0; i < (unsigned int)msg->msg_iovlen; i++)
-		printf("\t\t%d\tbase %p, len %d\n", i,
+		printf("\t\t%d\tbase %p, len %ld\n", i,
 		       msg->msg_iov[i].iov_base,
-		       msg->msg_iov[i].iov_len);
+		       (long) msg->msg_iov[i].iov_len);
 #ifdef ISC_NET_BSD44MSGHDR
-	printf("\tcontrol %p, controllen %d\n", msg->msg_control,
-	       msg->msg_controllen);
+	printf("\tcontrol %p, controllen %ld\n", msg->msg_control,
+	       (long) msg->msg_controllen);
 #endif
 }
 #endif
@@ -1014,7 +1359,7 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 			isc__strerror(recv_errno, strbuf, sizeof(strbuf));
 			socket_log(sock, NULL, IOEVENT,
 				   isc_msgcat, ISC_MSGSET_SOCKET,
-				   ISC_MSG_DOIORECV, 
+				   ISC_MSG_DOIORECV,
 				  "doio_recv: recvmsg(%d) %d bytes, err %d/%s",
 				   sock->fd, cc, recv_errno, strbuf);
 		}
@@ -1040,6 +1385,14 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 		/* HPUX 11.11 can return EADDRNOTAVAIL. */
 		SOFT_OR_HARD(EADDRNOTAVAIL, ISC_R_ADDRNOTAVAIL);
 		ALWAYS_HARD(ENOBUFS, ISC_R_NORESOURCES);
+		/*
+		 * HPUX returns EPROTO and EINVAL on receiving some ICMP/ICMPv6
+		 * errors.
+		 */
+#ifdef EPROTO
+		SOFT_OR_HARD(EPROTO, ISC_R_HOSTUNREACH);
+#endif
+		SOFT_OR_HARD(EINVAL, ISC_R_HOSTUNREACH);
 
 #undef SOFT_OR_HARD
 #undef ALWAYS_HARD
@@ -1062,7 +1415,7 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 			if (isc_log_wouldlog(isc_lctx, IOEVENT_LEVEL)) {
 				socket_log(sock, &dev->address, IOEVENT,
 					   isc_msgcat, ISC_MSGSET_SOCKET,
-					   ISC_MSG_ZEROPORT, 
+					   ISC_MSG_ZEROPORT,
 					   "dropping source port zero packet");
 			}
 			return (DOIO_SOFT);
@@ -1245,7 +1598,54 @@ doio_send(isc_socket_t *sock, isc_socketevent_t *dev) {
  * references exist.
  */
 static void
+closesocket(isc_socketmgr_t *manager, isc_sockettype_t type, int fd) {
+	int lockid = FDLOCK_ID(fd);
+
+	UNUSED(type);
+
+	/*
+	 * No one has this socket open, so the watcher doesn't have to be
+	 * poked, and the socket doesn't have to be locked.
+	 */
+	LOCK(&manager->fdlock[lockid]);
+	manager->fds[fd] = NULL;
+	manager->fdstate[fd] = CLOSE_PENDING;
+	UNLOCK(&manager->fdlock[lockid]);
+	select_poke(manager, fd, SELECT_POKE_CLOSE);
+
+	/*
+	 * update manager->maxfd here (XXX: this should be implemented more
+	 * efficiently)
+	 */
+#ifdef USE_SELECT
+	LOCK(&manager->lock);
+	if (manager->maxfd == fd) {
+		int i;
+
+		manager->maxfd = 0;
+		for (i = fd - 1; i >= 0; i--) {
+			lockid = FDLOCK_ID(i);
+
+			LOCK(&manager->fdlock[lockid]);
+			if (manager->fdstate[i] == MANAGED) {
+				manager->maxfd = i;
+				UNLOCK(&manager->fdlock[lockid]);
+				break;
+			}
+			UNLOCK(&manager->fdlock[lockid]);
+		}
+#ifdef ISC_PLATFORM_USETHREADS
+		if (manager->maxfd < manager->pipe_fds[0])
+			manager->maxfd = manager->pipe_fds[0];
+#endif
+	}
+	UNLOCK(&manager->lock);
+#endif	/* USE_SELECT */
+}
+
+static void
 destroy(isc_socket_t **sockp) {
+	int fd;
 	isc_socket_t *sock = *sockp;
 	isc_socketmgr_t *manager = sock->manager;
 
@@ -1256,17 +1656,16 @@ destroy(isc_socket_t **sockp) {
 	INSIST(ISC_LIST_EMPTY(sock->recv_list));
 	INSIST(ISC_LIST_EMPTY(sock->send_list));
 	INSIST(sock->connect_ev == NULL);
-	REQUIRE(sock->fd >= 0 && sock->fd < (int)manager->fdsize);
+	REQUIRE(sock->fd == -1 || sock->fd < (int)manager->maxsocks);
+
+	if (sock->fd >= 0) {
+		fd = sock->fd;
+		sock->fd = -1;
+		closesocket(manager, sock->type, fd);
+	}
 
 	LOCK(&manager->lock);
 
-	/*
-	 * No one has this socket open, so the watcher doesn't have to be
-	 * poked, and the socket doesn't have to be locked.
-	 */
-	manager->fds[sock->fd] = NULL;
-	manager->fdstate[sock->fd] = CLOSE_PENDING;
-	select_poke(manager, sock->fd, SELECT_POKE_CLOSE);
 	ISC_LIST_UNLINK(manager->socklist, sock, link);
 
 #ifdef ISC_PLATFORM_USETHREADS
@@ -1274,10 +1673,6 @@ destroy(isc_socket_t **sockp) {
 		SIGNAL(&manager->shutdown_ok);
 #endif /* ISC_PLATFORM_USETHREADS */
 
-	/*
-	 * XXX should reset manager->maxfd here
-	 */
-
 	UNLOCK(&manager->lock);
 
 	free_socket(sockp);
@@ -1465,18 +1860,11 @@ clear_bsdcompat(void) {
 }
 #endif
 
-/*%
- * Create a new 'type' socket managed by 'manager'.  Events
- * will be posted to 'task' and when dispatched 'action' will be
- * called with 'arg' as the arg value.  The new socket is returned
- * in 'socketp'.
- */
-isc_result_t
-isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp)
-{
-	isc_socket_t *sock = NULL;
-	isc_result_t result;
+static isc_result_t
+opensocket(isc_socketmgr_t *manager, isc_socket_t *sock) {
+	char strbuf[ISC_STRERRORSIZE];
+	const char *err = "socket";
+	int tries = 0;
 #if defined(USE_CMSG) || defined(SO_BSDCOMPAT)
 	int on = 1;
 #endif
@@ -1484,38 +1872,27 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	ISC_SOCKADDR_LEN_T optlen;
 	int size;
 #endif
-	char strbuf[ISC_STRERRORSIZE];
-	const char *err = "socket";
-	int try = 0;
 
-	REQUIRE(VALID_MANAGER(manager));
-	REQUIRE(socketp != NULL && *socketp == NULL);
-
-	result = allocate_socket(manager, type, &sock);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	sock->pf = pf;
  again:
-	switch (type) {
+	switch (sock->type) {
 	case isc_sockettype_udp:
-		sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
+		sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
 		break;
 	case isc_sockettype_tcp:
-		sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
+		sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
 		break;
 	case isc_sockettype_unix:
-		sock->fd = socket(pf, SOCK_STREAM, 0);
+		sock->fd = socket(sock->pf, SOCK_STREAM, 0);
 		break;
 	}
-	if (sock->fd == -1 && errno == EINTR && try++ < 42)
+	if (sock->fd == -1 && errno == EINTR && tries++ < 42)
 		goto again;
 
 #ifdef F_DUPFD
 	/*
 	 * Leave a space for stdio and TCP to work in.
 	 */
-	if (manager->reserved != 0 && type == isc_sockettype_udp &&
+	if (manager->reserved != 0 && sock->type == isc_sockettype_udp &&
 	    sock->fd >= 0 && sock->fd < manager->reserved) {
 		int new, tmp;
 		new = fcntl(sock->fd, F_DUPFD, manager->reserved);
@@ -1535,20 +1912,18 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif
 
-	if (sock->fd >= (int)manager->fdsize) {
+	if (sock->fd >= (int)manager->maxsocks) {
 		(void)close(sock->fd);
 		isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
 			       ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
 			       isc_msgcat, ISC_MSGSET_SOCKET,
 			       ISC_MSG_TOOMANYFDS,
-			       "%s: too many open file descriptors", "socket");
-		free_socket(&sock);
+			       "socket: file descriptor exceeds limit (%d/%u)",
+			       sock->fd, manager->maxsocks);
 		return (ISC_R_NORESOURCES);
 	}
-	
-	if (sock->fd < 0) {
-		free_socket(&sock);
 
+	if (sock->fd < 0) {
 		switch (errno) {
 		case EMFILE:
 		case ENFILE:
@@ -1580,14 +1955,13 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 
 	if (make_nonblock(sock->fd) != ISC_R_SUCCESS) {
 		(void)close(sock->fd);
-		free_socket(&sock);
 		return (ISC_R_UNEXPECTED);
 	}
 
 #ifdef SO_BSDCOMPAT
 	RUNTIME_CHECK(isc_once_do(&bsdcompat_once,
 				  clear_bsdcompat) == ISC_R_SUCCESS);
-	if (type != isc_sockettype_unix && bsdcompat &&
+	if (sock->type != isc_sockettype_unix && bsdcompat &&
 	    setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT,
 		       (void *)&on, sizeof(on)) < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
@@ -1601,8 +1975,22 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif
 
+#ifdef SO_NOSIGPIPE
+	if (setsockopt(sock->fd, SOL_SOCKET, SO_NOSIGPIPE,
+		       (void *)&on, sizeof(on)) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "setsockopt(%d, SO_NOSIGPIPE) %s: %s",
+				 sock->fd,
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"),
+				 strbuf);
+		/* Press on... */
+	}
+#endif
+
 #if defined(USE_CMSG) || defined(SO_RCVBUF)
-	if (type == isc_sockettype_udp) {
+	if (sock->type == isc_sockettype_udp) {
 
 #if defined(USE_CMSG)
 #if defined(SO_TIMESTAMP)
@@ -1612,7 +2000,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 			isc__strerror(errno, strbuf, sizeof(strbuf));
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "setsockopt(%d, SO_TIMESTAMP) %s: %s",
-					 sock->fd, 
+					 sock->fd,
 					 isc_msgcat_get(isc_msgcat,
 							ISC_MSGSET_GENERAL,
 							ISC_MSG_FAILED,
@@ -1623,7 +2011,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #endif /* SO_TIMESTAMP */
 
 #if defined(ISC_PLATFORM_HAVEIPV6)
-		if (pf == AF_INET6 && sock->recvcmsgbuflen == 0U) {
+		if (sock->pf == AF_INET6 && sock->recvcmsgbuflen == 0U) {
 			/*
 			 * Warn explicitly because this anomaly can be hidden
 			 * in usual operation (and unexpectedly appear later).
@@ -1635,7 +2023,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #ifdef ISC_PLATFORM_HAVEIN6PKTINFO
 #ifdef IPV6_RECVPKTINFO
 		/* RFC 3542 */
-		if ((pf == AF_INET6)
+		if ((sock->pf == AF_INET6)
 		    && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
 				   (void *)&on, sizeof(on)) < 0)) {
 			isc__strerror(errno, strbuf, sizeof(strbuf));
@@ -1650,7 +2038,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		}
 #else
 		/* RFC 2292 */
-		if ((pf == AF_INET6)
+		if ((sock->pf == AF_INET6)
 		    && (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_PKTINFO,
 				   (void *)&on, sizeof(on)) < 0)) {
 			isc__strerror(errno, strbuf, sizeof(strbuf));
@@ -1667,7 +2055,7 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #endif /* ISC_PLATFORM_HAVEIN6PKTINFO */
 #ifdef IPV6_USE_MIN_MTU        /* RFC 3542, not too common yet*/
 		/* use minimum MTU */
-		if (pf == AF_INET6) {
+		if (sock->pf == AF_INET6) {
 			(void)setsockopt(sock->fd, IPPROTO_IPV6,
 					 IPV6_USE_MIN_MTU,
 					 (void *)&on, sizeof(on));
@@ -1676,6 +2064,27 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 #endif /* ISC_PLATFORM_HAVEIPV6 */
 #endif /* defined(USE_CMSG) */
 
+#if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
+		/*
+		 * Turn off Path MTU discovery on IPv4/UDP sockets.
+		 */
+		if (sock->pf == AF_INET) {
+			int action = IP_PMTUDISC_DONT;
+			(void)setsockopt(sock->fd, IPPROTO_IP, IP_MTU_DISCOVER,
+					 &action, sizeof(action));
+		}
+#endif
+#if defined(IP_DONTFRAG)
+		/*
+		 * Turn off Path MTU discovery on IPv4/UDP sockets.
+		 */
+		if (sock->pf == AF_INET) {
+			int off = 0;
+			(void)setsockopt(sock->fd, IPPROTO_IP, IP_DONTFRAG,
+					 &off, sizeof(off));
+		}
+#endif
+
 #if defined(SO_RCVBUF)
 		optlen = sizeof(size);
 		if (getsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF,
@@ -1699,22 +2108,61 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */
 
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Create a new 'type' socket managed by 'manager'.  Events
+ * will be posted to 'task' and when dispatched 'action' will be
+ * called with 'arg' as the arg value.  The new socket is returned
+ * in 'socketp'.
+ */
+isc_result_t
+isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+		  isc_socket_t **socketp)
+{
+	isc_socket_t *sock = NULL;
+	isc_result_t result;
+	int lockid;
+
+	REQUIRE(VALID_MANAGER(manager));
+	REQUIRE(socketp != NULL && *socketp == NULL);
+
+	result = allocate_socket(manager, type, &sock);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	sock->pf = pf;
+	result = opensocket(manager, sock);
+	if (result != ISC_R_SUCCESS) {
+		free_socket(&sock);
+		return (result);
+	}
+
 	sock->references = 1;
 	*socketp = sock;
 
-	LOCK(&manager->lock);
-
 	/*
 	 * Note we don't have to lock the socket like we normally would because
 	 * there are no external references to it yet.
 	 */
 
+	lockid = FDLOCK_ID(sock->fd);
+	LOCK(&manager->fdlock[lockid]);
 	manager->fds[sock->fd] = sock;
 	manager->fdstate[sock->fd] = MANAGED;
+#ifdef USE_DEVPOLL
+	INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 &&
+	       sock->manager->fdpollinfo[sock->fd].want_write == 0);
+#endif
+	UNLOCK(&manager->fdlock[lockid]);
+
+	LOCK(&manager->lock);
 	ISC_LIST_APPEND(manager->socklist, sock, link);
+#ifdef USE_SELECT
 	if (manager->maxfd < sock->fd)
 		manager->maxfd = sock->fd;
-
+#endif
 	UNLOCK(&manager->lock);
 
 	socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
@@ -1723,6 +2171,48 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_socket_open(isc_socket_t *sock) {
+	isc_result_t result;
+
+	REQUIRE(VALID_SOCKET(sock));
+
+	LOCK(&sock->lock);
+	REQUIRE(sock->references == 1);
+	UNLOCK(&sock->lock);
+	/*
+	 * We don't need to retain the lock hereafter, since no one else has
+	 * this socket.
+	 */
+	REQUIRE(sock->fd == -1);
+
+	result = opensocket(sock->manager, sock);
+	if (result != ISC_R_SUCCESS)
+		sock->fd = -1;
+
+	if (result == ISC_R_SUCCESS) {
+		int lockid = FDLOCK_ID(sock->fd);
+
+		LOCK(&sock->manager->fdlock[lockid]);
+		sock->manager->fds[sock->fd] = sock;
+		sock->manager->fdstate[sock->fd] = MANAGED;
+#ifdef USE_DEVPOLL
+		INSIST(sock->manager->fdpollinfo[sock->fd].want_read == 0 &&
+		       sock->manager->fdpollinfo[sock->fd].want_write == 0);
+#endif
+		UNLOCK(&sock->manager->fdlock[lockid]);
+
+#ifdef USE_SELECT
+		LOCK(&sock->manager->lock);
+		if (sock->manager->maxfd < sock->fd)
+			sock->manager->maxfd = sock->fd;
+		UNLOCK(&sock->manager->lock);
+#endif
+	}
+
+	return (result);
+}
+
 /*
  * Attach to a socket.  Caller must explicitly detach when it is done.
  */
@@ -1764,6 +2254,44 @@ isc_socket_detach(isc_socket_t **socketp) {
 	*socketp = NULL;
 }
 
+isc_result_t
+isc_socket_close(isc_socket_t *sock) {
+	int fd;
+
+	REQUIRE(VALID_SOCKET(sock));
+
+	LOCK(&sock->lock);
+	REQUIRE(sock->references == 1);
+	UNLOCK(&sock->lock);
+	/*
+	 * We don't need to retain the lock hereafter, since no one else has
+	 * this socket.
+	 */
+
+	REQUIRE(sock->fd >= 0 && sock->fd < (int)sock->manager->maxsocks);
+
+	INSIST(!sock->connecting);
+	INSIST(!sock->pending_recv);
+	INSIST(!sock->pending_send);
+	INSIST(!sock->pending_accept);
+	INSIST(ISC_LIST_EMPTY(sock->recv_list));
+	INSIST(ISC_LIST_EMPTY(sock->send_list));
+	INSIST(ISC_LIST_EMPTY(sock->accept_list));
+	INSIST(sock->connect_ev == NULL);
+
+	fd = sock->fd;
+	sock->fd = -1;
+	sock->listener = 0;
+	sock->connected = 0;
+	sock->connecting = 0;
+	sock->bound = 0;
+	isc_sockaddr_any(&sock->address);
+
+	closesocket(sock->manager, sock->type, fd);
+
+	return (ISC_R_SUCCESS);
+}
+
 /*
  * I/O is possible on a given socket.  Schedule an event to this task that
  * will call an internal function to do the I/O.  This will charge the
@@ -1993,7 +2521,7 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 	 */
 
 	addrlen = sizeof(dev->newsocket->address.type);
-	memset(&dev->newsocket->address.type.sa, 0, addrlen);
+	memset(&dev->newsocket->address.type, 0, addrlen);
 	fd = accept(sock->fd, &dev->newsocket->address.type.sa,
 		    (void *)&addrlen);
 
@@ -2070,19 +2598,20 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "internal_accept(): "
 					 "accept() returned peer address "
-					 "family %u (expected %u)", 
+					 "family %u (expected %u)",
 					 dev->newsocket->address.
 					 type.sa.sa_family,
 					 sock->pf);
 			(void)close(fd);
 			goto soft_error;
-		} else if (fd >= (int)manager->fdsize) {
+		} else if (fd >= (int)manager->maxsocks) {
 			isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
 				       ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
 				       isc_msgcat, ISC_MSGSET_SOCKET,
 				       ISC_MSG_TOOMANYFDS,
-				       "%s: too many open file descriptors",
-				       "accept");
+				       "accept: "
+				       "file descriptor exceeds limit (%d/%u)",
+				       fd, manager->maxsocks);
 			(void)close(fd);
 			goto soft_error;
 		}
@@ -2116,6 +2645,13 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 	 * -1 means the new socket didn't happen.
 	 */
 	if (fd != -1) {
+		int lockid = FDLOCK_ID(fd);
+
+		LOCK(&manager->fdlock[lockid]);
+		manager->fds[fd] = dev->newsocket;
+		manager->fdstate[fd] = MANAGED;
+		UNLOCK(&manager->fdlock[lockid]);
+
 		LOCK(&manager->lock);
 		ISC_LIST_APPEND(manager->socklist, dev->newsocket, link);
 
@@ -2128,10 +2664,10 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 		 */
 		dev->address = dev->newsocket->address;
 
-		manager->fds[fd] = dev->newsocket;
-		manager->fdstate[fd] = MANAGED;
+#ifdef USE_SELECT
 		if (manager->maxfd < fd)
 			manager->maxfd = fd;
+#endif
 
 		socket_log(sock, &dev->newsocket->address, CREATION,
 			   isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_ACCEPTEDCXN,
@@ -2143,7 +2679,7 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 		dev->newsocket->references--;
 		free_socket(&dev->newsocket);
 	}
-	
+
 	/*
 	 * Fill in the done event details and send it off.
 	 */
@@ -2280,77 +2816,256 @@ internal_send(isc_task_t *me, isc_event_t *ev) {
 	UNLOCK(&sock->lock);
 }
 
+/*
+ * Process read/writes on each fd here.  Avoid locking
+ * and unlocking twice if both reads and writes are possible.
+ */
 static void
-process_fds(isc_socketmgr_t *manager, int maxfd,
-	    fd_set *readfds, fd_set *writefds)
+process_fd(isc_socketmgr_t *manager, int fd, isc_boolean_t readable,
+	   isc_boolean_t writeable)
 {
-	int i;
 	isc_socket_t *sock;
 	isc_boolean_t unlock_sock;
-
-	REQUIRE(maxfd <= (int)manager->fdsize);
+	int lockid = FDLOCK_ID(fd);
 
 	/*
-	 * Process read/writes on other fds here.  Avoid locking
-	 * and unlocking twice if both reads and writes are possible.
+	 * If the socket is going to be closed, don't do more I/O.
 	 */
-	for (i = 0; i < maxfd; i++) {
+	LOCK(&manager->fdlock[lockid]);
+	if (manager->fdstate[fd] == CLOSE_PENDING) {
+		UNLOCK(&manager->fdlock[lockid]);
+
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+		return;
+	}
+
+	sock = manager->fds[fd];
+	UNLOCK(&manager->fdlock[lockid]);
+	unlock_sock = ISC_FALSE;
+	if (readable) {
+		if (sock == NULL) {
+			(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+			goto check_write;
+		}
+		unlock_sock = ISC_TRUE;
+		LOCK(&sock->lock);
+		if (!SOCK_DEAD(sock)) {
+			if (sock->listener)
+				dispatch_accept(sock);
+			else
+				dispatch_recv(sock);
+		}
+		(void)unwatch_fd(manager, fd, SELECT_POKE_READ);
+	}
+check_write:
+	if (writeable) {
+		if (sock == NULL) {
+			(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+			return;
+		}
+		if (!unlock_sock) {
+			unlock_sock = ISC_TRUE;
+			LOCK(&sock->lock);
+		}
+		if (!SOCK_DEAD(sock)) {
+			if (sock->connecting)
+				dispatch_connect(sock);
+			else
+				dispatch_send(sock);
+		}
+		(void)unwatch_fd(manager, fd, SELECT_POKE_WRITE);
+	}
+	if (unlock_sock)
+		UNLOCK(&sock->lock);
+}
+
+#ifdef USE_KQUEUE
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct kevent *events, int nevents) {
+	int i;
+	isc_boolean_t readable, writable;
+	isc_boolean_t done = ISC_FALSE;
 #ifdef ISC_PLATFORM_USETHREADS
-		if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1])
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		/*
+		 * This is not an error, but something unexpected.  If this
+		 * happens, it may indicate the need for increasing
+		 * ISC_SOCKET_MAXEVENTS.
+		 */
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
+
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].ident < manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].ident == (uintptr_t)manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
 			continue;
-#endif /* ISC_PLATFORM_USETHREADS */
+		}
+#endif
+		readable = ISC_TF(events[i].filter == EVFILT_READ);
+		writable = ISC_TF(events[i].filter == EVFILT_WRITE);
+		process_fd(manager, events[i].ident, readable, writable);
+	}
 
-		if (manager->fdstate[i] == CLOSE_PENDING) {
-			manager->fdstate[i] = CLOSED;
-			FD_CLR(i, manager->read_fds);
-			FD_CLR(i, manager->write_fds);
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
 
-			(void)close(i);
+	return (done);
+}
+#elif defined(USE_EPOLL)
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct epoll_event *events, int nevents) {
+	int i;
+	isc_boolean_t done = ISC_FALSE;
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
 
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].data.fd < (int)manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].data.fd == manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
 			continue;
 		}
-
-		sock = manager->fds[i];
-		unlock_sock = ISC_FALSE;
-		if (FD_ISSET(i, readfds)) {
-			if (sock == NULL) {
-				FD_CLR(i, manager->read_fds);
-				goto check_write;
-			}
-			unlock_sock = ISC_TRUE;
-			LOCK(&sock->lock);
-			if (!SOCK_DEAD(sock)) {
-				if (sock->listener)
-					dispatch_accept(sock);
-				else
-					dispatch_recv(sock);
-			}
-			FD_CLR(i, manager->read_fds);
+#endif
+		if ((events[i].events & EPOLLERR) != 0 ||
+		    (events[i].events & EPOLLHUP) != 0) {
+			/*
+			 * epoll does not set IN/OUT bits on an erroneous
+			 * condition, so we need to try both anyway.  This is a
+			 * bit inefficient, but should be okay for such rare
+			 * events.  Note also that the read or write attempt
+			 * won't block because we use non-blocking sockets.
+			 */
+			events[i].events |= (EPOLLIN | EPOLLOUT);
 		}
-	check_write:
-		if (FD_ISSET(i, writefds)) {
-			if (sock == NULL) {
-				FD_CLR(i, manager->write_fds);
-				continue;
-			}
-			if (!unlock_sock) {
-				unlock_sock = ISC_TRUE;
-				LOCK(&sock->lock);
-			}
-			if (!SOCK_DEAD(sock)) {
-				if (sock->connecting)
-					dispatch_connect(sock);
-				else
-					dispatch_send(sock);
-			}
-			FD_CLR(i, manager->write_fds);
+		process_fd(manager, events[i].data.fd,
+			   (events[i].events & EPOLLIN) != 0,
+			   (events[i].events & EPOLLOUT) != 0);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
+
+	return (done);
+}
+#elif defined(USE_DEVPOLL)
+static isc_boolean_t
+process_fds(isc_socketmgr_t *manager, struct pollfd *events, int nevents) {
+	int i;
+	isc_boolean_t done = ISC_FALSE;
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_boolean_t have_ctlevent = ISC_FALSE;
+#endif
+
+	if (nevents == manager->nevents) {
+		manager_log(manager, ISC_LOGCATEGORY_GENERAL,
+			    ISC_LOGMODULE_SOCKET, ISC_LOG_INFO,
+			    "maximum number of FD events (%d) received",
+			    nevents);
+	}
+
+	for (i = 0; i < nevents; i++) {
+		REQUIRE(events[i].fd < (int)manager->maxsocks);
+#ifdef ISC_PLATFORM_USETHREADS
+		if (events[i].fd == manager->pipe_fds[0]) {
+			have_ctlevent = ISC_TRUE;
+			continue;
 		}
-		if (unlock_sock)
-			UNLOCK(&sock->lock);
+#endif
+		process_fd(manager, events[i].fd,
+			   (events[i].events & POLLIN) != 0,
+			   (events[i].events & POLLOUT) != 0);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	if (have_ctlevent)
+		done = process_ctlfd(manager);
+#endif
+
+	return (done);
+}
+#elif defined(USE_SELECT)
+static void
+process_fds(isc_socketmgr_t *manager, int maxfd,
+	    fd_set *readfds, fd_set *writefds)
+{
+	int i;
+
+	REQUIRE(maxfd <= (int)manager->maxsocks);
+
+	for (i = 0; i < maxfd; i++) {
+#ifdef ISC_PLATFORM_USETHREADS
+		if (i == manager->pipe_fds[0] || i == manager->pipe_fds[1])
+			continue;
+#endif /* ISC_PLATFORM_USETHREADS */
+		process_fd(manager, i, FD_ISSET(i, readfds),
+			   FD_ISSET(i, writefds));
 	}
 }
+#endif
 
 #ifdef ISC_PLATFORM_USETHREADS
+static isc_boolean_t
+process_ctlfd(isc_socketmgr_t *manager) {
+	int msg, fd;
+
+	for (;;) {
+		select_readmsg(manager, &fd, &msg);
+
+		manager_log(manager, IOEVENT,
+			    isc_msgcat_get(isc_msgcat, ISC_MSGSET_SOCKET,
+					   ISC_MSG_WATCHERMSG,
+					   "watcher got message %d "
+					   "for socket %d"), msg, fd);
+
+		/*
+		 * Nothing to read?
+		 */
+		if (msg == SELECT_POKE_NOTHING)
+			break;
+
+		/*
+		 * Handle shutdown message.  We really should
+		 * jump out of this loop right away, but
+		 * it doesn't matter if we have to do a little
+		 * more work first.
+		 */
+		if (msg == SELECT_POKE_SHUTDOWN)
+			return (ISC_TRUE);
+
+		/*
+		 * This is a wakeup on a socket.  Look
+		 * at the event queue for both read and write,
+		 * and decide if we need to watch on it now
+		 * or not.
+		 */
+		wakeup_socket(manager, fd, msg);
+	}
+
+	return (ISC_FALSE);
+}
+
 /*
  * This is the thread that will loop forever, always in a select or poll
  * call.
@@ -2364,98 +3079,116 @@ watcher(void *uap) {
 	isc_boolean_t done;
 	int ctlfd;
 	int cc;
-	int msg, fd;
+#ifdef USE_KQUEUE
+	const char *fnname = "kevent()";
+#elif defined (USE_EPOLL)
+	const char *fnname = "epoll_wait()";
+#elif defined(USE_DEVPOLL)
+	const char *fnname = "ioctl(DP_POLL)";
+	struct dvpoll dvp;
+#elif defined (USE_SELECT)
+	const char *fnname = "select()";
 	int maxfd;
+#endif
 	char strbuf[ISC_STRERRORSIZE];
+#ifdef ISC_SOCKET_USE_POLLWATCH
+	pollstate_t pollstate = poll_idle;
+#endif
 
 	/*
 	 * Get the control fd here.  This will never change.
 	 */
-	LOCK(&manager->lock);
 	ctlfd = manager->pipe_fds[0];
-
 	done = ISC_FALSE;
 	while (!done) {
 		do {
+#ifdef USE_KQUEUE
+			cc = kevent(manager->kqueue_fd, NULL, 0,
+				    manager->events, manager->nevents, NULL);
+#elif defined(USE_EPOLL)
+			cc = epoll_wait(manager->epoll_fd, manager->events,
+					manager->nevents, -1);
+#elif defined(USE_DEVPOLL)
+			dvp.dp_fds = manager->events;
+			dvp.dp_nfds = manager->nevents;
+#ifndef ISC_SOCKET_USE_POLLWATCH
+			dvp.dp_timeout = -1;
+#else
+			if (pollstate == poll_idle)
+				dvp.dp_timeout = -1;
+			else
+				dvp.dp_timeout = ISC_SOCKET_POLLWATCH_TIMEOUT;
+#endif	/* ISC_SOCKET_USE_POLLWATCH */
+			cc = ioctl(manager->devpoll_fd, DP_POLL, &dvp);
+#elif defined(USE_SELECT)
+			LOCK(&manager->lock);
 			memcpy(manager->read_fds_copy, manager->read_fds,
 			       manager->fd_bufsize);
 			memcpy(manager->write_fds_copy, manager->write_fds,
 			       manager->fd_bufsize);
 			maxfd = manager->maxfd + 1;
-
 			UNLOCK(&manager->lock);
 
 			cc = select(maxfd, manager->read_fds_copy,
 				    manager->write_fds_copy, NULL, NULL);
-			if (cc < 0) {
-				if (!SOFT_ERROR(errno)) {
-					isc__strerror(errno, strbuf,
-						      sizeof(strbuf));
-					FATAL_ERROR(__FILE__, __LINE__,
-						    "select() %s: %s",
-						    isc_msgcat_get(isc_msgcat,
-							    ISC_MSGSET_GENERAL,
-							    ISC_MSG_FAILED,
-							    "failed"),
-						    strbuf);
-				}
+#endif	/* USE_KQUEUE */
+
+			if (cc < 0 && !SOFT_ERROR(errno)) {
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				FATAL_ERROR(__FILE__, __LINE__,
+					    "%s %s: %s", fnname,
+					    isc_msgcat_get(isc_msgcat,
+							   ISC_MSGSET_GENERAL,
+							   ISC_MSG_FAILED,
+							   "failed"), strbuf);
 			}
 
-			LOCK(&manager->lock);
+#if defined(USE_DEVPOLL) && defined(ISC_SOCKET_USE_POLLWATCH)
+			if (cc == 0) {
+				if (pollstate == poll_active)
+					pollstate = poll_checking;
+				else if (pollstate == poll_checking)
+					pollstate = poll_idle;
+			} else if (cc > 0) {
+				if (pollstate == poll_checking) {
+					/*
+					 * XXX: We'd like to use a more
+					 * verbose log level as it's actually an
+					 * unexpected event, but the kernel bug
+					 * reportedly happens pretty frequently
+					 * (and it can also be a false positive)
+					 * so it would be just too noisy.
+					 */
+					manager_log(manager,
+						    ISC_LOGCATEGORY_GENERAL,
+						    ISC_LOGMODULE_SOCKET,
+						    ISC_LOG_DEBUG(1),
+						    ISC_LOG_INFO,
+						    "unexpected POLL timeout");
+				}
+				pollstate = poll_active;
+			}
+#endif
 		} while (cc < 0);
 
+#if defined(USE_KQUEUE) || defined (USE_EPOLL) || defined (USE_DEVPOLL)
+		done = process_fds(manager, manager->events, cc);
+#elif defined(USE_SELECT)
+		process_fds(manager, maxfd, manager->read_fds_copy,
+			    manager->write_fds_copy);
 
 		/*
 		 * Process reads on internal, control fd.
 		 */
-		if (FD_ISSET(ctlfd, manager->read_fds_copy)) {
-			for (;;) {
-				select_readmsg(manager, &fd, &msg);
-
-				manager_log(manager, IOEVENT,
-					    isc_msgcat_get(isc_msgcat,
-						     ISC_MSGSET_SOCKET,
-						     ISC_MSG_WATCHERMSG,
-						     "watcher got message %d"),
-						     msg);
-
-				/*
-				 * Nothing to read?
-				 */
-				if (msg == SELECT_POKE_NOTHING)
-					break;
-
-				/*
-				 * Handle shutdown message.  We really should
-				 * jump out of this loop right away, but
-				 * it doesn't matter if we have to do a little
-				 * more work first.
-				 */
-				if (msg == SELECT_POKE_SHUTDOWN) {
-					done = ISC_TRUE;
-
-					break;
-				}
-
-				/*
-				 * This is a wakeup on a socket.  Look
-				 * at the event queue for both read and write,
-				 * and decide if we need to watch on it now
-				 * or not.
-				 */
-				wakeup_socket(manager, fd, msg);
-			}
-		}
-
-		process_fds(manager, maxfd, manager->read_fds_copy,
-			    manager->write_fds_copy);
+		if (FD_ISSET(ctlfd, manager->read_fds_copy))
+			done = process_ctlfd(manager);
+#endif
 	}
 
 	manager_log(manager, TRACE,
 		    isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 				   ISC_MSG_EXITING, "watcher exiting"));
 
-	UNLOCK(&manager->lock);
 	return ((isc_threadresult_t)0);
 }
 #endif /* ISC_PLATFORM_USETHREADS */
@@ -2469,69 +3202,187 @@ isc__socketmgr_setreserved(isc_socketmgr_t *manager, isc_uint32_t reserved) {
 }
 
 /*
- * Initialize fdsets in socketmgr structure.
+ * Create a new socket manager.
  */
+
 static isc_result_t
-create_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
-#if ISC_SOCKET_FDSETSIZE > FD_SETSIZE
-	manager->fdsize = ISC_SOCKET_FDSETSIZE;
-	manager->fd_bufsize = howmany(ISC_SOCKET_FDSETSIZE, NFDBITS) *
+setup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) {
+	isc_result_t result;
+
+#ifdef USE_KQUEUE
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct kevent) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	manager->kqueue_fd = kqueue();
+	if (manager->kqueue_fd == -1) {
+		result = isc__errno2result(errno);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct kevent) * manager->nevents);
+		return (result);
+	}
+
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->kqueue_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct kevent) * manager->nevents);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_EPOLL)
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct epoll_event) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	manager->epoll_fd = epoll_create(manager->nevents);
+	if (manager->epoll_fd == -1) {
+		result = isc__errno2result(errno);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct epoll_event) * manager->nevents);
+		return (result);
+	}
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->epoll_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct epoll_event) * manager->nevents);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_DEVPOLL)
+	/*
+	 * XXXJT: /dev/poll seems to reject large numbers of events,
+	 * so we should be careful about redefining ISC_SOCKET_MAXEVENTS.
+	 */
+	manager->nevents = ISC_SOCKET_MAXEVENTS;
+	manager->events = isc_mem_get(mctx, sizeof(struct pollfd) *
+				      manager->nevents);
+	if (manager->events == NULL)
+		return (ISC_R_NOMEMORY);
+	/*
+	 * Note: fdpollinfo should be able to support all possible FDs, so
+	 * it must have maxsocks entries (not nevents).
+	 */
+	manager->fdpollinfo = isc_mem_get(mctx, sizeof(pollinfo_t) *
+					  manager->maxsocks);
+	if (manager->fdpollinfo == NULL) {
+		isc_mem_put(mctx, manager->events,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (ISC_R_NOMEMORY);
+	}
+	memset(manager->fdpollinfo, 0, sizeof(pollinfo_t) * manager->maxsocks);
+	manager->devpoll_fd = open("/dev/poll", O_RDWR);
+	if (manager->devpoll_fd == -1) {
+		result = isc__errno2result(errno);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct pollfd) * manager->nevents);
+		isc_mem_put(mctx, manager->fdpollinfo,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (result);
+	}
+#ifdef ISC_PLATFORM_USETHREADS
+	result = watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		close(manager->devpoll_fd);
+		isc_mem_put(mctx, manager->events,
+			    sizeof(struct pollfd) * manager->nevents);
+		isc_mem_put(mctx, manager->fdpollinfo,
+			    sizeof(pollinfo_t) * manager->maxsocks);
+		return (result);
+	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+#elif defined(USE_SELECT)
+	UNUSED(result);
+
+#if ISC_SOCKET_MAXSOCKETS > FD_SETSIZE
+	/*
+	 * Note: this code should also cover the case of MAXSOCKETS <=
+	 * FD_SETSIZE, but we separate the cases to avoid possible portability
+	 * issues regarding howmany() and the actual representation of fd_set.
+	 */
+	manager->fd_bufsize = howmany(manager->maxsocks, NFDBITS) *
 		sizeof(fd_mask);
 #else
-	manager->fdsize = FD_SETSIZE;
 	manager->fd_bufsize = sizeof(fd_set);
 #endif
 
-	manager->fds = NULL;
-	manager->fdstate = NULL;
 	manager->read_fds = NULL;
 	manager->read_fds_copy = NULL;
 	manager->write_fds = NULL;
 	manager->write_fds_copy = NULL;
 
-	manager->fds = isc_mem_get(mctx,
-				   manager->fdsize * sizeof(manager->fds[0]));
-	if (manager->fds == NULL)
-		goto fail;
-
-	manager->fdstate = isc_mem_get(mctx, manager->fdsize *
-				       sizeof(manager->fdstate[0]));
-	if (manager->fdstate == NULL)
-		goto fail;
-
 	manager->read_fds = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->read_fds == NULL)
-		goto fail;
-	manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->read_fds_copy == NULL)
-		goto fail;
-	manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->write_fds == NULL)
-		goto fail;
-	manager->write_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
-	if (manager->write_fds_copy == NULL)
-		goto fail;
+	if (manager->read_fds != NULL)
+		manager->read_fds_copy = isc_mem_get(mctx, manager->fd_bufsize);
+	if (manager->read_fds_copy != NULL)
+		manager->write_fds = isc_mem_get(mctx, manager->fd_bufsize);
+	if (manager->write_fds != NULL) {
+		manager->write_fds_copy = isc_mem_get(mctx,
+						      manager->fd_bufsize);
+	}
+	if (manager->write_fds_copy == NULL) {
+		if (manager->write_fds != NULL) {
+			isc_mem_put(mctx, manager->write_fds,
+				    manager->fd_bufsize);
+		}
+		if (manager->read_fds_copy != NULL) {
+			isc_mem_put(mctx, manager->read_fds_copy,
+				    manager->fd_bufsize);
+		}
+		if (manager->read_fds != NULL) {
+			isc_mem_put(mctx, manager->read_fds,
+				    manager->fd_bufsize);
+		}
+		return (ISC_R_NOMEMORY);
+	}
+	memset(manager->read_fds, 0, manager->fd_bufsize);
+	memset(manager->write_fds, 0, manager->fd_bufsize);
 
-	return (ISC_R_SUCCESS);
+#ifdef ISC_PLATFORM_USETHREADS
+	(void)watch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	manager->maxfd = manager->pipe_fds[0];
+#else /* ISC_PLATFORM_USETHREADS */
+	manager->maxfd = 0;
+#endif /* ISC_PLATFORM_USETHREADS */
+#endif	/* USE_KQUEUE */
 
-  fail:
-	cleanup_fdsets(manager, mctx);
-	return (ISC_R_NOMEMORY);
+	return (ISC_R_SUCCESS);
 }
 
-/*
- * Clean up fdsets in socketmgr structure.
- */
 static void
-cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
-	if (manager->fds != NULL) {
-		isc_mem_put(mctx, manager->fds,
-			    manager->fdsize * sizeof(manager->fds[0]));
-	}
-	if (manager->fdstate != NULL) {
-		isc_mem_put(mctx, manager->fdstate,
-			    manager->fdsize * sizeof(manager->fdstate[0]));
+cleanup_watcher(isc_mem_t *mctx, isc_socketmgr_t *manager) {
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_result_t result;
+
+	result = unwatch_fd(manager, manager->pipe_fds[0], SELECT_POKE_READ);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "epoll_ctl(DEL) %s",
+				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+						ISC_MSG_FAILED, "failed"));
 	}
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+#ifdef USE_KQUEUE
+	close(manager->kqueue_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct kevent) * manager->nevents);
+#elif defined(USE_EPOLL)
+	close(manager->epoll_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct epoll_event) * manager->nevents);
+#elif defined(USE_DEVPOLL)
+	close(manager->devpoll_fd);
+	isc_mem_put(mctx, manager->events,
+		    sizeof(struct pollfd) * manager->nevents);
+	isc_mem_put(mctx, manager->fdpollinfo,
+		    sizeof(pollinfo_t) * manager->maxsocks);
+#elif defined(USE_SELECT)
 	if (manager->read_fds != NULL)
 		isc_mem_put(mctx, manager->read_fds, manager->fd_bufsize);
 	if (manager->read_fds_copy != NULL)
@@ -2540,13 +3391,19 @@ cleanup_fdsets(isc_socketmgr_t *manager, isc_mem_t *mctx) {
 		isc_mem_put(mctx, manager->write_fds, manager->fd_bufsize);
 	if (manager->write_fds_copy != NULL)
 		isc_mem_put(mctx, manager->write_fds_copy, manager->fd_bufsize);
+#endif	/* USE_KQUEUE */
 }
 
-/*
- * Create a new socket manager.
- */
 isc_result_t
 isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
+	return (isc_socketmgr_create2(mctx, managerp, 0));
+}
+
+isc_result_t
+isc_socketmgr_create2(isc_mem_t *mctx, isc_socketmgr_t **managerp,
+		      unsigned int maxsocks)
+{
+	int i;
 	isc_socketmgr_t *manager;
 #ifdef ISC_PLATFORM_USETHREADS
 	char strbuf[ISC_STRERRORSIZE];
@@ -2557,43 +3414,71 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 
 #ifndef ISC_PLATFORM_USETHREADS
 	if (socketmgr != NULL) {
+		/* Don't allow maxsocks to be updated */
+		if (maxsocks > 0 && socketmgr->maxsocks != maxsocks)
+			return (ISC_R_EXISTS);
+
 		socketmgr->refs++;
 		*managerp = socketmgr;
 		return (ISC_R_SUCCESS);
 	}
 #endif /* ISC_PLATFORM_USETHREADS */
 
+	if (maxsocks == 0)
+		maxsocks = ISC_SOCKET_MAXSOCKETS;
+
 	manager = isc_mem_get(mctx, sizeof(*manager));
 	if (manager == NULL)
 		return (ISC_R_NOMEMORY);
 
-	result = create_fdsets(manager, mctx);
-	if (result != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		return (result);
+	/* zero-clear so that necessary cleanup on failure will be easy */
+	memset(manager, 0, sizeof(*manager));
+	manager->maxsocks = maxsocks;
+	manager->reserved = 0;
+	manager->fds = isc_mem_get(mctx,
+				   manager->maxsocks * sizeof(isc_socket_t *));
+	if (manager->fds == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto free_manager;
+	}
+	manager->fdstate = isc_mem_get(mctx, manager->maxsocks * sizeof(int));
+	if (manager->fds == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto free_manager;
 	}
 
 	manager->magic = SOCKET_MANAGER_MAGIC;
 	manager->mctx = NULL;
-	memset(manager->fds, 0, sizeof(manager->fds[0]) * manager->fdsize);
+	memset(manager->fds, 0, manager->maxsocks * sizeof(isc_socket_t *));
 	ISC_LIST_INIT(manager->socklist);
 	result = isc_mutex_init(&manager->lock);
-	if (result != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		isc_mem_put(mctx, manager, sizeof(*manager));
-		return (result);
+	if (result != ISC_R_SUCCESS)
+		goto free_manager;
+	manager->fdlock = isc_mem_get(mctx, FDLOCK_COUNT * sizeof(isc_mutex_t));
+	if (manager->fdlock == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup_lock;
 	}
+	for (i = 0; i < FDLOCK_COUNT; i++) {
+		result = isc_mutex_init(&manager->fdlock[i]);
+		if (result != ISC_R_SUCCESS) {
+			while (--i >= 0)
+				DESTROYLOCK(&manager->fdlock[i]);
+			isc_mem_put(mctx, manager->fdlock,
+				    FDLOCK_COUNT * sizeof(isc_mutex_t));
+			manager->fdlock = NULL;
+			goto cleanup_lock;
+		}
+	}
+
 #ifdef ISC_PLATFORM_USETHREADS
 	if (isc_condition_init(&manager->shutdown_ok) != ISC_R_SUCCESS) {
-		cleanup_fdsets(manager, mctx);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_condition_init() %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup_lock;
 	}
 
 	/*
@@ -2601,17 +3486,14 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	 * select/poll loop when something internal needs to be done.
 	 */
 	if (pipe(manager->pipe_fds) != 0) {
-		cleanup_fdsets(manager, mctx);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "pipe() %s: %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"),
 				 strbuf);
-
-		return (ISC_R_UNEXPECTED);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup_condition;
 	}
 
 	RUNTIME_CHECK(make_nonblock(manager->pipe_fds[0]) == ISC_R_SUCCESS);
@@ -2625,33 +3507,23 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	/*
 	 * Set up initial state for the select loop
 	 */
-	memset(manager->read_fds, 0, manager->fd_bufsize);
-	memset(manager->write_fds, 0, manager->fd_bufsize);
-#ifdef ISC_PLATFORM_USETHREADS
-	FD_SET(manager->pipe_fds[0], manager->read_fds);
-	manager->maxfd = manager->pipe_fds[0];
-#else /* ISC_PLATFORM_USETHREADS */
-	manager->maxfd = 0;
-#endif /* ISC_PLATFORM_USETHREADS */
-	manager->reserved = 0;
-	memset(manager->fdstate, 0,
-	       manager->fdsize * sizeof(manager->fdstate[0]));
-
+	result = setup_watcher(mctx, manager);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+	memset(manager->fdstate, 0, manager->maxsocks * sizeof(int));
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Start up the select/poll thread.
 	 */
 	if (isc_thread_create(watcher, manager, &manager->watcher) !=
 	    ISC_R_SUCCESS) {
-		(void)close(manager->pipe_fds[0]);
-		(void)close(manager->pipe_fds[1]);
-		DESTROYLOCK(&manager->lock);
-		isc_mem_put(mctx, manager, sizeof(*manager));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_thread_create() %s",
 				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
 						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		cleanup_watcher(mctx, manager);
+		result = ISC_R_UNEXPECTED;
+		goto cleanup;
 	}
 #endif /* ISC_PLATFORM_USETHREADS */
 	isc_mem_attach(mctx, &manager->mctx);
@@ -2662,6 +3534,52 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	*managerp = manager;
 
 	return (ISC_R_SUCCESS);
+
+cleanup:
+#ifdef ISC_PLATFORM_USETHREADS
+	(void)close(manager->pipe_fds[0]);
+	(void)close(manager->pipe_fds[1]);
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+#ifdef ISC_PLATFORM_USETHREADS
+cleanup_condition:
+	(void)isc_condition_destroy(&manager->shutdown_ok);
+#endif	/* ISC_PLATFORM_USETHREADS */
+
+
+cleanup_lock:
+	if (manager->fdlock != NULL) {
+		for (i = 0; i < FDLOCK_COUNT; i++)
+			DESTROYLOCK(&manager->fdlock[i]);
+	}
+	DESTROYLOCK(&manager->lock);
+
+free_manager:
+	if (manager->fdlock != NULL) {
+		isc_mem_put(mctx, manager->fdlock,
+			    FDLOCK_COUNT * sizeof(isc_mutex_t));
+	}
+	if (manager->fdstate != NULL) {
+		isc_mem_put(mctx, manager->fdstate,
+			    manager->maxsocks * sizeof(int));
+	}
+	if (manager->fds != NULL) {
+		isc_mem_put(mctx, manager->fds,
+			    manager->maxsocks * sizeof(isc_socket_t *));
+	}
+	isc_mem_put(mctx, manager, sizeof(*manager));
+
+	return (result);
+}
+
+isc_result_t
+isc_socketmgr_getmaxsockets(isc_socketmgr_t *manager, unsigned int *nsockp) {
+	REQUIRE(VALID_MANAGER(manager));
+	REQUIRE(nsockp != NULL);
+
+	*nsockp = manager->maxsocks;
+
+	return (ISC_R_SUCCESS);
 }
 
 void
@@ -2735,18 +3653,30 @@ isc_socketmgr_destroy(isc_socketmgr_t **managerp) {
 	/*
 	 * Clean up.
 	 */
+	cleanup_watcher(manager->mctx, manager);
+
 #ifdef ISC_PLATFORM_USETHREADS
 	(void)close(manager->pipe_fds[0]);
 	(void)close(manager->pipe_fds[1]);
 	(void)isc_condition_destroy(&manager->shutdown_ok);
 #endif /* ISC_PLATFORM_USETHREADS */
 
-	for (i = 0; i < (int)manager->fdsize; i++)
-		if (manager->fdstate[i] == CLOSE_PENDING)
+	for (i = 0; i < (int)manager->maxsocks; i++)
+		if (manager->fdstate[i] == CLOSE_PENDING) /* no need to lock */
 			(void)close(i);
 
+	isc_mem_put(manager->mctx, manager->fds,
+		    manager->maxsocks * sizeof(isc_socket_t *));
+	isc_mem_put(manager->mctx, manager->fdstate,
+		    manager->maxsocks * sizeof(int));
+
+	if (manager->fdlock != NULL) {
+		for (i = 0; i < FDLOCK_COUNT; i++)
+			DESTROYLOCK(&manager->fdlock[i]);
+		isc_mem_put(manager->mctx, manager->fdlock,
+			    FDLOCK_COUNT * sizeof(isc_mutex_t));
+	}
 	DESTROYLOCK(&manager->lock);
-	cleanup_fdsets(manager, manager->mctx);
 	manager->magic = 0;
 	mctx= manager->mctx;
 	isc_mem_put(mctx, manager, sizeof(*manager));
@@ -2799,7 +3729,7 @@ socket_recv(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
 		 * Enqueue the request.  If the socket was previously not being
 		 * watched, poke the watcher to start paying attention to it.
 		 */
-		if (ISC_LIST_EMPTY(sock->recv_list))
+		if (ISC_LIST_EMPTY(sock->recv_list) && !sock->pending_recv)
 			select_poke(sock->manager, sock->fd, SELECT_POKE_READ);
 		ISC_LIST_ENQUEUE(sock->recv_list, dev, ev_link);
 
@@ -2996,7 +3926,8 @@ socket_send(isc_socket_t *sock, isc_socketevent_t *dev, isc_task_t *task,
 			 * not being watched, poke the watcher to start
 			 * paying attention to it.
 			 */
-			if (ISC_LIST_EMPTY(sock->send_list))
+			if (ISC_LIST_EMPTY(sock->send_list) &&
+			    !sock->pending_send)
 				select_poke(sock->manager, sock->fd,
 					    SELECT_POKE_WRITE);
 			ISC_LIST_ENQUEUE(sock->send_list, dev, ev_link);
@@ -3286,7 +4217,7 @@ isc_socket_permunix(isc_sockaddr_t *sockaddr, isc_uint32_t perm,
 	} else
 		strcpy(path, ".");
 #endif
-	
+
 	if (chmod(path, perm) < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
@@ -3315,7 +4246,7 @@ isc_socket_permunix(isc_sockaddr_t *sockaddr, isc_uint32_t perm,
 }
 
 isc_result_t
-isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr, 
+isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr,
 		unsigned int options) {
 	char strbuf[ISC_STRERRORSIZE];
 	int on = 1;
@@ -3446,7 +4377,7 @@ isc_socket_listen(isc_socket_t *sock, unsigned int backlog) {
 }
 
 /*
- * This should try to do agressive accept() XXXMLG
+ * This should try to do aggressive accept() XXXMLG
  */
 isc_result_t
 isc_socket_accept(isc_socket_t *sock,
@@ -3557,6 +4488,16 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr,
 	sock->address = *addr;
 	cc = connect(sock->fd, &addr->type.sa, addr->length);
 	if (cc < 0) {
+		/*
+		 * HP-UX "fails" to connect a UDP socket and sets errno to
+		 * EINPROGRESS if it's non-blocking.  We'd rather regard this as
+		 * a success and let the user detect it if it's really an error
+		 * at the time of sending a packet on the socket.
+		 */
+		if (sock->type == isc_sockettype_udp && errno == EINPROGRESS) {
+			cc = 0;
+			goto success;
+		}
 		if (SOFT_ERROR(errno) || errno == EINPROGRESS)
 			goto queue;
 
@@ -3598,6 +4539,7 @@ isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addr,
 	/*
 	 * If connect completed, fire off the done event.
 	 */
+ success:
 	if (cc == 0) {
 		sock->connected = 1;
 		sock->bound = 1;
@@ -3957,37 +4899,107 @@ isc_socket_ipv6only(isc_socket_t *sock, isc_boolean_t yes) {
 
 #ifdef IPV6_V6ONLY
 	if (sock->pf == AF_INET6) {
-		(void)setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
-				 (void *)&onoff, sizeof(onoff));
+		if (setsockopt(sock->fd, IPPROTO_IPV6, IPV6_V6ONLY,
+			       (void *)&onoff, sizeof(int)) < 0) {
+			char strbuf[ISC_STRERRORSIZE];
+	
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "setsockopt(%d, IPV6_V6ONLY) "
+					 "%s: %s", sock->fd,
+					 isc_msgcat_get(isc_msgcat,
+							ISC_MSGSET_GENERAL,
+							ISC_MSG_FAILED,
+							"failed"),
+					 strbuf);
+		}
 	}
+	FIX_IPV6_RECVPKTINFO(sock);	/* AIX */
 #endif
 }
 
 #ifndef ISC_PLATFORM_USETHREADS
-void
-isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd) {
+/* In our assumed scenario, we can simply use a single static object. */
+static isc_socketwait_t swait_private;
+
+int
+isc__socketmgr_waitevents(struct timeval *tvp, isc_socketwait_t **swaitp) {
+	int n;
+#ifdef USE_KQUEUE
+	struct timespec ts, *tsp;
+#endif
+#ifdef USE_EPOLL
+	int timeout;
+#endif
+#ifdef USE_DEVPOLL
+	struct dvpoll dvp;
+#endif
+
+	REQUIRE(swaitp != NULL && *swaitp == NULL);
+
 	if (socketmgr == NULL)
-		*maxfd = 0;
-	else {
-		/* Prepare duplicates of fd_sets, as select() will modify */
-		memcpy(socketmgr->read_fds_copy, socketmgr->read_fds,
-		       socketmgr->fd_bufsize);
-		memcpy(socketmgr->write_fds_copy, socketmgr->write_fds,
-		       socketmgr->fd_bufsize);
-		*readset = socketmgr->read_fds_copy;
-		*writeset = socketmgr->write_fds_copy;
-		*maxfd = socketmgr->maxfd + 1;
-	}
+		return (0);
+
+#ifdef USE_KQUEUE
+	if (tvp != NULL) {
+		ts.tv_sec = tvp->tv_sec;
+		ts.tv_nsec = tvp->tv_usec * 1000;
+		tsp = &ts;
+	} else
+		tsp = NULL;
+	swait_private.nevents = kevent(socketmgr->kqueue_fd, NULL, 0,
+				       socketmgr->events, socketmgr->nevents,
+				       tsp);
+	n = swait_private.nevents;
+#elif defined(USE_EPOLL)
+	if (tvp != NULL)
+		timeout = tvp->tv_sec * 1000 + (tvp->tv_usec + 999) / 1000;
+	else
+		timeout = -1;
+	swait_private.nevents = epoll_wait(socketmgr->epoll_fd,
+					   socketmgr->events,
+					   socketmgr->nevents, timeout);
+	n = swait_private.nevents;
+#elif defined(USE_DEVPOLL)
+	dvp.dp_fds = socketmgr->events;
+	dvp.dp_nfds = socketmgr->nevents;
+	if (tvp != NULL) {
+		dvp.dp_timeout = tvp->tv_sec * 1000 +
+			(tvp->tv_usec + 999) / 1000;
+	} else
+		dvp.dp_timeout = -1;
+	swait_private.nevents = ioctl(socketmgr->devpoll_fd, DP_POLL, &dvp);
+	n = swait_private.nevents;
+#elif defined(USE_SELECT)
+	memcpy(socketmgr->read_fds_copy, socketmgr->read_fds,
+	       socketmgr->fd_bufsize);
+	memcpy(socketmgr->write_fds_copy, socketmgr->write_fds,
+	       socketmgr->fd_bufsize);
+
+	swait_private.readset = socketmgr->read_fds_copy;
+	swait_private.writeset = socketmgr->write_fds_copy;
+	swait_private.maxfd = socketmgr->maxfd + 1;
+
+	n = select(swait_private.maxfd, swait_private.readset,
+		   swait_private.writeset, NULL, tvp);
+#endif
+
+	*swaitp = &swait_private;
+	return (n);
 }
 
 isc_result_t
-isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd) {
-	isc_socketmgr_t *manager = socketmgr;
+isc__socketmgr_dispatch(isc_socketwait_t *swait) {
+	REQUIRE(swait == &swait_private);
 
-	if (manager == NULL)
+	if (socketmgr == NULL)
 		return (ISC_R_NOTFOUND);
 
-	process_fds(manager, maxfd, readset, writeset);
+#if defined(USE_KQUEUE) || defined(USE_EPOLL) || defined(USE_DEVPOLL)
+	(void)process_fds(socketmgr, socketmgr->events, swait->nevents);
 	return (ISC_R_SUCCESS);
+#elif defined(USE_SELECT)
+	process_fds(socketmgr, swait->maxfd, swait->readset, swait->writeset);
+	return (ISC_R_SUCCESS);
+#endif
 }
 #endif /* ISC_PLATFORM_USETHREADS */
diff --git a/lib/isc/unix/socket_p.h b/lib/isc/unix/socket_p.h
index 4f9cf27bf1f2..b7da860d20d4 100644
--- a/lib/isc/unix/socket_p.h
+++ b/lib/isc/unix/socket_p.h
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket_p.h,v 1.7.18.2.52.1 2008/07/29 04:47:31 each Exp $ */
+/* $Id: socket_p.h,v 1.7.18.4 2008/06/24 23:45:55 tbox Exp $ */
 
 #ifndef ISC_SOCKET_P_H
 #define ISC_SOCKET_P_H
@@ -26,10 +26,7 @@
 #include <sys/select.h>
 #endif
 
-void
-isc__socketmgr_getfdsets(fd_set **readset, fd_set **writeset, int *maxfd);
-
-isc_result_t
-isc__socketmgr_dispatch(fd_set *readset, fd_set *writeset, int maxfd);
-
+typedef struct isc_socketwait isc_socketwait_t;
+int isc__socketmgr_waitevents(struct timeval *, isc_socketwait_t **);
+isc_result_t isc__socketmgr_dispatch(isc_socketwait_t *);
 #endif /* ISC_SOCKET_P_H */
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
index bac24d75f2a9..facc12b15371 100644
--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.47.18.2 2005/04/29 00:17:09 marka Exp $ */
+/* $Id: time.c,v 1.47.18.4 2008/02/18 23:46:01 tbox Exp $ */
 
 /*! \file */
 
@@ -227,7 +227,7 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 
 	t->seconds = tv.tv_sec + i->seconds;
 	t->nanoseconds = tv.tv_usec * NS_PER_US + i->nanoseconds;
-	if (t->nanoseconds > NS_PER_S) {
+	if (t->nanoseconds >= NS_PER_S) {
 		t->seconds++;
 		t->nanoseconds -= NS_PER_S;
 	}
@@ -410,5 +410,5 @@ isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len) {
 		snprintf(buf + flen, len - flen,
 			 ".%03u", t->nanoseconds / 1000000);
 	else
-                snprintf(buf, len, "99-Bad-9999 99:99:99.999");
+		snprintf(buf, len, "99-Bad-9999 99:99:99.999");
 }
diff --git a/lib/isccfg/api b/lib/isccfg/api
index d94beab3e3f9..510e9a911bab 100644
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 30
-LIBREVISION = 4
+LIBREVISION = 5
 LIBAGE = 0
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index b04b3abde7a2..a13d0a5ad7cd 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.30.18.38.50.2 2008/07/23 23:48:17 tbox Exp $ */
+/* $Id: namedconf.c,v 1.30.18.43 2008/09/04 08:03:08 marka Exp $ */
 
 /*! \file */
 
@@ -36,7 +36,7 @@
 
 /*% Check a return value. */
 #define CHECK(op) 						\
-     	do { result = (op); 					\
+	do { result = (op); 					\
 		if (result != ISC_R_SUCCESS) goto cleanup; 	\
 	} while (0)
 
@@ -247,7 +247,7 @@ static cfg_type_t cfg_type_pubkey = {
  * Note that the old parser allows quotes around the RR type names.
  */
 static cfg_type_t cfg_type_rrtypelist = {
- 	"rrtypelist", cfg_parse_spacelist, cfg_print_spacelist, cfg_doc_terminal,
+	"rrtypelist", cfg_parse_spacelist, cfg_print_spacelist, cfg_doc_terminal,
 	&cfg_rep_list, &cfg_type_astring
 };
 
@@ -269,7 +269,7 @@ static cfg_type_t cfg_type_matchtype = {
  */
 static cfg_tuplefielddef_t grant_fields[] = {
 	{ "mode", &cfg_type_mode, 0 },
-	{ "identity", &cfg_type_astring, 0 }, /* domain name */ 
+	{ "identity", &cfg_type_astring, 0 }, /* domain name */
 	{ "matchtype", &cfg_type_matchtype, 0 },
 	{ "name", &cfg_type_astring, 0 }, /* domain name */
 	{ "types", &cfg_type_rrtypelist, 0 },
@@ -363,7 +363,7 @@ static cfg_tuplefielddef_t rrsetorderingelement_fields[] = {
 	{ "class", &cfg_type_optional_wild_class, 0 },
 	{ "type", &cfg_type_optional_wild_type, 0 },
 	{ "name", &cfg_type_optional_wild_name, 0 },
-	{ "order", &cfg_type_ustring, 0 }, /* must be literal "order" */ 
+	{ "order", &cfg_type_ustring, 0 }, /* must be literal "order" */
 	{ "ordering", &cfg_type_ustring, 0 },
 	{ NULL, NULL, 0 }
 };
@@ -544,11 +544,19 @@ static cfg_type_t cfg_type_serverid = {
 /*%
  * Port list.
  */
+static cfg_tuplefielddef_t porttuple_fields[] = {
+	{ "loport", &cfg_type_uint32, 0 },
+	{ "hiport", &cfg_type_uint32, 0 },
+	{ NULL, NULL, 0 }
+};
+static cfg_type_t cfg_type_porttuple = {
+	"porttuple", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+	&cfg_rep_tuple, porttuple_fields
+};
+
 static isc_result_t
-parse_port(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+parse_port(cfg_parser_t *pctx, cfg_obj_t **ret) {
 	isc_result_t result;
-	
-	UNUSED(type);
 
 	CHECK(cfg_parse_uint32(pctx, NULL, ret));
 	if ((*ret)->value.uint32 > 0xffff) {
@@ -556,18 +564,60 @@ parse_port(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		cfg_obj_destroy(pctx, ret);
 		result = ISC_R_RANGE;
 	}
+
+ cleanup:
+	return (result);
+}
+
+static isc_result_t
+parse_portrange(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+	isc_result_t result;
+	cfg_obj_t *obj = NULL;
+
+	UNUSED(type);
+
+	CHECK(cfg_peektoken(pctx, ISC_LEXOPT_NUMBER | ISC_LEXOPT_CNUMBER));
+	if (pctx->token.type == isc_tokentype_number)
+		CHECK(parse_port(pctx, ret));
+	else {
+		CHECK(cfg_gettoken(pctx, 0));
+		if (pctx->token.type != isc_tokentype_string ||
+		    strcasecmp(TOKEN_STRING(pctx), "range") != 0) {
+			cfg_parser_error(pctx, CFG_LOG_NEAR,
+					 "expected integer or 'range'");
+			return (ISC_R_UNEXPECTEDTOKEN);
+		}
+		CHECK(cfg_create_tuple(pctx, &cfg_type_porttuple, &obj));
+		CHECK(parse_port(pctx, &obj->value.tuple[0]));
+		CHECK(parse_port(pctx, &obj->value.tuple[1]));
+		if (obj->value.tuple[0]->value.uint32 >
+		    obj->value.tuple[1]->value.uint32) {
+			cfg_parser_error(pctx, CFG_LOG_NOPREP,
+					 "low port '%u' must not be larger "
+					 "than high port",
+					 obj->value.tuple[0]->value.uint32);
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		*ret = obj;
+		obj = NULL;
+	}
+
  cleanup:
+	if (obj != NULL)
+		cfg_obj_destroy(pctx, &obj);
 	return (result);
 }
 
-static cfg_type_t cfg_type_port = {
-	"port", parse_port, NULL, cfg_doc_terminal,
+static cfg_type_t cfg_type_portrange = {
+	"portrange", parse_portrange, NULL, cfg_doc_terminal,
 	NULL, NULL
 };
 
 static cfg_type_t cfg_type_bracketed_portlist = {
-	"bracketed_sockaddrlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
-	&cfg_rep_list, &cfg_type_port
+	"bracketed_sockaddrlist", cfg_parse_bracketed_list,
+	cfg_print_bracketed_list, cfg_doc_bracketed_list,
+	&cfg_rep_list, &cfg_type_portrange
 };
 
 /*%
@@ -595,7 +645,7 @@ namedconf_or_view_clauses[] = {
 	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
 	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
 	/* only 1 DLZ per view allowed */
- 	{ "dlz", &cfg_type_dynamically_loadable_zones, 0 },
+	{ "dlz", &cfg_type_dynamically_loadable_zones, 0 },
 	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
 	{ "trusted-keys", &cfg_type_trustedkeys, CFG_CLAUSEFLAG_MULTI },
 	{ NULL, NULL, 0 }
@@ -606,6 +656,8 @@ namedconf_or_view_clauses[] = {
  */
 static cfg_clausedef_t
 options_clauses[] = {
+	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
+	{ "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "avoid-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "avoid-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "blackhole", &cfg_type_bracketed_aml, 0 },
@@ -684,9 +736,9 @@ static cfg_type_t cfg_type_disablealgorithm = {
 };
 
 static cfg_tuplefielddef_t mustbesecure_fields[] = {
-        { "name", &cfg_type_astring, 0 },
-        { "value", &cfg_type_boolean, 0 },
-        { NULL, NULL, 0 }
+	{ "name", &cfg_type_astring, 0 },
+	{ "value", &cfg_type_boolean, 0 },
+	{ NULL, NULL, 0 }
 };
 
 static cfg_type_t cfg_type_mustbesecure = {
@@ -911,7 +963,7 @@ view_clausesets[] = {
 	namedconf_or_view_clauses,
 	view_clauses,
 	zone_clauses,
- 	dynamically_loadable_zones_clauses,
+	dynamically_loadable_zones_clauses,
 	NULL
 };
 static cfg_type_t cfg_type_viewopts = {
@@ -926,22 +978,22 @@ zone_clausesets[] = {
 	NULL
 };
 static cfg_type_t cfg_type_zoneopts = {
-	"zoneopts", cfg_parse_map, cfg_print_map, 
+	"zoneopts", cfg_parse_map, cfg_print_map,
 	cfg_doc_map, &cfg_rep_map, zone_clausesets };
- 
+
 /*% The "dynamically loadable zones" statement syntax. */
- 
+
 static cfg_clausedef_t *
 dynamically_loadable_zones_clausesets[] = {
 	dynamically_loadable_zones_clauses,
- 	NULL
+	NULL
 };
 static cfg_type_t cfg_type_dynamically_loadable_zones_opts = {
-	"dynamically_loadable_zones_opts", cfg_parse_map, 
+	"dynamically_loadable_zones_opts", cfg_parse_map,
 	cfg_print_map, cfg_doc_map, &cfg_rep_map,
-	dynamically_loadable_zones_clausesets 
+	dynamically_loadable_zones_clausesets
 };
- 
+
 /*%
  * Clauses that can be found within the 'key' statement.
  */
@@ -959,7 +1011,7 @@ key_clausesets[] = {
 };
 static cfg_type_t cfg_type_key = {
 	"key", cfg_parse_named_map, cfg_print_map,
-	cfg_doc_map, &cfg_rep_map, key_clausesets 
+	cfg_doc_map, &cfg_rep_map, key_clausesets
 };
 
 
@@ -1155,7 +1207,7 @@ static isc_result_t
 parse_maybe_optional_keyvalue(cfg_parser_t *pctx, const cfg_type_t *type,
 			      isc_boolean_t optional, cfg_obj_t **ret)
 {
-        isc_result_t result;
+	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	const keyword_type_t *kw = type->of;
 
@@ -1184,7 +1236,7 @@ static isc_result_t
 parse_enum_or_other(cfg_parser_t *pctx, const cfg_type_t *enumtype,
 		    const cfg_type_t *othertype, cfg_obj_t **ret)
 {
-        isc_result_t result;
+	isc_result_t result;
 	CHECK(cfg_peektoken(pctx, 0));
 	if (pctx->token.type == isc_tokentype_string &&
 	    cfg_is_enum(TOKEN_STRING(pctx), enumtype->of)) {
@@ -1259,17 +1311,17 @@ parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 }
 static cfg_type_t cfg_type_notifytype = {
 	"notifytype", parse_notify_type, cfg_print_ustring, doc_enum_or_other,
- 	&cfg_rep_string, notify_enums,
+	&cfg_rep_string, notify_enums,
 };
 
 static const char *ixfrdiff_enums[] = { "master", "slave", NULL };
 static isc_result_t
 parse_ixfrdiff_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-        return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+	return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }
 static cfg_type_t cfg_type_ixfrdifftype = {
-        "ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring, doc_enum_or_other,
-        &cfg_rep_string, ixfrdiff_enums,
+	"ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring, doc_enum_or_other,
+	&cfg_rep_string, ixfrdiff_enums,
 };
 
 static keyword_type_t key_kw = { "key", &cfg_type_astring };
@@ -1286,7 +1338,7 @@ static cfg_type_t cfg_type_optional_keyref = {
 
 /*%
  * A "controls" statement is represented as a map with the multivalued
- * "inet" and "unix" clauses. 
+ * "inet" and "unix" clauses.
  */
 
 static keyword_type_t controls_allow_kw = {
@@ -1423,14 +1475,14 @@ parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 				       "address") == 0)
 			{
 				/* read "address" */
-				CHECK(cfg_gettoken(pctx, 0)); 
+				CHECK(cfg_gettoken(pctx, 0));
 				CHECK(cfg_parse_rawaddr(pctx, *flagp,
 							&netaddr));
 				have_address++;
 			} else if (strcasecmp(TOKEN_STRING(pctx), "port") == 0)
 			{
 				/* read "port" */
-				CHECK(cfg_gettoken(pctx, 0)); 
+				CHECK(cfg_gettoken(pctx, 0));
 				CHECK(cfg_parse_rawport(pctx,
 							CFG_ADDR_WILDOK,
 							&port));
@@ -1492,7 +1544,7 @@ static cfg_type_t cfg_type_querysource = {
 
 static isc_result_t
 parse_addrmatchelt(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-        isc_result_t result;
+	isc_result_t result;
 	UNUSED(type);
 
 	CHECK(cfg_peektoken(pctx, CFG_LEXOPT_QSTRING));
@@ -1700,6 +1752,7 @@ static isc_result_t
 parse_logversions(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (parse_enum_or_other(pctx, type, &cfg_type_uint32, ret));
 }
+
 static cfg_type_t cfg_type_logversions = {
 	"logversions", parse_logversions, cfg_print_ustring, cfg_doc_terminal,
 	&cfg_rep_string, logversions_enums
@@ -1716,9 +1769,9 @@ static isc_result_t
 parse_logfile(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
-	const cfg_tuplefielddef_t *fields = type->of;	
+	const cfg_tuplefielddef_t *fields = type->of;
 
-	CHECK(cfg_create_tuple(pctx, type, &obj));	
+	CHECK(cfg_create_tuple(pctx, type, &obj));
 
 	/* Parse the mandatory "file" field */
 	CHECK(cfg_parse_obj(pctx, fields[0].type, &obj->value.tuple[0]));
@@ -1727,7 +1780,7 @@ parse_logfile(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	for (;;) {
 		CHECK(cfg_peektoken(pctx, 0));
 		if (pctx->token.type == isc_tokentype_string) {
-			CHECK(cfg_gettoken(pctx, 0));		
+			CHECK(cfg_gettoken(pctx, 0));
 			if (strcasecmp(TOKEN_STRING(pctx),
 				       "versions") == 0 &&
 			    obj->value.tuple[1] == NULL) {
@@ -1756,7 +1809,7 @@ parse_logfile(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	CLEANUP_OBJ(obj);	
+	CLEANUP_OBJ(obj);
 	return (result);
 }
 
@@ -1773,8 +1826,19 @@ print_logfile(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	}
 }
 
+
+static void
+doc_logfile(cfg_printer_t *pctx, const cfg_type_t *type) {
+	UNUSED(type);
+	cfg_print_cstr(pctx, "<quoted_string>");
+	cfg_print_chars(pctx, " ", 1);
+	cfg_print_cstr(pctx, "[ versions ( \"unlimited\" | <integer> ) ]");
+	cfg_print_chars(pctx, " ", 1);
+	cfg_print_cstr(pctx, "[ size <size> ]");
+}
+
 static cfg_type_t cfg_type_logfile = {
-	"log_file", parse_logfile, print_logfile, cfg_doc_terminal,
+	"log_file", parse_logfile, print_logfile, doc_logfile,
 	&cfg_rep_tuple, logfile_fields
 };
 
@@ -1805,8 +1869,8 @@ static cfg_type_t cfg_type_lwres_view = {
 };
 
 static cfg_type_t cfg_type_lwres_searchlist = {
-	"lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
-	&cfg_rep_list, &cfg_type_astring };
+	"lwres_searchlist", cfg_parse_bracketed_list, cfg_print_bracketed_list,
+	cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_astring };
 
 static cfg_clausedef_t
 lwres_clauses[] = {
@@ -1925,15 +1989,15 @@ doc_sockaddrnameport(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_chars(pctx, "( ", 2);
 	cfg_print_cstr(pctx, "<quoted_string>");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port <integer>]");
+	cfg_print_cstr(pctx, "[ port <integer> ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "<ipv4_address>");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port <integer>]");
+	cfg_print_cstr(pctx, "[ port <integer> ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "<ipv6_address>");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port <integer>]");
+	cfg_print_cstr(pctx, "[ port <integer> ]");
 	cfg_print_chars(pctx, " )", 2);
 }
 
@@ -1941,7 +2005,7 @@ static isc_result_t
 parse_sockaddrnameport(cfg_parser_t *pctx, const cfg_type_t *type,
 		       cfg_obj_t **ret)
 {
-        isc_result_t result;
+	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	UNUSED(type);
 
@@ -1952,9 +2016,9 @@ parse_sockaddrnameport(cfg_parser_t *pctx, const cfg_type_t *type,
 			CHECK(cfg_parse_sockaddr(pctx, &cfg_type_sockaddr, ret));
 		else {
 			const cfg_tuplefielddef_t *fields =
-						   cfg_type_nameport.of;	
+						   cfg_type_nameport.of;
 			CHECK(cfg_create_tuple(pctx, &cfg_type_nameport,
-					       &obj));	
+					       &obj));
 			CHECK(cfg_parse_obj(pctx, fields[0].type,
 					    &obj->value.tuple[0]));
 			CHECK(cfg_parse_obj(pctx, fields[1].type,
@@ -1968,7 +2032,7 @@ parse_sockaddrnameport(cfg_parser_t *pctx, const cfg_type_t *type,
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
  cleanup:
-	CLEANUP_OBJ(obj);	
+	CLEANUP_OBJ(obj);
 	return (result);
 }
 
@@ -2011,11 +2075,11 @@ doc_masterselement(cfg_printer_t *pctx, const cfg_type_t *type) {
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "<ipv4_address>");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port <integer>]");
+	cfg_print_cstr(pctx, "[ port <integer> ]");
 	cfg_print_chars(pctx, " | ", 3);
 	cfg_print_cstr(pctx, "<ipv6_address>");
 	cfg_print_chars(pctx, " ", 1);
-	cfg_print_cstr(pctx, "[port <integer>]");
+	cfg_print_cstr(pctx, "[ port <integer> ]");
 	cfg_print_chars(pctx, " )", 2);
 }
 
@@ -2023,7 +2087,7 @@ static isc_result_t
 parse_masterselement(cfg_parser_t *pctx, const cfg_type_t *type,
 		     cfg_obj_t **ret)
 {
-        isc_result_t result;
+	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	UNUSED(type);
 
@@ -2040,7 +2104,7 @@ parse_masterselement(cfg_parser_t *pctx, const cfg_type_t *type,
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
  cleanup:
-	CLEANUP_OBJ(obj);	
+	CLEANUP_OBJ(obj);
 	return (result);
 }
 
diff --git a/lib/lwres/api b/lib/lwres/api
index 510e9a911bab..0be3ae77fc2e 100644
--- a/lib/lwres/api
+++ b/lib/lwres/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 30
-LIBREVISION = 5
+LIBREVISION = 6
 LIBAGE = 0
diff --git a/make/rules.in b/make/rules.in
index a1ae55127cee..e1488e9c1c96 100644
--- a/make/rules.in
+++ b/make/rules.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: rules.in,v 1.47.18.13 2007/08/28 07:20:06 tbox Exp $
+# $Id: rules.in,v 1.47.18.15 2008/02/18 23:46:01 tbox Exp $
 
 ###
 ### Common Makefile rules for BIND 9.
@@ -104,7 +104,7 @@ STD_CWARNINGS =	@STD_CWARNINGS@
 BUILD_CC = @BUILD_CC@
 BUILD_CFLAGS = @BUILD_CFLAGS@
 BUILD_CPPFLAGS = @BUILD_CPPFLAGS@
-BUILD_LDFAGS = @BUILD_LDFAGS@
+BUILD_LDFLAGS = @BUILD_LDFLAGS@
 BUILD_LIBS = @BUILD_LIBS@
 
 .SUFFIXES:
diff --git a/version b/version
index 72f7f63bc0d1..61ba428c538f 100644
--- a/version
+++ b/version
@@ -1,10 +1,10 @@
-# $Id: version,v 1.29.134.18.8.2 2008/07/29 05:03:28 each Exp $
+# $Id: version,v 1.29.134.23 2008/11/12 04:17:12 marka Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=4
-PATCHVER=2
-RELEASETYPE=-P
-RELEASEVER=2
+PATCHVER=3
+RELEASETYPE=
+RELEASEVER=