
    i&d                        S SK r S SKrS SKrS SKrS SKrS SKJrJrJrJ	r	J
r
JrJrJrJrJrJr  S SKJrJrJrJrJrJr  S SKJrJr  S SKJr  S SKJr  S SKJ r J!r!J"r"J#r#  S SK$J%r%J&r&J'r'  \RP                  " \)5      r*S	r+Sr, S SK-r-S SK.r.S S
K/J0r0Jr  S SK/J1r2  S SK/J3r3J4r4  S	r9Sr: S SK/Jr;  S SK/J&r<  S SK/J=r=J>r>J?r?J@r@  SrASrBSSS\R                  \'S4   4S jrD S1SSS\7S\R                  \   S\R                  \   S\R                  S   4
S  jjrGSSS\R                  \H   4S! jrI  S2S"\HS#\HS$\R                  \J   S%\JSS&4
S' jjrKS(S)S*\R                  S+   SS&4S, jrLS-\7S\H4S. jrM " S/ S0\5      rNg! \5 a(  r6\7" \65      r,Sr+\*Rq                  S\6-  5         Sr6C6NSr6C6ff = f! \5 a)  r6\7" \65      r:Sr9\*Rq                  S\:-  5         Sr6C6GNSr6C6ff = f)3    N)IOVContextProxy
ContextReqGSSMechIOVUnwrapResultIOVWrapResultSecPkgContextSizesUnwrapResultWinRMWrapResult
WrapResultwrap_system_error)
CredentialCredentialCacheKerberosCCacheKerberosKeytabPasswordunify_credentials)to_bytesto_text)GssChannelBindings)GSSError)InvalidCredentialErrorNegotiateOptionsNoContextErrorSpnegoError)
BufferType	IOVBufferIOVResBufferT)ChannelBindingsr   )
exceptions)inquire_sec_context_by_oidset_cred_optionFzEPython gssapi not available, cannot use any GSSAPIProxy protocols: %s)r   )r   )IOVBufferType
unwrap_iovwrap_iovwrap_iov_lengthz-Python gssapi IOV extension not available: %sz1.2.840.113554.1.2.2.5.5z1.2.752.43.13.29iovGSSIOVreturn.c                     / nU  H;  n[        [        UR                  5      UR                  S9nUR	                  U5        M=     [        U5      $ )z7Converts GSSAPI IOV buffer to generic IOVBuffer result.)typedata)r   r   r+   valueappendtuple)r'   buffersibuffer_entrys       E/home/james-whalen/.local/lib/python3.13/site-packages/spnego/_gss.py_create_iov_resultr4   J   sB    G#AFF);!''J|$  >    mechz
gssapi.OIDusagecredentialscontext_reqzgssapi.creds.Credentialsc                 8   [        [        R                  US:X  a  SOS5      n[        U=(       a-    U[        R
                  -  =(       d    U[        R                  -  5      nU GH*  n[        U[        5      (       aa  SnUR                  (       a   [        R                  " UR                  US9nOUS:X  a    g[        R                  " XqU /S9nUR                  n	Us  $ [        U[        5      (       a  US:w  a  [        R                  SU5        M  [         R"                  " 5       n
[         R$                  " U
['        UR(                  5      5      nSnUR*                  (       a*  [         R,                  " U
['        UR*                  5      5      n[        R                  " [/        X5      US9s  $ [        U[0        [2        45      (       a  US:w  a  [        R                  SU5        GM  [        U[0        5      (       a-  UR*                  =(       d    S	n['        UR4                  5      nS
nO#UR                  n[7        UR8                  5      nSn[;        ['        U5      UUUS9n[        R                  " UUS9s  $ [        R                  SU5        GM-     [=        SS9e)a  Gets the GSSAPI credential.

Will get a GSSAPI credential for the mech specified. If the username and password is specified then a new
set of credentials are explicitly required for the mech specified. Otherwise the credentials are retrieved based on
the credential type specified.

Args:
    mech: The mech OID to get the credentials for, only Kerberos is supported.
    usage: Either `initiate` for a client context or `accept` for a server context.
    credentials: List of credentials to retreive from.
    context_req: Context requirement flags that can control how the credential is retrieved.

Returns:
    gssapi.creds.Credentials: The credential set that was created/retrieved.
initiateuserhostbased_serviceNbase	name_type)namer7   mechszCSkipping %s as it can only be used for an initiate Kerberos context)r?   r7    TF)forwardable	is_keytabz@Skipping credential %s as it does not support required mech typez#No applicable credentials availablecontext_msg)getattrgssapiNameTypeboolr   delegatedelegate_policy
isinstancer   usernameNameCredentialslifetimer   logdebugkrb5init_context
cc_resolver   ccache	principalparse_name_flags_gss_acquire_cred_from_ccacher   r   keytab_encode_kerb_passwordpassword_kinitr   )r6   r7   r8   r9   r@   rD   credrY   gss_cred_ctxrX   krb5_principalrO   r^   rE   raw_creds                    r3   _get_gssapi_credentialrf   T   s   * 5J3FL_`I{vj6I6I(I(u[[e[u[uMuwKdO,,I}}"KKT]]iP	*$ ))ydVTH !!AOn--
"		_aef##%C__S(4;;*?@F>BN~~!%!6!6sHT^^<T!U%%+H+`hmnn~x899
"		_aef$//>>/R#DKK0 	==0?!	"'#	H %%85AA IIXZ^_u x !-R
SSr5   c           	          [         R                  nXR                     $ ! [        [        4 a    [        [         S0 5      n Of = f [        R                  R                  U 5      R                  nOI! [         a<  n[        R                  SU R                  < S[        U5      < 35        Sn SnAOSnAff = fX!U R                  '   U[         l        [        U 5      $ )z;Attempts to get the SASL description of the mech specified.resultzgss_inquire_saslname_for_mech(z
) failed: N)_gss_sasl_descriptionrh   dotted_formAttributeErrorKeyErrorrH   rI   rawinquire_saslname_for_mechmech_description	ExceptionrS   rT   str)r6   res	sasl_desces       r3   ri   ri      s    ;#**##$$H% ;+Xr:;JJ88>OO	 		DDTDTVYZ[V\]^	 &#&  &&s'     !AA)A2 2
B8<2B33B8rO   r^   rD   rE   zgssapi.raw.Credsc                 *   [         R                  " 5       nSnSnU(       aK  [         R                  " XA5      nU (       d.  [        U5      S   n[        R                  " UR
                  5      nU(       d  [         R                  " X@5      n[         R                  " U5      n[        [         S5      (       a.  [         R                  " XF5      n	[         R                  " XHSU	5        [         R                  " US5        Ub  [         R                  " X5        U(       a  [         R                  " XFXS9n
O[         R                  " XFXS9n
[         R                  " US5      n[         R                   " XKU5        [         R"                  " XKU
5        [%        US5      $ )	a  Gets a Kerberos credential.

This will get the GSSAPI credential that contains the Kerberos TGT inside
it. This is used instead of gss_acquire_cred_with_password as the latter
does not expose a way to request a forwardable ticket or to retrieve a TGT
from a keytab. This way makes it possible to request whatever is needed
before making it usable in GSSAPI.

Args:
    username: The username to get the credential for.
    password: The password to use to retrieve the credential.
    forwardable: Whether to request a forwardable credential.
    is_keytab: Whether password is a keytab or just a password.

Returns:
    gssapi.raw.Creds: The GSSAPI credential for the Kerberos mech.
Nr   $get_init_creds_opt_set_default_flagss   gss_krb5T)r\   )r^   s   MEMORY)rU   rV   
kt_resolvelistcopyrY   rZ   get_init_creds_opt_allochasattrprincipal_get_realmrv   #get_init_creds_opt_set_canonicalize"get_init_creds_opt_set_forwardableget_init_creds_keytabget_init_creds_passwordcc_new_uniquecc_initializecc_store_credr[   )rO   r^   rD   rE   rc   ktprincfirst_entryinit_optrealmr`   
mem_ccaches               r3   r_   r_      s4   . 


C'+B-1E__S+  r(1+KIIk334E%%c4,,S1Ht;<< ((411#eT,,Xt<//F	))#hJ++CT##C3Js.s-(T::r5   rX   zkrb5.CCacherY   zkrb5.Principalc                    [        [        R                  S5      (       a  [        R                  R	                  [
        R                  R                  5      nSnU(       a@  [        R                  " [        UR                  5      [        R                  R                  S9nU R                  =(       d    SnU R                  (       a  U R                  S-   U-   n[        R                  R                  SU0UU/SS9R                  $ [        R                  R!                  5       n[        R                  R#                  XPR$                  U(       a  UR$                  OSS	9  U$ )
zAcquire GSSAPI credential from CCache.

Args:
    ccache: The CCache to acquire the credential from.
    principal: The optional principal to acquire the cred for.

Returns:
    gssapi.raw.Creds: The GSSAPI credentials from the ccache.
acquire_cred_fromNr>   r5      :s   ccacher;   )rA   rB   r7   )cachekeytab_principal)r{   rI   rm   OIDfrom_int_seqr   kerberosr-   rP   r   rA   rJ   r<   
cache_typer   credsCredskrb5_import_credaddr)rX   rY   r   rA   ccache_namegssapi_credss         r3   r[   r[      s	    vzz.//::**7+;+;+A+AB;;GINN$;vG[G[\Dkk(S ++d2[@Kzz++$*	 , 

 %	 zz'')

##PYinn_c 	$ 	
 r5   r-   c                     / nU  H#  n UR                  UR                  SSS95        M%     SR                  U5      $ ! [         a    UR                  S5         MV  f = f)a  Encode string to use for Kerberos passwords.

Encodes the input string to use with Kerberos functions as a password. This
is a special encoding method to ensure that any invalid surrogate chars are
encoded as the replacement char U+FFFD. This is needed when dealing with
randomly generated passwords like gMSA or machine accounts. The raw UTF-16
bytes can be encoded in a string with the following:

    b"...".decode("utf-16-le", errors="surrogatepass")

The invalid surrogate pairs in the UTF-16 byte sequence will be preserved
in the str value allowing this function to replace it as needed. This
means the value can be used with both NTLM and Kerberos authentication with
the same value.

Args:
    value: The string to encode to bytes.

Returns:
    bytes: The encoded string value.
zutf-8strict)errorss   �r5   )r.   encodeUnicodeEncodeErrorjoin)r-   b_datacs      r3   r]   r]   (  s_    0 F	+MM!((78(<=  88F " 	+MM/*	+s   =AAc                   l  ^  \ rS rSrSrSSSSS\R                  SS\R                  4	S\	R                  \	R                  \\\	R                  \   4      S\	R                  \   S\	R                  \   S	\	R                  \   S
\	R                  \   S\S\S\S\S\	R                   SS4U 4S jjjr\S9S\	R                  \   S\	R                  \   4S jj5       r\S\4S j5       r\S\	R                  \   4S j5       r\S\4S j5       r\S\	R                  \   4S j5       r\\" \S5      S\4S j5       5       rS:S jr\" \S5       S9SS.S\	R                  \   S
\	R                  \   S\	R                  \   4S jjj5       r\" \S5      S\ 4S j5       r!\" \S 5      S;S!\S"\S#\	R                  \"   S\#4S$ jj5       r$\" \S%5        S;S&\	RJ                  \&   S"\S#\	R                  \"   S\'4S' jj5       r(S!\S\)4S( jr*\" \S)5      S!\S\+4S* j5       r,\" \S+5      S&\	RJ                  \&   S\-4S, j5       r.S-\S!\S\4S. jr/\" \S/5      S9S!\S#\	R                  \"   S\4S0 jj5       r0\" \S15      S!\S2\S\"4S3 j5       r1\S\	R                  \	Rd                  \\"4      4S4 j5       r3S5\4SS64S7 jr5S8r6U =r7$ )<GSSAPIProxyiJ  zGSSAPI proxy class for GSSAPI on Linux.

This proxy class for GSSAPI exposes GSSAPI calls into a common interface for Kerberos authentication. This context
uses the Python gssapi library to interface with the gss_* calls to provider Kerberos.
Nr;   r   rO   r^   hostnameservicechannel_bindingsr9   r7   protocoloptionskwargsr)   c
           
        > [         (       d  [        S[        -  5      e[        X5      n[        [
        U ]  XXEXgX5        [        R                  R                  [        R                  R                  5      U l        U
R                  SS 5      nU(       d!   [        U R                  U R                   UUS9nU[&        R(                  -  (       aj  U R                   S:X  aZ  Uc*  [        R*                  " U R                   U R                  /S9n[-        [        R                  R                  [.        5      U5        Xl        S U l        g ! ["         a  n[%        USS9UeS nAff = f)Nz2GSSAPIProxy requires the Python gssapi library: %s_gssapi_credential)r8   r9   zGetting GSSAPI credential)
base_errorrG   r;   )r7   rB   )
HAS_GSSAPIImportErrorGSSAPI_IMP_ERRr   superr   __init__rI   r   r   r   r   r-   _mechgetrf   r7   r   r   r   no_integrityrQ   r"   _GSS_KRB5_CRED_NO_CI_FLAGS_X_credential_context)selfrO   r^   r   r   r   r9   r7   r   r   r   r8   gssapi_credentialgss_err	__class__s                 r3   r   GSSAPIProxy.__init__Q  s0    zRUccdd';k4)7kRZ	
 ZZ,,W-=-=-C-CD
"JJ';TB l$:JJJJ + +	%! 000TZZ:5M ($*$6$6TZZPTPZPZ|$\!

''(DE!
 -AE  l!WB]^dkkls    E 
E EE c                     / nU(       a#  U[         R                  -  (       a  [        (       a  UR                  S5        U$ Nr   )r   wrapping_winrmHAS_IOVr.   )clsr   avails      r3   available_protocolsGSSAPIProxy.available_protocols  s/     G&6&E&EEggLL$r5   c                     [         $ N)r   )r   s    r3   iov_availableGSSAPIProxy.iov_available  s    r5   c                     U R                   (       a>  U R                  S:X  a.  [        U R                   R                  5      R	                  S5      $ g )Naccept )r   r7   r   initiator_namerstripr   s    r3   client_principalGSSAPIProxy.client_principal  s9     ==TZZ834==778??GGr5   c                 X    U R                   S L=(       a    U R                   R                  $ r   )r   completer   s    r3   r   GSSAPIProxy.complete  s     }}D(CT]]-C-CCr5   c                     gr    r   s    r3   negotiated_protocolGSSAPIProxy.negotiated_protocol  s    r5   zRetrieving session keyc                     U R                   (       a:  [        U R                   [        R                  R	                  [
        5      5      S   $ [        SS9e)Nr   z;Retrieving session key failed as no context was initializedrF   )r   r!   rI   r   r   _GSS_C_INQ_SSPI_SESSION_KEYr   r   s    r3   session_keyGSSAPIProxy.session_key  s>     ==-dmmVZZ=T=TUp=qrstuu -jkkr5   c                     [        U R                  U R                  U R                  U R                  U R
                  U R                  U R                  U R                  S9$ )N)r   r   r   r9   r7   r   r   r   )	r   	_hostname_servicer   r9   r7   r   r   r   r   s    r3   new_contextGSSAPIProxy.new_context  sM    ^^MM!22((**]]LL#//	
 		
r5   zProcessing security token)r   in_tokenc                   U R                   (       dA  [        R                  S[        R                  " U=(       d    S5      R                  5       5        U R                  (       Gd  0 nU=(       d    U R                  nU(       aB  [        UR                  UR                  UR                  UR                  UR                  S9US'   U R                  S:X  a}  U R                  =(       d    S< SU R                   =(       d    S< 3n["        R$                  " U["        R&                  R(                  S	9US
'   U R*                  US'   U R,                  US'   ["        R.                  " SU R0                  U R                  S.UD6U l        U R                  R3                  U5      n [5        U R                  R6                  5      U l        U R                   (       dA  [        R                  S[        R                  " U=(       d    S5      R                  5       5        U$ ! [:        R<                   a    U R                  R>                  (       a  e  Nf = f)NzGSSAPI step input: %sr5   )initiator_address_typeinitiator_addressacceptor_address_typeacceptor_addressapplication_datar   r;   host@unspecified)r@   rA   r6   flags)r   r7   zGSSAPI step output: %sr   ) _is_wrappedrS   rT   base64	b64encodedecoder   r   r   initiator_addrtyper   acceptor_addrtyper   r   r7   r   r   rI   rP   rJ   r=   r   _context_reqSecurityContextr   stepintactual_flags_context_attr
gss_errorsMissingContextErrorr   )r   r   r   context_kwargsspn	out_tokens         r3   r   GSSAPIProxy.step  s    II-v/?/?C/P/W/W/YZ}}};=N/H43H3H5D+;+N+N&6&H&H*:*L*L%5%F%F%5%F%F612 zzZ'!%!8&!8$..:YM:YZ)/SFOODeDe)fv&)-v&*.*;*;w'"22n9I9IQUQ[Q[n_mnDMMM&&x0		!$T]]%?%?!@D II.0@0@AQc0R0Y0Y0[\ -- 	
 }}%% &	s    $H 0I
IzGetting context sizesc                     U R                   (       d	  [        SS9e[        [        R                  SSS9n[        U R                   U5        [        [        US   R                  =(       d    S5      S9$ )Nz;Cannot get message sizes until context has been establishedrF   r5   F)
std_layoutr   )header)	r   r   r(   r#   r   r&   r	   lenr-   )r   r'   s     r3   query_message_sizesGSSAPIProxy.query_message_sizes  s[    }} -jkk  

 	s+!SV\\-@S)ABBr5   zWrapping datar,   encryptqopc                     U R                   (       d	  [        SS9e[        R                  R	                  U R                   XUS9n[        UR                  UR                  S9$ )N.Cannot wrap until context has been establishedrF   confidentialr  )r,   	encrypted)r   r   rI   rm   wrapr   messager	  )r   r,   r  r  rr   s        r3   r
  GSSAPIProxy.wrap  sF    }} -]^^jjoodmmTSoQs{{cmmDDr5   zWrapping IOV bufferr'   c                     U R                   (       d	  [        SS9eU R                  XR                  5      n[	        USS06n[        U R                   XRUS9n[        [        U5      US9$ )Nr  rF   r   Fr  )r0   r	  )r   r   _build_iov_list_convert_iov_bufferr(   r%   r   r4   )r   r'   r  r  r0   
iov_bufferr	  s          r3   r%   GSSAPIProxy.wrap_iov  sb     }} -]^^&&s,D,DEW77
T]]JRUV	%7
%CyYYr5   c                 2   U R                  [        R                  U[        R                  /5      R                  nUS   R
                  =(       d    SnUS   R
                  =(       d    SnUS   R
                  =(       d    Sn[        X4U-   [        U5      S9$ )Nr   r5         )r   r,   padding_length)r%   r   r   paddingr0   r,   r   r   )r   r,   r'   r   enc_datar  s         r3   
wrap_winrmGSSAPIProxy.wrap_winrm  sx    mmZ..j6H6HIJRRQ#q6;;%#a&++$fg3EVYZaVbccr5   zUnwrapping datac                     U R                   (       d	  [        SS9e[        R                  R	                  U R                   U5      n[        UR                  UR                  UR                  S9$ )N0Cannot unwrap until context has been establishedrF   )r,   r	  r  )	r   r   rI   rm   unwrapr
   r  r	  r  )r   r,   rr   s      r3   r  GSSAPIProxy.unwrap  sJ    }} -_``jjt4377SSr5   zUnwrapping IOV bufferc                     U R                   (       d	  [        SS9eU R                  XR                  5      n[	        USS06n[        U R                   U5      n[        [        U5      UR                  UR                  S9$ )Nr  rF   r   F)r0   r	  r  )
r   r   r  r  r(   r$   r   r4   r	  r  )r   r'   r0   r  rr   s        r3   r$   GSSAPIProxy.unwrap_iov  so    
 }} -_``&&s,D,DEW77

3'9*'EQTQ^Q^dgdkdkllr5   r   c                 p   U R                   (       d	  [        SS9e[        U R                   R                  5      nU(       aZ  US:X  aT  U R	                  [
        R                  U4U[
        R                  /5      R                  nUS   R                  =(       d    S$ U R                  X-   5      R                  $ )Nr  rF   s   Kerberos 5 GSS-API Mechanismr  r5   )
r   r   ri   r6   r$   r#   r   r,   r0   r  )r   r   r,   rs   r'   s        r3   unwrap_winrmGSSAPIProxy.unwrap_winrm%  s     }} -_``)$--*<*<=	 &EE//M$8$8&#A4I[I["\]eeCq6;;%#% ;;v}-222r5   zSigning messagec                     U R                   (       d	  [        SS9e[        R                  R	                  U R                   XS9$ )Nz.Cannot sign until context has been establishedrF   )r  )r   r   rI   rm   get_mic)r   r,   r  s      r3   signGSSAPIProxy.sign;  s3    }} -]^^zz!!$--!??r5   zVerifying messagemicc                     U R                   (       d	  [        SS9e[        R                  R	                  U R                   X5      $ )Nz0Cannot verify until context has been establishedrF   )r   r   rI   rm   
verify_mic)r   r,   r'  s      r3   verifyGSSAPIProxy.verifyB  s0    }} -_``zz$$T]]D>>r5   c           
         [         R                  S4[         R                  S4[         R                  S4[         R                  S4[         R
                  S4[         R                  S4[         R                  S4[         R                  S4[         R                  S	4/	n/ nU HQ  u  p4[        [        R                  U5      (       d  M&  UR                  U[        [        R                  U5      45        MS     U$ )
Ndelegate_to_peermutual_authenticationreplay_detectionout_of_sequence_detectionconfidentiality	integrity	dce_styleidentifyok_as_delegate)r   rL   mutual_authreplay_detectsequence_detectr1  r2  r3  r4  rM   r{   rI   RequirementFlagr.   rH   )r   attr_mapattrsspnego_flaggssapi_names        r3   _context_attr_mapGSSAPIProxy._context_attr_mapI  s       "45##%<=%%'9:'')DE''):;!!;/!!;/  *-'')9:
 (0$Kv--{;;k763I3I;+WXY )1 r5   bufferGSSIOVBufferc                 2   S nSn[        UR                  [        5      (       a  UR                  nO[        UR                  [        5      (       a  UR                  nOm[        UR                  [        5      (       a  SUR                  -  nO>[
        R                  [
        R                  [
        R                  /nUR                  U;   nUR                  nUR                  [
        R                  :X  a  [
        R                  n[        [        U5      X25      $ )NF    )rN   r,   bytesrK   r   r   r   r  trailerr+   data_readonlyemptyrA  r#   )r   r@  buffer_databuffer_alloc
auto_allocbuffer_types         r3   r  GSSAPIProxy._convert_iov_buffer_  s    fkk5)) ++KT**!;;LS))!FKK/K$++Z-?-?ASASTJ!;;*4Lkk;;*222 %**KM+6RRr5   )r   r   r   r   r   )r)   r   )TN)8__name__
__module____qualname____firstlineno____doc__r   defaultr   nonetypingOptionalUnionrq   r   Listr   Anyr   classmethodr   rK   r   propertyr   r   r   r   NativeErrorrD  r   r   r   r	   r  r   r   r
  Iterabler   r   r%   r   r  r
   r  r   r$   r!  r%  r*  Tupler>  r   r  __static_attributes____classcell__)r   s   @r3   r   r   J  s|    ]a)-)-(,@D","4"4"$4$9$9-F//&,,sJJ@W/W"XY-F //#&-F //#&	-F
 %-F !//*<=-F  -F -F -F "-F **-F 
-F -F^ &//:J*K W]WbWbcfWg   d   &//#"6   D$ D D V__S%9   {$<=lU l > l

 {$?@ ,0- AE	-//%(- !//*<=	-
 
	- A-^ {$;<
C%7 
C =
C {O4E E E6??3;O E[e E 5E {$9: $(	Z__S!Z Z __S!	Z
 
Z ;Zdu d d {$56T5 T\ T 7T {$;<m__S!m 
m =m35 3 3% 3, {$56@ @V__S%9 @U @ 7@ {$78?5 ?u ? ? 9? 6;;v||JO/L#M  *S) S S Sr5   r   r   )NF)Or   ry   loggingsysrT  spnego._contextr   r   r   r   r   r   r	   r
   r   r   r   spnego._credentialr   r   r   r   r   r   spnego._textr   r   spnego.channel_bindingsr   spnego.exceptionsr   r[  r   r   r   r   
spnego.iovr   r   r   	getLoggerrM  rS   r   r   rI   rU   
gssapi.rawr   r    r   r!   r"   r   rt   rq   rT   r   GSSAPI_IOV_IMP_ERRr(   rA  r#   r$   r%   r&   r   r   r]  r4   rW  rU  rf   rD  ri   rK   r_   r[   r]   r   r   r5   r3   <module>rk     sQ      
      + 6 5  ; :!
	[43F  T(4OO 9 1 H lC6G)H  04	TT
TTTT Z(TT ,	TT
 __/0TTn' '1G '. *.	=;=;=; &=; 	=;
 =;@&&/0& &R
DkS, kSm  [VNJIIUXYYZZ[  TQGII=@RRSSTs0    E3 #F$ 3F!9FF!$G*GG