From e2d292d5baa28a7c5b41f13ced705d1f8d2712c9 Mon Sep 17 00:00:00 2001
From: Piotr Darosz <piotr.darosz@nokia.com>
Date: Wed, 29 Aug 2018 10:33:54 +0200
Subject: [PATCH] VID Internal HTTPS

Use HTTPS for internal VID interfaces

Change-Id: I72260cd10c4d83e84f639798f4e4ebb738f6f4aa
Issue-ID: VID-273
Signed-off-by: Piotr Darosz <piotr.darosz@nokia.com>
---
 .../main/docker/assembly/assembly-for-plugin.xml   |  14 ++
 deliveries/src/main/docker/docker-files/Dockerfile |  14 +-
 epsdk-app-onap/src/main/resources/server.xml       | 186 +++++++++++++++++++++
 .../src/main/webapp/WEB-INF/cert/org.onap.vid.jks  | Bin 0 -> 3573 bytes
 4 files changed, 212 insertions(+), 2 deletions(-)
 create mode 100644 epsdk-app-onap/src/main/resources/server.xml
 create mode 100644 epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks

diff --git a/deliveries/src/main/docker/assembly/assembly-for-plugin.xml b/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
index 35c20335..27bcdb2c 100755
--- a/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
+++ b/deliveries/src/main/docker/assembly/assembly-for-plugin.xml
@@ -26,6 +26,20 @@
 			<directory>src/main/scripts</directory>
 			<outputDirectory>scripts</outputDirectory>
 		</fileSet>
+		<fileSet>
+			<includes>
+				<include>server.xml</include>
+			</includes>
+			<directory>../epsdk-app-onap/src/main/resources</directory>
+			<outputDirectory>config</outputDirectory>
+		</fileSet>
+		<fileSet>
+			<includes>
+				<include>org.onap.vid.jks</include>
+			</includes>
+			<directory>../epsdk-app-onap/src/main/webapp/WEB-INF/cert</directory>
+			<outputDirectory>config</outputDirectory>
+		</fileSet>
 	</fileSets>
 	
 </assembly>
diff --git a/deliveries/src/main/docker/docker-files/Dockerfile b/deliveries/src/main/docker/docker-files/Dockerfile
index a347659a..01031823 100755
--- a/deliveries/src/main/docker/docker-files/Dockerfile
+++ b/deliveries/src/main/docker/docker-files/Dockerfile
@@ -1,10 +1,12 @@
 FROM tomcat:8.0-jre8
 # add vim and uncomment alias to speedup troubleshooting purpose
 RUN apt-get update && apt-get install -y \
-	openjdk-8-jdk vim
+	openjdk-8-jdk vim net-tools
 
 RUN sed -i 's/# alias/alias/g' /root/.bashrc
 
+RUN mkdir -p ${ROOT_DIR}/etc
+
 ENV JAVA_OPTS="-Xmx1536m -Xms1536m"
 
 ENV ROOT_DIR /opt/app/vid
@@ -52,7 +54,7 @@ ENV VID_ECOMP_SHARED_CONTEXT_REST_URL http://portal.api.simpledemo.onap.org:8989
 ENV VID_CONTACT_US_LINK https://todo_contact_us_link.com
 
 ENV VID_DECRYPTION_KEY AGLDdG4D04BKm2IxIWEr8o=
-ENV VID_UEB_URL_LIST ueb.api.simpledemo.onap.org 
+ENV VID_UEB_URL_LIST ueb.api.simpledemo.onap.org
 ENV VID_UEB_CONSUMER_GROUP VID
 ENV VID_ECOMP_PORTAL_INBOX_NAME ECOMP-PORTAL-INBOX
 ENV VID_UEB_APP_KEY 2Re7Pvdkgw5aeAUD
@@ -70,6 +72,14 @@ ENV VID_MYSQL_USER vidadmin
 ENV VID_MYSQL_MAXCONNECTIONS 5
 ENV VID_MYSQL_PASS Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
 
+ENV VID_KEYSTORE_FILENAME ${ROOT_DIR}/etc/org.onap.vid.jks
+ENV VID_KEYSTORE_PASSWORD Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U
+ENV VID_TOMCAT_PATH /usr/local/tomcat/conf/
+ENV CATALINA_OPTS "-Dvid.keystore.password=${VID_KEYSTORE_PASSWORD} -Dvid.keyalias=vid@vid.onap.org -Dvid.keystore.filename=${VID_KEYSTORE_FILENAME}"
+
+ADD maven/config/org.onap.vid.jks ${VID_KEYSTORE_FILENAME}
+ADD maven/config/server.xml ${VID_TOMCAT_PATH}
+
 ADD maven/scripts/*.sh /tmp/vid/
 ADD maven/artifacts/vid.war /tmp/vid/stage/
 
diff --git a/epsdk-app-onap/src/main/resources/server.xml b/epsdk-app-onap/src/main/resources/server.xml
new file mode 100644
index 00000000..2a1bab5a
--- /dev/null
+++ b/epsdk-app-onap/src/main/resources/server.xml
@@ -0,0 +1,186 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ -->
+<Server port="8005" shutdown="SHUTDOWN">
+  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+  <!-- Security listener. Documentation at /docs/config/listeners.html
+  <Listener className="org.apache.catalina.security.SecurityListener" />
+  -->
+  <!--APR library loader. Documentation at /docs/apr.html -->
+  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+  <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
+  <GlobalNamingResources>
+    <!-- Editable user database that can also be used by
+         UserDatabaseRealm to authenticate users
+    -->
+    <Resource name="UserDatabase" auth="Container"
+      type="org.apache.catalina.UserDatabase"
+      description="User database that can be updated and saved"
+      factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+      pathname="conf/tomcat-users.xml" />
+  </GlobalNamingResources>
+
+  <!-- A "Service" is a collection of one or more "Connectors" that share
+       a single "Container" Note:  A "Service" is not itself a "Container",
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
+   -->
+  <Service name="Catalina">
+
+    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+    <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+
+
+    <!-- A "Connector" represents an endpoint by which requests are received
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+    -->
+    <Connector port="8080" protocol="HTTP/1.1"
+      connectionTimeout="20000"
+      redirectPort="8443" />
+    <!-- A "Connector" using the shared thread pool-->
+    <!--
+    <Connector executor="tomcatThreadPool"
+               port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443" />
+    -->
+    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation that requires the JSSE
+         style configuration. When using the APR/native implementation, the
+         OpenSSL style configuration is required as described in the APR/native
+         documentation -->
+
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
+      maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
+      clientAuth="false" sslProtocol="TLS" keyAlias="${vid.keyalias}"
+      keystoreFile="${vid.keystore.filename}" keystorePass="${vid.keystore.password}"
+      useServerCipherSuitesOrder="true"
+      ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+                TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+                TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
+                TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
+                TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
+                TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
+                TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
+                TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+                TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+                TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
+                TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
+                TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
+                TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+                TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
+                TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+                TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
+                TLS_ECDH_RSA_WITH_RC4_128_SHA,
+                TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS_RSA_WITH_AES_256_GCM_SHA384,
+                TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+                TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                TLS_RSA_WITH_AES_128_GCM_SHA256,
+                TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+                TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
+                TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+                TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+                TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
+                TLS_EMPTY_RENEGOTIATION_INFO_SCSVF"
+    />
+
+
+    <!-- Define an AJP 1.3 Connector on port 8009 -->
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
+
+
+    <!-- An Engine represents the entry point (within Catalina) that processes
+         every request.  The Engine implementation for Tomcat stand alone
+         analyzes the HTTP headers included with the request, and passes them
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
+
+    <!-- You should set jvmRoute to support load-balancing via AJP ie :
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+    -->
+    <Engine name="Catalina" defaultHost="localhost">
+
+      <!--For clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+      <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->
+
+      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+      <Realm className="org.apache.catalina.realm.LockOutRealm">
+        <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+          resourceName="UserDatabase"/>
+      </Realm>
+
+      <Host name="localhost"  appBase="webapps"
+        unpackWARs="true" autoDeploy="true">
+
+        <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
+        <!--
+        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+        -->
+
+        <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html
+             Note: The pattern used is equivalent to using pattern="common" -->
+        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+          prefix="localhost_access_log" suffix=".txt"
+          pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+
+      </Host>
+    </Engine>
+  </Service>
+</Server>
+
diff --git a/epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks b/epsdk-app-onap/src/main/webapp/WEB-INF/cert/org.onap.vid.jks
new file mode 100644
index 0000000000000000000000000000000000000000..aab34aebe4088deb7a4523f4970a70ac09e4ce10
GIT binary patch
literal 3573
zcmb`Kc|25o`^V?Zj0rQyR+cRB6EVga#u9Zige;L5L^7Bm`z|3FG|AFU)+S`hnn;u-
z*|LT#xkbvJ2)C>wOY?Bw&vXBJp6B;_{a(-O_50&`o%1>0<y_}=UDx~io*zp;mLL!a
zbl-qK>~MfHNn_tIo*s5y7*8Lk{Q>f=IE6(Bgb4t{;d>xEf>j0qzyWC}Cjc-(;NkFj
ztKxpsy2r1Bv)iW-GC{<uWmi7Et@NP94`);c-c8WZvc#U}-?X84#DG-1bXCY5`Pu25
zt<J&$%=2$^zG|D8TM;5e%Jy+%NRNkp^K_oBuI_J^!0?dLsw%`zz!HDkm)AdVe!jA`
zrm#y})9OL}^W?d5Ibj}ke!9p_!(D~~v0U78)T1hD;;h!CMxw_R&%Ud3GSfRIF!bwy
zw^-0-rzmhfutI?ixeTXP)ZPpPjGo{et4Q*0X*pdvNE4ov_t(4i<>KvqtD?kNGU8>f
z#usE_b`<5XGn3ac34(h(g~BM+;eqq-S^6OhmgAmI3!#|NVD@Ak){;wPl45%-mG2bY
zEGw%^Nz_Hzv;0y@U(;BsT`}6z#kOUxzs?NA6q+9)-sm}D<8n0~9^f7}(bCiQiSNFs
z+ZLMaFZcF=v!3vAr@ZoxU+8O}Ebg}t2#iE?PNoi?gf$EYrPL+4D@I;Ss>fbWub}GX
zGnc3Lm8<26V$W++tK%`Ze#vymT4{z^NUy#U5A!CPtA5UYiN60y>7_a#?wXKmF^oxJ
zaJpUTKNH)hyj~Dg*J1t0a#slu(BTr;Y?-`_UcQ5=5iiU@r#8(D4(yKD)8`y+tCdVR
zN1kI3tEMJDDsB|J;)QD2dq87m-en%mE30rm`7o;8kemkz?wnF|_?{>mlgl&R*0YR>
zeRh|4Dn~?mZ4H<H>ldadMa7r+nnRH-g7^<X>pjMh7fTnDJ8%lrO<F5xMHsf(n$dFY
zG!Ja^d^%>QBmA`+oD4OUlnDFYsK|>oy7#OYko$t$+~797A&E>mUxZDZ_>7MWAvPzq
zUyCz+BjOsph!L5w_jjxliX<<5AP;6tyA_0;p&N6qX5=j_qJr8!LRfwE2vRbT;_m1-
zAFs(@i9|h9Uo~|4T}dt)^?|>mH@YT@COBStT+-5_AeBhjon`72*!b={>S=#0i8&x9
z#QmP$&=@Q0*wA3RNjL3y;|^n%Tr|6h@6?R;IqR2L^wt$)AV{#_x$@(8={o^(+_9WZ
z`Z7WZ9Q;;?v={yNe%y)E^b^Ltv@RHWriN8R#n+h5t%a-{LO3l=Zh0V#>QlJ9_aqzZ
z5~O#e?k4&OK#GW!57jyLw%_tU>pl9wt^MjXhH3M!*IMgCcOg$cu`A&OWm@7trMlnu
z7?K9qH7gP|dYaWPeGIr3HEP6`jPgH~uXUP0q*DFapKp6tXJN&mXJ|D}m-EHPz9sv6
zsHAbJuFy5lDfE`H0)6F;@8g&`^Cn*@+8aA`FzmB?MAWU*$9RX$s)H2ueepCG|ER^P
zU$gT%QjFT6#`iF|LmJy9j)LCSFItTx$2u5nwN-O2i#i=8-qCV)5}TK&)=_!EyE<QO
zrBunOkxyQtNA&K+d|*F0!t1e~7LbX{5_VcaJ>Lj#kz1p$F-S48%10N?pUT)dr;S{9
zLsxBZHekH7%*1836^7`E^A{dVi<*G%lRfq#g)fu|nlIBjPb@1>nvZw9dV$JTYD+&y
zD)x0ORml&nEr8=p7V9bmI1?=?@dYJxrasf$UR&jJIK_&uw|)6$%$G<Q_sV3O2*vax
zs`^Qyg7b$X6V2!4rJ03rSGKHU+g#;0G5IiF2Cu4%!<Y5+--HT2)p+0PHyXEUq7UeH
zNe1TEX-AQ=FFO8#N+wH;B6tb{fs5?(P!J4<!Lndb019Ph8{)o^c0!E=vLRTcspqJ4
zHUK~}K|ozB5@bQZ2yg^9lwgWw1Ca-U6$Ljo!e79$gQx?EL@^ng;_*6Ie(>mlhM^8S
zd-#!k+{q+oJ3q1(-c}hDKFWqw0afHxuvmF{5VYEtr$G6?B<P4mfvkTnhV3&P%kh&Z
zEWi=SKlVnV{tfg0=ElEx`STZm;egmrJ0ElbSUA7|*?-Oo4F>?o0~vyB9anCix?_Pj
zg2~1_fE}{Oy(s3}$iyE;#^%p#oCkqQ^o`It9<>Hk!xL~N>xLA6asz>o|Am`t)!5^-
z|0rlsp{IK@hmWAAOWf<wPYu=>(_5<g-C(|+I($#!kZ}oaayn<uR?>vG(h>Hmrd%}T
zw6x22s*TpbikVB(U7c!;IgOL!1_>M%>}=`&xm>1xnLTV}s?*RCmA>C92g4@RWoZsj
zl2Z)zYQ((fg%Y<?H|WZ+MDDHD$C*M4imIm_B4VL24sqJWNA^1JDnL|E^m}h4mZ9t;
zIlUvf(b%WkZ_@2?&PULN5g8{VJ;WoG3ROprbBL=q@kZW)!T<=6OIZLZbAJS0h#L+C
zA^V*ZMiAlv00tZmgECEkq6b>yKpz2l5X}2sm5J#P4EXB~3Ys0v5Qm=!4Z?Uh4)c6@
z=R|LLjPy{5A}dCFC2A#RgO4yE`ag+XIKTu79qh^uKLY1zPDxIT6RDy5^9HDd<NBt+
zWZhK|cQDKemjz|Q53(ryzYdNAc3#dHUuSnOH!_Lr?)lg0K=dC+g`e|bKj-)J0e~dL
zuWM*AKxnLm;WG4jN{=?n<*wZY%f{wo=Sv%ooiYjj4Qb&M^u`G3X*lzM_p?J*(DKxw
zdRZu|c66q;Z_FWw`0-Wriy8Z~GPy#a>=(vN?N@g$f_mO0`^1AFO2jx(OKkN0+IFn#
zrLaj)58>O^lws0^4t^!>@$=C&HTo=kQ@?j3Prhz-1pNo|>#}M5Qzd?5a}5jZzdoh2
z4pW-BBCm#?L>69H%B4npkn_T**K)3Ha(wivKO77>4U2<BpCYFnwaBM1z6&0{F`!|w
zNu!ZCiQt~~v8Y|P9XX4u$u3qJzj$a1C!~wnqP|srBSS+1nx+QtGtXZXvYzUL{6&iE
z`=sy(!=W~Rl43sw|AL7BD29LMfHEk*&jBTc0}jY5fd4K3|A6y<6?z}g=3bZSFwIIM
z1tsl{Ao`@nlW<z&B9@b7;S1NiYfh&)Wy|7=<`hPP8W7t8zi_EsqlC=Hdma;$*q~c7
zLiNZuwL3Cn@O-cPDoG14SStaRRBc$wF6$M;CYc!cI;6SACm;kdySy>w{-R^Br)6WW
zzdF}9@AlifKYEvjTwabTYf$VO`{Ik_b>F;k{tmUWsuxs^v19g=p+3o6j3Tqol)cNC
z?s_L9q4(A>)*yRKWVy;%mL+ZdY=lBmoQ9PBdO&=flI$1lj1S+*!xRnT(ez5R`DATc
z!gx7f-wtkMgx#WInc_>AI5%S6`>eRA+dbEDekCFW>1SoD-1GNBr-GD-pQ`GAs#H+q
z&r;?CkA(4<5)@Vq7Wz!en*wP~QrO_-uS<F$*TDqt0~#=ci2Vx`0REX60QJvzNc^w3
z_~)d8g+l>Ixj|R7PnV~x)|PFOG-D@Ly7-9>HYL%`kN>%!I%>?GIlp7hsK#s*{Zy`>
zqae(Vd2B&kNAS$e2&<)phl18mH8ZFSXJ1vej7Uz*KMCFF->EukC6LitRD3mdJHx5g
zA$;Jtkfrb=`^)dzA6D?BEKHVto-M%#IxU6J$a{u2lBL{WUpU*+3R2mxFJ;Ac*VZ<M
zK*cHuL9+s(u>kzc>&JDMi<ZTr%JA;Jn2U+nXRT(!O_P*eI==5jpcDF`>1ShVm#N^4
z3qjfkM+#3m%VEtB5j3+bH||-fMasH=wrPXETC`B0!*T@+g6svpr5n%mw&mEko|bM|
zEM-yuVL*rGY`xL<e3*I4GFg1_oCl;VnkIxti&nlqxjJ(AlAY<^FiZ$j$g}7z8R2OD
z^mxY2b)<CiqAQY<p^y47!983MaR*)9PZ|#n$|>c#0eNhD@67pH!~ElKyw|Jz6J9O2
zq`q75>72zs(oA2fiH5tHXqKaRdN+jcc~uU$6o@2m<xmp9PR@?)ptZS_`wC=}JX=!-
zGi8LmSmPc`-4osPSEZjGUrtm)Xg>Q4!0TPM_?$-h5c@wAggou0y$fc<_upRvY{fjl
z*V4B%3FQrQ#`p_cPWw8V+VjEr7pdmet+A@dZVsG|E*4e0INJKr3)d|#o}4Xo`vSsH
b@uU9JqlwPVygXVnw<yKk4MVIO+){r7S<lH~

literal 0
HcmV?d00001

-- 
2.16.6