wpa_supplicant-gui-2.10-150600.7.3.1<>,;f.p9|$l'iWǢgzxPwO#_!>nt92c )v^~rm!8=G,gŀ@ρ ^vJsfOW]cpAEY\B#oT "z޷qI7ՠO~1kSu VV[mD(5fAO^{d8G=\{E$"c;OQsZf^Sv+) =."osi!&!~~pM _R @a;\dx[>>?d ' J , BNkqx     &0\d(8*9`*: *FGHIXY\(]0^Ebecdefluvwxyz4DHNCwpa_supplicant-gui2.10150600.7.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.f.s390zl31 |SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxs390x x큤f,f'01d0bc690945fa8bfc1e86130ce566819ddbcce745a43c399aab466473ad8a5bd57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(s390-64)@@@@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)s390zl31 17267464142.10-150600.7.3.12.10-150600.7.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35766/SUSE_SLE-15-SP6_Update/1481ab215a0b1830ea80ceb6538f4766-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5s390x-suse-linuxELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=00197aea7c66fa2b21573fad7bf56fec8b8b3437, for GNU/Linux 3.2.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RRRRRRRR R RR R RRRRRR RֻUN yk utf-8293ad532d9143c66325e9afed0e17885d39f38a2342232872b5b0c672f0a7977? 7zXZ !t/ݐ ]"k%}RUJzx+P]8\Q.|~S G Fa*zk*v錏zfC=<_';}h{0v"zO恗5JߒwZ ȂcRum/V?fYڒzR;9>n/=ai/ M;'cd~wT=Ǟ}uE߂8pSXC՞tδ`QK  Fr1X_bHvF] /bk[uGP)ُ/0"I*ιwe=HC l%V,T+/ z )zL|$Y~E<8&t&.de\vz[ &v'!F U# iyɜ^P TM)ϦfsA<ւēg)]+Tn8L~ Vr?^!QJ]D^'DSrCH;䷺syؘ -w `o ȳ?c-E.Wӎ]ʯ#jƸ6N^J `0RfRS(~P, J;#j&qQ(J*Fr`oeS 礥y9N[.cٓUQܳViLgrMu"Cpx 6T׍L6V9Tsxju#Eh]sݡB i gHՙe dʍGGK'.J{RLoܴعZ’#1ϒh+ap߈3ɥD!dU|35ʲKxW*?"WU ٖo' g$Q>K9~>OPJSSQ)ب L}Jg󆲙0Y:VuY¦sdnQ8"Ua'a52ao<̆ K$ UjebCdRzI{߳Y2zA|I_,&tӤr):3 U ܎6!"Q/^ e2zTz %uND,Ή:Jl nE Q%f=:&wG>lĈ)6Ѿ)1/Y_=hW L9_‰FZ漜@\Eu'Hz_!}m,ׄd5T98|PU۱ }gG9rdڜ`!J3=RZ3_3WkwɺGy)ɼ"Qo0/KX)X﬇1?߲L]C*MolH Zn}-CFGn}K;"\Ep&"#@"8b) -.]ڧ;/}|Yl Wa SY4>C):Vh`@̨c*H Gc~2 jW>xaXbRO/OŽJa"xؠyo^KΉ~w@i(c4q~3i*Txu@'Q%1{Ҏݎ^ַ)he~ k3)W O#肑#=Yuy1[JHF~.핤YLW9֥3GSn>s<B F8[M8l7;q>4Ŀ[~}ht ]kBu3v?o*^YbRPH9Pٌcf2'$HL)nqK=i DpXc jpw(I~әX,dz>WK%җ0R&yxXUFFci/+Ȟ=>MKƉX)=kf.V|霞{q.L[DF802dŽs CvF 4)C[QkDahi L+Il NpM$vS}VKh2 U#tHdPw)ڏ y7kX?6$o1Dܸ41f%sKpX)&P O=`_,^qٸKB@J32v쭦 cJI֊H6紘@D=#:;s)u= 8 ^umd7l} 'CpL泛4 .THBdU;O݅Wߣ_׆; JvwKbx®}~G8A7;YJ\#x!ⶵ_ p.V3K*X4 {bak'0ցj}XQm=०h=قE/p893AdT5^1,LF|/U CB:z3 Y9K T#\ .i0 @E o0&V}y!d_k35D)g=k%̏"i߳0CC2Ep0|*"Nf3^T'RNJW%eCKюUZtʦ;OLl\QPj-r(Sz4npӜ6^8L >O2o7΀[‰rcA3RLV̘c5$@nƢq LD(en5]{Ohɒtm&=(#CGG\Of. 5(BH8Z%~d7eV럫pWXN\jUCM4ZAw( Q +;Qv]+).IDpVk{n) lR?U.YRND+,dp:w6|lJ|[M벭:=UKӦ):JVw5xIsU^!WTƾ9rqj')3w¢aQQ IK1dNO| WtB~ OӨVEQLC~_DCrM p^ᮅ>g;d&Θ S&OÑz=ޜ^]RPT#HyLy\yvևz^cxI;Q uES0/?ԺfPsU1F'Dɫ20n&LtrFcqq"Չ>Og*_Yuw;E"FŮVT:M t(Tal8l3Hj^7>am%G$&srL7 p gXw#Z"3":Y7[=`-V*I6ktgqdOvL)Jr+8ğw\s6uFe'o/J%ZW|rݐ~P|. #H^tPq\H Kwu2_(]_͞DR wd!WRH^Ac$m#֝ϊ8djA p1w]מc)ίg޽#'eغ4zop:Tri_RՊUz? $yOcqQwցxnBn" h,m5B%[ۦޑcoxBRL.|I 9uޏ -s~2OU*Ldokl7#?r~N!:l_J~sg'*1z7fC6"Fp ZQu>k}peP1>+WKx!̴h߰TFdI7Ϝ+K>ƟOAW4nVdkXZфcnE!vl2V4FSTKL,vэs۠Ce`1·y#O>bƫw: )ٯᤴzca5VcĪFRiSxsvZvQՋcd-OMuÞa# rbLN힬ҖȤ tllѻWwn'hSbl., ')q4poiI wT`JA kufص#5Ń?|zO{f,Wuë| )HogQB& uK_=sdݸ7RycC#8T0 ~w ;]RyXY1>d>-܋ bjG|?T"SuHR $yӲa6csHd,]5#Is]uu6I^I88߄(̮!W6quXlD>~ *|)C:4>v,0gkţ|mw_., %1(߁b!1ÖXAh_koH 91hV9-U8ph -oXh(-L`_QdL ^~ #x*:qw"FG*%pVtW5c'uuhX`E6uS?isTF_NYlF{n{[f{iA_$c(BDZv اMDKcR?ҧ-ps. b-w }sô,5G'e 7 {q,Ə at- HB5 q Q;/$g3K3?9x9}@|`Zԏ4gl/ԩ5vӐ@?c(—7(6[a$F/8A^fT uei/<0UV6zAnlB?b«cG@Фm;{O2~p(SiQzF+59QIj6y/;;F\{]Dc'gd}f-ƪ$-JD%4Hnʠ!}*}g6|Z5Fn4rXpxZ0| $JG ;߾;r,>&OwTnQ83cbqfD_/Tc3gڑ:l*9%? o+boE.>z/X?3Q}S-/̇xnܒmz@}#bycGGrTO-.YGfށfv HK/T ?X(;-Qxdž&nۼQWEqS¦}_!AMZ9Ƈf;.q@o`B>oL;cdi]ƴ#|S`9O*G#0(1 L%Γܬ[%ݸ @1B9JC2R@fupT-b{U%d>ٟb['(Fn~Ս#8Jjz >b9&p9t'%$b%Kl5!|$q+?;|̰Xmv-0N%?^}s3q8ߺ1+#=̦MᖃS+-)J?Iݳ}m>P 3w \#a}0=¶gF+C' j o;;N 9i+q6j2TBN,V:u=ܛ\auR{E֊NX[,H>gn7T?9guDTgr8SZ#1ϒ۶,KIuYTDGd%3կˌ%snfi:#8} 7eǵkhO?>ZbgD&,(K'Xp9.] btq|nR {ý+K?cK}{+]"ha[z.mfL)Tҋ~iV35WGp*"9Z$xbϊւ>lgzK1N3k  y$ŜȲyJ@D/_%#k[U''NOgV.4vatwNzB_@!4jj`~T> ;:WF[MxzWG_^%Ga!% v%2KqnDү,_Y:1pξaPپ R'qNCQ(fh`Rh\h7Ι1`yس8F%xEr" |mzyuXw/LDs2FGc/ !vC趾+Oy聯TIGUjN$AҦ8ֻsa"%9QHTz咔p_F )B$0E~0~_Ŷcx+D)tG2ER$1X9]<7x@dC1 K}wH:hZf0VAX'a홟Ql `A&8xN1sm:Hr2fK!dbaEdsׄɕ@G.ld%KA-IB $5) 'G1Q.>2z+W5mhHt4!w Q?p>j:ypQH#s n b5e.!O&%v8+SQ SmctFΐϼ'0G'4yCB/UiJE/8U9Z<"s-΢ 3Q'QBWSE5tqooX+ZuH"_{rb}$d$M2Smr$a/'{nG|k>'7n&^spg,D<+ DIJ.3+0臔}Ԇmg(:\#K3P}'ѣ훹:GXf:h`m/13`U}IXl S΢Q(GɉyؐJЋGDQ)'L˴3BFwd܎6(40TĿ%,;|F#O.y64(F(!ȝUalmΰ.^k|"Tw)'`(tn[ AkZƖF0|P_[&;6Y l>NN)k,> y}2#pG*,L}<#z2_q43@ ǖE'o|@InW\=&*:U%4I!!SN?Ί-Ms*lI){dIF͝tʱrUJ?ؚ$mp_b 1J*wI3yqM St7Iџ@q/ƕKzF`R?wh ^֣9Y WI)ͷ59GL]ϛ7>Nmֹ!{hDpjWaxJcע{{(HG(t487ȺKY;8Yȱ|RFKqZmȇ*VYŗ'9?3k48y-0K!;zH[^.V3QM[l0e<ӧQU4Pz!M%HOՏH/:25Dm p "FVW],TggVB\N5!q7<}~X"mR^Q9,iϬ1c^椻 *Ooaq-hϜSS<6ADa슐 1D/N æmjLĕfJԧUX?*d2Z5wxu7a:L*1x_68/99wqH%K=7)vx*Sو506Gz&4nT!Xs{b kW} Hہ]P4y/LȖxcؙ ҧ<beu YLIW*} -1RYqAa~Gbiq S V'#JKU;iOJf5"اj[/ڣLX0G9diRO ̺^( 1nh'{D͝+$Εgr/9xk>L^Uu] 'ЕSӉ3YGtCp^ L&_QJ=kg˙dعdJ{N%n9kSChJՑ%D뉺/\d"e샊- p-L$ CФFīur쌆oh_ahI댖/sGlbðlgB7QɈS&E/N'WN2rRYɵTG&e: g4~k‘ꎧbOs}I24H4z ؋dܬKC](V i}^.XYsOꞬB-ڂ>T^.lx-5+hMLYT}cY{W3.'a;ū섗l/6d9GВfj)"<|nQܶVI:^TfRVw0Wt&Gm+MB#V?xNsw\*QL~w `=#H؛K gGvreSVnXIT hrо> ptb/Y嘁r r[5nKXxE|iBǥЉD_ÂTtړ 4 IWEnZNj,~X!;ɒѪK}uswgW0!ZJ».͵t6(C-ZuYuQ4+d֒_~!a ;nۋ.io+ZKEwêt3N785#Dcy#BQM[$:(D2zT!P} ilI^2IO+oR-AcTF0歠U ÂV8y "PNiXѝS4XX?M|n'*Cˉf}_okg#}n{~g1 !3*{)mf>94QLc4hPЃb0ݘn*PLHLzǿXpF%<9c!x>߳!Cҳ](!$rwF6%:!yEXLY;-Kn pĘo2x&Tin(}P 1F lc-:ҟw=&l*Rf ڊ UD@ٳ,&>Y{41oA:ANřsЊ 0|h /NOï B1g [4(lvͨymF\ذ6\@6=3t2+=ZU=wP<&ʵu* ӉU=S HE %/K$}䶡[lSGU=EL \]WH>?؛z@S+A/=Z!~3;O yyإ%ѻѣh!7tfN~_0#-o$;r(3p^_ ؒ^`}2?LN<*ej䧺X3QvPcpwx'A)PMѿQNPa꬚O]t_,MOB ]^3 [܀3`; "όLս L*1FU?Bc9dGKpdR2O%&񂺐YC@fZ903 2>ҺdA<{vu3a?_ E#8!*6_\DFⰒOJd[HvuR>ri~h_xB dvQuW:21u_g814RݳӰ NcR8 "1=SE.xLGt? Xخ6*lKv2<0Z 9Q0⣠B c᱕#03LϘ1R\^uhӈ2t:l-R7DdY#xYKt5F-|, f~] fe?6mLZ'dmU1]#ZX6'G=1ҙ ]ߢUEǛc4Oqnih?Me̵n1+_Vh9q}R:2!fUiEIؗM:XIR7o/ RBRPrs@Pϝ)qCYcxCR8RvH9I"RQ'edi0C DP*TUj n<_|aeTR{/HR~ E 6:C8Ē#jo_&xzr.F!qaAyN!pmrU6_ucGBtMZ*Ju+y@ޛL;Ӛ}P*yOo5>?N$p,Ocx7x u04*q9 "20ECyuy|ʂpWk"Pֆc2Jׂ?*92egD/(ct1FLSAyM$]y!{v/7C+12d*1ZkhVB@-]sOIW~Z+WCjX^K9-M5Pe$%S{5.9E R7Z;HX]P/&Qcd;5Ώxpcܒf: |炞S)U(]k3T ZbjVoc e5=XO˫qd`u_"xYpVԟzzz!P@T!ӈP0I;Z&f.Z]Fm]?DiKW{X2Z5IDy[V|r;@&sTOr'i[N$9:P⠾ȰVwxj9TZ+;2w2NKt t6' ∮ ^bh~YBiCV@P3Mí\`mQ0#ZLq W[lfbTs18~jbA9wVTeo5MY@R k\p Ei,4Cb~BsR J3};E$ /Y\#D †C'kCni\ _1 U3Idp6U_cPۣˁ6TUovw&N:$r4DJcdvM<%-kM!d6R5HCW mmAVt{Z"UIuZ0v.bdj1piba=?J&F|h-S%ȷuo )5֬p2nq$O:56e9"|M,jPǡfθ%`6iJڬ0lG_{\rmHɋR GxC7h?/S>QS]b``Y3O/yG?jy2 (< E4jI^q[Ffo 򯝭3HdkcprgJ99y*Z}vY~'lh<}~w*r CJ1K0f;OVmV*W7HED': C`-f͝J\1:OyÍ>,ƸYh{7Ku\R=L%FPLh󢤝%kTF;lR(EI+)ʧˁ.t3ĮR8cAVUj6E0 H.&UWpL9o*g[T(M3?œcZJUY%m!;s5x9 j**MD/®;'[+Ef:%ETţA:цkz%F¶]Pe{SanyF ̞Ah+fλD;yo?y˾*C=j D#BE?02 BJJP.MTZwFSLg>_%"B µg"ۈ{fmD9Mj[`I ~=~fبjY,e5`®zOwDxx?gW7Ӣsx]T &N³JȦ:bg?o|fK(FIC5ZQ{}$e6)o_l󀎝8ҡss47uDͷwPyݸ`_ַ(lMu;XXkPnUruq4LDPY5,+v9@ 5pBŏw6xr*m%։[lU hŹ?}.|Z5M87xMgX?U,Ea$oUa^ ף52Ā)JPXHV۸hrlr=&V:JQSMNb#EQt'+>#ăAPbU7|5If:b~(zj(Pݲtok~Eb4 (7󬋄ɼ|?A1kO6LbwV7+4ʨi Q3B4N;$.x(–\H" CTuD82o2FT1QLɨ.+ )W&g0!QYQ J-);sߛ*o;CdsRQCZ |˽f߹Y,X#j|: Jh7Kq "L_ 6 .+f-J4cjg.P"°ͩ˧VIp,#Tԙmwco}C(gno ӹ%èhQg+pGbCsuM y` aϝ}>#ʭY = ؏z`ͤMנAm8_{n[8%yn?.pk=FF=#FOtW /H xA'g>yh֓j0]j~$R'[t-n,ᵷ/D~f#EJ\Gy;7 RU&2xp?ɐmYmd9*=H\p;xBޜR: !vQK4 x5`#e?3# CE.uvۢC"\wIA Fy=ۿI>T lp]W&.Bih@^w(wIrj?m6Ί[Z/“V2N>I;TF=[g:?J$K6OPU:LS"F#'B=}.)S3z\r 6]mgO,?_Xˤ|3ȉӸ&C=r藩giluͲQ6\x}XA)ܙ3%E8DnRsLGej /!Νf#߇WshJGmu?|F袥f 0=?Y[n0#ڤBB Gb⫟Utą|8k\R$ F\c2,[)FA'ă&:6p3 c$ώyvbe6+U/zcW*x&R߰ گi;*cvz`Xm@Sfw"T~hJ^t4&Z F2-MRа\F U%1 YDdI6N#W6lGv bOnoOS֞?SIK8)xH}q۹C$#mҨQa*&q)mRWE98P.oB5|E[E u- lJU!Dh%r#߆zyd' kyN;i[}杩CHg#Sc<#Py?)یD:=tkΚvdw*Iډ! ۺfiypZsN+h J7{MX7 Q`Ni;=,t@xl^wHT}aa 4Pr U]XQ"^>v$A]M:鸕mxb=l ] \$-XȒqTvM^QO&hc Px0l뚧nË^P:zJ~O kSwe~kb Or2]0{/ph\tvh:>j E1mjF纯̭a˨ZQ5+Krc?{ݕĖߠ99d^)3jie-loR1K?ٓ؎`vr5a"ol_I(p|OrLąvbG/ܥ1E(@ ;~'U ;F#TFnXE`S]rpX>>[g?o0s0_,Mve ٍM)%[B4OfBaW1{;l226ErglzK C׼نЏiְ/PMboGKs1=,`?k;rނAmI-*oP;ϦnzNBLj7|kk_O<{@HRƂb!rToa_b @ P2'`ao) OW@4=?5S9xDG-\&x37"PF֪S7 Ϧ ¨r5{jf+/G{Ӝ,eWdΊl* {YBfRlC"*mՎ:sC=M!2e….PORKDv)\ή9ƕn[@ok=@R}<鸀pd ýw= _Uz!iq~t_еr~SƖJh= bb ݠ#_lh wu~Tb?Vrbw}73\>N&.Eۻ8qw1sK~ ,I}3 YtIiH||#"tWf6Fr_ךT#(;qAێW4vͲd !5$ψX߱:XɱS&B!r%M,CX67¤/߾@lPq$<+h BqW;gɇs~¬P<,.xH Mj?%(yi. E4$fc#F*|W Kq,my\܍1𦊲e mq&8ds]XLai;}9v7z?4ڀkɴtn+qpf 9)WQp<30>a\ H4.j$Qs]m qp5PMviFs~l NepЂJTZ%t4fxY% 3]׮אTŇ3KAIE&w@nZd pǡ?#%Ӓt;7}1C5B?@EVA&L05')xƊ^}QqCbtR/6W]-&u˜%ɳpt_yDOLR J}ex*_くO:($eڗWD.vG]Kg &u>OZm?-6MО6Ĭ8e?X\$Q6,7FYv>EL5yH(mVo8}[Ҁx{Xd UtYp11 jG;Pj`)-YVTcK 2A ]F\Rn%Kt3mܷ"5[ Dr]b?ڥH`{kHD+bOo$&㱄@ F[1%[*>ࡆy{vmE\w(㜢LTVNX=Tq6mĦ}FjUW}s|d_ Uz2k# 巻f3)m3fa 8Ne0Gh]Jt`XԯzzTlqFi@ugH^G+c3:HHSu- 8ͦ۱|!m>vM[%Mi=C$^L*?Mn " *^"%-,z4[pU>Lҟl-q/X[^1L#E

#\'&>l a@`)D ǖ8ێ<&/S,})z7rg|oUca)k;/ M'*pXV{@24پm1K sfZT "'աkZZ?-7_LWR;-;OAs& Ax;M vǛuܬ6FgUh$)cYGDSu 56hi7rp3V7,Yشe2LxBoV(g;d˻]Y5&@sԃ9b}ə 4)No%D$WnKȢA +k\uѮ 8*woƣ|!t^S+kmi5ܙ{k C&Hz!ZC)D { uH+}C7X=K(Ʊ{_TftΣBK?Aٕd [kamX!ADwn|=cʌ=C?]@8yQP VUwSOGbz w_+qٲG>O$Vht ׅ K+? -KpGĝIPd]7hIƨ}@_;QI8 8(~ɪbVt9zmgV7-Jm;粮)w S|G16٣ ̮efP(7`/KI/gn ڟn(:ch9um\:9OZ#0"Y؟}B;; Wuu ߈;aZ݆󭤆] Ӝ vݙ=T&ZBAo {@XįX#qvE8IkOzY")?Q̈ )Fڛ陁a:q-IXCn 5oӑ;vC9wtCoS= YeǿpZi(?fg&BFORpld8.ӕXN'i:KX!!xWNi^:h@]\=| n؜fgeZ巬$A`1j=&XE+(ԛ$gUy50e x03#suugOe6Z@ 0Ħ#s bMř7 9Iǜ  HZdkNfXJ`مޫ+.bw| wQldS x WmrT1m4."ąD85ׁnw?2@KNR5<.GQYpݩ q+vy%mD?H_R}00cST(]2H/ tM%2稗j(Ưoe4Yzh1B )klFOKԑ}A2T&O1h ,hη{L۳;$3g'w+UkF8aݓ蚃5_;+mC/ϫKٷDrtYr^Cuf<6ՋB@Z6ФgU?JsWTQ:Fr F\UZ !cin{="Wa[9+AdT]9pjkIQ[S^{SgW0>G4? n"J\˳%_2Qv[J 9֎? .ͼ/6'_A*T!48A)\fN1Rr(-8ݭj"֓h`t(mHs,ɞر }al]5,ܵb{-E!ƛyfˈGh ͨʠsԀ"Gp;I( zWh_E 2>݋2^MFHGn ʾa b{,>V901ƽG ,g $23=o/ImS{09@>?O4;g<>zs*q`@QxNܦv:q*y\fוI.̲Q ?YǷfӢP]\ G@LF?j2 AA/`_P1%q\ki5&:4nWJ/ "H"GZ_5s eE˖[*J)nR#&m}Ȏ>_cP7؉En]Z7yua" }tccK^(*W _17%% kttJ[$cq7566)ʱ^N9Er- k tx&aoKysR%3]1.a׏|ǽʎ77c80n@=4w$; F8/|95bũ9ˋ[X1@S0znpՇrOxu &w5.kHw|}z2B+J_M?Q)[ua5[X| G3bcB( jcx6m ̓Z]HxĐD%k޻w!yᜑHP`5DI,Wr}#p!f?ܸݢb1pVd0:8!?%lxQpfӊy.Z,pRC{}r^Ҩ85X||Ff lUA1:-.Kj>9<;ֽ0}'x]MܢC|L_DP.5}G &&G&qx1Fԏh9u=5Yc'KNwI,7>ȒF`Lu|7_;,|,^ɕviq1R2O*qTLί8IԱΖOi'pަU 62uӤeqK4$]WҞm A<b\;A5S<U#p! 1j<\EDſ L^ qkM֬9CeIƿT9|{M6/Clo݆BO7!)3{ K'p}#c*oi0D2K#QSn:gK6bI9KƂQFJGa-go]캫S!lҶ'`wuqKZ/$lU~}< #"Y όgE+ cfsZ)4}-?`{gyxZi Xd!M%h 11qٵx*jjM1{EPX~IR]TWT6T3HŹj2*iB& 5dI3Ou :o[<XswQ01TѠ@E#lwn Kw45OD& ^OPԦ!g]LDZԷx V(<;1mmWU{_;՛( }#&`f"7C[Yh*KN3uXGv]{-.#II&EN¶?'fبj2bJm=RU1Z?%F`z0.vTsNs4zpp YaT:\ dy%غu eYtJ_P hC{aOߌa!|I\TK"Šyu8v"kqյ\a~!TT#.(+iC#\8zF%$trZq<h8Y "R /@y1+#V I+| a]6* 0|; A~_A .أ*N|={.]1!.ŴɊ(@7fG MEnI(-xȴ vz R|g79E-{rf$ 9%oP2Rv&VzԟZVԤ. ڮ%|?,S@0UZPOcډ`y%8E.j)zd-H9Fz#-$67@9J TC\)e3Qkss6q^S.f9|-NjWAa4maa tԘt9TG v=!WА3bi BLx(<`^:oE+> R cMGSa W5mݑj<;ǰ,krGc'az G9686&f pKu.ԆdF0[<]5W4Zaj+va eeL0u-]K kBr绍]B'MCZTjmJ߀V`kU\ِo7x\O, h5ڇ2R3o;ÎH(olEړra/cQ!֋VgZ3=X0N d$?Z;'򵾖{0q"LtOp PVWC=唢em AiIn *f0mؿ!2^ $Ε%X^ArypK7iwP}UfW_ԥf$v!"^8 V)W+MoV g{b*e#˜12 qvvK%n (8Dސͪ%Xd3Z|isV8Yr0Hs gS${0BRhg\+u5ddw,7w/()9UetLS/K΄O)؉JaGx[zaJy_-fGHg QWɨvK4ޅ X6[. VMwY p}ޠQPb6IÃΉ kI$2?y)ha{M+~w4uMc4羄i)Bpg9p'N{Ӊ-fOJT9/ f4\cJ3PG>7YrLjRag7$BX^RU.L^lEtY`˴ {8$.2D~pߎs'O @m[^[fJ88"~RAOrq飲[Jj B&8h5.z>KÕH c䫤k|MRf,`Z.hNMv,HYGwZSUb뽡N2i+uɕyW F%O#E1x&IZW[.2<؟͉He{"XF D7G &[3dulZ(ToCa^g׈lۣơH؀(Z_ -x;C|kxv2eidp|DlƎ v׭Ν At_H*2 oT l1+ıw9*eQ}Sul"^[TaRMM|KP]éMxߒw[;d0$N݃u~?㓥Y'&p3F&4N>_*]S#KI} HI@]qb n2At Dp;Bm[چ?̯$[ fF2|A-I2YJ=XނH2vzDv<2e=.M(Z'wGs$nweI?WNg,5XMnr Ylh5/eNV5'HP% k{Ul 3l*a;;!l`rf)I!,!d ݰFhL.F+x璯~%l6`M^@>o `gG*7`[0RIt0 pR@j!vS?bxolOmfPJCuO6aGw"ycLTo`FԆ1ߖFߚE\Ed,c|ٵra= b::I 6=vJř fSdt(]R+!;HE:\6Aca*9PO޻t+3 t3PTjXS&(*ơJ{O@&g{=FDژK^]]#߮4V6)Z IlG=]Mf9|j0pT !OBew|+ڃ]ݞ^ aqo"RP߱*j/(2 k*$6U=ccĆZ$:i|g׭Vqs2͊lr^#5"'٨ `:O׫L%dI.JYj/Lty0K7 6Mq4YrBm7+ [(Cq鈵f;mX`S) b̵6GEAv97yċV&)g792 (|rf^v_һZAq:VS{ߪ: ,f֪Ѭ.J%m? R6T1(Ga<3Bk[EoF^-bEnhG[Kl8᛽ؖ;Auk' u ks QY5d$D pl7؞zv\;JTBǫR4k)gt{KACV)}[yy;`eRLL˖ 23AG1iӥ_!^:E^IkIr`飚[d~MJÆ`)Kp 2gNkneݪ0O,zW#T*H[ML=]\ʌpILVN8)S*ZMWr?Q s"(okhʖՠIrQ5e6Op %Q^(e]bF6a2?qQ(#z8 +|4i-D-U,JOʮkqlsӭEyx:{e73N%dǢXB˲@Ɓ29]wx)«#QwUtAeW Z)=uOpmj- ;V=ג. AA\ʖliz]ʹ>5]U~ 0*S mj/}[-\zAӾ2.A&b^1U_4?Z._ %:4y2s:DgK<6ljT~02ckHX:L6QDsed~ЎTDx? ˉ@qyt[~Z_t5tZG^?]I8_$.O[2?M\t=g/P=a{ED@3%p,ڂxR3b%2w :l Tu5=it!Փj.lE~i`CN [= S7'@M _!7]9 Y:N#zaqB4+ ˶]Pu I!tWjwbAr if ĺXY1XeMgvt??x!J;H7qKDIP8jXm!= 8xųC6,`\Y^pI9t)".xm{]M Ia #HܕP(}>&Oix=D\nZ}ho2Ǯ~bz`D۞nx;t  -f3ؔ(Rp/Y½S5iz'@$Bn*4իJ&9E@w ?~k 2|-R8-W)- V{oy?4?) ȭpu Fb=ʦK:,ݪ:0%J80)ϲ5[5{(Hwu O' yL6a͞GC;]? 7^o jEvjz™O.p8.1Ϻ]ĺƂ.XН22Nva Nzi'G)o@PC}Z~~3Nz0mcⰦ{6J) }׾ KTyk/_[|(TshV 6[^B$p9hdzI4u>%"i /A;L$SES2Tp/L;GסQ,9}"#bˁy2_T/ 4}5xc[wfg)' &8 ^Z47:G!㝃e ,^u*-у ;5nu]MOKF_/^&c}AԦ4S͢"|‹6Df#=7lk(F'x}>U{-:u7])b&ik!&L_4Seo"eU^^Oŧ\JZm(64Sf 5!֠y&TI! 3tj;Di4(B1*-SoEJ{ihS:VԲcdZwϻOmR7`8 O彮>T7Ӥ!-B<# +99_ f+6O:O&$G5t] K .x +I^ǂ{|DlZx#o 4Lb946qSr}T(_drj8L78̀?h fG~RC8tqKO #-O?ob.TprY9_u!Dj(8Q+4\M`sgB6SaQi(P-e.)iTC߀^.^>ը%j;vZL!?ØϨgBqd"95w^kZ0ʩd9Լ pDAa