From 8711fd344a9f31e793d287edfe456608a4950717 Mon Sep 17 00:00:00 2001 From: github-actions Date: Thu, 8 Feb 2024 23:49:24 +0000 Subject: [PATCH] dist-docs: Update OVN branch-23.06 manpages --- .../support/dist-docs-branch-23.06/index.html | 26 + .../dist-docs-branch-23.06/ovn-appctl.8 | 186 + .../dist-docs-branch-23.06/ovn-appctl.8.html | 224 + .../dist-docs-branch-23.06/ovn-appctl.8.pdf | Bin 0 -> 29566 bytes .../dist-docs-branch-23.06/ovn-appctl.8.txt | 222 + .../dist-docs-branch-23.06/ovn-architecture.7 | 1207 +++++ .../ovn-architecture.7.html | 2173 +++++++++ .../ovn-architecture.7.pdf | Bin 0 -> 135979 bytes .../ovn-architecture.7.txt | 2171 +++++++++ .../ovn-controller-vtep.8 | 110 + .../ovn-controller-vtep.8.html | 142 + .../ovn-controller-vtep.8.pdf | Bin 0 -> 25699 bytes .../ovn-controller-vtep.8.txt | 140 + .../dist-docs-branch-23.06/ovn-controller.8 | 439 ++ .../ovn-controller.8.html | 784 ++++ .../ovn-controller.8.pdf | Bin 0 -> 59375 bytes .../ovn-controller.8.txt | 782 ++++ .../support/dist-docs-branch-23.06/ovn-ctl.8 | 426 ++ .../dist-docs-branch-23.06/ovn-ctl.8.html | 349 ++ .../dist-docs-branch-23.06/ovn-ctl.8.pdf | Bin 0 -> 31888 bytes .../dist-docs-branch-23.06/ovn-ctl.8.txt | 347 ++ .../dist-docs-branch-23.06/ovn-detrace.1 | 273 ++ .../dist-docs-branch-23.06/ovn-detrace.1.html | 81 + .../dist-docs-branch-23.06/ovn-detrace.1.pdf | Bin 0 -> 21824 bytes .../dist-docs-branch-23.06/ovn-detrace.1.txt | 79 + .../dist-docs-branch-23.06/ovn-ic-nb.5 | 397 ++ .../dist-docs-branch-23.06/ovn-ic-nb.5.html | 374 ++ .../dist-docs-branch-23.06/ovn-ic-nb.5.pdf | Bin 0 -> 38662 bytes .../dist-docs-branch-23.06/ovn-ic-nb.5.txt | 372 ++ .../dist-docs-branch-23.06/ovn-ic-nbctl.8 | 424 ++ .../ovn-ic-nbctl.8.html | 639 +++ .../dist-docs-branch-23.06/ovn-ic-nbctl.8.pdf | Bin 0 -> 53535 bytes .../dist-docs-branch-23.06/ovn-ic-nbctl.8.txt | 637 +++ .../dist-docs-branch-23.06/ovn-ic-sb.5 | 656 +++ .../dist-docs-branch-23.06/ovn-ic-sb.5.html | 600 +++ .../dist-docs-branch-23.06/ovn-ic-sb.5.pdf | Bin 0 -> 52130 bytes .../dist-docs-branch-23.06/ovn-ic-sb.5.txt | 598 +++ .../dist-docs-branch-23.06/ovn-ic-sbctl.8 | 412 ++ .../ovn-ic-sbctl.8.html | 627 +++ .../dist-docs-branch-23.06/ovn-ic-sbctl.8.pdf | Bin 0 -> 53219 bytes .../dist-docs-branch-23.06/ovn-ic-sbctl.8.txt | 625 +++ .../support/dist-docs-branch-23.06/ovn-ic.8 | 211 + .../dist-docs-branch-23.06/ovn-ic.8.html | 310 ++ .../dist-docs-branch-23.06/ovn-ic.8.pdf | Bin 0 -> 38755 bytes .../dist-docs-branch-23.06/ovn-ic.8.txt | 308 ++ .../support/dist-docs-branch-23.06/ovn-nb.5 | 3665 +++++++++++++++ .../dist-docs-branch-23.06/ovn-nb.5.html | 4100 +++++++++++++++++ .../dist-docs-branch-23.06/ovn-nb.5.pdf | Bin 0 -> 211737 bytes .../dist-docs-branch-23.06/ovn-nb.5.txt | 4098 ++++++++++++++++ .../dist-docs-branch-23.06/ovn-nbctl.8 | 1075 +++++ .../dist-docs-branch-23.06/ovn-nbctl.8.html | 1718 +++++++ .../dist-docs-branch-23.06/ovn-nbctl.8.pdf | Bin 0 -> 111075 bytes .../dist-docs-branch-23.06/ovn-nbctl.8.txt | 1716 +++++++ .../dist-docs-branch-23.06/ovn-northd.8 | 2808 +++++++++++ .../dist-docs-branch-23.06/ovn-northd.8.html | 3725 +++++++++++++++ .../dist-docs-branch-23.06/ovn-northd.8.pdf | Bin 0 -> 196655 bytes .../dist-docs-branch-23.06/ovn-northd.8.txt | 3723 +++++++++++++++ .../support/dist-docs-branch-23.06/ovn-sb.5 | 3514 ++++++++++++++ .../dist-docs-branch-23.06/ovn-sb.5.html | 3974 ++++++++++++++++ .../dist-docs-branch-23.06/ovn-sb.5.pdf | Bin 0 -> 209409 bytes .../dist-docs-branch-23.06/ovn-sb.5.txt | 3972 ++++++++++++++++ .../dist-docs-branch-23.06/ovn-sbctl.8 | 658 +++ .../dist-docs-branch-23.06/ovn-sbctl.8.html | 979 ++++ .../dist-docs-branch-23.06/ovn-sbctl.8.pdf | Bin 0 -> 74265 bytes .../dist-docs-branch-23.06/ovn-sbctl.8.txt | 977 ++++ .../dist-docs-branch-23.06/ovn-trace.8 | 418 ++ .../dist-docs-branch-23.06/ovn-trace.8.html | 572 +++ .../dist-docs-branch-23.06/ovn-trace.8.pdf | Bin 0 -> 56115 bytes .../dist-docs-branch-23.06/ovn-trace.8.txt | 570 +++ .../support/dist-docs-branch-23.06/style.css | 25 + 70 files changed, 59638 insertions(+) create mode 100644 src/static/support/dist-docs-branch-23.06/index.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-appctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-appctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-appctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-appctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-architecture.7 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-architecture.7.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-architecture.7.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-architecture.7.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-controller.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-detrace.1 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-detrace.1.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-detrace.1.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-detrace.1.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-ic.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nb.5 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nb.5.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nb.5.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nb.5.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nbctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-northd.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-northd.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-northd.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-northd.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sb.5 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sb.5.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sb.5.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sb.5.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sbctl.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-trace.8 create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-trace.8.html create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-trace.8.pdf create mode 100644 src/static/support/dist-docs-branch-23.06/ovn-trace.8.txt create mode 100644 src/static/support/dist-docs-branch-23.06/style.css diff --git a/src/static/support/dist-docs-branch-23.06/index.html b/src/static/support/dist-docs-branch-23.06/index.html new file mode 100644 index 00000000..410c9331 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/index.html @@ -0,0 +1,26 @@ + + + + Open vSwitch 23.06.3 Documentation + +

Open vSwitch 23.06.3 Manpages

+ + + + + + + + + + + + + + + + + + +
ovn-appctl(8)PDF, HTML, plain text
ovn-architecture(7)PDF, HTML, plain text
ovn-controller-vtep(8)PDF, HTML, plain text
ovn-controller(8)PDF, HTML, plain text
ovn-ctl(8)PDF, HTML, plain text
ovn-detrace(1)PDF, HTML, plain text
ovn-ic-nb(5)PDF, HTML, plain text
ovn-ic-nbctl(8)PDF, HTML, plain text
ovn-ic-sb(5)PDF, HTML, plain text
ovn-ic-sbctl(8)PDF, HTML, plain text
ovn-ic(8)PDF, HTML, plain text
ovn-nb(5)PDF, HTML, plain text
ovn-nbctl(8)PDF, HTML, plain text
ovn-northd(8)PDF, HTML, plain text
ovn-sb(5)PDF, HTML, plain text
ovn-sbctl(8)PDF, HTML, plain text
ovn-trace(8)PDF, HTML, plain text
+ diff --git a/src/static/support/dist-docs-branch-23.06/ovn-appctl.8 b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8 new file mode 100644 index 00000000..866f618e --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8 @@ -0,0 +1,186 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-appctl" 8 "ovn-appctl" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-appctl \- utility for configuring running OVN daemons +.SH "SYNOPSIS" +.PP +.PP +\fB ovn\-appctl\fR [\-target=target | -t target] [-T secs | \-timeout=secs] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] +.PP +\fBovn\-appctl\fR \-help +.PP +\fBovn\-appctl\fR \-version +.SH "DESCRIPTION" +.PP +.PP +OVN daemons accept certain commands at runtime to control their behavior and query their settings\[char46] Every daemon accepts a common set of commands documented under COMMON COMMANDS below\[char46] Some daemons support additional commands documented in their own manpages\[char46] +.PP +.PP +The \fBovn\-appctl\fR program provides a simple way to invoke these commands\[char46] The command to be sent is specified on \fBovn\-appctl\(cqs\fR command line as non-option arguments\[char46] \fBovn\-appctl\fR sends the command and prints the daemon\(cqs response on standard output\[char46] +.PP +.PP +\fBovn\-ctl\fR is exactly similar to Open vSwitch \fBovs\-appctl\fR utility\[char46] +.SH "COMMAND COMMANDS" +.PP +.PP +Every OVN daemon supports a common set of commands, which are documented in this section\[char46] +.SS "General Commands" +.PP +.PP +These commands display daemon-specific commands and the running version\[char46] Note that these commands are different from the \-help and \-version options that return information about the \fBovn\-appctl\fR utility itself\[char46] +.RS +.TP +\fBlist\-commands\fR +Lists the commands supported by the target\[char46] +.TP +\fBversion\fR +Displays the version and compilation date of the target\[char46] +.RE +.SS "Logging Commands" +.PP +.PP +OVN has several log levels\[char46] The highest-severity log level is: +.RS +.TP +\fBoff\fR +No message is ever logged at this level, so setting a logging destination\(cqs log level to off disables logging to that destination\[char46] +.RE +.PP +.PP +The following log levels, in order of descending severity, are available: +.RS +.TP +\fBemer\fR +A major failure forced a process to abort\[char46] +.TP +\fBerr\fR +A high-level operation or a subsystem failed\[char46] Attention is warranted\[char46] +.TP +\fBwarn\fR +A low-level operation failed, but higher-level subsystems may be able to recover\[char46] +.TP +\fBinfo\fR +Information that may be useful in retrospect when investigating a problem\[char46] +.TP +\fBdbg\fR +Information useful only to someone with intricate knowledge of the system, or that would commonly cause too-voluminous log output\[char46] Log messages at this level are not logged by default\[char46] +.RE +.PP +.PP +Every OVN daemon supports the following commands for examining and adjusting log levels\[char46] +.RS +.TP +\fBvlog/list\fR +Lists the known logging modules and their current levels\[char46] +.TP +\fBvlog/list\-pattern\fR +Lists logging pattern used for each destination\[char46] +.TP +\fBvlog/set \fI[spec]\fB\fR +Sets logging levels\[char46] Without any spec, sets the log level for every module and destination to dbg\[char46] Otherwise, spec is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the vlog/list command on ovn-appctl(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful if the target was started with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.TP +\fBvlog/set PATTERN\fR:\fIdestination\fR: \fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Each time a message is logged to destination, pattern determines the message\(cqs formatting\[char46] Most characters in pattern are copied literally to the log, but special escapes beginning with \fB%\fR are expanded as follows: +.RS +.IP \(bu +\fB%A\fR : The name of the application logging the message, e\[char46]g\[char46] ovn-controller\[char46] +.IP \(bu +\fB%B\fR : The RFC5424 syslog PRI of the message\[char46] +.IP \(bu +\fB%c\fR : The name of the module (as shown by ovn-appctl \-list) logging the message\[char46] +.IP \(bu +\fB%d\fR : The current date and time in ISO 8601 format (YYYY-MM-DD HH:MM:SS)\[char46] +.IP \(bu +\fB%d\fI{format}\fB\fR : The current date and time in the specified format, which takes the same format as the template argument to strftime(3)\[char46] As an extension, any # characters in format will be replaced by fractional seconds, e\[char46]g\[char46] use \fB%H:%M:%S\[char46]###\fR for the time to the nearest millisecond\[char46] Sub-second times are only approximate and currently decimal places after the third will always be reported as zero\[char46] +.IP \(bu +\fB%D\fR : The current UTC date and time in ISO 8601 format \fB(YYYY\-MM\-DD HH:MM:SS)\fR\[char46] +.IP \(bu +\fB%D\fI{format}\fB\fR : The current UTC date and time in the specified format, which takes the same format as the template argument to strftime(3)\[char46] Supports the same extension for sub-second resolution as \fB%d{\[char46]\[char46]\[char46]}\fR\[char46] +.IP \(bu +\fB%E\fR : The hostname of the node running the application\[char46] +.IP \(bu +\fB%m\fR : The message being logged\[char46] +.IP \(bu +\fB%N\fR : A serial number for this message within this run of the program, as a decimal number\[char46] The first message a program logs has serial number 1, the second one has serial number 2, and so on\[char46] +.IP \(bu +\fB%n\fR : A new-line\[char46] +.IP \(bu +\fB%p\fR : The level at which the message is logged, e\[char46]g\[char46] \fBDBG\fR\[char46] +.IP \(bu +\fB%P\fR : The program\(cqs process ID (pid), as a decimal number\[char46] +.IP \(bu +\fB%r\fR : The number of milliseconds elapsed from the start of the application to the time the message was logged\[char46] +.IP \(bu +\fB%t\fR : The subprogram name, that is, an identifying name for the process or thread that emitted the log message, such as monitor for the process used for \-monitor or main for the primary process or thread in a program\[char46] +.IP \(bu +\fB%T\fR : The subprogram name enclosed in parentheses, e\[char46]g\[char46] (monitor), or the empty string for the primary process or thread in a program\[char46] +.IP \(bu +\fB%%\fR : A literal %\[char46] +.RE +.IP +A few options may appear between the % and the format specifier character, in this order: +.RS +.IP \(bu +\fB\-\fR : Left justify the escape\(cqs expansion within its field width\[char46] Right justification is the default\[char46] +.IP \(bu +\fB\-\fR : Pad the field to the field width with 0s\[char46] Padding with spaces is the default\[char46] +.RE +.IP +\fIwidth\fR A number specifies the minimum field width\[char46] If the escape expands to fewer characters than width then it is padded to fill the field width\[char46] (A field wider than width is not truncated to fit\[char46]) +.IP +The default pattern for console and file output is \fB%D{%Y\-%m\-%dT %H:%M:%SZ}|%05N|%c|%p|%m;\fR for syslog output, \fB%05N|%c|%p|%m\fR\[char46] +.TP +\fBvlog/set FACILITY:\fIfacility\fB\fR +Sets the RFC5424 facility of the log message\[char46] facility can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] +.TP +\fBvlog/close\fR +Causes the daemon to close its log file, if it is open\[char46] (Use \fBvlog/reopen\fR to reopen it later\[char46]) +.TP +\fBvlog/reopen\fR +Causes the daemon to close its log file, if it is open, and then reopen it\[char46] (This is useful after rotating log files, to cause a new log file to be used\[char46]) +.IP +This has no effect if the target application was not invoked with the \fB\-\-log\-file\fR option\[char46] +.RE +.SH "OPTIONS" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.html new file mode 100644 index 00000000..dac90fb5 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.html @@ -0,0 +1,224 @@ +
+ovn-appctl(8)                     OVN Manual                     ovn-appctl(8)
+
+NAME
+       ovn-appctl - utility for configuring running OVN daemons
+
+SYNOPSIS
+        ovn-appctl [-target=target | -t target] [-T secs | -timeout=secs] comā€
+       mand [arg...]
+
+       ovn-appctl -help
+
+       ovn-appctl -version
+
+DESCRIPTION
+       OVN  daemons accept certain commands at runtime to control their behavā€
+       ior and query their settings. Every daemon accepts a common set of comā€
+       mands documented under COMMON COMMANDS below. Some daemons support  adā€
+       ditional commands documented in their own manpages.
+
+       The  ovn-appctl program provides a simple way to invoke these commands.
+       The command to be sent is specified on  ovn-appctlā€™ā€™s  command  line  as
+       non-option  arguments. ovn-appctl sends the command and prints the daeā€
+       monā€™s response on standard output.
+
+       ovn-ctl is exactly similar to Open vSwitch ovs-appctl utility.
+
+COMMAND COMMANDS
+       Every OVN daemon supports a common set of  commands,  which  are  docuā€
+       mented in this section.
+
+   General Commands
+       These  commands  display  daemon-specific commands and the running verā€
+       sion. Note that these commands are different from the -help  and  -verā€
+       sion  options  that return information about the ovn-appctl utility itā€
+       self.
+
+              list-commands
+                     Lists the commands supported by the target.
+
+              version
+                     Displays the version and compilation date of the target.
+
+   Logging Commands
+       OVN has several log levels. The highest-severity log level is:
+
+              off    No message is ever logged at this  level,  so  setting  a
+                     logging  destinationā€™s  log level to off disables logging
+                     to that destination.
+
+       The following log levels, in order of descending severity,  are  availā€
+       able:
+
+              emer   A major failure forced a process to abort.
+
+              err    A  high-level  operation or a subsystem failed. Attention
+                     is warranted.
+
+              warn   A low-level operation failed, but higher-level subsystems
+                     may be able to recover.
+
+              info   Information that may be useful in retrospect when  invesā€
+                     tigating a problem.
+
+              dbg    Information  useful only to someone with intricate knowlā€
+                     edge of the system, or that would commonly cause  too-voā€
+                     luminous  log  output. Log messages at this level are not
+                     logged by default.
+
+       Every OVN daemon supports the following commands for examining and  adā€
+       justing log levels.
+
+              vlog/list
+                     Lists the known logging modules and their current levels.
+
+              vlog/list-pattern
+                     Lists logging pattern used for each destination.
+
+              vlog/set [spec]
+                     Sets logging levels. Without any spec, sets the log level
+                     for  every module and destination to dbg. Otherwise, spec
+                     is a list of words  separated  by  spaces  or  commas  or
+                     colons, up to one from each category below:
+
+                     ā€¢      A valid module name, as displayed by the vlog/list
+                            command  on  ovn-appctl(8),  limits  the log level
+                            change to the specified module.
+
+                     ā€¢      syslog, console, or file, to limit the  log  level
+                            change  to only to the system log, to the console,
+                            or to a file, respectively.
+
+                            On Windows platform, syslog is accepted as a  word
+                            and  is only useful if the target was started with
+                            the --syslog-target option (the word has no effect
+                            otherwise).
+
+                     ā€¢      off, emer, err, warn, info, or dbg, to control the
+                            log level.  Messages  of  the  given  severity  or
+                            higher  will  be  logged,  and  messages  of lower
+                            severity will be filtered out. off filters out all
+                            messages.
+
+                     Case is not significant within spec.
+
+              vlog/set PATTERN:destination: pattern
+                     Sets the log pattern for  destination  to  pattern.  Each
+                     time  a  message is logged to destination, pattern deterā€
+                     mines the messageā€™s formatting. Most characters  in  patā€
+                     tern are copied literally to the log, but special escapes
+                     beginning with % are expanded as follows:
+
+                     ā€¢      %A  : The name of the application logging the mesā€
+                            sage, e.g. ovn-controller.
+
+                     ā€¢      %B : The RFC5424 syslog PRI of the message.
+
+                     ā€¢      %c : The name of the module (as shown  by  ovn-apā€
+                            pctl -list) logging the message.
+
+                     ā€¢      %d  : The current date and time in ISO 8601 format
+                            (YYYY-MM-DD HH:MM:SS).
+
+                     ā€¢      %d{format} : The current  date  and  time  in  the
+                            specified  format,  which takes the same format as
+                            the template argument to strftime(3). As an extenā€
+                            sion, any # characters in format will be  replaced
+                            by  fractional  seconds, e.g. use %H:%M:%S.### for
+                            the time to the  nearest  millisecond.  Sub-second
+                            times  are  only approximate and currently decimal
+                            places after the third will always be reported  as
+                            zero.
+
+                     ā€¢      %D  :  The  current  UTC date and time in ISO 8601
+                            format (YYYY-MM-DD HH:MM:SS).
+
+                     ā€¢      %D{format} : The current UTC date and time in  the
+                            specified  format,  which takes the same format as
+                            the template argument to strftime(3). Supports the
+                            same  extension  for  sub-second   resolution   as
+                            %d{...}.
+
+                     ā€¢      %E : The hostname of the node running the applicaā€
+                            tion.
+
+                     ā€¢      %m : The message being logged.
+
+                     ā€¢      %N  : A serial number for this message within this
+                            run of the program, as a decimal number. The first
+                            message a program logs has serial  number  1,  the
+                            second one has serial number 2, and so on.
+
+                     ā€¢      %n : A new-line.
+
+                     ā€¢      %p  :  The  level  at which the message is logged,
+                            e.g. DBG.
+
+                     ā€¢      %P : The programā€™s process ID (pid), as a  decimal
+                            number.
+
+                     ā€¢      %r  :  The number of milliseconds elapsed from the
+                            start of the application to the time  the  message
+                            was logged.
+
+                     ā€¢      %t  : The subprogram name, that is, an identifying
+                            name for the process or thread  that  emitted  the
+                            log  message, such as monitor for the process used
+                            for -monitor or main for the  primary  process  or
+                            thread in a program.
+
+                     ā€¢      %T  : The subprogram name enclosed in parentheses,
+                            e.g. (monitor), or the empty string for  the  priā€
+                            mary process or thread in a program.
+
+                     ā€¢      %% : A literal %.
+
+                     A  few  options  may  appear between the % and the format
+                     specifier character, in this order:
+
+                     ā€¢      - : Left justify the escapeā€™s expansion within its
+                            field width. Right justification is the default.
+
+                     ā€¢      - : Pad the field to  the  field  width  with  0s.
+                            Padding with spaces is the default.
+
+                     width  A number specifies the minimum field width. If the
+                     escape expands to fewer characters than width then it  is
+                     padded to fill the field width. (A field wider than width
+                     is not truncated to fit.)
+
+                     The  default  pattern  for  console  and  file  output is
+                     %D{%Y-%m-%dT %H:%M:%SZ}|%05N|%c|%p|%m; for syslog output,
+                     %05N|%c|%p|%m.
+
+              vlog/set FACILITY:facility
+                     Sets the RFC5424 facility of the  log  message.  facility
+                     can  be  one  of  kern, user, mail, daemon, auth, syslog,
+                     lpr, news, uucp, clock, ftp, ntp, audit,  alert,  clock2,
+                     local0, local1, local2, local3, local4, local5, local6 or
+                     local7.
+
+              vlog/close
+                     Causes  the  daemon to close its log file, if it is open.
+                     (Use vlog/reopen to reopen it later.)
+
+              vlog/reopen
+                     Causes the daemon to close its log file, if it  is  open,
+                     and  then  reopen  it. (This is useful after rotating log
+                     files, to cause a new log file to be used.)
+
+                     This has no effect if the target application was not  inā€
+                     voked with the --log-file option.
+
+OPTIONS
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+OVN 23.06.3                       ovn-appctl                     ovn-appctl(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..25f310d75785aa9460d6644d3552f826ac4f86f9 GIT binary patch literal 29566 zcmce-1zcTA(k}`GcL*BXA;`upSa5eII2(6&cM0w;f#B}$8a%jrfB?ZE$lWC8oH_I6 zn|X8JyYKxrYj^kRs_t4{|E{jRs-Tb;7NuumV1=g`JdVzTr=XCqcD6CpcQmuH<|ek) zcQgfAdz1<&lvU2k8Rg^?P zl!EV-g~W;J9fUW?yGLBateOFQ61$6Q=L#9iU=J^q-hj(T(J1%l2lZHkEAotC&Qt% zL@h2U6YhaHzGRnSKg+}V8%M*2Km9@WWAmCW{lfKOBW-Rc@OsdF;;FhVZKh=R{_v_O z#=F|Hi8&n-fdYXyn*K&j_6MidlfO_E!(IiR7@;a1hng&(9CCo5m8=n?^qWCt6OEZ(>aJv{2mj_)++;_+H zihX;8Bvna+eDv8K-U3B6&3Fd{95yXSffJ7l^;BM->u-+Im6i}FR3dF@>hrC86A;6J1i%dbpV0!`_%zEhj47=cX|s-9p$zFeyDez1oi% ztfu|O@-yIzg)!FD{)8o)ZjEF)?ZaNP>`jU3;pw*vlOvS{DCV6AcDo~kPPy|heOTSA zpX>WIQgs`awF~T~PIS2#yZYTCz*H9^mJ9<&z4XQid%2!HNsJw^Kf>Ff?sUH4+;=Og z>HTE!0JX^Q6zrioezA?%B;sr!mZ+k+vtRWZY6fAwz0>38x8CScltzxZ5x6l0LV9;= zpFD~<7{x)iVyxYpCU$@d#vS&*@l17m( zqe-?Y;XEf9xFGyFMFPwSt!13aMBQ1up=66&6&jiU1J`I~T03`$N}$YT{RKTE=1N@d zMvm0??p(SCV2#NwS3ravoe;TGKJ~Fm3%^k~L6kP}BJp7ZO!dbP=fYqT7fI_*F;FP0 zRcyP}I7#@oO}v6jWZqB%!Jb6I)hRl)N{NT0Be;Sy-g!r-m^rcYbmf;S(-BQny@YDF zg4v1$v)qrb-KftIST|ZdH=(u=a@gK>8`k3?be8WJVlh9jReeqbpX|*}2#f zpw=fAKO9GQn)IJuG_L|f+^2{98p_wSp7cN*xy5jw6-EaE6FC>)t2vV0$^hTzBo+$u zK@q2D9`Cr5nWvzX_OdG1Ft-GM0Slt4Jfws>#~33&yuwaPk(5lv%k)r6c7hCrmx!u! zXq?JgD!R3gmfg*)KViUa2X6lcax@!u&nzh+uwXf0WN~|yseJxj=B&f6nC0`QTQ!sI z=shCnb`n*;F^Kie{iT3Q@NnCWDvJ7#E0jeptS$BeE#)D7!;LJL?5mO7Of%;4HC)V)IuNlW>ZIaHsc-;4QVY7AycPn#@#V|3hqG1=CP;n&exHF~ ztE*7H?)ozAH*_w@H})Y(_3Gl@aw%B+C-|u7&Xkj&-mcClIQvxLLtM6lm#sxtehZ@= z4lf(DV%MvZvhgw(X!e1c_(=IIy%TV@N|q`KFj#?3mImy(qT7$FezE)*%k!@04u&;f;U-2@tF!nfRSj`hX zyzBFgxh-Hhs{w~>a=;Si0U5SsD``sOg4N+6316LM=3^Hnuu-VD1oT#u#Ds*hz7{my z5%uuS*6%y@%4xD}bbNDO8`BCJ-vOn)fAf;65jOcLX{*}B!Q z{GqnQ6qD_MyEY|2u$SXacctd?F*T|^z?AC7+*AuyoaCMuM~CMNikU|lkDYdwdZT@f zJEfs#<5@ovrB1LmU7C zJZLN8yBTbT945odKVQ?+-UgHqoxBcM?lOnnHuDl6URCh=-2N8EICC!S!gyUtaj4ZK zVFx?X6Qwo<)o++jqPDOAKfwax9TK_)2IekGdpS>UZo*?O$*z?1hdj}$8Bc$0IPi6T zInOYy@F)2|&cmXcSF91%h^&iw*{f=DD&^O<8mOmk;LT<18STXuLtvU=hkWCg!pHaW z2tYxDZyzo;tWgJrZV8Jw)vJxO;5tx4ED>RcTW^{TPZ5c69nsQ)VF;Uiq%5g%D3Rxn zy(z8qa*P~Dsjq&5Ma5m1p}}wP!*=!ro5P;vWD_oVDyO7pn_iN&y6XBZeq-y1wp zbm4Q*7;YUE4ez`0EmY_rUggGBmmcU~P#}W7mvu;~uPdGvibrb}fK7rLUVOu?wfhKW zr9gL3ya#2V!9_gq9nrV896T{Z{&*tPetmyUe$DEnG1;9Af5wyNvU^E;CpGK3)Swc6 ztR^MSxvGs}hE3wLt^kN69lv+VpCp?4n z&Pn!kwZvopj`w{atF!6x`opyH)u**@)13EtJ7Xm?!w}mM{C#U=AAMvl`sX7t1B<(* zG)j@K`wL0R_4YgKjE)LtSr#SUc86^BV|fi&e}h@M2>!H=`{XI!_3+7U8|rAch-VVs zdt1VyVX^4Q%uq2_uP+NeW0VCA7mR|_&4H-C4>NXT-_8_D;g<9eVJOkBV)z{!qxCe6 zr~kz$hH!k3k8xH%BdlNHV!?MKH0{7zh`5#V9k-I;FK>^9c@aA)b1j&CjICjL32&`= zXrw#_$#dJ6`l=w$oF~95SbYd)f*236QX+UxcXRiK^W*|-V%{lj9N;KSb`nj#MqY)U zgWR`wMwlNl)TD8R_mSWfn0`er92pGB6y{s~7EFV(dkCp2(u-=9?gBzJ>CCKeHXK-$}HiSAF?fG{Fxb=J3g(mJN zrh!3t&Zy-~K$xOhWrvayF1Fi)kF&|eMXwSaLYBLCw%v0)J)$@elqCSIjs9>cLA4h* z^u_snDVf<>Sm6J-$Mmm0D${@Eq<+#^wq72=^tw?)M1{-+v*^J^w()jguu`0rFfT2l z-r}1?r>NZ(2`R{Hg4r*we8PM-od3YtrXEg^LGDWsTYKv9yAs@xwU=6Vi7L~)@oPpc zC_bNWx8l_KPE!@Av^x+sdF7x&;& z*{n3hgNkm&P2QrPk>Fs*c+Nv!Cn(qRWW{*gWpgLqS=YwaN9Kz^##Wz@33YPcttWJA70>d_FWnl1LhLT+XYSs)k#fKwTZe%vJh&3rioarflgV)3UZpu2qWK zC{gZd$i(gIQnLR>fzy^G)T+!31HRlkzClxHEMUm52im^i#A|L%vRQJki)D{_q_vBW z$8?^s;9M3~I87+Cl0=9A-lJrx0atHN6R6d?@6lm@iiMScDKWohpl1J2hbX-f>o@M5H=D+VNRId{~(~m<=C=%>@Z-*MRXQo+jMZU=So&VI5 zmusZ$edfdMnVLy7D&5*}y(6)jKM}ZE(HkCnvhe$SFJJq9}?r5Qj+2 z8M|)lzAIlQ>Hm>l+N6$O9?F1qo=JWl-gpX3XqM;V1CUa_~u%j?@E8X zD}Y?1HVw1L+_zL$+Sw3OX;YD-#`4s2st5yfWu~kD=cwH4Ggz3~H7>m63RmCq29>2c zjZ|@0f>Bg|%_QzvFjbbADjCf{H+%Pwv3UYR<0$L%bQf<4CV3r_^oT#I^nqWw&qw2h z&Dp&po~6@|A;)Mnv9Q-G6w~&BkWMLAsEqC)f>1&YY&#;7N(GlNmE!(L#x5n z;zAC^gmtvpV<1dt9H8;W;t;||)(TOT#v4N;_3#X*x)KqmFRk7|YB|%G*C@2N;xj_% z*a%YB=Qy56_Tun<<)pP(WAAazlw!149lLM5*MkuJ?vC zl9@Z?R!PHHh541KB(mvcboxQ&IW$xorf5^2_I3+A$a^_Z8Oj5N*Y7%@h|T$Os=*sO{+imRn`<|o(@%%kkj7h7$tMdqD36!LRT|)CQ;gJ& zN!r>)IE)ChJs93XegulcopNvWpu z3;7=9vjVg$AEh23-fU?`eE^CN>WQu;l<|$dwssU9{p)#QGWt2`=7er&`AyhN`0(0A z%xTsxotZfcvxWL?l8haE1l3|XZO6A2Oy3N|(h0pAc5IR*@v0gt;^o#!9`QO5W@-egeUmyl%lQJf$z1jhYHW>RR{ z>{RbF>84XG`V-kPCrxkvG5cuS3x-Av0p@-rOgtpuz+zyD~DaKcRv0jw89Ib|)%sH)5^qV0cwWHfQz=)_-BVfe^V z%qsTUXDJbTK7C?F)stD3r-ce!LZ8<;gQJ~<2`8{h1k0jN)?&DORNL-V*X&u8Q$ekQ zP1QXMWEBFnysHvbe{lzE!h*#~59ym$-gE)+K+)5lLq@5vNelD9^}tnUvG);PQffIr zI+9-ZsV6!@4;`=_5?12gb;~+gd{&&x?JpzRc2+5bk+t{oni|5}&F(orxBcReaoM|b z+=jo}ZQIxyx{Sh${V2#jQT^5IUDr(C?c8P))AByfMF4u{ir%K)Sk@11__+?qS zO8s!$ri@NqK9&bKL8VQ{M4t*wH7*{yvmbnVUn`BpJMdm7dtber9)2-Db7a6?u>Plw z^_I12TA{!^%8-`OG|wWty}+DGE}qQVHj$k?-SUrbL0 z6n2$$#lP^9uUu_;N1u^ilq+RY($X{2*QmyUet(TxKYu}{_vge=Nv&6T6d$aZdg!}_ zs76^Wy;UQ3M`9F{m%m!=;xUl!lERXp8RETPMTG_Lz&>#GdIHKXg)Zoo`D}Sn_itbY z-lY_#LAVLvgH=B9(Z+EADOVU8WVMYSugm+|bu%82e4bIFrl}(T#kKzBGyn3fIhol0 z@~yf4<^3-+;PX!!kQY$C27b9^BVzR0#5>CMpiA!f!^U`Not^?!Gib20irT zz^^lxv!&1BPliP7)-~F4+_IuIevLk^w}c(U*spg+h%QohSg^Ifbc}`G(=roDeDqfT zl4L*sHkFqbWw*ziWkwJ(2qUN?TJ>&>rV_hUE(h|uf8kcvzTAHyVGb9x}dHE-cfllj%7#br45yNbHiO*O=DPqH7K zAEv#jX|sqV%<3*7>d&LG$ofX0M2$M)X!(%C>_*KCAw6R8(yfY0$LY5=yC{?a^3t27 zk@mFmwXJ1`=OuewZ(SK;sN>2k``&zlDsiO`ccy(al|k%R$#{RT1B`6|KHAy&kG$#5 zvm+Qp6Ok&OFO=U=@d!w3kd2_Nn@U$uDdMWM*{GEko-rk;-xwhj8^A0}gwA2?n(`qx zWKg3vj#nP)OyS7@dXWm^i!w0Ln$enP<#G{zRu2X*w3o8^X=x}gkSbAV(e2Nc(npxs z9tAtt_eqFT#Yz(kY2*$GLKs#jUuxW~7S$>^@!t0)m1t_ve9nR^@`USeKaH)r` z&DOI1x6#po>zlHd@BJ<9*O1BJNIgyf_!UwWZ8oD%t>MD`AuG`NjR+7Sw1p(FWxEQB zv@-ph4+54$qF^|oDTB~xm*35YJ@F-GyaYzV9g(_@XNDK`Q-b>nAIc8Me1m+QuYesz zwN0Y{@G|K7rB6Kc)1JxE;THxh)coiO^7}2`W#KK>M(FGY?^A0zhSU^XH<-Uox6i^F zgCqA;BrKp9La{n27kKHUu=?}Dp{IU^Kc`YIv8lC;vtC>rZ&?@NRR+%!SuF8@7;9&x zYAJVt0vn^YWV$?~V#!=hu6fWeXegI<${OQ2fN!|9Uv)+N3NfL1)+#T0_L^**iW@cBt8DlFxM1&@ zV;Lq;r1p8fd@T5BfG;6bEi|_Bk)G3n!B+*}q2Q+q<5(!3R#Lx9OFR;OXtj^-fuTm! z_iENU{yE(&lu?tftPc4XXH~W&*I)Wr!J>GkFRhc6UBm}}Uw|E?iOg#z? zYVgqWDgazL(b8LP3)#6;GvX&#M$|iA5i!s7g2!5c{`rTFN}9Z}ulTU8x)i22c`2hA z=nh}IQOGdRv2n}1Sxm9xp5S!U>RnP^kAHYSOv6BXir925C*Q(U_o+;nLurs^>S$co!wE ziJK+;e$)vXj%*wgl`sXRb~cj1L*k7AJcej7SZWVCl*nQ+o}qE{y%U#bsqd(d@Ed8@ z?VGTxj%YbPDn~1_ud{COO;cx{oC3@!F=0#_UeMANtv!-#cgWEwA5)FhV-W8arZRIl zY}5d2ZQd?Cri(f*@{K$TtKnt-;ZgF1U)sxOAc*^>fSKV)ad`AlwJb>_3xgPr;`}J5 zyXS|k2vyEVy}7Rpq5A9qO@Ojp3$|HQEIhc+DOul?kS=0j3KRAg!C_r7AvE z6m1+qF;`+n5S2a9+L4&$^*-;PM=P+%#0j}wcuZtPZ6H!kK#pmMR;vu&;vTX zXzT9_{ntQ$j3cD)sBdXw^5=kmXjTU3sBZ-7A!hz-wf@x9KSTj2GBLq3{SqIb$OZpP zW`H6G{4bWj>Gq}l$6Ee(9KV+2e~aUn6n}6C>N@~mfCo^Kl2cKWrd2kx0y@wO+E^O> z!lN+I!O-5!*3rhE7=&-oLj6|o3kL|WX7&z_LZnzgKgankBj_76&o9Y9 zl&qjJUN~OL7is>y4|)O+=S$B^jq{}kR0s9Kzm$x>=|Qsm;`!b4Yo0%sh=q%lm>Fb( zUdrDy{x$nc`>)UM(f$*~AG9Eu|J{d;gArtPM65x%A!gPlAO(OZ6#+_4297T#?q%aJ z{R5Z3djG)8uRZ=JAK(Q+e>K$1tlwKZnElljHZwK`f~+9O>}kQXZ~^R`Y(Qx#W+tYN zp#8@PFgAmKfs2)ywUdMPKPLOzkD9;mDJvqTtStTqJ{4`O^sWB|pf3;l{|cZl`uYdD zUUc*_i-Qw|J37e9DrKvf9mlCO~3K?3s)fA{np`2>(7~9(8viw$ICs?^#^8N zF#AIL3(voMeqs1er2gjqV+@eKe_<1}i~e4|^!~Z4USxZ@UfM6^%O3fo@2}nWLjSU7 z{-k^9f063XF_5>-y!wS7}TGq(O+Qv ze~eTXCV+vHr6uq`g7$BQ`!CQcsmn=-tNj653DDVLX833d-QT7{o}OywaT*kR=|IAt_gztHZ6K) zP_Ev~uI2)rp&YE7+ArC1pd>$5c))uH!xz^LbQ9!<>D!6}Urg5T=F226eJ`BwfZs}e zZ*5`;^7!BZN{&D)Rge=0Vv{j*Z~)oWUq|7K?Enn~Ix0b4A2r}TKoB4V5C(_%XDd^7`R0H{#026>Iz|_sw6le`F16Tko0am|FEWjFI?PO&Dw0AHwu?E-x zY^;F*TY&A0oBC_?U$x((+X6wZD#$GWm1Z_Zf3w>Fdw>JL0cd6Rdv*s<)}uAR!ORul zV5#q53UIImi3)H8IGWl6L8XfgzzN_CZ~?dh+=2EsG{5xnlHmw4r@#D(e;EB=?LRd7 zJA3i($%~++{rkZr^jEecBQql(-(Pu+nd)ZhO7ksiOva~HpOnM2x=E(ys=tX4n%$4Clv4L93tj3Q`;_Dl(5a$3Uwdrrx}?zM&|d0DmdV(1Le=+0pK# zopvE>`C`Q(d!O%SQ%rr)qP%_XrhWZqhc4vo0#kwjG0rI_8krK^5)L-O7EZ?yC}K1- zc*YV4pYeQ@r(YhL%&9OW5t=c;E}MOykI?B(ddUNG4mYdrr?;zGIelmI{YvL-S_)xx zdrRd!wCb!cwUSPw#nU*(e9uPC*gB4ew8y|?oZ^{$G;e#$(5O0$5RK`*M0l#lwgH5p z3AfJEAmGWP^m%;`L&RzYwUy~4$KxSaCVkiDZ3DTr%u-SYI!>JuW*cpvP{X@f7CKLx zKEBG&2aimEwhs64wmU0?$Os*sww%-hrm!#wykHk>hsm-)kNXf;nq_IO9Ib{Zehc~%mwIc{y{6e zn;$F=*)&9_%zWMtDn-~CjC0)VQB-KU_O-P`b)a%G_QE&-76-M0_~!quF}B zrArl+U1u{rvBG&GV*ScwlTc2F$?d}E=T0n*gc7uNQ8QK(Rx7eV$Av9*P1oM*hjgs& zGh@8{=sFdfZsD>GJnd~$IwCH5t%M4`jBk`MK6tgQ#Krh*xg!P^y~|%$D`JEj+ZE70 z#>vM~vV6!koWz-hRz-G6iRGEJMaPrK0zS(v5?Ch(6GePp`|u^)2cn^Te`ipM2+-lX9w!hs5h17OqQu;jO826MV6B^2zNA5Aqxoys$jnb@n z@FI$Zgpv=rhJxJmau0lvyvR6YfHONTkggJeap&Q8kGb=B;5WjbItMY}8m7 z?&51wTvb%x)Htw@=S8f*Q*v{TMvsO4YdRSRm^Y5Tr5Y8!hATrkeQv z5<3NjWuCuJaH6V@cS_OjOO(Q_QL>o=@w+?|L_hA#=vQnqk(};G{9U&HzF)HiL;CO z97G8A&FtOSj2g~zWaa=`vQOxT=rb1_v81It-6cr=xPattQT?w*P49(R$0%)4f{E!U zC=x0Av3D0PVQCS^u&v7mQ_^J@cjJ7!oHyX```{I zBYK0z(zhN3F}=QEnTW+*bjy%8=m)IQA%XfMLxOK+R5Z9@X(xpBIMVx|JIIKp#@nc9 z7F4h@`*#t9*%UM4d>!YwNOwVX4ra2XSP{h{FTnt|&Fr1SIJlFYKij0bqG=Jb{*pK_JS2Uv1` z*iCTHk?ss~%6Ihd!~$v*3crc#E4vxICpAd6T&}lYmRQe*DBv(i+ocXi3X?cnKK8gj zGLpd80p^e5g@;Qjki4Br-X)abFXati@JJ5n_$fcfa+=^cI>m`+Zm6YYsr^M}X$M-u zOR~9SDcgy#La70{wE>=6p9Qf8ebbh~(cu<`>k(+}6l_NHlgELW-Rx+*t0hZ3?74N= z1&y;B)jd^tvi6bpt;WQ2wZFd|YH`jY>OBs%#k>klDDF)8dAL@88Ow^yGphG@%oWID zREBfE6;gGwB3>P&>*bUF0hFzGW7k<5c=IjMUfznN0J&HK1uC*ePAi#4j5Tj@-w$Ft z8;bmn>X1HU>f_Ea$TfE9Qi`-lCK@`!I1^vz+p;H?&R%gj@J?)jk#NbfLq_v8pSYf9 zW;CZMr5kf^43%zfpnbt27(Q}gH&&`HnYR5Hq&zfG9QhpI02>-tnIn^%3v1!UO@%t40xlU z@uJ2l0DAe02|%)eh4<^6e`$Z&ZI?V#EJ@>fin1_6{|vje(0j?m&4+_e;~XhAX+u*) zqp2w8hdz~MuS)8oxORM_abeQ6Zt1bWD@jTE0W=4MULshEIhQ>3vfn;7wswF&aYy8W zVYcQT))=JI5Mkm;MV4Xi)20lx<+bIFdCqc7;3LZ3Mq0c^8of((YNw#M_JmpFTlH92 zuD)S~T20le5DF8|j}@s@3HcVss=t(#!TnWb7jxB4Id}{hq(66MboYr#5e#j=;` zc-KPjnpwIfx$tUtF~eN>B-nf;Tnm1Pwb|cngl5Qk4f;YX%dUQ!5sl$F5)kpmOnq#k z_=Jwej56~1(tl9fk`X)Oy}wCUB+V9{=NKjf85saD5fiX7t3ko0_}QRClOr^<+H}?L z%1^a__yo&BOGWn60NpU%D6OD~rB`jU5UIEAFxDx_>d?jy{g8xQxF;qWG-}_ggNs)8 z+zI<@0*O06=v~~|faAT2cwx`#8z=@oZVGL`g_NDWlZYZ&(7%%8A{=f%WHjoB^!u5p zOBmG|yHdJns->AB8i;up>+yLt0;=?>Y=L%kxzE= zac441Mk?_SZZ*c+*D6K6~jFuXCr)Zd4jfz<% z_L_dPCJ-`J&Sf^JA%7R?D(+rX%H^k!de?+~IhTs6@q`JSS83%BYvg?``^rlF`|a&ym@i+stzzpK<1;8GU8^XI5vq&Q%BX@Hkm-77_P_MhR$nedG5#2D zy^dy(%=B5kth3I_*wWIgKARU|x7Ma%LTXfB3t;k6R&lEJ?JJDw<|CV02#LnpB<1pA zDH4qm&)C8V2%+>U&mUuB-@6k0)PIIHD#k3&X)iY`EkyFnF(rKpsO7wTm2w||4FZ6FA0c7(f=;Rw*#jZKr+ZwYP`ke zIxvWkm0`n{{XN;*NykWe6)Gjd{RU-|8%7c$VKpwL1QJ-%KdbQRDE8SiV+;aL5( zB1VO4C21tjWo2$RS!b<18ArtcN6GTC1zja`lX7$d2n+a*$3kk0(f)>- z%Yk+@E|R_amNdX;k0aDJC8HrHtkQ71O=gs)Og|wxF+4gx9%EFvYfMa!w_0F&RJX_t_|DaAP}w~fgo5} z zRCDE+{%Z9GLEfoU*mJYJ(2!S1Nx|j5x(Q45VRI?=ab;OXjMTFoeGhP9bzBZ$urW&r z$MzmIv43=`N!C>jBH$}C_qnZVa1gln*x%Xc#FKMU7+Nm>(4?RpAsgpxRA;wDlvXpS z1!1)y)qM%X0>*ck72Nt9rNf7hj*N(=Q}#VASI}G*zkiiRZUj^I8u{lkC+0MUv9iAI zfqlEONvWwB_mbs_Xpsc>9?B*`{tCwBy6M>nSQP~KR-XWAw_7f1@yaC zfB;Ut?6dY0P?95N3vb4PXsWJVTZ`MEO#hAI?TUb=P z-fhU@bgH@2AEpafKrEeJ?~y#$XN6dr7{%R!GKmghEa^nWzU39hp|iYwzw3siVWRl1 z);&xr^Z9_*w)wk@$4@(&ESICJ6LP#aws_oMogOb~fTke@^egxli{sqN2gUR>_6u>$ zc#U}iS{0qW=c>?IqXd`b-P?=#b%dTGWc<@^3u=xD6@EVgyclzR396azot7dKk@xV8 zvwDDuP;K=7DERU;4zLPFq+WDIl#Ps)!~lN0-JD3oMAZnYO^J%OcWdQ(AMr|524WP3 zAc+)2@$mKQnECpfMS{JtObe&(d9yTW0g__e90?WUA05Uf)p6-Zh9}6;5w0qtvsl0C zFu0|0460OcwNXi^VQ?ETIo3Wjx>ov|vCUFP)lA(CDGw{;pX!Ukx!k&Kd0lgIFT-*@ zzGwJmIo#8BISWQNklh+L@MrAfLx2>Zpwm$=@8Bg2tt=G(*TJ}wJ*aZTI4N z4_m-ijUTB~L?p7i$`83gKV0e3{h}+>aap((49jt&{v`=FnY#1sso%6Wu8uK$E zNz&@7+KS$X4^bt~vvD_1eo)hxlNT~3Z79{;^yfTnZ`3=a2Pc9i zSg~)xDhz+Jx4`wn5EQZahJ*jMCyyV|*y_QrPFP8VW!Quc*N6EYQP>CPA;`IkZ$CvO ziTj!?u)>c`_|+UNUkICEPqP%KZtB>Lt(fVvfSTB|Z`r6AJjX!X=>xJ;Ao8V))790x z4l;yV`nT$$m#$F=8ZFP^Nq}TLU3{{ED=WI6cf68O)^`x~gOD1P0=u8JYO8l?2~wok^9`Yx@+6#` zrkD5n;Av)~?r~Dq8|F@nhX%gJ9{Hdp1rswl`loM12}kc(HD@clUnqDmItx<~Wh1CR#Gv1-?*@_vZvr-HRrBKSZ)=|Z?N zG9PYi=1&zNAjDRS$Jwxwyfzq>VrHwE0*m|9OH1d^hYGhjedcVfX7s^cd@{Vh;}$oN zD!;#B_m#!Z6%YUCt>Fenk9WHbJ2Ol|hd*JBiDOiG&D|!ZEiBwC)5SO0V!X&UmIVg9 zSPVW4JTx#_lE35F=4i^DOS*qu)X_2zvyEnZkoAz>>*8qx?FeY<8(_ljv4p$w9&}cr z7j=d1LBCpQTBUh94_xg&R)Qz>?%rQG4GJmpo55h3X#9AXgp0QC~Cto@qE9IOsEE7eJaX2Anz z$Gzs1pbty9=MoCAvfS_nTb;D9J(iNAXSC!3r>J%sl7`>;k;6LjCBB$z2Cr&Ds=7iI z_R2i^>p>a_<4V!k@V4UX856=0PH%GfUh>h&{E}v* zF89Ddw3g-YS2Bg^v1i&V+VSvi`Yxx(-8T5Qk%_vWzqX8^oMp2<@qSC z7mn&4J1q*mTMDyGi=%eJML?;Q=Uiv}xXO~mIp`qBvShjt9rUh&sMA|8oTki4Q^Wzaq&4v;a-LYBP!COV zfd#LQx4UF-eANSOW&m5Ap4neBy)?gHTdmxAnbNjSto!I1c=lK8Np$^48G-BzrWoqI z(M5d5QtfUMV?0VG@EL$;RaPa`t}2;CBa~rz7&O}&hoY|vR6Z9ZA(H5dT1|KtKj*Ps zZNd9PJ#baMZIh5|k1oabw6Xv)YxNecFh90!FWXwWm0}BXsahKZ^YkxYl6gwm9q`k81@!&3q~|)=1HBQW{OQntULf3 z%inC;$T_s5C^ON?QxED^ZKiy}*T~Z%H~zKwNJiGD&(9Fa=vd1yNh<&RKVeKS@uB}F zRP%2_yuV{L9E_ld3o92f7Yish%F6XW#cH_zIaUK|{v%ey3TpkESPiJ>KgMeQjMV&3 zaT*m+q(%)CtNDAR#scX0SF8q9{~b^H9Y6dlXk%z&Wu^Zsbn`2+1OVDO>0AECFpl~E zp+L^RgmV6GLpQE3!JB^#-~38``CItrZ>cW-8{r#vPUgRdZ`|BID9taOd}Q*lDX)iL zjr%NftY>9GP^wbu)Q6ksh6*K;y3Z9DNFDsRalO06&rfuP^=wL_@!oh>wwq3yM$nk>|yxNSBdpg{g(r z_bG3&8N6Z21SM#`t`L6ngS#7*1(w5K2sYG;)AlxEv(IZ>3x5>S-QO8vG-}J6&F-qt zeGMWj@J4Prgf+%Tp8HR=VjnNcB?^s*U;AQ6WOaVT>P0uFgGpkJ z@t27am1!%s1h=gk(-_AloAe6QVtXaJI7DpdjC+u$599P;8dXm)Np-l@5FyX`X_aJR zO-n#(Qy;IsQC$CPW{y7AmC!*m($8)3ca88wN^gaHIW^IUF~zClr^*_^T88OXX$9RS z_lt+%-sb%9AE9(MdtG#=rT#>Z{bunMqP-R~5!}@A>Hd4{gY#`7dC0p6Z-L4Pd-T-U zh>Iz_P{hTCCtG1{-C$}v&Y$eJ8Bc?giSK&s97U-(InU-CPCic@z#vLu#P_z0@Wj9; z+}VG^XpdsPJ>X5r`z)^p5dpR^Dz$_dl!KvuSw~PGQM|omzX&*xISBT=GbQ`!F-h$v(M@HC_VlGEf|006GGguTTkLKhB_uxrpR zXYfXNr4dZFVDtKv1Zh8uXq;Fet_(daournJ~9cN30ebVEy0YBR-tgazq(AJ`m{`) zTsc2EnchB7mz0Emw_JaGu-zl({WuCv3YLc7uods+2d8rm^yMSxXbj6hY#x)f*_!1I zSS0(vIp94K$l8~VvKgk$C;WjGTc)%6G6cZ{?;}b$YSuaxt%n02ysSn9M|Y?4TcKjB=V;wAFAEwDq*@`L|ZN%DMqdY*`@5c(v5y?mE2J$6TONIUa(SLbE^AbR4{3bm_soa4jQ)W=NRO zP_M?v_%ZkccL(Rsu(&i{qqlP;%p-_k6Tz)CGb+)wC`V56&UwxmX8G$LrWg|OsrcIcJ zB5ek|R$}jQ0{ghtSPJ@Fwj1`eQSsboH23n*XxSKQW%GSm_)E?FB)+Ke7+Ou_4?I&! z94icC)df^0`-QLG2iE;4fxUi`Y?oi%4yYRKzMFS&J>i(!Hc^FvuRkj^ppO@xwb$U94vW&jm;4rsExp-ZG%*PQqVyF`r7sk~Si|QMoiUE0i zpUid?_Tz$tsL%=9XGzCF(_1plx49J<>WRdmqW19Q=0?mSitZUagp(nL?>>fZ7+zLH zatD8sCX&u4HUILXt97*#nDhLt^Bi%F15Hr9GASFn5cSv_5 zA*D0|QUiiCN=Y{YinJgN(%mJ}{0HxS?|bj{e&754*ZR(4vCi3N@BPHt&sp=F{rr9p z`m{`;qW9o{8BC3f!s1(vp>ltkw%?$9G5B*=0w%B}(w=i?mlS_PvwN9Kfwe<8AiFz;;&A45uEUEG0mEqcP zPOJB!*x&aEt+Kk3Lj6=FBOf#?T4Q}|Q8nKPDQWXQU)K4UOHLmd>sQ;u*$@%Gu9#5h zkM(G{AS|1aCAb+QS2_d@%?v})g!?{ZPU2yXs(X{#_Ac;cvPu|ZxDx0Ju9d`3L1HEcKn7oasQ#3&cqfof(YTV&xJ-4gSqx97M$`lYgOmlVaVYxW zJlVjtU30PJv7(BW!jk6>K1Xxk(iG|ObYjxd<~DVNIMe7O^t4Q4O#aKzJpQ=)tNF#6hwtl;#T`I`_L&U=?mxHR^ zu+^I&M4x7}gr<l zD~l!5Wv!FJi7BvcW{sL!fOTNeyBdk;2Z9W|Dx4W~d9E|WtM?If1BJ(+9JX8$K(Mo| z>a#cbJ*v9u`kY<_24_UQtg6&JB8+HSh36Do(6q@hjbbMRbwIL#^W3um1Zs{N04ON+&<+j+{Ij=UJl)fKI?a8{>R87P{&-8j) zvY2;~(p8U#T7h!=RRWyt9lqyf;|aPa8-iFKxF+# zd3Ez9n@UJxSlHLcB!vvTB3~43OW@TfV_}T}$+1RnGQPAI8S+LZb>Khv@x(yFI$&|?y#OT&ya*Mno^O^dN#Asc>k?Wc&mTh1*XiId6a2_%HX1# zm2GB)_8E0=UzXwA7`Hy`X78r$wB{{!j$q^7?w6$npgdi{V($>ak@xiy6w(S`TKjC~ zN@?4)WYvvEFp_}jWBX>M6u9Rkpn!$-jk#wByD)j&b*vTti9GKUf^1gm!CVA&vYl{s5!@;uQD zayl9>{6=4U%Ej~z$9o&MwzBc?XB&)YQv6<^vnA*j#F#R%lcF`Y?%+cS<%Jw~J|r)k zol9tX-HFm=*5r~eMNqjolSSh|=U#?)0(s0x7E*amUs0K8auXMk#$jd%mDtn5t2Sod z@TEFgVSOrkS;QFGoT!H2gOw@y;*d@NhCdn!2eBv5y5f?!Vc0ulz~+3^qYLG{gF_NK z8#cO@N$LVRwZH4AaPfy33kqV#475*$2a~!m|5tc zk!AnbMq<=QL`wc1hM1OKnZ;2R7uqV>EbGk6+cBwh($bH^!|*!yanD2_shL{OD)yA1 zIej?DeI0c#%NtjI2#I}&FL>Odn;yv`FdN4#g3!LTU<5UObsdKA%+=gOhH7jW$=WNC=B@Gd z_>PUWo0(`LzSh6$LIa!RvNi_2)=kljCs+-pp1SMF6EqWXn=#Maw2KV; z*NzRrh9&?nN^VVLaXgs4wG~HE>8COFoi-TQ)fNFk*3&!i_r0^BUa%NRa(Vp~lypkJ z*~8W!Sm1qxKj$f967e!`@x&beC6Z1rpMRE4jyQht{;kN5#?r%!o^Kue=WXIOl+q=_ zn@e(|2r5;N=4i?gPUSbYaw@iK@$3nGS@F*DB|OGgz9CoojfkQqR)qvf?Rq%mRz-|T zlZf>;`jJ?ExR|hSoxO7x>{R6Q`8?sB-kv#EkkZ<&?^Y;kIHZ=un6c3hO7S#Ei>^yD zZepCthfPRsr}7|fo&mHJz_MVNtyv=slY!G}0LH>bn|7y`1`eX7rgVkdlTKGtbFS_Omsm-r>A$x^rXw6K6&IpxtLRJI)Nf*R3zI!jrQrD%yim4s&0nq%1F2 zq+m^@Az!)X2x<<|ZaJKsQ^sGcFP}cx2!wD3x}>G0m&80aXAQ_!RDM`rl_(`1-`*o| z;~^vWO(jPyTv0Sl_$nr|*ECGXCm%6|REbAdUfmKs6i^;_I(Ut+%E24W-GG)T|=R`=i z1u(XH3R~~7_eoYQ5(L*rSVEIoXt9n{m)gkJ;cP zYZrtWLy+6(T9B(eL9V; zb@a;*c4I=8;^&ATpCm5d#acdh4$^^Rve{&ZDk&8Tu58*I5C)9j#&f^-(YWhP^?F&j z6??**9U^(~q|>y1e{D~h@3b%wQrBJE8)&?5Lv?YW+8T1#Ymi*i0S_59?cq*nbWel}(II=IY+qQqKhmxZVUX!;CR z)I`D}35G0mT%Pi5X8UJm51AI0+|S>{Iy98KqaNfTvr(ja40VO~N}ix;1s_onhUdQu zs46t^M;IhjC@junW!+~s=FyGDB-s^jNT-z$b8Zv{usBq=FEOS&xO`lZ3Bkz7mx;)! zt;{UW;jMk3AM~aDYJYraz#B%ShF{^PTJa(Ow2r*8ZD}7fN!jlLUDnRQnb23DE+~hh zJvERibL}+^euH;K{hM+Xms8oZ#M#?V*&EzLzuf6Qtdb1z%CjLPCjUqyA0v(-Kv$W$ zBKtM*TicsYO}T~YBD6s>;85wAmNpV%ha1_c%J(a*JHDnYBHz?#J@+DQe5T9)`lt!v zFf=gEMTPiwgk6K#RjDqgme8gDg#bsSv7njg;_~iCVfnhIi$e{!c-B518AlURrtb=Z z6bqHYUcyz81>g1PG^W2^d0@=cDVu(=3=3X@smnRjM0J=!mvE4tfo)aqAxYd9Zt4ne zl1UBD1HKWQjqlv6sZ2bh-85e|KO5+tC3y-ix*$5Aoz(FJM=VDb~ z`N$x7D)Af@H#3e7QNjzY3pI2$W7Mxn%4VKw4GH-(p&xqvz%}UKBDQ-(8&#>kt6?Cw zDN~o|rQ%3?j(5r8J?K%pCi8eS4S&J=v6CGE6F2{ENPc2@>#W5TO+|98`Wo|R6J&SGI=k1te3?I0 za)z&L;Oat!1kwtmV*T`jV!wA6JZbC+Im;X{i*M>Rwj6D)5jLK&2@TzV2}ifU>8I4) zV9xk(K;>kDlfixYuMEiUvGWBytY$CC3#d4+Nj59oXH=ub2Qt&t ztYO3|;`th1bsTgftfY>1xEvfyQa1vaS9`Anc^-~h-Al8J>!iFtiWx!&|I+Ui!pz4# zFX5qYj3)fFWlO|P7BAvn<8wNdbfx=sP6ddUm)4Xy;c6_#F7hoIS8DRWAxCc`)&+D| z4M&CuXc@FRO`7*2@hU|Hx@Q`t^dL%&mgtI)#O$In*gf1uKblo$H^@xbDf1@r z>9fG`+p+qHx#v{O9YJp5vg*)P7Z4;COSp^hxz_r$TOinR`CeDg&k(bLd_bX(Ejv7)2tRbl0AFQ{*k{r~z&3 zaKCiL7FD1sgX#y`v@6+I*YXuwXMlGqes#G42o&=UOR}*ndxhG!SUM&7t$fE2G4pL) zR#)u|OznU=MV-Nsw_Py0Al3F=J5Y3bv&BV9kBy341E`AY8xm(#JXwg*hvoZ+IKjv~ z`4>?%MF?UVf5G|8MrJYGM(csa^}UT+Cb#)pc?;f}$DE1ZY4rL5%4>|%6wjYmra#Ae z!lXHJJRqW|u$nx?UW17|+N4#ykt}DBA)T3A=s>JQk0fS(h{0ugEhK$tRatwlP5}G}FghMu(1v>+Y@Z+>`3jU1M89 zr*D(IH_@97witbT2Bf)LhY;F}(eirWbOV_MytmctWesrY-d+^b5erf=TYBfmO2EqO z%_QuZ(*ZT>T4-f0A!+x+)g70W`!%U}jXL{pa*F>G0`Iq^A~z2|Dys-W;f6sx06r-H zzp{!D@E;H`l=RPO#h;h|PAh^?H~%@U2;%*xw4&zkNHQKCR0)6J!BE-5e?oX&3;!{h zX!1Mg>n}L3Yn0bDsLSCeLd)eh)YV@AS3d#of6CZhU;lptt{@;@$e%NI>Yl198Z^GQ zN%f1wbif1Rf}T*5N={eHN~^>&?dn%b_+jk%H-dO?KK^|Axv6o{oIcFw9cGiKYON9x)f za;Y5zcjz1?a>N;m#&y{`6T1hiR39BZ{_5Lx)%;i(_w1_GgyK`8x~h7&)t#=3^=A*2 zlpLiCG+&lmpci~B{ZT5*fj=2$W-?iNe@uSU)`q`|Tqm@sgU@isaL1T(jL8Oabe(Sd z;8fO_Iw85785Qk)zDZCjm8_9Ec+XVEwckA$D z!(Oh|MFK9qU$rAd8?1568n3*)g;V>Kl@$;tg^X0sz*5f}wrs0qTwB#Sf?7~CDbor& zF13|N_8nq2)J|uN=ydlO8`FA4_I_V;QxsU>P$Kp8$mcvgPKjatd@JkjC(Re$r5E}n z4Py55O92nXntbd=sNxBhXCL?5`?;JLuLR?_b|>O&2k0EHXqj{ed13E(NDaIiUh3cJ z1%y?F7apLcvu_K!mmhpsn<16zh;pUDJvQCF0pEaz`>uCq9~}DVzh&PJTSsF>J0%gn zL+{%QUMif3`~=s2noi0*ce%W%D+idq(?r%NQL(1IS%emPF#GTrN7u_@W_Kb2xj*{; zd0&YhA`urYpkppKNS;WW#iH$&N({X+c9lQjpqXdtQF9{wIQlN0nR7$l-M&>SW)cl9 zBtndv_ohg^FIU&I<|J;s89d_jhHuUYM;3zf7V96Bm?{38c)P`lkKGg5)Rk1UbhIQE zSIA6bu_uf#wOBHz>^Eeis=s5%IZbW2Vx!U6^AuL1#ZW&V9k`YHq9nY~F3XLjU5awYSPAJ&dXmT-EQ^PN53sdrgc;o-a6PH5Q`^69*5 zK|{98z1dAg^5(Z0IZd#Zw`iK*#-uNP9{VCLRFKAxZs^3_o)r)aNzJr)`rSQBw`{%< zHTzBNrgWrw9$@2;GrLr22ZBlexmQGGbPCKfcPa@Hz1DLYmDz92)X7%7agT}RTBCv@GOHfCj>CR1U3wA zJz>(;C%XDT3_c!b2_0t=AAb^2XMP+ySLk1V{N}^lXuo+(wu{>=M^*gfX3H!H>bv>u zD@@5tREXDyc)Ni+PEh=AD{Dho*uGO>Cl;2ub(*jjK`~W`{q1y|#7RB-y^Z^u7@6p#_Tsgau*&1C$p`0R@Z{HE{OeV|~uViWbOj!d-PmC8=y3h-8%9wsLy zn!PP}!LR)RVIOk-H&7L)h$mya7&+Y@!V~UP|r9Votg1k`B9B4d?E5Y z+u?S}%3SXxJz6yHa94Ywaaj-x+wB4awb=-!jAs;2tEmg;Ie4yAyxNAd^#vk-Fj{mH zvoBhjjh_XG*dL90>)Ay|?~c?qWDrFcwBcbF6tk`sPCkiT(M!D0g9Y!yKR%QWaEfNQZ_s`NCwPBh zSCqg`c;b!%AyUu>H`h%3M6Td#^++G(V%U}o7QJfdVBBCZLY~s?FP?6Z_!qy9lwKD(D$ee$PI^W zegpVrTN;S0>eCCzz3m^Xd|vI&=+$4h4x!ZfFRzZc7x72gGxRwnb*hBwm5cO zAY~-Tlw}!r1UFchpBm-zsH+iacQDVC%LI@B@mT9a&g!-!Z;~Cd>gOnPaYeHTOzP+e z3Rq9Dzvzrt8kyZ<$bY7=2Ubt&b;_-^amB?*mo&hi+Xqi?wSMaar8V(-+6*XkAjm4M zHs#;8$pYqxZQ}736U-uFpx5mGCL%U}do!ja+9nzij7R*x?g+69iKEA0Q zIcVx2umsMM=)TvzjqlYsR~Hxo@YF-N-#Es8I{X5hGpNi?y3N(!uN9qJF=Hu!OXp$G z`(dzmV_Kr0lSJR2uB)*(qZF9xqnqY}p=f^qYao~We)wL3ag{Oz>qN&*xtf%A1^KLm zhjxwfe*M*lS{i@;Q@L#UXSrkCaVRKr8RSgQc3-sd_v1ai?5xJrj!D{O&^!b(r!Sw7+Ek$pdK%Mxz=4vzmU6^Jf-Gx+D=7d9N3sM4}(2{8+@Cy*Mzr1wfHu|+sZs(v#qOyMIi==H&W&Ad#lhI|7no3My0S_?IakV z;qxP-W96Dg$mPi`pE%n3$>|fv=eO%?OLy~BORbEtcb*3*b-jQ?~`kf1QN=L$w$br-R=MGoS02CbuoK8$xR+8>o z!9&2q*1;A<$OZ7QwXt&+@PIS_G!a0ZUyFgvfS)QZ)^KJ`IYoery}gaKr3(Pe1>@r8 zZ-pK;U z4THgeATSUN=0s_5I(yo=7zc|5ecS z)bg5e3$^PQ;JRQVv`r6VAR;*c`;6i4yiA;2Io4<`uB z34*GEAp$%w0dA& zbr?4n7{Uemt+1bFziSBrue9869AsE32Alg-bN zGc^ICNMWvvbVfZ2Zd64~O$5yCootO3F#K!VEv;=I7>@48S9-O9T=0>hIF3bouyPw*ozxADsCE~Y}pLW21`}&8T{V75X z7*r<%{}_%4Ji!0a@qg#&-|ryQnsqp{`}G^y4*a`}AN9HL?=mRlm-=yo z_)t_-fAz=B556Ya{7V^N9@N*jzsW#Q80?p}!B8FeH$5;v56_?K=i+39VqtPZQFa1= zDwbYms2BpEm`m+Z45X-lR|Wv3?ab`~*TIjXE|nGs=m_ykJmeF7C??7;%FV|k29=Z) r2TP)Y8U_}HL3qGW2;x6$=v{MbI=dJ-x%>>=>!<;vHrkX>ki`3cuDm96 literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.txt new file mode 100644 index 00000000..914a460a --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-appctl.8.txt @@ -0,0 +1,222 @@ +ovn-appctl(8) OVN Manual ovn-appctl(8) + +NAME + ovn-appctl - utility for configuring running OVN daemons + +SYNOPSIS + ovn-appctl [-target=target | -t target] [-T secs | -timeout=secs] comā€ + mand [arg...] + + ovn-appctl -help + + ovn-appctl -version + +DESCRIPTION + OVN daemons accept certain commands at runtime to control their behavā€ + ior and query their settings. Every daemon accepts a common set of comā€ + mands documented under COMMON COMMANDS below. Some daemons support adā€ + ditional commands documented in their own manpages. + + The ovn-appctl program provides a simple way to invoke these commands. + The command to be sent is specified on ovn-appctlā€ā€™s command line as + non-option arguments. ovn-appctl sends the command and prints the daeā€ + monā€™s response on standard output. + + ovn-ctl is exactly similar to Open vSwitch ovs-appctl utility. + +COMMAND COMMANDS + Every OVN daemon supports a common set of commands, which are docuā€ + mented in this section. + + General Commands + These commands display daemon-specific commands and the running verā€ + sion. Note that these commands are different from the -help and -verā€ + sion options that return information about the ovn-appctl utility itā€ + self. + + list-commands + Lists the commands supported by the target. + + version + Displays the version and compilation date of the target. + + Logging Commands + OVN has several log levels. The highest-severity log level is: + + off No message is ever logged at this level, so setting a + logging destinationā€™s log level to off disables logging + to that destination. + + The following log levels, in order of descending severity, are availā€ + able: + + emer A major failure forced a process to abort. + + err A high-level operation or a subsystem failed. Attention + is warranted. + + warn A low-level operation failed, but higher-level subsystems + may be able to recover. + + info Information that may be useful in retrospect when invesā€ + tigating a problem. + + dbg Information useful only to someone with intricate knowlā€ + edge of the system, or that would commonly cause too-voā€ + luminous log output. Log messages at this level are not + logged by default. + + Every OVN daemon supports the following commands for examining and adā€ + justing log levels. + + vlog/list + Lists the known logging modules and their current levels. + + vlog/list-pattern + Lists logging pattern used for each destination. + + vlog/set [spec] + Sets logging levels. Without any spec, sets the log level + for every module and destination to dbg. Otherwise, spec + is a list of words separated by spaces or commas or + colons, up to one from each category below: + + ā€¢ A valid module name, as displayed by the vlog/list + command on ovn-appctl(8), limits the log level + change to the specified module. + + ā€¢ syslog, console, or file, to limit the log level + change to only to the system log, to the console, + or to a file, respectively. + + On Windows platform, syslog is accepted as a word + and is only useful if the target was started with + the --syslog-target option (the word has no effect + otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the + log level. Messages of the given severity or + higher will be logged, and messages of lower + severity will be filtered out. off filters out all + messages. + + Case is not significant within spec. + + vlog/set PATTERN:destination: pattern + Sets the log pattern for destination to pattern. Each + time a message is logged to destination, pattern deterā€ + mines the messageā€™s formatting. Most characters in patā€ + tern are copied literally to the log, but special escapes + beginning with % are expanded as follows: + + ā€¢ %A : The name of the application logging the mesā€ + sage, e.g. ovn-controller. + + ā€¢ %B : The RFC5424 syslog PRI of the message. + + ā€¢ %c : The name of the module (as shown by ovn-apā€ + pctl -list) logging the message. + + ā€¢ %d : The current date and time in ISO 8601 format + (YYYY-MM-DD HH:MM:SS). + + ā€¢ %d{format} : The current date and time in the + specified format, which takes the same format as + the template argument to strftime(3). As an extenā€ + sion, any # characters in format will be replaced + by fractional seconds, e.g. use %H:%M:%S.### for + the time to the nearest millisecond. Sub-second + times are only approximate and currently decimal + places after the third will always be reported as + zero. + + ā€¢ %D : The current UTC date and time in ISO 8601 + format (YYYY-MM-DD HH:MM:SS). + + ā€¢ %D{format} : The current UTC date and time in the + specified format, which takes the same format as + the template argument to strftime(3). Supports the + same extension for sub-second resolution as + %d{...}. + + ā€¢ %E : The hostname of the node running the applicaā€ + tion. + + ā€¢ %m : The message being logged. + + ā€¢ %N : A serial number for this message within this + run of the program, as a decimal number. The first + message a program logs has serial number 1, the + second one has serial number 2, and so on. + + ā€¢ %n : A new-line. + + ā€¢ %p : The level at which the message is logged, + e.g. DBG. + + ā€¢ %P : The programā€™s process ID (pid), as a decimal + number. + + ā€¢ %r : The number of milliseconds elapsed from the + start of the application to the time the message + was logged. + + ā€¢ %t : The subprogram name, that is, an identifying + name for the process or thread that emitted the + log message, such as monitor for the process used + for -monitor or main for the primary process or + thread in a program. + + ā€¢ %T : The subprogram name enclosed in parentheses, + e.g. (monitor), or the empty string for the priā€ + mary process or thread in a program. + + ā€¢ %% : A literal %. + + A few options may appear between the % and the format + specifier character, in this order: + + ā€¢ - : Left justify the escapeā€™s expansion within its + field width. Right justification is the default. + + ā€¢ - : Pad the field to the field width with 0s. + Padding with spaces is the default. + + width A number specifies the minimum field width. If the + escape expands to fewer characters than width then it is + padded to fill the field width. (A field wider than width + is not truncated to fit.) + + The default pattern for console and file output is + %D{%Y-%m-%dT %H:%M:%SZ}|%05N|%c|%p|%m; for syslog output, + %05N|%c|%p|%m. + + vlog/set FACILITY:facility + Sets the RFC5424 facility of the log message. facility + can be one of kern, user, mail, daemon, auth, syslog, + lpr, news, uucp, clock, ftp, ntp, audit, alert, clock2, + local0, local1, local2, local3, local4, local5, local6 or + local7. + + vlog/close + Causes the daemon to close its log file, if it is open. + (Use vlog/reopen to reopen it later.) + + vlog/reopen + Causes the daemon to close its log file, if it is open, + and then reopen it. (This is useful after rotating log + files, to cause a new log file to be used.) + + This has no effect if the target application was not inā€ + voked with the --log-file option. + +OPTIONS + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +OVN 23.06.3 ovn-appctl ovn-appctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-architecture.7 b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7 new file mode 100644 index 00000000..d21ae4dc --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7 @@ -0,0 +1,1207 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-architecture" 7 "OVN Architecture" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-architecture \- Open Virtual Network architecture +.SH "DESCRIPTION" +.PP +.PP +OVN, the Open Virtual Network, is a system to support logical network abstraction in virtual machine and container environments\[char46] OVN complements the existing capabilities of OVS to add native support for logical network abstractions, such as logical L2 and L3 overlays and security groups\[char46] Services such as DHCP are also desirable features\[char46] Just like OVS, OVN\(cqs design goal is to have a production-quality implementation that can operate at significant scale\[char46] +.PP +.PP +A physical network comprises physical wires, switches, and routers\[char46] A \fIvirtual network\fR extends a physical network into a hypervisor or container platform, bridging VMs or containers into the physical network\[char46] An OVN \fIlogical network\fR is a network implemented in software that is insulated from physical (and thus virtual) networks by tunnels or other encapsulations\[char46] This allows IP and other address spaces used in logical networks to overlap with those used on physical networks without causing conflicts\[char46] Logical network topologies can be arranged without regard for the topologies of the physical networks on which they run\[char46] Thus, VMs that are part of a logical network can migrate from one physical machine to another without network disruption\[char46] See \fBLogical Networks\fR, below, for more information\[char46] +.PP +.PP +The encapsulation layer prevents VMs and containers connected to a logical network from communicating with nodes on physical networks\[char46] For clustering VMs and containers, this can be acceptable or even desirable, but in many cases VMs and containers do need connectivity to physical networks\[char46] OVN provides multiple forms of \fIgateways\fR for this purpose\[char46] See \fBGateways\fR, below, for more information\[char46] +.PP +.PP +An OVN deployment consists of several components: +.RS +.IP \(bu +A \fICloud Management System\fR (\fICMS\fR), which is OVN\(cqs ultimate client (via its users and administrators)\[char46] OVN integration requires installing a CMS-specific plugin and related software (see below)\[char46] OVN initially targets OpenStack as CMS\[char46] +.IP +We generally speak of ``the\(cq\(cq CMS, but one can imagine scenarios in which multiple CMSes manage different parts of an OVN deployment\[char46] +.IP \(bu +An OVN Database physical or virtual node (or, eventually, cluster) installed in a central location\[char46] +.IP \(bu +One or more (usually many) \fIhypervisors\fR\[char46] Hypervisors must run Open vSwitch and implement the interface described in \fBDocumentation/topics/integration\[char46]rst\fR in the Open vSwitch source tree\[char46] Any hypervisor platform supported by Open vSwitch is acceptable\[char46] +.IP \(bu +Zero or more \fIgateways\fR\[char46] A gateway extends a tunnel-based logical network into a physical network by bidirectionally forwarding packets between tunnels and a physical Ethernet port\[char46] This allows non-virtualized machines to participate in logical networks\[char46] A gateway may be a physical host, a virtual machine, or an ASIC-based hardware switch that supports the \fBvtep\fR(5) schema\[char46] +.IP +Hypervisors and gateways are together called \fItransport node\fR or \fIchassis\fR\[char46] +.RE +.PP +.PP +The diagram below shows how the major components of OVN and related software interact\[char46] Starting at the top of the diagram, we have: +.RS +.IP \(bu +The Cloud Management System, as defined above\[char46] +.IP \(bu +The \fIOVN/CMS Plugin\fR is the component of the CMS that interfaces to OVN\[char46] In OpenStack, this is a Neutron plugin\[char46] The plugin\(cqs main purpose is to translate the CMS\(cqs notion of logical network configuration, stored in the CMS\(cqs configuration database in a CMS-specific format, into an intermediate representation understood by OVN\[char46] +.IP +This component is necessarily CMS-specific, so a new plugin needs to be developed for each CMS that is integrated with OVN\[char46] All of the components below this one in the diagram are CMS-independent\[char46] +.IP \(bu +The \fIOVN Northbound Database\fR receives the intermediate representation of logical network configuration passed down by the OVN/CMS Plugin\[char46] The database schema is meant to be ``impedance matched\(cq\(cq with the concepts used in a CMS, so that it directly supports notions of logical switches, routers, ACLs, and so on\[char46] See \fBovn\-nb\fR(5) for details\[char46] +.IP +The OVN Northbound Database has only two clients: the OVN/CMS Plugin above it and \fBovn\-northd\fR below it\[char46] +.IP \(bu +\fBovn\-northd\fR(8) connects to the OVN Northbound Database above it and the OVN Southbound Database below it\[char46] It translates the logical network configuration in terms of conventional network concepts, taken from the OVN Northbound Database, into logical datapath flows in the OVN Southbound Database below it\[char46] +.IP \(bu +The \fIOVN Southbound Database\fR is the center of the system\[char46] Its clients are \fBovn\-northd\fR(8) above it and \fBovn\-controller\fR(8) on every transport node below it\[char46] +.IP +The OVN Southbound Database contains three kinds of data: \fIPhysical +Network\fR (PN) tables that specify how to reach hypervisor and other nodes, \fILogical Network\fR (LN) tables that describe the logical network in terms of ``logical datapath flows,\(cq\(cq and \fIBinding\fR tables that link logical network components\(cq locations to the physical network\[char46] The hypervisors populate the PN and Port_Binding tables, whereas \fBovn\-northd\fR(8) populates the LN tables\[char46] +.IP +OVN Southbound Database performance must scale with the number of transport nodes\[char46] This will likely require some work on \fBovsdb\-server\fR(1) as we encounter bottlenecks\[char46] Clustering for availability may be needed\[char46] +.RE +.PP +.PP +The remaining components are replicated onto each hypervisor: +.RS +.IP \(bu +\fBovn\-controller\fR(8) is OVN\(cqs agent on each hypervisor and software gateway\[char46] Northbound, it connects to the OVN Southbound Database to learn about OVN configuration and status and to populate the PN table and the \fBChassis\fR column in \fBBinding\fR table with the hypervisor\(cqs status\[char46] Southbound, it connects to \fBovs\-vswitchd\fR(8) as an OpenFlow controller, for control over network traffic, and to the local \fBovsdb\-server\fR(1) to allow it to monitor and control Open vSwitch configuration\[char46] +.IP \(bu +\fBovs\-vswitchd\fR(8) and \fBovsdb\-server\fR(1) are conventional components of Open vSwitch\[char46] +.RE +.PP +.nf +\fL +.br +\fL CMS +.br +\fL | +.br +\fL | +.br +\fL +\-\-\-\-\-\-\-\-\-\-\-|\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL | | | +.br +\fL | OVN/CMS Plugin | +.br +\fL | | | +.br +\fL | | | +.br +\fL | OVN Northbound DB | +.br +\fL | | | +.br +\fL | | | +.br +\fL | ovn\-northd | +.br +\fL | | | +.br +\fL +\-\-\-\-\-\-\-\-\-\-\-|\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL | +.br +\fL | +.br +\fL +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL | OVN Southbound DB | +.br +\fL +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL | +.br +\fL | +.br +\fL +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL | | | +.br +\fL HV 1 | | HV n | +.br +\fL+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-|\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ \[char46] +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-|\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL| | | \[char46] | | | +.br +\fL| ovn\-controller | \[char46] | ovn\-controller | +.br +\fL| | | | \[char46] | | | | +.br +\fL| | | | | | | | +.br +\fL| ovs\-vswitchd ovsdb\-server | | ovs\-vswitchd ovsdb\-server | +.br +\fL| | | | +.br +\fL+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +.br +\fL \fR +.fi +.SS "Information Flow in OVN" +.PP +.PP +Configuration data in OVN flows from north to south\[char46] The CMS, through its OVN/CMS plugin, passes the logical network configuration to \fBovn\-northd\fR via the northbound database\[char46] In turn, \fBovn\-northd\fR compiles the configuration into a lower-level form and passes it to all of the chassis via the southbound database\[char46] +.PP +.PP +Status information in OVN flows from south to north\[char46] OVN currently provides only a few forms of status information\[char46] First, \fBovn\-northd\fR populates the \fBup\fR column in the northbound \fBLogical_Switch_Port\fR table: if a logical port\(cqs \fBchassis\fR column in the southbound \fBPort_Binding\fR table is nonempty, it sets \fBup\fR to \fBtrue\fR, otherwise to \fBfalse\fR\[char46] This allows the CMS to detect when a VM\(cqs networking has come up\[char46] +.PP +.PP +Second, OVN provides feedback to the CMS on the realization of its configuration, that is, whether the configuration provided by the CMS has taken effect\[char46] This feature requires the CMS to participate in a sequence number protocol, which works the following way: +.RS +.IP 1. .4in +When the CMS updates the configuration in the northbound database, as part of the same transaction, it increments the value of the \fBnb_cfg\fR column in the \fBNB_Global\fR table\[char46] (This is only necessary if the CMS wants to know when the configuration has been realized\[char46]) +.IP 2. .4in +When \fBovn\-northd\fR updates the southbound database based on a given snapshot of the northbound database, it copies \fBnb_cfg\fR from northbound \fBNB_Global\fR into the southbound database \fBSB_Global\fR table, as part of the same transaction\[char46] (Thus, an observer monitoring both databases can determine when the southbound database is caught up with the northbound\[char46]) +.IP 3. .4in +After \fBovn\-northd\fR receives confirmation from the southbound database server that its changes have committed, it updates \fBsb_cfg\fR in the northbound \fBNB_Global\fR table to the \fBnb_cfg\fR version that was pushed down\[char46] (Thus, the CMS or another observer can determine when the southbound database is caught up without a connection to the southbound database\[char46]) +.IP 4. .4in +The \fBovn\-controller\fR process on each chassis receives the updated southbound database, with the updated \fBnb_cfg\fR\[char46] This process in turn updates the physical flows installed in the chassis\(cqs Open vSwitch instances\[char46] When it receives confirmation from Open vSwitch that the physical flows have been updated, it updates \fBnb_cfg\fR in its own \fBChassis\fR record in the southbound database\[char46] +.IP 5. .4in +\fBovn\-northd\fR monitors the \fBnb_cfg\fR column in all of the \fBChassis\fR records in the southbound database\[char46] It keeps track of the minimum value among all the records and copies it into the \fBhv_cfg\fR column in the northbound \fBNB_Global\fR table\[char46] (Thus, the CMS or another observer can determine when all of the hypervisors have caught up to the northbound configuration\[char46]) +.RE +.SS "Chassis Setup" +.PP +.PP +Each chassis in an OVN deployment must be configured with an Open vSwitch bridge dedicated for OVN\(cqs use, called the \fIintegration bridge\fR\[char46] System startup scripts may create this bridge prior to starting \fBovn\-controller\fR if desired\[char46] If this bridge does not exist when ovn-controller starts, it will be created automatically with the default configuration suggested below\[char46] The ports on the integration bridge include: +.RS +.IP \(bu +On any chassis, tunnel ports that OVN uses to maintain logical network connectivity\[char46] \fBovn\-controller\fR adds, updates, and removes these tunnel ports\[char46] +.IP \(bu +On a hypervisor, any VIFs that are to be attached to logical networks\[char46] For instances connected through software emulated ports such as TUN/TAP or VETH pairs, the hypervisor itself will normally create ports and plug them into the integration bridge\[char46] For instances connected through representor ports, typically used with hardware offload, the \fBovn\-controller\fR may on CMS direction consult a VIF plug provider for representor port lookup and plug them into the integration bridge (please refer to \fBDocumentation/topics/vif\-plug\-providers/vif\-plug\-providers\[char46]rst +\fR for more information)\[char46] In both cases the conventions described in \fBDocumentation/topics/integration\[char46]rst\fR in the Open vSwitch source tree is followed to ensure mapping between OVN logical port and VIF\[char46] (This is pre-existing integration work that has already been done on hypervisors that support OVS\[char46]) +.IP \(bu +On a gateway, the physical port used for logical network connectivity\[char46] System startup scripts add this port to the bridge prior to starting \fBovn\-controller\fR\[char46] This can be a patch port to another bridge, instead of a physical port, in more sophisticated setups\[char46] +.RE +.PP +.PP +Other ports should not be attached to the integration bridge\[char46] In particular, physical ports attached to the underlay network (as opposed to gateway ports, which are physical ports attached to logical networks) must not be attached to the integration bridge\[char46] Underlay physical ports should instead be attached to a separate Open vSwitch bridge (they need not be attached to any bridge at all, in fact)\[char46] +.PP +.PP +The integration bridge should be configured as described below\[char46] The effect of each of these settings is documented in \fBovs\-vswitchd\[char46]conf\[char46]db\fR(5): +.RS +.TP +\fBfail\-mode=secure\fR +Avoids switching packets between isolated logical networks before \fBovn\-controller\fR starts up\[char46] See \fBController Failure +Settings\fR in \fBovs\-vsctl\fR(8) for more information\[char46] +.TP +\fBother\-config:disable\-in\-band=true\fR +Suppresses in-band control flows for the integration bridge\[char46] It would be unusual for such flows to show up anyway, because OVN uses a local controller (over a Unix domain socket) instead of a remote controller\[char46] It\(cqs possible, however, for some other bridge in the same system to have an in-band remote controller, and in that case this suppresses the flows that in-band control would ordinarily set up\[char46] Refer to the documentation for more information\[char46] +.RE +.PP +.PP +The customary name for the integration bridge is \fBbr\-int\fR, but another name may be used\[char46] +.SS "Logical Networks" +.PP +.PP +Logical network concepts in OVN include \fIlogical switches\fR and \fIlogical routers\fR, the logical version of Ethernet switches and IP routers, respectively\[char46] Like their physical cousins, logical switches and routers can be connected into sophisticated topologies\[char46] Logical switches and routers are ordinarily purely logical entities, that is, they are not associated or bound to any physical location, and they are implemented in a distributed manner at each hypervisor that participates in OVN\[char46] +.PP +.PP +\fILogical switch ports\fR (LSPs) are points of connectivity into and out of logical switches\[char46] There are many kinds of logical switch ports\[char46] The most ordinary kind represent VIFs, that is, attachment points for VMs or containers\[char46] A VIF logical port is associated with the physical location of its VM, which might change as the VM migrates\[char46] (A VIF logical port can be associated with a VM that is powered down or suspended\[char46] Such a logical port has no location and no connectivity\[char46]) +.PP +.PP +\fILogical router ports\fR (LRPs) are points of connectivity into and out of logical routers\[char46] A LRP connects a logical router either to a logical switch or to another logical router\[char46] Logical routers only connect to VMs, containers, and other network nodes indirectly, through logical switches\[char46] +.PP +.PP +Logical switches and logical routers have distinct kinds of logical ports, so properly speaking one should usually talk about logical switch ports or logical router ports\[char46] However, an unqualified ``logical port\(cq\(cq usually refers to a logical switch port\[char46] +.PP +.PP +When a VM sends a packet to a VIF logical switch port, the Open vSwitch flow tables simulate the packet\(cqs journey through that logical switch and any other logical routers and logical switches that it might encounter\[char46] This happens without transmitting the packet across any physical medium: the flow tables implement all of the switching and routing decisions and behavior\[char46] If the flow tables ultimately decide to output the packet at a logical port attached to another hypervisor (or another kind of transport node), then that is the time at which the packet is encapsulated for physical network transmission and sent\[char46] +.ST "Logical Switch Port Types" +.PP +.PP +OVN supports a number of kinds of logical switch ports\[char46] VIF ports that connect to VMs or containers, described above, are the most ordinary kind of LSP\[char46] In the OVN northbound database, VIF ports have an empty string for their \fBtype\fR\[char46] This section describes some of the additional port types\[char46] +.PP +.PP +A \fBrouter\fR logical switch port connects a logical switch to a logical router, designating a particular LRP as its peer\[char46] +.PP +.PP +A \fBlocalnet\fR logical switch port bridges a logical switch to a physical VLAN\[char46] A logical switch may have one or more \fBlocalnet\fR ports\[char46] Such a logical switch is used in two scenarios: +.RS +.IP \(bu +With one or more \fBrouter\fR logical switch ports, to attach L3 gateway routers and distributed gateways to a physical network\[char46] +.IP \(bu +With one or more VIF logical switch ports, to attach VMs or containers directly to a physical network\[char46] In this case, the logical switch is not really logical, since it is bridged to the physical network rather than insulated from it, and therefore cannot have independent but overlapping IP address namespaces, etc\[char46] A deployment might nevertheless choose such a configuration to take advantage of the OVN control plane and features such as port security and ACLs\[char46] +.RE +.PP +.PP +When a logical switch contains multiple \fBlocalnet\fR ports, the following is assumed\[char46] +.RS +.IP \(bu +Each chassis has a bridge mapping for one of the \fBlocalnet\fR physical networks only\[char46] +.IP \(bu +To facilitate interconnectivity between VIF ports of the switch that are located on different chassis with different physical network connectivity, the fabric implements L3 routing between these adjacent physical network segments\[char46] +.RE +.PP +.PP +Note: nothing said above implies that a chassis cannot be plugged to multiple physical networks as long as they belong to different switches\[char46] +.PP +.PP +A \fBlocalport\fR logical switch port is a special kind of VIF logical switch port\[char46] These ports are present in every chassis, not bound to any particular one\[char46] Traffic to such a port will never be forwarded through a tunnel, and traffic from such a port is expected to be destined only to the same chassis, typically in response to a request it received\[char46] OpenStack Neutron uses a \fBlocalport\fR port to serve metadata to VMs\[char46] A metadata proxy process is attached to this port on every host and all VMs within the same network will reach it at the same IP/MAC address without any traffic being sent over a tunnel\[char46] For further details, see the OpenStack documentation for networking-ovn\[char46] +.PP +.PP +LSP types \fBvtep\fR and \fBl2gateway\fR are used for gateways\[char46] See \fBGateways\fR, below, for more information\[char46] +.ST "Implementation Details" +.PP +.PP +These concepts are details of how OVN is implemented internally\[char46] They might still be of interest to users and administrators\[char46] +.PP +.PP +\fILogical datapaths\fR are an implementation detail of logical networks in the OVN southbound database\[char46] \fBovn\-northd\fR translates each logical switch or router in the northbound database into a logical datapath in the southbound database \fBDatapath_Binding\fR table\[char46] +.PP +.PP +For the most part, \fBovn\-northd\fR also translates each logical switch port in the OVN northbound database into a record in the southbound database \fBPort_Binding\fR table\[char46] The latter table corresponds roughly to the northbound \fBLogical_Switch_Port\fR table\[char46] It has multiple types of logical port bindings, of which many types correspond directly to northbound LSP types\[char46] LSP types handled this way include VIF (empty string), \fBlocalnet\fR, \fBlocalport\fR, \fBvtep\fR, and \fBl2gateway\fR\[char46] +.PP +.PP +The \fBPort_Binding\fR table has some types of port binding that do not correspond directly to logical switch port types\[char46] The common is \fBpatch\fR port bindings, known as \fIlogical patch ports\fR\[char46] These port bindings always occur in pairs, and a packet that enters on either side comes out on the other\[char46] \fBovn\-northd\fR connects logical switches and logical routers together using logical patch ports\[char46] +.PP +.PP +Port bindings with types \fBvtep\fR, \fBl2gateway\fR, \fBl3gateway\fR, and \fBchassisredirect\fR are used for gateways\[char46] These are explained in \fBGateways\fR, below\[char46] +.SS "Gateways" +.PP +.PP +Gateways provide limited connectivity between logical networks and physical ones\[char46] They can also provide connectivity between different OVN deployments\[char46] This section will focus on the former, and the latter will be described in details in section \fBOVN Deployments Interconnection\fR\[char46] +.PP +.PP +OVN support multiple kinds of gateways\[char46] +.ST "VTEP Gateways" +.PP +.PP +A ``VTEP gateway\(cq\(cq connects an OVN logical network to a physical (or virtual) switch that implements the OVSDB VTEP schema that accompanies Open vSwitch\[char46] (The ``VTEP gateway\(cq\(cq term is a misnomer, since a VTEP is just a VXLAN Tunnel Endpoint, but it is a well established name\[char46]) See \fBLife +Cycle of a VTEP gateway\fR, below, for more information\[char46] +.PP +.PP +The main intended use case for VTEP gateways is to attach physical servers to an OVN logical network using a physical top-of-rack switch that supports the OVSDB VTEP schema\[char46] +.ST "L2 Gateways" +.PP +.PP +A L2 gateway simply attaches a designated physical L2 segment available on some chassis to a logical network\[char46] The physical network effectively becomes part of the logical network\[char46] +.PP +.PP +To set up a L2 gateway, the CMS adds an \fBl2gateway\fR LSP to an appropriate logical switch, setting LSP options to name the chassis on which it should be bound\[char46] \fBovn\-northd\fR copies this configuration into a southbound \fBPort_Binding\fR record\[char46] On the designated chassis, \fBovn\-controller\fR forwards packets appropriately to and from the physical segment\[char46] +.PP +.PP +L2 gateway ports have features in common with \fBlocalnet\fR ports\[char46] However, with a \fBlocalnet\fR port, the physical network becomes the transport between hypervisors\[char46] With an L2 gateway, packets are still transported between hypervisors over tunnels and the \fBl2gateway\fR port is only used for the packets that are on the physical network\[char46] The application for L2 gateways is similar to that for VTEP gateways, e\[char46]g\[char46] to add non-virtualized machines to a logical network, but L2 gateways do not require special support from top-of-rack hardware switches\[char46] +.ST "L3 Gateway Routers" +.PP +.PP +As described above under \fBLogical Networks\fR, ordinary OVN logical routers are distributed: they are not implemented in a single place but rather in every hypervisor chassis\[char46] This is a problem for stateful services such as SNAT and DNAT, which need to be implemented in a centralized manner\[char46] +.PP +.PP +To allow for this kind of functionality, OVN supports L3 gateway routers, which are OVN logical routers that are implemented in a designated chassis\[char46] Gateway routers are typically used between distributed logical routers and physical networks\[char46] The distributed logical router and the logical switches behind it, to which VMs and containers attach, effectively reside on each hypervisor\[char46] The distributed router and the gateway router are connected by another logical switch, sometimes referred to as a ``join\(cq\(cq logical switch\[char46] (OVN logical routers may be connected to one another directly, without an intervening switch, but the OVN implementation only supports gateway logical routers that are connected to logical switches\[char46] Using a join logical switch also reduces the number of IP addresses needed on the distributed router\[char46]) On the other side, the gateway router connects to another logical switch that has a \fBlocalnet\fR port connecting to the physical network\[char46] +.PP +.PP +The following diagram shows a typical situation\[char46] One or more logical switches LS1, \[char46]\[char46]\[char46], LSn connect to distributed logical router LR1, which in turn connects through LSjoin to gateway logical router GLR, which also connects to logical switch LSlocal, which includes a \fBlocalnet\fR port to attach to the physical network\[char46] +.PP +.nf +\fL +.br +\fL LSlocal +.br +\fL | +.br +\fL GLR +.br +\fL | +.br +\fL LSjoin +.br +\fL | +.br +\fL LR1 +.br +\fL | +.br +\fL +\-\-\-\-+\-\-\-\-+ +.br +\fL | | | +.br +\fL LS1 \[char46]\[char46]\[char46] LSn +.br +\fL \fR +.fi +.PP +.PP +To configure an L3 gateway router, the CMS sets \fBoptions:chassis\fR in the router\(cqs northbound \fBLogical_Router\fR to the chassis\(cqs name\[char46] In response, \fBovn\-northd\fR uses a special \fBl3gateway\fR port binding (instead of a \fBpatch\fR binding) in the southbound database to connect the logical router to its neighbors\[char46] In turn, \fBovn\-controller\fR tunnels packets to this port binding to the designated L3 gateway chassis, instead of processing them locally\[char46] +.PP +.PP +DNAT and SNAT rules may be associated with a gateway router, which provides a central location that can handle one-to-many SNAT (aka IP masquerading)\[char46] Distributed gateway ports, described below, also support NAT\[char46] +.ST "Distributed Gateway Ports" +.PP +.PP +A \fIdistributed gateway port\fR is a logical router port that is specially configured to designate one distinguished chassis, called the \fIgateway chassis\fR, for centralized processing\[char46] A distributed gateway port should connect to a logical switch that has an LSP that connects externally, that is, either a \fBlocalnet\fR LSP or a connection to another OVN deployment (see \fBOVN Deployments +Interconnection\fR)\[char46] Packets that traverse the distributed gateway port are processed without involving the gateway chassis when they can be, but when needed they do take an extra hop through it\[char46] +.PP +.PP +The following diagram illustrates the use of a distributed gateway port\[char46] A number of logical switches LS1, \[char46]\[char46]\[char46], LSn connect to distributed logical router LR1, which in turn connects through the distributed gateway port to logical switch LSlocal that includes a \fBlocalnet\fR port to attach to the physical network\[char46] +.PP +.nf +\fL +.br +\fL LSlocal +.br +\fL | +.br +\fL LR1 +.br +\fL | +.br +\fL +\-\-\-\-+\-\-\-\-+ +.br +\fL | | | +.br +\fL LS1 \[char46]\[char46]\[char46] LSn +.br +\fL \fR +.fi +.PP +.PP +\fBovn\-northd\fR creates two southbound \fBPort_Binding\fR records to represent a distributed gateway port, instead of the usual one\[char46] One of these is a \fBpatch\fR port binding named for the LRP, which is used for as much traffic as it can\[char46] The other one is a port binding with type \fBchassisredirect\fR, named \fBcr\-\fIport\fB\fR\[char46] The \fBchassisredirect\fR port binding has one specialized job: when a packet is output to it, the flow table causes it to be tunneled to the gateway chassis, at which point it is automatically output to the \fBpatch\fR port binding\[char46] Thus, the flow table can output to this port binding in cases where a particular task has to happen on the gateway chassis\[char46] The \fBchassisredirect\fR port binding is not otherwise used (for example, it never receives packets)\[char46] +.PP +.PP +The CMS may configure distributed gateway ports three different ways\[char46] See \fBDistributed Gateway Ports\fR in the documentation for \fBLogical_Router_Port\fR in \fBovn\-nb\fR(5) for details\[char46] +.PP +.PP +Distributed gateway ports support high availability\[char46] When more than one chassis is specified, OVN only uses one at a time as the gateway chassis\[char46] OVN uses BFD to monitor gateway connectivity, preferring the highest-priority gateway that is online\[char46] +.PP +.PP +A logical router can have multiple distributed gateway ports, each connecting different external networks\[char46] Load balancing is not yet supported for logical routers with more than one distributed gateway port configured\[char46] +.SU "Physical VLAN MTU Issues" +.PP +.PP +Consider the preceding diagram again: +.PP +.nf +\fL +.br +\fL LSlocal +.br +\fL | +.br +\fL LR1 +.br +\fL | +.br +\fL +\-\-\-\-+\-\-\-\-+ +.br +\fL | | | +.br +\fL LS1 \[char46]\[char46]\[char46] LSn +.br +\fL \fR +.fi +.PP +.PP +Suppose that each logical switch LS1, \[char46]\[char46]\[char46], LSn is bridged to a physical VLAN-tagged network attached to a \fBlocalnet\fR port on LSlocal, over a distributed gateway port on LR1\[char46] If a packet originating on LS\fIi\fR is destined to the external network, OVN sends it to the gateway chassis over a tunnel\[char46] There, the packet traverses LR1\(cqs logical router pipeline, possibly undergoes NAT, and eventually ends up at LSlocal\(cqs \fBlocalnet\fR port\[char46] If all of the physical links in the network have the same MTU, then the packet\(cqs transit across a tunnel causes an MTU problem: tunnel overhead prevents a packet that uses the full physical MTU from crossing the tunnel to the gateway chassis (without fragmentation)\[char46] +.PP +.PP +OVN offers two solutions to this problem, the \fBreside\-on\-redirect\-chassis\fR and \fBredirect\-type\fR options\[char46] Both solutions require each logical switch LS1, \[char46]\[char46]\[char46], LSn to include a \fBlocalnet\fR logical switch port LN1, \[char46]\[char46]\[char46], LNn respectively, that is present on each chassis\[char46] Both cause packets to be sent over the \fBlocalnet\fR ports instead of tunnels\[char46] They differ in which packets\-some or all\-are sent this way\[char46] The most prominent tradeoff between these options is that \fBreside\-on\-redirect\-chassis\fR is easier to configure and that \fBredirect\-type\fR performs better for east-west traffic\[char46] +.PP +.PP +The first solution is the \fBreside\-on\-redirect\-chassis\fR option for logical router ports\[char46] Setting this option on a LRP from (e\[char46]g\[char46]) LS1 to LR1 disables forwarding from LS1 to LR1 except on the gateway chassis\[char46] On chassis other than the gateway chassis, this single change means that packets that would otherwise have been forwarded to LR1 are instead forwarded to LN1\[char46] The instance of LN1 on the gateway chassis then receives the packet and forwards it to LR1\[char46] The packet traverses the LR1 logical router pipeline, possibly undergoes NAT, and eventually ends up at LSlocal\(cqs \fBlocalnet\fR port\[char46] The packet never traverses a tunnel, avoiding the MTU issue\[char46] +.PP +.PP +This option has the further consequence of centralizing ``distributed\(cq\(cq logical router LR1, since no packets are forwarded from LS1 to LR1 on any chassis other than the gateway chassis\[char46] Therefore, east-west traffic passes through the gateway chassis, not just north-south\[char46] (The naive ``fix\(cq\(cq of allowing east-west traffic to flow directly between chassis over LN1 does not work because routing sets the Ethernet source address to LR1\(cqs source address\[char46] Seeing this single Ethernet source address originate from all of the chassis will confuse the physical switch\[char46]) +.PP +.PP +Do not set the \fBreside\-on\-redirect\-chassis\fR option on a distributed gateway port\[char46] In the diagram above, it would be set on the LRPs connecting LS1, \[char46]\[char46]\[char46], LSn to LR1\[char46] +.PP +.PP +The second solution is the \fBredirect\-type\fR option for distributed gateway ports\[char46] Setting this option to \fBbridged\fR causes packets that are redirected to the gateway chassis to go over the \fBlocalnet\fR ports instead of being tunneled\[char46] This option does not change how OVN treats packets not redirected to the gateway chassis\[char46] +.PP +.PP +The \fBredirect\-type\fR option requires the administrator or the CMS to configure each participating chassis with a unique Ethernet address for the logical router by setting \fBovn\-chassis\-mac\-mappings\fR in the Open vSwitch database, for use by \fBovn\-controller\fR\[char46] This makes it more difficult to configure than \fBreside\-on\-redirect\-chassis\fR\[char46] +.PP +.PP +Set the \fBredirect\-type\fR option on a distributed gateway port\[char46] +.SU "Using Distributed Gateway Ports For Scalability" +.PP +.PP +Although the primary goal of distributed gateway ports is to provide connectivity to external networks, there is a special use case for scalability\[char46] +.PP +.PP +In some deployments, such as the ones using \fBovn\-kubernetes\fR, logical switches are bound to individual chassises, and are connected by a distributed logical router\[char46] In such deployments, the chassis level logical switches are centralized on the chassis instead of distributed, which means the \fBovn\-controller\fR on each chassis doesn\(cqt need to process flows and ports of logical switches on other chassises\[char46] However, without any specific hint, \fBovn\-controller\fR would still process all the logical switches as if they are fully distributed\[char46] In this case, distributed gateway port can be very useful\[char46] The chassis level logical switches can be connected to the distributed router using distributed gateway ports, by setting the gateway chassis (or HA chassis groups with only a single chassis in it) to the chassis that each logical switch is bound to\[char46] \fBovn\-controller\fR would then skip processing the logical switches on all the other chassises, largely improving the scalability, especially when there are a big number of chassises\[char46] +.SS "Life Cycle of a VIF" +.PP +.PP +Tables and their schemas presented in isolation are difficult to understand\[char46] Here\(cqs an example\[char46] +.PP +.PP +A VIF on a hypervisor is a virtual network interface attached either to a VM or a container running directly on that hypervisor (This is different from the interface of a container running inside a VM)\[char46] +.PP +.PP +The steps in this example refer often to details of the OVN and OVN Northbound database schemas\[char46] Please see \fBovn\-sb\fR(5) and \fBovn\-nb\fR(5), respectively, for the full story on these databases\[char46] +.RS +.IP 1. .4in +A VIF\(cqs life cycle begins when a CMS administrator creates a new VIF using the CMS user interface or API and adds it to a switch (one implemented by OVN as a logical switch)\[char46] The CMS updates its own configuration\[char46] This includes associating unique, persistent identifier \fIvif-id\fR and Ethernet address \fImac\fR with the VIF\[char46] +.IP 2. .4in +The CMS plugin updates the OVN Northbound database to include the new VIF, by adding a row to the \fBLogical_Switch_Port\fR table\[char46] In the new row, \fBname\fR is \fIvif-id\fR, \fBmac\fR is \fImac\fR, \fBswitch\fR points to the OVN logical switch\(cqs Logical_Switch record, and other columns are initialized appropriately\[char46] +.IP 3. .4in +\fBovn\-northd\fR receives the OVN Northbound database update\[char46] In turn, it makes the corresponding updates to the OVN Southbound database, by adding rows to the OVN Southbound database \fBLogical_Flow\fR table to reflect the new port, e\[char46]g\[char46] add a flow to recognize that packets destined to the new port\(cqs MAC address should be delivered to it, and update the flow that delivers broadcast and multicast packets to include the new port\[char46] It also creates a record in the \fBBinding\fR table and populates all its columns except the column that identifies the \fBchassis\fR\[char46] +.IP 4. .4in +On every hypervisor, \fBovn\-controller\fR receives the \fBLogical_Flow\fR table updates that \fBovn\-northd\fR made in the previous step\[char46] As long as the VM that owns the VIF is powered off, \fBovn\-controller\fR cannot do much; it cannot, for example, arrange to send packets to or receive packets from the VIF, because the VIF does not actually exist anywhere\[char46] +.IP 5. .4in +Eventually, a user powers on the VM that owns the VIF\[char46] On the hypervisor where the VM is powered on, the integration between the hypervisor and Open vSwitch (described in \fBDocumentation/topics/integration\[char46]rst\fR in the Open vSwitch source tree) adds the VIF to the OVN integration bridge and stores \fIvif-id\fR in \fBexternal_ids\fR:\fBiface\-id\fR to indicate that the interface is an instantiation of the new VIF\[char46] (None of this code is new in OVN; this is pre-existing integration work that has already been done on hypervisors that support OVS\[char46]) +.IP 6. .4in +On the hypervisor where the VM is powered on, \fBovn\-controller\fR notices \fBexternal_ids\fR:\fBiface\-id\fR in the new Interface\[char46] In response, in the OVN Southbound DB, it updates the \fBBinding\fR table\(cqs \fBchassis\fR column for the row that links the logical port from \fBexternal_ids\fR:\fB +iface\-id\fR to the hypervisor\[char46] Afterward, \fBovn\-controller\fR updates the local hypervisor\(cqs OpenFlow tables so that packets to and from the VIF are properly handled\[char46] +.IP 7. .4in +Some CMS systems, including OpenStack, fully start a VM only when its networking is ready\[char46] To support this, \fBovn\-northd\fR notices the \fBchassis\fR column updated for the row in \fBBinding\fR table and pushes this upward by updating the \fBup\fR column in the OVN Northbound database\(cqs \fBLogical_Switch_Port\fR table to indicate that the VIF is now up\[char46] The CMS, if it uses this feature, can then react by allowing the VM\(cqs execution to proceed\[char46] +.IP 8. .4in +On every hypervisor but the one where the VIF resides, \fBovn\-controller\fR notices the completely populated row in the \fBBinding\fR table\[char46] This provides \fBovn\-controller\fR the physical location of the logical port, so each instance updates the OpenFlow tables of its switch (based on logical datapath flows in the OVN DB \fBLogical_Flow\fR table) so that packets to and from the VIF can be properly handled via tunnels\[char46] +.IP 9. .4in +Eventually, a user powers off the VM that owns the VIF\[char46] On the hypervisor where the VM was powered off, the VIF is deleted from the OVN integration bridge\[char46] +.IP 10. .4in +On the hypervisor where the VM was powered off, \fBovn\-controller\fR notices that the VIF was deleted\[char46] In response, it removes the \fBChassis\fR column content in the \fBBinding\fR table for the logical port\[char46] +.IP 11. .4in +On every hypervisor, \fBovn\-controller\fR notices the empty \fBChassis\fR column in the \fBBinding\fR table\(cqs row for the logical port\[char46] This means that \fBovn\-controller\fR no longer knows the physical location of the logical port, so each instance updates its OpenFlow table to reflect that\[char46] +.IP 12. .4in +Eventually, when the VIF (or its entire VM) is no longer needed by anyone, an administrator deletes the VIF using the CMS user interface or API\[char46] The CMS updates its own configuration\[char46] +.IP 13. .4in +The CMS plugin removes the VIF from the OVN Northbound database, by deleting its row in the \fBLogical_Switch_Port\fR table\[char46] +.IP 14. .4in +\fBovn\-northd\fR receives the OVN Northbound update and in turn updates the OVN Southbound database accordingly, by removing or updating the rows from the OVN Southbound database \fBLogical_Flow\fR table and \fBBinding\fR table that were related to the now-destroyed VIF\[char46] +.IP 15. .4in +On every hypervisor, \fBovn\-controller\fR receives the \fBLogical_Flow\fR table updates that \fBovn\-northd\fR made in the previous step\[char46] \fBovn\-controller\fR updates OpenFlow tables to reflect the update, although there may not be much to do, since the VIF had already become unreachable when it was removed from the \fBBinding\fR table in a previous step\[char46] +.RE +.SS "Life Cycle of a Container Interface Inside a VM" +.PP +.PP +OVN provides virtual network abstractions by converting information written in OVN_NB database to OpenFlow flows in each hypervisor\[char46] Secure virtual networking for multi-tenants can only be provided if OVN controller is the only entity that can modify flows in Open vSwitch\[char46] When the Open vSwitch integration bridge resides in the hypervisor, it is a fair assumption to make that tenant workloads running inside VMs cannot make any changes to Open vSwitch flows\[char46] +.PP +.PP +If the infrastructure provider trusts the applications inside the containers not to break out and modify the Open vSwitch flows, then containers can be run in hypervisors\[char46] This is also the case when containers are run inside the VMs and Open vSwitch integration bridge with flows added by OVN controller resides in the same VM\[char46] For both the above cases, the workflow is the same as explained with an example in the previous section (\(dqLife Cycle of a VIF\(dq)\[char46] +.PP +.PP +This section talks about the life cycle of a container interface (CIF) when containers are created in the VMs and the Open vSwitch integration bridge resides inside the hypervisor\[char46] In this case, even if a container application breaks out, other tenants are not affected because the containers running inside the VMs cannot modify the flows in the Open vSwitch integration bridge\[char46] +.PP +.PP +When multiple containers are created inside a VM, there are multiple CIFs associated with them\[char46] The network traffic associated with these CIFs need to reach the Open vSwitch integration bridge running in the hypervisor for OVN to support virtual network abstractions\[char46] OVN should also be able to distinguish network traffic coming from different CIFs\[char46] There are two ways to distinguish network traffic of CIFs\[char46] +.PP +.PP +One way is to provide one VIF for every CIF (1:1 model)\[char46] This means that there could be a lot of network devices in the hypervisor\[char46] This would slow down OVS because of all the additional CPU cycles needed for the management of all the VIFs\[char46] It would also mean that the entity creating the containers in a VM should also be able to create the corresponding VIFs in the hypervisor\[char46] +.PP +.PP +The second way is to provide a single VIF for all the CIFs (1:many model)\[char46] OVN could then distinguish network traffic coming from different CIFs via a tag written in every packet\[char46] OVN uses this mechanism and uses VLAN as the tagging mechanism\[char46] +.RS +.IP 1. .4in +A CIF\(cqs life cycle begins when a container is spawned inside a VM by the either the same CMS that created the VM or a tenant that owns that VM or even a container Orchestration System that is different than the CMS that initially created the VM\[char46] Whoever the entity is, it will need to know the \fIvif-id\fR that is associated with the network interface of the VM through which the container interface\(cqs network traffic is expected to go through\[char46] The entity that creates the container interface will also need to choose an unused VLAN inside that VM\[char46] +.IP 2. .4in +The container spawning entity (either directly or through the CMS that manages the underlying infrastructure) updates the OVN Northbound database to include the new CIF, by adding a row to the \fBLogical_Switch_Port\fR table\[char46] In the new row, \fBname\fR is any unique identifier, \fBparent_name\fR is the \fIvif-id\fR of the VM through which the CIF\(cqs network traffic is expected to go through and the \fBtag\fR is the VLAN tag that identifies the network traffic of that CIF\[char46] +.IP 3. .4in +\fBovn\-northd\fR receives the OVN Northbound database update\[char46] In turn, it makes the corresponding updates to the OVN Southbound database, by adding rows to the OVN Southbound database\(cqs \fBLogical_Flow\fR table to reflect the new port and also by creating a new row in the \fBBinding\fR table and populating all its columns except the column that identifies the \fBchassis\fR\[char46] +.IP 4. .4in +On every hypervisor, \fBovn\-controller\fR subscribes to the changes in the \fBBinding\fR table\[char46] When a new row is created by \fBovn\-northd\fR that includes a value in \fBparent_port\fR column of \fBBinding\fR table, the \fBovn\-controller\fR in the hypervisor whose OVN integration bridge has that same value in \fIvif-id\fR in \fBexternal_ids\fR:\fBiface\-id\fR updates the local hypervisor\(cqs OpenFlow tables so that packets to and from the VIF with the particular VLAN \fBtag\fR are properly handled\[char46] Afterward it updates the \fBchassis\fR column of the \fBBinding\fR to reflect the physical location\[char46] +.IP 5. .4in +One can only start the application inside the container after the underlying network is ready\[char46] To support this, \fBovn\-northd\fR notices the updated \fBchassis\fR column in \fBBinding\fR table and updates the \fBup\fR column in the OVN Northbound database\(cqs \fBLogical_Switch_Port\fR table to indicate that the CIF is now up\[char46] The entity responsible to start the container application queries this value and starts the application\[char46] +.IP 6. .4in +Eventually the entity that created and started the container, stops it\[char46] The entity, through the CMS (or directly) deletes its row in the \fBLogical_Switch_Port\fR table\[char46] +.IP 7. .4in +\fBovn\-northd\fR receives the OVN Northbound update and in turn updates the OVN Southbound database accordingly, by removing or updating the rows from the OVN Southbound database \fBLogical_Flow\fR table that were related to the now-destroyed CIF\[char46] It also deletes the row in the \fBBinding\fR table for that CIF\[char46] +.IP 8. .4in +On every hypervisor, \fBovn\-controller\fR receives the \fBLogical_Flow\fR table updates that \fBovn\-northd\fR made in the previous step\[char46] \fBovn\-controller\fR updates OpenFlow tables to reflect the update\[char46] +.RE +.SS "Architectural Physical Life Cycle of a Packet" +.PP +.PP +This section describes how a packet travels from one virtual machine or container to another through OVN\[char46] This description focuses on the physical treatment of a packet; for a description of the logical life cycle of a packet, please refer to the \fBLogical_Flow\fR table in \fBovn\-sb\fR(5)\[char46] +.PP +.PP +This section mentions several data and metadata fields, for clarity summarized here: +.RS +.TP +tunnel key +When OVN encapsulates a packet in Geneve or another tunnel, it attaches extra data to it to allow the receiving OVN instance to process it correctly\[char46] This takes different forms depending on the particular encapsulation, but in each case we refer to it here as the ``tunnel key\[char46]\(cq\(cq See \fBTunnel Encapsulations\fR, below, for details\[char46] +.TP +logical datapath field +A field that denotes the logical datapath through which a packet is being processed\[char46] OVN uses the field that OpenFlow 1\[char46]1+ simply (and confusingly) calls ``metadata\(cq\(cq to store the logical datapath\[char46] (This field is passed across tunnels as part of the tunnel key\[char46]) +.TP +logical input port field +A field that denotes the logical port from which the packet entered the logical datapath\[char46] OVN stores this in Open vSwitch extension register number 14\[char46] +.IP +Geneve and STT tunnels pass this field as part of the tunnel key\[char46] Ramp switch VXLAN tunnels do not explicitly carry a logical input port, but since they are used to communicate with gateways that from OVN\(cqs perspective consist of only a single logical port, so that OVN can set the logical input port field to this one on ingress to the OVN logical pipeline\[char46] As for regular VXLAN tunnels, they don\(cqt carry input port field at all\[char46] This puts additional limitations on cluster capabilities that are described in \fBTunnel Encapsulations\fR section\[char46] +.TP +logical output port field +A field that denotes the logical port from which the packet will leave the logical datapath\[char46] This is initialized to 0 at the beginning of the logical ingress pipeline\[char46] OVN stores this in Open vSwitch extension register number 15\[char46] +.IP +Geneve, STT and regular VXLAN tunnels pass this field as part of the tunnel key\[char46] Ramp switch VXLAN tunnels do not transmit the logical output port field, and since they do not carry a logical output port field in the tunnel key, when a packet is received from ramp switch VXLAN tunnel by an OVN hypervisor, the packet is resubmitted to table 8 to determine the output port(s); when the packet reaches table 39, these packets are resubmitted to table 40 for local delivery by checking a MLF_RCV_FROM_RAMP flag, which is set when the packet arrives from a ramp tunnel\[char46] +.TP +conntrack zone field for logical ports +A field that denotes the connection tracking zone for logical ports\[char46] The value only has local significance and is not meaningful between chassis\[char46] This is initialized to 0 at the beginning of the logical ingress pipeline\[char46] OVN stores this in Open vSwitch extension register number 13\[char46] +.TP +conntrack zone fields for routers +Fields that denote the connection tracking zones for routers\[char46] These values only have local significance and are not meaningful between chassis\[char46] OVN stores the zone information for north to south traffic (for DNATting or ECMP symmetric replies) in Open vSwitch extension register number 11 and zone information for south to north traffic (for SNATing) in Open vSwitch extension register number 12\[char46] +.TP +logical flow flags +The logical flags are intended to handle keeping context between tables in order to decide which rules in subsequent tables are matched\[char46] These values only have local significance and are not meaningful between chassis\[char46] OVN stores the logical flags in Open vSwitch extension register number 10\[char46] +.TP +VLAN ID +The VLAN ID is used as an interface between OVN and containers nested inside a VM (see \fBLife Cycle of a container interface inside a +VM\fR, above, for more information)\[char46] +.RE +.PP +.PP +Initially, a VM or container on the ingress hypervisor sends a packet on a port attached to the OVN integration bridge\[char46] Then: +.RS +.IP 1. .4in +OpenFlow table 0 performs physical-to-logical translation\[char46] It matches the packet\(cqs ingress port\[char46] Its actions annotate the packet with logical metadata, by setting the logical datapath field to identify the logical datapath that the packet is traversing and the logical input port field to identify the ingress port\[char46] Then it resubmits to table 8 to enter the logical ingress pipeline\[char46] +.IP +Packets that originate from a container nested within a VM are treated in a slightly different way\[char46] The originating container can be distinguished based on the VIF-specific VLAN ID, so the physical-to-logical translation flows additionally match on VLAN ID and the actions strip the VLAN header\[char46] Following this step, OVN treats packets from containers just like any other packets\[char46] +.IP +Table 0 also processes packets that arrive from other chassis\[char46] It distinguishes them from other packets by ingress port, which is a tunnel\[char46] As with packets just entering the OVN pipeline, the actions annotate these packets with logical datapath metadata\[char46] For tunnel types that support it, they are also annotated with logical ingress port metadata\[char46] In addition, the actions set the logical output port field, which is available because in OVN tunneling occurs after the logical output port is known\[char46] These pieces of information are obtained from the tunnel encapsulation metadata (see \fBTunnel +Encapsulations\fR for encoding details)\[char46] Then the actions resubmit to table 38 to enter the logical egress pipeline\[char46] +.IP 2. .4in +OpenFlow tables 8 through 31 execute the logical ingress pipeline from the \fBLogical_Flow\fR table in the OVN Southbound database\[char46] These tables are expressed entirely in terms of logical concepts like logical ports and logical datapaths\[char46] A big part of \fBovn\-controller\fR\(cqs job is to translate them into equivalent OpenFlow (in particular it translates the table numbers: \fBLogical_Flow\fR tables 0 through 23 become OpenFlow tables 8 through 31)\[char46] +.IP +Each logical flow maps to one or more OpenFlow flows\[char46] An actual packet ordinarily matches only one of these, although in some cases it can match more than one of these flows (which is not a problem because all of them have the same actions)\[char46] \fBovn\-controller\fR uses the first 32 bits of the logical flow\(cqs UUID as the cookie for its OpenFlow flow or flows\[char46] (This is not necessarily unique, since the first 32 bits of a logical flow\(cqs UUID is not necessarily unique\[char46]) +.IP +Some logical flows can map to the Open vSwitch ``conjunctive match\(cq\(cq extension (see \fBovs\-fields\fR(7))\[char46] Flows with a \fBconjunction\fR action use an OpenFlow cookie of 0, because they can correspond to multiple logical flows\[char46] The OpenFlow flow for a conjunctive match includes a match on \fBconj_id\fR\[char46] +.IP +Some logical flows may not be represented in the OpenFlow tables on a given hypervisor, if they could not be used on that hypervisor\[char46] For example, if no VIF in a logical switch resides on a given hypervisor, and the logical switch is not otherwise reachable on that hypervisor (e\[char46]g\[char46] over a series of hops through logical switches and routers starting from a VIF on the hypervisor), then the logical flow may not be represented there\[char46] +.IP +Most OVN actions have fairly obvious implementations in OpenFlow (with OVS extensions), e\[char46]g\[char46] \fBnext;\fR is implemented as \fBresubmit\fR, \fB\fIfield\fB = +\fIconstant\fB;\fR as \fBset_field\fR\[char46] A few are worth describing in more detail: +.RS +.TP +\fBoutput:\fR +Implemented by resubmitting the packet to table 37\[char46] If the pipeline executes more than one \fBoutput\fR action, then each one is separately resubmitted to table 37\[char46] This can be used to send multiple copies of the packet to multiple ports\[char46] (If the packet was not modified between the \fBoutput\fR actions, and some of the copies are destined to the same hypervisor, then using a logical multicast output port would save bandwidth between hypervisors\[char46]) +.TP +\fBget_arp(\fIP\fB, \fIA\fB);\fR +.TQ .5in +\fBget_nd(\fIP\fB, \fIA\fB);\fR +Implemented by storing arguments into OpenFlow fields, then resubmitting to table 66, which \fBovn\-controller\fR populates with flows generated from the \fBMAC_Binding\fR table in the OVN Southbound database\[char46] If there is a match in table 66, then its actions store the bound MAC in the Ethernet destination address field\[char46] +.IP +(The OpenFlow actions save and restore the OpenFlow fields used for the arguments, so that the OVN actions do not have to be aware of this temporary use\[char46]) +.TP +\fBput_arp(\fIP\fB, \fIA\fB, \fIE\fB);\fR +.TQ .5in +\fBput_nd(\fIP\fB, \fIA\fB, \fIE\fB);\fR +Implemented by storing the arguments into OpenFlow fields, then outputting a packet to \fBovn\-controller\fR, which updates the \fBMAC_Binding\fR table\[char46] +.IP +(The OpenFlow actions save and restore the OpenFlow fields used for the arguments, so that the OVN actions do not have to be aware of this temporary use\[char46]) +.TP +\fB\fIR\fB = lookup_arp(\fIP\fB, \fIA\fB, \fIM\fB);\fR +.TQ .5in +\fB\fIR\fB = lookup_nd(\fIP\fB, \fIA\fB, \fIM\fB);\fR +Implemented by storing arguments into OpenFlow fields, then resubmitting to table 67, which \fBovn\-controller\fR populates with flows generated from the \fBMAC_Binding\fR table in the OVN Southbound database\[char46] If there is a match in table 67, then its actions set the logical flow flag \fBMLF_LOOKUP_MAC\fR\[char46] +.IP +(The OpenFlow actions save and restore the OpenFlow fields used for the arguments, so that the OVN actions do not have to be aware of this temporary use\[char46]) +.RE +.IP 3. .4in +OpenFlow tables 37 through 41 implement the \fBoutput\fR action in the logical ingress pipeline\[char46] Specifically, table 37 serves as an entry point to egress pipeline\[char46] Table 37 detects IP packets that are too big for a corresponding interface\[char46] Table 38 produces ICMPv4 Fragmentation Needed (or ICMPv6 Too Big) errors and deliver them back to the offending port\[char46] table 39 handles packets to remote hypervisors, table 40 handles packets to the local hypervisor, and table 41 checks whether packets whose logical ingress and egress port are the same should be discarded\[char46] +.IP +Logical patch ports are a special case\[char46] Logical patch ports do not have a physical location and effectively reside on every hypervisor\[char46] Thus, flow table 40, for output to ports on the local hypervisor, naturally implements output to unicast logical patch ports too\[char46] However, applying the same logic to a logical patch port that is part of a logical multicast group yields packet duplication, because each hypervisor that contains a logical port in the multicast group will also output the packet to the logical patch port\[char46] Thus, multicast groups implement output to logical patch ports in table 39\[char46] +.IP +Each flow in table 39 matches on a logical output port for unicast or multicast logical ports that include a logical port on a remote hypervisor\[char46] Each flow\(cqs actions implement sending a packet to the port it matches\[char46] For unicast logical output ports on remote hypervisors, the actions set the tunnel key to the correct value, then send the packet on the tunnel port to the correct hypervisor\[char46] (When the remote hypervisor receives the packet, table 0 there will recognize it as a tunneled packet and pass it along to table 40\[char46]) For multicast logical output ports, the actions send one copy of the packet to each remote hypervisor, in the same way as for unicast destinations\[char46] If a multicast group includes a logical port or ports on the local hypervisor, then its actions also resubmit to table 40\[char46] Table 39 also includes: +.RS +.IP \(bu +A higher-priority rule to match packets received from ramp switch tunnels, based on flag MLF_RCV_FROM_RAMP, and resubmit these packets to table 40 for local delivery\[char46] Packets received from ramp switch tunnels reach here because of a lack of logical output port field in the tunnel key and thus these packets needed to be submitted to table 8 to determine the output port\[char46] +.IP \(bu +A higher-priority rule to match packets received from ports of type \fBlocalport\fR, based on the logical input port, and resubmit these packets to table 40 for local delivery\[char46] Ports of type \fBlocalport\fR exist on every hypervisor and by definition their traffic should never go out through a tunnel\[char46] +.IP \(bu +A higher-priority rule to match packets that have the MLF_LOCAL_ONLY logical flow flag set, and whose destination is a multicast address\[char46] This flag indicates that the packet should not be delivered to remote hypervisors, even if the multicast destination includes ports on remote hypervisors\[char46] This flag is used when \fBovn\-controller\fR is the originator of the multicast packet\[char46] Since each \fBovn\-controller\fR instance is originating these packets, the packets only need to be delivered to local ports\[char46] +.IP \(bu +A fallback flow that resubmits to table 40 if there is no other match\[char46] +.RE +.IP +Flows in table 40 resemble those in table 39 but for logical ports that reside locally rather than remotely\[char46] For unicast logical output ports on the local hypervisor, the actions just resubmit to table 41\[char46] For multicast output ports that include one or more logical ports on the local hypervisor, for each such logical port \fIP\fR, the actions change the logical output port to \fIP\fR, then resubmit to table 41\[char46] +.IP +A special case is that when a localnet port exists on the datapath, remote port is connected by switching to the localnet port\[char46] In this case, instead of adding a flow in table 39 to reach the remote port, a flow is added in table 40 to switch the logical outport to the localnet port, and resubmit to table 40 as if it were unicasted to a logical port on the local hypervisor\[char46] +.IP +Table 41 matches and drops packets for which the logical input and output ports are the same and the MLF_ALLOW_LOOPBACK flag is not set\[char46] It also drops MLF_LOCAL_ONLY packets directed to a localnet port\[char46] It resubmits other packets to table 42\[char46] +.IP 4. .4in +OpenFlow tables 42 through 62 execute the logical egress pipeline from the \fBLogical_Flow\fR table in the OVN Southbound database\[char46] The egress pipeline can perform a final stage of validation before packet delivery\[char46] Eventually, it may execute an \fBoutput\fR action, which \fBovn\-controller\fR implements by resubmitting to table 64\[char46] A packet for which the pipeline never executes \fBoutput\fR is effectively dropped (although it may have been transmitted through a tunnel across a physical network)\[char46] +.IP +The egress pipeline cannot change the logical output port or cause further tunneling\[char46] +.IP 5. .4in +Table 64 bypasses OpenFlow loopback when MLF_ALLOW_LOOPBACK is set\[char46] Logical loopback was handled in table 41, but OpenFlow by default also prevents loopback to the OpenFlow ingress port\[char46] Thus, when MLF_ALLOW_LOOPBACK is set, OpenFlow table 64 saves the OpenFlow ingress port, sets it to zero, resubmits to table 65 for logical-to-physical transformation, and then restores the OpenFlow ingress port, effectively disabling OpenFlow loopback prevents\[char46] When MLF_ALLOW_LOOPBACK is unset, table 64 flow simply resubmits to table 65\[char46] +.IP 6. .4in +OpenFlow table 65 performs logical-to-physical translation, the opposite of table 0\[char46] It matches the packet\(cqs logical egress port\[char46] Its actions output the packet to the port attached to the OVN integration bridge that represents that logical port\[char46] If the logical egress port is a container nested with a VM, then before sending the packet the actions push on a VLAN header with an appropriate VLAN ID\[char46] +.RE +.SS "Logical Routers and Logical Patch Ports" +.PP +.PP +Typically logical routers and logical patch ports do not have a physical location and effectively reside on every hypervisor\[char46] This is the case for logical patch ports between logical routers and logical switches behind those logical routers, to which VMs (and VIFs) attach\[char46] +.PP +.PP +Consider a packet sent from one virtual machine or container to another VM or container that resides on a different subnet\[char46] The packet will traverse tables 0 to 65 as described in the previous section \fBArchitectural Physical Life Cycle of a Packet\fR, using the logical datapath representing the logical switch that the sender is attached to\[char46] At table 39, the packet will use the fallback flow that resubmits locally to table 40 on the same hypervisor\[char46] In this case, all of the processing from table 0 to table 65 occurs on the hypervisor where the sender resides\[char46] +.PP +.PP +When the packet reaches table 65, the logical egress port is a logical patch port\[char46] \fBovn\-controller\fR implements output to the logical patch is packet by cloning and resubmitting directly to the first OpenFlow flow table in the ingress pipeline, setting the logical ingress port to the peer logical patch port, and using the peer logical patch port\(cqs logical datapath (that represents the logical router)\[char46] +.PP +.PP +The packet re-enters the ingress pipeline in order to traverse tables 8 to 65 again, this time using the logical datapath representing the logical router\[char46] The processing continues as described in the previous section \fBArchitectural Physical Life Cycle of a Packet\fR\[char46] When the packet reaches table 65, the logical egress port will once again be a logical patch port\[char46] In the same manner as described above, this logical patch port will cause the packet to be resubmitted to OpenFlow tables 8 to 65, this time using the logical datapath representing the logical switch that the destination VM or container is attached to\[char46] +.PP +.PP +The packet traverses tables 8 to 65 a third and final time\[char46] If the destination VM or container resides on a remote hypervisor, then table 39 will send the packet on a tunnel port from the sender\(cqs hypervisor to the remote hypervisor\[char46] Finally table 65 will output the packet directly to the destination VM or container\[char46] +.PP +.PP +The following sections describe two exceptions, where logical routers and/or logical patch ports are associated with a physical location\[char46] +.ST "Gateway Routers" +.PP +.PP +A \fIgateway router\fR is a logical router that is bound to a physical location\[char46] This includes all of the logical patch ports of the logical router, as well as all of the peer logical patch ports on logical switches\[char46] In the OVN Southbound database, the \fBPort_Binding\fR entries for these logical patch ports use the type \fBl3gateway\fR rather than \fBpatch\fR, in order to distinguish that these logical patch ports are bound to a chassis\[char46] +.PP +.PP +When a hypervisor processes a packet on a logical datapath representing a logical switch, and the logical egress port is a \fBl3gateway\fR port representing connectivity to a gateway router, the packet will match a flow in table 39 that sends the packet on a tunnel port to the chassis where the gateway router resides\[char46] This processing in table 39 is done in the same manner as for VIFs\[char46] +.ST "Distributed Gateway Ports" +.PP +.PP +This section provides additional details on distributed gateway ports, outlined earlier\[char46] +.PP +.PP +The primary design goal of distributed gateway ports is to allow as much traffic as possible to be handled locally on the hypervisor where a VM or container resides\[char46] Whenever possible, packets from the VM or container to the outside world should be processed completely on that VM\(cqs or container\(cqs hypervisor, eventually traversing a localnet port instance or a tunnel to the physical network or a different OVN deployment\[char46] Whenever possible, packets from the outside world to a VM or container should be directed through the physical network directly to the VM\(cqs or container\(cqs hypervisor\[char46] +.PP +.PP +In order to allow for the distributed processing of packets described in the paragraph above, distributed gateway ports need to be logical patch ports that effectively reside on every hypervisor, rather than \fBl3gateway\fR ports that are bound to a particular chassis\[char46] However, the flows associated with distributed gateway ports often need to be associated with physical locations, for the following reasons: +.RS +.IP \(bu +The physical network that the localnet port is attached to typically uses L2 learning\[char46] Any Ethernet address used over the distributed gateway port must be restricted to a single physical location so that upstream L2 learning is not confused\[char46] Traffic sent out the distributed gateway port towards the localnet port with a specific Ethernet address must be sent out one specific instance of the distributed gateway port on one specific chassis\[char46] Traffic received from the localnet port (or from a VIF on the same logical switch as the localnet port) with a specific Ethernet address must be directed to the logical switch\(cqs patch port instance on that specific chassis\[char46] +.IP +Due to the implications of L2 learning, the Ethernet address and IP address of the distributed gateway port need to be restricted to a single physical location\[char46] For this reason, the user must specify one chassis associated with the distributed gateway port\[char46] Note that traffic traversing the distributed gateway port using other Ethernet addresses and IP addresses (e\[char46]g\[char46] one-to-one NAT) is not restricted to this chassis\[char46] +.IP +Replies to ARP and ND requests must be restricted to a single physical location, where the Ethernet address in the reply resides\[char46] This includes ARP and ND replies for the IP address of the distributed gateway port, which are restricted to the chassis that the user associated with the distributed gateway port\[char46] +.IP \(bu +In order to support one-to-many SNAT (aka IP masquerading), where multiple logical IP addresses spread across multiple chassis are mapped to a single external IP address, it will be necessary to handle some of the logical router processing on a specific chassis in a centralized manner\[char46] Since the SNAT external IP address is typically the distributed gateway port IP address, and for simplicity, the same chassis associated with the distributed gateway port is used\[char46] +.RE +.PP +.PP +The details of flow restrictions to specific chassis are described in the \fBovn\-northd\fR documentation\[char46] +.PP +.PP +While most of the physical location dependent aspects of distributed gateway ports can be handled by restricting some flows to specific chassis, one additional mechanism is required\[char46] When a packet leaves the ingress pipeline and the logical egress port is the distributed gateway port, one of two different sets of actions is required at table 39: +.RS +.IP \(bu +If the packet can be handled locally on the sender\(cqs hypervisor (e\[char46]g\[char46] one-to-one NAT traffic), then the packet should just be resubmitted locally to table 40, in the normal manner for distributed logical patch ports\[char46] +.IP \(bu +However, if the packet needs to be handled on the chassis associated with the distributed gateway port (e\[char46]g\[char46] one-to-many SNAT traffic or non-NAT traffic), then table 39 must send the packet on a tunnel port to that chassis\[char46] +.RE +.PP +.PP +In order to trigger the second set of actions, the \fBchassisredirect\fR type of southbound \fBPort_Binding\fR has been added\[char46] Setting the logical egress port to the type \fBchassisredirect\fR logical port is simply a way to indicate that although the packet is destined for the distributed gateway port, it needs to be redirected to a different chassis\[char46] At table 39, packets with this logical egress port are sent to a specific chassis, in the same way that table 39 directs packets whose logical egress port is a VIF or a type \fBl3gateway\fR port to different chassis\[char46] Once the packet arrives at that chassis, table 40 resets the logical egress port to the value representing the distributed gateway port\[char46] For each distributed gateway port, there is one type \fBchassisredirect\fR port, in addition to the distributed logical patch port representing the distributed gateway port\[char46] +.ST "High Availability for Distributed Gateway Ports" +.PP +.PP +OVN allows you to specify a prioritized list of chassis for a distributed gateway port\[char46] This is done by associating multiple \fBGateway_Chassis\fR rows with a \fBLogical_Router_Port\fR in the \fBOVN_Northbound\fR database\[char46] +.PP +.PP +When multiple chassis have been specified for a gateway, all chassis that may send packets to that gateway will enable BFD on tunnels to all configured gateway chassis\[char46] The current master chassis for the gateway is the highest priority gateway chassis that is currently viewed as active based on BFD status\[char46] +.PP +.PP +For more information on L3 gateway high availability, please refer to http://docs\[char46]ovn\[char46]org/en/latest/topics/high-availability\[char46]html\[char46] +.ST "Restrictions of Distributed Gateway Ports" +.PP +.PP +Distributed gateway ports are used to connect to an external network, which can be a physical network modeled by a logical switch with a localnet port, and can also be a logical switch that interconnects different OVN deployments (see \fBOVN Deployments Interconnection\fR)\[char46] Usually there can be many logical routers connected to the same external logical switch, as shown in below diagram\[char46] +.PP +.nf +\fL +.br +\fL +\-\-LS\-EXT\-+ +.br +\fL | | | +.br +\fL | | | +.br +\fL LR1 \[char46]\[char46]\[char46] LRn +.br +\fL \fR +.fi +.PP +.PP +In this diagram, there are n logical routers connected to a logical switch LS-EXT, each with a distributed gateway port, so that traffic sent to external world is redirected to the gateway chassis that is assigned to the distributed gateway port of respective logical router\[char46] +.PP +.PP +In the logical topology, nothing can prevent an user to add a route between the logical routers via the connected distributed gateway ports on LS-EXT\[char46] However, the route works only if the LS-EXT is a physical network (modeled by a logical switch with a localnet port)\[char46] In that case the packet will be delivered between the gateway chassises through the localnet port via physical network\[char46] If the LS-EXT is a regular logical switch (backed by tunneling only, as in the use case of OVN interconnection), then the packet will be dropped on the source gateway chassis\[char46] The limitation is due the fact that distributed gateway ports are tied to physical location, and without physical network connection, we will end up with either dropping the packet or transferring it over the tunnels which could cause bigger problems such as broadcast packets being redirect repeatedly by different gateway chassises\[char46] +.PP +.PP +With the limitation in mind, if a user do want the direct connectivity between the logical routers, it is better to create an internal logical switch connected to the logical routers with regular logical router ports, which are completely distributed and the packets don\(cqt have to leave a chassis unless necessary, which is more optimal than routing via the distributed gateway ports\[char46] +.ST "ARP request and ND NS packet processing" +.PP +.PP +Due to the fact that ARP requests and ND NA packets are usually broadcast packets, for performance reasons, OVN deals with requests that target OVN owned IP addresses (i\[char46]e\[char46], IP addresses configured on the router ports, VIPs, NAT IPs) in a specific way and only forwards them to the logical router that owns the target IP address\[char46] This behavior is different than that of traditional switches and implies that other routers/hosts connected to the logical switch will not learn the MAC/IP binding from the request packet\[char46] +.PP +.PP +All other ARP and ND packets are flooded in the L2 broadcast domain and to all attached logical patch ports\[char46] +.ST "VIFs on the logical switch connected by a distributed gateway port" +.PP +.PP +Typically the logical switch connected by a distributed gateway port is for external connectivity, usually to a physical network through a localnet port on the logical switch, or to a remote OVN deployment through OVN Interconnection\[char46] In these cases there is no VIF ports required on the logical switch\[char46] +.PP +.PP +While not very common, it is still possible to create VIF ports on the logical switch connected by a distributed gateway port, but there is a limitation that the logical ports need to reside on the gateway chassis where the distributed gateway port resides to get connectivity to other logical switches through the distributed gateway port\[char46] There is no limitation for the VIFs to connect within the logical switch, or beyond the logical switch through other regular distributed logical router ports\[char46] +.PP +.PP +A special case is when using distributed gateway ports for scalability purpose, as mentioned earlier in this document\[char46] The logical switches connected by distributed gateway ports are not for connectivity but just for regular VIFs\[char46] However, the above limitation usually does not matter because in this use case all the VIFs on the logical switch are located on the same chassis with the distributed gateway port that connects the logical switch\[char46] +.SS "Multiple localnet logical switches connected to a Logical Router" +.PP +.PP +It is possible to have multiple logical switches each with a localnet port (representing physical networks) connected to a logical router, in which one localnet logical switch may provide the external connectivity via a distributed gateway port and rest of the localnet logical switches use VLAN tagging in the physical network\[char46] It is expected that \fBovn\-bridge\-mappings\fR is configured appropriately on the chassis for all these localnet networks\[char46] +.ST "East West routing" +.PP +.PP +East-West routing between these localnet VLAN tagged logical switches work almost the same way as normal logical switches\[char46] When the VM sends such a packet, then: +.RS +.IP 1. .4in +It first enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath\[char46] It then enters the ingress pipeline of the logical router datapath via the logical router port in the source chassis\[char46] +.IP 2. .4in +Routing decision is taken\[char46] +.IP 3. .4in +From the router datapath, packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch datapath and goes out of the integration bridge to the provider bridge ( belonging to the destination logical switch) via the localnet port\[char46] While sending the packet to provider bridge, we also replace router port MAC as source MAC with a chassis unique MAC\[char46] +.IP +This chassis unique MAC is configured as global ovs config on each chassis (eg\[char46] via \(dq\fBovs\-vsctl set open \[char46] external\-ids: +ovn\-chassis\-mac\-mappings=\(dqphys:aa:bb:cc:dd:ee:$i$i\(dq\fR\(dq)\[char46] For more details, see \fBovn\-controller\fR(8)\[char46] +.IP +If the above is not configured, then source MAC would be the router port MAC\[char46] This could create problem if we have more than one chassis\[char46] This is because, since the router port is distributed, the same (MAC,VLAN) tuple will seen by physical network from other chassis as well, which could cause these issues: +.RS +.IP \(bu +Continuous MAC moves in top-of-rack switch (ToR)\[char46] +.IP \(bu +ToR dropping the traffic, which is causing continuous MAC moves\[char46] +.IP \(bu +ToR blocking the ports from which MAC moves are happening\[char46] +.RE +.IP 4. .4in +The destination chassis receives the packet via the localnet port and sends it to the integration bridge\[char46] Before entering the integration bridge the source mac of the packet will be replaced with router port mac again\[char46] The packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch and finally gets delivered to the destination VM port\[char46] +.RE +.ST "External traffic" +.PP +.PP +The following happens when a VM sends an external traffic (which requires NATting) and the chassis hosting the VM doesn\(cqt have a distributed gateway port\[char46] +.RS +.IP 1. .4in +The packet first enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath\[char46] It then enters the ingress pipeline of the logical router datapath via the logical router port in the source chassis\[char46] +.IP 2. .4in +Routing decision is taken\[char46] Since the gateway router or the distributed gateway port doesn\(cqt reside in the source chassis, the traffic is redirected to the gateway chassis via the tunnel port\[char46] +.IP 3. .4in +The gateway chassis receives the packet via the tunnel port and the packet enters the egress pipeline of the logical router datapath\[char46] NAT rules are applied here\[char46] The packet then enters the ingress pipeline and then egress pipeline of the localnet logical switch datapath which provides external connectivity and finally goes out via the localnet port of the logical switch which provides external connectivity\[char46] +.RE +.PP +.PP +Although this works, the VM traffic is tunnelled when sent from the compute chassis to the gateway chassis\[char46] In order for it to work properly, the MTU of the localnet logical switches must be lowered to account for the tunnel encapsulation\[char46] +.SS "Centralized routing for localnet VLAN tagged logical switches connected to a Logical Router" +.PP +.PP +To overcome the tunnel encapsulation problem described in the previous section, \fBOVN\fR supports the option of enabling centralized routing for localnet VLAN tagged logical switches\[char46] CMS can configure the option \fBoptions:reside-on-redirect-chassis\fR to \fBtrue\fR for each \fBLogical_Router_Port\fR which connects to the localnet VLAN tagged logical switches\[char46] This causes the gateway chassis (hosting the distributed gateway port) to handle all the routing for these networks, making it centralized\[char46] It will reply to the ARP requests for the logical router port IPs\[char46] +.PP +.PP +If the logical router doesn\(cqt have a distributed gateway port connecting to the localnet logical switch which provides external connectivity, or if it has more than one distributed gateway ports, then this option is ignored by \fBOVN\fR\[char46] +.PP +.PP +The following happens when a VM sends an east-west traffic which needs to be routed: +.RS +.IP 1. .4in +The packet first enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and is sent out via a localnet port of the source localnet logical switch (instead of sending it to router pipeline)\[char46] +.IP 2. .4in +The gateway chassis receives the packet via a localnet port of the source localnet logical switch and sends it to the integration bridge\[char46] The packet then enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and enters the ingress pipeline of the logical router datapath\[char46] +.IP 3. .4in +Routing decision is taken\[char46] +.IP 4. .4in +From the router datapath, packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch datapath\[char46] It then goes out of the integration bridge to the provider bridge ( belonging to the destination logical switch) via a localnet port\[char46] +.IP 5. .4in +The destination chassis receives the packet via a localnet port and sends it to the integration bridge\[char46] The packet enters the ingress pipeline and then egress pipeline of the destination localnet logical switch and finally delivered to the destination VM port\[char46] +.RE +.PP +.PP +The following happens when a VM sends an external traffic which requires NATting: +.RS +.IP 1. .4in +The packet first enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and is sent out via a localnet port of the source localnet logical switch (instead of sending it to router pipeline)\[char46] +.IP 2. .4in +The gateway chassis receives the packet via a localnet port of the source localnet logical switch and sends it to the integration bridge\[char46] The packet then enters the ingress pipeline, and then egress pipeline of the source localnet logical switch datapath and enters the ingress pipeline of the logical router datapath\[char46] +.IP 3. .4in +Routing decision is taken and NAT rules are applied\[char46] +.IP 4. .4in +From the router datapath, packet enters the ingress pipeline and then egress pipeline of the localnet logical switch datapath which provides external connectivity\[char46] It then goes out of the integration bridge to the provider bridge (belonging to the logical switch which provides external connectivity) via a localnet port\[char46] +.RE +.PP +.PP +The following happens for the reverse external traffic\[char46] +.RS +.IP 1. .4in +The gateway chassis receives the packet from a localnet port of the logical switch which provides external connectivity\[char46] The packet then enters the ingress pipeline and then egress pipeline of the localnet logical switch (which provides external connectivity)\[char46] The packet then enters the ingress pipeline of the logical router datapath\[char46] +.IP 2. .4in +The ingress pipeline of the logical router datapath applies the unNATting rules\[char46] The packet then enters the ingress pipeline and then egress pipeline of the source localnet logical switch\[char46] Since the source VM doesn\(cqt reside in the gateway chassis, the packet is sent out via a localnet port of the source logical switch\[char46] +.IP 3. .4in +The source chassis receives the packet via a localnet port and sends it to the integration bridge\[char46] The packet enters the ingress pipeline and then egress pipeline of the source localnet logical switch and finally gets delivered to the source VM port\[char46] +.RE +.PP +.PP +As an alternative to \fBreside\-on\-redirect\-chassis\fR, OVN supports VLAN-based redirection\[char46] Whereas \fBreside\-on\-redirect\-chassis\fR centralizes all router functionality, VLAN-based redirection only changes how OVN redirects packets to the gateway chassis\[char46] By setting \fBoptions:redirect\-type\fR to \fBbridged\fR on a distributed gateway port, OVN redirects packets to the gateway chassis using the \fBlocalnet\fR port of the router\(cqs peer logical switch, instead of a tunnel\[char46] +.PP +.PP +If the logical router doesn\(cqt have a distributed gateway port connecting to the localnet logical switch which provides external connectivity, or if it has more than one distributed gateway ports, then this option is ignored by \fBOVN\fR\[char46] +.PP +.PP +Following happens for bridged redirection: +.RS +.IP 1. .4in +On compute chassis, packet passes though logical router\(cqs ingress pipeline\[char46] +.IP 2. .4in +If logical outport is gateway chassis attached router port then packet is \(dqredirected\(dq to gateway chassis using peer logical switch\(cqs localnet port\[char46] +.IP 3. .4in +This redirected packet has destination mac as router port mac (the one to which gateway chassis is attached)\[char46] Its VLAN id is that of localnet port (peer logical switch of the logical router port)\[char46] +.IP 4. .4in +On the gateway chassis packet will enter the logical router pipeline again and this time it will passthrough egress pipeline as well\[char46] +.IP 5. .4in +Reverse traffic packet flows stays the same\[char46] +.RE +.PP +.PP +Some guidelines and expections with bridged redirection: +.RS +.IP 1. .4in +Since router port mac is destination mac, hence it has to be ensured that physical network learns it on ONLY from the gateway chassis\[char46] Which means that \fBovn\-chassis\-mac\-mappings\fR should be configure on all the compute nodes, so that physical network never learn router port mac from compute nodes\[char46] +.IP 2. .4in +Since packet enters logical router ingress pipeline twice (once on compute chassis and again on gateway chassis), hence ttl will be decremented twice\[char46] +.IP 3. .4in +Default redirection type continues to be \fBoverlay\fR\[char46] User can switch the redirect-type between \fBbridged\fR and \fBoverlay\fR by changing the value of \fBoptions:redirect\-type\fR +.RE +.SS "Life Cycle of a VTEP gateway" +.PP +.PP +A gateway is a chassis that forwards traffic between the OVN-managed part of a logical network and a physical VLAN, extending a tunnel-based logical network into a physical network\[char46] +.PP +.PP +The steps below refer often to details of the OVN and VTEP database schemas\[char46] Please see \fBovn\-sb\fR(5), \fBovn\-nb\fR(5) and \fBvtep\fR(5), respectively, for the full story on these databases\[char46] +.RS +.IP 1. .4in +A VTEP gateway\(cqs life cycle begins with the administrator registering the VTEP gateway as a \fBPhysical_Switch\fR table entry in the \fBVTEP\fR database\[char46] The \fBovn\-controller\-vtep\fR connected to this VTEP database, will recognize the new VTEP gateway and create a new \fBChassis\fR table entry for it in the \fBOVN_Southbound\fR database\[char46] +.IP 2. .4in +The administrator can then create a new \fBLogical_Switch\fR table entry, and bind a particular vlan on a VTEP gateway\(cqs port to any VTEP logical switch\[char46] Once a VTEP logical switch is bound to a VTEP gateway, the \fBovn\-controller\-vtep\fR will detect it and add its name to the \fIvtep_logical_switches\fR column of the \fBChassis\fR table in the \fB +OVN_Southbound\fR database\[char46] Note, the \fItunnel_key\fR column of VTEP logical switch is not filled at creation\[char46] The \fBovn\-controller\-vtep\fR will set the column when the corresponding vtep logical switch is bound to an OVN logical network\[char46] +.IP 3. .4in +Now, the administrator can use the CMS to add a VTEP logical switch to the OVN logical network\[char46] To do that, the CMS must first create a new \fBLogical_Switch_Port\fR table entry in the \fB +OVN_Northbound\fR database\[char46] Then, the \fItype\fR column of this entry must be set to \(dqvtep\(dq\[char46] Next, the \fI +vtep-logical-switch\fR and \fIvtep-physical-switch\fR keys in the \fIoptions\fR column must also be specified, since multiple VTEP gateways can attach to the same VTEP logical switch\[char46] Next, the \fIaddresses\fR column of this logical port must be set to \(dqunknown\(dq, it will add a priority 0 entry in \(dqls_in_l2_lkup\(dq stage of logical switch ingress pipeline\[char46] So, traffic with unrecorded mac by OVN would go through the \fBLogical_Switch_Port\fR to physical network\[char46] +.IP 4. .4in +The newly created logical port in the \fBOVN_Northbound\fR database and its configuration will be passed down to the \fB +OVN_Southbound\fR database as a new \fBPort_Binding\fR table entry\[char46] The \fBovn\-controller\-vtep\fR will recognize the change and bind the logical port to the corresponding VTEP gateway chassis\[char46] Configuration of binding the same VTEP logical switch to a different OVN logical networks is not allowed and a warning will be generated in the log\[char46] +.IP 5. .4in +Beside binding to the VTEP gateway chassis, the \fB +ovn\-controller\-vtep\fR will update the \fItunnel_key\fR column of the VTEP logical switch to the corresponding \fB +Datapath_Binding\fR table entry\(cqs \fItunnel_key\fR for the bound OVN logical network\[char46] +.IP 6. .4in +Next, the \fBovn\-controller\-vtep\fR will keep reacting to the configuration change in the \fBPort_Binding\fR in the \fBOVN_Northbound\fR database, and updating the \fBUcast_Macs_Remote\fR table in the \fBVTEP\fR database\[char46] This allows the VTEP gateway to understand where to forward the unicast traffic coming from the extended external network\[char46] +.IP 7. .4in +Eventually, the VTEP gateway\(cqs life cycle ends when the administrator unregisters the VTEP gateway from the \fBVTEP\fR database\[char46] The \fBovn\-controller\-vtep\fR will recognize the event and remove all related configurations (\fBChassis\fR table entry and port bindings) in the \fBOVN_Southbound\fR database\[char46] +.IP 8. .4in +When the \fBovn\-controller\-vtep\fR is terminated, all related configurations in the \fBOVN_Southbound\fR database and the \fBVTEP\fR database will be cleaned, including \fBChassis\fR table entries for all registered VTEP gateways and their port bindings, and all \fBUcast_Macs_Remote\fR table entries and the \fBLogical_Switch\fR tunnel keys\[char46] +.RE +.SS "OVN Deployments Interconnection" +.PP +.PP +It is not uncommon for an operator to deploy multiple OVN clusters, for two main reasons\[char46] Firstly, an operator may prefer to deploy one OVN cluster for each availability zone, e\[char46]g\[char46] in different physical regions, to avoid single point of failure\[char46] Secondly, there is always an upper limit for a single OVN control plane to scale\[char46] +.PP +.PP +Although the control planes of the different availability zone (AZ)s are independent from each other, the workloads from different AZs may need to communicate across the zones\[char46] The OVN interconnection feature provides a native way to interconnect different AZs by L3 routing through transit overlay networks between logical routers of different AZs\[char46] +.PP +.PP +A global OVN Interconnection Northbound database is introduced for the operator (probably through CMS systems) to configure transit logical switches that connect logical routers from different AZs\[char46] A transit switch is similar to a regular logical switch, but it is used for interconnection purpose only\[char46] Typically, each transit switch can be used to connect all logical routers that belong to same tenant across all AZs\[char46] +.PP +.PP +A dedicated daemon process \fBovn\-ic\fR, OVN interconnection controller, in each AZ will consume this data and populate corresponding logical switches to their own northbound databases for each AZ, so that logical routers can be connected to the transit switch by creating patch port pairs in their northbound databases\[char46] Any router ports connected to the transit switches are considered interconnection ports, which will be exchanged between AZs\[char46] +.PP +.PP +Physically, when workloads from different AZs communicate, packets need to go through multiple hops: source chassis, source gateway, destination gateway and destination chassis\[char46] All these hops are connected through tunnels so that the packets never leave overlay networks\[char46] A distributed gateway port is required to connect the logical router to a transit switch, with a gateway chassis specified, so that the traffic can be forwarded through the gateway chassis\[char46] +.PP +.PP +A global OVN Interconnection Southbound database is introduced for exchanging control plane information between the AZs\[char46] The data in this database is populated and consumed by the \fBovn\-ic\fR, of each AZ\[char46] The main information in this database includes: +.RS +.IP \(bu +Datapath bindings for transit switches, which mainly contains the tunnel keys generated for each transit switch\[char46] Separate key ranges are reserved for transit switches so that they will never conflict with any tunnel keys locally assigned for datapaths within each AZ\[char46] +.IP \(bu +Availability zones, which are registered by \fBovn\-ic\fR from each AZ\[char46] +.IP \(bu +Gateways\[char46] Each AZ specifies chassises that are supposed to work as interconnection gateways, and the \fBovn\-ic\fR will populate this information to the interconnection southbound DB\[char46] The \fBovn\-ic\fR from all the other AZs will learn the gateways and populate to their own southbound DB as a chassis\[char46] +.IP \(bu +Port bindings for logical switch ports created on the transit switch\[char46] Each AZ maintains their logical router to transit switch connections independently, but \fBovn\-ic\fR automatically populates local port bindings on transit switches to the global interconnection southbound DB, and learns remote port bindings from other AZs back to its own northbound and southbound DBs, so that logical flows can be produced and then translated to OVS flows locally, which finally enables data plane communication\[char46] +.IP \(bu +Routes that are advertised between different AZs\[char46] If enabled, routes are automatically exchanged by \fBovn\-ic\fR\[char46] Both static routes and directly connected subnets are advertised\[char46] Options in \fBoptions\fR column of the \fBNB_Global\fR table of \fBOVN_NB\fR database control the behavior of route advertisement, such as enable/disable the advertising/learning routes, whether default routes are advertised/learned, and blacklisted CIDRs\[char46] See \fBovn\-nb\fR(5) for more details\[char46] +.RE +.PP +.PP +The tunnel keys for transit switch datapaths and related port bindings must be agreed across all AZs\[char46] This is ensured by generating and storing the keys in the global interconnection southbound database\[char46] Any \fBovn\-ic\fR from any AZ can allocate the key, but race conditions are solved by enforcing unique index for the column in the database\[char46] +.PP +.PP +Once each AZ\(cqs NB and SB databases are populated with interconnection switches and ports, and agreed upon the tunnel keys, data plane communication between the AZs are established\[char46] +.PP +.PP +When VXLAN tunneling is enabled in an OVN cluster, due to the limited range available for VNIs, Interconnection feature is not supported\[char46] +.ST "A day in the life of a packet crossing AZs" +.RS +.IP 1. .4in +An IP packet is sent out from a VIF on a hypervisor (HV1) of AZ1, with destination IP belonging to a VIF in AZ2\[char46] +.IP 2. .4in +In HV1\(cqs OVS flow tables, the packet goes through logical switch and logical router pipelines, and in a logical router pipeline, the routing stage finds out the next hop for the destination IP, which belongs to a remote logical router port in AZ2, and the output port, which is a chassis-redirect port located on an interconnection gateway (GW1 in AZ1), so HV1 sends the packet to GW1 through tunnel\[char46] +.IP 3. .4in +On GW1, it continues with the logical router pipe line and switches to the transit switch\(cqs pipeline through the peer port of the chassis redirect port\[char46] In the transit switch\(cqs pipeline it outputs to the remote logical port which is located on a gateway (GW2) in AZ2, so the GW1 sends the packet to GW2 in tunnel\[char46] +.IP 4. .4in +On GW2, it continues with the transit switch pipeline and switches to the logical router pipeline through the peer port, which is a chassis redirect port that is located on GW2\[char46] The logical router pipeline then forwards the packet to relevant logical pipelines according to the destination IP address, and figures out the MAC and location of the destination VIF port - a hypervisor (HV2)\[char46] The GW2 then sends the packet to HV2 in tunnel\[char46] +.IP 5. .4in +On HV2, the packet is delivered to the final destination VIF port by the logical switch egress pipeline, just the same way as for intra-AZ communications\[char46] +.RE +.SS "Native OVN services for external logical ports" +.PP +.PP +To support OVN native services (like DHCP/IPv6 RA/DNS lookup) to the cloud resources which are external, OVN supports \fBexternal\fR logical ports\[char46] +.PP +.PP +Below are some of the use cases where \fBexternal\fR ports can be used\[char46] +.RS +.IP \(bu +VMs connected to SR-IOV nics - Traffic from these VMs by passes the kernel stack and local \fBovn\-controller\fR do not bind these ports and cannot serve the native services\[char46] +.IP \(bu +When CMS supports provisioning baremetal servers\[char46] +.RE +.PP +.PP +OVN will provide the native services if CMS has done the below configuration in the \fIOVN Northbound Database\fR\[char46] +.RS +.IP \(bu +A row is created in \fBLogical_Switch_Port\fR, configuring the \fBaddresses\fR column and setting the \fBtype\fR to \fBexternal\fR\[char46] +.IP \(bu +\fBha_chassis_group\fR column is configured\[char46] +.IP \(bu +The HA chassis which belongs to the HA chassis group has the \fBovn\-bridge\-mappings\fR configured and has proper L2 connectivity so that it can receive the DHCP and other related request packets from these external resources\[char46] +.IP \(bu +The Logical_Switch of this port has a \fBlocalnet\fR port\[char46] +.IP \(bu +Native OVN services are enabled by configuring the DHCP and other options like the way it is done for the normal logical ports\[char46] +.RE +.PP +.PP +It is recommended to use the same HA chassis group for all the external ports of a logical switch\[char46] Otherwise, the physical switch might see MAC flap issue when different chassis provide the native services\[char46] For example when supporting native DHCPv4 service, DHCPv4 server mac (configured in \fBoptions:server_mac\fR column in table \fBDHCP_Options\fR) originating from different ports can cause MAC flap issue\[char46] The MAC of the logical router IP(s) can also flap if the same HA chassis group is not set for all the external ports of a logical switch\[char46] +.SH "SECURITY" +.SS "Role\-Based Access Controls for the Southbound DB" +.PP +.PP +In order to provide additional security against the possibility of an OVN chassis becoming compromised in such a way as to allow rogue software to make arbitrary modifications to the southbound database state and thus disrupt the OVN network, role-based access controls (see \fBovsdb\-server(1)\fR for additional details) are provided for the southbound database\[char46] +.PP +.PP +The implementation of role-based access controls (RBAC) requires the addition of two tables to an OVSDB schema: the \fBRBAC_Role\fR table, which is indexed by role name and maps the the names of the various tables that may be modifiable for a given role to individual rows in a permissions table containing detailed permission information for that role, and the permission table itself which consists of rows containing the following information: +.RS +.TP +\fBTable Name\fR +The name of the associated table\[char46] This column exists primarily as an aid for humans reading the contents of this table\[char46] +.TP +\fBAuth Criteria\fR +A set of strings containing the names of columns (or column:key pairs for columns containing string:string maps)\[char46] The contents of at least one of the columns or column:key values in a row to be modified, inserted, or deleted must be equal to the ID of the client attempting to act on the row in order for the authorization check to pass\[char46] If the authorization criteria is empty, authorization checking is disabled and all clients for the role will be treated as authorized\[char46] +.TP +\fBInsert/Delete\fR +Row insertion/deletion permission; boolean value indicating whether insertion and deletion of rows is allowed for the associated table\[char46] If true, insertion and deletion of rows is allowed for authorized clients\[char46] +.TP +\fBUpdatable Columns\fR +A set of strings containing the names of columns or column:key pairs that may be updated or mutated by authorized clients\[char46] Modifications to columns within a row are only permitted when the authorization check for the client passes and all columns to be modified are included in this set of modifiable columns\[char46] +.RE +.PP +.PP +RBAC configuration for the OVN southbound database is maintained by ovn-northd\[char46] With RBAC enabled, modifications are only permitted for the \fBChassis\fR, \fBEncap\fR, \fBPort_Binding\fR, and \fBMAC_Binding\fR tables, and are restricted as follows: +.RS +.TP +\fBChassis\fR +\fBAuthorization\fR: client ID must match the chassis name\[char46] +.IP +\fBInsert/Delete\fR: authorized row insertion and deletion are permitted\[char46] +.IP +\fBUpdate\fR: The columns \fBnb_cfg\fR, \fBexternal_ids\fR, \fBencaps\fR, and \fBvtep_logical_switches\fR may be modified when authorized\[char46] +.TP +\fBEncap\fR +\fBAuthorization\fR: client ID must match the chassis name\[char46] +.IP +\fBInsert/Delete\fR: row insertion and row deletion are permitted\[char46] +.IP +\fBUpdate\fR: The columns \fBtype\fR, \fBoptions\fR, and \fBip\fR can be modified\[char46] +.TP +\fBPort_Binding\fR +\fBAuthorization\fR: disabled (all clients are considered authorized\[char46] A future enhancement may add columns (or keys to \fBexternal_ids\fR) in order to control which chassis are allowed to bind each port\[char46] +.IP +\fBInsert/Delete\fR: row insertion/deletion are not permitted (ovn-northd maintains rows in this table\[char46] +.IP +\fBUpdate\fR: Only modifications to the \fBchassis\fR column are permitted\[char46] +.TP +\fBMAC_Binding\fR +\fBAuthorization\fR: disabled (all clients are considered to be authorized)\[char46] +.IP +\fBInsert/Delete\fR: row insertion/deletion are permitted\[char46] +.IP +\fBUpdate\fR: The columns \fBlogical_port\fR, \fBip\fR, \fBmac\fR, and \fBdatapath\fR may be modified by ovn-controller\[char46] +.TP +\fBIGMP_Group\fR +\fBAuthorization\fR: disabled (all clients are considered to be authorized)\[char46] +.IP +\fBInsert/Delete\fR: row insertion/deletion are permitted\[char46] +.IP +\fBUpdate\fR: The columns \fBaddress\fR, \fBchassis\fR, \fBdatapath\fR, and \fBports\fR may be modified by ovn-controller\[char46] +.RE +.PP +.PP +Enabling RBAC for ovn-controller connections to the southbound database requires the following steps: +.RS +.IP 1. .4in +Creating SSL certificates for each chassis with the certificate CN field set to the chassis name (e\[char46]g\[char46] for a chassis with \fBexternal\-ids:system\-id=chassis\-1\fR, via the command \(dq\fBovs\-pki \-u req+sign chassis\-1 switch\fR\(dq)\[char46] +.IP 2. .4in +Configuring each ovn-controller to use SSL when connecting to the southbound database (e\[char46]g\[char46] via \(dq\fBovs\-vsctl set open \[char46] +external\-ids:ovn\-remote=ssl:x\[char46]x\[char46]x\[char46]x:6642\fR\(dq)\[char46] +.IP 3. .4in +Configuring a southbound database SSL remote with \(dqovn-controller\(dq role (e\[char46]g\[char46] via \(dq\fBovn\-sbctl set\-connection role=ovn\-controller +pssl:6642\fR\(dq)\[char46] +.RE +.SS "Encrypt Tunnel Traffic with IPsec" +.PP +.PP +OVN tunnel traffic goes through physical routers and switches\[char46] These physical devices could be untrusted (devices in public network) or might be compromised\[char46] Enabling encryption to the tunnel traffic can prevent the traffic data from being monitored and manipulated\[char46] +.PP +.PP +The tunnel traffic is encrypted with IPsec\[char46] The CMS sets the \fBipsec\fR column in the northbound \fBNB_Global\fR table to enable or disable IPsec encrytion\[char46] If \fBipsec\fR is true, all OVN tunnels will be encrypted\[char46] If \fBipsec\fR is false, no OVN tunnels will be encrypted\[char46] +.PP +.PP +When CMS updates the \fBipsec\fR column in the northbound \fBNB_Global\fR table, \fBovn\-northd\fR copies the value to the \fBipsec\fR column in the southbound \fBSB_Global\fR table\[char46] \fBovn\-controller\fR in each chassis monitors the southbound database and sets the options of the OVS tunnel interface accordingly\[char46] OVS tunnel interface options are monitored by the \fBovs\-monitor\-ipsec\fR daemon which configures IKE daemon to set up IPsec connections\[char46] +.PP +.PP +Chassis authenticates each other by using certificate\[char46] The authentication succeeds if the other end in tunnel presents a certificate signed by a trusted CA and the common name (CN) matches the expected chassis name\[char46] The SSL certificates used in role-based access controls (RBAC) can be used in IPsec\[char46] Or use \fBovs\-pki\fR to create different certificates\[char46] The certificate is required to be x\[char46]509 version 3, and with CN field and subjectAltName field being set to the chassis name\[char46] +.PP +.PP +The CA certificate, chassis certificate and private key are required to be installed in each chassis before enabling IPsec\[char46] Please see \fBovs\-vswitchd\[char46]conf\[char46]db\fR(5) for setting up CA based IPsec authentication\[char46] +.SH "DESIGN DECISIONS" +.SS "Tunnel Encapsulations" +.PP +.PP +In general, OVN annotates logical network packets that it sends from one hypervisor to another with the following three pieces of metadata, which are encoded in an encapsulation-specific fashion: +.RS +.IP \(bu +24-bit logical datapath identifier, from the \fBtunnel_key\fR column in the OVN Southbound \fBDatapath_Binding\fR table\[char46] +.IP \(bu +15-bit logical ingress port identifier\[char46] ID 0 is reserved for internal use within OVN\[char46] IDs 1 through 32767, inclusive, may be assigned to logical ports (see the \fBtunnel_key\fR column in the OVN Southbound \fBPort_Binding\fR table)\[char46] +.IP \(bu +16-bit logical egress port identifier\[char46] IDs 0 through 32767 have the same meaning as for logical ingress ports\[char46] IDs 32768 through 65535, inclusive, may be assigned to logical multicast groups (see the \fBtunnel_key\fR column in the OVN Southbound \fBMulticast_Group\fR table)\[char46] +.RE +.PP +.PP +When VXLAN is enabled on any hypervisor in a cluster, datapath and egress port identifier ranges are reduced to 12-bits\[char46] This is done because only STT and Geneve provide the large space for metadata (over 32 bits per packet)\[char46] To accommodate for VXLAN, 24 bits available are split as follows: +.RS +.IP \(bu +12-bit logical datapath identifier, derived from the \fBtunnel_key\fR column in the OVN Southbound \fBDatapath_Binding\fR table\[char46] +.IP \(bu +12-bit logical egress port identifier\[char46] IDs 0 through 2047 are used for unicast output ports\[char46] IDs 2048 through 4095, inclusive, may be assigned to logical multicast groups (see the \fBtunnel_key\fR column in the OVN Southbound \fBMulticast_Group\fR table)\[char46] For multicast group tunnel keys, a special mapping scheme is used to internally transform from internal OVN 16-bit keys to 12-bit values before sending packets through a VXLAN tunnel, and back from 12-bit tunnel keys to 16-bit values when receiving packets from a VXLAN tunnel\[char46] +.IP \(bu +No logical ingress port identifier\[char46] +.RE +.PP +.PP +The limited space available for metadata when VXLAN tunnels are enabled in a cluster put the following functional limitations onto features available to users: +.RS +.IP \(bu +The maximum number of networks is reduced to 4096\[char46] +.IP \(bu +The maximum number of ports per network is reduced to 2048\[char46] +.IP \(bu +ACLs matching against logical ingress port identifiers are not supported\[char46] +.IP \(bu +OVN interconnection feature is not supported\[char46] +.RE +.PP +.PP +In addition to functional limitations described above, the following should be considered before enabling it in your cluster: +.RS +.IP \(bu +STT and Geneve use randomized UDP or TCP source ports that allows efficient distribution among multiple paths in environments that use ECMP in their underlay\[char46] +.IP \(bu +NICs are available to offload STT and Geneve encapsulation and decapsulation\[char46] +.RE +.PP +.PP +Due to its flexibility, the preferred encapsulation between hypervisors is Geneve\[char46] For Geneve encapsulation, OVN transmits the logical datapath identifier in the Geneve VNI\[char46] OVN transmits the logical ingress and logical egress ports in a TLV with class 0x0102, type 0x80, and a 32-bit value encoded as follows, from MSB to LSB: +.PP +.\" check if in troff mode (TTY) +.if t \{ +.PS +boxht = .2 +textht = 1/6 +fillval = .2 +[ +B0: box "rsv" width .25 +B1: box "ingress port" width .75 +B2: box "egress port" width .75 +"1" at B0.n above +"0" at B0.s below +"15" at B1.n above +"" at B1.s below +"16" at B2.n above +"" at B2.s below +line <-> invis "" above from B0.nw + (0,textht) to B2.ne + (0,textht) +] +.PE +\} +.\" check if in nroff mode: +.if n \{ +.nf +\fL 1 15 16 +.br +\fL+---+------------+-----------+ +.br +\fL|rsv|ingress port|egress port| +.br +\fL+---+------------+-----------+ +.br +\fL 0 +.fi +\} +.PP +.PP +Environments whose NICs lack Geneve offload may prefer STT encapsulation for performance reasons\[char46] For STT encapsulation, OVN encodes all three pieces of logical metadata in the STT 64-bit tunnel ID as follows, from MSB to LSB: +.PP +.\" check if in troff mode (TTY) +.if t \{ +.PS +boxht = .2 +textht = 1/6 +fillval = .2 +[ +B0: box "reserved" width .5 +B1: box "ingress port" width .75 +B2: box "egress port" width .75 +B3: box "datapath" width 1.25 +"9" at B0.n above +"0" at B0.s below +"15" at B1.n above +"" at B1.s below +"16" at B2.n above +"" at B2.s below +"24" at B3.n above +"" at B3.s below +line <-> invis "" above from B0.nw + (0,textht) to B3.ne + (0,textht) +] +.PE +\} +.\" check if in nroff mode: +.if n \{ +.nf +\fL 9 15 16 24 +.br +\fL+--------+------------+-----------+--------+ +.br +\fL|reserved|ingress port|egress port|datapath| +.br +\fL+--------+------------+-----------+--------+ +.br +\fL 0 +.fi +\} +.PP +.PP +For connecting to gateways, in addition to Geneve and STT, OVN supports VXLAN, because only VXLAN support is common on top-of-rack (ToR) switches\[char46] Currently, gateways have a feature set that matches the capabilities as defined by the VTEP schema, so fewer bits of metadata are necessary\[char46] In the future, gateways that do not support encapsulations with large amounts of metadata may continue to have a reduced feature set\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.html b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.html new file mode 100644 index 00000000..68a75bd5 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.html @@ -0,0 +1,2173 @@ +
+ovn-architecture(7)               OVN Manual               ovn-architecture(7)
+
+NAME
+       ovn-architecture - Open Virtual Network architecture
+
+DESCRIPTION
+       OVN,  the  Open Virtual Network, is a system to support logical network
+       abstraction in virtual machine and container environments. OVN  compleā€
+       ments  the existing capabilities of OVS to add native support for logiā€
+       cal network abstractions, such as logical L2 and L3 overlays and  secuā€
+       rity  groups.  Services  such as DHCP are also desirable features. Just
+       like OVS, OVNā€™s design goal is to have a production-quality implementaā€
+       tion that can operate at significant scale.
+
+       A physical network comprises physical wires, switches, and  routers.  A
+       virtual  network  extends  a physical network into a hypervisor or conā€
+       tainer platform, bridging VMs or containers into the physical  network.
+       An OVN logical network is a network implemented in software that is inā€
+       sulated  from  physical (and thus virtual) networks by tunnels or other
+       encapsulations. This allows IP and other address spaces used in logical
+       networks to overlap with those used on physical networks without  causā€
+       ing  conflicts.  Logical network topologies can be arranged without reā€
+       gard for the topologies of the physical networks  on  which  they  run.
+       Thus, VMs that are part of a logical network can migrate from one physā€
+       ical  machine  to  another without network disruption. See Logical Netā€ā€
+       works, below, for more information.
+
+       The encapsulation layer prevents VMs and containers connected to a logā€
+       ical network from communicating with nodes on  physical  networks.  For
+       clustering  VMs  and  containers, this can be acceptable or even desirā€
+       able, but in many cases VMs and  containers  do  need  connectivity  to
+       physical  networks.  OVN  provides  multiple forms of gateways for this
+       purpose. See Gateways, below, for more information.
+
+       An OVN deployment consists of several components:
+
+              ā€¢      A Cloud Management System (CMS), which is OVNā€™s  ultimate
+                     client  (via  its users and administrators). OVN integraā€
+                     tion requires installing a CMS-specific  plugin  and  reā€
+                     lated  software  (see below). OVN initially targets Openā€
+                     Stack as CMS.
+
+                     We generally speak of ``theā€™ā€™ CMS, but  one  can  imagine
+                     scenarios  in which multiple CMSes manage different parts
+                     of an OVN deployment.
+
+              ā€¢      An OVN Database physical or virtual node (or, eventually,
+                     cluster) installed in a central location.
+
+              ā€¢      One or more (usually many) hypervisors. Hypervisors  must
+                     run Open vSwitch and implement the interface described in
+                     Documentation/topics/integration.rst  in the Open vSwitch
+                     source tree. Any hypervisor platform  supported  by  Open
+                     vSwitch is acceptable.
+
+              ā€¢      Zero  or  more gateways. A gateway extends a tunnel-based
+                     logical network into a physical network  by  bidirectionā€
+                     ally  forwarding  packets  between tunnels and a physical
+                     Ethernet port. This allows  non-virtualized  machines  to
+                     participate in logical networks. A gateway may be a physā€
+                     ical  host,  a virtual machine, or an ASIC-based hardware
+                     switch that supports the vtep(5) schema.
+
+                     Hypervisors and gateways are  together  called  transport
+                     node or chassis.
+
+       The  diagram  below  shows  how the major components of OVN and related
+       software interact. Starting at the top of the diagram, we have:
+
+              ā€¢      The Cloud Management System, as defined above.
+
+              ā€¢      The OVN/CMS Plugin is the component of the CMS  that  inā€
+                     terfaces  to OVN. In OpenStack, this is a Neutron plugin.
+                     The pluginā€™s main purpose is to translate the  CMSā€™s  noā€
+                     tion  of  logical  network  configuration,  stored in the
+                     CMSā€™s configuration database in  a  CMS-specific  format,
+                     into an intermediate representation understood by OVN.
+
+                     This component is necessarily CMS-specific, so a new pluā€
+                     gin needs to be developed for each CMS that is integrated
+                     with OVN. All of the components below this one in the diā€
+                     agram are CMS-independent.
+
+              ā€¢      The  OVN  Northbound  Database  receives the intermediate
+                     representation of logical  network  configuration  passed
+                     down  by the OVN/CMS Plugin. The database schema is meant
+                     to be ``impedance matchedā€™ā€™ with the concepts used  in  a
+                     CMS,  so  that  it  directly  supports notions of logical
+                     switches, routers, ACLs, and so on. See ovn-nb(5) for deā€
+                     tails.
+
+                     The OVN Northbound Database has  only  two  clients:  the
+                     OVN/CMS Plugin above it and ovn-northd below it.
+
+              ā€¢      ovn-northd(8)  connects  to  the  OVN Northbound Database
+                     above it and the OVN Southbound  Database  below  it.  It
+                     translates  the logical network configuration in terms of
+                     conventional network concepts, taken from the OVN  Northā€
+                     bound  Database,  into  logical datapath flows in the OVN
+                     Southbound Database below it.
+
+              ā€¢      The OVN Southbound Database is the center of the  system.
+                     Its  clients  are  ovn-northd(8)  above  it  and ovn-conā€ā€
+                     troller(8) on every transport node below it.
+
+                     The OVN Southbound Database contains three kinds of data:
+                     Physical Network (PN) tables that specify  how  to  reach
+                     hypervisor  and  other nodes, Logical Network (LN) tables
+                     that describe the logical network in terms  of  ``logical
+                     datapath  flows,ā€™ā€™  and  Binding tables that link logical
+                     network componentsā€™ locations to  the  physical  network.
+                     The  hypervisors populate the PN and Port_Binding tables,
+                     whereas ovn-northd(8) populates the LN tables.
+
+                     OVN Southbound Database performance must scale  with  the
+                     number  of transport nodes. This will likely require some
+                     work on  ovsdb-server(1)  as  we  encounter  bottlenecks.
+                     Clustering for availability may be needed.
+
+       The remaining components are replicated onto each hypervisor:
+
+              ā€¢      ovn-controller(8)  is  OVNā€™s agent on each hypervisor and
+                     software gateway. Northbound,  it  connects  to  the  OVN
+                     Southbound  Database to learn about OVN configuration and
+                     status and to populate the PN table and the Chassis  colā€
+                     umn in Binding table with the hypervisorā€™s status. Southā€
+                     bound, it connects to ovs-vswitchd(8) as an OpenFlow conā€
+                     troller, for control over network traffic, and to the loā€
+                     cal  ovsdb-server(1)  to  allow it to monitor and control
+                     Open vSwitch configuration.
+
+              ā€¢      ovs-vswitchd(8) and ovsdb-server(1) are conventional comā€
+                     ponents of Open vSwitch.
+
+                                         CMS
+                                          |
+                                          |
+                              +-----------|-----------+
+                              |           |           |
+                              |     OVN/CMS Plugin    |
+                              |           |           |
+                              |           |           |
+                              |   OVN Northbound DB   |
+                              |           |           |
+                              |           |           |
+                              |       ovn-northd      |
+                              |           |           |
+                              +-----------|-----------+
+                                          |
+                                          |
+                                +-------------------+
+                                | OVN Southbound DB |
+                                +-------------------+
+                                          |
+                                          |
+                       +------------------+------------------+
+                       |                  |                  |
+         HV 1          |                  |    HV n          |
+       +---------------|---------------+  .  +---------------|---------------+
+       |               |               |  .  |               |               |
+       |        ovn-controller         |  .  |        ovn-controller         |
+       |         |          |          |  .  |         |          |          |
+       |         |          |          |     |         |          |          |
+       |  ovs-vswitchd   ovsdb-server  |     |  ovs-vswitchd   ovsdb-server  |
+       |                               |     |                               |
+       +-------------------------------+     +-------------------------------+
+
+
+   Information Flow in OVN
+       Configuration data in OVN flows from north to south. The  CMS,  through
+       its  OVN/CMS  plugin,  passes  the  logical  network  configuration  to
+       ovn-northd via the northbound database. In  turn,  ovn-northd  compiles
+       the  configuration  into a lower-level form and passes it to all of the
+       chassis via the southbound database.
+
+       Status information in OVN flows from south to north. OVN currently proā€
+       vides only a few forms of status information. First,  ovn-northd  popuā€
+       lates  the  up column in the northbound Logical_Switch_Port table: if a
+       logical portā€™s chassis column in the southbound Port_Binding  table  is
+       nonempty,  it  sets up to true, otherwise to false. This allows the CMS
+       to detect when a VMā€™s networking has come up.
+
+       Second, OVN provides feedback to the CMS on the realization of its conā€
+       figuration, that is, whether the configuration provided by the CMS  has
+       taken  effect.  This  feature  requires the CMS to participate in a seā€
+       quence number protocol, which works the following way:
+
+              1.  When the CMS updates the  configuration  in  the  northbound
+                  database, as part of the same transaction, it increments the
+                  value  of the nb_cfg column in the NB_Global table. (This is
+                  only necessary if the CMS wants to know when the  configuraā€
+                  tion has been realized.)
+
+              2.  When  ovn-northd  updates the southbound database based on a
+                  given snapshot of the northbound database, it copies  nb_cfg
+                  from  northbound  NB_Global  into  the  southbound  database
+                  SB_Global table, as part of the same transaction. (Thus,  an
+                  observer  monitoring  both  databases can determine when the
+                  southbound database is caught up with the northbound.)
+
+              3.  After ovn-northd receives confirmation from  the  southbound
+                  database  server that its changes have committed, it updates
+                  sb_cfg in the northbound NB_Global table to the nb_cfg  verā€
+                  sion  that  was  pushed  down. (Thus, the CMS or another obā€
+                  server can determine when the southbound database is  caught
+                  up without a connection to the southbound database.)
+
+              4.  The  ovn-controller process on each chassis receives the upā€
+                  dated southbound database, with  the  updated  nb_cfg.  This
+                  process  in turn updates the physical flows installed in the
+                  chassisā€™s Open vSwitch instances. When it receives confirmaā€
+                  tion from Open vSwitch that the physical flows have been upā€
+                  dated, it updates nb_cfg in its own Chassis  record  in  the
+                  southbound database.
+
+              5.  ovn-northd  monitors the nb_cfg column in all of the Chassis
+                  records in the southbound database. It keeps  track  of  the
+                  minimum  value  among all the records and copies it into the
+                  hv_cfg column in the northbound NB_Global table. (Thus,  the
+                  CMS or another observer can determine when all of the hyperā€
+                  visors have caught up to the northbound configuration.)
+
+   Chassis Setup
+       Each  chassis  in  an  OVN  deployment  must be configured with an Open
+       vSwitch bridge dedicated for OVNā€™s use, called the integration  bridge.
+       System  startup  scripts  may  create  this  bridge  prior  to starting
+       ovn-controller if desired. If this bridge does not exist when  ovn-conā€
+       troller  starts, it will be created automatically with the default conā€
+       figuration suggested below. The ports on  the  integration  bridge  inā€
+       clude:
+
+              ā€¢      On  any  chassis,  tunnel ports that OVN uses to maintain
+                     logical network connectivity.  ovn-controller  adds,  upā€
+                     dates, and removes these tunnel ports.
+
+              ā€¢      On a hypervisor, any VIFs that are to be attached to logā€
+                     ical  networks.  For instances connected through software
+                     emulated ports such as TUN/TAP or VETH pairs, the  hyperā€
+                     visor  itself  will  normally  create ports and plug them
+                     into the  integration  bridge.  For  instances  connected
+                     through  representor  ports, typically used with hardware
+                     offload, the ovn-controller may on CMS direction  consult
+                     a  VIF plug provider for representor port lookup and plug
+                     them into the integration bridge (please refer  to  Docuā€ā€
+                     mentation/topā€ā€
+                     ics/vif-plug-providers/vif-plug-providers.rst
+                      for more information). In both cases the conventions deā€
+                     scribed  in  Documentation/topics/integration.rst  in the
+                     Open vSwitch source tree is followed  to  ensure  mapping
+                     between  OVN  logical port and VIF. (This is pre-existing
+                     integration work that has already been done  on  hyperviā€
+                     sors that support OVS.)
+
+              ā€¢      On  a gateway, the physical port used for logical network
+                     connectivity. System startup scripts add this port to the
+                     bridge prior to starting ovn-controller. This  can  be  a
+                     patch port to another bridge, instead of a physical port,
+                     in more sophisticated setups.
+
+       Other  ports  should not be attached to the integration bridge. In parā€
+       ticular, physical ports attached to the underlay network (as opposed to
+       gateway ports, which are physical ports attached to  logical  networks)
+       must not be attached to the integration bridge. Underlay physical ports
+       should instead be attached to a separate Open vSwitch bridge (they need
+       not be attached to any bridge at all, in fact).
+
+       The integration bridge should be configured as described below. The efā€
+       fect    of    each    of    these    settings    is    documented    in
+       ovs-vswitchd.conf.db(5):
+
+              fail-mode=secure
+                     Avoids switching packets between  isolated  logical  netā€
+                     works  before  ovn-controller  starts  up. See Controller
+                     Failure Settings in ovs-vsctl(8) for more information.
+
+              other-config:disable-in-band=true
+                     Suppresses in-band  control  flows  for  the  integration
+                     bridge.  It  would  be  unusual for such flows to show up
+                     anyway, because OVN uses a local controller (over a  Unix
+                     domain  socket) instead of a remote controller. Itā€™s posā€
+                     sible, however, for some other bridge in the same  system
+                     to  have  an  in-band remote controller, and in that case
+                     this suppresses the flows that in-band control would  orā€
+                     dinarily  set up. Refer to the documentation for more inā€
+                     formation.
+
+       The customary name for the integration bridge is  br-int,  but  another
+       name may be used.
+
+   Logical Networks
+       Logical  network  concepts  in OVN include logical switches and logical
+       routers, the logical version of Ethernet switches and IP  routers,  reā€
+       spectively.  Like  their physical cousins, logical switches and routers
+       can be connected into sophisticated topologies.  Logical  switches  and
+       routers  are  ordinarily purely logical entities, that is, they are not
+       associated or bound to any physical location, and they are  implemented
+       in a distributed manner at each hypervisor that participates in OVN.
+
+       Logical  switch ports (LSPs) are points of connectivity into and out of
+       logical switches. There are many kinds of  logical  switch  ports.  The
+       most  ordinary  kind represent VIFs, that is, attachment points for VMs
+       or containers. A VIF logical port is associated with the physical locaā€
+       tion of its VM, which might change as the VM migrates. (A  VIF  logical
+       port  can  be  associated  with a VM that is powered down or suspended.
+       Such a logical port has no location and no connectivity.)
+
+       Logical router ports (LRPs) are points of connectivity into and out  of
+       logical  routers.  A  LRP connects a logical router either to a logical
+       switch or to another logical router. Logical routers  only  connect  to
+       VMs,  containers,  and  other network nodes indirectly, through logical
+       switches.
+
+       Logical switches and logical routers have  distinct  kinds  of  logical
+       ports,  so  properly  speaking  one  should  usually talk about logical
+       switch ports or logical router ports. However, an unqualified ``logical
+       portā€™ā€™ usually refers to a logical switch port.
+
+       When a VM sends a packet to a VIF logical switch port, the Open vSwitch
+       flow tables simulate the packetā€™s journey through that  logical  switch
+       and  any  other  logical routers and logical switches that it might enā€
+       counter. This happens without transmitting the packet across any physiā€
+       cal medium: the flow tables implement all of the switching and  routing
+       decisions  and behavior. If the flow tables ultimately decide to output
+       the packet at a logical port attached to another hypervisor (or another
+       kind of transport node), then that is the time at which the  packet  is
+       encapsulated for physical network transmission and sent.
+
+     Logical Switch Port Types
+
+       OVN  supports a number of kinds of logical switch ports. VIF ports that
+       connect to VMs or containers, described above, are  the  most  ordinary
+       kind  of  LSP.  In the OVN northbound database, VIF ports have an empty
+       string for their type. This section describes some  of  the  additional
+       port types.
+
+       A  router  logical  switch  port connects a logical switch to a logical
+       router, designating a particular LRP as its peer.
+
+       A localnet logical switch port bridges a logical switch to  a  physical
+       VLAN. A logical switch may have one or more localnet ports. Such a logā€
+       ical switch is used in two scenarios:
+
+              ā€¢      With  one  or more router logical switch ports, to attach
+                     L3 gateway routers and distributed gateways to a physical
+                     network.
+
+              ā€¢      With one or more VIF logical switch ports, to attach  VMs
+                     or  containers  directly  to  a physical network. In this
+                     case, the logical switch is not really logical, since  it
+                     is  bridged to the physical network rather than insulated
+                     from it, and therefore cannot have independent but  overā€
+                     lapping  IP  address  namespaces, etc. A deployment might
+                     nevertheless choose such a configuration to  take  advanā€
+                     tage  of  the OVN control plane and features such as port
+                     security and ACLs.
+
+       When a logical switch contains multiple localnet ports,  the  following
+       is assumed.
+
+              ā€¢      Each chassis has a bridge mapping for one of the localnet
+                     physical networks only.
+
+              ā€¢      To  facilitate interconnectivity between VIF ports of the
+                     switch that are located on different chassis with differā€
+                     ent physical network connectivity, the fabric  implements
+                     L3  routing  between these adjacent physical network segā€
+                     ments.
+
+       Note: nothing said above implies that a chassis cannot  be  plugged  to
+       multiple  physical  networks  as  long  as  they  belong  to  different
+       switches.
+
+       A localport logical switch port is a special kind of VIF logical switch
+       port. These ports are present in every chassis, not bound to  any  parā€
+       ticular  one.  Traffic to such a port will never be forwarded through a
+       tunnel, and traffic from such a port is expected to be destined only to
+       the same chassis, typically in response to a request it received. Openā€
+       Stack Neutron uses a localport port to serve metadata to VMs.  A  metaā€
+       data  proxy  process is attached to this port on every host and all VMs
+       within the same network will reach it at the same IP/MAC address  withā€
+       out  any traffic being sent over a tunnel. For further details, see the
+       OpenStack documentation for networking-ovn.
+
+       LSP types vtep and l2gateway are used for gateways. See  Gateways,  beā€
+       low, for more information.
+
+     Implementation Details
+
+       These  concepts  are details of how OVN is implemented internally. They
+       might still be of interest to users and administrators.
+
+       Logical datapaths are an implementation detail of logical  networks  in
+       the  OVN southbound database. ovn-northd translates each logical switch
+       or router in the northbound database into a  logical  datapath  in  the
+       southbound database Datapath_Binding table.
+
+       For  the most part, ovn-northd also translates each logical switch port
+       in the OVN northbound database into a record in the southbound database
+       Port_Binding table. The latter table corresponds roughly to the  northā€
+       bound  Logical_Switch_Port table. It has multiple types of logical port
+       bindings, of which many types correspond  directly  to  northbound  LSP
+       types. LSP types handled this way include VIF (empty string), localnet,
+       localport, vtep, and l2gateway.
+
+       The  Port_Binding table has some types of port binding that do not corā€
+       respond directly to logical switch port types. The common is patch port
+       bindings, known as logical patch ports. These port bindings always  ocā€
+       cur  in pairs, and a packet that enters on either side comes out on the
+       other. ovn-northd connects logical switches  and  logical  routers  toā€
+       gether using logical patch ports.
+
+       Port  bindings  with types vtep, l2gateway, l3gateway, and chassisrediā€ā€
+       rect are used for gateways. These are explained in Gateways, below.
+
+   Gateways
+       Gateways provide limited  connectivity  between  logical  networks  and
+       physical ones. They can also provide connectivity between different OVN
+       deployments. This section will focus on the former, and the latter will
+       be described in details in section OVN Deployments Interconnection.
+
+       OVN support multiple kinds of gateways.
+
+     VTEP Gateways
+
+       A  ``VTEP  gatewayā€™ā€™  connects an OVN logical network to a physical (or
+       virtual) switch that implements the OVSDB VTEP schema that  accompanies
+       Open vSwitch. (The ``VTEP gatewayā€™ā€™ term is a misnomer, since a VTEP is
+       just  a  VXLAN Tunnel Endpoint, but it is a well established name.) See
+       Life Cycle of a VTEP gateway, below, for more information.
+
+       The main intended use case for VTEP  gateways  is  to  attach  physical
+       servers  to  an OVN logical network using a physical top-of-rack switch
+       that supports the OVSDB VTEP schema.
+
+     L2 Gateways
+
+       A L2 gateway simply attaches a designated physical L2 segment available
+       on some chassis to a logical network. The physical network  effectively
+       becomes part of the logical network.
+
+       To set up a L2 gateway, the CMS adds an l2gateway LSP to an appropriate
+       logical  switch,  setting  LSP  options to name the chassis on which it
+       should be bound. ovn-northd copies this configuration into a southbound
+       Port_Binding record. On the designated chassis, ovn-controller forwards
+       packets appropriately to and from the physical segment.
+
+       L2 gateway ports have features in common with localnet ports.  However,
+       with  a  localnet  port, the physical network becomes the transport beā€
+       tween hypervisors. With an L2 gateway, packets  are  still  transported
+       between  hypervisors  over  tunnels and the l2gateway port is only used
+       for the packets that are on the physical network. The  application  for
+       L2  gateways is similar to that for VTEP gateways, e.g. to add non-virā€
+       tualized machines to a logical network, but L2 gateways do not  require
+       special support from top-of-rack hardware switches.
+
+     L3 Gateway Routers
+
+       As described above under Logical Networks, ordinary OVN logical routers
+       are  distributed: they are not implemented in a single place but rather
+       in every hypervisor chassis. This is a problem  for  stateful  services
+       such  as  SNAT  and DNAT, which need to be implemented in a centralized
+       manner.
+
+       To allow for this  kind  of  functionality,  OVN  supports  L3  gateway
+       routers, which are OVN logical routers that are implemented in a desigā€
+       nated  chassis.  Gateway routers are typically used between distributed
+       logical routers and physical networks. The distributed  logical  router
+       and the logical switches behind it, to which VMs and containers attach,
+       effectively  reside  on each hypervisor. The distributed router and the
+       gateway router are connected by another logical switch,  sometimes  reā€
+       ferred  to  as  a  ``joinā€™ā€™ logical switch. (OVN logical routers may be
+       connected to one another directly, without an intervening  switch,  but
+       the  OVN  implementation only supports gateway logical routers that are
+       connected to logical switches. Using a join logical switch also reduces
+       the number of IP addresses needed on the distributed  router.)  On  the
+       other  side, the gateway router connects to another logical switch that
+       has a localnet port connecting to the physical network.
+
+       The following diagram shows a typical situation. One  or  more  logical
+       switches LS1, ..., LSn connect to distributed logical router LR1, which
+       in  turn  connects  through LSjoin to gateway logical router GLR, which
+       also connects to logical switch LSlocal, which includes a localnet port
+       to attach to the physical network.
+
+                                       LSlocal
+                                          |
+                                         GLR
+                                          |
+                                       LSjoin
+                                          |
+                                         LR1
+                                          |
+                                     +----+----+
+                                     |    |    |
+                                    LS1  ...  LSn
+
+
+       To configure an L3 gateway router, the CMS sets options:chassis in  the
+       routerā€™s  northbound Logical_Router to the chassisā€™s name. In response,
+       ovn-northd uses a special l3gateway port binding (instead  of  a  patch
+       binding)  in  the  southbound database to connect the logical router to
+       its neighbors. In turn, ovn-controller tunnels  packets  to  this  port
+       binding  to  the  designated  L3 gateway chassis, instead of processing
+       them locally.
+
+       DNAT and SNAT rules may be associated with a gateway router, which proā€
+       vides a central location that can handle one-to-many SNAT (aka IP  masā€
+       querading).  Distributed  gateway  ports, described below, also support
+       NAT.
+
+     Distributed Gateway Ports
+
+       A distributed gateway port is a logical router port that  is  specially
+       configured  to  designate one distinguished chassis, called the gateway
+       chassis, for centralized processing. A distributed gateway port  should
+       connect  to  a logical switch that has an LSP that connects externally,
+       that is, either a localnet LSP or a connection to another  OVN  deployā€
+       ment  (see  OVN Deployments Interconnection). Packets that traverse the
+       distributed gateway port are processed without  involving  the  gateway
+       chassis  when  they  can  be, but when needed they do take an extra hop
+       through it.
+
+       The following diagram illustrates the  use  of  a  distributed  gateway
+       port. A number of logical switches LS1, ..., LSn connect to distributed
+       logical  router  LR1,  which  in  turn connects through the distributed
+       gateway port to logical switch LSlocal that includes a localnet port to
+       attach to the physical network.
+
+                                       LSlocal
+                                          |
+                                         LR1
+                                          |
+                                     +----+----+
+                                     |    |    |
+                                    LS1  ...  LSn
+
+
+       ovn-northd creates two southbound Port_Binding records to  represent  a
+       distributed  gateway  port, instead of the usual one. One of these is a
+       patch port binding named for the LRP, which is used for as much traffic
+       as it can. The other one is a port binding with  type  chassisredirect,
+       named  cr-port.  The  chassisredirect  port binding has one specialized
+       job: when a packet is output to it, the flow table causes it to be tunā€
+       neled to the gateway chassis, at which point it is automatically output
+       to the patch port binding. Thus, the flow table can output to this port
+       binding in cases where a particular task has to happen on  the  gateway
+       chassis.  The  chassisredirect  port binding is not otherwise used (for
+       example, it never receives packets).
+
+       The CMS may configure distributed gateway ports three  different  ways.
+       See   Distributed   Gateway   Ports  in  the  documentation  for  Logiā€ā€
+       cal_Router_Port in ovn-nb(5) for details.
+
+       Distributed gateway ports support high availability. When more than one
+       chassis is specified, OVN only uses one at a time as the gateway  chasā€
+       sis. OVN uses BFD to monitor gateway connectivity, preferring the highā€
+       est-priority gateway that is online.
+
+       A logical router can have multiple distributed gateway ports, each conā€
+       necting  different  external  networks.  Load balancing is not yet supā€
+       ported for logical routers with more than one distributed gateway  port
+       configured.
+
+       Physical VLAN MTU Issues
+
+       Consider the preceding diagram again:
+
+                                       LSlocal
+                                          |
+                                         LR1
+                                          |
+                                     +----+----+
+                                     |    |    |
+                                    LS1  ...  LSn
+
+
+       Suppose that each logical switch LS1, ..., LSn is bridged to a physical
+       VLAN-tagged network attached to a localnet port on LSlocal, over a disā€
+       tributed  gateway  port  on LR1. If a packet originating on LSi is desā€
+       tined to the external network, OVN sends it to the gateway chassis over
+       a tunnel. There, the packet traverses LR1ā€™s  logical  router  pipeline,
+       possibly  undergoes  NAT,  and eventually ends up at LSlocalā€™s localnet
+       port. If all of the physical links in the network have  the  same  MTU,
+       then the packetā€™s transit across a tunnel causes an MTU problem: tunnel
+       overhead  prevents a packet that uses the full physical MTU from crossā€
+       ing the tunnel to the gateway chassis (without fragmentation).
+
+       OVN offers two solutions to this problem, the  reside-on-redirect-chasā€ā€
+       sis  and  redirect-type  options.  Both  solutions require each logical
+       switch LS1, ..., LSn to include a localnet  logical  switch  port  LN1,
+       ...,  LNn  respectively,  that  is  present on each chassis. Both cause
+       packets to be sent over the localnet ports  instead  of  tunnels.  They
+       differ  in which packets-some or all-are sent this way. The most promiā€
+       nent tradeoff between these options is that  reside-on-redirect-chassis
+       is easier to configure and that redirect-type performs better for east-
+       west traffic.
+
+       The first solution is the reside-on-redirect-chassis option for logical
+       router  ports. Setting this option on a LRP from (e.g.) LS1 to LR1 disā€
+       ables forwarding from LS1 to LR1 except  on  the  gateway  chassis.  On
+       chassis  other  than the gateway chassis, this single change means that
+       packets that would otherwise have been forwarded  to  LR1  are  instead
+       forwarded  to  LN1. The instance of LN1 on the gateway chassis then reā€
+       ceives the packet and forwards it to LR1. The packet traverses the  LR1
+       logical router pipeline, possibly undergoes NAT, and eventually ends up
+       at LSlocalā€™s localnet port. The packet never traverses a tunnel, avoidā€
+       ing the MTU issue.
+
+       This option has the further consequence of centralizing ``distributedā€™ā€™
+       logical  router  LR1, since no packets are forwarded from LS1 to LR1 on
+       any chassis other than the gateway chassis. Therefore, east-west  trafā€
+       fic  passes  through  the  gateway  chassis, not just north-south. (The
+       naive ``fixā€™ā€™ of allowing east-west traffic to  flow  directly  between
+       chassis over LN1 does not work because routing sets the Ethernet source
+       address to LR1ā€™s source address. Seeing this single Ethernet source adā€
+       dress  originate  from  all  of  the  chassis will confuse the physical
+       switch.)
+
+       Do not set the reside-on-redirect-chassis option on a distributed gateā€
+       way port. In the diagram above, it would be set on the LRPs  connecting
+       LS1, ..., LSn to LR1.
+
+       The second solution is the redirect-type option for distributed gateway
+       ports.  Setting  this  option  to bridged causes packets that are rediā€
+       rected to the gateway chassis to go over the localnet ports instead  of
+       being  tunneled. This option does not change how OVN treats packets not
+       redirected to the gateway chassis.
+
+       The redirect-type option requires the administrator or the CMS to  conā€
+       figure  each  participating  chassis with a unique Ethernet address for
+       the logical router by  setting  ovn-chassis-mac-mappings  in  the  Open
+       vSwitch  database, for use by ovn-controller. This makes it more diffiā€
+       cult to configure than reside-on-redirect-chassis.
+
+       Set the redirect-type option on a distributed gateway port.
+
+       Using Distributed Gateway Ports For Scalability
+
+       Although the primary goal of distributed gateway ports  is  to  provide
+       connectivity  to  external  networks,  there  is a special use case for
+       scalability.
+
+       In some deployments, such as the  ones  using  ovn-kubernetes,  logical
+       switches are bound to individual chassises, and are connected by a disā€
+       tributed logical router. In such deployments, the chassis level logical
+       switches  are  centralized on the chassis instead of distributed, which
+       means the ovn-controller on each chassis doesnā€™t need to process  flows
+       and  ports of logical switches on other chassises. However, without any
+       specific hint, ovn-controller  would  still  process  all  the  logical
+       switches  as  if  they are fully distributed. In this case, distributed
+       gateway port can be very useful. The chassis level logical switches can
+       be connected to the distributed router using distributed gateway ports,
+       by setting the gateway chassis (or HA chassis groups with only a single
+       chassis in it) to the chassis that each logical  switch  is  bound  to.
+       ovn-controller  would  then skip processing the logical switches on all
+       the other chassises, largely improving the scalability, especially when
+       there are a big number of chassises.
+
+   Life Cycle of a VIF
+       Tables and their schemas presented in isolation are difficult to underā€
+       stand. Hereā€™s an example.
+
+       A VIF on a hypervisor is a virtual network interface attached either to
+       a VM or a container running directly on that hypervisor (This  is  difā€
+       ferent from the interface of a container running inside a VM).
+
+       The  steps  in  this  example refer often to details of the OVN and OVN
+       Northbound database schemas. Please see ovn-sb(5)  and  ovn-nb(5),  reā€
+       spectively, for the full story on these databases.
+
+              1.  A VIFā€™s life cycle begins when a CMS administrator creates a
+                  new VIF using the CMS user interface or API and adds it to a
+                  switch (one implemented by OVN as a logical switch). The CMS
+                  updates  its  own  configuration.  This includes associating
+                  unique, persistent identifier vif-id  and  Ethernet  address
+                  mac with the VIF.
+
+              2.  The  CMS  plugin  updates the OVN Northbound database to inā€
+                  clude  the  new  VIF,  by  adding  a  row   to   the   Logiā€ā€
+                  cal_Switch_Port  table.  In the new row, name is vif-id, mac
+                  is mac, switch points to  the  OVN  logical  switchā€™s  Logiā€
+                  cal_Switch  record, and other columns are initialized approā€
+                  priately.
+
+              3.  ovn-northd receives the OVN Northbound database  update.  In
+                  turn,  it  makes the corresponding updates to the OVN Southā€
+                  bound database, by adding rows to the OVN  Southbound  dataā€
+                  base  Logical_Flow table to reflect the new port, e.g. add a
+                  flow to recognize that packets destined to  the  new  portā€™s
+                  MAC  address  should be delivered to it, and update the flow
+                  that delivers broadcast and multicast packets to include the
+                  new port. It also creates a record in the Binding table  and
+                  populates  all its columns except the column that identifies
+                  the chassis.
+
+              4.  On  every  hypervisor,  ovn-controller  receives  the  Logiā€ā€
+                  cal_Flow  table updates that ovn-northd made in the previous
+                  step. As long as the VM that owns the VIF  is  powered  off,
+                  ovn-controller  cannot  do  much;  it  cannot,  for example,
+                  arrange to send packets to or receive packets from the  VIF,
+                  because the VIF does not actually exist anywhere.
+
+              5.  Eventually,  a  user  powers on the VM that owns the VIF. On
+                  the hypervisor where the VM is powered on,  the  integration
+                  between  the hypervisor and Open vSwitch (described in Docuā€ā€
+                  mentation/topics/integration.rst in the Open vSwitch  source
+                  tree)  adds the VIF to the OVN integration bridge and stores
+                  vif-id in external_ids:iface-id to indicate that the  interā€
+                  face  is an instantiation of the new VIF. (None of this code
+                  is new in OVN; this is pre-existing  integration  work  that
+                  has already been done on hypervisors that support OVS.)
+
+              6.  On the hypervisor where the VM is powered on, ovn-controller
+                  notices  external_ids:iface-id  in the new Interface. In reā€
+                  sponse, in the OVN Southbound DB, it updates the Binding taā€
+                  bleā€™s chassis column for the row that links the logical port
+                  from external_ids: iface-id to  the  hypervisor.  Afterward,
+                  ovn-controller  updates  the local hypervisorā€™s OpenFlow taā€
+                  bles so that packets to and from the VIF are  properly  hanā€
+                  dled.
+
+              7.  Some CMS systems, including OpenStack, fully start a VM only
+                  when  its  networking  is ready. To support this, ovn-northd
+                  notices the chassis column updated for the  row  in  Binding
+                  table  and  pushes  this upward by updating the up column in
+                  the OVN Northbound databaseā€™s Logical_Switch_Port  table  to
+                  indicate  that  the  VIF is now up. The CMS, if it uses this
+                  feature, can then react by allowing the  VMā€™s  execution  to
+                  proceed.
+
+              8.  On  every  hypervisor  but  the  one  where the VIF resides,
+                  ovn-controller notices the completely populated row  in  the
+                  Binding table. This provides ovn-controller the physical loā€
+                  cation  of  the  logical  port, so each instance updates the
+                  OpenFlow tables of its switch  (based  on  logical  datapath
+                  flows  in  the OVN DB Logical_Flow table) so that packets to
+                  and from the VIF can be properly handled via tunnels.
+
+              9.  Eventually, a user powers off the VM that owns the  VIF.  On
+                  the  hypervisor  where  the  VM  was powered off, the VIF is
+                  deleted from the OVN integration bridge.
+
+              10. On the hypervisor where the VM  was  powered  off,  ovn-conā€ā€
+                  troller  notices  that  the VIF was deleted. In response, it
+                  removes the Chassis column content in the Binding table  for
+                  the logical port.
+
+              11. On  every hypervisor, ovn-controller notices the empty Chasā€ā€
+                  sis column in the Binding tableā€™s row for the logical  port.
+                  This  means that ovn-controller no longer knows the physical
+                  location of the logical port, so each instance  updates  its
+                  OpenFlow table to reflect that.
+
+              12. Eventually,  when  the  VIF  (or its entire VM) is no longer
+                  needed by anyone, an administrator deletes the VIF using the
+                  CMS user interface or API. The CMS updates its own  configuā€
+                  ration.
+
+              13. The CMS plugin removes the VIF from the OVN Northbound dataā€
+                  base, by deleting its row in the Logical_Switch_Port table.
+
+              14. ovn-northd  receives  the  OVN Northbound update and in turn
+                  updates the OVN Southbound database accordingly, by removing
+                  or updating the rows from the OVN Southbound database  Logiā€ā€
+                  cal_Flow  table  and  Binding table that were related to the
+                  now-destroyed VIF.
+
+              15. On  every  hypervisor,  ovn-controller  receives  the  Logiā€ā€
+                  cal_Flow  table updates that ovn-northd made in the previous
+                  step. ovn-controller updates OpenFlow tables to reflect  the
+                  update,  although there may not be much to do, since the VIF
+                  had already become unreachable when it was removed from  the
+                  Binding table in a previous step.
+
+   Life Cycle of a Container Interface Inside a VM
+       OVN  provides  virtual  network  abstractions by converting information
+       written in OVN_NB database to OpenFlow flows in each hypervisor. Secure
+       virtual networking for multi-tenants can only be provided if  OVN  conā€
+       troller  is the only entity that can modify flows in Open vSwitch. When
+       the Open vSwitch integration bridge resides in the hypervisor, it is  a
+       fair assumption to make that tenant workloads running inside VMs cannot
+       make any changes to Open vSwitch flows.
+
+       If  the infrastructure provider trusts the applications inside the conā€
+       tainers not to break out and modify the Open vSwitch flows,  then  conā€
+       tainers  can be run in hypervisors. This is also the case when containā€
+       ers are run inside the VMs and Open  vSwitch  integration  bridge  with
+       flows  added  by  OVN  controller  resides in the same VM. For both the
+       above cases, the workflow is the same as explained with an  example  in
+       the previous section ("Life Cycle of a VIF").
+
+       This  section talks about the life cycle of a container interface (CIF)
+       when containers are created in the VMs and the Open vSwitch integration
+       bridge resides inside the hypervisor. In this case, even if a container
+       application breaks out, other tenants are not affected because the conā€
+       tainers running inside the VMs cannot modify  the  flows  in  the  Open
+       vSwitch integration bridge.
+
+       When  multiple  containers  are created inside a VM, there are multiple
+       CIFs associated with them. The network traffic  associated  with  these
+       CIFs  need  to reach the Open vSwitch integration bridge running in the
+       hypervisor for OVN to support virtual network abstractions. OVN  should
+       also be able to distinguish network traffic coming from different CIFs.
+       There are two ways to distinguish network traffic of CIFs.
+
+       One  way  is  to  provide one VIF for every CIF (1:1 model). This means
+       that there could be a lot of network devices in  the  hypervisor.  This
+       would slow down OVS because of all the additional CPU cycles needed for
+       the management of all the VIFs. It would also mean that the entity creā€
+       ating  the  containers in a VM should also be able to create the correā€
+       sponding VIFs in the hypervisor.
+
+       The second way is to provide a single VIF  for  all  the  CIFs  (1:many
+       model).  OVN could then distinguish network traffic coming from differā€
+       ent CIFs via a tag written in every packet. OVN uses this mechanism and
+       uses VLAN as the tagging mechanism.
+
+              1.  A CIFā€™s life cycle begins when a container is spawned inside
+                  a VM by the either the same CMS that created  the  VM  or  a
+                  tenant  that  owns that VM or even a container Orchestration
+                  System that is different than the CMS that initially created
+                  the VM. Whoever the entity is, it will need to know the vif-
+                  id that is associated with the network interface of  the  VM
+                  through  which  the container interfaceā€™s network traffic is
+                  expected to go through. The entity  that  creates  the  conā€
+                  tainer interface will also need to choose an unused VLAN inā€
+                  side that VM.
+
+              2.  The  container  spawning  entity (either directly or through
+                  the CMS that manages the underlying infrastructure)  updates
+                  the  OVN  Northbound  database  to  include  the new CIF, by
+                  adding a row to the Logical_Switch_Port table.  In  the  new
+                  row,  name is any unique identifier, parent_name is the vif-
+                  id of the VM through which the CIFā€™s network traffic is  exā€
+                  pected  to go through and the tag is the VLAN tag that idenā€
+                  tifies the network traffic of that CIF.
+
+              3.  ovn-northd receives the OVN Northbound database  update.  In
+                  turn,  it  makes the corresponding updates to the OVN Southā€
+                  bound database, by adding rows to the OVN  Southbound  dataā€
+                  baseā€™s  Logical_Flow  table to reflect the new port and also
+                  by creating a new row in the Binding  table  and  populating
+                  all  its columns except the column that identifies the chasā€ā€
+                  sis.
+
+              4.  On  every  hypervisor,  ovn-controller  subscribes  to   the
+                  changes  in  the Binding table. When a new row is created by
+                  ovn-northd that includes a value in  parent_port  column  of
+                  Binding  table,  the  ovn-controller in the hypervisor whose
+                  OVN integration bridge has that same value in vif-id in  exā€ā€
+                  ternal_ids:iface-id  updates the local hypervisorā€™s OpenFlow
+                  tables so that packets to and from the VIF with the particuā€
+                  lar VLAN tag are properly handled. Afterward it updates  the
+                  chassis  column of the Binding to reflect the physical locaā€
+                  tion.
+
+              5.  One can only start the application inside the container  afā€
+                  ter  the  underlying  network  is  ready.  To  support this,
+                  ovn-northd notices the updated chassis column in Binding taā€
+                  ble and updates the up column in the  OVN  Northbound  dataā€
+                  baseā€™s Logical_Switch_Port table to indicate that the CIF is
+                  now up. The entity responsible to start the container appliā€
+                  cation queries this value and starts the application.
+
+              6.  Eventually  the  entity  that  created  and started the conā€
+                  tainer, stops it. The entity, through the CMS (or  directly)
+                  deletes its row in the Logical_Switch_Port table.
+
+              7.  ovn-northd  receives  the  OVN Northbound update and in turn
+                  updates the OVN Southbound database accordingly, by removing
+                  or updating the rows from the OVN Southbound database  Logiā€ā€
+                  cal_Flow  table  that were related to the now-destroyed CIF.
+                  It also deletes the row in the Binding table for that CIF.
+
+              8.  On  every  hypervisor,  ovn-controller  receives  the  Logiā€ā€
+                  cal_Flow  table updates that ovn-northd made in the previous
+                  step. ovn-controller updates OpenFlow tables to reflect  the
+                  update.
+
+   Architectural Physical Life Cycle of a Packet
+       This section describes how a packet travels from one virtual machine or
+       container to another through OVN. This description focuses on the physā€
+       ical treatment of a packet; for a description of the logical life cycle
+       of a packet, please refer to the Logical_Flow table in ovn-sb(5).
+
+       This  section  mentions  several  data and metadata fields, for clarity
+       summarized here:
+
+              tunnel key
+                     When OVN encapsulates a packet in Geneve or another  tunā€
+                     nel,  it attaches extra data to it to allow the receiving
+                     OVN instance to process it correctly. This takes  differā€
+                     ent  forms depending on the particular encapsulation, but
+                     in each case we refer to it here as the  ``tunnel  key.ā€™ā€™
+                     See Tunnel Encapsulations, below, for details.
+
+              logical datapath field
+                     A field that denotes the logical datapath through which a
+                     packet  is being processed. OVN uses the field that Openā€
+                     Flow 1.1+ simply (and confusingly) calls ``metadataā€™ā€™  to
+                     store  the logical datapath. (This field is passed across
+                     tunnels as part of the tunnel key.)
+
+              logical input port field
+                     A field that denotes the  logical  port  from  which  the
+                     packet  entered  the logical datapath. OVN stores this in
+                     Open vSwitch extension register number 14.
+
+                     Geneve and STT tunnels pass this field  as  part  of  the
+                     tunnel  key.  Ramp switch VXLAN tunnels do not explicitly
+                     carry a logical input port, but since they  are  used  to
+                     communicate  with  gateways  that  from OVNā€™s perspective
+                     consist of only a single logical port, so  that  OVN  can
+                     set  the  logical input port field to this one on ingress
+                     to the OVN logical pipeline. As for  regular  VXLAN  tunā€
+                     nels, they donā€™t carry input port field at all. This puts
+                     additional  limitations  on cluster capabilities that are
+                     described in Tunnel Encapsulations section.
+
+              logical output port field
+                     A field that denotes the  logical  port  from  which  the
+                     packet  will leave the logical datapath. This is initialā€
+                     ized to  0  at  the  beginning  of  the  logical  ingress
+                     pipeline.  OVN stores this in Open vSwitch extension regā€
+                     ister number 15.
+
+                     Geneve, STT and regular VXLAN tunnels pass this field  as
+                     part  of the tunnel key. Ramp switch VXLAN tunnels do not
+                     transmit the logical output port field, and since they do
+                     not carry a logical output port field in the tunnel  key,
+                     when  a  packet is received from ramp switch VXLAN tunnel
+                     by an OVN hypervisor, the packet is resubmitted to  table
+                     8  to  determine  the  output  port(s);  when  the packet
+                     reaches table 39, these packets are resubmitted to  table
+                     40  for  local  delivery  by checking a MLF_RCV_FROM_RAMP
+                     flag, which is set when the packet arrives  from  a  ramp
+                     tunnel.
+
+              conntrack zone field for logical ports
+                     A  field  that  denotes  the connection tracking zone for
+                     logical ports. The value only has local significance  and
+                     is not meaningful between chassis. This is initialized to
+                     0  at  the beginning of the logical ingress pipeline. OVN
+                     stores this in Open vSwitch extension register number 13.
+
+              conntrack zone fields for routers
+                     Fields that denote  the  connection  tracking  zones  for
+                     routers.  These  values  only have local significance and
+                     are not meaningful between chassis. OVN stores  the  zone
+                     information  for  north to south traffic (for DNATting or
+                     ECMP symmetric replies) in Open vSwitch extension  regisā€
+                     ter  number  11  and  zone information for south to north
+                     traffic (for SNATing) in Open vSwitch extension  register
+                     number 12.
+
+              logical flow flags
+                     The  logical flags are intended to handle keeping context
+                     between tables in order to decide which rules  in  subseā€
+                     quent  tables  are  matched. These values only have local
+                     significance and are not meaningful between chassis.  OVN
+                     stores the logical flags in Open vSwitch extension regisā€
+                     ter number 10.
+
+              VLAN ID
+                     The  VLAN ID is used as an interface between OVN and conā€
+                     tainers nested inside a VM (see Life Cycle of a container
+                     interface inside a VM, above, for more information).
+
+       Initially, a VM or container on the ingress hypervisor sends  a  packet
+       on a port attached to the OVN integration bridge. Then:
+
+              1.  OpenFlow  table  0 performs physical-to-logical translation.
+                  It matches the packetā€™s ingress port. Its  actions  annotate
+                  the  packet  with  logical  metadata, by setting the logical
+                  datapath field to identify the  logical  datapath  that  the
+                  packet  is  traversing  and  the logical input port field to
+                  identify the ingress port. Then it resubmits to table  8  to
+                  enter the logical ingress pipeline.
+
+                  Packets  that  originate from a container nested within a VM
+                  are treated in a slightly  different  way.  The  originating
+                  container  can  be  distinguished  based on the VIF-specific
+                  VLAN ID, so the physical-to-logical translation flows  addiā€
+                  tionally  match  on  VLAN  ID and the actions strip the VLAN
+                  header. Following this step, OVN treats  packets  from  conā€
+                  tainers just like any other packets.
+
+                  Table  0 also processes packets that arrive from other chasā€
+                  sis. It distinguishes them from  other  packets  by  ingress
+                  port,  which  is a tunnel. As with packets just entering the
+                  OVN pipeline, the actions annotate these packets with  logiā€
+                  cal  datapath  metadata.  For  tunnel types that support it,
+                  they are also annotated with logical ingress port  metadata.
+                  In  addition, the actions set the logical output port field,
+                  which is available because in OVN tunneling occurs after the
+                  logical output port is known. These  pieces  of  information
+                  are  obtained  from  the  tunnel encapsulation metadata (see
+                  Tunnel Encapsulations for encoding details).  Then  the  acā€
+                  tions  resubmit  to  table  38  to  enter the logical egress
+                  pipeline.
+
+              2.  OpenFlow tables 8 through 31  execute  the  logical  ingress
+                  pipeline  from  the Logical_Flow table in the OVN Southbound
+                  database. These tables are expressed entirely  in  terms  of
+                  logical concepts like logical ports and logical datapaths. A
+                  big  part  of ovn-controllerā€™s job is to translate them into
+                  equivalent OpenFlow (in particular it translates  the  table
+                  numbers:  Logical_Flow  tables  0 through 23 become OpenFlow
+                  tables 8 through 31).
+
+                  Each logical flow maps to one or more OpenFlow flows. An acā€
+                  tual packet ordinarily matches only one of  these,  although
+                  in  some  cases  it  can  match more than one of these flows
+                  (which is not a problem because all of them  have  the  same
+                  actions). ovn-controller uses the first 32 bits of the logiā€
+                  cal  flowā€™s  UUID  as  the  cookie  for its OpenFlow flow or
+                  flows. (This is not necessarily unique, since the  first  32
+                  bits of a logical flowā€™s UUID is not necessarily unique.)
+
+                  Some logical flows can map to the Open vSwitch ``conjunctive
+                  matchā€™ā€™ extension (see ovs-fields(7)). Flows with a conjuncā€ā€
+                  tion  action  use  an OpenFlow cookie of 0, because they can
+                  correspond to multiple logical flows. The OpenFlow flow  for
+                  a conjunctive match includes a match on conj_id.
+
+                  Some  logical  flows  may not be represented in the OpenFlow
+                  tables on a given hypervisor, if they could not be  used  on
+                  that  hypervisor. For example, if no VIF in a logical switch
+                  resides on a given hypervisor, and the logical switch is not
+                  otherwise reachable on that hypervisor (e.g. over  a  series
+                  of hops through logical switches and routers starting from a
+                  VIF  on  the  hypervisor),  then the logical flow may not be
+                  represented there.
+
+                  Most OVN actions  have  fairly  obvious  implementations  in
+                  OpenFlow (with OVS extensions), e.g. next; is implemented as
+                  resubmit,  field  =  constant; as set_field. A few are worth
+                  describing in more detail:
+
+                  output:
+                         Implemented by resubmitting the packet to  table  37.
+                         If the pipeline executes more than one output action,
+                         then  each one is separately resubmitted to table 37.
+                         This can be used  to  send  multiple  copies  of  the
+                         packet to multiple ports. (If the packet was not modā€
+                         ified  between  the  output  actions, and some of the
+                         copies are destined to the same hypervisor, then  usā€
+                         ing  a logical multicast output port would save bandā€
+                         width between hypervisors.)
+
+                  get_arp(P, A);
+                  get_nd(P, A);
+                       Implemented by storing arguments into OpenFlow  fields,
+                       then  resubmitting  to  table  66, which ovn-controller
+                       populates with flows generated from the MAC_Binding taā€
+                       ble in the OVN Southbound database. If there is a match
+                       in table 66, then its actions store the  bound  MAC  in
+                       the Ethernet destination address field.
+
+                       (The  OpenFlow  actions  save  and restore the OpenFlow
+                       fields used for the arguments, so that the OVN  actions
+                       do not have to be aware of this temporary use.)
+
+                  put_arp(P, A, E);
+                  put_nd(P, A, E);
+                       Implemented  by  storing  the  arguments  into OpenFlow
+                       fields, then outputting  a  packet  to  ovn-controller,
+                       which updates the MAC_Binding table.
+
+                       (The  OpenFlow  actions  save  and restore the OpenFlow
+                       fields used for the arguments, so that the OVN  actions
+                       do not have to be aware of this temporary use.)
+
+                  R = lookup_arp(P, A, M);
+                  R = lookup_nd(P, A, M);
+                       Implemented  by storing arguments into OpenFlow fields,
+                       then resubmitting to  table  67,  which  ovn-controller
+                       populates with flows generated from the MAC_Binding taā€
+                       ble in the OVN Southbound database. If there is a match
+                       in table 67, then its actions set the logical flow flag
+                       MLF_LOOKUP_MAC.
+
+                       (The  OpenFlow  actions  save  and restore the OpenFlow
+                       fields used for the arguments, so that the OVN  actions
+                       do not have to be aware of this temporary use.)
+
+              3.  OpenFlow tables 37 through 41 implement the output action in
+                  the  logical ingress pipeline. Specifically, table 37 serves
+                  as an entry point to egress pipeline. Table  37  detects  IP
+                  packets  that are too big for a corresponding interface. Taā€
+                  ble 38 produces ICMPv4 Fragmentation Needed (or  ICMPv6  Too
+                  Big) errors and deliver them back to the offending port. taā€
+                  ble  39 handles packets to remote hypervisors, table 40 hanā€
+                  dles packets to the local hypervisor, and  table  41  checks
+                  whether  packets  whose  logical ingress and egress port are
+                  the same should be discarded.
+
+                  Logical patch ports are a special case. Logical patch  ports
+                  do  not  have  a physical location and effectively reside on
+                  every hypervisor. Thus, flow table 40, for output  to  ports
+                  on the local hypervisor, naturally implements output to uniā€
+                  cast  logical  patch  ports  too. However, applying the same
+                  logic to a logical patch port that is part of a logical mulā€
+                  ticast group yields packet duplication, because each  hyperā€
+                  visor  that  contains  a logical port in the multicast group
+                  will also output the packet to the logical patch port. Thus,
+                  multicast groups implement output to logical patch ports  in
+                  table 39.
+
+                  Each  flow  in table 39 matches on a logical output port for
+                  unicast or multicast logical ports that  include  a  logical
+                  port  on  a remote hypervisor. Each flowā€™s actions implement
+                  sending a packet to the port it matches. For unicast logical
+                  output ports on remote hypervisors, the actions set the tunā€
+                  nel key to the correct value, then send the  packet  on  the
+                  tunnel  port to the correct hypervisor. (When the remote hyā€
+                  pervisor receives the packet, table 0 there  will  recognize
+                  it  as a tunneled packet and pass it along to table 40.) For
+                  multicast logical output ports, the actions send one copy of
+                  the packet to each remote hypervisor, in the same way as for
+                  unicast destinations. If a multicast group includes a  logiā€
+                  cal  port or ports on the local hypervisor, then its actions
+                  also resubmit to table 40. Table 39 also includes:
+
+                  ā€¢      A higher-priority rule to match packets received from
+                         ramp switch tunnels, based on flag MLF_RCV_FROM_RAMP,
+                         and resubmit these packets to table 40 for local  deā€
+                         livery.  Packets  received  from  ramp switch tunnels
+                         reach here because of a lack of logical  output  port
+                         field in the tunnel key and thus these packets needed
+                         to  be  submitted  to table 8 to determine the output
+                         port.
+
+                  ā€¢      A higher-priority rule to match packets received from
+                         ports of type localport, based on the  logical  input
+                         port,  and resubmit these packets to table 40 for loā€
+                         cal delivery. Ports of type localport exist on  every
+                         hypervisor  and  by  definition  their traffic should
+                         never go out through a tunnel.
+
+                  ā€¢      A higher-priority rule to match packets that have the
+                         MLF_LOCAL_ONLY logical flow flag set, and whose  desā€
+                         tination  is a multicast address. This flag indicates
+                         that the packet should not be delivered to remote hyā€
+                         pervisors, even if the multicast destination includes
+                         ports on remote hypervisors. This flag is  used  when
+                         ovn-controller  is  the  originator  of the multicast
+                         packet. Since each ovn-controller instance is  origiā€
+                         nating these packets, the packets only need to be deā€
+                         livered to local ports.
+
+                  ā€¢      A  fallback  flow that resubmits to table 40 if there
+                         is no other match.
+
+                  Flows in table 40 resemble those in table 39 but for logical
+                  ports that reside locally rather than remotely. For  unicast
+                  logical  output  ports  on the local hypervisor, the actions
+                  just resubmit to table 41. For multicast output  ports  that
+                  include  one  or more logical ports on the local hypervisor,
+                  for each such logical port P, the actions change the logical
+                  output port to P, then resubmit to table 41.
+
+                  A special case is that when a localnet port  exists  on  the
+                  datapath,  remote  port is connected by switching to the loā€
+                  calnet port. In this case, instead of adding a flow in table
+                  39 to reach the remote port, a flow is added in table 40  to
+                  switch  the logical outport to the localnet port, and resubā€
+                  mit to table 40 as if it were unicasted to a logical port on
+                  the local hypervisor.
+
+                  Table 41 matches and drops packets for which the logical inā€
+                  put and output ports are the same and the MLF_ALLOW_LOOPBACK
+                  flag is not set. It also drops  MLF_LOCAL_ONLY  packets  diā€
+                  rected to a localnet port. It resubmits other packets to taā€
+                  ble 42.
+
+              4.  OpenFlow  tables  42  through  62 execute the logical egress
+                  pipeline from the Logical_Flow table in the  OVN  Southbound
+                  database.  The  egress pipeline can perform a final stage of
+                  validation before packet delivery. Eventually, it  may  exeā€
+                  cute  an  output  action, which ovn-controller implements by
+                  resubmitting to table 64. A packet for  which  the  pipeline
+                  never  executes  output  is effectively dropped (although it
+                  may have been transmitted through a tunnel across a physical
+                  network).
+
+                  The egress pipeline cannot change the logical output port or
+                  cause further tunneling.
+
+              5.  Table 64 bypasses OpenFlow loopback when  MLF_ALLOW_LOOPBACK
+                  is  set. Logical loopback was handled in table 41, but Openā€
+                  Flow by default  also  prevents  loopback  to  the  OpenFlow
+                  ingress port. Thus, when MLF_ALLOW_LOOPBACK is set, OpenFlow
+                  table  64  saves the OpenFlow ingress port, sets it to zero,
+                  resubmits to table 65  for  logical-to-physical  transformaā€
+                  tion,  and  then  restores the OpenFlow ingress port, effecā€
+                  tively disabling OpenFlow loopback  prevents.  When  MLF_ALā€
+                  LOW_LOOPBACK is unset, table 64 flow simply resubmits to taā€
+                  ble 65.
+
+              6.  OpenFlow  table 65 performs logical-to-physical translation,
+                  the opposite of table 0. It  matches  the  packetā€™s  logical
+                  egress  port.  Its actions output the packet to the port atā€
+                  tached to the OVN integration bridge  that  represents  that
+                  logical  port.  If  the  logical  egress port is a container
+                  nested with a VM, then before sending the packet the actions
+                  push on a VLAN header with an appropriate VLAN ID.
+
+   Logical Routers and Logical Patch Ports
+       Typically logical routers and logical patch ports do not have a  physiā€
+       cal  location  and  effectively reside on every hypervisor. This is the
+       case for logical  patch  ports  between  logical  routers  and  logical
+       switches behind those logical routers, to which VMs (and VIFs) attach.
+
+       Consider a packet sent from one virtual machine or container to another
+       VM  or  container  that  resides on a different subnet. The packet will
+       traverse tables 0 to 65 as described in the previous section  Architecā€ā€
+       tural  Physical Life Cycle of a Packet, using the logical datapath repā€
+       resenting the logical switch that the sender is attached to.  At  table
+       39, the packet will use the fallback flow that resubmits locally to taā€
+       ble 40 on the same hypervisor. In this case, all of the processing from
+       table 0 to table 65 occurs on the hypervisor where the sender resides.
+
+       When  the packet reaches table 65, the logical egress port is a logical
+       patch port. ovn-controller implements output to the  logical  patch  is
+       packet  by cloning and resubmitting directly to the first OpenFlow flow
+       table in the ingress pipeline, setting the logical ingress port to  the
+       peer  logical patch port, and using the peer logical patch portā€™s logiā€
+       cal datapath (that represents the logical router).
+
+       The packet re-enters the ingress pipeline in order to traverse tables 8
+       to 65 again, this time using the logical datapath representing the logā€
+       ical router. The processing continues as described in the previous secā€
+       tion Architectural Physical Life Cycle of a  Packet.  When  the  packet
+       reaches  table 65, the logical egress port will once again be a logical
+       patch port. In the same manner as described above, this  logical  patch
+       port  will  cause  the packet to be resubmitted to OpenFlow tables 8 to
+       65, this time using  the  logical  datapath  representing  the  logical
+       switch that the destination VM or container is attached to.
+
+       The packet traverses tables 8 to 65 a third and final time. If the desā€
+       tination  VM or container resides on a remote hypervisor, then table 39
+       will send the packet on a tunnel port from the senderā€™s  hypervisor  to
+       the remote hypervisor. Finally table 65 will output the packet directly
+       to the destination VM or container.
+
+       The  following  sections describe two exceptions, where logical routers
+       and/or logical patch ports are associated with a physical location.
+
+     Gateway Routers
+
+       A gateway router is a logical router that is bound to a physical  locaā€
+       tion.  This  includes  all  of  the  logical patch ports of the logical
+       router, as well as all of the  peer  logical  patch  ports  on  logical
+       switches.  In the OVN Southbound database, the Port_Binding entries for
+       these logical patch ports use the type l3gateway rather than patch,  in
+       order  to  distinguish  that  these  logical patch ports are bound to a
+       chassis.
+
+       When a hypervisor processes a packet on a logical datapath representing
+       a logical switch, and the logical egress port is a l3gateway port  repā€
+       resenting  connectivity  to  a  gateway router, the packet will match a
+       flow in table 39 that sends the packet on a tunnel port to the  chassis
+       where  the  gateway router resides. This processing in table 39 is done
+       in the same manner as for VIFs.
+
+     Distributed Gateway Ports
+
+       This section provides additional details on distributed gateway  ports,
+       outlined earlier.
+
+       The  primary  design  goal  of distributed gateway ports is to allow as
+       much traffic as possible to be handled locally on the hypervisor  where
+       a  VM  or  container resides. Whenever possible, packets from the VM or
+       container to the outside world should be processed completely  on  that
+       VMā€™s  or  containerā€™s hypervisor, eventually traversing a localnet port
+       instance or a tunnel to the physical network or a different OVN deployā€
+       ment. Whenever possible, packets from the outside world to a VM or conā€
+       tainer should be directed through the physical network directly to  the
+       VMā€™s or containerā€™s hypervisor.
+
+       In  order  to allow for the distributed processing of packets described
+       in the paragraph above, distributed gateway ports need  to  be  logical
+       patch  ports  that  effectively reside on every hypervisor, rather than
+       l3gateway ports that are bound to a particular  chassis.  However,  the
+       flows  associated with distributed gateway ports often need to be assoā€
+       ciated with physical locations, for the following reasons:
+
+              ā€¢      The physical network that the localnet port  is  attached
+                     to  typically uses L2 learning. Any Ethernet address used
+                     over the distributed gateway port must be restricted to a
+                     single physical location so that upstream L2 learning  is
+                     not  confused.  Traffic  sent out the distributed gateway
+                     port towards the localnet port with a  specific  Ethernet
+                     address  must  be  sent  out one specific instance of the
+                     distributed gateway port on one specific chassis. Traffic
+                     received from the localnet port (or from  a  VIF  on  the
+                     same logical switch as the localnet port) with a specific
+                     Ethernet address must be directed to the logical switchā€™s
+                     patch port instance on that specific chassis.
+
+                     Due  to the implications of L2 learning, the Ethernet adā€
+                     dress and IP address of the distributed gateway port need
+                     to be restricted to a single physical location. For  this
+                     reason, the user must specify one chassis associated with
+                     the  distributed gateway port. Note that traffic traversā€
+                     ing the distributed gateway port using other Ethernet adā€
+                     dresses and IP addresses (e.g. one-to-one NAT) is not reā€
+                     stricted to this chassis.
+
+                     Replies to ARP and ND requests must be  restricted  to  a
+                     single  physical  location, where the Ethernet address in
+                     the reply resides. This includes ARP and ND  replies  for
+                     the IP address of the distributed gateway port, which are
+                     restricted  to  the chassis that the user associated with
+                     the distributed gateway port.
+
+              ā€¢      In order to support one-to-many SNAT (aka  IP  masqueradā€
+                     ing),  where  multiple logical IP addresses spread across
+                     multiple chassis are mapped to a single external  IP  adā€
+                     dress, it will be necessary to handle some of the logical
+                     router  processing on a specific chassis in a centralized
+                     manner. Since the SNAT external IP address  is  typically
+                     the distributed gateway port IP address, and for simplicā€
+                     ity,  the  same  chassis  associated with the distributed
+                     gateway port is used.
+
+       The details of flow restrictions to specific chassis are  described  in
+       the ovn-northd documentation.
+
+       While  most  of  the physical location dependent aspects of distributed
+       gateway ports can be handled by  restricting  some  flows  to  specific
+       chassis, one additional mechanism is required. When a packet leaves the
+       ingress pipeline and the logical egress port is the distributed gateway
+       port, one of two different sets of actions is required at table 39:
+
+              ā€¢      If  the packet can be handled locally on the senderā€™s hyā€
+                     pervisor (e.g. one-to-one NAT traffic), then  the  packet
+                     should  just  be  resubmitted locally to table 40, in the
+                     normal manner for distributed logical patch ports.
+
+              ā€¢      However, if the packet needs to be handled on the chassis
+                     associated with the distributed gateway port  (e.g.  one-
+                     to-many  SNAT  traffic or non-NAT traffic), then table 39
+                     must send the packet on a tunnel port to that chassis.
+
+       In order to trigger the second set of actions, the chassisredirect type
+       of southbound Port_Binding has been added. Setting the  logical  egress
+       port  to the type chassisredirect logical port is simply a way to indiā€
+       cate that although the packet is destined for the  distributed  gateway
+       port,  it  needs  to be redirected to a different chassis. At table 39,
+       packets with this logical egress port are sent to a  specific  chassis,
+       in the same way that table 39 directs packets whose logical egress port
+       is a VIF or a type l3gateway port to different chassis. Once the packet
+       arrives at that chassis, table 40 resets the logical egress port to the
+       value  representing  the distributed gateway port. For each distributed
+       gateway port, there is one type chassisredirect port,  in  addition  to
+       the distributed logical patch port representing the distributed gateway
+       port.
+
+     High Availability for Distributed Gateway Ports
+
+       OVN  allows you to specify a prioritized list of chassis for a distribā€
+       uted gateway port. This is done by associating multiple Gateway_Chassis
+       rows with a Logical_Router_Port in the OVN_Northbound database.
+
+       When multiple chassis have been specified for a  gateway,  all  chassis
+       that may send packets to that gateway will enable BFD on tunnels to all
+       configured  gateway chassis. The current master chassis for the gateway
+       is the highest priority gateway chassis that is currently viewed as acā€
+       tive based on BFD status.
+
+       For more information on L3 gateway high availability, please  refer  to
+       http://docs.ovn.org/en/latest/topics/high-availability.html.
+
+     Restrictions of Distributed Gateway Ports
+
+       Distributed  gateway  ports are used to connect to an external network,
+       which can be a physical network modeled by a logical switch with a  loā€
+       calnet  port,  and can also be a logical switch that interconnects difā€
+       ferent OVN deployments (see OVN Deployments  Interconnection).  Usually
+       there  can be many logical routers connected to the same external logiā€
+       cal switch, as shown in below diagram.
+
+                                     +--LS-EXT-+
+                                     |    |    |
+                                     |    |    |
+                                    LR1  ...  LRn
+
+
+       In this diagram, there are n logical routers  connected  to  a  logical
+       switch  LS-EXT,  each  with a distributed gateway port, so that traffic
+       sent to external world is redirected to the gateway chassis that is asā€
+       signed to the distributed gateway port of respective logical router.
+
+       In the logical topology, nothing can prevent an user to add a route beā€
+       tween the logical routers via the connected distributed  gateway  ports
+       on  LS-EXT.  However,  the route works only if the LS-EXT is a physical
+       network (modeled by a logical switch with a  localnet  port).  In  that
+       case the packet will be delivered between the gateway chassises through
+       the localnet port via physical network. If the LS-EXT is a regular logā€
+       ical switch (backed by tunneling only, as in the use case of OVN interā€
+       connection),  then  the  packet  will  be dropped on the source gateway
+       chassis. The limitation is due the fact that distributed gateway  ports
+       are tied to physical location, and without physical network connection,
+       we  will end up with either dropping the packet or transferring it over
+       the tunnels which could cause bigger problems such as broadcast packets
+       being redirect repeatedly by different gateway chassises.
+
+       With the limitation in mind, if a user do want the direct  connectivity
+       between the logical routers, it is better to create an internal logical
+       switch  connected  to  the  logical routers with regular logical router
+       ports, which are completely distributed and the packets donā€™t  have  to
+       leave  a  chassis  unless necessary, which is more optimal than routing
+       via the distributed gateway ports.
+
+     ARP request and ND NS packet processing
+
+       Due to the fact that ARP requests and ND NA packets are usually  broadā€
+       cast  packets,  for  performance  reasons, OVN deals with requests that
+       target OVN owned IP addresses (i.e., IP  addresses  configured  on  the
+       router  ports,  VIPs, NAT IPs) in a specific way and only forwards them
+       to the logical router that owns the target IP address. This behavior is
+       different than that of traditional  switches  and  implies  that  other
+       routers/hosts connected to the logical switch will not learn the MAC/IP
+       binding from the request packet.
+
+       All other ARP and ND packets are flooded in the L2 broadcast domain and
+       to all attached logical patch ports.
+
+     VIFs on the logical switch connected by a distributed gateway port
+
+       Typically the logical switch connected by a distributed gateway port is
+       for  external connectivity, usually to a physical network through a loā€
+       calnet port on the logical  switch,  or  to  a  remote  OVN  deployment
+       through  OVN  Interconnection. In these cases there is no VIF ports reā€
+       quired on the logical switch.
+
+       While not very common, it is still possible to create VIF ports on  the
+       logical  switch connected by a distributed gateway port, but there is a
+       limitation that the logical ports need to reside on the gateway chassis
+       where the distributed gateway port resides to get connectivity to other
+       logical switches through the distributed gateway port. There is no limā€
+       itation for the VIFs to connect within the logical  switch,  or  beyond
+       the  logical  switch  through  other regular distributed logical router
+       ports.
+
+       A special case is when using distributed gateway ports for  scalability
+       purpose,  as  mentioned  earlier in this document. The logical switches
+       connected by distributed gateway ports are  not  for  connectivity  but
+       just  for  regular VIFs. However, the above limitation usually does not
+       matter because in this use case all the VIFs on the logical switch  are
+       located on the same chassis with the distributed gateway port that conā€
+       nects the logical switch.
+
+   Multiple localnet logical switches connected to a Logical Router
+       It  is  possible to have multiple logical switches each with a localnet
+       port (representing physical networks) connected to a logical router, in
+       which one localnet logical switch may provide the external connectivity
+       via a distributed  gateway  port  and  rest  of  the  localnet  logical
+       switches  use VLAN tagging in the physical network. It is expected that
+       ovn-bridge-mappings is configured appropriately on the chassis for  all
+       these localnet networks.
+
+     East West routing
+
+       East-West  routing  between these localnet VLAN tagged logical switches
+       work almost the same way as normal logical switches. When the VM  sends
+       such a packet, then:
+
+              1.  It  first  enters  the  ingress  pipeline,  and  then egress
+                  pipeline of the source localnet logical switch datapath.  It
+                  then enters the ingress pipeline of the logical router dataā€
+                  path via the logical router port in the source chassis.
+
+              2.  Routing decision is taken.
+
+              3.  From the router datapath, packet enters the ingress pipeline
+                  and then egress pipeline of the destination localnet logical
+                  switch  datapath  and  goes out of the integration bridge to
+                  the provider bridge ( belonging to the  destination  logical
+                  switch)  via  the localnet port. While sending the packet to
+                  provider bridge, we also replace router port MAC  as  source
+                  MAC with a chassis unique MAC.
+
+                  This  chassis  unique MAC is configured as global ovs config
+                  on each chassis (eg. via "ovs-vsctl set open . external-ids:
+                  ovn-chassis-mac-mappings="phys:aa:bb:cc:dd:ee:$i$i"").   For
+                  more details, see ovn-controller(8).
+
+                  If the above is not configured, then source MAC would be the
+                  router  port  MAC. This could create problem if we have more
+                  than one chassis. This is because, since the router port  is
+                  distributed, the same (MAC,VLAN) tuple will seen by physical
+                  network  from other chassis as well, which could cause these
+                  issues:
+
+                  ā€¢      Continuous MAC moves in top-of-rack switch (ToR).
+
+                  ā€¢      ToR dropping the traffic, which is causing continuous
+                         MAC moves.
+
+                  ā€¢      ToR blocking the ports from which MAC moves are  hapā€
+                         pening.
+
+              4.  The destination chassis receives the packet via the localnet
+                  port and sends it to the integration bridge. Before entering
+                  the  integration bridge the source mac of the packet will be
+                  replaced with router port mac again. The packet  enters  the
+                  ingress pipeline and then egress pipeline of the destination
+                  localnet  logical  switch  and finally gets delivered to the
+                  destination VM port.
+
+     External traffic
+
+       The following happens when a VM sends an external  traffic  (which  reā€
+       quires  NATting) and the chassis hosting the VM doesnā€™t have a distribā€
+       uted gateway port.
+
+              1.  The packet first  enters  the  ingress  pipeline,  and  then
+                  egress  pipeline of the source localnet logical switch dataā€
+                  path. It then enters the ingress  pipeline  of  the  logical
+                  router  datapath  via  the logical router port in the source
+                  chassis.
+
+              2.  Routing decision is taken. Since the gateway router  or  the
+                  distributed  gateway port doesnā€™t reside in the source chasā€
+                  sis, the traffic is redirected to the  gateway  chassis  via
+                  the tunnel port.
+
+              3.  The  gateway chassis receives the packet via the tunnel port
+                  and the packet enters the egress  pipeline  of  the  logical
+                  router datapath. NAT rules are applied here. The packet then
+                  enters  the ingress pipeline and then egress pipeline of the
+                  localnet logical switch  datapath  which  provides  external
+                  connectivity  and  finally goes out via the localnet port of
+                  the logical switch which provides external connectivity.
+
+       Although this works, the VM traffic is tunnelled  when  sent  from  the
+       compute  chassis  to the gateway chassis. In order for it to work propā€
+       erly, the MTU of the localnet logical switches must be lowered  to  acā€
+       count for the tunnel encapsulation.
+
+   Centralized  routing for localnet VLAN tagged logical switches connected to
+       a Logical Router
+       To overcome the tunnel encapsulation problem described in the  previous
+       section,  OVN  supports  the option of enabling centralized routing for
+       localnet VLAN tagged logical switches. CMS can configure the option opā€ā€
+       tions:reside-on-redirect-chassis to true for  each  Logical_Router_Port
+       which  connects  to  the  localnet  VLAN  tagged logical switches. This
+       causes the gateway chassis (hosting the distributed  gateway  port)  to
+       handle  all  the  routing for these networks, making it centralized. It
+       will reply to the ARP requests for the logical router port IPs.
+
+       If the logical router doesnā€™t have a distributed gateway port  connectā€
+       ing  to  the localnet logical switch which provides external connectivā€
+       ity, or if it has more than one distributed gateway  ports,  then  this
+       option is ignored by OVN.
+
+       The  following happens when a VM sends an east-west traffic which needs
+       to be routed:
+
+              1.  The packet first  enters  the  ingress  pipeline,  and  then
+                  egress  pipeline of the source localnet logical switch dataā€
+                  path and is sent out via a localnet port of the  source  loā€
+                  calnet  logical  switch  (instead  of  sending  it to router
+                  pipeline).
+
+              2.  The gateway chassis receives the packet via a localnet  port
+                  of  the  source  localnet logical switch and sends it to the
+                  integration bridge.  The  packet  then  enters  the  ingress
+                  pipeline,  and  then  egress pipeline of the source localnet
+                  logical switch datapath and enters the ingress  pipeline  of
+                  the logical router datapath.
+
+              3.  Routing decision is taken.
+
+              4.  From the router datapath, packet enters the ingress pipeline
+                  and then egress pipeline of the destination localnet logical
+                  switch  datapath. It then goes out of the integration bridge
+                  to the provider bridge ( belonging to the destination  logiā€
+                  cal switch) via a localnet port.
+
+              5.  The  destination  chassis receives the packet via a localnet
+                  port and sends it to the integration bridge. The packet  enā€
+                  ters  the  ingress  pipeline and then egress pipeline of the
+                  destination localnet logical switch and finally delivered to
+                  the destination VM port.
+
+       The following happens when a VM sends an  external  traffic  which  reā€
+       quires NATting:
+
+              1.  The  packet  first  enters  the  ingress  pipeline, and then
+                  egress pipeline of the source localnet logical switch  dataā€
+                  path  and  is sent out via a localnet port of the source loā€
+                  calnet logical switch  (instead  of  sending  it  to  router
+                  pipeline).
+
+              2.  The  gateway chassis receives the packet via a localnet port
+                  of the source localnet logical switch and sends  it  to  the
+                  integration  bridge.  The  packet  then  enters  the ingress
+                  pipeline, and then egress pipeline of  the  source  localnet
+                  logical  switch  datapath and enters the ingress pipeline of
+                  the logical router datapath.
+
+              3.  Routing decision is taken and NAT rules are applied.
+
+              4.  From the router datapath, packet enters the ingress pipeline
+                  and then egress pipeline  of  the  localnet  logical  switch
+                  datapath  which provides external connectivity. It then goes
+                  out of the integration bridge to the  provider  bridge  (beā€
+                  longing  to  the logical switch which provides external conā€
+                  nectivity) via a localnet port.
+
+       The following happens for the reverse external traffic.
+
+              1.  The gateway chassis receives the packet from a localnet port
+                  of the logical switch which provides external  connectivity.
+                  The  packet then enters the ingress pipeline and then egress
+                  pipeline of the localnet logical switch (which provides  exā€
+                  ternal  connectivity).  The  packet  then enters the ingress
+                  pipeline of the logical router datapath.
+
+              2.  The ingress pipeline of the logical router datapath  applies
+                  the  unNATting  rules.  The  packet  then enters the ingress
+                  pipeline and then egress pipeline  of  the  source  localnet
+                  logical  switch.  Since  the source VM doesnā€™t reside in the
+                  gateway chassis, the packet is sent out via a localnet  port
+                  of the source logical switch.
+
+              3.  The  source  chassis receives the packet via a localnet port
+                  and sends it to the integration bridge.  The  packet  enters
+                  the  ingress pipeline and then egress pipeline of the source
+                  localnet logical switch and finally gets  delivered  to  the
+                  source VM port.
+
+       As  an  alternative  to  reside-on-redirect-chassis, OVN supports VLAN-
+       based redirection. Whereas reside-on-redirect-chassis  centralizes  all
+       router functionality, VLAN-based redirection only changes how OVN rediā€
+       rects  packets to the gateway chassis. By setting options:redirect-type
+       to bridged on a distributed gateway port, OVN redirects packets to  the
+       gateway  chassis  using  the localnet port of the routerā€™s peer logical
+       switch, instead of a tunnel.
+
+       If the logical router doesnā€™t have a distributed gateway port  connectā€
+       ing  to  the localnet logical switch which provides external connectivā€
+       ity, or if it has more than one distributed gateway  ports,  then  this
+       option is ignored by OVN.
+
+       Following happens for bridged redirection:
+
+              1.  On  compute  chassis,  packet passes though logical routerā€™s
+                  ingress pipeline.
+
+              2.  If logical outport is gateway chassis attached  router  port
+                  then  packet  is  "redirected" to gateway chassis using peer
+                  logical switchā€™s localnet port.
+
+              3.  This redirected packet has destination mac  as  router  port
+                  mac (the one to which gateway chassis is attached). Its VLAN
+                  id is that of localnet port (peer logical switch of the logā€
+                  ical router port).
+
+              4.  On  the gateway chassis packet will enter the logical router
+                  pipeline again and this  time  it  will  passthrough  egress
+                  pipeline as well.
+
+              5.  Reverse traffic packet flows stays the same.
+
+       Some guidelines and expections with bridged redirection:
+
+              1.  Since router port mac is destination mac, hence it has to be
+                  ensured  that  physical  network  learns it on ONLY from the
+                  gateway chassis. Which means  that  ovn-chassis-mac-mappings
+                  should be configure on all the compute nodes, so that physiā€
+                  cal network never learn router port mac from compute nodes.
+
+              2.  Since  packet  enters  logical router ingress pipeline twice
+                  (once on compute chassis  and  again  on  gateway  chassis),
+                  hence ttl will be decremented twice.
+
+              3.  Default  redirection  type continues to be overlay. User can
+                  switch the redirect-type  between  bridged  and  overlay  by
+                  changing the value of options:redirect-type
+
+   Life Cycle of a VTEP gateway
+       A  gateway  is  a chassis that forwards traffic between the OVN-managed
+       part of a logical network and a physical VLAN, extending a tunnel-based
+       logical network into a physical network.
+
+       The steps below refer often to details of the  OVN  and  VTEP  database
+       schemas. Please see ovn-sb(5), ovn-nb(5) and vtep(5), respectively, for
+       the full story on these databases.
+
+              1.  A  VTEP  gatewayā€™s  life cycle begins with the administrator
+                  registering the VTEP gateway as a Physical_Switch table  enā€
+                  try  in the VTEP database. The ovn-controller-vtep connected
+                  to this VTEP database, will recognize the new  VTEP  gateway
+                  and  create  a  new  Chassis  table  entry  for  it  in  the
+                  OVN_Southbound database.
+
+              2.  The administrator can then create a new Logical_Switch table
+                  entry, and bind a particular vlan on a VTEP  gatewayā€™s  port
+                  to  any  VTEP  logical switch. Once a VTEP logical switch is
+                  bound to a VTEP gateway, the ovn-controller-vtep will detect
+                  it and add its name to the vtep_logical_switches  column  of
+                  the  Chassis table in the OVN_Southbound database. Note, the
+                  tunnel_key column of VTEP logical switch is  not  filled  at
+                  creation.  The  ovn-controller-vtep will set the column when
+                  the corresponding vtep logical switch is  bound  to  an  OVN
+                  logical network.
+
+              3.  Now, the administrator can use the CMS to add a VTEP logical
+                  switch  to the OVN logical network. To do that, the CMS must
+                  first create a new Logical_Switch_Port table  entry  in  the
+                  OVN_Northbound database. Then, the type column of this entry
+                  must  be  set  to  "vtep". Next, the vtep-logical-switch and
+                  vtep-physical-switch keys in the options column must also be
+                  specified, since multiple VTEP gateways can  attach  to  the
+                  same VTEP logical switch. Next, the addresses column of this
+                  logical  port must be set to "unknown", it will add a priorā€
+                  ity 0 entry  in  "ls_in_l2_lkup"  stage  of  logical  switch
+                  ingress  pipeline.  So,  traffic  with unrecorded mac by OVN
+                  would go through the Logical_Switch_Port  to  physical  netā€
+                  work.
+
+              4.  The  newly  created logical port in the OVN_Northbound dataā€
+                  base and its  configuration  will  be  passed  down  to  the
+                  OVN_Southbound  database  as a new Port_Binding table entry.
+                  The ovn-controller-vtep will recognize the change  and  bind
+                  the  logical port to the corresponding VTEP gateway chassis.
+                  Configuration of binding the same VTEP logical switch  to  a
+                  different  OVN logical networks is not allowed and a warning
+                  will be generated in the log.
+
+              5.  Beside binding to the VTEP  gateway  chassis,  the  ovn-conā€ā€
+                  troller-vtep  will  update the tunnel_key column of the VTEP
+                  logical switch to the corresponding  Datapath_Binding  table
+                  entryā€™s tunnel_key for the bound OVN logical network.
+
+              6.  Next, the ovn-controller-vtep will keep reacting to the conā€
+                  figuration  change in the Port_Binding in the OVN_Northbound
+                  database, and updating the Ucast_Macs_Remote  table  in  the
+                  VTEP  database.  This  allows the VTEP gateway to understand
+                  where to forward the unicast traffic  coming  from  the  exā€
+                  tended external network.
+
+              7.  Eventually,  the VTEP gatewayā€™s life cycle ends when the adā€
+                  ministrator unregisters the VTEP gateway from the VTEP dataā€
+                  base. The ovn-controller-vtep will recognize the  event  and
+                  remove  all  related configurations (Chassis table entry and
+                  port bindings) in the OVN_Southbound database.
+
+              8.  When the ovn-controller-vtep is terminated, all related conā€
+                  figurations in the  OVN_Southbound  database  and  the  VTEP
+                  database  will  be  cleaned, including Chassis table entries
+                  for all registered VTEP gateways and  their  port  bindings,
+                  and  all  Ucast_Macs_Remote  table  entries  and  the  Logiā€ā€
+                  cal_Switch tunnel keys.
+
+   OVN Deployments Interconnection
+       It is not uncommon for an operator to deploy multiple OVN clusters, for
+       two main reasons. Firstly, an operator may prefer  to  deploy  one  OVN
+       cluster for each availability zone, e.g. in different physical regions,
+       to  avoid  single  point of failure. Secondly, there is always an upper
+       limit for a single OVN control plane to scale.
+
+       Although the control planes of the different  availability  zone  (AZ)s
+       are  independent  from each other, the workloads from different AZs may
+       need to communicate across the zones. The OVN  interconnection  feature
+       provides  a  native  way  to  interconnect  different AZs by L3 routing
+       through transit overlay networks between logical routers  of  different
+       AZs.
+
+       A  global OVN Interconnection Northbound database is introduced for the
+       operator (probably through CMS systems) to  configure  transit  logical
+       switches  that  connect  logical  routers from different AZs. A transit
+       switch is similar to a regular logical switch, but it is used  for  inā€
+       terconnection  purpose only. Typically, each transit switch can be used
+       to connect all logical routers that belong to same  tenant  across  all
+       AZs.
+
+       A  dedicated  daemon process ovn-ic, OVN interconnection controller, in
+       each AZ will consume  this  data  and  populate  corresponding  logical
+       switches to their own northbound databases for each AZ, so that logical
+       routers  can  be connected to the transit switch by creating patch port
+       pairs in their northbound databases. Any router ports connected to  the
+       transit  switches  are  considered interconnection ports, which will be
+       exchanged between AZs.
+
+       Physically, when workloads from different AZs communicate, packets need
+       to go through multiple hops: source chassis, source  gateway,  destinaā€
+       tion  gateway  and  destination  chassis.  All these hops are connected
+       through tunnels so that the packets never  leave  overlay  networks.  A
+       distributed gateway port is required to connect the logical router to a
+       transit  switch,  with a gateway chassis specified, so that the traffic
+       can be forwarded through the gateway chassis.
+
+       A global OVN Interconnection Southbound database is introduced for  exā€
+       changing  control  plane  information between the AZs. The data in this
+       database is populated and consumed by the ovn-ic, of each AZ. The  main
+       information in this database includes:
+
+              ā€¢      Datapath bindings for transit switches, which mainly conā€
+                     tains  the tunnel keys generated for each transit switch.
+                     Separate key ranges are reserved for transit switches  so
+                     that  they  will  never conflict with any tunnel keys loā€
+                     cally assigned for datapaths within each AZ.
+
+              ā€¢      Availability zones, which are registered by  ovn-ic  from
+                     each AZ.
+
+              ā€¢      Gateways.  Each  AZ specifies chassises that are supposed
+                     to work as interconnection gateways, and the ovn-ic  will
+                     populate  this  information to the interconnection southā€
+                     bound DB. The ovn-ic from all the other  AZs  will  learn
+                     the gateways and populate to their own southbound DB as a
+                     chassis.
+
+              ā€¢      Port  bindings  for  logical  switch ports created on the
+                     transit switch. Each AZ maintains their logical router to
+                     transit switch connections independently, but ovn-ic  auā€
+                     tomatically  populates  local  port  bindings  on transit
+                     switches to the global interconnection southbound DB, and
+                     learns remote port bindings from other AZs  back  to  its
+                     own  northbound and southbound DBs, so that logical flows
+                     can be produced and then translated to OVS flows locally,
+                     which finally enables data plane communication.
+
+              ā€¢      Routes that are advertised between different AZs. If  enā€
+                     abled, routes are automatically exchanged by ovn-ic. Both
+                     static  routes  and directly connected subnets are adverā€
+                     tised. Options in options column of the  NB_Global  table
+                     of  OVN_NB  database control the behavior of route adverā€
+                     tisement, such as enable/disable the advertising/learning
+                     routes, whether default  routes  are  advertised/learned,
+                     and blacklisted CIDRs. See ovn-nb(5) for more details.
+
+       The  tunnel keys for transit switch datapaths and related port bindings
+       must be agreed across all AZs. This is ensured by generating and  storā€
+       ing  the  keys  in  the global interconnection southbound database. Any
+       ovn-ic from any AZ can allocate the key, but race conditions are solved
+       by enforcing unique index for the column in the database.
+
+       Once each AZā€™s NB and SB databases are populated  with  interconnection
+       switches  and ports, and agreed upon the tunnel keys, data plane commuā€
+       nication between the AZs are established.
+
+       When VXLAN tunneling is enabled in an OVN cluster, due to  the  limited
+       range available for VNIs, Interconnection feature is not supported.
+
+     A day in the life of a packet crossing AZs
+
+              1.  An IP packet is sent out from a VIF on a hypervisor (HV1) of
+                  AZ1, with destination IP belonging to a VIF in AZ2.
+
+              2.  In  HV1ā€™s  OVS  flow tables, the packet goes through logical
+                  switch and logical router pipelines, and in a logical router
+                  pipeline, the routing stage finds out the next hop  for  the
+                  destination  IP,  which  belongs  to a remote logical router
+                  port in AZ2, and the output port, which is  a  chassis-rediā€
+                  rect  port  located  on  an  interconnection gateway (GW1 in
+                  AZ1), so HV1 sends the packet to GW1 through tunnel.
+
+              3.  On GW1, it continues with the logical router pipe  line  and
+                  switches  to  the transit switchā€™s pipeline through the peer
+                  port of the chassis redirect port. In the  transit  switchā€™s
+                  pipeline  it outputs to the remote logical port which is loā€
+                  cated on a gateway (GW2) in AZ2, so the GW1 sends the packet
+                  to GW2 in tunnel.
+
+              4.  On GW2, it continues with the transit  switch  pipeline  and
+                  switches  to  the  logical  router pipeline through the peer
+                  port, which is a chassis redirect port that  is  located  on
+                  GW2. The logical router pipeline then forwards the packet to
+                  relevant  logical  pipelines according to the destination IP
+                  address, and figures out the MAC and location of the  destiā€
+                  nation VIF port - a hypervisor (HV2). The GW2 then sends the
+                  packet to HV2 in tunnel.
+
+              5.  On HV2, the packet is delivered to the final destination VIF
+                  port  by  the  logical switch egress pipeline, just the same
+                  way as for intra-AZ communications.
+
+   Native OVN services for external logical ports
+       To support OVN native services (like DHCP/IPv6 RA/DNS  lookup)  to  the
+       cloud  resources  which  are  external,  OVN  supports external logical
+       ports.
+
+       Below are some of the use cases where external ports can be used.
+
+              ā€¢      VMs connected to SR-IOV nics - Traffic from these VMs  by
+                     passes  the  kernel stack and local ovn-controller do not
+                     bind these ports and cannot serve the native services.
+
+              ā€¢      When CMS supports provisioning baremetal servers.
+
+       OVN will provide the native services if CMS has done the below configuā€
+       ration in the OVN Northbound Database.
+
+              ā€¢      A row is created in Logical_Switch_Port, configuring  the
+                     addresses column and setting the type to external.
+
+              ā€¢      ha_chassis_group column is configured.
+
+              ā€¢      The  HA chassis which belongs to the HA chassis group has
+                     the ovn-bridge-mappings configured and has proper L2 conā€
+                     nectivity so that it can receive the DHCP and  other  reā€
+                     lated request packets from these external resources.
+
+              ā€¢      The Logical_Switch of this port has a localnet port.
+
+              ā€¢      Native  OVN  services are enabled by configuring the DHCP
+                     and other options like the way it is done for the  normal
+                     logical ports.
+
+       It is recommended to use the same HA chassis group for all the external
+       ports of a logical switch. Otherwise, the physical switch might see MAC
+       flap  issue when different chassis provide the native services. For exā€
+       ample when supporting native DHCPv4 service, DHCPv4 server mac (configā€
+       ured in options:server_mac column in  table  DHCP_Options)  originating
+       from  different  ports can cause MAC flap issue. The MAC of the logical
+       router IP(s) can also flap if the same HA chassis group is not set  for
+       all the external ports of a logical switch.
+
+SECURITY
+   Role-Based Access Controls for the Southbound DB
+       In  order  to provide additional security against the possibility of an
+       OVN chassis becoming compromised in such a way as to allow rogue  softā€
+       ware  to  make arbitrary modifications to the southbound database state
+       and thus disrupt the  OVN  network,  role-based  access  controls  (see
+       ovsdb-server(1) for additional details) are provided for the southbound
+       database.
+
+       The  implementation  of  role-based access controls (RBAC) requires the
+       addition of two tables to an OVSDB schema: the RBAC_Role  table,  which
+       is  indexed  by  role name and maps the the names of the various tables
+       that may be modifiable for a given role to individual rows in a permisā€
+       sions table containing detailed permission information for  that  role,
+       and  the  permission table itself which consists of rows containing the
+       following information:
+
+              Table Name
+                     The name of the associated table. This column exists priā€
+                     marily as an aid for humans reading the contents of  this
+                     table.
+
+              Auth Criteria
+                     A set of strings containing the names of columns (or colā€
+                     umn:key pairs for columns containing string:string maps).
+                     The contents of at least one of the columns or column:key
+                     values in a row to be modified, inserted, or deleted must
+                     be equal to the ID of the client attempting to act on the
+                     row  in order for the authorization check to pass. If the
+                     authorization criteria is empty,  authorization  checking
+                     is  disabled and all clients for the role will be treated
+                     as authorized.
+
+              Insert/Delete
+                     Row insertion/deletion permission; boolean value indicatā€
+                     ing whether insertion and deletion of rows is allowed for
+                     the associated table. If true, insertion and deletion  of
+                     rows is allowed for authorized clients.
+
+              Updatable Columns
+                     A  set of strings containing the names of columns or colā€
+                     umn:key pairs that may be updated or  mutated  by  authoā€
+                     rized  clients. Modifications to columns within a row are
+                     only permitted  when  the  authorization  check  for  the
+                     client passes and all columns to be modified are included
+                     in this set of modifiable columns.
+
+       RBAC  configuration  for  the  OVN southbound database is maintained by
+       ovn-northd. With RBAC enabled, modifications are only permitted for the
+       Chassis, Encap, Port_Binding,  and  MAC_Binding  tables,  and  are  reā€
+       stricted as follows:
+
+              Chassis
+                     Authorization: client ID must match the chassis name.
+
+                     Insert/Delete:  authorized row insertion and deletion are
+                     permitted.
+
+                     Update: The columns  nb_cfg,  external_ids,  encaps,  and
+                     vtep_logical_switches may be modified when authorized.
+
+              Encap  Authorization: client ID must match the chassis name.
+
+                     Insert/Delete: row insertion and row deletion are permitā€
+                     ted.
+
+                     Update:  The  columns  type, options, and ip can be modiā€
+                     fied.
+
+              Port_Binding
+                     Authorization: disabled (all clients are  considered  auā€
+                     thorized.  A  future enhancement may add columns (or keys
+                     to external_ids) in order to control  which  chassis  are
+                     allowed to bind each port.
+
+                     Insert/Delete:  row  insertion/deletion are not permitted
+                     (ovn-northd maintains rows in this table.
+
+                     Update: Only modifications to the chassis column are perā€
+                     mitted.
+
+              MAC_Binding
+                     Authorization: disabled (all clients are considered to be
+                     authorized).
+
+                     Insert/Delete: row insertion/deletion are permitted.
+
+                     Update: The columns logical_port, ip, mac,  and  datapath
+                     may be modified by ovn-controller.
+
+              IGMP_Group
+                     Authorization: disabled (all clients are considered to be
+                     authorized).
+
+                     Insert/Delete: row insertion/deletion are permitted.
+
+                     Update: The columns address, chassis, datapath, and ports
+                     may be modified by ovn-controller.
+
+       Enabling RBAC for ovn-controller connections to the southbound database
+       requires the following steps:
+
+              1.  Creating SSL certificates for each chassis with the certifiā€
+                  cate  CN  field  set to the chassis name (e.g. for a chassis
+                  with  external-ids:system-id=chassis-1,  via   the   command
+                  "ovs-pki -u req+sign chassis-1 switch").
+
+              2.  Configuring  each  ovn-controller to use SSL when connecting
+                  to the southbound database (e.g. via "ovs-vsctl set  open  .
+                  external-ids:ovn-remote=ssl:x.x.x.x:6642").
+
+              3.  Configuring  a southbound database SSL remote with "ovn-conā€
+                  troller"   role   (e.g.   via   "ovn-sbctl    set-connection
+                  role=ovn-controller pssl:6642").
+
+   Encrypt Tunnel Traffic with IPsec
+       OVN  tunnel  traffic  goes through physical routers and switches. These
+       physical devices could be untrusted  (devices  in  public  network)  or
+       might  be  compromised.  Enabling  encryption to the tunnel traffic can
+       prevent the traffic data from being monitored and manipulated.
+
+       The tunnel traffic is encrypted with IPsec. The CMS sets the ipsec colā€
+       umn in the northbound NB_Global table to enable or disable IPsec encryā€
+       tion. If ipsec is true, all OVN tunnels will be encrypted. If ipsec  is
+       false, no OVN tunnels will be encrypted.
+
+       When  CMS  updates  the ipsec column in the northbound NB_Global table,
+       ovn-northd copies the value to  the  ipsec  column  in  the  southbound
+       SB_Global table. ovn-controller in each chassis monitors the southbound
+       database  and sets the options of the OVS tunnel interface accordingly.
+       OVS tunnel interface options are  monitored  by  the  ovs-monitor-ipsec
+       daemon which configures IKE daemon to set up IPsec connections.
+
+       Chassis  authenticates each other by using certificate. The authenticaā€
+       tion succeeds if the other end in tunnel presents a certificate  signed
+       by  a  trusted CA and the common name (CN) matches the expected chassis
+       name. The SSL certificates used in role-based  access  controls  (RBAC)
+       can  be used in IPsec. Or use ovs-pki to create different certificates.
+       The certificate is required to be x.509 version 3, and  with  CN  field
+       and subjectAltName field being set to the chassis name.
+
+       The CA certificate, chassis certificate and private key are required to
+       be  installed  in  each  chassis  before  enabling  IPsec.  Please  see
+       ovs-vswitchd.conf.db(5) for setting up CA based IPsec authentication.
+
+DESIGN DECISIONS
+   Tunnel Encapsulations
+       In general, OVN annotates logical network packets that  it  sends  from
+       one  hypervisor to another with the following three pieces of metadata,
+       which are encoded in an encapsulation-specific fashion:
+
+              ā€¢      24-bit logical datapath identifier, from  the  tunnel_key
+                     column in the OVN Southbound Datapath_Binding table.
+
+              ā€¢      15-bit  logical ingress port identifier. ID 0 is reserved
+                     for internal use within OVN. IDs 1 through 32767,  incluā€
+                     sive,  may  be  assigned  to  logical ports (see the tunā€ā€
+                     nel_key column in the OVN Southbound Port_Binding table).
+
+              ā€¢      16-bit logical egress  port  identifier.  IDs  0  through
+                     32767 have the same meaning as for logical ingress ports.
+                     IDs  32768  through  65535, inclusive, may be assigned to
+                     logical multicast groups (see the  tunnel_key  column  in
+                     the OVN Southbound Multicast_Group table).
+
+       When  VXLAN  is  enabled  on  any hypervisor in a cluster, datapath and
+       egress port identifier ranges are reduced to 12-bits. This is done  beā€
+       cause only STT and Geneve provide the large space for metadata (over 32
+       bits per packet). To accommodate for VXLAN, 24 bits available are split
+       as follows:
+
+              ā€¢      12-bit logical datapath identifier, derived from the tunā€ā€
+                     nel_key column in the OVN Southbound Datapath_Binding taā€
+                     ble.
+
+              ā€¢      12-bit logical egress port identifier. IDs 0 through 2047
+                     are used for unicast output ports. IDs 2048 through 4095,
+                     inclusive,  may  be  assigned to logical multicast groups
+                     (see the tunnel_key column in the OVN  Southbound  Multiā€ā€
+                     cast_Group  table).  For  multicast  group tunnel keys, a
+                     special mapping scheme is used  to  internally  transform
+                     from  internal  OVN  16-bit  keys to 12-bit values before
+                     sending packets through a VXLAN  tunnel,  and  back  from
+                     12-bit  tunnel keys to 16-bit values when receiving packā€
+                     ets from a VXLAN tunnel.
+
+              ā€¢      No logical ingress port identifier.
+
+       The limited space available for metadata when VXLAN tunnels are enabled
+       in a cluster put the following  functional  limitations  onto  features
+       available to users:
+
+              ā€¢      The maximum number of networks is reduced to 4096.
+
+              ā€¢      The  maximum  number  of  ports per network is reduced to
+                     2048.
+
+              ā€¢      ACLs matching against logical  ingress  port  identifiers
+                     are not supported.
+
+              ā€¢      OVN interconnection feature is not supported.
+
+       In  addition  to  functional limitations described above, the following
+       should be considered before enabling it in your cluster:
+
+              ā€¢      STT and Geneve use randomized UDP  or  TCP  source  ports
+                     that  allows  efficient distribution among multiple paths
+                     in environments that use ECMP in their underlay.
+
+              ā€¢      NICs are available to offload STT and  Geneve  encapsulaā€
+                     tion and decapsulation.
+
+       Due to its flexibility, the preferred encapsulation between hypervisors
+       is Geneve. For Geneve encapsulation, OVN transmits the logical datapath
+       identifier  in  the  Geneve  VNI. OVN transmits the logical ingress and
+       logical egress ports in a TLV with  class  0x0102,  type  0x80,  and  a
+       32-bit value encoded as follows, from MSB to LSB:
+
+         1       15          16
+       +---+------------+-----------+
+       |rsv|ingress port|egress port|
+       +---+------------+-----------+
+         0
+
+
+       Environments  whose  NICs lack Geneve offload may prefer STT encapsulaā€
+       tion for performance reasons. For STT encapsulation,  OVN  encodes  all
+       three  pieces  of  logical metadata in the STT 64-bit tunnel ID as folā€
+       lows, from MSB to LSB:
+
+           9          15          16         24
+       +--------+------------+-----------+--------+
+       |reserved|ingress port|egress port|datapath|
+       +--------+------------+-----------+--------+
+           0
+
+
+       For connecting to gateways, in addition to Geneve and STT, OVN supports
+       VXLAN, because only  VXLAN  support  is  common  on  top-of-rack  (ToR)
+       switches. Currently, gateways have a feature set that matches the capaā€
+       bilities  as  defined by the VTEP schema, so fewer bits of metadata are
+       necessary. In the future, gateways that do not  support  encapsulations
+       with  large  amounts of metadata may continue to have a reduced feature
+       set.
+
+OVN 23.06.3                    OVN Architecture            ovn-architecture(7)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.pdf b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b2ee057081c774f2f243448d05bb8a8e64accabf GIT binary patch literal 135979 zcma%>L$qiymu`=3+qUkpZQHhO+txj{ZQHhO+jzHX)T_?lsaBGejO@;CteN?d$_tCq zGSaa?k&a%)6+n@aO4z#E85uZR*x7Ot*c&*T)0;UF(8|*i&>AZVh>9rw8-?s_{%u$o zT3A~+dq|tOnppGvyMTb!;eXD_%E=3;D2e<#DJY;UBu+ra{ zyT#eWk$_&*+Q8XF*u==r*o2oC%E{T$#J~p1J*!)D(s6SPb^DUKjyavkfMw3zq;ySo zM5*N}T3J@5NEsHSMLb#p0F2)v`P!O1H_>mZy|wec!B`DVVqGOwBJcCXC(CQb#>c^1 zj-B_L@fU5Bd3QbAhXeVm+~|igb|$xGhV^Ml#o^_lG`Od&gKLows~CZBT_Zu%nH%V!nlX#C8;&g+5K{Z)=TB7)D@L1ho0!X zVwtbTHyAR5k?^UTVM6h{4WiC8bQynU3!AN7g9G1OhY*=wVoI0S@AG`XBUi2TOJ7D4 zho)aJ$mMsDdHB9{wg}$P6;ika78PjL(|M`0F(%rOX>vW7vDd+Y_lkyyenPNu;ggNo zXcQKBH_7+FTKMkS-y*(tJX+-_26J*~p&qVxPR&AG_C)1{(|zFCKr zd4S^Spbsq?-Rg47>)5$))@T+VpApEDkS&XjcVdU1YGIK4ji63^$_rCb`Rr1cUvQ&TMm ztLnO%J`!P?71aVmS9{G@&}suY$? z$+rlVPj2XnCy1@7wH!8Iz5p#^+WY3*z5;+I>^=*BHHuDeYDEeH{gQ3VMTh3z14_Ks zT$!Z<3r|#z_~yeq7$|%|;|iW^W(}OfHC;zAbvIfx7uWRsGE~3eEl`n!E%i64J)$S~ zf(Typ?HKC()gun1I;%s$X2+;@hmd)4_ny#KxGkkr4r^`_OE(pl8_s)4Rhx-%LV`W6Q0yC>dKqq z(@>62fsD}4bD8KUx;M!dNra+wt)xT%lnIcF4|v=mSQ;W2cDGipv~jc2Qi@>NzA<57 zvP|UcwyC_UM;PV+(O#RE*F|)DHk1mk$Q8+>s0so<>l;ep)g-ec4i;53Y++;a>Nnl}j*N?zVHCIa@cHpkn_SfIq>d7*+%;1kncORi&kAof6yX_%(jFTm20e znk4`GL4L6{0==|{FN-~f1t;3yR**?FFjF)>nm)M1B7QRrjz4@twsE|+WeKq3W2PmX zpGn$&A?+ys24r-LWu2{L3&t*w$jnJTMUo2NlEe!@?-8fL(qJkQR z670tan0EZZnB6tYR49+@^kx2BPNf(Qry0wj;3a6Kp9~4kYi2nI&f6auIHDmU_;ZfK zj?Z!Dl5I{>9+`idjQozUYpUMPr8#Se@>;^vL#^#)E`oh*!@DJ^ae!wF0oX<y_om98;9%>d^d#ihkz!2mo1ui~_dojZp91_&7q- zR!ZKY3EdvBzSk7>-|#1G2ecr0FvGGvLs2*pLj@M{gGb@LmOtEOEv){eMlOLuMwu^6 zIaw1ge!ZT>%6=kRdR%9zseg%FKUM#%gV{#; zBWHlA1H=A|wLmQV8DC1>RsG8l?)|zoG#Cm$FH1I_Vv==zQz_)Lu`pyRPut`GqFm>= zvn>Og31{)9oknwjJ|ycIz*km>?Uo~c7O>BcvaNPYe@YL|8q8MNe4aCgt!kyNMzEM> zDPua0?0C&mJ;oqoU5@whARbf8o^1RJ3q|ZUk>jB<=~7XMLv$JFe$}pEd~e`IQ<+%g ztk=3dZK>cyaKza)Ah#!Cp+pzS;#brn6_c-`CtKtaUiY%+7o6M<>}K5|iW+aZ_e&n{ zOY4uKq>1a)c+=#V-y2h(%+{GGdA6?MDZ=7 zSm98TF*!4NIvu^XB%xRghNQcw*#DEjC;CA^l#wG%wS)OLgOJXg8YMt^fvr`43-L0bdi?Cx@B-;uheU7~T)p+Nr(ytR%dzlM*`c~j~LH;w!{VvMA%CUKFhnj z5-{@gQ2};-LadU>Z5ZYqz@`{=GYMX5iR+d?b`}+nWOwgTIk+14rB1c5h@g$@oGU=r z*qooJJ`ynq=QVC=7CkaLX9Ah2h}KR+VcM3K_#Ls;-DL;+y>f*2HfX6MJ!z(kKqxk0HX_QBt_3DuiVKpVY%X;nvIQ;r9gO*9O(hOMMA?ULq;<> zZoeauop)PqT`&=L5{hcJ^RYd8M-nmk_IowM-e^(IC-zjv^60hJzu%T-nx16!gwpFX ze}GdY(hCYF<`G>D^-onjiA14za0^*vhXxpO#-2*S5%bVpH-w;xbz6_orsGeuwHw3B z6p|wN*)|p3tmmS@aHViB(5$G3)@RhqY#+$M4D7@^2M~bo9`n%|g^3#|d~z_ylwFz` z#kGErb(uHPODUFsCJL;>Rid3T95NA&=RS-qhv(UY1unR<0PQ=*4t|N=evkuJf8r>h zgT}LlU}|FDi7RQb`2ksQ`YD@(s1F-`wx6xIyV@)@lo<1tv-Ns>Opwgu?xLxJ)5Gv~ zE)qa07Fbj}_hI11j=hH)5P%M`GqQI}B@M+iUFD2{Rp@@X5-g zJQ}b|a6R}I92}{f#k1g~_-?ObM`?Xv8-xoJ0y{Twh!=*WLbZB&Z~=&FIeVt_bGqkb z7+Eplb!Y7a%&w_$XMeY1D2~X5M+cnN!wX6pMI%P9O)$)YeHo&eTTEg_?U#fT70916 zQUt0?GH||F+WVlotw9=idQ)Iy^DH;usq06B;@1x96!}EFxtYSzI2leUrZ`V}?+CUo z^6%kd!4ULikT0S9h9gAMsD~eR)Hm`SBA+2Qciq1K z04y&rz{+IvdP{aDY>FAQC?V%JlQH$E^s2F|_;z-c15-lxbapG$=O_HiUGsL5rZ;!# zM=w4#5TqLy&ZS8@%X}d<^uLcWndSr&AS5)k4-)%1ULwd`ntAHXK8yJZC1;-Q@$bN6 z>G@o+pSO9L`y%%{?O2+c+)k#)$%uV?RK%#nW=Py$4~B3))5dhKIa@+bd|A^&DB)g_ z>}xV6KCoy_LQddlE6i=N9Rh(7 z(l_lh#r##OC|&~BfKX-Bz_%s;$b&*cJCKl3c{e5%TDco`50pkH8G>UM0JFFXlmq62 zbERc?%-kg2zc2jN9m%s4b5IF^dkS#mBUnlM+vAGr`BY@e$rDv4q>=M_$%UxIF1Rob z=AL3IC=lZ0%f3dGrGK>s+#oIoc*bUVKpwz_Z9A;}z+vH#qyUjWvqtdk2{PUtijZlj zKvYAqOACEgsYiyMwp43q(bg$SM2wGyp4Q()mXzQ4FeX!|3?Xh}X2kw_kAVr%?AT>EeKUo8Az1pHqkGaCm3)c@2N{}YrM z|8JzMA?36=hS+ndHYKB99i9yi27G06O`;;P-hf=`U9ZF_9xFUV!VjFMUa>&CIxTna zC;i&RkSD&bRa50tCk({%{q}KLJE{jEgPH%f`rWyuEAQxbe;k-07x8JVOLF~vb+W4ul0&UTI6)LdZmWte!CcGv1ywEnm3eGI zxSclX@`Oe|poO34IX7vrI~^=ZnWRx*_S^N2-6qe84k8mm1O3T385VV9RKPnk zhTSyDltOhpQ*g5Rx_acYd{r6ac22?9QDLwT1ODYfaZy zG(NqN3BY&6fy}vDsO1`y5#{ONfX(MuxW9_mG(-IzCKBf?!18L=BJ}#If#|#m?piPo{aV=Y0VOl=k zg4MTlv7o+JKA=Xx05&|Sqd$IZ5UtKH+x}aCw=!Y|;a2V@B=>@0z8xRwf2vkww|{9# z@XW9JC)s6Y-Xs{`H#>rfR;ng3 zt#)q}Y7X?YIlkPDGjF4r+z8G>JDf$SbYpRJ$=e1^$=NX{643`A8S=?~)77{*tYYV> zJRE`#4_aJ1aX@zn&&*a97kz>grhr1E3MKv0= zoMuE55I4tF`DmAaf|8t)1rZi^rg5NP&qxu#HctubEGP%2np!24pv24}0QEtg)xj~d zH1K$*2ZTjVs^|_`i|8bStOhYFjaoGpj%wAVvXAdjG8HYhB7%4^7yShWW3<|NW`q4l!WWG_oJ@cR7Rc(FOS#~Kt2x*N{> z+-*elwT-L7lWk5aEE)iJXgaY_Zj$N^&N9tHYYzMG#ur=y5a0@v%~+>%4R4;Gplng@ zAj|{|)?fg}R8Hj8LuJDp#;fZmrI5yn(>;@AxR@mgXKZtW(E-{!+W($N7{`NgwtS@% zB$P5Nje&t+Z1DA>yw4$K!3YX> zl1pRYg?}~$rug7))KnqCLQ9eLTOU*ems&-GYk(!S_q(H&7sn*g+{{W^<1RM3B9~gK zMbq=z9tP8oLLNm2dOH6j<)*yM64mpS&Okv{r2{VG+!*X#z^&diST~HU^ z>`Y3}7H_ysh~R)&m1VVs!f|@9-4l1p6m_E0U5@r#f`_LM>eu(&HSbxhW-An+VpdUG zSIDXUehDUri;W@zt!rwXhYYUXqlFR|yIe1mvS+lqK2Q39ujAvJ%j(agGG68fAa5!J zTK6Wjqoy#oQ*NRuWeRB2}ykjw4NsON@OJzGtlm=H^H!~Pw6nvQ$*4MNxeWc=?x;zXxj$dJmziO#WXo0a{*;1 znNt(aF1bH-Ur;`^H9Uj)9{3ql!`Zld3*HMM9y&WZnb^z9)Dk2Wt(hi$6Kc8kN*1I4 zl%5I;y-B|+8yNS{U~D12H|etc>hf!xi8|0a*sy)o+SZMmF|J>QR^jbR73he$9P~Vn zoLhXv7W9g*5 z?v#l$mvC=3es|g34b7FKPK8Q*xh7g!XMZ#;%jS3Q)ebFs?9PV$@^GdIsVp#8?CXVw zSrHZAoZm=m2Xj*4T)ed%DqLbJ1U4LJvO>w$;m={x?1>TbYkn z+84iQwx%(#_$rP*UJWsO9kWzC7CrFMtF~7+Qk1i-iT$#?P`HE^;?J#>)PH&ViZhn>z6InEYEH3UXHSZ;j?T)#b(W6Y}Cc(@pM*#|) z@Te-pgB34)q_2s2B9gc;FjkbD&5+*INfl=k^(lHgTC20Vm0Bk<1oX8#?c>M+#+k0s z$cgpjQKF+O-0>Wz59ajAIJ9(~2P#{pMlQDG9s2UjTiZLAQChBjNd0B2vXnP+H3jj} zDfCwYc(6QuYiAsJ6FTnpMmY}`W3IeAP(uH9Txs7qCb7;wic2HtIMHolLA;D>tts zxkgGqKcD0%^?E@^QWO>ZYWO`F6%oHd@1;rqp{)Ns5_`DztRE;{c|W-99eL~bY-ONl zL~=rsl2{oPk>{gX{q+~wYfpwsAVbPgw?h|bp1}HoP>Z-TDltb|hkyJ&qs@71y$Nif zeyFiaB`P6|GM18>m_||MqYs1^_%e{#Ip~lcVTrxg&Hs7& z#(v-cw!tFQXkLCpzbHd5>^#FH_Oe*`6{7avmb8z zdC%QJX4M?P*MDM9+TnHY(5z9$2<=Z|wHY=!TT$Hb)APys@yPV~Ma@5on%&zeU&l%P z8Bg~s>>WqfKE<;&Clbwt@ZP6Z%ryvsZ+qlf{=u2(36<-&f?q!Es_7`<#fcp0vRg4r z@QEk2{WeHoe_tR-k|- z*zg|rv7WmjjY?+K#J-B|N)~(M)8m;eFq7-6&nHQzhMa*A4k7DVxedgx#C4A;p)?cN z#%ZjnqJ9|6Us(eoLZ~+j{gAPl z>-i`9Za+t^+NV3BlTq^&Q5G1IDG%m)t!%V`_FQepYs%w_D*oEab!0ZV>|Rr9+(JKW zU%IsxZL+!e^^%*cA{k}sQ|iYxW51%J?e>JCkDbr$rY+NQnAm7F-FfEkPjnwm#~2x1 z=l9S*Uh!8HaM3G0rAzji%I=4ffz2SEWzM|h&eE~L{R z$K1eNgOpr|`z}bq5YbM=4G(7!IHJJ)Ryf?)x?zgkuC54))mPdT4U-fDCp->svgo>s z1jP~%t?|)`BuR;0spNA3ufe8#XdVXPD!)a$l3Oy#Fm}rBN=ihGi!nAUUFz_CILpZ~h!WNPw>%+PDV53$#dtE`U1TDAd_h?h>`o{;N-Vh# zf*Kj~t|&30RSV0=P5O>(Wn>D+12N6dg4R&)3`UVqecO-pQ zfLMA@1-&x&@}5%hKxb+ zIygx%vVrAnBfuFWQT8fJ&)I2IUsm{_I9g$bTtJO)5)vz}%I3q+aL*ifZkEcWb4#`h zDE0;WN^PUM@5dP|QD8o6vV~yQ8i9XV;!JhTB+ND1j~H2zDhwv?vL8eg6Fb}s{s!y_ zm_(300+dL>>QdFrf*cVQq(##uy?5!v77A4Ak5&ZJ5wMU|(QpNJqh%P2&d= z{$NJ=?~rZemHf|S-#^s42x278cO2ssAJ*dL?3zQ6(j+sq)ryOaE*@D6SYi<+?ut_0 zY$W|FW(UTZH_7WU4RAy2N(Kf%#dXI~k&ZMA5Wkhz-}_{uBpv89ky$e}iJV7_W-Y4e zURL%nusrBd|1+o~|2ztd18{Y2NnyvWm~lH!LSeeCq0pU$q)>wldN)sh7AxHiN3On zGPW^bn@xzO-yA7Y;3|5~QC1c*hSbff z`~Bq*AO3k{@2gHbI8s1*EHDv10M5rE17kuWW~g+WdHPi)0o~^BpSV8yoz=o{3%R8u zr9TNbG=Vi+0x$2}$<;t3kMa8hY>?k(Z?T!QU=8}+mBe|6m z6}V9p<88o)R9wxU9oVERlEHcMin|X$Pf&$|bY$E`_PV(f2bdNDK9u$FkF~ zwDY6}$WECsB(Aiym?^$I)id;EfH}ehcgd>^Hv~>2kqRiCu)8`t2*LhO@Py&%0)cel zQR4if!**09;B_+q(`;)tR?2}JaY(#X8Jeb~qa9S89rcbw%4-Ou@^q}Ztbf8C+-US6 z)bSweIZ{;&*zYwZnY+T^$*Ugfc31Wq;>|zjK_QCxd`}aUVn*4^U)$rp? zR#CNdV$kGFA+tkSB9TvfUzj9d@J5>3ZL)Q5I1Z9Wbf>gwW!Pi)j0Wl+Oj|IF|KyF7 zaf5H&>1L|K*ihsSaeJfLvAY{?Zk8-3!NMfwc#|ZA163{dYy*$jR_6u(JaJdZ)ec}$ zENfm;Y1Lx9lSDH-Br!4Xr@_o=z=CE%6ax5a!45F{fAO35{dHwZY$zAs<^GbD>6$LUzu;Or*nfPGG0Veoo+zWpb#F2BhF-8e=E%F|H>9#ymAeMZZXQ zs=&x~z>-RWcG-&2N*0DC>Rai1Neq)YoaM-(R3?sPF2;9XYn0+9CmPO4%A7MaOUyd^ zJu;*pB&5apW#TDV9FMpde=lcIs*M2QxlV&%K|Jg?s@$|>Qx1mVKIF0imqE#o|h4fy|!y0~m#FCrn++A4t1C4oh@#h$fwrg#iDH!w! z0}eelqaEksB+m7UOL~J}8xdKkBZ5<@uR(MMP?ldgWQgDqBzB89`2F{;J)5pEC55$L ztI17=YMu#!(Mk3tC@K$DH@5Le!q_3?3Z2%}Fh^t^2KtK|J9<<0z|UOv*w6$epwvep zob}ehMyRW!P%1wg3!dlN7s+j;Ew8{)Ay@U>wuKMhi3JU?Ut#eRgOyemT=V&c5<8nL z!&to?mw9ux4ZldH?ENyMq+OH<*IHT{H^v0% zb=`~pVky!OTc&m#cY$>pAM4J8a5i*Ukf0_Hr5u2{xOL+3zd+1vSX-=!9KJ;_Wuc6S%?kw1i6lvYip@ zn;m`m?qX0*m&j3jxh7Vl4JTv}?=Sh9F*V!Ih+5Mrr$|sRNfKVhQVl(o32%%;ab)OO zDvO%WNVZy6q4kP>XC+4YExloQFlsv};C}1n-qj_#1sW#eP6xDZ)UvqX*YPMQV{R1I+?0G5+XxE#sg&Z6d?ek@qu=tZr=^R9cbFRT9 zF32p(`d#nO=@<*@vR5HQKPBU@FX$?f$C1SZe}VFCK7701puNArOJ7$={)4Xmo0|Sx zEHE>1{4ZVor&wV6KZ%8A&2h)05yb9CYJ2RaprO1vAwy)%~6*kvD$?puV*nF)hm(17Hfol;)E~(VHx_%A3rqk)mnnfvwjI2xx-+C^Q1*aThGL{^te2k^ ze66AN784sAt=n^2gRI#4qXaGsEdQQdjr0xVJW8!21l zILyu22phJ#=(tiNht-J}$V?F?pn@vnzlyLXzmZx&RZ_cM5A<4qB$ZqseAX9*#h;9g zy7Em0BPnEhUi7zIO@{d3diaNp-5Z?+18}}nUxMU2RFfV~L}kmjd9DujT;WyrT&w3P zO9tOP5EEZ{v@C(#+YGs6r@z|4tu!NUIU(kFcBAc&`2J=`MpRK#LfuGGV~5i0rh4B$(i+Ds<)bh){kB+*hE*@O zzOL~U%ijzA1)+2^%ATjjY5GpLtFCIT@%?&wu}t~^!5i>>?G8z*?d|^PY@V%%CGyc4 z$Z>AF^@u&qZ8#0_G%kun9a0w3TX|hkQW4s2*)(zSse7mi#*u`9D)8aqo#WstgZZ3` zcnc9Czr*!=5WuQyfY)JFwlUgvQMs45>{L*lx*j1@(!y956i(O@K3<k`srg9RnG(bByOAfU}Ae!aU<6|d?=$>Sp|Lm>-T3MZVA zfo`o%phM7f$JR2X=DJ*7G`y)m#j--o&V3%L<65U*ZO5ytDYA^%vPYjaANMD4sl)dd z_fvm&+!!r9lp&%-CwS|)o@!#IBg|&SRZzTDZ-nQx99%v|CKyZ>qY}brdYMT3eW|1Q z)g=QEs^bA~6s}rvd2K!lc!HgEeRsoqOMsw#cr$;y@qLL43!<{i?^Au7F9~J#(^hxA zU=9)4HrpAx{P*DF4Zg;W6Rc<444nu>aTA(PZF6M zqGxU!jnkDJHMUjb#TcLF5VALTOlJiq>-PL_sbzSQDoHS7cZ7^+eH^zS^#x!JjXt5O zDzJDo@DWVFkD&^HI(tW>JT15nZ1R)IE@(;8U$RUz6ZB~kX?O7m?WI3Xa4)0t~ z!0~X)W!Na3AGQP$Esja{@=QmS$$?%KVW26*k?@JS0!4vCK5EUu!Ck}yCKA)+#?DFw zlJr9J(O<)NuUP;RUPKOx|@cu~fv z`I^&JfJK0(8p}=^Lx|gDRZZirLQP{)iS2ghq+nw`+jf)zj^lP8NGms}Jfept1*;+r zP`odV+|rEsHe4&9Z{u~QmP#H_#`Sy$xc&z`?L^?shMykxwNGJbM4_Q2{O3`M=M~#O=F)qZeH;R z(D)h{zxP)n<_OuECiDQNISuY27}CpEQRmBxEksxw8DA-PPl+ScCo~ewnrqwPNP`p@ z!$>RS%;v6NnNDim6_wx2AVh&d(G;}M5xixhmI_BOyM!}u zqHIzOELbi!Gp0FCnUBfG<9Ww3s;}CR@iRv^`!_?pY^>1y-;z3$MIC8JsSC7|;PP-H zMHa5{Q;U$nY13YRT1lIkshLV?T*%8OYT+qnL7(xEAKR!eRgq2Uz?Ex|_bu%2-zh%F z>rDYrxaODg37cg8P@ocqQM>}U1tuV&732n4GXNq5=QW_9@BOLheVEe$w`c;O{L3C^ zAVz+NcHQ#I`Py0kc{-~5(P^(A=ta~e>(E+o3n@9e6t}ane|=JkO57=Kv<*nbwzc-E zp~82&QSjA4|Ck`abN@^N0W{i=H1AWm2fBt_IMpdunGF*~$Lk=o@KH0GS`8)KtsFEq z!8_TTuBb^wcq4hDn1{AyiPzjglp>O*E27|AFZM71A@U@bTBmUw$sgo0N)=^V+fgx; zaYB4`+ zPa5YN*@ZtdvT)t@HgJ(Uu3;s%q8YTdc^Q_2s|kFUOkLqgHM4aUr!61`T{^PdM*gmJ@Tm}Nky!evImT=1Wa$55kaE7er!!B2sV<;`(8tOC}A zVJc;zMjR`92Vwvuf7s(l50aVW0}}UBdqx~C1W;XhIrTgU)CbB{pr%PDsrOfSdl|Bx zqD2OJvuEajm){&dCTgBl%$uW+O{Q0jU)Im5i7$epscRK6C!IHK0|a3>@MUQ`Zd?MT-QVr1rQWPWIcv#w26^DlAXZ;dgC+t4n;6SLn0y9$dV zlWn?ED66Ju?LVu-#TpgM?BId2huEnb3sf==-up7KCp66!o`sNe&r=BG>Le;i8~d5~ zmEg-?<=R>+wb&oP;a?4B&WX8$?Ee8`Y0^JWXD*&rL#EORqkB~*lbU^GO;TK1t}X6P zpnQFv=sZBg_7Wg6gB46d=F1LT(a#lVek07mlVVJbBRGBZ2G=)KvbReoO2??eC!(gj z${bX&bRY9*HwWh3_LXx&;Rv%xB~az49WpjPiXyb3v8vDn@t>o(%;ag(l6W$daD6UvrQ{PJHB7 zjkP>|8OL65NGB9)0&wlvWB-iqK`-w1;;doRos?!2bB9K2h!}Ax= zFc+cw@FhXiOEhw769jvmP!VxB_|!m%L1rNdeAfu~aN%$GzVrv>DxQB1Q0bJS_1U`H zR>7p?MMPM7Z6)8aT-tZ2s3i)I`s`63xUW`)t=eT_^^|h{Ag9eUuZZ}d$X-~A+R=ly zZiLbuYFKkZNI2M%JrljC_T(%C5^Bu%qJ{;HLPvOc&uinK2q6ln0o+rjBF$1YcSQ3E zqMgi?iv^{uBQQm@4RUL6tIcS-aT67I1fQ#fY(U}4)nhP)Dj~-UbB8CRyE1Gc>Xy^P zJ<;lv7P80()zLT7voIF^WzPv|U}D5*Pn*I7Ue)3#?i(Pi>{VaK71^O=Z`yECH&6fa zniO7eL&8P#>tTKl5_c=9Ky(fgN8Ma{nw(~*=XW1Wr-4!4`NJnveWBJjBlnj*FTlp~ zm!)+R+XcM%MNZ+^hxXvF1Kx_Sb(L6AATxQqhL-j|ER(t*$ zS_G~*wzrqdi`>^I{l`57@qdE(|0e!882&f$$Heg;+LM{#|E4`d1X>nA@sVC=N z-|vpFUUvfo55n)l->O%&{8#(uNtGhr=O_H+A2Gh)wuhaC4uwQ;kD6Dg<<{F> z_g%H^`VGva8Mss+}R;;g-#NpqU&y#tnwrfLXK}p>YuihY&DPD-dEA} zKg2(tWfyXl5OKngtm$3lrMG&1r`I20Ej6w?Z%eYzD_l>5&et+p=iNN|F{5r@_xRln z5+D`@aA;yg;*vJ=i^g(j^T;RAOySvjHm;6OBd&g1DoM(d)IoQenBe&l!{F*K!&EZg z3fC>N1w`RQcDRtuv$Nk0XC&Rpd$=32MFIEUV-@{HmEohbTch(35hG7|Vu}&kpv@R$LyRF9uv54O*3VBE@})C-zxA9#Qv(eCr{0EyB2M9vIDSN!u_bEEFS9dG7*Iu1XBOye>es;z>a5sAn z*=>$m3PeDWXeOk)@HchA371A?f>@wK0?h9`QNs-4QR@BpD0Az#+j+P(hTGg?tI?5( z#ulF*+V91i*k2vkn!QM-Zi;B^NQ!A=9oZ{hR|-h{NgCOh$U5PFh~^CND)|rfqGTqV zyqQ!0%nR4@E>ZJZD@iD#SY#1hIJjGk_}uY*zGk`a%0n*4CP8SLrB~S=4khbFOY3JK zrA@aP26w(gVg>?8G#;94F0Z3U6>lleb&SPza7BkvW8C7p;WtsQ45VEgJsUi7eUd0%)+r;eVCEI%7eE|ZD7JSxxYdN2$;P1F zD!B=NV#gdZ`vi4OOCDUHVrK{4SqJ?-bqx^CB3R%iI8Jw?r5+$@o5`No30%45VZskO z4}F8)2v|@G5`G*5wnq8qd3%cjRbF+%fP@L$e|dDV&yvb5x$f5g_>V@AL%DO)z^oJy z%wQZE@ibu%m2W&nZG;hFkCZcLkaECA()g$XeqUPhnqZ)?!kQz?-UdXC^x%_YtTpNU z$)Z8B+u6<>W_C3I{FvDa2Hh?yzT+Y{09BO>h9y+#QW11VARP~YgWIs}8;@C4R%$L6 z^|*G2o60AyqUO0*Ou+19ws|G)a#6r@5s9azK0!SiWqcD$ic5`Qx!xRDdQNR1({w0hNT!3oEnGNyrKjHdY~ zgGO+s6l^>V0ce1nfid```)hG8hc_676)UUq zk_fJW1m)MMuHGj>7ve?gdX0!|mWqY@kN-6R;yIzrXxHC!8n}u_8eAW&$V4A^-vx@e zC5i6UqN8}i<_fQ&-`Pg+z&UIZ;n#6*j~Kk#O44V}x19CRB~mU~4gKZ{ab~f~hDQ-h zTIqsS#|vK(Yiab3epR1RkkdOYQm?0+$vLm1B8mtHPa^ya|Mr%_XTey7l@vB91G@j!}FGBi)7Eg^CI1wbP zhTSGi&8qwvuMq)0{T`d7d{4 zt=sK(BHEgcj*<_kZRxru+x%x~Ax~s-NVOed8Xe0|*b8`)#E^sfdze3ftHhFkvkG-H zUf1^4!<9(Vee(tPwXBEeY1O-cT_T8EZcBTfp=60AA+J0}Q!cMc;C-Ix=^Oe>{bDv8 z=GsH~7Yk^iUB)tN%2>AuvpOs4<(WHVY+fj&I9nQNYKg1}k{Y1sL<44iT>OI{Ue$Td zTt4H-EW(%@iad5nJ~e`+3x6pVok=c66cuFWDd{WHGBNWbTII8g zl(xUn!qz|G9DTOE2jn`#>_9mPywrA@q_$yy;g3lWPzx8YeRbn_O&kW9$UTjD5fjQy zf=6c#Cj<{8f#Ou82bFmFskqWU9D&^5;jQHiGhk&)74^ctqQ9`PWX%7Mv2*Cs1n9DL z+ICjjwr$%sDs9`gjY{iHyVAC8+xD&QUbiRTr2jw+Vi2+RKKt1xowYqp5V1WO*=`5J z7V0b#T#4#gx0na3!NojD39D6p~=uajL|CLD3Ch#$GsoZLEYyDVv1f}HBrX7 zr^k_;#O$zqB$=FQVMkLP5NUJ;G~v$l9-T*bpfhFrQCbRqoGd{liu)bi*Acch*CzZ~~aYI8~(oDIuv(d`cF!|6_<$O+Jt@k&6TT)a*j zDG|c))1p?k$sgFpz52%b=_+E$RD7)@bFCZ%cwyfw$#%K3X`KLMfdi&>p&em(3VRt)9@jn)7nK`faKP0uJSsb}3-C|KaH>eW%CxM2wb(=y;z?pr=CD3R8=zQ9wjg#==>zzrqf4Ldr9n`COj~ zdF_Z?m|RTQ`-W8m({xn4GDiKPwoV4jvALYiNF-sEV#-$#I}2-Y8r9b z+Sr$)VyqGKC>fvVa4!B;*iGbIW32~X96Ao z@%L1x4n8zJg{D-so#YfYg{KGmit{m>sPGBO8eaI#AgJhyiYvEF6mY1y=geD zf515}0lX=8?0h;)^hpsg+EuSNMZR1i2F6e96*j}PKI$*98RiM9mBO*TTp>~O^*-io zNN`>e?+&*iy8g>;-RwP~jlCvs^!fn077YR>kQ@woUw>OxT*z0Qu(A2FnQNJT!uU+? zHbN2m<@*Bb2Jv4@cQx%N(NAVX>+OSe!wWj@zwk3lEl@$cTjUKaI3z&yH?Gxxed=af$KS+@Tm6qNZsO7+AEaW{4yC&GOaUtGs zMNa9b6_g+Y>`jIEJ(Sp$RGHou=R8OW$UYu!peVHSqf$}LqfYNa0fk3H3Z$}%9sU(E zsmHXQXZkeRY9O$%t`!mwxDn8m;J?R_%1_?9>OcEk;lZcyUUACyozc5eEbO^dRU6A; zPxvWHkixPUeX7#G&a9!d&O-`zS&bo}fpa43E}h@|3sLFB_ymrG_iIbf1139BQLF|E7p8kLAM{-8^oX62sSSj7CfR2HCX@RC)CqP8MA->Tp9 z{1_QByBJw|Vo}SVsp!5~>2OsAZtdA@XZ%F5Ovs{k?LPjU72@G&@-aUlF712VztXOK z;x_rMew8`jaCH&QEYrp@9X8AwoqFmQ(i*mHQkId=mSF(bE?|WO$QnC|Mm{Z3{7M;< zIAks-Fpt5#pLW62Z4|_;4fCq<=cLeR@>PAU2>LR(0elDgf5S7`e}?~uK>u&y{oj*w zF2?`OC9|;nr$A@@zX|j$r%g_`?iH2Y>B~wxdguVKOrDwPMRS#38`##ls-DVBOL7%l z*W})kEofIPmsN*&4|t!*rZV_E^5d9kq9~j_J8#p#e!r!18bZF;ep*MWLbeRP{8G<* zm_K%&NB!E`*JpJ&HmU@^{+#wrZKb|ZnnkgYk#%zEi){^@A9K(Ky^L!{G$eTZIZ$Re|tZ_2vf)75JL&Bl3Cz4LXfTI4?`1Zg|$6iME~Hwc#o&*QXN0oVhCCBV zr?teHk^=JX+KO{qG*HfuN*+eOS>J;7sWw*<%rksBEECKf)4WH9I2K?mb0|u5+VRgb zc_7#k?}UeykFTFbsCCITe=O^ODUhI&RYd7yw>qw#HycYsOXUy;)NUO@4O;Rw$cPzG zwN&HD(aznfy+foX&doPh_;9jv-AIR~J&PeRlM7+lx+VxBAk*iQNpgF~xc zi9``rR4TvgKznM3-|M}!vBF2F8769Vgu!HPIY~Zuy8o)9dq`sR7wL5Bls4$oxN5e8 zZ^BK@)+&egqEG?}CZW5Cu}PA=+63lu-IF4hI6Dx#4vMQ84A4BqZMpI-Sfr0>qSJ2| zN?}<@LU0uxV*X>mQIruTX3l%XDa)yRZbhH``3&G>RdW&47KGbM^{_z24=XtK4PyG} zL``A6K_SWKmRo@jH+q&J>IhBqw9LlGMB?jzh>;AFqjl!SX2SMVv*KHkq=^W5dowp?UH0S8e(Dmt8Md07EzU z5gp%+QY#DkBQP_bIT4mCx}Ce0vj%Q8bZi)5XJ=_a(rKHWzBv7@vdq8xVaN^`U9`Ra z5|Q!t=k6DW0WYNx&ty+nhx`@>D&;q zV71H&GDM@wPg4o^@unmIudlv~6x zK#HO-v*IqEQzkUE&A8>CP+k2-(GL0C)nk6#S` z=I3MFS#e1WO?#A!*Tugl9~l-usXtt*{Nh5P(S_32s^pPQ_fzVoKuE*zAt!w&yrVY8 zw#I^bnw&FMAG|&Ca5{t~k>++(X$#d92srgYN`1m6L68Nlk6NmqtPo0RB}y@*KmsFl zAjaS>fsgeo!VQEjybvnvlU0IqUKE?TpKBIO4rXwgeB9cEygdSo)b3A=!;SxEprr}I zF5$@drIM{ssl3`oKX{mr<#ckyEW*9Qns2@}Xv`DXE)S@4l zDalG+o5e3=F#I&$e`bLkk_l$wU>V;a9PnVV*>$GVf?e|#Wtp4%d6t`QMx`|-%G*#tTbw2u~Cazg%S%l5n7_>fhP_$ zcL|4IKCH`E2yVb{#v4|%W}$Kc3CB{^C~tg5<zr$U%^z7 zqrU+@%bk*pms4+1GXpMG9Gc zgN6kL!6Ed=bKzo@Bhm6MB3?)=Z~>oLI#@HpU?b14U_GDrPft-aO zao3y&u%V@RFnr<4B#1{GlngWr1g|#W>!RN{Emw>Q1R;IotbJisyvL|x{+IpI8D9H# zMSp&5!m!ABW%52?n1?VO!uPBG(bK)x5ttp7_Vejgnv`W~U-Kbnf-ZB9t7R}bAW%iv zYe59o*mVY%>{K>p)Nmrrz#yZH=#(92n!7S$APiAxPhTgfF%Sf2a3k6!wB7t+!o^v} z5n;G#U4S*LEG?K+db5B^|L-@xDmNbL*XTTI1|{H>Uszt%)bvmx3*1I z+eZ~=N0U!Jnwff9h!6<@m7Ompue`G4ac#W?yza;VKZqfvn^v6s&{r7D1!VOwi_A4z zNL~5_E1)9&@-f4WGDlRFC%`uy&gs0s+ZKKgVn2tn*8IWdopV+e<B6$wOA7oqiT9H)Ud@g-}|`Ik9eltC2MtoV?3~ zQJ7j0wos@mP3(f@{7-1d(Ze*Z{b?3R!rg%a9_zHBm(}G%N_ujitn=E69lq&)3M zP=*8AuOdOzk|w=SGZDdlP>i|Muwv)GL`y8&H#sv&_ae?mUHLB2A7dCD{;H&fBdHe?t z7dO^f`Sz!3h!|M9Z6(lNM&gL;X>;aT8*At7u`?fzDGUj}-wAhChBrH>?#kTAB_w*- z6#OWh&4G{i7dRN24Wxs|LbS6MpCfPFhSHe^zeQC0>6#FV>_GHzR7<5Stg&!C0x|k# ze&xcpytZ?U4#c5L%k+$wn~(Eqv-?0(+A=O25z^1I`2_L{n$r86n3BtsXG?4IGk{1! zd*nsH{$LkK|NHB`;D0%*1beyLJ+0!Q#49|cR!k+^E%*5G8Q23r2ks;vmy13baWzTDDU&OIrFKNe0%kc<^R-%dX=c%ORyicueLRA=e zax>@@Ha$Rw8Zxy<*NZ_Pm1-0bf?9nK{LXbC)risY(%ULMhY?XxT7v?yUGHrBlz5hwMz4x zxRWKmp%=n@Ue_eWY6x?ulM=jmn@i8&I;c-mJog<=;%-4$qZ`jopT&5CndUBMktwzk z3eHNxIMjwCZ}7-9S&*}!eW@e2$vANlYC{6tCU~EwB1dEEUyPI(2V`wKLdULa_!`by z`hJr5GNNWITY=-XmN=Mu4P6jCq!EY41l9b`ahV)(+aid_|;is zU{ynA^>n=1wx%ef`H%6zC0-?G4p!m|?I(OX@B`DL>E~3<=eGqiSa>_I=jLh0GpCis z>G$${_G8$gXNm}Tv+sfE*ls!b8f~tH?1*v##u(kVj65FMCbHg?WJTCkT!0+$;0Idwecl@VW@n0syf0-4mOdRb0KjzQE@tE8jB^kYUhyBkxNVlZp;aPFa>rqw5`r9kSzdxD&@Z*>K_yN z8TjBMZBhc1s&Q(^fXuw>g)#+>SC;5@L#D5K|5~@-Oq~KBZ?dQP%pWUOBi-#>I`b+V zRgJX(C+)U34|9DK+H_h46t_m6=#H7_?EE_DJeqc8v&7xV>?f^7`l`G%i}aKIYvlP*kKH!{s&diPkrUgy;=TXB}_xR`QY6$&{l*fzE<6!^23}BhRcDyg0vo1dL4e9@l_mlZE zmn7Td{O?}E{l8rAC=SvsXJjRg_O%(OxjNhIYII;xF;6l}Mp0V^w_v@f_N05<7V1-9 znkhXkMF>3sE1l1+A0h^gm1dYxTMI>={ix`$7yDM#BDhd}sK_#%uZnZp<6>ItL#z+c z@n0@=`&9jxjLujWe$Rgv37M)+4j#29lQ+A_J;f0Rj^(Dl@4wh^&K>LOF_$4Td->aW z%mvu>czn9nRR?BQC30IEl19w-92T2w1_50ymkKNk%0Nt0Tfrhc*y*=zl)2d*ew&-F z;cmXBN=c6BozVvWoE2qnmdHTwGbUhdF~_GjaD{lR1m zBl}^N)Eq{QTUyt`3OBajJI&R#;e5KP`7FZO* zMbN6%x>}9cv4LHvR}ReUh?)+_ZT!lSqATS*YA(+{LGSqBHN6Eu_H*7AaoB*ShIO)? zR3EtJ%Dcv`E;__DftIUj0Gcj&X7oY#FL*AwGLn)I+D*`B!P_$Mserc3*+y43b@wGj z7BGvYX1a1&fd;WnWaDTCZQJ3%W>@EU%nzY(km8kZC9JgG!0}{ghBDzh;QHP|lO80o zMcdZi`5bOGX62h<;<=$+5mtP|GdIHzt0&9AlxQ)K?a;tq=I|K85;~VP7lrNi$kokz z@Z8eWSjk;E9B3L+Zb2L%{UFuRO*yjcx)u)p(>9~ne>!eDOW?Z>nbD`!>e~-0hjC25 zO1GKx5L)7+Y4^%`iTBsNDiyLqcDg|!8Tv?#r62ko6_apoyV{uqo&IJ)ag|tFFccoQpH6stE5OhfA0A8l25zLjIb{Of|=FNpbbYNV#!bi@H%Q1D8z#50(;2~|l_A10% zDz)(vN+uJtl;0HlQx=DN^z5ydo1dI6(>g2J*h@k&esMXv?~k6`t$PWTw4elHZSHq+ zG;$cZX}ylSJL806Mwy+{tNK>1x~E4B|7#_@rWt_D>9P&0x4*_vH9yOOgh`Ns&l!8T zXG?S>pCV~Qr0XZK1ICW>3DD4B1S;EJ+L+Eu#4bCOlxvOO9rwE5;|*~P%gXS;;<2|6 zkAn~AtM8pml~D`mOqM#wvNz^akoQRba3-f~PoZS=5McQ;L|*k!L`p9$b1-5*X5DX2 zOAXeki>4XxT*BZ#=vu%e1-@yI*TqzPEl;n6vcC%KZL2^!Q}(x*BNsKKer!;ABjNm@ znddlMnA7aLYtb)xK+Fanf(pFkF9)kK^*dOii=|p6jR{ zAjTSidLT0O-8+rq1h|540hIPhwYVeDb{smQsuMF=DIm<2Z(1yVTv0m5CNwufL@`U)*I=Xbk9?QGzC4)C7|b(Zo?PDeypci#B|Y^$~r#JR7M zvwW$ucXMc%D8F(-oxj1&DSr}xt{UU8q)Srt$@~EdFM~=7K~5@-0mbtvC)*g~2%Yve z5nO?4Z;M6S8hz8$tDbrM*wmt0_+<)(_b2m^@gD7eQm$wcCDGrdvscwC0)8|P-ZdThuAcQy#x5Qj2A%Q*hbQ;5S8@k zNZDdbqO=z9 zX|9aiA=QKQHn3?1j-#!OIvAkYDa)P%F)ht;d$|P4&SVs^jzgujhul@K7yyG@#`3?~ zm~6KPU+961ye_)NiCt7tilCJkUQ~SgB@k4cd9kVH@!o>h5;M`MuB^OggTBh+B7|>$ zS4u{OIEudZ<*Ub*o?^SMr4NMTJVF7*?y>SkYiHq0Dr%79iBDDmP5@fbDP!wC~%taUQQovx7# zZrjzDZ;B~TLEU`68?m3%-5uMcrYg%Kv>Cd&P+O^eGAyip@#RzOs_hQ(0ls5|&o&Uh z7v|Ne3n3Wm+wzMuEC7lGhRKBzEN#cZ!#3stDnvTU>9S`V*()RLJQnpM#HeSWC?l7_ zp7}hDlpoJSXj!*{wD$@5{(5^p`tQ4(Whj@L%pI-R6lDT=&vG!VdUBTG>B+qdUQ^8+qa z$DocpcNJlwJ^vB~%UTpv)IECpdoXG`J1>4>8==I!Vr;HKFk?EmKcwG481I+wE_oO& z)z#ke5(2!NXCuw#hg$jztY*W=`4T9$SGT(t*z*_<3GN*ozBbvAp15SJHuIxmte|%l zLZwwpz}4LV=SxZMfd9PCYAZSj?KymIl46E!`+Ff%ddf0OM);5HoMvYXj>zA=Na(SC zm!74q76{Epptd=j9ifSH&muc#y0`u9f6Ta1*7Yb2U!WZy(i($NAT9q82utoUn?Nq* z@8BV;CUox|wt{kT?=tR~Ex<1vK3+H3;>r|Xrki9bzA&YtYHqmgmuG5mDiJVK zKVznsFBh@R^3uQ*+V?b4gtS(mTn8>ldY5(Sv;AG=%tFEA&7^^2J2 zACp;`^RHKSEbw=HmtR6zVkAZV(i=?lYnBHkR?p2`hWRqyP z0o=mwkx>{fo|xh_8wz0p`tL$(3z?=;bk?4x!zzx_3xm7t{snS3aTc;5vfm{elwEoj zuJwSC$~A=2vJ^rd>`9N`2-CsRG(e~WiWq$6SURsa0t_T*?-{RRx8=LuMPYHdwvBSZ z@{@8F#hF={l7jgSdst#%Z%Z~+o#q=c@hq^5vJnsd@)*Ut#{N{)!<~RKWJF}=3xSLG zy<7XI_s#DHaRjZCSGCiohMu~)W^>^-RWpbwEwCnrSce6+jFwtSr}(KjeiFGwy8R%E zTI}kej-!gP*_@6>sbkJ-zaB}rqlB&XO8f8UG?;OKbvE*?qk*hb!G&w{p)16i&`!`H zVdC=dsDimHw=&YZuPe_0!h^-tw-q0)YilHVdq~xmWF+2+rMYxTVJ*Ix3Ev$TKKVgc zmE6C|2J`4}e6uC-_WV7cydQ&jzk8UGNgKX~fm~QEG^-(}Vie0kDx>LyX2=<)7?-YU zgEDO&<>fypNFQnCML}R=oswk7zvHst?t=Lg~^J{yvE3_kJ0yqfmr_EX$*yP$RM?d%-B8n$;8#&b@9Pb7!X#d8QfeAv9f(t_Mn zFvg|I?#3P+lb2(PMaMg&q7gjMrc`*gZF?I)pLKiTsQR{F&s@Tf0iW2qEp>3#wQ#+dO)QH| zJr7Abjfo(`77a5p=YQ!p6zOQ&XUVGj;p8Ctx^k!3sJQy-)R^CDqeYSiY? zB6OE^vY%+F_Ew+vK%q{(-$hiEgO{$H_|}h(<(6tNN;c?Jl*w}dhA@Mrw;1D;wjA3i zU9D4dq&#PXQFN`g^Lkc%uI9;?CnU2l-DtXGWR@7YuJW6SlhbMNLoBsC7s}QRbV$5y z#x8R#=NHK)PEqpG%YH{!$Sxm7>^k$4&EbLSYemXfV`Z{6KEYM%O-HY$tOtnQ{r5=z&xL|4k^fQV1fQ9 zXI-Z_>p#vl>sF1Rt*1EZb;)5kiQ|f5(`#blac67BbC^7zlHOeLvo%_CFLn7^V^*m; zo>y7wMA|jCZ?Bq;7~)ZgI17cdXMOpZOv5>BB#UExck`><+c#wG)_Hdl<=9O_=C>Ny zFl5yv*^+$MeTkHWA<#u7LTsu)N7bS_T12VSSWG@HVmeAhVm4L7Y8X~tg{F~*z- zKu}pN>uRorz|t2(p6kV`X{V9lUiOlA>6n84F)QEBl>gL9;0Ktp7{5ZjA*a6qQLh~W5>bc4UAJIS(o@| zPhqJf$xxE<{oSuk!sqxF7*J)oXFecx^%l25^Uerq%?S4Q!Jq_+g{_OIqshXG5(r)p zyM0KcDxy-OUor3r;?&?{nvGlTbx^1&b79b^n zhF5msU{Oi2fyQ@94+%Z^A^qcg9!mxwQs}`&Q`qH^=#j=NwJV1#{w z3x=+tKGB%PRC=;Q#pS%Fz;DmcUT{XIFY@m~MV&oBRPFCHmIeDUs3MOB`rIx^$B{a0 zN$(lsp>Y!mf-XKLf=y0DzHPY)M&A+&vIekAZX^R8cn>(&%WAgB)b#21+am^OTlJYe z0^ppjeTyRqvfoJra|bIEAO%so2$sJ_*r;5TH65G6l5vo(q=-mId*9Tk9@D^@+f05O zvX&it7mAEhkBd`{q@gIK|F}Ta@scgSx`L((o}jIy_2kk}!se9)7wlK+6HI3(p`*f~ zD+7IwtT3So8XSwPSp--#l$blW)=qXKP~Y$2T8a~FcUKC%UWb&dQueC^vMn`A9oz~+ z^N+KZ3oS<#jlMtpeYr%Y$V@>nVG;2_hHe^2#l!IIZ7Sy`ZH3BQZWQN56q`-zdR|r= zJMClwM>3ov#a01IVd@O9=YMxHY+5cEdyqgNC{?P=V^OHqC5tle{cC#8k}84_35i1r zwyYNq6+I?bAI6bTuxKY%mOS3u1TZ+6@ZZ2fyO`sD+rtN*YB_XA=a zIb2kU93s{4^4F-j;;V4Smu8cA`!5vMI>R0EM)<4(k2+;1RHr=sfs*(F!XyW;P?(Mj zWRtkwD66SmcC*H2QW9w!C@f_lGR-t9hB2`$G%%XcN3tVb2Sn7CQ@IR-JW;rSAlC0_ zLz*BMpE?Q1?oBmKQV!KJ5wYonJiS!J4d#7rfFH;o#~2PX0Z!lzG;$|d6tU%raN{}C zIok#NLVY@KQot&3AnIeZce(zo^hTy+FyckRX{x+stK?xsHRNu~r3h@Twl1koilV0h zcZGDlvZ8-3l`6SJf?r`tQ6dWQHG;gXC@AbNFPv|(EXsgS=(9kIcw2(AsrW(FZE&+T z*qte)%ehTO5yRi*0krFTEvkPbWg*0>c*x#qZp^6POtZlJt0$5n`U{hyO?C-IR(++p za)xH=egRX>04(~RU26hYdetBbPn~6g)yoNyYDzG$pd$`Os<*0~Pa zb_hzHm{Jsng`Awm>cOB)vKdHG#MJe8ApCH9!jP%#bGVdgE;(pn;u29Z7`6y>MaxzFWtIZ>E@e~2S z8Kl=9HPy$F2B;}3=JKSETTw9e_BS`MAW0Z>Xv}0tkQcDb&Mp?fu(JaRk< zpVBjIH_$NgNc^e|8mI|Ka*m=oR+r9BHUK@_&4ZA8Y}V82FBvY?YKGUcVn3@YFAmur z(8Lam_iYCVFd%1yybGZn8f0d1x@Oq80242Tumm`WZML$7Q}t(PYFp$R9V7+2z2UP< z0JQ(MclrW$oGk&f2?G^-{qwfp-qVpFW8rgt6=vTg?i8+nacUMJvQHR*Z9ITKd9!ri zTL(W+LfA1FX{0dAF_oQBY)#`Kx|&)_#w5W z#Id%HTIdnl6P41EJA*KQ@1v0|8o7hj33_o7%sgs!`5v@Q-3DTKVgTK$?^nzst?Bb- zq?66sM^w%Q^g6?Dq@FO!Z3b?KP+zD)sDXC+;mkk^>LwFfO7Tf#!h!A=Nc1BHbspuHX$d{|#y@YhW0r7j$Wh1=n5 zuQ)`CaQZn2YPz>Q!)WQs$|_Sjd~G|gC)mF>cOjBEoxv>|A&Z-vC*O@#awU3CJedP| z8jry8?Re9vMxm<2nPv!z`)*37-z(E>Sxbs(9&i~MOW8O#!OlO<*SidS=Ov9!+e-(* z)%x40`55%w0CB=^4UxA;l|9XBA-=mTa52GcyHHguf#l?W!Y8pQHQD3T?90D!U*ldR59chI@=PqPEyM{QV^m4z6?RGhRlSGo%$X?Lc6O`k{MPbxR{Kk8Y!N*e#eGN z(D9MxdWm%AT)cw3<1mK_uBO(FA1eiZn$`*nBWLSBp*Tg-r^0@|S^J_}o}br8~jO;Ua_1 zSNt8boYwPtZ<6el;h!mywO6MwIhq67^jVQ56qq6mdys(R=w_9`W7-szo@k(NW`tw{ zI6M@#G}Fm$6tmUqbnY$E4so-t(x!Dtl24()#4+mIbsSFe12nw@(2IDy{2XgC?Ew_3{fc3&aI0!e;3y2uuRy`|`csTD|)D6w%N z4og&UJ^IPxA#gVL+WP$^l9;UfBkJfP!nIfT0s7%cE(fyc@r^hduI==ixFr;TQFX5P zg!l|~w#tHedgv90Cu6hO!PUYy?-4~Oo_8^dzCFVDqUnHvIea{CpGVw?^O_#^o_^(J z57*S~akEf&~KY9i9VfoW{^l-lY)`WkYBWqj#p=M$VfWf%-uf|w5Wi~9hpaqzUP>ee~KUmu*nLO1PD zDKER-_~~&$q3@%TN41xMQkRC^0>k?!~A;hppP!~Ok+~|!{}GAIb12e`V$Q=txR4x;*>aq>yGQKNaH@0 zUk3geS%pEQ=j#S(IKs2L6St+x1T9L*M$+DdM@?=&=U<#^Z1+xYoPPM=;>apP-qDUe z!4YH?_1Bpef}nc9`Z>Uo>57^~T+Hj&rJ=(ENzO!a5JczOfbA;)cG!<0IF`3b6Z~^D ziPmRx!tPgX@SWyOkdJ6TJvQZ}ju7st(>rw%oqxC04pw7O5GoikVy)b;EIPdh z1Rxv5^Af&vQ|544=Q>k&fi!f(a-T!BNk{rGX_^q-qBpN+0azPB>K%G>l*eKzP@R&Y zemrl)rUP!z)F8vxxec2hWD>lZWrPmQfUbsHC-~^FO55)+*O#sShEf~~EnE7~3s;AA zHq9-4^<0p3G8gDRBguQ1jyfjP*-$$A=sJ6y0}n(M&q0;Ff@D)+kuq4*5>H#YaprL? z{#vf-B_21iZ2h<`oU3_O3RI}_P|)+mshqxE_v7DG9AR`;TycFn-d;2(N@=MjY!uV1 zNeV?l>q7N#yeoMkIM2_b;DMmO(LS|eN4YY1>sxXTlZG%SUknNOhro%~GMEj+kDpAD zf3x5AJ{KI1^%nOES5Ndyw+E1L94QdJaK3+!HEgb;O8h&F-1wsl!A*`sk6|GrSVY=B zdjDc~SHuW^LWnqc$2lG0eT^HR$($qnSfvRYe?yK@UT&kKtNQjQGy)hm38!s8Juv2M3wKsd!{x_V}P}nvw$fzyfOnyWUv12`G_)IwX`yLLjO2~qow^y zQvF_n7Cf28B!l&%IoQ8&2ig=u?P>yjN3Wu#v?er)b;=sW&>rOL(y1$#{RTx{`5tr} zy8>-Y%{LOhJ!!SFjxAEbPpt^o8D;~Wy?AlhG=i&>;X7eQzhTAh$4TBziuv z)R2q%SCEusn!E%$2d#@D&%i zo572S!MH@8NF88(_4ZX2M74;6FdOI`{U0yytMVc8hVlppA%O{{_1zrfnZsI5nBa{p zap?SztAr3G6cETx2$*~JOW(8Oqantn>dhF?4bpqYju9e;qzk(8+l|3wlv5 z)r&{4PY4mYcn!sZ0ZjN=M%?sKsiG8^9LjcFU$8#Fc^iPySKg`q%3*wY)O{qsq*!5M zpTI8<0>jU!SGUS61Odbmz``YGfboVzESq>orR+2{VF?5BZrxhrv$KbYW!z!r8jv)# z&TB_@(ADgX8YdR4ZLSCgbqH@WSVO8b7xVLjG^XOC&`gSPK=)|RfuhTjfHU|R*zOMYBWBfZh(QrI)&e1akfOVPAeh& zT5$@rET)oJrQ0!GCqvABRl$v&RF20>q+~_P#NYUNG`@;g7`Jj2)f#I~!$8(^vRBLb zXjqe>lTb#yUb7M#>glgr1$5889pc|EyXb)Lbp2qdX8SHAGFQ~C7T}YL0)_fh)EH^Q z9%9d{*exutd1dIt&2b+J|H5mK=Sb%4o*C37&u}QF@*xs(J6BJKnI-c0c;M0VvS){C zmuid{J3~UxElyb)?`;J<4$kCoK zD)L!SG%Ah6XYx9a5cca4K%hpR)s)U#ymBlW52%-jQ~7hT%GQHVG}NanX^uLF8c~{^ zwWC*a?&X^E&L-Kr;o1n?=OIL#fRL6b`Tds1iJ>YNCp;R%-Eiq37R7q7Z)UJG(Q6`@ zz7e#cI7YuN^lu?*#T#qGU=E2S->fsdSNKy#KxM9*iJ*f;ykPD_K6w{wx2S!kNzrDR zK3hA|W7bs%S7o)9r{&K-6Xxx{&G!Q`ji5u2$;TG8RYYRFrA8qf2pP5D8|uMlCz zWDC@YZXbF#+p z-)0%I!pycSlvVR#RJ4&(>U6qs(5)iJpL-1xII1v1itRMAnDK1jDtPCB)$2w{rk;8B z@M~WYj%gvRO*Pb0>mkX8aGG<&H)^8YZNT_YnGtDVYQDc20p(ehHAbIvSQTi7Ov^ap zO1GJB#5n89#Rf0@IxA_V`~6QloJVw{F}{XvM4|ZQ0HG}lacs!H6+t}V!h5ssIH^js zCH$bN@n3hFluIDxXtm&!4<6E6;x9G*C`^W#TodDi=JISgOcQ?(=S_1gBb<3^;Z^*=yqL8DqI#waNg1 zVsA+t!i)lM#g!Z%fB%ipS?D3LhcqJRrWdG1s1dBI+McZ<-LGY{Dib-U^X z-6}2_EGmf#=>fg?CR&9OBR?y`E5bV0R9d!m*7@i9-V*dZJw-l6RVg+>eI z@yFTu_%aYBLv?PYXIcLHMV}#K0_gBKY9G?J1v>zgi4Wo7Q8Z7?(lk(xMVp=S6)iz_ z?VHcz7AM+%lv(GY?=qf zR`I*^-4}ozs*_5+QR@?crcPt$VrjW=PuoVS83#D{o@vsI5hIr|ERAALGyQ#lmAyt_ z?V-OQ`ZdH79(X`(p-D?0t+cu=X@o&EM6~t9Y#PZ;|D@>BRn_ff59( z!KDYy33>QURV*v8Fdtt6FZvR6lbJuRS~LaBb{vxKXzDTU=Ylu0w};be z4nlWTwkM$tiB3P-t5)&Eo{yJnx;n7-Z*8A02=Cd=cd)~>PY0(f0tOT=O2s^Tbw?c z_C?`05L=}VxY=^-U zL^5u<)Tijd_OJ2IAkYdy^SxgsYtbiN!X^n)&p%GA=wxG;manE-OZWIE%i-MP$D1bC z-;0_OsteR)33AY?UE49tZo0~BiLxS`E)^w#fpgbPJlQHwY9NA^d8*tznFeM8OKJJJw|Vc2Z9j{ZE;T1sO;UM#k=7gs!_TOwY3by6$Ht<8@dMO!Sj^=y=s5wqr& zV>KseO7#$yQiI#M_nnP99ax!Om>ies z20)W5s>pfH%{n=4J?Q;XM<2o!nYYTGaa!4)l%X4UmQ#))#f-!|*=-l@oKyRQMm10F zRDjj}CRmTBsrq^g^5N^e>qohw@2#@(YR{^Utvti+uC@ zDRc0=NGfaE84{&;MmayKU6`j?P4mQ3CLsidK?U{u_wl*k-AUd*zgEtFcRK$MsK?CA z#_<0p@XY@W)MNQy0`)dxH$?yM*24U7Xwh)cH=rSfiW6;%==azSp`WL)NOk1jW zNU`V~-(X(DPg~jhFlkA~Dik{Wt~ya?WulBP z=_!>aNkOg0xmm<_!zR03NQTeFbY&O-7k-Nf*|#rgwG#cO=Zi~vv>8faS4<+eV#Fhy z#i`1->;9U@p;sT@Tn7(E53*a0p!e%Bx0@dq(D?#vy3LuY8a>tpm?iBGxnJ99~10PS*tYnk=+#X*Us3eR&{`EP=2xPJU-whUwYKeT=6)448I8NTMdJobvp z(7EtV-?4B!hTt`s1tK=xYim?6nQx{;?NtdxaqYlhoX6ypDOPvX6#Rz|3{{xSmY$r^ zaJ#G40MZe8Cu-9s=w&aQ>RQ!l<=l?LK7n+zN@(ay_Txr8FCqD5euP!5-sgwC2(|S`=*gnMf z0+)}Ajso(TNeQ2XhnOM*wjDjeX1r5KORPmc#^a7{4|5v^$3Xc-P1|* z@ZK$OPlk87<(&()S(>6hwTNQtIx&my@@%(>pw$2T#d>qdFDHQiVrMb7=Z@Y3Jr;U+ z+cs;($pDDYu{6jUa!sP}MNb8Q9Muci{c5U#o)vSM8W-%SH4txc%;!hju<3+sR*U5{ z9KBS#PcFzS7l!?u1gfqrg+(X$1A;Q8S2=-uoD%lWb$mb4V>JQLd>g+degUo_xy$#a z%~C*RMW-y_W43N_g8xP|Jt;eJy_S_mrfL!IhjU$0_Bd;*?I`OIi{zoMGt7l3aFchi z%!+KQuC!k40Mx3XL5l2OW-GXZhsNp|CUeP4uCWTW?*7U$(e2z)-GWtwl5Y0in}w#@ z*iwYR4Iybk6oVD?z_aVE4u#I{vU>@uHjb118@+&Xqyip(TtK2S`wvNUOnsl(Pq?&- zK!kF~#9M@+XwcI$NnkHbY>i!3fY}&G0IPhRV!{t3MmRil@465r_+>EHrd_Mxc-@DvMIM(HuRgiUeL%=rr}7O4!dj`j6#P zTE(1FNubE%)0tuxhM%O2#()YGlyyLV%*&I2c@qENxt8U_?97yA{hE+RVk-nwG8NfXa0Y7xyWF_PeoYfzohxd4Qf zt7)17=|3A7MND{2NNxNCiC6=D@=HWMK*Q~7dY0qmzc|>&D{-V zk#7kM2VO?W#%qdMm?G8ex@%L9S_ltp8$k|6_7lUY))Jh&>q^2&4^ILV8XibJw38Os z6uo@Cpx<3OE~)VY00K{3c}(;at0E?lMVpD3Dg#~(0WmHxDK_<|U7bTxgbGq%LBkh)O0IBw;D$o7|yFRaBoV9Y}yNKqwOSvn`{Juo%;)S>-Vz2%;&0 zBG&HlrAy{)-V;q7+V#xdk@Vq_nI#FB9Jr=()GfbX(9-K9aaKXvqNp=}CDjZE>TzLG zhN;o>zEtkvb$&XpzhBarAI0EyyFiF%Um4BR;424BXa@cDr&Xbl?6oVs&DTgQ3s;0s zD3tRz)*mG*`l?=E*(SyACaoVRWKcdbZthBkB4LLYv1g##2Kml8@Wg>r!7epgzYy-G zeR82aLOnp;+hu67c&}X+-hMIOZJZ8Q^_@CL3z*81`#KAE?L&8#Fu4P_Ux9Z7Gc(lJ zaUouqaPz#Tl-xZ9rXbUiwG444WQ?^>3vnz(?IB@u_jSl^2jU6pNotA|_i;a;Q$H#o zxraRcmAtE0lpYMSb~riYnP^$@RRax_Fl#;k2TwS!dTthf4U3yf_3HVr#j$q)GrGpN zA%B7+5w;F$CH6HdTBAtPB-DzNjv^;zT7mpLHPKV*spTK2H>y@*qW_GgqbUV z;z^rFM&==*dc=90KPN(_Y>;~)#{#js-c@C;yva9ImOsXKus2aQH%2Ac8#_i46^oUI z+7eFzmXEE&Js>)kGFo1{3Hm)X8)uyC%EbG$sXQQ6i+KDy{*4M~>7!6o>V3Q5*&VZu^em#-k5Qw)N7{rZy37J^Q}lTBiL;qM$c%GpT$K3PDY zW_v$;w*``gx-&tEkV=b|7L;1wo%`KKo~?BmCseSgV7AaOV#)V&Ic&j|U)Mc6K>8y} z?L-+PN9niPRLh!qFAw+fln2&WkV9@+1VV6SuUAhb!HWC2B!l~I!y={_;v_6i4F%}D zpW|srQPEBUKfxX<)~-cY5`X%yZz75i)h(Zi;J^=}hCr!ieMc?4qRF9}D5IbD?FrAX zEN~MBPCncGZ50!hJe6Vxcl~j%>9?qWJz>TGlks#XDg%`dL7q=$a_E4DdV*fO4%79- zioV_Wiq4vhPhV?ZNO^SC`O1XSHg_Fm*>mcuBP;KTj-9OJM7 z3Za7%C*IWol>)ykzZshDFD=)H z6&g{v)c9!C(8}wY7bcWSa*!0P$cCYa&I}T$R9CwHX6GbgaRHAgcx!|M3u)l`bt6vf z-LJaN?i3EnX9k_lP%v2ItrNbjl+eo%?x!iS-@lo!whPMbelY>Okc{hR+WXtA8A}2e3WdA zoA11lbJd_On~L!1u=O@3%vY4nl-WeC&8|_htN_-jawpqpZIc)6ncZnORNjC@K|^79 zaQQB6;Ym_^Aj+xq-^XwDx5|2mM1_C~iOW8H4#bfTqumj= z`MX7^JD4g8d_1+Z?w(RT#!v+Wm6-8fUfU|k=l)V2+r0Y08Js=SKNtg1t>Y!rfw`e< z*R&-DSvFeCC%&UKfMgLLj;sV?v`eQGutLW4xI7-N?_b_PR#NEmOt)awj$bK2^qWxd zxD6T@6<9!Qg2a7$k@{badvO${Uv*WAsGofcfP?FVdFe#QtaP!iSX~YV~ z1rigIG%x^8V&ym0`*+<&)}_UO88|RUZ%60!%!JXg#qW6VS#=ZvTEy9K3G~*@NWu;4jl4X z_=#UE5hb8NhP5i%x$ho~i55VoXEh(9Q4Nqvvl;L&LpWigN)c*P{Gi8tM_zyV z(zt$H373p3NaIaFRnXQJi!e{^UG7nrd`K=^xZe1%VGtqO?rhO{^GHpb_Xu6@g0CaH z9e)+9`d*Liyx;psMWsMf_6@WFLW;RO_5&xz7P?=KkFUP=k=->SvWr6H^U!ad!Q}>B zJ34+fq*3)z#S>AckrWcEB;@qF59Y~$4LzG{(=g1e@`}$yJ>{J2P!|F*QX!DBxi2CN zx8M+vr8;gi+b|j}x=CG{HWj{PoE4Y0eDKq7o)&J?G8Iu?ycpJ+5n=(vucP4`wNLR0 z&C!*)S5W438dD#6nGyqt1dY|jBc_;QL4V&wI3BIB^a;G_r3@AD9n4!S)n^w$M`PQc znUwKGW1TG{Q)Zf_mGIJ`rut>(12zu!B-Toi5MQY;N7LZnZ3EateIi;=jw~nLY`+@kWc{F z-=_O}YDc&ez<%U)DIwSA>0Ggq0*FLVhF&!316)^BvoC&$h8Q|hO@qN% z4SUTmU*+c1okms!A)mv53<7mmFRm^c{3<0@UFL^$#uySH;y)0T7e{sPIQv7!=b3<&7fy^{x09vm+JK3JQV;jM6MTh2VUV z&MxGWFze!v@cu{5=IKtKY7|McZ^j6S#R5XB+D~8J4{%+}6xV;X3IEd){Leu>J^O#! z1eX7%|FQfp>3w2Gq%pd-zC8x#wFz%4 zju>BWd&jZ4p6c75A9^tFdj>v5dWH)9MS|g{25u-Xdgus0Q6jh6DaINq(A;-*9TAcgrJKOUvrULR5)#OA17 z3LE?_lXgxCB6ry`kLa6DQcha+$R}aEm9p~RMHO++Lba*1?nETI(pOgNB6{m8C{ONB z3vN527rx<{jek)Y$J9->BYT-w;!qIEPIZNn=aI*o-GoD5pdG$tj^&>th(%$l`R-8^Rfc-__)9{> zG@`+3wCLKTR-8>Ik~pB;cxtf&tG8aSMtC40QA=Zo2zo7-!QH0Bm<4}RUoczwvpW}JAuX}gF&Q`Kjxa$R+L-Hk?+a9us}x*+Cmr-45l znyqHndS3Trxg=||v$S#g75DR-2E)A)poo{3s?}C(m8sHL2ubC1ez zscEI=_9WG4)j_cdjKxSg=cZIVX`0BW+~GYQ;;F+?vK`wE-4*2(+`N8B>A4vSun>$LkeWMyOlYo>N6-xR=x<#N%_#j6k{Xa$O{f>UBSYfJ9_owtXT~uLY zmPDSe5h5)Re7GL!5;dF4N^EEOwdyd0NA6)@9*IKL_Uq$UCxQYG0H}W!gR@kNfY8c* zkShm+KAr@-Ql(&Dl@xvNW;;xP>LED`zvtsQ>lQ7a>*W-$wcq1`TAxwj)V%3p*uPD9 z><{9fE0+O6D+Ai{@Bv*fOa;T(56wS$7FTCNV9L$EZdkkW?2a3q@et zg=7z1^A69mEgeEQCDXA*&OKjs+f1YgY3uUmJ+Me?!p}KlK-}{kv+R^C4)~5j;K3Ua z$-le9(I&_RoEb}52U`oSTiSfzOb+sh@0PO}gz*XhNWz`~6ZC0HBqtcufO^06u{*8J zh*qZSmc&Ij6Q^05PrXGlB2_#($TW{K#4fI} z>hk5?6Q7LRP(mngHAU2IKJqMrFuu(Oz^Y}!!YR$}XP$7V3}R+{%y z^DY!B;##z95h{m`>+Z4Zk|>-_Ababcaf2uo1mll;Br(O$({8o+f3?mS?1PnaWgOfE zm-VzMjO2exY9fwQ78S5TD^a!+5>r!Z7yi2MN|s1zXj>taW04{msIM2{GeZAfZKT}7 z-g%+BYS{jML=yk^R=hj(E9n&M)@euu0hL@&xf6jwaI9&ZgoGXw|7*LrHuSLI;2!3k zpsw=IL_V)3t>qPCMJG}cbeImRv{_JV@@ByTM*&Q!N2Km0JBQA~>1Do#MB3D!yNF@kgcx;Cs>0M^D_;c%q!c*1VCBwhZr$L!cB zC)xg~^0J8~ZdeLlRzY$rLDb2YfJ5E%|MV~!FS|hcz4bzPP-GUWfdBD#vs?>#HdL#> z3i6P_U5&*xdzHa0Rb@anbI~ys_E9Lnb}laGrt~(shz~Tm%FZk!ODGzW^jQ1zszvQ8 zaZ-OTn!K-Sa>%kl=W+HE|JHGMFfm$CfK$n9#D^RiCbwN1hctwCD;L7Ymq#x?0Jzx7 zgRY&&MFkgx_AcfcZ{J6I`BMG4gKsfUy>Ll4Vak_rSrk?q-#omoIJ>y_Kf`z1}D`4Ii zblC>$&aXX6U;1|QUAR+|=)7&L^SrTWYxgLS6sfW91$#_7u;`}KR6`%n@4cg+FD8#T zCPZoB(7VO@w<~#Wx<`SRJ8q)D=b5|&{c8yBjdl?Vy1<+1UjAzvK{VtOE~jaFUfT<1 zQ-L&OVY^-xm{;yEW$JlaxJITCGxc?w#r%iSV&-1H2J0X8k473HKvl5)f<`Guw2aW3 zw`a%|Q}%LYY%Sp@^;p|el7&%9a>#DPA|nR{DUx)AGhjsvnRN@-zV2^xd0L=}9|gDt z^@W!-NR}^;7KZ6~b|XPwL)BhEkWT#kffq<%izDo zO>A;R)ui@fQ*#JL3=viJq^}6nyfF`pZ4aXCVom3n`vZ)o945R=_g95ZjMI+%oNN0} znFlzDNJi=M+ZA@q#m>p{Y&tInyo*Tbgz0LNjTb8al)kgifzyb`=BRRRg(WC!Bh#fj zcUGI(K+2ZSf`SCxPS8O~9#2Rk%2)WemkkLe$GTVrwX`nxg0b(VOM9KtbmR&DRPk%9 zWMXD_=38f88jzt|<#y9;(m606gN=L>KbnASAf=>4d-PkVxBGi%(Wc1}HX1T<&r*F~4^S)Cn-^=WGvDpSvCk%Y>REWAAvF9+ z5!g%^W1<_qeal`S3a~W2A|6FzY|h?=(PSbkG(EBpUM!8iF;AdC2`1)W>GYhX)cYlT zed8^ji8Y+%)4=8|%LO+QRxmB!2aard!_;%9k0M(k6TfShqTq7Z#L6g#^^RZSyd? zsFS#-4i*pxe~+)tIW{t_L@Nf7f@hfI zQwvfrG>0hN{4l5M*=&Zy<+npBZEICV6>9o;<)4%)uC`N18Q{PW=u8vi+@_3O{6Ue; zI}SgGjXfhl-x@70)W~rfSc#T)?4UQXLmanr%N^9duS^H~UYwe|SWEpNt>>mR0Cus|q}4-JvVAdUrVJk!0{$e0jVY_j($G_TfeU zI$hVabeN-HeTbaY$S-|rm92mGv>&8hqzbs3M71~SN=PfI@nsfsxi0_m&!mO=Jj`?@ zjSiiHyDHIW%Q&_DH&LR*?&YA{%9Iq!llQfNKz5m{3H7`E5s=c21labl;cuJMlpMop z`+HuAtd${X+Cx4S=%1o$Ev2Y6u|1D7UHDe?n4NQNEI|kHpu|LgmVBhn_(_YzF)#R? z(k)G=GGq8?#hjR1@roqA6HN>)C3b$R+p_kw#XN6>HucR`J)PA~fhbz`_q@OFcVRHZ zY&D;eBk)~#hfoZktc_BEMRC2|p-z;Apapm`PA-Xo&E?EK9eyj7TQt^1`|O&vl1!s^ z;K;bt2FpTj+VLvT78{``?GVUq!@*lm?Z>8or3W({rS@`feqwyTLD=}8X#IB`@&EJv znEwNkVEJ#pAItxW@7Juc;kYr5!Ouc~EQi@VjX`{7(c`Jg~gI0HXe;xb~WSIsX7Duk5~`jec(v6=gDwXyH| z1!FrVZHs!AI{m~8f6p)FkwqDW|s^n%5 z0CzGvz4XZ~UEBY2}5elt!oK!Cp#?g*wI{Z{c}CNNRw8Dr@;|x(i~!9 zh%{UWE&j#$T;h1PY7o&tO%2T#n}hQ}ki=>rv&Ot$75%NQb31sVP#X7gJu*hyOiZtJ zI9^q)-(4=;y=yF(>Xmo#46iHwYqu(1w`#+HdP6c^=A)-_kUsuRW#wS1-XmUh{<@vJ zZ1j^@yczi0l9AxCh@Q=z6f?F2RxBZSGYDt-NmMi7#|x*g_&1a=7dN8XI10Dy7xfgG z9BBLVwQiFYBW`|Z7Sfq-6%}ZY8$D1l-P#oqb#g5NGSDwVeH9K!SGn9(`S8&vYxK1-G
x=PHxvy`75EEJum&15q zLS8Dks>LD(w5VeT*Zt57mElcRFsFua&=pw%Zy{mxOelQJTRJ)x!)s{=s>m_JylTb< zPJ>?eE}Z1Rcqm!%*=5j-?l}E4Vz^P8sFd?$VbL2sT$?s)UoGJBxbPB%!j7YTwqS&E zW})gIqj+E#yG#tx-d~d2l#vE9*c_K3@^eoJK`pzL%@-{EUz^2jAO9 zC%bVmxRda1I|R0sv4L_VXwED=1;O_u&-ZbOS+}%k*@x+l4#naM;XE$$ zX->xE@@4Sq&N_2KGYaW}Xka0Y^abPR-l_S0igf2oshqm%FQ1x|W`zk8s*!ZzXj_Y& zEZxb9#8io3^Cbp|K0cp&@C@)CDFc)vT=R(v^A0a+@boFH5IVI!`}A0BgpjmL(h9kv zRQ09u5jm2uhiG(K_d$g)eM?t>*6h@%qF@K27&VAa%lrd#JTj-_k>9eP`2;3#)TE7a zu?4B!yjaOsw0|y!P*Tpgr9Nku0Nl|{X3fnPvB1#tS>konk3E-J9e{#z@!1|fppESP zcvRSH=s+SeFd<1b$}!?2|Gkp*KGsjm+aLLkP%{bRuk;1SSELBfeCeP^l`UI0^9w4k z2!g3nDdPglFv?_QShej2E=@?)16M7C8EuVV^g(o;ZJ#qrMaHr5zxl|*#{pISNds~= zv;FyLoa_Y@eQhNqcB`Fk*|8{Jb!C=rx+>GR=%L_tOR#qJQ~T0%0ldHVg3D@b$axbL zPCUAdgAxVt5J|MgLH^q7RFS*7!7Kr+6@ua#Vfps)B4dJGSD-1K>>cG&(mxyNGlQ~= z5W$WIN1bUs)kNGpmz3o*DFNG2rM4k6xv&lXH)!lZ)c4oMEF^a}_cj&*V#w56sStzr zocR}6m!;}1S0!^cQ@pDF!xW$)#8gS%jD)c|zt{xFyh%ks;=pw{2uh4vwN=w;RxUCv zabH_1+@8vz@$OBQaEToX5Gn00z$=5njUp!1qYBP1w2H;Hd~44OgQeOFmTy#acBtA) zC1J3{h;1zXE>vd%B8m^q(Q~BC-7w{nq0xupRzw)s;A-%P0bt)d&XKZ0(LsG{attv1 zK6-5bP^2dm>aS2UHlahF9Er0Q8jz(*=$SM#fP7eQUaDS&Fyn$>Eui7bjDs!K#$=I$ zP>=%75n3e%BB_FZ*HvASvx=;h&sa;s$Jv__%Ul0wy%}#BZ_+Eto8;?WstVlv8-9@p zxj!@g$|4U?iFYpudAhHvIj7D25E+o;dOOm>s0&!=9ga8#AEic13`KJHjz#iS4KVx7 z24Qh1hHQQ1EgfiJ${@G?sbdna1ry*sneK1?0ROyK38=z z3wM#nF5ZhF=L!?n?CCk8^txlHJ|h*M?ASBB=j2=_TKZi0qm7_b>ri$~u5c{Y67ZCY zLQ(KD&a_}Y_7+jIn1JeFpu>b~3tXXaH>ti|C^>qj#x(&Mh530oii%sgPC9qPPtVvT zyK2|9XL?75SZi+96@`uRkzPrvQ1uamBwBu#$jL)ltc?)cZIEraMIbV*Ze69+DT@tw zelo>~1koU7&M7vW-Ny|Hx6&MBqR-B<{&f46m@d5!`p7bmcxc|rQKrbi;+6u7c#bJhxQ)M;YRIre7D}0TLM;S+5D>1JEHrsA~ zT9K4Rj1Wq|8|>gxNSwBX7uROkh8YA5s3&bEd`xQZm9Npy=V<`&AGEH zoZ~-sG)%_E00iS}C-u#EH|Kqv*z{>2BWT()Xhkv7Q}ajf@B@zJ3*DuL zBuL(*D}^3G(VKpt%v=`tBT285ivMLZbjBT!Mlw--EP&!IGV`^m%C`%C%lBXkSae>iViCk>4XKq@gs2R*f3=GC|VM4Umo-Pes z)Rj=y=~d06S}p{vL}nt+OG`8-j(z822yH{$o$>3bJi;48?L!~w$PL;@94hX#!3s9u zBMU_nl(}Xn=KKjAjN3nTpSTvst4fVOu?YpY3_kxN4TWr+#4ZN^7Q3X68au#BGvS+N zuh# zq$=w%jc0lc|9zrQT@b}+k_jsxhz#E zl>wd@{^x>T>_-c~W`FnW`~WQ}5Bxpv9r5$%*-~bwqq_F{RZalG7Qc2;iW-p{(E@uD zuV&zT;r#iZzx*aeAu(Ab(r(kXcEDB#?lD|-?37`mh-d-fBIgC2?o#W;fQ#kH8Cx|X z+%UDopz(d>YDZtNLPmU_d~96MC&!^m!|>@rYFYX9osoM_KI6DfZJ^#vJ!QJG zv=w=xk=#h^y)ltZY{hI)(VCLw}W-f0Y|* ziW{^=88gmk#O=+?`nSyWGECpP;|f!`zaHSHVbGmk!hR}TyZ_fWJhFLtRWa0%Rj|d&qF~=?)p2v0bvvK=tMIe0 za4EBq7=8yo>v~GpgDAp1V>aS}czja!WQ;@5M}SLk)@=-F$#iE|2=}=jAKu7b8E@AE zi8szh=W0c%cl$-|aYr8;V7sYiY=pWg-CvMtf2okG;VBj>OstTLtEuk3tstF-NLRXwLdS(n%sF=j?+IsO`k%?^vO#;)Udwe`fLU%L~ zzS;hdJjbzEkO8n^QCaCf#;VUH)fb>O>fuL-TOxMSuU=^)J)%&H{hYrv`P{HskhwZ| z7$UhfVBx@VxD8B;mj3ryS>v29Bal0KK-KDPNqeHt9&K#DWMjtFvUSHS;Vjwc0S!?+ zY>i&8J^a(KM2eN11r;p71@?N{#L;BWS)jdNn*XyeayaL0hap&o-yQDa1@-lzi}$Hb`8Zs8rjaG2@siXqBeiBs2<|9me`y0|@<^5A84 zd?`Y>@pbuPY<@mzhG+|e&9nzmPB4KjDb%AX@+29j`fx1;>3yKh3@|lVciNnx5Lu>t z8i#Bz3Cf=o4>m;d)r~0M$1Kd^rEEPe*HpAj`Ja+0NbUgrnh(e7fiGg4wxgEB6?^om z!|SJtLN?|0#m`kaCrU$nKVWfZ7l}+^AY)7o!2d1BV4OxTE%B(IKvH0AL=VoFH%zhG z8mS}?)JDQKq{tB`JWWjrkVUJ%G^yczx#oWaQyab!VmGO4B7nkd5e`Lyj^Kk&s?VkZ z-?KTI3q%6HP2rB-f3}SC#}Dffm1Qk58o^9qW}v%m$Tm}DfxVJO)KCzmMvARN&b=7F`aHC}6W_dASaz}B zZuU2m3i0A}(P@keTq!d2y*NxKyEnnoA2SO5*s09SR4{hAyxy)bubi<~9pVqFlE~bz z`NBrsVX3iV$Y7+BX|YbnMgy}`l_s%)G%18fm!74h+*-CYu*xP+4opV+ zEhko?x-PL^KH*3hL?!+jPN{m}F65V)xY(O&J9EaF+me0^CQ9shLLh%Vl zf?sP$?2wKTXhbSG%=s~^rY814!m0Vr^%gN!rf8f-0jC)>IwKdzB$`1;vb79rLX#Kn z=ziy8Vj}Z;(MKVFkY0-}Kpb z`%s`--JBR?&=&sU1>anSxRfbWeDi7FvV`_N(7*z)NCj2wqy5HO zE=lA;6Y;4Zkh5FXcW|VvK2g8HEhhyTB0m~|N1{IlbymIL+xbI+Ea+om9d71V<7RmQ z9*Fu#zY2`;cFQtJ$61Q608&lXA9DpYy&6x$V7TVW@QjMTUcEaY4Kjbqx1_MxC4Cx< zRh0`@`b&L&G5wMF81X>3`qVvEK-RM^v~gSi5=}HvXSfy8h!+lMm|NnSSPUd3*C4vn zKQ{)|1J7v31e?ka&T73amv=;pqDnm8Ely)0j}nBu z+C;*>gzM`kilM_LOlI;R~91LSxsL9ke62hx2)~R|}AWxS%eJF9}exyO#Y0 zFTCgkyI-mDcXVC<=mqhUb!VoZgKHVEvrfWX`sd)q$Nq`d>>hKF@(94Ia_{Ve+T{kb z!4s>nR}OY3l{EI%TdGn2reu>YB1&M+fl0U4_Tz1%k$QvcK2vZt@DcM7vOf*WxO1f$ zM$sRwdb;3#1wuF=4SH|X0~z0h)fqL_*&$cqL}n!$Ctv7ET(LlB^na=>*y6K7mc6B? z;Qm6V$}koM_kj?Nf99jKafTCNxGIJLPEOcYP%BmgMm-Ny?j($ZW?7ipCfN{ry+bSM zrP3GP1Sl7}c|can`kNMvP0jvshR}MOTRa6r= ~;|x=ly}B&c-z3*VKq9{kX{BTH z*;4;qh08qZE?grfu-RhkrMIcvlIQ4)oeZUsKKLJX;S{;bBN^+4@d;dE zkHh{8HBkmq%M)TN!@$F!*`$1iZ3GgdVptqBepB(KoMAqJ5r+g2q_pD84P0y#73n;e zurv_UMO=|OvkA!{)9Eu5!>lEqqml7c*dX>hq6~CsZSuAxCjq-L6AFfrGl{nI>#xsi zfZ_yG%7jN=KCXg?YmUmmBw*EYpKe<-i}uyg}E ztq@L@gK1kB@<+;kHM3FXh4c(kkEQo=3|J#O)zf@lSt*Xh2j!R-M}It)?~W_O(7+wr zIXOBJ8}RNWB6hQ8|B)_Sqr?t!qQuIG_;};>E@e(SZNI=yy^Q@uYfqM4YKej=mR7we z!B|BWnM{SgGP1Gt^dc|Lktr6Vh7?3bu)n3Zjk+8ffGCP_hE3DWksgZ4w-t@hyXMQE zxI)FZ;(Rmzn2Y!m=*{hti$jMy`&r3rbH*TTEV^^6eZBlrsmKk~;ys&hk5 z5)G(Kz@~jQdd8ztr%yoF=2e*_gpud33K6iUiFerpMMDe?$#ibznZ!9(I8AEg<3)L! z>c_mdJWntV@6hmx#EJDVsEZZ%Wt=gtgt8E$JCX#<>DS`=l!|YwZA=#~zbs}py0wY) zwa$oeN>}-xk@mpXtLGdAG~2HHR^HgwA=+>D{jw*g;h&vSHM8B!euE% z&z-9f=1d06wfDRQ%o-0NdN-{@)9BxsC14BZ-%W9=*`mFc(Kdm+lmNWU=3H=KV~&R~ z6~QUHVb_lo{gU06dyy*PZ?F1s?LYOfsh%E4)V*t?>er_54_2@~L^|PU^x;)#U`4`Tb26GuEdLaV}Z35lrRi;dE{?8LphaRu049Oh@u zWkQvt+?~13owlgQV%Exjkzyz@*&`90CD&uxR`TU&Ayp#Kx>Qj^pds0$CvV~`H~04j zBxE*QipOWlY6BBl<{xlj_WwK-&-wbynJENVBIoK6maz>NHV7%kq?V?Wjau5yDdxyB z^~kC2Cq^c{I?GmSSNt-Ap`rqL>))VzqGt~N9+sLUWgd+caukbm@p7r_$1zsNI_wjQ zH4uOLX15@C?)ejq>%qXz;+n5Voo;#($6EAEvlhQsfcLBvz~_IZsuw#?ot()%5CNGG zYUh}DGZBG8J06Z0uE{6+cEHIBqa{>SST44#RtJMKaRBf#@R1K~#4u=qoKPLC@l+2S$%oI{9rjkG`LI3|>u$Yo4R3afR!oSF1hRv0Zvpz$J?wlQdiBCS;JKew0 zEXkOT!CCRzrmF}*8fxvvhw*z_6Pa$VvU98{>MrzAmUvxI(f^lFK|L;LYbbta-kMg47_gdH;Ss z$A5jmA2rP?`>!PZKMDE&qtP+`XKT#*-!wYb{}qkyN>e88Uy|;gsXhIdq!%~zjFX@o zZ?ReTt43VAP)_LKVPgjqFqMi^i%sda<+j2qZ61?H|0=0T@TgYa&C(T@ zMwd}mp!@ZHGNsG2qYxJ{(l~Zz!>l&?Z{18Mx<&Z564cu3)i5uu=L}7j+36)lHSi?I zu$`S6VzWXo`z&#ptfk!;(*HEHlmYm@m( z(J$D#d79J3I>Mc_&&%DA`%?O5jO%@!?fgHCol}!&!J?$wwr$(CZQHi7+qP}nwr$(C zyZ3HR&zYE+hx2k@>JO}_sFjhKUyk5MV=GC97$nkkF!YHRZL+2_Z7D-hc_{vIbtVg= z>nN6DJb*Q35$@Xw*vq|pm2IioY|u)&@@9(G)o;TFsy)s`6U`*e0`}#J@5JSPw9;>x z%bfkIrWD&HupE^=c=~$Z6-Ri@QzFVxX|+1UiP@$q{cgpfb9d=DoMf=npo8@W$k=s+>T>P42$6S!g9>;}C$RQbx%Sx-ke`_w`n3E#9t`>msZCBHlj5(Z6mV zP{xga)AdzAIc7!R{?bmG*BK%~Y5dzW0Bfw+tfXJ?VfSepg6`BMuXiG~oc(I4O^h0g zQUO#T%*pHi>9t$i4>MLqnIUy9WtfDrp3o?yzC?=)*j96B6S9~-#qSzw@41D$$*h*v zP=iAyowIi^gqMdYCh2n0v7H%ekK%N=n0x4FxD`{+5?Dcabz)uB<;E~kIo0u=3>nDJ zXS-9DEqS%`RSF8ySd2Y|K?VU#hkuhaNGh|?(2gI#hQ{gP4&sd~E&y}fgGT%`n z*#xt@Y|EPl4D&x35G}i=Qu=j0ku4Jioy54Qnut%KIbp)9YT2{2YG*KIne$Y#f@W|a z)lR(7MyiI3Z#Xdt23k+f36g-)(^DZZ@i$z>H|ysmJO%1XSzQ4c91BGQr8aU|{d`w0ZXRoJL!a@vJXypBKM(sjR z#=)7&xXgbk6{(hQl~QOd zqC#Ov{xROMukK2J8US9D-4$^YHJG+ULmbA>x^MwYe>Mxa*$ErkO=9CZC$uaYH6-Nr z<(}>0@S+Ht4Qu#Je+snb2%-j={P<18`+AOl$EW{^y!^>#76Kf{K+U}Px$+hEyJGjP z@)gdzWT%qOm2Im~Hx1GYr(`JUhv=z@tJ^Dz znjaI*<>7RK^{367Y^sXKa$DS^I&OpNaPR;y%3~!?q>I9x9CjS`6!Ih)#v`>;~=3tpM&i4h)+mJ17H6(!=#tA%PGXN6ZknP!Cu zb=a>IUfHALC@ofi-0ltTqYd~7JbKfOdApS`RdXOrB!-?Sd10rva1p`ljv%k5#u0`) z{%38Z!mpv`|5HLwv%;YPQ#PM|GO|3)P=muw^ha8zrj~f^Wzam)h9YdEHozZ<@N#B69rJ?h4NA zay35e4vAxx2mHmj09QOna&Ilm9a`zdXRYYXzhZz}d?Hzx$uh6CEyWZp)*L6sHpw?y zDjR__jjykDB~~X0TGn>Qs4_UvRaui>U^03c4TuQZI>=!ER!Ej8z*60<)qqB5cX&iX z7zA(_3hum0mtD=It3Kgu;tMZd3EpAM+1=mBq%|lY5J(O}5>{N3pj{%C_YlfYeXh5H{y_R@H2} zd&_NTsCc+u?I6^O2;P$Z90_>aJ^>0HcM|v0d@M0}ZrBG#KbJ6CFkLmH+!-qfH~PK<%H) zQ*R9^srV!AjF|ZbEA6hM_gaE!w0#Rqv6xZZmnC6%4$VHT7O0GmB zn_Zd{YXGUbT6XeL!59`x$`~Qj(>xGfDC4n0v_!sx)VB#MSusDn&+rb92LT)k{LEO* zk3tT_zGuA~rQqciO_r6!<+EnT9{ZawkQvevM%Zd9`E_$-g_vH@51=Fy?Iv#Kf}TAv z(SS)bJ!Ycz-S(PTH>R1V3mB4?r?F#9^Pgbie?z?$wzJtuS5~Tli-f9>Y&PiY;tVBa z9-2w@bCg$Z;Wc93Imry8w6r%}&cG~6X#q($^RFzhl-LU4d>-{-^o!+R0mwZE6+_LK zt1~WB$86>8V2|Q_fq2g5u9bVvVgY&vvH)D5ID2~nn%swyhIcP0xZo475LRJqUscHh z0C>Xc6S_SJTqEddPwHgxpx=o^v_v;b>#LPal!ii}@i=M$z6 z7l)bc;F>h7)n^QKamQA0aHJYK*y`;v^XM`($>ipjmoyxO#ZenGj+}_a+j?(?-X;r< z{8+YDx{Jp4;7w)V2?9TXYxB}cp7vEDvOt2sBPGK~04*MZ(Z^;81##wS2F3Azxz)7o zS53rkc@S}s+cM+jG&#_i*HvnC#@&QtOUWj?lyPCLHCT^^qw1V4!$M#s`t9UZ-dhZ^ z%%~b;LKzpM8PuNRtukCWaA%k~U04$}irzX;#Wrv$)+Y-i%9~y<+A+0K9>%m4u7=SK z$Nr$0rbG&rs7&81L2MS`st=g;7d-rcY}}H}?1Pv(2o~xSd-FOhlyDFba;T0t**dt? z=8)xxPeKTAdFp|LYO_$!#?N@mL9$NQe!|%zx0*9iTBl;vq1Xd>?1Pg|_tnvv$Y#*C zZI)MlYT|_k@$I$Ix+hV(SX8Nbz46`6Bh2% zS<50qJF?lLHiy46Uq&{C5gk);*3JB*N@MN}biD8t9Cx;QTXVx&W4)bA16rn$Q93Ge>a|xdoYb+FR4rk0aQJhkbpui^tT1Wg?Unc8f$25HCK!R_M)f zOP!H4^g&MJ9}#8LG@8PXb^mZ`BOlU@0b9ojEgmqevfjZc3yGu(lA_fX%I8nP4n&@1 zm*4I6Gt(1CNjxoR@^pRpo;iwIV=EW6vXDMGz0xi7(yHHP*HyQxJU;|ap*QlxvHDxO z$$k`mSo$ksL{cSrvXlwlD-Dif!prx1=aff$9%;YYV@_8c4wn-*7#Z(^bthT`h zhpoh zKu;tiHLi%$C*qjnSFPPmG*KsVSeLH8;M{LG^=rK8~wzQZ;R`mdNo@9Fv}cr?KEnhUhWs@_a}Hl7SMmAy#FJL z{v)24IRC#5`QO+l_WvpN$?oXahI~`Mx2+H`TA%qSYMKB_@}S$mKnBS*5R^_H5g|iO z#HxGBT-%YK_%$Kb_avs6u|Wm^xSNccepk`tRG;t#aUuvx`QPtuj#P1YbiR(H%JqT2 z)?OL^&fKhos_od-`F{EQx{z<`pNSAqm?*z4B%fZ$*V)R=UOnWhs$!ywX(Vb}S5^Ji zGB9tUE|V9{WBK&+(9M9ibn0tOSAEVeJ`zt&5^;n`ddTc$ZEH_BSSl)hSTRwRlpY<) zTW$U8g6b0mEl+L0dsDqwR0ZX|T7&oNFP(?B``NpNh!%yK0WtN?k7^muPorFQI2Y+e zBZYLOLDKQ%MBn)ui&SMc+(6vtU<)_KIXW%ZNdpj;4t-)~2sT*{>gl zpJi|vH0HI57pUCx)x}guQTVIwtZh!su!0IU*lwobB(Y9R$zBHXu!${R2eA(9?ut_s z31j|+elv2s0Jq+~4Ltu*^8S4HCTvcCvPse)#{IDMDL(0*)M^awGb%u@*@$e6jx-=H zjtr%!m5A%Q@5Rf~op&E_u?RH&nKv5BzmYqWjA($nv;&tNd-^iwUMOrZ+)`0gHIpo* z0j!dJ;hjz!9q7deB2}xmW}6&xIfgZ{Ro~-KHdQ1tx*}#E%H4V2K#VZzq?m2PD`I z_?yrsRC5AR+s;$VirM_`_l~n1&@Zqi^YxA3wWYb<P*b9WMnTo!kWC zKrTbAwhgMy3-so~wqR)UCgPp;rIkkT7NBl-vB3MN5FAy|Adb`ZjlMEKTnE}GFzJN2 z);Xn5s<)mI24#=uk6}i3_eKZwUo1u#6!DJ_i2$$`F{RK1GJ6~j($$c~v@-j$^X54M z2mZ`ahF3&DkEqMNOJ?Li_TtCQoUNShH+7U#BchT)n5ODftonFsy>nR}A#$=KJ=Taw zgb0WDI6{;yR1^hpx({FhF+l|RXmwm+t@7XM*eaM`VTJkzsbUdS zX3lHR*OUW9R@Ya!iFGBWg$kDRRE&Um;iZFV#t(Sk8AEp#L<2~t`I4fGSBYRsn}t*zc3B4;?w4u#EQq8Q)9=3m z@?;(5-p*l6vKqy|I(oo+w}4o*2ZDWER7xzH@Y|Wk3IrV@I{j0i+Q3MW<>oWL^uu6u z<%Ed5=qcpqt`Y{!ZtP73z+{Zzi5_3FrpF440RLZQx1R0pOv>fd4oYREEMBN~Q zl$gyeheNFBmkT3`jq6=RE<+@BfYC7$yRl(#AgPzpw8qzJ>S)G^_FB^xtYm!O_9XG{ z96C-FV{%@CJhQ-~lU`ABUDJTbg;WR<_cc$mJ-A6- zFpVfjG4sf~Byp~*C6l)SwovOG*Plcx02RI&2oSvj+x3Zaz(kTu$rphtkY7g%6W|+<5>x3 z9A%6|%rDV<0t3AxGb&{IYt!+8eR6ulkk_6`}1IE&F-=a;p=RpvyvEEh> zgb;jR+PH?b8Qs6*&qD1qwp^XkGBGOj=URn(BQ>x}mb7-D4) zY35OdnoHXlHC6TP!B`j(QrEfa!mKD14Q$A6?DwT}i8_gnk$j>@7Yp>%gV#*GtOH%% zavHOQ<$+BGlRscn4Zb$ZQAu`ewf1(qS&X7Iu%n-tvg04{eG9{qFZh%$&hc(vw7kL> zMLw$ViJeg2;B{dD3o|pV&EZir&hm$k#ELEK3a1>en-JT;wl>04OqNaKSJ5z@5=GM} zm3`TNI4FV<*FZu`)tTs19Nlm7A6G#7c`$u?2Z|3v+;tozaUn?8=`<&VmUYv`s$x(i zaeDb#aUJ2cC<06-ojebR^O*6q@*OEE*1cU;!-s5)v!_O?^F=Nt4ZEL@s;21~3)*?* zozLyn0<{W>;PJ~tpyh5LKaob9<&#K}_3&cQIGqUFzE)uGo`5Z_#CYVPCtfr_^x|5kb4|ztP>Qjyb3fy z`KfKL9#Rfaw-ZRwL)H7T;uH`i*p~G68nb4Hxy?VMgcjCQ6I{E1q{HV~Xnp#e)WdBN2S6P6SK-B6EX$8cNbZnI`!d?Mg z%C0l1m!d@Brk$U*=8crN`Jm}y$-_XG0h&s2JA4!_jfPAiz?EF((0kKV!K5Toh^1WI zWbtAHJx}t$zX2TnqriEgXae~5;wcI#taJp5^!r`FrHgSuWc@}Y^eRWE3>0AhqUhwO zT|5ib<^7L z_dK-6U(+7B{e4OIoKI6lCxE#!TZiC2ywu7U^maQJRH;vc7^sX+9bq?2yrfxNGomc$ zHO|)iLRhZ>CnF5!MABb@C%#OseD--!LJ(;A$o|L6)@vhg*+l^HnUfpvg+7|6FFt2} z77PoQy94@Xz7}aj{K)}_*I%0W;=-)fvQR*sg?9~br$(txT;7F{SL*nQprlC@BF$ErB^Y%zyo`q;ow0MvqVpFIwDrdOS7IDcb~TRv>j7Sk#B00Cq4Q>{qZ ztkzY_Ku`>rnzAp|9>i5m)$G*E2n2-+XMEOW+}XKHRik$4oiKjMV^hFrw)DOidt8pK2UAern*tEp5%9|;*Hr5s zPr_6&v(vyce~(l;J7mhc@SRy~p)YYp`Si?CQ!Tiy`JQTCT-2AKcA4VLJbAb-K~?N6 zcG`5%a=nb5Kp^L}9=9B|r!UNPIaF|Fr0zYCaJl~HL?VV&@)_xlewyaRtdS>w6h6elG!euZcJe3UD!gTSL+;{9NnjPDv=^%1vJfxlIu*oJTQmcFUPt(&-5CA`mO z#muZ+&knxnThYU1Q)LEAu!$ng&-c#9goHbcFBOU2HLVaN=GUwXl7i1 z?$GeTbaG;E<`_v^LHHF8_?m|ff8T>+-K60*)HQTonE;u_x+q;n@U|earf&komWj#8 z--u-2A8oM`r`@6u4$AHQXxK}>|1E6R(3o7_oWkDBojnQ|Rat*JeaFp`>EoD+5LUh; z0LzOzDMMa=oL_~Y_G0vS+Oin9W;bP%N1E{qygS%2+jmU)cLV&_y4-Gzzq&X#dY;CL z4b53Lpt>`L|$ySaCv)bQCtgy~h=8f4cJ5daWvAG4NTMB!~1%NSD)M z5nifReKe!?Ipc%r^#0m3h+0;RV^%X0vtpkpqun9-dyL~pdS@P8)TeB3Z78A`glZ#x zOQMB-Wb7>eL0Z%bn>&f;7CHf^<>qk*P8jH&nzS*{1UX`@hIzVRGvD9mTFe9 z|1VIESG9eD1g)v~*P}JC0kC}c`R=(h_xw5tFKNu(3UA_+0~Vee55ebOw})}vzZF+O zn?Ko>Yq#oqIu#qiQD4oA9BuYsNPsET)?~Rh8&L+Dkckf!yp@#=pKwGW=uLGX={*~r z(BK%(hZBXF!^AA}?E;54^Sf88A#&h-@m`l-9XE5tHpTT8obV#Y<#9(YH|?uwXAv-l zJl}!vGs%gZl#3KE3v@B=Vamdzx-zQ|0XW6{||{vvcH>Lh&^|8{j%B1bh3f_>UK^x zq*5EHhc*-7lqrX^4sIB8iN=XdNxWzOF+sb2)^B2C}U#>f2` zztGVJyiL??Ee7N{tBW1H$FW`k@zSi7KEk zm-uadA&@1Egb{-zw9vl1sTxhgmt|G^%JF_$5$?@))sGBwGkOWW?+4%yJ}Y=tJ*<|F z^*GR+SKoE!lZ|tE5%7iXicEz!BeIDXONZ8?Wdo5x<)aN+cb733T?*ZJBN{t5)(OdL zM%ycg3N?OuBZ$2eOZj*s6&rUWj^!^yHM{zwlI6vWiK}wWWtCswaQIPsT#bZ~%I_cV zQWFeuiRddW~S+sj>yuu z?HW%?xWJxB- z!=ECoib*Q4S_JiQi6u20 zHdlG`IV74IX2_7Q(k}`L@7P`D@~qih5-t;fH4opohero*JsjTP^MUc-T)IWtW2TB` zr=aZhk}<%{Du@mAcG)8U4){k+@nkE3PhH;JHCzzD>GDGfrF@(!#9ZZkdvnZXaI{Jm z9WqSNpF~58eeC^Gg}$g}hZ<=D?fU9IK>sRBL1FjidvaV~VT<`C6Ol(j;!!c5`;}|^ zS8>ON9hDay;ik-tN@j;W>Uf{uN>;z=N-xxG#sFVP_^q?>GA#q3MtyC<7kRjsZ?S*G zI+M~c=iE~%joVIvm+eJclQaop1)|+3b|yWA&mKc?xS2=5NO9=Ff}@r?Fk}k%*lXoG zmv0FC1mDs^Wib9#0OmbQ=vo!$g>!@Sk~Nk_YQ*q8)9=yh84P%da5C{Z4P?IV!2tFs zX%;^rWn0lO%*go*qF_zL(XWI{^8>(3r2dwt7F|UoCY6k02J7J@r$dHwt_^=dsu7yt z8-#l0+kVdEWV)tImtg)bB|f*%B7&i0O8B9nPiDi^Pf$ZXT8sc&n2!n=cz zZ>2TK>~Cw+uaT5DBkAc(IaM!^+rD1b;nw|>>b%6Xcui4yKw%z?NQm_@v=tG2#6VrR zUb>S#O#zzq8qTZ|1kh9caSG=;hRc~dlE`iQb4WKFp5XTluMY!sZC-|0ar(! zm0SEq1$nzDa3VbZj~%LYm@DW@zbFh!IFAGQOf-NqA89w$WWl0cJYn{;R1G9_nfrCs zOH`3o%yYUPnQj2{Df$c8ZoQC6YF3`Cm?PufbHs0Z3Q;;Y#q{IC!D<{kbNT!Z0)nrW zLUlOoPLP9Z3_)|)nsDY*NsfTVhVrdrX0@DoP>9MS>jl)aH zOJ$YIa!P`vhGj{Bt7f0q_S8dU^%}Fi`Y^lO%M_z{oYOU*FQt*xX8m_sSUJBse`+Zt zpILOxi$qe8MUg9LPW&o%nVa9fj(u)9x_MV7tBB7e!KFrc3TX3E{syq>j~NM=Ss;9> z)G70U?!a}UKoly|=_5)aL*$nbjVc%FA?>nuTjFy|2n<)0_Uzs#wJnenLu6<$dEPA#qeIA~mNHWB-* z8y7G69)z+rb+?wDhj1!d;K>}($Y8{_;Daf`EhKxT5A4+Q!$EU92VF=qL*F7lG~ z&MFPKKjH>lTcj4FKe1rSD%O%H{|)1Hgz~OTSDP<4l67*P6rnS-Zb10tboZ-4Eo5#C zf!y(7B&3p*idafcef-?NLB5<@=+s4zAlVH#OyhFrSuN+>N|(`|G~PrS?MUBW-f`z~ zO|C16&&U0Ic3QHRj>>u{kgm_P1t`Ox)Y~KU&^}<#_FR{*3%Ug|1TK4QOjIXo>{%`O z2mydeon`Hjh*o@TXja@PreKEM7%8R<3Y39dRt)kx|2f2Y{l%Afyb0JFtC=Q`8v_tN)XwvIh@*&KyH5~WtX!B=vtU*Z?^*Y z784;w@U@~V1lk&S4;vNFs&!>f60H(>emS_oo}KUnOp5~ghJD1#G!-qvtUM4;1k+im z85K7%;mnN0G>*zYc-S6?Y(>I|1VBN;48U0g9+nkSap!{V~3i<%uxN4h#cv6ouh+%Qem#A%T@{Bcl8A5qeButB$4yC&ioobO95% zf<5&-BfP?&@MwLj?YO7f*=?7td_%}G*o1Pg*hemGym{>mzF5a$DtRqaqc85-n?;)- zG%V8bOVO5hC}s*Y@wk@)9+o`4981XT>D{zy(Jpnozsl@)JqHjEBxG-(P|xz|VZ5cf zzhpTe_EFCKhc(y#mB6@-n393)ss=?XHafm*&ef=(AX;HALuUzwvhhAuQjMo|$Y_1hZBI+qCtYC(f_ znMZ8_l64a1GB`QWY~nRGe9wFDq-3V(vhzI&T$IXI+_>%Imlc}A zb(qM*klj49XV0!30-v8uer~aQbu-BQA8?k zHJ6ac8;ac;C8sE=i&R@>{OM_)vc_wbze$*v!WE{wG|Av0UWI;;%N2Kw?7LJ) zX$-VUX9Bp`Y2 z-Xg-Il;(iuWzD3x3isZFv`SQXR><*m|B52wR9{7~uZp!eMv}`j<1Rd1xUHza`M9p@ zV&tU$qJ^P*SxV{1%Ca)zCMQ(pL^6xxBixe4nSkNWHuaiczE>LC#=6N01w7ZNTZflM z=}|n*v6ZHdQ)^>vXOdRCreb1BH@v1~{X$c7;+q4+I80#CqD8dCqWyzTDL@@j^kQ^YO` z#01xiS^#%Yq?uW+nY0%nH$bKgS~3u`Tx!3@Gz7OAM><?@@cuoZggV=5z9oMWbN*Sd*{9M=l$8H>yA7Hzf0P;; zKDr}1P)Igc3uY0%SkK0z^z)O0;%(vBSpYX;-5XT2;B?XcIT4dJRnhN%<9s{aN2;=9 zX2Il==1ao6GPAFoYN$mc0y?aat6N@;~;QCrt}Tx!Xcb% z&hZtQ&-AOP5R~NNQy7YbJ!M*tyEIe_(c@MbVqt$FPASJXXMiSMQOyG-@;y)a9S860(A>oC&Z;Zr!{Rx~M6YTyMrKsY&#g5~>vX-{S=k3gh1? zSM8cb#1UjDKC6xiltq20KSoh?OMM7aHF^og9DTWQN*?)>*;SbIsa<S}l9S0K=T|2wT ziL=i=!;rg7O%!Y^BEJpACD2#99h*;Pyy^SADa^|v1Ypt_``G5Dc%PA#3@DL~SMxw0 z6$dxvjKyBB`w#cnd^BKn;DVvg6-p$);@`z8|Tr6?1L7~Lw%lcBajJL((y zvHG2wDEm%U{-Jys%gy2LC!*vO7b8i7xRrLDJzp&Geng>zO+#PAy?1QphV0I4(3{JA zt}64ZY2RH%HIeqXHgI{r(iMTDubDpzPfxX{jWoD7@IG~Ijf}`^fZU-9qM&+4v(v4b z`*zWIdx=z$Jg1ik=9Y(5#XM2wX36Wmzi8Bq`t*f25|~I{t4HOa@cH6c&%4 zTtyqt09E17e!}~{8Xoi%xN2sDYL>o2jV$5odHd0A`D|DunZ=rFjBC94y->>Hze;iu zxkVgix4xw+Qt?1?oDF7uDZK2u@kj60SE;?cEL?3)YTHg4mV?9pxK(xHRJFL5kHxUt zQQ7Ol8|&*YG-i_vDi%|5X(UasUVLFc2u0^JnZl+z3Xf_aG{skig(-F8o9OV%C_UY` zGd~y{qV|}q#Ra@|VpD6V#qO@Btw}e4&n*#5?9(4DwlYkH*!I<&*GL|7js+a(b{yNf z>R*2p*x8d2?rWrtRJf(b63qot#59(*XUAK@cV&xg@;w$KirykiBYt)SpU$Vl#oY(o*buD)gZhyGUN+GWZ}jk3F?z(&a4C{Vsg6x=V{S-t z)Y3OzGfW=>i?B8RVyuuO{4a`0+P9AklXQ^?$8?DCaqUAi(o3vyT<3{GNHcBOpSJVI zAJM*8m?%Zo!G=DYo?87O>UN%McWx>66#T8mlq~dyZIE)NtUmQHM9C>46}1XHihn+PIF zH?++#+hYZ#jyXB+Ox^`#+K;}I{M^FbA7MY~K8HoggLAk_dd%Ti$X!!RP z8c6DecUY2ZY+DAeO#O;`*v2ugSzNZH%mdwO?*QU=w_b32=)>zsx617TR$Fc)WCLOt zB#u;Unk%&&e3gHYZ}+b^E5%Pm0gJ}=TUo-BM1=W0?BN4Jd061%S5p|yzLK#B5n!GH zs#Wa%eGWFc2BQjExz(HPz-EY3x^5@5<)>&im|8|Nl)9yu=-DI@7&Qn(OQ)d|0LE+7 zYvu$^=0kX5@n#D@rYJBw+Em7QuZp+~+X?r8uGCyUl&hyXfD@8*Qsu^(J>U#PMGN^4 z33q(i{2O2r3APp$4N!m!i+IE^B5cFkORmLeD%r_nvWV1DN9jwm5JJY|0MOE*ULC+5 z7n;eNfba1}C?G=~8K=-K#F%yVe?%v>2oWH3Yt)cEq4Ljv zrmFm{de>O(x8-ShG$A&$2rg{1TE7ZYEGKq{&iF)9%;jk zY>{$QF*EXE`0QpHiqT!EZD5-RpchA^)#lvp9CvP4()i?8LnCIoM?80a^2eDshaOOB z9o9{(UEM{k0LZWx_!I9W-76)o^L{zruN}DKaHzr&$?^za2KS&t;Ygw(>nI@6ikjQ} zQcr4xiUutMS&;yTSdqp5^~}nmR8(OcuUG;e>p3D*pWsysS{iO_> zK|$qp*o+qEdI$z9L?#HwBcm1&D2vd`*WPOq@R5Z_N(OPU3T=t7al~4q*z4D4vl`I~rUblFdj>^43l z+b2FkE1BaHGVY`T1FO1 ztyuTUe%u`i9SO|6h~Twh7gGK+wxbr!+%wi%k?6L$YG4-* z1m*c3IoPyf-F4=^w(uW&E01>w!2KABH&u;ssvJs(nD4Z!0Q(HntS(r8-$HEvXBA)u zxkd^mcz*{%S0Qd(p$LHC&05{rWQt88vl5HsTp7HpgNT-xCA(FMN=0QNhCr1UM<{M{ z+}tEX5cq<*F_*Iib@nVt#wpJM2>W%AN_4~WRkP*Cew+|z0S?baoRav%b3&*A zYBB8i(DE{t4P^vs?kp|o8~|5fyEPVylV1`wp%+P;&uM4l1<7NsHm}1i3P&t(P`5&L z)VhX7I463=$#Okz+ShRjG^!Ob*dnD91jAZcC0bB{pvASz*7tl0456gH_ zpd%)5Nq;)Jl+|#^r()w_-V|6;3M+*fah*Ujnj0Lt2~e+I)6t=XY)2X#OJ1kV=)nkE z&ZsTL%bBYPU?c7I@JaZ?Zt0DtdC1VK?k%Ztoj^du;WH02;DlTvyXN zqULC47ALzzS%AivMbBb@9_E74ZQRCA9Bf_L(A9hU?uEiUSDKoHMmtdl%Fd^Pv2gH6 zPO3MH&r9Gnf|t-qEjU2dt&f{C6%;Nk@<53+vIBS^8CPk(A!s#Y_nA}t9Ost|Cttxk z#iB;{r8i@sAPiTjl=|casA-$BRq`VR^nJw581wyibr@c6#;MkS>D7f?x!t4`Th@j| zfCX%NXJBlNC5U-)X~Np$X!<~E-kVd!3IrT5TfUj~GAXf8i~|<3fvkZtx7amqG@5?Y!7iCu!6?PWGV?rW74=!d zH+nfnA{E>}{}o~Mxtv4q7us?VfunHL5Dk*C0!rh0D^RJnd|cP(Lzrp4Ko6-c)!1$A z*R}E1Nzs_yOWvQCm}TiziBz+_ZBnr03?VCdbg|Nlj%BV5=kjp42)@wSOfKx5D<zsid$4S(G+Cfy4)Qh`aP62{%WXRNXj%-uAHPj01ebz-; zsA+*g$jsd8Y?Kiq?i6$>RW=mYC!3hjA>~StwTwS810bxs2IEvBbbvADyj{WV&~u)6 zqJUs78~#IW1=>!0#+4~|)X|bfDrlvJiWmGCi^~Frx~RAGM;gWN(+9PpDHJF&H?hZL zxMHegCiuu{hba+}iAtrw^?Pb^5OW6wQ}J3ZAe|YMspL6TC97;V$FcrHd{a?x7a<2XZ-w|6V20Aojk{y7y<~r*&0P& zkrUZvXbH0G)8N8uxwKh#2tm0vg!oRG!rLe09&BXbXTzy>_ux&g)iW)fO?g_$6$h85 zgB5fH4MnSKDapH7Yt3j-2DQuA-1`)Qm4;rWePVcH!EM#B`0xv~qH5(sIJ`7a5R?4Q zKNlRSV*4)F61sRP;!uy#@ND6wH2GqyvJYgYVw+GoE#{AOlQOhk3Vv{2lWu?je-}$tZ+X4{ zwnob6MSCMFT7ItT`sjM+`G+s1k4kYk`n<-v2_U-F?=~p`o(X9*_KH{x6(fJ9=U%>vV%X68 z^cmh+nD|#e&g<0Csk<+&d>$^1WA$}*^v<(1lAkEjm^wH0hrf0XFWEUjYN?S4Cxr%4 z)n7!nYbpWz29=pUGb@V6r_-)%9nk5wb@dP3tX7vCHNtr$HOY?59_p(4f*?u|1&brb zCx!H9IkGheFUq3+a?RGEFL?8$P4G-OKUF99em&E9X}gYDnTv8M(}V?OyZorboyA+m4mnRm~{eq}{7CvnYc8{KA~~ny;+TVZR)$LK(H* zbiwEBFD)*MCVhBwH!XW&c0W7cFY?s?awI_1BqI4{ z){G+J$v+Ose_Ahb5}q3dqDp3*uFhAiZhJ+hK&EFV1PPqNEKh=xODg)ByCJCZA+UN+ zoYN(QQeN5*NF4!2FV8BGPfLTBK3L@nyqzYmMoei$*nP}Z|EC@0G#a1#6 z(X5b933-HEYG2QL7l!ZKvv!s0h8T<^l{#J>oT7vA*5p`vi}&0i(^A)U!N}~8@>GJd zPUt#yg>U`H!8_33-QX zOISUvu(?)D8r9%#u;Lx|0CFK4ea<_F&apym|Aai!pYgJbbNakUC3So{gZ1CYct5kV z&Lu(vKVl{GAi&o~Bsmy#R@ZnW{Y*}yL=3^c67e_y!9@rtZT7d^Iz8jMy7ytTK+#DC z5NK~9P}fI!4=K2XEX7sfQ0jEVim-(FF9)d%kcUPTdI>Zpo-(Ur&E z+6)|ytMd;+73}7%*I$^~NH~L?D^Vmx7ht67ss=(#_?36+4J;RFoH$X&PV0p-GL72XQW(!*Z=01f<{FF;X(+S1CoSViz>5@YO%(( zH^~Zv?>sJS6QxUtY3@&5{{-0$CJu7Mwak?fqg>$v!Hj16nhlZyqD&DCr>wYZ(t@ba zrkp;kU+M#Dox?T88Ym3g3Mp9tAD<%tO8EB0V;t~^n=QKmFou#f`?&WI2rc|mC`<%9 zRl}=u&d38zTEH2m1yVW8U{mCM4g)@4zcL>C=BSo6NfwAYc3+vqf%oZEYfOCdv>;hP z6%*;QFN0bU8Cw<4VQ5RfqeSnwBFm9MIvRdMve!VJ#Z!PNQk%=WZE|m zm*AsGU8q>-wc8Ir5*$)oB6^D+@4;x5;2$?3Sjmb?A3O_#-Y4n+HVr@IX&P99m+0?& zXvGBU?hA=C3kR_>+x5aq%r`sRAg*Tt^+-X(R2F=`n#L+xY7IHoeiJuvxPo#%EZwmY z2pO8+yUzT=h!Jnk$12JysI!ttmn08}i3j5e*e|05535$#z?>2irC|-$hl3Rnfh7e& z>b8U32wn!xNwDUV?bA>rS+$yLtmCBU+&mOugrq)>M0H?);-UQB4t+zPPN)rbMpgln z54yf6^x0aGu8vA6Wpw#LMXLny$! z2Zrb-<~iU3Mp1a*1AeOZtk$R$hyBzbhgkO%GuUX&6>o=K> zAPSm8aaIg}v@bgKoD2ddtr~ek#>trshjJHDXE)yr#=i}qs)0sH*EKg~Z}29*&;|i_ zf;BBHoh{t1G4#&8G2)k4K0=4RD{mGs&%j}*)qtGuDc?wYKmQUACJ1c*F4~Sp813)G zEp+KKLY)p8OxeVKZ-O);l$Wxtl?BN@PP1LXIUNJrcCT@bAa@ENJL9Rj zZ#s2`1~pZHxj)u>5nu_RfH8iOPPV-^!@``w^@6+o=J)4-vr)uMg?(jKFho%r9=6gD zP!zVXEP`EOlqHX95$5)yWwZiBonow)IR}gUYDwR}e-!@1h@^VWF^grw>4$KC6+i26 z9|QS)74O`$WcH4e!q@8?@aI>~JyM`^;yfc(t~$qM=~(q?GpkR6r)8>{moH`wI^>;d z@TKS5*cO~1fq#X!BMpnV{(hoBjdj_g(Cn9E*Xr_F1t?l3h*eA+Qw?U>IaY+{ToW6I zMrR8=o5Ea+tGTlcBaxd5drNALZU3qZ%_yMMq%AXX-y?w9KM{;YITVtu*`-ZF@&aut zo0=px?i4Mc+g1kQNy1l#ITw&q&D_I8YP!lc-tp0d)M*D-p{h0yAp%?%XHSo=xZ!e7 zFR+na!2xl_F5FKZJw2Z%-k%qKVd4|ac#dTt?G6Mf6KUnBti%EVNT}UnhPG#o@-+|d z;~!!mkc$}aNN?wsIwnyL9^(LUg+hv@ z)qnk&>u)0yT#QA6nDP))1M$AcCkX!s5_g_LA8%HiAjmmY;0WM;M) zRUor0vQ-#uOJ^tisl=cljzPk*9B2Mlf>?aW@Q35QMF>H8g^PL0DXwJL;q2{&gw*?A zmX_pD_8kEk*g&-{aK@!LDcsW{0U6Y0@zz&yC=P!DgTOR1&urM;ZD3>I59PWt3CbO4 zSo7Tdwdd2{It3ok6p zEARc%QYHZwMP5#YqtRFISWcHlSTbJ1QyuvFYO!1X&?n)LrypH_{Xs-DsWgw>r7S{4 zV=;iD4UB-_PCTg5xlT8P+~(f1?DNtt2)Nnd0b2pMcBcF<&#fCQpa$;DTy&VX8Hacf zk9gc-ve&~91^2T+Pk}L1PrO@D&!>0!qai8_4n$;?bSQoU``WL!mn|}RnV#|IZJOv* z$mC=JI>Kq)pfWQd&+P7&s`}7H86pMc%U#w^F#%oc%h60BbJk@{vOf8gv`^8#CC2XW zkiVIfzzh(iyxNHwwh&qGA($T<27}cPBBpzEW&JijhTS%gsHO&X@y69Gg#!slZ)Qs@ z8_SM^X`MGSz!x@J7;!!z59Tk6c+ubSFB8dYQ>0D^+7MIa$f&Z@ z47TWh8?Tf4T@R^ueC;!poHM{EBP}SWm;mo}BMyco<4BTLaf7A`(C^mEcX%qzDO zQ^F+Ei2tGHrNAD+CX(e?Oe!?I9Y!mPFkWdS(g!CgHR^G~yjO-MCq`cPL7_f?^vYR3Mv|6$S49h0^ zm~4U2rt}R@0?<|3ofOHHR}-P?xjP@fE2&6Md|7fm`TpHHX}`((L(^U7kPKE)Q9#6own-ASLnRkek~j zxyp{l^}a4=pw~nSe{ybSUTSQgEr_eiH){rns*taaU%-GdIJcphht$V=Q~FX5ohm<9 zOvE_Ce)1XbRmF=v;(%u3A#Gc>He4w5)0`83;{-}GaE-2cPUh~--!=qTmIsVhGVgg3 z%AeFxk-IJ+ww7Q6PB8?b9nfO-4lwN7sxmLCN>2}VST+HF!La=nDQ`74RCNaT{GF>oE=h%0Ewew9vy5Vqo znh4WN{bK>5xRuzhyRB&y*3!}(DsVdL4oPYnhus^qcD_;ceaHhOH-JYm&%f@`_7!5i;bjpg&TL%>>-PAX< za2a1SGPE12P=+AhwF9NNjB#Z@FF3M9!c!AC$b=4x0srr+;2TCjTqy zb=Rn8E1Cv;`=buSNbpqn4?{DmEg+17R?IMwg@K0%cP2Z}B+?{0|Do3CXtJ^!R(M5n zdfMa{2I&g@ItcS=o`c?_r=ruN9qtz^jS1SN;roWRCHzg1Q4P|CD%c)hb-PmL94^a&Xu z*X4xRe_)K0no*pHiV{RKq8GYOoK@{dKf@-C1|oCOX(*(#vZ`qR{=Q!z-(wxn{}9#x zEtdap?#%rEMfHCouQ>i!$g37DZTsy}RKGoaMh2h|ZHuyOXnUZKd0%)hI$D)E(A^504(EM}20%MbXMeF0FRs)EBRB%*e4 z%y3N534VPMyP_Lir0svEhJqZKY@8el=)ZoleTi%*Yin8HuA zL}?zpnvp8}hA95i&KJ{V+0wSVdEyTZ_+o{diqF89uTjg_wdz9xanFjZu2pmr8+P}S z(#dX0xr-#nNhAfNGx|h3HE3)uWxYzp=ar3?D-gd;Rn(U<frX_O!zxiY zs2!1h7hS=0R~bi*7#;1r2czru?r(R7d=C! zhK20qZdG-GYp&fGM=aDxG3Yw6TFjEsJX7XedI{bUn#?Z6>SLwV%QWcvy5|H?nU?$e zpk++7I6^vU0B{t{kzs=P%N#&=WKkZKioq^qIf4Y~gqX5RgOic9ur|evvK|M}iyEMD z|2n2r1ZAy14vR`4rNncE)=9hBPG$n8J>kyrbN+n^EJMTq{)}9Iys0lrrU~GoFkw{< zM8!O>uuX;9Oxgc~Dzsk2(IJY--CpMJSWma`|*(S0XAw5ANX>;7}_52DM+1 z1e}T3ZunHT4Uw)F;HDQRb6VeS%Bvm7hc^cK$5SgqVpf`>_C&@d*bn9D;k=SH<=^tc zq?vkl2v(0H{}IWWs_fjhqfhDls{N_;b6gclPo9Sij&n!u@n|bPBELh7J(LmAm50-f zS7lChW!4Gc1yj#;Q20|6zHW}=f*fe5%N>NybSH%8Dho`PL7f7z1MaIoB}kl9z}QZa z1AxIYo?&SMW-uwse%VA+7P*i2adp5gKm;qyGSdRN-%WGhi?3D3Zp<=~9**Iz&7OHQ z=+n)h!5y-~3VD)!(oh7r_L{VxJegr|_<6Hz16V(Zx33^Tls=9!8Ji9?)Wqg*44J`< zN;l&KE2+3r<)jk9lO={L;Tx^cL~l+<#YDBZEGTNT2ZD~<-S}@cqRiS%&Ok2avoRDX z%d1!s_GhEKk_R@xR(MA({<;D@xFi7tGe3#C+m<)Rw`YM)MxbUr98PArEePV!ktrEG z#QpHDI=|v*z%m+W4c%T}uLn#6Uw%yN&u8a=SBQfx9t4VPp>C$Y!WkKWgMVEX%@NT0 zYworY|IL2uuBHXftPu?ypYSAv!?_+SZ2x<&SocE1vYvqNLEke&_Oe6dNA0fz^0#>h z5>I52HAQ$QuWQ*rAa7Y1$>_fOfzzpj96@xXTV|=%UXTt#tp`Bp1*uL@2~NvlNKJJ< zlcRa(VP%)@^L(QYx<7hNnkSB{ef>ks1c6AKfwotE?*jRns~IwdmU{tJKEE?#%&tw@ z6*#W%Ye(eAjfYFD^VQTAX`8`IgVXMC2)O#+iVIGE!KQpV@ZLfFdt!Uh;6O}0l=S1i zvDKNSRxttUUGF%66ozyhW-+e2e*oSDkC(1OeAwe+FbjGfmRAU1aSN&Z=oU^{i$S2Q zugFmq$Z#tkHZ;5=%7`I&L90ROd*W3(3S% zOmZg%fcynV-Wd+pxB$bYY7mvBC*?o&6?s74fe=>v5D^rl{N>sr+%p}zcg+TC#B&*! zEIa~_Zb$A+K%01H)dLXqz3SA=`00N_&`L20L@c=4Ni%~&?;@3^c9b^p^jB$#>UxBx zCKqNZ%0{ORUe@5@BGaUizz92-(Jqfr$SL#6_ zn^68TOpO|)3dW0@E)TevkwiFW+IuP!mU95x)U0o*haDVNSk~&BLbeWWRKF4@vMZ#- zgbf}iiUz3CfTwert2Pia5GqRAM2~Uo09~H5ObS*3hQV^0P9kbSeDsO5$WWzWz^0ie zfk7ljX3+7e0jz-ucs(De2xu?UYNx+$-U4$t*)>1BvNdlLA-$S7j_f2W?f${cFG28&*EXFO#-Qa{ z)V#1d2d0+!6lfH1lRo6ZOF7JL2ii+r6n^o=+=c3%Yl=TRz~Gt&uA9NKh{X(*$qIGA86byR3$FntT8#JbiJ zShVCAmE>$u;9k~#b{VH5qceZ43{5wKv3%hL(8*-A0c`x&TDHRt1Y$3@tNq350+m&` zA?~Wm*zr8c9}dbYLOQIlRW)vtW$>3fR5|(_@uSk8c5)a-nmGu#7v2!DN9hPru(286E{Vi%O4XzA+4l zK}AS3#}Gq8h`F*1x`$a-u<*x9vwbzTS>5Jd%WZ87U8ru6)&&_RY8K*kvL1&%P7GRK?d3kemtGQs=RJavXQyiZ?a+N#n3 z$7I;gt|qF(Y%Qz32?qxg5btIjV%nH?*}eu6lCQmLEF81JS$n_C@{=b$wS79Ry0u4J z8fMM$Qbk8lu9CMTMa?2(Gh=bK>23^@KPlAoM}4OKR<4Ve0yNas9;0gmTtfr6kQtF7 zLkou)be=$W?UNv)JL8%qZ1jH_fJEkjrpQMZlktQHX{qkRo zDoYp>jyzugn>*jils(y4(F>#8p`Lo4rn-`&wN}BA&OVoUw)&z0tx#DrdFWvEq+z7l zx2Ipr0gd^~I$Tem^|9xm8ZWY^1l^Sn@B`o2L)dN!RNAmLa4s&k;nK{Nl=kwD9jg2S#9d|F~S2?88p$*G=M?u8AE1o*?7;InBDVZ>{juI#+Yjck;-9!XR&*%aNa4}ws}JEl0*lY@ooL|!I_@K zPOBIiMhvW+&-MlGK!T9a2b$exOw1bhXBtFYpXor>%)58Vm(cM+*7wy)3n;rJ{;`(& zH+;6G(ifww11m2#eJx(b`?LebPtN9ddc(9!Q}7(8?VmoKer*}9R7V1M7i_e^oTsOF zpgsYPK2^oucSakG<=|>r+*#wqAP~m9ljqNfoDB-`B@IcP0iM5)o;x6b-*ZB!XW}P0 zKmvmh#sL|nSMTpiEKT8VV6Joj!rF0B)$=WlV%1?J@begfss71B%Ard&q%wK%3S-sy-N7C~(z8ijPd#8<> zGkkLpzqL(%HGKv9Xw0FXSDjctzwMQHHTY(xiGoN(6B(Pon4&LE-yd%4A-mHKNG6oP z>}l4T%C(MSy^7rqE*KFxj$aO}u&WCz^j+~&bQ>< zHZ6C{QCwvV+|W0j5hlVrKWSb|rw=P>X*T$IxkvlWR0;PwQ^mq0)&E($Dcd9&_RNYQ z)PgE%K#E6;oKM{+G26_HmoMK!vrxC6RP7a(^*xIMtGO(!*{w)HDZ7xJr%%<8Fm%6Z zRr9pUHN0`rQILtnel%BsX+y{lb{6P;VMEdw#Atw@Y_*;g??G5bVQiUwr3wzSZeE~g z$etM1%yJjSKoVjgwsU<-gjXd@|Ewum^DURg3NGrFF_zwOu~1b<_2{c+E3c|q>o-?j z@O*8dH*MQ2OtZBVYR^~s8w1%)pd!7=-Xd28lEgwL7Znl_nEZLxp@UBA5gTBLNxr~O zh=F=_DROCH4k^cUu>Gv#R%bN@qTB+l0bt#;^SU6*D{lct)REvkP}3ZVT6wW1oh%Em!5q>1H>4%Lz?z|ijDO_ALD;6t%YO>~(nUZEwVb0CltJq;DjxA&|S zp!w3)c9G^=BPk=9$~n@on{J*i*b`(yVSYGFN;0Y3v$f(piHcyl5G_?;+q;LZ3f%z| zc64^5zKpigDY}17WZyL+z2H`E{ZQ61`4BUCwlztDRv87P7lPwMBQsFDcZon!n1+p5 zgCOg8fkUBk-KP=z@_vEu9AQMpnJ*FE%SupNPOztyvzc$C+)TTf_GzT9HUdl0%BIJj zE?mHsQDxTB5jpFCS_#|T{9K^<{A?sWWMfbSq6r|G-->~{#C7}NyKCD5gkb8R9NusB zq;s;*p&#t6TD0__<9o3POqgdQrvVACsM(_Xr*6dw6%;kEQ5mn*4vmj>xS&Z>)4bcVe z$BPjLd%R%pD^w<%-7rjmZFM^`v)#FycChjgOm93AkG?|U@PhqatJJS+1C@4km2NE$ zIw~rgM4h^Crl<_6a0CNQgYQ+m?6)X2Ba)wU2)8+rLkI`uei=kajv$V8vF83ZD5dRk zFd4L1CQb(mSPb8$$p!%BV!ttNb(4boMS7glELo*(44y-3U)LH;fQE?rb+4l|9#Q|J zuC6Um5TgpqGCahE$Up`_?0qDD3y=}A3uj^j7bG!=OKNW)zqV0Xz&TD#Kd__{Cm=DS zT!Ht?M}jkh6B;lHMXClQ8&nu5i9!8UuzWe>4-3WkQIw6!z4UW$QjLH8PF{@nceSXqz+Vpe1bpp>DL&>D~=AlHwu-e2Ukd!-?H4|&i$?}sj7q{Ou@v^jyW zKT|FzWyqLZf+iFlapUt-A}6*yVR#Gak8eemFuVgsUb_Udg>%}HF)*AlrbKBHFb81X za!hDRSvY0Yr#jotwNoUc#ig3~4j5ihL+wTO@-BXGk&=zSn9&Pdv3HRUff-HNShqeJ zg{5=FC|`JSfpFXc9XN1f0cl;08rZQa>_&joRBMT?#dNkYv ze|QE|g?w(1Mq|>W8(0%=A!4l}4!(rG{hj;-MJvhi4&Or!Y>fN@`Dc*<dp)@;(G_4W zX6JO8hbV5~k4?x5lPtX<>tim)K87j}kAmpW9S@LPEzhF>Tc&tK?h6nkn@}7Fe>W^j zr0H}K&*_>nzv#djie;Ec`12uF5_3%Qg|osM^$hm>OeT&}5GJ4NqxYV?+~ zo2Brr5#!w;WNcDZ*YeK6v%0N9%7>R^O%^!^uh~iq!@6kH9=8gImWseo1;<5sRVLs` zYKa4~y_8=i^75Qp0r_w#Z9sV(`UdhKk~1!L_kt`5c#kAJL03>us7_UEgjQAVs>F$9b!#!*7A)S)0K`(O+4at8cJ(sNQqEb{ z2zh$q-aCde;NS)NIsmO4tJxF0CG*hb>9F>0HuTDC?}$1O7|C_V`mVL_x2fQmOFolN zU0x)>Or`ibwENYe%ViOOF&S_C%`H9Fkmj}77dLb)7by{j^_({vf@|NG(m9~vkvgD| z_^+PMpkBee(`~r80){NZ@)c0Di1iVcFr27b8qqM3q~Qw3&w$U=hl zx<>~$%;5lF3okr$HaF#>TcI41;b!`9wmUS6ERUS1L7y`qau1G|_>Zajw(Wcazl@?A zfMxG+aMa41cFmxnkK%NB74qwqz|5B;ln0!xb95XiP`N92J_X=7+4Uw4k!Rti%}si{ zC{6}p$;F6Kt^|LL*&i7HAK2$xvh4pjT>twZ{jbB7iH-Gtta;A=qQ(b81AQ8N6SnjjNGmvUpd;ey-@>PcIN(}_?M8^u0hcEvN?w{MqYMO!!H z%s;0l1IO~7g`!tu7U$e6Of18T2 zU**|9NN0-;m?YP~56I5=>TZ4mMelSFM;-r=d;InDMsB`rEYoh5l4|orJE`dC*zmTG z-0pcsST=6Kl>eqmH5^_dDOdCF`=yUiz(D*<5wk?J7VjL$3SI5j3&{uaFcj5O;_68x zO!<$)()sxl_g!HlZ)z;6MM2h(kaY78sY>(NDW`?lB27fJnOk!xV~I5SXZ1N=-ez09 z`rPfg)J9`3XSC9Ms}^f>?Wq*vQDO>xf}sgI-kZ26oJLsA2@ag72 zciMQz;3^HCRzxq2H=s1?|2@v8yES;>+GT8PUJa_ ziwO?2257(#y6i^SVXMYSF(ffMziwr&I$>bx37M~0HDyr}WN*?ak$TN31(@5#7qnz5 z)zx;Sb(FIk0vaUD6_j@PAcp00O;<4JRNp<+Z`jkQo%FKpO`f;@hGSKC>aJ?HW<{^T z;bk>rQ|O7-yBkANDW^PpOGnVkJoNc#>vgGDVOXc9C|cQTLgB8kzA&r_M6XOVoj{!s zSV@!jF5FIw`GMvRfkn2haDN6FFPpOQ<@jEs1=#z->t%gy3zsDP$yNU5c5{ysIT|JM z^BSG=SL-&v zhC~V5O!!(5agOYGOIIHjn0s}svSLeWOUOiXyu=)^pf;Lk+SbPLJYWne;5$Cq;;v-! z0!K3eeJ^DtL#8fdadggVHfcLkA3GxDP{Z!U#1ht93JTR|)X9W}=XKJnaI=>PW*(5< z2vN+DE3)I|SO@qVfff$1x_B=kDO}V>bxqO6gclZtYz)e1R`Il@k4|$F%g#d2AxD&6 zN&PbxU4@;eZv?u}(SnMFY+Lz77VJK#dVE4JAq{XQAgyF_Ubw@s{U|G)&KCkg5>nYf z0W^EGnnJk%VejDkEJ~D>z~rt|3LO^85X*G3m`pGo9SC2I@bi$P{?*>E-S|1x4)95A zl~>lH&g2(C=N^#vBt;SQdHpfgv7n6mMYBh&Fu|1EnS5@MByDm#d9}HIG8$t7m3%L_ zz5!)VDmojwR|5K25%eySBtG}D)KFELO6LFy4N#*)y95PP3Cwh-vGE@U5ARZVz+`87VAe7nHYRFqQa)J z|MY^?Zv{SLtk*{ivT|4w&1Zwd8HGq0@TU)}Q?mWBKdhk}W|B_WvphzJ^QNrV;FfFM zz+EVVoEFR!NB0IY)1S{OIo$5K-5>K;aJMx5V9tn4S|+NuYD@N+=J3MY({n1o727Fp zQj6rTF{n5^d1V&WSG@NFC3p%XUGM`J(m{2oq_Idv)oh;2>qBm0b-8vfwh=lZP87A7=Uje{QX-+bU4B#he~wu{%;0zd<#X7WI3P* zkuGlmUi;P~?z<6sZjbnC9iozPomA9j+;0D=FuRAV>9TUSJ0d@NCh{PaxVOvcKw8fS z8tSZ@ze;DVS?C>d+HMraN}M#owG0Z17R zKaGuT+%Yj=mhHY8HeXi)-Zm{*<(&f|LSK$3TDc$d=i(!2BNl)Wkwqlj&*KVAUksze zu$Az-uF=a{I|>LdVEuYn0kFHJ`1;>%O-NEORB9zgEeZ z`*W~dsLIKdA2oN@r0>K)J(XHHYI2J$0fG6wQ@p_ak5|!440*++6dr=N)9!0+&o9d* zZZnnERELM5Ky^D6H^?78ZY^atauIXn%m8Bn}L21W?;RRhlQm*sHnhe8vu>4EzG~B9X zr5ZkesRIwo0ilAtk@5=c|Ut`H4qaU}FAxBLyxP6C8Vb}Jvu9}xJIRl};$7GEb zNIY{4pq}r8+fNe>RZEl>C|805Lm4GEQ$Emt!%erZLiFZB5(#I>L(O6x2^HIoL(Ok- zIMvSIE?7%gO)X7u9lt2Fv7k^J61Gc_(_w|<(y8@?+QMd=MI;3fmG#NeuI)vQAJD4X zHc@Q_k7CnrBYX*&z=`>9%70MCyuHb-OpkD2f)XMrX(=EJEdg=#6^I#%$ShNlp>;`? zpF!cC_fnK7Vg!R_e6pnrx%K%+$`m^!So_wI9s)O5-683oL7ZfkUid3ku&z;_mZR7? zcQ?5$yGVIxaIbW>dQBFP^_7z_k9V$2Lw^-+wLJf-Os>={5<(WKG++km$nEGnU4{C? zZM!EyI%IPRV`+BVtJdBB0$e9G@xU=0@PwA4ik zSeqhqwm)~reDLiAIOALY#f@rO&Qdm>%@Uy-viu5CbxrrTTMpTC*h_GTB`%IHkWn4+O6*Nm?g>!>1rq|_bXRT?u<(UG}x!69Z+ z7)+YZ!Ys`kuaHnydPk!g)HvDuQ{A4%d;2oqnW;$(9XP_q`=mcyY7>d&hi2RX9UO|h ziI89ySNoXHUT*cR*c<2|@L&8^5F+O9Et#}PnRNQRkgsHhwLd_a%y{yI%$aPg$Mj=1 zSn`-afFeAhR|>IaUnNgmx3cNt ze?;MIEOeT2v`6>~a{DneicwY3{HtA*+^$edcBs9dA_NYS9^5yPx2>%e@mkRR@#+i- z4W_XX78b3QEz5fp^|Z32jJ=vnvw&fbn-+3kCFO5SGd2#|*L;_}6o=4|q1%MR5FB*& zllDrT>ty?2n*1iA68eGcstwG&q6^WGoBleJCv513kQ!OpLDj-)u?2HI77Pe|mu&7f z3dYXDmzh<^%N{G@#_84X_x*u^gED!_s0u~kV#^YYfsW>xBmYBeD9;U()>W0gVyk0O zr&T3raC3J^2#|VyTS~+Qmk&>frWkM}AHAMKCi1~t8g440O|X258r{#=lD8>`i-&}g zy`|nJl37l0-oFnanBo1zBquXfoAB>E{x^1lKEB_1sXlYpV8_q)*ZA?=#YYr8u1hLU zdTwgXk_q3rF3pFrs>4n)SAl`Dt1ucE0fSo##midEd=UR*X4mIP zy=JxFLcwhyg|4r!@7@0Eo&RcQ67N4n?th8b|6A%}V)%dQ4CjAxPdNXV+>@!qtyRRG zIduba238RV`rVCK+_FhZZKvu;Wm3wL!36iP2!Q~we$1sUo1A~Gu9GL<;3FOr@{&-J zAdnBokEiqAH^vBJwBaZ5-=0mq;enlzcyt**tg}9~t^MfBXj0!xFW39ATj)*)U+)6H z;h-RJ(M+(lt?2qbeVt!u_JP+*3du^Q5%$_Obi=l4@JV^_XO3aF70cpE&C|N6IF1(%+DA#SaI*$z7F@Y`jF$x zE0avVC(&S{YeGBrlpO7Y$IonqwG*kY8bgGu{sfgTs{AYZ2Jq;84mk3d4ILxysl<0U zxaH@+8w$ivM+HlaQCxWLgBh$9&N~+{q~p)(Gmm&Yc0w>$5?mrkIgBijA=lCEy|rib_&-G#x^p9R}>1D z78Dx6Ic5H=h?(r(M^v#?Z(zFKR)gW!lQ(<=aZVcjcY7QBPD&b7LF%4B?OS*4i-w|T zz)IQO9g3bEBJ9g1OgG1~G0h^M3hIz28pUN$l^@1v`- zrw%h(DJ?oYv$o_;Pk%}W1)dsxgk*9DmtDY$S!^H;Z#?)%jY}vsf!??Wb&}*d<$>e? z(YO|(pSKcXG~7(fcKn=6gS`zpSJZKO=}rx%FiXH&GX}mgF=95P0(of&2(r>BH{|=y z5+;-J?1Qp=Yn7U48AY@M4i8OcuNaT3aYDnn5|29Q(p`H}>6Y4IT^wa3WH zs7&m<1V5>}foU3&kBk^qR!RKpzmhAaaJ}`xKUy>#(L@fdRSK6dj1!>;F7AAmol}01 zLaKh;n(HM){5{H@>ACrsSPVhnMsV!O>~4JWZaFZm!ExE+wR72LWN@-fddu?C%_IXW z;*sa+^c1NJKw{3#!uD^~Bb+$nO_=lgE-9AKtj_F@4~W-#P9EJ;f9CN0YSoLy??d16 zLwYo)^$aXit<`7T55p_->U>=E26*E=B=aXsIsM8lCVWiBl)xA&+V=upb&ttwxHEj( zP*d`X()+@6iMA6*%bUM8p))&43pJkouGUtwG*tmug6h?dHq54&hsSPa4Z^olV6*um zn3y(B?e&}=h4dIElEuWx!zhdPQjjv*V@)nJz`D@JOhYOfrKc9~m45HR{iylM)u@Mg zrZm{x{4qc4KG8ChJoy8V!oj;_95`6tul@=x7B7YAh-LQYCEr32@_9vcKtLrdbZ}~- z>bbD`?>35kwd;4aX{l-QsOb9xN$w~G$c$7=(umRxK(Q%KmUdjtFST0o^hS}YlrwZ| zf*jH;95toF8u76*WT;o{8yoQ;U!d;m4uOgU!Z){1%on$oA?2`lY6n$?N|6&?@H%gu zUh(1LSIk;lFP2zw>=+iPcuE9ioO%2jq0phzS=xayNZ!!=Z)B%{Fs%(TcTvTR3Q@H4 z1ofE-w>@n~wgsY|BR)i*lJXilqaVcz$cUsVSHPCp;lH;+!-|ww8dc0L@xME?j3DS? zrRS*^+>7gKapit}n8EM|kSk;unlf>{Do{5RkQSgXm~KizF$rc<_kz-M_d|crDKSc* zzp=X1UN)3TxD4%{BSAwFKP|$#?@*jQi_@LU1y&+|3Z%~v5lkZ{qE#=HF(wPC7z2e5 z1tbfNC~4D{MersTmJm$>K!fjoXAo%?;(H1jxN?V9JUl>>f`B_gy}K18KXU0Prl)~# zD!Csz&(*GfVwOqkJTiGfg=LNj*tfEj0(9?-g-wXXtem)7Ef^GIDi=&5I6h@F!%mN0 z?>{YqR$v~P6oA0ha6CJX@SgJiuo9q@T^Y&GV~Ed@Lrpe2kogroJ&(0Hop1mOUG-KJ z``uZN3Z(PHWOxbrx5h({oiP@ZfnF?F?_yQz_%4B8=IMqg?zwgLH#b^;4x!=253J!j zQD|b5gug?b)E@O(>p4kp&dlRpEzh+lcInHT8SS|%kZF(GN21DDau;Y(uq{Smj5 zrK8xa6ogGD7poUR`6>zQwT2&6<7Dk$UPfB`yld2R$n>3Jy7GFr@N}2M-|(f%)_3Ts z)UetKW%2Mvrrk4*XniJJhyANIU6djsgQYMbT5@n2%wE2a{Q|VUG#nYGfKHA{3L}Hv z%)tyx**t9F5|(gl4IgdOifwn9Rcc!*eCNDpIE%2LE8;_y#-oLGPC94Tr0|qbkZ_Dp zi5dLYL0lw;voUYRL^@6{v9ra%ckgo>TYF!rNv=6U8=RN|uzmd*7H?}0tWD`$jZv6y z>l=Xc5pA$g+ZqtsHJ8ezc>ZrHGB2RE7^=LHvtXq+XUZE+YQTwfSCmiY5JMCoh~Sn@ zmgGuEgC;IO02s%k3j}*OKqK&rZN2rt4GL|GlfckS%_5BWu$rrdD99dwV&}O|%Tnpy zp6#^3l^t8=3Z&@`>IGqZdk%S(RO|;=(z8sIAk!%3;hexR1m(P_`Yj&~0!$R?NfItB zWqVt;E(w9R1~Wx@8LIMD0T56PM_OK?!)0m5q(*7>sF@zf%4Yc z{P!YS6nM?JV!q~yZ_B(j8fs#ddr|eWT>fQ&T;%OhGF!nwU6`MWFm(r?6f5tZC);pK zoKdj0qO}25=BE#(|nIph-pjh^;t4WyN6HHCa zO>tYdWr^A#yU-Zr08XNM>&B(0rx(I}j@h|r=|T)xaoz!WJHol0qQnbi-Hifdn2kd7YG2$zZZo;#ZRM6BD6}o;qKlayW7K4`(kXeiD}*t&=s^V zMR045-&Zd~wc-Y!a?U*J;5Gfag2*=+!6cQIT}}K~XA7lkmw99&N3AP*AL+D7F~?$C zR6F6hdPsx50%2rdTvXJ}KoPFzVUvk4{1xYiDC1w-5v}UcvYtOok+o!8YF|Qqi5P0h z6`=7q00%3ZMx06CvkF~k)<(1wQ38|_6@ZS^jB)X}zp0I~nO_>>gYpSH} zY2fMi-h6Cixy7S9jaypj9a=^Y6K+K9L^YZulprj@77i^LCiTv@)u^SdSk!Nq*F(DE zy`iXUa4OhT-9xJ^wLBl#l(WECqiWd6Zfh+38K%7HHv3;lI@UE;rL}oR*usYS}#_#sC zBc*H{K%3zNr1N3hXDzO*P8gMC z%KEhp&G)41PRW+{smPmc>G zb<^kXsCQt?aa7r0RZt6^R>x;2LRll7znbSH>L5imo>V{?5~bJ$Qb#%(4K$H&IvNXz zI)0rJ7+UeIn2)o%vP#RiQxxvrE*yAUEf%+s?76~#oPpUD_V0r;{8Qu`^`)|2&P@gv zK$~0y6=|Xdm%~^eg;$p7@r`Yd*0gcgK4kj%ScJlU+w8&BAfhjxSPkjkR@(T@S*url zV+Cib=NX*rfi9Vl#4SQZX+Yn{z4P}c%=Wuub$W?5$4&U*x_LePkk@_J$Juc{Dk zcy!XT7Jw&}ynYAyM~Fyo7s8Lp76Gp`Cdun(euMA?W+gn^?tP^utC)$jy1q!dAY0bn zarRu^c2{M5EYVO)zy(vwRVKtU`9uIyF0#ZVz1pqjwc0VHV|Wzn#w~oCO2vMc19@Yo z=oQ_boU~p-8iSE8(Rs?4({W-al8o}hmj^-N%yQA3&1EGe$?G5ex=UiShv>QNVUo|5g0JkJGt{V|TV(a?&wpdW5A{oLQuC zTv_5t&uAg0I(=XBz^-aEIv)M<7Nis1P&j3p_PQ{Sb%Gclyy<5mhlWEWC!*8!RHc)~`IDHYGu}YnGe4=7UuzM2SP-j@f*&3! z7P`iOl61L@of!63>Nn5U0!EA`CWBH4PnpW}b@jhs{ePfgwK0?a(=Pab3>X#$*8i~! z7#aQ(0>jAgzofuyIc#jySLd}?N2+s~@+d4RIZXahG>God{@3=z#wswTx({;RUv^dfj60ULeTi-Y8uu3S5arTB7$ zCt`)%|Dr1?fo=eP1^s048Tt5VBzU|AmdWXmV+u?#fN;x4(QfKS@vEyg>O}{K{n&~4 zp%g)uF{vP{1meBZrmK)r&FH=y=6Z;@wVjlz(f9G?l#Md zJPM~xzuP@U-!GxVlIR3QIc_Vj$#Y*k_mS&1>JO>n*=Qi|1&4!Hr{b065YHO0Lds!$ z4Yl9Vlt>qS>Ty~j>Xhtmt7){qYgV_iq6Pe?@6Owit zgzH?HZ-A!KH&UjBi#9xAjrvJkDFpt|dwqMT!yI)z1U4gs1`n~`cES~` zPnAP4##MV@M`S}Zqx&a9g^v%+vH&&2je6k7JBM4yFb4d80#m?yY2&f1<7 zfxU2fFATj&DXirn0T*Gs?GPju@%m-MvLZYZzF4b!l7xZ#ic44?O<@Ra*ue{8hT>zw zO33|-Oo!+m4X1coVsTDo-!e09`#yL0zLEi$T5wpWgto=A zih{7R{m<~caiZg06WHw6oP)ktPZ(srWY`4wx=AXbRtv0HhQ=8VKJhr6O``H|i_C7* zID{Um7T z#nV`1?QEuUpZBe4c3L|<`etdQzJTL5tJ+R7!@MsQtn3eDCa)s0_SP%|#}%+a();nl{>s7?&qK0=Lzj>~|4nJQUQO?@C} z4mK{()KrmzJb=1jqf9kVK~0N{!S{|jOrUPopSGUNRP9qpv6`)d<6+n*P6fom?Ve@b zc+px8bX7rJWTLll!f>pgw2>jzG?1=*tF*$SWe{b_6i}f;hM?Ya0N@KAT8s$4=)5?}K;4Vm~e%n*ix2-4q%v^=}HJJe?Qp_x3nhBZDr9m4iaxuFdOJIto!gDXK>$d z8jChs!2DHMg1G~5El=!3+D?T`@L6HL&~SpT zAZKbb*RD&K8MV-HY~x5m80g%*Ap#qyr>vGk%h}(Mm^`Bek%z>~)SP;EL-QukzeVaX zXcoKWeX-yeE5Pw4&5lFE+|`PJG@4j<}dgHIQwkOo;|1wVuzJAhj$rNye!X~R-K z=RM+)A-#o#C3xT`UmT5{JE&;*HS)PO@BZ{G`I0Zw!*^L2YPNk}La_a_x{y&l9X4#x?RZr0Gn zF?N}}mPa;c9g_%h+|qN0m#(a)n|l$_VJPPQqCbsxlh6#F?F~zyau#k1iaYPiCTG zI6*wSzqr_=qnEaJ>TPlsG#vU-9Ah%6BOJK$jVzc6Q<-Ls1K5w#v*gfjUPQ{)aU0g& z_`5)cMm}|G>0Tu|<$l9J==Z@Tgohr9*tLg+6FWPtX^VPPef7OMUNxS`v-)b2_e2{M z`|LeEVR7u%;4DT-vo+#F#SzRfIj3F_#>Q1apU~{_^)nCM_0M?Gq`rUXz*BznGGNb0 z*6n*S>J{61&Y5bEjx%{dh9d+=#{|_X6Td9os^=8-2me|-e^xx^wv;=9X^PG_-JMGE z+~g|NvB*Z>knOl|^LZG1umI&f{Q+N_t9#K7cAl&=-wa9dqwU2K=ABBI`LE@g=-CGA z=gm-A@aJ_ztc}Zl(y;Rry3+2i_AlN^jH`RAhoC(@9ClsdoeEX;D!AfJvbwR{f=8{dA+Za?2%Z>c;PlEPG${v%{>bMt2_FK?()6one zGBHJQENVg&lWOL?qFd3*Wgh<1wF zDoA9u8v%6>PQq;Z3blK}5L&y9<~;bk$B}2>DqnwGDzsPOrQOGfyhniyc9`5?oWL0u z!kr?h4k7!$a__Tk1+%SSe=^fVpL7@jycm;B_4NMg%>!Or=ACO9a_0u~m0_7&_wz?| z#JsTuojW$EptVdi$XwVjgZSGG@)cHhdA$EF-}&|M?48z zkEzjoo$J^^vmL??C|~C3 z`n2CYs5WzmmU1c?wgb678I^A(40Iw{WVei6@{ zB9PK{=dkys$YVZF$qEJpuP=0O!uFEI$tK+n2xNIP3clwZ0LT$4dsPx-9AY#%GJKR+ zp5ysi#_VXk;yvYVqK0?CHD;h*N)wful}z77{(|<>d-qgI(!1QzY`9h6u($ooc&>|3 zY&q{*cf(iGwve*|OP?(^kFaU(zxR? zkQ?~g@Vrf+m9t30U%*snE{u=2_tTRS5rJRetU^^XE?Htn-a5ED5)Zer~ox~ z?sd?Jd)1f4V1oWVY31~Q*5KTfXw=}8j`_pR6Aw49x}5iAyVZwf_P}SlE_p;@>Lcpu zWP9!|IF9ddX6|~PHk2a;QHDdgXqAupJFA~MzLJ&LwoeNZwVRS!-?!qv~Rf_{e^^ zC#vOxMyskf8d`o$gzJlxUVmMUe3P_bEs@H`u}MhHD$6E>`r`)L;h@$gC7sB$QZh~W z5Afc_bJ{EWvkkEUMmd8!vHQjPF_2!pggC}8-k{_9?P)d|cfOcHEwPvxfF0xrLV2Xw zqxEXu`IJWlEvKdHa|PCj)H6ov()W zhMlduy?!i4PE+Hxf@hL=s7^ylt|5o}2vHqLRJBKo zt2TrR*eDG?o$M!$|89qEKeFu;kn;i|{dqe-Ta|I5?Q->6#SF#XwT&NSHYIL*zKK~= zo%!Kh(ayST)RgLiv26_Rmx36Pd1*|zp#N=B zqR<_&Sf*A7QrI3Wan+BEHWgfgq=TeV0)KMptilr82+5w{si0UE7?|l|_fg>_heDEm z)FYzv>WdC|olg-rdSg zjSTD(_;X;iM13i-^*k~1bgEQ^gjSM{oHP1JRs@{YDc$=6pu)(SM& zheTwcR77?dd7glj10!Gy@Hiu_=WS9yf_l~MptpL_2g8(!ugKqLf6Vdx97CG99MNcGhF;}xlE6zB}Jew<$++XhvAb9@m=t>`5 zY|AcSWi2=OhzyZ(A;#QQZwsYmM@iE5gRS)bt52>PUrOG0CWk(9qFFB<$eD;=rTp3# z2k1uDSh8ywlKqa6nT>?hF(`VQMq&HTF)e;8maY@8F;;`C8cN+^ zMkUjnYB60i9ES3{)nOj2rF8d!wz}bf18mXERTegqQL zU4p}v$M8}Smgx1}H{y@PbEKiNFJI)eXTT?8bb|+vs}e6#6F2JAK{7Rk8@4Otl3$JR6qdk~ROgh>#39uA z{Tav9Mu&Z!18IS{TdLFMT$lSUW$u_ZMd!0f$6BuzY;nwwI9&6qv>iS?rKg-rMO=t= z&6*P@z+r;~`0&$7tqm}(y~0u2Ukh6!1~sOBWXHG?-rMuQ<_=q-bHuj>$0sMBWpNOAA45&qd|-W! zFDqGl6o}o6=aVHpo6mg0GU>BUW*5Um*vkyh4sNldWI%JIHI;O!*{Ph|AyQXt;k>KQ z+}DR>=8AAeYHxYDY!qft{dKaf&_H+9@xz(Oh6--Y?ZDQok1r1Mme6osVK$X$T)Lxl zg-l1By3&aK5i2e!(?usYGCBTp5hg>4Z*5R9_2DC8@wC9f9xGo=R~Ff^$f2abKMczk z@x9J$x+u_}!p5$of`7)B*Uu`KUixaXUxYj<3`)_saz>6+hEOFrFv1;{Z0i-9B5nMI z#>PdzaXr{3^tYV$rLDE3wuVI6m~CH(BM2=0a-SyT;Dw;7?D;IrJK0>fb7b)jSYGrf zKCZXZ@Go>zj`>S4Ba40DOmr@U=N)~$$O^f7vtNyf4(31<+)ufq1bG3B6CV_i~Ls}X0Vki;Ky@{+nm_l z!n7c9;hcmeit&tOVOu3%}x09EoxW~_$u2zHg^##^k`Uyze$)nNyA(4E9uAxtl2J= ztIBtA8W+292ZUpMjxO0LVXwPr_%SRi(6zvsoTmb8Ce_Q@$ktYkZR+JOa}jbXaIaLD z&s6UEoR^v|OUqbZGZ?uhLDaJelhSEFFMLB^B$YU6)Aa?BMK~cm6_R4ZWDC_}-?iJ@ zonC+t zz7jRvjWNXLBqHHL53>fX9_BVN?~Q|FIY8&U;-uNK4*w9;xczwT~||_ zbeYqNx>LYq_B&J05senCH(ustK8IIj+2Mt>ze)9Oc5l4EycBp!*PCRa_O`t{H`7bq zO6WjgZ-5leZ%0ij&fq>n=j)_nDS+W3 zVX-*?bD${%4@8>Wk60QlQ1|!alaxb1Vol7KlSZ6hhArliG+ZGt0>8-<)9o}tEkdOU zIw6t%JSixhsVQkkW-3fIGzxYi7?7s;CJg+$Uz^TM(PUpwW_eN*A#^1}?#@VCvI|RF z!Q%8Of{%RrTbhvKDCVV7XtvM9^)3|f#819IKev40o9;&7nLw$pQtF_xozr&u&K8Vm zQl8S}rG~+D+uL+%04>WK&)~>s9<#dx05-LYoX?tMy|kH1^ZT5pA{#;Nwf$tN;%4u( zmkQQ&)ujTZ_ARkcRZM%xnYdh(86};pJymUH&xcW{8dM@*7bs`@**VOr&<%S|xtrrh z^L2}TY#ZtQA|SB3It`(bIN?<6FtF`>^@+hP$b*})hQ%4a>gjbJ(>DcMA6_E(7XNC; z{f^Y+I0kzAnI@(8CWI2*`Z@jHgy)4qwdZhUYw+KD!$T(O!Qp%Aq=%|?_^Mhy5aY~! z>*!rnWc{AOV-+L-Up?C&G*9{1()YE5iM;e~!IXEV50zb`wweF_H4$`W0`?YeMWkgAsZ#VMqNY;?N}ss~mz+PscDaU0DeTwJ&x>mH4N(=NvO29s#g_A96QiBK zvMER|dBjPxP798*Pd4)`U)5mC4}61lyN&oV*WV>F*$OV5FWgANL%MPmf%vz?}BI!%cRuOSdRy{MgM zHR0qs$6?k%u3zxmSLxH2R1aF+Z#r`>~K-G4hQ{5f?s^khK(vsS{Ov*EBZU8PoK+g&#gSZyxz^W6_dV;|MtOH^Vq_vrc0@KZ|gE2kEo<9YDg-g zE3HdVKy`t%yh**}7G7voODIU(2<(~aE@`<|9xI;^)l)tb^aTAohJ}dbPvb348|$S5 z^JO}rNmsN;Jhd0SJ8JSzw^h*iu=PoXU-k%^K#bc)H#-3MbYoB{6QLO+Ki|^p@_#>0 zZe6<#IzdFAO5w2)OLi3Oo9`fYskn7ba z9#A^WVnxT-PHOqqItgEjfMc?ZZvcY(loE?y8QM=w@dER9=7)`^5-h7^7rrrBx5Wor zO*C7r@mFjfM=2xXD6YumxG2#N7TK^{N_uOC22x1$wY_}|L6L!4ip(Qzw&!3P(1;!> z&rF(xOnznNRq_P=B5lCeFQmbZ2t)2e`P*c3#K-%mMYIQfvQrDq)`Bz37FfqOn1*c0 zBodvo8$;U^)+x=5rdnN`>mBt?1fx(Q8NPNYt@PE7>|SqsQFUPD>|Rg6c6pYhJxh|q zG-+9%+V3uI*4kWWB}8LEfF$i(#t~tO>$Ki}A)5p>lD*qVB>zU77Gb$XD-b*f-}h>A zi33^)izF=wnG_MZMl(XiL0ZwFTT#IO()W;0r?sCxLasEWZiG2PW?sNGEKB1EjYi_r z65F%yPO`#nQ@&ve8Ewh<%U6x9ogQ<@Cc;NBJ~gRDBX_wDP;z!B8+{&VG$!q)= zng3nFUEtlwEOb;!aV$ZJc-`vKhGF9DI}7LvvYgPDlfrk<{-5nm+E8E^5jtZZ`K$;! zZJo*q@zn|lm>_L?RN>d?ffm>=_GwQxR-e2{4qtny-4MIUs=d#ts{8a| zJ6xjz3ma@9o=Vju2~aEsty8Y4%dt|%M$fWZNM3Gx_FXf?Ha_HG2CF@Bao(c4XjhfQoxxXVwdz(w{ z8}JP;0~Y@{PMGZGrd; zWD{GA@syDHo0clTr*86cI&sA)9OWcMi#f)5bw~dCS@Jo_%-{$TWHR4tKL%evOL4~fB;PfTuQ5zQ(0Tpx*cI8ug@AIybor7**Y45B z7d<-a+lff)UBOs$8I!BzDPx&GST2@ zJbZfiP0ZSA`O6oh>&ioI`qIz!<|cGFO5yFDFKa$r2m4~ObL{Q5+6ms_%|O4eS(0W& z0=v{g;=?RUMB1M%!LkFOPqeu~NFsgN7*|$Zos1eucYE;`aSKwPpL6_jk>hEl>2j*> zvRCs3^wskSyNKqZh3_H0Tl_8RcSKnVU~O6XS?Ff+Usz;5ZM|d&#)G!G1Utfejr?jg z-C`pRfsdBiI1be~O{p?ZX)6gwUs?dbAEGwvx@Ok}}xTT)i!n)qWJ_FVS@r~JNck7I3Y z%NF{BQ$piMP1kf^Bq^m&+NtmcLbGO+!{we;`AN!*L-f@Q4^btw!cu#UFZy+BUVIMM z>EWH|5o0hK3WGz0ptcTvg1X=uoD$?^u*09~o`}y~v_D-2=Z2yGw9@!I`7Nml=A#J1 z@pC#T3XeN;3YPQt<(!R&;=1ditA(~c*2lYX9G0Q#*+XqnS~|1eyrm zc$ca8(3wu14&%TnLkip{0vbyg$HU3}l$V*_{iIT1F7Pm-?1@Pgs;=~7gJ434_}7`2 z&9=RGrctMtEKKnSB{La8;ls~$5l~qg${ejrix2R7R)&RUcEsIXkjM4m6k(HRwzQMA z?G>y1?`U|Q%sW^HKoe)v6WcM*j5YK#H;@){6{L)P;5u@FO(=QSAC$p|J2K#4TPpoD zcWq3D64jmOu|7ld0oRtoBPtaS%ML07Gj`okT&RIPwhzlSu8-ntfHO*+z^GA|l~Z9p z8j2uX-0$O_kLeS$;nlL01`k=wvrsGU*CE$a=6d6k{d|sdx$xU{Dp;`H$fvnp+|s~T z$jkn&Bx)I)cz*b{#Z0y|Eu_>h^8hE>YB?z%GMk*m{A9)4ia(^e6(_5oF{6lwoK3t3 zJ0GTpb<*qKem@FFwDfYb`7I=@9pb)ch#R*tydTHnB+mTV9%iUC7FQCRaSTnapTL8DT!CdU@ zCZ}Y(m`+E>B|ReXQa21rlF)t%%=NaQ<~)0~q~hee?o+%;f)y%OTnpdsf`#bbAeAH#qSmUGtBLsp=-$EH%|O)sd%%4kM&HjW!|_|d&G_%r$}lqi zm-EU1N6__wzN0pz*%lw#jRaHgRc+jx+eO1o(<71a*4}SbzAFW)0gSTrxT*XW`wsZ2 zacJC>_?ALRw_+>!wjsy!?TLJkGc}xxH0W==x7vI35Y8@NccEuK7@w6J^ri#oH@;10 zHC(K11`^Uv<8F|SV65NKzH@K23MUGB0mxWO~qA!m+@uM>q6K-Z?%N z{cyKtIyU8nsvp+RlpBuFxZwwL+M@$*|TkScmjsc=UwXt zUS2h;(DtI1?hI|7w$kht8J}w0nW4S0=kHs5n)7wX<8X;?7eytv?#L=XMUxXvwz3My^mTJ;eVSY+la4e3q!9nUh7vx!}H+8sH@Hd|brU{Muu$ zbad@y{j(cta;+y;GTyr7LI!w=h%B8K=vpZ`aSe(w92|vK33<&4bDST_&SayX39#u#T|Y@#1YcoSQ*=oX8s zfzM-N%yvZ2ju7J0SF}TB%0(aQ=of%9QuH%2^mZsNuoxAVu&fH|nfW)9(Q)9}3V6vp zI>j)tkGV%(9kIlSixoZ)N)C{gAa;76kbXJgCHVpzwd`JG4$rrii*g`5XFWTGd|gsU z^E!vBWo7~A1+Jef%AhXVs_DW(u)F|~o*M*pF7(+rN9ES^M?Oig7K|sj4fwL2b3V*f z{$~s9x$un)On`l-&+n|HU_gB!*p4g4Y z(hL^u+sAx>83>$Bv_RewI#cI^{h0gG`AgUOn`UG1Gw0&aaZM)_BXtM@*qi>WN$*Bm z^mc>l<5(KY0U@7S9%>moEdp-bj0iDtowPR{(;xlX%tAvYc!aH$^1g~q%{)`7rhxQ| zgFD+kGMK{!*p}-qRp0{3%WTV678fB{Hbh5FZ z8peqw6YVCQJCO|r_Q&joEfq?#UY=oKqhk;cc0?$v>Zmy7Z<}bYv{%p-E1xrD<3gaj zJDt4RKl$|9`N^mv|9Zz7xKvWN%=$35sTUa@>L5KI~QFj5Ehui!1L+?p3xX%h(-p@9JRb>SEq4MP6IdwbaH|ghH-gQRU zi;i8C)OD3GneP|PCE|E8?IDhFkg8%$aVK3f_y;+L z?YxDV0)#RI;mG*Z&eu)bQEwlQJrgk~Ft2in@!<`Sie+5%K##v#f#_PsmnmwYZ?7-p zCf)JM-WJ}v*^efrD^W{9sc|i~Bc9|%e!(%BCr`Y}|4#dZ*&}u|9Pk}$rU3!MS&cgL zozA7;Ad*+FrD!#*GEFGr)BFrNyF?Fl0t7RlV{~gNm)C8ynkR10FG)W#DwM0z^|5Tq z9FuHAAMLvJ~ndleB7uSb<`%!xXXbuBeN z;?f*i^WsIfAtzZjP4vYpBL+zHp6HuYzA7T*^BbmJ+nD4@_r>gp3Z)BeeoZ{31rd#p z5JOi%^wd{_*k>~F3g5iIP?ot zN3UjZ=JbMdv-4gjM1p>NUlgwhZOj6;)mr1c1UT`_ZhQf^b#{-lH+M~lJPsyf<30nrII83+Y zrw!D2CFW9cNK|^ixm`!)7~Y(95JWqU)@&ri)Dl9&m^yH7IvfSNEASDQakVt0&qYc%qR=B>69*gM z)?|Wh*5mE4UL7u;e6V;f@qPQUK|<|K_e=FWdS3X^L}S5S3%-B_ZJ5X~djx%EC_}~g zrw163T)dc1S%|2WUaY?Ro>`4Ojvo`XzyQfi{q}`XK^jxv2$pO|QUryopl9{gcGIJ% zjjdS~K5e!+7quQvvB~UAvF~LjB4ghckrO&t_!#@AW#B`}_VT&DnH&#~kO>}$=%X$j z(xys;4Pc@|FRRL&CF%^JuQ%1wE@Hl7iR|%TCd)iadVC~nN`o%+%md$*$7@)CCi$tY z$198?O+^HW)|K5kg-Qi(-nwx;;V~^D|FEe{th%<95tjLbSG<9Iodl&iLQ8>z6YPgb z!3|Uxz5}5-wiho1f-4DZh^^F_j$JICB}948o9*q*@HZ*?aSL-i8t5p#9E*ZCGMqd& zq)3zz3m)KhrGDc)mS~GwL`40uz)#EAGCn9XT{LNLpmdc{aNL1c6F7^KI866rik?1l zRVMn{W_zY)9`Uh+ZZYTle$Mw3P)U4MsZcgMI$@_%uY~m8?bbxrE+hp~tQ4 zYSD&U-qib>nED2eFm3`1dc*9W@MaSObS6z6W#LEjSe@Q^v7w4$xw4ObP(^qUE40a-sHGeUaBIp9}QP4BMBxw5N>Q2W@LOhkP z7POPSz2eAQq+`NM%cjNC&|!5*pv8!P@OasyT+@L$>;33^Z`!1Zy^F^T%nGGDQMDnw zyoxl49A;Q8y|J=(WV1wrG4HU;#3t2%FTS9lbQNrnNUc!KalB@ZiV}Qp9?8iE9iQGJ z+z11uR;&mRa^;N7O|S^h(;9~!wJ$mmZTnvST&R$P6$9S{jB400Sn7-Xte;|>uqBp!A$+NP-T`CdyW<#%@7HYA>AS8*e zGQLegCkNxQyFh9)n}aFC;$~J3O`gh}b7;Ktb0IZLFK#CWc7msYifIJV&6GEnWx=Gi z&9kKY5?J+DtvMq$+RNf}7G1lF?r8>0a=5MeqS=qw=L4OoKr|R;KY|?6EA}~Ka^z@Yu zJ^gJI{~dG?no8DxNW&iHJz-{Je|YY}`0o>+Ff#skGoQTBv|V7s0?vcBx?t4y$u*&? zPG?JVLpdrrJI4f#p^sYuRD zFKC_71=T)ohBn!LJW|*jJ5hMwRZZ<9%Az!+#DpkyR#;r5RrT>lpUr33 zq{gi&}hzC)irjkcGG+={_5+Z6m`wlB4p`lCtq zf;rlxHpxob+vzP7-8?D*As13^>Z-;*6*Ndv9tEK< zY^2uMX|EaUkT%g4@OaUO+#5pcVYKT_4CkjyVmT4c$G_G0Oq#uqv9pvszOb{NPpz_? zM@d+M#5R!6qsl)Ku8loIzF<<@9n#J(63`+pBK9v+;ZX+zBiD3 zG-AHhda_XH`A8K!VY++FlN_tCfCZ0S7mnQOmAe_^g_!Ic6gvEuZ?xV3$7nH_36Ut5 z(11a+SX2iGPd%AuQJIP;u3y5io;TUNj)N#SVtM@9A>s0LuMv9cef8#t*$bW0EYvoU zx)L>QvN1Zl8_kQ_*bjcoL-3ON=%!RzN9@>RB-Em%uSN)y@i9w-%mp*M*I<;)6rr8> zfOb#)$Q^U>MI?;KsUsutBKEc2%-H~iEvH*meWgB;U8y?dFgcZW=N<^GJX%yDlU-p#<`o zSVJCd?t9K{ceXXyOcE#^z-*y%;P5#&(IaWSI!I~i6ssg>F_q`wiksc-d5t%!ygI>n z-N2hF-^cJcAJ)+*j|b^6xDv`B){b3d{f!vUtS@5`LQ)PZ1EZu;8}6`)QNr8p+Vz$; zN48pJj;*unCN^v?H+Zwt#2!3Z=I&@cH*`6HJbMVHl+LO2GhQows#o^BLrM#spI(`P zZ{$Kq3|hBZ0<2s*JWm{9?b}LBQ8IU*hY+&JIl;vtt#UeC!11WulF6<3QIIYQIvkv= z2u_H0kfo9+e1Ww$L0J>K?X+`zB4dnTZ{6{sDa5Cpu-hk&=^_C5E@IrQI-4mJDhfkq z7vw7C26Z46qkq8cK2FtGvnVRNaq8HVtVz;GVsuCT<6t6Rhu!+uH-SOP^t=KN3*b#U zi701!SA>vM5X2I_$^FSlSS-~DSz-g~L*8=x%2whFh{#FEZ!BQ7FT4ryc#QmQAZlE$ zE&10*eSFUM9O0=e#yp4z^U6?exdD%%Rzt!i*nQnLJvnTl4L+IMXHPJ3+RNz(N=)(D%Y?wB&N){%)(^t)hDZF% z$n!gfu`pSZUt?J(6fP}ml9lm8V1t!iP8jjid10JjTtKzGf-K zFS0}L$cM_8+~O+=tssn|5CD*Zeqd>sh*+-guI}Lb1kzv4z5dqWf1|Ex6~f-A?wj6c zMp$iy??RO20~W}{gYh3a%3p8%GO{y2bdq@K% z8Y#fW$VAM}$)t?{P_%W_cQhtu07}^#+c*+~ZgnaGHybEG=0i&Fpp_ZRbnE&iep z(}NFx@`oAps`{Vt7xRNH{=&oj;KN^devQfb1NM2a#cy~XeE1U&%b(*j%Y!Zc!o%|5 z!(Vv*9G_VpZ1EeO2Os{z^XK@?`e2LS@I3hNCmz;6$7j|DTl|HG^}&a~@ccPGvp(43 zH#`qM{E3I{&+(b;ko~W&F}Fc=bz&<=YuVN!}H+7pY~y7_;ZA2 zWcUw^{xPA^?8P!r#0 z)DFY|DRUzSVod}P`4oTTxrzusE4a_)blaQqPA_#txNcqt;>w;4c4_m?VY`4b|; z4=KibCIGiH{y3C2G4S-AfcZQVJ1Cd`<(!Ap{(08I`i}Zmwx+*M|Hq{Xys_Y@Zv@-} zycqy$82)w<{AD?SA|oTPK9B%FkrUybn*c?2gnL{6Rwro3&ty-LksaawmOoJAzf!(W zxBs7&K}a5y{~N6L+3P>k0JZo3OymDzkNb4(p}K!)%=_HxLHWP2$9?wm&outAJ?=Az ze^kePjQ`Ix{xK8oA$&G|J}I#tw8swpK>}MlDbntN7#5#(zsKCRUIMS?_O%u|Cj@8F+IS^aJi;XCMa2 zfJ&ex6FUdcydcTne?Lk;obh*E;5MKSG@KgvJX zf#cclbgG$a2<5ahkE}#FZDl4{5;10vL9&wzY`MF z;wb*lg#4{R`hO-Q3j@H!{6F&Yw`TT%mQsQm;(}5?X{l&yt#9*hyab)*{}V4+?&Iz|6fZG13KUx03V_^9QkAKt%#D@Sn;ypuuvI&IwZ%hT2f8hk}1FeIukDup; z@N@Zq47C5(HW12R>;H+V%=g#)&$It&1rYY1eEnb8c(3!n><4<~?`*wKtNv%Uf_DEO zn@?s=z)L4vM`L?)Q!__ke)pqfWo+Vzz{t!9FmST6G6t^Ra~fb`^&e^d+ePz0YgrK? zh36VSX)OWF@5~MVmDfK`?*20SUz=NC-M@PBAI0U5em{-}yi|a$1vPR%8_%CjDoFCaj-NCKl|fRVdVUh&$NFE5>c3F+cglg* ze-Ie7_8S5JA}Xjk1^#|%frtr01X})$r1u@hzntwolKTe!@ASG4+x};I{nlLl-x|Z; zyXJr8EXehL#dr4{k=3_0{!d|`5OA0QaFhWZhy|>`ke!2xRU7c!O5YSXH~;}4=wJvM zX8_y?95kSBCvFU4^p7Iw_@I3tO$5LXHVWF9S^POT9umRWtY;BAIcEC%})(Bu{<>Uac2RHy6tn?ks z01kHghQ~Lb>ONZeE#|r3@Ut}l$^b8EkZl}|MT~*bm@)7? ze-FZh0n)}crjBOB%#55&e0)Erhj2}Mt7iT}$rPv6@5_5NQHAkv1hzzkEI5lrnkOG) zyRik;yRE?#(4j;jNQhH2>=YD)1pHyNUao{`WWI9h)E4Zioz5+_UK*(J+R%Cjm`Db| zlU0s7dJnzh>2KNOUQu5@NoOaKv=V+LLej&o9*aSgXmG(NVuu6&-6}BJ+O1i__4{p} zNX(o-sCk! z#Gn$bW4vA)|Ju_Huu-{*Bg1t$Ca0rkbn8BD$eB$3I%tShtOfDSp7wSNSTo?uYcvx&%QTfG6=P?=TbsB!Z|IRmgTo6<-}JKrIkdJ~1lBh{n}@ zjg-JbY#JY7^KtDPa!)Lk-Z$+}?-#cQoMiUrr|F6o4Bx}OZ&@;RTABF%j`#Ul->$;U z=SVO1>z8M9XQ_MjaJKGnwytzMQ(P{i1Q+Tnx){R3a?7$;M%c>=Dg?U%KidYyYsVuc;X+MZfP$z2M_~a#l;4HRW zuMLB?{TLp2rTFIxnk3@~S?Lnk?5U~tcVv-v#jE#(A zBc)j-#)JZ=!JD>ML+PXA*V(u7jI*V6kUt7AUu}C2p6oKpeBR|O%;2uLe(`!@0)7T| zz%G}3gCeIBomQkx{Axt)qkgqXcf@BqpXPudD7);`%YYzQCcJH1u?Y*zPj5|vM&Hqr z)|*1ERx-DYQn{>bLv>G?67v$ydwC%C^CQFSHx{cd*3H3W?%>Y4TXb*1 z1Aub}j;I(v>O5vM$yP05VcO2@`n<_h&LKRLk4yMOhCfbzkgiy>1Ywb>Dyu+QAt7_1 zbfcc}*~rw2^|ieylDW=vH}C(CvUd*7{K3+MV-;&v4&D&f1eUKOQlgXuCh1!jU%wi;|@vtoC#w?IBKJ6mb4>AQ%D{jJcRV{F+ zkOUxRwYKPhZjE3eWuz5RB$-G2dq__wH;d2rE$R|EJZ?uRpKQPBZA~4v7M3n#O{^=g z_U2q7V_9FlbZd~V8-Y|$aL%*vAq{^B`)(FIAR_jgZjYv;lc;EeY-BhGLS$sAb`T>N zx;l;@Y~qd(6|;d>PFvYsx$9dL+|9DOL+Z@G997pu&!wU70blE|X?Z-%tfqf7;Sy^j ztCd|C;!r%*KbZsXbB;d9aYHU<0Y*eh!}mTRx}n4Olo=0eT>O&b9ttq z={naA%oj4IcBqzQL$#?x+R@sT_f9a=$U>*z3pOvfM45qxu)`S*jnyZ4?_(R-)9uuK zwV}#Hn=-WEPoxCmZYuTgb6A>|+>dWlL&ZMyJaWH`F&gVcdihMdA1jYR<2lVmd|m?P zS0LMIL_sXe_tP~ihqq`?2Zbf?FS&zYeczum4YoIPc6Lwq z_s1k>++Pspd;Z*zPuGi<#6yjuC01^3jN3A^(aKyzO6dKK>-U zxE~d8?Kk=fFoq9Y0Zm}?zSs?VGy46=VBhWHG&1M3;Vb*-+E1_AR^9|AI`r~V&v|cF z{CYP@j;y`zXJz$qoS^OC)NGHvFac9OEJO)6IfZ~mr~#-i@k_0AigWGek0i3Z z$yMTp60%MVT5~wA9dXANd=`YKLEh~);h5zL2>Ki{h4fXq43G#R4&3bcBN?1QNqEdx zX7~O8_L^&ccYtQ3or{6Scm^&QfY-)i#sG$OV@_VERZ>ABvVOR};FBds5;FY(TA7bQ z3g%FA?>uClNTCC|h)pP z3}y% z5W%76^J~u5E?f3Jh{loyqMpU(Gpl!_VH&I2gx_iR_afP_+|6Cv9*AXL6gr8F_X?)kk}Ww`xz;-AI0LS_pmn>Y==>n zv9l;5{kD>BF5MSrm>t5eJNdbKMvuRHOrG-A?EB|(vt!#Kt32IcBK43>IN47ix%(MD ze!Y|3fOoy4$8;pQ{#DnDI{Kd6JxWlchOD0}4f0%LT`3Y?u1Z)QIK9i?Xnx>09YLH8 zbxnQv8yxn8juFLuR}pO7_O9Y2U}6n*6aptDC)4N7<3p3yFUy0iII46t%5NP6pZXgS z1tKyncdTt29wrhGpC#l9WlA?h7>Kn^ny|!yxVwph%s$P5?9PIJh~~@tW_is(Y-5*3 z>(r~Ur1Wt=vea0A11G%M%u{kUB5;rv+wW0tm#+h{hrAwxLb4aTDpx=DG~}e^tg4Ic z)t9qn9v%69LZu>6;-C8cwv4M3QO=z_zzp!+lPH0Lb%XA=X?&2mI7UZh&&)e+sj_pa zkQ=$$LvkZYiK$7~tgH7<@>G3X-}L5nx|~lNd7>K%OdOM1NHRrSlCzSrHbv^j!B9d!@K0Uho+DjAqhXOqjj2>YjL<`CX-4ZY2^8>-XS1`i;I0g*I(m@Z5M)c& zff$e=#o^zY@*WERo1Ih2G@O%wnx`8950n~MLu{v5mc);NhoS33mF1M_X?{K z2TgLXgbE#wwSFA>Q$RnAOLq`Iz#6@RK!cVT-!)1T2N{<}xDak1>x-97Gnuf_Tz}K3 zalz~kLi*D2ZK@JL+=gAnEgW<=Es&S_&e_;G(2ZbOv>;qdpQWFvs-w_r_Qc8&|C1i> z{8?JSgvlYP2vLyu!K45=nO@78q3)-0UU0yhe73|YzD=v-s5iao1eFx~9Y97knu^;@ zS8D*}sVItL>cgOGmJ?GW2!6hWtg2<{tLu0NcL+@@q|m z-sWE+lHUGrY5Tv8Z~p$(Ut^trVoQg=Pk2m>tpARg02_j@HY~rcc=HD_xxub{oCy0pB&KN9{itql#P*@?H_qm!{dub+xZ#e zowO)b=ZSaXOI`ZPm(;{NTIpRNHhQD7YHOgRfeAr{H12{}5eR^QNoeY!{Au!s+Ff)k zEo`b5%5b&0)wr{ojk)jfzAj`r^#r=wUi+A4AM-u!!pA#xdmnpkKRtc=_B`E`mMK%< z#js!6t7M8a8(9fie_j2O-mu1FH-lzR@k0oC?=<2W2}9;o9!-nMEMc2U+dLY#Ndpp| z32^3OO&ZZ|IkyiwjtlUWPNCKArX^G)j0z8x$$mO3S6`llQJj1`obJ3t(o_+7?;JW1 zE+=6lWRye7xj;olk0;7-V<4pC@Xh|%?diJN*8cdzRzhL8^fz8vAOt(OfownEaz@!{A~k8DUarP?)SjZZB}5r2Yf^ab)&09iGi5_D%3aQ``2BWH zyKlL}8Goiy7DpeKAp511*8=V&)zKNV-i-ItMYmbh0-9Wctk((8cH1;2|M8PfOGJe9 z>-|JdP0r`uLnG#bS*h8E^X56%&Z|hP=<`0zgnsMbG+^7nNdx3H4Wa>(H75^ zzRkvAq1|U6?`-Rkaoadg90#Q%GK3iBf@7cyup4zu?#bhfFR3aKa;MODtkFk7x@Vv$j)Ra_qBN4gL2 z3;&KcIrWrL7wpnq!dHtZZ5p>85TgWOzvXJX++6 z01@=qAsh9*MklsakavYH02NWCzZ9IZ92s6F>0yOyr>gV{-I3{7X7f9514J zAJzpKOL9Ehi`(T%-gg6{b5UXPk#Fw7jL@qI8nS-PPB-)+xq~I&=7ch#tSf5-KNTN^> zJ1{B9$4S(TSMr$k+;9hGd?wKgSKl$ffsVK(f&_W}u-*A1;OK$~AzXWg^mKvhAKw8= zYSp(Oivc6-j(@J3sHo2|-0SUmP$|{5$YkjfcE|2%7#~FbeuigKG>MxNzw2!` z=}c8%)q8px1KAG^4T)JSXhIDcE+NWc^&)?4k4LEwNmHT>I2jpE5`Up9<>oOZm!s*R zla_W-T3=S}Iju$_8(A5F#6MvNyrEDEs_<(dlinfPi+$(*LkEaPd@EsY4M4$}(7OBs zK2?S6I9yy9+CJYscG9TPV@akyOfYZ6+9!QJjA)8o-dH%jmJ0RIu-^IsY}`8OSV5^D zbuGQHN6wL(Cstvcgw4d=SpjrgF`$%34vf+_8HxwTy)|~G%WSm7hgSYnyf=G88UcbD~GkV=BvQ;!lZ4`TWV95N z+5x|l2^B?P-%TZDmNwG%C2*Sra(R{e1Mhio!6h{ ziaUpk^avcx2)+T%Yfi`DDDgl47^i$4Q7V^;7{nd$6ARKo8b z3vS{1i?oh|HBcJ_sO&s;%>LjFNgGu3j@e>H;BxJ_Ui|QlTTCSz8l0`UFGciV(kVPPpiB z?DLkzFMX=*;WD0I@Vosi8c^zLDWUtvx}YV6y4=N%ITlVUQw|+ZR^6tBdC7QvOSmO^ zo$=W7Tpbg0uN{0fH^0(y^BV~As=inbed+i-1k*DME^bzFw75*@{9Q9f_b?w*yS{R^ zafmi$*Q@{balz&hjJl}T2~a}Qff^?(@*VvwU19_Nno`t&oJZAs7wrG(TiQ<_0;EfxBhf|_8lSU2pogFgIE ztcYsRBrgJGKwDKQM$$Q~=Wuugz*$*PQ&3Zm5lhbq4$RDZt4s5nRjbEi0JyMMT~;jl z6W&w9HLo_=$r!t(0+Ui1NgXybF$-lmMB5L@nV>e?enz@0vWzTU1%=!RVZ5}qU@gYQS$MW6BlL^L z(~~2EiprjvrFGQ=^(v+aM=F?c1P+W88#0yMrIBJ_p zl^QzLv>VmwAzbg?r^ZWdkg|16%8#<<${&fu#PZ145&QO?+#(6d3~5)1v2QVjjk?$5 zVPeNAdFy#upa=A|!3E9{u)lX2JvA-hl)MO3P4%1&@stQd4qwLgd?ASMINFk?D5hw~ zSdHXkJN|sDew0Ns_9_cOtx1_9_88(S6d1pF2*jvTqf{?0ZZ1E&n^5Ae$BF||RZnsG z@DDxetoN42>HHDXHWETEc5FfxNIE#);MjNuEJ~O+4y%^VQR-+SbaeE&wY#^+BY+J=KqgiCBdwnCe10fF95I9QfR0I*OxLci{L#B5=9e&kjreo^O_q#D zxhsp|o7+mZIF5JFTYo?E01IErJHMBtZfXMYW*B^jUBHKh9dY3I!j$rHn<3M#H@i0p z_Rd8dp;z-k-Q5gd87yL9JWed(AUxF5h@n>{A4)32^?2I2_(GDgvF=oAU7O)ya7E#S zqMA1-n!}@xmF%j@FR%%n25cSiT(H^lwEGJ`T&!TCWsWxH-*ux7BFF){Xm z3iZ7jH&J$la{jXBb@Evmwd64y^X^25=+S~^zS6b*^IX1qczl^){&7mP0!{tGUsGF` zK@|$}7P{Mck{@GbiDN)hbUPNN;T<30(hpGT%j#U05xGkgIPX-^#J=<{t)H_?9H(uM z!K6zMo(~h3qXnio{JdgO6hp^T0oc?PJOO=F$lSNC7{F!_%nlw>FvSyp0M>dI7;k|` zcak|+0gFUz^({G$p9EBiE=peLPUs9mVC04wUW)YToXPV$^friqS zPG|-;`xu#C)qDYT4x;Y#xGXqkzsa#!4j(<-5$hPG{n}S8y6xpUL-4Ablk~`WI?{HBO(Ts@PiXgO80{4w-TS>1tFldaUbe*xmLI>?nZpfB4TKOACzu}PSM?`x4jmbma?QUSAgX2+R<5Y!^;vbE+v{YOMKu5>&}3D=MVjP zbQFDU;=u8HP`WnIeVf!B$|321{{<$1pdV?%{)YzoRDWW|Gbc{4a3=#ibLtj64`kpf zc5g4UQT}>i;yuK!2=}!x(Z*mwvo@F=Dge{vn$iAkqK|b)NWa{IN7rm}YMgr3vO$z{ z{N1|H)F=a>%gd%c(**Ki<@PcLj4WCfmyYnjePpnM`W_^JUOEjuYDVURUX$^}JNLkD zz?@U~CY@m*98{ctV+`JDo?3NHg<1Jg>2ss|00EwQc)iOm`dsaUQKpDyV@%d*zWF(s z_~RWoQMZ)NL}29Or%id)*?T85g7RBEiR2iOrk3-S>)@&vPhkLdN9w}W`l~(fB92djjTe znos&kVXP*^mDo?}&X>azw3PGX6Fc1dQIK4k-74~Lh@>g-?Cb>O_J_3rK_!b6eCQ8wkX7at=- z{cw#gFF4sO_@8w;lA;#Pmh*g>Fu6=Mwr?6ie2Gr_LjVu4qQb4Sq3*o_mC`a{H2l3$>>!1s%rmFisXU~1Bw$zr^HQV~qrR9E$b<}v86hKX2z+59>TICU<^c;is`G<9Fw9rsdGoq#>sisTYgub+s zoA>DfG-S#-D0!*e5~4MRTp|26f|9DQ`=vTpxBkTR82}2TRLB-5>=!QU;4Hs$_F%o} z$O^DQ2?!(i`38UEr(j~@$Yu7ludQ&hXDFv0&6b+SZ&*J>TM-1drqNRP4>9K4 z%xfE;iyEGv_AH!bMEm!u4n3{>UNo|0?dL~ zh@mGGvtbbods)NEnul*@cHr?j+D*d^U#)P%yzjw@Nncs#`un_pyuT6cxbWHKU;-LCm-o0j`3By)0Rw}4*qWbgZ76Z525YZxAD&B#7V)!g@58ofz{QU8l?L(G( zw2iwJ8KES-mTiBPp!*MEBpS{=GH$3p=SE&FE{#7TiAx}fT1FC+tml#L!-RUd;!sOb zJritK3Lb=jX`TvdgkEhMo*QV~Z58CVV#h7}nA1Z` zB)T*A-$$$Kn%$TCGJ`^_hwSK3?F6!v(u4zcC5f!hH+&j>~s!|SIk}-skA*lC(=W}DbKN*7L+`LmQ z>l5AbJ8->kNL-&f5yx*O7-3{cRfFO1# zVFc%Ju6Z5&EXNWlmY!jkdWl=nL;-ogV;DdUHTvX3M7X`LOT*AY-x<wjN{k)S0vq_b6k<^X|69VQ zOxR(Cxkrov{b%dZ+p-&NK=YB?TPWNXc-RLbfgyf;)u}#PaFxk1T4#3G*4n!L(M5px z00S&g1fC>*cI&Ypd8yqgE7{L(BtvOSNRFl+Q__AXL^J@M+>IPeBAG|XIy)Kj>(7ut zJ^VYUAw2_!RZGZ$_z;4hwILkeNh-h+3I%b7#*};Z&}YES*a=5mxDux#CA6pV^j9vX zrI(rS!A?rzZIz{6j0@^u82fYNG#e7RbbnS0WY*A)5{VHPa~8F<40*nePuouZa+E+s zq=SZ4eMRrSlP`&@`aMG|FxfI6Cj$8>0@?E#hsI~SjOmzQx+~qNm#-vtB!7mF!fkmD zO)aS!Q2kz0ju#QlNrlAr+%oh%IhoKWO#-8ko=!-#Au2eta%?=_q@T>dJs@@_gzrr{ z*?UreuS}280$8u73&`}n0=)KD0{V!%4xeuvZpLi4=(NzH<-4j2QzSAgx{^r0*Pwh8qSAQhr&uzI92g)N((mB+j!y!^p+N92{H$L=@1wIM zB0^Duf{H{*txdJSF4;Y`wgdx8rMD0ilPo0!#wZkgIgXy^qT&PxtE!FS+gPL3kMLfah3tgo*|M-LtLoL}#srymv+Bke1ByXkfYD{YYc z?9w(?5ow{hk?o>IBS{p|Tn;uvYYchotbsMWP9)nhX zMewlWYrAV4j3UTD@I8eOq0-bs_CV6NL-`RTB>p^f?Ua189;|+D%9`j(@iHKv-46nV zt%XF}`qnM*j1e+9hy?WW0*t&qp&abfDKu3@kGhh`UU&L9f25^hRk)iT(14%aJ_jK$ zx*E`@jTcvSH1Ht4-G}3DdyZdAKt`&MN`Cf}G{+A-LY|QWJIBzD9k;Kd&PnavLDLi9 z)6CJu{6_qMp-bPPq-RM{LC1)g0X;;waq?`bwDXur{tGH1vY<4KGhr4Bk4zR)s%(9` zR<3Y{R+d^8u#=UhTibef>F2gBsy73sE|@Dh`$7|1?2^p&bqaX?g){t>e)Y;HOIGJS23aDMGgvT<zQ*s#2@M6VIfg@}GnbXM%@v`VmMH3mTsk zNN5Nh%Mimv9C{zv(6kI?L)}#3p>TGM_W?UWNSeVoBHunfK3lHa!LjRwSwVwQsKSSh@Ml-`4 zJ+erDrslu3JkvsHBe#&+$Zy5nIh^HX)gwGL4s^`NT)=H2A0guHVxFQl(XVq4lP|kH zid!9Z{rbJ-y$`(5FWMIYPp8>V^A>PO&6nBWxRe2U`_+7`A=@eHj)0G7hwK%`I;hj1 z;2v^AbcFa8>IP-E$J-y`o^wNbgzP&=W(2e=Z%u}V1Qdu}7Ya$zj1Uo4HHc({U6;5j zcR|2Mz(ZgtZtqy78R3@j> z+~g*6fLZb6g@e!L(m+$+;~7ni=J49V#lc$rnoB-szJhr+6BanmY)y*CKp*B~-F?91 zS$^o-=->uQVf@Kxsw26lcp73U`nbW5ENB^83o6Ex!<2A{9TB|7xUPHY!k}9LLQtsF zH9l}HaN0!;GMYVMXf`1%*1KYcw%)!QdV4@l%F=vDXY{DM1L>U!@5n71Ghb zuPQc^aE#DJ5BSu~z>XH2JVph;cdDep$}BPkzTdlBZv|vtr)}~_5{D0{BUE0-gHBcQ z)+}kjoeNa)2*kw3ck;#`W{O7KSh#@fMtmN8_{QVojvo)PVnGki8dvQHg^Bv|COUG+ z@IaP?c4{@Fv9P0nx!VZ}Y>(8&{{#=l1|-AGDjjrP!0JZp!)>+o%Xu6WX$!#CuAOl~ z?2tTH?~t>UOw|x!jRq0W3gcRg0#OCTgY7hC-BHG(~nBH zy)Jm=XBc4@lH#Z2&{k2ESLN$wFRA|Gik=FTlZKcBN92;~|Mmd;2c04JGIoKEUq{Lk za*Y+)y#$9d6D12Rz6)d)2->Ow<2Og2^SDNqx`N>aJG4%=VD(G!c72*b)pp(sIF_08 z<|vKT0gDgJME9W(vr}x0DNR<4i1{-7eJ-=}=ZhOfu>TN${>o4q(&x?Li#Z!nK(ieO zlG?8XqU6k}RuH}dKde?)^#}d1A1&go1$x#@Busaec|_PGz%J2BwBmMoC_tX*WToRx zsJR-D7l33nWjqStA+h!7=<(8oSEiww6Ic$AOXOVH#NB|(N>WaYoC#OUG|Glm1`%O= z=x!M0>d&U`*GZ1yaNnaAJUB9Zw?qT)7fpt=6d_Axro=J=n9-@b_aD%H6TY=rmEmhm zb`#aJL*Ha`=L9K48Vm>yKDcg%P!+Wf$yzS!Dt^r3x^u$0UUH+})BccS*|-HM+})5i zQ;vQJ)he(-dK;lJqCgui*G{8U&&2;ea8SamBXzGxgMUUf1}g@L+XaVBQKG9ajmCOp zROdM5J^?-MFVpV!*rw)i(64n5oloynCSrOjf?=kpsQY%EZA-0kjUFSa&?{c_dv=~~ zWS6KoXxqEac;~b1(L8^22woO)wbrA@OuWGy8blENzA$3I8+`M*&WWffbTm&9ajcc` z&(7MgWvNPIwz|9;&$+pOVp{O+!D@7!-_60KYB^f_?JA24lfH{%b_@f_f&E0ufE?2N z&Qrk(-B#zu3+ywPH}=!$d4ID!VhP9;I7@k4TnuaSMM~mkp^EM7+-yQypB-gA&fBY) z*n#96@%0w!H^i?y5A}BiAHEJ=NfSUm8eveQOczwlRdLF1D5l??b}{bJeHDBv9~s~- zI=?y0>9AZb*W*LbFXmjJ6XR@C(;7>|Wx=Te65Yaz6}H8h`IV@M?T|hDA;LJ*&MFTY zDFEL?f#&m7yqulJVQ-*d^*Pg*;3pDF~SR)fyEEJqqJGAVoN zS1s!XQMz6ISyLjK+}S5pE^j&wUveLF8cDHcW5=@KIQP@MLmR*Oy3MB-a(-HxrDdm< zhC~rLgcd6u0uNu+$5Ql zVs6LBZwE>7n=lq;e? zprrjvA!py-$Jys*`gE|si)%2nm9Q*!#UI?zPI{oX=%}=awK9>yGnL(X(G z#e^MvA1`TRsbvbS5b)he%P`iahZNF@9wB0m$N8o!7#5v(u%-DE37Y&z4N&I#)`HxC z!MJl%>wyv;FIaQw3{!$OryGL{Z6y33T!{ox&jz_hH-NQ?PPR^cIwRJ1cJ*OqUc8{H zZo%QTz87l@TioGA&Z(6+AhM_-d;ehm0>J5F(*_djO-WolFjAIKUOd?dg)xv1N&96g z2A|k9MJcjILex)|@sj22hmMss-K|-Iv-AC`{JVz|T-+hE@xc8De05*Tz{}^7%LB`V zd>OwS-L_Lfi!o$oy=@E3$E6;wZOm4oPxCRT~>?EKrkPR)H^i z66BFkMKevyca5Oj`qtV_nP0IvnP>CpCq32U_1^PN_X-XvYLBj)c%U9>KL$259N-Q7HT$=Em zMfstmjA+up2=FzezDkh)%tCexQ)!nkb6R5(@2CFRQ~NHi#a!zHvhM?O{@rvA{iH@fc8!O9G0u0`p{rEW{c zvHl*PVD$8oM{6GR4KF_uK3pUAvJ}}#Q@xVK#CvLU>r{;@xm z=W^WaFG3h=X1V{JD;Ib_+Im**1q)SF+E)=p!|(NH6o_{5 z002x^0<}%YL`LU*8rqKKK9+)aW=f2bY zxT-V7MT$vMW*kt|7wCh`{I>0{yz+;^?r971k4jvO@>5uJLzIi9W>P6@u_yMb46*Ib z^isFr(&IjFUB=5&pDVn(Kfv#;$HwGx@oQF+B5>t*Z@{y6Jo{_RrP#V5FTm7@a-nN} zUfg5mZ6p&crG%aKCm=7u=^JX`pyQ7 zk#z`KVlx{0QhE^0(lt{jncOBqiU%^?E`%+V`~&EN(bEj!<9mM=J(tu{p6H&xiL?&D zlNI6XcA*uWEoU85FFh-d$OS&l8u;>T=pT2)1H5ZWyHf<##Z~MK`UT}r??+NW&JP(< zw%QrZOkhbAep4aL$gmJ#lY8W^7Jac|)pXmqP;ng=g=$(FWW1xstl}!FCG>{`$A~g zk0lJ%s7kmvra(GF@H&1Bw&XXU5E*-PMJ^Uvk1OWxNt4}Wwo>L%mmCU*Fz0sE^pH9xG z_#Szht039LUx#?E^3Y@F2F~qLD zn~~mF5-V=sqt}K{k>Ks#bMA%x0G6lA zL&^!VQjcJjqw&a*5_Z#iB^5Zl`7>0eP?vqUD({Um`SA*3YTvpSP193DmF94YQu&xx zjYr>TQ>$o$(kr8CO%20hz{rk{qW)#la&*NG8b|R-JR9zn{#Gl3auIL_4ZE+fp&^KK zSM#6CC*F6&q;iJzc#(Zadnmn{0L9IhsLWw*2IJDaxCs$PVBaS$Dlm%4vY;_ELGL&c z{FWtA>`k>F{#dH> z;E&L23^_gKduyn1H-C-{{<(Nfc&zS)Bemfq07|dODu;HLQV+Yi1grwFGUbDGxz|;0K+{v3$U_puVY@x3c;5_^T)fwJg(} zuj`y2DVubcURMG$h>Jgu|*hYGDS&IEiy z-1;+~I`3C~h{xi@_;54!FDUSVme_5?`o@3&0jiNmwCnw`y6D7IsYp=)4Q{^dQOb{D zn#X3H^+W0tmi9n;S*iFzRdRMVb#-=DQq_^&vFpry;sB<;i!H zSb^&s{#uLEY8dj>hYjC6u z)E~0`HXrnvUEdDw zAa3<&bCc@oam3#Kx&1R>MCB;O7)K-YBQ__ihl{=eRGrwEQ+^k!nyL%S;Y3RbX61Ic zI$oqB}Gr($nWD^|1&m} z;~z4yNl9g+A`NpWKn>yJjJS%!0FUvYI+|nYC^cd)cf+agC^1C};5i#Q>`Se!znLQg z?!7@j8*;eMrr5ySB5~%|lw|D|N`rxaHRhex&G%+8V*kK~EKSOmuv&8VKWFJ==bQ4L zmSe_cI=h|VJSGcb^R2_G4#(^t|%PQLtNXtCr{S(9*U zC?BSPuh?j48eJ04a(kH`a?S-?4_lLD`VV z7y`uc(b01T=>Ut-%0wI!9$eoy*YtmrxnhtFn=1U2%L5? zp}yHGzb;&YefO(2GVGN*j;vM!D8a6kw#Ft?Zl~ z)JIrAhZ$bKzKo+wn;Nh__iNHb7BKz%qUWO7m&W5Ap(mC#w>Hm(E_7YThE^sziPh?D z4Lc*o7u4KOH5zn$VHQz!9Ig=nwd512OkDEfb#-XM=Sk+iG9g`IJckS|zf{vtR`Cn zJTXzh`3_z4Xy4yT($Bdd_}m&*m8n9YEwN>;sgS}W3 zoWatlmAJ5e82wU9#>EZ_IXBNYKby9arLVWXvfz!w;x7fz4b;^d=c=aC_K?l- z8)$#@+6U<$sv|6CxWw|LzCto(Tbs6rlDqFC=a~9KOG=bde&Sd3vg0RzA7NuS!G7P} z-S@J_@X+gX6rpw`{8@5>R;FK~c>OYyKBJykOU}G44FA9ixJfa4u2avqNp#Czhn}9B zq+eY#J6&p%s+t7|Cd*V$xGn)TX=clJT+k;EqLQ@YeS<(E6*qz}k2&xb=!m-+IUNmP z$zuZw-a@oXcQ#JORA!^uQHr&}0gy9>PwzdK1`mAqWgilz$?_yiF@*6YF zM;Z*w?ZR7cUS#b}mtI~d*70LtK`7tu5~eqq141T{4=V0u0D3zC>`ny>Pa|mePt#Dx z{g;7}+g9Xop@8E`4a9c{9$?~_0Vw&Q{VpeGDm@*N>U8zu0W$11xI%Pnxq1z=jM?9$ zJR2}JO+oH~<@MtQL+;fJ9VOJuF@7GvcucHMoHrdMI%2?P_ssVLzsp(PV1*K8`%3{gwa)f{%oju`w3LPmxkQ+V+YwsjqXb9mvpB5<*FAaic$ z1F(E#mmdr1=xdWcXRVIKBrOeXQX%F0f=*X6Mo}pdea77I_^PjYDf#BK*&+FW%$UJR zXepQK;{#kT_H1)X&w2RorJrCT-UAj221M(Scv7$H4k10S@a?+bPP9KD+=3^Fk@kk_ zp68nfZ$G$qI*0E2ultMS_a@P2+=Pd zozhlqrcW9ZNd#qW!XC}tKUr&Jq$_IRQioT|Hj@EqSIvPbB-dgjszOx?WbEpAYy@C z^!_{tSJB+d-T>`W-ob(oyjkn_KEB|+Kc3xH=o`g3t-8Jt4t(p~2gY6-*Ab$0+XU0) ziLF)4+g^>h@%DGKRolTt^7-mL$VFXKJ;&PEaGfVH0see?*X+*^rmEM62}CJ*%EIq} zfL)LsB3}2-r`OBwovMy~csrQ>h8cf{JpKvmqYP@h2AdI`liMh+2%ikNHHorzM4$KAn*M}j_S=pT@`DiG}dZqNVMojd=gwCV5m zobju=^=qG!lYsMUr;?3>`G3;q%>Sg%*}jDNf9Z3EFG>Dy^!Zn1&wtnF8vjw@!@|P! z^{)S~ZRfu)SN?0~&fium)&Ikx|GjhPuN}(274Q7#`sCl2C;!&HV^8n!KlJVV|F1s& zv$FoHZ2cdV^*_{){_l%;z6zw+|4~_MxH%)Qq~jZszy=EV6VV8&flvyZkRrr)rp!k4 zr5Z_)oT*21WQEvC>;R4j5Z_y^Ce&4D1)Ax_x z=NUfw+aKL*f>3t#gG!!8Dz}-lPSzJIm}S&zbh}uI{RkwsF{FY7Hu8}|Yf0H($=$qc zPU6ec7rMXOAdcy^c#;V82#rG3!)OPs2G#a-_gsvy8M9X9CJBtf(gxx7V2#KbBUVMf z#4-{-LPcoXAf6E`V~mFIB>6HDOsLDCkP&a)PYoFnL^~wuP}xBxqICC&RT&!M`mozU z$2~BA@lKK2P*V4AgXTm*KPruuX9`?nUipmVLu3jhHoVC@w0_40Hk1#$WCPXGQ?QA4+$!5Fz4)qIdg?3X!-h50@lj3F5Qv_C*x z5z~vucn+2%1Y^1^toEt%3R>=yI#+Xs_KTQ?hhzyy@rl;Rb{?5 z?iMjc4eK)USsZAj2YQ?vhUf~$ymoA zOURNXqHM`lb|Fa=B5Rv0B}>RwNY;uLA$|AsJn!=|`o8!5Q@ z*H4QPzanmx$*LLAhpWxhv>o;Mg4~opLm|2Pn(v{{e714ac=)YP?#^ybG4csAaTB<; zv2q)(^s_`Fc0BBs{Fh~@Vf_r(`^BplyCpQ2HsC4Wqr=#iW?G}KtTV|6NLQTG6ZAhh zY&|-py6S}1VZ%9gs<5;{`0!vlkCunR^_^ zu$U_rb1(P7?xxn;WVzvNr7AwdJp%bC1>t>Lm@7qEEG_r_Ip0O%XR_x4Mf@-WtslAB!x970dL-u(I2=jf;LCOrsOLAYkydT-z54 zdFzKc*vvQ?;zzLeADHN_t263R7#%+=N}*gj=)gLHalL+xnX2By-Be(hc4+oQVnWj8 zk?e1|>PaKo z&m$eFK!uVJP`hPSC;UEl$(*vGGxGkLOO6Rd z{JuG5>9|Wkn@hJ`n|6|;V5l{ZW@`;=p0F!>R?Wtzh~ssa1KKj03%K&9%T+D8U7o0- ziLaTGx4y-UU8)<(Hy`pWTz%BAuuri>%aV2_H>U7*sLs9n_s!8x_4XyT$jfg|t4w$3 zB46cnJ&7muT(d1HNY0vl^CgDRb1C86Vaejq&4Sg{>7sUyA2Q3E;bXQI*5;Nn2H(@% zqQ=52+qo#(r|*kc<#xJrY%m|7D!JQTj=rcO(#CxAN<&J98#5zRS?XDB@yKnJ;#Om; zrKY&PJ9);Og?Gh0h~=a4!fN}KyBCjeg@nDruZP|FxZaVpmRPAYMI%{bwV1l8b42kz zwZt3C`0|6C?8o26kjoVjT1#LpqSnrYM=i&X4{$b-G*#FQD2ayT_KD$}w+)?@Sf85*LeB#T?M zV_fLwzRgg23%HR6$FTsLwXBGT17+g@zBeLaZMo&K8hY)Als<*1%}a3~Ry0L@zr-4j zhCMjanoMYLKDy%yO>I$8mY3|r#Fu5xPrcx%rw~rygb;S3<0$8{x6c4jN= zNz3ynXlvqUd{f@xz-9T^?=rRf?GK7F;6K1XDc~;*l`wAns>t|F zE#I)h47`nziIDZVcH#OL(W#e|?7;9Bu2H_qULY~hA?`F!`;ud`0&8dE;nq5)k&~VR z73N1z^z1Llu<^A?ph*&now$7Cn8l=jzYW`h2X>9q8se%Rz}IjffqQ>w-tgowW%!$E zV#oQYu9Xh%R@1wt)~UIdZ)ndB(WDiGw--{nv1Bx}s}!#_RZgNQX&2rtzctY7$(F!13#4 zez#7d9^HlD!l%3ov0Zdin`t$}D};4sy*6Cb(T>Gp^p|`N)KeuXqVT| zum4yPylk5v3={BPWXxXR>QP%?l1<1waBMv|xAUekH?HEITORcT1o#a@YK%wk)(zBC zrN`A8xf&7?bnDPC;RbrTHDKh@d#n{rOe0m2%aq7$s*Nc4&;hhUc z`wwuRTYil35B8gd_qaw*d7{))Y=rtL@>yMTEiXT>@L!-1H`%O(J{RvV?JMguqLKfX|D`l0yhsjx#(Gc691yzUH=Y#hZPP6weGEVyINFXp8wp z{bAPO_?vEM$dypa-k6WA>4d&Yxv0h0OWKNsW(j(2hwS>{_3blUOGC5Q%oa4ST`2#d z!HYQSwQldGgGx`~6K$IZzwBjnu51?e^Ltt0!OLHBD9$@y`PE8sgVijVHb>+aEYV(e zEP;?aka}N2dM(f5nutCiNjtL|Vi)zobh)ggy=X(l;}eU4a@-I7kP)qiteoBMTSlcX zZ1-&_a`KP%)xSeMr|1kvzkFVxA|4$(AaT*6(A*)3H<#x|fyts7mC=cegtc-PsJTzk zIjWWD6AQFCFa79pgsfHV$gJ2dgn?MZBw6CS>lrf=e32 zQR4FIiVp?2>7vus@ca=P+$yFume&=RbN8>WO|Dm4r93)E(Exq;tCu_1?naBIRNWV| zZ~N}vx2{5;*2VF=7@YoW-5JT?Vq<)>+-J)EDGtS`tJdEai9O@g^6-4g>|2fDl$D>7 z(kj0=S7sXdz6{<$U+ufwN1KIoE$a_g&XYcV2~japAl1*6Xg>;Mel1si&=oi6e{jOt z`jycM1L4~;0m6J;w^&0^As6^(fEP$^*7KOCi5~}#*v|C@DIVW1^L(qa#eGD$Zd2v_ zp;N;*^a0qA-mO4}!s?UU@Qc@ItFvo^v5} zj+H({%|({!Fd9YhOxrlt4BvUyB)=6&Aq>Z%EtP#~yN{TfvITnuUW6QeSY&=#m2a%d zMv~7bOED8UQx?Pbo}aRc=XosMa5~>Q57mRWLK&OdL5JeAoVrilyERmL=R+{{7W3Wp ziu=xebUti4^D^dd#lGJ&)Rn|kY1%3k1<1#}|m>>1M1;+hDfx9s|yWs{kHmxdVU6E|`(BnFb&rW_D>}hHL5Z1>Zn8AFSPoI~UH3wIJb8{$2 z@#>~da5rZ{CSu-GB=4zask>W+gnO_NkHT=a(8LXi=Xz-?FRttM&TTd4eD~`(&=fEn zmK5IqdDN%P;5JndCjPm}=F8!?3crrUTT+ebhNZImMY6?K)z2}F9dQMQPH(ogMDez5 z54Ekl_nlH%g>}8i%TRmP8&OfWDmPd>A>vUj_uxu_l35D#w}_kVKk3%)&S-78LOPN% zrw<(C7anMZRlM!(n3ZA=of{Qw8_7V(U!3`w+vzwl<^A3wyfgp%j2VtY)QL&sM2Ppw z?S-X;pnH0RsIftVaK8n7!Rrqu)XMMe+)chNN<~T&gB88iR(^<_^C9{Ll zLoa#K((yQ@(8p5m=ATQ3FWFE-22p$y-XD$xKdEy%*%sq?{64i#OG&`&yRPNoto4b; z&EVTZL6H#>hCwcNyn1U*Ep3_I9AN>bZOtbB)`l{|de7KOsSu~fP@j6D^{WhjZRr(! zWCw5j$QFs6)VgI}p)sMg9)D_IMpS9pd+&;ssNlQOb#QSve~v79ed?$1YLS3Th|YRW zM(VmYTlcB~if9%wALr-Qr+c(hg}R@McZ7Wl)q~}j5A|*K&FgzvuTVRyWm>vC>D4o? z7Bjp@M`v*FiuqOUqHNleyf$8n3HoVAsg=$tRZKbDdDv7@`LJOX zz^I2czT?Qcq@n4%k?3Vr-F9a6rq46eYzC(D!_T-pj>$05p9<$)Mm_+9;`tvx9-ni# zJC#MRr+9FLAVQapn6#%(3wlHGBgpRgrnkpfqHWsz^6e0boGQ9&AC+&Vem`a}Kl5n~ zc`3NkOw!!7`t`zBTf1uHRAtdv`dPX+Z9my2>M*u2iMv9l3HrUGTUN{Vlq)&PFvTUP-zkB$d#HM9;c7jI%^V8e`j=sxW0 zM{t(JWEtO+?UBF5%s?rsVem)#+J2%dZZ8>$NI=DfT(S zq2A7(=xrv#TNmvU_{tW4hx_zwjP+nx&8vdyg-Y;a@7Q!``mluS+dKVlap4Ug4r|yI(gBNW+bjSp7!%h&KdV=E{(7--d-7r z4Zd$*F66#LoMpIF#ZvLnf%-%w`?_J*mtZ)TYijAh+zDTEqq7;~^h-rijAxJs+dWQg z=X#1Nt2Z3hK*>d`c6{Z6+FoUDPqR0CGoMuQu`2qTMivyD93akqNU-bD!zC2h*xi% z-W`4Y3oY^&PF2tF^IAqlw|gKmyVV;^N~=d6(O5>YrM53g`ZPpdm&wVsK3jK;qN)A% z))S_(fjlvmX{N)MKm5enf~zT-Cp)ghaD%VL=w2+- z@!rUnWyW=S6Nh9+nVzw=9GH`+)YA4;BYLK&9jLYNx!W}#6H&PQy*F;m7Ts&qBE2ka zSdZ^R&E3K~E2Z)>q&JA+0&5}3nMv92Y4nbKfWl5LKGE&(8%r2+j0(7XzLEl}p&;Ol zOU!x464_C_eYt6!gSp33db+;q_+Wj!_MDx7+BUY=OM2coF{Zpy{k&O3 zf4VBwo5+;u(S+(4K7L}DJ~YHHu5j#8OhXRgm=dFRB$*N@&W&lOg; zF%dbykt=IeyJ_GR+*|GzmA5&X{QgvUlP~Ty&&A?rHwzffE=_XWqb<%;j^I;XfpA># zw*TM|_Tk2U!O*OPuj?Y#UDmS!2mCHLv%ge=k%9dnpLQ!B2ltuRGba5LM->GM(tmV5OgTBHpE3B=@CKh?2vhUE z0N*4}SK(aikPIKH++}HzwdVT9*`<^2g{cJywds7{rduhemt*lRIiuB=uU9}1OD93L z>25j;Ywdkb^B2?M&aXNCiv;oC*Y{iK>ip~Oe(;Hb)IX05WEBEIt^juzKZv8t8N8RA z=*PwuQ3&2yPSjjV7tkfBxVYjqgNZK2!Fnc6!R}62XHf-t23Z9MXKzOrXrKcDiu+9( z;0poC66B7m80n}VB`E~T1bPxYK`ur}pr?nIuS}qv=x-Al@I6Tk6NUU%@pG3Gwa_(y z_<4JKxZ^>}M@g(C912ICfZ&KApF@B*(H#PpM2mthiOx6~BUSak9fE(!iMsmv5oBPn zfPetW0HmZh@eB-(#bRLq0){|9K@F&Hke8oBAk@qE7#Qz25WK}dW?sIMzcERIcWA=! z7BILZ0Q*-U((@-0cNpH=3qlI);OOn|CwKJd-(CniqVIA8{sZ)b1cwK{lQAHAJNrAi z5amQQ40IqGuHL?Wf4POg0Z9NM2^WR^J+S`}4@~BtVS^R;8@DW|Bcls4XyJlXLH-7L z1b{$60R$Alm>`fcD69+|V<`(GQvwSGTB#6SK#TuiwL@u#l{e7@tepHAqBjl)ISbzP zNlF-85`mNi{tEWn>~Aeu7%7!IhWcL)-hrU2`+pDL)05OtBt02bZzq3GkhVihRZi63 zAMY%K#KJLfM@K9a=YqpR;c)O50KT9gI}HwjLrbFp7l;404$e;h;2`)DJ$|>GvlGn4 z!-W*m7c2!F1mf%@gYzbOI{1N2PauFCHV&jdf`J_&DlZHE(+}_G;UfRLp_M%R{(9qq zC$*N0hlAG{Inh92w)0=P^T5mh_2#!7?BBlrklEiNaKeB|hW#@g z@fzzcolL<2}G%$}=#ciimzuURGbzf3A|@VPIkqrse$dRk0XhBOxd z1b{&xQD8Gz0)Qy^1FC`30^*%|AZajiPh0?vCDGpQ)-R1hXiFkc-z`HSK(eJ>GLkM`DBBDFgjsNZg^jWS}jAe7s1M6p6KZ zryht8N#6IMKP;NOmY^+`JO@aOG-~g7k=Q+$f#3Y+JL3YNEqQN%lNXC2iwojIk>dl2 zw86sd9tSu*z?LSLp%LVBkmTfrgoTAWRg~|L$0dNwN>dtY1{-pkZPYOj|56~7# zUJr16B=Ogi`}+eva6#Cu2Y|LDI`f^jfRywfupsxYYhYLH=?%~pO^y!@mjcM*g5yR1 z0UvhHS_0aVublu|3Q6Kg--#LYC%rd+AcHSiUO-zEK%P@@`TGMt4ESLyvKZhJ@dw*I z_@qgbklYrDA<u+J$=}|bB1nXRyJ}9dB|k?1SP(PWngjYn!1t`N z2-Kcjfwtu5A<{XAybnnJNTlhz`wv{~$od7;0~bniJ!u5_UIxxAU{B5A($YxsoRYS; zy)nRp1bGaQ#&^$n(FpRff#)y``5q4zO&Yty){p1_vh)!dWMv^RV|=g+=|BmA8F_pA zLBQ%lj36*AFPt|7w160aABt3kSjkGMqtGg76=^^foN3^qD}_-~#-h<`0740)s)|sP h|IZpW4B)2_ef=DWe!q{gaImid1cR`!n!Y;2{{Vmrg@6D6 literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.txt b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.txt new file mode 100644 index 00000000..a7ebf999 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-architecture.7.txt @@ -0,0 +1,2171 @@ +ovn-architecture(7) OVN Manual ovn-architecture(7) + +NAME + ovn-architecture - Open Virtual Network architecture + +DESCRIPTION + OVN, the Open Virtual Network, is a system to support logical network + abstraction in virtual machine and container environments. OVN compleā€ + ments the existing capabilities of OVS to add native support for logiā€ + cal network abstractions, such as logical L2 and L3 overlays and secuā€ + rity groups. Services such as DHCP are also desirable features. Just + like OVS, OVNā€™s design goal is to have a production-quality implementaā€ + tion that can operate at significant scale. + + A physical network comprises physical wires, switches, and routers. A + virtual network extends a physical network into a hypervisor or conā€ + tainer platform, bridging VMs or containers into the physical network. + An OVN logical network is a network implemented in software that is inā€ + sulated from physical (and thus virtual) networks by tunnels or other + encapsulations. This allows IP and other address spaces used in logical + networks to overlap with those used on physical networks without causā€ + ing conflicts. Logical network topologies can be arranged without reā€ + gard for the topologies of the physical networks on which they run. + Thus, VMs that are part of a logical network can migrate from one physā€ + ical machine to another without network disruption. See Logical Netā€ā€ + works, below, for more information. + + The encapsulation layer prevents VMs and containers connected to a logā€ + ical network from communicating with nodes on physical networks. For + clustering VMs and containers, this can be acceptable or even desirā€ + able, but in many cases VMs and containers do need connectivity to + physical networks. OVN provides multiple forms of gateways for this + purpose. See Gateways, below, for more information. + + An OVN deployment consists of several components: + + ā€¢ A Cloud Management System (CMS), which is OVNā€™s ultimate + client (via its users and administrators). OVN integraā€ + tion requires installing a CMS-specific plugin and reā€ + lated software (see below). OVN initially targets Openā€ + Stack as CMS. + + We generally speak of ``theā€™ā€™ CMS, but one can imagine + scenarios in which multiple CMSes manage different parts + of an OVN deployment. + + ā€¢ An OVN Database physical or virtual node (or, eventually, + cluster) installed in a central location. + + ā€¢ One or more (usually many) hypervisors. Hypervisors must + run Open vSwitch and implement the interface described in + Documentation/topics/integration.rst in the Open vSwitch + source tree. Any hypervisor platform supported by Open + vSwitch is acceptable. + + ā€¢ Zero or more gateways. A gateway extends a tunnel-based + logical network into a physical network by bidirectionā€ + ally forwarding packets between tunnels and a physical + Ethernet port. This allows non-virtualized machines to + participate in logical networks. A gateway may be a physā€ + ical host, a virtual machine, or an ASIC-based hardware + switch that supports the vtep(5) schema. + + Hypervisors and gateways are together called transport + node or chassis. + + The diagram below shows how the major components of OVN and related + software interact. Starting at the top of the diagram, we have: + + ā€¢ The Cloud Management System, as defined above. + + ā€¢ The OVN/CMS Plugin is the component of the CMS that inā€ + terfaces to OVN. In OpenStack, this is a Neutron plugin. + The pluginā€™s main purpose is to translate the CMSā€™s noā€ + tion of logical network configuration, stored in the + CMSā€™s configuration database in a CMS-specific format, + into an intermediate representation understood by OVN. + + This component is necessarily CMS-specific, so a new pluā€ + gin needs to be developed for each CMS that is integrated + with OVN. All of the components below this one in the diā€ + agram are CMS-independent. + + ā€¢ The OVN Northbound Database receives the intermediate + representation of logical network configuration passed + down by the OVN/CMS Plugin. The database schema is meant + to be ``impedance matchedā€™ā€™ with the concepts used in a + CMS, so that it directly supports notions of logical + switches, routers, ACLs, and so on. See ovn-nb(5) for deā€ + tails. + + The OVN Northbound Database has only two clients: the + OVN/CMS Plugin above it and ovn-northd below it. + + ā€¢ ovn-northd(8) connects to the OVN Northbound Database + above it and the OVN Southbound Database below it. It + translates the logical network configuration in terms of + conventional network concepts, taken from the OVN Northā€ + bound Database, into logical datapath flows in the OVN + Southbound Database below it. + + ā€¢ The OVN Southbound Database is the center of the system. + Its clients are ovn-northd(8) above it and ovn-conā€ā€ + troller(8) on every transport node below it. + + The OVN Southbound Database contains three kinds of data: + Physical Network (PN) tables that specify how to reach + hypervisor and other nodes, Logical Network (LN) tables + that describe the logical network in terms of ``logical + datapath flows,ā€™ā€™ and Binding tables that link logical + network componentsā€™ locations to the physical network. + The hypervisors populate the PN and Port_Binding tables, + whereas ovn-northd(8) populates the LN tables. + + OVN Southbound Database performance must scale with the + number of transport nodes. This will likely require some + work on ovsdb-server(1) as we encounter bottlenecks. + Clustering for availability may be needed. + + The remaining components are replicated onto each hypervisor: + + ā€¢ ovn-controller(8) is OVNā€™s agent on each hypervisor and + software gateway. Northbound, it connects to the OVN + Southbound Database to learn about OVN configuration and + status and to populate the PN table and the Chassis colā€ + umn in Binding table with the hypervisorā€™s status. Southā€ + bound, it connects to ovs-vswitchd(8) as an OpenFlow conā€ + troller, for control over network traffic, and to the loā€ + cal ovsdb-server(1) to allow it to monitor and control + Open vSwitch configuration. + + ā€¢ ovs-vswitchd(8) and ovsdb-server(1) are conventional comā€ + ponents of Open vSwitch. + + CMS + | + | + +-----------|-----------+ + | | | + | OVN/CMS Plugin | + | | | + | | | + | OVN Northbound DB | + | | | + | | | + | ovn-northd | + | | | + +-----------|-----------+ + | + | + +-------------------+ + | OVN Southbound DB | + +-------------------+ + | + | + +------------------+------------------+ + | | | + HV 1 | | HV n | + +---------------|---------------+ . +---------------|---------------+ + | | | . | | | + | ovn-controller | . | ovn-controller | + | | | | . | | | | + | | | | | | | | + | ovs-vswitchd ovsdb-server | | ovs-vswitchd ovsdb-server | + | | | | + +-------------------------------+ +-------------------------------+ + + + Information Flow in OVN + Configuration data in OVN flows from north to south. The CMS, through + its OVN/CMS plugin, passes the logical network configuration to + ovn-northd via the northbound database. In turn, ovn-northd compiles + the configuration into a lower-level form and passes it to all of the + chassis via the southbound database. + + Status information in OVN flows from south to north. OVN currently proā€ + vides only a few forms of status information. First, ovn-northd popuā€ + lates the up column in the northbound Logical_Switch_Port table: if a + logical portā€™s chassis column in the southbound Port_Binding table is + nonempty, it sets up to true, otherwise to false. This allows the CMS + to detect when a VMā€™s networking has come up. + + Second, OVN provides feedback to the CMS on the realization of its conā€ + figuration, that is, whether the configuration provided by the CMS has + taken effect. This feature requires the CMS to participate in a seā€ + quence number protocol, which works the following way: + + 1. When the CMS updates the configuration in the northbound + database, as part of the same transaction, it increments the + value of the nb_cfg column in the NB_Global table. (This is + only necessary if the CMS wants to know when the configuraā€ + tion has been realized.) + + 2. When ovn-northd updates the southbound database based on a + given snapshot of the northbound database, it copies nb_cfg + from northbound NB_Global into the southbound database + SB_Global table, as part of the same transaction. (Thus, an + observer monitoring both databases can determine when the + southbound database is caught up with the northbound.) + + 3. After ovn-northd receives confirmation from the southbound + database server that its changes have committed, it updates + sb_cfg in the northbound NB_Global table to the nb_cfg verā€ + sion that was pushed down. (Thus, the CMS or another obā€ + server can determine when the southbound database is caught + up without a connection to the southbound database.) + + 4. The ovn-controller process on each chassis receives the upā€ + dated southbound database, with the updated nb_cfg. This + process in turn updates the physical flows installed in the + chassisā€™s Open vSwitch instances. When it receives confirmaā€ + tion from Open vSwitch that the physical flows have been upā€ + dated, it updates nb_cfg in its own Chassis record in the + southbound database. + + 5. ovn-northd monitors the nb_cfg column in all of the Chassis + records in the southbound database. It keeps track of the + minimum value among all the records and copies it into the + hv_cfg column in the northbound NB_Global table. (Thus, the + CMS or another observer can determine when all of the hyperā€ + visors have caught up to the northbound configuration.) + + Chassis Setup + Each chassis in an OVN deployment must be configured with an Open + vSwitch bridge dedicated for OVNā€™s use, called the integration bridge. + System startup scripts may create this bridge prior to starting + ovn-controller if desired. If this bridge does not exist when ovn-conā€ + troller starts, it will be created automatically with the default conā€ + figuration suggested below. The ports on the integration bridge inā€ + clude: + + ā€¢ On any chassis, tunnel ports that OVN uses to maintain + logical network connectivity. ovn-controller adds, upā€ + dates, and removes these tunnel ports. + + ā€¢ On a hypervisor, any VIFs that are to be attached to logā€ + ical networks. For instances connected through software + emulated ports such as TUN/TAP or VETH pairs, the hyperā€ + visor itself will normally create ports and plug them + into the integration bridge. For instances connected + through representor ports, typically used with hardware + offload, the ovn-controller may on CMS direction consult + a VIF plug provider for representor port lookup and plug + them into the integration bridge (please refer to Docuā€ā€ + mentation/topā€ā€ + ics/vif-plug-providers/vif-plug-providers.rst + for more information). In both cases the conventions deā€ + scribed in Documentation/topics/integration.rst in the + Open vSwitch source tree is followed to ensure mapping + between OVN logical port and VIF. (This is pre-existing + integration work that has already been done on hyperviā€ + sors that support OVS.) + + ā€¢ On a gateway, the physical port used for logical network + connectivity. System startup scripts add this port to the + bridge prior to starting ovn-controller. This can be a + patch port to another bridge, instead of a physical port, + in more sophisticated setups. + + Other ports should not be attached to the integration bridge. In parā€ + ticular, physical ports attached to the underlay network (as opposed to + gateway ports, which are physical ports attached to logical networks) + must not be attached to the integration bridge. Underlay physical ports + should instead be attached to a separate Open vSwitch bridge (they need + not be attached to any bridge at all, in fact). + + The integration bridge should be configured as described below. The efā€ + fect of each of these settings is documented in + ovs-vswitchd.conf.db(5): + + fail-mode=secure + Avoids switching packets between isolated logical netā€ + works before ovn-controller starts up. See Controller + Failure Settings in ovs-vsctl(8) for more information. + + other-config:disable-in-band=true + Suppresses in-band control flows for the integration + bridge. It would be unusual for such flows to show up + anyway, because OVN uses a local controller (over a Unix + domain socket) instead of a remote controller. Itā€™s posā€ + sible, however, for some other bridge in the same system + to have an in-band remote controller, and in that case + this suppresses the flows that in-band control would orā€ + dinarily set up. Refer to the documentation for more inā€ + formation. + + The customary name for the integration bridge is br-int, but another + name may be used. + + Logical Networks + Logical network concepts in OVN include logical switches and logical + routers, the logical version of Ethernet switches and IP routers, reā€ + spectively. Like their physical cousins, logical switches and routers + can be connected into sophisticated topologies. Logical switches and + routers are ordinarily purely logical entities, that is, they are not + associated or bound to any physical location, and they are implemented + in a distributed manner at each hypervisor that participates in OVN. + + Logical switch ports (LSPs) are points of connectivity into and out of + logical switches. There are many kinds of logical switch ports. The + most ordinary kind represent VIFs, that is, attachment points for VMs + or containers. A VIF logical port is associated with the physical locaā€ + tion of its VM, which might change as the VM migrates. (A VIF logical + port can be associated with a VM that is powered down or suspended. + Such a logical port has no location and no connectivity.) + + Logical router ports (LRPs) are points of connectivity into and out of + logical routers. A LRP connects a logical router either to a logical + switch or to another logical router. Logical routers only connect to + VMs, containers, and other network nodes indirectly, through logical + switches. + + Logical switches and logical routers have distinct kinds of logical + ports, so properly speaking one should usually talk about logical + switch ports or logical router ports. However, an unqualified ``logical + portā€™ā€™ usually refers to a logical switch port. + + When a VM sends a packet to a VIF logical switch port, the Open vSwitch + flow tables simulate the packetā€™s journey through that logical switch + and any other logical routers and logical switches that it might enā€ + counter. This happens without transmitting the packet across any physiā€ + cal medium: the flow tables implement all of the switching and routing + decisions and behavior. If the flow tables ultimately decide to output + the packet at a logical port attached to another hypervisor (or another + kind of transport node), then that is the time at which the packet is + encapsulated for physical network transmission and sent. + + Logical Switch Port Types + + OVN supports a number of kinds of logical switch ports. VIF ports that + connect to VMs or containers, described above, are the most ordinary + kind of LSP. In the OVN northbound database, VIF ports have an empty + string for their type. This section describes some of the additional + port types. + + A router logical switch port connects a logical switch to a logical + router, designating a particular LRP as its peer. + + A localnet logical switch port bridges a logical switch to a physical + VLAN. A logical switch may have one or more localnet ports. Such a logā€ + ical switch is used in two scenarios: + + ā€¢ With one or more router logical switch ports, to attach + L3 gateway routers and distributed gateways to a physical + network. + + ā€¢ With one or more VIF logical switch ports, to attach VMs + or containers directly to a physical network. In this + case, the logical switch is not really logical, since it + is bridged to the physical network rather than insulated + from it, and therefore cannot have independent but overā€ + lapping IP address namespaces, etc. A deployment might + nevertheless choose such a configuration to take advanā€ + tage of the OVN control plane and features such as port + security and ACLs. + + When a logical switch contains multiple localnet ports, the following + is assumed. + + ā€¢ Each chassis has a bridge mapping for one of the localnet + physical networks only. + + ā€¢ To facilitate interconnectivity between VIF ports of the + switch that are located on different chassis with differā€ + ent physical network connectivity, the fabric implements + L3 routing between these adjacent physical network segā€ + ments. + + Note: nothing said above implies that a chassis cannot be plugged to + multiple physical networks as long as they belong to different + switches. + + A localport logical switch port is a special kind of VIF logical switch + port. These ports are present in every chassis, not bound to any parā€ + ticular one. Traffic to such a port will never be forwarded through a + tunnel, and traffic from such a port is expected to be destined only to + the same chassis, typically in response to a request it received. Openā€ + Stack Neutron uses a localport port to serve metadata to VMs. A metaā€ + data proxy process is attached to this port on every host and all VMs + within the same network will reach it at the same IP/MAC address withā€ + out any traffic being sent over a tunnel. For further details, see the + OpenStack documentation for networking-ovn. + + LSP types vtep and l2gateway are used for gateways. See Gateways, beā€ + low, for more information. + + Implementation Details + + These concepts are details of how OVN is implemented internally. They + might still be of interest to users and administrators. + + Logical datapaths are an implementation detail of logical networks in + the OVN southbound database. ovn-northd translates each logical switch + or router in the northbound database into a logical datapath in the + southbound database Datapath_Binding table. + + For the most part, ovn-northd also translates each logical switch port + in the OVN northbound database into a record in the southbound database + Port_Binding table. The latter table corresponds roughly to the northā€ + bound Logical_Switch_Port table. It has multiple types of logical port + bindings, of which many types correspond directly to northbound LSP + types. LSP types handled this way include VIF (empty string), localnet, + localport, vtep, and l2gateway. + + The Port_Binding table has some types of port binding that do not corā€ + respond directly to logical switch port types. The common is patch port + bindings, known as logical patch ports. These port bindings always ocā€ + cur in pairs, and a packet that enters on either side comes out on the + other. ovn-northd connects logical switches and logical routers toā€ + gether using logical patch ports. + + Port bindings with types vtep, l2gateway, l3gateway, and chassisrediā€ā€ + rect are used for gateways. These are explained in Gateways, below. + + Gateways + Gateways provide limited connectivity between logical networks and + physical ones. They can also provide connectivity between different OVN + deployments. This section will focus on the former, and the latter will + be described in details in section OVN Deployments Interconnection. + + OVN support multiple kinds of gateways. + + VTEP Gateways + + A ``VTEP gatewayā€™ā€™ connects an OVN logical network to a physical (or + virtual) switch that implements the OVSDB VTEP schema that accompanies + Open vSwitch. (The ``VTEP gatewayā€™ā€™ term is a misnomer, since a VTEP is + just a VXLAN Tunnel Endpoint, but it is a well established name.) See + Life Cycle of a VTEP gateway, below, for more information. + + The main intended use case for VTEP gateways is to attach physical + servers to an OVN logical network using a physical top-of-rack switch + that supports the OVSDB VTEP schema. + + L2 Gateways + + A L2 gateway simply attaches a designated physical L2 segment available + on some chassis to a logical network. The physical network effectively + becomes part of the logical network. + + To set up a L2 gateway, the CMS adds an l2gateway LSP to an appropriate + logical switch, setting LSP options to name the chassis on which it + should be bound. ovn-northd copies this configuration into a southbound + Port_Binding record. On the designated chassis, ovn-controller forwards + packets appropriately to and from the physical segment. + + L2 gateway ports have features in common with localnet ports. However, + with a localnet port, the physical network becomes the transport beā€ + tween hypervisors. With an L2 gateway, packets are still transported + between hypervisors over tunnels and the l2gateway port is only used + for the packets that are on the physical network. The application for + L2 gateways is similar to that for VTEP gateways, e.g. to add non-virā€ + tualized machines to a logical network, but L2 gateways do not require + special support from top-of-rack hardware switches. + + L3 Gateway Routers + + As described above under Logical Networks, ordinary OVN logical routers + are distributed: they are not implemented in a single place but rather + in every hypervisor chassis. This is a problem for stateful services + such as SNAT and DNAT, which need to be implemented in a centralized + manner. + + To allow for this kind of functionality, OVN supports L3 gateway + routers, which are OVN logical routers that are implemented in a desigā€ + nated chassis. Gateway routers are typically used between distributed + logical routers and physical networks. The distributed logical router + and the logical switches behind it, to which VMs and containers attach, + effectively reside on each hypervisor. The distributed router and the + gateway router are connected by another logical switch, sometimes reā€ + ferred to as a ``joinā€™ā€™ logical switch. (OVN logical routers may be + connected to one another directly, without an intervening switch, but + the OVN implementation only supports gateway logical routers that are + connected to logical switches. Using a join logical switch also reduces + the number of IP addresses needed on the distributed router.) On the + other side, the gateway router connects to another logical switch that + has a localnet port connecting to the physical network. + + The following diagram shows a typical situation. One or more logical + switches LS1, ..., LSn connect to distributed logical router LR1, which + in turn connects through LSjoin to gateway logical router GLR, which + also connects to logical switch LSlocal, which includes a localnet port + to attach to the physical network. + + LSlocal + | + GLR + | + LSjoin + | + LR1 + | + +----+----+ + | | | + LS1 ... LSn + + + To configure an L3 gateway router, the CMS sets options:chassis in the + routerā€™s northbound Logical_Router to the chassisā€™s name. In response, + ovn-northd uses a special l3gateway port binding (instead of a patch + binding) in the southbound database to connect the logical router to + its neighbors. In turn, ovn-controller tunnels packets to this port + binding to the designated L3 gateway chassis, instead of processing + them locally. + + DNAT and SNAT rules may be associated with a gateway router, which proā€ + vides a central location that can handle one-to-many SNAT (aka IP masā€ + querading). Distributed gateway ports, described below, also support + NAT. + + Distributed Gateway Ports + + A distributed gateway port is a logical router port that is specially + configured to designate one distinguished chassis, called the gateway + chassis, for centralized processing. A distributed gateway port should + connect to a logical switch that has an LSP that connects externally, + that is, either a localnet LSP or a connection to another OVN deployā€ + ment (see OVN Deployments Interconnection). Packets that traverse the + distributed gateway port are processed without involving the gateway + chassis when they can be, but when needed they do take an extra hop + through it. + + The following diagram illustrates the use of a distributed gateway + port. A number of logical switches LS1, ..., LSn connect to distributed + logical router LR1, which in turn connects through the distributed + gateway port to logical switch LSlocal that includes a localnet port to + attach to the physical network. + + LSlocal + | + LR1 + | + +----+----+ + | | | + LS1 ... LSn + + + ovn-northd creates two southbound Port_Binding records to represent a + distributed gateway port, instead of the usual one. One of these is a + patch port binding named for the LRP, which is used for as much traffic + as it can. The other one is a port binding with type chassisredirect, + named cr-port. The chassisredirect port binding has one specialized + job: when a packet is output to it, the flow table causes it to be tunā€ + neled to the gateway chassis, at which point it is automatically output + to the patch port binding. Thus, the flow table can output to this port + binding in cases where a particular task has to happen on the gateway + chassis. The chassisredirect port binding is not otherwise used (for + example, it never receives packets). + + The CMS may configure distributed gateway ports three different ways. + See Distributed Gateway Ports in the documentation for Logiā€ā€ + cal_Router_Port in ovn-nb(5) for details. + + Distributed gateway ports support high availability. When more than one + chassis is specified, OVN only uses one at a time as the gateway chasā€ + sis. OVN uses BFD to monitor gateway connectivity, preferring the highā€ + est-priority gateway that is online. + + A logical router can have multiple distributed gateway ports, each conā€ + necting different external networks. Load balancing is not yet supā€ + ported for logical routers with more than one distributed gateway port + configured. + + Physical VLAN MTU Issues + + Consider the preceding diagram again: + + LSlocal + | + LR1 + | + +----+----+ + | | | + LS1 ... LSn + + + Suppose that each logical switch LS1, ..., LSn is bridged to a physical + VLAN-tagged network attached to a localnet port on LSlocal, over a disā€ + tributed gateway port on LR1. If a packet originating on LSi is desā€ + tined to the external network, OVN sends it to the gateway chassis over + a tunnel. There, the packet traverses LR1ā€™s logical router pipeline, + possibly undergoes NAT, and eventually ends up at LSlocalā€™s localnet + port. If all of the physical links in the network have the same MTU, + then the packetā€™s transit across a tunnel causes an MTU problem: tunnel + overhead prevents a packet that uses the full physical MTU from crossā€ + ing the tunnel to the gateway chassis (without fragmentation). + + OVN offers two solutions to this problem, the reside-on-redirect-chasā€ā€ + sis and redirect-type options. Both solutions require each logical + switch LS1, ..., LSn to include a localnet logical switch port LN1, + ..., LNn respectively, that is present on each chassis. Both cause + packets to be sent over the localnet ports instead of tunnels. They + differ in which packets-some or all-are sent this way. The most promiā€ + nent tradeoff between these options is that reside-on-redirect-chassis + is easier to configure and that redirect-type performs better for east- + west traffic. + + The first solution is the reside-on-redirect-chassis option for logical + router ports. Setting this option on a LRP from (e.g.) LS1 to LR1 disā€ + ables forwarding from LS1 to LR1 except on the gateway chassis. On + chassis other than the gateway chassis, this single change means that + packets that would otherwise have been forwarded to LR1 are instead + forwarded to LN1. The instance of LN1 on the gateway chassis then reā€ + ceives the packet and forwards it to LR1. The packet traverses the LR1 + logical router pipeline, possibly undergoes NAT, and eventually ends up + at LSlocalā€™s localnet port. The packet never traverses a tunnel, avoidā€ + ing the MTU issue. + + This option has the further consequence of centralizing ``distributedā€™ā€™ + logical router LR1, since no packets are forwarded from LS1 to LR1 on + any chassis other than the gateway chassis. Therefore, east-west trafā€ + fic passes through the gateway chassis, not just north-south. (The + naive ``fixā€™ā€™ of allowing east-west traffic to flow directly between + chassis over LN1 does not work because routing sets the Ethernet source + address to LR1ā€™s source address. Seeing this single Ethernet source adā€ + dress originate from all of the chassis will confuse the physical + switch.) + + Do not set the reside-on-redirect-chassis option on a distributed gateā€ + way port. In the diagram above, it would be set on the LRPs connecting + LS1, ..., LSn to LR1. + + The second solution is the redirect-type option for distributed gateway + ports. Setting this option to bridged causes packets that are rediā€ + rected to the gateway chassis to go over the localnet ports instead of + being tunneled. This option does not change how OVN treats packets not + redirected to the gateway chassis. + + The redirect-type option requires the administrator or the CMS to conā€ + figure each participating chassis with a unique Ethernet address for + the logical router by setting ovn-chassis-mac-mappings in the Open + vSwitch database, for use by ovn-controller. This makes it more diffiā€ + cult to configure than reside-on-redirect-chassis. + + Set the redirect-type option on a distributed gateway port. + + Using Distributed Gateway Ports For Scalability + + Although the primary goal of distributed gateway ports is to provide + connectivity to external networks, there is a special use case for + scalability. + + In some deployments, such as the ones using ovn-kubernetes, logical + switches are bound to individual chassises, and are connected by a disā€ + tributed logical router. In such deployments, the chassis level logical + switches are centralized on the chassis instead of distributed, which + means the ovn-controller on each chassis doesnā€™t need to process flows + and ports of logical switches on other chassises. However, without any + specific hint, ovn-controller would still process all the logical + switches as if they are fully distributed. In this case, distributed + gateway port can be very useful. The chassis level logical switches can + be connected to the distributed router using distributed gateway ports, + by setting the gateway chassis (or HA chassis groups with only a single + chassis in it) to the chassis that each logical switch is bound to. + ovn-controller would then skip processing the logical switches on all + the other chassises, largely improving the scalability, especially when + there are a big number of chassises. + + Life Cycle of a VIF + Tables and their schemas presented in isolation are difficult to underā€ + stand. Hereā€™s an example. + + A VIF on a hypervisor is a virtual network interface attached either to + a VM or a container running directly on that hypervisor (This is difā€ + ferent from the interface of a container running inside a VM). + + The steps in this example refer often to details of the OVN and OVN + Northbound database schemas. Please see ovn-sb(5) and ovn-nb(5), reā€ + spectively, for the full story on these databases. + + 1. A VIFā€™s life cycle begins when a CMS administrator creates a + new VIF using the CMS user interface or API and adds it to a + switch (one implemented by OVN as a logical switch). The CMS + updates its own configuration. This includes associating + unique, persistent identifier vif-id and Ethernet address + mac with the VIF. + + 2. The CMS plugin updates the OVN Northbound database to inā€ + clude the new VIF, by adding a row to the Logiā€ā€ + cal_Switch_Port table. In the new row, name is vif-id, mac + is mac, switch points to the OVN logical switchā€™s Logiā€ + cal_Switch record, and other columns are initialized approā€ + priately. + + 3. ovn-northd receives the OVN Northbound database update. In + turn, it makes the corresponding updates to the OVN Southā€ + bound database, by adding rows to the OVN Southbound dataā€ + base Logical_Flow table to reflect the new port, e.g. add a + flow to recognize that packets destined to the new portā€™s + MAC address should be delivered to it, and update the flow + that delivers broadcast and multicast packets to include the + new port. It also creates a record in the Binding table and + populates all its columns except the column that identifies + the chassis. + + 4. On every hypervisor, ovn-controller receives the Logiā€ā€ + cal_Flow table updates that ovn-northd made in the previous + step. As long as the VM that owns the VIF is powered off, + ovn-controller cannot do much; it cannot, for example, + arrange to send packets to or receive packets from the VIF, + because the VIF does not actually exist anywhere. + + 5. Eventually, a user powers on the VM that owns the VIF. On + the hypervisor where the VM is powered on, the integration + between the hypervisor and Open vSwitch (described in Docuā€ā€ + mentation/topics/integration.rst in the Open vSwitch source + tree) adds the VIF to the OVN integration bridge and stores + vif-id in external_ids:iface-id to indicate that the interā€ + face is an instantiation of the new VIF. (None of this code + is new in OVN; this is pre-existing integration work that + has already been done on hypervisors that support OVS.) + + 6. On the hypervisor where the VM is powered on, ovn-controller + notices external_ids:iface-id in the new Interface. In reā€ + sponse, in the OVN Southbound DB, it updates the Binding taā€ + bleā€™s chassis column for the row that links the logical port + from external_ids: iface-id to the hypervisor. Afterward, + ovn-controller updates the local hypervisorā€™s OpenFlow taā€ + bles so that packets to and from the VIF are properly hanā€ + dled. + + 7. Some CMS systems, including OpenStack, fully start a VM only + when its networking is ready. To support this, ovn-northd + notices the chassis column updated for the row in Binding + table and pushes this upward by updating the up column in + the OVN Northbound databaseā€™s Logical_Switch_Port table to + indicate that the VIF is now up. The CMS, if it uses this + feature, can then react by allowing the VMā€™s execution to + proceed. + + 8. On every hypervisor but the one where the VIF resides, + ovn-controller notices the completely populated row in the + Binding table. This provides ovn-controller the physical loā€ + cation of the logical port, so each instance updates the + OpenFlow tables of its switch (based on logical datapath + flows in the OVN DB Logical_Flow table) so that packets to + and from the VIF can be properly handled via tunnels. + + 9. Eventually, a user powers off the VM that owns the VIF. On + the hypervisor where the VM was powered off, the VIF is + deleted from the OVN integration bridge. + + 10. On the hypervisor where the VM was powered off, ovn-conā€ā€ + troller notices that the VIF was deleted. In response, it + removes the Chassis column content in the Binding table for + the logical port. + + 11. On every hypervisor, ovn-controller notices the empty Chasā€ā€ + sis column in the Binding tableā€™s row for the logical port. + This means that ovn-controller no longer knows the physical + location of the logical port, so each instance updates its + OpenFlow table to reflect that. + + 12. Eventually, when the VIF (or its entire VM) is no longer + needed by anyone, an administrator deletes the VIF using the + CMS user interface or API. The CMS updates its own configuā€ + ration. + + 13. The CMS plugin removes the VIF from the OVN Northbound dataā€ + base, by deleting its row in the Logical_Switch_Port table. + + 14. ovn-northd receives the OVN Northbound update and in turn + updates the OVN Southbound database accordingly, by removing + or updating the rows from the OVN Southbound database Logiā€ā€ + cal_Flow table and Binding table that were related to the + now-destroyed VIF. + + 15. On every hypervisor, ovn-controller receives the Logiā€ā€ + cal_Flow table updates that ovn-northd made in the previous + step. ovn-controller updates OpenFlow tables to reflect the + update, although there may not be much to do, since the VIF + had already become unreachable when it was removed from the + Binding table in a previous step. + + Life Cycle of a Container Interface Inside a VM + OVN provides virtual network abstractions by converting information + written in OVN_NB database to OpenFlow flows in each hypervisor. Secure + virtual networking for multi-tenants can only be provided if OVN conā€ + troller is the only entity that can modify flows in Open vSwitch. When + the Open vSwitch integration bridge resides in the hypervisor, it is a + fair assumption to make that tenant workloads running inside VMs cannot + make any changes to Open vSwitch flows. + + If the infrastructure provider trusts the applications inside the conā€ + tainers not to break out and modify the Open vSwitch flows, then conā€ + tainers can be run in hypervisors. This is also the case when containā€ + ers are run inside the VMs and Open vSwitch integration bridge with + flows added by OVN controller resides in the same VM. For both the + above cases, the workflow is the same as explained with an example in + the previous section ("Life Cycle of a VIF"). + + This section talks about the life cycle of a container interface (CIF) + when containers are created in the VMs and the Open vSwitch integration + bridge resides inside the hypervisor. In this case, even if a container + application breaks out, other tenants are not affected because the conā€ + tainers running inside the VMs cannot modify the flows in the Open + vSwitch integration bridge. + + When multiple containers are created inside a VM, there are multiple + CIFs associated with them. The network traffic associated with these + CIFs need to reach the Open vSwitch integration bridge running in the + hypervisor for OVN to support virtual network abstractions. OVN should + also be able to distinguish network traffic coming from different CIFs. + There are two ways to distinguish network traffic of CIFs. + + One way is to provide one VIF for every CIF (1:1 model). This means + that there could be a lot of network devices in the hypervisor. This + would slow down OVS because of all the additional CPU cycles needed for + the management of all the VIFs. It would also mean that the entity creā€ + ating the containers in a VM should also be able to create the correā€ + sponding VIFs in the hypervisor. + + The second way is to provide a single VIF for all the CIFs (1:many + model). OVN could then distinguish network traffic coming from differā€ + ent CIFs via a tag written in every packet. OVN uses this mechanism and + uses VLAN as the tagging mechanism. + + 1. A CIFā€™s life cycle begins when a container is spawned inside + a VM by the either the same CMS that created the VM or a + tenant that owns that VM or even a container Orchestration + System that is different than the CMS that initially created + the VM. Whoever the entity is, it will need to know the vif- + id that is associated with the network interface of the VM + through which the container interfaceā€™s network traffic is + expected to go through. The entity that creates the conā€ + tainer interface will also need to choose an unused VLAN inā€ + side that VM. + + 2. The container spawning entity (either directly or through + the CMS that manages the underlying infrastructure) updates + the OVN Northbound database to include the new CIF, by + adding a row to the Logical_Switch_Port table. In the new + row, name is any unique identifier, parent_name is the vif- + id of the VM through which the CIFā€™s network traffic is exā€ + pected to go through and the tag is the VLAN tag that idenā€ + tifies the network traffic of that CIF. + + 3. ovn-northd receives the OVN Northbound database update. In + turn, it makes the corresponding updates to the OVN Southā€ + bound database, by adding rows to the OVN Southbound dataā€ + baseā€™s Logical_Flow table to reflect the new port and also + by creating a new row in the Binding table and populating + all its columns except the column that identifies the chasā€ā€ + sis. + + 4. On every hypervisor, ovn-controller subscribes to the + changes in the Binding table. When a new row is created by + ovn-northd that includes a value in parent_port column of + Binding table, the ovn-controller in the hypervisor whose + OVN integration bridge has that same value in vif-id in exā€ā€ + ternal_ids:iface-id updates the local hypervisorā€™s OpenFlow + tables so that packets to and from the VIF with the particuā€ + lar VLAN tag are properly handled. Afterward it updates the + chassis column of the Binding to reflect the physical locaā€ + tion. + + 5. One can only start the application inside the container afā€ + ter the underlying network is ready. To support this, + ovn-northd notices the updated chassis column in Binding taā€ + ble and updates the up column in the OVN Northbound dataā€ + baseā€™s Logical_Switch_Port table to indicate that the CIF is + now up. The entity responsible to start the container appliā€ + cation queries this value and starts the application. + + 6. Eventually the entity that created and started the conā€ + tainer, stops it. The entity, through the CMS (or directly) + deletes its row in the Logical_Switch_Port table. + + 7. ovn-northd receives the OVN Northbound update and in turn + updates the OVN Southbound database accordingly, by removing + or updating the rows from the OVN Southbound database Logiā€ā€ + cal_Flow table that were related to the now-destroyed CIF. + It also deletes the row in the Binding table for that CIF. + + 8. On every hypervisor, ovn-controller receives the Logiā€ā€ + cal_Flow table updates that ovn-northd made in the previous + step. ovn-controller updates OpenFlow tables to reflect the + update. + + Architectural Physical Life Cycle of a Packet + This section describes how a packet travels from one virtual machine or + container to another through OVN. This description focuses on the physā€ + ical treatment of a packet; for a description of the logical life cycle + of a packet, please refer to the Logical_Flow table in ovn-sb(5). + + This section mentions several data and metadata fields, for clarity + summarized here: + + tunnel key + When OVN encapsulates a packet in Geneve or another tunā€ + nel, it attaches extra data to it to allow the receiving + OVN instance to process it correctly. This takes differā€ + ent forms depending on the particular encapsulation, but + in each case we refer to it here as the ``tunnel key.ā€™ā€™ + See Tunnel Encapsulations, below, for details. + + logical datapath field + A field that denotes the logical datapath through which a + packet is being processed. OVN uses the field that Openā€ + Flow 1.1+ simply (and confusingly) calls ``metadataā€™ā€™ to + store the logical datapath. (This field is passed across + tunnels as part of the tunnel key.) + + logical input port field + A field that denotes the logical port from which the + packet entered the logical datapath. OVN stores this in + Open vSwitch extension register number 14. + + Geneve and STT tunnels pass this field as part of the + tunnel key. Ramp switch VXLAN tunnels do not explicitly + carry a logical input port, but since they are used to + communicate with gateways that from OVNā€™s perspective + consist of only a single logical port, so that OVN can + set the logical input port field to this one on ingress + to the OVN logical pipeline. As for regular VXLAN tunā€ + nels, they donā€™t carry input port field at all. This puts + additional limitations on cluster capabilities that are + described in Tunnel Encapsulations section. + + logical output port field + A field that denotes the logical port from which the + packet will leave the logical datapath. This is initialā€ + ized to 0 at the beginning of the logical ingress + pipeline. OVN stores this in Open vSwitch extension regā€ + ister number 15. + + Geneve, STT and regular VXLAN tunnels pass this field as + part of the tunnel key. Ramp switch VXLAN tunnels do not + transmit the logical output port field, and since they do + not carry a logical output port field in the tunnel key, + when a packet is received from ramp switch VXLAN tunnel + by an OVN hypervisor, the packet is resubmitted to table + 8 to determine the output port(s); when the packet + reaches table 39, these packets are resubmitted to table + 40 for local delivery by checking a MLF_RCV_FROM_RAMP + flag, which is set when the packet arrives from a ramp + tunnel. + + conntrack zone field for logical ports + A field that denotes the connection tracking zone for + logical ports. The value only has local significance and + is not meaningful between chassis. This is initialized to + 0 at the beginning of the logical ingress pipeline. OVN + stores this in Open vSwitch extension register number 13. + + conntrack zone fields for routers + Fields that denote the connection tracking zones for + routers. These values only have local significance and + are not meaningful between chassis. OVN stores the zone + information for north to south traffic (for DNATting or + ECMP symmetric replies) in Open vSwitch extension regisā€ + ter number 11 and zone information for south to north + traffic (for SNATing) in Open vSwitch extension register + number 12. + + logical flow flags + The logical flags are intended to handle keeping context + between tables in order to decide which rules in subseā€ + quent tables are matched. These values only have local + significance and are not meaningful between chassis. OVN + stores the logical flags in Open vSwitch extension regisā€ + ter number 10. + + VLAN ID + The VLAN ID is used as an interface between OVN and conā€ + tainers nested inside a VM (see Life Cycle of a container + interface inside a VM, above, for more information). + + Initially, a VM or container on the ingress hypervisor sends a packet + on a port attached to the OVN integration bridge. Then: + + 1. OpenFlow table 0 performs physical-to-logical translation. + It matches the packetā€™s ingress port. Its actions annotate + the packet with logical metadata, by setting the logical + datapath field to identify the logical datapath that the + packet is traversing and the logical input port field to + identify the ingress port. Then it resubmits to table 8 to + enter the logical ingress pipeline. + + Packets that originate from a container nested within a VM + are treated in a slightly different way. The originating + container can be distinguished based on the VIF-specific + VLAN ID, so the physical-to-logical translation flows addiā€ + tionally match on VLAN ID and the actions strip the VLAN + header. Following this step, OVN treats packets from conā€ + tainers just like any other packets. + + Table 0 also processes packets that arrive from other chasā€ + sis. It distinguishes them from other packets by ingress + port, which is a tunnel. As with packets just entering the + OVN pipeline, the actions annotate these packets with logiā€ + cal datapath metadata. For tunnel types that support it, + they are also annotated with logical ingress port metadata. + In addition, the actions set the logical output port field, + which is available because in OVN tunneling occurs after the + logical output port is known. These pieces of information + are obtained from the tunnel encapsulation metadata (see + Tunnel Encapsulations for encoding details). Then the acā€ + tions resubmit to table 38 to enter the logical egress + pipeline. + + 2. OpenFlow tables 8 through 31 execute the logical ingress + pipeline from the Logical_Flow table in the OVN Southbound + database. These tables are expressed entirely in terms of + logical concepts like logical ports and logical datapaths. A + big part of ovn-controllerā€™s job is to translate them into + equivalent OpenFlow (in particular it translates the table + numbers: Logical_Flow tables 0 through 23 become OpenFlow + tables 8 through 31). + + Each logical flow maps to one or more OpenFlow flows. An acā€ + tual packet ordinarily matches only one of these, although + in some cases it can match more than one of these flows + (which is not a problem because all of them have the same + actions). ovn-controller uses the first 32 bits of the logiā€ + cal flowā€™s UUID as the cookie for its OpenFlow flow or + flows. (This is not necessarily unique, since the first 32 + bits of a logical flowā€™s UUID is not necessarily unique.) + + Some logical flows can map to the Open vSwitch ``conjunctive + matchā€™ā€™ extension (see ovs-fields(7)). Flows with a conjuncā€ā€ + tion action use an OpenFlow cookie of 0, because they can + correspond to multiple logical flows. The OpenFlow flow for + a conjunctive match includes a match on conj_id. + + Some logical flows may not be represented in the OpenFlow + tables on a given hypervisor, if they could not be used on + that hypervisor. For example, if no VIF in a logical switch + resides on a given hypervisor, and the logical switch is not + otherwise reachable on that hypervisor (e.g. over a series + of hops through logical switches and routers starting from a + VIF on the hypervisor), then the logical flow may not be + represented there. + + Most OVN actions have fairly obvious implementations in + OpenFlow (with OVS extensions), e.g. next; is implemented as + resubmit, field = constant; as set_field. A few are worth + describing in more detail: + + output: + Implemented by resubmitting the packet to table 37. + If the pipeline executes more than one output action, + then each one is separately resubmitted to table 37. + This can be used to send multiple copies of the + packet to multiple ports. (If the packet was not modā€ + ified between the output actions, and some of the + copies are destined to the same hypervisor, then usā€ + ing a logical multicast output port would save bandā€ + width between hypervisors.) + + get_arp(P, A); + get_nd(P, A); + Implemented by storing arguments into OpenFlow fields, + then resubmitting to table 66, which ovn-controller + populates with flows generated from the MAC_Binding taā€ + ble in the OVN Southbound database. If there is a match + in table 66, then its actions store the bound MAC in + the Ethernet destination address field. + + (The OpenFlow actions save and restore the OpenFlow + fields used for the arguments, so that the OVN actions + do not have to be aware of this temporary use.) + + put_arp(P, A, E); + put_nd(P, A, E); + Implemented by storing the arguments into OpenFlow + fields, then outputting a packet to ovn-controller, + which updates the MAC_Binding table. + + (The OpenFlow actions save and restore the OpenFlow + fields used for the arguments, so that the OVN actions + do not have to be aware of this temporary use.) + + R = lookup_arp(P, A, M); + R = lookup_nd(P, A, M); + Implemented by storing arguments into OpenFlow fields, + then resubmitting to table 67, which ovn-controller + populates with flows generated from the MAC_Binding taā€ + ble in the OVN Southbound database. If there is a match + in table 67, then its actions set the logical flow flag + MLF_LOOKUP_MAC. + + (The OpenFlow actions save and restore the OpenFlow + fields used for the arguments, so that the OVN actions + do not have to be aware of this temporary use.) + + 3. OpenFlow tables 37 through 41 implement the output action in + the logical ingress pipeline. Specifically, table 37 serves + as an entry point to egress pipeline. Table 37 detects IP + packets that are too big for a corresponding interface. Taā€ + ble 38 produces ICMPv4 Fragmentation Needed (or ICMPv6 Too + Big) errors and deliver them back to the offending port. taā€ + ble 39 handles packets to remote hypervisors, table 40 hanā€ + dles packets to the local hypervisor, and table 41 checks + whether packets whose logical ingress and egress port are + the same should be discarded. + + Logical patch ports are a special case. Logical patch ports + do not have a physical location and effectively reside on + every hypervisor. Thus, flow table 40, for output to ports + on the local hypervisor, naturally implements output to uniā€ + cast logical patch ports too. However, applying the same + logic to a logical patch port that is part of a logical mulā€ + ticast group yields packet duplication, because each hyperā€ + visor that contains a logical port in the multicast group + will also output the packet to the logical patch port. Thus, + multicast groups implement output to logical patch ports in + table 39. + + Each flow in table 39 matches on a logical output port for + unicast or multicast logical ports that include a logical + port on a remote hypervisor. Each flowā€™s actions implement + sending a packet to the port it matches. For unicast logical + output ports on remote hypervisors, the actions set the tunā€ + nel key to the correct value, then send the packet on the + tunnel port to the correct hypervisor. (When the remote hyā€ + pervisor receives the packet, table 0 there will recognize + it as a tunneled packet and pass it along to table 40.) For + multicast logical output ports, the actions send one copy of + the packet to each remote hypervisor, in the same way as for + unicast destinations. If a multicast group includes a logiā€ + cal port or ports on the local hypervisor, then its actions + also resubmit to table 40. Table 39 also includes: + + ā€¢ A higher-priority rule to match packets received from + ramp switch tunnels, based on flag MLF_RCV_FROM_RAMP, + and resubmit these packets to table 40 for local deā€ + livery. Packets received from ramp switch tunnels + reach here because of a lack of logical output port + field in the tunnel key and thus these packets needed + to be submitted to table 8 to determine the output + port. + + ā€¢ A higher-priority rule to match packets received from + ports of type localport, based on the logical input + port, and resubmit these packets to table 40 for loā€ + cal delivery. Ports of type localport exist on every + hypervisor and by definition their traffic should + never go out through a tunnel. + + ā€¢ A higher-priority rule to match packets that have the + MLF_LOCAL_ONLY logical flow flag set, and whose desā€ + tination is a multicast address. This flag indicates + that the packet should not be delivered to remote hyā€ + pervisors, even if the multicast destination includes + ports on remote hypervisors. This flag is used when + ovn-controller is the originator of the multicast + packet. Since each ovn-controller instance is origiā€ + nating these packets, the packets only need to be deā€ + livered to local ports. + + ā€¢ A fallback flow that resubmits to table 40 if there + is no other match. + + Flows in table 40 resemble those in table 39 but for logical + ports that reside locally rather than remotely. For unicast + logical output ports on the local hypervisor, the actions + just resubmit to table 41. For multicast output ports that + include one or more logical ports on the local hypervisor, + for each such logical port P, the actions change the logical + output port to P, then resubmit to table 41. + + A special case is that when a localnet port exists on the + datapath, remote port is connected by switching to the loā€ + calnet port. In this case, instead of adding a flow in table + 39 to reach the remote port, a flow is added in table 40 to + switch the logical outport to the localnet port, and resubā€ + mit to table 40 as if it were unicasted to a logical port on + the local hypervisor. + + Table 41 matches and drops packets for which the logical inā€ + put and output ports are the same and the MLF_ALLOW_LOOPBACK + flag is not set. It also drops MLF_LOCAL_ONLY packets diā€ + rected to a localnet port. It resubmits other packets to taā€ + ble 42. + + 4. OpenFlow tables 42 through 62 execute the logical egress + pipeline from the Logical_Flow table in the OVN Southbound + database. The egress pipeline can perform a final stage of + validation before packet delivery. Eventually, it may exeā€ + cute an output action, which ovn-controller implements by + resubmitting to table 64. A packet for which the pipeline + never executes output is effectively dropped (although it + may have been transmitted through a tunnel across a physical + network). + + The egress pipeline cannot change the logical output port or + cause further tunneling. + + 5. Table 64 bypasses OpenFlow loopback when MLF_ALLOW_LOOPBACK + is set. Logical loopback was handled in table 41, but Openā€ + Flow by default also prevents loopback to the OpenFlow + ingress port. Thus, when MLF_ALLOW_LOOPBACK is set, OpenFlow + table 64 saves the OpenFlow ingress port, sets it to zero, + resubmits to table 65 for logical-to-physical transformaā€ + tion, and then restores the OpenFlow ingress port, effecā€ + tively disabling OpenFlow loopback prevents. When MLF_ALā€ + LOW_LOOPBACK is unset, table 64 flow simply resubmits to taā€ + ble 65. + + 6. OpenFlow table 65 performs logical-to-physical translation, + the opposite of table 0. It matches the packetā€™s logical + egress port. Its actions output the packet to the port atā€ + tached to the OVN integration bridge that represents that + logical port. If the logical egress port is a container + nested with a VM, then before sending the packet the actions + push on a VLAN header with an appropriate VLAN ID. + + Logical Routers and Logical Patch Ports + Typically logical routers and logical patch ports do not have a physiā€ + cal location and effectively reside on every hypervisor. This is the + case for logical patch ports between logical routers and logical + switches behind those logical routers, to which VMs (and VIFs) attach. + + Consider a packet sent from one virtual machine or container to another + VM or container that resides on a different subnet. The packet will + traverse tables 0 to 65 as described in the previous section Architecā€ā€ + tural Physical Life Cycle of a Packet, using the logical datapath repā€ + resenting the logical switch that the sender is attached to. At table + 39, the packet will use the fallback flow that resubmits locally to taā€ + ble 40 on the same hypervisor. In this case, all of the processing from + table 0 to table 65 occurs on the hypervisor where the sender resides. + + When the packet reaches table 65, the logical egress port is a logical + patch port. ovn-controller implements output to the logical patch is + packet by cloning and resubmitting directly to the first OpenFlow flow + table in the ingress pipeline, setting the logical ingress port to the + peer logical patch port, and using the peer logical patch portā€™s logiā€ + cal datapath (that represents the logical router). + + The packet re-enters the ingress pipeline in order to traverse tables 8 + to 65 again, this time using the logical datapath representing the logā€ + ical router. The processing continues as described in the previous secā€ + tion Architectural Physical Life Cycle of a Packet. When the packet + reaches table 65, the logical egress port will once again be a logical + patch port. In the same manner as described above, this logical patch + port will cause the packet to be resubmitted to OpenFlow tables 8 to + 65, this time using the logical datapath representing the logical + switch that the destination VM or container is attached to. + + The packet traverses tables 8 to 65 a third and final time. If the desā€ + tination VM or container resides on a remote hypervisor, then table 39 + will send the packet on a tunnel port from the senderā€™s hypervisor to + the remote hypervisor. Finally table 65 will output the packet directly + to the destination VM or container. + + The following sections describe two exceptions, where logical routers + and/or logical patch ports are associated with a physical location. + + Gateway Routers + + A gateway router is a logical router that is bound to a physical locaā€ + tion. This includes all of the logical patch ports of the logical + router, as well as all of the peer logical patch ports on logical + switches. In the OVN Southbound database, the Port_Binding entries for + these logical patch ports use the type l3gateway rather than patch, in + order to distinguish that these logical patch ports are bound to a + chassis. + + When a hypervisor processes a packet on a logical datapath representing + a logical switch, and the logical egress port is a l3gateway port repā€ + resenting connectivity to a gateway router, the packet will match a + flow in table 39 that sends the packet on a tunnel port to the chassis + where the gateway router resides. This processing in table 39 is done + in the same manner as for VIFs. + + Distributed Gateway Ports + + This section provides additional details on distributed gateway ports, + outlined earlier. + + The primary design goal of distributed gateway ports is to allow as + much traffic as possible to be handled locally on the hypervisor where + a VM or container resides. Whenever possible, packets from the VM or + container to the outside world should be processed completely on that + VMā€™s or containerā€™s hypervisor, eventually traversing a localnet port + instance or a tunnel to the physical network or a different OVN deployā€ + ment. Whenever possible, packets from the outside world to a VM or conā€ + tainer should be directed through the physical network directly to the + VMā€™s or containerā€™s hypervisor. + + In order to allow for the distributed processing of packets described + in the paragraph above, distributed gateway ports need to be logical + patch ports that effectively reside on every hypervisor, rather than + l3gateway ports that are bound to a particular chassis. However, the + flows associated with distributed gateway ports often need to be assoā€ + ciated with physical locations, for the following reasons: + + ā€¢ The physical network that the localnet port is attached + to typically uses L2 learning. Any Ethernet address used + over the distributed gateway port must be restricted to a + single physical location so that upstream L2 learning is + not confused. Traffic sent out the distributed gateway + port towards the localnet port with a specific Ethernet + address must be sent out one specific instance of the + distributed gateway port on one specific chassis. Traffic + received from the localnet port (or from a VIF on the + same logical switch as the localnet port) with a specific + Ethernet address must be directed to the logical switchā€™s + patch port instance on that specific chassis. + + Due to the implications of L2 learning, the Ethernet adā€ + dress and IP address of the distributed gateway port need + to be restricted to a single physical location. For this + reason, the user must specify one chassis associated with + the distributed gateway port. Note that traffic traversā€ + ing the distributed gateway port using other Ethernet adā€ + dresses and IP addresses (e.g. one-to-one NAT) is not reā€ + stricted to this chassis. + + Replies to ARP and ND requests must be restricted to a + single physical location, where the Ethernet address in + the reply resides. This includes ARP and ND replies for + the IP address of the distributed gateway port, which are + restricted to the chassis that the user associated with + the distributed gateway port. + + ā€¢ In order to support one-to-many SNAT (aka IP masqueradā€ + ing), where multiple logical IP addresses spread across + multiple chassis are mapped to a single external IP adā€ + dress, it will be necessary to handle some of the logical + router processing on a specific chassis in a centralized + manner. Since the SNAT external IP address is typically + the distributed gateway port IP address, and for simplicā€ + ity, the same chassis associated with the distributed + gateway port is used. + + The details of flow restrictions to specific chassis are described in + the ovn-northd documentation. + + While most of the physical location dependent aspects of distributed + gateway ports can be handled by restricting some flows to specific + chassis, one additional mechanism is required. When a packet leaves the + ingress pipeline and the logical egress port is the distributed gateway + port, one of two different sets of actions is required at table 39: + + ā€¢ If the packet can be handled locally on the senderā€™s hyā€ + pervisor (e.g. one-to-one NAT traffic), then the packet + should just be resubmitted locally to table 40, in the + normal manner for distributed logical patch ports. + + ā€¢ However, if the packet needs to be handled on the chassis + associated with the distributed gateway port (e.g. one- + to-many SNAT traffic or non-NAT traffic), then table 39 + must send the packet on a tunnel port to that chassis. + + In order to trigger the second set of actions, the chassisredirect type + of southbound Port_Binding has been added. Setting the logical egress + port to the type chassisredirect logical port is simply a way to indiā€ + cate that although the packet is destined for the distributed gateway + port, it needs to be redirected to a different chassis. At table 39, + packets with this logical egress port are sent to a specific chassis, + in the same way that table 39 directs packets whose logical egress port + is a VIF or a type l3gateway port to different chassis. Once the packet + arrives at that chassis, table 40 resets the logical egress port to the + value representing the distributed gateway port. For each distributed + gateway port, there is one type chassisredirect port, in addition to + the distributed logical patch port representing the distributed gateway + port. + + High Availability for Distributed Gateway Ports + + OVN allows you to specify a prioritized list of chassis for a distribā€ + uted gateway port. This is done by associating multiple Gateway_Chassis + rows with a Logical_Router_Port in the OVN_Northbound database. + + When multiple chassis have been specified for a gateway, all chassis + that may send packets to that gateway will enable BFD on tunnels to all + configured gateway chassis. The current master chassis for the gateway + is the highest priority gateway chassis that is currently viewed as acā€ + tive based on BFD status. + + For more information on L3 gateway high availability, please refer to + http://docs.ovn.org/en/latest/topics/high-availability.html. + + Restrictions of Distributed Gateway Ports + + Distributed gateway ports are used to connect to an external network, + which can be a physical network modeled by a logical switch with a loā€ + calnet port, and can also be a logical switch that interconnects difā€ + ferent OVN deployments (see OVN Deployments Interconnection). Usually + there can be many logical routers connected to the same external logiā€ + cal switch, as shown in below diagram. + + +--LS-EXT-+ + | | | + | | | + LR1 ... LRn + + + In this diagram, there are n logical routers connected to a logical + switch LS-EXT, each with a distributed gateway port, so that traffic + sent to external world is redirected to the gateway chassis that is asā€ + signed to the distributed gateway port of respective logical router. + + In the logical topology, nothing can prevent an user to add a route beā€ + tween the logical routers via the connected distributed gateway ports + on LS-EXT. However, the route works only if the LS-EXT is a physical + network (modeled by a logical switch with a localnet port). In that + case the packet will be delivered between the gateway chassises through + the localnet port via physical network. If the LS-EXT is a regular logā€ + ical switch (backed by tunneling only, as in the use case of OVN interā€ + connection), then the packet will be dropped on the source gateway + chassis. The limitation is due the fact that distributed gateway ports + are tied to physical location, and without physical network connection, + we will end up with either dropping the packet or transferring it over + the tunnels which could cause bigger problems such as broadcast packets + being redirect repeatedly by different gateway chassises. + + With the limitation in mind, if a user do want the direct connectivity + between the logical routers, it is better to create an internal logical + switch connected to the logical routers with regular logical router + ports, which are completely distributed and the packets donā€™t have to + leave a chassis unless necessary, which is more optimal than routing + via the distributed gateway ports. + + ARP request and ND NS packet processing + + Due to the fact that ARP requests and ND NA packets are usually broadā€ + cast packets, for performance reasons, OVN deals with requests that + target OVN owned IP addresses (i.e., IP addresses configured on the + router ports, VIPs, NAT IPs) in a specific way and only forwards them + to the logical router that owns the target IP address. This behavior is + different than that of traditional switches and implies that other + routers/hosts connected to the logical switch will not learn the MAC/IP + binding from the request packet. + + All other ARP and ND packets are flooded in the L2 broadcast domain and + to all attached logical patch ports. + + VIFs on the logical switch connected by a distributed gateway port + + Typically the logical switch connected by a distributed gateway port is + for external connectivity, usually to a physical network through a loā€ + calnet port on the logical switch, or to a remote OVN deployment + through OVN Interconnection. In these cases there is no VIF ports reā€ + quired on the logical switch. + + While not very common, it is still possible to create VIF ports on the + logical switch connected by a distributed gateway port, but there is a + limitation that the logical ports need to reside on the gateway chassis + where the distributed gateway port resides to get connectivity to other + logical switches through the distributed gateway port. There is no limā€ + itation for the VIFs to connect within the logical switch, or beyond + the logical switch through other regular distributed logical router + ports. + + A special case is when using distributed gateway ports for scalability + purpose, as mentioned earlier in this document. The logical switches + connected by distributed gateway ports are not for connectivity but + just for regular VIFs. However, the above limitation usually does not + matter because in this use case all the VIFs on the logical switch are + located on the same chassis with the distributed gateway port that conā€ + nects the logical switch. + + Multiple localnet logical switches connected to a Logical Router + It is possible to have multiple logical switches each with a localnet + port (representing physical networks) connected to a logical router, in + which one localnet logical switch may provide the external connectivity + via a distributed gateway port and rest of the localnet logical + switches use VLAN tagging in the physical network. It is expected that + ovn-bridge-mappings is configured appropriately on the chassis for all + these localnet networks. + + East West routing + + East-West routing between these localnet VLAN tagged logical switches + work almost the same way as normal logical switches. When the VM sends + such a packet, then: + + 1. It first enters the ingress pipeline, and then egress + pipeline of the source localnet logical switch datapath. It + then enters the ingress pipeline of the logical router dataā€ + path via the logical router port in the source chassis. + + 2. Routing decision is taken. + + 3. From the router datapath, packet enters the ingress pipeline + and then egress pipeline of the destination localnet logical + switch datapath and goes out of the integration bridge to + the provider bridge ( belonging to the destination logical + switch) via the localnet port. While sending the packet to + provider bridge, we also replace router port MAC as source + MAC with a chassis unique MAC. + + This chassis unique MAC is configured as global ovs config + on each chassis (eg. via "ovs-vsctl set open . external-ids: + ovn-chassis-mac-mappings="phys:aa:bb:cc:dd:ee:$i$i""). For + more details, see ovn-controller(8). + + If the above is not configured, then source MAC would be the + router port MAC. This could create problem if we have more + than one chassis. This is because, since the router port is + distributed, the same (MAC,VLAN) tuple will seen by physical + network from other chassis as well, which could cause these + issues: + + ā€¢ Continuous MAC moves in top-of-rack switch (ToR). + + ā€¢ ToR dropping the traffic, which is causing continuous + MAC moves. + + ā€¢ ToR blocking the ports from which MAC moves are hapā€ + pening. + + 4. The destination chassis receives the packet via the localnet + port and sends it to the integration bridge. Before entering + the integration bridge the source mac of the packet will be + replaced with router port mac again. The packet enters the + ingress pipeline and then egress pipeline of the destination + localnet logical switch and finally gets delivered to the + destination VM port. + + External traffic + + The following happens when a VM sends an external traffic (which reā€ + quires NATting) and the chassis hosting the VM doesnā€™t have a distribā€ + uted gateway port. + + 1. The packet first enters the ingress pipeline, and then + egress pipeline of the source localnet logical switch dataā€ + path. It then enters the ingress pipeline of the logical + router datapath via the logical router port in the source + chassis. + + 2. Routing decision is taken. Since the gateway router or the + distributed gateway port doesnā€™t reside in the source chasā€ + sis, the traffic is redirected to the gateway chassis via + the tunnel port. + + 3. The gateway chassis receives the packet via the tunnel port + and the packet enters the egress pipeline of the logical + router datapath. NAT rules are applied here. The packet then + enters the ingress pipeline and then egress pipeline of the + localnet logical switch datapath which provides external + connectivity and finally goes out via the localnet port of + the logical switch which provides external connectivity. + + Although this works, the VM traffic is tunnelled when sent from the + compute chassis to the gateway chassis. In order for it to work propā€ + erly, the MTU of the localnet logical switches must be lowered to acā€ + count for the tunnel encapsulation. + + Centralized routing for localnet VLAN tagged logical switches connected to + a Logical Router + To overcome the tunnel encapsulation problem described in the previous + section, OVN supports the option of enabling centralized routing for + localnet VLAN tagged logical switches. CMS can configure the option opā€ā€ + tions:reside-on-redirect-chassis to true for each Logical_Router_Port + which connects to the localnet VLAN tagged logical switches. This + causes the gateway chassis (hosting the distributed gateway port) to + handle all the routing for these networks, making it centralized. It + will reply to the ARP requests for the logical router port IPs. + + If the logical router doesnā€™t have a distributed gateway port connectā€ + ing to the localnet logical switch which provides external connectivā€ + ity, or if it has more than one distributed gateway ports, then this + option is ignored by OVN. + + The following happens when a VM sends an east-west traffic which needs + to be routed: + + 1. The packet first enters the ingress pipeline, and then + egress pipeline of the source localnet logical switch dataā€ + path and is sent out via a localnet port of the source loā€ + calnet logical switch (instead of sending it to router + pipeline). + + 2. The gateway chassis receives the packet via a localnet port + of the source localnet logical switch and sends it to the + integration bridge. The packet then enters the ingress + pipeline, and then egress pipeline of the source localnet + logical switch datapath and enters the ingress pipeline of + the logical router datapath. + + 3. Routing decision is taken. + + 4. From the router datapath, packet enters the ingress pipeline + and then egress pipeline of the destination localnet logical + switch datapath. It then goes out of the integration bridge + to the provider bridge ( belonging to the destination logiā€ + cal switch) via a localnet port. + + 5. The destination chassis receives the packet via a localnet + port and sends it to the integration bridge. The packet enā€ + ters the ingress pipeline and then egress pipeline of the + destination localnet logical switch and finally delivered to + the destination VM port. + + The following happens when a VM sends an external traffic which reā€ + quires NATting: + + 1. The packet first enters the ingress pipeline, and then + egress pipeline of the source localnet logical switch dataā€ + path and is sent out via a localnet port of the source loā€ + calnet logical switch (instead of sending it to router + pipeline). + + 2. The gateway chassis receives the packet via a localnet port + of the source localnet logical switch and sends it to the + integration bridge. The packet then enters the ingress + pipeline, and then egress pipeline of the source localnet + logical switch datapath and enters the ingress pipeline of + the logical router datapath. + + 3. Routing decision is taken and NAT rules are applied. + + 4. From the router datapath, packet enters the ingress pipeline + and then egress pipeline of the localnet logical switch + datapath which provides external connectivity. It then goes + out of the integration bridge to the provider bridge (beā€ + longing to the logical switch which provides external conā€ + nectivity) via a localnet port. + + The following happens for the reverse external traffic. + + 1. The gateway chassis receives the packet from a localnet port + of the logical switch which provides external connectivity. + The packet then enters the ingress pipeline and then egress + pipeline of the localnet logical switch (which provides exā€ + ternal connectivity). The packet then enters the ingress + pipeline of the logical router datapath. + + 2. The ingress pipeline of the logical router datapath applies + the unNATting rules. The packet then enters the ingress + pipeline and then egress pipeline of the source localnet + logical switch. Since the source VM doesnā€™t reside in the + gateway chassis, the packet is sent out via a localnet port + of the source logical switch. + + 3. The source chassis receives the packet via a localnet port + and sends it to the integration bridge. The packet enters + the ingress pipeline and then egress pipeline of the source + localnet logical switch and finally gets delivered to the + source VM port. + + As an alternative to reside-on-redirect-chassis, OVN supports VLAN- + based redirection. Whereas reside-on-redirect-chassis centralizes all + router functionality, VLAN-based redirection only changes how OVN rediā€ + rects packets to the gateway chassis. By setting options:redirect-type + to bridged on a distributed gateway port, OVN redirects packets to the + gateway chassis using the localnet port of the routerā€™s peer logical + switch, instead of a tunnel. + + If the logical router doesnā€™t have a distributed gateway port connectā€ + ing to the localnet logical switch which provides external connectivā€ + ity, or if it has more than one distributed gateway ports, then this + option is ignored by OVN. + + Following happens for bridged redirection: + + 1. On compute chassis, packet passes though logical routerā€™s + ingress pipeline. + + 2. If logical outport is gateway chassis attached router port + then packet is "redirected" to gateway chassis using peer + logical switchā€™s localnet port. + + 3. This redirected packet has destination mac as router port + mac (the one to which gateway chassis is attached). Its VLAN + id is that of localnet port (peer logical switch of the logā€ + ical router port). + + 4. On the gateway chassis packet will enter the logical router + pipeline again and this time it will passthrough egress + pipeline as well. + + 5. Reverse traffic packet flows stays the same. + + Some guidelines and expections with bridged redirection: + + 1. Since router port mac is destination mac, hence it has to be + ensured that physical network learns it on ONLY from the + gateway chassis. Which means that ovn-chassis-mac-mappings + should be configure on all the compute nodes, so that physiā€ + cal network never learn router port mac from compute nodes. + + 2. Since packet enters logical router ingress pipeline twice + (once on compute chassis and again on gateway chassis), + hence ttl will be decremented twice. + + 3. Default redirection type continues to be overlay. User can + switch the redirect-type between bridged and overlay by + changing the value of options:redirect-type + + Life Cycle of a VTEP gateway + A gateway is a chassis that forwards traffic between the OVN-managed + part of a logical network and a physical VLAN, extending a tunnel-based + logical network into a physical network. + + The steps below refer often to details of the OVN and VTEP database + schemas. Please see ovn-sb(5), ovn-nb(5) and vtep(5), respectively, for + the full story on these databases. + + 1. A VTEP gatewayā€™s life cycle begins with the administrator + registering the VTEP gateway as a Physical_Switch table enā€ + try in the VTEP database. The ovn-controller-vtep connected + to this VTEP database, will recognize the new VTEP gateway + and create a new Chassis table entry for it in the + OVN_Southbound database. + + 2. The administrator can then create a new Logical_Switch table + entry, and bind a particular vlan on a VTEP gatewayā€™s port + to any VTEP logical switch. Once a VTEP logical switch is + bound to a VTEP gateway, the ovn-controller-vtep will detect + it and add its name to the vtep_logical_switches column of + the Chassis table in the OVN_Southbound database. Note, the + tunnel_key column of VTEP logical switch is not filled at + creation. The ovn-controller-vtep will set the column when + the corresponding vtep logical switch is bound to an OVN + logical network. + + 3. Now, the administrator can use the CMS to add a VTEP logical + switch to the OVN logical network. To do that, the CMS must + first create a new Logical_Switch_Port table entry in the + OVN_Northbound database. Then, the type column of this entry + must be set to "vtep". Next, the vtep-logical-switch and + vtep-physical-switch keys in the options column must also be + specified, since multiple VTEP gateways can attach to the + same VTEP logical switch. Next, the addresses column of this + logical port must be set to "unknown", it will add a priorā€ + ity 0 entry in "ls_in_l2_lkup" stage of logical switch + ingress pipeline. So, traffic with unrecorded mac by OVN + would go through the Logical_Switch_Port to physical netā€ + work. + + 4. The newly created logical port in the OVN_Northbound dataā€ + base and its configuration will be passed down to the + OVN_Southbound database as a new Port_Binding table entry. + The ovn-controller-vtep will recognize the change and bind + the logical port to the corresponding VTEP gateway chassis. + Configuration of binding the same VTEP logical switch to a + different OVN logical networks is not allowed and a warning + will be generated in the log. + + 5. Beside binding to the VTEP gateway chassis, the ovn-conā€ā€ + troller-vtep will update the tunnel_key column of the VTEP + logical switch to the corresponding Datapath_Binding table + entryā€™s tunnel_key for the bound OVN logical network. + + 6. Next, the ovn-controller-vtep will keep reacting to the conā€ + figuration change in the Port_Binding in the OVN_Northbound + database, and updating the Ucast_Macs_Remote table in the + VTEP database. This allows the VTEP gateway to understand + where to forward the unicast traffic coming from the exā€ + tended external network. + + 7. Eventually, the VTEP gatewayā€™s life cycle ends when the adā€ + ministrator unregisters the VTEP gateway from the VTEP dataā€ + base. The ovn-controller-vtep will recognize the event and + remove all related configurations (Chassis table entry and + port bindings) in the OVN_Southbound database. + + 8. When the ovn-controller-vtep is terminated, all related conā€ + figurations in the OVN_Southbound database and the VTEP + database will be cleaned, including Chassis table entries + for all registered VTEP gateways and their port bindings, + and all Ucast_Macs_Remote table entries and the Logiā€ā€ + cal_Switch tunnel keys. + + OVN Deployments Interconnection + It is not uncommon for an operator to deploy multiple OVN clusters, for + two main reasons. Firstly, an operator may prefer to deploy one OVN + cluster for each availability zone, e.g. in different physical regions, + to avoid single point of failure. Secondly, there is always an upper + limit for a single OVN control plane to scale. + + Although the control planes of the different availability zone (AZ)s + are independent from each other, the workloads from different AZs may + need to communicate across the zones. The OVN interconnection feature + provides a native way to interconnect different AZs by L3 routing + through transit overlay networks between logical routers of different + AZs. + + A global OVN Interconnection Northbound database is introduced for the + operator (probably through CMS systems) to configure transit logical + switches that connect logical routers from different AZs. A transit + switch is similar to a regular logical switch, but it is used for inā€ + terconnection purpose only. Typically, each transit switch can be used + to connect all logical routers that belong to same tenant across all + AZs. + + A dedicated daemon process ovn-ic, OVN interconnection controller, in + each AZ will consume this data and populate corresponding logical + switches to their own northbound databases for each AZ, so that logical + routers can be connected to the transit switch by creating patch port + pairs in their northbound databases. Any router ports connected to the + transit switches are considered interconnection ports, which will be + exchanged between AZs. + + Physically, when workloads from different AZs communicate, packets need + to go through multiple hops: source chassis, source gateway, destinaā€ + tion gateway and destination chassis. All these hops are connected + through tunnels so that the packets never leave overlay networks. A + distributed gateway port is required to connect the logical router to a + transit switch, with a gateway chassis specified, so that the traffic + can be forwarded through the gateway chassis. + + A global OVN Interconnection Southbound database is introduced for exā€ + changing control plane information between the AZs. The data in this + database is populated and consumed by the ovn-ic, of each AZ. The main + information in this database includes: + + ā€¢ Datapath bindings for transit switches, which mainly conā€ + tains the tunnel keys generated for each transit switch. + Separate key ranges are reserved for transit switches so + that they will never conflict with any tunnel keys loā€ + cally assigned for datapaths within each AZ. + + ā€¢ Availability zones, which are registered by ovn-ic from + each AZ. + + ā€¢ Gateways. Each AZ specifies chassises that are supposed + to work as interconnection gateways, and the ovn-ic will + populate this information to the interconnection southā€ + bound DB. The ovn-ic from all the other AZs will learn + the gateways and populate to their own southbound DB as a + chassis. + + ā€¢ Port bindings for logical switch ports created on the + transit switch. Each AZ maintains their logical router to + transit switch connections independently, but ovn-ic auā€ + tomatically populates local port bindings on transit + switches to the global interconnection southbound DB, and + learns remote port bindings from other AZs back to its + own northbound and southbound DBs, so that logical flows + can be produced and then translated to OVS flows locally, + which finally enables data plane communication. + + ā€¢ Routes that are advertised between different AZs. If enā€ + abled, routes are automatically exchanged by ovn-ic. Both + static routes and directly connected subnets are adverā€ + tised. Options in options column of the NB_Global table + of OVN_NB database control the behavior of route adverā€ + tisement, such as enable/disable the advertising/learning + routes, whether default routes are advertised/learned, + and blacklisted CIDRs. See ovn-nb(5) for more details. + + The tunnel keys for transit switch datapaths and related port bindings + must be agreed across all AZs. This is ensured by generating and storā€ + ing the keys in the global interconnection southbound database. Any + ovn-ic from any AZ can allocate the key, but race conditions are solved + by enforcing unique index for the column in the database. + + Once each AZā€™s NB and SB databases are populated with interconnection + switches and ports, and agreed upon the tunnel keys, data plane commuā€ + nication between the AZs are established. + + When VXLAN tunneling is enabled in an OVN cluster, due to the limited + range available for VNIs, Interconnection feature is not supported. + + A day in the life of a packet crossing AZs + + 1. An IP packet is sent out from a VIF on a hypervisor (HV1) of + AZ1, with destination IP belonging to a VIF in AZ2. + + 2. In HV1ā€™s OVS flow tables, the packet goes through logical + switch and logical router pipelines, and in a logical router + pipeline, the routing stage finds out the next hop for the + destination IP, which belongs to a remote logical router + port in AZ2, and the output port, which is a chassis-rediā€ + rect port located on an interconnection gateway (GW1 in + AZ1), so HV1 sends the packet to GW1 through tunnel. + + 3. On GW1, it continues with the logical router pipe line and + switches to the transit switchā€™s pipeline through the peer + port of the chassis redirect port. In the transit switchā€™s + pipeline it outputs to the remote logical port which is loā€ + cated on a gateway (GW2) in AZ2, so the GW1 sends the packet + to GW2 in tunnel. + + 4. On GW2, it continues with the transit switch pipeline and + switches to the logical router pipeline through the peer + port, which is a chassis redirect port that is located on + GW2. The logical router pipeline then forwards the packet to + relevant logical pipelines according to the destination IP + address, and figures out the MAC and location of the destiā€ + nation VIF port - a hypervisor (HV2). The GW2 then sends the + packet to HV2 in tunnel. + + 5. On HV2, the packet is delivered to the final destination VIF + port by the logical switch egress pipeline, just the same + way as for intra-AZ communications. + + Native OVN services for external logical ports + To support OVN native services (like DHCP/IPv6 RA/DNS lookup) to the + cloud resources which are external, OVN supports external logical + ports. + + Below are some of the use cases where external ports can be used. + + ā€¢ VMs connected to SR-IOV nics - Traffic from these VMs by + passes the kernel stack and local ovn-controller do not + bind these ports and cannot serve the native services. + + ā€¢ When CMS supports provisioning baremetal servers. + + OVN will provide the native services if CMS has done the below configuā€ + ration in the OVN Northbound Database. + + ā€¢ A row is created in Logical_Switch_Port, configuring the + addresses column and setting the type to external. + + ā€¢ ha_chassis_group column is configured. + + ā€¢ The HA chassis which belongs to the HA chassis group has + the ovn-bridge-mappings configured and has proper L2 conā€ + nectivity so that it can receive the DHCP and other reā€ + lated request packets from these external resources. + + ā€¢ The Logical_Switch of this port has a localnet port. + + ā€¢ Native OVN services are enabled by configuring the DHCP + and other options like the way it is done for the normal + logical ports. + + It is recommended to use the same HA chassis group for all the external + ports of a logical switch. Otherwise, the physical switch might see MAC + flap issue when different chassis provide the native services. For exā€ + ample when supporting native DHCPv4 service, DHCPv4 server mac (configā€ + ured in options:server_mac column in table DHCP_Options) originating + from different ports can cause MAC flap issue. The MAC of the logical + router IP(s) can also flap if the same HA chassis group is not set for + all the external ports of a logical switch. + +SECURITY + Role-Based Access Controls for the Southbound DB + In order to provide additional security against the possibility of an + OVN chassis becoming compromised in such a way as to allow rogue softā€ + ware to make arbitrary modifications to the southbound database state + and thus disrupt the OVN network, role-based access controls (see + ovsdb-server(1) for additional details) are provided for the southbound + database. + + The implementation of role-based access controls (RBAC) requires the + addition of two tables to an OVSDB schema: the RBAC_Role table, which + is indexed by role name and maps the the names of the various tables + that may be modifiable for a given role to individual rows in a permisā€ + sions table containing detailed permission information for that role, + and the permission table itself which consists of rows containing the + following information: + + Table Name + The name of the associated table. This column exists priā€ + marily as an aid for humans reading the contents of this + table. + + Auth Criteria + A set of strings containing the names of columns (or colā€ + umn:key pairs for columns containing string:string maps). + The contents of at least one of the columns or column:key + values in a row to be modified, inserted, or deleted must + be equal to the ID of the client attempting to act on the + row in order for the authorization check to pass. If the + authorization criteria is empty, authorization checking + is disabled and all clients for the role will be treated + as authorized. + + Insert/Delete + Row insertion/deletion permission; boolean value indicatā€ + ing whether insertion and deletion of rows is allowed for + the associated table. If true, insertion and deletion of + rows is allowed for authorized clients. + + Updatable Columns + A set of strings containing the names of columns or colā€ + umn:key pairs that may be updated or mutated by authoā€ + rized clients. Modifications to columns within a row are + only permitted when the authorization check for the + client passes and all columns to be modified are included + in this set of modifiable columns. + + RBAC configuration for the OVN southbound database is maintained by + ovn-northd. With RBAC enabled, modifications are only permitted for the + Chassis, Encap, Port_Binding, and MAC_Binding tables, and are reā€ + stricted as follows: + + Chassis + Authorization: client ID must match the chassis name. + + Insert/Delete: authorized row insertion and deletion are + permitted. + + Update: The columns nb_cfg, external_ids, encaps, and + vtep_logical_switches may be modified when authorized. + + Encap Authorization: client ID must match the chassis name. + + Insert/Delete: row insertion and row deletion are permitā€ + ted. + + Update: The columns type, options, and ip can be modiā€ + fied. + + Port_Binding + Authorization: disabled (all clients are considered auā€ + thorized. A future enhancement may add columns (or keys + to external_ids) in order to control which chassis are + allowed to bind each port. + + Insert/Delete: row insertion/deletion are not permitted + (ovn-northd maintains rows in this table. + + Update: Only modifications to the chassis column are perā€ + mitted. + + MAC_Binding + Authorization: disabled (all clients are considered to be + authorized). + + Insert/Delete: row insertion/deletion are permitted. + + Update: The columns logical_port, ip, mac, and datapath + may be modified by ovn-controller. + + IGMP_Group + Authorization: disabled (all clients are considered to be + authorized). + + Insert/Delete: row insertion/deletion are permitted. + + Update: The columns address, chassis, datapath, and ports + may be modified by ovn-controller. + + Enabling RBAC for ovn-controller connections to the southbound database + requires the following steps: + + 1. Creating SSL certificates for each chassis with the certifiā€ + cate CN field set to the chassis name (e.g. for a chassis + with external-ids:system-id=chassis-1, via the command + "ovs-pki -u req+sign chassis-1 switch"). + + 2. Configuring each ovn-controller to use SSL when connecting + to the southbound database (e.g. via "ovs-vsctl set open . + external-ids:ovn-remote=ssl:x.x.x.x:6642"). + + 3. Configuring a southbound database SSL remote with "ovn-conā€ + troller" role (e.g. via "ovn-sbctl set-connection + role=ovn-controller pssl:6642"). + + Encrypt Tunnel Traffic with IPsec + OVN tunnel traffic goes through physical routers and switches. These + physical devices could be untrusted (devices in public network) or + might be compromised. Enabling encryption to the tunnel traffic can + prevent the traffic data from being monitored and manipulated. + + The tunnel traffic is encrypted with IPsec. The CMS sets the ipsec colā€ + umn in the northbound NB_Global table to enable or disable IPsec encryā€ + tion. If ipsec is true, all OVN tunnels will be encrypted. If ipsec is + false, no OVN tunnels will be encrypted. + + When CMS updates the ipsec column in the northbound NB_Global table, + ovn-northd copies the value to the ipsec column in the southbound + SB_Global table. ovn-controller in each chassis monitors the southbound + database and sets the options of the OVS tunnel interface accordingly. + OVS tunnel interface options are monitored by the ovs-monitor-ipsec + daemon which configures IKE daemon to set up IPsec connections. + + Chassis authenticates each other by using certificate. The authenticaā€ + tion succeeds if the other end in tunnel presents a certificate signed + by a trusted CA and the common name (CN) matches the expected chassis + name. The SSL certificates used in role-based access controls (RBAC) + can be used in IPsec. Or use ovs-pki to create different certificates. + The certificate is required to be x.509 version 3, and with CN field + and subjectAltName field being set to the chassis name. + + The CA certificate, chassis certificate and private key are required to + be installed in each chassis before enabling IPsec. Please see + ovs-vswitchd.conf.db(5) for setting up CA based IPsec authentication. + +DESIGN DECISIONS + Tunnel Encapsulations + In general, OVN annotates logical network packets that it sends from + one hypervisor to another with the following three pieces of metadata, + which are encoded in an encapsulation-specific fashion: + + ā€¢ 24-bit logical datapath identifier, from the tunnel_key + column in the OVN Southbound Datapath_Binding table. + + ā€¢ 15-bit logical ingress port identifier. ID 0 is reserved + for internal use within OVN. IDs 1 through 32767, incluā€ + sive, may be assigned to logical ports (see the tunā€ā€ + nel_key column in the OVN Southbound Port_Binding table). + + ā€¢ 16-bit logical egress port identifier. IDs 0 through + 32767 have the same meaning as for logical ingress ports. + IDs 32768 through 65535, inclusive, may be assigned to + logical multicast groups (see the tunnel_key column in + the OVN Southbound Multicast_Group table). + + When VXLAN is enabled on any hypervisor in a cluster, datapath and + egress port identifier ranges are reduced to 12-bits. This is done beā€ + cause only STT and Geneve provide the large space for metadata (over 32 + bits per packet). To accommodate for VXLAN, 24 bits available are split + as follows: + + ā€¢ 12-bit logical datapath identifier, derived from the tunā€ā€ + nel_key column in the OVN Southbound Datapath_Binding taā€ + ble. + + ā€¢ 12-bit logical egress port identifier. IDs 0 through 2047 + are used for unicast output ports. IDs 2048 through 4095, + inclusive, may be assigned to logical multicast groups + (see the tunnel_key column in the OVN Southbound Multiā€ā€ + cast_Group table). For multicast group tunnel keys, a + special mapping scheme is used to internally transform + from internal OVN 16-bit keys to 12-bit values before + sending packets through a VXLAN tunnel, and back from + 12-bit tunnel keys to 16-bit values when receiving packā€ + ets from a VXLAN tunnel. + + ā€¢ No logical ingress port identifier. + + The limited space available for metadata when VXLAN tunnels are enabled + in a cluster put the following functional limitations onto features + available to users: + + ā€¢ The maximum number of networks is reduced to 4096. + + ā€¢ The maximum number of ports per network is reduced to + 2048. + + ā€¢ ACLs matching against logical ingress port identifiers + are not supported. + + ā€¢ OVN interconnection feature is not supported. + + In addition to functional limitations described above, the following + should be considered before enabling it in your cluster: + + ā€¢ STT and Geneve use randomized UDP or TCP source ports + that allows efficient distribution among multiple paths + in environments that use ECMP in their underlay. + + ā€¢ NICs are available to offload STT and Geneve encapsulaā€ + tion and decapsulation. + + Due to its flexibility, the preferred encapsulation between hypervisors + is Geneve. For Geneve encapsulation, OVN transmits the logical datapath + identifier in the Geneve VNI. OVN transmits the logical ingress and + logical egress ports in a TLV with class 0x0102, type 0x80, and a + 32-bit value encoded as follows, from MSB to LSB: + + 1 15 16 + +---+------------+-----------+ + |rsv|ingress port|egress port| + +---+------------+-----------+ + 0 + + + Environments whose NICs lack Geneve offload may prefer STT encapsulaā€ + tion for performance reasons. For STT encapsulation, OVN encodes all + three pieces of logical metadata in the STT 64-bit tunnel ID as folā€ + lows, from MSB to LSB: + + 9 15 16 24 + +--------+------------+-----------+--------+ + |reserved|ingress port|egress port|datapath| + +--------+------------+-----------+--------+ + 0 + + + For connecting to gateways, in addition to Geneve and STT, OVN supports + VXLAN, because only VXLAN support is common on top-of-rack (ToR) + switches. Currently, gateways have a feature set that matches the capaā€ + bilities as defined by the VTEP schema, so fewer bits of metadata are + necessary. In the future, gateways that do not support encapsulations + with large amounts of metadata may continue to have a reduced feature + set. + +OVN 23.06.3 OVN Architecture ovn-architecture(7) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8 b/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8 new file mode 100644 index 00000000..23825e29 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8 @@ -0,0 +1,110 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-controller-vtep" 8 "ovn-controller-vtep" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-controller-vtep \- Open Virtual Network local controller for vtep enabled physical switches\[char46] +.SH "SYNOPSIS" +.PP +\fBovn\-controller\-vtep\fR [\fIoptions\fR] [\fI\-\-vtep-db=vtep-database\fR] [\fI\-\-ovnsb-db=ovnsb-database\fR] +.SH "DESCRIPTION" +.PP +.PP +\fBovn\-controller\-vtep\fR is the local controller daemon in OVN, the Open Virtual Network, for VTEP enabled physical switches\[char46] It connects up to the OVN Southbound database (see \fBovn\-sb\fR(5)) over the OVSDB protocol, and down to the VTEP database (see \fBvtep\fR(5)) over the OVSDB protocol\[char46] +.SS "PKI Options" +.PP +.PP +PKI configuration is required in order to use SSL for the connections to the VTEP and Southbound databases\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.RS +.TP +\fB\-\-bootstrap\-ca\-cert=\fR\fIcacert\[char46]pem\fR +When \fIcacert\[char46]pem\fR exists, this option has the same effect as \fB\-C\fR or \fB\-\-ca\-cert\fR\[char46] If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] +.IP +This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping\[char46] +.IP +This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain\[char46] The SSL protocol does not require the server to send the CA certificate\[char46] +.IP +This option is mutually exclusive with \fB\-C\fR and \fB\-\-ca\-cert\fR\[char46] +.RE +.RS +.TP +\fB\-\-peer\-ca\-cert=\fR\fIpeer-cacert\[char46]pem\fR +Specifies a PEM file that contains one or more additional certificates to send to SSL peers\[char46] \fIpeer-cacert\[char46]pem\fR should be the CA certificate used to sign the program\(cqs own certificate, that is, the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR\[char46] If the program\(cqs certificate is self-signed, then \fB\-\-certificate\fR and \fB\-\-peer\-ca\-cert\fR should specify the same file\[char46] +.IP +This option is not useful in normal operation, because the SSL peer must already have the CA certificate for the peer to have any confidence in the program\(cqs identity\[char46] However, this offers a way for a new installation to bootstrap the CA certificate on its first SSL connection\[char46] +.RE +.SH "CONFIGURATION" +.PP +.PP +\fBovn\-controller\-vtep\fR retrieves its configuration information from both the ovnsb and the vtep database\[char46] If the database locations are not given from command line, the default is the \fBdb\[char46]sock\fR in local OVSDB\(cqs \(cqrun\(cq directory\[char46] The database location must take one of the following forms: +.RS +.IP \(bu +\fBssl:\fIhost\fB:\fIport\fB\fR +.IP +The specified SSL \fIport\fR on the give \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6)\[char46] If \fIhost\fR is an IPv6 address, then wrap \fIhost\fR with square brackets, e\[char46]g\[char46]: \fBssl:[::1]:6640\fR\[char46] The \fB\-\-private\-key\fR, \fB\-\-certificate\fR and either of \fB\-\-ca\-cert\fR or \fB\-\-bootstrap\-ca\-cert\fR options are mandatory when this form is used\[char46] +.IP \(bu +\fBtcp:\fIhost\fB:\fIport\fB\fR +.IP +Connect to the given TCP \fIport\fR on \fIhost\fR, where \fIhost\fR can be a DNS name (if built with unbound library) or IP address (IPv4 or IPv6)\[char46] If \fIhost\fR is an IPv6 address, then wrap \fIhost\fR with square brackets, e\[char46]g\[char46]: \fBtcp:[::1]:6640\fR\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR +.IP +On POSIX, connect to the Unix domain server socket named \fIfile\fR\[char46] +.IP +On Windows, connect to a localhost TCP port whose value is written in \fIfile\fR\[char46] +.RE +.PP +.PP +\fBovn\-controller\-vtep\fR assumes it gets configuration information from the following keys in the \fBGlobal\fR table of the connected \fBhardware_vtep\fR database: +.PP +.PP +.RS +.TP +\fBother_config:ovn\-match\-northd\-version\fR +The boolean flag indicates if \fBovn\-controller\-vtep\fR needs to check \fBovn\-northd\fR version\[char46] If this flag is set to true and the \fBovn\-northd\(cqs\fR version (reported in the Southbound database) doesn\(cqt match with the \fBovn\-controller\-vtep\(cqs\fR internal version, then it will stop processing the southbound and connected \fBhardware_vtep\fR database changes\[char46] The default value is considered false if this option is not defined\[char46] +.TP +\fBother_config:ovn\-remote\-probe\-interval\fR +The inactivity probe interval of the connection to the OVN Southbound database, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.RE diff --git a/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.html b/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.html new file mode 100644 index 00000000..f93667ce --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.html @@ -0,0 +1,142 @@ +
+ovn-controller-vtep(8)            OVN Manual            ovn-controller-vtep(8)
+
+NAME
+       ovn-controller-vtep  -  Open  Virtual Network local controller for vtep
+       enabled physical switches.
+
+SYNOPSIS
+       ovn-controller-vtep   [options]   [--vtep-db=vtep-database]   [--ovnsb-
+       db=ovnsb-database]
+
+DESCRIPTION
+       ovn-controller-vtep  is  the  local  controller daemon in OVN, the Open
+       Virtual Network, for VTEP enabled physical switches. It connects up  to
+       the  OVN  Southbound  database (see ovn-sb(5)) over the OVSDB protocol,
+       and down to the VTEP database (see vtep(5)) over the OVSDB protocol.
+
+   PKI Options
+       PKI configuration is required in order to use SSL for  the  connections
+       to the VTEP and Southbound databases.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies  a  PEM  file  containing the private key used as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies a PEM file containing a certificate  that  certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate  authority  (CA) that the peer in SSL connections will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This may be the same certificate that  SSL  peers  use  to
+                   verify the certificate specified on -c or --certificate, or
+                   it  may  be a different one, depending on the PKI design in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables verification  of  certificates  presented  by  SSL
+                   peers.  This  introduces  a security risk, because it means
+                   that certificates cannot be verified to be those  of  known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When  cacert.pem  exists, this option has the same effect
+                     as -C or --ca-cert. If it does not exist, then  the  exeā€
+                     cutable  will  attempt  to obtain the CA certificate from
+                     the SSL peer on its first SSL connection and save  it  to
+                     the  named PEM file. If it is successful, it will immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all SSL connections must be authenticated by  a  certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This  option  exposes the SSL connection to a man-in-the-
+                     middle attack obtaining the initial CA  certificate,  but
+                     it may be useful for bootstrapping.
+
+                     This  option  is only useful if the SSL peer sends its CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol does not require the server to send the CA  cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+              --peer-ca-cert=peer-cacert.pem
+                     Specifies a PEM file that contains one or more additional
+                     certificates to send to SSL peers. peer-cacert.pem should
+                     be the CA certificate used to sign the programā€™s own cerā€
+                     tificate,  that  is,  the  certificate specified on -c or
+                     --certificate. If  the  programā€™s  certificate  is  self-
+                     signed,  then  --certificate  and  --peer-ca-cert  should
+                     specify the same file.
+
+                     This option is not useful in  normal  operation,  because
+                     the SSL peer must already have the CA certificate for the
+                     peer  to  have  any confidence in the programā€™s identity.
+                     However, this offers a way  for  a  new  installation  to
+                     bootstrap the CA certificate on its first SSL connection.
+
+CONFIGURATION
+       ovn-controller-vtep  retrieves  its configuration information from both
+       the ovnsb and the vtep database. If  the  database  locations  are  not
+       given  from  command  line, the default is the db.sock in local OVSDBā€™s
+       ā€™runā€™ directory. The database location must take one of  the  following
+       forms:
+
+              ā€¢      ssl:host:port
+
+                     The specified SSL port on the give host, which can either
+                     be  a  DNS  name (if built with unbound library) or an IP
+                     address (IPv4 or IPv6). If host is an IPv6 address,  then
+                     wrap host with square brackets, e.g.: ssl:[::1]:6640. The
+                     --private-key,  --certificate  and either of --ca-cert or
+                     --bootstrap-ca-cert options are mandatory when this  form
+                     is used.
+
+              ā€¢      tcp:host:port
+
+                     Connect  to the given TCP port on host, where host can be
+                     a DNS name (if built with unbound library) or IP  address
+                     (IPv4  or  IPv6).  If  host is an IPv6 address, then wrap
+                     host with square brackets, e.g.: tcp:[::1]:6640.
+
+              ā€¢      unix:file
+
+                     On POSIX, connect to the Unix domain server socket  named
+                     file.
+
+                     On  Windows,  connect to a localhost TCP port whose value
+                     is written in file.
+
+       ovn-controller-vtep assumes it gets configuration information from  the
+       following keys in the Global table of the connected hardware_vtep dataā€
+       base:
+
+              other_config:ovn-match-northd-version
+                     The  boolean  flag indicates if ovn-controller-vtep needs
+                     to check ovn-northd version. If this flag is set to  true
+                     and  the ovn-northdā€™ā€™s version (reported in the Southbound
+                     database) doesnā€™t match  with  the  ovn-controller-vtepā€™ā€™s
+                     internal version, then it will stop processing the southā€
+                     bound  and  connected hardware_vtep database changes. The
+                     default value is considered false if this option  is  not
+                     defined.
+
+              other_config:ovn-remote-probe-interval
+                     The  inactivity  probe  interval of the connection to the
+                     OVN Southbound database, in milliseconds. If the value is
+                     zero, it disables the connection keepalive feature.
+
+                     If the value is nonzero, then it  will  be  forced  to  a
+                     value of at least 1000 ms.
+
+OVN 23.06.3                   ovn-controller-vtep       ovn-controller-vtep(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-controller-vtep.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..f8c420169912d8eb8bda38ae7ff4046b3d22c1c9 GIT binary patch literal 25699 zcmce-1yo(jvNnplyIUYQ3wL*Scemi~!JXg)cXxLW1P|^KoZt?@A0*jl?R8~fe0XKW#D8YY+__I@eeR8sJ9vTNj6L;U1hXNJOE!VkTjq{l|?OZ(Yc?uWxuN}p=&jFQh3 z64(-Xp)^fqx)0Ur&ycKs&hFjrnIhGO8W}pCQF@JI6STSPP!{Q)$ENRE!C_}VK7S!{ ziKrUs`f}5<#w!s(^NpzixWFFiGMR>Oyd4+NrV%6OhO#4pG^t(zy;Gz|H#CsDh>837 z7&r-S)pv#4Woerbc^vfOV_C(hnAUAx8JUeX2jLz$@W$SZ%?=R%tISXii&2E~qAx<$SmA&(eI^vGzl^??NsB8U1kwlEd za@Di<-Tvil|17iF1-dpOGUvXDO@^21Vs47$%w^bPJ`#HBp<4Tgm9IViLR7sIq*bf% z&dXQLf#8?LdjiJmm)A=;TaCk@se#OsQkeymKF$xCPjtbXjX(N_DlDKvLw(#&KP4%0l3K zNiXS?57%7kop-QBNHI15_|(qy6Y(@;FtHNkw{tl<2LeOHQ?ZB66$@ zaP3*q&k~X7{#iW1`?3XMXW3$wz+st(p5HPXXTr(KlfG>6e$s>`f{!3 zXAy5X7qq`}I&o7WkzlFr3(pvy^abKs9+H^-zo%Kjn)nijtm|pOINz z8A9VA)F>wv^coi61lcDVd;(izhM8h-1jF6`((iYaaV74nMpJ_Q;L)u-8Q+RBCXWai zM&>)L6R}I&j8;sl>y;|x>e?zyLYr)650l{lfp5-Vi6AuzU*xN=%0aX~d|yHXaqiJd zOpn0Vk|qNW3ch}ULVkpKp@`&4L|TG%^^(h%!U(b7bo?Y|OdC9&G9+F|8<2m!mCqox z^v%P>OJvCuqm=?)(R2MWlERz7L||A)d)elOv%qiU+e_}Fsi3b?w`nSuE8{*w%q(qR z%ku3+oq-a4e18q)R3q-(QY7h|05t83JXHG94pPhxyB+aJF_(lrb#4C05e7nE{KI{v zpZOXAT2w1|zb+`BtU%V-{Zh3J7flN8=`pT3JIZ?$e2^d5Zc8fBx!VICb+PI2C%iP~ zM`4w^_~JZxx6u~x9T~IoaPhGP)wOOl;a9B+=;*aEret7~-x$^6`(d5IL?}NmDh^*< zVN#wPr`gNzgc9S@3$Z(B0lDYG0DbYVYIXIX;Ftsz5lDiVT^t+vWbYgv;v6-y+*Y|@ zD9Heyj56_oZ4HHQ1p_jSt-2i0xLG`Rj7z6wM-pw$pHf0=k7_)K-*3T8&QP6B=iDQBew zEQtsMUYJ{c>l*REkJ%2Y65BwN*MnsjN2`jTGbJ6n-PJjIs!I(!%B@?`#+-DR1e7n5 z5T?rI8U&)KIxf4^-mB!Mpgce~!E+k|8p%77C79eJ^Tz?f*ElT&jLb=lWyxpWW-adA~OvPax{l zc=}OgzZCIpL8k-L>^**%r)9%`o6qJEFFfJ z*m8#aFxNGa4o$O;8MHnLlp_@V^p0J^^iK{0dGy>5Zr-vQ)Dl)`mFvutLdsJgXsos zrX2S4PK|{+``julFJxi<4e!8^sR13!u}9FBPyDNL6x2^tMdHMuf@*xLiiE^VvhbN1 zrW>#qOCoBIXb+YiYI%31Yn0^aP~eKAa2x))hDy+Oy^M3LgURarxaj*yY2JgVVU|GP zv`}7UJ*pTOm~?&k!$rNCesYJ_a?g{*8&Q;y?8uj-g9gn7T%GCwlyKFL$#vdnohv4nU*^!5wKt?pbm|tf= zr)O?SX;;^Q(tJZI#o#S=63sc|lyL4|s#{l(X$m+nn4LdI0ZF8G8Jh(-qjLzzAdw;AMXeKQ*#(L2rC zz00s;NGdKB*8xD;5$TJ98R9X&M|rJMQdfR$O;s6-_9|(AjnIju*K+cCY_35gcvOIu zOHb^Wj{D6H``5gsH1&N)A`uU2M6nccrHdf5dH%x)Xv@By>j;4j3qfgA)XH#g*|f|Y8C$7L7d!O1}of9wpRyn5s|e8vl? z8!*!Z{&LsfTjcTn142F?w0Qp5f~@22N~3$Ju#zDvFVzQ(zLY5iVlhhd3&m)3!_krw zYVT-vcXXI^&U%QCX}Yepz9B0ZnO01`n=6LhW>ZG#qXeN7r=pS|y%QKqT$$2s(;3lB zzVioP+4%!~^av`tii1Rv`~B`qZ>B#_vVm5=K-GV?N}rp#p?~xkUMV!(3rM2mh%RJT zT54MvYHB#M9~IR}FqJoMSrYONkg^|p*jeP;*hAa`_$is#82<^YU!}KD{4D@~OBvZY zm|*^tG5ps!o#B5Ks8?u6IW7+(cV4QETK7;nVqAh{FITcHDpJ+pMI7c!t}TK1<%A}K znFA%vwd|HYqCE{bjROUQP-w|2a*C5cJe^c^5%`c0n~?Tpow&NF2X4EZTl5?i-#$_*^%5-e!JlHzVr*2)$UuW@qO@+-PN2#E20Y_4n29g{;h@26J^3e>TTN(-~ z4JB})E)|`AkLk+aprm?4tL^s{TpKL%Y?I zQ7@)CrvX6X=liDh8s)5)KG?cq1{Q^K{(dAs^~lC-dU4M~pd+ z<B>77H zMtVR3N|9Ef3F7KmR6C03{Po@0AnaCrg$}hGkwo_R|Irt-hU{&uZy=ZqMRX$tt9U;>=1?&+fx)q zApcRz`otbLs4m=aBAjYT!-&jN%8$y=Vr@OsGyygnC!~x*01T4Q6p9+M+slF#pw7rs zZ**3raV1h!ZgGQok}@DJu(j}RvC?vBv5iRiFn_%N$QsyuFP4^F)%n&XYcTOgpXah5 zj=e!%1H?dT-cUGX{5v=qGBIR!Ts}Yw8MCY~;&B1|bUC!XZuM)tgBn-|4UFxlo8k_j z5W}sjX_Y|JU5#d7kIl6W40WC8q^`vunu<#Xp(z{s3RL=XwVRr--xGr2nFmq11_aTeybH)jaIu^wck91PW3OXkJUYvmgcOv|=<*tCx z@IpTf5BXRTsv$Nzgt`8n0V&9|Kd+GOz6d0ekV-Ja;AUQJXG^nwm##Uj(7Xk7IAM`I zaoJg>9G6DPV2Ck-PK*Jvn71$iVRQq436>qDsI98@YK8s7*wz5qV^$zu`aQQ07ecy$ zvKG@d3@AEPl~3~4^g5MH;!y_w1Zz;*4?#PueS$5lC}%zeOGWEFd0>2oEBs=qimxSf z*g2KY@+y2$$)6sGVHmkFIRNlj0Y7>&iK}XNRR#=tH;^QelZJRO^x6Vig@FP!jC73c z11nCXPG^$SIrsFyBCK7~zmVLtWnsR2R6pvA)>oidM(Ft<^;L7*&Wv8>iyNu~h{a0K z(U3MFdUJNz&7Iqm%Pv**8nKpHtg4?rVnbb1#=S*)y95AK-kcZEGh-U8<_jKhZYE$t z52#NxRsiq0)tHe%!KAb3|i%|dGcyfX&l4I8e!nF(9DTlqs`;Kg8$9q@4%qZi# zZ)fBO{*pcPZc~2|4x|x)0KkSv&tJD#gZChv^5PQ`wA~m}e)sh|#2%jWxJ>TE{?od~ z&2)#2oErl^p>CBIulmp0iQC7s*E`?!oTWaUmg(_x50weQ9Mv*huc9n>e@jnQ7abN1 z^`lL1kMLy^vb--xmj9N1$9bCmRs1YPsa5+jDnstg+`Z;R5cGU z7`1+~tJK#dQp-KEKc^vA1t@%$V9o|akYT7{G~w4iS$Dh3q&Xh_Oy0UjGwIYW8(KOysfjBKJQNDVb zSJ0())d)JVWrXk);zE@zrvA>f2vQT*VjmMY8_E+@|Mv6>LopL`&^DW-aUAWPQ0jr$ z)QdwOPr~EyqFO^vUd!vwc%ne7 zIKA(={GD2yg$IMnfsq^+R6#MET;ayS<$RZqq|E6IULII-MOQ~RkuHv3y6ZX4tfuq>YznUL zhtD?Mn1j+co>TR+HF@vpS90yq?J&O?>6q}tA)V8Qk0FWB`0oJ)ibP(7@_-|e>46bZ zeR{-C***y#*7G)Qt8Zt4Cp$b3LLQZlj&_rq3CdWu1o7}U5a$laI#RGw7X8%Z1d6!w zAsmmwNVYMvCEv3;=SS)nYh*VJ+aZTb`At)LBWCK7@=usK`0w$6=@3S9{QFOSAQTX9rI|CFLV4pZ(dq;Iw01!+}kVSJ~cy%#nopx7mI|!g+GGz4Z=$zyT$oMnIp; zBRLsX*fd_KVhvTf3Ax^^I=dtcsc5c9XLZJk~jS|a+_Rt_dMPDD&^^zCc0iKDHvgOQ2j zE3qr@U~8mg;-m$5WvGb&$|i13ul+=AUmG+0ZvD#a0)$@kul*f~-Xcv!nAf7eLeKvn z&0+g%?7z+V75VUMmgH|60E!F@FboWDV*(U8U^spY zY%srO@{b;G`QKLmZ+pDy{L@3wz|rJwzW_qgni3kS)XEmtCXTd%wpPZ!wo%x`(a6EV z&dJt+=oJ=kmi&UvTaVX$ws3HC5;8Y%AYx(!NE`f-8Q7QrY8J*$=8jr0j4W@6`uoGg z^ftY}Kfmf>Sm^1A-o9_2-|1gDdZNF2u(18AhoL88V|+8@?f31=%F6bNSOy|CHul$2 zCib^g`Ym%XGyiVI#t!q=;&&ew7S>;VertKt`CIxu&hOvX(O<`Tv*E2Z^Q)e}(!Wa? ze~tH6{wA@%&g)Hn>-m<_|LXN-&6~zQHNQssrS;ETf6w@BtpEP=ThnXZzish<((r08 z8~y7ODPr?_%VJ?;M#T6VPD;*(PH&I@+h#KS4W(bTe}M68pa1Fyc!SBmGHMn!0yd5o z|H=znn3|frdWct-pasLk0kC(reZAnZFf(_0eOBlJrWP=7n6S36ady=Cd$6~i`p+O# zm6H@u6#4@~MO$kFoBx8sw<-UBfWo(Z`MulpL~kg3lm8|^k2w*)Bn5oA4^|x@C%Kv`1xo0 zR{NKge{lKQ;!S#c68_Zu>nVF{{f5l9`oDU;S@f6uruomz{)IfI|MVQc)&D~EFRcGx z;ggm5Kj8DXllgb}e5?Kc7N1NE07GXhE0e#V3NW?$Z_)Y>C;Km#DXSHf>h{U<#A+TA}0`i-<- zSo#|yzp(V%+x~^5-|gOd{s;X04>rEx?Jq0-NPlMcpK||$_j_H3|A3xf$1C99q30h* z>;GHt_CNTuU+3dL!TEMb{(XM_LWZn?waLFZX$4;cu-EvDmXV&7h~w1}v%ZF4Z&&26 zH~Y*m00Bp%w+QUD@HLz=uoE|V^RBl6k04abBKo%eekOwFNlmN;A z6@Ui70AL6(bTBabVB%zDV(Rpl{L9G$i~vTqR<eb}~OkZO}fEmCX zU;+35umV{B_WuAIfGxn*#spvouzNisY>oeMSO6RVjsQmsH-Mv^fsqNo3E&KHwlOww za5S=YFafv#TmfzXcYue9gDvH+#e91kfr*IW*CY1#vGObbXB&RMY4Fb%4PIB|pGTk2 zUvDNbvvV->^8V``gbX!zWu?7FK883)ngptI3gtBYGXILkM$LxCZm|NC^Yp;#dRlJ;*E{^Wi5>Y684TPw>^6dX0*Qy3v@a<=1)Yyv@0z#7L%fn|<;5X) zE}}P2dZ5m(lmbA>PZ_BpE>-Hda9827q$7c_A^M`|MhUW5twjHTs3B8R96y&;KBOdS z=5Xfy0lXzsL$XKwlB9KBlKgT>!OZfEtR;3s1WdN60!es|X31?ankCCMNJCPpsJj9U zOZ=w7i1=N}kTTvix-H!}r^PVoaX#T)&tv7#^!v1xKpW2$kJU^V5b&mbuzP5wA@0oF z)Qf$`vdp%1-f5j(-lLk)t&Pi&te5ybl<`Brs8^2ZL4Jv?+>=4-X}!wy_H_O9efy24 zMSHp~k6;eH`T}!C#tA&c_@ugVh>Tgwn9JIa_vE;rU=D7+Fw<&hfA@SX2$gUc_+LZF6Z5Y3WKI zqXT=^&GzucQj5wlH~G(=wDo}y7`mYTY0UOWvn@4(F>u@D^DWe~AdV`Yo^ti9QC*9b z5ViGrM}Jqyop!lr3!yI)D(7zAqD4#Y69^+e^ZfFt)zj(FS7>T1Rmhw*VDV$=$>#Tkd}l-z~&TbSc6xl=h) zTq~~a{a^r{oYzNjySk+y_0H7|d)Mhmy9K7w%8y+{H!5nGpcZSgxW%sR4aUF@2I!8k zBmES7=SI*6DMi>Dt$c{pyLg+BA^PXarjDi;QC8gJxJ=(R_Z>J?{2^nH{0+d*G z*1gYn8B?x@&}*Kz_c6P9balwk;AxQEvOfs~Z79;hLMLAobyKh+2;+U#CWN}OhDljT z0~^acGqLF)a;Vv6$-Y1vs#028!j=ecKhN>@lknOHzw5_VY+{MqEWAT!#Fz=W5JlRFgVlC=m%BZn-G{n{Vl`y&$`!cT&+nwSMH=F;n%XC@Y& zTFQ{?bQG4UgHdqYerQX>nUcpi9S1y$jtMexNdZ&|+2Yy;bc5@I2 zJUv}tajB}((bj_lMPTigmoLLL)o0_GnOiofq#CZkU@6p^r48kno|TLuw=y zs?L6azDAqpDOq}X9lHgOq@j+aAS}5k&JG_K8Sj%7tW&~w_Q0$^D$!*UGjGmkNEH2? zb|Yg6B>OhG*0*QjF^QN#Yb!zr&=_BY>cD_M6*(~2jy8Y`zWLu8RUEvIAv9!9fh618C2`8E& zO#^r{ZZX^){Jb^%cBX3RV10&<^=PdckC-Lvas_j}7agM`S3NW36CDAx;l^9~9;s8z_B4v1Wzu`I%#p;x`4cG{0QW8*ea1CnBR~u+TgrVN zv9{Kl(JPUH_~Y zf2_)})hCyKWo9zqllM~~$iW+W<7>RVO1-1j5x1;>!lZ%6L*|Di1yV7 z9;o>RXY}GJNDbP=Zw{cPGile6pt#0PjwvOh`K;NnK8@yQ-2rQ~AnL<+tT!oR#}J>* zW%>xYh$fCjzFFvHk5BghS7=88=Rvr3LSKy(u z#pHP^F1mQ!){wI+oA6Xp(yUtYPBeZ_oUCVjr?ogS|n?0Zri# z-Hhb&bOHX*k0>$=nYJBJjM=c<`i-G?fc+<9T4s9uYYZsq^5HfyGxH;l=yuULwy~17 zP~WC;!97UcaCntn<{AYDu(4 zS}I{70*16TW@A)8TMyNlx@#qva!h4=so2LI+MT<-q;Kzf192TyA_VRj+ssGb*Y2^X zSbC!|-P8v^Z|1?q7A0cFBL3v|0;%$MyN*u&$j-~ANfM0X z_H?nTt-2dSWPxwJg5B;ahFK!mYX-+Lks$F9-mpW#Rv3NsT-vjp^qmmOREAT_rJM6K z!(@%A=WU5twQt&%&Ud4ldR#2V_ZK#HymSGKA>*_V1h}{PW^ zAo0mWVeq%$>i%XAV?B;FKOey9kJrSGT`NO*KCZI&)aZFMv$_Sm z9FmZ?6^6S-EW=^)fBs%lhFcU9`<2*eh&@os<;(k$byW#(0uqu~(L)gByE2_j;hlUn zoE?`{{9vj49`>8=3KbyHlkclvrR!aysXk^zIDU^5x>m@~NV`M^j&Mrj1CA(OC7NFw z3C6y#R6zW)+AG0$?@>|^Ds9ys@Tob*5SEODdmmqq8?oyu1iVZ8pjzh$)3yjO!x^O( z)_L4+>4NIA{)Ml)xcSVylZu?FjR=+jGN15^lfD*T=hP%!{7lQEe{ZF;$>DW<^zww* zW4<-SHaqx-(QwgK+Tb)f)WuaUmv0qOZ20&B07VkvEH-4G{C`iW*0&BGnBU!x}ofskP)L~5E2zQ z&q{cb(2+0`I`Wi|Rr>s}b?5f1R@E~DfLtcj!8D>SH-KNCoZtz)k7dchyTm4YiiUO# zmu~JtbsXqmZVl?MSs;8cfIc_zS%_vQxJY~K;|JUSHgA`#{&}!B|HDsryns9qdPJt= zHE?dIkZl8f{cyKltTWkjpZ5@!WaT^Y4qk_7<)u@~7N_(`{9kCi%|!H`J|BB$W%Dt1 z(>$VeQTMv)h&IYh_$mcZjkNAFic(<&rH+}9b#$M>ME5*ntQk&kF z8x?BrtS}>CvmMvET6WxayH2*5Z`SX_pwyf=va4$f*ubtoYo_HML*s#M1AK3!?|eTL z``#vwwe)`Hv_NbiJAk58z@9c9Idio{Vl>pl{&p4Y%-^*O|NgLJwZm~(WchmJO7flM zrG+im+>;P^txIU&XFdy#NzZGMnT(Gl6;a4OogPO(4+2s)f-iFdY9DNo-E9kq zaXubE#QN9ZugK9bs;I-ikMB2iBH0aLLI#}5ebP+4sB|L#QF@)<7k!Z+uAs=l$7=FJDSA>@YFhq)0i(i?k7lj- zIqOkZZbNNJy)pL(`60bn2@&-0ofbGKkPEVg4%zRqBN#xdzTKATyYw&%HBQzVjc-l+WG@^$BoT(o>>Cwwqe zM^!<-qGP}g0Y{etAEsj9WYpddLvZ!04@$y@eAAY{haF)nkP>w=17wAcl6><@fmPlW zn9f>_P<6&_N(2?ge75)~S~^7ufF(&K0Xtj)nu&ds{UG>ax zY1s1@Z0uCkm(TD?-K)IMKTgb~_B!H>7R{fU-R@3TBUkr=Kf=|CoYCs|R8`)LTtElV zD{5Czk%x2^O!^yzypVYjJ*RH6wg&KiIN)*YEZaf+K@8et{zUHFxKRon-dyVP#l#hw zDNeppXMW7?`xXyltB@LCUh1n-97S#XS0$2}&dX)impfsA%)&~{BqDyfupH~XW0&=n zry-*&9$Eq10GCTHJ_U^q${-Zv!2CmITLx~(UZT9z4Are1*c zfK?)V-8W4pP#yfjXa&lx;r9ng`b1+3EIte7AIck;XXE2T_iKm!zebCeCDhO<2M?=p>=M#Ry^iJW)F9anX0iPq& zYt3BPBYrR&Ahr`)!dj*h7dY6^Q`t;pF9HtzfFHKoN~}ABKN8*x?HW;P{!i+1c3xc5n9)%2BN*HDpZc z@K372mfwwU0`0haDCGy>N6Ibd5*nMH7*U8>ZaXyNQzi(SgixShRBnwqGa zHlbl0qWxW&Ii&5m;uQ)L}_p@ggV5=5t>Fsh5T|jvC{!t$_a;uLij>1oc4gwhD@3i6HHLrly#% zH~)eR8&@l-LYd37etZ3y{sk-m_FUse^wOst%yYYlAPK*L86!N}1#L|faZ+V^M>20w zS<8TI3m-1?LX@r+qPN2T(;ol!n!(i>P;CE}d-y#-jrNPh+vV+le5;V*jj;XSFrWYC zdgou%=PP%|!Ss5k$IkxWP@n9t9Ogf$&$sN~)F;Dh?%zQg_ z`J4Jw1*iek|7ZI1_x-`YSWqKdYionwT<9A~3o!k~hFZ9oyk0H*&5D}4+nJl#{Cjfr z?Z*8V(`xr7{pMN!Vod)h&eX}=!Q_=Yb+vtEPya=k{#VlU*JbiQNYj5@#{KU}Q&whH zwtteQ8W!qG^Q~(P)wgq{D)e!oGDq2s&aa%QrdYZ{th+o?f_o+?DXAZ6OgU*_Oc)UK zC3o~@AS(M@j;wjbjI7vlrjoVi=~8-s%lK+e=HANQ+T|hdHsp||#+TcU?+=~d5kMW2 z{TZ+#_tz%RH%dmhQMZIpk52gtwXtU&DQCE(eNmn}eOAU|H)RL9o!%#($a8#r)+M(b zv2r`GPG*30)Tf_2zGd?Mv9*6Y8Am4NO8VZUKv+z)fL6W3VKx=qKm&FylEw~JF6xuC zdUfbC`8#ep21;IT;$wX$FLjRt{~>Qow_vftfuO?2@$u(|r59UoxG#;iQfJ>Yo8Jx5 zx|>N_E@fVIV5j6f+!>r`3?Le3v19pA^uA-HS{mV+Bmc&>c3Rg@*yxRxuUX35YIQfP zQg+FwQFk*9e#mgdbA;3g>`8dp&D)J&1j`_2g}fW&Zp6DFmJGOI*bTWeTCOQj2WkY> z3I;c{S#Y3%S`Mq|b}^u?SzVyALTtob4yovwGdx)+S^&1fcR|vMZZRZfMK2pDG)Sv< zvw}$Swf<^qXlqo*Kt75s^<`I|#)@v&pMf5sG2k28u5XYLB6gTkdQqTs%gB|nuATah z{OOPNVizxe!fwyAE|j%b4#1M?gXL;{$#i=WkK2but+}R5>Dw$HO9-=IgRizs(On(8 z$4MHa8rO9`X|$P7Y1544DVI2V#AcS?N;$9{VRl#2nZ8Zco{Y+*d`Meny3HKH`Aqs5 z`7`DbsSC9k@<2Dkcp4}R)4)4l`1@PM(L~_%K zz(Wv0D}?0>OD6LvXH(q+>`LF&uXjjEOSBpjZTlu1dFhc2g^=|L(=k^Q0pk*d;ozAm z26cLZB~)(_Mt61)=+Q zkq{VXvsl%`+?D&N>8|VXf7doA;|{Nt;%BK=x8#D{&^i;kkuw)a`{+)CWXG@iiBwYq zs82GM2gs}<(6*-A&I-%@iwCPV*zKy971Juk<|v*XFlWg;EBTL~IKz4$A)qn$Fn6}- z${AV|a+f4!-H?VWT5{oou1LP41IW zSSJ?b*%COZvqUyJC{QDSPTrR5b!V3g@pE=Hr>hdW=o6d`vDfCbx9uIb-w z{v6Ri0nPdJ2)QkA6aLv80l*f^!deT~5pcH7qa`Oib7g#n65?>;4;adVs9N2cx-VaoW^Ie(-8ecfw~RsCz=gUgGj*v!s>f%583WY0Hp^!frf$~fX7S- zAuyl^nWej7s$%83jM_zDx8nEtSpD;DN;4sl6Vb*RW=tR~0MR7<$3|nHCQ8M_QIXg= zz3!CYSo`Lc9b6%wt3B%n1#Z}3>az-}SONEdz%nQ^A8E0M{BiWo>vvARup8wW-#;Fq z#~tAJ;*uF#W8It2cYb8Pxl}VR;XOU{^NA%$2%^r4?x>F#`q{k0Wq((E?{*#YOsLnWDx&R_ zNEFfoGNw2+nlCnKyG!E5CDyzwJuq_yUbQYK|8yCbW3s3v+S_9uBoLUH)@s#E>=6|q zVh-q{IaIcgM@y|_5k4|?kKQa2n!I>iqsRIDe(S1NRtg!FR=BQ9{mJ2{;p#pxLGJwR z@bIDrzp0Qt<%Ut*0ooJkbsSO|UQ?bKO^jv?^^nwf`0GC`u*Vn=)_-L+SpjMiXFq;? zvaMtpINJG^Pb7n(=8@AGao#j9eL(h@o)`+*ft&8XrWPmh^8u#-#wi}Dd#5kCmxj@n zs4RyF9@G2vuQa6?a}Mbq6&Vo`c;CQECv7xVgGI|)3_##1mn`$y`GbQ}rAG)4N;rN? zFFrVF)&Z$$?;f*Xc@qOc6hnh!&W!)5!d?QEsCcq${Z)oF#oP#)Xr+jLTpF;35v8s9 zShYyV`@&PG^{1eivW}^DLAn}FoKhBz^uV>MS*X22ID#AG@huS+gLb4UB)AQYukZe| zG;dVGW_({h!zcsl+@kopb9W(#9RnPuSuR5@Fx(3ENlD>Pl0&P+6sdi}z_G+nh+GDD>t?#5W;=M8EO0)A4c=YtbYw$|)8rnxk#I zI|1v>J6UZ@tBuK1v&|>J@{6Al*pdD354jhf!hgok${}_m;BN8heUYk4nQN(D47a7l zNJ+RA$ASP5^9kNrWd3yI7-Jn%-5i735hy;vh0Eid3QxW3D;_0MuznW{Xa)0rSsm>A z_Oa4%V3U5w*vN|m!ZnJaWTuXWgP=Gmi9#;+%&eX>ty$GP&KC$J3@U~K6Q*Bc-#*uk zKQq+&aI1&hJT`{CfC9bLUp$|THRGo1`=XAj-uUsUtF{~(<+mly$URApc>U^lE>hj) zhV63n@7WkhR0Iohl|JUIJkt|G- zfcyE)8l8GM&Vbv_U1};NjMTE&mRAa!kddqv1JH~?{b*Fu>tPD2=X>gp1b}=~KuaTA zl{h`(k$@*P^idYQ8U(#1?QbN}`ks-JFtE@d^w)hQjU+sgc|Jt@7ON(RmpMYL(s+SL@ z_zsXjC5-?jq#=FD#23|GIWp$*M{wwzV0fOKf#Wn2vZe++>e`Uu6E)r%di_gnw;BHd zztP%eU}nhsx~!i4xqDHmvQ#61GH~JeULsIIB9wxnz9Ey`@|969R4w@oGgY+nv;vcQ z7xmG887fZK0dS98=!6|sLiaFU{daiQp@{L~Mlc*8%@cy8p$(=wH7)gVw_u%5?=V2U+^Jf1r644KdCS=~C%D?I z%!LQrb=jEg!CAs8OT&v6qYb(2m*Y>AKVxq{k-bv|Zh`z>{%xLuOPnfG{ySS5A*PI^ zT`!h%BAu_WXGY7Evue_3rR)TBNq53LQQ>Yw4GV!1{3Ub@ovu^_x#XB)Y6{HH#zJ_M zi-n|#iqsZR6cIomG4U?+T(U87J(yD~pT+9zlIY4PAY)3rd?ckEC0~wvBJ4Iq2xy0- z#%M)_qJoV=?sy_Kr*bu4&&~xGB0KDUH){u`F!C*R8^e29 zB`6}oBa*Bpvf6WkR6sf-azJLlT^|Q!E5Wz~4_1?YGkluEfjGy%TR^v5!n)>@ zTZ}|U;2;|f`iKxf2IE0afE_D0{EaeZ@? z@U|{Qs&AkxF0GE`H0}qap})vE{v-zP8lvQ-=cgD{$Y<-BT~wFa+$~jEm95n8V>@zA zHw)q?-GLb5PV~hEc0APPBQ=3f-KcmUq?^-c$*dK$-)*RHzZB*(6p(dpnHLa30g2W2 z=0yjRwfMo4Zmwy;hGh|a;xCVmAox;1v$fUut!$mDSc17Kh4dWZpo{ER zp))h6eZuRC7e;rkcGI8ScH!v(_4_36d!TPc@b+ilQ8GQF&sI*$57j{i#X|(>lV_1V ziL2eQ`E7v_CoAE)+7pfv>g$V(*J#{vgxrQH|@F_VX$9!DM zxYg7*2i;;@g3+#1n_RBP#HwL+R!Jd)MqjBlj?YiO;Y3HD#V2+SS$T@{k9QyHxr-f+ z+74c*nxxgPQ6X`uYf>K{Vd4sJHp%r5ufKTP1(7=M2FA=#*@n0c0WaDK03 zO}>QLHsVT7*d{k@BoXxqE>z0bYr}zp5Ij-fuHB?lrSdtgfY`;xu|q?tfoyXJx* z$$lTVYT8xJ5gyS;^RX!I_8l+>?c+su`HH5i^j(V$*g0{b2Yp8!7ccC291}Q*0g0-< z;ylP+o9EFdC4yaD{T0Fh$o=8rnrg2rhl~p;6bR&xfjSH8$f+JbC@^*3Z>LfyNOrm+ zkPpdDiBPc|V+=mWJsP!#si!LL++`|q3fN<8R88lr`ExR3nG?9UhEc z3p=2o-Mrpx{oCaY;eL}K5WZ^rZdgvY6)py+ zc2@1IvN0ga?KR)LWi|X}C^HDV>9hA}JL*APZCWaYiVF6qtTBNL_rIPEx$R3pSW?*Y-p zq8XeW4JyIMm4htJ2PTI6PQbK%5zvQN9At=#gmYtoIZ{58quSqrB?eCI zKU}DC3C_e>l4G!W3Ac|^Q6EiQxA46-hj6oe;`x^|ZG6*+w+tSRZER$+e2^mJsuSd2 z3~0Pd$;l1+ejZ}gInbeL*||n7WVaii0>jQcb08bCX(EI}=MCrQJ_$z%h~IV$1x|@k zaLe<{#@+vf!!>&JeM-*pdNdRW0weXuvxuW0pv}~;okaO*G#cWPYR1d zy)GcdQgEC)*3KW@xriW3bAK#_lA~p!)O^m^n4$^9L`tIk@l98X`MOCt9b|haJpY;- zO@e~kcpqvXF|e4;8McZ-PY8?-R)L40zrhAJtj@VVy-Tx^%I-jkMdj^O`3AL;A(?)3adQ| zB^Hx4DvxwJHIgc$v!%fDptbqxN&io4R{{^^_Wo%sSt3hBH>NC8#LO7O%wX&!YxZnq zn`SIyjKL5Jl|n?;BBVlyvPU6VE4yU7BC-?8mgWCa_uiI!@9+2je17j|KJz*6GtYC* zbIy6rJMVj*=lQ;ZH}+3(*=`N5Fv`?TjOkEs-oN4+IDeEwbKs4d1Or}7$pfRfNwjq{ zuwFCB$qIiu?`x;o9^7d;9P)18O3ixCrc+JP{fKilg zbqZ`k$?8Q!jaQGFxO4sIqVPEZ_)zPLi>XBDdj0P39BXa0?2A0TcO&u+8B1u`XNM-m zC{GTUQt!mgm%yp`@E)C9#{rEa+F#Ybq{v((Tq=1$hfCaVwhN_m{u@6c+c5mPHV`9`?F zx=dWcv1^0&^R1HK^w`2jYD2CHIUH!TUeU>n>LCYs2Z@(kCq*i#&TYF)k+X@?sFS|Fi`_*9g&W;>a%(CWLwz&M>|2B5LNg>fGjim{S*#wN5<`D#32kH6 zU3#_-Z3X#j9|6&!H++kzK`KeNp2UF42di3)#TAsq?5K33ios3z1J-K-gY zm8tgVL(S^8&KF$s^}-Nl?4beD3R!ZYDps}0tZR&sCWAR)K|K2SSgBezIF%RQBwr%U_F*Ppm&U^HI0w5}t#Ch-Zr!L3PG8ft8Yt|Yveh%r^Wy)em& zj>oVz2W~DzEDeQOU#BB6FsYh7_l{yIfh8inqKhksfMr?TTXblPNxy3R2C2#8_q##i zEq8|abCe=niJi*CL+xt$M&@(RoX|`wvBfw7u1z zxG3Fcy2y8OW5QcdA!|zEwOp5_94j#}Evfp&hj6iH6A7_i+$H*5UN#BKMPF)1X%F>0 zit1lcdva3F;pmxVc~lSi;Pun2zx4?oy>de9Lv4p@xe;W}EjY~0Af@A4bz}W4P3xr7 z2JWzsqU)I7g3>LyLJlt1$P`AA0+7tI&+6K4A2=plo5sEAvc;$TR?9lz`Grnv(SB|J z+MrD;`kI)oR`>F>d@>lJAEy^@jf&WR{Ejh=hylq#Jv2IwNFWOGa&o9LR@;#q({gV~ zc~DH|``_NA`16CgF5QXwSly}FGTW6RS1;%DctMIvH#^S=YPrlxHBBeP-e8a5KN6y> z(Z^!`33OxOx4|Zr(h=DCa>eH|=fJPzJ z%G$SZkyfYT{YFEr5BHK0-BdS=>(h5KtFK%gIPCn2&yHf9p9_kYHV+Ebt%YB-Uc~xV zFb3XyZAL$)-P@u^fmgwde*jM+y5KK z+COEY?0D8B;L`Bz>;ND&2__9V*ARc_TtocmTmw%3a<0K-|H-)qL;kCCZ98kg{;MnO zkF)?h^dCK6f2IU%=K)Xv@0HK@asE=VbKaGs%L)vf2ZCYy!+8choSCm*8bSC_X+KULOjR=($;OFSeg9&dbnw9Mzh`YvU6tt^92 z#1iL5L%N>OyFz>oUcy{Gfzv8)gtQt2g!y_dRD`%_7+#k+E*5?HW0aTL#TPEswM$QvH~jmbmCm(#LtZBq;tbbDMjFc@;%SiE z!aAx!;6{N&hA(wVTM1F5@K=F1P;xSpdr(TcaZO^CC0S2+%jp))nGQa?UQ$N<@MuAZ ze$GuR{r7~ITdbi>%X-1Dp6wbNau;g05I3O7?wBl0W2z0ytj~cj?X|M$@|#?XozrL* z0O9>(mG6}Zz*rt_bXw-nr4V`35Y613L)O8$)ta&^6y?i%%cNi6Q!co2=}_Z!Mn^8} zQoZd$)ZpC5_#stXa@LPJ<5WNTa@{#)N%w;Lrxd<;(}mCE=0?&`vFAM&?D1-5Z)RaM z&4BpyQ&Rc+>W^b@uWEx1LTLFFDy}B^L@VoU#Q8+|UFsNi@}l>o8Kd=wU)p!lYT`t# z#cQ7T*j#M=)nQl(mYCN&XvMpqJ;FZsiN-k=r6Ipk?q?vg{sG09q-g6kQ-(M51uw@I zXsQ-b{d9wk_v4z(^8+Ot+9-QnKnH5YJq$fcaA97wg*qn(`v*W7nsxb0Q}H1!oD^O8 zy~1Pkd>?Bk(n-3hTc46=!)7!=shrdqZ2IY$5_(#G0)9IDh^k{dS$9?W7!;xiYU$>2 zZ&BtLvdKfB-%R;Tmg4fdM;Y-RxhL<@(+pmDs=Md$_@bw>$rY>qJFI%a;g%WoXN60B zhx{Ufe1p5H9x_v(B2yWpdxNDNRkXDgI1-TVqw6b7tBp_N;njNsxG%OnG{`?IZMZ^2 zRt6@+cr8zH4ypBQI*pETE;QIQt!{*C*dvxNCA` z<&eKnb6(e%S5>>0?i;|hrY_#IVo9<;*fn6fzN=sK42UNqv1%r34OD#g34b$NwD!#m zdeJj)a`~8o9caUcVq#OYm{7R2kC6a)vyZVgAD!51!v{jKas-qpMu=TPY%A`m%2Zv>5izI zRfs5SoLNj}Z9%BRPzP`1hTkMt&fLO8bHMPalM*A^HLTHJkX&{0iPdGpA32m5bl8H` zC-X7K^wx$93sNxVOQ?y`aZW3`!OK%a3kS|M6MOT;BSW=5L{{Z)egs>cU34$dvFr2Y zVrI$QJ7(M$n0(6{Le#Bgrbm-|om6ynU&c1DgY4gC$pzQ9sO84#jnX%sCNSS$hEFw? zCDjO2W;1*W7L_ke_a8XoNwb@VSY6cgScQ;i1BvH*g*iiO8d;r(cKI|xD`u4K$f)|D z!31^i8FRrQP&r%1Ww#((>BEG5TJG0amk$JE0&b+W(-nd%$KBiv&!1F^$zH|DS>@7Z zCeM&KtJq#Ot4!&ozs?dWjKDiyw&7%fA6`zK7v;ikUb~TK1MUO0x{82gD`!`ih8=T+ z+PmK}w#H!!e*ci)qnn^Umfzl6ZUiO@M2l#U9kJ6TA+wymHYzjKGy>SZj)1ME zf;R}Y06_=VNO&6EV{|mgw4g21)Hz)A!p+yQn@;+wjzS-tDP^Z-OBqSwq!uHwtGj|8 zj#LzcrmDWy$;@qXaRTuUI_(3|Tf9xZ!unZ5RC0cFgio(bMf8|!w0B`q;YGQ-uA}DM zQ*9OR3h6*)NterxbUB%{O*fS@2jq7-`F26x?LwssQR{+b4CdauLy|*glo+|o3*toy ztQNkl)am!Vegum^PfPCWwr1(I_b8bXqfh+3By33u2Stg`EyRYhg6iJ0_Di?+8Bj1L1f&o(o+0gXXYblGcV%3n1+ZLyVJ}k7ijj9Z| zlQ_@(HZl;DQb5R*_}$uYGJc z>1e_B80lpde@TPZ+~$16xlip+*`X9rVR8G#DYecKKPNUEPhZg!1-vmLk6u%Q$a-4w z+yhW5(nPekPvh3Em#Lj~yHxgs7vj`BseP?k5BtVeo}DmVzhOdZLZTM=gDdp)#^gO+ zMXg<&aMO!gloI(T^e@rf&BZL3DUc>^sdMvGSMkfIgd6E=ro9Mp-rteov^VY zcX-AX4dNeMbV{a6<-e8D`+kAymr&9^N{^Mk%iJ(pYGKjoN&47VxwX54VMTUGg2$@v z;XDUVd53L7ZF`oTE`O#{t!`+>_D~qA86LULuDi5TPtRQRlms=_88;BI(u$+T9k{E_Nutg@@JJ zf*6e3Q;Dv7=qwn?HH1EdICJP~*|~i_&wa+3i|@tkW1p*jrN2L)aSd(EXIXxU{$wp;c(f%?wjQmsX&G6;M!tH+_P);cXa|TQmRVlW7Qi5Ml%U#@Byc+r;2vNgby?xC zs-cd?;cW&ghU!Xk1)x#DR96?G2ZpKu*%84250^?JenzkaQ!T zg~HKjG!!NUm6DPGI3zrLh!k6@1kpnXXm3Xmg883fL=VXwog{%UKPbT*3YUaI|7hrs zWN!eL9lYJJt=%?!`r*UhY5|bd|GpaF2cRAV&^@4p0U&i8JnbFH3J^^L9k3?e&4cn4 zg9QwSNy4Ng;SlJzj{S%BfWiFx_JA4qrnfx6gV6<`L2y250Mrjw3MM5j0h5w|p^T*v z7-=*HjY}b(SRv#+w>7N%=TJ0i?O-dSt`k4kpqR~KKf8YZw6hM;ri3WqCe&IvFr2#OJA7y2c$e(FaFlku;K;uU~ z8I%kVIs5|+j*ylGK!$#x!DOVQevw7NVZZXhf8|4>q<`rz0xt8jelVmA>KB>}06g@w zE-2|=#tM$uM%?&OXJEf<8{Fone#puI+fYB!WTkN5Bri0N|P%0GzhH&jp5R5pizdZ36}n*R<5Ymh#eSXt=U8@IS1gjF44T wQ&W{iqm|WBa1>e@uBwKV!v1Ft>usbm4~i|BvSWMz2#7Qic$
+ovn-controller(8)                 OVN Manual                 ovn-controller(8)
+
+NAME
+       ovn-controller - Open Virtual Network local controller
+
+SYNOPSIS
+       ovn-controller [options] [ovs-database]
+
+DESCRIPTION
+       ovn-controller is the local controller daemon for OVN, the Open Virtual
+       Network.  It connects up to the OVN Southbound database (see ovn-sb(5))
+       over the OVSDB protocol, and down to the  Open  vSwitch  database  (see
+       ovs-vswitchd.conf.db(5)) over the OVSDB protocol and to ovs-vswitchd(8)
+       via OpenFlow. Each hypervisor and software gateway in an OVN deployment
+       runs its own independent copy of ovn-controller; thus, ovn-controllerā€™s
+       downward  connections  are machine-local and do not run over a physical
+       network.
+
+ACL LOGGING
+       ACL log messages are logged through ovn-controllerā€™s logging mechanism.
+       ACL log entries have the module acl_log at log level info.  Configuring
+       logging is described below in the Logging Options section.
+
+OPTIONS
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the  PID  of the running process. If the pidfile argument is not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By default, when --pidfile is specified and the  specified  pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs  this  program  as a background process. The process forks,
+              and in the child it starts a new session,  closes  the  standard
+              file descriptors (which has the side effect of disabling logging
+              to  the  console), and changes its current directory to the root
+              (unless --no-chdir is specified). After the child completes  its
+              initialization, the parent exits.
+
+       --monitor
+              Creates  an  additional  process  to monitor this program. If it
+              dies due to a signal that indicates a programming  error  (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This  option  is  normally used with --detach, but it also funcā€
+              tions without it.
+
+       --no-chdir
+              By default, when --detach is specified, the daemon  changes  its
+              current  working  directory  to  the root directory after it deā€
+              taches. Otherwise, invoking the daemon from a carelessly  chosen
+              directory  would  prevent  the administrator from unmounting the
+              file system that holds that directory.
+
+              Specifying --no-chdir suppresses this behavior,  preventing  the
+              daemon  from changing its current working directory. This may be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By default this daemon will try to self-confine itself  to  work
+              with  files  under  well-known  directories  determined at build
+              time. It is better to stick with this default behavior  and  not
+              to  use  this  flag  unless some other Access Control is used to
+              confine daemon. Note that in contrast to  other  access  control
+              implementations  that  are  typically enforced from kernel-space
+              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
+              space daemon itself and hence should not be considered as a full
+              confinement  strategy,  but instead should be viewed as an addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes this program to run as  a  different  user  specified  in
+              user:group,  thus  dropping  most  of the root privileges. Short
+              forms user and :group are also allowed,  with  current  user  or
+              group  assumed,  respectively.  Only daemons started by the root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
+              that interact with a datapath, such  as  ovs-vswitchd,  will  be
+              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
+              CAP_NET_BROADCAST and CAP_NET_RAW. The  capability  change  will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons,  specifying  this  option will cause the daemon process
+              not to start.
+
+   Logging Options
+       -v[spec]
+       --verbose=[spec]
+            Sets logging levels. Without any spec,  sets  the  log  level  for
+            every  module and destination to dbg. Otherwise, spec is a list of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A valid module name, as displayed by the vlog/list  command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog,  console, or file, to limit the log level change to
+                   only to the system log, to the console, or to a  file,  reā€
+                   spectively.  (If  --detach  is specified, the daemon closes
+                   its standard file descriptors, so logging  to  the  console
+                   will have no effect.)
+
+                   On  Windows  platform,  syslog is accepted as a word and is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off, emer, err, warn, info, or  dbg,  to  control  the  log
+                   level.  Messages  of  the  given severity or higher will be
+                   logged, and messages of lower  severity  will  be  filtered
+                   out.  off filters out all messages. See ovs-appctl(8) for a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless of the log levels set for file, logging to a file  will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets  the  maximum  logging  verbosity level, equivalent to --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets the log pattern for destination to pattern. Refer to  ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets  the RFC5424 facility of the log message. facility can be one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp, ntp, audit, alert, clock2, local0,  local1,  local2,  local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon  is used as the default for the local system syslog and loā€ā€
+            cal0 is used while sending a message to the  target  provided  via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables  logging  to a file. If file is specified, then it is used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send syslog messages to UDP port on host, in addition to the  sysā€
+            tem  syslog.  The host must be a numerical IP address, not a hostā€
+            name.
+
+       --syslog-method=method
+            Specify method as how syslog messages should  be  sent  to  syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc,  to use the libc syslog() function. Downside of using
+                   this options is that libc adds fixed prefix to  every  mesā€
+                   sage  before  it is actually sent to the syslog daemon over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However, rsyslogd 8.9 and older  versions  use  hard  coded
+                   parser  function anyway that limits UNIX domain socket use.
+                   If you want to use  arbitrary  message  format  with  older
+                   rsyslogd  versions, then use UDP socket to localhost IP adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port, to use a UDP socket. With this  method  it  is
+                   possible  to  use  arbitrary message format also with older
+                   rsyslogd. When sending syslog messages over UDP socket  exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified  UDP  port, accidental iptables rules could be interā€
+                   fering with local syslog traffic and there are  some  secuā€
+                   rity  considerations  that apply to UDP sockets, but do not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The default is taken from the OVS_SYSLOG_METHOD environment  variā€
+            able; if it is unset, the default is libc.
+
+   PKI Options
+       PKI  configuration  is required in order to use SSL for the connections
+       to the Northbound and Southbound databases.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies a PEM file containing the  private  key  used  as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies  a  PEM file containing a certificate that certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate authority (CA) that the peer in SSL  connections  will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This  may  be  the  same certificate that SSL peers use to
+                   verify the certificate specified on -c or --certificate, or
+                   it may be a different one, depending on the PKI  design  in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables  verification  of  certificates  presented  by SSL
+                   peers. This introduces a security risk,  because  it  means
+                   that  certificates  cannot be verified to be those of known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When cacert.pem exists, this option has the  same  effect
+                     as  -C  or --ca-cert. If it does not exist, then the exeā€
+                     cutable will attempt to obtain the  CA  certificate  from
+                     the  SSL  peer on its first SSL connection and save it to
+                     the named PEM file. If it is successful, it will  immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all  SSL  connections must be authenticated by a certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This option exposes the SSL connection to  a  man-in-the-
+                     middle  attack  obtaining the initial CA certificate, but
+                     it may be useful for bootstrapping.
+
+                     This option is only useful if the SSL peer sends  its  CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol  does not require the server to send the CA cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+              --peer-ca-cert=peer-cacert.pem
+                     Specifies a PEM file that contains one or more additional
+                     certificates to send to SSL peers. peer-cacert.pem should
+                     be the CA certificate used to sign the programā€™s own cerā€
+                     tificate, that is, the certificate  specified  on  -c  or
+                     --certificate.  If  the  programā€™s  certificate  is self-
+                     signed,  then  --certificate  and  --peer-ca-cert  should
+                     specify the same file.
+
+                     This  option  is  not useful in normal operation, because
+                     the SSL peer must already have the CA certificate for the
+                     peer to have any confidence in  the  programā€™s  identity.
+                     However,  this  offers  a  way  for a new installation to
+                     bootstrap the CA certificate on its first SSL connection.
+
+   Other Options
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+CONFIGURATION
+       ovn-controller retrieves most of its configuration information from the
+       local Open vSwitchā€™s ovsdb-server instance.  The  default  location  is
+       db.sock in the local Open vSwitchā€™s "run" directory. It may be overridā€
+       den  by specifying the ovs-database argument as an OVSDB active or pasā€
+       sive connection method, as described in ovsdb(7).
+
+       ovn-controller assumes it gets configuration information from the  folā€
+       lowing keys in the Open_vSwitch table of the local OVS instance:
+
+              external_ids:system-id
+                     The  chassis  name  to use in the Chassis table. Changing
+                     the system-id while ovn-controller is running is not  diā€
+                     rectly  supported.  Users  have two options: either first
+                     gracefully stop ovn-controller  or  manually  delete  the
+                     stale  Chassis and Chassis_Private records after changing
+                     the system-id. Note that the chassis  name  can  also  be
+                     provided via the system-id-override file in the local OVN
+                     "etc"  directory  or  via the -n command-line option. The
+                     following precedence is used: first, the command-line opā€
+                     tion is read; if not present, the system-id-override file
+                     is read; if not present, then the name configured in  the
+                     database is used.
+
+              external_ids:hostname
+                     The hostname to use in the Chassis table.
+
+              external_ids:ovn-bridge
+                     The  integration  bridge  to  which logical ports are atā€
+                     tached. The default is br-int. If this  bridge  does  not
+                     exist  when ovn-controller starts, it will be created auā€
+                     tomatically with the default configuration  suggested  in
+                     ovn-architecture(7).  When  more than one controllers are
+                     running on the same  host,  external_ids:ovn-bridge-CHASā€ā€
+                     SIS_NAME  should  be  set for each of them, pointing to a
+                     unique bridge. This  is  required  to  avoid  controllers
+                     stepping on each othersā€™ feet.
+
+              external_ids:ovn-bridge-datapath-type
+                     This configuration is optional. If set, then the datapath
+                     type of the integration bridge will be set to the configā€
+                     ured  value.  If  this  option  is not set, then ovn-conā€ā€
+                     troller will not modify the existing datapath-type of the
+                     integration bridge.
+
+              external_ids:ovn-remote
+                     The OVN database that this system should connect  to  for
+                     its  configuration,  in  one of the same forms documented
+                     above for the ovs-database.
+
+              external_ids:ovn-monitor-all
+                     A boolean value that tells if ovn-controller should moniā€
+                     tor all records of tables  in  ovs-database.  If  set  to
+                     false,  it will conditionally monitor the records that is
+                     needed in the current chassis.
+
+                     It is more efficient to set it to true in use cases where
+                     the chassis would anyway need  to  monitor  most  of  the
+                     records  in OVN Southbound database, which would save the
+                     overhead of conditions processing, especially for  server
+                     side. Typically, set it to true for environments that all
+                     workloads need to be reachable from each other.
+
+                     Default value is false.
+
+              external_ids:ovn-remote-probe-interval
+                     The  inactivity  probe  interval of the connection to the
+                     OVN database, in milliseconds. If the value is  zero,  it
+                     disables the connection keepalive feature.
+
+                     If  the  value  is  nonzero,  then it will be forced to a
+                     value of at least 1000 ms.
+
+              external_ids:ovn-openflow-probe-interval
+                     The inactivity probe interval of the OpenFlow  connection
+                     to the OpenvSwitch integration bridge, in seconds. If the
+                     value  is zero, it disables the connection keepalive feaā€
+                     ture.
+
+                     If the value is nonzero, then it  will  be  forced  to  a
+                     value of at least 5s.
+
+              external_ids:ovn-encap-type
+                     The  encapsulation type that a chassis should use to conā€
+                     nect to this node. Multiple encapsulation  types  may  be
+                     specified with a comma-separated list. Each listed encapā€
+                     sulation type will be paired with ovn-encap-ip.
+
+                     Supported  tunnel  types  for  connecting hypervisors and
+                     gateways are geneve, vxlan, and stt.
+
+                     Due to the limited amount of metadata in vxlan, the capaā€
+                     bilities and performance of connected gateways and hyperā€
+                     visors will be reduced versus other tunnel formats.
+
+              external_ids:ovn-encap-ip
+                     The IP address that a chassis should use  to  connect  to
+                     this  node  using encapsulation types specified by exterā€ā€
+                     nal_ids:ovn-encap-type.
+
+              external_ids:ovn-encap-df_default
+                     indicates the DF flag handling of the  encapulation.  Set
+                     to true to set the DF flag for new data paths or false to
+                     clear the DF flag.
+
+              external_ids:ovn-bridge-mappings
+                     A  list  of  key-value  pairs that map a physical network
+                     name to a local ovs bridge that provides connectivity  to
+                     that  network. An example value mapping two physical netā€
+                     work  names  to  two  ovs   bridges   would   be:   physā€ā€
+                     net1:br-eth0,physnet2:br-eth1.
+
+              external_ids:ovn-encap-csum
+                     ovn-encap-csum indicates that encapsulation checksums can
+                     be  transmitted and received with reasonable performance.
+                     It is a hint to senders transmitting data to this chassis
+                     that they should use checksums to protect  OVN  metadata.
+                     Set  to  true to enable or false to disable. Depending on
+                     the capabilities of the network interface card,  enabling
+                     encapsulation  checksum  may  incur  performance loss. In
+                     such cases, encapsulation checksums can be disabled.
+
+              external_ids:ovn-encap-tos
+                     ovn-encap-tos indicates the value to be  applied  to  OVN
+                     tunnel   interfaceā€™s   option:tos  as  specified  in  the
+                     Open_vSwitch database Interface table.  Please  refer  to
+                     Open VSwitch Manual for details.
+
+              external_ids:ovn-cms-options
+                     A list of options that will be consumed by the CMS Plugin
+                     and which specific to this particular chassis. An example
+                     would be: cms_option1,cms_option2:foo.
+
+              external_ids:ovn-transport-zones
+                     The  transport  zone(s)  that  this  chassis  belongs to.
+                     Transport zones is a way to group  different  chassis  so
+                     that  tunnels are only formed between members of the same
+                     group(s). Multiple transport zones may be specified  with
+                     a comma-separated list. For example: tz1,tz2,tz3.
+
+                     If  not set, the Chassis will be considered part of a deā€
+                     fault transport zone.
+
+              external_ids:ovn-chassis-mac-mappings
+                     A list of key-value pairs that map a chassis specific mac
+                     to a physical network name. An example value mapping  two
+                     chassis  macs  to  two  physical  network names would be:
+                     physnet1:aa:bb:cc:dd:ee:ff,physnet2:a1:b2:c3:d4:e5:f6.
+                     These are the macs that  ovn-controller  will  replace  a
+                     router  port mac with, if packet is going from a distribā€
+                     uted router port on vlan type logical switch.
+
+              external_ids:ovn-is-interconn
+                     The boolean flag indicates if the chassis is used  as  an
+                     interconnection gateway.
+
+              external_ids:ovn-match-northd-version
+                     The  boolean  flag  indicates  if ovn-controller needs to
+                     check ovn-northd version. If this flag is set to true and
+                     the ovn-northdā€™ā€™s  version  (reported  in  the  Southbound
+                     database)  doesnā€™t match with the ovn-controllerā€™ā€™s interā€
+                     nal version, then it will stop processing the  southbound
+                     and  local  Open  vSwitch  database  changes. The default
+                     value is considered false if this option is not defined.
+
+              external_ids:ovn-ofctrl-wait-before-clear
+                     The time, in milliseconds, to wait before clearing  flows
+                     in  OVS  after  OpenFlow  connection/reconnection  during
+                     ovn-controller initialization. The purpose of  this  wait
+                     is  to  give  time  for ovn-controller to compute the new
+                     flows before clearing existing ones, to avoid data  plane
+                     down  time during ovn-controller restart/upgrade at large
+                     scale environments where recomputing the flows takes more
+                     than a few seconds or even longer. It  is  difficult  for
+                     ovn-controller  to determine when the new flows computing
+                     is completed, because of the dynamics in the cloud  enviā€
+                     ronments, which is why this configuration is provided for
+                     users to adjust based on the scale of the environment. By
+                     default,  it  is  0,  which means clearing existing flows
+                     without waiting. Not setting the value, or setting it too
+                     small, may result in data  plane  down  time  during  upā€
+                     grade/restart, while setting it too big may result in unā€
+                     necessary  extra  control  plane  latency of applying new
+                     changes of CMS during upgrade/restart. In most  cases,  a
+                     slightly  bigger  value is not harmful, because the extra
+                     control plane latency happens only once during the  Openā€
+                     Flow  connection.  To get a reasonable range of the value
+                     setting, it is recommended to run the below commands on a
+                     node in the target environment and then set this configuā€
+                     ration to twice the value of Maximum shown in the  output
+                     of the second command.
+
+                     ā€¢      ovn-appctl -t ovn-controller inc-engine/recompute
+
+                     ā€¢      ovn-appctl    -t   ovn-controller   stopwatch/show
+                            flow-generation
+
+              external_ids:ovn-enable-lflow-cache
+                     The boolean flag indicates if ovn-controller  should  enā€
+                     able/disable  the  logical  flow  in-memory cache it uses
+                     when processing Southbound database logical flow changes.
+                     By default caching is enabled.
+
+              external_ids:ovn-limit-lflow-cache
+                     When used, this configuration value determines the  maxiā€
+                     mum  number  of logical flow cache entries ovn-controller
+                     may create when the logical flow cache is enabled. By deā€
+                     fault the size of the cache is unlimited.
+
+              external_ids:ovn-memlimit-lflow-cache-kb
+                     When used, this configuration value determines the  maxiā€
+                     mum size of the logical flow cache (in KB) ovn-controller
+                     may create when the logical flow cache is enabled. By deā€
+                     fault the size of the cache is unlimited.
+
+              external_ids:ovn-trim-limit-lflow-cache
+                     When used, this configuration value sets the minimum numā€
+                     ber  of  entries  in the logical flow cache starting with
+                     which automatic memory trimming is performed. By  default
+                     this is set to 10000 entries.
+
+              external_ids:ovn-trim-wmark-perc-lflow-cache
+                     When  used,  this configuration value sets the percentage
+                     from the high watermark number of entries in the  logical
+                     flow  cache under which automatic memory trimming is perā€
+                     formed. E.g., if the trim watermark percentage is set  to
+                     50%, automatic memory trimming happens only when the numā€
+                     ber  of entries in the logical flow cache gets reduced to
+                     less than half of the last measured  high  watermark.  By
+                     default this is set to 50.
+
+              external_ids:ovn-trim-timeout-ms
+                     When  used,  this configuration value specifies the time,
+                     in milliseconds, since the last logical flow cache operaā€
+                     tion after which ovn-controller performs memory  trimming
+                     regardless of how many entries there are in the cache. By
+                     default this is set to 30000 (30 seconds).
+
+              external_ids:ovn-set-local-ip
+                     The  boolean flag indicates if ovn-controller when create
+                     tunnel ports should set local_ip parameter. Can be  heplā€
+                     ful  to  pin source outer IP for the tunnel when multiple
+                     interfaces are used on the host for overlay traffic. This
+                     is also useful when running multiple  ovn-controller  inā€
+                     stances  on  the same chassis, in which case this setting
+                     will guarantee that their tunnel ports have  unique  conā€
+                     figuration and can exist in parallel.
+
+              external_ids:garp-max-timeout-sec
+                     When used, this configuration value specifies the maximum
+                     timeout (in seconds) between two consecutive GARP packets
+                     sent  by  ovn-controller. ovn-controller by default sends
+                     just 4 GARP packets with an exponential backoff  timeout.
+                     Setting  external_ids:garp-max-timeout-sec  allows to cap
+                     for the exponential backoff  used  by  ovn-controller  to
+                     send GARPs packets.
+
+       Most  of  configuration options listed above can also be set for a parā€
+       ticular chassis name (see  external_ids:system-id   for  more  informaā€
+       tion).  This  can  be achieved by setting external_ids:option-[chassis]
+       instead of external_ids:option. For example,  set  external_ids:ovn-enā€ā€
+       cap-ip-otherhv  to  use  a particular IP address for the controller inā€
+       stance named otherhv. Name specific configuration options always  overā€
+       ride any global options set in the database.
+
+       Chassis-specific configuration options in the database plus the ability
+       to configure the chassis name to use via the system-id-override file or
+       command  line  allows  to  run  multiple  ovn-controller instances with
+       unique chassis names on the same host using the same vswitchd instance.
+       This may be useful when running a hybrid setup with more than  one  CMS
+       managing  ports  on the host, or to use different datapath types on the
+       same host. Make sure you also  set  external_ids:ovn-set-local-ip  when
+       using such configuration. Also note that this ability is highly experiā€
+       mental  and  has  known limitations (for example, stateful ACLs are not
+       supported). Use at your own risk.
+
+       ovn-controller reads the following values from the  Open_vSwitch  dataā€
+       base of the local OVS instance:
+
+              datapath-type from Bridge table
+                     This  value is read from local OVS integration bridge row
+                     of Bridge table and populated  in  other_config:datapath-
+                     type of the Chassis table in the OVN_Southbound database.
+
+              iface-types from Open_vSwitch table
+                     This  value  is  populated in external_ids:iface-types of
+                     the Chassis table in the OVN_Southbound database.
+
+              private_key, certificate, ca_cert, and bootstrap_ca_cert from
+              SSL table
+                     These values provide the SSL configuration used for  conā€
+                     necting to the OVN southbound database server when an SSL
+                     connection  type  is  configured via external_ids:ovn-reā€ā€
+                     mote. Note that this SSL configuration can also  be  proā€
+                     vided  via command-line options, the configuration in the
+                     database takes precedence if both are present.
+
+OPEN VSWITCH DATABASE USAGE
+       ovn-controller uses a number of external_ids keys in the  Open  vSwitch
+       database  to  keep track of ports and interfaces. For proper operation,
+       users should not change or clear these keys:
+
+              external_ids:ovn-chassis-id in the Port table
+                     The presence of this key identifies a tunnel port  within
+                     the  integration  bridge as one created by ovn-controller
+                     to reach a remote chassis. Its value is the chassis ID of
+                     the remote chassis.
+
+              external_ids:ct-zone-* in the Bridge table
+                     Logical ports and gateway routers are assigned a  connecā€
+                     tion  tracking  zone  by ovn-controller for stateful serā€
+                     vices. To keep state across restarts  of  ovn-controller,
+                     these  keys are stored in the integration bridgeā€™s Bridge
+                     table. The name contains a prefix of ct-zone- followed by
+                     the name of the logical port  or  gateway  routerā€™s  zone
+                     key.  The value for this key identifies the zone used for
+                     this port.
+
+              external_ids:ovn-localnet-port in the Port table
+                     The presence of this key identifies a patch port  as  one
+                     created  by  ovn-controller  to  connect  the integration
+                     bridge and another bridge to implement a localnet logical
+                     port. Its value is the name of the logical port with type
+                     set to localnet that  the  port  implements.  See  exterā€ā€
+                     nal_ids:ovn-bridge-mappings, above, for more information.
+
+                     Each  localnet  logical  port is implemented as a pair of
+                     patch ports, one in the integration bridge, one in a difā€
+                     ferent  bridge,  with  the  same  external_ids:ovn-localā€ā€
+                     net-port value.
+
+              external_ids:ovn-l2gateway-port in the Port table
+                     The  presence  of this key identifies a patch port as one
+                     created by  ovn-controller  to  connect  the  integration
+                     bridge  and another bridge to implement a l2gateway logiā€
+                     cal port. Its value is the name of the logical port  with
+                     type  set  to l2gateway that the port implements. See exā€ā€
+                     ternal_ids:ovn-bridge-mappings, above, for more  informaā€
+                     tion.
+
+                     Each  l2gateway  logical port is implemented as a pair of
+                     patch ports, one in the integration bridge, one in a difā€
+                     ferent bridge,  with  the  same  external_ids:ovn-l2gateā€ā€
+                     way-port value.
+
+              external-ids:ovn-l3gateway-port in the Port table
+                     This  key  identifies  a  patch  port  as  one created by
+                     ovn-controller to implement a l3gateway logical port. Its
+                     value is the name of the logical port with  type  set  to
+                     l3gateway.  This patch port is similar to the OVN logical
+                     patch port, except that l3gateway port can only be  bound
+                     to a particular chassis.
+
+              external-ids:ovn-logical-patch-port in the Port table
+                     This  key  identifies  a  patch  port  as  one created by
+                     ovn-controller to implement an  OVN  logical  patch  port
+                     within  the  integration bridge. Its value is the name of
+                     the OVN logical patch port that it implements.
+
+              external-ids:ovn-startup-ts in the Bridge table
+                     This key represents the timestamp  (in  milliseconds)  at
+                     which ovn-controller process was started.
+
+              external-ids:ovn-nb-cfg in the Bridge table
+                     This   key   represents   the   last   known   OVN_Southā€ā€
+                     bound.SB_Global.nb_cfg value for  which  all  flows  have
+                     been successfully installed in OVS.
+
+              external-ids:ovn-nb-cfg-ts in the Bridge table
+                     This  key  represents  the timestamp (in milliseconds) of
+                     the last known OVN_Southbound.SB_Global.nb_cfg value  for
+                     which all flows have been successfully installed in OVS.
+
+              external_ids:ovn-installed and external_ids:ovn-installed-ts in
+              the Interface table
+                     This key is set after all openflow operations correspondā€
+                     ing  to  the  OVS  interface  have been processed by ovs-
+                     vswitchd. At the same time a timestamp,  in  milliseconds
+                     since   the  epoch,  is  stored  in  external_ids:ovn-inā€ā€
+                     stalled-ts.
+
+OVN SOUTHBOUND DATABASE USAGE
+       ovn-controller reads from much of the OVN_Southbound database to  guide
+       its operation. ovn-controller also writes to the following tables:
+
+              Chassis
+                     Upon  startup, ovn-controller creates a row in this table
+                     to represent its own chassis. Upon graceful  termination,
+                     e.g.  with  ovs-appctl  -t  ovn-controller  exit (but not
+                     SIGTERM), ovn-controller removes its row.
+
+              Encap  Upon startup, ovn-controller creates a  row  or  rows  in
+                     this  table  that  represent the tunnel encapsulations by
+                     which its chassis can be reached, and points its  Chassis
+                     row  to  them.  Upon graceful termination, ovn-controller
+                     removes these rows.
+
+              Port_Binding
+                     At runtime, ovn-controller sets the  chassis  columns  of
+                     ports  that  are  resident on its chassis to point to its
+                     Chassis row, and, conversely, clears the  chassis  column
+                     of  ports that point to its Chassis row but are no longer
+                     resident on its chassis. The chassis column  has  a  weak
+                     reference  type,  so when ovn-controller gracefully exits
+                     and removes its Chassis row, the database server automatā€
+                     ically clears any remaining references to that row.
+
+              MAC_Binding
+                     At runtime, ovn-controller updates the MAC_Binding  table
+                     as  instructed  by  put_arp  and  put_nd logical actions.
+                     These changes persist beyond  the  lifetime  of  ovn-conā€ā€
+                     troller.
+
+RUNTIME MANAGEMENT COMMANDS
+       ovs-appctl  can  send commands to a running ovn-controller process. The
+       currently supported commands are described below.
+
+              exit   Causes ovn-controller to gracefully terminate.
+
+              ct-zone-list
+                     Lists each local logical port and its connection tracking
+                     zone.
+
+              meter-table-list
+                     Lists each meter table entry and its local meter id.
+
+              group-table-list
+                     Lists each group table entry and its local group id.
+
+              inject-pkt microflow
+                     Injects microflow into the  connected  Open  vSwitch  inā€
+                     stance.  microflow  must  contain an ingress logical port
+                     (inport argument) that is present on the Open vSwitch inā€
+                     stance.
+
+                     The microflow argument describes the  packet  whose  forā€
+                     warding is to be simulated, in the syntax of an OVN logiā€
+                     cal  expression,  as  described  in ovn-sb(5), to express
+                     constraints. The parser  understands  prerequisites;  for
+                     example, if the expression refers to ip4.src, there is no
+                     need to explicitly state ip4 or eth.type == 0x800.
+
+              connection-status
+                     Show OVN SBDB connection status for the chassis.
+
+              recompute
+                     Trigger  a full compute iteration in ovn-controller based
+                     on the contents of the Southbound database and local  OVS
+                     database.
+
+                     This  command  is  intended to use only in the event of a
+                     bug in the  incremental  processing  engine  in  ovn-conā€ā€
+                     troller to avoid inconsistent states. It should therefore
+                     be used with care as full recomputes are cpu intensive.
+
+              sb-cluster-state-reset
+                     Reset  southbound  database cluster status when databases
+                     are destroyed and rebuilt.
+
+                     If all databases in a clustered southbound  database  are
+                     removed from disk, then the stored index of all databases
+                     will  be reset to zero. This will cause ovn-controller to
+                     be unable to read or write to  the  southbound  database,
+                     because  it will always detect the data as stale. In such
+                     a case, run this command so that ovn-controller will  reā€
+                     set  its  local  index  so  that it can interact with the
+                     southbound database again.
+
+              debug/delay-nb-cfg-report seconds
+                     This command is used to delay ovn-controller updating the
+                     nb_cfg back to OVN_Southbound database.  This  is  useful
+                     when  ovn-nbctl  --wait=hv  is used to measure end-to-end
+                     latency in a large scale  environment.  See  ovn-nbctl(8)
+                     for more details.
+
+              lflow-cache/flush
+                     Flushes the ovn-controller logical flow cache.
+
+              lflow-cache/show-stats
+                     Displays logical flow cache statistics: enabled/disabled,
+                     per cache type entry counts.
+
+              inc-engine/show-stats
+                     Display  ovn-controller  engine counters. For each engine
+                     node the following counters have been added:
+
+                     ā€¢      recompute
+
+                     ā€¢      compute
+
+                     ā€¢      abort
+
+              inc-engine/show-stats engine_node_name counter_name
+                     Display the  ovn-controller  engine  counter(s)  for  the
+                     specified  engine_node_name. counter_name is optional and
+                     can be one of recompute, compute or abort.
+
+              inc-engine/clear-stats
+                     Reset ovn-controller engine counters.
+
+OVN 23.06.3                     ovn-controller               ovn-controller(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-controller.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-controller.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b8a07aacc5c26a652ee446e29dc6e71f2c6561c8 GIT binary patch literal 59375 zcma&sQ*%#I`Z9ZQB#uwr$(C{mrx2{@#=4WFJ*^b*-wC?p}5E z{UcKl5u;y7q=KZ$-A)Ukj&Xbc@5L8tb{WnucP(@gRkj_a&R83M?l-J(a z)XmYt+2r4dle4j%i!(3(zplKCv%QP6n1!{;e=h$|JHfCLG7{PuTEg(~FvytLnmL;j zvi%!TV)(a;vxy@igP65}vx$g_k)5##A0Ld9v!jWD4a}dcCan#}jZtLp74^xD04n6j zwq3O{p4Ix5q9ip(+Ukbz#^eA21raz9Z6MUtH;5DE$JnzRSW_S+Ep=)t^)&$S23j?|$MIRZ;E_lRGmF#wFN@!Po$R zVypuFCkOPHq3`jQ=h#=&=I%NG?u!y;iPyjL{Vn4&ZKx>;`D`1 z#q>-TOLnO_slUqyd;iJ_S*#U0{Xv4y;mdS2JH#i=v1>l|Ci*I0Ysh*OL=TK9UD?&z z`Q*LvL}{-}CIRjg6==w4khJDzCInC0%b(5K#O`+Qkqr%6xgd z@5{$@oe%ksDa>zZzNHCw_Wf{H9g$@}L-DcSR*ZQAOCfn8ItQA~bH@?xF%TD7X+n1znh9g?gOY}PXyF_id{8Z=ybTPxW*R3P zgx#5swS}d>Y*>qufT6JznUzeFtRAF!xyvJ_>;g=w_?*#!YxB z#xnU88Kd2F#L!0TLpQ-7ZyKvMwB!`|SmtX_!0y^eO}QcqFl&*hr(E(RpkD=rs$%Ga4TFU3Nf&jD40L0`V_a!n@vR8KZBqAIBQ1zHhH2gjmDw3K+xe_yV*;`6}B2fr{lD)O#^J?w<&YNNELwpHF zqQbE(SO-2AFOV*%?LRGdRPKd<`K7k>c^q#YQ9XeVixyk%?nUeOxNOtlsokT3=?)@# z-Nf@&bB7`LZt=-k?8JZQZ^WevfNV}-#V6D=b6KkFJ*Zl&8!+PlH zs>V*NOdVDmg1Yre(t^3|V_K~kJNBzJR_Jllg-%wxr-*QuO-;n?6&#AI$?@GIZ&8lQ ze7`uT7L8S3f5^j36-{k90@XjxS4fs-kPp5+0}AC`3}U=J-&O;*H_n3V|HJ!4^eb}7 zRo!C*hvvBIi)mEgcNW(W!#8vhokoDij_FCX%38}p)c{fFP13VVvkB;t=giE8<6Bb( zl#fJAZ_b4+OthlieTl;Xh-`GXy`=%0GxaZW+}-dJ{PCVy!tPO5ykZuAG=WB5TtbQZ zL$Y4@JHq*Tou%B^ml1Mirto8%-|Rmqi~XRds0EOv>mX~UF}o4j6l^HsgR9UbBqGFM8S!CxA zOh<2R4s%jrhF3BXC8GATdaj{o z#iF=!7mU73 zl}6`LJ&OIOC`*-CMKb>eSe`#2<Aw)-%Kh|2$p(R^ zAzBjZOX&oNa{eL+z~D=DSqZEVqh&ooVuSE*z{^?vB8ojzuv5`g6B|9C5mv!YIjF)KXzx%MwBbg(C>5+20zKQZ@ei?a3m@jBA?wUpFVhKW4R*MMOe%h5 zFB__G zoTx#$+G$34Yc5q!9-nA%^pJKM=w|9Ho9LOU zzSUHw>ZVG@k0lBi%*TDgU-N{J5)2@l{|$2Li5d}zy`U$3BT0<6ZliV3J4J@S?6vYJ zLN=|lpJ)#+_idxO?S|X`3Y&ShQdrjll?VnyoKhW;LRa4fOdl$Y4kWW-UKQ9F1bW&% zZ-s62bxlTWY)l~9ZTn!6@7xB>TjW7zXS+XQ7Q1-fgWpD)CU9}tUE^|bo|j_Hyp zZb~-7vGOnm?6ko#-u4bYEW)y?zh82DRHmvPI&X&<$+*5gXQKul2pCErBz}B8Kw572 zy>e)8%fX#;0zzOaJ40E0x?f)tQ;H0jQ} zh;0De^H!C!dD%GPF@}1XSr$)+XrT!U8$qWU^m5a>joycQ3&d(&C_`(E$PARGB~P_} zT48CCjZ4>HX8;opHNa>kU=0cBWeSS0V$OlFfAaJgD$5tDv&hPPemMW=%}fBMUqbIt3mL0 z3EVs#2W+DIGQx=x-t@Rk%rWoZ*=>@Cl|txo$T{H{Pjkc15`<_SU1JEC>J58Q(uU4H zm=TaV%g9;N@?03+Wb&I#+zpMo_AUy_W8%*9@4;p3LvM|_QFBlNM3-Qu0l9>-+Y?04 z)+}P7^*I7z7JIo$b*AN7S?n`VJpD75g-AJh#&m_=5^`?=O3*&{{wfV%~9gDAGtlF>{x5MWYo^<{U15a1~YMDi`Ux?H%j$LCugxQsc!k?9Re z91_JTPu>U1yO=Bd^j%(MHt}-3k0Fm<}%LDl}P{zEzRY5EB;5 z=#q|u>ke5`%W7}={;do&aa|EK4o_`bctp@Y19mS1&OpBB{zsx>1f>ShGHndymfuCo zHM=4aHM@;1C+}56?dW@$;t1v; zm8TrS3g3#?4`VJQkU;e|3O(VYTy5D}6p0r=!y$UK0zVw$7DdAoxm*6PuOl#%s@kpr z68`dS83&G(hJ5OFeWhLu)pn9bdM%gog#?cZoey98mkhTj{BgSLJ0`Zq|0}hBz5nR$ zKc@Rn%L3rwfcf7srvIiN)BnkSQ(Dqa8)Cn@FVrV(`sgeJ`f$p|1>>)%uhvu4O*xy$ zinNiSlve$KK>d`Qr@TgqJGig837oj&~!K(Zgcj@*PK7Qa=0_LAi=> zlKKvGL|sAuWIn-xxTPOmxxDHDoH_|Fo}Ls0Q{xGugGzxu{UhHxVUpj5dqBXj}|gRVkJuc z87F>4BgK*4RZ}@UgXVn!wKTfti?Tp{r*0o_O2JK;_w&cS^S{Ynh@0uIiPrj^+_Ax> z>M-u8fL1-fCuc<7>8aa0ly;4DZL?GL0YbbL@3Z2F5ogks0d6jv@rNc19Sn$-Y@nI? z!fv;;Jvo(XsFu9o(bpP1r2|0oSCAH2WDP@LJe2&rFvdgdV0PwLa;XJv#J4SboXL(& zi%SQ2rY$B@b=(dQbRZ9q6X-z&q1b{aFE5`;mg5*@yj`A#rx>~|w9-3(a@A%GR#!hcj9APo6q!4(fA z7!k}wf%x=CJP%BU-kDePg%F3?bk$~;h9ZmgGK71D5cI$d^ z{k(tQf95W{nx$2|Iql6X(5fSgaT4s%cYpu6yPH~>v8yqy6DelEII-jBMjmON@*?|a zPWU1WtcS7j8x<`RxK=AxyZkju7;IE^IQQ!h3ElvXB|P6*q$8>%*r`&~P&4LD9_y9V zYagQt)cP(^W`-q)azq{~X3jNaoYpp-C@j1qBxylXNO(y0Ti_O>_W^QP?xO?@54jS) zf5AOCT-t7cthef#Yyp^+?FGcQCcM);dZyIj^&qPGtD<2MP{{S=RA^+Z90I9||LJCY zyg#$U@%ZcA_%Y;cc2W=hOjH%J>d1EKs4z|h>!yF>Ok^3cpUWi2wE!Er0NMTI)Nn-u zmP+|c;#N-dEC8fdQM8lsooPIcVD%E&QnlkLKFLkAqgo^#ZG&#U9y+f!ZjLmYFrom0 ztr!Tf2xJw<*VcmF7P0>wW!lzGP-AO@+&hwXwu;ETQB`JP0Ywc&ra`On$^o<}MFEsR z_4z7!E0K{7q1GZj4Vph`$R10KK#XF5p5GVt5l5_AHoa*Hk~cSkN0fyM`2 z?H0jiIB^TvmkX;LurJF-4?qrl(Wg2Onsr`q3Q&b|ilaD4?%uUSRnrB5^irak2HOuo zxBPv; zQ>wLHoec#ll{ubzlq1|S?h@dhx*PtTk6-?_c%}$Kns6lEKmp{K1PKF2)v8{L{g>)* z8MuwN-(v80GV|@wFAcdSI(xo-p3oU1(EEn^4QrS;U-(dDxM^)UnTQX2G;36_EIF5-k-^rIQ#)nfT?WV43Lm}Mua}KqDP?4}K z9w7mMw##v{P4hy-|Jq`ET{l2LUhjpYWd=#01T&&Y^Z3grpk_;b`3LqPV}2fSBi8nJ zr>Kzg9RzPF^iKrb6c*CxCdBa$-plzZd@LyC87VnxI@5{?1ry`grhMbVM!wZwG^%@3 z966zm9nXhpkyC%qMg;txkWeFz zqxQIA451ZjXW^A1D01PI@k?L^Wzx8Cl~r2tL+jRelbxPOZu9ai;Yu@dEwq8riN+zn zxJTAQK*8TaemFR+nF#FJJfLyFjo>Z3%s1QbF0ZsreVpnXFHmqTh(8`1E5(A+B=JQB z7F_-yEvwW|+oUM6;Z;-SrNkLDP88@#xdACdm#~5llVqiOcj0y5r^}W6E_a~dl2I7# zFgzy`xYn+L6^U$vl&QCjlVuVr5=D}Jw=At~VZNftM}9~zhYo{FjvND8Ynp-+Mwclw zh^o?*rwA=2ViX2Z;M~tKsKEqwV4};VG7Tax4wbZ~_aaP@W?a+%OylubhHA|sb z(E%b!S*GTpS_eXqD95^;nVxl&o;!QUTDwxECRZ5Rw$C{kczV90hU1nGnizPk%8+%n zrGpeFGr)*|*Ie-8_W{fK)pA`;;U{xHumWAafwmJ0!tlVw+TRDq609y`Rk#k;C8%W& z)@76-Dp{P?^;acy2*;LemOErG9e9a~?lI&TBh(}Ks1VgS#IVK}tjC{6#PpayCOFB< z54c2wByyids6NM#+AuEH6h&}7sjSx3zK;052t^K*9w8UuI$SZN=H4awp{OB^aF%KL zns3TD`0=n>S9tn@71fZSpDN{QxL$<*iBT5cK9go#?Kj#h@KoV0*~@LdlFm~V)*BlE zIf5I+q|qrF1j~yQO+Zd&xxPIoXheJi%cSKP>Je zrt%JWpaVi52K!P}*U}+CSMnQO^yE{zG>8PhW*~KYtnI&3iyV4UETjr=O~(D5V0RKb z?BSZKN;oAS^2j&8eu9qOAH?($fyov=d}nTfrV~Vt@3%znCPbJ6`zM}as@F3D;Pi== zUjVPGO;&TDG3&@t3*9~~o*w$571N&H zyM6JNZhp7=tgQyJIEfq&piR&qum9vfN(%`l}zHlNR=@NZVbldjes9b$; ziqBJn_WDb}+sfj_mNlPe2sv!e8u;(wBm_?1H1d4l0hc=ec$?V-RcVVfZvI74L0)I@pRj5 z%!}|Bm(lB)O0_;N^{j#dHqADZui=kP))!b?I1d+q&pa4w%889qs#FHgUWw^xSx zOdP@{IVz`KkJ!)Vwm@ccj)E5!F|7B#Zevk|4YyR!{YzpGY1pn|Kl^~ ze^pMI8UHV((<;pk$IW46@12@7b|d9YB2#<$am1Lv5y_|MP9_whZQ8>6uHohw8hiDJ zd>_d@{k}3U+KfOF5sqX<)W1O>Sa`QeeWh-PJQ`*Rm=f$0f`~M4Fm%1OtA9WU%PovJinH8DGS2g@ATD&smwG@b$`ln`%yBOI4p)*@3Eo_WZte+ z$*NuJ$@F)cE1UmTgcH`1k=3v-pkRSwKG~aq6ycs^jLT zXUQ<(k>mA`Z9aLr-POpRu^s~%r{zJM!W^W6#}n%Eu-XyD?q2Q{gG-YmlDm%lnp_vj z9|(xKevDZVDCTRpIhjQ$h^j~JBv??xVYIc`tAoX(e zO_>86E}OZqeqb9yDx`106F5!@tr@v>K2DFD^b+Fw9I6U&N(aZXoR1JSq@y0t+ou;$ zcGOqT`pCews!_ZgyK?cGiUGqJe)sOh>RIfx;I$=)_(K`uF8GZkqCS-SFl7GnlhySl zETF`;KgB9LM}Put84>XeOIalv0ybgjxM)vf(t`QBXJ3*!S%4ej5neaZAz-?eWvT&P zn)_F8gF+t=seGZATXOCrAhyCve+cLoM}o5Fvo>*Uw+ICb^cxXOXv1Tc6=M0@wBpi3 zGh0!U|Mr7Q4wm|L zwe|1GeK~SVJV(aqa63}1zDpB1gNsGJZLH$=8?nVAMV7^SIQIz>mrJB&J_=F9xA1LJ zLTOy{adw6xzw3RM-FZtit2jgohElR^v?}m!J*&WVkQmxgjq7~Ga!N(m-?f=JU= zEweg20IjyF%Wz&PP);Fa{H;tu7>jvnx#j9sv3ax*w?+dRIn34Ow~QFw*)c>o20b8V z@5y&Krx=q2Dvvk8MuFoN#tx>C!37BpFEVxw5a>Ou4g@ZvIJpCQUGn|zbcYw(HUVwQ z!cb6|bLV@B(eN_GHU&R}_s>C_i@nkPi9~(UO+vG{_jv+KY#^BRQg&T2%2K{B1c8y-@6B;z8KO2KvB$aWow!AQ&4O>m z24@8S;ox02PeTX8msiF(WQVhY3^dnTUHS!rTz*NORUES|&pu9(#Z0j@ICc*V)%>ie!bnIU4nhPA z_y$JPCy>%}EcbLQT$CB)*i<~C$L1eYrT{xB6;sBLo(Ax0v0;WPw^>ws=B1JDZJs37 z#&EC*$4}*uK^|EZw#=C$@myc0Ej|l0x{X4$<||ceOu59f{{hd1M9v)tR{fFG^oKzP zU#j2R7|rLHYy;Ne=&k1AL8_EIAKYQ55~kdX)6-kh#aq-CD~ys~1AlJ@?lM>7DM*b+ zDNGW}Peh`v2P!yBH97SZzPJ1`i0CsIL`0!oTQ{J=SjBD&l3?ZI1tqJqx+u9z3Z_;= z+yl$$_rAA)c756@?BVbSP(7}D*+2S;Tskp7;&V=gZ>wn z_$e~`iuNdo&F@!DGvTY>Es4wcyL@U+ zf6%zT75SfkKRsTq1u%hS2g=|J5T>hNN~IpUsX9DwKM)mwGYw5{23C0*`T?@n@3rTJClDaJOE~)2MVj zvO5WY-vGI%eyC4dlgGYI-lwvLqj9|i!M_eOa!$;LgQ_FE{yeEgzu0TTP8MVeNp9k` z(Mu>ku7adw6hYw|F(K>2J^=J5?0Xj#1el!yu+Rl!ADj@)G=N2LWZuy&en05O} z&4?(HTV6HY`%b+#z!hgEy&E6<#$ooA@!oNHgV}n-!#2i$d;#D5 zVcBI?qQL*b>Pulw86*2g{C&#f6)57z90qNu{f=?I_-x~P*q(R9qUTJ(zc&iY!8mIl z@pGWp!6Oxg?4s_#D~H)F!4@lyM926Fs*bMZU!LjwujC>fQWvmKk^&n8ab7|)>f2%0 z>)wLWfJnYD2q&m?$K_m*m$J~2*l@@Nek$CcLEx6F1q7P>$!w%1g6QlwJZefLMZ;(% zj!C>iI6#`{)-|I&3swFQnY2jj7|@Mn%p>o>;DgDHMkSW)JdGUF7Y9`Qm!@U6D{K{iYk(aHSWhU6Jj2@W*mZxK>ilcjy$R`+~iFS@T~`pNrka3ne# zI8kBL#-@@OHgrucw=i?yIaSI!MPkYuv?A@l*hG1oU*iszOOfF>XT_d~e9elm)u2@;%YJUZvk`zB~`tYuYo-U;Pl zpR=C*Z(bLD0a@GgT||1JI%NqNK^bgZQ=U%;#}vf8Wg3?rOOA1<(F#;F$iAR#?8|vAWE$B%AA*?s9^|WKTPgh zo(#S6CB#M2-sGC)NZnIA-E8>k4{Tav zn(*8`$oT#WLY8kx+v3x8zv;UC3g{~A3jCL7{B^lmla9o8#?ik0k-aD5Zo`TNDexs91+*1PXJTcXqKQ?&I!@l z%XGy@evj!u@wH|L!FjVmX2Hl#!qbo(bDLIJ*okI_JB=nn1{0A(%0xg0Gv7!OK*)7u<&yjn2Ncp=J`5WexUup7Q_7gQnc$H{j2a?g7kyNZ-h zk@Kn39%MML&hxmrK@#Dlqm^T>vR@)yhO53Ka$L9Ku6KaND098yah&CEvpc|v!!B&Y z6NUTQtgbs|#7C8J?33$6gh5=#S8qs4(~Gd;MYLX*@n5H}Hd=@=HJuLSSUX!EeNU?7 zp%l&G2E}b!bZXAsN{`dElWKxR$H70K6!9pL#Q~sZOuvFw2c>X#^CN(61nadnxc^dU zU_3|!EsqY=LJg#a`mZ1q8U)XLQOel>OiUTVwg@e$pAX#ZR!^!9FP~tDnZeY3DW%t5 zDh8f2a^iTCoCUER;vv*HM}zJ2y3X;~$_)~(P%7G8YoZ(r3@D}ot)5DnbOug&;rQ4i z?)mT@0)bPvfI~V`D>-Jxg=G;+SHDnbit*1bTnY(tJ*`%8Jr1Nb?}k=TZ_>H^2Dms5 zp5@)PuSnaFbo~hV;k)ENnp3-+oXg>ar(1rmiviUl2gkebss5_d|92iL94gCxO@Se>-&*Es#Y3)Z|(7cd%cF zFBNM{6(>B_RJveh+J=DWKMHU(xT{BgYtTo2EXz*&|hN<9}SKb%GanF~$A*?rp zOoT+#(iGXT>EYaqbXdxZz;tfl6cJ4Hg7WeWCt(EAzS$|-nCp{$%QMM9e8vKFez$N> zo{%)KEPeH-3I6RqeLe*wABAQvyQDV4-ao*TvrPGcx&u!6D_!~(pq#$Hb!npM8}a}H zOK_{mq+qHrsN5gxt`Ua`U=TS?Ly`iKK^;Z4&f=ZCW1x*XW{TA{_o|!&j zl1LBRyz!j<%HX%6Ty`KBvxuaKK!Gla+KNuyht@!K9vx7b5D-+=$A@ba&f+LXlbolu zO7||=A3;=;6X--zqaq|?^?gn_1@tP_p;VT*h2a|g!-ZZcwgkFS*TL;3FkS4iDF?gHmg(G+00Yy3p_IJ7mG&HuThdw@IS9BbBYhVaQ;X}jilSF z=<4uBJI7eoD@j3_XGNFAw95BOW6Dcd5_R|KZ6Q#tT$`xR!l0sQqW|HC^i|b}w4sPR zhxT$56AqI-6ynH}!BvTo1D_<%ueG#`A}~Z<;=m8wn0YLr0E0owPmr;!<>%xRSU+*K z!p+6Pk9vq4O1R~H30~o;a}*+hX0ySJJ!zggkzyl5+iPe<=a~j%-U|~4Ei*hNQ4AaC zKa>-HGx1FEi3UI#HQwJuzdic&GJ|cHGd>(hU}924}8ap6%22D9%{I~kdmX&% z(V>|m9+d3O%d@s|G=e#AY@x^Cyy#`BKlwG+sTsN0w@l<3A)1p$dNS`SLD{zJRCsB=wEAgIpxQL z5+ZYE`mzQmO(xqbi4{)gzeT9-o*m7)$}dFkW2QXf@q-c|wGooug>3yr0k^^yRBB

ZwEa zyHDjY1(WhSLj=+3=~6_6W=GDgWr?k##tPcpjbNE|2z z&kZn5zMQD;PEDrg^#S9LEh@1+E+zoYs$Ux#ARD}kvp4Hn`pe>ZQ*?vznSRwL)En|; zk@(nCpoK2lhBy3LN0m`a<|Q4?@_S+jT$sjsr=4hv1pK(>VOV95^EHyBMSgw60XLhh z4-Ywsu~?1eIpeGoGLH3`5XW6gIliGS^Bx)C#W-uvd=8hGrEzB=T_a{}O02(Yg8UJt zYZ`w&L=`6sdyq}R56{R1tz*r!g|FF*ehKCN~`5j5pSLZ%9~y$&#%HB?3R(Uqc)# zqBTOD+NMP z#AYX~?SY!_s9dGNUEN;gw<1ZE=ui=Tn&W3QxT@X|)5%dhtgDR3)d|5U5%Z?vTMP$} z21vj8?Gis#LOYzGs@%kBAQA8vP>N`XW?4y!jbY=l)n_QqexH^HV4gh z#v*tZhrsg{|IAh&8|^tb5^SW01DE!hBrwsvi7?C2M)M%zH42sTEaXW%)NmeXi45M) z2hk68CkS)y$pSDMV6vFIdBol8p1Ig4e8jfwK{M*Nh#V`9nr&q!u3+!iPObGY3n~*7 z7vy#P!U7K$6Jl6pPkR-}ED!~Y&Qd&Ckv;R7SK$iCA>~aG0sOBlvMK%|Quv+$fw!cy zX8IraQK#<#kOqy`lW{*iAEzMmz!tyEKPXS8(DaqDn)F<<&S7Gq09oXD&}UxfS96xq z=vBZyt2DZl;W*Ch&if5$imE~#=aH(nh&h`|HSe>ybKhzgCo?7Agsx;*(G|=tnDeT2 z6%gro43+Ry^O*^)rNu`OWA)WkI;C3v1a8Os#=^-~^K>RYN$0j_osz$xVcZR~eRlAO zBHM^3dAE|u|Q zQO?rPQ)koCdUWAX#mg&O<>rceXQweMo9)Q>DNr))=hO(o(q8o{Loh)$2S~;i(+zck zrpgD-?OZN~t7qBFhfx*Jp-)=R1DMMgrCd=bzVYSC(DZ=BJ3-qCSze$U1di6eIpcO<8W+3L+v{s_eAeZ`Im9@&aF9ZQHVqy zu-$%02}bFSB%K}>(#;YTh_6CkK`o0*GQMKx$YuU%EqNzb%BUOB)Hfik6LocSSt?U5 ziSVuMJ)zCxKmIworq@Sw^WAiKqG9==al5>!=pgHAqQ2?=CM$xhn99~2)TGwH7PW5b zcxXQ`e6q6+cyZ+a7jf+WS0%sBUZJ0;#`_RO{Q!=2s)BpU9`B8x$^9{wWJqymyCf z(mbCB!hmG;&Pz&JfLn(a&)?oP~*F|X)P6*!gI%B6Z*-x zuZ{0%Gxw>hKES>e0J&Y~t^MNiL`YC!Nc%k0>Ww?&>28v{E=jras+dIcQrY~}Yu^-$ z7}||#r4i)o=K216?)CC11m3aJjIp-php~gd@Jq8rk$?G$a?BdojJ(bPXnOX}oe{?h zcCF0Tnf7vHnmmUlbKBiYvZTIFxdZ3Icqj(eU{enOSyqYDGOb(Rc{Lo_cmAFl$DJC% z_#&FXgZ8jF^r1MCS>lspCLe;MG0^~MX*mkx(Mi27xmT&&n0W?=mh}$CU~H}pRfcpPGRqe|L%=M z!A{j<3uV#I&hFMxLU8eh87p(wbZL%t~&Ep zjBrZbI57Q<70s*nm;357{!+LkrQ3wBJRcvB>xW09S>D>G2@Xr^pK?DONum8zpyM%2 z9{>dzXmcss#%!K-mv@Bj#qy1j>@={r;X~9z-EZ>CY_Zi4*mY0oq2%kRt{SQKrHwN? z!~jbPU7z0|bl<5iS&0_fn`b{-C(~IOEigG3%G(kNN@Wl72&|tIQDU3wJ)hbX#Gowc zwx@b%oAe~V_{EP9}9gWw<4wvA`$%<#0{m{`ls1Mj8W79pkhC z23dMEYU|)5K-A@{~6kP5dn&vOQ8?yp#uC zj?{F&gqG?6+~3IfJp65+Y|-k2Zf{US5E>Hu+ZBi?8S1=Oj&f8xV0qwUI8epU4-14f#fuOTLiU!pbe|AKXTU`pQ!@JeYado0z%|hVGEbdEj<&5%$^jk-LmVm}Z2U*B@ zSWPbL#YJ+$IiT2C+a1G^-?eG2gMeHGgz2iO6FUFe7)3{0{3^|_w z{Q1PF%UKIBF;7D`??#s_k+>~Vm^k`;lUZE~5oy#+ZZ6dPtD|0a=Zc)zRnR(dD82*@ z;^>aXxMm%;y_*A2sN~RYycjs91A7LBcDhd??u_C?a)F1kts*J6_{`kpRb+_&qIF?n zaOh(7CedD&3oW4}A!xp(xtT&=lfKb@SPJ6)r%yLU?oeS1{Rqk-vQPQVif zHg83ya@E&(XA4EB!eh4RX}tV}dbUwy+|ImOV|P9#pk0!v=qc zsN4ocx|`DJI3?t()2UQn>={NrY?XPMTpHbYt_X(70bRSw9gI@0p0i&VbKx=V?)EPB z4tsV!vxoL}5ha(3QKMqX{jaXD(_zWj-<5_9;9Lwgvm4610RR=x0_(m+1q~gucC;xC z!Wpo17V*++Bh+e&IMW{-`?*tI=uJ34_BYvXh+xq0?GNPUYmJdwvq|00<|^UjAhk!aFMS2t$g(`Rl1zz^~%X*B|X>2LfQ#aEFU6UU%-RN8sX?tpB4zMVc zq$nsz`3%9{FCYu)P}dHfI$R_^eMtVmbFo}+@#OID2t8AXLc~Qw6)fAXPKNVsYYXh5 z3J7xfuTv%897}zki!l#=`PH;Mma^Z{_<jDr*}X#tjFgn8+4W% zkj*-$77}oC{#n(b)dYkxG|&3Z&?=BESxQk2)yaXj+JXDo^g#oX<*krr)~gd%ydWK0 zIEeMxc9lb`G9};-u7&*UL!e=79>#A|WG|LQt6lS6RnoCVa#PoJ+EFV0{*hv@pIeC|TD(1M81tRH7Yr4&R(eudk^ArzkbdDCghpG5HKMuVD zkEL=iSCwtKw|bxAO`#Y$GoX|fki)npvwq8^BFk}&bXi(pMgL2(erH6?%JJ_+LLs=^ zFek?OV{gh&w%N#2>gl4xu}trvolE;)C+d4U4k0WE>N-hEKNUZuN;I05Jz4L4Rn~|( zQGuLLy631gS}1p^6d`0Kg8MK0k@8WP0#Jck#j|-Xk|_W;^+64rbB*y7%Ox}c(p0I7 z&rXBoT$UEi@F72f1+KuG+80St7giFTnOVl#u-0(rf)T5UEt?`kZqB=%zMhcb@WBjhtB1OuO?-t@~qotr-_eSn#wkCs(ybs`s8xRH?VbiI0_6);9Xd% zx!k-=JSu3$5y9LvEl-`ssBM)7YvkT^v__EG;xWb!_|=*1++!hLQ%{FSfiLE^n9sOO zB4X>~ClSX)K>nEn`+|Vh_uO~Pe82fWA#Ih>>tff_K z5jdoDjb3w4t5Kk|f(VM2Sd~)fV8?bLIu@g@zGw*(eXT0gGGY&{`hx(P*t^pu&vTQc z>r?$qPAl;}P`s9*nSY;Z1jSx;GbGs_HQimpR7)ziBf-px=G@)2eGXVcuBkd=^d1vX z(de}iRzYd5qqkz|c&H}81*LlyH&8BLq_7(~{4jq4j#65@N5Nn{r8HlD1}CYVIyH%c zUQZFh?go>Z{$Z=E(7l37_Z(i^JIR2d<922LDEH=E&k?`Y{-2HeXQTbuxM$>GX8zN- zXJYs#f7@*47W zjOdb8vD_Np_OcIH8nOA;s-%wzv=A%T_D3x{x;JdtH(AgZv5y^QRS=CGcZU%_yMR|s z1qOV}x+{}PP5rZ#zNHs|OXJDz;dL(`RIDAhoUbdF^z7ksMjxL)sK_m+s2z7)mFzCo z=!w)2p0HoHwyHkv^ELSn`nT}Vk35hLF`XlzyyF`;bn$FI<8}KMisdO}dd_~8NXj|^ zbys@qV^R(DjAMCxfM;UDOIl>pwJ=EXS`su$>16Ihv3uPHk71oUF)h4QvM6{IDnvI} zVX0B0)IYd3`AIZKeHJ@3=TN0k9>cv0WYAfYGh%9w<(_qkg6E+7S9KI_@|GCL)H z%ev=4!DiiieMHr1$=E32Z3*VTmPSICaVGTpY&>u+4=omV5qvwj)i1Rs1!^evyf9=B7h`@a7R4;Wmft-y>U4L3;O-bu1?gZYUnVvbCfrKL|`TX#1#0 z=zM6A{Eh3^urt{Mynu};$a4Gx?`abe0E=(eeRxMLnDT`prO9}T_M=g)IN zQ~c0l&{|({{(zX{IJt$njXXG+3FQI|PcDqQEVw@2oU~ZZ+S!k1;pMS3619ssmCnEJ zxaxV^oxq9D`GJ-5r2S}-4t@6azy(@!oGISZv>F+4VpwFTTW;t}<1w-){m8bcR-bn~ z5ElZh%3^RYB)@Kc|E^D>!%#;n7p@H#(Sn;=zg=NGdmmO1#os6{n$gv48h&M2&M~ld zKGfp_W$Z?9abGt7qH+*rCcYJ*wIrS`5F)LchO81?DfcmqNhnD_Wua>QEv&qfWStqr z`ym|!B!@W|cM_3b=@o_#W7UHb5M6@bJJV#KyzW!4SLNQ$xx9Nj<7ORaYgG3kszP{K z@^f1iQFyB^DimI)-CUROK_tzp_S57LMAy|l!fjJ=u2Q9s!rq3&kp*8t)Ar)8T}^B0 z2?RU4^^5{ey1T%k5}2PWy94pJ0@zST1~S*48kZ@e`ZUE;JtJpO?L^Fyjozb7eJzC+twb zp7GJHDaw<#W|4#v1Aj3Ov1IkDORp)_nJ7__<%R7+BRX|+wg|XpIkNXKRdtqsM5YldS|lVyvM;U^7^jEajHuPLb=kpS%G1ok<9iBc$_3m_Wo4a$V9qWi$NbB{_w;_w zrgU6+rPU#L?bXD01JgP68>*%rlho_>0FO7eevI|anx|0@wz<~ACBK%P@r$HKJ4fg; zv2=h7D=G|6JcxFZ1%P_dwy$3+CIejB1nb_+rY~Z;AC$6stSV?uF4YDgOJ%v8%RU8# zGT9bRqVz{{+mL>~oFvI#?q-4PPmONR?x?oCXT)R zqSZ~3CC{3F6C!3@^#-fn@*ogav>WLh?*tpz*7g&benke{g?H0@``t#>d{Q>9CQmsW zA4bMW9%&)1osNN(Ne*OEos*<9CE`~!tLO`NUdh+VEtYG5zBkaLZ8N$2(z2N5$WvHR zjD~mJ^yk6irauoBDus%IQ6*PnV0#x1zjYoXKySziyaF z3lT=8unIl}2|^DEAttq#1#8~EfL%Kz1|>LV_v_cBglhcYpX`&B%ua8yE|2IE-|o9% z-V^@((r8h}u8HI~4l%DBYsyH0RH_nA?zLnmgeuRwG>&9USyb)OV1~5iZ{?8!-b@(I z2XiEa9-W`Ky#ggyvLei)T3f~YGda?K=4tYni$AXpmEFQmr8RdtPdQuZ)r24)Lfv3g zfIsVr60avf*mz}-HprNJ<9$h^m7zc13KPWp5_4U+X{ItQr*VP+AxHH}M7rV&BV`CA z<8;T(o7oJCsMH!l*frys(*v2sTGDA_mSwtmz_2lF#5$h8Nfb)K@;ww#*jGp>H>Apm zfwe6g)jw-iyD2P;sfqd!8C=nx_yoOf(Crw_lRm5!JL&6Q!Ml1wEgfEDAE^R%%k{8_ zX{~;~xHw9O8t+&e#;DhbdiYmMx+%MU?<&bUq|K!|=tOl-at%j@(2)&tq^b8h_uCqK zq>nhQ+vBKh_FR_z?_STo-da-pROOCqW(e{i9*OmkN9DLSTR5su32BbEDqM!6ijsZ> z6=Cvuz>ak-$X}|1m~fl?s9ZF!?N(&ExR8)0+=U^TWCx?rN~Oz7f@pM_^4IFQuVy%2 zuNINK*3G-p^zpZnP5STB_h91_6DaSaV<5v%0MMGD!(L^BvE}+5J5rdsfs38R5}m{1 z!`cPh*^>3jKfaehD8|kxrY1{jN{0?uQRY_8Q2HpBAB~?&(xoKhLe-6ImgiT%^RyOD zNh2aTMe8aK1(t|U&q9-NY9{F|&5lR=mz~qTWA}N3Va!CH}>)vr$XPa3$NC zC+mwK%vbzrb9U}%sjN+sbj3ENj$fl!lT!1o#KMTPd7H)w}l`;hzJ6@O^YV9nc%MSK;_Y4s*o5jD0fx-o|>*;NTn{ZFl(DVYDD-Ob( zb~Zm&E$&0-b1ctra#FZzaW0E;Nhajg^3k=8FH9pV#6HZW;2LRbsrLn^$45x)JMvnq z$*xcbK@5D4^T!66dnZ7OTyy2SU?C?%=C93r;n^i(Gyz}Jj+MlbqJ)id|X$#WJp}SF&7GV3#~p-0m6xyyvk-s zM!XF5#otESP{3Aw8CZCW7ZPnL!GAQqw!GqBl4#24=)#1%NWKwh&~kcGQ+*{^ssUa4 zezR95C?XwJR{d&>{`40^^!Dw$Ltn{s&d%Ab&{(f( z!-#%&r*}<_f0@|3AX=$tT99w2c*a7CA#ZFBUu0dnQ)^Hl3!R){ip;~LO*qpS#gU}~ zvUKL0ukEjEuniAExu?UceZ89<-*E%{_J0~&y$qUue>q|NYjp^we_kDe>0ewO;@k7! z%6mucLTW@G3qJp?=c;k?hNR(e%s4wr(P(gwzKOoU8zbU=ufPYY^H`21Hn83`!+kQv za>{Y$)?)|I;EMHv>sY%Br(EHok$2{@HD5 zo<0p)bv&qp3SP&>rSr<~pWx?;tBy-0{IJx1)>)Rej4he$ehHksbW7v3R>4}i1*rY% z4k=%y7hfKd!nlOHhGdf!ba8gwUS=O2=eWWoaxv*QMEbQCi+Ul z6SUG>8)>;s(}i9nZ+wrPs`?VU7U5k$hSXjJp#xil3?ldZxtF_@&WyF|gz=C%$ETXm zd)KxCgZrxS$WA~e-F-QJ=t>2CCX1G-P~*s*QDx9uj{syGiA@Kzx0PqZ72R9$KX9Gc z^@h$}HR|X*QoX$==K8m|_ftD}T1X_K$G?!*W%hRiYI(#?)RCrM)ixbC#9_fueRF-ptA{e1k9?%? zXTG+^_U6=HCzmBKgwNHW4Y!Laep_m_z}KaU>4P9+h8pry7l|BzN-o3xRIHDVPK_=d zPa_*h^&=!+H>?Ep6Xq{IGeP2crVJ1FSDT$~90kI8sIxeM1B&19;uE$p>nGjGi@=>W zT}_e4?jsz~hbBF%CV1>QDOhLy85Kf45Z2ld*>ur_;w$QIbEQNJY4uKJ?Y$RWD|3ci zz*#9dw8$Jr3Z_-!pz<{TRt%OM_XcK}(b^3=rZ!(>;bgS=ib#$z3n2YfC)=42-Jp5942~}a=0Rzj|bNx({+vIM-&8}RUfRH z5XIT~9ibt@InWkR6~{ahagzlYR?)dz4SBZvGqTF^E|e39q-^!wC6AH^tGBK& z&2Fe@CI({ar`}qFcG6J( z2z2!eYMC_!eMjIio%mmIUx&dZ-&_;Et`Is6auB^!gT&nGB%wD*MywI<8C4}TZOIw& zLiNa6l%-jwoXm!kCw&s^m5*+R9-Y+qD3M0ZRYb*VIMYIB;-1ly+qf0+y^Xq%q7*gs!PXWL<@Zx3NhX9&o8r39Gt{@Z0l>a(H)pGlQ7!DM-x3yNzr; zyYbp7$F-dR&*5=N!A&PEVoNm2DfHTk1s5pXI5-h?G(SO8+9aaZ9OV;W6V%pwEn%+c zp7HVqxoEK_@fq#4K8$^pq0BQ^=427rkqnj(*6Q}it#XOGV$YDYv5=4)?`T>FbntO`QkIbeRfb6F&FcE?@ta%k9I zbidy~5f^^?3X{mJj1oSedL666Uu%|G9oPkkoI9B|3S|9e-nPaB+h2Anw#UJ8-9G=t zBEdH2L`5yI*OH017<}B3Q)m}aw}|9&32p)AU`eFUEUGAM7+f|#D@5w`nfZ5CI3swL z`hr=9_ot9Q7Uk7xzM%^r4p&YDCG4ihS%tK$X9wibZ`bB3e(rkyY&#uMR1%JmUNp4`j-FW zo~EK4^RHiqJurg&(g1<W3vLbjr8|wlx|AHwrbN@xZLnQNwZC!PvCyWVVwYpby{D(Wfr#aaHRUaS?=PCyeS?_h=d=>1Vz=$3nGH zVf7=%Jdc3W8#Rs1th2LR2_JJ~m^mZs$O7KP8Q_!u-c#^>|4~r6IT3Mqp(KOoAd(4A ze7FTwq3W+XQrf}S91GEBTa~v5X>uYEAC@Su*_poMJBNdbj4D;SVDRZk%eFF1Rwk*~ zbN|?T6#-X3lil?MKXwB#&Dh9=l6{ZGC^1QJExA05O_Dk3I{1>7UoU}DWjZ#QIvTwCFneYf@%?>$`i9RiAY35rCYwbuSl z7TUNjH5o3iGT!xJ+2Ug_S16@@Fw*VMBLnvE@;!8I8CA?QpCSck)x`)LFMwUIn+wIj zJC>vlGK@@@IR80UnUc9vwbuBLN9h%NM1uSW_*k(QqkVGs1%Wo!FsPVVue*nMSwDL1 z^yW(+;gajo0V51;irObvkVocSxM<^s+&u~0BqzJ>t4g()=r%4+N8bX|kaMqtLJehb zx4zGez##Cgn1sc}9FIH|T8dW6KbC@71sRcwaen{BU1&V%yuZY;7pUIO-00N@`6J|29RvMePBKjY z>{rkHFZtCUf|exTYSJyD3c)u35k@h zo~{C4X*L@u0Mitw*8QepvT_Eozv#vVN2$P*wBU$%7~l4>g)4eOW@4^f+Feo_UnRbK z6Su|>mC@PZ+^6&(IHTj?o#F98iNbKT%h^zuy?bX}^l;j#Unxfv!PRKzDRKiWYAPzL zIItLyG_s&CU9^}>e`!1+!HkXhkrXqIDSE$(gp!#`qa~CJ$PKtCRXRf(G_jX1j=E&Y zzq>lidf=%(I;ZpD!!SXBB-@Ue7p2@BMce-rlE`RMr42{0eq)R_yw{hWd7&XUGWG3N zzed7h=N^+;q|-*iRVxljTPN2+ppF^4$4Fx(E>wvC_V%jNY`CP{)h+$aICQ_TFq2Ke zuVz3+WoYDJt=5X6+2aRvbnM`jC8FC5%ih@OEf-o@}_L%#qr6-&wZqOqhlH%r?=n z`Iohvdq}pDfayW(%@D}R0q@*+p+}c$Rayf3?W)kle_%*Ad@0m`;FX|eSzCR5z0^)KNBxEy+DtG(nlYdjSEf%8VV+)#@zdTo){l#(Og5Km z?CBLF+Cu5O;PO+()!wv$#@AhK<4cWJVwSH9BBX^t%cSiWbROGO|MXPP z4W`UqN7;r9*gsXXIaA5+X3N0&L90Hb7ul(n5*sRj&4}Cj;nhg58=QdBICg-|wEktH zKbI-c_FRfTqw?F==JN3xKlfdND_i>o2(*@>9>DdC5o~AzDVy#AhcgU^)PYvct&AwfW z)NKy1;HlEZlkj!bnb%ojxqTYREXySxHapX7*VFcTy*d_8YEqW+N)*~Iu23_cBMT>w zBuDnp|223$%2uoV7Lp@sKht#x-?0||uM(S+=?Zn{GDjWjGO$b7zSoys&UOsUGAV?z zuMe`)3+{Awf zSfJR`?%_PQ)=K>Od6U42(!c_824d}O1sTeyhK^?Po@aG7XD`h^_01RaYn6#GErzsS z`i4>0)b9qkGd4JthB|&SL|Y-+fgj@9d-%byRM_%tBI3Rg0q?dRPY17eHqX|-^U-$Q z)7UZ!-tnM&BEkLG8c7|+NN%P%nu5yoN-W5VJ$sgz2bnrjt}Xqd%)Cgr})+C z=7|fboj{84bf#NsIB;YDMk}+N^2FN)Ta-hdzBDIoZ3(6_nUJM?-DU}9#nT84ZzbJ_ zl5dAuvqKwP-|wmB)>B)*lTtcI1sK9-aM-c7kvXcTfhAk3Md4QR$LY@jyZ>-B$$9j% zL}|SStOM*6{T*q(oB+nG6)J#8kB-b&6%~p2vK!oQfv1YlhpH@_n1`9p-1g`FVTQ7^ zm}-+dw9hMeBdtv&QDlYH7Cg!j5xNLkA&9MOsh!oSB{riDfhAHN8qcD2HBIW=(Mxr2 zj^o1#eu`T-g=O8#LQ|A{dXGp(6GtcO4t4iVNNof3OD{aJ2(0)RnbVI^O|V~@>mVu= zlMPVbEjMPojigY#OTmhYuIqELD|4I_4qiGUP#Mz2sK^(sSzA`aT5v^UoG(u3!0`R5hiFQF(WXZ`<*f!-j(TtL>G(j52)B z=G)eMpWno$H!$UWJ9F`)uK~U^k#V*H%mzFhau(LnT?yRe%>VA4dH%QVB>WJJG}G>% z4BY1I=3}C0F0Ya6^0F6Se@Yt{M0%fEm2RXCq;{(pnzVN9-}b3omM$-IC}#>V?*=0} zU1m+Y%(lfd%%sFi;L1@IO7H?LiR{vK0OVSNZG5x4Fy;%(p++5pV41%fhQYG6%SQA=>D={79mvs*eW1)d!Xl-12^H&= zovM?{;EkWJ5jEY!4B3-|;ny^sQSKI2?d{D^SQn+@b|;V^#ts#~Qh91PhycS`jucH2t#+oNs;~RZl`XY{k(Dn7A6n??0?aM!S4p01i`i%l zkf0ZfDdJ5;g1yS+pzd8@<_a7>VTSs2+=?j5!9)>Prp;>$zAnOQuRzq`Ui{_!K#bn4 zWyv-YpVUwKt+w5MIE`3jQv40YWT3rT`tr@&T*aifxG9*SAyjBzM_Hh&m>ise4^smB zf}R|_NbwLvRlmNBjri1df^8C(20&C7VyiT7(aC^>jvFWr8(F z9@0KE(1=^V3}2j@AAQK8G|mhibpW@&vCcQQdf)X#D!r2Q2;p)F$_o0&jpD}6SRKr)kRfuf3G z&F-^JC$@f!VH{WAk>#pRWcizX>fZGXR!sQ9K~Dr6xGwMjud!Sc7GeHT(yrPNuw)Nd zMBlI>G&JzSxPfz$Gw2J*Rwz?hd}&c+){^i-wJ6a}S$@Tl+D$Bo&;7qBi1PfS@Uc+K zjtlRI&632Q46zNbEWn3RuYKW$UO{};8z4A=ip>flwSOok0~LXGjc!PdO4t{=ny!s& zy3O4IXbO+>N(r$WipB(34kfjk3L6`UdX_JkI77unr{XCl>o|L+fkjCepBqLTXNp-1E~`4C+-`XxxR?6 z5qt-^hh1fR9I?%J0nu``=K0+jiRlz7>`nv>bgWqxNQjo0C16e1n%{@{aHFh|=x0`G zuNd9r`f~G-f^|%pHcV-t$BlKEoXzeNX4!4d`W_r?YClp`p#&vlHN^6V<#!Q!2nUgPGL|B~#ANCmSgS_vO@40Jw7?qK@GF3r49ikicXsAwy9YP`uw2Tp1E zncZ#kNkhRb$CGd!?3XvOmhd)w`x|pG3jiyyd!+ob7EoVCF?}-}s(6jtCj9~s}Uwh_%$=Cj6XCroW?`yRm*5ws&kf=YbSF@sMGC$TZy`^yv zZ&G9yS;`VG3Mu;F_RD~`|5r0C7`QI!w;bcf2mMrN*6yR}QaQE@Sc4>t5}(%Z-|m9q zmlFA8o1XxCK0wPe4|_(nO6+gLa)cz8J?qbY*Sk5;E#QTjT9!QzJD zSdm-9rqx-dD&OXq-pCIG_EoA@w&y&Wo&sJ=a|SY&5K9@J!{H=|+Vf+#VH}S{R-0^g z)Q$)Gg&641(Le5$zH-P(S#m1o<+B@m9a3-cGLbupCzXD`2f4En(bDbmNot#f z+2!1p?%<@GW_s4B#>%J4B+LDJ%V@g9xow5JaoiZ^=oK#63b}~HVw+cOq^;hLvkt9o zo7~|>fD&4pP~+aEBp}U^iYj(E>weKSNksA9)?STyv(i~NPkRG)21VEvN>rqY(U+*f zkr0Jajb8U0>0HWxjzkndJKRYImWD#?=!mjUJDTA}mp5Jx%yu@1b6{%qBE|2lD|^P)d>)M9B> zM{UVL0-)#X-d0gHjYU`8MH!0Q=3~0Rp}M|h?c#a82gc3qVt)Lwk)x&D0>ie)>>%{L z(9FH}6|XKP7v?}wSl9r*dj^OnjA|4T*=KJe1 z42cRpK8Rg_5P#cash?`{kb-MV) zQw(;-n$?Y)OhOradWpUkB$efl!uyyO*-(z>G4||1l1(bp7pL7qkdQ8w?PPmM$REK~ ztk2FSEQ|pV5^d=FhZV#P@JFnRo6d{aD&OKhRK!=j-858KO=z5IF@wsI-y^%nc&+W* z3RRJ`WWq1}*=w!G*V7Cc{37j}p?z+fW1cEgh3;7STRoSQYOJ_6LzDwuK2%|C!$iu9 zqs&|HI-11;8;N1_O1W=Emc4YOhg92G>GX)^5$LeWl=2kHZBL8-@4hR4!zbv@XsiIu zWHf?Hg4-VfU-LwJvyiZ%kQv2DK>sGost-OA?Tojl^*|UL$DU%tu(am=dod9y^(wDl z_NNo`$9%dEf<6q!a_P#EhJ?QADW83X%+-H63COl7!FP)itD#95zPrA28mh1#3sA6c z=YB^BkTV4@!1SM6&Ede5F7xb5HuNEHv-pM`!ei?3_a~#^&5W{*$hG z4l~J!1yXT#q!}kHje#M^o)DtJx9D20BrmLfSmkQjCK4!%fY~{+ofdsJLq^@@=Jjc% z#=K(1z#`R{H=@S*yQv(PgtOU0UMUeJBwx5_kEEK6h>P>r?P!^cx7?N$2^K{z84#E& zEPQg%GUC8KD8laZah*kG5hgTz1G!iO{rzdNPp|eo%GAWN(Dozl3!c^}nTwLoSo!55{s&iu3Ee?(>fRhQ$=#o)CTlT3FT?-?Of7ALWuH|1@vi{g800YcT>3!$xW8 z>$d~Rgg5iARoFul{9_zd)Vg(NxV9T%d<$$aKzpiCvKZ^eXRRtibaKtvpVC9U~SRbrB)ZD#%6^{LHXKL%qm|tRjPDcW6bmlklMRRW^boNcY!8a;XY@#Yg?IlnZOA zk%|?|R;WI0TJ3GUPR};>d%I546`U$v?eUm3Qqj>>+Z%6jco-7G&6=u#(QQ2a|HVqzj(}F29V>t{fDn9_p%JtZxe1 zK-q|&WXmeOLA%a;yPaKV&bvQl3QtA+I+f=2?J0?_t z;k>8MdvjxyT5o{)A8P_JJEWEb681%nwNhHrd2hw%jp>cT50r&DI=)qLxa zzW*qZlCsGeddS>1npzE4MEgxS*uwRb6*cQu$B4=GZF+N<-ah6k;V;4^4m8C59s?Gp zg4e)!H6(8$g|2MQ=F$0*eK>eNu?^8%_(cv;)-cF>hMNaEj(LJF94Cx|ABf5_efGf` zQw=PnnXN`TzQaJg5sYffsk7;7e_u~d5Gon(wY&jCk{v864sN-mI6PUX5k~zZlJJ8) z_*oAN7Ctm{%U&HtH)MsOfp;o?Uv{2?K0~5P&DfZdRZJfLev-WJ0fk6GUsP1CM1*j&!1o|oF^T-qj8(5tZ9LY|&bNV= zu(a`?PR`(b1)YfvgZLX`yIP0UP{`Td0TH$Ogw(r6Li7=`dsK4fU?HLCJ}*D4s|UFe zx&1=!w6Bdxex)*>CCN-9Fk!Y_2EZSn5JZbuOWU=htUuc+l)nijSv!QOL)d-n3}3~i zOvchs*`k9QfKrxajPK9MbqjKe&UH$(ZF~B{;v%`Q!4xh%{CR^?t&RIJ;@$G5b5&+< zsLWFYrL$LR>Y%th3t^}&#gpKZsKKT&nI`!=8akY60&yEo-LgB|5t@oxv&O8b2xS36 zwt33Jk!1`{Xj0_(;}TpYygUY2bdPiw;nhm};9mtrQQERs?c*x=`p6TCAYWmMs&I?5 zI|81@J@J`5qa{_#q*7Xyr(tQv;^M2Y42^W<)DA!I*N7AXEsyr+&YDRT{r3LHcX{(TJvS^yUgPwZgomydUqV5TM(cKI&636FwjY|5 z&o1*S8PKrCIbJ10xL+g-eqwV>i6#=-E*FsK7}w-kO`n6RvhiIe&$PZL>mN=R_-swZ_`HGEa0$`W64U7(baAZ2c@M^QCwM_SuBNMZRFd zKD>*4;!k^JXGbf<0+=N}9~p9|2)Pi+l^YXA&?jLC7F2FRUSvmwD>ieSNY@?H&4-K6 z0XerTcz}qkW?pYDFHRSW?SqE{LxI(HzQOY@ZGxVk+{%e$db}JE4mv+c755Pq8r7M@ zS{dQ+k*&LgdGxB4Sbhp|mQve}$Ts8Swe5;t!A^@J9#I9J@)U<44mYw;mOukpmZB@B z+p5fGh8id3agBaewo@VvJBtr0y3vwnW!@Z%CO7;+Y_@dfaf! zO-Hz)uWa&hub!Ol%b7|t1n_>?($F@0qdqpHN7oDPQF=ZE0_rl5E081Sw%zS0;BIb` z|3l|SUZ>Aw?wb1JYl8L00U%)!7pEAlFl2j|S9!|V3teOfJGFKhRkk*Dsbc69FH8FBKfR@Jk3O?)|$ z*+(LpJ42zMP@$3-GE@KgYQ~%oyK|)q?W!`}d~-74n}oPZhEz^3?;f?9tHBV4w^|f6 zV`n1V)iEOAA^$3Nxxc3MJI?l%S7?&Sm9KV0_ZX1ju#%MURvOlv0 zjUA*+!j%4b?C_V@I6c!}UgOOF>^08(FL{j@t1sCsi9e4WE|wJiX7_AXP2*GbUHoWW zFb>p*q!{5SE6D7H;t>ET9o6@(x0sI`S^L{E^;o7R2Cq{<3iicq{Eh}gn^Ayo<@<%* zyM?3epV7?UYmekS^leqyq&zH>SKIGcieM`bqjg9%%G7t=t(=?fNACOgztaa?8y>aV zZ>~kpZf_SV(N5QzRRr%i5-E<6he$mTyHBn@in3cn~VFD#&(6lbba}kirQ*VgT(C7qtZrm_` z@i+s26k;=T>^!7swRy^}ny=(TBX{nNse7&5B&Qf(6LPPfU3=olFUE&rUmm#4|~VMT4;4p9-crlKScXB7rV)cGx3eu zDW$5AKFNIFl*fQyU~7582Qv$ssY;UEO7*Lq6mA4V&!c2`7nPq84gI2O&WV_r89lPa zU5y&qEUiy8BI#d_xlo4J(k%O&ET@c((BXZf;43e%O@5fch7-e8MYOnbjg(Ycj7-47m7oV_)V(EWAE{%uJQE9XWbrtP zcY-V`UV=o{8PL0f`zcQY1m?y>Qtb=6#5&jQjBhB^%~z+pg#|U&LoeL+#7XfoH7G+# zNy>Gnzmp4fEP(#sG^b}_I!x+3FI3PU`B%3VQYD!qoB)c^Jt1ycQc$L%fB z+a?2-w~6K>R;_YzUyymhoS20!7~$M^<+!UZKB@KHw-;}%EwHvSt>4WJ#cjm3^>V1r z7E$(zVDM`b`B{FL9e@17W;W!#ThzjstiBwFl5&T_aGI-5Zyw3Qf(YQQYv# zI+f=okn)m)kuc}{yDSQj?|xNTWj;=+W-Ei$WD&dQ6ihCVo1@o4wtn+74AWl)v@f9V zhqkS8u;naJ{(=myY9E3!YM3bdf&!}<8~et+rsl@hpph2LW7MlGv@5MyJxCZl6_V-u zPYGsa=0oymVxdOep#^NEwx38QBAVug)^6S(Mv|zz7Mu~^-t%YRmJg_e7~<<3)C%g! zVQ7Zzra#Gt%^j-X zp)}4L^*A&0pN<(#?2)otO<9FtfxNP7S@8?q{!f_j?+YWyP}c)K`^J6rfA$gZ&MH}s+JOSE>V(#s5K&+`h=E_ z#ojF=R%@Z&$2j_OUvZ3D?kummLx~YaPj->S+LCPTU3mpe^zeaLraT(BW6RM6qJ?ls zVV5LKiuU({_=dfl6Qkt{&5@NLYD-Qb2%9`qvzs(c<;K`!!eDhS>kF~L_F4=@63eTIiGKVh2J})&# z7D+YGuziMN)C_`rHhHEU_~r?!WULXpd&;@R0hT*YH%GwEv(H}QfbB7k@vE^snSE}G z;o}>MbSjEX@~F+p;c0+38r;zYCpvSZLnwFWFZ%7T8;|T)N9RRrZEz)Q^!w@bE@Ht`TKh*Qxf#%)!oSA z4G9xu&T=h!x}^SEDlUZ$p?J{3`MJ}ihLeU7P6Z+YgFQizgmuA;5QEMLpL)du3<$?! znJF{;yHmd)gNYq}-F_8YQZwlc+LeJ;+||yd^s>P~iiAh;iC^2KT!EY5vORl20*O#^ zdNzY}^k?a3p1At?qLMRPo%3^}9VgjDr)oWK%b$<4E5~SqT-N6}_ zeXIKt!at6}Y1xNBs*^Iu2QD*n!&*JLG#;wu0#*F_IxYRXU)4Su^XygcdGHW~x*GRfM%=Ny*AZLnB)+?6#~Dy( zgc(+49O%DYDr;viFb}@be*4`rv3v>tu0Pyqs!IIVm^Gj2+3oCfiHEm!Z3(NSZ0J79 zyRzdp)Z2qbVb)sMKoHHKfY)#Z+`*b=iJRJ7F@w`eq8|IN>CyjU?*GIWj4U5Pd>uOtY9Jv*5 zgUc^cq%WTI(R^~?_zL$m*~04H$Qzgf0Wv^ia|1zJHzKX)xgo3!j6`f4j5-JaMO!D( ze)UB3pi~Y(8z-XYx4?>^+dxNKX9pvoBPbJj2U{a0ppzCrURaa}pbT_#0?~=uf)X?Q zP7T`U9v}p|2GKhbJx_yIL;&3aG5h?Enc+Xk&a)Z%QuaUCdD*n_zwq;CmHq!;J&e!( z*8e9z&$D&@&JW|W2ljJC{RjB@t8M;KKQBw{{uh4!oMZGK;ODQp_!~cewc#K5VS2{v zf2Mwz{u?;I_{{&kewhAqcxL*mF8)zJFK#CPg`fW%o|*p}Jip97`#V3(|2aG}|2KGk z`Hb~n`1#M_nfbrL^UKiq@BIAZGaE>jg2Xe?i+pw@0!Wz~I}&LjJi|-zx6}lkUPjRf zFET3B&(gFTGihujbU)uPOG6W4AfzOH` zASxiQEG0psY;Fy7q!YBYGJdfKgn^Dm4(4`Fwhlxf`vL^x-}c8d1;}79cW`tPGBa=> zVqyeH8~hPwU}FNPnHxKqIcgy=vOJ6WfBcw0mHy|!LjQdKImPpx=QAT4JHqqbf8}_l zd8TJ!d&wPvo`?<9rC3?nUe14pSwWA=#>W0~FtI;Z)brJID$p7#zf*$Bd`|V7o(0rD z{+1SwasZY8oa0|r2rBWv|Gnh-lHW5||LgC6i3e3D$PyH>F|su_w=pGR zd66FgC1*pYXS4HJxH0@g61>Fzfuk3*^iMj#Gphc&P&2m?uyHj1>sr{{!~_VkOhKlo z76KCoz~0%`3Fu&MYUTuzk@Nr)bAX8z!ZV7j&25|=b^cM_-+=xXY$YUwMa884fUTmf zwSmn);r6*M{;zP$O#dv1>0g@cH%gzI=y&7)-y`=K1kcAGO$2I;Kf(1U@}BYd+?>z% zpO4=qzN7-hu!ErTN6a4pdZv3$|AO{EX#T|ab1A>+fB!$j?l+{K;q?OAKhDqbe?sn0 z9-ptD!_U3ukGQ{j=yUq#KJ^^`C*3n&e}?}%*fRYe^5B`f|Bryn%KTq|`=UwzN8mok z{(lQxCI*0^vy~O_{|&=`Qz3t0SXxY0Rzmd;3`>CYx4F^(3E~%v;9rov%nbjd?EM38 zFSvVdyBFE~zlegD^#5!8A9(#E&2zgy|9(r;znAtRBtfbEj*REuYhVrhAJnoSXxOhs$HGQL$4Jjg#KF!$#LB^}0}!<`Fm)tiMgRyn8aTmH;b&^>38{umRYZ+W-N! z09(+%9l-ASJ;+OeFQMPX*?}0cHU69O0XP600ggZyP=1c)ZU9Fs14lD}qn&{f5a0xG zGIIce&aSoqXMnSfG0?%$$kqV}Z~?di+yL$X4}b^I!ItW!*+k8)fX|W?1WUz#=&qOR zKN=jA0#qH(t>pw127**A5LEMjSFu6>X`qd%lNqSR*jRaa9i1G22G$5}S=nyx>Pqvg zM=|jot~AAxtt|H9_0HX@l^^HabHw`4U`^ndpwL601kvG$iD`n|CH=tQ1BZwTq%CTk zD}-j}<`#1rO9KZN*XmV0zbx*pdwth=yWi4recO55GU0s_7qoEvfO<9gi>J7TRd$DD4p268}dcmBsK!(|D9TNm+= zH~o?FygBF-`!t&_d6UOGyx(m#U97eR)Dk4I;SsXwUq}6HsB-X1GT-}&rBE#Ln=c;EoJt>~L zqlu`ZSXXQ*DGI$(4!KkezMc-dNxlkyh>X}mYv6n0-{^Z0g8Z6LtIXN|%kaEtnBorV zf3F9xTYD4DhDPIKIrdOA0kLOn0AH8o7JNgb`im*NYf#bvl_7IQZju1*7w@2e0j+(Q zTk;JV91>QT`yhe=5koG!q!pnqSqwsEIOrg%0YP1|Ti}YQ6&Wf5SJ=>?>>iB)T3yhJ z3^j>YxbdKo0TcnL*&fHAbhjLIu}VV3FtjjX1K3@WPVq{jVI(97TS5L#VfsN~1H?X} zprEjoXixDdl0RW|Zj?EmlkE&$9~vK|UjuboBRNkucj6B(>C%K9rK?Hl?UFr$Exavn zZB#R2yuRjH%dHvqd>**>l|KIN0=NCvHLJSrx^lWd;S2UH-mg^1V#vy8(d)>7WzhTp z|I|HQkA7l?k#s5~ccd0MZq7RU1P8?iyF_}q0~$>-PHM&Q$vE;}razVj#lEdOn8!#$2Cr|U^J9@(WhZa zNb}^Lwn+5E2&{Ct6V)}x6$dhJfAGUun{-Mid{TKSm){?y14_>8u5YXW=&4oKGDCaQ zkabQkuU`+?QCJ`o#!_$)EEIGc^sD&otk6Alde{o}=xqIr>)J!(6_uh)IicvM3c|=} zhY`ge3hh5}Gb%EqzMwL4^#`X`>IH4|8`Xn#(OaAF&VdeqY-KyvlP@@OSFja3e79X9 z;Q0b+mj|&r#PC`m7SLGEDU2|HSP1 z>6ho{{PwWknmU)0%-uEO0BdW|_13^5hlK3bbi=s-q4@G3Nhm(=8jWy{yfq~w+5uX4 zJ!W)rUV=?+at>+-H7@N#Ro2<4tsStBo(F-q7fq!xy-jI}ryXVTb`opFx@Zqfrc zSavWE*xUsPPvM?L(`jnEbe;?BylE|{Z$8o_0U?^$A0F@Tt$d2MFAP$Ii_tQnw0 z_|6?jcX<1nI{f+c%J;PIA0$ybp6Gp2c{9WU+!taUX*{6m&abX!?17wEJM#~~m>ynF z$Zx%;=iOpnJ*7!qw}=8$*$Bc|*};sS~;viHWoXC$~zY?~c5xgb|@ba>M}1(;BM@qiH> z8iCZqgU3$JCK5l~>EeJy#pg(U-gk_@C#BrZ&t4ZPvi1$Wk6^VRlX804Xvj!z)W+a> zfy^qOL+{A6;r{X9Ov?Zs zq2=XjK=d47UtJ=HB&M*2&$#(519eqjFhCF`K3L35zOzF0K#{s z(adTBI1|e068X*3H;t8fiyAe zfTl4gudNLh!Ef%76 z?b&vobZMi{bxphh6S^bVy$<1t{!ozhQ8AaIQ=99P&Y6|gZmnjfV_V7oVzBn}q37xE zICJvQz&usvx4uUpp~Upv0!;cx$>Qu>wv+e)Rc;hS4#h|s(LOZa2|l`FUC|_8ZWyt~ zCqpX^3$L|y1-Rg5C4^3Rn+n)IrmJ%H^|DYWsOF2(HO%>m|1Lg=?{IA!;xFr${e-+a zuseN!Q)98u1Jar}{>%cta!*lGOsqe$Tx&7-@+By>$iTq`v10?n;JqHOK96l5EKGH3 zI``>U*BlY0XH9R|Qh3M+JRPYW0fEkD)IW?zn}yn;z$|f12ImQbSRIm7 z15uIJC25+G)l>eA;ntP0k3fMPtqkOoagtdP?i#pw=;)c7XC@P^&oyj*ZLBIGA4nJm z;}!x$i(>YWQc32PhtEGAEtc6(+MdYyIsB%hJ8RxcWPv(Mnlq?gw_!jzsd}q2tCF`T zI*Y&a%7Il5pk!JbB-HLtlc|ZpG{3;JsicC zu>)y~mId3Dhb|NNmlX1<7LqOP!YXmhXd3uW<;FZFWMy%;CRb2r+{oI%xnOq0Umlw2 zn6pmGXq_x28%nStC+~(XDQY*Tq2vRqRsMW?1+nD#u|CLC2K=BW9Ef&z^IrQe9s8kO zutSbn=(UT@lDZedZz*X-uXa_ylc2_hfZ_NQo{`>+Et;FtWM~@NuR&S^lY^?L4B`BYaZ}W+oQV6; zy}M1oJf~@NheoiBfHp;^nzW;lyrbsF73@H)N5)uYr3b1xlyADYo;e_wBlC2*Dzr3#d`RiMWW*)8{e&6ZLr zUs~HeK%zvDq0nQ*0IfQ~DN_<%?=9*9suQCa-z^#~*?AXQOHo85LthOuqKkgd-3Y~+ zAfncN-=NbL-#wc*o^w3-i0~wu<95K%niv)G5{M!7aiQ+plEc8vch6x0gZ2kB&4Obk^RjH8mCMy0+%${gN6s4KN zciL9!v$B*%_$EYnO~b*LVHH5L?XGxWw~ z=PwqP6rL&qdW-vjc7voJQKhc0BhOn*FO*}yYFBmUKGk8p-&6;9ySGPbYn7KXZ5OSs zA{T#u4wUd{uGC1_m6gAlU{q^oWxbIv$AhuXoiGOb7%zL~k#n2^u$(o#pX>^cU!<1x z@$avBpj~l5qP5(vtl9w~xiAZ$01@&VSZkJ?1$A$RO&KAWzf^e8S94t{`x)|0n|~ami_cs(r%%b3CM(oLHi zV)CR^TvuHGIq~#c_+nl%QE4#ZVP!+c@5qGv0>txJP&U(bqNQSox${&y{KG2YH&*6w z_oOyI5`{nokGd*0FKDz@ySJ{Bah4LPdEBx&SaL-|KT)s#FV%|nctL2{%lQ$~P?;@H zIxvrcoxdktus7rUt& zf*%87GOZVQj5iVp>-|iMQWKLTz#V=C+oV?Z?d`n0)Nn*Od)rsf^RDt>^=`86I9uVp z&vZRYx{;&;HEURFd-TeSoYA|c2i+wP7|H^_WW`VIcsJqO#+jCyf{qSvH52f2n|68y zTnLfPh)jFJ6}$r-Wfs|3t$=@prc?2_+{)a-y7}49X9F(R((G8A>k6}?0cy$da#Sxj zu`A?W1zrc)Bt7DzLwz`d0zGEy*)RX#M)rve3>j^$a%kxAi4ZNXhYREGPS#miJA;^m zh}5+TLu;rR;j0xK%}p;Dde+M33$IU+3`wc9&fg{jXXbFNgl@{+^8Xvsv9l&(?)jUjfZA8m^}s6j*9m4W0g-)@F&6` znqzy#^NL)m^H54cS8Y*=ZQgDeH?N0OC*E`?TQNw8%*O>NJY}?Ys!o^E&zE0Jgdt$c6Yb>E-N>;pPW%oFuAc6clvzDafgj6V}1W zd0D(U7g5nk69pf%q2Bh#g7w`r?9}qnxMs0*WkryBv zWQ@bn{mtBp8Mh{zrX)a<&?Bb;nTg9pkKxT6syfx79|-fN7)M*lm}Mow?e3apP53$5%=f)>X@gup-fnt+w+6N5s^x;QM#a_5e9@R~Ozu$Gm81JG?E&-B zp|j|^!k}aTeax~Ur)l{t2JqD zJO#v~gEQhB;bwUIJyDdpI7ZJC;z&r8OGaWzgk#PjK2NOh#0H@dk@3;5Jp%a76;442 z06hf%+D%IW9)|jjOM(Oh;&ZtZ(1{Xm(6niv&U<@jM&gNTgPq$Inl_+%%oA3j@JAYJeoR%f7iitFAw zs;j25B_Egz;?yFu%XVkhDvC3f-itkc?%K4ro5JqaGh&y#LO{07uv#y`J)5>LOwEk? zNiGcHm3L0B&mZacS9QshrWebGK`lJf;moO`N=ul~Y$r;^?4&Se zNJj~yOmB`(SuIJjEl?)EqE8kDxgM~?q-eu%mg)HNaaoiF|Fvuz%yy8|;cY`!g2j#n zb$5lkUhkq8wF`7Qe;MQ!}L!~7KhWG54951LaW)!oH!*XLgR=NvT8^W1I0 zH!a-tzV3b)Ez~+x#5qGTy&a`h)z&cZPuqLn0BYbbNQy}z#gV9(g$(OeFdEZse& z5b6;_s#1XD08S$2F`}4A?bEr?qg{i2Sbn%(ZbMyxt2k6rkq}z-_`i7IXN7Bfn_ez5 z{G+>eeV+@oO1;Srs~f+9EH$4Wf#y8Fpe*n+ybyTC2dnmDV~xLN1GsWtS3TxRLyVO z*1S3?w`fcO#@ej55|bcmRTJ~w=SmuH=1W~ zrl_idg&nDoHs%afcORFxyr7{#Y%Z7jSs{5MVzp+<(>goX;!08hhb9pSKI<>dK3;b|5?Lam;c+H0Mm4kq%}QjV>`)NWSmO#;OvlOQ1=bR{$;f`hkU{z z(OZ8>#M=u;4=GcWa^7-Wq<(@y{8Cl>cS(D3R(=l9tj~5NTeE4^iZPQ|G+QFlT0>jO z!qv5*;e38cc2KKF4+Vt+4qgrXsOQ#JFQp24a=_5iNpWt4RlU~Q?IsD4+k!Fmh*VDW zS`oEO6vrCd8G6>ju5^dcwsq%;SYVW-@$wsNN53wQx0a>4rZjCJ4}UNKyyG_%SU#%( za?s2j*ZlPRP5MAzx;f1qkTuQ;a^1JQA|NC&(45OoE-q1YgNVbue=cJmza{XooZtAtvVSyDIl_=iiMextAJ~ ztcLuWjomuY2Pj9=m0D0Wgbu{#O!U)hgX24}aHnt1vs<==f(q1@(%|DkWJZ+ku~5}# zQWNkMTnsngkx7ov`XL}=hwWiPpJf_S{==SEw#r56C}ep(pFl!Dx`M&*;51~k-W zw64j@fNLu8nD`hb0@%R3-!4x;CKd7zAk!qx2u%Y;3-^NJ)Q(gM{Ax&td}Z^?Eq1Rm1|WhFAG z3J5z>P`#Y@m37XO$MoL2c_vIZj!f`M?~H%h!ZPvGfm zqc4Ji;GJTq#Wx6THE9j=u zjG4`RL2v^tN6;lBC!?yNtlbcTRuw$Uy0Ax&kQ&P1=}LnUwS`7jwk@4uGa3dHEA-l> zj=&R<^X~eTEp~u*`wjDhkr4i{)J(G5=b{KM0!ce<9d^L0BULtN%)4 ztpIhiJqY>;*#5=p`6 zQW9Ebc4GbE1d+(pDG2fOTN|U{qu!U*(#2S{{2b#rkhreLu(X_{~2BoAzEY+osKn@>9bujoGzZ63nk{QXq z?D9N^H;|>s?#Vdu!&P;dMRVr(gb8tzZr95iphI z=s^GN;>5ks6#f}VAOH4Rb|t8v_oVlk6klQGt!QujGqs| z-w$m62L>LNCdhrk4s-IDA8JVub8$`XcfDWoZkDMx695~0tyD?xFQ(HfIU0~EW~*XZ zTsk%uz&B;%K{!CD!Ue9PGVppc25yUDxPwvY3?*jieBC#l6+3dlMoX-3hN4+_C?Vq< zgPbtNljt=d{$7ae-68yR3F~Ktw8~q z6Gs&-I&5gZqptuHX3yjxUAu@A zF-@g(C#cJe7e65)eT;;79Mb}eX>%f9%-$k7W&t@r-nfwYuliHX>hWnZnC#4HJ@DeY z*O&2N%P*u6g`bPI!1Vt1Jm_`}j2tIF(0`v8>EqXiLJTJ+!XaHIiW@7IGh-A2*Xd?C z<_&UP7`yHW`iah+&>!TV&VsLfFTEcy@)bGlA6>>%0nT8wYQVQ#^P$`l z`MEG}+yc$pEe&-S7G!@6+c`EGmsmfOBZ`h=r9-CTT*3Da9xLHMJIWJ-mrIU4YMOT+ zal)c0#q`%MLA^4Nu|JWSft&V)Yx%q^OwsxDDpC}%q83UOiwK&638z633=yOhpn&AJQFFr9yY76(>WJ$hk1t)-b-SF#1dKx$m< zQPf5UF~4-3o&{s2uK57e^u{X0ZcN+0L)B@{z59ux2;S8Z((UWKu}K!4t1vqmS36?f z-N$&l@~}J*f5&?+JNQBP4TDs^eB`Mu@SZaAfPhcRw~DBn>x8pWxSQ7CnyX_CvEG;4%P)Ad}u0XI?L55f2aGOZ7iWaYjvUOh?O?iCNq=7B@rqkLIH0Mp6SSqu- zWYs8j_K=7_qJ=Hkp+3`+sT+LY&KqK4F`jWIUGcZT^0P&5gzeHA1%J=ODZCYN;ieta!h>!pl%~2?UwMA)V{XhM zh?r>~#d8$vt53k4;($m+H^c@fnzx|;dDu#r>WCll%3b4KX@36L+VVSh7gcOiNT)7;>O9uSWtHH%<9{e1((@SE;Bbqjdo{cvOgqZ&| zK-S9qs-O^`q-#;H6GLVW0M>!`WUJ_sHOwaWa3B-byivDi&EB;Z0tO~Y0!31DoRRsW z2a7jqHj&x_Ubj{G8Q)p@Ldn|_>iIuI81 z!JBrOgkxw3;0@5-ActhCxBi4eV6X>Uf2;gj$LlLRY$GTOL|N##SDOoPH1{m%$?dhM zC?gMJWYyan1~}FEIbf?ZfY33sm;h$=g^n>0^QAH@>3SvYJX@ekU z#96U{%vi`BLuM_(Ya zM(3Hos1C`piiO>#>upy)`KM*L*Vm149#3j$8f3{;qxF|^2F6S38q(Bow1{D2!_*Df z5dPXUGfBQt(i<8-D-`3DK%%(hH1v%p=1g~pN|zRaozFzDn^oFEU0X}G+cb{QbVS7&D6dfXKnBL0)FuoO`_+Dse{=!(3E-2^ z&}GqY2z?C7Y5o#7c^rsG*|+`NlS1DasK+POjsv}L$*D#y$A;ys(UefmxZT^(oCJI9 zWDwlV+wj2;(xq9_nou@!<0i37l`sHi034!*vg6>tr)hYKXX^GyN+F{nKmJ(q4OBU` z-XQyYfTUtI981NB6RLy*X6KQgA@IvVJ(QgdCWlvr($M|bFn1xxEKq9eE%zz=`2N!O0g=(a<|6U>~wh52OOBxH;Sck<>M09~rEfNklWdQLw99-hPqGgjdbe zfiigS$1a0WqyUJ4K1ckCI<7=DruP6Pk(UFllRr^~HRRsn;D%}hoh*}2!_x430NHI+ zTGa1gFASF%!^1we-##US(=jo|R8(qExr||##5PcwJQ7_z^1wM zGa3w<5(2Qk9KP$Xm;k)~@N?bC)dspjuJmjDpB2BRnr2B_>U}oRBwOH2v%#m;rt!Zm zogRgW&h$MR)>-g!D^3OzJ=T0Q3lgn!yfNJD_jc5KM)T`qP3ir z11v*kEF5>5*L(Q*U}cb=!U%h<#Q7kOdYm@k6d_3$%KRhH!S?#F_M0spGXomOpz1-B zR94iZH4FDv@;w79%XQ_r_37z$2qUIacAZptXq>*lWo*Z`eC9Ms;78C7NcVpvMGpPc zbWF-xYYzt_fOW_E0D)|KPON{kM6<`D@ju;8?}e!P$OIQPeg{g>CM^ym!PSRu zt?V5L{aMk+ku-LCI`ND9U~S+p9;m#hDEh*eX&eucpcpo4Zk7Io&qx>QyVyl~5+P=0 zY`F~W67%ag(n;J%%2qAJCHTFGqqMt;jV*yDKOJ9)+6d7Pt_gz2iBG9G_F=Ku9d6maf}>`t9jMYMT5VRry{gG?b7K}mg<8}EtC!>#e_Dfr;(l!-!`nf;q=2!xJ%)6F#leDE>fvw+xH{!h^1+|90NI)l zJ=7R~0!#TA+H)QCd ze9^Q^lrK*hXIc-}%}Q6zPeAp0V{Qc@mA1T9S0d%u7=E%sC|Uo(R=VthF>HUrNv51% zrr08MfVHV)rQDQIsgPn`++kqP+}3e#t9yicLBvjM99h6Q)llWa6Dk6cDwxW`49o}P z)ZuxVE1}&AlT0ylhWtR_Y=x*%>8p*&(p0^)PJ62@PMHc~(3Tz1q=XcI7z-KXwz2YY zlBLc=vs&q#ZR5N#NyBI5rO=?97(XB(p)_vwCq*5NA+f!Sf&~_691-f#yXGtBT^g~q zB{v7T+&Sy3hFuLyoN!(q!V+MpWo=qGXfn}Q;G6~HoPuSMX*xo+!(1q%B#vfQgpu24 zroyF|0eBlJZrt%ck0E>~sdnZ;5p_J45PCqL2>g!1Y`Sfk-Qn7#7D z>bcu)4y8C&cLm?U)z&C8iRn-OS~`0Pym=b6dWmcEa{uc+hn05rg3@g7z|=-0rr#(7R3^=%*}AP8%mC!p2S`0`@Jec8%rt6M+31BbfFvUg6nA247gfOk@v*ap?AcCB+d)LR^Wnu1~4U%Mlt` zQ?`L(%}17Xh0ecp>}uPLba4y?fR}`HQK!oN#f?`jzb#6r|z6yp|Fy1eaXyG)it)^YGIXrXQWFny`9&|TI>s$LQV5~ zHmGo2e;z=|msS=tC~%Q;dR` zy@%tSgU~zGvoEyAr{?^j;~Q;5iH||)YWgn z^z(VH2wgP~am3G;ngK7Hxw#GodKup1 zR|%foa=AJL3S#9{23QiD`%F~9`5ZDB(z%Hb5K2CK3d|wxYXLNTvG&qt0vVgkYtT(B zYuCDeN@uHC#91*-8_=rcv6$CISWKp3Bg2d+V!DPKxsvkCkB1CvX$W;#uRowA95YEB z;$s$48WhHxP19#a9`)z;Ul}I>Gr_AzMn$({%jeN7?9pfjEl^yTwWsn=+0iXa_p=xG zoZ1WYNmMF^P_vV4@Gjj0o>;v%>BJ1COVC+c_!lRJ&>+tq9%8}#6u6Vn_+3%J_eK4Z zDAPG)WW%Z#8rn!3+9L)n9%HZr9{kCb2u|ob&DJQfaEpeeWy{u zD&pEp$K-5vHyb0kfSdAS)9fSWClTfSXyg^H(ycziG{v(O(v{YZgr0Xzvn#Mro67UxX18(lVwNE29gN(pX^a|j_*t=JO+VPlWjIf-b&B zOkYHbSRP>)_?v-!l-3v)?cecEfTz`_HdFhI-=xJmZ0!UM$hR4&Dz#Tk=*^niyheWM z#GsmG-#H{>?9K^X2?V$tA&f8_)r?h~ZOQUF(M^??h87>~iJ~j2Xw)=vYP$pMm)mgr z)h#OFc;~>S*c63g*bL%26=BAwuXK{ z2*Qg-+$9GYQftYr@Sa~HD?P2Gu?A@5`-pc;+PHRBK7fhw6Bg=BcCqqN#m!7X+6^j& zpH)9-J*+&BzS>_(Ar;tO9k%VokuPK|laxY9spOo6Er-!bKAFlzekMMB*=<;!{6)s5 zK{s4X!G96IgV%g5e?mYlv0tGH8uK*s^@=>*nNje!)ZtacoK!_8Ltr8t1~7 zQHz}|Ge)nkj|*ph7Yi}>7p5+)72ClYVQK*|Ke(CJPXC`k`<F zctn>_QLhO@%)RK-sRL^`3mqEyGmb7?YyEAm<=y2~&*#^gKEQU&eu;s)G&nHq7+P1W z?vP+= zG$n#fh)ga@LKEcHh5`bKPnX`<_X0@VnnQ2z02^GrHosFGZSuhjJwmnH^#UWg!I%J> z;aYwBY;%=r{B*0FMWhAqAiBpmrg|VL)2)cR{*+6Y zh)=UZ6Xz2`d%!8WMJ@4I744r&@@(FKn4bT+6By4g-cgq&9JABukgFQAm-%VaP3Pml zqY8^14s+lDh3*x^isGi=O=(NolI~7Wj0P_}nCq%#T>^GG{2nKd&c`A8Llb<8BJ0jy zGd1=}rxBpX{hO_zEQ=kT+X)hMgr_8fMa00G{_~ho5{Wi3*xU+UDAuwPu2kQ(*DHo; zL3==b&hY5>W^>(e;r17q`AQJOGjrsau=ez+ei55bzJLMFo}rtw!JrM9!g#LMrEPq( zWyKjmsDNm>A~kfro4{ArlM~zu0lX; zIiYWn8(`+-T$Bk6_Lxs?e5i-aID9yl=`w5YJa{BXBTd2JfQ;$BXsHq0oW0nnA!@@$a=XQJ&`KXBA(U7wjjB7u(^dHYr~$MlHx*Orvwbw3}MKIfqfA!s#f zguE)V+^(eb5TaZ76UYg5o!Tf^HbyaaENyMp%8mnv@2lhqSKM}OP1ALzCsRHh7e75d zxXwTliY)kC2U>q9XOXw2AQ!gU&_o>t2Bnk#u#$6op*3Pk|$gI%J?^ z?d5NMGP9{`SetRmw9GioztcU=g;mzu%(ppn^>!}Fpx}?hL?ibTo-&x)vY%tvbb%jI zc|u)5BZc-1K;zxav_3{(tL&zokDxD{V)-=Re@zIH0u?)$FuZ?=J2|@Le$uW)sVc?P z;Po#C60iAW2O<+I_v%@1gGjEWMaF8xwM~U^rP;F2MpE~k{5@{^?v-H+OZ=N0-pUOu zF(~K|jcMkWQ8KA|%;G{mA9G89vd{uPnSXqx(?iO!D33b^Un9*-3c#sJ7!7?9?R)be zJC)89usB_}YOB9wH2Q`@cf5I5?};ybV`240`-%Cslj@(QTsq$HDWO0;sOg>KC} z{LPzS`xbmqGab3fd5tW#SqL%4^W~5aHzY@R-*>OXYq0HH0|RE`B)hwtYuWvguSa3Y z`ILD3cDF1vi{!JfYX@l4xAT0h%BH8v(;(LBe(1<%3!?9tA(Q=0Q73;|{iD|nV`1*F ze?G`fUoxQ7%>J~*>)|%(+t?|fFzj|Tv|GgJJ*~uW{c(SoXBw9+2mcEg0OOY6zw+~c zbnX8WeEvTP?*HQFKf3WhHu68s9c(`Uo$0>==uH0!ptJt?$^RRm)Bl|Qdw@>=-vV^? zf7hXznHm3s)clXUtn?!-|3k_R|4l#s7x%XM&!X|aG-I0|xA?~^{+B}R@Q*kA@1F2~ zv4h?JlN9`K6)OJ$KL3YerT=p&n3p`aQD;8Euo zVBTKMA99IirO4myZ}(l(n0-+JO+@@O{sPbNz3U=(zEfMJ0h7%9`il{za!b)2+~IQJ z<39ICZ8N*_OCTlTK`GVL zXu6f9!Qg125~l%<$2zAfjVRqP_b-#F)ik@)bTLi)+y?#>ClV+)nN_Y>L+mWZ4aIb| zj72n19A{w3(z!)7Rvv9HHEG8LjzbeOw`<{r{IsVQ(%kv|E8YNNB#{UaV~zX`a=fY4 zqbNS0Xy%*=;VNk4tlT8z61leSy2IXDQO!&iFVN_)X0)_5^*nSb@QDoRdexe>f_d(Q zwfsX&BWO=s-w3F=;6uW%f_+@89yGw~S;#DyxPmdnDLKtp!aiU}>Lx-Drw z*DQgVSIRx^PsEbNEd%&+zX0$B(6Di_jq>D#rbVr$_oOoztTMm!==f6yTPdL(mmAi_ zVhhF=AVgX}sU6JLy=nhB*jw`vLA`0NTCrdCTcOs@A=ScYt_ijNlALKth%U zB)=T5=iggm!(&VI3LV5yLIucHv7nw}U5`Iqakgg+`0#>|mB!{NqK_={z&S$~qQ6h8 z`yT=BZV*qI!X=8{DI^JuaKbNE|B58D|Ti=LRk!NT5!Rz3zi+0YB_!Dxd6J| zSX4{q%<4{~KeBir%ZA#ay80lPd%-GQpkFC0dCnTotV|+vN@y4%{C<|Vka5U7xq8|r z)!d(KRLGJ2N|-#(E&*0_7KGe#-D6R}-mK2Zd5B6OMPcRoTdsv0K%GcQUB*$1ppe#o zSKlrI%z7oZLyx4}SL&GM7aM$oCE&O@uWv2vp(l4&&p~FnkUc_t)eOZKPBM{Vxs8ts zU;#Ljwk%cwgXJ-)oI%~s>b1_Z7XXZoc9Lp*lbLRZcKjyR3ky4&;uo%Ofyy}8ETEa% z)*IQ_qJ^HX2!Qc8N)P*0oC`m22t2}{-Kk$@TL9k$f;fiQF}MD7BG$T-`|9wp#L(ThbihyTN)$kd@Jsc|N?0xl6^>SMbc4#;1GJ+Xa>(vwJd&i6q zWU76~tc+Otz#bqsU1`PT32?8@zQX|Dz#`HOhFvf>wFQFePPwv8w%*vY+OnA+rV(;+ zo>^l#`q$*6zOoEz#nzzM*h#=)$dT!kGp^??SZWwz=PRX7dkX zl7bk1p>Adj5n?sA+!@Y?!?(IGlR}ao#VYWW;?0c*dF_rj^7jRhyqdta4sVq-$$0>k zk|Ip3L-7~!_2Yu>64KqJ_Xn>;d|9p1u)5rAD*x?%p}2eyM9J8gj&8o7#O)=DbSD7rNXp!8_$&jFH*PW!&YKA=Gow=L>j z1yxi4nww}?qy7f-(8^&Dv8*qn9;a7dX8~qLF>u-rUCTtcDbZseTXz)p1Z*p?dpSb; z)XVM>cXozng$1f_5~yL-kTJnAme+`O^P<8^4&@A-!YKfML!6@`N2TGP(Dmkf%?xkY zOvDR$#G6>8cw1d69R{Zdj7(0N4nfE|sM74h{+R%K&ikg%ngcIUs>%hm%?>SUt?FQT zEp`K@h~+kYRQE$Cw?;J{2W-r!z)N{`1PDL+lWfN2VLb4ASZrDL;bR}ONTNwKu$=w| zP-FdOHDAm0#f+u1@3fg!Qh@ge+T#(l(ZyUq<$Y&ccA%tsYsb|E$NZ`>B($8<3~D|$ zP~ie5OYz8FJ|n=nPq_y4l|Nd8p!xr4?cBqm&fWkXC8ARHx3ybhQVcPd@Ao_R%#<~h ze(sk-s9|Q9jF~YrB2lD}%XU{TU8$%@q_R>;D%YYU$|cc77p%}l>vx7~8{@aTf9yOS z&(}Ne`=0l_=RIeh=Zy0?Zu|p{I9qzD1@(OL_7?kG%W5+h$@COz|77y)&sJw!j^1j? zYtSuxq~8~5Yu`Qf!B$lKrufR~W*_bw=5JSdey>d}?Ui_qplw?!{g>gaeSzH{MM*v=?!<+oqv%%7~JxKEq?J- z^L^$dZ0Ec14=+1@UK%~;l(9-(Sme$MK1JH<*oTz zmy?RQ&0F-r;v8{E&*63Yww==?ZJQ3LmNBlV)@y{OfoHKae9@vI89LD;u9P>2VSTVTc+;jVz%bP?fnf`W2Tf2rS{DF0d^(Qt(m#M zwf(+;Tr)AR#J|qxkbBi$DF0Ip(0T3JD`8jgtMlwG#d^#ksqU>; z){S0UaV|Q^u)DBjv8eX=v7*}7n`@Ona%}Y~m93|T+qgM7cw!CgZukpvE%UUzOio_# ztz39SEAw&}xAS^P*wr0jgI#~^dlILG`|uAG)UU=Id8z#i}bM8+U1c{&?M2*I_uhJ^C%Jdustg zPHQKfuD5ecyIAvl*ne$W*T)kZl+W*q;>@G=&TX&Vq8~unrXkI4Fxd3cyBodBUJ9cU&TUt7RdP#<(@Xa{y|40g0c~klzmD+Wy>8yI$2RL# z@6G%$!`4+Bx8it`wnk1z`08vGU#nsZ!QK-`6FtgEK2vt?+_1@N@Ws->VvR5;JkH5r z=9IY9GS4^J*#|vc-f*7S-v0P9t3~u+`zE!+;WMheY-Zn8Ni#ce^NhDq8EubRW<-;kQ37mr5HO?)&eMPIG19G<83{cfEKD zz9G!&nMEZn*;UtuA?9v9 zy;Z2Ez0tXNgGH_jP8eWzDrXV$4X1GCrxa~#;Yuc&HksaSu;17iZ@12wd5BCoGygyR zWzG?gs*W8#=5VBRb8dZ2>GgM8A6E4mzJImQW4o`kqt~*EpI^>~=XPoxyvhB+W!#_=qS$fBNAif1McFtm7O0S%|V<2(OrQwo7 z#?l8HrRsoma@(@cFnqgPR?~l@m$BV?s*>mWG}s<~p`3AcWlXc3|89G$oZb#1A z5u0mP%LqL-crQQfV$9D;>95U2pVgRj`^e*gEw=~~?-!PnI=q7ji*De2)1BwLXSU#Q zNmDvbsV`lbnifP!jpo!vaq2$DSXZ3>ePiXaE5H3Q&w9w*V1HhiAijj3zYflNlX-+T z(|Nak_3oUKKWfS~!Ys0_&p4#onC@DB{GM{1pSV8c6Y9BPhf_gu3pV)L+xFjv)@zDV z(>##rO78yK3ai|=SoHq5a_~-KR7q*TvZ9IR4;{M_-Q%m{`Wx2frbI-a>8X6wq#SwS zNmb2_gXR0EDnnILtE4syu}Y==P)F6z0X=VKQtBrfN2MfXw%X0B#vb);cX}l;SyY?4 z&CtEz$Gy9@aCr@)!J~I@PvQo#2okM-CiB%iURjU4tefNd9nnMHT%`ugawz1sIC3eUQJ;HuTXhkksYk1RzGvJd}L!-+r z8+lvB@2^g=m@%vxZO>6w+;AD;dw##;@)hj+CqT^A#`-Hg41&nSZ~vukx+DbbQ2_E9 z%A4cM6VTD!MOV=%9-EF{MYO@&h|D>Dyyc-{j#H?uvrnkM50#Bx!caF|!UD*54km;p z!f;2hWfBws$kFx89jz_(WC|g)kN{Bt;0vQd0{8+6ErgC9F`1bCQ zdz4ftTq{LKp}!L2<jKKb_tfE2AWi@Tcq{-$29>!B(gaC@c9gjzYAD{-N%im~xDPP0! z3fzdn_;O+_M9ksJNTy_US!IpBP$VJ|F#NfwQ5iyjNZ?SB?1d71krBbo9Dq41CqoE$ z8R%VJ29snIRXG_R4^co)U`qmcYPmKbAOyr# zIT=Dg6yrni3b_Kd3T;5+<^^Gh5z#D%zZc;G|z-7hYUKte5i5JQN>ktZD_ag+CLV$1L z98owc0au6u2H?60oD~zb+SC#-%$Wpp62v4}kPrgJj6#G+AWAZmX=XuY!i>My@RVIQ YA(67g(viiFNCC$H)%Eo)>@3y)2MrR7;Q#;t literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-controller.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-controller.8.txt new file mode 100644 index 00000000..b72fd396 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-controller.8.txt @@ -0,0 +1,782 @@ +ovn-controller(8) OVN Manual ovn-controller(8) + +NAME + ovn-controller - Open Virtual Network local controller + +SYNOPSIS + ovn-controller [options] [ovs-database] + +DESCRIPTION + ovn-controller is the local controller daemon for OVN, the Open Virtual + Network. It connects up to the OVN Southbound database (see ovn-sb(5)) + over the OVSDB protocol, and down to the Open vSwitch database (see + ovs-vswitchd.conf.db(5)) over the OVSDB protocol and to ovs-vswitchd(8) + via OpenFlow. Each hypervisor and software gateway in an OVN deployment + runs its own independent copy of ovn-controller; thus, ovn-controllerā€™s + downward connections are machine-local and do not run over a physical + network. + +ACL LOGGING + ACL log messages are logged through ovn-controllerā€™s logging mechanism. + ACL log entries have the module acl_log at log level info. Configuring + logging is described below in the Logging Options section. + +OPTIONS + Daemon Options + --pidfile[=pidfile] + Causes a file (by default, program.pid) to be created indicating + the PID of the running process. If the pidfile argument is not + specified, or if it does not begin with /, then it is created in + . + + If --pidfile is not specified, no pidfile is created. + + --overwrite-pidfile + By default, when --pidfile is specified and the specified pidā€ + file already exists and is locked by a running process, the daeā€ + mon refuses to start. Specify --overwrite-pidfile to cause it to + instead overwrite the pidfile. + + When --pidfile is not specified, this option has no effect. + + --detach + Runs this program as a background process. The process forks, + and in the child it starts a new session, closes the standard + file descriptors (which has the side effect of disabling logging + to the console), and changes its current directory to the root + (unless --no-chdir is specified). After the child completes its + initialization, the parent exits. + + --monitor + Creates an additional process to monitor this program. If it + dies due to a signal that indicates a programming error (SIGAā€ā€ + BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, + or SIGXFSZ) then the monitor process starts a new copy of it. If + the daemon dies or exits for another reason, the monitor process + exits. + + This option is normally used with --detach, but it also funcā€ + tions without it. + + --no-chdir + By default, when --detach is specified, the daemon changes its + current working directory to the root directory after it deā€ + taches. Otherwise, invoking the daemon from a carelessly chosen + directory would prevent the administrator from unmounting the + file system that holds that directory. + + Specifying --no-chdir suppresses this behavior, preventing the + daemon from changing its current working directory. This may be + useful for collecting core files, since it is common behavior to + write core dumps into the current working directory and the root + directory is not a good directory to use. + + This option has no effect when --detach is not specified. + + --no-self-confinement + By default this daemon will try to self-confine itself to work + with files under well-known directories determined at build + time. It is better to stick with this default behavior and not + to use this flag unless some other Access Control is used to + confine daemon. Note that in contrast to other access control + implementations that are typically enforced from kernel-space + (e.g. DAC or MAC), self-confinement is imposed from the user- + space daemon itself and hence should not be considered as a full + confinement strategy, but instead should be viewed as an addiā€ + tional layer of security. + + --user=user:group + Causes this program to run as a different user specified in + user:group, thus dropping most of the root privileges. Short + forms user and :group are also allowed, with current user or + group assumed, respectively. Only daemons started by the root + user accepts this argument. + + On Linux, daemons will be granted CAP_IPC_LOCK and + CAP_NET_BIND_SERVICES before dropping root privileges. Daemons + that interact with a datapath, such as ovs-vswitchd, will be + granted three additional capabilities, namely CAP_NET_ADMIN, + CAP_NET_BROADCAST and CAP_NET_RAW. The capability change will + apply even if the new user is root. + + On Windows, this option is not currently supported. For security + reasons, specifying this option will cause the daemon process + not to start. + + Logging Options + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + + PKI Options + PKI configuration is required in order to use SSL for the connections + to the Northbound and Southbound databases. + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + --bootstrap-ca-cert=cacert.pem + When cacert.pem exists, this option has the same effect + as -C or --ca-cert. If it does not exist, then the exeā€ + cutable will attempt to obtain the CA certificate from + the SSL peer on its first SSL connection and save it to + the named PEM file. If it is successful, it will immediā€ + ately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certifiā€ + cate signed by the CA certificate thus obtained. + + This option exposes the SSL connection to a man-in-the- + middle attack obtaining the initial CA certificate, but + it may be useful for bootstrapping. + + This option is only useful if the SSL peer sends its CA + certificate as part of the SSL certificate chain. The SSL + protocol does not require the server to send the CA cerā€ + tificate. + + This option is mutually exclusive with -C and --ca-cert. + + --peer-ca-cert=peer-cacert.pem + Specifies a PEM file that contains one or more additional + certificates to send to SSL peers. peer-cacert.pem should + be the CA certificate used to sign the programā€™s own cerā€ + tificate, that is, the certificate specified on -c or + --certificate. If the programā€™s certificate is self- + signed, then --certificate and --peer-ca-cert should + specify the same file. + + This option is not useful in normal operation, because + the SSL peer must already have the CA certificate for the + peer to have any confidence in the programā€™s identity. + However, this offers a way for a new installation to + bootstrap the CA certificate on its first SSL connection. + + Other Options + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +CONFIGURATION + ovn-controller retrieves most of its configuration information from the + local Open vSwitchā€™s ovsdb-server instance. The default location is + db.sock in the local Open vSwitchā€™s "run" directory. It may be overridā€ + den by specifying the ovs-database argument as an OVSDB active or pasā€ + sive connection method, as described in ovsdb(7). + + ovn-controller assumes it gets configuration information from the folā€ + lowing keys in the Open_vSwitch table of the local OVS instance: + + external_ids:system-id + The chassis name to use in the Chassis table. Changing + the system-id while ovn-controller is running is not diā€ + rectly supported. Users have two options: either first + gracefully stop ovn-controller or manually delete the + stale Chassis and Chassis_Private records after changing + the system-id. Note that the chassis name can also be + provided via the system-id-override file in the local OVN + "etc" directory or via the -n command-line option. The + following precedence is used: first, the command-line opā€ + tion is read; if not present, the system-id-override file + is read; if not present, then the name configured in the + database is used. + + external_ids:hostname + The hostname to use in the Chassis table. + + external_ids:ovn-bridge + The integration bridge to which logical ports are atā€ + tached. The default is br-int. If this bridge does not + exist when ovn-controller starts, it will be created auā€ + tomatically with the default configuration suggested in + ovn-architecture(7). When more than one controllers are + running on the same host, external_ids:ovn-bridge-CHASā€ā€ + SIS_NAME should be set for each of them, pointing to a + unique bridge. This is required to avoid controllers + stepping on each othersā€™ feet. + + external_ids:ovn-bridge-datapath-type + This configuration is optional. If set, then the datapath + type of the integration bridge will be set to the configā€ + ured value. If this option is not set, then ovn-conā€ā€ + troller will not modify the existing datapath-type of the + integration bridge. + + external_ids:ovn-remote + The OVN database that this system should connect to for + its configuration, in one of the same forms documented + above for the ovs-database. + + external_ids:ovn-monitor-all + A boolean value that tells if ovn-controller should moniā€ + tor all records of tables in ovs-database. If set to + false, it will conditionally monitor the records that is + needed in the current chassis. + + It is more efficient to set it to true in use cases where + the chassis would anyway need to monitor most of the + records in OVN Southbound database, which would save the + overhead of conditions processing, especially for server + side. Typically, set it to true for environments that all + workloads need to be reachable from each other. + + Default value is false. + + external_ids:ovn-remote-probe-interval + The inactivity probe interval of the connection to the + OVN database, in milliseconds. If the value is zero, it + disables the connection keepalive feature. + + If the value is nonzero, then it will be forced to a + value of at least 1000 ms. + + external_ids:ovn-openflow-probe-interval + The inactivity probe interval of the OpenFlow connection + to the OpenvSwitch integration bridge, in seconds. If the + value is zero, it disables the connection keepalive feaā€ + ture. + + If the value is nonzero, then it will be forced to a + value of at least 5s. + + external_ids:ovn-encap-type + The encapsulation type that a chassis should use to conā€ + nect to this node. Multiple encapsulation types may be + specified with a comma-separated list. Each listed encapā€ + sulation type will be paired with ovn-encap-ip. + + Supported tunnel types for connecting hypervisors and + gateways are geneve, vxlan, and stt. + + Due to the limited amount of metadata in vxlan, the capaā€ + bilities and performance of connected gateways and hyperā€ + visors will be reduced versus other tunnel formats. + + external_ids:ovn-encap-ip + The IP address that a chassis should use to connect to + this node using encapsulation types specified by exterā€ā€ + nal_ids:ovn-encap-type. + + external_ids:ovn-encap-df_default + indicates the DF flag handling of the encapulation. Set + to true to set the DF flag for new data paths or false to + clear the DF flag. + + external_ids:ovn-bridge-mappings + A list of key-value pairs that map a physical network + name to a local ovs bridge that provides connectivity to + that network. An example value mapping two physical netā€ + work names to two ovs bridges would be: physā€ā€ + net1:br-eth0,physnet2:br-eth1. + + external_ids:ovn-encap-csum + ovn-encap-csum indicates that encapsulation checksums can + be transmitted and received with reasonable performance. + It is a hint to senders transmitting data to this chassis + that they should use checksums to protect OVN metadata. + Set to true to enable or false to disable. Depending on + the capabilities of the network interface card, enabling + encapsulation checksum may incur performance loss. In + such cases, encapsulation checksums can be disabled. + + external_ids:ovn-encap-tos + ovn-encap-tos indicates the value to be applied to OVN + tunnel interfaceā€™s option:tos as specified in the + Open_vSwitch database Interface table. Please refer to + Open VSwitch Manual for details. + + external_ids:ovn-cms-options + A list of options that will be consumed by the CMS Plugin + and which specific to this particular chassis. An example + would be: cms_option1,cms_option2:foo. + + external_ids:ovn-transport-zones + The transport zone(s) that this chassis belongs to. + Transport zones is a way to group different chassis so + that tunnels are only formed between members of the same + group(s). Multiple transport zones may be specified with + a comma-separated list. For example: tz1,tz2,tz3. + + If not set, the Chassis will be considered part of a deā€ + fault transport zone. + + external_ids:ovn-chassis-mac-mappings + A list of key-value pairs that map a chassis specific mac + to a physical network name. An example value mapping two + chassis macs to two physical network names would be: + physnet1:aa:bb:cc:dd:ee:ff,physnet2:a1:b2:c3:d4:e5:f6. + These are the macs that ovn-controller will replace a + router port mac with, if packet is going from a distribā€ + uted router port on vlan type logical switch. + + external_ids:ovn-is-interconn + The boolean flag indicates if the chassis is used as an + interconnection gateway. + + external_ids:ovn-match-northd-version + The boolean flag indicates if ovn-controller needs to + check ovn-northd version. If this flag is set to true and + the ovn-northdā€ā€™s version (reported in the Southbound + database) doesnā€™t match with the ovn-controllerā€ā€™s interā€ + nal version, then it will stop processing the southbound + and local Open vSwitch database changes. The default + value is considered false if this option is not defined. + + external_ids:ovn-ofctrl-wait-before-clear + The time, in milliseconds, to wait before clearing flows + in OVS after OpenFlow connection/reconnection during + ovn-controller initialization. The purpose of this wait + is to give time for ovn-controller to compute the new + flows before clearing existing ones, to avoid data plane + down time during ovn-controller restart/upgrade at large + scale environments where recomputing the flows takes more + than a few seconds or even longer. It is difficult for + ovn-controller to determine when the new flows computing + is completed, because of the dynamics in the cloud enviā€ + ronments, which is why this configuration is provided for + users to adjust based on the scale of the environment. By + default, it is 0, which means clearing existing flows + without waiting. Not setting the value, or setting it too + small, may result in data plane down time during upā€ + grade/restart, while setting it too big may result in unā€ + necessary extra control plane latency of applying new + changes of CMS during upgrade/restart. In most cases, a + slightly bigger value is not harmful, because the extra + control plane latency happens only once during the Openā€ + Flow connection. To get a reasonable range of the value + setting, it is recommended to run the below commands on a + node in the target environment and then set this configuā€ + ration to twice the value of Maximum shown in the output + of the second command. + + ā€¢ ovn-appctl -t ovn-controller inc-engine/recompute + + ā€¢ ovn-appctl -t ovn-controller stopwatch/show + flow-generation + + external_ids:ovn-enable-lflow-cache + The boolean flag indicates if ovn-controller should enā€ + able/disable the logical flow in-memory cache it uses + when processing Southbound database logical flow changes. + By default caching is enabled. + + external_ids:ovn-limit-lflow-cache + When used, this configuration value determines the maxiā€ + mum number of logical flow cache entries ovn-controller + may create when the logical flow cache is enabled. By deā€ + fault the size of the cache is unlimited. + + external_ids:ovn-memlimit-lflow-cache-kb + When used, this configuration value determines the maxiā€ + mum size of the logical flow cache (in KB) ovn-controller + may create when the logical flow cache is enabled. By deā€ + fault the size of the cache is unlimited. + + external_ids:ovn-trim-limit-lflow-cache + When used, this configuration value sets the minimum numā€ + ber of entries in the logical flow cache starting with + which automatic memory trimming is performed. By default + this is set to 10000 entries. + + external_ids:ovn-trim-wmark-perc-lflow-cache + When used, this configuration value sets the percentage + from the high watermark number of entries in the logical + flow cache under which automatic memory trimming is perā€ + formed. E.g., if the trim watermark percentage is set to + 50%, automatic memory trimming happens only when the numā€ + ber of entries in the logical flow cache gets reduced to + less than half of the last measured high watermark. By + default this is set to 50. + + external_ids:ovn-trim-timeout-ms + When used, this configuration value specifies the time, + in milliseconds, since the last logical flow cache operaā€ + tion after which ovn-controller performs memory trimming + regardless of how many entries there are in the cache. By + default this is set to 30000 (30 seconds). + + external_ids:ovn-set-local-ip + The boolean flag indicates if ovn-controller when create + tunnel ports should set local_ip parameter. Can be heplā€ + ful to pin source outer IP for the tunnel when multiple + interfaces are used on the host for overlay traffic. This + is also useful when running multiple ovn-controller inā€ + stances on the same chassis, in which case this setting + will guarantee that their tunnel ports have unique conā€ + figuration and can exist in parallel. + + external_ids:garp-max-timeout-sec + When used, this configuration value specifies the maximum + timeout (in seconds) between two consecutive GARP packets + sent by ovn-controller. ovn-controller by default sends + just 4 GARP packets with an exponential backoff timeout. + Setting external_ids:garp-max-timeout-sec allows to cap + for the exponential backoff used by ovn-controller to + send GARPs packets. + + Most of configuration options listed above can also be set for a parā€ + ticular chassis name (see external_ids:system-id for more informaā€ + tion). This can be achieved by setting external_ids:option-[chassis] + instead of external_ids:option. For example, set external_ids:ovn-enā€ā€ + cap-ip-otherhv to use a particular IP address for the controller inā€ + stance named otherhv. Name specific configuration options always overā€ + ride any global options set in the database. + + Chassis-specific configuration options in the database plus the ability + to configure the chassis name to use via the system-id-override file or + command line allows to run multiple ovn-controller instances with + unique chassis names on the same host using the same vswitchd instance. + This may be useful when running a hybrid setup with more than one CMS + managing ports on the host, or to use different datapath types on the + same host. Make sure you also set external_ids:ovn-set-local-ip when + using such configuration. Also note that this ability is highly experiā€ + mental and has known limitations (for example, stateful ACLs are not + supported). Use at your own risk. + + ovn-controller reads the following values from the Open_vSwitch dataā€ + base of the local OVS instance: + + datapath-type from Bridge table + This value is read from local OVS integration bridge row + of Bridge table and populated in other_config:datapath- + type of the Chassis table in the OVN_Southbound database. + + iface-types from Open_vSwitch table + This value is populated in external_ids:iface-types of + the Chassis table in the OVN_Southbound database. + + private_key, certificate, ca_cert, and bootstrap_ca_cert from + SSL table + These values provide the SSL configuration used for conā€ + necting to the OVN southbound database server when an SSL + connection type is configured via external_ids:ovn-reā€ā€ + mote. Note that this SSL configuration can also be proā€ + vided via command-line options, the configuration in the + database takes precedence if both are present. + +OPEN VSWITCH DATABASE USAGE + ovn-controller uses a number of external_ids keys in the Open vSwitch + database to keep track of ports and interfaces. For proper operation, + users should not change or clear these keys: + + external_ids:ovn-chassis-id in the Port table + The presence of this key identifies a tunnel port within + the integration bridge as one created by ovn-controller + to reach a remote chassis. Its value is the chassis ID of + the remote chassis. + + external_ids:ct-zone-* in the Bridge table + Logical ports and gateway routers are assigned a connecā€ + tion tracking zone by ovn-controller for stateful serā€ + vices. To keep state across restarts of ovn-controller, + these keys are stored in the integration bridgeā€™s Bridge + table. The name contains a prefix of ct-zone- followed by + the name of the logical port or gateway routerā€™s zone + key. The value for this key identifies the zone used for + this port. + + external_ids:ovn-localnet-port in the Port table + The presence of this key identifies a patch port as one + created by ovn-controller to connect the integration + bridge and another bridge to implement a localnet logical + port. Its value is the name of the logical port with type + set to localnet that the port implements. See exterā€ā€ + nal_ids:ovn-bridge-mappings, above, for more information. + + Each localnet logical port is implemented as a pair of + patch ports, one in the integration bridge, one in a difā€ + ferent bridge, with the same external_ids:ovn-localā€ā€ + net-port value. + + external_ids:ovn-l2gateway-port in the Port table + The presence of this key identifies a patch port as one + created by ovn-controller to connect the integration + bridge and another bridge to implement a l2gateway logiā€ + cal port. Its value is the name of the logical port with + type set to l2gateway that the port implements. See exā€ā€ + ternal_ids:ovn-bridge-mappings, above, for more informaā€ + tion. + + Each l2gateway logical port is implemented as a pair of + patch ports, one in the integration bridge, one in a difā€ + ferent bridge, with the same external_ids:ovn-l2gateā€ā€ + way-port value. + + external-ids:ovn-l3gateway-port in the Port table + This key identifies a patch port as one created by + ovn-controller to implement a l3gateway logical port. Its + value is the name of the logical port with type set to + l3gateway. This patch port is similar to the OVN logical + patch port, except that l3gateway port can only be bound + to a particular chassis. + + external-ids:ovn-logical-patch-port in the Port table + This key identifies a patch port as one created by + ovn-controller to implement an OVN logical patch port + within the integration bridge. Its value is the name of + the OVN logical patch port that it implements. + + external-ids:ovn-startup-ts in the Bridge table + This key represents the timestamp (in milliseconds) at + which ovn-controller process was started. + + external-ids:ovn-nb-cfg in the Bridge table + This key represents the last known OVN_Southā€ā€ + bound.SB_Global.nb_cfg value for which all flows have + been successfully installed in OVS. + + external-ids:ovn-nb-cfg-ts in the Bridge table + This key represents the timestamp (in milliseconds) of + the last known OVN_Southbound.SB_Global.nb_cfg value for + which all flows have been successfully installed in OVS. + + external_ids:ovn-installed and external_ids:ovn-installed-ts in + the Interface table + This key is set after all openflow operations correspondā€ + ing to the OVS interface have been processed by ovs- + vswitchd. At the same time a timestamp, in milliseconds + since the epoch, is stored in external_ids:ovn-inā€ā€ + stalled-ts. + +OVN SOUTHBOUND DATABASE USAGE + ovn-controller reads from much of the OVN_Southbound database to guide + its operation. ovn-controller also writes to the following tables: + + Chassis + Upon startup, ovn-controller creates a row in this table + to represent its own chassis. Upon graceful termination, + e.g. with ovs-appctl -t ovn-controller exit (but not + SIGTERM), ovn-controller removes its row. + + Encap Upon startup, ovn-controller creates a row or rows in + this table that represent the tunnel encapsulations by + which its chassis can be reached, and points its Chassis + row to them. Upon graceful termination, ovn-controller + removes these rows. + + Port_Binding + At runtime, ovn-controller sets the chassis columns of + ports that are resident on its chassis to point to its + Chassis row, and, conversely, clears the chassis column + of ports that point to its Chassis row but are no longer + resident on its chassis. The chassis column has a weak + reference type, so when ovn-controller gracefully exits + and removes its Chassis row, the database server automatā€ + ically clears any remaining references to that row. + + MAC_Binding + At runtime, ovn-controller updates the MAC_Binding table + as instructed by put_arp and put_nd logical actions. + These changes persist beyond the lifetime of ovn-conā€ā€ + troller. + +RUNTIME MANAGEMENT COMMANDS + ovs-appctl can send commands to a running ovn-controller process. The + currently supported commands are described below. + + exit Causes ovn-controller to gracefully terminate. + + ct-zone-list + Lists each local logical port and its connection tracking + zone. + + meter-table-list + Lists each meter table entry and its local meter id. + + group-table-list + Lists each group table entry and its local group id. + + inject-pkt microflow + Injects microflow into the connected Open vSwitch inā€ + stance. microflow must contain an ingress logical port + (inport argument) that is present on the Open vSwitch inā€ + stance. + + The microflow argument describes the packet whose forā€ + warding is to be simulated, in the syntax of an OVN logiā€ + cal expression, as described in ovn-sb(5), to express + constraints. The parser understands prerequisites; for + example, if the expression refers to ip4.src, there is no + need to explicitly state ip4 or eth.type == 0x800. + + connection-status + Show OVN SBDB connection status for the chassis. + + recompute + Trigger a full compute iteration in ovn-controller based + on the contents of the Southbound database and local OVS + database. + + This command is intended to use only in the event of a + bug in the incremental processing engine in ovn-conā€ā€ + troller to avoid inconsistent states. It should therefore + be used with care as full recomputes are cpu intensive. + + sb-cluster-state-reset + Reset southbound database cluster status when databases + are destroyed and rebuilt. + + If all databases in a clustered southbound database are + removed from disk, then the stored index of all databases + will be reset to zero. This will cause ovn-controller to + be unable to read or write to the southbound database, + because it will always detect the data as stale. In such + a case, run this command so that ovn-controller will reā€ + set its local index so that it can interact with the + southbound database again. + + debug/delay-nb-cfg-report seconds + This command is used to delay ovn-controller updating the + nb_cfg back to OVN_Southbound database. This is useful + when ovn-nbctl --wait=hv is used to measure end-to-end + latency in a large scale environment. See ovn-nbctl(8) + for more details. + + lflow-cache/flush + Flushes the ovn-controller logical flow cache. + + lflow-cache/show-stats + Displays logical flow cache statistics: enabled/disabled, + per cache type entry counts. + + inc-engine/show-stats + Display ovn-controller engine counters. For each engine + node the following counters have been added: + + ā€¢ recompute + + ā€¢ compute + + ā€¢ abort + + inc-engine/show-stats engine_node_name counter_name + Display the ovn-controller engine counter(s) for the + specified engine_node_name. counter_name is optional and + can be one of recompute, compute or abort. + + inc-engine/clear-stats + Reset ovn-controller engine counters. + +OVN 23.06.3 ovn-controller ovn-controller(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ctl.8 b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8 new file mode 100644 index 00000000..002ebcb8 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8 @@ -0,0 +1,426 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-ctl" 8 "ovn-ctl" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-ctl \- Open Virtual Network northbound daemon lifecycle utility +.SH "SYNOPSIS" +.PP +.PP +\fBovn\-ctl\fR [\fIoptions\fR] \fIcommand\fR [\-- \fIextra_args\fR] +.SH "DESCRIPTION" +.PP +.PP +This program is intended to be invoked internally by Open Virtual Network startup scripts\[char46] System administrators should not normally invoke it directly\[char46] +.SH "COMMANDS" +.TP +\fBstart_northd\fR +.TQ .5in +\fBstart_controller\fR +.TQ .5in +\fBstart_controller_vtep\fR +.TQ .5in +\fBstart_ic\fR +.TQ .5in +\fBstop_northd\fR +.TQ .5in +\fBstop_controller\fR +.TQ .5in +\fBstop_controller_vtep\fR +.TQ .5in +\fBstop_ic\fR +.TQ .5in +\fBrestart_northd\fR +.TQ .5in +\fBrestart_controller\fR +.TQ .5in +\fBrestart_controller_vtep\fR +.TQ .5in +\fBrestart_ic\fR +.TQ .5in +\fBpromote_ovnnb\fR +.TQ .5in +\fBpromote_ovnsb\fR +.TQ .5in +\fBdemote_ovnnb\fR +.TQ .5in +\fBdemote_ovnsb\fR +.TQ .5in +\fBstatus_ovnnb\fR +.TQ .5in +\fBstatus_ovnsb\fR +.TQ .5in +\fBstart_ovsdb\fR +.TQ .5in +\fBstart_nb_ovsdb\fR +.TQ .5in +\fBstart_sb_ovsdb\fR +.TQ .5in +\fBstop_ovsdb\fR +.TQ .5in +\fBstop_nb_ovsdb\fR +.TQ .5in +\fBstop_sb_ovsdb\fR +.TQ .5in +\fBrestart_ovsdb\fR +.TQ .5in +\fBrun_nb_ovsdb\fR +.TQ .5in +\fBrun_sb_ovsdb\fR +.TQ .5in +\fBpromote_ic_nb\fR +.TQ .5in +\fBpromote_ic_sb\fR +.TQ .5in +\fBdemote_ic_nb\fR +.TQ .5in +\fBdemote_ic_sb\fR +.TQ .5in +\fBstatus_ic_nb\fR +.TQ .5in +\fBstatus_ic_sb\fR +.TQ .5in +\fBstart_ic_ovsdb\fR +.TQ .5in +\fBstart_ic_nb_ovsdb\fR +.TQ .5in +\fBstart_ic_sb_ovsdb\fR +.TQ .5in +\fBstop_ic_ovsdb\fR +.TQ .5in +\fBstop_ic_nb_ovsdb\fR +.TQ .5in +\fBstop_ic_sb_ovsdb\fR +.TQ .5in +\fBrestart_ic_ovsdb\fR +.TQ .5in +\fBrun_ic_nb_ovsdb\fR +.TQ .5in +\fBrun_ic_sb_ovsdb\fR +.SH "OPTIONS" +.PP +\fB\-\-ovn\-northd\-priority=\fINICE\fB\fR +.PP +\fB\-\-ovn\-northd\-wrapper=\fIWRAPPER\fB\fR +.PP +\fB\-\-ovn\-controller\-priority=\fINICE\fB\fR +.PP +\fB\-\-ovn\-controller\-wrapper=\fIWRAPPER\fB\fR +.PP +\fB\-\-ovn\-ic\-priority=\fINICE\fB\fR +.PP +\fB\-\-ovn\-ic\-wrapper=\fIWRAPPER\fB\fR +.PP +\fB\-\-ovsdb\-nb\-wrapper=\fIWRAPPER\fB\fR +.PP +\fB\-\-ovsdb\-sb\-wrapper=\fIWRAPPER\fB\fR +.PP +\fB\-\-ovn\-user=\fIUSER:GROUP\fB\fR +.PP +\fB\-\-ovs\-user=\fIUSER:GROUP\fB\fR +.PP +\fB\-h\fR | \fB\-\-help\fR +.SH "FILE LOCATION OPTIONS" +.PP +\fB\-\-db\-sock=\fISOCKET\fB\fR +.PP +\fB\-\-db\-nb\-file=\fIFILE\fB\fR +.PP +\fB\-\-db\-sb\-file=\fIFILE\fB\fR +.PP +\fB\-\-db\-nb\-schema=\fIFILE\fB\fR +.PP +\fB\-\-db\-sb\-schema=\fIFILE\fB\fR +.PP +\fB\-\-db\-sb\-create\-insecure\-remote=\fIyes|no\fB\fR +.PP +\fB\-\-db\-nb\-create\-insecure\-remote=\fIyes|no\fB\fR +.PP +\fB\-\-db\-ic\-nb\-file=\fIFILE\fB\fR +.PP +\fB\-\-db\-ic\-sb\-file=\fIFILE\fB\fR +.PP +\fB\-\-db\-ic\-nb\-schema=\fIFILE\fB\fR +.PP +\fB\-\-db\-ic\-sb\-schema=\fIFILE\fB\fR +.PP +\fB\-\-db\-ic\-sb\-create\-insecure\-remote=\fIyes|no\fB\fR +.PP +\fB\-\-db\-ic\-nb\-create\-insecure\-remote=\fIyes|no\fB\fR +.PP +\fB\-\-ovn\-controller\-ssl\-key=\fIKEY\fB\fR +.PP +\fB\-\-ovn\-controller\-ssl\-cert=\fICERT\fB\fR +.PP +\fB\-\-ovn\-controller\-ssl\-ca\-cert=\fICERT\fB\fR +.PP +\fB\-\-ovn\-controller\-ssl\-bootstrap\-ca\-cert=\fICERT\fB\fR +.SH "ADDRESS AND PORT OPTIONS" +.PP +\fB\-\-db\-nb\-sync\-from\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-nb\-sync\-from\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-nb\-sync\-from\-proto=\fIPROTO\fB\fR +.PP +\fB\-\-db\-sb\-sync\-from\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-sb\-sync\-from\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-sb\-sync\-from\-proto=\fIPROTO\fB\fR +.PP +\fB\-\-db\-ic\-nb\-sync\-from\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-nb\-sync\-from\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-nb\-sync\-from\-proto=\fIPROTO\fB\fR +.PP +\fB\-\-db\-ic\-sb\-sync\-from\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-sb\-sync\-from\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-sb\-sync\-from\-proto=\fIPROTO\fB\fR +.PP +.PP +\fB +\-\-ovn\-northd\-nb\-db=\fIPROTO\fB:\fIIP ADDRESS\fB: +\fIPORT\fB\[char46]\[char46] +\fR +.PP +.PP +\fB +\-\-ovn\-northd\-sb\-db=\fIPROTO\fB:\fIIP ADDRESS\fB: +\fIPORT\fB\[char46]\[char46] +\fR +.PP +.PP +\fB +\-\-ovn\-ic\-nb\-db=\fIPROTO\fB:\fIIP ADDRESS\fB: +\fIPORT\fB\[char46]\[char46] +\fR +.PP +.PP +\fB +\-\-ovn\-ic\-sb\-db=\fIPROTO\fB:\fIIP ADDRESS\fB: +\fIPORT\fB\[char46]\[char46] +\fR +.SH "CLUSTERING OPTIONS" +.PP +\fB\-\-db\-nb\-cluster\-local\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-nb\-cluster\-local\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-nb\-cluster\-local\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-nb\-cluster\-remote\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-nb\-cluster\-remote\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-nb\-cluster\-remote\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-nb\-election\-timer=\fITimeout in milliseconds\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-local\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-local\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-local\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-remote\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-remote\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-sb\-cluster\-remote\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-sb\-election\-timer=\fITimeout in milliseconds\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-local\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-local\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-local\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-remote\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-remote\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-nb\-cluster\-remote\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-local\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-local\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-local\-proto=\fIPROTO (tcp/ssl)\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-remote\-addr=\fIIP ADDRESS\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-remote\-port=\fIPORT NUMBER\fB\fR +.PP +\fB\-\-db\-ic\-sb\-cluster\-remote\-proto=\fIPROTO (tcp/ssl)\fB\fR +.SH "PROBE INTERVAL OPTIONS" +.PP +\fB\-\-db\-nb\-probe\-interval\-to\-active=\fITime in milliseconds\fB\fR +.PP +\fB\-\-db\-sb\-probe\-interval\-to\-active=\fITime in milliseconds\fB\fR +.SH "EXTRA OPTIONS" +.PP +.PP +Any options after \(cq\-\(cq will be passed on to the binary run by \fIcommand\fR with the exception of start_northd, which can have options specified in ovn-northd-db-params\[char46]conf\[char46] Any \fIextra_args\fR passed to start_northd will be passed to the ovsdb-servers if \fB\-\-ovn\-manage\-ovsdb=yes\fR +.SH "CONFIGURATION FILES" +.PP +.PP +Following are the optional configuration files\[char46] If present, it should be located in the etc dir +.SS "ovnnb\-active\[char46]conf" +.PP +.PP +If present, this file should hold the url to connect to the active Northbound DB server +.PP +\fBtcp:x\[char46]x\[char46]x\[char46]x:6641\fR +.SS "ovnsb\-active\[char46]conf" +.PP +.PP +If present, this file should hold the url to connect to the active Southbound DB server +.PP +\fBtcp:x\[char46]x\[char46]x\[char46]x:6642\fR +.SS "ovn\-northd\-db\-params\[char46]conf" +.PP +.PP +If present, start_northd will not start the DB server even if \fB\-\-ovn\-manage\-ovsdb=yes\fR\[char46] This file should hold the database url parameters to be passed to ovn-northd\[char46] +.PP +\fB\-\-ovnnb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6641 \-\-ovnsb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6642\fR +.SS "ic\-nb\-active\[char46]conf" +.PP +.PP +If present, this file should hold the url to connect to the active Interconnection Northbound DB server +.PP +\fBtcp:x\[char46]x\[char46]x\[char46]x:6645\fR +.SS "ic\-sb\-active\[char46]conf" +.PP +.PP +If present, this file should hold the url to connect to the active Interconnection Southbound DB server +.PP +\fBtcp:x\[char46]x\[char46]x\[char46]x:6646\fR +.SS "ovn\-ic\-db\-params\[char46]conf" +.PP +.PP +If present, this file should hold the database url parameters to be passed to ovn-ic\[char46] +.PP +\fB\-\-ic\-nb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6645 \-\-ic\-sb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6646\fR +.SH "RUNNING OVN DB SERVERS WITHOUT DETACHING" +.PP +\fB# ovn\-ctl run_nb_ovsdb\fR +.PP +.PP +This command runs the OVN nb ovsdb-server without passing the \fBdetach\fR option, making it to block until ovsdb-server exits\[char46] This command will be useful for starting the OVN nb ovsdb-server in a container\[char46] +.PP +\fB# ovn\-ctl run_sb_ovsdb\fR +.PP +.PP +This command runs the OVN sb ovsdb-server without passing the \fBdetach\fR option, making it to block until ovsdb-server exits\[char46] This command will be useful for starting the OVN sb ovsdb-server in a container\[char46] +.PP +\fB# ovn\-ctl run_ic_nb_ovsdb\fR +.PP +.PP +This command runs the OVN IC-NB ovsdb-server without passing the \fBdetach\fR option, making it to block until ovsdb-server exits\[char46] This command will be useful for starting the OVN IC-NB ovsdb-server in a container\[char46] +.PP +\fB# ovn\-ctl run_ic_sb_ovsdb\fR +.PP +.PP +This command runs the OVN IC-SB ovsdb-server without passing the \fBdetach\fR option, making it to block until ovsdb-server exits\[char46] This command will be useful for starting the OVN IC-SB ovsdb-server in a container\[char46] +.SH "EXAMPLE USAGE" +.SS "Run ovn\-controller on a host already running OVS" +.PP +\fB# ovn\-ctl start_controller\fR +.SS "Run ovn\-northd on a host already running OVS" +.PP +\fB# ovn\-ctl start_northd\fR +.SS "All\-in\-one OVS+OVN for testing" +.PP +\fB# ovs\-ctl start \-\-system\-id=\(dqrandom\(dq\fR +.PP +\fB# ovn\-ctl start_northd\fR +.PP +\fB# ovn\-ctl start_controller\fR +.SS "Promote and demote ovsdb servers" +.PP +\fB# ovn\-ctl promote_ovnnb\fR +.PP +\fB# ovn\-ctl promote_ovnsb\fR +.PP +\fB# ovn\-ctl \-\-db\-nb\-sync\-from\-addr=x\[char46]x\[char46]x\[char46]x \-\-db\-nb\-sync\-from\-port=6641 \-\-db\-nb\-probe\-interval\-to\-active=60000 demote_ovnnb\fR +.PP +\fB# ovn\-ctl \-\-db\-sb\-sync\-from\-addr=x\[char46]x\[char46]x\[char46]x \-\-db\-sb\-sync\-from\-port=6642 \-\-db\-sb\-probe\-interval\-to\-active=60000 demote_ovnsb\fR +.SS "Creating a clustered db on 3 nodes with IPs x\[char46]x\[char46]x\[char46]x, y\[char46]y\[char46]y\[char46]y and z\[char46]z\[char46]z\[char46]z" +.ST "Starting OVN ovsdb servers and ovn-northd on the node with IP x\[char46]x\[char46]x\[char46]x" +.PP +.PP +\fB +# ovn\-ctl \-\-db\-nb\-addr=x\[char46]x\[char46]x\[char46]x \-\-db\-nb\-create\-insecure\-remote=yes +\-\-db\-sb\-addr=x\[char46]x\[char46]x\[char46]x \-\-db\-sb\-create\-insecure\-remote=yes +\-\-db\-nb\-cluster\-local\-addr=x\[char46]x\[char46]x\[char46]x +\-\-db\-sb\-cluster\-local\-addr=x\[char46]x\[char46]x\[char46]x +\-\-ovn\-northd\-nb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6641,tcp:y\[char46]y\[char46]y\[char46]y:6641,tcp:z\[char46]z\[char46]z\[char46]z:6641 +\-\-ovn\-northd\-sb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6642,tcp:y\[char46]y\[char46]y\[char46]y:6642,tcp:z\[char46]z\[char46]z\[char46]z:6642 +start_northd +\fR +.ST "Starting OVN ovsdb-servers and ovn-northd on the node with IP y\[char46]y\[char46]y\[char46]y and joining the cluster started at x\[char46]x\[char46]x\[char46]x" +.PP +.PP +\fB +# ovn\-ctl \-\-db\-nb\-addr=y\[char46]y\[char46]y\[char46]y \-\-db\-nb\-create\-insecure\-remote=yes +\-\-db\-sb\-addr=y\[char46]y\[char46]y\[char46]y \-\-db\-sb\-create\-insecure\-remote=yes +\-\-db\-nb\-cluster\-local\-addr=y\[char46]y\[char46]y\[char46]y +\-\-db\-sb\-cluster\-local\-addr=y\[char46]y\[char46]y\[char46]y +\-\-db\-nb\-cluster\-remote\-addr=x\[char46]x\[char46]x\[char46]x +\-\-db\-sb\-cluster\-remote\-addr=x\[char46]x\[char46]x\[char46]x +\-\-ovn\-northd\-nb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6641,tcp:y\[char46]y\[char46]y\[char46]y:6641,tcp:z\[char46]z\[char46]z\[char46]z:6641 +\-\-ovn\-northd\-sb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6642,tcp:y\[char46]y\[char46]y\[char46]y:6642,tcp:z\[char46]z\[char46]z\[char46]z:6642 +start_northd +\fR +.ST "Starting OVN ovsdb-servers and ovn-northd on the node with IP z\[char46]z\[char46]z\[char46]z and joining the cluster started at x\[char46]x\[char46]x\[char46]x" +.PP +.PP +\fB +# ovn\-ctl \-\-db\-nb\-addr=z\[char46]z\[char46]z\[char46]z +\-\-db\-nb\-create\-insecure\-remote=yes +\-\-db\-nb\-cluster\-local\-addr=z\[char46]z\[char46]z\[char46]z +\-\-db\-sb\-addr=z\[char46]z\[char46]z\[char46]z +\-\-db\-sb\-create\-insecure\-remote=yes +\-\-db\-sb\-cluster\-local\-addr=z\[char46]z\[char46]z\[char46]z +\-\-db\-nb\-cluster\-remote\-addr=x\[char46]x\[char46]x\[char46]x +\-\-db\-sb\-cluster\-remote\-addr=x\[char46]x\[char46]x\[char46]x +\-\-ovn\-northd\-nb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6641,tcp:y\[char46]y\[char46]y\[char46]y:6641,tcp:z\[char46]z\[char46]z\[char46]z:6641 +\-\-ovn\-northd\-sb\-db=tcp:x\[char46]x\[char46]x\[char46]x:6642,tcp:y\[char46]y\[char46]y\[char46]y:6642,tcp:z\[char46]z\[char46]z\[char46]z:6642 +start_northd +\fR +.SS "Passing ssl keys when starting OVN dbs will supersede the default ssl values in db" +.ST "Starting standalone ovn db server passing SSL certificates" +.PP +.PP +\fB +# ovn\-ctl \-\-ovn\-nb\-db\-ssl\-key=/etc/ovn/ovnnb\-privkey\[char46]pem +\-\-ovn\-nb\-db\-ssl\-cert=/etc/ovn/ovnnb\-cert\[char46]pem +\-\-ovn\-nb\-db\-ssl\-ca\-cert=/etc/ovn/cacert\[char46]pem +\-\-ovn\-sb\-db\-ssl\-key=/etc/ovn/ovnsb\-privkey\[char46]pem +\-\-ovn\-sb\-db\-ssl\-cert=/etc/ovn/ovnsb\-cert\[char46]pem +\-\-ovn\-sb\-db\-ssl\-ca\-cert=/etc/ovn/cacert\[char46]pem +start_northd +\fR diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.html new file mode 100644 index 00000000..bc4b7266 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.html @@ -0,0 +1,349 @@ +

+ovn-ctl(8)                        OVN Manual                        ovn-ctl(8)
+
+NAME
+       ovn-ctl - Open Virtual Network northbound daemon lifecycle utility
+
+SYNOPSIS
+       ovn-ctl [options] command [-- extra_args]
+
+DESCRIPTION
+       This  program is intended to be invoked internally by Open Virtual Netā€
+       work startup scripts. System administrators should not normally  invoke
+       it directly.
+
+COMMANDS
+       start_northd
+       start_controller
+       start_controller_vtep
+       start_ic
+       stop_northd
+       stop_controller
+       stop_controller_vtep
+       stop_ic
+       restart_northd
+       restart_controller
+       restart_controller_vtep
+       restart_ic
+       promote_ovnnb
+       promote_ovnsb
+       demote_ovnnb
+       demote_ovnsb
+       status_ovnnb
+       status_ovnsb
+       start_ovsdb
+       start_nb_ovsdb
+       start_sb_ovsdb
+       stop_ovsdb
+       stop_nb_ovsdb
+       stop_sb_ovsdb
+       restart_ovsdb
+       run_nb_ovsdb
+       run_sb_ovsdb
+       promote_ic_nb
+       promote_ic_sb
+       demote_ic_nb
+       demote_ic_sb
+       status_ic_nb
+       status_ic_sb
+       start_ic_ovsdb
+       start_ic_nb_ovsdb
+       start_ic_sb_ovsdb
+       stop_ic_ovsdb
+       stop_ic_nb_ovsdb
+       stop_ic_sb_ovsdb
+       restart_ic_ovsdb
+       run_ic_nb_ovsdb
+       run_ic_sb_ovsdb
+
+OPTIONS
+       --ovn-northd-priority=NICE
+
+       --ovn-northd-wrapper=WRAPPER
+
+       --ovn-controller-priority=NICE
+
+       --ovn-controller-wrapper=WRAPPER
+
+       --ovn-ic-priority=NICE
+
+       --ovn-ic-wrapper=WRAPPER
+
+       --ovsdb-nb-wrapper=WRAPPER
+
+       --ovsdb-sb-wrapper=WRAPPER
+
+       --ovn-user=USER:GROUP
+
+       --ovs-user=USER:GROUP
+
+       -h | --help
+
+FILE LOCATION OPTIONS
+       --db-sock=SOCKET
+
+       --db-nb-file=FILE
+
+       --db-sb-file=FILE
+
+       --db-nb-schema=FILE
+
+       --db-sb-schema=FILE
+
+       --db-sb-create-insecure-remote=yes|no
+
+       --db-nb-create-insecure-remote=yes|no
+
+       --db-ic-nb-file=FILE
+
+       --db-ic-sb-file=FILE
+
+       --db-ic-nb-schema=FILE
+
+       --db-ic-sb-schema=FILE
+
+       --db-ic-sb-create-insecure-remote=yes|no
+
+       --db-ic-nb-create-insecure-remote=yes|no
+
+       --ovn-controller-ssl-key=KEY
+
+       --ovn-controller-ssl-cert=CERT
+
+       --ovn-controller-ssl-ca-cert=CERT
+
+       --ovn-controller-ssl-bootstrap-ca-cert=CERT
+
+ADDRESS AND PORT OPTIONS
+       --db-nb-sync-from-addr=IP ADDRESS
+
+       --db-nb-sync-from-port=PORT NUMBER
+
+       --db-nb-sync-from-proto=PROTO
+
+       --db-sb-sync-from-addr=IP ADDRESS
+
+       --db-sb-sync-from-port=PORT NUMBER
+
+       --db-sb-sync-from-proto=PROTO
+
+       --db-ic-nb-sync-from-addr=IP ADDRESS
+
+       --db-ic-nb-sync-from-port=PORT NUMBER
+
+       --db-ic-nb-sync-from-proto=PROTO
+
+       --db-ic-sb-sync-from-addr=IP ADDRESS
+
+       --db-ic-sb-sync-from-port=PORT NUMBER
+
+       --db-ic-sb-sync-from-proto=PROTO
+
+        --ovn-northd-nb-db=PROTO:IP ADDRESS: PORT..
+
+        --ovn-northd-sb-db=PROTO:IP ADDRESS: PORT..
+
+        --ovn-ic-nb-db=PROTO:IP ADDRESS: PORT..
+
+        --ovn-ic-sb-db=PROTO:IP ADDRESS: PORT..
+
+CLUSTERING OPTIONS
+       --db-nb-cluster-local-addr=IP ADDRESS
+
+       --db-nb-cluster-local-port=PORT NUMBER
+
+       --db-nb-cluster-local-proto=PROTO (tcp/ssl)
+
+       --db-nb-cluster-remote-addr=IP ADDRESS
+
+       --db-nb-cluster-remote-port=PORT NUMBER
+
+       --db-nb-cluster-remote-proto=PROTO (tcp/ssl)
+
+       --db-nb-election-timer=Timeout in milliseconds
+
+       --db-sb-cluster-local-addr=IP ADDRESS
+
+       --db-sb-cluster-local-port=PORT NUMBER
+
+       --db-sb-cluster-local-proto=PROTO (tcp/ssl)
+
+       --db-sb-cluster-remote-addr=IP ADDRESS
+
+       --db-sb-cluster-remote-port=PORT NUMBER
+
+       --db-sb-cluster-remote-proto=PROTO (tcp/ssl)
+
+       --db-sb-election-timer=Timeout in milliseconds
+
+       --db-ic-nb-cluster-local-addr=IP ADDRESS
+
+       --db-ic-nb-cluster-local-port=PORT NUMBER
+
+       --db-ic-nb-cluster-local-proto=PROTO (tcp/ssl)
+
+       --db-ic-nb-cluster-remote-addr=IP ADDRESS
+
+       --db-ic-nb-cluster-remote-port=PORT NUMBER
+
+       --db-ic-nb-cluster-remote-proto=PROTO (tcp/ssl)
+
+       --db-ic-sb-cluster-local-addr=IP ADDRESS
+
+       --db-ic-sb-cluster-local-port=PORT NUMBER
+
+       --db-ic-sb-cluster-local-proto=PROTO (tcp/ssl)
+
+       --db-ic-sb-cluster-remote-addr=IP ADDRESS
+
+       --db-ic-sb-cluster-remote-port=PORT NUMBER
+
+       --db-ic-sb-cluster-remote-proto=PROTO (tcp/ssl)
+
+PROBE INTERVAL OPTIONS
+       --db-nb-probe-interval-to-active=Time in milliseconds
+
+       --db-sb-probe-interval-to-active=Time in milliseconds
+
+EXTRA OPTIONS
+       Any  options  after  ā€™-ā€™ will be passed on to the binary run by command
+       with the exception of start_northd, which can have options specified in
+       ovn-northd-db-params.conf. Any extra_args passed to  start_northd  will
+       be passed to the ovsdb-servers if --ovn-manage-ovsdb=yes
+
+CONFIGURATION FILES
+       Following  are  the optional configuration files. If present, it should
+       be located in the etc dir
+
+   ovnnb-active.conf
+       If present, this file should hold the url  to  connect  to  the  active
+       Northbound DB server
+
+       tcp:x.x.x.x:6641
+
+   ovnsb-active.conf
+       If  present,  this  file  should  hold the url to connect to the active
+       Southbound DB server
+
+       tcp:x.x.x.x:6642
+
+   ovn-northd-db-params.conf
+       If  present,  start_northd  will  not  start  the  DB  server  even  if
+       --ovn-manage-ovsdb=yes.  This file should hold the database url parameā€
+       ters to be passed to ovn-northd.
+
+       --ovnnb-db=tcp:x.x.x.x:6641 --ovnsb-db=tcp:x.x.x.x:6642
+
+   ic-nb-active.conf
+       If present, this file should hold the url to connect to the active  Inā€
+       terconnection Northbound DB server
+
+       tcp:x.x.x.x:6645
+
+   ic-sb-active.conf
+       If  present, this file should hold the url to connect to the active Inā€
+       terconnection Southbound DB server
+
+       tcp:x.x.x.x:6646
+
+   ovn-ic-db-params.conf
+       If present, this file should hold the database  url  parameters  to  be
+       passed to ovn-ic.
+
+       --ic-nb-db=tcp:x.x.x.x:6645 --ic-sb-db=tcp:x.x.x.x:6646
+
+RUNNING OVN DB SERVERS WITHOUT DETACHING
+       # ovn-ctl run_nb_ovsdb
+
+       This  command  runs  the OVN nb ovsdb-server without passing the detach
+       option, making it to block until ovsdb-server exits. This command  will
+       be useful for starting the OVN nb ovsdb-server in a container.
+
+       # ovn-ctl run_sb_ovsdb
+
+       This  command  runs  the OVN sb ovsdb-server without passing the detach
+       option, making it to block until ovsdb-server exits. This command  will
+       be useful for starting the OVN sb ovsdb-server in a container.
+
+       # ovn-ctl run_ic_nb_ovsdb
+
+       This command runs the OVN IC-NB ovsdb-server without passing the detach
+       option,  making it to block until ovsdb-server exits. This command will
+       be useful for starting the OVN IC-NB ovsdb-server in a container.
+
+       # ovn-ctl run_ic_sb_ovsdb
+
+       This command runs the OVN IC-SB ovsdb-server without passing the detach
+       option, making it to block until ovsdb-server exits. This command  will
+       be useful for starting the OVN IC-SB ovsdb-server in a container.
+
+EXAMPLE USAGE
+   Run ovn-controller on a host already running OVS
+       # ovn-ctl start_controller
+
+   Run ovn-northd on a host already running OVS
+       # ovn-ctl start_northd
+
+   All-in-one OVS+OVN for testing
+       # ovs-ctl start --system-id="random"
+
+       # ovn-ctl start_northd
+
+       # ovn-ctl start_controller
+
+   Promote and demote ovsdb servers
+       # ovn-ctl promote_ovnnb
+
+       # ovn-ctl promote_ovnsb
+
+       #  ovn-ctl  --db-nb-sync-from-addr=x.x.x.x  --db-nb-sync-from-port=6641
+       --db-nb-probe-interval-to-active=60000 demote_ovnnb
+
+       #  ovn-ctl  --db-sb-sync-from-addr=x.x.x.x  --db-sb-sync-from-port=6642
+       --db-sb-probe-interval-to-active=60000 demote_ovnsb
+
+   Creating a clustered db on 3 nodes with IPs x.x.x.x, y.y.y.y and z.z.z.z
+     Starting OVN ovsdb servers and ovn-northd on the node with IP x.x.x.x
+
+          #  ovn-ctl  --db-nb-addr=x.x.x.x  --db-nb-create-insecure-remote=yes
+       --db-sb-addr=x.x.x.x  --db-sb-create-insecure-remote=yes  --db-nb-clusā€ā€
+       ter-local-addr=x.x.x.x               --db-sb-cluster-local-addr=x.x.x.x
+       --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641
+       --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642
+       start_northd
+
+     Starting OVN ovsdb-servers and ovn-northd on the node with IP y.y.y.y and
+     joining the cluster started at x.x.x.x
+
+         #  ovn-ctl  --db-nb-addr=y.y.y.y   --db-nb-create-insecure-remote=yes
+       --db-sb-addr=y.y.y.y  --db-sb-create-insecure-remote=yes  --db-nb-clusā€ā€
+       ter-local-addr=y.y.y.y --db-sb-cluster-local-addr=y.y.y.y --db-nb-clusā€ā€
+       ter-remote-addr=x.x.x.x             --db-sb-cluster-remote-addr=x.x.x.x
+       --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641
+       --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642
+       start_northd
+
+     Starting OVN ovsdb-servers and ovn-northd on the node with IP z.z.z.z and
+     joining the cluster started at x.x.x.x
+
+          #  ovn-ctl  --db-nb-addr=z.z.z.z  --db-nb-create-insecure-remote=yes
+       --db-nb-cluster-local-addr=z.z.z.z  --db-sb-addr=z.z.z.z   --db-sb-creā€ā€
+       ate-insecure-remote=yes              --db-sb-cluster-local-addr=z.z.z.z
+       --db-nb-cluster-remote-addr=x.x.x.x --db-sb-cluster-remote-addr=x.x.x.x
+       --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641
+       --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642
+       start_northd
+
+   Passing ssl keys when starting OVN dbs will supersede the default ssl  valā€ā€
+       ues in db
+     Starting standalone ovn db server passing SSL certificates
+
+             #      ovn-ctl     --ovn-nb-db-ssl-key=/etc/ovn/ovnnb-privkey.pem
+       --ovn-nb-db-ssl-cert=/etc/ovn/ovnnb-cert.pem
+       --ovn-nb-db-ssl-ca-cert=/etc/ovn/cacert.pem
+       --ovn-sb-db-ssl-key=/etc/ovn/ovnsb-privkey.pem
+       --ovn-sb-db-ssl-cert=/etc/ovn/ovnsb-cert.pem
+       --ovn-sb-db-ssl-ca-cert=/etc/ovn/cacert.pem start_northd
+
+OVN 23.06.3                         ovn-ctl                         ovn-ctl(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..c9881a3758ce5f47dcd3f7083ccb13ea2e49a58e GIT binary patch literal 31888 zcmce-1y~)+vNjwnID}xqCAclzL(t&vt_yc}g1bAx-Q5DgLU4C?4el1?TO`?X?z!ha z`~LDhii03s8fJo{71My^93U5orDn)Bz!_&2Kp=X&F96c_EM_Kc9kt z2qCSVppcTNfY3W@14AcU6MG=2#?Icr%EA8Kdr(%|!QR@z{)34*@VWSpMuKA@q$jk} zGlk>k21o!cjqHsHSwS^&08lUXKwCn<2XkF}pde7+$^gj217~M%3)HoMb51Q&5|3P9 zebu_Jd{S=<#*n?teGz4ORVg$hHS-nRAN5Uj?m=;tpm27}W#pOHK@{<2rTJS5I06IP zRu>N@fivi82EO{6A}cj)R#z6!H-bmRm!jeq>gFoo=mp(@J2EiqRv$_PWp*=1&t){Q z$+!mB+d5!YDI7JiT|Ndeb(WUKS@|DyGEMEFM7$US7g^O^xt6`ROwu0Q9YCOkOcCU{ z(rD|NmAhjUmKLp(&aE?%K>`yvS@M9L~d<$n=c1XxYjf&NNTy~t}i_};NK zDAHq(N?aP5Q?9Kp8;_Iq>fn{?x8!c@A_OIi++9D6<}dt!ns(OE6oEVA^z&;hKmCO) zv+6spVwIs4R&#A2h4@*FqOrRBzyy}yTZSI{PdV=Z^-%AJTf5t&QD0lqzFrl1S$l8R zdh^9yBO*9~3LM!)8zId!L>e^&54ri9Bbv?>oWque&O|-SlX(xk5{uCtnp55b=XAg< z^gJc?KyH8cJbs6z0qWs{!S}QDy1Kx+MmBIV&cZDHgv@Kse?KxF-Wh_kR8PY zqadc*K3xupm`0?lpzWvjfcQMk=@q-GV;${Ac7oK>-Dcd<4_Vu&_tT2iOZa2kg`d!) zP@;~^5{VCZ{aUbD7%n6>Wr#mDuEB~p7K-lc_27gh^aSjXid9z^hIGeVs737Py%8G< zFz}gyHFEGxVXI#;q({_{5Tq2~%mMqbl+&OZHR{Cok_rt^Zpv3pwrrq=0jue=peu*{ zlMTiVSu3*{Nwx)e)9!U>K|$oX^Z=i4Dq^yMA#I>W6Z(SJn^OQasi-Px6XUnI*QV8n ztQC1XpMoyEcer5XlZexnf}hL_G?yshD{~M8vwvgMe#F3J57QVfjv2Br17HC z`NAl&7(+YJQ^Uw55krkMS8WGTNeI;OZPWhPYV_}SN{W1?v(t)Z=tlwjh7(AIrLyG5 zGjhwQNL+02#IzbantbIug@$)(CbcdPQlEp2hpB(a=QXF!)w+7XOw1$7;TU;2Y7FSB z5KO_luxP(8Qr`Za8?ZBpuUDX{S&5yl*+#Xoq~3{SU05-FyV2rFmEM9zyUqb_bQ=+| z26U$Ez{&CYJe>9@cV<1iq(owEGuv9JiQuV8V#UJ`QCdzL7_{Rph&yjYjuI3&dxPrv z1TLlWjuL2T@Y_Rxa?f7n*_S-04D`(GaKGyq{@vv;{4<}UG7$6W1KQF#dW#@@-FM7L z1s8^NSvk}N{^&Q&8jcv)eoUz1gz$zM@>|lq6(^CO?I$w5KM+TV!;9^8ax_S5AGPdK z+tTw%T^3cG4%?1uPb-J^YRh^AJMAhONKz}HsRI(U>Rx%&Pf9|%pt+>x7#q#aZIImI zh`hkm=?2e$Af8uo3Q zk6lg9j$p=rDDwV+m%`QY7UM8v2^y0NNwj zM|>uOV@l%jYER~|NErhW(yed}1NkU;^^3h9Dgjb9eV3jZF7Am3(|C*-dY(Swbl1L& z@*K1JNE}^CZ_|MpdSNA|{&+p-hX$G?TOKLor@nX5FnZ*9G)8@N)G^Bf)G!yH)UGM} z+6q*UlNF=Nt>GO>INOSdx;@I@Fo$2g*^Ba?CCWCmg7?in@A{Y7wCt&pb zy6uo44GU^i--hv}aHuW>g@u*Q_+fv2a`2%qwm!aqr3&I}9>z!Rq*#9pst<*IpF>Ne zujZa^H2{cxp@$+d8?2jpLO+JlmhQ1DjcV&rs*s8s(&`uKpr$dL&=ONLElgcHL>#6c zm?0M~9Fy!+}<>+5j6mmuQ}wb5#+Yk@bAG2VE;s5EA-T+W8G(MxV0-l~B!BJ>h8CAu~w5n8_tnmUZMOVHw|D-Ds zfUoPPwvu5K846*#Cu70gxy+w`vT^-M{-yYVDqc>5PO$g~=Mw83mH-RjsD)=t1-QIE z)G@AuB1_;sFdKHKv<;3+ZDg0pclq5{Ls*;&=3Q2ZR}UPP=k0Nt4iNaNlqxL6kq+v5 z!u!cf0Vv_ghc5~I=JiMGKUDZgcQDgg!LAfhQG1`Hpw#+Krq;7ybf67l)H69a7TUL zGkg?7Oe*^tFZYAmO-B^_A_te<@Zj(sJaH0n_EYiGm>%!wPDdgb%S!g1b}es(Z-VP-^2O5vd?(xbBS zz)w&|MTXB*kp4c#%-Lh!kZs zAAC?+;IM6^ahBMD9G?>Rh&qotNdQ zC8BkxS-Nr|9>sAUtUk!CbC>LuU__1$h$K`R2cpc`_*Z5Ub5XC2(h^MSsg4YRoKSIY zuV4$8fLcV3b4-#aeTm59JjJ>AsTb{A`oO6V@c(7=gqgC-k^W@EbF zKDcP_%EZka`}qp!NbQ$-nwTA%C1#z*IDH(xzXtz-TYW)~+S9H?gTBn53Vus^NGWdi z12S@{+HZQA9BcZBa#^Z3M)wi7*iVU!Q)ON`9`eVslLG0hDLbdN*_v4sUAQXUvntcF zGFRtaIWiLeK74~p$7X}w3tJzk*RfXb&94f)kzF>)UwoQ73}RjD?Q#>FNV>Y3E)q}F z9VbVhE^n*YxV6?z-sue_p54HsIh@M;=;65{p|XG#v+pjWa~A8+R@fAQ$?b0R>B6M;X3n!CPDjI+53|>0KS?8!>%k@K&T2AZuis zrzEFOMw!8C;}OP8q>sglT9p%7VJ7p&!u6v95DZ_eBZyn#%N2@!iC9{AiETZ8nZmfp zvKmg(MQ_>fI%p=fHIRR7G|?y_7gP$RxHL(*+dh=rgrt6LS2y6IY5;_JX!PiWhDO?A zIqrf!x> zRquRKEhey$&|M$@=CizM!TyxQ5;j4mb@`&WfEBuf<}#Q@c#T#NwS_`E6Ph!81qUW%9C<*^&Z|TFF9!h?V#W((Ii8<%%vR3?<_2E){ z+$Ivrk4fKqI_;qR4If)Kqi3iuGC;?rkGwVb_Cki-ud(7$YEJZ$y zyUp%3cCvF7`ja6Mf#@q?V3#Ru4$fylTv9IqcEa$vSAu0|y2G4!s>V5U_O%GgYs5WK zOX^{Sl-M+HaplyQ&Z_vk>Te-X6Ho3_1WsoV$+Wc-rj^Cmq^hckVisZF`L-v@mT{r7>H)#vnoqjxn&^S+pB@ zXV;Sv6$)!RRr1KCexY%ZbzLNUQBe5Eq@HP{Yn7?wU$eY{s_lWIbukzTb4Gc_A-tBo zvpMr{q74JSPhu$X5?9IZJUtfCP_ekx&7Jsg1Om4muI8gNEn%X5RRNnKbyUAi+%i_%ev&R|!i_$MRx0jd|z? z8vn~zXJmamnT0{J4p=$&#bRePVq-KTt)40v(XOGb`8L60yWpDWHdsbeZ{rjSzYHdR z$CcEN+pZ}L*`esO4{J=xa*<;*Gm7*xxfH4S-uPIm2 z7;#+q;^hVAKKcu(s(sP9sEMKcCJC|l+@bG`fnEw!1H?j#<-NV@s(FtkJcrri2l6md zrnZ`cwF%|=%$DC1XDxPT)VQ3^vYS%32h1b1xCMY38rQ+aL90^cjr+DA{M-E;C`t^K zrFrxpT-RMv?Nza5s$&;z;Xgyt5Z%xtKT83Q8qk zq&0Rp)oHV7?q2OTWV#)3%xt;eU5IN_c`&Vg%cB#l@k+!7_A8m_!u#p1t6%J=jH@zc z=w`4@D~o5zE^rrTnuztLo#?fx}BvxqpXH{pQWxX})3Di{*>2 z+FX>r%6tKzB!iVSkrYOjv;@PY%SEY^%j%N|py6Rs1U4%lA&ZMHybMAk=I6mIiMP~Z z4SBurRPg9GAcmrJ`j0KuvQ8}+o4QWfN5=`dqGWv_z`AZ!vC_<|_((0V+~ISUJ6K`- zj?KJxendO*BF~I_<4YMf++n6nU(6h8p^11k)JeBI3Us~5sb(6P?UO{-Oo)!1u*`Di zh1ieUI5ob9%a;aAXlIu{Cqpx0@%A5eg`dsc{D@=+F?Na=?enOsVGg$?w+0g!+kMwMZ=f^6hN07jce|?6 zEJ`KwA&gW~`RkxsFez9_+E<~9&Zn?~L~8gqNJ;vDj< zk$Jv;vnaow{6I&4UKYY7cQHRC2BAp{rpLY$L(}-6EWl|XyS93?V2h{vWb2_xrigMi zN^Ncr+_U%Q`t{3BwEQwR2cmfnJU8#F<<3jK8|h4B$?Wj^&dcb*Fgua7LC@E)BufIs zK7|J#MxZy0lt|OzdoUlgsJ!o@@s8HyiJh7PlO@*D@m|eKXA~KthVncsZ zb${nDNh8K*^M-10U$fE#xqbEs^;L2_AQ%9@J7e)PDwiewY8 z=j0eaPn6C(H+9}`BA*YJO2FFNMIwP+R=p5i-86xtu=77-1W=>p?dkhNZyy>z3W?In zBP5>+r_CD0TH?r5?}!-UBhH4Szt(eP%OPI8;QYD*{@Jt88mAcULNl}cEz6JOY6~4M zu?fYPva>-6|H>gNhqtyCr+ZMK2<;hDyTN*#!Q0baYhivVUF(xy~ z+V)gftJu#473tY4=Xb15%Tlq~khrIn>kH?nqACy}{*k;Q^b#CHrA%>*-_5;@?fjSzd1X}0EDVgydPpTSeTK0-v`n#Zq9i4684J&VQj8)DZn0F_@{}(?Djwu5 zP+j?6zKDc^FohB`#{R{fo*T8b^h&d4B-D~gqbJkptnz4Zlu3IvZ*Y}7^Sgm_$Sr7M zOyxP)`1%Bc5_S9ioZcNcx=k`dZv{_B90X|QJ)Dm!=0lS43+~?3&m%Fyj%G273JZ!P zE2$*6&O8CRAS~tc81T;Sb|8iazAQ{0%S43i)z>M`LZ=MmLgrV<$iEHPGt{i#oyc$I zZ{x9&-CcNF`>E48>?PXzk_Pa>iX7ET_u2*)!Jf0z2l%chu}{22gw@x`E?Sk(V!OLu zc27(B$fp)kELLKTqEpmumy9Usdtvebq#TT8&TCSvAc;j> z9Y&PQPLcF&!om-`0u4Dp8=cM;UpNZZTFtevW;uOp_2{0FR@0C#DP*%9-%4bxv8quK z;wD_utXEy7*gLD1BDOp$S?^pO=Fr(9JAHbT5DDf09~v*(kdYw-moU>Qi1>RcWClJs z@rInv7dbP3i$!WRC8l_XB-ZJ9u!PS56&3iIdHW;x3*y!BJZ3$_LD|>Rc+mP0b-RiX z>~SxV_@FspnkO)jbTZaoK^Xbr+fbOFYm>-92EVY7vw5e0tZe|f2?-4mzvr}D_pih))-86~V;-Y=N)r+LLx~MY+x46|}90()a><=CNi@uMoCg7{i zD+!XukU8%3$3Vst&#%mZo^YJ0{)PgVasdJz)-*)jneg@FfKa7b-&!a!-2OhQ3`XV7 z1cKlm-{AQ0lW%5|>pjO}d5uX*l&_+*#5ztpQ{yS=T8ZT!Iz~$379@4m*YjsE=pZuM za@Dg&fAmK#5MIRH8?zVUmqecK?3!GHnd~9Yfe(K->LSl~c6ZcaU&eXNE1aCD<%#S(qhH)}!C8O1%BTVu2TeD zZ*u>%qLg;-Fq84&Y!5@Gsz`ULio~1Pq+|~@5dlV{;=H&>_!v+cYdyxx_Ic!fYk<6v zLU(Efim={+0W#Gso|E{qf{L|hz9`+ASRuHn&RaCc%cw1_2FBeorB1uUez3~2D}pIdse;&s-=}9p|;s${lJqrvRM2?UM_ECo2;pya-*kt-1_yr~rAM;2EAKi*~}| zw)nZih%5~qp$+O9=eO1_vkt6srK4}SHMOE6^%~W}LuEI|L`5*OZ8+mCxlE^LeoWr+ zTxy5iZNmB5JG6zvXwOvQO3_E#9IHjxv762%Lq?cE9QD>TL|nNycc-NoSUBsyS)rM~ z_M-&0qXbSFRlEeO>Zr2>Hbh8&KgmnjV>2Vx-8i)p*2PIk>RM7>w?4?ex>Q*lIT(;6 zDeVG;&Vj!BK`(w6{BI)Hb42;;T1WEw#t!!^^`DMky3f+j zxo2(A500LY4FnceR<@t%A9+^LC9<)x|2&x3pC<_9GC?vN%*?;!Kw~}2{L*G&Vf~jL z80bM}Ja_ec{2b=z8Dtn}xS!^M6qrF>Ju5z^&qn=G54sGH^mEH|j{Ug>lz-NJPU(Ni zgG~CV^Q-0OI6w74<39KI=a``J{`=przCdmNQR27W|IiMaLQotKvIOm>F|jlP83Yi%yS{u7Z(aw@{YvcC~2XJw&l`EQVXzR3Sako;>_pV#4!pF^FO6U4X9WF1 z$MdK^(f2!jZvVs1-{=FiJm;Qof!{4ZujH2v&o{(#>mNGLmi&=_9+~lvtNM@F`Tqoc ztjzy{zMua8Kcers_5UUMm^c774pyLTWF|(&_Wu(W|K{cY#G(wJjDqYR-cb}3XiW6~ zD;R%9u7BVjK{vs_y2n3O`#F7H%U|pLN9h@lpw;?s*WxcpkTgi*89_gf-`M-3{L7F1 zl74oB&+GT>nSQ&?->&dk`X>%Rtv^u=DnCp8h2US7f@DBr{ehUjBk`}=XM8;$zj62% z!v4VFvj_Ye4xf8@w&po~K7KiEMz-f@`0Lt!js0KGAS?a_ML!>q{v(S17F&NlSpVs! z{< z`!kv00DN}(&rkKBO3)*^uC)m88NI)X&x1U-J!`@Neu0wD(#Rb2G5`mVw+C7%5i&5d z!2u*q?Cd}e{wL_3-5aPQP|OCs5KsX40Q>*}fFM8!@BttU5CMn+Bmj~CDS$LU1^@~L z00n>|Knb7>Pywg{bOCw*eSp4|xs@g8Y+<1bFaQ7nKpO{LbATbpuY>*^fdE6$TL-`h zU<@#Ju{H);0!#pA0CRxFFNY7X1Xwy)=mBl*OpGi6RsbtYAix@64Z0<*3;@>V4tBrp zPy;=4fGxldU}xeCurt@SGX~gM>*@mm_5gchTOcTPvH~~&94rk$9qC)y0s)QyCxA1+ z1>g#B1=?Cs{+#pYji;b{=@~F`f5n-f<=?CIYg6gp_mqOB?eEb~;LlB{^z`gJJb!LC zO>=fpke``<3})C#RT7JLW-gSR<Emy1)uHfvwE#P0=B-kU%^`KW{oc!lCG(yeXbqn*8a z8yP(mOBT{{GtdPDp zj7CQTeCOK$XW&}4GNyF8n5=w}#U$gNkSW(CHcR+CpJaidOmkuKq-B4g>!%c=_eQ&WPvfE4k=f@u&Up$i=*x%X&IdFs;Dcr7wn<=~4XCyDnIP2ua3=EZ2U+>7!i zMNElF3)Co)snT5|&T`WWlw@;?7~(KV^Sb45St78dgDDv50t|vBB63?_nF#s5RSMrl zm&R-e%M~sb_9RKB{+_!t27BQ&_#yw}Z9up|V0w|;c7xFjkDJ|OoGdV>+|B%o{UUXf z<7sEu`Oew%>ONuTJ^nk7i_Z)rVU*bCB{LELUwiM1O_eT{wyGk1_-_1dR@)#u8_Y(o z#g%RgY$LpD1NX%nt>nZ~UL}%dSf!B;m`y*2o|}f$><$M@IvC(gE24g7id6#XxC)EC z9LG$Q1L2H16rZJ`x@a+CU1o}{@&wlvK348{nw5fZmO@fgqM{#6$(!m+GWzBk8LK`?wF{m*-n``H0)Rgv<-@iRpV}wlI45b!NPknj+EA5 z`bv9D`Vt1!-dH@dtH!p)b-v;p=89v=a8z(Iuf+zWu2&3tC8QO4zCZ%{E{3z^6vDAf zsGCCikj2aV9X2u)B@&Cs3f{fC+Tg*`@{QeiJ9+1EO9H3FwxOP&C6qlnJL-8Yd(AQT z_DiFhe6kP1GR0e8zpPilSl%dlZfmA749y{Lb!SxjzDMx&AFE^I)&+|TcGmcugHMjV z`>-@Vx0MJ3x>L^I10!s#69cyB&*(&?OkA_)(Paa(5BCpBFHkDeT6*3mpExf=-3Q=m z%Z<%QAU3VPJBSLPoG+QE7&7VrXZtKrd(p8`W3_<-@IP{+rN}9l?oj{WI5mCIn-|H$ zgUjt?DnabIoO`kU))QfeDPyRXVgkY{28Cx$3Do z(ZKcT)OneXwAQZi9(-MxL}|wc#&36JE2D+?m3tzgGs8_-Vt0q=7ykvN)HxY@Uw_I$ z6R(Cx5*+wmUf01c%B6?t zf|D!bgla9!24FJp(mWo>Afd*^HHjk$-5Y7t)ZERM)i7A$MK>IkX@+CueEuG)2ayAT zlxxm!p4qyc%l|^33pp*DoFq7c4@x*QUiFL98#T9T1hX?$^e3nZh_x6&PD=q-Jp+E; zZwtxPubM^GCrUnozZBecc4jf0!?@u|p4R2$el3rIVK3n%x%GmE12w#5$(9WgVJYj~ z?V%rh0!O%11po>^3AsQswSuL&+dbJIZ;)5rN>~V}l`pv*WiVpFcQBSveMRcx_ z{xsVJLc(uN`^uM2T0*AvIH^p@?mQ-TJZ}i!?nQkO1&S9heQoL;u82x=Gjcc+=MpSy z`*=^z!2NNAJt@6^bN>wff`VWR!ziJ9UQSHz6_?k>G$~FbG&h{mVvv<$mI^C34~Mm8 zd!N<#X0UVer+Sw7cty~iE~}vEJZjDQgHW%n&Ha1xr~c(+aj_I%lNT%ctd{{xjnj6!p&PdGw3^Au@c~~@YxZ5yPKE{e zdl3aqmX8DJ3U)If2X4WQ2-zCSiF3N$6Si2wwlwsYgq8T)kQD|UV&z{D%}Me2Ax3Io zerT0vP=?=g=<6&ialvVXqTiOG!?&t~Q?UwRvk^g2UDspPhvZSt%7C70f)6Zx+y((GFM%cT{ zoS12AWl%xogsCq3Iq&P&rb@*j=1=_+z|TtdrulCXxKFTD;Sob``Vc+P(GQipsWZyo zH7cvPWvB3{88c<0<<3xVC>aQ0%U?#%wLl@xm!wd4cNW5N6pJ;N830>SIFyVT*vxB_ zLc*0cT))WWx4ypRwX1KBFkdb#FaA>ICm~;yoZu64KOMfxbWu7e)cL0I9@$-WT%wcP zv+2QDNQj!~pa7ctU@HJ?71s71{0qI7t8Zl6*R9PY2{Jpdv*G@dLU~@=^QnHYgJ4qX z2POZ;$sV_PjkG!_7S}-ThJJ;B{@HFN;Y5wQRS&0_3OyEIVWFcLK@#Y$0^uB;>1&16 zDfog^qm}rD`xIs)8GxyiJpuWA@U_-z%=$Q@>9_8Jx+@KCn{`0A44ow}Fx3uG11|;3vJNwK{wY97s9=fXYx&o-hyeurh zv^MhWyv)*3EM)yt9#wupISET8J!iet?x;^07ULKw0cuBjK`WHPj+@3D%O3rvv?UZ3 zrP8I6CH>U}{l)g^*am_xJv>Y4IlSJ~2i|@^ZZ|BDv8wbdv|m~^ILfVJoO#`k^sdN| z$L&}_B=Lym?By|ZWwI4zppw}0d^;-l zYC@XBOJ*JIfeI}PGuIB*e(>y~v2b=YNOOKG=n}m#EmA+^cxu|6H1nE(YWr9+i%G>j4E)^_pq#!@v)CCdXYf1wX=W7DFAgNlJy zK*jAOjWC7xu}QL{bT^M;DYnZFHZ>J(;jEsbiWqHPq2Ift^)NXya_R>+J%BxaEelIO z&Zo3@!uVflJVQ#41QivV<4MnA9Kx?L!iLZo-V+FF2#VM$QRrbFKE5P-$K&qOuFGba zNGWF5r^Qe6V^6Lb#Vxzb;b1&q0{%2NS^k8%^u`e*?DMtOkF-#@k(FtlvVCpo6AOCj z`vncQhUysSm<5{S0koB(vKB>tJ^6l}r!4k^kseX&Mw|Rjy^ZXEb}Fumk|=_+VON(-DGRoj zsyt*4j+lHeAv*A?b91dI24ns~KNN!OQWeqwDvMQ5w>qhNw=-;m#z)v=1Zy(#V601Ja4*Sg ze-9j+B1z$nhBzpTBp$XE6QWacucsq_sW+#5Dt83nE2ti~$7pBqpk#B|K%y>M_>M*r% zh5(g+e~;@@UQQ1Utg)fp8_u!39=mqJ)&8Pe!AT*SjsZjvs;K7jrCY5qv6HDMs*Lh5 zbrKX7YtEckv_8* zGE*tg8s=iAWU7+|yM+eCtkT(jzm>9I%+-1T^K}x#mytuLTq?3pJya#DTLAf-ZFr~N zt!~K+LW}UB<6F>3w>aC0$-Tl6H-3)@GN;e$fv;rivf`}6!Nm~{q*N&ihzJBG+W}aHv~8>lq_oONkrWw;vf~_=633gm2Z?8~WQ1H@MTytYo_10xdSZ zA?DvA6HF7lE4#_rLYqDBmY>2rKcu7Uk5P<_h}AM_+*m}7Zq={A6B$zVn+$difx63=&r&M%B9Ehv{Y4Y-n60s7K@F*%({)rd z1}Q__`P`b*5`Eeby^S(AXLo2Z72PN8c6sPkLKXUwUPnc|H~oDyB>!&K(ESR#f|6cC zLcAh}*iz8Ln(@ixP}9jQvyklv`(-gE8{@;ydmGGc7mpX`CkR=O1ib#Cp>$&lvTOs9 z7{l{MrM(ZG?{}~u?0Uh%5XSn9U`~81>B;-kFAluq8365k|nSfDUEP)TAh0h2gr`7b%3w>GNUYHhQR&_0)(Ptca zt^UJT$$aIQCnt^^Z)mUgCP}h=mr!$BPIiq@%#?{`E3J<`Wk#60aRi|4J+su_{0WKr zWN@M4GPh~Wx~>)K4mWo#`p%j2-rhpFekz&ednT(H!fo-hTD| z$jKe@P6U(hqrt9KEiAMM(zpY?=_*r5NCK?_9B%FS65Es+*v>5O^ccV6yc{xJe9|5L zUPwK^u#0rpSaiMHca$JK3V~tCkbrE8mq?w#FBmk>((w(|;9Ist!RNrOwl1zIiNMcN z`m#s_qD7LScs#F}1`mDZgM)FGm1;vC8>8%RHu++S-o6n(#blJY%H>cr7I3thG;eUg zOw7g()pU+MD+}THq-+%_)l=SVl^I{=i+?;KTaC(i zQIo)KVI+F3tT=c|Y*a4kVNj3oKJ@)Jd~QV7fiX$Hh&#npkJ#Giu9wiMA1Y>CGl!&iQ<7li9xsL zj)>Cf%b?3IeGIN`L?wysa{~YTXzz?b;?;D+MZ1ejK1du1w~qol(P^9QIv}LoZp$E> ze5>(M4$C@|I{V4qN%_eH*w6-U8Afsqe(fZbdUSlmGX+>Y->i7p=c&9FawmTxW;0Oj zRW}}taKH0K@R551PU@7gNZjQVo@&_R@s;+v%TIgQmffAmPk+lphX2L`7pdR>VgioT zcF$`UxpFmll|ifj9IvzXh!?UmHVN1r4n>LK2p8^2%b{mgW@1|HK&*7PPn5`K#QJHF zOh~uBk5_@Up0uvHd1}f*_W^~*)h>~hkslu;AD%+(#435H4~c?M6=2UGD+om+2-WKG zRfM26iTW&teANjnRIVbF%3bVHXUNG^Hw$yHnMVuT9n5O=V~gX}+Y1)Ax3yjitw}2H zKi4v>>X>VrU{%NU<#k~AgsunIhiC{m+xHf?_-KBNZx6Z4ltFmMudf}XN|D>wPXe92 z!GGU#zp@T6J`ZIRbSLtRZf1yk!kB~4+Urn;p=}l4bq5Qtc`|F;N{@yq>HHA~d_H)u^{j!t_TwQ(2o$iaHfos9&+4hWD>i9us)n=^sL?6pgc+-#Iw zL`>9BRX><9brZmA5eAFethdALsM9G4K5VX%oE5aLzTNiFTm%oD_J+aK9?-F-#1M^1 z7Bl-?m)ls^uc_s$(m*?<&G3yOVP?FR$ItLamY>|a{nH9uEzEEy2}6aCh?FFG>CkY7 zq2Z}HpR)Gj!BMo?F6yyY**#?F6`n|BSWIAGfiQWw-oozHfUx=spGTqm#2eK#rD&0+ zMZ%$@*#}SRY@cA1)RFv?(11^eHTRbzEt&9!rQoh#E=oeb#O^;<=D575N{sZkT7HAh zLar6v;hsDiJ%&CcW>rf*35}mr`2nj^vaAX(B07*j-1-}lQgUvD=MUdrf>p%z0OO>w z3a)5t!RYPbO8=>v@rrU>GxnQDzY32L$!pa*tNEh>6rVA|ZA|u-cG!v2(35rN?{CL* z6|C=@W|9x7D>1d2JcsK!mQ}zpxWjc2^E+z?2=nuht#{c=b4B@5JK~_1ki8wZMW&jHuIZ=QmZOavA^@6zP}b-rxmiG&p?~UWgrmv=+nZYE~k9h z^;X%u=Pk;W;pwN9SPLodv6Ux@)r-YFX$HJcYK4)B1pdj|o=8kcRqW6N8|5r*;h1{J z0$)8HJ}3%A5a+zzVRijT7q3YHD5EH$tU`5yRg(79u_gi=!TEwb12$m+QJDNLVHN|W zTns^~Y(6WzO5+JF+mS&SipR>2{y#Uv^T+*vLcRP4Ciy4#LJ#6km^ld9S(ymgm^uC%=7pK#UznHY;$O_m zbLqclUO?Nq{t5H)0mQldVqBit7Nwsoi=M76K+jfJ-wbGP4m7m?Bma}Q{7J$5NxnRj zLH`T#8!kL-ysraxXtO)clQmc`pC2xfd2@dgi}# zFDgzd@=k5<8LWrLs1)@`WIxU7T9~CxQI%EXtQND+it|Oae8tBi@g|A7k9ox}!v99s z3c;<>8E>_8TFpqkNOLBlq0Hj=0dJY0W#nDQ@=nW$$C386_xq1_ww^mb9z0t!z##0B zeHq?_-GT)dRjHcYLl()J46m$YComLl*%c-xz4)H*m66aa_vQ9Y(g@_a=3b(kxov@# z7NncD-)DFR%$NED-Z}#~-ku#+Hc-nUa`!WRTA@_8VliWd*6hP*cyXNc+SsyO+OqYghwDEm8O_ThzqFIIB zsnvm`U!f;lIYX~)PP!dg_7%L6mj=cS9=@Bu61h@l5FWnsOI6*hr8!%C{b%`meKYn?4?fcm)w z_RD*1m``o4o*VaGbcLEHE$Zp&Pod{pxNfHn{^}S<>V@jgrqRdQXF@v|9@V>SPWf(O zZY|BeTm9oz<#bnSi*3$9Ens^~`5Pbc0ubZ?3s@6;4hJwTUl`Zu#%0;qUD!jCqw#qw z#D&&OEqM@1-hMr&ImGaY@8~D+wbRT(B+#%BWixyMi)jEC>dS1vQ%YzEr%Q_Sx)L#_ zaA+!=3d%9W!~1j&?IK-on$8=Rm0JN&4Gs`w;i#m1)wElEBWTR5}d)>Nk?gAcA-^g=*Bia9+ zcQC!{E6%55IT(Df>9f23@DU+4sp-bL9SRQCLO|6e+);2q_W>^X4u=RQ(Z_;FwuFUb z3C#tkt}1-&k+$?M0rqmzhV^W=68m)Yte_;5%l_#Uxi>J?VI`;Qo*&H3)Rx5+b`9l+ zWA`@}#LY9PjqHV0)U&{<5+`T-mKc=12C$b)R@=-UplU*OBFyN@2hl~(c~M^NcLh|Y zjE3a2qnb-{ys7-5bHMp=J8GAGGkc33x9O4b>K3TQcL=@wL#_e59QmYy;254g_Kfx; z9m(PoT8#Bp-sxfzn3i(2q|9~J`JpV8M7)!%W#ZDYWJfAFK1~T&UUgP6#!6AVl4*IY zHAF|hv@LUgU_u9Gt1q23sYc_EPYw5PYru(bkzw-a=-IO9d3(`O$SgPtAq^sBJ>%ZT z@_r;tz7L8q2>)8AK;FEOt$%QojAu+2iSD!QcX+|Mx3jy-!M7mpF*k7YfaNdnvc?tm zpo<9haktg=wA-s6qw;uiQe4N3(kZkvuL%l8c=38ZK(; zfYv5DG43I^H|&jAgb0}~W9rLX*fHDGOOU;&a;{01C$NZXWscnsl=-@_3bQ93oU-w* zF@79^Goy3$wy|QC+jHMA;?bid>r?8FG~D#!2z#jGo~-=Db}~=_r+`fAvg}h+FoPOV zv_4^1e!NnJyWU;P$F$}40pHQdo|{{&*nS^kRx~5jY7740f)qh&U9$4S(fx&55)CQk zqI&USwwNJjO7|&;d|HAh1t8_5OEgn6>`=4q91=R>{t>5Mpq5sec+Ufy#{=}>3*$7bKEFuR$bxoK+Yy&r64So$?)MKN_BOyg8_W4PmLa| zB|j>CBP;iPux(I{w~!p`BQ*C!=0|(&eACWsOg%9-uFz1GWcUtdh=P@iFR9Xx6DGeg zXGvt)w~7`il_|%13GbZJ;`NY^T(E>Yox=@rU}b0HwuhrOXl-;pYQyeONy;2Kc9Y9n zkDx8J)|jK?=gTV?OGTdu*UE}$(AM?xQ3U5gzA7Ynt?DWj!i*lp(DzQj{RXCmj!3Gg zgk;|OHCB*CfdJ3pVTGl|79w)9C29Yp(IL|LXR0F_$o!pItSIO0&B_{w#sVq1yjF2J zVVI?NC0kYLr2TZ#Q3i^P;^U3ej+b@~wwRZqhDo zmB=CA%V5eHjYfQbyXB9Hr15)VGJQ~&+aa;Q3(X(j1aq4BmtTP=W)ZL_#D#pd)p>!A zAx_;g2{-H{Vi-DA6!y^!@}>Oci_MMhGNe6lyHI9y@`qXctCj7ZMFG^Qc;Xvu%;9d+M^n^|A#tiy&VU#%~+s7sieIeEp&aFTAK?pqRMjL{)5pRHHh;Rck*W6(lJL zT}XGpefQ2a+}CQC?lhj+-H<}K3>x|EZSlpb98in;4%&Cv&?Nw#i*$CXjCUo zgGEmzb)HTcCb9oxAhGC?S!qO4Nx=}+25APWUI>mGudYik7Zo&)WOdZ94>Ui?GE}wU zQV88ee@1HQBphb?^EtupZ@sfIQ;8V)5w6@5YctCZI3|epb z)zv`3;J}i$5y@g7j(6J7!dur==JXRC29|w=%Dw1yOqp%s`YiHR9{zs(_#JQlpzZ?_ zTfhC+eMZa|Yj9$Vx=xICo02N4=K9O=V{s{dig}fbUGw~@`b6THX=KZkJzOKz~n8tb_ClgI3Zbbtx1yv zU;4XGw-+QViIMwFtMhDGLFGqDOKRq4NcBPsEGL9AACFi?3#9(AhRwOjkXq|hdM zk^vY;Pq~HGq>ztB2OWqUF!J8!mc11hjd*h{ms>VW=8qNMLhk{ktY9!~8vVpzZb3as zt$u>7Y!fx9sG##zEXqC%M>bk)Yatnp~a`0j_do^UyI@} zj24 z>3MR{cX`Zw%;j;{aL7{jnD%rpC98NJ^-w%IuIJFWP3Tx$tS+CbTM!t^!}- zNBMi4_xa3ijFcqrht0KR_M#K|WPyqT6BU_&#z>BPYzHpKyff0M*Q?Y;Ik$r+c&42&a9ZTd7HS%Vy@01)rh!(YWD3b@~UK^uD+WKIcnuGjNcJ!`<5V+#h|fEv={RN`ZQbV;LDe-j!c0>U`@}$d zm*FOy|GvPEyT8i=0($)n4?-;YJ3W`%Q`Xl4;YoaO#ep zaJ8na-!sX(F)rhGhe>nbzFd?c1eOQXso9aOOaVEWC_cO0kh8F%`OIT|ADKsd4Y&(- z3NJI}F$n2AYuVaWWvY@z%|_HvY{$yq5fW|diXOKV((Xuaf?KjOvocvFta>eW%+1a1 zhHNEP#m=YvI`d0-t=*t0`bE*yw#FG7a zf(1Y(R;oe(Hd@e`_*HIy0uN|~AvYC1~(xX>G0M5z=E>sRr7(VC=9 z^_e*!lI4k#l*fhPOVcizQzjS1jbXBf-4=EsQ9069r!E|<;UDNk+TQD+U<)ZK<`%@u zG1xw~WLC_JN_a(l5z$aGxTRf3Uoke5j@@+uX$Yn-t{qS3Y#z)7-++3`^-xSWXT{me z#&u{*4z}>a!k3Nbq3X#*rWK;nWjgAG!E)%N!So8$aE+&f;Q132?otZpQ5_Y2-`oN< zJT$=qiIi7)st_4GE!;NgM(tT7YaRV6u*=rn_VPMQ3pceC`Hb9{`9rbdRMM3x`-pm zBKv0pYkRF!q^$wXfzlBb0RWT&5?emO`FtANd*lv583dn?d6(b56j}0Ckt@E&p+l~j z74^B|LEYaoyWy!z_o?wZ!LFCdlHH7x=zf{h-S&Lz#E zwgn25$7xs9>h9Ukrsjw)Vawcx3%PVUe-nqyTzBiqhb+mz^fBkU+)s^NpRbm0<-Wl2 zcS6>Ad^W~2lqYWnMRSuB%^335BARjK+=CpTRRyVI^NrybQp!YpJ$9K4p5&5GPb1Y^ zFzYrtK)$0(c|gt*a`~V! zuI#M85Sgs;%hrj6dBdv|9N(khbF9sY89~B{due=q%R!~LtwOdFvw++fqzC$AlNKM~ zbl-_0S4Yj;MIVJa$l7VP<<4;P4uh~~1S@LcxomUWNx`1lE-UutJKxA#Nezy!#?3V| zj(r^Q_c2bTnl|0s>RT6rT&_T#7k+V}A4-dg#;l;+MP1yL5c2@nR43k#f%O|J7iE}- zc4w)4y+N5+D@6>7-s?np;>vWB?-TuOsi7ain$O=)10OoajNo$&_-cIo7LaCjLVE)4 zHJ%NXq1QRV;o*Ql;1%$imYTwnd`Ldsi-U2xK}`(RK-g{#q)&kXBBAwaPWz#(z|);L z8S?@~0;D_hPB#JsGwlS;q%4yeS;Wg8@rqA3jFl_&Cpm;z&HKqiBuhbuT2{ zEm53#-<>zrOPtOneuEhu5Rq>`NOZ$;D#Kndk{}UeJ5M-e+w~4LSJNr2z?VAG#eBh2 zJx$75R&0iBBE9>g_l#4CPw;c{LF~Bst8fpZttrZD<$6jt{%!sV_Y~wdug(IrLps-7 zszLQvu+pVG!^gHk^9#ItZTJ+9ejW!MWyl?HhGqAU5zEH8ZY`0J!?;Aw#|n{#Q(|Ubk!fUBXq; z^kw&2at`dRMe5{L`nwymt+&M{htS(`{jX^CSnoxR0taV9z59>2wcKnoE%*7_PH?hu ztb}PoJ{~ozAn(QFf02Trx`{VcA|K}`tY9wpV5O2?seB)uFW(SCt8A3Jj&XI$$A2eq zsLxlZloQ_a{5Yn2y8JTkpf-!=10{Jy8`^#l&xMhJ8IAZA*+}#EY3DCu z4bdRatj;%fsYweba-5xOtrwKR0P9PFVAR_C)|NhIuv+$G?@85}53JtDsF?)Q&$4qH z5>db8+Brpzj-|IC+yFsM>tz)a%y;*8XFZtHkhX;Gww+6a1lsoR_cK3{|Y-h3x z?f7Rg9bmT|;%$5qyfF{FKQOz;TwB;H^Byt?M2DZ-i}!XXJ~|CbEb=JFG^2RUCD$Dn z5VhL9xmc&&mEeVEk}>tD!zockQRoFQ5Bnhf>^y}3`syOCZ=JpU^(~6xHD}WA`SBm{ zi~mh}{6B$P{=g=HprAieY1LX9XcZ34h`f5V*^K zlO@;q6XpPgg8w5}L6TkiKY$hffGYe*qW=S~@B^rT04V$dOR)S2OZb68Kp+tQOFsN3 z5aAaP!oPC-Oo6mX7QpCUlh=PL)OFdao?pEJ9-$ZpdF9<(?Hz z^Wa`ngu5YCb(jQTk}xX5E!?G>(2%`4OG9dxhVx#3cuaRxx8t&nA>;^L9pWA`CDkld z4tPscMKIDWWr%n55ERl&M;)=%ZE1+%;IDtL%HU!6M-gshQj=&(h6wsOvj^a|%<{}D zQ4!PbI2OJg@wW*+FT8`UE{%?vzP_6E_WrOUtE?`6D!U>N5pBIk8h*8LlC-rj@X*un zGm&3xsSKg|pxG2&9;nbzmibhox-laTk{4P6h%}& zgyA#<)uxb0UfS}zs!7@9m*ILN2ewC9?NPCvNFOw{_jxgTpEi}-3b#$<*czUM+u;MSB8V7x+t}cdUx2GiZoCMmVvXO;6S$f@}-_SNP z-kaX-o)fK`HBX|NXHBx^)PH$-WgQ`EFrv}@AXRp4nES*e2W7loYx`iDS1qMy{)&%; zBEZFl&sJTUZYa)>Za2{rsadONq!O7d-cP?DVxCqnQj`#R|HCQrbo^q#8_IJ*;f9sK z#1k4^9!Kj`bN`#lCZ)h4YcY8K|` zExYUDAN+Mm=^Vp*?b-6;ch<`{dU1tmZSP<#oJj7Ri4(nCHN#27_XBa<7@} zL`S~~gDxG;xGct$F2($ z0861{TAx2WFFf6Eu(OM8mqdC_s}rFikQ?JY-WRCtrjK`_!>5mSxBm-v7&z^1U>gc_ z>z<+QOf8M6>ORDuS7F@F6>L)#N9?`Qb98o1?L~586 zrmIdu7#W;9P;cg8uVvd04X-AV?2(%~avh`Qz5@W-SE@Fwg&g9M$AuT@DvnB0<+P%% zFTF6<$ttYYEXTCaT%F7xZ=Wcfw zA6D2FVSN6wWcFc3I^@1&#pHJwK99_K`wRR?Gh>~)tvMmm;@3B=?KN9H@jONx4o zneynG(;QB7PT#%mwB-DXuZT@}`+DwYgVoD7*Bd3ZLXymP681Pc2FF;p z{8(2mH5KJCsfekJN=&$e?w@7MXl=K`ty*w%`HV#_AiV#8`x92 zJXvzR5k7?1tNOh2yYt>2b;Em2eXl;TjBXdgjr63JEeKT`>7J!i)Mw%BT%fGO zJ@#(ROR5aqBK!^pf$vFV51YrGadptmzG~y0qqF7GRQL791XuJ?om)LZ#TzMu+r54& zpjD1^dz3++E@uX{a=sdOd&^*4hE7(2#~48Rl11!Tc#``*xa1Q?erQqO=sFUyrVfn- z_Xx%J?_j841f(pjjndah`qj$WU6=%Cng)`vM4*H`){`K}<$fpE!Kc{1Tzmtr z$OV=}Bd$@hjAsl;6Yq-S7PrDV%IC}jlfbAj8QqY15>1F)L(9D(+x6mE53X?2XSZ3^!TBaLZywAQRAox1#eHpsA z|F}lp$J=}@kx?EIq3;~l%W>I;lls+Pm!BOPt|vz@r+9F=k9-BB4b*JT;>P*MRo8P$e^uNQL95A! zbfJ5ZEPSMDhkzF9@Cz9~FGtsLTmfI>;ZY0MG@YL2<8ma=nbz(b@aHtk3HL)UG_pop zSaZi?9N#HviXvg@A>+-(^t82Jj46_2K5^i!H&6m4-AwQyuw*N=U;hM~`2{%P`& z|7ZbJ7S=J`3TP>CHC^PFspsRd^p^`sgo(!*n=wyVwvTOQRO(ae@ZDL+vo?89Hj!WF zkY6X3@0k6Hr-~ly5iUNfkoIu@qgZ;qi<~y{!SjqKzH5-iY|vKeKKAV^&%v7xfvc7l1sGF*e2kcx()ZstKhOm@Ann?i`04{4d-RvAOn% z)!>xEyG2q(jo??LvKy_j6wHIH#7xNYm@1qvl=qdU$NgCnB&D%S=_)GLvT(Xol)Y@E z52hbLUuahsJ)Oab4SfIotDYQ^uK3VH!{OPXm-eGm)`RGYU3Y>7ZImpdWVjP2qi-8F zw;Ys%19Y7k+|bwp%NDiHM=`y^7Uo|wkjiQe37{Lz<|5aN9W2rpe?769pp_Bj$XJQd zMC{EYvB`^Kt{niul?TV)1V>_Sx@uMbGarv9%%EryM6$)?uXmc95s9T&@3oV(h zZ-%;L=?0@+E~X=%J`06uo`C`CII}UfUNJSH*k>&VDn_RvSoahh<8SbrcgrbW#rY;H z+d64C=a8sK2R5ZoW{7D5a3yL9HMbH@@@TLcY*Oac7PJ&6;I!;ofPIGIXlA-lF~r@*>y~9{ zyH&D{Y^+--mdmw;YbnLdWuWu%X?8jP{c>9}ncZ+PoDm%;WlR0}Tz!@JQ0;6>xX*Ui zg4c>b7vjI~kk*IlJtL)eYBf8_I47Bf2!7>ZVB*mXcnMu&np_)ATZ;VCe)*z%j-$u{63wYK{QABTFqU{FYyZw z-Uly=W}f*{GS5?VjAr-b3#{gDEWC?mh5;DCo8dKw(fn`fDlq#ymS{G|9nDJ_t{xCT zSe)DGc;AyKY2#z17}-4)1kbwZIWNr;@#By8yi6xD3LGOk-XkMm!C54@8*A~3= znOp@28Ui4XOpYSV>D0#(kHZ&Jsa~vsZid$E#`eD;8ifc7XnrvFxg%W#TB?fg(0oTD z{yaR<-1D<$cHQWlSjeuu!KWd&cGPEjwktfFnzfHBM55GMns(+tHMJbHeGvDsCoNiu z!avADF_tZ?1s0vy%dx%4N}%_wgFWsM-8&KZLQ3MB_xY;3ATFA9tsJRed0vCZZwv1} z*02$6+NC*ibYRILKqjo`Su4(<_BoCxHqG;%3wK6WEb4Fh7uv}R4t^1Gy7;}H@pSy7 z?Lrp=qwq_dvUPYpd04QPj=r07?Y1W@T+t8>eu(fB(JsM2hXq8gUXCOkwcRiWq`fBe zI^i6~YF2Zb9)Z|%y;D@T+eY<6{fz2U(KUyFAbYL0RqzKPwteH^RK~5rton4RcE5^G z2wCL!rsI4IVim>P}?0u@<3)SS%k}jQ__2+yX4I4Pc}9hlJ0Rcpe0xWJA3Yjbmz856@;mXIXdLW; z^}{LffQeY!P0B!}ck}H2R1(+1l;4R|3uLisU0v<;?b1EUQ;3e>(2}z{$-Y3j#FI}2 z!5`tBGJ>zLgoE^AyuDw1Ur`U4kF!4OOwM|6Q+oLJDdCsrK+yp*QSB>==)saY>^F3-Yd*bY`IxRsk=dtATaM8r*x*vt;@bvLEr#k4jNO3z0SAjXOlj52VPEAi?+G@_^I?0lu`Zmeh4(QBz$vaKNlTl?B_wx(!RPn@Yr198;#RDxdTznpBHvOlNl~=ASl$*lw?B`_I zmZ8>vBui*3mSB0pJIe+;I_zZhE)4VYi$3*xL335TmM-^xs`hYmdVo7PS&ej1Fpm$3 zB;9>;`UpePJJ+~|;!>e4`?|DWAAK(8asDhilhzPlf8zxGR0xAf;!EsBNzxrv_G{_* zqpp+z(8d9ow^&?BIu0%R(1Ebs$1}(38@st+dSu77!H)DyDv9W)l*G+TRn1HE41p_` z+;;BYRTly5vEmN1I^FShm|?v=ah!&Q>DODb^@p%qW%mgYJ)j)s+0nh6tp}UnIF*6q&20+f_VJNVIDd8qfYRv z@7!3I8IzW!LJ)yR`1WO*Cq__g=tchy3$IQF7CaorM|9&zQrX_e34DvZ6ChOe`H}N7 zVcn?pg9oLx-~peYE~|H#8K*F`X;!>4%6fO*z*ptZ2`g&j+qif<7Q~<>N6*$Y6=YqB zC(Oj`rlPa7-wWW6MNiK48Fob;y7dydFMeGN7^>`%lvb=~LFEhJ5I#>9qLv4UYcecJ zx8{=!^1V}uf>*_ogkin8WG2QR$4If{X_rhst=vc(!Y@+g4WZ zU^^a@p?$K!J!P#3e6RCl`+Zwio0B6p`gFr-2faDBp_jx;S} zD?`r1zNOG^@QSx~j+%-uzUip%zdMCB_t-g@?#lz@ubK(Np#;WIA^NX&3l5Ixf!5Im z#T5ib8vdZWpDiYVL4!|gU|lOSZc`e#K=g+C@1O0p$l|VsCJ5eXI_pXmfZFh=oF3oFTpQU6eI=XSTTw?PnO z0^Dt^ZJoH?`51mS;YOVQ5VJD?eyTWI@iAz~Dgd1A?5wRUoB?1qI2(u+1YrS~IwF{@ z-0U2!03bF_21J*R#-`j#2$tDDIz;@%$6)U4Y|qWk?&jvk<_2N2b2MWI!QpUrAebEt zW<_YQI(gVS8@RLDI?*8P{dB}a2eAR!|6%AKEL(`0rhp%Y z4Ge$O9;K%Kvlm2J(tqC#;sZoK5X9vn&bSfmxW+C4kT2-aSHFc1u71%g?DFcmO_8w%$J z!L@kV|E7ePC`2n^M6FXq?bH9>>Mu%vX=UfAf|xmeGepE2k-tiwnwO1T^L}{ol@mvC%*Muy=8^{uy${M(ifmCO=F% zA*KR^aKzY%+tkj{#=sd7^!D}$KEI!}aoG_O!NAXp_|Vw`0lwk?8PG!3&VQU(Tl@$u zZfgTuGd>1)R$~)W0~c#&27XoBpW4QMjGeUw{~sqm+p+(vuYWVLKShWIgBWD?e=bLU zY{37~@qgFRzwSW@7#1Ic+mAcUZ-A`7Jm&nzs$%>Pi;4;HVE0EvBSP^z{$Y@ z;Q*Kd{*=L>AO!p4j{{))rwjswLH;g7h<*^s{h|lt`oYQlHyIEF`%MOd{NUI8r7ePR z7K-3m{6z+a01-Thzsi7c2pj>T`b7`K1wya~{wf2)xFCPG3j%Ti|K1h|gZ}Ox7Z=BG z{ed7qs!RQ17cpC02-enLWiXE4>;k!9aKuK0U-b|ygunF%MNIwQ^|4jAX}{&D{99}EOT@bdoZ9|sKnn}1v!zl}W*#`&9nAcQM_A7{juIf4TDR~v{h z|2?kYVEAvoz~PX;&j$#|@uOhmFFu3e9I(IGaCS665Fk1tNXY^0$`+m`h`0wJxZ>>) zobQNTAxZ#tNn2Ap0Ae72ki|=i0JM3*Pl2L{;uxI5a3LXKh^VNr5GSXo7+4Gh191VL jatZPO&l{&4IG_+E;a}djwr`MM<*&ThW-BlB=6{} literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.txt new file mode 100644 index 00000000..ad63476a --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ctl.8.txt @@ -0,0 +1,347 @@ +ovn-ctl(8) OVN Manual ovn-ctl(8) + +NAME + ovn-ctl - Open Virtual Network northbound daemon lifecycle utility + +SYNOPSIS + ovn-ctl [options] command [-- extra_args] + +DESCRIPTION + This program is intended to be invoked internally by Open Virtual Netā€ + work startup scripts. System administrators should not normally invoke + it directly. + +COMMANDS + start_northd + start_controller + start_controller_vtep + start_ic + stop_northd + stop_controller + stop_controller_vtep + stop_ic + restart_northd + restart_controller + restart_controller_vtep + restart_ic + promote_ovnnb + promote_ovnsb + demote_ovnnb + demote_ovnsb + status_ovnnb + status_ovnsb + start_ovsdb + start_nb_ovsdb + start_sb_ovsdb + stop_ovsdb + stop_nb_ovsdb + stop_sb_ovsdb + restart_ovsdb + run_nb_ovsdb + run_sb_ovsdb + promote_ic_nb + promote_ic_sb + demote_ic_nb + demote_ic_sb + status_ic_nb + status_ic_sb + start_ic_ovsdb + start_ic_nb_ovsdb + start_ic_sb_ovsdb + stop_ic_ovsdb + stop_ic_nb_ovsdb + stop_ic_sb_ovsdb + restart_ic_ovsdb + run_ic_nb_ovsdb + run_ic_sb_ovsdb + +OPTIONS + --ovn-northd-priority=NICE + + --ovn-northd-wrapper=WRAPPER + + --ovn-controller-priority=NICE + + --ovn-controller-wrapper=WRAPPER + + --ovn-ic-priority=NICE + + --ovn-ic-wrapper=WRAPPER + + --ovsdb-nb-wrapper=WRAPPER + + --ovsdb-sb-wrapper=WRAPPER + + --ovn-user=USER:GROUP + + --ovs-user=USER:GROUP + + -h | --help + +FILE LOCATION OPTIONS + --db-sock=SOCKET + + --db-nb-file=FILE + + --db-sb-file=FILE + + --db-nb-schema=FILE + + --db-sb-schema=FILE + + --db-sb-create-insecure-remote=yes|no + + --db-nb-create-insecure-remote=yes|no + + --db-ic-nb-file=FILE + + --db-ic-sb-file=FILE + + --db-ic-nb-schema=FILE + + --db-ic-sb-schema=FILE + + --db-ic-sb-create-insecure-remote=yes|no + + --db-ic-nb-create-insecure-remote=yes|no + + --ovn-controller-ssl-key=KEY + + --ovn-controller-ssl-cert=CERT + + --ovn-controller-ssl-ca-cert=CERT + + --ovn-controller-ssl-bootstrap-ca-cert=CERT + +ADDRESS AND PORT OPTIONS + --db-nb-sync-from-addr=IP ADDRESS + + --db-nb-sync-from-port=PORT NUMBER + + --db-nb-sync-from-proto=PROTO + + --db-sb-sync-from-addr=IP ADDRESS + + --db-sb-sync-from-port=PORT NUMBER + + --db-sb-sync-from-proto=PROTO + + --db-ic-nb-sync-from-addr=IP ADDRESS + + --db-ic-nb-sync-from-port=PORT NUMBER + + --db-ic-nb-sync-from-proto=PROTO + + --db-ic-sb-sync-from-addr=IP ADDRESS + + --db-ic-sb-sync-from-port=PORT NUMBER + + --db-ic-sb-sync-from-proto=PROTO + + --ovn-northd-nb-db=PROTO:IP ADDRESS: PORT.. + + --ovn-northd-sb-db=PROTO:IP ADDRESS: PORT.. + + --ovn-ic-nb-db=PROTO:IP ADDRESS: PORT.. + + --ovn-ic-sb-db=PROTO:IP ADDRESS: PORT.. + +CLUSTERING OPTIONS + --db-nb-cluster-local-addr=IP ADDRESS + + --db-nb-cluster-local-port=PORT NUMBER + + --db-nb-cluster-local-proto=PROTO (tcp/ssl) + + --db-nb-cluster-remote-addr=IP ADDRESS + + --db-nb-cluster-remote-port=PORT NUMBER + + --db-nb-cluster-remote-proto=PROTO (tcp/ssl) + + --db-nb-election-timer=Timeout in milliseconds + + --db-sb-cluster-local-addr=IP ADDRESS + + --db-sb-cluster-local-port=PORT NUMBER + + --db-sb-cluster-local-proto=PROTO (tcp/ssl) + + --db-sb-cluster-remote-addr=IP ADDRESS + + --db-sb-cluster-remote-port=PORT NUMBER + + --db-sb-cluster-remote-proto=PROTO (tcp/ssl) + + --db-sb-election-timer=Timeout in milliseconds + + --db-ic-nb-cluster-local-addr=IP ADDRESS + + --db-ic-nb-cluster-local-port=PORT NUMBER + + --db-ic-nb-cluster-local-proto=PROTO (tcp/ssl) + + --db-ic-nb-cluster-remote-addr=IP ADDRESS + + --db-ic-nb-cluster-remote-port=PORT NUMBER + + --db-ic-nb-cluster-remote-proto=PROTO (tcp/ssl) + + --db-ic-sb-cluster-local-addr=IP ADDRESS + + --db-ic-sb-cluster-local-port=PORT NUMBER + + --db-ic-sb-cluster-local-proto=PROTO (tcp/ssl) + + --db-ic-sb-cluster-remote-addr=IP ADDRESS + + --db-ic-sb-cluster-remote-port=PORT NUMBER + + --db-ic-sb-cluster-remote-proto=PROTO (tcp/ssl) + +PROBE INTERVAL OPTIONS + --db-nb-probe-interval-to-active=Time in milliseconds + + --db-sb-probe-interval-to-active=Time in milliseconds + +EXTRA OPTIONS + Any options after ā€™-ā€™ will be passed on to the binary run by command + with the exception of start_northd, which can have options specified in + ovn-northd-db-params.conf. Any extra_args passed to start_northd will + be passed to the ovsdb-servers if --ovn-manage-ovsdb=yes + +CONFIGURATION FILES + Following are the optional configuration files. If present, it should + be located in the etc dir + + ovnnb-active.conf + If present, this file should hold the url to connect to the active + Northbound DB server + + tcp:x.x.x.x:6641 + + ovnsb-active.conf + If present, this file should hold the url to connect to the active + Southbound DB server + + tcp:x.x.x.x:6642 + + ovn-northd-db-params.conf + If present, start_northd will not start the DB server even if + --ovn-manage-ovsdb=yes. This file should hold the database url parameā€ + ters to be passed to ovn-northd. + + --ovnnb-db=tcp:x.x.x.x:6641 --ovnsb-db=tcp:x.x.x.x:6642 + + ic-nb-active.conf + If present, this file should hold the url to connect to the active Inā€ + terconnection Northbound DB server + + tcp:x.x.x.x:6645 + + ic-sb-active.conf + If present, this file should hold the url to connect to the active Inā€ + terconnection Southbound DB server + + tcp:x.x.x.x:6646 + + ovn-ic-db-params.conf + If present, this file should hold the database url parameters to be + passed to ovn-ic. + + --ic-nb-db=tcp:x.x.x.x:6645 --ic-sb-db=tcp:x.x.x.x:6646 + +RUNNING OVN DB SERVERS WITHOUT DETACHING + # ovn-ctl run_nb_ovsdb + + This command runs the OVN nb ovsdb-server without passing the detach + option, making it to block until ovsdb-server exits. This command will + be useful for starting the OVN nb ovsdb-server in a container. + + # ovn-ctl run_sb_ovsdb + + This command runs the OVN sb ovsdb-server without passing the detach + option, making it to block until ovsdb-server exits. This command will + be useful for starting the OVN sb ovsdb-server in a container. + + # ovn-ctl run_ic_nb_ovsdb + + This command runs the OVN IC-NB ovsdb-server without passing the detach + option, making it to block until ovsdb-server exits. This command will + be useful for starting the OVN IC-NB ovsdb-server in a container. + + # ovn-ctl run_ic_sb_ovsdb + + This command runs the OVN IC-SB ovsdb-server without passing the detach + option, making it to block until ovsdb-server exits. This command will + be useful for starting the OVN IC-SB ovsdb-server in a container. + +EXAMPLE USAGE + Run ovn-controller on a host already running OVS + # ovn-ctl start_controller + + Run ovn-northd on a host already running OVS + # ovn-ctl start_northd + + All-in-one OVS+OVN for testing + # ovs-ctl start --system-id="random" + + # ovn-ctl start_northd + + # ovn-ctl start_controller + + Promote and demote ovsdb servers + # ovn-ctl promote_ovnnb + + # ovn-ctl promote_ovnsb + + # ovn-ctl --db-nb-sync-from-addr=x.x.x.x --db-nb-sync-from-port=6641 + --db-nb-probe-interval-to-active=60000 demote_ovnnb + + # ovn-ctl --db-sb-sync-from-addr=x.x.x.x --db-sb-sync-from-port=6642 + --db-sb-probe-interval-to-active=60000 demote_ovnsb + + Creating a clustered db on 3 nodes with IPs x.x.x.x, y.y.y.y and z.z.z.z + Starting OVN ovsdb servers and ovn-northd on the node with IP x.x.x.x + + # ovn-ctl --db-nb-addr=x.x.x.x --db-nb-create-insecure-remote=yes + --db-sb-addr=x.x.x.x --db-sb-create-insecure-remote=yes --db-nb-clusā€ā€ + ter-local-addr=x.x.x.x --db-sb-cluster-local-addr=x.x.x.x + --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641 + --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642 + start_northd + + Starting OVN ovsdb-servers and ovn-northd on the node with IP y.y.y.y and + joining the cluster started at x.x.x.x + + # ovn-ctl --db-nb-addr=y.y.y.y --db-nb-create-insecure-remote=yes + --db-sb-addr=y.y.y.y --db-sb-create-insecure-remote=yes --db-nb-clusā€ā€ + ter-local-addr=y.y.y.y --db-sb-cluster-local-addr=y.y.y.y --db-nb-clusā€ā€ + ter-remote-addr=x.x.x.x --db-sb-cluster-remote-addr=x.x.x.x + --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641 + --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642 + start_northd + + Starting OVN ovsdb-servers and ovn-northd on the node with IP z.z.z.z and + joining the cluster started at x.x.x.x + + # ovn-ctl --db-nb-addr=z.z.z.z --db-nb-create-insecure-remote=yes + --db-nb-cluster-local-addr=z.z.z.z --db-sb-addr=z.z.z.z --db-sb-creā€ā€ + ate-insecure-remote=yes --db-sb-cluster-local-addr=z.z.z.z + --db-nb-cluster-remote-addr=x.x.x.x --db-sb-cluster-remote-addr=x.x.x.x + --ovn-northd-nb-db=tcp:x.x.x.x:6641,tcp:y.y.y.y:6641,tcp:z.z.z.z:6641 + --ovn-northd-sb-db=tcp:x.x.x.x:6642,tcp:y.y.y.y:6642,tcp:z.z.z.z:6642 + start_northd + + Passing ssl keys when starting OVN dbs will supersede the default ssl valā€ā€ + ues in db + Starting standalone ovn db server passing SSL certificates + + # ovn-ctl --ovn-nb-db-ssl-key=/etc/ovn/ovnnb-privkey.pem + --ovn-nb-db-ssl-cert=/etc/ovn/ovnnb-cert.pem + --ovn-nb-db-ssl-ca-cert=/etc/ovn/cacert.pem + --ovn-sb-db-ssl-key=/etc/ovn/ovnsb-privkey.pem + --ovn-sb-db-ssl-cert=/etc/ovn/ovnsb-cert.pem + --ovn-sb-db-ssl-ca-cert=/etc/ovn/cacert.pem start_northd + +OVN 23.06.3 ovn-ctl ovn-ctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-detrace.1 b/src/static/support/dist-docs-branch-23.06/ovn-detrace.1 new file mode 100644 index 00000000..703f8992 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-detrace.1 @@ -0,0 +1,273 @@ +.\" -*- nroff -*- +.\" ovs.tmac +.\" +.\" Open vSwitch troff macro library +. +. +.\" Continuation line for .IP. +.de IQ +. br +. ns +. IP "\\$1" +.. +. +.\" Introduces a sub-subsection +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +. +.\" The content between the lines below is from an-ext.tmac in groff +.\" 1.21, with some modifications. +.\" ---------------------------------------------------------------------- +.\" an-ext.tmac +.\" +.\" Written by Eric S. Raymond +.\" Werner Lemberg +.\" +.\" Version 2007-Feb-02 +.\" +.\" Copyright (C) 2007, 2009, 2011 Free Software Foundation, Inc. +.\" You may freely use, modify and/or distribute this file. +.\" +.\" +.\" The code below provides extension macros for the `man' macro package. +.\" Care has been taken to make the code portable; groff extensions are +.\" properly hidden so that all troff implementations can use it without +.\" changes. +.\" +.\" With groff, this file is sourced by the `man' macro package itself. +.\" Man page authors who are concerned about portability might add the +.\" used macros directly to the prologue of the man page(s). +. +. +.\" Convention: Auxiliary macros and registers start with `m' followed +.\" by an uppercase letter or digit. +. +. +.\" Declare start of command synopsis. Sets up hanging indentation. +.de SY +. ie !\\n(mS \{\ +. nh +. nr mS 1 +. nr mA \\n(.j +. ad l +. nr mI \\n(.i +. \} +. el \{\ +. br +. ns +. \} +. +. HP \w'\fB\\$1\fP\ 'u +. B "\\$1" +.. +. +. +.\" End of command synopsis. Restores adjustment. +.de YS +. in \\n(mIu +. ad \\n(mA +. hy \\n(HY +. nr mS 0 +.. +. +. +.\" Declare optional option. +.de OP +. ie \\n(.$-1 \ +. RI "[\fB\\$1\fP" "\ \\$2" "]" +. el \ +. RB "[" "\\$1" "]" +.. +. +. +.\" Start URL. +.de UR +. ds m1 \\$1\" +. nh +. if \\n(mH \{\ +. \" Start diversion in a new environment. +. do ev URL-div +. do di URL-div +. \} +.. +. +. +.\" End URL. +.de UE +. ie \\n(mH \{\ +. br +. di +. ev +. +. \" Has there been one or more input lines for the link text? +. ie \\n(dn \{\ +. do HTML-NS "" +. \" Yes, strip off final newline of diversion and emit it. +. do chop URL-div +. do URL-div +\c +. do HTML-NS +. \} +. el \ +. do HTML-NS "\\*(m1" +\&\\$*\" +. \} +. el \ +\\*(la\\*(m1\\*(ra\\$*\" +. +. hy \\n(HY +.. +. +. +.\" Start email address. +.de MT +. ds m1 \\$1\" +. nh +. if \\n(mH \{\ +. \" Start diversion in a new environment. +. do ev URL-div +. do di URL-div +. \} +.. +. +. +.\" End email address. +.de ME +. ie \\n(mH \{\ +. br +. di +. ev +. +. \" Has there been one or more input lines for the link text? +. ie \\n(dn \{\ +. do HTML-NS "" +. \" Yes, strip off final newline of diversion and emit it. +. do chop URL-div +. do URL-div +\c +. do HTML-NS +. \} +. el \ +. do HTML-NS "\\*(m1" +\&\\$*\" +. \} +. el \ +\\*(la\\*(m1\\*(ra\\$*\" +. +. hy \\n(HY +.. +. +. +.\" Continuation line for .TP header. +.de TQ +. br +. ns +. TP \\$1\" no doublequotes around argument! +.. +. +. +.\" Start example. +.de EX +. nr mE \\n(.f +. nf +. nh +. ft CR +.. +. +. +.\" End example. +.de EE +. ft \\n(mE +. fi +. hy \\n(HY +.. +. +.\" EOF +.\" ---------------------------------------------------------------------- +.TH ovn\-detrace 1 "23.06.3" "OVN" "OVN Manual" +.\" This program's name: +.ds PN ovn\-detrace +. +.SH NAME +\*(PN \- convert ``ovs\-appctl ofproto/trace'' output to combine +OVN logical flow information. +. +.SH SYNOPSIS +\fB\*(PN < \fIfile\fR +.IP "Common options:" +[\fB\-h\fR | \fB\-\-help\fR] +[\fB\-V\fR | \fB\-\-version\fR] + +. +.SH DESCRIPTION +The \fB\*(PN\fR program reads \fBovs\-appctl ofproto/trace\fR output on +stdin, looking for flow cookies, and expand each cookie with corresponding OVN +logical flows. It expands logical flow further with the north-bound information +e.g. the ACL that generated the logical flow, when relevant. +.PP +. +.SH "OPTIONS" +.IP "\fB\-h\fR" +.IQ "\fB\-\-help\fR" +Prints a brief help message to the console. +. +.IP "\fB\-V\fR" +.IQ "\fB\-\-version\fR" +Prints version information to the console. +. +.IP "\fB\-\-ovnsb=\fIserver\fR" +The OVN Southbound DB remote to contact. If the \fBOVN_SB_DB\fR +environment variable is set, its value is used as the default. +Otherwise, the default is \fBunix:@RUNDIR@/ovnsb_db.sock\fR, but this +default is unlikely to be useful outside of single-machine OVN test +environments. +. +.IP "\fB\-\-ovnnb=\fIserver\fR" +The OVN Northbound DB remote to contact. If the \fBOVN_NB_DB\fR +environment variable is set, its value is used as the default. +Otherwise, the default is \fBunix:@RUNDIR@/ovnnb_db.sock\fR, but this +default is unlikely to be useful outside of single-machine OVN test +environments. +. +.IP "\fB\-\-ovs=\fR" +Also decode flow information (like OVS ofport) from the flows by connecting +to the OVS DB. +. +.IP "\fB\-\-no-leader-only\fR" +Connect to any cluster member, not just the leader. The option works for +OVN Southbound DB and OVN Northbound DB. +. +.IP "\fB\-\-ovsdb=\fIserver\fR" +The OVS DB remote to contact if \fB\-\-ovs\fR is present. If the +\fBOVS_RUNDIR\fR environment variable is set, its value is used as the +default. Otherwise, the default is \fBunix:@RUNDIR@/db.sock\fR, but this +default is unlikely to be useful outside of single-machine OVN test +environments. +. +.IP "\fB\-p\fR \fIprivkey.pem\fR" +.IQ "\fB\-\-private\-key=\fIprivkey.pem\fR" +Specifies a PEM file containing the private key used as \fB\*(PN\fR's +identity for outgoing SSL connections. +. +.IP "\fB\-c\fR \fIcert.pem\fR" +.IQ "\fB\-\-certificate=\fIcert.pem\fR" +Specifies a PEM file containing a certificate that certifies the +private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be +trustworthy. The certificate must be signed by the certificate +authority (CA) that the peer in SSL connections will use to verify it. +. +.IP "\fB\-C\fR \fIcacert.pem\fR" +.IQ "\fB\-\-ca\-cert=\fIcacert.pem\fR" +Specifies a PEM file containing the CA certificate that \fB\*(PN\fR +should use to verify certificates presented to it by SSL peers. (This +may be the same certificate that SSL peers use to verify the +certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may +be a different one, depending on the PKI design in use.) +. +.SH "SEE ALSO" +. +.BR ovs\-appctl (8), ovn\-sbctl (8), ovn\-nbctl (8), ovn\-trace (8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-detrace.1.html b/src/static/support/dist-docs-branch-23.06/ovn-detrace.1.html new file mode 100644 index 00000000..088eb6a6 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-detrace.1.html @@ -0,0 +1,81 @@ +
+ovn-detrace(1)                    OVN Manual                    ovn-detrace(1)
+
+NAME
+       ovn-detrace  -  convert  ``ovs-appctl ofproto/trace'' output to combine
+       OVN logical flow information.
+
+SYNOPSIS
+       ovn-detrace file
+
+       Common options:
+              [-h | --help] [-V | --version]
+
+
+DESCRIPTION
+       The ovn-detrace program reads ovs-appctl ofproto/trace output on stdin,
+       looking for flow cookies, and expand each cookie with corresponding OVN
+       logical flows. It expands logical flow further with the north-bound inā€
+       formation e.g. the ACL that generated the logical flow, when relevant.
+
+OPTIONS
+       -h
+       --help Prints a brief help message to the console.
+
+       -V
+       --version
+              Prints version information to the console.
+
+       --ovnsb=server
+              The OVN Southbound DB remote to contact.  If the OVN_SB_DB enviā€
+              ronment variable is set, its value is used as the default.  Othā€
+              erwise, the default is unix:@RUNDIR@/ovnsb_db.sock, but this deā€
+              fault is unlikely to be useful  outside  of  single-machine  OVN
+              test environments.
+
+       --ovnnb=server
+              The OVN Northbound DB remote to contact.  If the OVN_NB_DB enviā€
+              ronment variable is set, its value is used as the default.  Othā€
+              erwise, the default is unix:@RUNDIR@/ovnnb_db.sock, but this deā€
+              fault  is  unlikely  to  be useful outside of single-machine OVN
+              test environments.
+
+       --ovs= Also decode flow information (like OVS ofport) from the flows by
+              connecting to the OVS DB.
+
+       --no-leader-only
+              Connect to any cluster member, not just the leader.  The  option
+              works for OVN Southbound DB and OVN Northbound DB.
+
+       --ovsdb=server
+              The  OVS  DB  remote  to  contact  if  --ovs is present.  If the
+              OVS_RUNDIR environment variable is set, its value is used as the
+              default. Otherwise, the default  is  unix:@RUNDIR@/db.sock,  but
+              this  default is unlikely to be useful outside of single-machine
+              OVN test environments.
+
+       -p privkey.pem
+       --private-key=privkey.pem
+              Specifies a PEM file containing the private key used as  ovn-deā€ā€
+              trace's identity for outgoing SSL connections.
+
+       -c cert.pem
+       --certificate=cert.pem
+              Specifies a PEM file containing a certificate that certifies the
+              private  key specified on -p or --private-key to be trustworthy.
+              The certificate must be signed by the certificate authority (CA)
+              that the peer in SSL connections will use to verify it.
+
+       -C cacert.pem
+       --ca-cert=cacert.pem
+              Specifies a PEM file containing the CA certificate that  ovn-deā€ā€
+              trace  should  use to verify certificates presented to it by SSL
+              peers.  (This may be the same certificate that SSL peers use  to
+              verify  the  certificate specified on -c or --certificate, or it
+              may be a different one, depending on the PKI design in use.)
+
+SEE ALSO
+       ovs-appctl(8),ovn-sbctl(8),ovn-nbctl(8),ovn-trace(8)
+
+OVN                                 23.06.3                     ovn-detrace(1)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-detrace.1.pdf b/src/static/support/dist-docs-branch-23.06/ovn-detrace.1.pdf new file mode 100644 index 0000000000000000000000000000000000000000..7a08cd3447d5fa247831f1ed11be0729aeaf4b23 GIT binary patch literal 21824 zcmce-1yo#1+BO=3LvVL@Y1|=raCf)H-Q8V+J3)iHyL$q`-Q6V+Aovf-Idjf@GxOcK z>tFY-Ub}Zyz0xJmuB!dK)nszQqI8V(EHGq)$I-bkWMtyj&Nhbnj%GI2T!gmzj-~(; z2SPeIIzl=lMFCL}g_paKjn#|5%)rdj%+XB>=nS;veQ`iYXZMGmjI5l1vZBa~rl5e5 zkQgDIgRqE-xR401t&y>dy_qBMrNqI}$i~T$_x(#!*2&S<$x+nI68M_^uYL)Jm5_nZ z#=snghX)`9v^H@xC1iUkQ2@MnaRk~E0z@tK9f86?LmML?A0Lc^qdidH3dS{KRDH>Q zi38c|Ms=NTIw@$q2d98dIiADq{50}YR9*3+y#khozm*KBf{=o(GbkyP zLR@0WN=PwJA6vI*-hIYY)Gk4wybR`(#j|diEM_zB?N(rVXWVsXe_C5=mXzI$r`^Sc zkUzpMJH<7b46;BR1L@_JxZJAjZf5|JT47NFHJpCGr<*+*s;uOS5(>V;PZEThpiIxq zXSlNBS&bpHI0myhho5xlNU85Lz_Q*xnF-QQFhqk#sTs{NT>jVszh$LqSb)ho`!4TC zwA%4K;8bLT@up1nnAs1k{PVKEA2fOqbSFF zXi=f07%Gg`%)%A7vbl9yH{ysI%#?7UFN%o`G-vfU9b)bAs&Kbfae>`7`JC;@;aiEbiiy&H$+mIMId&MOM=usS>FL+T zzL^NQrnsDgi;b-!mVSbIo;jTbp^5XQAzuWpsV?%JPO?XlMV-5y4XZcnB!g42?|VF= zRNOdsUcejTf_gH|=ARu{n`TO;^;zHeM6beWS7m0N{xA=SUV7v4Mv)~Jo*=7od4pFd z{37Lh6Z5s*wy>~J#WW*DMOVZf6Ysc+b^%g$ltmK|+y5h>Mffg@usI zo6F0u5jjFS9D6Qz`~z+cHOL!(LY$=$TL7JAP19dXqE`6zVvy=4Y9^weZ-&Zj& z1|K}!-q)W{gwM_VOfPfZQ6Vd?LJLXFoM;BdflPmXx8$9p&k`Q#pxO-)iTH``lpl4R z)@=yqp}EAdohpKiE1XFHOLAL`M%d{2PEOH&710V!vuGVhqkOQ2m?~m~D&LoDegB8; z6ak9sNZe_6gZZf=5YInLOumPpV7HG6Oqe-@!FbGG+j@h+4Im*rrD?wE#S5)&dky=L z!Md%2(eeemoh4dSN07x3MHmBO^GifE@V}`t76Jg^ZC>fWJuG=6l36HU~j=E zD9D@CWaQOCQp&V;WSDH^Y6`97VDs8){wt%}!@$mmP13#om}KYP8)Y39*5M(i#3LMk z*kO%1C+E^?Q9aY_$eA69sR?Vv0}rD_)2HOU{QR5qk|iv3P+!;2i|i1oI39ZCCoUi^ z^mcpqxgFj!^wRFqhV2D2EiH31O+4!`t9fBCF{A;Maux88j30iC`Hs4vo7k-JSIhzP ztVHP2EJ3I;M6-7?iq{_?5XJ?lvCU$9iK(|_KL>b<){{ zd(JL7O!}i@1{DLL+N)5>p~9w12+AM2b{T>cU%O zKeGFp#Ma-ROGWUj;`W;N-EFUM&3YDw&Di^ghe?o~uNUsb0+(ngAmv~C=NfLpCfal} z+%V-AK=ywuR$}lN;eD#AZK++A0`>^R4PFEmZj{F~bi`X#f9aGNheay%)8QpfsbCHM zVGMg^vNV0GAcRNEO8H$vc8+jH`)HS?d4hGw1_T?@N5L%X_AVq$@fi8TT}yp32Xw_7 zBA336uw|l;Qse!wsAqd&y(rYp91^(jZ)86r?inE1bu9?v?~eM?pEF3Ak%}DhLq?T> ztl*>Hn!iuXzM)O{px&25hW0`2vzki*BIzMR5OQ0#6RKdZ6*`xqZzYR(g5d}h3KA~b z8`lKpppAE^lbQ78xWnsN$egKbEPd{ za~Nbz`su9=3xiAcYuN;?GO@BCnbRJ4*b**@us?RPP3#+^OV_vFrK=F)XieFa*juf$ z?9U8ck0xOsFHcrx4_|H*oFnje-cO1c^*!KPVGGLLUz8YM)R{a2F z&K@BSA1ecG@=%#a=jizWYgsQ;*boi-UWz)roL$hUFKFu3ZL_e6U zzzS2)33l7Z@gOQ#+FZHdj|o9)Ah2LQ6|`F5wEzP0-148I3!*y0Z=EIjH?SE`i!FQZ zL_jBH^R3>=m?<|YJPh7-?RY?Pr1fV|25P;FqTm4*HrXwxD=j4yV0Ws!NuX#<6(oT(axV)TS;l)3BpzoW ze%-8-D8@ujwbXM^_2d}ErgsI%%h7M;6dsVKCd#DYQ$CFuGN1Gbd~wD$7fOjG`*Azp zxjC~dsyYvs3|?0t**(3liHFdryZ^@wtfoHoE&%Qp-;8^8IpMlm!e{4rz zQmw`-MOt8z#{3zFr?2OPdN+C<_J0bp=eG<W*NIx)VPWbdk zr24DaM2dmAkn;zzk*Q+CC_B#^G58*}4)1elvLo5%!Xy+9YuPWH9?g_2(B;N*OWCQz zxQR_xUX<#-+voZjka=Z#v$UrO+g2vxF(7DP2&OY)&|<*yeJB{y3jKu+HT2#^LEnduAKxDskIyolKtnF!fAnY3X53O0@}uO);G zFIx6MYez!n7pcNaG0?%r$=(p?@bWezXK!Pu2z1m0yu6kX0+fKRjxTniHZRJIzqMap zX8=Mk`4@W!!dI9mz`PXwiJSi)tHb{1Z~s-DU$FgqeO{~l`!(&QEic_e_^W>$2mz92 zMh=9UFt62BfMNW7(8%U&AO2bTG6xvvstwCwzg$YfXN^=GEe5oXzYV9ED8v?FpHg08;vY zq#4S2+_q2h6|Ic$G5{vaNm4V@1Uc>I<6$8Y`HHviK7<>w{! zA2t5)@xRDldhO*o6tR9G6wItm2$_C^NYTl_@%5p99YV&x0Q5`x2ONHl?w@vmS8)6z zqiSX?VC`V`kG!y%u`%#vUU-=ZG+&+x27s{{%`ApzXDh|CeZc9fLowS9h;yd(Hoex?kh`I@W(&uR4E?*Dqwgl>G5|>Fq!9 z_9y;+BkNWE>h%x#3)(nd#{X6K<@y5^zwz=H694r2+wS)_!^=F){0l#?b@+w7Kkl#P zf7bC8eXrMR{`JoONBSiX^IG=1F0aqRpIWb_ueEu-|JHc1{H6J#{U0&(3%kFO_#but zXvO~`XJupgCmjBsLjDsDU#0(-IArDo*g4s}aB5~Irj9V2Y`=4sKx4;0APO+H{I@9m z+a&srDN#*QUPeju50r|(%;RQ;{}ZOKQ^9{gDGS@bofChd??3nZ|8t-I()eHc{7?Ds zvHm-be*1pK#czE5!p~pG_!B>`v)3Q^`K|YA_v+`j{h$8-miwFJPlWy7w2+OR^`B7l zYtaP!C)E6H!TkSV_WHHz{T-CAOW$9s;x9bN=vx8*!}=-svaQmjds*e_m>5_IIbWt) zwwJBdE8qJE6U&zk84N(t z5oo3Ivd7|p0Z5xUIJ`{qzn0uraJ@KsS(0BiWt0E`fFM8!APf)zhy$bm(f}ENEIe zq`22I;PP&G6+K*{g@%LF^hn8KCU3_4(;(MIU~U3d59&Z5kr+8t%m(bGR16e!kr*P3 zzc0GQ41RfiQKGxMg{GBkDKBrSO8ef*kF5%)&TQVB<@#@rd-P9)3mztCj~#25PnmmL z^443F_|bc(1j&@jwDU0;h&y+85bTMA(l~?Cdo;E`&tOGYQEUwmVBF4QLo}yYCa?iA z4A8hJ{Cu(YTi=s9_jDO=x;lK_F84Z{89B)$@i9=+ckc^DB9iY!jcz+QwpztYLLndE12{9l)%44To)rcT|KtANf5u&pe;)qKeRIWYrPfo)08Qr|*Q< z{jkE?_!9a_J+?LX;d5)=P2Xw6(iwm|#@2SHWagVw61Yte{g3>j)M@KOR&#{+yh{;+2lfsqo&_d$1DoBi&zz)D`*ypOskkP)<H~EGsS(xc0feYde0f8CBdgyXJZC z_i3G-$n0&J+)~!yON~iSyE2U;QNZJb+fur zz*c+yD0B2vdGxM`#udc-ak}|~dOFhl%W)LJjFX#C%Xo7M7kYl4qqKEdaaS2*>1ZVG z>13Yhcy)BwIVKKR<}$d^mQFiSt=kF+bf^H6x??D}l}R2ft5Xs^MEJoyB%op*FQbh@ zgO-as@`h%Awe3Pn5;Nf5%prx3U1^Mxa7|_q)uOB@00bv0{7VTn4c5fUfT)Ml)b#aT z!XvU4e|mn}u`5Zlnxw}^TH(T`HCcDwp!_N*6+OnXblSVxD`iad9&=k92!X5`ng(TL z52gxh2Rst@cagP)_g|@G(RF%C`+k;ax%SRyQ}YZ(QkyCIO4L$ifxs>s$ij#qWM#bf z9c)Lka|Q0l-swP_*l}xXPLZMWcDPYnc8~lt;_0URz8!g}V(mmT2I8Q{II%( zPnqCYdn_v1p_Cb$Ik6})iX*0IZWcgGS3kUi@3}mGi~Es8pDhzyp5JE`{$cR5Duyjbpas1> zK%1Bvi=0{=!hs?Jd7XB3_>_LcngNcHApjrB-t-$W1eh*wQ1g20Dbns)nD|mUA<_&& zR55v{LP$@lJcS|y? z2R=K=m9M0X4K;f>VhBUW1wo$y$p=ZnKM)M*1f-m(v+^QSX8VP-ZI;*)0tCjBPUQ(ej zI(t&XTx3NdHpncm7$TVg8r+_efyqf2CI2tdiNPp~mn|rvx8E0MI#=VaM>t6q+=&(&x#0($-R!(kFZmykFEj_W+!+iT$)qg*CzGGH)I~I~j^Od6N1<*db|i z7KYn0;dG(XsHT%hHL7Alm}R8xl?=w`F0AwHe|JZuYSC8l43b-$Q5ynBGd-K)fr;7Q z4Re=KtziKTJU8Rw<5NryOo2)~5rTdQyrJB;_EN7Xr6KzfcL}ogu0eB57u}}Nyaa9R_xJBPPp0%5s)xvF*FQoE`^(W)`MD3GtHqGm*1E$|EN4*I~y z2vo=T>S?t!&A_`|HIi=7tV?V39))j>IgM>?^+S98?Xqs1dTg%#n6e=U@ghQ6n}wD# zA16#%FbD~pbllp(%n#0H;SFSI)jUkKo3tlZoR&|^=!z!P`kNC66qLT;T2yDEN8sz& zef}xVHa^cwE{F9AJ1qq(qzALJBjzai&Tyg#bDvo$iqK_*}(JhnZpdVQ2{}>yB?J zKw@kitHQ9Ogd8p-tJBkC8ft1fKq*I>R=Rv~h2%|zQX)+(z8UK+(_H_pVK`_1=pB^v zyjEJkPT$!*g&Bp$YSrGnfitPx9`3gBN(O{J%2gd`l%i2J#KX;bo{o3I~s=dRG zW_9O{=zQWWkzi3qQDMu7yivXDbE*A^*JT-!Fem7$I%G6%(pS_W3RPVleSx4P;;{Ta z1^@6=6tf03GxHLbB1z|Ax7?ENDL>WX%S#`TMz)My=dy~+Ea?oOe5ctt2$HWx*Bv5! z2Sq~)OGprFr=LNjJnRn_v+HFlX%Z8*<6NK{aVuocghx`1?;%y!aMb(@M^pWD2jd8K zyFa%QG_E$&et+T3lS}|IALt0*@`-C7|X1 zCizQHBkbW!=ntw?wtKTW3oYwHyKx%H1hz}O;E2K;qaPmxA`m5-o>3!{CJVfIAz*@e%9cd6e-!+MXA|5N5^pxy6ps9f z%{mB>8C2-QdA1P5c694K?A%g0Aa9>orN1|0?^gr|`P7&DkU^p$ZLASYkH-kPqq>f! zr&*z8ZJ{h?p)HdDWNt3Ga$o#vbxbB6Mw%oQVr%855^&4bJ6Zr;a~OecvoV?s7f;*n>S8NgA37oyRUta)0KCw*p=$yz!BN+;jk-Tq7D zuv?=6isz&AC!xn8`U=ELEVN-wxGxPzXKXs$mcc$T^Ig&e3tu)(c`(Mh6*hl5oa1ih zZ@<5d@MmD!yR-}K!yW5slKuXb1Lng|eSBkvc34+L80a})zwgNYo`RuR?dRS!XXrV6 zcDpLAwvsswUmmbP+3|nSgUj9-SZy8TDZ4GcHT3rW$e{`x65t}wQQtVW<>0C~KGC_> z@g-&v$v`TN=C@(K7X)nF3py0Z;203nfe_Q{aG$9fJksdnW!2sL2{p9{>gu=j`Vzn? z(tX=py{pvpcrW0i|FSb?eyG4iXeCxFFR>+IKKzjGQamN}PBg)AG8L1-!AC#+uym=z z47Pt-rksUUx@;(NY$-71y?<2%xzHF~=ve*Yf?C8KXaZC#ekv>Vi+31iMy|T80 zkMC_gsJZrQ$rv0*Gx-NOi#hUzR-CuV;{zw4_01gIniDxB6RR1|mSaD*=^%6MJ>B8C z!iBuEc~92u(4n@Fc*+mTr#j~7?R_1|bXPZzWg%T-WuhhJbNZZ5|6J)<^)=i{xuEr( zNuj>KK0_0JD>FqPITU*26EVxCUN^KpZxh0Gcb|drv`qT!p?y*-2aDkQtYm@az<|DMkF?6D$2D>#UtqJ;kLYmmv8L_M_YLUD@q^z5PHvGzU9z z-S;PWNxi1z_cb^DyIa=X)$i)`-?2K}*mR#(hUoa28Mrd+D(bd+9)95DP0-D!BE{g% zo@g`l^MS_;ePlU;b%b28JU-x9T6iFHAL_DNybv$H(&%>xYie=sMLP~rr^j*X`uT9O4NA@wZ zQVtivw36zKx|+W^trPl%_xquPOE)z4koQWFPowEgzH#@n-t`T}RU;v9J_uchIOwsS z;g{{Akkc9jUyMS&+(}-<-9?`7%jLeqA`@Cgi-vm3Hksm9d|eOxY>Z^ z1s%L!?9a6k`oe`gCi{2-GMuBR2d95#)D}JdQ@af;WL>BV8Q|Nr(Y@HAOPY3_I1y5> z8H=zQO3@=c|K`36w4fKJ#_EcQ({?se+o5ro^{PBSiAgeSo4E+d64^Q&D4TMKT0p5d zgwz>nD_Y0H!z-W3!Af3!((~cNdq-!9kByvG@Kdn+NWPGtezaWSy1P=lN}=0nEn(i3 zg_d2ixCeP_3Zw<45($rmFCA%^W8;)&gd*{Bo6VJs80RfeGVVue^f;+IxSNHPZnfYtv(3K?#9v*(JgYQftkL;Z8KR0wJ*6LOG?^!FR7s-Fg zT1ozmw|Zr*R9+Y>1Au|PJ;1bK`V=&oM`^Do(7RP%2R%*^$F@L-On_P`fD z%*Ez~5pxE(yb@smcc8t^Ke1uI0(*aB!~Pa9`R~~p>J3KCH>)@WoTyWRaEx@&@Zv*pfzpIV zHy>}f)-JU<7ffz$oqfEbAB1L?Q$5Bw&)n8--bGZUidLzWrCP^U=M2+mZ5jq_mOTT2 zxN0N0W+N8I+G5<_?FEg$o|_=+k>iZi73=iHFEW>DumcDKrtRe z_M~;5jD?4lobq7J=YDSL$!ClLYIEzvj(gLEoa0nNLPmTgISJp9kYt|fa=tr8C?}*h zqnCtOJ8wDHkjLP?=ibW48&B4+^&eErw9uN|qfAfk320Zv5G6x<`)~r8zmwYqx<JYJ^RQJ&mf1DQ_A=e?>MO+GN4#cxdsG`_Kf`vlwCTUooL}U}D zv`Z#4(#~kGTV%M`b_T~;7_zcnvaXV@YnL66cPLW0*LM3IrGHHy&Jk0Ihr`e%X@R?Ot8SYfVTLl+NBYY*{H8G)E4Qs z>!y8~X$Nnwgv-3QcWZW;HR97k2zF>J8|X*9KQq>*)1P);wEgqQs2|Bt?5oyRK|H0A zg8iFzy5S4u?@ZaUWIO5B=4=NNSH|588P>3LM$b%&{zOQjZiM0~M>z$|dPuCPa1op_ z{?aj`(haq#o^t)R->N$>Lq2XDhu<>v2)ZBDjATay<4q55u@*SMugqTOHP|EG))nIM6~t3pTOMk<9!H8&^k&*qPjx;9+)6tGM(_IWtj2;i4ZQ| zImy^#Z>p9;#m{Xg zHu2)qK~TcLdH}4ShsIEK!v4tmvX}2Q63!A>)ffZ}m9(^gezUPyZ@mxvLW_lt1&05q zj=TcgwY3Xr$7MHpAu`tlQPzUa!OoyIAaN+~)vX z!pX27d^@Wm-g+qWm=5DsbKT?0Z>00&3Ab}Z#xWM3m>zb>yp8+e2ivQ0K*pe(RKTyB zK83rz&4z=!;SFN(Jn9kC5F_ZMTSV4vUUPRxg*60PjT}olyA0|dZh>DL^M>#61Hqf6 zNvKqOBzjpByhN2$%PqS=zWu~s>}p)k&|af+f)jIwMO-dK)wrn(wPYs(L@=4d2ry=I zzhipeZ3G6+^O?y6+{y>H!bpRYZm%_XP{vAR>h@a4G;OTmlQ+FKohOZHYiebyIzX3! z)TsLFZm%`+7R&i)p?WOEEyD8s9H{V{9}?%m2#;->AH`-t?oz-o9N0kZqO}e~2JmOc0P`aV z=Y}#o2lp*L$nHYY6frjY)7ayZLT^+Rwy10S+QKS=a#0m7a@1-BMDh|D!lvs`QCUE+ zxz-&@O8S5n2kuM+9s1l02?E{~EIy!jF| zhuRm*6lO%Q3lywC3)5kuB-EkTh?%HHeJg4c*y{_GMIibMPk*341SyznEB5wRq;j<9 zH;GI6R2Jj zw^Ah<7T{=6aBj-*2o)b!`93XsH%a=2%5HrXamtRJTU+Gt%po(Ert@L5OpIb+UQ%lu zT&N2DzTO6BR-=}$coA(G8Wo8mu>*4?e!)upDf|iS6B&CQm=4d3BKzdGF?w<7kuT!l zZ4B~T${@#HGU`j_3Du`|nsp{n8i zlY!Hi;%Mh)X^IW8gZWO>+4vRC3~v z?7x4gP&B`UQR0$=dS@)jo&h=7G|CPON5?hdtM6m&fMP?E%eCEaPY6aVQp2JTC$VYm zOVy+Q#y1txT;d(YJJI;*{L>`v*P?ZkTU>^}&Mq+QuxaW=25UiH~UB~iWRhxypJvXuL_m$BNYV7K_ zOVYN*0ya50?-6vnboRvJ9A?_RULc#PB*NFv+OqV3dj@mw+k4?0v=AnTw?c|j{jr2Fd1Gdj>lbo9S3|&# z_5~r`*wwRfkP_)nyg!jOu0lZ#5+_;2<2Z=e;l`1^;|2J?m2faCf|NNcEUdFFsdBJQ zuI!Gpqw1tYAPtyKP-6$w!Itm!5K1^S&i@1wRoJ>fIO(brPn>2`xX2$Oe4dO>R8!!h zDW-E54|9(U4k->k?4)b%+=*WyOobF)2C=}IdyTd{j!oz6c-%FqS z5^jCymN=9~U25E6qu)JydtMY23332r6f(vCvB~GpOoNk7ccPIAUXCVDS7HE;2pUGp zN+ntxV`N;om)4ZKh+A7in5V2095!P>Z#l8Ph=+nzj4qe7a(Dyk9v>lAN5!T_9{pu6 zY+VzbTBd{@2WB*X#y{kI=4@i~ZIBA|Hct%IScHP~urdzw7WL6AhtzWtoT`-Ph`f0~ zKQw2@LR*v85^afG9;k@#Df2EEH2K$}lC7iqI8U14Yo<;mbu9GE6tyn`pPm!3xQpX$L#&Vw8c7+D z>@N1(x6!RCWL89&s}rsrYHtO)6Zrb0n3L^5`!w%IKyK94WmGaXVgVSmBBP=HLE)2a z3N&>zw7~*&GO|@E=0h~e=+H!A(^`uDqUFh~ZplF)NJA2wq>)Hu`M^*{q#Zqp5f&qK zBM>f55)!HsRR?MYOeCg_MRUJHCf+$+wxF=3w z#JIbiUMFiCtD9D5Gt^U72&#d)!p$Vs@40-MU*Af^$EQ7q4_yQ0%SGDTkQm}yRh?bz zw<#;PG;bCgdm1cz5Ap@ufLf=j+G^14f=qt%Gdhq_LvuS`z&lZuc*bB>U7}cL4BfiM zK*66;ov=jZQG)qQu1fDB(25E=YQ$I(#D6B zAnCG!K?XdO5~GCpaur{mWiC##-nYAoWh~z6v6EgZM1aYCKcw*$QT3`f;h$ z#CzkvU5=hC!L{gep7mWL(9p|b+%SVvj}!3DVS#n3oZ5$G9oA>EoS1!QkC?D~eLE2k z`E0QrK}oZ*KL0gUL*Zsp>uH={6V?fKpkAOPqMtSdhqFTybPN6s2I4%f3sLQd)q)nm z-mgZdtm+O5nwE1D=CbQ>4@^QNkNzmQ-Q?Kc&&ookqg?=k2ENhwT{{_Zka#P}-9R}E z8y$9$KJAfb$7(LZVM{+!oF~5O*Z{2w;vWzfx)TkDWf6MQ2dyzS)r{xC5mj54&zz^# zOCo+#<#5_x-{4s@zYAt=%^ka|t9WAyVViU;b2%c8OrHN)Soo)jyKi1sCvn@11;-($ zujP5}!9o{wi_5vvC@25(20>C?cQ*NKrJ81?8ux}WZ3PC6rn~t_O%sf_dak(2$59~> z5i3>xUVVx&uxDX`Tp#PEI}&%rAFBHh#f#+eTpA}$3xZaY;*wq3*sH#^i~?T%c=ApJ zJS(GjJK!TV?hI1NhRp-GqgjrWV++*Jpvvjh92y60fu!Jo_!Mm-E-cX&jQ~s$7=WpLPBg!fa)BlqWJ=kSa4p&YyM-_ z_V5yXo(Tv5ISK7RQmQ$+h-5vo#kW!DG<>{j2{@D~kpp!_BTlhfZ~N7XNbZ)A(K>Vm z;NCSR+-&5O@OdV`xs{_H#4V0M284H2)S%gL-}Rh!M<5Jf%&+x)Q#U5MIoJ`s+G7b+ z%7ibsuSMI?VKb9XGw3Q!zlb81sOSCAK#|q(jJ+sTwoCf?bKl_1XSVw3X%_av=|264 zhp;A^`f!2ASY_ud-r&tW*yCj83d|F;&yTs&JjKHMgrGfd^^vUBbgt0xWK&=56nV*fhmPy1`Ebh+% zOW0HX@;zRd_p!MhKIZ9q<7?$IpU5(|KN*I9a2My@GXG8D7AV%nr-#}7$v!5N;|9BZ z$_h{}>7eK2;`1y)mtD#a#oQ^lX(#6S4DAEC^=iEptT1-oy7^tR52R)-g5=-O49Q}! z0%ua|4M@nJ6QuOb9c{ie=X6Zoi3+G{j!K^+%0}p*Xg+J&pFec*;OGf}UZd$GW=MlC zkS`-iO{l}jg3k0{_vIdmfiD|yyQL~+(=|95(HSWx3rR?3eHx*dIdU+ol#W+gd z@Y7`ELWln_i^NH6)>-Hv6itSj51xtYScn4b!RL7N(y^%#grCNhWemk6-^_@Va~aL5 z*iC8Bw?F`~3at_SkeB;Z_E{;){b?Mgz#rM~F0^!l-t`60y7`l$w=)m#<^s>}i>jBg z^)~!U6b#c<5F}WP;Tm)jv8Jhxry%D9ueKTH1bax0>mK#RhsDdmXT(+?DmZw zYh^;j(I+M2m2*$?^eMpWMEW6wyiWAoD6&J$iEX3%6sR#$r)R!6QlWoA3;n9(8aSg! z7hr`(@y08MSU>MgkRr87&_n23KzO5E*rI9s^jmi~h7|wGK&?glKAP{L-0v?1jqO6;TCk*YU zMdAzPh$;@vS%8ecZ7GtA#X%!D#W!xZ+Z?5y9UioFMZVc{&YJ&RmG|+8cooEyi~q7E z+529l(?;k}tgblneq!clMPT(d&SdL4=g-lHqVM)oiAfdQd1@Sh-oPW;0yJ{l3R&}O zc^^KsJ3ix^Z0(F{MY^k%-Yl=FTUg&IkPM9L<425c3KR>TB~tZeKn6BRTEol<-2%ia zgk%jn8Lk8eCQ8F)sB-Q2;T^Og@6nQnB?l8@vSM_PPbXCG(VSu|b~SiwTbNTqLHXy; z+Cs8sh?nl%?}|+xdEgPEYc*4^GSc_)ix(;4n~LpHk!|U!^SeFYbh=CNf^sDe;FZ41 zUo9WvEqd5{o2u>=6^ss(;wz$9jJ2_Q@NqcrG5`dj9E)^j1-$)^=~7SktKB#lHR%;n zBD8U-rHbYkbI5j_MoZqfeH8joxTIhzzFZf>v!tM_#z&^{^A8RA!=cWx&XLcXe?Qq5@4bzV}Q`J9EbIZ*p7 zcRfC($PYj9TS4j8NxRR(A}Dzd7-w?m(ad@d*5>37O^aD1thC?pR@AuXq^-b4aLUMe zp&5#VFpjlY_1`b+KB1g8QS>RJct#fRy&G>Q{qo?|cp^O+{!<&U@$P7SX zE7pXRG_(()7L>UKRqxC3CMdL8LBEkk`!nlRwUs*j&_ehOk|ENYJ#+3<=bM!^g!TU8 zqa`H_oLZZ=SJ#?8R3s04AuqZV(q$j6XOq~ndgVySD7rl?Vp5T;#!*bEh==NuL2mst zR@H|Jw(wl=dC$^}z|Hbm(%Y4$ZykPh8As2ErzGXkErZh^tJiO$7o>PRqvFdExQP?* zi`^)b1JiT1Tx31Y{2<$O`P!a?(@hSm8N3}oQ)=w1m2Y1^*4Lh}Wq0zO)#zVNDC5k+ zj9WYQsr1m+QA4ujt?AYTWbwXh52z=o@Qvoc5GXHU+cTGlrkR)aS$Eg-@NCJUkBr_! z4nQo;5X(SkOmV+o?G1j4_eXiW%3FuP9LD}=BV9Vo0Ip*2-u6=1>t-QHm-Cb60Ulu_ z{NCWemi$2#S@aUSbK41Zb|nHhJ`{!sDH)8x_k7-AMSwsWX1c!0prYD&;AoSSXQE6lRx z84h!_fCTY`H+8&biAG<{ci#t|LG|A???wD3*+lC z+n0ZpFt8A^aWMaDsN<#Z@1c%g*}p;^4DA0Y)bV=)XiOUeDaVoVERZ#P;uz zh<`d?>-Z8s_@_g(Os_E>g}=fEzw-aD57EBFcR2rkh*sIc5e0~y$s*0AM<@7>B{#JO zHq_TQ)Ysh^1U5G@2^~fW=Gr??T*F?L{N{*M*P7JofXr&rB2I^L9DPwi!+M67xCW{Y zsNEPrd1S}?q2H;q`}?4b)0n!?+3nNFt?{l`){WcRo*R~!CvJ}(L*_^YVv?ASr=|vB z5oKDdnh-rOW^5pKjIkJ~G_iF&xTHq<9tk8&Dh89l)0wXW3Z6Ew0$lDpD)N|~r8u`* z<6&2a5TH!GmaV=-gRFv*Cb__J`Fye+E}H8Fa?!KgbQQ=<@zdN($OMB z^e?1T_a%Ygxe2M~Fs%xG*E4`&i5E zH}+6&pq!D%!p=lC#AZYIq)lZ`{(1A;UhH$9{N+v!$=4yj(cKvTNB!{lq5O z)AH3j;!(VZngz+rdbP(5Cz~RSR4R{*D2`XAmU-vl2>F{C6T!DF{P}YB^*5~Q53C?I zl2-4X;m~V1*2Bm*;_YChcgHzB6V{i*hoz z*oR0K;k+>HvvrxBx83gt0GSY`hEW3fjrh#4RXm5v=!1pa!uye92`uaFy?8m5*5A$e zgBhCXNA}Z#KGjOOMoaDO1{etCSh}fDC%#F_Nw2{7blq}yw2$-I%JWlahJ%$HyNHbyv9@#fNzh#_eH6=?jx ztGprxew`;9P*}x8t=^(utzA3ls#H4WlFLDBD#eitU&jVkC^V%OQn9cKA=iXl5m4DH zeRCn|Qm~`akrpJ<>2Rxs|Hc(RBz>KGVVVmImTkfpmu|3|uS&Cy^L@LXO~pAPe<^BI zxmV%(<~-`GlY{*+v4G*GA7V3cpRX)^rtgw}012~~YHLeC7ebqJ7GpO2yx^NCR@R%o zgbix5`hq(Sl@#5CAPlpwaR33L4R0Y6`?j3DVib*b9o0A4uv|n7l5MpfZOK#x+DFU{=D^xlx#S?zPKa87ZzVNJkhHk&yLS$1FC0FQ zSI5b>;Ruhf+U`#am;FGfe;{YuTR`kn(`XR4sJHONN?Dd5cr@WJb1F?f<%oM$0dn~4 zzj0=xP=goVm(L-z>9jq!$jAa~g)=-a#D~BoX>`yv`GDWN?911N0v|mi!7-}h{k`>o zGm*S{!2ld$9Sk1BZxvXmfD|%pMlr&(#TfAhQ{D~p4ErF;^NL7!?|mEOpj{WU`r{S- z8!eqzuoD&7^(5Wfh$MfTRljqMJ? zgCYiZWdO73*mwFIrPBBr6+1rxlwX>uex6RUD&W z*0OU1wU11yhRsA5{j(z7>M0H;&?YIg!FJ0fC0`^0hQVBokDz@_p{xmlmKbEqzn)Z7 zyT&oog6R*jW}ydNf<$l10~E}rzqWou)#-Gqz~H-j6W@8r0Lu79K3wLI1oVUsq44MQ z(K%b=*aS7mj-DhutIrL50<#ufv0Ow_(l9ZJs;rO8laQsJ{bv(f>nf(=9>iNv>7Gpx zW0K|!k4Y5U89#w>{}6b`la%a_e#pL>w&gV?N*eid!$62ycs1V{Lnu=jY%h1;FVp4= z->ayd@#upAU0Oq3);-{{OM363!ngw!v`BhE2Vy?18Jws4qN650en&fWfe9tI=$J=n zG=F1m!kqzD1zKA>?LKbma0pdy2%nmh)z=d_?`7IH8W`=pZES-66&}=4w}1SkGwbf+ zkQ6-%js@XOU3qs|Bd4V^itz+znd2o{)Z(>RQN9IBB_KdUI$w^a7|sG<;=}4h#dcZ9 zd6OOT__n#qN`7mP;S;_SnL1eN@-eSyEq1o3!@7|od&U~%R&|4{kV{1mbvocSCTAqc zSYQTP71#Uikl(DhDZ;M2X8fp7Nr8c{LPYVX5_!G*9{h5U`qRi_D zOy3qQ93xD-r#+0OR4(ioH>2QpQT4P77L$fUFLnaBEua=VM*|m2M)IA>wmiy-v-u^{ zQL87O=8suBGTOSzRffP4=`Ku7G&M=7Ps#>%!_z3=(QRT5MLF^U4^&FS3*=WdA7nM# z3v|8EEBqyMb71l7!rUQcIrezWAi1(#*!a`j5eH~nktK=$9sc^M^f8~N?`Er z8$%8<{d$2FYdX+z%8Eh;g6FEkcw{GEdoid5WgXjoad$~_?`zsu7a}9&rB5m$Sb0C+ zyC8}dLaVvv3joK2b+^-_e~L#-`Ygnjg^8T6G2341n!3GTefdLB>!@+9<_t`H_d$Yq zBs!gR)r#ug6@+Zv|7qpwW1A?$_>4fzRAM5?N0=PbaRa>Gdw0FN-r06z-3QdU=1p6M5Hn&uSZb?zcbQ+p}m`pBEO^z4`eLblX0B%gw0= z`W~Nm>$RUo&^3GQn;or9by;YyPaTXl2@Wr)Kru`p$&4Q+MoJSw5=uL*I&w zAAVgO>f!U5Pw+FY{(E=gowV|6{CRN*yT87Ceq%w+<~H=t;k47w4II3mt+{#Ouk73_ zRmHpN-{*QRE7-X3VBNs}wJT%JC(j76eYe}P_O-T-iM8~caCX|_rUO-N3!A3M`0+7o z8h&(MM(bkOnIo&0%`V=tzL!in>BcXcFWl(Yuwl@U<}vqH?JmtKx$;%o$y4U$7ndKp zc%Ws@@_v6F-!?pZ`Nb;l8`rL%C-43J>^J={oSh$W1TA}x6*+z%`|c-cN7o%;2jtFc zDDU&_+_DcEt7o+oX7QJWs4Epj{e{64SBVJ~hcRZ$ercH9q| zbE3fKfTqImZb? z5gsDy3=)#AZx+IU%4W&5l@=FfYJjL1^#}bxfybhLUmzq#Ex6u9gt}%XaZHD()fU`g zFTqq<_Emd*#0}2pRM~8Q>TZ>2;8l0g>&2+Ub9w zIfrS1ofVokTxMp%3&_TG?*_gAKMV{HY9dG{xWg`wV!?|_im{^Ua!8GH?J)`&5N)7v zGBL1+#DmG~J|3(0qT1Z6pv)Ak%o75siXK3FT(83kVhpTG>F0 z4z%eW+^Q3(Q!7~+4=ZP_RAfoQYJd)?O&DdM83T$3)0-twW>TBVPD6df!8?O?`-6w? z_iG8I;lzB|74`$Ea&*204~M;Okr66T1)>{E z^dlHne0s{cU8Kk7(L#n`DJbZO+a*e};&-Z$^uZudigoQm5;6j}n&C^;3uoG_dP0x% zsqu=>tEHCca|S9cc$9E^Bxl&C;?~y#I@%qdJD=AYujuW_`@XuFS=|I11}2&8*pAk8 z>@k(c=ji@52u?X#@Q8MWNjdM>i8$WAtFr%RQw@W^@mfYhDrz~MoiA#80nx}rGe!Zn z0YW&u00!ITA&5l!W_Oq1!>rbX$VpW3NI=)7*>o+l;sxVamSHgoOV}9R2sCD`V1a~< zrjRC~l4L^+#{*Hli;WRL-XYnBC=<*{vW*supuduAV`1D~Y!oMGf*Hv;BMZ_S$uqco9&q_`9kH1d10ji*xQ z)M$j&NyZ@-nNr3J`UY@XGufZObDjF9Do)@$E1>*|k!9YP2l4;|VI3I+a from 1.369600,0.718660 to 1.369600,0.718660 to 1.828500,0.782660 to 2.428400,0.866310 to 2.854400,0.925710 +"connections*" at 2.112800,0.987850 +linethick = 1.000000; +spline -> from 1.371300,0.530960 to 1.371300,0.530960 to 1.454400,0.519360 to 1.538200,0.507670 to 1.618100,0.496530 to 2.103300,0.428840 to 2.663500,0.350800 to 3.021200,0.300960 +"ssl?" at 2.112800,0.585070 +.ps +3 +.PE +.RE\} +.bp +.SH "IC_NB_Global TABLE" +.PP +.PP +.PP +Northbound configuration for OVN interconnection\[char46] This table must have exactly one row\[char46] +.SS "Summary: +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fICommon options:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ 2.75in +\fBoptions : ic_probe_interval\fR +optional string +.RE +.TQ .25in +\fIConnection Options:\fR +.RS .25in +.TQ 2.75in +\fBconnections\fR +set of \fBConnection\fRs +.TQ 2.75in +\fBssl\fR +optional \fBSSL\fR +.RE +.SS "Details: +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Common options:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides general key/value settings\[char46] The supported options are described individually below\[char46] +.IP "\fBoptions : ic_probe_interval\fR: optional string" +The inactivity probe interval of the connection to the OVN IC Northbound and Southbound databases from \fBovn\-ic\fR, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.ST "Connection Options:" +.PP +.IP "\fBconnections\fR: set of \fBConnection\fRs" +Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured\[char46] See the \fBConnection\fR table for more information\[char46] +.IP "\fBssl\fR: optional \fBSSL\fR" +Global SSL configuration\[char46] +.bp +.SH "Transit_Switch TABLE" +.PP +.PP +.PP +Each row represents one transit logical switch for interconnection between different OVN deployments (availability zones)\[char46] +.SS "Summary: +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.75in +\fBname\fR +string (must be unique within table) +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBother_config\fR +map of string-string pairs +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Naming:" +.PP +.IP "\fBname\fR: string (must be unique within table)" +A name that uniquely identifies the transit logical switch\[char46] +.ST "Common Columns:" +.PP +.IP "\fBother_config\fR: map of string-string pairs" +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "SSL TABLE" +.PP +SSL configuration for ovn-nb database access\[char46] +.SS "Summary: +.TQ 3.00in +\fBprivate_key\fR +string +.TQ 3.00in +\fBcertificate\fR +string +.TQ 3.00in +\fBca_cert\fR +string +.TQ 3.00in +\fBbootstrap_ca_cert\fR +boolean +.TQ 3.00in +\fBssl_protocols\fR +string +.TQ 3.00in +\fBssl_ciphers\fR +string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBprivate_key\fR: string" +Name of a PEM file containing the private key used as the switch\(cqs identity for SSL connections to the controller\[char46] +.IP "\fBcertificate\fR: string" +Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch\(cqs private key, identifying a trustworthy switch\[char46] +.IP "\fBca_cert\fR: string" +Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller\[char46] +.IP "\fBbootstrap_ca_cert\fR: boolean" +If set to \fBtrue\fR, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] \fBThis option exposes the +SSL connection to a man\-in\-the\-middle attack obtaining the initial +CA certificate\[char46]\fR It may still be useful for bootstrapping\[char46] +.IP "\fBssl_protocols\fR: string" +List of SSL protocols to be enabled for SSL connections\[char46] The default when this option is omitted is \fBTLSv1,TLSv1\[char46]1,TLSv1\[char46]2\fR\[char46] +.IP "\fBssl_ciphers\fR: string" +List of ciphers (in OpenSSL cipher string format) to be supported for SSL connections\[char46] The default when this option is omitted is \fBHIGH:!aNULL:!MD5\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Connection TABLE" +.PP +.PP +.PP +Configuration for a database connection to an Open vSwitch database (OVSDB) client\[char46] +.PP +.PP +This table primarily configures the Open vSwitch database server (\fBovsdb\-server\fR)\[char46] +.PP +.PP +The Open vSwitch database server can initiate and maintain active connections to remote clients\[char46] It can also listen for database connections\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtarget\fR +string (must be unique within table) +.RE +.TQ .25in +\fIClient Failure Detection and Handling:\fR +.RS .25in +.TQ 2.75in +\fBmax_backoff\fR +optional integer, at least 1,000 +.TQ 2.75in +\fBinactivity_probe\fR +optional integer +.RE +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBis_connected\fR +boolean +.TQ 2.75in +\fBstatus : last_error\fR +optional string +.TQ 2.75in +\fBstatus : state\fR +optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR +.TQ 2.75in +\fBstatus : sec_since_connect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : sec_since_disconnect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : locks_held\fR +optional string +.TQ 2.75in +\fBstatus : locks_waiting\fR +optional string +.TQ 2.75in +\fBstatus : locks_lost\fR +optional string +.TQ 2.75in +\fBstatus : n_connections\fR +optional string, containing an integer, at least 2 +.TQ 2.75in +\fBstatus : bound_port\fR +optional string, containing an integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBother_config\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtarget\fR: string (must be unique within table)" +Connection methods for clients\[char46] +.IP +The following connection methods are currently supported: +.RS +.TP +\fBssl:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified SSL \fIport\fR on the host at the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBtcp:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified TCP \fIport\fR on the host at the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBtcp:[::1]:6640\fR\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.TP +\fBpssl:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for SSL connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IPaddress (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap in square brackets, e\[char46]g\[char46] \fBpssl:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 (but not IPv6) addresses\[char46] A valid SSL configuration must be provided when this form is used, this can be specified either via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBptcp:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBptcp:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 addresses\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.RE +.IP +When multiple clients are configured, the \fBtarget\fR values must be unique\[char46] Duplicate \fBtarget\fR values yield unspecified results\[char46] +.ST "Client Failure Detection and Handling:" +.PP +.IP "\fBmax_backoff\fR: optional integer, at least 1,000" +Maximum number of milliseconds to wait between connection attempts\[char46] Default is implementation-specific\[char46] +.IP "\fBinactivity_probe\fR: optional integer" +Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message\[char46] If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe\[char46] If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect\[char46] Default is implementation-specific\[char46] A value of 0 disables inactivity probes\[char46] +.ST "Status:" +.PP +.PP +.PP +Key-value pair of \fBis_connected\fR is always updated\[char46] Other key-value pairs in the status columns may be updated depends on the \fBtarget\fR type\[char46] +.PP +.PP +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpunix:\fR), both \fBn_connections\fR and \fBis_connected\fR may also be updated while the remaining key-value pairs are omitted\[char46] +.PP +.PP +On the other hand, when \fBtarget\fR specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets\[char46] They are omitted\[char46] +.IP "\fBis_connected\fR: boolean" +\fBtrue\fR if currently connected to this client, \fBfalse\fR otherwise\[char46] +.IP "\fBstatus : last_error\fR: optional string" +A human-readable description of the last error on the connection to the manager; i\[char46]e\[char46] \fBstrerror(errno)\fR\[char46] This key will exist only if an error has occurred\[char46] +.IP "\fBstatus : state\fR: optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR" +The state of the connection to the manager: +.RS +.TP +\fBVOID\fR +Connection is disabled\[char46] +.TP +\fBBACKOFF\fR +Attempting to reconnect at an increasing period\[char46] +.TP +\fBCONNECTING\fR +Attempting to connect\[char46] +.TP +\fBACTIVE\fR +Connected, remote host responsive\[char46] +.TP +\fBIDLE\fR +Connection is idle\[char46] Waiting for response to keep-alive\[char46] +.RE +.IP +These values may change in the future\[char46] They are provided only for human consumption\[char46] +.IP "\fBstatus : sec_since_connect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last successfully connected to the database (in seconds)\[char46] Value is empty if client has never successfully been connected\[char46] +.IP "\fBstatus : sec_since_disconnect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last disconnected from the database (in seconds)\[char46] Value is empty if client has never disconnected\[char46] +.IP "\fBstatus : locks_held\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection holds\[char46] Omitted if the connection does not hold any locks\[char46] +.IP "\fBstatus : locks_waiting\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire\[char46] Omitted if the connection is not waiting for any locks\[char46] +.IP "\fBstatus : locks_lost\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client\[char46] Omitted if no locks have been stolen from this connection\[char46] +.IP "\fBstatus : n_connections\fR: optional string, containing an integer, at least 2" +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpssl:\fR) and more than one connection is actually active, the value is the number of active connections\[char46] Otherwise, this key-value pair is omitted\[char46] +.IP "\fBstatus : bound_port\fR: optional string, containing an integer" +When \fBtarget\fR is \fBptcp:\fR or \fBpssl:\fR, this is the TCP port on which the OVSDB server is listening\[char46] (This is particularly useful when \fBtarget\fR specifies a port of 0, allowing the kernel to choose any available port\[char46]) +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.IP "\fBother_config\fR: map of string-string pairs" diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.html b/src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.html new file mode 100644 index 00000000..81c9a0cc --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.html @@ -0,0 +1,374 @@ +
+ovn-ic-nb(5)                  Open vSwitch Manual                 ovn-ic-nb(5)
+
+NAME
+       ovn-ic-nb - OVN_IC_Northbound database schema
+
+       This  database is the interface for cloud management system (CMS), such
+       as OpenStack, to configure OVN interconnection settings. The  CMS  proā€
+       duces  almost  all  of the contents of the database. The ovn-ic program
+       monitors the database contents, transforms it, and stores it  into  the
+       OVN_IC_Southbound database.
+
+       We  generally  speak  of  ``theā€™ā€™ CMS, but one can imagine scenarios in
+       which multiple CMSes manage different parts of OVN interconnection.
+
+   External IDs
+       Each of the tables in this database contains a  special  column,  named
+       external_ids.  This  column has the same form and purpose each place it
+       appears.
+
+              external_ids: map of string-string pairs
+                     Key-value pairs for use by the CMS.  The  CMS  might  use
+                     certain  pairs,  for example, to identify entities in its
+                     own configuration that correspond to those in this  dataā€
+                     base.
+
+TABLE SUMMARY
+       The  following list summarizes the purpose of each of the tables in the
+       OVN_IC_Northbound database.  Each table is described in more detail  on
+       a later page.
+
+       Table     Purpose
+       IC_NB_Global
+                 IC Northbound configuration
+       Transit_Switch
+                 Transit logical switch
+       SSL       SSL configuration.
+       Connection
+                 OVSDB client connections.
+
+IC_NB_Global TABLE
+       Northbound  configuration for OVN interconnection. This table must have
+       exactly one row.
+
+   Summary:
+       Common Columns:
+         external_ids                map of string-string pairs
+       Common options:
+         options                     map of string-string pairs
+         options : ic_probe_interval
+                                     optional string
+       Connection Options:
+         connections                 set of Connections
+         ssl                         optional SSL
+
+   Details:
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Common options:
+
+       options: map of string-string pairs
+              This column provides general key/value settings.  The  supported
+              options are described individually below.
+
+       options : ic_probe_interval: optional string
+              The  inactivity  probe  interval of the connection to the OVN IC
+              Northbound and Southbound databases from  ovn-ic,  in  millisecā€
+              onds. If the value is zero, it disables the connection keepalive
+              feature.
+
+              If the value is nonzero, then it will be forced to a value of at
+              least 1000 ms.
+
+     Connection Options:
+
+       connections: set of Connections
+              Database  clients  to  which  the  Open  vSwitch database server
+              should connect or on which it should listen, along with  options
+              for  how these connections should be configured. See the Connecā€ā€
+              tion table for more information.
+
+       ssl: optional SSL
+              Global SSL configuration.
+
+Transit_Switch TABLE
+       Each row represents one transit logical switch for interconnection  beā€
+       tween different OVN deployments (availability zones).
+
+   Summary:
+       Naming:
+         name                        string (must be unique within table)
+       Common Columns:
+         other_config                map of string-string pairs
+         external_ids                map of string-string pairs
+
+   Details:
+     Naming:
+
+       name: string (must be unique within table)
+              A name that uniquely identifies the transit logical switch.
+
+     Common Columns:
+
+       other_config: map of string-string pairs
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+SSL TABLE
+       SSL configuration for ovn-nb database access.
+
+   Summary:
+       private_key                   string
+       certificate                   string
+       ca_cert                       string
+       bootstrap_ca_cert             boolean
+       ssl_protocols                 string
+       ssl_ciphers                   string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       private_key: string
+              Name  of  a  PEM  file  containing  the  private key used as the
+              switchā€™s identity for SSL connections to the controller.
+
+       certificate: string
+              Name of a PEM file containing a certificate, signed by the  cerā€
+              tificate authority (CA) used by the controller and manager, that
+              certifies  the  switchā€™s  private key, identifying a trustworthy
+              switch.
+
+       ca_cert: string
+              Name of a PEM file containing the CA certificate used to  verify
+              that the switch is connected to a trustworthy controller.
+
+       bootstrap_ca_cert: boolean
+              If  set to true, then Open vSwitch will attempt to obtain the CA
+              certificate from the controller on its first SSL connection  and
+              save  it to the named PEM file. If it is successful, it will imā€
+              mediately drop the connection and reconnect, and  from  then  on
+              all  SSL  connections  must  be  authenticated  by a certificate
+              signed by the CA certificate thus obtained. This option  exposes
+              the  SSL  connection to a man-in-the-middle attack obtaining the
+              initial CA certificate. It may still be  useful  for  bootstrapā€
+              ping.
+
+       ssl_protocols: string
+              List of SSL protocols to be enabled for SSL connections. The deā€
+              fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.
+
+       ssl_ciphers: string
+              List  of  ciphers  (in  OpenSSL cipher string format) to be supā€
+              ported for SSL connections. The  default  when  this  option  is
+              omitted is HIGH:!aNULL:!MD5.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Connection TABLE
+       Configuration for a database connection to  an  Open  vSwitch  database
+       (OVSDB) client.
+
+       This  table  primarily  configures  the  Open  vSwitch  database server
+       (ovsdb-server).
+
+       The Open vSwitch database server can initiate and maintain active  conā€
+       nections  to  remote  clients.  It can also listen for database connecā€
+       tions.
+
+   Summary:
+       Core Features:
+         target                      string (must be unique within table)
+       Client Failure Detection and Handling:
+         max_backoff                 optional integer, at least 1,000
+         inactivity_probe            optional integer
+       Status:
+         is_connected                boolean
+         status : last_error         optional string
+         status : state              optional string, one of ACTIVE,  BACKOFF,
+                                     CONNECTING, IDLE, or VOID
+         status : sec_since_connect  optional  string,  containing an integer,
+                                     at least 0
+         status : sec_since_disconnect
+                                     optional string, containing  an  integer,
+                                     at least 0
+         status : locks_held         optional string
+         status : locks_waiting      optional string
+         status : locks_lost         optional string
+         status : n_connections      optional  string,  containing an integer,
+                                     at least 2
+         status : bound_port         optional string, containing an integer
+       Common Columns:
+         external_ids                map of string-string pairs
+         other_config                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       target: string (must be unique within table)
+              Connection methods for clients.
+
+              The following connection methods are currently supported:
+
+              ssl:host[:port]
+                     The specified SSL port on the host  at  the  given  host,
+                     which can either be a DNS name (if built with unbound liā€
+                     brary)  or  an IP address. A valid SSL configuration must
+                     be provided when this form is  used,  this  configuration
+                     can  be specified via command-line options or the SSL taā€
+                     ble.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL support is an optional feature  that  is  not  always
+                     built as part of Open vSwitch.
+
+              tcp:host[:port]
+                     The  specified  TCP  port  on the host at the given host,
+                     which can either be a DNS name (if built with unbound liā€
+                     brary) or an IP address. If host is an IPv6 address, wrap
+                     it in square brackets, e.g. tcp:[::1]:6640.
+
+                     If port is not specified, it defaults to 6640.
+
+              pssl:[port][:host]
+                     Listens for SSL connections on the  specified  TCP  port.
+                     Specify  0  for  port  to  have  the kernel automatically
+                     choose an available port. If host, which can either be  a
+                     DNS  name  (if  built  with unbound library) or an IP adā€
+                     dress, is specified, then connections are  restricted  to
+                     the resolved or specified local IPaddress (either IPv4 or
+                     IPv6 address). If host is an IPv6 address, wrap in square
+                     brackets,  e.g. pssl:6640:[::1]. If host is not specified
+                     then it listens only on IPv4 (but not IPv6) addresses.  A
+                     valid  SSL  configuration must be provided when this form
+                     is used, this can be specified  either  via  command-line
+                     options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              ptcp:[port][:host]
+                     Listens for connections on the specified TCP port.  Specā€
+                     ify 0 for port to have the kernel automatically choose an
+                     available  port.  If host, which can either be a DNS name
+                     (if built with unbound library)  or  an  IP  address,  is
+                     specified,  then  connections  are  restricted to the reā€
+                     solved or specified local IP address (either IPv4 or IPv6
+                     address). If host is an IPv6 address, wrap it  in  square
+                     brackets,  e.g. ptcp:6640:[::1]. If host is not specified
+                     then it listens only on IPv4 addresses.
+
+                     If port is not specified, it defaults to 6640.
+
+              When multiple clients are configured, the target values must  be
+              unique. Duplicate target values yield unspecified results.
+
+     Client Failure Detection and Handling:
+
+       max_backoff: optional integer, at least 1,000
+              Maximum  number  of  milliseconds to wait between connection atā€
+              tempts. Default is implementation-specific.
+
+       inactivity_probe: optional integer
+              Maximum number of milliseconds of idle time on connection to the
+              client before sending  an  inactivity  probe  message.  If  Open
+              vSwitch  does  not communicate with the client for the specified
+              number of seconds, it will send a probe. If a  response  is  not
+              received  for  the  same additional amount of time, Open vSwitch
+              assumes the connection has been broken and  attempts  to  reconā€
+              nect.  Default is implementation-specific. A value of 0 disables
+              inactivity probes.
+
+     Status:
+
+       Key-value pair of is_connected is always updated. Other key-value pairs
+       in the status columns may be updated depends on the target type.
+
+       When target specifies a connection method that listens for inbound conā€
+       nections (e.g. ptcp: or punix:), both  n_connections  and  is_connected
+       may also be updated while the remaining key-value pairs are omitted.
+
+       On  the  other  hand, when target specifies an outbound connection, all
+       key-value pairs may be updated, except  the  above-mentioned  two  key-
+       value  pairs associated with inbound connection targets. They are omitā€
+       ted.
+
+       is_connected: boolean
+              true if currently connected to this client, false otherwise.
+
+       status : last_error: optional string
+              A human-readable description of the last error on the connection
+              to the manager; i.e. strerror(errno). This key will  exist  only
+              if an error has occurred.
+
+       status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING,
+       IDLE, or VOID
+              The state of the connection to the manager:
+
+              VOID   Connection is disabled.
+
+              BACKOFF
+                     Attempting to reconnect at an increasing period.
+
+              CONNECTING
+                     Attempting to connect.
+
+              ACTIVE Connected, remote host responsive.
+
+              IDLE   Connection is idle. Waiting for response to keep-alive.
+
+              These  values  may  change in the future. They are provided only
+              for human consumption.
+
+       status : sec_since_connect: optional string, containing an integer, at
+       least 0
+              The amount of time since this client last successfully connected
+              to the database (in seconds). Value is empty if client has never
+              successfully been connected.
+
+       status : sec_since_disconnect: optional string, containing an integer,
+       at least 0
+              The amount of time since this client last disconnected from  the
+              database  (in  seconds). Value is empty if client has never disā€
+              connected.
+
+       status : locks_held: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  holds.  Omitted  if  the  connection  does not hold any
+              locks.
+
+       status : locks_waiting: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  is currently waiting to acquire. Omitted if the connecā€
+              tion is not waiting for any locks.
+
+       status : locks_lost: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  has  had  stolen by another OVSDB client. Omitted if no
+              locks have been stolen from this connection.
+
+       status : n_connections: optional string, containing an integer, at
+       least 2
+              When target specifies a connection method that listens  for  inā€
+              bound  connections  (e.g. ptcp: or pssl:) and more than one conā€
+              nection is actually active, the value is the  number  of  active
+              connections. Otherwise, this key-value pair is omitted.
+
+       status : bound_port: optional string, containing an integer
+              When target is ptcp: or pssl:, this is the TCP port on which the
+              OVSDB  server  is  listening.  (This is particularly useful when
+              target specifies a port of 0, allowing the kernel to choose  any
+              available port.)
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+       other_config: map of string-string pairs
+
+Open vSwitch 23.06.3            DB Schema 1.0.0                   ovn-ic-nb(5)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ic-nb.5.pdf new file mode 100644 index 0000000000000000000000000000000000000000..579be21589774a7a664cfd789e032347ca3dde72 GIT binary patch literal 38662 zcmce;1yo(jvM!8!aF-y#f-T(L-CcvbI|O$N?ykWhxCaZa!6CQ?f`#DrFNo}Y&c64J zbKm&i9gE3q@9L_rtE%Vh*<|vXoy=`*IEn1^oy-8H zjzqNbv_!N00U5<((8c19+y4(3kAz!XO(BU@)D9zI}D&e_S%*-6yg%J?bzAN2&sLPSqw zYhVG#%?*$?wlQ@wBVq-nC<1`3I2k(-0Yt6zos5Nz4Q-8#d3oU+og9qyt>N4<3RMRk zmPC=;&!~4yawM@0t6#B6s1_!u#~G5y78WFMgN1DMs+-XyCE5;DT@jv{K*3844iXoF z3+E)yEmtLv_ZCJr?c2KTY4bka9?(#V1SLj+i?(JSWxyM54a>Ahtn7 zq|scx4{*7lh~%d$?8qhuC9Rq1F2zsfnhChMx$)w}K2aP>Ilw{L5u271isPXx=b~<_ z9UPTamh}4s8l_>@t4(`id`;QVk%W)_6Yf&!^xu|wM zE@MWQqKz(!x>cr=V~#^=%)JLgZ*QfRTy7Ybui2+dR)}+>zWisZft=_ji6J;v-~-FVQulwBAS!VHH&o# zM!v9BMsw3;yjZmBA{vbZFCk0jIN|o3`4`@O?5C{%PHgN%t3q%`Sw!O%%k*_1*_M%y z1U|nqFX$RkI6XLd5!4LorHnJn7uo|!7w4&$zG)LA#xJTgw_2^jzRALf$!HD0pDQI6 zsfL3;oWOj9z7t?1YQCngrOz>xPXi3M5MDW8OKvE!*)I@r8e5$tQ7Wyui7%U(pyeyX z?G1RN88J0O6y}@x`iCQu_#wQQxt6VL&Px?FA7V#;a~}$#S2FkV1=?W(akTi( z$^FbVehO+>{}(-4xzHmc0Dp9JRpO<(=P{R}+5k&cD9yE~YN?d)Cp?W;tr+fKB8if01kDvp5 zH!bPqrwy@N32z4U=-@}pL8NVbSX|09Oz72;wnm+R-0c+TVxn{xZSuwP{D!Dw*+fU~ zc0%Ntaewa7qF4K)MFc$Qs56yE)5a1b2)k~R@S75HM=zV*+&)8qyx;w*F*MpRrRO+V ze1n&XRzZp|BWU8aO|~fT!m-D3Mh7$o|GRc&r&F^x$^N874`Yd$ttYrCVVOOi9nW|x z?eR%bm)+7#ae9_@sa^jabA?}Ip~R2w8)F;Bxrrg!%iXNq>#l*R+D0s+>w}q@ubxZL zq|%%Rm!>a-H`&84S_ZOJ3k}p2i0~2kcid<5OHGMCxGZ+iFo-;$nv_Q037vj&O_Pg6 z;lW!s7e~WPxCB_d2pMVSv*z=r?Y(*C`TVbwS>0qM6jBH ztIb{8LyR$UY(kUXUnM#J;>|)g;?|<|X3<4(?!3a4oM9X)GwEd&A;!|eeYD8^8`)Nl zIya-oZH@&l_X`e|&hUWzI?mHxHEPS9f(^_xJe&wMm&=_7e1vPUOhWzT>#5)`wF!9` zyJd=6BqHsx9HQo28ehZ`=qnhzH0f5oDYV~mzoIChF zietl5axvSMF)|;BCaQ$r0(zu5uB@ixX~aFi!}3^c%f+6}@LmYMA?XI0EHtU*D#in} zk|)9(Rof^+@8lARNL(GrV546u85nv}<4?-_>CV8+zy|j#jp3gr zReNkzFt|J35-$}~nqU&ZK@VOiRwt<@bz97R8&W0H%bu!@vsI?zA42**amg_>Cz~xBhcP%TKc?H}?R;?%u{uufGorg9k|PYWGNt@gyP=xb z;p_3xLTQol9P_d;7qJTSw#~Bcgn^FEkD1_L3|=C)xRx(3>Vlm0*k)Xo>w7G`BxZ^N z&Ko#w_x)zAS=E)*)r4rtl}y`V6p|@0_N-eWJ@qcmz=58iv#7=A zgMVC~pjk&Mc5FE;T~wTzbJ951+E3!R?uWghE|l2r?>J~+o?gn&=!DtsM<9pEzwf{k zo1tws^M(D&PX|U=8cm$knnX`Vt?8sTAiJycvG~@{@`tXlc|Y#KClMJL9a<>Oi)C`5 zAr+H4!@?mEdTZPC+~!H`**43@nHI=+%5t3v<3^LbhUEbEE8dB7n9+qAi^?O^;gmWQ zx|{D1cEKYGN||#q?bw$5bEg+5uvu^8L^Xk{-}>-)p-;t&Vh`aS-Ar55!8HY|qi8SXjE=R%EG?(ols4Gz+l?C!jZ0^) zs*vnX9>f))RvjI$7DF=jyTNj|9%slFY&bD4GrBZE?uT)O0#bZ631p_wFp_}B+ZOg) zEJ#zRZk=^m31Or}M_nP^8sCp@7wa>pA-giJyh9dH$kM2@RHPB|8ghf2`r0J8gS-#%+_1;n8LPp6&QwN%Q#Rmz<*zw;^)p2 z0og<}9~+ak-C$Y(HI2JIRrEJXz|_90;+7Y&UUn0CE5Y^-%Y7RO*7QCqVIAFl+KJu# zuzJNC8_>MOs{YE~l-|?Nndqeo=;77&d9a}GMHCKnC`y8?YB zvi^C#`Fd0sG5ToCXe`j48+kxpzO^Snh#qo&AUlJF)%IJ-BjR{#Z^*ZAM4qD2BdbgL z`zmilKfFq1#6W;^5C{1Tev>)BXo?JngtP}+MVya$P#3*}+W6wqMwoeYaxE-)1EuED z_a#{V2CSlc1v|B8;1>tz7k){|beK${B{Y*oyip;2Uu`YH%E-;DH4SbM){zVGhKW z;)pxds~B}#ECB*ccXitzN9jmkb9@U^6uZk|wi$Lx_z&KToG>60Chy(r&fI{=kYvc~ ze+or$)8@hO>Ja*9bWTiNKT+ZiB!m_J_T_LnhpMk)Oy}artq3+OJ%=E1bp5=woum8Z z(Z@N4!>Biyt_sjEfw0k>}f{`qbxw?CsDg1rfq4b-o5TW#Q5vBaw zB9Y@{u!IRpL~qZK@D?@N&}phUFzgCfk&qiJB`RftmY0W&j#0saW@4%6o?#Bl3Z8G(Ev>Lyl3N6uwP618zIE-m-s zZQQ$_kl*#TTTsSe_gqK_DLopapu`IwM4>o`{Gz9bGOgjRX4Q&Qz?>LhtC&$n7}@8@mDV17f#(7d(959raKHUZ^(NBQW+Hq{A$Ik!O9oaSi`k5I zf2?;|OjSr0_EX8L6GK*g7fza_{)<8EDF(L-#i2KN;wcX81 zfzn&wFHm!{4KVLtOV#=9?O0@ak)*1-;2H7kyTVx~@LkAH*EfJ895^p5vR>yZI!8l` zWO*lmat=bAsxdmg+h!J!1KC2~zqtgXWJnCWdV@CNODxZ23$7I7h~`uma$}w$x3TtN zz7&zCShL=D<^3j=jD|mlvs&4%1S=EAMG0GxADOzH7n?mBMT12$bP!RqM|Is)6sR}B zh36iP#X*daMj7&aY~v>=)d&wQ>_{^>nN9()BtaqCD3pmg_Am5|#`!~=Svg^h-%o?G zKnhp{c?Em@&p#%##fLIwh$E@ntwf?wOugl+2+d7kCorTTb!1TWC8!%T7=$1vl?1JO z(CGKfw~F>=PErCBmN3AgB5qazX-pxNH={`@wjBvSybKg+SzXo68?=h)S}o;h%3dlT z7mSE$9au^e=MuH9K{Rt+Wt}+<+%iNXV}H5n%1qMy>E@VZZnzVIBLEW&(;dP#pw?h8 zwb#E-KnG{|TO`VQih!V&vxo*}CRl$X{}dj409iw?1irfgMW?5nm3S$i%2Gydp4d{} z6u2B4^htaw`X-DNp;h69h6elGp>VJLNamo&RoEA0Cq7i6HT3XiB{0f#?HK$>TrNW& zGmHjT3)PSH<+_g`N;zlYFAB%6<=N_;!5b_OhtYCCSrp|wIE+Z`h|&qci}-12RiHKr z$O3apxk^%O7}JwR)RrzJ7BZZVr&fft5uMS}aefZBq_^PL#+AK6zs=Vi)D9HRZWq71(ircumStS??-32`{M z3Vib&YOh=~G=8~$)KQ*c*4s{n8dUSLlvhY&fxi|6+@<4aU%-1#T^`M%EL9f$tFQaM z*mrZ3je$m`<%F%wTF3k^N&?ml{!o>f*<#p4=p^2do&q1xzVb|UiFCC^G$bSh7ZqD* z>TIp84z($syhUUJ;Psd2!*Q*nR?9^$U)1Mu6HX7PLDeg`!d$~M^|Heu9y1_wd+6Z| z3%Rv+N3yl8zMJp)A?$n27#NbXrVgQoWtMoXoJdTGpVBEhl;a!jn;zJv3-Asa=R;Y4 zwD^Z{cvkv9y?HjqKgQvo-aO-f=FO|fIHuD-J+irgfkqERCT!mB32|98(qwAy&5VpR z)*?VgTx&YA9f&@HqbDCL7%b@V!}+l2b-S{(4azOp#U%GQ1~(j#c>ZSc0{uo!wbR(5 znVf30y!JTuI)<*|2sLORgc62`mZtTs(`UUDh)vXPbyR5VSUMW5Rw~EyFK>Bnvwpzd z1%bTj>%)dPnJzG;kK;Eji(Au8P!geR>!i#{SfNOh~zPgv{MN zEItw)to;z#=zuH4mPA-7+=jyc0KHaI9VJ(mi&+?GzY@??8&s*{xEdgr+51XYyu{1? z+IZtmnlBm!f)oJ^k?vf}MSOtEh8(O)wXg&k*#eO%;<}fRb2+N?75K~dA^Q$WgPQwA z!HQC5rI;_awk3^8LRy6CX{hB}VpUWvXlq3iad&DKBueyilirPo?UH?HPrxYh*9!4m z?uy1!ACS>)h@v+N?BmJv(hqNdfO;upf}}%So3}e-ix&oi6u;GZn~!ZSx+zdQ22O?L zm{?|l&=CPGm8_KeQKZU|)}iZVerGutTd6gfwP zINLLbJcRe4sC$^cHo|(D$h>-HU!NK@Oo#eKRLX7*)8`Kj2UB+9-YS@opS@IemIUV> z`4w0#HJ0-Q<;vzd(G9@2Q8}e;kgQ)Rt7Lx`jwfdD*kY4BmVXzub7`TFJ^%gHwHIa- zX;V^^yt@~PUut2aFg=?0h$C`0MO*rSz617H<6Qa*Z&m+G+|+|*&2va>oZ!ihiE+_L za*1qo27y{knQYqC0L`4snfUV4yZY2u6iG1li-xvezTx%pe;53s+JA-S)3z4Mw+l2+ zJ$A2NL>w=phM2fUqqG?mB=f&5XPdZWAgWxL9pOSeRUT3b7L2P7a6bMf5kgC37BT=5 zC^z?Bc6Sm6$L6RA!;UV*lDe?I%dc~Sk%eZ+$`X^n9IcrdCaeoRF!D#OvA3DsmGgCx zKsP>?4>KinV--L@t-_et7gf9Diue>Ci?%#D^p)`SOR)wb819#xty4SC$b;OWQ!!kBo@`Z95`Qw`qQws1wkC{5#CW> z_tVjl@=Mr%bK%Siv$Frd?&)&*jZrT)0@mSE^ux$dYJ`o6o~f{R#1ApmJhid~LG_B7 zg$TJ1Zq?lWYYbjfv{`mA>nd?MR zI`rT*+J@M?oKRg$I!AWq$r-+vl{y(>40|U7Y+@?)3md?(L)PJhr{;MbvS|MaH`Y7% zn|U9BqBTlz!A>yvl%)j{7*GdaOmEVW%8cP*GR;vXtX2VBc7Pu3>d2$!y-71<59Dd2 zy{g(Jo0pWku9}%vV{ukIa;wcZu0{-BLA;@_X)XwpG=@4M^?YH1f+sL;k#;2Zx);V0 zOZUybRD=U%8AYSk!J#4fy=0sXS{A2qrGP5@vC5Al>&Md(s3C_)-9#nP0e%_p8r_`@ zKjhm-<#OU!x_f6Uj3J6crHkF>%yo}`bgizmL{zP7eh8zcr@^jxdE&h7q+`Ea=ZFd} zMCxpzYwA2nQ2hhlsarpZjce8=8kT`~dozztiZVZP)Oue{J1Xdy-yIF4z= zAUX)CoJo-i9)5p$-gZKqvw$c;7o~?fOkk#vp7?z+MT_iuWrvd-F-31~$yh69oP4m3ZY->x~8E@!q4(6?N5^5g&3nGx;eUBQFs6-9!8eXC0@aJN|2-X!UHh0UWCu2nXLY9H&33Kh zDJr@AYLtrua#yAlj~@bLs4AZF=kOH}g7FX#C8W60_3TrIO6>ly1H}9KeC^e7Su*8Y z*tieGt$oVST^;Ur@=3(9B(4eX-Y1gbaKYY;f=JjI$&A+CIf<*4RyTNxaM|9zTOAEM zn5JD_SWZX9PlIhe_C`+L0w*kefjtjt0&!p5^44Ex^AH6R6C}VKKOGFdYfs^`-Rb8_ zG7Zi)QHR5moB>1IZx{4rrAt~waASfPDO>q%cxejmIi)!D5emIN($*mGl19a&Ru)Qp z1Wd+k3@#GLnR{ELU92+{@Apu?+FNOQSlfhbFgw^5eIp^2-=Jei5DUw@BZz$2SC6kz z{MI)ev70h9X1OHL4GaRx$qFi9CKwixBpTtROL^QdIqvLGYa1o66HZ)7gY9YY>tTu!Slcl<7ekxovF?{q=ncdD-izbAxf1v?OYs3JEH zAzUou}D+`k@k>n5WuR*pe0CegK7~2My_Q9x+Hy3wTCQI!$0LFUR;u6{* zmhc4u7n;$zv0zNE?7%8s-`Om-;G}$bWtIA{A^pICtWJE2Psg4iLZ-~2No|ceL}Io& zz`a4F3XTG?hl}#Rbd?Wil-kN@(UPU!4Tl^|5he#Fhs*J!+fsGODqN0SWVg~A~ zAOK_kN?atS@3SBGYg`TKuw(ag0$Crx*(ek(%o-A_3x}*(ojriiaOr9PBhO>TIo3&X(zj~;vfP*82;}B5Ufp`~&6DssYm`XhH zgkgL}B!6l*8%?j0H54!-3>~bPO|&I=QR*DKo(9FVJnSEQ*gHVl3?5SszaU;V}Hr@V+W6qDBoSPb{3!KBWFfUHdN^Z`CU3&NiSAweD34cLBe1G z?uUGik%mySW?vTlyp59v0TNg7Y1&#g2TL5wpgR^XYIIQ}@Pr(+@2`)sNUhY9>#uRm z_R3yJAA*xBt~q|8dB695jabnq0~4%C^V>OQjmgI733*ikz6Acp5$6F`%_f#XUCQHt zouvGBkAZ4AjcJ*l_eqUA4c<$a3In>)SrEq&Y1)}~r1k{5Q26^@@HS z0LFfOhSo{eGdZKN?6A~=(lMvBR;k?IO$_4C*Aa18;C#^c^#eJZi>Q!9%%@-yjJUYy z)%7;X)eo&8SJYBr%fRW=A1eel|Izm2a!?0KGULWZ^u4x~D4jdL7aqfX!hH0nU~OqJ zG;J20NbhTwPOPb!0V@O2HPRDq#^uP2w|rR-;D~SJgJn9TO?=r07Xvi1vS0BDx z8X>Kr7>{h5z@qVD#F9?Ek3Cx(2w`YmE=6Fg?#u^`H%TqS`gWWZXYqmDC!$s-Vj` zF!j+%Hsle`5M+r3S$9tken{=2hOJ)IJlMa85EpCstZGM z0u^6&FRKH)L$pH{zMKs*AF&Jl=8Q))+5J8#7%HITAw8W*B}MpnU!HRU2>X-?UpI-> z+tz>b#n|@%JM|Ct>1W(;(GA?8?Hrd#QkKwueR3UVwLx08mfVXR-scp?=>Woy4S|{J z3#mT=n``+E#Mq5!pG=kbeVA2PF6}fqv^lv28QEN->MPk{Z9FLG9AS9ecrbHC)gk^J z$j*ei0JRsYW19W!uB|U193}^8uvuao*~%DVVR#jx)iqn){-@Bds=C} zU#@kX=B4A;jX~MOeG$>~99^(U(D4sUbIwS6-i#GW~U6}XUd-zCK$CR)Kx76wlWIV!cwU^i;-io zINj~h-J&F*{3symb~g$4LyPDVV+S7}x=cyO(FfI%a0>D1ElFEoua0UU-{h;!#qy6FPJ!t>!^kx3u{NTm)`ON4oq7uOeZd+@IRt(6t^%q{W=9JovE?;+- z=uie!%S+fN3=!O#Kly2n43TOT<9-yQxA%d8n)k(k=8#i+B~4K-ufR?U3Z)y~ruMlL z6cT0)b=(tlC<=DC;O=8R$tafI@PcNc*!3o@xs9w>c&<{h>)lAeR2%osK3itmDCcO` zqcp;Gbe~<;am}_>Iu;+6k68F;>z&pJa^aeL+75{Q z6gf|B=co0fCf}^LYUtGjJLL|IA|PekeqtFl(&PO;dwscTb8{g^6V&f61LS+8XI|?E zAYbZr#3;7se@yWwz;@o36x07cIfLk>U^7Ed)U*x2Bl5v?M$17z*?wt5y5ylR+b z&V~6qpibIg?U3yV*5225H<5B;utM;<7HVdtit#Ay#koVjxFrpSq&GDghDDH=Sg{%H zw4{WDT;{K-OoZ|tu5??N63+Eg?g6cQ=bX8pGU9T@HocK~Wzwd zZ!sMEMz4LPz6y0O-$4w<%U$xn%9Zo6uWCe9N_K94U_RA+#oi|9Ug5WueWJDF z@$rRZ$C1qr2h`8a?eMHdJvqFdUE>>RY?IP#eqOc%>{`nT_{v%fauaMtYxM0bY|MRG z(#OXP{a9S8=?9nO?K)G|U-r1X$@!)zpP3oA0+$1! zt9pR5IzVD{4&lusG4X(}2Qi^PSZ=p>0yv~I*=9YwVApD|-~9ad6E1uhnO#ec69h~5 z^f3$<1)aJLBankP$|c7v6qFPDT{+(K-pD6@)xq`d79H<9ZxFAb!d}cy;R`~29xb$7 z<5GpEpT7a!o9?02(e%PT==`z!2K3}?d(vv#O`qI~TV6)VgV{8F8q(X~aFosaH7bsj zuECGAF^QhVw4--5tnj25HI?XTTQMjvT+`noD(GSf^5#3&OdgQ85uXRpm+B#`eO1B? z{3hH8{(1=44aN+o9Ib`a#y?B>0uR3to>^W=ax-b#K{HEWY&$hjs8lL8uS>4#&xJ&EAHv!vN^1S4YDjuJy~+ODKPp`)|F z5vFB*7;HX2?Fq@ol~>57rS*!Om`_Ny52%{c>exTMwG!HkNG)d z#-@l37L$|a2X_PKNco0+#|GtYG(=PLSu_pyFPHdCZ1Tn-!%uk9IX*C#A-7V(N0jK$F)^ppurHq?sZv*aX5SC)X*q;oS~U~b(iY4@7Us-xW0Uya^QPcE`_)>c|HKey+>l{)skJ1 z(Qy&hd_B8xn|E`ufD4Zp4Mkb&j@<$`Z~M74sTqv%5;e-S~VUD}=t+y26nDb18aHPvhYg1B$Tj13S`+Nk}?-e z^w1MY>l%YOhUf);%*MStPeIs|5$0(x#KB<8hp}U=FeXf}gg5nv3+Xo+Jbz0g+kSwE zbXR@;<&`e!xRM={efm0+ymq&4$9?DbEusZ6>SYFzrf&FVyCo~d=G0Dz{b@Qz*#aDl z#70w@4!X3r!!=GiAWQ`q2FJv55z04_*VK#Q6o9PoM zENSBI*8Nukk56+%!VOqA_S0|E@lGYMKAiNWz`hyG2|nf=5$5hYUaBR}g;8FXCFXz= znReZgFq|w2_SDe)>c-wNtnkj7-6>Y;lS**~$=qwklGsEG|Fq84;@Qh@VqB}yEbX1? z%shDLW&kO*k@M9FCOLx5J^gOlz^*U>;OI7NO&-k$ZVZKJ85Rp1?&8wAqq>lX*?@lT>l_GwWETc-1 z4}4UgZ>S)nT2z`K^TmCiAGSBQW$9stNMnm=DNkxNLp&;9g-X9t>cQ@eETibJ>=pM4 z%v3^WxCbT75TGDu@d2yMgJeSvi82QKb0SS*Zt%4EuHt*|9u=L-QBKa9@wHQGlzN%9g5iz4YQ{EdgrKNlq`)+R&DOA|al+K?7|8 zIS;NbKZNpwG|OSveF1I=qe5374u}3QX?Ui5t`pveFs3*0hc=Xs6G@yH*i9{E2@FiZnl(uPlUt%MA z<2=E3ICxW-9~T7jNV3o@C)k;pC6R2A6OBA)Q`yDQu<{6DqpC$dKz)L_{%qz>}8=TkNjhy(Fia&b$Cpe7-HpgpBGo6Hew^igCd z9F6cto*sdELqyEf4COhw^0>jn;F|9O)|;?v{=#4$!W?&YRABbjpe!4*rfWJa4aa~T zgTFrhh(Jr!7{5Wo%_0YBV!3spGE>m=!zQwq>n0WD>A?@*n2>v^k^XBz$kBYquG>TK z@s{GtsT2X9bM|3AByF5k5Q3LK!ayyxDTR+Ntq;;6C#wR2;aLRGhT_Vpn5UVGWN#BV zC$sv>h2nOmP5YX#a>w&0?$etn&b9DAFOKl?I$)d&03 zT?SDX@&|gV($e_?+|U9Zx`<2##;=7v!4^m@u6SZfur=`J&7Y0LP0G4vUo=l4D$crh zULv9^_JbJm_x+g0*8y<=sj+Y8@e~~OG(#qMX)`MqAz4Prm?~|axFVlOa)>~Q=YEaM z?OjpWpDLr2Bu?1QTi;-gA|W>``H7ZpC7ov_yp&+?jYkwVE3}F$1?8MMbJDxb6Lo}7 zO<&E~XnNkBY9vv1hlbOW)OaZd2WS|yM$cp5tialNKn)R&v?jkdT0@OTj7rq`l64$n z>y@YEkBpyX(zO$_HLOUkb-vh;I8!7&^FnerH*(-D)Y;_Q5vH$&{QWpFGuwO`Ljb|e zmI;gsHFQj-n5K6#P$Ge#{{F10W6QoqX@;~*ewxY29vbigN5-R6X98g&Itu$fhfSeY z%pSr!Ww|?FADeqw<$Pxn<_&BvuIl#oOofty}rwMNIR(@zLUJ>s%E@#qc4utLDsMZsYMv zhnI6}i|1`sSY2pvu-=l_<@eDtihSidGSJg-Vjqv(@JBW}9m3k(~(?G78>86@GgIS>OuPx>@}V##m5t&Rvt ztdf(Bx*cx_Sv}1p$k~~(d3)bM^H>B8tpnf1`JC)N#@0h2{nOEYa-g3bZFa^#k4c&T zxyOt7KicCpsy+;Sn~1)AKwV8e!=M00dNok#+-gRVSrIma$|dfAKH z>9*cdKd@SR`gn!q1r<<5%;v1PudA2uVUs(X5kmBnMC}aJtlDO)96l}|*nYgG#RKHv zkdx+Iz`z>fn;;y%WLv4|w`trPRj9iGjT2@k9(f5r;uq2wt&*L*XS#yeHXAawJ_+(N zf79?0Dm91+SARs4*ob>S#5}ME=33th(Z`bqhlE&miiW^;;r{9<1dV!H^AwhaqSAON zybbFU#=h_?Pd~{Lk1HJl<1(sU@>*Bu6qC&vB!hK)8PnZr7WM!#*d7|l2nN~FFv5>M zUjA@*^hm4h+=*5Sh4L!XVEL!)< z_+0o#o6I}yelULFH3pT%d}G_D^SX1WCrOlj*lgp}0~wCx4tAT&_878Mb2=G}AlQ2k zgf@e1=XHaCRE8e~Z>_K$CTEgOn{19DMPr~lk_s^#>C(+0y9VM5TLnaK#8Cxk$n>)0 z$wKs_aLh>+o@3}BU1GBDTq^a=O~cmm_17pf_#UWx^HIopgE%C1nNYm~%(L!M%B!H@ zYPd?{WvaEHFl7x`AgggsfEE=H5^%e=-EdpyQ1Fxbs!;|@+OA3qh>$yY8XSdCwB*tg zzpZrWZjmjAJtq7iz6bKDN1l;ve&NzO@zSm*=J#SW+);Qhr5?vjR#fr#=2^UG*%{T zgOhyu4z);ecWP4h6|rX8^YY^Mm`0kt%hQo2dzb(9fuR16q7n};4QD&(x5?x{)7cbb z=Sl5(hHgaEy9&wi!LHv#n{Tr?*q*qBcq|L)C_hsQYcm}MzdwEf5N3-j|OYhd@1|PS!W|n%M*}R4^Ez!3W(W;ZN_+&sWhEK*9>-G9wXb*uV z1I>gtD@uToX8OdGc_8_^uI}SpS^-cZd_(P@-gSbdMJ~ace83Rir~JPEY71AdNcPo@A|`8@lV-ST zDr)&655jeF*+SNlsB0UU6BeBQz>C7M=)SZzy(k`&NH@;XOkhNB=?qAniA;Py2<*1X)u`a%INP#-g_=u2kd1}&iE>}Hj& zO0(q)QYK-8)b@=#%R|}WlIIcX6bR;T2-Dj4oWR+k!6FRy8|3kYD~rDyD;S@Bp?|nm z_3JC4YpjQ0p%G*`7&}paZEs9{bg${B_^l01F1axWZ(Prob8nzbmW$LnpIwh%9EMpB z{~h@#@Ig=Omrx}hrN@B0bB*x9JPkdX7HoR4tss?TgCW6?dPNFXfuo{Y{}yG6k#f56 zY1l3HusrjNCaPTapx`U3#PZKfAZmFf0%++nX^#vju5%xWWWcB4JZQ?=m>=tvUW2J{ z$rZ-XQ!|dJE9QAtuS1FuN#o9og01&YFu80O2YBI{vcEayCVcH&h9ce9F%**KDjyqw zTKy3ulu7i*%YD%^co%^)T#-uGMz3yg~QI_MzQ{ zicD*1uEyNA$x;JJrcBmB3P5&XN+0!}R-6sPc>F{i+1%@>n5mnc&Fy7BKijjLOZ-T=S0@tu49tLR|KKR=z;i9x ztrb&6FD%4HUYe#iG4AqLwr7gW_+3Wbpl@R*VS1yI)85=yFWtfM`G9Zv_n-a4ls}v3 z=Qo}l^nZ5b{eF%H{De~3-Od;wuWxD$kTEtg*B7*PBhq@>BgD$UNW{j$r~?O3v~>c0 zP)S4&EahNq<3#lIwp0|ki@2y8^&!PZd8*hvcj{GgNwpls~s1gs}&3oOj= zvo!ESOn?wD4y^A;^t2sN5e}FHB=(uI{}pmX+?>Reo=3v){CMy;flqs+o~ikZz~|48 z{!Ss|6Gxs%{eRCe#{Yt0&%5jYg`WQvjy(&I@#*pEzww9h-zCWS+h6>D&mX2IFZAE( z`6I($h+=y3OaFJ|#q@_4f8pnOL&4wW#q@h~-v0uB{_x^&^!$7M zig3^4Q-sqY0`kBasD;@7u5JGG^{Xo(eJ6b@Thrft{!(u;#!mW1z#JmxKMeh?uAWN# z0+%8K102IMA_0mVaL*+HifnMt{QjGQ``asuXMOue7r_CP1c*%ZtsH@$s{d~OZ*xfz z_(>$gzc=>O%m1kRXO;3ltMNC2|Fa=JPs{&NAI}r#e^%pvJo0Do{g3*17Ur)Sg8Gie zPdX4FFRLJ>DoU+vZf)#HD`;zF^laONjU5dg%K; zy2!0YG#-zk69{uz4Cg`+281MbIXWo3K5{|>VPhsegp{(Ld9Ke6;F_Ed_4nfYf) zHg>qDQa|gnu(1A18&5qvwe_3&pJM=00_^XZ9$`nV+-!S3STJfPOaul)H_9jidRWxUjj2i80Wj z0(wwdK-ESMFfj+tbtZtdxs9`<&R@;{4fKBisUjk)Au0O{kczg}`ZoVSOUp_)CLd}K+gX`<1cjng}2|hdM*J(Av+Kc zPhsHo3nf1h^jD21-2SBdiQ3=wfpow<#hLF8s>*GrDIU z0I7J&|6S{eqTk`CmjCeWzeUymFSul7{uf+6+rIx6mwz)P|F^hg;sDq?+X9bOF*h}H zg5zNQ8M87rar!?&_HWkX4`elgr<({!{DQ0m(BhgK{yS!Wj^>%v|DzIRVE-2-`iJ#@ z3E?^P6Ab^g8u*p>v&Jux{Z^DuYoFiB@2|Fh<^C%BB>Mm62Q2Y-U_6C?0_1n<@2T(% zx4&TY3^yQnpVZ&qzy_@QHDeItT_-&;^e=<;%z0UTYv9W7zcg)vz-1tC z6-diS&q~ArTz#-|FzY;>s{=d^h#3wb;Ar@?4g@9w7j^n};>J(l_!)ib;wkT`CLG|W zm<4Q1t$@o%psV9#Y^@4h5wgPpWXv5MftvN%7Cu=yU_(G#30y)_0t5hp03m=dKm;HP z5Cezv3vdQF+ZY);I2zhI7z11Yt^hZHJHW%(!S?mDIGzqcdeT-vTq*vg z{h#B%1o`uTqrabT1mx-8ZIaNR1Ci)CSb2H>9DS6j?yjsf*TTmT=SY)8^>tF-Iz)X^Fu)l!igV z?W$UnIk(LX`;iE5H_AsE{Dt*TVHApHB!n{ftK43T0(wUkgAX2pC;ZrHbJjW2!y0jn^3>Nx@d4w@di;7twmIBJ?y1qvi)n@B1l#ex zabhl&e&;kW4|bKOb}Loime4lp5`cyz_sw(mb|KJ|@BH=muJNx~tz56oKd)^i#%IPK zUw7=>CQis<)7|BtgzP4N7_X*Yc!MdY!9=DX?j3G9lv>hV;-@qo0g(qY$unu{UE8_A zgc^lkea+nXsS9u6n}JYlvj@xET@XfcOqXYb>gwKl;3<#agdJ0Kbp!Ho%j%)dqSbTx80*7jA%173K4QlK?KSm zUId5a_&&qR=|i8%k#SDo!_9qVQ#*e|YKk;hm}VcK!Bv*dK6OM#bqLq{mtM2gAB_ejP~@bS(KGxW{SrQ92+k+Ty#b{esqz-CAD4q$}i)H%0hv2;|;}wWZ>>+kpt&u+wFMK z`@OtXs__b%mi|sU+>0J(Ek_|0wGzT>)$Qh3*vz)G>Qp{PJj`m)Ry1_6#KA?k00e8X zR#|c+3cZnQ?E7B+EoW?KwDBwj3FzK?MN_Lek3PsWbU#jV02}yrZbsaXA+ND~m44)a zfRndv$RV5JDFLQJ=o5{yV2>0Is#x~yftD+qSk7s1b27XxVyW%ySoR6;1b+jf`s7i?(QzZJwR~zJLg0& zeY)Ock=}z6qoj(E&5i!ib@syhPEhUC(J`Toy2uUV zJ1KXkoZETIY=6b+Zv89tPUqD&viC&Ksmn?(8=A#u(7g}lDdZ|eNrgmaKW^7)8tx$9 z(8!y!=BUMCWK@)_hW59*?V0+R+D6Dqtf*xv~b0cxd8;Y_{7uoJUL^5yi{Z9)t+#t5i__0Zo`>F=HM=o&rv zuTgwBIDJ;XU531RI37M>>64@m3EZ#>`I}GPmKVOfiGzvkKnwY6zJGzBG@nF(fj-)4 zRh@Sq#Ui-ZdICH%b+v+{@agRLEPtvJqhGofGZ~5jmlDHm z;idq87z)xnzh@cNQp2qbHxFcK2F5ce7^jH97 zt3hs*dqgP8Lp~qRY#h6yn;EzOKWskBP6y4lpz}sfX}d(`o?i9Q@W}fY>R`P>O1Ukg zP5R-lthzU7uGPc7Us7#e!ZTlomhN$C5zFUrV29r2OxXe49JKLx{F9*;uRMsumH9@9uR7Zi3ri(^F2!KjBe zz+x{j?6NwmYN~fST_y=QHB^Q_1bPA>|s0DmE z9~QV^=4SLOa0d96tk<`HZp(@4+h^34H{^;LV;rbrk1AlzE?M!Dq4TxuNG+2r3m9Ld z7K|LuO%;xDpbea2!8SWu4mob~I?ivC?|II}a-H(}^l>|Gk+G2hl*E=c<)4Gp(@v z{A7wnQ71bTVP!Sa;wvg5EvT7C0+T%`E;2k#^~001hEg+MDZ_jUOI1{adXd8t#cm`H zVOjgpD}*+g$=Xx2{VQ7m(_k`vnTmFjL~I?laNx)4?%o{KwNrP)FTJwf8iG4Q>qGEv z3i@&8F$Q8eYO^_={Aj*XKA;Z)n*|h?uo4Ttu@Bmezq4V{$I*A_YhNd2 zi20?=5}*VzLB-&C#Mq%Kf}CeR;X2-vom)dqB5ruopLIG(swbvUY(^l3vGtsfxxW`u z>nS>RO6j*lf5{dv&U?6p?kR94p3nPAas>f-H9D(JGgh)>6PGGIUQ`lnDev4TrL0^e z*bbA@vQnOo-5)(3vyl*M$j7d%;$B=+)7$etXS8|vp&4~ShOZIR!^XwKN)Ey(8SnmG zF+ZoH?ULQ>$p|R~D)gs}*tw!R!hM;@>zjGogXEnfXY(CRjjJ>7RPVQ!7 zkcFH{2ivN!w^1RC)^CBq1+DOnq4ckX4GZ7{O4v}*uxwWf zroXwKaA@)do~QYw2287AC$I*7X2GzPT{jC?LUUC@_z zA^bj2K6$edwaj0UCa$Y6nV{ia3iwv`S68xOcG~g2SF$&bIJM^9o z&~YI5Sbw||J$8t{QpZifTR0Ww6zL)gpV~CJwBK?(!S5PkWR;?po=&c2GH_ro6qQkg zOwqK8an0quivKkPW4HuB_jp~}W2^J-4&@`VeBP(CTLn$cU6#{!qo=^7V~8&@GopDphDMs%-!>No5xV7ylwg#jqKazcJuzpPTEc9GGNYAIw%7Qd$fEdova6P)5-I6 z`Q4FqWvNjNo^qD=b5qAt=58a*bcJ8zAQ(i>i9=2Gex}!)_yGN+zXv6kvwbdR%Oxlz zZ=$*x;q|t~!y5}ha-zDLnpcQ$-*e-v;f+Q-B&g+(oW>vljB7P@A=P+AfA@`6bF_thw9Yd-@#$61X6yCg!@NjxE=5(BP)tP{gt&WQ255|^ z^Icy9Ma}SWB{elm23Ml}*7K?qx3U5hCel(($A=Rc(o>ZwnZF#LLl z3S8b$&|L^yysAy{%1%t^@$nWu5k&f;#H9=If_*!_x(-5`b1XbQds?(QY;ACDcanDG zJkajN`NF>1F(Ka&IF7j(K74UGa53}gBQ>6*r?jrtI_rZgkCJ^jsBO81lE}=t`>wwA zkzscu1{H*vuAe^RcPcP2%o4W~%uko;(^Ho%LQLx9ZT z;TKfoVDHagbGKOf>?>&eZeU?sdyq>jpkMzLzYSlV3c94S${U%6k z!?{MO7WicRbf!Ad0hA{Q?U!6M%4(gGLyIT=X&!vQd*M2Prt)U@72Y*A=|PU`n}~L# z+(!>>vr6Fd3D#f2Iota=E4MoHygtS%ZaD`SsP^sCgdYCL6DfU$z?vlMYC>k@WfK81 zIU^CxwSrfEWkGz5ts(4ffN&wL(M!?Nnu?Gt6%?Bl!T0go!Q8U*Og16R8ovCuPq;vV zymK4*$tle{)~oKgJ;aUo9zV86h7jG{+h|FsjUMt1p5c3xr-&D8oUKFIZpB~e{4ERa zTt{`Wf+W?QJA^NZ!6eUOZ3#Hu>Ch3}v?MLH2M|G>a_xOQs)k%B?0PQk$$^2a(R5kV z`gnHJdl!3`w>lPE&QH3}Vi)}u@wuUI17BS_wjh_QT<~iJQCeHPBiGrNjWcL1tW+F~ zPU)}E3txz^h`VUzjDllNPnNezNX`$E< zvexg+pUzJ-49uE$cyT~%Kx^D6ylySMY;ha5Usp0RJt{@f)B|?!&sRjDJHx6t%wxv* znN_ln36AJ3O-i3^(NcQc*i^M2BeP2Kn_A`+4ef<~%0#YFjZW>8nMUkQdp1uGdqobh zSd_YCmRUBa5aZ02+DOSsO-f8qPtT9^M=K`lID2#`lG=_jB;1*~m6n@?#ZfUQ7@w|e z3k@6OwO7fTj$n`#okVSmj=h?g)_tXFuc&UxFHoHETCqB_q+xiU78u<;!eQG2Kr&@^ zM6f(Nla(E`j{3kAs^Ph!pueQAM{T99eT`Q$LBeKBW3+;ev)Y=-3MEZSM0OmX%5}FC zec&F0=6+?zx7XWBVqc?iT?rI!dq^f+%T%}I>y5fckwE zbs6I+%Ekbg^L06M9s*-mzpO6`qQb^e@p7aQXz4 z50fN8d-4wym)__sB#l+%ujyOy;Zbz2W1aCNB>T8#MjI%f=c^DgH$c#?@)lo|irzCT zNPN?V7WVM5^OAeLI6MOCv2E@KI-vG{H1o>2g=?CM_Z8WhO*f%kw<#ULN;el3Hr3Cl>IGq{ zt9pGlNh}(-H!Imk2HkJtoh83_Y!&PZie${193~1;g^p)Gg0Gc<_npt;(0h8`7|u9U z?)3ZigmxW+I~o=KL0r^yV0eMqHZaC|z2YJtbgsxIs&t}iL;)LC6<>nG%fr?NGkhpA zjm2(xNdhjxf0EAeJ`mjOd&>46a0L(HnwU0^+fRd9S2O4}y9T_0@t;DP@kA1Wn)QCQ z?!tg3*bbx8peA%^-xAF(d;?EG62fQSX6D1H3eh-xe-ktXw~5*o_;%~#TWQERc%i-A z|6+kt%g^HCrzQ3ChlJx&cwxFqUti&fF_Lb~3%Xi&FoEIzY?fbN8)A4Jb+w6VsW^!C z_U1du`@Q;ZBcUKjZ~E*TxF;(2qDrK`?~CuYen39~?$1I^GMEi#di{uWecXD@H9mjV zE0IKT?_J~f0dH$8iom-kh4#IJ-&z$Ob6O_co%xj##21AakK{~NUDzu?Bd!98@GK-31f zHI5Uwm4=Oj<3Hd%96;da4|vb7%YWlN0N~Ys!FxFWmw1o(U$CBENRJwW`u~5N=NB&Z ze+=_D{u|@@4H*3m4f;1k`aAGrYHRsB=Hv|gfegFffgl@0XN!NsK^9J?Kv?L%fv9d(MS71YD~#Fay4t)`k48$d9FZVQPF)t zP{n;uL?RN>024AI($B#lFxNamg!xJb)mkSu+ND`B*^l@qr5BnRwTJHQ+;yAt7haop zi|*Y>@$Cz>x4zj=%@Q2gYfK5wWhBRCV&+;xhun-SgyeUE2>xo(S#)Flr6&fq@( z!Y+9>I!{0AK`3eAdIEgS4q|W9zOs31KCRaC?~o_#21`PxgbmQw0~`H_hLHe*Q{FL* z>)wsQ=V}leD)cZ&L+&c1Y6BaJ23)vqo~jQTl>6ZoeQt*3RqIPuHb@N^Pw?826}@d$ zFH2shAPt}yq2q%RHcSm5)_uhW%GKilhQo8)WPX=h z*}J$-E{mPj;rPY!Dcl zr=OQ$YFn4FZ?`hRoo}2&4%V`-NAR58-S3?Fw_nq1Gn_NHlgf8HwtJc*_qlR?2Q*k5 zx^jJw@t}-pyCx84M@Nk=Nbp<}5`qf8f1mL=+!}UT?Rl1YbMmyc%MrIIVBP$ZGeS?QUw!V63!Y#4Tc!ull|i-DPf5Gg2oD{XA8X}1A!>=@noSVk!T?_ej_r`yEIYf^x)>c$V<4@SW?)#vwdD7 zv=#xuOj?D$4=7?jr3>&w#Y&3M1eP$-jWQ@YA`_U}FfFBvi0VUL2&$F*0l}@S*CPP; z+maF5MLUwgc9?Ota2I1_pW02-*sk^C^O$dJgOZH!?>_m!j7vtBCQnj}eVsRToiALi z{K?wz4b?es^jO*g2dVx$BgD&)FHA_HF7eFSL;u*o(2H|`-|Y|MG??Z%$d8~{#Pqh` zd-*UZN$Xhq$&ywC=?2f#hvqinwU{w%5V=}pgl8n<*cGkQF~|A4uX0iqspsG|o_rN;un~}D!$gAp*g+IR0rESwcsq)1*s`Q`r#$P!*P{vx zrb#+zS=i-<>neG5xJj55yW>{70sBfST&C0y&Ias=l9$CVE1xn_TKymxy5)yseI_qn zQ2;GdtNtSOV9((_DwpOD?h-|-Dx^1gc2(M=G87%1aTx4lA5S+s5eeaQsp3xfIdK!c zC0fuw4;H!rvgTW)#;uIzc!N9(WH{t}Mi8wfsCmVp++N-Trj1xmB3T*ev+ObPcS*Q9 z?CrA6iKv2WoO(9%8Oxv~jv;{YfD5t@tRY;`#L)0r8{U-i>*N48673z9B zQtLcQ)D&OhqFHvi`x>hixTzI}xlVym}BA)dLw2_q<7>`Kw1`!CqfP z+G;KlO0~c8hgXZn|Uzn5A$(8a!Q_+wFEWsvDD)rID&D_RXQRoAnHw8l)#&7(ORrs z+#29Mck!|B)jk!vXOj*ohgA`k%7t*s8vATH!eRpAR4czFx7lF4`RR(G-+f=j%wNRL zLr7}s+fw#oS{qN@NCeJkgzJrjj<+F%@_f`WPCculiV6{- z)Cx|{4MW0i)VOO{jm&r7TcMp}n<`*{nfoeYi9#4l z;gY%4OL52xaFo)eUkHgG60pHXY*}2_o?aTl!8EWXjF>ma)!nb%TZ0LUl67Jv{IMdr zYkqn!mer)=lT+9RvkqRqSDIZ{zznw2+L`KBuF}vkG>mBkRlnSwJ99`O>W#diW|9C7 z`ni1X)74$vr&`Qp>e0v%K`IQDwCF6anUFvck=PYV0xt|XVISNqrOGLcDSp^?DRqsn z3qdFbbt^5~HXb>%-mQI0`4n0GFW*yFZve#k!ivQpLWD|YLrUreE)!mz~j|NxBH>Wf_pa3FT$p8G0I~wZJDj3f3>rY06ZtkPutVlY7d(&kTK? zs3uJ(CF=r_L6;^Ow}G9QlrW2&DUI^Ch6tI7;2R2h+fvDz!oj^kc5!Um!|5S9Wbv`EDC|b~X zw_KW)+<+8k)#_1>o&4z<@x8@Ez}j##7+Ok<0rdsswKFY&Q`{w>k{je#FW5tC@xA^*7}B>LrWfr=)Zd1=xRFT|UGjYfO5R6Cp|w_TZ} zSz2!s!_(MM5{HWwd!2XV#1}u(G`d+d7r`BM+G@nQqic?`!F0u9jc=xlCi!H zpjdmdzQK5(nAhcMlq!QlV(e1GexFC>S{IXTpSX8I+kfr~9v$Q}Eq96AnR`}%VQ=K@F*#$AwG4ovT`~#NQk>wR<$P9#7 zwObAaAbe*F4_|JXYVf3YoYX7%^Kx!UiS77VpQ8)@AM4k=;nS;|FQSbGvBpm zq3n>dLL(=yE%RQdR?O(jXPvVYI;E@Av3|y;&IvU|;2mQnY=aLa>FEpaG+w)R9My~z zjNFrH7VlCUB5bj#tXea8WNQ(iB%-1YBO%H!Be2DVy_i6nWS^E>ob9kKtYm1>CosSA zzR3GCy(=wS9IM{U^n~qKTxmkwQ{+O2Mc&#(PdDXCcTGk)b|>wLmXndPltGUyn|~uM zC4->F=kKQ;G^BD3WyR+KT^pYeJ##ZMuP)T_aSt3g*ZO(~??T=#2*=v^Nze!WpxQao zIVG}aG@>aiv={prJQ<;#7zkUaeXx5hTXT~Y7s8J@{Z3FNGIs;RgrB$12Efkg#!ZhZ zN?AgQMnRjgO|i!Z{^XiPGfyT4#p;O*KY0acB3MnU3jVNod00tlds(TfmiLN>@*)ydO9cvN`(X<_w=MUAk+b8?Z+ykOM^epY zgSu2p=PjfDDttN(=OKl$839EX{#dvv0I!9W*puKA6nT6Y!}%kc?Xfj!TLi{hBKwy{ zGFQA(M2PM!2RoIu?I9JUsyLCh))T@XcTg!rZh@iry-3UZgLv!e-Kq*HM!MXBJGygk zM@BAFuEv^N^AGLhcm7h?zga@S=UGv!xztNcj$uUp6N9-Vv^ znFI!!-~;m3z6CoIRg8kB!?qQ*)_`BnemY7^tFAU|2Hk>&E|0K8z>awPAVBW1esk4F zRpY+pGVUqxY8Z&#&|M%KzaTT8e3iUZj7zqCW`up zrLC3XJr)&e%bcBVI~Hu5?KbPsP2FR>s4(1WwUptE+@Q!yFW#sNRu(||c~_fww5$wu z_DnNVvtRX{dM2%&AQ4{LRu#DV*Hi z754{OFl{N`Ga%u!XJT&utW#?Uz;`%vc)K;~qu;(iVUiMrbf|M@OK*udwZc1m=hLt- za7(UD!2zDGTED}FLN#zu!;Kc3WDfeE+)BDXweUTxe&CB|Rm0o@`xtxI!Re@MmT(0^ zPa$kJ?*i_-n79tAYVlj~jpt8yp*&-pgH7zPNK;u!=EhGcWl`ys5|~nL;XIAgPZk5+ zBs?B*3P;98N07drYbq3y7}li!gu&%Vp%T`8zo)+{b0fp$DC z#h)B@ZW=j}PY1r%0&`76Jhyti*BU9&c#%80MD1o}W+vq%tEMb1E9>lRCdk|Oqz?VOFjT!H+B^^{0UeTukv#?ApAf?o!`c z0pWWa?3+*Y8}6~OxaG0bNtiW)T+QtFLoxGDlf78oZ8B|;{WVq&>b zLE=fy&FW8aBgOOcJe+BF;s7;PIxlyo1s$?^{PLexhEW4k<@BtDJheWt^D@aq5zmdH z!dnz(34YFMuhuZibCgV*K)x|hr28reUxTRLL-+MZc@v7Q;rw>}XGL8Y7(7qAHt5B# zqbZf{@gu|h{XU<9ewl})9K^_`ZOI6NbILbP;qm&Fidlw~A zyze%_!T%;-N5C7I+zTS-Op*zyi%nx!VoCCzh}?^HUx*O&;Q^&OI6KbVp#(uB@4ShH zb5p!e)=6!%jBcI_YD`Iz(vK%&3Igqe=g?4iKGUmlq9!lYh)q+9o?3D9R^}|MtDxsJ z6HQ2|dE|m;k5vRX)y^<}C zzJ%O?W##q32}=%WC{y-t(@1Iwh&6()Z&Y%WkYtdmMz(B$2pW6m)yx?0uN_ka< z_L-mI&Pb<#9~!(g9^q*SDp&}EFf0L*L%&Yr)nj@_Asu5xoGf@no%pt3_-Yg1uW)-4 zC(|&GoN6TNUA@3hLS}bDCr0g6-rN({>sw zKZ#9%&4q6i6;qYL(gdV6?C+78M;?(`fjX+0j-Kfuz6^3_rfCV<23ilYSKHh(TQI8$ zlRvNV8PUJAjcLkYy(q$^McET3z#J%VpBCQS1n)lH>@S40Brnv3kn#!9zkTQSDwv78 z!_4b?4{+B!i zO%j-7*oop3D&5jMX1ig0fBkNpli7iC*+s3Eb3LaKmu{T<0Z?9T%*M%$V2#nu)T*## z>+7?Tj`O@cIFLm3#;gXn0N*K+qmi%CCpX`UMq6f_-$I5WP8%L0A|9QJL{)}U5;4*R zsFvC0n7my%3?`Ao^+O04OmhfD@bh5~lFtk&OwCBi7fl))=G7YO3Kys4<#a!l>NA$8 zrH;HB>9nTYUxynUGMga*yUf3?w8?ujf0tDWk_o?cdYD4c9)l}a4r7zB@7Qr`6=l1k z);QRP&<2Gr#a4_jv7Uq3e*JlNLk>bw>D9)zLk(t*P&SQRRskCJlYkg3b@1&m^+#99 zI8oJ!1Q%*A0R~IbDA9SydQJqGwZ}dw%MXO*qqeLF#Li7|er=>1@p_5|TbXt>I8f2; zWXViZ0t*o|H6lWiQtudesYqy)%P4nQ-bXtij>f6SC6J)(4MjkbEw|NZ2ouXTp%9mG zeId@H`66ePU*Q;|k(gzdk~wkUPNTI8gjl-6WhRyJhmmOBO9^79*(S}YC1Rf@we7nF zb(_#Kf532Gt{b z5Nw}Cj9p}Y1;8T3Flm>%o~|AeecPZ(d9*wvmoG~5Z>VGW(rcfC%n+bg@$*X-Sl)6G z?Na4qC)}>uxGc&Fv;invg)Vmw)f|B`DViu4y%w*(bxY(&gbxb=9mxr~Fe;KK#%HB! zUw)Q0sLmlmu-h$rQPPoyX5EPq7)Xzzc}tV;1bFM|Bm z9{xH4`g}uF3*KBiYdE%Kik9#ibvTt6SqIp?u!fNhltHg_B!_>eV}2uqP>YdV-JZM8 z6%F8(1&iXA155pR?04Hai|9DPSR&MCn1iMMj@woD6!ZIZ*l|It4N{Dg-)4VHH23Pl zH9N=rLv}$5jC1DVPA{T=kcoo$oPxQot+;kFuU6iaMIuj<7C4JPtwM6@3J&+=9S0IJ zdsH(UxJx#@jUaiN z%rZ(0;b3?xwGpD_`4tlqu^;A(@*((mPfFT@cPdaTv$}=LZu!7ppQ9v;x*C^Jgl~w_ zcB(=mVI7*Vyq@pd?ub0be0~lWi24R-4(5BpIOap-iPuNW-VtQkx`RBdL+1R$NrXZZFILGyepIj6fq(7ks_^~6-7y11`DdHMsgbtu;7&Q^XHupoMU z*gQ!IVNxuSiO2of^i8?pxRX`OkCPg%#)+M0d)L?tvL z26^9QywaiKO>V{KS@$=SRaXID0A@9V7+Oa5fP6l~*+i-b7nF`u&|@OLj~w5|)zJDG zXA<=FQe>&{Hb)DqZ&*E&Tdr*IYGv$J@gm2Hb5JxIhf0@z=3CKwcV&zmMncz6m^&r? zTEq8xFgIH5r3d129g2wwm1Fr&#IWMCj-`Q^O`E~K_WLppjE*-ZVs#a znLNg_C=7Y@loltL{;b%eU*AKp89EaCq9~hMD z1z*tB7uSzK3F_(ik-%4Nw-ZP@4DxMClV{Eoazx`nbh+IkOB=C-lTV@9cZMS=zDVoq z_}!op2Ay1s(@1s+^1Sq&p_nMk4ikYTp=$QxQF1Ee@74hN)!BVRI&fY;QJjtWM}=I zF2)Wdbh2?U{}VoBX8Jc@jDz`4_#qqnAMwNg&KCo){wMrU;~%s$78YQHf04(25y!-U zq_JOQF=ZfdX!I}o*DvDNpD13x2wuOaT@JrvcK;x1xiYx@iH`M)mHbCK)*pl%{`Yh& zW)@baKjLoczvx&Ud_?4&a&_@IvSsX0`tw@m+T{xyYKoZ(SZKl2)J#Z{0$`vhOq0tn z!4Sls1;9o~3&0SeIRq^$=1zjAZuQFfLRVLxRvxW@yI)*4xvT9f+&4Szvs@QetPe7? zHZNZ~F1T52q(H<9rp?66p_Tha-S_c6n23;fp2N)kv{gEVel49ATxe&U>IhZQH?GoP5sDs19zTvWj^8T*#ZL#8w_w>!3C&chtWLeuu z$hk56+HF@lhMb%%^ovMgk@+bqG&?QQKovACinhO~AzZc361N5mdQf}h*`QJN_!2rT z+G<2aUjq;|!&{Q0h1U)`>+Y#;)*uw?eU+F;$Ou$5V6bqkBLGtZ3pp~p;Z|mo!!jiW z*fGzh%4^_gB3-t7OsZ_mb;{4meB@l`e6eR1GoMK1^xFs1K#@pi@uAX-=fs3)9i-iy zFm#WDaiFF!YgHlxZxTD8bWdJTb3qYijO(^*c#=9P+c+NKjBB%Y=kW3aeWRgdTD~p6 zincc4!LpuGDusd+u%Fh3=iv6C^6JJkzU{snIhk0;^EI|H#KTQXaDKDvrjxZUCxk8x&9O^G6OCLd~SqPC_d<{@4g zlVCg!PNvhISA%jZl$k;~@Z`!Ix|f8)J#!;-k6^i=)ERxgeMu_GFb;{~`HDO!1$*y> zF?C*dGHMxe-p`cHUx>r-L-2@fvc5C#J;K-?3%3uCd|Av8>t<%eR1RQV%Mqe`SkT0N z7(jhwy~2}gub((p1;Ik1oJEccY4Ws&WBYKSMi5VfO4|gFUt!iSo#m>U{j~AaCn*|T zjlbo9tOLp)XiXk-^C<*x?2$3T;&s@nF&U(b2CypQ4ToAWWG=v-)X;p3xdhh`xj=r( ziS4L>33quKc-(S}$kA#VWzojD#&3|%Bo9fqn}Ck}@P6jV;dYmH!qq1Ueb?WpKqDn` z!{fsQUBt}MU1_Puh=v38{m;4kdICG7ZV(Vh+;8Gz`crItT>ZhV#GF9XF2;@#;vHJW z&g;#9?v}AXSPb#w?O7Z$POv@rvqD~Z-pu(=Z$XH7o-HyAFH490Q)!2SF9$syPxS-J z_*)=FVy!DwuGnoL_Ku5n4QP)w*G>`6G05RCl8QB?p4fLxXz4Z?AF!{@$mB=LXz1#> zK=ss1>Epo(SLJL34zL193n$+4qS=NsGABJvKLhL!V^0FYMrhP2UU@5_vwSO)M@G-h zM3c~(1>h(f@!T`-!6KS<_qn9;IKXj}oq$x3yxb`oW}2U1u>l_ms3T58)iY=h<;^xI z6H`3PN4!9geAn`piooARrdL_`FX#VEYgUPewU3L{QPV#}2&`+xIG;4s=H4cj1NF+; zHcS2}C9T^9X%(esMGMjLXq8}o9u!A&2i%l4fP_lrQ=^;d@CN3NOeO_h*rl*gcbrd8_J!%QfQQsP zlAm=^x33fG0g2fxTseXQM&+1J{$d8L7BBz9EU%+xx=w{0l1dlYm>Q~YY%?Tl8Y_B% z6J^&~|+>{g$v^?K!Qo>1Q~+|b!+dP<%A z&99 zZnlluUg3h{*~AD@TL8bP#O6(|IWV6ot9nfJoxmC1jg4zG+kR;_idQN=bukp?uG%0aj7#Hg2veZZf?tOvMBfJJ;HTjPkh8Uv z=NzA|K45}tdK2|Txchr&wreYp*dCRazYOM3u|?8e#hz?c?27Q-XYaz?@9pAKg+ZFi{$!mDeRWKWh@%$Y3){_bAokLA+ZH)>x z!j|PvQ$%})wK*tu6tWL$85KI}JqU|wGG#$4^l=OU#BBIlF+EdH+VT{>o+maq-q!%4 zhpDfS%^a-?E;`F|KKZvtm;^o$7Y-}qu122`7y9!oSA`vJA8;K*R9M*QI*)qlzvWEm zQnZ9J)ZM1)L8;1jEX$KLZ%!L_?cz>^E!%-T2pFp!U5$CwP6(~*uv{di8Jg^^V<2`H zIe@RhZ??J`7z{2fiJ-k7AqYmED86RwGdLKq6bTu}#w8~qIM5N^f6dByCw@w#q>Ms} zwg(rX`;&yu?*flxB07iPCobQcNoigZg->f#xTHfkltIrapCsWL3B=o8>>}%eD_aML zJYBoRx&>5Ezep8(>|H^~6xEoQ6?EVH6{_sU%0LIn*|r4?tXSk!nW=hyPOPpS*4tX8 z%G{JbsrfvVDu3X|k~jv^1i~!TcI}EJFr5lleD|Ed*_Cay{8yZdb!)~9SU$BRGw9iE zr3Ka6UIWk1uQQGpfN1Fx@U^Z>CIRVVZ(sGRv7RFOe0S)%WR=74(~;*1z5d zWv6LK+!-fV(A=TB79?*D7`+udD(4eJK&2-X#K_dO>eTDM#(3g+2=!Vi6|ZtgMDz<{ znMjrhIEC)ID{|ATXi(+U4lh<}>btw*^B6k$z~&u+o;z>BtJShS(hx4t5qoh?teP=ny=B=gVH z?>+|eXcCAjGM0C1*;gnA7~y|b)}gFPjdlv^i|uKy9HFXRL{L|0aQE{)I?2#?Q824i zDrHPZ6T?D|jz@!{G*!G>N*d&;DGrDk5GSeJD~o;JkUk+O=+zn8-8DO|x2jjs`nmw3 zQ|`(^BefQT-J@q*53u<<=rCrYt)XEd#ikgiQ=OPW*}RZm_}CLzkK-jXB}P655_ELov&_o`^bT zJVJ&o%%=ci8r~OPJ2*;~=GMK|DBRGFqfCdrEV>k(EhL|(twrZ-^@yl~4-Ru*d|2|? z^`qTe&=qrolWzbWcz9{4!(1zM8``Wo4h{=OVf3SNVu3NQ7jzo?m3*a_*jL}OQm~i% zpBv2jS(b`nKF=*W=Eb&9=L}&f3(Rt%pDq#Pmb@z1a(XKAPMc~AXY_!edg7schQkHg0+m_*hvgTPK^)ApGz`t*Hoe za@M5kH!T=3qr5Bw#7wJqBj>p|Rb2|!Rke<(xCPgOi_}`j5pdfk)&|A`!E~!r{RnA( zY_XwDF)F%#nA^$nq+sf4JQsmezX~;s7)CFM$6S2u1gBR>*Oap~D~*|vDe?efhN6O` zeg%rfVZDQ?7~3D`zpOGK@IIefad*++VW$a&6_e#X1gn`O(jad6;#OQCB5oXaayop& z+WO{%&_8A+42t}z@Yo~)t%M2}rrZR<=V0YrcYhTxO5k1r@<;*pND%z99Nj@x=f?*U z@y{P+2)WW$*SxMoMoZV;5p};_`*n3XLhP*3Zo@c6`n9s&75eAug-$P8R)KSIQf5$X zj{9?t2^>F_l!U<3g&rl1JzAp9p6D{087%pMhj(F}{{7+iH+8o^Zk_$7?%ThmH8f;p z{;8`00I;+E>p_l(-vjv22-F-QG%_`}wBx0?XzipRv^3$RP-m58lywj`wXl@%axzu+ zl2bAEvNq;4q2T9(<>5C3ie8%1c^Ep-nOWKZ^-G)yfubqA#KKB4V#L1;Jh(h;9c+Q} zbA-Sh)OOBX9=sI4xo`o`e-$%O5dLQ3V$DmTA*(>>VsCF_ZRtYDM9)bNpaU?|5}G*y zrCr?ZovaA~^lTKsDxFNsxRij>oWEBHyyB&>aB*?qVqkE0cc*t}rnh%8X8>?=axyS7 zF)%UF0WIj9J?&f!J?QM5Nr3TwYlx-BzufGc>3?ezJy2DJ!BT?(K+nkV&p`i_nE~pc z5dI2mXk_o|!b?p2k6Il55dBZp06zfM!wl>m@Qe#6DQe6ah+|@-Zi@Fyh7Pi_|L@(mwf&V)zwEd~?2TP*f$}|)BD@r?u9hZT z%$!DyMoi3{bY`YzoOA#H@E;@apyMz!W8-88FqyF!{;%i3#Q0zBaBy|9`7Py4j2TRA zOn-%R22KS4*bozAE;D;4TSFIM(mOZ+MWPIU)6)TF1O*=t@Ix0%pu`W~ZwW1EtkdF zumInK{wW3{3mYeph4QB|V10k@FDujE+swlLOK|N^zKpD_9DlEmZ <= >=\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] equals, does not equal, is less than, is greater than, is less than or equal to, or is greater than or equal to \fIvalue\fR, respectively\[char46] +.IP +Consider \fIcolumn\fR[\fB:\fR\fIkey\fR] and \fIvalue\fR as sets of elements\[char46] Identical sets are considered equal\[char46] Otherwise, if the sets have different numbers of elements, then the set with more elements is considered to be larger\[char46] Otherwise, consider a element from each set pairwise, in increasing order within each set\[char46] The first pair that differs determines the result\[char46] (For a column that contains key-value pairs, first all the keys are compared, and values are considered only if the two sets contain identical keys\[char46]) +.TP +\fB{=} {!=}\fR +Test for set equality or inequality, respectively\[char46] +.TP +\fB{<=}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<=}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 or both\[char46] +.TP +\fB{<}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a proper subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 but not both\[char46] +.TP +\fB{>=} {>}\fR +Same as \fB{<=}\fR and \fB{<}\fR, respectively, except that the relationship is reversed\[char46] For example, \fBflood\-vlans{>=}1,2\fR selects records in which the \fBflood\-vlans\fR column contains both 1 and 2\[char46] +.RE +.IP +The following operators are available only in Open vSwitch 2\[char46]16 and later: +.RS +.TP +\fB{in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is also in \fIvalue\fR\[char46] (This is the same as \fB{<=}\fR\[char46]) +.TP +\fB{not\-in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is not in \fIvalue\fR\[char46] +.RE +.IP +For arithmetic operators (\fB= != < > <= >=\fR), when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the record is always omitted from the results\[char46] Thus, the condition \fBother\-config:mtu!=1500\fR matches records that have a \fBmtu\fR key whose value is not 1500, but not those that lack an \fBmtu\fR key\[char46] +.IP +For the set operators, when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the comparison is done against an empty set\[char46] Thus, the condition \fBother\-config:mtu{!=}1500\fR matches records that have a \fBmtu\fR key whose value is not 1500 and those that lack an \fBmtu\fR key\[char46] +.IP +Don\(cqt forget to escape \fB<\fR or \fB>\fR from interpretation by the shell\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise all columns are listed, in alphabetical order by column name\[char46] +.IP +The UUIDs shown for rows created in the same \fBovs\-vsctl\fR invocation will be wrong\[char46] +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-id=@\fR\fIname\fR] \fBget\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]]\[char46]\[char46]\[char46] +Prints the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in the column is printed, instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist or \fIkey\fR is specified, if \fIkey\fR does not exist in \fIrecord\fR\[char46] With \fB\-\-if\-exists\fR, a missing \fIrecord\fR yields no output and a missing \fIkey\fR prints a blank line\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for \fIrecord\fR may be referred to by that name later in the same \fBovs\-vsctl\fR invocation in contexts where a UUID is expected\[char46] +.IP +Both \fB\-\-id\fR and the \fIcolumn\fR arguments are optional, but usually at least one or the other should be specified\[char46] If both are omitted, then \fBget\fR has no effect except to verify that \fIrecord\fR exists in \fItable\fR\[char46] +.IP +\fB\-\-id\fR and \fB\-\-if\-exists\fR cannot be used together\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBset\fR \fItable record column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Sets the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR to \fIvalue\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in that column is changed (or added, if none exists), instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBadd\fR \fItable record column\fR [\fIkey\fR\fB=\fR]\fIvalue\fR\[char46]\[char46]\[char46] +Adds the specified value or key-value pair to \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] If \fIcolumn\fR is a map, then \fIkey\fR is required, otherwise it is prohibited\[char46] If \fIkey\fR already exists in a map column, then the current \fIvalue\fR is not replaced (use the \fBset\fR command to replace an existing value)\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column value\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Removes the specified values or key-value pairs from \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] The first form applies to columns that are not maps: each specified \fIvalue\fR is removed from the column\[char46] The second and third forms apply to map columns: if only a \fIkey\fR is specified, then any key-value pair with the given \fIkey\fR is removed, regardless of its value; if a \fIvalue\fR is given then a pair is removed only if both key and value match\[char46] +.IP +It is not an error if the column does not contain the specified key or value or pair\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBclear\fR \fItable record column\fR\[char46]\[char46]\[char46] +Sets each \fIcolumn\fR in \fIrecord\fR in \fItable\fR to the empty set or empty map, as appropriate\[char46] This command applies only to columns that are allowed to be empty\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-id=(@\fR\fIname\fR|\fIuuid\fR)] \fBcreate\fR \fItable column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Creates a new record in \fItable\fR and sets the initial values of each \fIcolumn\fR\[char46] Columns not explicitly set will receive their default values\[char46] Outputs the UUID of the new row\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for the new row may be referred to by that name elsewhere in the same \fB\e*(PN\fR invocation in contexts where a UUID is expected\[char46] Such references may precede or follow the \fBcreate\fR command\[char46] +.IP +If a valid \fIuuid\fR is specified, then it is used as the UUID of the new row\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Records in the Open vSwitch database are significant only when they can be reached directly or indirectly from the \fBOpen_vSwitch\fR table\[char46] Except for records in the \fBQoS\fR or \fBQueue\fR tables, records that are not reachable from the \fBOpen_vSwitch\fR table are automatically deleted from the database\[char46] This deletion happens immediately, without waiting for additional \fBovs\-vsctl\fR commands or other database activity\[char46] Thus, a \fBcreate\fR command must generally be accompanied by additional commands \fIwithin the same\fR \fBovs\-vsctl\fR \fIinvocation\fR to add a chain of references to the newly created record from the top-level \fBOpen_vSwitch\fR record\[char46] The \fBEXAMPLES\fR section gives some examples that show how to do this\[char46] +.RE +.TP +[\fB\-\-if\-exists\fR] \fBdestroy\fR \fItable record\fR\[char46]\[char46]\[char46] +Deletes each specified \fIrecord\fR from \fItable\fR\[char46] Unless \fB\-\-if\-exists\fR is specified, each \fIrecord\fRs must exist\[char46] +.TP +\fB\-\-all destroy\fR \fItable\fR +Deletes all records from the \fItable\fR\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +The \fBdestroy\fR command is only useful for records in the \fBQoS\fR or \fBQueue\fR tables\[char46] Records in other tables are automatically deleted from the database when they become unreachable from the \fBOpen_vSwitch\fR table\[char46] This means that deleting the last reference to a record is sufficient for deleting the record itself\[char46] For records in these tables, \fBdestroy\fR is silently ignored\[char46] See the \fBEXAMPLES\fR section below for more information\[char46] +.RE +.TP +\fBwait\-until\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Waits until \fItable\fR contains a record named \fIrecord\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] This command supports the same operators and semantics described for the \fBfind\fR command above\[char46] +.IP +If no \fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR arguments are given, this command waits only until \fIrecord\fR exists\[char46] If more than one such argument is given, the command waits until all of them are satisfied\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Usually \fBwait\-until\fR should be placed at the beginning of a set of \fBovs\-vsctl\fR commands\[char46] For example, \fBwait\-until bridge br0 +\-\- get bridge br0 datapath_id\fR waits until a bridge named \fBbr0\fR is created, then prints its \fBdatapath_id\fR column, whereas \fBget bridge br0 datapath_id \-\- wait\-until bridge br0\fR will abort if no bridge named \fBbr0\fR exists when \fBovs\-vsctl\fR initially connects to the database\[char46] +.RE +.IP +Consider specifying \fB\-\-timeout=0\fR along with \fB\-\-wait\-until\fR, to prevent \fBovs\-vsctl\fR from terminating after waiting only at most 5 seconds\[char46] +.TP +\fBcomment\fR [\fIarg\fR]\[char46]\[char46]\[char46] +This command has no effect on behavior, but any database log record created by the command will include the command and its arguments\[char46] +.RE +.SH "REMOTE CONNECTIVITY COMMANDS" +.TP +\fBget\-connection\fR +Prints the configured connection(s)\[char46] +.TP +\fBdel\-connection\fR +Deletes the configured connection(s)\[char46] +.TP +[\fB\-\-inactivity\-probe=\fR\fImsecs\fR] \fBset\-connection\fR \fItarget\fR\[char46]\[char46]\[char46] +Sets the configured manager target or targets\[char46] Use \fB\-\-inactivity\-probe=\fR\fImsecs\fR to override the default idle connection inactivity probe time\[char46] Use 0 to disable inactivity probes\[char46] +.SH "SSL CONFIGURATION COMMANDS" +.TP +\fBget\-ssl\fR +Prints the SSL configuration\[char46] +.TP +\fBdel\-ssl\fR +Deletes the current SSL configuration\[char46] +.TP +[\fB\-\-bootstrap\fR] \fBset\-ssl\fR \fIprivate-key\fR \fIcertificate\fR \fIca-cert\fR [\fIssl-protocol-list\fR [\fIssl-cipher-list\fR]] +Sets the SSL configuration\[char46] +.SH "OPTIONS" +.TP +\fB\-\-db\fR \fIdatabase\fR +The OVSDB database remote to contact\[char46] If the \fBOVN_IC_NB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovn_ic_nb_db\[char46]sock\fR, but this default is unlikely to be useful outside of single-machine OVN test environments\[char46] +.TP +\fB\-\-leader\-only\fR +.TQ .5in +\fB\-\-no\-leader\-only\fR +By default, or with \fB\-\-leader\-only\fR, when the database server is a clustered database, \fBovn\-ic\-nbctl\fR will avoid servers other than the cluster leader\[char46] This ensures that any data that \fBovn\-ic\-nbctl\fR reads and reports is up-to-date\[char46] With \fB\-\-no\-leader\-only\fR, \fBovn\-ic\-nbctl\fR will use any server in the cluster, which means that for read-only transactions it can report and act on stale data (transactions that modify the database are always serialized even with \fB\-\-no\-leader\-only\fR)\[char46] Refer to \fBUnderstanding Cluster Consistency\fR in \fBovsdb\fR(7) for more information\[char46] +.SH "LOGGING OPTIONS" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SH "TABLE FORMATTING OPTIONS" +These options control the format of output from the \fBlist\fR and \fBfind\fR commands\[char46] +.RS +.TP +\fB\-f\fR \fIformat\fR +.TQ .5in +\fB\-\-format=\fR\fIformat\fR +Sets the type of table formatting\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBtable\fR +2-D text tables with aligned columns\[char46] +.TP +\fBlist\fR (default) +A list with one column per line and rows separated by a blank line\[char46] +.TP +\fBhtml\fR +HTML tables\[char46] +.TP +\fBcsv\fR +Comma-separated values as defined in RFC 4180\[char46] +.TP +\fBjson\fR +JSON format as defined in RFC 4627\[char46] The output is a sequence of JSON objects, each of which corresponds to one table\[char46] Each JSON object has the following members with the noted values: +.RS +.TP +\fBcaption\fR +The table\(cqs caption\[char46] This member is omitted if the table has no caption\[char46] +.TP +\fBheadings\fR +An array with one element per table column\[char46] Each array element is a string giving the corresponding column\(cqs heading\[char46] +.TP +\fBdata\fR +An array with one element per table row\[char46] Each element is also an array with one element per table column\[char46] The elements of this second-level array are the cells that constitute the table\[char46] Cells that represent OVSDB data or data types are expressed in the format described in the OVSDB specification; other cells are simply expressed as text strings\[char46] +.RE +.RE +.TP +\fB\-d\fR \fIformat\fR +.TQ .5in +\fB\-\-data=\fR\fIformat\fR +Sets the formatting for cells within output tables unless the table format is set to \fBjson\fR, in which case \fBjson\fR formatting is always used when formatting cells\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBstring\fR (default) +The simple format described in the \fBDatabase Values\fR section of \fBovs\-vsctl\fR(8)\[char46] +.TP +\fBbare\fR +The simple format with punctuation stripped off: \fB[]\fR and \fB{}\fR are omitted around sets, maps, and empty columns, items within sets and maps are space-separated, and strings are never quoted\[char46] This format may be easier for scripts to parse\[char46] +.TP +\fBjson\fR +The RFC 4627 JSON format as described above\[char46] +.RE +.TP +\fB\-\-no\-headings\fR +This option suppresses the heading row that otherwise appears in the first row of table output\[char46] +.TP +\fB\-\-pretty\fR +By default, JSON in output is printed as compactly as possible\[char46] This option causes JSON in output to be printed in a more readable fashion\[char46] Members of objects and elements of arrays are printed one per line, with indentation\[char46] +.IP +This option does not affect JSON in tables, which is always printed compactly\[char46] +.TP +\fB\-\-bare\fR +Equivalent to \fB\-\-format=list \-\-data=bare \-\-no\-headings\fR\[char46] +.RE +.SS "PKI Options" +.PP +.PP +PKI configuration is required to use SSL for the connection to the database\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.RS +.TP +\fB\-\-bootstrap\-ca\-cert=\fR\fIcacert\[char46]pem\fR +When \fIcacert\[char46]pem\fR exists, this option has the same effect as \fB\-C\fR or \fB\-\-ca\-cert\fR\[char46] If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] +.IP +This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping\[char46] +.IP +This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain\[char46] The SSL protocol does not require the server to send the CA certificate\[char46] +.IP +This option is mutually exclusive with \fB\-C\fR and \fB\-\-ca\-cert\fR\[char46] +.RE +.SS "Other Options" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.html new file mode 100644 index 00000000..1145f1b2 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.html @@ -0,0 +1,639 @@ +
+ovn-ic-nbctl(8)                   OVN Manual                   ovn-ic-nbctl(8)
+
+NAME
+       ovn-ic-nbctl  - Open Virtual Network interconnection northbound db manā€
+       agement utility
+
+SYNOPSIS
+       ovn-ic-nbctl [options] command [arg...]
+
+DESCRIPTION
+       This utility can be used to manage the OVN  interconnection  northbound
+       database.
+
+GENERAL COMMANDS
+       init   Initializes  the  database,  if it is empty. If the database has
+              already been initialized, this command has no effect.
+
+       show   Prints a brief overview of the database contents.
+
+TRANSIT SWITCH COMMANDS
+       [--may-exist] ts-add switch
+              Creates a new transit switch named switch.
+
+              Transit switch names must be unique. Adding  a  duplicated  name
+              results in error. With --may-exist, adding a duplicate name sucā€
+              ceeds but does not create a new transit switch.
+
+       [--if-exists] ts-del switch
+              Deletes  switch. It is an error if switch does not exist, unless
+              --if-exists is specified.
+
+       ts-list
+              Lists all existing switches on standard output, one per line.
+
+DATABASE COMMANDS
+       These commands query and modify the contents of ovsdb tables. They  are
+       a slight abstraction of the ovsdb interface and as such they operate at
+       a lower level than other ovn-ic-nbctl commands.
+
+       Identifying Tables, Records, and Columns
+
+       Each of these commands has a table parameter to identify a table within
+       the database. Many of them also take a record parameter that identifies
+       a  particular  record  within  a table. The record parameter may be the
+       UUID for a record, which may be abbreviated to its first  4  (or  more)
+       hex  digits,  as  long  as that is unique. Many tables offer additional
+       ways to identify records. Some commands  also  take  column  parameters
+       that identify a particular field within the records in a table.
+
+       For a list of tables and their columns, see ovn-ic-nb(5) or see the taā€
+       ble listing from the --help option.
+
+       Record names must be specified in full and with correct capitalization,
+       except  that  UUIDs  may  be abbreviated to their first 4 (or more) hex
+       digits, as long as that is unique within the table. Names of tables and
+       columns are not case-sensitive, and - and _  are  treated  interchangeā€
+       ably.  Unique  abbreviations  of table and column names are acceptable,
+       e.g. t or transit is sufficient to identify the Transit_Switch table.
+
+       Database Values
+
+       Each column in the database accepts a fixed type of data. The currently
+       defined basic types, and their representations, are:
+
+              integer
+                     A decimal integer in the range -2**63 to 2**63-1,  incluā€
+                     sive.
+
+              real   A floating-point number.
+
+              Boolean
+                     True or false, written true or false, respectively.
+
+              string An  arbitrary  Unicode string, except that null bytes are
+                     not allowed. Quotes are optional for  most  strings  that
+                     begin  with  an  English letter or underscore and consist
+                     only of letters, underscores, hyphens, and periods.  Howā€
+                     ever, true and false and strings that match the syntax of
+                     UUIDs  (see  below)  must be enclosed in double quotes to
+                     distinguish them from  other  basic  types.  When  double
+                     quotes  are  used, the syntax is that of strings in JSON,
+                     e.g. backslashes may be used to  escape  special  characā€
+                     ters.  The  empty string must be represented as a pair of
+                     double quotes ("").
+
+              UUID   Either a universally unique identifier in  the  style  of
+                     RFC  4122,  e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or
+                     an @name defined by a get or create  command  within  the
+                     same ovs-vsctl invocation.
+
+       Multiple values in a single column may be separated by spaces or a sinā€
+       gle  comma.  When  multiple  values are present, duplicates are not alā€
+       lowed, and order is not important. Conversely,  some  database  columns
+       can have an empty set of values, represented as [], and square brackets
+       may optionally enclose other non-empty sets or single values as well.
+
+       A  few  database columns are ``mapsā€™ā€™ of key-value pairs, where the key
+       and the value are each some fixed database type. These are specified in
+       the form key=value, where key and value follow the syntax for the  colā€
+       umnā€™s  key  type  and value type, respectively. When multiple pairs are
+       present (separated by spaces or a comma), duplicate keys  are  not  alā€
+       lowed,  and  again the order is not important. Duplicate values are alā€
+       lowed. An empty map is represented as {}. Curly braces  may  optionally
+       enclose  non-empty  maps  as  well (but use quotes to prevent the shell
+       from expanding other-config={0=x,1=y} into other-config=0=x  other-conā€ā€
+       fig=1=y, which may not have the desired effect).
+
+       Database Command Syntax
+
+              [--if-exists] [--columns=column[,column]...] list table
+              [record]...
+                     Lists  the  data  in each specified record. If no records
+                     are specified, lists all the records in table.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order.  Otherwise,  all  columns
+                     are listed, in alphabetical order by column name.
+
+                     Without  --if-exists,  it  is  an  error if any specified
+                     record does not exist. With --if-exists, the command  igā€
+                     nores  any  record that does not exist, without producing
+                     any output.
+
+              [--columns=column[,column]...] find table [colā€
+              umn[:key]=value]...
+                     Lists the data in  each  record  in  table  whose  column
+                     equals  value  or, if key is specified, whose column conā€
+                     tains a key with the specified value. The following operā€
+                     ators may be used where = is written in the  syntax  sumā€
+                     mary:
+
+                     = != gt;>gt; = >gt;>gt;=
+                            Selects records in which column[:key] equals, does
+                            not  equal, is less than, is greater than, is less
+                            than or equal to, or is greater than or  equal  to
+                            value, respectively.
+
+                            Consider  column[:key]  and  value as sets of eleā€
+                            ments. Identical sets are considered equal. Otherā€
+                            wise, if the sets have different numbers  of  eleā€
+                            ments,  then the set with more elements is considā€
+                            ered to be larger. Otherwise, consider  a  element
+                            from each set pairwise, in increasing order within
+                            each  set.  The first pair that differs determines
+                            the result. (For a column that contains  key-value
+                            pairs, first all the keys are compared, and values
+                            are  considered only if the two sets contain idenā€
+                            tical keys.)
+
+                     {=} {!=}
+                            Test for set equality or inequality, respectively.
+
+                     {=}   Selects records in which column[:key] is a  subset
+                            of  value. For example, flood-vlans{=}1,2 selects
+                            records in which the  flood-vlans  column  is  the
+                            empty set or contains 1 or 2 or both.
+
+                     {}    Selects  records in which column[:key] is a proper
+                            subset of value.  For  example,  flood-vlans{}1,2
+                            selects records in which the flood-vlans column is
+                            the empty set or contains 1 or 2 but not both.
+
+                     {>gt;>gt;=} {>gt;>gt;}
+                            Same  as  {=}  and {}, respectively, except that
+                            the  relationship  is   reversed.   For   example,
+                            flood-vlans{>gt;>gt;=}1,2  selects  records  in which the
+                            flood-vlans column contains both 1 and 2.
+
+                     The  following  operators  are  available  only  in  Open
+                     vSwitch 2.16 and later:
+
+                     {in}   Selects  records  in  which  every element in colā€
+                            umn[:key] is also in value. (This is the  same  as
+                            {=}.)
+
+                     {not-in}
+                            Selects  records  in  which  every element in colā€
+                            umn[:key] is not in value.
+
+                     For arithmetic operators (= != gt;>gt; = >gt;>gt;=),  when  key  is
+                     specified  but a particular recordā€™s column does not conā€
+                     tain key, the record is always omitted from the  results.
+                     Thus,   the   condition   other-config:mtu!=1500  matches
+                     records that have a mtu key whose value is not 1500,  but
+                     not those that lack an mtu key.
+
+                     For  the  set operators, when key is specified but a parā€
+                     ticular recordā€™s column does not contain key, the comparā€
+                     ison is done against an empty set.  Thus,  the  condition
+                     other-config:mtu{!=}1500  matches records that have a mtu
+                     key whose value is not 1500 and those that  lack  an  mtu
+                     key.
+
+                     Donā€™t  forget to escape gt;>gt; from interpretation by the
+                     shell.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order. Otherwise all columns are
+                     listed, in alphabetical order by column name.
+
+                     The UUIDs shown for rows created in  the  same  ovs-vsctl
+                     invocation will be wrong.
+
+              [--if-exists] [--id=@name] get table record [column[:key]]...
+                     Prints  the  value  of each specified column in the given
+                     record in table. For map columns, a key may optionally be
+                     specified, in which case the value associated with key in
+                     the column is printed, instead of the entire map.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist  or  key  is  specified,  if  key does not exist in
+                     record. With --if-exists, a missing record yields no outā€
+                     put and a missing key prints a blank line.
+
+                     If @name is specified, then the UUID for  record  may  be
+                     referred  to by that name later in the same ovs-vsctl inā€
+                     vocation in contexts where a UUID is expected.
+
+                     Both --id and the column arguments are optional, but usuā€
+                     ally at least one or the other should  be  specified.  If
+                     both are omitted, then get has no effect except to verify
+                     that record exists in table.
+
+                     --id and --if-exists cannot be used together.
+
+              [--if-exists] set table record column[:key]=value...
+                     Sets  the  value  of  each  specified column in the given
+                     record in table to value. For map columns, a key may  opā€
+                     tionally be specified, in which case the value associated
+                     with key in that column is changed (or added, if none exā€
+                     ists), instead of the entire map.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--if-exists] add table record column [key=]value...
+                     Adds  the  specified value or key-value pair to column in
+                     record in table. If column is a  map,  then  key  is  reā€
+                     quired, otherwise it is prohibited. If key already exists
+                     in  a  map column, then the current value is not replaced
+                     (use the set command to replace an existing value).
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] remove table record column value...
+
+                     [--if-exists] remove table record column key...
+
+                     [--if-exists] remove  table  record  column  key=value...
+                     Removes the specified values or key-value pairs from colā€
+                     umn in record in table. The first form applies to columns
+                     that  are  not maps: each specified value is removed from
+                     the column. The second  and  third  forms  apply  to  map
+                     columns:  if  only a key is specified, then any key-value
+                     pair with the given key is  removed,  regardless  of  its
+                     value; if a value is given then a pair is removed only if
+                     both key and value match.
+
+                     It  is  not  an  error if the column does not contain the
+                     specified key or value or pair.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] clear table record column...
+                     Sets each column in record in table to the empty  set  or
+                     empty  map,  as appropriate. This command applies only to
+                     columns that are allowed to be empty.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--id=(@name|uuid)] create table column[:key]=value...
+                     Creates a new record in table and sets the initial values
+                     of each column. Columns not explicitly set  will  receive
+                     their default values. Outputs the UUID of the new row.
+
+                     If  @name is specified, then the UUID for the new row may
+                     be referred to by that name elsewhere in the  same  \*(PN
+                     invocation  in  contexts  where  a UUID is expected. Such
+                     references may precede or follow the create command.
+
+                     If a valid uuid is specified, then it is used as the UUID
+                     of the new row.
+
+                     Caution (ovs-vsctl as example)
+                            Records in the Open vSwitch database are  signifiā€
+                            cant only when they can be reached directly or inā€
+                            directly  from  the Open_vSwitch table. Except for
+                            records in the QoS or Queue tables,  records  that
+                            are  not reachable from the Open_vSwitch table are
+                            automatically  deleted  from  the  database.  This
+                            deletion  happens immediately, without waiting for
+                            additional ovs-vsctl commands  or  other  database
+                            activity. Thus, a create command must generally be
+                            accompanied by additional commands within the same
+                            ovs-vsctl  invocation to add a chain of references
+                            to the newly created  record  from  the  top-level
+                            Open_vSwitch  record.  The  EXAMPLES section gives
+                            some examples that show how to do this.
+
+              [--if-exists] destroy table record...
+                     Deletes each specified record from table. Unless --if-exā€ā€
+                     ists is specified, each records must exist.
+
+              --all destroy table
+                     Deletes all records from the table.
+
+                     Caution (ovs-vsctl as example)
+                            The destroy command is only useful for records  in
+                            the  QoS  or Queue tables. Records in other tables
+                            are automatically deleted from the  database  when
+                            they  become unreachable from the Open_vSwitch taā€
+                            ble. This means that deleting the  last  reference
+                            to  a record is sufficient for deleting the record
+                            itself. For records in these  tables,  destroy  is
+                            silently  ignored.  See the EXAMPLES section below
+                            for more information.
+
+              wait-until table record [column[:key]=value]...
+                     Waits until table contains a record  named  record  whose
+                     column equals value or, if key is specified, whose column
+                     contains  a  key  with  the specified value. This command
+                     supports the same operators and semantics  described  for
+                     the find command above.
+
+                     If  no  column[:key]=value arguments are given, this comā€
+                     mand waits only until record exists.  If  more  than  one
+                     such  argument  is  given, the command waits until all of
+                     them are satisfied.
+
+                     Caution (ovs-vsctl as example)
+                            Usually wait-until should be placed at the  beginā€
+                            ning  of a set of ovs-vsctl commands. For example,
+                            wait-until bridge br0  --  get  bridge  br0  dataā€ā€
+                            path_id waits until a bridge named br0 is created,
+                            then  prints  its  datapath_id column, whereas get
+                            bridge br0 datapath_id --  wait-until  bridge  br0
+                            will  abort  if  no  bridge  named br0 exists when
+                            ovs-vsctl initially connects to the database.
+
+                     Consider specifying --timeout=0 along with  --wait-until,
+                     to  prevent ovs-vsctl from terminating after waiting only
+                     at most 5 seconds.
+
+              comment [arg]...
+                     This command has no effect on behavior, but any  database
+                     log  record  created by the command will include the comā€
+                     mand and its arguments.
+
+REMOTE CONNECTIVITY COMMANDS
+       get-connection
+              Prints the configured connection(s).
+
+       del-connection
+              Deletes the configured connection(s).
+
+       [--inactivity-probe=msecs] set-connection target...
+              Sets the configured manager target or  targets.  Use  --inactivā€ā€
+              ity-probe=msecs to override the default idle connection inactivā€
+              ity probe time. Use 0 to disable inactivity probes.
+
+SSL CONFIGURATION COMMANDS
+       get-ssl
+              Prints the SSL configuration.
+
+       del-ssl
+              Deletes the current SSL configuration.
+
+       [--bootstrap] set-ssl private-key certificate ca-cert [ssl-protocol-
+       list [ssl-cipher-list]]
+              Sets the SSL configuration.
+
+OPTIONS
+       --db database
+              The  OVSDB database remote to contact. If the OVN_IC_NB_DB enviā€
+              ronment variable is set, its value is used as the default.  Othā€
+              erwise, the default is unix:/ovn_ic_nb_db.sock, but this default
+              is  unlikely to be useful outside of single-machine OVN test enā€
+              vironments.
+
+       --leader-only
+       --no-leader-only
+            By default, or with --leader-only, when the database server  is  a
+            clustered database, ovn-ic-nbctl will avoid servers other than the
+            cluster leader. This ensures that any data that ovn-ic-nbctl reads
+            and  reports  is  up-to-date.  With --no-leader-only, ovn-ic-nbctl
+            will use any server in the cluster, which means that for read-only
+            transactions it can report and act  on  stale  data  (transactions
+            that   modify   the  database  are  always  serialized  even  with
+            --no-leader-only). Refer to Understanding Cluster  Consistency  in
+            ovsdb(7) for more information.
+
+LOGGING OPTIONS
+       -v[spec]
+       --verbose=[spec]
+            Sets  logging  levels.  Without  any  spec, sets the log level for
+            every module and destination to dbg. Otherwise, spec is a list  of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A  valid module name, as displayed by the vlog/list command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog, console, or file, to limit the log level change  to
+                   only  to  the system log, to the console, or to a file, reā€
+                   spectively. (If --detach is specified,  the  daemon  closes
+                   its  standard  file  descriptors, so logging to the console
+                   will have no effect.)
+
+                   On Windows platform, syslog is accepted as a  word  and  is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off,  emer,  err,  warn,  info,  or dbg, to control the log
+                   level. Messages of the given severity  or  higher  will  be
+                   logged,  and  messages  of  lower severity will be filtered
+                   out. off filters out all messages. See ovs-appctl(8) for  a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless  of the log levels set for file, logging to a file will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets the maximum logging verbosity  level,  equivalent  to  --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets  the log pattern for destination to pattern. Refer to ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets the RFC5424 facility of the log message. facility can be  one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp,  ntp,  audit,  alert, clock2, local0, local1, local2, local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon is used as the default for the local system syslog and  loā€ā€
+            cal0  is  used  while sending a message to the target provided via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables logging to a file. If file is specified, then it  is  used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send  syslog messages to UDP port on host, in addition to the sysā€
+            tem syslog. The host must be a numerical IP address, not  a  hostā€
+            name.
+
+       --syslog-method=method
+            Specify  method  as  how  syslog messages should be sent to syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc, to use the libc syslog() function. Downside of  using
+                   this  options  is that libc adds fixed prefix to every mesā€
+                   sage before it is actually sent to the syslog  daemon  over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However,  rsyslogd  8.9  and  older versions use hard coded
+                   parser function anyway that limits UNIX domain socket  use.
+                   If  you  want  to  use  arbitrary message format with older
+                   rsyslogd versions, then use UDP socket to localhost IP  adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port,  to  use  a UDP socket. With this method it is
+                   possible to use arbitrary message format  also  with  older
+                   rsyslogd.  When sending syslog messages over UDP socket exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified UDP port, accidental iptables rules could  be  interā€
+                   fering  with  local syslog traffic and there are some secuā€
+                   rity considerations that apply to UDP sockets, but  do  not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The  default is taken from the OVS_SYSLOG_METHOD environment variā€
+            able; if it is unset, the default is libc.
+
+TABLE FORMATTING OPTIONS
+       These options control the format of output from the list and find  comā€
+       mands.
+
+              -f format
+              --format=format
+                   Sets  the  type of table formatting. The following types of
+                   format are available:
+
+                   table  2-D text tables with aligned columns.
+
+                   list (default)
+                          A list with one column per line and  rows  separated
+                          by a blank line.
+
+                   html   HTML tables.
+
+                   csv    Comma-separated values as defined in RFC 4180.
+
+                   json   JSON  format as defined in RFC 4627. The output is a
+                          sequence of JSON objects, each of which  corresponds
+                          to  one  table.  Each  JSON object has the following
+                          members with the noted values:
+
+                          caption
+                                 The tableā€™s caption. This member  is  omitted
+                                 if the table has no caption.
+
+                          headings
+                                 An  array  with one element per table column.
+                                 Each array element is  a  string  giving  the
+                                 corresponding columnā€™s heading.
+
+                          data   An array with one element per table row. Each
+                                 element is also an array with one element per
+                                 table  column.  The  elements of this second-
+                                 level array are the cells that constitute the
+                                 table. Cells that  represent  OVSDB  data  or
+                                 data  types  are  expressed in the format deā€
+                                 scribed in  the  OVSDB  specification;  other
+                                 cells are simply expressed as text strings.
+
+              -d format
+              --data=format
+                   Sets  the  formatting for cells within output tables unless
+                   the table format is set to json, in which case json formatā€
+                   ting is always used when formatting  cells.  The  following
+                   types of format are available:
+
+                   string (default)
+                          The  simple  format described in the Database Values
+                          section of ovs-vsctl(8).
+
+                   bare   The simple format with punctuation stripped off:  []
+                          and  {}  are  omitted  around  sets, maps, and empty
+                          columns, items within sets and maps are  space-sepaā€
+                          rated, and strings are never quoted. This format may
+                          be easier for scripts to parse.
+
+                   json   The RFC 4627 JSON format as described above.
+
+              --no-headings
+                   This  option  suppresses the heading row that otherwise apā€
+                   pears in the first row of table output.
+
+              --pretty
+                   By default, JSON in output is printed as compactly as  posā€
+                   sible. This option causes JSON in output to be printed in a
+                   more  readable  fashion. Members of objects and elements of
+                   arrays are printed one per line, with indentation.
+
+                   This option does not affect JSON in tables, which is always
+                   printed compactly.
+
+              --bare
+                   Equivalent to --format=list --data=bare --no-headings.
+
+   PKI Options
+       PKI configuration is required to use SSL  for  the  connection  to  the
+       database.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies  a  PEM  file  containing the private key used as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies a PEM file containing a certificate  that  certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate  authority  (CA) that the peer in SSL connections will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This may be the same certificate that  SSL  peers  use  to
+                   verify the certificate specified on -c or --certificate, or
+                   it  may  be a different one, depending on the PKI design in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables verification  of  certificates  presented  by  SSL
+                   peers.  This  introduces  a security risk, because it means
+                   that certificates cannot be verified to be those  of  known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When  cacert.pem  exists, this option has the same effect
+                     as -C or --ca-cert. If it does not exist, then  the  exeā€
+                     cutable  will  attempt  to obtain the CA certificate from
+                     the SSL peer on its first SSL connection and save  it  to
+                     the  named PEM file. If it is successful, it will immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all SSL connections must be authenticated by  a  certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This  option  exposes the SSL connection to a man-in-the-
+                     middle attack obtaining the initial CA  certificate,  but
+                     it may be useful for bootstrapping.
+
+                     This  option  is only useful if the SSL peer sends its CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol does not require the server to send the CA  cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+   Other Options
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+OVN 23.06.3                      ovn-ic-nbctl                  ovn-ic-nbctl(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..f0b7ec2e7fd1cfffd7ce90eb27da3c604c1998a7 GIT binary patch literal 53535 zcma&tLzF1NvM}nl?e5*SZQHhO+qP}n?%r+Nwr$(}_POi6e{v>wlvz=+GKUpkMiz;@ zuqX`!Ei)9!=v7=H6bXrht*f1pfwP63EhoOcfwMWCnG-&ZJPkgLv66tOh~mFd$j;{9 z3kyRFYYS%&X%klyYo31#;L|w#Z=S52ynu?5$iGZM0c9a^d>SWV5mgBx5gvPEQ#VHo zXOn*sCud_j7iS*6e^WUZXL}cCQ44F6|2+Pmc7kHTr^mN5w1nd3rjs_YHFGw{XZ;sZ zr2Dsuvxy@bmrYMrns+#mMiN2&TeVfrP zidJV;G7SmR^%7c&WI&(%5EzI#K=RZ#*mc<%-s==BhJSKVB@N%2$xKPv=hOLO4Bb!z zg~J=(vs(*~)7ap88WZJDT6u3H&AWvI>uD9*`g&X|;;%siZ&DU{gf`MUuZHz(^@l^t z8yj4I$Iwd`@k@hYLY~HQ*VxH2<)viL-sq-q&c1<0_K+j$v(KgjP@_9%(@o8ruc+;t zCDw;4Hn?L9k?*&+3~%W&FKSs%J@x$+u>#kRTv0K}1#TMY1F2-g$_T1D?`u$ep45ph zxvRF`6Z%3Q9Fknl)4gKWpE0GUkXoZpS>cl<9#(ZeZ;Ny(-LdIdm7_;$=jy`qJqX9? zjxtPZ$Lz7DixW9TWgM%&YIo6(lCqQA*}=klI+)rV*5 zOI$z6u3eil)_S);K3#uK{&Y5ZMwy)^by5Ug&#`UwG%uK*h}_v@Xu(hDd|+Ix1Ij!J z*=(w&MsGeSVjiccQ!Ril<#a?MCIkcx=i@wRLO2C{?Go_4xl$a6huUweI8hGGkWDOznqewqXh zyB>LR4vefDC$$jM{7F3lcZXS5d{R9+r3X&K@=sqJ1BCc=gUr>?{EDw6wdQdGwt|g| z)pk2-Em^j;G%k2%4hVaRc$Nx!>!WY9glZvu4o3_eaxE{)wdP?Y3fXest2t>v;A?ly zXCGPA^{g}~#}7zI(*`v59FPK#1V=KzRp}NX6M@pDAwrg z!Wv7TN%ABu&BoK+KrhM_C?CKZ@1_0e^C;dy*6ms<^E9ct#C4CvXQf3>ByGCfj?7_C zD@(%o#NM;dZc(%s*qC!fNI63nOe{nwkk18p_z{$n-eMVO=3oG}Vu2=09j&tkuXmY| zt^OMjwnZ?KtXe?YA9Xca#wdRna}LPbBVlZS=uoq9yEP|2sq(GSjJ192vCy+`@$tKs zn(>VQol0VG!v}H;4b?zKiEV*_015up0|ooS!g-??w)WmeUwp9kj5SF5+)LnhX;X5fv)P1?TTOH;e8qJd1A0{e06=)rL?{y`IwF0)6zpNmlab<$_X5D1UfI~}6eEa^hU*>%CWJr& znw_RZ0vghc7s_0p${DW6b%>R~Rh>Mp-KGw~A11hJ*6Uw24!t%EQ2$ULNqhXlK_d>lrP~eF?xyWLkn3B(T%V@* zB5M;wic6@*7Cw7v1y@u6|dX2ajQ$HL|iNJjpfN8 zd)`Q1WW+Ycij$wv!#on$mCY{)>Sld{zZdNhAImOYtZ(N7#zE|^&4)L%dKGw&V=u^T zXGwS{I+5^1`%-w@VTTqQT*ah9@)s9cSh6%W8r;^LiM1QG5+(Xot6wB_ z>T(>J;5=WXm#4gf9Lns&5rSm3W)b45vyx1t-jMyknp+Ua(O)u#o$%WQy!{?h&~r%6 z5v%cumk8@o+zvwwuxu30gv}yBXTHprSLzqZz}*A>a|N1WHu*tTYinIAk#}w+yHAT+ z9f+{3Ueb(C;S`%w2_-Hmz^?oRvjfA_4)<^Anm`1nN2w;yb6iJncsCbrF73Oj*Ud=? zV!i+~1M&wyj3V5`l+s_&0bHLuS6%`)68S!4dmI)i^7cY{pFU}<<$?Twx5Q8;e1T-F zNc7`i$2&`xthXH{;$>T`y3iaZPuNh#?)7+3zSMjQq+Q~lK7%d#b*hqj@FooQp_02L zewEPXc?{hbh83lm<_mY=nNJBSKIQ$lz=o-*5CUWSx$5uDX!#6L*m7p>;j}ScJ9l$n zZK=GTXa@*-i(m&3Vy7Dh6Mj52+4SgFp@cuKK{~(1{RWQM66WNzXUqZadxhz6 z$`c{9ersiNYPaK9$4n|Kc}Zn5faw+A=awYb2ZL$&H#kHoM@9t61Y)r1FYN*0PvhMo zhb=CHH)g^+H|vcFhp-(pn|1GfIJv5Xs`vguGaRqUEa;Xs4{lW{72eUn`^R29s-E;8 zw)vg{ob?m^@}^6!IsO-7#J2bp^2TI!D7AFUyI8owTnhHMvQmsN$_qkVl1S&w_P;va zEQ*PPnf4ISC(?5oPjfiP5JNU+uheOfgy~COYSbBE>YkzJ`fK9TlydB%-g84$)|ie^hT`4fo)%Wa08qP>ht> zidaNrfe*L=S`%SLzEf6wxArf2lK;HI$ANDx;$xh#Ea=SN?+Z`Raga3<7e>EH@W~3u z5!b$DHt3Ks1)n;2WjB`t>+=12QyWVicX|^pCIN=TCXiklrviS8a)u==`Q?&{a+NV+ zN$q4Vk>aD8=t9@U=o5!AnTrI@#RmtFkx4=65Qn5A(fp}g>N4s2q!bM=t*3Eif##_M z=g9S{<`C^RMw(X#=8uD${#l+!ro1$X&RL7)R#QWv;@N@D_@fZh!&jPx2)yz@HnEZF2wfvn^v&9ra} zb-dNXe3*a46`=EJuyG`R)}WgvUCL9GsuGJfl>_&yljKRpbt#dVDV18dx=|PMQ|xQb zV+NY%m~~b2mu3#}U5W8PM6@iHK{)_thdvoe^~-^*qh{PmuyeL6KttvnV?m*_wRz{# zVCxj~mN%Ll183Sm-mK{P6H84V0DPRxk_??P9I}{D-Tc#>WEVtSjP8W|MCS$g zsdL`=NofH(NXeV)0(EZzD9%^=k9SguFba;WOioand@VhdqMoy7q6l^7~(v#eml3DM33g-g(7;4>3mC$HtW^(Gk zI!fII$a%0`#&>(wGXMpZKe1j-k3O1LdmX4&ghA9G^`%^~14&hY7{q|xxD8vD8=ok6 zfWOFFgNGl=W-ipNORP`hlQJwd_$^+>FH{>9s8;YH2>EE>MLSp^XLk~eP5!}y9VDVB zLxLE5#h}$7g)kb&Dl+r($ZzE!gc$&aSv_}+d`kZO=jjsM_esthfa8`xADn!72SO82Ji7x}lV~ZOe`t4G*f2}kJD+{6nLYw1eIUw1=8a{udZfjVveOpVr zp;n!u!{7pDIB53Tr0xX-v^0bmIA*y9CDEh%G~^=+1bK`$&CzXEX#1Wv>rz)@@nLTV z3n7GEQ(9g+vvu4KV&}*_R_UkzUR%D}Q?MX6rp%nJuQc!0wiX<)ukO=+M9WIUMb+ZP zOskXzPo8qRlFzsi4N4u-o2eT5+$1WL%6imJARUqeJ*ybtT zODb9lMg?hu$IkC{+xSH6Gh^Uex>fAq5So!c*?vfUVPe|s(JR}G40utevrGyTcCMAO zm%qOs;hg~iBUD}m-yR2@K0XRJ=Jq$au1h=nJCg4g_+VoX-^AAVf0^=c_8;2(2Q>c~ znHU*4p#C?;@ZauX_&>pCS<}XDixuhTMz7zu@}=HXM6pf;Tbs@%0DA*$wPQL=#($zy zTWeLvg2>_;L*Pf?rtFPx2WGeAnbScF+mn25g(?yoF3%%3qhKdKoe}Af@1%F~T0)vu zZYP`mnTp|8!*-l+Mo!jY>HXm-3eU;gzK3_7jv>)0kqnY!H&^)j`RZ$z9x|G$0>LDq zFZ^*?VkvuNa`D8F!`i+NoiEiC4sbBCajr-`agJSf{C!&DiIP%xdJGzSx-l3{q;hoV z;+&2z{CI4!U(pHI+wN-O)pAgNnD>v4$u5 zs7e=g#uV)e=1js|^6^H~3Jdit1^UL62(z7;#Dux(U3ryh-Ry4#+hD(p17UR<*-0`x z71i`&?`2uL*O_iri=#I+cTs(p@03M!X+V_fgAkG0(Lt(mQpiF!DWR!pj}%9AnNfWb z;a}J0?IW8Jiv;5-TbK3ey^uy~LJe5O>t#6?N)Y^39UcrmTnf z=gVP^zny=CRx;OibzZ~NO_-mvs{b%?jjB2MJ78;J>$Uc0zl@r&EZGzxI8BHE()Hmo zx<_~Bw?mHHzGfBd04^nKK$b~lXOcL`mx8HebzdQ7pq^izAc@j#PWx`g+qg*4>fbu5 zx$JSdsD9UK4xF_>iv@L(dw7uSr_2WuQdwlD<1b#42O*D;@6CGTK@))hlv|o{gSL!|I1{Nk1%fZTQbpJ3!dA3)w*09y%|FuEEC+T| zn2L%%iN%i%VGyp{+B#tJN78KJHUORGX`1@H6G=_Gd23Cqt}N&%_q-g=rKa*}3nW@$ zM4wh$4mZ#zm2+UAkKi4!syGBL$5%VtOa7)1joAeT$ZIIBN2cfLC)~IJV`t;Q-_;I! zd=i+FAd4y6H?G`RkKFX3(T$V7BcCx(9iGa)>w@}944{dK5o9m^nZ}j7FRV)K zoyKR6R4z`y_5^Km4YOCxrpP)j1%3S+8Ije(k?s22tW*rUxy>e z++3BrH8veuNdaP#@l1q$?M61QcDa5^`Sdg!crp_u4IgS0&t`ng1FM{_r2`CqMzH8K zy8RP*i_-2G>ab9^X}RiGJ203z;Dp6Rt1g_^$^^Jl;(%G>mj!@OTey4gJ)sNskYi(At4#=7@un~)sPC$vSF?cPj=;#Z2rte7oJ$@KmxCI?i&lBrM5|s6RumYz@ZH3puFT z#y@z-o{BXec>IM-(^_>h)*IsU@2kL?Q*nB{^woC}{4iD1VVmGP_zg&BIHR>L6?3l2YucA>C zdWkT=Vv1Iq&li76-UgJK9FEb27BWI*2*ZKYz_N5mZcML6%9{!+swrd-ELg>f{F8qs zWv2lpFbxeJz%Qzjp2&|nUUim^OBGg+Wd3L6u|J6+Z>cL2w2~9@9q4G#q-|kLFSTLN z=NS+jfGs(;t&|Wpq6Yo^!ZGwGhGVWVV$rDM`!CbICP%K2X!=R4h5AU)5NM7Prgka6 z78+O^Bg;A1kG6XraY*Q)8mz(w5K^-c6KN#-I8}&$@i6Dvw%2ujWBQN>oEc{JLsJ5G z87*NV;o{w_t&47rXV`K1C3ae6ZYx!sczN&Ex*V zm5%p|>&%Spu3Y06dr9`@RH1FCt0%6$R_?u*X)t8O=VrYW%zPectd2ekbw!+g;sU>+ zE-sPfjAT_r=By@I!JZl6&d zTgrY{p_c1bL!C=_dShphPmMS zhF&A0MNmr%?sNAp{+6x^uQB&IEitqT*3PO6K{)*BKSkT|0qLfIEk5M}(G#nMX)H@B znP+=b*iNE@DxG+ww1?uU>)+MDmaHPv;cjU2UAYm$LMC&+S*f6<6fdiyo&Y5LhXX0= zCH-=%0#GV-5w*+PiG*capi4G<3xNx)8HHhoA^;Jc-9CbCcSrd31?~v0P|fSgFIB1+ zTM{$;Qu&3lgilx`bjzO{gVUX8i}o(@^ZEvC`yWcXReQ9Au}}cgh)YF}1ZOS!U} z)>bt=)*En1ts@$~R!&#IJrM$beBrl)_ob5jO+u?I@e3Xmk6YU>-T>JN_$<{vNsJlH z^C$Q#&N2P>G)a4HgxJ^gUI%UY(&YzH@O^^Ues-k}!-9a2mwpu{+@%qI&suuBdMk0^ zKb9&zx8Tw{jJZ!ovp`2ZK>~b*9OvdpN?P{FB8Am}-@J$~26aX$$Y9ZR%0~d?} zQLj!O!u%nml51(frYl*$g_O2V1DVSOUF`HSOn`Vn9C5H!bDIV@U44EPgb*B6xnIg1 zWNjbv-c#l{BwI{XB2x+Z{;o7}o7`=Z(6N&9#%5KW~O0rqT z+={jgtUYrBCL+!aAT!af3Qo{?@KC#3_z)^)vMZKCJd2*ZRJD2pCT!dqt3q2Yr$K{b z1E@<1vCU}Y?`xgGoiwcjKir*WN^$ponC&_|F^mrt$+xpFUh@^VuhWReA6FeMDxFlt zuAf`fX zeL;}>jxzx1%DV?QP!6F#h=qnvL|{SA%3W7?zB*>tbv@ISSw{A0XeLDn(^`k&A(>rP z;YH)Wz*H5NI+pbbcDG6$61b&dy;iH>2t)B-J0@O3zwvCq1ic3 zZ)I>!1(UBIE*Pddlqu;Oh62#FgnwQ@De0TO%FjcaM=vl3!0>K2&oN0ONYU9wIV3^d z_feR70=$4LxiI%XUz22$73S^Te zI#bdL*wFQ&7Kl3*2xDJ{Ef|dAFVBwjwhr}2BKLb!^$!y8aHj!q*@ZJ4)&|Aap6ei2 z#89+>N5&kCImgamX-G@y%r3@JIm+mq7{JNsnVZwXyR11S372M+CALIgI-DkpMmsoc zt>IbT#SGyPOaLxP_UP-lo!Lop%ggCzqmr(L4KDkBj99trk3z33s?`bcV$aNG6uAn|W$8a?8qcNtIW zjTJZ0WwVhDA^aPzyV}Hz?%oPXumB!2m0VhgumjHt@{0bU6m#Em|1qSa>j^oyjMrsW zy88iuDBzEeC?PW+3HcOfS9NVmbgD%Ch;*=i_{e9|+0nV9EE9J+apIk*7oucAc5t+vL=+!ez>O3qxywQ9>Zj^;DmUJFAm|OVKnS)s1ccuW-GfJMuG;2U zHz){aS>Xkk1Bm5gL|#sFNcgVIPgP>HbE)}^-3S=gK+Xra!Rv-$@QJYD0aw}v&4oo4 zC(4R^Lp62SXIh`;xb?>9zp}b4Itci57^v<8;ewY>XUhGr_NgvrZY)dY34KvYt}F|C zbH!A(vJMIqo%X#J`_v@Yk@bk@F z8hu|S|aHK z$TyQFv5i%o;dsr^x;6j^NH#KAa3;-%7&|ts@$l`w_cUGN1+fzfMDuOm4xdoN+0OcM z6MZb^fBszq(bLJDc33(-xO%ih{yKO#nc@}>3VRzIgl}B$oa{X$tmq>_NECKu+SfUui7EbGh;(u7o(Zbd-US!I?Akdov47p} zF-NcR7ZnE6Xop$R$XeA)|BJjp<11^9G|Zijj9KDYn-}?TIuB-IHWi*E{O76DJBMzA zwER&-h3=2{sjo`kq@$HV)0?_5MN?|~WcRX?-Se{#z@yDWV@SkQRgG0}GzdxYpSJRq zP8kkuY!yVanGdz1Ylb_1>`lAg^p{`zxli8=i=oAzD6g+CPKm# z_nyxV#!G2r6Kw$UJ=|I^;XpcKIVEURm@uK}Ws%N}Bb$ah`x)Wttc4~!Ng`abitX=V zGp0<^1SmRP-*?5|j8Y5tdlNf|1mQ$Y?=FlRC1FU8{1~+!bA5EKt|-!(H$M)6|B#s zL6KRn^eeTEtm-B~FiHRd4e~GZ#a>TvQoY-at;_&g^Q*AxGjl$ba-M-zciZ44L5V_* z_Pw_2FGhyrtZ2tuLR@}LPLNdgS*Q1gfydSyEygm3EV9l^#X!R^sENSD9BlV`Y{9Q56(fdNf@&Hn^vGdllc`I zS_;^`>ww$FH*qIr_o37&44&58fP9rBMEVHo5voCyaY7KAX$5#M)~+DL@GSw2svBbc zArPzLXmRH6iAZGPtJ^V8VD2HBmqcno+~}!6s?F8NS){a|5N9FQ# zzP!V6Ac?z=;7TdbcPoaH5#kQ=4ibu^B|?QfLE`ai?$;U5@|Am$J> z!_1Y>{DTF}i@~dx2BV6apH_jPyYoDN_))0vD1J0k=(r=nASOL8)^^+#s3oL}r`IZT z6PUX|Y^6cY+v{L^+lKr)%B6t$XSm~`SgWOMUyirzYl5c z>h0Z}EV?^s?~0s^zdU2muJFMfZGZrT#+=Gnr5hoi(Ef}}TS<@k00O4htd8y^)U;Mz zVZEETu-@`truPd#YLYYZfG|(;&CvcDD}TQ3_I^-ZS(qeyW!Ky51tx><)ks%EOHd*FkACX2Gf|K}8_Gfl^v{}JG?F%TcwJ03{&Q<3Yf2~?QD6w-uZ1(3u1LZsG| zxa$}126S<&itKhr70%q3FY6GBKm=fo|Ed6oGjqn?YWGSWdbl7TVTwCtRpta_>&#mn zBoB$^3?vs}G%!jwOlEEx%0KAa3)aMQ*1p@2)*G8s_d%wVqS;*jILN0g2-#fQL|jGU zwPAz)-JDamL8iIU*61U@U=*xi5NXAD`Ae4>0<6)OB-8SD%mvqY@h40>WUiEF-JSEV zw22^hvutz~+d2<|rZ5=5j2B2KZnqARX@Ui%T@fIIyqM4m^K#)_eJgkc-vHNYk~koV z(fd^TFlgu32&fdFe4lKpC&|V}kfpynoQrvsfi)`-3%-`&)4`y}I+{FY-;OH1y|(OI zX?nMPBhxi9j`(CPPL*h>mSs{n#98hga=JTeE;klpUcH+f zW8@J1NJnTmg>9@bFFDmJhKJymlMBWx$b+&x*OG+4x2SM9R|t^j&~BfD$1b6FM=$99 zxv<=E*X~K14d5HWP+2zwn<-EPvJwavJ#kS`1`TI(VLN=@p*_No24>YR_F{fD%{rFRg`x zYN_x-0{uJYY5UBOeEzMk`K0+>m{vhV2+uIk9{{ugnMjxb@<@6|Ruy%XLEgnEq^>W* zwOkK;M^=^sLHc?^S<_?3-olKScT|6j#NJXIlR`3Lks%^-Y4)Lm1zI+7a+5GJj5+)* z4l=q0Yp*kNPC&~i9$^%EgB$+BiEM)~xZ-oV@!T<2Ko?rH>V6axLg{XUtlkxSR9Kv3 z-r*LhN8(&F1h}n{cR8(A*{4|ekJ({sbpx`w3|l7H{l)ENq79YIS{;sw*f(OA#pfXQ z^TgsfIcuwer^?PWQWaW%fM4Why;_j=grV8T!U4q+;3$|^B@cet305EN-($?p}l^1<<8*%=jd)#A8V3si+tuiw1cf zV-Sv{yP~0-Ra+9El29gu)Gfei&ekwcWh7>k76^9T{X384?Cd$W-Z!^=#G(GGSZ>{?n+CX$*hRhZnq*aY*)+j%H7$2uRjIHSQj7Ux3?2$K7pP;fy^zIc-BLvxy(S?@jFTOq z*nQ%aB5G`fWog>WDGp)Izat2|Iiwx`xnNOiO@Z;-4S0Zgn6}4_J(1kfYf_iXw4ut1 ze5}Y6zMkAI!G@8p00?q*Ll&heRw%sY@tRZ1+_Rpk*c1c}YHwzn;Osg2LMjERx|g+c zz6AKmj;*2R(?2dA;}0?#&K!adUyLg{&^^cqi%8tAKqyX64s7PR6IVVRtQ{1d#V#dCOhRj~4 zFNxc`zMGKh*4rxPV$bB!RB0Vk?0B0bi;L|Dc)e333!$o#8nCF^E({L1-N;Qgnj|k% zD-RBx-4n?rB9)0e)j1J3LUC`CcXsBeI}8`1*DN>vmEE+Q_RQVRp3aQ;+L?XN=}DSz zB9j{`+V-8)cC-6k3uNQ9tB(J7fZ}?TX-9w3@=JIXksQMc2ZAQ|&BFULyeVj*6e+xD zPr-LpyIVv8fWiKD2Hy@=kp1et=o3#otv)$D$G}v6=TC1XD2&+8^~2Tf-J>3fRnGf= zdG~)D`#;`gWBPyIWn}tq?=t_NysK#wci4jX)6*-sONeeIN-UxviI{KW2&#DW%_egOJ9=L~aG*dXXZ-0_;ig}SnPQWaA7x(^a z>6ao5uhy%r@N8xL)4Cz%*WRvqP@c8CJi068ZQst0pEQ_nIh(>}-|cY-@IjzFWlY0wWp)FH#3OM- ztsfSbIFdvX;WJ!gY|lszvwrIfM3N=tKelaV{IEC@9|xO;xVSu{fQX+BmqcQ(wY5UB z)xN@>qT@_-M9DtatJHdzi$xtpA1%>5sOzW~XSmHLLIbYz*NpBCN?~%N&S+zVz37IM zkve^3hwSavGSZQ5_{Bp^b-&4nLZ0Y##dJQ`UVN5s3qQ|^#X*N^8CE#%;4z3#49~Lp zLA&bo0i=06awM9y$N5K0RuEedK1zhrJNIX7g69!HQaEb3$DvLbQ5HWT&T`0=0)Q2= zYgMH?=wGfb2t~uj6FiF=L8lelua~U!+7Z-_I6(gtc?i~&Xvb7ZXP&<^4Yd6Un6)z! zH*@ZWTle9pZV_(x$xuuLqV8|R98VF^gK1M6YHEzAthM6eCW%9y@2Gil;*Tt-{_{L_ zvcI%}0{lFsehecT%%J93evLcGg!pcZH{n|k5oa8*F0e?=swE*FSx1wB0%94mJ1^%F z9xNaTxB0?;c2>9)rlzPq<^EW@(^a9n{5^NsgqnSc{dYdy^e*e~4{J{?y0-lQMGW}k zYVfGfxvveSNi`#>iE!zXDsP|aHQu4)p&0FGexGAs&6MZlDbf97oqh%-PEPnYS zp>7t86DEk6ZL9mA&ckXn=8#N^CJZ*|!n`G`!~x>k1ArNsFOj@^bg!u1gG&N{=4?jE zZYJlL4MFPKjc-LW2y8gvC3dkF^{Ok<7MDl+b+>lnsl1;$XWU?o)OwCv$ZK|-7-f0> zeS9c8ve+Q^J=}h>+|Hx=JhCMIV(_GDSC#b`3h=`r8!Pf#Hx&@AB!GSmT(vei<`rYZ z2|(yOIV;@ImnR1`pCaU&|g5FmV=>FT}!4uz9+ z1*iRB#8J>PyiDBWvZ9nyXm$XBI9YALElee1j&&i z>;nVJWDzNAoOBQTt0nV9e!2|0owKj1<$qdjKc;Tu0C!z}nB?o4AVMKTuZq-2?-??V z*l!DTt1k@7tmZ0quKAa%Dm|NqqtJ=qp0hv*ks$z z&2L*^8#LP(^usWfcnukdD$NWJ{r{s zpO%WSqLQoGqc;^FFb8{B203#*uY^m^qC^g8Sl9vJ8dQjmX2I-KzyM9~zuPNwX;YQH=vAn7=)WS!H~ zYU-Zpr!42LSX%-uqp?s#Na)1fWb$>&2MaT~=p?n0RL2Q(g>P#H3V8-Gu~P%=XbaKd zw;(CY6M~@P+iZ_Pm0xn=`9wR?1|{jR)`F&sLxlV z3PH<31C4j+2SoL60~j0yrdz$lqM>k8eZrhLn*|&2cle`Ol!e^s{3}YbcQodnKj)y- zL5+0=q*{y^V8UM{Vjsmny&ect(SeVw7Gy|*v_^hd%eyp~6q+sF`o{3hBb%6opox*j zir6X^p6N)b$#neT=5M%f*0|v1cNKP4U|A_E(#N9-GYe;;bZLb*#~3&_kcO5Bl_Mt~ z`^_M{BCyB{Jl8%npO3||Q4Tbltqmr;@k*M@$Du|bU%dglW9V}das$KN((xk8omk2* zTPzc+EWUZ*ZzDhwNDX47RYQj94oH`sjgBGZQlknZg08uU6W|!w9m$P&59!^Z2&8Y* zxJ|Y?hnw0tF!8y!x|Z`iD|~SNqjiT5yUDwOuT-0Vfm*vY#C9s5^SSVP zaO?MTu}P;VU9Xt0`OKfJ>c&aRrzTBN9^nRtHGabwYSZ-ZM9O%6G9f1 zMF5L`J$6Ffy`1nOu(Ip6{IY;-iSYU>X9μuZ#o%i4fE;`rm9B;YR=geCu^p>Z^d z-?E&=O?RDVU;zK%wo_``yi(#w@E-a=vzDBRV~tzjI)0!;BNIAe_GfBPIJx#aCl!g0 zN3Elb5ts*>R0j0q-o`4DYfzbJOxG1&)1TDYa}xwI4_<|ui0wUi0!*YI+S>l8J_?XS z>6e}B2Zc!DHfv$C>5lypKQbi{H1LuWol@vgcu%4WU z?V9*V^3V&6n=CeYVM62}e=y~_M+}g3hz}s9ZfJdb&tOoZKhh9Wf*j(WktAe6auD2K@Zf%xaE2%ao~te95;d+f2J9=zGej2 z-8sx!gs!3i~YsLVuZ|P*R@RKhq@) zi(liq<8)a$j~^5%ga}m7?Q(=Fk*D^j@%eNEYu#V^hm~F{pB7f0birkcHkv_#y;6@l zMtx4WG8GRvmMcYAkqwv0KpbxQ$mkIHAoUkO7R!GGth%}zT=D{O*=+hMe#q~X z1Ozm>%~o_G)cSIycK+BXX}{Id$(!cLb{2|Hn+6i~)CScXBzA(`oARD9>Wli$b@~yc zI^tdbEn&j2VMeL`xZ)Ylyw_6=CcX{)eba`RvLiqCr=l&~@eyhhE>9E7BZ-j_<%L+b z^wfnRG8wQORZ}f`3538Bu0Yryt~$W^zPC5;>}Ou>lX=@efuO6&joT1fP7&ICPUvw6 zd@U$8+AY^}dG`6+q6VS#k!{?E6zx)%bsl1Z=uLUji`j_P{X=wYYL8L`>c zzvGQyUIr>tKWgStD`>HZ!x5z1Cttcv&&`jB;Q?K|Id<`OR<@bazMiYlZe=7v}HTYGo?`pLm7G(lbC%dF$1?hKvj z(~`Hx{eh1-+sP&LbE1C1px~_0<8_D%F6ra1AtE=r(`pP6yxf!;x+=qDYLj7uwWH_W z@MoLO;INSbc1790pG`Jj*1z@#I{p@JLUxvxiR|5zKP)q~bbX#jc1uP25UP0zHm)5z zZ1vo;g(xPD`DoJ>zOGNfp3THOQ?9dVXw+*}Wkc+8E;R|oEUPOvITLb^?FFx-8Fx-9 zQQv#~%tCi@AjfLI8o|Cliv9hI;Axj8#`_}g#Ye2+w1qCinm7mTj=@nA%<9ISHsxrv z{Cdo**B~d`2zMs1<)ly?w_XqJR3qH3+)ZVFko2!>Z|oP!!eO^BrJE~lX|sfJfF zK=cTS8*2MG)VMX1d~coR)w7~&PY0JWwOOpboc&Er5^cRpNu?eq{J?|TmW#%}?!eiS zHfzL&LiS=9MX6q2c`0nCLcHnBf~39{2p*scH2@PsMtI|qdxrM9bikseYOzpUMZwXm-$_YT zPr%Bfv3odzOT^P@e%-QvPR0F~Z*@XmJ(r(nAjRxbB7tQMVM zbu7X6e7FnQWh`O2o`+fqrfBr)czrjCrN_!@)I?;(7zEy015Ko3$W?|yDI>Z={34l( z2tPCaiwW^g{8%Llbfv1Xyh%l~!847v>6ysU*EoLcH1^i2Aa;~=v-G&<-QftC?;yZl zv)|lDtTyk6ME>aC%^nuf?cBw$X@l}l+A%F`E6o{g1>kBPs_jYi_%)~O z+%V3%>MES}xZI=ww%5}_o+DNwP9r+W^ReN-9kck#<~v$y$1OF;0Pq+sco}S}NvfOG z;#fet#xZtR287noCkgi2eXIPJHX3YG;PivH{vsCsxy4Kx{F-LSZMI4!Ds`+7_=S+g ze_WK*M2n-XHb>SZK#ht{LyuQ|H{3> zN=5ERF~E1!`)a$i$;74qvB7HS+Ny_Isa3@?SU*rO&7{zYy>{Yy5&cQ_lr)}*H0jYR z`5^HK@~t538vsaVcjU2ZA~S>andny>s{!I=@a=Bc>Gg2q5kOflM_c)V^>XoXc|KYG zdRRRE;(L3z*_KnQ9vdnYYszk<^Q-9IIbW3lL+ z7vx<1(2QPFy_}m*^T1QV1A&=rsw`9j+5o1kZsO9|*ZBe3%arE1Z@~;K2<7X;&yfDT5*jOYU!WqCJdPnHFx&BP z@Cu~eFyCz1SSLk2m^yA9VJDOj6fTA%=-sI(w1tT@WmRRdo{WFpge~l>+zQBLYkhV1 zRXAx49?IviA?<4^@no>!n8%l8I^!baj#>S#`j)=u>N(T%lOp&wxOS{_gd0~iEDxR` zJYty%7uP|ar8$l(b)O^Nl$>19Ji?5Juu=wJr-vm9i&amvPjy7&Y#!f`ty3#Ow~ha4 zw1ZJp_SdD={<|UyboL2B%`L6&rdD^S+n2+!XEfx`C1Vk1MEa&J{De2z|Hs=~K-IY< zZKFtnyGsZjoQ=D?ySuw@+%33Ea0u=mJUGEMSa5fDg5?6|`&8`bi`uG+Ld@uhMTxOJxWLMNyiVgji(UV>k%2nFWD$Qt&;S%DLF zbB0lEfb&DvpI^zesNRx_(t*tA$6oQ6?nV_A=FEx1f6pwewXXR(1_MKpWrV1WBMo|q z0}<_hM7q(obNg_XTnO!6PwWKlaQSx4JNrPGz40oV%p3#9r?C79fFEg?Bgbwc@lEI2 zk{EmaGp_?jEGRV|-p>w5ziy{h8GH`J&%Pe~EeHeO5nRo*CQh`FE2s5|<~5*rz*tG) z(3(XQ1N$e(q{l|``P`AfwcUA_s?qzb+&m4MAw`=+q%I|n4h2TAG`=L!P%?~!f_JkG zdPC-PQ)|}E%c;yGd?{8JhX#v8&37)vQZz~Aa9a#lu0#Rh1H&8fT%P;B1$CJjQ?e>2 zR45G3B086{yWCd>xxU)8rq~+oDZ~j6@u@P)JQz8F&l7NKb5FEix9L|o96n>AJXBF6 z;bJVDO9e7wGn2r0i<`c;!m!-R^Eq=AD_`2?p(HLD% zZ3kSjIgQKtcV6{hO&6Fb=Jhnd3HoIj*&{%{QSJ+&=%h0GccGP^5i`fFi;IPm4X99S`}+>SGXb#JcUboL$#`-B97l{az%xcL;PVg_dB^4#Ocu({!RJ z_^?*sLzq-Jc&!$oA~FxB#cEN`m;`nLkQUB1CKMr%$!#}#gvr|mOM^@~bnfbFM?xYK z^<_nSoqb2@@1d-=DppFp+qK%gJlw86agRYGl3B@G-q5sJPLMcWn)G)^`9-G%VUr8w zx#U;e@PW5{(MYH>w;h?HIj+3C`No%2k{S@z6=YFGHQ=mc!?JnriM8ujW^I79cP*X} zusi*x(V+wF9&I5%HFrQUi68%oZHi=_fC=Jr-3MB2?v$JxrPLX2ak*0|jlEvK0y|>u z@o{#0rcn(}N10j{UBu+_+_UtEf`aLDDRU;7Q^TFPSothnpn>?3?!~2txw8|MB8GJZ zgE^}q%N)l^$Z{NL*Styd_1oO7c}xJ8EGQc5@sT{$Otr2>Gg7s$Ay6^}6TFtnpv?%d zkw~_V-QMasD-Xt>`l4#W-gt;lP)Um@(7qz4$?IeXKK3Tlv?vmu5{K1p*VS}4Pl!eZIg0`cJEr|ZmpNxJ-0=P;-`c85DhDO#bRPvrzU zVn0;x{A~Ldnb1sC(W>1C=UKOD>bZOWnAopv>3B$sESg zRE8m$W2Z?r2qWhg13fCgaylYNp$2*29NdMPzijn?bmQ#!j|H*P{L_-qz{B>#Df$A!T zg`^-dL1&-JR*dwzhAnBmA=QA*0J|KCX%H>~`F0T!1CJ9?y;%3d3#Nj#; zU+&q}tS;**1 zSdy^*>9yelo3Y9#*!T{Q6#O7{oK9TTt&~}teS^tmG{XRZR@>OrJHoG@Oo~0jMPl*a zq-!l@xZ$^6Zm_$B+fK5bPbLhxfSn!4+V(Pfg*Aew>BMeB=~ z#)1Vt#xUrQE_`~3u%$bOgdUmdXr|%R_gTN7`@Fxm#1|#aW7G0vN0^kaR6f*%PnNCY z(ukjG)9@w2&)CGzvhux{4%)PRnM7Q7`@jZza~T%CDl zbzI&ZRFL9xtGzAzPCQY7t8=52Gf-!t<54&;JsTRDJZ4U0*p-ZNKQa7ewC4>`(1&^TM~h;nut}ju zjb$jl%*@Qxy~@^bWa=Dmf#O;8E|MmdZ89z;+fXOr2gjoyF7QNgATwf$dsW+PAwfnOE`kipgGIA;=+~{b1S@vGP_;#3ZsqtZik= z2tj`{i1(GJzk~VS0Q90Z#A}q_EKYqt8@u$qS#Fxh3j2A)*q$w(R_s_;L@J{c!x}98 zn(xJcwIEu4^-{enS#aG|o9B6U$)`(eYO&<8qR^GMK9*Q;(Lc``O^$z1*S|Zs&AO=I_z*#w+5<8pFZbxa_-hu+uJRv^`WfIY8A^dIsH^9 z?p8k8lXlxqfbxSC1m9Ljo3l6$5zi#oHG!%h-`Z3*;x-wJD=ki~&OVub3{Jtykww3* zAtV`0yf{yu{8}iJsIuQ%Luko5q=y=yaw6^MxREh)#24*{!E5-A$*Zq+S+HCky zD1g`Y1h33L4emH|ikK-(c)Ojwuu-n#>+`l@AY4M&tCb|s;d*0xaCg!E2;;3Q8QPEV zq%en+zVJ(qf?IhLboC0`g3JhD$H5PZUdagl*2vNgA7I1T$BiSqs}lNncCxmDU=`0I5N}JEc4QcjAG;sdhnzEp38{nn}YZ1{GzP2qHP=3@m?(iT05>yv9 zsIH!|?Rm%J7?-=AO&dN*Ma#=yV>S%6*qetvgJ4AtZ{l&1iKt4mKdD~9s57Yosfgi) zNvo2?CNo5m#f6a6V}ClCdJLD z&>`BtmOiNmLK#&dz3I=*E!^NWH`GQm zkDqdPJHgE=zx=Y-V1vUtn9TX2B6Yr6A;~qXefsq?`)ohNRnN>tSXX47eW!NmRy%@K#pK;p@HQ$OyptpNdi8b%1ybZsim`QG-989AnL3v z6s4aM>BCzT%zR{%ViXJfrHYY45v8#Lsuq27vv0IlZfJu7xU4e1NPYW!BmjdJGh=+Q z@d$3n-C@Lt>+ZeW{79F3oc)7r3rXr&hYXqOOOb_Yyohi3A4}{ZKmMvdkwSOUOrqemf}7g|*kzzum0Y8=FbQ ziVt@0`6O`UY|d81kGG#RIj#$nr@M@UwRLOeGM56`aFlNdTSYjXM{4Yk;YzVOHM6VW zldj-YU(#oih-YtCmPjE6KBh~Nx@BJh>l!5u9)40tyd!BE4o%L?e9(p~l0-#dVHJ7d zNxIPF=GKkMTL%&y>1r!EB2y3xPxtFA%>|)D{VcNyqz?v}SP z<+Nn$>Mn;lJctzOA|0(P4eFqQ>PTr0jnu|1YRJp}_R?a*)_&d5-HBv^Q(0w_=!nFm!x%=1}sA%=>kRH!xHK>7o;|nSiPV(QOr(NQy|A{I0})B@v-8 zpAQtn=^TA0B3G;}hq)UvFXgB;AOXpirN(sIubDF36cbVk1yOFYO)=#i{+d@1ewq~E zo6Bd5u^)?Et_aORUaZWd9Ke_*rbynDjBl}^b9xUq?T&LFD#ywW>gX= zj++x2Y5dB7OF1xMap$HBBW2)jS>kxNJ3w_fr?2N{x*u3fBP2n(0(AmX>5%z@G!Zxt z%D_4EW0K(er)f#>52^N9(Om?A#fL$HBzNL^;T^%UUFH|GEZ0C1bC7QQ`~5Z4%%z&Z zZ93R+UY|}UTcbhgw}ooOa8N1MgK68#1cGnB2t)2+98@C}vD`kmAEdGyUTa*}lo_>f z>n+o46N*k)2@voWqBWuF z)70**+R~=gF)(4W_Zuh+8eNx~N9-6Lus}`DKzZN&K}`KdnV#jw;6p9PHx}M3SeMpq zwILsf6xMe~=Y%mrIAryxB(`zE*$~#GUAi@BZ_cH;ubbZViNIjXnarH=-DjhjfN@|w z{VZyar9-+I;N6;iM`(tL$L2EnNSL8Jwz!XXc0 zPl)i9Mn~%eWcl(6VHZ#{b{~g^7vi9-&PSVbMr|poWRh#Rj7S%50$xOArw+BoMBnM+ zLzdpL%^mTe)5ild#kT$C!zyAj9{LjwZ% zoHsXcoTv)usExx1xK|^R!w)g%`EQWev!-asW4vxFt1VO2j@I( zL?B_PeNPc6D2Ae}Q_uJ$;pz?}zJ7fz&Su;J`MlT8Y9K!NM}%|?ZOLDzrPh287voTI zN*_u5#W2?@GIh48v-2iNZ?M4Mo&U6_E&iUIlAFrUypcetWc(H%)L5um1~02uheE{- z+T^NTfh?vk+!KZ5yNWW!mtWHPwtLlbV?@Ande!UzQp@mfcJhvjoH`*AN?YS3K`>W# zRwb}xz_A@bvr1pAMwbT0fMjm)QealA9>@%mY|Kwh3dqYXE+WKgFFzCCWpmM(U$8XHor@(a{yerWaTxNj0w}Aoaq%0O$x-k)@KFo?3Q~%C=;dfdVxC=%0-kpP zx?O}yoh8SGu?|Rhl>qD)gn7&&l%p|Gox;9 z%BY~3)F}ScgntyI%*#j>sqRT7Hc49OM_#8296uO*D@x7r?rlNMPgSA)cnYc;FLX46 zCU|f8RKM)ox5dfpN3x8Tr?|)-=np}2MaeD%a|h#T@=@GP<%cL!6ToIz4JtS{ zogUeygUfbWif!8*E{cMPz(cjq&?7Yoz9}nXK^Dq=;bJ`I&>Wa5&Cnd{38QEA;_$F& zgi*SYz0{|B_3_2gq%1vDHPvx)%5y9g>e<@QI!aqPI*As+ux)O-Ke&n1K4CVge_Kxu z(iiyDr+%s#^NWQnsWCO5e&nL34EkyT@uXi<9zSsT2y`ec1mol5IzEmu^~8>lTf|Dd zaDs)RnNptFs8iLVM9rr(H_*Oq_4gs&GO;CO5)Z{$#^N~rsaDM}PJRuLMKq<|5h*H8;Fh@ji0!)81V~Pf*GSujKhV(l5R@5RHBngi? zwax=+7{)b+oTp3D)iTFP;G4W;t+m3rt_X6>?o1#|3(;~q6jBeShjw`6(nV+H4pzUV z&29z{-PmT0!Cum>bvpdKXu%)YYER5T7h5DfUocsoPJ* z6X0i&Zomvqv&a5LZDg`d!*+RU1W60l8vVGGDA55gJJtw2rIZqdZ7A7~PM~IfXwhcefreL4hY)qG;N4vd4@FKl zO%T}5Gstqr3dJ@@Gcuc zF}{He1*p9Vofk`LI*VuHP9S7hL#Y}XrD9Z^HKnV+VnXsP9sM`O-@WtrKBVF(;0IaC zNz`vaw$FPt50v#aKp9IapO=N6H^6xK;(6bjC%r)Wh$grxtr&&E>dkH}$deOdH?QZP?>ond*zg!iOsmNqTGD)!?HUV&3BK+`8Ke;*KnwuO=Oz5)Fq*Q#0O+8P{=Unw`Bz%O@`xuW)d zt``>8UyuHqisM`m(h>fKq3=FrFAfR}C92FLJ}!J0&uTP$mDncdS}96i6W zhXmq*^^JIFKOp_UcARhOYHc)Q{j9o@Gh(#jHO8g7&EYfSLCwrm0k27yML;JG@8AUmb%Z; z?`Fv-rgGt=R{o5{R;8NALC#)4M+)eBn_)!=I}S}#;s!Gjna+$~q0>sYGvC+UX`g-& zKwp-(7xHA8N~4k8N)BO<-3QUwepzr@9RDg&5pKc2y^#aW4iP?az9GkmJ zOxA^a_`YOw7BtJRO@ zVz8;`>Ff;^K3Su`n8KO_*Zuq$3auXQPJYR>^$M(7UHTzX?4iZ&rUuM8b?SG(hEGv# z{kVm51ltD!G;Sk-zKad}qa!q!c?u4^c4!sT;dV{grz!~!2^*L!$)ZP5hSse$p9qkH zk5kQ?H_48s_tPdJ7M8e(5D>`~%UQm3&I{IR^CzKtz4d~?#sIb|YX}5dmbhG&WlepovMzhAjS5_qu0_RFMk6DOT0XJ!v|x; z^1af6tRLKEM&U(!NaIar>+AMP#Jg2`R-WY2j+neEe6V0JpmI*JK%yxaCw^37OR$XtHV&i!v$fdB%2LUBk+#>ca8Ah8bci%u(*lZ(!|AgHg|q+Dy` zWRhR9FM&o=OH<%YvAEIa8CcYlYH9Fhn$3C!jeM(XIY^irs-~w*Fm+q8uPnl5)&2J8mvFSO9Ln~Y4@rWGhv0+Qwr@eoa6?gXl!ioB-mc{j zK&UDj^Kmj#ejI z^sB_cgjl3si@(+zVFr%&55iJPdmgExHdhv=A#&@#?WgG~eyv_AKNO6}OV5)Rs_#=C zU#x8S^^pWANs;iJ+CRj)31(kf*=j#c0H1C(O&6FX$fx$nlqF0U8NNH&3SXr&iQvBG z13q0UDe_3okKVxT*)KvT=)E%~bg_1r zl?e(%xN{WEKM<@8x=~V7j5B4gDt1IVa1uh*SEPhTwIwC!*W=>4>vZMXGFKGfz5 zBN_XZ-HMoQ6&KS>bUEDN{jt1RmP}bmwuCs&^Wll?+>wsjOnq9}%aR;xtlv;8{M%VR zc#Rb`V|jm-rAbz(8BQMp7Ms7OR)+YAB1i^1zQyuMWq?F1Ua^Gofkc*cF;i=swVj6= zXT1rF3Hzr$CP{AI0=A^Y+LR=jYH~ao)U}UtMJl?KfrJ*+Zz9SvVTz|4E&}Pv4-8mj z;W3fc+(J>GSY2a{w2;K&=DmV%B@^sF>k9qiw4`6$0Vhsbz>b-b7T-X=q3=FE+Lru2 z1-qM*P~hFk-|!v=*_a8PxI((cHQf)=&G`xXC;OEfzL8v-InR4C#y(KSX3+G7wn@Zf zwEBS!S0wYv{nqDm9XRC#PI%#bYt=^+tO`3mav5$&G==h`zDwcm@^5rdU7GRT9+_+2 z#3Jxey|tH6UoVAH?3BNe4v+hZ^7RpcBb)+N5l^BnuY_!$UVspBdQFcSJIbTo#QyWV zh0BM;0)+forc3AS>|~K)O*KMY<=F7FA~7678j?3=riMU`?IE%pCVd?V^~@*faF6>X zG^HmCO56EyjFVZnv;-#;7O9f*#9)UQ|kj8|IT@j5tpshS+S?rXfgkyJ8vX>3Hky<6lia4)7SGb57Eq-5Ec z)U^q^kQn^pgBA@Cn*A3sket(Cf_7X^!V*pjPN5`S=JX3ej8z{#jW8JzbP*OPk@KU$ z6UgWyh{AHm;9$@PyxVl=Ew=)0j7-^owdizb&{uhsogPR7M@w8|MoB0%po@oEoJ1$g z3CUHc^~gur`DQFpTH>^j;H5t`UYsKuOlQ3Q=`0O-X0Q_U=kYPjI5mliX8wTuKy#Wi zUW*OkK{LJc+ilPoQ!dt)FS(h;I}j)xHYXOV%t4*3WB$SOcO{hY@Sr_ryK}ZrZoqYYVhEyS6GO8dlD)(m~%vtd4d z{Nm53gKYRF5<7c9$2oU7v3!ntq!DVNJm-&P`2x|xv2P$EX!UfO*= zruPE5TpH=p$%OhbBwh^|@=?8bhm`m9!{FL7B+!bY{c-wE)9jcMW^tRju)?w5z$``P z{6p1Fp~eXqN?7d3OGiM@mal;T+{Iajpz;Q>QfWWN|F3n)oN%H*c+hOi7SU z$uy?pE+3Xi>T}`SzU@YF)n({7$`Ku)K&3~^fyG7Sf`pfMo$!lc*doKSS_o_15(-y- z3@O&*&lT0vzedbuyE^LM^0%IqW8NBHBzJ2NOcAhm@&c7OaeiEbsU&#stR+T_#EJV2 zVS%ZsgqWlRB(6Ip!5XO1mbeD3xkam$QVH(7Drkofq8ou8MJ&c6#aPp4r%ia-n`bh4 z=sA;ek$2;@qozcf8p!DRyT=m7K=^%bk9&0$lnIGNy(%J*vo|UV~mhT~2S)$ArkZ;N4^tWMc^~uDn zcS_Hw<&9Rn3dlNTnXA?vlv>nV{S#-6O<{mhSU(2E>v6Pa@$m-lMouNAt489Sia>Jt$XI$yq3?`ExSd9)QM?rCT5akQJ0Py_eSCBdA+F zy1Erkp3JpjXj)786GW_TQdi|edm-0}so*yqJeeW=u8OPbk0Q}DPX*;uQF;Vljw<3C zEN+e8qKz{LWAc_!yC0c;jU?gb1d>HL;w-B}B zw=q55ERGyI{C=a`l#_&mD&zV13H+2OJv-b+u;6@oi>m-QLGxs{bYpr)ZdE$2%_qp9 z`!iPhIQ`9=g=xU)4P@$uhu6Ot{#S$kavO%8or&$Y;s5<^_48>uN^W+>06BeAV}P`= zk-5Hrtt)}%%N&4(o`Hasok1H0pkV9xe6|h&-E%GnV;e_;m(PS1o}-O{woVR)#=z%7 z;H~?82=A&etnDP@A6^%-@`NGU$Xdzd|vOd z{u4j{dw6F0Kj4}1uRi?UUw?Jiv#xknKLoG(2S@;rG&cegXu`aRPXUJhPv`af4w%<5 zpa8@0db1ejwZ|1;UIqQ^{EkTUt0)JV262a7C?a&=Cu$0M)4BaxBKY- z8CMK1?EY7Eykh;oqxi2|{)(6Xs*YFr|4AXB4>W$UG5|FJ2{~ysDkXDkV<3%yt(DQM z@ewix8akNUIodi9JR7rTO#NZ(UMQZeleq)XQP51^fq;<#Af^AOpPrQwplWX9Xa>}T zVPK{sV0;z=GxLkEfB#-$USsKAVt(g&aT!?IV3?m{|C8&bgy)>B|G4O2*q>3&`iyfH z7S>nyx1Z&?$*inwuNNcROEE4wg%GW|@(^jzc%`HTCznJ?kr`G5P_UIoMQ(pZ?6IJ!S5p4oe)dX9M!!%Ka? z#qnG(`^%92}%?un0lQL{iXxFAndPzs<{on4bc3ru#mZliShH4=y?vL`K+$!04C-D z6Dyb(3|X7oI03c)QN!N`-(R4W<`>oA7yJ{n3bxkzHvfX!mv;U?K<(cJ`_di1ua~a) zXUsl#-hY7DS8TsR;2(nj3!Q(W^#y-_blXeHYmLufc+K^k!uF^CIs6Kj-_$P@ugLuq zoWBwMQqM~nzyIlAUP7?o0gdHoSoJ<$4LfxG&@6&$PeV`J1!f`CigrxcObi zOWDuV&#|w+KOx5WJihtan>fPIGtvVLoUE*jpS}OLaQ>T~{|nAiic(^#Du2RR{MpEw8~#r`zuMOS zKnXwB{dXn&KL!6s`0uLsKh+e!RqO8(|A5%<&>y9|0{OZ7{{Zt#=&$tOzTf)tIoIEz z_;*OX`2R?K1>!#d_6o#jSifk>=j%7kOF1vxy|{ls@UL3`t(JR+>_0*0bsq9>q4T#s z`+uk7{-)Mm&FbG3=ZkIqhuMAYe;Ivi<9}nI1)f)%nl#L;1T+kEEClRq^aL#IY}zkp zxjr93%LD`92O7RCIG-b*SC9I3V#Y6!{Ui8N$xGS`B@EyXxbfSVT0O5*VE~Gb#?~qX z^h~TU0BLg|@Yw*o!s*3YKNs|D^PktMD0oVX+%x#PT zwgB7be>;HP%cA|2iC5nrEZ99a!`A4Jk#A&R1#kcW0l?>TeQf|hb63D0jRM*|Hwxeg za5Qr;es*1K0ZsrX8zW-}prNgUF~Aw%0&oSm0o;upY$;wl`sG01XC3`I)B1s?78V|!zmDr&&Jl zp1#i&9dgkFrys=Eg+xHYhZV=A{{c=PDuymZALVT)sP*(rwuNO~eId}g?!tAnbu##( z;%06y8^2k7+K4-1%$17J3T zST-dKI`1Al@`e^N;@#!?yW!m;tWz0UyTZf0Au4#_2hXO|{Pgx_9=Cu9hulmz-!ONq z<$4M!iMxqW3R}P0O{|-D7EeAkGFazop<};iwZ?FZrH+>G=^NZYX(cuch*z4trZfmx zFF50Unnirtk^kj`SV(Sh(%jg6fG*0?W4oBQST-Nm$ZW3ZATf^MbUHc}qn*8czNF8y z=0S8VavVO7??te!cbL6JrBb26U1)ebj~SKXwS#^;;zOa=*>x!lF#TF{Yb#kmlhJm_ z9_Ai3FHKXJS?F1WJ_Toi$Q++4e3WaVcwfvu1!_U-6yxs4A%s^jqj*t7JOyFF@+>q43VW2)%d5@Act$cGcH_N- zV~TcJZnmqtsfL0l#bz0I#a@BzLMpg9y-9JKTItpKO+9cqlPgeHh|N;;yBsVzjgzrRxjqNO#|(JG z|KwfsbdfzKs<5=ekVeii>@+u51y(-2IK+qiIM+G*>Ev4RHc(vH^mxOI zvYEG#df{FFD*rrM(HO!wBV~WxX>bUK)K^JE6 zT50c%30MzyV|%nV#8q&$ht#x+(3bnDh6K;Z*%`mNw9s-3XNS3i>L6KK_ZldL;!qAX z!}P-f>r(7j@e>@AvMEcK@T1nf>6d*`4Z4-)iJS6ZJ|fJwkbDy;8JAn}{#BR>yPkC# zC*kBq^j%y|1BXJ8XOQG0fwAl1XX2665<{0W=UtRvc#CZy(c5>=PYq;e!5sbX9~);Y ztFSP-9H>9mp$gm1Ncr9isJ%5j3Ap!dX3f#Yu;=>TJTMsI4OWnQGUXBPt!{^1nXqmt zu|^}DyB6G--O+*-zDz*-{eV9~ zF+?243X^`@YalM7=uKK;gi~%@n1@i?0`8NY#~CqVp-FPskrj4kHQ&g>crg7=p%owR zvNT^EW5Wx=`Fjy&OD*`ZRh$=UuZuaB)&$8|OykkPPYEPlOqUbhf$D zW=03tK@E2?5~A%cWUOAJ7EcSmd&56J+eijLeX~Lar2_{15N5Cnw>)r6D^|(6tgpx6 zH8Y#d9e`!`YgIKFd~(J+a>=s`^`@s^sLn+MDZ_F=h<~^$mgViOrsa2$OVq^$*%}Fon*{y39x4gYHcWNw=i$l9JR2y--rQem!H0o*;l7SvXN*)qa zF9Sn44t84(n$B41Y_eC%8Z`$2k9iha#3H0seEIq2(uI5)XFg4E$!spEnfKtj*)Oqn z!_WofjmmNk;*HK9qx`|Es^5EXk|IdQB>-$pVC4bW&G1bTarYs|ALU#=(wSI>5pj(I z4*BjZdaPv2_v88B!-F|eenDZBV)RTTn9|cXV=EYjGuzE9IVV(er$v!`rvP~izk=%S zz!M1jY2lKkGTQCE8kFf#nTx(j;vNUM$8PovkEyzwjQhtgJjn*l z82(>YhX|z~6IaB=O;=sa|E5q;(G?<_t8fNAq_K{jIVJod*lES-k z|73jg9xhOu4E%ITPq*aj$uD~l0XsTuUu>jnSh?%WGzO%JwSV0r5eE0(K@x(yp}9rk9vHZJO!%bP#v0R+NT$$xR4uLHMz`d? z^w|;K=^eP)i9QI7-4ZD;I5cVz&^619uwKMS^OYne{RSur^y(damnXm>7^Kq*YKvJJ2+}&D z6evO3Z$aUNhL)oMOi8KU5I|otBBxII!Qri)CdSxs5Q^{Pj5ZUd2S2AiIgTJ*_Z(Xy zRKnMk%3RgYbCz6`d}01>6`uVjkq(}QSzBRZqcqCZcFr9q8kV;NK@uuNI#kFn;>P#a z$Pjq_MWr|u0&B@wHqVsKBrwd3jK?u0GFp717zs6P@w>;?LqQoFnq6@l(-96L;*J!b5AUamZ0VwpX{l_z8oG&>85{g1Q+ZI!)o0}@u+TP;l(Avb5g38LI zcs>LbE zI)z0t^+sy(Js8p{ID4@&X}BXR>6{F_WQ{3Fdcl$So@x?@0_B!C9wNG#)(9p+KIM75 zu3iL1lEC-keCM~AuAoMx?VUEF#NP!s8H#!!&Dlaus+_#8m}PpjELVcQsbRDjipqK3 z&&i+JH!ZwrKhr+-M`Mw}s-qWBJ(1jB$|EWOV^yk~MhV5vFQ=3h9R8D*+B*WGkF95B0Zq8;n@)Mk%X-k!0oq3^eF za)Ec4>R=GHY|LicysG1L1%(xEe#rSQz^e(%MJoqwd8BlNFHZ($ezSbKeEX-|!Dm&p zQtJW_I80%|vs2Y$8Uga{r!^ie0o)r4rvukZZ;tPmvjJ9%m$Tvv1B;`C)?{DZqAX7g zA7L3w#?6CT!gG}`M?57Fs^7Un;;|uVZip%w4WFC4e#pFAURkjNoP}rNxfT9L###2=c09 zgwV^_L(L}S&!inQEK;W;-L|bM9+xkg3OF{E+?lWsaBGOSrx{9$;9`4z?BxX>EZR3J zm-+qk91cO^r_19VLNjxZr)T^x2ACSM(|@Wxvoe_L_c_Oe@iQ9L?RjEQM1wW7SuM09N4V|<8`g8j zgdzYjr~n6-?GHId2})i@?3;gkg0x2pQME+7sP(y&uJv0-`Pe;X0NJC4lcB1%a1`xW zOj;W0$jqi`w$z6L_34QtJ4f9mpvAz9V2Q7*xkDfi)??%xt{t||2d1}1`wtf>@;fBE zXb)maZg0z+h_{{=3AL0f0IbV~9ce)W+fg}B^N0)gD|{!69m5{5?Udhc+zNHeDSmXo zc}x~)V~aoigh((RW@6A=Up7s%pvu7K1gEQ0B$E|OC{f69U?B?1`o4;~m=QjAq*Jb2 z7FcXFo&4^)Q)ohkHpL^VHH2(Dr#=-#SiIke%Vw|M4LNbb`D2;9dL^DxWdtI$aIn0c z_I{+0h@(Rx4<(`N_ssj))wh-2JeS=8++LHgc?-{9@}wF}QJULY?|LZ(mdOVqzXi(U19aR@k}dpth`d37^Gf{tjaK>)r#LS05j_ z`LWhJsq4@t*Y^n8<86n72zwOms1zp@IAE01(xH_n_at|)mml^4?X$zH_*$*h5v_jQ zP%{2s&#=J2deeLf(7J4pKB5dhY2~=#v@z}*E;c%I;_8nU2^RKWv(^aW!%5Bo#bEGU z+r!@X(+-eQUE1yWXk>>=&|nPpKSd<}YUD!|gctA+$E)fcL0{EVjIC!Y#kuE?zO`u0 zt*L7&&o98tAS_A-!k=LAe_MLkkMMWmqKr7Gsa3gvIHH1--Yw~JP1@Cmg(tkFae+cX zI9Y8oloyY!tIF$9P(0)t&OPqfaW)gkjW>oik7c)%>H*eA7j1Z{tzJP;chtJ#xWgGc zv($)L3UkA;W{%bA>VA6M5sAsY86$$;HP3l?{;CKzA_VH(Mda$nh3)>Hm=o-$LL7a@ zR7JhpRXoa0S7T_7aeAs^6%wxG!3Geh5Xv}%{sDE=UG4x=8-)W~R=pl490Tzv(B8wi zA*UUxhU{}d+=wW+%Kba1^mxgQ7RGdQTSj}VI%vt%p+Sof5>+f5;ApH~F?+zn&tD#1?ToJ1DuRts(ck>K;}vtsppv5r}|(hXsl zj6R8{>Dgf}#epLT7AUz>^9qvo`sSg+7S$NaM6f`v&iCjANdmK%b5*&-_!tYslPZ55&I{IQSZ8D>vL#K5~&Xu&V8Y6wmf+!7(@1T@( z>Z)VyU7g)8mmGdBr=ntE^1&N}muj13b&2vWa3IwJ0ng7&teK;?r(s0q{?m3+G6Xi# zcj;@}(>xC2P=q~Fv8342)syl0J*foMWa;#`Od&oGWgmlr!%ZuwTp|0Z;Te92_rxG~tZGR!&EV%p@V zn8f+i=5B1lF0wd~Th!`SOf6PoZQ&=gyHK0ic>Y@hW%=n# z7&L#@76nV(dCD{`SK|)`x1*yrsQ|NnR4S{&pY4du<(!eN~v*BEBzq{~A@)aO3 z&|3nt>zh1f4BuWYz8!GUecLJSVeeGRgfymEjWQNuNYKOl(OQIAJ(1G#t1$a>@i zgikJpaoV}GhGJ%C(U|1OEP;vYI=U-%^5BN48~^ZsjSvvC#@nH3rMjZ3 zvzA*sz;uhdjiHh8ljpY27plWUJ=w7if?p|QF5#2*E4AHJ)!o|CKq~tNPN~oKfWu&& z(+?iIACs{;@BFpC&JH_Jb*|au2CE7raUyH(e!I5=EFZ}j zIM7r>Lv$>`S2Wkxw&b7J@5+>mlw(%NwPv)Kb=8! zD!r-M$Jbn`y5dY-*(C+@f!*{3Auw$x;FbDyrl%&Gx#+K2Gn-xxPbTYgHw_XY*pXA2 zp!?2a)rGan`!)RzF^Z6^1;`ll|l!}M}<*Zhnx!>;}qy#>$>xJ z9^U6;S@C#YC}kgHtcaE+zs{B3q8~;hcEfPt6P+L`BYKieI#)n(<}CP=xPre&+z{XO z=nPOx+^T{iG2+f(_nJ+&maw+=2yL3uqV|9-S$ux4L!`=Dq;wF=;!^fP2Ejl`G9b<% zu{ypRH3Jhct-ZS&TgSm^g+OfUr&W1sTA;;sU{ywaNL7`4?muXt=_XBFVwjrfEL=m& z$s$|=H#7Y>Y5SAF>6{PCB@p zfFS)5?Eh-*D}d@swsvus;K3b&!@=EMg1fuBySqCC4IbPb0t6?x1$PJ@+<7N6bMKwW z%>VxTs@^Gz+Pn9X?%u0+owL7Q-(rGukHXgP?rjQY z)G~_+CtJv6xXMCc`g~|;6OzkZ07-^lLh-u}SCRHTE*(g@o=UydjYKQRsK(beM9uy3 zULvQae(y{N4-_amnr=hWDtPhTKy}UaZ9f234gvw1DBeEa4;I$&H;3q+t-e~iA2TxO zMY=IuG_^kA;L>otA$>S$(J5idK%fYs<)6tTm1A$?EGsGLUvu%0ro^mRPQxLfK!lyT z!^V1EJ~TCX*hPUGX`Vs(0+ta0>3K&(=ec4{Jt~WL)pu zF)8tUYiwIL*;R0_wib2A79_mwdvr+M0WA%E+iX90pMe!vf)yV!>W3QT*^LFvRXy#% zF>*zPybO7@9$waE)v$iH_G^|^Q&yKTt)X}pw#5o@ zj`E(Z#ei3a=RorAw(QSN8k23dMmDo9ncM#k z*}6z-Lb?hiDs7mszjL-RZZ5C^?ZN$cOZioN^ex^6Ypow@`Z=P8_;b%KWF1fK^m3m8 z?Zs5}NbE$k^n`@S7|Jz9I!%x=&fc63pWAp7{6wm!qoTf_Q_!G0RePJ}CQIkwXPl+0 zh)=sk58^Jds+W{cUYA~#7&zeS1~ z8yl*Pv4R`!!`*9fSaWqv;B16KIdi6o8R%Ev$Pq}xO2x#)XiQVDlZCc7UA)mZ8v z;dDW&gFy#z^i2&55V2yIIpOoe z&Nl5F3R71Miwn-*(0|9FdFmy?#=<9Y^@{#=?QTLC-yOx!`6?)S{@o=GR8k}55In;xgd&Sst0;x-TML9(Ss-J+W*7@!F&edMda6FH)_DWb2;1LY$hI~Mc0676FC%jThK*l`~u(gpA z9wvg4bB9v=+O~bBK1rXX_641eVQ;j+Cg7DzIMq^+hL+5UZz3j&#C!ntdc3eP?0j*K z&z-gx6{`9%GME#8!0#Ho=Sk^keX#eS(A%b>0oT;;iFk}_e1q0Iv2)JZ-#j^t{w3BIP6hVO%d75<8sMM#(3ggPq-YKUqIO)_IsNsz`y0i$NrQE`5ZZtpm42eWX zzIjA)YxN_=b0O3&I`Ly7oI9&mId9n2UT&Uy7G<0LvJ!p5XHP_7Z6>5(+1TA+le24% zLBOAQ2)j^kqg#27P5@3@7KR{w=X1zp9SVJ{+bC78JV3?bi2ix($r(Oe;O6dZ!lx`bcL&#gLHI)s&mivd}MOp zVh~~Q=0ss*LL8k;i7YpZK@y%Lb>E#gMs9c7y|G4!DLs_3MLG)3zz`-oNQ#`VkuM@) zEOS)rQ!L{w;V9zB2#`kO(ofy(^=msVtJ)8wCjLzA%m+K|Fm8y99Iwff^Re_5Doif) z&Ceaxe}Ja{+FSi|8^M2r(Eks+k$#8hf&0|x04$tDoWP`hb{5XRL-fGLKST7to&E=+ z|9SDBA$n%umH!f={|V4b{a+#aKLPYV(Rs)J8G`?PlMBQDgv9?7`2IK0{Xcm7e+9Mw zXPeERw%_~#yxUm(z9ZmI5d1%Y@Bc>J|Bku;+$g2^C(Qll`TslS&J5uEGv@B$p{}IX z{1TDiB$o~3n2^8H)-$&q+0*XqoVT0b7x_uhaa_afq;dVa>ukwB{Kqy7QW&$v zdt+=$j;kIsg{Nid8N@DwrCS*(xo%=LcMJhuQD zuaLJBn-wdkR$imaGq)%Amsr-3?}sEJ5#l5=I<1GNck6`#rrj-oWjYp40FUj>hr76j z$@IJ6#mScB?1Wn4vf=u{HST3*79Lg#j_=)mw{8uu-FFazEq2kDkBq)bfm&O8g>=JI zT1w4DK3N1EI(S<-4)$R?ljD;*1_Yb!q&%dZA8$mw2JgN+bak7qY1!Cyqvh%8FLv8c z1&~V@jXJLBbZvEhqftZoa`c7Xko5=Drr;Q{E1DDR`z_htsC4mT;*N-BSi&v*-n8`h zcPNCY@GyRcXtnW+(k(z{Ef7QI+Vn*sT4FwuR8*}9lP_#rI$K7DoVD5Nf-PugDBR&G zU*rriHl@Z$%(uut=A;YAkj%WRf07$z?7XXXb;0j zOys)ZLpFex|3ydci6hNHaNE|Ax3y%D0blQoWsPe7d+rWJU0kNS#0#p)Mqe8{LC%VM6fDR$gjs1jNTsp711smC0T z%)0(so>T4F{mJ{9!8{9q3Pqi#$8f0$Y4&BX2cCr*p7fLm+$kkj?xS$Q#mRxJhpE3R zQK%QbvOrtqlqoF}MikVBwA`fJ&3H3;I$D4XNFo_0AD1Qq-K;q#?T#QEn*a_ghpfSc z0AwF`-@P|X8=}K#NguEnhus)06h4b}K`ee*T_f0oyX+Vn3S3bG;VAR%-jt&IklYC? zm37-T%UGT-0$00(U$pU~cyCzp$OcWU@|_eU>WFp2VHC)!e#$8ZF>leOyz%}1lo1UM zc39dr-vtt~N!0Mnk|Kr#sG^COHHV{+knj0@c3cv25H)CNjh5y$qGuO)Hj0wk~3Y>{r`MnkXnm(4iq^u|vlI zAxblN`(D9&bP0H5gpa&6Imqk5gnB;m2JMLq>43Vo&VW9Q@kxufmZ9rmvj}OFCZx>n z!kHvRzTmuvg5TMUht>8siS(3idn!l9n_^QVNjKgeq+N-y56n|8^3n6EXltk|Nw)Kp zSJt`V<-h_XMFcmvG$q(;s=1>?UtpEENGB&tx(xXn6PkMoK36(wHcDbW;-r_!JSNI9 zHZpl~7j<`@%zE{HJ5P}Iwo11NbB|{C#yuC#S!!K?#{6fCC!|#G!4R=M5ah4wT!gSw z6_l5G%+4?O$nOH5`uRUve5`O^o4mh2P!WN$UA2E#QA{a|?niw|aTon!u`x|YtXo}? zdtVtA6!00J_^qBUn~aMT>6}Hzg>yV&p;(!PT}HPFp*o^!|M6nIhxmb^|G?A%2zs6d zBM8?s*Lgprf!KYRt(K7*XaM*5CyvR+efKdpkl2#VCd&9wr-^JS?padnh^9eqKGS;f zT1M4xy)vyE-fl3(d^wwn)Fb+pHjkfHou&0x^rN4)!i?< zbp$5fLPVS@Sq8ajip-GBRV7aslqy2^DGIQJ&VTH4c zpp(q`hw%1|?P9}3eSzeVVRh2|rzGH0NmvM}*_rE@j2Q97ywmyS@P6E`N9kN=1-zP> z&?k}u|3F2cz>?`+-elOL_L*>G7ngR491;o#g10@^HCvYk!GgFVbHgAbxG zgSR6?D_PRgc^`u>n##tO_%iPk6c4ibMB?0uIN7B$vNKW0<3O2+@)=iAR+C*JwM#aG z-`o1RlyO>qu!jR@($GE#nWrCT=+oX4zXN5+L2##Igzd~PKpSF@=HfjlCiagiCAO*U zaA(y)ETSrW^2zWnN)?OJM=i4(nXm(4aqf4SQXP^?n`$&B@b0r{5R_S)U#vs;uqb8D zZZgcaJ8f8;lnF*?1g4?V)5`vZRW^*8yLB#J<0J3;KIKol=MkY`PhzIiNA)wA{)YEWzAsAHIH0t=eVK_WvE7Cv*9Zjhm4l&?mT!;DE` zO2z0_XA2sX~&u(+&F*O z<~M^XBQ9&#cwD$0wpBWu(9iWlSZNemKR~rIO`)&1;I;+7+hJj@vCkmQ(iWeV!>2sN zuv`e5TmSv9|;ThCTQ6M_%96@eOBJqD-_ z4ha%cO*`LG1Q3!nO{y;FjJGF3R9z%>VQb(7JQ7-0C6*I%lMkmeQ^1`z$Y%T4OJk^w zkX{t9SwmO6D^buvoN7DK=lOnkF~%MB9|)x4pMBD`gyUa5y(6L?RuiOXR?HCIfn3SQyBUTqXel1SAqN@6(X?Z1fCbqGEO{n@32Tq^T@*Jgp$;Q?tILZGO`mbT|Q% zgd$$T^+pvb6)U^UVK^+NM2z4`jSbLnn+#7E zePT+GzL2aTKjd>R@r>_S$IS?Pn!7$f_a1i)Bn|E0P~|BplRuLjNCzloido274uXb3 z=V95d9OZ0DRF{=il#VQ9IGZNSf2s#z)>&7abL!w5*J?=;f_F1DCWMidO%n}#x59P$ zEQs~!Me|+uJ)oArLu;>UmYDX$WaHqPBu65tq+9)};S3*4$10 zNaliM6(8sH<019y$@SwA-#4&CNP*0v*cl6du;`3PLFnD`Gz@x=NaM+&u$;;5fjPxd z#H7ywi;A_FM>^clZ12M!PmB>H7-GJQ&*TxlqGauq+BG!eK)5!@NU>VL&j~>7T+9}} zjnT|WNXaqUmM*W4YP{bvRiR4d_HqzRA~;(WEK9KjE7JJ-=quuM7cNq6B%J)IlqUdv zyiv&kPN}vvucc7&>P^=ZZ)SEio4G$6H?fLsvTKE~R(eDlXD(9Dm0gSd<`6Vb46#UR zJbpZR_^883A>5UiKB#jXE4Mm}rc^(Is1N9UpFN&8cvs!aa7T7K>C;RI-*$VPYnElH zN+eAP9g_-SfGo=vl(pUouDS|4h3M*7H3qFkUjgmI@@tWAgVNwen4IKJ*8(ybi7tI- ziniGh(;=5RMJiy0p58Z}e-CFXG(D;Xbn9EJOFzC=W_Cuo(ter9S)Q0k515OjEiC+r zV|(j_|0o(s!J*?QIwmYxLad$i)ax`O5o87xH#yUEAxkYny*b<7C4!TfFGXHb z|5jn?USSt5xY@=EGs!UtCVDeE#{64I+F3g$xtOe_N9{eAmSC(JPM&XQlToYuVY6pu zw!Tve6$o_b7=@Z!BjhRq@@n5p`P%OfMml}JZxWNd=H118#=-ePKp(h5%3JgmzxTmX zTzJOAb0jxO4~UEt#v1@IAL1Ud8S^d~^Ggu&;hYosC{I_bL1{z5z> zfSzXAbByVp0;AtmsS+$~<(O=V!Yk88l~2Cohl_ft1|wzL789B-o8FWw5ZSRY3ZzQ{ z=UtN>Guq_g{e9T@_+XW>WjWU?nv^gKj+CU-38~{W1QztfA*P3>q~wgTz_+8*V^DI> zM(ME@I($Q;(`AD6w(Z9sK~bC_t?s+VB>LIrGc~R#^dX%~RIo{eq)R7LgGuHu<)dmk z{qSYm>+u{XTvhOF&}>RBE;l-q2|i{r;Y?`3XkRq%v9&?xXJsE^ja+#U1?`HKy7&W3=|N^3N|O4JQ1B10ml zT1t#0T`m42jZXmoVj2ogD+5^%VnuPn`8=G&v-2$v84~;yc#FT%?46BKj?}Q4+`SoU!ebMv2Ph+tU`UUmYeZnK* zv4n@^O%dR$;GBNGNuD-@f84)MZfyBQ=M$saX}3if9_FREni!lf|5rG&MJf zxf91*Sr{2~a;UxFqxs45f^Lxo$rGre-k9vC$dg&if{!pOMVl@hA)dCA)Lt7Aa^ux~ zj7ctY>6T|Z>h;$QrOGLty4QFKR<$Da$`4E`C3G`$0bv_SyWB6D-toG{jDU&)n}wsdb9k3tnLVuMTq(lK$jqH9gK9(%VkB4kI}*a{k6sT0BSC3M4yka7}xC zN#72dQlOw%b6$va?m$NO!(qS!Szfo*SGe`gmp6`@d*2rIY#MLz&@wjA*6u@Z0`|Bh zt;;4+6wqOirgeXyJh}yIKWE@ei4{L1MklNu=n#;^SUs%2Zi_jHe-oI=W`q}4wSrKaF*@~N>+ze_nVvomH`+K#qk^&L9lY1drxpSA?IB3eSdQn z9H$P7L8TBBG@}yN4~~%ycOI-R?s;Vu(368!ee6+_x>84}mFKe?A4uN0zEtUla&z|e zF~awm8|MUJS;{a(TL}}__#^9BzRv~W_wTA0|1vPSmf{k{D1+0#lbzN3Dx}%u7=%Mw zX(7{KQ_*)@GLECq)^-4)7GD55W~3{ePy{W9&r>tWPsgE6yOR4hKPQeHg>Bmn8Ht?k@nqEWBow4??*dt$b?rL_D}_st=0i2>Wh{sy*7mwz`--^7 zKU2N*qSwKSa;PNGpCWZuemT{I7;(g>#*Y;VR*FKcb zspWDyp>ONl6_{lsX;=oGlYBm{ppENHsP%$uH0lS|neogM;~?&6o{BZPPtm!mZ$dKh*Ne`vPw}ggu@xJEc7T#j3LpoVZ1D~A~b6R zAc1`_Q{Yi(E865pK6)aq>s}#>k;M?!viF^FRId0aC}y$61ul;p(yTz|9;aX+owDX# zjAdSaef^wczB=6Yv2i@p0E#y%T`=F%fF}n=Y&ApY$9~^q|LDVcjNL%m`0Q-*QK9OO zRNkf-DOMb0aicfMaE2OVSVxtfH*b0~F^F(v3!M2pJZvMGn$FD9;l|JU&Z~V-!`aJ~ z6`4HrjNY@4f6coPDNv?P`1eQEgNmm?H{|(5f>A5z3r${ zG~dQ5-{cxS90y&+j2?jhVC|`tJbNX|>zTHxl3xnhSZmW!bI9^u*-3rw` z#u$RT)(`ec!fwV$YeDhdG9`{|q4OHxTdcOHjFvcsn!T87jRjQHFmvm!)Ei`g3haeC zi(T@l_~quUf}7(fe;p8NsR}wMw0F~3M-GulOfGoHRz9P7w$A=`lm@8Giw`xW2XC8X zNs&6ppOmr&g(tJ0P2#i?j|+48>LnJ0`&{AP(uSBi*|_LwaOXXilQ5EgQPg~2)EkA7 ziO#(XXqECI4(e0IV~_$9qNIu3XxWUjj&4_iia13Pg6|Bk4+BYw*H&ZO zthZ%rXE4w@0+S6qCMt}Zs=EMW| zDzZNnRI55E(-Bevh#y zZ0kANU>V5~WyrB9^|?6jj$@azH=*Y+ zGP;HFceu7GcUPIUn_kd52Ob+L&%jy)a-$F65Z+71pttRaszh*qHSO#YI6yUE{2s72 zr`o8s2VHIBjq=2F`TY#6J55i7@yNXvM_J1RyX5~B2>EQE@WQzPp?rBaV?uLZ9wb-7wT0h zk7X87(3&jRX_kFOd-Gd#ATrnui;!uG?J>EX|zRXXP^G~brrHnNM2lRR7$BR zvEt6yK+)RKGEzHbw7TGM)43#aZ2HQ%j72AbfnEX)Q!L$(vByjyKjnMT6#jQsM|jg& z=L{CQ;RF{Rt=Te5MXtI?<)`>Und_J1&v+4dWYZS?8goUeNd+>Ci3|CtnF=M|DGU)tnqU4ZYrJK)J%WASdhqoC5w zmkolqrp0Hfw`1@TU5B*sNO?r(Rg#4wBZfEk0n{_Enku`SWhSl@)uyE5GDYI(Ln78`RY2H4QJEb&drxH2}K2xUUK z*T$@AQ5tjwt{c+>r;Hgymla#}A*Zmm(H8jVbZQQEjm-3iqgNAHU~s)6QPx45tZJvn zKH6C+Z^+d|-B`inn^%|FT1mPDmnm~)YnDzO`Xfzp9)d|*`8;OO-#lrmvTtb*mfd4x zzK(^MK3x&K$->6$S_V2aI^nLum=f>g3X-Eh4ou3ct|;(1m%%Co&64TcAU|hi5l&AV z!sQC2?3PEzVe#sZ%=7CNX1svGyH#f?ULvjD*dbx!lu1XzJ=x(RqMF7xg3mD$&`RSl zz-U@X|G}bRks=m#9$xN}HZ)&9x9IkabIS!duX?8XCRUe!$~5Q3asD`{O+nB#G71Pe zQ7ygs4)HE5*eZXy`F-120Cb?yq^yjH(MQ~?kd!Q4_2Cdg0JH}#FArN4|Cz(>O+S3|saKXBziI)}-Xr|@ zd3{)ZbB#+d{3hv|hkRw_cvsf+E@ac>nTO5#+g#f!ShRr@=`mF6#KO9U@UGbpw*>Ro z1ZemtmG}?~J!NA7cY6)gwI}}I%fq_G=h>;5;OR9yO@3>T%i*V9u90vPHGS< z^R;tU!>mFj8?NDy%Opwz`RiZ7lU)G&1dc>bN$|}~xtDo_8lfnb4bDEJ6Kv8m^>bw{ zA;OYh1f{Yu3q)w-_pRvYRzFqr2}y)xFTw6jUAoz*f5@?@io_6GDAZH}!DmRK3_&7W z_i`?O*^!(|AWhl-%xf>rQ*$dK-)+X4DbMNpcKLHO;YI^*!2P-d_Cx}r`;EdWrr$wW zxC=ozggJ$}?yGICpW5X29cgzC-`yYY-8Vc85TG#MxX}eniZtn&ksV}omA@NG!a>UWInmcmh z5Rx%f#7jJvLx<`xGHGlyAqH z-T9BXk+sXgVEWs*^?f>A1VRwA?>(fQX?9nTHs3Pb&kF=L(KTSVm0-Z7hpJ%XC|t2A zWj)jREdYW~(A*DSmi`WP|4g|5Z;VM^n|AtSS{W%Z(XBM~(F!kH+XU6yM$=$!@bpHV(yZkF%`!AW=zY#3`2{rzC{{M^` zvj8|5|BM=^x!I#FbPcM(3`;Y3f>G^QX5$JG&4Pd?j>!^T83y&doeA_xYxg|cEtO7< zG9G0+#i&6XnAPWAkp~NgkV*7{eKWE{k>n^j?udN3#!ZpoasT)=*3?zCzJ346cYS^T zQ3s026`@C;k)q!WenuM8mR@#zR1UwBF*m0_Pme(OH6%h;yli4Cw{zknBpNJZ0xU%= zVmFV^k@KBC4#N9@#Ii5yP)56{!5b^9+_z&NfVD=J0);djTuoIiuBOTD=;P!PL|=cr zziPWmJRW;G;Jg#b%2AVlCo{ni^A)o=TyRytl%W-GIss=JjAhW4ap4tx*L~BGh zZz8@xf6+ChtBq3^ub^amgBv0H#nceHHbh;nL)4noFg!(smY9qJB`JamA}BqkTr!$` zBwX)pMD*EUVH~#U004U6^ewJFlZN;=+(kwy5jo=e!5G{$?$hsgag=yj=k8lw5m$vV zNwzY+K6TC`0cG69BgJjSu5!F!I!PAgzC^r2^%HVoyv@gY6FYeMNgEuer!hE{VDX*> z3>$6>$u3I5j3NCNKW5vGsP(uM-8pQIn$#Ptn>Liv?OZ6#MN@a-x=0QyI(s3=J{z-t z`$|S>#rF{662%LW26ZT>-F|m>oI&be0cUQ4qZCUV#}&M0>cDfztJ-*4bR{J!?kBu6 zj0mb5-;}DWJZjzsk9!8##ODhA05RP__3@j7l>)kZh&EsP`N83C>ZU=@91X8qkIhA{ zgD?#Q4%4l>)4(`us}uih%o2D|1zE z?U>n=GuJK5$^>dXB3!m4*ptqLJNPdh;I?h-r2`(|sMl{$&c z3iLo{(u$an=zfPAw%lb~6-=QRmZR2pRG9^B?XCiNb31;plvmR_1clxIEPAff@-&_w z;G%W2--R#U__TA*p$&4b!&aiAZ&n~mf{CzcvuqjpS+0i3PgGIn;^w)R*Pk|CdCtYP z2fMPlwAiYzWJ3MNII{rFb4`lidXNl7)(>l(+r+YI5V(M8MMGLKrJTVFV+XMrdVJkD zcDPvZ?#37d-`8(%@W6>AdsV`p(QV%3v9YbR1szqEUtIeW+l#I0I&zg;(A?n)7$u@O zZ4cltucLIq4Fyf>8--A!z658=TnYyJ()Ic$nPvr@g?YV?bw*-q3<*GPp(DuFJ7pIK z`G)h!)-GipGZ~W_KB_diaF#>#6Lpds0bJ!c@~r1FG)@=Kr|}clJ5UX^{G>7vdF#S8 z!DrehZx<0&X@=4?v0~wYeM-BD9gen5yebGfqmadbnq_T%;DH2iG|kr=&_8l1u*bQ?ji#3l5X|gYi&6N|fCS12CY>bZ zrLB@auoJcOHEsp1OIyeb30dcXCy%I3W@U&bD)bwUEv4e;eih>!Dxp+sLu#Vei=gkA zy{rj%8NoVRMRKzPUPh9tn07(2GZg5K9*&>H?b)MIVNmi{AVkQ_v~(LgT=J^+!j4+N zZtcr+Mc;;EPvRJ!U0HPIVT)v$1R!yQtc{lw+<1hI47~x1ER91HBz*@WRsKc(&g_S5 zvD*;I)d);bj(w^|lo@5X76HVdKt_k7gT2q2P9(!&@37(Z^8+)E{q?{q=9sh|g}TmC zN%c>PQ5d?ijY9JIKi>Ky;VlLZROlq7jWYMD$?VVSN%%s^@iKxJtm><%8?tcjVF`p! z(vYZgU)`3NI#z|9(~!o}w=e9WU5+~S9+=z;-2!r$zgoa-xCG<2ReJ>{RLx(m_mX#D zI?revG(3Q;BaeW|W`nqQ*djl{YrDY9L8c9}DP-5Yt(H2O3R4b@pDu^QiBHb zdQQa>&nTV- zt5@eb>38=sa{Sp)gZA)nj!uo9yc@VOx_X7kRRsQLN>zZc8EnQj_gb-XmG*UevTin5 zr>Hp0k96kW9tx<^?C{R~l?dgxnr)!uWgH9dcQf~L`dH&^VJF+qDVk?g)xhdLkBG4N zZsR1*=&2{tP2{FfS@LnZ@06gWmF8?FopjDm#ae`I76?M|LIYZ%I=>YzB*U?CA zqy=gVM=u(Kf3|j_@faNOjs;ADbUcil(3!)X*|5mbCXY1u+ktVVjhEki*Y*^UQkIfb zi1}Dq$z%TmVQyAoVaY2WLv}~yxJXHmw0sgD|!R|g=D*30YCVQCiu(Qv|8`HRt@JRdI}30*8iN;6(TGfyE(R5J+YeZg?iHO;6C0V0v8 zV{2)t>bxg5_asjXA)wUCUg}cTKGT}c_Dw2vGD(OYmIAzG10V0Hkma72U4FL|(Xf(l zJA9QQ*mQ5xx60382sa2yf#cR{S}ILgF~`Manqo)1rR~GP-A^Mi>j@M~&_mhZeAv6c zdvb8dG&bBQ--6V2P3JK!k74qfC@Xp0>%N?-;?9k^ z@_ncU+3o9J8Mo_x%LzZUBxNF*!@~St!o;{}bPY9W5l`Nd?%9Mpd7f$VD0dpSnz{YJ z{8ad+Zogb)iu1>?e>Kw`m~Ge$@VCBh7_R%UriMB#a1Tg5SJXpy=L>lBceIt@+tJ&A*t?f{*M-o@}@zn2na2>k!=r|hiwJevR=0(5lE(R!DWd-z4tp? z3i|?7F6V-DG90QJ?5lqH+ele{O#7o5S+B*H2OcZxO&ICfP<93`avEIpfXlD9n5ShJ zNLUKoiYBP?V6(omF_x#8-oEiG_Sb#68&~aw>)p;9cTZwH`T7bl$_XmhF&J``HSG|f zT9X72Wc&Mr@4LFtnnGn=X0h4!`OP7Cx40NF7_p8`=Hu_1k57f3T2>v(&N{s|4tD$2 z>`TSuHCC5nS930DvZN=r2+F89TbN|7_ATNxA8yJeriLl^1YKWi7Q_XA7TMF9AY1{lgT9AZAjHhtF6Q6s##! zLQ3(;8|;rZFVj-jyDPKR=Rn)Xo&-cub9ue^o{n1OI&b1>PV!j;{%uU_C%&qw;F2MI)V^O>~yt zK&Nk|S-xY}^Qw1Cp!XAN(YO0HvLZ9aP+{%qIEWPBS8gZ+-?e1a5x%W#;Ux){B#owU zMau;B>@zrpc+Vx5ENvQd77%>aQr)*wEMxr|X?2mntKT27rl0bm@NvpB$FQA>P+}-L zzR)GF{rWUsKqhw!Q%c06m31q1;Nf8}b$Xz8DrczeU?0CA!FmszG%Qz(PW|===!!Mg={9%+bYr zB{PL7_t{^#fSD+sqh0~FJoBU+IaRcVMok0fnsQgRm<{hk!RdO?G0n#UX#yoXzG*c> z3f)8QoA0&2{V0`rRg1aXE5U=$JhormbfV3Yayol`)_Uc{qCU~>6HlRp!drW@JbDC? z7Q9)Lh+M1v#kWu4T(%6&8=cZOr+N*lWh$HCqvu2u#}O(; zA6#P(&l?Js4&s+~286B!qeeb8Vq1F>n6Ym0r0HYl1b%o}5)Q*L`c!|1chYoYX)#(s zFga;|ar(}r0Y&T#22E-c{WMhtDhOs~?wIbjotkGZxi5yF5U-FKZoI@U?vU@;YpaMbrVmmt%T_H%Uq!Ls1b}+>fH)Db+z01kLIDM2$Sp& zNPf5hG>qO4xs`*YR!kqhVkT*STv$5!h?=bsvTN}JV)eA)SNG6Z2n4>%i%uC zN_8CYvVBH$p6egwDH97YbTnNWE>|Wy;~1R5>UvAmN<+-OsXapgJ6g(zK061;3=vtp zUfWlV%#@lS*a!!;&)>&TsgZ_VEL1rsH@{)2QsY3&IeRaCzvPNCrOBh0fQWFO8aZrg|HFfQ*59{(PD{Jm8jg_Se;Z%E>wB^MMkou~S?Y>Xhu-82iXs}y;ppQD|mw$h) z^cy4epWiF}i!1s++;!@*GXEm3V`5@w{rBq-9)5S=3m72rACaMnnT0JcJ@Ofs*Jq5oar2N_AOzB4;~0 zYby(9A^<%nJrf-hGcA#+BaoHR&Cbz^h>4z!5@^!V*py2VNZ$XuLEsrLrMa`SJr@Im zo0}WG8#BF~qZtDeCnqNZBY*(_paV+KIeFMR8@SWiI*|hX{nil+^?$3`I??~uCwd^w zA%lfF0~0+X!@nH;iy_j&&X(w>V*^7w7iV4)l0U52|H=Db%m6O{?Jxs}2Rz~e79B8l zF*0%Fr4*N!Ard#Yb8`Nj@0o~+k)9Di&qT@a$H4vfR2$v8NkfN!pX(Nsma6eixBWe0kwpGV{QCjwEiUYCoMZiW#FCT zGjp^vH6?Nd#=*}CW1^HSPq<9#9PUWA5`d<#-z+P7N|2}*ho1X#oQ;ti- z&d9|E$h#>i!b|DmVqwh1%xTDI2w>);9~7e$){rbo3!!ob7yVA z_xr(bdJO-u^$#=qTN7}>04JH@-^-B?j_Ci>=l`Ff|2%_$8DYGXZa<$ef6Eg4$=UhG zBko_T>fQgasHlK%seeW^aL#|m^g9u*pKE~;z{mk$X5j=b14c$l;2%&7xLp1hi9f>k z-9H656(8RpDQxbJCZ<3RTwoH}&&c}yL&V0)3aoQrO7wdhkVTgRNR9mSLuC6$8!G_t zlgjxoZ2c(9kCFX1e&N6L1;7Cu z@h`dnHqM_V82%y$)Mfj19863AwqNHDXz%a+V`pUjRSu{NpTNE0RPZG7S6xP z0hoSPJou|U7FM=j{Q~X%L;u)**1Pysm*a1-#>NIjuYQr^VE$YGm>D^KRxbIAJ!TFL zj$g+MWa4G|yFE@IO!ik@0O#M=5zs5=ulJXgk(2XJ_ruxI0LUBc2&`>G#Gqv1X#!m5 zM8J|mcEHj>z=x6|5rd?ysT~ne0ay}*K~jWBi$@H&Zdifb*CNb7|$)9tfE3p p!oorT0H+8O-~TS5^Rq&Tle2-N^KTCqR^S7S367jx^t~9|{{f{EcIW^A literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.txt new file mode 100644 index 00000000..b39b76bd --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-nbctl.8.txt @@ -0,0 +1,637 @@ +ovn-ic-nbctl(8) OVN Manual ovn-ic-nbctl(8) + +NAME + ovn-ic-nbctl - Open Virtual Network interconnection northbound db manā€ + agement utility + +SYNOPSIS + ovn-ic-nbctl [options] command [arg...] + +DESCRIPTION + This utility can be used to manage the OVN interconnection northbound + database. + +GENERAL COMMANDS + init Initializes the database, if it is empty. If the database has + already been initialized, this command has no effect. + + show Prints a brief overview of the database contents. + +TRANSIT SWITCH COMMANDS + [--may-exist] ts-add switch + Creates a new transit switch named switch. + + Transit switch names must be unique. Adding a duplicated name + results in error. With --may-exist, adding a duplicate name sucā€ + ceeds but does not create a new transit switch. + + [--if-exists] ts-del switch + Deletes switch. It is an error if switch does not exist, unless + --if-exists is specified. + + ts-list + Lists all existing switches on standard output, one per line. + +DATABASE COMMANDS + These commands query and modify the contents of ovsdb tables. They are + a slight abstraction of the ovsdb interface and as such they operate at + a lower level than other ovn-ic-nbctl commands. + + Identifying Tables, Records, and Columns + + Each of these commands has a table parameter to identify a table within + the database. Many of them also take a record parameter that identifies + a particular record within a table. The record parameter may be the + UUID for a record, which may be abbreviated to its first 4 (or more) + hex digits, as long as that is unique. Many tables offer additional + ways to identify records. Some commands also take column parameters + that identify a particular field within the records in a table. + + For a list of tables and their columns, see ovn-ic-nb(5) or see the taā€ + ble listing from the --help option. + + Record names must be specified in full and with correct capitalization, + except that UUIDs may be abbreviated to their first 4 (or more) hex + digits, as long as that is unique within the table. Names of tables and + columns are not case-sensitive, and - and _ are treated interchangeā€ + ably. Unique abbreviations of table and column names are acceptable, + e.g. t or transit is sufficient to identify the Transit_Switch table. + + Database Values + + Each column in the database accepts a fixed type of data. The currently + defined basic types, and their representations, are: + + integer + A decimal integer in the range -2**63 to 2**63-1, incluā€ + sive. + + real A floating-point number. + + Boolean + True or false, written true or false, respectively. + + string An arbitrary Unicode string, except that null bytes are + not allowed. Quotes are optional for most strings that + begin with an English letter or underscore and consist + only of letters, underscores, hyphens, and periods. Howā€ + ever, true and false and strings that match the syntax of + UUIDs (see below) must be enclosed in double quotes to + distinguish them from other basic types. When double + quotes are used, the syntax is that of strings in JSON, + e.g. backslashes may be used to escape special characā€ + ters. The empty string must be represented as a pair of + double quotes (""). + + UUID Either a universally unique identifier in the style of + RFC 4122, e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or + an @name defined by a get or create command within the + same ovs-vsctl invocation. + + Multiple values in a single column may be separated by spaces or a sinā€ + gle comma. When multiple values are present, duplicates are not alā€ + lowed, and order is not important. Conversely, some database columns + can have an empty set of values, represented as [], and square brackets + may optionally enclose other non-empty sets or single values as well. + + A few database columns are ``mapsā€™ā€™ of key-value pairs, where the key + and the value are each some fixed database type. These are specified in + the form key=value, where key and value follow the syntax for the colā€ + umnā€™s key type and value type, respectively. When multiple pairs are + present (separated by spaces or a comma), duplicate keys are not alā€ + lowed, and again the order is not important. Duplicate values are alā€ + lowed. An empty map is represented as {}. Curly braces may optionally + enclose non-empty maps as well (but use quotes to prevent the shell + from expanding other-config={0=x,1=y} into other-config=0=x other-conā€ā€ + fig=1=y, which may not have the desired effect). + + Database Command Syntax + + [--if-exists] [--columns=column[,column]...] list table + [record]... + Lists the data in each specified record. If no records + are specified, lists all the records in table. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise, all columns + are listed, in alphabetical order by column name. + + Without --if-exists, it is an error if any specified + record does not exist. With --if-exists, the command igā€ + nores any record that does not exist, without producing + any output. + + [--columns=column[,column]...] find table [colā€ + umn[:key]=value]... + Lists the data in each record in table whose column + equals value or, if key is specified, whose column conā€ + tains a key with the specified value. The following operā€ + ators may be used where = is written in the syntax sumā€ + mary: + + = != < > <= >= + Selects records in which column[:key] equals, does + not equal, is less than, is greater than, is less + than or equal to, or is greater than or equal to + value, respectively. + + Consider column[:key] and value as sets of eleā€ + ments. Identical sets are considered equal. Otherā€ + wise, if the sets have different numbers of eleā€ + ments, then the set with more elements is considā€ + ered to be larger. Otherwise, consider a element + from each set pairwise, in increasing order within + each set. The first pair that differs determines + the result. (For a column that contains key-value + pairs, first all the keys are compared, and values + are considered only if the two sets contain idenā€ + tical keys.) + + {=} {!=} + Test for set equality or inequality, respectively. + + {<=} Selects records in which column[:key] is a subset + of value. For example, flood-vlans{<=}1,2 selects + records in which the flood-vlans column is the + empty set or contains 1 or 2 or both. + + {<} Selects records in which column[:key] is a proper + subset of value. For example, flood-vlans{<}1,2 + selects records in which the flood-vlans column is + the empty set or contains 1 or 2 but not both. + + {>=} {>} + Same as {<=} and {<}, respectively, except that + the relationship is reversed. For example, + flood-vlans{>=}1,2 selects records in which the + flood-vlans column contains both 1 and 2. + + The following operators are available only in Open + vSwitch 2.16 and later: + + {in} Selects records in which every element in colā€ + umn[:key] is also in value. (This is the same as + {<=}.) + + {not-in} + Selects records in which every element in colā€ + umn[:key] is not in value. + + For arithmetic operators (= != < > <= >=), when key is + specified but a particular recordā€™s column does not conā€ + tain key, the record is always omitted from the results. + Thus, the condition other-config:mtu!=1500 matches + records that have a mtu key whose value is not 1500, but + not those that lack an mtu key. + + For the set operators, when key is specified but a parā€ + ticular recordā€™s column does not contain key, the comparā€ + ison is done against an empty set. Thus, the condition + other-config:mtu{!=}1500 matches records that have a mtu + key whose value is not 1500 and those that lack an mtu + key. + + Donā€™t forget to escape < or > from interpretation by the + shell. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise all columns are + listed, in alphabetical order by column name. + + The UUIDs shown for rows created in the same ovs-vsctl + invocation will be wrong. + + [--if-exists] [--id=@name] get table record [column[:key]]... + Prints the value of each specified column in the given + record in table. For map columns, a key may optionally be + specified, in which case the value associated with key in + the column is printed, instead of the entire map. + + Without --if-exists, it is an error if record does not + exist or key is specified, if key does not exist in + record. With --if-exists, a missing record yields no outā€ + put and a missing key prints a blank line. + + If @name is specified, then the UUID for record may be + referred to by that name later in the same ovs-vsctl inā€ + vocation in contexts where a UUID is expected. + + Both --id and the column arguments are optional, but usuā€ + ally at least one or the other should be specified. If + both are omitted, then get has no effect except to verify + that record exists in table. + + --id and --if-exists cannot be used together. + + [--if-exists] set table record column[:key]=value... + Sets the value of each specified column in the given + record in table to value. For map columns, a key may opā€ + tionally be specified, in which case the value associated + with key in that column is changed (or added, if none exā€ + ists), instead of the entire map. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] add table record column [key=]value... + Adds the specified value or key-value pair to column in + record in table. If column is a map, then key is reā€ + quired, otherwise it is prohibited. If key already exists + in a map column, then the current value is not replaced + (use the set command to replace an existing value). + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] remove table record column value... + + [--if-exists] remove table record column key... + + [--if-exists] remove table record column key=value... + Removes the specified values or key-value pairs from colā€ + umn in record in table. The first form applies to columns + that are not maps: each specified value is removed from + the column. The second and third forms apply to map + columns: if only a key is specified, then any key-value + pair with the given key is removed, regardless of its + value; if a value is given then a pair is removed only if + both key and value match. + + It is not an error if the column does not contain the + specified key or value or pair. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] clear table record column... + Sets each column in record in table to the empty set or + empty map, as appropriate. This command applies only to + columns that are allowed to be empty. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--id=(@name|uuid)] create table column[:key]=value... + Creates a new record in table and sets the initial values + of each column. Columns not explicitly set will receive + their default values. Outputs the UUID of the new row. + + If @name is specified, then the UUID for the new row may + be referred to by that name elsewhere in the same \*(PN + invocation in contexts where a UUID is expected. Such + references may precede or follow the create command. + + If a valid uuid is specified, then it is used as the UUID + of the new row. + + Caution (ovs-vsctl as example) + Records in the Open vSwitch database are signifiā€ + cant only when they can be reached directly or inā€ + directly from the Open_vSwitch table. Except for + records in the QoS or Queue tables, records that + are not reachable from the Open_vSwitch table are + automatically deleted from the database. This + deletion happens immediately, without waiting for + additional ovs-vsctl commands or other database + activity. Thus, a create command must generally be + accompanied by additional commands within the same + ovs-vsctl invocation to add a chain of references + to the newly created record from the top-level + Open_vSwitch record. The EXAMPLES section gives + some examples that show how to do this. + + [--if-exists] destroy table record... + Deletes each specified record from table. Unless --if-exā€ā€ + ists is specified, each records must exist. + + --all destroy table + Deletes all records from the table. + + Caution (ovs-vsctl as example) + The destroy command is only useful for records in + the QoS or Queue tables. Records in other tables + are automatically deleted from the database when + they become unreachable from the Open_vSwitch taā€ + ble. This means that deleting the last reference + to a record is sufficient for deleting the record + itself. For records in these tables, destroy is + silently ignored. See the EXAMPLES section below + for more information. + + wait-until table record [column[:key]=value]... + Waits until table contains a record named record whose + column equals value or, if key is specified, whose column + contains a key with the specified value. This command + supports the same operators and semantics described for + the find command above. + + If no column[:key]=value arguments are given, this comā€ + mand waits only until record exists. If more than one + such argument is given, the command waits until all of + them are satisfied. + + Caution (ovs-vsctl as example) + Usually wait-until should be placed at the beginā€ + ning of a set of ovs-vsctl commands. For example, + wait-until bridge br0 -- get bridge br0 dataā€ā€ + path_id waits until a bridge named br0 is created, + then prints its datapath_id column, whereas get + bridge br0 datapath_id -- wait-until bridge br0 + will abort if no bridge named br0 exists when + ovs-vsctl initially connects to the database. + + Consider specifying --timeout=0 along with --wait-until, + to prevent ovs-vsctl from terminating after waiting only + at most 5 seconds. + + comment [arg]... + This command has no effect on behavior, but any database + log record created by the command will include the comā€ + mand and its arguments. + +REMOTE CONNECTIVITY COMMANDS + get-connection + Prints the configured connection(s). + + del-connection + Deletes the configured connection(s). + + [--inactivity-probe=msecs] set-connection target... + Sets the configured manager target or targets. Use --inactivā€ā€ + ity-probe=msecs to override the default idle connection inactivā€ + ity probe time. Use 0 to disable inactivity probes. + +SSL CONFIGURATION COMMANDS + get-ssl + Prints the SSL configuration. + + del-ssl + Deletes the current SSL configuration. + + [--bootstrap] set-ssl private-key certificate ca-cert [ssl-protocol- + list [ssl-cipher-list]] + Sets the SSL configuration. + +OPTIONS + --db database + The OVSDB database remote to contact. If the OVN_IC_NB_DB enviā€ + ronment variable is set, its value is used as the default. Othā€ + erwise, the default is unix:/ovn_ic_nb_db.sock, but this default + is unlikely to be useful outside of single-machine OVN test enā€ + vironments. + + --leader-only + --no-leader-only + By default, or with --leader-only, when the database server is a + clustered database, ovn-ic-nbctl will avoid servers other than the + cluster leader. This ensures that any data that ovn-ic-nbctl reads + and reports is up-to-date. With --no-leader-only, ovn-ic-nbctl + will use any server in the cluster, which means that for read-only + transactions it can report and act on stale data (transactions + that modify the database are always serialized even with + --no-leader-only). Refer to Understanding Cluster Consistency in + ovsdb(7) for more information. + +LOGGING OPTIONS + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + +TABLE FORMATTING OPTIONS + These options control the format of output from the list and find comā€ + mands. + + -f format + --format=format + Sets the type of table formatting. The following types of + format are available: + + table 2-D text tables with aligned columns. + + list (default) + A list with one column per line and rows separated + by a blank line. + + html HTML tables. + + csv Comma-separated values as defined in RFC 4180. + + json JSON format as defined in RFC 4627. The output is a + sequence of JSON objects, each of which corresponds + to one table. Each JSON object has the following + members with the noted values: + + caption + The tableā€™s caption. This member is omitted + if the table has no caption. + + headings + An array with one element per table column. + Each array element is a string giving the + corresponding columnā€™s heading. + + data An array with one element per table row. Each + element is also an array with one element per + table column. The elements of this second- + level array are the cells that constitute the + table. Cells that represent OVSDB data or + data types are expressed in the format deā€ + scribed in the OVSDB specification; other + cells are simply expressed as text strings. + + -d format + --data=format + Sets the formatting for cells within output tables unless + the table format is set to json, in which case json formatā€ + ting is always used when formatting cells. The following + types of format are available: + + string (default) + The simple format described in the Database Values + section of ovs-vsctl(8). + + bare The simple format with punctuation stripped off: [] + and {} are omitted around sets, maps, and empty + columns, items within sets and maps are space-sepaā€ + rated, and strings are never quoted. This format may + be easier for scripts to parse. + + json The RFC 4627 JSON format as described above. + + --no-headings + This option suppresses the heading row that otherwise apā€ + pears in the first row of table output. + + --pretty + By default, JSON in output is printed as compactly as posā€ + sible. This option causes JSON in output to be printed in a + more readable fashion. Members of objects and elements of + arrays are printed one per line, with indentation. + + This option does not affect JSON in tables, which is always + printed compactly. + + --bare + Equivalent to --format=list --data=bare --no-headings. + + PKI Options + PKI configuration is required to use SSL for the connection to the + database. + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + --bootstrap-ca-cert=cacert.pem + When cacert.pem exists, this option has the same effect + as -C or --ca-cert. If it does not exist, then the exeā€ + cutable will attempt to obtain the CA certificate from + the SSL peer on its first SSL connection and save it to + the named PEM file. If it is successful, it will immediā€ + ately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certifiā€ + cate signed by the CA certificate thus obtained. + + This option exposes the SSL connection to a man-in-the- + middle attack obtaining the initial CA certificate, but + it may be useful for bootstrapping. + + This option is only useful if the SSL peer sends its CA + certificate as part of the SSL certificate chain. The SSL + protocol does not require the server to send the CA cerā€ + tificate. + + This option is mutually exclusive with -C and --ca-cert. + + Other Options + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +OVN 23.06.3 ovn-ic-nbctl ovn-ic-nbctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5 b/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5 new file mode 100644 index 00000000..177e2e05 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5 @@ -0,0 +1,656 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-ic-sb" 5 " DB Schema 1.1.1" "Open vSwitch 23.06.3" "Open vSwitch Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.SH NAME +ovn-ic-sb \- OVN_IC_Southbound database schema +.PP +.PP +.PP +.PP +This database holds configuration and state for interconnecting different OVN deployments\[char46] The content of the database is populated and used by the \fBovn\-ic\fR program in each OVN deployment, and not supposed to be directly used by CMS or end user\[char46] +.PP +.PP +The OVN Interconnection Southbound database is shared by \fBovn\-ic\fR program in each OVN deployment\[char46] It contains interconnection information from all related OVN deployments, and is used as the intermediate store for each OVN deployment to exchange the information\[char46] The \fBovn\-ic\fR program in each deployment is responsible for syncing the data between this database and the its own northbound and southbound databases\[char46] +.SS "Database Structure" +.PP +.PP +The OVN Interconnection Southbound database contains classes of data with different properties, as described in the sections below\[char46] +.ST "Availability Zone Specific Information" +.PP +.PP +These tables contain objects that are availability zone specific\[char46] Each object is owned and populated by one availability zone, and read by other availability zones\[char46] +.PP +.PP +The \fBAvailability_Zone\fR, \fBGateway\fR, \fBEncap\fR and \fBPort_Binding\fR tables are the availability zone specific tables\[char46] +.ST "Global Information" +.PP +.PP +The data that does not belong to any specific availability zone but is common for all availability zones\[char46] +.PP +.PP +The \fBDatapath_Binding\fR table contains the common datapath binding information\[char46] +.ST "Common Columns" +.PP +.PP +Each of the tables in this database contains a special column, named \fBexternal_ids\fR\[char46] This column has the same form and purpose each place it appears\[char46] +.RS +.TP +\fBexternal_ids\fR: map of string-string pairs +Key-value pairs for use by \fBovn\-ic\fR\[char46] +.RE +.SH "TABLE SUMMARY" +.PP +The following list summarizes the purpose of each of the tables in the +\fBOVN_IC_Southbound\fR database. Each table is described in more detail on a later +page. +.IP "Table" 1in +Purpose +.TQ 1in +\fBIC_SB_Global\fR +IC Southbound configuration +.TQ 1in +\fBAvailability_Zone\fR +Availability Zone Information +.TQ 1in +\fBGateway\fR +Interconnection Gateway Information +.TQ 1in +\fBEncap\fR +Encapsulation Types +.TQ 1in +\fBDatapath_Binding\fR +Transit Switch Datapath Bindings +.TQ 1in +\fBPort_Binding\fR +Transit Port Bindings +.TQ 1in +\fBRoute\fR +Route +.TQ 1in +\fBConnection\fR +OVSDB client connections\[char46] +.TQ 1in +\fBSSL\fR +SSL configuration\[char46] +.\" check if in troff mode (TTY) +.if t \{ +.bp +.SH "TABLE RELATIONSHIPS" +.PP +The following diagram shows the relationship among tables in the +database. Each node represents a table. Tables that are part of the +``root set'' are shown with double borders. Each edge leads from the +table that contains it and points to the table that its value +represents. Edges are labeled with their column names, followed by a +constraint on the number of allowed values: \fB?\fR for zero or one, +\fB*\fR for zero or more, \fB+\fR for one or more. Thick lines +represent strong references; thin lines represent weak references. +.RS -1in +.ps -3 +.PS +linethick = 1; +linethick = 0.500000; +box at 0.764118,0.478405 wid 1.279064 height 0.478405 "IC_SB_Global" +box at 0.764118,0.478405 wid 1.223508 height 0.422849 +linethick = 1.000000; +box at 4.006642,0.956810 wid 1.039861 height 0.478405 "Connection" +linethick = 1.000000; +box at 4.006642,0.239203 wid 0.717608 height 0.478405 "SSL" +linethick = 0.500000; +box at 4.006642,1.940219 wid 1.528217 height 0.478405 "Availability_Zone" +box at 4.006642,1.940219 wid 1.472661 height 0.422849 +linethick = 0.500000; +box at 0.764118,2.312323 wid 0.850499 height 0.478405 "Gateway" +box at 0.764118,2.312323 wid 0.794943 height 0.422849 +linethick = 1.000000; +box at 4.006642,3.029930 wid 0.717608 height 0.478405 "Encap" +linethick = 0.500000; +box at 0.764118,3.760837 wid 1.528217 height 0.478405 "Datapath_Binding" +box at 0.764118,3.760837 wid 1.472661 height 0.422849 +linethick = 0.500000; +box at 0.764118,3.043230 wid 1.189411 height 0.478405 "Port_Binding" +box at 0.764118,3.043230 wid 1.133855 height 0.422849 +linethick = 0.500000; +box at 0.764118,1.448515 wid 0.717608 height 0.478405 "Route" +box at 0.764118,1.448515 wid 0.662052 height 0.422849 +linethick = 1.000000; +spline -> from 1.405363,0.591510 to 1.405363,0.591510 to 1.525442,0.612138 to 1.650210,0.632892 to 1.767419,0.651167 to 2.355188,0.742762 to 3.032609,0.833697 to 3.484224,0.892244 +"connections*" at 2.385423,0.918605 +linethick = 1.000000; +spline -> from 1.408903,0.431435 to 1.408903,0.431435 to 2.076565,0.381767 to 3.105805,0.305222 to 3.641715,0.265362 +"ssl?" at 2.385423,0.506640 +linethick = 1.000000; +spline -> from 1.192472,2.124118 to 1.192472,2.124118 to 1.366325,2.054941 to 1.572900,1.985094 to 1.767419,1.950170 to 2.252426,1.863100 to 2.806419,1.860326 to 3.240428,1.879462 +"availability_zone" at 2.385423,2.034848 +linethick = 1.000000; +spline -> from 1.193908,2.278643 to 1.193908,2.278643 to 1.648966,2.255105 to 2.394417,2.255488 to 3.003331,2.441875 to 3.244160,2.515549 to 3.487764,2.659166 to 3.673098,2.786039 +"encaps+" at 2.385423,2.526552 +linethick = 1.000000; +spline -> from 1.364507,2.947740 to 1.364507,2.947740 to 1.972272,2.846797 to 2.853782,2.693803 to 3.003331,2.631228 to 3.264349,2.522055 to 3.525462,2.335860 to 3.713858,2.184206 +"availability_zone" at 2.385423,2.965154 +linethick = 0.500000; +spline -> from 1.363263,3.098246 to 1.363263,3.098246 to 1.496068,3.108484 to 1.636528,3.117670 to 1.767419,3.122932 to 2.316246,3.144939 to 2.454600,3.148670 to 3.003331,3.122932 to 3.217178,3.112886 to 3.456093,3.090783 to 3.645733,3.070595 +"encap?" at 2.385423,3.230860 +linethick = 1.000000; +spline -> from 1.127888,1.449471 to 1.127888,1.449471 to 1.569360,1.456552 to 2.349351,1.488605 to 3.003331,1.617966 to 3.104370,1.637963 to 3.209523,1.665041 to 3.311902,1.694989 +"availability_zone" at 2.385423,1.702643 +.ps +3 +.PE +.RE\} +.bp +.SH "IC_SB_Global TABLE" +.PP +.PP +.PP +Interconnection Southbound configuration\[char46] This table must have exactly one row\[char46] +.SS "Summary: +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.RE +.TQ .25in +\fIConnection Options:\fR +.RS .25in +.TQ 2.75in +\fBconnections\fR +set of \fBConnection\fRs +.TQ 2.75in +\fBssl\fR +optional \fBSSL\fR +.RE +.SS "Details: +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +.ST "Connection Options:" +.PP +.IP "\fBconnections\fR: set of \fBConnection\fRs" +Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured\[char46] See the \fBConnection\fR table for more information\[char46] +.IP "\fBssl\fR: optional \fBSSL\fR" +Global SSL configuration\[char46] +.bp +.SH "Availability_Zone TABLE" +.PP +.PP +.PP +Each row in this table represents an Availability Zone\[char46] Each OVN deployment is considered an availability zone from OVN control plane perspective, with its own central components, such as northbound and southbound databases and \fBovn\-northd\fR daemon\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name that uniquely identifies the availability zone\[char46] +.bp +.SH "Gateway TABLE" +.PP +.PP +.PP +Each row in this table represents a interconnection gateway chassis in an availability zone\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBavailability_zone\fR +\fBAvailability_Zone\fR +.TQ 3.00in +\fBhostname\fR +string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fIEncapsulation Configuration:\fR +.RS .25in +.TQ 2.75in +\fBencaps\fR +set of 1 or more \fBEncap\fRs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +The name of the gateway\[char46] See \fBname\fR column of the OVN Southbound database\(cqs \fBChassis\fR table\[char46] +.IP "\fBavailability_zone\fR: \fBAvailability_Zone\fR" +The availability zone that the gateway belongs to\[char46] +.IP "\fBhostname\fR: string" +The hostname of the gateway\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.ST "Encapsulation Configuration:" +.PP +.PP +.PP +OVN uses encapsulation to transmit logical dataplane packets between gateways\[char46] +.IP "\fBencaps\fR: set of 1 or more \fBEncap\fRs" +Points to supported encapsulation configurations to transmit logical dataplane packets to this gateway\[char46] Each entry is a \fBEncap\fR record that describes the configuration\[char46] See \fBencaps\fR column of the OVN Southbound database\(cqs \fBChassis\fR table\[char46] +.bp +.SH "Encap TABLE" +.PP +.PP +.PP +The \fBencaps\fR column in the \fBGateway\fR table refers to rows in this table to identify how OVN may transmit logical dataplane packets to this gateway\[char46] +.SS "Summary: +.TQ 3.00in +\fBtype\fR +string, one of \fBgeneve\fR, \fBstt\fR, or \fBvxlan\fR +.TQ 3.00in +\fBoptions\fR +map of string-string pairs +.TQ 3.00in +\fBip\fR +string +.TQ 3.00in +\fBgateway_name\fR +string +.SS "Details: +.IP "\fBtype\fR: string, one of \fBgeneve\fR, \fBstt\fR, or \fBvxlan\fR" +The encapsulation to use to transmit packets to this gateway\[char46] See \fBtype\fR column of the OVN Southbound database\(cqs \fBEncap\fR table\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Options for configuring the encapsulation, which may be \fBtype\fR specific\[char46] See \fBoptions\fR column of the OVN Southbound database\(cqs \fBEncap\fR table\[char46] +.IP "\fBip\fR: string" +The IPv4 address of the encapsulation tunnel endpoint\[char46] +.IP "\fBgateway_name\fR: string" +The name of the gateway that created this encap\[char46] +.bp +.SH "Datapath_Binding TABLE" +.PP +.PP +.PP +Each row in this table represents a logical datapath for a transit logical switch configured in the OVN Interconnection Northbound database\(cqs \fBTransit_Switch\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBtransit_switch\fR +string +.TQ 3.00in +\fBtunnel_key\fR +integer, in range 1 to 16,777,215 (must be unique within table) +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBtransit_switch\fR: string" +The name of the transit logical switch that is configured in the OVN Interconnection Northbound database\(cqs \fBTransit_Switch\fR table\[char46] +.IP "\fBtunnel_key\fR: integer, in range 1 to 16,777,215 (must be unique within table)" +The tunnel key value to which the logical datapath is bound\[char46] The key can be generated by any \fBovn\-ic\fR but the same key is shared by all availability zones so that the logical datapaths can be peered across them\[char46] A tunnel key for transit switch datapath binding must be globally unique\[char46] +.IP +For more information about the meanings of a tunnel key, see \fBtunnel_key\fR column of the OVN Southbound database\(cqs \fBDatapath_Binding\fR table\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Port_Binding TABLE" +.PP +.PP +.PP +Each row in this table binds a logical port on the transit switch to a physical gateway and a tunnel key\[char46] Each port on the transit switch belongs to a specific availability zone\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtransit_switch\fR +string +.TQ 2.75in +\fBlogical_port\fR +string (must be unique within table) +.TQ 2.75in +\fBavailability_zone\fR +\fBAvailability_Zone\fR +.TQ 2.75in +\fBencap\fR +optional weak reference to \fBEncap\fR +.TQ 2.75in +\fBgateway\fR +string +.TQ 2.75in +\fBtunnel_key\fR +integer, in range 1 to 32,767 +.TQ 2.75in +\fBaddress\fR +string +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtransit_switch\fR: string" +The name of the transit switch that the corresponding logical port belongs to\[char46] +.IP "\fBlogical_port\fR: string (must be unique within table)" +A logical port, taken from \fBname\fR in the OVN_Northbound database\(cqs \fBLogical_Switch_Port\fR table\[char46] The logical port name must be unique across all availability zones\[char46] +.IP "\fBavailability_zone\fR: \fBAvailability_Zone\fR" +The availability zone that the port belongs to\[char46] +.IP "\fBencap\fR: optional weak reference to \fBEncap\fR" +Points to supported encapsulation configurations to transmit logical dataplane packets to this gateway\[char46] Each entry is a \fBEncap\fR record that describes the configuration\[char46] +.IP "\fBgateway\fR: string" +The name of the gateway that this port is physically located\[char46] +.IP "\fBtunnel_key\fR: integer, in range 1 to 32,767" +A number that represents the logical port in the key (e\[char46]g\[char46] STT key or Geneve TLV) field carried within tunnel protocol packets\[char46] The key can be generated by any \fBovn\-ic\fR but the same key is shared by all availability zones so that the packets can go through the datapath pipelines of different availability zones\[char46] +.IP +The tunnel ID must be unique within the scope of a logical datapath\[char46] +.IP +For more information about tunnel key, see \fBtunnel_key\fR column of the OVN Southbound database\(cqs \fBPort_Binding\fR table\[char46] +.IP "\fBaddress\fR: string" +The Ethernet address and IP addresses used by the corresponding logical router port peering with the transit switch port\[char46] It is a string combined with the value of \fBmac\fR column followed by the values in \fBnetworks\fR column in \fBLogical_Router_Port\fR table\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Route TABLE" +.PP +.PP +.PP +Each row in this table represents a route advertised\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtransit_switch\fR +string +.TQ 2.75in +\fBavailability_zone\fR +\fBAvailability_Zone\fR +.TQ 2.75in +\fBroute_table\fR +string +.TQ 2.75in +\fBip_prefix\fR +string +.TQ 2.75in +\fBnexthop\fR +string +.TQ 2.75in +\fBorigin\fR +string, either \fBconnected\fR or \fBstatic\fR +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtransit_switch\fR: string" +The name of the transit switch, upon which the route is advertised\[char46] +.IP "\fBavailability_zone\fR: \fBAvailability_Zone\fR" +The availability zone that has advertised the route\[char46] +.IP "\fBroute_table\fR: string" +Route table within which this route was created\[char46] Empty value means \fI
\fR routing table\[char46] +.IP +Routes for directly-connected networks will be learned to \fI
\fR routing table and if Logical Routers have more than one Transit Switch, which interconnects them, directly-connected routes will be added via each transit switch port and configured as ECMP routes\[char46] +.IP +Static routes within route tables will be advertised and learned only if interconnecting transit switch\(cqs LRPs will have same value in \fBoptions:route_table\fR as NB \fBroute_table\fR or ICSB \fBroute_table\fR value respectively\[char46] +.IP "\fBip_prefix\fR: string" +IP prefix of this route (e\[char46]g\[char46] 192\[char46]168\[char46]100\[char46]0/24)\[char46] +.IP "\fBnexthop\fR: string" +Nexthop IP address for this route\[char46] +.IP "\fBorigin\fR: string, either \fBconnected\fR or \fBstatic\fR" +Can be one of \fBconnected\fR or \fBstatic\fR\[char46] Routes to directly-connected subnets - LRP\(cqs CIDRs are inserted to OVN IC SB DB with \fBconnected\fR value in \fBorigin\fR\[char46] Static routes are inserted to OVN IC SB DB with \fBstatic\fR value\[char46] Next when route is learned to another AZ NB DB by ovn-ic, route origin is synced to \fBoptions:origin\fR\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Connection TABLE" +.PP +.PP +.PP +Configuration for a database connection to an Open vSwitch database (OVSDB) client\[char46] +.PP +.PP +This table primarily configures the Open vSwitch database server (\fBovsdb\-server\fR)\[char46] +.PP +.PP +The Open vSwitch database server can initiate and maintain active connections to remote clients\[char46] It can also listen for database connections\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtarget\fR +string (must be unique within table) +.RE +.TQ .25in +\fIClient Failure Detection and Handling:\fR +.RS .25in +.TQ 2.75in +\fBmax_backoff\fR +optional integer, at least 1,000 +.TQ 2.75in +\fBinactivity_probe\fR +optional integer +.RE +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBis_connected\fR +boolean +.TQ 2.75in +\fBstatus : last_error\fR +optional string +.TQ 2.75in +\fBstatus : state\fR +optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR +.TQ 2.75in +\fBstatus : sec_since_connect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : sec_since_disconnect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : locks_held\fR +optional string +.TQ 2.75in +\fBstatus : locks_waiting\fR +optional string +.TQ 2.75in +\fBstatus : locks_lost\fR +optional string +.TQ 2.75in +\fBstatus : n_connections\fR +optional string, containing an integer, at least 2 +.TQ 2.75in +\fBstatus : bound_port\fR +optional string, containing an integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBother_config\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtarget\fR: string (must be unique within table)" +Connection methods for clients\[char46] +.IP +The following connection methods are currently supported: +.RS +.TP +\fBssl:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified SSL \fIport\fR on the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBtcp:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified TCP \fIport\fR on the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBtcp:[::1]:6640\fR\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.TP +\fBpssl:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for SSL connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap in square brackets, e\[char46]g\[char46] \fBpssl:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 (but not IPv6) addresses\[char46] A valid SSL configuration must be provided when this form is used, this can be specified either via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBptcp:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBptcp:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 addresses\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.RE +.IP +When multiple clients are configured, the \fBtarget\fR values must be unique\[char46] Duplicate \fBtarget\fR values yield unspecified results\[char46] +.ST "Client Failure Detection and Handling:" +.PP +.IP "\fBmax_backoff\fR: optional integer, at least 1,000" +Maximum number of milliseconds to wait between connection attempts\[char46] Default is implementation-specific\[char46] +.IP "\fBinactivity_probe\fR: optional integer" +Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message\[char46] If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe\[char46] If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect\[char46] Default is implementation-specific\[char46] A value of 0 disables inactivity probes\[char46] +.ST "Status:" +.PP +.PP +.PP +Key-value pair of \fBis_connected\fR is always updated\[char46] Other key-value pairs in the status columns may be updated depends on the \fBtarget\fR type\[char46] +.PP +.PP +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpunix:\fR), both \fBn_connections\fR and \fBis_connected\fR may also be updated while the remaining key-value pairs are omitted\[char46] +.PP +.PP +On the other hand, when \fBtarget\fR specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets\[char46] They are omitted\[char46] +.IP "\fBis_connected\fR: boolean" +\fBtrue\fR if currently connected to this client, \fBfalse\fR otherwise\[char46] +.IP "\fBstatus : last_error\fR: optional string" +A human-readable description of the last error on the connection to the manager; i\[char46]e\[char46] \fBstrerror(errno)\fR\[char46] This key will exist only if an error has occurred\[char46] +.IP "\fBstatus : state\fR: optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR" +The state of the connection to the manager: +.RS +.TP +\fBVOID\fR +Connection is disabled\[char46] +.TP +\fBBACKOFF\fR +Attempting to reconnect at an increasing period\[char46] +.TP +\fBCONNECTING\fR +Attempting to connect\[char46] +.TP +\fBACTIVE\fR +Connected, remote host responsive\[char46] +.TP +\fBIDLE\fR +Connection is idle\[char46] Waiting for response to keep-alive\[char46] +.RE +.IP +These values may change in the future\[char46] They are provided only for human consumption\[char46] +.IP "\fBstatus : sec_since_connect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last successfully connected to the database (in seconds)\[char46] Value is empty if client has never successfully been connected\[char46] +.IP "\fBstatus : sec_since_disconnect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last disconnected from the database (in seconds)\[char46] Value is empty if client has never disconnected\[char46] +.IP "\fBstatus : locks_held\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection holds\[char46] Omitted if the connection does not hold any locks\[char46] +.IP "\fBstatus : locks_waiting\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire\[char46] Omitted if the connection is not waiting for any locks\[char46] +.IP "\fBstatus : locks_lost\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client\[char46] Omitted if no locks have been stolen from this connection\[char46] +.IP "\fBstatus : n_connections\fR: optional string, containing an integer, at least 2" +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpssl:\fR) and more than one connection is actually active, the value is the number of active connections\[char46] Otherwise, this key-value pair is omitted\[char46] +.IP "\fBstatus : bound_port\fR: optional string, containing an integer" +When \fBtarget\fR is \fBptcp:\fR or \fBpssl:\fR, this is the TCP port on which the OVSDB server is listening\[char46] (This is particularly useful when \fBtarget\fR specifies a port of 0, allowing the kernel to choose any available port\[char46]) +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.IP "\fBother_config\fR: map of string-string pairs" +.bp +.SH "SSL TABLE" +.PP +SSL configuration for ovn-sb database access\[char46] +.SS "Summary: +.TQ 3.00in +\fBprivate_key\fR +string +.TQ 3.00in +\fBcertificate\fR +string +.TQ 3.00in +\fBca_cert\fR +string +.TQ 3.00in +\fBbootstrap_ca_cert\fR +boolean +.TQ 3.00in +\fBssl_protocols\fR +string +.TQ 3.00in +\fBssl_ciphers\fR +string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBprivate_key\fR: string" +Name of a PEM file containing the private key used as the switch\(cqs identity for SSL connections to the controller\[char46] +.IP "\fBcertificate\fR: string" +Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch\(cqs private key, identifying a trustworthy switch\[char46] +.IP "\fBca_cert\fR: string" +Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller\[char46] +.IP "\fBbootstrap_ca_cert\fR: boolean" +If set to \fBtrue\fR, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] \fBThis option exposes the +SSL connection to a man\-in\-the\-middle attack obtaining the initial +CA certificate\[char46]\fR It may still be useful for bootstrapping\[char46] +.IP "\fBssl_protocols\fR: string" +List of SSL protocols to be enabled for SSL connections\[char46] The default when this option is omitted is \fBTLSv1,TLSv1\[char46]1,TLSv1\[char46]2\fR\[char46] +.IP "\fBssl_ciphers\fR: string" +List of ciphers (in OpenSSL cipher string format) to be supported for SSL connections\[char46] The default when this option is omitted is \fBHIGH:!aNULL:!MD5\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.html b/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.html new file mode 100644 index 00000000..4c4e7a38 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.html @@ -0,0 +1,600 @@ +
+ovn-ic-sb(5)                  Open vSwitch Manual                 ovn-ic-sb(5)
+
+NAME
+       ovn-ic-sb - OVN_IC_Southbound database schema
+
+       This database holds configuration and state for interconnecting differā€
+       ent  OVN deployments. The content of the database is populated and used
+       by the ovn-ic program in each OVN deployment, and not  supposed  to  be
+       directly used by CMS or end user.
+
+       The OVN Interconnection Southbound database is shared by ovn-ic program
+       in  each  OVN  deployment. It contains interconnection information from
+       all related OVN deployments, and is used as the intermediate store  for
+       each  OVN deployment to exchange the information. The ovn-ic program in
+       each deployment is responsible for syncing the data between this  dataā€
+       base and the its own northbound and southbound databases.
+
+   Database Structure
+       The  OVN  Interconnection  Southbound database contains classes of data
+       with different properties, as described in the sections below.
+
+     Availability Zone Specific Information
+
+       These tables contain objects that are availability zone specific.  Each
+       object  is  owned  and  populated by one availability zone, and read by
+       other availability zones.
+
+       The Availability_Zone, Gateway, Encap and Port_Binding tables  are  the
+       availability zone specific tables.
+
+     Global Information
+
+       The  data that does not belong to any specific availability zone but is
+       common for all availability zones.
+
+       The Datapath_Binding table contains the common datapath binding  inforā€
+       mation.
+
+     Common Columns
+
+       Each  of  the  tables in this database contains a special column, named
+       external_ids. This column has the same form and purpose each  place  it
+       appears.
+
+              external_ids: map of string-string pairs
+                     Key-value pairs for use by ovn-ic.
+
+TABLE SUMMARY
+       The  following list summarizes the purpose of each of the tables in the
+       OVN_IC_Southbound database.  Each table is described in more detail  on
+       a later page.
+
+       Table     Purpose
+       IC_SB_Global
+                 IC Southbound configuration
+       Availability_Zone
+                 Availability Zone Information
+       Gateway   Interconnection Gateway Information
+       Encap     Encapsulation Types
+       Datapath_Binding
+                 Transit Switch Datapath Bindings
+       Port_Binding
+                 Transit Port Bindings
+       Route     Route
+       Connection
+                 OVSDB client connections.
+       SSL       SSL configuration.
+
+IC_SB_Global TABLE
+       Interconnection  Southbound configuration. This table must have exactly
+       one row.
+
+   Summary:
+       Common Columns:
+         external_ids                map of string-string pairs
+         options                     map of string-string pairs
+       Connection Options:
+         connections                 set of Connections
+         ssl                         optional SSL
+
+   Details:
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+       options: map of string-string pairs
+
+     Connection Options:
+
+       connections: set of Connections
+              Database clients to  which  the  Open  vSwitch  database  server
+              should  connect or on which it should listen, along with options
+              for how these connections should be configured. See the  Connecā€ā€
+              tion table for more information.
+
+       ssl: optional SSL
+              Global SSL configuration.
+
+Availability_Zone TABLE
+       Each  row  in  this table represents an Availability Zone. Each OVN deā€
+       ployment is considered an availability zone from OVN control plane perā€
+       spective, with its own  central  components,  such  as  northbound  and
+       southbound databases and ovn-northd daemon.
+
+   Summary:
+       name                          string (must be unique within table)
+
+   Details:
+       name: string (must be unique within table)
+              A name that uniquely identifies the availability zone.
+
+Gateway TABLE
+       Each  row in this table represents a interconnection gateway chassis in
+       an availability zone.
+
+   Summary:
+       name                          string (must be unique within table)
+       availability_zone             Availability_Zone
+       hostname                      string
+       Common Columns:
+         external_ids                map of string-string pairs
+       Encapsulation Configuration:
+         encaps                      set of 1 or more Encaps
+
+   Details:
+       name: string (must be unique within table)
+              The name of the gateway. See name column of the  OVN  Southbound
+              databaseā€™s Chassis table.
+
+       availability_zone: Availability_Zone
+              The availability zone that the gateway belongs to.
+
+       hostname: string
+              The hostname of the gateway.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+     Encapsulation Configuration:
+
+       OVN uses encapsulation to transmit logical  dataplane  packets  between
+       gateways.
+
+       encaps: set of 1 or more Encaps
+              Points  to  supported  encapsulation  configurations to transmit
+              logical dataplane packets to this gateway. Each entry is a Encap
+              record that describes the configuration. See  encaps  column  of
+              the OVN Southbound databaseā€™s Chassis table.
+
+Encap TABLE
+       The  encaps column in the Gateway table refers to rows in this table to
+       identify how OVN may transmit logical dataplane packets to  this  gateā€
+       way.
+
+   Summary:
+       type                          string, one of geneve, stt, or vxlan
+       options                       map of string-string pairs
+       ip                            string
+       gateway_name                  string
+
+   Details:
+       type: string, one of geneve, stt, or vxlan
+              The  encapsulation  to  use to transmit packets to this gateway.
+              See type column of the OVN Southbound databaseā€™s Encap table.
+
+       options: map of string-string pairs
+              Options for configuring the encapsulation,  which  may  be  type
+              specific.  See  options  column of the OVN Southbound databaseā€™s
+              Encap table.
+
+       ip: string
+              The IPv4 address of the encapsulation tunnel endpoint.
+
+       gateway_name: string
+              The name of the gateway that created this encap.
+
+Datapath_Binding TABLE
+       Each row in this table represents a logical datapath for a transit logā€
+       ical switch configured in the OVN Interconnection Northbound databaseā€™s
+       Transit_Switch table.
+
+   Summary:
+       transit_switch                string
+       tunnel_key                    integer, in range 1 to  16,777,215  (must
+                                     be unique within table)
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       transit_switch: string
+              The name of the transit logical switch that is configured in the
+              OVN Interconnection Northbound databaseā€™s Transit_Switch table.
+
+       tunnel_key: integer, in range 1 to 16,777,215 (must be unique within
+       table)
+              The tunnel key value to which the logical datapath is bound. The
+              key can be generated by any ovn-ic but the same key is shared by
+              all  availability  zones  so  that  the logical datapaths can be
+              peered across them. A tunnel key  for  transit  switch  datapath
+              binding must be globally unique.
+
+              For  more  information  about  the meanings of a tunnel key, see
+              tunnel_key  column  of  the  OVN  Southbound  databaseā€™s   Dataā€ā€
+              path_Binding table.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Port_Binding TABLE
+       Each row in this table binds a logical port on the transit switch to  a
+       physical  gateway and a tunnel key. Each port on the transit switch beā€
+       longs to a specific availability zone.
+
+   Summary:
+       Core Features:
+         transit_switch              string
+         logical_port                string (must be unique within table)
+         availability_zone           Availability_Zone
+         encap                       optional weak reference to Encap
+         gateway                     string
+         tunnel_key                  integer, in range 1 to 32,767
+         address                     string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       transit_switch: string
+              The name of the transit switch that  the  corresponding  logical
+              port belongs to.
+
+       logical_port: string (must be unique within table)
+              A logical port, taken from name in the OVN_Northbound databaseā€™s
+              Logical_Switch_Port  table. The logical port name must be unique
+              across all availability zones.
+
+       availability_zone: Availability_Zone
+              The availability zone that the port belongs to.
+
+       encap: optional weak reference to Encap
+              Points to supported  encapsulation  configurations  to  transmit
+              logical dataplane packets to this gateway. Each entry is a Encap
+              record that describes the configuration.
+
+       gateway: string
+              The name of the gateway that this port is physically located.
+
+       tunnel_key: integer, in range 1 to 32,767
+              A  number  that represents the logical port in the key (e.g. STT
+              key or Geneve TLV) field carried within tunnel protocol packets.
+              The key can be generated by any  ovn-ic  but  the  same  key  is
+              shared  by  all  availability  zones  so that the packets can go
+              through the datapath pipelines of different availability zones.
+
+              The tunnel ID must be unique within the scope of a logical dataā€
+              path.
+
+              For more information about tunnel key, see tunnel_key column  of
+              the OVN Southbound databaseā€™s Port_Binding table.
+
+       address: string
+              The  Ethernet address and IP addresses used by the corresponding
+              logical router port peering with the transit switch port. It  is
+              a  string  combined with the value of mac column followed by the
+              values in networks column in Logical_Router_Port table.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Route TABLE
+       Each row in this table represents a route advertised.
+
+   Summary:
+       Core Features:
+         transit_switch              string
+         availability_zone           Availability_Zone
+         route_table                 string
+         ip_prefix                   string
+         nexthop                     string
+         origin                      string, either connected or static
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       transit_switch: string
+              The name of the transit switch, upon which the route  is  adverā€
+              tised.
+
+       availability_zone: Availability_Zone
+              The availability zone that has advertised the route.
+
+       route_table: string
+              Route  table  within  which  this route was created. Empty value
+              means <lt;main>gt; routing table.
+
+              Routes for directly-connected networks will be learned to <lt;main>gt;
+              routing table and if Logical Routers have more than one  Transit
+              Switch, which interconnects them, directly-connected routes will
+              be  added  via  each  transit switch port and configured as ECMP
+              routes.
+
+              Static routes within route tables will be advertised and learned
+              only if interconnecting transit switchā€™s  LRPs  will  have  same
+              value in options:route_table as NB route_table or ICSB route_taā€ā€
+              ble value respectively.
+
+       ip_prefix: string
+              IP prefix of this route (e.g. 192.168.100.0/24).
+
+       nexthop: string
+              Nexthop IP address for this route.
+
+       origin: string, either connected or static
+              Can  be one of connected or static. Routes to directly-connected
+              subnets - LRPā€™s CIDRs are inserted to OVN IC  SB  DB  with  conā€ā€
+              nected  value in origin. Static routes are inserted to OVN IC SB
+              DB with static value. Next when route is learned to  another  AZ
+              NB DB by ovn-ic, route origin is synced to options:origin.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Connection TABLE
+       Configuration  for  a  database  connection to an Open vSwitch database
+       (OVSDB) client.
+
+       This table  primarily  configures  the  Open  vSwitch  database  server
+       (ovsdb-server).
+
+       The  Open vSwitch database server can initiate and maintain active conā€
+       nections to remote clients. It can also  listen  for  database  connecā€
+       tions.
+
+   Summary:
+       Core Features:
+         target                      string (must be unique within table)
+       Client Failure Detection and Handling:
+         max_backoff                 optional integer, at least 1,000
+         inactivity_probe            optional integer
+       Status:
+         is_connected                boolean
+         status : last_error         optional string
+         status : state              optional  string, one of ACTIVE, BACKOFF,
+                                     CONNECTING, IDLE, or VOID
+         status : sec_since_connect  optional string, containing  an  integer,
+                                     at least 0
+         status : sec_since_disconnect
+                                     optional  string,  containing an integer,
+                                     at least 0
+         status : locks_held         optional string
+         status : locks_waiting      optional string
+         status : locks_lost         optional string
+         status : n_connections      optional string, containing  an  integer,
+                                     at least 2
+         status : bound_port         optional string, containing an integer
+       Common Columns:
+         external_ids                map of string-string pairs
+         other_config                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       target: string (must be unique within table)
+              Connection methods for clients.
+
+              The following connection methods are currently supported:
+
+              ssl:host[:port]
+                     The  specified  SSL port on the given host, which can eiā€
+                     ther be a DNS name (if built with unbound library) or  an
+                     IP  address.  A  valid SSL configuration must be provided
+                     when this form is used, this configuration can be  speciā€
+                     fied via command-line options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              tcp:host[:port]
+                     The specified TCP port on the given host, which  can  eiā€
+                     ther  be a DNS name (if built with unbound library) or an
+                     IP address (IPv4 or IPv6). If host is  an  IPv6  address,
+                     wrap it in square brackets, e.g. tcp:[::1]:6640.
+
+                     If port is not specified, it defaults to 6640.
+
+              pssl:[port][:host]
+                     Listens  for  SSL  connections on the specified TCP port.
+                     Specify 0 for  port  to  have  the  kernel  automatically
+                     choose  an available port. If host, which can either be a
+                     DNS name (if built with unbound library)  or  an  IP  adā€
+                     dress,  is  specified, then connections are restricted to
+                     the resolved or specified local IP address  (either  IPv4
+                     or  IPv6  address).  If  host is an IPv6 address, wrap in
+                     square brackets, e.g. pssl:6640:[::1].  If  host  is  not
+                     specified then it listens only on IPv4 (but not IPv6) adā€
+                     dresses.  A valid SSL configuration must be provided when
+                     this form is used, this can be specified either via  comā€
+                     mand-line options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              ptcp:[port][:host]
+                     Listens for connections on the specified TCP port.  Specā€
+                     ify 0 for port to have the kernel automatically choose an
+                     available  port.  If host, which can either be a DNS name
+                     (if built with unbound library)  or  an  IP  address,  is
+                     specified,  then  connections  are  restricted to the reā€
+                     solved or specified local IP address (either IPv4 or IPv6
+                     address). If host is an IPv6 address, wrap it  in  square
+                     brackets,  e.g. ptcp:6640:[::1]. If host is not specified
+                     then it listens only on IPv4 addresses.
+
+                     If port is not specified, it defaults to 6640.
+
+              When multiple clients are configured, the target values must  be
+              unique. Duplicate target values yield unspecified results.
+
+     Client Failure Detection and Handling:
+
+       max_backoff: optional integer, at least 1,000
+              Maximum  number  of  milliseconds to wait between connection atā€
+              tempts. Default is implementation-specific.
+
+       inactivity_probe: optional integer
+              Maximum number of milliseconds of idle time on connection to the
+              client before sending  an  inactivity  probe  message.  If  Open
+              vSwitch  does  not communicate with the client for the specified
+              number of seconds, it will send a probe. If a  response  is  not
+              received  for  the  same additional amount of time, Open vSwitch
+              assumes the connection has been broken and  attempts  to  reconā€
+              nect.  Default is implementation-specific. A value of 0 disables
+              inactivity probes.
+
+     Status:
+
+       Key-value pair of is_connected is always updated. Other key-value pairs
+       in the status columns may be updated depends on the target type.
+
+       When target specifies a connection method that listens for inbound conā€
+       nections (e.g. ptcp: or punix:), both  n_connections  and  is_connected
+       may also be updated while the remaining key-value pairs are omitted.
+
+       On  the  other  hand, when target specifies an outbound connection, all
+       key-value pairs may be updated, except  the  above-mentioned  two  key-
+       value  pairs associated with inbound connection targets. They are omitā€
+       ted.
+
+       is_connected: boolean
+              true if currently connected to this client, false otherwise.
+
+       status : last_error: optional string
+              A human-readable description of the last error on the connection
+              to the manager; i.e. strerror(errno). This key will  exist  only
+              if an error has occurred.
+
+       status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING,
+       IDLE, or VOID
+              The state of the connection to the manager:
+
+              VOID   Connection is disabled.
+
+              BACKOFF
+                     Attempting to reconnect at an increasing period.
+
+              CONNECTING
+                     Attempting to connect.
+
+              ACTIVE Connected, remote host responsive.
+
+              IDLE   Connection is idle. Waiting for response to keep-alive.
+
+              These  values  may  change in the future. They are provided only
+              for human consumption.
+
+       status : sec_since_connect: optional string, containing an integer, at
+       least 0
+              The amount of time since this client last successfully connected
+              to the database (in seconds). Value is empty if client has never
+              successfully been connected.
+
+       status : sec_since_disconnect: optional string, containing an integer,
+       at least 0
+              The amount of time since this client last disconnected from  the
+              database  (in  seconds). Value is empty if client has never disā€
+              connected.
+
+       status : locks_held: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  holds.  Omitted  if  the  connection  does not hold any
+              locks.
+
+       status : locks_waiting: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  is currently waiting to acquire. Omitted if the connecā€
+              tion is not waiting for any locks.
+
+       status : locks_lost: optional string
+              Space-separated list of the names of OVSDB locks that  the  conā€
+              nection  has  had  stolen by another OVSDB client. Omitted if no
+              locks have been stolen from this connection.
+
+       status : n_connections: optional string, containing an integer, at
+       least 2
+              When target specifies a connection method that listens  for  inā€
+              bound  connections  (e.g. ptcp: or pssl:) and more than one conā€
+              nection is actually active, the value is the  number  of  active
+              connections. Otherwise, this key-value pair is omitted.
+
+       status : bound_port: optional string, containing an integer
+              When target is ptcp: or pssl:, this is the TCP port on which the
+              OVSDB  server  is  listening.  (This is particularly useful when
+              target specifies a port of 0, allowing the kernel to choose  any
+              available port.)
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+       other_config: map of string-string pairs
+SSL TABLE
+       SSL configuration for ovn-sb database access.
+
+   Summary:
+       private_key                   string
+       certificate                   string
+       ca_cert                       string
+       bootstrap_ca_cert             boolean
+       ssl_protocols                 string
+       ssl_ciphers                   string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       private_key: string
+              Name of a PEM file  containing  the  private  key  used  as  the
+              switchā€™s identity for SSL connections to the controller.
+
+       certificate: string
+              Name  of a PEM file containing a certificate, signed by the cerā€
+              tificate authority (CA) used by the controller and manager, that
+              certifies the switchā€™s private key,  identifying  a  trustworthy
+              switch.
+
+       ca_cert: string
+              Name  of a PEM file containing the CA certificate used to verify
+              that the switch is connected to a trustworthy controller.
+
+       bootstrap_ca_cert: boolean
+              If set to true, then Open vSwitch will attempt to obtain the  CA
+              certificate  from the controller on its first SSL connection and
+              save it to the named PEM file. If it is successful, it will  imā€
+              mediately  drop  the  connection and reconnect, and from then on
+              all SSL connections  must  be  authenticated  by  a  certificate
+              signed  by the CA certificate thus obtained. This option exposes
+              the SSL connection to a man-in-the-middle attack  obtaining  the
+              initial  CA  certificate.  It may still be useful for bootstrapā€
+              ping.
+
+       ssl_protocols: string
+              List of SSL protocols to be enabled for SSL connections. The deā€
+              fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.
+
+       ssl_ciphers: string
+              List of ciphers (in OpenSSL cipher string  format)  to  be  supā€
+              ported  for  SSL  connections.  The  default when this option is
+              omitted is HIGH:!aNULL:!MD5.
+
+     Common Columns:
+
+       The overall purpose of these columns is described under Common  Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+Open vSwitch 23.06.3            DB Schema 1.1.1                   ovn-ic-sb(5)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ic-sb.5.pdf new file mode 100644 index 0000000000000000000000000000000000000000..9a1d5d2fac8d9d7d03e0737bedc81ab829454083 GIT binary patch literal 52130 zcma&NLzrgEwzi$NomrK(ZQHhO+qP}nwrv}4+O{fH|JvvO&grbqZbi(PamDP+xW_X@ zsvsgp%SgupLppvPUj#!+Drx6tZ*1sdX>Z3x;9%%tL2vF%K&wDYKx?8bC?=}(&nRqf z`_BtYBTE}g7f%^eH&Ywle-0p^b^L$(ntLwCMhh+>tJH$ z?qum=`p=59i;2Cf3orjaQ+Zbx2Uiy{OB>VwJpNZ-f?*|KAh0*Gg5lwzmoc?7cd;N~ z`)5Uo{-0A^Oq~em#cT{+OhrtM?M+Pi_+Xq}oJxupjB)jveR0*c9XPF9J-)b3WgXXVZJw z2TEeTpJxB&;URMQXnhQszf#xv*8+8H(dcJfSB^&jZ~$=sTFrh(yeiH`Vsu-Df9$SHzGH_mA|h%tkVSz;be=wgiULQOD6 z-$S46z4#c56!0~L-M_+_n8du)`QX1pYOwgnDQQ0D5lH_8Z_^K_lu^p}$lu}H)#IdS|@Q)I2W2Ey?=wv;-`0JsG9 zkGy|A=UuDlsz~q8y$!E$Lzg=e&{Yz-M!gfyn>iUINS-<=vac!=BMv|*qKJ6(#}E*u zi3vwwfd+q(`<;74Frq*Sh<}R}(^ki|jCa)`xvE=^00)PF3*vVi*ue^(!87RRd|=hz zt${rj$!yFr4VjPxipRR=-n;K}plv;z-eowME)x9>cy-HBk@!Q(2t0YC$F@}|ImcPe zgQhZqX?+u26V{l|6(lq$(~$nBH6k|zE= z(68`C7hS~YF%n3SfF|w&1Vg=^2KG$!CT#VNcOt*qsRDPjO#j?rFDy^{R4L-e#ER)z zh~YiLh5*}#TH)H4Z2iCq8Z=JD31ky5#d@QPqbcpqN1Jn2A(MU3g7}t@MS`yFAz52D zC^-d-8s-?rSETW*?0||`hOaYB6?6}G*I99P1v?a|b)Jh-LKcBR`2-XRrz&HWv9e0x z01~>)@XQI$^TRk{=T=6d1|iT!i+|f)Kl5hy5Fu7FkVrF3Y?+CnpG7fEC$@6mE91Y_+BextcD^(}1XRz~iZirSza%TOS!{-hzit zGC$g?8b*EkuMyIWTQp+u46>4HD|KKG9k&K)1NM4>xGq`c;$9@NXcIr zwwn=ZI{JcyRsNJtIPH47*=<)dmz!{u9oAEa6)}#wGz|xS2W$yU9o;YQ{Z92EPEen1 zXPu#h=ntXX?1;iR4UVp{b~_C9o(t{&Q}OStJkdmkAxN zz(KS#Mxe^V&tLn<&4RrI7oxj|qPGqSvOn2Oq!%I}*h=*)5#2>%PqjQCRNLTN-G5mS zW?5r4SN+%M13)^`Hj3*IY>lN1U*yW(q?Jd@>J1L67Sr4Zs3+wFfic1Qp^>%~a1w@+ zoj6e!Ki%LNI(0;Qh&_m5NYmd9Vpq#{m4gL!cr!hjV<{aDcJ<@d_wT`@ zqq)YZ&+N7RZO#MQk{s3Z5ipEZ6dD!DuwliD=vaB?-q)J~xC+rDJ=YPP9g}c5Gq=zl zUSHqBU_c%CCG<`_-q_c6zS5jKap~xcHr(~ZrVg4owWXM^WROqIo*Rcr(G={`2X)P@ zR`Vf@B)5kiAsa!Od%t@dEyZNV@nx-{+o$6;=ELXc8r?qUI5ClB3|N-3|4x1HTXg=i&wzBLCRgukYy(!n2HD9TSW^NjFE# zNY6cZecz%_+?y!vyw)8Yb-%YxQo!^hqrS0b9C?%sqNM-AI!c7hSo=_>2#k}(=8@pM zc1av>*|KAc#y{Bm3oL0&U}tJ)^8eJtKePWRkpJk8|BOtGjBGIfZ;kQa@`Ulf(kG>w zlTN?HF?x=uFUc0z0Il@Qkl`lGELjUNw#eiFR3}uMC@fG59H7aBem^FCR*WP)5t;LW zic78CBzk>}=jx?c#jL+!{mY{g)riIV;$mj2_vT#+^<>4$by+gv`hC)044pWuvSOsw zNpDt7Sh1ho$&>z$P;04Uok_fEGIZicCl@weU48rO^n0lXK-pL7M@pzJ3dx^~@8yo~ z7b3pi%e0+qB?~6ME}3XyZ|CmJvoBgd)Vq6Z&vc$wn5r9R;Q?_hRa#6r`c5_MSiz>U z&^n%%!ZtbT<#bbFlhZrAW9(~P2YLA8^}BhM?&kLTd1!kn70VuvrvU%_zels~XXJk~ zzn<=$mP^ozxmeYB?0jaPKgJ)9yOhFX3h2yl!d1H!uB?3q4nzSD z-&(c}UaPZ!*&6-2dUN(F-DiznOZw9tt=Y7u{ie|lUH92Z%lk&j&A53j5w}f!r?=TE zZTIO}tyWik;x-~IO`ecI`vYh1N26a`Ewjp~?P}Am*;j7GTdL)DTdQI(>P~;=$tT&h zx|x1FSKofM-m=jjgREz0*aK1J#0s|# z^{B9a#{_OY$IlJEwRTmPf%Ds)wTB0m%C4~zjz3_}XiCSN-iWf_(N!aI*tRJx`}uWi zRGD_4ujwO!l^gA0X?QRSop97Xu|4)}SRL}tb-YJx53aqKfmLm zu5A)=-yWNQW|ZmTE?mCsStUY!fmaChu?i!M>GRSQg8jbb*L$IU(Qdy)|9PFhjTR>- zq!uf`G0peAl#KR!Ij%7IMZ-3HIggK*nyq0Y`6<9zm|Sgz9+#rzK1x8?odYOqLb11A zIrd`v4xJ9Nc3L}4NIPvNW$KWw6PnR2r}JM z4DG}3>E-iD{Z4=WGkU7V2&!SxBR(|o;f2b4c_SrdxevNuo9(WzhK? zrqeKEq~}a?oEAakTy|h@OQ-KPecDb+3b1*a1G#)8mfs2!){f_{dmk&$LEa^$*Kzyx zb#seHHh3ZMs>WxT7S1GQz5BGj9>^R#*&4{xw-GvaT;L;y9g$74p#!E&f43sM7R~K2 zKY-f&$L8tb8&Tkn4-cp2(vT>M%ls5eeLSn`yegJ7$V1Vgk0AdY3%;S`o6(T@+_{2E zWS4Dpji%R*eP@BywTfrgqQCXi?+$6=rJ#-f)T3(xwj25x5DFB6TT0f zY{OrCpaoB1HQ>QWwcniDa)4||C<(RdirDQx7n^@`rn_K5uuAtzJaoOE$zQchvM>+XCwZ38c(+nL{GyUOA4K0?v^l0-mU8eb(#QX=!MekOX?wQI7Dv0&8+WD}o8k0LqA zdf=Gl8K6UB95B@6)!d1bTa!;Bz`Rhw3Wf)iXbq7}6Mj`I*mpV{|E^^LUu)_p%up!8 zA`aTPi^8OD=pnfs79pvtiBqEsvxh2g?P$AqPIHkLPZJf#cl|cvo#1nZGla>vHBq4% z<7@P3BooI~@NK(b>g@oI^pJhFju8QEMJ@L`gop=lU&ppNQjdUsi8 zS;nnBK1cqVaM8_mq zC@>yMa=}d(2*%nwh*iiOD5dbOan@8y$-p8ZFp&(AMzT~qysKfEECJ`1`{e{f`#jS# z$j6AqE)|8_owUpOCkJi-Ev0h$98!2)ul`IQ_qkla#j`Qupm_wn>AJb_4a;g!>=iQg ztw;9L0g~t!TB)ny0EWC7(yaoFaS(Qc%(GHk9xW8G(5k415E~_Ro4pKp2=4-cW3Y zZ!}R2U$!A`f@`XA=M=4L`S=1rGb2|TfAlOccmNF!iopL&lJr*!8HKYqiuNOFA>nvK z2&@*zqRE-BmnAoltAw5ehSjk^r}42u3RwLu2Qbo13=wO=U@KLq=Zn=j#4ymaNZJ{r zBDTUXTdB~oHYNw;&I^jJf`ng?U>4U2vz^E=B#s9KlQfM8CB+ehjx-wt&@-)XBf*PL zwhfXE1_J+3sa^6eg`x(VQH(7@2k=q;2E7@B_qdD%hbTxPizidjU2wRS2fXShL4p9# z{AoN1)}GQesqSEl5l)K{AjzAvg)BV2^0#j>?M<+mQpPiJe$e=8x zAH()5AW49u5jyh}B$tHvq|8tUlm{;s7>;G=1qA?==xJ4P?Fri=`c;d=5IqUi>3nK} zC?yZzgtET{3JJ+3#166Nq!e;hl4!L?QZ#U(EeM9x%582`Sc_tUD1O0zAt-`mP%e;) zx($>OWi-u}4}0LQ+$`UP$; z;VEfB|KnlkO9YNieR0onk+2)L>9ugCle+b_1|SDrMKY)IpxwK25<)8ynvW{V0->2}U01aQL8q@z&?(XM zqC*oXz@Y#lCP_}Ge$P8dM2?3&7|5_fIuuA8T|+H~;uuVj;F8ZJ!FmL7p4Y0MPoiow zsuSbX1>^nfz@v|scpJ92n=kD6uFouocm&3%Ql5vAZ~VcS`^&Bf_)91#Rw%kXS;@#1 za5lczqja`>Ww%Hb(8c(!K*P+`_Sjr+@btO(7idPig8X0F_J2g{|A<>Q4vzm7w@i%x zioG#0{Wrn4Qng7tfCN(S6ZNG8@UR@c4P9R>CK#Rx63O8#HWqD_Efc{eLOR8taGz%t zXLelE%s>RRjaB)2z22%N@`4cH*8GReG=xy`v*h8Ab_TvB6gt%LW<|-%9xwc@;NwAT zIz}kYkUm7oi;mMLx<3&FSeU4UhZFz&oaY^>>E(LP4dwN_c7R6K$8z*7=P;Rv zh^5q$s#t3KfGb;8%tl~5Tlfha20SVTpk@k+L4SOOLP?+*lD(fFz3OUKeO!$etm=TW zk$am?p*Z(2iK?s3j!G@>iY=mfoL$mWOvg#KD~rqbBvY|L38C<5Pww39J)a&Bj;~Ym>s+awh&DffvLT^Y zYkiHNxi}ogc#ZwanHbDhMoB`&8F`p^D9WLo0mGZw{V^=%#X}`KH`?!A)Ark-bQZkb z&JN6$Kg2avgiY2nw*8KpfV%4Dh_(2qd?gK9}FZ?J2&xScfZ+4l~%GIqx;c@k9OeNecR=3v&OYy)(PQHjXq$SB?i@z12Qkf`f931urp(6Wa3GD}@rdGD zQgXBn1~_Lco;FFbZNW_uGAkZK$Qyu{L2mD4`G)zX_83pGxxA5RTDBYp44hQye_tIT zQy2>DH1}K)7Twc&#bo@2ovy~)?}|b(S6yAaiVx+kz$m=K9W7c2=u+Dh4TWV%= zgD~Bd6=@Pg0bcdZZx{R^=V$uY*Ed<{+>ni%jvn z>_8fjGe+#zJNP3f|0K8GrY)!egiNZL%5$y|v(4#7^A&Wm`ml|XV?v`Jy|RhHmEyDQ zAV@K5;=`g)43&JDXt+U$n|6#o>WACfhtxpZQ&w1Q~kJAZ1?MB?=$)>lR_*e96UbeF$6iQ7ijy9 z?(Ek7X{fNg{Hq>EyU@58;(J-4&T6zdm+J}s_Q;T5d&6oY`_{1@I9&*kxiD^MLr?r< zZn$Sv-R1XF-;hHy>=%`HxW&=>ll`Y@(}{AuMqj24Y=Dqww2$fRbV6eAn2Mb#&^A@K z=S4n%*wE&Uer>Uh>pC;KazA7`eZIolN53rODak=XL@|k`r4%sOV5glDaM%POiBSyP ze*jo_)N1om7=YpPB=8Kg;+gj$+gF{_`}hH+BNnp!`-c5*IEkH|<^OIN=f4atGsAyn zaMl0GcCjJ(uB-3Ys+dP00S!j)8jUY!%4M}Qk|CyYV@C*)wDnAYS+0JE`MF>M)fZiJ z+-@-U0c}lh@|t75O$>v1epG*F9>XHuV7|c`{X}o!OUBi$!K&|Rkw>%V3;8zubT!}; zQIt?T`?kzs%Kd53`3o(!uNQ+IO^k0>;|^Qyusouw?fY@6yp2)dpw5|6v6B-Us)*^>|j;6p#ypVpHsDQ*bz8TlUPKh1KLk0=wIQ`gu z@eIg}*TFcq{&hyKIGyYva%FmLIFCqtcC-4KeS&|LFRpgbBwf+yO-%4nwUS18%0+c* zh&R&s((NdBk>oT_X=OY-B1?%t9Ph%8P$|^9VTPjms3A!jtwk8PRFtNwgb^xp*+R46 zH;D^1mvJFLBp4yNQ09SBOaT>0!Lx(x(`aMGokQZ9;SDjWB+A0eq{SPL*PC9V()QM8rGC{@I1k;ssVV zg!v`%wkv@LbWCbHDmCyw(fp5zxw~B4sR8aAX10MX8H@cTvwJ0ZX!%^6+h9nen5~vnq_Gog4xkFS|mpm8ETno z{q*6UZ}E;{{QU;wU)@$Z`j9h;rw2+5VF{@I}_R^8Q#?r+F`L*Y$!#0|I#rXVA6Am_d`Cj48(~#L=?+;oIo7EJ$m2Y z;yJUU1doM-JZy@fJ2lR{0cLDBPZ5hZ8IX(@=)!r$a1a{wTIo>LqFvnVJDrXw%jvqu z`02j`UWHD5egf>K%lK@j%Qgyg1GYnx_-Q(CG5H-^)Ww&qskM~fX2uT`Ktaj; zlu$L`a^l0H`o*vy)_s=rss&la=s3#~&qV)<3qpj~y;fK=E`sb(D1(P{3K!>z%3Hpl z%8V4M71?RWW_vCE*?uSxFUFk7y-CRHTX`*b=gz<~CqfG6 zINy4w`LMi4wkQ(U;&ItmL*AO(lH!eewN$i_WO20EGhOPya1`5r8cs_cmUG#q!AO0J zeuI(Nl?X+{B;N5XKC9+>rj5_J^lVjZ-@!e|?PB^m*2IfyuO0r-*AH1s+aMeV#|gTR*!< z!Je}MERMnqg`uuQv3?w7)sn8(Y6YdDYSy`e z5#2bXviD=Do%}4p%55<9^6Q9>W4y;my*zPfB$x$Z8k?Q-oU^X(oh(bSZ)f%u zW$r~Z7t>|gRMa;v)dBw0PEC-I!2wv0e6$OVOBKT}w5O~%q%P$$q5f?0J7kSAY>ed{ z0W<%1UCxvkm%S=azH>GqF9CmH%`F(GVN-cAPphV;ivBTi1Y4C`1?lL$zJd--)%m!m zS-f->?w!-OwOwBTmOmQTU$ImSO%E2TA3)3EX5)|6L;Ba0qOkYd%S66Kh00z^`?H`U zN5%8ssszG9dFXK$3pbnV7o%^K);teBD`NcRowF^kIOpg!;F%7f;UYUN1G*Gh##S(> z;L~)&;|}IshO)RrgZokKT_E&xxelWiY!0N1&?$6w-3{JR>uWq5 zuxmWtTJXkQvm9sTyzJmToZrcW*O<)9K9uvLYg(t#b<1~aL;;z^AoaHps_}G18-mTw zwqdfsuX^okpAS9E6p(IzDmcY-`xB7gL2*x4eEAY446UA3J1pV&R&-FT$8ue;&e~|? zZze6&)hH;V=RccwHfKm(!|B4|>d?$UdS|Xi4L+1`wyQ9qGe1K=Qph&Xz@8f@dJG(b zk?8KD^(Hveg1G(2(eF$w{($PMD)bMI=kdjCfM25BdH>x}$rxs_4>e3_MiS>{O+QRP znU)a!tB9W@|FVelE`;NBDBsSz^x8KP2r?Q&r*%HAuMb+%4xp;FUguC4UzMmpfU6g zvJiXYQ4VmQLy)S%M7Gy*YFW{MJM>33z!;{0pPJbxWKwfFrQ4frp+2?BQzHL{y}JS3 zA_-?%hvLFf)=;1c(C)?5T8MwRWcT<1Hkw8U`ZvM;L#F>B7$Xzw{}GJ+-vs0MZwS_^ z4v71YW_?q?uXSlO8_A})(Ponj#IOu9i|yeU4NB{5!;y9(@oc|ke^&p9$4x4tYfHue zkMg}A>Y2IMF&ooY5TS^=)_==HZ-%lp*Ed`7jqZxC5pbX09J%_xpRwm`{J@C|Tq$ET z1rWr(uCmQPK6mk)v50@TzR^o(;m9Oi?+cg~{Lwn2gjEr#7Z2AViLnI0A0t zMGLQ%Yl*|cFb@z~!cV2p#E$61me&YEqp@1d{X+r70ZsnzJmKsjDrFlvb1h5y?L(Xe zeB~(i+}GfeD7PsEP{qM&c8{GBC_|K^ro4-=>P^aQ#J_0_O3SBffkE5RiymT?F2jIx z^Bo**v|8BCHBR;8#vZ7MiIgkJdV&}Lxv3GO%o?J)p45J-=->{2tG4i?n>u-eL&-oX zPTi~NJS-~T5dV~M3Wt;p=7#bWTq1ksVE%yOy6CZE7C5sSy|h}o_Syers*07Y8${rO zf(Z(>&sLNuAQ8ZB!L-nGKsp04_5w_cdVZxDR4QSPo!Z~Lp#N&)-XXewQoqiSSOh#& z_5XHZdk1Vjexl=b$_`ix_8+hfN`Co!#lmb1L8$fFg~4Kk5T%q--6yIi1 z_tk(cyQDJ;f*}eyr5V=sJw%#PpfTYzI$r%zcN0vn(-?_i_|>=!LQ3O?sYUvpUOZoz z+=)g?Y>CK9x@6Bz&eFnEC1H_&z||XmpRn^p=l;Q%9*X~bJR+D7%L_jR^vTf|lNoCq zMbZnUy|r#HYiYF;B(qLlqWdO?9r-~QD!;79TM<|uj7Z+gB~klDJ>NBKQw1?5wu)FE z?}mBzoCD$G0EmMO;Pci81r8g_a*PT!Ag%?)A__>17Y-Om(j)G`jsgiKcHuxc{?zEY zz2Ce`M38@sp&rl+t^}{#Hya6O=u<8ewfJbm6el`JF`pl9Y>a zAI!)`n7gXFyul3>BTM_+l;iW}FPqmEEej#00NrC*B&A#9x9V6%{T3CTlcTwdaD&FwW zIm)AzjqTccV#9E0LLicJmI;WcF^j=2%h91EIAZvWC#;EsTu2lPZ5UBs4qO2)IboD< zTDtk^hqVRuoox&UVG^VPU*A(MrQ>a0oW)zfKx!vkIKp;$R$TSj=souh7?Q=vbO$D! zF^C37A+c5c9E|VZa7vyyv0Tt=)aAZ3HRU1$iMV2g-+40=N;W2yTUiedHHfOHT1;O@ zjW#xe+ZkllPpnwr3yd$Eu9O_?Fdj0^{KBAN4H02+ORDqex7*#XPr7)uBo`` zeDY7x<`9`xft$ZQjbAF>{rp{%x-7~UEQ$)t_u_JfZTWNC`t4E-`Ld)XVCv`3jTxm z|6k0q{$Kcl<=^=Nmj5bW(5kuP1n5BTTUXwHk zZ77roDY>nhPgFnSdIKSmNK8d$%Z+2=MDPFkp5xpL>?=S*MZ4_3W#*<4YSH%5M0%pV zY{`M~!U5&XES6>~`%2cb}2j4aUjcKLto!J@sTrxdKO zg&j8h0qa`tYp|H6G}oULiRwTkjDAC`*_l0q2pcbm9~Z_NskaG#y>a~#D;sqjYOtm+AZ1e0i!Tugz^62K z`Z+yTSO7KSm{-j#9XHo$JFkxW$5JYo$y0sDSiKZjc|a#<$P!5nfsxMzTa&ww4oUdm zpxqX*goZ~>Aab3I1!&UW(oIO8gNcA~t7Z%1;#t;cTkj3)2_hb$ zNJI11;CW%88MCy+wro>oa4A^D^hFhWs1fG~KH*=>v;({(jS{2=#>zbBCKBfz>EW}^ z6r{sJSN_tgI&!7VuCmTma| z*k+^6l-{^dXR6EpNZz6fs8Lkf(@Un9<%pLOrdM`{ZfxP&^Q|6Yzj-$ zE`uyJcC{3_SzhzWS9Pt;GB!28vFL!O^;%QaJmzG+5oA^elZgS2-E%u7wT(Iy5&Q5J zpevK)c)nc^%_rgz-99#5dd}${c)CZ2`tDg-MOA`;2j^W`HO%6rG(dX&f+XT1<(RdH?=#SLobRA;+2kplwV3dP!asuy3$I9vJu2VL{SjJ%;Ne3)BcMJ@aCMJ8K1>q4)vsMb;_N++`I2jy`Im zM!rAf&tCoO>w0DpSJDIgi8y$C82?!Y10}rQkjj%P6hbNEiyqZVp<@Y$R|f$ZPaM92 z4EJLic9?DD_N|H~iZNc?w;VsK8K=~@{(-~OqPGE2k56_p)bbKs9G}3Z;2O;=K5kwX zoOzyM=+tGUuacGtg1ww*b*fM^Ro}gQ>&qA+tIjQ;?KGhp_DZ7!snj?NyKNe4oF+;) zR4JlLt*oX@4b^8^&@+Ts?lW<-Ds_HXorW+>xm)h(ml1 zPf=xa%^XauB$)vw5d5mqkuXl>&_lqrwjkM_maVO7^3ta`t8N%kFk3L>9!&XyaKxCC zIYxlw1ZW)-j#L9WB<9F)O1^x_u2OUe#QYU+r&nhHRrXbgP1lF6hWEy_XBWIphM=WP z?)l7*vTL=P1Jr~`p=Ys4{d=NKF)*e+b`%ZG^dQq$-(e5)ugaf$w0VQ@2lnO(istFwwJn%Li&nJU7I`9@NXC{ zpu3wO(iAc7aijEGL)|u2HPqG;B9L(r9mYi;F!nV9yw|Q z3B(WFkn%OxKsNIfoC1;nOQGESvj=b`eKtl6lG{Z7F2PHCqMuxIyC2yyd5!_Xjhrqc z@<`u)bB0=dxdcqMcY`}sg5R-r^u}Kd7bp7TB3&8Ba>>{4Ard9dEtX=jrS&N1)UDG7 za5VsVf_56wa67TYiaA)vMh{AHA=wl7FS{~9HU@dGHEbu?U%bmq5=V0VO6ui1yFI36 zMq9UwjQmwZ>q3R!c2D7?=xJP8n!7>0xJg{WFEA4Q_Vu_aGQ%V><0_-bLMKevpo{y!g#-jrt`x{Ap6zs=~cKeb*Flwn?Ls5^Aw;Cv!KsjFwINook220{l44*PY@3sxuU-#g#xwE-d3`xKu(;Vb-xru6?>s;FhiYkXR^Y5u zJx>C=JG*NL-qi;4k^vWmOfm+4a~qbOQ!Z8R1)95(kpdFFY^iM zEnUxmreTOE4{HNlst$x+4}WinhW~e{(b~=Ad*bH~qu{QjJOO@pd9YN%sA`A{nDyPKnB*#d zjrNVaPFNYsE==Zs`do?If;xpW+{K-^?fLv9_rTZJ*bGjS#i+1M=S%uLVq8xlTirQ8Fcnn`~{fe#aTd_wG) zdAmv=BMHdt2bKu5i6&qLu3wGnAKdXLwPUROOZ5GZnEQ|DV`5?bzY1uUe`keR{;RBT zs|LXChy&$+{QnctXxbzcQt)74t_zxlXc>8Xo9p2c%s?aNNH^O_;z>#KzCwPlY6+}B|$M}7maxf7KLp6G)SCtld92A$9wcs^hEOl?peX8BABOB7O* zKOC@qV3X;be>}^nc&3*^%y<~biG24BA2i&my&shoZ=&JxxME_&@3R`}zXuCsNKUbh z?-Nd;`4Eppl#r7ZBzWA=b=E%R5>I&IEzn?*d-!`f^8b4OL7XT14UfI9HV+%oTe(PA z4n0Oflr_P_u2&y4?lhN7QNd*^EI!LA+Z^#iemkA!GCC`kD0YLhT2*B&2`t7KXY|cr z&N%Cw2T^q~rB+)RD`sA(EMW|D9wM_O1KGM^-!A&(V$_7IU?RL??s_CTgEH0BGcNh< z8<6fu^+BP!c$3Yk!e%7-yW;hjAS!1J8>85LiB)tpZO645mZuKp*LJI}vYLC_Ee~U; zyVyekE0)tSxI&r7KmI#oS(CX~C#Bt#>?W`7Uo~|pz>17fW&yA7K=g{*ZhVczl!iXb z{2YBR?!HMFq%Z;kVIH5PvX`_N9WhxgJjHHn-6hEbO|hjZzVpIUWS)k>A} zRbwXyFj~0KiZbj%TjseoWDdG+Cr&dD+VArm50yQ;tEimS?C&-!`Lb7@3Siub3{pW= zo4RS&Pnsowk@%&ykrMnY;wHN3vfSVi(aY9j@MV-Mv z8&G%=g=;-vNrGdaS?(%?Em(k>p9ql-pX3xL@jBFUe7;c1`67x>X05~DVdu!?fuS=k zNJDBdV8{>$v=nO)Dahky}?Z%2^guEXh{5Wk+!=EtC@ya zv3o*8=n|(|H5>^$bA8&wKmpiH#1j2dWkFx7$Q#3krCLrulo|XZaG=;wQn6OjLyGyL z+u4+jF^@&%B+s8Us-vs`x!WR;=l6aQRP>euuwtCLzJLUBt)PgvnCXZGqJ;?--LVi- z1Iz5pf!(lVLZYUIhNXrsD>DV({ijKk$@TLUE1>JLETu4{67FiNBiV~5`UNMBKLuQ| zqb}Ap;`*{|c|YL9-u)9I4kU7J-tWVP_nayFQcqyZ6R-H?WUnqL6i?t)V}5!}aW&Ot zp@j!q3(5Djw61y_c2A@RnI_^`l@ zhzYM3+r!isXX7AWPFyj z4SV84q5dwx8zPI6$A!<2%mMY|b=3wTc)%YTt+zPjgyEF*Jt83R&g08et~@%uAMM@y z&ai?p)_*)MS!weA@378C$@2?Mv}Qpr5)|$+M3j-so~VDs9fd@@HvY&2YJIeRBz%X^U(^GH`t}G0NR-n&jw^0DsWE*+1``2iqfB{Cm^rHkf(RcZX9BJ+S@SO= zbOIAV0x@ckd9YW2i^q{|zY?#}5vPG~R0;3?97-c0G^O7D7zl&3SF8lv0<4Ck%E=wK z{c?~?!T2oct$)C0IBAy$xf$pYODlfbkU?1T#bgXo&%Ty6m@}h=yYilH&`hI6eszi_ z71j2>&huM=&uuxqqpE92wr+<;u9D1--lAToNAWk&En<4{+Z`yQ42KP_Flc_qDC*|E z$IBr)@38`z|1M2R))=`Z-!-!OU}xlPoD@`o&lkhD08o18#OFPvJAIGwPQ?MMK+6!v zM`2r?`e$twmp7y&oUt)ze|FLjEaf;@WyWwzj6=E*0=-(pZ%i;Z$Ekh6xkebl zI`}+#^S>eee}OBTO4a^t@c*|)g^`nm;eP}EEdMT2Vg0X)R8}?rDN>n0{!dG`_CN|p zbmx8<`_-XHq!A}|nm!38EJ-+#5mEtgg4Xx&kJJz24)egiP~sX@wv-Z;Hk;YPa{6+4 zH{@QVG`8bI`A_dgjLsv=2cOXgWu-qY+p!T>)_&cE(ev^=FrAD#@e>L$FnM5#Nf$Qf zA3vUNNT@(xWOO1J((4R5aXB_gjAW;{YX0xvs~{d0YMD?KXI>^BJWhDHcaAc*ZB)a( zH1`%0yv?(#zh2+wC0jL;`$sqF>n zZU#GNnq_FKNaiP8es`{*=WyfG{nKElU+#Ya750rfcEjDzcN3-2-#P`0l5DCo`qZIf zvN%=kgkrvhUBU>k^LDu%V=7WSmpq&PUIq8CO(dhLuHZ}m!$PtQSbUC0oO8)d0n?L4 z-^7?Cqf2@Qj~7HotEpK{WR_CB9-nbm0Uoz(tgUaAZyEjyh+5adT}7Ne`N}7#{6$4r z0i~;EzfnyLO!ZNisN#l!KdusurlWMDZOb?i(xpV8vT%>DA*QP?X0Z$Mm182AI+6;K zPd`Z}*97yEfF)!o`=%g{00b3W06}UXh-DyjUV~czhbYoqsy5M>NXys~x^?W36{#gT zDOAJ(e&)2TD-&*dyj!EhJ(Zq1e1%e`o}EaoiQ?kf*{b zfodjCQ%y9P2jrQptC`qI)J^lJPZ><8Gi<;@fE^pB1;TwK-Gjzi`2euL++P7>UY0N46_g>w~EO7~72`|IChPcn-> zs?Nsbu^X&OxS-w-o5IQo4!aq8J)L+d3=cTMFtX5Ncu=V+kT%oK@s1w_9%!-E49gaU0dScaTNVUdFb2wV@^L1OLvJ`vz+riKdSK08rIyCZd;D+)8X6bUSg3;raha&A^np}`=lHi zxrLWsr2v`+G~|4esb@=)%^~f*cP*gA&Z5mxDW!ZUU07Ui#wFMf4$dBPMs&dvxE_sz zoEDOn0K;!lai4z)G6(@Lo@=US7aC8gs~qt2@&44rOwCY%CL8^FYPRU&Q)FC|+s;;{ zbvCWkzAmdBSD!&BHTc9b3w&7i|MB(~P<1TJ{%~-2cL^F~V6?iPFl!QC~uLvSa- z65L$_!3hM15Hz^v+mMrUa^<~s&->Q@E|@*tGcDECzpm=(s+pGe?1#V!a~Oa++ic1A zpEDkR@k$r+oer^kFYU+~sJHA1Jzaf#q@df@ub5!jN7b^?IbfaqPLh-MA|7nu-HfKK zUl1jKK4adEa<0H0dTS$nc;s*^2?b_Ozd8^X`Gy3Zp~~FznU74ywNjX&`*axNK?7L) zE6*rfN0u0)WTd-+HS6gCwJ(cxJB)=sc#G{-cocJRh;dw5WspFO6RgAv#Y>7PPOeC5 zIu;V3nZQ@x7K$pi!_oP{z}KMyFWX=taCn?jtv#PxvjB`<1YHvyfw4HBruU9eB5pIG z`;vOTu^<*2f6=!*XoXc0;pWFWlKCx|3hcdjEM|jZ3Toj_gNPutc~v6Xe0gt!jQ=f? zv`j7C%y&75qbLcKQQo{S)XcX2c`UjLM&yA8ZZC^<-$CB7^-`nQRXNhz*k*`AjP7@; z_Z3@WvUD3%4XI0+WWOFCD^KN;f?`yc(qiU|_kE&%Sim`OzO40=Du3uPS!~J0#lE z?aJHHV3@3V9et2kAsGE*+m|;mg(GC~t<~)_CcG4Wqfp&4=@`P3S#k zdPJjtC4AtD5LDvrB@wpDN8pKFztPAR;B=GoV0yLoSf5lkSjd#<@}J!6}eG$(?3 zbaI$A!{wa!+?ERShB_h)SHu~X3(vP+o4;>X$0fF=UJmo4I|!w%y6(jHVkz?L#Wwur zfrlSxFC&^kitli4UTpngkHz9h^4m0D&hh81BqR)CmO;T}yR&v6rI3#W&T-ld!kuL@ z&OOk~EYOMktW`fOt$Kqvlk{}H!oDzPyS8!9fcYwaS;Y&c@<(x0ha$r}qrFZZ|DMs_ zLLTfv1qU?vPkLrAC{L<~Ih7i5oFXspzwrT1>@(SJoC-)RKW?+dejXrtZ%XuDR^{~m z*}k9|B;XCprl=CB+PrR)qSBmctCKK|oalE`bX!|tGNv&wgj2WJ^dp|x`G+B#;wU?= z#Je=CiFdvqzUmos&WO{oVC@It6*j%gS`BC*MwC%C(n2~8co*8{(fr{0LAMu;ItpaNcs>)bVds->CKT*gl9 z6ua*nhQaBKR2_jz9@#;&{jl)FA?uoaucbuV>-( zFE}O@%5O5Gm&9>Pzk2jDSj$^@Ko6x@QmMr$=ogR;w#Y=Wt2a2kDbMugzjl_^KCQu^ zBp~Km*viy`t2WFMB1_IjU%Wl*BkS>g(U0-QL{Vv?shRXLs$sDgl28_pJ{Zim%Q3BD zrYR@(0a@?|IHAc@;lE7Vo~C0@>oly~e;Vi5|JBos{XgtS2Q zGnPxWT`$ zq$Vb6e)6J7x5>PuZB)BWk?uX+FhtKpal%r_!wl8Xf==xo4d>TfckSYHgOq({`T1fl z!UXS@(J8&!b*&O{gPMFbi+UW!kb?bA$we2k#b|dvOeb5ytK+q?UiM60<o)ZgTs z58h1J5ul`yuf}`2fB2O99xbK`))p;IF-}}NE)M%l#H&tbx(!P4H2?6k-n)7W-KNX| zzSwNi+61Z!It?6pSiZ~&!Kw##U7qmz3U6D60GvvjSQp9=w7gHo(k$;2rI(Y?h2^JN zo9z(c&_ej^og8I&2w}VKJKfHLyuRtxoD)vggy3k&XRM_~5@CGS+Q-CB7tVg~jCxWO zG=DAX6?eYv&Kl9ulP$n-xiQ$h`Ho0G&bBj%v39oPR(klWb#7YbQFa@k{3y4oX7$+0 zpCvOaufqSHs>&vvP6(pdgOL+D8}bY+L-WJYfQAyfo}wI|OOq&!Lv==vAmXR3W_{x+ z@fOyH+D{>qUp5gA&tdo?rshwZ6Ocp|J)mI^6R|l2^re!~KLFtEGjT`)8dhjX4D^XZ zmAogX`yeJg7)JCgLgipBecbsu)xJ>5>k}sMEK_K^S!DVst0jC~!QZCo364Q`kRI@q zgC3>I&sms?j?7esqjV-*hRF|FP76u>T7aSem-^6zTI5AnKAKuG%*+2X z9~T(o_TQlBuUf-%1aK!0#m{q&X`eUb36X|p0)WOeinH$0-@_0*G1>=$uxTR~!YdpO z9qfCl^?SPsOsV`SgYetGF=3qGb~sFA1d}Vd@`h~EV8&ZrdoF6Zl&=}2Xz&on9yuqO z5+LhusyJcUR1CUC%GsC|WxSy}<}5$wzg-x=1j+-BspKc1pxTAv^Q64*UmIrCZOA^cO`6A48tJI3 z=5c!5G{k4M*~a40RJJn>HZ&dS;bKY(vX#=kt}v4f-DQCVOQgZyxz8H5MY!duC*4Vc z5Rh0!-^WO#*iCSBST1+0n>+ou(Wsy$oxxsIJG(Zl!A8h==tygLf%p~8wi%{@iVX8G z*$ z>sZJxF(DQ)@P0<&s1HYggr*G)$t#WQvedJ(Wx5o(*M2qc>~v+->Pz0pK4Vvq#F%s# z`f&D;3+wrR=yIh_oR+jUd>Rf)3iFa%#o?~j-jlmN~M&gZ0QaG{ClLE@A73K z;o<`_(1<4B*nC;XrY%DQU?_c`X;Psi+{{a1)Y*}-f1NxACx7$ZvfLWwka~tIDFUAH zAe+blT=Q~qMR%igeG-FDlUPWTCNqfvPW=px$lyJz5G^MQ(YGd8@G&@DD&_rP_@bq7 z`7E$Z+gGCLLGP!_Iy+~O8qb5(kUXWzfj0Qe0uj(L^Rar_*PG9-^S9w-W=sgX3d`|> zH3uptR*6*yGs=zhv8O8;%J2%SAZ46r$6#8kCO+AofAFfPLhJr+9uqwr$Zr`}3Zw&z zPYB>xD#rRc5SgCuh^XSlrdFkf`@LjpC1?ogl5J*8sss6^nBT+iYpEGoXNQd2VIrzy ziRDyL#@6%RhRm0au?s{rFtO4yo$0SD!YFRrcOiQ%G1!rM!D6OL*ZbN&ri~`PE_J%R zS`?B#H3NRmM|_{vrkZg)0vo%ln)B_|@*1C&ttgGan(fhZO34kS5WL2r3aJjU9 z|FYzx!9JJRm*qxynL7@C(oN%zh-)sx(l;J1jP4!!$CXi@f-!h!nsIe^r=7_sNFUdP zb8+AGhlp(YetF-ni+b<%(J_z8N<=$BJtQ=vf7&`%g?jN*nyb`Q*3BsHrA;3i(3dXBodI6ZNnkEOezp2QqWp54AB--?u=nk1#LZR9yMpuh{%R`1l$B!x^q!VJh+ z@xK6Su$^PNAc!$$NRn`>u4`nYPgi|ED|Yw(sGkT8`6Y}MtV1i zp+fmEq#0rtF9JzbxLO43rYSQii;AvUq^3{EDzhG)m&lkZ1J6u_`s>YO8J}@KTWDO# z;m_OVXA4J0;rv!2UZjqhE>~PH!>d*##S1YkVZazTu%x3iZktgnc4Kury;v+xQB|27 zsjIi2$-fd=PPA*}8H39KqyCDTX3m-|C3fRj3$d^9t2HNmkN1go3Qc!-Bole9k4k8e zwnJ6&zN zVYTHqF2uv(qn1o0V*{1a04Sbu|4POm<0`&r_;VrER&Dw3(gJ#2D>-P$5m7PgYn%_E zDLxUtTtJ>~Zk@JZKx`h%P~Q$hk7~}J{;}wUwqR8+wq238jkc`P&q3E|BV)__!K>7X ze|nIWfF9$d{|Xn;lyuNn=q8l7T9Z?V_5ep+NSX+T0BZ4I%OJ=7GZGAVVG!nhocEL} zN$#C{Ql^m=*hnE-*6|{z<%LP)18w>3#kHMZ=}3VAMCIXwJ9`hPV5_PPi|ihfFy9=n`7i#x`H%w-F!`i@7ozfF6VV5Ul1?8 z-L)P7ghSF!WIlvY*YYgN-HF*pD4f3-K~2xWk&Z*6mKcrqM0p1mqJDNpGg9BUt6>VP z&g(|1{yaBU;wcR2i$qFQ4^u#ko8ODv$UAUsRDkL8Z42STxGpTk%m|!f04|I5{>AlMY7*}qP*e>p?5aIyR~$^KVoX!ife8G1}>#Qrk}=JJH5qo%xZ4f*+a zwQGx2Jh>gK6pov*BO9S?426Q&Q1uTol4UPx zejApPmEg`DH}6cgHCcQyk*N#5UYJ<{nOFI-~fcXMQ$xqkrQg-*v4?n`T7#O2kzqF0eQA$las8?vi+3y=5+eDjYZo4bA6>vM`j?W>?LD+k!?(E= z`IS*r5+(TJ^Dz(FDAZ+dR1)q#q7c0aIp6kFsQRSxsw*)~+k_2;NS4!pdMHozCAJsJ zjKX2K%{OXOGj6tgN~n2mHW(Lpc1b|n2zM41Lu-ZCBuYjrxeoTLW*Y<#O|6pk^XKIY z=k!8fVo(js@W>srp+<$-K15~gwnIQyqpAYRu@{~Nt1rp=J4iRDF2_TVLpbv7$W%`D zfz2<@S){iiIXm`}LiHLN4TXzjG%JP3qkc~dUNt7iXRqg1_L|a+q3Bn517=cON(ZNC z!zY0vPS&u3!p>Fim={YH6n!8Dcn?0Lt#!Y^Rx0PQGILeFwFU|S7-;jtZ z2!=6PXab|`;_yPnYHGM(f2fO}UJ$uwQhXp_{;PO!@w<>Xl$3tkB3sL-aUik}p)b!1 zx8w&iBcZa@eLs9$Cq%eSEhD955wrDe1QFBs#NZ}h%C>=IVCER`LM9?$Hi-e@mmS0f ztLdm$7P0<_HzIf753ghmE%QzrJ_va$aPhFViMdxrUfxtEogb2qSz9zuS-K14ExZOf z=NbtqUgJroo39-RV@}O|C*=t^tfI5KeunZPKj1suk5=vH%fdMxM=K9kK_PH-Vh$-- zKoT1Dwogf|*5$+~6&LmaN8OOEN7zT0Su5o$`+=~KKX|E2un)DOzgZ%RN|2s|>oeYxhAlcL+$*B)p;s55So2Aw2(zzy zBGbX46-6|}=P)a-FMhCdV>%hfjsRCX=~*lou@4p{p91a11W+X?x{2`kMAH#%%dM+d z0^JGY6@UU_hT_?Fm)6M1GYjM^y<<@<+CJoWrT8x%F5vh|jpTRg$+|C>7ZhgNJU(Cs z*G<1`3glcQckMN)kRUALiub{bN$VlfA)+60YbOUAa`A?8D?$6NrOP}{RX4r>8PU&J zo_1lsQVg)1kKeri;_||t7i*xF746j0S~4o+;2mk4$SZdMPi7FbxZrS`blVP7`LPS3 zo>i8Xa3M-6GZlZ@sFURTX*=<#IPOUwv%mfC)~L+!uSf$>u!XqEGU5^BH7$RGZ5v-m@>I$eBE- zC5xZdpGOjhveH-{Z5^1BBDKZm@%ffJW7705f5A%q@vkt%SE7!x9x2^jm4 zw=j&1(8>LpG;nh21Xql)EYe(M3;2cU;#wns3a@yn29lj#gu~R_y|TWw7Vq*wE5LcL zGEp(L1{q}KOb1-8nS04ja( zwC5Myl_NB9qG1hF)Rw~g7IlHmNz^rX`Z+@w;ZE4%sz*-R-PX`hCkyo4@DtDEB8tJs zY}v?ufIb#j?e|;?ViVqjz9OHkW3d`Dpgg-pWzd9F^P$A^-Dn?m#D-nc=P(S$zF?@9(W``eI;RM*#wUCNfZ^N*XT?A| za4ey!Yg~djiBbQ_C`~ARx|f(-;$@gL57Oy{pJftZI~XKiNl_5DobWp-oD%nvr_SdG zt2NBe+S?)?ybP(q2A8w>ax{7rb4OD%pipK8ywzbxLVZ=WmuG!0ZM&xA+#2@XEF)n? z`Qh|+E!6&wL9ojzw=-@tglC@&UJT`|UL5ng#OB>{hEnK32M_ECn))DVz;UqtyY+e4 zQpmg>*Nqr*D_#q?B(F>Lmn_|-f!7p%()gI>(5PEECIQ$#k7ilEIWar}k^R-NlfAwVN_|H7qA3r<&^ddf~Vjd5+ z2x{vMgA zQ4URq#bR z>oces-R^r|8MN!Pr~jzCF*QTuU<~K9RjBy>P;8erT8?g40j&;1H=2tn1?qwm*Bd8P zrLTq;(c*yXdf|tJuA;reUDw)ZwT%j7zXd|619mI2nuq!~QBlHbWGfv$*osM;5F2nO z82Y96e2Kv6NB%<6D2yKIGl7p%MIYDM90^s;CjIBPm$mX0YD>WLE7a{VElv-$qId3AyNJLy^ z$fj(q`^ku*z!VR9C6E(_M(}TBMa7eWPqfG#z(Ll}Q#*Eo2L&RDFwl}{btMlV-d}I? zH%~OZP(ChFiya}73_{3(76y-$-p~FX&>Pe)72EDooe2~`F8G)OWNx@T<+t&|h*S`y zSk6H%SS9EUmUv$OOkj>}L#V2xZm>@vhKEIrLuAu~EMmVqG?gXMtBOY>QYPmG8ThAU zW7>S9`UwJtX4Lp>vZAu@gtauVS*Ge!Jad#ipk>m)9j|#W?@b|MYpz&5%s#<5LQ#lt zR*Kq8bS}Lk_OKp!ld8|^F(zAez!UTgMYK#v&&WgE zgZCfJalisFUkwR);1Udf5&pI|H9QH61=T1`9UTd)pDhtiE%ZiMQq&YT**Nr_T8h(Iob6AHYoS8}Xp=rjaVht--W92S|}%L6WLTkb_rQPLSXKv(a0RSYOeJ$!ubh*(s%Z=X?qn1<&y?|8c^ z_hSJ~i@X6DhwvgFyq2&khJ(&rx!%Eru!bZ(6c(Hx`wGG*7h3L6$GB&R6L-@yNrO0s z-COoGN&4mM8RW)Nn*%VAb6>a3xxb5X7(B4Gq+5~PPAFF`q_Vm9vhohOqyuNc0sCq@>$M2;rT#-Udnp3q~eJYLu#JrabBqOJ?9#feLqgtPhE@?ts%4) z>d?Rzg0|c71>x<>gq#NM&AMS8ZusgO4YR53xqRLw`L_#eA9>HM8d_T^EpIpv1=_4f z!wJ^yA9(V!{1N*%$Zl4%SKS@qbGgn%?gv~(UDiD?iVy6V?#(1n*&A;1d|;G;snMo8ogcJ(`H~}OO7dX9IFZ}t zMmDb%74PQHY-0j5Ju7Z3j?Mj>--X} z+1O0xn!JV$_Y~Lkvic&UOCLb(CEi2)8s?kfupwJ5?QxBc`&IK(Ee^i@*n}qBV(48{ z(K(ix+mEte0~?k6Fjpzvlrmi06w`ZL+DUsuG(U8D+{5b^^BOQg4lo6TaD9KSMXL7P zr!M0jO7I8RH5;bkzbMHk<@fZu7bojqp1*&*0tVWdLCwR_9H3-uX%3J#H?uYtad0Qq zee?<9U}hoZfc9x1WdfygHn(>neY8fYfG(Q@9bBDF&4Hjol$;$*Rn1*= z0ib;K@h|9?u3xVwv_ z>QhUYpPuV~5%}m6^+e5I1U`Kl`gaOh9y#(z>i<&;pBTpSZy5IUHNStL=fA?SpY%Mg zi~JLRSpK;OS$@sL{@?S5^>Kdp&-DD+hkqc7^>N1c-{~*bKY8&Nex5!J@_T=={_@8A zFYxD2Ui?PSpMCfTf7t$ecxL-Icz$}@^mqQS{rB+9_9rj?;?L8I5dT2We-F>>{|3)b zewx42!~WmHGyA{6^OFO@KhX2v!!!H8!87}xefS5SIsSWi=J+>wetPEooj;Fheu^KE zHUueH(kBfIBn8M?n*m96;UD3y0{WWJ)9FdMsDR$g`5F7EoSr0@3jCAcP=S9Mub|V< zBy2yEJb^+5p8e^S9rz~}sKD!!f?)0XqDLV4xACUJ%n8r@&xJkK^0%sgQloz_$8QAxXH9%kMSrV~CuQ;Xa{TR9WCdti zo4Hs4b>Ue+o?Wa@^Mc2r_4DsB{&=u6F_E%^hTN|-k7p+Mr>l>5K*!JDUswLh{WJ7* z7oLff6ZGj<4i3(z^RF-msEM4MTu%op*CR_GV~?r0LDJ+g6(|n>nCfSKc91yvy^O~i zewFo;{-3`fT0k{EQ3T4t1}f_@=i~X$7J=d{pt?Y*{s?hBwiOh9%=>s|`k5X?)l;6I zcb;nd)zZiEezozjzJLGsvn28$d!Y57aWQKP3vi<>zZ@~W(lu~Nin(~r=fKtW5&e;B6Q2E%%{{t$2=jmfV{5qccfP?KH zPzmbKf57Fhe)@Ok$G-pB|Bp3*dJ@F_Ur73eut(fI_TJ<5U*qE`4d^--2p5lG(D4Ua z9&>E590gj9Vqjt7Ams+Ff^cxN=|6583fk?I4IUs2 zG<{r;0$l_xE*U#YnLonxXY{d($9s=C;Q>DZCv0zN3tGkkO+Q`C?KD6uQ(W)>d21jL zB=4U9^(g5;1%b3UXeo;ZAPf)zhyug_;s6PNBtQxv4Uh%M0ptM+07ZZj0K`Us8bBSO z0ni5M0E_`3oevr&z?T3MfQhrQ=}U8$$6@j-{4{_7rT|k1TL;j0BpmGQi~(iu#$01MEP8o&}@1+emPv@*8`SOZ=HYyoyZRRq8u-~e#2HwQQZ93PkB zo@#gs{Vd-RM1g}Dz|qzf2pXy8z{l-j0nPv*0BG$F06H3*ngd(_F0UK_t^ikiGjnI4 zse`jQzzy&U;12Krcmh1logHYOy5w=6S5{Jx@CV`LFTL~>|D!X1?&13T7Oo(^{;n-W z|J?JHg_&DG;IG|X-95Ba=bA5LKAuzij8#&pKMcvN}5O$?@vg z@oEnf^l#I2n{8S7a%NA=?gZYqaiWJJIUtKA`+j)6JNrj_|JbS%E4Aa>V>IM@*9g-% z1ZuZ}*90U@^0qnL8+5PiN7!)Fz`vJGixE4_RQF&RNFrY|=+#@DaA@bt5EJ1g^L-mL zcc@ImD$h7y%GO>girgIx);=8~DVyTbHfd!eyB2cswu&^FCDZnn>ZadG{c+Om$G`XE zXbn@`?n}ZubvJL_^@s!BO$RzRsw0_&>*1L(xiciZX8*XQ}?Qy$yFmn2vCp z_(6e&%59nYG?)!EdqjqKg9<>YdfIb1CbGn!kV7T0jCR_>27gNdjy5Gj!9$792D~BY zEHXn%T*dG^xcdbhK#^usas6m5H-{#JCikjlge>(IJg<}VinlGC(dctpvGiMce2=bg zP)&4Odj~xGH;SCeOC&vosRlltFHaZ=*gqP0`^}9)pV~)S2 zDzswWssMBcFX{~C6mxy8Z%~La_zcdq)|9tTgz6OvF?=>WdQa0zkmM4H&<5do$DJH> zJz|O6IAG1^hy$#(y4a)4!0AbdUNcUbWsjaGiN4OhU{oj*VJIygojt2=(uAZ9tUjMn zrhzId1s1@cBH4(h1jP4a7)rj@lf4}&_MAA!;>Kh(=VLl%)dR zR3h7p!b~6|tRiW3hM6$t^Z^*Mf-KiHbH}03ZPefkn zyI$6crZ@QNtn%C6Pfc1T`(jCkzE*c*7qR1CtiKg^2h(rl=C#x(ww_jW^VHW?Fkgd! zzL;D^;2ax6QrD-<+0;!Ijg`)Bm3hOOhbB25RdX}y!6b(NM~gYCz&m>rHJyx@U91UGJ`--N8HhY zQ&PfRUQ7QUtlSlJT#zEuM@|4eN*WI#rCRh>zF;RN|I3;caXh4uS9odiDA!9f5aD2{ z6S+Y+ql|iHt?z2m+^Fo{m8p*Je)wRlBR?3gf z$cN*-_b^4_W1rkHk`nNs~*-K{tw~y@U>tk7zDp^-b z<>*3{g61(2Hg2dHnYSZ!{ZSG{6XYeu+u{=HwbFMRZ`+Fg{`qJ_KHSXMi_=Xe)MM2IOoCA- zUXoHN>9aDu??FaxcAtQQr$>g9eV4Ah$r(CUpq&A7GZ^=gz7%PUl0*GKCy$+uit0pR z`rPEA)aHibwIT#cHp<(6#82RHiIC}9sKgPp&mq!X6y^JvDw{E5_zz5YA)|fC(?+jR zyQ^z#stygghnf*XZTG=c-C~S`1A@*Rbqy^�?~p8_6cKmIBibQ{Lxv?JE4(m@3SE zKwn!1oCrhtkaftIBI21kN-4NG5`Ptk;7^AL+=la`@5!*{yBT0HnpWtrR?)y|pAf>n zkLx}R*QtHU%a?+nriF^t@a+Em*H`U7Ncs1Y8l?@AwOZn8;>L;c)h;qbn~Ef?jATg#cVT|L$${rIY|lL!pr zOL3&RdyKx)jGB&4fQ*udvAJ-|wzC_r331%#tC4}Jb|@SQ-X(Ll={}eD3tl?9wW^uD zG1lrYfT*kslW+E2!g)NF-$8^L<9$(n)<*wOp?ACk4pfK-u!aewysmv|C?#qb&9!?! z?SR_IjLIy6d$!&ukX(QCBVO2;D~ZX9QH&2_corxNF4DZ~tA2jZV!`5FaE>D)=U} z3CtXzTbu645H7`4VN%%5P13_NW{stX)_Q|C#+4)km)DoP1_0X5-Zm(+HDoMpMnEGbq06En3TwcE1QuorF!L1Esq)!N3+(R2xu~X zKYN7D-06B=(PYz$GMXIHmbAS{PA4cA&S=oSKx1?bA&xWcz>s{7vh7`Z>4{ z=$_Z+9dAP?v=|LBj`D6t->>VMM<36}u$YMEbkLR|&_-g+FEI33H-yreitAg~ex@VW z^`j~goZ@^KuQV+mt-3Y~ny@O#&~3`rATA-7jKraZ^a+{qkP2YCp|5f#Sb464BCJ!9 zhnws{4m3}18w?(f-je7Km4|QEHY^8>vFCL`r7$`6q>3?sYjus;>;eEsOx%5LcMHgZ zJ9U;ckjqf&I!V#fHrAi}E2Zord01Ki9m1}%9;#mW>g2NK(s2=d+Es5RuyB!(T4HX< ztE5{n9MEa)B?OcW#yJaKD5_~{&uYk}3}Ly*`qosta=OQ~lh(o+;YZ&=#5J-Z7}0W0 zeAYKuk-_w9?fi7;mWGlj9Bmk&$rt>p=_=D!A=cn6=jQW?%GU2ZaMM$U4*30vH6z8Q znWDClr)_rcs~7L^8^p78%K+j-AQ@@fZ-3z|0ogV4Hvumh7fs zKgy__dBSdA3+uhQt9=`{RrnHT^K7SCh2L6IqMd^gd0+z)trt}$ZR|2~=zhR?@$1%x zi0Sc&($U8li0_*LHQIo=3eBk8oqMI0xAVHT&LM}_ok798%Z1-1r%?& z-okqYsGPAjaU(XZ zr?#Dqc?!3N-eh{Z@fQySKr){KX{ z`>xk@>8bJ5?gAdrZv)IWP}2O!Up$w45n$t;6k2e_sQYEk=&RUhOzg5&Fy)EYWhjLk zVoYXSPv7uu-vZPtDN_tcW`e2pd=t^<-s%LXz)ouxJwpAnckj1fQpY@yl?YNmo1YN~ z9#`%kh=Dc2j01bgG@BeM`4AevH*NkHFWT?^taq*8tyPb7QPLKK`hr@ooUtyGUSg8O z!wgr?3XYNwAH6KLm?U-J#cRvz_pP9pAfl-vYI?N-BhxR;UM8{8O7DFk@M@@ND=$<2 zJa2oze~O9iTqo{|^Ma074)LU^aw)5XHGgayIO0Db5lmqoLT=Hw=3u;C_vv{Lb{$8H zng~;XQuv9xz6^>9WBvU2@;rMz;e;L&!9-ue5q5Wd*wHI*XL*+Exq}U>`z`P}XxZxy z#+tg!7gEj56OJ&u`HD6#2RgMxOn*#r?N9VIt*SJw8u;pClkZRzAi+#$#3=BqEq!gE zl&M(52#w0iGdru1t#~HW=;w;ZP=tU|#;%*Sd!O;JT+bbHX*D3LKM^ay=znb(XY+y3Hbl zE_X(wYWQn*?yA}gi_0onkG=VRjEFOxN68W?I!M36tT<{5W+Vr?pl!3JpZVe6 z;h7x&kmzQ(13Z zGQ8UqQlF2H(GLnQ$mvDpS1j2dwfi354eR?xz7cb>N#ek4>m!73j_g3g4XkAkfEsl_ zT+d#+7vu9`u-#7Fc$j6JSIVoRxeE?}U>jv}!@8XFnVkFqb`uR|aT4a9jVtJgjNbtI zo?+S~M7^<}hKx}F@fM~94vW#MfNAEpa^8+T#O`T<7&cn%N~x%!rC40*0Z~QZtGAnO zjUV`RP~N_lwv_1IA@0`Kd%+pj7FhDB+fDX$C7Ug@n|_0rlbUO#Je73m~-_!6{iEp9+Y6Jk^S3_CEUzL% zGzG1=XI^cXPgihLzBCOcaUkR$ZeL13BXZ;#dg&nq^fT2~*R2z4yy9g{ZJQ_cxp!6H z97-%_Rm`1zg(B@sqLjVo@ruv)xCxnnz&KtO23124bY~%FoEWDa?zG6vdQJ103 z%D=wn8}thAY^)blgSNPC)&b4ugv`3h^a|o7>wFgVkjwCxhAGrgL6-p3u3dveN$h0o zO!=as

yXllCLzoH|ZcJ`VMSB;xE3Lqho`18Kf|{zZo*ohp1^hJH{h*_#$b%~(wL zII3nhT)Z3s`k{RHSnMQJ@lT-&<&StK$o1j{#XHvGj*g1D4#8%+d5@%E62L2(s>6H8 zRUXH4)avb|tmu#{cb&}A5!HC13g#m88h0%mR9$=lhzY$mGz3k=BZxWCgr%A|5nJiq z(w!yhK#rTNcZLa(7%g=?p9D?NnQU;9-Y2E%h9_!#&HT<-^lIlk(YW(l$=j}b;ng7i z5=!^3`-V1JH?~cW4UviL0EFT2y7g)r*+5s6jk9+rG|GE&eiSm5^yAepyaydQ@QX1K zVWy2Wi}jUY!59k!;m^1_i}aOXs(XT%8q)9@CPOl7fg0SdbHZ^w<}p}zm924EN@XsK zT5`3kYQFly5$#$IQ+eJ=i3P*s{eZPpvCka)Rc{mtMqij-;hJ@`BsoFvFfUsDs0~!< z5r>9!sXKtVb8c%@3#!kNN-Rp`)-1Ji;TY!JLJta+m{jbjpN>mn9bdak5H;GmM@s1l z@@?N(bpSvSZ*vysSDCKwZryUYWfQm%SwyZaF&jSQTk*jz�G04dy#o*S|aI%?%9A zw=X{|Q2Zz<@3RcS&ybr>jrh4BhGbet;zd8%I$y)mxOE`ub8K@hq&CD$B7wp;yhyGx z1um5oWiQy>Dk(hWmWY5-8AMAO^?Jw30pd}EFy|R(M)bXgkxUDT&hOs9r}HbFvLjiH0>>y?i9Vj1e_4cZJ>!Qf6O<)tof8wwI6IvWG;L*Q zn4VK(?gr4uq}1Nv?TiksC~V{R%%sQPocM}m!VY=$W2b82+q}r!82)$p3)e$Q!SR0QxYQ$*zgw z#H#oX`*-0189E14y(`D%ny_V(=dwsB`b})lI{c4a>ZjXHtTtBPx4-MSX0kiWvv1;e zC4G>Xy@WLoCM~-!JAioE(Y6(2P=e0O$z&DcW4ZiRfW0eJOlz0yE<}kmNc?i-rQ|rj z?~iE@m(*+P`>@_DD%)cNtaA#<>wefh7YEaY1r|j-LXz!`>j-FkwdN`zVHi_S%?_QjXxM_eriqGeIhN{C0yUJ_ z+LJ}eox*Dv>J(vXsoGHXb};lsWVvi5RtlBcME#&$t(v^OcZL>md?rTx8}&< z3mF!wlq{^-!^Oc@Nz=h+>-#!Qjm)2uOc94ZMHR+)6n$T*uO5AYXJR&7A1oDR(I~{C zWJJsLmSrnqSjk<&#DVfCX|Fm^7Jz>BBf|luwYb zw3L~lFtbZnTV=Avt?wgjs2x$tU&lA`;v1j+Y(05#RZUHstTwPv3tcNqn^1d)aPg#D zK~kCe=mIFv`b}%Zt0r4E7T*_!T`@cj8Up{>y@+@Q@oB;s2V_^XfKyeU=v@n}fr zZxqQolGXJ+#|_EU*WJ^+T!BY;k>p-RE%zfJcu(lqFGfsA!`qTAP+VXUsVQOs4o`b1oV&Ue8iDdnzOmE& zjBIM1V#rTCYBX5!{9@Z6zig~H3ZXo8*Jy)ZR#n*ICy4r=6Hng*eI`je(ZmG@{h=gdcDM$F$?_qV+?yPL5 z!|n$2G&WZ*DjGd3tVDc-gVioDHvVw-m9pTT3WtP7Ny>;43%m+(EWeYjsTxzn;7FR8 zeczQ3qH4fIo3Sel-DuC-?h4}W+#yW$acADyNdbZyUV}DZ&83OrKDY#5Dk<1@*Jrd< zgkVL-T^D*R)J6k0GR3Kfh!F^~xXd%W+-S=ndKcImq1`|dSc4wFTe7#BoUga8v-cwb zi+xwnP}fw{8oBToFuAdBrA6e-68QFZ8%mFikmPRQECj#Y0@CKl;x+oP-qPY>bZT4) zLQvd&Uo^tY>oO6*5xoiFPrg;*xLu1N@HrL>=ErN@VqVy`O}n`|Dy#t5-ycfqO}sXSfeY@OwkcIQ+&5pf8Vg)CU-ot-b6@GaUJzBl~6Jyi=U`&6qHZg!4F&J1t zF2dX(7c9_@+W*Gh1lnf%cYD)g^e=l8Gbr{y*qgZjhP~G|JBrF z^H0Vmdux!b=|8tP{bh4{G8#Wwr~Wb@|1?CI+gbm#fdS3kK<2F{!<4Nt(CRPql$EnN z$V~M&j8sqlioY4DeseVX&y7@^%>QVl^6=18om)JNCG&C!(}608nD1TGS<)G>nX&16 zp@4;jXQrZ*M=AO7CHEfhzz;i@G+dvA%0Xcv0e>(1J-d%?|HWu!_CkJ7OK-dYx1^hF>|w+r z!2torH=G?3lGm>r1!=98Z@=NReVw_UT{4bBIwI7oWiwgG+oIEGZ?QS|I-RSe42SA9 zSZD7}brbJ0om?mHtU1JHEGj* ztqai)%k~FZ+F3T=kywJf#XOYIJ)xI5J?=NZsiw%s%L%LAml&i;$R#S??oqx?RZ!TG zpKBw$`JRo}V#zlCnfWy9*5&fWB@FQhU(RS`rfcpk3upY&;Qh${?n3@T$+p%`R_ZdNd@keTXQ$L+v^Q(?d^CM1uYjR2*#svlL+oV#0UI zqy;sbci_!UYWOe2pkuQdq3EB$@nti{1R3y?y|I)NpZV3d~!I zjIv66=K7im(`Up7Ih1`_WpQI6WVCp287ORYG5I_ljywLE7mVlyogGfMFDFeNVuLuP zdMFvh#0JhF$1kjFD7cPdDBKe_cZE3i&pLd$h#Q0rM-?b! z>+jsx^6(GNl}*N%5yE@JJ5~oFn4)SHlSM*zS-8(s`Nh z36HP?waSE)ut)tadKMw>b)R`w^EZ}SsDGpeR0Ag6Wq!bV>Sa=W_Zmq$rMBQ zh5O-EY*LfRjHp9w#jaP{TTiWyb|a}l6V35Zeu}~_2O`ahFOAcu4DQJ7vc8*s_P5mG zGcg8WY~>ha-xQc1BcOo5PQZ(={$A|6PS2O zs{wWs4vrHi z?Y;KiYd>7G*K^^K6T!VVZAI7D1xlfMkX-s3=>_t7E z;In+j`Vp-Lzpa=Gq&Ix7GPSNgd{(D48>Z^{$)Th^g+I3O zL6bc9aQqfdIGB4go_VQ0p(dF#V$D)(I?yk9(bQIPj zHofHL5qqkT$}UszNp&On`s$WX4Q+UP1E@ZTL$CmA*$yYvhh}8raKE^`UHGgecbg;k zv8ZSH#6`u3K{xycOwQ09KArweF5@Vm1>ab+%mq|-usmiEesDb88SYK7xN4){~Joyn!v^e2TTW@gZ=ljB~x`id|I`O=e4)z7WMZ<|rVExnFW3(iM-8`m46HMFIK9d~lMNUGcVT&8Az})#A{{1=i*M%2(QNrW1-2N{ifszl4J!;Ey zze)?2Jxm_{zI#}We}%_hvz3@oo916Y61Q4F@TJ&E%AQ!1;P`9x*Xx(+p`Ge;nNDG6 zYqbqL#gIl&g(;q)^iDUa5^?GM?f$nRm|K~y!|Pv=(_9SvO!pwQ_a6F|*-rTwua7v6 z6|B*pLW03f-Ua$J1 zZ^{5jW~ZTl&S-N*sK@-Wl6X-A@I(p|v(Uy8WND|BPm3`wO$bZCST{e9h=si@OC;;E z(NJ*YCHtXeD@%#r@KzHyyOf z@lKFy0@qznA>hJV{#1==j;N_namND6tE)gR#7rPJ@I|Z{^J$3OD;Aa3D2JBtHyY}y zI*4*#^A_!nK@*-tY(>5vRx_suF68^WWDtfrX6oA#MLl!Tq)`;P;Kt=uWb019mb9fu zJ6eQCa>pk_%e_M~rAi(d$J`=z((|9au-DNM58}? zY9`MK23(1H{Rp*)Qa=ugkWo+T01YLtDj%x7RX$&~hO5beO$`m||$1 zwMonQrK;Ma`Gc9*D-I)(uC$FVxYVl&IYLr4%bM1_lGbOMbAymRd`FrSdb`V@O{;EG z6g;Y-jg4W7k1ACQocvaPERJg|!ts@JnsJKebyd~lS>lf|7gjGTHJlNxno3*iZ#C3i z^Gxu<(+&p)_=%o9O702qRzS{u`IJ>08A7LxLbZJzQznU=lbzQ)I}^k4(o$zFxpvS& zvWX2MOfg=~oE_FhJLuw5LZU>K$GAKwVPra-2SF*ZM`?)T?n>N;vi(e z7pQ_1KGbjEt|E%2yYP8e22D|54?V#7LrLv2`wo917E5}W&)jIJ%J-*G)=Sr}WF>f4%KG@=ZF+hw zxyy09jC`q<3bQl+DV=Y2q)aV4vszI+$CmuM82__!Hg=x$RPE_|)ZOXr(q}Q;Qb3h6 z(fB5S5sxX;Vn*qlPHwE&1dl_5#UXO#EGe`62v*8j${AmyMpP%9 zvpu+l#D%~gXY|y!-e#vIHV_8cFx9L=3=;yp;X-TG1qs_GjFbybyhmLt1npYf;bQK_nNsG4#yD9JKoZ;Qy! zdtUD(4%z@v8#DaqqbAQCs^T6*n&adjvJD0k5*Sg%q4w+V&o!_O+ zWL;INwGX-I>EPfk3?ntXps0s1bmNT=`3pr(SM47APZ(B4vk<0P=q8svstf+0vsuF5 ze(^qY+(cEOkdvO)l3z!e?s&5(F`%Wrrb2&QW7o#1RYLi8S3Zb{$^L0+U?)ItYNalDGIb?7^FI;3z$8cmdGT)2 z5QaCeC&bqk$r!zC=BF|Da@@{+U``(($_jq>tfvKCu#r!aPu?QBC)}SNUY~`lur5j$h(wb6d>M|>D=zn$q$wQc8AA_-3RBpEU z19+4gr!1$~BFt1U_j1%U3-N)k@)y-B*l)#vl9aUwBTerxYsM~N%I=t6s*>R@6Zg=8 zZNsQ`bz()SPbW17f{h5T_+B8cD6ROpeAx>5AvSDT1Rg_8YsM<~irn#j+81iz!u)<~ zchNQKqb7NPbetO*7rIZ>fT&8+hoE4p4?mn$v!ol}V{U5oOeYl^50z168P1mog$x`e z?ptx4bkr?#R*4TZ2UGJ-C;QX9(q5@-mg{D+6`47US_a1kgv8Kk6w;3+BcCP!+IS_v3K1WU*I_EBaLgU zmCdI;OigE(9UG2~!x>w^!wo&%e_p?~er1ec5k@jHmXMuyjix-4gM5DCWG~7uusr;Y z;&@2gkj~n)#)@k@v_YHHMP<%p`NTI3n-81SQ)xe z&=L=dDs4vRbLQuXVOXbn$gwA^PF9c)A&q!hnF|U6-J4$=3u{7#=|R@I-nN#^J+{F{ z-(FsVa(hekKXui{IwXnd>U4~aPBJ}49;snTh^j{^>It*)z3qOQdn{}x0Hxh?EVDyz zUE2={!HdCv_k_e|mPRqXfCxrq;J(O?$2ulmRd1KXI> zT;tl5b|mo*da#)KbSd<=)}%5dEC;fg2+~gTq`McU*3dbbPGs$)$aSU~h^&hw6;_8h zu7#sU)Ey_+-q$Og%VZ5vMyl+_al)$ubj)mdlb)q6In4+&6VrJN8 z8y#qkt~anQr8!n9vNu0r{E^O+P?ULuIIC3#RLVnSmFvErX4P*H4R5kGlnC zzKAVuvhG3aUu0!wWF#A8%`EHbFHI)vX2nLnO0ZnfRYJpg&$l8RfN9x2{K-4=Q=h^R zgW!(k1EvQA$`2BWWZ7z^r6t{KAFZBoK23bj*vGI#i6(0DBT?A>tkutbOGaFyw1teOo`?kIG8VS`d_PD>oV$Ng z>CzeAExtw>aI7;nv)T8a%P_S5Np!88v4F)|LBW>N9{BNhYKHh*Y%~yhqu$hUEK_5< zyig2|XTgfcVUrrh=+O|-DT{)3G&hTG8@3ncGhMY5bw<`6MOLtM^0V=DAE%P`{Fk!x zD@J}40>y%X7*uE9yw=ua6MO<=QAg(SQ284UqPL*KQoXKeUE(Tng~Zi+zG}!kuDw-> zv|s*_1(VVmd`HdkY3nXP;p|EjOb=KO!2)Mj|@GV zScSj(W6!dsufc#bKI!8_9xlQbKHv%JO5Nl2M+1gj`v4VP7~Jh&w^Vk2*-ebypVG$) zrrg>duyj4g%p5hJRYUD9h~5$qW)>dMJll>?3$wrBcovD#_m=s`O_!MS_R049ZwacN zBMv3CDMAdE88esyf?mPOo= zr$B zi~YFb98>CY-!bbmFT0@sf^CkAjqm*A!ky?_L!jXa&g7BB8=AS-C$CINP-D|TZyR4a zy?Ko_E?!stJXbb#RJrKftJI-5`!jlt+=>S|v3f<=(F`L(z)P4%1%8hT%s9?B7wto; z*{jJ|j2=1uz0GbJOeH>FpUt+l+JKPI7g&!KLjaV8gLB9EC+c>afsbFfwjT&SKf1g$ zi7RR}71I#=_AdJgH%6{yl zE)sGdzo87!a<*G@^MKFuGjna0J%A$ckhD52&|s&=PX*H70C}qyWMVwHA@=UGTl~_i zzyKH2QH1f7h=a850UKy$(`THmsNxR+)C9Znnz;UKPbKW}{e*lO<08`6NJ*Yzeopl% z%}}i&74ZvSiG+g>j4Ex3wD>5>fx+Ujhhz^qDZ zs-(uO$6Q%B5d`u`+7s6JQ zOAy*?W%0Z(l7g5ybM}P?3%!f{trUU7vzCiFwI=lw%Vo7y^!DHngSp&>wrz`x0hjqh z7~8jKL2g|Y73E9TP9jLVh{R^n7OjReAHV|sRKd}iU(~l(Oc2foo52SgP5uWiIKZVQ zKSv8oPd{->OY!hth6;i~R!p|MR3~aDL7(ldn}_Jzh-8SNsfHUWnk7P^#`R%YsToPn z4YF2djkKp0GmR3IM-4(sd2|&h6t-6>c@7J2c<*ET4IWGCH(n~$LC>*+zIn`zAt<4_ zXq}&V8B63Sl;PNEZ+#ZJw2gLL)oAZ-!e~Jx?w>0A8b(qkHiymQj?yQs*s$Lmoo5XZ4Oru zMHQ+g)yNnm1DRrgO78%DrKtXOwO;U9Dgqi7rK_Q%(M-@|HMONvG zZ)XPAyEf!vPPM@+b)~m_XH^PMW<}{4tw@3;;{$s_DxgbHn6Xe%4syyU{?msPMIVX> zK2-epz*91K!DD0dDi~)T2e%!maO@S*<`L-_BYH@nuwb@7P;I!jot&plCB?fIsqzU$6=NR)Ftf^ zSQAg4g?jWA5rBhkPH5L_idv@FiV;3Fyy}C{T!lb0+!TU`Dyh{Uqer>k)Wx}Fxj*(h zsB(FI5TH&?5p6KH(R~@*>h5Aa?V=rEXziCqr&lq1070ry!aENholDh$Wj2joG!Z93 z;v0Et_JcyVg{xnZ2|q-@-IeM)JWCLpMj2xC0DOBAr2IZ3Hf9Z*w0!@#$-9zd5}{3^ zyL)K8%qBjMGmhVvGQmuhiN)+@f9C#eu(av&W8ROYF8NgnBOO^W-Q*xks6%xMMacWt z!m{A8Qh&O|>K9?xwXLhMea)F_wxRfAFJRPB!}c3~n5V&|&3&OCge}3$rw=Mycztu# z0z}57ztS%ww6+J#ULpu=+14*eJvxI3WjC-3m7?o*;ZHI}5ajQX14- z72!LIU-M#GRSwy%b$+}aIzFB1Q}wFWej>j{c>GA^RoPH;+QI=|{lv-FlW&}o7L^Ia zYhRbxIxA&ZhTdDGO60iKM6D8om#en&PXNCv_LEr$3t`$w(#~BF60X`0+U6 zZ)e)4pkQ3+7G(r0B{5GHM1ZLT8kgL6Vo$F=Wn!%%Hn39R3O?l8(vB>iR%pq0uv(7L z%^owE@N(#Nb|554dL6Ja()o0LF9v?99jd8#f*Wxz^0?}Gh&&@I6`r!-R%Ht*7<+VzBmvK$S&+2aQF$@x zXg%~}4W?BP8Fm%G@0CEtqJ1Xx=p+Qbl`BXbaR744DY~&E`Mfe|AGp7z_EcoKLG;& zpc?sGuJvy;F#r2pD>oR*^LId?wza!@Uz4Di3=E$W(Kv+2)k6X434xwiu!a~qG87FN zm(-;yIg4!}xqKC3m*!xuU$bT8f*jjPIz@vbhVhat*$V?-Zc%=W(z?M?;`8j#^>x~; zuKnzbf{d!8*7gKZY-%Y^(%6aWjC_qx<&f~GuHmimUIky;u)xQpKfD-xQ6J&?L=wNX z>10BRH49bk{=pH?&y5=hAx7)%$lr}x$L{Uw2R@jBIxoWlc80anw|53GK~rE%I-@Lp z=Rk>Mwv92K`$OtI86WxXtA7&9WEmbIEZQNGvW!lq-*_6=nE(F8Q{m&=gV|fEFSqvjX=wr0s}e2*Y7pdg)Fipu#c|H*>2B>sDO3GV8U=L+xf zoe9;SmcD1$ctD%>T*`r=m{9*I89YJCTpc?v#RgB1vPLz+lcSL8h^O>Bga=VfX0)HY zLTM!=NIL<=8_x;4qqvbkW@JCQ^CS2&D6JB|o~)zI+GsuW<6i2^=u2{Gqqn4|RE2G1 zC7En_jXC-szg5jHNKX(Vs^=>Yh_xTy=K3Ho7I<@6ZQdInHp)pJ3Q*WD?n5U#mlisf zdN)zlBox!uF=Sm3rVKm*v}vW3@3NZICJ^q;M*1MKc zhUAb~oR(uaWYdO~bqrc}^cCbmEVN0cPccuU!F?_Y7<`?+6QvZsqu zmsfPQ{(W#Y{z%=Y2?~d%r#Cqdps8q!dy$UV->57=>sK$Um$7>o7$~rZ;#p-=6mjsWuX4&S@=eR@2Y7gUm%^hMlV4 z#t3T_)kcTbtWvLz<{NNgD0o@bU_#>~?zb^@ntSf!Ui_rurZnAgm|uL%J@$+YB#Jkz zF9&({abEh_lI#i?kajn6>b>%PvrCy`1ubU@V zprUIZUgKN~eWp9ZAUpoP8A;xvavD{yTL8-#r^b=2US4H@wSvPdr-v*94jR^4kaKW- zJsTa;jV|gdmxw5xAdE|LjYmm!D6rDfhbPcs>1p5UTE%>?A8M@Vr~lZ|$<#>JNa$H= zB4vS$R`HpVNK#L=M$ub#__zNTu=Js0R13o*tzs0B>S$lAi|QQF+#BNS5xlRCYHv8m zy(mO+8PEqpgY4&Fb#xbg_pL(x7y;C^t zrgC3Goiz`lZ;qy`8xDLfJCR+0oZc=7QfJ>^m3bMvCkYX$xG0e#mT-FyI}OK+nBmK& z%cf^}*wslSzg~^P+hA`+WbEKVK6UoG5xuy`b#6mp4^{VZZ0A89N1V0FB=glIz@WZT#F-Nb=M7@nirA_Nhd59xd&FVl ztWFn=W;}UPPx5R%K8=wCg=MVX12Y`y)I&K~(DOMMrpQ&PEh^7w# z2_ousx#>Hqtxy8_Bq3*Xz4zkR^Nj1W`{s%vZtQJ%5N6&nK;~H=$t_7fl$vp|>{GDT zTD9N99QpCCuWeCo z#OGP??$bnq%l=qsWq~4fSb&9J;M)?F(qtC783?9m(P9O<9zJzc1W=!Lc!z9_e)I86 zTt0P(IJ!cI$&^0P&c#04)LRi;2fWF*`@LUJx*84$yRP?$cw@7&va%~CJ|Y-9vt6M0 ztzZ9e;o4?<$4_aA#>g>fQf*UzaJe(hU_!G|pvy$i+Gb`v*{6-?*|AHlGRafnt0EFX zvU{lY?wlKiYK188-8#hSRh<$xsH2OQ+jWKj)WV_sf_W_CIlC>NzwZfNB)f{BHQqbw zHv-_-Ie~$}qGxR;U8drM4ZGz|ScwSPnsD$5c?B9pp!Z(SE3LE)b#Hlhw9zNdokgd0 zWlQmuM%54u9DR0Pw1QS(fJ@ZCNX*ps^R#`L=b?6uk(o91%ZnM^y!czcV7efn5Ot1>$j2A3C1Mhxh1c-% zRB&onB+GI8K42#)P~QYDRCtsjGA9i^`dU|0pHMBP9Jxdj)`ZkoYk-Vwp)XocqM}Nx z>Rl)L43PI}FPMP-Rr@8HZ|S|{mShf|PRU2X+;1zOSe(eMz>x+?` zXz^I|2*U9Fqqfsw1knIg#A*1j^^4?O_mp+%Y<*59mB_62#~FsQf${=uma_Ze1_l)l zHW+A`*Iph{FUgpY6eZn^1<9_rcB1M#6T}4ZiWlh4=f6Fkxm@>EsOfPBS-6_d*S%lsX%yVMs;qt~#tkZmCX8O2EMWV>E zaBwv-nI`Zg?{=n>_Y$jhi-aMYpF67=VOT!U@8k3Wg$k(%oea?@8*=POW*0_BExJF?+Z$k-j>XJ<*TJ3yROH(C4RaYy^U2p@+S{MY`$zw7=9~~L;`k1w+XVC5T zzZ5}&-Uv$8&=~^c*cWLsWk*dn{R;|VS9!!v3&xr}qkgY9p)Y*c4@RGy22F_h!g!(` z5g8)exT_e-1Rhu?^PRNn>f1|NpOxYa)X)OZSgK%oFNmY&`1_xwd)^@Qt^7E>3BL*h zXQ4E+d=ALVEU$Ea?amuK!p!tmYn}yx>}GS5G55n4{qMc7eJ1|zUffTq9v^j>y3N0+ zca0f4*SGSb5^{1=`0VH0cXHkEa{2`8-fKJD+Ra(|@7la^IsGdX_Jq1#Y5mYoGq{xsM%_SKLacs|!^}7I9zdhM9acs=n)_mQ|-?$|@}nv9mO*ceIT; zE)(sPzog@j6-TeJdxhusos5zso>`;U zb4PoJu1p^8P^4j^&c?*#QGf07l&GL6o=#JhnXp%am9Fx)4qY(gSwE9_E_JhxiwE!CL9MyX*RCh zplsRi4Cz8Isk^Y=3dT6iZD2bcs)~2DB|GOA*pr`6<|l)x(0*fFq{rW&#+n%aCsJWU45@ol_onUc0@NW=Ad(qU*BL(*a}NG?D4`7j1i-52*d?40{dgBEIWiw+y|^eoxL ziBc(L(@PkQ*LlG#2dDK-KRijsw%_^%FKumQRO{JQpza9R<1&iR?)ILJ*tt z(qmi~20hrG_u<07LhItRwqRRn)Er2!23EG2O*4gF;jK<_DgJ&|1&1U23~KlnN$dac zE$JvK{EKXfi;D;H@3R#FVQ=_J4xEY#U}kA;>mD!PbU+StnY zx>~CHDruPe+MDxPFbWG{3J9CRS=lXt-li@MSG{<4fA$% zafEZl0=yj^oZMjEf{cHdz~J|HVh%>YA1dzlf{Z$fDgbw9X9s&*cL0c;kDUw11!eDG zj|I5v*woC~!(EV;_ODi4{?_|X&A>l^w*!U`4}J%ObKYBcm|MCEGD@o`0Hkf4-Q53V z2nBF)vU7sixfnVA8rXm74?day>^6J_{_`NWc&9gg~4iZXhQJ$jPe# z0>ilZU|f890vx|6!50c{CH}{e-+!_Co6_H`oLx2GD<@>_>TG2N@Px;~-Gp(mgTU;Z ze|GkV*1QZ=i*xm8pk=JEM@M(;wOvf6kqQtq zLYRR6qwD{!q5pXX!9iMrj9zz7nBRa~e`7cQ*REpv51Wb^e)N48(eO~bi)kha*xg>> z1ab0$z}$TBZNSON2>*er!MDqQ(fBKTnf@ujng7jA?d@u51!q{~;ljL&tUoUR6as;B zIa>k#l!16acRY}H7r^N+8H5we2WM3LNe1HKyraGSSq9;P!t)V7$v8Q=c;R#MvkV0O zO%KEezN13_Nss&Pc>Na{h!=WSF#ab!FcixDn=d?ke82V!;^XColLP-`3m-2O4zv1M z1_5*ZItQE}Fz;_;gK*vPm;Y?b1HLP{@vH2P()?H1@BTr!d4Bbo6F#TE&OIlT>o;FO zJn&q~uYEwET))l>ClnrEzvywo*Yejng}3(){_*@a4!AAPueO}LkUKuoU&agh2mkmu z|G}2;H=p@<_~3-Nzqa?ge^Acf)`OFe_l}$XCtEHq@Er^NPcje>^mqTDT)*`Jx4omt z|H&3kzX@kH{aFTY?>Acz6nsa5|BEf(Z?VP&;kzRd{z(tS!}AaRar6E<4!G?dYx+;N zT)fiVallz$|G__=-}gCu?tk0UVDMcXo1glH zxAzbJ@!gTI{;UTl!2NA(@O}APA3S`&`3L3%|1RU$DBo}K%nP|I=kSvr zh!1qfivNp@=eKxFGI34cBV;FXG;;T4DONJ{}6vQAdc z0QkV+WehlEB>?&YJiNRRQLq?%D#amEJQ8BOqGA#t2~j=?3HT#ZN routing table. + + Routes for directly-connected networks will be learned to

+ routing table and if Logical Routers have more than one Transit + Switch, which interconnects them, directly-connected routes will + be added via each transit switch port and configured as ECMP + routes. + + Static routes within route tables will be advertised and learned + only if interconnecting transit switchā€™s LRPs will have same + value in options:route_table as NB route_table or ICSB route_taā€ā€ + ble value respectively. + + ip_prefix: string + IP prefix of this route (e.g. 192.168.100.0/24). + + nexthop: string + Nexthop IP address for this route. + + origin: string, either connected or static + Can be one of connected or static. Routes to directly-connected + subnets - LRPā€™s CIDRs are inserted to OVN IC SB DB with conā€ā€ + nected value in origin. Static routes are inserted to OVN IC SB + DB with static value. Next when route is learned to another AZ + NB DB by ovn-ic, route origin is synced to options:origin. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Connection TABLE + Configuration for a database connection to an Open vSwitch database + (OVSDB) client. + + This table primarily configures the Open vSwitch database server + (ovsdb-server). + + The Open vSwitch database server can initiate and maintain active conā€ + nections to remote clients. It can also listen for database connecā€ + tions. + + Summary: + Core Features: + target string (must be unique within table) + Client Failure Detection and Handling: + max_backoff optional integer, at least 1,000 + inactivity_probe optional integer + Status: + is_connected boolean + status : last_error optional string + status : state optional string, one of ACTIVE, BACKOFF, + CONNECTING, IDLE, or VOID + status : sec_since_connect optional string, containing an integer, + at least 0 + status : sec_since_disconnect + optional string, containing an integer, + at least 0 + status : locks_held optional string + status : locks_waiting optional string + status : locks_lost optional string + status : n_connections optional string, containing an integer, + at least 2 + status : bound_port optional string, containing an integer + Common Columns: + external_ids map of string-string pairs + other_config map of string-string pairs + + Details: + Core Features: + + target: string (must be unique within table) + Connection methods for clients. + + The following connection methods are currently supported: + + ssl:host[:port] + The specified SSL port on the given host, which can eiā€ + ther be a DNS name (if built with unbound library) or an + IP address. A valid SSL configuration must be provided + when this form is used, this configuration can be speciā€ + fied via command-line options or the SSL table. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + tcp:host[:port] + The specified TCP port on the given host, which can eiā€ + ther be a DNS name (if built with unbound library) or an + IP address (IPv4 or IPv6). If host is an IPv6 address, + wrap it in square brackets, e.g. tcp:[::1]:6640. + + If port is not specified, it defaults to 6640. + + pssl:[port][:host] + Listens for SSL connections on the specified TCP port. + Specify 0 for port to have the kernel automatically + choose an available port. If host, which can either be a + DNS name (if built with unbound library) or an IP adā€ + dress, is specified, then connections are restricted to + the resolved or specified local IP address (either IPv4 + or IPv6 address). If host is an IPv6 address, wrap in + square brackets, e.g. pssl:6640:[::1]. If host is not + specified then it listens only on IPv4 (but not IPv6) adā€ + dresses. A valid SSL configuration must be provided when + this form is used, this can be specified either via comā€ + mand-line options or the SSL table. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + ptcp:[port][:host] + Listens for connections on the specified TCP port. Specā€ + ify 0 for port to have the kernel automatically choose an + available port. If host, which can either be a DNS name + (if built with unbound library) or an IP address, is + specified, then connections are restricted to the reā€ + solved or specified local IP address (either IPv4 or IPv6 + address). If host is an IPv6 address, wrap it in square + brackets, e.g. ptcp:6640:[::1]. If host is not specified + then it listens only on IPv4 addresses. + + If port is not specified, it defaults to 6640. + + When multiple clients are configured, the target values must be + unique. Duplicate target values yield unspecified results. + + Client Failure Detection and Handling: + + max_backoff: optional integer, at least 1,000 + Maximum number of milliseconds to wait between connection atā€ + tempts. Default is implementation-specific. + + inactivity_probe: optional integer + Maximum number of milliseconds of idle time on connection to the + client before sending an inactivity probe message. If Open + vSwitch does not communicate with the client for the specified + number of seconds, it will send a probe. If a response is not + received for the same additional amount of time, Open vSwitch + assumes the connection has been broken and attempts to reconā€ + nect. Default is implementation-specific. A value of 0 disables + inactivity probes. + + Status: + + Key-value pair of is_connected is always updated. Other key-value pairs + in the status columns may be updated depends on the target type. + + When target specifies a connection method that listens for inbound conā€ + nections (e.g. ptcp: or punix:), both n_connections and is_connected + may also be updated while the remaining key-value pairs are omitted. + + On the other hand, when target specifies an outbound connection, all + key-value pairs may be updated, except the above-mentioned two key- + value pairs associated with inbound connection targets. They are omitā€ + ted. + + is_connected: boolean + true if currently connected to this client, false otherwise. + + status : last_error: optional string + A human-readable description of the last error on the connection + to the manager; i.e. strerror(errno). This key will exist only + if an error has occurred. + + status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, + IDLE, or VOID + The state of the connection to the manager: + + VOID Connection is disabled. + + BACKOFF + Attempting to reconnect at an increasing period. + + CONNECTING + Attempting to connect. + + ACTIVE Connected, remote host responsive. + + IDLE Connection is idle. Waiting for response to keep-alive. + + These values may change in the future. They are provided only + for human consumption. + + status : sec_since_connect: optional string, containing an integer, at + least 0 + The amount of time since this client last successfully connected + to the database (in seconds). Value is empty if client has never + successfully been connected. + + status : sec_since_disconnect: optional string, containing an integer, + at least 0 + The amount of time since this client last disconnected from the + database (in seconds). Value is empty if client has never disā€ + connected. + + status : locks_held: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection holds. Omitted if the connection does not hold any + locks. + + status : locks_waiting: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection is currently waiting to acquire. Omitted if the connecā€ + tion is not waiting for any locks. + + status : locks_lost: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection has had stolen by another OVSDB client. Omitted if no + locks have been stolen from this connection. + + status : n_connections: optional string, containing an integer, at + least 2 + When target specifies a connection method that listens for inā€ + bound connections (e.g. ptcp: or pssl:) and more than one conā€ + nection is actually active, the value is the number of active + connections. Otherwise, this key-value pair is omitted. + + status : bound_port: optional string, containing an integer + When target is ptcp: or pssl:, this is the TCP port on which the + OVSDB server is listening. (This is particularly useful when + target specifies a port of 0, allowing the kernel to choose any + available port.) + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs + + other_config: map of string-string pairs +SSL TABLE + SSL configuration for ovn-sb database access. + + Summary: + private_key string + certificate string + ca_cert string + bootstrap_ca_cert boolean + ssl_protocols string + ssl_ciphers string + Common Columns: + external_ids map of string-string pairs + + Details: + private_key: string + Name of a PEM file containing the private key used as the + switchā€™s identity for SSL connections to the controller. + + certificate: string + Name of a PEM file containing a certificate, signed by the cerā€ + tificate authority (CA) used by the controller and manager, that + certifies the switchā€™s private key, identifying a trustworthy + switch. + + ca_cert: string + Name of a PEM file containing the CA certificate used to verify + that the switch is connected to a trustworthy controller. + + bootstrap_ca_cert: boolean + If set to true, then Open vSwitch will attempt to obtain the CA + certificate from the controller on its first SSL connection and + save it to the named PEM file. If it is successful, it will imā€ + mediately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certificate + signed by the CA certificate thus obtained. This option exposes + the SSL connection to a man-in-the-middle attack obtaining the + initial CA certificate. It may still be useful for bootstrapā€ + ping. + + ssl_protocols: string + List of SSL protocols to be enabled for SSL connections. The deā€ + fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2. + + ssl_ciphers: string + List of ciphers (in OpenSSL cipher string format) to be supā€ + ported for SSL connections. The default when this option is + omitted is HIGH:!aNULL:!MD5. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs + +Open vSwitch 23.06.3 DB Schema 1.1.1 ovn-ic-sb(5) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8 b/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8 new file mode 100644 index 00000000..99ceab89 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8 @@ -0,0 +1,412 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-ic-sbctl" 8 "ovn-ic-sbctl" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-ic-sbctl \- Open Virtual Network interconnection southbound db management utility +.SH "SYNOPSIS" +.PP +\fBovn\-ic\-sbctl\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] +.SH "DESCRIPTION" +.PP +.PP +This utility can be used to manage the OVN interconnection southbound database\[char46] +.SH "GENERAL COMMANDS" +.TP +\fBinit\fR +Initializes the database, if it is empty\[char46] If the database has already been initialized, this command has no effect\[char46] +.TP +\fBshow [\fIavailability_zone\fB]\fR +Prints a brief overview of the database contents\[char46] If \fIavailability_zone\fR is provided, only records related to that availability zone are shown\[char46] +.SH "DATABASE COMMANDS" +.PP +.PP +These commands query and modify the contents of \fBovsdb\fR tables\[char46] They are a slight abstraction of the \fBovsdb\fR interface and as such they operate at a lower level than other \fBovn\-ic\-sbctl\fR commands\[char46] +.PP +\fIIdentifying Tables, Records, and Columns\fR +.PP +.PP +Each of these commands has a \fItable\fR parameter to identify a table within the database\[char46] Many of them also take a \fIrecord\fR parameter that identifies a particular record within a table\[char46] The \fIrecord\fR parameter may be the UUID for a record, which may be abbreviated to its first 4 (or more) hex digits, as long as that is unique\[char46] Many tables offer additional ways to identify records\[char46] Some commands also take \fIcolumn\fR parameters that identify a particular field within the records in a table\[char46] +.PP +.PP +For a list of tables and their columns, see \fBovn\-ic\-sb\fR(5) or see the table listing from the \fB\-\-help\fR option\[char46] +.PP +.PP +Record names must be specified in full and with correct capitalization, except that UUIDs may be abbreviated to their first 4 (or more) hex digits, as long as that is unique within the table\[char46] Names of tables and columns are not case-sensitive, and \fB\-\fR and \fB_\fR are treated interchangeably\[char46] Unique abbreviations of table and column names are acceptable, e\[char46]g\[char46] \fBg\fR or \fBgatew\fR is sufficient to identify the \fBGateway\fR table\[char46] +.PP +.PP +.PP +\fIDatabase Values\fR +.PP +.PP +Each column in the database accepts a fixed type of data\[char46] The currently defined basic types, and their representations, are: +.RS +.TP +integer +A decimal integer in the range \-2**63 to 2**63\-1, inclusive\[char46] +.TP +real +A floating-point number\[char46] +.TP +Boolean +True or false, written \fBtrue\fR or \fBfalse\fR, respectively\[char46] +.TP +string +An arbitrary Unicode string, except that null bytes are not allowed\[char46] Quotes are optional for most strings that begin with an English letter or underscore and consist only of letters, underscores, hyphens, and periods\[char46] However, \fBtrue\fR and \fBfalse\fR and strings that match the syntax of UUIDs (see below) must be enclosed in double quotes to distinguish them from other basic types\[char46] When double quotes are used, the syntax is that of strings in JSON, e\[char46]g\[char46] backslashes may be used to escape special characters\[char46] The empty string must be represented as a pair of double quotes (\fB\(dq\(dq\fR)\[char46] +.TP +UUID +Either a universally unique identifier in the style of RFC 4122, e\[char46]g\[char46] \fBf81d4fae\-7dec\-11d0\-a765\-00a0c91e6bf6\fR, or an \fB@\fR\fIname\fR defined by a \fBget\fR or \fBcreate\fR command within the same \fBovs\-vsctl\fR invocation\[char46] +.RE +.PP +.PP +Multiple values in a single column may be separated by spaces or a single comma\[char46] When multiple values are present, duplicates are not allowed, and order is not important\[char46] Conversely, some database columns can have an empty set of values, represented as \fB[]\fR, and square brackets may optionally enclose other non-empty sets or single values as well\[char46] +.PP +.PP +A few database columns are ``maps\(cq\(cq of key-value pairs, where the key and the value are each some fixed database type\[char46] These are specified in the form \fIkey\fR\fB=\fR\fIvalue\fR, where \fIkey\fR and \fIvalue\fR follow the syntax for the column\(cqs key type and value type, respectively\[char46] When multiple pairs are present (separated by spaces or a comma), duplicate keys are not allowed, and again the order is not important\[char46] Duplicate values are allowed\[char46] An empty map is represented as \fB{}\fR\[char46] Curly braces may optionally enclose non-empty maps as well (but use quotes to prevent the shell from expanding \fBother\-config={0=x,1=y}\fR into \fBother\-config=0=x +other\-config=1=y\fR, which may not have the desired effect)\[char46] +.PP +\fIDatabase Command Syntax\fR +.RS +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBlist\fR \fItable\fR [\fIrecord\fR]\[char46]\[char46]\[char46] +Lists the data in each specified \fIrecord\fR\[char46] If no records are specified, lists all the records in \fItable\fR\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise, all columns are listed, in alphabetical order by column name\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if any specified \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, the command ignores any \fIrecord\fR that does not exist, without producing any output\[char46] +.TP +[\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBfind\fR \fItable\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Lists the data in each record in \fItable\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] The following operators may be used where \fB=\fR is written in the syntax summary: +.RS +.TP +\fB= != < > <= >=\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] equals, does not equal, is less than, is greater than, is less than or equal to, or is greater than or equal to \fIvalue\fR, respectively\[char46] +.IP +Consider \fIcolumn\fR[\fB:\fR\fIkey\fR] and \fIvalue\fR as sets of elements\[char46] Identical sets are considered equal\[char46] Otherwise, if the sets have different numbers of elements, then the set with more elements is considered to be larger\[char46] Otherwise, consider a element from each set pairwise, in increasing order within each set\[char46] The first pair that differs determines the result\[char46] (For a column that contains key-value pairs, first all the keys are compared, and values are considered only if the two sets contain identical keys\[char46]) +.TP +\fB{=} {!=}\fR +Test for set equality or inequality, respectively\[char46] +.TP +\fB{<=}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<=}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 or both\[char46] +.TP +\fB{<}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a proper subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 but not both\[char46] +.TP +\fB{>=} {>}\fR +Same as \fB{<=}\fR and \fB{<}\fR, respectively, except that the relationship is reversed\[char46] For example, \fBflood\-vlans{>=}1,2\fR selects records in which the \fBflood\-vlans\fR column contains both 1 and 2\[char46] +.RE +.IP +The following operators are available only in Open vSwitch 2\[char46]16 and later: +.RS +.TP +\fB{in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is also in \fIvalue\fR\[char46] (This is the same as \fB{<=}\fR\[char46]) +.TP +\fB{not\-in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is not in \fIvalue\fR\[char46] +.RE +.IP +For arithmetic operators (\fB= != < > <= >=\fR), when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the record is always omitted from the results\[char46] Thus, the condition \fBother\-config:mtu!=1500\fR matches records that have a \fBmtu\fR key whose value is not 1500, but not those that lack an \fBmtu\fR key\[char46] +.IP +For the set operators, when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the comparison is done against an empty set\[char46] Thus, the condition \fBother\-config:mtu{!=}1500\fR matches records that have a \fBmtu\fR key whose value is not 1500 and those that lack an \fBmtu\fR key\[char46] +.IP +Don\(cqt forget to escape \fB<\fR or \fB>\fR from interpretation by the shell\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise all columns are listed, in alphabetical order by column name\[char46] +.IP +The UUIDs shown for rows created in the same \fBovs\-vsctl\fR invocation will be wrong\[char46] +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-id=@\fR\fIname\fR] \fBget\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]]\[char46]\[char46]\[char46] +Prints the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in the column is printed, instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist or \fIkey\fR is specified, if \fIkey\fR does not exist in \fIrecord\fR\[char46] With \fB\-\-if\-exists\fR, a missing \fIrecord\fR yields no output and a missing \fIkey\fR prints a blank line\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for \fIrecord\fR may be referred to by that name later in the same \fBovs\-vsctl\fR invocation in contexts where a UUID is expected\[char46] +.IP +Both \fB\-\-id\fR and the \fIcolumn\fR arguments are optional, but usually at least one or the other should be specified\[char46] If both are omitted, then \fBget\fR has no effect except to verify that \fIrecord\fR exists in \fItable\fR\[char46] +.IP +\fB\-\-id\fR and \fB\-\-if\-exists\fR cannot be used together\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBset\fR \fItable record column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Sets the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR to \fIvalue\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in that column is changed (or added, if none exists), instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBadd\fR \fItable record column\fR [\fIkey\fR\fB=\fR]\fIvalue\fR\[char46]\[char46]\[char46] +Adds the specified value or key-value pair to \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] If \fIcolumn\fR is a map, then \fIkey\fR is required, otherwise it is prohibited\[char46] If \fIkey\fR already exists in a map column, then the current \fIvalue\fR is not replaced (use the \fBset\fR command to replace an existing value)\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column value\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Removes the specified values or key-value pairs from \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] The first form applies to columns that are not maps: each specified \fIvalue\fR is removed from the column\[char46] The second and third forms apply to map columns: if only a \fIkey\fR is specified, then any key-value pair with the given \fIkey\fR is removed, regardless of its value; if a \fIvalue\fR is given then a pair is removed only if both key and value match\[char46] +.IP +It is not an error if the column does not contain the specified key or value or pair\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBclear\fR \fItable record column\fR\[char46]\[char46]\[char46] +Sets each \fIcolumn\fR in \fIrecord\fR in \fItable\fR to the empty set or empty map, as appropriate\[char46] This command applies only to columns that are allowed to be empty\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-id=(@\fR\fIname\fR|\fIuuid\fR)] \fBcreate\fR \fItable column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Creates a new record in \fItable\fR and sets the initial values of each \fIcolumn\fR\[char46] Columns not explicitly set will receive their default values\[char46] Outputs the UUID of the new row\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for the new row may be referred to by that name elsewhere in the same \fB\e*(PN\fR invocation in contexts where a UUID is expected\[char46] Such references may precede or follow the \fBcreate\fR command\[char46] +.IP +If a valid \fIuuid\fR is specified, then it is used as the UUID of the new row\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Records in the Open vSwitch database are significant only when they can be reached directly or indirectly from the \fBOpen_vSwitch\fR table\[char46] Except for records in the \fBQoS\fR or \fBQueue\fR tables, records that are not reachable from the \fBOpen_vSwitch\fR table are automatically deleted from the database\[char46] This deletion happens immediately, without waiting for additional \fBovs\-vsctl\fR commands or other database activity\[char46] Thus, a \fBcreate\fR command must generally be accompanied by additional commands \fIwithin the same\fR \fBovs\-vsctl\fR \fIinvocation\fR to add a chain of references to the newly created record from the top-level \fBOpen_vSwitch\fR record\[char46] The \fBEXAMPLES\fR section gives some examples that show how to do this\[char46] +.RE +.TP +[\fB\-\-if\-exists\fR] \fBdestroy\fR \fItable record\fR\[char46]\[char46]\[char46] +Deletes each specified \fIrecord\fR from \fItable\fR\[char46] Unless \fB\-\-if\-exists\fR is specified, each \fIrecord\fRs must exist\[char46] +.TP +\fB\-\-all destroy\fR \fItable\fR +Deletes all records from the \fItable\fR\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +The \fBdestroy\fR command is only useful for records in the \fBQoS\fR or \fBQueue\fR tables\[char46] Records in other tables are automatically deleted from the database when they become unreachable from the \fBOpen_vSwitch\fR table\[char46] This means that deleting the last reference to a record is sufficient for deleting the record itself\[char46] For records in these tables, \fBdestroy\fR is silently ignored\[char46] See the \fBEXAMPLES\fR section below for more information\[char46] +.RE +.TP +\fBwait\-until\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Waits until \fItable\fR contains a record named \fIrecord\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] This command supports the same operators and semantics described for the \fBfind\fR command above\[char46] +.IP +If no \fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR arguments are given, this command waits only until \fIrecord\fR exists\[char46] If more than one such argument is given, the command waits until all of them are satisfied\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Usually \fBwait\-until\fR should be placed at the beginning of a set of \fBovs\-vsctl\fR commands\[char46] For example, \fBwait\-until bridge br0 +\-\- get bridge br0 datapath_id\fR waits until a bridge named \fBbr0\fR is created, then prints its \fBdatapath_id\fR column, whereas \fBget bridge br0 datapath_id \-\- wait\-until bridge br0\fR will abort if no bridge named \fBbr0\fR exists when \fBovs\-vsctl\fR initially connects to the database\[char46] +.RE +.IP +Consider specifying \fB\-\-timeout=0\fR along with \fB\-\-wait\-until\fR, to prevent \fBovs\-vsctl\fR from terminating after waiting only at most 5 seconds\[char46] +.TP +\fBcomment\fR [\fIarg\fR]\[char46]\[char46]\[char46] +This command has no effect on behavior, but any database log record created by the command will include the command and its arguments\[char46] +.RE +.SH "REMOTE CONNECTIVITY COMMANDS" +.TP +\fBget\-connection\fR +Prints the configured connection(s)\[char46] +.TP +\fBdel\-connection\fR +Deletes the configured connection(s)\[char46] +.TP +[\fB\-\-inactivity\-probe=\fR\fImsecs\fR] \fBset\-connection\fR \fItarget\fR\[char46]\[char46]\[char46] +Sets the configured manager target or targets\[char46] Use \fB\-\-inactivity\-probe=\fR\fImsecs\fR to override the default idle connection inactivity probe time\[char46] Use 0 to disable inactivity probes\[char46] +.SH "SSL CONFIGURATION COMMANDS" +.TP +\fBget\-ssl\fR +Prints the SSL configuration\[char46] +.TP +\fBdel\-ssl\fR +Deletes the current SSL configuration\[char46] +.TP +[\fB\-\-bootstrap\fR] \fBset\-ssl\fR \fIprivate-key\fR \fIcertificate\fR \fIca-cert\fR [\fIssl-protocol-list\fR [\fIssl-cipher-list\fR]] +Sets the SSL configuration\[char46] +.SH "OPTIONS" +.TP +\fB\-\-db\fR \fIdatabase\fR +The OVSDB database remote to contact\[char46] If the \fBOVN_IC_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovn_ic_sb_db\[char46]sock\fR, but this default is unlikely to be useful outside of single-machine OVN test environments\[char46] +.TP +\fB\-\-leader\-only\fR +.TQ .5in +\fB\-\-no\-leader\-only\fR +By default, or with \fB\-\-leader\-only\fR, when the database server is a clustered database, \fBovn\-ic\-sbctl\fR will avoid servers other than the cluster leader\[char46] This ensures that any data that \fBovn\-ic\-sbctl\fR reads and reports is up-to-date\[char46] With \fB\-\-no\-leader\-only\fR, \fBovn\-ic\-sbctl\fR will use any server in the cluster, which means that for read-only transactions it can report and act on stale data (transactions that modify the database are always serialized even with \fB\-\-no\-leader\-only\fR)\[char46] Refer to \fBUnderstanding Cluster Consistency\fR in \fBovsdb\fR(7) for more information\[char46] +.SH "LOGGING OPTIONS" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SH "TABLE FORMATTING OPTIONS" +These options control the format of output from the \fBlist\fR and \fBfind\fR commands\[char46] +.RS +.TP +\fB\-f\fR \fIformat\fR +.TQ .5in +\fB\-\-format=\fR\fIformat\fR +Sets the type of table formatting\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBtable\fR +2-D text tables with aligned columns\[char46] +.TP +\fBlist\fR (default) +A list with one column per line and rows separated by a blank line\[char46] +.TP +\fBhtml\fR +HTML tables\[char46] +.TP +\fBcsv\fR +Comma-separated values as defined in RFC 4180\[char46] +.TP +\fBjson\fR +JSON format as defined in RFC 4627\[char46] The output is a sequence of JSON objects, each of which corresponds to one table\[char46] Each JSON object has the following members with the noted values: +.RS +.TP +\fBcaption\fR +The table\(cqs caption\[char46] This member is omitted if the table has no caption\[char46] +.TP +\fBheadings\fR +An array with one element per table column\[char46] Each array element is a string giving the corresponding column\(cqs heading\[char46] +.TP +\fBdata\fR +An array with one element per table row\[char46] Each element is also an array with one element per table column\[char46] The elements of this second-level array are the cells that constitute the table\[char46] Cells that represent OVSDB data or data types are expressed in the format described in the OVSDB specification; other cells are simply expressed as text strings\[char46] +.RE +.RE +.TP +\fB\-d\fR \fIformat\fR +.TQ .5in +\fB\-\-data=\fR\fIformat\fR +Sets the formatting for cells within output tables unless the table format is set to \fBjson\fR, in which case \fBjson\fR formatting is always used when formatting cells\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBstring\fR (default) +The simple format described in the \fBDatabase Values\fR section of \fBovs\-vsctl\fR(8)\[char46] +.TP +\fBbare\fR +The simple format with punctuation stripped off: \fB[]\fR and \fB{}\fR are omitted around sets, maps, and empty columns, items within sets and maps are space-separated, and strings are never quoted\[char46] This format may be easier for scripts to parse\[char46] +.TP +\fBjson\fR +The RFC 4627 JSON format as described above\[char46] +.RE +.TP +\fB\-\-no\-headings\fR +This option suppresses the heading row that otherwise appears in the first row of table output\[char46] +.TP +\fB\-\-pretty\fR +By default, JSON in output is printed as compactly as possible\[char46] This option causes JSON in output to be printed in a more readable fashion\[char46] Members of objects and elements of arrays are printed one per line, with indentation\[char46] +.IP +This option does not affect JSON in tables, which is always printed compactly\[char46] +.TP +\fB\-\-bare\fR +Equivalent to \fB\-\-format=list \-\-data=bare \-\-no\-headings\fR\[char46] +.RE +.SS "PKI Options" +.PP +.PP +PKI configuration is required to use SSL for the connection to the database\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.RS +.TP +\fB\-\-bootstrap\-ca\-cert=\fR\fIcacert\[char46]pem\fR +When \fIcacert\[char46]pem\fR exists, this option has the same effect as \fB\-C\fR or \fB\-\-ca\-cert\fR\[char46] If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] +.IP +This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping\[char46] +.IP +This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain\[char46] The SSL protocol does not require the server to send the CA certificate\[char46] +.IP +This option is mutually exclusive with \fB\-C\fR and \fB\-\-ca\-cert\fR\[char46] +.RE +.SS "Other Options" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.html new file mode 100644 index 00000000..c40a9946 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.html @@ -0,0 +1,627 @@ +
+ovn-ic-sbctl(8)                   OVN Manual                   ovn-ic-sbctl(8)
+
+NAME
+       ovn-ic-sbctl  - Open Virtual Network interconnection southbound db manā€
+       agement utility
+
+SYNOPSIS
+       ovn-ic-sbctl [options] command [arg...]
+
+DESCRIPTION
+       This utility can be used to manage the OVN  interconnection  southbound
+       database.
+
+GENERAL COMMANDS
+       init   Initializes  the  database,  if it is empty. If the database has
+              already been initialized, this command has no effect.
+
+       show [availability_zone]
+              Prints a brief overview of the database contents. If  availabilā€
+              ity_zone  is provided, only records related to that availability
+              zone are shown.
+
+DATABASE COMMANDS
+       These commands query and modify the contents of ovsdb tables. They  are
+       a slight abstraction of the ovsdb interface and as such they operate at
+       a lower level than other ovn-ic-sbctl commands.
+
+       Identifying Tables, Records, and Columns
+
+       Each of these commands has a table parameter to identify a table within
+       the database. Many of them also take a record parameter that identifies
+       a  particular  record  within  a table. The record parameter may be the
+       UUID for a record, which may be abbreviated to its first  4  (or  more)
+       hex  digits,  as  long  as that is unique. Many tables offer additional
+       ways to identify records. Some commands  also  take  column  parameters
+       that identify a particular field within the records in a table.
+
+       For a list of tables and their columns, see ovn-ic-sb(5) or see the taā€
+       ble listing from the --help option.
+
+       Record names must be specified in full and with correct capitalization,
+       except  that  UUIDs  may  be abbreviated to their first 4 (or more) hex
+       digits, as long as that is unique within the table. Names of tables and
+       columns are not case-sensitive, and - and _  are  treated  interchangeā€
+       ably.  Unique  abbreviations  of table and column names are acceptable,
+       e.g. g or gatew is sufficient to identify the Gateway table.
+
+       Database Values
+
+       Each column in the database accepts a fixed type of data. The currently
+       defined basic types, and their representations, are:
+
+              integer
+                     A decimal integer in the range -2**63 to 2**63-1,  incluā€
+                     sive.
+
+              real   A floating-point number.
+
+              Boolean
+                     True or false, written true or false, respectively.
+
+              string An  arbitrary  Unicode string, except that null bytes are
+                     not allowed. Quotes are optional for  most  strings  that
+                     begin  with  an  English letter or underscore and consist
+                     only of letters, underscores, hyphens, and periods.  Howā€
+                     ever, true and false and strings that match the syntax of
+                     UUIDs  (see  below)  must be enclosed in double quotes to
+                     distinguish them from  other  basic  types.  When  double
+                     quotes  are  used, the syntax is that of strings in JSON,
+                     e.g. backslashes may be used to  escape  special  characā€
+                     ters.  The  empty string must be represented as a pair of
+                     double quotes ("").
+
+              UUID   Either a universally unique identifier in  the  style  of
+                     RFC  4122,  e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or
+                     an @name defined by a get or create  command  within  the
+                     same ovs-vsctl invocation.
+
+       Multiple values in a single column may be separated by spaces or a sinā€
+       gle  comma.  When  multiple  values are present, duplicates are not alā€
+       lowed, and order is not important. Conversely,  some  database  columns
+       can have an empty set of values, represented as [], and square brackets
+       may optionally enclose other non-empty sets or single values as well.
+
+       A  few  database columns are ``mapsā€™ā€™ of key-value pairs, where the key
+       and the value are each some fixed database type. These are specified in
+       the form key=value, where key and value follow the syntax for the  colā€
+       umnā€™s  key  type  and value type, respectively. When multiple pairs are
+       present (separated by spaces or a comma), duplicate keys  are  not  alā€
+       lowed,  and  again the order is not important. Duplicate values are alā€
+       lowed. An empty map is represented as {}. Curly braces  may  optionally
+       enclose  non-empty  maps  as  well (but use quotes to prevent the shell
+       from expanding other-config={0=x,1=y} into other-config=0=x  other-conā€ā€
+       fig=1=y, which may not have the desired effect).
+
+       Database Command Syntax
+
+              [--if-exists] [--columns=column[,column]...] list table
+              [record]...
+                     Lists  the  data  in each specified record. If no records
+                     are specified, lists all the records in table.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order.  Otherwise,  all  columns
+                     are listed, in alphabetical order by column name.
+
+                     Without  --if-exists,  it  is  an  error if any specified
+                     record does not exist. With --if-exists, the command  igā€
+                     nores  any  record that does not exist, without producing
+                     any output.
+
+              [--columns=column[,column]...] find table [colā€
+              umn[:key]=value]...
+                     Lists the data in  each  record  in  table  whose  column
+                     equals  value  or, if key is specified, whose column conā€
+                     tains a key with the specified value. The following operā€
+                     ators may be used where = is written in the  syntax  sumā€
+                     mary:
+
+                     = != gt;>gt; = >gt;>gt;=
+                            Selects records in which column[:key] equals, does
+                            not  equal, is less than, is greater than, is less
+                            than or equal to, or is greater than or  equal  to
+                            value, respectively.
+
+                            Consider  column[:key]  and  value as sets of eleā€
+                            ments. Identical sets are considered equal. Otherā€
+                            wise, if the sets have different numbers  of  eleā€
+                            ments,  then the set with more elements is considā€
+                            ered to be larger. Otherwise, consider  a  element
+                            from each set pairwise, in increasing order within
+                            each  set.  The first pair that differs determines
+                            the result. (For a column that contains  key-value
+                            pairs, first all the keys are compared, and values
+                            are  considered only if the two sets contain idenā€
+                            tical keys.)
+
+                     {=} {!=}
+                            Test for set equality or inequality, respectively.
+
+                     {=}   Selects records in which column[:key] is a  subset
+                            of  value. For example, flood-vlans{=}1,2 selects
+                            records in which the  flood-vlans  column  is  the
+                            empty set or contains 1 or 2 or both.
+
+                     {}    Selects  records in which column[:key] is a proper
+                            subset of value.  For  example,  flood-vlans{}1,2
+                            selects records in which the flood-vlans column is
+                            the empty set or contains 1 or 2 but not both.
+
+                     {>gt;>gt;=} {>gt;>gt;}
+                            Same  as  {=}  and {}, respectively, except that
+                            the  relationship  is   reversed.   For   example,
+                            flood-vlans{>gt;>gt;=}1,2  selects  records  in which the
+                            flood-vlans column contains both 1 and 2.
+
+                     The  following  operators  are  available  only  in  Open
+                     vSwitch 2.16 and later:
+
+                     {in}   Selects  records  in  which  every element in colā€
+                            umn[:key] is also in value. (This is the  same  as
+                            {=}.)
+
+                     {not-in}
+                            Selects  records  in  which  every element in colā€
+                            umn[:key] is not in value.
+
+                     For arithmetic operators (= != gt;>gt; = >gt;>gt;=),  when  key  is
+                     specified  but a particular recordā€™s column does not conā€
+                     tain key, the record is always omitted from the  results.
+                     Thus,   the   condition   other-config:mtu!=1500  matches
+                     records that have a mtu key whose value is not 1500,  but
+                     not those that lack an mtu key.
+
+                     For  the  set operators, when key is specified but a parā€
+                     ticular recordā€™s column does not contain key, the comparā€
+                     ison is done against an empty set.  Thus,  the  condition
+                     other-config:mtu{!=}1500  matches records that have a mtu
+                     key whose value is not 1500 and those that  lack  an  mtu
+                     key.
+
+                     Donā€™t  forget to escape gt;>gt; from interpretation by the
+                     shell.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order. Otherwise all columns are
+                     listed, in alphabetical order by column name.
+
+                     The UUIDs shown for rows created in  the  same  ovs-vsctl
+                     invocation will be wrong.
+
+              [--if-exists] [--id=@name] get table record [column[:key]]...
+                     Prints  the  value  of each specified column in the given
+                     record in table. For map columns, a key may optionally be
+                     specified, in which case the value associated with key in
+                     the column is printed, instead of the entire map.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist  or  key  is  specified,  if  key does not exist in
+                     record. With --if-exists, a missing record yields no outā€
+                     put and a missing key prints a blank line.
+
+                     If @name is specified, then the UUID for  record  may  be
+                     referred  to by that name later in the same ovs-vsctl inā€
+                     vocation in contexts where a UUID is expected.
+
+                     Both --id and the column arguments are optional, but usuā€
+                     ally at least one or the other should  be  specified.  If
+                     both are omitted, then get has no effect except to verify
+                     that record exists in table.
+
+                     --id and --if-exists cannot be used together.
+
+              [--if-exists] set table record column[:key]=value...
+                     Sets  the  value  of  each  specified column in the given
+                     record in table to value. For map columns, a key may  opā€
+                     tionally be specified, in which case the value associated
+                     with key in that column is changed (or added, if none exā€
+                     ists), instead of the entire map.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--if-exists] add table record column [key=]value...
+                     Adds  the  specified value or key-value pair to column in
+                     record in table. If column is a  map,  then  key  is  reā€
+                     quired, otherwise it is prohibited. If key already exists
+                     in  a  map column, then the current value is not replaced
+                     (use the set command to replace an existing value).
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] remove table record column value...
+
+                     [--if-exists] remove table record column key...
+
+                     [--if-exists] remove  table  record  column  key=value...
+                     Removes the specified values or key-value pairs from colā€
+                     umn in record in table. The first form applies to columns
+                     that  are  not maps: each specified value is removed from
+                     the column. The second  and  third  forms  apply  to  map
+                     columns:  if  only a key is specified, then any key-value
+                     pair with the given key is  removed,  regardless  of  its
+                     value; if a value is given then a pair is removed only if
+                     both key and value match.
+
+                     It  is  not  an  error if the column does not contain the
+                     specified key or value or pair.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] clear table record column...
+                     Sets each column in record in table to the empty  set  or
+                     empty  map,  as appropriate. This command applies only to
+                     columns that are allowed to be empty.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--id=(@name|uuid)] create table column[:key]=value...
+                     Creates a new record in table and sets the initial values
+                     of each column. Columns not explicitly set  will  receive
+                     their default values. Outputs the UUID of the new row.
+
+                     If  @name is specified, then the UUID for the new row may
+                     be referred to by that name elsewhere in the  same  \*(PN
+                     invocation  in  contexts  where  a UUID is expected. Such
+                     references may precede or follow the create command.
+
+                     If a valid uuid is specified, then it is used as the UUID
+                     of the new row.
+
+                     Caution (ovs-vsctl as example)
+                            Records in the Open vSwitch database are  signifiā€
+                            cant only when they can be reached directly or inā€
+                            directly  from  the Open_vSwitch table. Except for
+                            records in the QoS or Queue tables,  records  that
+                            are  not reachable from the Open_vSwitch table are
+                            automatically  deleted  from  the  database.  This
+                            deletion  happens immediately, without waiting for
+                            additional ovs-vsctl commands  or  other  database
+                            activity. Thus, a create command must generally be
+                            accompanied by additional commands within the same
+                            ovs-vsctl  invocation to add a chain of references
+                            to the newly created  record  from  the  top-level
+                            Open_vSwitch  record.  The  EXAMPLES section gives
+                            some examples that show how to do this.
+
+              [--if-exists] destroy table record...
+                     Deletes each specified record from table. Unless --if-exā€ā€
+                     ists is specified, each records must exist.
+
+              --all destroy table
+                     Deletes all records from the table.
+
+                     Caution (ovs-vsctl as example)
+                            The destroy command is only useful for records  in
+                            the  QoS  or Queue tables. Records in other tables
+                            are automatically deleted from the  database  when
+                            they  become unreachable from the Open_vSwitch taā€
+                            ble. This means that deleting the  last  reference
+                            to  a record is sufficient for deleting the record
+                            itself. For records in these  tables,  destroy  is
+                            silently  ignored.  See the EXAMPLES section below
+                            for more information.
+
+              wait-until table record [column[:key]=value]...
+                     Waits until table contains a record  named  record  whose
+                     column equals value or, if key is specified, whose column
+                     contains  a  key  with  the specified value. This command
+                     supports the same operators and semantics  described  for
+                     the find command above.
+
+                     If  no  column[:key]=value arguments are given, this comā€
+                     mand waits only until record exists.  If  more  than  one
+                     such  argument  is  given, the command waits until all of
+                     them are satisfied.
+
+                     Caution (ovs-vsctl as example)
+                            Usually wait-until should be placed at the  beginā€
+                            ning  of a set of ovs-vsctl commands. For example,
+                            wait-until bridge br0  --  get  bridge  br0  dataā€ā€
+                            path_id waits until a bridge named br0 is created,
+                            then  prints  its  datapath_id column, whereas get
+                            bridge br0 datapath_id --  wait-until  bridge  br0
+                            will  abort  if  no  bridge  named br0 exists when
+                            ovs-vsctl initially connects to the database.
+
+                     Consider specifying --timeout=0 along with  --wait-until,
+                     to  prevent ovs-vsctl from terminating after waiting only
+                     at most 5 seconds.
+
+              comment [arg]...
+                     This command has no effect on behavior, but any  database
+                     log  record  created by the command will include the comā€
+                     mand and its arguments.
+
+REMOTE CONNECTIVITY COMMANDS
+       get-connection
+              Prints the configured connection(s).
+
+       del-connection
+              Deletes the configured connection(s).
+
+       [--inactivity-probe=msecs] set-connection target...
+              Sets the configured manager target or  targets.  Use  --inactivā€ā€
+              ity-probe=msecs to override the default idle connection inactivā€
+              ity probe time. Use 0 to disable inactivity probes.
+
+SSL CONFIGURATION COMMANDS
+       get-ssl
+              Prints the SSL configuration.
+
+       del-ssl
+              Deletes the current SSL configuration.
+
+       [--bootstrap] set-ssl private-key certificate ca-cert [ssl-protocol-
+       list [ssl-cipher-list]]
+              Sets the SSL configuration.
+
+OPTIONS
+       --db database
+              The  OVSDB database remote to contact. If the OVN_IC_SB_DB enviā€
+              ronment variable is set, its value is used as the default.  Othā€
+              erwise, the default is unix:/ovn_ic_sb_db.sock, but this default
+              is  unlikely to be useful outside of single-machine OVN test enā€
+              vironments.
+
+       --leader-only
+       --no-leader-only
+            By default, or with --leader-only, when the database server  is  a
+            clustered database, ovn-ic-sbctl will avoid servers other than the
+            cluster leader. This ensures that any data that ovn-ic-sbctl reads
+            and  reports  is  up-to-date.  With --no-leader-only, ovn-ic-sbctl
+            will use any server in the cluster, which means that for read-only
+            transactions it can report and act  on  stale  data  (transactions
+            that   modify   the  database  are  always  serialized  even  with
+            --no-leader-only). Refer to Understanding Cluster  Consistency  in
+            ovsdb(7) for more information.
+
+LOGGING OPTIONS
+       -v[spec]
+       --verbose=[spec]
+            Sets  logging  levels.  Without  any  spec, sets the log level for
+            every module and destination to dbg. Otherwise, spec is a list  of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A  valid module name, as displayed by the vlog/list command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog, console, or file, to limit the log level change  to
+                   only  to  the system log, to the console, or to a file, reā€
+                   spectively. (If --detach is specified,  the  daemon  closes
+                   its  standard  file  descriptors, so logging to the console
+                   will have no effect.)
+
+                   On Windows platform, syslog is accepted as a  word  and  is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off,  emer,  err,  warn,  info,  or dbg, to control the log
+                   level. Messages of the given severity  or  higher  will  be
+                   logged,  and  messages  of  lower severity will be filtered
+                   out. off filters out all messages. See ovs-appctl(8) for  a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless  of the log levels set for file, logging to a file will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets the maximum logging verbosity  level,  equivalent  to  --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets  the log pattern for destination to pattern. Refer to ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets the RFC5424 facility of the log message. facility can be  one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp,  ntp,  audit,  alert, clock2, local0, local1, local2, local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon is used as the default for the local system syslog and  loā€ā€
+            cal0  is  used  while sending a message to the target provided via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables logging to a file. If file is specified, then it  is  used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send  syslog messages to UDP port on host, in addition to the sysā€
+            tem syslog. The host must be a numerical IP address, not  a  hostā€
+            name.
+
+       --syslog-method=method
+            Specify  method  as  how  syslog messages should be sent to syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc, to use the libc syslog() function. Downside of  using
+                   this  options  is that libc adds fixed prefix to every mesā€
+                   sage before it is actually sent to the syslog  daemon  over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However,  rsyslogd  8.9  and  older versions use hard coded
+                   parser function anyway that limits UNIX domain socket  use.
+                   If  you  want  to  use  arbitrary message format with older
+                   rsyslogd versions, then use UDP socket to localhost IP  adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port,  to  use  a UDP socket. With this method it is
+                   possible to use arbitrary message format  also  with  older
+                   rsyslogd.  When sending syslog messages over UDP socket exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified UDP port, accidental iptables rules could  be  interā€
+                   fering  with  local syslog traffic and there are some secuā€
+                   rity considerations that apply to UDP sockets, but  do  not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The  default is taken from the OVS_SYSLOG_METHOD environment variā€
+            able; if it is unset, the default is libc.
+
+TABLE FORMATTING OPTIONS
+       These options control the format of output from the list and find  comā€
+       mands.
+
+              -f format
+              --format=format
+                   Sets  the  type of table formatting. The following types of
+                   format are available:
+
+                   table  2-D text tables with aligned columns.
+
+                   list (default)
+                          A list with one column per line and  rows  separated
+                          by a blank line.
+
+                   html   HTML tables.
+
+                   csv    Comma-separated values as defined in RFC 4180.
+
+                   json   JSON  format as defined in RFC 4627. The output is a
+                          sequence of JSON objects, each of which  corresponds
+                          to  one  table.  Each  JSON object has the following
+                          members with the noted values:
+
+                          caption
+                                 The tableā€™s caption. This member  is  omitted
+                                 if the table has no caption.
+
+                          headings
+                                 An  array  with one element per table column.
+                                 Each array element is  a  string  giving  the
+                                 corresponding columnā€™s heading.
+
+                          data   An array with one element per table row. Each
+                                 element is also an array with one element per
+                                 table  column.  The  elements of this second-
+                                 level array are the cells that constitute the
+                                 table. Cells that  represent  OVSDB  data  or
+                                 data  types  are  expressed in the format deā€
+                                 scribed in  the  OVSDB  specification;  other
+                                 cells are simply expressed as text strings.
+
+              -d format
+              --data=format
+                   Sets  the  formatting for cells within output tables unless
+                   the table format is set to json, in which case json formatā€
+                   ting is always used when formatting  cells.  The  following
+                   types of format are available:
+
+                   string (default)
+                          The  simple  format described in the Database Values
+                          section of ovs-vsctl(8).
+
+                   bare   The simple format with punctuation stripped off:  []
+                          and  {}  are  omitted  around  sets, maps, and empty
+                          columns, items within sets and maps are  space-sepaā€
+                          rated, and strings are never quoted. This format may
+                          be easier for scripts to parse.
+
+                   json   The RFC 4627 JSON format as described above.
+
+              --no-headings
+                   This  option  suppresses the heading row that otherwise apā€
+                   pears in the first row of table output.
+
+              --pretty
+                   By default, JSON in output is printed as compactly as  posā€
+                   sible. This option causes JSON in output to be printed in a
+                   more  readable  fashion. Members of objects and elements of
+                   arrays are printed one per line, with indentation.
+
+                   This option does not affect JSON in tables, which is always
+                   printed compactly.
+
+              --bare
+                   Equivalent to --format=list --data=bare --no-headings.
+
+   PKI Options
+       PKI configuration is required to use SSL  for  the  connection  to  the
+       database.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies  a  PEM  file  containing the private key used as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies a PEM file containing a certificate  that  certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate  authority  (CA) that the peer in SSL connections will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This may be the same certificate that  SSL  peers  use  to
+                   verify the certificate specified on -c or --certificate, or
+                   it  may  be a different one, depending on the PKI design in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables verification  of  certificates  presented  by  SSL
+                   peers.  This  introduces  a security risk, because it means
+                   that certificates cannot be verified to be those  of  known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When  cacert.pem  exists, this option has the same effect
+                     as -C or --ca-cert. If it does not exist, then  the  exeā€
+                     cutable  will  attempt  to obtain the CA certificate from
+                     the SSL peer on its first SSL connection and save  it  to
+                     the  named PEM file. If it is successful, it will immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all SSL connections must be authenticated by  a  certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This  option  exposes the SSL connection to a man-in-the-
+                     middle attack obtaining the initial CA  certificate,  but
+                     it may be useful for bootstrapping.
+
+                     This  option  is only useful if the SSL peer sends its CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol does not require the server to send the CA  cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+   Other Options
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+OVN 23.06.3                      ovn-ic-sbctl                  ovn-ic-sbctl(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ic-sbctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..7b727f340d0dd78c63faaa195ff0f749a438465d GIT binary patch literal 53219 zcma&tQ*WlRK)*{6cJVxl_H{d5ffLJ78U1rG&T2d zwsJN57jbblb#Qa#7yMUMaC3EZbCs~NHTzHV|FjYeI}sC+gRwOXA0MNvnZ1RpB@xHJ zh%)29SzOJWi5Mkpja<#d%uF0i%>)EsTwI;ajO<`MbIY^=&HxD%zcmfnE15yGC_~2y zfjSdjtqNoACNl@SsVX!n1aVuTKnS6!Sx!$u@t@9$lW<@%-ul1yA-W*u~U#nx$+ueV4eP4J=AT@em+ag=&OttV@YDU7= zwi)WbL*#Dt_av2)COi+UefHREtXt04a*E0^`+f9I`HMFZ9|CJSJab=jDKF2jhkb62 zZZI#=`{tHM8KcGeP$w&H7&c~_xzn6GB*E%}gYt3FRSC!Z_ZmeEdz067@n*5uGSm$RF@}e;;GiVAR)}54802y3)I<*$$1en+~r7 z=Y2As30H?qhW81Il?M5hz$o62H|@3o`_p7OLmFo!C@|pr{XVsDc~+CbSfDH5bD(RE zab8^&4%uE4`t(4OD*XX+qiUx2MeS`>-DEOVjb8&1{t-2TOf)Ls$X!6$YRp)d@?1Z^}rF=^dkm`6!b5F08)?ucWVS|0V^J9z4 z{NR=S;iZ45Qixm7FbGM^&wl)2Rp|R811U6!YP+RoJn`|>Y1pTVK@<(9fmv^!wM;!l(uz|QAWSDII&&|47qOanc$8&B05{=?a@ ztSI2Dp6nj>zUEou>@_CgI~aLfSK_$288tQ#7;1|hMrfU7xw9VT6e#=wrJ|l6ldj>G}ALu7y6HMUY{5bO?FD_$;HQFOfL~d$|RX z@^>Eg_YA^S``{hY{V_m?ajWQeYU!#$IyjnJN*`U;LaxF=!`sr@Vw6d_euLrC|k zSQ*x{1uSM5l97`WW(mH~QK&g;DCw#9?(PlJ$qWC}Ut{T4@%H!F7u-YEbP@(;Uo;X_ zN?7H+B+}j;gWY_`NgDQ{kL2s+f_BeKV8Kzx$cG{DTU~ArrtHH?u0RZ=lg-(M<)wpp zr<(L|hpI~!i4-PdJ?IEVau59kmr6`T@N_DdN}<~8>wfaki+$0I?`IdIfk8QfM-k}J zEMBALQ*AHCu)Dw!YAz%77~+u^Cz~l)TFq;zZ|$xQceu{a%k2XAL=@&>y7q6ZPU_W( zKfPjNXbhWhiBD#CaWlt8@oXI1DL{GD=uDP4IWzb(^?Xpff$QZ<&!oQ2#62~N#o5wb zkJ9hfBou(bW@6-sx+IJJ{ZyFK)EH60c$R~=KCVKB=V~Oe#TjYCWqgUBBE($|i`r`B zaQG5i^>LH}KyUNVd?X#bc|AXNa4L|2Cm?HC^cqqNDQ>kmG2eqv%(T|`QCg9Gq@?I? z?s@ZauRUJ*mqpYbvdfSImArw2BbK1Gqc&gcVG&uA5j7bI?$IXobXfN~po1~LNe?ij zZT6MCbwxWU+rYSHV}`jOYuXk+b$AY#Ua5r9{iwQt#Ata*{My}@FZB9*;aum6c4m^& zMc6^=v*_{!IETQckMcXmcvE@)yOWqF2VVZNY8E_;cra-^7R;=^imV))P~}4~72+ZY zhhop56dFY$oRz0aON0?kGE3CBn{?GqLLs5T>dto5RX`TSa3tWfOpu#OrpX%IcsO5t ziwe6%9c1dCKc0TVkql){!jalA3tG!pvYCXTh&ZLn&t-K<^q5lFVK0J9zCY+jGSf?_ zjTD2Nbc)=Cj-Pk#YnNa(Edq{&BuQO>(zjPwZE|i8WzQ&}v${XnQTs&RobN>y%;({K z1U3i?<`mysV%&t|j!b^j{cPB5?96sQnd=-dfcbPMj5S=D*&cus$ISyS=}kHpS?cuHNUu0`du{CR&%AjQ!ee3nQ*{6U3UT2I`7jWGn5wO@7 zJK17fV9b1qjpHPMj%n?7r(2mG_oCIgA0+0mpD49dz6Jim=ggaWGtsP)WG~e!b%%X= zs^3|(urzJ3KHxy`7Hv9^fCXizOMKjMRyWgkAG|5!q~kaCgNPnd$upB}F)^GBjda7my(~P@cuQ z*Ogs#TTQ#e811O))|=5JZIvuL?+@wGB-N1N$z+gkkEq_2K4xK;A=Dd)=}jxbS)p;C zeI)Tq3-t{>AEF6Rn)<&&FZ1hTokgUrEg!c4hvmp(>K~Vd4A1^51wVE>CJ}^6vlKBz z0*bEUJEoDIuH_q&8S4sCY`dQZotJUytG2atRb%xDj6W^Mu9^qWQ4odK?WpzYu@k;K z?QM!6;b_I&GnP3u^G!UCK0ag&mR^unAZ)*(F6wI_T>D%UEwXqu@Vb|KF*AkU8BrW0 zCAsyT{-Sp}&?V0NzVv0`LRbAU4~<=MlSnU!S#E=jmuVAPzJ`-N?-GT1T!0FKC{6NO z5dmsfAad?@3q$DPZRwC}v+AIla1LT<#`8n=lWc?)Ekn$s0Vq!C7eF#&WH*-!WHjQC zow{@gd_1jWW2PztC71Rc2Rc+N9$8)AgTN*>1J&L= znS+0vBY=Mv`b+4Omrc(`f)-|d!a1o%J!|<1Ca=i&EQ1ZvH?Rs~RBU$F360`6peQBZ z`{2ZgBZqbRT$BEIBdFsgnhyj4LFZwNVqWPWDY%^-aYyRXU&dP8Dpk6nZmjbo894hj z+WbPQhM`EkZ;WtgrNY-Q)R6;rporj2L~=$FMC6J?Q@_7nARI?HHTEmM??o!SUYx#1 zm!P!&EBdemX`0<5QB49LW>FJB>(*(fpz0?`#T0be{%a(kY6aA7fy^9Tt|qRIod~9@ zEjO-{?WQGw*t4Y$x`J)O;8*mjM&)Ch6Z!$f`r~qrMuv%6#esi+VY-%Do?F*jNyCgk zV=WT<4x|{OR?RBoD}HkrgkE3#1bq{lKPU0H>qC%u+VW>}G8>k2CUim5B{LACn# zsW71>X~?|M@Ip^8*G6m1;O91Vj1P`5O|^#ZaXB+#IYn>2RQEQ^AZac?52wXhL zhpfTkFI+W)M9AdHlE(9g{masY4F8{P5xs1HpSihD06_2)4Ne=EQ46~asahEMS5IAC zM_o(B*B{OJI%}*VtP}g1UoN2CQ!^_3s**x-+2|!}uE%6rg*l=qb=K;OqzX1hY}NBm z`iq{%icRMUN8vb~^M1J3OK`54cv7UXgY)63T~$ zo!0%m@B0&2gtKcJ=j0N`^7}+Y4_9d#J95WA!E%Orzrv(afYfI-H1yeN(_5b1H_|$H zV+d9HBBZDke9P6Fh)QF_O#K6nwmhfiLVJf->0qp~!>!{O3%(yg-z3$qSi1nwQ_Aa; zYYw0CMX6++LW+rC9$Da<6(mHg$W!PBb!}L>0_MTvbW*MI=j4gp1C+G1P%>6nxM`N9 z8K!#fIc?lpe~$ch+Q@92?_v8>M%kKmya#Ms^giB%$Ou#nu#zyhPoBgYBg6gA>jLt6 zvwrk&r0WjZq?KFL{2gsaQnoo*ty)9hqi!hsa)XjvHcw15(B*i^UvltDFFCm1R=Gs; zQ--d`BDXa!10F1rXL zt4SCTKaM!V8?582^Ro$uXS61J*NrpOSq}H=SAgq#vpZ&kq~c`Bh6{5a2pws$FU^ai zuWTJN6r9KQdjuHe*t0bd9InY8b%nWn;<%>}-W4=LXPmbto{hm|*2R?*@1w_lPST3t z9Q;N6lj2|sx?_dZ&0Ls4nBq~s+3HnASBioPlRNw>&}mYi^KOP2??OTuOENlw8(s}s z-F;ld@uiU6oM%P14bX0>ZkS**3Umx$A_24U3xd!@gk-cc=)#-jMovTCQCd9Am_e{Q zGB)tF`LLP=I9+UbkfL1}O%g+_kTo(TPw`ke=@ioTZey%4xaa6l z*{oB1@qlY`SmH`AV`9amtNzPqy{ZvaV_(SPLp4eJUXC3zxj(?04v0WswpkruwbY<4 zzR-OdoLY?VW znxphd)CZX2Q1$+&o>)R5=~1|5-Ae!0Y4RjNjuWM&N+nAZ8vefAQ8x9jhSZq-{q^b z)6g&-hXRZ;Lc>>Jn!?JL{iGip8dPS)P}!Q_rm3uB1vk%bkQJ`%!B)FIo}|Ek{oodX z1YLD{h7Q)``pBKl@J77M=SC26^;8`u;9!K1DT+MVZI^wu|Ex}QtlfNFL{Rq#_+qgj zssg1xNDU~e>hV8APGU%Yj>b0MJ>#qpkyEm%u=NUG_Be-SokXh(eT-H1 zdy$@d2>ggE?iq!SO-hV!_C^#uTL8=?G^uF^gw2wI1Y{dp*`W+L>G^Ckh{2i!@gQ;i zQ=sjg#tRf@KyqR_aeN7;hElEQ%=tXFG*)!!;|z z=1x=4DTqtePKa>+JIuy?zh%+BuuUE}8LdaoCC3dBdj^k(D0neO3Ju^`m6U?%3OFku z;OI+NR$wg@vcCoH+%3m@Cr)-EiLGS$5>(4BHXrzhuGfkgIVf1R!XIuKYzF;djpil@ z4Ja>18~C!pX@yPk7rITQCWK^krZcW)gnJ_D(xm3A^ClFLOAP>ZI2=+E7(p(SNvCkO z=od~6j|RJ{Ku~Tnh0$)&D%G1-KOw8?Hk6iYPRTR`ZZGo5MQ_x~kez9+99U!6a)vyw zWY_wcuwA^)`KM}c-8n=|=kzasrnYC~o7Y5Af7q)|BU#W0yKcEZ$ZMWOt+=gYVPKRi z(ofa{q1F)KscDtUcr=RE5J1~S?t6yc-8b$Z@)3CHAbYII*FS#IpPnn0BIviZa9#|| z-}-F>d|P^mnEY)$1o7bG6xi2quZz2zwS!X!ilaPsvf1}CR=P($C9V@-Y$R5WL+FFv zRdx{9oQuJ+jmaYFdl`XHlBMl};hSk`S7r3_Swybgzq@~%#=^`5dIafm%}1N0V~x}+ z^xy<1wj6fVkF$0$!bR|CX@_x@wy$UD=eFZK{+yB5K<{dsQ=<7B^LSM5!OBilpu>Pn ztShWi4wclhO?rgj7*l!U38$l)SU}@YTrMTX%tOvKWTARGi&XHs6Yog*^;~1r?+=8Sf2lWk7KiLb0Z89y7GpP-`dah8P^H22 z&&yZ>=~M)RyA?g*fpa`|Hq||UgNb2F6(GX46Pr9Yux_~N;E7Q$lfo9pSEZEPA*$rA zrh3KXW~ja9;P{E}+Rx`PBdX-|+TGXA;P!L}V4j#e%Pg&`e1a2n*KD1XSjH0t4?E(a z4*Fag%gW+r)Pa~2P70UMbbG>#!tzcrlK*?8{AUcQ#us)O;)Qu zVs3C_+TPd;Z~A|X?sMM^Ff6yyYn^u!?39k`?6(1a(7aooJ0cN9<@;O>oOvyq%M@>S zVTAFdcG3^Mumf!T{kJLALJ19Y7=>fT7Rq?lLyLD|M6UAEd}yLVuxJMT_`5`km->i8 zI~^gKzcoNSoCnV)hOv)$v62rE@v*o1@`=t^oyySx*`)-ohe>@)B5{wtl{Rs4Y3EKb z(iB)2C}HsDMfboZQJ$ZF+RDzWH|mg+v8c%7@c;M)d1NSMxX(E={Vi@ z=3l{WP`V^HFBrakjCq-R1PBO)q7q4obroAqft@EHZn$e4FEgim!Q5>gJnXpjy}N3d ztHt=6sR&dz2v@G;g31z%@%ZFEH%#$f%L1C-N!!zF=PWe3 z7&@`Udb-t7&~H8B&E9gx|Mb-Lz~cjq9E0w^$FQY7773y((r)lzdIYU|A0k%t{7DEx zT5o~5`hlcwyrmAng^dAy5V+i@W%3|AAZ*Ve#1$QnDZ5pH=~?kl>Ka-LB)E>JF^|xT z*ESKr?FmKr6GYK{ohAOawx+Cbj}w7&LK&`HuS!C@QNnCcXd|+7;BwwG9rzer8OiAEj~V>yyBj{@;x|<&P4ujZeJ{u9jjre~w`k&9e3pM>de^(t!lG>|iJ4X*&X zB0(Ok^ba9#ryb4wlq#zSbaECbuHvMZP=R%O3ZS1P`n%rGz1eWe1CdvuL5}0xLQk*g zThPzY`IY?7H)ddOJ{;7^+cPH@7+}8YBf4kgQzRfw2WQp<4@nLe-guUdtCF*n&%sgE zqjyr_4M(jdXW41I6by0%4L59^Bn{rv`fGjB2;g@Y7;acI8mIN!qs#;>e-y0FCQVg~ z2id{>7_abHq~nNtm&^$ycc!h?-%#AKmX?rd0pY4)CK<0ys$(h;Sww>nWecjizt{g3 z+g_0Bac^Hi{#l*RJ#ij#JAjAaPrBMW&M9UmrOn@uFeN>l79NxqfhTInFH`v>C_foO zt%G{FOP(J?I}B2&a5S6Tp9+L2Y<}nW1i>wcKK~)kA1Ca_D}kQql|F4ti=hx5p5Q?c zH1K^~n$RuFQAh_Lqd@VdKkC*H?6M=^yNr7Py`d#NO|tVh(WI)01*@Vf4qmCgjUasL z!E?}DoqVhR>CK*m|KS*Tr~G^&%%@JC|1U!Rj}8CFknHT-|Id)z|CKOgVfw#h46k%_ zTma+f{%Z|F`Lb@M@XrvJ-Ad(ityxYLa@rbEgroZ-xCm-_+0l$<*QqX=n2Tm?h*t+=N&O);lP+!)3^L$;roZ}Vr z<`w#V^A0dGI4PgWvk&Q}!lW41C|lmIAMXvAp!h1FPqd*u_nnZv- zFXI*r)AgeZq)w?W3}|~K+$ULH`v9B)bFm|wfpThOHnZ!ea;TOO%q+!eyHH18JdS16 zEoVLVRlceYGZk02WeNw25aIz}xhkDpW3kdM+(T>kyD@4N?%ypj4gKHKpDNVsJ+JSN zTSo?$wJem_5AB^;*Q&{zH}{WpT?XknRw2&vnT{^=+ZjfZ(NJmS-!Tz;yWD%KDh`*` za)0f(8~hnCr`QFku%}$aeQc;q;`B1mrrIqB33}9ilgV*6O*E&p%=Spb<wuK(LN~@x3S+Dv`7xIU(99H`LUFiteyI@tn;j zUfHjvYjY?{n_xIP>Sio}=X+-IQSfCZf;c}B`BHfE_ zkW>;s1b(d2SLo%Ekp=;`Gu{W5bL2Pqrsy-4Gnpk+-D#>IIpp$Valzd^~~H?AbcMAlljwb^`k;h^Vsm!_^;@4S#@-O zR|uJQn@2-PZbckaAS{vm4?n<>OVsxMNaq^?>V1DO5S@CBs0&)nRdc6=fOhRAo+bW= zV>9(1@}^R}x%;)0nH{}31|v1W&)ai_#tJjPX)@{M+=Xk-DLME-9e`$rvHK3iLphye zfIlNsZrlS>sgk{OG6Yo=cQ2>c$6fsv<;`H&I}udi4BhfRa`yJ>@67L!uDFN~7&uow ziWj-Qt~LyD`@AD1A>FwBppec}$)DGz?l(<;pq_T6XtB(=N2!mB9X+`r)I(#8dk9Hg z-A^OUy3Rll90}nYxVj;#DR1*v`&Q$qHxzX^Xl^{bPDI!@U+|*~Z*XSsY2v@imB^99 zw*?!+;z2_bPAv|FhLd?o`X~i?y0Bgnj-Mw5d zV(>DCXlo4Nt_84s#5i!SqO^NUz+*#5^(@H>$M$@pUKD=@=>1G%ku@s}De1L{)*zKL zcF|L2u@Bq_2gV#rAl>d%_qz8Xk4&`Hk7&J!WlO#-U!Ha~T?MlC$)DAWePAeh5>TKM zP!Q3C?cLN5Gw|(v%<$n=ZhF4>-J#QLQR9GV;M7Y8p38kK0ZT4j@&Jrt7kDpylMrfLfYPrIE|ACXPq>M!fyhYe&R@{HbR&Z>4qY>=DKB+*t~M+f;}l#qyj9v^AGF zBnhgW+Xi=Kh+sP^{e>mbro0<-o6bXzZZEs;aVyKnSa6M}{`?sx>C#8fc@d)IOs62R z@nymx5We>O@DfA>u@tkN{?t6SOTo!^0=&tUlrAmf8<&8^FNtzxTz0fq9nD z3vcm#2JZDkv<8{ZY2)~}7cMjxBJQG8QjdZJ&N~)s%J`|=9FdwZIW|%{ZzcT@8>B(P zNBhB>aL{JVAWt0*Hu%Qk?`rVCanQ=<3Q0ZMLQ^JUY}k8TERAwpuDSpLMq7NsbOCL= zBe05T8Q{g=5czhpRM`}fZJ_L3xIq;>SZ(Z-H{mnyN1{UAcSaelx$mji@q zsg;SAhtEpEc8%`AFCKNk2)85>v8k;4BN9j<7zJc}h&1yh+KpSw!60pxhCC_Si|UpK z8bd)v;2Lztern}SN#%zH3CBNq_q;rJV~Y%5(0}ohzf8^n7t+~7zCkf6w{@tgKXg9a zXU?}(&dO#JWbC`d@Q8RwNhA`Z7BN!bC~V6MM9V59D79txMpe=7&|!3Q35Ohp0#<4!qF16+?;O5yT}+SapomA}N|K&)g|Osv&_sPPD8`3YLE(`VS& zECi&BKR(ot;^fgO|HU0aDI=E< z?{lYzuZereS1CNh)4jjCiy zc6SZPfDboxZ=;oOr`l(@y%nOc%*=_1;a05$ENL#D4l9GTA}Y zVgO^E5_O{^L_k|}DLF^Wr+Km;MeYy>H#SyXZk%IC@JQk=HEFN-de-C<0t%4lJr=q` zfJ8?vqX0azr@Ok*Z`)T}Uo$^F1d5LbrObEqkt>c? z195&VYV4O>GJck{rkD7>`-tJ5YWuSl%%rkDmVhAXJm>4cZ9OsTAqNWXwQ>oJfzHq@ zcTBEIgslzeI^K4IYLe^HLw6BHbWdN29TWlG4C4js%m3|HwUoS!#ATzxBlOc9G`9um z8&l!I19}sRs+@zQzLo?w;9JQ#hgF96C5a7f@I zQ!1uo601Co-wxIq2m9j$59R8<(DuH*>HwPjx8GwmS}mGsb}{htFr%3x+>85`y*nm} zXeA-Q^mAryCfrK}xP$2u6cZ$<&}Hp zEk~UMjj9S*je-^B&&VARlSq=~+>L3!%_v>6d17@M3F8vC&a>``yQvZ2N*WHUdQOdH zV&S!1NVl9Ug|BYNig8Es1~%f1m#E92D3kAQ;=}FAep`b>oNpU%Ik1=N*l%CFA2U2h zsh0S?s-t%ws&+r@F4B4ot2-43T1k^?7|q@U#8wGEk~XDbEg${T{_I+5Cyg*3p|7a++)N0Ip+p}Lf z4pIuDnIj~rYnRuG(}cI zJxU~FRiECI$Az#jJnAHH(cuo=t&x^Tus1BOXz@pJ`-%pn+>9-LnXh_L zev__3d90)`%45MB-CS<(W$`-x!@O78UL{Mp+IPWmYXu)ojujukSY1S^*7Y~uBa6u~ zyp^`WTpcO5JQjfL=CT*6B@0Wv9#Ia7I%QdQ27(~8Sc0knHO*q=8x~GEeOp96(oVAa z&BT}7j{|ks`MuE3r<>ADd9=6K7E#X-5uJ=1>2oC&$TFUyG?XmeF=_OJ#V)r#U{*|M6sC(6e=9^KD#k${FiKydFNa4uB+A6cCS?U zK<#B-dsMOq7oy^Pmq5PK8AjnL?P^;|Zf#mX;^R&f#rK`KgIc=Q9g6o?PF#3#tOos` z_b#qz-+;m%C1N^8B#`0duskO#`E?EW3dI7b8y$RgkoKV#AnE?i+#{R(52gY`C^V9c zJ5nVF?H?>F&_n=Xwc1y?wn2$jT!#zjiYc7h>wH(V355}f)9)p^8CclM^Egx-x#xM? z$kpMvAiqrJBT{8w4ZG@k*4Up)^dNS#DLI_X#mH*C1_CClx$#8#Ro4o;Rij&4Snm_K zlX1E-5;;7&{`c2^F6Bgx01i34m+f_uBOwtgj^LmI&#R@6=(cl&t!c-0Z4`|MqJHZ$ z=YcX1^*n>m`1|BYlWnqV8E!2%6?0%6Gp~g+9P~@|mw-Hq=YW zakesd%>vZsSY0I-yixvNqAmG8_T(j2GNsw%(BD1~Oe#pMvy#vBp&XeuEOq({rx5Fk z>sPrcI7lvvzX~QC`3qqa_`#I9bGm|f2h;d|c1Mq})nAId3eqIeff|Z267Gu(1RiUQ zB5+yGVMnhnoCDU?8Zf54_kJNlRMa%RL5f55#T_~z8g7lmsPGH%)yfnGH#el3UtfHb z`?t{K2w$A1Oqp%sPjXc4W{1!ur(Y0+C_`IUlH7d)S5@v&LAa$;2#bTsYjmSmf%Nv& z6E7lVDvfho2jtXm0mep{lDUZ*;TFimD&JyoJ?`Drw$-u9oWdEj8uc&^Z{JgM~V zhws3J`0zqR+Re=&LG<>V-#?zmT1miE9nnoZ+WjJ@W(B^#HRZ}cX7eZ9fv(Ax)zEMj z4FGl@Jdj$7UdmNfu<|<1orNes%fs6b{w{?O5oWJ?G3;uZ_z~`iovpzz7s!?l8o=G1 zVR}MmzvKlYkktL#U2^n*s!qJ0=~G?M6}|g*G;C@?Jra11OVgoo?F*B;gAv1^0h6B zo%@3DJWmMKhLrn3B)T-E2($mOB!$T5?m`P~y^-tvI>Zw-Y_f*$75B#oyN2Uy&Gw-r zkVZkG%#w>2GjAUQHU~x(#uzr&(Nl1~4L%IQ0JrU9 zy3w2gbtD@?>cb8f=8j~%q_LmdZXz@v>_}F&Osztc3W~)VH>B|z=TRC?>zbFl&>$oj z$1%CPnSAEEB5xUBsrLj5Bn08a=(!>wFP;kJYXpIvC=UF#$BVUr-KCZmXJ>Op!HM+ej(+*pbS zBLN4h)gNYvOGUl+ii#ZTrafqWdO?Ok$9aJZhMNrI=J(M4R8~nQj!oWHj+C5mRExBW zIx{E+zG5Av)#4URS)_8M{GI?ma1;`1NFao4^8*%GCe%9!YagtlqjxAcDXwf8!$X=W zjt!|Kr>E*doA~D0`7XNkYk+jgLXf#|Rt*-Tc|{6=CwF}D z5=F(q2pT^yYO>{9pba4&a(d0LmZMCX=N313BhZOuHc5m17x zR@kruY6g+?k2LL^G&bxd${X=KY22?$Pg}8{)WQy|N)Etx0j*t~4r&!ppFJAQN%F9b zv5>9)!Oe$f>u^tE@$w82+iB)Oq%aCC9jH;f$#5=P&rWMk9&2_#8|U$v)g$^WNOuf5 z#Rb#1ttO0ajX6bK?x$0;M$oGje5g<*;of_=BV6s2-HY0Ktsj&nB9SMN%wHi+qKi64`j>Ze+s+k*z0%Zipu< zp(`~Nso<$z2m@%0Z|j=+ykTooqv5K>jrgC~pCuABFU(KMV-dscLNTEF&PZ>M5XY!S z{XeVDg@qH|NbA<#`go*f#nuxV>Lt&?a5!R7se5BJOZZ=Rj+Q+`Y-@vZPR!}iNp&aE zK9$|hmb{M9-A=(TK}$^zD-GT62-tcC#Ii>&xxv4fdVH2;8R?Y7#+Jv$z1HHbe=Rm{ zmVAs&Z~RKlG!JqOn`Zoz9?(TB$14qsFrU+P|IQ!6K<0gZPW{C!AI>k?@#o74vA2E< zP}-dVF4xD&kT+_#V(1_M)w&!!wtmpUqfyj)7N09jvs>C~z2`?m+%d!4TE0Xf`SdPw zxIQzcDX7>5e+a(4oT|-qG}{Rej?ZP+N|-JjcP_P0uU{h} z4=M~CtHfii5|-Tmcl`i3i?%p7gy?Sd7vkS?NLeLpqk(iKXupR$NDL9i57P5jD=wI9 zpXbc!^1`j8qvvmMFl&<5fDb#L&AKLGuk|$A-U;kf((6z6>x*(>`ptd*`Cw|TCvBR^d&5)uYMok+0X`>IBJ_6D>+6Lec)A3$Qo-`94M|wUadS|-q!3J~c z3J(b!0;_Qx@SLn&E+MV`u5u|9z!wv~vWtetskK(}VKkdP?)74H>J zeFOY?h!^uq_yN2Px1RW}T=fNvi(mS0GsXk#S%P_0A#+7Wh==p-gm-t~&RS5##uZSy zn1aCAf%KSsr`}P89K61qGK)k6A*p`&W26byEWaY&g3$qTo6-vNhc9T3aX@(x$^6sY zmR*XL_IX30iK#|&>iLKO-BbWvP7BFr_bKkRDEH;%J|#?3|71`zP%DK}{J8O^1WZEE zu^aQ}uHZTabo|Hu@ww0I17RZPc;|on@jov7-!v}!|MMf~fBTW^|Ki7gA3yB@QYd~e z8jk?wz*Qs8jb1n=#FQBbec8(m%_(DKNMLa#77r?AQRO9TgOk;P;(*QS{yUPX`B@?+ zpKB0D8&}%9lYmMT3Qgimy$&e&0LRe#plCFM4CL zL$XId799ibReP2XL|c%Xv6YAY$p}vK7}|>5fMl%e)f7&cw!j2Y2ho7qx%e1-nN=#Kl0zEjFwrhQy*~f^mEy%H$1Rd4Iz_h4O2E3Fs%VU>~gAU;YlqeyREj0B~r-L zIR93(3d}D(J*I}WBvX*BdE!ygb`yDv9nXhPW&HPhR0Pp@&aJK~1t(T+5B9kBQOO+l zSi0ogu3!0Anf)mwoM;KITZzyar_U^IFbermFdqdxHEl9IY zYzhUbcpC}3W{-Yi>wGeYPU2foYXbH;iyBW)aJS?BVuA94pFSEHP{4gV zv7r&h64$-2MVq(9st0@!JM=hux9 z7(?^E4}y0Nx>k>FIIow$mO-G&~5Sbw(; z0_LxQOQYl#{>d8X02z_*;}vDR1X#7M{zA9nkR<0>4)GQ)e~*JBBWjDLRM_w$QvSj2 zce1aNX`dyzwohog)T^>jbCs}FFuSTY(lZb`hF8k0QJoeMk4qK!$#0_AG9o{*&Ve6n zrQI9O8$rKME0mEb;!a0*7mtrV&qcO_bF;<{NKnsMgiJ6sKkg4k2VSXnJ3Y|XyqzD! zL%z`M-s->Qbt!X^yrq4F zkRq8KLirxMn&!4n7%+UTBfqaYayWOc4FY^Vybpcj70p&AP46PB03$zo`WocQ5G2sl zlb6j5K;o5_o_VyPR)MVTYm?lrqs~Q(@e{2F#q$hjz?2uD6^t*m?amE$pid-LZ2k;R za$rRkUOZ%AokH4dz@epw2-~$UUMYG2c0&^=F@=60pZL8f;51W_OwG;ow}1dowY_R7 z&*6=)p z5R`VX&C831S`Pz~w+WLZ^2JH~Ch^2NN~jlBe*^Up$pGG&KBk5=f(AromrHJ;Gn?A4 zWXV7C9aFnH3YP{7);Wu@b$kX*bo!>PzpVWXWfO^wrnZ z{+!0cv<8-Xi5QJYu2xcER>1ERzpUyolq6R7@Oq+AV2JYDqsm(5li_IpKi=K~s;(tl z8^zrT?hsryF2UX1-QC>+1PvM_xLa^{4G>&|26uM|5SSCSimj+9UK<`u=^NuM8nPTW7i?CeUw;^X#GuHj2uHJ>*Vcxa2%%V+OYwhGVs=DyaT!}yn?D^}3qd9DQ)c@W zSd;2Ju<8M1T5AlSt|N}D&}aHNY?X@WD3Het!onyV$|{j`)Fa+{Vi))*b<2Zhn`)CD z)dVXVWFc&HTzmtCCwSFP`jaTT+X3k{*g?OWM7|dUBd3%jGyDNbf_yje)>lzX=Wc#N zjUvDNoe*>>J~L^N04pB)3*wHlfh?&xEIMt5%O)f#v|Q^BVlI2u&;eMY2ekq+>g*Xf zZoQPGqyjxVzg!RB1Ji+|^19?#->{J7ZWv=HYAdXcoYrQqL^s~sP@kwbWSy>bbTs?O z>rwc(qI;P?oa1-7I$UyTaWRfINhf9f=1lyq~9<`{Qe@(3b#Tb*Wdaw!y z^3l4edBB!-t%7re0tZD?v^79M7YreVsi8q&Ib9XfEX`b$ZT-vq&+NWd=3)QBCnW6C z3F23eNDH^cfp}*!YxmX71_n9fSO@||b$}rg#3;ytmVq?cSp1_Hx1+euKq}UWmOx@} z^85MqcceXPvmRpzHl@;xu=}WDUoVDtl5N-v8^J-h1(9j<-Vd^QSlDW@B5(A=_o6HT zwxEt?@F*6B+$dNkGv69UcYr|Z4z6Iz$G8j0r&L$MeNCR=jO->9_~{EbsI@K(F7#nT z>2mn;Y7ivEJ4Y0BuQIJ@EhKvy9pj`B9@jI*BjDoyLaD93+1sI&F|oZ zg*RQf*GUxYXWdJ3TOEv0G2B){cT1E$oV3CifL>+$6LCpq{ftaALKQ3Hrc%3Hxsi5c zK5hh`zGutyvHc9DTyjnkkcvQPeIbX z1_we63^#;Fjj#`871B-ByTS4w%o;Y|nHPOt+U7|-lBax~N2t7gT%p2?iqzeLH_)at zVB)Vu*FxLrBMic#y=6wJ2|FHfek-F!CYA!Ok{~%{GgWe~kV_kdC$3>RU9O%dq!umS z;%&q&dC0=hms4{CKKZGKbE6$X&eDSzKp}QX>mmy%vR15*RlO4=-CL;;DQ3_WO9hKm zm#-OO;>hm$v8G?I^I?d$uHdUb(KjP$|8JVS%*k5gh``s-^ou zXBkc=3S%U32+>}aWCnNNnZcno69|oAFh4l3?;%gWXGCf}hi7E4*n*Drca$v~vtMPR zgWL=d90VWxcx`}Rl6^)OnTFX!v)Dqz0LoPbvnr>P*(D^!XCnKtEJkinkVzAf34>_> z@qIj|D(o0*{wOx>TW-Qkr;?vwhWXC<6w$YEluBqT zJ4&}0U^EmbErsw(Tm)3!4|r(YVCr6uNmFxvDKeY9Nn8iT3gEnZJbjH))$gn(a&{!0 zZZ$A$gI&5c@;qt9ZM4~1zY|B~8cfqtIy6i~#NChFd5U}&TB#KGi`p6t;q(`}P}xEI z*qJ$y|5X$>{%ca6Oy&5+0|+CY0L|Gb#?Y?sSMh?0L@hGB;!4V){KdV`2KIxfu)d zzcV)*)f#kK5<_dhpgl0VglG+=IbvB4w2@|~G*J|;KXz0=f`-YKjGPdFhfk`le870z zH2DUn@{#qpS%%7nx}>*Ls{(YL*5gEn>b(dn>&}Do2yW9Sb?wY+f=*pi%*Ut(h5uT#4=$uU0~GP z`VBu;DJ{}5*vS|u5>4ppn~lS_MH0L*4S0hJ`t?`Bv5jQS<^6{(3Ea4W8dAm;?D*HJ z)jToetYNh>KJvYWbfK0pv1}2RG<bDOcikr!JUOBGUe6}eu zBwkL8oW-zgp`F}AOqpYpw7`D75SnJyK%#Fq&=WE$5MuRuu_7tSP^J}-Cy80)L%2l^ zib#g>+SyVL{cwA;FFk4U_1Tn$_~}83UFE=BYNYy?S1eY2W<>8*RT2) zC@1M-**`T+7+ZcEPwd!Zp%64BAY-*0g-FqJ4B{OM=y(v7IHEYLZo6OEEsz{RrsgY8 zQpI~`52p^nioKemx(l>9OEp&VNwrFl&?yTVCO2E>0nEQOgj8X2LxS>T9){h`)K5%O zAJZjKpg!W-jcO(W&lGf`d$`flOttL1O?20@-J$*nX|_3fc;W7+kEYehh{{ScY=wP@ zxi(vGrxa}A|8{5@EUxdz6%NQs^}+JC^$sO#EvW9Bt@aPeZL$#g_EAqin`O-y0@E|F zGqdTCAV1sms#latwsX~fmeU;FuDHi=e_A>P>F1})0lQBqXe z-Z_2anf4CEqsK)=pii)vLKpt0Z5D_d1dJS5l>cg?(on9pP`^HfnwYZfST%Yz%&9p< zAFIlv;1y)1Awa8r_;API3Zdz1CBuc)u9GwhPopn^NwOzJl^$Qz><7>k^6~D?Ku*ID z%oAvs;*ajAQDs{`zCN|?yp8c`(ezMuiK`7W$7}fQMJQh@GYgD<4p?CK>yg667DB^& ztyJ1cBVH=f!ZR_25&bruOn@PDV~e&pEtqabwdaQ^Msvv1r;oTo?%zvHo$UivGw^0E zsJQ!bFEU4|MZ6(iGiZ^ODUo0D%@N*e!r@GXp5S!EBqSI5W3)z!84}~!wsC?A;g=G` zwn=<%;Hg4>ZPAwn?jq)s_vmo%V7Ynhiuib?P*2_<(acad=aqMCyi!?pYdp@TC%D;h z$~`5zJWX!npuD@o3@`Y~folC+=ly{7+df`VGB_!)YnO$zoF|9aOWuiw zycV`2pY<_X%*n^$PhRiTJh%ou!ZrO+;XqL6^D`#c73qv_T1EkBR*Z;6gysss9Y(gL zELu;yS@Lcz;7HBa!ZV>!qI>+)=Rk15QgPV`{8NSUPQDwxw*6eniVz%*re<3~>q?}7 z{U#4FaN~6hmD=!@-o}~N;hs>N8VZjmeN(L~`Oa1ap<}*6t8yyLbhg~pN6S5Vh)H=n zgh;1{y@PxfqNO^@5A>ZOG9MG;VYSviy;EMylYTr;E~(Y!MJhcC&oC~h6U6nn6qumv z_MGb!=VYzA@qOd`*`*@+osx2^o_qJ66QoJhv18_`33nqyWnNGL=2|uCscrGRBvb!8 z#-HnHKae^-Wn>Asmk5V^ah;UWmjr2o#=?1g*dAiIr+RNO0BxII7>uDIM4q;GrC=~D z{OrdLuxL=U{-kY?o2l{1i(p;Rf#4hfJG8z02=u|7R!i*a)&Wy(T)~O8VTg+bOZ6+Z zxTk&ZxFl2L6CTW7YDy1;f_W0PM4lppn$o_*3Kvd#NVuw^kI|e=NW!x<;Uc9-ps%v~BfEdGyr5pXT|u^XWpWwX zh*mP5(&7m&59x8L?x%X|mAcPOoqnDiU?H{@m!IM@>t7pOo64jUv_)2HiGiUDBvki6 zQZ(YeiD0qh2VtRvPU<{}7h%!~h{2x;f#1BsK^ z?2!wA2x&1a64Va6OrnDfd#f4k!_ZZoCt7bOB|f?4ynM8VRdPgL~hU>>@^+8 zaW49z@?uYk6zH1 zSj}ViajytMon|xz=#9?HtlrD0<@u~2S4EhC@6n!VNUXCm4Z8c$rg!eLL_X;4^1;-v zGv0i$9tW|?2&OD?13v?y$UP(fv7Enxb!)h@&8$4(i!NZw*RL*ByJt8QW>n(jM<}q4 zrG6$rAUV=1c)Tr2Y|aDgSZjJrO=Ccc(G!)wnE)n!A$S4Yd*zX_i@SR?NTnBy;qXpN z52+~zicU)kMDap$IRI=>`c~*B7+>K;7fxUmCurs#JS;U|?WA1-UTDV6XJ@D!HPxYr zDy9?u>5TgFq5(GP^p4HnqHuIB`r$PuWp+NowL`{;?#BuxFRFvpuP}!GTemt8v@ihs79+24t4$4kIqWGyXmpP~3erCHfw=wfkxKj8_sdT#EvtZL z)ecCX6+KBU5qcO=Vz`8Kh>_$lL|nuVivdb9$_5zauac?WerWwy(R|1EwYJ*yedL#KcvfpzQg01-@LGb)h^<8=5 z6E()9oNS)PMhux5pfQ%LrxFFMk`@cUI@#fs#*o0!{OeAf@W?`|(IE6}v#`}}YM|g!~m(}Hy(Q3Kh%!ozJIx1k9d&4+fSL?Y|Dmiv`(LD9ZD1HhalxJSn z39}J?6$>?#GFI0o9I-y=%9w!so}?%TeIc@$>ze}sM;B$zfL6KgNcFysRd{G;W=U}g zK@reax$>F9er&A6uYTw(1oa1d+LZfhTj@u$dNem>aU|F}A5KU4HsK@fQ$(D9iN?cF-o(`fy z9Ul%yCpwqTS}pwyKwl3h<@f zb}O|5!aFr{vO94E@E03f{<#a7<~DX84WbyOrE<%1 zSG>;61`JQh9hywe^UFuR6qm|oPbQGw?dkLiRw<*tH~8yV!;3iWuQgt4Zr$5xjsVxN zeSUzG5@1-*OzPp2pqphW)Y+QP)iqtlg!H{h$0pDlF+GBdL-XwnhM9BXclLGPSlvBB zmx^FqlSGS&EbVyw9_u49tXopATSW&dTH(0~z!go5d50oqwBF12<88y45WRC7x&I1C z7kK5YgEpJ!f~=}WN^lI7>n6Tn#ATN%4%b~&){Y;YACBc!ceSo@xn$)ud92=k{ejju z+gFE3^+q%Fhm$jEOkT~y!`x$ucn@vMYR)(g>Nh#H?|1KlF;|kYNlbe_{fIr3R)>cElJpc89m*y%eg=bhyru;p;x&b#!oZX=qF@h1_j;Kko)PDY;(EW9r?@KeSR zZNVP#-Yb`DdhqK<%o0vwb%u{&5cL0}P41 zYl(Vm#fmE(G&jhX`wSWuUF^FntNL+zXx7hJ%}e0c3Rmh0uE!Y4mJNavj}-6yYDz3s zwAHt9Y04%Ar#c<4k+viG-X_>8(FoDhsy#E#wFs+{0IL=`;#ngx)N=`xZy4I3g zV^O*-Uk74;m{@GUxTLHR$RZ)#i}Ga*8VW8bulM5@N{-rDR70j4DN{3jcO9U`i}d!O z)Ir9`(N`f)lT^GmNFpE-+~!q7QxmkX%zdt5H`6Dw(gtlhRSOaagT?LT3T0t9=W8<* z3l&7ocXAe~q{5*U=H<6ekJoG&)`UNx?|sXV`>JY64DSGl+I2$Su{W4btCVX`J+)c~ z=F^fcS=y!S*57B&mKY26$O{w#Ev*x_qcy|XZr#=VQ9B3tW$4qJH)Ya@i;l>O6ia8z}%w-lUrB$Qjv51mWpLGn@%|dY^E24y}(&6G=v{ zp~%scV-~y@2FDm^)tAV5dljxebz|=#{;W@#@aym^-giFV_fx@s`Y|h5q-Lf?UZhO= z8i}!1wMe(c?9DOyxF+ywPNU-m0X(CRwTl8VAX0o%DA6Xl5yB9#_sRrgw>~evPZ2P0<>?>6mJ;ZMgyCwO+pqk`F|6 zW@>xP`YE^4Clq6JCU{M4iKDcj!adm%Q?=GC$w_0H^)|!}?5I}4`X z9DfWc^^&bU3v{+=t40Mohsgf$onUfVU1Q7A;m1F!(;;-=B^bqo_sTWx)-v9CY98T?_bkDf^k)DFu`O=NEOdzMD|8fz(mHp+GardCgz~HK z4c@2rXl_sdpNH6|^|C=?8t7nRpM zhr;3Div4d;$;T0?!a)x+Cwt@4r52;~GWe2@k(wCFBUC!bkZd^FEOBZ%j4D;yzQLKy zUVmE)Pc_!75L8~U*L7p+VKYbQY*A{;5v*T2XeDlAZSH-XA(bB49ir=C)h5|R(KEUAHe}46KAiHo;97LJMqXZeWP<&gM=Y!q%BUEq0ip=xcU&odUHy((`c$`-8rC|{&%Kn^!n_67=}U|Fhr4rpCSBbe z=p(;Gahk_>sIUP_*Q)k`=^PO>#VazR1%R6B48P ze*du)ng;6gy}Iq`sg3ZDEmG{Gt0F<2!%>7ELf4C}$VZBRL4|%#O8_Ypk*qKD>UMqA zm{#fNSs)1}#N&t4wC)-I;}BLvPi7Zg>#TV&XB!4C6f_wOi%55j)c4K8T*8go9+X7l zK5t!|oQy*o0>6pyuep4B+8++J7x?yCIOT18pdsIK8Cq9>>HvA)mS8?HO-qm{{)SS% zXg+Q8{0(8qp&w?>QtS57>e&T9+0Cv+{r5j)L{y+K%Fr#<1HW zJIeAQZ58~CF$qNHZf*qYD5))4VVGQtLrb>gfDnBw9O&IS@)O3Ru{p@urvb~a`{!R+ zIk6E=M%q~}Inb2EgdWa2h95~^b41v~o2iHWR6Q949QMMMf7{;JE_|h5#sS|L790PO zHGIIU117a~`_A40%#90!^ebtVhI&M{Ua`}sO6gkRz@#jvQ(=>Ma}sAYx^QY^Ce2kq zK&9Zdt0cojDml~W#oT<*^>GsNmXD%)@Rb`y4L*LbZ~sq(A<+#4>pz6A1sP9hrSGC?IIb6K9n``?OlLhvqSVxS=jJ*D9I7cR z23duycTEP<8?#*x{8P)rP;plLDgIXT6U@rBxc)`*hm4EYfu(dmwSKbG6N{0>?rgd; zdlO8>Sa&ub*ENe5qEJL{wgINT+4x{f9tpyJ91r{g!nwO08+Y}pDaPD}hq{qHrcKi9 zhXZkD*^Dfrg&zOHksLy}ovFN;qm(AI3TjJ0sa={{iuiXnk4HEv%i$ii_wn?KY_|`$ z1m9HXrSnp?K6=*!UpsY+;yE>%I1+2ud%hl0h@K1*^-vRHNqRp^i63s+^PMoG#v@U5 z#qLY)7qtB#p?7YHQR#G<>!>l4sfa2=-!J(UU{O6Et>6v{EW=a@$Exvr1>W&ELI`L$ z95#uAZ|5i0`_rZL738n-1a-d+A63iobe_WWmZ2^HRnDb00d7|Lqc^XdBUA><`<7t# zJ%MqkjGbgynMubeIoEdAJwnclKj$Im<1BanQq(o9z8y5Bbq}YJOotSgchg; zuoT7VO%af?UNw5G(wSSVraT}8n`Ft*X7+~@lM)Va8|)~F&GGt>NL>LcR<#hC0~ayS zc=JLbYhK?2RK61*!hM8k6t$-v6G+uy-;4>~+dQ@J!lw?+2kqHUsbJm(FJ4Dk1nrt_ zwKQGC0u+R^RAJ^*qF+zzCoojFE2ywn#%A+iv?q&XXMTo36(we{WdEwN(bi;RS-emu zJCl%zsFg@S6GV^hH-ZxBpyUfVaJUFBP)k>}5KrQ*IqkLJy3}l{I2)Bfi-P=)XR|qK zQt8W#GdL3Q!XoZ>+$qM9+O^MaEi|-gAs{x91(>mM{9|EZtb2Sr2O=Y?BfL<`L&mA1)DPG&LGtLFq!Nb;2^yyBv(GRvn;4uwPpK_n%!hJWv}bc8DJ zj9dG;8VdP4&$!?`&Q`RwMKF_-AEQR#C|mdwSFe3qyY9)pk?>gdsZ5LHkrg`YX?4|E{W8rJdg;2?$dV?NcR4;ZqwmS*decKUy&9BKt|#CZ<8SAaS|-V z{(v-`RbW$HU83@A6-*U!+^>KrIFxN{?ZoKmj)J#@Ffk{aCy_anKJJPIlW>d9w@M34 zjkJRN2@?cVS#s#+f$g1pOVfRYNUet;4Kb%6QsZ~+LM{IKfp5q$p$vW3KFrIX6Ui#cPDa>YmEN-n34X)BoH73Pj+}X7+&rHpdleCp`1`x7 z@p*h{2GHU}9YUz@4(xIRi}MQA39a4xjO$}}b3%Fjn10JN%_J5uw%UgqePa=sGcBO? zH|JCrkov}PAH)YNU~p!Jfr*U6SD^}h_w@hw#l!sk_WytK^E}G=J3q|N-vc}g>c7CxpKbG(d|p-`{{uh2$7cTpe*Toj z-}w2n4gbIo%QIg8JMv-qU*P=m1;^jz!}8z5Gs~Z{_)9)7&m;eVpZ^}7S^pP2v;5hH zzuW82<^t*pp!y+x(Lc__0BK7TXJT!*XYnb)G5v9SS*QT_(g&2_m|q^O!o9S(5^%fo zmy|5OlIRixW#9_bIh=pjEq|8vM^VCtE`~Pt=D*AQLz&5%x)_=OV~AOQ<@Gn^^qk@k za49h{!7;tm5TL{b_fjo@5(nH%8~lyp+5aC=yl8>{jN)(4oc}$pn4j7GkIHz#`hQ08 zAJ_Z^FaJ>)FY^C`LdekB^x4V)l;niPHRWklENxAl>4ofVOkRwSh^e!&lcj@;y%RCe zm;o{M%h)|r0Iidyle3Gkg`pEM3o}5*@DDc=2Ma*m(!|9A__;YV8zV6bPzY>n&%*xw zdk%RCWqc0#o#y$@%)trA1`PdouIC(pDLMYS7~!~psOA9ToSmKH<^J2v4y-Z<2j|Ph z!ui~c&%WnWT&%3WQUXiz7o!GHb~SQ&9_&1;9Hzgz>r3n(fO;7W{iXvv z!|P9vx}}|kF`7An=#q|Agir zP<;m9uV#CWc_|SHhL=>p7|uW3K>rI|ep5eFyucPn^BndY&d=pM=kfcW5$@Ud0!|>m zf4@J6|E|L`NT07~|MUI1ll&3)XFY#&_B-8k{By~_^LWl1NDT~q`TYSg7GUT8pTGY@ zKxJqB2cW)Kw|@!L|2gdX6N~>oP+7PDj;{8=vmPzYEnMKZ*njzKOwC;2m{^zqMy@tC zraz9?wg9sib7JXc3bZKzGvGWMU=A<`p2iAf0AK;I z@N}>+wF6iJtN_*k8-R_evopZ0qiX8Oab-)d*HtVz~On${=&qI>lX_Sz-ri= z{ObEAMm7K^fHS}ucp$AEz}eCR@T*eJ4!}wQTmUW>PNu-SyFI`a;A&@L>f~%}?_>&a z1Gob`0G6v-EQ;tPT6+X= z#~5sQ@II(OcsCt1cS;6Fr^zEuhW#+-vBren=1m4cC%YBw)1~u1ya$2Fm4&;Zhn@7* z4aM&Fiadn&TbXBj2DfEwlSRb+i#SW1gdD!u9R3~f&<}jWC+j_78Pr=N;$z)-ee$^L zL&5DxN&4XPR92kPjTTdxXg}IpujT#jk5jBaRZD4lSZF--cslPeBx7f%-}EPh9R_T# z=P;oc#$knZDNfGqttERz1GmY8xb4xMwD_4E_JQcv?O$J&U z&z2|I#@I)$##eDM4f>Um8l*8hc*lsJeL(p-o?+Pf#a;X;YzeO(;59gDI;`H*D67x5 zSv6s8R`H|E{jK>|$rNsY>r+4neR`9{i39`Q_uoMSQYgu8shH8no3zrv~DdQD!O^aDE)Q6>t+ZOC7YZpOI zs~y-+vs;nWXK0CdDi{|#PD4n^NEWFVQCLB+h2cul=j9e}PnW77)CV}_=;f&?<`vCS z1BMdNl=!CcUP(t4^eONRMd6BtQSsGB)Wze<1uJD;#Pi%&sdl&AD&ItPLw0X>+rJrg zvO*uh?1A~5!!b2~X-pB1<3VoS6OX!p${|ijIDf$Nt$F0OQJq)c)-6YOt5Vi;lwFEv zh#5`~;P6SOu|*Gy;Z+DcppC?D6Uz;%H5k#fb}sD*E3fdwljX=Z6JQx`Idxet6iozk z!g9hqm#7bk2#@i4OXHq1%aLHSFghu^gV*pl2oXIW{jTS**E43<2wBif!!Lc&U}t_- zTT?$?tr<(N->ITYmZr1DU%9K6wfH@Y2=iI}B=>jpAqBD$s+wtiM%QM+fNWb$Pi!dx z*n>z$p9Vo&2{uM%4+-QwV&I0LT>P8(lvpP`%+7iCqN%#4fe<~!IAlDX_1beWI`xBd zy#joX7OURUZXVLS!aZMK8X;93 zsGTGXmi&|t=UQKm?0dqqd(EP!Q9%_Zj*BWKM`1c3Xqk_akMOnJrAblM@rGdq?AXo^ z`e}A;NyEECV#_Ei>Vs1Uk)sbRya5tjmyrgW*p1+fg$MDwZN>*s&MTUhFIwb=;$LJB zWh2kb4HjDD-|}3~&L^EQGkvB(Uz(gLar(go4yVY_Z=#qQ8Y}@S3llXEaWs) z2Zv&NC)em879{)1vOP3-zo)aJ)iMsU{2R86p5UoZ4Nk+_o@&WZ&W5-|-SR!%}P1V7O-ZXLjj6eDtN7o`_-U}T|aN6D!@)JNJ)anOvc zS7G>VhZIiSsao!zn#CPFntWQNmjcZ28yMgrwyw7n=QNa+zk3A`aa?!`k8+3lc5$q1 zKyld2tK=(znin<@mpf{)Se^Wod{Io4lZ6A*hSc5Je45YPB)&vo18c3_t0720s}O9K zPnnAlpPHr6GVD}z#AsB7mHENk&<`I*`TP|O*xfbL+D{oPSHkP^cNeV~QS9 zKzVJ?X06)sL+$c|6^EOr=xAt)X(}0KIpSx@3RY{tqr38qc-_T%SY1k>BHl)N&-dMD zKG;#0t*d_s;RXv07&M6kBLR^fs4IDWQzPR*->PPMX#_QCxjGlLY&7niRfD+mebfD` zm<=a|-GY8I6un4o9Hz)!kT=nX)c|ZF*Iw!{@W^ufx^ula3blE1I)62(lP5uoW9gZ) zQ6rP3T^B3}E=fqmw7C2nrWF!zWi?{6h?-n&uzA+A@vv;C5yq%9R=Mmi0oe*NI5-Lu z85rb`ReLg=n3}z6XM{}vhjkuUEIKCZ(F%P|4+Et1hAKi&ONO!v*7i(W=WY1+mH}WGc{za>G|z>XiBZ;eeNh_ zo8R@vr7*j=90>}lH)H1QKZ^UqjHvaDFyd#hFcY)ERLTIOmJ{i+)`BBb*6JO%R88Is zl7oGi#TfNW4QAHn%Enqo?M)2DGM3*>b&l%c(w0a24uP*kkezR?@%N0*-I=?RxC$

?FZqCZp_&_^X}KNfNf^~{#7uah9g6x`*UG0Y4^1ZZC!Cbev-rl za>&Ab3es5C@)l_@EIkyV3UVpuPsj_SZGI?p=3JcMn)6q^gBT&T2!+{Ey9XuqJE(U) z40-m4BSRqC;@qTu^Z&@RU<` z;DZOQNNApN4vu_ReW1`gI`$96e1%O7cHaQ%%7%Mp1|Z(U`z$R^Q4>jB$1WlwN?Hg; zU@AM#XdWTF+n2DmiXq^3ke3g&_Z@ruYOdEc9`MVyHCwAxMnTXOn5e<%kAgvRuc_q> zOx1TORdL6VDO^8)KCokeeN@MJ%&9o}I`}4ArF@VA^ht_)U~a^g^@5X}n%Y;JVeea# zIVl%#!-e|rdXI=j=Chep#M>f?Aem31-gW0!*JDMM z@DeF_;8(UEXPoXlK1?XI&KC{O>{xPaB-njF%=wC8UMpK96I3D{k$N#`%gnW$oRKwC zhqDAN)}#q>_D1I(Qs3DMrPIbPyg09^DGcRWAwXQWoDoAuAd<2(i0KQr&ZR3muWsQK zPE9NoTWymTSi+?`?R_=8o0g|RLWihtZt47_T8eH?1)6#M0h}U<@~p}X114XGQPfpT zSC`v$^+Sh;EjWvJW6W76DQ(d#IDrin0F z-6Z+U2k#6Ml&C;@?_U3IC0bgR0*oTr8|K{&sLZO${h4+J?lTk`02Il~P_Sza1342)n~KjK`bR>ppOMEkWsJ0_B9RGi{TV#|1;kFf~_$_KEj z42|PG9vCF(C00BW^Jz)y8agUUWaTn+vTWo{2_@ke5)rHiWfJ|Pnt>P2@o7$=4XFfy z$PuBsMGf*M@|M!fk)R`;!%lZo5$#XMCAAU|xw{=-5Ms)1FfWjUKS4lAXXBsd84`W& z{^l~PHjm<5@5OB19lD52yM3@(A z>$j!1k$>|Zg@&S5MbBikl)2^6^#eltR4Ld1eukU!i8LQoL_C>dNJCRks8f_Dnz4U1 z$Tkc8`A*eZQvtQU3}_7`>l90v|<0oN#FJf)fExZ5c-tR z!ZlbT`JczY1M_UMOyHNb4e6VtlARW3j3{#uiM;x9%Pvi#-ca)~(StJGo2aiL8l+X| zG}I3T(h`J-TYlrNarK$+EwikfxjsF@iOq2PnwMZZK^tmeap)Y6cVhmQ?b2U~FJhZ)f>+p<=|+xeCwKMWf-gxw)49Qj7t5 znaM?GbHO3PfpEc@&WO3nWe52kcI=)Xn){G!mA#20j9dSd10z%7)ETSM{D9wgEC^qd zvDH34G+_w%?ut!yM--&9PM#41FYdEWtlSDv@Jfl$6SR=zY4G>joh${Hn)#Ilv{(eJ^Js;UQ9dXv8tT^_JazJT`V1I1&3ZEiDsTKrU2 zzw2`e3qCTEcB9MWyXJ70P_k4%@($W|E;DuQW1jH-9V;(5)Cqb+PRr7D@Fv%>~pnrwZ+Z{LVDg-LI%n0(!wsH^%kq^^a{i4?6< z=V_+lnJ-FHoHSE%|7zF>Ja8QJl|o({;a8Yw`zf&=$jIeeVtk$T<^D&0zNL9yYW23> zrtu;gfzjM=J1rIFw*w~V@PPJJkNo=sjp3MCI6X{dyKMus>GNcllOZa|$bp z%9;g9({F=@4eqT1S3SjXyl$$#&qZLd5g>(>^d8)52tBYtK{o{jP#{QV!-Qa8`!P%);eKY>GQQC% z4Mt=s_?C@sa*wx^^CS56@e&|}y-i&1huJH$SPZZ1J^u3XThULSJ_X*h7(H!*$s(}9 zz%Vp?k@~zmJ46%PLfnq#EnK*mpk?jpY%Hy;iuFcRVci$Qo|B=e3=6?#`?I;C;b-c~s;at@&hTV&0$+PORY*|^sg1a9 z7IoavT^jM&I@e z9?8>DccV(a*4bdwo9O)R{mUFB1%SFtUOciGX*-YXC33{Mn zM0QnmQ&YHvQ%VKjg^ZK98S*^MlHVPi4$%$IoRdmG;j;EZf`MqEsJgt{3ZJVI>Li05 zd}%n7y(6~G(c;iNbS-3f{{4f0b8T@|eubrlU72Da^_ zJf$6pbaGM=3izuw{IlDP3t98j-g@x}?g@+yf3^A9THp0`-xYB(`K!8mSNHb>7kIB$ zNsv|cs>*x7=||*gr}#}c;SnphFTK?_V`U-)kXPiuSK(de7K=p{5XtVn4ORG9405h$ zrzWwuAiCv{yPU&tuG2h;-ehYYz;Kc3IlOLtQz(#BIXo;hPsOX7k{GhuY2V~%eU8NC zGi{)R8wf>$o17cU%(-Be(;n^whve@xu4r?OFDF`_{l#N_(G$*4CzE|YXiF;+5CkU` z>$N|yg%UHNeM&~uMfd@68aKr*T>k}|Ct0bAnaPQf+)H8d$Q})k4_mEC=FCto0W%hG zz&hxw5z6o0{hC75UJi#jOd+tijHMAo6vYP? z_T1CSmVaKD9Ose9VK3OX9i3{<8RRXP@SN}NFH~gTltcGS%zmL;99P>y$7>5j&BWoc z;!e?hO0r#;t(G;{+Ba*_2X*vHRI|8uyJy-nbTX`~ z4Zcp>Nznk1V1a?ogZZ@}%8l9GmQ7fXo_2SC_a!BTdAjRvmL!JmkH*+Ab`OOE_|T7hKbXPA!$SwT)lTQ{derrX2XIz=x}5Bn6#^ z9p0ly7C2%Z`7@jm!>^V5`67E25M-VWM?M8x)AP{*8GOXB}G@BZ@GEadIXD^2p z;k&FaH^HAekTT6n^4f<(qkaeo{ zjmftjabBAWJsRb(JAW*rp#GC$7^G=wvkf|9D$ZAV@E z<$bT}u*66WCY0xA-xGPQULB_T2FFe&36(p#@`*R7kBNDJec6~Uo+Oa`T+>A0A31yq zkI~-g5_Ii<%o_Ru-OLM$jL50-DhichBh!(@=B>MxCDnIP-|&IZM{m-koSBhCbm*_{ zS#~G96qvsI%G0PmZcBjZK_?zeH57POs8iB{JzXB6`!(>YS6>6ppdS<3SEZ->6GQN) zZA3`hFrxz$Utj93$?$wZONJ+{!IDd+p~^CE%m)@Vn%_pq}KdhdQa0CI%|N z@?KW4GknD`UA!xKeeqC!Xe>>fkx(h?BUhXN0e|* z(bW^MTBf2*>8Q_678K2;0nP{2x8JKFhxfUp@y_xC0)MxPHDR4xW*$k;MgF@q8JSGF{&`hg2TKYFGUjUQu~QX zSy|M_M-$H|sDq%|LIo;tEc@eD{yuAukr+FLiyOP<0>G9h#Iw|$R#>>l-=D_*ammkn zi=3 zCq+2*Ct#Rc1blf^KTdk!J`7}E5%)`_jH~RU8lIWXH6}eFf?J^VvTyer)O)=Uc}*D% zEgn+R?)uXjlekab;#FcI-RK1F68^cd{QHBjN;u!*+GVS<$r9&F%@!F)wN$+bW<{y6 z5}sYaV?Z$AR{Y!rbNYHwgTPVNVNgKrfMBFUq9fG!f`#!kZi%Q%%D{v7|7qBE`b2SIk>yKySpFUHCTeXy95vJ7Az3lgS$&0xbseC=KgnPGWY%WRlQvlwRi8; zYqhNII<>!E--_*}lAZ3~BpeZpE}#tl>On zAv>uHF8}cDbukbMMcBSEBHa^PIDX5BnB@HUXrA7(4)}R-kPp6Y!Wag&leAL?s-TO) zI~UbslvD?iwv+Ew51GQrdE|V3YT}GXAEByl=mEOo6jR;qR2s|fiAVZ;2nOT>0ZI0j z*m1aY>F5~%lGds><@}?&bX;z?L?dQ1v+&PQzB&>YiDPVJxM!) z=9LM(%vn5Ab-kli{#4dJfWzr*1X^_2?bX>jZ{(gcGo0DZyHr;ztpsEwza=A&wY$si z8l8QUNdXPNNKaT)s*unRLGR*wipo>Xg^n7cKO&aEHc%f54`W0Wy(PY*xfUhnt|l9a zp$m6T^{@v&8T9Q2J|cS1BVJ6jH0tK!l6o#zHu+fTt7aGimYv(by*T?5WJlm4KQT3M z^)$zK7m`L)Oj!&q3^n6Q+(~t-OOvaY5SA8a@7VkABAhU}V!?fZ>uMcITNp#NMSgnU z;>K%vv|C-BHW_bvAAzgm%khTu@WT4agb zC$PGdaGuMwIcG-P--day7 zn8b2?4Y3gz zE>z!iQUZR#AGLL07bSKvO zpi0Lm5Y=M6oJmc%JnNm z4l4XJME=|3zajFUFaHBX4tn!nLgYUIa_RpFk!yfJ@;^c3Kk;#={|tive$a&RKVjkj z1b_bmd;c5p{;$C9e;;-E(-D|Ipl>^?-!b_=f#ClDfBz5W{VVGI+cDBVq27NwH2VL7 zdNXtV8TIz`)Kt-Edj1gSET5&_ZAr#nQ#sc-re3aoq&R6UCKfA&31ybO_X<5;5M9y@ zT^Jn>3hsgz^&RIN_+H-JLZdRz;#^fy7;31URM-h?G%P znQRZSEOq`gyf@6U-XXZ-8x_mnZM=tN(sc_Z)C`Qg zcwq8Vd8f0vTS)(vT1Ta+$TyR?U5^m-Q`8}Bdtz)t&xm-VjhvUfBmY{|d*HV3zO&1G zRmTq4g^_DuIN#+k8Au^hH0-ph*SXoTK&ye)chtvV%=QCjLull+8-_Ey!lqnLM5@H` z>-G;#@Fbf=Jt?UQw`e5jh;aVK7&Wo;GR0a}bC8O(nFzaLA)Y~*M z=Bmlk6l%seMdNv&)F*F@wIMx1X1Pg`pPecw`(_Tkrq7ftT2n&ywLT>~x(d97vA~9K z;j3vlVn9}^kOLh5Yf`s$-#1?{^7{1TA30MTg|_US_*#kw7>Nu{Sy!p&4sy0BYh%*I z?i8sk!x{Xoo@8*SZsj=nyEkw(G7xvnuv*Y>zt_{m#c6Vmv=JHfhbR)9TAd-J4g>+8J zkJ%g9g2Uyn6Wq+$fhg2lh#;^)>zqMxzE zrrQ=mU>C$^AmxTYejY(F7AcnIRK8(!4R?97DN-3);2)gd&rHjqahU4 zlMJ)m>`p3s49cIdQQNj|v5w^WA#t}k`bU~RNc4my4z1HhtKLdOqYv5EA4Y(!7$$wk zdd*jKp=f%yH)%qPj~AA*#ea^1Y8LTzdQllm5?t8~1RpvH3;Th-K*S`V2GM|*RO@J8 zA$xT~W}&HQTnrVx2$Bs74c}Q(pX*Y6@nw!` zo}YnFO;<}(MXHUryt3AvFdH7^DWU|yB}u{FlTGc#hJq`vi}bQHWlB*O02m&{MBJ(9 zS!nTf$P?aXbJ%Fdc&HSKoits!vTId)ZM;FcTWVcqEZy2&>v!Dvr^&T}T63SR9#N8g z213Ml!B9svxk=zBE2u7VSzMm)P~X0L>=($l%CGQPow&Q(R}+P?UvYR_@sUan)1T&o z@;36>YJH0SwSHAa&Ru0#P~c~x*SH4y?6R)X*i6yMrA@ME%M-#_}?>!_Bqo6J; zj$B9M@jy3=>%hGj+`!Gy;BuynOm2Sgd1L9wB7gc_obrAazi5mHDHn%KT2?w5MGQEA zG>>ToZ6(nSTDN#3Si#=kwUo;`!vO&jpryMXGRH8+*sHrMaSP6vjpRYk1mBTYfHBAs z$<4R_@pV8%$!oisb`Lf^NV_w>l!|W^j&Xn=TgmefJ69_G}?iP+dHn}hwo|f5It$aR(Ue&Ulvk##V z<>Fdz>SgTGjRn8W594c3(~t#isc_sy_~o*~RLwY~X~3+Gp^sp*3x3mP2@)NYwDO&` zc83lfp?Wcq`pT3Lrt%TfhN5Ef-=r3$xS_{zF-qe7yU9`qd zKfG^UM)(Gs0t?KRv|pKhE!>xM%WQ>Qf^*6K4K>pyTw9wy6CxuCL`OrPnSl$y{t|XW zS@>1BQi*)IgPEOKK3}nPLH7JoyCC@)DvMHsoru%Fy?j@-oT>aR8-Rre3$CZ|Dn+dN z0q;teKl-XS8evQzY-7RblL@!2TPy*>Hv0-ae(2}AL7Wsyogd&j>E^Ikn+RJ%2S6O` zRgP(t8M=?(%Mp|Aqgc;{Eb_*?TA9_?Yu?iB!{Y5Bj9G{{48K~f!Qe%1`IcL|A3b$u zQ7!RGU0Z#p z{`|MS`tYG|*(LjLxwXh}MTpADV)4zzj)H@9?P8NGPpi`izGE*D<2m|K_04GbC){|o z7@HAiun zm7WCYy#8jUm!l+##suYA36Cvw*{2c>6U@1$14BN@{WgjNVMIeKSU$2AMUrgWK5?8{TYgmU5D?Z9@dL@VRaZj zt2rqXWI{tdEW!rk<9V;R3bY?ITgVT^>fuU)9U<voPw5S?0NkLPry3LSE`(QxK@z5vy2kr)!o2<+Y7q6)ig4o~%FKtF z3hH)lDwd0ZkGV-oA9CB z>Sd+btPp1fVYbg_3UQ;fv*VJoO}1pp>mnNNHqF(jlX<)yg%XHQSAk_qa+7Nnx8cCoW>n4n?!3lw;8V9A=%19L!omFoE-Tl%_kzc*a zz`_j7K4C8ZcEB!=4A#3zgU4?{LRqRh-UE3g=p7)BAxWCv~rcb zQqj{~anWuFS1EgV#1p5smhpgL46=elr(sNN_&0IUK$(dn*&&#hDJD|rG-@6Sz*He? z4N{#Y`|bsjv$!8+ZbJWNVaaY`Cjq3z`Z5dIF&Q>y6DHOiE;QW?5Fj6wx%i;F>)ITQ zQ_aP@fH4uVA`munYGLm;sZ@bPkBL>Ny*WgoCa9=!P{QAKw?EY3cd+rA>?QX$<}*J2 z4`POQ%jA4TqeMOT))FGqo?b&a2?k(^)8mP#&JunWN0@^7eM*o+rbzOZRjH56O_D~R zAFoh~eCcIs)B6hvO_&X|OP`|5ca@m@FH2P5;VVbvij`gf>z{n{oHEYqr0Y#o?VHVL zJMDUsF2UqRMkrA(h+THfwk_xqzwYh9$HoS$jV#H#UD76nQF10FB#%oUry#Ln#t#DS z8xs=KM&98LPmRFHKbfRPTj}u+4o{T|G1#{q=Yyj;L)+YSj!5>i&!uZ!QW`?L6szHp z3ComBBnOktT_{FWclZ;@wbcD5@j-E#k)#ostC5$vs{6gP@JoJK#__QaywN8V}MvTc0sELYQaiyzflAnqAC4_}Fs z;G6rV*n)(wb<05A4!b`d>yr+iiX6T_BZIf4xlO?%=9dP+vY=kNfN~G;Bh)@S*z9#d zljW932DON5bY#YOE{&upDf$|s2U_1if%z0P{1(PH-N+RmW zb=Rvk-wXSUe&aFj8TU|3%d-o~?ehqRJGlRzzoW_XwID`dn2$_4&@KKAH3bD38B;Ip zF>K(@#;6~p(m2@myN%G|u$ZY8-+}Tmu=^Gf?+$1f4hO&9kDKUAVvHslj;oV1YHAgc zv^dF>i-~6Q*-0rH?ohKQPB(IJvX~SwyTM0u6XgY6qTi%WV2XO8vL3@vW~>YH;g*Xw zTscF$>?dfv*FVUQRrN9@xXz|ppKfc`T``uZCUxjv5ysinh}Nmz1JsJ?r)LAh))RU< zLBGa`aJtzXH0P2gJgWUYdxepbn9;wxY|UnjUQJw0b#k40+>+DiedH*F8`xhbY}Z9B zXq7|G49x)He7=w=AB=C?zq_j9$Kp+omSX!E8@0m^ALd8dN30wPS4n(8Pne$C32)aG z(k{~ugl27!bma6+02*V$75ILKee$^xTG>$P`LtV$Jps*da1}< z?Ik0TEn)+fl{>JiyS8WugryQJ_^3T6Og_6WtDkWgc>gB1%Vrc|t>gKXllJbyyn$WA z4IxI_I>zc<=yl*Ox0G$^1ey{i9Lkjb53~pOVBM!QB5CoDPsovREBkuHWKlNvYcE^k zjuH!k<5@O(Yg=+f8-BcQqur@SN-VI@9V_+sk8Vcp4l?%^UnOqNfE9rWK^snrP~k#( z*$kwU?&Lx3{7j_wF zvz|fr*6sO|VJHt*Z!Z&Kucc{r5RSDhW2BA9>*@ehJ!^#=FoA&1im|>g6RSzC5lpi9 z{o7fYJukxAjZQ)M!7#H^pQ4hU~5TP#UoX;3FpbB5_5q@ z7o!%2V$Lm7s@8AgDB6P)6K|W#W+ zovanM{pvlGvzlynJPNOYc2O@{p;I?|qaqZ}oi zER%7D_b5A73@uXh?2^_yeA6I~F5)o{tc&O*LMha&l2y%BhbuJ2RG8nCPOeZ}+om8@%^dBjo+WtbppAi$}mJ01I^WOGciCG~trlkou&o9Kz{>TpD_m zDb5&gT|ZVDS`nH##4L%oKV9HiXfM|2L@|6Kq3=;4hLy<}*1UVbG%Ww|C@5;a*%cv| z2il@Q?+(Ar+kBZuw}`wKu6Pgo*V4@bagQEqmt@*$Q4%r*9-2Zx_lS{ z&w;%v=HXavF>DJ=*9cPx!D>H5nIv%9MCY6G+a)S|xk8s!=7nfoFIgQ4N(~2bw`wbx zh_5UyJJPREnbqLWHCcg)!x9%8H%jhKWdV9%G}0CHFc@#AaE=_qQ2?%ls5ZXCx%Msr zKq@12mihbYl6~ApIdYVCibs{q0g;KUC$kux_~XJH{yNETBE4=1xO5@r&UUT_T0FTA z6kn_(56L;w5+U3a=!FC65zg{c#V?aLR7R-8?2k~*D!&_=*W|l zAw({ShH%hSgss)~O$M9xK%*}$gI>T_aOkz_cEzX4G(j<(${W4eGK<+cGILrikfJ34 zQ(k6YuMOuOrcXRUpCbE{!F8$<(w(3s!43|g%y`qo{np9(AC=UyEhcvnYiVauM(WvS zLy8xeRo|C7xAq)2vQ?Jf)hY3$_sS|K?Ij12@g^i;W{wOrS@zFJMe!9lzrG~4GofvG zuLYSB^U1L`AtrA{7rx~TW1y7mh$`gRoaRh|Z`-LeK$ju2AL@s3LVW&~bpn3Ik#%}H z#*wiYT-1xe+6L?_R$7+`(Kh!M)y@iwZsRjX$Crot%2SAD!JNo_1SAEiD9qMvF|`jo zqvjo*g8S%3Ob3Chv&y++AEHq&P%vBps2&XP{;*YcK4_1Ci-S|bTP2R0wbaq}qe=;e z%~UF~R!H)A6|#czKD}KC_S~;v0pJt1?IpJkgs1|X%*F4Vj{!Kuy(3MIKwIT`zos3u z3otMET&t{8AC@MLT!t&v`pU$vT_+!jo~-So@V0fl+k#uAr~XhGIie<*nzwqv@ZUIP zS!CDs2xfr=`l2D=F)ezQET>~XJ}!<0j(6I>V0}&j%f!CET-k^<`JmQGe=hsH_x%bD znZUXc+YSu)?pvKY)v@e68b+fP2d%4#&`czULQbUyB)z06)lh-jrY^kV#HR9xg4$&z ztyqicM7X*|HND&nc9q@sq0Ga}R!bo}*|c`Ti6n~aGHxrSSS^6m}9T7XH0=_9*S65I1o^lRwSiIBd6?1*f&?KMBvD|y7~kg zl5fp@Es8qoTgSWnR_<3mc=w9cybfo&!uLW5`aHKk<_aengnHI&Da}Vy7TScAK#X23+ zfo@maevzbp20zN%e<9bXo<^mCsEchHQIt-ofvkvMM7d~YpyZ<~6o2GbEx`4xcnrRi zx9o1kf&R=%*>%}obI>`gb+{QZGL?ptLn}S?{^-RF z9^_mvC{(quW-Gd>(GNfy)phymh-(`}BFm~$dmAa&;8IoYEbWrX!vK^Cu0seJ8{daC zhU-Udb&gHlfzmrX?3a-c^T$i#SDAR&ol78tCMP_fuqGusxP#;=QQsxxR#g=Ep2^}A zf@jM1u2Y<`v5KUo3=(j^qv}$`#Ao&H56|`Q5n(!qBfQaM{kTY8wZ2UT;F3*6AvoFQ zCZ(PtGC|BX5!6ZHG{S29mimKL%PL7c;_Q97Ys%nU-R!*k6aEc1^Vz2->IL!IyzhWn zch0ki0bNSs&Y@xEkQ4Qi>jS8_VZk4}@#eZ8 zvFW>arh$NZ0m|+J;@DYTSYA`LYcS#l`KqU4W#w3B=F|>!;gFG(^Z z=(h2Nwe{~iXEJVx=dOq`h)ybrpuTmNjs)KB*3;CS1VAo*C6KV;Q5b)mdKw{nA(e7z zW@6V*Pi!2{9zJbxF5F?xt-2zaCuWF}l*a7elp&!I;5czu#oC4BB_r{y{?6a%D2p_* zJ!<9#8@GSIZ(n>;ja-?ho4pcd6Dn1Ig@9TrS@KSx?gcW@m3fcYiPSj(u?diKkxQZ# zie_E!;yXOfE;C&>TiP5VBGo4(orPT>N~^eMLr=d_R?#ag8IrXKzdL#1Zl{@%ZS^S} zOZ;1*wh9;#V**tO%9}NB7Z3%P)MOla(%xr22N~Y#8&SnB3$}DcE;rnz&yghS^?ZSM zYmRv1amXImO5d^l_ru=162FJCq}0@ZvCr|>m^j#$@!<5^`Jtc)=b6DT!3bScF1#Xk z<-kvf3g28GE&jSB(_zkW&vzOy-u-AH7iFQ^Ufzj+BX}858wRSNIa3`p7m1! zVeU&!l!P9WB(N}k?W@4EAG1TN7X!fzH!*8_^aMyGU=|16@|a!3|6; z_$?JUNSVP;@G+EbcvNy;sRCBaLXWUK_kD}MLft<@-v1k<`#+Hd{0?;kSbqx#2XUY< zfnwr0S^kA}gQC3u6%NkH@@K3Y6gQ8+_;0M63H0>OST~5h=O3_c%|D{bSy`F?6dV3C zE?nx52yk@}ux~NDg9|CNnIlCu_%M@OzrTcLWFt@P#}hVsr#dQK3_= zM&{p5!!u>Ue^fvg;Jf*vdu!lqI7;_6O-|N~Y0h2&iD9wH;$@RUCfS~jCK=wj&UwgK zz4P+?FqKtnghauZ-7I<69OnyNAI|2;yL@9Ib0aO?Po#3H_;tmSvD&y74=*o1M=vlB zFUSh7`YuAm2qHM(WrjtU`r=is(&_ZFZsg-!hS;epKDwe&bM*j&5IpVW|MDz z*!$2S3Q-dy`9}ZEHHK85P9L~2xnu0SC?Od;1`tE%ePtiJF%}5&m1`G1eq;QhL6q<{ zsrf6G4_bX*?}X_3*eE`t@AQpFzWL&=!dx85yp;;6;;w)!3Mi1TUN!HwMB|DWp#aL! zX0Tt2o+mI0+&y3NO-oo5j&pKd2w2>kujaT~T`w#cjAp0yX4QF&DetFC>0Cjkp{2Xp zGaTd9`Sa)aX37Unb3Qa$)*}cWMs)_P>8Y&BMSZS+>lRTwr>Ai@^JCKlkH_sxp4#{i zfp;P57WwL?T9xb6`Qr<;vVst@ZV4;0wa&@8IR#%dAsx(ezh5@U7~~LeqYRb>sDA|P z;31TlURq-=6|4f)jG?Vf*3g2?_zG_*nFZ=oy)jv#zP;)PHl^8(OE*M19){Oe19Y) zKLnAeP)Xct%Y!@Z_918qJc)2@(PR!~zRzRf8raBt3mDFwNP8oQS}$Ki#g+Pf6!OiG z2>d=1jo2`0AYAkD-njhJeL%cMXFHAl8O{3Z-Dm(OD!(W8Sn~y!tJ|5=h1wY#XHyj+ z+V(cO^?tEDU|$P0wf7P+(@P?YJRb&ucw(EBh5(cXRC12i{V=+OmD)`iT%|l8b@<6O zX=5pFNj0c-Q5jXT`4vN0Rqw2OJS@ANK;nxv@9cR&@0J7jXXk}X_0Fu2WKb?aIL0M) z6^QEq`VbpsV-ovmmwxU9(KLhQyde?k;A&S8y;~j{MpWdzR7O-P4*JNx} zmY-h*pfMHNGZKwhErLJ8OeCuIE!UdeeEJ484srgTbzXDhL$E-u`4sP~yqp-O^+?aX zjf{;|maVK_IXk0uNc#why_APhG{MHuvL&6O1~Ie#p-predI~=MxKBg7`T-E-7xWFQ z*U6z&F`t~qjz%X@6zA5@+5*rZ3%}&W26~(p0Iv$Oj+}TQS=nlr^swurz zCp~t96?z3igK*=ZzueQNbNmeWkT(o4`FqW3SC0H zCr2cr^zZG>S?}@x(H4qd6@X#tEtQZfTZB#9o^B1@CAY# zP{O>l4H6{EKSZRfuq_3p?a9((=5~7xnuQ{f>SoQEE^6i?HG!7?llpr#2CexGcdUp^ z;uY42)fNO7qu99(R(3HVW@n1Q`sy4UJ~)&s>EqvvS=KS-m6ZHC)vI86gT5Yta*bR; zp2-cVeRtr76vyEhvuvPx|l>z%)Ng6ka(+>0S+hCSbtXX zv1Lzlv=_kdMYOu@vUn&hgrb=doIPI~XnKQ_vO9!`V;Ye@jzseEKllVb@B7lxev9y85{EtmcyU0hTI$=ScwUI z&zi%pE{}y^MxWln7t4<9>DGEy2tr-5SJsS}*W#VrZs!-1EacNonl(X_JHY!OcS38d za&p$YUOcn1nqj;UF7E)phY^er+sAiKJSJxckw*nX)mjYAuYE;$D!*O*K1DQ4b zORsW#O=b>$JY!gNo3l?&^D4WYfqdJve zQA-x3O*e%tGFQc0c3}xd9X~8a(NH@_J0FPMD-tWD7gU!Hd?!?^Hc$Fi<*gV( z7eoH;H%niy<&eu`4t*j2B*FOdM{7piVyMCpvpStXXxwA1kD^%%pBl?-V+a=HR2m}Z zycOLO;QgPI5~_JbTwcX`J3WAqtSdv0L~E;)((mA=zC}VNjcN2=LnVzHD6vIqWhSF> z=^q2P$2c#^!i5kgWn|XmZq1K{k8U64r#-7?r;Zo_>kl|-IlZWyaouI>cs$pf*sYK6 zk@iKfu(DsRv%Pb>65LP}3TuUq6)A4>K2%LI{vb`y)_kdtyu-{T_gVU|figr9V}Epu zDn^oalXji@mWbnhv;*Oha5XK>9tQlSg?7qcGuEFl!htZskS8JL{? zV3pGQak8dRBed`9es+zXZE=Yb2K9Fpf=H@v$b1=-oUvOAaqb6@{U& zZ}Lqq4pCE-3yHb5@t8(hB5NV5I(xU4MD5*H4Qf(C?7QgN_jKA_WW^OVd#54}i?ale zyUAN@qg^;HInOa(;!7!tUPEte63B0k4=Cgbf7wJ&l~m97t2UqS|`FbUo7CS|?_+s`paIB5ymA zpX-UFk8t-xV)p63rRljK?Sb3O7P#i8wg; zV1SOU`ks^w%ojTx$tP7qw zyk}Q~79`64D8n5&t>0x2fxD)ft7VhCD8tX^hWkNho@F~3>3|8rYfKI^+qHTkdflw=bixiq(Okkf-%cRn2$s7a)YDx81>_t25BrRU}4CojLPUf4>J6KtKr#UZ|i?Di} z%o>(6*vHTaG~h+$sGG658#T1jJ>k1~pFT1&8hHsFw+XD%~`JJ~~-$ zMThawv@P*ymnppSJI_Ggn^5uDR;<34CH8Ka1YTP^yqZjviSqY2vp??kA_S|<+t=*+ zirgyLQrG@?%QUj>XBk>I;en~!CoFML#kIPKV8BEAGMRC;yGbNv89lP@fLQt!iB-^_ zzz8WCkoT&Vvxhf9s5oIbiMwJ9CTQH?JHlNVwL(KL-cDpE>OjTVUXij*DAu=aJ@3!q z9H=nm%WwFC*`2Z4WJ3gn%|qT)LatQ0OWYdY(-muy(F|6hHL=cp<7i4`!&bN!of8u{ zOqKP&IPK*!7_+DJjvxv zu4bh}{#uUd_w>0t96eU}lfwJ8YWC}`Q%8PRm|JuU2AZfc^Si^K9W+9)GPPBwDD99q;9G0gRY&sc}YHaX_)~WYsO5yaOR&zu0LgrroZ->547RceSM? zb}p<&F}bpVyZS-h#$^2uA>=%BrtwA{=yOEUS~w_LJeZTk#}f1& zC-IPB$v{MohA;W`8N6dHj*+#)6!(1$wDGQ20>-Sv`wrPgY-DbJ4G}?ye1$DvmBfmKV=R z*0yIy*bza!t3?~OP>@D$G(y7a{jPn1`vM=B4K}KaIt;_Z4{5pZeWQYD^@v@+A8$u0 zjV7lpG3^nED&5b{8utJu1!LnOT~WPknm+eb>?T9nBj$DeZ&LOf+}cW1EmVy>w0VV^ zc#io(S7uJmI7L1W9AUHXNWBp^qkb{;Tg+>kO#H%=gd>E!pyx)%VSmAX`H1lRcBG#B z#;QM=ErDm9g;NmLA;68G#>_@qV>_2CbuOQS9>EozOKUPojf#6bX4(7Hn2MCv$16lT zAX`#mTrpHQLfSVrbNg8)&Uw!sNuPi_N{wi%LdI8eI0_q;80@;mc0DS(NA ziJ1XF#rQ|Z{ug_o!TjfDgJ$55cJqQ{xaB~^!sec$AUZ~VW+rA6d008>O1iI(}W?by%TmTL(CU&m>b{bUxtys9BZy@4r%7kf zQ~*E?F*V^f2RhjqxqzJB!2v`$YvckN7DkXqQ1SDEUb6~CJOZ_=i}kDaX*|L-@y)noj(u74QW--u()v|Rodi9g);?LRp};HWA3soCuD_Q704%?bDJbjA zulhKCCerf`!{_OUSiee9W8S%2mN z`AdI6kp-N89|L9%u3y^6!o&uG+WuOXg_HGXl8wLUV`T^B5c*pgGbcOXm$rc1`4>Os z;^g?d4K^nBKhK+slM#qQ*a?*7hLlmo%F7J2&PhSZhk&3YLZD4anUqn=-W*5@avV@{ z5Jo9cQXO6)F%B^Rvnaa=r <= >= + Selects records in which column[:key] equals, does + not equal, is less than, is greater than, is less + than or equal to, or is greater than or equal to + value, respectively. + + Consider column[:key] and value as sets of eleā€ + ments. Identical sets are considered equal. Otherā€ + wise, if the sets have different numbers of eleā€ + ments, then the set with more elements is considā€ + ered to be larger. Otherwise, consider a element + from each set pairwise, in increasing order within + each set. The first pair that differs determines + the result. (For a column that contains key-value + pairs, first all the keys are compared, and values + are considered only if the two sets contain idenā€ + tical keys.) + + {=} {!=} + Test for set equality or inequality, respectively. + + {<=} Selects records in which column[:key] is a subset + of value. For example, flood-vlans{<=}1,2 selects + records in which the flood-vlans column is the + empty set or contains 1 or 2 or both. + + {<} Selects records in which column[:key] is a proper + subset of value. For example, flood-vlans{<}1,2 + selects records in which the flood-vlans column is + the empty set or contains 1 or 2 but not both. + + {>=} {>} + Same as {<=} and {<}, respectively, except that + the relationship is reversed. For example, + flood-vlans{>=}1,2 selects records in which the + flood-vlans column contains both 1 and 2. + + The following operators are available only in Open + vSwitch 2.16 and later: + + {in} Selects records in which every element in colā€ + umn[:key] is also in value. (This is the same as + {<=}.) + + {not-in} + Selects records in which every element in colā€ + umn[:key] is not in value. + + For arithmetic operators (= != < > <= >=), when key is + specified but a particular recordā€™s column does not conā€ + tain key, the record is always omitted from the results. + Thus, the condition other-config:mtu!=1500 matches + records that have a mtu key whose value is not 1500, but + not those that lack an mtu key. + + For the set operators, when key is specified but a parā€ + ticular recordā€™s column does not contain key, the comparā€ + ison is done against an empty set. Thus, the condition + other-config:mtu{!=}1500 matches records that have a mtu + key whose value is not 1500 and those that lack an mtu + key. + + Donā€™t forget to escape < or > from interpretation by the + shell. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise all columns are + listed, in alphabetical order by column name. + + The UUIDs shown for rows created in the same ovs-vsctl + invocation will be wrong. + + [--if-exists] [--id=@name] get table record [column[:key]]... + Prints the value of each specified column in the given + record in table. For map columns, a key may optionally be + specified, in which case the value associated with key in + the column is printed, instead of the entire map. + + Without --if-exists, it is an error if record does not + exist or key is specified, if key does not exist in + record. With --if-exists, a missing record yields no outā€ + put and a missing key prints a blank line. + + If @name is specified, then the UUID for record may be + referred to by that name later in the same ovs-vsctl inā€ + vocation in contexts where a UUID is expected. + + Both --id and the column arguments are optional, but usuā€ + ally at least one or the other should be specified. If + both are omitted, then get has no effect except to verify + that record exists in table. + + --id and --if-exists cannot be used together. + + [--if-exists] set table record column[:key]=value... + Sets the value of each specified column in the given + record in table to value. For map columns, a key may opā€ + tionally be specified, in which case the value associated + with key in that column is changed (or added, if none exā€ + ists), instead of the entire map. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] add table record column [key=]value... + Adds the specified value or key-value pair to column in + record in table. If column is a map, then key is reā€ + quired, otherwise it is prohibited. If key already exists + in a map column, then the current value is not replaced + (use the set command to replace an existing value). + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] remove table record column value... + + [--if-exists] remove table record column key... + + [--if-exists] remove table record column key=value... + Removes the specified values or key-value pairs from colā€ + umn in record in table. The first form applies to columns + that are not maps: each specified value is removed from + the column. The second and third forms apply to map + columns: if only a key is specified, then any key-value + pair with the given key is removed, regardless of its + value; if a value is given then a pair is removed only if + both key and value match. + + It is not an error if the column does not contain the + specified key or value or pair. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] clear table record column... + Sets each column in record in table to the empty set or + empty map, as appropriate. This command applies only to + columns that are allowed to be empty. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--id=(@name|uuid)] create table column[:key]=value... + Creates a new record in table and sets the initial values + of each column. Columns not explicitly set will receive + their default values. Outputs the UUID of the new row. + + If @name is specified, then the UUID for the new row may + be referred to by that name elsewhere in the same \*(PN + invocation in contexts where a UUID is expected. Such + references may precede or follow the create command. + + If a valid uuid is specified, then it is used as the UUID + of the new row. + + Caution (ovs-vsctl as example) + Records in the Open vSwitch database are signifiā€ + cant only when they can be reached directly or inā€ + directly from the Open_vSwitch table. Except for + records in the QoS or Queue tables, records that + are not reachable from the Open_vSwitch table are + automatically deleted from the database. This + deletion happens immediately, without waiting for + additional ovs-vsctl commands or other database + activity. Thus, a create command must generally be + accompanied by additional commands within the same + ovs-vsctl invocation to add a chain of references + to the newly created record from the top-level + Open_vSwitch record. The EXAMPLES section gives + some examples that show how to do this. + + [--if-exists] destroy table record... + Deletes each specified record from table. Unless --if-exā€ā€ + ists is specified, each records must exist. + + --all destroy table + Deletes all records from the table. + + Caution (ovs-vsctl as example) + The destroy command is only useful for records in + the QoS or Queue tables. Records in other tables + are automatically deleted from the database when + they become unreachable from the Open_vSwitch taā€ + ble. This means that deleting the last reference + to a record is sufficient for deleting the record + itself. For records in these tables, destroy is + silently ignored. See the EXAMPLES section below + for more information. + + wait-until table record [column[:key]=value]... + Waits until table contains a record named record whose + column equals value or, if key is specified, whose column + contains a key with the specified value. This command + supports the same operators and semantics described for + the find command above. + + If no column[:key]=value arguments are given, this comā€ + mand waits only until record exists. If more than one + such argument is given, the command waits until all of + them are satisfied. + + Caution (ovs-vsctl as example) + Usually wait-until should be placed at the beginā€ + ning of a set of ovs-vsctl commands. For example, + wait-until bridge br0 -- get bridge br0 dataā€ā€ + path_id waits until a bridge named br0 is created, + then prints its datapath_id column, whereas get + bridge br0 datapath_id -- wait-until bridge br0 + will abort if no bridge named br0 exists when + ovs-vsctl initially connects to the database. + + Consider specifying --timeout=0 along with --wait-until, + to prevent ovs-vsctl from terminating after waiting only + at most 5 seconds. + + comment [arg]... + This command has no effect on behavior, but any database + log record created by the command will include the comā€ + mand and its arguments. + +REMOTE CONNECTIVITY COMMANDS + get-connection + Prints the configured connection(s). + + del-connection + Deletes the configured connection(s). + + [--inactivity-probe=msecs] set-connection target... + Sets the configured manager target or targets. Use --inactivā€ā€ + ity-probe=msecs to override the default idle connection inactivā€ + ity probe time. Use 0 to disable inactivity probes. + +SSL CONFIGURATION COMMANDS + get-ssl + Prints the SSL configuration. + + del-ssl + Deletes the current SSL configuration. + + [--bootstrap] set-ssl private-key certificate ca-cert [ssl-protocol- + list [ssl-cipher-list]] + Sets the SSL configuration. + +OPTIONS + --db database + The OVSDB database remote to contact. If the OVN_IC_SB_DB enviā€ + ronment variable is set, its value is used as the default. Othā€ + erwise, the default is unix:/ovn_ic_sb_db.sock, but this default + is unlikely to be useful outside of single-machine OVN test enā€ + vironments. + + --leader-only + --no-leader-only + By default, or with --leader-only, when the database server is a + clustered database, ovn-ic-sbctl will avoid servers other than the + cluster leader. This ensures that any data that ovn-ic-sbctl reads + and reports is up-to-date. With --no-leader-only, ovn-ic-sbctl + will use any server in the cluster, which means that for read-only + transactions it can report and act on stale data (transactions + that modify the database are always serialized even with + --no-leader-only). Refer to Understanding Cluster Consistency in + ovsdb(7) for more information. + +LOGGING OPTIONS + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + +TABLE FORMATTING OPTIONS + These options control the format of output from the list and find comā€ + mands. + + -f format + --format=format + Sets the type of table formatting. The following types of + format are available: + + table 2-D text tables with aligned columns. + + list (default) + A list with one column per line and rows separated + by a blank line. + + html HTML tables. + + csv Comma-separated values as defined in RFC 4180. + + json JSON format as defined in RFC 4627. The output is a + sequence of JSON objects, each of which corresponds + to one table. Each JSON object has the following + members with the noted values: + + caption + The tableā€™s caption. This member is omitted + if the table has no caption. + + headings + An array with one element per table column. + Each array element is a string giving the + corresponding columnā€™s heading. + + data An array with one element per table row. Each + element is also an array with one element per + table column. The elements of this second- + level array are the cells that constitute the + table. Cells that represent OVSDB data or + data types are expressed in the format deā€ + scribed in the OVSDB specification; other + cells are simply expressed as text strings. + + -d format + --data=format + Sets the formatting for cells within output tables unless + the table format is set to json, in which case json formatā€ + ting is always used when formatting cells. The following + types of format are available: + + string (default) + The simple format described in the Database Values + section of ovs-vsctl(8). + + bare The simple format with punctuation stripped off: [] + and {} are omitted around sets, maps, and empty + columns, items within sets and maps are space-sepaā€ + rated, and strings are never quoted. This format may + be easier for scripts to parse. + + json The RFC 4627 JSON format as described above. + + --no-headings + This option suppresses the heading row that otherwise apā€ + pears in the first row of table output. + + --pretty + By default, JSON in output is printed as compactly as posā€ + sible. This option causes JSON in output to be printed in a + more readable fashion. Members of objects and elements of + arrays are printed one per line, with indentation. + + This option does not affect JSON in tables, which is always + printed compactly. + + --bare + Equivalent to --format=list --data=bare --no-headings. + + PKI Options + PKI configuration is required to use SSL for the connection to the + database. + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + --bootstrap-ca-cert=cacert.pem + When cacert.pem exists, this option has the same effect + as -C or --ca-cert. If it does not exist, then the exeā€ + cutable will attempt to obtain the CA certificate from + the SSL peer on its first SSL connection and save it to + the named PEM file. If it is successful, it will immediā€ + ately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certifiā€ + cate signed by the CA certificate thus obtained. + + This option exposes the SSL connection to a man-in-the- + middle attack obtaining the initial CA certificate, but + it may be useful for bootstrapping. + + This option is only useful if the SSL peer sends its CA + certificate as part of the SSL certificate chain. The SSL + protocol does not require the server to send the CA cerā€ + tificate. + + This option is mutually exclusive with -C and --ca-cert. + + Other Options + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +OVN 23.06.3 ovn-ic-sbctl ovn-ic-sbctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic.8 b/src/static/support/dist-docs-branch-23.06/ovn-ic.8 new file mode 100644 index 00000000..c6725872 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic.8 @@ -0,0 +1,211 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-ic" 8 "ovn-ic" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-ic \- Open Virtual Network interconnection controller +.SH "SYNOPSIS" +.PP +\fBovn\-ic\fR [\fIoptions\fR] +.SH "DESCRIPTION" +.PP +.PP +\fBovn\-ic\fR, OVN interconnection controller, is a centralized daemon which communicates with global interconnection databases IC_NB/IC_SB to configure and exchange data with local NB/SB for interconnecting with other OVN deployments\[char46] +.SH "OPTIONS" +.TP +\fB\-\-ovnnb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Northbound Database\[char46] If the \fBOVN_NB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnnb_db\[char46]sock\fR\[char46] +.TP +\fB\-\-ovnsb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Southbound Database\[char46] If the \fBOVN_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnsb_db\[char46]sock\fR\[char46] +.TP +\fB\-\-ic\-nb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Interconnection Northbound Database\[char46] If the \fBOVN_IC_NB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovn_ic_nb_db\[char46]sock\fR\[char46] +.TP +\fB\-\-ic\-sb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Interconnection Southbound Database\[char46] If the \fBOVN_IC_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovn_ic_sb_db\[char46]sock\fR\[char46] +.PP +.PP +\fIdatabase\fR in the above options must be an OVSDB active or passive connection method, as described in \fBovsdb\fR(7)\[char46] +.SS "Daemon Options" +.TP +\fB\-\-pidfile\fR[\fB=\fR\fIpidfile\fR] +Causes a file (by default, \fB\fIprogram\fB\[char46]pid\fR) to be created indicating the PID of the running process\[char46] If the \fIpidfile\fR argument is not specified, or if it does not begin with \fB/\fR, then it is created in \fB\fR\[char46] +.IP +If \fB\-\-pidfile\fR is not specified, no pidfile is created\[char46] +.TP +\fB\-\-overwrite\-pidfile\fR +By default, when \fB\-\-pidfile\fR is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start\[char46] Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead overwrite the pidfile\[char46] +.IP +When \fB\-\-pidfile\fR is not specified, this option has no effect\[char46] +.TP +\fB\-\-detach\fR +Runs this program as a background process\[char46] The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless \fB\-\-no\-chdir\fR is specified)\[char46] After the child completes its initialization, the parent exits\[char46] +.TP +\fB\-\-monitor\fR +Creates an additional process to monitor this program\[char46] If it dies due to a signal that indicates a programming error (\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR, \fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or \fBSIGXFSZ\fR) then the monitor process starts a new copy of it\[char46] If the daemon dies or exits for another reason, the monitor process exits\[char46] +.IP +This option is normally used with \fB\-\-detach\fR, but it also functions without it\[char46] +.TP +\fB\-\-no\-chdir\fR +By default, when \fB\-\-detach\fR is specified, the daemon changes its current working directory to the root directory after it detaches\[char46] Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory\[char46] +.IP +Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing the daemon from changing its current working directory\[char46] This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use\[char46] +.IP +This option has no effect when \fB\-\-detach\fR is not specified\[char46] +.TP +\fB\-\-no\-self\-confinement\fR +By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time\[char46] It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon\[char46] Note that in contrast to other access control implementations that are typically enforced from kernel-space (e\[char46]g\[char46] DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security\[char46] +.TP +\fB\-\-user=\fR\fIuser\fR\fB:\fR\fIgroup\fR +Causes this program to run as a different user specified in \fIuser\fR\fB:\fR\fIgroup\fR, thus dropping most of the root privileges\[char46] Short forms \fIuser\fR and \fB:\fR\fIgroup\fR are also allowed, with current user or group assumed, respectively\[char46] Only daemons started by the root user accepts this argument\[char46] +.IP +On Linux, daemons will be granted \fBCAP_IPC_LOCK\fR and \fBCAP_NET_BIND_SERVICES\fR before dropping root privileges\[char46] Daemons that interact with a datapath, such as \fBovs\-vswitchd\fR, will be granted three additional capabilities, namely \fBCAP_NET_ADMIN\fR, \fBCAP_NET_BROADCAST\fR and \fBCAP_NET_RAW\fR\[char46] The capability change will apply even if the new user is root\[char46] +.IP +On Windows, this option is not currently supported\[char46] For security reasons, specifying this option will cause the daemon process not to start\[char46] +.SS "Logging Options" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SS "PKI Options" +.PP +.PP +PKI configuration is required in order to use SSL for the connections to the Northbound and Southbound databases\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.SS "Other Options" +.TP +\fB\-\-unixctl=\fIsocket\fB\fR +Sets the name of the control socket on which \fB\fIprogram\fB\fR listens for runtime management commands (see \fIRUNTIME MANAGEMENT COMMANDS,\fR below)\[char46] If \fIsocket\fR does not begin with \fB/\fR, it is interpreted as relative to \fB\fR\[char46] If \fB\-\-unixctl\fR is not used at all, the default socket is \fB/\fIprogram\fB\[char46]\fR\fIpid\fR\fB\[char46]ctl\fR, where \fIpid\fR is \fB\fIprogram\fB\fR\(cqs process ID\[char46] +.IP +On Windows a local named pipe is used to listen for runtime management commands\[char46] A file is created in the absolute path as pointed by \fIsocket\fR or if \fB\-\-unixctl\fR is not used at all, a file is created as \fB\fIprogram\fB\fR in the configured \fIOVS_RUNDIR\fR directory\[char46] The file exists just to mimic the behavior of a Unix domain socket\[char46] +.IP +Specifying \fBnone\fR for \fIsocket\fR disables the control socket feature\[char46] +.ST "" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] +.SH "RUNTIME MANAGEMENT COMMANDS" +.PP +.PP +\fBovs\-appctl\fR can send commands to a running \fBovn\-ic\fR process\[char46] The currently supported commands are described below\[char46] +.RS +.TP +\fBexit\fR +Causes \fBovn\-ic\fR to gracefully terminate\[char46] +.TP +\fBpause\fR +Pauses the ovn-ic operation from processing any database changes\[char46] This will also instruct ovn-ic to drop any lock on SB DB\[char46] +.TP +\fBresume\fR +Resumes the ovn-ic operation to process database contents\[char46] This will also instruct ovn-northd to aspire for the lock on SB DB\[char46] +.TP +\fBis\-paused\fR +Returns \(dqtrue\(dq if ovn-ic is currently paused, \(dqfalse\(dq otherwise\[char46] +.TP +\fBstatus\fR +Prints this server\(cqs status\[char46] Status will be \(dqactive\(dq if ovn-ic has acquired OVSDB lock on SB DB, \(dqstandby\(dq if it has not or \(dqpaused\(dq if this instance is paused\[char46] +.RE +.SH "ACTIVE-STANDBY FOR HIGH AVAILABILITY" +.PP +.PP +You may run \fBovn\-ic\fR more than once in an OVN deployment\[char46] When connected to a standalone or clustered DB setup, OVN will automatically ensure that only one of them is active at a time\[char46] If multiple instances of \fBovn\-ic\fR are running and the active \fBovn\-ic\fR fails, one of the hot standby instances of \fBovn\-ic\fR will automatically take over\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic.8.html b/src/static/support/dist-docs-branch-23.06/ovn-ic.8.html new file mode 100644 index 00000000..8d78730c --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic.8.html @@ -0,0 +1,310 @@ +

+ovn-ic(8)                         OVN Manual                         ovn-ic(8)
+
+NAME
+       ovn-ic - Open Virtual Network interconnection controller
+
+SYNOPSIS
+       ovn-ic [options]
+
+DESCRIPTION
+       ovn-ic,  OVN  interconnection controller, is a centralized daemon which
+       communicates with global interconnection databases IC_NB/IC_SB to  conā€
+       figure  and  exchange  data  with  local NB/SB for interconnecting with
+       other OVN deployments.
+
+OPTIONS
+       --ovnnb-db=database
+              The OVSDB database containing the OVN  Northbound  Database.  If
+              the  OVN_NB_DB environment variable is set, its value is used as
+              the default. Otherwise, the default is unix:/ovnnb_db.sock.
+
+       --ovnsb-db=database
+              The OVSDB database containing the OVN  Southbound  Database.  If
+              the  OVN_SB_DB environment variable is set, its value is used as
+              the default. Otherwise, the default is unix:/ovnsb_db.sock.
+
+       --ic-nb-db=database
+              The OVSDB database containing the OVN Interconnection Northbound
+              Database. If the OVN_IC_NB_DB environment variable is  set,  its
+              value  is  used  as  the  default.  Otherwise,  the  default  is
+              unix:/ovn_ic_nb_db.sock.
+
+       --ic-sb-db=database
+              The OVSDB database containing the OVN Interconnection Southbound
+              Database. If the OVN_IC_SB_DB environment variable is  set,  its
+              value  is  used  as  the  default.  Otherwise,  the  default  is
+              unix:/ovn_ic_sb_db.sock.
+
+       database in the above options must be an OVSDB active or  passive  conā€
+       nection method, as described in ovsdb(7).
+
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the  PID  of the running process. If the pidfile argument is not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By default, when --pidfile is specified and the  specified  pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs  this  program  as a background process. The process forks,
+              and in the child it starts a new session,  closes  the  standard
+              file descriptors (which has the side effect of disabling logging
+              to  the  console), and changes its current directory to the root
+              (unless --no-chdir is specified). After the child completes  its
+              initialization, the parent exits.
+
+       --monitor
+              Creates  an  additional  process  to monitor this program. If it
+              dies due to a signal that indicates a programming  error  (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This  option  is  normally used with --detach, but it also funcā€
+              tions without it.
+
+       --no-chdir
+              By default, when --detach is specified, the daemon  changes  its
+              current  working  directory  to  the root directory after it deā€
+              taches. Otherwise, invoking the daemon from a carelessly  chosen
+              directory  would  prevent  the administrator from unmounting the
+              file system that holds that directory.
+
+              Specifying --no-chdir suppresses this behavior,  preventing  the
+              daemon  from changing its current working directory. This may be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By default this daemon will try to self-confine itself  to  work
+              with  files  under  well-known  directories  determined at build
+              time. It is better to stick with this default behavior  and  not
+              to  use  this  flag  unless some other Access Control is used to
+              confine daemon. Note that in contrast to  other  access  control
+              implementations  that  are  typically enforced from kernel-space
+              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
+              space daemon itself and hence should not be considered as a full
+              confinement  strategy,  but instead should be viewed as an addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes this program to run as  a  different  user  specified  in
+              user:group,  thus  dropping  most  of the root privileges. Short
+              forms user and :group are also allowed,  with  current  user  or
+              group  assumed,  respectively.  Only daemons started by the root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
+              that interact with a datapath, such  as  ovs-vswitchd,  will  be
+              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
+              CAP_NET_BROADCAST and CAP_NET_RAW. The  capability  change  will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons,  specifying  this  option will cause the daemon process
+              not to start.
+
+   Logging Options
+       -v[spec]
+       --verbose=[spec]
+            Sets logging levels. Without any spec,  sets  the  log  level  for
+            every  module and destination to dbg. Otherwise, spec is a list of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A valid module name, as displayed by the vlog/list  command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog,  console, or file, to limit the log level change to
+                   only to the system log, to the console, or to a  file,  reā€
+                   spectively.  (If  --detach  is specified, the daemon closes
+                   its standard file descriptors, so logging  to  the  console
+                   will have no effect.)
+
+                   On  Windows  platform,  syslog is accepted as a word and is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off, emer, err, warn, info, or  dbg,  to  control  the  log
+                   level.  Messages  of  the  given severity or higher will be
+                   logged, and messages of lower  severity  will  be  filtered
+                   out.  off filters out all messages. See ovs-appctl(8) for a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless of the log levels set for file, logging to a file  will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets  the  maximum  logging  verbosity level, equivalent to --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets the log pattern for destination to pattern. Refer to  ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets  the RFC5424 facility of the log message. facility can be one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp, ntp, audit, alert, clock2, local0,  local1,  local2,  local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon  is used as the default for the local system syslog and loā€ā€
+            cal0 is used while sending a message to the  target  provided  via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables  logging  to a file. If file is specified, then it is used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send syslog messages to UDP port on host, in addition to the  sysā€
+            tem  syslog.  The host must be a numerical IP address, not a hostā€
+            name.
+
+       --syslog-method=method
+            Specify method as how syslog messages should  be  sent  to  syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc,  to use the libc syslog() function. Downside of using
+                   this options is that libc adds fixed prefix to  every  mesā€
+                   sage  before  it is actually sent to the syslog daemon over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However, rsyslogd 8.9 and older  versions  use  hard  coded
+                   parser  function anyway that limits UNIX domain socket use.
+                   If you want to use  arbitrary  message  format  with  older
+                   rsyslogd  versions, then use UDP socket to localhost IP adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port, to use a UDP socket. With this  method  it  is
+                   possible  to  use  arbitrary message format also with older
+                   rsyslogd. When sending syslog messages over UDP socket  exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified  UDP  port, accidental iptables rules could be interā€
+                   fering with local syslog traffic and there are  some  secuā€
+                   rity  considerations  that apply to UDP sockets, but do not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The default is taken from the OVS_SYSLOG_METHOD environment  variā€
+            able; if it is unset, the default is libc.
+
+   PKI Options
+       PKI  configuration  is required in order to use SSL for the connections
+       to the Northbound and Southbound databases.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies a PEM file containing the  private  key  used  as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies  a  PEM file containing a certificate that certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate authority (CA) that the peer in SSL  connections  will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This  may  be  the  same certificate that SSL peers use to
+                   verify the certificate specified on -c or --certificate, or
+                   it may be a different one, depending on the PKI  design  in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables  verification  of  certificates  presented  by SSL
+                   peers. This introduces a security risk,  because  it  means
+                   that  certificates  cannot be verified to be those of known
+                   trusted hosts.
+
+   Other Options
+       --unixctl=socket
+              Sets the name of the control socket on which program listens for
+              runtime management commands (see  RUNTIME  MANAGEMENT  COMMANDS,
+              below).  If  socket  does not begin with /, it is interpreted as
+              relative to . If --unixctl is  not  used  at  all,  the  default
+              socket is /program.pid.ctl, where pid is programā€™s process ID.
+
+              On Windows a local named pipe is used to listen for runtime manā€
+              agement  commands.  A  file  is  created in the absolute path as
+              pointed by socket or if --unixctl is not used at all, a file  is
+              created  as  program in the configured OVS_RUNDIR directory. The
+              file exists just to mimic the behavior of a Unix domain socket.
+
+              Specifying none for socket disables the control socket feature.
+
+
+
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+RUNTIME MANAGEMENT COMMANDS
+       ovs-appctl can send commands to a running ovn-ic process. The currently
+       supported commands are described below.
+
+              exit   Causes ovn-ic to gracefully terminate.
+
+              pause  Pauses the ovn-ic operation from processing any  database
+                     changes.  This will also instruct ovn-ic to drop any lock
+                     on SB DB.
+
+              resume Resumes the ovn-ic operation  to  process  database  conā€
+                     tents.  This  will also instruct ovn-northd to aspire for
+                     the lock on SB DB.
+
+              is-paused
+                     Returns "true" if ovn-ic  is  currently  paused,  "false"
+                     otherwise.
+
+              status Prints  this  serverā€™s status. Status will be "active" if
+                     ovn-ic has acquired OVSDB lock on SB DB, "standby" if  it
+                     has not or "paused" if this instance is paused.
+
+ACTIVE-STANDBY FOR HIGH AVAILABILITY
+       You  may run ovn-ic more than once in an OVN deployment. When connected
+       to a standalone or clustered DB setup, OVN  will  automatically  ensure
+       that  only  one  of  them is active at a time. If multiple instances of
+       ovn-ic are running and the active ovn-ic fails, one of the hot  standby
+       instances of ovn-ic will automatically take over.
+
+OVN 23.06.3                         ovn-ic                           ovn-ic(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-ic.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..a134eb5737aa5a6788a1fdefa13d599fca8c5741 GIT binary patch literal 38755 zcmce;1yo(hwy2E1NSh>9qJT_GDQaDthEnWdSdn>5H7WXS`r06=H=XFgduc>xtA5pYgH z0c9a^0G)%dh^mB;2#>9iv5UQ#BM2Ph;AmvyMTOqn;Y^yKZ zFArjP&Z~`Rb|!FiBOjLz`Gee=5^5<$w%(?TYto}bNc2+V!150dvHw#08NHuH0})s2 z63<+lb(pZMb@(6x=LY)`E(FE7uGz1%!6NWOLF=khtegr-_r&d|~HKIe_0K4+EH zwG%sm>F3nbdUsc!;hKv^FO$JG8nE0;%3UOpVoHaEo?t!Xjl=n6+5o9Gdk)kXgw?pL ztzvAZR=-txIA_#QiU)y{iu)Q3u zwrld^npE4UvkPr1)7UA^ zthGg)Uz3~=)l?nNi9lPTe=?nFb^SVnWvh0`Jnr_*k5t1Q{%iL*0q#5$MjdfLko+eX z9Ub!!id_d4I-Rq=>_p*6m5_H%hF=u!sF{{U=hP3vZhoX6lnqvh*GWvLvyz5Lp^Y2{4r)y@f3Q5=3Q{B+CPut z{5sq0yZ*t%3y~SDMP6I-npdY2Epr^Cq^6Wh^)dx|lF4&F1}+9pUhO9WM((y7i|Co- z1(ciyrPYvQ4Yl}UT;ras#9~7=q;v{}!d^jorfY)*pE zjru13R{u6nesLBmnTQTj@%Fp@5i$g#M@HRF8KR}R#W$1!=`d6B1=6BoR8XT@d-HL-q7Pwd*VCguSQc@D^Vdbg`~~4tVU4jg>AhGNh9J{7RSPU$c8M# z@i|+AoaoY57MW>~=YXI^`*vk|2x~tbPF5m7j{=ymIndR#Nq#AT7qRFs z9%wj1-R!a7lyI4>Az7owGCIO=OndD!29gDfeg*WY7rnM5%W;Pg>u6T7eMJVj;PWbj z&~Isg>9*ur%HRh5YsxEm&n3uu5o7?5sHO+J73sDerZ==zrPhp)CW&Rc@`Fcb&^#wZ zIk zn@5NGhANQMj$eyE=>%Cg^CXgb1`!~5@9%eju7<^>f9Ow297y!J&Cr+UU(x@M=$Y_g2AywNm!$c4A%T|PICW{*C0@nZPZN(s-CO4m^lcKl_r$}omfMw2E!N_}dTaan*Zgn@~9VRB0AhYh)@u*zoovZA1E;Yke930)4@FqBSG9CvG#FUSoD*}d z2a3kR8bx++UHX0H&^6IZH0s$M{PgttM_v%&Pd;?QySezq4nXaEboMLqH7;)^KQfF> z)J1|vKNL&mAEc;4y0-Rh`&b9n-bL@I^{CH@ZrYh4(Gt1)jwOr^Tdsu|?MnA!IN~^L zB$FWv*@nqb5Bl0yLrJszECPfCp-TFX(J;u$Fus8+-$u*R2DN!`F1y)-CQeuM?c}dc zk;Zv?C)hY`8XzGFU$zX z)6X@T>C>VKP)b^a<{k5j$#tQaf5hykp^3D0+%p)!#YQY%!J`jlY)bDHFN&j-;P{^; z_z8M_a$|Q!olz+&y54yhzB&=R^`zpFfqfXgXHPbS4e;#H?L1tGb|HtXGH1BJq)I;I zzyjUfUGBV5v4NYcwr5)XAnP&uY9`6oEb|h3%dR&?<;O0G@gv7;!tYGb_$oikdiR22 zD^P!Mz|i8FzKq~{>G9-3(BV~O*K4JX)pz5p*h`QxF?F;a zPHY1(mfsKgoyjwa-S)Z#0zg*o;hhmVn5$kEwCz9XN39a8_7L{rJ0=Pe?=GQOCe0-Y zGzC0QLtBa2Wg6s%CC_z&aQ2%Pi_%By2%STqJoXgs9J{R44Vk~|q#jXDz%MRn{_Myr z3vNM0pjoMBRX;A1zPxocrTaGVQ2nYF*-@20337fl>ezi(@SC*s>4w&6yMvWxcQ?N` z>`w?~`9K7K&_i*%h962mnnH+ND>7bddiEWT*8>V=3Ih$u+UUCwhenqfhvWE5PTb;ZIU?H1H$%OTOy-eJ{IYh``^kvQO`xuicB8)q=W$}Q zdOj+@=^_>1V}CGlNZ-tJVnDKxTzxG zL-f_R=C8D_oqhn6`we+CsS{UCws765hmEYbponv-X?Jek%HiDiE3$GSFvC6Xze@%S zAHwK>r0{1rp#(XjDM=V*{p)^@}$8}fr4w?EP+ z_VJYnt{DrP)kIN2>FCgz1A8?t#ITW_2|N-V3Zn3fO7k+WJw&QJWgeE6%L(NEu;AvO zH@99?F28DCwk|j7Tpe`eLrMsrhI}X@Bw4QpjOz(Osffo)As+1z3z~%DlR8ZcFC@6} z(isYzMQ+oECZnlxM(-P(P+}=Q%sMk++!W5Mjg}P{biFHg7IT)U za!@uRcG$PX&K>fnH5N$OF@zPZ2}&?jLn(}F;XS;hIuTVluJ3nXzb?! zhVJu4>XqiV_qe#^Xj+jT6NmuCS{@KFuX+KLC|2*_^W{suOMEPa8fa3lWM41KaH31c zHwraO-B9^E+H43?F=xM~03o|+2kNw4RvDDnDqHAji~pjpX&`OAym3}@r(=aVv24hb z8(TKsTS}|&XnS8$mUMg2+{lfL?ov&3&sul*C0;@p zf!XA{)^#u4iZFuvd`tOk8bVr(ZFUX?;k^QCcAXK(5{kORv|8SyD_F_PCE#L`n+?l? zxU0BQj!G{|UcpU6okNuh114qdcZ4zf>Dv2ae;TOwX(>O}`!Mu>Fv;6hPF@(4*2)aQ z$0Hkcb_Mfqy}dImi%(vUZ)Cqz-0nGA5ripYYw+c&a(YngRjB;c+F?~HrTEJR-af5e z@IevkQiqh8zZ*&)BB$yyBOjzoi>Kw^sj81~6B6M0)662bqt#6kHl{BDVlT6AsRR<| zxNK@;Na6cr4ptRSn5%+^lU+208T$|HiE4tK``JJw;`QBsXJ5-UvM^G8@@mPFHk>Ra`MB-Z9S4bL$o)zRw;NPKZb)#j4pk?AP(- zMjN1gX^Cr;g5Wp8(6M>&1Sn~@QQ2J7lRM_K61E;4Kk4tt@9hhq9 z>lzAIbPr{eTf(-QxbFd2HGUi9D6p8PC_FKt5Js!c9MA|eB+jm)pOqj~$cAsbHmUT3 z%)58G^?rVp(i*EeVYN}di;h;kIqarXGLRe=sDhkEjG5pM%6k=4!G1+<5qqHYY5}d8 zBFwsr+1mrKHp#*@h7+{3v6G{O3AhjM_t0ex_NG6guFZzlmRCcOO&ee}DX5Zgk ztc>sKuIgqyI;Fwkt7tt`unbPqvd6yWBw5w*ygywTVAln%dTI0$6!Uhx^Y-8j=SEXl znDb^Yw1&hFd+RtsHh)21np^s^37vri)^1R@5(YC5AePko>IkqBB|wI_VV@ukk!e76 z*=HMG>G*!#--|0%vj_H~Zib2ve>Ae`W}t;wk+H4h8?`-SU>Frh-=NFH&C!E$Fq|^P zse&iImZGLoAQralWj~;&sFHSNuEvj*T_utv^doy;r7|ZsBWxybSf+9gdRE)@kK;{R zJWOLpjWHu5`PYp#^=3c5fZ+DjOTE@MEbCbf;ILLxkog@5$}jE?&&o?DwwC&8&HyKF-#T^lCb?0i^mKNn1Sq&Q^DAJP<4%HG(P~?=rgUYPgp)6lmOu_TTR5<93DWMI*LCV#%9~KaU+W3W( zVQVF=d%}jIlkI0zTgroNUwM!LK!6qE?5a$DYsH>t0$yT}wIP}R)+i@zMgPFFC2{&H zkXv50rCO`cyEUD)ue0b!vQ0gA_DE`5s-MiV&mGr1f<#=ZQio6NioOq|W(VZ(y*^y} zAcoi!iP|PML&oO^kX_m9m|@Jek~!3}VzbN%Q)6~=U{#_y#4#{DB*l&RwsQd&`;&ZZ zB$i3&=Bgas7lxluO2$b6Klkfxi(k`uh+#?76tQ0y9+p!sGB;6*c8t~Shee=bj-&fT zl4qHa!OMh)D$N?id}D?PQ9nG)(#gYp+3Iq1BcE)qsGj`N{1xZvB%?B;|N}I+y z_%~yUgY(;2!Im&HcFCLd0`QQx0FRzdTmjm zzxSO^1^!Refkz?-TlhnjpJObkbu}u}B?KbQ-u+4F?!xw5B*}D{pur^@AFC z%s5GFC(gtu7G1XD7ByZ|Vp@{D$@GzLGS22Men}PWnDIt8=cOrUd2UvfcS?%YV{*s@ zYJ9cii!Hg7ekFd-Ts8m=N%{BfhwXV9v5pz_h_Z*0WH)C;r3aP$RELcQhW8{lX9mBa&0WELjHYA?|&R_^+Ees{UqR>bB`tB zWB1U$9n;ij^E$U?1}eYg3i=gzPy5Mz=h!5>Be-l?M_0(#gynmlriF`7RlxK{-a9P* zo3iptp=FF!Gb=-)6$w-&VZ{}V2x2I&^mng+YEz$~u5DqHXZr8%D88cg4rO>y-dd-B>!7hy^ zbElA4PP=cfShtfv%@Vrxv+MR3@DC%mA)4+W0eq#IxDQwbRPrnJ_Le@g`V+oRr5;n% zh%S@SBb@3*VvxOJlQ7oP!YbeGi$<2}a*aSp^FRMc_)-inLI`OSQi9aIBa$O~pf53s-BY5?&5wE~KVF_6=vD8NQI&$^1)A$9QP*YN}bF*~Tsc>4Y z>6SB4cXRhx=o0ft)WFPX}0!)>Cc z%fd`ztUIws>tjG*h@H;4MKgvHUJ7#qx%3h$X&!1xqRUGRoW{OF$!HAxdxE%>NMm~s z8?%Ro)#Spg2}dOErAiaBwa1yML`vq<$bP>)(PqgJI(+@6l_N&t@01ybXI3)v6E4n^ z0R)M7Mez51g4T0C)^~@u<6qrU7?(=ixD0mbp& zd>=RU{?Y80)gQa7yYIP{{=;&8Hc6jMS7tVLj=xM-&i{CR!^H4U9^i~>EZc82K0Ux$ zqf?gjgU4K>q~_zet$qB>X zE|6cDI%e~F5@hI#i{m4llAN1-euwzwViG7O?I}4zvK@72<=_}5XEl^xcSY@0vq)@4 zE;CUi*D zF;_osxBuZh@;p(5C3>YhUF~G`P6TKjPr^KuGOSM-Tw@(xbF4A`Vr&xnKA{7qlLGmO z_|||BbdsK3%TRcoG2z7jZ82hh8eU-W@aN;WnZ3(PxXPkS7Kr+QazO_MSXWF#$wuvt zZ=}JasZw*k@y>Wz-Rhrw<@GRjLMRF{T5RyFMOg%FhWaEG8U^QXIkO^+YhY`?4t;}g z+X=y+z?X5od?~izkDMKL-%gl*LA?RN8qBSzI9R(^(}gFts}&iJP#_NfDo84q>b~&NN-4UqF1|-zOX@&?c!*Cr z>k0uLfH`7ZK&xR-DKX#OvHZq|4x-DXUU$1SJ`tnWsGl2%^i7X6j&<>Gx+oLkw&9W4e!#F8pdQyumQnNiF+xtz zHuK@#G1}O@!RBRW%A;s|h8d&Eh3np>!+Y&i_F59O>Nvg^bN)FZ-!Auu(NK3pux?B} zK2zUr7PZfJ^ssp4mcEsqhpVUaK5f(=Trk%>9gvCl#}1vCtUT(qhD4`PKZKW{i!rZ& zQq5AuXylnZ-xPd!wXvE@aQK8ywDbgyc{sUNe@MI(N9XC~S0M^uZbo zyj{Y(JhxbEE2lLQ@d<8s)Co?M%*&qb>!pE~^yXNj7^^^XMg3*!kayd+?|%+V@B?(s zZ0W>mPu{VMtjyui+G^q*GtdZNi%oRL7otuM{0guTOx?wxLU=#@%4RC&HSVjoV$tFi z0hI}JZ?rB9$$4ZV4(4jE3Y&&Bn!OuU(fl+ZNIo_j&t)e-K?u{B?bb(%E2HW*^r?`) zVD}M}MuMVIv~R!IMvREQ`@#boksYN(>VR7L(hcHNoO`eoRu7Pqsx%EXgU#inn?P|YJ{8rMf;dAT`x89)I&^41Sm8@Z;fnm|SV*0$M9NtFF#;-4iU8%eB1~SLy=-;Zx z*5VOM1T+s!rYEwg3$jJW_l@@lr{J&#K9Q)Djx=Ge360INL8y~)k@#o0@j z7l(S(*yoLGYf~cVO%EY-_uVpZ)eRyV^WbJ-{cPfrnfPJKAa3~JjFV_Nf(ET<5xD~?6+n_@BW@G;+iYJ3Pb zzLYj-;a|(O__SYC)UAhl!#27h=VFq`l+#!==^@~4Y`HE~^x?A*7u>@#O2HoMeqT)v zw<8{F7sC-oajjxvp8wqq)vt?Ra^-9W9x6(@i3EwI;ylXqZ(j0myAl@ry;jF{oQ6td zDBE(#kFv#St%*s?A3YoPpthy16=Tkyj`nR+b^6i?IX;S@q*<0E*{(bZse?n7*~HRi z_G0gl!%)uOT(eGxpn5Wby|08&Fs1BcrXb}MOGa>K^wnEa(rrt(?0gC6mtL#G(N`%g z7w~j?iBvT#Kep~I9@mV95(8)@ry+CeWJIR9IgC>LvL*$ZXT21Vm0vwvdId8(5HpG~ zn z^Nsxc0@?V6UV2~R7}B8>#KHin%qiumCt4RY7O!=S)=4|qMOyu?kjz&ortBER$%bZ5 z+4OD`0CZ|IA+9JtMu)S=cePWGcRuC>> zkiED^0Y#F;kFH(FBJFY|~Lv~WiTNW0dNO8vNRPa$w?OFq z>S>n*c{sk&^L^#?O+X|aG&P2N^beRA+>SP z^aw*tc?;`AM&z2`Iq5mUT?tnkQ|xNYks4RF(CMVhHyaF1U%-fEfso_QTdFA!5D{@w zbH{(7?2!${;Ebw&@xY%~v`BlUQvjQ5am#qVJqItu;fPJOhT|Q8y>smbZ(<+;U^7L! zBwwZ3#7;=)Azs>Fa@sB{49s_JL!mT*m}oBNMe{CD9C2yr6`6n=xK>+M-OSG0u%b*xt$FSyUHovBM}DeOx% z_*wC21xpSPvYJK3$}XOrOE|R z6A`Lw5(W*|rZ1fe%j6XW7a>TOw0M%swT`uEbsTDFiW!G5GFR#nc(!J_qZ7RMVV%Kp zd{7;RWagsTB5jnLK$&=V1V7dCE!y4afwXG`Dnn=a(AOWaa{Ua(X6UZcyG#!xoU-$seKi%>ucSH5#Z z%Pk}=6oX4bis_=~Lo}J;$h-4Nf?+hStmB?6rn{--p>Rm@ya4cD*sw zgJHxRXEXN!q}^T>S)cl{6)`TRc4v3?bbpL{Ltd*FbNq)v^la!n8$?X3Our2xCg%S% zh*$ywAbW_*|lbDpCL9*kk({Eh#id)_~*gq=;{VfiqOQJGeY3H5L zBjO{+?oLsH&tf+!u}_)u&Zxr)r^}?;&biO^&wTIX7V_*BVox5#tzzlNw=RdHXQl$> zN!yby$<&@TS|p{xP)R|wkz|cuiQJA>PS4aV{hT=Q$i~S&zORgGHC9OeIqQ=A*^O&Q zeIxkb79in9YtY!rcgE|nxNGPvQ0`B=seoS2+J1LA&3XHtCD=e}m9K#sxmuwl`&Y-P z0$T~JK#m%%Fs>a&O`!Nznpm5EAo&(T)Wo|474{#V4e2%ps_SSC!{ikoI}-ck@7mVXcqeW5vo9U4^_Rz zhVUTk&@UW|bbLpJp=sK&i_qv>d|a|2R|0jdW$Q~=GTgz18{#8IhSq<(b;c_+Yz^V)vKQ>Jgl!yTXMSkfqMtu1 zZV(y9Hw86Vs!hzH**tiypA`KDWRKFi`^h;NdVj0E-3nrN)ZekHE{B75>x)3f8ANb8 zM_!xlyv*`!5A^L}8xJfIC};3jNmsCWYLOn7n=yggEV_qc*9_f#jrl%w`&%{m z_GN8Ij8G4)x*xZamkI=~rAk$_&{2icY!~p8j#IblY`eMY7T4D#XH9u)31~*ruztI^Y(-YS0{csa^Gr;wlvQ)1nN<2jIC5 zE?pqSvPF{N3pp`69v#RJEgYAh@dv1#4hAY7Zf95eT0CyUyibG;ROG4FR$*yN=bBLm zO|n!Z5WdGHCG6JHc-^A~YY~p3x1KB-*aiWR$a-0U#RdJ9U6Q^$F-*2?h=HgDnJ0TQ zJsd-KI~D0uks+Q(sT@-Rlo%bV%)KV3<*s?`j|FTrPt9foGIVZqHh~YN9|_2hjM{As zyiGI2ll2kW9zth3PV@AbO#Y`zroi)|LyZ7p>m~lCfyGeJA5r<-TxGwr+abVh^EjeU+$!Y<1NbPC_YIm2YpG+43LGS=d+F~Q}7E7F{W>_1q9?#1SgJ1eEPra5jzx~}k+N#7yd_#S&pJf|Ss z(uXoubxA`XW!C=!nx=6XOJYi;A?fSS^AQ@<{a1WtLy*@7S5IiV1k4>N zOJh)h55`6LL((`3BlhZixm#S4D!~g|l)Q`Rd~5^duy~JTA9VvFcu-}L3Hb-6DW-hv zIjCX*Br)g%uNzm{hWNI55+73Hkj;IWH}BybamlV&XL;UZ>p%w$p`em87kLUQEg(9I{bl)ARy68+gPPhzLKeQ>%j9DY=V2A`mmAe zo)EW85F1V9zBC7Ix!)0(^B^5(mH#e7reS6L-7C;=G*NU)TkTCBo z8^2E38=S}b{J2xeqoK{s%=-H87Av24=H<21Z>`tEToGg-nJYAlu_iE5U^pp|G8IzZ z!8UB~8`iAyO$wmD8^h8>1hE`Yv;ont_kyhQ07i&I6p>LsOb+2;B6U78@tFvpbCC4p zX%9-bN$sX%DjLfiXs$;JiD}VeJr&pRMT0s=@eiLn?z z2q|f|cuQn$XP&pr-UYSz?g#uL-}(KIuVeiC4PLEVV_7?#Xs%1bLql_YxDm|kM zM4T*y7KYiYqPUSEzop}Vwmi1c9@tZ9sh*tMX7ATFG9UL}7&Se(Dc#LF4_vV7a+!67Uq8D6YOQK_5 z-*Sp)YKCY)bnHw3p;m-wED?-9xIEpV6HaJ7Mh-Wjj`Pw! zib$BxU{l}NBJp`Pom)kCgEp`cPpLOM>_mfku1oTd}7wNzR(oBUY8LM|uxz{*nhS<(pwk#cA0_67>yPFeNzB#m#E%Q*YTsK4fo zP^Cac=4~&}H^pgdZ~oQU2_V*a8HwJz08}q;{^`D^vTs3al**&AhaE9GfDblHxOdij z^IoQBTVxT!ui%of_>QHvmoK5=9tkM*c_)R%X`@`Uuin%Ztr=wUWH%51p+56iPr~i$ zMQlgKbVmtP%0LYs6Z59V@xMWJvboL$#hDI%z7~@gXNnDn2!+BV3Pg#C4+xfIqrS9@ z6cFi>`QjD03zS9P-1$!co(A>_02ZddUIP8i1o%TJWj9+8P+s2z1e5_8nduAKxB@hv z9;&f1G6C2*nY0msiZ+hm&!PYf;9T|~Ye&G7(WwZI207R`*&Bi!z?I0`+ZZZ=95sR9 z&%yveWss{QxSXgBI5XoPxxt@P0foR}aCry7(;KLYh~Ox&tWSb5{x6F21paf|{}Si< zjo5#a=Xa0&|KB}KjQ@o^PmekOE)NqEIO3_J{uku=Yi$12KhJj={!O0W?-lACxH~GCu1$#OFR$L}Yq?^%+qc z0IuE%j4SKkvHbU52WQcD)VH)T`Ca{=*MSVkQQruh0$~25uD@~pFTsF{jEsnk&w~wA zJYc^rQ-a zlJf60B!y^{&8$EUbb>aPM$Z~T8027RZ)WRgV-Emp95DEQXr!kSU=?C!@8Bq8s&5Zq zW&%p<|LJFBX9lX789ACdXd*JPJ}Ile|CpJX0Z+#taZkRdJWSx%2v`{y0RQCpU7D5s zxei1I06Q2LHa7NW_qU%7e3Ix)D5f*S|Peq^HC&7NlgHH%t@l(o^kK-u??0+izEKQT&jljZ;E!s}tWCh;fZI|8DmfWA zK21DNmn-AH_G{+2kn1V|2K~RqEcC1P+eZ`Pbw8{tn{t_1IwqA{C~odh2d$8{`ftO!|&rM<_XHD z@c$P$pD}(O?>}n=_xo>pe&hKB+#loil=9TVpLxLX9AF;)B<@d2o=QFCeunu^7XQK* z9R5Sb-~XTJ`h%<|ik`{*(|u~^H(5_SJ{?ctC->>H_%rRVOYpfTz|#EA_muu5+3z}@ z>i*qxzv*NCk4yaz{{N)(e_-&rrvD+Gm5t@!7=4~F{#!=>@72m*82)ocnK^-WPB!3g z&dp3r9T6Fs8G!~)mX;u}_ZeQGvE_fs@84#JzxY*@(lb zO7!1r2a^KM`*&WR{7>BcovA1PzheJJ*fWV>8J;xc-#Glu-Ea5LHve08z-|5;InT?d z|CXG;&AiXc?*9jJ{s81}I_-JV{JYA0nmPY9sXntHt8WGRZ>C>C@Pc2HjtRUE0}}%q zfRlp}z{bg<{j?JTcmoF(M4*6!;nSKQ90^{)>)VQho{0S;_|(W#+EYnH;2-D-Sesaa zO$9`tk|W4U6~M^CjtG=7b8rBw{%5qF)E&4Y@Qe;N7pQ;&KtZ4oP#7oz6a|U_#eot) zDWEh^1}F=Z1Ih!z(*#f%r~*_4ssY~v)qxs7eV_r*5NK#)X=4pE0)l|g(f~nrPWqNW zW3bi-|2czz#$dYyXaY0^n!4GVf~KlT9jzC9Kdl1-lu>m>( zove*O_6~+N_8_1$&;{rUbOXAB>}{x@JO62m3b5*bB1!RIQ_*wy&tdyx`-#8rJ^}8( zzfX`te{EO6%*e^h``5-4neW|{mFAoI7+>#}B)mN}-H0*$?o**^RiTvGhk#?JY81o} zjUeQM9>frE$ROkc10Mqs1^^6|^l{DQntzvHUcOwKvuJ2*YG^$13by{HY4ZYX`_8%B zR5X3tK#Oy5zFb_rx^G`SxgsKFbw=*nJbg_FADKXdXB8F&U+?YdpFXx}9IGjS(2p7ZB&pdJ(@v1AR0>4 z5N(q>%1cseDaA>6)ex5^DpOoA!%-GWASa?2HB&wVXHLc%YM&=OV-!|cB(FqGOj$%R zgR4kmPKzV$`9*32C32CWD4j2Pb$Ofhx%|-7ny~DUV*;nKb=X z70JdlJn}+dU*&~9rm8*4hAF8k^3@PtVIlEw0#)aL=m~WMd!DGWxf3DugW;p8V1itf5%JCt@h5(P-4eWwYEyu!I~MwKF9@t^tW8y4VsHN zA0od@^zoD4U*v|DU%HC4ypRxSLp$}NT!~jnGy4Iu<*T@wHNG*$r!>;sUlWYPcVf`X zRS*cRY0bdkDXVHyWs&AnA*$02axiVvipMM>51-zP?F@PySE3c9TKkEgv^7;J&EG&? z&^@o%LPOG^p6L+9Rp?{Q7I?=GWi^GREIHnnWyldIk0m+FPKo$*-`0FRdR>{LB9Rr% zqm1Ke!JjKMZS>m51vW1w1p~QO@j5z(X_P^BR5E^X@e%~~3S1H}5RHDi%gx{ zt;@m{&g=e~5WOeiM7NtZ<$gzMWC$7KFmVammC}pm^oPz>@70%Rws~Zo*~ zA&*11C;c#RPLHdmmC+jg7Zc3F3(v$ zBTz|_UkD`$KmEXEBjn!ip-$n!x43sD$ux9M%v2p7bZId}&En2~ufx4jwYh*8s+~32!!uZ{$ZwnnFu#3~Up< z@Uva1_y|;3g}D96Cw1;Gqec#=hiqWo^@ZsSP>5=o3n?eeM`-(rmS)B>g@prv+0U|@kS`)u}4oH0oN?kJ5^bf zQ}`$%()36i_s!WCe$`q7me}@Hs0c7S>s(xrw@7J$(17n&zSnLzL2N?7`V0H3up8LN zlj7tV8(wCc_nCyPglwnfMV;ED!kvUuVUTOlpn{cIrVk>dt+7hwY_3c_`1NwqcV5(6 zcG-0(Nnz7hW5HHDlvZ3?4G45%;h4#R9>MNJ;SM4ZO+~dXTLE;0^`~B>R19ce-usOv z-1U$za3`cSa;7WT>P~5+Q-$D)TFOPBMx7yYrPQJ_R!StUFb(GV29Lq0>IInv6xRr{ z;=;ih4t4sZ9e<>K6@arVSkwEu!FT=#bT0X>?4VJih=twFkSv9iUguCVPJ!Bi4MTM@ zvE{Kf9o?`bqojqQbZTVCzNzK$A(GVv_uJ@|9crwVd(0D+DHDeXGq?^6=hI>Ft5LFs zl0qU*fGP3$E(5K3PcC0DWDncT5tNF^H%d6g{p@otzp}wns~^gw(%s!LG1q%nLLHAQ z4O=l-Q|^I`Mdo;hly5pDWa%ZWHdPzX(!8Md(LT7sW!EvVXN{?v?3&864UNcABeM77 z^phHYiCUp?&Ny{nr)hb$Sirw7t!MP{3b*Q;4Q9clYod(lM<6}DkVpwj75A0v()G{H z5I6VDn^oRemvKItWoPcCprw>KV@(q!LwCWpdiu!}qceTNU~`oUp$%1?7nZ&P@4HEc z0_kxdbI>1H=M!Q(vfUziF>yLPlXb0JQf77)yXWBvU&1#FaP1{N98x4H`mkhf{9ma{cb^|T9wq%gS~V40s@OUgk-XE z1=7XFCG*!=gtESLLUF-sfP|yFQ!+BItE`WfRKbBcU%jU5qiA)8)f*xs!={ASY6s)Y z8DVU#x@z|dkn1NVh&NGV1}{iCW!YdNzJ50BIA@3Tq$w87^zPMByPw1!Wuq(ozG_)7 zC81dO;0YH;`s&T}|KaQ%gCyWDLhFj=DQfRP_^^b?b(m%QL8#ZIt;Keh`AfCz%2Xf2 zi{iwoJ(4*HK4|@%6*f#$1Z=!k#LBo5Sz9qEG4YPOY%oxn)e# zy&@P9w@p`&Sn-xC5lUP>Yj)U{TDo#x4+HX4uQin2<|zd zxuGp&-E`MMg1G2erl^*y<_9!|LI$l$#agt^kX5gk)f{?05+q}C>dGy&d_>-2uew7( zg6%BoStJv*{I<6f0Q-*9o+u&pAJgBDNh!@JD`T$CS9t@ET_sc@xNV{|kwRE8+=e=q zwXC|xSzFmkna)x!N?u6GL{1(GW`L_21%+})Socj_Fzwzp0j}7(bgEl0zQvrsj08m? z%W3H>Xo)9KB-P+X z{d{f0O8SFACL(P#xVW0iZ055_mNjtrXF^QFpW2OKN|+N7EadKfj>tY-xTf__UCDA+ zRRO;ool2qu@v%8k;T>@tl2H12B+`X0LC3GMz-Fr#^0{O967y!`IG|fM^#R28F|ca( zI#rFNh;%U)wkp+Q<{ftTl zzy(Cg7U`=e?S|TX_vW`xC{@G|=e+HoT*vi99>$=wJrGxmG-oL+SFGajPt`8o>fMX4**I=VdK5;L2 zgcN{|n94gs%sBmSs~MM?PE>}~E$6+4)KMF43v|UM`pVv+AZS}PkCf~JKd?z)v@$Ue zkuLEY`7CG*H_m?yh|Ipkl~dxcuOFL%ejp-}5A4nbmlSs(fbHO|-GzV9I_YV-o2K<1 z?R|RD6&;zFQa0}b?@iTm-S`B{Q=Ak z(lq6N2?a{e8x# zC$=|7I~V|+D)`BIy8UxyONy{#o>z-gSPnY z(PEx;ZSKvz@Hq9IdgENG@VwA2TVfT`F6WPCyT(=EqNH=m?&YpMi4Ro^ca%C@XX4{U z6tfp1DrSQvT27RiZ~M+Nbk*VA2cueh&Ah5}HvK{MSrL!|)#G!l$SUTTMaE!j@V)yW zj-qzRSTCzi*Zf+3lG>_`MFPnTUey8}&&DAhqYZ*twmEV&olN=fZKGBXX2R=_0W*-P zjb%aSw)#_5%m^NBf$f=kVght9y}X;54N*WiRS23=O`h5~%-H;gOA0I?R4;?ez8pC9 zrT#yMeZ))KM2utTp!ua4!AcTjO;v4!aA=SXU*(tZS1^1R7OQfG8Lj=8GXr5Gwp5Co2jn=fo++k z*&0zFmHp=ConU>20UEA}-g8j+8snf;PT!{{Yq6`gv$3wSD}*pTPCQ_a+h$fmPa~IV zG=1ossATZ4$y7)~P1*>Cw~9W=+B(n~wX!mLbby)0Dj9i>@5=How1J+mya46$L`J4~ z=Y{|mZh}#{&_b1iwF*ogA~j`tEM=tm2{;4atrBd98S)o88V%|`7an0DT-*-E428w!iss?RzEjV+TSY4xnQ=X`vyP9?bzHz&h+HQ2nvKXMsJ7SH%A z@3?efd0a?_55dyScadomFKUu|9#j>t>x?8ya`82jew^ zrsLaej9+jNj6h8vSdQHcN4yBo@uBl=;-j%y%FzvV!H>&0^?DP$tsWF zUshI#3n|7+`*mk2x;3pT%x$^1j4uVd3UQ{FZ>E1bZcJ23PHmghiERx}M!UG0-7ktF z=g=Q+5(zE}3jutJ1NipuW^Zh3C~KQjlGD<%p|2v`>4aTbas3Y1g{)uMpRIiGG>Z%)5>@WL!FuTG>ZplWd6C~0P@^TNa(v& zWx&H@Q^muRXVd+tobZ{plwZ&OfZ%U75L}j@oD~^mO30Y7G;C}}f+&@t8qYtvr_iM4 z?y%#`ZFIm%t;yO7O?sZV3HP-$gB1lQ(d_wL>GV{aohW6*si>96XPQsXNlR@@O~Zmr z!+d($FiqlS{D8o9^}b+a?|J+&`%nlo)6>&VwG|3RygcK&b;45tWtrL>l2$-n9jy~0 zI>leN*@MVb+eyEf_7uKb$=sR2b*vIYMn4kbu|tCK*&!d+1u_!yo8F)no)nF7K$X+Z z$8#8p%L#6-z+S^7U;ypgbW)nM9zsqn>;9vJvqfC3lxkFzgPe$nf(KV_IB{shv{Ovt z*J5S@OaM_lq_~2}@r6a>d=5$5(5o+4uyfFZ7k8DYLRM%aQc_9=u8m$^-TVo82|=Pb z^hJ!}lxqKEe}6M`et39qL=Z}rvX@rCs}3Xjnao=vN&Nw)$k6r$IX z?fMa5V6=Ub;hY=826CsIM9XP~3fPOd_-$eE_0RZYL|c5%nCH2lMj@2J_(vH{;qUUP zDd$ll&r%GeW{M97SU)8Kv80Em-+w4u(64Tvax2UpHHC8h;BO_=O-s)Gm{Ra^KB_zKu5282xEB=4YosH2yZdm@EwIS0Q}oHyh_i6faOZ zD&DJm24^VVk?_o{21=HS|E;{F6fb8wZ0JR5OL5HPks@7iyO?RnjprAR%T8IsSp$+R zF?$nPFVKO0tTt=bFu_#8Lty+Y=Fot!(W%ahUP0ejl#*`B=vh4@&UQ#8ZGNq{3Y5#!5 zO%@s8pNDBp#Av2WF2is@I|@3qA9B`t$4svDt77@s$=PEqt5BQ8&~-#7pe3M;ok3rX z6}FPZur=k0r1AjyMx)_B&9E$9`TbNvl`KRbu9l`BR2?$I0`>-g&Y{H#UKY2Wti zPD{W0z`;Qv>b@H;geH&e*7MX2!t_VH%EzMj)Vz^Z=aNX{DeLG(9011~&1%M{kI{;- zt8Ks4%30NvOUVqc?;1EVLhW(c-nvm-=jDqlP3ySuLTZproy!)Ps~U}{J8A#?qQ{&U zk`GFq7f_l)EJ5I<#~ys^-pLNV%Ai9PQNN*RVU+1?MI)Ev9?YaQ;cL@%QdwDj_tr`% z##{|qrG;geZpreP#ZgK2=EEn<1()ZrwT09J0`2E|wiO*O40RT{4WWKS%o%31z?B;QO|NT_;)KB{Doz z1A{QHS@EGlwbj)c2S)syo&%mm%t`l6gc(@0fVGCC= zOHRNFODia+s^tfhV5Y8Y^S;b7VauVzO)m*GjSp)NVEX0MP%i~5VJh7E?#dVwMK6aS zm5Q2#f^x`~ye>(JXv8$^H6E(5R?A5^mOhKZW?)PT4B3Jm%-ssW^qd70s8K{ePQv3A zo6~2v=JHZCgP+qL!<+o>^ih)LcCT(|AI?lq&%o>nyg+T;HaB+*&&Z7vzH84j7^&5>IcJ+WIK03N|Rb&4JVYC^kMm zAJ$%RFnx`l z59?_Xbzh1#OsRozoLx>ekFU$xvhCH3%a*86pgHYK-;s6yHEKsD5jF6 zhV6t`;~VFBu$rw_t63fhbg%yrLSe6VniKG|;2hIAALv8~LD(Hoed41KEwnJV?S`2* zp8$L)-2q=WKB{W2cIEpL_aPtVTn*bJW`5ezLlFRFS7W2&>VqI7l!9iaSeVu6O8yE_$<)fD0{bwZnY}u834Fo13Pn7~ z6DO>gjK``lpXQjHyPh2-6f7J}@*-N5$T4t7rsxw#hL8;LbV={~paNvneLh-U zq_NQtiBNg8{4vqoGb?w^i5hq&zjC#%L&(r$$l9wVa8;VJ^gy4}f~)=raOO3Q_5l_i zz}3hv`T;dSY+U}W+Uwu-gbaUUBL5q7^?zaX|6o_&MH)1W-&H*vOy4yc?Ck#oyJBbm zH+J>6=6|v)hVRz@%&wR?{@3j4|3$9;#;pt;4UDWzod1rR{(1cm*z^zd`yX7($j-*b z;4gIRFI?*za{V{7W%*y=*8hfUIsAh@8yi~x1w;RncG+0`1F!x6?`l`M2(C+>n1?x0+FWU5HXOV4px$q7U2WZU_<8d^2N_>< zg&z5AeLp~>?9=#b)hi{yi3|l3QrriJK!(=%=!~`1C(j`#GtV!`AAebi>EL315(7ya z21&r7Hh^YkVSHI!-(u6dQ112`R;~Uq(%m`Oz1zwciE0@dDj^dM4k4S-X!9N_=jc0e z(v6vPfR%`Zh|0dB{Ul-`=A`8%C1&-|6PC7@oX@&(IdTsUE)oVO`CPvG%((cn^9>|; zw2pY##5!uB*SwyuPf}}ii=GKP zJEAlH79w}3ySb0e_nJ(oRZjZ){XT_1tkmF2B{)QSi*OlS59Ycdyn%D@PZM)TxI)Sq z^xh-b73manM}~&P?@wKkq$Yh2w;4q0|7A~-f&@6|YKU1Eq%M0-tcuVPzB%|dI5J3S z2w#_BPsB^`h-4M+GpN}gk|r}dXeErx@NgWc#SII%1vr^Ew-V

dLnbt&FC#mBc|<4j{qtAidMI_?dz4!lTHzCnyXjp&&sKW z>JIi+*!DG83p!rEyQy&T6x?K3~LkJq{AQAT$1&QmS&oV%n{D2Ma$35d{~} zi}(EE`FU4IG-q`Nf7Uw%XvmMbmMlH~U-dH5TzowV+UT8bXxEZFzSJC)JnUX+v^#HeZcv=m*)&{(y}sAgM7^U24GU4kFpE%gf;y7hqDO z7W8I*d+|O7$@cvOh9YoVjWcg2V2WjOc0u$+{wd~a!;7c6nM@geHq#2uTi|!v;qdG0 zSAf5p*h)dpqy8Y|n6Hcmt2ofN{zyA|OSDY85rA}DGTEee5O^t}-&6;W9Eg<0MubN2 zG`d~*mdX=)S{S^|oT|u!kIKpeZuqD?S+i_{*#gYsSf&q@{^6CaDfwuGA?2R2$EA+` zWu*Y*&%jt9MQm9iBa2W5SiQeG-SiXP9ThjoQb5z37rgEEw^le8l9?0A!<-eyKep%5 z$06pIZuf5&wMorhC*Yjs0$lJJQ9tlpU|2W4Fy<_`BEAQA^d63JB(sl|Sd7R3hFeq9 zah4J>A$k+{VkZaQ$X$LFjy4S{n)!|VU8r#lj8#<UeHuVnXKUn8z1-?Tfv%}Y@a!h zuc>u7k4Bc*fsJYJ-_x%?!GwfSI-J1GiSb~5jT^1rZZsTB5hTQC#I;dJZV~4#rge-dfVgS>;ry#zq_yqfN~@Hta!QivAy`)p=L)4 z)A(IOwatouH?C*Bq!ie#DL8abdyhE{Z8|Q-pJb>gof{KpF?TO zN<&#iV5G6FxlBCgR<|KX`6G?Hj{#-ceZAq0@BD0FIQal_dT6`3e; z5{7hw#S)X!FRZwpmZ}DCejMnauufb=b%Mo+-hIKYN=J-eI+@;X<4U}^&PcLO-b$Ud1J68e5%}#UrlTLR7=qYQNV#> z{T+l)o-*4^GHs9vH>?4KDhYFzWjLB2a9+t0zi3`2l)`EEi$f7R>=#aZoI+h}&yD)dcoK8hcBULqy z>>j}7&CG}hXY{Sz{a!X)lR`?ZMCio3M1Zco0kcfAySf@65a6F=^WzEp z%yjgW({5t!BjSvFz%+EEup%Cu-apLrkm)Nb&KH%Jejl!A=WO7#y3v-I_+OPIzKU%+PqEH-f^no9>7wjau|X{p!s~3s?Uso!59ptX8p9 zaRPn(qpkSn_;&;D?+==HX(dTPQB|m&kjOJzDE%YoQXF z=8q1EqIAJwS~kU{XDCgLKqCgY0a{C3BCZ1x>7LuK?EV9uuSrT;r40HYxqBA$V~|A* z-4xB=Ti%>?*`Q9@zDJBvDqPkCfE##}EyY!U_noWdy^wc1G&Q%F{_>Uz4;ZFp?c|oJ zbq9LV(R7;(=cjNv5-_KR!aS8fFUqkR%eU2HEmm_Au**2AN2{Kts=d8mHN9kP83V+! zpcnz;xczXvy1}JR_uU6Yv!0IU%v@YDgBVEIu)pI0O!w-d`nYG>jrMVxPVUUr0u=QS z8P^?xWH=|JVa=)w_qyq_hZ-^~a={0b_GQ@-+Q}YOS|XO? zII6kew>E~b1wJZf4|y-5?Ffu=dSQDN9VWTg*dJt7OQY_^LJ#qQ4`rL7o+;c7cLQ+o zJwS(IM%4l!MtWO5u*#%3RmH}4bm9O{+I#;?H@j4{t*Il8pSYAAm|olcfig@x2GE$W z^O6N#bI!*TK44@TXIRuUoH?LXC`vJ>KS<&M%9u$QG>ejo&5BJj+xE&U4PA0-B@`l~ zl8Rb$6{3vXq^%3F1T0J!^6=-lw1x9s82TJVjA`Xyjxhcrp@8 z7R&sByhuf43q84OGSZjr>UnVkEw*cS6XxRBDRpXzd8r5z(K9d71W?T%auH^AhARpB z)G1JTP+mayV|yX5ZP;BF?q1&Dg5Qd6x^Ow=S{{~{M?+BG50A&Q^|51C0KJx8aLOui z=?JnXYgjuL`xji%9ryIgKOs+HHcr#T@iM%a0UaEVb@oMdnspaMnHZ8T1srY?J8v}c zxdydIAQ8-Fn9#G#iZn1euuQ52YY|uopwP&r93{^eX0eCrQ)bzU&rAR~C&;H^tR}5EwOk=(xk>n2eeLa; zDk(JOn3cTx4A%vyFpZiX_8(;VUl>T>`Rg7&auoXZIA29I8+wTU%q1wIZ`M|ZbZ&rkIb#qEyn3++P+{1 zjVCvd4r9c~Cb~sW&^t^s=B(s|rg+dw&v$W^m1H2h8$>~@(B06fU(o=PlUV6Zg8h6LoGKm1ZL?@+8u6Ls! z^;upt*t%s?9@X+L0CDz0)T0)FrbIB~kBn=HAk9!ruQv0?F6C(Vh5^?m<%-b3LI2A~ ztoa-ZoIH7&sF03P%)i|((1vf179ff4i>oLjUV?UdE}bA680KF=Pv;s*Q05x7)k zao=i6w3F@pIk!cOFhtIL8Nqt+Bx5(+{E^2`sYO#I*Sh}JWCoSO&!@fm5-={-TR8)3 zrouJ#$?ua=L3cJ~B&U7EGt@st31=rSo@aF)b6GFtWz&|>D zoLDzkHKB`gan*u*#P~b`Q5?l&RTs;BF7mi)otD~z>uFyL!g&wOS@O}R4Eh9aBp=0pV!?s_e+eTsVx~Q!_?Zq~TxdS+_{Cb{Riy~jeBmiA- z8%11-KJ`c<5o2S!yJGWQeFpZ0+?8W3bhn`X*7S;B6Jra`W;3hfQvSXt6^EdQ zD^MG?W^>pp(ArI`uF7Z=MiVbZkft7(tSScwDmDR4Z=2qGal{ZvvBqH*OABZD-NJ6- z52kICzqg3cv`Sq((;>O@cX8Q6JS{3H+jrVrmuiUU2QEYE7I`OGO)c~!%6?cS?vW6& z?etrw&c~H$x}+DQaf6~qdY0F)wCI5U@=r{NeGWD1syI#6FHibu|BI?*TE8@imJP0} zVRjQGEloC)mgbXA&o;K13oP%%LGm#H|#J}Ju30U3bj z3EHxWZ4;r}4^T*nG7CiwTR1uv5sCp&<{@IP^yVotLZsmNt)KutK2Jrj`d`~~%1bbu zy)i!RvZdyD=AhgXZ&2p^~}GU7PVykopJ?KNGytf8d{^3sN4v9 z;LUC~8HeJoIOA|s-1C?L)`8*>DEIDd73j4}S&Q{lWBQ z;*sX?^Fbftav(j~VAmZ}1#HTU87B7=qPumPhuq@JfVWey?0$EC@H_~!)4fCd$iiiX zW|k*pRSeWfL0wU06%Pt0*Bsh~fN#BU_=>75(I>`4r*)wQa-Ej{Gii-Q>M*Y#K1Atp zcx5=cu|ZT+pEP#u*qe$>_?IfmdSsvhAUfx=HaEC008jb_BrM^km1XK)DKo@a*s91E z<_h(TDG8kQANLsMb(>mz7Y*=+Sr@U^3>;|vP>zS0f)761IeHM^w>|5(LQwViRzjk#(_YE~Yk!J1TKr9t=fW2_)O; zQe1wZxT2{}dx?pE45^e(v8kxAu@b0^95S5+=2HxfXM34o|)-$BSQm zOD|o9wxsMM@%hrNg?D3<3mY<3tZ3_6)A%)FRRYYA+?>ta+WB8IOM3h~uF>|k&?mc) z7NKe9Qe~UB*YZLtmX#qlvZ!r= z%2^ztcNb)SqO!M^82NIH1%jQ2c~@n*c%++V#YpdpK(%n8=1UIdS4fa-9J9M-E9b|= z{x(K6R!I_&6w||*AYrL!*ta@Y^gK;2(y%o0;TU9{^iM})l))|>;VsJs-y~-TznD=v zQF+zY&C{*{q2#2JqBwvaqF)jOJ1wXZIGRH`p0X(oTF4dBIiX=`<`W}PE*VY&W)x6W zEha|piYT^EZ&HrEY-MJh5SomtbLv*NT3q9DF*5bnr%s-CKRRq5A0BE-HLz~Q4D)-e z7wb9?5uhdpS4m;s8HLI7t} zeo)G2_ML$hohEQwjCZmc1P!k?86(r>rMHl#S#MfBWKm;d?!GcOqmH*aBsgM{e?lqo z1jd!3Kotkcme0x^qJ7ox!VM_`ZC)+YVBUG|8U)liL@n5BjTI<)v|V`3PP35ra7+>kIZVFkDjJIRyzqSaXo^QFDff>gvsRVAV;2=od9+!Yx8?-l zgrf3*>UTk{ddA%IM)9OEKTAWbm(b& z%(kPTkvA0V33dsB;!YyRI=$;9E`I}c@3fbDH?)n_u}?Nrt|QrrvNQK-r`>F^{=@{L ze992qP@uQq7ft|Y|K=HVO!UyB0lL_3Bcp6g(*Y*+m*(dY;!r$S9aLWY++~1_t?uhg zk4?ZPiVuZD#mm=B2b&xC#LH2<0Q8->Ju{c(Gdt$yP5fThW6tQW;34Kd_h~Ytwavu} z4TE0#4q%%jZtivUg{`O6WinsTYZic#u+Q61@$2+p$zP@xU{6jh?bokUzdNKe`#SV( z58I!8ZoCSFT5xN*5F0y97u5$|4;io@<7EFV=GOAn^w(zmRt{D*?CbV(MlG^oP1kIs zqq9zH(cHPgTG|fV`6P5jZpd&#=OO*waWEf*B|YLksbTF{H{VYeR;K5#TlLVt6)=A; zZ+fNjF#>#RIAw#SNv;ouR;98&Gc|{=Bzyn{jHfv#WVv?7c_$U+)s7_>;3-dA1=%u; zzCI-%Qq)*JQe*q47#Q-?ATUi|qtub73mCd}3(uLX6({WNm`SxKbPw@WBxgU$@_vx z0d1U0&K3mS{1Dx`yGZKc*Ihi%O) zqmL{AX&qARh#<}!rn~4fDn2EI_T`&2-P_5`ntY!HW*j1fg*QpG2X_8=^f)rQ4t_cd z3$nw%m*7AfkBdYQi_oT0-l*=$Htz;MuA%j+T(x&!%}54n1je;bVr-yC>Jh+K?>h}e zwQf!37+&4G>^50Yc@l%K*6ZLq_H{}0nQ2XY{>(srKerh5vCi2+dX9ENRW7TjwXp~;Cuny)q7%!F?^vuiGrO+NPJMxF$T-rKci$)37yrAl2PuK z5Ou8wezFApV!M-&Wv2jIb4K8SU5xIY1=fGSS6u5QjCI@6qi-HepN z`~tm4S06b%Y3OAT_ee{FqH=+WcOo^hKnrB2m(5ys9a(mtyDzT1J|I%F=_*?^Kv0Wh zhLInaq~g>jn;GEo>M=TKFo`7Gn0u%@-eQ}c>r=pu#P|6gH*Q!V2gHtI|0wct7Hyr} z{<(lR*eC(VpK-UyO$^l7zv8ChE4OS#GJ5vgn{tK%~5dNM{Q z-Yx8t^Tm#44n-7gai7P>=eWHg-457YN8MDLxy}Zkfpb)a3w{WgxbH2y z%yjbtayyq|Z@z=D6+(-H_U3DdDWF?MJ&P`ii&^Fe)}f%5lSL{fi;`4LqT4S3W%^8= zqews+?ts9fAmk$D_39GhvzTA#lt_f!`vOuIGsMWu%=m9n z#D4@4#lAy`{|F%dXZ-MAvBQ6X*}o&%{~=&#`<*KMP89wnJowMB;D3n-di+~5@bA`x zzwpt&*gpRE$v|c{cJ{yW(KHWdrQh8nau5=5qXbm}!rmMri0O#n!d+^n0fJgkMaty! z9`EGANy>S>ICXyjiqgi=sH?wycuP)8+cb+fKVoRm9Q6Gj#O#0Q$QIWg6 z_lzvtW6UuFNgD-OBm&cMi-q;+ne`Q?%Rf>xqz`#gF?L(-US@lt(P-2=3kl@qvvV<3 zFz+>~sdXd%%nyJ5lNcUzLb96vf(U&LZQ-dakjKu`!_29b^@Ac}MT0?35Ko zvO};#T8~f>M!7*llnIYG`5VEkOVLM+a`1^569xm+aH!0am`kLshp!bQwM&0THG@8~ zx{T7MvjeP2_l~Q~x$RHdEu$*-EctwlcGWy@yedJL^Wz?1|1&%}n9i1?^IU1T^jW(? zZ<5AU$!1M_jzgW<$Bz(9;WK$o5cM)Rvwgzw#@v#^kP0fI?d;wENJhMPrWhlLHT>)W ziB|y59Q0Zr$v@*Uir6b?i!kMYl?A4c66oAykeObX7sN&w+~nPgq56yecNS*!6nzq& zajRLs{ul0uno~bKlY~8#-;-%oELdTmvhJ?avf877%XLR;5siwUH_g%6XO8H;7!oFfCFo>;j0`nb z8yAma18k)QN8oF5z>dSuP(uWFM)+rxS(A8i`tvVgyS%YUR)r6ynDhYIQl}j9$){6* z#Nz@E`}FHu?1@qP{U zSXVOy3g*_Qq(#n6MwkcuSTf!!8hN|9-9fq5I$Am2w#^Dl1R$1Z#d7cyxQdb|L$_V; zdtzNmc?!DQX)LZVX0LF;erDoNOhELyJH%zU3fBYL_w`VbY9hmE6%HZZnA*59jhVst zHS&voVMFS0ZPuj@g8H^(S>=*BLvYz-qf^Qr^+GC|no>3ak|`f(@EVnid%?tG~KQJP@sqrBtzXLG46_%0`f8)Ww*iTCk~i zU0K5wQ0@M=u1xfBo+Eh~7#CVM0!Vsl5H-8cBZM|GyQ^cRSz{9uz<9v=>D*fquM|Q& z?q_>7oQIHrMP7MrxTJ(+Op(&>^uPvrYp1GZjPtW5L6Vxe3)feGRrM;hQovj`rK{Y& z+1HHR`~ZzLV)#&jrK&`?qhPML9iVQQuIU>mDj-`o)KVaqC4!tJZY8BE8v3Wtp}0%D zWIVY}{v!Cf?A(}hTZqS4XXE!a#r>nu9)w^Nu_>0)DOFT@pdhKszMgy33Z3z`Go-}k zeO6-F^Ws=ika~XJHoYu2{nY0b_(ljfU57NxD}$I`iSwJ_n<4LHEsgv|bf7#uXx%-j z`>UrS{XR2ZRPWuxM;W2FQYOe2DEvUN9n+7M8v_g?i0CD}&OOqP(wxI=7GQZB$`;Ss zI)DfX>P>=8a~AU^B#Cd)VJCv$hYdUUG*0M@&kYL;yK~tCWh>A$s_Xd^da4vR_^EXu zW~~w%%-8Rsz=284&yJ1eU)i+&_<}WElh(}~(WVM(;0lm!p@s!xFwVVz=d#!ynH_*l ztFUktQ{;J=F6_SDUg6%m`SM2ft+jvTRQgy?fhcU}gTS1{0cE z%A>_U$1!PisptZn+9~SwB2IH&+BV9oz3+-La@R7O+6i82 z$JEs~!z6J`l#*ThSy!vOgmO$1E8o510w`;8yJ~|W)2mCutYRLE1bAn2z>|+gbBbKW zG~oAb#*-lt2{wU>k6vGRxQxf<4ZrsI(PjYR>%YW+YYeZ>9v)p%FM9}JL$p&;weL!k zipsm?ZFqGfEo0Ai#>J?R$^$5~rq^BbfxCb;2q7A8_0L^TV!8r9rc+W6P}-v?Q(CDi z+ms8|_?t6sTRgJxy+G1Fmy|v^Pn7IHtg0+h(yCY$HmYffMU^+<5zPh-iZfdbw0CL; zKu$BoncGhI0?`830wfNY7gQ;%;Y=uLVQ--ur?7;AUJe9nIrW35GqXqN$;W3_Fk$%5 znm?w1gYT>nwuVwxIJaw~7BdPoj+ri8FyT$xiT77i2v5ipd-^Q=Op>d?zY3k<%`dcD zkI7AgNj<_}Y<|Em_j42r-U?xR;dvZJiU-}2ehf)?wAgg_!|7gBUCV_zhdAdp98e%Q-f9d%X^RsuNf*k*y+j6<&p~#Id~!P znsCJdC}t6;W{h$^lVz>;qzUJ*)7-5B&_dy|Bor2MPTnDhdWg#)>Qk(&Raaz~MBJgN zJw;8DJfGKGQRNycHUJj!Deo(p`+S%Lpx-SWJC>*fRoWc`V3obcqx2(ZG;lF8Ht-kH z%Omozm9gOReu=PtpULk=;8)=L9v+ zZ!9zmamqtQt0rq0w5;8$t`#FsW)j@#Dvmv-F_fGSW$mTl4rXzl}(cNks*(8 z0MasLxA{LKb2xWOqgwRq+1%W*dco?>LIPEvMow>!?B$Q#If#^=t!T?JG-UK!;`ftV zS2>cR*1tHcKZueLJcw=!_>pC;0h1}o=z-bA^aE|I@w7`z6-FrEPOnbb@Ix)aWpaK3 zXwuNbk-uB4w3rsCn1gF}*72Q;HzDir=@vLcx}uW9M$qM&C9m`=G$-9%DLyub$6`bC>I5e$oWyhnA!?-zven)=-yf~Xz?F+3jtGIP=GHchpd znkY-Bfg#wQEl~Ji;Jp<1S?@-qDp9Ge7xU#VY@-q0H}&A#T`1p~mX?uefciX9l?1Yx zNn|BVjgv^WBEn#KXQr=9Q=Rt^jVI_#3JkqzJy6x+?hfC+TU>K6ekE~~8)HJ4FpF!U zG{7R2d`EV>8@pqVjh{H5sRMNr2tUKoglP-*K2frp5##MHdLT6TUTL6aP*I3Lj=~n%Qr|rma6veUoWqO+? z@@`%YtFA3-XP_f%!ifg&b>KDe$Q(|GqQIqy$|w)S%xlx-X+Z4T^~?L~H0;aY;EB)I zo#W;?0c|dz{0CntiB+a%xeo0PIkL)11&)e8%-2cBRZly5E$C#-qJ`~q&n$*#zZ+2M zzyZ0F^4fdKcKsXFjbn$A(zX}d&1gwjC!k+fY4N2x`f%K}-mai2?U%iegkdqOM2?Jv z;w|y2zjSINtdHC01l6Kn{%0NC_+`jD7f&~LFW}?G zfG?wt=IGI&?N+bt?dxZ;fdaR0E@rcLKlTgTfKB5H=Jy-in=oJ-Q;-($%UXd;@&RX} zr)HvV(>HU`mA`+C;N$w8`%s~?B8J)R3DI$lyZ?A$mrry6ygbxJvqUwM5RPJX4}=cIPtZ*>U_W>kDHgE-%$rj`sieG2oRQ0AFAO={;Pr8_E>AeN(M*L} z-To}-50zLnSIRhenH8YGgEgg`A(I$twv#rSX8#n2?YN(%+$uW|(3Q24#Dqsv)i<(+6 zWXV;BveE;cVekY`k^7?++X_^_Ff8r2wDH(qSLfhlB!WuoR#N}01=>7P+fKoERo`Ai?;=zneA8S*W!3ALl3A1ACGCA*H`UP16rj8LvEDrYS@zb zBa}U}^?EcZpyR`I9(I>ad@Hb3+0M~t#*B}95DoJclT$M0J}?a!u?cr1ayX(CGHAkB zk=)h@Df`hGw*3v{-17D4&v+5NezceeRAXFhBO#8gu{doTX31J6%}#J1lixX<<0r#z zZnE=3K~iZQc@|P%K5Md|Q<7B07(^k$$WyFcz<0&;L`|LL`)*`b$ScvJhAdUbVK~Et6!Y22ZsgT@RBYXPy z)=wN>1lnqAT3N(MnaU)Ey_}RDyW&WjHYzy4Psh6Fg;wV>oAXoE!fAV*Gp$-=Ep<>| zmv@N4PM~1sZIMZdY{nv~nV~ZyjAN3Qh~x8kyH&jk&Gz4e;$|KI>f1N?tp?34DKo?{ z@2V`PbQ$;AYrtl*+IYP$?jv0JRaG$PXOC$ZDbXk%ELcfqjYbfcXK94U+U%gyzKM zTXq5O%8GvifinQ9W3#l5F@Z!vHm-Q9OS-+2 z;mEmp<)5=7q_k$|I>)}CCq3ZQShd-~7o)_Be8W_VZ9n>o?E)J^o z^a4kHbf{-ZfVBd(e%0^g=eILsddiO0_RNxFaZY3L2OK75hEK-Oe(vh~0&+3D`|}$U zip%6MRGP|^O@`-HdU3hM0>qvlATRnY;Jar zRs;;RtYqI)IvSgDDt=p&|1sfri-*kI+1Z|xj?T@^jn<8c*3Qw4j)8-NgN~k&j**e( zy9bSvhpn@LJB_Uq(f4|P--w0!e+;vAqW$}xXupFbbQbD#47Bug|61r@UN{RoTY|qW zY+z{T;>`2o$3JJW|I6zCHqG}7-}5kizrF7(&TreZv5S$3BM+IFyflHBxt){qKOC+E z4D_`0jI<17bpL!~|Bv;)Kg|Dm+uwKKpZn(i?!zhb?G82d5dOAM^D@#iGSkpA($KRj zGcs{9b8s@!YjV^5mrma|>U)%sqsjM(|Hr7mbo$FEJ4fa3JI8DGe_FeG-nL;Ny8Bmf z3FHipcqBzihAqIZ9l%4-q3Bd}P%W_#Ab&uS+n~R`kCNk9RN7>SUlePX^-5-26AA`N4lm`Hj@SoXAJ@>!9E6Q;^We9eVFp{^uKw$PuB!1r zis}}N6^_x!x#RSB1?mgM1&@VP3Ce);06)M`E^i>t^c}xO@Y^&+m~P&EstXI{OKC=q zS>45S6v>EL*4aowJC(Js*#2yj#&F+8N*Sn^y6b`?X(A}{_H5XL8Y3rtn@9#W(n3My zxQCM@Bvzz)Hi{zUw$0-$qIg`&C>) zDYO?Ke6cvzw?RNU8RS%%VSI|9aO(S#6GHFxK~gw5^u7(lHtJ zz!?Tkx|4;Qy*)4tpga6vvtr+7%S1(sC10DhCT{qrCHbj TS>3e7CQYnqbaS)*d_VdN#0U0- literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-ic.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-ic.8.txt new file mode 100644 index 00000000..e8e0176c --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-ic.8.txt @@ -0,0 +1,308 @@ +ovn-ic(8) OVN Manual ovn-ic(8) + +NAME + ovn-ic - Open Virtual Network interconnection controller + +SYNOPSIS + ovn-ic [options] + +DESCRIPTION + ovn-ic, OVN interconnection controller, is a centralized daemon which + communicates with global interconnection databases IC_NB/IC_SB to conā€ + figure and exchange data with local NB/SB for interconnecting with + other OVN deployments. + +OPTIONS + --ovnnb-db=database + The OVSDB database containing the OVN Northbound Database. If + the OVN_NB_DB environment variable is set, its value is used as + the default. Otherwise, the default is unix:/ovnnb_db.sock. + + --ovnsb-db=database + The OVSDB database containing the OVN Southbound Database. If + the OVN_SB_DB environment variable is set, its value is used as + the default. Otherwise, the default is unix:/ovnsb_db.sock. + + --ic-nb-db=database + The OVSDB database containing the OVN Interconnection Northbound + Database. If the OVN_IC_NB_DB environment variable is set, its + value is used as the default. Otherwise, the default is + unix:/ovn_ic_nb_db.sock. + + --ic-sb-db=database + The OVSDB database containing the OVN Interconnection Southbound + Database. If the OVN_IC_SB_DB environment variable is set, its + value is used as the default. Otherwise, the default is + unix:/ovn_ic_sb_db.sock. + + database in the above options must be an OVSDB active or passive conā€ + nection method, as described in ovsdb(7). + + Daemon Options + --pidfile[=pidfile] + Causes a file (by default, program.pid) to be created indicating + the PID of the running process. If the pidfile argument is not + specified, or if it does not begin with /, then it is created in + . + + If --pidfile is not specified, no pidfile is created. + + --overwrite-pidfile + By default, when --pidfile is specified and the specified pidā€ + file already exists and is locked by a running process, the daeā€ + mon refuses to start. Specify --overwrite-pidfile to cause it to + instead overwrite the pidfile. + + When --pidfile is not specified, this option has no effect. + + --detach + Runs this program as a background process. The process forks, + and in the child it starts a new session, closes the standard + file descriptors (which has the side effect of disabling logging + to the console), and changes its current directory to the root + (unless --no-chdir is specified). After the child completes its + initialization, the parent exits. + + --monitor + Creates an additional process to monitor this program. If it + dies due to a signal that indicates a programming error (SIGAā€ā€ + BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, + or SIGXFSZ) then the monitor process starts a new copy of it. If + the daemon dies or exits for another reason, the monitor process + exits. + + This option is normally used with --detach, but it also funcā€ + tions without it. + + --no-chdir + By default, when --detach is specified, the daemon changes its + current working directory to the root directory after it deā€ + taches. Otherwise, invoking the daemon from a carelessly chosen + directory would prevent the administrator from unmounting the + file system that holds that directory. + + Specifying --no-chdir suppresses this behavior, preventing the + daemon from changing its current working directory. This may be + useful for collecting core files, since it is common behavior to + write core dumps into the current working directory and the root + directory is not a good directory to use. + + This option has no effect when --detach is not specified. + + --no-self-confinement + By default this daemon will try to self-confine itself to work + with files under well-known directories determined at build + time. It is better to stick with this default behavior and not + to use this flag unless some other Access Control is used to + confine daemon. Note that in contrast to other access control + implementations that are typically enforced from kernel-space + (e.g. DAC or MAC), self-confinement is imposed from the user- + space daemon itself and hence should not be considered as a full + confinement strategy, but instead should be viewed as an addiā€ + tional layer of security. + + --user=user:group + Causes this program to run as a different user specified in + user:group, thus dropping most of the root privileges. Short + forms user and :group are also allowed, with current user or + group assumed, respectively. Only daemons started by the root + user accepts this argument. + + On Linux, daemons will be granted CAP_IPC_LOCK and + CAP_NET_BIND_SERVICES before dropping root privileges. Daemons + that interact with a datapath, such as ovs-vswitchd, will be + granted three additional capabilities, namely CAP_NET_ADMIN, + CAP_NET_BROADCAST and CAP_NET_RAW. The capability change will + apply even if the new user is root. + + On Windows, this option is not currently supported. For security + reasons, specifying this option will cause the daemon process + not to start. + + Logging Options + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + + PKI Options + PKI configuration is required in order to use SSL for the connections + to the Northbound and Southbound databases. + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + Other Options + --unixctl=socket + Sets the name of the control socket on which program listens for + runtime management commands (see RUNTIME MANAGEMENT COMMANDS, + below). If socket does not begin with /, it is interpreted as + relative to . If --unixctl is not used at all, the default + socket is /program.pid.ctl, where pid is programā€™s process ID. + + On Windows a local named pipe is used to listen for runtime manā€ + agement commands. A file is created in the absolute path as + pointed by socket or if --unixctl is not used at all, a file is + created as program in the configured OVS_RUNDIR directory. The + file exists just to mimic the behavior of a Unix domain socket. + + Specifying none for socket disables the control socket feature. + + + + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +RUNTIME MANAGEMENT COMMANDS + ovs-appctl can send commands to a running ovn-ic process. The currently + supported commands are described below. + + exit Causes ovn-ic to gracefully terminate. + + pause Pauses the ovn-ic operation from processing any database + changes. This will also instruct ovn-ic to drop any lock + on SB DB. + + resume Resumes the ovn-ic operation to process database conā€ + tents. This will also instruct ovn-northd to aspire for + the lock on SB DB. + + is-paused + Returns "true" if ovn-ic is currently paused, "false" + otherwise. + + status Prints this serverā€™s status. Status will be "active" if + ovn-ic has acquired OVSDB lock on SB DB, "standby" if it + has not or "paused" if this instance is paused. + +ACTIVE-STANDBY FOR HIGH AVAILABILITY + You may run ovn-ic more than once in an OVN deployment. When connected + to a standalone or clustered DB setup, OVN will automatically ensure + that only one of them is active at a time. If multiple instances of + ovn-ic are running and the active ovn-ic fails, one of the hot standby + instances of ovn-ic will automatically take over. + +OVN 23.06.3 ovn-ic ovn-ic(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nb.5 b/src/static/support/dist-docs-branch-23.06/ovn-nb.5 new file mode 100644 index 00000000..c098c2f9 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-nb.5 @@ -0,0 +1,3665 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-nb" 5 " DB Schema 7.0.4" "Open vSwitch 23.06.3" "Open vSwitch Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.SH NAME +ovn-nb \- OVN_Northbound database schema +.PP +.PP +.PP +.PP +This database is the interface between OVN and the cloud management system (CMS), such as OpenStack, running above it\[char46] The CMS produces almost all of the contents of the database\[char46] The \fBovn\-northd\fR program monitors the database contents, transforms it, and stores it into the \fBOVN_Southbound\fR database\[char46] +.PP +.PP +We generally speak of ``the\(cq\(cq CMS, but one can imagine scenarios in which multiple CMSes manage different parts of an OVN deployment\[char46] +.SS "External IDs" +.PP +.PP +Each of the tables in this database contains a special column, named \fBexternal_ids\fR\[char46] This column has the same form and purpose each place it appears\[char46] +.RS +.TP +\fBexternal_ids\fR: map of string-string pairs +Key-value pairs for use by the CMS\[char46] The CMS might use certain pairs, for example, to identify entities in its own configuration that correspond to those in this database\[char46] +.RE +.SH "TABLE SUMMARY" +.PP +The following list summarizes the purpose of each of the tables in the +\fBOVN_Northbound\fR database. Each table is described in more detail on a later +page. +.IP "Table" 1in +Purpose +.TQ 1in +\fBNB_Global\fR +Northbound configuration +.TQ 1in +\fBCopp\fR +Control plane protection +.TQ 1in +\fBLogical_Switch\fR +L2 logical switch +.TQ 1in +\fBLogical_Switch_Port\fR +L2 logical switch port +.TQ 1in +\fBForwarding_Group\fR +forwarding group +.TQ 1in +\fBAddress_Set\fR +Address Sets +.TQ 1in +\fBPort_Group\fR +Port Groups +.TQ 1in +\fBLoad_Balancer\fR +load balancer +.TQ 1in +\fBLoad_Balancer_Group\fR +load balancer group +.TQ 1in +\fBLoad_Balancer_Health_Check\fR +load balancer +.TQ 1in +\fBACL\fR +Access Control List (ACL) rule +.TQ 1in +\fBLogical_Router\fR +L3 logical router +.TQ 1in +\fBQoS\fR +QoS rule +.TQ 1in +\fBMirror\fR +Mirror Entry +.TQ 1in +\fBMeter\fR +Meter entry +.TQ 1in +\fBMeter_Band\fR +Band for meter entries +.TQ 1in +\fBLogical_Router_Port\fR +L3 logical router port +.TQ 1in +\fBLogical_Router_Static_Route\fR +Logical router static routes +.TQ 1in +\fBLogical_Router_Policy\fR +Logical router policies +.TQ 1in +\fBNAT\fR +NAT rules +.TQ 1in +\fBDHCP_Options\fR +DHCP options +.TQ 1in +\fBConnection\fR +OVSDB client connections\[char46] +.TQ 1in +\fBDNS\fR +Native DNS resolution +.TQ 1in +\fBSSL\fR +SSL configuration\[char46] +.TQ 1in +\fBGateway_Chassis\fR +Gateway_Chassis configuration\[char46] +.TQ 1in +\fBHA_Chassis_Group\fR +HA_Chassis_Group configuration\[char46] +.TQ 1in +\fBHA_Chassis\fR +HA_Chassis configuration\[char46] +.TQ 1in +\fBBFD\fR +BFD configuration\[char46] +.TQ 1in +\fBStatic_MAC_Binding\fR +Static_MAC_Binding configuration\[char46] +.TQ 1in +\fBChassis_Template_Var\fR +Chassis_Template_Var configuration\[char46] +.\" check if in troff mode (TTY) +.if t \{ +.bp +.SH "TABLE RELATIONSHIPS" +.PP +The following diagram shows the relationship among tables in the +database. Each node represents a table. Tables that are part of the +``root set'' are shown with double borders. Each edge leads from the +table that contains it and points to the table that its value +represents. Edges are labeled with their column names, followed by a +constraint on the number of allowed values: \fB?\fR for zero or one, +\fB*\fR for zero or more, \fB+\fR for one or more. Thick lines +represent strong references; thin lines represent weak references. +.RS -1in +.ps -3 +.PS +linethick = 1; +linethick = 0.500000; +box at 0.297039,0.190275 wid 0.330865 height 0.152220 "NB_Global" +box at 0.297039,0.190275 wid 0.275310 height 0.096664 +linethick = 1.000000; +box at 1.636365,0.304440 wid 0.330865 height 0.152220 "Connection" +linethick = 1.000000; +box at 1.636365,0.076110 wid 0.228330 height 0.152220 "SSL" +linethick = 0.500000; +box at 1.636365,2.131080 wid 0.228330 height 0.152220 "Copp" +box at 1.636365,2.131080 wid 0.172774 height 0.096664 +linethick = 0.500000; +box at 0.297039,1.357285 wid 0.432335 height 0.152220 "Logical_Switch" +box at 0.297039,1.357285 wid 0.376780 height 0.096664 +linethick = 1.000000; +box at 1.636365,0.549697 wid 0.559195 height 0.152220 "Logical_Switch_Port" +linethick = 1.000000; +box at 1.636365,0.778027 wid 0.228330 height 0.152220 "ACL" +linethick = 1.000000; +box at 1.636365,1.234687 wid 0.228330 height 0.152220 "QoS" +linethick = 0.500000; +box at 2.880550,2.570813 wid 0.419671 height 0.152220 "Load_Balancer" +box at 2.880550,2.570813 wid 0.364115 height 0.096664 +linethick = 0.500000; +box at 1.636365,2.570813 wid 0.594084 height 0.152220 "Load_Balancer_Group" +box at 1.636365,2.570813 wid 0.538529 height 0.096664 +linethick = 0.500000; +box at 1.636365,1.006357 wid 0.228330 height 0.152220 "DNS" +box at 1.636365,1.006357 wid 0.172774 height 0.096664 +linethick = 1.000000; +box at 1.636365,1.463017 wid 0.511642 height 0.152220 "Forwarding_Group" +linethick = 0.500000; +box at 2.880550,0.663862 wid 0.429169 height 0.152220 "DHCP_Options" +box at 2.880550,0.663862 wid 0.373614 height 0.096664 +linethick = 0.500000; +box at 2.880550,0.393245 wid 0.228330 height 0.152220 "Mirror" +box at 2.880550,0.393245 wid 0.172774 height 0.096664 +linethick = 0.500000; +box at 4.132773,1.446090 wid 0.530669 height 0.152220 "HA_Chassis_Group" +box at 4.132773,1.446090 wid 0.475114 height 0.096664 +linethick = 0.500000; +box at 2.880550,1.577182 wid 0.356225 height 0.152220 "Address_Set" +box at 2.880550,1.577182 wid 0.300670 height 0.096664 +linethick = 0.500000; +box at 0.297039,0.617343 wid 0.340394 height 0.152220 "Port_Group" +box at 0.297039,0.617343 wid 0.284839 height 0.096664 +linethick = 1.000000; +box at 4.132773,2.570813 wid 0.774830 height 0.152220 "Load_Balancer_Health_Check" +linethick = 0.500000; +box at 0.297039,3.467267 wid 0.228330 height 0.152220 "Meter" +box at 0.297039,3.467267 wid 0.172774 height 0.096664 +linethick = 1.000000; +box at 1.636365,3.467267 wid 0.356225 height 0.152220 "Meter_Band" +linethick = 0.500000; +box at 0.297039,2.570813 wid 0.429169 height 0.152220 "Logical_Router" +box at 0.297039,2.570813 wid 0.373614 height 0.096664 +linethick = 1.000000; +box at 2.880550,1.847768 wid 0.556029 height 0.152220 "Logical_Router_Port" +linethick = 1.000000; +box at 1.636365,3.238937 wid 0.752637 height 0.152220 "Logical_Router_Static_Route" +linethick = 1.000000; +box at 1.636365,3.010577 wid 0.603583 height 0.152220 "Logical_Router_Policy" +linethick = 1.000000; +box at 1.636365,1.691347 wid 0.228330 height 0.152220 "NAT" +linethick = 1.000000; +box at 4.132773,1.847768 wid 0.473587 height 0.152220 "Gateway_Chassis" +linethick = 0.500000; +box at 2.880550,3.238937 wid 0.228330 height 0.152220 "BFD" +box at 2.880550,3.238937 wid 0.172774 height 0.096664 +linethick = 1.000000; +box at 5.123116,1.446090 wid 0.356225 height 0.152220 "HA_Chassis" +linethick = 0.500000; +box at 0.297039,3.695597 wid 0.568724 height 0.152220 "Static_MAC_Binding" +box at 0.297039,3.695597 wid 0.513169 height 0.096664 +linethick = 0.500000; +box at 0.297039,3.923927 wid 0.594084 height 0.152220 "Chassis_Template_Var" +box at 0.297039,3.923927 wid 0.538529 height 0.096664 +linethick = 1.000000; +spline -> from 0.464454,0.204273 to 0.464454,0.204273 to 0.720579,0.226245 to 1.214046,0.268574 to 1.469684,0.290506 +"connections*" at 0.927050,0.296512 +linethick = 1.000000; +spline -> from 0.464545,0.169546 to 0.464545,0.169546 to 0.528599,0.161819 to 0.602791,0.153374 to 0.670194,0.146935 to 0.977740,0.117560 to 1.341637,0.093740 to 1.520921,0.082725 +"ssl?" at 0.927050,0.178119 +linethick = 0.500000; +spline -> from 0.358539,1.434552 to 0.358539,1.434552 to 0.424237,1.517146 to 0.539772,1.645285 to 0.670194,1.712475 to 0.876696,1.818877 to 1.004013,1.661755 to 1.183937,1.808678 to 1.253471,1.865456 to 1.195384,1.933498 to 1.260047,1.995787 to 1.331347,2.064438 to 1.440153,2.098657 to 1.521743,2.115462 +"copp?" at 0.927050,1.835621 +linethick = 1.000000; +spline -> from 0.336924,1.279166 to 0.336924,1.279166 to 0.423354,1.090535 to 0.639233,0.624132 to 0.670194,0.603583 to 0.778727,0.531583 to 1.111267,0.527229 to 1.355062,0.534871 +"ports*" at 0.927050,0.634788 +linethick = 1.000000; +spline -> from 0.357352,1.280322 to 0.357352,1.280322 to 0.422806,1.196297 to 0.538950,1.064231 to 0.670194,0.992596 to 0.951071,0.839311 to 1.334878,0.795471 to 1.521378,0.782959 +"acls*" at 0.927050,1.019570 +linethick = 1.000000; +spline -> from 0.513712,1.328059 to 0.513712,1.328059 to 0.564888,1.321513 to 0.619444,1.314968 to 0.670194,1.309731 to 0.977618,1.277948 to 1.341576,1.252984 to 1.520891,1.241537 +"qos_rules*" at 0.927050,1.336674 +linethick = 0.500000; +spline -> from 0.500804,1.435374 to 0.500804,1.435374 to 0.742499,1.530724 to 1.124814,1.684406 to 1.183937,1.725170 to 1.224427,1.753087 to 1.216999,1.781674 to 1.260047,1.805512 to 1.558581,1.970671 to 1.699536,1.821221 to 2.012683,1.956666 to 2.330153,2.093969 to 2.647106,2.360810 to 2.793085,2.492907 +"load_balancer*" at 1.636365,1.983609 +linethick = 1.000000; +spline -> from 0.320332,1.435161 to 0.320332,1.435161 to 0.359513,1.577486 to 0.463358,1.878425 to 0.670194,2.025378 to 0.859008,2.159515 to 1.015094,1.954535 to 1.183937,2.113118 to 1.291252,2.213918 to 1.162200,2.325495 to 1.260047,2.435520 to 1.281966,2.460180 to 1.308757,2.480334 to 1.337801,2.496834 +"load_balancer_group*" at 0.927050,2.140061 +linethick = 0.500000; +spline -> from 0.448714,1.279135 to 0.448714,1.279135 to 0.514899,1.246712 to 0.594937,1.211123 to 0.670194,1.187103 to 0.969672,1.091509 to 1.338653,1.039693 to 1.520312,1.018291 +"dns_records*" at 0.927050,1.214046 +linethick = 1.000000; +spline -> from 0.515082,1.374273 to 0.515082,1.374273 to 0.750597,1.392996 to 1.128955,1.423044 to 1.379052,1.442893 +"forwarding_groups*" at 0.927050,1.455071 +linethick = 0.500000; +spline -> from 1.917637,0.529269 to 1.917637,0.529269 to 2.093147,0.521567 to 2.324339,0.521201 to 2.526426,0.552863 to 2.572396,0.560048 to 2.620589,0.572165 to 2.666012,0.585834 +"dhcpv4_options?" at 2.307625,0.584038 +linethick = 0.500000; +spline -> from 1.917546,0.592227 to 1.917546,0.592227 to 1.974111,0.599990 to 2.033294,0.607388 to 2.088793,0.613112 to 2.283696,0.633144 to 2.506576,0.646631 to 2.665372,0.654637 +"dhcpv6_options?" at 2.307625,0.677075 +linethick = 0.500000; +spline -> from 1.918002,0.482416 to 1.918002,0.482416 to 1.974263,0.470573 to 2.033233,0.459491 to 2.088793,0.451363 to 2.328235,0.416443 to 2.611852,0.402043 to 2.764924,0.396472 +"mirror_rules*" at 2.307625,0.482568 +linethick = 1.000000; +spline -> from 1.917424,0.622214 to 1.917424,0.622214 to 1.950243,0.634423 to 1.982696,0.648275 to 2.012683,0.663862 to 2.050708,0.683620 to 2.051195,0.702465 to 2.088793,0.723045 to 2.688571,1.051384 to 3.466354,1.278313 to 3.866084,1.382066 +"ha_chassis_group?" at 2.880550,1.197149 +linethick = 1.000000; +spline -> from 3.091588,2.570813 to 3.091588,2.570813 to 3.268772,2.570813 to 3.528460,2.570813 to 3.744003,2.570813 +"health_check*" at 3.452045,2.600953 +linethick = 0.500000; +spline -> from 1.935021,2.570813 to 1.935021,2.570813 to 2.161311,2.570813 to 2.468217,2.570813 to 2.669178,2.570813 +"load_balancer*" at 2.307625,2.600953 +linethick = 1.000000; +spline -> from 4.400071,1.446090 to 4.400071,1.446090 to 4.572080,1.446090 to 4.792494,1.446090 to 4.943497,1.446090 +"ha_chassis*" at 4.732520,1.476230 +linethick = 0.500000; +spline -> from 0.451363,0.539194 to 0.451363,0.539194 to 0.516726,0.509389 to 0.595363,0.478975 to 0.670194,0.464058 to 0.898737,0.418483 to 1.162687,0.447618 to 1.356219,0.483816 +"ports*" at 0.927050,0.495233 +linethick = 1.000000; +spline -> from 0.468016,0.648518 to 0.468016,0.648518 to 0.531187,0.659691 to 0.603857,0.671716 to 0.670194,0.680758 to 0.977039,0.722588 to 1.341241,0.754646 to 1.520739,0.769289 +"acls*" at 0.927050,0.765849 +linethick = 1.000000; +spline -> from 0.412455,3.467267 to 0.412455,3.467267 to 0.643921,3.467267 to 1.179066,3.467267 to 1.457202,3.467267 +"bands+" at 0.927050,3.497407 +linethick = 0.500000; +spline -> from 0.373974,2.493729 to 0.373974,2.493729 to 0.443265,2.425321 to 0.554020,2.328692 to 0.670194,2.278003 to 0.747218,2.244423 to 1.285772,2.174280 to 1.521774,2.144688 +"copp?" at 0.927050,2.304976 +linethick = 0.500000; +spline -> from 0.513042,2.619767 to 0.513042,2.619767 to 0.564249,2.630148 to 0.618987,2.640043 to 0.670194,2.646923 to 1.487798,2.757100 to 1.709979,2.765381 to 2.526426,2.646923 to 2.573188,2.640165 to 2.623025,2.630696 to 2.669969,2.620741 +"load_balancer*" at 1.636365,2.761636 +linethick = 1.000000; +spline -> from 0.513621,2.570813 to 0.513621,2.570813 to 0.736349,2.570813 to 1.088038,2.570813 to 1.337557,2.570813 +"load_balancer_group*" at 0.927050,2.600953 +linethick = 1.000000; +spline -> from 0.512342,2.532088 to 0.512342,2.532088 to 0.954115,2.450803 to 1.941292,2.268078 to 2.012683,2.245245 to 2.277577,2.160489 to 2.567921,2.015119 to 2.735454,1.925644 +"ports*" at 1.636365,2.419141 +linethick = 1.000000; +spline -> from 0.336376,2.648171 to 0.336376,2.648171 to 0.390962,2.758896 to 0.507106,2.960375 to 0.670194,3.061449 to 0.845278,3.169829 to 1.070320,3.215191 to 1.258677,3.233153 +"static_routes*" at 0.927050,3.252028 +linethick = 1.000000; +spline -> from 0.377018,2.648993 to 0.377018,2.648993 to 0.446705,2.715848 to 0.556212,2.808885 to 0.670194,2.858357 to 0.880349,2.949567 to 1.137540,2.986861 to 1.333082,3.001778 +"policies*" at 0.927050,3.015326 +linethick = 1.000000; +spline -> from 0.325203,2.493150 to 0.325203,2.493150 to 0.370047,2.361663 to 0.479706,2.096678 to 0.670194,1.965130 to 0.861322,1.833094 to 0.965410,1.947716 to 1.183937,1.868927 to 1.220348,1.855805 to 1.224823,1.842684 to 1.260047,1.826640 to 1.345716,1.787550 to 1.446273,1.751565 to 1.521226,1.726540 +"nat*" at 0.927050,1.992073 +linethick = 1.000000; +spline -> from 3.125990,1.769862 to 3.125990,1.769862 to 3.345491,1.699019 to 3.667284,1.595022 to 3.886785,1.524148 +"ha_chassis_group?" at 3.452045,1.755279 +linethick = 1.000000; +spline -> from 3.159174,1.847768 to 3.159174,1.847768 to 3.379588,1.847768 to 3.685551,1.847768 to 3.894396,1.847768 +"gateway_chassis*" at 3.452045,1.877908 +linethick = 0.500000; +spline -> from 2.014693,3.238937 to 2.014693,3.238937 to 2.272584,3.238937 to 2.597878,3.238937 to 2.765411,3.238937 +"bfd?" at 2.307625,3.269077 +linethick = 1.000000; +spline -> from 1.751474,1.662851 to 1.751474,1.662851 to 1.826396,1.642271 to 1.926923,1.612040 to 2.012683,1.577182 to 2.047907,1.562843 to 2.051834,1.547012 to 2.088793,1.538061 to 2.277851,1.492334 to 2.332224,1.527223 to 2.526426,1.538061 to 2.583173,1.541227 to 2.644883,1.547255 to 2.700444,1.553649 +"allowed_ext_ips?" at 2.307625,1.565004 +linethick = 1.000000; +spline -> from 1.752448,1.680996 to 1.752448,1.680996 to 1.968113,1.661086 to 2.442887,1.617216 to 2.700961,1.593378 +"exempted_ext_ips?" at 2.307625,1.674938 +linethick = 0.500000; +spline -> from 1.752448,1.705503 to 1.752448,1.705503 to 1.942540,1.729554 to 2.334050,1.779117 to 2.600922,1.812910 +"gateway_port?" at 2.307625,1.831389 +.ps +3 +.PE +.RE\} +.bp +.SH "NB_Global TABLE" +.PP +.PP +.PP +Northbound configuration for an OVN system\[char46] This table must have exactly one row\[char46] +.SS "Summary: +.TQ .25in +\fIIdentity:\fR +.RS .25in +.TQ 2.75in +\fBname\fR +string +.RE +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBnb_cfg\fR +integer +.TQ 2.75in +\fBnb_cfg_timestamp\fR +integer +.TQ 2.75in +\fBsb_cfg\fR +integer +.TQ 2.75in +\fBsb_cfg_timestamp\fR +integer +.TQ 2.75in +\fBhv_cfg\fR +integer +.TQ 2.75in +\fBhv_cfg_timestamp\fR +integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fICommon options:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fIOptions for configuring OVS BFD:\fR +.RS .25in +.TQ 2.50in +\fBoptions : bfd-min-rx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-decay-min-rx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-min-tx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-mult\fR +optional string +.RE +.TQ 2.75in +\fBoptions : mac_prefix\fR +optional string +.TQ 2.75in +\fBoptions : mac_binding_removal_limit\fR +optional string, containing an integer, in range 0 to 4,294,967,295 +.TQ 2.75in +\fBoptions : controller_event\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : northd_probe_interval\fR +optional string +.TQ 2.75in +\fBoptions : ic_probe_interval\fR +optional string +.TQ 2.75in +\fBoptions : nbctl_probe_interval\fR +optional string +.TQ 2.75in +\fBoptions : northd_trim_timeout\fR +optional string +.TQ 2.75in +\fBoptions : use_logical_dp_groups\fR +optional string +.TQ 2.75in +\fBoptions : use_parallel_build\fR +optional string +.TQ 2.75in +\fBoptions : ignore_lsp_down\fR +optional string +.TQ 2.75in +\fBoptions : use_ct_inv_match\fR +optional string +.TQ 2.75in +\fBoptions : default_acl_drop\fR +optional string +.TQ 2.75in +\fBoptions : debug_drop_domain_id\fR +optional string +.TQ 2.75in +\fBoptions : debug_drop_collector_set\fR +optional string +.TQ 2.75in +\fBoptions : use_common_zone\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ .25in +\fIOptions for configuring interconnection route advertisement:\fR +.RS .25in +.TQ 2.50in +\fBoptions : ic-route-adv\fR +optional string +.TQ 2.50in +\fBoptions : ic-route-learn\fR +optional string +.TQ 2.50in +\fBoptions : ic-route-adv-default\fR +optional string +.TQ 2.50in +\fBoptions : ic-route-learn-default\fR +optional string +.TQ 2.50in +\fBoptions : ic-route-blacklist\fR +optional string +.RE +.RE +.TQ .25in +\fIConnection Options:\fR +.RS .25in +.TQ 2.75in +\fBconnections\fR +set of \fBConnection\fRs +.TQ 2.75in +\fBssl\fR +optional \fBSSL\fR +.RE +.TQ .25in +\fISecurity Configurations:\fR +.RS .25in +.TQ 2.75in +\fBipsec\fR +boolean +.RE +.TQ .25in +\fIRead-only Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : max_tunid\fR +optional string +.RE +.SS "Details: +.ST "Identity:" +.PP +.IP "\fBname\fR: string" +The name of the OVN cluster, which uniquely identifies the OVN cluster throughout all OVN clusters supposed to interconnect with each other\[char46] +.ST "Status:" +.PP +These columns allow a client to track the overall configuration state of the system\[char46] +.IP "\fBnb_cfg\fR: integer" +Sequence number for client to increment\[char46] When a client modifies any part of the northbound database configuration and wishes to wait for \fBovn\-northd\fR and possibly all of the hypervisors to finish applying the changes, it may increment this sequence number\[char46] +.IP "\fBnb_cfg_timestamp\fR: integer" +The timestamp, in milliseconds since the epoch, when \fBovn\-northd\fR sees the latest \fBnb_cfg\fR and starts processing\[char46] +.IP +To print the timestamp as a human-readable date: +.IP +.nf +\fB +.br +\fB date \-d \(dq@$(ovn\-nbctl get NB_Global \[char46] nb_cfg_timestamp | sed \(cqs/\[char46]\[char46]\[char46]$//\(cq)\(dq +.br +\fB \fR +.fi +.IP "\fBsb_cfg\fR: integer" +Sequence number that \fBovn\-northd\fR sets to the value of \fBnb_cfg\fR after it finishes applying the corresponding configuration changes to the \fBOVN_Southbound\fR database\[char46] +.IP "\fBsb_cfg_timestamp\fR: integer" +The timestamp, in milliseconds since the epoch, when \fBovn\-northd\fR finishes applying the corresponding configuration changes to the \fBOVN_Southbound\fR database successfully\[char46] +.IP "\fBhv_cfg\fR: integer" +Sequence number that \fBovn\-northd\fR sets to the smallest sequence number of all the chassis in the system, as reported in the \fBChassis_Private\fR table in the southbound database\[char46] Thus, \fBhv_cfg\fR equals \fBnb_cfg\fR if all chassis are caught up with the northbound configuration (which may never happen, if any chassis is down)\[char46] This value can regress, if a chassis was removed from the system and rejoins before catching up\[char46] +.IP +If there are no chassis, then \fBovn\-northd\fR copies \fBnb_cfg\fR to \fBhv_cfg\fR\[char46] Thus, in this case, the (nonexistent) hypervisors are always considered to be caught up\[char46] This means that hypervisors can be \(dqcaught up\(dq even in cases where \fBsb_cfg\fR would show that the southbound database is not\[char46] To detect when both the hypervisors and the southbound database are caught up, a client should take the smaller of \fBsb_cfg\fR and \fBhv_cfg\fR\[char46] +.IP "\fBhv_cfg_timestamp\fR: integer" +The largest timestamp, in milliseconds since the epoch, of the smallest sequence number of all the chassis in the system, as reported in the \fBChassis_Private\fR table in the southbound database\[char46] In other words, this timestamp reflects the time when the slowest chassis catches up with the northbound configuration, which is useful for end-to-end control plane latency measurement\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Common options:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides general key/value settings\[char46] The supported options are described individually below\[char46] +.ST "Options for configuring OVS BFD:" +.PP +.PP +.PP +These options apply when \fBovn\-controller\fR configures OVS BFD on tunnels interfaces\[char46] Please note these parameters refer to legacy OVS BFD implementation and not to OVN BFD one\[char46] +.IP "\fBoptions : bfd-min-rx\fR: optional string" +BFD option \fBmin\-rx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-decay-min-rx\fR: optional string" +BFD option \fBdecay\-min\-rx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-min-tx\fR: optional string" +BFD option \fBmin\-tx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-mult\fR: optional string" +BFD option \fBmult\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : mac_prefix\fR: optional string" +Configure a given OUI to be used as prefix when L2 address is dynamically assigned, e\[char46]g\[char46] \fB00:11:22\fR +.IP "\fBoptions : mac_binding_removal_limit\fR: optional string, containing an integer, in range 0 to 4,294,967,295" +MAC binding aging bulk removal limit\[char46] This limits how many rows can expire in a single transaction\[char46] Default value is 0 which is unlimited\[char46] When we hit the limit next batch removal is delayed by 5 s\[char46] +.IP "\fBoptions : controller_event\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Value set by the CMS to enable/disable ovn-controller event reporting\[char46] Traffic into OVS can raise a \(cqcontroller\(cq event that results in a Controller_Event being written to the \fBController_Event\fR table in SBDB\[char46] When the CMS has seen the event and taken appropriate action, it can remove the corresponding row in \fBController_Event\fR table\[char46] The intention is for a CMS to see the events and take some sort of action\[char46] Please see the \fBController_Event\fR table in SBDB\[char46] It is possible to associate a meter to each controller event type in order to not overload the pinctrl thread under heavy load\[char46] Each event type relies on a meter with a defined name: +.RS +.IP \(bu +empty_lb_backends: event-elb +.RE +.IP "\fBoptions : northd_probe_interval\fR: optional string" +The inactivity probe interval of the connection to the OVN Northbound and Southbound databases from \fBovn\-northd\fR, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.IP "\fBoptions : ic_probe_interval\fR: optional string" +The inactivity probe interval of the connection to the OVN Northbound and Southbound databases from \fBovn\-ic\fR, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.IP "\fBoptions : nbctl_probe_interval\fR: optional string" +The inactivity probe interval of the connection to the OVN Northbound database from \fBovn\-nbctl\fR utility, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.IP +If the value is less than zero, then the default inactivity probe interval for \fBovn\-nbctl\fR would be left intact (120000 ms)\[char46] +.IP "\fBoptions : northd_trim_timeout\fR: optional string" +When used, this configuration value specifies the time, in milliseconds, since the last \fBovn\-northd\fR active operation after which memory trimming is performed\[char46] By default this is set to 30000 (30 seconds)\[char46] +.IP "\fBoptions : use_logical_dp_groups\fR: optional string" +Note: This option is deprecated, the only behavior is to always combine logical flows by datapath groups\[char46] Changing the value or removing this option all toghether will have no effect\[char46] +.IP +\fBovn\-northd\fR combines logical flows that differs only by logical datapath into a single logical flow with logical datapath group attached\[char46] +.IP "\fBoptions : use_parallel_build\fR: optional string" +If set to \fBtrue\fR, \fBovn\-northd\fR will attempt to compute logical flows in parallel\[char46] +.IP +Parallel computation is enabled only if the system has 4 or more cores/threads available to be used by ovn-northd\[char46] +.IP +The default value is \fBfalse\fR\[char46] +.IP "\fBoptions : ignore_lsp_down\fR: optional string" +If set to false, ARP/ND reply flows for logical switch ports will be installed only if the port is up, i\[char46]e\[char46] claimed by a Chassis\[char46] If set to true, these flows are installed regardless of the status of the port, which can result in a situation that ARP request to an IP is resolved even before the relevant VM/container is running\[char46] For environments where this is not an issue, setting it to \fBtrue\fR can reduce the load and latency of the control plane\[char46] The default value is \fBtrue\fR\[char46] +.IP "\fBoptions : use_ct_inv_match\fR: optional string" +If set to false, \fBovn\-northd\fR will not use the \fBct\[char46]inv\fR field in any of the logical flow matches\[char46] The default value is true\[char46] If the NIC supports offloading OVS datapath flows but doesn\(cqt support offloading ct_state \fBinv\fR flag, then the datapath flows matching on this flag (either \fB+inv\fR or \fB\-inv\fR) will not be offloaded\[char46] CMS should consider setting \fBuse_ct_inv_match\fR to \fBfalse\fR in such cases\[char46] This results in a side effect of the invalid packets getting delivered to the destination VIF, which otherwise would have been dropped by \fBOVN\fR\[char46] +.IP "\fBoptions : default_acl_drop\fR: optional string" +If set to \fBtrue\fR\[char46], \fBovn\-northd\fR will generate a logical flow to drop all traffic in the ACL stages\[char46] By default this option is set to \fBfalse\fR\[char46] +.IP "\fBoptions : debug_drop_domain_id\fR: optional string" +If set to a 8-bit number and if \fBdebug_drop_collector_set\fR is also configured, \fBovn\-northd\fR will add a \fBsample\fR action to every logical flow that contains a \(cqdrop\(cq action\[char46] The 8 most significant bits of the observation_domain_id field will be those specified in the \fB debug_drop_domain_id\fR\[char46] The 24 least significant bits of the observation_domain_id field will be the datapath\(cqs key\[char46] +.IP +The observation_point_id will be set to the first 32 bits of the logical flow\(cqs UUID\[char46] +.IP "\fBoptions : debug_drop_collector_set\fR: optional string" +If set to a 32-bit number \fBovn\-northd\fR will add a \fBsample\fR action to every logical flow that contains a \(cqdrop\(cq action\[char46] The sample action will have the specified collector_set_id\[char46] The value must match that of the local OVS configuration as described in \fBovs\-actions\fR(7)\[char46] +.IP "\fBoptions : use_common_zone\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Default value is \fBfalse\fR\[char46] If set to \fBtrue\fR the SNAT and DNAT happens in common zone, instead of happening in separate zones, depending on the configuration\[char46] However, this option breaks traffic when there is configuration of DGP + LB + SNAT on this LR\[char46] The value \fBtrue\fR should be used only in case of HWOL compatibility with GDP\[char46] +.ST "Options for configuring interconnection route advertisement:" +.PP +.PP +.PP +These options control how routes are advertised between OVN deployments for interconnection\[char46] If enabled, \fBovn\-ic\fR from different OVN deployments exchanges routes between each other through the global \fBOVN_IC_Southbound\fR database\[char46] Only routers with ports connected to interconnection transit switches participate in route advertisement\[char46] For each of these routers, there are two types of routes to be advertised: +.PP +.PP +Firstly, the static routes configured in the router are advertised\[char46] +.PP +.PP +Secondly, the \fBnetworks\fR configured in the logical router ports that are not on the transit switches are advertised\[char46] These are considered as directly connected subnets on the router\[char46] +.PP +.PP +Link local prefixes (IPv4 169\[char46]254\[char46]0\[char46]0/16 and IPv6 FE80::/10) are never advertised\[char46] +.PP +.PP +The learned routes are added to the \fBstatic_routes\fR column of the \fBLogical_Router\fR table, with \fBexternal_ids:ic\-learned\-route\fR set to the uuid of the row in \fBRoute\fR table of the \fBOVN_IC_Southbound\fR database\[char46] +.IP "\fBoptions : ic-route-adv\fR: optional string" +A boolean value that enables route advertisement to the global \fBOVN_IC_Southbound\fR database\[char46] Default is \fBfalse\fR\[char46] +.IP "\fBoptions : ic-route-learn\fR: optional string" +A boolean value that enables route learning from the global \fBOVN_IC_Southbound\fR database\[char46] Default is \fBfalse\fR\[char46] +.IP "\fBoptions : ic-route-adv-default\fR: optional string" +A boolean value that enables advertising default route to the global \fBOVN_IC_Southbound\fR database\[char46] Default is \fBfalse\fR\[char46] This option takes effect only when option \fBic\-route\-adv\fR is \fBtrue\fR\[char46] +.IP "\fBoptions : ic-route-learn-default\fR: optional string" +A boolean value that enables learning default route from the global \fBOVN_IC_Southbound\fR database\[char46] Default is \fBfalse\fR\[char46] This option takes effect only when option \fBic\-route\-learn\fR is \fBtrue\fR\[char46] +.IP "\fBoptions : ic-route-blacklist\fR: optional string" +A string value contains a list of CIDRs delimited by \(dq,\(dq\[char46] A route will not be advertised or learned if the route\(cqs prefix belongs to any of the CIDRs listed\[char46] +.ST "Connection Options:" +.PP +.IP "\fBconnections\fR: set of \fBConnection\fRs" +Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured\[char46] See the \fBConnection\fR table for more information\[char46] +.IP "\fBssl\fR: optional \fBSSL\fR" +Global SSL configuration\[char46] +.ST "Security Configurations:" +.PP +.IP "\fBipsec\fR: boolean" +Tunnel encryption configuration\[char46] If this column is set to be true, all OVN tunnels will be encrypted with IPsec\[char46] +.ST "Read-only Options:" +.PP +.IP "\fBoptions : max_tunid\fR: optional string" +The maximum supported tunnel ID\[char46] Depends on types of encapsulation enabled in the cluster\[char46] +.bp +.SH "Copp TABLE" +.PP +.PP +.PP +This table is used to define control plane protection policies, i\[char46]e\[char46], associate entries from table \fBMeter\fR to control protocol names\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBmeters : arp\fR +optional string +.TQ 3.00in +\fBmeters : arp-resolve\fR +optional string +.TQ 3.00in +\fBmeters : dhcpv4-opts\fR +optional string +.TQ 3.00in +\fBmeters : dhcpv6-opts\fR +optional string +.TQ 3.00in +\fBmeters : dns\fR +optional string +.TQ 3.00in +\fBmeters : event-elb\fR +optional string +.TQ 3.00in +\fBmeters : icmp4-error\fR +optional string +.TQ 3.00in +\fBmeters : icmp6-error\fR +optional string +.TQ 3.00in +\fBmeters : igmp\fR +optional string +.TQ 3.00in +\fBmeters : nd-na\fR +optional string +.TQ 3.00in +\fBmeters : nd-ns\fR +optional string +.TQ 3.00in +\fBmeters : nd-ns-resolve\fR +optional string +.TQ 3.00in +\fBmeters : nd-ra-opts\fR +optional string +.TQ 3.00in +\fBmeters : tcp-reset\fR +optional string +.TQ 3.00in +\fBmeters : bfd\fR +optional string +.TQ 3.00in +\fBmeters : reject\fR +optional string +.TQ 3.00in +\fBmeters : svc-monitor\fR +optional string +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +CoPP name\[char46] +.IP "\fBmeters : arp\fR: optional string" +Rate limiting meter for ARP packets (request/reply) used for learning neighbors\[char46] +.IP "\fBmeters : arp-resolve\fR: optional string" +Rate limiting meter for packets that require resolving the next-hop (through ARP)\[char46] +.IP "\fBmeters : dhcpv4-opts\fR: optional string" +Rate limiting meter for packets that require adding DHCPv4 options\[char46] +.IP "\fBmeters : dhcpv6-opts\fR: optional string" +Rate limiting meter for packets that require adding DHCPv6 options\[char46] +.IP "\fBmeters : dns\fR: optional string" +Rate limiting meter for DNS query packets that need to be replied to\[char46] +.IP "\fBmeters : event-elb\fR: optional string" +Rate limiting meter for empty load balancer events\[char46] +.IP "\fBmeters : icmp4-error\fR: optional string" +Rate limiting meter for packets that require replying with an ICMP error\[char46] +.IP "\fBmeters : icmp6-error\fR: optional string" +Rate limiting meter for packets that require replying with an ICMPv6 error\[char46] +.IP "\fBmeters : igmp\fR: optional string" +Rate limiting meter for IGMP packets\[char46] +.IP "\fBmeters : nd-na\fR: optional string" +Rate limiting meter for ND neighbor advertisement packets used for learning neighbors\[char46] +.IP "\fBmeters : nd-ns\fR: optional string" +Rate limiting meter for ND neighbor solicitation packets used for learning neighbors\[char46] +.IP "\fBmeters : nd-ns-resolve\fR: optional string" +Rate limiting meter for packets that require resolving the next-hop (through ND)\[char46] +.IP "\fBmeters : nd-ra-opts\fR: optional string" +Rate limiting meter for packets that require adding ND router advertisement options\[char46] +.IP "\fBmeters : tcp-reset\fR: optional string" +Rate limiting meter for packets that require replying with TCP RST packet\[char46] +.IP "\fBmeters : bfd\fR: optional string" +Rate limiting meter for BFD packets\[char46] +.IP "\fBmeters : reject\fR: optional string" +Rate limiting meter for packets that trigger a reject action +.IP "\fBmeters : svc-monitor\fR: optional string" +Rate limiting meter for packets that are arriving to service monitor MAC address\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Logical_Switch TABLE" +.PP +.PP +.PP +Each row represents one L2 logical switch\[char46] +.PP +.PP +There are two kinds of logical switches, that is, ones that fully virtualize the network (overlay logical switches) and ones that provide simple connectivity to physical networks (bridged logical switches)\[char46] They work in the same way when providing connectivity between logical ports on same chassis, but differently when connecting remote logical ports\[char46] Overlay logical switches connect remote logical ports by tunnels, while bridged logical switches provide connectivity to remote ports by bridging the packets to directly connected physical L2 segments with the help of \fBlocalnet\fR ports\[char46] Each bridged logical switch has one or more \fBlocalnet\fR ports, which have only one special address \fBunknown\fR\[char46] +.SS "Summary: +.TQ 3.00in +\fBports\fR +set of \fBLogical_Switch_Port\fRs +.TQ 3.00in +\fBload_balancer\fR +set of weak reference to \fBLoad_Balancer\fRs +.TQ 3.00in +\fBload_balancer_group\fR +set of \fBLoad_Balancer_Group\fRs +.TQ 3.00in +\fBacls\fR +set of \fBACL\fRs +.TQ 3.00in +\fBqos_rules\fR +set of \fBQoS\fRes +.TQ 3.00in +\fBdns_records\fR +set of weak reference to \fBDNS\fRes +.TQ 3.00in +\fBforwarding_groups\fR +set of \fBForwarding_Group\fRs +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.75in +\fBname\fR +string +.TQ 2.75in +\fBexternal_ids : neutron:network_name\fR +optional string +.RE +.TQ .25in +\fIIP Address Assignment:\fR +.RS .25in +.TQ 2.75in +\fBother_config : subnet\fR +optional string +.TQ 2.75in +\fBother_config : exclude_ips\fR +optional string +.TQ 2.75in +\fBother_config : ipv6_prefix\fR +optional string +.TQ 2.75in +\fBother_config : mac_only\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.TQ .25in +\fIIP Multicast Snooping Options:\fR +.RS .25in +.TQ 2.75in +\fBother_config : mcast_snoop\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBother_config : mcast_querier\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBother_config : mcast_flood_unregistered\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBother_config : mcast_table_size\fR +optional string, containing an integer, in range 1 to 32,766 +.TQ 2.75in +\fBother_config : mcast_idle_timeout\fR +optional string, containing an integer, in range 15 to 3,600 +.TQ 2.75in +\fBother_config : mcast_query_interval\fR +optional string, containing an integer, in range 1 to 3,600 +.TQ 2.75in +\fBother_config : mcast_query_max_response\fR +optional string, containing an integer, in range 1 to 10 +.TQ 2.75in +\fBother_config : mcast_eth_src\fR +optional string +.TQ 2.75in +\fBother_config : mcast_ip4_src\fR +optional string +.TQ 2.75in +\fBother_config : mcast_ip6_src\fR +optional string +.RE +.TQ .25in +\fIInterconnection:\fR +.RS .25in +.TQ 2.75in +\fBother_config : interconn-ts\fR +optional string +.RE +.TQ .25in +\fITunnel Key:\fR +.RS .25in +.TQ 2.75in +\fBother_config : requested-tnl-key\fR +optional string, containing an integer, in range 1 to 16,777,215 +.RE +.TQ 3.00in +\fBcopp\fR +optional weak reference to \fBCopp\fR +.TQ .25in +\fIOther options:\fR +.RS .25in +.TQ 2.75in +\fBother_config : vlan-passthru\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBother_config : broadcast-arps-to-all-routers\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBports\fR: set of \fBLogical_Switch_Port\fRs" +The logical ports connected to the logical switch\[char46] +.IP +It is an error for multiple logical switches to include the same logical port\[char46] +.IP "\fBload_balancer\fR: set of weak reference to \fBLoad_Balancer\fRs" +Set of load balancers associated to this logical switch\[char46] +.IP "\fBload_balancer_group\fR: set of \fBLoad_Balancer_Group\fRs" +Set of load balancers groups associated to this logical switch\[char46] +.IP "\fBacls\fR: set of \fBACL\fRs" +Access control rules that apply to packets within the logical switch\[char46] +.IP "\fBqos_rules\fR: set of \fBQoS\fRes" +QoS marking and metering rules that apply to packets within the logical switch\[char46] +.IP "\fBdns_records\fR: set of weak reference to \fBDNS\fRes" +This column defines the DNS records to be used for resolving internal DNS queries within the logical switch by the native DNS resolver\[char46] Please see the \fBDNS\fR table\[char46] +.IP "\fBforwarding_groups\fR: set of \fBForwarding_Group\fRs" +Groups a set of logical port endpoints for traffic going out of the logical switch\[char46] +.ST "Naming:" +.PP +.PP +.PP +These columns provide names for the logical switch\[char46] From OVN\(cqs perspective, these names have no special meaning or purpose other than to provide convenience for human interaction with the database\[char46] There is no requirement for the name to be unique\[char46] (For a unique identifier for a logical switch, use its row UUID\[char46]) +.PP +.PP +(Originally, \fBname\fR was intended to serve the purpose of a human-friendly name, but the Neutron integration used it to uniquely identify its own switch object, in the format \fBneutron\-\fIuuid\fB\fR\[char46] Later on, Neutron started propagating the friendly name of a switch as \fBexternal_ids:neutron:network_name\fR\[char46] Perhaps this can be cleaned up someday\[char46]) +.IP "\fBname\fR: string" +A name for the logical switch\[char46] +.IP "\fBexternal_ids : neutron:network_name\fR: optional string" +Another name for the logical switch\[char46] +.ST "IP Address Assignment:" +.PP +.PP +.PP +These options control automatic IP address management (IPAM) for ports attached to the logical switch\[char46] To enable IPAM for IPv4, set \fBother_config:subnet\fR and optionally \fBother_config:exclude_ips\fR\[char46] To enable IPAM for IPv6, set \fBother_config:ipv6_prefix\fR\[char46] IPv4 and IPv6 may be enabled together or separately\[char46] +.PP +.PP +To request dynamic address assignment for a particular port, use the \fBdynamic\fR keyword in the \fBaddresses\fR column of the port\(cqs \fBLogical_Switch_Port\fR row\[char46] This requests both an IPv4 and an IPv6 address, if IPAM for IPv4 and IPv6 are both enabled\[char46] +.IP "\fBother_config : subnet\fR: optional string" +Set this to an IPv4 subnet, e\[char46]g\[char46] \fB192\[char46]168\[char46]0\[char46]0/24\fR, to enable \fBovn\-northd\fR to automatically assign IP addresses within that subnet\[char46] +.IP "\fBother_config : exclude_ips\fR: optional string" +To exclude some addresses from automatic IP address management, set this to a list of the IPv4 addresses or \fB\[char46]\[char46]\fR-delimited ranges to exclude\[char46] The addresses or ranges should be a subset of those in \fBother_config:subnet\fR\[char46] +.IP +Whether listed or not, \fBovn\-northd\fR will never allocate the first or last address in a subnet, such as 192\[char46]168\[char46]0\[char46]0 or 192\[char46]168\[char46]0\[char46]255 in 192\[char46]168\[char46]0\[char46]0/24\[char46] +.IP +Examples: +.RS +.IP \(bu +\fB192\[char46]168\[char46]0\[char46]2 192\[char46]168\[char46]0\[char46]10\fR +.IP \(bu +\fB192\[char46]168\[char46]0\[char46]4 192\[char46]168\[char46]0\[char46]30\[char46]\[char46]192\[char46]168\[char46]0\[char46]60 192\[char46]168\[char46]0\[char46]110\[char46]\[char46]192\[char46]168\[char46]0\[char46]120\fR +.IP \(bu +\fB192\[char46]168\[char46]0\[char46]110\[char46]\[char46]192\[char46]168\[char46]0\[char46]120 192\[char46]168\[char46]0\[char46]25\[char46]\[char46]192\[char46]168\[char46]0\[char46]30 192\[char46]168\[char46]0\[char46]144\fR +.RE +.IP "\fBother_config : ipv6_prefix\fR: optional string" +Set this to an IPv6 prefix to enable \fBovn\-northd\fR to automatically assign IPv6 addresses using this prefix\[char46] The assigned IPv6 address will be generated using the IPv6 prefix and the MAC address (converted to an IEEE EUI64 identifier) of the port\[char46] The IPv6 prefix defined here should be a valid IPv6 address ending with \fB::\fR\[char46] +.IP +Examples: +.RS +.IP \(bu +\fBaef0::\fR +.IP \(bu +\fBbef0:1234:a890:5678::\fR +.IP \(bu +\fB8230:5678::\fR +.RE +.IP "\fBother_config : mac_only\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Value used to request to assign L2 address only if neither subnet nor ipv6_prefix are specified +.ST "IP Multicast Snooping Options:" +.PP +.PP +.PP +These options control IP Multicast Snooping configuration of the logical switch\[char46] To enable IP Multicast Snooping set \fBother_config:mcast_snoop\fR to true\[char46] To enable IP Multicast Querier set \fBother_config:mcast_querier\fR to true\[char46] If IP Multicast Querier is enabled \fBother_config:mcast_eth_src\fR and \fBother_config:mcast_ip4_src\fR must be set\[char46] +.IP "\fBother_config : mcast_snoop\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Enables/disables IP Multicast Snooping on the logical switch\[char46] Default: \fBfalse\fR\[char46] +.IP "\fBother_config : mcast_querier\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Enables/disables IP Multicast Querier on the logical switch\[char46] Only applicable if \fBother_config:mcast_snoop\fR is enabled\[char46] Default: \fBtrue\fR\[char46] +.IP "\fBother_config : mcast_flood_unregistered\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Determines whether unregistered multicast traffic should be flooded or not\[char46] Only applicable if \fBother_config:mcast_snoop\fR is enabled\[char46] Default: \fBfalse\fR\[char46] +.IP "\fBother_config : mcast_table_size\fR: optional string, containing an integer, in range 1 to 32,766" +Number of multicast groups to be stored\[char46] Default: 2048\[char46] +.IP "\fBother_config : mcast_idle_timeout\fR: optional string, containing an integer, in range 15 to 3,600" +Configures the IP Multicast Snooping group idle timeout (in seconds)\[char46] Default: 300 seconds\[char46] +.IP "\fBother_config : mcast_query_interval\fR: optional string, containing an integer, in range 1 to 3,600" +Configures the IP Multicast Querier interval between queries (in seconds)\[char46] Default: \fBother_config:mcast_idle_timeout\fR / 2\[char46] +.IP "\fBother_config : mcast_query_max_response\fR: optional string, containing an integer, in range 1 to 10" +Configures the value of the \(dqmax-response\(dq field in the multicast queries originated by the logical switch\[char46] Default: 1 second\[char46] +.IP "\fBother_config : mcast_eth_src\fR: optional string" +Configures the source Ethernet address for queries originated by the logical switch\[char46] +.IP "\fBother_config : mcast_ip4_src\fR: optional string" +Configures the source IPv4 address for queries originated by the logical switch\[char46] +.IP "\fBother_config : mcast_ip6_src\fR: optional string" +Configures the source IPv6 address for queries originated by the logical switch\[char46] +.ST "Interconnection:" +.PP +.IP "\fBother_config : interconn-ts\fR: optional string" +The \fBname\fR of corresponding transit switch in \fBOVN_IC_Northbound\fR database\[char46] This kind of logical switch is created and controlled by \fBovn\-ic\fR\[char46] +.ST "Tunnel Key:" +.PP +.IP "\fBother_config : requested-tnl-key\fR: optional string, containing an integer, in range 1 to 16,777,215" +Configures the datapath tunnel key for the logical switch\[char46] Usually this is not needed because \fBovn\-northd\fR will assign an unique key for each datapath by itself\[char46] However, if it is configured, \fBovn\-northd\fR honors the configured value\[char46] The typical use case is for interconnection: the tunnel keys for transit switches need to be unique globally, so they are maintained in the global \fBOVN_IC_Southbound\fR database, and \fBovn\-ic\fR simply syncs the value from \fBOVN_IC_Southbound\fR through this config\[char46] +.IP "\fBcopp\fR: optional weak reference to \fBCopp\fR" +The control plane protection policy from table \fBCopp\fR used for metering packets sent to \fBovn\-controller\fR from ports of this logical switch\[char46] +.ST "Other options:" +.PP +.IP "\fBother_config : vlan-passthru\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Determines whether VLAN tagged incoming traffic should be allowed\[char46] Note that this may have security implications when enabled for a logical switch with a tag=0 localnet port\[char46] If not properly isolated from other localnet ports, fabric traffic that belongs to other tagged networks may be passed through such a port\[char46] +.IP "\fBother_config : broadcast-arps-to-all-routers\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Determines whether arp requests and ipv6 neighbor solicitations should be sent to all routers and other switchports (default) or if it should only be sent to switchports where the ip/mac address is unknown\[char46] Setting this to false can significantly reduce the load if the logical switch can receive arp requests for ips it does not know about\[char46] However setting this to false also means that garps are no longer forwarded to all routers and therefor the mac bindings of the routers are no longer updated\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Logical_Switch_Port TABLE" +.PP +.PP +.PP +A port within an L2 logical switch\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBname\fR +string (must be unique within table) +.TQ 2.75in +\fBtype\fR +string +.RE +.TQ .25in +\fIOptions:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fIOptions for router ports:\fR +.RS .25in +.TQ 2.50in +\fBoptions : router-port\fR +optional string +.TQ 2.50in +\fBoptions : nat-addresses\fR +optional string +.TQ 2.50in +\fBoptions : exclude-lb-vips-from-garp\fR +optional string +.TQ 2.50in +\fBoptions : arp_proxy\fR +optional string +.RE +.TQ .25in +\fIOptions for localnet ports:\fR +.RS .25in +.TQ 2.50in +\fBoptions : network_name\fR +optional string +.TQ 2.50in +\fBoptions : ethtype\fR +optional string +.TQ 2.50in +\fBoptions : localnet_learn_fdb\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.TQ .25in +\fIOptions for l2gateway ports:\fR +.RS .25in +.TQ 2.50in +\fBoptions : network_name\fR +optional string +.TQ 2.50in +\fBoptions : l2gateway-chassis\fR +optional string +.RE +.TQ .25in +\fIOptions for vtep ports:\fR +.RS .25in +.TQ 2.50in +\fBoptions : vtep-physical-switch\fR +optional string +.TQ 2.50in +\fBoptions : vtep-logical-switch\fR +optional string +.RE +.TQ .25in +\fIVMI (or VIF) Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : requested-chassis\fR +optional string +.TQ 2.50in +\fBoptions : activation-strategy\fR +optional string +.TQ 2.50in +\fBoptions : iface-id-ver\fR +optional string +.TQ 2.50in +\fBoptions : qos_min_rate\fR +optional string +.TQ 2.50in +\fBoptions : qos_max_rate\fR +optional string +.TQ 2.50in +\fBoptions : qos_burst\fR +optional string +.TQ 2.50in +\fBoptions : hostname\fR +optional string +.TQ .25in +\fIVIF Plugging Options:\fR +.RS .25in +.TQ 2.25in +\fBoptions : vif-plug-type\fR +optional string +.TQ 2.25in +\fBoptions : vif-plug-mtu-request\fR +optional string +.RE +.RE +.TQ .25in +\fIVirtual port Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : virtual-ip\fR +optional string +.TQ 2.50in +\fBoptions : virtual-parents\fR +optional string +.RE +.TQ .25in +\fIIP Multicast Snooping Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : mcast_flood\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.50in +\fBoptions : mcast_flood_reports\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.RE +.TQ .25in +\fIContainers:\fR +.RS .25in +.TQ 2.75in +\fBparent_name\fR +optional string +.TQ 2.75in +\fBtag_request\fR +optional integer, in range 0 to 4,095 +.TQ 2.75in +\fBtag\fR +optional integer, in range 1 to 4,095 +.RE +.TQ .25in +\fIPort State:\fR +.RS .25in +.TQ 2.75in +\fBup\fR +optional boolean +.TQ 2.75in +\fBenabled\fR +optional boolean +.RE +.TQ .25in +\fIAddressing:\fR +.RS .25in +.TQ 2.75in +\fBaddresses\fR +set of strings +.TQ 2.75in +\fBdynamic_addresses\fR +optional string +.TQ 2.75in +\fBport_security\fR +set of strings +.RE +.TQ .25in +\fIDHCP:\fR +.RS .25in +.TQ 2.75in +\fBdhcpv4_options\fR +optional weak reference to \fBDHCP_Options\fR +.TQ 2.75in +\fBdhcpv6_options\fR +optional weak reference to \fBDHCP_Options\fR +.RE +.TQ 3.00in +\fBmirror_rules\fR +set of weak reference to \fBMirror\fRs +.TQ 3.00in +\fBha_chassis_group\fR +optional \fBHA_Chassis_Group\fR +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids : neutron:port_name\fR +optional string +.RE +.TQ .25in +\fITunnel Key:\fR +.RS .25in +.TQ 2.75in +\fBoptions : requested-tnl-key\fR +optional string, containing an integer, in range 1 to 32,767 +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBname\fR: string (must be unique within table)" +The logical port name\[char46] +.IP +For entities (VMs or containers) that are spawned in the hypervisor, the name used here must match those used in the \fBexternal_ids:iface-id\fR in the \fBOpen_vSwitch\fR database\(cqs \fBInterface\fR table, because hypervisors use \fBexternal_ids:iface-id\fR as a lookup key to identify the network interface of that entity\[char46] +.IP +For containers that share a VIF within a VM, the name can be any unique identifier\[char46] See \fBContainers\fR, below, for more information\[char46] +.IP +A logical switch port may not have the same name as a logical router port, but the database schema cannot enforce this\[char46] +.IP "\fBtype\fR: string" +Specify a type for this logical port\[char46] Logical ports can be used to model other types of connectivity into an OVN logical switch\[char46] The following types are defined: +.RS +.TP +(empty string) +A VM (or VIF) interface\[char46] +.TP +\fBrouter\fR +A connection to a logical router\[char46] The value of \fBoptions:router-port\fR specifies the \fBname\fR of the \fBLogical_Router_Port\fR to which this logical switch port is connected\[char46] +.TP +\fBlocalnet\fR +A connection to a locally accessible network from \fBovn\-controller\fR instances that have a corresponding bridge mapping\[char46] A logical switch can have multiple \fBlocalnet\fR ports attached\[char46] This type is used to model direct connectivity to existing networks\[char46] In this case, each chassis should have a mapping for one of the physical networks only\[char46] Note: nothing said above implies that a chassis cannot be plugged to multiple physical networks as long as they belong to different switches\[char46] +.TP +\fBlocalport\fR +A connection to a local VIF\[char46] Traffic that arrives on a \fBlocalport\fR is never forwarded over a tunnel to another chassis\[char46] These ports are present on every chassis and have the same address in all of them\[char46] This is used to model connectivity to local services that run on every hypervisor\[char46] +.TP +\fBl2gateway\fR +A connection to a physical network\[char46] +.TP +\fBvtep\fR +A port to a logical switch on a VTEP gateway\[char46] +.TP +\fBexternal\fR +Represents a logical port which is external and not having an OVS port in the integration bridge\[char46] \fBOVN\fR will never receive any traffic from this port or send any traffic to this port\[char46] \fBOVN\fR can support native services like DHCPv4/DHCPv6/DNS for this port\[char46] If \fBha_chassis_group\fR is defined, \fBovn\-controller\fR running in the master chassis of the HA chassis group will bind this port to provide these native services\[char46] It is expected that this port belong to a bridged logical switch (with a \fBlocalnet\fR port)\[char46] +.IP +It is recommended to use the same HA chassis group for all the external ports of a logical switch\[char46] Otherwise, the physical switch might see MAC flap issue when different chassis provide the native services\[char46] For example when supporting native DHCPv4 service, DHCPv4 server mac (configured in \fBoptions:server_mac\fR column in table \fBDHCP_Options\fR) originating from different ports can cause MAC flap issue\[char46] The MAC of the logical router IP(s) can also flap if the same HA chassis group is not set for all the external ports of a logical switch\[char46] +.IP +Below are some of the use cases where \fBexternal\fR ports can be used\[char46] +.RS +.IP \(bu +VMs connected to SR-IOV nics - Traffic from these VMs by passes the kernel stack and local \fBovn\-controller\fR do not bind these ports and cannot serve the native services\[char46] +.IP \(bu +When CMS supports provisioning baremetal servers\[char46] +.RE +.TP +\fBvirtual\fR +Represents a logical port which does not have an OVS port in the integration bridge and has a virtual ip configured in the \fBoptions:virtual-ip\fR column\[char46] This virtual ip can move around between the logical ports configured in the \fBoptions:virtual-parents\fR column\[char46] +.IP +One of the use case where \fBvirtual\fR ports can be used is\[char46] +.RS +.IP \(bu +The \fBvirtual ip\fR represents a load balancer vip and the \fBvirtual parents\fR provide load balancer service in an active-standby setup with the active virtual parent owning the \fBvirtual ip\fR\[char46] +.RE +.TP +\fBremote\fR +A remote port is to model a port that resides remotely on another OVN, which is on the other side of a transit logical switch for OVN interconnection\[char46] This type of ports are created by \fBovn\-ic\fR instead of by CMS\[char46] Any change to the port will be automatically overwritten by \fBovn\-ic\fR\[char46] +.RE +.ST "Options:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides key/value settings specific to the logical port \fBtype\fR\[char46] The type-specific options are described individually below\[char46] +.ST "Options for router ports:" +.PP +.PP +.PP +These options apply when \fBtype\fR is \fBrouter\fR\[char46] +.IP "\fBoptions : router-port\fR: optional string" +Required\[char46] The \fBname\fR of the \fBLogical_Router_Port\fR to which this logical switch port is connected\[char46] +.IP "\fBoptions : nat-addresses\fR: optional string" +This is used to send gratuitous ARPs for SNAT and DNAT IP addresses via the \fBlocalnet\fR port that is attached to the same logical switch as this type \fBrouter\fR port\[char46] This option is specified on a logical switch port that is connected to a gateway router, or a logical switch port that is connected to a distributed gateway port on a logical router\[char46] +.IP +This must take one of the following forms: +.RS +.TP +\fBrouter\fR +Gratuitous ARPs will be sent for all SNAT and DNAT external IP addresses and for all load balancer IP addresses defined on the \fBoptions:router-port\fR\(cqs logical router, using the \fBoptions:router-port\fR\(cqs MAC address\[char46] +.IP +This form of \fBoptions:nat-addresses\fR is valid for logical switch ports where \fBoptions:router-port\fR is the name of a port on a gateway router, or the name of a distributed gateway port\[char46] +.IP +Supported only in OVN 2\[char46]8 and later\[char46] Earlier versions required NAT addresses to be manually synchronized\[char46] +.TP +\fBEthernet address followed by one or more IPv4 addresses\fR +Example: \fB80:fa:5b:06:72:b7 158\[char46]36\[char46]44\[char46]22 +158\[char46]36\[char46]44\[char46]24\fR\[char46] This would result in generation of gratuitous ARPs for IP addresses 158\[char46]36\[char46]44\[char46]22 and 158\[char46]36\[char46]44\[char46]24 with a MAC address of 80:fa:5b:06:72:b7\[char46] +.IP +This form of \fBoptions:nat-addresses\fR is only valid for logical switch ports where \fBoptions:router-port\fR is the name of a port on a gateway router\[char46] +.RE +.IP "\fBoptions : exclude-lb-vips-from-garp\fR: optional string" +If \fBoptions:nat-addresses\fR is set to \fBrouter\fR, Gratuitous ARPs will be sent for all SNAT and DNAT external IP addresses defined on the \fBoptions:router-port\fR\(cqs logical router, using the \fBoptions:router-port\fR\(cqs MAC address, not cosidering configured load balancers\[char46] +.IP "\fBoptions : arp_proxy\fR: optional string" +Optional\[char46] A list of MAC and addresses/cidrs or just addresses/cidrs that this logical switch \fBrouter\fR port will reply to ARP/NDP requests\[char46] Examples: \fB169\[char46]254\[char46]239\[char46]254 169\[char46]254\[char46]239\[char46]2\fR, \fB0a:58:a9:fe:01:01 169\[char46]254\[char46]239\[char46]254 169\[char46]254\[char46]239\[char46]2 +169\[char46]254\[char46]238\[char46]0/24\fR, \fBfd7b:6b4d:7b25:d22f::1 fd7b:6b4d:7b25:d22f::2\fR, \fB0a:58:a9:fe:01:01 fd7b:6b4d:7b25:d22f::0/64\fR\[char46] The\fBoptions:router-port\fR\(cqs logical router should have a route to forward packets sent to configured proxy ARP MAC/IPs to an appropriate destination\[char46] +.ST "Options for localnet ports:" +.PP +.PP +.PP +These options apply when \fBtype\fR is \fBlocalnet\fR\[char46] +.IP "\fBoptions : network_name\fR: optional string" +Required\[char46] The name of the network to which the \fBlocalnet\fR port is connected\[char46] Each hypervisor, via \fBovn\-controller\fR, uses its local configuration to determine exactly how to connect to this locally accessible network, if at all\[char46] +.IP "\fBoptions : ethtype\fR: optional string" +Optional\[char46] VLAN EtherType field value for encapsulating VLAN headers\[char46] Supported values: 802\[char46]1q (default), 802\[char46]1ad\[char46] +.IP "\fBoptions : localnet_learn_fdb\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Optional\[char46] Allows localnet port to learn MACs and store them in FDB table if set to \fBtrue\fR\[char46] The default value is \fBfalse\fR\[char46] +.ST "Options for l2gateway ports:" +.PP +.PP +.PP +These options apply when \fBtype\fR is \fBl2gateway\fR\[char46] +.IP "\fBoptions : network_name\fR: optional string" +Required\[char46] The name of the network to which the \fBl2gateway\fR port is connected\[char46] The L2 gateway, via \fBovn\-controller\fR, uses its local configuration to determine exactly how to connect to this network\[char46] +.IP "\fBoptions : l2gateway-chassis\fR: optional string" +Required\[char46] The chassis on which the \fBl2gateway\fR logical port should be bound to\[char46] \fBovn\-controller\fR running on the defined chassis will connect this logical port to the physical network\[char46] +.ST "Options for vtep ports:" +.PP +.PP +.PP +These options apply when \fBtype\fR is \fBvtep\fR\[char46] +.IP "\fBoptions : vtep-physical-switch\fR: optional string" +Required\[char46] The name of the VTEP gateway\[char46] +.IP "\fBoptions : vtep-logical-switch\fR: optional string" +Required\[char46] A logical switch name connected by the VTEP gateway\[char46] +.ST "VMI (or VIF) Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR having (empty string) +.IP "\fBoptions : requested-chassis\fR: optional string" +If set, identifies a specific chassis (by name or hostname) that is allowed to bind this port\[char46] Using this option will prevent thrashing between two chassis trying to bind the same port during a live migration\[char46] It can also prevent similar thrashing due to a mis-configuration, if a port is accidentally created on more than one chassis\[char46] +.IP +If set to a comma separated list, the first entry identifies the main chassis and the rest are one or more additional chassis that are allowed to bind the same port\[char46] +.IP +When multiple chassis are set for the port, and the logical switch is connected to an external network through a \fBlocalnet\fR port, tunneling is enforced for the port to guarantee delivery of packets directed to the port to all its locations\[char46] This has MTU implications because the network used for tunneling must have MTU larger than \fBlocalnet\fR for stable connectivity\[char46] +.IP +If the same host co-hosts more than one controller instance (either belonging to the same or separate clusters), special attention should be given to consistently using unique chassis names used in this option\[char46] It is advised that chassis names - and not host names - are used for this option\[char46] +.IP "\fBoptions : activation-strategy\fR: optional string" +If used with multiple chassis set in \fBrequested-chassis\fR, specifies an activation strategy for all additional chassis\[char46] By default, no activation strategy is used, meaning additional port locations are immediately available for use\[char46] When set to \(dqrarp\(dq, the port is blocked for ingress and egress communication until a RARP packet is sent from a new location\[char46] The \(dqrarp\(dq strategy is useful in live migration scenarios for virtual machines\[char46] +.IP "\fBoptions : iface-id-ver\fR: optional string" +If set, this port will be bound by \fBovn\-controller\fR only if this same key and value is configured in the \fBexternal_ids\fR column in the Open_vSwitch database\(cqs \fBInterface\fR table\[char46] +.IP "\fBoptions : qos_min_rate\fR: optional string" +If set, indicates the minimum guaranteed rate available for data sent from this interface, in bit/s\[char46] +.IP "\fBoptions : qos_max_rate\fR: optional string" +If set, indicates the maximum rate for data sent from this interface, in bit/s\[char46] The traffic will be shaped according to this limit\[char46] +.IP "\fBoptions : qos_burst\fR: optional string" +If set, indicates the maximum burst size for data sent from this interface, in bits\[char46] +.IP "\fBoptions : hostname\fR: optional string" +If set, indicates the DHCPv4 option \(dqHostname\(dq (option code 12) associated for this Logical Switch Port\[char46] If DHCPv4 is enabled for this Logical Switch Port, hostname dhcp option will be included in DHCP reply\[char46] +.ST "VIF Plugging Options:" +.PP +.IP "\fBoptions : vif-plug-type\fR: optional string" +If set, OVN will attempt to perform plugging of this VIF\[char46] In order to get this port plugged by the OVN controller, OVN must be built with support for VIF plugging\[char46] The default behavior is for the CMS to do the VIF plugging\[char46] Each VIF plug provider have their own options namespaced by name, for example \(dqvif-plug:representor:key\(dq\[char46] Please refer to the VIF plug provider documentation located in Documentation/topics/vif-plug-providers/ for more information\[char46] +.IP "\fBoptions : vif-plug-mtu-request\fR: optional string" +Requested MTU for plugged interfaces\[char46] When set the OVN controller will fill the \fBmtu_request\fR column of the Open vSwitch database\(cqs \fBInterface\fR table\[char46] This in turn will make OVS vswitchd update the MTU of the linked interface\[char46] +.ST "Virtual port Options:" +.PP +.PP +.PP +These options apply when \fBtype\fR is \fBvirtual\fR\[char46] +.IP "\fBoptions : virtual-ip\fR: optional string" +This option represents the virtual IPv4 address\[char46] +.IP "\fBoptions : virtual-parents\fR: optional string" +This options represents a set of logical port names (with in the same logical switch) which can own the \fBvirtual ip\fR configured in the \fBoptions:virtual-ip\fR\[char46] All these virtual parents should add the \fBvirtual ip\fR in the \fBport_security\fR if port security addressed are enabled\[char46] +.ST "IP Multicast Snooping Options:" +.PP +.PP +.PP +These options apply when the port is part of a logical switch which has \fBother_config\fR :mcast_snoop set to \fBtrue\fR\[char46] +.IP "\fBoptions : mcast_flood\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, multicast packets (except reports) are unconditionally forwarded to the specific port\[char46] Default: \fBfalse\fR\[char46] +.IP "\fBoptions : mcast_flood_reports\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, multicast reports are unconditionally forwarded to the specific port\[char46] Default: \fBfalse\fR\[char46] +.ST "Containers:" +.PP +.PP +.PP +When a large number of containers are nested within a VM, it may be too expensive to dedicate a VIF to each container\[char46] OVN can use VLAN tags to support such cases\[char46] Each container is assigned a VLAN ID and each packet that passes between the hypervisor and the VM is tagged with the appropriate ID for the container\[char46] Such VLAN IDs never appear on a physical wire, even inside a tunnel, so they need not be unique except relative to a single VM on a hypervisor\[char46] +.PP +.PP +These columns are used for VIFs that represent nested containers using shared VIFs\[char46] For VMs and for containers that have dedicated VIFs, they are empty\[char46] +.IP "\fBparent_name\fR: optional string" +The VM interface through which the nested container sends its network traffic\[char46] This must match the \fBname\fR column for some other \fBLogical_Switch_Port\fR\[char46] +.IP "\fBtag_request\fR: optional integer, in range 0 to 4,095" +The VLAN tag in the network traffic associated with a container\(cqs network interface\[char46] The client can request \fBovn\-northd\fR to allocate a tag that is unique within the scope of a specific parent (specified in \fBparent_name\fR) by setting a value of \fB0\fR in this column\[char46] The allocated value is written by \fBovn\-northd\fR in the \fBtag\fR column\[char46] (Note that these tags are allocated and managed locally in \fBovn\-northd\fR, so they cannot be reconstructed in the event that the database is lost\[char46]) The client can also request a specific non-zero tag and \fBovn\-northd\fR will honor it and copy that value to the \fBtag\fR column\[char46] +.IP +When \fBtype\fR is set to \fBlocalnet\fR or \fBl2gateway\fR, this can be set to indicate that the port represents a connection to a specific VLAN on a locally accessible network\[char46] The VLAN ID is used to match incoming traffic and is also added to outgoing traffic\[char46] +.IP "\fBtag\fR: optional integer, in range 1 to 4,095" +The VLAN tag allocated by \fBovn\-northd\fR based on the contents of the \fBtag_request\fR column\[char46] +.ST "Port State:" +.PP +.IP "\fBup\fR: optional boolean" +This column is populated by \fBovn\-northd\fR, rather than by the CMS plugin as is most of this database\[char46] When a logical port is bound to a physical location in the OVN Southbound database \fBBinding\fR table, \fBovn\-northd\fR sets this column to \fBtrue\fR; otherwise, or if the port becomes unbound later, it sets it to \fBfalse\fR\[char46] If this column is empty, the port is not considered up\[char46] This allows the CMS to wait for a VM\(cqs (or container\(cqs) networking to become active before it allows the VM (or container) to start\[char46] +.IP +Logical ports of router type are an exception to this rule\[char46] They are considered to be always up, that is this column is always set to \fBtrue\fR\[char46] +.IP "\fBenabled\fR: optional boolean" +This column is used to administratively set port state\[char46] If this column is empty or is set to \fBtrue\fR, the port is enabled\[char46] If this column is set to \fBfalse\fR, the port is disabled\[char46] A disabled port has all ingress and egress traffic dropped\[char46] +.ST "Addressing:" +.PP +.IP "\fBaddresses\fR: set of strings" +Addresses owned by the logical port\[char46] +.IP +Each element in the set must take one of the following forms: +.RS +.TP +\fBEthernet address followed by zero or more IPv4 or IPv6 addresses (or both)\fR +An Ethernet address defined is owned by the logical port\[char46] Like a physical Ethernet NIC, a logical port ordinarily has a single fixed Ethernet address\[char46] +.IP +When a OVN logical switch processes a unicast Ethernet frame whose destination MAC address is in a logical port\(cqs \fBaddresses\fR column, it delivers it only to that port, as if a MAC learning process had learned that MAC address on the port\[char46] +.IP +If IPv4 or IPv6 address(es) (or both) are defined, it indicates that the logical port owns the given IP addresses\[char46] +.IP +If IPv4 address(es) are defined, the OVN logical switch uses this information to synthesize responses to ARP requests without traversing the physical network\[char46] The OVN logical router connected to the logical switch, if any, uses this information to avoid issuing ARP requests for logical switch ports\[char46] +.IP +Note that the order here is important\[char46] The Ethernet address must be listed before the IP address(es) if defined\[char46] +.IP +Examples: +.RS +.TP +\fB80:fa:5b:06:72:b7\fR +This indicates that the logical port owns the above mac address\[char46] +.TP +\fB80:fa:5b:06:72:b7 10\[char46]0\[char46]0\[char46]4 20\[char46]0\[char46]0\[char46]4\fR +This indicates that the logical port owns the mac address and two IPv4 addresses\[char46] +.TP +\fB80:fa:5b:06:72:b7 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41\fR +This indicates that the logical port owns the mac address and 1 IPv6 address\[char46] +.TP +\fB80:fa:5b:06:72:b7 10\[char46]0\[char46]0\[char46]4 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41\fR +This indicates that the logical port owns the mac address and 1 IPv4 address and 1 IPv6 address\[char46] +.RE +.TP +\fBunknown\fR +This indicates that the logical port has an unknown set of Ethernet addresses\[char46] When an OVN logical switch processes a unicast Ethernet frame whose destination MAC address is not in any logical port\(cqs \fBaddresses\fR column, it delivers it to the port (or ports) whose \fBaddresses\fR columns include \fBunknown\fR\[char46] +.TP +\fBdynamic\fR +Use \fBdynamic\fR to make \fBovn\-northd\fR generate a globally unique MAC address, choose an unused IPv4 address with the logical port\(cqs subnet (if \fBother_config:subnet\fR is set in the port\(cqs \fBLogical_Switch\fR), and generate an IPv6 address from the MAC address (if \fBother_config:ipv6_prefix\fR is set in the port\(cqs \fBLogical_Switch\fR) and store them in the port\(cqs \fBdynamic_addresses\fR column\[char46] +.IP +Only one element containing \fBdynamic\fR may appear in \fBaddresses\fR\[char46] +.TP +\fBdynamic\fR \fIip\fR +.TQ .5in +\fBdynamic\fR \fIipv6\fR +.TQ .5in +\fBdynamic\fR \fIip\fR \fIipv6\fR +These act like \fBdynamic\fR alone but specify particular IPv4 or IPv6 addresses to use\[char46] OVN IPAM will still automatically allocate the other address if configured appropriately\[char46] Example: \fBdynamic 192\[char46]168\[char46]0\[char46]1 2001::1\fR\[char46] +.TP +\fImac\fR \fBdynamic\fR +This acts like \fBdynamic\fR alone but specifies a particular MAC address to use\[char46] OVN IPAM will still automatically allocate IPv4 or IPv6 addresses, or both, if configured appropriately\[char46] Example: \fB80:fa:5b:06:72:b7 dynamic\fR +.TP +\fBrouter\fR +Accepted only when \fBtype\fR is \fBrouter\fR\[char46] This indicates that the Ethernet, IPv4, and IPv6 addresses for this logical switch port should be obtained from the connected logical router port, as specified by \fBrouter\-port\fR in \fBoptions\fR\[char46] +.IP +The resulting addresses are used to populate the logical switch\(cqs destination lookup, and also for the logical switch to generate ARP and ND replies\[char46] +.IP +If the connected logical router port has a distributed gateway port specified and the logical router has rules specified in \fBnat\fR with \fBexternal_mac\fR, then those addresses are also used to populate the switch\(cqs destination lookup\[char46] +.IP +Supported only in OVN 2\[char46]7 and later\[char46] Earlier versions required router addresses to be manually synchronized\[char46] +.RE +.IP "\fBdynamic_addresses\fR: optional string" +Addresses assigned to the logical port by \fBovn\-northd\fR, if \fBdynamic\fR is specified in \fBaddresses\fR\[char46] Addresses will be of the same format as those that populate the \fBaddresses\fR column\[char46] Note that dynamically assigned addresses are constructed and managed locally in ovn-northd, so they cannot be reconstructed in the event that the database is lost\[char46] +.IP "\fBport_security\fR: set of strings" +This column controls the addresses from which the host attached to the logical port (``the host\(cq\(cq) is allowed to send packets and to which it is allowed to receive packets\[char46] If this column is empty, all addresses are permitted\[char46] +.IP +Each element in the set must begin with one Ethernet address\[char46] This would restrict the host to sending packets from and receiving packets to the ethernet addresses defined in the logical port\(cqs \fBport_security\fR column\[char46] It also restricts the inner source MAC addresses that the host may send in ARP and IPv6 Neighbor Discovery packets\[char46] The host is always allowed to receive packets to multicast and broadcast Ethernet addresses\[char46] +.IP +Each element in the set may additionally contain one or more IPv4 or IPv6 addresses (or both), with optional masks\[char46] If a mask is given, it must be a CIDR mask\[char46] In addition to the restrictions described for Ethernet addresses above, such an element restricts the IPv4 or IPv6 addresses from which the host may send and to which it may receive packets to the specified addresses\[char46] A masked address, if the host part is zero, indicates that the host is allowed to use any address in the subnet; if the host part is nonzero, the mask simply indicates the size of the subnet\[char46] In addition: +.RS +.IP \(bu +If any IPv4 address is given, the host is also allowed to receive packets to the IPv4 local broadcast address 255\[char46]255\[char46]255\[char46]255 and to IPv4 multicast addresses (224\[char46]0\[char46]0\[char46]0/4)\[char46] If an IPv4 address with a mask is given, the host is also allowed to receive packets to the broadcast address in that specified subnet\[char46] +.IP +If any IPv4 address is given, the host is additionally restricted to sending ARP packets with the specified source IPv4 address\[char46] (RARP is not restricted\[char46]) +.IP \(bu +If any IPv6 address is given, the host is also allowed to receive packets to IPv6 multicast addresses (ff00::/8)\[char46] +.IP +If any IPv6 address is given, the host is additionally restricted to sending IPv6 Neighbor Discovery Solicitation or Advertisement packets with the specified source address or, for solicitations, the unspecified address\[char46] +.RE +.IP +If an element includes an IPv4 address, but no IPv6 addresses, then IPv6 traffic is not allowed\[char46] If an element includes an IPv6 address, but no IPv4 address, then IPv4 and ARP traffic is not allowed\[char46] +.IP +This column uses the same lexical syntax as the \fBmatch\fR column in the OVN Southbound database\(cqs \fBPipeline\fR table\[char46] Multiple addresses within an element may be space or comma separated\[char46] +.IP +This column is provided as a convenience to cloud management systems, but all of the features that it implements can be implemented as ACLs using the \fBACL\fR table\[char46] +.IP +Examples: +.RS +.TP +\fB80:fa:5b:06:72:b7\fR +The host may send traffic from and receive traffic to the specified MAC address, and to receive traffic to Ethernet multicast and broadcast addresses, but not otherwise\[char46] The host may not send ARP or IPv6 Neighbor Discovery packets with inner source Ethernet addresses other than the one specified\[char46] +.TP +\fB80:fa:5b:06:72:b7 192\[char46]168\[char46]1\[char46]10/24\fR +This adds further restrictions to the first example\[char46] The host may send IPv4 packets from or receive IPv4 packets to only 192\[char46]168\[char46]1\[char46]10, except that it may also receive IPv4 packets to 192\[char46]168\[char46]1\[char46]255 (based on the subnet mask), 255\[char46]255\[char46]255\[char46]255, and any address in 224\[char46]0\[char46]0\[char46]0/4\[char46] The host may not send ARPs with a source Ethernet address other than 80:fa:5b:06:72:b7 or source IPv4 address other than 192\[char46]168\[char46]1\[char46]10\[char46] The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic\[char46] +.TP +\fB\(dq80:fa:5b:12:42:ba\(dq, \(dq80:fa:5b:06:72:b7 192\[char46]168\[char46]1\[char46]10/24\(dq\fR +The host may send traffic from and receive traffic to the specified MAC addresses, and to receive traffic to Ethernet multicast and broadcast addresses, but not otherwise\[char46] With MAC 80:fa:5b:12:42:ba, the host may send traffic from and receive traffic to any L3 address\[char46] With MAC 80:fa:5b:06:72:b7, the host may send IPv4 packets from or receive IPv4 packets to only 192\[char46]168\[char46]1\[char46]10, except that it may also receive IPv4 packets to 192\[char46]168\[char46]1\[char46]255 (based on the subnet mask), 255\[char46]255\[char46]255\[char46]255, and any address in 224\[char46]0\[char46]0\[char46]0/4\[char46] The host may not send or receive any IPv6 (including IPv6 Neighbor Discovery) traffic\[char46] +.RE +.ST "DHCP:" +.PP +.IP "\fBdhcpv4_options\fR: optional weak reference to \fBDHCP_Options\fR" +This column defines the DHCPv4 Options to be included by the \fBovn\-controller\fR when it replies to the DHCPv4 requests\[char46] Please see the \fBDHCP_Options\fR table\[char46] +.IP "\fBdhcpv6_options\fR: optional weak reference to \fBDHCP_Options\fR" +This column defines the DHCPv6 Options to be included by the \fBovn\-controller\fR when it replies to the DHCPv6 requests\[char46] Please see the \fBDHCP_Options\fR table\[char46] +.IP "\fBmirror_rules\fR: set of weak reference to \fBMirror\fRs" +Mirror rules that apply to logical switch port which is the source\[char46] Please see the \fBMirror\fR table\[char46] +.IP "\fBha_chassis_group\fR: optional \fBHA_Chassis_Group\fR" +References a row in the OVN Northbound database\(cqs \fBHA_Chassis_Group\fR table\[char46] It indicates the HA chassis group to use if the \fBtype\fR is set to \fBexternal\fR\[char46] If \fBtype\fR is not \fBexternal\fR, this column is ignored\[char46] +.ST "Naming:" +.PP +.IP "\fBexternal_ids : neutron:port_name\fR: optional string" +This column gives an optional human-friendly name for the port\[char46] This name has no special meaning or purpose other than to provide convenience for human interaction with the northbound database\[char46] +.IP +Neutron copies this from its own port object\(cqs name\[char46] (Neutron ports do are not assigned human-friendly names by default, so it will often be empty\[char46]) +.ST "Tunnel Key:" +.PP +.IP "\fBoptions : requested-tnl-key\fR: optional string, containing an integer, in range 1 to 32,767" +Configures the port binding tunnel key for the port\[char46] Usually this is not needed because \fBovn\-northd\fR will assign an unique key for each port by itself\[char46] However, if it is configured, \fBovn\-northd\fR honors the configured value\[char46] The typical use case is for interconnection: the tunnel keys for ports on transit switches need to be unique globally, so they are maintained in the global \fBOVN_IC_Southbound\fR database, and \fBovn\-ic\fR simply syncs the value from \fBOVN_IC_Southbound\fR through this config\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.IP +The \fBovn\-northd\fR program copies all these pairs into the \fBexternal_ids\fR column of the \fBPort_Binding\fR table in \fBOVN_Southbound\fR database\[char46] +.bp +.SH "Forwarding_Group TABLE" +.PP +.PP +.PP +Each row represents one forwarding group\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBvip\fR +string +.TQ 3.00in +\fBvmac\fR +string +.TQ 3.00in +\fBliveness\fR +boolean +.TQ 3.00in +\fBchild_port\fR +set of 1 or more strings +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string" +A name for the forwarding group\[char46] This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database\[char46] +.IP "\fBvip\fR: string" +The virtual IP address assigned to the forwarding group\[char46] It will respond with vmac when an ARP request is sent for vip\[char46] +.IP "\fBvmac\fR: string" +The virtual MAC address assigned to the forwarding group\[char46] +.IP "\fBliveness\fR: boolean" +If set to \fBtrue\fR, liveness is enabled for child ports otherwise it is disabled\[char46] +.IP "\fBchild_port\fR: set of 1 or more strings" +List of child ports in the forwarding group\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Address_Set TABLE" +.PP +.PP +.PP +Each row in this table represents a named set of addresses\[char46] An address set may contain Ethernet, IPv4, or IPv6 addresses with optional bitwise or CIDR masks\[char46] Address set may ultimately be used in ACLs to compare against fields such as \fBip4\[char46]src\fR or \fBip6\[char46]src\fR\[char46] A single address set must contain addresses of the same type\[char46] As an example, the following would create an address set with three IP addresses: +.PP +.nf +\fB +.br +\fB ovn\-nbctl create Address_Set name=set1 addresses=\(cq10\[char46]0\[char46]0\[char46]1 10\[char46]0\[char46]0\[char46]2 10\[char46]0\[char46]0\[char46]3\(cq +.br +\fB \fR +.fi +.PP +.PP +Address sets may be used in the \fBmatch\fR column of the \fBACL\fR table\[char46] For syntax information, see the details of the expression language used for the \fBmatch\fR column in the \fBLogical_Flow\fR table of the \fBOVN_Southbound\fR database\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBaddresses\fR +set of strings +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for the address set\[char46] Names are ASCII and must match \fB[a\-zA\-Z_\[char46]][a\-zA\-Z_\[char46]0\-9]*\fR\[char46] +.IP "\fBaddresses\fR: set of strings" +The set of addresses in string form\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Port_Group TABLE" +.PP +.PP +.PP +Each row in this table represents a named group of logical switch ports\[char46] +.PP +.PP +Port groups may be used in the \fBmatch\fR column of the \fBACL\fR table\[char46] For syntax information, see the details of the expression language used for the \fBmatch\fR column in the \fBLogical_Flow\fR table of the \fBOVN_Southbound\fR database\[char46] +.PP +.PP +For each port group, there are two address sets generated to the \fBAddress_Set\fR table of the \fBOVN_Southbound\fR database, containing the IP addresses of the group of ports, one for IPv4, and the other for IPv6, with \fBname\fR being the \fBname\fR of the \fBPort_Group\fR followed by a suffix \fB_ip4\fR for IPv4 and \fB_ip6\fR for IPv6\[char46] The generated address sets can be used in the same way as regular address sets in the \fBmatch\fR column of the \fBACL\fR table\[char46] For syntax information, see the details of the expression language used for the \fBmatch\fR column in the \fBLogical_Flow\fR table of the \fBOVN_Southbound\fR database\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBports\fR +set of weak reference to \fBLogical_Switch_Port\fRs +.TQ 3.00in +\fBacls\fR +set of \fBACL\fRs +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for the port group\[char46] Names are ASCII and must match \fB[a\-zA\-Z_\[char46]][a\-zA\-Z_\[char46]0\-9]*\fR\[char46] +.IP "\fBports\fR: set of weak reference to \fBLogical_Switch_Port\fRs" +The logical switch ports belonging to the group in uuids\[char46] +.IP "\fBacls\fR: set of \fBACL\fRs" +Access control rules that apply to the port group\[char46] Applying an ACL to a port group has the same effect as applying the ACL to all logical lswitches that the ports of the port group belong to\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Load_Balancer TABLE" +.PP +.PP +.PP +Each row represents one load balancer\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBvips\fR +map of string-string pairs +.TQ 3.00in +\fBprotocol\fR +optional string, one of \fBsctp\fR, \fBtcp\fR, or \fBudp\fR +.TQ .25in +\fIHealth Checks:\fR +.RS .25in +.TQ 2.75in +\fBhealth_check\fR +set of \fBLoad_Balancer_Health_Check\fRs +.TQ 2.75in +\fBip_port_mappings\fR +map of string-string pairs +.RE +.TQ 3.00in +\fBselection_fields\fR +set of strings, one of \fBeth_dst\fR, \fBeth_src\fR, \fBip_dst\fR, \fBip_src\fR, \fBtp_dst\fR, or \fBtp_src\fR +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fILoad_Balancer options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : reject\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : hairpin_snat_ip\fR +optional string +.TQ 2.75in +\fBoptions : skip_snat\fR +optional string +.TQ 2.75in +\fBoptions : add_route\fR +optional string +.TQ 2.75in +\fBoptions : neighbor_responder\fR +optional string +.TQ 2.75in +\fBoptions : template\fR +optional string +.TQ 2.75in +\fBoptions : address-family\fR +optional string +.TQ 2.75in +\fBoptions : affinity_timeout\fR +optional string +.TQ 2.75in +\fBoptions : ct_flush\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.SS "Details: +.IP "\fBname\fR: string" +A name for the load balancer\[char46] This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database\[char46] +.IP "\fBvips\fR: map of string-string pairs" +A map of virtual IP addresses (and an optional port number with \fB:\fR as a separator) associated with this load balancer and their corresponding endpoint IP addresses (and optional port numbers with \fB:\fR as separators) separated by commas\[char46] If the destination IP address (and port number) of a packet leaving a container or a VM matches the virtual IP address (and port number) provided here as a key, then OVN will statefully replace the destination IP address by one of the provided IP address (and port number) in this map as a value\[char46] IPv4 and IPv6 addresses are supported for load balancing; however a VIP of one address family may not be mapped to a destination IP address of a different family\[char46] If specifying an IPv6 address with a port, the address portion must be enclosed in square brackets\[char46] Examples for keys are \(dq192\[char46]168\[char46]1\[char46]4\(dq and \(dq[fd0f::1]:8800\(dq\[char46] Examples for value are \(dq10\[char46]0\[char46]0\[char46]1, 10\[char46]0\[char46]0\[char46]2\(dq and \(dq20\[char46]0\[char46]0\[char46]10:8800, 20\[char46]0\[char46]0\[char46]11:8800\(dq\[char46] +.IP +When the \fBLoad_Balancer\fR is added to the \fBlogical_switch\fR, the VIP has to be in a different subnet than the one used for the \fBlogical_switch\fR\[char46] Since VIP is in a different subnet, you should connect your logical switch to either a OVN logical router or a real router (this is because the client can now send a packet with VIP as the destination IP address and router\(cqs mac address as the destination MAC address)\[char46] +.IP "\fBprotocol\fR: optional string, one of \fBsctp\fR, \fBtcp\fR, or \fBudp\fR" +Valid protocols are \fBtcp\fR, \fBudp\fR, or \fBsctp\fR\[char46] This column is useful when a port number is provided as part of the \fBvips\fR column\[char46] If this column is empty and a port number is provided as part of \fBvips\fR column, OVN assumes the protocol to be \fBtcp\fR\[char46] +.ST "Health Checks:" +.PP +.PP +.PP +OVN supports health checks for load balancer endpoints\[char46] When health checks are enabled, the load balancer uses only healthy endpoints\[char46] +.PP +.PP +Suppose that \fBvips\fR contains a key-value pair \fB10\[char46]0\[char46]0\[char46]10:80\fR=\fB10\[char46]0\[char46]0\[char46]4:8080,20\[char46]0\[char46]0\[char46]4:8080\fR\[char46] To enable health checks for this virtual\(cqs endpoints, add two key-value pairs to \fBip_port_mappings\fR, with keys \fB10\[char46]0\[char46]0\[char46]4\fR and \fB20\[char46]0\[char46]0\[char46]4\fR, and add to \fBhealth_check\fR a reference to a \fBLoad_Balancer_Health_Check\fR row whose \fBvip\fR is set to \fB10\[char46]0\[char46]0\[char46]10\fR\[char46] The same approach can be used for IPv6 as well\[char46] +.IP "\fBhealth_check\fR: set of \fBLoad_Balancer_Health_Check\fRs" +Load balancer health checks associated with this load balancer\[char46] +.IP "\fBip_port_mappings\fR: map of string-string pairs" +Maps from endpoint IP to a colon-separated pair of logical port name and source IP, e\[char46]g\[char46] \fB\fIport_name\fB:\fIsourc_ip\fB\fR for IPv4\[char46] Health checks are sent to this port with the specified source IP\[char46] For IPv6 square brackets must be used around IP address, e\[char46]g: \fB\fIport_name\fB:\fI[sourc_ip]\fB\fR +.IP +For example, in the example above, IP to port mappings might be defined as \fB10\[char46]0\[char46]0\[char46]4\fR=\fBsw0\-p1:10\[char46]0\[char46]0\[char46]2\fR and \fB20\[char46]0\[char46]0\[char46]4\fR=\fBsw1\-p1:20\[char46]0\[char46]0\[char46]2\fR, if the values given were suitable ports and IP addresses\[char46] +.IP +For IPv6 IP to port mappings might be defined as \fB[2001::1]\fR=\fBsw0\-p1:[2002::1]\fR\[char46] +.IP "\fBselection_fields\fR: set of strings, one of \fBeth_dst\fR, \fBeth_src\fR, \fBip_dst\fR, \fBip_src\fR, \fBtp_dst\fR, or \fBtp_src\fR" +OVN native load balancers are supported using the OpenFlow groups of type \fBselect\fR\[char46] OVS supports two selection methods: \fBdp_hash\fR and \fBhash (with optional fields +specified)\fR in selecting the buckets of a group\[char46] Please see the OVS documentation (man ovs-ofctl) for more details on the selection methods\[char46] Each endpoint IP (and port if set) is mapped to a bucket in the group flow\[char46] +.IP +CMS can choose the \fBhash\fR selection method by setting the selection fields in this column\[char46] \fBovs\-vswitchd\fR uses the specified fields in generating the hash\[char46] +.IP +\fBdp_hash\fR selection method uses the assistance of datapath to calculate the hash and it is expected to be faster than \fBhash\fR selection method\[char46] So CMS should take this into consideration before using the \fBhash\fR method\[char46] Please consult the OVS documentation and OVS sources for the implementation details\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Load_Balancer options:" +.PP +.IP "\fBoptions : reject\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If the load balancer is created with \fB\-\-reject\fR option and it has no active backends, a TCP reset segment (for tcp) or an ICMP port unreachable packet (for all other kind of traffic) will be sent whenever an incoming packet is received for this load-balancer\[char46] Please note using \fB\-\-reject\fR option will disable empty_lb SB controller event for this load balancer\[char46] +.IP "\fBoptions : hairpin_snat_ip\fR: optional string" +IP to be used as source IP for packets that have been hair-pinned after load balancing\[char46] The default behavior when the option is not set is to use the load balancer VIP as source IP\[char46] This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a space character\[char46] +.IP "\fBoptions : skip_snat\fR: optional string" +If the load balancing rule is configured with \fBskip_snat\fR option, the option lb_force_snat_ip configured for the logical router that references this load balancer will not be applied for this load balancer\[char46] +.IP "\fBoptions : add_route\fR: optional string" +If set to \fBtrue\fR, then neighbor routers will have logical flows added that will allow for routing to the VIP IP\[char46] It also will have ARP resolution logical flows added\[char46] By setting this option, it means there is no reason to create a \fBLogical_Router_Static_Route\fR from neighbor routers to this NAT address\[char46] It also means that no ARP request is required for neighbor routers to learn the IP-MAC mapping for this VIP IP\[char46] For more information about what flows are added for IP routes, please see the \fBovn\-northd\fR manpage section on IP Routing\[char46] +.IP "\fBoptions : neighbor_responder\fR: optional string" +If set to \fBall\fR, then routers on which the load balancer is applied reply to ARP/neighbor discovery requests for all VIPs of the load balancer\[char46] If set to \fBreachable\fR, then routers on which the load balancer is applied reply to ARP/neighbor discovery requests only for VIPs that are part of a router\(cqs subnet\[char46] If set to \fBnone\fR, then routers on which the load balancer is applied never reply to ARP/neighbor discovery requests for any of the load balancer VIPs\[char46] Load balancers with \fBoptions:template=true\fR do not support \fBreachable\fR as a valid mode\[char46] The default value of this option, if not specified, is \fBreachable\fR for regular load balancers and \fBnone\fR for template load balancers\[char46] +.IP "\fBoptions : template\fR: optional string" +Option to be set to \fBtrue\fR, if the load balancer is a template\[char46] The load balancer VIPs and backends must be using \fBChassis_Template_Var\fR in their definitions\[char46] +.IP +Load balancer template VIP supported formats are: +.IP +.nf +\fB +.br +\fB^VIP_VAR[:^PORT_VAR|:port] +.br +\fB \fR +.fi +.IP +where \fBVIP_VAR\fR and \fBPORT_VAR\fR are keys of the \fBChassis_Template_Var\fR \fBvariables\fR records\[char46] +.IP +Note: The VIP and PORT cannot be combined into a single template variable\[char46] For example, a \fBChassis_Template_Var\fR variable expanding to \fB10\[char46]0\[char46]0\[char46]1:8080\fR is not valid if used as VIP\[char46] +.IP +Load balancer template backend supported formats are: +.IP +.nf +\fB +.br +\fB^BACKEND_VAR1[:^PORT_VAR1|:port],^BACKEND_VAR2[:^PORT_VAR2|:port] +.br +\fB +.br +\fBor +.br +\fB +.br +\fB^BACKENDS_VAR1,^BACKENDS_VAR2 +.br +\fB \fR +.fi +.IP +where \fBBACKEND_VAR1\fR, \fBPORT_VAR1\fR, \fBBACKEND_VAR2\fR, \fBPORT_VAR2\fR, \fBBACKENDS_VAR1\fR and \fBBACKENDS_VAR2\fR are keys of the \fBChassis_Template_Var\fR \fBvariables\fR records\[char46] +.IP "\fBoptions : address-family\fR: optional string" +Address family used by the load balancer\[char46] Supported values are \fBipv4\fR and \fBipv6\fR\[char46] The address-family is only used for load balancers with \fBoptions:template=true\fR\[char46] For explicit load balancers, setting the address-family has no effect\[char46] +.IP "\fBoptions : affinity_timeout\fR: optional string" +If the CMS provides a positive value (in seconds) for \fBaffinity_timeout\fR, OVN will dnat connections received from the same client to this lb to the same backend if received in the affinity timeslot\[char46] Max supported affinity_timeout is 65535 seconds\[char46] +.IP "\fBoptions : ct_flush\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +The value indicates whether ovn-controller should flush CT entries that are related to this LB\[char46] The flush happens if the LB is removed, any of the backends is updated/removed or the LB is not considered local anymore by the ovn-controller\[char46] This option is set to \fBfalse\fR by default\[char46] +.bp +.SH "Load_Balancer_Group TABLE" +.PP +.PP +.PP +Each row represents a logical grouping of load balancers\[char46] It is up to the CMS to decide the criteria on which load balancers are grouped together\[char46] To simplify configuration and to optimize its processing load balancers that must be associated to the same set of logical switches and/or logical routers should be grouped together\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBload_balancer\fR +set of weak reference to \fBLoad_Balancer\fRs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for the load balancer group\[char46] This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database\[char46] +.IP "\fBload_balancer\fR: set of weak reference to \fBLoad_Balancer\fRs" +A set of load balancers\[char46] +.bp +.SH "Load_Balancer_Health_Check TABLE" +.PP +.PP +.PP +Each row represents one load balancer health check\[char46] +.SS "Summary: +.TQ 3.00in +\fBvip\fR +string +.TQ .25in +\fIHealth check options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : interval\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : timeout\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : success_count\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : failure_count\fR +optional string, containing an integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBvip\fR: string" +\fBvip\fR whose endpoints should be monitored for health check\[char46] +.ST "Health check options:" +.PP +.IP "\fBoptions : interval\fR: optional string, containing an integer" +The interval, in seconds, between health checks\[char46] +.IP "\fBoptions : timeout\fR: optional string, containing an integer" +The time, in seconds, after which a health check times out\[char46] +.IP "\fBoptions : success_count\fR: optional string, containing an integer" +The number of successful checks after which the endpoint is considered online\[char46] +.IP "\fBoptions : failure_count\fR: optional string, containing an integer" +The number of failure checks after which the endpoint is considered offline\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "ACL TABLE" +.PP +.PP +.PP +Each row in this table represents one ACL rule for a logical switch or a port group that points to it through its \fBacls\fR column\[char46] The \fBaction\fR column for the highest-\fBpriority\fR matching row in this table determines a packet\(cqs treatment\[char46] If no row matches, packets are allowed by default\[char46] (Default-deny treatment is possible: add a rule with \fBpriority\fR 0, \fB1\fR as \fBmatch\fR, and \fBdeny\fR as \fBaction\fR\[char46]) +.SS "Summary: +.TQ 3.00in +\fBlabel\fR +integer, in range 0 to 4,294,967,295 +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ 3.00in +\fBdirection\fR +string, either \fBfrom\-lport\fR or \fBto\-lport\fR +.TQ 3.00in +\fBmatch\fR +string +.TQ 3.00in +\fBaction\fR +string, one of \fBallow\-related\fR, \fBallow\-stateless\fR, \fBallow\fR, \fBdrop\fR, \fBpass\fR, or \fBreject\fR +.TQ 3.00in +\fBtier\fR +integer, in range 0 to 3 +.TQ .25in +\fIoptions:\fR +.RS .25in +.TQ 2.75in +\fBoptions : apply-after-lb\fR +optional string +.RE +.TQ .25in +\fILogging:\fR +.RS .25in +.TQ 2.75in +\fBlog\fR +boolean +.TQ 2.75in +\fBname\fR +optional string, at most 63 characters long +.TQ 2.75in +\fBseverity\fR +optional string, one of \fBalert\fR, \fBdebug\fR, \fBinfo\fR, \fBnotice\fR, or \fBwarning\fR +.TQ 2.75in +\fBmeter\fR +optional string +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fIACL configuration options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : log-related\fR +optional string +.RE +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBlabel\fR: integer, in range 0 to 4,294,967,295" +Associates an identifier with the ACL\[char46] The same value will be written to corresponding connection tracker entry\[char46] The value should be a valid 32-bit unsigned integer\[char46] This value can help in debugging from connection tracker side\[char46] For example, through this \(dqlabel\(dq we can backtrack to the ACL rule which is causing a \(dqleaked\(dq connection\[char46] Connection tracker entries are created only for allowed connections so the label is valid only for allow and allow-related actions\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +The ACL rule\(cqs priority\[char46] Rules with numerically higher priority take precedence over those with lower\[char46] If two ACL rules with the same priority both match, then the one actually applied to a packet is undefined\[char46] +.IP +Return traffic from an \fBallow\-related\fR flow is always allowed and cannot be changed through an ACL\[char46] +.IP +\fBallow\-stateless\fR flows always take precedence before stateful ACLs, regardless of their priority\[char46] (Both \fBallow\fR and \fBallow\-related\fR ACLs can be stateful\[char46]) +.IP "\fBdirection\fR: string, either \fBfrom\-lport\fR or \fBto\-lport\fR" +Direction of the traffic to which this rule should apply: +.RS +.IP \(bu +\fBfrom\-lport\fR: Used to implement filters on traffic arriving from a logical port\[char46] These rules are applied to the logical switch\(cqs ingress pipeline\[char46] +.IP \(bu +\fBto\-lport\fR: Used to implement filters on traffic forwarded to a logical port\[char46] These rules are applied to the logical switch\(cqs egress pipeline\[char46] +.RE +.IP "\fBmatch\fR: string" +The packets that the ACL should match, in the same expression language used for the \fBmatch\fR column in the OVN Southbound database\(cqs \fBLogical_Flow\fR table\[char46] The \fBoutport\fR logical port is only available in the \fBto\-lport\fR direction (the \fBinport\fR is available in both directions)\[char46] +.IP +By default all traffic is allowed\[char46] When writing a more restrictive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets\[char46] +.IP +Note that you can not create an ACL matching on a port with type=router or type=localnet\[char46] +.IP "\fBaction\fR: string, one of \fBallow\-related\fR, \fBallow\-stateless\fR, \fBallow\fR, \fBdrop\fR, \fBpass\fR, or \fBreject\fR" +The action to take when the ACL rule matches: +.RS +.IP \(bu +\fBallow\-stateless\fR: Always forward the packet in stateless manner, omitting connection tracking mechanism, regardless of other rules defined for the switch\[char46] May require defining additional rules for inbound replies\[char46] For example, if you define a rule to allow outgoing TCP traffic directed to an IP address, then you probably also want to define another rule to allow incoming TCP traffic coming from this same IP address\[char46] In addition, traffic that matches stateless ACLs will bypass load-balancer DNAT/un-DNAT processing\[char46] Stateful ACLs should be used instead if the traffic is supposed to be load-balanced\[char46] +.IP \(bu +\fBallow\fR: Forward the packet\[char46] It will also send the packets through connection tracking when \fBallow\-related\fR rules exist on the logical switch\[char46] Otherwise, it\(cqs equivalent to \fBallow\-stateless\fR\[char46] +.IP \(bu +\fBallow\-related\fR: Forward the packet and related traffic (e\[char46]g\[char46] inbound replies to an outbound connection)\[char46] +.IP \(bu +\fBdrop\fR: Silently drop the packet\[char46] +.IP \(bu +\fBreject\fR: Drop the packet, replying with a RST for TCP or ICMPv4/ICMPv6 unreachable message for other IPv4/IPv6-based protocols\[char46] +.IP \(bu +\fBpass\fR: Pass to the next ACL tier\[char46] If using multiple ACL tiers, a match on this ACL will stop evaluating ACLs at the current tier and move to the next one\[char46] If not using ACL tiers or if a \fBpass\fR ACL is matched at the final tier, then the \fBoptions:default_acl_drop\fR option from the \fBNB_Global\fR table is used to determine how to proceed\[char46] +.RE +.IP "\fBtier\fR: integer, in range 0 to 3" +The hierarchical tier that this ACL belongs to\[char46] +.IP +ACLs can be assigned to numerical tiers\[char46] When evaluating ACLs, an internal counter is used to determine which tier of ACLs should be evaluated\[char46] Tier 0 ACLs are evaluated first\[char46] If no verdict can be determined, then tier 1 ACLs are evaluated next\[char46] This continues until the maximum tier value is reached\[char46] If all tiers of ACLs are evaluated and no verdict is reached, then the \fBoptions:default_acl_drop\fR option from table \fBNB_Global\fR is used to determine how to proceed\[char46] +.IP +In this version of OVN, the maximum tier value for ACLs is 3, meaning there are 4 tiers of ACLs allowed (0\-3)\[char46] +.ST "options:" +.PP +.PP +.PP +ACLs options\[char46] +.IP "\fBoptions : apply-after-lb\fR: optional string" +If set to true, the ACL will be applied after load balancing stage\[char46] Supported only for \fBfrom\-lport\fR direction\[char46] +.IP +The main use case of this option is to support ACLs matching on the destination IP address of the packet for the backend IPs of load balancers\[char46] +.IP +\fBOVN\fR will apply the \fBfrom\-lport\fR ACLs in two stages\[char46] ACLs without this option \fBapply\-after\-lb\fR set, will be applied before the load balancer stage and ACLs with this option set will be applied after the load balancer stage\[char46] The priorities are indepedent between these stages and may not be obvious to the CMS\[char46] Hence CMS should be extra careful when using this option and should carefully evaluate the priorities of all the ACLs and the default deny/allow ACLs if any\[char46] +.ST "Logging:" +.PP +.PP +.PP +These columns control whether and how OVN logs packets that match an ACL\[char46] +.IP "\fBlog\fR: boolean" +If set to \fBtrue\fR, packets that match the ACL will trigger a log message on the transport node or nodes that perform ACL processing\[char46] Logging may be combined with any \fBaction\fR\[char46] +.IP +If set to \fBfalse\fR, the remaining columns in this group have no significance\[char46] +.IP "\fBname\fR: optional string, at most 63 characters long" +This name, if it is provided, is included in log records\[char46] It provides the administrator and the cloud management system a way to associate a log record with a particular ACL\[char46] +.IP "\fBseverity\fR: optional string, one of \fBalert\fR, \fBdebug\fR, \fBinfo\fR, \fBnotice\fR, or \fBwarning\fR" +The severity of the ACL\[char46] The severity levels match those of syslog, in decreasing level of severity: \fBalert\fR, \fBwarning\fR, \fBnotice\fR, \fBinfo\fR, or \fBdebug\fR\[char46] When the column is empty, the default is \fBinfo\fR\[char46] +.IP "\fBmeter\fR: optional string" +The name of a meter to rate-limit log messages for the ACL\[char46] The string must match the \fBname\fR column of a row in the \fBMeter\fR table\[char46] By default, log messages are not rate-limited\[char46] In order to ensure that the same \fBMeter\fR rate limits multiple ACL logs separately, set the \fBfair\fR column\[char46] +.ST "Common Columns:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides general key/value settings\[char46] The supported options are described individually below\[char46] +.ST "ACL configuration options:" +.PP +.IP "\fBoptions : log-related\fR: optional string" +If set to \fBtrue\fR, then log when reply or related traffic is admitted from a stateful ACL\[char46] In order for this option to function, the \fBlog\fR option must be set to \fBtrue\fR and a \fBlabel\fR must be set, and it must be unique to the ACL\[char46] The label is necessary as it is the only means to associate the reply traffic with the ACL to which it belongs\[char46] It must be unique, because otherwise it is ambiguous which ACL will be matched\[char46] Note: If this option is enabled, an extra flow is installed in order to log the related traffic\[char46] Therefore, if this is enabled on all ACLs, then the total number of flows necessary to log the ACL traffic is doubled, compared to if this option is not enabled\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Logical_Router TABLE" +.PP +.PP +.PP +Each row represents one L3 logical router\[char46] +.SS "Summary: +.TQ 3.00in +\fBports\fR +set of \fBLogical_Router_Port\fRs +.TQ 3.00in +\fBstatic_routes\fR +set of \fBLogical_Router_Static_Route\fRs +.TQ 3.00in +\fBpolicies\fR +set of \fBLogical_Router_Policy\fRs +.TQ 3.00in +\fBenabled\fR +optional boolean +.TQ 3.00in +\fBnat\fR +set of \fBNAT\fRs +.TQ 3.00in +\fBload_balancer\fR +set of weak reference to \fBLoad_Balancer\fRs +.TQ 3.00in +\fBload_balancer_group\fR +set of \fBLoad_Balancer_Group\fRs +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.75in +\fBname\fR +string +.TQ 2.75in +\fBexternal_ids : neutron:router_name\fR +optional string +.RE +.TQ 3.00in +\fBcopp\fR +optional weak reference to \fBCopp\fR +.TQ .25in +\fIOptions:\fR +.RS .25in +.TQ 2.75in +\fBoptions : chassis\fR +optional string +.TQ 2.75in +\fBoptions : dnat_force_snat_ip\fR +optional string +.TQ 2.75in +\fBoptions : lb_force_snat_ip\fR +optional string +.TQ 2.75in +\fBoptions : mcast_relay\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : dynamic_neigh_routers\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : always_learn_from_arp_request\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : requested-tnl-key\fR +optional string, containing an integer, in range 1 to 16,777,215 +.TQ 2.75in +\fBoptions : snat-ct-zone\fR +optional string, containing an integer, in range 0 to 65,535 +.TQ 2.75in +\fBoptions : mac_binding_age_threshold\fR +optional string, containing an integer, in range 0 to 4,294,967,295 +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBports\fR: set of \fBLogical_Router_Port\fRs" +The router\(cqs ports\[char46] +.IP "\fBstatic_routes\fR: set of \fBLogical_Router_Static_Route\fRs" +Zero or more static routes for the router\[char46] +.IP "\fBpolicies\fR: set of \fBLogical_Router_Policy\fRs" +Zero or more routing policies for the router\[char46] +.IP "\fBenabled\fR: optional boolean" +This column is used to administratively set router state\[char46] If this column is empty or is set to \fBtrue\fR, the router is enabled\[char46] If this column is set to \fBfalse\fR, the router is disabled\[char46] A disabled router has all ingress and egress traffic dropped\[char46] +.IP "\fBnat\fR: set of \fBNAT\fRs" +One or more NAT rules for the router\[char46] NAT rules only work on Gateway routers, and on distributed routers with one and only one distributed gateway port\[char46] +.IP "\fBload_balancer\fR: set of weak reference to \fBLoad_Balancer\fRs" +Set of load balancers associated to this logical router\[char46] Load balancer Load balancer rules only work on the Gateway routers or routers with one and only one distributed gateway port\[char46] +.IP "\fBload_balancer_group\fR: set of \fBLoad_Balancer_Group\fRs" +Set of load balancers groups associated to this logical router\[char46] +.ST "Naming:" +.PP +.PP +.PP +These columns provide names for the logical router\[char46] From OVN\(cqs perspective, these names have no special meaning or purpose other than to provide convenience for human interaction with the northbound database\[char46] There is no requirement for the name to be unique\[char46] (For a unique identifier for a logical router, use its row UUID\[char46]) +.PP +.PP +(Originally, \fBname\fR was intended to serve the purpose of a human-friendly name, but the Neutron integration used it to uniquely identify its own router object, in the format \fBneutron\-\fIuuid\fB\fR\[char46] Later on, Neutron started propagating the friendly name of a router as \fBexternal_ids:neutron:router_name\fR\[char46] Perhaps this can be cleaned up someday\[char46]) +.IP "\fBname\fR: string" +A name for the logical router\[char46] +.IP "\fBexternal_ids : neutron:router_name\fR: optional string" +Another name for the logical router\[char46] +.IP "\fBcopp\fR: optional weak reference to \fBCopp\fR" +The control plane protection policy from table \fBCopp\fR used for metering packets sent to \fBovn\-controller\fR from logical ports of this router\[char46] +.ST "Options:" +.PP +.PP +.PP +Additional options for the logical router\[char46] +.IP "\fBoptions : chassis\fR: optional string" +If set, indicates that the logical router in question is a Gateway router (which is centralized) and resides in the set chassis\[char46] The same value is also used by \fBovn\-controller\fR to uniquely identify the chassis in the OVN deployment and comes from \fBexternal_ids:system\-id\fR in the \fBOpen_vSwitch\fR table of Open_vSwitch database\[char46] +.IP +The Gateway router can only be connected to a distributed router via a switch if SNAT and DNAT are to be configured in the Gateway router\[char46] +.IP "\fBoptions : dnat_force_snat_ip\fR: optional string" +If set, indicates a set of IP addresses to use to force SNAT a packet that has already been DNATed in the gateway router\[char46] When multiple gateway routers are configured, a packet can potentially enter any of the gateway router, get DNATted and eventually reach the logical switch port\[char46] For the return traffic to go back to the same gateway router (for unDNATing), the packet needs a SNAT in the first place\[char46] This can be achieved by setting the above option with a gateway specific set of IP addresses\[char46] This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a a space\[char46] +.IP "\fBoptions : lb_force_snat_ip\fR: optional string" +If set, this option can take two possible type of values\[char46] Either a set of IP addresses or the string value - \fBrouter_ip\fR\[char46] +.IP +If a set of IP addresses are configured, it indicates to use to force SNAT a packet that has already been load-balanced in the gateway router\[char46] When multiple gateway routers are configured, a packet can potentially enter any of the gateway routers, get DNATted as part of the load-balancing and eventually reach the logical switch port\[char46] For the return traffic to go back to the same gateway router (for unDNATing), the packet needs a SNAT in the first place\[char46] This can be achieved by setting the above option with a gateway specific set of IP addresses\[char46] This option may have exactly one IPv4 and/or one IPv6 address on it, separated by a space character\[char46] +.IP +If it is configured with the value \fBrouter_ip\fR, then the load balanced packet is SNATed with the IP of router port (attached to the gateway router) selected as the destination after taking the routing decision\[char46] +.IP "\fBoptions : mcast_relay\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +Enables/disables IP multicast relay between logical switches connected to the logical router\[char46] Default: False\[char46] +.IP "\fBoptions : dynamic_neigh_routers\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, the router will resolve neighbor routers\(cq MAC addresses only by dynamic ARP/ND, instead of prepopulating static mappings for all neighbor routers in the ARP/ND Resolution stage\[char46] This reduces number of flows, but requires ARP/ND messages to resolve the IP-MAC bindings when needed\[char46] It is \fBfalse\fR by default\[char46] It is recommended to set to \fBtrue\fR when a large number of logical routers are connected to the same logical switch but most of them never need to send traffic between each other\[char46] By default, ovn-northd does not create mappings to NAT and load balancer addresess\[char46] However, for NAT and load balancer addresses that have the \fBadd_route\fR option added, ovn-northd will create logical flows that map NAT and load balancer IP addresses to the appropriate MAC address\[char46] Setting \fIdynamic_neigh_routers\fR to \fBtrue\fR will prevent the automatic creation of these logical flows\[char46] +.IP "\fBoptions : always_learn_from_arp_request\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +This option controls the behavior when handling IPv4 ARP requests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC binding) entry is added/updated\[char46] +.IP +\fBtrue\fR - Always learn the MAC-IP binding, and add/update the MAC binding entry\[char46] +.IP +\fBfalse\fR - If there is a MAC binding for that IP and the MAC is different, or, if TPA of ARP request belongs to any router port on this router, then update/add that MAC-IP binding\[char46] Otherwise, don\(cqt update/add entries\[char46] +.IP +It is \fBtrue\fR by default\[char46] It is recommended to set to \fBfalse\fR when a large number of logical routers are connected to the same logical switch but most of them never need to send traffic between each other, to reduce the size of the MAC binding table\[char46] +.IP "\fBoptions : requested-tnl-key\fR: optional string, containing an integer, in range 1 to 16,777,215" +Configures the datapath tunnel key for the logical router\[char46] This is not needed because \fBovn\-northd\fR will assign an unique key for each datapath by itself\[char46] However, if it is configured, \fBovn\-northd\fR honors the configured value\[char46] +.IP "\fBoptions : snat-ct-zone\fR: optional string, containing an integer, in range 0 to 65,535" +Use the requested conntrack zone for SNAT with this router\[char46] This can be useful if egress traffic from the host running OVN comes from both OVN and other sources\[char46] This way, OVN and the other sources can make use of the same conntrack zone\[char46] +.IP "\fBoptions : mac_binding_age_threshold\fR: optional string, containing an integer, in range 0 to 4,294,967,295" +MAC binding aging \fBthreshold\fR value in seconds\[char46] MAC binding exceeding this timeout will be automatically removed\[char46] The value defaults to 0, which means disabled\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "QoS TABLE" +.PP +.PP +.PP +Each row in this table represents one QoS rule for a logical switch that points to it through its \fBqos_rules\fR column\[char46] Two types of QoS are supported: DSCP marking and metering\[char46] A \fBmatch\fR with the highest-\fBpriority\fR will have QoS applied to it\[char46] If the \fBaction\fR column is specified, then matching packets will have DSCP marking applied\[char46] If the \fBbandwidth\fR column is specified, then matching packets will have metering applied\[char46] \fBaction\fR and \fBbandwidth\fR are not exclusive, so both marking and metering by defined for the same QoS entry\[char46] If no row matches, packets will not have any QoS applied\[char46] +.SS "Summary: +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ 3.00in +\fBdirection\fR +string, either \fBfrom\-lport\fR or \fBto\-lport\fR +.TQ 3.00in +\fBmatch\fR +string +.TQ 3.00in +\fBaction\fR +map of string-integer pairs, key must be \fBdscp\fR, value in range 0 to 63 +.TQ 3.00in +\fBbandwidth\fR +map of string-integer pairs, key either \fBburst\fR or \fBrate\fR, value in range 1 to 4,294,967,295 +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +The QoS rule\(cqs priority\[char46] Rules with numerically higher priority take precedence over those with lower\[char46] If two QoS rules with the same priority both match, then the one actually applied to a packet is undefined\[char46] +.IP "\fBdirection\fR: string, either \fBfrom\-lport\fR or \fBto\-lport\fR" +The value of this field is similar to \fBACL\fR column in the OVN Northbound database\(cqs \fBACL\fR table\[char46] +.IP "\fBmatch\fR: string" +The packets that the QoS rules should match, in the same expression language used for the \fBmatch\fR column in the OVN Southbound database\(cqs \fBLogical_Flow\fR table\[char46] The \fBoutport\fR logical port is only available in the \fBto\-lport\fR direction (the \fBinport\fR is available in both directions)\[char46] +.IP "\fBaction\fR: map of string-integer pairs, key must be \fBdscp\fR, value in range 0 to 63" +When specified, matching flows will have DSCP marking applied\[char46] +.RS +.IP \(bu +\fBdscp\fR: The value of this action should be in the range of 0 to 63 (inclusive)\[char46] +.RE +.IP "\fBbandwidth\fR: map of string-integer pairs, key either \fBburst\fR or \fBrate\fR, value in range 1 to 4,294,967,295" +When specified, matching packets will have bandwidth metering applied\[char46] Traffic over the limit will be dropped\[char46] +.RS +.IP \(bu +\fBrate\fR: The value of rate limit in kbps\[char46] +.IP \(bu +\fBburst\fR: The value of burst rate limit in kilobits\[char46] This is optional and needs to specify the \fBrate\fR\[char46] +.RE +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Mirror TABLE" +.PP +.PP +.PP +Each row in this table represents a mirror that can be used for port mirroring\[char46] These mirrors are referenced by the \fBmirror_rules\fR column in the \fBLogical_Switch_Port\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBfilter\fR +string, one of \fBboth\fR, \fBfrom\-lport\fR, or \fBto\-lport\fR +.TQ 3.00in +\fBsink\fR +string +.TQ 3.00in +\fBtype\fR +string, one of \fBerspan\fR, \fBgre\fR, or \fBlocal\fR +.TQ 3.00in +\fBindex\fR +integer +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Represents the name of the mirror\[char46] +.IP "\fBfilter\fR: string, one of \fBboth\fR, \fBfrom\-lport\fR, or \fBto\-lport\fR" +The value of this field represents selection criteria of the mirror\[char46] \fBto\-lport\fR mirrors the packets coming into logical port\[char46] \fBfrom\-lport\fR mirrors the packets going out of logical port\[char46] \fBboth\fR mirrors for both directions\[char46] +.IP "\fBsink\fR: string" +The value of this field represents the destination/sink of the mirror\[char46] If the \fItype\fR is \fBgre\fR or \fBerspan\fR, the value indicates the tunnel remote IP (either IPv4 or IPv6)\[char46] For a \fItype\fR of \fBlocal\fR, this field defines a local interface on the OVS integration bridge to be used as the mirror destination\[char46] The interface must possess external-ids:mirror-id that matches this string\[char46] +.IP "\fBtype\fR: string, one of \fBerspan\fR, \fBgre\fR, or \fBlocal\fR" +The value of this field specifies the mirror type - \fBgre\fR, \fBerspan\fR or \fBlocal\fR\[char46] +.IP "\fBindex\fR: integer" +The value of this field represents the tunnel ID\[char46] If the configured tunnel type is \fBgre\fR, this field represents the \fBGRE\fR key value and if the configured tunnel type is \fBerspan\fR it represents the \fBerspan_idx\fR value\[char46] It is ignored if the type is \fBlocal\fR\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Meter TABLE" +.PP +.PP +.PP +Each row in this table represents a meter that can be used for QoS or rate-limiting\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBunit\fR +string, either \fBkbps\fR or \fBpktps\fR +.TQ 3.00in +\fBbands\fR +set of 1 or more \fBMeter_Band\fRs +.TQ 3.00in +\fBfair\fR +optional boolean +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for this meter\[char46] +.IP +Names that begin with \(dq__\(dq (two underscores) are reserved for OVN internal use and should not be added manually\[char46] +.IP "\fBunit\fR: string, either \fBkbps\fR or \fBpktps\fR" +The unit for \fBrate\fR and \fBburst_rate\fR parameters in the \fBbands\fR entry\[char46] \fBkbps\fR specifies kilobits per second, and \fBpktps\fR specifies packets per second\[char46] +.IP "\fBbands\fR: set of 1 or more \fBMeter_Band\fRs" +The bands associated with this meter\[char46] Each band specifies a rate above which the band is to take the action \fBaction\fR\[char46] If multiple bands\(cq rates are exceeded, then the band with the highest rate among the exceeded bands is selected\[char46] +.IP "\fBfair\fR: optional boolean" +This column is used to further describe the desired behavior of the meter when there are multiple references to it\[char46] If this column is empty or is set to \fBfalse\fR, the rate will be shared across all rows that refer to the same Meter \fBname\fR\[char46] Conversely, when this column is set to \fBtrue\fR, each user of the same Meter will be rate-limited on its own\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Meter_Band TABLE" +.PP +.PP +.PP +Each row in this table represents a meter band which specifies the rate above which the configured action should be applied\[char46] These bands are referenced by the \fBbands\fR column in the \fBMeter\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBaction\fR +string, must be \fBdrop\fR +.TQ 3.00in +\fBrate\fR +integer, in range 1 to 4,294,967,295 +.TQ 3.00in +\fBburst_size\fR +integer, in range 0 to 4,294,967,295 +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBaction\fR: string, must be \fBdrop\fR" +The action to execute when this band matches\[char46] The only supported action is \fBdrop\fR\[char46] +.IP "\fBrate\fR: integer, in range 1 to 4,294,967,295" +The rate limit for this band, in kilobits per second or bits per second, depending on whether the parent \fBMeter\fR entry\(cqs \fBunit\fR column specified \fBkbps\fR or \fBpktps\fR\[char46] +.IP "\fBburst_size\fR: integer, in range 0 to 4,294,967,295" +The maximum burst allowed for the band in kilobits or packets, depending on whether \fBkbps\fR or \fBpktps\fR was selected in the parent \fBMeter\fR entry\(cqs \fBunit\fR column\[char46] If the size is zero, the switch is free to select some reasonable value depending on its configuration\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Logical_Router_Port TABLE" +.PP +.PP +.PP +A port within an L3 logical router\[char46] +.PP +.PP +Exactly one \fBLogical_Router\fR row must reference a given logical router port\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBnetworks\fR +set of 1 or more strings +.TQ 3.00in +\fBmac\fR +string +.TQ 3.00in +\fBenabled\fR +optional boolean +.TQ .25in +\fIDistributed Gateway Ports:\fR +.RS .25in +.TQ 2.75in +\fBha_chassis_group\fR +optional \fBHA_Chassis_Group\fR +.TQ 2.75in +\fBgateway_chassis\fR +set of \fBGateway_Chassis\fRes +.TQ .25in +\fIOptions for Physical VLAN MTU Issues:\fR +.RS .25in +.TQ 2.50in +\fBoptions : reside-on-redirect-chassis\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.50in +\fBoptions : redirect-type\fR +optional string, either \fBbridged\fR or \fBoverlay\fR +.RE +.RE +.TQ 3.00in +\fBipv6_prefix\fR +set of strings +.TQ .25in +\fIipv6_ra_configs:\fR +.RS .25in +.TQ 2.75in +\fBipv6_ra_configs : address_mode\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : router_preference\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : route_info\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : mtu\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : send_periodic\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : max_interval\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : min_interval\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : rdnss\fR +optional string +.TQ 2.75in +\fBipv6_ra_configs : dnssl\fR +optional string +.RE +.TQ .25in +\fIOptions:\fR +.RS .25in +.TQ 2.75in +\fBoptions : mcast_flood\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : requested-tnl-key\fR +optional string, containing an integer, in range 1 to 32,767 +.TQ 2.75in +\fBoptions : prefix_delegation\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : prefix\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 2.75in +\fBoptions : route_table\fR +optional string +.TQ 2.75in +\fBoptions : gateway_mtu\fR +optional string, containing an integer, in range 68 to 65,535 +.TQ 2.75in +\fBoptions : gateway_mtu_bypass\fR +optional string +.RE +.TQ .25in +\fIAttachment:\fR +.RS .25in +.TQ 2.75in +\fBpeer\fR +optional string +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for the logical router port\[char46] +.IP +In addition to provide convenience for human interaction with the northbound database, this column is used as reference by its patch port in \fBLogical_Switch_Port\fR or another logical router port in \fBLogical_Router_Port\fR\[char46] +.IP +A logical router port may not have the same name as a logical switch port, but the database schema cannot enforce this\[char46] +.IP "\fBnetworks\fR: set of 1 or more strings" +The IP addresses and netmasks of the router\[char46] For example, \fB192\[char46]168\[char46]0\[char46]1/24\fR indicates that the router\(cqs IP address is 192\[char46]168\[char46]0\[char46]1 and that packets destined to 192\[char46]168\[char46]0\[char46]\fIx\fR should be routed to this port\[char46] +.IP +A logical router port always adds a link-local IPv6 address (fe80::/64) automatically generated from the interface\(cqs MAC address using the modified EUI\-64 format\[char46] +.IP "\fBmac\fR: string" +The Ethernet address that belongs to this router port\[char46] +.IP "\fBenabled\fR: optional boolean" +This column is used to administratively set port state\[char46] If this column is empty or is set to \fBtrue\fR, the port is enabled\[char46] If this column is set to \fBfalse\fR, the port is disabled\[char46] A disabled port has all ingress and egress traffic dropped\[char46] +.ST "Distributed Gateway Ports:" +.PP +.PP +.PP +Gateways, as documented under \fBGateways\fR in the OVN architecture guide, provide limited connectivity between logical networks and physical ones\[char46] OVN support multiple kinds of gateways\[char46] The \fBLogical_Router_Port\fR table can be used two different ways to configure \fIdistributed gateway ports\fR, which are one kind of gateway\[char46] These two forms of configuration exist for historical reasons\[char46] Both of them produce the same kind of OVN southbound records and the same behavior in practice\[char46] +.PP +.PP +If either of these are set, this logical router port represents a distributed gateway port that connects this router to a logical switch with a \fBlocalnet\fR port or a connection to another OVN deployment\[char46] +.PP +.PP +Also mentioned in the OVN architecture guide, distributed gateway ports can also be used for scalability reasons in deployments where logical switches are dedicated to chassises rather than distributed\[char46] +.PP +.PP +The preferred way to configure a gateway is \fBha_chassis_group\fR, but \fBgateway_chassis\fR is also supported for backward compatibility\[char46] Only one of these should be set at a time on a given LRP, since they configure the same features\[char46] +.PP +.PP +Even when a gateway is configured, the logical router port still effectively resides on each chassis\[char46] However, due to the implications of the use of L2 learning in the physical network, as well as the need to support advanced features such as one-to-many NAT (aka IP masquerading), a subset of the logical router processing is handled in a centralized manner on the gateway chassis\[char46] +.PP +.PP +There can be more than one distributed gateway ports configured on each logical router, each connecting to different L2 segments\[char46] Load-balancing is not yet supported on logical routers with more than one distributed gateway ports\[char46] +.PP +.PP +For each distributed gateway port, it may have more than one gateway chassises\[char46] When more than one gateway chassis is specified, OVN only uses one at a time\[char46] OVN can rely on OVS BFD implementation to monitor gateway connectivity, preferring the highest-priority gateway that is online\[char46] Priorities are specified in the \fBpriority\fR column of \fBGateway_Chassis\fR or \fBHA_Chassis\fR\[char46] +.PP +.PP +\fBovn\-northd\fR programs the \fBexternal_mac\fR rules specified in the LRP\(cqs LR into the peer logical switch\(cqs destination lookup on the chassis where the \fBlogical_port\fR resides\[char46] In addition, the logical router\(cqs MAC address is automatically programmed in the peer logical switch\(cqs destination lookup flow on the gateway chasssis\[char46] If it is desired to generate gratuitous ARPs for NAT addresses, then set the peer LSP\(cqs \fBoptions:nat-addresses\fR to \fBrouter\fR\[char46] +.PP +.PP +OVN 20\[char46]03 and earlier supported a third way to configure distributed gateway ports using \fBoptions:redirect\-chassis\fR to specify the gateway chassis\[char46] This method is no longer supported\[char46] Any remaining users should switch to one of the newer methods instead\[char46] A \fBgateway_chassis\fR may be easily configured from the command line, e\[char46]g\[char46] \fBovn\-nbctl lrp\-set\-gateway\-chassis +\fIlrp\fB \fIchassis\fB\fR\[char46] +.IP "\fBha_chassis_group\fR: optional \fBHA_Chassis_Group\fR" +Designates an \fBHA_Chassis_Group\fR to provide gateway high availability\[char46] +.IP "\fBgateway_chassis\fR: set of \fBGateway_Chassis\fRes" +Designates one or more \fBGateway_Chassis\fR for the logical router port\[char46] +.ST "Options for Physical VLAN MTU Issues:" +.PP +.PP +.PP +MTU issues arise in mixing tunnels with logical networks that are bridged to a physical VLAN\[char46] For an explanation of the MTU issues, see \fBPhysical VLAN MTU Issues\fR in the OVN architecture document\[char46] The following options, which are alternatives, provide solutions\[char46] Both of them cause packets to be sent over \fBlocalnet\fR instead of tunnels, but they differ in whether some or all packets are sent this way\[char46] The most prominent tradeoff between these options is that \fBreside\-on\-redirect\-chassis\fR is easier to configure and that \fBredirect\-type\fR performs better for east-west traffic\[char46] +.IP "\fBoptions : reside-on-redirect-chassis\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, this option forces all traffic across the logical router port to pass through the gateway chassis using a hop across a \fBlocalnet\fR port\[char46] This changes behavior in two ways: +.RS +.IP \(bu +Without this option, east-west traffic passes directly between source and destination chassis (or even within a single chassis, for co-located VMs)\[char46] With this option, all east-west traffic passes through the gateway chassis\[char46] +.IP \(bu +Without this option, traffic between the gateway chassis and other chassis is encapsulated in tunnels\[char46] With this option, traffic passes over a \fBlocalnet\fR interface\[char46] +.RE +.IP +This option may usefully be set only on logical router ports that connect a distributed logical router to a logical switch with VIFs\[char46] It should not be set on a distributed gateway port\[char46] +.IP +OVN honors this option only if the logical router has one and only one distributed gateway port and if the LRP\(cqs peer switch has a \fBlocalnet\fR port\[char46] +.IP "\fBoptions : redirect-type\fR: optional string, either \fBbridged\fR or \fBoverlay\fR" +If set to \fBbridged\fR on a distributed gateway port, this option causes OVN to redirect packets to the gateway chassis over a \fBlocalnet\fR port instead of a tunnel\[char46] The relevant chassis must share a \fBlocalnet\fR port\[char46] +.IP +This feature requires the administrator or the CMS to configure each participating chassis with a unique Ethernet address for the logical router by setting \fBovn\-chassis\-mac\-mappings\fR in the Open vSwitch database, for use by \fBovn\-controller\fR\[char46] +.IP +Setting this option to \fBoverlay\fR or leaving it unset has no effect\[char46] This option may usefully be set only on a distributed gateway port when there is one and only one distributed gateway port on the logical router\[char46] It is otherwise ignored\[char46] +.IP "\fBipv6_prefix\fR: set of strings" +This column contains IPv6 prefix obtained by prefix delegation router according to RFC 3633 +.ST "ipv6_ra_configs:" +.PP +.PP +.PP +This column defines the IPv6 ND RA address mode and ND MTU Option to be included by \fBovn\-controller\fR when it replies to the IPv6 Router solicitation requests\[char46] +.IP "\fBipv6_ra_configs : address_mode\fR: optional string" +The address mode to be used for IPv6 address configuration\[char46] The supported values are: +.RS +.IP \(bu +\fBslaac\fR: Address configuration using Router Advertisement (RA) packet\[char46] The IPv6 prefixes defined in the \fBLogical_Router_Port\fR table\(cqs \fBnetworks\fR column will be included in the RA\(cqs ICMPv6 option - Prefix information\[char46] +.IP \(bu +\fBdhcpv6_stateful\fR: Address configuration using DHCPv6\[char46] +.IP \(bu +\fBdhcpv6_stateless\fR: Address configuration using Router Advertisement (RA) packet\[char46] Other IPv6 options are provided by DHCPv6\[char46] +.RE +.IP "\fBipv6_ra_configs : router_preference\fR: optional string" +Default Router Preference (PRF) indicates whether to prefer this router over other default routers (RFC 4191)\[char46] Possible values are: +.RS +.IP \(bu +HIGH: mapped to 0x01 in RA PRF field +.IP \(bu +MEDIUM: mapped to 0x00 in RA PRF field +.IP \(bu +LOW: mapped to 0x11 in RA PRF field +.RE +.IP "\fBipv6_ra_configs : route_info\fR: optional string" +Route Info is used to configure Route Info Option sent in Router Advertisement according to RFC 4191\[char46] Route Info is a comma separated string where each field provides PRF and prefix for a given route (e\[char46]g: HIGH-aef1::11/48,LOW-aef2::11/96) Possible PRF values are: +.RS +.IP \(bu +HIGH: mapped to 0x01 in RA PRF field +.IP \(bu +MEDIUM: mapped to 0x00 in RA PRF field +.IP \(bu +LOW: mapped to 0x11 in RA PRF field +.RE +.IP "\fBipv6_ra_configs : mtu\fR: optional string" +The recommended MTU for the link\[char46] Default is 0, which means no MTU Option will be included in RA packet replied by ovn-controller\[char46] Per RFC 2460, the mtu value is recommended no less than 1280, so any mtu value less than 1280 will be considered as no MTU Option\[char46] +.IP "\fBipv6_ra_configs : send_periodic\fR: optional string" +If set to true, then this router interface will send router advertisements periodically\[char46] The default is false\[char46] +.IP "\fBipv6_ra_configs : max_interval\fR: optional string" +The maximum number of seconds to wait between sending periodic router advertisements\[char46] This option has no effect if \fBipv6_ra_configs:send_periodic\fR is false\[char46] The default is 600\[char46] +.IP "\fBipv6_ra_configs : min_interval\fR: optional string" +The minimum number of seconds to wait between sending periodic router advertisements\[char46] This option has no effect if \fBipv6_ra_configs:send_periodic\fR is false\[char46] The default is one-third of \fBipv6_ra_configs:max_interval\fR, i\[char46]e\[char46] 200 seconds if that key is unset\[char46] +.IP "\fBipv6_ra_configs : rdnss\fR: optional string" +IPv6 address of RDNSS server announced in RA packets\[char46] At the moment OVN supports just one RDNSS server\[char46] +.IP "\fBipv6_ra_configs : dnssl\fR: optional string" +DNS Search List announced in RA packets\[char46] Multiple DNS Search List must be \(cqcomma\(cq separated (e\[char46]g\[char46] \(dqa\[char46]b\[char46]c, d\[char46]e\[char46]f\(dq) +.ST "Options:" +.PP +.PP +.PP +Additional options for the logical router port\[char46] +.IP "\fBoptions : mcast_flood\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, multicast traffic (including reports) are unconditionally forwarded to the specific port\[char46] +.IP +This option applies when the port is part of a logical router which has \fBoptions\fR:mcast_relay set to \fBtrue\fR\[char46] +.IP +Default: \fBfalse\fR\[char46] +.IP "\fBoptions : requested-tnl-key\fR: optional string, containing an integer, in range 1 to 32,767" +Configures the port binding tunnel key for the port\[char46] Usually this is not needed because \fBovn\-northd\fR will assign an unique key for each port by itself\[char46] However, if it is configured, \fBovn\-northd\fR honors the configured value\[char46] +.IP "\fBoptions : prefix_delegation\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, enable IPv6 prefix delegation state machine on this logical router port (RFC3633)\[char46] IPv6 prefix delegation is available just on a gateway router or on a gateway router port\[char46] +.IP "\fBoptions : prefix\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +If set to \fBtrue\fR, this interface will receive an IPv6 prefix according to RFC3663 +.IP "\fBoptions : route_table\fR: optional string" +Designates lookup Logical_Router_Static_Routes with specified \fBroute_table\fR value\[char46] Routes to directly connected networks from same Logical Router and routes without \fBroute_table\fR option set have higher priority than routes with \fBroute_table\fR option set\[char46] +.IP "\fBoptions : gateway_mtu\fR: optional string, containing an integer, in range 68 to 65,535" +If set, logical flows will be added to router pipeline to check packet length\[char46] If packet length is greater than the value set, ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation Needed and Don\(cqt Fragment was Set) or ICMPv6 type 2 (Packet Too Big) code 0 (no route to destination) packets will be generated\[char46] This allows for Path MTU Discovery\[char46] +.IP "\fBoptions : gateway_mtu_bypass\fR: optional string" +When configured, represents a match expression, in the same expression language used for the \fBmatch\fR column in the OVN Southbound database\(cqs \fBLogical_Flow\fR table\[char46] Packets matching this expression will bypass the length check configured through the \fBoptions:gateway_mtu\fR option\[char46] +.ST "Attachment:" +.PP +.PP +.PP +A given router port serves one of two purposes: +.RS +.IP \(bu +To attach a logical switch to a logical router\[char46] A logical router port of this type is referenced by exactly one \fBLogical_Switch_Port\fR of type \fBrouter\fR\[char46] The value of \fBname\fR is set as \fBrouter\-port\fR in column \fBoptions\fR of \fBLogical_Switch_Port\fR\[char46] In this case \fBpeer\fR column is empty\[char46] +.IP \(bu +To connect one logical router to another\[char46] This requires a pair of logical router ports, each connected to a different router\[char46] Each router port in the pair specifies the other in its \fBpeer\fR column\[char46] No \fBLogical_Switch\fR refers to the router port\[char46] +.RE +.IP "\fBpeer\fR: optional string" +For a router port used to connect two logical routers, this identifies the other router port in the pair by \fBname\fR\[char46] +.IP +For a router port attached to a logical switch, this column is empty\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.IP +The \fBovn\-northd\fR program copies all these pairs into the \fBexternal_ids\fR column of the \fBPort_Binding\fR table in \fBOVN_Southbound\fR database\[char46] +.bp +.SH "Logical_Router_Static_Route TABLE" +.PP +.PP +.PP +Each record represents a static route\[char46] +.PP +.PP +When multiple routes match a packet, the longest-prefix match is chosen\[char46] For a given prefix length, a \fBdst\-ip\fR route is preferred over a \fBsrc\-ip\fR route\[char46] +.PP +.PP +When there are ECMP routes, i\[char46]e\[char46] multiple routes with same prefix and policy, one of them will be selected based on the 5-tuple hashing of the packet header\[char46] +.SS "Summary: +.TQ 3.00in +\fBip_prefix\fR +string +.TQ 3.00in +\fBpolicy\fR +optional string, either \fBdst\-ip\fR or \fBsrc\-ip\fR +.TQ 3.00in +\fBnexthop\fR +string +.TQ 3.00in +\fBoutput_port\fR +optional string +.TQ 3.00in +\fBbfd\fR +optional weak reference to \fBBFD\fR +.TQ 3.00in +\fBroute_table\fR +string +.TQ 3.00in +\fBexternal_ids : ic-learned-route\fR +optional string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fICommon options:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ 2.75in +\fBoptions : ecmp_symmetric_reply\fR +optional string +.TQ 2.75in +\fBoptions : origin\fR +optional string +.RE +.SS "Details: +.IP "\fBip_prefix\fR: string" +IP prefix of this route (e\[char46]g\[char46] 192\[char46]168\[char46]100\[char46]0/24)\[char46] +.IP "\fBpolicy\fR: optional string, either \fBdst\-ip\fR or \fBsrc\-ip\fR" +If it is specified, this setting describes the policy used to make routing decisions\[char46] This setting must be one of the following strings: +.RS +.IP \(bu +\fBsrc\-ip\fR: This policy sends the packet to the \fBnexthop\fR when the packet\(cqs source IP address matches \fBip_prefix\fR\[char46] +.IP \(bu +\fBdst\-ip\fR: This policy sends the packet to the \fBnexthop\fR when the packet\(cqs destination IP address matches \fBip_prefix\fR\[char46] +.RE +.IP +If not specified, the default is \fBdst\-ip\fR\[char46] +.IP "\fBnexthop\fR: string" +Nexthop IP address for this route\[char46] Nexthop IP address should be the IP address of a connected router port or the IP address of a logical port or can be set to \fBdiscard\fR for dropping packets which match the given route\[char46] +.IP "\fBoutput_port\fR: optional string" +The name of the \fBLogical_Router_Port\fR via which the packet needs to be sent out\[char46] This is optional and when not specified, OVN will automatically figure this out based on the \fBnexthop\fR\[char46] When this is specified and there are multiple IP addresses on the router port and none of them are in the same subnet of \fBnexthop\fR, OVN chooses the first IP address as the one via which the \fBnexthop\fR is reachable\[char46] +.IP "\fBbfd\fR: optional weak reference to \fBBFD\fR" +Reference to \fBBFD\fR row if the route has associated a BFD session +.IP "\fBroute_table\fR: string" +Any string to place route to separate routing table\[char46] If Logical Router Port has configured value in \fBoptions:route_table\fR other than empty string, OVN performs route lookup for all packets entering Logical Router ingress pipeline from this port in the following manner: +.RS +.IP \(bu +1\[char46] First lookup among \(dqglobal\(dq routes: routes without \fBroute_table\fR value set and routes to directly connected networks\[char46] +.IP \(bu +2\[char46] Next lookup among routes with same \fBroute_table\fR value as specified in LRP\(cqs options:route_table field\[char46] +.RE +.IP "\fBexternal_ids : ic-learned-route\fR: optional string" +\fBovn\-ic\fR populates this key if the route is learned from the global \fBOVN_IC_Southbound\fR database\[char46] In this case the value will be set to the uuid of the row in \fBRoute\fR table of the \fBOVN_IC_Southbound\fR database\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Common options:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides general key/value settings\[char46] The supported options are described individually below\[char46] +.IP "\fBoptions : ecmp_symmetric_reply\fR: optional string" +If true, then new traffic that arrives over this route will have its reply traffic bypass ECMP route selection and will be sent out this route instead\[char46] Note that this option overrides any rules set in the \fBLogical_Router_policy\fR table\[char46] This option only works on gateway routers (routers that have \fBoptions:chassis\fR set)\[char46] +.IP "\fBoptions : origin\fR: optional string" +In case ovn-interconnection has been learned this route, it will have its origin set: either \(dqconnected\(dq or \(dqstatic\(dq\[char46] This key is supposed to be written only by \fBovn\-ic\fR daemon\[char46] ovn-northd then checks this value when generating Logical Flows\[char46] \fBLogical_Router_Static_Route\fR records with same \fBip_prefix\fR within same Logical Router will have next lookup order based on \fBorigin\fR key value: +.RS +.IP 1. .4in +connected +.IP 2. .4in +static +.RE +.bp +.SH "Logical_Router_Policy TABLE" +.PP +.PP +.PP +Each row in this table represents one routing policy for a logical router that points to it through its \fBpolicies\fR column\[char46] The \fBaction\fR column for the highest-\fBpriority\fR matching row in this table determines a packet\(cqs treatment\[char46] If no row matches, packets are allowed by default\[char46] (Default-deny treatment is possible: add a rule with \fBpriority\fR 0, \fB1\fR as \fBmatch\fR, and \fBdrop\fR as \fBaction\fR\[char46]) +.SS "Summary: +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ 3.00in +\fBmatch\fR +string +.TQ 3.00in +\fBaction\fR +string, one of \fBallow\fR, \fBdrop\fR, or \fBreroute\fR +.TQ 3.00in +\fBnexthop\fR +optional string +.TQ 3.00in +\fBnexthops\fR +set of strings +.TQ 3.00in +\fBoptions : pkt_mark\fR +optional string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +The routing policy\(cqs priority\[char46] Rules with numerically higher priority take precedence over those with lower\[char46] A rule is uniquely identified by the priority and match string\[char46] +.IP "\fBmatch\fR: string" +The packets that the routing policy should match, in the same expression language used for the \fBmatch\fR column in the OVN Southbound database\(cqs \fBLogical_Flow\fR table\[char46] +.IP +By default all traffic is allowed\[char46] When writing a more restrictive policy, it is important to remember to allow flows such as ARP and IPv6 neighbor discovery packets\[char46] +.IP "\fBaction\fR: string, one of \fBallow\fR, \fBdrop\fR, or \fBreroute\fR" +The action to take when the routing policy matches: +.RS +.IP \(bu +\fBallow\fR: Forward the packet\[char46] +.IP \(bu +\fBdrop\fR: Silently drop the packet\[char46] +.IP \(bu +\fBreroute\fR: Reroute packet to \fBnexthop\fR or \fBnexthops\fR\[char46] +.RE +.IP "\fBnexthop\fR: optional string" +Note: This column is deprecated in favor of \fBnexthops\fR\[char46] +.IP +Next-hop IP address for this route, which should be the IP address of a connected router port or the IP address of a logical port\[char46] +.IP "\fBnexthops\fR: set of strings" +Next-hop ECMP IP addresses for this route\[char46] Each IP in the list should be the IP address of a connected router port or the IP address of a logical port\[char46] +.IP +One IP from the list is selected as next hop\[char46] +.IP "\fBoptions : pkt_mark\fR: optional string" +Marks the packet with the value specified when the router policy is applied\[char46] CMS can inspect this packet marker and take some decisions if desired\[char46] This value is not preserved when the packet goes out on the wire\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "NAT TABLE" +.PP +.PP +.PP +Each record represents a NAT rule\[char46] +.SS "Summary: +.TQ 3.00in +\fBtype\fR +string, one of \fBdnat\fR, \fBdnat_and_snat\fR, or \fBsnat\fR +.TQ 3.00in +\fBexternal_ip\fR +string +.TQ 3.00in +\fBexternal_mac\fR +optional string +.TQ 3.00in +\fBexternal_port_range\fR +string +.TQ 3.00in +\fBlogical_ip\fR +string +.TQ 3.00in +\fBlogical_port\fR +optional string +.TQ 3.00in +\fBallowed_ext_ips\fR +optional \fBAddress_Set\fR +.TQ 3.00in +\fBexempted_ext_ips\fR +optional \fBAddress_Set\fR +.TQ 3.00in +\fBgateway_port\fR +optional weak reference to \fBLogical_Router_Port\fR +.TQ 3.00in +\fBoptions : stateless\fR +optional string +.TQ 3.00in +\fBoptions : add_route\fR +optional string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBtype\fR: string, one of \fBdnat\fR, \fBdnat_and_snat\fR, or \fBsnat\fR" +Type of the NAT rule\[char46] +.RS +.IP \(bu +When \fBtype\fR is \fBdnat\fR, the externally visible IP address \fBexternal_ip\fR is DNATted to the IP address \fBlogical_ip\fR in the logical space\[char46] +.IP \(bu +When \fBtype\fR is \fBsnat\fR, IP packets with their source IP address that either matches the IP address in \fBlogical_ip\fR or is in the network provided by \fBlogical_ip\fR is SNATed into the IP address in \fBexternal_ip\fR\[char46] +.IP \(bu +When \fBtype\fR is \fBdnat_and_snat\fR, the externally visible IP address \fBexternal_ip\fR is DNATted to the IP address \fBlogical_ip\fR in the logical space\[char46] In addition, IP packets with the source IP address that matches \fBlogical_ip\fR is SNATed into the IP address in \fBexternal_ip\fR\[char46] +.RE +.IP "\fBexternal_ip\fR: string" +An IPv4 address\[char46] +.IP "\fBexternal_mac\fR: optional string" +A MAC address\[char46] +.IP +This is only used on the gateway port on distributed routers\[char46] This must be specified in order for the NAT rule to be processed in a distributed manner on all chassis\[char46] If this is not specified for a NAT rule on a distributed router, then this NAT rule will be processed in a centralized manner on the gateway port instance on the gateway chassis\[char46] +.IP +This MAC address must be unique on the logical switch that the gateway port is attached to\[char46] If the MAC address used on the \fBlogical_port\fR is globally unique, then that MAC address can be specified as this \fBexternal_mac\fR\[char46] +.IP "\fBexternal_port_range\fR: string" +L4 source port range +.IP +Range of ports, from which a port number will be picked that will replace the source port of to be NATed packet\[char46] This is basically PAT (port address translation)\[char46] +.IP +Value of the column is in the format, port_lo-port_hi\[char46] For example: external_port_range : \(dq1\-30000\(dq +.IP +Valid range of ports is 1\-65535\[char46] +.IP "\fBlogical_ip\fR: string" +An IPv4 network (e\[char46]g 192\[char46]168\[char46]1\[char46]0/24) or an IPv4 address\[char46] +.IP "\fBlogical_port\fR: optional string" +The name of the logical port where the \fBlogical_ip\fR resides\[char46] +.IP +This is only used on distributed routers\[char46] This must be specified in order for the NAT rule to be processed in a distributed manner on all chassis\[char46] If this is not specified for a NAT rule on a distributed router, then this NAT rule will be processed in a centralized manner on the gateway port instance on the gateway chassis\[char46] +.IP "\fBallowed_ext_ips\fR: optional \fBAddress_Set\fR" +It represents Address Set of external ips that NAT rule is applicable to\[char46] For SNAT type NAT rules, this refers to destination addresses\[char46] For DNAT type NAT rules, this refers to source addresses\[char46] +.IP +This configuration overrides the default NAT behavior of applying a rule solely based on internal IP\[char46] Without this configuration, NAT happens without considering the external IP (i\[char46]e dest/source for snat/dnat type rule)\[char46] With this configuration NAT rule is applied ONLY if external ip is in the input Address Set\[char46] +.IP "\fBexempted_ext_ips\fR: optional \fBAddress_Set\fR" +It represents Address Set of external ips that NAT rule is NOT applicable to\[char46] For SNAT type NAT rules, this refers to destination addresses\[char46] For DNAT type NAT rules, this refers to source addresses\[char46] +.IP +This configuration overrides the default NAT behavior of applying a rule solely based on internal IP\[char46] Without this configuration, NAT happens without considering the external IP (i\[char46]e dest/source for snat/dnat type rule)\[char46] With this configuration NAT rule is NOT applied if external ip is in the input Address Set\[char46] +.IP +If there are NAT rules in a logical router with overlapping IP prefixes (including /32), then usage of \fIexempted_ext_ips\fR should be avoided in following scenario\[char46] a\[char46] SNAT rule (let us say RULE1) with logical_ip PREFIX/MASK (let us say 50\[char46]0\[char46]0\[char46]0/24)\[char46] b\[char46] SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let us say 50\[char46]0\[char46]0\[char46]0/25)\[char46] c\[char46] Now, if exempted_ext_ips is associated with RULE2, then a logical ip which matches both 50\[char46]0\[char46]0\[char46]0/24 and 50\[char46]0\[char46]0\[char46]0/25 may get the RULE2 applied to it instead of RULE1\[char46] +.IP +\fIallowed_ext_ips\fR and \fIexempted_ext_ips\fR are mutually exclusive to each other\[char46] If both Address Sets are set for a rule, then the NAT rule is not considered\[char46] +.IP "\fBgateway_port\fR: optional weak reference to \fBLogical_Router_Port\fR" +A distributed gateway port in the \fBLogical_Router_Port\fR table where the NAT rule needs to be applied\[char46] +.IP +When multiple distributed gateway ports are configured on a \fBLogical_Router\fR, applying a NAT rule at each of the distributed gateway ports might not be desired\[char46] Consider the case where a logical router has 2 distributed gateway port, one with \fBnetworks\fR \fB50\[char46]0\[char46]0\[char46]10/24\fR and the other with \fBnetworks\fR \fB60\[char46]0\[char46]0\[char46]10/24\fR\[char46] If the logical router has a NAT rule of \fBtype\fR \fBsnat\fR, \fBlogical_ip\fR \fB10\[char46]1\[char46]1\[char46]0/24\fR and \fBexternal_ip\fR \fB50\[char46]1\[char46]1\[char46]20/24\fR, the rule needs to be selectively applied on matching packets entering/leaving through the distributed gateway port with \fBnetworks\fR \fB50\[char46]0\[char46]0\[char46]10/24\fR\[char46] +.IP +When a logical router has multiple distributed gateway ports and this column is not set for a NAT rule, then the rule will be applied at the distributed gateway port which is in the same network as the \fBexternal_ip\fR of the NAT rule, if such a router port exists\[char46] If logical router has a single distributed gateway port and this column is not set for a NAT rule, the rule will be applied at the distributed gateway port even if the router port is not in the same network as the \fBexternal_ip\fR of the NAT rule\[char46] +.IP "\fBoptions : stateless\fR: optional string" +Indicates if a dnat_and_snat rule should lead to connection tracking state or not\[char46] +.IP "\fBoptions : add_route\fR: optional string" +If set to \fBtrue\fR, then neighbor routers will have logical flows added that will allow for routing to the NAT address\[char46] It also will have ARP resolution logical flows added\[char46] By setting this option, it means there is no reason to create a \fBLogical_Router_Static_Route\fR from neighbor routers to this NAT address\[char46] It also means that no ARP request is required for neighbor routers to learn the IP-MAC mapping for this NAT address\[char46] This option only applies to NATs of type \fBdnat\fR and \fBdnat_and_snat\fR\[char46] For more information about what flows are added for IP routes, please see the \fBovn\-northd\fR manpage section on IP Routing\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "DHCP_Options TABLE" +.PP +.PP +.PP +OVN implements native DHCPv4 support which caters to the common use case of providing an IPv4 address to a booting instance by providing stateless replies to DHCPv4 requests based on statically configured address mappings\[char46] To do this it allows a short list of DHCPv4 options to be configured and applied at each compute host running \fBovn\-controller\fR\[char46] +.PP +.PP +OVN also implements native DHCPv6 support which provides stateless replies to DHCPv6 requests\[char46] +.SS "Summary: +.TQ 3.00in +\fBcidr\fR +string +.TQ .25in +\fIDHCPv4 options:\fR +.RS .25in +.TQ .25in +\fIMandatory DHCPv4 options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : server_id\fR +optional string +.TQ 2.50in +\fBoptions : server_mac\fR +optional string +.TQ 2.50in +\fBoptions : lease_time\fR +optional string, containing an integer, in range 0 to 4,294,967,295 +.RE +.TQ .25in +\fIIPv4 DHCP Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : router\fR +optional string +.TQ 2.50in +\fBoptions : netmask\fR +optional string +.TQ 2.50in +\fBoptions : dns_server\fR +optional string +.TQ 2.50in +\fBoptions : log_server\fR +optional string +.TQ 2.50in +\fBoptions : lpr_server\fR +optional string +.TQ 2.50in +\fBoptions : swap_server\fR +optional string +.TQ 2.50in +\fBoptions : policy_filter\fR +optional string +.TQ 2.50in +\fBoptions : router_solicitation\fR +optional string +.TQ 2.50in +\fBoptions : nis_server\fR +optional string +.TQ 2.50in +\fBoptions : ntp_server\fR +optional string +.TQ 2.50in +\fBoptions : netbios_name_server\fR +optional string +.TQ 2.50in +\fBoptions : classless_static_route\fR +optional string +.TQ 2.50in +\fBoptions : ms_classless_static_route\fR +optional string +.TQ 2.50in +\fBoptions : next_server\fR +optional string +.RE +.TQ .25in +\fIBoolean DHCP Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : ip_forward_enable\fR +optional string, either \fB0\fR or \fB1\fR +.TQ 2.50in +\fBoptions : router_discovery\fR +optional string, either \fB0\fR or \fB1\fR +.TQ 2.50in +\fBoptions : ethernet_encap\fR +optional string, either \fB0\fR or \fB1\fR +.RE +.TQ .25in +\fIInteger DHCP Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : default_ttl\fR +optional string, containing an integer, in range 0 to 255 +.TQ 2.50in +\fBoptions : tcp_ttl\fR +optional string, containing an integer, in range 0 to 255 +.TQ 2.50in +\fBoptions : mtu\fR +optional string, containing an integer, in range 68 to 65,535 +.TQ 2.50in +\fBoptions : T1\fR +optional string, containing an integer, in range 68 to 4,294,967,295 +.TQ 2.50in +\fBoptions : T2\fR +optional string, containing an integer, in range 68 to 4,294,967,295 +.TQ 2.50in +\fBoptions : arp_cache_timeout\fR +optional string, containing an integer, in range 0 to 255 +.TQ 2.50in +\fBoptions : tcp_keepalive_interval\fR +optional string, containing an integer, in range 0 to 255 +.TQ 2.50in +\fBoptions : netbios_node_type\fR +optional string, containing an integer, in range 0 to 255 +.RE +.TQ .25in +\fIString DHCP Options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : wpad\fR +optional string +.TQ 2.50in +\fBoptions : bootfile_name\fR +optional string +.TQ 2.50in +\fBoptions : path_prefix\fR +optional string +.TQ 2.50in +\fBoptions : tftp_server_address\fR +optional string +.TQ 2.50in +\fBoptions : hostname\fR +optional string +.TQ 2.50in +\fBoptions : domain_name\fR +optional string +.TQ 2.50in +\fBoptions : bootfile_name_alt\fR +optional string +.TQ 2.50in +\fBoptions : broadcast_address\fR +optional string +.RE +.TQ .25in +\fIDHCP Options of type host_id:\fR +.RS .25in +.TQ 2.50in +\fBoptions : tftp_server\fR +optional string +.RE +.TQ .25in +\fI DHCP Options of type domains:\fR +.RS .25in +.TQ 2.50in +\fBoptions : domain_search_list\fR +optional string +.RE +.RE +.TQ .25in +\fIDHCPv6 options:\fR +.RS .25in +.TQ .25in +\fIMandatory DHCPv6 options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : server_id\fR +optional string +.RE +.TQ .25in +\fIIPv6 DHCPv6 options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : dns_server\fR +optional string +.RE +.TQ .25in +\fIString DHCPv6 options:\fR +.RS .25in +.TQ 2.50in +\fBoptions : domain_search\fR +optional string +.TQ 2.50in +\fBoptions : dhcpv6_stateless\fR +optional string +.RE +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBcidr\fR: string" +The DHCPv4/DHCPv6 options will be included if the logical port has its IP address in this \fBcidr\fR\[char46] +.ST "DHCPv4 options:" +.PP +.PP +.PP +The CMS should define the set of DHCPv4 options as key/value pairs in the \fBoptions\fR column of this table\[char46] For \fBovn\-controller\fR to include these DHCPv4 options, the \fBdhcpv4_options\fR of \fBLogical_Switch_Port\fR should refer to an entry in this table\[char46] +.ST "Mandatory DHCPv4 options:" +.PP +.PP +.PP +The following options must be defined\[char46] +.IP "\fBoptions : server_id\fR: optional string" +The IP address for the DHCP server to use\[char46] This should be in the subnet of the offered IP\[char46] This is also included in the DHCP offer as option 54, ``server identifier\[char46]\(cq\(cq +.IP "\fBoptions : server_mac\fR: optional string" +The Ethernet address for the DHCP server to use\[char46] +.IP "\fBoptions : lease_time\fR: optional string, containing an integer, in range 0 to 4,294,967,295" +The offered lease time in seconds, +.IP +The DHCPv4 option code for this option is 51\[char46] +.ST "IPv4 DHCP Options:" +.PP +.PP +.PP +Below are the supported DHCPv4 options whose values are an IPv4 address, e\[char46]g\[char46] \fB192\[char46]168\[char46]1\[char46]1\fR\[char46] Some options accept multiple IPv4 addresses enclosed within curly braces, e\[char46]g\[char46] \fB{192\[char46]168\[char46]1\[char46]2, +192\[char46]168\[char46]1\[char46]3}\fR\[char46] Please refer to RFC 2132 for more details on DHCPv4 options and their codes\[char46] +.IP "\fBoptions : router\fR: optional string" +The IP address of a gateway for the client to use\[char46] This should be in the subnet of the offered IP\[char46] The DHCPv4 option code for this option is 3\[char46] +.IP "\fBoptions : netmask\fR: optional string" +The DHCPv4 option code for this option is 1\[char46] +.IP "\fBoptions : dns_server\fR: optional string" +The DHCPv4 option code for this option is 6\[char46] +.IP "\fBoptions : log_server\fR: optional string" +The DHCPv4 option code for this option is 7\[char46] +.IP "\fBoptions : lpr_server\fR: optional string" +The DHCPv4 option code for this option is 9\[char46] +.IP "\fBoptions : swap_server\fR: optional string" +The DHCPv4 option code for this option is 16\[char46] +.IP "\fBoptions : policy_filter\fR: optional string" +The DHCPv4 option code for this option is 21\[char46] +.IP "\fBoptions : router_solicitation\fR: optional string" +The DHCPv4 option code for this option is 32\[char46] +.IP "\fBoptions : nis_server\fR: optional string" +The DHCPv4 option code for this option is 41\[char46] +.IP "\fBoptions : ntp_server\fR: optional string" +The DHCPv4 option code for this option is 42\[char46] +.IP "\fBoptions : netbios_name_server\fR: optional string" +The DHCPv4 option code for this option is 44\[char46] +.IP "\fBoptions : classless_static_route\fR: optional string" +The DHCPv4 option code for this option is 121\[char46] +.IP +This option can contain one or more static routes, each of which consists of a destination descriptor and the IP address of the router that should be used to reach that destination\[char46] Please see RFC 3442 for more details\[char46] +.IP +Example: \fB{30\[char46]0\[char46]0\[char46]0/24,10\[char46]0\[char46]0\[char46]10, 0\[char46]0\[char46]0\[char46]0/0,10\[char46]0\[char46]0\[char46]1}\fR +.IP "\fBoptions : ms_classless_static_route\fR: optional string" +The DHCPv4 option code for this option is 249\[char46] This option is similar to \fBclassless_static_route\fR supported by Microsoft Windows DHCPv4 clients\[char46] +.IP "\fBoptions : next_server\fR: optional string" +The DHCPv4 option code for setting the \(dqNext server IP address\(dq field in the DHCP header\[char46] +.ST "Boolean DHCP Options:" +.PP +.PP +.PP +These options accept a Boolean value, expressed as \fB0\fR for false or \fB1\fR for true\[char46] +.IP "\fBoptions : ip_forward_enable\fR: optional string, either \fB0\fR or \fB1\fR" +The DHCPv4 option code for this option is 19\[char46] +.IP "\fBoptions : router_discovery\fR: optional string, either \fB0\fR or \fB1\fR" +The DHCPv4 option code for this option is 31\[char46] +.IP "\fBoptions : ethernet_encap\fR: optional string, either \fB0\fR or \fB1\fR" +The DHCPv4 option code for this option is 36\[char46] +.ST "Integer DHCP Options:" +.PP +.PP +.PP +These options accept a nonnegative integer value\[char46] +.IP "\fBoptions : default_ttl\fR: optional string, containing an integer, in range 0 to 255" +The DHCPv4 option code for this option is 23\[char46] +.IP "\fBoptions : tcp_ttl\fR: optional string, containing an integer, in range 0 to 255" +The DHCPv4 option code for this option is 37\[char46] +.IP "\fBoptions : mtu\fR: optional string, containing an integer, in range 68 to 65,535" +The DHCPv4 option code for this option is 26\[char46] +.IP "\fBoptions : T1\fR: optional string, containing an integer, in range 68 to 4,294,967,295" +This specifies the time interval from address assignment until the client begins trying to renew its address\[char46] The DHCPv4 option code for this option is 58\[char46] +.IP "\fBoptions : T2\fR: optional string, containing an integer, in range 68 to 4,294,967,295" +This specifies the time interval from address assignment until the client begins trying to rebind its address\[char46] The DHCPv4 option code for this option is 59\[char46] +.IP "\fBoptions : arp_cache_timeout\fR: optional string, containing an integer, in range 0 to 255" +The DHCPv4 option code for this option is 35\[char46] This option specifies the timeout in seconds for ARP cache entries\[char46] +.IP "\fBoptions : tcp_keepalive_interval\fR: optional string, containing an integer, in range 0 to 255" +The DHCPv4 option code for this option is 38\[char46] This option specifies the interval that the client TCP should wait before sending a keepalive message on a TCP connection\[char46] +.IP "\fBoptions : netbios_node_type\fR: optional string, containing an integer, in range 0 to 255" +The DHCPv4 option code for this option is 46\[char46] +.ST "String DHCP Options:" +.PP +.PP +.PP +These options accept a string value\[char46] +.IP "\fBoptions : wpad\fR: optional string" +The DHCPv4 option code for this option is 252\[char46] This option is used as part of web proxy auto discovery to provide a URL for a web proxy\[char46] +.IP "\fBoptions : bootfile_name\fR: optional string" +The DHCPv4 option code for this option is 67\[char46] This option is used to identify a bootfile\[char46] +.IP "\fBoptions : path_prefix\fR: optional string" +The DHCPv4 option code for this option is 210\[char46] In PXELINUX\(cq case this option is used to set a common path prefix, instead of deriving it from the bootfile name\[char46] +.IP "\fBoptions : tftp_server_address\fR: optional string" +The DHCPv4 option code for this option is 150\[char46] The option contains one or more IPv4 addresses that the client MAY use\[char46] This option is Cisco proprietary, the IEEE standard that matches with this requirement is option 66 (tftp_server)\[char46] +.IP "\fBoptions : hostname\fR: optional string" +The DHCPv4 option code for this option is 12\[char46] If set, indicates the DHCPv4 option \(dqHostname\(dq\[char46] Alternatively, this option can be configured in \fBoptions:hostname\fR column in table \fBLogical_Switch_Port\fR\[char46] If Hostname option value is set in both conflicting \fBLogical_Switch_Port\fR and \fBDHCP_Options\fR tables, \fBLogical_Switch_Port\fR takes precedence\[char46] +.IP "\fBoptions : domain_name\fR: optional string" +The DHCPv4 option code for this option is 15\[char46] This option specifies the domain name that client should use when resolving hostnames via the Domain Name System\[char46] +.IP "\fBoptions : bootfile_name_alt\fR: optional string" +\(dqbootfile_name_alt\(dq option is used to support iPXE\[char46] When both \(dqbootfile_name\(dq and \(dqbootfile_name_alt\(dq are provided by the CMS, \(dqbootfile_name\(dq will be used for option 67 if the dhcp request contains etherboot option (175), otherwise \(dqbootfile_name_alt\(dq will be used\[char46] +.IP "\fBoptions : broadcast_address\fR: optional string" +The DHCPv4 option code for this option is 28\[char46] This option specifies the IP address used as a broadcast address\[char46] +.ST "DHCP Options of type host_id:" +.PP +.PP +.PP +These options accept either an IPv4 address or a string value\[char46] +.IP "\fBoptions : tftp_server\fR: optional string" +The DHCPv4 option code for this option is 66\[char46] +.ST " DHCP Options of type domains:" +.PP +.PP +.PP +These options accept string value which is a comma separated list of domain names\[char46] The domain names are encoded based on RFC 1035\[char46] +.IP "\fBoptions : domain_search_list\fR: optional string" +The DHCPv4 option code for this option is 119\[char46] +.ST "DHCPv6 options:" +.PP +.PP +.PP +OVN also implements native DHCPv6 support\[char46] The CMS should define the set of DHCPv6 options as key/value pairs\[char46] The define DHCPv6 options will be included in the DHCPv6 response to the DHCPv6 Solicit/Request/Confirm packet from the logical ports having the IPv6 addresses in the \fBcidr\fR\[char46] +.ST "Mandatory DHCPv6 options:" +.PP +.PP +.PP +The following options must be defined\[char46] +.IP "\fBoptions : server_id\fR: optional string" +The Ethernet address for the DHCP server to use\[char46] This is also included in the DHCPv6 reply as option 2, ``Server Identifier\(cq\(cq to carry a DUID identifying a server between a client and a server\[char46] \fBovn\-controller\fR defines DUID based on Link-layer Address [DUID-LL]\[char46] +.ST "IPv6 DHCPv6 options:" +.PP +.PP +.PP +Below are the supported DHCPv6 options whose values are an IPv6 address, e\[char46]g\[char46] \fBaef0::4\fR\[char46] Some options accept multiple IPv6 addresses enclosed within curly braces, e\[char46]g\[char46] \fB{aef0::4, +aef0::5}\fR\[char46] Please refer to RFC 3315 for more details on DHCPv6 options and their codes\[char46] +.IP "\fBoptions : dns_server\fR: optional string" +The DHCPv6 option code for this option is 23\[char46] This option specifies the DNS servers that the VM should use\[char46] +.ST "String DHCPv6 options:" +.PP +.PP +.PP +These options accept string values\[char46] +.IP "\fBoptions : domain_search\fR: optional string" +The DHCPv6 option code for this option is 24\[char46] This option specifies the domain search list the client should use to resolve hostnames with DNS\[char46] +.IP +Example: \fB\(dqovn\[char46]org\(dq\fR\[char46] +.IP "\fBoptions : dhcpv6_stateless\fR: optional string" +This option specifies the OVN native DHCPv6 will work in stateless mode, which means OVN native DHCPv6 will not offer IPv6 addresses for VM/VIF ports, but only reply other configurations, such as DNS and domain search list\[char46] When setting this option with string value \(dqtrue\(dq, VM/VIF will configure IPv6 addresses by stateless way\[char46] Default value for this option is false\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Connection TABLE" +.PP +.PP +.PP +Configuration for a database connection to an Open vSwitch database (OVSDB) client\[char46] +.PP +.PP +This table primarily configures the Open vSwitch database server (\fBovsdb\-server\fR)\[char46] +.PP +.PP +The Open vSwitch database server can initiate and maintain active connections to remote clients\[char46] It can also listen for database connections\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtarget\fR +string (must be unique within table) +.RE +.TQ .25in +\fIClient Failure Detection and Handling:\fR +.RS .25in +.TQ 2.75in +\fBmax_backoff\fR +optional integer, at least 1,000 +.TQ 2.75in +\fBinactivity_probe\fR +optional integer +.RE +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBis_connected\fR +boolean +.TQ 2.75in +\fBstatus : last_error\fR +optional string +.TQ 2.75in +\fBstatus : state\fR +optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR +.TQ 2.75in +\fBstatus : sec_since_connect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : sec_since_disconnect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : locks_held\fR +optional string +.TQ 2.75in +\fBstatus : locks_waiting\fR +optional string +.TQ 2.75in +\fBstatus : locks_lost\fR +optional string +.TQ 2.75in +\fBstatus : n_connections\fR +optional string, containing an integer, at least 2 +.TQ 2.75in +\fBstatus : bound_port\fR +optional string, containing an integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBother_config\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtarget\fR: string (must be unique within table)" +Connection methods for clients\[char46] +.IP +The following connection methods are currently supported: +.RS +.TP +\fBssl:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified SSL \fIport\fR on the host at the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBtcp:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified TCP \fIport\fR on the host at the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBtcp:[::1]:6640\fR\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.TP +\fBpssl:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for SSL connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IPaddress (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap in square brackets, e\[char46]g\[char46] \fBpssl:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 (but not IPv6) addresses\[char46] A valid SSL configuration must be provided when this form is used, this can be specified either via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBptcp:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBptcp:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 addresses\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.RE +.IP +When multiple clients are configured, the \fBtarget\fR values must be unique\[char46] Duplicate \fBtarget\fR values yield unspecified results\[char46] +.ST "Client Failure Detection and Handling:" +.PP +.IP "\fBmax_backoff\fR: optional integer, at least 1,000" +Maximum number of milliseconds to wait between connection attempts\[char46] Default is implementation-specific\[char46] +.IP "\fBinactivity_probe\fR: optional integer" +Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message\[char46] If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe\[char46] If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect\[char46] Default is implementation-specific\[char46] A value of 0 disables inactivity probes\[char46] +.ST "Status:" +.PP +.PP +.PP +Key-value pair of \fBis_connected\fR is always updated\[char46] Other key-value pairs in the status columns may be updated depends on the \fBtarget\fR type\[char46] +.PP +.PP +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpunix:\fR), both \fBn_connections\fR and \fBis_connected\fR may also be updated while the remaining key-value pairs are omitted\[char46] +.PP +.PP +On the other hand, when \fBtarget\fR specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets\[char46] They are omitted\[char46] +.IP "\fBis_connected\fR: boolean" +\fBtrue\fR if currently connected to this client, \fBfalse\fR otherwise\[char46] +.IP "\fBstatus : last_error\fR: optional string" +A human-readable description of the last error on the connection to the manager; i\[char46]e\[char46] \fBstrerror(errno)\fR\[char46] This key will exist only if an error has occurred\[char46] +.IP "\fBstatus : state\fR: optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR" +The state of the connection to the manager: +.RS +.TP +\fBVOID\fR +Connection is disabled\[char46] +.TP +\fBBACKOFF\fR +Attempting to reconnect at an increasing period\[char46] +.TP +\fBCONNECTING\fR +Attempting to connect\[char46] +.TP +\fBACTIVE\fR +Connected, remote host responsive\[char46] +.TP +\fBIDLE\fR +Connection is idle\[char46] Waiting for response to keep-alive\[char46] +.RE +.IP +These values may change in the future\[char46] They are provided only for human consumption\[char46] +.IP "\fBstatus : sec_since_connect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last successfully connected to the database (in seconds)\[char46] Value is empty if client has never successfully been connected\[char46] +.IP "\fBstatus : sec_since_disconnect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last disconnected from the database (in seconds)\[char46] Value is empty if client has never disconnected\[char46] +.IP "\fBstatus : locks_held\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection holds\[char46] Omitted if the connection does not hold any locks\[char46] +.IP "\fBstatus : locks_waiting\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire\[char46] Omitted if the connection is not waiting for any locks\[char46] +.IP "\fBstatus : locks_lost\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client\[char46] Omitted if no locks have been stolen from this connection\[char46] +.IP "\fBstatus : n_connections\fR: optional string, containing an integer, at least 2" +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpssl:\fR) and more than one connection is actually active, the value is the number of active connections\[char46] Otherwise, this key-value pair is omitted\[char46] +.IP "\fBstatus : bound_port\fR: optional string, containing an integer" +When \fBtarget\fR is \fBptcp:\fR or \fBpssl:\fR, this is the TCP port on which the OVSDB server is listening\[char46] (This is particularly useful when \fBtarget\fR specifies a port of 0, allowing the kernel to choose any available port\[char46]) +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.IP "\fBother_config\fR: map of string-string pairs" +.bp +.SH "DNS TABLE" +.PP +.PP +.PP +Each row in this table stores the DNS records\[char46] The \fBLogical_Switch\fR table\(cqs \fBdns_records\fR references these records\[char46] +.SS "Summary: +.TQ 3.00in +\fBrecords\fR +map of string-string pairs +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBrecords\fR: map of string-string pairs" +Key-value pair of DNS records with \fBDNS query name\fR as the key and value as a string of IP address(es) separated by comma or space\[char46] For PTR requests, the key-value pair can be \fBReverse IPv4 address\[char46]in\-addr\[char46]arpa\fR and the value \fBDNS domain name\fR\[char46] For IPv6 addresses, the key has to be \fBReverse IPv6 address\[char46]ip6\[char46]arpa\fR\[char46] +.IP +\fBExample: \fR \(dqvm1\[char46]ovn\[char46]org\(dq = \(dq10\[char46]0\[char46]0\[char46]4 aef0::4\(dq +.IP +\fBExample: \fR \(dq4\[char46]0\[char46]0\[char46]10\[char46]in-addr\[char46]arpa\(dq = \(dqvm1\[char46]ovn\[char46]org\(dq +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "SSL TABLE" +.PP +SSL configuration for ovn-nb database access\[char46] +.SS "Summary: +.TQ 3.00in +\fBprivate_key\fR +string +.TQ 3.00in +\fBcertificate\fR +string +.TQ 3.00in +\fBca_cert\fR +string +.TQ 3.00in +\fBbootstrap_ca_cert\fR +boolean +.TQ 3.00in +\fBssl_protocols\fR +string +.TQ 3.00in +\fBssl_ciphers\fR +string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBprivate_key\fR: string" +Name of a PEM file containing the private key used as the switch\(cqs identity for SSL connections to the controller\[char46] +.IP "\fBcertificate\fR: string" +Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch\(cqs private key, identifying a trustworthy switch\[char46] +.IP "\fBca_cert\fR: string" +Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller\[char46] +.IP "\fBbootstrap_ca_cert\fR: boolean" +If set to \fBtrue\fR, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] \fBThis option exposes the +SSL connection to a man\-in\-the\-middle attack obtaining the initial +CA certificate\[char46]\fR It may still be useful for bootstrapping\[char46] +.IP "\fBssl_protocols\fR: string" +List of SSL protocols to be enabled for SSL connections\[char46] The default when this option is omitted is \fBTLSv1,TLSv1\[char46]1,TLSv1\[char46]2\fR\[char46] +.IP "\fBssl_ciphers\fR: string" +List of ciphers (in OpenSSL cipher string format) to be supported for SSL connections\[char46] The default when this option is omitted is \fBHIGH:!aNULL:!MD5\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Gateway_Chassis TABLE" +.PP +.PP +.PP +Association of a chassis to a logical router port\[char46] The traffic going out through an specific router port will be redirected to a chassis, or a set of them in high availability configurations\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBchassis_name\fR +string +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ 3.00in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Name of the \fBGateway_Chassis\fR\[char46] +.IP +A suggested, but not required naming convention is \fB${port_name}_${chassis_name}\fR\[char46] +.IP "\fBchassis_name\fR: string" +Name of the chassis that we want to redirect traffic through for the associated logical router port\[char46] The value must match the \fBname\fR column of the \fBChassis\fR table in the \fBOVN_Southbound\fR database\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +This is the priority of a chassis among all \fBGateway_Chassis\fR belonging to the same logical router port\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Reserved for future use\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "HA_Chassis_Group TABLE" +.PP +.PP +.PP +Table representing a group of chassis which can provide high availability services\[char46] Each chassis in the group is represented by the table \fBHA_Chassis\fR\[char46] The HA chassis with highest priority will be the master of this group\[char46] If the master chassis failover is detected, the HA chassis with the next higher priority takes over the responsibility of providing the HA\[char46] If a distributed gateway router port references a row in this table, then the master HA chassis in this group provides the gateway functionality\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBha_chassis\fR +set of \fBHA_Chassis\fRes +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Name of the \fBHA_Chassis_Group\fR\[char46] Name should be unique\[char46] +.IP "\fBha_chassis\fR: set of \fBHA_Chassis\fRes" +A list of HA chassis which belongs to this group\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "HA_Chassis TABLE" +.PP +.SS "Summary: +.TQ 3.00in +\fBchassis_name\fR +string +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBchassis_name\fR: string" +Name of the chassis which is part of the HA chassis group\[char46] The value must match the \fBname\fR column of the \fBChassis\fR table in the \fBOVN_Southbound\fR database\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +Priority of the chassis\[char46] Chassis with highest priority will be the master\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "BFD TABLE" +.PP +.PP +.PP +Contains BFD parameter for ovn-controller BFD configuration\[char46] OVN BFD implementation is used to provide detection of failures in the path between adjacent forwarding engines, including the OVN interfaces\[char46] OVN BFD provides link status info to OVN northd in order to update logical flows according to the status of BFD endpoints\[char46] In the current implementation OVN BFD is used to check next-hop status for ECMP routes\[char46] Please note BFD table refers to OVN BFD implementation and not to OVS legacy one\[char46] +.SS "Summary: +.TQ .25in +\fIConfiguration:\fR +.RS .25in +.TQ 2.75in +\fBlogical_port\fR +string +.TQ 2.75in +\fBdst_ip\fR +string +.TQ 2.75in +\fBmin_tx\fR +optional integer, at least 1 +.TQ 2.75in +\fBmin_rx\fR +optional integer +.TQ 2.75in +\fBdetect_mult\fR +optional integer, at least 1 +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fIStatus Reporting:\fR +.RS .25in +.TQ 2.75in +\fBstatus\fR +optional string, one of \fBadmin_down\fR, \fBdown\fR, \fBinit\fR, or \fBup\fR +.RE +.SS "Details: +.ST "Configuration:" +.PP +.PP +.PP +\fBovn\-northd\fR reads configuration from these columns\[char46] +.IP "\fBlogical_port\fR: string" +OVN logical port when BFD engine is running\[char46] +.IP "\fBdst_ip\fR: string" +BFD peer IP address\[char46] +.IP "\fBmin_tx\fR: optional integer, at least 1" +This is the minimum interval, in milliseconds, that the local system would like to use when transmitting BFD Control packets, less any jitter applied\[char46] The value zero is reserved\[char46] Default value is 1000 ms\[char46] +.IP "\fBmin_rx\fR: optional integer" +This is the minimum interval, in milliseconds, between received BFD Control packets that this system is capable of supporting, less any jitter applied by the sender\[char46] If this value is zero, the transmitting system does not want the remote system to send any periodic BFD Control packets\[char46] +.IP "\fBdetect_mult\fR: optional integer, at least 1" +Detection time multiplier\[char46] The negotiated transmit interval, multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode\[char46] Default value is 5\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Reserved for future use\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Status Reporting:" +.PP +.PP +.PP +\fBovn\-northd\fR writes BFD status into these columns\[char46] +.IP "\fBstatus\fR: optional string, one of \fBadmin_down\fR, \fBdown\fR, \fBinit\fR, or \fBup\fR" +BFD port logical states\[char46] Possible values are: +.RS +.IP \(bu +\fBadmin_down\fR +.IP \(bu +\fBdown\fR +.IP \(bu +\fBinit\fR +.IP \(bu +\fBup\fR +.RE +.bp +.SH "Static_MAC_Binding TABLE" +.PP +.PP +.PP +Each record represents a Static_MAC_Binding entry for a logical router\[char46] +.SS "Summary: +.TQ .25in +\fIConfiguration:\fR +.RS .25in +.TQ 2.75in +\fBlogical_port\fR +string +.TQ 2.75in +\fBip\fR +string +.TQ 2.75in +\fBmac\fR +string +.TQ 2.75in +\fBoverride_dynamic_mac\fR +boolean +.RE +.SS "Details: +.ST "Configuration:" +.PP +.PP +.PP +\fBovn\-northd\fR reads configuration from these columns and propagates the value to SBDB\[char46] +.IP "\fBlogical_port\fR: string" +The logical router port for the binding\[char46] +.IP "\fBip\fR: string" +The bound IP address\[char46] +.IP "\fBmac\fR: string" +The Ethernet address to which the IP is bound\[char46] +.IP "\fBoverride_dynamic_mac\fR: boolean" +Override dynamically learnt MACs\[char46] +.bp +.SH "Chassis_Template_Var TABLE" +.PP +.PP +.PP +One record per chassis, each containing a map, \fBvariables\fR, between template variable names and their value for that specific chassis\[char46] A template variable has a name and potentially different values on different hypervisors in the OVN cluster\[char46] For example, two rows, \fBR1 = (\[char46]chassis=C1, variables={(N: V1)}\fR and \fBR2 = (\[char46]chassis=C2, variables={(N: V2)}\fR will make \fBovn\-controller\fR running on chassis \fBC1\fR and \fBC2\fR interpret the token \fBN\fR either as \fBV1\fR (on \fBC1\fR) or as \fBV2\fR (on \fBC2\fR)\[char46] Users can refer to template variables from within other logical components, e\[char46]g\[char46], within ACL, QoS or Logical_Router_Policy matches or from Load_Balancer VIP and backend definitions\[char46] +.PP +.PP +If a template variable is referenced on a chassis for which that variable is not defined then \fBovn\-controller\fR running on that chassis will just interpret it as a raw string literal\[char46] +.SS "Summary: +.TQ 3.00in +\fBchassis\fR +string (must be unique within table) +.TQ 3.00in +\fBvariables\fR +map of string-string pairs +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBchassis\fR: string (must be unique within table)" +The chassis this set of variable values applies to\[char46] +.IP "\fBvariables\fR: map of string-string pairs" +The set of variable values for a given chassis\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nb.5.html b/src/static/support/dist-docs-branch-23.06/ovn-nb.5.html new file mode 100644 index 00000000..24ae1893 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-nb.5.html @@ -0,0 +1,4100 @@ +

+ovn-nb(5)                     Open vSwitch Manual                    ovn-nb(5)
+
+NAME
+       ovn-nb - OVN_Northbound database schema
+
+       This  database  is  the  interface between OVN and the cloud management
+       system (CMS), such as OpenStack, running above it. The CMS produces alā€
+       most all of the contents of the database. The ovn-northd program  moniā€
+       tors  the  database  contents,  transforms  it,  and stores it into the
+       OVN_Southbound database.
+
+       We generally speak of ``theā€™ā€™ CMS, but one  can  imagine  scenarios  in
+       which multiple CMSes manage different parts of an OVN deployment.
+
+   External IDs
+       Each  of  the  tables in this database contains a special column, named
+       external_ids. This column has the same form and purpose each  place  it
+       appears.
+
+              external_ids: map of string-string pairs
+                     Key-value  pairs  for  use  by the CMS. The CMS might use
+                     certain pairs, for example, to identify entities  in  its
+                     own  configuration that correspond to those in this dataā€
+                     base.
+
+TABLE SUMMARY
+       The following list summarizes the purpose of each of the tables in  the
+       OVN_Northbound  database.   Each table is described in more detail on a
+       later page.
+
+       Table     Purpose
+       NB_Global Northbound configuration
+       Copp      Control plane protection
+       Logical_Switch
+                 L2 logical switch
+       Logical_Switch_Port
+                 L2 logical switch port
+       Forwarding_Group
+                 forwarding group
+       Address_Set
+                 Address Sets
+       Port_Group
+                 Port Groups
+       Load_Balancer
+                 load balancer
+       Load_Balancer_Group
+                 load balancer group
+       Load_Balancer_Health_Check
+                 load balancer
+       ACL       Access Control List (ACL) rule
+       Logical_Router
+                 L3 logical router
+       QoS       QoS rule
+       Mirror    Mirror Entry
+       Meter     Meter entry
+       Meter_Band
+                 Band for meter entries
+       Logical_Router_Port
+                 L3 logical router port
+       Logical_Router_Static_Route
+                 Logical router static routes
+       Logical_Router_Policy
+                 Logical router policies
+       NAT       NAT rules
+       DHCP_Options
+                 DHCP options
+       Connection
+                 OVSDB client connections.
+       DNS       Native DNS resolution
+       SSL       SSL configuration.
+       Gateway_Chassis
+                 Gateway_Chassis configuration.
+       HA_Chassis_Group
+                 HA_Chassis_Group configuration.
+       HA_Chassis
+                 HA_Chassis configuration.
+       BFD       BFD configuration.
+       Static_MAC_Binding
+                 Static_MAC_Binding configuration.
+       Chassis_Template_Var
+                 Chassis_Template_Var configuration.
+
+NB_Global TABLE
+       Northbound configuration for an OVN system. This table  must  have  exā€
+       actly one row.
+
+   Summary:
+       Identity:
+         name                        string
+       Status:
+         nb_cfg                      integer
+         nb_cfg_timestamp            integer
+         sb_cfg                      integer
+         sb_cfg_timestamp            integer
+         hv_cfg                      integer
+         hv_cfg_timestamp            integer
+       Common Columns:
+         external_ids                map of string-string pairs
+       Common options:
+         options                     map of string-string pairs
+         Options for configuring OVS BFD:
+            options : bfd-min-rx     optional string
+            options : bfd-decay-min-rx
+                                     optional string
+            options : bfd-min-tx     optional string
+            options : bfd-mult       optional string
+         options : mac_prefix        optional string
+         options : mac_binding_removal_limit
+                                     optional  string,  containing an integer,
+                                     in range 0 to 4,294,967,295
+         options : controller_event  optional string, either true or false
+         options : northd_probe_interval
+                                     optional string
+         options : ic_probe_interval
+                                     optional string
+         options : nbctl_probe_interval
+                                     optional string
+         options : northd_trim_timeout
+                                     optional string
+         options : use_logical_dp_groups
+                                     optional string
+         options : use_parallel_build
+                                     optional string
+         options : ignore_lsp_down   optional string
+         options : use_ct_inv_match  optional string
+         options : default_acl_drop  optional string
+         options : debug_drop_domain_id
+                                     optional string
+         options : debug_drop_collector_set
+                                     optional string
+         options : use_common_zone   optional string, either true or false
+         Options for configuring interconnection route advertisement:
+            options : ic-route-adv   optional string
+            options : ic-route-learn optional string
+            options : ic-route-adv-default
+                                     optional string
+            options : ic-route-learn-default
+                                     optional string
+            options : ic-route-blacklist
+                                     optional string
+       Connection Options:
+         connections                 set of Connections
+         ssl                         optional SSL
+       Security Configurations:
+         ipsec                       boolean
+       Read-only Options:
+         options : max_tunid         optional string
+
+   Details:
+     Identity:
+
+       name: string
+              The name of the OVN cluster, which uniquely identifies  the  OVN
+              cluster  throughout  all  OVN  clusters supposed to interconnect
+              with each other.
+
+     Status:
+
+       These columns allow a client to track the overall  configuration  state
+       of the system.
+
+       nb_cfg: integer
+              Sequence  number for client to increment. When a client modifies
+              any part of the northbound database configuration and wishes  to
+              wait  for ovn-northd and possibly all of the hypervisors to finā€
+              ish applying the changes, it may increment this sequence number.
+
+       nb_cfg_timestamp: integer
+              The timestamp, in milliseconds since the epoch, when  ovn-northd
+              sees the latest nb_cfg and starts processing.
+
+              To print the timestamp as a human-readable date:
+
+                        date -d "@$(ovn-nbctl get NB_Global . nb_cfg_timestamp | sed ā€™ā€™s/...$//ā€™ā€™)"
+
+
+       sb_cfg: integer
+              Sequence  number that ovn-northd sets to the value of nb_cfg afā€
+              ter it finishes applying the corresponding configuration changes
+              to the OVN_Southbound database.
+
+       sb_cfg_timestamp: integer
+              The timestamp, in milliseconds since the epoch, when  ovn-northd
+              finishes applying the corresponding configuration changes to the
+              OVN_Southbound database successfully.
+
+       hv_cfg: integer
+              Sequence  number  that  ovn-northd sets to the smallest sequence
+              number of all the chassis in the  system,  as  reported  in  the
+              Chassis_Private  table  in the southbound database. Thus, hv_cfg
+              equals nb_cfg if all chassis are caught up with  the  northbound
+              configuration  (which may never happen, if any chassis is down).
+              This value can regress, if a chassis was removed from the system
+              and rejoins before catching up.
+
+              If there are  no  chassis,  then  ovn-northd  copies  nb_cfg  to
+              hv_cfg.  Thus,  in  this case, the (nonexistent) hypervisors are
+              always considered to be caught up. This means  that  hypervisors
+              can  be  "caught  up" even in cases where sb_cfg would show that
+              the southbound database is not. To detect when both the hyperviā€
+              sors and the southbound database are caught up, a client  should
+              take the smaller of sb_cfg and hv_cfg.
+
+       hv_cfg_timestamp: integer
+              The  largest  timestamp, in milliseconds since the epoch, of the
+              smallest sequence number of all the chassis in  the  system,  as
+              reported  in  the  Chassis_Private table in the southbound dataā€
+              base. In other words, this timestamp reflects the time when  the
+              slowest  chassis  catches  up with the northbound configuration,
+              which is useful for end-to-end control  plane  latency  measureā€
+              ment.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Common options:
+
+       options: map of string-string pairs
+              This  column  provides general key/value settings. The supported
+              options are described individually below.
+
+     Options for configuring OVS BFD:
+
+       These options apply when ovn-controller configures OVS BFD  on  tunnels
+       interfaces. Please note these parameters refer to legacy OVS BFD impleā€
+       mentation and not to OVN BFD one.
+
+       options : bfd-min-rx: optional string
+              BFD  option  min-rx  value to use when configuring BFD on tunnel
+              interfaces.
+
+       options : bfd-decay-min-rx: optional string
+              BFD option decay-min-rx value to use  when  configuring  BFD  on
+              tunnel interfaces.
+
+       options : bfd-min-tx: optional string
+              BFD  option  min-tx  value to use when configuring BFD on tunnel
+              interfaces.
+
+       options : bfd-mult: optional string
+              BFD option mult value to use when configuring BFD on tunnel  inā€
+              terfaces.
+
+       options : mac_prefix: optional string
+              Configure  a  given  OUI to be used as prefix when L2 address is
+              dynamically assigned, e.g. 00:11:22
+
+       options : mac_binding_removal_limit: optional string, containing an inā€
+       teger, in range 0 to 4,294,967,295
+              MAC binding aging bulk removal limit. This limits how many  rows
+              can  expire in a single transaction. Default value is 0 which is
+              unlimited. When we hit the limit next batch removal  is  delayed
+              by 5 s.
+
+       options : controller_event: optional string, either true or false
+              Value  set by the CMS to enable/disable ovn-controller event reā€
+              porting. Traffic into OVS can raise a  ā€™controllerā€™  event  that
+              results   in  a  Controller_Event  being  written  to  the  Conā€ā€
+              troller_Event table in SBDB. When the CMS has seen the event and
+              taken appropriate action, it can remove the corresponding row in
+              Controller_Event table. The intention is for a CMS  to  see  the
+              events  and  take  some  sort  of  action.  Please  see the Conā€ā€
+              troller_Event table in SBDB. It is possible to associate a meter
+              to each controller event type in order to not overload the pincā€
+              trl thread under heavy load. Each event type relies on  a  meter
+              with a defined name:
+
+              ā€¢      empty_lb_backends: event-elb
+
+       options : northd_probe_interval: optional string
+              The  inactivity  probe  interval  of  the  connection to the OVN
+              Northbound and Southbound databases  from  ovn-northd,  in  milā€
+              liseconds.  If  the  value  is  zero, it disables the connection
+              keepalive feature.
+
+              If the value is nonzero, then it will be forced to a value of at
+              least 1000 ms.
+
+       options : ic_probe_interval: optional string
+              The inactivity probe interval  of  the  connection  to  the  OVN
+              Northbound  and  Southbound  databases from ovn-ic, in millisecā€
+              onds. If the value is zero, it disables the connection keepalive
+              feature.
+
+              If the value is nonzero, then it will be forced to a value of at
+              least 1000 ms.
+
+       options : nbctl_probe_interval: optional string
+              The inactivity probe interval  of  the  connection  to  the  OVN
+              Northbound  database from ovn-nbctl utility, in milliseconds. If
+              the value is zero, it disables the connection keepalive feature.
+
+              If the value is nonzero, then it will be forced to a value of at
+              least 1000 ms.
+
+              If the value is less than  zero,  then  the  default  inactivity
+              probe interval for ovn-nbctl would be left intact (120000 ms).
+
+       options : northd_trim_timeout: optional string
+              When  used, this configuration value specifies the time, in milā€
+              liseconds, since the  last  ovn-northd  active  operation  after
+              which  memory  trimming  is performed. By default this is set to
+              30000 (30 seconds).
+
+       options : use_logical_dp_groups: optional string
+              Note: This option is deprecated, the only behavior is to  always
+              combine  logical flows by datapath groups. Changing the value or
+              removing this option all toghether will have no effect.
+
+              ovn-northd combines logical flows that differs only  by  logical
+              datapath  into a single logical flow with logical datapath group
+              attached.
+
+       options : use_parallel_build: optional string
+              If set to true, ovn-northd will attempt to compute logical flows
+              in parallel.
+
+              Parallel computation is enabled only if the system has 4 or more
+              cores/threads available to be used by ovn-northd.
+
+              The default value is false.
+
+       options : ignore_lsp_down: optional string
+              If set to false, ARP/ND reply flows  for  logical  switch  ports
+              will  be  installed  only  if  the port is up, i.e. claimed by a
+              Chassis. If set to true, these flows are installed regardless of
+              the status of the port, which can result in a situation that ARP
+              request to an IP is resolved even before  the  relevant  VM/conā€
+              tainer  is running. For environments where this is not an issue,
+              setting it to true can reduce the load and latency of  the  conā€
+              trol plane. The default value is true.
+
+       options : use_ct_inv_match: optional string
+              If set to false, ovn-northd will not use the ct.inv field in any
+              of  the  logical flow matches. The default value is true. If the
+              NIC supports offloading OVS datapath flows but  doesnā€™t  support
+              offloading  ct_state  inv flag, then the datapath flows matching
+              on this flag (either +inv or -inv) will not  be  offloaded.  CMS
+              should consider setting use_ct_inv_match to false in such cases.
+              This results in a side effect of the invalid packets getting deā€
+              livered  to the destination VIF, which otherwise would have been
+              dropped by OVN.
+
+       options : default_acl_drop: optional string
+              If set to true., ovn-northd will generate a logical flow to drop
+              all traffic in the ACL stages. By default this option is set  to
+              false.
+
+       options : debug_drop_domain_id: optional string
+              If set to a 8-bit number and if debug_drop_collector_set is also
+              configured, ovn-northd will add a sample action to every logical
+              flow  that contains a ā€™dropā€™ action. The 8 most significant bits
+              of the observation_domain_id field will be  those  specified  in
+              the   debug_drop_domain_id. The 24 least significant bits of the
+              observation_domain_id field will be the datapathā€™s key.
+
+              The observation_point_id will be set to the first 32 bits of the
+              logical flowā€™s UUID.
+
+       options : debug_drop_collector_set: optional string
+              If set to a 32-bit number ovn-northd will add a sample action to
+              every logical flow that contains a ā€™dropā€™ action. The sample acā€
+              tion will have the specified collector_set_id.  The  value  must
+              match  that  of  the  local  OVS  configuration  as described in
+              ovs-actions(7).
+
+       options : use_common_zone: optional string, either true or false
+              Default value is false. If set to true the SNAT and DNAT happens
+              in common zone, instead of happening in separate zones,  dependā€
+              ing  on  the  configuration. However, this option breaks traffic
+              when there is configuration of DGP + LB + SNAT on this  LR.  The
+              value  true  should  be  used only in case of HWOL compatibility
+              with GDP.
+
+     Options for configuring interconnection route advertisement:
+
+       These options control how routes are advertised between OVN deployments
+       for interconnection. If enabled, ovn-ic from different OVN  deployments
+       exchanges  routes  between  each other through the global OVN_IC_Southā€ā€
+       bound database. Only routers with ports  connected  to  interconnection
+       transit  switches participate in route advertisement. For each of these
+       routers, there are two types of routes to be advertised:
+
+       Firstly, the static routes configured in the router are advertised.
+
+       Secondly, the networks configured in the logical router ports that  are
+       not on the transit switches are advertised. These are considered as diā€
+       rectly connected subnets on the router.
+
+       Link  local prefixes (IPv4 169.254.0.0/16 and IPv6 FE80::/10) are never
+       advertised.
+
+       The learned routes are added to the static_routes column of  the  Logiā€ā€
+       cal_Router table, with external_ids:ic-learned-route set to the uuid of
+       the row in Route table of the OVN_IC_Southbound database.
+
+       options : ic-route-adv: optional string
+              A  boolean  value that enables route advertisement to the global
+              OVN_IC_Southbound database. Default is false.
+
+       options : ic-route-learn: optional string
+              A boolean value that enables  route  learning  from  the  global
+              OVN_IC_Southbound database. Default is false.
+
+       options : ic-route-adv-default: optional string
+              A  boolean  value  that enables advertising default route to the
+              global OVN_IC_Southbound database. Default is false. This option
+              takes effect only when option ic-route-adv is true.
+
+       options : ic-route-learn-default: optional string
+              A boolean value that enables learning  default  route  from  the
+              global OVN_IC_Southbound database. Default is false. This option
+              takes effect only when option ic-route-learn is true.
+
+       options : ic-route-blacklist: optional string
+              A  string  value  contains  a  list of CIDRs delimited by ",". A
+              route will not be advertised or learned if  the  routeā€™s  prefix
+              belongs to any of the CIDRs listed.
+
+     Connection Options:
+
+       connections: set of Connections
+              Database  clients  to  which  the  Open  vSwitch database server
+              should connect or on which it should listen, along with  options
+              for  how these connections should be configured. See the Connecā€ā€
+              tion table for more information.
+
+       ssl: optional SSL
+              Global SSL configuration.
+
+     Security Configurations:
+
+       ipsec: boolean
+              Tunnel encryption configuration. If this column  is  set  to  be
+              true, all OVN tunnels will be encrypted with IPsec.
+
+     Read-only Options:
+
+       options : max_tunid: optional string
+              The  maximum supported tunnel ID. Depends on types of encapsulaā€
+              tion enabled in the cluster.
+
+Copp TABLE
+       This table is used to define control plane protection  policies,  i.e.,
+       associate entries from table Meter to control protocol names.
+
+   Summary:
+       name                          string (must be unique within table)
+       meters : arp                  optional string
+       meters : arp-resolve          optional string
+       meters : dhcpv4-opts          optional string
+       meters : dhcpv6-opts          optional string
+       meters : dns                  optional string
+       meters : event-elb            optional string
+       meters : icmp4-error          optional string
+       meters : icmp6-error          optional string
+       meters : igmp                 optional string
+       meters : nd-na                optional string
+       meters : nd-ns                optional string
+       meters : nd-ns-resolve        optional string
+       meters : nd-ra-opts           optional string
+       meters : tcp-reset            optional string
+       meters : bfd                  optional string
+       meters : reject               optional string
+       meters : svc-monitor          optional string
+       external_ids                  map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              CoPP name.
+
+       meters : arp: optional string
+              Rate  limiting  meter  for  ARP packets (request/reply) used for
+              learning neighbors.
+
+       meters : arp-resolve: optional string
+              Rate limiting meter for packets that require resolving the next-
+              hop (through ARP).
+
+       meters : dhcpv4-opts: optional string
+              Rate limiting meter for packets that require adding  DHCPv4  opā€
+              tions.
+
+       meters : dhcpv6-opts: optional string
+              Rate  limiting  meter for packets that require adding DHCPv6 opā€
+              tions.
+
+       meters : dns: optional string
+              Rate limiting meter for  DNS  query  packets  that  need  to  be
+              replied to.
+
+       meters : event-elb: optional string
+              Rate limiting meter for empty load balancer events.
+
+       meters : icmp4-error: optional string
+              Rate  limiting  meter  for packets that require replying with an
+              ICMP error.
+
+       meters : icmp6-error: optional string
+              Rate limiting meter for packets that require  replying  with  an
+              ICMPv6 error.
+
+       meters : igmp: optional string
+              Rate limiting meter for IGMP packets.
+
+       meters : nd-na: optional string
+              Rate  limiting  meter for ND neighbor advertisement packets used
+              for learning neighbors.
+
+       meters : nd-ns: optional string
+              Rate limiting meter for ND neighbor  solicitation  packets  used
+              for learning neighbors.
+
+       meters : nd-ns-resolve: optional string
+              Rate limiting meter for packets that require resolving the next-
+              hop (through ND).
+
+       meters : nd-ra-opts: optional string
+              Rate  limiting  meter  for packets that require adding ND router
+              advertisement options.
+
+       meters : tcp-reset: optional string
+              Rate limiting meter for packets that require replying  with  TCP
+              RST packet.
+
+       meters : bfd: optional string
+              Rate limiting meter for BFD packets.
+
+       meters : reject: optional string
+              Rate limiting meter for packets that trigger a reject action
+
+       meters : svc-monitor: optional string
+              Rate  limiting  meter  for  packets that are arriving to service
+              monitor MAC address.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Logical_Switch TABLE
+       Each row represents one L2 logical switch.
+
+       There are two kinds of logical switches, that is, ones that fully  virā€
+       tualize  the  network  (overlay logical switches) and ones that provide
+       simple connectivity to physical networks  (bridged  logical  switches).
+       They  work  in the same way when providing connectivity between logical
+       ports on same chassis, but differently when connecting  remote  logical
+       ports.  Overlay  logical  switches connect remote logical ports by tunā€
+       nels, while bridged logical switches  provide  connectivity  to  remote
+       ports  by  bridging  the packets to directly connected physical L2 segā€
+       ments with the help of localnet ports. Each bridged logical switch  has
+       one  or  more  localnet  ports, which have only one special address unā€ā€
+       known.
+
+   Summary:
+       ports                         set of Logical_Switch_Ports
+       load_balancer                 set of weak reference to Load_Balancers
+       load_balancer_group           set of Load_Balancer_Groups
+       acls                          set of ACLs
+       qos_rules                     set of QoSes
+       dns_records                   set of weak reference to DNSes
+       forwarding_groups             set of Forwarding_Groups
+       Naming:
+         name                        string
+         external_ids : neutron:network_name
+                                     optional string
+       IP Address Assignment:
+         other_config : subnet       optional string
+         other_config : exclude_ips  optional string
+         other_config : ipv6_prefix  optional string
+         other_config : mac_only     optional string, either true or false
+       IP Multicast Snooping Options:
+         other_config : mcast_snoop  optional string, either true or false
+         other_config : mcast_querier
+                                     optional string, either true or false
+         other_config : mcast_flood_unregistered
+                                     optional string, either true or false
+         other_config : mcast_table_size
+                                     optional string, containing  an  integer,
+                                     in range 1 to 32,766
+         other_config : mcast_idle_timeout
+                                     optional  string,  containing an integer,
+                                     in range 15 to 3,600
+         other_config : mcast_query_interval
+                                     optional string, containing  an  integer,
+                                     in range 1 to 3,600
+         other_config : mcast_query_max_response
+                                     optional  string,  containing an integer,
+                                     in range 1 to 10
+         other_config : mcast_eth_src
+                                     optional string
+         other_config : mcast_ip4_src
+                                     optional string
+         other_config : mcast_ip6_src
+                                     optional string
+       Interconnection:
+         other_config : interconn-ts
+                                     optional string
+       Tunnel Key:
+         other_config : requested-tnl-key
+                                     optional string, containing  an  integer,
+                                     in range 1 to 16,777,215
+       copp                          optional weak reference to Copp
+       Other options:
+         other_config : vlan-passthru
+                                     optional string, either true or false
+         other_config : broadcast-arps-to-all-routers
+                                     optional string, either true or false
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       ports: set of Logical_Switch_Ports
+              The logical ports connected to the logical switch.
+
+              It is an error for multiple logical switches to include the same
+              logical port.
+
+       load_balancer: set of weak reference to Load_Balancers
+              Set of load balancers associated to this logical switch.
+
+       load_balancer_group: set of Load_Balancer_Groups
+              Set of load balancers groups associated to this logical switch.
+
+       acls: set of ACLs
+              Access  control  rules  that apply to packets within the logical
+              switch.
+
+       qos_rules: set of QoSes
+              QoS marking and metering rules that apply to packets within  the
+              logical switch.
+
+       dns_records: set of weak reference to DNSes
+              This column defines the DNS records to be used for resolving inā€
+              ternal  DNS  queries within the logical switch by the native DNS
+              resolver. Please see the DNS table.
+
+       forwarding_groups: set of Forwarding_Groups
+              Groups a set of logical port endpoints for traffic going out  of
+              the logical switch.
+
+     Naming:
+
+       These columns provide names for the logical switch. From OVNā€™s perspecā€
+       tive, these names have no special meaning or purpose other than to proā€
+       vide  convenience  for human interaction with the database. There is no
+       requirement for the name to be unique. (For a unique identifier  for  a
+       logical switch, use its row UUID.)
+
+       (Originally, name was intended to serve the purpose of a human-friendly
+       name,  but the Neutron integration used it to uniquely identify its own
+       switch object, in the format neutron-uuid. Later  on,  Neutron  started
+       propagating  the friendly name of a switch as external_ids:neutron:netā€ā€
+       work_name. Perhaps this can be cleaned up someday.)
+
+       name: string
+              A name for the logical switch.
+
+       external_ids : neutron:network_name: optional string
+              Another name for the logical switch.
+
+     IP Address Assignment:
+
+       These options control automatic IP address management (IPAM) for  ports
+       attached to the logical switch. To enable IPAM for IPv4, set other_conā€ā€
+       fig:subnet  and optionally other_config:exclude_ips. To enable IPAM for
+       IPv6, set other_config:ipv6_prefix. IPv4 and IPv6 may  be  enabled  toā€
+       gether or separately.
+
+       To  request  dynamic  address assignment for a particular port, use the
+       dynamic  keyword  in  the  addresses  column  of   the   portā€™s   Logiā€ā€
+       cal_Switch_Port row. This requests both an IPv4 and an IPv6 address, if
+       IPAM for IPv4 and IPv6 are both enabled.
+
+       other_config : subnet: optional string
+              Set  this  to  an  IPv4  subnet,  e.g. 192.168.0.0/24, to enable
+              ovn-northd to automatically assign IP addresses within that subā€
+              net.
+
+       other_config : exclude_ips: optional string
+              To exclude some addresses from automatic IP address  management,
+              set  this to a list of the IPv4 addresses or ..-delimited ranges
+              to exclude. The addresses or ranges should be a subset of  those
+              in other_config:subnet.
+
+              Whether  listed or not, ovn-northd will never allocate the first
+              or  last  address  in  a  subnet,   such   as   192.168.0.0   or
+              192.168.0.255 in 192.168.0.0/24.
+
+              Examples:
+
+              ā€¢      192.168.0.2 192.168.0.10
+
+              ā€¢      192.168.0.4                    192.168.0.30..192.168.0.60
+                     192.168.0.110..192.168.0.120
+
+              ā€¢      192.168.0.110..192.168.0.120   192.168.0.25..192.168.0.30
+                     192.168.0.144
+
+       other_config : ipv6_prefix: optional string
+              Set this to an IPv6 prefix to enable ovn-northd to automatically
+              assign  IPv6  addresses using this prefix. The assigned IPv6 adā€
+              dress will be generated using the IPv6 prefix and  the  MAC  adā€
+              dress  (converted  to an IEEE EUI64 identifier) of the port. The
+              IPv6 prefix defined here should be a valid IPv6  address  ending
+              with ::.
+
+              Examples:
+
+              ā€¢      aef0::
+
+              ā€¢      bef0:1234:a890:5678::
+
+              ā€¢      8230:5678::
+
+       other_config : mac_only: optional string, either true or false
+              Value  used to request to assign L2 address only if neither subā€
+              net nor ipv6_prefix are specified
+
+     IP Multicast Snooping Options:
+
+       These options control IP Multicast Snooping configuration of the  logiā€
+       cal   switch.   To   enable   IP   Multicast  Snooping  set  other_conā€ā€
+       fig:mcast_snoop to true. To enable IP Multicast Querier set  other_conā€ā€
+       fig:mcast_querier   to   true.  If  IP  Multicast  Querier  is  enabled
+       other_config:mcast_eth_src and other_config:mcast_ip4_src must be set.
+
+       other_config : mcast_snoop: optional string, either true or false
+              Enables/disables IP Multicast Snooping on  the  logical  switch.
+              Default: false.
+
+       other_config : mcast_querier: optional string, either true or false
+              Enables/disables  IP  Multicast  Querier  on the logical switch.
+              Only applicable if other_config:mcast_snoop is enabled. Default:
+              true.
+
+       other_config : mcast_flood_unregistered: optional string, either true
+       or false
+              Determines whether  unregistered  multicast  traffic  should  be
+              flooded  or  not. Only applicable if other_config:mcast_snoop is
+              enabled. Default: false.
+
+       other_config : mcast_table_size: optional string, containing an inteā€
+       ger, in range 1 to 32,766
+              Number of multicast groups to be stored. Default: 2048.
+
+       other_config : mcast_idle_timeout: optional string, containing an inteā€
+       ger, in range 15 to 3,600
+              Configures the IP Multicast Snooping group idle timeout (in secā€
+              onds). Default: 300 seconds.
+
+       other_config : mcast_query_interval: optional string, containing an inā€
+       teger, in range 1 to 3,600
+              Configures the IP Multicast Querier interval between queries (in
+              seconds). Default: other_config:mcast_idle_timeout / 2.
+
+       other_config : mcast_query_max_response: optional string, containing an
+       integer, in range 1 to 10
+              Configures the value of the "max-response" field in  the  multiā€
+              cast  queries  originated by the logical switch. Default: 1 secā€
+              ond.
+
+       other_config : mcast_eth_src: optional string
+              Configures the source Ethernet address for queries originated by
+              the logical switch.
+
+       other_config : mcast_ip4_src: optional string
+              Configures the source IPv4 address for queries originated by the
+              logical switch.
+
+       other_config : mcast_ip6_src: optional string
+              Configures the source IPv6 address for queries originated by the
+              logical switch.
+
+     Interconnection:
+
+       other_config : interconn-ts: optional string
+              The name of corresponding transit  switch  in  OVN_IC_Northbound
+              database.  This kind of logical switch is created and controlled
+              by ovn-ic.
+
+     Tunnel Key:
+
+       other_config : requested-tnl-key: optional string, containing an inteā€
+       ger, in range 1 to 16,777,215
+              Configures the datapath tunnel key for the logical switch.  Usuā€
+              ally this is not needed because ovn-northd will assign an unique
+              key  for  each datapath by itself. However, if it is configured,
+              ovn-northd honors the configured value. The typical use case  is
+              for  interconnection:  the tunnel keys for transit switches need
+              to be unique globally, so they  are  maintained  in  the  global
+              OVN_IC_Southbound  database,  and  ovn-ic simply syncs the value
+              from OVN_IC_Southbound through this config.
+
+       copp: optional weak reference to Copp
+              The control plane protection policy from table Copp used for meā€
+              tering packets sent to ovn-controller from ports of this logical
+              switch.
+
+     Other options:
+
+       other_config : vlan-passthru: optional string, either true or false
+              Determines whether VLAN tagged incoming traffic  should  be  alā€
+              lowed.  Note  that  this may have security implications when enā€
+              abled for a logical switch with a tag=0 localnet  port.  If  not
+              properly isolated from other localnet ports, fabric traffic that
+              belongs  to  other  tagged networks may be passed through such a
+              port.
+
+       other_config : broadcast-arps-to-all-routers: optional string, either
+       true or false
+              Determines whether arp requests and ipv6 neighbor  solicitations
+              should be sent to all routers and other switchports (default) or
+              if  it  should  only be sent to switchports where the ip/mac adā€
+              dress is unknown. Setting this to false can significantly reduce
+              the load if the logical switch can receive arp requests for  ips
+              it does not know about. However setting this to false also means
+              that  garps  are no longer forwarded to all routers and therefor
+              the mac bindings of the routers are no longer updated.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Logical_Switch_Port TABLE
+       A port within an L2 logical switch.
+
+   Summary:
+       Core Features:
+         name                        string (must be unique within table)
+         type                        string
+       Options:
+         options                     map of string-string pairs
+         Options for router ports:
+            options : router-port    optional string
+            options : nat-addresses  optional string
+            options : exclude-lb-vips-from-garp
+                                     optional string
+            options : arp_proxy      optional string
+         Options for localnet ports:
+            options : network_name   optional string
+            options : ethtype        optional string
+            options : localnet_learn_fdb
+                                     optional string, either true or false
+         Options for l2gateway ports:
+            options : network_name   optional string
+            options : l2gateway-chassis
+                                     optional string
+         Options for vtep ports:
+            options : vtep-physical-switch
+                                     optional string
+            options : vtep-logical-switch
+                                     optional string
+         VMI (or VIF) Options:
+            options : requested-chassis
+                                     optional string
+            options : activation-strategy
+                                     optional string
+            options : iface-id-ver   optional string
+            options : qos_min_rate   optional string
+            options : qos_max_rate   optional string
+            options : qos_burst      optional string
+            options : hostname       optional string
+            VIF Plugging Options:
+              options : vif-plug-type
+                                     optional string
+              options : vif-plug-mtu-request
+                                     optional string
+         Virtual port Options:
+            options : virtual-ip     optional string
+            options : virtual-parents
+                                     optional string
+         IP Multicast Snooping Options:
+            options : mcast_flood    optional string, either true or false
+            options : mcast_flood_reports
+                                     optional string, either true or false
+       Containers:
+         parent_name                 optional string
+         tag_request                 optional integer, in range 0 to 4,095
+         tag                         optional integer, in range 1 to 4,095
+       Port State:
+         up                          optional boolean
+         enabled                     optional boolean
+       Addressing:
+         addresses                   set of strings
+         dynamic_addresses           optional string
+         port_security               set of strings
+       DHCP:
+         dhcpv4_options              optional weak reference to DHCP_Options
+         dhcpv6_options              optional weak reference to DHCP_Options
+       mirror_rules                  set of weak reference to Mirrors
+       ha_chassis_group              optional HA_Chassis_Group
+       Naming:
+         external_ids : neutron:port_name
+                                     optional string
+       Tunnel Key:
+         options : requested-tnl-key
+                                     optional string, containing  an  integer,
+                                     in range 1 to 32,767
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       name: string (must be unique within table)
+              The logical port name.
+
+              For  entities (VMs or containers) that are spawned in the hyperā€
+              visor, the name used here must match those used  in  the  exterā€ā€
+              nal_ids:iface-id in the Open_vSwitch databaseā€™s Interface table,
+              because hypervisors use external_ids:iface-id as a lookup key to
+              identify the network interface of that entity.
+
+              For containers that share a VIF within a VM, the name can be any
+              unique identifier. See Containers, below, for more information.
+
+              A  logical  switch  port may not have the same name as a logical
+              router port, but the database schema cannot enforce this.
+
+       type: string
+              Specify a type for this logical port. Logical ports can be  used
+              to model other types of connectivity into an OVN logical switch.
+              The following types are defined:
+
+              (empty string)
+                     A VM (or VIF) interface.
+
+              router A  connection  to  a  logical  router.  The  value of opā€ā€
+                     tions:router-port  specifies  the  name  of   the   Logiā€ā€
+                     cal_Router_Port to which this logical switch port is conā€
+                     nected.
+
+              localnet
+                     A   connection  to  a  locally  accessible  network  from
+                     ovn-controller instances that have a corresponding bridge
+                     mapping. A logical  switch  can  have  multiple  localnet
+                     ports attached. This type is used to model direct connecā€
+                     tivity  to  existing networks. In this case, each chassis
+                     should have a mapping for one of  the  physical  networks
+                     only.  Note:  nothing  said  above implies that a chassis
+                     cannot be plugged to multiple physical networks  as  long
+                     as they belong to different switches.
+
+              localport
+                     A  connection  to  a local VIF. Traffic that arrives on a
+                     localport is never forwarded over  a  tunnel  to  another
+                     chassis.  These  ports  are  present on every chassis and
+                     have the same address in all of them.  This  is  used  to
+                     model  connectivity  to  local services that run on every
+                     hypervisor.
+
+              l2gateway
+                     A connection to a physical network.
+
+              vtep   A port to a logical switch on a VTEP gateway.
+
+              external
+                     Represents a logical port which is external and not  havā€
+                     ing an OVS port in the integration bridge. OVN will never
+                     receive any traffic from this port or send any traffic to
+                     this   port.   OVN   can  support  native  services  like
+                     DHCPv4/DHCPv6/DNS for this port. If  ha_chassis_group  is
+                     defined,  ovn-controller running in the master chassis of
+                     the HA chassis group will bind this port to provide these
+                     native services. It is expected that this port belong  to
+                     a bridged logical switch (with a localnet port).
+
+                     It  is  recommended  to use the same HA chassis group for
+                     all the external ports of a  logical  switch.  Otherwise,
+                     the physical switch might see MAC flap issue when differā€
+                     ent chassis provide the native services. For example when
+                     supporting native DHCPv4 service, DHCPv4 server mac (conā€
+                     figured  in  options:server_mac  column in table DHCP_Opā€ā€
+                     tions) originating from different  ports  can  cause  MAC
+                     flap  issue. The MAC of the logical router IP(s) can also
+                     flap if the same HA chassis group is not set for all  the
+                     external ports of a logical switch.
+
+                     Below  are some of the use cases where external ports can
+                     be used.
+
+                     ā€¢      VMs connected to SR-IOV nics - Traffic from  these
+                            VMs  by passes the kernel stack and local ovn-conā€ā€
+                            troller do not bind these ports and  cannot  serve
+                            the native services.
+
+                     ā€¢      When CMS supports provisioning baremetal servers.
+
+              virtual
+                     Represents a logical port which does not have an OVS port
+                     in the integration bridge and has a virtual ip configured
+                     in  the  options:virtual-ip  column.  This virtual ip can
+                     move around between the logical ports configured  in  the
+                     options:virtual-parents column.
+
+                     One of the use case where virtual ports can be used is.
+
+                     ā€¢      The  virtual ip represents a load balancer vip and
+                            the virtual parents provide load balancer  service
+                            in an active-standby setup with the active virtual
+                            parent owning the virtual ip.
+
+              remote A remote port is to model a port that resides remotely on
+                     another OVN, which is on the other side of a transit logā€
+                     ical  switch  for OVN interconnection. This type of ports
+                     are created by ovn-ic instead of by CMS.  Any  change  to
+                     the port will be automatically overwritten by ovn-ic.
+
+     Options:
+
+       options: map of string-string pairs
+              This  column provides key/value settings specific to the logical
+              port type. The type-specific options are described  individually
+              below.
+
+     Options for router ports:
+
+       These options apply when type is router.
+
+       options : router-port: optional string
+              Required. The name of the Logical_Router_Port to which this logā€
+              ical switch port is connected.
+
+       options : nat-addresses: optional string
+              This  is  used  to send gratuitous ARPs for SNAT and DNAT IP adā€
+              dresses via the localnet port that is attached to the same logiā€
+              cal switch as this type router port. This option is specified on
+              a logical switch port that is connected to a gateway router,  or
+              a logical switch port that is connected to a distributed gateway
+              port on a logical router.
+
+              This must take one of the following forms:
+
+              router Gratuitous ARPs will be sent for all SNAT and DNAT exterā€
+                     nal  IP  addresses and for all load balancer IP addresses
+                     defined on the options:router-portā€™s logical router,  usā€
+                     ing the options:router-portā€™s MAC address.
+
+                     This  form  of options:nat-addresses is valid for logical
+                     switch ports where options:router-port is the name  of  a
+                     port  on  a  gateway router, or the name of a distributed
+                     gateway port.
+
+                     Supported only in OVN 2.8 and later. Earlier versions reā€
+                     quired NAT addresses to be manually synchronized.
+
+              Ethernet address followed by one or more IPv4 addresses
+                     Example:  80:fa:5b:06:72:b7  158.36.44.22   158.36.44.24.
+                     This would result in generation of gratuitous ARPs for IP
+                     addresses  158.36.44.22  and  158.36.44.24 with a MAC adā€
+                     dress of 80:fa:5b:06:72:b7.
+
+                     This form of options:nat-addresses is only valid for logā€
+                     ical switch ports where options:router-port is  the  name
+                     of a port on a gateway router.
+
+       options : exclude-lb-vips-from-garp: optional string
+              If  options:nat-addresses is set to router, Gratuitous ARPs will
+              be sent for all SNAT and DNAT external IP addresses  defined  on
+              the   options:router-portā€™s   logical   router,  using  the  opā€ā€
+              tions:router-portā€™s MAC address, not cosidering configured  load
+              balancers.
+
+       options : arp_proxy: optional string
+              Optional.  A  list  of  MAC  and  addresses/cidrs  or  just  adā€
+              dresses/cidrs that this logical switch router port will reply to
+              ARP/NDP  requests.  Examples:   169.254.239.254   169.254.239.2,
+              0a:58:a9:fe:01:01          169.254.239.254         169.254.239.2
+              169.254.238.0/24, fd7b:6b4d:7b25:d22f::1 fd7b:6b4d:7b25:d22f::2,
+              0a:58:a9:fe:01:01 fd7b:6b4d:7b25:d22f::0/64.  Theoptions:router-
+              portā€™s  logical  router  should  have a route to forward packets
+              sent to configured proxy ARP MAC/IPs to an appropriate  destinaā€
+              tion.
+
+     Options for localnet ports:
+
+       These options apply when type is localnet.
+
+       options : network_name: optional string
+              Required.  The name of the network to which the localnet port is
+              connected. Each hypervisor, via ovn-controller, uses  its  local
+              configuration  to  determine  exactly how to connect to this loā€
+              cally accessible network, if at all.
+
+       options : ethtype: optional string
+              Optional. VLAN EtherType  field  value  for  encapsulating  VLAN
+              headers. Supported values: 802.1q (default), 802.1ad.
+
+       options : localnet_learn_fdb: optional string, either true or false
+              Optional.  Allows  localnet port to learn MACs and store them in
+              FDB table if set to true. The default value is false.
+
+     Options for l2gateway ports:
+
+       These options apply when type is l2gateway.
+
+       options : network_name: optional string
+              Required. The name of the network to which the l2gateway port is
+              connected. The L2 gateway, via ovn-controller,  uses  its  local
+              configuration  to  determine exactly how to connect to this netā€
+              work.
+
+       options : l2gateway-chassis: optional string
+              Required. The chassis on which the l2gateway logical port should
+              be bound to. ovn-controller running on the defined chassis  will
+              connect this logical port to the physical network.
+
+     Options for vtep ports:
+
+       These options apply when type is vtep.
+
+       options : vtep-physical-switch: optional string
+              Required. The name of the VTEP gateway.
+
+       options : vtep-logical-switch: optional string
+              Required. A logical switch name connected by the VTEP gateway.
+
+     VMI (or VIF) Options:
+
+       These options apply to logical ports with type having (empty string)
+
+       options : requested-chassis: optional string
+              If set, identifies a specific chassis (by name or hostname) that
+              is  allowed  to  bind  this port. Using this option will prevent
+              thrashing between two chassis trying to bind the same port  durā€
+              ing  a live migration. It can also prevent similar thrashing due
+              to a mis-configuration, if a port  is  accidentally  created  on
+              more than one chassis.
+
+              If set to a comma separated list, the first entry identifies the
+              main  chassis  and  the  rest are one or more additional chassis
+              that are allowed to bind the same port.
+
+              When multiple chassis are set for  the  port,  and  the  logical
+              switch  is  connected  to an external network through a localnet
+              port, tunneling is enforced for the port to  guarantee  delivery
+              of  packets  directed to the port to all its locations. This has
+              MTU implications because the network  used  for  tunneling  must
+              have MTU larger than localnet for stable connectivity.
+
+              If the same host co-hosts more than one controller instance (eiā€
+              ther belonging to the same or separate clusters), special attenā€
+              tion  should be given to consistently using unique chassis names
+              used in this option. It is advised that chassis names - and  not
+              host names - are used for this option.
+
+       options : activation-strategy: optional string
+              If  used  with multiple chassis set in requested-chassis, speciā€
+              fies an activation strategy for all additional chassis.  By  deā€
+              fault,  no  activation strategy is used, meaning additional port
+              locations are immediately available for use. When set to "rarp",
+              the port is blocked for ingress and egress communication until a
+              RARP packet is sent from a new location. The "rarp" strategy  is
+              useful in live migration scenarios for virtual machines.
+
+       options : iface-id-ver: optional string
+              If  set,  this port will be bound by ovn-controller only if this
+              same key and value is configured in the external_ids  column  in
+              the Open_vSwitch databaseā€™s Interface table.
+
+       options : qos_min_rate: optional string
+              If set, indicates the minimum guaranteed rate available for data
+              sent from this interface, in bit/s.
+
+       options : qos_max_rate: optional string
+              If  set,  indicates the maximum rate for data sent from this inā€
+              terface, in bit/s. The traffic will be shaped according to  this
+              limit.
+
+       options : qos_burst: optional string
+              If set, indicates the maximum burst size for data sent from this
+              interface, in bits.
+
+       options : hostname: optional string
+              If  set, indicates the DHCPv4 option "Hostname" (option code 12)
+              associated for this Logical Switch Port. If  DHCPv4  is  enabled
+              for  this  Logical Switch Port, hostname dhcp option will be inā€
+              cluded in DHCP reply.
+
+     VIF Plugging Options:
+
+       options : vif-plug-type: optional string
+              If set, OVN will attempt to perform plugging of this VIF. In orā€
+              der to get this port plugged by the OVN controller, OVN must  be
+              built with support for VIF plugging. The default behavior is for
+              the  CMS  to  do  the  VIF plugging. Each VIF plug provider have
+              their own options namespaced by name, for example "vif-plug:repā€
+              resentor:key". Please refer to the VIF plug provider  documentaā€
+              tion  located  in  Documentation/topics/vif-plug-providers/  for
+              more information.
+
+       options : vif-plug-mtu-request: optional string
+              Requested MTU for plugged interfaces.  When  set  the  OVN  conā€
+              troller  will  fill  the  mtu_request column of the Open vSwitch
+              databaseā€™s Interface table. This in turn will make OVS  vswitchd
+              update the MTU of the linked interface.
+
+     Virtual port Options:
+
+       These options apply when type is virtual.
+
+       options : virtual-ip: optional string
+              This option represents the virtual IPv4 address.
+
+       options : virtual-parents: optional string
+              This options represents a set of logical port names (with in the
+              same  logical switch) which can own the virtual ip configured in
+              the options:virtual-ip. All these virtual parents should add the
+              virtual ip in the port_security if port security  addressed  are
+              enabled.
+
+     IP Multicast Snooping Options:
+
+       These options apply when the port is part of a logical switch which has
+       other_config :mcast_snoop set to true.
+
+       options : mcast_flood: optional string, either true or false
+              If  set to true, multicast packets (except reports) are uncondiā€
+              tionally forwarded to the specific port. Default: false.
+
+       options : mcast_flood_reports: optional string, either true or false
+              If set to true, multicast reports are unconditionally  forwarded
+              to the specific port. Default: false.
+
+     Containers:
+
+       When a large number of containers are nested within a VM, it may be too
+       expensive to dedicate a VIF to each container. OVN can use VLAN tags to
+       support  such  cases.  Each  container  is  assigned a VLAN ID and each
+       packet that passes between the hypervisor and the VM is tagged with the
+       appropriate ID for the container. Such VLAN IDs never appear on a physā€
+       ical wire, even inside a tunnel, so they need not be unique except relā€
+       ative to a single VM on a hypervisor.
+
+       These columns are used for VIFs that represent nested containers  using
+       shared  VIFs. For VMs and for containers that have dedicated VIFs, they
+       are empty.
+
+       parent_name: optional string
+              The VM interface through which the nested  container  sends  its
+              network  traffic. This must match the name column for some other
+              Logical_Switch_Port.
+
+       tag_request: optional integer, in range 0 to 4,095
+              The VLAN tag in the  network  traffic  associated  with  a  conā€
+              tainerā€™s network interface. The client can request ovn-northd to
+              allocate  a  tag  that  is unique within the scope of a specific
+              parent (specified in parent_name) by setting a  value  of  0  in
+              this column. The allocated value is written by ovn-northd in the
+              tag  column. (Note that these tags are allocated and managed loā€
+              cally in ovn-northd, so they  cannot  be  reconstructed  in  the
+              event  that the database is lost.) The client can also request a
+              specific non-zero tag and ovn-northd will honor it and copy that
+              value to the tag column.
+
+              When type is set to localnet or l2gateway, this can  be  set  to
+              indicate  that  the  port  represents a connection to a specific
+              VLAN on a locally accessible network. The VLAN  ID  is  used  to
+              match incoming traffic and is also added to outgoing traffic.
+
+       tag: optional integer, in range 1 to 4,095
+              The  VLAN  tag  allocated by ovn-northd based on the contents of
+              the tag_request column.
+
+     Port State:
+
+       up: optional boolean
+              This column is populated by ovn-northd, rather than by  the  CMS
+              plugin as is most of this database. When a logical port is bound
+              to  a  physical  location in the OVN Southbound database Binding
+              table, ovn-northd sets this column to true; otherwise, or if the
+              port becomes unbound later, it sets it to false. If this  column
+              is  empty, the port is not considered up. This allows the CMS to
+              wait for a VMā€™s (or containerā€™s) networking to become active beā€
+              fore it allows the VM (or container) to start.
+
+              Logical ports of router type are an exception to this rule. They
+              are considered to be always up, that is this  column  is  always
+              set to true.
+
+       enabled: optional boolean
+              This  column is used to administratively set port state. If this
+              column is empty or is set to true, the port is enabled. If  this
+              column  is  set  to false, the port is disabled. A disabled port
+              has all ingress and egress traffic dropped.
+
+     Addressing:
+
+       addresses: set of strings
+              Addresses owned by the logical port.
+
+              Each element in the set must take one of the following forms:
+
+              Ethernet address followed by zero or more IPv4 or IPv6 addresses
+              (or both)
+                     An Ethernet address defined is owned by the logical port.
+                     Like a physical Ethernet NIC, a logical  port  ordinarily
+                     has a single fixed Ethernet address.
+
+                     When  a  OVN  logical switch processes a unicast Ethernet
+                     frame whose destination  MAC  address  is  in  a  logical
+                     portā€™s  addresses  column,  it  delivers  it only to that
+                     port, as if a MAC learning process had learned  that  MAC
+                     address on the port.
+
+                     If IPv4 or IPv6 address(es) (or both) are defined, it inā€
+                     dicates  that  the  logical  port  owns  the given IP adā€
+                     dresses.
+
+                     If IPv4 address(es) are defined, the OVN  logical  switch
+                     uses  this information to synthesize responses to ARP reā€
+                     quests without traversing the physical network.  The  OVN
+                     logical  router  connected to the logical switch, if any,
+                     uses this information to avoid issuing ARP  requests  for
+                     logical switch ports.
+
+                     Note  that  the order here is important. The Ethernet adā€
+                     dress must be listed before the  IP  address(es)  if  deā€
+                     fined.
+
+                     Examples:
+
+                     80:fa:5b:06:72:b7
+                            This  indicates  that  the  logical  port owns the
+                            above mac address.
+
+                     80:fa:5b:06:72:b7 10.0.0.4 20.0.0.4
+                            This indicates that the logical port owns the  mac
+                            address and two IPv4 addresses.
+
+                     80:fa:5b:06:72:b7 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41
+                            This  indicates that the logical port owns the mac
+                            address and 1 IPv6 address.
+
+                     80:fa:5b:06:72:b7 10.0.0.4
+                     fdaa:15f2:72cf:0:f816:3eff:fe20:3f41
+                            This indicates that the logical port owns the  mac
+                            address and 1 IPv4 address and 1 IPv6 address.
+
+              unknown
+                     This  indicates  that the logical port has an unknown set
+                     of  Ethernet  addresses.  When  an  OVN  logical   switch
+                     processes  a unicast Ethernet frame whose destination MAC
+                     address is not in any logical portā€™s addresses column, it
+                     delivers it  to  the  port  (or  ports)  whose  addresses
+                     columns include unknown.
+
+              dynamic
+                     Use dynamic to make ovn-northd generate a globally unique
+                     MAC address, choose an unused IPv4 address with the logiā€
+                     cal  portā€™s  subnet (if other_config:subnet is set in the
+                     portā€™s Logical_Switch), and generate an IPv6 address from
+                     the MAC address (if other_config:ipv6_prefix  is  set  in
+                     the  portā€™s  Logical_Switch) and store them in the portā€™s
+                     dynamic_addresses column.
+
+                     Only one element containing dynamic  may  appear  in  adā€ā€
+                     dresses.
+
+              dynamic ip
+              dynamic ipv6
+              dynamic ip ipv6
+                   These act like dynamic alone but specify particular IPv4 or
+                   IPv6  addresses  to  use. OVN IPAM will still automatically
+                   allocate the other address if configured appropriately. Exā€
+                   ample: dynamic 192.168.0.1 2001::1.
+
+              mac dynamic
+                   This acts like dynamic alone but specifies a particular MAC
+                   address to use. OVN IPAM will still automatically  allocate
+                   IPv4  or  IPv6  addresses, or both, if configured appropriā€
+                   ately. Example: 80:fa:5b:06:72:b7 dynamic
+
+              router
+                   Accepted only when type is router. This indicates that  the
+                   Ethernet,  IPv4, and IPv6 addresses for this logical switch
+                   port should be obtained from the connected  logical  router
+                   port, as specified by router-port in options.
+
+                   The  resulting  addresses  are used to populate the logical
+                   switchā€™s destination  lookup,  and  also  for  the  logical
+                   switch to generate ARP and ND replies.
+
+                   If  the  connected  logical  router  port has a distributed
+                   gateway port specified and the  logical  router  has  rules
+                   specified  in  nat  with external_mac, then those addresses
+                   are also used to populate the switchā€™s destination lookup.
+
+                   Supported only in OVN 2.7 and later. Earlier  versions  reā€
+                   quired router addresses to be manually synchronized.
+
+       dynamic_addresses: optional string
+              Addresses assigned to the logical port by ovn-northd, if dynamic
+              is  specified in addresses. Addresses will be of the same format
+              as those that populate the addresses column. Note  that  dynamiā€
+              cally  assigned addresses are constructed and managed locally in
+              ovn-northd, so they cannot be reconstructed in  the  event  that
+              the database is lost.
+
+       port_security: set of strings
+              This  column controls the addresses from which the host attached
+              to the logical port (``the hostā€™ā€™) is allowed  to  send  packets
+              and to which it is allowed to receive packets. If this column is
+              empty, all addresses are permitted.
+
+              Each  element  in  the set must begin with one Ethernet address.
+              This would restrict the host to sending packets from and receivā€
+              ing packets to the ethernet addresses  defined  in  the  logical
+              portā€™s  port_security column. It also restricts the inner source
+              MAC addresses that the host may send in ARP  and  IPv6  Neighbor
+              Discovery packets. The host is always allowed to receive packets
+              to multicast and broadcast Ethernet addresses.
+
+              Each  element  in  the  set may additionally contain one or more
+              IPv4 or IPv6 addresses (or both), with optional masks. If a mask
+              is given, it must be a CIDR mask. In addition  to  the  restricā€
+              tions  described  for  Ethernet addresses above, such an element
+              restricts the IPv4 or IPv6 addresses from  which  the  host  may
+              send  and  to  which it may receive packets to the specified adā€
+              dresses. A masked address, if the host part is  zero,  indicates
+              that  the  host  is allowed to use any address in the subnet; if
+              the host part is nonzero, the mask simply indicates the size  of
+              the subnet. In addition:
+
+              ā€¢      If any IPv4 address is given, the host is also allowed to
+                     receive  packets  to  the  IPv4  local  broadcast address
+                     255.255.255.255   and   to   IPv4   multicast   addresses
+                     (224.0.0.0/4).  If  an IPv4 address with a mask is given,
+                     the host is also allowed to receive packets to the broadā€
+                     cast address in that specified subnet.
+
+                     If any IPv4 address is given, the  host  is  additionally
+                     restricted  to  sending  ARP  packets  with the specified
+                     source IPv4 address. (RARP is not restricted.)
+
+              ā€¢      If any IPv6 address is given, the host is also allowed to
+                     receive packets to IPv6 multicast addresses (ff00::/8).
+
+                     If any IPv6 address is given, the  host  is  additionally
+                     restricted  to  sending IPv6 Neighbor Discovery Solicitaā€
+                     tion or Advertisement packets with the  specified  source
+                     address or, for solicitations, the unspecified address.
+
+              If  an  element includes an IPv4 address, but no IPv6 addresses,
+              then IPv6 traffic is not allowed. If an element includes an IPv6
+              address, but no IPv4 address, then IPv4 and ARP traffic  is  not
+              allowed.
+
+              This  column uses the same lexical syntax as the match column in
+              the OVN Southbound databaseā€™s Pipeline table. Multiple addresses
+              within an element may be space or comma separated.
+
+              This column is provided as a  convenience  to  cloud  management
+              systems,  but  all of the features that it implements can be imā€
+              plemented as ACLs using the ACL table.
+
+              Examples:
+
+              80:fa:5b:06:72:b7
+                     The host may send traffic from and receive traffic to the
+                     specified MAC address, and to receive traffic to Ethernet
+                     multicast and broadcast addresses, but not otherwise. The
+                     host may not send ARP or IPv6 Neighbor Discovery  packets
+                     with  inner  source Ethernet addresses other than the one
+                     specified.
+
+              80:fa:5b:06:72:b7 192.168.1.10/24
+                     This adds further restrictions to the first example.  The
+                     host  may  send IPv4 packets from or receive IPv4 packets
+                     to only 192.168.1.10, except that  it  may  also  receive
+                     IPv4 packets to 192.168.1.255 (based on the subnet mask),
+                     255.255.255.255, and any address in 224.0.0.0/4. The host
+                     may  not  send  ARPs with a source Ethernet address other
+                     than 80:fa:5b:06:72:b7 or source IPv4 address other  than
+                     192.168.1.10.  The  host may not send or receive any IPv6
+                     (including IPv6 Neighbor Discovery) traffic.
+
+              "80:fa:5b:12:42:ba", "80:fa:5b:06:72:b7 192.168.1.10/24"
+                     The host may send traffic from and receive traffic to the
+                     specified MAC addresses, and to receive traffic to Etherā€
+                     net multicast and broadcast addresses, but not otherwise.
+                     With MAC 80:fa:5b:12:42:ba, the  host  may  send  traffic
+                     from  and  receive  traffic  to  any L3 address. With MAC
+                     80:fa:5b:06:72:b7, the host may send IPv4 packets from or
+                     receive IPv4 packets to only 192.168.1.10, except that it
+                     may also receive IPv4 packets to 192.168.1.255 (based  on
+                     the  subnet  mask),  255.255.255.255,  and any address in
+                     224.0.0.0/4. The host may not send or  receive  any  IPv6
+                     (including IPv6 Neighbor Discovery) traffic.
+
+     DHCP:
+
+       dhcpv4_options: optional weak reference to DHCP_Options
+              This  column  defines  the  DHCPv4 Options to be included by the
+              ovn-controller when it replies to the  DHCPv4  requests.  Please
+              see the DHCP_Options table.
+
+       dhcpv6_options: optional weak reference to DHCP_Options
+              This  column  defines  the  DHCPv6 Options to be included by the
+              ovn-controller when it replies to the  DHCPv6  requests.  Please
+              see the DHCP_Options table.
+
+       mirror_rules: set of weak reference to Mirrors
+              Mirror  rules  that  apply  to  logical switch port which is the
+              source. Please see the Mirror table.
+
+       ha_chassis_group: optional HA_Chassis_Group
+              References a row  in  the  OVN  Northbound  databaseā€™s  HA_Chasā€ā€
+              sis_Group table. It indicates the HA chassis group to use if the
+              type is set to external. If type is not external, this column is
+              ignored.
+
+     Naming:
+
+       external_ids : neutron:port_name: optional string
+              This  column gives an optional human-friendly name for the port.
+              This name has no special meaning or purpose other than  to  proā€
+              vide convenience for human interaction with the northbound dataā€
+              base.
+
+              Neutron  copies  this  from its own port objectā€™s name. (Neutron
+              ports do are not assigned human-friendly names by default, so it
+              will often be empty.)
+
+     Tunnel Key:
+
+       options : requested-tnl-key: optional string, containing an integer, in
+       range 1 to 32,767
+              Configures the port binding tunnel key  for  the  port.  Usually
+              this  is not needed because ovn-northd will assign an unique key
+              for  each  port  by  itself.  However,  if  it  is   configured,
+              ovn-northd  honors the configured value. The typical use case is
+              for interconnection:  the  tunnel  keys  for  ports  on  transit
+              switches  need  to be unique globally, so they are maintained in
+              the global OVN_IC_Southbound database, and ovn-ic  simply  syncs
+              the value from OVN_IC_Southbound through this config.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+              The  ovn-northd  program  copies all these pairs into the exterā€ā€
+              nal_ids column of the Port_Binding table in OVN_Southbound dataā€
+              base.
+
+Forwarding_Group TABLE
+       Each row represents one forwarding group.
+
+   Summary:
+       name                          string
+       vip                           string
+       vmac                          string
+       liveness                      boolean
+       child_port                    set of 1 or more strings
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string
+              A name for the forwarding group. This name has no special  meanā€
+              ing  or  purpose other than to provide convenience for human inā€
+              teraction with the ovn-nb database.
+
+       vip: string
+              The virtual IP address assigned to the forwarding group. It will
+              respond with vmac when an ARP request is sent for vip.
+
+       vmac: string
+              The virtual MAC address assigned to the forwarding group.
+
+       liveness: boolean
+              If set to true, liveness is enabled for child ports otherwise it
+              is disabled.
+
+       child_port: set of 1 or more strings
+              List of child ports in the forwarding group.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Address_Set TABLE
+       Each row in this table represents a named set of addresses. An  address
+       set may contain Ethernet, IPv4, or IPv6 addresses with optional bitwise
+       or  CIDR  masks.  Address set may ultimately be used in ACLs to compare
+       against fields such as ip4.src or ip6.src. A single  address  set  must
+       contain  addresses of the same type. As an example, the following would
+       create an address set with three IP addresses:
+
+             ovn-nbctl create Address_Set name=set1 addresses=ā€™ā€™10.0.0.1 10.0.0.2 10.0.0.3ā€™ā€™
+
+
+       Address sets may be used in the match column of the ACL table. For synā€
+       tax information, see the details of the expression  language  used  for
+       the  match column in the Logical_Flow table of the OVN_Southbound dataā€
+       base.
+
+   Summary:
+       name                          string (must be unique within table)
+       addresses                     set of strings
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              A name for the address set.  Names  are  ASCII  and  must  match
+              [a-zA-Z_.][a-zA-Z_.0-9]*.
+
+       addresses: set of strings
+              The set of addresses in string form.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Port_Group TABLE
+       Each  row  in  this  table  represents  a named group of logical switch
+       ports.
+
+       Port groups may be used in the match column of the ACL table. For  synā€
+       tax  information,  see  the details of the expression language used for
+       the match column in the Logical_Flow table of the OVN_Southbound  dataā€
+       base.
+
+       For  each  port  group, there are two address sets generated to the Adā€ā€
+       dress_Set table of the OVN_Southbound database, containing the  IP  adā€
+       dresses  of  the  group of ports, one for IPv4, and the other for IPv6,
+       with name being the name of the Port_Group followed by  a  suffix  _ip4
+       for  IPv4  and _ip6 for IPv6. The generated address sets can be used in
+       the same way as regular address sets in the match column of the ACL taā€
+       ble. For syntax information, see the details of the expression language
+       used for the match column in the Logical_Flow table of  the  OVN_Southā€ā€
+       bound database.
+
+   Summary:
+       name                          string (must be unique within table)
+       ports                         set    of   weak   reference   to   Logiā€ā€
+                                     cal_Switch_Ports
+       acls                          set of ACLs
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              A name for the port  group.  Names  are  ASCII  and  must  match
+              [a-zA-Z_.][a-zA-Z_.0-9]*.
+
+       ports: set of weak reference to Logical_Switch_Ports
+              The logical switch ports belonging to the group in uuids.
+
+       acls: set of ACLs
+              Access  control  rules that apply to the port group. Applying an
+              ACL to a port group has the same effect as applying the  ACL  to
+              all  logical  lswitches  that the ports of the port group belong
+              to.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Load_Balancer TABLE
+       Each row represents one load balancer.
+
+   Summary:
+       name                          string
+       vips                          map of string-string pairs
+       protocol                      optional string, one of sctp, tcp, or udp
+       Health Checks:
+         health_check                set of Load_Balancer_Health_Checks
+         ip_port_mappings            map of string-string pairs
+       selection_fields              set of strings, one of eth_dst,  eth_src,
+                                     ip_dst, ip_src, tp_dst, or tp_src
+       Common Columns:
+         external_ids                map of string-string pairs
+       Load_Balancer options:
+         options : reject            optional string, either true or false
+         options : hairpin_snat_ip   optional string
+         options : skip_snat         optional string
+         options : add_route         optional string
+         options : neighbor_responder
+                                     optional string
+         options : template          optional string
+         options : address-family    optional string
+         options : affinity_timeout  optional string
+         options : ct_flush          optional string, either true or false
+
+   Details:
+       name: string
+              A  name  for the load balancer. This name has no special meaning
+              or purpose other than to provide convenience for human  interacā€
+              tion with the ovn-nb database.
+
+       vips: map of string-string pairs
+              A  map of virtual IP addresses (and an optional port number with
+              : as a separator) associated with this load balancer  and  their
+              corresponding  endpoint  IP addresses (and optional port numbers
+              with : as separators) separated by commas. If the destination IP
+              address (and port number) of a packet leaving a container  or  a
+              VM  matches  the  virtual  IP address (and port number) provided
+              here as a key, then OVN will statefully replace the  destination
+              IP  address  by one of the provided IP address (and port number)
+              in this map as a value. IPv4 and IPv6  addresses  are  supported
+              for  load balancing; however a VIP of one address family may not
+              be mapped to a destination IP address of a different family.  If
+              specifying an IPv6 address with a port, the address portion must
+              be   enclosed   in   square  brackets.  Examples  for  keys  are
+              "192.168.1.4"  and  "[fd0f::1]:8800".  Examples  for  value  are
+              "10.0.0.1, 10.0.0.2" and "20.0.0.10:8800, 20.0.0.11:8800".
+
+              When  the  Load_Balancer is added to the logical_switch, the VIP
+              has to be in a different subnet than the one used for the  logiā€ā€
+              cal_switch.  Since VIP is in a different subnet, you should conā€
+              nect your logical switch to either a OVN  logical  router  or  a
+              real  router  (this  is because the client can now send a packet
+              with VIP as the destination IP address and routerā€™s mac  address
+              as the destination MAC address).
+
+       protocol: optional string, one of sctp, tcp, or udp
+              Valid  protocols  are  tcp,  udp, or sctp. This column is useful
+              when a port number is provided as part of the  vips  column.  If
+              this  column  is  empty and a port number is provided as part of
+              vips column, OVN assumes the protocol to be tcp.
+
+     Health Checks:
+
+       OVN supports health checks for load  balancer  endpoints.  When  health
+       checks are enabled, the load balancer uses only healthy endpoints.
+
+       Suppose      that      vips      contains      a     key-value     pair
+       10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health  checks  for
+       this  virtualā€™s endpoints, add two key-value pairs to ip_port_mappings,
+       with keys 10.0.0.4 and 20.0.0.4, and add to health_check a reference to
+       a Load_Balancer_Health_Check row whose vip is  set  to  10.0.0.10.  The
+       same approach can be used for IPv6 as well.
+
+       health_check: set of Load_Balancer_Health_Checks
+              Load balancer health checks associated with this load balancer.
+
+       ip_port_mappings: map of string-string pairs
+              Maps  from endpoint IP to a colon-separated pair of logical port
+              name and source IP, e.g.  port_name:sourc_ip  for  IPv4.  Health
+              checks  are  sent to this port with the specified source IP. For
+              IPv6 square brackets  must  be  used  around  IP  address,  e.g:
+              port_name:[sourc_ip]
+
+              For  example, in the example above, IP to port mappings might be
+              defined         as         10.0.0.4=sw0-p1:10.0.0.2          and
+              20.0.0.4=sw1-p1:20.0.0.2,  if  the  values  given  were suitable
+              ports and IP addresses.
+
+              For  IPv6  IP   to   port   mappings   might   be   defined   as
+              [2001::1]=sw0-p1:[2002::1].
+
+       selection_fields: set of strings, one of eth_dst, eth_src, ip_dst,
+       ip_src, tp_dst, or tp_src
+              OVN  native  load  balancers  are  supported  using the OpenFlow
+              groups of type  select.  OVS  supports  two  selection  methods:
+              dp_hash  and  hash (with optional fields specified) in selecting
+              the buckets of a group. Please see the  OVS  documentation  (man
+              ovs-ofctl)  for more details on the selection methods. Each endā€
+              point IP (and port if set) is mapped to a bucket  in  the  group
+              flow.
+
+              CMS  can  choose the hash selection method by setting the selecā€
+              tion fields in this  column.  ovs-vswitchd  uses  the  specified
+              fields in generating the hash.
+
+              dp_hash selection method uses the assistance of datapath to calā€
+              culate the hash and it is expected to be faster than hash selecā€
+              tion  method.  So CMS should take this into consideration before
+              using the hash method. Please consult the OVS documentation  and
+              OVS sources for the implementation details.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Load_Balancer options:
+
+       options : reject: optional string, either true or false
+              If  the load balancer is created with --reject option and it has
+              no active backends, a TCP reset segment (for  tcp)  or  an  ICMP
+              port  unreachable packet (for all other kind of traffic) will be
+              sent whenever an incoming packet is received for this  load-balā€
+              ancer.  Please  note using --reject option will disable empty_lb
+              SB controller event for this load balancer.
+
+       options : hairpin_snat_ip: optional string
+              IP to be used as source IP for  packets  that  have  been  hair-
+              pinned  after  load balancing. The default behavior when the opā€
+              tion is not set is to use the load balancer VIP  as  source  IP.
+              This option may have exactly one IPv4 and/or one IPv6 address on
+              it, separated by a space character.
+
+       options : skip_snat: optional string
+              If  the load balancing rule is configured with skip_snat option,
+              the option lb_force_snat_ip configured for  the  logical  router
+              that  references this load balancer will not be applied for this
+              load balancer.
+
+       options : add_route: optional string
+              If set to true, then neighbor routers will  have  logical  flows
+              added  that  will  allow for routing to the VIP IP. It also will
+              have ARP resolution logical flows added. By setting this option,
+              it means there is no  reason  to  create  a  Logical_Router_Staā€ā€
+              tic_Route  from  neighbor  routers  to this NAT address. It also
+              means that no ARP request is required for  neighbor  routers  to
+              learn  the  IP-MAC mapping for this VIP IP. For more information
+              about what flows  are  added  for  IP  routes,  please  see  the
+              ovn-northd manpage section on IP Routing.
+
+       options : neighbor_responder: optional string
+              If  set  to  all, then routers on which the load balancer is apā€
+              plied reply to ARP/neighbor discovery requests for all  VIPs  of
+              the  load  balancer.  If set to reachable, then routers on which
+              the load balancer is applied reply to ARP/neighbor discovery reā€
+              quests only for VIPs that are part of a routerā€™s subnet. If  set
+              to  none,  then  routers  on  which the load balancer is applied
+              never reply to ARP/neighbor discovery requests for  any  of  the
+              load balancer VIPs. Load balancers with options:template=true do
+              not support reachable as a valid mode. The default value of this
+              option,  if  not  specified,  is reachable for regular load balā€
+              ancers and none for template load balancers.
+
+       options : template: optional string
+              Option to be set to true, if the load balancer  is  a  template.
+              The  load  balancer VIPs and backends must be using Chassis_Temā€ā€
+              plate_Var in their definitions.
+
+              Load balancer template VIP supported formats are:
+
+              ^VIP_VAR[:^PORT_VAR|:port]
+
+
+              where VIP_VAR and PORT_VAR are keys of the  Chassis_Template_Var
+              variables records.
+
+              Note: The VIP and PORT cannot be combined into a single template
+              variable. For example, a Chassis_Template_Var variable expanding
+              to 10.0.0.1:8080 is not valid if used as VIP.
+
+              Load balancer template backend supported formats are:
+
+              ^BACKEND_VAR1[:^PORT_VAR1|:port],^BACKEND_VAR2[:^PORT_VAR2|:port]
+              or
+              ^BACKENDS_VAR1,^BACKENDS_VAR2
+
+
+              where  BACKEND_VAR1,  PORT_VAR1,  BACKEND_VAR2, PORT_VAR2, BACKā€ā€
+              ENDS_VAR1 and BACKENDS_VAR2 are keys of the Chassis_Template_Var
+              variables records.
+
+       options : address-family: optional string
+              Address family used by the load balancer. Supported  values  are
+              ipv4  and  ipv6.  The  address-family is only used for load balā€
+              ancers with options:template=true. For explicit load  balancers,
+              setting the address-family has no effect.
+
+       options : affinity_timeout: optional string
+              If  the  CMS  provides  a positive value (in seconds) for affinā€ā€
+              ity_timeout, OVN will dnat connections received  from  the  same
+              client  to this lb to the same backend if received in the affinā€
+              ity timeslot. Max supported affinity_timeout is 65535 seconds.
+
+       options : ct_flush: optional string, either true or false
+              The value indicates whether ovn-controller should flush  CT  enā€
+              tries  that  are related to this LB. The flush happens if the LB
+              is removed, any of the backends is updated/removed or the LB  is
+              not  considered local anymore by the ovn-controller. This option
+              is set to false by default.
+
+Load_Balancer_Group TABLE
+       Each row represents a logical grouping of load balancers. It is  up  to
+       the  CMS to decide the criteria on which load balancers are grouped toā€
+       gether. To simplify configuration and to optimize its  processing  load
+       balancers  that  must be associated to the same set of logical switches
+       and/or logical routers should be grouped together.
+
+   Summary:
+       name                          string (must be unique within table)
+       load_balancer                 set of weak reference to Load_Balancers
+
+   Details:
+       name: string (must be unique within table)
+              A name for the load balancer group. This  name  has  no  special
+              meaning  or  purpose other than to provide convenience for human
+              interaction with the ovn-nb database.
+
+       load_balancer: set of weak reference to Load_Balancers
+              A set of load balancers.
+
+Load_Balancer_Health_Check TABLE
+       Each row represents one load balancer health check.
+
+   Summary:
+       vip                           string
+       Health check options:
+         options : interval          optional string, containing an integer
+         options : timeout           optional string, containing an integer
+         options : success_count     optional string, containing an integer
+         options : failure_count     optional string, containing an integer
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       vip: string
+              vip whose endpoints should be monitored for health check.
+
+     Health check options:
+
+       options : interval: optional string, containing an integer
+              The interval, in seconds, between health checks.
+
+       options : timeout: optional string, containing an integer
+              The time, in seconds, after which a health check times out.
+
+       options : success_count: optional string, containing an integer
+              The number of successful checks after which the endpoint is conā€
+              sidered online.
+
+       options : failure_count: optional string, containing an integer
+              The number of failure checks after which the endpoint is considā€
+              ered offline.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+ACL TABLE
+       Each row in this table represents one ACL rule for a logical switch  or
+       a port group that points to it through its acls column. The action colā€
+       umn  for  the  highest-priority matching row in this table determines a
+       packetā€™s treatment. If no row matches, packets are allowed by  default.
+       (Default-deny  treatment  is possible: add a rule with priority 0, 1 as
+       match, and deny as action.)
+
+   Summary:
+       label                         integer, in range 0 to 4,294,967,295
+       priority                      integer, in range 0 to 32,767
+       direction                     string, either from-lport or to-lport
+       match                         string
+       action                        string,   one   of   allow-related,   alā€ā€
+                                     low-stateless,  allow, drop, pass, or reā€ā€
+                                     ject
+       tier                          integer, in range 0 to 3
+       options:
+         options : apply-after-lb    optional string
+       Logging:
+         log                         boolean
+         name                        optional string, at  most  63  characters
+                                     long
+         severity                    optional  string,  one  of  alert, debug,
+                                     info, notice, or warning
+         meter                       optional string
+       Common Columns:
+         options                     map of string-string pairs
+         ACL configuration options:
+            options : log-related    optional string
+         external_ids                map of string-string pairs
+
+   Details:
+       label: integer, in range 0 to 4,294,967,295
+              Associates an identifier with the ACL. The same  value  will  be
+              written  to  corresponding  connection  tracker entry. The value
+              should be a valid 32-bit unsigned integer. This value  can  help
+              in  debugging from connection tracker side. For example, through
+              this "label" we can backtrack to the ACL rule which is causing a
+              "leaked" connection. Connection tracker entries are created only
+              for allowed connections so the label is valid only for allow and
+              allow-related actions.
+
+       priority: integer, in range 0 to 32,767
+              The ACL ruleā€™s priority. Rules with numerically higher  priority
+              take precedence over those with lower. If two ACL rules with the
+              same  priority  both  match,  then the one actually applied to a
+              packet is undefined.
+
+              Return traffic from an allow-related flow is always allowed  and
+              cannot be changed through an ACL.
+
+              allow-stateless  flows  always  take  precedence before stateful
+              ACLs, regardless of their priority. (Both  allow  and  allow-reā€ā€
+              lated ACLs can be stateful.)
+
+       direction: string, either from-lport or to-lport
+              Direction of the traffic to which this rule should apply:
+
+              ā€¢      from-lport: Used to implement filters on traffic arriving
+                     from a logical port. These rules are applied to the logiā€
+                     cal switchā€™s ingress pipeline.
+
+              ā€¢      to-lport:  Used to implement filters on traffic forwarded
+                     to a logical port. These rules are applied to the logical
+                     switchā€™s egress pipeline.
+
+       match: string
+              The packets that the ACL should match, in  the  same  expression
+              language  used  for the match column in the OVN Southbound dataā€
+              baseā€™s Logical_Flow table. The  outport  logical  port  is  only
+              available  in the to-lport direction (the inport is available in
+              both directions).
+
+              By default all traffic is allowed. When writing a more  restricā€
+              tive  policy, it is important to remember to allow flows such as
+              ARP and IPv6 neighbor discovery packets.
+
+              Note that you can not create an ACL  matching  on  a  port  with
+              type=router or type=localnet.
+
+       action: string, one of allow-related, allow-stateless, allow, drop,
+       pass, or reject
+              The action to take when the ACL rule matches:
+
+              ā€¢      allow-stateless:  Always  forward the packet in stateless
+                     manner, omitting connection tracking  mechanism,  regardā€
+                     less  of  other rules defined for the switch. May require
+                     defining additional rules for inbound replies. For  examā€
+                     ple,  if  you define a rule to allow outgoing TCP traffic
+                     directed to an IP address, then you probably also want to
+                     define another rule to allow incoming TCP traffic  coming
+                     from  this  same  IP  address.  In addition, traffic that
+                     matches stateless ACLs will bypass load-balancer DNAT/un-
+                     DNAT processing. Stateful ACLs should be used instead  if
+                     the traffic is supposed to be load-balanced.
+
+              ā€¢      allow:  Forward the packet. It will also send the packets
+                     through connection tracking when allow-related rules  exā€
+                     ist  on the logical switch. Otherwise, itā€™s equivalent to
+                     allow-stateless.
+
+              ā€¢      allow-related: Forward the  packet  and  related  traffic
+                     (e.g. inbound replies to an outbound connection).
+
+              ā€¢      drop: Silently drop the packet.
+
+              ā€¢      reject:  Drop  the packet, replying with a RST for TCP or
+                     ICMPv4/ICMPv6    unreachable    message     for     other
+                     IPv4/IPv6-based protocols.
+
+              ā€¢      pass:  Pass  to  the next ACL tier. If using multiple ACL
+                     tiers, a match on this ACL will stop evaluating  ACLs  at
+                     the  current  tier and move to the next one. If not using
+                     ACL tiers or if a pass ACL is matched at the final  tier,
+                     then   the   options:default_acl_drop   option  from  the
+                     NB_Global table is used to determine how to proceed.
+
+       tier: integer, in range 0 to 3
+              The hierarchical tier that this ACL belongs to.
+
+              ACLs can be assigned to numerical tiers. When  evaluating  ACLs,
+              an  internal  counter  is  used  to determine which tier of ACLs
+              should be evaluated. Tier 0 ACLs are evaluated first. If no verā€
+              dict can be determined, then tier 1  ACLs  are  evaluated  next.
+              This  continues  until the maximum tier value is reached. If all
+              tiers of ACLs are evaluated and no verdict is reached, then  the
+              options:default_acl_drop  option from table NB_Global is used to
+              determine how to proceed.
+
+              In this version of OVN, the maximum tier value for  ACLs  is  3,
+              meaning there are 4 tiers of ACLs allowed (0-3).
+
+     options:
+
+       ACLs options.
+
+       options : apply-after-lb: optional string
+              If  set  to  true,  the ACL will be applied after load balancing
+              stage. Supported only for from-lport direction.
+
+              The main use case of this option is to support ACLs matching  on
+              the  destination IP address of the packet for the backend IPs of
+              load balancers.
+
+              OVN will apply the from-lport ACLs in two stages.  ACLs  without
+              this  option apply-after-lb set, will be applied before the load
+              balancer stage and ACLs with this option set will be applied afā€
+              ter the load balancer stage. The priorities are  indepedent  beā€
+              tween  these stages and may not be obvious to the CMS. Hence CMS
+              should be extra careful when using this option and should  careā€
+              fully  evaluate  the  priorities of all the ACLs and the default
+              deny/allow ACLs if any.
+
+     Logging:
+
+       These columns control whether and how OVN logs packets  that  match  an
+       ACL.
+
+       log: boolean
+              If  set  to  true, packets that match the ACL will trigger a log
+              message on the transport node or nodes that perform ACL processā€
+              ing. Logging may be combined with any action.
+
+              If set to false, the remaining columns in  this  group  have  no
+              significance.
+
+       name: optional string, at most 63 characters long
+              This  name,  if  it  is provided, is included in log records. It
+              provides the administrator and the cloud management system a way
+              to associate a log record with a particular ACL.
+
+       severity: optional string, one of alert, debug, info, notice, or warnā€ā€
+       ing
+              The severity of the ACL. The severity levels match those of sysā€
+              log, in decreasing level of severity:  alert,  warning,  notice,
+              info, or debug. When the column is empty, the default is info.
+
+       meter: optional string
+              The  name of a meter to rate-limit log messages for the ACL. The
+              string must match the name column of a row in the  Meter  table.
+              By  default,  log messages are not rate-limited. In order to enā€
+              sure that the same Meter rate limits  multiple  ACL  logs  sepaā€
+              rately, set the fair column.
+
+     Common Columns:
+
+       options: map of string-string pairs
+              This  column  provides general key/value settings. The supported
+              options are described individually below.
+
+     ACL configuration options:
+
+       options : log-related: optional string
+              If set to true, then log when reply or related traffic is admitā€
+              ted from a stateful ACL. In order for this option  to  function,
+              the  log option must be set to true and a label must be set, and
+              it must be unique to the ACL. The label is necessary  as  it  is
+              the  only  means  to associate the reply traffic with the ACL to
+              which it belongs. It must be unique, because otherwise it is amā€
+              biguous which ACL will be matched. Note: If this option  is  enā€
+              abled,  an  extra  flow is installed in order to log the related
+              traffic. Therefore, if this is enabled on all ACLs, then the toā€
+              tal number of flows necessary to log the ACL traffic is doubled,
+              compared to if this option is not enabled.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Logical_Router TABLE
+       Each row represents one L3 logical router.
+
+   Summary:
+       ports                         set of Logical_Router_Ports
+       static_routes                 set of Logical_Router_Static_Routes
+       policies                      set of Logical_Router_Policys
+       enabled                       optional boolean
+       nat                           set of NATs
+       load_balancer                 set of weak reference to Load_Balancers
+       load_balancer_group           set of Load_Balancer_Groups
+       Naming:
+         name                        string
+         external_ids : neutron:router_name
+                                     optional string
+       copp                          optional weak reference to Copp
+       Options:
+         options : chassis           optional string
+         options : dnat_force_snat_ip
+                                     optional string
+         options : lb_force_snat_ip  optional string
+         options : mcast_relay       optional string, either true or false
+         options : dynamic_neigh_routers
+                                     optional string, either true or false
+         options : always_learn_from_arp_request
+                                     optional string, either true or false
+         options : requested-tnl-key
+                                     optional string, containing  an  integer,
+                                     in range 1 to 16,777,215
+         options : snat-ct-zone      optional  string,  containing an integer,
+                                     in range 0 to 65,535
+         options : mac_binding_age_threshold
+                                     optional string, containing  an  integer,
+                                     in range 0 to 4,294,967,295
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       ports: set of Logical_Router_Ports
+              The routerā€™s ports.
+
+       static_routes: set of Logical_Router_Static_Routes
+              Zero or more static routes for the router.
+
+       policies: set of Logical_Router_Policys
+              Zero or more routing policies for the router.
+
+       enabled: optional boolean
+              This  column  is  used  to administratively set router state. If
+              this column is empty or is set to true, the router  is  enabled.
+              If  this  column is set to false, the router is disabled. A disā€
+              abled router has all ingress and egress traffic dropped.
+
+       nat: set of NATs
+              One or more NAT rules for the router. NAT  rules  only  work  on
+              Gateway  routers,  and  on distributed routers with one and only
+              one distributed gateway port.
+
+       load_balancer: set of weak reference to Load_Balancers
+              Set of load balancers associated to this  logical  router.  Load
+              balancer Load balancer rules only work on the Gateway routers or
+              routers with one and only one distributed gateway port.
+
+       load_balancer_group: set of Load_Balancer_Groups
+              Set of load balancers groups associated to this logical router.
+
+     Naming:
+
+       These columns provide names for the logical router. From OVNā€™s perspecā€
+       tive, these names have no special meaning or purpose other than to proā€
+       vide  convenience  for  human interaction with the northbound database.
+       There is no requirement for the name to be unique. (For a unique  idenā€
+       tifier for a logical router, use its row UUID.)
+
+       (Originally, name was intended to serve the purpose of a human-friendly
+       name,  but the Neutron integration used it to uniquely identify its own
+       router object, in the format neutron-uuid. Later  on,  Neutron  started
+       propagating   the  friendly  name  of  a  router  as  external_ids:neuā€ā€
+       tron:router_name. Perhaps this can be cleaned up someday.)
+
+       name: string
+              A name for the logical router.
+
+       external_ids : neutron:router_name: optional string
+              Another name for the logical router.
+
+       copp: optional weak reference to Copp
+              The control plane protection policy from table Copp used for meā€
+              tering packets sent to ovn-controller from logical ports of this
+              router.
+
+     Options:
+
+       Additional options for the logical router.
+
+       options : chassis: optional string
+              If set, indicates that the logical router in question is a Gateā€
+              way router (which is centralized) and resides in the  set  chasā€
+              sis.  The  same value is also used by ovn-controller to uniquely
+              identify the chassis in the OVN deployment and comes from exterā€ā€
+              nal_ids:system-id in  the  Open_vSwitch  table  of  Open_vSwitch
+              database.
+
+              The Gateway router can only be connected to a distributed router
+              via  a switch if SNAT and DNAT are to be configured in the Gateā€
+              way router.
+
+       options : dnat_force_snat_ip: optional string
+              If set, indicates a set of IP addresses to use to force  SNAT  a
+              packet  that has already been DNATed in the gateway router. When
+              multiple gateway routers are configured,  a  packet  can  potenā€
+              tially  enter any of the gateway router, get DNATted and eventuā€
+              ally reach the logical switch port. For the return traffic to go
+              back to the same gateway  router  (for  unDNATing),  the  packet
+              needs a SNAT in the first place. This can be achieved by setting
+              the  above  option  with a gateway specific set of IP addresses.
+              This option may have exactly one IPv4 and/or one IPv6 address on
+              it, separated by a a space.
+
+       options : lb_force_snat_ip: optional string
+              If set, this option can take two possible type of values. Either
+              a set of IP addresses or the string value - router_ip.
+
+              If a set of IP addresses are configured, it indicates to use  to
+              force  SNAT  a packet that has already been load-balanced in the
+              gateway router. When multiple gateway routers are configured,  a
+              packet  can  potentially  enter  any of the gateway routers, get
+              DNATted as part of the load-balancing and eventually  reach  the
+              logical  switch  port.  For the return traffic to go back to the
+              same gateway router (for unDNATing), the packet needs a SNAT  in
+              the  first  place. This can be achieved by setting the above opā€
+              tion with a gateway specific set of IP  addresses.  This  option
+              may  have  exactly one IPv4 and/or one IPv6 address on it, sepaā€
+              rated by a space character.
+
+              If it is configured with the value router_ip, then the load balā€
+              anced packet is SNATed with the IP of router port  (attached  to
+              the gateway router) selected as the destination after taking the
+              routing decision.
+
+       options : mcast_relay: optional string, either true or false
+              Enables/disables  IP  multicast  relay  between logical switches
+              connected to the logical router. Default: False.
+
+       options : dynamic_neigh_routers: optional string, either true or false
+              If set to true, the router will resolve  neighbor  routersā€™  MAC
+              addresses  only by dynamic ARP/ND, instead of prepopulating staā€
+              tic mappings for all neighbor routers in the  ARP/ND  Resolution
+              stage.  This  reduces  number of flows, but requires ARP/ND mesā€
+              sages to resolve the IP-MAC bindings when needed. It is false by
+              default. It is recommended to set to true when a large number of
+              logical routers are connected to the  same  logical  switch  but
+              most  of  them never need to send traffic between each other. By
+              default, ovn-northd does not create mappings  to  NAT  and  load
+              balancer addresess. However, for NAT and load balancer addresses
+              that  have  the  add_route  option added, ovn-northd will create
+              logical flows that map NAT and load balancer IP addresses to the
+              appropriate MAC address. Setting dynamic_neigh_routers  to  true
+              will prevent the automatic creation of these logical flows.
+
+       options : always_learn_from_arp_request: optional string, either true
+       or false
+              This  option  controls  the  behavior when handling IPv4 ARP reā€
+              quests or IPv6 ND-NS packets - whether a dynamic  neighbor  (MAC
+              binding) entry is added/updated.
+
+              true  -  Always learn the MAC-IP binding, and add/update the MAC
+              binding entry.
+
+              false - If there is a MAC binding for that IP  and  the  MAC  is
+              different,  or, if TPA of ARP request belongs to any router port
+              on this router, then update/add that MAC-IP binding.  Otherwise,
+              donā€™t update/add entries.
+
+              It  is true by default. It is recommended to set to false when a
+              large number of logical routers are connected to the same  logiā€
+              cal  switch  but most of them never need to send traffic between
+              each other, to reduce the size of the MAC binding table.
+
+       options : requested-tnl-key: optional string, containing an integer, in
+       range 1 to 16,777,215
+              Configures the datapath tunnel key for the logical router.  This
+              is  not  needed because ovn-northd will assign an unique key for
+              each  datapath  by  itself.  However,  if  it   is   configured,
+              ovn-northd honors the configured value.
+
+       options : snat-ct-zone: optional string, containing an integer, in
+       range 0 to 65,535
+              Use the requested conntrack zone for SNAT with this router. This
+              can  be useful if egress traffic from the host running OVN comes
+              from both OVN and other sources. This way,  OVN  and  the  other
+              sources can make use of the same conntrack zone.
+
+       options : mac_binding_age_threshold: optional string, containing an inā€
+       teger, in range 0 to 4,294,967,295
+              MAC  binding  aging  threshold value in seconds. MAC binding exā€
+              ceeding this timeout will be automatically  removed.  The  value
+              defaults to 0, which means disabled.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+QoS TABLE
+       Each  row  in  this  table represents one QoS rule for a logical switch
+       that points to it through its qos_rules column. Two types  of  QoS  are
+       supported: DSCP marking and metering. A match with the highest-priority
+       will  have  QoS  applied to it. If the action column is specified, then
+       matching packets will have DSCP marking applied. If the bandwidth  colā€
+       umn is specified, then matching packets will have metering applied. acā€ā€
+       tion  and  bandwidth are not exclusive, so both marking and metering by
+       defined for the same QoS entry. If no row  matches,  packets  will  not
+       have any QoS applied.
+
+   Summary:
+       priority                      integer, in range 0 to 32,767
+       direction                     string, either from-lport or to-lport
+       match                         string
+       action                        map  of string-integer pairs, key must be
+                                     dscp, value in range 0 to 63
+       bandwidth                     map of string-integer pairs,  key  either
+                                     burst  or  rate,  value  in  range  1  to
+                                     4,294,967,295
+       external_ids                  map of string-string pairs
+
+   Details:
+       priority: integer, in range 0 to 32,767
+              The QoS ruleā€™s priority. Rules with numerically higher  priority
+              take precedence over those with lower. If two QoS rules with the
+              same  priority  both  match,  then the one actually applied to a
+              packet is undefined.
+
+       direction: string, either from-lport or to-lport
+              The value of this field is similar to  ACL  column  in  the  OVN
+              Northbound databaseā€™s ACL table.
+
+       match: string
+              The packets that the QoS rules should match, in the same expresā€
+              sion  language  used  for the match column in the OVN Southbound
+              databaseā€™s Logical_Flow table. The outport logical port is  only
+              available  in the to-lport direction (the inport is available in
+              both directions).
+
+       action: map of string-integer pairs, key must be dscp, value in range 0
+       to 63
+              When specified, matching flows will have DSCP marking applied.
+
+              ā€¢      dscp: The value of this action should be in the range  of
+                     0 to 63 (inclusive).
+
+       bandwidth: map of string-integer pairs, key either burst or rate, value
+       in range 1 to 4,294,967,295
+              When  specified,  matching  packets will have bandwidth metering
+              applied. Traffic over the limit will be dropped.
+
+              ā€¢      rate: The value of rate limit in kbps.
+
+              ā€¢      burst: The value of burst rate limit in kilobits. This is
+                     optional and needs to specify the rate.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Mirror TABLE
+       Each row in this table represents a mirror that can be  used  for  port
+       mirroring.  These  mirrors are referenced by the mirror_rules column in
+       the Logical_Switch_Port table.
+
+   Summary:
+       name                          string (must be unique within table)
+       filter                        string,  one  of  both,  from-lport,   or
+                                     to-lport
+       sink                          string
+       type                          string, one of erspan, gre, or local
+       index                         integer
+       external_ids                  map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Represents the name of the mirror.
+
+       filter: string, one of both, from-lport, or to-lport
+              The  value  of  this  field represents selection criteria of the
+              mirror. to-lport mirrors the packets coming into  logical  port.
+              from-lport  mirrors  the packets going out of logical port. both
+              mirrors for both directions.
+
+       sink: string
+              The value of this field represents the destination/sink  of  the
+              mirror.  If  the  type is gre or erspan, the value indicates the
+              tunnel remote IP (either IPv4 or IPv6). For  a  type  of  local,
+              this  field  defines  a  local  interface on the OVS integration
+              bridge to be used as the mirror destination. The interface  must
+              possess external-ids:mirror-id that matches this string.
+
+       type: string, one of erspan, gre, or local
+              The  value of this field specifies the mirror type - gre, erspan
+              or local.
+
+       index: integer
+              The value of this field represents the tunnel ID. If the configā€
+              ured tunnel type is gre, this field represents the GRE key value
+              and if the configured tunnel type is erspan  it  represents  the
+              erspan_idx value. It is ignored if the type is local.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Meter TABLE
+       Each  row  in this table represents a meter that can be used for QoS or
+       rate-limiting.
+
+   Summary:
+       name                          string (must be unique within table)
+       unit                          string, either kbps or pktps
+       bands                         set of 1 or more Meter_Bands
+       fair                          optional boolean
+       external_ids                  map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              A name for this meter.
+
+              Names that begin with "__" (two underscores)  are  reserved  for
+              OVN internal use and should not be added manually.
+
+       unit: string, either kbps or pktps
+              The  unit for rate and burst_rate parameters in the bands entry.
+              kbps specifies kilobits per second, and pktps specifies  packets
+              per second.
+
+       bands: set of 1 or more Meter_Bands
+              The bands associated with this meter. Each band specifies a rate
+              above  which  the band is to take the action action. If multiple
+              bandsā€™ rates are exceeded, then the band with the  highest  rate
+              among the exceeded bands is selected.
+
+       fair: optional boolean
+              This  column is used to further describe the desired behavior of
+              the meter when there are multiple references to it. If this colā€
+              umn is empty or is set to false, the rate will be shared  across
+              all  rows  that  refer  to the same Meter name. Conversely, when
+              this column is set to true, each user of the same Meter will  be
+              rate-limited on its own.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Meter_Band TABLE
+       Each row in this table represents a meter band which specifies the rate
+       above  which  the  configured action should be applied. These bands are
+       referenced by the bands column in the Meter table.
+
+   Summary:
+       action                        string, must be drop
+       rate                          integer, in range 1 to 4,294,967,295
+       burst_size                    integer, in range 0 to 4,294,967,295
+       external_ids                  map of string-string pairs
+
+   Details:
+       action: string, must be drop
+              The action to execute when this band matches. The only supported
+              action is drop.
+
+       rate: integer, in range 1 to 4,294,967,295
+              The rate limit for this band, in kilobits per second or bits per
+              second, depending on whether the parent Meter entryā€™s unit  colā€
+              umn specified kbps or pktps.
+
+       burst_size: integer, in range 0 to 4,294,967,295
+              The  maximum  burst allowed for the band in kilobits or packets,
+              depending on whether kbps or pktps was selected  in  the  parent
+              Meter  entryā€™s  unit  column. If the size is zero, the switch is
+              free to select some reasonable value depending on its configuraā€
+              tion.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Logical_Router_Port TABLE
+       A port within an L3 logical router.
+
+       Exactly one Logical_Router row must reference a  given  logical  router
+       port.
+
+   Summary:
+       name                          string (must be unique within table)
+       networks                      set of 1 or more strings
+       mac                           string
+       enabled                       optional boolean
+       Distributed Gateway Ports:
+         ha_chassis_group            optional HA_Chassis_Group
+         gateway_chassis             set of Gateway_Chassises
+         Options for Physical VLAN MTU Issues:
+            options : reside-on-redirect-chassis
+                                     optional string, either true or false
+            options : redirect-type  optional  string, either bridged or overā€ā€
+                                     lay
+       ipv6_prefix                   set of strings
+       ipv6_ra_configs:
+         ipv6_ra_configs : address_mode
+                                     optional string
+         ipv6_ra_configs : router_preference
+                                     optional string
+         ipv6_ra_configs : route_info
+                                     optional string
+         ipv6_ra_configs : mtu       optional string
+         ipv6_ra_configs : send_periodic
+                                     optional string
+         ipv6_ra_configs : max_interval
+                                     optional string
+         ipv6_ra_configs : min_interval
+                                     optional string
+         ipv6_ra_configs : rdnss     optional string
+         ipv6_ra_configs : dnssl     optional string
+       Options:
+         options : mcast_flood       optional string, either true or false
+         options : requested-tnl-key
+                                     optional string, containing  an  integer,
+                                     in range 1 to 32,767
+         options : prefix_delegation
+                                     optional string, either true or false
+         options : prefix            optional string, either true or false
+         options : route_table       optional string
+         options : gateway_mtu       optional  string,  containing an integer,
+                                     in range 68 to 65,535
+         options : gateway_mtu_bypass
+                                     optional string
+       Attachment:
+         peer                        optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              A name for the logical router port.
+
+              In addition to provide convenience for  human  interaction  with
+              the northbound database, this column is used as reference by its
+              patch port in Logical_Switch_Port or another logical router port
+              in Logical_Router_Port.
+
+              A  logical  router  port may not have the same name as a logical
+              switch port, but the database schema cannot enforce this.
+
+       networks: set of 1 or more strings
+              The IP addresses  and  netmasks  of  the  router.  For  example,
+              192.168.0.1/24   indicates  that  the  routerā€™s  IP  address  is
+              192.168.0.1 and that packets destined to 192.168.0.x  should  be
+              routed to this port.
+
+              A  logical  router  port  always  adds a link-local IPv6 address
+              (fe80::/64) automatically generated from the interfaceā€™s MAC adā€
+              dress using the modified EUI-64 format.
+
+       mac: string
+              The Ethernet address that belongs to this router port.
+
+       enabled: optional boolean
+              This column is used to administratively set port state. If  this
+              column  is empty or is set to true, the port is enabled. If this
+              column is set to false, the port is disabled.  A  disabled  port
+              has all ingress and egress traffic dropped.
+
+     Distributed Gateway Ports:
+
+       Gateways,  as  documented under Gateways in the OVN architecture guide,
+       provide limited connectivity  between  logical  networks  and  physical
+       ones.  OVN  support multiple kinds of gateways. The Logical_Router_Port
+       table can be used two different ways to configure  distributed  gateway
+       ports,  which are one kind of gateway. These two forms of configuration
+       exist for historical reasons. Both of them produce the same kind of OVN
+       southbound records and the same behavior in practice.
+
+       If either of these are set, this logical router port represents a  disā€
+       tributed  gateway  port  that  connects this router to a logical switch
+       with a localnet port or a connection to another OVN deployment.
+
+       Also mentioned in the OVN architecture guide, distributed gateway ports
+       can also be used for scalability reasons in deployments  where  logical
+       switches are dedicated to chassises rather than distributed.
+
+       The preferred way to configure a gateway is ha_chassis_group, but gateā€ā€
+       way_chassis  is  also supported for backward compatibility. Only one of
+       these should be set at a time on a given LRP, since they configure  the
+       same features.
+
+       Even when a gateway is configured, the logical router port still effecā€
+       tively resides on each chassis. However, due to the implications of the
+       use of L2 learning in the physical network, as well as the need to supā€
+       port advanced features such as one-to-many NAT (aka IP masquerading), a
+       subset  of  the  logical  router processing is handled in a centralized
+       manner on the gateway chassis.
+
+       There can be more than one distributed gateway ports configured on each
+       logical router, each connecting to different L2 segments.  Load-balancā€
+       ing is not yet supported on logical routers with more than one distribā€
+       uted gateway ports.
+
+       For  each  distributed  gateway port, it may have more than one gateway
+       chassises. When more than one gateway chassis is  specified,  OVN  only
+       uses  one  at a time. OVN can rely on OVS BFD implementation to monitor
+       gateway connectivity, preferring the highest-priority gateway  that  is
+       online.  Priorities  are  specified  in  the  priority  column of Gateā€ā€
+       way_Chassis or HA_Chassis.
+
+       ovn-northd programs the external_mac rules specified in  the  LRPā€™s  LR
+       into  the peer logical switchā€™s destination lookup on the chassis where
+       the logical_port resides. In addition, the logical routerā€™s MAC address
+       is automatically programmed in the peer  logical  switchā€™s  destination
+       lookup  flow on the gateway chasssis. If it is desired to generate graā€
+       tuitous ARPs for NAT addresses, then set the peer LSPā€™s options:nat-adā€ā€
+       dresses to router.
+
+       OVN 20.03 and earlier supported a third way  to  configure  distributed
+       gateway  ports  using  options:redirect-chassis  to specify the gateway
+       chassis. This method is no longer supported. Any remaining users should
+       switch to one of the newer methods instead. A  gateway_chassis  may  be
+       easily  configured  from the command line, e.g. ovn-nbctl lrp-set-gateā€ā€
+       way-chassis lrp chassis.
+
+       ha_chassis_group: optional HA_Chassis_Group
+              Designates an HA_Chassis_Group to provide  gateway  high  availā€
+              ability.
+
+       gateway_chassis: set of Gateway_Chassises
+              Designates  one  or  more Gateway_Chassis for the logical router
+              port.
+
+     Options for Physical VLAN MTU Issues:
+
+       MTU issues arise in mixing  tunnels  with  logical  networks  that  are
+       bridged  to  a physical VLAN. For an explanation of the MTU issues, see
+       Physical VLAN MTU Issues in the OVN architecture document. The  followā€
+       ing  options,  which  are alternatives, provide solutions. Both of them
+       cause packets to be sent over localnet instead  of  tunnels,  but  they
+       differ  in  whether  some  or  all  packets are sent this way. The most
+       prominent  tradeoff  between  these  options  is  that  reside-on-rediā€ā€
+       rect-chassis  is  easier  to  configure and that redirect-type performs
+       better for east-west traffic.
+
+       options : reside-on-redirect-chassis: optional string, either true or
+       false
+              If set to true, this option forces all traffic across the  logiā€
+              cal  router port to pass through the gateway chassis using a hop
+              across a localnet port. This changes behavior in two ways:
+
+              ā€¢      Without this option, east-west  traffic  passes  directly
+                     between  source and destination chassis (or even within a
+                     single chassis, for co-located VMs).  With  this  option,
+                     all east-west traffic passes through the gateway chassis.
+
+              ā€¢      Without  this option, traffic between the gateway chassis
+                     and other chassis is encapsulated in tunnels.  With  this
+                     option, traffic passes over a localnet interface.
+
+              This  option  may  usefully  be set only on logical router ports
+              that connect a distributed logical router to  a  logical  switch
+              with VIFs. It should not be set on a distributed gateway port.
+
+              OVN  honors  this  option only if the logical router has one and
+              only one distributed gateway port and if the LRPā€™s  peer  switch
+              has a localnet port.
+
+       options : redirect-type: optional string, either bridged or overlay
+              If  set  to  bridged  on a distributed gateway port, this option
+              causes OVN to redirect packets to the gateway chassis over a loā€ā€
+              calnet port instead of a tunnel. The relevant chassis must share
+              a localnet port.
+
+              This feature requires the administrator or the CMS to  configure
+              each  participating  chassis  with a unique Ethernet address for
+              the logical router by setting  ovn-chassis-mac-mappings  in  the
+              Open vSwitch database, for use by ovn-controller.
+
+              Setting  this  option  to overlay or leaving it unset has no efā€
+              fect. This option may usefully be  set  only  on  a  distributed
+              gateway  port when there is one and only one distributed gateway
+              port on the logical router. It is otherwise ignored.
+
+       ipv6_prefix: set of strings
+              This column contains IPv6 prefix obtained by  prefix  delegation
+              router according to RFC 3633
+
+     ipv6_ra_configs:
+
+       This column defines the IPv6 ND RA address mode and ND MTU Option to be
+       included by ovn-controller when it replies to the IPv6 Router solicitaā€
+       tion requests.
+
+       ipv6_ra_configs : address_mode: optional string
+              The  address mode to be used for IPv6 address configuration. The
+              supported values are:
+
+              ā€¢      slaac: Address configuration using  Router  Advertisement
+                     (RA)  packet.  The  IPv6  prefixes  defined  in the Logiā€ā€
+                     cal_Router_Port tableā€™s networks column will be  included
+                     in the RAā€™s ICMPv6 option - Prefix information.
+
+              ā€¢      dhcpv6_stateful: Address configuration using DHCPv6.
+
+              ā€¢      dhcpv6_stateless:  Address configuration using Router Adā€
+                     vertisement (RA) packet. Other IPv6 options are  provided
+                     by DHCPv6.
+
+       ipv6_ra_configs : router_preference: optional string
+              Default Router Preference (PRF) indicates whether to prefer this
+              router  over  other  default routers (RFC 4191). Possible values
+              are:
+
+              ā€¢      HIGH: mapped to 0x01 in RA PRF field
+
+              ā€¢      MEDIUM: mapped to 0x00 in RA PRF field
+
+              ā€¢      LOW: mapped to 0x11 in RA PRF field
+
+       ipv6_ra_configs : route_info: optional string
+              Route Info is used to configure Route Info Option sent in Router
+              Advertisement according to RFC 4191. Route Info is a comma sepaā€
+              rated string where each field provides  PRF  and  prefix  for  a
+              given route (e.g: HIGH-aef1::11/48,LOW-aef2::11/96) Possible PRF
+              values are:
+
+              ā€¢      HIGH: mapped to 0x01 in RA PRF field
+
+              ā€¢      MEDIUM: mapped to 0x00 in RA PRF field
+
+              ā€¢      LOW: mapped to 0x11 in RA PRF field
+
+       ipv6_ra_configs : mtu: optional string
+              The  recommended  MTU for the link. Default is 0, which means no
+              MTU Option will be included in RA  packet  replied  by  ovn-conā€
+              troller. Per RFC 2460, the mtu value is recommended no less than
+              1280,  so  any mtu value less than 1280 will be considered as no
+              MTU Option.
+
+       ipv6_ra_configs : send_periodic: optional string
+              If set to true, then this router interface will send router  adā€
+              vertisements periodically. The default is false.
+
+       ipv6_ra_configs : max_interval: optional string
+              The  maximum  number of seconds to wait between sending periodic
+              router advertisements. This option has no effect if ipv6_ra_conā€ā€
+              figs:send_periodic is false. The default is 600.
+
+       ipv6_ra_configs : min_interval: optional string
+              The minimum number of seconds to wait between  sending  periodic
+              router advertisements. This option has no effect if ipv6_ra_conā€ā€
+              figs:send_periodic   is  false.  The  default  is  one-third  of
+              ipv6_ra_configs:max_interval, i.e. 200 seconds if  that  key  is
+              unset.
+
+       ipv6_ra_configs : rdnss: optional string
+              IPv6 address of RDNSS server announced in RA packets. At the moā€
+              ment OVN supports just one RDNSS server.
+
+       ipv6_ra_configs : dnssl: optional string
+              DNS  Search  List  announced  in RA packets. Multiple DNS Search
+              List must be ā€™commaā€™ separated (e.g. "a.b.c, d.e.f")
+
+     Options:
+
+       Additional options for the logical router port.
+
+       options : mcast_flood: optional string, either true or false
+              If set to true, multicast traffic (including reports) are unconā€
+              ditionally forwarded to the specific port.
+
+              This option applies when the port is part of  a  logical  router
+              which has options:mcast_relay set to true.
+
+              Default: false.
+
+       options : requested-tnl-key: optional string, containing an integer, in
+       range 1 to 32,767
+              Configures  the  port  binding  tunnel key for the port. Usually
+              this is not needed because ovn-northd will assign an unique  key
+              for   each  port  by  itself.  However,  if  it  is  configured,
+              ovn-northd honors the configured value.
+
+       options : prefix_delegation: optional string, either true or false
+              If set to true, enable IPv6 prefix delegation state  machine  on
+              this  logical  router  port (RFC3633). IPv6 prefix delegation is
+              available just on a gateway router or on a gateway router port.
+
+       options : prefix: optional string, either true or false
+              If set to true, this interface will receive an IPv6  prefix  acā€
+              cording to RFC3663
+
+       options : route_table: optional string
+              Designates  lookup  Logical_Router_Static_Routes  with specified
+              route_table value. Routes to directly  connected  networks  from
+              same  Logical  Router  and routes without route_table option set
+              have higher priority than routes with route_table option set.
+
+       options : gateway_mtu: optional string, containing an integer, in range
+       68 to 65,535
+              If set, logical flows will be added to router pipeline to  check
+              packet  length.  If packet length is greater than the value set,
+              ICMPv4 type 3 (Destination Unreachable)  code  4  (Fragmentation
+              Needed  and Donā€™t Fragment was Set) or ICMPv6 type 2 (Packet Too
+              Big) code 0 (no route to destination) packets will be generated.
+              This allows for Path MTU Discovery.
+
+       options : gateway_mtu_bypass: optional string
+              When configured, represents a match expression, in the same  exā€
+              pression  language  used  for the match column in the OVN Southā€
+              bound databaseā€™s Logical_Flow table. Packets matching  this  exā€
+              pression will bypass the length check configured through the opā€ā€
+              tions:gateway_mtu option.
+
+     Attachment:
+
+       A given router port serves one of two purposes:
+
+              ā€¢      To attach a logical switch to a logical router. A logical
+                     router  port  of  this  type is referenced by exactly one
+                     Logical_Switch_Port of type router. The value of name  is
+                     set   as   router-port   in   column   options  of  Logiā€ā€
+                     cal_Switch_Port. In this case peer column is empty.
+
+              ā€¢      To connect one logical router to another. This requires a
+                     pair of logical router ports, each connected to a differā€
+                     ent router. Each router port in the  pair  specifies  the
+                     other in its peer column. No Logical_Switch refers to the
+                     router port.
+
+       peer: optional string
+              For  a  router  port  used  to connect two logical routers, this
+              identifies the other router port in the pair by name.
+
+              For a router port attached to a logical switch, this  column  is
+              empty.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+              The  ovn-northd  program  copies all these pairs into the exterā€ā€
+              nal_ids column of the Port_Binding table in OVN_Southbound dataā€
+              base.
+
+Logical_Router_Static_Route TABLE
+       Each record represents a static route.
+
+       When multiple routes match a packet, the longest-prefix match  is  choā€
+       sen.  For  a  given  prefix  length, a dst-ip route is preferred over a
+       src-ip route.
+
+       When there are ECMP routes, i.e. multiple routes with same  prefix  and
+       policy,  one  of  them will be selected based on the 5-tuple hashing of
+       the packet header.
+
+   Summary:
+       ip_prefix                     string
+       policy                        optional string, either dst-ip or src-ip
+       nexthop                       string
+       output_port                   optional string
+       bfd                           optional weak reference to BFD
+       route_table                   string
+       external_ids : ic-learned-route
+                                     optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+       Common options:
+         options                     map of string-string pairs
+         options : ecmp_symmetric_reply
+                                     optional string
+         options : origin            optional string
+
+   Details:
+       ip_prefix: string
+              IP prefix of this route (e.g. 192.168.100.0/24).
+
+       policy: optional string, either dst-ip or src-ip
+              If it is specified, this setting describes the  policy  used  to
+              make  routing decisions. This setting must be one of the followā€
+              ing strings:
+
+              ā€¢      src-ip: This policy sends the packet to the nexthop  when
+                     the packetā€™s source IP address matches ip_prefix.
+
+              ā€¢      dst-ip:  This policy sends the packet to the nexthop when
+                     the packetā€™s destination IP address matches ip_prefix.
+
+              If not specified, the default is dst-ip.
+
+       nexthop: string
+              Nexthop IP address for this route. Nexthop IP address should  be
+              the IP address of a connected router port or the IP address of a
+              logical port or can be set to discard for dropping packets which
+              match the given route.
+
+       output_port: optional string
+              The  name  of the Logical_Router_Port via which the packet needs
+              to be sent out. This is optional and  when  not  specified,  OVN
+              will  automatically  figure  this out based on the nexthop. When
+              this is specified and there are multiple  IP  addresses  on  the
+              router  port and none of them are in the same subnet of nexthop,
+              OVN chooses the first IP address as the one via which  the  nexā€ā€
+              thop is reachable.
+
+       bfd: optional weak reference to BFD
+              Reference to BFD row if the route has associated a BFD session
+
+       route_table: string
+              Any  string to place route to separate routing table. If Logical
+              Router Port has configured value  in  options:route_table  other
+              than empty string, OVN performs route lookup for all packets enā€
+              tering  Logical  Router  ingress  pipeline from this port in the
+              following manner:
+
+              ā€¢      1. First lookup among  "global"  routes:  routes  without
+                     route_table  value  set  and routes to directly connected
+                     networks.
+
+              ā€¢      2. Next lookup among routes with same  route_table  value
+                     as specified in LRPā€™s options:route_table field.
+
+       external_ids : ic-learned-route: optional string
+              ovn-ic  populates  this  key  if  the  route is learned from the
+              global OVN_IC_Southbound database. In this case the  value  will
+              be   set  to  the  uuid  of  the  row  in  Route  table  of  the
+              OVN_IC_Southbound database.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Common options:
+
+       options: map of string-string pairs
+              This column provides general key/value settings.  The  supported
+              options are described individually below.
+
+       options : ecmp_symmetric_reply: optional string
+              If true, then new traffic that arrives over this route will have
+              its  reply  traffic bypass ECMP route selection and will be sent
+              out this route instead. Note  that  this  option  overrides  any
+              rules  set  in the Logical_Router_policy table. This option only
+              works on gateway  routers  (routers  that  have  options:chassis
+              set).
+
+       options : origin: optional string
+              In case ovn-interconnection has been learned this route, it will
+              have its origin set: either "connected" or "static". This key is
+              supposed  to  be  written only by ovn-ic daemon. ovn-northd then
+              checks  this  value  when  generating   Logical   Flows.   Logiā€ā€
+              cal_Router_Static_Route  records with same ip_prefix within same
+              Logical Router will have next lookup order based on  origin  key
+              value:
+
+              1.  connected
+
+              2.  static
+Logical_Router_Policy TABLE
+       Each  row  in  this  table  represents one routing policy for a logical
+       router that points to it through its policies column. The action column
+       for the highest-priority  matching  row  in  this  table  determines  a
+       packetā€™s  treatment. If no row matches, packets are allowed by default.
+       (Default-deny treatment is possible: add a rule with priority 0,  1  as
+       match, and drop as action.)
+
+   Summary:
+       priority                      integer, in range 0 to 32,767
+       match                         string
+       action                        string, one of allow, drop, or reroute
+       nexthop                       optional string
+       nexthops                      set of strings
+       options : pkt_mark            optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       priority: integer, in range 0 to 32,767
+              The  routing  policyā€™s  priority.  Rules with numerically higher
+              priority take precedence  over  those  with  lower.  A  rule  is
+              uniquely identified by the priority and match string.
+
+       match: string
+              The  packets  that  the routing policy should match, in the same
+              expression language used for the match column in the OVN  Southā€
+              bound databaseā€™s Logical_Flow table.
+
+              By  default all traffic is allowed. When writing a more restricā€
+              tive policy, it is important to remember to allow flows such  as
+              ARP and IPv6 neighbor discovery packets.
+
+       action: string, one of allow, drop, or reroute
+              The action to take when the routing policy matches:
+
+              ā€¢      allow: Forward the packet.
+
+              ā€¢      drop: Silently drop the packet.
+
+              ā€¢      reroute: Reroute packet to nexthop or nexthops.
+
+       nexthop: optional string
+              Note: This column is deprecated in favor of nexthops.
+
+              Next-hop  IP  address for this route, which should be the IP adā€
+              dress of a connected router port or the IP address of a  logical
+              port.
+
+       nexthops: set of strings
+              Next-hop  ECMP  IP addresses for this route. Each IP in the list
+              should be the IP address of a connected router port  or  the  IP
+              address of a logical port.
+
+              One IP from the list is selected as next hop.
+
+       options : pkt_mark: optional string
+              Marks the packet with the value specified when the router policy
+              is applied. CMS can inspect this packet marker and take some deā€
+              cisions  if desired. This value is not preserved when the packet
+              goes out on the wire.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+NAT TABLE
+       Each record represents a NAT rule.
+
+   Summary:
+       type                          string, one of  dnat,  dnat_and_snat,  or
+                                     snat
+       external_ip                   string
+       external_mac                  optional string
+       external_port_range           string
+       logical_ip                    string
+       logical_port                  optional string
+       allowed_ext_ips               optional Address_Set
+       exempted_ext_ips              optional Address_Set
+       gateway_port                  optional    weak   reference   to   Logiā€ā€
+                                     cal_Router_Port
+       options : stateless           optional string
+       options : add_route           optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       type: string, one of dnat, dnat_and_snat, or snat
+              Type of the NAT rule.
+
+              ā€¢      When type is dnat, the externally visible IP address  exā€ā€
+                     ternal_ip  is DNATted to the IP address logical_ip in the
+                     logical space.
+
+              ā€¢      When type is snat, IP packets with their  source  IP  adā€
+                     dress that either matches the IP address in logical_ip or
+                     is  in  the network provided by logical_ip is SNATed into
+                     the IP address in external_ip.
+
+              ā€¢      When type is dnat_and_snat, the externally visible IP adā€
+                     dress external_ip is DNATted to the IP address logical_ip
+                     in the logical space. In addition, IP  packets  with  the
+                     source  IP address that matches logical_ip is SNATed into
+                     the IP address in external_ip.
+
+       external_ip: string
+              An IPv4 address.
+
+       external_mac: optional string
+              A MAC address.
+
+              This is only used on the gateway port  on  distributed  routers.
+              This must be specified in order for the NAT rule to be processed
+              in a distributed manner on all chassis. If this is not specified
+              for  a NAT rule on a distributed router, then this NAT rule will
+              be processed in a centralized manner on  the  gateway  port  inā€
+              stance on the gateway chassis.
+
+              This  MAC  address must be unique on the logical switch that the
+              gateway port is attached to. If the MAC address used on the logā€ā€
+              ical_port is globally unique, then that MAC address can be specā€
+              ified as this external_mac.
+
+       external_port_range: string
+              L4 source port range
+
+              Range of ports, from which a port number  will  be  picked  that
+              will  replace the source port of to be NATed packet. This is baā€
+              sically PAT (port address translation).
+
+              Value of the column is in the format, port_lo-port_hi. For examā€
+              ple: external_port_range : "1-30000"
+
+              Valid range of ports is 1-65535.
+
+       logical_ip: string
+              An IPv4 network (e.g 192.168.1.0/24) or an IPv4 address.
+
+       logical_port: optional string
+              The name of the logical port where the logical_ip resides.
+
+              This is only used on distributed routers. This must be specified
+              in order for the NAT rule to be processed in a distributed  manā€
+              ner on all chassis. If this is not specified for a NAT rule on a
+              distributed  router,  then  this NAT rule will be processed in a
+              centralized manner on the gateway port instance on  the  gateway
+              chassis.
+
+       allowed_ext_ips: optional Address_Set
+              It  represents  Address Set of external ips that NAT rule is apā€
+              plicable to. For SNAT type NAT rules, this refers to destination
+              addresses. For DNAT type NAT rules, this refers  to  source  adā€
+              dresses.
+
+              This  configuration overrides the default NAT behavior of applyā€
+              ing a rule solely based on internal IP. Without this  configuraā€
+              tion,  NAT  happens  without  considering  the  external IP (i.e
+              dest/source for snat/dnat type rule).  With  this  configuration
+              NAT  rule is applied ONLY if external ip is in the input Address
+              Set.
+
+       exempted_ext_ips: optional Address_Set
+              It represents Address Set of external ips that NAT rule  is  NOT
+              applicable  to. For SNAT type NAT rules, this refers to destinaā€
+              tion addresses. For DNAT type NAT rules, this refers  to  source
+              addresses.
+
+              This  configuration overrides the default NAT behavior of applyā€
+              ing a rule solely based on internal IP. Without this  configuraā€
+              tion,  NAT  happens  without  considering  the  external IP (i.e
+              dest/source for snat/dnat type rule).  With  this  configuration
+              NAT  rule  is NOT applied if external ip is in the input Address
+              Set.
+
+              If there are NAT rules in a logical router with  overlapping  IP
+              prefixes  (including /32), then usage of exempted_ext_ips should
+              be avoided in following scenario.  a.  SNAT  rule  (let  us  say
+              RULE1)  with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b.
+              SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1  (let
+              us  say  50.0.0.0/25). c. Now, if exempted_ext_ips is associated
+              with RULE2, then a logical ip which matches both 50.0.0.0/24 and
+              50.0.0.0/25 may get the RULE2 applied to it instead of RULE1.
+
+              allowed_ext_ips and exempted_ext_ips are mutually  exclusive  to
+              each  other.  If  both Address Sets are set for a rule, then the
+              NAT rule is not considered.
+
+       gateway_port: optional weak reference to Logical_Router_Port
+              A distributed gateway  port  in  the  Logical_Router_Port  table
+              where the NAT rule needs to be applied.
+
+              When multiple distributed gateway ports are configured on a Logā€ā€
+              ical_Router,  applying  a  NAT  rule  at each of the distributed
+              gateway ports might not be desired. Consider the  case  where  a
+              logical router has 2 distributed gateway port, one with networks
+              50.0.0.10/24  and  the  other with networks 60.0.0.10/24. If the
+              logical  router  has  a  NAT  rule  of  type  snat,   logical_ip
+              10.1.1.0/24  and  external_ip 50.1.1.20/24, the rule needs to be
+              selectively applied on matching packets entering/leaving through
+              the distributed gateway port with networks 50.0.0.10/24.
+
+              When a logical router has multiple distributed gateway ports and
+              this column is not set for a NAT rule, then the rule will be apā€
+              plied at the distributed gateway port which is in the same  netā€
+              work  as  the external_ip of the NAT rule, if such a router port
+              exists. If logical router has a single distributed gateway  port
+              and  this column is not set for a NAT rule, the rule will be apā€
+              plied at the distributed gateway port even if the router port is
+              not in the same network as the external_ip of the NAT rule.
+
+       options : stateless: optional string
+              Indicates if a dnat_and_snat  rule  should  lead  to  connection
+              tracking state or not.
+
+       options : add_route: optional string
+              If  set  to  true, then neighbor routers will have logical flows
+              added that will allow for routing to the NAT  address.  It  also
+              will  have  ARP  resolution logical flows added. By setting this
+              option,  it  means  there  is  no  reason  to  create  a   Logiā€ā€
+              cal_Router_Static_Route  from  neighbor  routers to this NAT adā€
+              dress. It also means that no ARP request is required for  neighā€
+              bor  routers  to  learn the IP-MAC mapping for this NAT address.
+              This option only applies to NATs of type dnat and dnat_and_snat.
+              For more information about what flows are added for  IP  routes,
+              please see the ovn-northd manpage section on IP Routing.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+DHCP_Options TABLE
+       OVN  implements  native  DHCPv4  support which caters to the common use
+       case of providing an IPv4 address to a booting  instance  by  providing
+       stateless replies to DHCPv4 requests based on statically configured adā€
+       dress  mappings. To do this it allows a short list of DHCPv4 options to
+       be configured and applied at each compute host running ovn-controller.
+
+       OVN also implements native  DHCPv6  support  which  provides  stateless
+       replies to DHCPv6 requests.
+
+   Summary:
+       cidr                          string
+       DHCPv4 options:
+         Mandatory DHCPv4 options:
+            options : server_id      optional string
+            options : server_mac     optional string
+            options : lease_time     optional  string,  containing an integer,
+                                     in range 0 to 4,294,967,295
+         IPv4 DHCP Options:
+            options : router         optional string
+            options : netmask        optional string
+            options : dns_server     optional string
+            options : log_server     optional string
+            options : lpr_server     optional string
+            options : swap_server    optional string
+            options : policy_filter  optional string
+            options : router_solicitation
+                                     optional string
+            options : nis_server     optional string
+            options : ntp_server     optional string
+            options : netbios_name_server
+                                     optional string
+            options : classless_static_route
+                                     optional string
+            options : ms_classless_static_route
+                                     optional string
+            options : next_server    optional string
+         Boolean DHCP Options:
+            options : ip_forward_enable
+                                     optional string, either 0 or 1
+            options : router_discovery
+                                     optional string, either 0 or 1
+            options : ethernet_encap optional string, either 0 or 1
+         Integer DHCP Options:
+            options : default_ttl    optional string, containing  an  integer,
+                                     in range 0 to 255
+            options : tcp_ttl        optional  string,  containing an integer,
+                                     in range 0 to 255
+            options : mtu            optional string, containing  an  integer,
+                                     in range 68 to 65,535
+            options : T1             optional  string,  containing an integer,
+                                     in range 68 to 4,294,967,295
+            options : T2             optional string, containing  an  integer,
+                                     in range 68 to 4,294,967,295
+            options : arp_cache_timeout
+                                     optional  string,  containing an integer,
+                                     in range 0 to 255
+            options : tcp_keepalive_interval
+                                     optional string, containing  an  integer,
+                                     in range 0 to 255
+            options : netbios_node_type
+                                     optional  string,  containing an integer,
+                                     in range 0 to 255
+         String DHCP Options:
+            options : wpad           optional string
+            options : bootfile_name  optional string
+            options : path_prefix    optional string
+            options : tftp_server_address
+                                     optional string
+            options : hostname       optional string
+            options : domain_name    optional string
+            options : bootfile_name_alt
+                                     optional string
+            options : broadcast_address
+                                     optional string
+         DHCP Options of type host_id:
+            options : tftp_server    optional string
+          DHCP Options of type domains:
+            options : domain_search_list
+                                     optional string
+       DHCPv6 options:
+         Mandatory DHCPv6 options:
+            options : server_id      optional string
+         IPv6 DHCPv6 options:
+            options : dns_server     optional string
+         String DHCPv6 options:
+            options : domain_search  optional string
+            options : dhcpv6_stateless
+                                     optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       cidr: string
+              The DHCPv4/DHCPv6 options will be included if the  logical  port
+              has its IP address in this cidr.
+
+     DHCPv4 options:
+
+       The  CMS  should define the set of DHCPv4 options as key/value pairs in
+       the options column of this table. For ovn-controller to  include  these
+       DHCPv4  options, the dhcpv4_options of Logical_Switch_Port should refer
+       to an entry in this table.
+
+     Mandatory DHCPv4 options:
+
+       The following options must be defined.
+
+       options : server_id: optional string
+              The IP address for the DHCP server to use. This should be in the
+              subnet of the offered IP. This is also included in the DHCP  ofā€
+              fer as option 54, ``server identifier.ā€™ā€™
+
+       options : server_mac: optional string
+              The Ethernet address for the DHCP server to use.
+
+       options : lease_time: optional string, containing an integer, in range
+       0 to 4,294,967,295
+              The offered lease time in seconds,
+
+              The DHCPv4 option code for this option is 51.
+
+     IPv4 DHCP Options:
+
+       Below  are  the  supported  DHCPv4 options whose values are an IPv4 adā€
+       dress, e.g. 192.168.1.1. Some options accept  multiple  IPv4  addresses
+       enclosed  within  curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please
+       refer to RFC 2132 for more details on DHCPv4 options and their codes.
+
+       options : router: optional string
+              The IP address of a gateway for the client to use.  This  should
+              be  in  the subnet of the offered IP. The DHCPv4 option code for
+              this option is 3.
+
+       options : netmask: optional string
+              The DHCPv4 option code for this option is 1.
+
+       options : dns_server: optional string
+              The DHCPv4 option code for this option is 6.
+
+       options : log_server: optional string
+              The DHCPv4 option code for this option is 7.
+
+       options : lpr_server: optional string
+              The DHCPv4 option code for this option is 9.
+
+       options : swap_server: optional string
+              The DHCPv4 option code for this option is 16.
+
+       options : policy_filter: optional string
+              The DHCPv4 option code for this option is 21.
+
+       options : router_solicitation: optional string
+              The DHCPv4 option code for this option is 32.
+
+       options : nis_server: optional string
+              The DHCPv4 option code for this option is 41.
+
+       options : ntp_server: optional string
+              The DHCPv4 option code for this option is 42.
+
+       options : netbios_name_server: optional string
+              The DHCPv4 option code for this option is 44.
+
+       options : classless_static_route: optional string
+              The DHCPv4 option code for this option is 121.
+
+              This option can contain one or more static routes, each of which
+              consists of a destination descriptor and the IP address  of  the
+              router that should be used to reach that destination. Please see
+              RFC 3442 for more details.
+
+              Example: {30.0.0.0/24,10.0.0.10, 0.0.0.0/0,10.0.0.1}
+
+       options : ms_classless_static_route: optional string
+              The  DHCPv4  option  code for this option is 249. This option is
+              similar to classless_static_route supported by Microsoft Windows
+              DHCPv4 clients.
+
+       options : next_server: optional string
+              The DHCPv4 option code for setting the "Next server IP  address"
+              field in the DHCP header.
+
+     Boolean DHCP Options:
+
+       These options accept a Boolean value, expressed as 0 for false or 1 for
+       true.
+
+       options : ip_forward_enable: optional string, either 0 or 1
+              The DHCPv4 option code for this option is 19.
+
+       options : router_discovery: optional string, either 0 or 1
+              The DHCPv4 option code for this option is 31.
+
+       options : ethernet_encap: optional string, either 0 or 1
+              The DHCPv4 option code for this option is 36.
+
+     Integer DHCP Options:
+
+       These options accept a nonnegative integer value.
+
+       options : default_ttl: optional string, containing an integer, in range
+       0 to 255
+              The DHCPv4 option code for this option is 23.
+
+       options : tcp_ttl: optional string, containing an integer, in range 0
+       to 255
+              The DHCPv4 option code for this option is 37.
+
+       options : mtu: optional string, containing an integer, in range 68 to
+       65,535
+              The DHCPv4 option code for this option is 26.
+
+       options : T1: optional string, containing an integer, in range 68 to
+       4,294,967,295
+              This  specifies  the time interval from address assignment until
+              the client begins trying to renew its address. The DHCPv4 option
+              code for this option is 58.
+
+       options : T2: optional string, containing an integer, in range 68 to
+       4,294,967,295
+              This specifies the time interval from address  assignment  until
+              the  client  begins trying to rebind its address. The DHCPv4 opā€
+              tion code for this option is 59.
+
+       options : arp_cache_timeout: optional string, containing an integer, in
+       range 0 to 255
+              The DHCPv4 option code for this option is 35. This option speciā€
+              fies the timeout in seconds for ARP cache entries.
+
+       options : tcp_keepalive_interval: optional string, containing an inteā€
+       ger, in range 0 to 255
+              The DHCPv4 option code for this option is 38. This option speciā€
+              fies the interval that the client TCP should wait before sending
+              a keepalive message on a TCP connection.
+
+       options : netbios_node_type: optional string, containing an integer, in
+       range 0 to 255
+              The DHCPv4 option code for this option is 46.
+
+     String DHCP Options:
+
+       These options accept a string value.
+
+       options : wpad: optional string
+              The DHCPv4 option code for this option is 252.  This  option  is
+              used  as part of web proxy auto discovery to provide a URL for a
+              web proxy.
+
+       options : bootfile_name: optional string
+              The DHCPv4 option code for this option is  67.  This  option  is
+              used to identify a bootfile.
+
+       options : path_prefix: optional string
+              The DHCPv4 option code for this option is 210. In PXELINUXā€™ case
+              this  option is used to set a common path prefix, instead of deā€
+              riving it from the bootfile name.
+
+       options : tftp_server_address: optional string
+              The DHCPv4 option code for this option is 150. The  option  conā€
+              tains  one  or more IPv4 addresses that the client MAY use. This
+              option is Cisco proprietary, the IEEE standard that matches with
+              this requirement is option 66 (tftp_server).
+
+       options : hostname: optional string
+              The DHCPv4 option code for this option is 12. If set,  indicates
+              the  DHCPv4 option "Hostname". Alternatively, this option can be
+              configured   in   options:hostname   column   in   table   Logiā€ā€
+              cal_Switch_Port.  If  Hostname  option value is set in both conā€
+              flicting  Logical_Switch_Port  and  DHCP_Options  tables,  Logiā€ā€
+              cal_Switch_Port takes precedence.
+
+       options : domain_name: optional string
+              The DHCPv4 option code for this option is 15. This option speciā€
+              fies the domain name that client should use when resolving hostā€
+              names via the Domain Name System.
+
+       options : bootfile_name_alt: optional string
+              "bootfile_name_alt"  option  is  used to support iPXE. When both
+              "bootfile_name" and "bootfile_name_alt" are provided by the CMS,
+              "bootfile_name" will be used for option 67 if the  dhcp  request
+              contains  etherboot  option (175), otherwise "bootfile_name_alt"
+              will be used.
+
+       options : broadcast_address: optional string
+              The DHCPv4 option code for this option is 28. This option speciā€
+              fies the IP address used as a broadcast address.
+
+     DHCP Options of type host_id:
+
+       These options accept either an IPv4 address or a string value.
+
+       options : tftp_server: optional string
+              The DHCPv4 option code for this option is 66.
+
+      DHCP Options of type domains:
+
+       These options accept string value which is a comma  separated  list  of
+       domain names. The domain names are encoded based on RFC 1035.
+
+       options : domain_search_list: optional string
+              The DHCPv4 option code for this option is 119.
+
+     DHCPv6 options:
+
+       OVN  also  implements  native DHCPv6 support. The CMS should define the
+       set of DHCPv6 options as key/value pairs.  The  define  DHCPv6  options
+       will  be  included  in  the  DHCPv6  response to the DHCPv6 Solicit/Reā€
+       quest/Confirm packet from the logical ports having the  IPv6  addresses
+       in the cidr.
+
+     Mandatory DHCPv6 options:
+
+       The following options must be defined.
+
+       options : server_id: optional string
+              The  Ethernet  address  for the DHCP server to use. This is also
+              included in the DHCPv6 reply as option 2, ``Server  Identifierā€™ā€™
+              to  carry  a  DUID  identifying  a server between a client and a
+              server. ovn-controller defines DUID based on Link-layer  Address
+              [DUID-LL].
+
+     IPv6 DHCPv6 options:
+
+       Below  are  the  supported  DHCPv6 options whose values are an IPv6 adā€
+       dress, e.g. aef0::4. Some options accept multiple  IPv6  addresses  enā€
+       closed  within  curly  braces, e.g. {aef0::4, aef0::5}. Please refer to
+       RFC 3315 for more details on DHCPv6 options and their codes.
+
+       options : dns_server: optional string
+              The DHCPv6 option code for this option is 23. This option speciā€
+              fies the DNS servers that the VM should use.
+
+     String DHCPv6 options:
+
+       These options accept string values.
+
+       options : domain_search: optional string
+              The DHCPv6 option code for this option is 24. This option speciā€
+              fies the domain search list the client  should  use  to  resolve
+              hostnames with DNS.
+
+              Example: "ovn.org".
+
+       options : dhcpv6_stateless: optional string
+              This  option specifies the OVN native DHCPv6 will work in stateā€
+              less mode, which means OVN native DHCPv6 will not offer IPv6 adā€
+              dresses for VM/VIF ports, but only reply  other  configurations,
+              such  as  DNS  and  domain search list. When setting this option
+              with string value "true", VM/VIF will configure  IPv6  addresses
+              by stateless way. Default value for this option is false.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Connection TABLE
+       Configuration  for  a  database  connection to an Open vSwitch database
+       (OVSDB) client.
+
+       This table  primarily  configures  the  Open  vSwitch  database  server
+       (ovsdb-server).
+
+       The  Open vSwitch database server can initiate and maintain active conā€
+       nections to remote clients. It can also  listen  for  database  connecā€
+       tions.
+
+   Summary:
+       Core Features:
+         target                      string (must be unique within table)
+       Client Failure Detection and Handling:
+         max_backoff                 optional integer, at least 1,000
+         inactivity_probe            optional integer
+       Status:
+         is_connected                boolean
+         status : last_error         optional string
+         status : state              optional  string, one of ACTIVE, BACKOFF,
+                                     CONNECTING, IDLE, or VOID
+         status : sec_since_connect  optional string, containing  an  integer,
+                                     at least 0
+         status : sec_since_disconnect
+                                     optional  string,  containing an integer,
+                                     at least 0
+         status : locks_held         optional string
+         status : locks_waiting      optional string
+         status : locks_lost         optional string
+         status : n_connections      optional string, containing  an  integer,
+                                     at least 2
+         status : bound_port         optional string, containing an integer
+       Common Columns:
+         external_ids                map of string-string pairs
+         other_config                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       target: string (must be unique within table)
+              Connection methods for clients.
+
+              The following connection methods are currently supported:
+
+              ssl:host[:port]
+                     The  specified  SSL  port  on the host at the given host,
+                     which can either be a DNS name (if built with unbound liā€
+                     brary) or an IP address. A valid SSL  configuration  must
+                     be  provided  when  this form is used, this configuration
+                     can be specified via command-line options or the SSL  taā€
+                     ble.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              tcp:host[:port]
+                     The specified TCP port on the host  at  the  given  host,
+                     which can either be a DNS name (if built with unbound liā€
+                     brary) or an IP address. If host is an IPv6 address, wrap
+                     it in square brackets, e.g. tcp:[::1]:6640.
+
+                     If port is not specified, it defaults to 6640.
+
+              pssl:[port][:host]
+                     Listens  for  SSL  connections on the specified TCP port.
+                     Specify 0 for  port  to  have  the  kernel  automatically
+                     choose  an available port. If host, which can either be a
+                     DNS name (if built with unbound library)  or  an  IP  adā€
+                     dress,  is  specified, then connections are restricted to
+                     the resolved or specified local IPaddress (either IPv4 or
+                     IPv6 address). If host is an IPv6 address, wrap in square
+                     brackets, e.g. pssl:6640:[::1]. If host is not  specified
+                     then  it listens only on IPv4 (but not IPv6) addresses. A
+                     valid SSL configuration must be provided when  this  form
+                     is  used,  this  can be specified either via command-line
+                     options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL support is an optional feature  that  is  not  always
+                     built as part of Open vSwitch.
+
+              ptcp:[port][:host]
+                     Listens  for connections on the specified TCP port. Specā€
+                     ify 0 for port to have the kernel automatically choose an
+                     available port. If host, which can either be a  DNS  name
+                     (if  built  with  unbound  library)  or an IP address, is
+                     specified, then connections are  restricted  to  the  reā€
+                     solved or specified local IP address (either IPv4 or IPv6
+                     address).  If  host is an IPv6 address, wrap it in square
+                     brackets, e.g. ptcp:6640:[::1]. If host is not  specified
+                     then it listens only on IPv4 addresses.
+
+                     If port is not specified, it defaults to 6640.
+
+              When  multiple clients are configured, the target values must be
+              unique. Duplicate target values yield unspecified results.
+
+     Client Failure Detection and Handling:
+
+       max_backoff: optional integer, at least 1,000
+              Maximum number of milliseconds to wait  between  connection  atā€
+              tempts. Default is implementation-specific.
+
+       inactivity_probe: optional integer
+              Maximum number of milliseconds of idle time on connection to the
+              client  before  sending  an  inactivity  probe  message. If Open
+              vSwitch does not communicate with the client for  the  specified
+              number  of  seconds,  it will send a probe. If a response is not
+              received for the same additional amount of  time,  Open  vSwitch
+              assumes  the  connection  has been broken and attempts to reconā€
+              nect. Default is implementation-specific. A value of 0  disables
+              inactivity probes.
+
+     Status:
+
+       Key-value pair of is_connected is always updated. Other key-value pairs
+       in the status columns may be updated depends on the target type.
+
+       When target specifies a connection method that listens for inbound conā€
+       nections  (e.g.  ptcp:  or punix:), both n_connections and is_connected
+       may also be updated while the remaining key-value pairs are omitted.
+
+       On the other hand, when target specifies an  outbound  connection,  all
+       key-value  pairs  may  be  updated, except the above-mentioned two key-
+       value pairs associated with inbound connection targets. They are  omitā€
+       ted.
+
+       is_connected: boolean
+              true if currently connected to this client, false otherwise.
+
+       status : last_error: optional string
+              A human-readable description of the last error on the connection
+              to  the  manager; i.e. strerror(errno). This key will exist only
+              if an error has occurred.
+
+       status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING,
+       IDLE, or VOID
+              The state of the connection to the manager:
+
+              VOID   Connection is disabled.
+
+              BACKOFF
+                     Attempting to reconnect at an increasing period.
+
+              CONNECTING
+                     Attempting to connect.
+
+              ACTIVE Connected, remote host responsive.
+
+              IDLE   Connection is idle. Waiting for response to keep-alive.
+
+              These values may change in the future. They  are  provided  only
+              for human consumption.
+
+       status : sec_since_connect: optional string, containing an integer, at
+       least 0
+              The amount of time since this client last successfully connected
+              to the database (in seconds). Value is empty if client has never
+              successfully been connected.
+
+       status : sec_since_disconnect: optional string, containing an integer,
+       at least 0
+              The  amount of time since this client last disconnected from the
+              database (in seconds). Value is empty if client has  never  disā€
+              connected.
+
+       status : locks_held: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection holds. Omitted if  the  connection  does  not  hold  any
+              locks.
+
+       status : locks_waiting: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection is currently waiting to acquire. Omitted if the  connecā€
+              tion is not waiting for any locks.
+
+       status : locks_lost: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection has had stolen by another OVSDB client.  Omitted  if  no
+              locks have been stolen from this connection.
+
+       status : n_connections: optional string, containing an integer, at
+       least 2
+              When  target  specifies a connection method that listens for inā€
+              bound connections (e.g. ptcp: or pssl:) and more than  one  conā€
+              nection  is  actually  active, the value is the number of active
+              connections. Otherwise, this key-value pair is omitted.
+
+       status : bound_port: optional string, containing an integer
+              When target is ptcp: or pssl:, this is the TCP port on which the
+              OVSDB server is listening. (This  is  particularly  useful  when
+              target  specifies a port of 0, allowing the kernel to choose any
+              available port.)
+
+     Common Columns:
+
+       The overall purpose of these columns is described under Common  Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+       other_config: map of string-string pairs
+DNS TABLE
+       Each  row  in this table stores the DNS records. The Logical_Switch taā€
+       bleā€™s dns_records references these records.
+
+   Summary:
+       records                       map of string-string pairs
+       external_ids                  map of string-string pairs
+
+   Details:
+       records: map of string-string pairs
+              Key-value pair of DNS records with DNS query name as the key and
+              value as a string of IP address(es) separated by comma or space.
+              For PTR requests, the key-value pair can  be  Reverse  IPv4  adā€ā€
+              dress.in-addr.arpa  and  the value DNS domain name. For IPv6 adā€
+              dresses, the key has to be Reverse IPv6 address.ip6.arpa.
+
+              Example:  "vm1.ovn.org" = "10.0.0.4 aef0::4"
+
+              Example:  "4.0.0.10.in-addr.arpa" = "vm1.ovn.org"
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+SSL TABLE
+       SSL configuration for ovn-nb database access.
+
+   Summary:
+       private_key                   string
+       certificate                   string
+       ca_cert                       string
+       bootstrap_ca_cert             boolean
+       ssl_protocols                 string
+       ssl_ciphers                   string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       private_key: string
+              Name of a PEM file  containing  the  private  key  used  as  the
+              switchā€™s identity for SSL connections to the controller.
+
+       certificate: string
+              Name  of a PEM file containing a certificate, signed by the cerā€
+              tificate authority (CA) used by the controller and manager, that
+              certifies the switchā€™s private key,  identifying  a  trustworthy
+              switch.
+
+       ca_cert: string
+              Name  of a PEM file containing the CA certificate used to verify
+              that the switch is connected to a trustworthy controller.
+
+       bootstrap_ca_cert: boolean
+              If set to true, then Open vSwitch will attempt to obtain the  CA
+              certificate  from the controller on its first SSL connection and
+              save it to the named PEM file. If it is successful, it will  imā€
+              mediately  drop  the  connection and reconnect, and from then on
+              all SSL connections  must  be  authenticated  by  a  certificate
+              signed  by the CA certificate thus obtained. This option exposes
+              the SSL connection to a man-in-the-middle attack  obtaining  the
+              initial  CA  certificate.  It may still be useful for bootstrapā€
+              ping.
+
+       ssl_protocols: string
+              List of SSL protocols to be enabled for SSL connections. The deā€
+              fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.
+
+       ssl_ciphers: string
+              List of ciphers (in OpenSSL cipher string  format)  to  be  supā€
+              ported  for  SSL  connections.  The  default when this option is
+              omitted is HIGH:!aNULL:!MD5.
+
+     Common Columns:
+
+       The overall purpose of these columns is described under Common  Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Gateway_Chassis TABLE
+       Association  of  a  chassis to a logical router port. The traffic going
+       out through an specific router port will be redirected to a chassis, or
+       a set of them in high availability configurations.
+
+   Summary:
+       name                          string (must be unique within table)
+       chassis_name                  string
+       priority                      integer, in range 0 to 32,767
+       options                       map of string-string pairs
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Name of the Gateway_Chassis.
+
+              A   suggested,   but   not   required   naming   convention   is
+              ${port_name}_${chassis_name}.
+
+       chassis_name: string
+              Name of the chassis that we want to redirect traffic through for
+              the  associated  logical  router  port. The value must match the
+              name column of the Chassis table in the OVN_Southbound database.
+
+       priority: integer, in range 0 to 32,767
+              This is the priority of a chassis among all Gateway_Chassis  beā€
+              longing to the same logical router port.
+
+       options: map of string-string pairs
+              Reserved for future use.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+HA_Chassis_Group TABLE
+       Table representing a group of chassis which can provide high availabilā€
+       ity  services.  Each  chassis  in the group is represented by the table
+       HA_Chassis. The HA chassis with highest priority will be the master  of
+       this  group. If the master chassis failover is detected, the HA chassis
+       with the next higher priority takes over the responsibility of  providā€
+       ing  the  HA.  If a distributed gateway router port references a row in
+       this table, then the master HA chassis in this group provides the gateā€
+       way functionality.
+
+   Summary:
+       name                          string (must be unique within table)
+       ha_chassis                    set of HA_Chassises
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Name of the HA_Chassis_Group. Name should be unique.
+
+       ha_chassis: set of HA_Chassises
+              A list of HA chassis which belongs to this group.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+HA_Chassis TABLE
+   Summary:
+       chassis_name                  string
+       priority                      integer, in range 0 to 32,767
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       chassis_name: string
+              Name of the chassis which is part of the HA chassis  group.  The
+              value  must  match  the  name column of the Chassis table in the
+              OVN_Southbound database.
+
+       priority: integer, in range 0 to 32,767
+              Priority of the chassis. Chassis with highest priority  will  be
+              the master.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+BFD TABLE
+       Contains  BFD  parameter  for ovn-controller BFD configuration. OVN BFD
+       implementation is used to provide detection of failures in the path beā€
+       tween adjacent forwarding engines, including the  OVN  interfaces.  OVN
+       BFD  provides link status info to OVN northd in order to update logical
+       flows according to the status of BFD endpoints. In the  current  impleā€
+       mentation  OVN  BFD  is  used to check next-hop status for ECMP routes.
+       Please note BFD table refers to OVN BFD implementation and not  to  OVS
+       legacy one.
+
+   Summary:
+       Configuration:
+         logical_port                string
+         dst_ip                      string
+         min_tx                      optional integer, at least 1
+         min_rx                      optional integer
+         detect_mult                 optional integer, at least 1
+         options                     map of string-string pairs
+         external_ids                map of string-string pairs
+       Status Reporting:
+         status                      optional string, one of admin_down, down,
+                                     init, or up
+
+   Details:
+     Configuration:
+
+       ovn-northd reads configuration from these columns.
+
+       logical_port: string
+              OVN logical port when BFD engine is running.
+
+       dst_ip: string
+              BFD peer IP address.
+
+       min_tx: optional integer, at least 1
+              This  is  the  minimum interval, in milliseconds, that the local
+              system would like to use when transmitting BFD Control  packets,
+              less  any  jitter  applied.  The value zero is reserved. Default
+              value is 1000 ms.
+
+       min_rx: optional integer
+              This is the minimum interval, in milliseconds, between  received
+              BFD  Control  packets that this system is capable of supporting,
+              less any jitter applied by the sender. If this  value  is  zero,
+              the  transmitting system does not want the remote system to send
+              any periodic BFD Control packets.
+
+       detect_mult: optional integer, at least 1
+              Detection time multiplier.  The  negotiated  transmit  interval,
+              multiplied  by  this  value, provides the Detection Time for the
+              receiving system in Asynchronous mode. Default value is 5.
+
+       options: map of string-string pairs
+              Reserved for future use.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Status Reporting:
+
+       ovn-northd writes BFD status into these columns.
+
+       status: optional string, one of admin_down, down, init, or up
+              BFD port logical states. Possible values are:
+
+              ā€¢      admin_down
+
+              ā€¢      down
+
+              ā€¢      init
+
+              ā€¢      up
+Static_MAC_Binding TABLE
+       Each record represents a Static_MAC_Binding entry for a logical router.
+
+   Summary:
+       Configuration:
+         logical_port                string
+         ip                          string
+         mac                         string
+         override_dynamic_mac        boolean
+
+   Details:
+     Configuration:
+
+       ovn-northd reads configuration from these columns  and  propagates  the
+       value to SBDB.
+
+       logical_port: string
+              The logical router port for the binding.
+
+       ip: string
+              The bound IP address.
+
+       mac: string
+              The Ethernet address to which the IP is bound.
+
+       override_dynamic_mac: boolean
+              Override dynamically learnt MACs.
+
+Chassis_Template_Var TABLE
+       One  record per chassis, each containing a map, variables, between temā€
+       plate variable names and their value for that specific chassis. A  temā€
+       plate variable has a name and potentially different values on different
+       hypervisors  in  the  OVN  cluster. For example, two rows, R1 = (.chasā€ā€
+       sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N:  V2)}
+       will make ovn-controller running on chassis C1 and C2 interpret the toā€
+       ken  N  either  as V1 (on C1) or as V2 (on C2). Users can refer to temā€
+       plate variables from within other logical components, e.g., within ACL,
+       QoS or Logical_Router_Policy matches  or  from  Load_Balancer  VIP  and
+       backend definitions.
+
+       If  a template variable is referenced on a chassis for which that variā€
+       able is not defined then ovn-controller running on  that  chassis  will
+       just interpret it as a raw string literal.
+
+   Summary:
+       chassis                       string (must be unique within table)
+       variables                     map of string-string pairs
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       chassis: string (must be unique within table)
+              The chassis this set of variable values applies to.
+
+       variables: map of string-string pairs
+              The set of variable values for a given chassis.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Open vSwitch 23.06.3            DB Schema 7.0.4                      ovn-nb(5)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nb.5.pdf b/src/static/support/dist-docs-branch-23.06/ovn-nb.5.pdf new file mode 100644 index 0000000000000000000000000000000000000000..58dca0ac5544a855240d3a1d91e3443d23ab9b60 GIT binary patch literal 211737 zcma&NV~j4q(k=XqZQI;q+qP}nwr%aPZF|oi+qP{Rcb_-+yUCaH=l#{))t%~2DydqX zwTetZM2wb^js==*utnkW>*Ti@mC21WOivXG}H99z(@alNxD^2IzlS5xRrOjTS@XXqx zL0GC=Q`eZvTLFAetq06dI$LHen}pH&)DY3HCZU{`QsLTM0)A=eGZ3R9FVr=zeV zTX$rQT~M{6)4PI}1x2a#2btjYFmV?%J*{*0XMRcUG5y1@O~&%RY=MvFO`4`cE}JH< ztwg-K*R;r$QKzQb*Q0bi=CK)aT z4hjgh74bqP_EZ)}bdoc}c1VGnJ(;lb(n5m4%86r|yu^`n@Bc`MXeHjOs1Xy*tbZMx zd-@5FV>b>@ntChl-As;te)AC%*vsD(3x!f8q_70S`R0q>3N&-%gv# zjf>Xs<|~2~3h?81aHy&Pk+7sGZd-~FLiFX4Do9~qHv}CYps7uM3@heAf>Qu50VdrP z!^~DmGyIGDsHw*B3$RieZ?CXrD@ewj-=o!eTa=O-?>lOMyY)oj>z^88*DK z@GVbQ3C}VMjoR7UwD_avf8*oZ2u{$`4{>BZjtT?HPde;&#%xy7I(pOpm^jjWq#p@J zRmU0Hs2^QKK*f<*h??e*3efmN4&Bod0>K#-VpCvkfhR%s^q+naIu4)W!>uEYgF303 zJx?K42%@FpDE!VrOJzYQi_W1OAYPBc%ghw`6{HWKo3&LYj7b+B12{b&s1@8d1dQIj zWwj=HZSjCso^%>xracRSodkUqyKt-0-mu;5+f;=OZ41`bg!fUhhOBDVTsUGYsk zK$*VuhKZt+xC$f(gy}`z{#r+098yM;LIptrCdSL^+20ILbOyrVP?v1WSMb^R zbDcK#L_Vvma)`&J*aHpTv$5$YfN*;bif)uZw2?T83J*T60$rQV$>Cev5&6o#-ub3? z+sdU@(hQe9Q*RIAqI8m!Of?ve6OCPARec z1#Figil?tMlG^_XDSTtXgs!H}IwWvi*`L?A6oRgyc-);dHBzo1YT}VFYy`bc3C{Zp z#KZr`Xrd_nS+drU`MVQ*^vCn$ba6K+8zM=L;PKg>hz{+}p1k$})n)KWHgc=iwmC}Z zi7j$-=ru&?TG9SzwuA#(zK+B78YzN(?gQEo?yrzW@R^1-dsfXu;$oSeI``DGnO*1| zwt0@4;GDG?%PGBDz-BZdr~{daAUlSI{olVo^`3dg%rq25F+!v`(6TJMELR^^{O>vf z4jfM!!qMvXHxiiQ9wX4)rWhbS*W6ah<~vT6LB9jS=iH&$x{-xvH)c@ny`zB%i`cHM z?6iR4B9QIqR?NW7464p-G;7dNT6@PWQaT*05y#ybg7Ds;JhFb9vgBZ;;P`z3h@EQS zvBddAhIeta%3kLQb2J6k0f-|7vJJa!MDu=o%y&W}H68GS@EGjk!6`L|6mDh)v z47Ld9=`=;*PnQ(0A2=g3-dU!0CjYl!|C{}%$p5Fb|7T?6WaWhZzc$AIMgWZeI|z_8 zAveH)DEjgprO6eY-e5d3)<{cFqzY-(Kt%~{X%Q^(9+tOT)R3H#HeU$sX*lM5lTmdy z34{gVQue1Qi7;j?`}Q4e{nxJo>xdf_auV~Gb+kzsOBvi|04-U1((GB6xgPD{xe+?3 zBWX>43}nsc`C97q^+7DR5w*zNVh5}y4O%*a5J834-(|D-zF$K+s>9RZnfkRB!_KkAF2c}k1Y zybrmPQ}FB4V<&~j-}M?~CJX1z-Fn4UMp_MDVGyzW#uu{tHM=HeFZZ92lWKA$uxAFQ zteW#T9#V69^R$(Uim~z21}lV#1-gMX)^*kc9Gh;;;s-<7Lk);5^ycaH5)5S1K?wJu}Hd;(O zC}gFL$a>MA!0p`w5DYl&`mf;rPt^VsU1ko}{})`&|AKc+4F4N^SEHlpoHdf_ds5e% zRY5A`rEi9>vu$KPu33_aVICDIF}fc@ikg&`^!DUD!}$e7Ah2#qNX0*@-?Xyf&gpLX z>ARQaw|Beq`f~p~N!!E!@sVMEVf5+j+4cJQv?l%NE&vqIkB=Zj@*Kjzil!^QpA+w%q7|NSZNgQb(!*-_B{rGmzLJbHy-X8Ok| z_vhZ|F8t+!8}^o#UU=;Mcy(`}Dt;yY_YL}A?X9o+PQkJ=ZQ?316)pAJoan%bMyJuB0l zs_>`#p$Qvz1#ONWE7Rsb8#;!MA0JNx@7H&R4fE|}FIIyVJO#G5+T0K4Llh{E6iHpC z8E#WY_&YWD7*!un`(NkZjt!m@LqG3@r6tY{c|T8nO`bYD)dc)|z>a6pY7wqj!dPv0 zV^-oiT>%;&B05yv?k<{5RLsmB;y$~R z+pEoCj1=x)w**P3jr>?k9Q?125GQ%p6N;>Sn_qWV$9{MI7avpo-&>nC{;mwkTT$+= zT9+97?xh=3U&$3#8d~Q3UO!I$m8~?qkDVkc#X_D{x@#$@Ppf})N1vw$l)Rv-Xff(` zboIaCww!cYk3V%7w{&*a;Oyw#4Ozkmx9WCkZ&uuYUxfd#tY_`wJ%6<8ec3KsN1pxl z@_nY*@Vt$_A(+13FS69`N&#E_xo9%$BnuOrB%`_77PfhPtfg1BVOvY`*i`I|{l?wm)eu%EKXR|NX?1)8wn18XmU@fxKdfi4Zq0gdHqBXN#1-HJECefs! z%J{s#qJArKJF?bE%eJA;B4)L_h@RTodPg3&>7w89VYK~IPsdj2u#}u;?WhTJdL~;1 zO80WU)VAR&@!gSVbrIy4- zhA|4UO)ndr>+*a~Mj!c`9RAhq;p^$>{8-4%t*dVR*I0@Yq;yxRfwAMOxkiD8y7|k> zWO@d2AD?Znel_8iT2IGsk}JWO*n#$j@YGAgxDKC9lu( z5Ue7mAbE+?_f>LDvBiAU!jCm3A2#@yx;jQ)ot;`~-gVnWm=bYBn(&OYayrm?IX;t!C6tuaB~55&bJ~Ij5e~@v z^8t6)>$~5>fJ{QA^sM^Aw^37ai$ne2vrM0Nc1SnYK)Em?ioWmrmpb^vb&~_}Bd=3M z`}LXP$&hXdh%^m<_#FUv*C!9c#u7{Ryo%1%{@#vFE02v@zUobz!}$RWhz4EA!_rr( z;H04XZV=YMP|qZJ`qoeh9t{__E3YgRSeHiD%yHufwb3p8-?#mE41W*#N3H`7<7xOi zHZ&9L(Q*u{EsDYlGOY>?Tk$7eseM`D(dri?Yfl+!!$DI#kX?Mq-RB4qOOxq_p31L> zbp~N$G&7dNQ?q`x28!Bp8$m4``O498+1BR;2h_pLJ99(kA`7GXZc=O~3o@CUEEA}H zLVbEZO?q2AJx$iSFxGaVwSqoVpytAZgwuZwlrPD3c2&$YARPVL{IV9}h@ENI*lvdZeGl03!!Et8ZTr4y}nZLW=4CPX- z>SI;buz42*r}%|a4MK{1mL_w@I+BkjY?3)!*;2@kCW*(_;P6?nk6ZTAJ3YY4Z3e$oJ-)lPIx+(*JYX*F6(7ii3 zE0rx20UTiQx=P87{&npmF>}M`ooK-`@P>hrr@sT_c9q^vzTR(i8y91o5-FeEziR`O zT?U)tyN(ZMnDFXm1IfqE2^6zJ4~xV}u<-W&{1w}wjafKOI6?EO12eBQ zTf#N|ou$AyFm3Cr!*MW4pmASGA4}%I1YEI{OP*ylv0UyV|6<;m2;oE}#{X(~Q_#F?$EE zA*Gy^Yu|kG2Kx{<0l7RTA64tS^sxaFBM9-9!8Zu##Qhl6!`3PRkw3f`5#0rj4IQLvA?Rz z!eI-86+v_`Vs!;`uscW_MM}+)Fer7S2+`^zeaV?b-C_?4B321DgYeQhheJBf7FuKA zj;F7uHZdI1PjmzX5TkZjrOYr*kj{vFCPtJl^TTU^#o{aULDOu$~u9RZ%qLR!HGXBI-H^ z>(~M>wmmsU!^`N%f8kd!Oo6cYJNG3>=b|2eyf8yinc!Wdj8(aLgzjo*(o7f6X>YWt zQp9YYkJ(j%tdjJ(=htxAFfuZ_EJe47l-Glu27{VKB_5WfP<|rDB*6}tX{Dj!iY}#4 zfFOh0kS`rFM@~>uPv%v0hviErZo251gtW1rjf*+2LX;7GK|gK9nuDJ57;DzF5NQI9 z&tYF)Q<3kJ6(uz@%c)DU<{~>8g&|2}Hj;B6FNV-SgR~9jN{Y~E`&o~R2NWzMf-f$g z^6bsS)b+5xoMTO7=tOxR({qZTm@U(DGF+o{c@FmCv8T5RX760%3;BDm0#YSw64LvF zpjnv6eX>q7l8ES0Hywp)LGTJ)OkkViN|`H&K++|!nVo<^Jp^2vf>hf3hWqG(74r#& z9fb3U3=z<cj>=WWQTeAUU9fgpv2 z(TBnMgV90MgHr|g=6{zOnzK_x5tLxW#Bk(lCdjdA=x+0jfX&fJz&A~VRM=YjWhw3j zQTRAa&SLqU6Dvi*?rrf|0);V6McBxuT;11`-sVg`qMn284)znFV##L*$V;LM(C^RQ z`WK^eT?XF;Y4knHnXyTPP2k+9K9?O8s+GT{^nm*S>l1S6CGDb2O5fX!{@P7$)B;sQ z@oPN5UpF|L}MGAyUid+aCni7>9jUrA6VWy`>42PmaZATHcD)DvKXmVLqC2Zqd zKwO^tx}w<1@&f5Zz& zX}pd8om;+y&X~ruC!)Lg|iGSZwwPigo)>X2?60t9;EGO1R-FcMPokbn|@7DTeZU( zZ^K|WA(FgQ5`PC9UwMt(i96m5j^_Y&1s05xAnXz61Uc-On_LZ21cK{&mGM9_X^!p| z=wrrqgy2gJH|>{NYce(1Wc(u;0AWn-If6B5l1JhP%-)006Km+?R*nU-gzuTJs64Kh zDiLfwP9M?48^nHUAQ6a%cnEZ1&M9yV#ZZCdL?BMr@hi_JDu_fXseW{!*`E3+W`mMR zv86m*<(;t~WK15-y>;@e;!?*ao^%->orngSZ`33G%^4(8G)UM>C2+T<$uL?Z4zIn5 zGqTj{Bp0_85Qb=3N_i5b#|dO{fkJ94617a+w#Yr~5gz*tPLl6jWC5p{&&wbxuJ$qt zpYL6Ga0b5?j$AQJG6@K5&|WXUc=(e-4*;+thWT|qO*s1QGd zi)xj-T4`<=*bhmok{KkaZ1D7&_>qsQJ`=MVBIyn%K$u&YlCSGDXNts39R?1I9PG5L zA`>PUrBLIvim!o~w^6T$jf5Qm^`t_CvgTeu61gkC8`%9g4hj1ZLWC#ke~_{ZS)OJn za!|tj$FV< zpaws>HR?#OloY0jiDjD#0|Cm@AsW2Viv3*&$80K&7iwBwKuL*fxo%S=2m`5AF<(Ya zh!FrRiffUoprIEa556l@ps>dcLy(HuB6K6}6%AyFzNpmNItg;E^QX(_he+2(W#s;> z8aYU6l84*#o(J=Wv-2(WS?RdjVKAM7XBO}2=qefgHo%yrRGAe^{1xfXS(4O(s^%Tx z45X?+O^R{1IK$HK@`wca;7b6FBoNW$>es2fu%(PB!Ca3l*WA{-^_akf<*D;~9QN!; zz$_{RoJ6kExWp~SK5B~57{|ESX&m-^Mt+MR+Ek)~ECe43V!gd1n@6NzH4CQTP-;N% z6{YAOQ_%8BMR;K`${7ZsPyj7)H>&*GFztZ>>w_8vn8HR3N*vCk3LdD`+*NW~A9PGp zUqB=VrU*<7S~5n;l4Z}uwQ_R6SObhiwSjFv^czcyg%rYo)nxu4dNwg?G{9^Z-vD!B z5H?$}a$QAEfnj#;Ug^X@z9qb78mUV~<$nJjY|%JXytnGaJjodS77-90zzj*I>Vqbj zWyR$*3ta+_ry3b5ap#t@1X*8<6uzg;Y?cg!I)T@-Usd zGIY8up?1re{5VF=#~En$0~IBSVG{ZU=p%%cvX1QUZcv)MC%>w5dWQX=c22EC{6I?m zT?!J*yZ4=X7jdz5zVCGS5ozi+PEA|`2SFi5KZFw4w6+gbW^YDYQDy3ICTZ**vz{8X z1IKT}D0Za;qAVTK6&);F&q<$Q(q0 z0NJeT{f&&b8sR``f-9G(TbXQ^j2g&XahS=elH2HT&&$rT!+Py+_`>kD45Tq}Q{M;N zEPAA=ow9U5c<#w>#9fCQHiL5=zvt(!)Hl37Ck*OO+xW|m&*caotMqt-xcnR^7#gW7 z&l_|lIFp>&mI_@jTFSUEk4cd+ZXHw%a5+*F@)MqaMP!vmy{ ze-?fbz>N)+F1|l*K|PkqQ_-nuV z%Voa$%f%NlOS*V2CbgC3VM~MSX^xTdglCIx+;|G{pDQk-3h@U`EYY7LWL+ijwPMy3 z(WKt;MfO~DM0kxTfURIVvx;hjKDeBINrI1p!}4>5D;g|i?Z324G&qrL;zOnf0Hdi< zC0h@>2UC<7PmO-$O%IE$$8TsNFU6KWse~JuaaA2L5P46odXgz8GN(pR{(E74CKcT0 zKzps=C0%=w0&-PGSX+`fRTRN?tjr%lI?_F2DGHZA6%zFm5g84`l*CMUDwBh6a7V*T zXv}kY)V3mhodSBYBslCo1!-cv=vtV+8rOq6IFQE@CHTyze`oif!E;51j z$zgFHK&Gxuh7mMxN*EL3F=}0Y6ZtMsI5lM~v2DORM10uq9CP!k~&pln{r}+5Q~vS(o}AyJ4#X?l?y7Y40Yq)ucmORXl_D1DZ6Exde!<^ zdF5c1h(&N_^?GC7GY_%CUASoO((3X0ozhU%iWr#mym7Ed6UuAE=HA8k->}7c~d7k*z9Tx>GKBK9UL_Z1@!=L_9?QLq$C#rjy9lDx>zW) zxhAK9VN8=X9x^>wM%fQ&O{iNDbI(EjWG?4R+?b7SA}lzF-ePvD6ar!emnZLq18s^) zYx+1t4J64n)CIOgGwieGP;P%XFiFfeJ@F(@_~Z(!$%^U?n@vOwNxtFpIP7yT$yuoR{!<-2)c>`6#4R zHTup5auZ1^-<*&z&WFz!=TY1(G>FPj804HPNMl~nF6I$eeIxn=zrzdFfE^a*Yl;Z( zB^+vs?cAG>k7n~kZx5nlbM)w`N496^4HgKmjGt7}#Ol*6L2^!`vi2iIr)c0Yy{ukE z4@gp49ENUm^`kkFgw zvGEp(WG=0?ScY-^p^Xx>0K_vhmaTbuVThiN7+ae#W{XaTzWSX8QBCE-ByqwAy=mn87N8M8a_N zlin485>cYLrX!Ljmfk`0!Y+pjy0(qq#)@OYD|V)xQ-(+O?2AGMt(L-S*v$E;IEDg( zU7r^YQtp@lfwX+q%JWO5>Z?$$m_8&)ZK{Tmq9d|U#_=PHrvyoh;eM$@J%6a#l1m?= zqI+{pwzAAw2F)YYtnTA_)hZ=z?Rbb3bxnk3#~Rj2tbk9#y`TkEOMQ8aVmIZloF;F1 z;#o^h`4(*^lRmj!j z@9QTI?~mV~%V4k7;vX&x2#9vLSX4#8vu`R=aD?$0sxYC9w%oYxn;V)IWAHuU3perE z2pJd9_$r;!3vuo&x@(SbQcp*;i^p*p9~gYPhMXAfacr zj0&zvr}RB6wIxmb<|tOOB2n;^kpkSj>JGd8zG5K!A{7r?v8q0MlA|Q<*Z+0cNr>8D zYia1gu^^hwk%da0^#6J8`SpWmm~ij z)3@ZZVTvB64=nU|d?oHdW%26IVn806h**kKwcNwXR)@|uVa<2~KrK6*dh zuNM%K7r!fHVO&*NEb#nerLYH2kU6Ryt9ne1Qr#4mfMOz>@1eCn<9-iNJZB)fA2CN5 z!0pW_r(r@(5;z)a9ZpcKij8v<2#G*xu1rW(*l0G5DL3SyNE?}Q-{m4zqwzA$REVI% zz)Mp!iK?W6COKQjLWML1$o43zXa9=dU($~6%a{9I2bvb_}m=D`~=vC_zD&hHX z{)`+9J$;1BpDdM=MG^>O)x|h~W;|Eh+LV~w9_pmW5pe&eV4JHPA@p3gZrDp8Xfz{H zfu>__502O<7gd2XqNe_W9d$|SP<0{Ly}j>>39>Ve>-&C3iv^g6l}S`PX9JHz8II^3 zV<-!Koe^Kquv9}Eq>4z+B&#CNiNB3j4H=-`CH0V+(- z3I*x`2}@!rzv8t{*2OoiH`l3z+mIg5!l
=1A~jJ@<=K_HxfH(CASP0-P>!$FrZ zU?lcia4u>Z$4e@mc6=6!9Z+{kymozwcNQFTE{^_96jmk8b+xAm8hcaB1Qtu5LZ`LLHU z5p{36M<8Uc)w@4xlXjqXzuhyW+)m}mt%;H6SCH~7ZbaTdQ+H>k)gEipd2X4|wf zzp{&wqq0Yu+jy>p+PBxBd&8nsRqv)64Sk0LRXwb#=4{k%U1?rg8Ok+YR5|*QL<656 z#ZF!b;YPm1_T8Wf02LZ|W|u4#Q-^O-ui}rvSt(Ci5m?MLHgYA|=ioWjO}uDqyCOSB ze%Tz6lx<_G(^@RBb@CO?=w{%v5OF)i#!I`rU2Lo@%<{Cr{1Lm5wL;6NAOEnFZbtBJ zP7I}EryEf07QDTvr;=YCm;qj?Kd0zj?%+am!7T!6F_7#ISAlJi<@rZ`+!I!!jM6^OQA07ef!1oLU zCmdvKI6up@o{0m)2O^${N-*R^=!y9Q%G?K|;jrR#D{dG=q>ef1jlV}@dmjYtSrM-` zBN!cxQ3C>b>-g>nW)^E*XGZ54Ku1CBaVo1RK2KK}NS;bZ&m7aW`}bbMj#Qnuorr|X zKUzePy?7)M#;hO;h*o%(=V&M@L>QssO6N%fuVs*x%tdfJfb&f^6kMpedrlf=zj^Z24Ec&Z9;;HqD?CY&zrH)}g|x zUmje%J9Bw|VWFDf*U8Suj=83lnJ=f<_F2B8J2Y4kl+D|?ycIZ7`1O|{gH;$QZM4V2 zfL}~ys22MS1k4(x3HXR%b@F%RvQZL|iT$xvab+QGL4er>$L!ZrvMkJUFEqhY*U1sQ zW3ih8VE#b-T4erpE}Hde;gsF_k+Iict6>N5C2+#igS^e%mX%KSx>AAK3MNV0zE?6u zqc>L3icKZNks-*r= z8EESEo>R4so)+;n^JOC4(eP;;8NE8O~5X52st4;eIwDZ%*p8uab z{Qno<{ZIP+AN3tGE6e{&)Bi2dV*XzVw5BvS>~O}A{t56|V!(Jn2j^U7w&Vk^WOoT0 z*njnVCIA<3+9WpR!nk{h=>Wfho+y9DSDa65N~~F%5&-i`5PNrCIGrz6Ku}0(MhXwyNQWW!)vogcoYmX8 z`1HjBWiaH`)bOK-Q(c>^dhfdd`hkEa1#{QHXBp&wAv($bC)u`e##u zd@hhai)-7)imtSWVs9p5jf`-YSxGejVplOB>$e&vojatBd)3yx3LpA9TbskmB$I?Xh(KpL#`*2Y%YsFm{LlxvGa6X zs_^TH($o>QAoz&ONIdt6$at~k?Uz#oqSiJW&qr~;iuUE1ZaNNJ7f+O8rzVp?ZQpL- zL7uzrz(#j%1SrP)<2VXvm&-|dQRGS3_h^BYa~|&{-2t5=3dig|-3^?i4*k7_2@(KH zLkZ<92MEa{IZk1;P$P9S7LcxjMcD9*Js>o^GcbE2;!t%t0{PoT*dhD(gB>3E>0WB0g|GN4tL5cs^o3aps85a%|(HGnkn51*QQLRI;Y;-9P~cP<**= zBX6CXkRH-)&DTge%inhK5$gYY&nL(HRgAzbvVnB3t2(l~ix(C6nm&|ha zsakN0;Ysy5@%!DmuP7?TQ}IwqK(B3AIxa4MVPC=g8dyr5jX4?)Bbb4`TJ=CFA4pgWFW@#m<{4#`|DIyZwfCts^>B7E12C$> zy~2@RUZ^Pfj)Pe`VXB)va9=`IzA9VZqGJy}RjR7?B1nb{opRZgq+TU*zzX*Q0I0HpC7FxA4LD7RN z*Pb7s-Adq<0S)GfBBv0`d{kPh_vu9=WWsy~lY64!v_^WR8qS9DPZ)+`eQmvJWd6N! z@Xh&TnMIIatj!j*=H?|ZP}5R{xc+yyGaY{MofSq^gfh5$265il= zka?k|kHt{PX2V5u^hkopuWC^yi(VG2hO|%J>d^YLr)~E}^m0;k@9$o%N%;@Ojm&i$~YR3MD&N*wx6rQmgdG! zs4x9AYgw|!c+)x*edGb`39#_Vs?wdo_@QQ6?n=Jy|MV4hl$X@nzFxq0e@u$0@TXL; zhc5e38wseBfGgJwiq+VAQ3`>Ny=FT}fm;|KK}Mk8DS39@Sz_b~PyhHKt^w2UU3 zXwzp<9T>Z|4TkiU#h(wP40T?ab^~wHR%o_c2LR79WiwBzl^^1P%`{$%b~na?0me-5 zlVHs33Ba2KW8kG)D<VFGu1#j5Z)K$!BlbHb{KkAeL$b@G?$&l${9D z4DPGe-yK8q)bh9KrU+HeqRr<(F9Z{p!gVJ5U~we`xqWp-L6Mq}EH9cmAsTw8si8;J zjBltqT~~}z=eMP*wRBe!HejhW!NBwNm$2^_qjhGe-*%ij&X=0lVUYlQ#~T;nm4CGR zJwh>~4qSNj452+3vA&dMr$B&k-&V)xu4W~TEXRFdGE{zJXDO25(EJWkSDNEjBpaa= z8;VJ?C;%TE#Si%q!)Qfl(!-7y)0Rlq`Yz-@2Fq{)H0z@0DgwC602Y>SNqg!0p>nB~ zc-7Qlg0(e9gCuZ75*BabpjR|+K$N1t^u>XF103=`7G=Q$eX2)T1R>70(X@$Qo(7#f z7IApj;|OBGPmNOYPQgamRJVlG$Z-|``&gye-@3*c^urf&zzdxQR4_=wTM_u9IL>y;sHCqED^U~PWo2K3Hb9~4+vz| zE3S1{Odzuy;P~F~{+$)9jNoDGnML}$cL55G7l`rlrnb%wvmgXh;0OnMXJt|zpSrwb zg@-t<^k-M&O#iU=VHmOuRpnX1fq^Lp$W?}IqswJSL}77R1AjT1=~F~$m1S+1vR`iiMX}SrsG2?b??;;kC$SdM-{UnW zl`Cf#5oc%rPMKFP&g4mPc&6dYpjM%d-I>NX`Tm6N77@>W_>{NPlL-X(zK8}^y272Kbh4bA$W`_Cihn= z%9D{piG$=f9iUWX3JqL2f^Dg@x1gkNsDnf_oqavkxDwGLgzoq54Z*L*kXzU{Ec5rU zZ$qzm09hdr1x(3~pzAZEd=Wle%p8kh9OCOUVVOZ322EGy${jLM=P- z7eoBJCx2h`m4yEbM*j~y{tt|1V(0vSFq)b9zxo`QS^hVD4qIBX&Ij#Ce?HWATUEyU z0lOHd+Gb|TEfrg9CLRaeD*f8_x0J`7ds|uLx;~EXg;v} z@yz!Ja_Ss`6X{W;tpn*;4j%qAoj$^T3QKya9H#}gK?BXrdCx{o)wFJaldlL*QcO4! zCIpnO*V*O!VYGG?{D|!_na|Oyk$Ex zFSTXkaC8&9Yx(M4EHD|(REjs$Q|TlXT{|_Wm@>yWVn9+a(x$&1KTe>WbWB)|9TGyu zVOD8fYvuli5}qK%7GeM>$z(YNenJtkgZ;i_2~p}Pzts zhSFGllNbs0-YFqOU+=IfEMB-BzH7RJw6YbDcs%+cI1s~s0d3n!Fy&Cq*T0H}l{4eY zw>;}@RsH^2n-ONkjPT6n@n@_dWc*eF@Bcu)J0MgwzJ$gmn?DR>f0oIlY@`cgF=!2? z!it6{;kEF=oP#|fQWEmQ+8vooLS>No&}^5rYJJ;qk2n+}NtZ6vYP8->L0`TBQ=Bj@ z+DJpC)y$=Cp>F3uLXYRv^TRYh0lz9ws9&dCgkB?Ix?Bz5rm_I&n+b-r_jeCTTYusI^4UnLrh8#wB_$BCvt=dAJ zr`;XEo+2&>v4=rUyD32|wSB%6Lo&|EqQgvX=oDt%FW_ zYx5$K#{^a_pEMP}E|=;kKNzgNkdr$O)=-?i#QNDwD-I?`+T7BY56>;- z;4zh2o7sPw>O{HdgeO=73+N}`r|F=eFCU3xXg3nnn)UY3g!1t?{DqRQQz=^MuNFG3 zA4SU^KL#;}igR#RU{;KSwp>A-kSCNqy@;c;p_1GZ5Tm>60+0hCEC)}TM3Y~rSdEN5 zXjwc2o!_*gqxJp4qy&}6_keeja12|eg)4oJlGbxW2s9r$**OjY?20YWTny(yUk{O2 zl10(v%d0U&*8qqsPH34GQLAnYeLZD!<7Grv3G0^Y~8}OW81cE+v(W0ZQHi(q+{E*ZQE8SIlcB< zXPvNU?8}qp64)nLA^~>0Cul^<st@Wmb`#C)D9 z+>PSJJuRNICubr+P+!H%t#T|Kw2om}Da5E7nC`E7LCR9JQ406J+R6zN`v>e(aM4qs%<`X||S0IUg0jdBqnY$mNire!%vZ zxK(7cTmctO8z9RHcR?H0ERRHh-p3!e)3^62!~uZ4e8-45L8vW{-&vNPV)HZI0C6Ou;tRW;$W8ROtrb zIC*f2(S<@B3=TC4f!H;HDfZKyhhSg^2L1v2x$ogNk-OW?=e_RiXYRXP3R&x+{>2d& zMs}w=)H}N7PsKR>EneTRz2Wrf<3xJ5Lg{+02GhW!E`RXM+_Z{%57R#`WkdJUm=5h# z_QHc0$7D>A&L6?5r<}Be0ys;&+~)6fiwsP@ZBvTwGvGGSqfHcDqU++5fuoQSvdD#d z6-t~C2Z%le^zQJoH!-D_5tc#=^7_(4-Ga3+eawRpi!P!^fu>)tmLFR0lHD%U*9v(? zZLk01D28dMMXsM^_-FIRS=amKJx*2EsJH34@C=Jy+i7z*weR<67n;!J#n8j}#6nsi zN2#H=n}l-N48atie}&&JBFEYN;TTTDw+vbr!Ne~fPz8@5j?GfE*~`PH{1R-ehzS+BHKIYdiy(gb4lL!XF7_@cdGVF2g0cXI zm+wQ~1{F^6g;A7SX?nJ6#pV+)oBeF(pVpIFY>=o#b^@Ifok`FDP^oDj^jo6?{m~e5 zRe~0s?j7?k?UoH_@f3M-R00!(Gyx}dnld(|>LEWg)^p-MtEBP7Yc2hLl~EFR+c z;{)-^Lh{mjA-VW|3J`l{vfqO{@7>@V;B)|IvDMwSI%w3upf4vxxN3E+T-4i5yu7lu zDgAaYOzYiK_iTboccSr&iAK92f+hR&OV$Q8Ja{xVIPjPV#a_USHl<~Ku?V}<*rEG+ zKk@sw-qNUogP34KF!~^NdP%PgPL&eB2yylV$?^+hf`+nRHa9DK2Uh(64e=ZO{|)m0 z0Q!GGo|EbSfjs-aL7wA(0r?!w|4&G>`j3z%hGPWg#y9GkV?Nc$!)ExCz@}UP38@|o z5DcKiyjSoY<>xRr7uuGjNIj)mMid98!%H^rA16)5B&gFl{^RZO$&g7ad2b%XvzqC5 z^H$v|I=PdkOFfUrJ7pn0ovrMXaG+?SXwNJi8@a3td*>THTYpEemoCz$x$Mi` zQqY=Bc3CLyG)!^4n>032x&*-*jISk=ym`~z@hjR~%PrHD4F#$Z0sm;qn>a&M6F+y6m4H1oqaRVfby?L?1>(>qpkuL=gS{lpOo~%1-uWcx7 zk!dqNx+pX@o7Rn_*y{}&)^0W z;I+bdm8*Wz;B3QaWZELRfss4IUGyak4P6Er8FZ1>!xatg`tPt-tC&`JSm~oH7K7fZ z%hpQEn7NgWCnlXWjn2z;OGDyRT0DgI&TKGl!rUTT#5DA0I!8}L#NNLJrg`Bv+ah@R zLN2Au?)xe-AhNmp6hT!wYjb@39Pi_#PJv2m8nQ3}4muJ}i#rQV+?X*rEb1rsvONv$ z-Rt*q8IQ?mGbsU(ZisQGfcQi^?u78(ecHm*XYC9QrH5o)byzkpRalkG;f+pvc)(oy zlTQ74;o5Qhw~u?UFT-8x%*aS2uj13nu14kX^?cnYFRY`O!FrSlc>9gmTL|tQ06>rg zZotTG``64}*AGCjO5>xFCMQctX<`J0tsvw(t7mXO183y-F@>FS9a?A>yn|@%XDGdZ zf3tcFYTN>oo>AIt8B>u0`Ha-jSBH@;WynCQg{X&0Nb|Z>N^ZPi=G?Gs@1* z;}Afj%7|-3O0d6q=%8ZPket&ro8aLI{Yg=gnxDuDWdIOpS_?alTp*{s_DGyO;;1a* zc~3A?pwp2F`PftKEQt+9m$3KaF(e2xR8c;MO07~)Xwhg_7B6MyglfZx{{SXja~?!1(V z^yU}S0E`=QqKF!^m(Y-)Mm-=jGAKa5r_;}Dk3})Sv83sK(5=$4R zp%5k8Cl)$Sd|J?G!RdcM(kZ;1l5}y0KD%9s7_CyLw4`8lE|eHXf!u>nKo;dmHzdCb zS@k4=3&jR(4LF2>-K=ntZZeikDGFBD}xtumHcx#U( zM+WPqWmq!sBHKHZ$=FhCIeEY+au%Nd6C>2sS2#g)(%MJ;ss;fINaNv#;;*Fxj&qqf z*ur>Hc2#wApSpy5!RHQ9ytGlLGym3i`a4q>l31;@JOXb5{L z_U2T5Q4kD9S*g3d>O)la>Y!VPYljjF^UgzC_g|q!h5htZ`?=LR%E~Wxs94T7 zCI&Crou|?7pUcl@C{50rIZQ;#)c-LW&9vK5I&_fA`1uf2G0jq_V39)keRR8IdJMB{ zq5{Q&_nQKrCkmw0>qbw0S;@wJuLzJAOn~>4(4?+Y1tS-L5hVErlgYhzz)8WD4H^X`$?0QOHxZ@#T%N-z1j^iock_S(zM*qSAAmW3wiU z2CsZ)lLfqS=}~u1WYZ-S>F;&Z$v=!*8P<6(4onhl$$rqLhu;0~o=L%gw8JlB@56OM z9X{U!kmp%I;Q*dVlv)WT;KGBYJA(t{UAM=VQ3j!2wsX@&IVYFyRfH%MSK$W*kAjtA zeq(}8@G#iJ!Uydfu0oqs^jb{wnr3Fd-1q832MIC@iU#Mc^4s5ikAkJG^RsqC{b4?R zpIaMSKYd#94ab?=9PuxKgR2I{r5 zT0kE(dgQVJMwOK7OY>n{3}EnE0LU}fxCqf%f8MBHhq83lcjy~Fb5VTk_w3UrMj*<1 z`ULkD=>9PcbH3m%<T>t&Pb+oXCuezLE`lZtACk2|F4jj0ym2;-_be z#{|6db!}1eGu=6Lts!kD%=6`qetAc`gK>XE=)tD67;z)XogrP!U>STJmdd4`m#Mn= zWdpwOTr1&KQJRPqB`Xb%Kg)ygLhXu^eOf?kaJ;63*ovhPeq4)XLw^6ky(^!oQ!Hoi z?LEj;lrGr<$&jESLQte!@A(k)a=BG`G+lZ+pvIef9mXf74q7~`IxK5g_5Rtb#GFcs z6?jhFD7ab4L`9SPBLF7IM=*p`O(r`H*onJ3=tRZdOn+|^KP>u3(utJ z>F^3&#?xTzOIBXimUs^SIplWc`|Q@C-2ZbU|HD~=uW&URIO}uAM8WKQRqR!kA4IEJ4VvW){vy6JSIsXQqciuj%SfFN1R()E# zipr`Zmjp{gT$#1>?_UKfh>3dN+uO>yy=rQM;VVS+4=;etB|43HyS~};IwjOXVOcz_ zyQov=!XX76oa{7`?BQf@SV6SzF(cJS+tG#gMm_bHDi32?AWpi}tq29`-3)`Lsx^NvlC>|VOy zUsoO<;!nD0?htu4!xh4+rfwkOA|dx~*Pxzmp)D7F>Y8vd2SozFy20UNX6fX0w|_^c zRiiK0WSdJTPv6`i%ciqsV8p~%$CRl*iM+XReY>G;`%nX z;?uuG(6Ln!qd6+n@Y7}n*_2@8IqAO?#LVD>GXlD0huT4)y@GT{JkpAi7I=*Gq!(&` z0!#gvC-nK-R*91M1T;3>+>8*pi5K}|krFbQj1t}vMjp+Zwy~c$2l=S26skIB#o3-0HJyt6^X?1yd6Nf(v)!{V5zx5^)It%DKWq2%sSU!XGgJ18=GkjgH zOdIIVwD@VfHwlcMQ-}$Z05eL`rNu4iNw5&Vb5!{^ znF|A^3&;g@6W;@P1^k9Lds9-%=@MR^CWIB@GL90mIn%1&>B;Y3#->fyH={wtCGdP1 zUrkD$bzxqOoC8rC*c^6xjkEcoG7|z%Tchw1#p8j<<&SUY2S<8ur$3jcEMNa#+y7a| z|5@9aIhh&$Z;XwF@n35@3)BCywjZZ$+HSESgxE-o~qqbGu4hG?A~#daAt*gtC%^G4K9i{u2#R8lIka`DrNC{eCQ zs9yCXz(`BBud)O;qY zt}l<&4tW+JlwTvxMk6D&Y`~PGpH1D+`4@9I)BRt7_en>4Ks_7Zlnq zs${Qv!h?nY^I`1yz$6DV3*+#@0g7}t^b;p~4MXDT2Vk{%fx*LwFWnPh63D$l;z8gi zPE$H5VEOCon97;#Zsq#}&sR{f%Z+nH<%=B2nPgLQaY@tm37^b|yp)C9I*pMf4KAzQ z+ZPTQ{6@)wk{BJd<--(-gLm-dgUeSE)5x6wSxU;gNHKWiK=}LBT*sdWry|Bi1`R2Y zy%@Ad4HRzNiwE}v2@?b(abeQW_xGAY-J_;(8a~PQ$YcwKaT4^4M4>EQ*z4P43igb8 zF)j!j{lErI&O-`g@VCZWuum`1p+GD8L{ZvUeXMSsu{^RDkof~yJRYPUh%N0-ox}2* z<^kNfcSY2!`4&EeA*5oLR;q_P8^sK*?A9j_lNVUS7{K>*9q)C&P8I2N)q%w*djH(3f&qs+<~ z3N8LzR2n^l=XSqu-Z3ZD1Q;#36XDj{bOR9A{r;C8f($8#UNn;9}-jw|Qw zE)pLxgXtaP@s5WEihq6o=LG4GH9WFJzGI_DFB#^_lDL#qJYEoENat_Mr0lP9P?l2k z*!fDG{2+*tPeOZFH$6cgMAjDZv;K+F<3j9u`9w2@z0I|qT4s0K4C@Rv%!^&UFP2bC zoppB5Lm+TN9Oe*QY5-{E+DSG!1$1Cwh~OEUEY@wcOSRtNJ#?p}JQ?YGq+zms0R2WW zpY>|}R+n=_s&ZU#%ILhp-a8*=B4e5{d88_A>eY@F^TfQJ?UJwC*3K3nvbh*GUcp;( zEF#KaZxYZzp|BP+Y_9qGr@{!0lvy#l}Z*NFPh==oxF(~i3uY~R3^{XH#Q;l0JTb%_Ko}B&kUY};~ zAkYf*&*fgDA0t5FlSUzJzC&&hPwf$9q-jxylNz!0=tU+aJ0k+^f^Ityj**3H%I4LS z104w+vKj0Zh%}|62WU<_&#%b5cW@C-G+aAnb>f2Qg3dOF+Su2=P`)Wd3)tuU5jTyh z)0ZKt?0QS6WcMP`sdFs~2-&g@*m^fznX1sFs0Ap0#m8F^E}GyuXfxo-MQvlIHP8@d zhN9JL|B87<@AXUfjrHA}i%KMG#zqSMXd*-+wSbMBWd?jRQHcVjfc)!iAtXo*sW1jJ z8M#-}kR&xsnE?8gQQ|;#;TDf1xC2;gg;}NziO>d&uCFoPrP3MD)xXDVs8D<8N}BxJ zm&6Wy=+%0I6Wd_}Ru&}0erjZ~<``iY-jk_XAP9wV0;3m&2c31j!KP3%$&z1>lzX1{h{g#^AD&>anl#r(q;p=!?Z&aInR4d$vn zTvw(c4ef+b(N^SQl%R&C-y@9X%Tl3Co zOVYCEVI{4Y3OO6|ZpjerK)zBd+UJ8#2GQn>d)&UHpVZtU2fdDx^51q}Fd;0gMvPZg z6R4dxG&UICgX7d53UuS15jD>K+m?-mwWIPW^_Lnls*Q?waqvcd{y_t={(Hv)1S{3W zyCWmj*2@!Ejahi@+O*iPW~~u(nrOw5s~k6E<6BJ@vB_Fu1O0j7P891Y>6l5`!d0g7 z_+ka#ncJTjI1c2Uplej!tr>UEAJQZNn;1x8tYLI(?so}1tRVC4Z+bNu3zzOvAAx8EWJx0Ei3j7~AP6Vk>JJBpH|YVZ-R zCtpve-)r1XFdoDoF+rXncJSmw9z z2dtYd{LVR<47TqOR2$`5{o6HoyYGrR5P2S{MZ7*UE`zj8EgmoBb?vZ0!^Cv~EKUf-|@So-YO{;tyfWZ$@MG@InnH&upSW=lHaTPw$> z#l$l^y3KWtm#`fsfb@HZ$IGk)w!xDfK(6-ZJKStP_!35*_`+Tslkkf?1OaYHlB4rx zk1DD7e(hK-$HE4$YN3F(w?_|0IGVY9(;wpiQdd~yy>Nad3z|oT@`D{N5BBwks?0~y za#;B|u6qE@l5MuSl$1Mvjle9=)`K{%7&43E;LLf>w*yaE-0r^OVMdi9%-c)FONQx` zBUeDShayKf-iCI|EID^ zNs5%+CIigq?KcX~26$y6&HMc3hI1cS(QMo+0R%+Anat&R0ysr~--^8={aNOJy{?;|HWbSbJf;A!$E zw#)6+L1yw~8Py%0%??C?uZ***GqZ1%!x1|Kb3?x|eT~%(y(MWiTY_=>NzblPF zb8Mq5*TJvDMCvGj((VC`GtEIO3u#y~1>!)XIzq@K{kYw6N&pSd;GA>K&6gKD%u#E= z7TwRZ1xs+q;?&Wkvt!Atv1_#nNe2DO_awAeeCtLzHl zIQPwhX?%#H`@w}}8>Z5CWdMMg=_Fg$L#j1(oGX-5LOaCIzVROg0neH+kN<8e57a)| zj{*p`$zFayAgQOLpmwT$(ZDSVaQDw{=`#n_@R@m3_k%>-71hSZn{~I5F;Yk#W#L}W z9uH(gNvuLXK#K`I)p#l&@B!Xp!TG1kzsV*0%H3+j+~*uEppaCU+~bQ+Vv$kL*~+z6 zR0=L%+*d<}xXtGF1o6*0hMcuG(cscv7|blslshREL5XR%e7R5p!|+lEAe?iqBzX@S zb7(X|i=adNSaW%2i4}1yYjqLk3>HS(d{H&rw4KHwpI>D(@OFN^$_Xt9bYnCg!a4l;bbW*k~xH z>fM?%-2Ll4`p^6E4@$7Ju>W6@VEuR4l=XiKn=Wgt|GhK??Qdu6 ziCCS~c`ioBZikGO`B%1xcT$-;!5k4I&>RCmriBO^*E zmjF<@9Ft49bxTamB}bf5_s5r$!3VucKWUb|*zq>BAHsqCUsRyk9ZabTH77o7oQ_RYvC1c=|P z;4Ui#+Po3yHL&#VRc6-)OEs}?f~PbP4=MTF#I#8MZFztQ&!`rz3c`wi0K;8Adp~_r zc@svPEcaTT_~&|%ixK(|78sl{*^QqC_%IcbOT9M~4wOc3d0!~VYL5EPCa9uvJ#jJt zxb4l)KzY~Ep0Daew~Iv5MMaqe)d$cSSYh1Fc}gP)Tr$%#2`4k7PdB0g= z92fWbk{bx4;T)Y&%A%j|jTG{{s>cb~Xj%4MlA#^diBf5)VPN82*CGrVc%OJpJTx2AX6pXisA)?5vWSnS@ zRP7LortHoa<~(uyl_Rv-4%FF6@m)Nbcg3=w2q*ruWQJR4!|=Q^%|el2zq!VpYWS4& zyCjAQ7z(0Ggy}?{wH-}ymOXMDd?SeCMhkYMmBXmwQ5U@xl)$Tuo(kS-qcxq=*n=}A zHU(N6V>G4PfH|Ln@7acF1pw@^d1he0`8*Y-E*Xw%8)aR707i|Ua9|_#!)AzWzssieJ;ERjCDzzC5Vcng6~kQ;O|@72@|FmK zzR)3PT5Ae0UsenMRHi<6l2XHlFF=MFE#G#<(Z^7NDK5N`21V1?0j!onEbGH3g`{%k z1;(kEScvLjei;@fbipH9juB?GLzc)ROoH_^>_S)cqq!Nm=9?|LIM;kltYy|3o~zN zu*oq&?j|PTO=IQKGB3g|TU?hWU5>aoqb(hPh~w@l6-Vn-Qpg1EacMtRqBM?)>-&l7fC=`ny;1wsITK zYpW+8hnBZR{ExXQ=!IIO;4{|ZdXK^ztcLcbWHo(n`s9k{c0F$qp9Whwjj~-P1s=_z z5!?=@-%m)FAh7y|{$3(+kKM&jz`g(%6gJznI@q5s~+Hi^GuZ%!}<=7rv zY?)^C$D!c^PGw!r-kJxaE?<0;=JYUbG5AqDYXS8?O|w|eiyefmA;~3JcYKyr&&(PO zjXFAds}~=y<~Z{T9`37U~IsH6YdhfZf(t;MFFHSVY zkP_w#+GAfO3zHNlyK49P;4DvXjPPu11$R8~Em7-!Gr%}j@5mtg!QgHrK%YOsVbrq? z-w3c&;(03*{+1sX0i4+{{m&ROJ3~)^8Msa-?tbla9*`!dmqL>ocs?3(7lJy49eOy_ zH@ZXMPMaxG^Z9zT&9_jSX{E?WZAH56I1T_fI~>_?rNE=(Wc%xu)b1@05vHv*ohHL4 zVt>e+ULGSC7UmuF$9cZAEl_XPbup$%2B#`$G*F?Z!-o&~Hnam#Gp;;lb7^YjZkWl%Hs|qM$|z z93Du|;US`(FvoxLbANrt|7DYZ=jT}er~F*=-#+;k2hv~d z#~rO@-*kA#q}_}ul5xVOw5KcnRfwS5qK(XwqPXJbJ^!293H~XHq-3(S99@to!rKCp z29L|d66FWL4K|?yYq&42-GcbFeZIrFg^v?JNft2T&fptKiRk_b~*&tJWI(TrM98FQ* zsliaHL1Etds?6#FGhmzy!k4CCA8^8{Yjx5Jq!5Y6j$I*_s@^nPKU#gv_mr2GT~sp- z{Zug!_o9U0fGCF102Zb!ld)?HcO$Eu4wk)#STZMagrdr4An3uiDLt zZD+e4ceVhuc)Dp>h^DIJlLN)n2F=P71%KpSnU!7ODch7kQ&=t~SRtT@8!!(%2ZmEC zS{r{t8rvJKu5K(DXN2)001xF%rMLhu@eMux36Jl2-hX%ElC^Fhg=J<@%E(`|x=zbW~0wbSBO33Cw+ zxGfBiNm`_Mz{1=nMcHbsKTSo;6iOfsVNg*cJN$LwJ5x%fc;{u3Y&h`fT)%lhNF#)Z0b<3 z(b++$5e4<91`w6=;{>o~9d#&A;V0N;uU-XA)!8{8rCLXocd+cos-ro+w`YpqZn7R? zS&^RkD!_T}Fw2EYC(_Dy$f{zq#oB{ksGoTob*P85kRsJ;!YtXGhH*TipYXmXIciFJ zuS!ZQIZ%ZRY)7IAVmZjrQdN6KfOG$As9w1=b)wFK?OQR-am0uVc7B8mHP|M29>kw7 z2cK_Gd8=?Wm;g)9ZqvoSiBjh&JhceVo|y*mthr6TwxZq!*rxhi+s>$9`^4h0Vtwuq z)1?gzKO`x4>owiXG*`!e@{&`t<$9wVYYY1DY9IV0XRf~AHoF6!se%Ms1vX7rv{>&c zhn;_z>ZD{FI>>2I;DZV7w!Fao)K5g~R}bYS`|vt9N%!5SR_I6Q4j+|rJA(F z;`hfM{Hu~X5Wfp?*-6NAus4t|C6IVt;3lQc*$KUdpY9PeX3Zz{-p7?3z@C;xJm$GU zFI`1O#v}#hb%>M?hl+gs+o}-ut`M@KBYpg+8?@CtC%LPkrnTo9#g1SK)3gV(WQmlv zQPHADzjL;pS1rJLK9*;(EUU2HgEZKNwpI}k=H!0WwJ?ROcmi`V;M3=jTSk4I;4tMZ zT4RJ{p_Zo*7@iMhAO$v?b@}{Ej~#k;>FxCxpH6RpA?($-U~6-_6;`r_hVb!dm7r+g zc#S>PVVrQsgP&VyFLheZPh^~6KNo#c)qEj|AdRq!jvAjsJypmvPDm#qrd=LM?^b1H zPijUA$c~LXrAaXvR5Z)~BT-A;SApEqCGLkpTu?j3=xgc3+8bvwt0EWQy=_&W*(&-Ufo*)| zO+&$uoU4=ezP8Dt9`)I-$iU^$&JQQD2z$_Zb8Gl8Lt)0h>2OmpjAQ;5zHiqfL>?I? zw#%&}P`EAw7Z;wrCD(=kYIYcC;@pqJ-$7hElhrdi7i)fie#o2465vk`+fC`-8rsI( zRx3d7;8$os&!~t6RRU8Fg=ioy)p&$y=w;)4D)V8OVy5$CH4}_ zNqG6hR#$Cr@$e2FWy|hWV>x3G&*Yk0-gS{akA=h}k0f=-FFqFT#(2m^NU~&Pq!<<* zWmv@!VT}V|qe)Jgv5G#A+BG2%rlX#Z2|2cG(?rsQh#7b07~D3ShFS?rc~dlqAsib1 zG-5}Z(VC;YaLx~N%M=fW({)KhvQ2;@ziegbImJPsopJPzcFsE=L--=v(-L&ZS6Ah9 zC+kw+=%5yQ^stAaaM~YaB#FIHGc?7#Ab%^O88UY-XT`D4Gq$&aD?cmY!KwPk_w;4l zw31)%H!wwBZE^QM$N2=Dv~HZh>zGZ@Vn{GPvAF3xtL&oapnUrBO)p|PcxN7Ysq9sP zp8U!^Dp$iUwLt416Q4hG`Ll(Qxc{d(KH!DYHPg>bUwC!qLDInsEpKR#8Jj#GBeuvD zUh&En#a~{lIn7+B z!tRMe#Het7lvxwKYB)4jkn9jWL$bkiT0NW+9XL2pv&?=*MH@i*F~ z4Fc$!FGUGq10y>;cmu(>yCJ;Ys`r+&$eRq8`^{|4EpqH_XD91n1-FI~NXxWqiwDXB z4OHmUyv9>-Y8arTzol77FN^|vkCKL@`9@Yw&ozYb=`yikroorFBl^h|Ts5Tci6=T2 zBAm?xhIwDg5WJY&Qd`Vzsij#0yAgOq&6joa>16Z0;)PtU$? zjWsT)d6wXxZI`1u^#O;=7@D|K*s*GI7A$JcxTndjp9sD{syTR=@u@2Tk=3M*Yhed3 zh^d`X>HBM*Ux@nd_g>%gTLgU;#1Jh+#r3E~TbTL^( z78fw0An=$WKN@Af=NQ}G`KcMsJ(*RmC<2B4-k;#{DJGg}6SZ;T5pfSyq{c8^aUA4j zMZyiey1Tn1oAfFFYDPsll>fn>e4_i@kREoo@AI_QC+9h@WNY*0%j0SA84W4x#m$!c z7HJF8Gr!@oig7+PQHWc^6|V8(yLH7S&-gTm+2QhdM@Eei#yV3Laee8~u3%D6ea6Qy*~1NxSupI!5b2*5qC|p65mw1yNln~^D69=7m8t^&|~d)`<9$gQ$|-F!YAr7f2!Bh zpf?k93R;P=eN_9 z8Z}Nte22pTXsk!@$!pS{4nlWU;VO7e2B?T=dgPc4^mXv!=4X?p?R+H(HyJnc`4-zR z{fw$KpL&fMG%p|}9OhV4>9qj8Z7QJ)le_h50>)tx3LL}8ja|t#{$XooVxUU7?PxbP zBf^pEACWcQu%{7-ug23{yEV=jv2Df`=3pmiZ2Kb4Teh*vYC5z@9SR1wLkEgd z01u2`sApmDi$BvptOXp7{nmy^BkJ$*+Q%|9{cIINitsoUEVGHYRFy>2Y%k8?m;sOF z$8aZzjek5Usg-ROkyJQ;F*!e;kjxeMFHVE!kh*bildAwDxQ9d>8C6B{7WvLT6mHaf zv^j-_RlPG>~a^O3>6BH@MKK z4%nLI^qKc8KZ|)TZ$fRCb>em`ninzakf6eRR=c2wl4z~V)qY#d7^P=@r6Hq8x_f z3+UQH(_s1}u)IE@50Tk~dxQ*$sXFoaQXvNk7!46I%W*{n9S!Ec3Df-@e+AF2v(bEW zDV5Z^8&_&mxVnFrE;seY-Iy#tQj3Hdrj`(Y0qv%k?6UfbqE7(uY1}^6xGm0XM{-V? z`tX?ejk!?HY4Ep*NANM7Siy18V}{aVt&t9&HW*Q%(q_Z0@!c?;blI;_J6$Vj_8+_(N**+oVtM9Lr>eRvGV>34vZ7gFcr{2Q~-Z6B1K? zGPX9bQ9|E>$BNkg5v-f*CVHo@z^;*pALF5?g(Ed69Q(JV8!ON{MFo$a6xNOwRxAHUoChy)&$4P}_L%P->TmwcA&19c|+cvUorpuodkt&*FZb0)NG zGNCsDdufj==Ur^&3rhq;z*C33a@<7S>*gBTtlLS* zCD{H#_aVYMmGQSi@w2ibIz{9U<}5+v`eNZMvt~v za`sDysD%c))XD+_pb5firB_!FSsfd6(j}jW!}NK5i%MT`%`tH@AC`O!*w-|)n=;&9 z8(um1Ej*1@tU+SZr2+=kZ8|4E5WNB(fID~nzA3q03TvO0Y%6TWiyv4kE%60&jQy7N zHrN`QsmasIrlwwP2~UaVdLF-mRVDqfNOcsFx{C@p5hH|}wIZ=|PxW(75QZc4 zhgv+Iq+CSE6cFZRsgBKj)D*eB$iSOKcDH6He?bak=sQd`n8xAb%ZSF$Rvtat*o=f& z0lS5U1zAxE5g_@V`%ftMldLbhTw!~^svuE->amdh5HS8%3$U&BUCT``05DIe9KN9- za5#uF{TJBk3L*`;eKCvy9X@w;S1fB_Lg|oF(#cANK-dGzDG!f!IKN#b#kPcqTG4{p zRcx#fjw87<8IvlFLFtGHR#P~PwL zYgbBLRXz3x0d~|a*BA(}97DqT&vqF`;-%F9j8kr0e5*$4k3tLlcvIzsFg0lMA{dUju~DkA145?!q)d+fShv0NKYwA zxzxIZY7Z*JhE8IP{vKG;v&xozb_qqIAt8)g)^^l&%9~2%7-<+jXGM3v9atyQ!spHjX2nGFq`7QbJ0aRr;w6u!NWpEayqW9 z?b!vyXe=Dr<9^C7_*GhiZe_B>Oh&&Tleu2j(HXbxJH6@2pYe0ZcGj{g^PQAw8Atx( zz9v>{PCU)z{V~Ok1+Bj|{P(Of13#)nY;}a{abq7}cx6t22QtdeX!ZtF&U34s5G$7N zXHXZv%zBr}Tm&`D-2d8pO zXl198ZGE+Y>ZW&;3=I-SLSzqcNEGt3r#H@j@&p40KxskmD>+U&ku9|=>z0>GKXn-B z@x<(lR+cgfS4mG@&}(ui?qIlUqe^$Zfl|rNPuf(sUOPqDkCaDhFveDvqQqar{xd?l zmUd4twt&FR)|pbI-CR<_&TsPKJW;gvINbqZlpBJ$$y1#zC;MbE&BvxV511gf6-V4S zy@-u>n>*3N(cpJtIYzzlq|L6kr_O};Y1$l3XBvcX2*>`!ix)fvYq;TbyY!{dk{6}v z!&|4NTA|xwm2gLcoDpP~vgvl|XY<|j;9;DcZ5-hbT{&UHdrrY~QT`i}GnFrveX!G0Frb9s4i@T-`us#!8h7d;#lU>4 zi^_iQ<|C=2sZwEh89m^rX4$tE+N=Qb4B+94_&h0@4*#8ds?aJ1kn>ik$rLZ+zAU9i zyr82f$4m-Rz>^9_uqtr@a^K3cw9y{szetR&Af<1TVcL?z>4mF3<5xg(Ln7 z14m3?xN&#%4#A1w1NK>WZ{TeVoS-fhkXns%OI1RpJb^u&M0N-TA`}X!*Q`wYi!hMJ z9!2A{1n`_$@9_nJLc&L8#2cApBK8s>aFU4qZXw93kb}^Kmg4|G7xP;%;#y`Ge}nHF zpnDwz;{^z0T+sYH-(2Pe^-;#P*(UOh=y+S$P&%(m&wwo|cf+qP}nsMvPi*tTukb}F`AyVg2w?S1i`i}fdF zn`4Zp_h(!|-w}urc{F+p^%5wP1fK%YVXpd$N9&sFGb=3a4%BlkEsDbH+CKhE2SADTHfZ{2(7gQ~bzv9DRQfCPi9!kpN*W zHsT|mmJ;0ISq)-iQ`RO7miC`?jr#8|%*p5y7Z#&_XLc0&EYPHgewm53RE&Sk4ZA3# z=c7UZq2F8oHu8T&Gk1$>I~$cM%X1@|4`F zp7}-<%?vU2b*!waF(I%5fbItxzUx{7{TnOG+l}SLka2qLO?bCrjXSgv-j^hS^-$k| z9$L8?ovw%F{B~ChH7qP(-s45arG2B%R(`Etyf&wl6Aks^{=w(=0l30{8yQ~5S_u#& zRBl1`+G zO_&|n!^TL|b~27hr3V1i8cA$+J6XOaa(bCi$P>6cP=J<|k8Vl;r30#lm?{>KvK|Y! zsU$aQz^OJ$k<9h=D?;UfJjJCmMlh^&I!JFHf)JL2 zr6!Wdm#Xkh&h9)6GIaP^n$pBK2%~4$Z@3sjt>QUsvz+W)6pLi zWL)*jdXF_(sQGaW9|oy;lAu#|%ijTKcf`jbquYc>7aX!_q$kp-DWShI;-0P@XJ(wt zc%9BaJ~&BBAMgG2-84@1_C&m7&D*`h!nS#Cp7osp+)HGW~7PdOFXjufcBAVyE&M6{#dwAQ^;B|DEq`-<%9C` zG!{xsbZ*2WD-4S|NGO(2!GkvuVO78l5Nmn`?2pA$wlz*AYyUl5=qT!RVtha{J(_h{RfVHAV z9Q(7?N?Xk^5xXh#530YISIT0=jF}xnSNNc`<_!8V)a^)ZB^tB^p=4Wch;bJYda(pu z{q5ZnqmTM?&6~6Oju2De@#wDHdA{B2j%@CcH~?z+xCs~i&ik{I`t~;)Qwj%N z|A+zKzxNIwhAU3!JxN5j4!(<=+^S1a}E&?+!L||stSDesjRA+Is zU7IW!@-*mkljK=p;Jp?PL7(-LFOrLjJ%Y_N3|-7LFccfR&t9~r>$|1%t)dnP{Xq(a z9O@V6$V86OlSV-4dZ1#g3mven&IM%Azan+7CXA`ksc>_N=j3=-!;3#pUzj#wW}lB+ zAFd#g-Z~mX=YP!o8wl;+u?1=Vjxac`eT~!=Bqq$`fNd#oi^3ge3Jv@*;4H3=&M`lr*}taSsa3oqmg#L(?`+ zj<)f!#*2AAEPgq09kS}6^r%^UX3RbSux`!he#f{7-mo^#poGCk^Cke4pwe_@&HjK8 z364cvHjaZvZ8#fC(Vl*s&2X$bOAI60j%BMb{F;7TxbipN(fpY~^P34>hGTt*M12dJ zu7$p-y+LhR&u7q8_pOTbA3jkugvD*m3p1<70+9|3Vl+TCnnR4ZB)WnCTy1`2*Cd1Q zjY4Soa+So?M|i2LQ?h0;XRYgFX*n?P|IYZ~`t&Kwye-x8THUu79g;)YX8x2MYnj$u10 zl&Pe-CnCeWWNcm}Iu0f!qXzVe};~$h}F~@@vN(EX2UfR|b<^5~CJu!_$*T+nz}sajAS)`lVJ^QHb`QSwf4_1)EiVw5tfZ^vgZ1 z+%!LNmtS5z_kQ73Gm@L#iv=~A_v)5=ANx8`ve)@bT1@ zz|Lb~X$v%2B8Xe07wa0nI#B~N9ggq0Jh^!~7Bi`gFM`$Ek2}%IPiy+cz>pbt#zRxg z*sB#9;x{=c?=pqzOGmyeC30e0shtK!OLg)#UNx0g5j8;?TR-1Z6qaI!Z?6i3mzl?r zH;nqx;H>q^k$-;V<*hjl%8La+-}f)Yckypy`L1PV%5YJKC%icv6A1wNsgDy;3}EtU zZ?kABc79IUJ`PRH@~GH0p!x>&VL|UhkzfXhq;oTpP$bG~DP@-9eD7J+sw5&SE}*@L zI3W0X_Epcln6=M9O^9C-GP(k&$>_5}U<6iF11>|bP-7QTG~8io^#uy?=Ru~> zJwvevjQ7cYC!!&(HlhWFd*zpVCM5xhj7yeqcjUkvo^7+GgZo}sm+WY+d8~}Ik z?Nz#EuJ9xVj-cl!aH~0Tk;av58Bvavr~K4At;o1`;Ebv}(vOKFx21XOOwN|%vu0Zw z>a-%8amP8c7;;RL#g9L?Hk1-EeOZnGbM2dU>A<)vn@sR9XZanm28~^?Lk$-}sP*7a z#qS+}c%jNlse%Ce$;i-TPtz8;B^6BUR+66z@4`kpFu<-4Z?hQx$}`8Daqy?1Mn|$I z6OrW`TFHdwt>szWAL zxNX-UziLFh7%y~~oB&U>0CN!d*~Ua*n*4YFt-%_duEKx3wg3Hw{`cs~%*FOUISr2g z%#d>YuQH@PS~E%iwUC}u**CAW21ETdkk`R=WO}r-e!od=a8*MU2Nv62Dj8aAUg&XG zb&TJJ`?r`C*8)+8f4vkcf8pOU+JNIX36mM=sKCkX^A9ySqDG${({oBj->T2U(1mrR zL(QrNgTV3IkhM<d4>)X;4Vu_xf zV&aJI-`T~Ow2EIlvq;}dGT&-y&ktq$dY)^$z4d?QVMyj2GDwg4Y-;+uw!sTO`-69V*=tar9mLaAetG+0 zLJ~gGr~Vr;W}lX23*MP@=S4w|5*CN$^6%V&jvEAT^drb@#&zy6EAkCsh*wbxut@p} zaa-B-T#FOt-R=YB&PR~Tw&`u(>H@M)ZEPO<^}e!Gv+?SX{?d}K>pWms5WU-FZP13u z@%RgE*ZBRD(ntb15Z>e2{1-=Y>KHO&WarDt{PU5X&h?)w5KLi#7`|+?B(VsqR@(c~ z)ykCxGT7)~Ls2^#+y}%av7o-kn9)ccncQt*$wK0|Ys5!fdLzBGfWO;(@Bs(j1WFHW zMR?*JT5)zwU!9Z(6_Q}N57TDYGhUTg#_pFkjW?SOl{#-6723*eMXK9L%m8!tRm6QO z&kW_buKqtnQ%#M{LcO(^RHv-5kL4?zsvMyb4dbA&C}u({{F3?N@V8`B;B=GA9h?Vi zUTHRUx>12A9b5K&x7yBIY-4^rU+5XUu;G4g{iMtGS{Hre1(lyo+XvK60k*9F6g>te zc8=h`Ru9_NIce+l}dBjB(o?k#Uw)1^O~hutujc90yM9ggyrRh&|#V0eg&%F2+xHKM(I$$=}D zL%bUkDIe#u;+*VwIuq6c_i(fo(pn*>|K4x_r)3dW1FZns*;zXZ^vyBUCS`R=2pBAQSIZqQXJK4Z zh4#Ngy1l3mfI3Ov!nG$2@bytXv;FhdEJz+mBN+O(a=l}ZcrTqvfw&%@Qf33ettcNm ztN!>@(hSU=GZzC}wDQhw2!w>!a>4ZWC z`!26-?SnZ3(}t2skVef$msDDfGJhQkHg$=~RK#~EHK5 zP~;Of@92THCxGCqQ^&8aB#d|-^i-Z&Oc^tTB}~i&G^`yluCsb&_aiXHMqF6PgQ&y&15;-MAL#`da`xL5yk_{C5g244M zAIsMuM{+CHR71`RZ@rMQFhIq8RY3ai9cfmMW%k4Z2nYf!Ksa!M%FlKWA9(p<-KMa6 zRQ18aAND%)sNB)CLjsZlxDHdrj^%g_7{Z7PNyI5INOPv*c~2-I8`!vXmXN4&|i3V9aS|f9;j~!RdY!BvlVjC3-t1U z8r}FPjUX|xXnP)eMXCLTW!H1Kjbsw6;KD>5Z|zWTiWxmG@G=4Fa1sNJnS};lO#>IeX{HT?T)Lx)cL-_h z(*Y%+2>~6l;v+Fd0CnTAfw;>@fZ#WIIIOnNU4TILYIb{UYNlL@z0DiyA)sp#O>dr^ zY9{lRToz&5Pm!bDr*9u3?^J_wpn+bV`;!Pnp-Y>p@>iFzeef8$)$vITvL?(VyJ=`? z@Uvn>%h?~6d{5muMdeOv7!+DMx5=CXuvYs3lvNvOeC7y3y?eUFhC_!>``dYbP#&5B zqA9zbY&hp^mMsBAVjI=`2umEUJhTYf>P$DD7`3jn(&9N7pkj?fpGi#vI9S0y2nOW) z!tLGnuulPDz-xMYQwQ@cxWx&dy}N>hPe_`ns`V4^8d1)UrN~*IO&XN?xqyqG zH{%!XSpkhQYSTRW#UXZcNTk5XIFqY<=r+1;JZ2NLl;LU|q$WLeMK+r&;9!Ssn;tB*#77?PZ%j@mb5(qg2ylg!G$!ml8 zx&(X5OOkd~MQCnHmBM7*9f(zy%pEvrRqvut3+;I;;JzR}ZpX6qw{k5|YqN3v1xLV? z6|v)S(k-v`;4K+ECj&B0>yZ+?P-^)y&dPDPa^idw?hV+2X8?CVesH@2!`#73MC^Rw zTM!#Xx{q2HSCtZYGhA*3vr~l(@Dq>hJI^|O$tEpd1L*-C@q(KnC{1(M6 z?;`>UFV9)}qB}&?3&decn9;~`j*DWIqS%%A+le7zQODQFf33MGDqZi%p=FmJ!F84t z7xK9=84EE1?qx+)?`63_`BIgc&%vxx7_FPqKh|z=lx!~k5yHytqLME7P`vPcD2D!- z|6B$p6oOShssXVkPv=F*E8e-4{DhR)%Et*@>RJ3x*6K#uFIEEiq51fj(U}zcW&|-5 z0&>(*ULW=^P7K*bfopEio|ReVvn~B=C40JMN+51;!sO3FrR{S8&U9sez_8XZ^A^kf zOXAX}n_cK;A^qm2hQuG0p{D}!<)DZ31*iD_I4kNR?Z;x57VO~oP~ytK_Nw%I87j}_ zGNe~ZyZ;273O62;rQr%7fA*I5Gt{z!w9Cl(l|O_Z4fwKSmEBAi92{a~dsb~TcjOHS zx@4TZ`|8LP$kmv)a*fQ9YTmNoY_*ZRZ*J)U8wz{R@DVb4gX?CnKR;_fEM^^)Dna zTn3CkO#bd(F&Ml1+#iL`|GQAt&E)!dcr}!k(Q{z#^=do~{Fw>$l449{BqQtEHW1zU zzIfQ<1e;6cm75YijGVd_Tdv)*`8eBpE%E8v*CL=eaUpWipN!Gt*A>kxyjqIt;ajHb z`4tsI;bl$`{S5j_NC0qh8QWF8ZrEH9DQhJIsiXSbBxIjjHzq(D$H8=?1R2N&uN38m-_ru4jovMpA`%jD!`BI9#-uhEg(>8aK`}T>1 zqa^J#o4WXQM{WJL>3lPhKE89O_6C!~B5F)bSyrR$K z@g^f>n35G0z`vN$Ob%TspIIKzrmz|fRooTwOLpJy+;xjU`6^#`+p~4Jf2i%UV_%7b zFGUj&d;5%2i&jPsJzNA3UUPTPuO4;pI@%e0J_6vEcI{aL3q|zof9S&rQp%HNi|2P#{IejGc9yQIK|r;=0z&dj8>E5-L#i zRS-gVz5SC{OMJv&;ov0ycOLGU#qaRIKJ*Mj3m_IRf|cRt;=|EcP`iB)^}^Wvz{X1ldrjbig5x3hMA*6qqAThVU|L!#kM^)VaD zIkNTG$)n=dA6ID5YNS#>t*zTE(`lDi#(0w)Mz%##J1=bq3 z8F3a0q<5WYeL6y8H-hxQNjXJk?&sxUr$=!VnJb&62-qK1kf?A8y9Qw2ra$3Rs>#|nn5c{I8lWLBM z!6lW`6S;zUeq)N)20*{1O7~M@@Ao*EsghB}d{YN_ z4mlRPF+Si9YMSawCP@+O-}%;9n6ghjreY9;YDlq9wlHxEJAo!BlLWYSsH7uV#VLZMP-4+&Xj2P6|)5Q|~ z`XT;67?1g@;CZ6GC?fHs7sZo`bGE>QzM zo^O~+e-1PzS6cTBuVXL8dbF>Pc)l?AWO4?j!yuOVPiWFRFr~MpU3jq`{(8CQ@Z5CP zv5f|sjdIf)ZwHm%QBNU0V{T~UUSUH@0rVhL?%Gq>2}_aWzmcKLt}08eE6@n~5HYWq z-+P9cFK&7vFSKf{!^TJv7hPdpyqt{;Z_@HUSeZuY(xhsm0vn9c`1E&)lS^T79sRj= ziOiw|ipx}4IP4c)Dc+~g5^o7>ASm_7WCwc~5@RZ&S1JC|a6{|9_OBRXK>$|{P`AlJ za&|5e>hUy7N*R)$q`1}4pJX`3nYTxn9KgteK%}I8@B99^>AZ0?4vjh$r#;XGvb3It zUr(LH1quA~lc3f<{dSX}J4&lcx&opHyla1J z6+G0oTGKjINjZt`Hw|XiB$`ik^{`9mZZCY7wpWy6n64P1K!#6Ex!q>N%kJ(AdP9Jk zlPa7#$1qaqglJsF%84LTy9r4@02CHFG0vbc6s&<-!X^&w`t$OH5wVck6B||lskr1E zOT-=Qwtwc%K7XP&OM-zc&Iumx?vi_^**Yt71I94sp|5ro^v{E5&GBo+hqRqpv*n4UY*BG3 z_Rp1g6pwzuViLiZ>z9Rlz>H+|;*t`G^Bk4>5<3pR!XtCb4r+%2kxbb{98X;o_;Zbz`d$70IUo|Gc&6)RHl$U;)f z?qUm%`065257xVeHX7HFF~VFe)iSz3As9Wumsu&$;ZpUPF4szIrmRQ6Qd6Ep0 z)US(KaOYyJXvGBXendG^zTUNHgn+ za&QYGGw=P?<;pfXOTf|k^?+>zS&7ZA0Fn`H%M5Zb<#MAdO9 zy>s)aVOEV6p4E^-)@TG<&gCo!>D@G`@!P401!j8paUnWW3Mp<676ruwHGgblvm|b1 zB0kyh>Kt$(7{Q1A5Gg|~XqnikeA|x`ZJ9W`qja8#RV7T8>s{SxXO(%@p3W;iM+Z60 zf5-PmIOrYq*su(LvTOR$=_VYu+`O|?Ek3;q%N#% zTMui|BjqM@|07>?KZnkPN1yA%Qx6(aQI4`l7w%43$L3pE*JL8zo_|P28i|TPecmv> z9y9LePO&+3Wh35}sVGS5Vlw&4IDs}^_>;WNN$N_=sdD?=ftL^9w zXFcZaUZ(x~UGRaD_NsM-n4*Q8lqGm&ypPjFkeiGYEPGi&H^C5i-ATAm$FO|c%&fQF zsk54#ow;^@T3LPm9K^qsFG58n5(07I& zG%;X>Q$33ZRjCg_Cq;%WgWCDd5djDVkam1~`&--O10F)l4m^p9W3o-iLQ}HPzV%h6 zKiV>EqK=aT3^lC-BVxvwORYht$sDo(4FR=s!N;OQSiZ*A-G%a@yO|JTYi*3b`gV|E zgN`wjfgB)d=OJ(@NO)FH9PQneyA(bT!QdjqwbZHb)@%pSwIjs$PoIGOARMn}^92;I zOg_&?Bk~;ivUA_9ADm7^>vKBS?hj?NEGhF^wnb6oV+PPo z@I#O5-|6CXe?rJ&rBw~@U!^;}WP0@gQgfGidT77&$-Ld+dNda~CNvx_4p5_agxBt<-yp{MpV$HC{|Y;p`G0K|TS01r zP%hy893xJx-RL~}S${BnrofZ(Bd|a$fzWEc!@eeej@;+KIh5m4%TjbpV3`CJ=FVN@ zIlfXwQxc*2wqIwy)kJS-LI@=hEi zOjR6!erfX$IX)@2ANRXXE}y117E-%n&gjE&$6OE%wpxhk>@vc z9A0!_@_eW35=eP>ZY7JfK>h5FWM!|AEc`>SQ~AuiIF-S$1|$ORxu7cD?)w!z{0U6y zcwipHBdK!XB&A`(SZ?{$KRjq}(0tr%h+z5LunmH@X|h2Ca{EB-(1;*t95^5*&8F~i zRHO`z>d`~u;dsz+c3~o8ztJO%Fm6OLY_(k9}hYv!fU#NvT2ooQiS3ESiuyvP#-m zeH$gGp0vu0fdY<)t184Fj2@6w`SW%uawaJuV&$Bd5+4Y^E~-tKs3?jT;<=_Z-cZc+ zNPFT89VqghNZl1Ky*ZG1z`YLp<=Peih%x>bi=u+X9xI1KNcwc)HG4@&9s47g5I>%WDqhL24@X;E?suJ~QNu&yN<)zP)i6YrOvM=b1iGr{sv`GEkoO zD|2wcpuT!65jgQZm^FT|=^Rkl$?|Tlt5o9yv(8}-WpEv&2sMrCqE&tjN^z2F9!1O_2lW0 zEje0bz7z3>%0yr6W5Sa$f@=zv9KtU`&w5mht&`uX;zbQmCnIG-q^Y@tRVw5}3@bRp zW#$v|oUupa=+Pixo0dNdNzRgyVa^XBfyg@Fj;ssIKeTMN8RC7A^x1z$+JUn1pkQ4IB zKf({KD<(ML$THq)K1=i$Xx-V^>+*w84W8s&DK2Y={Gv#;`YPIHX;dPXj}deJgcSG( z&@SK((aHG(frH0GyShA{oVJZloY<`?AKGg0yz1$WEMF7eS{{I%f_}iJ{+jk+e)l`M z9B2qoc?fkiS5*Pty2ek+Ppqek>vtxdqSd>3FdN<{e7_Nq=mY+7sNTUX1PUwk-9OSo zs|Sfm*4Wx%*JpUvwoktYRQ*YN+;N_$##bPNvM?A-XUL)WWvn`;z>Dpg0Xuhs^4rV! z5i<{M$I?oQ=D?X;FyF6}BgjOjD*uh|Pad)c4B?CCUjmX~l6@h|NEl|2v|@!QBgW_( zu0UXp$XqY5Vlh2KYbo^GXSog;a#6X>9;V$-+d@sNDEYMal1QD8gy1C{TNG=3g~D&p zYJ8}NY(YJQg`L3WTW>WLss zj=Eg{Jp<@pkARWzQlMK%<_&i-Gi}J*HD4Kg<9L3@s-mXVcinLqcGuAZ`qS~OYMtvx z47_q3ctl8QAQ{~mF|I){t^n8ga9?#PlXPhH3pl~?o!y*|yV5o!iRge7Mpz8UW>F-$WYsCTd z^&&36cLA}G97na)Tc66jB0e$py$(=$pdQfXT=@G4DO5WtCiSv}{ylyo(?C`&lEh0j z#LeS`Tu66AL0t=)>I5!Bl3pzn2-giEBEXbH-!(WQxSBwdhAPQYQU>EhkNX7%&m zet=1^`I+7%g#q@l4$%bsshg!kKt`X%)@_;dG*Ry?f4UbtAj)soZcSkx`blNZG}$Hz z)BKE`1qb!y5^%)T@le2h`TigkPI%SWm{Wu36%yRK&`qWG2--73M5r-Pky8l?g3F?e z%%C9+!Jy6JW!=>|k=S?RH2FL=Cy+=lq6(UzN5Lo4n-C+-zeO+%Vg#nho1(v&htDZH(WqN!~xK`!qc|+Z4C6Yt; z4udA3n*8v;s#xB4HA<*bohrBoRI-KL(@>DxL*T6RQ486|+`+%4gI45q<6X*-^k4F; zzloqL@*B)@n^?DJ4U#gmpOiyy{UtUM{eLk}A*5^i&&|pkpb;;sW)-y0&4#bl z^&g8U`FcJ_zyF1D2V>*tL_*?bx-x3!(D4%c`m3}*e=mI64OPGv1gZ+`x%!IBSdSe^ z^=AC`E0V|^y?)sC?9au;-re(W)w0yn|M;)}_dooNw4X^*80moGv5$?5dvgb@zL@mp!YR{-L&cIU3nW%k89`%k7mvA04@w z?k3g5sb`H^7xO!5;mC^qYmCgB{>V7p1f`&>YN6j`S9`X)wD$hwK6*5aIPHf_#v5n&u;gqXC>dvXbBzq?&ou-$|y#)1Lqeb#ID|H*T@W|&*g@C*M- zoYQJl=%9OL#-Qbcr@Hl2%}IdhVQaZj(4%hVWH{D}>kYy3YVJl<`X@QVqCn5DooDj- zW}Ot)&*;X$`_nj>hQIJ=r~Cxa^JwaaccUrb`i7eJeR`NTwbDi`lo@l9gN$Gmo2mBDfd>BA>5^udIRpFN%UCrcS^~JF0&1+Z+EAOoDxYV{#M(!;9tmJ zVSY@E+YAWd?x@4NHPw`d8kGaLeD;ddT%Sc0EaOC*-yB!DVjW?z{^KE_nOwi5a<;$n z8;bZ8Sm=dM?_zZY$;UAguf1Jpq5* z5i`t@9QX)3d9+>Jr5ke(1>+j5i{FU#A=!xZb?BI{(04h!aY0}zpiXH+yz8{}Jitc+ znodD!q9K5jj+N*a8MAJ$} zfl<86UNHpKudY^B({gBmRKrqM>?okY;C~WOwcAUf;N7L&03{!6!7L_X8>?)JD=W6P{sTHHy?om0XO!*lATJJl}?_tw$$7ya5RRXc6;uEao||jp7(7s3b>l8sg3AN zboqfY4BE#4Z~Y;UL@WFLOW!CL(4^nDflc1La2K8lO>Ua$x;rg7`eEvv9_$LP%eaHX zkK+;~Qv#VTqgg`I z>J!O@&_My8UUyjCz%lM)aboX*1QEUjB~pw&7M5Z`XEbKQU>|}9b7T~7*KYKOGM_+@ zrFYC7HC%uu*g{Ivw4V02;EE4V#TSf-Qrc1d3vi^uEqLpZ*T-oaWWDYBoA?>`3BOH2 z+)8gS{{=;i7)%S^z^-J8uwVA1J_m<^H_4o}udy7A@Zf#OnI3dJdWmIrl*qd6Zhc9s zVr3+kp9Ss2mbekrdjH6@!e@AoEK=dyD3ZC9G4*0-#K(>WA`W7J_1+3<3u1L!$=)|r zaC7#{<-n>ORYhN++0kSwZ}UuxnMoVo1{A?Uhj=@P(LTJk(I4Q0RK36UF816w z)MZ!@#^{b3eGX$Hp=ui~+T?=8$O_-4p+f-{f$iZVGLF~e<3L-q#bLrijM#&ZQv2M} zSe98p*z6~&mS<-j zIbJ!QjQ*}@s86_skthmN!OclBS0Y^)kfESJV?iSrtp>`SbK;)1Py!+S+FMykg<^R1 z2)wsmsjXw8_z~r;5aJBOGC$H8kG#^zLc8n(QS<6dF(Wi(l?+Xb(xRBMm%|EU7Qup^ zbbldT`r%8jzGJq#71HpQL*n}tS`%C>`Ejq4aKup!+VX{d?J-Rn!tPWqYq-#Yq)VP0 zXJYP)=rj_gccbnY!xSuItyj5O|87v1Tf8N7s0*%nGuu^KMr^vl1dDSLc7xg&3?QXk za?>K_P{&zoEmm#Q89CkL786T&Gc^Y~NTp2-Tf%jDy(wuU*cAN+7&`Op@mNxW7}{mD zhF{Q1Gfy=p89orOI7TzOkivVB2rodV$gA>#^MP|mn&Iv#hhFr(wxM|=$x9pWff z&GO(tg1NKIaNX8jnkHGu<)(_`ls@0DYjv_7(^f5vFU76pkhk@EYpb56iSF&=p^VPx zyX2_d_J}gq39x%s;p6t!BnmZ3+OK*LHA&9c+p(7A@X)5P2r`XQ7vl7JRt<1_)Li`T z>_`%whhMz_9qV201RcW=)hx9rFkYU`DE_<-Pqh>o!)(%=xYk)z&xD2u!po(H^PzS( zSr$$483DGNr!)e{%7U`a&ncltI!2=ZOH%pR$h7$o^uva=l_n<|EZ5OsS{XHB?jJ*#kX{eJY#=q26V=Y z2}r1TmCyLwe!jL??bBL;g#0bh1?n#1fQP3yVvLt0W3r&?Vp$5xJcW89!GZCcM1 z63cku@l8I%;*|8$OG+KdoI@2}@rowG4Un?)UcdLCrv4fpC-CPo94V^aN^M9!Jk}J$7v;aLR-u%R$U@k@sxP%Sz;C}W-QqAmJ_S`#m43YA7*UX=jFaTbe>-%}SAP2}# z=YCnodIwQW=+kUTGb49zF;cd+s($#6M1Ji}9|Ys4`O-=7PPx@RY2m-LWSw#4!o2)^ z+TKrgz`|F({Bd#vgs+w`e*Z8MjvJC!vG!c*X;Q?8FL62ZGwzC?4=eqXH01pa?%|GE ztL3?jyepYlYVv`jlgH3BeGMB=1A;UBsKt)0FkF1uaNKOk^G03G)#~toEBEV|cFt4c*pB-GTpQ_8O`U063 z7uZp_MR4Wq*SR%jMFCt^+<`*7e7>t5=X?j{ZqVQ0h3nYa^d?pym|058V71m$4W*!0 zRs^C9FiX$lhT-yjLfZ6z-9lW2@R#z*pNb>MbOObc-ICvx!3A@*X!vfc=D$9y89IC; zyf2Kl0S(OPCaX^-@2wVgk`9fKrx3*-Q+f zD^aPw>>w$22jfpQII#}Su_fIX?7yW^T8%7c)RTu)TmKqcAcL7CjBpE))R$q#0d*+i z!)-hihZ}y#3iLw8oLswklzAZ(Nc1Wxebr~lzp{w!(R#SZN}-LfY;UWg|9Mdlrya2l zS)8(T9dWT#WY_k3jW|w*1V=`T@V!AloY8Xx+ljTLYL#EA*C1DDPkyZF%HM}6Nf{^A z(#b+*@gHimv)#DHGo7@TDr{OW=ZbkFF{^l=m|ol+dI=eb0)CErt@s|US5(U07f&%B zIY3z+^Qsf>ZTVkM{^1HhO?D(Y=`{6VuKvSA@P6;YWzju(zfBz`d#Yg}mV| zhNd^3XyIAnkFvkD?iR>h0-xV8Qwo_sO`8q3b+c(t%PSXGTLvy4hZi@pJ;Pe`nz^J` z)*cwHh|yKQjgWaY!klz5pmW=`^T4kgdrInhzgt)xFpU6W!hUnfw6w`7dVIOygh5Y3 zLEnvaI^KbpR+NpZd>9ju1oVViPAx{5YCLK>-e>FV1NYjs2A|eVDRdXWv(KngqM}CG z^=8=>Bd;b)EucOl1OWdKu_<$fx(G%!_RNxK%9wV&4>b$BLnX?nh)afJ=an>glfCBG z2Tv=MC=>_!j)Zt!J3wHCpO(Sxr+4|5li^V*JA3`wEdh#p&Dxti6ruvqR5~v#toGH% zFz}07UjPYl?n8jO{@3G$!`SJ865h!dOP~~5 z$6j^)dheygs(P2VAt6Y<(GWnL;CH{pONG!On4$MJYyVWGHJfG#FZA^f#J!KMuM0-F zRLVG_m!`Ry)g4o(%7AQimYm%_+zYbN#}u7uy(sZO<;TjDK_Rc3bE$A-dhMbaZj~I<1ueF9-PziBSii6OjTxz7N%{`?39VpT+3BnB7PR)T2t#yiWw4jy?jXyX ziN8)Vn60nFcX{-flh>H&H0x%l)LEzAM<<;il5#A>hl079RO!NRLPEs3;er3vQ29!N zOykHIfJr4#iXo`YG1&lgskbJuSZFpWrub}Ays%DXzq3|#awJ{Ines{Nl|8VA!Lc?F z|GX2Vk|Q&fA5>6x?9$7iT%5yq1bzF!EUQ?M2Z|GrB-ZHuCfLOv*^H|;QrHc(oS0W( z0%E1|^;O}jk`HA2pd&97x84fz=0Fbg)NDPX+7p;P21qzT?&yhCP!t;I z*dPK?<}xzD!RO*6ycWNzRIJ=`D`afI@a5^Od%C#W*;OAZwCXpKM{rpSan$5~ulaRz zSB;PHU8krdqu%qdy$xrv3AK<(IW%gXK)!4E=(r{}Nn%*2 znFy9fIm&kcnQF`F6Ep~TV%8`GLzK2%EJH}meWrfCK1qU!Tv*SKRuP0TBm5(?i|c3y z3WJ+i;Y6o`Fy)c5d9hbUT9{$b9i{;pdV`YG?OxJ}F)GaAC&ylonTeYK5_OnW9rX*T z+J+(`(Wg}_Hu{7$7T`0jvfcah`TsEXPF%E&G0gi3GPcr;EQk`z3ztB9l}fB+9N z@U3>?*rQQ43eyCY`|j|w2(K-nJ$ApLn*h`Fu05pW7v;U}^xBU{Hh>qT;}6}I##k5l ziUuLY$QPnWQCZ0Ae&jjn6NpIhC5S&;f)`kZK~Z$A)4nKJQ9_fEF5v*I`on~$0~2F zZaK5LhyiYrM$=3uO%q&I<_dDLx-COUZN;XjC~tl7&ESG^0#6Y{z{;-rdwl1cHz84W zQP@>G=7lmUoSGi+fU{;lf^>}_b|KkK?haCec1aXE*pRlE008iV_lQFnp={bdnNUm+S6LF6a@$Z{a-63oeE00P_$q<5OpXvN z1*o-*tJN_{kMpvjI@tXI{hT6J_l!v?EW_B0^I=nB%fTkG7%RGMtG-RAZW=b%q*A$GZZhvGx2f+!zb^Fl)#|2%zN(P&MqYkqRpZ5+l$%HumSG9ifW} zf1MB+_Vo^nf}~JiVS(9e`{8d#w=98yuCmN-)>PK=5-nFH2_I=#7#y#syAW+^qqxP| z0QL&>PQ}CQOgHFq5)7r)h~Nla!YF-&NFcG}tvHT|-_Z<9KgN&;*P$dPn&LYpr-!Yu zoTHAzL2b!0~= zptkDF^AJ#ggfARG2O<^>YlAjx>H-A;VRW&53In7vrzCP`P7*~mSbV6c#d+Rq5uh#+ zxz%Y#OLZ7qJj5Uf*ZfMGU=d|cBop-1;u1F0J)mW%Ubq?Ca&w?80{_<9bh#H=&aWk4 z`pk#HJwQq6=)^r8iFJ7@LZ|#9CX?_A67gP%hpy|VR_mqO*kmV!7wv~ZrErMREeXn4 zq6()y-(=xzAs2enMjW4@7^CVS`uRE6--Zs|VN59n#Nse+1xTOaP~RFnaigy&UVxw^ zydW#?g+{neq*&ui9Gsb4jRf9AH}8g84jVK z9X`!cM}#v{dP{**sK4nUSUM(;kd_)$Hn};hfkitK@EjajAmoD-_*#+P!)Qc5_T7zY z^NPXDl=hW)-9yTlJF2##L`i(ba+Q|(g6sw%I#E$`{H(CJ@axo%V#WlyhJ^FUK?p&1 z&l2D`=1E&Bx~+>k3%s>o!|vDQXM4vnRV!3A^@1c7eoIy@#xiW`raJuy$-z<*c?u>P zn(v*swe}lbSk>CkkRf@t>@f%7p<`5T4b%ZFi5x}~E1^JM0`7dGx@H2l3)zE zBaSK@kJT}KQBG3o%TFSd`(tL^rrB`x3i=ZF00R_&G)Tk&q2n?6d1k=p5P3|6qMm-BfN`ujb2K5vQvKvq=#)D4}5e& zMDemGATw)8vQ5}k$N_XS;X|&}HjPx=T7Ggvt6-RN@*tKs;WidmsXYUQPsW3k)Lb@j zF}f<$sIGwUb2^mWag>sDze6j$R&FZLC=3(EBO_42 z1c+X?Q>a$7h(yVFxwEhTFRmo9KP%T2ciwF%F~b%0dKIjKpLU58nVf3rY*d!@6~RS(1SiG8KEtD> z+xFz%Sg3HuZ*i@%qj-LVMdhcaaC(m6awC)yAqdG$%!DrVV-H`p?5x(Jbe>DXyM%Zz z66eVt7g9gaQ?)5jd79qDBNb+Sf75h>pxCTLm80Xu*3N&WlVSFP@l$UYu{_6(vyHoW zUkefd`v&8tFPd(@GBX0}ncmLPCw~XwoIL8H78Itqox^jAn?%r8woT%*i_PDo(b@fT z2RJ4F#Hw-<67aAI`_4-Ii^h9&ghmy0-&C&lk;PyOUel5Fxi~{u1wFGn1e0FM$Ofvw zs=$D4)Axb6d)=S8V9MEOY{c$eas}Y$Xygy=gBx6f2220~8OW_?9#~`(KBcS*WBWM- zy|lGq&qqChunk9zfJ#LWxaCU~p}3ec(_NCW-n^0ockD=&h!2+KG8rir;$f-WX|ihB zf(mL%cW6{_EH(t2dG1??(i~3+0B>5CBMXNQ#Q&y<)HT0m-*Va}PYS3z(9xw=uDWVE zcEf^205EoDNSfKVdOAYuI%|Du({6W%3q!RdD$f(7j}Tr~^2XXz;I8m}`T??ywI`1O zmQY#48=}rU*)_nR?gD!@A=<%75wq-hIG0ds#zPVM0s5Q!f+S67|>@`GBB zFX%>>j_V1Pg7f>z)2(BBsWb9~I2=S5%_9f}Mx0>ya&dii|N5lAT?5+wkMYs}xu*Ts z_=uT><$t^z&i|D9IsaEuf34;}?`9lz=ZV_OoPqSUp!?x?_Q<0!Wz3Cd+JvxF2VnyR zF%UpDAc=MF|HjEdTLdghuu3`-LYOUt28_W>oQ4Qb2{AEL;u%8|ojrBCLNRA_6sA23!Hc_lv*}{Sfbc|f z{5o1#oy}D-F}tkNr0`p>gvHQvb|T2}h6^>v`c1vNiS(+B>&80BzFf^tVlBa_nf|Kj zCQekHOQwaD=5YDlnVy%xV->hi4c+VIGO?wJIQ(=yv5lHba^fV-<%sv>XP!6dw4%3q zL6>)oxYd`MP?nHo7bPP31s1cLGnmMyLLu3 zEK`HW^eNe`DMT5u+h!e2wVE9%r8-nR?34wIh?9v0%@OY<49R?|%%+yn{`2niq|QQ8 zQMIJTKEBDe)tW{eM&vH@@sf(-5;oBpO_4+h>wEwNaCf%T_t{vMZS2&cpYF-O_U9C} zpD4;Q3cz?I#LQ}@djH1EIVV~~_5^Ts@JE`vR-9z5naE$Ou#8Z_bJmGfw#{o%vq_wA zMl^qEYE_ywtwM#39wFQ;dYjA0`^r1yu{95y`h~6}^NGWw0&r`Fc#u+ZWjoD!IZ|kW z!=~no0eTnR07P@*Pfeg-ZFqIUojmQK-uBEMM=+*3&VI~;RMLPC`ayL;+N4bDbX#Rr zS@;*A+0laIUY;SiIEKd9*ex#_fCnS2W{&Yp+_Qz5V$nQ__DSh3(U>ra^1T7i4=yur zLFTySV)hz^!{C0$ns5uSkBaonf-wn-H&W9ur|-p+!s^&H)n6a{%BJ2gpM03G)1d5z zWa}EJq)Rsf(IfBOZaiizabZ)YA#wD6*;oDoH;dc0l!qog7a4N465jx-^~d6RN*wa;q8NmUu(q45$P4_}(B| zOP6qCX0}2K3CgkT5|@4lH;wDkj}6vZkS1GjVwHYEexB9sNR1ee-?;~hPvak>7ABU< zBjACQsgk|j_AcyV|73LC>f8iNsl-LYTc-;ie=<&FQI;vA^!l($dWnsJNUQBZBnDpd zcW7Ce_e3lHxLU2UN<>VTQ9JdFu(0*RkyTNR5*9PxNw5HG3Jeei(?2jC>aiL|C1NIy zHK?TP2!yC?B}(wB+G^bKYq3gLU0gouFjG)1pMLz-vjVw{b5Bnonw)MLwZe?0`{gv){j zA0s+-oU-}AoekOdu^=K20~v4sZ4a~2n8zWOTG8K34uaaxj+#r=z;^bU7YE(STcD%r zKh9Xfv`9~*=4Z>ru>$)8kPw(qN;dZ=OLI9lazOKUspuFiLa4sFj=Zsb`AWx6Ol;ld zk#fU~j(|N1IcF6!Hk?BJAuk#^0e7~RRp9m+Zxg-@xl~p0GXtd(9#-K5q0c9C1$mbP!X&eJ zSXe$9n=q!TZGU5hyfYueCat*pW|^}|TXvB~lgHGU^FK_|1!3-J0Esfl);ALDwW-vx<^t4G*%(#abglWd1r zflLtgBeM?o7>*TpS7vpK3gcm6UPYzedQZGRd{eDL8jBHrG>&cmirwtvN8uz@q`Wb>S} z$gd#@(G&yixEC?S_9GxZoaUzqiAp|Yq%XzrIblJ9Mhkmml%(RhcfL845_q6LjWySQx2yh$?2k;Pq$<1?1J0$H%?Drcb*O{MHTKw3R(qJ2C4 z;w*yvbKa+!vS7>~%g?f@(bJzI2hhiFqq%95nMK9yAUS*Qo|%YW<^C2!%d@xs$j6>v zvmM<4J_yJS)YhCJh6FBl)n;WE4I)CZf<-Q?BQTT3XpG9I!RJptLpSZRR^ic#JLDJ{ z#W%zZm22&p#6_q=o-i+Z8Ba&VU{X%ICw1D2i<;%<*`d(ufS>=Xk8z z0B_{kCfA3jxRuehGzt8A@Ky4r2|;mrL&E8y!O4YNhkK9<9C83=C>2G)q%oX3j3fq+ z9!*arHV7;a2PsdKrZi2rEC=Ymsgc_IEIgxx<0|yTO~#{XHx%lV&*Hs}9J(Qeg} zb>3z}`g5gzf2x@JFaJpbpqZTXRZtt7+`9VJ$et7juJphwEGGenGTFNBo%%g~E7o4A zSdmIwn@YL~0x0(OP0wF~pPaH#G7A6Iy0u#(IXpU_zT(Hys86N)IJ-OATE|sgx96MU zeqiT2)H9MSh&1Tw*v`H29FP9)2ROT*OSDNw5{~+I6+Qa3OZT9-9Y57uJE=z^(^Jk< z5M?g8yF7X%UG(RK>D^Di{Vz}|r=h4_TB+B-QF*yp4cmmfsW(M?$9bo1%%JsP?`!%$ z+9(4wWfOHR^O)pl!d2~@^~zZLHfyrR>C8N8UWl?=w%MO1@5V@7NBQ-vU2;%v(!L~} zp+?17U>y)}Tg*nNrbE`H_lLTTewB+?-7zcHlvZMjqM=xcot~Pmv zR8>Th5Ivj`^VM}_8$a21BVN{ZJ$_EA@};Xjybv#`Q5sHIHtCN3*Z1uW z8Vq2(g!fY)-$j8rPnhOw1g)KaKOR)^qYI3kL>AV{u2(uQ>xK`Mpl-;o^zdgA6S zv#+e4YMdLB&2_P_e0MF8^;vScxrYzu`$ul_yZ7$Z7g)MooQIm&Q;Wc=DJE$FHHYHI7bWLFEi-!=Zjg~}EhMA>Qx-?fXg>>X} z4x@6vj%5^8wBnk(LRwVYmGD|5IZrsHW zIweiDl01y?#@lj1b5O)gX3Vw;CgH=Xe-HHAUDgA}^4Q5hMAnGgKV?Ub`g3iiA?VYg zRhVR8;#&Y_%2hgU9xHYV8X^9u$RY@cA(`7FeCRy=Z4Etwn=Ch7f*=6fY$p{X=e$vh z+VSdGsOpj%b+~jf8S^~>ydDHa5~+&N)WvTA*@*6YZtxK;CJYmfdoTSdvhM43$*2{( zRy5gYJl=cm+`cRVHMP_(ZQjjy+o7;<4$usi4k5v@2(INgRG0^VLFTw0;C9@w*x^2x zMr`pMvXH?Bog%&X*>$*PP(cjvjSPOs8M8nfh*f;lWc%GiZZ@0Y6!@vWu~-dawCnEP z^C;O2WpTd7fCDYi8gvIXV-1G5ug6wvlN=W;<&`df-}H6CfVUPX{Y#XP}I&q(67Ux7!3j7C!SQbEJt`BhAKw5Zv&QIk@2qlV8;i% zx!f?!8hKYW$EX?5wgxWrJxc!TtB67QN7Pe-%sQMJvk8za=>sYd17>++fw%uq^cVVZ z{H!6qEqum1qmS_jB;}iNP|6_Zy3q_8xnzNl{a)Nvd*l!zw&@p6QY)~WXUR4nxjIZQ;Z7z@pM-62A2 zDqp4w99NC(6?M@v9HL1)fnDTN zk}hrX^o33OK#a@A2qbb+qp?w&BT>)@aZqHFnd*WVt+Ebsr*vb1;zkL|l!vW#fkk9; zsiTcY$xN!(A?*NUq3&&|?z}cwOFkB2-$;&*sBsPWOb~xI>tH}_DXkb!+Gs3UrGMI#KthZNs1Wk6HXcq|U@?SE+UUleRE2O{ELvgYTLz#B zVW#$tx8R3&aXrs?#2mX3ebG3Wa*CME&o9wkA_f|t+e@v(2(cXSn{I>1ycv^iV&pg8 zwFS5Fhsde>$Y+C9gL?q%1Ea(lYuf55MAJv-(}C)L9jo;P{uWAAjAYZN@5AFtu0;u` z2af=~St4Xy&Oe*LVORl7_15(28QG^c!Ps$R#O!JgWg&joup8%4D1f~=>8raI%Reue z?7!zgyXUZs32G!)q#zJ50E(sFsuuPl=$S9f4wA$=5=7P|2GJjMd$r@=pb*SJr*i}^ zr#5O-5xIuj&PY%V^*VwrQ|7E*^{{ zGXu`l*cV$^F+Tv;j2e*+*loUGz#)+=6nJ)pv;^zU3%xABn3n|~t-jpZ7I?;JD<7ID zym8ymgq;bqgXuj^zU4Fr)_{_nX3LV0k!Pkcru_RmT{PTI78oW;_$z`7g^#H$fRRsq*YM8$9))*!Y}DqJd#uB% zvLlEsAQPWi9lv_c;{%6@=wWPcb2PJh^UBMr0=qesctqD?r+(+6jfcGv!kK%}74D;n z{!Z*V&wjGV0LVSHaPTK$vXEMfB?ES>9^5HZ&s-xvTTsP99V%wkr9@KX_W$ zyx9%TVk-6?dUBHM6>?}#1kUvS@qJUggUD|Gp^IyXgYAOQU$YAXEKz33N`)LMEeuja zHb-)3JfoAHT!E>We>CwcF{cTWAvkxgu0Pz4+MNFGSqJ+C0Ho5!FQ$yuj{u0u>QoGb zb;LU{-ol+*tU0^n**E|WzW*CUGqO<UdD#zf8NQ4IP=eG0)FZ$vd#j~97^a^oZi zELl$t+h3#Pyf|aiwrEISeJIaprt3a z3(1b4E1#p#mWvPBMwRSASbbQ4HyOWN<(045~xom~>VWf#~m}klfyj+rKX(*f?P= zwS*HrKHOoSD7R9+n*`y47(56>;jj)uDZG39xjoFkf6zCwa*g}XTg(6W%#3XR!z(c| z{HM^&$nd{1npd>8?6$bjeCN~=d^sNr%tVz+N_t*eMp%M(%V5p$76l8|U1}<6JCn9q ze&_Ww{d4|!BA;-`dN~9P6!2OYJvGr=*ZUs4ODRoCMEP&`Mc+tD)yenfF+5Q^{?fD^ zzda>$)^X|Q@O)+*p`TSFcSk1XB=by-zrT`L_RY-x!iM*EB|#~oVb*Zy=aJ0xbPm?% z`OH|>yHLu4Ll*8izPElZGFR5;A8E||2-k%)E`oec5B{aGl4H-mbT^KJ$e<0OVrAcPHrPUn%Drx}kkDdD} zLjkG=Bn>iO<0MbMX+R4L`b0E4Z$PzO9k7!CFC{G}D7q7&g&K!wejh}X&^2m7<>%qd zaxnlkD22PemOGZXLuJLZm^?{+uR4XkzgIv`iG;lRN@Wk1?26^AeEs8wJ@PonwbxEM3cw{(w3!NTy>AWl>k)d7IWm61}k zYAKvm0+qtJs=*Q(|Dx!YExH`0dV%b^1p{4}DN#^2vBJ8pHm%J)u_As65MWEkC)pig z6>oaYD{}%dKqCBXJV#2wUO(I~QMAndQWE*FKAKFLcTok9PqTJ(3+- zz^=bc!kEsLNW2b72Ls`J&;Y#AfRoIq z0@t(M5#_@~mm;8eshMUCiv!09D%sR6k#)IJ%io@n+Ie2|#=v~;Q)EUVF!Id#?(&TP%QbZp z6UD?3Jbh1WNn0QiIb3K#({<$$bBozDRDC>^ZlLJ1qs_d>lKq=!h^C zPXVkC|GBH9!|}zrc(lgEVhx2;DjD&}5`0R``Igtw6&M-pc}I@088aYVrZ$eeo5CqC z4GF=dDnlO`malpC8%z-2Stn^zL3zTujy90D&wNL46)bySJW) z`$eQP79av$Hg?3&#KfZ%iP49=)vSZU-}pU}ViAw|O*1Q4!1M<4ZJrxGfz)ATexQb=uX)t+w07t;~ttQ{vTxZ&|2VYV^EU zep@m4K??$6Bxm7f0=BL%AbgF>nHYk*2}0mxOhWqI*wmQz03}icjnt#%ZPFKqkmeE`&^N2nBAxog;aFOj*ZJ1 z&pv4w0mW2f@O~v}1a{7mV1m0>d!;M>rq#8(kif$&7o8iogb6_6?AJ}Xo}1*!x*IU3=DLHiP1tc+ z`o96l49SwO5}up|{Nvu+s6`aC&%xBID1s6B4}zGdPdhyd{eNt5y#)T(|;YwEB!fX?z zHkgPH=$|9xxSv^uQ8u_z82)c2h|s548!>8yE5CW&sS8zzB0sP7jT#EXnwwVM zP88<=oh(y+iBGw9$j2q=VCPWjrvN*E_p6(Z*^Z-9tT&TVR0A&nF}8%~Affv#3e_Qe z2jTns3ykplIQP&P26b+!0aYnSM(nZQz! zWwz^Q6D3-c$d(kzVq(S42mS~3_ZXa{VpA>#C=hm*=$Z>UjYU(%GTOnnk~_o z*Jyg^LqE}@Vw;7l86#VF+sTn?_)6XNYqZ^nf|Q~Z=N3!!L_a+{z5&7p`mvZ3%y8Un zE5ypy&CODE{6~Xa!^Gj`dgQ$Q9OxELO%Z(J2ggW1UMW*p2{H!RkUg|+*g1ImR!aEu zbRk$#V|L%zSR@8%@#ed*lSU4BnxhQI7PCm;Am%JihPx93u3Cl4_}1%0&Slg|H(8fc4VZThYSeTbRWy`6d?r^;j6@ZVfu5D9hSb#P$Un=n!Oyc2p>0SLuNHFuLc+4|v;8?gt>tV( zIPy`(OsCouoB26o&P?5M$S@X@qb?rVFoj~8xS_$^dIG`$Vq*?t#>`wku@4KYS}&LI zE>cNG27<`rbir3KHS6N67jtYovWx~l8w!;8K$&R*oMe)}%V&!7G-Q4Uj81V;U@v9W zD}JEE3S||jKH{N5txQgk+c8HeqTU<1-9$M8$RW;ZFG)_?KxmYGGu~4UOlLI;-jKK! zEJiM=WR+8RCzu(bNX$7V(~7rx)&8%-XBt$zpKYyGG)&AL*Zy!b#}6bh(LN@0!PkF{ zk0EbP_nC7>VnTQaQg6xdF}@dsvw=Ew?EANzlqEF*ncJIa!u0fB?{y@S6m1|G!kjk7 z3i+4&ptfyF|e<^E0d%8D;cw<*zL^zz{h zr+`u>&R$Je1=zS_{GNpb_O}B*MD;#M9L7~v&l<*kD_F8gq62|E%y*zx+_1+wzd>gW zGGqvamDi;6kk{pinEh|2GNu20gvbC36Ym7F+NNLf%FK~q3{HB-W^wp=a-)q=u#H}_i#`O^Y%x|r60 z-Bt*ozjKc;Jef<-AE3N;OWu!oJyk(HS#=7$6b5%;@GOa?4L3aV1BqgvV)nF4e=^2; zn^FLg%gb)l31l+PSQgFbKtLfekv$U7SJ7MJ)4x-{kLZ^YNYy;Iw%wsz1#7dkU5k9QO-Glu*moh5iA# zmMgGIks#!bSSep%rI(M3xTGAj%`_yf^;^W_(*8=NXGjd=R5WwA!P^{pWlO34Kw3Eo z2*>Ury=D$T<>Z{dv*AW|^_WjOJ!`hmEZu7}^Ho1yWdjMF+rJnS zeSx10(nJ|-@~$iX-d2!NM+wcG0;26Tz3bm3}L!M=>j zaICZRb!g$*$-{A!gTLWsdn$Ap-WM*O(#U(JV{&)hMX>37=bq8HCKIL8RY`69KB>eV zcM+ET{>^^o7l;nZC(Y*MnTi+Z2g*o6rRoDg*rS#e*Y^JyH6J{tTu(39qrE+7LzsZ> z%Kn7cYU{=T>XqfgyyKBJKteTkm(Y#wOOYP!T-WMaq%HhpR|TZ&4G1VI0P2d0xsvbt zfWbZ>?=3k7?K;RvP#uFJ_WA{22sdp40-V!^gi@SQcacu%_pO;jcaLvy84C@#|3}6D zZ%vGm<^NyI#>nuWo*3i5g1|taL@#D(<6`PWKrd!v=wd2jYHV*}%Et%g?BZlrHGT+D&+=TrR|QJoeG1W3^CeY4hPW_gxun@5`xle)1jMg(As``1q!2&V0ckyV*5 zAxdkfzFWU<6&fT&$iV-*ox&WDXHL&-`5XO1UU5*B@2OT*Z<=q%**k%Mrb`;d10siU zd@9r2?deP3CCCjkvWUjiBC*~q@AYL7&$nwXY>P57nc#YsQd(lvX#9=&E*srHdq_WZ z`4vdk7>Uf$9E~G*XGpJg1gjU~4=T2`OB`*9N9^00AC_8pX*`0{>PP{Ktt6VZbN&cq zB*tIGL%J_JxI_w4OR-N0==$AguhQqIBm9>fr=(KD%S>C)cOGa71jk!lJ>TBk-{fCT zL1ZSOU>3mqu-Wh0{vK;|Vv@#KB+v-{Hsb=i}UCTti>rP4Pb#WUl2BcZE&ic3~mh zuf_QTZ>4yha}r|Vh5Zw)O^x>qZKZrISAHN4QNaP?W5fXOTC4_vgIfFeU|CXVQZ@y{ zd0N~qindpiEJ!dPO>m)Ms{*Rnd#a200MF}QJ4)1$p$ou!UGK3F_%Ejs4u)O?+k;C| zmqkN;yJ;BmmNtbHTA{e&ygJ=2F*g^pRaiA5)M-VDXUsFq)iB2O9|zo5kg+&t{vG5N zb4)U(5?KtlRCgy4HszOSD_FO^K^nCRu~-PQ#d)nd8;iJJM&Ax$S)*aMjB>f@M|3-_ z8881B{YoaUmDGMJ!0R<7V6^kcpX%!8{o4xkR-cW@GEke=6;XBd8emRS*AyA(73djG z@5H!b2!9<)F`#lLVApcckAG2{i6JCdxcbqRUF0qWGlSmsMfFWzF(@c&s%dgb-=w-c zXGr8cxM$v+WI;!qcrk+)#Bs$~JB3h%ByFc9q6-~o4gFhdCnI6_SAVzeEg*6;gVCOO z-h|mRBoJGJ8D+bt#YG*@*wm-+D@UAyS=&*Zn&8w{v*oZ~p;U!9^J-O&VCFc)fCAsijb7O>|+gl)$EZ~&0MmWBCva8=K z)R|yQ<~$z53YOm%$WNh-TCVw!?yot`T9Ra>AxCQMn=Z}N!4Lw{7){Lk@0^8 zM(3*i^IX{w{&}tr*c7Hl5C{a2>NA3RWs{WVWQ{7E!)~1fP-z(siJcx3?8oX~@s*lTKbPt{8hN6?Fp5AXR&lGVwE)>k7iTn(% zxYQL?60;rf3Iiuri$esvWZBmKQs#LhjJOKtsIC^)Mmh>rrr6GQcZj5Fkz=8H>7Of^ zt45+ss#LL8g!DXmmk{VnD5rzaHr>*DXH=o1oM@IF!sM!R>zZ_N38DA#Jrbv&quCHf zkpBak{6{Nk0cySmSb@^qDE8DH^D04Vk1i?cSUCjC(aqHnD!!&d@`vk^spM2klhIpN zE9eN#$4v|cAt@1Sl7U281?A}rw{e{0aIH~HIzY< zlymmXNn8 z_X!fIh_#h;5JX~&l*g9=941-#G1!5>8wzm(_mU?9=YYaSs<7w8nCNQh!i&Tt$fg2L zIcn976Z~Gdy-_e?Xbl64e=Lz}PW$8b1<42~(~o0p=x*xB6){R|xE_n*^Uj7a94P&# zDBwKIms=jP26X2P^cY6h59GwEIwBUVl2ptPwlIcy@ZG`$WYC&7 z*tMD}Du1SjY5-YErLA_Q4HTAWU8{VD664|f?uhJSo*>XdObmLTy%He_gs(Wag6_!{ zr}Frg83HFKbPzaIo@IYX>%J>?QD(P&Tc+XwLC6LB^y&_nImZS1YHEk6zIunNzIkRV z$>0P8q~AJm7#kE(b>sP#B4X&g!Z^(}tLpG%9iy?gwecbd(x_l>p^CP8u;m%H4SCpt zBO2ezc5AKQJj%D3U~B%{se81_ntv;ytdH#eh0w7(C#%5pi1lxnvQJhyWyJCFqXwRQ zHziKd)tQvA2Vg0g`-2%)_M{;1Ct=&t>K}DSMLd-=P-2rgtkS-4nydA@>X&`M!?usX zu@j3VMg2)Rv|r3OwgB;u*l_d>4W$7Fj_DkGZA+dQ$PXZLhCM@Gy0mh1bcP!CnOTe% z6?lLrpF_74-RiYI^m_m8#I2w7Pbz!=ES@TZ-bc6#;8LeGo(C|Qy_IRejBS_Q_yL}T zRNxL6o!V)*oSx`uhktuRN3k;_7I@TWs2%4A;7KmzuJ;sA1w$DQbo$8eIdJ10-95_v z)O+A!1g#7%q4X|;K|x+(b~Ddp?M@4afszTjII`Q~AjC2OO;b}>wBFX*9Mdv+u4zKp zFUaCAQSgdOG$BtX?42Hk^6y8(J)eqiUFT#1hqJj;x`2*j=j7&@HZN2NBV;&mLIA@x zBQouI^Xkp|2F~;wgLFUtA7%T$5k*F3HunE{XJGtKMv;;6e+4O)YHT=dv7!8nL)))a z854?#jow2UyXZI~v#Yrf&W!;}Gti_JrP3kl-kaB-;C}@o5Qus#YAb#iCk8@)%X7X3 z@)IQ_qgc*=^=`xrwP5|=B05!H_M>Gxzp-Iis5XmU$d+&PW9Y`-kOdh*8ObT$FhfDv z8*S$Ahp3TeG`1Wx9I@eqdX)65#{cu4(zOGLrYLdaJV>156lm71c+ZKDKX!hkcH#vr z2~w8WFeTKyzx86LOMkmS&tz{>hK~Co25A$$W&689dnN4+L|VxkjGz&%T$nE35y5a| zF-X*WP<2m^2t>#^XCKs*_p1^o8MDM;D7av=V3QNZVd97*v!|CA-#6`d`!2`{2a0SV zRKe&&M|ilXQLbU}NdqFkw7jubJEjsMsD~{)3M}QA6H*d;;-_1vwQB~IYNcHzb>bRI zGI=6KyHK@^hw4s2t#%bUtzgQyi)N~87#v`*{ulXR*db7J7#3f>VHB%kUW~6uJ2VT* zrp{Sqj~cpuV0vE~IcKrt#gh0S!57FP3e?nYplCcxwhq@?77$VB*<)T?Bnq-TuK7Y! z9B@c7iAy{E6MTSE3+hHV7)I>w1*>f0l-7<*&g_szN`?2d)hA&5HVVl{AN?J&DrIrD zu(axgtGZwPh&&duEQSk67zf(;lx#kF1p@>N35myoii#nGDYG7{(`q0XSY})e71t-| zkirYIx8=;6hDMw=PF@M`>*J@*;_<{!B0-zc;Y8Vx@<2qB@>*#x$IR7}6KWUz2wx0F+|kGn zj**-%UwTDeepZ_RlFW;BpG12`n>YVFK`NBwYlWK_)*gMX*H9<9@K22OAs39@idqI8Fexly1IlGhsp}qmMXroot#1kqojDS=`6W#8AR3AZWkHM!cv7t_TY#3o_c#vcv8$h9%Y8R~&T`tz~ZI>>S$uuM1n>;OegRidi?;UsK5afm91)}ICSpJx%yF+e~S|XKEi0JB@JmF z1=NMbJ;w_;JoQhAyhm2f9-)|0-Oq5cH55_<#k=lwuN7ms;%1{}z>?Q)o9=b3mcBX=iVJp+(T9py#uY~c9Ii7tn42}30F-n|Db zSGsW$^`6C{XLKbT#@X9y zuzC{rezW|3edGH6{tn(C6Dn-*>0$ws7BXCvS1zuRs<7SG?V@kRQ zdviq=px~#9AY&LBj=#bP{Q5jHfyt4<@wWID#P0r!H3R$>wmD_ZyxjR_5)9h7>)}A3<#4UH18=Ku4 zY~v=H=B-RGUK%;ned_Hxk2=ADIZ%`6FFr@3fA}V zS*LB=&aAX;+qP}nwr$(CZQGSLD>F}ZpJ(sB*xyC}hV{%fW6beJgqAaGw+%^P5GTGWc&w4hVj2+WHh#Hw?&cuUYpE+ zkl+Xyt#>O%c-LbCW{4u18uoqSg9NNf$A;2{WW{4~zJwm;yejFe6NxQaG>ig5K+Ku1 zYHOz|lvHN)G%)PZ7USN#IJASWjz;RxwSA_h^JW5iI(zRdR-R7}FY_Ed?R&cBv)HGI zQ^_H_c(vWHcP>8AAqF}b!;c!p>kmD>4p@Ahq~dzNE1J8a2xbPw`OYNJk|ic<`SjfJ zyPt;s7O+i*vfdHF7SgOt3AXIt?3`JyUv0b=aztdJ@lIvJ+)Px@LTW7d-ag>DA}cTR;@yvMyHE#_LOl*zgt{y)L!@>9uN}%aMVC**rB3o)+u~!-Q5?o= zB(e_L`}y&Ny`u+D4BJ3g>N#YI*fwy14U3+pR!8WW_gthRie=T)%gSmL#tb*&mWb@{ zJMO>9M0lZE)P%igOdVF9q>zXlBR2k5v;r)uFRDj*FnD`*1y2U7R?Z}x^cP78k zy?!-1PalS_=nFGbC8ftR2?^8IdyTnT(Y0=~ zN-FGr+FT;&^WR(o#?tWF-fP9pQFL$QYn?%3_$=(jJU&p567Y3cW1k!EeRVsOUwPG2 zb!qtQsR;dimd7RO{@K%_Pw2s1^~?VFVlw%TTY{`9l_cM4@gW9RSot#2+2UB4{Ya?t zU4(KvM~;EQb`uc*oT|Xgk$;~WWpIwPR9x?rm;r2{mNn~YHL{;BBxWI!nz=#50`@Yt zzYcyNfR!R|Ru=plp*&7Y56;_M%{M6%!j4mH9&YKdd%ujkg~yUf6u2ZZ6q<@Fqn48_ zkf@cmr=oSV*bVWp4QQ~$>KZBEdnAF-S$ZZb%Z-M5beCT_8MCI0WJcMwE-^2tOdpwts%67Yb6_| z1rmC~v>hw$*Wi7{BqJ5co5UCR$3+=b=8N*N3xG!?c9O zk+~r(<`h5O-3y+Dq3ap&)3xlbCFM)L;BSgxcBSY-gfBu+KcqkZ>lK4KHQkjsF?bIC zsZ>;$CKOBLBLQXsDwsy{xkL6Jl6-k!UCZ*40IrSC+YJGI$*?x@KBsc-@~nw1b|BWK z>73-uq*i)74_Zt>ea`n!hiC~>N1au23p}%m1J1M#3|Ylr_uq-IaF-xy&dqeJRxgbP zb}U)*=GWNS z6av+(5-55Vf>7RKaP;V`;Xiuoy*fTFh^YGW%Z-a>9A+y0V=}^SrRt~>o}<;eS0vMLt;3MEe^E37#K_Ez8RfeFjkKrB8HN# zB}&$Ahy94u4Q<;$;>r)cF1iIAPi^Bo`uGRNQg@gTz4 zat$F_U>s)%`IaZZcLD(RyvyX5fjB}?=b0kTDHLxTQ{Bpt7VS)hzZzQl8uazu=Z`|e zg&t$pqms~}nCfj`wI1ADME-cIpcuRv7J$~?^p4;6!uAZFGtcN($+(L(747|KW6&$ZWr zikk?l2&D(lK}&}g;+vpJx_mZl>N{SquvCoVoSk$Bj9+E@{D!E{x2+AYxeO?N6-T(} zv8TENR#c!YtSF|jrhO{g61}ikj?=e5N?YodkXb;Du?>lDEZdEr>iESy9oXzXm>f(V zmyXn(^^zokhfW&-W2L-Ym7rpOK8;ftlfjX8)yvc1yO(?M3$<+&Zkt!^Q=F1MQ~eyn zfTy8kG2J3&!ogF$U!gMmjvelSp|6e#ogD`?-Ne%Be424O8^yQj z9)VpuQfB>wgB(L(XMhJy1Tts(mCk69Y?c7K<8%f5brJ3-yHfM}-XT$#Sz~ z!gBYqP^I-mnyvf5qv^70ZJ`_+xmG@hN@s?~2{AAyXS=2NK)c7;)#q)EDRGv}t|ulL zL@@G>G4s33LD^Jl9FXHhX9M%oWEW5$e85o=2|kj0;+}wNdBU!i?mHmQ50Kg_2L1mE z?0?JV|IfcL{O4VY@gMjX#{Y_csrgT>mRA2S!~vL_%1!Vs398LTqnet@sBFc6V|ig| zAZ9?x7e4m9L%;1Mry+piwaevH#S(Q8Q_oJhJl>rlcp4~!bxY$ZNj5KA;jA5OW(1{uXyFTaW0(Ti_Quby>TpMdBV<&7(RX%ykPdwnWDPeOYt zGmTnG!enibaq3P^Tl#ELTSczp!zrSXS>u>Y#M8+qQ%^)`_uQ;^@YMS%xL(xpJu#kv zdyvD36to`dqls-(uZo*OoUT+-Pp#Dxt5~vDdTX+JyNp*XM?T2AQaKG%!#rlCyy{0USB_7 z=J#$Zzj|%)Iul%i@E?hyYd-1nLW!g5r-`h5ckI@WK}6EUw7oAOc7}(!j~$eaPnGaO zo|2-8vCAfhPP=C;8;7|MI0gq!*K=|ac8Q3jrwqM&G5ngws<^3_*y*%|i9Mx6l*1e^ zHbCNF0Jp|1x9o0Ei?3?m-Pe-0le+S8!TNx5G-yL(oLU;Rr-H0gk+hmFn5#u*uTSZ= zEM0!OH&xv~?0>3QPeNEmrsCKIcu!Ajgt!=;qbtbit~@YCI=IZMlKPpzc4qxUx(I@7%ksra3iAW!$Cb& zS;ABCHFJ@{f)h7WxvV$tw9a%VeO~0pN>(l4ZM_ues%nXbHi;I1OzgId0Vm#kguX}( zrLXD%*%K^oE3TJ3{S|H*EWFsak$HM_%klXm`xJ3!R+lpFIAbGPbdQBJn@@;E!}_%tq^- zug-<|gGnw?&d5!D$>;xY)OZ`5TJ+ygel(t`nW8f2l7hpZree#90CVfvYq^Rg9@t?H zP9Pj$0@0r!L&l>P*fW%yF_2nmfLP%MjfYd@s%sz?OrBxE_xB%3BY+huQ})L4EE|E4 zm|#R0M*}btajodbsO>6I_)l-iKURvrH)ui zc>obvtZ^nHHk@o(Ck~UfJ!!1lI{j|iuAN1ng1JSB75eFlr$0feUT1w!RzD`yKT1uM zN2;pLdmBuX9XMG=M{9nvbxS97nPdbbmyLoKx4#=wQzfjiZ|o!3c&cH$Jy+Sp(@ZJ* zW9$_&!}v4$(zEqFd{$311xBq|m# zcOjIp%op93tF?JR(x$eL=UZe>`Ods4zr~LQ->JXE4>%5 zuCMRaOgjwfi9v4HM&fxMj#Y3as?ngE0!vex0@(3iE#YWu4d>t3HCFZCBi&|ps z>svOJHjaX9>vVwZ3JH=cYqZ77E1mpd^{%oULRC})cAZji9N#8V!CZKr>I_MKVT?(J z0p*}17>(>Pv`#V7p62zi@5T8TrwfVf?NfQdhFUQQvk^RsX2PzG$x32eN)|;^NJLp( zc^cL0hxVZU>g2OsP_8FE%?^lSE0hfDl9XrV(}t|JOOrkyHl?qPS{{U{SCt;n&}IzB zrwSnJHOxy%t(z`K%7BDGE<^=V;dhj3KGi}5Qu@?ORe zMXIPlq-mvde`Yp(_6u}ni1Tzh-5!;mbH}B^qS6v_c?za}o`(i{gX!c_127wPRdb$I z8Tm=Hyz^+_*pOM82M0tZxn@I*-Sxr?UeG^0={1K{5}shb;iOV zLz`%P)#6MbvHi&u6tT6)s@1J%nM$1vyz>xjVcpL)x8&sb^;5 z@In*fHXe4^!hR?iVA4O3SuVGvaLc*<~&=Fn%Bk;h`^Ksp8xUbS)BIfbVDj1uI2om z`5j4Nfi|@>u{)XMZj#H~0qwimN*G=;KEdz$rNpLSVsWG43cgZE9q(Mnvn(Uz8ZSto zzkv{v^n#}f7~C6+Co>@(!+oYW;8V+gzbMy8UD{$Tfbv5w5!cikf-*O0P`VbISZF^4 zqE*C8BEO3_hPJWA9p=nj6L*xwSf8qznS17L=|s;s72rsa`!TCP1cqdF%Vme%1PZYL z+wR-kiStBbgUpD($+NPrsj^MEmURG@35C!-Dp%#h`RYtg92W>^p^-`uSd^2G%WBsA>>UcLcB-d*@g3}qdW zJfb*p#%9WmsJ@UL5W0E!D*L<+?D3IxspM6~%qghOlGhHWXcI;rP;sR&oYaU6btf#NJjO;gO82CRnXS5opf7y=8t ztXs|4#$OfL?d4*(x|CY?VGWb-AsiqPzKI#f!FQP?P(z_fKwCGSbW z&>6?$Dwgq{tDbXuYG3Kn<$d8Av@s%7$SSRf#G0?70aZs%zUK{*mi}kmkl!!)F!hg*otS~C?dWk6fQ&5T`gjTPuYP-o26sx9-ioH2ma*Tdlx zK7VLi!1w55LEj>rTHncTG`SmQeE6{#jAgXx_HQT3AV)T{wy@|0HZ|F}nO(b4XQLaF zc+uzl?y*wtjEhwjem4$hJyG=Hvd%oR7;~fVI?cWyZm?{Zdtw@nAc50W#_8EvV94e5 zw#2?1?qQ#1c=CP)aou8YuwadAU?D>hju%Y5r8-;?LftBG=FRP>;mSdq>l2`F002&H zsQ82V1)1TJbEuD^OP)y3=CBLl!7~hN80eXRUQDf`qSu4|R*TtAkfQ>c?p}7M{>a2#D6RWy2%*;vya~>VZldz;M5V$IgpUL}y8g{F zI9A+Ku~-Udy1WZBnpI39-+QHa#9COzv6Ri}7j{VcXWQ}`?Qp4+!HFFaW=L{_Z`;xb{7Hk6Krxr3&2g2 z0Xr6XM3=Q%EM`2mQfS4kzk=M!MZKFzEazVa$n`;kP2Jio6cri=4NzT)_ z&Phq{@e;WRaWf9ANw!HY%*z9&QL2w&+p3q@+(%Z_%iZN6B}-@JstSBl1wQu zSywD$$laPxtjbcEa)*}w^MpUsq`-XcG+WF9r*uGWZe#02^oA<6iffaD?g7LAQn&){ z`SE(B@BR`0cUGm>KTOR3!w)mDaWMa9CG`*dFw=j<57%gDIc>3``Ti~A)2fIKK>(oh zH+vzJ-O9K+ZEYZl04Hqv*|yQ+j%Ro+P}=8wOh1ja=T^j2OOE2vM?k#B#Odm+?w(^XVd)p z3F~DQ2$Q4rM;v*eCq+D>;&QuHc5Ee%NRD4PqL3;J(`ovq178LH_{!?uxUbXJ|7-ypN9zrx6acvJJG{J5||; zmr}g=v-Hwh$+zl62E21srb0&mO_@gM1V6o?A&}WR zJ0&NohBgQ#ix!QYG#{_g#j_VL+E!dc_5dXygi7hAuZj^Bz-~Ai-j<1?(n{8*k&r^IlhjSP;j4G-DP!3~cf(Kn@N}I;o)a<7 zX{V}k#!Vcl9~gO)S@fbkYI4iC%*Ob!>Sq5im`$)49y+0qL>jE|@SdO5N{HPK_e6G^ z+XtAzR%2L#vb&5pidsI_R*kZROS@=Yn zDB##m?JPOgmM(^r8EkK|&`1$oPbYJaxAXR;r6ABOKD+_co$i}^BVTP%dlfwohat|v5QMg#N+U%^(~nhkIel$9wtxon_J zC}G7YE@<&&GyK8}{k(bZQfJ@u9%{liT&=sv>HgT7bLIlapr{`UKt3#+w#H4YeVD@( zqB!wjbd2NygPjYiM>^MDil}bJ(0E(RC$tYGCix0rH2~c(wMjxT>^O&F1@nt24|+dR zK2iZ>uu}L*UXHzs4=AC<(@6a)CzOH{)>q@pqB@2DL6Qsm-0|9-D+F4JH+1)AzPbFa zzya*xDW>FXHEVx^)he_5y*(Q^7?79SUeL#T?I&>sj#J3T=u$hGgf1c3NuT%2Ed!fR zNlSY`hUQ+L{xAzrI^SXpu>ZinNe2uCqT|wWQuH(*z3F6*Z2){76p1mwAsYyEPuti1 z@#C7CQA7rbrYnplG|W%u@OPhF^ZsHky7z`9L|&d~3K+_QVL1IQYifT$QWDWyP8F{) z;j%1=nmmy?kCQeTg?$;0aa$ax|MxUoxY_lk4^G6R*eoO@NJE>}CmxfaNydXRxO7JFZ%rjLao zNJF4N02;GGWpXnJAmElsx_$>%I&tBBJOXivHX21j4xymx$_*6Kx3s$9eU$fUJh=mT#cddde;>L>Kpv^Qs!CGU z(;VPOfngIs$rXWMJy$S25qYl^Lm6?(K*KE$M8FU*Gm)4oWlG<{%)w!xBG9^7!UO?{ zm?6to!o(;|`*$bU&eR9yb-~H>yPQxMW-MZf1L4&W=Jk8mMTF3^+H5#;$`5q{?C z>U+x5j`q4^KXF?330-k~KvgpyQ2YMWpRN(J znviP>*sA`eUE(;Rf)m}8+hffw1g~-w>^TfSDZp`Tq zQXgsCVoH8k_tc)nA0``8&C4{c8+UcLb1_vyb6kV5$5GxXUAYVu3;{KipdM3d!?z)A zwKGtR%{;S0?(FU`6*LBt7S!P6SHx+AX?b2pC6n;PejFQViIo~IA!L#;&j=v>+G}}! z|HhE{pt@2y#yH@GP_!?>aV2jpmjWm-l9FWdy#~>P3uKzq*lZ)9k?ukxX)4vUo;C*5 zuS@hzwa_*dQgvri07GaM3f_)MkJf3xroqF*AKv$4h=!kqfg-3*$D%IFzq^i#_WwSm zMt=?B)bckt4T`2lxt!!?-?+J!h_mhchqfA(|2IW>4kSr>&da62vvybL^ zlC%VY6ZSyHYA1cV^Y4c1jCeOLosW>cb0ehLspB5OuID~sGE~Q&2%tx~ohXh~jHKGS6? z!8dNdLCQUhz#KDl6yiWZwA_-!I*N+a#MD)lTGbJy1HI#~S>8l;G>5R*+t?hH&wIZx zQ?H*Z2(izL1OX=j=K54#fzmq%SI#*Qu(O~VIscf)D}zrm>dc96&|dTiaDWGj2C!kY z*Y&KOU^`FofUH&*6_ons4b?D1nR)Z$jYNR+ z3vDktaLX9s?wf?S!^!BvtG7`d`d|t3vDVXOo7O!mdr4c5lMz(UmesBaD;R%B^a+UM z10DsZgVG&5%{g~TcJlFTjqy{zbc6>0$D_5Ew5`nFW|vDG@& zYe%1$9BcG+8kn(6sg4Buz3%CwYZQ7v#R?h}-ns4H-6=qbUVxoQXZp8W-hnLlP$*Rc zP_GTWp=CN>XG~kAM{qm`=tC3v-cBO5>sme25DCbz27og}DY+2}IPTX@uKMoY`9K<< z1OBfD{U(E7#6KdykT9` zZk9;jc=NQDl(YCa{}cA>99J=sjs*xM1VDlyjLB>^8?zUP6vo_r)NY3ag>}Me@Q^Ax zuQQ;FDg(T#Qr5ONvRP#ZAz&Y;l1$>-K=ms~c3w7-I}JJ(ZG}o=%i|NN)wXx? z_fsGW=}f54s1%V0;EGlvZ^_6K%=h*sD~^6tps@)<`hvN=yEl_gPY7M*^$IP9j?okb z9`aFxUMPz`Cd}Wed!i_P<}(oqN4Ups7}Kezfy$M~oXv{X)th%VHlsjsg~sIDVXE)yqsID>28U zK~E~46Drb;QjrtnSeRyf%~tpFTd!YbZk5ffp(|kl`)|0G(tnsSiuG@;YkJ@-z||3X zlho7y!1N0D0e(X|wW;7T_uTG_1U>Aoin<{BkqlRX>2+eC<50XP#BYLQu&v^*F+9?? zKWS~<#-rn+#w6f_QL5pm{zl~y3CKocBrQ@byeqt53~iTc3}@zkkty14iyJW69tRU4 z?v@fUtH#NA%z-xME>UvzvC{Q|4fnOuJYSxY)f@MT_DnX%a`(5X#gusdCMO8@) zvplYtJtcMn{}G*K?T}qG)y&c`P8eXbr?0+L_@IKD#UzjNIA|{72_b~83Wcept5>CM zN&)Zy96Ln7>R4&OB#O7Vv5X# zEF}z_47`d2aj~iPukb%kbS>(MsAU#QlurZ#-N!s<+c9|vq%aDPFt^Rk6rQcT8r7ds zp=z3iTf>ggDv6qQyJ4n;9O_?Wp@Ol3b3zgp249BceM5x$=*Vj^#PBqUJs~MYxzmeT zulMa-M85nUeY4&E!?|&ZNg;gtKS43R9Fiui_2cB+cV0}JnBCmD4`eg*bAl~}^rBY( ziYBvPf2lKgR`&!R?GGI8WpL!?Bd86-VWT(I`Xd|lb)$+RSkk!JlTv8jxT8b16i3lu zBuNoR^k?Y03;eU~xGaNh{g!^W!xMqOVsR9cyf@%N(I06HI9bW%v|n3L%<@5fLbI|| zR8vA30Pcx-pI;*kxC9J5qv4za1P>A;`=;Jsct;`5MkDfKP6j+6C!ptetVB2)H0ZIj z!tr^#E_Ra3)MLGC#10&S^$}uxmR|oiGX}dSA>?7xHvaQ)LIMU53k^<|c9o~o#DEcr z{cjMJS6A~O$CYu*Tr6K{QBu8O8tl=$5fQAraG3Jep@u?!o;~bj%aw5L0XC${M-!o5 z1uU^Q%V^4ztmgC@x+wt3}^qT`2RtnfyLK?@Pjnjl9TCgF14Ra{kDr<$H zOVDZMT-Ep}Tv*``rvdCvEjzlmiWV;*&l01jbyzD#V4MD~u@YioH|zI>H=WG0h03v{ zuS%fZRhtz{V6R$tBvx`Tp-Y+s?}S5r0TA)tvqPBLw~_*!PlxmC zT_|8reIFyTD$>XNXDRenskZidsnm(uSm;ne&DoTBa_w5g3l6uzgmP#t~2`~A10 z`TGIP23l0<(xXIf8_!uKG$DW$W4v44Qfsi430?txFIEiI~g90FyWI2epffwJz;}y$Qd0Dv}WZ$2#5dSxj8u4|Mw@t{0}%c z^M8eNk7!E89gQOP&efT}8B$@iY{0Wl^juH*2T4R<$vS4h!o&_Im@5@aD{|#F)n(-! z{-js>MkSh}i=qXjLyp5iUu2oL>m)O%wOOwBl{V*0P7_OaKvndZ&JK9!vUONWID+kZtK z+I}usV(MH$zSZysF{n#T!KBfdl$OUEQzq};J+RcCGNXgiivC(`tY5UX?ZJX^H7QX# zI;qNP8?zLr649h+G}hM3hSEKs>Z{p56|$41Z08jzZnh8GCXJg3M9&vcAlYetd%f11 ziO}{RuWk+n@!**3l4_k1FTLoknUKE?^Q`W&An{R4N`uZ=WIkc^@DU0Hrg1+9S4?Q# zW3H+sExHf|Z%CKCC9ZNl+oS7QjO;u7&-lVPS<+su{E3P-6;7SL)bl!q4~?6Ev;dF_(MQ%JB!J&0C%SqJ+jw!o~dH5Bvo78ywxxgZ8D_ z4on~I8kk_WZlKbLq?h*tN-ZQKbl&5QBS>`D?N|fgXD>Z#iaz;4jpcl~W*s4*voF7( zwV6R7`^j`vF9I3nui!RcPah0Kl$bb=skQ_t}A!NJHr`b zX|0`gTN(DH+HZiuE6}N=S)TKV#xuYbqdv*oq-y|W=|v^torEML!HrOosyn5jKcL-7 zYu(9fC6fnCTngF@?cHj(-t68su%LajD&O6fZWEoDXfXMMZ{Q)h3kdm!0K#2lEW*6! z?7+GZ!PAuQ{)YrkOsP*@e3~>EOcffE9b=irc~V@lSru)JFsp!Q;B}wwebx69*BNvz zXF`kDVUmQfV4YP)6<7GORZ`KVE71*4NAWD~Qa4q{#5q5pwnTC6JXQ3rJ#J-FzwTt~$ zqFYu-i)%QT`us`1@QPf$8RjyH+y`k1>BL+1+T^A#0NIBGk0%;?@;E|0sxoE7UkisP z=1yj0@Rc0I)i5jjO_5X3)cgguwRcF%1WOX+39^`cZ&al$yiiFfQL#<2ytks^VOnFWax#L4DRmOLoR6m=K%_ z4>hVOnW%`e?W}?#?{g9i(9j!UqJG)apl4ow_!h7kGjdp;zC*dB=?N!f6qkCb_lKf< zhQ5tZ6a`tn1PTLX}FU8WTgJ(y%|ISLr(}9@TmJKEN-?9;xA=M zU;bKjpF_kY=iVTljc!2}CZOr)mC0Pc|h?KEfhegmG zyedV==|W%_y&9lgp1I)X3qG4T{j!*7_ekwr=c3#f7_VT+)W(m$HSPkEbwe}lTY&^w zxxx9&nC@vS{DjB>-v&SOGM~Fad@D|3iA0VOr@WQqRF-1VHBKq}WRDC6qsS^5D?&M} zw3L|V2@Z=L#bri*)U2H$XF>&u_Q9bm4owm69C1EXfOq}BtB7F{J}cgp;XA7qa_Hee z64%%|$H<8Jso%}9nzaG1aO!_7v>f5{{Oy!>3V^D7F)keT+^m}KD{ni)6$+u)t;j$%6m{GgV^+FdWevpIBwT7#}g3c@`YDU&35tG*w^9fC}p^ zvse(0PJEaWgxFZK;IL$Mrdo1I;hb@TwlPTVD(Uf7Ud)sOTo*4A9gC)*uDWZsc(R2N z+@3Wk%Y2RP*J)ywpg?HwvPV-GWw-J*@I!skH&QWz42z=Ip^-Jo8*v@4ua0GMS$H!(Q{Dyf(OFbIj^Zg05V zBxmZhOhenamT5;=rIMDFw#-4OwY;l!cB+G=h5!`2hj3FwgLXKTqzQDWxG#xkM2t1es+)1N$`zhzfixCDd;2?0vAz}{)l=Ts-gc1|yslNi1{~Ek0W5%I9h8$(%wwx?} zDQ2G;kr}O)6O*hgo|k>;5|ZW!lEGB%#1+=%5rZxe$0-7{_nFD+HAS+Rgre)yocgXVG{w4MtV4(Q5K| zV5w80a-LBvypN-@1%6mT(B>jVkF$nlPWT3J1V{vYakf=)^I(FkwO-bAS7_N(3jA|K zeIEw1lv8Vn!+GcJdE`@5zgKlMOgYB;Z3_hIGWyOjoe-Og8yX^|D$T+u&+J6VsAoE_jExj8)GHKhS)jQ)|9aeNk3$=u z#+9<54Hj?1q&It=>9x(OWsR74fJs*!zVglE*lNRX$m2je*GM*f^VZC6vp&^(5H=)yp*OY}-n&Ef8-}qfaL1?8KLU4d@|n*Kf^c4(&U)Bhg0zfh>onQBCd z0Y?u^T{)0$l{te*M5!s>H0WspD)*7zel}k)8&3L{M5Rr^K9yTyO1uF zOusd**QZ8SvQ>Yns?qTlKaChVmEa@Mz^Y@3ST}S%WR7hdqFV>LaKI07N7WlP^gdj8 z^c2_WdXHZ(Va6fz&F@7~9C)BKjoeRuo{!+0UG3qazxs5gI@zmo- zeaI^}pD(uZ?>8)Szm&}^ww5Cg(i|ELpBfax9601x_q^)nu4~$w4xaUfJJqo(^H5ht zKHD^8fFjO45dpQ# zyO(omNr!U8^ouA$$ey zq3VB7KX-Y>n}+!E7t^?M*(CB&9u1mCU&T3swQIB6>@D|NWosXky*b_VVCR%u*9I{{ zNoy=onIu<7ws-M7ew<(T`;*tOyN=35?m4sIAr5hsdv;n?i;a8OHHYJ$QE1eLzuQ!( z+q8CzkE}Z7_*rkQ*-G1`V$@)~o#MF1j^pc!fMN_Bc+>MT{4#Q}rZM|S17{@ng1eRg zJs2JZ(-qY+R!jtG9`{pK)feKLNF-gDrLa?l3CCo9*Y* z`>e)#?P;wd5$xTmh4euGJjB*3OEj2*)JwZcqk~;S3~qe;spqm-o6MK;@m%(9^R)}xNPw%bMl+KcuqykR z&eZE+_JmU4G`Yjd*hT!?NnMo?m7uY(?i_H;adzDD^twImEV(t%g_V!i+P|Q-OJT|t49+9V&vsbeD^){pwoEl>s*q`}uu3Js zB|)>|0L7gFqzPHns#H*zA*MeD8Y$pi#<#bsv`H^YJFyBnw{8 zz{yi!!iIrx77MThO@GM==T%!qK6`5@i}U~~_W4zDh~$@AT%!oAY$VyCCj}!1Il4QP zpSddou5n`u3Y^;!@)6}&wn2+I6-X8<7`mBfpL)>^N_#rI52jI@M+ed*jN0A6Z#U(B11>a2ZftOjyFFfC@5$}~ZSxX)xDylZq z8jOUkeveyn)o>MF_Hi5ShCGNUaSqbklz&xxxy0R~f)&k~G7v7y{x|cT)ZrkponF7D zm?)v?4Ln20L$0c_BOn33Bo7|pMY$lyRl3#CVtVXw4&|QQC}1-|#(`ZWf)-8zbqsAE zDJ-yTV~Kt`DEO{KGf)+umk}>e7V~u>$$M%}D#^fu!r`cD+Wg!iuLuuQ;M2jh{owWF ztfad;`35<~!|4o&5?dLj63qZG#B7K4(;{+##paPdtX?VG-E>EZYAN&GCIAzN|4@2k zl>eRp&#o6=W;M!&u=uRJx&zF}A{quUph;Tgm-d0?$Z0V}fM-ddPrDX{hCm3+Pq**$ z(dXEC$OpMW7*-AX@nYkmBxTT_m_ds_t^nQ*DVE4JLAq7Acia?d>=>v$cB(QfUjhAa zg?z^i<9(!`cDr%2fRSI@K$~S}D1}_0B98Jl<`Z!}ay=Dv@q8p5pNrx12gBTD6O#nX z@0S|kXtd}RZ5+`#zW$2r^9wy|lrbLVA4nI_R|9-!Ra-UMmIiME{SmckIqI?6$OHRBYR} zZQHhOr()Z-ZQZeriYm5kCtbbY(Y@a>`uVVb!u936=2~kWb82r$H6>EhwSaTkxLN9q z#5L%Y{?uj0>59r8`BVT!GMykTYerYo&dIeWP`oLEeMq^JPi87H2JIUWVhQM6~w01HZ3F8I1mb898r;3}Rijrd# z+m^(09MQ&rfRR0Ru1wkxG?OU!x z;UZb?Znt|s-)_)`{n%>b8|xv&-2;S8MUbxz4>z=*n?eiHE(h>Jpm#~ItNI%yxbCm$ zT6XN#$Y!Lf9IV%Q$A!%8>Drt+a9I#dVtiG&?`}~HV8xeuu6rvcwy>F*vcVZwDp^;L zXd^1x!t}S~!@?#wO{lFKsubv}g>5mO5O|{4`h;Lv!$RUDa+7woL&^m1O?dFv(-rR0!o)C0Kc`se zMaiA273C1(yuHHBj?yVcA>Z3atbsn-vLnNuSCB zfvOI^F5SQgV3u7H3z95@6BPL-u6Su9K{)_FsAwh(WqrKOFVGuZgU>3rD0)G^U@%xLt{y+ zVb<`!4cch&*3~oRi%$QRVPXs|^OSD}!sm{z6@LoRB%H~U^9GG~t@MKSecSYHl4bBI z-r0ThQUn3>UZ5svO*rb83zXB*aD&`1Dh~Q|`PX%d;$u)g9M_23ew{5G!PD|RL`v<_ zM2Hgn(yVqw7Ce=s-hMs_tLCiotm#}2uC(#a8idvNE#++}UQ+DUnFxz41i#3=pXpQ& z@!-O=C%4PQt0AFsU_?xv)8GTPIFYShN{cM!{>WNbFv|lyCZM#deLtfS8=mbmbXnd+ zHI>x>vv@ovNfxh>T2ykU%Hw#AYFvNN-%o106V3|ralm6d#bvFI7jR&QxxRZzI7lo_ zO`M$1LnTkV}j0zj5DXItw)py_b$f6^0Dd zXj5f@!K^sDY0D?tXG>?hh203H);u$fx)?L<#CuAmvJO{PZ40Ux)_Uo1ysH`9u;?#Z zH>cRxvSro?O6e0N5uPN=v*-3pumv*~XqWFGwl@(#VD846xL{|#s|jv6Kf;IC9{W)I zIHt)z+60N)tT$yvlot)U;0uOkn$6AJvL+!EgsEeQy>Z#!iffjIoUXSpo$d|G!Bo>z z=$SzEzpA0Xf}uOa(|KyRdK|a6GRy`3{q8Io@f;)?$gfeQ&^U3m75pC&|Hym>_A2;# z{;iZ}eMYQQvE7F417j2=h}GM6zo;MwF!*}AgxLtOXtKe!0O(c6HU5>-E^A}7#YRPC zQ77t@;ThU;9ly@@G;LUZJ*J7zZoQG#n;gKT+z-B5LTl^$j*KMs zo>&jYVn4f|F7lv+hZnqBNxOF)*`9hf?P-HfQ!Xx`_Pg57BM4 zs`hczUJyHf)g|#z@J%!MZ^uY3mixopkE9YDu|_l5SY3;Yz=0L4c0y^O74~hlJ$>@@ z3gb&E{SqE8~t} z?~Gc{KR!z|H!ML#(mB35uOL=hAbGD`k;QQD2vZl|+?oh@wT<{VtFQmMv-J{~^2!t^ z^txZKgRD#)53iL!yAC3ByiY$zq1p8?;J5`y43UT=h*`Gr?R@&Yw40Hdg>gi}3@NtF zkkOh>hdMUwuI~u`x>o5j&O0BgKc?FK1{*Qae>&&ZXU11XwM&9XFA4dxr@(;NE5Gcu zHZK(2hJ8_HK{nEQxmIa2#^N(gp?s&JS~z@qa+w4|&GA~$KM5^-&ty*2sDaGMTBIYvZ2Rip4?v6e3YV>{ zgB-+`5xQq{1==qpz(TyDwzUfbxx9|QLUj278%X%=K z=cJ-c>gZqBc#5)jKf3kB8%ByR;!yq|uC@b(IOVY0b!Ls4WZIY#5B6?O-}uAyGE zN<~ej6hYol-QdPZp{QTmkx}NDvrvGcrtNltlAdhZ5<>(Mw2STsQ*)=P_-X23I7N(y zV62d(DC=@LFK>@y9^R7N{8czf9+k4R<`uJ}X>}Ub@H1=fqpaME`OSU4r7aj7Ldkw~ z#sIVpOpLk;ge2NuU2W=c@Pt7RfPnEuH;DoR@GPE(1ML)>P%HMmBjQ`#XCQ^*nD~-7J;pWJL%3MXGVlzv{2x5oN43TH++{;xfdU~g3x5gu5XD~=SPS-o!FzUIb@VnMUOUC)1zZDv&b=nok<1F_M5{W_WWBl+JxX)+ z-l)=P#Z~m`Hit1!wCzP~rgDdsC{Qimn!!D;H@ZdxoE^N+TLnodu;9WT-ql@7`zG52 z4fP$Jx~tPu`}0qxK5ME|#eY_kc4LMti#IB&p1qlOwN$6snZ)I6p7U zh|rPy-FtGq{Y$fY7l)h&i?y7UV#TR1hkzh`WY+FvQE<7{lO5x#B z))mSn`-P@2mz#~uaUH3UH6EU;tnEVM${R_u7hZ?2rgoiIb_Qec9Zr_I`wZYYoV9!f z&|K&(2XrCvyW8H}v6c9UM*GXs7dy)iwt6g!kz9q`w=4+AB^!8xzR=T@t3oQvsRMo- zdz1?o;EqMUp^dhK_#=`J;$GQIf+XtFf;0q%I&^XrNsV%gi zt?1?GjcRO|talV>ym7Jk2M+ZS;es-_@~ADV92g|BStHlpqnb;pR`qp|?4fCMruoEx zd0B!WcD+uW+*y{!`@0QKC6=R6$^_Mi0&G(CUb<` z=UCY%h%|{}8R256G&;0KLMu#4k@&)u^fsT#YfCW8l_gFIK%J|>pD7*w-8-nE09X(U z#@IEd67V}A@GL$MC`+dnF@x;-cuJu*zuBX5x*})SMj@UIJ0uBSD!DInrd%>3cx&Gx zF`gB+U-(6JKi!GH{^iKZc5FM#%fVMxDw0)RfSKM@Lu*s&kiE>GvG>y*v~DT8fO-c4;xW&3!`y0JsKX& zCD&$kAg7AC9lZ{T&^gN&^JyUoUx)fDMWw%bL^m*CUGu#e2xZ!l^id zL7sES-RZYVJ(q>UyEf-&R^#>%MM~F>TyV6*o$Bbr3oLnFnkNedVhXLWIjERUF*uQt^%m2ysFH-4!sFLP5~RYHIA3DKe1Q576~dRBQatJ8 zr$OxxvNXnPT<^BUlkkMGiD%l|__SxaShWw;=?P3CZ3pda~D35Sqjq zes0}fR<9f)45K36&-k0SVhUz1H)75mlwK0A=0A?6HOkZ0E&&X}e45*H(=w>gVPGeg zo!MT?L%wegh#)7(xL{J#d&ACr57K?zD)GG^NskU=oH0-=b5!w;gCZ@wv)%dKx8+># z-RY&?fuls`N|td*e!F|e8SQK6UvzW`R)z4n>!Xz2PUH&!S(cx&d!Bt5|)`6;Gei6!?<%i=^IF0jdR<5+!43Wf< z{JQtU-qXD3;JS3T`tmG|EeN*ysIt#?vc&xNL&07vI^T|r_Mc`7pMPeL6KQ(?$Ptp1 zMD`){L`H&AXY4*>L+SJf5<+rvSgT!avC6in_Lc{iN6zw;7GX(z!!{{z+r|WcuZQN= z4Dn&iV`4?lAeD!T=AAmaK^05*;*2eJ9B?6zV`EXm@l3gfx>qNAO)Tz#(}w)N!ztSZbYyhgD))W=%f( zzi8oiwB>vK6=eD1wyX$w)z7eX$6C@p0UEAfTg1-ZNW=q$4FULT9qT|1LP$uC6X9Pt zhJHNkPER7~OecpyHbL@*B(%=Rm%16_P9J1kqFk}X#ZFZbW{2Tnr_>FwBWZ4GqF+&13cE>8HKn| zEzDsY+5GTcMQjcF6r#oZZXgjM@N;^KBm_BIij=`;_%O%wiskdYaYB&Cj6s5*Iqs zLbZTfbtd*-%Vj=PLOJF9?UgPLMKlKH{fLw$jiaGvrXKsMdHMluc@m~;em6h^e%=rd z*nmoK0t*8Y-2=J4=Q@#SrJPas@alwsR6i51Tek~G%|J12u8n&7fukKK)4TnSRp{H~W6*A47#^8=s7J6uD^lW19f>fL_tm!ru$$QEc;xxo5T?_L|Wd*Iux~1AW zGKPX&7p^P3euK#Sq2YkC9Hj++$LDVc$#&!i@N)3v4OC+KOu#Pxkd!MC?4(gHX)aA4 zGx98}7j{HH__dnZ9b_#BzV}6D;39^%9+NInAT#ROdgJCX9IAjC7viV8e}@_3zv=$g|B*Y*v6@0y0C(>poH?@YJxNh?wzXx)0Q}WbNkFh6I}Q zt6r`^CUiy>$|dt#04?%!7kZc$DKPw10lXGNjMB4ui#^Jni+L_v=qTzK1#j4%rqrDH z@>1?3#uZ{UrZJV|JRc@j^KABPmdDV|mq~_RzYeVZGx1s%)1W@Bv{tdBOHj@kgRsDD7opZ34?4!|#@*TJr`J|9W5U>2qKngBLZ zc$8`mCSEB7Ntjql#a4APqSfl{j02#g&GA4Ln`9SaclQ`PTDc5t*N{eG2kltaTd}W& zsgg*oHfk+P7LKDNFO?HZ+=`>!;ZBx1t}87(Oz#IN8*^U8k(r=x(^WT+pNNjCys)2# z3r6@`OzYK)6(hkE(CKh&$lRoitDo3~T3w+Y8b!>kvdQ}vHZgq-z{I4^gO0TDkZxwJ z>+5=Kd4X>MPaK3R-+MK_;>EWIFeM4+;3dR~W@nKdEi8bIP~)sD@EYn@A@1L{7gY37 zMuO4#4fvfZ*>2ntXd`+_6e4-S$%2lN1qbLqf)(R2l!wh1vnYQ-9^`^FRIjFFt-BEX z_UM;1)^IpMC%iK3cbT6VgsO?vQY1htvCT>GJ6(Oct?;}to#rTik;(ReJnxLhL9kjH zXfQGb;tTbJ`_d(9r>)~NHjWSL4QIhHf^^g1W)0*^P#!A%6x6w&Hjhd|vC2KJ-X4_O zzn+!=k2#5#-n}A4_M(b>J~L-Gv<3W)JrBMt9iYT9tZrEaVE?Sz|0?$*HHRd6aD&O#9|GFf^^9j zz5-c4@%zEwGS%snL9!ge#UBm=Rk;n4+*ueqx+J)LfXTNhTK^A%<$ueN{}L=r%>V5u zVEYgJ1>66Kzi8E-a^4U}-@2gj#&DDlSwH}SyUKB5KB^p^{X01=oaZb=N=ZZnj15$3 z**nme^gG7|un-$wkzTE=FNwae_2P8hdBXl0Dn?|1^mXyO&Yc1Y!2RYt_%9m!$E4L{ zCqJL|tny)bq8fq9&#{-QF`82bTqf1{1dv?NtCjN;CU>igE}dx=N-?`iA=Fw!e^#tP zz}&7K?t~2e!KERUQJImulLwX`^tu?-vx9*~x62JLhP*LG{Lnu$w$Y@c*PQ=wp5Sm+ z_|XO(XJ*xRnLX3gmVuHIAzb-anS3-Mp&Sd#1?e)Xo4T4tox}FG<+GbkLl=M^dqwXA z?ZUdv;T*gslDIG^+gYzcO^@!|=Uc(VO_tq>t}*{|uA54H^w(8vDN8G~pc?vel_3tU zm*3yLl&142asxLrJ*MGfYzvHLFa9K9p;4}nDqR}O?hxcvcuDQX7#c;=^Hf@;#8NwowNxNU0 zYJ}kvK1AR5`?H)S%0x1v(C69Vrvt|L^+(yi&-VrN=#WYx#W(LR9Ud=3&iaT_!cFZ@ z6G1R#2+tBp3>&49ZLTHilqZogtvoQ*tUCvdapEY;#;ZgDinK9oqTF>@Ig)#j;WayI zqwHH!SNyA^fuJ7(HVF?QsHfyWZ)@5;$TQ0?oq=^F5+{R1ESx{zGDN@!5C75NEF-+y}3W7LW8UUB$uGzl0=8JuuELPPRKHR_y$(j~<3`|voh@vHCTQfu&$7nA4eLS3fq_GLtxt8DCn8QtNV7@SH0M0H z=yT^%MXbK=v+GE+ULdcJ1g>x())zyzK+m^po_cU`l}g<7Aip|`Td^=kOsl1X9PQ7T z<1X=KWQfO<2WJ1OOmv)3#)m45Xz`KrG8MQem_d^0+%V+G4vmZ4fNZais_-4-QY(y| zN4QwpZr2;C-MkcM#3doedR zP?OrxnXjsdFT!oN?E~Mem~jua3;gibsk0q%G0Tn;)$vf@v4g1gs_2%sJjWBs-$Z92 zK|^3;9ST;DB2`_#+I}Di{jEW`uX^?2`}9E!dL$+s)S#p2E%te;77%-fh^9HEHBgZg4{L0hq zuo(@rIr1i~*;nseBM|^^UnL7+N@PV`Io!DaJ%Vk_9S&jpD;gtEm)wfI<%+VYs!1%_ zUJo=ZnZAms*w`jg6&AJ9MKbkq5O1m$`t8}U#iZA6;k6Qi{-#WL!U8@?-?@|k_}@#( zX~ZSAby}<#m&`b$OB+<|3|gmI&T?8~df1%iSKq|X-M+(M{L6YW_;;Vlg>he~YkZAs zAB%DZai_2fsIC(03z&2WJxV3yhpW%3`^dGzcw!|5@4nHo1(Bx3fO%|IBa&o3#iUUB zXvy4{AnSoVv~THI2?u1@c16e7McDx`HOXfx?n{^OII%CTorD}D;j^IdMK%BiA`K2-t= zh5SUt(&*z8*A(QCBn5Zt0US)i0mqGPv|DyyM~Y)z5C01fEtz?{YP40x!|05ZYJtmZ(-v`Xp>P4BQ&c5~#?IY+6i1+>ht&DI6 zaFv4Bri{Hb*M<*^lAtiD{$?>7O69}?B_pP~Yue5LGGSZU_$t_9QPx2)iPrj-GGS|` zJH;(-W7kcy7nKH*_#cR5QR@=kyI`#UPf9$pt_ zf#bL|Q84CYdVaYCC({{Zw-uk+swIRyYCytr(U)`XDJS5WWE318B9+uIU?icq zjqld6K{uD+``8YF?R7t;)4iGTaUouhPEMWH7&wC3u|BKc#msSRA+*Zi4F$d8G7Lx!3Cm@f{ia#i@L&K+{m_?s-vGG| z<-xoF1D3f~lmZ~*?_)T%wHsfZ_);0xu3Q}XdZxjIx|{1~@y+bOU%~ZJ`?j8GA53uL zuZ64{Vq<3N0uk}J6n3_U^oKb87s>9)@tC>s+iDrjmc+W;1W&e5qy}Nx=}sn+#CaXn zI$c~e7B6&3oKqUHe&vbc&kmrPgMZ79JJMN*l-v&rzo82&m7v$1%&PDcGVMDA>X>{! z;v{8tb||}Pu?omZd}0#wH@FQL7#{5OYr_@>Cx1CcX$Z~P7;q~qv@+1^iQq<#_-}z4 zGvSFYC^b@=Wqq}(^H-svSoWD}M<`!RP)e8@3;P=g#jzFr8Et^&F(2Fk5hjxsBO8}O zf%p5ROtvfne&I>~tFHyE2bH>>;v)MVRR9x6WQxMdJBB!A(aTO$@R=?!iM*^V>w3GSH1zY@-KtcsT(m(F=!lNhSLZGWz*d>3WXW|Je-ckLWQue{r8C5ZB z?IkVC{~^gC!`{+b5`{@KiJP!b@Co`aq26K6Wwd2=aTfx4x$d-^!68L+(FFw$-XdUs zuT4So0ADrumpfD?-mB@)r!Ks8{k`SfArTjpy+~|dNrZ{hA=#ZOJoOIBiFHDc;H??5 ze9Wh895g>_1qQtO=~_jZl;q7oIm1V<5(svy1jqDaYp75AX8`}pRyMW^PnYC_fn$f3 zZ+ODUaaRimdei|?&j4`VQlFYv+|T{SyMOc8f$r86P!Ngc$~?otRXiLxnkWJc1yqrvKvltbuhsip6L*x%7{2|~X8m`w(Pq+KKYs{X@U=t?h zje|XCj1|c=x#V?LZV5lU%Fg>fEG1sfzana5RMq2S!ybHeU(@U#QzE-s|Ly)Y1|whk z;JT?8&^mqdQig|T#&o1L{Rs*X(@*w4tva@slV!VyZfD&)z0Xb#-rUFHsG z(uL*bq>gKh%UCc zFcJj@GK~s_^bz5XCiAK|&vGquxcFd6#sXy=!_)i4#mQwR9eP8=yV3SA`mS-P;1Ha; zq`em)I-WS?%bYYXTY^u->u()zkhUx3;QfdFiDZpGjF-?sz|Z&VduzRn5+kdMHaGC( zPmlHcz#*BH$Kl^h6Cd8?Hz1}k#UTqJ__sT#pQ{OY+}XXQe|^cyY+y+P4&wYoloYZU zEshoywZwlP!ePX<(*DZTzo;SHrj~tWKdCrFKn4+RB+?-N1*6@?{EUf zO8+Hpg04;*~Fk=r+5fM04^r?!l%_ykY5*}=2$RIk50Y%JQ&y^`uo#sOoX(Mn>kW%e^V8^Wjv%N&Xo@ok?L$j8z3fpe3(llw!vD4nUkC$;pfk|g50~t zQ}yHoNgdoluU;yEU$vCTz>7c8ZZpdwc&@0~D4p9( zZuqYRHT_0iSFx5X+MjNG<+YfcDZ#s@tXcX<+QySHAbnyF$gW@tEJjCS5muQ3NTyFG z5S-csjW2Db$}L*NyD>41aMn<80X4%~7AWR5tA&QV*yohoj^k2BxlL33N-%2nFgVj1 zbM}6l3og`52YnG1xt|9FtOT#LyN8@*9r#$1+_gl60z~#4J;Nk>)k{SX;_zscOhB~( z;sGDAM09L%Tt%@Y<#T|!RdIZmNF9N^ML8P5M75!j`esPvjx@}Dvd#1*hQW>I=?nN;9^?9qlP0_Z zJpWarr{hxX%rYZ$0ThmrZ0VpP8-7$?9)D>R8p!tLrB4{|3_c;0P6zFF6;{fsQ?=3UKThzm zv2OU0sN@0=3B_p**ZCwCugn%5%e(~lGko6zU#mvNt33J9dk)G#^p(~{`Z#Z9p44D@ zTqv};*dDd83Git!BOZN0OUSd^`sk*zS#sAPxB;IeuPy{4X$V4d%};u{VZRYbHqrM5 zmJ}j=GDUe$Tx5U(vJ4<(l3;r^0TX+q2AV;Jw)%-NL{5>@+3{qK%pJ=!tm1Nlv5>KKiaK=$ zRc&^wtA{3xlJ`j;0yL)#Njb(`%Sdi|QsN?3t9I1ptw2BqTAuxLmL0?3Mlmq%s!o^e zAOB*77)pt7A1Yxg&}?d)6V7)LMhmjF)gfSr|j6(Obp*bua_o}B@A=Tu;b^UAWV?rHAr!O@S zaR(3zAA-$dY3D5ikr5=I;8$(e2zjyB>pq(pCL zA1dGrB6U9Z>{y3sU=&e@88(5PK?wT@u7ql+qRF*3MO%d7!9xm*HW#kj-?Ga#+u%k% z*NGVHoLk^{C=ZrGawW@`D?d!o$(mfa(R4e+D`(D;ka*O~Vtv#dt(g*MZmAI<7_6sh zDgNj^n`PL8^-)+MY2AX>w#(J zJW#yd!{7Co-rqIK7@@&H4&Bkj;m$lRz;iVj3CvHn%=lizP@yM(?qW;{nX9qV*Bcgv zqAs2E|1JAD+~lxlmOdu-H+yrV6FgN*KYx0aA{~qBQI6j>%IHC6gSTFtt#}7p>>Hz$ zz~rpl8Lsey|DB#-ApONqmN#W~LWMFW?M2xIp5aTx;bks3MH5J;IxH z43MGSe$Hv`;68Nu5!v)pMZ>|;k2)I!^bo$bHFzk5gZlw>^%xDfgHm7&eYDRfzFk+K zx)z)EdEh-iSlLlFe$fHj4dSy66^#ITV)t#I+xK6Odz^nx;(J#@+>PaDw4dLHaG`SJ zsz1qt0T%0|!ULB75(m~YA<qWaDo8WlzhU8OX&25M!AoIeo^V41823NS!|#UJ2wnK-V{4Tudf(n zK+;udm9_cpm%92ya=TKw9^Fzh?J(42&NNSw?{OGnOU5kMRzZYUOhB25IW(@ z!2Q!+v1rEr;@rbNjorPqlNkP2 zskoV}IoC5r{6nLQw5bG*x_WT7n~+?`YO5ccC9n=P!p{Ee3iMTrT6a65J3Kp|xddse z%YY-aa#fZ&`y$_446Os^aXp=|Gzr38Go2hmQ=E!E6?CfYW?RoeP|{Z%e(1gx6CPlv zmUTvSk=d!!EssMN;2}kMLksHNf60Y|ywc1zcOMtg0z*4}Kw|l}T>tN2@n7S@e*vY8 z?Emc=X8#XBDf|BjDDBabaoHG0>V43dwi}>!LVxH7nxE0$_n&-cfCPIQjsuyugyLAqbGl?5wMi?kv;#* zXQ@wb2A8H=ZO#`cc{TLnU}0cNa!!(#O8d}S;+; zvc(y^s{FBzP;KVQ1QHVnHiLqyJua$5G$Blh3W)W0upf8M8)Hq25v$kl`_1z+c0U(v zBIG#G(H3a_ivIVm4TxkNA|9h4Rrm?4m|5Q0<;(6-b0!o~b%eUg$FGDvNQN4v{Gjbz z(xAqj%xX$R$K7npqoh(MNV-+x^}EhWO2~cY-!$r8!m@qQE~Wr47y8Ffqzb>+D*NCI z{d)~gc4a*}gxt!S;j{RRf3I`vuM13K@I5hfSQG1FSY7s(lYz?ZJfS*s8M91nDHEFd zb0bj?0=mrJdJGp91a-mmVj&pJO-rDdPSUj}C##)-eceQMw!ydbv)D&x)s2*r!+7uI z6#BQwM0KQ+Zji~<*FrB)e$3Tg26bf*F7ZO~oODy|b-URr19>@>s+y_#`@FiG&XWQK z{$z#nS-(hR<7wmi)p(oZx0Gvw3Y7D?ZMynB@ILluvPzlq^_Pj+JYD!u9W@7eQ%W~L zWQ&4Yq>FkaH*ln@KFfPQD5mV&7e^fAYz1%9?WuKBcdwFdVOAuZAnM6NuO&)pHn|`@ z(hj=PeO5X0PZXpIi^X|%W98bTD25$gZ0NXhl`_(1HZ@6E@_^@I5Q8$f1G9k#jbtuY zGV7ezuYtA44Jp2<9Oq1~I}C5~u?JQ5dr*8FVSJh_XEUb6(McZT8@vG%Ss4S4S<&p{ z?P)7->UoV&O`LG4Tk4nZD0vj1ynhj_$gY#Gnv{xZM{84C5YS}C2J@SQ{40)IkD`!b zl3C{Rr0-4JcmQi%48^v=E$H5X@SL(pA&)#S*S^@gE-qGJ>}FDHbY#}8^c6T8 z(44KA0Sw-^Yw?5&nc)*^?i%Es1zaOe)WXh%66MgN#!zwh8POU$#@=WT;HP|sutCzxRy6FI#N7p{)@YB9&n346yB>EQ zc=zXY4Ahh})lnUHA?aJ1#_1`jtF(lH7 z#=V2&4hT0nnW?i`iC|OR#h@4f1#FiJlI6Qurj4KA{t7GI&fm^HLL}E5$H^~u40uw! zCBqSPZsCT{O@X|00QmpG24VnF;+NZ8XtY~MPhM@z`nu4N=d#0lMK#6>-}I-1_{;?l z;Xn$yMIs;zQ%cg{P1op@-eci{#)Pbx6`7u72zZI$_*Yk}YS$HQCJ>kM#(2loDO>`I z>#OoC)_RdQBn0CW>;+5#a?^WZJ+Ih*0Zap@ihY>3PX-H3{CG?-It9*ZMS8=^EqKWge_h_+aDMknQ7|UZD#CCd;h-ah!8Ow&1)|p5>HVC)I_UR2Gv4xP_wx zD&5DeMEt45(sOW)9PoxNXS z6=l8Q&|#&Vty*|-tTRn29I_6qD(okqVSo`8RtP-urx^sidjym&ZYGHyiqwSFG#uf(doi8 zg}f%_FBuxEC^1V4w{4dEa`I7e(~+wz6&;KcI5iw;b$|B|r1|j%tizB%s1CBkaL)Q_ zv?pJA_5zLOc&-l5O{0^LZP_{*PlZkx1GSArq{EkmgHNHh*rF?b-~1IDIv;n4{kF>h zngxl+P#33_vPz4)%A=n(c2MA5&ysr)gGm!cZ5CquVbcSvzPX!vVzvZU*)dcy1z=l} zFL$(NJ~}mYIGdUEKq;>zD&ncxrHLG%X%ALz@M?Rb=PNg}MAD)v&e=*b)5E$@kWYaL zqjtRikkmp3<0p(^zTypF4GJMbNAUIvhVaR4dzFI`G$=X`J&Q@J@lQ8`++#QsQ@D!MA;LAlX4d*L4 zXLcV@?to#d; zGrCh4`7x4N9IHBw(T|8Mlzcj4j>>X zh}HjtxG}S{{CBA+`+q>(IQ~b7+p^|XT(&rB?~BSbS=#=@=U@Urd`-O)xphXnXH69; z+MSKIL= z#nr${UcU~5X0ufuV{S*RqoG%)C7d%7EHZ`o!WSt8Vd^QL5bSwGb@DIe-^Oj)AY--7 z{XY*LjRJNR@R^pYoxiMVSharZgWZ6B`Ahk)ZGa#+7FR;K0b)Dh5LWY>$$KaqlJ^rX z9Tzv*2lh0V@ILIDwRP6va)#isZ8lq!xl5E2Q(>JpI)sjf;zUDIn;yYEZ)I<sd{Z;DZ^`8I{rZHJAmo7N|bGJ0Byhl(ZZaxaMe)UkikDU+K2)7rm=qepmRGs*)b zQR*L?_7}llKwHb%>1D*&k(~GUlfB!z2m=<&s*r3+jr<^H6nH8!=a^9q5(TqS@#(-F zAqEd_Ke4C0!2CMPA0-(POiLO3p|iprS4nzR{duEtGVfpgSCcIlfy&gskZ%1gMn?U) z4qoAE*xe`G8bUX%X%0xeIRd|e&LDYUC~It4=$3$|c-KI~NnZ?F{Vcuos~+i$|$p=-kmkWNv*?REB$*Y#~% zex1Uyum0`P@LQg}vJlbMYx~yKcgBYAxidg-JN_{;LQvMw6~;UWgwAw2{EY&1lMr4i zn1Y6ov{eWL#JFC(Wj7k4zL6`JT|+CWZ3g6#CTo0z`zM1TmuV5bUdf?`K8qSDprKsT z{2!F25L@ApUqX=1)F6Pu++e7!eN0pCPqv@n%r;N@dIScRk*63+w$@s6gz0Hrz?9-L z(udZH-YS?CNVXJY-y zcHPTJO@@Asc~MePGBiC5{9riGycTx(#V?I%a04MJ`I4qGjh|8dBsev4} zwE%US5F=v!4xG23=>8N@2r?UdXlIL)bF7H!4oNgMHJY^A2ZEz%`O_A(gAkQ+&Ewlw zayUkIv(C*c%T4=U4F(V5*T)C#jrxzuHowXeSqaZ0^=V5>Dc&0!W`vv&9D(iWog0kx zqwSw4sihfLUwhymv#J#VOErpbT+XHOtOzBPA}Zb@l=Ig*x99)<%5nt-&OrxZ9x7$+ ztZkY>51{?17FLeG_sRMGUyPkommo^kZPT`G+qP|2+P0mQwr$&XW~FW0wtcI6jK2Nw zornGtu_Jb@IoI{@ZZe_&JOtJ=JA=Xo)&?&wdq8GN(Tj=BMh96oCKsIjqkp{-sL@Dd zO#uk>uANu#7;@UZP8DFP>+UNU^~dfMc9_Sz!X1g$H$F_15u2%kjVVT82VI#wOP{CR z!sQ%ZG2kC5HRgt}Jt*6pd26xjEU+VztORAwK936VbiyL?uImdMIj&i=k(VCdBtG6K zxWU9|sMKIwDoH6r z2hR$ESFTocTFkZxj8V~ZZ}x!A&<=dCBec>C5MNCu0oj!;z!dgbPn*yH4Xy-O?G6P^ z@8j=hTT6G;xqN7d9J}DnyM@R=niY)xSd^O2STi_ZrL4LAGdn zXv^NvVDUwx>C_{OQ?yVc)%DtZ>(=S2kVJWecw*)%bV06!+uot0{Iz2+CmJzG)G|e9 zX)>FAAJ3()o0zkTNE&7=vi5o8X3yIodcek35Pa4r#HeR!`V})Y7!5)2YGO_FE@#2# za72oOr|U&g7GLw8a}6|U)clp=`aBAPQydZu(F#eWn^$FT1)m#)D;dbs>Nw!GwR?J@ zezd>%7-0&eu`nyufo9#RTd?;;3JpQJj@zF+k#Qy%q$Fk^heP^tMbpfJ;M!b^g}OD= zkz5>iBuO)M2?H#F3wOftPzwaD!r`QBXIrjjPoA;*#mPO}tHwJnCywFdiI@%UFd9Mh zOE{QqYv5gIJ4RN(C~@!D3sOooBh9%8lzqTc=2r6f%C-s2$L+ww^Nc$i>ht84EOD%S z%y3cOPpb6@AeW8V8xt60w1;k1yjYomWF8>OuD46ujS!Ym;AdiW&swp~4XPZ8Htg#jI zT{hH|SY{4C$>MeZWhIcyY+QZ`g_TZSR4*IW8Z`xLz%6Y9M==*69we%HQhOqyY6orBgTU{_@7@I#u4w;S|ktQSuP;v|IstL zeoD>S)8Mvm@8b-gTGzai@p|Iwbvg!&8O0%!t!I`2DP?h$3k?s=MqRsfx5qKNqiD@} z1jxIcoGbr+-h>R?bWCX<6(N^7pej1iXFnm*_hcgaMl3hsz^?}6W$`JU@Y8*Rkch7P zZ1;2*4p^Tk_{1(b=&4$Fft0p_hn5~Qv`_+yh8vraduK4uoC3wNaCDyBHT0MLb|x)E z8G-vbb)%2?h&!L#rHR|-=iszE-^7DXoW^5znN}Y&4&>ij=U+oWF~sV8(6bIB4SthH z+G*N+sp^jkQnFDLTCt{qmMw#Q3@|cWFz>^n#HKl*-tk8kHj0}6M! zh^Zf>a>#-MEpSgO04FfBV;i{^!zR2L7blawRg3%)_hvzPM z4q1FJnEkMm!$*AlT4mJ*siEeoHIJYqCBEBtGZ^g09t*VbaZF{@dl6nr{jeN;lTJi4 z(OB=BVwR>I43LFgy$MbdXhi2a9}eY9k}S~iXico!wobTcX>TN*apYh#%c?#K%|=!> z^DqY-ElxKbOlnPpi}9)K%7xR8Oc+O%p9Ka_I*BxygjV-*;~+s?q*L017hx#0 z{Jj(Chs2opA!jRCLs@jz*f4UswLBd%LUQ5rQ%1f_QU~6DdjtuJgfY5^EAdN_(rw<(&AVU-AKnkA&fAdyeXpA$;;Id;4-z>f5{?Q}E@1Yt1I3?<$m6I?Cr;~(t z6p~*o-H-4hPZ(d``wukc3$m9(mZwzsgR!))QcJ$d!*l;H1!M3`mM8QdhUg%8=YLP=FcE zKw#9!U-V^Bqf3jHZ(xVNM#qfxA4c1Mpch6q*8f5;?Ee70u>Vic%aFQs>;@Y`&xiUg z8fG2F9cg&GOFVCpgaXS&rZSCrx^88q`lE)~1NMC(Hwme9%F0=Rx#BB^hysmw4A$#Q3~`s>iLcJ~)e=n5m6fxs5;9$|`h-jl3j8ju!n$QfCWXC zhCXP{b&N$O&MdjAGZnK?>fbQnOu_dWzw5-?J_rOLBuy~leLDo>!Khh2;)Z*!bLGVc zw(8}qCnYcr!~U1!!=3Bf$oopTBf<-0bNsG?BlcAFZ-w)D41=_^0pos%!O3tZ!-Ky? z#KgPqIG&sauyp(rwJ$#V1f zSV8av6k;o! zP&mPJl&H^=P86Mgn=W?6R87ja4Vw7;UzSZE^4RV!U8*BNnrw2T-z5#Sr#KJGYO{P? zb+xb#2$CAmCB~~Jpp($(&5;oC@{Fjx^2G-o8H}Bx&7i!8NznihkoH$2wp=`F&QILL z;t~j5?PMlI_#wTvWPgO>)5=0o%)znOSWr?^=GoMj; ziztsyMYER-dI8wW7(wAi5J^jz8>P}wf{>LuMty=1Wxz>LUMbrb1g38y-KVB{lL|rf z7KNuf=W>}u4HhtTy?5M*z6Dy%j`DI@*k(U_@qh^E6a3T@MeM>Da=Bs8`8EXrrbD6X zlm`qvL192+S4X9K8C_a+!&fP9vZa%$Gyh%m(xGaxtSzpD|1fA8Hiog%X(|)~0>GmE ziDEsAq=*xDp^rWFMu3e0hpQbZcKxwqtehJk6{pwl;sAfhf?Rx4{+D-D__y`Mi zE2T^lREcC^z>XV4kf}Iz(*i@U8`zuzXc@M>H7`OnFBE;osE`pG)?5Z_ zE`xE;XN*%CKFx=Uk>}tSN2s>cHKl!y9Do~DZ;t>e|GuA)@l?qrbjA|zBG})O`YYkl z!6r35#U81JS4dn79Sef~5+<6Et~y__vu|*XwssuCG+F9Y9?pmm8{Pf-?h zny-TEBpU_PN|lbt4^Y#$kAr(q}hn0;Df-^y;oy1=BhFFXLk+Kx%GZ*%Ru z|M3qz9r$>oGdy{0LoHusjp5_i^_k8JSs` z|G!Rw;~#Rb9RE}9bxHFtoydm1eL-1A&1ysh;{Gz-{%OHwaY1IuE+-BgUN;y5g894Q z?-8@p4h|rwlypcUyMD&6Yix~|b>UX?=FcM&SL)m0w{kQooVgZ?Ip-(3#eadst23!B z+N?2?(-poHI&?M3Lqt(R0SDAXVJ7FouJ;Kj<4-r#lS>AuK+}*;tX;2^o6{wEbpa9@ zFFxglB*FnJ)YO*Cd6RX!h4ZEDl#drjGROi2n_dcey}f;MRg3QdP{Si z^JUWmd#H%*Z!0wrm$4;(bqtO5GlgBdiqp_MaRa~-O%dqsPD0#!M0`_OCQoIDvugtZYGR+ z=$?ECZg`sjp#>Z&$BTR)3uF(;ep~nh_mX?8Ie5B8DC>2%WpQyvGool$&djWfh1&uW zt!#8JzW!W2Ey(_CgromoB8!HoFD|FkrK^Af7DRbKsv^*oEtpK6R8BV6*c(7wIZS(}NnB&$^ zoJ9*XTKY8+eV7;)s2UI%8xGi{Qrst?ft39Uk`0Z^0L!^qR>N@C}XDG*16y`++w^A717iDd_`JuJ9D$hz|}mRhi;N zSfZJ7ykAw9XPy940dA=ylyk_Kg++W1)cCU0-go`|$WpJ7o@S&pw7jw zIbLwQ{LLBrhr9V*Q#B=7V5Y)QolmX74(B_MivZF9nJ&e{mF4{9kF*;6LE*;LFzZC- z0q;_*c;t%{TpqH?Uz^1(~V(AP$+-Z?Ijl}cV zo=F=M&W<(@&PY6EdTmgKmlGzSGG3OD zqmQ&=hmD&_st)WgE5UKo>IMMZ)=EoqrX)stz{F1=zC)x#v>L^npbp7Z7=KDla=<4LlU#7h*N#xNvXel#}vB8A(kTs$e0M!6$4d{6QR;Cb4z6mlp}cs zJnkh9B9>UN)G-K;*DR&g3ourXlyc-GiMMaxC;ZKwjswvF1Oh+@R}>az_Sn0|a5;Q% z^@Noet>nr+iBB8lQNnfS7buTn8Epeud%0A%DroR=wm~!isZgbR)1&g6crW1d6P7Ls z+qeBOHk^R}-a&wjC|tbB2;$rb<>?^6Nal4~rGsO(t{5?H758j7zV?^}jzLoCBm*}p zrXKy3?af?37M2-Lc}c&h$~9N5$n@fcstTt<2n^YgF3(t?8au2LRkNISFmjj9N9f)_}VPlHe8FpY>E=FZ(!^{3VU@`uQOB5(5Dsmxaw zBD&Ax8>O4IE=F(%fRDrhVIZ_`WxQ8o(l;Qt7a&u%Xzc$E{(q12e=i?7S^k?#XODopea6D{5^jT5goytlIA#*?J8LQ8>mTF0EzT`1i{hoVV}>pPXn!qHgf6ex91XDx#4Gk6h-|>L3NKoY+DIktJC`Ocz(ei{KoZ? z$O5tCg;(l}NPhWz_Q&gj)K2~HAHVq-a1Oa|8kwaA0XWb1r%G%l?nl0Ltch@-oC!21 z-^8QYPostu8WzHvX#DKU1x4%^h3N%FGI0$SH*2Y&L%!SLNbtIRYc;#c!22~vL=J9; zud!44!>D}0AkCYK9I~T&%1J=7YA}9P`NqpdNuj3R4o}Hr8~Q-swkJFhyl(e9S9E^= zJ%{UuW6@BiSqp0Q>4c(+qX{00uR%MCuKS+#Y_ke~Qt@duu1(xEtzNVS)xP|a=oi9p=(oieOR*6;2N6J!>r8&A# z>QayGg+Y+n;xK733lE%6VXF8Z1JdJDEA4UTaDgWJDOfAvFbagUVB0aC<{GmuZ4^_mo#8s7#8MTual)}ki1+qNSo5p zZaqI^liszZ!qun|-MXv#nn6pjuf!bKoC1b zh!;azGYxSCDQoL66eLp1m^;a^6jm-D0M8t?U=@zDSKcf@SH4TN`7#T*=urn9YB2nJ z=`OfDo-1P(2O8B-T-cGo$MUaw%nM=S)sGHQ(=)uZL4LUGv{S8hNRMdn-1tgw*UJ4F zMsVk3@N~uzR@askrxA$HxDzpOH$1lc>*%0)H}?6vCL`L-2qZFF+ z#aSa)Lxg2*5C{w`!7I$xV^4b@xI6I--T%I3}}tNzqPe7*v(%EW1OR@li>tL6fcQDko?AZ{o!sexOI?Db{#!R z238|Gkvi={DRFI|8p@8=^}3Kvs}RA{P)xOg6vU`~t$rO3apfYiQ6kWg#r=IrHFT;_ zR?~IUx;Sw#yUl}y)ZojICrJmC;?Qy82e%Kf_-`I4xqtzI7jY~i%m)kv4h}tHE z23wUglsJ-oAxRIBOpVZ@ZfFJ7i33?k7GSd!=V9he-uKwXjj3qo$xI}8BcgNVm{&>} zX(vLI*9Y(lmKqvJF-oY{hy;fg7L;Sh<>uqvLK(=q`mZ#_Kuc#+0Q(~hwL>BkUEg}> zyTpd0s1;fQsC6p9T2Z^)V;s&Nm(D1Vw^5#VE4wVynaB&K%T_np&o0gs5J^P8T#dVV zmfo~{K_x+W(7$vX2&(IOGXB+~k@SV@ZFf%GbFkCL96-`L7Ozw38ZYO7OQ0bgwXR~u zLqH69D)8l}2i-&Awg=}LrzCm4936KLKFpHMQA{0@n8+WR`vIuP*96(jUrdQ+6!wfZ zMSaUJY%4Gvt&u2Jta?Wh1v#dH4jQcBW=3?SXz(bM7#qP(ii!;EMmmy%D+N9L4h4~v zkHD+#&O!auwCwS8V*Y@l>o2uDo~Pv+AQ_XLUA_{F>ua_9|83RV)%-#<+YITxJaGYNQ8 zQ9^_f4>XwFS|xAXQ~*LtO9m#UG$V2}S~V4k@Nb!#L6ssjpoV>|_}& z8-!J*JBhHUxFFQaSrjwntw;Ecvi>UGj zMP`Iy!Hzx>x_b;h9AB>}-Wz^1ZP(N(LpaNu=c%?lR`n>0!2;7{7e!jP2$Iq^bLC;! zRf-+iD}Ww0^jM$!9RRwnB2g?CX}b_Ovy7ty&~2C49fM;bd~aWt-;$W^(oGqX}o zeQ`K)ijT@}gd$bZ1wUsGLVXHyoGlV0z3gvx{2E0?Ul9ouiTvV$@5v(x3gG__IB{v&r`mjw~fM>_oSfCx<*OyB()kRgS}o&JCJG`2zgQsSrn*14*IUY$-0? zP&d^RqDt^Z_4n+C6xc!IMNQT63xV*J*auh{kyl8pYL;dijWQ9E63jyTTaR*MNro9m%MCfTz0_nd?M<7lY(Lgg zyKln2p2c|~$tTfwvahAxSyQXDS}eq@naGWGqU51#k;!Wuqr z7_7@Vz2fj-15QMF)LB>*E_k}+kVyCE8^!NpU5WJ)Jq6UyiM`+nq^09RA^he=ibGbzU=BD(c;@^d)*gEgdtxIl z(t8yL!)adEC$vQuZT$C+i*m`bYN%J)gdab8)SJ|%zZ@rsR`in#+B^o8~?So*CgpO=$HRq12@ zb&EUZ>eH{M^G_Ja^Bjw$n~F`|MaaU{SR-&eGx2ECi>pwy*Tzb;>=TI=XPB~}aR>s! zjh;>TOO;$npme4UYLs4OrNi)*lqqhmj|?|)z^(lB?TgrG3~gj7zfNDLhveaW1&0NH zf>pGlfhQ^%1CtyNJIm1KKwQ*x$@=Q!B5=Tc=Gvpw#1miJwhVTa8g??}P9>NQYMlAK z;YG`byYBOwE1pF<5QQeHiJ?&(ciUus=zeJgz6aE|p>W45NEI zF~5rMQ3S}j6X%)yHNQc#`fA=73FJ$TAv~f@<{kPV8=}-8Nt4y|_z^tvfVtWPYoSP- zil+0n@4_~na8{QxGX>d3kBen62%M(`nfsk=rP7D`-A!xZ(~^^?h6sGBRml^ELss}J zUyl}(+46g=nM`)+Gz|)x6Gw&zsMD-qk1Ng?yeS>0^(x9gNLF+Sq(!15&hlEA$;Qx6 zIrwX@xxq09&J>22H@}O4b%A>#;!OjHG?5R#A1fQYGE7RSnd3|F2ga@?SVb*SCz*BB zz?~xnaxzkUl!dF2o#@Mnw=$OrSuN132Q;yHqs*o>3mVr_IczhIa?hs>!+0U`GbFdu zHIBzt;r}=jQLXRSS%6)m4&{`cH&S-9UvoJKhmHp-oujfJgf{a2!RVU5+f1S+ zD8vII%?dTsfjJ;P4f0bYg@hYwj16U8)lcA@)1DX*A3WEM>a0;>#Vm}(sHNVf3V}EvP4;;u9YirvuB@-~2!q){%;wySiM{-|_?yccpvY%-qyD>@gBMhF{EAR^ z0e@9&i%)=%@uSa^r0xAsl3d-P&*y8f`|!4W`eQ$2y6fh<9Gfe0iP&v2TUcP{>*%jh zWXc5$Rjbi`hX~#Va9?D4gH(Pp8(J&3S1707RXHW3b)FWy(9ENF?`T2mzJ@U0&gp4`Az=pt5%G-hbFx9RovCZ zjtQ-|h{M(?-P$D>3}(bS#)77j3PoA6o8h4a6Kds)kB-d~F8kWgGmfIqGw(Rr5smYz z^a{wL52mp-a#wFARZzmU2!u`ga#F^fB}Z2Q`g0Gv`o!jRJJxXyt*FS6^{u4H4VPt0b@7KdWgpE1>r?7Fg z)`aVZ7}CGQh-UUN;d$70S2*11<}s*V#>1MUPTm9sl!jm+=0GTgE-l}vKL?xV;JQSl zoXq0S@gjetr>d>CTU4je58Bf_?@T+Xnar_UIX;{Re~T7-XxT4EhSsvKwPM^w{Qgi{d08Oo!;So$EI(d?)p_5eYL+Lr#qbc)I}toA z5gbJeWj;wn_RXkw`=vPt%mb-|82rvAzh(cjr_eOP+BsR_qc$%KZ-a~zJ9J#%Yn{>} zdW8Tn^90QHLhNFonrc#gm#u|Hh`4S9%tit5!QZLf)Q4MmP%xAnJ+ZF$0*e`w}aj`L! z^1|b!n?!Og3;OAeiJE#XhL;{`MgA(}&>A+hz)~yy=p5&xB7yWX&oIS)MP6ubr&g!e z?yPHE)>bHYPI8kXI;uD8ql+6#y>%6OD1t7?7Rh51XLnt5440ZJNWpLkx2rS0YMU^w z_?h%YdnVH7NIIhK-uSNv(pBO5&|-hMevPmbe=V3ASiU22o9-ISz}%-d#afx2R@6_~ z-0z*S0Avx-^M2@n(9KvE##ggtC*`8bB0`MQ zCN2iA?_8X1bQ1)VY^;hB0b$ooQ(e#QB}qs1yRA6r58Ygh=K0}p|FcE*OM&?HT&cdV zS8uWr&qu%oy!plY+W1z*whb1EHZ+$0Yp~qhG<<`i;IAo>vbjf>Gc0lE;Td3jF%jDW zUduqI>0Plwv^YnSb`M?khXval_$`>_IlS{OTmtauxoHpH!7vG$Jr2v0Dr4DB;Hhro zhP=hJTY-I};_GIJS1Rhvu?MHUks9m`zN*0BQu9F8ol-|h+z-u(wlCm1gk?jU2K*2uJD9`hRPm4QX zZMWwyP+Bo!AEs}j7&=N6Zeo}Rj{~;=*UzZrEvV0PKIuZU|Raj@@`#H3|Bdw&4;`a57-{z16%>47Qi| zvW@Y6?wCX|_=~XsIPFnlG3@UP)5w=I%3~dpSv+@T={mOG@$SbTA2Fo#)<`jNmqan{ zQ62=1mE9+LD8RuAg#8!hLzW798?XE4DbRi%boZFsZ=-6KC=&pxf+eO6wvUA0wZbQa z^LV*~F-&S!^nXHfEq%TGL6rZ1&1FkS;R%1-BF4#LkQX$ZG%3E}DLpj4mX-B2SEe(q z!e?7ky69v_QaFMm>TxCG}qTtQ@8rHeQg0TB|c-T#(4 zj5g($7swzQnhey!`7>tMoQUq%={l)Z2Bq2RTj-Sy%=vLJGy~BmI)MdHJE^JK+N~M* z1!6JJGWW4HEuk#1&nrQ-6S;YExabN|RZ|Q!hh0=*c3k!hF+)(f?XxH%Dp@Asn-<$! z6DopwN2gpSrd+b9+HDnbJD)?ZHWEPz5IvFMDC=*00?Va--Wh=Y=rvfPs_>nUEs&!4 zi7P2F5`q7Mx`p%vB(7WtZzwTuuAMMu?NryQexnCNgs2$1z*)TphiPFisAN_UAXJmK z?4ZAOVdpEhf6B$DX+lRZzE942s$x%N;H_d)Qh5LUla$HcNz}U(#l~rH0$R=S(ccew zqzR9uH;On%Uq|i2&Yn~h#)+TwBoQ{kN*NKPnnZ3Lvq^x2n;qSdg^k5VL54me5RCt} z18gM6#s_Ca_X;pfFD_YL0tM?O{!+LgD>@%dN@PIsbWkf|!CfAlV3T?E7?9yIAeCc^ zgeV;NVX)%3^}Ix&TGnb}=-mT>ihgb&Wp40TBy(yCZ2UVVq(o%d2zNNYqX7I#`sQ{L zDurZ!j7O$pSWUG`w1+Qv=&RA7(j1PJ5WdPI`p~+iG8N{Y0v}%Ok zHpqVM|F}jjWsDUedhZYM-q-cyxKUEt=a3JooSvdw@hPp}n2^)rE<4pQjP;uZJ11VD9WtZAO!O9xtVH&5r6|keN?W z7y06bxN%*_U1@hp3<7;v%s=+Aznkvid+9oK;Ver!iA^+_GU1t8NmH}7G*gS&6kOYl z?3MvOPA!Me0p62OsnM5x*|>jw{Mm1;F54TrNeFWu5;}FXGQJ4zvZ=RISE-I0Xm_q{ zgoUq1=L>9wRgf=3TVc{ZlPoWH8!w8Rl@45L~ezID0DK&*!9?w9*;<5c|B#&%R2Vun-mPM% z#^PI*W&bT=gC{m0kyA3+P>h+F#}qvsUbN3Eo861Wq$m@pG~oM(oqjP!!}7Rc3(h-I9htU)$K+ZF=i2FhemJoIgT^bo_;8&@lx!saSP;YUR#D>PnVT^X!@$C=3fW_Aw$8KM z({06#FktvBN;G*4x=+`mm#XK}6z~U{V58?r;aO#a29H#926{IJm%7P_t3VRj}zmL^DUPwzXX9BoBcUcJvk zcXr8(jt6g1g|4E#H1V=J`TRJC2OTm~nS)Ng$^u z`eK+plHM+mC($lt=?m{!MQd^LZ%%K-TgH@HCi% z08$_MWhKo6_>A`V-HO?ou#U%q?HAAUWPQNOH(py5uCfwl~7wU|YknAAfDovP6QojIY_1xJ`q6{}xf z7gTa}j#u74$PP?v@{UmU;FIe%+dZi&)|@asR=n}2`ejPuX-S4ci;fSpb>4JgfuQoG zhSPU|cea#`TMuNk(2ZjkI#swMH3Y{EGikp=YM#t@=1H$rI_lIH7<`D;YW!j(-t1YP z^!QxP8pqOUsiL?_%;?tGnlj+U=eu*>LW|y>|4lPf=@~q6))a}~!@NFwRO`@=FL{t5 zQ1rV|7?NqTd&{)VG<8W6+Mx>R@>@+9FS|cE_sMj~)rIxPldLf8qrwRwyQ*p-GTC;u zGZJ4zZC>f?4f&Tkt6VRoCj`a>)F|GNq**KXmAfuk%*hm4azy{{(-P0dzv+wkJKRslQ+5Rlrx}h(!F#$d^o}rV(wTG6>9Q37KqvLR=3H$-E z)G*B9R*xVKASWdI#2~|I=8vhj=`58M-%FChi#2#4y+auSz$Wqwqe#{e(%QCEvjVE8 zQ&-rVx;F#vM%%HAxFj<*NDZkn;yQKq1GLaNky0pz8wMv|Q{p0-SgIW*pRd zWqHZ8(8`K4qRJZ$3NJcnWTzc05`m$cO9;}7n*wNW#u!16xB*am4v;gs9+0X0LJOwD z)_FnSMa}g#MhLGow4Qu7mw8zw%zmUfEYSRMV*rBD@O7`h*o|h;p0qF#9C-i+cC;u& zduOL_ICF1lEGY*AM!m0@gUg_euy4B{o5>4}y zE;fDAtEgHlj&9Oxcg_Kj@PTGc^*f1GFB$jP1MG$B7+Yp2ok_q1L5&h%tS8UiQ5hJ* zq8FgOhDAqPsLu=z89zPBeHV;paF+`k4ia#%y^h;^$=oN!6;-3LbFk|lItWp+uSwiV}nv+yAg829n+4f2O85U0%5XVTZZhPblu}hbJfvM z?)5XWR@no|7Z&zKB*%R?p}rja5m4+n`p1N}fLf90_ng1r0E7UO$$&k?di-#*m_YdX zFf%s_c!ELwY2SVf`$eV!z%a`Q8wCbS>-6U%KwJ~Io0;O4_54uqeoM@ylGn{D*7Nox z!p-4f@5Sr_C>o9><~QUglaa#!a7Jmgt-&8U-6Gx-aDqr!swf~Q!R)wFluLC3z%Em# z-C@uICSM6l$botWvHku5w8=t+o8pA032>kwQ4D&rrC&~J(t5tjtC9`KBV5f3i@pX| z<9HEXWjOCXVD(DPUy2*=MruC@(;)l&3f9W6dNzqM_SHbe)HWA-k6c!xOtvuEo)#`hA$a<} zL$-SE)KMiq`RcIK5{lhej6+cYmA`>i-sFZCKEF+Jo0OvRjEEogEoDp`)~)oM(XB(Ilgdwo%#%?yT7 zWuiqs-826B#B*ES?(RFR=KuCi&9bnpeHXW+sL%P_;G*HgX8`h}KNq=FaayG>S%Glk$t1M;0`G@V9ApupSCqo@t*6ED8B zkzax&9z&=t+j=l;yxBv>#+ zSo4c0%Q}K=qlb_Xh%^S$B;i)$S+hWRDgRfJJsHq;`_Qjy_O$_vT7l#w@))`i2~KB- zRu{3CY-U#XHB@Dk&?K^%Qtx16>R~520jLBJVtQOsI1zCWba|$cVq~2s9LIcFP`#g) z6<7+Rxs=Rc8(m>kqG(<=ENFs_o58Ik#a+eR%=`+V+1U?8Irc$WYo9=W=Ncee53I)% z0@(?FrO^BF4zuPgvfoC>PYw5C%z~%N_cSqvMsAYG@d18wr6g$OJ1)Ylrh_Xk2GGr} zdMTdFlJ`VPJeTBB5Pys%9xfE$g2;Q2zB0ZmVt!zb*Jh@+MG`C^p(}Q@)GTEUoT?wJ z?R0qLWV8FFe;YF3M)VJiS->aU^OM%J>)`GOVYyI-tTQ0El9<0w|6O=xCT!NzL;LGj zw9*4?7VTiU{epjr@mP%o9a+e4!6eYyD8RAA?$&gAE)vmZKL?))~e zXQ5KrW%ttbF`b}YTzG_q1!%`m>3Lip;t{|k4ZdB!GfIrr5CX@ow9j*kj9FSU+EyrI z68WSti(3?KHz&St`6C5AEk(DfM(#y{6ZjR@a6K{aMRh+r|AH$iYO)Y7Q-L3)z!WcQo_1m6*w7Yu(&M_C zx?$nA_X459K%v#kcI||%U@R%2-%>#-FPz3D2idduTP%?3fxM4>G zNc1U~EF? zHRNpouw^|_<7jC^O?`b#P^yB!K@?B=x0i|ZBJ1L~^wLk}#d}veA-l*qP6}hvx!3pW z9kwUoU$*bq9~~St#x=Sgy0kC)yWR+3k4D`p`=t(z&&SAN@Qco1uW-bv@RWoq_{g#z zy_z4$%)X8&sQ6+ewJP?=GA-5C*V9tHhFe!DRV1gEtg#?drTC`-qIaZndg=Q&b1LtE z;)r{Zc9VJ?d%q_I*P$5i$x7v(5m9-g0~p&@N zIxCsr$b~o^KRW3$xkl$K@%F9s5S+{g+wtpo=gux7S)X$mX@Y(o4g!~SMl_fITv{6mP7PDs z4{`k4I3376L*kEMP-$A^wh7J07xcF z>7*)*G0kBuC7RzxUn}-#11!d?Cso>x>2oy5ibpB!3rZPvd{JHNSP4Z%m68S1NeXDX zbQp&1hMNrtR8{pXD|4aTB1ch|7dDy#Q9m_%FdRbUbHFKPz2vPShndl9yD2T!3KRF{ z&n70fdPCDFy?RSBgfG%DulATnABhfte(oQ4_qqw!cjjRPdIiu6t|rMFTt8aB3;E_V8#VMO&!5?x3n?F=dC$kI)SQpmy0!7y*NRr`uAzFRPRU2w78T z-uyqt&apcaDC@SdZ6_7mwr!_k+pgHQZQHh=*tVUDUAMaL=zc$Rf9M}^&RFN{IoAfH z9)0wXKoTGxwFjBdr@^fcx+aTA3Do+LVVY_$-JB8O=)h8oSiP8SjaxF118p8M4@?^o zD0L0A%YoPHToSgNPhTH0*>9S6r9@z%-9k=tU#e~L(59jlUU^9{hwbmWmk#QE8+%zz zokX*qtfgbXASxz^!~$$-dBayZyjKQy%;)Y>mu!6*XX%K%EcR6pbiJ(t62h5j^FUG7 zLH$cb0(pz1Emo|Xp6T?KJ{AjL#(eb(gNu2id_P2M{TaG8-@&SPkMavWt@XILt@hk7 zMx}XBOGX4j8-tw34~;9-CIFa;M#)+ zs>mNo`10hU=gZ@X5PQVCj(yS2a}UmdAVT#e>bmF|@PtUC+{&p=56>Alc4l$h!J)nOl<=b&19i8+N8Zs_hr^7wr zpA(Qb(S|x!c!7oX{O-s*o^G&{^SarH1vMR|`kFL1@d>=kfupwFWcs;EO86{0PXab8 zX50q0za?ZJso!irLUNm5+*GW2849`t9@3qCCru+x$>->2PF z&SoanWy4lfZVjLibsWZz2C}IFW^e!cP?P$;a8rO7;H)Oe0%(kXnMTU`*gh2X~L4cPP^V@L8&xB0gZ$*_`$tUFtcHtwa;a1a<9QFd@_`dA& z+(0oC!5b#46x1x+9z(4>sMiKd0fH2|e=ccO544V7@HO)lXc1^wVR@*?*A09#saHGc zgdYR9`YkK%(6OLWw;}HimIQbQ1M)wIm=h+RSo70$lTxCiNRiBGLe!o^l);A0Eak53 z9I$c{Phv&qM>ui=CNai{@u!)IpP6sJh^rj192IWP78 zpnD4-2BK(zN>qf44z%naVf5Qd?5vcX*BZ#A_E!t3gxI#v7A$>*fT2PleWEos1uX6Z zSwql?$GrWbHoWtn!h2{G(p?isiF%ICw{+bo+wTX4KoX`OVr)a^;mA#r^E{>1swPIl zbji^hK%x^erq3BA76Gw7?{Zv{suL}bHU7Gf9T?prkW>0L+^TP`-#cu~(gr2427t`W zqWO{SNe97_8?Pt$Cn`L3vo+3dWg>fZIwmf7q}QukX%9mk;*&iceUB;Q<&r3er03y` zqrDfj5&ww_f)nR#Xq?lYIPZiVcZ9uwuZ#VIUH_s}i}M($XOx_}VE zNtug;8i9i?BmVZ9?><_=2oBBs1&SzCr({AdLGlvnj>lL~w6?Pn2Ff|z_H1fyHA*?m zD$*PKnfn$RGl|yU*hj^2{h)_<jF7?zLZ}6%&Mo=+R}cK z1ZuTw$7@OeL5QXCTbb+aX8B`PfTsM`jwNdvrWJP=ZEOrWN87|e|SDSt9E{!j8}jh2-2Av;FzrN$mcB|sRJsQoQf zPdTMRzH_lg8sR1xwv;GhaZ6a)?IYXzPs&@|13^DHDV=swW}|MS)ZX>2SJWS3deh;N zx*L`W4SKHX@1IOx$u5La@_P0fxV$ZL>UI1fuSQ+^88Xqq*}=l`w!Kb(kEiEdL9m&T zrH2E_{)lV4W3;RT1pS_Ow3jxL3rKp7+YBfRTJJ_5O)h=BKa-i><*EUgnnx-GuP5nM zh+BTXlAA}8z6m2zW*!z)xaJOYSG8Zp4bikGK*kP%qx=LLPy+e6M7Rw7#vC&r_wnS+ zU0OaQ8+QgI)T+eM zZAC~eS=p3H*eY#N=E7}u>#*QS6ta%uil`-h0UOPLWUlpiox&8-3X^-+uc62{dib6h zQV+GgWn76Cjbc9P#FP;swrdDZzdtLw^0OhpbPTV)B8Baz1c{ zOtYqZH3KoY5K3SZO-$cl4OFK#j})9G>Y{_QT^xPhSKYtFlq=5$SL2Z-7RGgu5BasO zB-P9;7pU+oYIs-g(TeVHnZ3H1-OjfU5Ty$Q-z5tqJ0t>}_L5DH^*;Drx96NK%qN+! zIC0@my!nqistM~_PD6n@92YKHLEM7{HNX(COm0vxTy88jaEdb|@Op2H{a+p`2Jfz`7F_ecGP^<*ajnnQ&LldTSLYCyNgRe+){6uJ`jv5q^= zp8S)~0jBP1Wna~3$DsPnW##^{9i>W;{3-2HTS=@`Oou7ne|K%y^L=icH-!vAKb+s+ z#y8a2%$Nsx(~od}+?wK^kvVZF%p56G16uzEA5Xx9Oxh>s4&Om;**K9L90qb28vyHu z3lEcCWKMD?MG~s8ekYf48ZT!LxJt&He%j)m_uMy|0&d_r>8NHzg};n>^Us#OJTc{p z-kTktuUMI)z8aa5m^{o8>WHPr(joJ7-Q+##2<)1$P5Yhepqj#$yZjbX-r}KE4dCW0 z9^sPHlLljG7QC#nGRnb2$p*3^BglhXuCIXx3k*ad8@_n=pq2 z_cV_NV2CY*l-8UIK)7=#u=X4oNn_JpI_zIC3myw8-fHuzu&x>xG>m}Y?1mHS`6Cd> zuT?W3-ET!}I!7Gb3Gv-cVHtHTs!~DvRqLiP`YXmt8*VGdDv`S<$f)}Ar@nWA6eG|` zVS1-w-cwxJJkE)vzT7p=!CJJ#Cvyv3RUAlRcu^JcnD8b&n+S9Y3=0qN}r- zda=b-@`43H2@&+1NiJ3#oghH$wRs$?d0~NYVM39Q7iy!BWYdu{4let z^t-TqaSPnSV2IH%Puln$nlglFUXe(*2TLS^hybPpiAV;O5IlIY;yM%j^=9*D5e5+< z#+?vT8ZL9Y^&BTBco-sgf==ACHD|Y>?C*~{vlt=;+l)ge8MAegH($sV=Aouj>EUzW zZeEBy`oDiF{hUPW&dGFc@1DmvY~L8VXMmes)CG>Eep#fKX=gn_*3Rq)ZALkjb9frK z;Tb`48lSt(Ny3|KJjYqTbzR(mBAGT`GD5L&#uPf7Z__h}wM2^IA3zdLk&P|g@dQRQ z;=ohH9(y_+i?{2mmozp@3u2M7K{~&u3vOEz);t7tG4(Z()6Sbwxi_4{dWnNo#!GRm zF%>V<5#1hlEh3;MP_~%SHMe&VvL0)Q!G?Mf3a{dD&{rX^uwe>^t`DxZcMwg#QYP=G zvRUf3scNJJtO+6H`wD46z!Qt^?nDY;khgBOSq&XTR3ySl0o=RNXY6n6QEhfDDyb=oqzyxCh;?J7$ef6q=9|<%LnV* z+6l}*otih$7K?yzN*j(k%|PgoorqTRv#YwT2*V;ef;RjS*hgg&lnC!Tl-X1-yYn8K z8b5zky4-^FTeplh)LC;Z0hjO@awCUZ?0+<2JDUCAteG#6rb#LBhyUoDf-ki?x)iL< zB6Actfn||7L3z*Jh)%@a3Jr^I7&UkmAX@m-7FP67(H1&09y0tpr>$kRe`LkWu-yfiF*j^`8%Kyk}|388KV^Yk_!ufAnmYMNCeO+e8|IOFcoNzi6 zN9lQ>p?1M`7_6?PwgJcAwv%`i^~%67roVs&he{=l76gJ2Z18+;@iYB))U(y3T)$}$ zffN>`(_+v+nXJ}_D#~X3I`xejicAPwW}va#L3vTZ8*kfO7LVJ&sNx`0`7-qCYfR#l z0+%WZw?VAR_tdlh6C}n+Uu2j*0Y%dKp{8hmk@I){ZhT@cgF_*^cFQYmfiYs@^%MLb z8^kj|mnwfM>@k-TM_eK^mc{w@%=tjKyU`^N%td|~W)M&c|+ zCPLq3hTk^RfgywGqf~FbSMLF;at|&xQoa@!kWNpEY+c=dUj@#1s(#nL(6PV6Df~bz zKc{R&ULTjA13(B9#;vJ1GW z7pek|o_27#(|b6GQ&?qC8V9U)aN7oYuT+^-&6QbQV<=iET5#kqqs=lTP3Bw__;mkx zeZ-|e*bkvn>kE%t;!wEp2~EUVO_Ru`F~52T9K&%hoI;vn`hxT24jMMRPM(FZPM~~4 zo?*}3=RVd@0~iGJt0%(Z1pdgy#nziunmdqFqWX#pXbp=*0*!Blxfw%aI%n=3<6Rk0 zW_9+lV`)}RV5(hLl-zkd!V^0Uzp*RkK`z&L;w^c)YTS4^$pMU1D!N%HC&M9IHtg>R zvqMtgiv#t52Eem#WBPKj5vNEWfLb;NyNSQ%Ql5sG*(p9aVJncnEhg_C8JGUhMVVT_ z$crTW>I_w~BC^bS);ta^i8EEm{mdQxBrP_?krtqcfExpGB`+bMC||O7fZAhJKJdkw z9!NOUBwx&R`z~taC0$cIgnAwKS;aF5BxYaB!TwD~gB&Auq4l=dM~+2uLGm@$^qu<_B`x`&2kWy9)U)}IuTfhb5$ zm)~)6Ur|ln*c4%4F_nGTu$6SO!@KDKV@XTbG_XtwougFdG-Ctz`>343gL+!x&r{L< z&cY#7qeHeGv_0J`yoYfp?_eK>9;U?)R-xzsjBXI_E6DW9pY&* zF3@(#oy~}qytyCj9_F@-8Ct~~g7@D%)_YTpE@tbt@ra=eJZ$n_l$Sp@4L_meZ?X{S;kE>E&oF^Pvz@**fRp2aMvu}96Bdh?>uVy|4_y|B zHK+C$Nj>OaBvlbB)$!-Na7HFI$HZWIUbL$obQ;W*A4VY2|Ovx3o>flXyuYLeq*ls^!>*lXB}T$gWpZIwGfQE(#?_ z#8Gf(^3T2#)nGTnC1~GLj3-hfTQ=5yS0ac_EtC5DkS*kQ$S*H=4^f*j9c|0Dr*K_DMn1 zEQK*NaWog})NU|j(c?-u7TwHBh|Ze9@ZoNbd$^D(3yd%`tkE9|OZVz#qm(-8L9A)e zKnp7dW`-oJOI;fOtI2rPVaO6*nfWidNjb)IZyL^)fydE?GbCO=w3d~s@Teo z4c5BTu?OG?cBabkV1c%rmAHjen+@GDl3v{QwKh1uzo>HiCsFOe4M?$n~~wZ zNF-&`EYYiWF|O=X6^zGukucL=n@W1^Pkm4+)VxGVsPT5(oUD`2b2_PYu25>rSqxCn zo5tV%m?f`esn?Ay*wkmnzo#xUJ0RZQ!n)n+QBEzgDrU~$cDF-yDT^%K+}zn><_@GS zHl{|D?dxp@8cQ(t^1)5M*1c2}kOp}=eh_nwxS=xZo!@Kq;yI56JzF~AHyG~EJx~)n zv_SQ?Lg{>Zu6E~;SDaY$Quk@)>$c=zC~+-6(J`RP(lWbb@^S^%G>E*xRt(m46VfVV zfZ`1)TViH%TnRNm<+!t~RePv{QZV*P3TS3tw(WEGF}ygB@#DLcknIgzI_Lb!Z#q>V%ISI7#xvH=v^fFewIHI&I+|gGolU61>5zJvFm>lk)IQugCaD+ zDVTyUoT7dG8!{-qzac;FX1pgv)c1lGzx%zgOL#Z+=xOTQ=v9PjwckW*&G#AwWZzGsn;<}vaz9d+{&0<-X zg2-;T0`~9YzHj>m{nsPA-?jrwZN-07t|p?MjL0-_wB4rA;XiWMCl6ho$HWk+Cy}uEaYW9il1R3EU5el zmNv!$N#a*V9mbY^4xn}|(cRN^%H3&xtJQzMrP%M|f$iMV{(g^v$CDm%EwnwD{PFX&Q_P$d7x_k>(7?8A<-bbgsaLmCY zgyU!-N>f=&<{A=L-&B1wF0^4TFLeYFZN8-N{z7O+XBVxM`nW5@gKBEN9iM&G{9vUr zA8(iCzSf>>?#f2R;~ga7uKn5OTEAo=!8-H4n9NjSF$S#VNO&4D1w64zg#L8XUPq~A zKVq^;S?q}SvUwt=v9j#3NQ7U1_41>wrCB%L*0T-Wwk`82!x0C(!1Hu2*;U02@z8cC zy^+xvgG@jr^u~EkZP1p4nh*^(SNX)eD4ckd|L^LD;2dxl691>(YSAbty!(SHX$*m) zY}_%i7aNysY4f-I>ui@jDJ$A%oCNDWjcnjSQkHy@S0A^VfgjR4TZxr7+XKRH)taIX zW2IY`0*VwPFm_+b2I0@bxG~B137_@ozN~>qUAjGRoYM>8UK9;KI1nA4)N3A+<|gBK z@cyiOh1`;g(wb5tk}r6)Z=7`+*1&+`G)*~N6*yy02aW&M=@bXLE3n%{!O~CkZUX+> zzflI&3iIX9+`SMK81A|WEffC&MeLPHhAb!2HQJYc5)6%s+n1_nY{M@@vb(J`FDJpj zpfQHrH*6C+3)BDUmjRGvjs9eV{E3E}o3%~QHf2zqd0?cSdkh`*{ z5({k46lc;1X;GD~ll$hy^TDA4uT|{;`3w{TS3oguI8kgT$08Y%Pg6)3R3^>(7DOr{ zGTpR5gH1$PT3VaORRd7P6EIuuVd#)BJTY~jKHz1Y2fu)Q7@rRh7};{)q?!rh@cbj3 z^8W7j6OROE-J;Ta(xfva!96pKgf z?eAa|8YJ--rGSXw-EzOpD}9PVZhgd* zYB6p|5pE>PIK6K804MZ)CwfkF@aeC7_~<62Ro1kmHKkf(=y^GSUP+)B>@pme<_zbp z_cqNU28qyoL4tSNoXmtoBxTo$rloZ~R~%(Kl8FxCRt}q5c7Vi=e8=~5`?+eTlQU^N zU1=n~+I-i}6>yCu7QhpSn6`>IPl>4xTHuMbF7sY~#Cw+rzR4?38rSi`Q2`Yt%@q#- zMf;%c1eZQ8D%^OD{|rL?r7B}0LcHwAfI~IzhWK-mb$Ac{`fk}~dYOP}>cGr-9}B&3 z5xa$C`vh<;js^nXDyYTuhVvv%elK$P)`NwgSU`p_UE(+*k?3efU~}0zyFn_H)wm&& zvTD6-6M+nwErb^>JOgT##pScpelQdV5pCippnlv|1jJ3Ia}MZh2E;GS9wckv7E-$? zcygC`LVVrceVS|Em|k+u9?-HN+Q@&rTcwGIM z4wwuBd};PINlxK_@uGNDJpP5plF{#))#j8+|tQ%tBhURRxqt zqM`=VO#I_3A{KKJ!o)gGd4u}#Y{%ap5%~pJx46cKiBc8AR61B1Tc(q|Pt7J}{7X&p z#L{(hm9|`4`g2AeCpA|a$$=dx@VAqMqjpN#k z?A5S(C`yTq7RS8NmC$5V!-UNoCPI~td?3*C)T5g~Q*)X0fKu#@p&hf!jYc@}o8+F$ ze&RuaP%W_U&4VyWI$w0hzb~tiZd5GhHyFOT>f)ysUl6fpy;cQhNON(MEEEcvZD=GD zRJ$|T5b}URTJ#tzfpg`|pDMrybjYa=DkI#lzx(FlwCLEz6HR>%FaP=`uqrfm!%r9b9!aL+qAi;K_L=XDt@67t zSeNe=Hb&cA+!#Fp+RX8azp zs^Cz{dxT2hudfwVj~s907RKWjI}Jg-_aHAhzS1N%D|LwN%KL}$nxpH6+rcM2WbpmC z&8b%7L4+&6KK$l2Q;jJdkfgim=1uVfHS890_ThfX8S6`u8#{I zvdSl=((1nEJk6l)x|@Kw^Ao3&c>sUcESy5j?&iq5{pwDbbdSU4(#HV3=5}NbKaf$; zf=Fex*)9)=`{{-OTIvHPNE1-O6PSF&dkAgJ0TU6cC}&E%PuS3gR1{P@Tw`X>QIHp% z#TO9#MfmSMA{aJ-oGtYVA~qGM&?VZrd$tCSmerl0?yJyvqb+Oa(?;A*R$TgZ#4hE? zqqN&v$%M%OL4q|Zt216P5z~1_{WY&URfNqc$?b2A6zlUyVbu-{a>{*aC~3!hiqh}0 zRMKMPQwUKeoD9vxpSC);$70?}t<)yRbo|YxBy#F%h!$cvl-}hRvE{o4nO>fU2Z5zi z>INm*5E08{IV&?2k7lxaT{v1GTrHdo-2DjJeBT#(YjS&DiQ=W*POG|tIG*0$OL`cjE~o@_n+ktk!#Z<9eF zmu6TNw}8q-w|+)7dv;ex)jkJ{^&ftzs_bukME4p}M!tS<#a^tz;|9K9qaJm7@igT< zKJpIq$I3pW=|6}W?w5V*R-^p(cKv`qJ$#k_GkpFtQvUOYi;eT&o#D((|LH<7GyRV) zgpBUaD-mh0*8 zn)oT%Wq~K?&&hlHkaHW|OA<&$d@}1t&p`pUo#QP~@T`3#kc#{0=E%%ZhB2AMp*mleKHc``FIj#x2vv68r*TpDqkN9 z{_{$quu4*AdhT|!nvp?~j8P_-NBk-vY|>|k_IAFkd9B3S*}@99=q~fI?yFgA2BR)O z>DomR#=HUJRl=E~Zk1_GMO6l)eF^NX%r>s*G(mHG1hCP$}OqSPVaD zmt$DA(rNO=lo8H#CRg7WM(>^__meMItIvY5+;huJBneyYU8^#Sn&C!XNz0_X8@~b> z)qd-Hpk943ey$(&jf=MW zv}+26`}*uAcFkm$_jxv7_MOH!BLsfZJr2X-Q)jj%T#l?~^Q`*n-rp}U0o=g^RRqQY zDA%xF@zW~wVR1UEno2*=b`PSPl+fIpGs{)}uMz>F@FKBrC zbY-=sSvi%&JC%}Vg!-36UK+zO0^sERAsSgWTs=X_)OMei{Zv~!I~ONMD7C+uZSAXX z+?;}4x2E<7F^aXEtI5lp%uDk&pP}W1MUSU%w$Am?pD^EqPsCHzMUFlceA>Du# z$)ED`zWPZP5uoF8m1RC~y0p`wGr9#!>9^>A|}BKC?N*KvBOgNVfxO zl2_30vEWc|y!5y^iG5FgdeplRD{cVtSm3-8-(%7;7-D_}bV;tIqU@BlS3Oo?!nA*= z#fXcE74F5auW*8U?mjK^vx6qfc7V(8aeM$aQUDN|LL6T?BeplkhHdx*P7h%zNPRJ= zfTU0wklAaBT~JyLP`eE^1AiBltSqj}^#TsxpgN;g2m&8_n^A01{$xT*cRk<}w|u8m zMjs4~w&-z$4T!8r7z1$y=y3n77=jg}XSGXyQ8X@6Ffi9HJX>!nJ#=*5@o~Lm6e2}P zF~W+5Ue~uNIP*o1jI-4h#Z-_yKy5dR@d&+gQn%$w1JXN>oiYejD}QvURW=>2_3W{@x8-lBz;)Ar8X5E5JOwlJ)ZdmhZ6=Q+Mi@^p`FsY z#+EcM(i_O!>6wke?vip;r({k2=A=3SSE=K92;7{1!CUEpwK`=B1ae96eByJJC|Vg0 zc>?wq)fLg@V`5TJ8dq^?My&@u^QHi3M}FC!abDvwLjqSx5lO4m(%^vfG(%(W5CU>ki z3OV$NA`BQ58fHSjgJ8*O)@Sywm>atx!On{rCLf17mgC>Bz!)A@Op=96PB5gNzhrXu0==*3zrI~&jN-FV@s2FWHO!i z6y`>A67qQUqxpg^hqVzbnZFQ9gb;1m9VLpra;Lc-Wo*d2^75-ox}tw>Wm&3#)3_l#Fy(m_w9h9U6K?trBSfA2r6 z1=-@m2y17wPrY$!E`NU>r54p4j(r6VVgH0*8WPkK&d&L6zJ&p&rcY#&fXW7= zWizKhb`Oa3JaC5xgz&Q#n1sPFroo&7EL03R_rKv(Qza4XsDDE9H9*Slo+4FSPNiwh ztDbZJIVGys1xL~chJi_o*eMbDGo$M2UOL3A0L0592yOaplklSWR7LmLU7oeHr5Ox? z+FEjj^c%pcs?B^|0SZXXVTKWc;R#?M!*q3at$Np;rM&L^R`E)?bQ(e>S}e%lah(Si zuED}TkhbX4P4L?V&l{9=#awfH2WK=ikf_!NB~RqXG+Pf6ZA0$VT&1+lL@TXbZ}K)a z&9xcqE%KxcVuyh?_SJM_mQaf4JuCE`c%DB4KD9_52a7sKVC*?VQSZJudPp_eu9?J@ zxzH(Bh)Em_X>H2+OIacfGi@$222D1f9hM;?v>h`ZF}K(rCm7qb7w|bR^WeoU%6PKm zKFw$FbROqK>#^bW%r*rC{}sWBU$NS%XUc`;QwAKYXC)+|Y@pb&^ruLi;f)bi%FbG; zIV}A0L|V#jj*Z$nfT3UvQb6NA(O0MScrz>>w20A7{J2Z|POLxq0yIOvteVWpVb<#MI`00E*T{j3aJ4?JigZDUV-R)* zcSa&?3wJCueuLM-8P=^<>`Q2{@TTJenF4|EfuMf1Xl#>yu7FIUF3$u!(Ql>FUDsIH z*Mxe)WPdJ&zWmaixjyxYozL5%C!21J@os=N^<}UcVWIev=v=RDYC6APu2OS3Vdz3- zSr9JuE%0*y`QwZ2VS)GVdJq@2z^&hr2Y4ucMalB)2rzPu@iUP6taQVD5Kgc8^XPUf@eQj-Jn@l`SFitjIR8-X)h83!QHS>xbe2j_d~TWQzB}L6<+E{{ zKs0rxe0g1Hu!$Zt-|%_v8fk1?!=!YzuLhrl!koyYd6?<#spUBS90N!e)Gw(~KH>ynh`?_jS zx41ht)pSGpawlX;$Tw)NLTc>GtYGEQ=wM#dHJ+YYFCx&1i@;QMRm7YQX@tonBy{|F zUGw_=Y@7Tf5qw%g`p7nM*xGgG1JOFr&JF!{-RVBhekG!?flY1>}x?m2Fg z+P2kn9#vjPo7HLj;r??ufkPLTdO%E);c{~n40?nF%`lTh|FemRb`RR5xeo8yAPIw= zrPBeL;je)YQ{O z%Z0^+05cV_0;BR7Z z%GRpE2}ccE0o51KV0Zf?t^?wdh{)szG|XwY(?fUq1oUvMeXNm1Z_$(`u~EUcV69eNu~l1Px> zClZ^$-<26>vhmg94-9GeWH$=J{^Hoxo@Cc8wI508` z`TK3o@B;yfUKv>0OZJKBm}sDl&`Ml-CWRX8S|jDDQ)p+KB9H-?rfn4wDj?$U^Zq}q zR~WU-7TNoB3Aw9WFDC}UL=hS}Wqd2eTY%fgS0OMhR}E2E6MAcE)mddGhkVmfJ7=VF zF%zIck@Z4d8}z~xbg$v?fu4pX;R5|C2T+k9phh777QdqLh??)-(2O^vmB=)@8V3!S zS_p|!qUiNDY*D1_^A8)OzD-Ze&fg`@3C{Lw0HpO0c_eXGzKvmXXLMu&>MUlwrOlLn zZ)-YUUt_xiZC93t;TgCG%GGc57mlrMFaxED%AgCRpu%{(k$dK?6f^hpH|^DzQuZfn z72DPaGV2>L-~0fXX}#++5iBn>+^v%|k`-n#5Z5Q)H($^`Ttj1#K{NQ04b84~?g)1h z6XVzSmF3-A`wNIR_OiSO-m(@WpZ|WH{WZcOMv8u(BFB*t)u4DL9yx4!Ihqz^jZmSo zU^IwgxxE$mB?0E0Y&Ytv|8rY|qiu+Ch!(x;XMzA}*U_Fi+YEg-QtErIB*XamoE@!c z64lqSBxFEmzgLtVx^OU-8?i@S@Av#qN(NaXr*X@rv3*ajTA>4C#c=xLd}4io5Eofz zz9*Uzy%Xz|z9{nXAy+s!+7OOm2-_^M;g12u!r<1_8;pwgrjF7%E2`CcINI|~#BpqC z1`B1RJMBFhijhR}M5qePmCQ$&O02q)UZSV9!FZvcaHEoA=i?B7s#)`by6@e@cyDfK z&!w*bsk4J~T2_k4k!<50BJf95mnF3grO}boCWPna_5ouqGieF%{=BeXNma+BA`%Vq zB$Z<>CjEA2lx`U;{DmQzcgWA?p*#&gr;dy=nR1elGpG!>nQ9~#OJsxmi(1JTAEFTo ztA{MUsW0dTV8P@1OD8+j7Lmg(q0Bbb-v@mRLk7hpZ!X=6hglE5Tr}@Mu>O2_6^t!W5Q77*F))7Dm=`RYv_X`kJlP> zt@&{9`If)JtX}3O{w`~Pt|lF;LDeYEcT68jgU+O$J{crV-YxSQKMvzRpA0*q^9A-u z%6PuIU#z+<$KMco3nU^ep$A-XLx4D9q;`9LY`-x4aeN+%a`(%sWf;hRJ&lHj+mM;G z;>2R4LZ#*+w5Resy&Ch$t8+Rh?Db`OOJs&4&9j;9a=bI8PVPyrSj(SzJhAJBxBwZ3 zE5~mo!mjro78f%FHPYG@SR7+bE&m-#TIW-(NpCJJlmg}=Tw%%(a@@s62A6rq-*-Y}k3 zL@t(L?I-}k6&bez)W)r?ilghO6px(;>V6U<6}y0hD(ia9?e0LtNf*8VWH!74WYt%L z@Wb9OQ#DXY;?fg|yctq4dWo~(BCK-DD6o~1GMzo2f_}#p4`cnwY>}9Sv@uCeh_C?0 z0`Nu22tG|vKoPSz`sW896M0Y=Tgy5u%iy#jr~eURD@U>>4YNM?Ht6#66PWHCa)siB zVlkQaifU_SFgLKDF%rP(`p1Siny?48zEC0Q^9Rb-u2E(t?O=ffY{`+Bv|erf>cU#F zZfqv2L1ds;r0`XAqT%gNR(N2NGE3B!TVOG_)aaI=pi=zAS?eDd^PeF_7y>QNPYNx3 zxmz_ke z{?y5%2z-un?5XB4R1}#Qzb2)CaZX3=F5pc?5k$LJJb#a@gsW3>k`JxHbUGdxWKKK$Viid#ZLsh!_b_3m5?4{{qYtdA zsI;}8)%PFSGQm%mDA)YNvTK4z+uIG^c*~<-$U{Enn7dqRtB)6m6S}SkIK&EqQ|%>& z44h%&!yX9>xYEXtb;8oFXALebpSHeHVG34$4qKgI^jY)cj?(Z9)#qiW9x~2%AY4;n zx;YSRHmqyO8jkA3x!g3kN=S~)@CC#cGiRG2q83F^teC!~fhnoUiHp_mm#NYo9BE z8*>GQvOrr~3c%YC2!d|bjQy1T=JdFijVIS$IFcfl4&~Z?f}G8k%~K_m?$wnJ#eu+#S8So+d5Y2 zJSOgI<+Nv19y+9Tu~k$bL>sHHv(E%vG0^}E8=7N-tn0xVH;wE#K)2jOf|-5uYdIi1 z`e)3x?8bEZt{hOrLxsvz;gmfOH%h1(!)Os2446LP#Sk#9lc4H&qgb@Gjr6$hAV+AJ@AWWD_K8fcDQwA24O+vd&hZbVh z!KSse_|xQB}?3~S6#l7`b{f(#E3`qxM(FiVDK zgF|dcTfQA2X3BvR24l@jpWyG+mOnt)*|i?Anw>~sczAC0c)}%zQP|_8jAN7uQW~2b ziG~;8v7!X#b8*R$k%V;SC%9#tMpuaWmgfVOwQTDZB+u~K7%(Z0u=lO7X;B`G+tartaQYN#2SX~yMW4~iDopow>mee-^$ zWou?@iF3vO#(fTXx88d}$kl|t*8c|h&4q~uo@+TurTyNxE^L6n>CrcsWu?gE19axs zzc7*WW8LwAfI?GISWsr!062i7l6(Bc%p-b`90`3db=Jz0X`z10PQd>+n><7m+IE*W zFbu8K@@;1{bcMd`EsNzjA_HS=+$cu+>d?gJ96qnhlPqaBd2wXOJ?t18b9Sa-sTH+F z3jF}<4Sz|@tu7Zl7Vk1_TUl|^J*w)wk{0l`1uvCTravED-8bae+qrI>`bY-}L0neO zlqrj~Mi~V7J!Sgp{f$-jIA>H!T*8{F{G5Jwr9&EW z6=_vvPPI@e(9ZVDbzy=NS8mGzID&l%W|BzwdL?=#>!tq`RT8{$WV z!it?WKe;aWt;`0G=gMozuS#qC*Z{LFHy7CCMi3}LdPR)(MGQUOu>tq;@!xvx2lfsu zyw^nD;FjD$DDtJdzDeDiSCv`J0o++o9`V+^5z=HVC+|0(N4IyUePer%ssH6M{VyYn zg_HUJ9@EVK#mHj*pNy;=)d{;zMx>rgniEM-bQ1avr%81p@P*O{J9%VA4CAVLNwLJF zXOefSuQ3FviFFt>N|*fp^_?lNAxKHepkbfI4yz)tm3fijPdeGL%8*0q$Q+H9NQ7D^ z^YWV_q+z1dco}FlT;z}T@?K+7tLk-{1o_Fg(F!Y7c5@Dbl z#(9x`k`4wbxo%$?<~#5QZXjU%teFBj6pt~W#naUlt|N5&g;jw4X}@@hb7PAr&T%=7 z|NZF3aX}D7YtwQ8FK*4*7tIi>W2r=BrY9RNPtLkeZ^qj%G>jlu)mh7Ao#(q{FfhB5 zqjYkbRK_}TBSJ0T@hBvLUjF5+DW#QAZ@H76=9$+q2_S3PUeg3!vGD`J*ka!>_S21; zz{4IVUz12-amu_m7(S?`4RVx%==$40Mw@WttK(h84^E4BDZ}pm-Lx1$Jtg26QaF)F z1zQn=qwhR{P3O%1B%ECF2iq@7zHO*WG$Y?=1tkYOjXS)75?szv4;A&O=qY<2DcGL1 zAo2QmscqIdHQAXdj>}k2PR7U!K1S&M=dpS9jUw*d(b6Mq7^$Tec{VS6{v2`(ht&Be zbGXGT5Wcj<9HYgx$x+x_H^Ik>XU3w5`rzeP`l+EW?q*!p`x9kxKDaW+TQgu-D4voo zBeI96$AY`XO;A1QCmw)CGy6!(ZD9Zq@?X#cmTrME=TcHFN)t&Upg&581qc zLl_1vnYgWe)~~yqqCMe57H?Ip#OXnjFostoi#5~|?)n$TXg;HuA>bUV_W_PcM~PwB znYyRl#mKKjc8Vf zt6aq}=&XF^BL{oRsX8)uc;$w0Y#HSxS}wlO%VqI4n0n?E3reT0_2l9~bKa`Ly4Nq@ zzoo<#|9Qgxd2aqOW#r)aKa8IFzhLyt{}V>Pt+i=)$d2UmqH(7LVMNbRD0-v4NIOTj zQM!%gGl2m?!qU*$StB|&EpS!$NXWA^-H5{Dh?3t0OX6q%&*f}3gNKka8*UI8?$vUu z#Qo#U?A}xOQbFkhqvXtmKZC2vlhyO#hYRA#YLXeU*bk9{+agcy-}js6pZ05DS7;|X zQiQZ8lM!jtjWjQ3(|-x?R86p8w%H0ogJW3MUD@uq+*eMq(~yZR5NdF<0E;O}TL-U( z2-{}iz6+ZgRC5;rc5y?kHF_^MO*z^a;1Yv?6bEq@eX#Toi&0Q>xAUB@$HUvGhrv-# z^@2B5WLZ(9Ujo_R_jd2ApXQkP79dxj{Qzv!mZS%P9LU&=x@`DkO`&jGu)YzWv!#sj zXW)SXmN1uMF(c)qbr{o)QC)5;ci<6a>WveuB)5?oA@faLbc7Hbdl(NpAJv*DVg|a6 zYNK)Y;u6l~ZZ(cWb;^M`T&4p1vDHc^Acsw%<8%|QC=;e}@RyWvd3jx)cDtK&hS3>g^ z1sW3FMMG#JWQMTCNz@d!6+bg=yE!T!Q}WM|7Yr980wsPLBq42FYn+}n+9en)5yz(H z^9BcRB_Lt7@f)hw%^zuj3`v#i5Y>ZWx+j+)O0*IjR{*-%F} zzj18yNMp3eZMe=0Y^QITp5%G--zHibNR0huuVf1Np_?D-GMS*=BoRF+){Pg@pmKQQ z*wiCGhqO*)n%HebS`n+qlRWIdKx>no`8z^{I{-n8#JA{6L5ENq-@GPpG^6GvpMS)6 z4*jz<;KKOC4S0t8Ny!H_cUUEl>FO`l2MBm)RGe0{Be7VkYr+N1Tkl4WP&BCc1^)Pn zTKb8K9(+eHj#ean6Dd{m5-WQ4$poW|umJ9aY(y!wcT6N^Jbjk*{Qnp`r!GOXCEccN z+qP}n&aAX;+qP}nuC#62HY#=N>@m9g;qHg?CsxFYm@&Vw3OTAM zAE1gcJf*9Kh2f5^-Z#dd`CoMRL1h+3Q*m!1p6u80xi-2NdBT8sy+-=c(4#IXt-^-7 zx6T|p7&3aLaTAc8wW zW1c+G9tdPZ_`;lV^7?Dy#&Np;nsVen2~zJYGceor?uiTJXMgb(`RBRos;ZlM(Ohqe?M%i2?6e9UTWA^CK;*3Z8S)-yZW_I?2G{s#6DL*o9Idh|cY zH6ts>|K>0*EJfOe*>5i{*%KmHI$SzE5xf&O=gNL7)aEQp=C`b=fM2y6E>``6TwRtgF&M~f=rHYwr;5? zY1W{NyKl>_!b2`SPIzSg!1ch};Vq5wPjgDgh5%4(#q2bbI(>UbyX>WV44>FL-NaJi z*BV8DP2sw$vj!PjlYhMF@D?=23r40_FQ>P5nW%1ova>46vkzICM{~lV@-`bv57&f( zYMO;FFP}DTHgaXEt`@mnk!R0Vs&e>@i|F3i2ma!3G{4US*cH&{${jjt%?)d)NFRQf zEF-%k133B|M@-TPRBhE5LugRA!Pv#318sEGFQ#U#FtTAXsYi6FRbVa+G0m?=t@euw zx{fInJXC$cY95 z`zb%T0g~8PJ@ocbIx}x?K@%RlAdm zj(7j>l+&%vu79( z4e~nBe++453)jaPcF)+RnVd-#Ge_6y5+J4e`TmMBb;=m)J837dYKovrTtas8h>v^Y zVKv|<7Z_z`UkmFRykXXeT3}{FzRHszJ;+BiKIHySRggf6ba?D?I_jeUWp+OiHTag17H4s5DKx>lc z_g`VOGRuGK=^VA#c8aD7n!rp33}R-pYpUnW8W+%MDN+(qaTfZx`s2+py<{mke>EKo zX7*8JOma_Z$Hd*Ul(T)pi%m!~OVZDlErCu#0m^XN+VqhR7gk|22eLC!9ZRJ`D2Q?< z3XJ~J239k)u5yvZzc}W(aO6jPu|F(9dx9#bFHJT|yPNA!6q9X9n?C5v}Mq& zu5{vy_ByFD(mo+{LlRsKkON05{tEIb%5{Qw3R=F4$&l|vYTYtbP44u6&Ij(d%0PmL zN@Vv`)UMcox~XYut|AeGPRS+n+c=7by{dIQ1i7G(hd1GX(YX-_><8S<6BDxjjtoAwf+0`cj3AW9+~T8Ht;fr2*` zBFe7AVo_W->lI2T%l`{lP>PKe&lOM!ZK4Z)Rz{)h?9-fjwyb6gwTEgdeLbIBA`gSN z2&qD!>6~+F-4hb7995z`pkdIcQsJ*a1}ufDXcS_kg?YB{2J<8-lBT&>?xel=gAhcH ziu!R1F$qsd8MrGwLyIMzv@BV;`~`5?*R5}eqRXpUPN$UODbpR#I6E{=ZJ|}F?B1gv ztRQ~_DX|q1W`*?n%h$da)vLr42E@Fe3W|MTu_)!I2v9@LlP$~WnZY8~h#e9oz@A!= z>%7Gv!@L-_x%w?tFRx9-f9*VIc)96L$|S*@%mku!uErR)DdqvjLPi(YFa}$8Q1vxt z0J&th>Bfp48zhm!Q}ASa$W%4lx>mVhV$`pVU3 z3hxXX(|0wOem2yn`gJD<7(vnMbVyZz)goz^N`z3ln8`>Md)yjo8ozwbmK5X<7z%O- z=ng649Zx&9T|0HN_r(=y5@mJ<#X>USrG+M%uj%}K9x#u2@pJdh%3#3|D5*1+v9Ypb9sLx5c_Udpm6t1<&~vY!MozVFQ4yjQ14!rF zv}>W?9q@V!u+_4*JScS4(C0oGd+7{=@l=!Q5Bwan;ae6|ibB{!3ZXCSM$!$s&Ihxl zIhZrw3yyZxhIH|JrAvD~`lEN3OX@JiAytT)v(m(o%`yXsjJobJImWW*8ydVV=#z!` zeuUF&teUW0R>g<=Y$S*8k7UGK5*1^O2Tl@7kwA}3+( z#l}q5>KT#lq--!qs0A2a-y9&?zJ2YuPgnXUB>xX^mKx~e|6g1GshI!y>oKx(aQv^| zhWTHJQs)1PC|%Z&j{93%dq30>I#hsGbP@}7y|ze1m04snG0qH>F?1qYRmT#E7Ir{H ze*}GUVptd-yN12Qpvce^>3%tRPOhdwucjCl#oIp28-Tv1#6#<8|%$drj$ zrO8(Dg&qxC(^;fYLSRC&i`G34lC|Al$T0vrFuZhe9OBbUkjv81UQd>v!`c^P>+um* zy32U_7+>eF3=X^)yD@Y=Eg>8?ywmRL0j?hnR2SlU0(rO;|?HXDVvCzQbg)}J>PvN6@k%7O{nGzs}pohDz$^l z0N~GorYT|VSqQSyCJEOGM(&-MpM`Ngiqb>TnQJb7*cacFN-qRez%g<5=ZY7c%oy?y z9T);>dpJU>m}V2}9_>0(NB2jIcVTit@_@bPyt%x^W(R&>?$`Z-;zYdfqhuE_sD;Us zfqvZiGJ1I=B!s$-`9u6R1VaP~B!7C?AU&vP41SG#G4=QpBy?!3QgHv+aOt!h79vKt zesF3>%?PJ~6Kmk*VO-KXE5%Abqy=Z89PjrHoQM=VPOT0e=(mae78QTIFCC1ny@<1!>08RxpJ^EXf6^=;-o^#+f!V@RiJqxR>f7!?fG zb&+I~+M|&Na*i}6p5Z}^BxZPb+vRy5WTr0iYZN>+o)L>zcWI+bDl`Huc*p@FK6p2; z>}|I6gps`ChJ~9s>;kvAO=V>@tH{qcwPzNoOT|Qp*zYa`A|avK@yKRpOzTzaG^Kh4@Nl@IYC_eKwzLQyB4p6)oudv1K4t>gs0+7^JTis8pUl-hZf0IIbLd4BG z88`$eudS{?|Bw~r<`1}7q0|&h1hm-UNTe^mQ*UjD08N?Wyn4H8rz%*B7Jb(`>`m{* zih@a{f-aez+9i-QF3d4;8EL1r_>1-?%$d@pP56h-L9@aT6EmEG)S!oeRhe z^HJLLX=4sG;q688j4kF&P~roY2jKZEeSqDhFJN>Z$8m1t{gZ*%~+(cVCsNxQD?&)D&CKghK6 zQ*?h?l06o(cH~{<;@7H*r=9=a9IBY=;+E)fjb}9@#-UpWaNr-O)HyfYS?`$8VZQH+ zK0t}lXwqJa%cDp|!ZW}!>9zYB7a+iSrtRx`3N1;xC{7Ekmt4QymJZI)!Bs4tPV264 zaDYfs4I1zk5Zf*@v?qbAKb4~-<&#mEsnUL8)EsXSVBj{o$t;C3YQB975dHLIdx!P? z0njo+1p1eU{ePG@IT);`_Yra0=9=F1|*R}jTQj_nXo`K zu?8X~8Sf?>I0x1FeP_0AlEoTkuf5PlSfGiS)?vE6=sWQf_0k%LU}<6~;)uJZ*r8Y2 zuuC4vA0(5h8AnCKS{=YP6J0m6{@O6sK%-lzM+jdn5E2~_HV4zRR853;5<+zMwd9Dc zqPdwPEpW^Y697Y$#*aS6CJKq>#!))JbB+6cI29G)MM^7!OUS zk0cZG_3zvnkHZPvzi(E7>0^s3YS_ld$EZ12? zSYkYB&>NSGRV`WBu^&4Iz?m&*V7%qN@i^@ft zVvTAhBOKf%e6{js3i{Zrmp=NnIJi5SD(97CsQ%+-GR*D_>X4~7}rb-NLUTaKgDO(BN zn84gvUB#alp&>W~wH)0gba{-*(J~zZBXcvcEBEWF#~iudR}8FgK2%e~Vijr%<*03T zbwp!+n>U*H7U0+cWr1Qmv1pvJit5XSuB=1@XEuuFQtF2LF@X4>LQvpdjZcqGE$E5~IeH3D@O3w>KNHghM1aIkb{VxL~Nf=es%Mry&0iUg_q zd#ffVr2*uVL&~A4;n0MFNUX=i0P_$qHvI+cLapVAmL4XhmjA}h=j1rZ-0+SjJR@WS zUB|mO_Tu+u8p^8{$*Ywv-TqWN!m;NQlorf-tz(ItIs$VIECZJkmTDF_7HGe>bp0F{ zT@Hj)sO)@jhBqmhFW-U#Sl-2$?oG?a8*1@jCL^ofpemC1q72`p)v7^11!Ezb z<8!5o8kFOQX>Ck*m^@tJ4_n+=l0Kq|M2F!*`*mloCMX5q{iB*M8ld!1Nfu<^IEERp zgZn3;M4R8UCsp{WRWQVw$J~|@c*f3)O37wJs%5*J0HL1^R0bk*e#e61HArp)udOM} zZB`Dfj5~dkC_iNRryZCHkV}ECK>Jku4`(J?Q&!a##bT_&T<`daWGcvp=-&XrwGvg~6{$5SL--F+_%5GNv|e`$ zB7VY?Qo~w#7%s%^lNU~m(sjAzU|(bn82Xpn9u6`MwMkNj2#PuOJY6HkeM4;AkRAF;W18>VbBa-Y!H6$PTcFfZpBB=6<#BRk=5sl;Bs*6p)&9D zN|5#t8(Fqas}Cf!W%u$;&)Wu)PW)Jj5IZ)gKrfJ}@8P;H3zHR#A}JICkQQW_vKFKu z$PK?J+i4)ICo&QW#{PBW1!;Z>oo#Es7-wZ=@?Slg+n#4=n$drPsLZ&7Ed7K;ZK9Za zB#SDj;K*0Dr^(6GDi{Je24A0X7#CI9CtDvnvP@(@^EE?X%s;`A9e$(&=??#1$;M(n z8d%45=lKz}5mcZB_K8RdyC;wt0MQo?;ka^Qegc1g1Hq&O)ci{?@;@v4zn%=H|NUgL z{L9Lo<-c0l|4kZl+-ybaT~*e1M6NXI2kFz>Wp(9p8I|0S7(E@hZbtysw0%UWcyt(iUN-bC>G)vD zm{G7yl#%@#{(jhymoW+hk`t0Qj^-gk`KBz2Umv+Xssh2`C}7x-)ge-|VMzV-_R!Tu zR zj_$*>Et-DBpV5l(v0XYu+?0qR%Py;##?nzR)1|4WPL`o6s0oi_S_)-xN8H581hcZ2C|wK{aEtxtunR-DtTL!7crux;G{}?akkip)#Rr#o1l5lx14J7VS=kEco2`P39k){^=nLlS1 z3X?i3DaQF7WI{^jck7!)AiIMRVKEeppJ-}h=q|$B2R>cD+5Y1Bq(N=WEql_in_Cc1 z)-~Z`V7sR!VEy{BwyMVJ*MtwYX5|9>JlpHR%D1hXjg~Mdbh}fMJ(ON&Fb{C0cQ`dOi>Keco*l|APCgrH_|!Q$61~&^ zqiNmewuio~oO({xe2*ss;Op+lv_3+qT?5r}ebGoZcZd<6Scb~3D5#DO!@3O$L%doH- zA5rP=yz!(V#30a*03#5vLCkImh$ULEKLBOWQiXbeoDSTfmUiZ(v1J-(Q`4;dqRY5A zM2mRO{Lpm*#Rqfy+VKqGf7w*K9!R`Ooge(vRH=JlB^Y7=f{#^uSF@e-*q8xDGsEFJ zA#yqs4@6SNeKeDRx+j)c^`oPgpmN*gD*_|oL?|F9umvRltMVjYC4iPpx<4M^N{e~= z6i-Eln(Rh@cxiOl;RxgC>7fW6k_f2vn(jm+VCY(I_$RT^ygq`%Uv+JDuU-^78%d0| zA#=(YT35&22H>h)!~>?VDu^lvUYg}j6MBUS9|~h|kO)F>xUm;YXLqT5 zh5en*O6knghzOK6F(qA6p#{6V#aLZ1fR;L=ysT)y4^;7VERQXl+3@@Rr!ioEeXwtj zXpm0y>9nYQ!}Zb_N&u9#m#x~r5khL3eIL@_InDxD!Z@?LI$jDp!<6;FVN1OrlVIDT zWLSz9&Wxfu^3Qj=y&&J;yRM&7?-96NGbHi&RGYW~FExL_BbdAm@n<#CKI@kKg|^4o z)Q~-bB(8P+lIY4gCAN*vml#?9R-R73Dx3IT`Qu!4oRsS=iYt25kNZmcN|#-fLrLT> z^2~S4jw>Lm;NAFEgwQs*ddB#q{Z+E*kF4VL3Ls(s1QB`sa{uP1OL6E;p+DXFxPldF z>v;AyM$3q;OhPt)Al4P6(p-$hFpR;5U|40*l?KC**DvLfj-Q6h>v_ya3va{dCn%kA zd;}+Cojg zeFS`#MB#PXmCRf%r&EHdvEG@PZvfaVFrI)6Sbzf%OzEJt$btIvo|N6Yjo=7}B8o&K zf?{*aiFcjim&LciqxN2=->;wH#s1_al%#&sy=LRm(B-3Jj;j}r1y4}&@n7i!j6UUM zXy||Rt=^fd>eIk*Uhkn9*PO$3^;v)_KJ3N}kjomKMDtZ(J>gChC(Nv(XvJ$uW^6p7&`*29Euira2QjDVZe0tagK-MOScgqt$p@P zPDkSMn@yI#pXmffk+543#b>OmnYA^t4Ltmw2?0+`E+%TXmDh!CPpxfc+X&Ds+(9GQ94HA-WLspAxrko{aCHzTfb;>P`Pb3I5Ya z{9{UBU}OKkmg8R_CYJvSVp`VxyE7j9&&l1Cc3(0_RL6cHyLKb83F@Y1!zWRP3IQh) zVh{kV|H1|Si~2*{d2YW6KxA`?Bb8)_^?2XZ)AiH&O+WjAvY7Yh;-`)+8DB@9ch=wW z2g_em!h${exz2 zpZf1lw6-qdN}#;WR~ayt)W|7(@|~D6+tQ;$wbS+h(Z~mZ^}mskclOWeE0e76UWvDf zFzDBpBbe6ESvGZQlNW~Q3}Dpe)%No;mHtqYrbK-vt2>$rr=FT+qH-sTYh}HATV9VZ z58F?ZpLR3n^}ZwSZKrV`zcSK)xrs_5HA-C=C#Yo7d^}zRl5{wLTfp9?ZoA``F_k(L z7r(w=eA2$zWR!5#RU}LTVI{mD8-Jf#+4ag%18p+NwwiQGPOx|hF_s60vRnBGh?Pu+ zQ7Y%s31)M)zP8>+IJhAw-Dfu)o*1-feL~AQ29biGCd_7n!v7HnpD^$yNtv0 z>qDw1pkX0&&cV%xffwy6Rvfz|(l#)c?x7UOjL{Mu7qwZEXsl!i?FXc20E`*-OI2%W zjrRa!Ky|sZ?3>WM#kjR>3)th&*%0;VY$gIo9XZU#;_m0Ai7Xn~{^MhZV+ZVeeO|ni zqKv4N2Z-R}vXS4bPFTt`Q0}rw|Y8ymHV=tfC5@0Cqz!jo>!B`E?oD5O5=lWkj^MJDr$h)tv{)l2dxfZqxGu~Cl!dm>>wuBOd<$VH| zA-**$v*IINm4Ix^YXQ~D5V7cwfq!_4# z4@7ko@IZCU<3xAi{@>o8qWE)5WmK*2{5)^LC>>_!$ebPLu9j*Ma}O=R+f`5w%KhB`pl2MUaeN#^~Bxo#!Y4v7f>JU&70x#PesGQ zL>47GoOZ$A&YYm*e={At`GX1K;B$3&_&WH$&lpq!r=s`B_G&BkVLM(~i4yOB)JXID zIY$UQ8`=!t@2|(FdEuNL+oYUGZy&q@kk!8S17O!55S(UM2A>C`QpJvt=xdjvFZAJo zLhKrH_0wEa-sDCaXmb&u$+bU-5r8EA#%~~b%323FPDQ34bbC&eiQo;oaMV;Q9OE+ zx67YTG=IgsEly;hVyHy6ihk^y&bxXKFt%p3v32UAS4}jp+GxjWUm=w2d!(WQIBb&f z7WN%~-xLSudaI|_HdVGn5MA|MXXn<**UsQwj=~6zU&I!N~^^c87-M@pPW08kC)Kh1?^KGUph& z5)B|Ze(y&fje~{VH(wuc+~hdSm=}B6YF^>AbhXAmnkvXPZ4jU;SaHM|pBDxz!iIWw zg!aw;Dp4nYnHNCmG~UnOCzRC(oXU8&1QSMTZqw$z(~=St zOpC9!vhm+-qIOQIjuHZ|hz0gWzGPcw%*fi`Rq7hFM|Tq@Adr5e;Q$j~8Q!%UP)z79 z=Pr_y&`L__%^Km@0!c`_YTSsv6D08Q+GRRKG+oo*3aw{ZkHZ5IcNxBznJWSFBRj#B z!qzowpcsNCuX;9GC`#mXQ(4_n7DZEzB~=I8fip-}Q2-YpQUQOx2)emv1mC4p-}UUk zT?L(rv4!}qdqiBbSUTUEFl?C>e{7N`rt*IYsxksV2#D4l5Er8OHspgc96!Rt?_Wf} zLrkhZh6}~U*AtYA-yaw}iztw5W)EW%q~qfSxeg#dY6zwS zSAxHAd$s{LSuO;?LA>jKbGZ&so2*OEOE4Z-WW8E>@`Znr>S*JFc)MIwemO>YbT7{i zbT-|Vl4gUsXoB%WTkVcC-2#C-N_S{2En2H;wM@^ilj(Qx#I`+)=FQyMHHxL5){wvOMD`1wod1>cdZD%j(Q~Tk7eJ4rEu8rrIvI-7E67g=^+W*< z=B7RlB=7C6u*~YXzbXS}C$5dtR#;Pb-lt+`qeX{@;MHP2YIjyhuWq2$sN-c3d5;!Y{u;+y-UsHgO zS4hDS6)|rZs9>lMML3it_2@Rba1cLKa6_ZXqFZ|cmK^%yKIH0SAFkCk(GK(Bae$Tn z@`W9%83p|!@Ss2QPeK0h!K~G^OdmNwm)v{UB(55>P!O0BZE3Xzd#qai{W19da-_Bn z7SE=ZK+M@epnY{;b1yQjj@=B%vOEg1+MY0Gn@ga+hF{a{z9@9jW`6@-DekcS|I?y>8nS;{H)hWN!~IzP1@~k9uW-K-&Gp315!An} z+f!B_%KAvJOzu%awhWDQ27#*qvTUdC5f=1{8|67rhtsAhpKXalqrK(4z31IUdA-8=_3A@lRAy{OZ{87{gGY9cLViWT-I==nvH7|zHiLg;7Pqg77khm&4W)X zC7RlE`_?CVnEtN;Uit{1>a{C$wGO(rr}HqqBwx3wpgGrNw^4YH18{36T@C!2y~D&F z?ubM-4u`&N28BuMj=lRqPAfO@7ile53%RIT8z)@rsHfIjHtBUDySvYHFFtLrf=~NO zYKxrFoHf^Gmn}&h6N6TCFIT?E#Fo)&gRn|E3}4rnwYsG`SBvr1KvwdG$?qY3cOFM15w3fKVeHC3I$2!~ zNSCuVoztM|a9~@l_XgL&JgNA%aF$m1i^1Fl*TJ5b6_uNsXXb)_O@F<4pz@QIxLZ06 z)h1pJ8e}|@TMVrWbavP)YBVrDS@eFppH>a7h!*mH*0h1>H5PNuq@aj}$_5fot_T)d zt3U%YC+wUzQBdS??u*3-IC10mIK)bCYorHTrA0=;&}!%=9b^XOC~d3ZkYZ#G z{e>T@@JV=1cu>IXPJ5wrlqmyYX5{WepZKv*TNBwl?P`&$w|1kU8bi?h8rreIFe(=D zT5QBy3f9JXKW3vTH#|)Nls#?53Bf5fl~XWq45|6x&8K!c?~)cKxa4(%OrLm)8J^KD z`-n+FXHvK0t8bzO@iIRFCxcXbD86<7$6Bf5yf64+iIB;*8Ur=O&G=VGO{e4RgSB?q zGw3fMhM`|>x0;>1tA!S7B7nr}%|m@;a>@*#D=jXqR)ESRzmO@mUri16wNv=%^k{T; z^Chtxq>3@uf~djMPf?jnbl|~TcHM6AeY7I;41S&uAGqLcAxPZyDrSN|6tALPhZf*O z1OME$K;>NDufdJZh4dEcvmLxBXge;A#cPaxBxL4Mnd+R5!b){93P zvmIPyePm&ux~UGu@(;^ENJnG!VlyB=g8aUn%?u$*cHs^?B0*_jc0SQGQmhE|@>nT% zZx0w%jP>DANq`<#Ew8Cmp5zL(iex1lC`7Raw8yh3-Y8*}#1i=t-Xt6_|G4@(- zCjjjz$GN8rQY#sfNP>}QZ?`>R-;|e{Fzb+GRHC`Fyr7jPtvzqwZQNJl&dO9QUysSx z92u<8?)4)73I1@iZ;DpPYDp_miiUEYCaue#mu1Nkq|t1L z{;Ecw-G~Gk7~yXm3?lO@(tWN@uSA-iAQqyUEiG!PVh~BXc8VaPQsxjwo3)C|S`bR`H zInj5uKmdw_dS_~=rBYdrRmvaSG#B2HP3UO_Gm}U!6jGwOI8Cp2XCN6u0%Y)j-N-Uv ze6rFLU%D49BtKR_t6lcYJhflD5IEmC*ZnXyp=jE&2PIh9Comu=mXK7k$zJ+#To9Zz z=SYG=#`&h%0jD@DzP!`T=%E4Nq`Lmpi{OGj)`b!4y-1Ny=I(%q3h&J8%`qR6teH%T z10}zm`lQb)bh$mNa8r0ZLr)ig&!8-lnn_C{`3eT3e8I|x<&2ei(S`Fn6lX~ia})}k zu^S?+>c_wJCvcie1VKY{E&F=Ni!JAbnNpOu!y8E1uo`f^s2(i<--%8krIszR`kO7d zg4KturuGn($5JcxwbhrZX$vrl>p-L&XrI7#R!=<|-Zy)eS0N1EJH^OM`gI${mpW1c zCB_A^uA4%ij0T+*+p#K$u`+e3(myF%+88_bb89;?&eV(SHkzKT)XAU$zcuS8(}Ux? zh?8oMS@4N#2X%s+tXt%{?4_82W}((D3+EKR{MB*vy{`*oXNf4j>M z^t9&zFdn~41(~x6W=?fdig;DOTxb%om#)anBAloIEX#GeSz@L*ESc?B1n`Nt;hT2( zLg5a_N zue2+L^I&YQs6!j-fWx9w29hP0cqmhrQ_AGTVY(C&$7qUXrYxD2w!0Pjk0!kO9poadyf|J@Y5~K_iPheZ98!U8M<`PVCEHd- z`0UNv2S-`v%VSDxgVHT1xUSUkM7{-Ku*2CkGM_Sv!IAm0Q)QNJm_UUW^VUY?C^DUw z42D|5hq+;^D?&CxTXZNIOPEgfuSB(P!Yi!|?|Gp^S?K#y5+Hk;#nu5>_*-k)(dQ~W z@?j16hh<$a7A{m)>J&R^m9VQ+NPq)h$m#Hd$m?01JD9F6vo46&$@kbui7X_ws5n$r zy_)8|7G3~wrRyE0PYbSWV@|l>#k5>@@;Jya)_QHgPBQ9wBe6y@loCZpSm!10>!%Lk z5x+#k;Dd1R0;jevX7Ar8<`-qrH?z&&SRz!gn-j)&{r=$?nFD+?QOjlZK`7S z2wL)>AZE(z_h!NWlJTUSa{x1T`EpCWubOkma~8ct4H1PW$+dbGbSOj+6vVDd)0JSF zZdv&fsF{%Ntrp$CYcyRhQ8c_)NWS=S)e&XO#yXgmkdbiqH|4R{1Mav+q=Eh^EE1?HB`Dkd)@2xeDa*6nEPfj z(oU{?UBw?)408l9w7ZiLN89gyy|l(!j)B6b?^lG{bSC|@9@y4p2`?b%yjtz98XG7#H)NLK1vlg-F(^kLKs5n`_ZsS3}x+So?blqSYTGw^iN!+Cf^ z158=7$@(69FzG}Hamp=>!=>uC_t91I@;0*zSfVN2(9JSM|0K{gY&&(R_G1HS%o(Ok z_inskAy_{lkMT{ffJ(II5`nM+d@cd#%jstn?K0AvKytn&5qmVQRNHR3d?WHUk_Ws> zAry($=Oo5P9ITx}oGYBnB3CFjarz!<%IsmZ9aY|2@DN=>(g$wUmX7wx8s+C_;!4pq z&iO=y2R$xig`3BV};oY{^8?dt;o z>ual~shw2)G^Rk|Pta5tw1c4#D(k@bRSO6_vF-%nO=1rLpJfQ+D-bLK(}zx^yW*A6 za>CgVrLY39uoJo^mof7ZsGUb%a7R1dJ%laNO`&aDM$a-k_#~OrbkGt>_V^J!T(Tf= zI#hvKEG=N)$^n+g<_|(@R1ExEyOfbR-3~0)QbhlzcYK@IT+HMkqYU zK)X|j0I;Mnx_y2PPcB$odS1{&r@>ZcWN8p}Cf~Z-DTQ=&3)#h`^gf}d$eFN^h{FwV zXO#TJsaj||cph}#q_N$H8$B*1H28b_sq6}T`+4lzvTpGuJ6&!3-}(jvP&-*B?_1zf zn&?nP?6S+3gOx$rdtD5Gw_U>_!He4KS-%hh_WVwdh6Zq>9KNCputq>{Lpi*5I^tUC ze?8fW+2hEs`bPK}h2NX+ZwLD%xMiG2TsiG5TQEA~iqNQ}jM8FqVsg`}NafOhc7ME# zd@!hV&gMKea40d~akw0dZvJ&SlKNi&nCXc^#vsX@J!UTv7}0@yKcVW>Ptm2Xg=4Zh zyb3Wj=YsStopbvDFoJv2y%j_zcLUHghDQGO1A>>*Smd-R-~YI=F1y(2)`l9;v|Q7f zXWt-dF>FX7j!n!P>qTKcun$v%gl^8O3m0Unshiuj2s#f$~Yj4pznf>uMQ zC>pDZL$LD3Hc0upGAV*-3gt9UR`GI82vczIU~7^#qJYXM=U5n{WXxYM9?Fk!y=(h5+zsz#PiE6c~8 z)syEs8>^DTCb22tz!#8!V9~RVC7Zg5ZS2wsSKe0s2`YXrLP-*B=uLNK)Hgi}(M&VM z3W2jKk(&uzlQjc%p_C_L?&L`#M>q^_sCaFsDc}eRe6voi9$*GgUQ@}Bh#{N)!3giV z+>I{+&yNgRuWSxikn!>jfZM1(*FYmN8+U|fp+#d)EhH-ZUQ z=zbHI+&K@yWu$j3Jk32eCJ33X2QY+5>2j?#fu@Pj8e1qAulwYMxXzc zs2F&*;BXGNMZG#%v2!T%(gg-Z==fI)_%gsd?aYBD^tJv1Gz%GewFWj|3W0OGZMP!G z_2`sohMQgs*&!?jtiVYSYKbqzAF}9D#W}0yN={K@oyU!E^?P~v@B$ZM#f~bd7VAf5 z0t}nL5Ocd!OR97o^YeZ2n8_9LUElOV4=u9hT=D`+=~^W$!m{V-(a9!Zkk;wLT_*;< zm_BmAVTEpQC@i*Cyp=kR1g{LqXHAZ+KMZ>VAqn6SKWy}(gNlK`Q+tA$3<&JHGSO|m z8#caSzx@D>!$$r^5C2b*{!ck)CEn0yqX`UE}-RHi|l{A4pe>ja%|kD!MR!gPs|L_K;w z-RYkhzpUbrzU0O}Kr4-N4;@W{c{V;?aFv0<574-_0vv&<16wqDYNG`lf#ETl( ze0z`|pDbxe$cD}f&oramQvmgho|o3RN_7QLo^OA}4m{{ zOItxlHk$m!_W^9J)?LaxM%U;OADu1)5i*u@T|5bcqhc`p@p)B{`_gSK$DLlp2B9Wb zMTqfkWCcE39;|ewI7vQvpY$63{X!c{`i2mP!0E{bSYF?5VY)9B%x7er+UM3={CU6+0b6*k@~ zgO=jmrQ^kU3A#=QOFMyhBrHicXEpT(0RgV{zZ`hr;qwu8$pkSgfoYV_ee4VN6Z)2s zI(xchwZoa3oU*mHXt#;D(U+U|{Y`yUY-o&cd||KogT9NHsDGK4-Z!3PeWi$v6;N_ybRHcIyeV|vEfhe# zn!ZT6Ozb%|Npm)2J6YOj!utnyq!T41;zqM7n(H!DF5$C2V3cC|kU#JpE7Zy9<#31G$&>RoD zK6!%6oALJ!4sO1S1;Xt(TWTT0F})Rwe0nbs0birR6J93FYfeE|ARrtkhy!l%sd4=@ zn3LDFRXd!keD3G6!M$+oztLX)Uby&~e??cI)&gq`$AE?KY2@latb$;_x?yj?xZx)8 zCOU7#k5}}3Q)TZ}Iy|Ee$DZ6I<0Q}cf__UC?k|k-@J^jlj*<1xjvs?|QmVn3mOea( z!fQc-;xnN={5o!$z54(&(;ZOz|Ca#&JW&5UWsJ=KcfP{*FUTm{e}#;;{O`>_fqVfM zn$VrxZ&JBZNpZ;y4If7?yzoF8w(by+>ofdM>i1DPIuZd%hpQ=P9^`ePdJZqw*DE5u zgeXYI;kfUqiHs;)Q#~^g->4^XwL>WkGHn~t19T)hABx2=?0Om!#Q+IOLs^~9ZI?pkd{^u5ReW55fBhi zQc_wvq*Gd2kkw&Cgfoc zwcxREb@d&58@KElTHB5#4J_+#tRH`(Jjg~9v%rZl?)57*C6g2k%ZNYfi}r;v!JaGrlgez;#vqf`O)Mq)96d?~hcTWw4k#*I%*YU9<6)Dca6 z{91G`oh3jDT|XH;{6p&6WUv*p*jtBOnLW3<(^>Y!Rdy^ z?TS=t5{$C@3T`+X$-#l;*Bx=IvR#DO*gAA%RqT=P1l)QBPFu<|s8$QBm|_|CoNzy} zQ_|0~`~IE15u zwXs$grMLwq0=gL=3aEC-2G|xTyY=51SQv}jAD_hPuv(mU`6P9Ry4Aph@d>WfcR@?x z$ou?dD&OIFDS}jSZoX1S+d)F*S{dU)esvv>T#}N6bwh`aL6NIF&fQa$x|5%U%u%>t zl%|g%tJZcMSCQbxaOW%3-7$Ha*WLsNDef!vn}_}zawMxO<>Ym6$lb;p!Lv*lZ?7+n zo8EI(BX%~Jk5Y{7^_fSML5rjZjQB)m+6QDcaeI#JJu zH*-gA7x(Mu*$1Vg53UE}CsO+3F)A9n503OSL~a^)?Gst-_WC!Vhq=C+Eg_1JUa~AI zzsner;d5&tG*E|I630?+7JJ`^l%sxKkV2`lk$O~1*YhFG-2H$6ojOS^!PzXk9Fz?` zb$8uYm;=F-%tJdd;nYzt;62sw%T{n__SOVbei(jE#Aa5$jp($2Bq)RLFccm7ljZ z6sTCN$fW! z&w4n7r|}(#pEA_uwDhUv^L@X{=KlTwCG8lewwJ)Pl1%ObY$j!`jg}YjroXA z9euvL{9u}wx*P8(9_UGy>o+8Fs5*MsMz>QSxOQ!XO_F}lz3HnsgC2aNAC7J%$h-6S z8XDOM*tQ;-^vD{~;Mgw=|B#%ai|L5TV|$3ICK#?5*-JRMFv){tdNDrkR+z-3fyJq~ z)`@sI;T{!<5?X(4w_lBKcEu(UPr7{iIfy{TTbUe|uIw{P!(w1L~?iF<4mQ*7~0KaRy`e@B4C zu8kH|cqCn2ls1eiW8dnLy`zJm%sscVAtFn1975!}B#Y~m_Guc)w*6aK81Df`(nL%@`5)5pY;x|Wp*%CP|&euql9f`%ll9*k+9{Oh$2hU;S85Fj}{E#W{c(Y z;?KS>-t)814g`Q=u`^4RtipPq=XSG6 zdy899@h+V+ofa)(``dL}W=%UBolG~356Nt}bk=Slb%&KnX=Uc#e!1uEF0AP`w)d;F zD!O&6z6einD5+>Rzm~2PsCHw)$dN189B({fFz_W@SsMt7F=G6Z?NFe!;4`eruEngq z$=O-3dz|}9aT?PR-L{~c_|}aOlVDmNBKztroP)iWJZ3KWH0)A0v1{5bEq%Cci{zam zB8shUnhwRUWyY%bxnVGso5Xho5`Ift9lK>C@9?cMfvT?Tm8Pad=j+;%mI9ll6l9NE z_Xi0WbBf6$P_t!0I;o77?g*!!-)(Fv_`p}(q)=t)j0zIX^iN5ZGn|q z^z(idfk|HSbl$s?gGn^a39^3qRYMIac$ND6-D1Y%L0Kff2lwB#>{7wKP^!iMo~p}> zSJp@S(1Kj)p^(#UXC}SO-Ot>8V*-Ln&e5n(bYJI1Va(%%nqyB#v0z~#=cPBk1ozRd z_&qh-a?N50DIx(!@$CenM5`pQS{%1CxzCoiOqt&z%Q!^S?MVs|W9uxCs_y&xE|z4Zi-Oe#+-?O>JXB@(Dj` zRr2czOG-Lg7qv9CgZ#H*l39nTb=-l$WF1sX0)FUZb#A0p32Q}g#@A50xy2AW{X&b( z=co&`iV^4gL#?YQC66eFG~d&1;QP_n(tbyrNjG2Zl`lN_dBd=o24#|jm{7b|3bQy( z(yPf69_`Uc9km(!N~6xR?&z-si61yd3a27w7e(%TJ&eorrzH4F*YI?+{V*%-#GCee zg6Ox5gO1tNy(!E%y8{N^jx#0|mk!*q7P>KRYJ{30aY=>XP=!zJpYFqn0zVd7b3$uRV1Ldwn#vVTcBwbq|miNRs11 z^$9m(gc@F}bB+`)hif8#?Qe{U}a;{LPWCC>%xjd=g7 z^+u^$fA+hC?0~XEAMV+OImI?^;F8UohiaBo`e|)`nC{bwPe_hkX>6s=VWS`4VhX?W z=ja*LAhhre`@`NY&7iNZwpixtv*rMRe$8s#iF~emJ}2~>;z#dxlTn}I%YIbVEe<$h zQurAlL9Jx`L8Iv=%~Vl>uQ_)cDgP z4C)+~v|kgN5>93p&6s&p(2Gvy@;C~2j6TFx6tl~82R`UFl2#LPQB^2#!LrAMtP)Mc zKt!Latde`P8K8KFR!g=iuv#>WOXJ4l#JI+#Vf(jp>8q~^ZRh(R%g!ZoXR@03)nzrRiTZS|T$g$&6!FOTABs1r7vFxBgl=l8DBP8N|iP zjCC}AgDg3D`_ZbCdA|!v+Y>uM>VcuCqOYIuuZ>%yly;9R@ix@H1|eXURo&^F%$$P% z=oDN`4a4n(A;dL(qa*+-|ICut|rv_R3_uVqapkTt+}>#uR^1 zRe)7cl}d*W#|tHdZfEb=aB-3te09$+QM&>5w^J1k zp9suNnYDT>w6=2HsqdXQzoG-H#qQG}&mcmiI}1A6MI=Zla&N0E-_gYDP)zV|6YxFe zEa$WxO)P4b$R>8~Y#TRbHMsZSRYhI4n$gWf(yFcf0hQa#DGHiG7KYZ{l=Fl{S~~-* z*XYrx;ftgb8yN&n<-0oY18dF*EqZu6IWWs*5A)3&$hWlT!)_=}%C~$<435W1{RXrf5%P zuR+sEsuFA&ETlXEFi~j(d+l$2? zk8!8vrWr@SF4+Jbj}hK7jD>KLrne703%UD_o)(vbrLl*gx(mCy8)vbVoDkP4-CK-x z((~==8usBSVoD(m{=Y^PW*T9`P!RVY*E8=0Gs(RF)lBjW%}yEB4N8nP$7iBL~Rm`;4OPk_KJ-^9@)VaoJM@jgJml44c+1XAF{>CTzaD#cR zhwI;EI4$yYn43QMFyr%xXKet(Mca1w5b7qDJ~H%anB*=JOF!}psc9?IBU*`att;~G z%JF0E5(hUOn zymI3yz1HC5Ra18THmYB)f5=?VUAsSOm_ipTnk=<5Q9#UY?Km5}T<4^rsN!Sfsc zqOwO2RY<#lv1wCf-^(~py2g@%<;m-5(N%CdfkbbOmHOfXWSQ^U!+y%J2xe1r!=`9l z5mbu;fMC=nQVP`AF%GVq4gLvt>FDZXJ}VzwJh-6-M# zw$sY(%0a>X-V%+QcQdjk3HevRA`FFE1iDKSa<+Q*!c3+@9gOcjDNA5(n&$iITAj>*n#N4cw;h_obP+=0Uq+>{XlegyN3lj4+@LH-hw8GK;m5C+xxqp_vhh{ zsiN6TCoofrcB3oVQup{C!NbiZn@^2atxJROe!kgD3_^=Ld`|({p{|<>XHQC;DTci3 z@H6^UQABMeWU39G>?I*7PaG-pw0S>@$3u9D;_sywJeI$90pbJw^;BLkA;kM%O$fE# z?Q)vrA)NZAZN$65%q@-sM>Q?=EU!~tcCoa&R#lBTT=JFGUO&8SM<>rjl5&!7cO9Hq z8P!wnT^g|VOV)Wus^v5<_7lM!rduLENFJIGH!-+J%n)^-Ji9Jh7M}8&h(*8RBcZ5w za8&OC9$&)d&8Yx z{5h)Z2sXx+w(^f^+5|z(1!O{b(x3tMy`F&MS0Pzlm5a;eUj}iBC?*Iw#t1Pd3~irP zw6Ysr*Xom;&x((}xfD?75!zK;x94jZeE`~d2?%UB-Z{y0@0uC;`J4g+Lz|UDL?wxs zcbdmFfzVanVUK;->V?3Ij@Zuwhq+lk81RaV*EVmHF!N( zY-ugWo`BnJ6t*vNY9c~3T&xiv(B%Nnq&x7InZZE9t@5@!hlg|`kpm+Xn3 z*UOI)N00N5it{zSkOkkA@xE_DWKTdK{GgTrkiwk%MC`>c^X?sOV<{Vj5jC)lr4fPj zb_23+ZI|*Pe}*jag8K(61Zv{SpH3nHfx%qQ`d1PfmR5-9@9@ggHzYFhs9MS19lCc1 zLv^!%PBHLC>uh$BYj%z8V@FFDEUN(JQ+8!Rsm{;E?E_Cw-U8E*WbgRgQ{dIL5h|zc zDf@to!eh#@q4`0XGKhX9&^Pj^v~(yC$+%N9b&E7qTfW09IlOR`G|(6Bkvtv|ayeNBX%48y!IgVLloV%qa zL+F$d;E{unuG?bqr1FTIGRp%=u4p9^{W|tGUyj&yc5#vJ=dbDu)J_jSu&0c*OU;pX zQN9`ukmcxow`ZOav13N~WR?QQ`3<51g~PC=?u6Ct&P>xu>i7J0GxLQV zmUG)D0zV(@?q&Cz^AOg%gFnq>iz78Z;zgDCLb53MO~sDa2$Vf{*2Mj{87B~*Hoe>CXHGLN zkabYJi{yy^JZ-V~lez&rgdE%0PxhAjg#w9yuXfAj_S}>wqND7XH_ZEZ%W^kfRSVOY zbugKFX^{^st0cZD=d5WR|CXCd(gTO}rMW#iyAu`3;k|DmXb~++Rp~n!Nh4VfoUSxw zWk!t6mNZk4f%Z37On1ufs3|lySt(EOs;E3sw8roSylm`jJQHKy`R>J?l8KjWBPvfJmBvc|>AC$@RayGE8Mbn1f% z{FZHiKnXP7r(D~reor>Cs=?6>_Bz+s8D9J8oJdL+Td_nuSITp(DQk+Bi3@2H|3O+d zaPu2!XkEn~B98ml)&b*|SvijSppAg?GMZ$k$?K(Y@Zfrk<%MN_g71#A99TqfasyMv ztQtxkq~bXZCIy4S$j0F4vF1%lvqGhX(jco~ zCh|}=0^i=P<~*XTka$n#(tyO9jKW?>0`${QxlMM*g?@~wJZ3^hkfw1qyIk<&2LyEa z_I|b_%8ZtmW|?nSzpfz6E!|#owh{~PK-flGs6|W{+f1r*U=${M#Fq=?+Bx-X8=k_6 zsP*r-vHUDVRV1fk38RRa{L!Oej?oO>Vq%m;WOBbH@i&6~>V5(){fkm=`YT^V+Np(c z--}&`OLC9%f%l%|%0yGz+_cZyqlJGIG|htm2)C)zj|31JsEVcf6J0})nvg@y>U)k} z`$7N3;6cjh{Fo}C-|eaxBJhI2AOT1FGS9bYL+yHGI#tVX*IGxvT>luyPs+FB1u_wl zyTUMgH*PgMJn=DuGtzN!oc&>iMclysy~@yOk^v8!;)B?vIQmO?%x1BphmRzTVyPzD z1SZyU?QW-ND;AS4V=1hMx(C$>J?f!+`O!Rfuuz~Q+B%%OynMB8^V5zAfjZ&w4~5K! z2Uibv6@*wT0p!>X2v*WnWn>nc$)-X1Ej8Zx=^AqR7|dTiFcsl=oU z3xO9qyJnpsry1D)n_hj(8C+njnUeqqHelrqz(!H>SdiOH&j;#aE7kgcbu`+3* z+zJ9>5BX$Bv3=UMP8*y1nYXW{)>$Qyz~>Qvs}AGmcPxNUn#`k&-w4gm^Z7lBl?b!~wM7xQ4K% zTluRxD+}b%hNuX(;g3XI7y*&pFSkY_e4EqX!(BdUd>2eL z^Zi#-&8gAC%FP@&kKBKTlchFlr@w!r1r`$z9U%jwX7*{&maBxKboKjQi8Ay~%#}8k`y?&eTC@nS8^{n#Elw8nTMbB` zI&oVYpv2!?G9vD0+;e8TnGx8t7ZYv_dWZ|LaT8a!QB zA8!(Vc|JE(yWF=mg-_R`JpO)^xh9f##Ylw=XFO{5jgDmOv&Rwrm{U8)ErqB~#6Jj? zkEuvI;F|cKFz?Bv`63nDYm>f^FhHZR;?}KCY%Z9xJ3kc29t1l=m(^bDz&n<-^M`XFjGV9sax=+y1o#FYIDhHcbq%D&A>!_QFU*E_OK z?-4&Pe00~kiZtGQByU28Y(S=qPc_shlq9gca>IN*M-+%U&xeMP#vz$g1(w%lFJB#G zqpHKhl}@wYh?5F>gEL^!RsXix3&n0EcnFINEsQD{`SXF_=1J8?8G$}V)s1-MRHr?r z>ej%C5GxXP;bd=5)>@#b!k@_#ifqEzDo5wKCiQdIc=%3J{) z7w@?f{r-;X0-sVW9eh|ee2wMv0-W8%BB~ZIiFd35s#=@ln6vIu2zQC!p-bG))FSklx6w%_KDr(nikMUAtzkc3DYB_%f5C?F#CX_jMe_4@?r7_qXrh9KWEjBCSh{mdE;%^sQsAuG!<>&lcN$ zo02!_@BQ1IYca>)hFyOkWGrr~LAU&~I|vW3Yw6Okh(3{N)*q#?PoAz#H?3W*++JdX zski$UQ!wKwoyBc@GT*oK=mDWRZEvLeyFK^g5RD4K*m(!`+ff(P*X z>ScjHs_7_26u(N{M_Qj(UoP{z!PC+xgZ^Q;9lOMl);l@9;@SIN=U`8*H_B zhqR$aF7-0B(WLY_(r|5c|7*k4ydUKatY|NNl;@H1fD#c?wC~WzhVgyI^5v+g1B{<@ z+$SUrJdQA!2D`5)-?as2Mp2q(BRzI>-$*dN%R1tRQ_{dRD7}|R#~0o&Bv<|k#8($< zoBVb(!b*-BhZ3b=62DA+G~ui4bEGn{ZGjeJ+*%QSFTqotVUqoC{mo7!kimfUmZC|Om&DNyFL2w z8ZW-{rVtr*HUdTrx`klPDu5dKWuBa?;0xxVs)m@%6!lPHdUh`(b_Jt>2a@runh|Cd z;!~-eWL}Sgknldgj&IdUYBye$m5z2V1DKoeGeqgh)u{RnsTK)UoeSN25kL)ld!DqL`%!39fe>xM? zii#&JS|4rY8>3qAeR-7w`I;vhxs1>CWqgVnW>DBlL@3>}&o^-kVsxHo%iLMPyK}o1 zckWeq=}_DfI{-cIQE^=Yajxl%v(Qf2s?^soFo8}9}#@@=5%gnJJqEaaOy z-xY;hvnJ<3RFrRrx5D>OzyjkP1wE~&D9){TyPzb9lECG}SP(P&qm|e*;BLFbJ(>j5 zPRK}X<4xb-GKfdA@a|$UZ!YoaFtbXgf)+>g?N2J&*cBB-;-jpVQ$utCOg<>pn#r{I z2Sw@vG}Q4n0GA7U%ird2n~jInkJrx`nX7G5A+y!K zYj%qCLvOSeF(Jeive$5}a_$xTK2iHPlT%A2M2V`F>L3+0pUMKkK#3&B`+^&2 zB;mNkhna``B=dbG%JTg}2(ELt+#WqO^Lub2%_iC`B;oaqv%dgG^XpNS^Q;(D56b_V6u9H^h43JfWajXbDA zmy0@<&a{p9onpRMn)-Rl?ul}V(C9Z08GtPqamzTsC$M=SWR1Iw<1zQ6(zl_y>pS%c zJ`djV*L;d-X`?+pg&(~+QeCAYqiwZ*6kQ3lI&brX1%k%(MRy)jZBKQWyglvc$!(u| z|7yoMiknxk{>hIeMQ`%sM#_g8Sn{HizGWvIB+iL&0Tds+aA=HI-`up0ido^=T6lwr z)`Rb<@y!~}fOl) zG#TZy+)eH^5y?gE&;>>(H0nht`ZB8&!)LkMf57~32uBi0@J2vP_*N&FNY0Y9ZHsRwHe*me zC!1lXPoMoJ8b-v9`)|hu>yKbF20S31Up?0^ccqXJK*Q4k3{Ww)00R`kW>&`H_8!!F z&@PMz2%_fY2N|FP)a+f1UBJ{FkXTM&I~Qu`WP=*yGT7PP)yWj>49P^r$=*~Q?4k!y zk(8zeXn;LjAnBy-A(4S+u|-7C0TPffB)v1_bb%|7bpw}9cTQlG0@d%40M6UU>~Xc4|%RcV=zE*LJ8yl zXhGOF%Knyz6Urc=(E9(i1<&O9jh;VNJKjir}db|R8eq-e?d49Ly`4h(leZsFs zKU^2!8MYRYIy`gz*2N$FaQ$w>U;4Q^Jab=wXV@k@f9r?)>hR3{TNi)y1A9~X zKjgVOJab=wXV|M&f6K#jb$I5v0MD@ZCH_O6tHU$T1$c%nOZ^Xdt`5(<7vLGT$m?%; zc&`r6ycggZwqD{t77;&(-0X|FUm26Ft? z#vh4*9KW0Kw@6oqX&}dMh5Rkj@0R>6($&El2>h*(zeW1pn7>4Vu)wPtDFXixvA;z6 zLm+>Pbamhc{$XB!i}brSe~ARTLU>2=9wHBJdxQ2n1aryf31Oz<+om z@Cu0{kn{KR{uh@1p^8AxD}*=a@8|t*k^X`A71BlEMSKzX4`BpeA!7tyL>Ynqa7G~4 z6~g->)(HHEHUh7ZHv%srj=+DIBar(F;e8Qz1pY%Ffmg^Lffvz7;6MBk$a96(`yvJj z{D(pUd9D!N7m-NdKP(b>g)|a)5sw7^LnMK`R|xNms3hM_C_&>+qpev-7po^#_=pSkcS-*K@J^|20)DrX$wFF%uwFF&6EkXZKOVAZkOVCBs z67&zX1YIGu1YJZeL9p+l|Lw>HT_LpuT|_NG|4>WN6;eykMbr|qJoM{&A8HA@LTU-Rh+2aFp_ZU4q?VwIs3qthY6-eRY6-fCT7v$emY^%7mY|EM zCFmb&3A#dR3A%_{g8reFP}6y~{0FjH53&G|8nyz^nHnH(W#&w+hYlU!si6bU4^Zl$ zh7KF`K@Mjj*yu(L9X6s+Lx=U^ki%I5SZ}3<4(lNx2k4ku4IO3)A&0XluqR#(9rlz# z4rftdXi`ImwIJkhRuGH?tD(b)CqyI|+k+m@WrOh=NEk*YpvSYUfUsdRBz!LQ+1vvp zd@lEymmLy5m;B713=N-^dgeKWgwLfv^ASSA=klLv1;bhKA4Mo!8@RNC&xoUXQcE3p9Kl@4OK} z=k+-2kRbQZ>v3j!A>s3SoEaHN_`Duxj}tU}mY)GNWTL1UoOR^YYrQOUaAb(5b<&;E?slj0P9j^z{Wq9N&y?5TrLHa zEnF_erE3oBdoNW6tZTef3Rur|xfGYKIn1SasWQ%1lUy>%rSX2Y8sl=Mz+76FOmgXl z2VUOJ0bwqi%L#UQOLsP#e#ufUU;WD)yR+Hi%L#UQb9Xk|ddX5QU;WElJmBR`9`N!u z?`$^ia@B`Xn#(1*yxBXOZMs}3mp6Q8vo)72<0E|&y0)VpMoOB?<( zZ~Ns+xxDE+^HyK3l*^mGGjH!DOSydOU*7bcc{493*yT;%nK$r~rCh%Hmp6T9-mc3D zc6rlx<}JEpDVMMQIVEUn6-VPy+;W)ru! zF@wE(C<%5pb+U4Bv3H_AW7TKxIzm%G-nFxGa(0ohGMW-gY_ zdgzc{YN}OY?S7CP`*SH}&GX9DQJ%V`o(4levn}28?(1oMWJYXr% z`8heLc_FU@@<4h~=<(M%55!3FLiUb>{&T{-InXm`EPja31r`%h?(bNTl-v-)|939X z5`N`&R_?oRA|#CP>K_|NYAI{}ksu<^P%oOtX*|QKjrm?ai$0EFgXd*vtw* z-PObe`r0eh^#%Nk)5C6`gA4Xv?5~snDAaxjw5{yK?3}HBhb67d&B2gYVY;P; z0~}rLUBFIO7M3pP{9FK2D<@M|TXP$*2h`gHFt-Aj+d%wAoB&%ZJ6C6eKgIv`kp4!t zy1LF?6}59@tJ&Kc+x-J=s20>N4{Z)=E||~hOo_k1@Vm(&{-OU{SVN%#{fDR@=4FC3 zJEVzzf$tY6pcRrG}<}!TkK;_zizZ7<&CIm$P3e zG@)lONJF6b_Yr#i7c76t3k^fhp^w)2z2A>AG(PmfgWms@4l2{Hb7Fy!?A2=KpX@o#|3 z>B?zIX`cgJ7UDIuGX0+jhxrQs3xGq){@Zr{r{ZA^2!j~(Iy3}1!Yl{03D4}`uiw97 zKx4t;LBR$4Kex=#7vv!}`5cC4`9Yx#ZD6QvJcl{VCZENHLFF9q(6q3eA-`w#{OlJJ z2O`topn{%5!Sy%rpyz+C{sluAT+ed+8?4auP2A;nR;y(+7pk4Q$ULA%LC1YFg|I+`9L-sPzV}s1evOz5wKg5H}%gtc` zkhU?laHi%$2Z%YFLbo%3T!idRVC--Q47J#2L1-b+d(f2VfHPQ%*;&{?c0qvnie13A zT9Azm_|O50R?g0ljs*rgsJ(<_1Q}95c0ynThyla_5&%hn6hImv1Goc_1;_&w0Ez%5 zfHFV@pbCKK5}*Ol1ZV;70(1e!0LTyo(q}l|2N=5mOaLavP5=`pV^c8n2|GK3bttgY z`(T&fmm%k8H%$NPXaJ`6HuiRqUt3#afEmEd-o^%!9~c0uApq>?YHR}ldzji7+XBpC z9g>wB7}6^N%pn^(04xBO0838?ORycl3SbSm53m8)p7m7#JAj>)9T;E_u!sCQ034wE zLBJ$|ot??y0I7w&8Nk8D)fwOju@Ycs7b}P?us+eu#OANg5#R)H1~`M=AO$&Fc>tVk zjGZk3&JK`D16%+umQG;E(cK>43UIYE13NjJ+B<;(ZUA?H2f!2X0Pq0pWX}YHfV7nj zm=n^sLp}Ctf4bAN3+HAJ5(lDQXxqDhCBcy402tDae~$tr0199`3l~d>^#^f^h&a1A zfsJj^JyKFV+;w8zC%#hLsWaZvj+h-p;t!Zh3jPxo@LX$$ZgYsQtKC zYe&ibki2zahn^A>E1{jpKK9Y~39NeyxqI(O7TzVDH1jP#X&vDbR5DY(=_OJ|b&uCn zDFKn_8%W<5%`Eoij?nblluSg*6ACxI!=v?xO8Hw0;6{J3{x{D629-|F>`w|sUw4n+ zj6p$>?tZQ;(jwQC6EpWTbS1EHt{%91H{`{f$c;BPqCZCQejeoid>^8Y@9KTOg=e*6 zGbYbXax<=uZib*v&|KLjrB@_)>xajCM6@3$bnNiO{viQaC{$?tqz_m(JPyZQorQVX z9i}I%9lGx4-5UjTe$_d7H2U;KSXW$EtX847^Kjwto6+vfeEv9$1Lh^UqU_IVA^8VG zLTen{=>p=APZ_9v90FS3bWM2><&>?YGLbJeBx@~LktiUwnK7NAq%Qc9Zb)xP&6=np za$J!u@2d(+e%+9qHPr!qMY^sOMTV9-%1f&um(Is(sx;x5^eS)ik=L$S^Ki$E-~OaN zHx!|PR1x-EvQE-AlU^O5{v{4^Neqoid5s|aMXriE6XnvKsO%I*ktJyXg{VA)m%Sd8 zLVNG57Rpc1PU=pc?Zmb*MEM%M9WPcc(aOL%k)+DpTiHs=M+-o!0ys zSROwf_x&;dh^Wi(#Oi5RPG&;Wy(1r|hQ%$z>62ZFkSVNS@k|xE4R3H0i^PVm7Ef>z z$h~ufsgo%o&+hpesA8yp!YV%YeXQGffK}t*58&zW>Uv&{GIn~J$mu$X{m0Ps%%q*> z?jFu#sRhZjENm&NupeyGx9WNC(=RHNAyePl*qEON?G_656cWiXi6R3``L&lB35-77 zd2i=ArJCZVbYFEQ7iwz;v8HY`k9yt!-6}DOP>u{& zbkjq`yP^xMHL{b}%ocMe(YXb@kxX#>JqoswM(s=x%QOj&?2w&SUq62TW~5bOjg%Vq z>r9)>qRYJp#?Pmd8w1Nf>ZN{uVZIn`oQ3GDi9FQk7bDGojjpvda@*Lp=w-Rx13mEK z4dBNdS6oe#&_|Og3d&{dVr-LC7UT~D<4f>IOm5gDF?;uNT>FAybSv^bwi{yjmke{q zzNFdkRD#HD3nN`GFG_`D*A8&4SkUVZq_B4~c5CPUV!QidQ?q%rCHu5g ziDx&1L~EyreT19!aU7bR1?dnYLhDQM>{=idl|#$djG@KVvIF>c&Q zI&d>Txg-77dY#~d(OAfPmlh1m&1Z2#2dg=%qDiX<*Iu@cA79_dn?s$<&ws^k)#FU_ zzJRz)sbu?Oqf)&qC98=6c2K7>6U|czP>v<`_zWSC-0|kB#6BnDLtZ2DG3>Ocg#EAw zbh#NLY>^}yF$iEIU29f33E3)OYlvc=oYF1inuTBw;Mc~798|rCz8Us!;eT4Fy}}qn z@z&UK0O->*Rw=8Lp{L}bH)l|7Ss0Yzy{d30PE^FMO4d9Lg|AV5h-i^mu|(GGju|O} zPfw^dO(LZz?TEf>EL~pyQKrc4ZDwv7;Un9{M>-lRW{hl{BO~!6H0EQA0eSNsF~uR` zG;0F!CS+RUg+d_sSn9wiT#tEI8N?FFW*Y(rz}?M_>$kXFSie@>$G`6X?mY>irTjtB z5!PvF^ZN~QysD7$B6-_M`=Z({+1b{TsCy#UzMxWH|BU1G!Ly$E4z`R0j z>tkfjfME^0+>g&hAIl<;l1yf@A5z3;vz23gH!QvOuy<~Z1F-5)sps#}O$^+vf~j1! z&(m7qNs=6W6`S*isD9ojWOBxlBr(VN50v5UiOXj> zXWw|^((6C$^+4$1SHc-I`{+!S528Yy&UrFFM@wm#4DS=h4SilF$`sPbXZvU^Cz3u8 zl*lmp`t(#nb}Qh`yn&(`r!|;0>hs4(M{#4is*3uu-oZqi9lAv&IuvZRSYv3-C2{sW z0d|DG40zr#nlaCPf|4ZCLqk8+&E!?{N-nxGePu!VdL2oh!Sra}$i6n`+fPS@(-Hv5 zU=_|bi%RatWD}f$Pv7L^wg@<4XJ0L1&pi>DHVBY>*Yv$4!Z=&OVOvqOw@xOh-S{MW zdScyuS?gO;?*qxQr+l&|YOGFAb2Z!|=H_|LbPK{h>r(`|-P)o;>LKAVmoRs;Fcwex zBGk-ec{;%zzqQO^exe{fGeT@jO*?1iH?tByQOV+)(9g^HD((}5jn8nZg2tv=Z2gZZ zg)PQVz+hd^Z3MGfBwa5Wv5IDC*Ivts>r+C;%_+@2%K}5a6<^DyKXrhs4UwfwLQ+KX zm=s66fbUYV(8A=yZb!ZzIIJX2GtuUs%4WawrjhN5q2u)C-W*T!cb2R=7yDqQZ|3l~ zgdB_fEK>*5U2J8Z&Lf$--M7=P`qE^nMr4iY{zi7?edh``7k4kix@4`B9zEK&_BcI> zv|U0>TWjpo`O&2SLt86>r`cwTPjyQvwp=IS46U=-i3s>I!{-s4-LRPZh}KB(KE@2X zKKE99sEb9aW3-Lv<^8eL5RRql?yygAa1Z38A5>nI!#!U&R-MFTw8BWGZpF*tRx&ZE zP-LSkto9T>e*f}arkz-8yGqJvl0;hJ(?Nr~4-5_{>*)1Tv!{c31v~ALMATDy3vbgY z<(Iw7047Y*#||DORgqwNHFz#wlZk~3wLQId@9itR23$KsDH&s9#F+R}Bt7!(pjLW+ z)ZU;Z^$h_vnDrE|BHTHjh?`8n zE40bE`mP4SAv$lz4gEQfn(xQr z0~K#TN3oIKm{u|-xdN=$Ll#hFP;cH+RdwV|(D$XuwtZwAY3X7YR**_!>UV-S;t*iR z(QHVr&DJX~!K8F2K8_@-N0OOqEs1hsT(mP(NXgg)Z*RbPP`-qdk=z$KWKF>Y=|v9af;gi7F%l=ORLB)Kgft?isRiXixR$CUym>0OiB z(rNJYyHzVcou8?dTUnJE9Of^$@!@>q5zmkARb zWJ)tms(f`T|0nNR8wo>9jF! zRO%wK0DqwqGKV*Zyub-%MKJ;d}+Uyhzd{Zgt4(EV<|w< zTl$J9@qH0*11p7A6rW%x-yEYE`*-51PYI}&?L&fieK;e+ZQS3=()eY;E3C~^t(i_o z=30&dj#3^}o5DDD+tj37cAKn1PsS31-`^`C{)ip^Z2%Gcx%PgL#kYGb<#@W=FY{PC z?iw*6xSo-bn%Mz(mSoRKZ;zw{VFJpns1sF5O&dM$i1DXVkKF=4lUgkj4`iRjF$6=O70%J`K zOFzb0$8>Vo2OhRGh>_;5>p34Yi`stiBJ$~md$ZzGYZ$aOQJLff{_1AFNL?ftjlYoe zLhR)@J{zLI7t_k(vZ39oRt)vySUS~y8c+Q@M_4Um=96!OYn*QueahVFM^2O-dASOo zu0ZhRvq=^I#x8PH)MWPi~8qBL;$DerVBwvdlN{bsU#fq>14 zR+Rg7U9z9AUX7p%`C}?+S}jBi?iQlkX=>zYwYYoh&X{jdcx>e^vFr;Y{>Z7qC5nZ6KLrJ|gnVmmX`a{1 zeB!O3y7F#NFRzxTDh-q#8%iVilogGN;|4J|+U`0A2Bu`6JXgi)GOobDal6v|$zZ~) z!_3}~X+of(gS~-!Bnc+Jf#8H^&Cf!b41*z3vrvvN6`!0phP&^|ytx*hBWS@o1xm($ z(0Of{3(WIGer)3%NI)`^nek&6Q#*i=Kzs37mdR&@I40WL^cXI6^T(f3F))`&rH0vp zQ&*TBRrCr4?{3W+**|&K_oIGfWO_P-XG?XJ(plv@&!9Z{P{Cvz?xw^e&i-w+krElY zw017E@>yfv-MZU>!W++#;yD~W;OLh@x9D|i_~~3L6zvN4iG@Z<8++Q18<2ZU^xALs z2XH3E-}QX1uc(CFDf#l{4inQM!Abb7w-hz)tAqwpwbQ=%Sr5a)IZ}&k>BsA+S?=++ z`}q}f`b6YucI?K+jHA&pfbZD4=PS6NcXrF(szZIrOQOpkJ&YRvN zMX$c$i|rF6lE1mRvQ_Bomj-l57Oe`7Lkq?D2fW!cl<&%Uu>RqBr0<=v2#d)d5%&j?e2W_-cSr z4r4ufqv|?UBTP><@7nV#`KtEULpO5%&ADLlrv?69WMV5rzjHy&#gtj{mnr&l{pH>% z85ak88;)z#ok(|HdF5|JU#n6^6cyR)@=&)r#-J_zBAA89M`DhUSgGTaNzdT3`n@$N zCvqb$>VxWnmbbD*U^e=6vwIIJ;#}VschDLW4v_1#$Gjv+@JiM}!9%## zAwo#9u8dllvor5`7V#KZR#rI~EV$XNZarnU`MMuq{@k|F>cBuZSUwl;#77lP1QuXh z#!RF}*8VQYGqfvgAD`~%Z`_2LDr!l7e+&UZ&A1FrnacrWFjZS(9J~7#@>iTNH8yH! zQN7QSvJ_rKSwWq_v3H9lM=87w49e9M17Og0MV{=lO(9P(oM7Qsb0%OC%NJ4pO)`D25gmiY03??Z>1oNDTc-%vC4{L*fX z@kh|x$Ta#uTh>3W{f+(GT)%!kpgIq`&m5XaoQ%%P8h(0uO61Uw&6*e33?`x!myz`G zX>Zt&HdZs;f%itkt5>bubE%PVCxccupXe^lXDvL zu219SpbUt>5!oYnS-vNZ%N^dks$x?5a4h1B9@(4<-C(Z?O%&;TCkpx1 zD8c;O-umeBZII^s%gnbndD6q_z$}dH|jV$qjJzVEUdz#v!`VE7q0(nKD~J znKy1cm}Chv@PWLH%GQRM9Ed0r89#eHV`NlUGi&H)j>EP?m^yF+a0P7=nuV$#m%Yev zA|DNZSNt^UH{G2FEuclGQ|sDXqqJ*m#G2I7wy&hNv9E5ESW?nXpU&2d79fSW>3G#aUU|rY7?-7EwyExP0mYs)`nZ={iZxRJ%ki zIW-b?g5tX3;xbi5HyZVew2BGXN*vYYAT;adAop{2KApyD(dN?4d8}(24{e5Xcw){x1SeLJVczy@}0f9&!U7 z+=~(@&M79VNtn=+ei*MRFL|@Z>@-?|p5ta!mc+%SC%dZm*26PCS76j>(5 zi@Zn1tSs2#r}2(82K)24mtLT_oSZq~jthQVZ>w-|GQ&9QITrGM<%E0s8 z)xHrzQ(0QqKy}h}&{R(>b~pSIT@%l&Zi&{kH|AJ@fvJJ7f0?oMo=gwI93eV({&9KZ zWpnX;_iOm88F0AB%|i#>Gq!~}>Jgz5har0I!~}PZz}zO|r~KtQc6AMc{fkvA3(J#? zh>qES6W^(ld!@@FCgu8RrhqYG77P6Sr|?HPvdnAp#dP-07uM>N#_VMr5L#O~d$DM- z2nm@e@loL(6b*_n4{Ss^T@JT7j~{v{nIn@v1#gx~ zZHnJPmm1%>vv;)tlts5rE<_p;l;GF-uImM+)+qXei(`-Lw!?3$=pcq^*_cTT=P>cZ zf(}Q{5V99cKRbaD8{Db=|9GaFql=;+q8uEUv7=-_k0BV-g*l?f)HeF++H^ACGH!?{ zMT|V--);|cUKH>n+1xA>IPAgs`9Yu?fafF#5>TUyTu6+jRv6!$H+Stu$zQc>3c+W7 zwY>r#W%1ymW02fE$3Q3B8Daq@m$|X%^7$6ZOCf2ZXcO}-4vILiyv_!T3GD0b=}q(7 zk{YW}sDB;n53Xx!L~q$mf`ShBk&GgIn}i{I z)U-|Ji_%BJM>RYLFWWY=93d;JLXtdgThHMV;GWn92`KBQuW=A-zUP(RWH73Bf4yEu zMrow@d*sBQwc^789+w+?aCQd&YHU%H6F41*Fxhke6aus%@OBUsda zuYqF?h_-tg&O%}OsKg(4V(PB*izv^=HB+KY4wA%FqIejlWoasSR*kY$ z68p;gZHlj5cB4k7aa1q7^mw%1#jG-Ul)dQ8yC42+6H^)9fVt*yqoFbQrDEsPR#IxI zcw5HA2!QMy{qkgC8nCF_S;`~^ZXXBeGsO(1zykUcEd#r z7k7^oiBCHe6U}2?CQszmJ>&(C8^dGwmYdYPeVcRz18;EyHj~-f-;;EJ z$l@P|8T|XM@xPCdG5$kS{AYIaulT~hKwkg!3x91OEfXUL0q5U|KQ<1I|Lzz5F8*h~ z@NYl=!!I!Y{qtY=1 z8U6$B{ku=FwfyIm{$G>||G-E8MJoJb;s0DJa56IeXQ|-nsiC~w{uS-t)nbf_B|Avw zR=dU}uUg?cSeBnZkt;LCGfimnnE6b1wZZk}=cae|`|!0tKY{f%Yv=ZR*YAUpQ#nZ136-TmNpENc~)EN30bL)nm2!}8Ge%O_8L{K9~)~PxUL*` z4Mn6}NJvb`M2CmUWc64Ljj`SfGar95GHtWckWvx(es#RWJk+lI9&D|BSpZdZ%(JAt zCtu3?#X&>Hvw?N7m`!0|`MC**YzidcZ?zF^Bsk_f!gc8hdn;RnW69c_&*Rq$N9Arf^rm4-RlM%%ci&ZY(;wx z9~Di3-dA_tZebhR!*tz}@<-~^Iv`pAy!v)Nn(jqs7>sFfRD`zqjwYp+Qd^>sEfi41 zw}icpz}W*uhKEhxXFBRDfneo-eA=oA1Q(4OQP5H#!t{?u&qzJdHj`i_`2B{67vj+^ zd!YvmRltHjUjK1#!N_A*^Z|W)aro<1>-Ed=3YqV$oW-MBG|50$jXOtbvgca^$ zCcuss_6d*>x7<8b>f!O)6ERM>aoqT`b)0KM=&7e%3|1ykIT9Hm5FI)Vi^+RKa|l*? zIO8mLUAqR=y>zv?l-K?3*E=dp8~1zN1v_8y2IQE zPt8*>Tz#R(ad<-3;n(52I?l`zs|KN#Bs}+$M(v_{SWl1mnzE1`IaPIUbL&G%1~71u zE=E~L*s$c7@nGrlaO(<-V|3TWr72|Ryn!*q#-x}viIbS_Lmr60ayiD!kNu*B;F(Wn zfAzOp<1)syJWg-mOL|Hx)LuOZihP&F*Pz38VBF?=UV$e+-EX;>)8p-2Ag7e?-+Jg0$Q<(G=mqQun62jLw>N8B zE`t3IOSU(dpDBG6?l0e{KRnJ!y(b3nBEbkbD`}^JDFx!Fl|yIODY7Ea`b<32%5hRX zd)2J07LNms43=iu7RU;NS&HKIXEGe%?hf)V6Wv_hp2Bq^r%R)>ic->>;4M#N`$QQ& z$Jiei&B+;(VHkd$n;PEL4gdHPk^no8GcT#?l}rO_0$L}iv!j1y&IQ8e_gMGN>wX2V z4L3uA1rWwdhXBpprw`QEIWkwXao6PqCjcHg`~6q)h!x0Pz!oaRB>2>_oWB&@I{uy>E;}$V;VLIxcRIMd+>jsq z64Uv%1R?^&Lh7;^BJQ&fKe`0;mI{MBGgV7HQ7NW&$(;I_2s@k>!{PtvC^~#IC?}18 zO)Jn~SN&#rAoMxo2ekXj%hcd@G)F{1U(`t>RZyH`=9_=OHGFvj2~l_;g}Q2)He0WO z0F4yEY{NKty4*+3lIe7HrLL}>|18(53`zgomv6VEuV0^*vm>4f#*IkkOmHq@kE~liF#mr&%VKA*kCbS*yB%p?JY@5eua^iQb)d~)lyn;$+9Op z*!^9QGilqj!8<~|(2~+*RVHie%qhJfY`f_`kxl^r?m<60&S4>!cvcArRqo6GcVW)$-{@s*{AG(TyFly-4%ZJEZpSjk;>S95S zb>Ud8ou{46>0L%@y-yC9sG2-6!deitrl!d7M#=eM467qi!Yl39L%kN^=)|uny!*iK z9Rg*tR|(s(S^KVQ>0}V3)yaj{%S6PjIlkQ&LO(di@dftIeymLt=KciJFb>78p?U zMEE!bHm~AO7)>js{9+jHQtmCSFL{U&CK0h-rBrGs&9fuex`S3P^kQU0yo?dN?_wAw zQcLFYyVWJBT;?2BbNV$bmh!VV=8aM!x|0nQe)v%)C=v?NBzJ?28k#t{F~f~H2))B6 zx{$6=*7bCLVt|EW!tD-SUQ<}uk1yZhN0sg)8Pk$i8%q0tFXS=#u156_W;UllJ*DzC z^X;}T->}0l;Opzi*tfIku@+G>{S@=z0zs=QhPhQE>N2j@k>P#rJ1h(1ixn_Z!f;=TSPO3(K2g9ZAjV-$(A{v? zjv02SSQ)TxF*n0ZEjLU?<+_@cU_=CJMI*@S`6gFfsZ>~CK#4a3O{*Sbq3DoE%DQc6 znnmvZg%oWHjUWIA^uD?sTtNae#oOtM|W&l=9t}WL9R6(M3{Kx z>o|)Z#L=&t>TlH`)ANZ6dRXJJVOYS1J~FZ9&B7zGsQ&p`6_PQ12|~$3kX*jkWJLgh z%x5(y_Ig4xM4e3x$>OkUc;b65mUgNJJRN+Yu&R4#MGf6N5iDM1LNh`Ufh$lWtbc{f zF}XBjVmp6dX_1s_wS-dP2R342Ia+6xM5CM@XS^G3T`$e@+K*<6S>3!8-*1K+y~*f^ zxCk>=NGt9ubnSo`#x@v4l{o9k!>D6Ww08&~{nH;mN7ZNivi5A@+bvZCE@ktT*fyIU z)@fy0tY`f54aLl7AXs{sZ?E(*FMjX>h?1Ufm@$HC0n-n1rb~2{FyNMn>dEo}J@y?* zF2H^uP1{$;V@IJ-AAEZ~?^xy7!8l7uW5_ByZ*yPLD-?gn91{?YKLTSwCFiDV&offZV`bWXw>2-u)d%sYkE%Q`9_+s8T~A)hxUQK^0W*XHwPC-jwqB$4_P= zA%L$SWJjMEmLnd0;6*~0DQ(tAFqXFQJq7Rn^XV^yMAlvvgZ0-6+!7!p(x`Jqv;udL zFQL0}od%s4)#IO1_r)rWeN&Q{M<(5^QuplXni72Hyf@f`pRN%xtF30pHpd;xShGv6bnFdIia_*+Sh$8SD;aU@c#o3P0**qoekeF}9(~DE$J8cOvGfR??I_aYwfDJV)Lw!39Y~mI&Lk}IsaFJuzp|QQ-^M=` zB{Fvk#2p}qKT5mKp;|$#kfoMnLOsauud^!MY@pbL<6*x!o3jIXW_WbQKvSCO_^)uH+SfYY2i`lZBfTuYm}eJ&w8$^J(t*4D9w5M&xQOJu-mXW@6QCfNmQ_g>Klz@>+A^|lKHe*-FKIjw1N64y;>ZI=7plwvd zhH+r#kQ1EKi@8AkOMMY~+NI9d6SCo=7)ScDD>L6_6JM!(Vk_TgXhgQPcCF~axLi-U zx(XtuuWj#ZZM-T=y;s&jXfA8T#l}E(Ur8p($tFsN6IRR^)TPbqAnSSa6CsIk_Eh;5 z*~tM?uOe`k7Z6qXXPx2PP?$I)%&avtds2lf7K16$lFUxYQAiLeH^tUj_eu@_NwSfE zl9X4NY;X8IX_F$d$wy(O_Fz|P@OV!PRAkn+Im zR5@G#v()C?g2DA@mBniY;8jHnYa6u$=K#)9W=&GXq7*%S*hr0EHU;w5!Dcy_M>`z1 zUp^oU$|}0FMJNdT5y!l?!nmSDA5Oi$PBiJigK-&$;OX+~Br509*YV$fmFB}zY%wF|1?gS>c^X021!%LKxPKjlKI2C}=2t@#?oU1jHF2dJ7$m3k&}!`3MF~P|DM}c&sv^51a{- z&CYv`eSyuP$_jF#{%G~&xwKhw10?rILp@v}VY}cfHUMjH71sXHct57{F-;>#HxCg<(T?4R|$Pv5b1G-ATgj008I2<1B0+#^*)Q3fE4;2&^8rnl zac5D^h0{o?fmXYYJI3t`iYxN(Q@*&EY*4*~l}%lpowZ19cpv;OvyizeUht=4l3WgN zU_82WW(ory$K$-@v8QF5Q`(3qu*fSB^5upa7M@+W8zit`{>jV8$^^m=C>xxI0K_x* za7fHz5UM2foFG%z^7YA6(mQ=GrtgPJJ*Fs^TEdhaTUOD+nGyJ58yji1K_Q(Xs1b7qQ2=(g;wifIi2p>*E2Wp$J3|X)#OL1TMSQ%Lzp{Zo4ebcSzX&_m8gB z0-PqpUs9u8J)yemB{;AHz?qP&T8|$>yaf@i>rlWl#mBR1IQEzbh=PiYaJ| z$shX#>@9Tza~qo8&^%HSjRzJ)zhGRP(I{ z^Q|ROH!e7QgH-Y+qnk`%O;nSFrQ~z)r-_@a8&J*&}!W+Uy}juj#L-uV^?JcWjoMcTq9L}r)^!J=20USNUXmp5&Zl8(Tx?zO ztj*iqlL&;Kge^kANCL@BifAEd(G6`Dj30b&dUC9_cLJuCiWS{Jsjj3?*7O;%Tv6JU zU#be+d?QWq3~88_-ZpIThU+Y51BAP94cWXwc2D~6wzBm}4~wR0OEdzd4%bKo1I3xius`*5~lS2Fsi0EI1l_SiScb==N zRDWkK*3$Rx-7u(v7D#O!-QNE+!*0Bmf_4qaD61XF=^(46pk+@E$5{Mc&}?FDu%>*# zvTq@7id_A%9BJ>;7(bo6r~z2L$+TV3aj9OR>s6SY=3uE$|78$U?3gP&3Rth2@8N3& zF$Xyj8i1wVF=4@$)qSLM5@f#e`4I+9KK3?sD?H0Jm>rW$GV6d6?I<8-*UZDs$SQ*b zd_oKSyt^Q6no@BFI81UqA`|%a(}{MCq<122zsWUr@(rYZ)d3HAFicu5I;=+8&Z?}& z)=siK2ASaCriX8UzMQJTH%M#5t>1pk>xkp}6~Zgw-qQQq)FF)zdleTWE*)*ieJY|F z%?&e(OP6q)Q%OG;lnY%skBXd(aD!TBW|C)*gZzurQ+K{%G>zI}O_t-CEW*;z%=wS2 zHzsb_5m)CMC^y#8yuPM`JN*0ggxnOlEqToj>a@rcm{@V4*pLczM^w<$A=CrV39zj` zEf*n3O|U+WcS$_!LnLfS?GO9=7-=~Evvx8kLV*Neudee?d$b3@LJ91!##k$M4XF#+ zmh`KLFMcObPZE!1>zqeZ+x=ANCe_gg_^*oJ+!>lJQ(Jyu(MS^m$+JEcoh{Z5H$*^1 zs#PV@T!Q!~$!^6?tW5?N`ieYgw14XCzqb@5Wm|0LYx|j2KG!<-kC*>pEuT zrn=@QU3CLRtd6ctR{`XrTGrIAX9LFs6^$;Y9Y5{_)mnmW`v=%qKCcL4VV*UTbbr4tn8E$?j+m<;-~;pmL5?RB{fxT(tXAn6qL*#BV}J-^{UPHd{kFs zQP)a)yxQHH6&g9*@RwtX$Wm=-(Nhw&4a?}NJeMjn=M1<32Y~k~F}tS1uLRh~+K@n` zr+%rRc1TBC^DG=)9#ETgh%fm`uYUKG?UGh()Tj{O%8Ae< zXz#Ea@H4nSWi3AkHM^hUFsKicYA8UCEsi*^01d3+JZa&_og~^6YR9dm{`~}Wxmhu( z$a~NUy3qjzl#s*w0jR^y>hskkAC_!R=&Z-!Ks8tzPE<&i$17mkl5SBEkQgq2 zpl{m5n*xXnHMI52X_`#pN1ztqZUD%F7Pxa90S*^ zIaFaZPBmICso2j`zG%5e7g2Tz8K>Ow@)zBdj%tc8C5 z{p=`NtAX)eVHn^;!}S2dDg3!U0M2b?y{0{Hvny4kR$m(-;a~PczQ6y}DX&j%?rV@jkrE3b`uKCKEU{>F&7zNVbO{taVn%fa6*WP)N?LYZ7B{#3H*d(+x&FX2#L zV+ZB~65IfetTk5=lx%?gbkHKV=$e)DUbG%$>MNL^`omWzfP?chmo;VG``YB3RbU(E z#}+zaw2U0m;BMX~Wepd8>kZevVi7XWtHr(WMNpbX>X2qH4iwQW`F;q_bDvvdoRjY@ zf}M|KKJPN8grpGZ$LiN+U13DqLnr@PR8ts%WdD3H^Z*-G=y^|e!p+<-iK3n7yL$kPHS{`ga-bV=4~DA zSIeQ#u|1;oPp^;awrk!sP)Ux<-N_!_NGzfGo@4XwfwpsHY+#;~7*J6Dtv&9$3o+I0 z6NK&8-P4dvRbs@z9U@+*`s=l-uUuV-_~=WxgK2|gnS~}pGl*e@Jo;JmBwmVknDi4X zLs6@624+>2_WHe_d|E8;-xyhhl%|~#h6a?YyoaL;b_0!;G5001@V&VqscUpkAwRfzxI ziO~4>+yn~?)Bg~S_@9yy{}GHZ{6`?-U-^pv1uIPc_8$JpDE?d2;h#wdyT2WWf6;LG zw=ly$k_`VV#_%sP4F9#i@NY%#|J+~r$HM=yYWSN*VffFgLBrhzS-l;9*MbK@tMZ3* zuhj?{;cqMg1RUj$xh_v zeRQ!_cf9C%e^kSpPC6+mD>s_ebkHjhe^2%R=}{?6#Ok^5W>Dm3HoB z!6+yZJpnW_-|zBFxNpMBi_H-z+XeghJ+1KI_$@us}W{h zkcONHl0AarAdC?YqrXQ60#Zfj=%7`AutS(afM}=xx&V(b31X~j|C^=GMC)|`QXm~4 z^6iAJ8`C=*rgZ;KOMrG6##zliE^yY#nJ zXUpkNN)bG#G~~&)kB`dZhPIB@p$+f(m-*(P;E*w)%e+M%v};^Fh#G7(Su=v0fmS-R z^qe7|ox>}Klg)5$=+yB}8zfwO)~=`*E7i_q`Vj4|K1R4I(1pPAd?Wo~29tXOv{Ugs zwJ254MxR)X($&h6gBc{Au@F=p4)o+K0n>}oNJ-|@6Y~*f!rJHT!vqC6c4x5Y#pMh9V8tm!_HH>`Ir}AOT&$lRLbP%&1OPoGi;)T>xK&z}*t7+`mXrS0gbw57|Lw##FBh0aq5~5qztiB()PDRt+u}1>WGjnuET*h0 zDt`T7KQK*H4di)nU@F`OXA%Hn94+^|I8yAkaNYGS%PRaHv$6MlgLWl9Zi8^S! zsN4)qtpN*vAb42th7fs_7X(SgaWAF0Mzn7SaP|n@k)zi!=X0CCv$nW3yuFhAv3W!u1|3)(ckVs%k)J9jyxEd`v?sr9ME{KyP> z1ehHSP3h37Z#Rf|GswFO1<1?Th~5CFbrf&7Z~w}vR#(BY1_qc91l`cSybTNl?jpX= zZ*R!4e;c@JL;&rer`eME2Z=xr*_;fmv#FZ~;u;7a-4VytX+J|h1D%x?<`)+r%UQRH zv+MPEc#Zsa&t_S2LAwV72lQDIPdn0|k2euOwndPRx^NXaGJ8PeI@VEG3c>PZ-yugp0h1$SoJdQ)T3ZiH_`$AByUtM zn7_buzAF&A;%M2_=eA6KSl7;+(z`za^ZAr0*J(n)pt0J{0yT(g+aB%8Qhm%>nfcmw z^Mlo2Wp?6^)w%Vp>Og9ZJ;e|4b!>w2UL6 zh%~9cb5A#ubSV?v#Al}YN;E)A%I0lp05u92kGt=1Z*m5)twz>@inA4~K0}DG-(3%xyd>r>e@1yJp({`6C2O5a%yGamHGivtH{pi+R#|jSkVe3$JI+t znf%hnDw5f=ZS3EU>IHV!T14qmK)c1RsTx2Gn&$O;$uEXY3?@ErK7BP#&7)dx1qcYp z>CdE^b|@$qBpWp$W})!T2)6^hsis&|bnEZCN(J$Fz=I~XyKk=*YCQs5+EwXhV06@4 zCS76EJ!(TD1*l%}Bn5xNoeKrBbM%)v?AxPgXR)y#FdAiF=dW|>Fo}U38-b@m`X=!g zego?~G9)JS4I15Tca79HC!+_p{Ey&aiYjM`rNl%MM&o4%_OU! z_!C(pexiKEj5c>MNa9!Rqk}(d0Z}k=OteyR4GoAAka27_Q5n+$w=Vzk5@x{U>kGxaZD6>}=sbW+8G}ss+g4NBfGc6p_Dn+8 z^$&U8n*;RJJf3{jxO{7+j!v+Z<#>WxA2pZND5h$cjwEm=B{>PE&E)~C90)+7w6T-prsn(5AIwqRN%=uC zz%l%$@>xft;>K78Fznyc4t*o(jyja{GO_hO5`3*ohAiC8sbEQ){n|D>EwHke1- zKfYOX-*oW!$f7;&{#|pMK5MI;Jb3`(!%jhIcLCJ9+sM6xzZ355K-DVL6mI>S^Q8<0 zE~-Ught{Fo4+%$dGfHR{`}D><8)CYw&twS;41;B$IHNpAmHj1ixw>?M?huBjjw}dK zBi{8CoLC`E^{B2nXY1M=ZQ=I|-asmMUM4UZaP&SNZ+dq1oCT16g?szQr^6$GPYNAX z-I~o%JCR=El!?;ivYWXYe&1ccIJ5$oR(m!1)!5|zrNbGz%T|UN?MNQSYg*A*@m70z z$@AZLqesTNVKt&Z%8eLIdM#n(9*jwtl4%-q{E#d;z00@59@D1xt%e(qmj9 z5RKD;Nms6A9AfFJR>BtMELr@Aq#+d~MiZTdYX<3U-eO z>3y)OUSrp`a$C8K@uM$>Ox++2kWJ0_qcQNuqiEW6s7Z}|m*7O;YF{U((X?+eaIN-;cE zJUfv%1nbIH6v~~`B7hI+Yf7u*R72s&NvE~ME2hx()L$8|4+C6mO|rLO{Q7L@cW|j4 zHKl9AoUO)M*a|2+*=JvP47*hTFJ8HHO5CV)u5sWB@%42TqIE5?Hh5@ia0b{jOr%A7dsQ`T*7UzWt zHt^#ubhrUe2T~o-l#LDcM#s%;4i-8c2XH%AcGzBqz(DkZzj%LEfdN?6S)Qfva;wpO zX-R^M@>T+mjTsY=y(Ufj>$FEa$Ae+U87c$w2WI|NGH(40_-C%v z)%GHW8(NXS2*L6w^nDE3A)YGL-5^yJ$b4+K#33DpDtDqE(zwaqg_Y$v>P4(x&^uv7 zH(UwJCU{9%a;BGIb*BK0d&MV|VA5DoUssg8UK7lxA_%2kUkdkbIEVnIWWx|xq=2>L z+_f4u4V1DWklMP6E{yJ^l_$tzOW=-tk3&HVY3MVsmAKXSslFcEs1wR$DRzzQJPWJ2%@GV(Ec4 z$(xf3?qunzMM5SH(_)zb-3%7=gHpq6A={WN)fRMt%AW{8Jg*lG(7OXet+W(lh}VT{ zv=oQG=J3101IM~JQ$lJ)D0e#9_NRQ+$_|cj#I%~)#vAsgo)gCwJ=_FRGeSw~v6V0t zUr5}Fzyb3u2KcP@f)-}(f|h$(3##0S-``OU{P$}eKk?h%3q?|FB9}y(m(EpF5YOBh zBdU#`7}A-|`e(AeXFRa9;_EXTH(SK&H8~dVUtCq;jOczFK(a4|kDteHSDA>ps5fLS zLppKr@r)h0uk`tg5lT+jUf(QW!}=YR7FJi)R!k5t1-*>Ox>wd(NwfdHMjZ>n6HHvDQLcyS-utKLi| zwmH0FYafL>R{M6s=h=OR#(v6AnK5bvnbdyWnhI&bd-(a#4P^S4)kf1_^KpQdp51{c ziupPP$I3}bCen>Vw;EY;-)~=5O7k-t@qRI~AO78pmc)f#&;0QDjqs`3PiRO2&f(~7t-IeJS zSFUw7KAs@$tjtvp(cO8gjzgDujz3u?Re$!$axz-bG9f3(v-yL z&N{E8b7eI|pDDOSXOZ9)asU!Jz~jlxB9xvH1EEw)l@T|XQ`CX|$j7?kQ`1A<oQ)-k#g@d7d!8KCnI@ zjJ|Sv`DHs*X~@;)YDmfG4b+tBYI?NkuJ5aNx#k{AWz8Q~AtkCmHSPBHy#l5T%^W%^ zL?Ggm#P5_X9d&{^P!+=Viu-Cp_`9XPtp~5YRUQ}!Uc&rCdlbuXB3`bLVxEP!HQQe^ z%Dr>5&nB&8LVv^vG@wK6h>)%AtZ1d?Zbw5Bwf1RQSE=}e@KFp_)6E;Pp<&&Dlx8w& zMF#rP>u4;^zW1$)FY{jv3iim9F&NzwmJ}#<8sR^UNb!}>tdrYgo!NYR#P76NJn-5z zgH1o7(my-I4W|5ZBV@V9ds+KCkhzvY9pevtmQl-W!DW}1d9ln*L(0|CS2oC}V~KF; zn-XWMAqHY)e+Mq!{^-VoMA{r5e+A7D=e`J3k_%zO5h7AFvFrgdreo{()<}Q4sm?x} zdt9hh!5ac6;wN~d&42#TMUV*4hbMU79Lp1Us&3q`EkEp)q&v}gr@Y7fbg2|2EJs^7Xq~sg9&TKp z_E{grN<)#Tnlz!&(y-)#2y?^Fv_C3H5j#KZ5WSNHr@KoS)!#)8oYCX}7HG}EA zKe%kp%z~2k*A#o7xBybljvAP#G)gvzmx*3DFVcX!TSNXbqM$yB#|?BguxR*JL3De} z_&Z%lTO`)$KDzY@y^K~0b?ZNTLomG)N+q*!{bOR+(z<9W-9GuW9t9#Qh%8Cddg+Fv z0?}M0VE6`QV`ck@cLPB)t^c^Rxl#3qefk9O_(+Z)!)S$nUy<{;uP#VDwXM3B2|V41 zFw&sE8ndN(@plY&trIv3bRir!u;nlCc7#`(`NH11!?v@Uu=g!|1|#Z3djGX*hcbyw zluU#)sC1uGJ*1P4G*l(ha(8PPN)LaIDm~qdQ;Ri zT58Rz1r3iT##>MI!1OqdJkb>ebACz z=9Tl3;k8K%myO=ep8Fw7u_Q@5NSuMb*T&bQh0egh-F{q3Q9@j#| zeV;RXca8R4$^rxxzypPX4G{QX4}G4-pEn{iFCr)2GLM?y+LM>l_C`nWKPtbl1sy20#%13WAAw)sdL?CVh6FJdzDiwh&Rj(S@YorU zj2TAye7wxH0uy2b*F~4N!v}7;8b44hJfdc{Q9s{;AffsRKNWH9fjs zye|C-*MnoX|8iZu5vd1&K#oeQ867bVv45p>5+jSlmo*xNwLbM&yx2)M$_7O&zv~;r zY`~VpwxBF4mx1yef+LDcEgWXwQ9 zHs-d(WOE}?!D%K&aABYOZ42*v&UfM;zBJ@UOZFpmR!R!aOKDl9A+t9`>?@cf7dFseZU9V)X>AK^G zt{&dgdiZ4f-uYje)%K6>#(8h3FEssq^L3j({LP#7541PjA3U=2k;4bqy!!TYqtAXc z>#>17e|;u({O1R5Kk@k5s}HsAZ&}{(P-2T1`QrQ2How;0GXAE$|cdYHyO=>JR{qW3R_ckwF@nZShhxKbV?cCA%PW`;ChyHx-g_Cc6{TC0f-M{O? z({CNKUeRM)cRYDaZ{O9wWWkKv_BK!Z&%*m2eg5dQExAm+?0@Zo{P^tdeZ@7)cD=Cf z$UW&leEj(zr%&&zTlM>+8@k^8<+YC=dhpzd7h4wJGd^eM_s_35_1`^e_hZ+sIC$ae zt5Rd@#>RhkO?vC%p8T16w;lh}==C?(-+yuX#h+Y%ntzrv0SsCDY0ea8X$&p++SqLwQ9<*@zcXnY*XM5X1!!VK==`Z&Ky3!iy?;9A* zjARp`NCxi>Ii0XVmg@R!Vs*z#t6D1ctuIzBI~Am4QaazX3Kd*ZK3uA-w`58spt6!L zWI9{hCKcj;*~GePwVX+(hlht#!%nJH=}pTZ2-3n%+jbHh$-%n^s=1Nmz~DD9UT8>h z^(C=^!Bl8d3Rixoi>uQzCDKy^OP z+}GV?3)@W!J1P8Cwv%y#j4jqQrU?@k3Q{e&wi`Emf3j2!Q;k%qvI;BL)LSVP3f5h? zaNIadrferACI$<|Cb=5Z#+5Zw{gji>l{-29 zPR7jAug<5(Z9AUrNWOI_oofeRhg2*C5;hkWCDm z3d8ONs6m#U%BqI{lT?fG*|3RdgrbS*hE{|=pnicCY&&j%G!P2BIgTPYUw~3K5#o$L!Ny z2x(m_3%(GhIzm&fXJBe-X#!&ybfzfHb_^7CEe-l?oBCe4Do)m=egVKX{@8-)Gf3c( zF_h~&%m)~k(fkl1J0hz+C&s>j#Tuf|C9#2}4AJbUK5m~U=@>@V;G5UV3LAh|bZ**n zsjNiw88k2|3-lI3gAZs7L0^o0u7Pon>hlaB3ZW^XxIQn&KF?!wQwSKU&krHRYsW>r zcro^ARu6374oHj(2N1a=hM-Ty*ymF}8(9OFUTceR9O=jCi?J^VsIMHP0@H^yB7Cq< zbNiHZ=z5@98F=xieJC5m&qg1&PlaeeL^cp~JzOC?;#27JW9)N*X%w{uvYOiLIvy^i ziSQYHG4^?i#Jzy5!|YR@xi6=79?%!W*rzF_;_&%suZ2~;6P5B@zX)P8C=&!^t zurFr+z$Q=P%E$ueD(VA;ASW~^3jtGWeFghGpTvQHtUxMLBeC5_~N8l^>#xM{L&E;<eP}$nEFBlgt649q6`O}t zfnc=+vTV=u14;c1`!w5AR3HQDE67qmivW0Mgb(_BTE}6ZW1tWtu^Rx{jn;ddV`K6I z&Wg%HpKCy3qxukk)TdZpS|?#&K>JSULlRPbX!?oG5?h|8u>pPT{GkHvQ$EO2pW@Ji zN)#Penv@~)fPLnox5#{rEbH$Dj$4!u`gn~n#!!8(OZPk}yqNXC-b3exZjI(DWZ8OP zLkVaff%(dS3bPxwj77Z57 zb98!ajUdb79#zd{zQ=~d^21aZ;#0`7T8tK$?xBchL>rOS2o5?A$kLuhIx1j$5A*^3 zlCCd1&qzlLw&r*m!Ey$`xQtKR5GP|mmeolY%S-v7&tv(4qdi?C$kOvAn&J?bI}%q~ zqmd=HphU1939_sfyDmIUWi`(&4Oz+uSr!|vw&|WH;XVUt8nqe6WEw+|Wj1?)onehW zgHliQ`I?RaSyu0H;$&lJU$WYy9l`1vWLaLK(_=XZeTvRaJCdFUp^W#%o+s(PkNMiX zC&WRX`oJ8g84YJd7JoSYGMeKm8bcn^oW?1lfae>ULK+*|!J&?vLUwK}cz@_|ChLMB_C_+nYB^_@n0DW0vi`F2YS w%+M{4Xjy_dQp?a2$fa7yrYm!-t;5%|2CKPBHGIr(j_ClLUbJZ0inhA{0fL-2BLDyZ literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nb.5.txt b/src/static/support/dist-docs-branch-23.06/ovn-nb.5.txt new file mode 100644 index 00000000..21f18325 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-nb.5.txt @@ -0,0 +1,4098 @@ +ovn-nb(5) Open vSwitch Manual ovn-nb(5) + +NAME + ovn-nb - OVN_Northbound database schema + + This database is the interface between OVN and the cloud management + system (CMS), such as OpenStack, running above it. The CMS produces alā€ + most all of the contents of the database. The ovn-northd program moniā€ + tors the database contents, transforms it, and stores it into the + OVN_Southbound database. + + We generally speak of ``theā€™ā€™ CMS, but one can imagine scenarios in + which multiple CMSes manage different parts of an OVN deployment. + + External IDs + Each of the tables in this database contains a special column, named + external_ids. This column has the same form and purpose each place it + appears. + + external_ids: map of string-string pairs + Key-value pairs for use by the CMS. The CMS might use + certain pairs, for example, to identify entities in its + own configuration that correspond to those in this dataā€ + base. + +TABLE SUMMARY + The following list summarizes the purpose of each of the tables in the + OVN_Northbound database. Each table is described in more detail on a + later page. + + Table Purpose + NB_Global Northbound configuration + Copp Control plane protection + Logical_Switch + L2 logical switch + Logical_Switch_Port + L2 logical switch port + Forwarding_Group + forwarding group + Address_Set + Address Sets + Port_Group + Port Groups + Load_Balancer + load balancer + Load_Balancer_Group + load balancer group + Load_Balancer_Health_Check + load balancer + ACL Access Control List (ACL) rule + Logical_Router + L3 logical router + QoS QoS rule + Mirror Mirror Entry + Meter Meter entry + Meter_Band + Band for meter entries + Logical_Router_Port + L3 logical router port + Logical_Router_Static_Route + Logical router static routes + Logical_Router_Policy + Logical router policies + NAT NAT rules + DHCP_Options + DHCP options + Connection + OVSDB client connections. + DNS Native DNS resolution + SSL SSL configuration. + Gateway_Chassis + Gateway_Chassis configuration. + HA_Chassis_Group + HA_Chassis_Group configuration. + HA_Chassis + HA_Chassis configuration. + BFD BFD configuration. + Static_MAC_Binding + Static_MAC_Binding configuration. + Chassis_Template_Var + Chassis_Template_Var configuration. + +NB_Global TABLE + Northbound configuration for an OVN system. This table must have exā€ + actly one row. + + Summary: + Identity: + name string + Status: + nb_cfg integer + nb_cfg_timestamp integer + sb_cfg integer + sb_cfg_timestamp integer + hv_cfg integer + hv_cfg_timestamp integer + Common Columns: + external_ids map of string-string pairs + Common options: + options map of string-string pairs + Options for configuring OVS BFD: + options : bfd-min-rx optional string + options : bfd-decay-min-rx + optional string + options : bfd-min-tx optional string + options : bfd-mult optional string + options : mac_prefix optional string + options : mac_binding_removal_limit + optional string, containing an integer, + in range 0 to 4,294,967,295 + options : controller_event optional string, either true or false + options : northd_probe_interval + optional string + options : ic_probe_interval + optional string + options : nbctl_probe_interval + optional string + options : northd_trim_timeout + optional string + options : use_logical_dp_groups + optional string + options : use_parallel_build + optional string + options : ignore_lsp_down optional string + options : use_ct_inv_match optional string + options : default_acl_drop optional string + options : debug_drop_domain_id + optional string + options : debug_drop_collector_set + optional string + options : use_common_zone optional string, either true or false + Options for configuring interconnection route advertisement: + options : ic-route-adv optional string + options : ic-route-learn optional string + options : ic-route-adv-default + optional string + options : ic-route-learn-default + optional string + options : ic-route-blacklist + optional string + Connection Options: + connections set of Connections + ssl optional SSL + Security Configurations: + ipsec boolean + Read-only Options: + options : max_tunid optional string + + Details: + Identity: + + name: string + The name of the OVN cluster, which uniquely identifies the OVN + cluster throughout all OVN clusters supposed to interconnect + with each other. + + Status: + + These columns allow a client to track the overall configuration state + of the system. + + nb_cfg: integer + Sequence number for client to increment. When a client modifies + any part of the northbound database configuration and wishes to + wait for ovn-northd and possibly all of the hypervisors to finā€ + ish applying the changes, it may increment this sequence number. + + nb_cfg_timestamp: integer + The timestamp, in milliseconds since the epoch, when ovn-northd + sees the latest nb_cfg and starts processing. + + To print the timestamp as a human-readable date: + + date -d "@$(ovn-nbctl get NB_Global . nb_cfg_timestamp | sed ā€ā€™s/...$//ā€ā€™)" + + + sb_cfg: integer + Sequence number that ovn-northd sets to the value of nb_cfg afā€ + ter it finishes applying the corresponding configuration changes + to the OVN_Southbound database. + + sb_cfg_timestamp: integer + The timestamp, in milliseconds since the epoch, when ovn-northd + finishes applying the corresponding configuration changes to the + OVN_Southbound database successfully. + + hv_cfg: integer + Sequence number that ovn-northd sets to the smallest sequence + number of all the chassis in the system, as reported in the + Chassis_Private table in the southbound database. Thus, hv_cfg + equals nb_cfg if all chassis are caught up with the northbound + configuration (which may never happen, if any chassis is down). + This value can regress, if a chassis was removed from the system + and rejoins before catching up. + + If there are no chassis, then ovn-northd copies nb_cfg to + hv_cfg. Thus, in this case, the (nonexistent) hypervisors are + always considered to be caught up. This means that hypervisors + can be "caught up" even in cases where sb_cfg would show that + the southbound database is not. To detect when both the hyperviā€ + sors and the southbound database are caught up, a client should + take the smaller of sb_cfg and hv_cfg. + + hv_cfg_timestamp: integer + The largest timestamp, in milliseconds since the epoch, of the + smallest sequence number of all the chassis in the system, as + reported in the Chassis_Private table in the southbound dataā€ + base. In other words, this timestamp reflects the time when the + slowest chassis catches up with the northbound configuration, + which is useful for end-to-end control plane latency measureā€ + ment. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + Common options: + + options: map of string-string pairs + This column provides general key/value settings. The supported + options are described individually below. + + Options for configuring OVS BFD: + + These options apply when ovn-controller configures OVS BFD on tunnels + interfaces. Please note these parameters refer to legacy OVS BFD impleā€ + mentation and not to OVN BFD one. + + options : bfd-min-rx: optional string + BFD option min-rx value to use when configuring BFD on tunnel + interfaces. + + options : bfd-decay-min-rx: optional string + BFD option decay-min-rx value to use when configuring BFD on + tunnel interfaces. + + options : bfd-min-tx: optional string + BFD option min-tx value to use when configuring BFD on tunnel + interfaces. + + options : bfd-mult: optional string + BFD option mult value to use when configuring BFD on tunnel inā€ + terfaces. + + options : mac_prefix: optional string + Configure a given OUI to be used as prefix when L2 address is + dynamically assigned, e.g. 00:11:22 + + options : mac_binding_removal_limit: optional string, containing an inā€ + teger, in range 0 to 4,294,967,295 + MAC binding aging bulk removal limit. This limits how many rows + can expire in a single transaction. Default value is 0 which is + unlimited. When we hit the limit next batch removal is delayed + by 5 s. + + options : controller_event: optional string, either true or false + Value set by the CMS to enable/disable ovn-controller event reā€ + porting. Traffic into OVS can raise a ā€™controllerā€™ event that + results in a Controller_Event being written to the Conā€ā€ + troller_Event table in SBDB. When the CMS has seen the event and + taken appropriate action, it can remove the corresponding row in + Controller_Event table. The intention is for a CMS to see the + events and take some sort of action. Please see the Conā€ā€ + troller_Event table in SBDB. It is possible to associate a meter + to each controller event type in order to not overload the pincā€ + trl thread under heavy load. Each event type relies on a meter + with a defined name: + + ā€¢ empty_lb_backends: event-elb + + options : northd_probe_interval: optional string + The inactivity probe interval of the connection to the OVN + Northbound and Southbound databases from ovn-northd, in milā€ + liseconds. If the value is zero, it disables the connection + keepalive feature. + + If the value is nonzero, then it will be forced to a value of at + least 1000 ms. + + options : ic_probe_interval: optional string + The inactivity probe interval of the connection to the OVN + Northbound and Southbound databases from ovn-ic, in millisecā€ + onds. If the value is zero, it disables the connection keepalive + feature. + + If the value is nonzero, then it will be forced to a value of at + least 1000 ms. + + options : nbctl_probe_interval: optional string + The inactivity probe interval of the connection to the OVN + Northbound database from ovn-nbctl utility, in milliseconds. If + the value is zero, it disables the connection keepalive feature. + + If the value is nonzero, then it will be forced to a value of at + least 1000 ms. + + If the value is less than zero, then the default inactivity + probe interval for ovn-nbctl would be left intact (120000 ms). + + options : northd_trim_timeout: optional string + When used, this configuration value specifies the time, in milā€ + liseconds, since the last ovn-northd active operation after + which memory trimming is performed. By default this is set to + 30000 (30 seconds). + + options : use_logical_dp_groups: optional string + Note: This option is deprecated, the only behavior is to always + combine logical flows by datapath groups. Changing the value or + removing this option all toghether will have no effect. + + ovn-northd combines logical flows that differs only by logical + datapath into a single logical flow with logical datapath group + attached. + + options : use_parallel_build: optional string + If set to true, ovn-northd will attempt to compute logical flows + in parallel. + + Parallel computation is enabled only if the system has 4 or more + cores/threads available to be used by ovn-northd. + + The default value is false. + + options : ignore_lsp_down: optional string + If set to false, ARP/ND reply flows for logical switch ports + will be installed only if the port is up, i.e. claimed by a + Chassis. If set to true, these flows are installed regardless of + the status of the port, which can result in a situation that ARP + request to an IP is resolved even before the relevant VM/conā€ + tainer is running. For environments where this is not an issue, + setting it to true can reduce the load and latency of the conā€ + trol plane. The default value is true. + + options : use_ct_inv_match: optional string + If set to false, ovn-northd will not use the ct.inv field in any + of the logical flow matches. The default value is true. If the + NIC supports offloading OVS datapath flows but doesnā€™t support + offloading ct_state inv flag, then the datapath flows matching + on this flag (either +inv or -inv) will not be offloaded. CMS + should consider setting use_ct_inv_match to false in such cases. + This results in a side effect of the invalid packets getting deā€ + livered to the destination VIF, which otherwise would have been + dropped by OVN. + + options : default_acl_drop: optional string + If set to true., ovn-northd will generate a logical flow to drop + all traffic in the ACL stages. By default this option is set to + false. + + options : debug_drop_domain_id: optional string + If set to a 8-bit number and if debug_drop_collector_set is also + configured, ovn-northd will add a sample action to every logical + flow that contains a ā€™dropā€™ action. The 8 most significant bits + of the observation_domain_id field will be those specified in + the debug_drop_domain_id. The 24 least significant bits of the + observation_domain_id field will be the datapathā€™s key. + + The observation_point_id will be set to the first 32 bits of the + logical flowā€™s UUID. + + options : debug_drop_collector_set: optional string + If set to a 32-bit number ovn-northd will add a sample action to + every logical flow that contains a ā€™dropā€™ action. The sample acā€ + tion will have the specified collector_set_id. The value must + match that of the local OVS configuration as described in + ovs-actions(7). + + options : use_common_zone: optional string, either true or false + Default value is false. If set to true the SNAT and DNAT happens + in common zone, instead of happening in separate zones, dependā€ + ing on the configuration. However, this option breaks traffic + when there is configuration of DGP + LB + SNAT on this LR. The + value true should be used only in case of HWOL compatibility + with GDP. + + Options for configuring interconnection route advertisement: + + These options control how routes are advertised between OVN deployments + for interconnection. If enabled, ovn-ic from different OVN deployments + exchanges routes between each other through the global OVN_IC_Southā€ā€ + bound database. Only routers with ports connected to interconnection + transit switches participate in route advertisement. For each of these + routers, there are two types of routes to be advertised: + + Firstly, the static routes configured in the router are advertised. + + Secondly, the networks configured in the logical router ports that are + not on the transit switches are advertised. These are considered as diā€ + rectly connected subnets on the router. + + Link local prefixes (IPv4 169.254.0.0/16 and IPv6 FE80::/10) are never + advertised. + + The learned routes are added to the static_routes column of the Logiā€ā€ + cal_Router table, with external_ids:ic-learned-route set to the uuid of + the row in Route table of the OVN_IC_Southbound database. + + options : ic-route-adv: optional string + A boolean value that enables route advertisement to the global + OVN_IC_Southbound database. Default is false. + + options : ic-route-learn: optional string + A boolean value that enables route learning from the global + OVN_IC_Southbound database. Default is false. + + options : ic-route-adv-default: optional string + A boolean value that enables advertising default route to the + global OVN_IC_Southbound database. Default is false. This option + takes effect only when option ic-route-adv is true. + + options : ic-route-learn-default: optional string + A boolean value that enables learning default route from the + global OVN_IC_Southbound database. Default is false. This option + takes effect only when option ic-route-learn is true. + + options : ic-route-blacklist: optional string + A string value contains a list of CIDRs delimited by ",". A + route will not be advertised or learned if the routeā€™s prefix + belongs to any of the CIDRs listed. + + Connection Options: + + connections: set of Connections + Database clients to which the Open vSwitch database server + should connect or on which it should listen, along with options + for how these connections should be configured. See the Connecā€ā€ + tion table for more information. + + ssl: optional SSL + Global SSL configuration. + + Security Configurations: + + ipsec: boolean + Tunnel encryption configuration. If this column is set to be + true, all OVN tunnels will be encrypted with IPsec. + + Read-only Options: + + options : max_tunid: optional string + The maximum supported tunnel ID. Depends on types of encapsulaā€ + tion enabled in the cluster. + +Copp TABLE + This table is used to define control plane protection policies, i.e., + associate entries from table Meter to control protocol names. + + Summary: + name string (must be unique within table) + meters : arp optional string + meters : arp-resolve optional string + meters : dhcpv4-opts optional string + meters : dhcpv6-opts optional string + meters : dns optional string + meters : event-elb optional string + meters : icmp4-error optional string + meters : icmp6-error optional string + meters : igmp optional string + meters : nd-na optional string + meters : nd-ns optional string + meters : nd-ns-resolve optional string + meters : nd-ra-opts optional string + meters : tcp-reset optional string + meters : bfd optional string + meters : reject optional string + meters : svc-monitor optional string + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + CoPP name. + + meters : arp: optional string + Rate limiting meter for ARP packets (request/reply) used for + learning neighbors. + + meters : arp-resolve: optional string + Rate limiting meter for packets that require resolving the next- + hop (through ARP). + + meters : dhcpv4-opts: optional string + Rate limiting meter for packets that require adding DHCPv4 opā€ + tions. + + meters : dhcpv6-opts: optional string + Rate limiting meter for packets that require adding DHCPv6 opā€ + tions. + + meters : dns: optional string + Rate limiting meter for DNS query packets that need to be + replied to. + + meters : event-elb: optional string + Rate limiting meter for empty load balancer events. + + meters : icmp4-error: optional string + Rate limiting meter for packets that require replying with an + ICMP error. + + meters : icmp6-error: optional string + Rate limiting meter for packets that require replying with an + ICMPv6 error. + + meters : igmp: optional string + Rate limiting meter for IGMP packets. + + meters : nd-na: optional string + Rate limiting meter for ND neighbor advertisement packets used + for learning neighbors. + + meters : nd-ns: optional string + Rate limiting meter for ND neighbor solicitation packets used + for learning neighbors. + + meters : nd-ns-resolve: optional string + Rate limiting meter for packets that require resolving the next- + hop (through ND). + + meters : nd-ra-opts: optional string + Rate limiting meter for packets that require adding ND router + advertisement options. + + meters : tcp-reset: optional string + Rate limiting meter for packets that require replying with TCP + RST packet. + + meters : bfd: optional string + Rate limiting meter for BFD packets. + + meters : reject: optional string + Rate limiting meter for packets that trigger a reject action + + meters : svc-monitor: optional string + Rate limiting meter for packets that are arriving to service + monitor MAC address. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Logical_Switch TABLE + Each row represents one L2 logical switch. + + There are two kinds of logical switches, that is, ones that fully virā€ + tualize the network (overlay logical switches) and ones that provide + simple connectivity to physical networks (bridged logical switches). + They work in the same way when providing connectivity between logical + ports on same chassis, but differently when connecting remote logical + ports. Overlay logical switches connect remote logical ports by tunā€ + nels, while bridged logical switches provide connectivity to remote + ports by bridging the packets to directly connected physical L2 segā€ + ments with the help of localnet ports. Each bridged logical switch has + one or more localnet ports, which have only one special address unā€ā€ + known. + + Summary: + ports set of Logical_Switch_Ports + load_balancer set of weak reference to Load_Balancers + load_balancer_group set of Load_Balancer_Groups + acls set of ACLs + qos_rules set of QoSes + dns_records set of weak reference to DNSes + forwarding_groups set of Forwarding_Groups + Naming: + name string + external_ids : neutron:network_name + optional string + IP Address Assignment: + other_config : subnet optional string + other_config : exclude_ips optional string + other_config : ipv6_prefix optional string + other_config : mac_only optional string, either true or false + IP Multicast Snooping Options: + other_config : mcast_snoop optional string, either true or false + other_config : mcast_querier + optional string, either true or false + other_config : mcast_flood_unregistered + optional string, either true or false + other_config : mcast_table_size + optional string, containing an integer, + in range 1 to 32,766 + other_config : mcast_idle_timeout + optional string, containing an integer, + in range 15 to 3,600 + other_config : mcast_query_interval + optional string, containing an integer, + in range 1 to 3,600 + other_config : mcast_query_max_response + optional string, containing an integer, + in range 1 to 10 + other_config : mcast_eth_src + optional string + other_config : mcast_ip4_src + optional string + other_config : mcast_ip6_src + optional string + Interconnection: + other_config : interconn-ts + optional string + Tunnel Key: + other_config : requested-tnl-key + optional string, containing an integer, + in range 1 to 16,777,215 + copp optional weak reference to Copp + Other options: + other_config : vlan-passthru + optional string, either true or false + other_config : broadcast-arps-to-all-routers + optional string, either true or false + Common Columns: + external_ids map of string-string pairs + + Details: + ports: set of Logical_Switch_Ports + The logical ports connected to the logical switch. + + It is an error for multiple logical switches to include the same + logical port. + + load_balancer: set of weak reference to Load_Balancers + Set of load balancers associated to this logical switch. + + load_balancer_group: set of Load_Balancer_Groups + Set of load balancers groups associated to this logical switch. + + acls: set of ACLs + Access control rules that apply to packets within the logical + switch. + + qos_rules: set of QoSes + QoS marking and metering rules that apply to packets within the + logical switch. + + dns_records: set of weak reference to DNSes + This column defines the DNS records to be used for resolving inā€ + ternal DNS queries within the logical switch by the native DNS + resolver. Please see the DNS table. + + forwarding_groups: set of Forwarding_Groups + Groups a set of logical port endpoints for traffic going out of + the logical switch. + + Naming: + + These columns provide names for the logical switch. From OVNā€™s perspecā€ + tive, these names have no special meaning or purpose other than to proā€ + vide convenience for human interaction with the database. There is no + requirement for the name to be unique. (For a unique identifier for a + logical switch, use its row UUID.) + + (Originally, name was intended to serve the purpose of a human-friendly + name, but the Neutron integration used it to uniquely identify its own + switch object, in the format neutron-uuid. Later on, Neutron started + propagating the friendly name of a switch as external_ids:neutron:netā€ā€ + work_name. Perhaps this can be cleaned up someday.) + + name: string + A name for the logical switch. + + external_ids : neutron:network_name: optional string + Another name for the logical switch. + + IP Address Assignment: + + These options control automatic IP address management (IPAM) for ports + attached to the logical switch. To enable IPAM for IPv4, set other_conā€ā€ + fig:subnet and optionally other_config:exclude_ips. To enable IPAM for + IPv6, set other_config:ipv6_prefix. IPv4 and IPv6 may be enabled toā€ + gether or separately. + + To request dynamic address assignment for a particular port, use the + dynamic keyword in the addresses column of the portā€™s Logiā€ā€ + cal_Switch_Port row. This requests both an IPv4 and an IPv6 address, if + IPAM for IPv4 and IPv6 are both enabled. + + other_config : subnet: optional string + Set this to an IPv4 subnet, e.g. 192.168.0.0/24, to enable + ovn-northd to automatically assign IP addresses within that subā€ + net. + + other_config : exclude_ips: optional string + To exclude some addresses from automatic IP address management, + set this to a list of the IPv4 addresses or ..-delimited ranges + to exclude. The addresses or ranges should be a subset of those + in other_config:subnet. + + Whether listed or not, ovn-northd will never allocate the first + or last address in a subnet, such as 192.168.0.0 or + 192.168.0.255 in 192.168.0.0/24. + + Examples: + + ā€¢ 192.168.0.2 192.168.0.10 + + ā€¢ 192.168.0.4 192.168.0.30..192.168.0.60 + 192.168.0.110..192.168.0.120 + + ā€¢ 192.168.0.110..192.168.0.120 192.168.0.25..192.168.0.30 + 192.168.0.144 + + other_config : ipv6_prefix: optional string + Set this to an IPv6 prefix to enable ovn-northd to automatically + assign IPv6 addresses using this prefix. The assigned IPv6 adā€ + dress will be generated using the IPv6 prefix and the MAC adā€ + dress (converted to an IEEE EUI64 identifier) of the port. The + IPv6 prefix defined here should be a valid IPv6 address ending + with ::. + + Examples: + + ā€¢ aef0:: + + ā€¢ bef0:1234:a890:5678:: + + ā€¢ 8230:5678:: + + other_config : mac_only: optional string, either true or false + Value used to request to assign L2 address only if neither subā€ + net nor ipv6_prefix are specified + + IP Multicast Snooping Options: + + These options control IP Multicast Snooping configuration of the logiā€ + cal switch. To enable IP Multicast Snooping set other_conā€ā€ + fig:mcast_snoop to true. To enable IP Multicast Querier set other_conā€ā€ + fig:mcast_querier to true. If IP Multicast Querier is enabled + other_config:mcast_eth_src and other_config:mcast_ip4_src must be set. + + other_config : mcast_snoop: optional string, either true or false + Enables/disables IP Multicast Snooping on the logical switch. + Default: false. + + other_config : mcast_querier: optional string, either true or false + Enables/disables IP Multicast Querier on the logical switch. + Only applicable if other_config:mcast_snoop is enabled. Default: + true. + + other_config : mcast_flood_unregistered: optional string, either true + or false + Determines whether unregistered multicast traffic should be + flooded or not. Only applicable if other_config:mcast_snoop is + enabled. Default: false. + + other_config : mcast_table_size: optional string, containing an inteā€ + ger, in range 1 to 32,766 + Number of multicast groups to be stored. Default: 2048. + + other_config : mcast_idle_timeout: optional string, containing an inteā€ + ger, in range 15 to 3,600 + Configures the IP Multicast Snooping group idle timeout (in secā€ + onds). Default: 300 seconds. + + other_config : mcast_query_interval: optional string, containing an inā€ + teger, in range 1 to 3,600 + Configures the IP Multicast Querier interval between queries (in + seconds). Default: other_config:mcast_idle_timeout / 2. + + other_config : mcast_query_max_response: optional string, containing an + integer, in range 1 to 10 + Configures the value of the "max-response" field in the multiā€ + cast queries originated by the logical switch. Default: 1 secā€ + ond. + + other_config : mcast_eth_src: optional string + Configures the source Ethernet address for queries originated by + the logical switch. + + other_config : mcast_ip4_src: optional string + Configures the source IPv4 address for queries originated by the + logical switch. + + other_config : mcast_ip6_src: optional string + Configures the source IPv6 address for queries originated by the + logical switch. + + Interconnection: + + other_config : interconn-ts: optional string + The name of corresponding transit switch in OVN_IC_Northbound + database. This kind of logical switch is created and controlled + by ovn-ic. + + Tunnel Key: + + other_config : requested-tnl-key: optional string, containing an inteā€ + ger, in range 1 to 16,777,215 + Configures the datapath tunnel key for the logical switch. Usuā€ + ally this is not needed because ovn-northd will assign an unique + key for each datapath by itself. However, if it is configured, + ovn-northd honors the configured value. The typical use case is + for interconnection: the tunnel keys for transit switches need + to be unique globally, so they are maintained in the global + OVN_IC_Southbound database, and ovn-ic simply syncs the value + from OVN_IC_Southbound through this config. + + copp: optional weak reference to Copp + The control plane protection policy from table Copp used for meā€ + tering packets sent to ovn-controller from ports of this logical + switch. + + Other options: + + other_config : vlan-passthru: optional string, either true or false + Determines whether VLAN tagged incoming traffic should be alā€ + lowed. Note that this may have security implications when enā€ + abled for a logical switch with a tag=0 localnet port. If not + properly isolated from other localnet ports, fabric traffic that + belongs to other tagged networks may be passed through such a + port. + + other_config : broadcast-arps-to-all-routers: optional string, either + true or false + Determines whether arp requests and ipv6 neighbor solicitations + should be sent to all routers and other switchports (default) or + if it should only be sent to switchports where the ip/mac adā€ + dress is unknown. Setting this to false can significantly reduce + the load if the logical switch can receive arp requests for ips + it does not know about. However setting this to false also means + that garps are no longer forwarded to all routers and therefor + the mac bindings of the routers are no longer updated. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Logical_Switch_Port TABLE + A port within an L2 logical switch. + + Summary: + Core Features: + name string (must be unique within table) + type string + Options: + options map of string-string pairs + Options for router ports: + options : router-port optional string + options : nat-addresses optional string + options : exclude-lb-vips-from-garp + optional string + options : arp_proxy optional string + Options for localnet ports: + options : network_name optional string + options : ethtype optional string + options : localnet_learn_fdb + optional string, either true or false + Options for l2gateway ports: + options : network_name optional string + options : l2gateway-chassis + optional string + Options for vtep ports: + options : vtep-physical-switch + optional string + options : vtep-logical-switch + optional string + VMI (or VIF) Options: + options : requested-chassis + optional string + options : activation-strategy + optional string + options : iface-id-ver optional string + options : qos_min_rate optional string + options : qos_max_rate optional string + options : qos_burst optional string + options : hostname optional string + VIF Plugging Options: + options : vif-plug-type + optional string + options : vif-plug-mtu-request + optional string + Virtual port Options: + options : virtual-ip optional string + options : virtual-parents + optional string + IP Multicast Snooping Options: + options : mcast_flood optional string, either true or false + options : mcast_flood_reports + optional string, either true or false + Containers: + parent_name optional string + tag_request optional integer, in range 0 to 4,095 + tag optional integer, in range 1 to 4,095 + Port State: + up optional boolean + enabled optional boolean + Addressing: + addresses set of strings + dynamic_addresses optional string + port_security set of strings + DHCP: + dhcpv4_options optional weak reference to DHCP_Options + dhcpv6_options optional weak reference to DHCP_Options + mirror_rules set of weak reference to Mirrors + ha_chassis_group optional HA_Chassis_Group + Naming: + external_ids : neutron:port_name + optional string + Tunnel Key: + options : requested-tnl-key + optional string, containing an integer, + in range 1 to 32,767 + Common Columns: + external_ids map of string-string pairs + + Details: + Core Features: + + name: string (must be unique within table) + The logical port name. + + For entities (VMs or containers) that are spawned in the hyperā€ + visor, the name used here must match those used in the exterā€ā€ + nal_ids:iface-id in the Open_vSwitch databaseā€™s Interface table, + because hypervisors use external_ids:iface-id as a lookup key to + identify the network interface of that entity. + + For containers that share a VIF within a VM, the name can be any + unique identifier. See Containers, below, for more information. + + A logical switch port may not have the same name as a logical + router port, but the database schema cannot enforce this. + + type: string + Specify a type for this logical port. Logical ports can be used + to model other types of connectivity into an OVN logical switch. + The following types are defined: + + (empty string) + A VM (or VIF) interface. + + router A connection to a logical router. The value of opā€ā€ + tions:router-port specifies the name of the Logiā€ā€ + cal_Router_Port to which this logical switch port is conā€ + nected. + + localnet + A connection to a locally accessible network from + ovn-controller instances that have a corresponding bridge + mapping. A logical switch can have multiple localnet + ports attached. This type is used to model direct connecā€ + tivity to existing networks. In this case, each chassis + should have a mapping for one of the physical networks + only. Note: nothing said above implies that a chassis + cannot be plugged to multiple physical networks as long + as they belong to different switches. + + localport + A connection to a local VIF. Traffic that arrives on a + localport is never forwarded over a tunnel to another + chassis. These ports are present on every chassis and + have the same address in all of them. This is used to + model connectivity to local services that run on every + hypervisor. + + l2gateway + A connection to a physical network. + + vtep A port to a logical switch on a VTEP gateway. + + external + Represents a logical port which is external and not havā€ + ing an OVS port in the integration bridge. OVN will never + receive any traffic from this port or send any traffic to + this port. OVN can support native services like + DHCPv4/DHCPv6/DNS for this port. If ha_chassis_group is + defined, ovn-controller running in the master chassis of + the HA chassis group will bind this port to provide these + native services. It is expected that this port belong to + a bridged logical switch (with a localnet port). + + It is recommended to use the same HA chassis group for + all the external ports of a logical switch. Otherwise, + the physical switch might see MAC flap issue when differā€ + ent chassis provide the native services. For example when + supporting native DHCPv4 service, DHCPv4 server mac (conā€ + figured in options:server_mac column in table DHCP_Opā€ā€ + tions) originating from different ports can cause MAC + flap issue. The MAC of the logical router IP(s) can also + flap if the same HA chassis group is not set for all the + external ports of a logical switch. + + Below are some of the use cases where external ports can + be used. + + ā€¢ VMs connected to SR-IOV nics - Traffic from these + VMs by passes the kernel stack and local ovn-conā€ā€ + troller do not bind these ports and cannot serve + the native services. + + ā€¢ When CMS supports provisioning baremetal servers. + + virtual + Represents a logical port which does not have an OVS port + in the integration bridge and has a virtual ip configured + in the options:virtual-ip column. This virtual ip can + move around between the logical ports configured in the + options:virtual-parents column. + + One of the use case where virtual ports can be used is. + + ā€¢ The virtual ip represents a load balancer vip and + the virtual parents provide load balancer service + in an active-standby setup with the active virtual + parent owning the virtual ip. + + remote A remote port is to model a port that resides remotely on + another OVN, which is on the other side of a transit logā€ + ical switch for OVN interconnection. This type of ports + are created by ovn-ic instead of by CMS. Any change to + the port will be automatically overwritten by ovn-ic. + + Options: + + options: map of string-string pairs + This column provides key/value settings specific to the logical + port type. The type-specific options are described individually + below. + + Options for router ports: + + These options apply when type is router. + + options : router-port: optional string + Required. The name of the Logical_Router_Port to which this logā€ + ical switch port is connected. + + options : nat-addresses: optional string + This is used to send gratuitous ARPs for SNAT and DNAT IP adā€ + dresses via the localnet port that is attached to the same logiā€ + cal switch as this type router port. This option is specified on + a logical switch port that is connected to a gateway router, or + a logical switch port that is connected to a distributed gateway + port on a logical router. + + This must take one of the following forms: + + router Gratuitous ARPs will be sent for all SNAT and DNAT exterā€ + nal IP addresses and for all load balancer IP addresses + defined on the options:router-portā€™s logical router, usā€ + ing the options:router-portā€™s MAC address. + + This form of options:nat-addresses is valid for logical + switch ports where options:router-port is the name of a + port on a gateway router, or the name of a distributed + gateway port. + + Supported only in OVN 2.8 and later. Earlier versions reā€ + quired NAT addresses to be manually synchronized. + + Ethernet address followed by one or more IPv4 addresses + Example: 80:fa:5b:06:72:b7 158.36.44.22 158.36.44.24. + This would result in generation of gratuitous ARPs for IP + addresses 158.36.44.22 and 158.36.44.24 with a MAC adā€ + dress of 80:fa:5b:06:72:b7. + + This form of options:nat-addresses is only valid for logā€ + ical switch ports where options:router-port is the name + of a port on a gateway router. + + options : exclude-lb-vips-from-garp: optional string + If options:nat-addresses is set to router, Gratuitous ARPs will + be sent for all SNAT and DNAT external IP addresses defined on + the options:router-portā€™s logical router, using the opā€ā€ + tions:router-portā€™s MAC address, not cosidering configured load + balancers. + + options : arp_proxy: optional string + Optional. A list of MAC and addresses/cidrs or just adā€ + dresses/cidrs that this logical switch router port will reply to + ARP/NDP requests. Examples: 169.254.239.254 169.254.239.2, + 0a:58:a9:fe:01:01 169.254.239.254 169.254.239.2 + 169.254.238.0/24, fd7b:6b4d:7b25:d22f::1 fd7b:6b4d:7b25:d22f::2, + 0a:58:a9:fe:01:01 fd7b:6b4d:7b25:d22f::0/64. Theoptions:router- + portā€™s logical router should have a route to forward packets + sent to configured proxy ARP MAC/IPs to an appropriate destinaā€ + tion. + + Options for localnet ports: + + These options apply when type is localnet. + + options : network_name: optional string + Required. The name of the network to which the localnet port is + connected. Each hypervisor, via ovn-controller, uses its local + configuration to determine exactly how to connect to this loā€ + cally accessible network, if at all. + + options : ethtype: optional string + Optional. VLAN EtherType field value for encapsulating VLAN + headers. Supported values: 802.1q (default), 802.1ad. + + options : localnet_learn_fdb: optional string, either true or false + Optional. Allows localnet port to learn MACs and store them in + FDB table if set to true. The default value is false. + + Options for l2gateway ports: + + These options apply when type is l2gateway. + + options : network_name: optional string + Required. The name of the network to which the l2gateway port is + connected. The L2 gateway, via ovn-controller, uses its local + configuration to determine exactly how to connect to this netā€ + work. + + options : l2gateway-chassis: optional string + Required. The chassis on which the l2gateway logical port should + be bound to. ovn-controller running on the defined chassis will + connect this logical port to the physical network. + + Options for vtep ports: + + These options apply when type is vtep. + + options : vtep-physical-switch: optional string + Required. The name of the VTEP gateway. + + options : vtep-logical-switch: optional string + Required. A logical switch name connected by the VTEP gateway. + + VMI (or VIF) Options: + + These options apply to logical ports with type having (empty string) + + options : requested-chassis: optional string + If set, identifies a specific chassis (by name or hostname) that + is allowed to bind this port. Using this option will prevent + thrashing between two chassis trying to bind the same port durā€ + ing a live migration. It can also prevent similar thrashing due + to a mis-configuration, if a port is accidentally created on + more than one chassis. + + If set to a comma separated list, the first entry identifies the + main chassis and the rest are one or more additional chassis + that are allowed to bind the same port. + + When multiple chassis are set for the port, and the logical + switch is connected to an external network through a localnet + port, tunneling is enforced for the port to guarantee delivery + of packets directed to the port to all its locations. This has + MTU implications because the network used for tunneling must + have MTU larger than localnet for stable connectivity. + + If the same host co-hosts more than one controller instance (eiā€ + ther belonging to the same or separate clusters), special attenā€ + tion should be given to consistently using unique chassis names + used in this option. It is advised that chassis names - and not + host names - are used for this option. + + options : activation-strategy: optional string + If used with multiple chassis set in requested-chassis, speciā€ + fies an activation strategy for all additional chassis. By deā€ + fault, no activation strategy is used, meaning additional port + locations are immediately available for use. When set to "rarp", + the port is blocked for ingress and egress communication until a + RARP packet is sent from a new location. The "rarp" strategy is + useful in live migration scenarios for virtual machines. + + options : iface-id-ver: optional string + If set, this port will be bound by ovn-controller only if this + same key and value is configured in the external_ids column in + the Open_vSwitch databaseā€™s Interface table. + + options : qos_min_rate: optional string + If set, indicates the minimum guaranteed rate available for data + sent from this interface, in bit/s. + + options : qos_max_rate: optional string + If set, indicates the maximum rate for data sent from this inā€ + terface, in bit/s. The traffic will be shaped according to this + limit. + + options : qos_burst: optional string + If set, indicates the maximum burst size for data sent from this + interface, in bits. + + options : hostname: optional string + If set, indicates the DHCPv4 option "Hostname" (option code 12) + associated for this Logical Switch Port. If DHCPv4 is enabled + for this Logical Switch Port, hostname dhcp option will be inā€ + cluded in DHCP reply. + + VIF Plugging Options: + + options : vif-plug-type: optional string + If set, OVN will attempt to perform plugging of this VIF. In orā€ + der to get this port plugged by the OVN controller, OVN must be + built with support for VIF plugging. The default behavior is for + the CMS to do the VIF plugging. Each VIF plug provider have + their own options namespaced by name, for example "vif-plug:repā€ + resentor:key". Please refer to the VIF plug provider documentaā€ + tion located in Documentation/topics/vif-plug-providers/ for + more information. + + options : vif-plug-mtu-request: optional string + Requested MTU for plugged interfaces. When set the OVN conā€ + troller will fill the mtu_request column of the Open vSwitch + databaseā€™s Interface table. This in turn will make OVS vswitchd + update the MTU of the linked interface. + + Virtual port Options: + + These options apply when type is virtual. + + options : virtual-ip: optional string + This option represents the virtual IPv4 address. + + options : virtual-parents: optional string + This options represents a set of logical port names (with in the + same logical switch) which can own the virtual ip configured in + the options:virtual-ip. All these virtual parents should add the + virtual ip in the port_security if port security addressed are + enabled. + + IP Multicast Snooping Options: + + These options apply when the port is part of a logical switch which has + other_config :mcast_snoop set to true. + + options : mcast_flood: optional string, either true or false + If set to true, multicast packets (except reports) are uncondiā€ + tionally forwarded to the specific port. Default: false. + + options : mcast_flood_reports: optional string, either true or false + If set to true, multicast reports are unconditionally forwarded + to the specific port. Default: false. + + Containers: + + When a large number of containers are nested within a VM, it may be too + expensive to dedicate a VIF to each container. OVN can use VLAN tags to + support such cases. Each container is assigned a VLAN ID and each + packet that passes between the hypervisor and the VM is tagged with the + appropriate ID for the container. Such VLAN IDs never appear on a physā€ + ical wire, even inside a tunnel, so they need not be unique except relā€ + ative to a single VM on a hypervisor. + + These columns are used for VIFs that represent nested containers using + shared VIFs. For VMs and for containers that have dedicated VIFs, they + are empty. + + parent_name: optional string + The VM interface through which the nested container sends its + network traffic. This must match the name column for some other + Logical_Switch_Port. + + tag_request: optional integer, in range 0 to 4,095 + The VLAN tag in the network traffic associated with a conā€ + tainerā€™s network interface. The client can request ovn-northd to + allocate a tag that is unique within the scope of a specific + parent (specified in parent_name) by setting a value of 0 in + this column. The allocated value is written by ovn-northd in the + tag column. (Note that these tags are allocated and managed loā€ + cally in ovn-northd, so they cannot be reconstructed in the + event that the database is lost.) The client can also request a + specific non-zero tag and ovn-northd will honor it and copy that + value to the tag column. + + When type is set to localnet or l2gateway, this can be set to + indicate that the port represents a connection to a specific + VLAN on a locally accessible network. The VLAN ID is used to + match incoming traffic and is also added to outgoing traffic. + + tag: optional integer, in range 1 to 4,095 + The VLAN tag allocated by ovn-northd based on the contents of + the tag_request column. + + Port State: + + up: optional boolean + This column is populated by ovn-northd, rather than by the CMS + plugin as is most of this database. When a logical port is bound + to a physical location in the OVN Southbound database Binding + table, ovn-northd sets this column to true; otherwise, or if the + port becomes unbound later, it sets it to false. If this column + is empty, the port is not considered up. This allows the CMS to + wait for a VMā€™s (or containerā€™s) networking to become active beā€ + fore it allows the VM (or container) to start. + + Logical ports of router type are an exception to this rule. They + are considered to be always up, that is this column is always + set to true. + + enabled: optional boolean + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port + has all ingress and egress traffic dropped. + + Addressing: + + addresses: set of strings + Addresses owned by the logical port. + + Each element in the set must take one of the following forms: + + Ethernet address followed by zero or more IPv4 or IPv6 addresses + (or both) + An Ethernet address defined is owned by the logical port. + Like a physical Ethernet NIC, a logical port ordinarily + has a single fixed Ethernet address. + + When a OVN logical switch processes a unicast Ethernet + frame whose destination MAC address is in a logical + portā€™s addresses column, it delivers it only to that + port, as if a MAC learning process had learned that MAC + address on the port. + + If IPv4 or IPv6 address(es) (or both) are defined, it inā€ + dicates that the logical port owns the given IP adā€ + dresses. + + If IPv4 address(es) are defined, the OVN logical switch + uses this information to synthesize responses to ARP reā€ + quests without traversing the physical network. The OVN + logical router connected to the logical switch, if any, + uses this information to avoid issuing ARP requests for + logical switch ports. + + Note that the order here is important. The Ethernet adā€ + dress must be listed before the IP address(es) if deā€ + fined. + + Examples: + + 80:fa:5b:06:72:b7 + This indicates that the logical port owns the + above mac address. + + 80:fa:5b:06:72:b7 10.0.0.4 20.0.0.4 + This indicates that the logical port owns the mac + address and two IPv4 addresses. + + 80:fa:5b:06:72:b7 fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 + This indicates that the logical port owns the mac + address and 1 IPv6 address. + + 80:fa:5b:06:72:b7 10.0.0.4 + fdaa:15f2:72cf:0:f816:3eff:fe20:3f41 + This indicates that the logical port owns the mac + address and 1 IPv4 address and 1 IPv6 address. + + unknown + This indicates that the logical port has an unknown set + of Ethernet addresses. When an OVN logical switch + processes a unicast Ethernet frame whose destination MAC + address is not in any logical portā€™s addresses column, it + delivers it to the port (or ports) whose addresses + columns include unknown. + + dynamic + Use dynamic to make ovn-northd generate a globally unique + MAC address, choose an unused IPv4 address with the logiā€ + cal portā€™s subnet (if other_config:subnet is set in the + portā€™s Logical_Switch), and generate an IPv6 address from + the MAC address (if other_config:ipv6_prefix is set in + the portā€™s Logical_Switch) and store them in the portā€™s + dynamic_addresses column. + + Only one element containing dynamic may appear in adā€ā€ + dresses. + + dynamic ip + dynamic ipv6 + dynamic ip ipv6 + These act like dynamic alone but specify particular IPv4 or + IPv6 addresses to use. OVN IPAM will still automatically + allocate the other address if configured appropriately. Exā€ + ample: dynamic 192.168.0.1 2001::1. + + mac dynamic + This acts like dynamic alone but specifies a particular MAC + address to use. OVN IPAM will still automatically allocate + IPv4 or IPv6 addresses, or both, if configured appropriā€ + ately. Example: 80:fa:5b:06:72:b7 dynamic + + router + Accepted only when type is router. This indicates that the + Ethernet, IPv4, and IPv6 addresses for this logical switch + port should be obtained from the connected logical router + port, as specified by router-port in options. + + The resulting addresses are used to populate the logical + switchā€™s destination lookup, and also for the logical + switch to generate ARP and ND replies. + + If the connected logical router port has a distributed + gateway port specified and the logical router has rules + specified in nat with external_mac, then those addresses + are also used to populate the switchā€™s destination lookup. + + Supported only in OVN 2.7 and later. Earlier versions reā€ + quired router addresses to be manually synchronized. + + dynamic_addresses: optional string + Addresses assigned to the logical port by ovn-northd, if dynamic + is specified in addresses. Addresses will be of the same format + as those that populate the addresses column. Note that dynamiā€ + cally assigned addresses are constructed and managed locally in + ovn-northd, so they cannot be reconstructed in the event that + the database is lost. + + port_security: set of strings + This column controls the addresses from which the host attached + to the logical port (``the hostā€™ā€™) is allowed to send packets + and to which it is allowed to receive packets. If this column is + empty, all addresses are permitted. + + Each element in the set must begin with one Ethernet address. + This would restrict the host to sending packets from and receivā€ + ing packets to the ethernet addresses defined in the logical + portā€™s port_security column. It also restricts the inner source + MAC addresses that the host may send in ARP and IPv6 Neighbor + Discovery packets. The host is always allowed to receive packets + to multicast and broadcast Ethernet addresses. + + Each element in the set may additionally contain one or more + IPv4 or IPv6 addresses (or both), with optional masks. If a mask + is given, it must be a CIDR mask. In addition to the restricā€ + tions described for Ethernet addresses above, such an element + restricts the IPv4 or IPv6 addresses from which the host may + send and to which it may receive packets to the specified adā€ + dresses. A masked address, if the host part is zero, indicates + that the host is allowed to use any address in the subnet; if + the host part is nonzero, the mask simply indicates the size of + the subnet. In addition: + + ā€¢ If any IPv4 address is given, the host is also allowed to + receive packets to the IPv4 local broadcast address + 255.255.255.255 and to IPv4 multicast addresses + (224.0.0.0/4). If an IPv4 address with a mask is given, + the host is also allowed to receive packets to the broadā€ + cast address in that specified subnet. + + If any IPv4 address is given, the host is additionally + restricted to sending ARP packets with the specified + source IPv4 address. (RARP is not restricted.) + + ā€¢ If any IPv6 address is given, the host is also allowed to + receive packets to IPv6 multicast addresses (ff00::/8). + + If any IPv6 address is given, the host is additionally + restricted to sending IPv6 Neighbor Discovery Solicitaā€ + tion or Advertisement packets with the specified source + address or, for solicitations, the unspecified address. + + If an element includes an IPv4 address, but no IPv6 addresses, + then IPv6 traffic is not allowed. If an element includes an IPv6 + address, but no IPv4 address, then IPv4 and ARP traffic is not + allowed. + + This column uses the same lexical syntax as the match column in + the OVN Southbound databaseā€™s Pipeline table. Multiple addresses + within an element may be space or comma separated. + + This column is provided as a convenience to cloud management + systems, but all of the features that it implements can be imā€ + plemented as ACLs using the ACL table. + + Examples: + + 80:fa:5b:06:72:b7 + The host may send traffic from and receive traffic to the + specified MAC address, and to receive traffic to Ethernet + multicast and broadcast addresses, but not otherwise. The + host may not send ARP or IPv6 Neighbor Discovery packets + with inner source Ethernet addresses other than the one + specified. + + 80:fa:5b:06:72:b7 192.168.1.10/24 + This adds further restrictions to the first example. The + host may send IPv4 packets from or receive IPv4 packets + to only 192.168.1.10, except that it may also receive + IPv4 packets to 192.168.1.255 (based on the subnet mask), + 255.255.255.255, and any address in 224.0.0.0/4. The host + may not send ARPs with a source Ethernet address other + than 80:fa:5b:06:72:b7 or source IPv4 address other than + 192.168.1.10. The host may not send or receive any IPv6 + (including IPv6 Neighbor Discovery) traffic. + + "80:fa:5b:12:42:ba", "80:fa:5b:06:72:b7 192.168.1.10/24" + The host may send traffic from and receive traffic to the + specified MAC addresses, and to receive traffic to Etherā€ + net multicast and broadcast addresses, but not otherwise. + With MAC 80:fa:5b:12:42:ba, the host may send traffic + from and receive traffic to any L3 address. With MAC + 80:fa:5b:06:72:b7, the host may send IPv4 packets from or + receive IPv4 packets to only 192.168.1.10, except that it + may also receive IPv4 packets to 192.168.1.255 (based on + the subnet mask), 255.255.255.255, and any address in + 224.0.0.0/4. The host may not send or receive any IPv6 + (including IPv6 Neighbor Discovery) traffic. + + DHCP: + + dhcpv4_options: optional weak reference to DHCP_Options + This column defines the DHCPv4 Options to be included by the + ovn-controller when it replies to the DHCPv4 requests. Please + see the DHCP_Options table. + + dhcpv6_options: optional weak reference to DHCP_Options + This column defines the DHCPv6 Options to be included by the + ovn-controller when it replies to the DHCPv6 requests. Please + see the DHCP_Options table. + + mirror_rules: set of weak reference to Mirrors + Mirror rules that apply to logical switch port which is the + source. Please see the Mirror table. + + ha_chassis_group: optional HA_Chassis_Group + References a row in the OVN Northbound databaseā€™s HA_Chasā€ā€ + sis_Group table. It indicates the HA chassis group to use if the + type is set to external. If type is not external, this column is + ignored. + + Naming: + + external_ids : neutron:port_name: optional string + This column gives an optional human-friendly name for the port. + This name has no special meaning or purpose other than to proā€ + vide convenience for human interaction with the northbound dataā€ + base. + + Neutron copies this from its own port objectā€™s name. (Neutron + ports do are not assigned human-friendly names by default, so it + will often be empty.) + + Tunnel Key: + + options : requested-tnl-key: optional string, containing an integer, in + range 1 to 32,767 + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, + ovn-northd honors the configured value. The typical use case is + for interconnection: the tunnel keys for ports on transit + switches need to be unique globally, so they are maintained in + the global OVN_IC_Southbound database, and ovn-ic simply syncs + the value from OVN_IC_Southbound through this config. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + The ovn-northd program copies all these pairs into the exterā€ā€ + nal_ids column of the Port_Binding table in OVN_Southbound dataā€ + base. + +Forwarding_Group TABLE + Each row represents one forwarding group. + + Summary: + name string + vip string + vmac string + liveness boolean + child_port set of 1 or more strings + Common Columns: + external_ids map of string-string pairs + + Details: + name: string + A name for the forwarding group. This name has no special meanā€ + ing or purpose other than to provide convenience for human inā€ + teraction with the ovn-nb database. + + vip: string + The virtual IP address assigned to the forwarding group. It will + respond with vmac when an ARP request is sent for vip. + + vmac: string + The virtual MAC address assigned to the forwarding group. + + liveness: boolean + If set to true, liveness is enabled for child ports otherwise it + is disabled. + + child_port: set of 1 or more strings + List of child ports in the forwarding group. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Address_Set TABLE + Each row in this table represents a named set of addresses. An address + set may contain Ethernet, IPv4, or IPv6 addresses with optional bitwise + or CIDR masks. Address set may ultimately be used in ACLs to compare + against fields such as ip4.src or ip6.src. A single address set must + contain addresses of the same type. As an example, the following would + create an address set with three IP addresses: + + ovn-nbctl create Address_Set name=set1 addresses=ā€ā€™10.0.0.1 10.0.0.2 10.0.0.3ā€ā€™ + + + Address sets may be used in the match column of the ACL table. For synā€ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound dataā€ + base. + + Summary: + name string (must be unique within table) + addresses set of strings + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + A name for the address set. Names are ASCII and must match + [a-zA-Z_.][a-zA-Z_.0-9]*. + + addresses: set of strings + The set of addresses in string form. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Port_Group TABLE + Each row in this table represents a named group of logical switch + ports. + + Port groups may be used in the match column of the ACL table. For synā€ + tax information, see the details of the expression language used for + the match column in the Logical_Flow table of the OVN_Southbound dataā€ + base. + + For each port group, there are two address sets generated to the Adā€ā€ + dress_Set table of the OVN_Southbound database, containing the IP adā€ + dresses of the group of ports, one for IPv4, and the other for IPv6, + with name being the name of the Port_Group followed by a suffix _ip4 + for IPv4 and _ip6 for IPv6. The generated address sets can be used in + the same way as regular address sets in the match column of the ACL taā€ + ble. For syntax information, see the details of the expression language + used for the match column in the Logical_Flow table of the OVN_Southā€ā€ + bound database. + + Summary: + name string (must be unique within table) + ports set of weak reference to Logiā€ā€ + cal_Switch_Ports + acls set of ACLs + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + A name for the port group. Names are ASCII and must match + [a-zA-Z_.][a-zA-Z_.0-9]*. + + ports: set of weak reference to Logical_Switch_Ports + The logical switch ports belonging to the group in uuids. + + acls: set of ACLs + Access control rules that apply to the port group. Applying an + ACL to a port group has the same effect as applying the ACL to + all logical lswitches that the ports of the port group belong + to. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Load_Balancer TABLE + Each row represents one load balancer. + + Summary: + name string + vips map of string-string pairs + protocol optional string, one of sctp, tcp, or udp + Health Checks: + health_check set of Load_Balancer_Health_Checks + ip_port_mappings map of string-string pairs + selection_fields set of strings, one of eth_dst, eth_src, + ip_dst, ip_src, tp_dst, or tp_src + Common Columns: + external_ids map of string-string pairs + Load_Balancer options: + options : reject optional string, either true or false + options : hairpin_snat_ip optional string + options : skip_snat optional string + options : add_route optional string + options : neighbor_responder + optional string + options : template optional string + options : address-family optional string + options : affinity_timeout optional string + options : ct_flush optional string, either true or false + + Details: + name: string + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interacā€ + tion with the ovn-nb database. + + vips: map of string-string pairs + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers + with : as separators) separated by commas. If the destination IP + address (and port number) of a packet leaving a container or a + VM matches the virtual IP address (and port number) provided + here as a key, then OVN will statefully replace the destination + IP address by one of the provided IP address (and port number) + in this map as a value. IPv4 and IPv6 addresses are supported + for load balancing; however a VIP of one address family may not + be mapped to a destination IP address of a different family. If + specifying an IPv6 address with a port, the address portion must + be enclosed in square brackets. Examples for keys are + "192.168.1.4" and "[fd0f::1]:8800". Examples for value are + "10.0.0.1, 10.0.0.2" and "20.0.0.10:8800, 20.0.0.11:8800". + + When the Load_Balancer is added to the logical_switch, the VIP + has to be in a different subnet than the one used for the logiā€ā€ + cal_switch. Since VIP is in a different subnet, you should conā€ + nect your logical switch to either a OVN logical router or a + real router (this is because the client can now send a packet + with VIP as the destination IP address and routerā€™s mac address + as the destination MAC address). + + protocol: optional string, one of sctp, tcp, or udp + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of + vips column, OVN assumes the protocol to be tcp. + + Health Checks: + + OVN supports health checks for load balancer endpoints. When health + checks are enabled, the load balancer uses only healthy endpoints. + + Suppose that vips contains a key-value pair + 10.0.0.10:80=10.0.0.4:8080,20.0.0.4:8080. To enable health checks for + this virtualā€™s endpoints, add two key-value pairs to ip_port_mappings, + with keys 10.0.0.4 and 20.0.0.4, and add to health_check a reference to + a Load_Balancer_Health_Check row whose vip is set to 10.0.0.10. The + same approach can be used for IPv6 as well. + + health_check: set of Load_Balancer_Health_Checks + Load balancer health checks associated with this load balancer. + + ip_port_mappings: map of string-string pairs + Maps from endpoint IP to a colon-separated pair of logical port + name and source IP, e.g. port_name:sourc_ip for IPv4. Health + checks are sent to this port with the specified source IP. For + IPv6 square brackets must be used around IP address, e.g: + port_name:[sourc_ip] + + For example, in the example above, IP to port mappings might be + defined as 10.0.0.4=sw0-p1:10.0.0.2 and + 20.0.0.4=sw1-p1:20.0.0.2, if the values given were suitable + ports and IP addresses. + + For IPv6 IP to port mappings might be defined as + [2001::1]=sw0-p1:[2002::1]. + + selection_fields: set of strings, one of eth_dst, eth_src, ip_dst, + ip_src, tp_dst, or tp_src + OVN native load balancers are supported using the OpenFlow + groups of type select. OVS supports two selection methods: + dp_hash and hash (with optional fields specified) in selecting + the buckets of a group. Please see the OVS documentation (man + ovs-ofctl) for more details on the selection methods. Each endā€ + point IP (and port if set) is mapped to a bucket in the group + flow. + + CMS can choose the hash selection method by setting the selecā€ + tion fields in this column. ovs-vswitchd uses the specified + fields in generating the hash. + + dp_hash selection method uses the assistance of datapath to calā€ + culate the hash and it is expected to be faster than hash selecā€ + tion method. So CMS should take this into consideration before + using the hash method. Please consult the OVS documentation and + OVS sources for the implementation details. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + Load_Balancer options: + + options : reject: optional string, either true or false + If the load balancer is created with --reject option and it has + no active backends, a TCP reset segment (for tcp) or an ICMP + port unreachable packet (for all other kind of traffic) will be + sent whenever an incoming packet is received for this load-balā€ + ancer. Please note using --reject option will disable empty_lb + SB controller event for this load balancer. + + options : hairpin_snat_ip: optional string + IP to be used as source IP for packets that have been hair- + pinned after load balancing. The default behavior when the opā€ + tion is not set is to use the load balancer VIP as source IP. + This option may have exactly one IPv4 and/or one IPv6 address on + it, separated by a space character. + + options : skip_snat: optional string + If the load balancing rule is configured with skip_snat option, + the option lb_force_snat_ip configured for the logical router + that references this load balancer will not be applied for this + load balancer. + + options : add_route: optional string + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the VIP IP. It also will + have ARP resolution logical flows added. By setting this option, + it means there is no reason to create a Logical_Router_Staā€ā€ + tic_Route from neighbor routers to this NAT address. It also + means that no ARP request is required for neighbor routers to + learn the IP-MAC mapping for this VIP IP. For more information + about what flows are added for IP routes, please see the + ovn-northd manpage section on IP Routing. + + options : neighbor_responder: optional string + If set to all, then routers on which the load balancer is apā€ + plied reply to ARP/neighbor discovery requests for all VIPs of + the load balancer. If set to reachable, then routers on which + the load balancer is applied reply to ARP/neighbor discovery reā€ + quests only for VIPs that are part of a routerā€™s subnet. If set + to none, then routers on which the load balancer is applied + never reply to ARP/neighbor discovery requests for any of the + load balancer VIPs. Load balancers with options:template=true do + not support reachable as a valid mode. The default value of this + option, if not specified, is reachable for regular load balā€ + ancers and none for template load balancers. + + options : template: optional string + Option to be set to true, if the load balancer is a template. + The load balancer VIPs and backends must be using Chassis_Temā€ā€ + plate_Var in their definitions. + + Load balancer template VIP supported formats are: + + ^VIP_VAR[:^PORT_VAR|:port] + + + where VIP_VAR and PORT_VAR are keys of the Chassis_Template_Var + variables records. + + Note: The VIP and PORT cannot be combined into a single template + variable. For example, a Chassis_Template_Var variable expanding + to 10.0.0.1:8080 is not valid if used as VIP. + + Load balancer template backend supported formats are: + + ^BACKEND_VAR1[:^PORT_VAR1|:port],^BACKEND_VAR2[:^PORT_VAR2|:port] + or + ^BACKENDS_VAR1,^BACKENDS_VAR2 + + + where BACKEND_VAR1, PORT_VAR1, BACKEND_VAR2, PORT_VAR2, BACKā€ā€ + ENDS_VAR1 and BACKENDS_VAR2 are keys of the Chassis_Template_Var + variables records. + + options : address-family: optional string + Address family used by the load balancer. Supported values are + ipv4 and ipv6. The address-family is only used for load balā€ + ancers with options:template=true. For explicit load balancers, + setting the address-family has no effect. + + options : affinity_timeout: optional string + If the CMS provides a positive value (in seconds) for affinā€ā€ + ity_timeout, OVN will dnat connections received from the same + client to this lb to the same backend if received in the affinā€ + ity timeslot. Max supported affinity_timeout is 65535 seconds. + + options : ct_flush: optional string, either true or false + The value indicates whether ovn-controller should flush CT enā€ + tries that are related to this LB. The flush happens if the LB + is removed, any of the backends is updated/removed or the LB is + not considered local anymore by the ovn-controller. This option + is set to false by default. + +Load_Balancer_Group TABLE + Each row represents a logical grouping of load balancers. It is up to + the CMS to decide the criteria on which load balancers are grouped toā€ + gether. To simplify configuration and to optimize its processing load + balancers that must be associated to the same set of logical switches + and/or logical routers should be grouped together. + + Summary: + name string (must be unique within table) + load_balancer set of weak reference to Load_Balancers + + Details: + name: string (must be unique within table) + A name for the load balancer group. This name has no special + meaning or purpose other than to provide convenience for human + interaction with the ovn-nb database. + + load_balancer: set of weak reference to Load_Balancers + A set of load balancers. + +Load_Balancer_Health_Check TABLE + Each row represents one load balancer health check. + + Summary: + vip string + Health check options: + options : interval optional string, containing an integer + options : timeout optional string, containing an integer + options : success_count optional string, containing an integer + options : failure_count optional string, containing an integer + Common Columns: + external_ids map of string-string pairs + + Details: + vip: string + vip whose endpoints should be monitored for health check. + + Health check options: + + options : interval: optional string, containing an integer + The interval, in seconds, between health checks. + + options : timeout: optional string, containing an integer + The time, in seconds, after which a health check times out. + + options : success_count: optional string, containing an integer + The number of successful checks after which the endpoint is conā€ + sidered online. + + options : failure_count: optional string, containing an integer + The number of failure checks after which the endpoint is considā€ + ered offline. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +ACL TABLE + Each row in this table represents one ACL rule for a logical switch or + a port group that points to it through its acls column. The action colā€ + umn for the highest-priority matching row in this table determines a + packetā€™s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as + match, and deny as action.) + + Summary: + label integer, in range 0 to 4,294,967,295 + priority integer, in range 0 to 32,767 + direction string, either from-lport or to-lport + match string + action string, one of allow-related, alā€ā€ + low-stateless, allow, drop, pass, or reā€ā€ + ject + tier integer, in range 0 to 3 + options: + options : apply-after-lb optional string + Logging: + log boolean + name optional string, at most 63 characters + long + severity optional string, one of alert, debug, + info, notice, or warning + meter optional string + Common Columns: + options map of string-string pairs + ACL configuration options: + options : log-related optional string + external_ids map of string-string pairs + + Details: + label: integer, in range 0 to 4,294,967,295 + Associates an identifier with the ACL. The same value will be + written to corresponding connection tracker entry. The value + should be a valid 32-bit unsigned integer. This value can help + in debugging from connection tracker side. For example, through + this "label" we can backtrack to the ACL rule which is causing a + "leaked" connection. Connection tracker entries are created only + for allowed connections so the label is valid only for allow and + allow-related actions. + + priority: integer, in range 0 to 32,767 + The ACL ruleā€™s priority. Rules with numerically higher priority + take precedence over those with lower. If two ACL rules with the + same priority both match, then the one actually applied to a + packet is undefined. + + Return traffic from an allow-related flow is always allowed and + cannot be changed through an ACL. + + allow-stateless flows always take precedence before stateful + ACLs, regardless of their priority. (Both allow and allow-reā€ā€ + lated ACLs can be stateful.) + + direction: string, either from-lport or to-lport + Direction of the traffic to which this rule should apply: + + ā€¢ from-lport: Used to implement filters on traffic arriving + from a logical port. These rules are applied to the logiā€ + cal switchā€™s ingress pipeline. + + ā€¢ to-lport: Used to implement filters on traffic forwarded + to a logical port. These rules are applied to the logical + switchā€™s egress pipeline. + + match: string + The packets that the ACL should match, in the same expression + language used for the match column in the OVN Southbound dataā€ + baseā€™s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in + both directions). + + By default all traffic is allowed. When writing a more restricā€ + tive policy, it is important to remember to allow flows such as + ARP and IPv6 neighbor discovery packets. + + Note that you can not create an ACL matching on a port with + type=router or type=localnet. + + action: string, one of allow-related, allow-stateless, allow, drop, + pass, or reject + The action to take when the ACL rule matches: + + ā€¢ allow-stateless: Always forward the packet in stateless + manner, omitting connection tracking mechanism, regardā€ + less of other rules defined for the switch. May require + defining additional rules for inbound replies. For examā€ + ple, if you define a rule to allow outgoing TCP traffic + directed to an IP address, then you probably also want to + define another rule to allow incoming TCP traffic coming + from this same IP address. In addition, traffic that + matches stateless ACLs will bypass load-balancer DNAT/un- + DNAT processing. Stateful ACLs should be used instead if + the traffic is supposed to be load-balanced. + + ā€¢ allow: Forward the packet. It will also send the packets + through connection tracking when allow-related rules exā€ + ist on the logical switch. Otherwise, itā€™s equivalent to + allow-stateless. + + ā€¢ allow-related: Forward the packet and related traffic + (e.g. inbound replies to an outbound connection). + + ā€¢ drop: Silently drop the packet. + + ā€¢ reject: Drop the packet, replying with a RST for TCP or + ICMPv4/ICMPv6 unreachable message for other + IPv4/IPv6-based protocols. + + ā€¢ pass: Pass to the next ACL tier. If using multiple ACL + tiers, a match on this ACL will stop evaluating ACLs at + the current tier and move to the next one. If not using + ACL tiers or if a pass ACL is matched at the final tier, + then the options:default_acl_drop option from the + NB_Global table is used to determine how to proceed. + + tier: integer, in range 0 to 3 + The hierarchical tier that this ACL belongs to. + + ACLs can be assigned to numerical tiers. When evaluating ACLs, + an internal counter is used to determine which tier of ACLs + should be evaluated. Tier 0 ACLs are evaluated first. If no verā€ + dict can be determined, then tier 1 ACLs are evaluated next. + This continues until the maximum tier value is reached. If all + tiers of ACLs are evaluated and no verdict is reached, then the + options:default_acl_drop option from table NB_Global is used to + determine how to proceed. + + In this version of OVN, the maximum tier value for ACLs is 3, + meaning there are 4 tiers of ACLs allowed (0-3). + + options: + + ACLs options. + + options : apply-after-lb: optional string + If set to true, the ACL will be applied after load balancing + stage. Supported only for from-lport direction. + + The main use case of this option is to support ACLs matching on + the destination IP address of the packet for the backend IPs of + load balancers. + + OVN will apply the from-lport ACLs in two stages. ACLs without + this option apply-after-lb set, will be applied before the load + balancer stage and ACLs with this option set will be applied afā€ + ter the load balancer stage. The priorities are indepedent beā€ + tween these stages and may not be obvious to the CMS. Hence CMS + should be extra careful when using this option and should careā€ + fully evaluate the priorities of all the ACLs and the default + deny/allow ACLs if any. + + Logging: + + These columns control whether and how OVN logs packets that match an + ACL. + + log: boolean + If set to true, packets that match the ACL will trigger a log + message on the transport node or nodes that perform ACL processā€ + ing. Logging may be combined with any action. + + If set to false, the remaining columns in this group have no + significance. + + name: optional string, at most 63 characters long + This name, if it is provided, is included in log records. It + provides the administrator and the cloud management system a way + to associate a log record with a particular ACL. + + severity: optional string, one of alert, debug, info, notice, or warnā€ā€ + ing + The severity of the ACL. The severity levels match those of sysā€ + log, in decreasing level of severity: alert, warning, notice, + info, or debug. When the column is empty, the default is info. + + meter: optional string + The name of a meter to rate-limit log messages for the ACL. The + string must match the name column of a row in the Meter table. + By default, log messages are not rate-limited. In order to enā€ + sure that the same Meter rate limits multiple ACL logs sepaā€ + rately, set the fair column. + + Common Columns: + + options: map of string-string pairs + This column provides general key/value settings. The supported + options are described individually below. + + ACL configuration options: + + options : log-related: optional string + If set to true, then log when reply or related traffic is admitā€ + ted from a stateful ACL. In order for this option to function, + the log option must be set to true and a label must be set, and + it must be unique to the ACL. The label is necessary as it is + the only means to associate the reply traffic with the ACL to + which it belongs. It must be unique, because otherwise it is amā€ + biguous which ACL will be matched. Note: If this option is enā€ + abled, an extra flow is installed in order to log the related + traffic. Therefore, if this is enabled on all ACLs, then the toā€ + tal number of flows necessary to log the ACL traffic is doubled, + compared to if this option is not enabled. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Logical_Router TABLE + Each row represents one L3 logical router. + + Summary: + ports set of Logical_Router_Ports + static_routes set of Logical_Router_Static_Routes + policies set of Logical_Router_Policys + enabled optional boolean + nat set of NATs + load_balancer set of weak reference to Load_Balancers + load_balancer_group set of Load_Balancer_Groups + Naming: + name string + external_ids : neutron:router_name + optional string + copp optional weak reference to Copp + Options: + options : chassis optional string + options : dnat_force_snat_ip + optional string + options : lb_force_snat_ip optional string + options : mcast_relay optional string, either true or false + options : dynamic_neigh_routers + optional string, either true or false + options : always_learn_from_arp_request + optional string, either true or false + options : requested-tnl-key + optional string, containing an integer, + in range 1 to 16,777,215 + options : snat-ct-zone optional string, containing an integer, + in range 0 to 65,535 + options : mac_binding_age_threshold + optional string, containing an integer, + in range 0 to 4,294,967,295 + Common Columns: + external_ids map of string-string pairs + + Details: + ports: set of Logical_Router_Ports + The routerā€™s ports. + + static_routes: set of Logical_Router_Static_Routes + Zero or more static routes for the router. + + policies: set of Logical_Router_Policys + Zero or more routing policies for the router. + + enabled: optional boolean + This column is used to administratively set router state. If + this column is empty or is set to true, the router is enabled. + If this column is set to false, the router is disabled. A disā€ + abled router has all ingress and egress traffic dropped. + + nat: set of NATs + One or more NAT rules for the router. NAT rules only work on + Gateway routers, and on distributed routers with one and only + one distributed gateway port. + + load_balancer: set of weak reference to Load_Balancers + Set of load balancers associated to this logical router. Load + balancer Load balancer rules only work on the Gateway routers or + routers with one and only one distributed gateway port. + + load_balancer_group: set of Load_Balancer_Groups + Set of load balancers groups associated to this logical router. + + Naming: + + These columns provide names for the logical router. From OVNā€™s perspecā€ + tive, these names have no special meaning or purpose other than to proā€ + vide convenience for human interaction with the northbound database. + There is no requirement for the name to be unique. (For a unique idenā€ + tifier for a logical router, use its row UUID.) + + (Originally, name was intended to serve the purpose of a human-friendly + name, but the Neutron integration used it to uniquely identify its own + router object, in the format neutron-uuid. Later on, Neutron started + propagating the friendly name of a router as external_ids:neuā€ā€ + tron:router_name. Perhaps this can be cleaned up someday.) + + name: string + A name for the logical router. + + external_ids : neutron:router_name: optional string + Another name for the logical router. + + copp: optional weak reference to Copp + The control plane protection policy from table Copp used for meā€ + tering packets sent to ovn-controller from logical ports of this + router. + + Options: + + Additional options for the logical router. + + options : chassis: optional string + If set, indicates that the logical router in question is a Gateā€ + way router (which is centralized) and resides in the set chasā€ + sis. The same value is also used by ovn-controller to uniquely + identify the chassis in the OVN deployment and comes from exterā€ā€ + nal_ids:system-id in the Open_vSwitch table of Open_vSwitch + database. + + The Gateway router can only be connected to a distributed router + via a switch if SNAT and DNAT are to be configured in the Gateā€ + way router. + + options : dnat_force_snat_ip: optional string + If set, indicates a set of IP addresses to use to force SNAT a + packet that has already been DNATed in the gateway router. When + multiple gateway routers are configured, a packet can potenā€ + tially enter any of the gateway router, get DNATted and eventuā€ + ally reach the logical switch port. For the return traffic to go + back to the same gateway router (for unDNATing), the packet + needs a SNAT in the first place. This can be achieved by setting + the above option with a gateway specific set of IP addresses. + This option may have exactly one IPv4 and/or one IPv6 address on + it, separated by a a space. + + options : lb_force_snat_ip: optional string + If set, this option can take two possible type of values. Either + a set of IP addresses or the string value - router_ip. + + If a set of IP addresses are configured, it indicates to use to + force SNAT a packet that has already been load-balanced in the + gateway router. When multiple gateway routers are configured, a + packet can potentially enter any of the gateway routers, get + DNATted as part of the load-balancing and eventually reach the + logical switch port. For the return traffic to go back to the + same gateway router (for unDNATing), the packet needs a SNAT in + the first place. This can be achieved by setting the above opā€ + tion with a gateway specific set of IP addresses. This option + may have exactly one IPv4 and/or one IPv6 address on it, sepaā€ + rated by a space character. + + If it is configured with the value router_ip, then the load balā€ + anced packet is SNATed with the IP of router port (attached to + the gateway router) selected as the destination after taking the + routing decision. + + options : mcast_relay: optional string, either true or false + Enables/disables IP multicast relay between logical switches + connected to the logical router. Default: False. + + options : dynamic_neigh_routers: optional string, either true or false + If set to true, the router will resolve neighbor routersā€™ MAC + addresses only by dynamic ARP/ND, instead of prepopulating staā€ + tic mappings for all neighbor routers in the ARP/ND Resolution + stage. This reduces number of flows, but requires ARP/ND mesā€ + sages to resolve the IP-MAC bindings when needed. It is false by + default. It is recommended to set to true when a large number of + logical routers are connected to the same logical switch but + most of them never need to send traffic between each other. By + default, ovn-northd does not create mappings to NAT and load + balancer addresess. However, for NAT and load balancer addresses + that have the add_route option added, ovn-northd will create + logical flows that map NAT and load balancer IP addresses to the + appropriate MAC address. Setting dynamic_neigh_routers to true + will prevent the automatic creation of these logical flows. + + options : always_learn_from_arp_request: optional string, either true + or false + This option controls the behavior when handling IPv4 ARP reā€ + quests or IPv6 ND-NS packets - whether a dynamic neighbor (MAC + binding) entry is added/updated. + + true - Always learn the MAC-IP binding, and add/update the MAC + binding entry. + + false - If there is a MAC binding for that IP and the MAC is + different, or, if TPA of ARP request belongs to any router port + on this router, then update/add that MAC-IP binding. Otherwise, + donā€™t update/add entries. + + It is true by default. It is recommended to set to false when a + large number of logical routers are connected to the same logiā€ + cal switch but most of them never need to send traffic between + each other, to reduce the size of the MAC binding table. + + options : requested-tnl-key: optional string, containing an integer, in + range 1 to 16,777,215 + Configures the datapath tunnel key for the logical router. This + is not needed because ovn-northd will assign an unique key for + each datapath by itself. However, if it is configured, + ovn-northd honors the configured value. + + options : snat-ct-zone: optional string, containing an integer, in + range 0 to 65,535 + Use the requested conntrack zone for SNAT with this router. This + can be useful if egress traffic from the host running OVN comes + from both OVN and other sources. This way, OVN and the other + sources can make use of the same conntrack zone. + + options : mac_binding_age_threshold: optional string, containing an inā€ + teger, in range 0 to 4,294,967,295 + MAC binding aging threshold value in seconds. MAC binding exā€ + ceeding this timeout will be automatically removed. The value + defaults to 0, which means disabled. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +QoS TABLE + Each row in this table represents one QoS rule for a logical switch + that points to it through its qos_rules column. Two types of QoS are + supported: DSCP marking and metering. A match with the highest-priority + will have QoS applied to it. If the action column is specified, then + matching packets will have DSCP marking applied. If the bandwidth colā€ + umn is specified, then matching packets will have metering applied. acā€ā€ + tion and bandwidth are not exclusive, so both marking and metering by + defined for the same QoS entry. If no row matches, packets will not + have any QoS applied. + + Summary: + priority integer, in range 0 to 32,767 + direction string, either from-lport or to-lport + match string + action map of string-integer pairs, key must be + dscp, value in range 0 to 63 + bandwidth map of string-integer pairs, key either + burst or rate, value in range 1 to + 4,294,967,295 + external_ids map of string-string pairs + + Details: + priority: integer, in range 0 to 32,767 + The QoS ruleā€™s priority. Rules with numerically higher priority + take precedence over those with lower. If two QoS rules with the + same priority both match, then the one actually applied to a + packet is undefined. + + direction: string, either from-lport or to-lport + The value of this field is similar to ACL column in the OVN + Northbound databaseā€™s ACL table. + + match: string + The packets that the QoS rules should match, in the same expresā€ + sion language used for the match column in the OVN Southbound + databaseā€™s Logical_Flow table. The outport logical port is only + available in the to-lport direction (the inport is available in + both directions). + + action: map of string-integer pairs, key must be dscp, value in range 0 + to 63 + When specified, matching flows will have DSCP marking applied. + + ā€¢ dscp: The value of this action should be in the range of + 0 to 63 (inclusive). + + bandwidth: map of string-integer pairs, key either burst or rate, value + in range 1 to 4,294,967,295 + When specified, matching packets will have bandwidth metering + applied. Traffic over the limit will be dropped. + + ā€¢ rate: The value of rate limit in kbps. + + ā€¢ burst: The value of burst rate limit in kilobits. This is + optional and needs to specify the rate. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Mirror TABLE + Each row in this table represents a mirror that can be used for port + mirroring. These mirrors are referenced by the mirror_rules column in + the Logical_Switch_Port table. + + Summary: + name string (must be unique within table) + filter string, one of both, from-lport, or + to-lport + sink string + type string, one of erspan, gre, or local + index integer + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Represents the name of the mirror. + + filter: string, one of both, from-lport, or to-lport + The value of this field represents selection criteria of the + mirror. to-lport mirrors the packets coming into logical port. + from-lport mirrors the packets going out of logical port. both + mirrors for both directions. + + sink: string + The value of this field represents the destination/sink of the + mirror. If the type is gre or erspan, the value indicates the + tunnel remote IP (either IPv4 or IPv6). For a type of local, + this field defines a local interface on the OVS integration + bridge to be used as the mirror destination. The interface must + possess external-ids:mirror-id that matches this string. + + type: string, one of erspan, gre, or local + The value of this field specifies the mirror type - gre, erspan + or local. + + index: integer + The value of this field represents the tunnel ID. If the configā€ + ured tunnel type is gre, this field represents the GRE key value + and if the configured tunnel type is erspan it represents the + erspan_idx value. It is ignored if the type is local. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Meter TABLE + Each row in this table represents a meter that can be used for QoS or + rate-limiting. + + Summary: + name string (must be unique within table) + unit string, either kbps or pktps + bands set of 1 or more Meter_Bands + fair optional boolean + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + A name for this meter. + + Names that begin with "__" (two underscores) are reserved for + OVN internal use and should not be added manually. + + unit: string, either kbps or pktps + The unit for rate and burst_rate parameters in the bands entry. + kbps specifies kilobits per second, and pktps specifies packets + per second. + + bands: set of 1 or more Meter_Bands + The bands associated with this meter. Each band specifies a rate + above which the band is to take the action action. If multiple + bandsā€™ rates are exceeded, then the band with the highest rate + among the exceeded bands is selected. + + fair: optional boolean + This column is used to further describe the desired behavior of + the meter when there are multiple references to it. If this colā€ + umn is empty or is set to false, the rate will be shared across + all rows that refer to the same Meter name. Conversely, when + this column is set to true, each user of the same Meter will be + rate-limited on its own. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Meter_Band TABLE + Each row in this table represents a meter band which specifies the rate + above which the configured action should be applied. These bands are + referenced by the bands column in the Meter table. + + Summary: + action string, must be drop + rate integer, in range 1 to 4,294,967,295 + burst_size integer, in range 0 to 4,294,967,295 + external_ids map of string-string pairs + + Details: + action: string, must be drop + The action to execute when this band matches. The only supported + action is drop. + + rate: integer, in range 1 to 4,294,967,295 + The rate limit for this band, in kilobits per second or bits per + second, depending on whether the parent Meter entryā€™s unit colā€ + umn specified kbps or pktps. + + burst_size: integer, in range 0 to 4,294,967,295 + The maximum burst allowed for the band in kilobits or packets, + depending on whether kbps or pktps was selected in the parent + Meter entryā€™s unit column. If the size is zero, the switch is + free to select some reasonable value depending on its configuraā€ + tion. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Logical_Router_Port TABLE + A port within an L3 logical router. + + Exactly one Logical_Router row must reference a given logical router + port. + + Summary: + name string (must be unique within table) + networks set of 1 or more strings + mac string + enabled optional boolean + Distributed Gateway Ports: + ha_chassis_group optional HA_Chassis_Group + gateway_chassis set of Gateway_Chassises + Options for Physical VLAN MTU Issues: + options : reside-on-redirect-chassis + optional string, either true or false + options : redirect-type optional string, either bridged or overā€ā€ + lay + ipv6_prefix set of strings + ipv6_ra_configs: + ipv6_ra_configs : address_mode + optional string + ipv6_ra_configs : router_preference + optional string + ipv6_ra_configs : route_info + optional string + ipv6_ra_configs : mtu optional string + ipv6_ra_configs : send_periodic + optional string + ipv6_ra_configs : max_interval + optional string + ipv6_ra_configs : min_interval + optional string + ipv6_ra_configs : rdnss optional string + ipv6_ra_configs : dnssl optional string + Options: + options : mcast_flood optional string, either true or false + options : requested-tnl-key + optional string, containing an integer, + in range 1 to 32,767 + options : prefix_delegation + optional string, either true or false + options : prefix optional string, either true or false + options : route_table optional string + options : gateway_mtu optional string, containing an integer, + in range 68 to 65,535 + options : gateway_mtu_bypass + optional string + Attachment: + peer optional string + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + A name for the logical router port. + + In addition to provide convenience for human interaction with + the northbound database, this column is used as reference by its + patch port in Logical_Switch_Port or another logical router port + in Logical_Router_Port. + + A logical router port may not have the same name as a logical + switch port, but the database schema cannot enforce this. + + networks: set of 1 or more strings + The IP addresses and netmasks of the router. For example, + 192.168.0.1/24 indicates that the routerā€™s IP address is + 192.168.0.1 and that packets destined to 192.168.0.x should be + routed to this port. + + A logical router port always adds a link-local IPv6 address + (fe80::/64) automatically generated from the interfaceā€™s MAC adā€ + dress using the modified EUI-64 format. + + mac: string + The Ethernet address that belongs to this router port. + + enabled: optional boolean + This column is used to administratively set port state. If this + column is empty or is set to true, the port is enabled. If this + column is set to false, the port is disabled. A disabled port + has all ingress and egress traffic dropped. + + Distributed Gateway Ports: + + Gateways, as documented under Gateways in the OVN architecture guide, + provide limited connectivity between logical networks and physical + ones. OVN support multiple kinds of gateways. The Logical_Router_Port + table can be used two different ways to configure distributed gateway + ports, which are one kind of gateway. These two forms of configuration + exist for historical reasons. Both of them produce the same kind of OVN + southbound records and the same behavior in practice. + + If either of these are set, this logical router port represents a disā€ + tributed gateway port that connects this router to a logical switch + with a localnet port or a connection to another OVN deployment. + + Also mentioned in the OVN architecture guide, distributed gateway ports + can also be used for scalability reasons in deployments where logical + switches are dedicated to chassises rather than distributed. + + The preferred way to configure a gateway is ha_chassis_group, but gateā€ā€ + way_chassis is also supported for backward compatibility. Only one of + these should be set at a time on a given LRP, since they configure the + same features. + + Even when a gateway is configured, the logical router port still effecā€ + tively resides on each chassis. However, due to the implications of the + use of L2 learning in the physical network, as well as the need to supā€ + port advanced features such as one-to-many NAT (aka IP masquerading), a + subset of the logical router processing is handled in a centralized + manner on the gateway chassis. + + There can be more than one distributed gateway ports configured on each + logical router, each connecting to different L2 segments. Load-balancā€ + ing is not yet supported on logical routers with more than one distribā€ + uted gateway ports. + + For each distributed gateway port, it may have more than one gateway + chassises. When more than one gateway chassis is specified, OVN only + uses one at a time. OVN can rely on OVS BFD implementation to monitor + gateway connectivity, preferring the highest-priority gateway that is + online. Priorities are specified in the priority column of Gateā€ā€ + way_Chassis or HA_Chassis. + + ovn-northd programs the external_mac rules specified in the LRPā€™s LR + into the peer logical switchā€™s destination lookup on the chassis where + the logical_port resides. In addition, the logical routerā€™s MAC address + is automatically programmed in the peer logical switchā€™s destination + lookup flow on the gateway chasssis. If it is desired to generate graā€ + tuitous ARPs for NAT addresses, then set the peer LSPā€™s options:nat-adā€ā€ + dresses to router. + + OVN 20.03 and earlier supported a third way to configure distributed + gateway ports using options:redirect-chassis to specify the gateway + chassis. This method is no longer supported. Any remaining users should + switch to one of the newer methods instead. A gateway_chassis may be + easily configured from the command line, e.g. ovn-nbctl lrp-set-gateā€ā€ + way-chassis lrp chassis. + + ha_chassis_group: optional HA_Chassis_Group + Designates an HA_Chassis_Group to provide gateway high availā€ + ability. + + gateway_chassis: set of Gateway_Chassises + Designates one or more Gateway_Chassis for the logical router + port. + + Options for Physical VLAN MTU Issues: + + MTU issues arise in mixing tunnels with logical networks that are + bridged to a physical VLAN. For an explanation of the MTU issues, see + Physical VLAN MTU Issues in the OVN architecture document. The followā€ + ing options, which are alternatives, provide solutions. Both of them + cause packets to be sent over localnet instead of tunnels, but they + differ in whether some or all packets are sent this way. The most + prominent tradeoff between these options is that reside-on-rediā€ā€ + rect-chassis is easier to configure and that redirect-type performs + better for east-west traffic. + + options : reside-on-redirect-chassis: optional string, either true or + false + If set to true, this option forces all traffic across the logiā€ + cal router port to pass through the gateway chassis using a hop + across a localnet port. This changes behavior in two ways: + + ā€¢ Without this option, east-west traffic passes directly + between source and destination chassis (or even within a + single chassis, for co-located VMs). With this option, + all east-west traffic passes through the gateway chassis. + + ā€¢ Without this option, traffic between the gateway chassis + and other chassis is encapsulated in tunnels. With this + option, traffic passes over a localnet interface. + + This option may usefully be set only on logical router ports + that connect a distributed logical router to a logical switch + with VIFs. It should not be set on a distributed gateway port. + + OVN honors this option only if the logical router has one and + only one distributed gateway port and if the LRPā€™s peer switch + has a localnet port. + + options : redirect-type: optional string, either bridged or overlay + If set to bridged on a distributed gateway port, this option + causes OVN to redirect packets to the gateway chassis over a loā€ā€ + calnet port instead of a tunnel. The relevant chassis must share + a localnet port. + + This feature requires the administrator or the CMS to configure + each participating chassis with a unique Ethernet address for + the logical router by setting ovn-chassis-mac-mappings in the + Open vSwitch database, for use by ovn-controller. + + Setting this option to overlay or leaving it unset has no efā€ + fect. This option may usefully be set only on a distributed + gateway port when there is one and only one distributed gateway + port on the logical router. It is otherwise ignored. + + ipv6_prefix: set of strings + This column contains IPv6 prefix obtained by prefix delegation + router according to RFC 3633 + + ipv6_ra_configs: + + This column defines the IPv6 ND RA address mode and ND MTU Option to be + included by ovn-controller when it replies to the IPv6 Router solicitaā€ + tion requests. + + ipv6_ra_configs : address_mode: optional string + The address mode to be used for IPv6 address configuration. The + supported values are: + + ā€¢ slaac: Address configuration using Router Advertisement + (RA) packet. The IPv6 prefixes defined in the Logiā€ā€ + cal_Router_Port tableā€™s networks column will be included + in the RAā€™s ICMPv6 option - Prefix information. + + ā€¢ dhcpv6_stateful: Address configuration using DHCPv6. + + ā€¢ dhcpv6_stateless: Address configuration using Router Adā€ + vertisement (RA) packet. Other IPv6 options are provided + by DHCPv6. + + ipv6_ra_configs : router_preference: optional string + Default Router Preference (PRF) indicates whether to prefer this + router over other default routers (RFC 4191). Possible values + are: + + ā€¢ HIGH: mapped to 0x01 in RA PRF field + + ā€¢ MEDIUM: mapped to 0x00 in RA PRF field + + ā€¢ LOW: mapped to 0x11 in RA PRF field + + ipv6_ra_configs : route_info: optional string + Route Info is used to configure Route Info Option sent in Router + Advertisement according to RFC 4191. Route Info is a comma sepaā€ + rated string where each field provides PRF and prefix for a + given route (e.g: HIGH-aef1::11/48,LOW-aef2::11/96) Possible PRF + values are: + + ā€¢ HIGH: mapped to 0x01 in RA PRF field + + ā€¢ MEDIUM: mapped to 0x00 in RA PRF field + + ā€¢ LOW: mapped to 0x11 in RA PRF field + + ipv6_ra_configs : mtu: optional string + The recommended MTU for the link. Default is 0, which means no + MTU Option will be included in RA packet replied by ovn-conā€ + troller. Per RFC 2460, the mtu value is recommended no less than + 1280, so any mtu value less than 1280 will be considered as no + MTU Option. + + ipv6_ra_configs : send_periodic: optional string + If set to true, then this router interface will send router adā€ + vertisements periodically. The default is false. + + ipv6_ra_configs : max_interval: optional string + The maximum number of seconds to wait between sending periodic + router advertisements. This option has no effect if ipv6_ra_conā€ā€ + figs:send_periodic is false. The default is 600. + + ipv6_ra_configs : min_interval: optional string + The minimum number of seconds to wait between sending periodic + router advertisements. This option has no effect if ipv6_ra_conā€ā€ + figs:send_periodic is false. The default is one-third of + ipv6_ra_configs:max_interval, i.e. 200 seconds if that key is + unset. + + ipv6_ra_configs : rdnss: optional string + IPv6 address of RDNSS server announced in RA packets. At the moā€ + ment OVN supports just one RDNSS server. + + ipv6_ra_configs : dnssl: optional string + DNS Search List announced in RA packets. Multiple DNS Search + List must be ā€™commaā€™ separated (e.g. "a.b.c, d.e.f") + + Options: + + Additional options for the logical router port. + + options : mcast_flood: optional string, either true or false + If set to true, multicast traffic (including reports) are unconā€ + ditionally forwarded to the specific port. + + This option applies when the port is part of a logical router + which has options:mcast_relay set to true. + + Default: false. + + options : requested-tnl-key: optional string, containing an integer, in + range 1 to 32,767 + Configures the port binding tunnel key for the port. Usually + this is not needed because ovn-northd will assign an unique key + for each port by itself. However, if it is configured, + ovn-northd honors the configured value. + + options : prefix_delegation: optional string, either true or false + If set to true, enable IPv6 prefix delegation state machine on + this logical router port (RFC3633). IPv6 prefix delegation is + available just on a gateway router or on a gateway router port. + + options : prefix: optional string, either true or false + If set to true, this interface will receive an IPv6 prefix acā€ + cording to RFC3663 + + options : route_table: optional string + Designates lookup Logical_Router_Static_Routes with specified + route_table value. Routes to directly connected networks from + same Logical Router and routes without route_table option set + have higher priority than routes with route_table option set. + + options : gateway_mtu: optional string, containing an integer, in range + 68 to 65,535 + If set, logical flows will be added to router pipeline to check + packet length. If packet length is greater than the value set, + ICMPv4 type 3 (Destination Unreachable) code 4 (Fragmentation + Needed and Donā€™t Fragment was Set) or ICMPv6 type 2 (Packet Too + Big) code 0 (no route to destination) packets will be generated. + This allows for Path MTU Discovery. + + options : gateway_mtu_bypass: optional string + When configured, represents a match expression, in the same exā€ + pression language used for the match column in the OVN Southā€ + bound databaseā€™s Logical_Flow table. Packets matching this exā€ + pression will bypass the length check configured through the opā€ā€ + tions:gateway_mtu option. + + Attachment: + + A given router port serves one of two purposes: + + ā€¢ To attach a logical switch to a logical router. A logical + router port of this type is referenced by exactly one + Logical_Switch_Port of type router. The value of name is + set as router-port in column options of Logiā€ā€ + cal_Switch_Port. In this case peer column is empty. + + ā€¢ To connect one logical router to another. This requires a + pair of logical router ports, each connected to a differā€ + ent router. Each router port in the pair specifies the + other in its peer column. No Logical_Switch refers to the + router port. + + peer: optional string + For a router port used to connect two logical routers, this + identifies the other router port in the pair by name. + + For a router port attached to a logical switch, this column is + empty. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + The ovn-northd program copies all these pairs into the exterā€ā€ + nal_ids column of the Port_Binding table in OVN_Southbound dataā€ + base. + +Logical_Router_Static_Route TABLE + Each record represents a static route. + + When multiple routes match a packet, the longest-prefix match is choā€ + sen. For a given prefix length, a dst-ip route is preferred over a + src-ip route. + + When there are ECMP routes, i.e. multiple routes with same prefix and + policy, one of them will be selected based on the 5-tuple hashing of + the packet header. + + Summary: + ip_prefix string + policy optional string, either dst-ip or src-ip + nexthop string + output_port optional string + bfd optional weak reference to BFD + route_table string + external_ids : ic-learned-route + optional string + Common Columns: + external_ids map of string-string pairs + Common options: + options map of string-string pairs + options : ecmp_symmetric_reply + optional string + options : origin optional string + + Details: + ip_prefix: string + IP prefix of this route (e.g. 192.168.100.0/24). + + policy: optional string, either dst-ip or src-ip + If it is specified, this setting describes the policy used to + make routing decisions. This setting must be one of the followā€ + ing strings: + + ā€¢ src-ip: This policy sends the packet to the nexthop when + the packetā€™s source IP address matches ip_prefix. + + ā€¢ dst-ip: This policy sends the packet to the nexthop when + the packetā€™s destination IP address matches ip_prefix. + + If not specified, the default is dst-ip. + + nexthop: string + Nexthop IP address for this route. Nexthop IP address should be + the IP address of a connected router port or the IP address of a + logical port or can be set to discard for dropping packets which + match the given route. + + output_port: optional string + The name of the Logical_Router_Port via which the packet needs + to be sent out. This is optional and when not specified, OVN + will automatically figure this out based on the nexthop. When + this is specified and there are multiple IP addresses on the + router port and none of them are in the same subnet of nexthop, + OVN chooses the first IP address as the one via which the nexā€ā€ + thop is reachable. + + bfd: optional weak reference to BFD + Reference to BFD row if the route has associated a BFD session + + route_table: string + Any string to place route to separate routing table. If Logical + Router Port has configured value in options:route_table other + than empty string, OVN performs route lookup for all packets enā€ + tering Logical Router ingress pipeline from this port in the + following manner: + + ā€¢ 1. First lookup among "global" routes: routes without + route_table value set and routes to directly connected + networks. + + ā€¢ 2. Next lookup among routes with same route_table value + as specified in LRPā€™s options:route_table field. + + external_ids : ic-learned-route: optional string + ovn-ic populates this key if the route is learned from the + global OVN_IC_Southbound database. In this case the value will + be set to the uuid of the row in Route table of the + OVN_IC_Southbound database. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + Common options: + + options: map of string-string pairs + This column provides general key/value settings. The supported + options are described individually below. + + options : ecmp_symmetric_reply: optional string + If true, then new traffic that arrives over this route will have + its reply traffic bypass ECMP route selection and will be sent + out this route instead. Note that this option overrides any + rules set in the Logical_Router_policy table. This option only + works on gateway routers (routers that have options:chassis + set). + + options : origin: optional string + In case ovn-interconnection has been learned this route, it will + have its origin set: either "connected" or "static". This key is + supposed to be written only by ovn-ic daemon. ovn-northd then + checks this value when generating Logical Flows. Logiā€ā€ + cal_Router_Static_Route records with same ip_prefix within same + Logical Router will have next lookup order based on origin key + value: + + 1. connected + + 2. static +Logical_Router_Policy TABLE + Each row in this table represents one routing policy for a logical + router that points to it through its policies column. The action column + for the highest-priority matching row in this table determines a + packetā€™s treatment. If no row matches, packets are allowed by default. + (Default-deny treatment is possible: add a rule with priority 0, 1 as + match, and drop as action.) + + Summary: + priority integer, in range 0 to 32,767 + match string + action string, one of allow, drop, or reroute + nexthop optional string + nexthops set of strings + options : pkt_mark optional string + Common Columns: + external_ids map of string-string pairs + + Details: + priority: integer, in range 0 to 32,767 + The routing policyā€™s priority. Rules with numerically higher + priority take precedence over those with lower. A rule is + uniquely identified by the priority and match string. + + match: string + The packets that the routing policy should match, in the same + expression language used for the match column in the OVN Southā€ + bound databaseā€™s Logical_Flow table. + + By default all traffic is allowed. When writing a more restricā€ + tive policy, it is important to remember to allow flows such as + ARP and IPv6 neighbor discovery packets. + + action: string, one of allow, drop, or reroute + The action to take when the routing policy matches: + + ā€¢ allow: Forward the packet. + + ā€¢ drop: Silently drop the packet. + + ā€¢ reroute: Reroute packet to nexthop or nexthops. + + nexthop: optional string + Note: This column is deprecated in favor of nexthops. + + Next-hop IP address for this route, which should be the IP adā€ + dress of a connected router port or the IP address of a logical + port. + + nexthops: set of strings + Next-hop ECMP IP addresses for this route. Each IP in the list + should be the IP address of a connected router port or the IP + address of a logical port. + + One IP from the list is selected as next hop. + + options : pkt_mark: optional string + Marks the packet with the value specified when the router policy + is applied. CMS can inspect this packet marker and take some deā€ + cisions if desired. This value is not preserved when the packet + goes out on the wire. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +NAT TABLE + Each record represents a NAT rule. + + Summary: + type string, one of dnat, dnat_and_snat, or + snat + external_ip string + external_mac optional string + external_port_range string + logical_ip string + logical_port optional string + allowed_ext_ips optional Address_Set + exempted_ext_ips optional Address_Set + gateway_port optional weak reference to Logiā€ā€ + cal_Router_Port + options : stateless optional string + options : add_route optional string + Common Columns: + external_ids map of string-string pairs + + Details: + type: string, one of dnat, dnat_and_snat, or snat + Type of the NAT rule. + + ā€¢ When type is dnat, the externally visible IP address exā€ā€ + ternal_ip is DNATted to the IP address logical_ip in the + logical space. + + ā€¢ When type is snat, IP packets with their source IP adā€ + dress that either matches the IP address in logical_ip or + is in the network provided by logical_ip is SNATed into + the IP address in external_ip. + + ā€¢ When type is dnat_and_snat, the externally visible IP adā€ + dress external_ip is DNATted to the IP address logical_ip + in the logical space. In addition, IP packets with the + source IP address that matches logical_ip is SNATed into + the IP address in external_ip. + + external_ip: string + An IPv4 address. + + external_mac: optional string + A MAC address. + + This is only used on the gateway port on distributed routers. + This must be specified in order for the NAT rule to be processed + in a distributed manner on all chassis. If this is not specified + for a NAT rule on a distributed router, then this NAT rule will + be processed in a centralized manner on the gateway port inā€ + stance on the gateway chassis. + + This MAC address must be unique on the logical switch that the + gateway port is attached to. If the MAC address used on the logā€ā€ + ical_port is globally unique, then that MAC address can be specā€ + ified as this external_mac. + + external_port_range: string + L4 source port range + + Range of ports, from which a port number will be picked that + will replace the source port of to be NATed packet. This is baā€ + sically PAT (port address translation). + + Value of the column is in the format, port_lo-port_hi. For examā€ + ple: external_port_range : "1-30000" + + Valid range of ports is 1-65535. + + logical_ip: string + An IPv4 network (e.g 192.168.1.0/24) or an IPv4 address. + + logical_port: optional string + The name of the logical port where the logical_ip resides. + + This is only used on distributed routers. This must be specified + in order for the NAT rule to be processed in a distributed manā€ + ner on all chassis. If this is not specified for a NAT rule on a + distributed router, then this NAT rule will be processed in a + centralized manner on the gateway port instance on the gateway + chassis. + + allowed_ext_ips: optional Address_Set + It represents Address Set of external ips that NAT rule is apā€ + plicable to. For SNAT type NAT rules, this refers to destination + addresses. For DNAT type NAT rules, this refers to source adā€ + dresses. + + This configuration overrides the default NAT behavior of applyā€ + ing a rule solely based on internal IP. Without this configuraā€ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is applied ONLY if external ip is in the input Address + Set. + + exempted_ext_ips: optional Address_Set + It represents Address Set of external ips that NAT rule is NOT + applicable to. For SNAT type NAT rules, this refers to destinaā€ + tion addresses. For DNAT type NAT rules, this refers to source + addresses. + + This configuration overrides the default NAT behavior of applyā€ + ing a rule solely based on internal IP. Without this configuraā€ + tion, NAT happens without considering the external IP (i.e + dest/source for snat/dnat type rule). With this configuration + NAT rule is NOT applied if external ip is in the input Address + Set. + + If there are NAT rules in a logical router with overlapping IP + prefixes (including /32), then usage of exempted_ext_ips should + be avoided in following scenario. a. SNAT rule (let us say + RULE1) with logical_ip PREFIX/MASK (let us say 50.0.0.0/24). b. + SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1 (let + us say 50.0.0.0/25). c. Now, if exempted_ext_ips is associated + with RULE2, then a logical ip which matches both 50.0.0.0/24 and + 50.0.0.0/25 may get the RULE2 applied to it instead of RULE1. + + allowed_ext_ips and exempted_ext_ips are mutually exclusive to + each other. If both Address Sets are set for a rule, then the + NAT rule is not considered. + + gateway_port: optional weak reference to Logical_Router_Port + A distributed gateway port in the Logical_Router_Port table + where the NAT rule needs to be applied. + + When multiple distributed gateway ports are configured on a Logā€ā€ + ical_Router, applying a NAT rule at each of the distributed + gateway ports might not be desired. Consider the case where a + logical router has 2 distributed gateway port, one with networks + 50.0.0.10/24 and the other with networks 60.0.0.10/24. If the + logical router has a NAT rule of type snat, logical_ip + 10.1.1.0/24 and external_ip 50.1.1.20/24, the rule needs to be + selectively applied on matching packets entering/leaving through + the distributed gateway port with networks 50.0.0.10/24. + + When a logical router has multiple distributed gateway ports and + this column is not set for a NAT rule, then the rule will be apā€ + plied at the distributed gateway port which is in the same netā€ + work as the external_ip of the NAT rule, if such a router port + exists. If logical router has a single distributed gateway port + and this column is not set for a NAT rule, the rule will be apā€ + plied at the distributed gateway port even if the router port is + not in the same network as the external_ip of the NAT rule. + + options : stateless: optional string + Indicates if a dnat_and_snat rule should lead to connection + tracking state or not. + + options : add_route: optional string + If set to true, then neighbor routers will have logical flows + added that will allow for routing to the NAT address. It also + will have ARP resolution logical flows added. By setting this + option, it means there is no reason to create a Logiā€ā€ + cal_Router_Static_Route from neighbor routers to this NAT adā€ + dress. It also means that no ARP request is required for neighā€ + bor routers to learn the IP-MAC mapping for this NAT address. + This option only applies to NATs of type dnat and dnat_and_snat. + For more information about what flows are added for IP routes, + please see the ovn-northd manpage section on IP Routing. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +DHCP_Options TABLE + OVN implements native DHCPv4 support which caters to the common use + case of providing an IPv4 address to a booting instance by providing + stateless replies to DHCPv4 requests based on statically configured adā€ + dress mappings. To do this it allows a short list of DHCPv4 options to + be configured and applied at each compute host running ovn-controller. + + OVN also implements native DHCPv6 support which provides stateless + replies to DHCPv6 requests. + + Summary: + cidr string + DHCPv4 options: + Mandatory DHCPv4 options: + options : server_id optional string + options : server_mac optional string + options : lease_time optional string, containing an integer, + in range 0 to 4,294,967,295 + IPv4 DHCP Options: + options : router optional string + options : netmask optional string + options : dns_server optional string + options : log_server optional string + options : lpr_server optional string + options : swap_server optional string + options : policy_filter optional string + options : router_solicitation + optional string + options : nis_server optional string + options : ntp_server optional string + options : netbios_name_server + optional string + options : classless_static_route + optional string + options : ms_classless_static_route + optional string + options : next_server optional string + Boolean DHCP Options: + options : ip_forward_enable + optional string, either 0 or 1 + options : router_discovery + optional string, either 0 or 1 + options : ethernet_encap optional string, either 0 or 1 + Integer DHCP Options: + options : default_ttl optional string, containing an integer, + in range 0 to 255 + options : tcp_ttl optional string, containing an integer, + in range 0 to 255 + options : mtu optional string, containing an integer, + in range 68 to 65,535 + options : T1 optional string, containing an integer, + in range 68 to 4,294,967,295 + options : T2 optional string, containing an integer, + in range 68 to 4,294,967,295 + options : arp_cache_timeout + optional string, containing an integer, + in range 0 to 255 + options : tcp_keepalive_interval + optional string, containing an integer, + in range 0 to 255 + options : netbios_node_type + optional string, containing an integer, + in range 0 to 255 + String DHCP Options: + options : wpad optional string + options : bootfile_name optional string + options : path_prefix optional string + options : tftp_server_address + optional string + options : hostname optional string + options : domain_name optional string + options : bootfile_name_alt + optional string + options : broadcast_address + optional string + DHCP Options of type host_id: + options : tftp_server optional string + DHCP Options of type domains: + options : domain_search_list + optional string + DHCPv6 options: + Mandatory DHCPv6 options: + options : server_id optional string + IPv6 DHCPv6 options: + options : dns_server optional string + String DHCPv6 options: + options : domain_search optional string + options : dhcpv6_stateless + optional string + Common Columns: + external_ids map of string-string pairs + + Details: + cidr: string + The DHCPv4/DHCPv6 options will be included if the logical port + has its IP address in this cidr. + + DHCPv4 options: + + The CMS should define the set of DHCPv4 options as key/value pairs in + the options column of this table. For ovn-controller to include these + DHCPv4 options, the dhcpv4_options of Logical_Switch_Port should refer + to an entry in this table. + + Mandatory DHCPv4 options: + + The following options must be defined. + + options : server_id: optional string + The IP address for the DHCP server to use. This should be in the + subnet of the offered IP. This is also included in the DHCP ofā€ + fer as option 54, ``server identifier.ā€™ā€™ + + options : server_mac: optional string + The Ethernet address for the DHCP server to use. + + options : lease_time: optional string, containing an integer, in range + 0 to 4,294,967,295 + The offered lease time in seconds, + + The DHCPv4 option code for this option is 51. + + IPv4 DHCP Options: + + Below are the supported DHCPv4 options whose values are an IPv4 adā€ + dress, e.g. 192.168.1.1. Some options accept multiple IPv4 addresses + enclosed within curly braces, e.g. {192.168.1.2, 192.168.1.3}. Please + refer to RFC 2132 for more details on DHCPv4 options and their codes. + + options : router: optional string + The IP address of a gateway for the client to use. This should + be in the subnet of the offered IP. The DHCPv4 option code for + this option is 3. + + options : netmask: optional string + The DHCPv4 option code for this option is 1. + + options : dns_server: optional string + The DHCPv4 option code for this option is 6. + + options : log_server: optional string + The DHCPv4 option code for this option is 7. + + options : lpr_server: optional string + The DHCPv4 option code for this option is 9. + + options : swap_server: optional string + The DHCPv4 option code for this option is 16. + + options : policy_filter: optional string + The DHCPv4 option code for this option is 21. + + options : router_solicitation: optional string + The DHCPv4 option code for this option is 32. + + options : nis_server: optional string + The DHCPv4 option code for this option is 41. + + options : ntp_server: optional string + The DHCPv4 option code for this option is 42. + + options : netbios_name_server: optional string + The DHCPv4 option code for this option is 44. + + options : classless_static_route: optional string + The DHCPv4 option code for this option is 121. + + This option can contain one or more static routes, each of which + consists of a destination descriptor and the IP address of the + router that should be used to reach that destination. Please see + RFC 3442 for more details. + + Example: {30.0.0.0/24,10.0.0.10, 0.0.0.0/0,10.0.0.1} + + options : ms_classless_static_route: optional string + The DHCPv4 option code for this option is 249. This option is + similar to classless_static_route supported by Microsoft Windows + DHCPv4 clients. + + options : next_server: optional string + The DHCPv4 option code for setting the "Next server IP address" + field in the DHCP header. + + Boolean DHCP Options: + + These options accept a Boolean value, expressed as 0 for false or 1 for + true. + + options : ip_forward_enable: optional string, either 0 or 1 + The DHCPv4 option code for this option is 19. + + options : router_discovery: optional string, either 0 or 1 + The DHCPv4 option code for this option is 31. + + options : ethernet_encap: optional string, either 0 or 1 + The DHCPv4 option code for this option is 36. + + Integer DHCP Options: + + These options accept a nonnegative integer value. + + options : default_ttl: optional string, containing an integer, in range + 0 to 255 + The DHCPv4 option code for this option is 23. + + options : tcp_ttl: optional string, containing an integer, in range 0 + to 255 + The DHCPv4 option code for this option is 37. + + options : mtu: optional string, containing an integer, in range 68 to + 65,535 + The DHCPv4 option code for this option is 26. + + options : T1: optional string, containing an integer, in range 68 to + 4,294,967,295 + This specifies the time interval from address assignment until + the client begins trying to renew its address. The DHCPv4 option + code for this option is 58. + + options : T2: optional string, containing an integer, in range 68 to + 4,294,967,295 + This specifies the time interval from address assignment until + the client begins trying to rebind its address. The DHCPv4 opā€ + tion code for this option is 59. + + options : arp_cache_timeout: optional string, containing an integer, in + range 0 to 255 + The DHCPv4 option code for this option is 35. This option speciā€ + fies the timeout in seconds for ARP cache entries. + + options : tcp_keepalive_interval: optional string, containing an inteā€ + ger, in range 0 to 255 + The DHCPv4 option code for this option is 38. This option speciā€ + fies the interval that the client TCP should wait before sending + a keepalive message on a TCP connection. + + options : netbios_node_type: optional string, containing an integer, in + range 0 to 255 + The DHCPv4 option code for this option is 46. + + String DHCP Options: + + These options accept a string value. + + options : wpad: optional string + The DHCPv4 option code for this option is 252. This option is + used as part of web proxy auto discovery to provide a URL for a + web proxy. + + options : bootfile_name: optional string + The DHCPv4 option code for this option is 67. This option is + used to identify a bootfile. + + options : path_prefix: optional string + The DHCPv4 option code for this option is 210. In PXELINUXā€™ case + this option is used to set a common path prefix, instead of deā€ + riving it from the bootfile name. + + options : tftp_server_address: optional string + The DHCPv4 option code for this option is 150. The option conā€ + tains one or more IPv4 addresses that the client MAY use. This + option is Cisco proprietary, the IEEE standard that matches with + this requirement is option 66 (tftp_server). + + options : hostname: optional string + The DHCPv4 option code for this option is 12. If set, indicates + the DHCPv4 option "Hostname". Alternatively, this option can be + configured in options:hostname column in table Logiā€ā€ + cal_Switch_Port. If Hostname option value is set in both conā€ + flicting Logical_Switch_Port and DHCP_Options tables, Logiā€ā€ + cal_Switch_Port takes precedence. + + options : domain_name: optional string + The DHCPv4 option code for this option is 15. This option speciā€ + fies the domain name that client should use when resolving hostā€ + names via the Domain Name System. + + options : bootfile_name_alt: optional string + "bootfile_name_alt" option is used to support iPXE. When both + "bootfile_name" and "bootfile_name_alt" are provided by the CMS, + "bootfile_name" will be used for option 67 if the dhcp request + contains etherboot option (175), otherwise "bootfile_name_alt" + will be used. + + options : broadcast_address: optional string + The DHCPv4 option code for this option is 28. This option speciā€ + fies the IP address used as a broadcast address. + + DHCP Options of type host_id: + + These options accept either an IPv4 address or a string value. + + options : tftp_server: optional string + The DHCPv4 option code for this option is 66. + + DHCP Options of type domains: + + These options accept string value which is a comma separated list of + domain names. The domain names are encoded based on RFC 1035. + + options : domain_search_list: optional string + The DHCPv4 option code for this option is 119. + + DHCPv6 options: + + OVN also implements native DHCPv6 support. The CMS should define the + set of DHCPv6 options as key/value pairs. The define DHCPv6 options + will be included in the DHCPv6 response to the DHCPv6 Solicit/Reā€ + quest/Confirm packet from the logical ports having the IPv6 addresses + in the cidr. + + Mandatory DHCPv6 options: + + The following options must be defined. + + options : server_id: optional string + The Ethernet address for the DHCP server to use. This is also + included in the DHCPv6 reply as option 2, ``Server Identifierā€™ā€™ + to carry a DUID identifying a server between a client and a + server. ovn-controller defines DUID based on Link-layer Address + [DUID-LL]. + + IPv6 DHCPv6 options: + + Below are the supported DHCPv6 options whose values are an IPv6 adā€ + dress, e.g. aef0::4. Some options accept multiple IPv6 addresses enā€ + closed within curly braces, e.g. {aef0::4, aef0::5}. Please refer to + RFC 3315 for more details on DHCPv6 options and their codes. + + options : dns_server: optional string + The DHCPv6 option code for this option is 23. This option speciā€ + fies the DNS servers that the VM should use. + + String DHCPv6 options: + + These options accept string values. + + options : domain_search: optional string + The DHCPv6 option code for this option is 24. This option speciā€ + fies the domain search list the client should use to resolve + hostnames with DNS. + + Example: "ovn.org". + + options : dhcpv6_stateless: optional string + This option specifies the OVN native DHCPv6 will work in stateā€ + less mode, which means OVN native DHCPv6 will not offer IPv6 adā€ + dresses for VM/VIF ports, but only reply other configurations, + such as DNS and domain search list. When setting this option + with string value "true", VM/VIF will configure IPv6 addresses + by stateless way. Default value for this option is false. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Connection TABLE + Configuration for a database connection to an Open vSwitch database + (OVSDB) client. + + This table primarily configures the Open vSwitch database server + (ovsdb-server). + + The Open vSwitch database server can initiate and maintain active conā€ + nections to remote clients. It can also listen for database connecā€ + tions. + + Summary: + Core Features: + target string (must be unique within table) + Client Failure Detection and Handling: + max_backoff optional integer, at least 1,000 + inactivity_probe optional integer + Status: + is_connected boolean + status : last_error optional string + status : state optional string, one of ACTIVE, BACKOFF, + CONNECTING, IDLE, or VOID + status : sec_since_connect optional string, containing an integer, + at least 0 + status : sec_since_disconnect + optional string, containing an integer, + at least 0 + status : locks_held optional string + status : locks_waiting optional string + status : locks_lost optional string + status : n_connections optional string, containing an integer, + at least 2 + status : bound_port optional string, containing an integer + Common Columns: + external_ids map of string-string pairs + other_config map of string-string pairs + + Details: + Core Features: + + target: string (must be unique within table) + Connection methods for clients. + + The following connection methods are currently supported: + + ssl:host[:port] + The specified SSL port on the host at the given host, + which can either be a DNS name (if built with unbound liā€ + brary) or an IP address. A valid SSL configuration must + be provided when this form is used, this configuration + can be specified via command-line options or the SSL taā€ + ble. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + tcp:host[:port] + The specified TCP port on the host at the given host, + which can either be a DNS name (if built with unbound liā€ + brary) or an IP address. If host is an IPv6 address, wrap + it in square brackets, e.g. tcp:[::1]:6640. + + If port is not specified, it defaults to 6640. + + pssl:[port][:host] + Listens for SSL connections on the specified TCP port. + Specify 0 for port to have the kernel automatically + choose an available port. If host, which can either be a + DNS name (if built with unbound library) or an IP adā€ + dress, is specified, then connections are restricted to + the resolved or specified local IPaddress (either IPv4 or + IPv6 address). If host is an IPv6 address, wrap in square + brackets, e.g. pssl:6640:[::1]. If host is not specified + then it listens only on IPv4 (but not IPv6) addresses. A + valid SSL configuration must be provided when this form + is used, this can be specified either via command-line + options or the SSL table. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + ptcp:[port][:host] + Listens for connections on the specified TCP port. Specā€ + ify 0 for port to have the kernel automatically choose an + available port. If host, which can either be a DNS name + (if built with unbound library) or an IP address, is + specified, then connections are restricted to the reā€ + solved or specified local IP address (either IPv4 or IPv6 + address). If host is an IPv6 address, wrap it in square + brackets, e.g. ptcp:6640:[::1]. If host is not specified + then it listens only on IPv4 addresses. + + If port is not specified, it defaults to 6640. + + When multiple clients are configured, the target values must be + unique. Duplicate target values yield unspecified results. + + Client Failure Detection and Handling: + + max_backoff: optional integer, at least 1,000 + Maximum number of milliseconds to wait between connection atā€ + tempts. Default is implementation-specific. + + inactivity_probe: optional integer + Maximum number of milliseconds of idle time on connection to the + client before sending an inactivity probe message. If Open + vSwitch does not communicate with the client for the specified + number of seconds, it will send a probe. If a response is not + received for the same additional amount of time, Open vSwitch + assumes the connection has been broken and attempts to reconā€ + nect. Default is implementation-specific. A value of 0 disables + inactivity probes. + + Status: + + Key-value pair of is_connected is always updated. Other key-value pairs + in the status columns may be updated depends on the target type. + + When target specifies a connection method that listens for inbound conā€ + nections (e.g. ptcp: or punix:), both n_connections and is_connected + may also be updated while the remaining key-value pairs are omitted. + + On the other hand, when target specifies an outbound connection, all + key-value pairs may be updated, except the above-mentioned two key- + value pairs associated with inbound connection targets. They are omitā€ + ted. + + is_connected: boolean + true if currently connected to this client, false otherwise. + + status : last_error: optional string + A human-readable description of the last error on the connection + to the manager; i.e. strerror(errno). This key will exist only + if an error has occurred. + + status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, + IDLE, or VOID + The state of the connection to the manager: + + VOID Connection is disabled. + + BACKOFF + Attempting to reconnect at an increasing period. + + CONNECTING + Attempting to connect. + + ACTIVE Connected, remote host responsive. + + IDLE Connection is idle. Waiting for response to keep-alive. + + These values may change in the future. They are provided only + for human consumption. + + status : sec_since_connect: optional string, containing an integer, at + least 0 + The amount of time since this client last successfully connected + to the database (in seconds). Value is empty if client has never + successfully been connected. + + status : sec_since_disconnect: optional string, containing an integer, + at least 0 + The amount of time since this client last disconnected from the + database (in seconds). Value is empty if client has never disā€ + connected. + + status : locks_held: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection holds. Omitted if the connection does not hold any + locks. + + status : locks_waiting: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection is currently waiting to acquire. Omitted if the connecā€ + tion is not waiting for any locks. + + status : locks_lost: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection has had stolen by another OVSDB client. Omitted if no + locks have been stolen from this connection. + + status : n_connections: optional string, containing an integer, at + least 2 + When target specifies a connection method that listens for inā€ + bound connections (e.g. ptcp: or pssl:) and more than one conā€ + nection is actually active, the value is the number of active + connections. Otherwise, this key-value pair is omitted. + + status : bound_port: optional string, containing an integer + When target is ptcp: or pssl:, this is the TCP port on which the + OVSDB server is listening. (This is particularly useful when + target specifies a port of 0, allowing the kernel to choose any + available port.) + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs + + other_config: map of string-string pairs +DNS TABLE + Each row in this table stores the DNS records. The Logical_Switch taā€ + bleā€™s dns_records references these records. + + Summary: + records map of string-string pairs + external_ids map of string-string pairs + + Details: + records: map of string-string pairs + Key-value pair of DNS records with DNS query name as the key and + value as a string of IP address(es) separated by comma or space. + For PTR requests, the key-value pair can be Reverse IPv4 adā€ā€ + dress.in-addr.arpa and the value DNS domain name. For IPv6 adā€ + dresses, the key has to be Reverse IPv6 address.ip6.arpa. + + Example: "vm1.ovn.org" = "10.0.0.4 aef0::4" + + Example: "4.0.0.10.in-addr.arpa" = "vm1.ovn.org" + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +SSL TABLE + SSL configuration for ovn-nb database access. + + Summary: + private_key string + certificate string + ca_cert string + bootstrap_ca_cert boolean + ssl_protocols string + ssl_ciphers string + Common Columns: + external_ids map of string-string pairs + + Details: + private_key: string + Name of a PEM file containing the private key used as the + switchā€™s identity for SSL connections to the controller. + + certificate: string + Name of a PEM file containing a certificate, signed by the cerā€ + tificate authority (CA) used by the controller and manager, that + certifies the switchā€™s private key, identifying a trustworthy + switch. + + ca_cert: string + Name of a PEM file containing the CA certificate used to verify + that the switch is connected to a trustworthy controller. + + bootstrap_ca_cert: boolean + If set to true, then Open vSwitch will attempt to obtain the CA + certificate from the controller on its first SSL connection and + save it to the named PEM file. If it is successful, it will imā€ + mediately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certificate + signed by the CA certificate thus obtained. This option exposes + the SSL connection to a man-in-the-middle attack obtaining the + initial CA certificate. It may still be useful for bootstrapā€ + ping. + + ssl_protocols: string + List of SSL protocols to be enabled for SSL connections. The deā€ + fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2. + + ssl_ciphers: string + List of ciphers (in OpenSSL cipher string format) to be supā€ + ported for SSL connections. The default when this option is + omitted is HIGH:!aNULL:!MD5. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs +Gateway_Chassis TABLE + Association of a chassis to a logical router port. The traffic going + out through an specific router port will be redirected to a chassis, or + a set of them in high availability configurations. + + Summary: + name string (must be unique within table) + chassis_name string + priority integer, in range 0 to 32,767 + options map of string-string pairs + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Name of the Gateway_Chassis. + + A suggested, but not required naming convention is + ${port_name}_${chassis_name}. + + chassis_name: string + Name of the chassis that we want to redirect traffic through for + the associated logical router port. The value must match the + name column of the Chassis table in the OVN_Southbound database. + + priority: integer, in range 0 to 32,767 + This is the priority of a chassis among all Gateway_Chassis beā€ + longing to the same logical router port. + + options: map of string-string pairs + Reserved for future use. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +HA_Chassis_Group TABLE + Table representing a group of chassis which can provide high availabilā€ + ity services. Each chassis in the group is represented by the table + HA_Chassis. The HA chassis with highest priority will be the master of + this group. If the master chassis failover is detected, the HA chassis + with the next higher priority takes over the responsibility of providā€ + ing the HA. If a distributed gateway router port references a row in + this table, then the master HA chassis in this group provides the gateā€ + way functionality. + + Summary: + name string (must be unique within table) + ha_chassis set of HA_Chassises + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Name of the HA_Chassis_Group. Name should be unique. + + ha_chassis: set of HA_Chassises + A list of HA chassis which belongs to this group. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +HA_Chassis TABLE + Summary: + chassis_name string + priority integer, in range 0 to 32,767 + Common Columns: + external_ids map of string-string pairs + + Details: + chassis_name: string + Name of the chassis which is part of the HA chassis group. The + value must match the name column of the Chassis table in the + OVN_Southbound database. + + priority: integer, in range 0 to 32,767 + Priority of the chassis. Chassis with highest priority will be + the master. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +BFD TABLE + Contains BFD parameter for ovn-controller BFD configuration. OVN BFD + implementation is used to provide detection of failures in the path beā€ + tween adjacent forwarding engines, including the OVN interfaces. OVN + BFD provides link status info to OVN northd in order to update logical + flows according to the status of BFD endpoints. In the current impleā€ + mentation OVN BFD is used to check next-hop status for ECMP routes. + Please note BFD table refers to OVN BFD implementation and not to OVS + legacy one. + + Summary: + Configuration: + logical_port string + dst_ip string + min_tx optional integer, at least 1 + min_rx optional integer + detect_mult optional integer, at least 1 + options map of string-string pairs + external_ids map of string-string pairs + Status Reporting: + status optional string, one of admin_down, down, + init, or up + + Details: + Configuration: + + ovn-northd reads configuration from these columns. + + logical_port: string + OVN logical port when BFD engine is running. + + dst_ip: string + BFD peer IP address. + + min_tx: optional integer, at least 1 + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, + less any jitter applied. The value zero is reserved. Default + value is 1000 ms. + + min_rx: optional integer + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send + any periodic BFD Control packets. + + detect_mult: optional integer, at least 1 + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the + receiving system in Asynchronous mode. Default value is 5. + + options: map of string-string pairs + Reserved for future use. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + Status Reporting: + + ovn-northd writes BFD status into these columns. + + status: optional string, one of admin_down, down, init, or up + BFD port logical states. Possible values are: + + ā€¢ admin_down + + ā€¢ down + + ā€¢ init + + ā€¢ up +Static_MAC_Binding TABLE + Each record represents a Static_MAC_Binding entry for a logical router. + + Summary: + Configuration: + logical_port string + ip string + mac string + override_dynamic_mac boolean + + Details: + Configuration: + + ovn-northd reads configuration from these columns and propagates the + value to SBDB. + + logical_port: string + The logical router port for the binding. + + ip: string + The bound IP address. + + mac: string + The Ethernet address to which the IP is bound. + + override_dynamic_mac: boolean + Override dynamically learnt MACs. + +Chassis_Template_Var TABLE + One record per chassis, each containing a map, variables, between temā€ + plate variable names and their value for that specific chassis. A temā€ + plate variable has a name and potentially different values on different + hypervisors in the OVN cluster. For example, two rows, R1 = (.chasā€ā€ + sis=C1, variables={(N: V1)} and R2 = (.chassis=C2, variables={(N: V2)} + will make ovn-controller running on chassis C1 and C2 interpret the toā€ + ken N either as V1 (on C1) or as V2 (on C2). Users can refer to temā€ + plate variables from within other logical components, e.g., within ACL, + QoS or Logical_Router_Policy matches or from Load_Balancer VIP and + backend definitions. + + If a template variable is referenced on a chassis for which that variā€ + able is not defined then ovn-controller running on that chassis will + just interpret it as a raw string literal. + + Summary: + chassis string (must be unique within table) + variables map of string-string pairs + Common Columns: + external_ids map of string-string pairs + + Details: + chassis: string (must be unique within table) + The chassis this set of variable values applies to. + + variables: map of string-string pairs + The set of variable values for a given chassis. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Open vSwitch 23.06.3 DB Schema 7.0.4 ovn-nb(5) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8 b/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8 new file mode 100644 index 00000000..8f03624e --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8 @@ -0,0 +1,1075 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-nbctl" 8 "ovn-nbctl" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-nbctl \- Open Virtual Network northbound db management utility +.SH "SYNOPSIS" +.PP +\fBovn\-nbctl\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] +.SH "DESCRIPTION" +.PP +.PP +The \fBovn\-nbctl\fR program configures the \fBOVN_Northbound\fR database by providing a high-level interface to its configuration database\[char46] See \fBovn\-nb\fR(5) for comprehensive documentation of the database schema\[char46] +.PP +.PP +\fBovn\-nbctl\fR connects to an \fBovsdb\-server\fR process that maintains an OVN_Northbound configuration database\[char46] Using this connection, it queries and possibly applies changes to the database, depending on the supplied commands\[char46] +.PP +.PP +\fBovn\-nbctl\fR can perform any number of commands in a single run, implemented as a single atomic transaction against the database\[char46] +.PP +.PP +The \fBovn\-nbctl\fR command line begins with global options (see \fBOPTIONS\fR below for details)\[char46] The global options are followed by one or more commands\[char46] Each command should begin with \fB\-\-\fR by itself as a command-line argument, to separate it from the following commands\[char46] (The \fB\-\-\fR before the first command is optional\[char46]) The command itself starts with command-specific options, if any, followed by the command name and any arguments\[char46] +.SH "DAEMON MODE" +.PP +.PP +When it is invoked in the most ordinary way, \fBovn\-nbctl\fR connects to an OVSDB server that hosts the northbound database, retrieves a partial copy of the database that is complete enough to do its work, sends a transaction request to the server, and receives and processes the server\(cqs reply\[char46] In common interactive use, this is fine, but if the database is large, the step in which \fBovn\-nbctl\fR retrieves a partial copy of the database can take a long time, which yields poor performance overall\[char46] +.PP +.PP +To improve performance in such a case, \fBovn\-nbctl\fR offers a \(dqdaemon mode,\(dq in which the user first starts \fBovn\-nbctl\fR running in the background and afterward uses the daemon to execute operations\[char46] Over several \fBovn\-nbctl\fR command invocations, this performs better overall because it retrieves a copy of the database only once at the beginning, not once per program run\[char46] +.PP +.PP +Use the \fB\-\-detach\fR option to start an \fBovn\-nbctl\fR daemon\[char46] With this option, \fBovn\-nbctl\fR prints the name of a control socket to stdout\[char46] The client should save this name in environment variable \fBOVN_NB_DAEMON\fR\[char46] Under the Bourne shell this might be done like this: +.PP +.nf +\fL +.br +\fL export OVN_NB_DAEMON=$(ovn\-nbctl \-\-pidfile \-\-detach) +.br +\fL \fR +.fi +.PP +.PP +When \fBOVN_NB_DAEMON\fR is set, \fBovn\-nbctl\fR automatically and transparently uses the daemon to execute its commands\[char46] +.PP +.PP +When the daemon is no longer needed, kill it and unset the environment variable, e\[char46]g\[char46]: +.PP +.nf +\fL +.br +\fL kill $(cat $OVN_RUNDIR/ovn\-nbctl\[char46]pid) +.br +\fL unset OVN_NB_DAEMON +.br +\fL \fR +.fi +.PP +.PP +When using daemon mode, an alternative to the \fBOVN_NB_DAEMON\fR environment variable is to specify a path for the Unix socket\[char46] When starting the ovn-nbctl daemon, specify the \fB\-u\fR option with a full path to the location of the socket file\[char46] Here is an exmple: +.PP +.nf +\fL +.br +\fL ovn\-nbctl \-\-detach \-u /tmp/mysock\[char46]ctl +.br +\fL \fR +.fi +.PP +.PP +Then to connect to the running daemon, use the \fB\-u\fR option with the full path to the socket created when the daemon was started: +.PP +.nf +\fL +.br +\fL ovn\-nbctl \-u /tmp/mysock\[char46]ctl show +.br +\fL \fR +.fi +.ST "Daemon Commands" +.PP +.PP +Daemon mode is internally implemented using the same mechanism used by \fBovn\-appctl\fR\[char46] One may also use \fBovn\-appctl\fR directly with the following commands: +.RS +.TP +\fBrun\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] [\fB\-\-\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] \[char46]\[char46]\[char46]] +Instructs the daemon process to run one or more \fBovn\-nbctl\fR commands described above and reply with the results of running these commands\[char46] Accepts the \fB\-\-no\-wait\fR, \fB\-\-wait\fR, \fB\-\-timeout\fR, \fB\-\-dry\-run\fR, \fB\-\-oneline\fR, and the options described under \fBTable Formatting Options\fR in addition to the the command-specific options\[char46] +.TP +\fBexit\fR +Causes \fBovn\-nbctl\fR to gracefully terminate\[char46] +.RE +.SH "OPTIONS" +.PP +.PP +The options listed below affect the behavior of \fBovn\-nbctl\fR as a whole\[char46] Some individual commands also accept their own options, which are given just before the command name\[char46] If the first command on the command line has options, then those options must be separated from the global options by \fB\-\-\fR\[char46] +.PP +.PP +\fBovn\-nbctl\fR also accepts options from the \fBOVN_NBCTL_OPTIONS\fR environment variable, in the same format as on the command line\[char46] Options from the command line override those in the environment\[char46] +.RS +.TP +\fB\-\-no\-wait\fR | \fB\-\-wait=none\fR +.TQ .5in +\fB\-\-wait=sb\fR +.TQ .5in +\fB\-\-wait=hv\fR +These options control whether and how \fBovn\-nbctl\fR waits for the OVN system to become up-to-date with changes made in an \fBovn\-nbctl\fR invocation\[char46] +.IP +By default, or if \fB\-\-no\-wait\fR or \fB\-\-wait=none\fR, \fBovn\-nbctl\fR exits immediately after confirming that changes have been committed to the northbound database, without waiting\[char46] +.IP +With \fB\-\-wait=sb\fR, before \fBovn\-nbctl\fR exits, it waits for \fBovn\-northd\fR to bring the southbound database up-to-date with the northbound database updates\[char46] +.IP +With \fB\-\-wait=hv\fR, before \fBovn\-nbctl\fR exits, it additionally waits for all OVN chassis (hypervisors and gateways) to become up-to-date with the northbound database updates\[char46] (This can become an indefinite wait if any chassis is malfunctioning\[char46]) +.IP +Ordinarily, \fB\-\-wait=sb\fR or \fB\-\-wait=hv\fR only waits for changes by the current \fBovn\-nbctl\fR invocation to take effect\[char46] This means that, if none of the commands supplied to \fBovn\-nbctl\fR change the database, then the command does not wait at all\[char46] Use the \fBsync\fR command to override this behavior\[char46] +.TP +\fB\-\-db\fR \fIdatabase\fR +The OVSDB database remote to contact\[char46] If the \fBOVN_NB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnnb_db\[char46]sock\fR, but this default is unlikely to be useful outside of single-machine OVN test environments\[char46] +.TP +\fB\-\-leader\-only\fR +.TQ .5in +\fB\-\-no\-leader\-only\fR +By default, or with \fB\-\-leader\-only\fR, when the database server is a clustered database, \fBovn\-nbctl\fR will avoid servers other than the cluster leader\[char46] This ensures that any data that \fBovn\-nbctl\fR reads and reports is up-to-date\[char46] With \fB\-\-no\-leader\-only\fR, \fBovn\-nbctl\fR will use any server in the cluster, which means that for read-only transactions it can report and act on stale data (transactions that modify the database are always serialized even with \fB\-\-no\-leader\-only\fR)\[char46] Refer to \fBUnderstanding Cluster Consistency\fR in \fBovsdb\fR(7) for more information\[char46] +.TP +\fB\-\-shuffle\-remotes\fR +.TQ .5in +\fB\-\-no\-shuffle\-remotes\fR +By default, or with \fB\-\-shuffle\-remotes\fR, when there are multiple remotes specified in the OVSDB connection string specified by \fB\-\-db\fR or the \fBOVN_NB_DB\fR environment variable, the order of the remotes will be shuffled before the client tries to connect\[char46] The remotes will be shuffled only once to a new order before the first connection attempt\[char46] The following retries, if any, will follow the same new order\[char46] The default behavior is to make sure clients of a clustered database can distribute evenly to all members of the cluster\[char46] With \fB\-\-no\-shuffle\-remotes\fR, \fBovn\-nbctl\fR will use the original order specified in the connection string to connect\[char46] This allows user to specify the preferred order, which is particularly useful for testing\[char46] +.TP +\fB\-\-no\-syslog\fR +By default, \fBovn\-nbctl\fR logs its arguments and the details of any changes that it makes to the system log\[char46] This option disables this logging\[char46] +.IP +This option is equivalent to \fB\-\-verbose=nbctl:syslog:warn\fR\[char46] +.TP +\fB\-\-oneline\fR +Modifies the output format so that the output for each command is printed on a single line\[char46] New-line characters that would otherwise separate lines are printed as \efB\e\en\efR, and any instances of \efB\e\e\efR that would otherwise appear in the output are doubled\[char46] Prints a blank line for each command that has no output\[char46] This option does not affect the formatting of output from the \fBlist\fR or \fBfind\fR commands; see \fBTable Formatting Options\fR below\[char46] +.TP +\fB\-\-dry\-run\fR +Prevents \fBovn\-nbctl\fR from actually modifying the database\[char46] +.TP +\fB\-t \fIsecs\fB\fR +.TQ .5in +\fB\-\-timeout=\fIsecs\fB\fR +By default, or with a \fIsecs\fR of \fB0\fR, \fBovn\-nbctl\fR waits forever for a response from the database\[char46] This option limits runtime to approximately \fIsecs\fR seconds\[char46] If the timeout expires, \fBovn\-nbctl\fR will exit with a \fBSIGALRM\fR signal\[char46] (A timeout would normally happen only if the database cannot be contacted, or if the system is overloaded\[char46]) +.TP +\fB\-\-print\-wait\-time\fR +When \fB\-\-wait\fR is specified, the option \fB\-\-print\-wait\-time\fR can be used to print the time spent on waiting, depending on the value specified in \fB \-\-wait\fR option\[char46] If \fB\-\-wait=sb\fR is specified, it prints \(dqovn-northd delay before processing\(dq, which is the time between the Northbound DB update by the command and the moment when \fB ovn\-northd\fR starts processing the update, and \(dqovn-northd completion\(dq, which is the time between the Northbound DB update and the moment when \fBovn\-northd\fR completes the Southbound DB updating successfully\[char46] If \fB\-\-wait=hv\fR is specified, in addition to the above information, it also prints \(dqovn-controller(s) completion\(dq, which is the time between the Northbound DB update and the moment when the slowest hypervisor finishes processing the update\[char46] +.RE +.SS "Daemon Options" +.TP +\fB\-\-pidfile\fR[\fB=\fR\fIpidfile\fR] +Causes a file (by default, \fB\fIprogram\fB\[char46]pid\fR) to be created indicating the PID of the running process\[char46] If the \fIpidfile\fR argument is not specified, or if it does not begin with \fB/\fR, then it is created in \fB\fR\[char46] +.IP +If \fB\-\-pidfile\fR is not specified, no pidfile is created\[char46] +.TP +\fB\-\-overwrite\-pidfile\fR +By default, when \fB\-\-pidfile\fR is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start\[char46] Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead overwrite the pidfile\[char46] +.IP +When \fB\-\-pidfile\fR is not specified, this option has no effect\[char46] +.TP +\fB\-\-detach\fR +Runs this program as a background process\[char46] The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless \fB\-\-no\-chdir\fR is specified)\[char46] After the child completes its initialization, the parent exits\[char46] +.TP +\fB\-\-monitor\fR +Creates an additional process to monitor this program\[char46] If it dies due to a signal that indicates a programming error (\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR, \fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or \fBSIGXFSZ\fR) then the monitor process starts a new copy of it\[char46] If the daemon dies or exits for another reason, the monitor process exits\[char46] +.IP +This option is normally used with \fB\-\-detach\fR, but it also functions without it\[char46] +.TP +\fB\-\-no\-chdir\fR +By default, when \fB\-\-detach\fR is specified, the daemon changes its current working directory to the root directory after it detaches\[char46] Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory\[char46] +.IP +Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing the daemon from changing its current working directory\[char46] This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use\[char46] +.IP +This option has no effect when \fB\-\-detach\fR is not specified\[char46] +.TP +\fB\-\-no\-self\-confinement\fR +By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time\[char46] It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon\[char46] Note that in contrast to other access control implementations that are typically enforced from kernel-space (e\[char46]g\[char46] DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security\[char46] +.TP +\fB\-\-user=\fR\fIuser\fR\fB:\fR\fIgroup\fR +Causes this program to run as a different user specified in \fIuser\fR\fB:\fR\fIgroup\fR, thus dropping most of the root privileges\[char46] Short forms \fIuser\fR and \fB:\fR\fIgroup\fR are also allowed, with current user or group assumed, respectively\[char46] Only daemons started by the root user accepts this argument\[char46] +.IP +On Linux, daemons will be granted \fBCAP_IPC_LOCK\fR and \fBCAP_NET_BIND_SERVICES\fR before dropping root privileges\[char46] Daemons that interact with a datapath, such as \fBovs\-vswitchd\fR, will be granted three additional capabilities, namely \fBCAP_NET_ADMIN\fR, \fBCAP_NET_BROADCAST\fR and \fBCAP_NET_RAW\fR\[char46] The capability change will apply even if the new user is root\[char46] +.IP +On Windows, this option is not currently supported\[char46] For security reasons, specifying this option will cause the daemon process not to start\[char46] +.SS "Logging options" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SS "Table Formatting Options" +These options control the format of output from the \fBlist\fR and \fBfind\fR commands\[char46] +.RS +.TP +\fB\-f\fR \fIformat\fR +.TQ .5in +\fB\-\-format=\fR\fIformat\fR +Sets the type of table formatting\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBtable\fR +2-D text tables with aligned columns\[char46] +.TP +\fBlist\fR (default) +A list with one column per line and rows separated by a blank line\[char46] +.TP +\fBhtml\fR +HTML tables\[char46] +.TP +\fBcsv\fR +Comma-separated values as defined in RFC 4180\[char46] +.TP +\fBjson\fR +JSON format as defined in RFC 4627\[char46] The output is a sequence of JSON objects, each of which corresponds to one table\[char46] Each JSON object has the following members with the noted values: +.RS +.TP +\fBcaption\fR +The table\(cqs caption\[char46] This member is omitted if the table has no caption\[char46] +.TP +\fBheadings\fR +An array with one element per table column\[char46] Each array element is a string giving the corresponding column\(cqs heading\[char46] +.TP +\fBdata\fR +An array with one element per table row\[char46] Each element is also an array with one element per table column\[char46] The elements of this second-level array are the cells that constitute the table\[char46] Cells that represent OVSDB data or data types are expressed in the format described in the OVSDB specification; other cells are simply expressed as text strings\[char46] +.RE +.RE +.TP +\fB\-d\fR \fIformat\fR +.TQ .5in +\fB\-\-data=\fR\fIformat\fR +Sets the formatting for cells within output tables unless the table format is set to \fBjson\fR, in which case \fBjson\fR formatting is always used when formatting cells\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBstring\fR (default) +The simple format described in the \fBDatabase Values\fR section of \fBovs\-vsctl\fR(8)\[char46] +.TP +\fBbare\fR +The simple format with punctuation stripped off: \fB[]\fR and \fB{}\fR are omitted around sets, maps, and empty columns, items within sets and maps are space-separated, and strings are never quoted\[char46] This format may be easier for scripts to parse\[char46] +.TP +\fBjson\fR +The RFC 4627 JSON format as described above\[char46] +.RE +.TP +\fB\-\-no\-headings\fR +This option suppresses the heading row that otherwise appears in the first row of table output\[char46] +.TP +\fB\-\-pretty\fR +By default, JSON in output is printed as compactly as possible\[char46] This option causes JSON in output to be printed in a more readable fashion\[char46] Members of objects and elements of arrays are printed one per line, with indentation\[char46] +.IP +This option does not affect JSON in tables, which is always printed compactly\[char46] +.TP +\fB\-\-bare\fR +Equivalent to \fB\-\-format=list \-\-data=bare \-\-no\-headings\fR\[char46] +.RE +.SS "PKI Options" +.PP +.PP +PKI configuration is required to use SSL for the connection to the database\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.RS +.TP +\fB\-\-bootstrap\-ca\-cert=\fR\fIcacert\[char46]pem\fR +When \fIcacert\[char46]pem\fR exists, this option has the same effect as \fB\-C\fR or \fB\-\-ca\-cert\fR\[char46] If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] +.IP +This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping\[char46] +.IP +This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain\[char46] The SSL protocol does not require the server to send the CA certificate\[char46] +.IP +This option is mutually exclusive with \fB\-C\fR and \fB\-\-ca\-cert\fR\[char46] +.RE +.SS "Other Options" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] +.SH "COMMANDS" +.PP +.PP +The following sections describe the commands that \fBovn\-nbctl\fR supports\[char46] +.SS "General Commands" +.TP +\fBinit\fR +Initializes the database, if it is empty\[char46] If the database has already been initialized, this command has no effect\[char46] +.TP +\fBshow [\fIswitch\fB | \fIrouter\fB]\fR +Prints a brief overview of the database contents\[char46] If \fIswitch\fR is provided, only records related to that logical switch are shown\[char46] If \fIrouter\fR is provided, only records related to that logical router are shown\[char46] +.SS "Logical Switch Commands" +.TP +\fBls\-add\fR +Creates a new, unnamed logical switch, which initially has no ports\[char46] The switch does not have a name, other commands must refer to this switch by its UUID\[char46] +.TP +[\fB\-\-may\-exist\fR | \fB\-\-add\-duplicate\fR] \fBls\-add\fR \fIswitch\fR +Creates a new logical switch named \fIswitch\fR, which initially has no ports\[char46] +.IP +The OVN northbound database schema does not require logical switch names to be unique, but the whole point to the names is to provide an easy way for humans to refer to the switches, making duplicate names unhelpful\[char46] Thus, without any options, this command regards it as an error if \fIswitch\fR is a duplicate name\[char46] With \fB\-\-may\-exist\fR, adding a duplicate name succeeds but does not create a new logical switch\[char46] With \fB\-\-add\-duplicate\fR, the command really creates a new logical switch with a duplicate name\[char46] It is an error to specify both options\[char46] If there are multiple logical switches with a duplicate name, configure the logical switches using the UUID instead of the \fIswitch\fR name\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBls\-del\fR \fIswitch\fR +Deletes \fIswitch\fR\[char46] It is an error if \fIswitch\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBls\-list\fR +Lists all existing switches on standard output, one per line\[char46] +.SS "ACL Commands" +.PP +.PP +These commands operates on ACL objects for a given \fIentity\fR\[char46] The \fIentity\fR can be either a logical switch or a port group\[char46] The \fIentity\fR can be specified as uuid or name\[char46] The \fB\-\-type\fR option can be used to specify the type of the \fIentity\fR, in case both a logical switch and a port groups exist with the same name specified for \fIentity\fR\[char46] \fBtype\fR must be either \fBswitch\fR or \fBport\-group\fR\[char46] +.RS +.TP +[\fB\-\-type=\fR{\fBswitch\fR | \fBport\-group\fR}] [\fB\-\-log\fR] [\fB\-\-meter=\fR\fImeter\fR] [\fB\-\-severity=\fR\fIseverity\fR] [\fB\-\-name=\fR\fIname\fR] [\fB\-\-label=\fR\fIlabel\fR] [\fB\-\-may\-exist\fR] [\fB\-\-apply\-after\-lb\fR] [\fB\-\-tier\fR] \fBacl\-add\fR \fIentity\fR \fIdirection\fR \fIpriority\fR \fImatch\fR \fIverdict\fR +Adds the specified ACL to \fIentity\fR\[char46] \fIdirection\fR must be either \fBfrom\-lport\fR or \fBto\-lport\fR\[char46] \fIpriority\fR must be between \fB0\fR and \fB32767\fR, inclusive\[char46] A full description of the fields are in \fBovn\-nb\fR(5)\[char46] If \fB\-\-may\-exist\fR is specified, adding a duplicated ACL succeeds but the ACL is not really created\[char46] Without \fB\-\-may\-exist\fR, adding a duplicated ACL results in error\[char46] +.IP +The \fB\-\-log\fR option enables packet logging for the ACL\[char46] The options \fB\-\-severity\fR and \fB\-\-name\fR specify a severity and name, respectively, for log entries (and also enable logging)\[char46] The severity must be one of \fBalert\fR, \fBwarning\fR, \fBnotice\fR, \fBinfo\fR, or \fBdebug\fR\[char46] If a severity is not specified, the default is \fBinfo\fR\[char46] The \fB\-\-meter=\fImeter\fB\fR option is used to rate-limit packet logging\[char46] The \fImeter\fR argument names a meter configured by \fBmeter\-add\fR\[char46] +.IP +The \fB\-\-apply\-after\-lb\fR option sets \fBapply\-after\-lb=true\fR in the \fBoptions\fR column of the \fBACL\fR table\[char46] As the option name suggests, the ACL will be applied after the logical switch load balancer stage\[char46] +.IP +The \fB\-\-tier\fR option sets the ACL\(cqs tier to the specified value\[char46] For more information about ACL tiers, see the documentation for the \fBovn\-nb\fR(5) database\[char46] +.TP +[\fB\-\-type=\fR{\fBswitch\fR | \fBport\-group\fR}] [\fB\-\-tier\fR] \fBacl\-del\fR \fIentity\fR [\fIdirection\fR [\fIpriority\fR \fImatch\fR]] +Deletes ACLs from \fIentity\fR\[char46] If only \fIentity\fR is supplied, all the ACLs from the \fIentity\fR are deleted\[char46] If \fIdirection\fR is also specified, then all the flows in that direction will be deleted from the \fIentity\fR\[char46] If all the fields are given, then a single flow that matches all the fields will be deleted\[char46] +.IP +If the \fB\-\-tier\fR option is provided, then only ACLs of the given tier value will be deleted, in addition to whatever other criteria have been provided\[char46] +.TP +[\fB\-\-type=\fR{\fBswitch\fR | \fBport\-group\fR}] \fBacl\-list\fR \fIentity\fR +Lists the ACLs on \fIentity\fR\[char46] +.RE +.SS "Logical Switch QoS Rule Commands" +.TP +[\fB\-\-may\-exist\fR] \fBqos\-add\fR \fIswitch\fR \fIdirection\fR \fIpriority\fR \fImatch\fR [\fBdscp=\fR\fIdscp\fR] [\fBrate=\fR\fIrate\fR [\fBburst=\fR\fIburst\fR]] +Adds QoS marking and metering rules to \fIswitch\fR\[char46] \fIdirection\fR must be either \fBfrom\-lport\fR or \fBto\-lport\fR\[char46] \fIpriority\fR must be between \fB0\fR and \fB32767\fR, inclusive\[char46] +.IP +If \fBdscp=\fR\fIdscp\fR is specified, then matching packets will have DSCP marking applied\[char46] \fIdscp\fR must be between \fB0\fR and \fB63\fR, inclusive\[char46] If \fBrate=\fR\fIrate\fR is specified then matching packets will have metering applied at \fIrate\fR kbps\[char46] If metering is configured, then \fBburst=\fR\fIburst\fR specifies the burst rate limit in kilobits\[char46] \fBdscp\fR and/or \fBrate\fR are required arguments\[char46] +.IP +If \fB\-\-may\-exist\fR is specified, adding a duplicated QoS rule succeeds but the QoS rule is not really created\[char46] Without \fB\-\-may\-exist\fR, adding a duplicated QoS rule results in error\[char46] +.TP +\fBqos\-del\fR \fIswitch\fR [\fIdirection\fR [\fIpriority\fR \fImatch\fR]] +Deletes QoS rules from \fIswitch\fR\[char46] If only \fIswitch\fR is supplied, all the QoS rules from the logical switch are deleted\[char46] If \fIdirection\fR is also specified, then all the flows in that direction will be deleted from the logical switch\[char46] If all the fields are supplied, then a single flow that matches the given fields will be deleted\[char46] +.IP +If \fIswitch\fR and \fIuuid\fR are supplied, then the QoS rule with specified uuid is deleted\[char46] +.TP +\fBqos\-list\fR \fIswitch\fR +Lists the QoS rules on \fIswitch\fR\[char46] +.SS "Meter Commands" +.TP +\fBmeter\-add\fR \fIname\fR \fIaction\fR \fIrate\fR \fIunit\fR [\fIburst\fR] +Adds the specified meter\[char46] \fIname\fR must be a unique name to identify this meter\[char46] The \fIaction\fR argument specifies what should happen when this meter is exceeded\[char46] The only supported action is \fBdrop\fR\[char46] +.IP +The \fIunit\fR specifies the unit for the \fIrate\fR argument; valid values are \fBkbps\fR and \fBpktps\fR for kilobits per second and packets per second, respectively\[char46] The \fIburst\fR option configures the maximum burst allowed for the band in kilobits or packets depending on whether the \fIunit\fR chosen was \fBkbps\fR or \fBpktps\fR, respectively\[char46] If a burst is not supplied, the switch is free to select some reasonable value depending on its configuration\[char46] +.IP +\fBovn\-nbctl\fR only supports adding a meter with a single band, but the other commands support meters with multiple bands\[char46] +.IP +Names that start with \(dq__\(dq (two underscores) are reserved for internal use by OVN, so \fBovn\-nbctl\fR does not allow adding them\[char46] +.TP +\fBmeter\-del\fR [\fIname\fR] +Deletes meters\[char46] By default, all meters are deleted\[char46] If \fIname\fR is supplied, only the meter with that name will be deleted\[char46] +.TP +\fBmeter\-list\fR +Lists all meters\[char46] +.SS "Logical Switch Port Commands" +.TP +[\fB\-\-may\-exist\fR] \fBlsp\-add\fR \fIswitch\fR \fIport\fR +Creates on \fIlswitch\fR a new logical switch port named \fIport\fR\[char46] +.IP +It is an error if a logical port named \fIport\fR already exists, unless \fB\-\-may\-exist\fR is specified\[char46] Regardless of \fB\-\-may\-exist\fR, it is an error if the existing port is in some logical switch other than \fIswitch\fR or if it has a parent port\[char46] +.TP +[\fB\-\-may\-exist\fR] \fBlsp\-add\fR \fIswitch\fR \fIport\fR \fIparent\fR \fItag_request\fR +Creates on \fIswitch\fR a logical switch port named \fIport\fR that is a child of \fIparent\fR that is identified with VLAN ID \fItag_request\fR, which must be between \fB0\fR and \fB4095\fR, inclusive\[char46] If \fItag_request\fR is \fB0\fR, \fBovn\-northd\fR generates a tag that is unique in the scope of \fIparent\fR\[char46] This is useful in cases such as virtualized container environments where Open vSwitch does not have a direct connection to the container\(cqs port and it must be shared with the virtual machine\(cqs port\[char46] +.IP +It is an error if a logical port named \fIport\fR already exists, unless \fB\-\-may\-exist\fR is specified\[char46] Regardless of \fB\-\-may\-exist\fR, it is an error if the existing port is not in \fIswitch\fR or if it does not have the specified \fIparent\fR and \fItag_request\fR\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlsp\-del\fR \fIport\fR +Deletes \fIport\fR\[char46] It is an error if \fIport\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlsp\-list\fR \fIswitch\fR +Lists all the logical switch ports within \fIswitch\fR on standard output, one per line\[char46] +.TP +\fBlsp\-get\-parent\fR \fIport\fR +If set, get the parent port of \fIport\fR\[char46] If not set, print nothing\[char46] +.TP +\fBlsp\-get\-tag\fR \fIport\fR +If set, get the tag for \fIport\fR traffic\[char46] If not set, print nothing\[char46] +.TP +\fBlsp\-set\-addresses\fR \fIport\fR [\fIaddress\fR]\[char46]\[char46]\[char46] +Sets the addresses associated with \fIport\fR to \fIaddress\fR\[char46] Each \fIaddress\fR should be one of the following: +.RS +.TP +an Ethernet address, optionally followed by a space and one or more IP addresses +OVN delivers packets for the Ethernet address to this port\[char46] +.TP +\fBunknown\fR +OVN delivers unicast Ethernet packets whose destination MAC address is not in any logical port\(cqs addresses column to ports with address \fBunknown\fR\[char46] +.TP +\fBdynamic\fR +Use this keyword to make \fBovn\-northd\fR generate a globally unique MAC address and choose an unused IPv4 address with the logical port\(cqs subnet and store them in the port\(cqs \fBdynamic_addresses\fR column\[char46] +.TP +\fBrouter\fR +Accepted only when the \fBtype\fR of the logical switch port is \fBrouter\fR\[char46] This indicates that the Ethernet, IPv4, and IPv6 addresses for this logical switch port should be obtained from the connected logical router port, as specified by \fBrouter\-port\fR in \fBlsp\-set\-options\fR\[char46] +.RE +.IP +Multiple addresses may be set\[char46] If no \fIaddress\fR argument is given, \fIport\fR will have no addresses associated with it\[char46] +.TP +\fBlsp\-get\-addresses\fR \fIport\fR +Lists all the addresses associated with \fIport\fR on standard output, one per line\[char46] +.TP +\fBlsp\-set\-port\-security\fR \fIport\fR [\fIaddrs\fR]\[char46]\[char46]\[char46] +Sets the port security addresses associated with \fIport\fR to \fIaddrs\fR\[char46] Multiple sets of addresses may be set by using multiple \fIaddrs\fR arguments\[char46] If no \fIaddrs\fR argument is given, \fIport\fR will not have port security enabled\[char46] +.IP +Port security limits the addresses from which a logical port may send packets and to which it may receive packets\[char46] See the \fBovn\-nb\fR(5) documentation for the \fBport_security\fR column in the \fBLogical_Switch_Port\fR table for details\[char46] +.TP +\fBlsp\-get\-port\-security\fR \fIport\fR +Lists all the port security addresses associated with \fIport\fR on standard output, one per line\[char46] +.TP +\fBlsp\-get\-up\fR \fIport\fR +Prints the state of \fIport\fR, either \fBup\fR or \fBdown\fR\[char46] +.TP +\fBlsp\-set\-enabled\fR \fIport\fR \fIstate\fR +Set the administrative state of \fIport\fR, either \fBenabled\fR or \fBdisabled\fR\[char46] When a port is disabled, no traffic is allowed into or out of the port\[char46] +.TP +\fBlsp\-get\-enabled\fR \fIport\fR +Prints the administrative state of \fIport\fR, either \fBenabled\fR or \fBdisabled\fR\[char46] +.TP +\fBlsp\-set\-type\fR \fIport\fR \fItype\fR +Set the type for the logical port\[char46] The type must be one of the following: +.RS +.TP +\fB(empty string)\fR +A VM (or VIF) interface\[char46] +.TP +\fBrouter\fR +A connection to a logical router\[char46] +.TP +\fBlocalnet\fR +A connection to a locally accessible network from each ovn-controller instance\[char46] A logical switch can only have a single localnet port attached\[char46] This is used to model direct connectivity to an existing network\[char46] +.TP +\fBlocalport\fR +A connection to a local VIF\[char46] Traffic that arrives on a localport is never forwarded over a tunnel to another chassis\[char46] These ports are present on every chassis and have the same address in all of them\[char46] This is used to model connectivity to local services that run on every hypervisor\[char46] +.TP +\fBl2gateway\fR +A connection to a physical network\[char46] +.TP +\fBvtep\fR +A port to a logical switch on a VTEP gateway\[char46] +.RE +.TP +\fBlsp\-get\-type\fR \fIport\fR +Get the type for the logical port\[char46] +.TP +\fBlsp\-set\-options\fR \fIport\fR [\fIkey=value\fR]\[char46]\[char46]\[char46] +Set type-specific key-value options for the logical port\[char46] +.TP +\fBlsp\-get\-options\fR \fIport\fR +Get the type-specific options for the logical port\[char46] +.TP +\fBlsp\-set\-dhcpv4\-options\fR \fIport\fR \fIdhcp_options\fR +Set the DHCPv4 options for the logical port\[char46] The \fIdhcp_options\fR is a UUID referring to a set of DHCP options in the \fBDHCP_Options\fR table\[char46] +.TP +\fBlsp\-get\-dhcpv4\-options\fR \fIport\fR +Get the configured DHCPv4 options for the logical port\[char46] +.TP +\fBlsp\-set\-dhcpv6\-options\fR \fIport\fR \fIdhcp_options\fR +Set the DHCPv6 options for the logical port\[char46] The \fIdhcp_options\fR is a UUID referring to a set of DHCP options in the \fBDHCP_Options\fR table\[char46] +.TP +\fBlsp\-get\-dhcpv6\-options\fR \fIport\fR +Get the configured DHCPv6 options for the logical port\[char46] +.TP +\fBlsp\-get\-ls\fR \fIport\fR +Get the logical switch which the \fIport\fR belongs to\[char46] +.TP +\fBlsp\-attach\-mirror\fR \fIport\fR \fIm\fR +Attaches the mirror \fIm\fR to the logical port \fIport\fR\[char46] +.TP +\fBlsp\-detach\-mirror\fR \fIport\fR \fIm\fR +Detaches the mirror \fIm\fR from the logical port \fIport\fR\[char46] +.SS "Forwarding Group Commands" +.TP +[\fB\-\-liveness\fR]\fBfwd\-group\-add\fR \fIgroup\fR \fIswitch\fR \fIvip\fR \fIvmac\fR \fIports\fR +Creates a new forwarding group named \fIgroup\fR as the name with the provided \fIvip\fR and \fIvmac\fR\[char46] \fIvip\fR should be a virtual IP address and \fIvmac\fR should be a virtual MAC address to access the forwarding group\[char46] \fIports\fR are the logical switch port names that are put in the forwarding group\[char46] Example for \fIports\fR is lsp1 lsp2 \[char46]\[char46]\[char46] Traffic destined to virtual IP of the forwarding group will be load balanced to all the child ports\[char46] +.IP +When \fB\-\-liveness\fR is specified then child ports are expected to be bound to external devices like routers\[char46] BFD should be configured between hypervisors and the external devices\[char46] The child port selection will become dependent on BFD status with its external device\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBfwd\-group\-del\fR \fIgroup +\fR +Deletes \fIgroup\fR\[char46] It is an error if \fIgroup\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBfwd\-group\-list\fR [\fIswitch\fR] +Lists all existing forwarding groups, If \fIswitch\fR is specified then only the forwarding groups configured for \fIswitch\fR will be listed\[char46] +.SS "Logical Router Commands" +.TP +\fBlr\-add\fR +Creates a new, unnamed logical router, which initially has no ports\[char46] The router does not have a name, other commands must refer to this router by its UUID\[char46] +.TP +[\fB\-\-may\-exist\fR | \fB\-\-add\-duplicate\fR] \fBlr\-add\fR \fIrouter\fR +Creates a new logical router named \fIrouter\fR, which initially has no ports\[char46] +.IP +The OVN northbound database schema does not require logical router names to be unique, but the whole point to the names is to provide an easy way for humans to refer to the routers, making duplicate names unhelpful\[char46] Thus, without any options, this command regards it as an error if \fIrouter\fR is a duplicate name\[char46] With \fB\-\-may\-exist\fR, adding a duplicate name succeeds but does not create a new logical router\[char46] With \fB\-\-add\-duplicate\fR, the command really creates a new logical router with a duplicate name\[char46] It is an error to specify both options\[char46] If there are multiple logical routers with a duplicate name, configure the logical routers using the UUID instead of the \fIrouter\fR name\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlr\-del\fR \fIrouter\fR +Deletes \fIrouter\fR\[char46] It is an error if \fIrouter\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlr\-list\fR +Lists all existing routers on standard output, one per line\[char46] +.SS "Logical Router Port Commands" +.TP +[\fB\-\-may\-exist\fR] \fBlrp\-add\fR \fIrouter\fR \fIport\fR \fImac\fR \fInetwork\fR\[char46]\[char46]\[char46] [\fBpeer=\fR\fIpeer\fR] +Creates on \fIrouter\fR a new logical router port named \fIport\fR with Ethernet address \fImac\fR and one or more IP address/netmask for each \fInetwork\fR\[char46] +.IP +The optional argument \fBpeer\fR identifies a logical router port that connects to this one\[char46] The following example adds a router port with an IPv4 and IPv6 address with peer \fBlr1\fR: +.IP +\fBlrp\-add lr0 lrp0 00:11:22:33:44:55 192\[char46]168\[char46]0\[char46]1/24 2001:db8::1/64 peer=lr1\fR +.IP +It is an error if a logical router port named \fIport\fR already exists, unless \fB\-\-may\-exist\fR is specified\[char46] Regardless of \fB\-\-may\-exist\fR, it is an error if the existing router port is in some logical router other than \fIrouter\fR\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlrp\-del\fR \fIport\fR +Deletes \fIport\fR\[char46] It is an error if \fIport\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlrp\-list\fR \fIrouter\fR +Lists all the logical router ports within \fIrouter\fR on standard output, one per line\[char46] +.TP +\fBlrp\-set\-enabled\fR \fIport\fR \fIstate\fR +Set the administrative state of \fIport\fR, either \fBenabled\fR or \fBdisabled\fR\[char46] When a port is disabled, no traffic is allowed into or out of the port\[char46] +.TP +\fBlrp\-get\-enabled\fR \fIport\fR +Prints the administrative state of \fIport\fR, either \fBenabled\fR or \fBdisabled\fR\[char46] +.TP +\fBlrp\-set\-gateway\-chassis\fR \fIport\fR \fIchassis\fR [\fIpriority\fR] +Set gateway chassis for \fIport\fR\[char46] \fIchassis\fR is the name of the chassis\[char46] This creates a gateway chassis entry in Gateway_Chassis table\[char46] It won\(cqt check if chassis really exists in OVN_Southbound database\[char46] Priority will be set to 0 if \fIpriority\fR is not provided by user\[char46] \fIpriority\fR must be between \fB0\fR and \fB32767\fR, inclusive\[char46] +.TP +\fBlrp\-del\-gateway\-chassis\fR \fIport\fR \fIchassis\fR +Deletes gateway chassis from \fIport\fR\[char46] It is an error if gateway chassis with \fIchassis\fR for \fIport\fR does not exist\[char46] +.TP +\fBlrp\-get\-gateway\-chassis\fR \fIport\fR +Lists all the gateway chassis with priority within \fIport\fR on standard output, one per line, ordered based on priority\[char46] +.SS "Logical Router Static Route Commands" +.TP +[\fB\-\-may\-exist\fR] [\fB\-\-policy\fR=\fIPOLICY\fR] [\fB\-\-ecmp\fR] [\fB\-\-ecmp\-symmetric\-reply\fR] [\fB\-\-bfd[=\fIUUID\fB\fR]] \fBlr\-route\-add\fR \fIrouter\fR \fIprefix\fR \fInexthop\fR [\fIport\fR] +Adds the specified route to \fIrouter\fR\[char46] \fIprefix\fR describes an IPv4 or IPv6 prefix for this route, such as \fB192\[char46]168\[char46]100\[char46]0/24\fR\[char46] \fInexthop\fR specifies the gateway to use for this route, which should be the IP address of one of \fIrouter\fR logical router ports or the IP address of a logical port\[char46] If \fIport\fR is specified, packets that match this route will be sent out that port\[char46] When \fIport\fR is omitted, OVN infers the output port based on \fInexthop\fR\[char46] Nexthop can be set to \fIdiscard\fR for dropping packets which match the given route\[char46] +.IP +\fB\-\-policy\fR describes the policy used to make routing decisions\[char46] This should be one of \(dqdst-ip\(dq or \(dqsrc-ip\(dq\[char46] If not specified, the default is \(dqdst-ip\(dq\[char46] +.IP +The \fB\-\-ecmp\fR option allows for multiple routes with the same \fIprefix\fR \fIPOLICY\fR but different \fInexthop\fR and \fIport\fR to be added\[char46] +.IP +The \fB\-\-ecmp\-symmetric\-reply\fR option makes it so that traffic that arrives over an ECMP route will have its reply traffic sent out over that same route\[char46] Setting \fB\-\-ecmp\-symmetric\-reply\fR implies \fB\-\-ecmp\fR so it is not necessary to set both\[char46] +.IP +\fB\-\-bfd\fR option is used to link a BFD session to the OVN route\[char46] If the BFD session UUID is provided, it will be used for the OVN route otherwise the next-hop will be used to perform a lookup in the OVN BFD table\[char46] If the lookup fails and \fIport\fR is specified, a new entry in the BFD table will be created using the \fInexthop\fR as \fIdst_ip\fR and \fIport\fR as \fIlogical_port\fR\[char46] +.IP +It is an error if a route with \fIprefix\fR and \fIPOLICY\fR already exists, unless \fB\-\-may\-exist\fR, \fB\-\-ecmp\fR, or \fB\-\-ecmp\-symmetric\-reply\fR is specified\[char46] If \fB\-\-may\-exist\fR is specified but not \fB\-\-ecmp\fR or \fB\-\-ecmp\-symmetric\-reply\fR, the existed route will be updated with the new nexthop and port\[char46] If \fB\-\-ecmp\fR or \fB\-\-ecmp\-symmetric\-reply\fR is specified, a new route will be added, regardless of the existed route\[char46], which is useful when adding ECMP routes, i\[char46]e\[char46] routes with same \fIPOLICY\fR and \fIprefix\fR but different \fInexthop\fR and \fIport\fR\[char46] +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-policy\fR=\fIPOLICY\fR] \fBlr\-route\-del\fR \fIrouter\fR [\fIprefix\fR [\fInexthop\fR [\fIport\fR]]] +Deletes routes from \fIrouter\fR\[char46] If only \fIrouter\fR is supplied, all the routes from the logical router are deleted\[char46] If \fIPOLICY\fR, \fIprefix\fR, \fInexthop\fR and/or \fIport\fR are also specified, then all the routes that match the conditions will be deleted from the logical router\[char46] +.IP +It is an error if there is no matching route entry, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlr\-route\-list\fR \fIrouter\fR +Lists the routes on \fIrouter\fR\[char46] +.SS "Logical Router Policy Commands" +.TP +[\fB\-\-may\-exist\fR]\fBlr\-policy\-add\fR \fIrouter\fR \fIpriority\fR \fImatch\fR \fIaction\fR [\fInexthop\fR[,\fInexthop\fR,\[char46]\[char46]\[char46]]] [\fIoptions key=value]\fR] +Add Policy to \fIrouter\fR which provides a way to configure permit/deny and reroute policies on the router\[char46] Permit/deny policies are similar to OVN ACLs, but exist on the logical-router\[char46] Reroute policies are needed for service-insertion and service-chaining\[char46] \fInexthop\fR is an optional parameter\[char46] It needs to be provided only when \fIaction\fR is \fIreroute\fR\[char46] Multiple \fBnexthops\fR can be specified for ECMP routing\[char46] A policy is uniquely identified by \fIpriority\fR and \fImatch\fR\[char46] Multiple policies can have the same \fIpriority\fR\[char46] \fIoptions\fR sets the router policy options as key-value pair\[char46] The supported option is : \fBpkt_mark\fR\[char46] +.IP +If \fB\-\-may\-exist\fR is specified, adding a duplicated routing policy with the same priority and match string is not really created\[char46] Without \fB\-\-may\-exist\fR, adding a duplicated routing policy results in error\[char46] +.IP +The following example shows a policy to lr1, which will drop packets from\fB192\[char46]168\[char46]100\[char46]0/24\fR\[char46] +.IP +\fBlr\-policy\-add lr1 100 ip4\[char46]src == 192\[char46]168\[char46]100\[char46]0/24 drop\fR\[char46] +.IP +\fB +lr\-policy\-add lr1 100 ip4\[char46]src == 192\[char46]168\[char46]100\[char46]0/24 allow +pkt_mark=100 +\fR\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlr\-policy\-del\fR \fIrouter\fR [\fI{priority | uuid} [match]\fR] +Deletes polices from \fIrouter\fR\[char46] If only \fIrouter\fR is supplied, all the polices from the logical router are deleted\[char46] If \fIpriority\fR and/or \fImatch\fR are also specified, then all the polices that match the conditions will be deleted from the logical router\[char46] +.IP +If \fIrouter\fR and \fIuuid\fR are supplied, then the policy with specified uuid is deleted\[char46] It is an error if \fIuuid\fR does not exist, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlr\-policy\-list\fR \fIrouter\fR +Lists the polices on \fIrouter\fR\[char46] +.SS "NAT Commands" +.TP +[\fB\-\-may\-exist\fR] [\fB\-\-stateless\fR] [\fB\-\-gateway\-port\fR=\fIGATEWAY_PORT\fR] \fBlr\-nat\-add\fR \fIrouter\fR \fItype\fR \fIexternal_ip\fR \fIlogical_ip\fR [\fIlogical_port\fR \fIexternal_mac\fR] +Adds the specified NAT to \fIrouter\fR\[char46] The \fItype\fR must be one of \fBsnat\fR, \fBdnat\fR, or \fBdnat_and_snat\fR\[char46] The \fIexternal_ip\fR is an IPv4 address\[char46] The \fIlogical_ip\fR is an IPv4 network (e\[char46]g 192\[char46]168\[char46]1\[char46]0/24) or an IPv4 address\[char46] The \fIlogical_port\fR and \fIexternal_mac\fR are only accepted when \fIrouter\fR is a distributed router (rather than a gateway router) and \fItype\fR is \fBdnat_and_snat\fR\[char46] The \fIlogical_port\fR is the name of an existing logical switch port where the \fIlogical_ip\fR resides\[char46] The \fIexternal_mac\fR is an Ethernet address\[char46] +.IP +When \fB\-\-stateless\fR is specified then it implies that we will be not use connection tracker, i\[char46]e internal ip and external ip are 1:1 mapped\[char46] This implies that \fB\-\-stateless\fR is applicable only to dnat_and_snat type NAT rules\[char46] An external ip with \fB\-\-stateless\fR NAT cannot be shared with any other NAT rule\[char46] +.IP +\fB\-\-gateway\-port\fR option allows specifying the distributed gateway port of \fIrouter\fR where the NAT rule needs to be applied\[char46] \fIGATEWAY_PORT\fR should reference a \fBLogical_Router_Port\fR row that is a distributed gateway port of \fIrouter\fR\[char46] When \fIrouter\fR has multiple distributed gateway ports and the gateway port for this NAT can\(cqt be inferred from the \fIexternal_ip\fR, it is an error to not specify the \fIGATEWAY_PORT\fR\[char46] +.IP +When \fItype\fR is \fBdnat\fR, the externally visible IP address \fIexternal_ip\fR is DNATted to the IP address \fIlogical_ip\fR in the logical space\[char46] +.IP +When \fItype\fR is \fBsnat\fR, IP packets with their source IP address that either matches the IP address in \fIlogical_ip\fR or is in the network provided by \fIlogical_ip\fR is SNATed into the IP address in \fIexternal_ip\fR\[char46] +.IP +When \fItype\fR is \fBdnat_and_snat\fR, the externally visible IP address \fIexternal_ip\fR is DNATted to the IP address \fIlogical_ip\fR in the logical space\[char46] In addition, IP packets with the source IP address that matches \fIlogical_ip\fR is SNATed into the IP address in \fIexternal_ip\fR\[char46] +.IP +When the \fIlogical_port\fR and \fIexternal_mac\fR are specified, the NAT rule will be programmed on the chassis where the \fIlogical_port\fR resides\[char46] This includes ARP replies for the \fIexternal_ip\fR, which return the value of \fIexternal_mac\fR\[char46] All packets transmitted with source IP address equal to \fIexternal_ip\fR will be sent using the \fIexternal_mac\fR\[char46] +.IP +It is an error if a NAT already exists with the same values of \fIrouter\fR, \fItype\fR, \fIexternal_ip\fR, \fIlogical_ip\fR and \fIGATEWAY_PORT\fR (in case of multiple distributed gateway ports), unless \fB\-\-may\-exist\fR is specified\[char46] When \fB\-\-may\-exist\fR, \fIlogical_port\fR, and \fIexternal_mac\fR are all specified, the existing values of \fIlogical_port\fR and \fIexternal_mac\fR are overwritten\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlr\-nat\-del\fR \fIrouter\fR [\fItype\fR [\fIip\fR] [\fIgateway_port\fR]] +Deletes NATs from \fIrouter\fR\[char46] If only \fIrouter\fR is supplied, all the NATs from the logical router are deleted\[char46] If \fItype\fR is also specified, then all the NATs that match the \fItype\fR will be deleted from the logical router\[char46] If \fIip\fR is also specified without specifying \fIgateway_port\fR, then all the NATs that match the \fItype\fR and \fIip\fR will be deleted from the logical router\[char46] If \fIgateway_port\fR is specified without specifying \fIip\fR, then all the NATs that match the \fItype\fR and \fIgateway_port\fR will be deleted from the logical router\[char46] If all the fields are given, then a single NAT rule that matches all the fields will be deleted\[char46] When \fItype\fR is \fBsnat\fR, the \fIip\fR should be logical_ip\[char46] When \fItype\fR is \fBdnat\fR or \fBdnat_and_snat\fR, the \fIip\fR should be external_ip\[char46] +.IP +It is an error if both \fIip\fR and \fIgateway_port\fR are specified and there is no matching NAT entry, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlr\-nat\-list\fR \fIrouter\fR +Lists the NATs on \fIrouter\fR\[char46] +.SS "Load Balancer Commands" +.TP +[\fB\-\-may\-exist\fR | \fB\-\-add\-duplicate\fR | \fB\-\-reject\fR | \fB\-\-event\fR] \fBlb\-add\fR \fIlb\fR \fIvip\fR \fIips\fR [\fIprotocol\fR] +Creates a new load balancer named \fIlb\fR with the provided \fIvip\fR and \fIips\fR or adds the \fIvip\fR to an existing \fIlb\fR\[char46] \fIvip\fR should be a virtual IP address (or an IP address and a port number with \fB:\fR as a separator)\[char46] Examples for \fIvip\fR are \fB192\[char46]168\[char46]1\[char46]4\fR, \fBfd0f::1\fR, and \fB192\[char46]168\[char46]1\[char46]5:8080\fR\[char46] \fIips\fR should be comma separated IP endpoints (or comma separated IP addresses and port numbers with \fB:\fR as a separator)\[char46] \fIips\fR must be the same address family as \fIvip\fR\[char46] Examples for \fIips\fR are \fB10\[char46]0\[char46]0\[char46]1,10\[char46]0\[char46]0\[char46]2\fRor \fB[fdef::1]:8800,[fdef::2]:8800\fR\[char46] +.IP +The optional argument \fIprotocol\fR must be either \fBtcp\fR, \fBudp\fR or \fBsctp\fR\[char46] This argument is useful when a port number is provided as part of the \fIvip\fR\[char46] If the \fIprotocol\fR is unspecified and a port number is provided as part of the \fIvip\fR, OVN assumes the \fIprotocol\fR to be \fBtcp\fR\[char46] +.IP +It is an error if the \fIvip\fR already exists in the load balancer named \fIlb\fR, unless \fB\-\-may\-exist\fR is specified\[char46] With \fB\-\-add\-duplicate\fR, the command really creates a new load balancer with a duplicate name\[char46] +.IP +If the load balancer is created with \fB\-\-reject\fR option and it has no active backends, a TCP reset segment (for tcp) or an ICMP port unreachable packet (for all other kind of traffic) will be sent whenever an incoming packet is received for this load-balancer\[char46] Please note using \fB\-\-reject\fR option will disable empty_lb SB controller event for this load balancer\[char46] +.IP +If the load balancer is created with \fB\-\-event\fR option and it has no active backends, whenever the lb receives traffic, the event is reported in the Controller_Event table in the SB db\[char46] Please note \fB\-\-event\fR option can\(cqt be specified with \fB\-\-reject\fR one\[char46] +.IP +The following example adds a load balancer\[char46] +.IP +\fBlb\-add lb0 30\[char46]0\[char46]0\[char46]10:80 +192\[char46]168\[char46]10\[char46]10:80,192\[char46]168\[char46]10\[char46]20:80,192\[char46]168\[char46]10\[char46]30:80 udp\fR +.TP +[\fB\-\-if\-exists\fR] \fBlb\-del\fR \fIlb\fR [\fIvip\fR] +Deletes \fIlb\fR or the \fIvip\fR from \fIlb\fR\[char46] If \fIvip\fR is supplied, only the \fIvip\fR will be deleted from the \fIlb\fR\[char46] If only the \fIlb\fR is supplied, the \fIlb\fR will be deleted\[char46] It is an error if \fIvip\fR does not already exist in \fIlb\fR, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlb\-list\fR [\fIlb\fR] +Lists the LBs\[char46] If \fIlb\fR is also specified, then only the specified \fIlb\fR will be listed\[char46] +.TP +[\fB\-\-may\-exist\fR] \fBls\-lb\-add\fR \fIswitch\fR \fIlb\fR +Adds the specified \fIlb\fR to \fIswitch\fR\[char46] It is an error if a load balancer named \fIlb\fR already exists in the \fIswitch\fR, unless \fB\-\-may\-exist\fR is specified\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBls\-lb\-del\fR \fIswitch\fR [\fIlb\fR] +Removes \fIlb\fR from \fIswitch\fR\[char46] If only \fIswitch\fR is supplied, all the LBs from the logical switch are removed\[char46] If \fIlb\fR is also specified, then only the \fIlb\fR will be removed from the logical switch\[char46] It is an error if \fIlb\fR does not exist in the \fIswitch\fR, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBls\-lb\-list\fR \fIswitch\fR +Lists the LBs for the given \fIswitch\fR\[char46] +.TP +[\fB\-\-may\-exist\fR] \fBlr\-lb\-add\fR \fIrouter\fR \fIlb\fR +Adds the specified \fIlb\fR to \fIrouter\fR\[char46] It is an error if a load balancer named \fIlb\fR already exists in the \fIrouter\fR, unless \fB\-\-may\-exist\fR is specified\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlr\-lb\-del\fR \fIrouter\fR [\fIlb\fR] +Removes \fIlb\fR from \fIrouter\fR\[char46] If only \fIrouter\fR is supplied, all the LBs from the logical router are removed\[char46] If \fIlb\fR is also specified, then only the \fIlb\fR will be removed from the logical router\[char46] It is an error if \fIlb\fR does not exist in the \fIrouter\fR, unless \fB\-\-if\-exists\fR is specified\[char46] +.TP +\fBlr\-lb\-list\fR \fIrouter\fR +Lists the LBs for the given \fIrouter\fR\[char46] +.SS "DHCP Options commands" +.TP +\fBdhcp\-options\-create\fR \fIcidr\fR [\fIkey=value\fR] +Creates a new DHCP Options entry in the \fBDHCP_Options\fR table with the specified \fBcidr\fR and optional \fBexternal\-ids\fR\[char46] +.TP +\fBdhcp\-options\-list\fR +Lists the DHCP Options entries\[char46] +.TP +\fBdhcp\-options\-del\fR \fIdhcp-option\fR +Deletes the DHCP Options entry referred by \fIdhcp-option\fR UUID\[char46] +.TP +\fBdhcp\-options\-set\-options\fR \fIdhcp-option\fR [\fIkey=value\fR]\[char46]\[char46]\[char46] +Set the DHCP Options for the \fIdhcp-option\fR UUID\[char46] +.TP +\fBdhcp\-options\-get\-options\fR \fIdhcp-option\fR +Lists the DHCP Options for the \fIdhcp-option\fR UUID\[char46] +.SS "Port Group commands" +.TP +\fBpg\-add\fR \fIgroup\fR [\fIport\fR]\[char46]\[char46]\[char46] +Creates a new port group in the \fBPort_Group\fR table named \fBgroup\fR with optional \fBports\fR added to the group\[char46] +.TP +\fBpg\-set\-ports\fR \fIgroup\fR \fIport\fR\[char46]\[char46]\[char46] +Sets \fBports\fR on the port group named \fBgroup\fR\[char46] It is an error if \fBgroup\fR does not exist\[char46] +.TP +\fBpg\-del\fR \fIgroup\fR +Deletes port group \fBgroup\fR\[char46] It is an error if \fBgroup\fR does not exist\[char46] +.SS "HA Chassis Group commands" +.TP +\fBha\-chassis\-group\-add\fR \fIgroup\fR +Creates a new HA chassis group in the \fBHA_Chassis_Group\fR table named \fBgroup\fR\[char46] +.TP +\fBha\-chassis\-group\-del\fR \fIgroup\fR +Deletes the HA chassis group \fBgroup\fR\[char46] It is an error if \fBgroup\fR does not exist\[char46] +.TP +\fBha\-chassis\-group\-list\fR +Lists the HA chassis group \fBgroup\fR along with the \fBHA chassis\fR if any associated with it\[char46] +.TP +\fBha\-chassis\-group\-add\-chassis\fR \fIgroup\fR \fIchassis\fR \fIpriority\fR +Adds a new HA chassis \fBchassis\fR to the HA Chassis group \fBgroup\fR with the specified priority\[char46] If the \fBchassis\fR already exists, then the \fBpriority\fR is updated\[char46] The \fBchassis\fR should be the name of the chassis in the \fBOVN_Southbound\fR\[char46] +.TP +\fBha\-chassis\-group\-remove\-chassis\fR \fIgroup\fR \fIchassis\fR +Removes the HA chassis \fBchassis\fR from the HA chassis group \fBgroup\fR\[char46] It is an error if \fBchassis\fR does not exist\[char46] +.SS "Control Plane Protection Policy commands" +.PP +.PP +These commands manage meters configured in \fBCopp\fR table linking them to logical datapaths through \fBcopp\fR column in \fBLogical_Switch\fR or \fBLogical_Router\fR tables\[char46] Protocol packets for which CoPP is enforced when sending packets to ovn-controller (if configured): +.RS +.IP \(bu +ARP +.IP \(bu +ND_NS +.IP \(bu +ND_NA +.IP \(bu +ND_RA +.IP \(bu +ND +.IP \(bu +DNS +.IP \(bu +IGMP +.IP \(bu +packets that require ARP resolution before forwarding +.IP \(bu +packets that require ND_NS before forwarding +.IP \(bu +packets that need to be replied to with ICMP Errors +.IP \(bu +packets that need to be replied to with TCP RST +.IP \(bu +packets that need to be replied to with DHCP_OPTS +.IP \(bu +packets that trigger a reject action +.IP \(bu +packets that trigger a SCTP abort action +.IP \(bu +controller_events +.IP \(bu +BFD +.RE +.RS +.TP +\fBcopp\-add\fR \fIname\fR \fIproto\fR \fImeter\fR +Adds the control \fBproto\fR to \fBmeter\fR mapping to the control plane protection policy \fBname\fR\[char46] If no policy exists yet, it creates one\[char46] If a mapping already existed for \fBproto\fR, this will overwrite it\[char46] +.TP +\fBcopp\-del\fR \fIname\fR [\fIproto\fR] +Removes the control \fBproto\fR mapping for the \fBname\fR control plane protection policy\[char46] If \fBproto\fR is not specified, the whole control plane protection policy is destroyed\[char46] +.TP +\fBcopp\-list\fR \fIname\fR +Display the current control plane protection policy for \fBname\fR\[char46] +.TP +\fBls\-copp\-add\fR \fIname\fR \fIswitch\fR +Adds the control plane protection policy \fBname\fR to the logical switch \fBswitch\fR\[char46] +.TP +\fBlr\-copp\-add\fR \fIname\fR \fIrouter\fR +Adds the control plane protection policy \fBname\fR to the logical router \fBrouter\fR\[char46] +.RE +.SS "Mirror commands" +.TP +\fBmirror\-add\fR \fIm\fR \fItype\fR [\fIindex\fR] \fIfilter\fR \fIdest\fR +Creates a new mirror in the \fBMirror\fR table with the name \fBm\fR with the below mandatory arguments\[char46] +.IP +\fItype\fR specifies the mirror type - \fBgre\fR , \fBerspan\fR or \fBlocal\fR\[char46] +.IP +\fIindex\fR specifies the tunnel index value (which is an integer) if the \fItype\fR is \fBgre\fR or \fBerspan\fR\[char46] +.IP +\fIfilter\fR specifies the mirror source selection\[char46] Can be \fBfrom\-lport\fR, \fBto\-lport\fR or \fBboth\fR\[char46] +.IP +\fIdest\fR specifies the mirror destination IP (v4 or v6) if the \fItype\fR is \fBgre\fR or \fBerspan\fR\[char46] For a \fItype\fR of \fBlocal\fR, this field defines a local interface on the OVS integration bridge to be used as the mirror destination\[char46] The interface must possess external-ids:mirror-id that matches this string\[char46] +.TP +\fBmirror\-del\fR \fIm\fR +Deletes the mirror \fBm\fR\[char46] +.TP +\fBmirror\-list\fR +Lists the mirrors\[char46] +.SS "Synchronization Commands" +.TP +sync +Ordinarily, \fB\-\-wait=sb\fR or \fB\-\-wait=hv\fR only waits for changes by the current \fBovn\-nbctl\fR invocation to take effect\[char46] This means that, if none of the commands supplied to \fBovn\-nbctl\fR change the database, then the command does not wait at all\[char46] With the \fBsync\fR command, however, \fBovn\-nbctl\fR waits even for earlier changes to the database to propagate down to the southbound database or all of the OVN chassis, according to the argument to \fB\-\-wait\fR\[char46] +.SS "Remote Connectivity Commands" +.PP +.PP +These commands manipulate the \fBconnections\fR column in the \fBNB_Global\fR table and rows in the \fBConnection\fR table\[char46] When \fBovsdb\-server\fR is configured to use the \fBconnections\fR column for OVSDB connections, this allows the administrator to use \fBovn\-nbctl\fR to configure database connections\[char46] +.RS +.TP +\fBget\-connection\fR +Prints the configured connection(s)\[char46] +.TP +\fBdel\-connection\fR +Deletes the configured connection(s)\[char46] +.TP +[\fB\-\-inactivity\-probe=\fR\fImsecs\fR] \fBset\-connection\fR \fItarget\fR\[char46]\[char46]\[char46] +Sets the configured manager target or targets\[char46] Use \fB\-\-inactivity\-probe=\fR\fImsecs\fR to override the default idle connection inactivity probe time\[char46] Use 0 to disable inactivity probes\[char46] +.RE +.SS "SSL Configuration Commands" +.TP +\fBget\-ssl\fR +Prints the SSL configuration\[char46] +.TP +\fBdel\-ssl\fR +Deletes the current SSL configuration\[char46] +.TP +[\fB\-\-bootstrap\fR] \fBset\-ssl\fR \fIprivate-key\fR \fIcertificate\fR \fIca-cert\fR [\fIssl-protocol-list\fR [\fIssl-cipher-list\fR]] +Sets the SSL configuration\[char46] +.SS "Database Commands" +.PP +.PP +These commands query and modify the contents of \fBovsdb\fR tables\[char46] They are a slight abstraction of the \fBovsdb\fR interface and as such they operate at a lower level than other \fBovn\-nbctl\fR commands\[char46] +.PP +\fIIdentifying Tables, Records, and Columns\fR +.PP +.PP +Each of these commands has a \fItable\fR parameter to identify a table within the database\[char46] Many of them also take a \fIrecord\fR parameter that identifies a particular record within a table\[char46] The \fIrecord\fR parameter may be the UUID for a record, which may be abbreviated to its first 4 (or more) hex digits, as long as that is unique\[char46] Many tables offer additional ways to identify records\[char46] Some commands also take \fIcolumn\fR parameters that identify a particular field within the records in a table\[char46] +.PP +.PP +For a list of tables and their columns, see \fBovn\-nb\fR(5) or see the table listing from the \fB\-\-help\fR option\[char46] +.PP +.PP +Record names must be specified in full and with correct capitalization, except that UUIDs may be abbreviated to their first 4 (or more) hex digits, as long as that is unique within the table\[char46] Names of tables and columns are not case-sensitive, and \fB\-\fR and \fB_\fR are treated interchangeably\[char46] Unique abbreviations of table and column names are acceptable, e\[char46]g\[char46] \fBd\fR or \fBdhcp\fR is sufficient to identify the \fBDHCP_Options\fR table\[char46] +.PP +.PP +.PP +\fIDatabase Values\fR +.PP +.PP +Each column in the database accepts a fixed type of data\[char46] The currently defined basic types, and their representations, are: +.RS +.TP +integer +A decimal integer in the range \-2**63 to 2**63\-1, inclusive\[char46] +.TP +real +A floating-point number\[char46] +.TP +Boolean +True or false, written \fBtrue\fR or \fBfalse\fR, respectively\[char46] +.TP +string +An arbitrary Unicode string, except that null bytes are not allowed\[char46] Quotes are optional for most strings that begin with an English letter or underscore and consist only of letters, underscores, hyphens, and periods\[char46] However, \fBtrue\fR and \fBfalse\fR and strings that match the syntax of UUIDs (see below) must be enclosed in double quotes to distinguish them from other basic types\[char46] When double quotes are used, the syntax is that of strings in JSON, e\[char46]g\[char46] backslashes may be used to escape special characters\[char46] The empty string must be represented as a pair of double quotes (\fB\(dq\(dq\fR)\[char46] +.TP +UUID +Either a universally unique identifier in the style of RFC 4122, e\[char46]g\[char46] \fBf81d4fae\-7dec\-11d0\-a765\-00a0c91e6bf6\fR, or an \fB@\fR\fIname\fR defined by a \fBget\fR or \fBcreate\fR command within the same \fBovs\-vsctl\fR invocation\[char46] +.RE +.PP +.PP +Multiple values in a single column may be separated by spaces or a single comma\[char46] When multiple values are present, duplicates are not allowed, and order is not important\[char46] Conversely, some database columns can have an empty set of values, represented as \fB[]\fR, and square brackets may optionally enclose other non-empty sets or single values as well\[char46] +.PP +.PP +A few database columns are ``maps\(cq\(cq of key-value pairs, where the key and the value are each some fixed database type\[char46] These are specified in the form \fIkey\fR\fB=\fR\fIvalue\fR, where \fIkey\fR and \fIvalue\fR follow the syntax for the column\(cqs key type and value type, respectively\[char46] When multiple pairs are present (separated by spaces or a comma), duplicate keys are not allowed, and again the order is not important\[char46] Duplicate values are allowed\[char46] An empty map is represented as \fB{}\fR\[char46] Curly braces may optionally enclose non-empty maps as well (but use quotes to prevent the shell from expanding \fBother\-config={0=x,1=y}\fR into \fBother\-config=0=x +other\-config=1=y\fR, which may not have the desired effect)\[char46] +.PP +\fIDatabase Command Syntax\fR +.RS +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBlist\fR \fItable\fR [\fIrecord\fR]\[char46]\[char46]\[char46] +Lists the data in each specified \fIrecord\fR\[char46] If no records are specified, lists all the records in \fItable\fR\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise, all columns are listed, in alphabetical order by column name\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if any specified \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, the command ignores any \fIrecord\fR that does not exist, without producing any output\[char46] +.TP +[\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBfind\fR \fItable\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Lists the data in each record in \fItable\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] The following operators may be used where \fB=\fR is written in the syntax summary: +.RS +.TP +\fB= != < > <= >=\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] equals, does not equal, is less than, is greater than, is less than or equal to, or is greater than or equal to \fIvalue\fR, respectively\[char46] +.IP +Consider \fIcolumn\fR[\fB:\fR\fIkey\fR] and \fIvalue\fR as sets of elements\[char46] Identical sets are considered equal\[char46] Otherwise, if the sets have different numbers of elements, then the set with more elements is considered to be larger\[char46] Otherwise, consider a element from each set pairwise, in increasing order within each set\[char46] The first pair that differs determines the result\[char46] (For a column that contains key-value pairs, first all the keys are compared, and values are considered only if the two sets contain identical keys\[char46]) +.TP +\fB{=} {!=}\fR +Test for set equality or inequality, respectively\[char46] +.TP +\fB{<=}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<=}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 or both\[char46] +.TP +\fB{<}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a proper subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 but not both\[char46] +.TP +\fB{>=} {>}\fR +Same as \fB{<=}\fR and \fB{<}\fR, respectively, except that the relationship is reversed\[char46] For example, \fBflood\-vlans{>=}1,2\fR selects records in which the \fBflood\-vlans\fR column contains both 1 and 2\[char46] +.RE +.IP +The following operators are available only in Open vSwitch 2\[char46]16 and later: +.RS +.TP +\fB{in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is also in \fIvalue\fR\[char46] (This is the same as \fB{<=}\fR\[char46]) +.TP +\fB{not\-in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is not in \fIvalue\fR\[char46] +.RE +.IP +For arithmetic operators (\fB= != < > <= >=\fR), when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the record is always omitted from the results\[char46] Thus, the condition \fBother\-config:mtu!=1500\fR matches records that have a \fBmtu\fR key whose value is not 1500, but not those that lack an \fBmtu\fR key\[char46] +.IP +For the set operators, when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the comparison is done against an empty set\[char46] Thus, the condition \fBother\-config:mtu{!=}1500\fR matches records that have a \fBmtu\fR key whose value is not 1500 and those that lack an \fBmtu\fR key\[char46] +.IP +Don\(cqt forget to escape \fB<\fR or \fB>\fR from interpretation by the shell\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise all columns are listed, in alphabetical order by column name\[char46] +.IP +The UUIDs shown for rows created in the same \fBovs\-vsctl\fR invocation will be wrong\[char46] +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-id=@\fR\fIname\fR] \fBget\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]]\[char46]\[char46]\[char46] +Prints the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in the column is printed, instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist or \fIkey\fR is specified, if \fIkey\fR does not exist in \fIrecord\fR\[char46] With \fB\-\-if\-exists\fR, a missing \fIrecord\fR yields no output and a missing \fIkey\fR prints a blank line\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for \fIrecord\fR may be referred to by that name later in the same \fBovs\-vsctl\fR invocation in contexts where a UUID is expected\[char46] +.IP +Both \fB\-\-id\fR and the \fIcolumn\fR arguments are optional, but usually at least one or the other should be specified\[char46] If both are omitted, then \fBget\fR has no effect except to verify that \fIrecord\fR exists in \fItable\fR\[char46] +.IP +\fB\-\-id\fR and \fB\-\-if\-exists\fR cannot be used together\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBset\fR \fItable record column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Sets the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR to \fIvalue\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in that column is changed (or added, if none exists), instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBadd\fR \fItable record column\fR [\fIkey\fR\fB=\fR]\fIvalue\fR\[char46]\[char46]\[char46] +Adds the specified value or key-value pair to \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] If \fIcolumn\fR is a map, then \fIkey\fR is required, otherwise it is prohibited\[char46] If \fIkey\fR already exists in a map column, then the current \fIvalue\fR is not replaced (use the \fBset\fR command to replace an existing value)\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column value\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Removes the specified values or key-value pairs from \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] The first form applies to columns that are not maps: each specified \fIvalue\fR is removed from the column\[char46] The second and third forms apply to map columns: if only a \fIkey\fR is specified, then any key-value pair with the given \fIkey\fR is removed, regardless of its value; if a \fIvalue\fR is given then a pair is removed only if both key and value match\[char46] +.IP +It is not an error if the column does not contain the specified key or value or pair\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBclear\fR \fItable record column\fR\[char46]\[char46]\[char46] +Sets each \fIcolumn\fR in \fIrecord\fR in \fItable\fR to the empty set or empty map, as appropriate\[char46] This command applies only to columns that are allowed to be empty\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-id=(@\fR\fIname\fR|\fIuuid\fR)] \fBcreate\fR \fItable column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Creates a new record in \fItable\fR and sets the initial values of each \fIcolumn\fR\[char46] Columns not explicitly set will receive their default values\[char46] Outputs the UUID of the new row\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for the new row may be referred to by that name elsewhere in the same \fB\e*(PN\fR invocation in contexts where a UUID is expected\[char46] Such references may precede or follow the \fBcreate\fR command\[char46] +.IP +If a valid \fIuuid\fR is specified, then it is used as the UUID of the new row\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Records in the Open vSwitch database are significant only when they can be reached directly or indirectly from the \fBOpen_vSwitch\fR table\[char46] Except for records in the \fBQoS\fR or \fBQueue\fR tables, records that are not reachable from the \fBOpen_vSwitch\fR table are automatically deleted from the database\[char46] This deletion happens immediately, without waiting for additional \fBovs\-vsctl\fR commands or other database activity\[char46] Thus, a \fBcreate\fR command must generally be accompanied by additional commands \fIwithin the same\fR \fBovs\-vsctl\fR \fIinvocation\fR to add a chain of references to the newly created record from the top-level \fBOpen_vSwitch\fR record\[char46] The \fBEXAMPLES\fR section gives some examples that show how to do this\[char46] +.RE +.TP +[\fB\-\-if\-exists\fR] \fBdestroy\fR \fItable record\fR\[char46]\[char46]\[char46] +Deletes each specified \fIrecord\fR from \fItable\fR\[char46] Unless \fB\-\-if\-exists\fR is specified, each \fIrecord\fRs must exist\[char46] +.TP +\fB\-\-all destroy\fR \fItable\fR +Deletes all records from the \fItable\fR\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +The \fBdestroy\fR command is only useful for records in the \fBQoS\fR or \fBQueue\fR tables\[char46] Records in other tables are automatically deleted from the database when they become unreachable from the \fBOpen_vSwitch\fR table\[char46] This means that deleting the last reference to a record is sufficient for deleting the record itself\[char46] For records in these tables, \fBdestroy\fR is silently ignored\[char46] See the \fBEXAMPLES\fR section below for more information\[char46] +.RE +.TP +\fBwait\-until\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Waits until \fItable\fR contains a record named \fIrecord\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] This command supports the same operators and semantics described for the \fBfind\fR command above\[char46] +.IP +If no \fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR arguments are given, this command waits only until \fIrecord\fR exists\[char46] If more than one such argument is given, the command waits until all of them are satisfied\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Usually \fBwait\-until\fR should be placed at the beginning of a set of \fBovs\-vsctl\fR commands\[char46] For example, \fBwait\-until bridge br0 +\-\- get bridge br0 datapath_id\fR waits until a bridge named \fBbr0\fR is created, then prints its \fBdatapath_id\fR column, whereas \fBget bridge br0 datapath_id \-\- wait\-until bridge br0\fR will abort if no bridge named \fBbr0\fR exists when \fBovs\-vsctl\fR initially connects to the database\[char46] +.RE +.IP +Consider specifying \fB\-\-timeout=0\fR along with \fB\-\-wait\-until\fR, to prevent \fBovs\-vsctl\fR from terminating after waiting only at most 5 seconds\[char46] +.TP +\fBcomment\fR [\fIarg\fR]\[char46]\[char46]\[char46] +This command has no effect on behavior, but any database log record created by the command will include the command and its arguments\[char46] +.RE +.SH "ENVIRONMENT" +.TP +\fBOVN_NB_DAEMON\fR +If set, this should name the Unix domain socket for an \fBovn\-nbctl\fR server process\[char46] See \fBDaemon Mode\fR, above, for more information\[char46] +.TP +\fBOVN_NBCTL_OPTIONS\fR +If set, a set of options for \fBovn\-nbctl\fR to apply automatically, in the same form as on the command line\[char46] +.TP +\fBOVN_NB_DB\fR +If set, the default database to contact when the \fB\-\-db\fR option is not used\[char46] +.SH "EXIT STATUS" +.TP +0 +Successful program execution\[char46] +.TP +1 +Usage, syntax, or network error\[char46] +.SH "SEE ALSO" +\fBovn\-nb\fR(5), \fBovn\-appctl\fR(8)\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.html new file mode 100644 index 00000000..e730675b --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.html @@ -0,0 +1,1718 @@ + diff --git a/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-nbctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..e8038b20d3acb2e3952ce70a8c2287d34a76095d GIT binary patch literal 111075 zcma&tQ@U*yq1lH~T6gXU2%Q${hKO zcP1G?RGf~9o)v~{;Rh9e_ zm+B+?tkpqKeUqTO(&Zie1s$<_1u(p4Iv_GbD~Ca45hrYJ(! ze!A<~&+$vZCdicwVURca&%T%EF&oB|E!X1Xx~@RB=S}zJ zSCHz0gHl7pgV#?Kr;_RRsaH_g+AAjvve*C=PxG#lC zd6mt&-foVT80_`BGk7$*g)bb}iXcvwo8u*PaFlR;4O2Hy!`aPrls2#qt`U&AyVV(9|~QpYtht(WY?hxMaZd|W5PNf{hs znU0C_n{WF^Sp@pM??>-TOGkkU;u3mwN6_}sunuwe#vb1^;U|G|xcEnj(z&)PwH-!- z<1KGZ>#hyv!8~02oLmYX*x-R&hv!=nwkGLsPxmh}kZo^oQV;}T?N8?om{A*rX_sy@ z216j;hn}=uA6A-dG-`ibo3->8l{`01qo9;>Nh7%~^)#_}|4Q-@jt+;^(wGzQqKCJ~ zy0MI2%P%Fxl#xJ1DK!+Rs!PD!Z@Tx-nwDaFU6cgfj$XoXdXp$X&_s;h_eLxMHw06$ z?|3s=?dWdo-A=XqwqAQ&s`e`8!iWSfm=Q6(>Nc5R;)l{Pn@I1G)4nc;In8QvM|E{4 zT28ZWr+SU#(FJ3oouml(20f(30FxhD!ypI1d9~orzB#oNa`vi$s=RBn87O zHW>=RN<1u-jBd!tte!g?;I*L)4|^dk6sHrsGNZ}%N5HM2iWINiWTWM#YQt+L>Z+xb zV8V5-y7+#dHTT4Zsvm{A&H$Y6+@mfol*Qg-(=T>s-S8= z|25MhpL-6&!3e8!>r>IBNmK`ERTV^uaz9om+pi=8os7y98sTFRw(7M?J9{EH*w}^_ zy}FB~Majhb#c}EzX~%^u&~aHsG3Ca6wdERkE!mL@_m(*Qu?T##99%9z4@g*A(Ei)*molKTh?^}o=gMF; z^C&V02a$3-C)S%{`c%<$E84Ohi<>|h_RDE;m+}w(%%tLnGy9y|*`??-NF@+;`B2OvQWudY8WpgD%0eSc9_)2C z^zy3d#}7B@l2gIS8-keY`MC@xsu0~~DCF@vL}?jA#kF6`;@G#luX4W(n(;I$PMGn4^-1f=mz*g;5vr^?pPn#MR#x}Ej|Bq)rbxQ-AS+(3r=m|JhpzQjU>9)` zVhexRF4e6xTQ$N~K$~LDG`erqa{wK{&LNv)z^weg9Y^O0V`}EKDne$V-jppjFtptj zUfHIU%F2TTFQ5)JLmRYOHrDtJhfxwct#7oO*z;BQw&X-YYsnoI(_uth9m%946csZ} z7OvH-@7EhjNF{Lh+F)@-r%t$dB|>yCr$7ZqzQJN68QDZo{ur&v3-2TTwSp_ssSAn9 zKOW>1wC+mymE%B#(9ie0=gCA4eaa|bbNkmb6B{W?KGli7XfObhL{anSS0etyj|T`c zxs!b&l(c8|HTX;r29jq@$Ge4}dw#i}3_RNknV(BKE%I6Ys2wO!& zS7|nwa^Fe8!Oj!}e{DH9vHuKi0;vusWIhy@dBN}1Sn?7penZ)mlMdYhEaDtQoh0mW za^Prx0k(k8tDs~w(^Mj*i?o7_;sj!|1y$5gWl z+T(sAxx{k(C)^n#O4ijuW^gVLLv9f=`Iog z=YYX6{!fKlq^WHbKV55GV58PCr@dQ2$3oSX9g`DvzIE(VLKBB8^D~n# z=SE>cn|qwik-bOqQqorQY2CWd8RC)!lJZELHH2jcE;WE@%YugDhn>3kJf^N&?XQ9t zN8LZud?UCyGjqhHQsa6Ss~?;2#d*hrgL}Gdt<~|aOW1P>wpjJ;3?1S|{ zN0@mKz%N~m5tj1H1h%!w0?H@y+@g@&oPBQ&NL*X!PO-L|V*4ESCW65*fL0r7d5ah9M4rJod;eK1pHf*qieFN(|?aWvs9ek1?&s(V#)mEI@> zeZHO0XSNQI`H&aQF;Ww&#uiG3Oyqpt8NzkDa)@Cst&%0wy&i>ytjZ?a-Nom!d{*2V`bUe zj0J8&69^d5w2KLFMI_Kn;<}-;?9cPIFp;1F zEK4J|x3*ipgmNnpZjJp zcluprr?>hC7l_ z78h+p6k?t#QnSBg+{PsWVl#wD@ChuF?@u`M(4}?p*AC+NaM(A@v-t1^@>G&V2rn{N zV#8H47$4|)OzVkvxSh<4r~4&>aQVs>EJl1V+sEb?!>w$5cmFcYv(f|wkISP!`X2YA zq6gzKT6>hA%feJDD&yzd(tE)nwSU?O@H-MzghTokEuQ^^d<(?;2=g*L&Ix2XaVp51 zco&Dh|AAEd$MYwJ)!Y&t%A zTJyi1`2nuiRSGh-Gx=X4{hR%VRsX@%e?}G-HWrxwtub-@m${fY|1ap;(%MMc7)J8l zsY~Z@R^G>C39hQTM;wz%QI2GDMA zFCh*PQg}IADD%FhiEcAM`l|P@bK^krc7C{so$Y1*Sg{((Ww1MTSut{bIBLbx)v&Rf z6bUj-GIg9p@66Kt@aTNSir(!BqES6$y4I++H=F9xtcBO^ct2_l)fGJE9pO7hPaNWv zLT>Ts$mq^IsLU|18FIMz5{nx0BRLXWya@gE{K4)c?uCGkq1 zQmwQ-Qbf1b?xC;J-T0&1S*x+t*ukZut8CXwp?34UVWqwo&c^fX`VfYPPraPh8Ff{; zB(k>n1&`t2>WOVH3S}KTpdEdk5*LqbW>p{Bj@+`Wo)7+`MR{c?D=dbnYYca0V-^H5rhx@4A&(+;#*dC25 z{uJGKt-Jjcs2K5_(uvUGCA`D-9aWVg!MtDfI_IgUb!TS$8eJ%+ zkTtKnp64k`uup7nbAsz9a;;fdLn$}Rx5t~~F6h4h?Z*-LOCeZAoQlFk^H!W!h6V24 zKJ$APPd!{u#M+kGW2d>Qazud+R7)dT)`I8I)gA7RIZ0>e{wtzakcs-JP!ey~P^B`~ z$-(TRQs4CnxeGwA{bHB13}PR{@-jR!-s@P4Ov}1z8TDkTNITkLB`{fBdmgWC)4esz zk24|Td-M?5*juf(wC!OILXpw$LB*S$`Mjm9NkCp8=aJ|Q@5`=9OeBb2ufPB42}JWt zh1nP1d&;A*QG1;X{;Ad~UYW)yAwXid9Zi#3Y<0AQr<;c)k`sq~ri3gE2iT~^RT+yo zwE`1`=~fSRnHm&HLPuN}f-`-T$N`lu%M%oUo8`Ksse$S=K5(m>+)=F)vz^qQm$ni0 z6#DmGklFW=KS1SIIhTRq`AIR4a8%0m@9>i0eaV!eG+rTXP| z^gL7+I2CXWY_8rb7Z|v1E$gdTi1@S;W%h`aa;l_99xTin{AJ(aq-qy`OFh(_g(y~B5g*W_WSPLC>I^7 zonfX?It?tr$^!Qqc)r$Fa;;G!xS29gyg~-?f~Ak^)Mr=FSZ+uq=_<*218@iwn?C&3 zN7*+8#f$1OeNDbWplfDaK!`H-g$}`O7;^lfxw3RI4lVb)Lds51_e$H&lV2KVW&E1$EtU7`rET;CkT z>(4xIo$!>OP7==pR(rBjudxmQsw~|UTmgtDyEM{I{ePfPfj)JLd`TnscC#qST6FA+jvhm*Q-XRa`n3n zrR3MhKMFF}WANuljiFOF;) zSp4C*3nU5o1)oJTL^mFkO^-}cCf9a(xTtEm5gAr$vPE1d=lutfa0}H;CzS7~AiE&W zyz}Vtqo;$>ezH%{@O3UPbIC-7vVXeP-i2f_kOdiKr+imB?6oC070R{%fa1FUP7Efb zAUmsgj$8CLYHNgY-9;n(`lK}2W6_PP(DDQwRwptY_*;*sFm=AlyjnomKhjTtn;I@Y-q$i#g8Y5MJHWo8D7P~l7CeGrc& z)@y&jb#j-FXERVx!34JjPl`tWJxU44#c=(KIM{Cu|H(6pUx4O{u$MVgU($*}=_E&T z9Y(Sn_}#+lBiAZg>kBcG*cQpo;W&nqVvkySQ!h^LYeQYXr4<{MI)jgW>Yi;MSAu1` zwMzf-07g5b90C<{MO2Pd1b}ZA5qlr$laWdsD`9U}n%#c6YIC9QLqu#?CqwjR=Df*# zTAOoNh{oRl1?5s_5G|0R5FxWcXY;)Zb*r|OI*s> z8EV0BM7+{%2_Hl$x+$NY>qGGXk4#NUBJs)7xxfQGPIG$R$V4)%gj_-%!!0u*bj}=) zFU%JEunonR`X!X%g#{z;(g(`#T!Pw%&_lKoDw7Z0FO|l(FlLrjBNy4(Vf%#@){j?* zidk{)_h)`wQ$(@kRP!;fOBD~gnfQed%t)>{rc&ue_JV{`cjIQo@b65~t-HY`rOGaokU zSG^^~^n@fyL{)jnIb9Puyz+891bKzWL(Vjv`HmWnQM4QPb|}D|>y9r+bD(A_vlN(t zHm@r{=4`e~Q*K*KALLE(bgAM{(nfzW(62k29(K@oyDQVw0*7Nz*-tDOsIKewK9(QN zHF(sT?G}Iff*>wyr^gemwaUX|AqCjYh5ukO>G8{zX;3%v zzRXtrN-6(i%mF)IZ)%VhH+2Jh4QuhnK(>2_yB!+!LRrsX_3#5=Q}`Rr1szj91(H}9 zPRr;wHyEQ*Q$n3w2@7IH#fj86o_V+i@p5-V(K;1S{-Fu)srwE|_*n!=a4hv+mj+7kXCZtBca zguVA7_}D=@5*>NCuT|ClBXsz=z|T@7)2-bh!8Y^lW9{^>Rf~0IVG3QmAV+_)1zUPlIv7_p6)7GEk4oMu+XSt{xB%{=m zZSaH10AR^$**RZBBLawR=f_tJymYW~_va#{A6#8GM*NAEfhpe`^A>@77GWz+7YSP1 zk>Xy=ayARMk_#V$Cd1f>50YFfQtbJmi2`Ge(g;qWC=f*Fh)RzHFS|na;>a}_uF3I9 zYw*OwO?m4+XDao{0l_wO!92}LxBFjKGkUV6LlSb-nVDFCC=e<}8Vc=|t#W#?l2 z{~627^k0l+X8yl0wnlR!X|v@&j5T=so4rUci`d0|1Ub>FB%O+8X(Vv@9w=huhUqwp zG`2Q(jFYUe=09l(1jf)1)!&f}ok$L>RvrDTwWpH9 zQ-5y7Uaw3%Any;D^&>Jq1TCzHxo?Mq{pO+B(WiKoCvJmah*xY`&-eHI8(UR;Mv_}? z>WvVe9@R=DRl^+T&-Pd8VaaeYHsD6Q5>p146>U1I? zxIWBY#clXcguDGUP9-OHIO;hwEwf`@XN1d;ufkU!qbm+ zGliv}C%G)}ow1(j z2|PDU+k=}n&@D%qc$PWVF(ewT5+3lrh5tg0-Pi%pqcq7&Nr{`*8VQq-F|^8USS4r} z^5uW;Gba+3_iuA^*Yu^~ftv8by}4{`r8&*<5W1Y7iG?>72x_=JokS`Ix?G>=2EBrF z%LE0ER}yZiNH+M4m}w2pYtq-#Xlw#%>*Hn+iQb#_Qp_lq6FPar^k7@I2iwxP zQs+E?c-;BQpH%-iT_p)mdQzzhl3=uz(Y%k1xoc(}@s((}?n0x_n_0x6fr$h@s}LW! zAUkFdl`OCilr@!^=Qukz`nm=GSbg5TCk0f*oPxyZgT_kEooIgd;Le@aCqts2B+fop zbn;g@R|N273qrzH&a3i~p1Ew6JFP3dTskCZ@{o!fD|86W;R4SDan+qtx24FZl*jYJ zjWi*Waf{eiR{K@KI$Xn*%)^(K<2Vlxqhd?#IMmA1T82yx)a*y9`9wcfB`uT!0Dg9)xfZ+xC z^wW+WI++H`o=aM~hOhu*^|T0}BKkMklv;Kdp#wYEos$B<6H*KD*FhdxSoT!F6aEj) zz$~$Urzk%~3#-k`v3I!FJJNER`1XmH6Ds4K1uMQ^CKz-KF5I4M>YQdU6e#jAZahEP zutl6io|vUe+?X5B75)HYq>ZqkuBEBF;H*@Z@iAw|J$PJ9%?bD~qnw_yvpVXRVlt2@ zgM!tsy;=4fnUI!6Ui+XHRztSZBZM@n*kqm}1j_si&FeHd?^odRPwF_2*js@Id+*l(d zef=#4K2==b?bPs&no@Lh7)tN)d^X)qX>7Dq$qN&7MuF$cf3nBlYBwguz$HQI(NxbH zsD%4N@?ywuc~QQXIiTu-OP%$pFqOy?!|Xe5huoAF1g0>BDki8+4ZG=@TZJJ<>2H#t24ps|1^7u&b_`*L=(CV@#=Kzj2d*yd&&KJ-RJ*NtaQZhn|lZMC6Czr;vs$Zzrx z{~FT^yU<+u-G?$7VX5H{*#iE77claxg2y&vkk;*W0vy>5Q@@+&W7)Ib5NC7jvbRtn zIrKFG);P+$2_&*054#&66%h$#aLobSK{V=MDCf6eBGj}OZE(tEul5C_nozMeBK|ezc{;9BMztQXpBm*zT@`*{ zN7JacG+sFA`iKIi$M@risTKUV{MZOQ27s^gNcsb4)?Gho@onYhG`Qo$@maKI%Hqe? z>0})l!1EZLN=_gS;oM07#i}oo(nJyom#F-LE*0c)hTP0QWew@$Q$&X~eRaB!Jw<%e z(CQauPC!{HU7~0gdz?-V!lffybP&UwFD|wn!oq777hqPrEs2HBQJ3hsSQ`mr-pwfO zh3nzmvL-thwL@^!uwb6{yqMbUqaq=nVur1)*k}G#L+l`A@~*A=jE)}(Y^v|GiJV>P z|JjAUs$%ZXNIpi5S=`3)gL;%!GT;)hng%_CNbZGQ zFeI`2cgHlAor1=7qQDI`N3yW0tD#~2Qlo~!Va zg?R6s7xi80AGK2hatUT_$NX+I4lZH^b+8VaCNBOIMK0&+U$pp7mg zb=R=Yv%q9!Eu#pmGv}$8f2+%xdl1GJMpx6R9MPDhwH_7NufwYXSdbbDwKUM@nd&5n zS|!QmzBv!XENA0MP~naZO$^NP`NB-kzu2P&RAf#wrMIh_be$etL>5v$S6hVhc8m%GkRHr|DwUl89FJMFG zi-mj#*<1d^qGm19TO%%1Q~#J!7Q;lzZh?i43EuOm<%&4n4TZBRJ>5otP8Bd~hk{3NVrs@%}qkXO$_-{CsG>)`IAJ zP?(cp=8B2lWeTN<{ln|s4I|5@!4S4B)JHti!=Xo?jXhW3BluDDyV&5J^VtztI>Y?Y z?Kz&~7h50d;7qcxu%F-4!aSFOX6n9=)6WA21NsLjy6A)X>(MtW?n|#%kBZ>h%L91V z+gaKU2FNsCOTJOFoy53u9^;VYcac_(!-nD*Ud5Hl1X4$Xq1nkiG*SCKTL zJRP&;%V3r%TJDw&@jEV`O`wM1JI?pK$_>FcJ zxI2|mQApH}z9{JvIM9mY5HlFQ-(30KD;-;2-DrIQV=zSKJ!)rJRnkp}+qTcT-DY#( z6x?t#6f`u}j&ED?;Ju`8>xT9q)F(C?1tw^JTaCdfp*SY;s@s9{a4_=OYe`;b*G_)4 zXy&@ev>Vi)eDJ#X|Fz!UKbh#wt!bJ?lj%~)_V82|s`&y4iG40MZPC|V@SM!1S)XXY zaWo<}CU^^#Z{FVip%3qBOU#Wb1BPdb59eRtaQvOKPz6dmN# z0wDKIXqpur6zGxoPe{drZJs)5=hnv2VEB>YJ^Tv~EB#KLD!~fQ3)Y&$&1Tg$S4tLk zo)v)Zo1Qw-1mYk_kxC>FD+?nX(h-WW7p{YXy4!Vf zcRvzg{rp!4pL-aj2uv1TJ%2AmQxO`0jc-UBNfN$;wKF|)K7i_)dE-=mQO-NCKTy9I zz4Chu*OLm7ubm3<`>v`*aY3V_s46`&_*Ho3wjl6G0}Btm`7pH-DoR%qPH&s~o)?zurEj2e-5#S$lb zCV(i2sUX+}$!yVCYy?w;CgxY=@r zs1Si~S7!DLF)nC-p2?P;Y&1>?=*t;=ky9wb=Q9L=(@Jl`ndFG_hf%;zcp$$9AuXq* zVt?V2umdJeoQJL_ydD5eQ@+aAD&yJ1*OYPuh8!mueRi5;)Ohi#x;(+6vPnHj^HfZC zIA5ybeF(x)0T#@}kU)smyGQla7fWfSX!Q3*lYH2s+H3SL1C*q(qa%2(E^XzP0o?)neyn@9mu3U(Wzx_m1DdCEt8DpYSzynz?9buH>67o#{99jR2 zwF7YMLNUPfgHLamovvptBKqPPCHohD@SgbcBqKvqh4F)iJnwT- zQD8VF821&DB8H=B9oy+gQyw??{vtYs|Cck?!Ss`jL!fEw>HuTw6OsdQ97GCb&?3pZ zPSjFesP@h%Cg*L=Z+K19gi?S2aZ(5xVY9S(UHxrekj{@dWjMuxt)^b&TJLT&1!DNE z(yG_RT?nPe!O3&}Xjz|(Mb_z%RCuF}bsoNsL!B`;b}O}E?OoBb=Nh<98@3g;_AW%O zr-ojoqDCb{BoVrQ!*>dxJMfpITzEuNN=1gRR<|e_vMMnd1A4O>nU`r28-sxcZ9$es zwVjwP9U*s)s@8>WSw67~`Qeh^iZB&iHVaoy7*?v-HL5a~8--^cY9B%tEu|(G?4vlw0@9~JA>38Ll!1QDM2OG<`eV;CDn9%ej+dLr8yt8S zTAJCvNogKtHLxS>|G27rIaPC0-4B}@zudkJnZ*aLj1SKbx0vcsd~8j6`Lrde9P+-1 z`W##t*rokvaSI>H3e`T21-iU68*5gHcsqR9Q=2VZKkXQGt}l>+vKXRl>Hs3(SFG*{ zgWv1tarncGy+HPlE%r~c6WfQ@D@$Wu8?w`OZ_nrF{nUqg9)q60&Jaw7pO5qRyAir0 zy3zN2^W}xoQ!uJ2+B#6;n9>>)bGh|jdSF>mKbvHq1~5IUk@8a5>jV_bB2ti!Ly?}D zaGa)6kwAgR1=l1d&iv9+oN1T5Vzg5NJ8#Lq*~How2~&c^`+Dh^tD5*%VQ2C9LZ8VJ zZE2)t@?wf_$PmN31EsaJSLBL)nHQDAbwlG>KI-F}Iq5-R1Y~M3fK$CLub1O5T1ey> zT0ApmB}$YsXDkMR^-rKJsgH}n=&@_&VlHXK%3f-(M%9L?-Hb}e1HkYd-!B=YhEvz7Dg3xHu6uvQgd3VqO#n=LV z$oC}PCz@;*YS+3IzDzZD_4?8=4J$gqVMZQ7aU%nWR@JL3OA>yB^Xd27A{d&^=G!7Xu&PKfMjn2z=&^KPP5R?;q8*T zSGLUYuOfEFPO!%~@EV9u721F&^3#KxChSlTF(%shd*G5DvP?T;5z8o*nz z5PE4`=!vxkC3BUSee7Z+=YG5dTPBebxTOL?dQL%x+1yS#hChc)S@|^oR`g&;V;`#&uQXD6Ql!~3d&U3qujXq^ zo(}A4r<-rN3{!5kOiV*;`iF%Svj~Sn{o)Fsxo3NtI9ua_Kt07f%q}GZ%z32yXz@%D z1bM81q7jnCBNN=LAL6C*i3{nWBdO_$(%f!(H=0dDzJ11$ADLHT(zvMxL#9CIOXU|7 zkZw^uW@BUewX{}3#Jj@mi^h;U#`=3J-YmA4mT|Nn8*=vgU=@ zeL@mOxG|a$~C=c&YmGjCGM#qO? zygNeMT@BAhYS_wc60MxgA=u9JGYYUk11D_^zHN{7P`bZs!;>0^L=$6=r`M!l$ur&} z9laJ>n;U{q>~nQ$SHJw+gdnNRo|t%u?>9iOLrBH7r(8$(Mk^}?AagQLr6wO`Rjwh) zF3&c~IQk8ok(-4{Sv`e8CYP%K#;tXAq|Uf*UUGI#)UO3 zdGFreF~c5mM3TG6RNet~Sk$7l95IsUZLSnWSqViw`yuyP>WfxiRRN26|6LNS!nr96 z%{~?F+VDp+p(;ws&UGdSnKK_L#3ty_v_h84d10HA+2YawMq4pTp)C*Yf zXW4lI8zmL^^bM*M*K3^p>s=+mIc$C_ZOK>3E@UtHD_79IBTGtY>JqJlo6hf04Y}JG zb_Q0Z?9VLD6a)Me%!K)U^e?NLA27dQUeSZeA69g)X&zWkE?vI~w1UPQBWlBhnKF*f z;pB=xrFq6;hcpz`AVhJs@OC+hSoPx^s`RPTPCM`kW(> zhmWM+LLjw?Q6>TBL*54`m#QYQ6Eu6`CnL_ zt#8F^+AC)nUHlH6&21IRC5{6q+1lz`3OvEb==BtNgG^Q%vd&S*1?0ycKhRUoY0X^Z zC3V;7Vr!$IU@}P=G;SDgX^|#j0~3>RwM{+Ihz7(9CyOp?WH;32RuY(HUk;!9aBMs! z-C};o9~)dL*r@Y1)0VY5^${Gr-@iA~O0fGM^|l{5^pld&{nTSmfyGaLE^B>`Sz|@ZWYTnWFQ07?b7-s(CWbh2s^6me2^8ag;<>2J_ ze+eVkeMJZS)31^J1P?X?>YaIaFjfq+)uxO!!psI z6oOHGcM5GEtF*jqU&-6(t#45}Bho!mXpsh%ravlshSuv`>YC{gSIl+OJj>y{}o z{>9g;HOK;vT`IXftS6{wVQev^wXJNAUXL>doO}2@GbzzQLZzA4`wfDfq?<;w$wNEq z#x?|;P_Mr~Mv2UWxX63x8-#F<7!7bnZ=+S{y(cPu6F%6?c^6B%b_!t(9<(9v`TbSE?0l9lyP<$`1piNuj<=QT8v}Y{axh0x z6z8JqcJ1x3lEwH~z7xHr-?TFm2LN=^VE^A)aG1x9jL++}gcvwskZ+qfkWSzTtaMZ_ zIQW$aFQ)u}mrpu`y=khohV;_;2!;8bnBQAjzqj&cx)pALANGVXZ1vBNhWT&z(DOtO z_)|p`!m5&R8#c}v@g=wP^wg$G+@!HXtq@!^YuFnU4HaQ$=k(g>&4EwOP;cLplY8S+ z;waK+_M9Sh)2GlI-Ub@5MrWya)~g;u$SY=IoH1TLJKEY@u3-YDm7{6TZCc>k@&ne| z33jYyLOYCM>sb-+d)DMu_f=#Qwz@xWpJ|%g$HD^?*$WydKMJgX{A>?a5yKYEVmrYN zwqK^OfVK-RH;=TBDO6;Eb-53_Bhx$NP!-v+zJ8o>3>iQ(h>)FefV8U9#|BV$r5=?U z>^qO3LEum3jM+0q2Eb~Ov3X$oXgh_CLW#7s$1HKfqwbHJ*g#jp$8um_We+eJkj7<_ zy$Nw#w?*?%{wQN>SD`;z&aU{6$Bm%5Log*|$Ho*o+``_%dJx`Jl6V1O!EKdk1c3|U zr}mszCXjf&&i` z8UKFL5}}u#XTRO~Mgo!uQ1Pzc85aZ26Rb|yXF!pfU8Lo81wq~0S`hW;c{XjOZV{xp z)T~0#RIO8+ad>|`C#FH5PXp^$zGw|}X^JgMiycfc4oH7>^7TQa7{J}xc|ug8m?FlO zYyWwCe?Rq#o1s24N9Q<_yTR?Igi@%(ANhRkvyvfFsGGiE|C!R9rt-hO|8mgT`dEw3 zTH3#DzZ)Me#9lTN2wnPn-*Fj+rZ%K(pvx7@GeR-b%Sk(9wIjCikk-JUIX>i5Vf}+sy8BUH<@D^kb&j1rvRh$!(73;LS}WUMp{wGxL7v9N!bR4a^e-l+O^k zvm&e(Lawjs+Z!}pta_h6&|*yZRXAMze}Rsr}5S z@jJ>%t#;TeK^VLTV47OiR~nS{htYx}#Ubg1TrfbylQ0TWY8jP=M947el?v$Bxx)JN zs++Uw64}{AXb{i`2k*F|LjUtQJY zwsjznN?6RyQ&`6g1+O@Jc0Q(oLRqYoj}?6>@pC|N)S0lN?||;j#XM3kr7@jt9#1DN z+53vj8YEraw^8#&lF|>Ej6k23G-s7zq2#DVk4-~#$E9rd7`#{#U0#=RW0jbPJmOc|;BX*7Q1Lv85 zH3blGvu?l@xkA-*?Y$A_h{vO_!`4`AdQP}iU%k*$r_X?e1@gDeWhV>tOQZF#0$70# zUh6B!m8lHlUjRaup`xZhBv&dpa}*phZu}%C<&#|D>{2wy5iM1B*wa(#VFN-6vIe_( z5?ol>RX<+q9=F$P99cAa}|-B@)e8wAi`S%J?*u}b>AfDq^BsC7dHX8`WQ z!R)+yOlO}d41iGsj}?U;N~0v)7`2b^m?m7nr(|#yVO80r@+~Gm;MQX;fc>E0lKSv_ zSDi`~0xhh%a2s^(?+}8AxaN5zy>wA^k zdc#nVOEg#P3$tsnF7#<5$kJI>xi3_8ULk$9%fzSVVqY+3s9G#e^{OTxRArZxK}_$i zMOj@Ib@Mse+L3mj8d>0kQyK$r^1B@W(1x9F(2U!C-aMWw3SPRNmQIOA2GKa@h6J~r zJb#}S7CgBI1D&UzJ^;S0`gwa;-m2f7RGQFKtmNvL>9(fjj|*87_EI(e z0gOx@XPzKF^$IvwLq#_e@i~_rtbamYn2gvEa*JpmRIu3~l0)Spzwhqj$OIuGkux?H z!}_xigo|8R*AcbkUX0Bpb7)*G5};sA9ZhL@4cXWQJ_OlJxIm{LIpZKV>5f802efE3 z*R5%U{$z7*1lb2i7%>0G=FS*2BgmhEZ;Ltu1B_p!ixRoF=WZT__-VV1f7q_)WkCk zNwo0+sW=$mLxBR7X-5czZa^rl@3bCwEMAov;n-0;qszKCrra)tw`##Xn#3X&9|nJV zm}2MTiinm>=HlB2bs56~9%b{Q>6Fm7=7k#zG03uupUmCTi<%TR2h~xiQl~Minz-%( zo)3wvKLxD$Befa;GYL~=GWO;j>S*IU~&aPxpQF6LOMd_ zaCuo_>Y~pVPo5;DQEM2QH}vy(8ihAoV=12^5R^~QL;@~?WI3_h%1g7SBu*|JEaZ%T zL{MPnM1>o*r*i7YdH!u1jvA(rBneYo;U&=naR+$kGB&eiiG<>uYYbK9oW^`e(ChoEZR z^flcW@&lx~I>;t4XrBtb;L`}2PV|PF0D-$4ThK&(T*&owH{xeLHU*4y+73~=rxR=t zGNj&*A)r2!oZ`v@Vis)v3ixc#H;xpCw^d|iaPt~i)so-sEeS+M!gtkFT0!b%CQd?u zzDslIy)Z5j0Pxl00-CRAKYjD^3hCOaDjTSCe|K+tidGS0S$hsXVwbtz)V7eZ<#Pr- z5s<&u)YpFIQX@_52_z#(L?aRHq_rrX_AAX z>Q!#jRoC6dQwXXef$ud$+l(0&%C!mXf&si@DqYWJl>M0&!az}l78MSDb1qJ=a+k0T z{Md|KPUKyRsK^BEqd1GpZ-YaN%P=(MfalwIBDviWiSs4TriqCvnFZdw%(cSC1I!#V z63gTR0l=-;XTeLx7Ft_nG-mr3LR*d;z$&&o7?7uZD-hh!^lG_pM*~g*7cF`Hzx?+( zcWH;;qjmGz!$EBp>$&acKxt0E1aRmMroB)7;vm@p;1O_9P8=|5Zl>y5A zP==NM#)iq|j{Bh~uUed{(~g%X#0>5{K5*ZJ>n8}w3lay~K^A%HH+ib5r^`lK zbrK-P9{!po(#8lg!43bw62m(+*BHbTwSUi1E^DNSPJlAGfn15VEV$r8jk!Q_5&-t4 z%kNn0#~^*+o1WgC6gZgo2h!|0Mfk6>^*<%*|ECgJS^rv;DO>-Ub8dGa z|L0S3R>=zDSHP?6```eWZneZ^nqJ;r z8ciIL8ceye*W;s4ZVkZJN_SqD$pX-)pKbJZ)v9%F@0JPqOV$EpJV2~1BB4MD!icpA z%pT<*kC%gb$5%-ZJP*QK##r+Ge8%_8R{2@h7N=i-!LA#$ z1(>7V#LDMmBNC=ZP)&{rYHC*hd00H#_AMJ;w;#?jkBPm=_z0rWY@jV|dN-cuV04V= z2N13l&grXZM<2Y}8EMxl(yn1V@>Q+Z)?l&kSfPX83ypKFn%I}EX4NFp8dn*r`LkPh zuK4)ja>zq=N%Jzk+PiXqK*GuBzWaPW!~WQ`D&zMDkl}1jbdO(B+?>^4G|kvSz7lxX zH}C4X(p_$7`PLpJ7a0+LzeItP+%x3zZ{NJu)z#fncBF(c3hej#kF&dKn|(}SB*t)Q z+o4y#c5Pa#1rP!qruSAkd2|?_UOr!}H6YXVWqR&F+Aloa(yZ^oD{J!Bk)py|{&4f!tz z^TfS4H^oeV6dY3uYo~{bV@Ai`uWN8nsjxNg=`7Gj5|2udsczyR?CXl|cF}hr^+nD_ zN157Y%OShQ+~$Y6ov%QE~p3Ea9wZwR3AO~t15XMQ2CqBR*Wr!?F zX*vhOf=8g-37%rR61PSg26%PXg?)$;Wbid){Sv?zJ{iO{{s&Wp*tF!kW!T_ku2$kL z^zBlw!&cM{u~!biE5>pM$b=yXeu+>JW5A^A?4*kl1kqcgi>Y0^WmG8$8w|@~deyHA z8qVp#!)mPp!QLU21y4d1UGmuT?|nTby|l)E#s&uz3^X)#nVzZ=;?l(&gmQ`DILyO_ z4)Z~wJf`{|hT)^L(NLCc)T*Ypk6L-i;j={@CM>%8kCaTg#7;%mdxk~6tE&Ykt{DaL zyNYdI5gB4EJn$lm29s*6i^sDS*Zg6q?z~GvE|<49a;XRS5J=>;%q?}6MINqoG`VsU zyUfqSzYjzZkB)`uJa`;bQw~|+B}E83mAi0&s2RHr=VL%0GXU9qLOx5j)gQQX&^WPE zgf%x*<>d@P{z(*PpsA~t${Q=O^KwLf?7+l)%q}`}8!BDqMQ?>iQnAE|&5$)|l%=^` z83`pi4Lon`v#BXiE3%}6L!($7H-f7`L*)CN5DTljk^PU91Ew^YHmt4!v_Ys(d0fOW zhrk4it(A!MHqu3T!+-@r@&VV0sh26NQebGpPg|NeN7L*$gGUY%KaIhWj!XPzgneJmatB6F_O9m_Iut$rX5_B;hsA zb3_`C1J}>MQd5{jP|1_5c-I*+&5~}eck1N;pFt}u1AaUAA&KpX@fMaB$$H>St+Wk!{M@IY zAw;2ZP{kL0W5s~RT=M;U`y8rH z?hHsBB~#k+kPv!EqMqR9V7)}-bYXfJ4_>z`m#T|pR1<3}&lv7b;-MSdi;5Mg8u;oB zpOj$n1~Fcjd(LxU7Y(Ks-hTz#pAd!$2D=2f;38yj9YcI3Qq>01myK%$Rv_pi1MD%D zz0#sBff%lV53_+m=@Qz9$Wnizg2m6>rUx=1OR>$`w@2oUAJ_yXk=N7HL_?(Tjf@$+ zEMZTpRY$i>sl> zm{hhBX;|bUH$-aE-(VyMHw**PqJLIxXDy!AM-34QWgbp`)bOTgM#lW4lgeI0f1lHR0k&6*4)u?-YkeY%e#EoK8cv0X zxGe9b%z4=)4|w$f8LGMG`yL0VNuPD070Yj4=En=|mm*NIRDab91Mh)j5kpVc^}h%A zvJ>QHCiK>`*_eiWd^g%x(1^2YK?bxUU>0yX=5KEHGH_&AY*jT?f%1PRx2j?&`_J8& z%FVup@HQOWH^(N}+Yf!v^0?wfYAL|y1xIpJ$A7=!e^cixoYAQ}tzKA*I#ffD97wZtS54AENuB7ou7!&W8^JpQ z*S>^wnAmJA?4f16wzt;GgYfNs_gMq;cdJZ?}job_=+ zdi9gwzubh-jK638d`6rrO0UuWDMz?q5rFD&^|wO1 zm#=>f1bG*e2zVkfmGtQw;6xzVZAh7wG5aM?xP`(#lH2{eu!zUaw~uIB`!qYc#lfk# zsNFSM>e2H1Vze9_dGt=?5Z;n)iZGdGVZxn9Ipwe?9u|2{Rof;MBt<{x>BP z#L@k}Ki;HMMem;k!P{epy@2l@!Hf{-7aZOOLsZzBcE|H(*EsyXTOPXpNds=hLNAnJ~- z8v4ux8GoE{5JP5F)8Twkd;fRYs$n|^30Ak0v*tvvO0@)y5uB5sPA zqa-M@6}Eow*IQiA>;I<9C$A7CikxM&d>UnINADDG9lYUn#kc%7A`a znYdWqNz?ToMS_1%7CT{%wP!iz=4juaI{H8i*-hPiEf@D z(bZJjf|Lo~%L?u+BIl|R48)_H+(%{G+?qmr2JVlu&>pBRL6jlO#cXlsjF`xDGIS#L zem-$Vx*z%|Ok;t|F)#RoZb`B-iYVEzgfgWLt0V+u5UT#Eg0SEV9#i(~ry07d3!-Ea zN8wl^?`g8LSi8+>Z1u#d!lt_HvyCQHZQYp(x0?J{o+ZUb7I$9k+mY69rg4l?%{8P= zxd34Q`wLR6=W#fgw=Rv3-^JwN(GB1s61%W-@O4m#oiHH=foFdsnVg6K7`0}_M zwARUyn)2YcJmLFt^__K>{ps$Tjhi13##wrcXCe;ia#Hi(p7yE>8dn+l&D=y(6ZTjI zZ}iW7XbbXg8&u8f*m1GUsv7ws&3TeVMP?C4)Bah5i>r5o)&om;;QLS;cOZAlH`yf? zBdGRP7^()_Qzu0Vq>|USPy&r~#73m5M}+K4bj>XxJ(DLmF!ntPweI zgI87ANEDxZM$pEMs>O8@46)--vGxhNSJ-RhEZ~ik5C!3IEhG?BgeI;ekXmGyKu;Nk z*0v<5S@pNQ0;)gY1M?wBnLCC`Aq0X%lS8E1OULp8H`}yf0)Dy}mw#Nj4WBbn#6Y`K zEe4C*W@^J~&uz(6>9`ml`g8*uxX?+WG!Gh@Fo0OkZrU5ToGqk-p(3crru#9f(ewi9 zw=GlN+q#;r$@+w$@*efIKS!Us00z&1tyHKPGTcH|QLbIeC5K{t&CUb!uO_Aym*~u1 zr4{tkb*W-HLk7*@GP8}BypBUSf&WW9;>QZ#yhvX~C@VpdCqp~+iUfhjK4!7~B)g|l z5&%KDFteK?+(N-Nz?e#{a}@C>b6`07Z|tS|E(&vHxIoKE;K>#87cE zwBoutDFpJ%uzhlW)4E&k&^&2{9u7Y;u{oyjAjFczO@SJ7g4aKhq=t)-;f9$vvNtgN?=;-AX1-vfc*|LSD( z>?DSmZ(jo&w9cZ>G+fuAhs_o&TsSBY3p>|u0aJSI5u~GSlKTLjujJ)zt^^vdGu>dg z0flz~P-ig+Wu{A@NNFBK2PFQi&S3q+9Ya%f1wV_>Bhxhk4Z(t zPGp2sf>W4^bmp=sJsZ0}LeS2{3vnJ$^ir6@ecNaMAcw!r$)-N^O8mzs%_VNSx45`) zo_^b5a(ovX!ZSR^SZES;11Jd=0Liq^xDZS!sg{Ypw%wGsEp)+`0vfyDINZ6_eh48mssvByoy; zSJ~yPhBiMG-&x@WPP9<{tjsu!G%Y#G9FpdqFi~jN`qxr6%u!=p(0^Fbv_#Zu*81#S zJ9)Ve%p86}@Bq%oqC^#L)MU#s`70*{RwF=TL_&!`^CN*Po}EMv2*GjY- zP~>4t>z;K@HN%1c6e%YCa#_D#Us!(iz zt<#zZus$>5R4eTbz)l^>5id@fhb1SLrO1v3s9@7p=V-3cnX_p{feftUaW zE>3jLt!m^R!^mlGs*3M4hBjyh-JFiYc1|`EYdQ+udYsszde|4+uvscRWJ@O*Zp@(UQw6U<>hs;yfTUC`r)rM6*3qaIRx;` zygVyG@<5^0)CrI>ZCWW`A6O!)z#)J(k3F#1maCNEkv$3qV$}GFn(dMz*`X^DMx}Ru zuYQ63LagKdJS@1$$g+&zAV}TCX)9(FTubp6j~~8USvNSW+Tdhck+d{K9`Yj;grwRA zDj zudpQsIx*t33+XCEpq%hcOzC)#0WLy;ROe;t=4M~uWlH%QR<@K-mY7?Su11(~<@XnE z0SX85&+jDmfRrwFjd%&jJ_2%TTt1djm5T1QQuhyTVc~!)D;wHf83#g8rpyD9HTCn( zAy`PvAd1EZCMaseU9Pf#KoTi0Xcn1>q7(|D2c-~$zUH$;73>TNON7cxKP4i#9v4Lv zN2AOY4J#PM2XF>%QW=N4vrgxxO)lAd7Vg5$8aE%=9Zy>sp&jJPQJkC#Is@z{ia7d3|A^k4wl)f5Dk#%TTi zO`2qpXYj2jZj|!w+5Lg|_fy~^xKr-GGx2}2?*C+B4%Yw8#H{~~x3m7A@b(k!S*Ps@ z8&f z+S*d&C&9MB=YM{_yS$$gMTyCgzZL!K-PMsh`#(IyM&%l{*E}g0@oVF@Os-eDAF}lWZn1 z#ee_G8W8%pJdCPYH7@}tm=>CHXg)Yc zQbg(T`?a;oxQZjXAGG<)Nk5)MVGu8R;Hw$1C!nfEV$hiirQ;4vIN>q3I&3AdGMt>! z0i;!T)ReGTq);E$F7Aaxk@YQdLLf*iY9T`j$q6hJeGjkli|%2sYbRM%tjf!yLSe70 zw|?EUSVl$xlBB%>gr!oEcHDp9HM|XX!grkjk+}1@Q#!f9fSPAsbz~e9jjHY$f}=US^3J7#Hy)y%*~s|~Wz!B(1U^iilE9nO*5YJxn-Zjph_saa z4b{WnMwAd%x_cCp(vz62a#(U^nChM-#rC}Wpi9r;t`=))$a7qUAuwi}6V*X}w-uaF1E~uWiX$6bU;R|<%rGwuwaAj@{Iw#_0iYF5{%03; zJWe9_a0g>(W&98upPW=Oi#I|x3oBfs6x07AE&{QhlG{nvI+irY)-wFX*O1xXqlL4s zKlJo3Lr)ix$4Ds4T0@HUd7p&I%?wQ}AluL6j}OtUa(7(y^fejcgRiqva&hfIIOD(d zjFT1i1kNcEexdd!9POzjt(g(1V=NOa?|u3^I{eEC6R1<-i3PNEAqhWmKB%j zsK&bEkpV}?c^H59oSU99=96V*l0#(h`Bw%`4;OlRF|;4B&d*w<(HVRnm-=z97?Ug| zabq3xvNEjCI(Ke*(6~0V&eWJFGo}VVz-ekdkRig#wN|@~NwL8Fnmy85X%ta!KMyof z2SH<7GB21~1SgbP22m(FfKUjI89?XsL$TCsl}Ck^}HzsHe_cqd%crhxSnhUDs5A27gOT4O~p>?Bdn7#FFwcze%xYOl*dQ`&G9g5A`jBS$+iphJ*j{}>aEC7}hN zw*tYzp02E`vhn^?4;u4L6UD|?L6M}Byhs{kF4n)|>f1HcggNGzT81$~vHxw8=>>C; z@HPg^&_&&^&oX9h>VjdyIS9^MIr#bH*r=4 zOv%t4wc_3W$e|Dh+%ea=*uMN_-Io7a9m(RHYtPhBi6cUGi$Uz!{Hy{MNiKz*JD->a zYG#OG{nLQcXAM#bk=>kR6BiCqaA-h+!bBu$;;&O*4RfpuEl~vi=9PvG0q#F8M0F}& zpe9L5@zw7~8;#|1C4<>0c^ag}-l_`@e}t+zyzk&8`AvgU9b|e?g1A8R!N(Bl5Z&yV z*{^_E_iGxak$O7;`*bw`=e+8BL(pFRRw~r@i$n@!wRj27LCj95+p-xrgDnolm?Sg; z&jaIL6p}z*sSq6QG25_q^%X{Ufxm7=d^4nR}2Qnj?FZ#V;VtF?+Zz$BOgr&%?DMj@y=hD=IH0T z^eu|)srs>^wu_89@^^5fhD7Lnq<95sD@Yh605(4g zzGnngTUBTorfjS30!0O3hLL(oDQtvj%B;DLC057;w|}hH3=Icj*)nd~*$AUGjP7VQ zrbFRe_r%Y1+1_ffOgHCO_*hIluWGQ0UQts&wN;?>G>daB7*M3+lV_cVl^IW| z<;ZP3&jdD!KkyCFZ|x?#*ZkXfe1{&dEDg{D4%awlzEHM$_cJuQv%`0-un77&*?KP9 zf|@z#y;&!6c<^2H7r5H`vBDN?Q9*Wj=3H02rTVa&^HE=+;gLI#R?m#IJ(-alTT}ao zX~#9yn79VJ>?1o-PnwM~7K@3igMc#PeotG-9KMj3LnaPe!10yv%Dch92w@WLCOY-= zgwXc=ci%<$_m%-|meF;a#Y6>U!h;5=T4+d|SG6NtR2C{>7pVYOA`KAD2Q>_8-K3&YOhoM9$?Gj5Qbv80CH77#+(xKqE*@@hJe?qIQuf+JyWI zf}hu;3<6b-P1XNi-F3vE$8X*u!3~<(8 z$_R55=6lSh7q#IUFgRmn0Z#aUxEW~iRh_)rsuN3?c1Ew@S=3qJTtY3ax1uu<5Mn3i z)ZeTYBRU%3{rbUE{{BduHOYnE;_V)eu(iDHvA31=ceEOWQ{#~z$A4QeX>yaPxjyvf z@&)?~?CJL8HqmM9U6fX51+QkZLHA;^-O6Jhlq}M7q6t_O!xNXhoN)t1LT*7rnwM&@ zt-XeD*7`Y}M92ABA2`t5Ef*wOHGuy-ESAY$H*&Y!qLysXqC-yDbAYi@o14qp= zD(ya;(c-}91bf9TT#mJTVk;WtPSra`1bV5}RM?&V9tw2wra$S|N<>hckyt!HKs*r) z=qstMjxv%l8{$RKv@sr|N^RA(p3K)Z+dEe>mHB(s^RAf`20jb)h4Uz~VXpI;j4~2q za!ZyInxPWA>HRgxL;7v zquj1gZ2uNxD0x#ID1}poj`R79%%HjuP#526Qu)xXGsO!BX zk%0_tfN_i`8d2Gd!(q^@Zq!`m^M&nA6QJ*`&8@N(g5A11vpeMosYT*4#bRD3Yi5Y z7uN^1S4ceUPVoersIikAoUivYI+AIl!K)7(Yl1n&@(~_$i$4MP?yQ%r-QL0Qgd@BCn8TrV({}0@c*{*x{ruEUjUbg&UK~l9 zC)Z;=*J{j>p+%?-l6xNL{*L}^7WHh>*Z{w1LI%kdEVPl1A2>VZlNq!h$L zs+Dnr4g+ueK>mghQfF{L-(Qj4mMLaM;+w?_joR?N@G{PFfoupE+J1i?YE3v8JtNOP zbGmLP(Iv~q`aDx*O_K)p3=nD9Dd(I;&mhvlt&GK($~@~ zgeVP^^p!Sz2Hi*-8^`h0FZd7Kv#ubUQ)jb%r=+gC8^A$5?##Ziq;qnO|FAV&*3Tb4 z2)1_w-?;%n@B`>+g$;fgi5$1&_ojV;_gj1qrJi7$+0zBwMcgsZvkE!3OP6WJv1V+# zIb!Vwn?wD*{O>hrg9WT{y|oq8p}6s*(d^7h^Pu+iQ@>qP1QlbCF;bkoT>mbkJRPzV zpn`uxyPPaZTSH+^u2~sJ-$4du_Kw1|iy*_(TAdXNv%b{n=y1$fj#jaBxSWCp%AC*= zX4POSl@k*fOEfQ|I;z|NAt+&MfPi|7-@TEGu=ha4n4=s1+ySlgksK(oXBtQBr_J2& z7r{k*b#Z27dSeSF<^h;#P9^Na&-_}^&`&hf6o0d@w%*f%2PG<)plj)g$QBKu@%?Bc z#V{VKK&_Sf(L}uc_pj?!#JjWoHhqxQ|9T(zpWgqU_W@QW7PkMlmty^Ii398ZN#by= zHSM%5j(7KJ9>ogKSp95 z<{2?(+?A<&xuVlqz0qY=RjB1`Y%=BS_IN?!)!FF-0F)juqcgW|?}~qk@YOJw&KQQq zw58kIf3y3#jloi{yj?ZvYA^S+E9-$R$BldSGU+;`!v3)nP^l5Pd6m_zt>0*<)%pnk z+W8tn7%wwwFq!`FZLRvLSc`Epb`{`RUbip7Ywt@#$v%2|$=Ue!UH7-U@XN@qpjMd+ zIg6w9NWutJ+EC5p(>Lt*Gc%p!)K>(pTk`e&%k0oZm{YjomV)R~6=$`n0OXf)PFgl&GvnMSJE21Ks% zMzSr*LSbHaAF-~&-tY@N@prQ1ogRi6CgSpD>-bo+Cp*MX>;N~q=44%bnDw?P-fbGr z$-Sb1V{+4;BDi8uwgfw1PGZC2DhQD{uDg%>8B`P{@jiWP0FHVKji0-$!o41$DTs)_ ziqYj2mpIF3oK^yPVEXS75|XOP9PM`1qAwJ6jw2ZvP)kF7?+oxT8M4TQGn|Q=S-S*o z43Z;%x5_z@rM}parV}I9R(riP&_k}-cN;gGZ9DZ#Z1QbvIfoZAS0~`>M94@Gs;jn& z4>sa*_E=}jmsxa!MlF;o?Z&?!v8Yqxuycy6uPG#+D7NdX1qgP&sT^TUCA@65q}j{) zq&}_;!j<06$hs_IqFZf%w7CP3BkYc_?*@J!J+N!GAOs4#A^B4IB01;D5_xHqAQd7p z4U6FE&Uz$$^4N`Qe5Lw!i1q>NHC5OI*uF7dG;$3I6CEuTaw4kV6yDyve37uQ#^DiM z25{}<-ERadwfJ-7*Z`fog_HO9RA=ARL2O*xI_X;r&#|r;C7P_&u2xwmLceu0s^41J zMlle(9RAfOYqO&5#%*@jX%rD7#=gk>i4M73*?cd|ViiaC!D7ol2T_V?qcBKBCCkFV zlcte1e|C#9)=0su{L6T#F_kI@LwIFpPXk8zee~^t)oicsSK~g8-`y?x0;@^3cn?%V zoo%f>2*ao6y%U{fH&f&wIk+s0Q_o)jH!f=CjuzSlKRA5GK*c=Qk)+w7`(98(8!*si zcdNJ;0=_YYIkqC3HBA}K@OaR=<;Hgy6^TM4@LI9Ph^qV`I{CYDWKQWMXc<4R$M@&P zt3>#X69ECQSyvf6a{-h1NfRi)dYEh%%=P!v1ZYp_}`OK2nZ-e z(d>u0kv*HhyI=k7L_LjIc1>UhJ8r`{T!3NbHWypx3Yp}K!DKa!wL)|Js;1km2ZWL+ z1qj3#SWq^ouMDS9@mY-b8cWgSmI51`no>>KsE2xe@2$fM}F<6A2-DLck1CIU7&4~FG;sYXwG z_kH~A!oB$J*VBv!In4%dcnCpq8GIM2#>&o<>V5y8s4on7M9$9N;I+D$PLsSPZsXJx zi%E+t*1R68z*s~S5lBbv7Y0v2oEkO8w}fmT=5()Jp_8_o4aSJd0zwf1XXv2{2?Xj9 zU3?doJ|!e$2PocUym>JgDxu=CbSNgfs_eMaV?imu%Q#U6A6J&Q!WVc4gH1aOf}J?C73^wUEes&nZnxSy_7$&}B3iA%Vlgbaxrn%U>oJfq^A-3Qk$UR2>xA;nPSP;W!iwBZn)G+OQUHZaQpolTs48-k z6IfzuNMSbRlKfkdxe3s_A_9enimiiFX%Yvu{Y9YS%UMhYNR1azW-BUyj1rrP3vuBv zM&7B@iuxw@0e-HBeyX$=S7cvV_^%utF$O=cb_o1qN`+U&$lLeugn^ z5ELx{s{#x^k-##kJI_o1xS38@4F@vWgI?K-ix9LDK@5=pIif%-fDp<`f#2!-7WFbu zIZxsJLPrA``HHLq3~5}LFVi1s*5n2goBLeH1*JA~#Kpp(Caa*}aL(_hqw1`oayx49 zgn?G#K(fbun-d7JH`_H&*cT;N@;okC9mma_ZL(CSZJ$>`SSFmCIkLv|pK7k8e=oPe z?0~y4&i1~bw6F!1!x9yyKC?j+HU(-0KvV31-dI8XVwrEVGbx!k0*|3uBNVx>xWh6x5XPh$cEkA>AQNOSwQcG0q>QA0cfK zDla@F3XbI_(J-vG-KF_y<&<4I3KyS?8QZ^A+H9ebO~>ALM4F|gINT;h4kK5<+LfXr zWq3AG-{(22=hyE*#SRZaWFsnsmiHrhg`z~}{7OQR*?f6H%$eR2I6ZCKOTujvZs5Lp zr=WVRCBxx~-ZJg?mwzkYFsnqY;Z58(=oNt*I zrrEM;4lNrYPlltiVIqhbqTT}KV<%2$b?9FB^vIS>#SjE|#zy8PZiMCdVB#z4sAFr< z{%tv8oI;@4uN!k@d~ME;l-YK&r*7-YWU2##bd&jO%Mna#8=H@8x{tdOE)x_}>|VuG z5bDy@1(ijChlhUlXlFS^5nO_`j4b%W%GqY3Ky_1nBr37it;eCZ2``Ap0-eThIh21T z{7{4aSwPW8p;<)ps0GdvANE&yLxHs=uY~gw4A?hiR=gk9WK}xP_R?jwBbI{47U-_g znJ%G)OV7(Vu`pqeZTbr2(s@Hk?G+jN(5@^QTQ4aL3!ME;H1ygfHHO%i-vv)EnZtlM z3n7k=;;Xhxd+RbhI_~bU8+k!}t=>#mR7v8>GGdfZx(anj-nT&ICu#|TC)vrr6HWg! zaC^uCXsD?$&xsrUg(515GxtjsrQA7Rj!U=3BWvWFeko{LabDpbI=z^?GCf2#sIy{4 z`yS44T4*EX#gu$CV`7H6#ga>|P$0XnRMao-wU8j(vi#Ryl_gcYJ6hE0CB{ETXWQ-coS76o6F=})TJ|i&T+r+S^0HroW1kZ88+(~b zz2c0li;i{#<22E_D_6dw9n+CBxqqZs7?^&dx|Qty{D6{snSsbCY0jpk() zsng|w<8!bMSdylOR7Q$3l0(yf#X}ZnEQbZKQi|XtS2k~2ljgG7d3X}`j7~S$HinEE>M<3uK(PEKF#lT?_d!+e zk*$aW$Yk_e;pkA3>+S2?B`V9Bz&yHz$Uk6fmR?M?il};yQ>e^s(AbWssl)NsoY!>i zboDGfZQg;3}?REdEg_z@nI61 zr2>*~#@M|-$HWRi-fhp-ey&^Km3;R?{!xn4ZzjBroh)SgX{VY#EXppoO>_K^PGE4J zcH!|*nNdMz+RuJRVOU}b5^?YaBY)BRKu48nWWj&VZ+3Yu$5lpVLnSK&zT z5pet#O?ozVY90F_o6r$?&hRloYADmDQF(l~=4{f7-|eTGvJV~Gut zocUucm>B2iwM|3F+OMPY4cq@4JXd9Z=)b$o|AO}bF0TLWHvbLYv;CjI`__NpeU2oG z?`?er$1?H-vzR0G%WO9Q_YmHD%-XsaaVZ3JQF68lmsRjrv44jCy}->R4Ga~It{Wb% zUxKh;Ql{&}@#IK9ARqR0x&PbTPviZ{?0H-IyuayN!q32;Pv7>u?$PJ@#aS40u3r6= zcrYn|+;C#<-z2b4KmP|(+(Cb;R7N#|XRe*LeoIB&v%S39UZA`;P|z{ddxo9_#uH8K z>aXF6uGfXrtY2Zb7|OkZ_$h(D{?`Y~XNKyyj5d!e?VTajRsI`td<^afxl-s8)AmG0 zosNg*sNaQ~m@+#4blY~B#WsuDzN@LO>E{<|ciro!7k&t@s^U2xnzq~X1oPUSspnvm z)$~P`f$K1Wt8&9@eobtV?vK|uA`A^l{C!(2R10Ij54i-$qdT!Dch~!)8^U^XHMC%-%KjNr^c=t$E=gFXvMoCM{=B0BZ^B}KZaXT0Ex|~NS!z1F8&|PX3G&) z^O*R+`V3l`{LoOn9b_BbMq3>-m*eYGK1{5i>P9Ww2}8H`ofg|i0%*k1uVyXz%pu8D z-EC|F5w$tr(m`?f1KHa;{$()>Nr#H->8or9rz0|{N@GJJyLr5+N4S;^olp`2`?YM# z&Q@K*_yLQNMOXhiE+R%L@0JkOw5`dT!HokXxQZtoT{*cJ-pKbcnMm4BYV|&|LLn(k zFo7(+_tH3pV0x2w6M_5hGd$uaRAdRO*A*!67|bf7&Ld|j0u=VPkU$y50q`bikMw~) zo3`XQ@q{bm^WUKRzr7spqg54cxI$UIjUwxZtWm!#L5zqydzAsw5&tbVu(Xh})gK;w*f!85jnN4x0<=-jTkBaG$Fv zvo#B&JUAT)gcOSQ+lQWxOBgFe&be^i!lT^vG{yngHMds}^%)!35{?$3mGwEt7R~~n zau%pAPa4+alggr&qv{j5cSE3BNbXRtR6yF(< zg?*p_R`!d5hlfn@z05Hvzvyv_EqD42J(%v@)p0%?W}G|K^i=dE-`y3+SjwIYk@@tL z)}Fd5l5)_-u&k`0wXnNW4E)}SX#p31{eI0kQygbngFN{Y_a-l;N4{t;Q`ewi>iFyJ z?pxbMUk;KI*Vz%tQY@SZAy(-Gc^uY>O^(^~Bgg$z_fMmwd65^%_aNW7J^f-S?8jgf zI8*`+QDHnq&q*){V_jqCF36v-wpeoH1xsb-Huvb(Yde~zSWuD3!78? z(6kNAyi<)59kQv@`@)^uO$O&ZTr#35lM1y>%8NdOHrY?{!h$NuKqYhKnesxM?!J7v zF8-zLR@>a|J$i5nD!I!!sK6}E>6;QhX$ezgI6ELv5l3jzXi5CMW=*Lj%Xop=sW4Ws zU4zw)@FuZ&iTp*Mq}d!ootzW?pw#2dm3TT}{8hJ#Q#f68Q#W_f$V9n5k-=-l^75$x z`A$MPtPKp{Ug-Yg@v`<7@t z%wk~ZpH9}!dhCRzCkmK3sEM-<2Dsn@`2>6!0o}C$;RJ3S3DohJTVabvMqpW!Ff9yT{32xm0+WL99<}}1oWvJpnM?_yZ=R+_L)V(xN}5YhLvSM z@a1>xpj`5FzEw=r&lZKQwZl&-Nvdhi`Kg2!{K1urJ5b_hM0-=&cxXid4&aDGIb4cn zShvwW!*MoqxIX*rY#Hb{LPSY!`j|Cc7Sezsh%0s%AWHjHg>EGhtNS+0Sxu1udX(cR zCm=JoDdnqpZH;sQ+gWbT}HyHj)Sy|1ubch_T z{JGUSQSN%hh)Ex0u-OCd&PLkr&?H=aiHs?l!NCoay=bsuB!b_}?z^G+ZJRK8#%N?^sO5UfrC4fQ~VD`ZAt377M_DF`I*5`clUO`PzKX}V+gGSMy z+HohQl)Tz)>g*fnaq!_cF$7Gx0|`EIz0WiCk_{HGd(;X?*cCSyE+)Smat>apv7vTb zaHO(C;<^QM&G)t<%Mm!vI13Lqi}eE>ehTpkw-iW@J?f*x-ff(5`H!wgsad!ed}hI9 z?AmZeb{57EmBCv4)pYi1OWx91mRdO&6W&`G4 zcRiEjEa?lsp4V0mKg&#;V+sN(n$OqA_w54NfbOEsCB8Qjtwm|j_B?30bvq|O{5yPf zJF=NqaMlgt}*@oX}ntAG`-kez!7>goFm_pHarMH$r{Bd9% z&5}dM^cKYV3wSd%D_V{#zVHwfuuJ;KcI2M;GI!q|hW8zdiuZc`UCf#c@x&2T#v%Yq z&c6aS)LkAYR!OVTi2ft#t+(WsmxH}jEn%;3WcIkWlr03DwdZCenG*{|5NpYJbtq8z znzIc#4+UfSW=a)-oo~C+XNj^+Idj!|jkTGW73@bdij9S;SC+wt!{)NJWL~lFiAKvT9R8=KuqYq@Eep^=1cF~VR8rvJZGmz{zo6xK#yRdLb zpp(x7=3md2wr4b+>NYF|$s@pJuYX0G9ZahW^T{@rWVbow|Hs%lY>5JFTQ+Um_DS11 zY1_7K+qP}nwr$(CvrfG+URC3EZYw?^){fX~&IEvOKd?6;Vm0}s1#0IH+mvKHXDKEQ zZsn+NBJILIcf>hSq_mzyXOgr0oirJrjIFsK8HUao;vqXT`~QY-mj5hbv;0>@>}mDs z|Eq`Xd89l+qbH4F2>ksE*P!B(lt3z6k_=q!pzlxU4*@~}Kr&px9iVHx%fQ3arw3q{ zs&JrG++xv81jeK5>ia!8J5&<2_E7rCwoYf&py{PU|CQwQOXB(P?NOglx-x#y`Reag zw?n%m83mFBQX{$Y8LXV0a_Jj@z>Y3I8ZL+~Q?(eZTr=@mM02!wyCa$nfVY4!Q${@H zSbpkm{jofuJ-8Xc0Q-@1K$Ty+17t|N-D|tCU@n879s`? zBgs^e{8P7;;_<{bf?~5-NfX6QIGoA~zWL+P=UtI9ZcTA5hTIUh?Q+!6Q3A^69DFH$ zz(^w4G8@#Sf(=5yldM*85deKD-YVT5;?81I|BbLhSHMShXV3l9w#S&*RVERh>U!t= z4--X5I1P}R{J--!crFFrW^~~BUvpgR&=js#E8|=Md-cSsS>?dp&%P*m3S?m@!Y#_t zzvs(|w~Oh8-;fDlaZ2Flr6w>V@a98J4vzHHK&MYD&8(~DmjIPkouxbE`7|gBY&dvY zKMoO*g&4Yfc33Y#zhaaX4G~`SWD0`nd#2`qb3V&BLJ7Y)ak4xJPjY*61WRbB=)_iT zWrHS$)iRQBPf>1q;siyFW5lf44@v$sS9=kWwOFhG6P6k}j}3>oM6W0RV zK72ya=WvtZs5Szt`6+M&0^L?W{d?LsKl&1_>vQH{92F?AN?A1bG-HUzGnii(lTZRl*<2 zwC^5h@4wh+?vDQs#K^YSYwCyIc;Vk(5|1S=Ux;uUwF2yU-ee+TuNl)d zvf}TolQ!XL$c^MRMs2WVGwiPK3D? z{3#|TC{sM)GvdOc0p^IS_ZoGuie~RYMt{x)%@die2ADurkwWhU#?6k6-8yLs&o#t> z%ocy0AkWnd!BL1H{EB?b;5w#_vk#or@+nR}szHWW_2qkh9i>litrBTdL0AAz{6vn- zaL*Cg^})aKnbDa;Omk<f1 zMgkt=P^?Zq%6LZDdgi5p5E#C>jg1GLKyW>nhctW$O1-o4bW4vz+i9J*^FP)Q))?b^ z%Rr+*8laNQ;6gnf#2ezQyIaQGxv&DWc7l|>N8I5@y79D6XSDwT5)Zq@$Wb2iS)L0n z|1rs@fh`!5+2~u4)$Sk?$iq&N zI0nH@F>-t0_zJmaYT{g9R|v+K;oWBjZf0u|H$o08jk(J6AUzlj|{x5(?)wiXGZ|m1_uKT8rRM0 z!w_3}pusos?2JXKjA@-H^Dx*_qbDvdFn>hCLcR0vPqg5oKoj7F4=}??KJB6)0gRvm zBN`IcBBKzZ0V5(%+>;6k!Px0Lp_ugNF2muJHhx=$zQj+bNcClGBuWK?{5g|?nLl|^ zAiQ&%!8q?}Bvw1_;Y@jJRTDI*BNW%v)sRos z+ft%#{~C)X$nbwG8sp2KS3?-s+NmT)S3H3sY!u2w0Tpho@s?Yklc|P1e3^RTWT}E4qoyu zd?_hNThifU#@fRsHAD4Sx{tOV##MuXI${69mD#q_neG;o%(8wmVzmoVJ^NFKFJyV7 zW?l0G!&4dlTw1)bsUOE4UmwwAq$u`qO%nRyt=yq($Ws`+re+S>L|cirZY%D}O+4BV zXV0zq;G=(i>>OV-Uo~PMQr+l)7g;=++wI1yyTpoJWaC? zhb=&|G10o5A_rctRjP;5n=*lvj;>5E#474I&Ky~euG$;NJ+-vSO*!h0q?$ZztQFc{@qMEf0B<5(Egx=L?2v*hfAev;70Y3+a-XNw;Stqg zzR{=Ea`6Ft(lG$iZsRl+{cu^6*E>4I5e3#@0Y70NVq!_w1K^3`laLX0kd~pBK0sk~AV}iY zur0)AG%5FfyhIuP&cCM1w9;?#h_x3!TL7~-*~>luvxXP%NpqTz=I)*$xGVMJtSG_5 zcfvTMg=Zdv&3GO8eolR$^V0TdRY1*;+_AA_2WSFPTA>t&QA16@#5qz1J<-95pi)XI z{wVquyoo3Tme*)l8m|uF=k1}a1JXs0|KG=2y#fsZZA;_9O4 z!{4~xgI_nMA~E?b^i3MORD!xjN!ZZGhbgAN-vUGvVnM#6xx**aM6IU2Sq$Hln7%03 z53iMtq%|E>GdkW<_mP#EOpge}l;q_IM;4APW_-E2-{3)goWh4{#y~1s$)=Ge>ssi8 zSiRoQ^3gzUB1~$ADfE3yN&j519%O2Q(G4z1d&!n{gF<7~>ZF4Nl0J3Ch^Nm|?2AJ7iE z@UGW31nz+WAgFJ8_9G2RP$tPZVpN z!I_c5ZcR`Oq*`W@*0Go_`Q^GX#jc0n<`R4~QJ<%Q+imv! zSBg-oI{m9EIPcKEHm_Fxc5AB|@hIl4LV$es;O3w1<)G^YoLpYR9r+E(fvi7cSiVim z@^!z*EJ^bzxr=Lb|Gu+@KG4PVAF}G{q-X-ug*{!^^awDT*4q5rk^nLa9*-7ZDAg@E&jRFh9(m(3E<%#nLR_l6BK z5vbrab@1=$^fPFx`Ox`u+zv?eN(N(P29cgMA5{1dIxdCj z)JxGZO^ov26B&?fEUalyfP&cseH!B`trUhaveNDit1?rNIK&i5%9j}c5RCXqm0T(T z;2o6v*oWV0NT*j{!?qG=9%3BGbX~vA*ybPlA&=_87;;4EBBvS)8|%gVzvh^KJqwnE zk}B!&j*pPPS;=PE#u)l8%2H}$_EBNoANLyx&IH~_>u(r#WyoE~_QUh0G>o?E38+kD z+F|T7O_5+O3QZuyjkbk{ei1gh&l2h-XXp;!6v8CwVH9y3lLLfx>;>FV>L(vKJG+c( zk@Ay&&{#4JtJfcC656MpzyU2QZU6N=jW*eQoJt}#jCkWL!@d@j$Gu?Z6nUeH$&pH) zomZE zBjx!Mt(kH3iD>zDR*fWjoepiyepNgwi~zuklpDGOg@A=G!n3Nr#dIa)B=Af|N5$%s9l}1zbfmuAZ!G<0iTl9aZ~L*vxj}z?pICwXW@G*# z20BK|HmCII&K;4kD3hgvoDQZwVM}Dl6^Snj#|ashek}Ojng75`!f@x}wrcCb#wsW3 z)>bk?JSR<$ksW|uS%skGq#Ky0a0FnEa&GukfmxSzZ7sp3)l3qaeK%yA;BAN1!5kRo z{#p10p?451F?R+0kaA#QP-Z0YNp%17o;h)Eba9@2BM|(b#F`Hh zzEv;BGmmaqd*{^|zb#&PPPgNs9Jro+)PywAfWdP>9=C48-Y*B^AJ;2>h!cKizKkz+059ZDYJp^t6$PHzCT#NXY+-R z!FB&lZ#Uj6CcWZQ)(76I34#l+JTh!)#VYC5Bwz#5tq3vG&If%7AOcJt{wjc}nwI7o zPmv?FL>a<`)5nlf2TNPH6Dh#>Hd-5G**9j#Yl0SEoHm~e&_A6nJ!3FAM0&v2xi)&H zHs78=P33-1MFv2!LRF$o6v8xUF$9ebQ=T9pMTwH#Wo=riIF?b+_su}`aqueqigf+X z^J4`NiMrJOeLH7@kLMoLsaPTM5b8%H`Mk3H@6NM3M5k2$nj(g{iN|t1Is+ywY=y)3 zgCip+7>=Q=aZ{R*2LIKDv|req#H1blX;H3)Z{7+a<><@k*F@cSeeR5gfrvW^&L$q0 zfuo%a@tK0I%U$X0HCg(|%HjF#D0Dw?8m&U^Zx_PiaM75~u>YLcOZsG0WhO?PG;^A?CwEODmx#Lat-uj?>QVf2HtTf7wjU4av6v zeXDHm%^B(h{&u&={rfg>V`$*`jmfz@V)`YG;-w(4TEsl|d(cD?R$H4}kW(KwYPevd z2EPgZRTDWRuoL~<%UiJq2-?48JqXRs6YmWhdY)Mudem|fb`vJrnUlXBbinPjG zl!%4R+IO%LEQpwEm+>z#f!!#Xu-_gvk}S@LyP*=_QX{jW4OHxiL_eo^$OzP}KB@G6 zEOtrh$w_t9M?qz6<&JhDzxHw~$tE04jH>DfoGAVsknV9iu{(YUh$Qi?goC~F12%vhib?b_Yn3Sdoc~X2%t@cq$=m z+{A_G5Ydal!>n{q%9N94oYFpd^H{Z6&r+15nV*1BJn6faEg1sv{ZEXAU$d^t$Q85v z-^kfL1C|iBp2r(CE{gELGS_v&%&RQ9I|7q#fw%g3g!+&7#cVkgxa~8i6JzQCbo7S& znwO^=#cwrRPT;QeihfG@(k9JN1>RV>i>^#5VayN$w4CCI^1_DZTVW^wxHW;WPEy^k z_$utPR1c5~lk}PXsejnq2Bs)GT{?%kXs_+3*@72-Slo?pwW3R+2=hwDpAT5mWCQz4 zknY+aEZ(z#*tUgWOo2IIh`8n%nl$_$`&`r9J%&GJbCl>y!MSeVtPUL1I zfc3v(2Xt#(#%zwD{`AT+jOEG=TTHdb{YATrT@nXGm$~Z5L>V?gv?HxaZ6={2Ic}bN zf&HTTjNvi8DJpudNkkLT3(c5JcYL4W*qy2+DUK?78~y24%Pl_IUavKk@+Ez#9nSbV zKd_1^q(w8G-J$y0KRB6^G7z#aC?Y|>Y%Kbw?|dVt20E0W5>gk#u&?KqWPO}|Hc;EI zo!v=s0o0iT8c8FhPGp{Bbg*|#`N~4!n;o;nnN|`h9-B&2`u$jhKl-$2tbDQvHMmDX zOK=&njUNls2ctI;of0Or$7Mus$8+-SwN{-r;L{N+Q99{r5-l{RYC40=XxMdMPsba$g7@ww`761y{5fxxE>HV))dAgzc`N~ZV?Ps-Rgo3XakxW~ zIdY&JY7{}93M_y?o#RBCu5_}+1c?ni8*O5K&z8Y zir)Hsb*Xk*l~>So5ZH4$?7_9tBFAhjvq_1nfRVm&4FFEOY_UAk7PPG#zx8}nay^D+ zWY$ud;gknfH>%CFWg+lsp>63-BuYmL`q~6!)rf&_n%|41?4<=PHy>PaO&t7T_5oo;$Yv|pW(9lJFm zCnTc|WjPhCojOu;s5ju;)v2qoxbyn?+=16&V!u0`7N7{7zO=dQ;{XK)?U=(=Yl0CQ zKhMD4w=a==47t_{7;4qux6B_>1LSOi0B#)brI8k^yvpJM43Z?3N$`h4ab^JD0@;GY zCQ#&1xG$l{Sx0=g_y7%2qTf#=xPj}#r#0}QR%I&p;DXduPi6CSdlobd?Jq<8KAuw zmx^&Y#q46eAp5jkH*heF&u74i0^=(%7Np@~R%$};GVs9aP$7YWJ7w=$A>)J=3hA^* zr^Uq&!0#i@LsD#ZpfS(1>(**=Nti3&eppPu!(TTX86My0Rd^_O9+O zH8~`7)9It21fULVQznMrw+pLkRmQZZLOkF1yXIQGXxC^hgd5p38peY@<~d{aGOHeE zOmyk*+u@|GeW>;7OtYyyLQ?qHH)G)7c&JIZIRHu?E~1^FWH3Dr2msqe8lPCmT3FAC z5J6r+N2le7#w=hE@GbRZ6yU%#;K7LG;CzcSICj!uqfsF|AWl2sKw zf>2xy>P^%rZpEdtoS%B+nU=~!mso|#GBU`V_ymQ-SUfzS85(yGmbKx{Ge_e9@dZ64 z1DeB_T}@GYLV)7W zSQilp4O1>_g-?P~U#-xE1cummFLPqs{$AisTrUkdPuIIK(6b-YUZ;tCwa@%zv@CJH zj?+R~(nvo`8w6l_K)CaQxX#5|4QtU2=iS8#*p=xP+GRvI1wGF!6ggB9vRY3O0hAIV zGG?FVBR5|;lCbg^TK*3Psz}86z1#KrxnPuz>bq_ciy-;>5FQlhQ~(fPY^r0nu03LGJ*6D*46*9I?)Gyy|0eOaZ zuhUC)zk(3Kjp$CM?eu5>xqs^=x}H$KL+4Qi%!GC@VW%Y;2v7}fcL}oiv97LrQ2(HM z*V->~j-!!rQCg1V>)|JG+%#A}O(b7O%vh^6thWqhyloLs^ONG#5OPKtXn6S<*uehY zMd1+Dd46z2TG}4nLuueQc$_DPIM66##uPp|v9pl$i19q4-oSdx?<30sHBjjqo%KQIY^C)m(~V+ICFRg)UCWLIp29HqD^9_pnk_9rBUVIjqiM=c0s9@L z5&Zk^WED!SKJgT#ioBO1WKtag@jJwo@0Nc*C`t`zm`#e4Ps@@uqz-1Dz&lOMnh>pi zfXIE)BFNihN=@VW)|_kFgMWdvABFL>g!P9K*qkegHJhAX0?PQKp*nc5aw@D6a8G7* zRBNF1Qt!FUkpZHVbu9vz&%+4U@wl*0LHkue-0IGyq7I(rvHc3#e>$ocffFn z%!-YiNPW2Nu1E||ntKj(GVf!?P`j(4#Mg4*HQF2?Nz5sQm~P|wpGH16M2>yw6zQ%I ztI2!;n-1uOQT!Dzq7fNuvYpNrPYHe9MS7EEP>0J#38jo#X1_Hb!?+(C9YYkkfZ*$6 z6A34fI2gngKx!Dh)>($KyMqY%90BC-qk&jQPFL&3vMW2$DrwWD?Mu8$Bazzad#FWo zWi6T9ba|LH^mFA<%0y}4LcliLB&jQ25k1gS*9DdukjIS z6d9D+qgQ$ERV%~%=zuciG!61?(cslG+og%Jb6MyrlX`~L!@q!(nJ$%xUYl3gk;Cxm z&L&lc@5!6`&)FhX#_d~%lYuE4)*a0yhd5UoQ$viRW;@i37DBT*VqkmWVLrasbHmFV z>9J$Ar+ab&C$-;0Yg1_g%n>VNKoy8o;>IjYN!e6OWkf$#M+OHN)2a+kQ_@VzE~HOu zl{XD>1f>*-c-s%;2759^+H|!y`7`CN|8C4}Dm%r3>CswJt7tQ3FZXLvtGQ1Z8}%%6 zV^GQ&5`4x;`bh4eS1|HV2m#%8zyXLn1SP-bstF%l0|=v%l$e0^l@VNX|A{D24fPt> z?U=2CmnWvqKF`|Rvf1>Y$NVTvWU-7g2~CfGwy0=+CM-sj#vZH!xcc0(_j1t5#I~E{ zg?&;q zFf7A{1YQX=o{&!DDz|h{esPXNa5T{Gz!u<_y;_umnVMSR`*T0ldAU0m1gGqe5z!!U zyRAP2=bp0UEGVB`a7EdfWV{0J5g#nRTKq8_=f3bUgwPj8cZRs+;*F6KJNf$Va7zS| z;#UvxQem2&6O%ClF&zPqkY7Ix*E~G#ja98}CsxKlcPCrn(JgywJy0$2pb5b>%Bcf| z$&&rG-4rRft;oS1gOsIOp%KWy%~X+@vmYh%%#hfB_7nyq7s%>&=>BO~anrLI*bx&>8L- zT7C3=gtic1qsC&RrSzAWsfN2M49%WvPzK^dhkw51Q-xJ^%57@NY7_t~TVhyrET z)8;_W9Zv3E1q9K7e&!#dKGf(lGTo9!qnGdL<0~maVT6y~#1CyEIm4n*V2Zr%*hl0jOQaPXqZCm@SI%F zqrWS!WR$(lFPkYR&|vIZufrQwgj-)^_I^3$)&~OjcC~*|eS6e}YUbVekFolH#^wLJ z8OOxV^#2qktp8cLXZ^1#_syD@Hisf9KewfOz43sV`rB$%fG?u5WEf9GnNLqx$kbZ` zfhlI0$l*#98!`UwLGH;uqdcWIUE(UH0U~p_$%8uJx)t@vzpVOkoYOeOQe_5IInU37M&p%caWq=Zx=&s>qZIGePQ!=eEE1 ze;@daAC)e)OAO{=SPx#%dqs(eL%bna;0cFnx=yn8e8yQOpAYbN_9Zf)w8YdTpnGSh zTXnz^N~yi(Z(NKUIbe+2Xcx39a9qfgYCBkVKSi0`Y*N~Jdc4+?YjrDjFaF{~BD4TE zqqQrzJkPf3B$i- z2cdQp#iY~#zz8U4-A*mJ>P^aw4hBL0y9eopFd3%3)2tH!gn*NMP+r?ner=ef|PjxDc zD1V~LCXQbtQ{rBeC9(*hyuM{dVgU)Q+RnpG5)=uw^EhJ~3c;WdWpyWNu*S z%j2q->=Duh1w||(Ryj6)B7vG7#`+6$^!#4;m4u^5zEiT)SNAwk?GtIkLKmQ{bE(S& z8vBZ&1!{;z5j%MQ6(}B&x#ztUT4a^*il5^SG_nnNT|7R0RKrA&VGNv+K@9BpbXh3M zto(c6yXDeLlB=Tp5r@DIc*YA_-;r5lVS{ZVfxbrt-^<- z39yN5Yj4*JoeIpFTCV7dTt9Y)7oqeKY6QmS76)f-@R^Zx>D+wlPp^YlY0`g&x|Y(q zmdMJ-&l~L&fSzd8=j!sjO**|0b%*2IEZ(8=yH;nfQWO!9=NW&@Dt9iC$Da2n+E&Hr z-WTc*Df$LBiatsS;Dc9oQap5v!OzgD8_~C4t8K*?1zBoGgULUnBP$1Wis(M|AfLmP ztA#J}0;@ZbHAedRBG@zB<9PdF%AWZ6r6t7}&jgMhFK*g$rk&vs${aCLfKLjTk;SF_ zZStP)Crc>fjBdtuc6ma$-tsX%zF&N^8XN8s48RRw$cKnmwQ>IHl?$VyVOybBrr3z2 zt`Q`6Yy4G z+Cl|Cdzg^d7}h3NKEem&l+#Q@tY#JfOXh-SBds5G zWImw7t~icNu|7UQ2QrM%mu$Rd>$Vbhhp~*1_gQSvZob^06a_}0c*-4d`vT8JE7es~ zGNl_b5(C5};L{PoC^I!4Gc(T-CAggV5n=hPMP5ya7hwwelzF;ER&(f{%hCbB@kAdQ zPO7}#rmqQa)E`b3GWl^7d{XbQ2>7q!ZJJcWu!4WA261^A0_t{E;MpC54*PX7Yyd31 zt6R|IhFSSufIZ6=XmPu#P9#he;#eHBhV<)ST!pylT>LR#nb3IifQN;6#+r7J5;>}d z@j?zo6i#4cdg-v%N|)N{(k&n+dBC2ih2=<=;ZM~gPLip$P2&Vi+t<8wXhB!IUzr&; zciNE%%-Lpm@KI6)Q1$3q(FB(I+bG*oj2Ny;zS&ksTdJG^(Ns_z$s|X9J8>UZJEXi7 zA_=3U_AxkGn1L3k#dNg<LmkFD$|eK2BxO8il1&@Yw4`G@|4SyqJwDfjY!05)+ew z@TYEjr(C{^xBW-(K!9NRv$f-Zz_B#=yD8MYLRe#dFpR8u$)uWe(sae#eW)YPBN{`+ z_MwTe*d<&HdtXFz&^i-8gZc2?({uMZCGvR8_z`>liKIZ5Zq)cT296BrJP`9lF>J=Wd{$({@UB3G=`%U-(02(MTRuU zDHZqQn6^tGo2it5mQHm3Qk$+6ISU|u`G|N!!UGMRe#jX%z5N7E0%aYLp`uG=52>4l zH<`tt0xkE(1dzbcX3G$@LaXo(J`>ynP|sP5KEOG_>uhW$$qq115I}aeoO2%eF+&g4 z=OCibaGFsqMf;S=g1sJhG^``la6^Gj39+jS0n^j(|9nE?)SZ!~De{Z8a@=hqz}a8J zPu+c!21dnF_I%XEz5yjZ46OT07ePe&KpV3Zrou2^Y^|zUAz6&sXe5$NR1Gn7q3(hyP z>{T;iCKvph1E!Nla6UP0OS^E={$z71cG#y%+f&h}{ua7NSY(US=5e?zH9=Re%I_8Z zr?H5Oc5cc#y1chiDPYk3Y+@U(s`go;6Rf%@IO>BjCxynTna|Cj8R*GH^l0tHw4pkYaOQklx#2W?_6=DZA?K4^1Ua!Pv&{X_l_ znXP-(YAk`??-J${lm9jnR{1PhnOpR1Dt~kyN;_4nY==6h>)_8y5m)L%wp5)dV`jKMq*H#)X$qzh zi%qp9h6O1N?hyR#6bky4cwB|U9WPP>59XHR$U$=Q*b^)Z0O5SO7uB$=9zL}u7~cOe z?y6ov6TzkG;&P-n((D4&(Y9vslb-)N9cJXCB$%zv1;3eS<2gy%E8q|Mfhm+{-Q969 z&?pAnKE>QQ^}`$^j9MzT4UNXC(SJI*Cv&spYodfOyWu26nG6!i28dh-GtaZf1ua|~ z$_}sH4h(YaW{@#O3)=a%UjpE{@99BV1LX_ytNCo88jSH(!~;BsG7}I1QhRZ9(SZ?r z^tLKoYcUrz^brNuIb*p!YJG{Qr2C3q|;g1Y7c4<^uj=FHq5pm zpjQ1(%M0z}x0Yeix9tvo$ahM{Iq&1 zOXJ3HP~oIO#=9{rD5dTQ*d9>UN4`= z0PpBXYuMCrCyk|a+^mcz?uaU#L}>yPC$`uEGv%-;n$JrncqdFAe$X2~Lx>jMgEQ*v zwmmZ-541l@Xn1_-h5-_B0wJ=G)j)t+njUa2{^Kt{oWxLeAU@E|LA}fKvL}dRNW05t zeE(2?kOR5v=DO!gt0HqUvJ0NWx3@w7_4(Y2gvq~Cc#`1S><@HG( z_%YsvfDi@Xdp=MP1|sVWB8gh#n#_e)oc3`Kdz|T`G4BmFJB9B4q*r%u@5SD{0SVsu zENIbP)ZM|LmTXa<_^y_&9IA}cF8Yz4z=N1BeG3>wqw-DZE}2lsUn648 zNY>yj){Ak}p*C_Z2dC3~;CJsVw2x`T`2c)A51H7U?a7w(E-*m7B%g$K+}?6O^h3$m zMH8foyD^eSHGdz4V{TAEC{?{t3YmQy;_rM=(c14K7XbLg%v;2Cr*blv)tA^*--u68 z6e8r?c#|xNo5m$|i+m2AR1Jso(R$3|M53aF}_q^!? z3{oK=>D_J(m4dAnJvXIqj|gvW=qN5#s&*5`P)9J=rYuG(2n5`8lS9bUacc6S8xMCe zWox|lX5;u@BO-U$6d`-8q3i=s?ZGS$PKe&ZuGP_TrWjfe{IDV051QzbckzhYT6Y;I zF@mia?3vxxW3qS2cA890wLg_ZXQ*~~vN$}g=m>D>K{UdYP zCE=Sb%Q*RM{}Jc2YwZWE+e8n(4&oAnV;o;e`(14VP3+w<^G}y;o6!$_d(#6`Y=erX zunc>xw4s~L8mjs|IkM>MJu3YvAa=aITcBd=z8;-}nZUbF$GbsQ8Ie*t0>t}8>CH}a zE&LL5Z%=*ODbV%d*~>G56nPXtw*;SuNB4nS;I`>|PosgvPXg}gLP%iRt0iKWN;sxy z{cv*kLTc|z-HCp{4ZZ6Y0M4zCjN`axP(18E_85<`CbfV${OzMhNIRHDbt$m{=}2=M z&ugiXSkAdBH@Muth#$=hT|`UV*EayrOt!3Yphu>{?~ihEI7A}=>qz%*WiQ66FV?T; zjLjxiBf9N5U7$!HC#+QO_xKFvjctOTz_5MCZ!X!M*uaeNpA}F?EOEQ(3e@sLsD@@> z`+*Dzrk^rig6y;(Hzx45?Z0^lF`W~i3m->|`=~eN3SbiQx64kDy?fI%1 z0$mX?o> zNHv-|u7I);BlRG$`Ear7;k(8HyzbPUK9NB<88yBj^Q`X~rfR@=*xnF(*~1Wv37r!e zAw8=;%%oBlW$ex^tz+U+syYsX6s063CCg^n;eH>mj}b3l17ot^gW6oFy$oogEU!{L zY?ZB1ewv|4sY_8|W@RA`sM#u#l81`f$pZta;jXe~C~%hy=G%68<7(-!8K>O3yJ}>~ak;Ba#*ebsC0sKDu)ntwnI z+u*lW&!w!cp5#&LH|4e(m%qd2^4F-aFk+Fq)$ia(3L>2-8f(M9$rxQ{k!!CG|B-nGh+!85rcO4X#slQX^+ZqqZ@JUZ_IMAAQwDJ~syn zUb`wx8zP8TMqmhXZgjRx=fM8QL1+jh50-Cow%_zDc&p_5xzW@`SxFV633h{Y%ck0W zvyQ>G>kSW43u~c%rb*e`+gE9>5dcX4B6{4->4Q1l6UIVnI<)Pz>W=MW_|@NkQ?oD{ z2%QJ?hy?J>W|1bX8W}fWRAo{%$XxDeDCS}kVEs<*VyeGTm*&(Qm~29@CwJ99;typG z`Hr&4j`MYQq_KpC)J+Sp0c2pMgfs!t+qI7w>nqp8eT}(zwY|mzk_#yJ4TPYX2B4OA z(_v+3Pp1(QjxX#Iz&><7SAtDoJ`3OtV*zyoi3~f!SmUP2<<|`_{@S;e>#PnD} z6if|4>M;~TceuPtwta!rAHXp`4~#v((04|J?RF25JTX1A)R$4X0g~gCu@cdP!6BYm zcacf@8^^(h+UCD2H0B?839~O4QpIrPOb7n&X4S6VinV-*Jm4c;oxA0KtC1}-XV?Jqz z>hFl~@Sh)xe*;BEut5<)Gy08#{LOBe@hIY`lc9CvM3OGM10GF|da+>Y22E?+H$tp3 z(6c!H5Qy?t-NJWXLmBz$=R=W4vrab-EG{R<%H3HFm)jv)D1m|?X3fAYTtNNc$;-yA zOjiRM2N=Gv-gOPfm}S!$O!?IY*X2Lo>5Zv`d(D3>RgEzJqlmjxR`D@fB!!QAW*D{*w*ya@aVgY} zR4+eeAXg9>QoC{|%hLIpja7?6z9^x}pjP>;V56R8P-~+a?b?CbY4>_TmohRFLondf zsEKGdb?0vVSpc91w-Pi3&z9ez;qOM+11wYA!$+8^)&04w)}Q=D>(ks`ZtVmMLx2hR zDlLkO9O(i7;pdzhI69>v@Do~J#g5L(Lt+GTO-W6Zt<}qq)pUbreDg!oBh!>IvyWa` z=;2!LI>Hj!dJPT7VZ5|Q;8-e-?CC*C5*#>+bg8VK8+)K<2)r;c`K5V#Zt=El2|0i= zZ=TOuVXGXG+KZJluxP|O3SmeV?S|yS}A^BF%tysSLXyx z?}jBWB5jQCvAoC!jK#*D1FcI{g7N2L(%~5#hCUbCJz95D8HptsOB5Uqcj(4#@?`!T zd^;cArg@)LbM3@+6Gj#WL`L|c7L1#j3v|RBCleYQek4^|v1=hcBK2mb28YBt zA&ozkB@avz5FXJw|?_<`;(BA_K^J5tU4I~5ATAA2=MVyGN>@(8o zg`*1YqMDr(m}Dllhif?I0fuN_Y)eE;lg4;0y9DE6@h&9=(Xr475ezbN9N~DeO&a_My-%YWWxM&Y&Ro#>PdH?Ca$Z3j6sN94I#)C#Nzwgy30osUc)dj85jA-coQKf9h>jqNgNhcG zh7=oEOnjCI7)L%0Q?4T09ZhJ{pJj|x8x~hj1;dd9n&j!rRqZA;`zv}806J7)Wo9*X zqum~H_^Wmk^|4MKDjBZWpfTHmVK;r=%`1isv#j6sq3tlKUWWg7T23k!+~V=t;Zlh_ zBTt|`w*vl5cnH42K#hbcuA*Yv`8p~zcdRYdN~JPSe_ptS zaP~uofWJTv$=Y-|8v}YeekhxqqkawFv?GHM81?oe>HUF|&G|jsAz=P}e-+X@uyj4K zblTV(=8`%nu{Y~p0Ye)=)R^q~b$X9T#Zcz22~|GM`zg-nFD}XF2F))CYLo=~Eo!9p z`WsSWwA(b=VfZ?5>#nxJ^?)=^jpU7CC_EQn`r6|!nxD9$lZ2G8y)R@GM+!Zq^wCtMz8b;O=ih)QZJL^1TOtlq1=@PcQml11vJEj*gpQGAYxe5NdJ zT#wc(I~Vl%kaCSS^QAF%VAr**ubgWv+KU3_32(_DK6-*Hz=1W6hKS>1LSR)ea9=)E z8uw?c0#9rE8>hY#h}OSzA!9>J#?N5ztE>n{afFM9)U^ww@VMa41KWKt0F>`_CHDQ~ z_W&L><6EoS{aVMVRJ!9Rl zX5sW6VJUed~s>%D!0 z@a&ICC3MySd|YgU)4)u_kzp`*=4)(tIN-`hW)>MKy<)>{?EDv^2y6VOpV#XF&`alz zJ|S`3vN@0qseyv68c@{cNNTvCcziJnWY>IUBhS^G@t72N<|9ZXyPvDEg836H@B?`% zN2B{+8t^~b?mw0QR<8f0@N@h(EQjO&1j{+nl5;+2Mee%L*p)0Ip}Q0FFB|WxYjLGu zJ5b_X?{aU}WfhZ|R4fcGynM~P_(uO3VFmIBlNw8=Z7I}cE0(HV`+9%6fH;P{XAk*j^+&_hvhHZHn|!t zBLIMRrnoQW)Y41jJo`&5RErR;)QW!p`QiN}h~qE*teSx)?0uB#xLh$1(3dkV6bk*i zRn2r+U%i-nfgS+{?7Y~=Gz1AT19r?m|E|}G88du9&iDW#A4Isv>4)a;FWn+t{=lL* z!2xTB_7qQ{ZHLq=b4Um&g`e>Ra3hox8X07QxH#je`iVSKg!DtHza7%6=RhH!U&y6r zLm@j!$X#bDYWWIzzbmGgr3mhWu6<$5>eN`zGA?BXVv!Nujt>x!AK77IUU+_goZnbC zG3MRdYJN<~bm}8+S>VZ7;deZ-FJ;1Bq9Ri}uZI_qfk<@4Z$`txOSUjp#90b*3e7G# zOVA_ixQ%1}k(8_oO;N+C;EqhXP~3-&Du|3szcA^BPa5 zXU2?Kmf@K^jw5v702K;1f?=kajpGDV0iry&4kmkqJ}3~#5(nsY!(>X&c$VG zH_2FN#oQmW-+LozZiV82cSq$wUP{m=Mk4F!j~|hBPR^O1rKSL}!>S1gJedGKBfT{L`krD7G~-q0lmu`+*_7 zh_NlCgt!r9^4x@IjiQ&y$o9qiVs0wo$d6UZj|Vbo}f`AZ93- z3w42g4varOG%(NVky-!d<_2u)IScb zNF9Ho-tR6faeAR*OiOr+il&Z!H{M}m80Y&8Q;AVyAFk4gF|6`?RKkwsd55H@z(AEY@v|C;X z(4ItH$Bc9MCyRW%ErpHKE1eoHRs%aAel!{X60Zn*`NbaG%xdtU`&`X3RqCljaL?AR zz&2eTmU}N`z@u(habq%VDIxiFZkR$W-T`MF@ibu%5OcD*(cb~kBThYc^P*kk<@n(g zadV}rQUh;A^*@v^BGHq?rCdvA0sjrm#Tuw`6?i^@7*Hur0gm0$#M&3k)Y?sG4<6|( zS&h1{;9HvoQeIVgN`G2S=GyD$lrX!=)q?KQsyd7{Zs8b!7{$!H1m44mMU}%b z$HmSD4yqDe%9^4;8EzrMLmR5H*l5lt=9%jl^6gDAo8ugunq!WMK%<}HBMH@Dx5{ts zv*arA?f@TaIP~D8;c@>LXmPNH!DlUy@4!U*#I;v$4A?6#-*deiInI@bZ7{Ci0Lwy8 zj!!xA7Ff3__m-gdGRK%|*#8TGPxxA|(sA9nX)2XT8e8K|$f3h#3*^SWG1ihR;S!!A z+ugJ~yU2CpBAG>4wj0kZa2a0qkjeAV^fK1!_=5f}U5`H&9T+?ZPiMxK$A)2SdJKU^ zS0!$q-$zukSITr)ZzJu1a&>U{p^L9U9pziq#c%z0-Fyr~FL{D|eDRKcQ)V$2q-&rQ zBh2@}MzoQeei`O)n`~A%4XjtDK*ZsoPLnL$z%082{k_<{gkf#x*oSF}E!Fdz&*0bU zsyil!jB{&oj#qls_o6^YcYDWoc~11rG`5Bc%L_v^UpJSlo72U4=v7RQm%hB+`RtOV zJgAlM&M(sv?)HfWni?z~kZSvId{LN_jbf$Fqf zt$l{&Atl?DU*B6lKPO3fsoBJ;PPa5+9;leHq-^~zr7hr^&E>;ZKnoQZjw1>fhPxN; zY*{4VE=Ceio}Qq6xB3kUOX8>f_+b5v`1*zjp3yV%-{ZvpLRNnLe}^H*e?wL{{!fsV zDQ!LHjaGEP%Dknpc5m z5F+5%cpHo7qJ%V48?T(d*KLH8H&laQLFWoDH%>gzbDsAffu}q9*EvTRU0Dj|*2`X8 z9uG>Tes2SVbR?3BWLP2(S7fCGB@YHhsHrLYRMMyrEXNg6iqqpm_4JFU88KEZz;X^C z&XZ{U*vFX#Z$>DakYitH0L6x|-Bhv7N$983l9$tz%1sN;mWAJQNbJU2;Q~&i&hP-q z#9vKVQ~8=vo8UiL(5 zq@Aw!XHV~ddNDPFO(U%&TRrrk${tC+Qk$V9a-gYS@(T#Z5@%_l6xm_x;srV4oco4J zX~2^sKUau1kIVM_DD!Jb(_2^B^-I?8lriX$dt}gIYi|rx4OOBYp5yL{!0|e3a^e?qFb==A(!A_ye#{T0xeeE8dTNIt3W@NwrRVm54A5vkOvaH!*#bv=s2_WPHz6Bf!YL0bfHJ1 zbB=+Evir3Gn9ZRoO(S}@Z1%oI5^MT-onjN(=2bR|YSNM3UO@fNr>5X=Rne02(2xza zsx@FSo~7qZDVAu)&?{<~Sj57fyVcr=i2dL4iYrpsyBt6cGSNlBMfHd#Tv-s%v45B@TmW<&dT z>={pmY+vKBKyadBEn>elcry$F?`pmz?-pz#AcOn~>d5d56$+J9V6w)04Kze? zJweJ8PiN^9!!#FEN$#8u06&)Eb`{!Vz#{z~Eez!WR>MKTy z7?JN$Kj-8NftjkUa%#9H*j&dNPn~bbf{;9(&}K5jDXK4AxO2nVj2q@R_joVThA4`8 z8*ZJ&*wC-*!s6-0>^q#Z?~y|(Ueb;|6l?9dx|C8U12LP%YT`pN1hg3cgF0*N+$V31 ziaL+y3HEYvKCZB`A3M0!`%T72tUbd(n(prnKi_U}zn+kV45E zAQ?*A#O@D0;-v{+I!o2he{R<7fR0Hr-8ym`vc@Wy_xMq^yHk$P>cPtiG#O~zXbAJROq#T!2tMFUd1${s7xicsKQ;5agQWfMK z|0%ZHbfyyZ6H)aY<~lR;b@nDg{GClnK*{# zqfPATAy(qK3r@_3L*^@@H)&B%VICO%^vLi9;va7;)9gAHr14-xaJ#|Wx0=6JYz&OS zm|pV9)v`H6LA6)wU`)P+zdzNJrglv0KtuqvE=Y?RR&k|-HsrCuU$pqgvmw+PJ!oXF ze=Zuy3gK?qUG*2=tm!+R*Sq6r6SEEmCm%0M&sT%axyx6~Hh&`|bm3BUsdB7dXJ9Bd z7stsJti!`aPH5etQzUCKO=wIROd{vj1Akg-+ibuwt4v9|(=Ku-%4e5Z8yl33ti{rt zhU`OOxu5gE^s}_45i}LSQ%UeRL^={z_-CRo%(;f;5M`MIz)JfUPO57n8kB~OI&k}D z+Gh@`moqbagL*!$>U8be6MYMX)Q*3cTzj4qWDE@S(${*|&mu!L!3fXMV{@k?4p`NL zO~G2ZnPr5ToIMT}7KkS{de|d~d5H?3eTEYX_U@++EImNlVt@NE8Sxg-M38cGz90F< zSqsx~XthD8FhB&A+m1xfdx4zQPc=YPId3$&b1$&RwBpam^jMIq64;jAo@yX`F{Z3z z4PSsS?p8+yfzNSQ!6aRBu#x(MR9yfg8=q0yW>j7T?aoqf22@m;gt}I1`^}c(VS3rn zHq1A+)Fck4pfBn!iD-mkhv%C2Tx?tq)F4!=jS|5D1e_FA+FLCnixh%&*)y`4?op9Q|=4}pa&Vgi=fAtI}3slbCPGtjAMti4X&fB$IV|c35H5p>-~y56YdLQ#r32&74vcI+RGi0FyL zFh4N}@QWgOPgIu8z^EP-j59l_GNmxL-!7hQuN828}p{X(ZXzUauVT|kW zTWoHEpPBw;w*{EpRB)7lB-IcFM4>avpg$Fj1H{O775h)w16#3}>G2yRtv6Iy3s>D0 zZ&$w{fkgw;A79=M4Q@|-fEqlm{(EZvAKV2q2gm>7E;#=icft98!d+Bp|Bn$v@G7D# zF%YTKxk9-q>`FCW`f`xKg3w$ST2z>{np&Bn4EuMF(X+~9%tjQhkTfb~la6;Sy`Nyg z$K%<89Dt19Y;Z*2{l?hsD50YwMnl$H`q5x0+RGWx)UUQOw3K46{JHPxTtr|@1}}*t zcIfGL)btW@;nPP^%TQvJYJptY%23m3zEl~JH*DYIm2d&?A8B4IPH*HWdcaAsf~c`w zm9oV!`dfEuK2_YPa{2Xs!@wXe$K83?sl~YggpfV_5%niRY#gr1m#NDb-5mK^MBRu4 zGbx`R-F6|=xOCmT9iL9CPLSa*u{Bd@Hk^)-;oHGh9x6FDVdvBP26z%jyaG9E!pzp> zG~%Aa&I-o1dx^@D!>VDQ*Lefy%XP(``??!!@;omhXpLS(4aQB4j{{y}5v#dJHDlX_ z*xXDf(mdTmn*Ob~xey#fJ%)Q1)^xQ!g0yiu<#Vo|n_VwfLEiVVJTG#AkvXPZ!=0&g zQimqaJTH56@Kykrk<&pJ`oQK6&-N|P9CG83`>8x!;S!o1ShrJxtSri}q@oAb*v?Udm;GagNhuWt+;q zPesH+n%{eZ@uw5ub)A@NZVvd&syxI1P)I*Vv!w?%Uh|dcXhp=wKi7k51l&MAAI}o^ zy5OM`Dmg7YP%6}2D8DiUkrGsPRxF^4t3RAI*tpkQjrMFLXP8%~7-e@#TCz;9@-9SK zbhm#P$>?*U~N}Dl4X5& z;%kD?q-Fy1dlsF~27bUiMYxQomO%Z?Zw>cV|C+UNJtUO|8P_x&7omir1n6zqLiVqO zT8j}}LD=61KHc(8tr;|Uqx-D@TdR-+G-7U<1J9Tt!}94voylw`d@I@%L5G5k(zWp+ zbt*xOEO#l{05xIa=VuMrN^VIDKP=4t^(|Mb=%PapU=17L_Ndvy%t>(MTP^7I9kd8G zXvV{1BXVc_pdS3I#pg7qFm>i14XwngH37GL%9@}q1hK~B|2F*54K@o5QE?ot%Xkk| zoz0}MZz8oFntz311Vc!XrqNG%dU|3DSY`X7+geN(AekV8F=ONs6*1};`@sMi!kp1n zgT|qYsRHR8m|29Dq5FL9JmA?qMTk%;x(b;cgB%lKv#Ag-RxM*m%6A{cKVm5YgT*G9OC9RE*EbNCkZrviEz!YIGk|1>*E`I z&A0pD9Y^NAwhAcX-J@GS08n7#x5-GJ=<7w;;Z20x_OyGaw*h@B#hN7u=8WA(6eBMF zrWzgTPg_5!okQ!R;Z}QtvQ}nCJmOySwVfcMB1Ar`-LGJUwASH{QLB_oW+=Wk$}@tT zkXr^S(5y5apvfg<{%bj2aAg~wGd9I6NOtP?J&_C1Jf6UFf~Yco!1-n2Rno#@4CUYrSJ^eulhR^Q#^buzey=M@ zahJUg5#iJt+)_dke%3i-6$7&nge|d$>>C<25<)q5{xwA3)lh;Oy@UEKRydUqEKp*?QJk=vZ5<%yH;~747+#7My?GmF-J(rCeP8Fb;4V z!P)b9lyMNm{!+pg@FvLF;*A(Em~#FIM@V}zLcg!Ck03uL=;$bb?Y8~BMO8zF1fvvO z@Y*8>rjAfm*l_uI0Zpt>tank%Jp2UE6wjWnz{a1uA+?0ncUTWIdt{UBkyIEat!?AQ zXu(1^H`@D^Adoc0fWl_c9lxEvE5TNW+!z#AfN}6E*1}Q~8G*aPY7Wq)`ILV~>{bFG z#!3TU=6E;fw_`~mmAMvXGz%`_HH(bEYYGsbMq|a68|X!99GS_Hvr1$J?bta+{J0)) zXv;%o)>ocICyKlVYdz&`g8-e&ct6H@%%a^@R_U|nJ@T5m#L*qS^lh1YnSWBA_EXGX zs}x!GUO5&2aQC|%qy%nwwA;q`6>B|Qdw*FSefYcMErFlim11DRmPtl_mM07yn#f&g z&CX`Xla9tlT5p;?-OUL?6%F(fbBFKet!0II%;E|L<;rq=G$q;`F0av|jTXli_VL2M zPcOIIy^}w*jcl+_mRDNnYA20zL0|mq?iD&Ujhu)>g|`0Da%7;9{~CN4B_~mN@bTm+ zE^)ukkG$4MZ8S)`f`;I9up2d;Yw|f^RKy7$hE@jdbB7!R^<@}p4m_fZXZA|o*{B4< zfM*hUZV{Rw_5k6$Y8@yxZ3y|=cypHce2n^aA678|N%<`XRj2<&3~*Xu^@04$SNFY5 zD0csjD5xoV8B(eEd?W4Z$FV}+P-Z4-#i^310sy<5a9pc1aAguD%yytPB+JJ{@F2Ib zEIfv}7C>7aZ173nrS0x?e|nDS1R0RcKAXRq;86(NAVVR?ra3Uy|5cR@vJW^ zNep=TKNc-ciH^psubaeuby;|GpeJ2Uts1+zU6O6BU`(&`9TIsD zp{UdtW5_aZexZN%;Dtn{kWDGw#%MU~l7?2n#Gz;9r<<=2HA*hN_u8gk=9+K=U+!dx z1fm?YC(>hp^%d->EOkGQq>CX?Q>}q?!`&reo+#wGT>lfMFWCnt*`sS767JuTFLl;* ztlX0tZPm7&vWW()ep|siB6F8zwXm1tiPL^4S1XY#A_mASf(>g2;M&OH0p@T_zhN|0CN?OaHjcCejodpQK8apQzVqf8VywO1y>q8Isd$pdR!h4xM5G?xv^H>fUH@p!W6G#*X;|w|Ld<%1y8)gkCO> z_3&+LV62do;`p5zIbd8VQXVNYP;hYXWQXWc5JG~~Y|65Cx!jv`xgMnF?U^e~6G=Bw zjP{f;o(fNbC?hgyE;vF(JA8jo^DO6ITPNktiFX`JTqOteHL{XyJT)Zf3S?g1gjq*u z?)IPuLRGqOg6T$RFgs618XK3LbiXd`04=<`!HwCW{hb>KByIqF<`m9S_@v<- z?Zkd~$jz9Y4blqFl=^Qym5>Y`xjHM_J3#q3PdIz5Tn$Tnapq)S?fJ~^XYPVW&ss(Z zFMWcKDS~h7<%C7t;aiiNR^0G(#k&mpv%YuBUQ2tbZ7tKg9?(C(rH@d=EBfyQd=W_VUEFkRCPQp)mcpO8; z$1aQ+j+svzSQ-SOchVsKzP5(eON*Jd^Z=<%6&w=BVzN-5q0IH88P}af(F>VEJXzLgP(XF z?JuJ$_ihB38WSqcT3O;sq?;lm%4Mu<%N0kqu{JR^{y;TIovO`muII`TU?lKkeU2MS z3Ql?ixlD7Ld1y*HoF%N~sTjz}eVp-L$Txpt1QSF9RO0E#d*I;3AqDt*;`}M;Wf*kH zWJuOb_!_(0tE|C7@xv~$(0+EbSV*On#Yvo{%yqb>t{M(S(O*l(e3_D07g)s@CNYnK zne1SxjPN6lh59Ury!tP0UQ{xDxPH)UH$2@pIdT@qvz$RD_P3RKf&Z}8Mcc;%aD6~y zbS#TB(F#QF#NI39phf28IX`w5{^iaL*~v(8$O5iO~}mK9DF z`aLKn4lgyIPIDBQBr_zf5#};d7Do(j52N&2zrb zEU7~6>c3wi|o>gUt(*(?_5`E#tc0tIVW;PxF67$l7E+&%(jHT zb!wnh5kPfh@hm6zSvR`o+wrN)C~c-* z;eWx%kjcdd>I&$J*5rRKMRxYKXeBFBqkPF%W`94!zWrUhlx|wj)8q{fDtz1jO*U^_ zDn}M`XW~Sy{A4;;?Ur%O<3&L=0i&z$kbcC(vh(btd4}ROibX%)&l_pwm*Y#blnp1( zpRCC6u-Tn(?q-+&)l6d6K=#6tJmY#;FCT__};7HU$#_r;eO$;1dqr`^*~6JhUoQnX(|UrTmbNvIFV5iBgn9<3;? zX*Sb9Sc>1gmg=F$R8v@wP8?_E9To#`Gu5s6XTnR?Ys`>)vu3B9*mBil-2KbkY&N|I z=@5+3pv>)%zJH{FWTZ1!*8n-H=BOmNftV^95;}50at{<}hQK4T2Q+6DYY(5>KbB0 zjib@xGN@(XY8Apw4PqYPisAxrdtczu`tu6}BF!yoS7YX=Yu_0CsnYwJ5;H{zC=|b} zd0nZG6elWs8Q)1ntUDxA#+NC@Zd@G%M0$FlAZ)vk(LsrX!}g{*A|n~%{1$%2#;*|egzhEo?N@{L9e&jCsZ6FMGmD*9Ihh@igt21EzCDsW z%n1EvMTG;G&F>igf`Z*Uu||cO;hpx9j$z4qHfkxFhE)IL(xUzHl}U=u@+h$z-tI8< zkPdo0beQz3Gy9WZ6@c`9W(Sj!I_#kWrh%uYr6J!(O zF;-cGCiZm8mcV!A#vN7ePS1=Z!;YdyhAn4oKvt?}K%~RJ$fqh`S%sRBcyU$USp^|E z^gE#<4`z-rp?Fhukw~1zRpt5ZjpV&68(;y2=yig{ilcsImzo+)YBi4f2x>*oFCoY= z*O?6+Hl`*T@XcfdolJ)VP%c0O(LW4>Pbh}L=1(bOq?SwlgP*ARgs)1k4$~AlO6Atq zd?VqJUt1x1Vj>09R}uq7&VcBj%|fI6a$H~a=S_7gwJdSgJMpuce*#NX)-I?zWJxFq z6t~3WAplUoW6+7!1#=Mcqy9iUP$ka5k1#*sqrih-Q?MPK;W!?tZ2_~xb*@EBL zGW17`@IOR8d->tl^0rA%(1m{LEpR$2Lwjqo7U0{yh&Fg12%v@3zC(OIh$>oNS?*Oy zh+N6!PB3r29?mw;M}m#QHvL0o;hZy@2hWo->vGH^=>_-xTYZ$J8mRgKetQ5WJq}tO zW|Z+056LJ(comZ%y=`k_rG*05snO2PE1ys)Zt>+iY(jRb7NYe=#!R~?t5 zS=V-nZni82$Olti{1xU|NX9YHMV6&T@F2KD@YZyin|PAO6+J#UwF4O1CDAx<$h7he z0sJDqmUpxGQ|aZn54k^2ro-f}rzGv3&!5<(Xc8JT0D9OQ)9oMBFa|&BC6$$t5(sO? z3bw}pfa0uw_iUJaKCZSt9*H-L4Run+$k9eBdw{eo+a5+=IQy}X_prdEqiI96=V3>E z-%esE9XQ7WS?cpI+a?Y@H3Y@_^_H&|P9YVU_`IwG#@k9@t(Z(d9(O+GgGAY4n%3j#G?(N>2I-xdtkdE&1b(C zet|{PTgHdkL-Go~m2tvmGlL;wZhCtw`tB-sroP)`IMaiJW6U%fOn+UkOtPqGHJI8}orj(Xj0ZNh+Z{>d%@`b@w$1Tk`M=aS#Cr-#EaLZ=hwf& zIT1ifXVk}MB@Bp_+-8CqI9YvJMmYz-t4C*mxh9`5kJ6m31R9YBnx1I-!B(Tn)#1$B z6Ubk(xv8FDose1ZPg(SDCp@XvSmhG@b1$RnCBJF|9r$^4-Os>dbW18e~dP?3~Y3b1J;a-bIL14Unp8Ps}oSynF zW91;`t9!$$Mbc-gF8X}jfN%mE_7go6p zL>W5q|G-__%?({`Y1;E@0oTYsti^3nqQA!QGk^^T>48+>Ppt^%UXLE@wXIcGyrE5Y z?$VTL27XuArsQ0&m@O1otYs>U+aOI$4g0PxERrQ05Hwp+;V}ZyLs3@j*fHxR^}b-g ze3%wHDpzX1F!bD^)dMI-glZ5s66<(oy5W2dUVAqF{f1@a;v+OSIaz`(a8Yqys^~L$ zvobySsv;ukIkbal<#|HIBpANuRT69jxQE}PJYz2H7qu+`$LCb7DuNX3bEpo4$os6V zF6LQ=xDHsb&*ZE8Fjpd`7TA|J2oIKYgzz@Oao=3JEVVjJ6kMPdfMnZxPQh+0qjw5! z;FAsPn7dc351Ob8YKs`ZFFfa^2a!J=+_X$)lM_xV_yh&8meOBbx5OXLz8x1l(mEY~ zNrh1Ei@L&?1x1*IK=qezRfd(aX0GXFU|&6Qv5lx!jO zw$J(<^!D3)ddjEN0v*dB3r~tCDaFp;t);?*`6XDLW=;#17{Gf4T-X4rT|9NWbG1lJ zw>7YhL{!;?2Y;c-vuPdP4opBEUu|TGdU!%S!UJEkZrca=LGVFSJz0bL zQD4W2s57HRNt|xj6>3&&t4Kr0x8{pm>!*(ry$(*tX`pEm8DiyOu6J*Pu zg*x(1!J5?B$(v)3O|QtCg4AN+i2c<$f$M*69^uBKprn3ezTBjH=*cW~fJy)`DBbxB zk;FcS{$h`UpUI?O2K>#X9eMCR)5Vts)Hg_-sj=dG6uJsVUC#&2K9yfzkwsuq`}%+w zu@Q2PSE9^cNNEpEFlQsiu#(daJ9i-I#v<|KgQl8AF^VS#f?WLe1s~?e*!~eQltauz zGzwDL;SGDI_?L@05Wxp_3L6=-nDILu?GK-p_&SWKN@kgHQUR7a=D!xleBCtS$*wB8OYzEo9Ry8p#_`_2K znIMTx7YJ|C$-ZyRY<0bDBR$%mWWlPIC3jp4UaNE|FvZ#8 ztXXsa8gIPs3?0hiYT$tD_a-tcV8gxlS?jwBiHVZ1ORE}?p@Z&j^|+0nTV|Bgt@@i5 zV+xmfm|rYbrp)SK$bK(Za<)I=oN@DphFEipkswRtQALOtE6 zsf|cp(~t4%>3yH@cBcn8j;N3EzoqK`n zTQtF+JP2uQ=$OpbUV-r&n$hn>y5FM=jQ1b$U#jI~qhhG`-x2h+x{=W^oXUNeSGb5s zdHitynhcOo&QUVf^2$n2hOC=z!TfcFxI^Ys)%+pdbLF5#7k~-Pvu~nqnw&?uC%m_N zn0fL#WhQNwoJFotLMQVgQg0h#s@Vj9|EUT#)uZ1gUwVGL8p_$*O62}q=Rext{g>r( zWWr4*mz>&CYkg#U>A6fdon8^W*+F5G_A%u|^;op@F!NaS46@tq4p=-~b{CYD)ZctE z`WnI>dzB4c%PvY5iyt9ae@V&!QL3Y&!`iaro32e~X~Ux;0&?w^D<4y?ok-J$ed4oA^BW8Y=VpVLev=%7^)jLW4e-+6CD1F%0`&7GZ>R1%$N%n5eutg`2z>wpBI=6%s~e)f7-+(*vSi) z1l)q`Ybo=N4+3$NgU9#yJq;^ZTp5{n5Oeh$#1u_1&fM?(v%SY1evxUuSbf24+o4iE zk1H6JCwK0xbaifJc@)_y`f{VRBI2;hMm@k$3H?$ES+5 zHn!A-@Z_ylvjXvpnyjpF&fGwcP(FoPU@HU>g8BWf5yfVoa9nb%^w}^_&qAt0FXOD^ zeFU(D=xgz;C$+RR*4`I0Z8&Bgh44T`ZEXu8NI&Y;g4E!}FsJhek7LI;e47m^Zpjm1 z6K&n4qo%>OYth8+oa-_@#M`Oe(ss|NV_su1YUR==Vi^hieM?b@JN zq2Fcn0!hm&l)QO2om)b`p1A_oFVQ3PXB}6Q*KNbru*5X_3fcJ1<#v`fg#wA`g$uzr zg^j6cv3-<(+3O!1&;x~NFHh*G-rB~BU{(WK76o?X3WG#g66pLI2swTi`69Snm!L+; z<6O+>CE3=W?n6H`zJ7q%Y5lx^ImjOZS5^JNc$^NbP>et6PVdR8)HLpXMHdl{HjpP@ zL`s=SQJkq>Mk*-5%cl=0_p62bNno(O7biA=aBs_`b2lw)qnVJ_+Zi5+!FoIL0^kcg zYGyN4SJ>~M7~|(S=6jLE!8I38obPZ0#p#dSRYiMhOM{+VxhQKyBq^xm{4h!d8k|OVfk+ZOaL-6@mR@qq$MOew$S&j zGS*o0S)!vN_Gk^(ui%hJ2RC!h9h!CgF3IkDZhU{&Ml?R4n;Tni7m*@Fuvns6+^SJp zl%RZ~!Xy&IzqP=;Y*LRDGTDFQ#%zLseYAB~3H=07bs2=C0#*!sI|wJ(eg(?RY;H4a zlLcQ)fOHCsNTF~C40=3H0jGiJgiBUq5-%@v++Ev-nSdaVW%h?((UIg^5nZ5y-J7C! zcya-7E4^c59}S)ZhW`vkmL0*Ldz0vl38!iumATFF<`~wb|xCaVN7lHd=G8a zpHx9nQPXqto-!A~fq$usUIap3s17C7(pn_c&{*dW?;0&o>*w}<;o6|NtZ2zCRwg>s zUoy2&Vr-$sxuwq+W|N$f_vhSg{(k1@8Rl5Ju?l^%z)^p2pD(vf$O_wF*j&}DGD~aV zlfdou0vc@Iv=@2km+hkpSdy3ZoNYLjxb6w92JwsX&M+L47A7b1a8CRB|uH5#77z!B&hs^zd?9T)%r@KFAS<$lR?;}xGwIv zF)!lyC!5a8VV`ltHExhi!anXrfNUyjwUBG_q@x(kO9zYjDTdopZbQMNa#=Mycru>= z@&rA*bn>@c=3LtDn6iph-g}%fY9;#N`M-M4IPFY1JA#O#Jb-2EOA-M~T)9aJ06)ZT zI%4*(MV&qyZyG3@A+o}BAvLl9r8)SlNMH8&a$j_jg=&g|dTo0IQ2wO+LoIpn^`p;T|Q+&)nI?dS~1#R6{IDEF;QAf$3t|7-%J9l z{cV0E!)275XQ1^CA;hX}<>Oa8HGyNRg()u-9rB>x9AWt@TZT&#wz1A&4hptbiy@OG zl_EW!Ah7dwK41oC9TTV(i-{4k>0w1xi4i+Mt21T73(qj=PhxpcIR_uobIv}z)1445 zxfxCgb?OJGS4+)(xU$()k6I9)igOg}(d%6d>dP8Ws(myWKJMb8%C?FMn_b<;I+%{Y z!EPmxpT6R_|5lr2_b-&}ihAu-TMMeohT}FL6fxRKUL z7L*mUwAur(PsmbGg^)(yD@G-SrF^uV_`KPwDZM-vVfqKCn^t6jq-Zuy;sx&>c26Q{ zV97g(dd$Z;djG@;bgc!;7Z7Y(ov8(umzm$Hdh>%V@Hbf&Tsh{CSm&w zTa#32R`F03y&&8ZXYS}s1x=AJ9nEPX9m;MwWO^%7!bIz@ zrDQAuLEc*cHP&JAI!+!`WBvh@bANlc7zGWR-a@;xAN||SGDX|J zg3^3SmQsDS5wSBqVPCLTerzJ!br_1iy5J}@ZEgRuHCzmo>~$kqfGe6fX?>nEmcz-6 zrpxacW$dCjqT+I3foE`LsvpW3@bQyhu;(c4+vFrlH_uoDL6(;KBWItSwXZu0JHm$q zwK!%pPIgZ=WgfilVfXRJq~pi;=W1Cisk(o_<&dP&zSIVN1>5S9HsMxZ!qGlPXBPd$ z7DbAqd$2|XdS%B*$tO1n#FDuLIj+fuXwK5JY~V&_oV?Uk1oFh|BMoOc881wZz3nw6PAth9_5(5=PH~OEM$i^70q1lfrrL+>_3*H?BW*b2IP5F4fym1(9wVJ%3*US9 zh*yg=!anyADEAJ#$}q#>>{-ic{B_2DS`0V2Zs&4hU) zjO3Yd?b$im1Z(rb8`3#+~NIfz&Sto!km*|Z~-=nLA z+R&~0?cmS0eFVQ9O*G9c^!2}y(mS$ww|>gQ_3Pzm{Qv%7JpX_9V7%U(!+Jli-?{by z%T%sGce$xEGMiYU9Adihnbs(r69z(qMqRor_`!H);(of5>WllXj=P2Q&5s3?kuP7{ z*Xz797~wz13y8v!D1f`ocwTX>iM3>K?IAsFM0IS|7}luxo;G*kmyBC}|`j zti0QvuJrV@OP`R&7Ppc!;QJ`#=iHpwpD0d~FmW$@ZPJ0kF8UOsJeRQiL@yMdp_9bm zSV6dTyjs;}dHsM(Zs)PG^64izk*VvkxDsVf%5NuK3bdFtP0!66lQc^nv?MtvZk6yJ zsx0l9PqBC@B~mk)w%WA!0N-^Pu~Qz@FwiluJmj47*{Bp_V7MlmUvgeiurpSCfTS8; z(&B*kT6qIDaii?0o0$J3p;Bw%kX0Sf+rK+lk%7xcMW|RtsLI|}diMqamSS9Fdp=#&&$v75D?s-fhxgcnX&PSp z=#&%XmnW$fX-mG^{+!k>;6wWu! z-~U`_9yWKM23ZM~{k^;KM;})T333DLR6m=*LYii(85Xa6>u_0CdOe;|Q!eO8f350` zctPnc7|&TH1=;b?Z*}lr>+whyZ&FSx*-ay;BA#A1%1}CCKRi}t>tT%FS#EZB^_(-8 zR!WZxS+V9ss%JKFmBF4j6d)?grG98q!AN2RllcX>+!H`V#{iT~Y(?Xp_J3AT^JGEc z+di`CGtv8Tr#|0^hUE;Y->2;3sk5Z2ul*VYMQlC$aHVB9WQ28{hH;HN ztOUjSOI45A)aVQ4gOZ1FN=969>?)jkC2Sr&P(Szt^B(vd))CLiJAd;LH1Lyr+*Fvc zA@8Y*cKfFPYdATpXFXnOV(T#$O||t5=2EYBo^)hR%dan56xFqJkEY$&fnQwfuwdMw zL`FbCkhce(y*o^oP6|aF)S2#9nj9-z-pyC4GPhrsVF-jVWC}j6z~2XbG(lLE=fft_ zn;&e8dhb#X<)V<7)i>?TOMh(jE`GCp-HDIrxWn&i+Gt$sA|T|GOu$(F+eHim6hX5$ zExgW`J2;HkdwFtw*x~jyLV@wsJeHAqI3QCwV;C}#Hj6;29^SG>5CADz^EZP++5D$tk}Wn2R&bPj~9=LCLOGl$CtB-VH(|3;E2a1%O9A3RdO(& zA)E-9%6~<+@vMxbCIR!ELG_JNm@s#-QI&TE^u5g*eh!nKUaj(w5G_yM=O zZ}r7Ur2T2<(?6k;L5=wl%R10mR^&MlFTO6fM2A-k5B?u%_3)P zq@aatEVhr#wCtJU@+%T!c`aX;y}Fm=;79J({d7q+ab89}N(P)?pZZ~N6FBrEvBtMx zOyATbsd%kzwW2rzmZ$ZP3MfODWsW@&`IfFT)rG}`Dw&Lf%hTlf&rc21yNoo4bEi)S z%sKbalb@*|2ItbgIa)MRp%aJJEM|4Kx7Op1PbGSW6(fqEITj{ zXWTFOL+d!|vln(?kUGZ*I>SCF!F0`Bb?BREwmhDyr2`nyfT)#QhUc`!1&VZ-G7$NU z%JXWq!XCNlC5sUT!zu*&Lbt}nR=@v3)U2^<$6|F-;E5RuyUz1gCL8n1>5Uxd<6C#3 z${DoKAeo8&R~+#ZZ%}Yb-QDBG87SMyskB3|=)H+v`TH7S#1Z*$q-GYRkpTxdLJ4|F zq3z@DaZfjd4kwoxLJhnbHAgwTuDzcxIM=Tv{fcFeAcwTPIMp_0Mj}wi?5416j1J!7 z?0sBiQ1LK=OnSFv#Mo|Vj3r5GP&!_6$E-;#Lyb}+OFA*Nt>L!FYrl#}FVh4r>68!D zvWyBIO#Q z_c~5A;P`r`noftI#;Q@gvPc$VGj7q7S8GdlyED2C!`jPtr1L!Ep4zqI;$BhSs6^ot z5wyg!1sf2ItVSA_mU|dXBdqK*h{3!PBk!StUa~kLFoXHF=E2_wuv#_0LnhCNlf{$T? z-Yc^cSi0=4L{;H9d3D7k=r^)#5MGgcQU`Y~iZBb;V`!S$_ny*Le&NU3@;kuM%=VhKF0Qp_YNPak&1A6&B18dob7 z3k^wel}6#puuQ{c5%LK3RT@_l3u5MScSMHUZd;^+) zW4ypReY1<-MM-{XrX{Q=h(2~0QIoqT=i(tFrrl$lBzdW_^^VFNv?q9j|*9+fXX|fO-?1dh;k4pkQiLtH~U5(Hq=+xfXa7-u8s&|CI2Ce6r+6zuE#k-7ftL%T= z37HRh3~dhTd(l7|C!}q_v|96)yZFPT#gy-<12^S!SR|#)_$#f(tP1m5Y2 zeWjz<%!wUVQEu3dm^4y){px;E$!ccg4e3B+tH-w%;VaRZ*xMeP#87&*uHxJSzl?9L zxITi&&*H4hzL?79S@r5>A-cZ_D}JntP-My}wl;Pp)w{ewb0~=|TYQ3DeS9F#>)tVI zzo2}9Y1_p$ySlUMwp|sy;n-(0Bg)&81yrM7xZn#(HW)I2!T(~bj?Dul7PbVwX@8TW zUr}_kNIb1O(zjto>)5zqyyn?7*G9^0^mQGUO;>IjY1Rq%LED%`%Ee2}R;TW)*&`CEa$JFEQT6DHi!pPdE2pT^5@#zDSC0$&5W8K9Rvr(c;*((P-W+ zU53kh*Fx-GTizr=OW~dCn8&E#7VX;@`OG5`kNIW%)h(2PtlNx6^yy~-{!Qzy_e;(g zZ>wmQ3y<(=23~TrdVipGs0q3cH*YPDy>q3@QmHcUrZhs1>!haBdceMsxUfN>$7$j! zA)+5a^4K~9-UphxhK&+~NgPZ3g8mc=3$wuq);lPTKP6QOp4&ol4pD}9H#}d~mHH66 zVjy8$Oa;nJBX(YcyJ%nZY?ItIPJ`_pb!Xw0_`(Sk&D%=1Ha-8dNX?0bn+V1Lq9<86 zZ@5EBTo|l^KEk{D*`>PJ&-gEpdD`yik$Fr5fZhn8z(-x#?QPa749#8xg`Gz8`a3xI zD!#gL{!#@53qp%uSg(fV-vlA}vK4|H0Csjs`AQ`+v+MYpHp-MecpXbYJRdb4OV;XK z@>KEaxGhY75#;kplTub5C(YuzK+#eQx0$`stM0qE{?rjlI6=KSRcV^w#=r<;YEX(L z$YfYeX)}6CaN_A4a0e8;0%c;TW&GxgMOkZ?pc^-goUj5hE7$AZY(Gbrmtt&^*1L>| zF(cKe{gYxuZ3uns(~A!b%9sk?6-#%I`j|7~yQ(?uedcbSzL17x(?+~!9Ere( z8`xH8rsUT<57Xu5LgJ8`^O`%5nw&-&=Gi?kOd&q|(g)JuD!(m8#^ zB?BRADlw#@MNSTQIO9u{%%-g`jXMozb3ziu%BX5cr6R5SLujXlO?_)ok;=LLLoema zJy^tgx4u1U#*r$jADx^esLoZ8rF)J7z>L2|^WW_ik7IwLBou?PAgorrZAqn_&Toad$SO&b<<{Y*P>#NpVmU2JZu` z9e_C4^v)*+ryXBW1x#@eI}8o4p>A(rABYw3{5!4v`GOWsUN)YeYpwkM{(=_%|LO%T zMOq6E>pb_sw05WfZdN}5hi04I`dhrIS#vEGjw~KD%Xm{;U2@7teG$gn7RhbXo=hAT zKsTE)dN`-$2>(Zn10?uS-?kNV(L-awuk3keMw|YL!dZPu8Iezu2GYKaF~7}}Ymb!Z zCqMCvIL9vWby@FXNA8slJ(j&Bz%0QoNyq(CI551O_NDaUE9wM-$tNmn*c5PYN3lOI zC!Dh~D{`U1AGTVV3AOvQ2Qq1rBoCk2>JD{F`8TiMYD}e$BdE+v54D^qlBFNMLZI33 zua5fUNA^51;&H<}*BRC`c$dX}?C;6nP{xbjob$$W1s{O&;@9g^Wn0=PCvhIdl^xKruXKDijr^T-8?7w*MWA zh5$naPNIB;Oi7J@m_>;qu)fJs`5uPy&SQtGMn4ftZ*<*+kKr2UnLEK>Efmor*wEyt zTleiSEOfZH0-MZe5^9o)_>u_GBJ4hM7%dtawv&vX3a{w0R(*<^b&wp4Om%@}ibpXp z896$eWyY#~e)Pe_`NnDO$N|gpxMJgj`FymgSK1S-rzG{lh7P&!hj9eE=iav;#h0j* z`YmiLCUl7D?P+R>8PKjQAss)C7HkVr)XivhqnS)fBrK8gFHQ6p=vhDntU+VG78}sh z_MpqBMaVba?ZhpwTCHWoHkg6a(tA$NaF3cV@k(OL&sr|@%~6CX`I>%8*nvVM1u|YmUP&JQRNF6NNIRXCT#4xH%N4XtC=;YE zgVDM;SbGm%C+Obie2ew5`Ql6WQQU<~t4{XCL@5agb2E*$4Qx(al zu}_`kp1V9CJwljR?z@*($V?Q*di8R$>9Tfw7P>zkPWZ;raqIGeymT)m7kb`FqgpNU z=LoJ(9cN8bu)kR*aVa>oFFMObtiXIRy`IpKV|Wr_ZI(w9Uf@HohqZ2oQM_c$+c>|? zFjbAT_YOxTAj~1h;O(npiCCX+=xyckrxy_sg$LOfXg8$ywT}6-{0vw`F$ep{MKuQo zHVM{TT8{Tgo%fYQ)lI~Lja#%u2jT!%norg)3`|z&_GjbneOMq5&A9Kx(HSR@)Qu?Z z)-VK5JV{RC^#Fdb&M(sW1AJ&mqY9Dg1nIDljIRw=y?yNemf64ylHh%Cc~|mZSzu)$Q-|z7Z*2Jo)PdYC^DpYKL%Q|5ydU~-K+Yec*#Cch zIKCV6Pv+r(ywTuK`uub5;`n8YKitLfum0lr390}8_Tl_xi{JG5<-;HT;)J~K;h*sr z=Pz6Qp%3RTAO6(mpTjffFI)Vk&o3YT(1+`v!!y?}Tl}F9*DoLb)aReWGuJO${HD(@ zAO6(mpTjfvFI)Vk&o3YT(1-h)^Zv5MZ~FZ5;Sc-p{d0Kc`wKkZy+P@B`|$m9c;@?Mi$Cmh_w?Ng7zPrWxcYXN(IXv_K1)lF#*Z-u?KZj@jzrgd|w8-!JKrr?_90PL!FufqZ;}@>v zz=zi6uH=sZ5O}G5kNVXBcfmGz^F8w}v{VD!MRec|6SJ64U@Z-$i)7i`?})YJj`TT@7$|m4P?kMfkpp+__Q>!2i7#19C75-NCGdg9E}? zeq5dqNcs6vgM6Tp5~1gOT& z4q(3n98irPaA#Sd8ZY4PlK8DK4T<)O~6SyC9u?D%^O~Ocl zT+Ljpo!lH<$l33DzweVi5OMG{Rns;@Kf^Nw?Cx85|GsQy+2ZaT|4;rU5($Re=qsx`oGKltnFX7znA;h zV~~=Nygy|ALgKgczH9e?ILrU-ad7M4nKNkzGe>i42TSl!^4(wR?xt>#c{<2w%KqEX zaCi6z0`4aAewGA6@bGI#+uA|g!PWZLzLd3v1qeKs2cEop1c12O-rB+4)!?^^e;f0D zAxrL|in^LElZLfD$dyIH(a!wezy*nm)czj0IJnu!Il(h1+;^SiPq#vH?sD&3^HT=0 z<>2K5aD#LIn;)bGuq61~JwJbJ0Dew3a$XJ&avpH^2ig8i^MD6pUhwPoAwSN$h!2v2 zNb!T?jyp+k%fF<+CAq<&$M3bUvw_w6y-G;)V0G_K`B?maP;=H@>@;_gfKkEb={(pgL zuzCNC+PkO~_#aXG+oViOLfrE62XP4)vp+EYckv4W1LOyW&0Sy%anUcl{=hE;kq{^T1m0cC zU~t^YfsgV1NQ3w90Q9pwq|6$kmEngK{WcAhSbdk4%9gy?c4?IKViuUw&B12{XYUP57(c;d&dR- zGk76~|Ce1ZCqK~H-O&x?Vr^;V1|}ch_v}CxZeVJ_4m5SQvjc&X|0BeIi(!62Tv0_< zS3=?k#O1&w#oFv&F@8r){);Xe-1g7$9|GII{`(!+KOOZ~l00|QG7t#}K_37 z1E`Sx75w{I3Ia@s)^`8}ry-X-1m@g#Td=-hYKygRl!S*^gwZ-1W*bn4U_{a0+oQuKsBHyPzz`RGzFRg&4K2Q zc6KH%KoAh*>~3NQv;bNGt%0^cJD~mdU`bObs9oghn^kPGj7>h6LBI)N`tM{}SH z&=u%vXX0uFbagT@0|DKD?m%}3bC8RxnWGB`=mGQudI7x|?yM(cZ3p56hieezs{Iy6 z-DUi+JXi*N$wMsX29g4SBRmk;3cm+-l0XHJgQc4lI1=aQ77=lEa{-yy1H7`bwY~Lm zw417m+Z{CF!p0`))7>!famK{BY^X7#DN73i2lLa@`-&+uQHEo8$df4_PFB`gX^6!{ zim=N}>|)ViCn0S|sjipGxkXbR$yh24w_p42Yc+c`avpz*JHI-7pzglk`q}rh;L5eU z41*nghC=U%^0-}W+ye7W4r6o*a`hZi^}G55)3v#k;)&q-*m(!K_1%vzvrW%!W233Q z%~aIPka3XGhbi#bZf$=WFnLF{C@fquq&%12%J08)sWD@{?AWnOl)ZKNEv6!1G4;ZI zpvvLn13i7y!QR4_k5jo9g;v9OGvHhH7^*0k^wauYOj66(`+qINIlT2mkX9wzryG4Z zx7lTUoT@RL-*8eIy*ZR#R4eZM+I9vQr;PLvRrwj4ujr9WQK_>A8+Q&MFI5$r zf!78eS3XR2Eg2D4{6*m>)r!)u8q^!g9dazWFH4~YGXaHos*`0sQ&={%jmgiX;Z?bc ziVgG5RH^76+punk4bUsYa1`Zo;q-IWk!9-gxVt>|t}+ca%`}b3kv=|wZOBk%(;X7_ zfWO*hsyDLs-Z(_M#iXaxSM{x#sh3K+SDbNK#0bWG)+@ zJi*7))yiI45vzn|kIV2dT@o7@J72Tm&*qj@?&p zm{Tw&aNc|q~3T?M!UJX%{daX@JE{Q zP}u1rH)3+0v=zQSd@qD4mO;7~;XyVoK22m~UqCCws{yDk7xFr}Z&kOn+Y6!Qod)9q!?{shw5k(hiakh`3f<7=6ewi08a;?{4hQfzUa6bXC z7lIfxJ`CtJdK?2vko7iVWJGn}%sH3w9z{_bkKC~2F<8@eB6*3?lr;grBecJ^($VGf za7@0D1Irhq>`4{tLC&Yo`&(mxA`PKyxUw}la)Q19QXXN_&hdXGd5~1k0L?C z5>Ax7rtNLMo4xW$hg{H+KrZt1n7+Kzob(FiwZVHBvy-5nomTDJ%HAg5K~>*W6KN?;-4Ydj#I0uI;UF%q z#2?wf>#ry|tJB3tGXqW$(#x{>-hbl!MzadnC z7JL_TV72TC9KIQjN9~6bT)FXnSN8byO4L2Upt#&z(MABLG*Op`RI+j4h@=-K>X^~> zvGj8auhG(67WS|WC0@CH+R3aYoT*|L9o82jvHo#!9kB3jNY7$W@LscDhHC0mgeh*~ zMf#8}1=)+P+cyxJ2oH^6r?^rNx+WU$2-}XM=ID^J<`wdr^(H#oBd)D5pos5m9+PIjnQ#iRg~#r1LgL zsOe|is1PbOST7F~jq?Fl*a!FTi|XpR#Xn{@+#w@A;VoBk#FiOl z@nA}#Rp=SfyT~jVy&Tlrz+@w4VQ-$V6FN2biJoY$X`Vlr4N^a2UJb#X39VUu9J*QZ zyuGBlny%!V?^EFTLB)*!0qmB?QN3hGaW8ocI3`V5ufP_ZomT0065igmE@;A;LfaoMP zwb*>L>cD2v5|D_1+?RU7INrZC?lWr5!;hZTDxmFr8a1F{)cX^7&#R>QT{>k-5?2D3 z5Y@CBr`2!H61T10(KNNPp_6NP)+>txSx33E;uu}`5$_vb9|p}+(!`-UjgaGe2q4cZ z^{T<0#iOcqIg`EV2!7J!@MyoQ)RHXNu%K5TI+nF!jQCrFws>fNvQX@y_0dJVlT z^P(n$t&4nx7Q8z!DwV*(zyxGa>!Ti?fjeIR%8&1Izs^Vc-SE4T+qWz0)uB9B>5e26 z+CV{*dy9%A>ve#36L_sP&qKT1TI`qN2r}YA5g0>n00bfY<3Uhu;SApdJPvz#%o`Vp z?TnfER$%%2nXwg_3sJeKZPId8USpLNcnuJ`<$r#~``p8UNuZ>vY<6IOb)l)8f`qIu=bkY6*POm=H$B8!m# z4jGE!&?Aw>!T==W7+>OEe8cS;&Ph9Skm_7bc60kWE|_h!`4wenH$yujYBA^r!xg4e z%U4V#kKE7&i_^(u<7qs9f;vmY3j92#4T4ri){6Uh*-+}oBsW*6$GSbf7Vx?FYUpVw z_?jqe!hw}Un_f!EqU?(RB#rAUii6jjTO>^Rv8iqhfHe$?tXbU0m#!6KjOMkl+#hlB zmE?(XTIJFi_cNv4X151wbPGZiedZ*O#dgV?T}v_~;q!C7Wpz&1ZLNCWNOM}Se%p&B zsyclXlilui;a>;f>{39)n>7l6{`9p!^^wDEAEOY8?ks|f+1IYXcW#0xU(H>kCV7$G zC&uOaX$9M*EYXC9#N1yMTZ6sKp9Uyf_uPEGS<6_iCBk7kWi$AOEgCEnPu6L>v3xb~ zK!rnX8Lyu5tX}h5C50|`bNb?yGJ{GK`t$91zX;3rbGpjU2R+1zUNo789(yAF^@!(m zJ+2oMXuaD>Rv4E)(`n-4a=H~}Q;%Zl8Xg>09(kZX&&npC8+`ld9w2RgFR%brhWN%D zN{W0zdFn%Ua4xw&+5LsKCP6btE$!D~;0N4@-w8DBEzj44p^nzYmwJ8+2sp4RYkL{? z`C)~;C!TidLFFb+D}VGr(+n0NtVYFCfdq8 z49y}~I~WT@6w_v2@0%!R?|t1{+)56$aR9$G3^+M6wmd0{G= z)(MbhxmVcrkh%fap;T6MXq8a%t(GMyiVcP00xc!%{U=@vtcc7wgH)6#WZk2S4oz;DmNhm2lc8d^9z3me(TM=Icv z`(-mBw2D6I)EJqZm%XCy-qgkQLlDYbfO={9w!#)~{K@gthptbjFG_CDn3&4x*B@p# zKXWOyDaS-1PFZ3evO*}iyhiJ1lW<%pXsrKI)<`U;dW%v{(CP_UW&Oc)ey+Fv>+<@4 zVyk~WA^n}Oa)SvgWO{-he0Kvc7vE39%Jqw|f-`?7tarP=2rIbce;};vT)be8`a3JV zll>DbmAvDnGQbBwSui_&2vqpNP*s4cV3w*5)VO1++CUwkE>I85Siy@fV8-cc3p8;9 zvsY6SGu!X9(-cf#O?zO!yiNqP1X_ZrCWM??0j<29tUwN6vTSolm+e5V zuD@|+2Wtlqm^eFv|NqbA+4=jNmbt0jcODJ$09Wd2?e#B=+Re%Z1ZLKrj(^Fmfj&SV zkc;D=DfZoh`R^3_x3!A@o?`RzvT^-RvAsOquxHw?k@7Mq_|R(!;_0#OJ(VLDBX1ac zxY?_rzW6werB$|xc`h}okjnF&bREk=B8rRyft}q`isVo%a*BHsDEj2t$&W|r`_8L8 zdzJRyIlfr&`|_gsTR6?I)k(_rZbw%)l}sF^m(cR;wW_np)33zlwRwvRX>$WY9)t8A zi~&H#Z^DBq48}ALa8B#6&EqlZ7E?YoWxzLIfMQ?yOu6Ek?Y`W&jKV(l`_y?f_%fyr zE=7oulEZr576qRr1F!PgSzn5E<{KPU%)?2Gb$kYs+Pct|nhWac(w0^8o`#OPmfQ>L z#kkwkkX!$$+ub!daT5Le0ahV92fd+GnOMBYSR8o@K-CU5twz-J7ur+dOy%q1GAg# zE{_P|*h6L&E6EKhUq+_9RWQXkL|~7aeKaLh>zwDVcNn ztn3h7?7hqg?Z|?+7N*dLw6*cG63moMSk;&d5j}4`Op$9tys~HIm}xvP-ys1_`Pn1W z6%=TwLz4+4xv)nuCnIa$GE&CsC<-aR#kNKA`~YuC${y>La6lu3Bq||$fxV9WBwb8_ z+AB1IKso|hWGzHcA)1ylV$_Q<$9Aeswd0%aH`<%^@kcU(@TNiFw}~x2ST5*Q54?=b zdGMuANVNE{RXeAh-D6KDjCgc-VK;c8D@Xb9P0$sV=jzQ8ipY9zG?TycRMc0X|A&N+ zhq5hVv;6)O7Y6H@1ouB3BX?pCVJj(m1-z+`d`IVysY5A1X-I#DkD+*!-ViX6mb64S zn)4ELls8Z}u&svShIK3W4{z@k+y? zekQ2`RDY!il#vvmNtK!^!FSVb*4Msw+^&`cfvUStDhhm{re5iY>#=NRtpb zQM`^;a3bDvihwh^fkY(t$q8H1SA9)+m}LM?&$f zn2X7X@KlXReQkRjL^C{Fq`WRg=1X!fT?XqEgSd!tql4OZph#Z?wt6t;%bLL(a5bpr z)-=4aD-OdTBHBrbNfNZdI+If+1EEe9KKODttY^c=KEszaO*`X)fIB!q><#iJhb}ZP zzI2!=E*Zob2X?1P6J_QRXarvl){Ve?d!u2WPr3kTs1K8=u*J_wYZP09HH;jGsRXeuGi-oW`ze^z|ZKp zsz7iMP8hE>Ne5Ca5Ui;1p?+hzPl}NxN~QP2aO~lduAdBXdt1!sK-X1DzHp4FSw4iA z=Yp_`;y^!6?5C@tjsZcFt0&t2;?Yw$@AS(S;!+E=)&0)AN^<&)=5++U6fgI&x_MfX z_veSF`Nfr%N9wo5gk-1RQX^1`%+p9XsJsC3;1N9SA&mK&lAGvIlboH*rvQWKLtiqF zrYQdiXECS~Cyzhb#K7V`F@KAXD1RxheEraqE3QSk*M0|2ifXI!I|%TB`rf_Vy#s%oKl@S;I@B?vrxDlCpWBNh|Pq74I#nD(#?7a{YLpMfB2m?MKEs?r1&a zuXJniBIw&=OOvC%9v{43qgPO_rklgphY4~o&5;*>9gKH`nw;Yh;)X8+fg}&M77@RwjI)p zmNgy#X=qw{rIWWjPOfLqawzs%^15f$IaePEDXSzg%7S;7X{oM(8UluxPtfQA6v@z- z!%)%2j->_$DsF%O?2EFx2(PXK*ezSA4g<|;rZ8`uk3mU!DG|k)tLsu~G5upmQt4Ku z#cdUXh--EAsxMwH6Ff)zH zRmV@!=+tFGElp2NEZyHY5hh7(>Ct94oBk z2`U{)P3!%RtNlHMyE`s))!;|Jzs6!be-lT@$CNRs`T3Kz7;8VPEHJiAmQfz&E>9A)a|f;NtaSW{}=#KcU(nH4gINj#_Oz=a^bW&z-He}_4V#` z%`$&U;Uhf|`k0d7Ba)?I#S8|t#LFo_3QeGg=QKk$YeLctJa4ynOZ@&|xG?Ial9GRd z;{fCAgV9{{9y-S*LX8<>7UY)XBiuj-F4V5rzLT#(hMGG2w=N2jDr{tv8EoJ1WoO$R z<@4ehFLLvbLe%C-{fqqW-z@jFMT@xRs6(yi4rR+VW&%G`w=g{J7=|)fm6hnibJP1izxK-Q%7_g^|JCoubd~= zZ1_d0Pb96MDUwVJ7qt+!c}H|-^$m-1A8{=#zk|cGs)+93B9ZV1Y*%)w*#dG^>2OK2 zpAlkg8aM8~#1Ro+25c8rab<=)VsE_28vPtX`rcKWdZElPs$nNnDn@?QLR&|DoFB*Alms@0Io(sr<75m0n+7X9m!l` z0VW&DH7pN310!ACM-+XVRHGhWoknvi$=i>Z+{lrwxJ+toIVjx*o<$5TzZ95O+(27$ zHb&5Lb@rt2uagna?&l@^(v)!m-zKqy*PvC{f_bRn%{mIh_%^p!e_k!rF^Q?P_+|d$ zC;KtiP5y-J&{?(H=qeNNG;d0@Ns$dF z&~S)|ouvqK2=1j3!NXWr``>1!UDd!(tLTY8|3}TWo_H82iwA zuhnIHitcp6gbTgd4mDh|J|rQNBZ?c(EzBKX+|jFM^3acPZ=Qkw)Y&1DteHw!8J{@n zgUU-Jne~Jkojts@FL4_V6qN(mN7(zb$Q%pH+W>iPJo zJY_pM8BfvPUvALZ9+nS^cL1B%1_UlfXTPTij>6G42d^6dowf+M-=E8bz8RB?EyoC%G9?CX$C zboGTtmhLc@dJ8<%5)&o^q)6n)Ch#4Ps**0KSp?#hZY-#TB2KCkQ=k17K)_S8kFD<^*QQGUS`ef_=kyJ=vt{2XVajR@=f0#s_G3WCgWs!+~NRh5fy0EI9$_1ZE5 zobeZOP5m`*-?FXbq`%vJfs1yUcq#KpxsTV0RnS1gb+!->)duvN%ECo_|HRu;*`bx<6Klujy3X=0gzOgL6dsRJzly5-O#C zpxv9B5NbwFhOmQco}1*p4awA?Y0%T1e_A;c<0gbWImaJdO!0J3oD)v5aD9Q6Da%6Y8HI8}7B0Hv zC$;#PY=7hs1mzAo1T>4Kdb>x!b)$4uc%|_j1Dt|fhfkTVHB1tMrLS)ID(=6}Rb?v9 z)1B=dy50?*^l=bt%igYb!7=I+2a5Zm*sw0rY08Wu02fFD>}1 z^rN#b$@@}ac*ZvYVg42~C@P^@4M9Yw8677oLZB0+8RJ}M`wkRO&(}2eLLNN63CJQ? zB>=cQ@=l&2Nq7CvLw&K0=|k5N!uKXgUEjEk)m{U_ft#;B@t}ULv9W&tw_NWv1VlX%$W2Rl znAzp>Wn)I>;H(^aL*nW^SUxLovMhdr9Z@j!5eR?H23@g7Q7uHT%? zW3I_NA%)!|qe0xTgixhQ9tjyfT+HdkwhR`FP^~(CHi3}!=r#Q&^vZ?LK_B8{pAvl8 zrp(l5Q$4xTi|^G|jth}=var@Rnloch4Kv|<8v4vx8V;_xB@r{C6t`6Uuds#juei^q z)3h469N>86!tB1d6zRk`YseX0Nh1xTm9Tj{y0**VTC3XG8it5<6 zCOUzpWWk(Z{M0h-<1?78yop;k1r-e&p3Lx3B&h5A7|1oG z;ncl7=q;)H04FxaT!xWy8ULC`ZjB?Va}!hZcDv9e?2JOyd8FN?Ety8ysx>*1VJ3ba z?}@-4_V!Ro-(f`ctbN9#&IZ@P6e#|24E^jeLNbmn;Gz7`dsD>R=Wg&Lvw7$-atXA> z(i@fBrhW4~3TEePFmcUmFkG1hc_lSNBT~55%(l%O8Fwlg z!x+-*$)+xPl0%hb)Kja)-_V2zuFZB#JYvTP*@;}uy%?r~wtX4LH}XUdtBoVedVl;7 zsUeX@5d_j=-o(9pl2vbQ!0+cpcld4V;imJ-?akS`8rSEL6yX7MCmG*ejq}~flH|4Q z#4}mjm-d2|qpD)WUx-HVu=th;skXG7)i$fiN4G2Z;-cnuas?Rl${4uu@l#XNX)GS9 z(y&eTVeO8uxp;@3r>u_d>05~`P?iZAzDKJvMQj{t%s`HQ3OErYb8V~c=xFAxqjJ(| zdqARrZ0S=QqNkUvYvLtV?*ZtH7v0nj>795{2z`nCq?7KnUwKUa{j1uLYbSk7Ve=AH zTh97aXP5PSnbp=e2!3`i&-tvLwZ<1D^_zKff9<)X^fO`Yht<_BA5!2Vi@~oY9(RCu zU$j!qkO-$BO00_JcCoKl?=1RC(+f?Ms8MkJh^tJ?FdtrkeazzHV2dD^2P5`JTnjTJ zm@m?z*Y7nRcSL_e7a3`jCEiDDAz0pDZ$JCyym~}lEdp;x@E&f|&oRH26SnFN1J=c9 z4e8eg+`UoBoz?Zah7zRbIXT7=!_KJm!jbGW=GRJ3L=c;eA`>hl$e zy0v`iLn?jrTY`88&a<%{ss?Rw{upj~^;su*lk(*Bwd7J0IoIJ=wEldR^!#59J2epx z@K5I(#Hgj7N8XE-n|p2q&1^bmRkq1WkDy75;<HZrF*b8%8Y4*4FM;=HpgmZ$JUC-x514YEnQ_1fIp z`dfAHlz_P&*cJn!J|$^f>x$QrCOP!A@3l0?-YCB~eLpcjK*ucC&R@(HW;2C(ncy#l zYpMob18AMq(*`+|zV?J^TgX2k>*SUyK>z&Gif7}dUC-WC&i>^}L5sXyS`z+gD)T)Q zE+2P)1frNuYzi2WLAx0S^-DlFcODY+1qc8T%Br%1x#%i<2q3EF1# z@EfLMdb%S0gr(5@?u;{82Ci^2=-2c%6nXfWNHgd(F02D-*R|y(d7T~ckF2 zSuGE0T3HC8N$RVo(;5$#Yv^DNWxk?~H;x#;BIY7rNOznfI6grz$YC@>+cc2VUbT&{ z67qP0?S`fwBmBx{+0u#ozU`hwFOYd?-^%jhRmR>(5U0sfr<#`~*UiwatmQ>U(B9q+ z^d6_@8D0e_!1#$4MYxz;ZG}o2lv1t=#v;b!T>NEI$Ln>9!uvi6%BLL>t-6pEDblagZSt#=VpW+n z6MM?Dr$zg37+=%6s8dhc)X<~mA>49RCzI>7Fw^rZk@50V4tTGb?tVRUu#T!<`o!jh z*WZ{fh;M;SU?~YQaSS3&#@E1G7<_@2o9d9b0AiTmY0-!j5)xz*GSsH$$YJGL5U3zR z8Ga=pn1XibJiu^hEuAs#BIjpilFC5;00^iUWk@(LY^q=~4@_lHU#F^^f9<=q@0RlmTCAbE6hu{zh!6CT2 zJHh|SIq&X!PIA6)cfWrJF0PrLs_N?M>VAfK?yfro_|%HVJq-Rrp;ABV`qtgc5T2E} z-8iQrf!aBUwd}Y`I2A?yjXh2%%Rb2!P(2XI4Y}?`11tN0xFUV0g9K^PR`HuRZ{0;u z0{G3p7r&Eid&T~3WYVT;;+>Vu(UE<Dyb%ebI`0|fa-)aHorExbV87cmN@2-tAw|@dQwM8EduXQE zsC4#{Id&dKbai~SWQN_<*qH07}9 z5EJ3m4olr0mtydH9Y5`^I)2tpXcf^x;OjY9PJHjM5cDSN3|6ES?MI$uXs@{C{l$~X zbEROiR}`FF@<|n3ZySHaf$2ZT+iZ+n4(rIPr_(LRmW;%0m=n2DAmk;NFrPn-vo~I7 zJURiBgNVM{Urqu;~0I}9^~?bTpkLnz}PzHn79BikdFZ}OOVVt zm!zY6_3xjm2)3^cn!8QT$7F}nvlqZm%JU7CU>)(Cp#U&42A^BAXA0WPhi<)G&_XixU+*roB&;dW-U9l+?5=x%iXw4d;-+X#%38qQ zcwK;@lZL_KN*k&V8jqZ4ECJ? zi?)Lys)Rx0N{{A5$!y~u92(`#(ELydxNqiCR(M&YcmtouDc^9G$-VM2*6E1ut$XQt zP5Gp!`bFSg(2hd`7OMAv?d91D98c)TpwY8jigmEr)-Z5<2XFXI`|asNw9bmysqnOa zxMx^Qfuy+13o(^k)BT<2)ra01=Mtj`bBUK&iHv5PvCm-M-{XyXuufBzopirw;h zO{QuC{3uZy7gP~+eh3$vMX9iFAM$`QU)^llateFYwn{E^Xo;0oHyIL@WI3Ttw0g_p z@+ITb^H138P4+9dWr-3MuUrzp@boV|PQto(&F)k1zWT9=H{IvjzHUqM?BWt9o4;N{ zayT-f;8kWn{{&yI}a%%arm?d1|jG$Gg}a(mvU=@$E8KoYx3^C(URw;9P)_8}W6I`vyC=!g7J_Yn5|C z*n*kFaj*quIOhHW%eu_za4o=rErRnQVw-e0n5#leh|%|LFntyP`%R~dCit@1V}^ub zqsl~Rt-Hxq7MCc8 zGd^;l_d75VT5O8sKKVMJu-hpnpojY8{!I)fVM1C(M1pH4Z)O0p1$pkP=X{+D)&haF zU*(Ad#N*7%zs48v)(Al*R3Y;E=N~ zcIihC_d9GR>}6k*`+i@VaB&&WbxS@W61b@Y7gikdp5!(>Ykufp*}wEb(ak~N<40g4 zy*6-BO~xgqz!FN2w1htc&6re9I=n*{TETN#9n-<<_g?CoAs~4^t5!i~h^#6y`Mt_16AScpTIf1+sypVJ5U?A^5ffIQD4o-l){5LoO z2zm97XnGDV$UFZdaDvSL6`t@HXu|(LT*99xS|Gsu{~J8vpKuAk;Sv4~-~WGsBK&dc z<`3A!zt7+N3!h+T^`~zx|9eP6 zVnZO-M@^lQvYM&lski4!uLw=C;Y3rnd0)S#iG3EI_&WAAqe#lO7iN!Fm)9q^`ufRX z!OJx3`H4E-NSAg8y92?t<+g2)ryu^e2u8=Hm*v}jOORiF@N1n8ZJ1P^g1bnZ) ze)#^X%w-c@o}p5wA>xIyFDEfm)G|_%JaJGsO@=vQQ>DByX#}ULp66~UpisvZNA<%q z){NuB-Mgb;I23R{y(x{v8>ze@{m-tmZ)Yh9Yo0tgePk`2O+6P5JWepIvN=wXsqx9bJs(8u;(HOldSyQZ4q7ladhpb1pE5S4DglY@xF8t;-_>^r`tX1j< zHVUG!F-}$N2|WlWGW?)_!PS8 zqo%|Gr8*85629?sN*c>G?wlY3MLCLTtg0TV9vTQ(K~auQpB{v%68^47bq#7&oP;JV z0+$N1zn_Hf_MirfoghJX()v2SMM9u@@7WPSzAeCJxjvS4lEss4la-SZYSh1R4mI=bj}b>MI|k&wY7{46y;rYQ++ZHWddQsB$#Ob-N$}~l zzu(Zu#562&e)iE%EK!Xys6%M}d=b%6gC5x)8>!IRK?Fw)D$u*V^1Xe^DiM~LpSKY0 zOqYY#p1DxPB8kM)^h-%aW``1e3l0@{*(v!lSF(RVj_i}E=QeL9S~qL=!rNUym*g!m zm#hdq+I$gCe{tkIlwUQ-ybv)|c`jx%_3qq~QNTF&>LYG%a{_QE%OAD5^3*WO^t<~i zj*Qs}o)nXBJ`9o>Nc&PE(7smYIx;q6yotH`{(Pqj=Ur5HzZ0=nOjvdA2CrQzavoF> zCpCzKmx@yO$9RUtfRtz*l-Is1pGsGry9tYAM5Ao6fH|(E4pYhDdg1I2{knk!%BEv4W$~{52we|ml!u5k7zT&}FVdfhkg5ONT-A22n%bQk zvk|&tP;Bu|q0bj33l`1e5z30^dM&ku7QuoOW0`N0wQ_r|}jqLR+%J(z>Gw zmK!W)hYAg}2Qy=YOHwne-ZXe9B|?mftxD>pNVoya}|hsEOUw z$3Hj2-~OJAip0B6y;~Xi8u+8^a4(cNx%o5nNN0mnOxv)-(=#W&G2%c;ZsW6v!T58j zTkyapF%WoRT7IsL%qrF1oI&XI;s@m3Fs;Zlk##Y3KhF;KVX@CJqhXsoskZgy02N~1 zx)H-I0Dd$l`6K4x+xAF^v+kzFuij`Ngwv!+%Cu@_kVwLlqO?8KhOB0=kkZM6{{uYMI8`T z-!@uXz1vxJ`s@ADSF2DOt~*|j9`eUwu_V;9s=jy=$NVt_)r+Oq@|IHqFS`VVLH=Mz z<(Ysp?QT0q=rnAPFmQh&?et-`%@-1aqZFCq39jn#Kx|VYuA!iM*d&pmHmHl|AHvYv z<||i&TXweUx3e8dejs-+lD3foQFBl=-o9nunn*B;JVWKGN_0U``QG*8WGM)!^@-d1 zHCc%<^*Rl5;)hTg#R_ig-I^VersA8?{Dj3ii@DcY5=9ZIvqd79bast&!Gi3cH2e;F zpbknm?jN!BJqPL(!&u#&#e!NjJ(Ay0p1_>-@(!x|_H2FXRd_gk?NoSijf_H`YQ=Aj zr2=88k$I3Ly2(Nr-Chv zVuhgEtd?uDDnK%zK3#N=c3x0%c7PjRtLRFIxM@{X`V?Q1WSNoUax+t}N3C2lvA>VL z#B^HCIYk_m4O@C(THqsgc#v|*klL_R?|su~G21t0ICbbx44fVWR>Wrs%8S}H&L?&} zSeIvL*13ZzAx}k7L}K=zrxB3@n|h|<3On!a3+Car%&BEqrs^| zxmZu_6AU(m8a*?1QZ~&aQwkN~GpP57B5rXvjf7#uH2KZWk(-G^bgA4$BGtHXC)?fQ z3oq;_8E^xOsbr;u{B6SC7msPbpYk7tdk8fkF&SWjqBCSCzU@t;+aN0263sQ*HFbYptO^47HYul2_TI zldf7c;a%JZAWT=YtctxMylj_}9PSCCNJSMP`I?OV*}Zw)ST2xfx!~}kQBk5byqOj&g1@-KIab7U z&l?7{S6(oTX*RiQxCPiQqS980J4n6{{6KyKyHO~-deh8L3n91uY(s(=XI$(D6ZQLs@Yop#0MtdXQu&?s`c%HU)+ubTihV{7n zf;=o^J>7z6|NR=1k&WD?du6KRLZF_FFKo$vzqc{QxeH`vtT-h-kUrJNxhc`F(Dl=t zb)<alhf)R&^>gJjZCKt_3%Zl(|K zh-KgKQVZjZ4j4NrtI8@r9d@2O9(iHabD_v;MSDlo_(hyKZAoc!4)DgckYiMqX-2QHSuX)=(LFob%Jolba!RhgjDzfH<& zc__Zrh?lWHZ75mYDj+-63wMZI@JLhU1+z=P(_}zYww- zLI>xq=D7rGpGzMJ@bD4&OWUZPSF2ua)N329SE=8EH+zCFA3IPjPQ%$zl6B?$3mD@Fmh;9MCK+O|_^C8FW-(-3 zyfH>|Tb@|0YZ%l^0rs16Xjb=idG`^iy^=RbQ8uBf^kG_v8s{*&7`=xu87oRE3%ybH zY9&`pXce)%;P>*>_tr_BckqP^F~^s<(I>c)CMLPI~W$L zMpP#bP9s-(*iC-b#V*iU-K6lHhLRQ+O%JS*klQv3oAcwoH3>A*jEq=VL4-mp6o{pW z4yVLX-p~~It+u}Y7d(p-0oAtxSq56Yyk&sKxN{T`p2jSbH)+dT*{iLiJ!~`G&`Opn zO|57@V+jd)3#A8r@bc>p@mI!%3XS%xZFILTu91`WN|18&)RqzNv`tiTgAjnNaP%q_ zX~t^o0#m&=H?%{hhk{9Scf8ZK59G?lgYIf=#v6PKIa-VlDaGHD_V+q*9P2CFubgeR z@f>kT65Z&5q-2_7jfg7wBp*vzTj6V(pqq6CPp*899>ZmlchMNTICvWoE2cU>k*QD@ zo}v%=PL6&t%OMb|unA|2G~S9QnaLD zftG2gW|4}r{Oq!^X=sHYI{9~{iIT-*sjco)CYM$s0rN?CN2}h?c-gLPi9S`$c`Js? zogggb_eFOmc}v@-j*`8?MMR&_KgB}u2wV6O;g&%?@krAbj^Ldc_HunL2qU0HZ(K`g z#^=fW+JmPEC=kBg-oRm@IoJ)PD^+{(X=JI<#$PKc@u)15am`CEk_0IExZNCsd*#43? zP!Gih^1}U1VASgs<&oOc)-s}+BNZZerS{M?oprLb*6S=x{XAeFqL=dUXE{-rdG51I zc-z-I{<6cAW0t^aPxdUA)+{6sJQS@UkD?yUW&hse~B3 z&6f zE3CGsB$X{>^~u?g+06AGd|Fl119aHB_F|RONWrF9wDwWSvZwL6TE+!vJ2q;10yti@ ziG2NF-+DbNTiDMoOpvj9kCdU52y!lzHZ#KyQZ2_~o!w^W?NYa8n8t?@J)CK!$*(1@ zNt{2o+-A@2{-Uh^LPo|{*Uj3*#m!AcMaGSUOk!k^PlcIq5?^cgVwa1-hojqzay?X5 z_?>G;;)jx0S>5*{@$6Nj!*=;bMoA3GhL|)FZzID85aB-?9tPsOI=1_446QaR*(5Qd z(TwpwVAyNd-wC80u**??eD&Idd-uTnJAU$7brh4|jugxQ<)Klva05EgORqELj8Hj{kV z?A>dUcHo+sG5M}Z%hOPy(!tFx9apYC=xo}U&-5+6IEpA0&tvR8se9tnVdb<_j&18Z zc*^gl`KRN#V^!498DahGfiaV1L+a(mbq_P-WHwH;+vi5*UVKBtQ^ zSxbk{eV;hCkXU4Li7a;xZ0mFxlDc?^2~DG_5HckrvoP9=pcO*V(agTr&BTz#zY=WD z(T#^{ao5=dMiX|$M4>0 zWLB-K6{dKf^{=>vydcgj589{P7VSSIGdg^=PvI%vtvq<5^J-URpBcvGk#DH%13DgP z{M#pnNj<{~4res~RHL`7Jdtp!ai29~?DTB14+1TLapPWJONM>c1wpxMGGX<6HGr-;OT7LO6DjVwy=)Z8~fcgqd& zB}Pg}$*!lDkf5)$BdS_|e=_2jfhGpN681SxFr|LDNR?>TCvsQnFk}RN+_%2{$`2)| zL>h!gnKbUrgr{$tD_!+UUqrp2O+gH2YGGO1iDVR?8CyM4i6`GpqeNixN4_U;CF9gX?S7VCb3PgeoV)gRtP4dgi z7zO&flo$)x_K<7lzt@+oj!2U3*qP@PQ#Fv_uBMjOuDA;MOE4EG*w_;4MP^-F@<&b@ zo3rY2G*6F73Wb1N@HV$cwFEVT9GW4HUO+cu1lZ%>2vAF zhOkL|5=XE>mEjXbJp@1zqs=ho+ zXaPRh10Ej76YL~1NnX+wXt7{lo9OXm>Z133rO?3b9(BbA zN&&^^@$qXcPQ=vbvNO3y3wt!Icf{5nxOPy-fxKEa*jF?M(MaSP zo^uMJ2G)hfIre2?qUqFoE%_^F$bpRkQx1IXv-1{ft*3~j>35p@JO;uWU0l>EUTzHc znaPHpi!w~g>@};9@=9>|4y;Vp6Yb4jrc1UVQhPiB#BY4UnplTqmh3KKCy!JIuXi24 z(Hk0d8kswar|% z!tza^pG&h|J(XSqB@N#^GXDb!KAI9yKHc1n$SYr6(fF^TjsV`rmj{%aaSPYGtTgvd ze9rW47Ow2p!{|_=+zi7-FSF83)(&ZBx!Il@PJTpwl)YV%!e~0Qgl9*36QlcLReI!; zyIzqhxx$kRTz;fFLyqgg*U@dFLWI3W!OGZec(?D4UIbNLjz^VyoR`~AjBKU3+nH;C zrtlGd?&7P$M>xRR?KFCheTb$1E2zQE#Ee_Efz z^jj!l-f=y{l0Jzh7s%+kLC)5+qW?Xss z{<&iLJj3F2R9-qExED|QwhTBYLulb4WmFZg*(+7B;znI%{w@>!qwR(_1><V}o$=z{-mrt2{$(Nk?{4;6 z+xFY|cL>rs-Jw;d<9W4h^}7DY4<=>bq5ND{M#~+o#FcXxo(s=q+%t(eF1c;x%Fufr zoZd>!2y<}&62Qr)h*V=`uQ2-cDoM-o(+mWHZ4BZq``yTtmK2=8}Q{uUsW28v2 z&$Jlnc^5SCsT1gZw3dfMNjaEAeS(qUWYt%k-(m%%ut6BaM^kfIUc>U{g=`tG46WSG_f4w!a!z^;Vo^-)-? z0xrMg#iBTxBeZMaGhKDXT+GStyS)wbgZMtu*_ungWAfGbiKIT6kDrQ5d*?d!MF~!$ zc@u})?nvIab?4ITMsFoyDxrvP4|PJg#_#yvCw->2tIqNnO}+U0t2N13V`9 zVOa182S1?p-reZ>kT=Q)RBev)ho7%T=abK``|D7-KEgYx7xvnHyg6DYjeU(nzIea+ zY6A(l%Wu>--|F+ZZnY!wkq2;MqS2mh0WQ8}OUL9B=DP`R@MZAD)XfTuzSL`3B(Jqo zTw6U1>KYj8suJ>jGdskkP9TFiT^%<4H7lb0xkesMB$qNx{#T|YoSd79r{ux}v-~JU zN>mowmi_>a?0FuiwS@bK1jMx`n61|9soy~qKZ`H^cQ6$Hr*fA6DoF_8_W2V<0f3Z0 z{WppN^p_G3e?w7#K#+LS|_-aO&XEX6$V-v)ai;^&yiyPfxmu} zZD6mB%xyredUFY-k06R;ithE2O*Lh#$XWHQ^eoLbU;o__fAG-3aO=~OCD3JRSaAE! zf4L%DG>S|DKoI40itvLG&Se_!XoN2o*Vp8^V5n$2=fFq45HrI|6TUD#(Y^6qI{=SlzIsX;&#Gm@&t z#l7^4UTOnVyP;7EX5&;dQ6>&)ESm(Rb-ve6&6nG$uABmlOqlfj?wCuZbL zVxo0GNB2L@kk08Z+BvrqWpU^gOEZC9%13!zMrako-foK}OzxB|@qUpHdOXZ&IORwl z60gMp*?t0OqEK}1W2?~c52-P214Y*i_9NNs&Sxn*U&42(d(=weYjqi;F01PK>lBnQ ziVySy`Y};AJ9N#VBs96z(MFv`-|E)rE6QYta(9K|+4A5dkxH0luUjP)2-AviDJldD zdaxRZzb4JQ?o6K1nPyN^7O{4YHwUa#BGUWfGykTpn?tD2zzzH)JPd`z!Xk^s< zmCx8+wvj?FDB*=5Z@%u_k_P#YBX|slmum7OW#&MkV6>PQE3kYY+AwHJu;C`w)G3~O zrt1P5FJ}{Fzikhnmg^pQJv)js=tE=OVhlZ?mM{89#bt32k)zyDuyG7)`a=EtEdMtH zjDo!Eoz(G3KBUWi=Gbn7cEYJ6W$fG1LDPV?gHqWWs1@mb(QJ(jmE+gpTRzI?#hOv`} zt&{nRl9D&hxWf6ODA+SfJ|iqO#S^?i49PeFn#THn)Uzq8g2xpZgd21f&!<#aH6G)f zg}=0Ka?XSkGYNoW7F{c1yk16G$lb$B?9&$M+I3{R$7J)aYzQ!$EFZdF|Fo4^s!&1- zRlaD;b;=?K)WAgcYrNem7N|rj9nf!O_YOE?6@fmr3)hj-oYYM`lbG~+_AlE6_& zcjbrQFl&DkE0b&Vr=C|+Sv`UlTX~&RW=PTIB>00_B=;&emfHr@=id>46WbCgLo}EM z{RD@M51X&rRady{#2t0pPkDh`o62fl0BuxNhdfh;UINROf9#mVWrj3vLS;Zz&Wg|$ z2FjXc#yD*9JlDkcy(He#bCrvunG%N!%CRUTqMJQLYa*1L&H_){=A1oi8iWxkK+(B9 zP7BUuGsxH0nP>hO@+l-M-G6eJfK2$F&qtiyOn+44*+|rOhtkFUP`tdh-pNpHh#NFp zk~enF+1YhOV^KW!o+4CJQ)Od$ZEgDz(iFUwkZfo#LSsLRd=g)X&dBASEuVmkam_dd zA_33$EV+Z1TBXyh0H;KXiFo@am`xH5yQ&A0qpf=diPA2rnwOufxib9NGTt=6pz^TY z;hl>b^Px|Dqo@617{S?-OI9G1a4~~ z7mf(94Ya17cPDc7LzIlMpIo3d-i67pNS_>D(X1KC`Uu%J*?iErJkC+DZ%@B_=8I;p zwkXUAWy1T|`F8v(xA6#v=zzw%0(hYmg6cYso)N-sqwM9Kp*6iY!psgT$H>=;j zq>EG^kzK-S6I4m4nA#0O)(o7rraA^_WYN|183V1F_E7bnDu zi04})Dqj`{t|fY24wy$G?v{muPKCKQ9jurcq(c$eFZJ4%6*Ja|xSENU^?_UMsd1PX zgS?%>#Eu7elk#za3EvV1TBoXkR3XcRH*tHRJlj~;fx^tMm~||Ogn}!gw&_V4dwuua z8dTe}lJ&3jV#OT&iG~D8fnr&j%0d;UYDnJ1J+ZUuZH14sBaXMiUg`8iY(e(btQBzv z3>t{}Y-aiIH40p+b$o* zSar(3ZNTedFkFG$p;laZ(@xkOclCZCH;UIITmQK6)Icumqu;(UWy4bn_Cu)8L9C_0 zc^qWy`~pZB(uT$8cKzZic3HB=2ey5rO`I)D3+6CZCJ3UHPqqTUBx;%Yvq8bOz+9w# zkbabMygLl96yhU{Hs0PaH7^DdbxiH)9f`2(PGbmXAM~n!{8m!qV(dznV4Zwr=zb|Q z6r>A8kjM@#X~tn+hYV9EcEGjLRb;DfgM6R~87e-N$Eo5T$jg6heyg0GXrKaj zLVzDEXIHD_0N-Kg{)H#(?c%iYL8$JBvl(+>(7BMe^cQyQ5-1IfN%uP0RrPu9K->Yd zoK_|)8=Io*d!*v3wt~%*+2_C{mHINdY4~PQvBjpskrGYWcFvA0UW3q%SKU|#=jMe- zh=F~j<9Ht~&C}t8d3WltTt3CAdBzAov*^TFasF}iE}ee5d@d<8HyQ9TxpQjraAC!3reafG z2>4)VTKJuSHM4G?7fd@=2g)t|+A!!LOjd@nCL4_Jp_Kzw=@aoc^PX=p;JpZvDe2%U zZzvI{R<2V)dKn~6^`+!_gKpR3I%y*c=O-J-7Za=ik@}7A=P3D{L6f=Y44!IC4e-|> z#>4gNQDUl>&Zf(@Z)D8^ft=r-;{agFXw}-)>?#@LoX=f6UB^_pb2m9umyv_o@B5;c zQ&?t@zQ`kZJNQlAxSo(qEsU$o!hV@^E*m!l5pcg(FzWN8MPb@-lMgEHdu$`+u%!F& zwjlSWW~3*;!$@!+cFCBNxA9@#TY3PI%`2?**OUb9qGgFt%4L`DZ?#ub(0M)- zKL|MbU~a9L+o|Le=D6m)cAGu`K~u)+$eoq>j44OgYaGb-iIYb^hnz>-8qDxZt{}C$ zJ0;4Wvrh`@qIi5*yIqD7JpZ2V*7`PL)^@*v|=@Rz4t0gyotekeWfvJXf zLL#RL{M5DRb6!m|FlR~8Hy(G0I*uSy8f2i+T^2TIL+3SIFC17iY#|VZc;~M|MAkYvO|zT2ck!C+qp3o~g$k9@qRqq#t?)=FsW`YnQt-amO^8I2 zGUqlU>gcF7=Gkn2FWK8N;$V_2R%Nl#LmFQ=K8nCQ$;CI7VuH5)z-4h3e>x5e30k z_iP-5e$M=^a9RbK-dvhqg#*9$3zgLZ?X|n&7V8P;t=kU;0X^TI8`&D1Rb9_XJm#pl zWT(0;FY7N&O)u$sAzs8SOJs;AIHBYZ>9o${bX@e*?3a>D!ETUIZ`JwP7OR zbAgT;VXWhH+9{gS)nprpGy0&!6A~e_>%ajsxL_A}f9AMHe_Xm8P4~7=T}lYA*8Sn) z8oIAz5i%~n- zlUeSbs1r+EArHOntaauWF)eb;|@=P_;rK_)5#f+$_P`lS1?HoQj zIEcBL@qy*)vdgMJdC6dWst~@~;msv02*3dN`x9{8@OJ~V zBkCq>(Lc`U(!AbZ(;ghXSw-Itb+*SefbLtpqpUF@Yw$0|+n!t9%s7k`h@%5^)oR?pB3E&k08hpqrb}TE^=aE?=WeMxq06tj~^!5_; zkBDJYR_D;*2Ih7SF`DrKWKVuB9FH=|Tq3gfnQ&^R8b*sjDQf$pI_I9-hHnSzC1`tSQf?BA(&N}0ru z?!O1kGiV&pghX)(JDzR43$me)UR%&#n=%Z^28Dm(p?O9Bkw)YlVVD7%-Hz~_|2A-B z7oAktcUxlYaRn~&IjdO)hkzmzwqCXXes6Tt7R}g%)7V1CFr46~nMGQoB@yF(T9fAX z(yrb&(XXS5KD((S?Z)fDV);uW3qP2d7)utz{VEDnHyN1HJ&f{5@bR}M_{GwPaH#pk zVC8sT1}u42&&=z+Wo~;G-3CK%U^J?@<9HSBMrvo4GmvYbyFw7X1w@}GCcG%=uBcpm zm(36#;eKz!fNO8MrtvW~726>Z2P!NkIP#6KBlvlXj^kaWBkfcto*!nNDC6|m_logs z4~%8RAQF~s@1m1*n%eXjbB61eoV{Au5<(Pa@ID;q5u$n?CVC!^Mf>qxwO6g53%>^h zas=$%3YbSsa6+cW$zGsVshBI|f{M1xfv-^mtxQBXfcZx2O zkQhFF*cOV3bD6%V;`(mi=NjB=8_oVwVf#=Klh(XVg3Wl3Q>{DAh2+u*7*hGzZ*!+O06&_AR1kJBi9hI{@{_ik<>@z zjb>XdlIYhW2|*6YK{HU{bRi^}KVnVO^C$`(2gok4q<*~8cdwnyTkB97{XTX(@6`A~ z#jT~_C|0g9H3;f*t{3Pslg!kQ&Ss#%2~) z_JZ`sE$#FaR;GgV8r<>#c}FobORJaO&Som!3aTdFHYU8L^uj{O0>Vb74#sAzo<@$W z=6^5)xllm(k_4&5l;tF;ehPTHkpSgFOG)%uY}7hls0< zAibu%5{0XSgRPAfguIxImyLs!gNud2+!;dZ{-ye=xY5u30 zy$jnPKCwY6PP1ESvU9Kj*#D!WpSN0m(vDg=*i-!M*vQzy%~gR(nI|I+*4%s}3N z*x`Z<5Auvp$=Siw&BV-EkX}kjjzY@P!Nv7YvkQhvP;Z)hi9^a^3vmKCfvf;dRsfGGCl?=(myZ*mEx`VZ5M-htT4H|`(Ecy9 z{vz}jEeB^+$jk{@I6Ih|Q@BIurG5sCgN>7m4e)1Yf2jRSN`U=mDE~6l|K{M09OdQz z@58sV`nMw4u~VBCVb`&&UQwwkfe8X zgb>*o{mdhFNJh{L2|(U-wStsC7y2WiMQvUGd}3?$Gqw0^jqEK1={;FZ&CHG5Y+dPv z)a?I|HvKbpwpK!aKKVnB{ol6!A+mooK^6=o$n5{Q9EFf6{+AyAdxrkK2SJMH3(|Z1 z++ltztpAte$N#aa82%57iV<>)^JhjwV*WFy8N?x}&j|!@0(dyNfV_}p007WKej#Fz z%h{40GK{wcv3g@pc9_21Lk%p5|Z#{u9){+U{TJ}5xk++5rg<`jRnfkB|3l<+?v z6!w3%K{jq~NQwWywE@5&ASZ+Z^sjONFc;@fj_kj+0RRwYx?kJ4KmZ6o>EGnQypT@* z-o^po0B}LL`hJn);P|y)UQX_x6!(9Z;{kH~+6ScRCtv;F<-j~YIiCO4#sdKUBys** z8yExz{HDtV{B0ZnE)eIh{Xzo6^V>K;;NM~e=HiA_EckoB0Pr8gr+@Q>0{{m9>N6Ph z`#8W{Al_f)Ai6*KYX5Ez2;%-#4r1>g{Nwp;J~)6N@Nf2b0KC7=2Z;B#ID@%s1k#|Z!df5}Nm{_+0qACTj>*h6$7oRYuT;{yJclMu3k-~9t}f_|M3P6$it zud(6;gE)R0FBtF-{sDjM1ES0I>v*{!;rlJuz#PBnf`Qx+4vxQ%4Wi5WtAAWvJiuSu zz+jGl@DCD%U+r=6{3OQx+k9|A*8Xqv0l7f^)(4OW`0HAL=t4jxzu4pD{U>|>;2$r9 zFZ4Iv-|PXocz(}kFxT(?adZ6SIQ`q$AiBThGh`Ux-^a`KyMNrA;9tiE(dGTM4YFJP z7E>_z_uK$;137=44~Q<$uQBBYa`65t2eJ1L{&9nT*X88+HP;|q)1cq&L4x&5tiTY# zU*`kT^xN730l>dsE5O|U;NS1_2GRY=jr+Gbf}{}7uQ>^Ztij*? <= >= + Selects records in which column[:key] equals, does + not equal, is less than, is greater than, is less + than or equal to, or is greater than or equal to + value, respectively. + + Consider column[:key] and value as sets of eleā€ + ments. Identical sets are considered equal. Otherā€ + wise, if the sets have different numbers of eleā€ + ments, then the set with more elements is considā€ + ered to be larger. Otherwise, consider a element + from each set pairwise, in increasing order within + each set. The first pair that differs determines + the result. (For a column that contains key-value + pairs, first all the keys are compared, and values + are considered only if the two sets contain idenā€ + tical keys.) + + {=} {!=} + Test for set equality or inequality, respectively. + + {<=} Selects records in which column[:key] is a subset + of value. For example, flood-vlans{<=}1,2 selects + records in which the flood-vlans column is the + empty set or contains 1 or 2 or both. + + {<} Selects records in which column[:key] is a proper + subset of value. For example, flood-vlans{<}1,2 + selects records in which the flood-vlans column is + the empty set or contains 1 or 2 but not both. + + {>=} {>} + Same as {<=} and {<}, respectively, except that + the relationship is reversed. For example, + flood-vlans{>=}1,2 selects records in which the + flood-vlans column contains both 1 and 2. + + The following operators are available only in Open + vSwitch 2.16 and later: + + {in} Selects records in which every element in colā€ + umn[:key] is also in value. (This is the same as + {<=}.) + + {not-in} + Selects records in which every element in colā€ + umn[:key] is not in value. + + For arithmetic operators (= != < > <= >=), when key is + specified but a particular recordā€™s column does not conā€ + tain key, the record is always omitted from the results. + Thus, the condition other-config:mtu!=1500 matches + records that have a mtu key whose value is not 1500, but + not those that lack an mtu key. + + For the set operators, when key is specified but a parā€ + ticular recordā€™s column does not contain key, the comparā€ + ison is done against an empty set. Thus, the condition + other-config:mtu{!=}1500 matches records that have a mtu + key whose value is not 1500 and those that lack an mtu + key. + + Donā€™t forget to escape < or > from interpretation by the + shell. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise all columns are + listed, in alphabetical order by column name. + + The UUIDs shown for rows created in the same ovs-vsctl + invocation will be wrong. + + [--if-exists] [--id=@name] get table record [column[:key]]... + Prints the value of each specified column in the given + record in table. For map columns, a key may optionally be + specified, in which case the value associated with key in + the column is printed, instead of the entire map. + + Without --if-exists, it is an error if record does not + exist or key is specified, if key does not exist in + record. With --if-exists, a missing record yields no outā€ + put and a missing key prints a blank line. + + If @name is specified, then the UUID for record may be + referred to by that name later in the same ovs-vsctl inā€ + vocation in contexts where a UUID is expected. + + Both --id and the column arguments are optional, but usuā€ + ally at least one or the other should be specified. If + both are omitted, then get has no effect except to verify + that record exists in table. + + --id and --if-exists cannot be used together. + + [--if-exists] set table record column[:key]=value... + Sets the value of each specified column in the given + record in table to value. For map columns, a key may opā€ + tionally be specified, in which case the value associated + with key in that column is changed (or added, if none exā€ + ists), instead of the entire map. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] add table record column [key=]value... + Adds the specified value or key-value pair to column in + record in table. If column is a map, then key is reā€ + quired, otherwise it is prohibited. If key already exists + in a map column, then the current value is not replaced + (use the set command to replace an existing value). + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] remove table record column value... + + [--if-exists] remove table record column key... + + [--if-exists] remove table record column key=value... + Removes the specified values or key-value pairs from colā€ + umn in record in table. The first form applies to columns + that are not maps: each specified value is removed from + the column. The second and third forms apply to map + columns: if only a key is specified, then any key-value + pair with the given key is removed, regardless of its + value; if a value is given then a pair is removed only if + both key and value match. + + It is not an error if the column does not contain the + specified key or value or pair. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] clear table record column... + Sets each column in record in table to the empty set or + empty map, as appropriate. This command applies only to + columns that are allowed to be empty. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--id=(@name|uuid)] create table column[:key]=value... + Creates a new record in table and sets the initial values + of each column. Columns not explicitly set will receive + their default values. Outputs the UUID of the new row. + + If @name is specified, then the UUID for the new row may + be referred to by that name elsewhere in the same \*(PN + invocation in contexts where a UUID is expected. Such + references may precede or follow the create command. + + If a valid uuid is specified, then it is used as the UUID + of the new row. + + Caution (ovs-vsctl as example) + Records in the Open vSwitch database are signifiā€ + cant only when they can be reached directly or inā€ + directly from the Open_vSwitch table. Except for + records in the QoS or Queue tables, records that + are not reachable from the Open_vSwitch table are + automatically deleted from the database. This + deletion happens immediately, without waiting for + additional ovs-vsctl commands or other database + activity. Thus, a create command must generally be + accompanied by additional commands within the same + ovs-vsctl invocation to add a chain of references + to the newly created record from the top-level + Open_vSwitch record. The EXAMPLES section gives + some examples that show how to do this. + + [--if-exists] destroy table record... + Deletes each specified record from table. Unless --if-exā€ā€ + ists is specified, each records must exist. + + --all destroy table + Deletes all records from the table. + + Caution (ovs-vsctl as example) + The destroy command is only useful for records in + the QoS or Queue tables. Records in other tables + are automatically deleted from the database when + they become unreachable from the Open_vSwitch taā€ + ble. This means that deleting the last reference + to a record is sufficient for deleting the record + itself. For records in these tables, destroy is + silently ignored. See the EXAMPLES section below + for more information. + + wait-until table record [column[:key]=value]... + Waits until table contains a record named record whose + column equals value or, if key is specified, whose column + contains a key with the specified value. This command + supports the same operators and semantics described for + the find command above. + + If no column[:key]=value arguments are given, this comā€ + mand waits only until record exists. If more than one + such argument is given, the command waits until all of + them are satisfied. + + Caution (ovs-vsctl as example) + Usually wait-until should be placed at the beginā€ + ning of a set of ovs-vsctl commands. For example, + wait-until bridge br0 -- get bridge br0 dataā€ā€ + path_id waits until a bridge named br0 is created, + then prints its datapath_id column, whereas get + bridge br0 datapath_id -- wait-until bridge br0 + will abort if no bridge named br0 exists when + ovs-vsctl initially connects to the database. + + Consider specifying --timeout=0 along with --wait-until, + to prevent ovs-vsctl from terminating after waiting only + at most 5 seconds. + + comment [arg]... + This command has no effect on behavior, but any database + log record created by the command will include the comā€ + mand and its arguments. + +ENVIRONMENT + OVN_NB_DAEMON + If set, this should name the Unix domain socket for an ovn-nbctl + server process. See Daemon Mode, above, for more information. + + OVN_NBCTL_OPTIONS + If set, a set of options for ovn-nbctl to apply automatically, + in the same form as on the command line. + + OVN_NB_DB + If set, the default database to contact when the --db option is + not used. + +EXIT STATUS + 0 Successful program execution. + + 1 Usage, syntax, or network error. + +SEE ALSO + ovn-nb(5), ovn-appctl(8). + +OVN 23.06.3 ovn-nbctl ovn-nbctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-northd.8 b/src/static/support/dist-docs-branch-23.06/ovn-northd.8 new file mode 100644 index 00000000..569d5b17 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-northd.8 @@ -0,0 +1,2808 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-northd" 8 "ovn-northd" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-northd and ovn-northd-ddlog \- Open Virtual Network central control daemon +.SH "SYNOPSIS" +.PP +\fBovn\-northd\fR [\fIoptions\fR] +.SH "DESCRIPTION" +.PP +.PP +\fBovn\-northd\fR is a centralized daemon responsible for translating the high-level OVN configuration into logical configuration consumable by daemons such as \fBovn\-controller\fR\[char46] It translates the logical network configuration in terms of conventional network concepts, taken from the OVN Northbound Database (see \fBovn\-nb\fR(5)), into logical datapath flows in the OVN Southbound Database (see \fBovn\-sb\fR(5)) below it\[char46] +.PP +.PP +\fBovn\-northd\fR is implemented in C\[char46] \fBovn\-northd\-ddlog\fR is a compatible implementation written in DDlog, a language for incremental database processing\[char46] This documentation applies to both implementations, with differences indicated where relevant\[char46] +.SH "OPTIONS" +.TP +\fB\-\-ovnnb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Northbound Database\[char46] If the \fBOVN_NB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnnb_db\[char46]sock\fR\[char46] +.TP +\fB\-\-ovnsb\-db=\fIdatabase\fB\fR +The OVSDB database containing the OVN Southbound Database\[char46] If the \fBOVN_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnsb_db\[char46]sock\fR\[char46] +.TP +\fB\-\-ddlog\-record=\fIfile\fB\fR +This option is for \fBovn\-north\-ddlog\fR only\[char46] It causes the daemon to record the initial database state and later changes to \fIfile\fR in the text-based DDlog command format\[char46] The \fBovn_northd_cli\fR program can later replay these changes for debugging purposes\[char46] This option has a performance impact\[char46] See \fBdebugging\-ddlog\[char46]rst\fR in the OVN documentation for more details\[char46] +.TP +\fB\-\-dry\-run\fR +Causes \fBovn\-northd\fR to start paused\[char46] In the paused state, \fBovn\-northd\fR does not apply any changes to the databases, although it continues to monitor them\[char46] For more information, see the \fBpause\fR command, under \fBRuntime Management +Commands\fR below\[char46] +.IP +For \fBovn\-northd\-ddlog\fR, one could use this option with \fB\-\-ddlog\-record\fR to generate a replay log without restarting a process or disturbing a running system\[char46] +.TP +\fBn\-threads N\fR +In certain situations, it may be desirable to enable parallelization on a system to decrease latency (at the potential cost of increasing CPU usage)\[char46] +.IP +This option will cause ovn-northd to use N threads when building logical flows, when N is within [2\-256]\[char46] If N is 1, parallelization is disabled (default behavior)\[char46] If N is less than 1, then N is set to 1, parallelization is disabled and a warning is logged\[char46] If N is more than 256, then N is set to 256, parallelization is enabled (with 256 threads) and a warning is logged\[char46] +.IP +ovn-northd-ddlog does not support this option\[char46] +.PP +.PP +\fIdatabase\fR in the above options must be an OVSDB active or passive connection method, as described in \fBovsdb\fR(7)\[char46] +.SS "Daemon Options" +.TP +\fB\-\-pidfile\fR[\fB=\fR\fIpidfile\fR] +Causes a file (by default, \fB\fIprogram\fB\[char46]pid\fR) to be created indicating the PID of the running process\[char46] If the \fIpidfile\fR argument is not specified, or if it does not begin with \fB/\fR, then it is created in \fB\fR\[char46] +.IP +If \fB\-\-pidfile\fR is not specified, no pidfile is created\[char46] +.TP +\fB\-\-overwrite\-pidfile\fR +By default, when \fB\-\-pidfile\fR is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start\[char46] Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead overwrite the pidfile\[char46] +.IP +When \fB\-\-pidfile\fR is not specified, this option has no effect\[char46] +.TP +\fB\-\-detach\fR +Runs this program as a background process\[char46] The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless \fB\-\-no\-chdir\fR is specified)\[char46] After the child completes its initialization, the parent exits\[char46] +.TP +\fB\-\-monitor\fR +Creates an additional process to monitor this program\[char46] If it dies due to a signal that indicates a programming error (\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR, \fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or \fBSIGXFSZ\fR) then the monitor process starts a new copy of it\[char46] If the daemon dies or exits for another reason, the monitor process exits\[char46] +.IP +This option is normally used with \fB\-\-detach\fR, but it also functions without it\[char46] +.TP +\fB\-\-no\-chdir\fR +By default, when \fB\-\-detach\fR is specified, the daemon changes its current working directory to the root directory after it detaches\[char46] Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory\[char46] +.IP +Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing the daemon from changing its current working directory\[char46] This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use\[char46] +.IP +This option has no effect when \fB\-\-detach\fR is not specified\[char46] +.TP +\fB\-\-no\-self\-confinement\fR +By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time\[char46] It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon\[char46] Note that in contrast to other access control implementations that are typically enforced from kernel-space (e\[char46]g\[char46] DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security\[char46] +.TP +\fB\-\-user=\fR\fIuser\fR\fB:\fR\fIgroup\fR +Causes this program to run as a different user specified in \fIuser\fR\fB:\fR\fIgroup\fR, thus dropping most of the root privileges\[char46] Short forms \fIuser\fR and \fB:\fR\fIgroup\fR are also allowed, with current user or group assumed, respectively\[char46] Only daemons started by the root user accepts this argument\[char46] +.IP +On Linux, daemons will be granted \fBCAP_IPC_LOCK\fR and \fBCAP_NET_BIND_SERVICES\fR before dropping root privileges\[char46] Daemons that interact with a datapath, such as \fBovs\-vswitchd\fR, will be granted three additional capabilities, namely \fBCAP_NET_ADMIN\fR, \fBCAP_NET_BROADCAST\fR and \fBCAP_NET_RAW\fR\[char46] The capability change will apply even if the new user is root\[char46] +.IP +On Windows, this option is not currently supported\[char46] For security reasons, specifying this option will cause the daemon process not to start\[char46] +.SS "Logging Options" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SS "PKI Options" +.PP +.PP +PKI configuration is required in order to use SSL for the connections to the Northbound and Southbound databases\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.SS "Other Options" +.TP +\fB\-\-unixctl=\fIsocket\fB\fR +Sets the name of the control socket on which \fB\fIprogram\fB\fR listens for runtime management commands (see \fIRUNTIME MANAGEMENT COMMANDS,\fR below)\[char46] If \fIsocket\fR does not begin with \fB/\fR, it is interpreted as relative to \fB\fR\[char46] If \fB\-\-unixctl\fR is not used at all, the default socket is \fB/\fIprogram\fB\[char46]\fR\fIpid\fR\fB\[char46]ctl\fR, where \fIpid\fR is \fB\fIprogram\fB\fR\(cqs process ID\[char46] +.IP +On Windows a local named pipe is used to listen for runtime management commands\[char46] A file is created in the absolute path as pointed by \fIsocket\fR or if \fB\-\-unixctl\fR is not used at all, a file is created as \fB\fIprogram\fB\fR in the configured \fIOVS_RUNDIR\fR directory\[char46] The file exists just to mimic the behavior of a Unix domain socket\[char46] +.IP +Specifying \fBnone\fR for \fIsocket\fR disables the control socket feature\[char46] +.ST "" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] +.SH "RUNTIME MANAGEMENT COMMANDS" +.PP +.PP +\fBovs\-appctl\fR can send commands to a running \fBovn\-northd\fR process\[char46] The currently supported commands are described below\[char46] +.RS +.TP +\fBexit\fR +Causes \fBovn\-northd\fR to gracefully terminate\[char46] +.TP +\fBpause\fR +Pauses \fBovn\-northd\fR\[char46] When it is paused, \fBovn\-northd\fR receives changes from the Northbound and Southbound database changes as usual, but it does not send any updates\[char46] A paused \fBovn\-northd\fR also drops database locks, which allows any other non-paused instance of \fBovn\-northd\fR to take over\[char46] +.TP +\fBresume\fR +Resumes the ovn-northd operation to process Northbound and Southbound database contents and generate logical flows\[char46] This will also instruct ovn-northd to aspire for the lock on SB DB\[char46] +.TP +\fBis\-paused\fR +Returns \(dqtrue\(dq if ovn-northd is currently paused, \(dqfalse\(dq otherwise\[char46] +.TP +\fBstatus\fR +Prints this server\(cqs status\[char46] Status will be \(dqactive\(dq if ovn-northd has acquired OVSDB lock on SB DB, \(dqstandby\(dq if it has not or \(dqpaused\(dq if this instance is paused\[char46] +.TP +\fBsb\-cluster\-state\-reset\fR +Reset southbound database cluster status when databases are destroyed and rebuilt\[char46] +.IP +If all databases in a clustered southbound database are removed from disk, then the stored index of all databases will be reset to zero\[char46] This will cause ovn-northd to be unable to read or write to the southbound database, because it will always detect the data as stale\[char46] In such a case, run this command so that ovn-northd will reset its local index so that it can interact with the southbound database again\[char46] +.TP +\fBnb\-cluster\-state\-reset\fR +Reset northbound database cluster status when databases are destroyed and rebuilt\[char46] +.IP +This performs the same task as \fBsb\-cluster\-state\-reset\fR except for the northbound database client\[char46] +.TP +\fBset\-n\-threads N\fR +Set the number of threads used for building logical flows\[char46] When N is within [2\-256], parallelization is enabled\[char46] When N is 1 parallelization is disabled\[char46] When N is less than 1 or more than 256, an error is returned\[char46] If ovn-northd fails to start parallelization (e\[char46]g\[char46] fails to setup semaphores, parallelization is disabled and an error is returned\[char46] +.TP +\fBget\-n\-threads\fR +Return the number of threads used for building logical flows\[char46] +.TP +\fBinc\-engine/show\-stats\fR +Display \fBovn\-northd\fR engine counters\[char46] For each engine node the following counters have been added: +.RS +.IP \(bu +\fBrecompute\fR +.IP \(bu +\fBcompute\fR +.IP \(bu +\fBabort\fR +.RE +.TP +\fBinc\-engine/show\-stats \fIengine_node_name\fB \fIcounter_name\fB\fR +Display the \fBovn\-northd\fR engine counter(s) for the specified \fIengine_node_name\fR\[char46] \fIcounter_name\fR is optional and can be one of \fBrecompute\fR, \fBcompute\fR or \fBabort\fR\[char46] +.TP +\fBinc\-engine/clear\-stats\fR +Reset \fBovn\-northd\fR engine counters\[char46] +.RE +.PP +.PP +Only \fBovn\-northd\-ddlog\fR supports the following commands: +.RS +.TP +\fBenable\-cpu\-profiling\fR +.TQ .5in +\fBdisable\-cpu\-profiling\fR +Enables or disables profiling of CPU time used by the DDlog engine\[char46] When CPU profiling is enabled, the \fBprofile\fR command (see below) will include DDlog CPU usage statistics in its output\[char46] Enabling CPU profiling will slow \fBovn\-northd\-ddlog\fR\[char46] Disabling CPU profiling does not clear any previously recorded statistics\[char46] +.TP +\fBprofile\fR +Outputs a profile of the current and peak sizes of arrangements inside DDlog\[char46] This profiling data can be useful for optimizing DDlog code\[char46] If CPU profiling was previously enabled (even if it was later disabled), the output also includes a CPU time profile\[char46] See \fBProfiling\fR inside the tutorial in the DDlog repository for an introduction to profiling DDlog\[char46] +.RE +.SH "ACTIVE-STANDBY FOR HIGH AVAILABILITY" +.PP +.PP +You may run \fBovn\-northd\fR more than once in an OVN deployment\[char46] When connected to a standalone or clustered DB setup, OVN will automatically ensure that only one of them is active at a time\[char46] If multiple instances of \fBovn\-northd\fR are running and the active \fBovn\-northd\fR fails, one of the hot standby instances of \fBovn\-northd\fR will automatically take over\[char46] +.SS "Active\-Standby with multiple OVN DB servers" +.PP +.PP +You may run multiple OVN DB servers in an OVN deployment with: +.RS +.IP \(bu +OVN DB servers deployed in active/passive mode with one active and multiple passive ovsdb-servers\[char46] +.IP \(bu +\fBovn\-northd\fR also deployed on all these nodes, using unix ctl sockets to connect to the local OVN DB servers\[char46] +.RE +.PP +.PP +In such deployments, the ovn-northds on the passive nodes will process the DB changes and compute logical flows to be thrown out later, because write transactions are not allowed by the passive ovsdb-servers\[char46] It results in unnecessary CPU usage\[char46] +.PP +.PP +With the help of runtime management command \fBpause\fR, you can pause \fBovn\-northd\fR on these nodes\[char46] When a passive node becomes master, you can use the runtime management command \fBresume\fR to resume the \fBovn\-northd\fR to process the DB changes\[char46] +.SH "LOGICAL FLOW TABLE STRUCTURE" +.PP +.PP +One of the main purposes of \fBovn\-northd\fR is to populate the \fBLogical_Flow\fR table in the \fBOVN_Southbound\fR database\[char46] This section describes how \fBovn\-northd\fR does this for switch and router logical datapaths\[char46] +.SS "Logical Switch Datapaths" +.ST "Ingress Table 0: Admission Control and Ingress Port Security check" +.PP +.PP +Ingress table 0 contains these logical flows: +.RS +.IP \(bu +Priority 100 flows to drop packets with VLAN tags or multicast Ethernet source addresses\[char46] +.IP \(bu +For each disabled logical port, a priority 100 flow is added which matches on all packets and applies the action \fBREGBIT_PORT_SEC_DROP\(dq = 1; next;\(dq\fR so that the packets are dropped in the next stage\[char46] +.IP \(bu +For each (enabled) vtep logical port, a priority 70 flow is added which matches on all packets and applies the action \fBnext(pipeline=ingress, table=S_SWITCH_IN_L2_LKUP) = 1;\fR to skip most stages of ingress pipeline and go directly to ingress L2 lookup table to determine the output port\[char46] Packets from VTEP (RAMP) switch should not be subjected to any ACL checks\[char46] Egress pipeline will do the ACL checks\[char46] +.IP \(bu +For each enabled logical port configured with qdisc queue id in the \fBoptions:qdisc_queue_id\fR column of \fBLogical_Switch_Port\fR, a priority 70 flow is added which matches on all packets and applies the action \fBset_queue(id); +REGBIT_PORT_SEC_DROP\(dq = check_in_port_sec(); next;\(dq\fR\[char46] +.IP \(bu +A priority 1 flow is added which matches on all packets for all the logical ports and applies the action \fBREGBIT_PORT_SEC_DROP\(dq = check_in_port_sec(); next;\fR to evaluate the port security\[char46] The action \fBcheck_in_port_sec\fR applies the port security rules defined in the \fBport_security\fR column of \fBLogical_Switch_Port\fR table\[char46] +.RE +.ST "Ingress Table 1: Ingress Port Security - Apply" +.PP +.PP +This table drops the packets if the port security check failed in the previous stage i\[char46]e the register bit \fBREGBIT_PORT_SEC_DROP\fR is set to 1\[char46] +.PP +.PP +Ingress table 1 contains these logical flows: +.RS +.IP \(bu +A priority\-50 fallback flow that drops the packet if the register bit \fBREGBIT_PORT_SEC_DROP\fR is set to 1\[char46] +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 2: Lookup MAC address learning table" +.PP +.PP +This table looks up the MAC learning table of the logical switch datapath to check if the \fBport\-mac\fR pair is present or not\[char46] MAC is learnt for logical switch VIF ports whose port security is disabled and \(cqunknown\(cq address setn as well as for localnet ports with option localnet_learn_fdb\[char46] A localnet port entry does not overwrite a VIF port entry\[char46] +.RS +.IP \(bu +For each such VIF logical port \fIp\fR whose port security is disabled and \(cqunknown\(cq address set following flow is added\[char46] +.RS +.IP \(bu +Priority 100 flow with the match \fBinport == \fIp\fB\fR and action \fBreg0[11] = lookup_fdb(inport, eth\[char46]src); next;\fR +.RE +.IP \(bu +For each such localnet logical port \fIp\fR following flow is added\[char46] +.RS +.IP \(bu +Priority 100 flow with the match \fBinport == \fIp\fB\fR and action \fBflags\[char46]localnet = 1;\fR \fBreg0[11] = lookup_fdb(inport, eth\[char46]src); next;\fR +.RE +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 3: Learn MAC of \(cqunknown\(cq ports\[char46]" +.PP +.PP +This table learns the MAC addresses seen on the VIF logical ports whose port security is disabled and \(cqunknown\(cq address set as well as on localnet ports with localnet_learn_fdb option set if the \fBlookup_fdb\fR action returned false in the previous table\[char46] For localnet ports (with flags\[char46]localnet = 1), lookup_fdb returns true if (port, mac) is found or if a mac is found for a port of type vif\[char46] +.RS +.IP \(bu +For each such VIF logical port \fIp\fR whose port security is disabled and \(cqunknown\(cq address set and localnet port following flow is added\[char46] +.RS +.IP \(bu +Priority 100 flow with the match \fBinport == \fIp\fB && reg0[11] == 0\fR and action \fBput_fdb(inport, eth\[char46]src); next;\fR which stores the \fBport\-mac\fR in the mac learning table of the logical switch datapath and advances the packet to the next table\[char46] +.RE +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 4: \fBfrom\-lport\fI Pre-ACLs" +.PP +.PP +This table prepares flows for possible stateful ACL processing in ingress table \fBACLs\fR\[char46] It contains a priority\-0 flow that simply moves traffic to the next table\[char46] If stateful ACLs are used in the logical datapath, a priority\-100 flow is added that sets a hint (with \fBreg0[0] = 1; next;\fR) for table \fBPre\-stateful\fR to send IP packets to the connection tracker before eventually advancing to ingress table \fBACLs\fR\[char46] If special ports such as route ports or localnet ports can\(cqt use ct(), a priority\-110 flow is added to skip over stateful ACLs\[char46] Multicast, IPv6 Neighbor Discovery and MLD traffic also skips stateful ACLs\[char46] For \(dqallow-stateless\(dq ACLs, a flow is added to bypass setting the hint for connection tracker processing when there are stateful ACLs or LB rules; \fBREGBIT_ACL_STATELESS\fR is set for traffic matching stateless ACL flows\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBeth\[char46]dst == \fIE\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.ST "Ingress Table 5: Pre-LB" +.PP +.PP +This table prepares flows for possible stateful load balancing processing in ingress table \fBLB\fR and \fBStateful\fR\[char46] It contains a priority\-0 flow that simply moves traffic to the next table\[char46] Moreover it contains two priority\-110 flows to move multicast, IPv6 Neighbor Discovery and MLD traffic to the next table\[char46] It also contains two priority\-110 flows to move stateless traffic, i\[char46]e traffic for which \fBREGBIT_ACL_STATELESS\fR is set, to the next table\[char46] If load balancing rules with virtual IP addresses (and ports) are configured in \fBOVN_Northbound\fR database for a logical switch datapath, a priority\-100 flow is added with the match \fBip\fR to match on IP packets and sets the action \fBreg0[2] = 1; next;\fR to act as a hint for table \fBPre\-stateful\fR to send IP packets to the connection tracker for packet de-fragmentation (and to possibly do DNAT for already established load balanced traffic) before eventually advancing to ingress table \fBStateful\fR\[char46] If controller_event has been enabled and load balancing rules with empty backends have been added in \fBOVN_Northbound\fR, a 130 flow is added to trigger ovn-controller events whenever the chassis receives a packet for that particular VIP\[char46] If \fBevent\-elb\fR meter has been previously created, it will be associated to the empty_lb logical flow +.PP +.PP +Prior to \fBOVN 20\[char46]09\fR we were setting the \fBreg0[0] = 1\fR only if the IP destination matches the load balancer VIP\[char46] However this had few issues cases where a logical switch doesn\(cqt have any ACLs with \fBallow\-related\fR action\[char46] To understand the issue lets a take a TCP load balancer - \fB10\[char46]0\[char46]0\[char46]10:80=10\[char46]0\[char46]0\[char46]3:80\fR\[char46] If a logical port - p1 with IP - 10\[char46]0\[char46]0\[char46]5 opens a TCP connection with the VIP - 10\[char46]0\[char46]0\[char46]10, then the packet in the ingress pipeline of \(cqp1\(cq is sent to the p1\(cqs conntrack zone id and the packet is load balanced to the backend - 10\[char46]0\[char46]0\[char46]3\[char46] For the reply packet from the backend lport, it is not sent to the conntrack of backend lport\(cqs zone id\[char46] This is fine as long as the packet is valid\[char46] Suppose the backend lport sends an invalid TCP packet (like incorrect sequence number), the packet gets delivered to the lport \(cqp1\(cq without unDNATing the packet to the VIP - 10\[char46]0\[char46]0\[char46]10\[char46] And this causes the connection to be reset by the lport p1\(cqs VIF\[char46] +.PP +.PP +We can\(cqt fix this issue by adding a logical flow to drop ct\[char46]inv packets in the egress pipeline since it will drop all other connections not destined to the load balancers\[char46] To fix this issue, we send all the packets to the conntrack in the ingress pipeline if a load balancer is configured\[char46] We can now add a lflow to drop ct\[char46]inv packets\[char46] +.PP +.PP +This table also has priority\-120 flows that punt all IGMP/MLD packets to \fBovn\-controller\fR if the switch is an interconnect switch with multicast snooping enabled\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBeth\[char46]dst == \fIE\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBinport == \fII\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fII\fR is the peer of a logical router port\[char46] This flow is added to skip the connection tracking of packets which enter from logical router datapath to logical switch datapath\[char46] +.ST "Ingress Table 6: Pre-stateful" +.PP +.PP +This table prepares flows for all possible stateful processing in next tables\[char46] It contains a priority\-0 flow that simply moves traffic to the next table\[char46] +.RS +.IP \(bu +Priority\-120 flows that send the packets to connection tracker using \fBct_lb_mark;\fR as the action so that the already established traffic destined to the load balancer VIP gets DNATted\[char46] These flows match each VIPs IP and port\[char46] For IPv4 traffic the flows also load the original destination IP and transport port in registers \fBreg1\fR and \fBreg2\fR\[char46] For IPv6 traffic the flows also load the original destination IP and transport port in registers \fBxxreg1\fR and \fBreg2\fR\[char46] +.IP \(bu +A priority\-110 flow sends the packets that don\(cqt match the above flows to connection tracker based on a hint provided by the previous tables (with a match for \fBreg0[2] == 1\fR) by using the \fBct_lb_mark;\fR action\[char46] +.IP \(bu +A priority\-100 flow sends the packets to connection tracker based on a hint provided by the previous tables (with a match for \fBreg0[0] == 1\fR) by using the \fBct_next;\fR action\[char46] +.RE +.ST "Ingress Table 7: \fBfrom\-lport\fI ACL hints" +.PP +.PP +This table consists of logical flows that set hints (\fBreg0\fR bits) to be used in the next stage, in the ACL processing table, if stateful ACLs or load balancers are configured\[char46] Multiple hints can be set for the same packet\[char46] The possible hints are: +.RS +.IP \(bu +\fBreg0[7]\fR: the packet might match an \fBallow\-related\fR ACL and might have to commit the connection to conntrack\[char46] +.IP \(bu +\fBreg0[8]\fR: the packet might match an \fBallow\-related\fR ACL but there will be no need to commit the connection to conntrack because it already exists\[char46] +.IP \(bu +\fBreg0[9]\fR: the packet might match a \fBdrop/reject\fR\[char46] +.IP \(bu +\fBreg0[10]\fR: the packet might match a \fBdrop/reject\fR ACL but the connection was previously allowed so it might have to be committed again with \fBct_label=1/1\fR\[char46] +.RE +.PP +.PP +The table contains the following flows: +.RS +.IP \(bu +A priority\-65535 flow to advance to the next table if the logical switch has \fBno\fR ACLs configured, otherwise a priority\-0 flow to advance to the next table\[char46] +.RE +.RS +.IP \(bu +A priority\-7 flow that matches on packets that initiate a new session\[char46] This flow sets \fBreg0[7]\fR and \fBreg0[9]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-6 flow that matches on packets that are in the request direction of an already existing session that has been marked as blocked\[char46] This flow sets \fBreg0[7]\fR and \fBreg0[9]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-5 flow that matches untracked packets\[char46] This flow sets \fBreg0[8]\fR and \fBreg0[9]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-4 flow that matches on packets that are in the request direction of an already existing session that has not been marked as blocked\[char46] This flow sets \fBreg0[8]\fR and \fBreg0[10]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-3 flow that matches on packets that are in not part of established sessions\[char46] This flow sets \fBreg0[9]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-2 flow that matches on packets that are part of an established session that has been marked as blocked\[char46] This flow sets \fBreg0[9]\fR and then advances to the next table\[char46] +.IP \(bu +A priority\-1 flow that matches on packets that are part of an established session that has not been marked as blocked\[char46] This flow sets \fBreg0[10]\fR and then advances to the next table\[char46] +.RE +.ST "Ingress table 8: \fBfrom\-lport\fI ACL evaluation before LB" +.PP +.PP +Logical flows in this table closely reproduce those in the \fBACL\fR table in the \fBOVN_Northbound\fR database for the \fBfrom\-lport\fR direction without the option \fBapply\-after\-lb\fR set or set to \fBfalse\fR\[char46] The \fBpriority\fR values from the \fBACL\fR table have a limited range and have 1000 added to them to leave room for OVN default flows at both higher and lower priorities\[char46] +.RS +.IP \(bu +This table is responsible for evaluating ACLs, and setting a register bit to indicate whether the ACL decided to allow, drop, or reject the traffic\[char46] The allow bit is \fBreg8[16]\fR\[char46] The drop bit is \fBreg8[17]\fR\[char46] All flows in this table will advance the packet to the next table, where the bits from before are evaluated to determine what to do with the packet\[char46] Any flows in this table that intend for the packet to pass will set \fBreg8[16]\fR to 1, even if an ACL with an allow-type action was not matched\[char46] This lets the next table know to allow the traffic to pass\[char46] These bits will be referred to as the \(dqallow\(dq, \(dqdrop\(dq, and \(dqreject\(dq bits in the upcoming paragraphs\[char46] +.IP \(bu +If the \fBtier\fR column has been configured on the ACL, then OVN will also match the current tier counter against the configured ACL tier\[char46] OVN keeps count of the current tier in \fBreg8[30\[char46]\[char46]31]\fR\[char46] +.IP \(bu +\fBallow\fR ACLs translate into logical flows that set the allow bit to 1 and advance the packet to the next table\[char46] If there are any stateful ACLs on this datapath, then \fBallow\fR ACLs set the allow bit to one and in addition perform \fBct_commit;\fR (which acts as a hint for future tables to commit the connection to conntrack)\[char46] In case the \fBACL\fR has a label then \fBreg3\fR is loaded with the label value and \fBreg0[13]\fR bit is set to 1 (which acts as a hint for the next tables to commit the label to conntrack)\[char46] +.IP \(bu +\fBallow\-related\fR ACLs translate into logical flows that set the allow bit and additionally have \fBct_commit(ct_label=0/1); +next;\fR actions for new connections and \fBreg0[1] = 1; +next;\fR for existing connections\[char46] In case the \fBACL\fR has a label then \fBreg3\fR is loaded with the label value and \fBreg0[13]\fR bit is set to 1 (which acts as a hint for the next tables to commit the label to conntrack)\[char46] +.IP \(bu +\fBallow\-stateless\fR ACLs translate into logical flows that set the allow bit and advance to the next table\[char46] +.IP \(bu +\fBreject\fR ACLs translate into logical flows with that set the reject bit and advance to the next table\[char46] +.IP \(bu +\fBpass\fR ACLs translate into logical flows that do not set the allow, drop, or reject bit and advance to the next table\[char46] +.IP \(bu +Other ACLs set the drop bit and advance to the next table for new or untracked connections\[char46] For known connections, they set the drop bit, as well as running the \fBct_commit(ct_label=1/1);\fR action\[char46] Setting \fBct_label\fR marks a connection as one that was previously allowed, but should no longer be allowed due to a policy change\[char46] +.RE +.PP +.PP +This table contains a priority\-65535 flow to set the allow bit and advance to the next table if the logical switch has \fBno\fR ACLs configured, otherwise a priority\-0 flow to advance to the next table is added\[char46] This flow does not set the allow bit, so that the next table can decide whether to allow or drop the packet based on the value of the \fBoptions:default_acl_drop\fR column of the \fBNB_Global\fR table\[char46] +.PP +.PP +A priority\-65532 flow is added that sets the allow bit for IPv6 Neighbor solicitation, Neighbor discover, Router solicitation, Router advertisement and MLD packets regardless of other ACLs defined\[char46] +.PP +.PP +If the logical datapath has a stateful ACL or a load balancer with VIP configured, the following flows will also be added: +.RS +.IP \(bu +If \fBoptions:default_acl_drop\fR column of \fBNB_Global\fR is \fBfalse\fR or not set, a priority\-1 flow that sets the hint to commit IP traffic that is not part of established sessions to the connection tracker (with action \fBreg0[1] = 1; next;\fR)\[char46] This is needed for the default allow policy because, while the initiator\(cqs direction may not have any stateful rules, the server\(cqs may and then its return traffic would not be known and marked as invalid\[char46] +.IP \(bu +A priority\-1 flow that sets the allow bit and sets the hint to commit IP traffic to the connection tracker (with action \fBreg0[1] = 1; +next;\fR)\[char46] This is needed for the default allow policy because, while the initiator\(cqs direction may not have any stateful rules, the server\(cqs may and then its return traffic would not be known and marked as invalid\[char46] +.IP \(bu +A priority\-65532 flow that sets the allow bit for any traffic in the reply direction for a connection that has been committed to the connection tracker (i\[char46]e\[char46], established flows), as long as the committed flow does not have \fBct_mark\[char46]blocked\fR set\[char46] We only handle traffic in the reply direction here because we want all packets going in the request direction to still go through the flows that implement the currently defined policy based on ACLs\[char46] If a connection is no longer allowed by policy, \fBct_mark\[char46]blocked\fR will get set and packets in the reply direction will no longer be allowed, either\[char46] This flow also clears the register bits \fBreg0[9]\fR and \fBreg0[10]\fR and sets register bit \fBreg0[17]\fR\[char46] If ACL logging and logging of related packets is enabled, then a companion priority\-65533 flow will be installed that accomplishes the same thing but also logs the traffic\[char46] +.IP \(bu +A priority\-65532 flow that sets the allow bit for any traffic that is considered related to a committed flow in the connection tracker (e\[char46]g\[char46], an ICMP Port Unreachable from a non-listening UDP port), as long as the committed flow does not have \fBct_mark\[char46]blocked\fR set\[char46] This flow also applies NAT to the related traffic so that ICMP headers and the inner packet have correct addresses\[char46] If ACL logging and logging of related packets is enabled, then a companion priority\-65533 flow will be installed that accomplishes the same thing but also logs the traffic\[char46] +.IP \(bu +A priority\-65532 flow that sets the drop bit for all traffic marked by the connection tracker as invalid\[char46] +.IP \(bu +A priority\-65532 flow that sets the drop bit for all traffic in the reply direction with \fBct_mark\[char46]blocked\fR set meaning that the connection should no longer be allowed due to a policy change\[char46] Packets in the request direction are skipped here to let a newly created ACL re-allow this connection\[char46] +.RE +.PP +.PP +If the logical datapath has any ACL or a load balancer with VIP configured, the following flow will also be added: +.RS +.IP \(bu +A priority 34000 logical flow is added for each logical switch datapath with the match \fBeth\[char46]dst = \fIE\fB\fR to allow the service monitor reply packet destined to \fBovn\-controller\fR that sets the allow bit, where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.RE +.ST "Ingress Table 9: \fBfrom\-lport\fI ACL action" +.PP +.PP +Logical flows in this table decide how to proceed based on the values of the allow, drop, and reject bits that may have been set in the previous table\[char46] +.RS +.IP \(bu +If no ACLs are configured, then a priority 0 flow is installed that matches everything and advances to the next table\[char46] +.IP \(bu +A priority 1000 flow is installed that will advance the packet to the next table if the allow bit is set\[char46] +.IP \(bu +A priority 1000 flow is installed that will run the \fBdrop;\fR action if the drop bit is set\[char46] +.IP \(bu +A priority 1000 flow is installed that will run the \fBtcp_reset +{ output <\-> inport; next(pipeline=egress,table=5);}\fR action for TCP connections,\fBicmp4/icmp6\fR action for UDP connections, and \fBsctp_abort {output <\-%gt; inport; +next(pipeline=egress,table=5);}\fR action for SCTP associations\[char46] +.IP \(bu +If any ACLs have tiers configured on them, then three priority 500 flows are installed\[char46] If the current tier counter is 0, 1, or 2, then the current tier counter is incremented by one and the packet is sent back to the previous table for re-evaluation\[char46] +.RE +.ST "Ingress Table 10: \fBfrom\-lport\fI QoS Marking" +.PP +.PP +Logical flows in this table closely reproduce those in the \fBQoS\fR table with the \fBaction\fR column set in the \fBOVN_Northbound\fR database for the \fBfrom\-lport\fR direction\[char46] +.RS +.IP \(bu +For every qos_rules entry in a logical switch with DSCP marking enabled, a flow will be added at the priority mentioned in the QoS table\[char46] +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 11: \fBfrom\-lport\fI QoS Meter" +.PP +.PP +Logical flows in this table closely reproduce those in the \fBQoS\fR table with the \fBbandwidth\fR column set in the \fBOVN_Northbound\fR database for the \fBfrom\-lport\fR direction\[char46] +.RS +.IP \(bu +For every qos_rules entry in a logical switch with metering enabled, a flow will be added at the priority mentioned in the QoS table\[char46] +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 12: Load balancing affinity check" +.PP +.PP +Load balancing affinity check table contains the following logical flows: +.RS +.IP \(bu +For all the configured load balancing rules for a switch in \fBOVN_Northbound\fR database where a positive affinity timeout is specified in \fBoptions\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IP address \fIVIP\fR, a priority\-100 flow is added\[char46] For IPv4 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && ip4\[char46]dst == \fIVIP\fB +&& \fIP\fB\[char46]dst == \fIPORT\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && +ip6\[char46]dst == \fIVIP\fB&& \fIP\fB && +\fIP\fB\[char46]dst == \fI PORT\fB\fR\[char46] The flow\(cqs action is \fBreg9[6] = chk_lb_aff(); next;\fR\[char46] +.IP \(bu +A priority 0 flow is added which matches on all packets and applies the action \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 13: LB" +.RS +.IP \(bu +For all the configured load balancing rules for a switch in \fBOVN_Northbound\fR database where a positive affinity timeout is specified in \fBoptions\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IP address \fIVIP\fR, a priority\-150 flow is added\[char46] For IPv4 \fIVIPs\fR, the flow matches \fBreg9[6] == 1 && ct\[char46]new && ip && +ip4\[char46]dst == \fIVIP\fB && \fIP\fB\[char46]dst == \fIPORT +\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBreg9[6] == 1 && ct\[char46]new && ip && +ip6\[char46]dst == \fI VIP \fB&& \fIP\fB && +\fIP\fB\[char46]dst == \fI PORT\fB\fR\[char46] The flow\(cqs action is \fBct_lb_mark(\fIargs\fB)\fR, where \fIargs\fR contains comma separated IP addresses (and optional port numbers) to load balance to\[char46] The address family of the IP addresses of \fIargs\fR is the same as the address family of \fIVIP\fR\[char46] +.IP \(bu +For all the configured load balancing rules for a switch in \fBOVN_Northbound\fR database that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IP address \fIVIP\fR, a priority\-120 flow is added\[char46] For IPv4 \fIVIPs +\fR, the flow matches \fBct\[char46]new && ip && +ip4\[char46]dst == \fIVIP\fB && +\fIP\fB\[char46]dst == \fIPORT\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && ip6\[char46]dst == \fI +VIP \fB&& \fIP\fB && \fIP\fB\[char46]dst == \fI +PORT\fB\fR\[char46] The flow\(cqs action is \fBct_lb_mark(\fIargs\fB) +\fR, where \fIargs\fR contains comma separated IP addresses (and optional port numbers) to load balance to\[char46] The address family of the IP addresses of \fIargs\fR is the same as the address family of \fIVIP\fR\[char46] If health check is enabled, then \fIargs\fR will only contain those endpoints whose service monitor status entry in \fBOVN_Southbound\fR db is either \fBonline\fR or empty\[char46] For IPv4 traffic the flow also loads the original destination IP and transport port in registers \fBreg1\fR and \fBreg2\fR\[char46] For IPv6 traffic the flow also loads the original destination IP and transport port in registers \fBxxreg1\fR and \fBreg2\fR\[char46] The above flow is created even if the load balancer is attached to a logical router connected to the current logical switch and the \fBinstall_ls_lb_from_router\fR variable in \fBoptions\fR is set to true\[char46] +.IP \(bu +For all the configured load balancing rules for a switch in \fBOVN_Northbound\fR database that includes just an IP address \fIVIP\fR to match on, OVN adds a priority\-110 flow\[char46] For IPv4 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && +ip4\[char46]dst == \fIVIP\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && ip6\[char46]dst == \fI +VIP\fB\fR\[char46] The action on this flow is \fB +ct_lb_mark(\fIargs\fB)\fR, where \fIargs\fR contains comma separated IP addresses of the same address family as \fIVIP\fR\[char46] For IPv4 traffic the flow also loads the original destination IP and transport port in registers \fBreg1\fR and \fBreg2\fR\[char46] For IPv6 traffic the flow also loads the original destination IP and transport port in registers \fBxxreg1\fR and \fBreg2\fR\[char46] The above flow is created even if the load balancer is attached to a logical router connected to the current logical switch and the \fBinstall_ls_lb_from_router\fR variable in \fBoptions\fR is set to true\[char46] +.IP \(bu +If the load balancer is created with \fB\-\-reject\fR option and it has no active backends, a TCP reset segment (for tcp) or an ICMP port unreachable packet (for all other kind of traffic) will be sent whenever an incoming packet is received for this load-balancer\[char46] Please note using \fB\-\-reject\fR option will disable empty_lb SB controller event for this load balancer\[char46] +.RE +.ST "Ingress Table 14: Load balancing affinity learn" +.PP +.PP +Load balancing affinity learn table contains the following logical flows: +.RS +.IP \(bu +For all the configured load balancing rules for a switch in \fBOVN_Northbound\fR database where a positive affinity timeout \fIT\fR is specified in \fBoptions\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IP address \fIVIP\fR, a priority\-100 flow is added\[char46] For IPv4 \fIVIPs\fR, the flow matches \fBreg9[6] == 0 && ct\[char46]new && ip +&& ip4\[char46]dst == \fIVIP\fB && \fIP\fB\[char46]dst == +\fIPORT\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBct\[char46]new && ip && ip6\[char46]dst == \fIVIP\fB +&& \fIP\fB && \fIP\fB\[char46]dst == \fIPORT\fB +\fR\[char46] The flow\(cqs action is \fBcommit_lb_aff(vip = +\fIVIP\fB:\fIPORT\fB, backend = \fIbackend ip\fB: +\fIbackend port\fB, proto = \fIP\fB, timeout = \fIT\fB); +\fR\[char46] +.IP \(bu +A priority 0 flow is added which matches on all packets and applies the action \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 15: Pre-Hairpin" +.RS +.IP \(bu +If the logical switch has load balancer(s) configured, then a priority\-100 flow is added with the match \fBip && ct\[char46]trk\fR to check if the packet needs to be hairpinned (if after load balancing the destination IP matches the source IP) or not by executing the actions \fBreg0[6] = chk_lb_hairpin();\fR and \fBreg0[12] = chk_lb_hairpin_reply();\fR and advances the packet to the next table\[char46] +.IP \(bu +A priority\-0 flow that simply moves traffic to the next table\[char46] +.RE +.ST "Ingress Table 16: Nat-Hairpin" +.RS +.IP \(bu +If the logical switch has load balancer(s) configured, then a priority\-100 flow is added with the match \fBip && ct\[char46]new && ct\[char46]trk && +reg0[6] == 1\fR which hairpins the traffic by NATting source IP to the load balancer VIP by executing the action \fBct_snat_to_vip\fR and advances the packet to the next table\[char46] +.IP \(bu +If the logical switch has load balancer(s) configured, then a priority\-100 flow is added with the match \fBip && ct\[char46]est && ct\[char46]trk && +reg0[6] == 1\fR which hairpins the traffic by NATting source IP to the load balancer VIP by executing the action \fBct_snat\fR and advances the packet to the next table\[char46] +.IP \(bu +If the logical switch has load balancer(s) configured, then a priority\-90 flow is added with the match \fBip && reg0[12] == 1\fR which matches on the replies of hairpinned traffic (i\[char46]e\[char46], destination IP is VIP, source IP is the backend IP and source L4 port is backend port for L4 load balancers) and executes \fBct_snat\fR and advances the packet to the next table\[char46] +.IP \(bu +A priority\-0 flow that simply moves traffic to the next table\[char46] +.RE +.ST "Ingress Table 17: Hairpin" +.RS +.IP \(bu +If logical switch has attached logical switch port of \fIvtep\fR type, then for each distributed gateway router port \fIRP\fR attached to this logical switch and has chassis redirect port \fIcr-RP\fR, a priority\-2000 flow is added with the match .IP +.nf +\fB +.br +\fB\fR\fBreg0[14] == 1 && is_chassis_resident(\fIcr-RP\fB)\fB\fR +.br +\fB \fR +.fi +and action \fBnext;\fR\[char46] +.IP +\fBreg0[14]\fR register bit is set in the ingress L2 port security check table for traffic received from HW VTEP (ramp) ports\[char46] +.IP \(bu +If logical switch has attached logical switch port of \fIvtep\fR type, then a priority\-1000 flow that matches on \fBreg0[14]\fR register bit for the traffic received from HW VTEP (ramp) ports\[char46] This traffic is passed to ingress table ls_in_l2_lkup\[char46] +.IP \(bu +A priority\-1 flow that hairpins traffic matched by non-default flows in the Pre-Hairpin table\[char46] Hairpinning is done at L2, Ethernet addresses are swapped and the packets are looped back on the input port\[char46] +.IP \(bu +A priority\-0 flow that simply moves traffic to the next table\[char46] +.RE +.ST "Ingress table 18: \fBfrom\-lport\fI ACL evaluation after LB" +.PP +.PP +Logical flows in this table closely reproduce those in the \fBACL eval\fR table in the \fBOVN_Northbound\fR database for the \fBfrom\-lport\fR direction with the option \fBapply\-after\-lb\fR set to \fBtrue\fR\[char46] The \fBpriority\fR values from the \fBACL\fR table have a limited range and have 1000 added to them to leave room for OVN default flows at both higher and lower priorities\[char46] The flows in this table indicate the ACL verdict by setting \fBreg8[16]\fR for \fBallow\-type\fR ACLs, \fBreg8[17]\fR for \fBdrop\fR ACLs, and \fBreg8[17]\fR for \fBreject\fR ACLs, and then advancing the packet to the next table\[char46] These will be reffered to as the allow bit, drop bit, and reject bit throughout the documentation for this table and the next one\[char46] +.PP +.PP +Like with ACLs that are evaluated before load balancers, if the ACL is configured with a tier value, then the current tier counter, supplied in reg8[30\[char46]\[char46]31] is matched against the ACL\(cqs configured tier in addition to the ACL\(cqs match\[char46] +.RS +.IP \(bu +\fBallow\fR apply-after-lb ACLs translate into logical flows that set the allow bit\[char46] If there are any stateful ACLs (including both before-lb and after-lb ACLs) on this datapath, then \fBallow\fR ACLs also run \fBct_commit; next;\fR (which acts as a hint for an upcoming table to commit the connection to conntrack)\[char46] In case the \fBACL\fR has a label then \fBreg3\fR is loaded with the label value and \fBreg0[13]\fR bit is set to 1 (which acts as a hint for the next tables to commit the label to conntrack)\[char46] +.IP \(bu +\fBallow\-related\fR apply-after-lb ACLs translate into logical flows that set the allow bit and run the \fBct_commit(ct_label=0/1); +next;\fR actions for new connections and \fBreg0[1] = 1; +next;\fR for existing connections\[char46] In case the \fBACL\fR has a label then \fBreg3\fR is loaded with the label value and \fBreg0[13]\fR bit is set to 1 (which acts as a hint for the next tables to commit the label to conntrack)\[char46] +.IP \(bu +\fBallow\-stateless\fR apply-after-lb ACLs translate into logical flows that set the allow bit and advance to the next table\[char46] +.IP \(bu +\fBreject\fR apply-after-lb ACLs translate into logical flows that set the reject bit and advance to the next table\[char46] +.IP \(bu +\fBpass\fR apply-after-lb ACLs translate into logical flows that do not set the allow, drop, or reject bit and advance to the next table\[char46] +.IP \(bu +Other apply-after-lb ACLs set the drop bit for new or untracked connections and \fBct_commit(ct_label=1/1);\fR for known connections\[char46] Setting \fBct_label\fR marks a connection as one that was previously allowed, but should no longer be allowed due to a policy change\[char46] +.RE +.RS +.IP \(bu +One priority\-65532 flow matching packets with \fBreg0[17]\fR set (either replies to existing sessions or traffic related to existing sessions) and allows these by setting the allow bit and advancing to the next table\[char46] +.RE +.RS +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 19: \fBfrom\-lport\fI ACL action after LB" +.PP +.PP +Logical flows in this table decide how to proceed based on the values of the allow, drop, and reject bits that may have been set in the previous table\[char46] +.RS +.IP \(bu +If no ACLs are configured, then a priority 0 flow is installed that matches everything and advances to the next table\[char46] +.IP \(bu +A priority 1000 flow is installed that will advance the packet to the next table if the allow bit is set\[char46] +.IP \(bu +A priority 1000 flow is installed that will run the \fBdrop;\fR action if the drop bit is set\[char46] +.IP \(bu +A priority 1000 flow is installed that will run the \fBtcp_reset +{ output <\-> inport; next(pipeline=egress,table=5);}\fR action for TCP connections,\fBicmp4/icmp6\fR action for UDP connections, and \fBsctp_abort {output <\-%gt; inport; +next(pipeline=egress,table=5);}\fR action for SCTP associations\[char46] +.IP \(bu +If any ACLs have tiers configured on them, then three priority 500 flows are installed\[char46] If the current tier counter is 0, 1, or 2, then the current tier counter is incremented by one and the packet is sent back to the previous table for re-evaluation\[char46] +.RE +.ST "Ingress Table 20: Stateful" +.RS +.IP \(bu +A priority 100 flow is added which commits the packet to the conntrack and sets the most significant 32-bits of \fBct_label\fR with the \fBreg3\fR value based on the hint provided by previous tables (with a match for \fBreg0[1] == 1 && reg0[13] == 1\fR)\[char46] This is used by the \fBACLs\fR with label to commit the label value to conntrack\[char46] +.IP \(bu +For \fBACLs\fR without label, a second priority\-100 flow commits packets to connection tracker using \fBct_commit; next;\fR action based on a hint provided by the previous tables (with a match for \fBreg0[1] == 1 && reg0[13] == 0\fR)\[char46] +.IP \(bu +A priority\-0 flow that simply moves traffic to the next table\[char46] +.RE +.ST "Ingress Table 21: ARP/ND responder" +.PP +.PP +This table implements ARP/ND responder in a logical switch for known IPs\[char46] The advantage of the ARP responder flow is to limit ARP broadcasts by locally responding to ARP requests without the need to send to other hypervisors\[char46] One common case is when the inport is a logical port associated with a VIF and the broadcast is responded to on the local hypervisor rather than broadcast across the whole network and responded to by the destination VM\[char46] This behavior is proxy ARP\[char46] +.PP +.PP +ARP requests arrive from VMs from a logical switch inport of type default\[char46] For this case, the logical switch proxy ARP rules can be for other VMs or logical router ports\[char46] Logical switch proxy ARP rules may be programmed both for mac binding of IP addresses on other logical switch VIF ports (which are of the default logical switch port type, representing connectivity to VMs or containers), and for mac binding of IP addresses on logical switch router type ports, representing their logical router port peers\[char46] In order to support proxy ARP for logical router ports, an IP address must be configured on the logical switch router type port, with the same value as the peer logical router port\[char46] The configured MAC addresses must match as well\[char46] When a VM sends an ARP request for a distributed logical router port and if the peer router type port of the attached logical switch does not have an IP address configured, the ARP request will be broadcast on the logical switch\[char46] One of the copies of the ARP request will go through the logical switch router type port to the logical router datapath, where the logical router ARP responder will generate a reply\[char46] The MAC binding of a distributed logical router, once learned by an associated VM, is used for all that VM\(cqs communication needing routing\[char46] Hence, the action of a VM re-arping for the mac binding of the logical router port should be rare\[char46] +.PP +.PP +Logical switch ARP responder proxy ARP rules can also be hit when receiving ARP requests externally on a L2 gateway port\[char46] In this case, the hypervisor acting as an L2 gateway, responds to the ARP request on behalf of a destination VM\[char46] +.PP +.PP +Note that ARP requests received from \fBlocalnet\fR logical inports can either go directly to VMs, in which case the VM responds or can hit an ARP responder for a logical router port if the packet is used to resolve a logical router port next hop address\[char46] In either case, logical switch ARP responder rules will not be hit\[char46] It contains these logical flows: +.RS +.IP \(bu +If the logical switch has no router ports with options:arp_proxy configured add a priority\-100 flows to skip the ARP responder if inport is of type \fBlocalnet\fR advances directly to the next table\[char46] ARP requests sent to \fBlocalnet\fR ports can be received by multiple hypervisors\[char46] Now, because the same mac binding rules are downloaded to all hypervisors, each of the multiple hypervisors will respond\[char46] This will confuse L2 learning on the source of the ARP requests\[char46] ARP requests received on an inport of type \fBrouter\fR are not expected to hit any logical switch ARP responder flows\[char46] However, no skip flows are installed for these packets, as there would be some additional flow cost for this and the value appears limited\[char46] +.IP \(bu +If inport \fBV\fR is of type \fBvirtual\fR adds a priority\-100 logical flows for each \fIP\fR configured in the \fBoptions:virtual-parents\fR column with the match +.IP +.nf +\fB +.br +\fB\fR\fBinport == \fIP\fB && && ((arp\[char46]op == 1 && arp\[char46]spa == \fIVIP\fB && arp\[char46]tpa == \fIVIP\fB) || (arp\[char46]op == 2 && arp\[char46]spa == \fIVIP\fB))\fB\fR +.br +\fB\fR\fBinport == \fIP\fB && && ((nd_ns && ip6\[char46]dst == \fI{VIP, NS_MULTICAST_ADDR}\fB && nd\[char46]target == \fIVIP\fB) || (nd_na && nd\[char46]target == \fIVIP\fB))\fB\fR +.br +\fB \fR +.fi +.IP +and applies the action +.IP +.nf +\fB +.br +\fB\fR\fBbind_vport(\fIV\fB, inport);\fB\fR +.br +\fB \fR +.fi +.IP +and advances the packet to the next table\[char46] +.IP +Where \fIVIP\fR is the virtual ip configured in the column \fBoptions:virtual-ip\fR and NS_MULTICAST_ADDR is solicited-node multicast address corresponding to the VIP\[char46] +.IP \(bu +Priority\-50 flows that match ARP requests to each known IP address \fIA\fR of every logical switch port, and respond with ARP replies directly with corresponding Ethernet address \fIE\fR: +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBarp\[char46]op = 2; /* ARP reply\[char46] */ +.br +\fBarp\[char46]tha = arp\[char46]sha; +.br +\fBarp\[char46]sha = \fR\fIE\fB\fR; +.br +\fBarp\[char46]tpa = arp\[char46]spa; +.br +\fBarp\[char46]spa = \fR\fIA\fB\fR; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +These flows are omitted for logical ports (other than router ports or \fBlocalport\fR ports) that are down (unless \fB +ignore_lsp_down\fR is configured as true in \fBoptions\fR column of \fBNB_Global\fR table of the \fBNorthbound\fR database), for logical ports of type \fBvirtual\fR, for logical ports with \(cqunknown\(cq address set and for logical ports of a logical switch configured with \fBother_config:vlan\-passthru=true\fR\[char46] +.IP +The above ARP responder flows are added for the list of IPv4 addresses if defined in \fBoptions:arp_proxy\fR column of \fBLogical_Switch_Port\fR table for logical switch ports of type \fBrouter\fR\[char46] +.IP \(bu +Priority\-50 flows that match IPv6 ND neighbor solicitations to each known IP address \fIA\fR (and \fIA\fR\(cqs solicited node address) of every logical switch port except of type router, and respond with neighbor advertisements directly with corresponding Ethernet address \fIE\fR: +.IP +.nf +\fB +.br +\fBnd_na { +.br +\fB eth\[char46]src = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB nd\[char46]target = \fR\fIA\fB\fR; +.br +\fB nd\[char46]tll = \fR\fIE\fB\fR; +.br +\fB outport = inport; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +Priority\-50 flows that match IPv6 ND neighbor solicitations to each known IP address \fIA\fR (and \fIA\fR\(cqs solicited node address) of logical switch port of type router, and respond with neighbor advertisements directly with corresponding Ethernet address \fIE\fR: +.IP +.nf +\fB +.br +\fBnd_na_router { +.br +\fB eth\[char46]src = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB nd\[char46]target = \fR\fIA\fB\fR; +.br +\fB nd\[char46]tll = \fR\fIE\fB\fR; +.br +\fB outport = inport; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +These flows are omitted for logical ports (other than router ports or \fBlocalport\fR ports) that are down (unless \fB +ignore_lsp_down\fR is configured as true in \fBoptions\fR column of \fBNB_Global\fR table of the \fBNorthbound\fR database), for logical ports of type \fBvirtual\fR and for logical ports with \(cqunknown\(cq address set\[char46] +.IP +The above NDP responder flows are added for the list of IPv6 addresses if defined in \fBoptions:arp_proxy\fR column of \fBLogical_Switch_Port\fR table for logical switch ports of type \fBrouter\fR\[char46] +.IP \(bu +Priority\-100 flows with match criteria like the ARP and ND flows above, except that they only match packets from the \fBinport\fR that owns the IP addresses in question, with action \fBnext;\fR\[char46] These flows prevent OVN from replying to, for example, an ARP request emitted by a VM for its own IP address\[char46] A VM only makes this kind of request to attempt to detect a duplicate IP address assignment, so sending a reply will prevent the VM from accepting the IP address that it owns\[char46] +.IP +In place of \fBnext;\fR, it would be reasonable to use \fBdrop;\fR for the flows\(cq actions\[char46] If everything is working as it is configured, then this would produce equivalent results, since no host should reply to the request\[char46] But ARPing for one\(cqs own IP address is intended to detect situations where the network is not working as configured, so dropping the request would frustrate that intent\[char46] +.IP \(bu +For each \fISVC_MON_SRC_IP\fR defined in the value of the \fBip_port_mappings:ENDPOINT_IP\fR column of \fBLoad_Balancer\fR table, priority\-110 logical flow is added with the match \fBarp\[char46]tpa == \fISVC_MON_SRC_IP\fB +&& && arp\[char46]op == 1\fR and applies the action +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBarp\[char46]op = 2; /* ARP reply\[char46] */ +.br +\fBarp\[char46]tha = arp\[char46]sha; +.br +\fBarp\[char46]sha = \fR\fIE\fB\fR; +.br +\fBarp\[char46]tpa = arp\[char46]spa; +.br +\fBarp\[char46]spa = \fR\fIA\fB\fR; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +where \fIE\fR is the service monitor source mac defined in the \fBoptions:svc_monitor_mac\fR column in the \fBNB_Global\fR table\[char46] This mac is used as the source mac in the service monitor packets for the load balancer endpoint IP health checks\[char46] +.IP +\fISVC_MON_SRC_IP\fR is used as the source ip in the service monitor IPv4 packets for the load balancer endpoint IP health checks\[char46] +.IP +These flows are required if an ARP request is sent for the IP \fISVC_MON_SRC_IP\fR\[char46] +.IP +For IPv6 the similar flow is added with the following action +.IP +.nf +\fB +.br +\fBnd_na { +.br +\fB eth\[char46]dst = eth\[char46]src; +.br +\fB eth\[char46]src = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB nd\[char46]target = \fR\fIA\fB\fR; +.br +\fB nd\[char46]tll = \fR\fIE\fB\fR; +.br +\fB outport = inport; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP \(bu +For each \fIVIP\fR configured in the table \fBForwarding_Group\fR a priority\-50 logical flow is added with the match \fBarp\[char46]tpa == \fIvip\fB && && arp\[char46]op == 1 +\fR and applies the action +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBarp\[char46]op = 2; /* ARP reply\[char46] */ +.br +\fBarp\[char46]tha = arp\[char46]sha; +.br +\fBarp\[char46]sha = \fR\fIE\fB\fR; +.br +\fBarp\[char46]tpa = arp\[char46]spa; +.br +\fBarp\[char46]spa = \fR\fIA\fB\fR; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +where \fIE\fR is the forwarding group\(cqs mac defined in the \fBvmac\fR\[char46] +.IP +\fIA\fR is used as either the destination ip for load balancing traffic to child ports or as nexthop to hosts behind the child ports\[char46] +.IP +These flows are required to respond to an ARP request if an ARP request is sent for the IP \fIvip\fR\[char46] +.IP \(bu +One priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.RE +.ST "Ingress Table 22: DHCP option processing" +.PP +.PP +This table adds the DHCPv4 options to a DHCPv4 packet from the logical ports configured with IPv4 address(es) and DHCPv4 options, and similarly for DHCPv6 options\[char46] This table also adds flows for the logical ports of type \fBexternal\fR\[char46] +.RS +.IP \(bu +A priority\-100 logical flow is added for these logical ports which matches the IPv4 packet with \fBudp\[char46]src\fR = 68 and \fBudp\[char46]dst\fR = 67 and applies the action \fBput_dhcp_opts\fR and advances the packet to the next table\[char46] +.IP +.nf +\fB +.br +\fBreg0[3] = put_dhcp_opts(offer_ip = \fR\fIip\fB\fR, \fR\fIoptions\fB\fR\[char46]\[char46]\[char46]); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +For DHCPDISCOVER and DHCPREQUEST, this transforms the packet into a DHCP reply, adds the DHCP offer IP \fIip\fR and options to the packet, and stores 1 into reg0[3]\[char46] For other kinds of packets, it just stores 0 into reg0[3]\[char46] Either way, it continues to the next table\[char46] +.IP \(bu +A priority\-100 logical flow is added for these logical ports which matches the IPv6 packet with \fBudp\[char46]src\fR = 546 and \fBudp\[char46]dst\fR = 547 and applies the action \fBput_dhcpv6_opts\fR and advances the packet to the next table\[char46] +.IP +.nf +\fB +.br +\fBreg0[3] = put_dhcpv6_opts(ia_addr = \fR\fIip\fB\fR, \fR\fIoptions\fB\fR\[char46]\[char46]\[char46]); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +For DHCPv6 Solicit/Request/Confirm packets, this transforms the packet into a DHCPv6 Advertise/Reply, adds the DHCPv6 offer IP \fIip\fR and options to the packet, and stores 1 into reg0[3]\[char46] For other kinds of packets, it just stores 0 into reg0[3]\[char46] Either way, it continues to the next table\[char46] +.IP \(bu +A priority\-0 flow that matches all packets to advances to table 16\[char46] +.RE +.ST "Ingress Table 23: DHCP responses" +.PP +.PP +This table implements DHCP responder for the DHCP replies generated by the previous table\[char46] +.RS +.IP \(bu +A priority 100 logical flow is added for the logical ports configured with DHCPv4 options which matches IPv4 packets with \fBudp\[char46]src == 68 +&& udp\[char46]dst == 67 && reg0[3] == 1\fR and responds back to the \fBinport\fR after applying these actions\[char46] If \fBreg0[3]\fR is set to 1, it means that the action \fBput_dhcp_opts\fR was successful\[char46] +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBip4\[char46]src = \fR\fIS\fB\fR; +.br +\fBudp\[char46]src = 67; +.br +\fBudp\[char46]dst = 68; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +where \fIE\fR is the server MAC address and \fIS\fR is the server IPv4 address defined in the DHCPv4 options\[char46] Note that \fBip4\[char46]dst\fR field is handled by \fBput_dhcp_opts\fR\[char46] +.IP +(This terminates ingress packet processing; the packet does not go to the next ingress table\[char46]) +.IP \(bu +A priority 100 logical flow is added for the logical ports configured with DHCPv6 options which matches IPv6 packets with \fBudp\[char46]src == 546 +&& udp\[char46]dst == 547 && reg0[3] == 1\fR and responds back to the \fBinport\fR after applying these actions\[char46] If \fBreg0[3]\fR is set to 1, it means that the action \fBput_dhcpv6_opts\fR was successful\[char46] +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBip6\[char46]dst = \fR\fIA\fB\fR; +.br +\fBip6\[char46]src = \fR\fIS\fB\fR; +.br +\fBudp\[char46]src = 547; +.br +\fBudp\[char46]dst = 546; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +where \fIE\fR is the server MAC address and \fIS\fR is the server IPv6 LLA address generated from the \fBserver_id\fR defined in the DHCPv6 options and \fIA\fR is the IPv6 address defined in the logical port\(cqs addresses column\[char46] +.IP +(This terminates packet processing; the packet does not go on the next ingress table\[char46]) +.IP \(bu +A priority\-0 flow that matches all packets to advances to table 17\[char46] +.RE +.ST "Ingress Table 24 DNS Lookup" +.PP +.PP +This table looks up and resolves the DNS names to the corresponding configured IP address(es)\[char46] +.RS +.IP \(bu +A priority\-100 logical flow for each logical switch datapath if it is configured with DNS records, which matches the IPv4 and IPv6 packets with \fBudp\[char46]dst\fR = 53 and applies the action \fBdns_lookup\fR and advances the packet to the next table\[char46] +.IP +.nf +\fB +.br +\fBreg0[4] = dns_lookup(); next; +.br +\fB \fR +.fi +.IP +For valid DNS packets, this transforms the packet into a DNS reply if the DNS name can be resolved, and stores 1 into reg0[4]\[char46] For failed DNS resolution or other kinds of packets, it just stores 0 into reg0[4]\[char46] Either way, it continues to the next table\[char46] +.RE +.ST "Ingress Table 25 DNS Responses" +.PP +.PP +This table implements DNS responder for the DNS replies generated by the previous table\[char46] +.RS +.IP \(bu +A priority\-100 logical flow for each logical switch datapath if it is configured with DNS records, which matches the IPv4 and IPv6 packets with \fBudp\[char46]dst = 53 && reg0[4] == 1\fR and responds back to the \fBinport\fR after applying these actions\[char46] If \fBreg0[4]\fR is set to 1, it means that the action \fBdns_lookup\fR was successful\[char46] +.IP +.nf +\fB +.br +\fBeth\[char46]dst <\-> eth\[char46]src; +.br +\fBip4\[char46]src <\-> ip4\[char46]dst; +.br +\fBudp\[char46]dst = udp\[char46]src; +.br +\fBudp\[char46]src = 53; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +(This terminates ingress packet processing; the packet does not go to the next ingress table\[char46]) +.RE +.ST "Ingress table 26 External ports" +.PP +.PP +Traffic from the \fBexternal\fR logical ports enter the ingress datapath pipeline via the \fBlocalnet\fR port\[char46] This table adds the below logical flows to handle the traffic from these ports\[char46] +.RS +.IP \(bu +A priority\-100 flow is added for each \fBexternal\fR logical port which doesn\(cqt reside on a chassis to drop the ARP/IPv6 NS request to the router IP(s) (of the logical switch) which matches on the \fBinport\fR of the \fBexternal\fR logical port and the valid \fBeth\[char46]src\fR address(es) of the \fBexternal\fR logical port\[char46] +.IP +This flow guarantees that the ARP/NS request to the router IP address from the external ports is responded by only the chassis which has claimed these external ports\[char46] All the other chassis, drops these packets\[char46] +.IP +A priority\-100 flow is added for each \fBexternal\fR logical port which doesn\(cqt reside on a chassis to drop any packet destined to the router mac - with the match \fBinport == \fIexternal\fB && +eth\[char46]src == \fIE\fB && eth\[char46]dst == \fIR\fB +&& !is_chassis_resident(\(dq\fIexternal\fB\(dq)\fR where \fIE\fR is the external port mac and \fIR\fR is the router port mac\[char46] +.IP \(bu +A priority\-0 flow that matches all packets to advances to table 20\[char46] +.RE +.ST "Ingress Table 27 Destination Lookup" +.PP +.PP +This table implements switching behavior\[char46] It contains these logical flows: +.RS +.IP \(bu +A priority\-110 flow with the match \fBeth\[char46]src == \fIE\fB\fR for all logical switch datapaths and applies the action \fBhandle_svc_check(inport)\fR\[char46] Where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.IP \(bu +A priority\-100 flow that punts all IGMP/MLD packets to \fBovn\-controller\fR if multicast snooping is enabled on the logical switch\[char46] +.IP \(bu +Priority\-90 flows that forward registered IP multicast traffic to their corresponding multicast group, which \fBovn\-northd\fR creates based on learnt \fBIGMP_Group\fR entries\[char46] The flows also forward packets to the \fBMC_MROUTER_FLOOD\fR multicast group, which \fBovn\-nortdh\fR populates with all the logical ports that are connected to logical routers with \fBoptions\fR:mcast_relay=\(cqtrue\(cq\[char46] +.IP \(bu +A priority\-85 flow that forwards all IP multicast traffic destined to 224\[char46]0\[char46]0\[char46]X to the \fBMC_FLOOD_L2\fR multicast group, which \fBovn\-northd\fR populates with all non-router logical ports\[char46] +.IP \(bu +A priority\-85 flow that forwards all IP multicast traffic destined to reserved multicast IPv6 addresses (RFC 4291, 2\[char46]7\[char46]1, e\[char46]g\[char46], Solicited-Node multicast) to the \fBMC_FLOOD\fR multicast group, which \fBovn\-northd\fR populates with all enabled logical ports\[char46] +.IP \(bu +A priority\-80 flow that forwards all unregistered IP multicast traffic to the \fBMC_STATIC\fR multicast group, which \fBovn\-northd\fR populates with all the logical ports that have \fBoptions\fR \fB:mcast_flood=\(cqtrue\(cq\fR\[char46] The flow also forwards unregistered IP multicast traffic to the \fBMC_MROUTER_FLOOD\fR multicast group, which \fBovn\-northd\fR populates with all the logical ports connected to logical routers that have \fBoptions\fR \fB:mcast_relay=\(cqtrue\(cq\fR\[char46] +.IP \(bu +A priority\-80 flow that drops all unregistered IP multicast traffic if \fBother_config\fR \fB:mcast_snoop=\(cqtrue\(cq\fR and \fBother_config\fR \fB:mcast_flood_unregistered=\(cqfalse\(cq\fR and the switch is not connected to a logical router that has \fBoptions\fR \fB:mcast_relay=\(cqtrue\(cq\fR and the switch doesn\(cqt have any logical port with \fBoptions\fR \fB:mcast_flood=\(cqtrue\(cq\fR\[char46] +.IP \(bu +Priority\-80 flows for each IP address/VIP/NAT address owned by a router port connected to the switch\[char46] These flows match ARP requests and ND packets for the specific IP addresses\[char46] Matched packets are forwarded only to the router that owns the IP address and to the \fBMC_FLOOD_L2\fR multicast group which contains all non-router logical ports\[char46] +.IP \(bu +Priority\-75 flows for each port connected to a logical router matching self originated ARP request/RARP request/ND packets\[char46] These packets are flooded to the \fBMC_FLOOD_L2\fR which contains all non-router logical ports\[char46] +.IP \(bu +A priority\-72 flow that outputs all ARP requests and ND packets with an Ethernet broadcast or multicast \fBeth\[char46]dst\fR to the \fBMC_FLOOD_L2\fR multicast group if \fBother_config:broadcast\-arps\-to\-all\-routers=true\fR\[char46] +.IP \(bu +A priority\-70 flow that outputs all packets with an Ethernet broadcast or multicast \fBeth\[char46]dst\fR to the \fBMC_FLOOD\fR multicast group\[char46] +.IP \(bu +One priority\-50 flow that matches each known Ethernet address against \fBeth\[char46]dst\fR\[char46] Action of this flow outputs the packet to the single associated output port if it is enabled\[char46] \fBdrop;\fR action is applied if LSP is disabled\[char46] +.IP +For the Ethernet address on a logical switch port of type \fBrouter\fR, when that logical switch port\(cqs \fBaddresses\fR column is set to \fBrouter\fR and the connected logical router port has a gateway chassis: +.RS +.IP \(bu +The flow for the connected logical router port\(cqs Ethernet address is only programmed on the gateway chassis\[char46] +.IP \(bu +If the logical router has rules specified in \fBnat\fR with \fBexternal_mac\fR, then those addresses are also used to populate the switch\(cqs destination lookup on the chassis where \fBlogical_port\fR is resident\[char46] +.RE +.IP +For the Ethernet address on a logical switch port of type \fBrouter\fR, when that logical switch port\(cqs \fBaddresses\fR column is set to \fBrouter\fR and the connected logical router port specifies a \fBreside\-on\-redirect\-chassis\fR and the logical router to which the connected logical router port belongs to has a distributed gateway LRP: +.RS +.IP \(bu +The flow for the connected logical router port\(cqs Ethernet address is only programmed on the gateway chassis\[char46] +.RE +.IP +For each forwarding group configured on the logical switch datapath, a priority\-50 flow that matches on \fBeth\[char46]dst == \fIVIP\fB +\fR with an action of \fBfwd_group(childports=\fIargs +\fB)\fR, where \fIargs\fR contains comma separated logical switch child ports to load balance to\[char46] If \fBliveness\fR is enabled, then action also includes \fB liveness=true\fR\[char46] +.IP \(bu +One priority\-0 fallback flow that matches all packets with the action \fBoutport = get_fdb(eth\[char46]dst); next;\fR\[char46] The action \fBget_fdb\fR gets the port for the \fBeth\[char46]dst\fR in the MAC learning table of the logical switch datapath\[char46] If there is no entry for \fBeth\[char46]dst\fR in the MAC learning table, then it stores \fBnone\fR in the \fBoutport\fR\[char46] +.RE +.ST "Ingress Table 28 Destination unknown" +.PP +.PP +This table handles the packets whose destination was not found or and looked up in the MAC learning table of the logical switch datapath\[char46] It contains the following flows\[char46] +.RS +.IP \(bu +Priority 50 flow with the match \fBoutport == \fIP\fB\fR is added for each disabled Logical Switch Port \fBP\fR\[char46] This flow has action \fBdrop;\fR\[char46] +.IP \(bu +If the logical switch has logical ports with \(cqunknown\(cq addresses set, then the below logical flow is added +.RS +.IP \(bu +Priority 50 flow with the match \fBoutport == \(dqnone\(dq\fR then outputs them to the \fBMC_UNKNOWN\fR multicast group, which \fBovn\-northd\fR populates with all enabled logical ports that accept unknown destination packets\[char46] As a small optimization, if no logical ports accept unknown destination packets, \fBovn\-northd\fR omits this multicast group and logical flow\[char46] +.RE +.IP +If the logical switch has no logical ports with \(cqunknown\(cq address set, then the below logical flow is added +.RS +.IP \(bu +Priority 50 flow with the match \fBoutport == none\fR and drops the packets\[char46] +.RE +.IP \(bu +One priority\-0 fallback flow that outputs the packet to the egress stage with the outport learnt from \fBget_fdb\fR action\[char46] +.RE +.ST "Egress Table 0: \fBto\-lport\fI Pre-ACLs" +.PP +.PP +This is similar to ingress table \fBPre\-ACLs\fR except for \fBto\-lport\fR traffic\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBeth\[char46]src == \fIE\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBoutport == \fII\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fII\fR is the peer of a logical router port\[char46] This flow is added to skip the connection tracking of packets which will be entering logical router datapath from logical switch datapath for routing\[char46] +.ST "Egress Table 1: Pre-LB" +.PP +.PP +This table is similar to ingress table \fBPre\-LB\fR\[char46] It contains a priority\-0 flow that simply moves traffic to the next table\[char46] Moreover it contains two priority\-110 flows to move multicast, IPv6 Neighbor Discovery and MLD traffic to the next table\[char46] If any load balancing rules exist for the datapath, a priority\-100 flow is added with a match of \fBip\fR and action of \fBreg0[2] = 1; next;\fR to act as a hint for table \fBPre\-stateful\fR to send IP packets to the connection tracker for packet de-fragmentation and possibly DNAT the destination VIP to one of the selected backend for already committed load balanced traffic\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBeth\[char46]src == \fIE\fB\fR for all logical switch datapaths to move traffic to the next table\[char46] Where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] +.PP +.PP +This table also has a priority\-110 flow with the match \fBoutport == \fII\fB\fR for all logical switch datapaths to move traffic to the next table, and, if there are no stateful_acl, clear the ct_state\[char46] Where \fII\fR is the peer of a logical router port\[char46] This flow is added to skip the connection tracking of packets which will be entering logical router datapath from logical switch datapath for routing\[char46] +.ST "Egress Table 2: Pre-stateful" +.PP +.PP +This is similar to ingress table \fBPre\-stateful\fR\[char46] This table adds the below 3 logical flows\[char46] +.RS +.IP \(bu +A Priority\-120 flow that send the packets to connection tracker using \fBct_lb_mark;\fR as the action so that the already established traffic gets unDNATted from the backend IP to the load balancer VIP based on a hint provided by the previous tables with a match for \fBreg0[2] == 1\fR\[char46] If the packet was not DNATted earlier, then \fBct_lb_mark\fR functions like \fBct_next\fR\[char46] +.IP \(bu +A priority\-100 flow sends the packets to connection tracker based on a hint provided by the previous tables (with a match for \fBreg0[0] == 1\fR) by using the \fBct_next;\fR action\[char46] +.IP \(bu +A priority\-0 flow that matches all packets to advance to the next table\[char46] +.RE +.ST "Egress Table 3: \fBfrom\-lport\fI ACL hints" +.PP +.PP +This is similar to ingress table \fBACL hints\fR\[char46] +.ST "Egress Table 4: \fBto\-lport\fI ACL evaluation" +.PP +.PP +This is similar to ingress table \fBACL eval\fR except for \fBto\-lport\fR ACLs\[char46] As a reminder, these flows use the following register bits to indicate their verdicts\[char46] \fBAllow\-type\fR ACLs set \fBreg8[16]\fR, \fBdrop\fR ACLs set \fBreg8[17]\fR, and \fBreject\fR ACLs set \fBreg8[18]\fR\[char46] +.PP +.PP +Also like with ingress ACLs, egress ACLs can have a configured \fBtier\fR\[char46] If a tier is configured, then the current tier counter is evaluated against the ACL\(cqs configured tier in addition to the ACL\(cqs match\[char46] The current tier counter is stored in \fBreg8[30\[char46]\[char46]31]\fR\[char46] +.PP +.PP +Similar to ingress table, a priority\-65532 flow is added to allow IPv6 Neighbor solicitation, Neighbor discover, Router solicitation, Router advertisement and MLD packets regardless of other ACLs defined\[char46] +.PP +.PP +In addition, the following flows are added\[char46] +.RS +.IP \(bu +A priority 34000 logical flow is added for each logical port which has DHCPv4 options defined to allow the DHCPv4 reply packet and which has DHCPv6 options defined to allow the DHCPv6 reply packet from the \fBIngress Table 18: DHCP responses\fR\[char46] This is indicated by setting the allow bit\[char46] +.IP \(bu +A priority 34000 logical flow is added for each logical switch datapath configured with DNS records with the match \fBudp\[char46]dst = 53\fR to allow the DNS reply packet from the \fBIngress Table 20: DNS responses\fR\[char46] This is indicated by setting the allow bit\[char46] +.IP \(bu +A priority 34000 logical flow is added for each logical switch datapath with the match \fBeth\[char46]src = \fIE\fB\fR to allow the service monitor request packet generated by \fBovn\-controller\fR with the action \fBnext\fR, where \fIE\fR is the service monitor mac defined in the \fBoptions:svc_monitor_mac\fR column of \fBNB_Global\fR table\[char46] This is indicated by setting the allow bit\[char46] +.RE +.ST "Egress Table 5: \fBto\-lport\fI ACL action" +.PP +.PP +This is similar to ingress table \fBACL action\fR\[char46] +.ST "Egress Table 6: \fBto\-lport\fI QoS Marking" +.PP +.PP +This is similar to ingress table \fBQoS marking\fR except they apply to \fBto\-lport\fR QoS rules\[char46] +.ST "Egress Table 7: \fBto\-lport\fI QoS Meter" +.PP +.PP +This is similar to ingress table \fBQoS meter\fR except they apply to \fBto\-lport\fR QoS rules\[char46] +.ST "Egress Table 8: Stateful" +.PP +.PP +This is similar to ingress table \fBStateful\fR except that there are no rules added for load balancing new connections\[char46] +.ST "Egress Table 9: Egress Port Security - check" +.PP +.PP +This is similar to the port security logic in table \fBIngress Port Security check\fR except that action \fBcheck_out_port_sec\fR is used to check the port security rules\[char46] This table adds the below logical flows\[char46] +.RS +.IP \(bu +A priority 100 flow which matches on the multicast traffic and applies the action \fBREGBIT_PORT_SEC_DROP\(dq = 0; next;\(dq\fR to skip the out port security checks\[char46] +.IP \(bu +A priority 0 logical flow is added which matches on all the packets and applies the action \fBREGBIT_PORT_SEC_DROP\(dq = check_out_port_sec(); next;\(dq\fR\[char46] The action \fBcheck_out_port_sec\fR applies the port security rules based on the addresses defined in the \fBport_security\fR column of \fBLogical_Switch_Port\fR table before delivering the packet to the \fBoutport\fR\[char46] +.RE +.ST "Egress Table 10: Egress Port Security - Apply" +.PP +.PP +This is similar to the ingress port security logic in ingress table \fBA Ingress Port Security \- Apply\fR\[char46] This table drops the packets if the port security check failed in the previous stage i\[char46]e the register bit \fBREGBIT_PORT_SEC_DROP\fR is set to 1\[char46] +.PP +.PP +The following flows are added\[char46] +.RS +.IP \(bu +For each port configured with egress qos in the \fBoptions:qdisc_queue_id\fR column of \fBLogical_Switch_Port\fR, running a localnet port on the same logical switch, a priority 110 flow is added which matches on the localnet \fBoutport\fR and on the port \fBinport\fR and applies the action \fBset_queue(id); output;\(dq\fR\[char46] +.IP \(bu +For each localnet port configured with egress qos in the \fBoptions:qdisc_queue_id\fR column of \fBLogical_Switch_Port\fR, a priority 100 flow is added which matches on the localnet \fBoutport\fR and applies the action \fBset_queue(id); output;\(dq\fR\[char46] +.IP +Please remember to mark the corresponding physical interface with \fBovn\-egress\-iface\fR set to true in \fBexternal_ids\fR\[char46] +.IP \(bu +A priority\-50 flow that drops the packet if the register bit \fBREGBIT_PORT_SEC_DROP\fR is set to 1\[char46] +.IP \(bu +A priority\-0 flow that outputs the packet to the \fBoutport\fR\[char46] +.RE +.SS "Logical Router Datapaths" +.PP +.PP +Logical router datapaths will only exist for \fBLogical_Router\fR rows in the \fBOVN_Northbound\fR database that do not have \fBenabled\fR set to \fBfalse\fR +.ST "Ingress Table 0: L2 Admission Control" +.PP +.PP +This table drops packets that the router shouldn\(cqt see at all based on their Ethernet headers\[char46] It contains the following flows: +.RS +.IP \(bu +Priority\-100 flows to drop packets with VLAN tags or multicast Ethernet source addresses\[char46] +.IP \(bu +For each enabled router port \fIP\fR with Ethernet address \fIE\fR, a priority\-50 flow that matches \fBinport == +\fIP\fB && (eth\[char46]mcast || eth\[char46]dst == +\fIE\fB\fR), stores the router port ethernet address and advances to next table, with action \fBxreg0[0\[char46]\[char46]47]=E; next;\fR\[char46] +.IP +For the gateway port on a distributed logical router (where one of the logical router ports specifies a gateway chassis), the above flow matching \fBeth\[char46]dst == \fIE\fB\fR is only programmed on the gateway port instance on the gateway chassis\[char46] If LRP\(cqs logical switch has attached LSP of \fBvtep\fR type, the \fBis_chassis_resident()\fR part is not added to lflow to allow traffic originated from logical switch to reach LR services (LBs, NAT)\[char46] +.IP +For a distributed logical router or for gateway router where the port is configured with \fBoptions:gateway_mtu\fR the action of the above flow is modified adding \fBcheck_pkt_larger\fR in order to mark the packet setting \fBREGBIT_PKT_LARGER\fR if the size is greater than the MTU\[char46] If the port is also configured with \fBoptions:gateway_mtu_bypass\fR then another flow is added, with priority\-55, to bypass the \fBcheck_pkt_larger\fR flow\[char46] This is useful for traffic that normally doesn\(cqt need to be fragmented and for which check_pkt_larger, which might not be offloadable, is not really needed\[char46] One such example is TCP traffic\[char46] +.IP \(bu +For each \fBdnat_and_snat\fR NAT rule on a distributed router that specifies an external Ethernet address \fIE\fR, a priority\-50 flow that matches \fBinport == \fIGW\fB +&& eth\[char46]dst == \fIE\fB\fR, where \fIGW\fR is the logical router distributed gateway port corresponding to the NAT rule (specified or inferred), with action \fBxreg0[0\[char46]\[char46]47]=E; next;\fR\[char46] +.IP +This flow is only programmed on the gateway port instance on the chassis where the \fBlogical_port\fR specified in the NAT rule resides\[char46] +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.PP +.PP +Other packets are implicitly dropped\[char46] +.ST "Ingress Table 1: Neighbor lookup" +.PP +.PP +For ARP and IPv6 Neighbor Discovery packets, this table looks into the \fBMAC_Binding\fR records to determine if OVN needs to learn the mac bindings\[char46] Following flows are added: +.RS +.IP \(bu +For each router port \fIP\fR that owns IP address \fIA\fR, which belongs to subnet \fIS\fR with prefix length \fIL\fR, if the option \fBalways_learn_from_arp_request\fR is \fBtrue\fR for this router, a priority\-100 flow is added which matches \fBinport == \fIP\fB && arp\[char46]spa == +\fIS\fB/\fIL\fB && arp\[char46]op == 1\fR (ARP request) with the following actions: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +If the option \fBalways_learn_from_arp_request\fR is \fBfalse\fR, the following two flows are added\[char46] +.IP +A priority\-110 flow is added which matches \fBinport == +\fIP\fB && arp\[char46]spa == \fIS\fB/\fIL\fB +&& arp\[char46]tpa == \fIA\fB && arp\[char46]op == 1\fR (ARP request) with the following actions: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +.br +\fBreg9[3] = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP +A priority\-100 flow is added which matches \fBinport == +\fIP\fB && arp\[char46]spa == \fIS\fB/\fIL\fB +&& arp\[char46]op == 1\fR (ARP request) with the following actions: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +.br +\fBreg9[3] = lookup_arp_ip(inport, arp\[char46]spa); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +If the logical router port \fIP\fR is a distributed gateway router port, additional match \fBis_chassis_resident(cr\-\fIP\fB)\fR is added for all these flows\[char46] +.IP \(bu +A priority\-100 flow which matches on ARP reply packets and applies the actions if the option \fBalways_learn_from_arp_request\fR is \fBtrue\fR: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +If the option \fBalways_learn_from_arp_request\fR is \fBfalse\fR, the above actions will be: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +.br +\fBreg9[3] = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP \(bu +A priority\-100 flow which matches on IPv6 Neighbor Discovery advertisement packet and applies the actions if the option \fBalways_learn_from_arp_request\fR is \fBtrue\fR: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_nd(inport, nd\[char46]target, nd\[char46]tll); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +If the option \fBalways_learn_from_arp_request\fR is \fBfalse\fR, the above actions will be: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_nd(inport, nd\[char46]target, nd\[char46]tll); +.br +\fBreg9[3] = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP \(bu +A priority\-100 flow which matches on IPv6 Neighbor Discovery solicitation packet and applies the actions if the option \fBalways_learn_from_arp_request\fR is \fBtrue\fR: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_nd(inport, ip6\[char46]src, nd\[char46]sll); +.br +\fBnext; +.br +\fB \fR +.fi +.IP +If the option \fBalways_learn_from_arp_request\fR is \fBfalse\fR, the above actions will be: +.IP +.nf +\fB +.br +\fBreg9[2] = lookup_nd(inport, ip6\[char46]src, nd\[char46]sll); +.br +\fBreg9[3] = lookup_nd_ip(inport, ip6\[char46]src); +.br +\fBnext; +.br +\fB \fR +.fi +.IP \(bu +A priority\-0 fallback flow that matches all packets and applies the action \fBreg9[2] = 1; next;\fR advancing the packet to the next table\[char46] +.RE +.ST "Ingress Table 2: Neighbor learning" +.PP +.PP +This table adds flows to learn the mac bindings from the ARP and IPv6 Neighbor Solicitation/Advertisement packets if it is needed according to the lookup results from the previous stage\[char46] +.PP +.PP +reg9[2] will be \fB1\fR if the \fBlookup_arp/lookup_nd\fR in the previous table was successful or skipped, meaning no need to learn mac binding from the packet\[char46] +.PP +.PP +reg9[3] will be \fB1\fR if the \fBlookup_arp_ip/lookup_nd_ip\fR in the previous table was successful or skipped, meaning it is ok to learn mac binding from the packet (if reg9[2] is 0)\[char46] +.RS +.IP \(bu +A priority\-100 flow with the match \fBreg9[2] == 1 || reg9[3] == +0\fR and advances the packet to the next table as there is no need to learn the neighbor\[char46] +.IP \(bu +A priority\-95 flow with the match \fBnd_ns && +(ip6\[char46]src == 0 || nd\[char46]sll == 0)\fR and applies the action \fBnext;\fR +.IP \(bu +A priority\-90 flow with the match \fBarp\fR and applies the action \fBput_arp(inport, arp\[char46]spa, arp\[char46]sha); next;\fR +.IP \(bu +A priority\-95 flow with the match \fBnd_na && +nd\[char46]tll == 0\fR and applies the action \fBput_nd(inport, nd\[char46]target, eth\[char46]src); next;\fR +.IP \(bu +A priority\-90 flow with the match \fBnd_na\fR and applies the action \fBput_nd(inport, nd\[char46]target, nd\[char46]tll); next;\fR +.IP \(bu +A priority\-90 flow with the match \fBnd_ns\fR and applies the action \fBput_nd(inport, ip6\[char46]src, nd\[char46]sll); next;\fR +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.ST "Ingress Table 3: IP Input" +.PP +.PP +This table is the core of the logical router datapath functionality\[char46] It contains the following flows to implement very basic IP host functionality\[char46] +.RS +.IP \(bu +For each \fBdnat_and_snat\fR NAT rule on a distributed logical routers or gateway routers with gateway port configured with \fBoptions:gateway_mtu\fR to a valid integer value \fIM\fR, a priority\-160 flow with the match \fBinport == \fILRP\fB && REGBIT_PKT_LARGER +&& REGBIT_EGRESS_LOOPBACK == 0\fR, where \fILRP\fR is the logical router port and applies the following action for ipv4 and ipv6 respectively: +.IP +.nf +\fB +.br +\fBicmp4_error { +.br +\fB icmp4\[char46]type = 3; /* Destination Unreachable\[char46] */ +.br +\fB icmp4\[char46]code = 4; /* Frag Needed and DF was Set\[char46] */ +.br +\fB icmp4\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = eth\[char46]src; +.br +\fB eth\[char46]src = \fR\fIE\fB\fR; +.br +\fB ip4\[char46]dst = ip4\[char46]src; +.br +\fB ip4\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER 0; +.br +\fB outport = \fR\fILRP\fB\fR; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB +.br +\fBicmp6_error { +.br +\fB icmp6\[char46]type = 2; +.br +\fB icmp6\[char46]code = 0; +.br +\fB icmp6\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = eth\[char46]src; +.br +\fB eth\[char46]src = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]dst = ip6\[char46]src; +.br +\fB ip6\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER 0; +.br +\fB outport = \fR\fILRP\fB\fR; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +where \fIE\fR and \fII\fR are the NAT rule external mac and IP respectively\[char46] +.IP \(bu +For distributed logical routers or gateway routers with gateway port configured with \fBoptions:gateway_mtu\fR to a valid integer value, a priority\-150 flow with the match \fBinport == +\fILRP\fB && REGBIT_PKT_LARGER && +REGBIT_EGRESS_LOOPBACK == 0\fR, where \fILRP\fR is the logical router port and applies the following action for ipv4 and ipv6 respectively: +.IP +.nf +\fB +.br +\fBicmp4_error { +.br +\fB icmp4\[char46]type = 3; /* Destination Unreachable\[char46] */ +.br +\fB icmp4\[char46]code = 4; /* Frag Needed and DF was Set\[char46] */ +.br +\fB icmp4\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = \fR\fIE\fB\fR; +.br +\fB ip4\[char46]dst = ip4\[char46]src; +.br +\fB ip4\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER 0; +.br +\fB next(pipeline=ingress, table=0); +.br +\fB}; +.br +\fB +.br +\fBicmp6_error { +.br +\fB icmp6\[char46]type = 2; +.br +\fB icmp6\[char46]code = 0; +.br +\fB icmp6\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]dst = ip6\[char46]src; +.br +\fB ip6\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER 0; +.br +\fB next(pipeline=ingress, table=0); +.br +\fB}; +.br +\fB \fR +.fi +.IP \(bu +For each NAT entry of a distributed logical router (with distributed gateway router port(s)) of type \fBsnat\fR, a priority\-120 flow with the match \fBinport == \fIP\fB +&& ip4\[char46]src == \fIA\fB\fR advances the packet to the next pipeline, where \fIP\fR is the distributed logical router port corresponding to the NAT entry (specified or inferred) and \fIA\fR is the \fBexternal_ip\fR set in the NAT entry\[char46] If \fIA\fR is an IPv6 address, then \fBip6\[char46]src\fR is used for the match\[char46] +.IP +The above flow is required to handle the routing of the East/west NAT traffic\[char46] +.IP \(bu +For each BFD port the two following priority\-110 flows are added to manage BFD traffic: +.RS +.IP \(bu +if \fBip4\[char46]src\fR or \fBip6\[char46]src\fR is any IP address owned by the router port and \fBudp\[char46]dst == 3784 +\fR, the packet is advanced to the next pipeline stage\[char46] +.IP \(bu +if \fBip4\[char46]dst\fR or \fBip6\[char46]dst\fR is any IP address owned by the router port and \fBudp\[char46]dst == 3784 +\fR, the \fBhandle_bfd_msg\fR action is executed\[char46] +.RE +.IP \(bu +L3 admission control: Priority\-120 flows allows IGMP and MLD packets if the router has logical ports that have \fBoptions\fR \fB:mcast_flood=\(cqtrue\(cq\fR\[char46] +.IP \(bu +L3 admission control: A priority\-100 flow drops packets that match any of the following: +.RS +.IP \(bu +\fBip4\[char46]src[28\[char46]\[char46]31] == 0xe\fR (multicast source) +.IP \(bu +\fBip4\[char46]src == 255\[char46]255\[char46]255\[char46]255\fR (broadcast source) +.IP \(bu +\fBip4\[char46]src == 127\[char46]0\[char46]0\[char46]0/8 || ip4\[char46]dst == 127\[char46]0\[char46]0\[char46]0/8\fR (localhost source or destination) +.IP \(bu +\fBip4\[char46]src == 0\[char46]0\[char46]0\[char46]0/8 || ip4\[char46]dst == 0\[char46]0\[char46]0\[char46]0/8\fR (zero network source or destination) +.IP \(bu +\fBip4\[char46]src\fR or \fBip6\[char46]src\fR is any IP address owned by the router, unless the packet was recirculated due to egress loopback as indicated by \fBREGBIT_EGRESS_LOOPBACK\fR\[char46] +.IP \(bu +\fBip4\[char46]src\fR is the broadcast address of any IP network known to the router\[char46] +.RE +.IP \(bu +A priority\-100 flow parses DHCPv6 replies from IPv6 prefix delegation routers (\fBudp\[char46]src == 547 && +udp\[char46]dst == 546\fR)\[char46] The \fBhandle_dhcpv6_reply\fR is used to send IPv6 prefix delegation messages to the delegation router\[char46] +.IP \(bu +ICMP echo reply\[char46] These flows reply to ICMP echo requests received for the router\(cqs IP address\[char46] Let \fIA\fR be an IP address owned by a router port\[char46] Then, for each \fIA\fR that is an IPv4 address, a priority\-90 flow matches on \fBip4\[char46]dst == \fIA\fB\fR and \fBicmp4\[char46]type == 8 && icmp4\[char46]code == 0\fR (ICMP echo request)\[char46] For each \fIA\fR that is an IPv6 address, a priority\-90 flow matches on \fBip6\[char46]dst == \fIA\fB\fR and \fBicmp6\[char46]type == 128 && icmp6\[char46]code == 0\fR (ICMPv6 echo request)\[char46] The port of the router that receives the echo request does not matter\[char46] Also, the \fBip\[char46]ttl\fR of the echo request packet is not checked, so it complies with RFC 1812, section 4\[char46]2\[char46]2\[char46]9\[char46] Flows for ICMPv4 echo requests use the following actions: +.IP +.nf +\fB +.br +\fBip4\[char46]dst <\-> ip4\[char46]src; +.br +\fBip\[char46]ttl = 255; +.br +\fBicmp4\[char46]type = 0; +.br +\fBflags\[char46]loopback = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP +Flows for ICMPv6 echo requests use the following actions: +.IP +.nf +\fB +.br +\fBip6\[char46]dst <\-> ip6\[char46]src; +.br +\fBip\[char46]ttl = 255; +.br +\fBicmp6\[char46]type = 129; +.br +\fBflags\[char46]loopback = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP \(bu +Reply to ARP requests\[char46] +.IP +These flows reply to ARP requests for the router\(cqs own IP address\[char46] The ARP requests are handled only if the requestor\(cqs IP belongs to the same subnets of the logical router port\[char46] For each router port \fIP\fR that owns IP address \fIA\fR, which belongs to subnet \fIS\fR with prefix length \fIL\fR, and Ethernet address \fIE\fR, a priority\-90 flow matches \fBinport == \fIP\fB && +arp\[char46]spa == \fIS\fB/\fIL\fB && arp\[char46]op == 1 +&& arp\[char46]tpa == \fIA\fB\fR (ARP request) with the following actions: +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = xreg0[0\[char46]\[char46]47]; +.br +\fBarp\[char46]op = 2; /* ARP reply\[char46] */ +.br +\fBarp\[char46]tha = arp\[char46]sha; +.br +\fBarp\[char46]sha = xreg0[0\[char46]\[char46]47]; +.br +\fBarp\[char46]tpa = arp\[char46]spa; +.br +\fBarp\[char46]spa = \fR\fIA\fB\fR; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +For the gateway port on a distributed logical router (where one of the logical router ports specifies a gateway chassis), the above flows are only programmed on the gateway port instance on the gateway chassis\[char46] This behavior avoids generation of multiple ARP responses from different chassis, and allows upstream MAC learning to point to the gateway chassis\[char46] +.IP +For the logical router port with the option \fBreside\-on\-redirect\-chassis\fR set (which is centralized), the above flows are only programmed on the gateway port instance on the gateway chassis (if the logical router has a distributed gateway port)\[char46] This behavior avoids generation of multiple ARP responses from different chassis, and allows upstream MAC learning to point to the gateway chassis\[char46] +.IP \(bu +Reply to IPv6 Neighbor Solicitations\[char46] These flows reply to Neighbor Solicitation requests for the router\(cqs own IPv6 address and populate the logical router\(cqs mac binding table\[char46] +.IP +For each router port \fIP\fR that owns IPv6 address \fIA\fR, solicited node address \fIS\fR, and Ethernet address \fIE\fR, a priority\-90 flow matches \fBinport == \fIP\fB && +nd_ns && ip6\[char46]dst == {\fIA\fB, \fIE\fB} && +nd\[char46]target == \fIA\fB\fR with the following actions: +.IP +.nf +\fB +.br +\fBnd_na_router { +.br +\fB eth\[char46]src = xreg0[0\[char46]\[char46]47]; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB nd\[char46]target = \fR\fIA\fB\fR; +.br +\fB nd\[char46]tll = xreg0[0\[char46]\[char46]47]; +.br +\fB outport = inport; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +For the gateway port on a distributed logical router (where one of the logical router ports specifies a gateway chassis), the above flows replying to IPv6 Neighbor Solicitations are only programmed on the gateway port instance on the gateway chassis\[char46] This behavior avoids generation of multiple replies from different chassis, and allows upstream MAC learning to point to the gateway chassis\[char46] +.IP \(bu +These flows reply to ARP requests or IPv6 neighbor solicitation for the virtual IP addresses configured in the router for NAT (both DNAT and SNAT) or load balancing\[char46] +.IP +IPv4: For a configured NAT (both DNAT and SNAT) IP address or a load balancer IPv4 VIP \fIA\fR, for each router port \fIP\fR with Ethernet address \fIE\fR, a priority\-90 flow matches \fBarp\[char46]op == 1 && arp\[char46]tpa == \fIA\fB\fR (ARP request) with the following actions: +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = xreg0[0\[char46]\[char46]47]; +.br +\fBarp\[char46]op = 2; /* ARP reply\[char46] */ +.br +\fBarp\[char46]tha = arp\[char46]sha; +.br +\fBarp\[char46]sha = xreg0[0\[char46]\[char46]47]; +.br +\fBarp\[char46]tpa <\-> arp\[char46]spa; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +IPv4: For a configured load balancer IPv4 VIP, a similar flow is added with the additional match \fBinport == \fIP\fB\fR if the VIP is reachable from any logical router port of the logical router\[char46] +.IP +If the router port \fIP\fR is a distributed gateway router port, then the \fBis_chassis_resident(\fIP\fB)\fR is also added in the match condition for the load balancer IPv4 VIP \fIA\fR\[char46] +.IP +IPv6: For a configured NAT (both DNAT and SNAT) IP address or a load balancer IPv6 VIP \fIA\fR (if the VIP is reachable from any logical router port of the logical router), solicited node address \fIS\fR, for each router port \fIP\fR with Ethernet address \fIE\fR, a priority\-90 flow matches \fBinport == \fIP\fB && nd_ns && +ip6\[char46]dst == {\fIA\fB, \fIS\fB} && +nd\[char46]target == \fIA\fB\fR with the following actions: +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBnd_na { +.br +\fB eth\[char46]src = xreg0[0\[char46]\[char46]47]; +.br +\fB nd\[char46]tll = xreg0[0\[char46]\[char46]47]; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB nd\[char46]target = \fR\fIA\fB\fR; +.br +\fB outport = inport; +.br +\fB flags\[char46]loopback = 1; +.br +\fB output; +.br +\fB} +.br +\fB \fR +.fi +.IP +If the router port \fIP\fR is a distributed gateway router port, then the \fBis_chassis_resident(\fIP\fB)\fR is also added in the match condition for the load balancer IPv6 VIP \fIA\fR\[char46] +.IP +For the gateway port on a distributed logical router with NAT (where one of the logical router ports specifies a gateway chassis): +.RS +.IP \(bu +If the corresponding NAT rule cannot be handled in a distributed manner, then a priority\-92 flow is programmed on the gateway port instance on the gateway chassis\[char46] A priority\-91 drop flow is programmed on the other chassis when ARP requests/NS packets are received on the gateway port\[char46] This behavior avoids generation of multiple ARP responses from different chassis, and allows upstream MAC learning to point to the gateway chassis\[char46] +.IP \(bu +If the corresponding NAT rule can be handled in a distributed manner, then this flow is only programmed on the gateway port instance where the \fBlogical_port\fR specified in the NAT rule resides\[char46] +.IP +Some of the actions are different for this case, using the \fBexternal_mac\fR specified in the NAT rule rather than the gateway port\(cqs Ethernet address \fIE\fR: +.IP +.nf +\fB +.br +\fBeth\[char46]src = \fR\fIexternal_mac\fB\fR; +.br +\fBarp\[char46]sha = \fR\fIexternal_mac\fB\fR; +.br +\fB \fR +.fi +.IP +or in the case of IPv6 neighbor solicition: +.IP +.nf +\fB +.br +\fBeth\[char46]src = \fR\fIexternal_mac\fB\fR; +.br +\fBnd\[char46]tll = \fR\fIexternal_mac\fB\fR; +.br +\fB \fR +.fi +.IP +This behavior avoids generation of multiple ARP responses from different chassis, and allows upstream MAC learning to point to the correct chassis\[char46] +.RE +.IP \(bu +Priority\-85 flows which drops the ARP and IPv6 Neighbor Discovery packets\[char46] +.IP \(bu +A priority\-84 flow explicitly allows IPv6 multicast traffic that is supposed to reach the router pipeline (i\[char46]e\[char46], router solicitation and router advertisement packets)\[char46] +.IP \(bu +A priority\-83 flow explicitly drops IPv6 multicast traffic that is destined to reserved multicast groups\[char46] +.IP \(bu +A priority\-82 flow allows IP multicast traffic if \fBoptions\fR:mcast_relay=\(cqtrue\(cq, otherwise drops it\[char46] +.IP \(bu +UDP port unreachable\[char46] Priority\-80 flows generate ICMP port unreachable messages in reply to UDP datagrams directed to the router\(cqs IP address, except in the special case of gateways, which accept traffic directed to a router IP for load balancing and NAT purposes\[char46] +.IP +These flows should not match IP fragments with nonzero offset\[char46] +.IP \(bu +TCP reset\[char46] Priority\-80 flows generate TCP reset messages in reply to TCP datagrams directed to the router\(cqs IP address, except in the special case of gateways, which accept traffic directed to a router IP for load balancing and NAT purposes\[char46] +.IP +These flows should not match IP fragments with nonzero offset\[char46] +.IP \(bu +Protocol or address unreachable\[char46] Priority\-70 flows generate ICMP protocol or address unreachable messages for IPv4 and IPv6 respectively in reply to packets directed to the router\(cqs IP address on IP protocols other than UDP, TCP, and ICMP, except in the special case of gateways, which accept traffic directed to a router IP for load balancing purposes\[char46] +.IP +These flows should not match IP fragments with nonzero offset\[char46] +.IP \(bu +Drop other IP traffic to this router\[char46] These flows drop any other traffic destined to an IP address of this router that is not already handled by one of the flows above, which amounts to ICMP (other than echo requests) and fragments with nonzero offsets\[char46] For each IP address \fIA\fR owned by the router, a priority\-60 flow matches \fBip4\[char46]dst == \fIA\fB\fR or \fBip6\[char46]dst == \fIA\fB\fR and drops the traffic\[char46] An exception is made and the above flow is not added if the router port\(cqs own IP address is used to SNAT packets passing through that router or if it is used as a load balancer VIP\[char46] +.RE +.PP +.PP +The flows above handle all of the traffic that might be directed to the router itself\[char46] The following flows (with lower priorities) handle the remaining traffic, potentially for forwarding: +.RS +.IP \(bu +Drop Ethernet local broadcast\[char46] A priority\-50 flow with match \fBeth\[char46]bcast\fR drops traffic destined to the local Ethernet broadcast address\[char46] By definition this traffic should not be forwarded\[char46] +.IP \(bu +Avoid ICMP time exceeded for multicast\[char46] A priority\-32 flow with match \fBip\[char46]ttl == {0, 1} && !ip\[char46]later_frag && +(ip4\[char46]mcast || ip6\[char46]mcast)\fR and actions \fBdrop;\fR drops multicast packets whose TTL has expired without sending ICMP time exceeded\[char46] +.IP \(bu +ICMP time exceeded\[char46] For each router port \fIP\fR, whose IP address is \fIA\fR, a priority\-31 flow with match \fBinport +== \fIP\fB && ip\[char46]ttl == {0, 1} && +!ip\[char46]later_frag\fR matches packets whose TTL has expired, with the following actions to send an ICMP time exceeded reply for IPv4 and IPv6 respectively: +.IP +.nf +\fB +.br +\fBicmp4 { +.br +\fB icmp4\[char46]type = 11; /* Time exceeded\[char46] */ +.br +\fB icmp4\[char46]code = 0; /* TTL exceeded in transit\[char46] */ +.br +\fB ip4\[char46]dst = ip4\[char46]src; +.br +\fB ip4\[char46]src = \fR\fIA\fB\fR; +.br +\fB ip\[char46]ttl = 254; +.br +\fB next; +.br +\fB}; +.br +\fB +.br +\fBicmp6 { +.br +\fB icmp6\[char46]type = 3; /* Time exceeded\[char46] */ +.br +\fB icmp6\[char46]code = 0; /* TTL exceeded in transit\[char46] */ +.br +\fB ip6\[char46]dst = ip6\[char46]src; +.br +\fB ip6\[char46]src = \fR\fIA\fB\fR; +.br +\fB ip\[char46]ttl = 254; +.br +\fB next; +.br +\fB}; +.br +\fB \fR +.fi +.IP \(bu +TTL discard\[char46] A priority\-30 flow with match \fBip\[char46]ttl == {0, +1}\fR and actions \fBdrop;\fR drops other packets whose TTL has expired, that should not receive a ICMP error reply (i\[char46]e\[char46] fragments with nonzero offset)\[char46] +.IP \(bu +Next table\[char46] A priority\-0 flows match all packets that aren\(cqt already handled and uses actions \fBnext;\fR to feed them to the next table\[char46] +.RE +.ST "Ingress Table 4: UNSNAT" +.PP +.PP +This is for already established connections\(cq reverse traffic\[char46] i\[char46]e\[char46], SNAT has already been done in egress pipeline and now the packet has entered the ingress pipeline as part of a reply\[char46] It is unSNATted here\[char46] +.PP +.PP +Ingress Table 4: UNSNAT on Gateway and Distributed Routers +.RS +.IP \(bu +If the Router (Gateway or Distributed) is configured with load balancers, then below lflows are added: +.IP +For each IPv4 address \fIA\fR defined as load balancer VIP with the protocol \fIP\fR (and the protocol port \fIT\fR if defined) is also present as an \fBexternal_ip\fR in the NAT table, a priority\-120 logical flow is added with the match \fBip4 && ip4\[char46]dst == \fIA\fB && +\fIP\fB\fR with the action \fBnext;\fR to advance the packet to the next table\[char46] If the load balancer has protocol port \fBB\fR defined, then the match also has \fB\fIP\fB\[char46]dst == \fIB\fB\fR\[char46] +.IP +The above flows are also added for IPv6 load balancers\[char46] +.RE +.PP +.PP +Ingress Table 4: UNSNAT on Gateway Routers +.RS +.IP \(bu +If the Gateway router has been configured to force SNAT any previously DNATted packets to \fIB\fR, a priority\-110 flow matches \fBip && ip4\[char46]dst == \fIB\fB\fR or \fBip && ip6\[char46]dst == \fIB\fB\fR with an action \fBct_snat; \fR\[char46] +.IP +If the Gateway router is configured with \fBlb_force_snat_ip=router_ip\fR then for every logical router port \fIP\fR attached to the Gateway router with the router ip \fIB\fR, a priority\-110 flow is added with the match \fBinport == \fIP\fB && +ip4\[char46]dst == \fIB\fB\fR or \fBinport == \fIP\fB +&& ip6\[char46]dst == \fIB\fB\fR with an action \fBct_snat; \fR\[char46] +.IP +If the Gateway router has been configured to force SNAT any previously load-balanced packets to \fIB\fR, a priority\-100 flow matches \fBip && ip4\[char46]dst == \fIB\fB\fR or \fBip && ip6\[char46]dst == \fIB\fB\fR with an action \fBct_snat; \fR\[char46] +.IP +For each NAT configuration in the OVN Northbound database, that asks to change the source IP address of a packet from \fIA\fR to \fIB\fR, a priority\-90 flow matches \fBip && ip4\[char46]dst == \fIB\fB\fR or \fBip && ip6\[char46]dst == \fIB\fB\fR with an action \fBct_snat; \fR\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBnext;\fR\[char46] +.IP +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.PP +.PP +Ingress Table 4: UNSNAT on Distributed Routers +.RS +.IP \(bu +For each configuration in the OVN Northbound database, that asks to change the source IP address of a packet from \fIA\fR to \fIB\fR, two priority\-100 flows are added\[char46] +.IP +If the NAT rule cannot be handled in a distributed manner, then the below priority\-100 flows are only programmed on the gateway chassis\[char46] +.RS +.IP \(bu +The first flow matches \fBip && +ip4\[char46]dst == \fIB\fB && inport == \fIGW\fB +\fR or \fBip && ip6\[char46]dst == \fIB\fB && +inport == \fIGW\fB\fR where \fIGW\fR is the distributed gateway port corresponding to the NAT rule (specified or inferred), with an action \fBct_snat;\fR to unSNAT in the common zone\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBnext;\fR\[char46] +.IP +If the NAT entry is of type \fBsnat\fR, then there is an additional match \fBis_chassis_resident(\fIcr-GW\fB) +\fR where \fIcr-GW\fR is the chassis resident port of \fIGW\fR\[char46] +.RE +.IP +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 5: DEFRAG" +.PP +.PP +This is to send packets to connection tracker for tracking and defragmentation\[char46] It contains a priority\-0 flow that simply moves traffic to the next table\[char46] +.PP +.PP +For all load balancing rules that are configured in \fBOVN_Northbound\fR database for a Gateway router, a priority\-100 flow is added for each configured virtual IP address \fIVIP\fR\[char46] For IPv4 \fIVIPs\fR the flow matches \fBip && ip4\[char46]dst == \fIVIP\fB\fR\[char46] For IPv6 \fIVIPs\fR, the flow matches \fBip && ip6\[char46]dst == +\fIVIP\fB\fR\[char46] The flow applies the action \fB ct_dnat;\fR to send IP packets to the connection tracker for packet de-fragmentation and to dnat the destination IP for the committed connection before sending it to the next table\[char46] +.PP +.PP +If ECMP routes with symmetric reply are configured in the \fBOVN_Northbound\fR database for a gateway router, a priority\-100 flow is added for each router port on which symmetric replies are configured\[char46] The matching logic for these ports essentially reverses the configured logic of the ECMP route\[char46] So for instance, a route with a destination routing policy will instead match if the source IP address matches the static route\(cqs prefix\[char46] The flow uses the actions \fBchk_ecmp_nh_mac(); ct_next\fR or \fBchk_ecmp_nh(); ct_next\fR to send IP packets to table \fB76\fR or to table \fB77\fR in order to check if source info are already stored by OVN and then to the connection tracker for packet de-fragmentation and tracking before sending it to the next table\[char46] +.PP +.PP +If load balancing rules are configured in \fBOVN_Northbound\fR database for a Gateway router, a priority 50 flow that matches \fBicmp || icmp6\fR with an action of \fBct_dnat;\fR, this allows potentially related ICMP traffic to pass through CT\[char46] +.ST "Ingress Table 6: Load balancing affinity check" +.PP +.PP +Load balancing affinity check table contains the following logical flows: +.RS +.IP \(bu +For all the configured load balancing rules for a logical router where a positive affinity timeout is specified in \fBoptions\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IPv4 or IPv6 address \fIVIP\fR, a priority\-100 flow that matches on \fBct\[char46]new && ip && +ip\[char46]dst == \fIVIP\fB && \fIP\fB && P\[char46]dst +== \fR \fB\fIPORT\fB\fR (\fBxxreg0 == \fIVIP +\fB\fR in the IPv6 case) with an action of \fBreg0 = ip\[char46]dst; +reg9[16\[char46]\[char46]31] = P\[char46]dst; reg9[6] = chk_lb_aff(); next;\fR (\fBxxreg0 == \fIip6\[char46]dst\fB \fR in the IPv6 case) +.IP \(bu +A priority 0 flow is added which matches on all packets and applies the action \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 7: DNAT" +.PP +.PP +Packets enter the pipeline with destination IP address that needs to be DNATted from a virtual IP address to a real IP address\[char46] Packets in the reverse direction needs to be unDNATed\[char46] +.PP +.PP +Ingress Table 7: Load balancing DNAT rules +.PP +.PP +Following load balancing DNAT flows are added for Gateway router or Router with gateway port\[char46] These flows are programmed only on the gateway chassis\[char46] These flows do not get programmed for load balancers with IPv6 \fIVIPs\fR\[char46] +.RS +.IP \(bu +For all the configured load balancing rules for a logical router where a positive affinity timeout is specified in \fBoptions\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IPv4 or IPv6 address \fIVIP\fR, a priority\-150 flow that matches on \fBreg9[6] == 1 && ct\[char46]new && +ip && ip\[char46]dst == \fIVIP\fB && \fIP\fB && +P\[char46]dst == \fR \fB\fIPORT\fB\fR with an action of \fBct_lb_mark(\fIargs\fB) \fR, where \fIargs\fR contains comma separated IP addresses (and optional port numbers) to load balance to\[char46] The address family of the IP addresses of \fIargs\fR is the same as the address family of \fIVIP\fR\[char46] +.IP \(bu +If controller_event has been enabled for all the configured load balancing rules for a Gateway router or Router with gateway port in \fBOVN_Northbound\fR database that does not have configured backends, a priority\-130 flow is added to trigger ovn-controller events whenever the chassis receives a packet for that particular VIP\[char46] If \fBevent\-elb\fR meter has been previously created, it will be associated to the empty_lb logical flow +.IP \(bu +For all the configured load balancing rules for a Gateway router or Router with gateway port in \fBOVN_Northbound\fR database that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IPv4 or IPv6 address \fIVIP\fR, a priority\-120 flow that matches on \fBct\[char46]new && !ct\[char46]rel && ip && ip\[char46]dst == +\fIVIP\fB && \fIP\fB && P\[char46]dst == +\fR \fB\fIPORT\fB\fR with an action of \fBct_lb_mark(\fIargs\fB)\fR, where \fIargs\fR contains comma separated IPv4 or IPv6 addresses (and optional port numbers) to load balance to\[char46] If the router is configured to force SNAT any load-balanced packets, the above action will be replaced by \fBflags\[char46]force_snat_for_lb = 1; ct_lb_mark(\fIargs\fB; +force_snat);\fR\[char46] If the load balancing rule is configured with \fBskip_snat\fR set to true, the above action will be replaced by \fBflags\[char46]skip_snat_for_lb = 1; ct_lb_mark(\fIargs\fB; +skip_snat);\fR\[char46] If health check is enabled, then \fIargs\fR will only contain those endpoints whose service monitor status entry in \fBOVN_Southbound\fR db is either \fBonline\fR or empty\[char46] +.IP \(bu +For all the configured load balancing rules for a router in \fBOVN_Northbound\fR database that includes just an IP address \fIVIP\fR to match on, a priority\-110 flow that matches on \fBct\[char46]new && !ct\[char46]rel && ip4 && ip\[char46]dst == +\fIVIP\fB\fR with an action of \fBct_lb_mark(\fIargs\fB)\fR, where \fIargs\fR contains comma separated IPv4 or IPv6 addresses\[char46] If the router is configured to force SNAT any load-balanced packets, the above action will be replaced by \fBflags\[char46]force_snat_for_lb = 1; +ct_lb_mark(\fIargs\fB; force_snat);\fR\[char46] If the load balancing rule is configured with \fBskip_snat\fR set to true, the above action will be replaced by \fBflags\[char46]skip_snat_for_lb = 1; ct_lb_mark(\fIargs\fB; +skip_snat);\fR\[char46] +.IP +The previous table \fBlr_in_defrag\fR sets the register \fBreg0\fR (or \fBxxreg0\fR for IPv6) and does \fBct_dnat\fR\[char46] Hence for established traffic, this table just advances the packet to the next stage\[char46] +.IP \(bu +If the load balancer is created with \fB\-\-reject\fR option and it has no active backends, a TCP reset segment (for tcp) or an ICMP port unreachable packet (for all other kind of traffic) will be sent whenever an incoming packet is received for this load-balancer\[char46] Please note using \fB\-\-reject\fR option will disable empty_lb SB controller event for this load balancer\[char46] +.IP \(bu +For the related traffic, a priority 50 flow that matches \fBct\[char46]rel && !ct\[char46]est && !ct\[char46]new \fR with an action of \fBct_commit_nat;\fR, if the router has load balancer assigned to it\[char46] Along with two priority 70 flows that match \fBskip_snat\fR and \fBforce_snat\fR flags, setting the \fBflags\[char46]force_snat_for_lb = 1\fR or \fBflags\[char46]skip_snat_for_lb = 1\fR accordingly\[char46] +.IP \(bu +For the established traffic, a priority 50 flow that matches \fBct\[char46]est && !ct\[char46]rel && !ct\[char46]new && +ct_mark\[char46]natted\fR with an action of \fBnext;\fR, if the router has load balancer assigned to it\[char46] Along with two priority 70 flows that match \fBskip_snat\fR and \fBforce_snat\fR flags, setting the \fBflags\[char46]force_snat_for_lb = 1\fR or \fBflags\[char46]skip_snat_for_lb = 1\fR accordingly\[char46] +.RE +.PP +.PP +Ingress Table 7: DNAT on Gateway Routers +.RS +.IP \(bu +For each configuration in the OVN Northbound database, that asks to change the destination IP address of a packet from \fIA\fR to \fIB\fR, a priority\-100 flow matches \fBip && +ip4\[char46]dst == \fIA\fB\fR or \fBip && +ip6\[char46]dst == \fIA\fB\fR with an action \fBflags\[char46]loopback = 1; ct_dnat(\fIB\fB);\fR\[char46] If the Gateway router is configured to force SNAT any DNATed packet, the above action will be replaced by \fBflags\[char46]force_snat_for_dnat = 1; flags\[char46]loopback = 1; +ct_dnat(\fIB\fB);\fR\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBip4/6\[char46]dst= +(\fIB\fB)\fR\[char46] +.IP +If the NAT rule has \fBallowed_ext_ips\fR configured, then there is an additional match \fBip4\[char46]src == \fIallowed_ext_ips +\fB\fR\[char46] Similarly, for IPV6, match would be \fBip6\[char46]src == +\fIallowed_ext_ips\fB\fR\[char46] +.IP +If the NAT rule has \fBexempted_ext_ips\fR set, then there is an additional flow configured at priority 101\[char46] The flow matches if source ip is an \fBexempted_ext_ip\fR and the action is \fBnext; \fR\[char46] This flow is used to bypass the ct_dnat action for a packet originating from \fBexempted_ext_ips\fR\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.PP +.PP +Ingress Table 7: DNAT on Distributed Routers +.PP +.PP +On distributed routers, the DNAT table only handles packets with destination IP address that needs to be DNATted from a virtual IP address to a real IP address\[char46] The unDNAT processing in the reverse direction is handled in a separate table in the egress pipeline\[char46] +.RS +.IP \(bu +For each configuration in the OVN Northbound database, that asks to change the destination IP address of a packet from \fIA\fR to \fIB\fR, a priority\-100 flow matches \fBip && +ip4\[char46]dst == \fIB\fB && inport == \fIGW\fB\fR, where \fIGW\fR is the logical router gateway port corresponding to the NAT rule (specified or inferred), with an action \fBct_dnat(\fIB\fB);\fR\[char46] The match will include \fBip6\[char46]dst == \fIB\fB\fR in the IPv6 case\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBip4/6\[char46]dst=(\fIB\fB)\fR\[char46] +.IP +If the NAT rule cannot be handled in a distributed manner, then the priority\-100 flow above is only programmed on the gateway chassis\[char46] +.IP +If the NAT rule has \fBallowed_ext_ips\fR configured, then there is an additional match \fBip4\[char46]src == \fIallowed_ext_ips +\fB\fR\[char46] Similarly, for IPV6, match would be \fBip6\[char46]src == +\fIallowed_ext_ips\fB\fR\[char46] +.IP +If the NAT rule has \fBexempted_ext_ips\fR set, then there is an additional flow configured at priority 101\[char46] The flow matches if source ip is an \fBexempted_ext_ip\fR and the action is \fBnext; \fR\[char46] This flow is used to bypass the ct_dnat action for a packet originating from \fBexempted_ext_ips\fR\[char46] +.IP +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 8: Load balancing affinity learn" +.PP +.PP +Load balancing affinity learn table contains the following logical flows: +.RS +.IP \(bu +For all the configured load balancing rules for a logical router where a positive affinity timeout \fIT\fR is specified in \fBoptions +\fR column, that includes a L4 port \fIPORT\fR of protocol \fIP\fR and IPv4 or IPv6 address \fIVIP\fR, a priority\-100 flow that matches on \fBreg9[6] == 0 && ct\[char46]new && +ip && reg0 == \fIVIP\fB && \fIP\fB && +reg9[16\[char46]\[char46]31] == \fR \fB\fIPORT\fB\fR (\fBxxreg0 == +\fIVIP\fB \fR in the IPv6 case) with an action of \fBcommit_lb_aff(vip = \fIVIP\fB:\fIPORT\fB, backend = +\fIbackend ip\fB: \fIbackend port\fB, proto = \fIP\fB, +timeout = \fIT\fB);\fR\[char46] +.IP \(bu +A priority 0 flow is added which matches on all packets and applies the action \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 9: ECMP symmetric reply processing" +.RS +.IP \(bu +If ECMP routes with symmetric reply are configured in the \fBOVN_Northbound\fR database for a gateway router, a priority\-100 flow is added for each router port on which symmetric replies are configured\[char46] The matching logic for these ports essentially reverses the configured logic of the ECMP route\[char46] So for instance, a route with a destination routing policy will instead match if the source IP address matches the static route\(cqs prefix\[char46] The flow uses the action \fBct_commit { ct_label\[char46]ecmp_reply_eth = eth\[char46]src;\(dq +\(dq ct_mark\[char46]ecmp_reply_port = \fIK\fB;}; commit_ecmp_nh(); next; +\fR to commit the connection and storing \fBeth\[char46]src\fR and the ECMP reply port binding tunnel key \fIK\fR in the \fBct_label\fR and the traffic pattern to table \fB76\fR or \fB77\fR\[char46] +.RE +.ST "Ingress Table 10: IPv6 ND RA option processing" +.RS +.IP \(bu +A priority\-50 logical flow is added for each logical router port configured with IPv6 ND RA options which matches IPv6 ND Router Solicitation packet and applies the action \fBput_nd_ra_opts\fR and advances the packet to the next table\[char46] +.IP +.nf +\fB +.br +\fBreg0[5] = put_nd_ra_opts(\fR\fIoptions\fB\fR);next; +.br +\fB \fR +.fi +.IP +For a valid IPv6 ND RS packet, this transforms the packet into an IPv6 ND RA reply and sets the RA options to the packet and stores 1 into reg0[5]\[char46] For other kinds of packets, it just stores 0 into reg0[5]\[char46] Either way, it continues to the next table\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 11: IPv6 ND RA responder" +.PP +.PP +This table implements IPv6 ND RA responder for the IPv6 ND RA replies generated by the previous table\[char46] +.RS +.IP \(bu +A priority\-50 logical flow is added for each logical router port configured with IPv6 ND RA options which matches IPv6 ND RA packets and \fBreg0[5] == 1\fR and responds back to the \fBinport\fR after applying these actions\[char46] If \fBreg0[5]\fR is set to 1, it means that the action \fBput_nd_ra_opts\fR was successful\[char46] +.IP +.nf +\fB +.br +\fBeth\[char46]dst = eth\[char46]src; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBip6\[char46]dst = ip6\[char46]src; +.br +\fBip6\[char46]src = \fR\fII\fB\fR; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBflags\[char46]loopback = 1; +.br +\fBoutput; +.br +\fB \fR +.fi +.IP +where \fIE\fR is the MAC address and \fII\fR is the IPv6 link local address of the logical router port\[char46] +.IP +(This terminates packet processing in ingress pipeline; the packet does not go to the next ingress table\[char46]) +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 12: IP Routing Pre" +.PP +.PP +If a packet arrived at this table from Logical Router Port \fIP\fR which has \fBoptions:route_table\fR value set, a logical flow with match \fBinport == \(dq\fIP\fB\(dq\fR with priority 100 and action setting unique-generated per-datapath 32-bit value (non-zero) in OVS register 7\[char46] This register\(cqs value is checked in next table\[char46] If packet didn\(cqt match any configured inport (\fI
\fR route table), register 7 value is set to 0\[char46] +.PP +.PP +This table contains the following logical flows: +.RS +.IP \(bu +Priority\-100 flow with match \fBinport == \(dqLRP_NAME\(dq\fR value and action, which set route table identifier in reg7\[char46] +.IP +A priority\-0 logical flow with match \fB1\fR has actions \fBreg7 = 0; next;\fR\[char46] +.RE +.ST "Ingress Table 13: IP Routing" +.PP +.PP +A packet that arrives at this table is an IP packet that should be routed to the address in \fBip4\[char46]dst\fR or \fBip6\[char46]dst\fR\[char46] This table implements IP routing, setting \fBreg0\fR (or \fBxxreg0\fR for IPv6) to the next-hop IP address (leaving \fBip4\[char46]dst\fR or \fBip6\[char46]dst\fR, the packet\(cqs final destination, unchanged) and advances to the next table for ARP resolution\[char46] It also sets \fBreg1\fR (or \fBxxreg1\fR) to the IP address owned by the selected router port (ingress table \fBARP Request\fR will generate an ARP request, if needed, with \fBreg0\fR as the target protocol address and \fBreg1\fR as the source protocol address)\[char46] +.PP +.PP +For ECMP routes, i\[char46]e\[char46] multiple static routes with same policy and prefix but different nexthops, the above actions are deferred to next table\[char46] This table, instead, is responsible for determine the ECMP group id and select a member id within the group based on 5-tuple hashing\[char46] It stores group id in \fBreg8[0\[char46]\[char46]15]\fR and member id in \fBreg8[16\[char46]\[char46]31]\fR\[char46] This step is skipped with a priority\-10300 rule if the traffic going out the ECMP route is reply traffic, and the ECMP route was configured to use symmetric replies\[char46] Instead, the stored values in conntrack is used to choose the destination\[char46] The \fBct_label\[char46]ecmp_reply_eth\fR tells the destination MAC address to which the packet should be sent\[char46] The \fBct_mark\[char46]ecmp_reply_port\fR tells the logical router port on which the packet should be sent\[char46] These values saved to the conntrack fields when the initial ingress traffic is received over the ECMP route and committed to conntrack\[char46] If \fBREGBIT_KNOWN_ECMP_NH\fR is set, the priority\-10300 flows in this stage set the \fBoutport\fR, while the \fBeth\[char46]dst\fR is set by flows at the ARP/ND Resolution stage\[char46] +.PP +.PP +This table contains the following logical flows: +.RS +.IP \(bu +Priority\-10550 flow that drops IPv6 Router Solicitation/Advertisement packets that were not processed in previous tables\[char46] +.IP \(bu +Priority\-10550 flows that drop IGMP and MLD packets with source MAC address owned by the router\[char46] These are used to prevent looping statically forwarded IGMP and MLD packets for which TTL is not decremented (it is always 1)\[char46] +.IP \(bu +Priority\-10500 flows that match IP multicast traffic destined to groups registered on any of the attached switches and sets \fBoutport\fR to the associated multicast group that will eventually flood the traffic to all interested attached logical switches\[char46] The flows also decrement TTL\[char46] +.IP \(bu +Priority\-10460 flows that match IGMP and MLD control packets, set \fBoutport\fR to the \fBMC_STATIC\fR multicast group, which \fBovn\-northd\fR populates with the logical ports that have \fBoptions\fR \fB:mcast_flood=\(cqtrue\(cq\fR\[char46] If no router ports are configured to flood multicast traffic the packets are dropped\[char46] +.IP \(bu +Priority\-10450 flow that matches unregistered IP multicast traffic decrements TTL and sets \fBoutport\fR to the \fBMC_STATIC\fR multicast group, which \fBovn\-northd\fR populates with the logical ports that have \fBoptions\fR \fB:mcast_flood=\(cqtrue\(cq\fR\[char46] If no router ports are configured to flood multicast traffic the packets are dropped\[char46] +.IP \(bu +IPv4 routing table\[char46] For each route to IPv4 network \fIN\fR with netmask \fIM\fR, on router port \fIP\fR with IP address \fIA\fR and Ethernet address \fIE\fR, a logical flow with match \fBip4\[char46]dst == +\fIN\fB/\fIM\fB\fR, whose priority is the number of 1-bits in \fIM\fR, has the following actions: +.IP +.nf +\fB +.br +\fBip\[char46]ttl\-\-; +.br +\fBreg8[0\[char46]\[char46]15] = 0; +.br +\fBreg0 = \fR\fIG\fB\fR; +.br +\fBreg1 = \fR\fIA\fB\fR; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBflags\[char46]loopback = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP +(Ingress table 1 already verified that \fBip\[char46]ttl\-\-;\fR will not yield a TTL exceeded error\[char46]) +.IP +If the route has a gateway, \fIG\fR is the gateway IP address\[char46] Instead, if the route is from a configured static route, \fIG\fR is the next hop IP address\[char46] Else it is \fBip4\[char46]dst\fR\[char46] +.IP \(bu +IPv6 routing table\[char46] For each route to IPv6 network \fIN\fR with netmask \fIM\fR, on router port \fIP\fR with IP address \fIA\fR and Ethernet address \fIE\fR, a logical flow with match in CIDR notation \fBip6\[char46]dst == \fIN\fB/\fIM\fB\fR, whose priority is the integer value of \fIM\fR, has the following actions: +.IP +.nf +\fB +.br +\fBip\[char46]ttl\-\-; +.br +\fBreg8[0\[char46]\[char46]15] = 0; +.br +\fBxxreg0 = \fR\fIG\fB\fR; +.br +\fBxxreg1 = \fR\fIA\fB\fR; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBoutport = inport; +.br +\fBflags\[char46]loopback = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP +(Ingress table 1 already verified that \fBip\[char46]ttl\-\-;\fR will not yield a TTL exceeded error\[char46]) +.IP +If the route has a gateway, \fIG\fR is the gateway IP address\[char46] Instead, if the route is from a configured static route, \fIG\fR is the next hop IP address\[char46] Else it is \fBip6\[char46]dst\fR\[char46] +.IP +If the address \fIA\fR is in the link-local scope, the route will be limited to sending on the ingress port\[char46] +.IP +For each static route the \fBreg7 == id &&\fR is prefixed in logical flow match portion\[char46] For routes with \fBroute_table\fR value set a unique non-zero id is used\[char46] For routes within \fB
\fR route table (no route table set), this id value is 0\[char46] +.IP +For each \fIconnected\fR route (route to the LRP\(cqs subnet CIDR) the logical flow match portion has no \fBreg7 == id &&\fR prefix to have route to LRP\(cqs subnets in all routing tables\[char46] +.IP \(bu +For ECMP routes, they are grouped by policy and prefix\[char46] An unique id (non-zero) is assigned to each group, and each member is also assigned an unique id (non-zero) within each group\[char46] +.IP +For each IPv4/IPv6 ECMP group with group id \fIGID\fR and member ids \fIMID1\fR, \fIMID2\fR, \[char46]\[char46]\[char46], a logical flow with match in CIDR notation \fBip4\[char46]dst == \fIN\fB/\fIM\fB\fR, or \fBip6\[char46]dst == \fIN\fB/\fIM\fB\fR, whose priority is the integer value of \fIM\fR, has the following actions: +.IP +.nf +\fB +.br +\fBip\[char46]ttl\-\-; +.br +\fBflags\[char46]loopback = 1; +.br +\fBreg8[0\[char46]\[char46]15] = \fR\fIGID\fB\fR; +.br +\fBselect(reg8[16\[char46]\[char46]31], \fR\fIMID1\fB\fR, \fR\fIMID2\fB\fR, \[char46]\[char46]\[char46]); +.br +\fB \fR +.fi +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.ST "Ingress Table 14: IP_ROUTING_ECMP" +.PP +.PP +This table implements the second part of IP routing for ECMP routes following the previous table\[char46] If a packet matched a ECMP group in the previous table, this table matches the group id and member id stored from the previous table, setting \fBreg0\fR (or \fBxxreg0\fR for IPv6) to the next-hop IP address (leaving \fBip4\[char46]dst\fR or \fBip6\[char46]dst\fR, the packet\(cqs final destination, unchanged) and advances to the next table for ARP resolution\[char46] It also sets \fBreg1\fR (or \fBxxreg1\fR) to the IP address owned by the selected router port (ingress table \fBARP Request\fR will generate an ARP request, if needed, with \fBreg0\fR as the target protocol address and \fBreg1\fR as the source protocol address)\[char46] +.PP +.PP +This processing is skipped for reply traffic being sent out of an ECMP route if the route was configured to use symmetric replies\[char46] +.PP +.PP +This table contains the following logical flows: +.RS +.IP \(bu +A priority\-150 flow that matches \fBreg8[0\[char46]\[char46]15] == 0\fR with action \fBnext;\fR directly bypasses packets of non-ECMP routes\[char46] +.IP \(bu +For each member with ID \fIMID\fR in each ECMP group with ID \fIGID\fR, a priority\-100 flow with match \fBreg8[0\[char46]\[char46]15] == \fIGID\fB && reg8[16\[char46]\[char46]31] == \fIMID\fB\fR has following actions: +.IP +.nf +\fB +.br +\fB[xx]reg0 = \fR\fIG\fB\fR; +.br +\fB[xx]reg1 = \fR\fIA\fB\fR; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fB \fR +.fi +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.ST "Ingress Table 15: Router policies" +.PP +.PP +This table adds flows for the logical router policies configured on the logical router\[char46] Please see the \fBOVN_Northbound\fR database \fBLogical_Router_Policy\fR table documentation in \fBovn\-nb\fR for supported actions\[char46] +.RS +.IP \(bu +For each router policy configured on the logical router, a logical flow is added with specified priority, match and actions\[char46] +.IP \(bu +If the policy action is \fBreroute\fR with 2 or more nexthops defined, then the logical flow is added with the following actions: +.IP +.nf +\fB +.br +\fBreg8[0\[char46]\[char46]15] = \fR\fIGID\fB\fR; +.br +\fBreg8[16\[char46]\[char46]31] = select(1,\[char46]\[char46]n); +.br +\fB \fR +.fi +.IP +where \fIGID\fR is the ECMP group id generated by \fBovn\-northd\fR for this policy and \fIn\fR is the number of nexthops\[char46] \fBselect\fR action selects one of the nexthop member id, stores it in the register \fBreg8[16\[char46]\[char46]31]\fR and advances the packet to the next stage\[char46] +.IP \(bu +If the policy action is \fBreroute\fR with just one nexhop, then the logical flow is added with the following actions: +.IP +.nf +\fB +.br +\fB[xx]reg0 = \fR\fIH\fB\fR; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBoutport = \fR\fIP\fB\fR; +.br +\fBreg8[0\[char46]\[char46]15] = 0; +.br +\fBflags\[char46]loopback = 1; +.br +\fBnext; +.br +\fB \fR +.fi +.IP +where \fIH\fR is the \fBnexthop \fR defined in the router policy, \fIE\fR is the ethernet address of the logical router port from which the \fBnexthop\fR is reachable and \fIP\fR is the logical router port from which the \fBnexthop\fR is reachable\[char46] +.IP \(bu +If a router policy has the option \fBpkt_mark=\fIm\fB\fR set and if the action is \fBnot\fR drop, then the action also includes \fBpkt\[char46]mark = \fIm\fB\fR to mark the packet with the marker \fIm\fR\[char46] +.RE +.ST "Ingress Table 16: ECMP handling for router policies" +.PP +.PP +This table handles the ECMP for the router policies configured with multiple nexthops\[char46] +.RS +.IP \(bu +A priority\-150 flow is added to advance the packet to the next stage if the ECMP group id register \fBreg8[0\[char46]\[char46]15]\fR is 0\[char46] +.IP \(bu +For each ECMP reroute router policy with multiple nexthops, a priority\-100 flow is added for each nexthop \fIH\fR with the match \fBreg8[0\[char46]\[char46]15] == \fIGID\fB && +reg8[16\[char46]\[char46]31] == \fIM\fB\fR where \fIGID\fR is the router policy group id generated by \fBovn\-northd\fR and \fIM\fR is the member id of the nexthop \fIH\fR generated by \fBovn\-northd\fR\[char46] The following actions are added to the flow: +.IP +.nf +\fB +.br +\fB[xx]reg0 = \fR\fIH\fB\fR; +.br +\fBeth\[char46]src = \fR\fIE\fB\fR; +.br +\fBoutport = \fR\fIP\fB\fR +.br +\fB\(dqflags\[char46]loopback = 1; \(dq +.br +\fB\(dqnext;\(dq +.br +\fB \fR +.fi +.IP +where \fIH\fR is the \fBnexthop \fR defined in the router policy, \fIE\fR is the ethernet address of the logical router port from which the \fBnexthop\fR is reachable and \fIP\fR is the logical router port from which the \fBnexthop\fR is reachable\[char46] +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.ST "Ingress Table 17: ARP/ND Resolution" +.PP +.PP +Any packet that reaches this table is an IP packet whose next-hop IPv4 address is in \fBreg0\fR or IPv6 address is in \fBxxreg0\fR\[char46] (\fBip4\[char46]dst\fR or \fBip6\[char46]dst\fR contains the final destination\[char46]) This table resolves the IP address in \fBreg0\fR (or \fBxxreg0\fR) into an output port in \fBoutport\fR and an Ethernet address in \fBeth\[char46]dst\fR, using the following flows: +.RS +.IP \(bu +A priority\-500 flow that matches IP multicast traffic that was allowed in the routing pipeline\[char46] For this kind of traffic the \fBoutport\fR was already set so the flow just advances to the next table\[char46] +.IP \(bu +Priority\-200 flows that match ECMP reply traffic for the routes configured to use symmetric replies, with actions \fBpush(xxreg1); xxreg1 = ct_label; eth\[char46]dst = xxreg1[32\[char46]\[char46]79]; pop(xxreg1); next;\fR\[char46] \fBxxreg1\fR is used here to avoid masked access to ct_label, to make the flow HW-offloading friendly\[char46] +.IP \(bu +Static MAC bindings\[char46] MAC bindings can be known statically based on data in the \fBOVN_Northbound\fR database\[char46] For router ports connected to logical switches, MAC bindings can be known statically from the \fBaddresses\fR column in the \fBLogical_Switch_Port\fR table\[char46] (Note: the flow is not installed for IPs of logical switch ports of type \fBvirtual\fR, and dynamic MAC binding is used for those IPs instead, so that virtual parent failover does not depend on \fB +ovn\-northd\fR, to achieve better failover performance\[char46]) For router ports connected to other logical routers, MAC bindings can be known statically from the \fBmac\fR and \fBnetworks\fR column in the \fBLogical_Router_Port\fR table\[char46] (Note: the flow is NOT installed for the IP addresses that belong to a neighbor logical router port if the current router has the \fBoptions:dynamic_neigh_routers\fR set to \fBtrue\fR) +.IP +For each IPv4 address \fIA\fR whose host is known to have Ethernet address \fIE\fR on router port \fIP\fR, a priority\-100 flow with match \fBoutport === \fIP\fB +&& reg0 == \fIA\fB\fR has actions \fBeth\[char46]dst = \fIE\fB; next;\fR\[char46] +.IP +For each IPv6 address \fIA\fR whose host is known to have Ethernet address \fIE\fR on router port \fIP\fR, a priority\-100 flow with match \fBoutport === \fIP\fB +&& xxreg0 == \fIA\fB\fR has actions \fBeth\[char46]dst = \fIE\fB; next;\fR\[char46] +.IP +For each logical router port with an IPv4 address \fIA\fR and a mac address of \fIE\fR that is reachable via a different logical router port \fIP\fR, a priority\-100 flow with match \fBoutport === \fIP\fB && reg0 == +\fIA\fB\fR has actions \fBeth\[char46]dst = \fIE\fB; +next;\fR\[char46] +.IP +For each logical router port with an IPv6 address \fIA\fR and a mac address of \fIE\fR that is reachable via a different logical router port \fIP\fR, a priority\-100 flow with match \fBoutport === \fIP\fB && xxreg0 == +\fIA\fB\fR has actions \fBeth\[char46]dst = \fIE\fB; +next;\fR\[char46] +.IP \(bu +Static MAC bindings from NAT entries\[char46] MAC bindings can also be known for the entries in the \fBNAT\fR table\[char46] Below flows are programmed for distributed logical routers i\[char46]e with a distributed router port\[char46] +.IP +For each row in the \fBNAT\fR table with IPv4 address \fIA\fR in the \fBexternal_ip\fR column of \fBNAT\fR table, below two flows are programmed: +.IP +A priority\-100 flow with the match \fBoutport == \fIP\fB +&& reg0 == \fIA\fB\fR has actions \fBeth\[char46]dst = +\fIE\fB; next;\fR, where \fBP\fR is the distributed logical router port, \fIE\fR is the Ethernet address if set in the \fBexternal_mac\fR column of \fBNAT\fR table for of type \fBdnat_and_snat\fR, otherwise the Ethernet address of the distributed logical router port\[char46] Note that if the \fBexternal_ip\fR is not within a subnet on the owning logical router, then OVN will only create ARP resolution flows if the \fBoptions:add_route\fR is set to \fBtrue\fR\[char46] Otherwise, no ARP resolution flows will be added\[char46] +.IP +Corresponding to the above flow, a priority\-150 flow with the match \fBinport == \fIP\fB && outport == \fIP\fB +&& ip4\[char46]dst == \fIA\fB\fR has actions \fBdrop;\fR to exclude packets that have gone through DNAT/unSNAT stage but failed to convert the destination, to avoid loop\[char46] +.IP +For IPv6 NAT entries, same flows are added, but using the register \fBxxreg0\fR and field \fBip6\fR for the match\[char46] +.IP \(bu +If the router datapath runs a port with \fBredirect\-type\fR set to \fBbridged\fR, for each distributed NAT rule with IP \fIA\fR in the \fBlogical_ip\fR column and logical port \fIP\fR in the \fBlogical_port\fR column of \fBNAT\fR table, a priority\-90 flow with the match \fBoutport == \fIQ\fB && ip\[char46]src === +\fIA\fB && is_chassis_resident(\fIP\fB)\fR, where \fBQ\fR is the distributed logical router port and action \fBget_arp(outport, reg0); next;\fR for IPv4 and \fBget_nd(outport, xxreg0); next;\fR for IPv6\[char46] +.IP \(bu +Traffic with IP destination an address owned by the router should be dropped\[char46] Such traffic is normally dropped in ingress table \fBIP Input\fR except for IPs that are also shared with SNAT rules\[char46] However, if there was no unSNAT operation that happened successfully until this point in the pipeline and the destination IP of the packet is still a router owned IP, the packets can be safely dropped\[char46] +.IP +A priority\-2 logical flow with match \fBip4\[char46]dst = {\[char46]\[char46]}\fR matches on traffic destined to router owned IPv4 addresses which are also SNAT IPs\[char46] This flow has action \fBdrop;\fR\[char46] +.IP +A priority\-2 logical flow with match \fBip6\[char46]dst = {\[char46]\[char46]}\fR matches on traffic destined to router owned IPv6 addresses which are also SNAT IPs\[char46] This flow has action \fBdrop;\fR\[char46] +.IP +A priority\-0 logical that flow matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.IP \(bu +Dynamic MAC bindings\[char46] These flows resolve MAC-to-IP bindings that have become known dynamically through ARP or neighbor discovery\[char46] (The ingress table \fBARP Request\fR will issue an ARP or neighbor solicitation request for cases where the binding is not yet known\[char46]) +.IP +A priority\-0 logical flow with match \fBip4\fR has actions \fBget_arp(outport, reg0); next;\fR\[char46] +.IP +A priority\-0 logical flow with match \fBip6\fR has actions \fBget_nd(outport, xxreg0); next;\fR\[char46] +.IP \(bu +For a distributed gateway LRP with \fBredirect\-type\fR set to \fBbridged\fR, a priority\-50 flow will match \fBoutport == \(dqROUTER_PORT\(dq and !is_chassis_resident +(\(dqcr\-ROUTER_PORT\(dq)\fR has actions \fBeth\[char46]dst = \fIE\fB; +next;\fR, where \fIE\fR is the ethernet address of the logical router port\[char46] +.RE +.ST "Ingress Table 18: Check packet length" +.PP +.PP +For distributed logical routers or gateway routers with gateway port configured with \fBoptions:gateway_mtu\fR to a valid integer value, this table adds a priority\-50 logical flow with the match \fBoutport == \fIGW_PORT\fB\fR where \fIGW_PORT\fR is the gateway router port and applies the action \fBcheck_pkt_larger\fR and advances the packet to the next table\[char46] +.PP +.nf +\fB +.br +\fBREGBIT_PKT_LARGER = check_pkt_larger(\fR\fIL\fB\fR); next; +.br +\fB \fR +.fi +.PP +.PP +where \fIL\fR is the packet length to check for\[char46] If the packet is larger than \fIL\fR, it stores 1 in the register bit \fBREGBIT_PKT_LARGER\fR\[char46] The value of \fIL\fR is taken from \fBoptions:gateway_mtu\fR column of \fBLogical_Router_Port\fR row\[char46] +.PP +.PP +If the port is also configured with \fBoptions:gateway_mtu_bypass\fR then another flow is added, with priority\-55, to bypass the \fBcheck_pkt_larger\fR flow\[char46] +.PP +.PP +This table adds one priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.ST "Ingress Table 19: Handle larger packets" +.PP +.PP +For distributed logical routers or gateway routers with gateway port configured with \fBoptions:gateway_mtu\fR to a valid integer value, this table adds the following priority\-150 logical flow for each logical router port with the match \fBinport == \fILRP\fB +&& outport == \fIGW_PORT\fB && REGBIT_PKT_LARGER +&& !REGBIT_EGRESS_LOOPBACK\fR, where \fILRP\fR is the logical router port and \fIGW_PORT\fR is the gateway port and applies the following action for ipv4 and ipv6 respectively: +.PP +.nf +\fB +.br +\fBicmp4 { +.br +\fB icmp4\[char46]type = 3; /* Destination Unreachable\[char46] */ +.br +\fB icmp4\[char46]code = 4; /* Frag Needed and DF was Set\[char46] */ +.br +\fB icmp4\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = \fR\fIE\fB\fR; +.br +\fB ip4\[char46]dst = ip4\[char46]src; +.br +\fB ip4\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER = 0; +.br +\fB next(pipeline=ingress, table=0); +.br +\fB}; +.br +\fB +.br +\fBicmp6 { +.br +\fB icmp6\[char46]type = 2; +.br +\fB icmp6\[char46]code = 0; +.br +\fB icmp6\[char46]frag_mtu = \fR\fIM\fB\fR; +.br +\fB eth\[char46]dst = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]dst = ip6\[char46]src; +.br +\fB ip6\[char46]src = \fR\fII\fB\fR; +.br +\fB ip\[char46]ttl = 255; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB REGBIT_PKT_LARGER = 0; +.br +\fB next(pipeline=ingress, table=0); +.br +\fB}; +.br +\fB \fR +.fi +.RS +.IP \(bu +Where \fIM\fR is the (fragment MTU - 58) whose value is taken from \fBoptions:gateway_mtu\fR column of \fBLogical_Router_Port\fR row\[char46] +.IP \(bu +\fIE\fR is the Ethernet address of the logical router port\[char46] +.IP \(bu +\fII\fR is the IPv4/IPv6 address of the logical router port\[char46] +.RE +.PP +.PP +This table adds one priority\-0 fallback flow that matches all packets and advances to the next table\[char46] +.ST "Ingress Table 20: Gateway Redirect" +.PP +.PP +For distributed logical routers where one or more of the logical router ports specifies a gateway chassis, this table redirects certain packets to the distributed gateway port instances on the gateway chassises\[char46] This table has the following flows: +.RS +.IP \(bu +For each NAT rule in the OVN Northbound database that can be handled in a distributed manner, a priority\-100 logical flow with match \fBip4\[char46]src == \fIB\fB && +outport == \fIGW\fB\fR && is_chassis_resident(\fIP\fR), where \fIGW\fR is the distributed gateway port specified in the NAT rule and \fIP\fR is the NAT logical port\[char46] IP traffic matching the above rule will be managed locally setting \fBreg1\fR to \fIC\fR and \fBeth\[char46]src\fR to \fID\fR, where \fIC\fR is NAT external ip and \fID\fR is NAT external mac\[char46] +.IP \(bu +For each \fBdnat_and_snat\fR NAT rule with \fBstateless=true\fR and \fBallowed_ext_ips\fR configured, a priority\-75 flow is programmed with match \fBip4\[char46]dst == \fIB\fB\fR and action \fBoutport = \fICR\fB; next;\fR where \fIB\fR is the NAT rule external IP and \fICR\fR is the \fBchassisredirect\fR port representing the instance of the logical router distributed gateway port on the gateway chassis\[char46] Moreover a priority\-70 flow is programmed with same match and action \fBdrop;\fR\[char46] For each \fBdnat_and_snat\fR NAT rule with \fBstateless=true\fR and \fBexempted_ext_ips\fR configured, a priority\-75 flow is programmed with match \fBip4\[char46]dst == \fIB\fB\fR and action \fBdrop;\fR where \fIB\fR is the NAT rule external IP\[char46] A similar flow is added for IPv6 traffic\[char46] +.IP \(bu +For each NAT rule in the OVN Northbound database that can be handled in a distributed manner, a priority\-80 logical flow with drop action if the NAT logical port is a virtual port not claimed by any chassis yet\[char46] +.IP \(bu +A priority\-50 logical flow with match \fBoutport == \fIGW\fB\fR has actions \fBoutport = \fICR\fB; next;\fR, where \fIGW\fR is the logical router distributed gateway port and \fICR\fR is the \fBchassisredirect\fR port representing the instance of the logical router distributed gateway port on the gateway chassis\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Ingress Table 21: ARP Request" +.PP +.PP +In the common case where the Ethernet destination has been resolved, this table outputs the packet\[char46] Otherwise, it composes and sends an ARP or IPv6 Neighbor Solicitation request\[char46] It holds the following flows: +.RS +.IP \(bu +Unknown MAC address\[char46] A priority\-100 flow for IPv4 packets with match \fBeth\[char46]dst == 00:00:00:00:00:00\fR has the following actions: +.IP +.nf +\fB +.br +\fBarp { +.br +\fB eth\[char46]dst = ff:ff:ff:ff:ff:ff; +.br +\fB arp\[char46]spa = reg1; +.br +\fB arp\[char46]tpa = reg0; +.br +\fB arp\[char46]op = 1; /* ARP request\[char46] */ +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +Unknown MAC address\[char46] For each IPv6 static route associated with the router with the nexthop IP: \fIG\fR, a priority\-200 flow for IPv6 packets with match \fBeth\[char46]dst == 00:00:00:00:00:00 && +xxreg0 == \fIG\fB\fR with the following actions is added: +.IP +.nf +\fB +.br +\fBnd_ns { +.br +\fB eth\[char46]dst = \fR\fIE\fB\fR; +.br +\fB ip6\[char46]dst = \fR\fII\fB\fR +.br +\fB nd\[char46]target = \fR\fIG\fB\fR; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +Where \fIE\fR is the multicast mac derived from the Gateway IP, \fII\fR is the solicited-node multicast address corresponding to the target address \fIG\fR\[char46] +.IP +Unknown MAC address\[char46] A priority\-100 flow for IPv6 packets with match \fBeth\[char46]dst == 00:00:00:00:00:00\fR has the following actions: +.IP +.nf +\fB +.br +\fBnd_ns { +.br +\fB nd\[char46]target = xxreg0; +.br +\fB output; +.br +\fB}; +.br +\fB \fR +.fi +.IP +(Ingress table \fBIP Routing\fR initialized \fBreg1\fR with the IP address owned by \fBoutport\fR and \fB(xx)reg0\fR with the next-hop IP address) +.IP +The IP packet that triggers the ARP/IPv6 NS request is dropped\[char46] +.IP \(bu +Known MAC address\[char46] A priority\-0 flow with match \fB1\fR has actions \fBoutput;\fR\[char46] +.RE +.ST "Egress Table 0: Check DNAT local" +.PP +.PP +This table checks if the packet needs to be DNATed in the router ingress table \fBlr_in_dnat\fR after it is SNATed and looped back to the ingress pipeline\[char46] This check is done only for routers configured with distributed gateway ports and NAT entries\[char46] This check is done so that SNAT and DNAT is done in different zones instead of a common zone\[char46] +.RS +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBREGBIT_DST_NAT_IP_LOCAL = 0; next;\fR\[char46] +.RE +.ST "Egress Table 1: UNDNAT" +.PP +.PP +This is for already established connections\(cq reverse traffic\[char46] i\[char46]e\[char46], DNAT has already been done in ingress pipeline and now the packet has entered the egress pipeline as part of a reply\[char46] This traffic is unDNATed here\[char46] +.RS +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Egress Table 1: UNDNAT on Gateway Routers" +.RS +.IP \(bu +For IPv6 Neighbor Discovery or Router Solicitation/Advertisement traffic, a priority\-100 flow with action \fBnext;\fR\[char46] +.IP \(bu +For all IP packets, a priority\-50 flow with an action \fBflags\[char46]loopback = 1; ct_dnat;\fR\[char46] +.RE +.ST "Egress Table 1: UNDNAT on Distributed Routers" +.RS +.IP \(bu +For all the configured load balancing rules for a router with gateway port in \fBOVN_Northbound\fR database that includes an IPv4 address \fBVIP\fR, for every backend IPv4 address \fIB\fR defined for the \fBVIP\fR a priority\-120 flow is programmed on gateway chassis that matches \fBip && ip4\[char46]src == \fIB\fB && +outport == \fIGW\fB\fR, where \fIGW\fR is the logical router gateway port with an action \fBct_dnat;\fR\[char46] If the backend IPv4 address \fIB\fR is also configured with L4 port \fIPORT\fR of protocol \fIP\fR, then the match also includes \fBP\[char46]src\fR == \fIPORT\fR\[char46] These flows are not added for load balancers with IPv6 \fIVIPs\fR\[char46] +.IP +If the router is configured to force SNAT any load-balanced packets, above action will be replaced by \fBflags\[char46]force_snat_for_lb = 1; ct_dnat;\fR\[char46] +.IP \(bu +For each configuration in the OVN Northbound database that asks to change the destination IP address of a packet from an IP address of \fIA\fR to \fIB\fR, a priority\-100 flow matches \fBip && ip4\[char46]src == \fIB\fB +&& outport == \fIGW\fB\fR, where \fIGW\fR is the logical router gateway port, with an action \fBct_dnat;\fR\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBnext;\fR\[char46] +.IP +If the NAT rule cannot be handled in a distributed manner, then the priority\-100 flow above is only programmed on the gateway chassis with the action \fBct_dnat\fR\[char46] +.IP +If the NAT rule can be handled in a distributed manner, then there is an additional action \fBeth\[char46]src = \fIEA\fB;\fR, where \fIEA\fR is the ethernet address associated with the IP address \fIA\fR in the NAT rule\[char46] This allows upstream MAC learning to point to the correct chassis\[char46] +.RE +.ST "Egress Table 2: Post UNDNAT" +.PP +.PP +.RS +.IP \(bu +A priority\-50 logical flow is added that commits any untracked flows from the previous table \fBlr_out_undnat\fR for Gateway routers\[char46] This flow matches on \fBct\[char46]new && ip\fR with action \fBct_commit { } ; next; \fR\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Egress Table 3: SNAT" +.PP +.PP +Packets that are configured to be SNATed get their source IP address changed based on the configuration in the OVN Northbound database\[char46] +.RS +.IP \(bu +A priority\-120 flow to advance the IPv6 Neighbor solicitation packet to next table to skip SNAT\[char46] In the case where ovn-controller injects an IPv6 Neighbor Solicitation packet (for \fBnd_ns\fR action) we don\(cqt want the packet to go through conntrack\[char46] +.RE +.PP +.PP +Egress Table 3: SNAT on Gateway Routers +.RS +.IP \(bu +If the Gateway router in the OVN Northbound database has been configured to force SNAT a packet (that has been previously DNATted) to \fIB\fR, a priority\-100 flow matches \fBflags\[char46]force_snat_for_dnat == 1 && ip\fR with an action \fBct_snat(\fIB\fB);\fR\[char46] +.IP \(bu +If a load balancer configured to skip snat has been applied to the Gateway router pipeline, a priority\-120 flow matches \fBflags\[char46]skip_snat_for_lb == 1 && ip\fR with an action \fBnext;\fR\[char46] +.IP \(bu +If the Gateway router in the OVN Northbound database has been configured to force SNAT a packet (that has been previously load-balanced) using router IP (i\[char46]e \fBoptions\fR:lb_force_snat_ip=router_ip), then for each logical router port \fIP\fR attached to the Gateway router, a priority\-110 flow matches \fBflags\[char46]force_snat_for_lb == 1 && outport == \fIP\fB +\fR with an action \fBct_snat(\fIR\fB);\fR where \fIR\fR is the IP configured on the router port\[char46] If \fBR\fR is an IPv4 address then the match will also include \fBip4\fR and if it is an IPv6 address, then the match will also include \fBip6\fR\[char46] +.IP +If the logical router port \fIP\fR is configured with multiple IPv4 and multiple IPv6 addresses, only the first IPv4 and first IPv6 address is considered\[char46] +.IP \(bu +If the Gateway router in the OVN Northbound database has been configured to force SNAT a packet (that has been previously load-balanced) to \fIB\fR, a priority\-100 flow matches \fBflags\[char46]force_snat_for_lb == 1 && ip\fR with an action \fBct_snat(\fIB\fB);\fR\[char46] +.IP \(bu +For each configuration in the OVN Northbound database, that asks to change the source IP address of a packet from an IP address of \fIA\fR or to change the source IP address of a packet that belongs to network \fIA\fR to \fIB\fR, a flow matches \fBip && ip4\[char46]src == \fIA\fB && +(!ct\[char46]trk || !ct\[char46]rpl)\fR with an action \fBct_snat(\fIB\fB);\fR\[char46] The priority of the flow is calculated based on the mask of \fIA\fR, with matches having larger masks getting higher priorities\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBip4/6\[char46]src= +(\fIB\fB)\fR\[char46] +.IP \(bu +If the NAT rule has \fBallowed_ext_ips\fR configured, then there is an additional match \fBip4\[char46]dst == \fIallowed_ext_ips +\fB\fR\[char46] Similarly, for IPV6, match would be \fBip6\[char46]dst == +\fIallowed_ext_ips\fB\fR\[char46] +.IP \(bu +If the NAT rule has \fBexempted_ext_ips\fR set, then there is an additional flow configured at the priority + 1 of corresponding NAT rule\[char46] The flow matches if destination ip is an \fBexempted_ext_ip\fR and the action is \fBnext; +\fR\[char46] This flow is used to bypass the ct_snat action for a packet which is destinted to \fBexempted_ext_ips\fR\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.PP +.PP +Egress Table 3: SNAT on Distributed Routers +.RS +.IP \(bu +For each configuration in the OVN Northbound database, that asks to change the source IP address of a packet from an IP address of \fIA\fR or to change the source IP address of a packet that belongs to network \fIA\fR to \fIB\fR, two flows are added\[char46] The priority \fIP\fR of these flows are calculated based on the mask of \fIA\fR, with matches having larger masks getting higher priorities\[char46] +.IP +If the NAT rule cannot be handled in a distributed manner, then the below flows are only programmed on the gateway chassis increasing flow priority by 128 in order to be run first\[char46] +.RS +.IP \(bu +The first flow is added with the calculated priority \fIP\fR and match \fBip && ip4\[char46]src == \fIA\fB && +outport == \fIGW\fB\fR, where \fIGW\fR is the logical router gateway port, with an action \fBct_snat(\fIB\fB);\fR to SNATed in the common zone\[char46] If the NAT rule is of type dnat_and_snat and has \fBstateless=true\fR in the options, then the action would be \fBip4/6\[char46]src=(\fIB\fB)\fR\[char46] +.RE +.IP +If the NAT rule can be handled in a distributed manner, then there is an additional action (for both the flows) \fBeth\[char46]src = \fIEA\fB;\fR, where \fIEA\fR is the ethernet address associated with the IP address \fIA\fR in the NAT rule\[char46] This allows upstream MAC learning to point to the correct chassis\[char46] +.IP +If the NAT rule has \fBallowed_ext_ips\fR configured, then there is an additional match \fBip4\[char46]dst == \fIallowed_ext_ips +\fB\fR\[char46] Similarly, for IPV6, match would be \fBip6\[char46]dst == +\fIallowed_ext_ips\fB\fR\[char46] +.IP +If the NAT rule has \fBexempted_ext_ips\fR set, then there is an additional flow configured at the priority \fB\fIP\fB + 2 \fR of corresponding NAT rule\[char46] The flow matches if destination ip is an \fBexempted_ext_ip\fR and the action is \fBnext; +\fR\[char46] This flow is used to bypass the ct_snat action for a flow which is destinted to \fBexempted_ext_ips\fR\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Egress Table 4: Post SNAT" +.PP +.PP +Packets reaching this table are processed according to the flows below: +.RS +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and action \fBnext;\fR\[char46] +.RE +.ST "Egress Table 5: Egress Loopback" +.PP +.PP +For distributed logical routers where one of the logical router ports specifies a gateway chassis\[char46] +.PP +.PP +While UNDNAT and SNAT processing have already occurred by this point, this traffic needs to be forced through egress loopback on this distributed gateway port instance, in order for UNSNAT and DNAT processing to be applied, and also for IP routing and ARP resolution after all of the NAT processing, so that the packet can be forwarded to the destination\[char46] +.PP +.PP +This table has the following flows: +.RS +.IP \(bu +For each NAT rule in the OVN Northbound database on a distributed router, a priority\-100 logical flow with match \fBip4\[char46]dst == \fIE\fB && +outport == \fIGW\fB && +is_chassis_resident(\fIP\fB)\fR, where \fIE\fR is the external IP address specified in the NAT rule, \fIGW\fR is the distributed gateway port corresponding to the NAT rule (specified or inferred)\[char46] For dnat_and_snat NAT rule, \fIP\fR is the logical port specified in the NAT rule\[char46] If \fBlogical_port\fR column of \fBNAT\fR table is NOT set, then \fIP\fR is the \fBchassisredirect port\fR of \fIGW\fR with the following actions: +.IP +.nf +\fB +.br +\fBclone { +.br +\fB ct_clear; +.br +\fB inport = outport; +.br +\fB outport = \(dq\(dq; +.br +\fB flags = 0; +.br +\fB flags\[char46]loopback = 1; +.br +\fB reg0 = 0; +.br +\fB reg1 = 0; +.br +\fB \[char46]\[char46]\[char46] +.br +\fB reg9 = 0; +.br +\fB REGBIT_EGRESS_LOOPBACK = 1; +.br +\fB next(pipeline=ingress, table=0); +.br +\fB}; +.br +\fB \fR +.fi +.IP +\fBflags\[char46]loopback\fR is set since in_port is unchanged and the packet may return back to that port after NAT processing\[char46] \fBREGBIT_EGRESS_LOOPBACK\fR is set to indicate that egress loopback has occurred, in order to skip the source IP address check against the router address\[char46] +.IP \(bu +A priority\-0 logical flow with match \fB1\fR has actions \fBnext;\fR\[char46] +.RE +.ST "Egress Table 6: Delivery" +.PP +.PP +Packets that reach this table are ready for delivery\[char46] It contains: +.RS +.IP \(bu +Priority\-110 logical flows that match IP multicast packets on each enabled logical router port and modify the Ethernet source address of the packets to the Ethernet address of the port and then execute action \fBoutput;\fR\[char46] +.IP \(bu +Priority\-100 logical flows that match packets on each enabled logical router port, with action \fBoutput;\fR\[char46] +.IP \(bu +A priority\-0 logical flow that matches all packets not already handled (match \fB1\fR) and drops them (action \fBdrop;\fR)\[char46] +.RE +.SH "DROP SAMPLING" +.PP +.PP +As described in the previous section, there are several places where ovn-northd might decided to drop a packet by explicitly creating a \fBLogical_Flow\fR with the \fBdrop;\fR action\[char46] +.PP +.PP +When debug drop-sampling has been cofigured in the OVN Northbound database, the ovn-northd will replace all the \fBdrop;\fR actions with a \fBsample(priority=65535, collector_set=\fIid\fB, +obs_domain=\fIobs_id\fB, obs_point=@cookie)\fR action, where: +.RS +.IP \(bu +\fIid\fR is the value the \fBdebug_drop_collector_set\fR option configured in the OVN Northbound\[char46] +.IP \(bu +\fIobs_id\fR has it\(cqs 8 most significant bits equal to the value of the \fBdebug_drop_domain_id\fR option in the OVN Northbound and it\(cqs 24 least significant bits equal to the datapath\(cqs tunnel key\[char46] +.RE diff --git a/src/static/support/dist-docs-branch-23.06/ovn-northd.8.html b/src/static/support/dist-docs-branch-23.06/ovn-northd.8.html new file mode 100644 index 00000000..87b3c5d0 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-northd.8.html @@ -0,0 +1,3725 @@ +
+ovn-northd(8)                     OVN Manual                     ovn-northd(8)
+
+NAME
+       ovn-northd  and ovn-northd-ddlog - Open Virtual Network central control
+       daemon
+
+SYNOPSIS
+       ovn-northd [options]
+
+DESCRIPTION
+       ovn-northd is a centralized  daemon  responsible  for  translating  the
+       high-level  OVN  configuration into logical configuration consumable by
+       daemons such as ovn-controller. It translates the logical network  conā€
+       figuration  in  terms  of conventional network concepts, taken from the
+       OVN Northbound Database (see ovn-nb(5)), into logical datapath flows in
+       the OVN Southbound Database (see ovn-sb(5)) below it.
+
+       ovn-northd is implemented in C. ovn-northd-ddlog is a compatible impleā€
+       mentation written in DDlog, a language for  incremental  database  proā€
+       cessing.  This documentation applies to both implementations, with difā€
+       ferences indicated where relevant.
+
+OPTIONS
+       --ovnnb-db=database
+              The OVSDB database containing the OVN  Northbound  Database.  If
+              the  OVN_NB_DB environment variable is set, its value is used as
+              the default. Otherwise, the default is unix:/ovnnb_db.sock.
+
+       --ovnsb-db=database
+              The OVSDB database containing the OVN  Southbound  Database.  If
+              the  OVN_SB_DB environment variable is set, its value is used as
+              the default. Otherwise, the default is unix:/ovnsb_db.sock.
+
+       --ddlog-record=file
+              This option is for ovn-north-ddlog only. It causes the daemon to
+              record the initial database state and later changes to  file  in
+              the  text-based DDlog command format. The ovn_northd_cli program
+              can later replay these changes for debugging purposes. This  opā€
+              tion  has  a  performance impact. See debugging-ddlog.rst in the
+              OVN documentation for more details.
+
+       --dry-run
+              Causes  ovn-northd  to  start  paused.  In  the  paused   state,
+              ovn-northd does not apply any changes to the databases, although
+              it  continues  to  monitor  them.  For more information, see the
+              pause command, under Runtime Management Commands below.
+
+              For  ovn-northd-ddlog,  one   could   use   this   option   with
+              --ddlog-record  to  generate  a  replay log without restarting a
+              process or disturbing a running system.
+
+       n-threads N
+              In certain situations, it may  be  desirable  to  enable  paralā€
+              lelization  on  a  system  to decrease latency (at the potential
+              cost of increasing CPU usage).
+
+              This option will cause ovn-northd to use N threads when building
+              logical flows, when N is within [2-256]. If N is 1, parallelizaā€
+              tion is disabled (default behavior). If N is less than 1, then N
+              is set to 1,  parallelization  is  disabled  and  a  warning  is
+              logged.  If  N  is  more  than 256, then N is set to 256, paralā€
+              lelization is enabled  (with  256  threads)  and  a  warning  is
+              logged.
+
+              ovn-northd-ddlog does not support this option.
+
+       database  in  the above options must be an OVSDB active or passive conā€
+       nection method, as described in ovsdb(7).
+
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the PID of the running process. If the pidfile argument  is  not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By  default,  when --pidfile is specified and the specified pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs this program as a background process.  The  process  forks,
+              and  in  the  child it starts a new session, closes the standard
+              file descriptors (which has the side effect of disabling logging
+              to the console), and changes its current directory to  the  root
+              (unless  --no-chdir is specified). After the child completes its
+              initialization, the parent exits.
+
+       --monitor
+              Creates an additional process to monitor  this  program.  If  it
+              dies  due  to a signal that indicates a programming error (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This option is normally used with --detach, but  it  also  funcā€
+              tions without it.
+
+       --no-chdir
+              By  default,  when --detach is specified, the daemon changes its
+              current working directory to the root  directory  after  it  deā€
+              taches.  Otherwise, invoking the daemon from a carelessly chosen
+              directory would prevent the administrator  from  unmounting  the
+              file system that holds that directory.
+
+              Specifying  --no-chdir  suppresses this behavior, preventing the
+              daemon from changing its current working directory. This may  be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By  default  this daemon will try to self-confine itself to work
+              with files under  well-known  directories  determined  at  build
+              time.  It  is better to stick with this default behavior and not
+              to use this flag unless some other Access  Control  is  used  to
+              confine  daemon.  Note  that in contrast to other access control
+              implementations that are typically  enforced  from  kernel-space
+              (e.g.  DAC  or  MAC), self-confinement is imposed from the user-
+              space daemon itself and hence should not be considered as a full
+              confinement strategy, but instead should be viewed as  an  addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes  this  program  to  run  as a different user specified in
+              user:group, thus dropping most of  the  root  privileges.  Short
+              forms  user  and  :group  are also allowed, with current user or
+              group assumed, respectively. Only daemons started  by  the  root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES before dropping root  privileges.  Daemons
+              that  interact  with  a  datapath, such as ovs-vswitchd, will be
+              granted three  additional  capabilities,  namely  CAP_NET_ADMIN,
+              CAP_NET_BROADCAST  and  CAP_NET_RAW.  The capability change will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons, specifying this option will cause  the  daemon  process
+              not to start.
+
+   Logging Options
+       -v[spec]
+       --verbose=[spec]
+            Sets  logging  levels.  Without  any  spec, sets the log level for
+            every module and destination to dbg. Otherwise, spec is a list  of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A  valid module name, as displayed by the vlog/list command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog, console, or file, to limit the log level change  to
+                   only  to  the system log, to the console, or to a file, reā€
+                   spectively. (If --detach is specified,  the  daemon  closes
+                   its  standard  file  descriptors, so logging to the console
+                   will have no effect.)
+
+                   On Windows platform, syslog is accepted as a  word  and  is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off,  emer,  err,  warn,  info,  or dbg, to control the log
+                   level. Messages of the given severity  or  higher  will  be
+                   logged,  and  messages  of  lower severity will be filtered
+                   out. off filters out all messages. See ovs-appctl(8) for  a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless  of the log levels set for file, logging to a file will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets the maximum logging verbosity  level,  equivalent  to  --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets  the log pattern for destination to pattern. Refer to ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets the RFC5424 facility of the log message. facility can be  one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp,  ntp,  audit,  alert, clock2, local0, local1, local2, local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon is used as the default for the local system syslog and  loā€ā€
+            cal0  is  used  while sending a message to the target provided via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables logging to a file. If file is specified, then it  is  used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send  syslog messages to UDP port on host, in addition to the sysā€
+            tem syslog. The host must be a numerical IP address, not  a  hostā€
+            name.
+
+       --syslog-method=method
+            Specify  method  as  how  syslog messages should be sent to syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc, to use the libc syslog() function. Downside of  using
+                   this  options  is that libc adds fixed prefix to every mesā€
+                   sage before it is actually sent to the syslog  daemon  over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However,  rsyslogd  8.9  and  older versions use hard coded
+                   parser function anyway that limits UNIX domain socket  use.
+                   If  you  want  to  use  arbitrary message format with older
+                   rsyslogd versions, then use UDP socket to localhost IP  adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port,  to  use  a UDP socket. With this method it is
+                   possible to use arbitrary message format  also  with  older
+                   rsyslogd.  When sending syslog messages over UDP socket exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified UDP port, accidental iptables rules could  be  interā€
+                   fering  with  local syslog traffic and there are some secuā€
+                   rity considerations that apply to UDP sockets, but  do  not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The  default is taken from the OVS_SYSLOG_METHOD environment variā€
+            able; if it is unset, the default is libc.
+
+   PKI Options
+       PKI configuration is required in order to use SSL for  the  connections
+       to the Northbound and Southbound databases.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies  a  PEM  file  containing the private key used as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies a PEM file containing a certificate  that  certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate  authority  (CA) that the peer in SSL connections will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This may be the same certificate that  SSL  peers  use  to
+                   verify the certificate specified on -c or --certificate, or
+                   it  may  be a different one, depending on the PKI design in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables verification  of  certificates  presented  by  SSL
+                   peers.  This  introduces  a security risk, because it means
+                   that certificates cannot be verified to be those  of  known
+                   trusted hosts.
+
+   Other Options
+       --unixctl=socket
+              Sets the name of the control socket on which program listens for
+              runtime  management  commands  (see RUNTIME MANAGEMENT COMMANDS,
+              below). If socket does not begin with /, it  is  interpreted  as
+              relative  to  .  If  --unixctl  is  not used at all, the default
+              socket is /program.pid.ctl, where pid is programā€™s process ID.
+
+              On Windows a local named pipe is used to listen for runtime manā€
+              agement commands. A file is created  in  the  absolute  path  as
+              pointed  by socket or if --unixctl is not used at all, a file is
+              created as program in the configured OVS_RUNDIR  directory.  The
+              file exists just to mimic the behavior of a Unix domain socket.
+
+              Specifying none for socket disables the control socket feature.
+
+
+
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+RUNTIME MANAGEMENT COMMANDS
+       ovs-appctl  can send commands to a running ovn-northd process. The curā€
+       rently supported commands are described below.
+
+              exit   Causes ovn-northd to gracefully terminate.
+
+              pause  Pauses ovn-northd. When it is paused, ovn-northd receives
+                     changes  from  the  Northbound  and  Southbound  database
+                     changes  as  usual,  but  it does not send any updates. A
+                     paused ovn-northd also drops database locks, which allows
+                     any other non-paused instance of ovn-northd to take over.
+
+              resume Resumes the ovn-northd operation  to  process  Northbound
+                     and  Southbound  database  contents  and generate logical
+                     flows. This will also instruct ovn-northd to  aspire  for
+                     the lock on SB DB.
+
+              is-paused
+                     Returns "true" if ovn-northd is currently paused, "false"
+                     otherwise.
+
+              status Prints  this  serverā€™s status. Status will be "active" if
+                     ovn-northd has acquired OVSDB lock on SB DB, "standby" if
+                     it has not or "paused" if this instance is paused.
+
+              sb-cluster-state-reset
+                     Reset southbound database cluster status  when  databases
+                     are destroyed and rebuilt.
+
+                     If  all  databases in a clustered southbound database are
+                     removed from disk, then the stored index of all databases
+                     will be reset to zero. This will cause ovn-northd  to  be
+                     unable  to  read or write to the southbound database, beā€
+                     cause it will always detect the data as stale. In such  a
+                     case,  run this command so that ovn-northd will reset its
+                     local index so that it can interact with  the  southbound
+                     database again.
+
+              nb-cluster-state-reset
+                     Reset  northbound  database cluster status when databases
+                     are destroyed and rebuilt.
+
+                     This performs the same task as sb-cluster-state-reset exā€
+                     cept for the northbound database client.
+
+              set-n-threads N
+                     Set the number  of  threads  used  for  building  logical
+                     flows.  When  N is within [2-256], parallelization is enā€
+                     abled. When N is 1 parallelization is disabled. When N is
+                     less than 1 or more than 256, an error  is  returned.  If
+                     ovn-northd  fails to start parallelization (e.g. fails to
+                     setup semaphores, parallelization is disabled and an  erā€
+                     ror is returned.
+
+              get-n-threads
+                     Return  the  number  of threads used for building logical
+                     flows.
+
+              inc-engine/show-stats
+                     Display ovn-northd engine counters. For each engine  node
+                     the following counters have been added:
+
+                     ā€¢      recompute
+
+                     ā€¢      compute
+
+                     ā€¢      abort
+
+              inc-engine/show-stats engine_node_name counter_name
+                     Display  the  ovn-northd engine counter(s) for the speciā€
+                     fied engine_node_name. counter_name is optional  and  can
+                     be one of recompute, compute or abort.
+
+              inc-engine/clear-stats
+                     Reset ovn-northd engine counters.
+
+       Only ovn-northd-ddlog supports the following commands:
+
+              enable-cpu-profiling
+              disable-cpu-profiling
+                   Enables or disables profiling of CPU time used by the DDlog
+                   engine.  When CPU profiling is enabled, the profile command
+                   (see below) will include DDlog CPU usage statistics in  its
+                   output.  Enabling CPU profiling will slow ovn-northd-ddlog.
+                   Disabling CPU  profiling  does  not  clear  any  previously
+                   recorded statistics.
+
+              profile
+                   Outputs a profile of the current and peak sizes of arrangeā€
+                   ments  inside  DDlog. This profiling data can be useful for
+                   optimizing DDlog code. If CPU profiling was previously  enā€
+                   abled  (even if it was later disabled), the output also inā€
+                   cludes a CPU time profile. See Profiling inside the  tutorā€
+                   ial  in the DDlog repository for an introduction to profilā€
+                   ing DDlog.
+
+ACTIVE-STANDBY FOR HIGH AVAILABILITY
+       You may run ovn-northd more than once in an OVN deployment.  When  conā€
+       nected  to  a  standalone or clustered DB setup, OVN will automatically
+       ensure that only one of them is active at a time. If multiple instances
+       of ovn-northd are running and the active ovn-northd fails, one  of  the
+       hot standby instances of ovn-northd will automatically take over.
+
+   Active-Standby with multiple OVN DB servers
+       You may run multiple OVN DB servers in an OVN deployment with:
+
+              ā€¢      OVN  DB  servers deployed in active/passive mode with one
+                     active and multiple passive ovsdb-servers.
+
+              ā€¢      ovn-northd also deployed on all these nodes,  using  unix
+                     ctl sockets to connect to the local OVN DB servers.
+
+       In  such deployments, the ovn-northds on the passive nodes will process
+       the DB changes and compute logical flows to be thrown  out  later,  beā€
+       cause  write transactions are not allowed by the passive ovsdb-servers.
+       It results in unnecessary CPU usage.
+
+       With the help of  runtime  management  command  pause,  you  can  pause
+       ovn-northd  on these nodes. When a passive node becomes master, you can
+       use the runtime management command resume to resume the  ovn-northd  to
+       process the DB changes.
+
+LOGICAL FLOW TABLE STRUCTURE
+       One  of the main purposes of ovn-northd is to populate the Logical_Flow
+       table in  the  OVN_Southbound  database.  This  section  describes  how
+       ovn-northd does this for switch and router logical datapaths.
+
+   Logical Switch Datapaths
+     Ingress Table 0: Admission Control and Ingress Port Security check
+
+       Ingress table 0 contains these logical flows:
+
+              ā€¢      Priority 100 flows to drop packets with VLAN tags or mulā€
+                     ticast Ethernet source addresses.
+
+              ā€¢      For  each  disabled  logical port, a priority 100 flow is
+                     added which matches on all packets and applies the action
+                     REGBIT_PORT_SEC_DROP" = 1; next;" so that the packets are
+                     dropped in the next stage.
+
+              ā€¢      For each (enabled) vtep logical port, a priority 70  flow
+                     is added which matches on all packets and applies the acā€
+                     tion  next(pipeline=ingress, table=S_SWITCH_IN_L2_LKUP) =
+                     1; to skip most stages of ingress  pipeline  and  go  diā€
+                     rectly to ingress L2 lookup table to determine the output
+                     port.  Packets from VTEP (RAMP) switch should not be subā€
+                     jected to any ACL checks. Egress pipeline will do the ACL
+                     checks.
+
+              ā€¢      For each enabled logical port configured with qdisc queue
+                     id  in  the  options:qdisc_queue_id   column   of   Logiā€ā€
+                     cal_Switch_Port,  a  priority  70  flow  is  added  which
+                     matches  on  all   packets   and   applies   the   action
+                     set_queue(id);           REGBIT_PORT_SEC_DROP"          =
+                     check_in_port_sec(); next;".
+
+              ā€¢      A priority 1 flow is added which matches on  all  packets
+                     for  all  the  logical  ports and applies the action REGā€ā€
+                     BIT_PORT_SEC_DROP" = check_in_port_sec(); next; to evaluā€
+                     ate the port security. The action  check_in_port_sec  apā€
+                     plies  the  port security rules defined in the port_secuā€ā€
+                     rity column of Logical_Switch_Port table.
+
+     Ingress Table 1: Ingress Port Security - Apply
+
+       This table drops the packets if the port security check failed  in  the
+       previous stage i.e the register bit REGBIT_PORT_SEC_DROP is set to 1.
+
+       Ingress table 1 contains these logical flows:
+
+              ā€¢      A  priority-50 fallback flow that drops the packet if the
+                     register bit REGBIT_PORT_SEC_DROP is set to 1.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 2: Lookup MAC address learning table
+
+       This table looks up the MAC learning table of the logical switch  dataā€
+       path to check if the port-mac pair is present or not. MAC is learnt for
+       logical  switch VIF ports whose port security is disabled and ā€™unknownā€™
+       address  setn  as  well  as  for  localnet  ports  with  option  localā€
+       net_learn_fdb.  A localnet port entry does not overwrite a VIF port enā€
+       try.
+
+              ā€¢      For each such VIF logical port p whose port  security  is
+                     disabled  and  ā€™unknownā€™  address  set  following flow is
+                     added.
+
+                     ā€¢      Priority 100 flow with the match inport ==  p  and
+                            action  reg0[11]  =  lookup_fdb(inport,  eth.src);
+                            next;
+
+              ā€¢      For each such localnet logical port p following  flow  is
+                     added.
+
+                     ā€¢      Priority  100  flow with the match inport == p and
+                            action   flags.localnet   =    1;    reg0[11]    =
+                            lookup_fdb(inport, eth.src); next;
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 3: Learn MAC of ā€™unknownā€™ ports.
+
+       This table learns the MAC addresses seen on the VIF logical ports whose
+       port  security  is disabled and ā€™unknownā€™ address set as well as on loā€
+       calnet ports with localnet_learn_fdb option set if the  lookup_fdb  acā€
+       tion  returned  false  in  the previous table. For localnet ports (with
+       flags.localnet = 1), lookup_fdb returns true if (port, mac) is found or
+       if a mac is found for a port of type vif.
+
+              ā€¢      For each such VIF logical port p whose port  security  is
+                     disabled and ā€™unknownā€™ address set and localnet port folā€
+                     lowing flow is added.
+
+                     ā€¢      Priority  100  flow  with the match inport == p &&&&
+                            reg0[11] == 0 and action put_fdb(inport, eth.src);
+                            next; which stores the port-mac in the mac  learnā€
+                            ing  table  of the logical switch datapath and adā€
+                            vances the packet to the next table.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 4: from-lport Pre-ACLs
+
+       This table prepares flows  for  possible  stateful  ACL  processing  in
+       ingress  table  ACLs.  It  contains a priority-0 flow that simply moves
+       traffic to the next table. If stateful ACLs are  used  in  the  logical
+       datapath, a priority-100 flow is added that sets a hint (with reg0[0] =
+       1;  next;)  for table Pre-stateful to send IP packets to the connection
+       tracker before eventually advancing to ingress table ACLs.  If  special
+       ports  such  as  route ports or localnet ports canā€™t use ct(), a priorā€
+       ity-110 flow is added to  skip  over  stateful  ACLs.  Multicast,  IPv6
+       Neighbor  Discovery  and MLD traffic also skips stateful ACLs. For "alā€
+       low-stateless" ACLs, a flow is added to bypass  setting  the  hint  for
+       connection tracker processing when there are stateful ACLs or LB rules;
+       REGBIT_ACL_STATELESS is set for traffic matching stateless ACL flows.
+
+       This table also has a priority-110 flow with the match eth.dst == E for
+       all logical switch datapaths to move traffic to the next table. Where E
+       is  the service monitor mac defined in the options:svc_monitor_mac colā€
+       umn of NB_Global table.
+
+     Ingress Table 5: Pre-LB
+
+       This table prepares flows for possible stateful load balancing processā€
+       ing in ingress table LB and Stateful. It  contains  a  priority-0  flow
+       that  simply  moves traffic to the next table. Moreover it contains two
+       priority-110 flows to move multicast, IPv6 Neighbor Discovery  and  MLD
+       traffic  to  the next table. It also contains two priority-110 flows to
+       move stateless traffic, i.e traffic for which  REGBIT_ACL_STATELESS  is
+       set,  to  the  next  table. If load balancing rules with virtual IP adā€
+       dresses (and ports) are configured in  OVN_Northbound  database  for  a
+       logical switch datapath, a priority-100 flow is added with the match ip
+       to match on IP packets and sets the action reg0[2] = 1; next; to act as
+       a  hint  for  table  Pre-stateful  to send IP packets to the connection
+       tracker for packet de-fragmentation (and to possibly do  DNAT  for  alā€
+       ready established load balanced traffic) before eventually advancing to
+       ingress  table  Stateful. If controller_event has been enabled and load
+       balancing rules with empty backends have been added in  OVN_Northbound,
+       a 130 flow is added to trigger ovn-controller events whenever the chasā€
+       sis  receives  a packet for that particular VIP. If event-elb meter has
+       been previously created, it will be associated to the empty_lb  logical
+       flow
+
+       Prior  to OVN 20.09 we were setting the reg0[0] = 1 only if the IP desā€
+       tination matches the load balancer VIP. However  this  had  few  issues
+       cases  where  a logical switch doesnā€™t have any ACLs with allow-related
+       action. To understand the issue lets a  take  a  TCP  load  balancer  -
+       10.0.0.10:80=10.0.0.3:80.  If  a  logical  port - p1 with IP - 10.0.0.5
+       opens a TCP connection with the VIP - 10.0.0.10, then the packet in the
+       ingress pipeline of ā€™p1ā€™ is sent to the p1ā€™s conntrack zone id and  the
+       packet is load balanced to the backend - 10.0.0.3. For the reply packet
+       from  the  backend  lport,  it  is not sent to the conntrack of backend
+       lportā€™s zone id. This is fine as long as the packet is  valid.  Suppose
+       the  backend lport sends an invalid TCP packet (like incorrect sequence
+       number), the packet gets delivered to the lport ā€™p1ā€™ without  unDNATing
+       the packet to the VIP - 10.0.0.10. And this causes the connection to be
+       reset by the lport p1ā€™s VIF.
+
+       We canā€™t fix this issue by adding a logical flow to drop ct.inv packets
+       in  the  egress  pipeline  since it will drop all other connections not
+       destined to the load balancers. To fix this  issue,  we  send  all  the
+       packets  to the conntrack in the ingress pipeline if a load balancer is
+       configured. We can now add a lflow to drop ct.inv packets.
+
+       This table also has priority-120 flows that punt all  IGMP/MLD  packets
+       to  ovn-controller  if the switch is an interconnect switch with multiā€
+       cast snooping enabled.
+
+       This table also has a priority-110 flow with the match eth.dst == E for
+       all logical switch datapaths to move traffic to the next table. Where E
+       is the service monitor mac defined in the options:svc_monitor_mac  colā€
+       umn of NB_Global table.
+
+       This  table also has a priority-110 flow with the match inport == I for
+       all logical switch datapaths to move traffic to the next table. Where I
+       is the peer of a logical router port. This flow is added  to  skip  the
+       connection tracking of packets which enter from logical router datapath
+       to logical switch datapath.
+
+     Ingress Table 6: Pre-stateful
+
+       This  table prepares flows for all possible stateful processing in next
+       tables. It contains a priority-0 flow that simply moves traffic to  the
+       next table.
+
+              ā€¢      Priority-120  flows  that  send the packets to connection
+                     tracker using ct_lb_mark; as the action so that  the  alā€
+                     ready  established  traffic destined to the load balancer
+                     VIP gets DNATted. These flows  match  each  VIPs  IP  and
+                     port.  For  IPv4 traffic the flows also load the original
+                     destination IP and transport port in registers  reg1  and
+                     reg2.  For  IPv6 traffic the flows also load the original
+                     destination IP and transport port in registers xxreg1 and
+                     reg2.
+
+              ā€¢      A priority-110 flow sends the packets  that  donā€™t  match
+                     the  above  flows  to  connection tracker based on a hint
+                     provided by the previous tables (with a match for reg0[2]
+                     == 1) by using the ct_lb_mark; action.
+
+              ā€¢      A priority-100  flow  sends  the  packets  to  connection
+                     tracker  based  on a hint provided by the previous tables
+                     (with a match for reg0[0] == 1) by using the ct_next; acā€
+                     tion.
+
+     Ingress Table 7: from-lport ACL hints
+
+       This table consists of logical flows that set hints (reg0 bits)  to  be
+       used  in  the next stage, in the ACL processing table, if stateful ACLs
+       or load balancers are configured. Multiple hints can  be  set  for  the
+       same packet. The possible hints are:
+
+              ā€¢      reg0[7]:  the packet might match an allow-related ACL and
+                     might have to commit the connection to conntrack.
+
+              ā€¢      reg0[8]: the packet might match an allow-related ACL  but
+                     there  will  be  no need to commit the connection to conā€
+                     ntrack because it already exists.
+
+              ā€¢      reg0[9]: the packet might match a drop/reject.
+
+              ā€¢      reg0[10]: the packet might match a  drop/reject  ACL  but
+                     the connection was previously allowed so it might have to
+                     be committed again with ct_label=1/1.
+
+       The table contains the following flows:
+
+              ā€¢      A priority-65535 flow to advance to the next table if the
+                     logical switch has no ACLs configured, otherwise a priorā€
+                     ity-0 flow to advance to the next table.
+
+              ā€¢      A priority-7 flow that matches on packets that initiate a
+                     new  session. This flow sets reg0[7] and reg0[9] and then
+                     advances to the next table.
+
+              ā€¢      A priority-6 flow that matches on packets that are in the
+                     request direction of an already existing session that has
+                     been marked  as  blocked.  This  flow  sets  reg0[7]  and
+                     reg0[9] and then advances to the next table.
+
+              ā€¢      A  priority-5  flow  that matches untracked packets. This
+                     flow sets reg0[8] and reg0[9] and then  advances  to  the
+                     next table.
+
+              ā€¢      A priority-4 flow that matches on packets that are in the
+                     request direction of an already existing session that has
+                     not  been  marked  as blocked. This flow sets reg0[8] and
+                     reg0[10] and then advances to the next table.
+
+              ā€¢      A priority-3 flow that matches on packets that are in not
+                     part of established sessions. This flow sets reg0[9]  and
+                     then advances to the next table.
+
+              ā€¢      A  priority-2  flow that matches on packets that are part
+                     of  an  established  session  that  has  been  marked  as
+                     blocked.  This flow sets reg0[9] and then advances to the
+                     next table.
+
+              ā€¢      A priority-1 flow that matches on packets that  are  part
+                     of  an  established  session  that has not been marked as
+                     blocked. This flow sets reg0[10] and then advances to the
+                     next table.
+
+     Ingress table 8: from-lport ACL evaluation before LB
+
+       Logical flows in this table closely reproduce those in the ACL table in
+       the OVN_Northbound database for the from-lport  direction  without  the
+       option apply-after-lb set or set to false. The priority values from the
+       ACL  table  have  a  limited range and have 1000 added to them to leave
+       room for OVN default flows at both higher and lower priorities.
+
+              ā€¢      This table is responsible for evaluating ACLs,  and  setā€
+                     ting  a  register bit to indicate whether the ACL decided
+                     to allow, drop, or reject the traffic. The allow  bit  is
+                     reg8[16]. The drop bit is reg8[17]. All flows in this taā€
+                     ble  will advance the packet to the next table, where the
+                     bits from before are evaluated to determine  what  to  do
+                     with  the packet. Any flows in this table that intend for
+                     the packet to pass will set reg8[16] to 1, even if an ACL
+                     with an allow-type action was not matched. This lets  the
+                     next  table know to allow the traffic to pass. These bits
+                     will be referred to as the "allow", "drop", and  "reject"
+                     bits in the upcoming paragraphs.
+
+              ā€¢      If  the  tier column has been configured on the ACL, then
+                     OVN will also match the current tier counter against  the
+                     configured  ACL tier. OVN keeps count of the current tier
+                     in reg8[30..31].
+
+              ā€¢      allow ACLs translate into logical flows that set the  alā€
+                     low bit to 1 and advance the packet to the next table. If
+                     there  are any stateful ACLs on this datapath, then allow
+                     ACLs set the allow bit to one  and  in  addition  perform
+                     ct_commit;  (which  acts  as  a hint for future tables to
+                     commit the connection to conntrack). In case the ACL  has
+                     a  label  then  reg3  is  loaded with the label value and
+                     reg0[13] bit is set to 1 (which acts as a  hint  for  the
+                     next tables to commit the label to conntrack).
+
+              ā€¢      allow-related  ACLs translate into logical flows that set
+                     the allow  bit  and  additionally  have  ct_commit(ct_laā€ā€
+                     bel=0/1); next; actions for new connections and reg0[1] =
+                     1;  next; for existing connections. In case the ACL has a
+                     label then reg3  is  loaded  with  the  label  value  and
+                     reg0[13]  bit  is  set to 1 (which acts as a hint for the
+                     next tables to commit the label to conntrack).
+
+              ā€¢      allow-stateless ACLs translate into  logical  flows  that
+                     set the allow bit and advance to the next table.
+
+              ā€¢      reject  ACLs  translate  into logical flows with that set
+                     the reject bit and advance to the next table.
+
+              ā€¢      pass ACLs translate into logical flows that  do  not  set
+                     the  allow,  drop,  or reject bit and advance to the next
+                     table.
+
+              ā€¢      Other ACLs set the drop bit and advance to the next table
+                     for new or untracked connections. For known  connections,
+                     they  set  the  drop  bit, as well as running the ct_comā€ā€
+                     mit(ct_label=1/1); action. Setting ct_label marks a  conā€
+                     nection as one that was previously allowed, but should no
+                     longer be allowed due to a policy change.
+
+       This  table contains a priority-65535 flow to set the allow bit and adā€
+       vance to the next table if the logical switch has no  ACLs  configured,
+       otherwise a priority-0 flow to advance to the next table is added. This
+       flow  does  not  set  the  allow bit, so that the next table can decide
+       whether to allow or drop the packet based  on  the  value  of  the  opā€ā€
+       tions:default_acl_drop column of the NB_Global table.
+
+       A  priority-65532 flow is added that sets the allow bit for IPv6 Neighā€
+       bor solicitation, Neighbor discover, Router solicitation, Router adverā€
+       tisement and MLD packets regardless of other ACLs defined.
+
+       If the logical datapath has a stateful ACL or a load balancer with  VIP
+       configured, the following flows will also be added:
+
+              ā€¢      If  options:default_acl_drop column of NB_Global is false
+                     or not set, a priority-1 flow that sets the hint to  comā€
+                     mit  IP  traffic that is not part of established sessions
+                     to the connection  tracker  (with  action  reg0[1]  =  1;
+                     next;).  This  is needed for the default allow policy beā€
+                     cause, while the initiatorā€™s direction may not  have  any
+                     stateful  rules,  the  serverā€™s  may  and then its return
+                     traffic would not be known and marked as invalid.
+
+              ā€¢      A priority-1 flow that sets the allow bit  and  sets  the
+                     hint to commit IP traffic to the connection tracker (with
+                     action  reg0[1]  =  1; next;). This is needed for the deā€
+                     fault allow policy because, while the initiatorā€™s  direcā€
+                     tion  may  not  have any stateful rules, the serverā€™s may
+                     and then its return traffic would not be known and marked
+                     as invalid.
+
+              ā€¢      A priority-65532 flow that sets the  allow  bit  for  any
+                     traffic  in the reply direction for a connection that has
+                     been committed to the connection  tracker  (i.e.,  estabā€
+                     lished  flows),  as  long  as the committed flow does not
+                     have ct_mark.blocked set. We only handle traffic  in  the
+                     reply direction here because we want all packets going in
+                     the  request direction to still go through the flows that
+                     implement the currently defined policy based on ACLs.  If
+                     a   connection   is   no   longer   allowed   by  policy,
+                     ct_mark.blocked will get set and packets in the reply diā€
+                     rection will no longer be allowed, either. This flow also
+                     clears the register bits reg0[9] and  reg0[10]  and  sets
+                     register  bit reg0[17]. If ACL logging and logging of reā€
+                     lated packets is enabled, then a companion priority-65533
+                     flow will be installed that accomplishes the  same  thing
+                     but also logs the traffic.
+
+              ā€¢      A  priority-65532  flow  that  sets the allow bit for any
+                     traffic that is considered related to a committed flow in
+                     the connection tracker (e.g., an  ICMP  Port  Unreachable
+                     from  a non-listening UDP port), as long as the committed
+                     flow does not have ct_mark.blocked set.  This  flow  also
+                     applies  NAT  to the related traffic so that ICMP headers
+                     and the inner packet have correct addresses. If ACL  logā€
+                     ging  and  logging  of related packets is enabled, then a
+                     companion priority-65533 flow will be installed that  acā€
+                     complishes the same thing but also logs the traffic.
+
+              ā€¢      A  priority-65532  flow  that  sets  the drop bit for all
+                     traffic marked by the connection tracker as invalid.
+
+              ā€¢      A priority-65532 flow that sets  the  drop  bit  for  all
+                     traffic  in  the reply direction with ct_mark.blocked set
+                     meaning that the connection should no longer  be  allowed
+                     due  to a policy change. Packets in the request direction
+                     are skipped here to let a newly created ACL re-allow this
+                     connection.
+
+       If the logical datapath has any ACL or a load balancer with VIP configā€
+       ured, the following flow will also be added:
+
+              ā€¢      A priority 34000 logical flow is added for  each  logical
+                     switch  datapath  with the match eth.dst = E to allow the
+                     service monitor reply packet destined  to  ovn-controller
+                     that  sets  the allow bit, where E is the service monitor
+                     mac defined  in  the  options:svc_monitor_mac  column  of
+                     NB_Global table.
+
+     Ingress Table 9: from-lport ACL action
+
+       Logical  flows  in this table decide how to proceed based on the values
+       of the allow, drop, and reject bits that may have been set in the  preā€
+       vious table.
+
+              ā€¢      If  no ACLs are configured, then a priority 0 flow is inā€
+                     stalled that matches everything and advances to the  next
+                     table.
+
+              ā€¢      A  priority  1000 flow is installed that will advance the
+                     packet to the next table if the allow bit is set.
+
+              ā€¢      A priority 1000 flow is installed that will run the drop;
+                     action if the drop bit is set.
+
+              ā€¢      A priority 1000 flow  is  installed  that  will  run  the
+                     tcp_reset  {  output ->gt;>gt; inport; next(pipeline=egress,taā€ā€
+                     ble=5);} action for  TCP  connections,icmp4/icmp6  action
+                     for  UDP  connections,  and sctp_abort {output -%gt; inā€ā€
+                     port; next(pipeline=egress,table=5);} action for SCTP asā€
+                     sociations.
+
+              ā€¢      If any ACLs have tiers configured  on  them,  then  three
+                     priority  500  flows  are  installed. If the current tier
+                     counter is 0, 1, or 2, then the current tier  counter  is
+                     incremented  by  one  and  the packet is sent back to the
+                     previous table for re-evaluation.
+
+     Ingress Table 10: from-lport QoS Marking
+
+       Logical flows in this table closely reproduce those in  the  QoS  table
+       with  the  action  column  set  in  the OVN_Northbound database for the
+       from-lport direction.
+
+              ā€¢      For every qos_rules entry in a logical switch  with  DSCP
+                     marking  enabled,  a  flow  will be added at the priority
+                     mentioned in the QoS table.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 11: from-lport QoS Meter
+
+       Logical flows in this table closely reproduce those in  the  QoS  table
+       with  the  bandwidth  column set in the OVN_Northbound database for the
+       from-lport direction.
+
+              ā€¢      For every qos_rules entry in a logical switch with meterā€
+                     ing enabled, a flow will be added at  the  priority  menā€
+                     tioned in the QoS table.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 12: Load balancing affinity check
+
+       Load  balancing  affinity  check  table  contains the following logical
+       flows:
+
+              ā€¢      For all the configured load balancing rules for a  switch
+                     in  OVN_Northbound  database  where  a  positive affinity
+                     timeout is specified in options column, that  includes  a
+                     L4  port  PORT of protocol P and IP address VIP, a priorā€
+                     ity-100 flow is added. For IPv4 VIPs,  the  flow  matches
+                     ct.new &&&& ip &&&& ip4.dst == VIP &&&& P.dst == PORT. For IPv6
+                     VIPs, the flow matches ct.new &&&& ip &&&& ip6.dst == VIP&&&& P
+                     &&&&  P.dst  ==   PORT.  The  flowā€™s  action  is  reg9[6] =
+                     chk_lb_aff(); next;.
+
+              ā€¢      A priority 0 flow is added which matches on  all  packets
+                     and applies the action next;.
+
+     Ingress Table 13: LB
+
+              ā€¢      For  all the configured load balancing rules for a switch
+                     in OVN_Northbound  database  where  a  positive  affinity
+                     timeout  is  specified in options column, that includes a
+                     L4 port PORT of protocol P and IP address VIP,  a  priorā€
+                     ity-150  flow  is  added. For IPv4 VIPs, the flow matches
+                     reg9[6] == 1 &&&& ct.new &&&& ip &&&& ip4.dst == VIP  &&&&  P.dst
+                     == PORT . For IPv6 VIPs, the flow matches reg9[6] == 1 &&&&
+                     ct.new  &&&&  ip &&&& ip6.dst ==  VIP &&&& P &&&& P.dst ==  PORT.
+                     The flowā€™s action is ct_lb_mark(args),  where  args  conā€
+                     tains  comma  separated  IP  addresses (and optional port
+                     numbers) to load balance to. The address family of the IP
+                     addresses of args is the same as the  address  family  of
+                     VIP.
+
+              ā€¢      For  all the configured load balancing rules for a switch
+                     in OVN_Northbound database that includes a L4  port  PORT
+                     of  protocol P and IP address VIP, a priority-120 flow is
+                     added. For IPv4 VIPs , the flow matches ct.new &&&&  ip  &&&&
+                     ip4.dst  == VIP &&&& P.dst == PORT. For IPv6 VIPs, the flow
+                     matches ct.new &&&& ip &&&& ip6.dst == VIP &&&& P &&&&  P.dst  ==
+                     PORT.  The flowā€™s action is ct_lb_mark(args) , where args
+                     contains comma separated IP addresses (and optional  port
+                     numbers) to load balance to. The address family of the IP
+                     addresses  of  args  is the same as the address family of
+                     VIP. If health check is enabled, then args will only conā€
+                     tain those endpoints whose service monitor  status  entry
+                     in  OVN_Southbound db is either online or empty. For IPv4
+                     traffic the flow also loads the original  destination  IP
+                     and  transport  port in registers reg1 and reg2. For IPv6
+                     traffic the flow also loads the original  destination  IP
+                     and  transport  port  in  registers  xxreg1 and reg2. The
+                     above flow is created even if the load  balancer  is  atā€
+                     tached to a logical router connected to the current logiā€
+                     cal  switch and the install_ls_lb_from_router variable in
+                     options is set to true.
+
+              ā€¢      For all the configured load balancing rules for a  switch
+                     in  OVN_Northbound  database that includes just an IP adā€
+                     dress VIP to match on, OVN adds a priority-110 flow.  For
+                     IPv4  VIPs,  the  flow matches ct.new &&&& ip &&&& ip4.dst ==
+                     VIP. For IPv6 VIPs, the flow  matches  ct.new  &&&&  ip  &&&&
+                     ip6.dst   ==   VIP.   The   action   on   this   flow  is
+                     ct_lb_mark(args), where args contains comma separated  IP
+                     addresses  of  the  same  address family as VIP. For IPv4
+                     traffic the flow also loads the original  destination  IP
+                     and  transport  port in registers reg1 and reg2. For IPv6
+                     traffic the flow also loads the original  destination  IP
+                     and  transport  port  in  registers  xxreg1 and reg2. The
+                     above flow is created even if the load  balancer  is  atā€
+                     tached to a logical router connected to the current logiā€
+                     cal  switch and the install_ls_lb_from_router variable in
+                     options is set to true.
+
+              ā€¢      If the load balancer is created with --reject option  and
+                     it  has no active backends, a TCP reset segment (for tcp)
+                     or an ICMP port unreachable packet (for all other kind of
+                     traffic) will be sent whenever an incoming packet is  reā€
+                     ceived for this load-balancer. Please note using --reject
+                     option will disable empty_lb SB controller event for this
+                     load balancer.
+
+     Ingress Table 14: Load balancing affinity learn
+
+       Load  balancing  affinity  learn  table  contains the following logical
+       flows:
+
+              ā€¢      For all the configured load balancing rules for a  switch
+                     in  OVN_Northbound  database  where  a  positive affinity
+                     timeout T is specified in options column, that includes a
+                     L4 port PORT of protocol P and IP address VIP,  a  priorā€
+                     ity-100  flow  is  added. For IPv4 VIPs, the flow matches
+                     reg9[6] == 0 &&&& ct.new &&&& ip &&&& ip4.dst == VIP  &&&&  P.dst
+                     ==  PORT. For IPv6 VIPs, the flow matches ct.new &&&& ip &&&&
+                     ip6.dst == VIP &&&& P &&&& P.dst == PORT . The flowā€™s  action
+                     is  commit_lb_aff(vip  =  VIP:PORT, backend = backend ip:
+                     backend port, proto = P, timeout = T); .
+
+              ā€¢      A priority 0 flow is added which matches on  all  packets
+                     and applies the action next;.
+
+     Ingress Table 15: Pre-Hairpin
+
+              ā€¢      If  the  logical  switch has load balancer(s) configured,
+                     then a priority-100 flow is added with the  match  ip  &&&&
+                     ct.trk  to check if the packet needs to be hairpinned (if
+                     after load  balancing  the  destination  IP  matches  the
+                     source  IP)  or  not  by  executing the actions reg0[6] =
+                     chk_lb_hairpin(); and reg0[12] =  chk_lb_hairpin_reply();
+                     and advances the packet to the next table.
+
+              ā€¢      A  priority-0  flow that simply moves traffic to the next
+                     table.
+
+     Ingress Table 16: Nat-Hairpin
+
+              ā€¢      If the logical switch has  load  balancer(s)  configured,
+                     then  a  priority-100  flow is added with the match ip &&&&
+                     ct.new &&&& ct.trk &&&& reg0[6] == 1 which hairpins the trafā€
+                     fic by NATting source IP to the load balancer VIP by exeā€
+                     cuting the action ct_snat_to_vip and advances the  packet
+                     to the next table.
+
+              ā€¢      If  the  logical  switch has load balancer(s) configured,
+                     then a priority-100 flow is added with the  match  ip  &&&&
+                     ct.est &&&& ct.trk &&&& reg0[6] == 1 which hairpins the trafā€
+                     fic by NATting source IP to the load balancer VIP by exeā€
+                     cuting  the action ct_snat and advances the packet to the
+                     next table.
+
+              ā€¢      If the logical switch has  load  balancer(s)  configured,
+                     then  a  priority-90  flow  is added with the match ip &&&&
+                     reg0[12] == 1 which matches on the replies of  hairpinned
+                     traffic  (i.e.,  destination  IP is VIP, source IP is the
+                     backend IP and source L4 port is backend port for L4 load
+                     balancers) and executes ct_snat and advances  the  packet
+                     to the next table.
+
+              ā€¢      A  priority-0  flow that simply moves traffic to the next
+                     table.
+
+     Ingress Table 17: Hairpin
+
+              ā€¢      If logical switch has attached  logical  switch  port  of
+                     vtep  type, then for each distributed gateway router port
+                     RP attached to this logical switch and has chassis  rediā€
+                     rect  port  cr-RP, a priority-2000 flow is added with the
+                     match .IP
+                     reg0[14] == 1 &&&& is_chassis_resident(cr-RP)
+
+                     and action next;.
+
+                     reg0[14] register bit is set in the ingress L2 port secuā€
+                     rity check table for traffic received from HW VTEP (ramp)
+                     ports.
+
+              ā€¢      If logical switch has attached  logical  switch  port  of
+                     vtep  type,  then  a  priority-1000  flow that matches on
+                     reg0[14] register bit for the traffic  received  from  HW
+                     VTEP  (ramp) ports. This traffic is passed to ingress taā€
+                     ble ls_in_l2_lkup.
+
+              ā€¢      A priority-1 flow that hairpins traffic matched  by  non-
+                     default  flows  in  the Pre-Hairpin table. Hairpinning is
+                     done at L2, Ethernet addresses are swapped and the  packā€
+                     ets are looped back on the input port.
+
+              ā€¢      A  priority-0  flow that simply moves traffic to the next
+                     table.
+
+     Ingress table 18: from-lport ACL evaluation after LB
+
+       Logical flows in this table closely reproduce those in the ACL eval taā€
+       ble in the OVN_Northbound database for the  from-lport  direction  with
+       the option apply-after-lb set to true. The priority values from the ACL
+       table  have  a  limited range and have 1000 added to them to leave room
+       for OVN default flows at both higher and lower priorities. The flows in
+       this table indicate the ACL verdict by setting reg8[16] for  allow-type
+       ACLs,  reg8[17]  for  drop ACLs, and reg8[17] for reject ACLs, and then
+       advancing the packet to the next table. These will be  reffered  to  as
+       the  allow  bit,  drop bit, and reject bit throughout the documentation
+       for this table and the next one.
+
+       Like with ACLs that are evaluated before load balancers, if the ACL  is
+       configured  with  a tier value, then the current tier counter, supplied
+       in reg8[30..31] is matched against the ACLā€™s configured tier  in  addiā€
+       tion to the ACLā€™s match.
+
+              ā€¢      allow  apply-after-lb  ACLs  translate into logical flows
+                     that set the allow bit. If there are  any  stateful  ACLs
+                     (including  both  before-lb  and  after-lb  ACLs) on this
+                     datapath, then  allow  ACLs  also  run  ct_commit;  next;
+                     (which acts as a hint for an upcoming table to commit the
+                     connection  to  conntrack).  In  case the ACL has a label
+                     then reg3 is loaded with the label value and reg0[13] bit
+                     is set to 1 (which acts as a hint for the next tables  to
+                     commit the label to conntrack).
+
+              ā€¢      allow-related  apply-after-lb ACLs translate into logical
+                     flows that set the allow bit and run the ct_commit(ct_laā€ā€
+                     bel=0/1); next; actions for new connections and reg0[1] =
+                     1; next; for existing connections. In case the ACL has  a
+                     label  then  reg3  is  loaded  with  the  label value and
+                     reg0[13] bit is set to 1 (which acts as a  hint  for  the
+                     next tables to commit the label to conntrack).
+
+              ā€¢      allow-stateless  apply-after-lb ACLs translate into logiā€
+                     cal flows that set the allow bit and advance to the  next
+                     table.
+
+              ā€¢      reject  apply-after-lb  ACLs translate into logical flows
+                     that set the reject bit and advance to the next table.
+
+              ā€¢      pass apply-after-lb ACLs  translate  into  logical  flows
+                     that  do  not  set the allow, drop, or reject bit and adā€
+                     vance to the next table.
+
+              ā€¢      Other apply-after-lb ACLs set the drop bit for new or unā€
+                     tracked  connections  and  ct_commit(ct_label=1/1);   for
+                     known connections. Setting ct_label marks a connection as
+                     one  that was previously allowed, but should no longer be
+                     allowed due to a policy change.
+
+              ā€¢      One priority-65532 flow matching  packets  with  reg0[17]
+                     set  (either  replies to existing sessions or traffic reā€
+                     lated to existing sessions) and allows these  by  setting
+                     the allow bit and advancing to the next table.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 19: from-lport ACL action after LB
+
+       Logical  flows  in this table decide how to proceed based on the values
+       of the allow, drop, and reject bits that may have been set in the  preā€
+       vious table.
+
+              ā€¢      If  no ACLs are configured, then a priority 0 flow is inā€
+                     stalled that matches everything and advances to the  next
+                     table.
+
+              ā€¢      A  priority  1000 flow is installed that will advance the
+                     packet to the next table if the allow bit is set.
+
+              ā€¢      A priority 1000 flow is installed that will run the drop;
+                     action if the drop bit is set.
+
+              ā€¢      A priority 1000 flow  is  installed  that  will  run  the
+                     tcp_reset  {  output ->gt;>gt; inport; next(pipeline=egress,taā€ā€
+                     ble=5);} action for  TCP  connections,icmp4/icmp6  action
+                     for  UDP  connections,  and sctp_abort {output -%gt; inā€ā€
+                     port; next(pipeline=egress,table=5);} action for SCTP asā€
+                     sociations.
+
+              ā€¢      If any ACLs have tiers configured  on  them,  then  three
+                     priority  500  flows  are  installed. If the current tier
+                     counter is 0, 1, or 2, then the current tier  counter  is
+                     incremented  by  one  and  the packet is sent back to the
+                     previous table for re-evaluation.
+
+     Ingress Table 20: Stateful
+
+              ā€¢      A priority 100 flow is added which commits the packet  to
+                     the  conntrack  and  sets the most significant 32-bits of
+                     ct_label with the reg3 value based on the  hint  provided
+                     by  previous  tables  (with  a  match for reg0[1] == 1 &&&&
+                     reg0[13] == 1). This is used by the ACLs  with  label  to
+                     commit the label value to conntrack.
+
+              ā€¢      For  ACLs  without label, a second priority-100 flow comā€
+                     mits packets to connection tracker using ct_commit; next;
+                     action based on a hint provided by  the  previous  tables
+                     (with a match for reg0[1] == 1 &&&& reg0[13] == 0).
+
+              ā€¢      A  priority-0  flow that simply moves traffic to the next
+                     table.
+
+     Ingress Table 21: ARP/ND responder
+
+       This table implements ARP/ND responder in a logical  switch  for  known
+       IPs. The advantage of the ARP responder flow is to limit ARP broadcasts
+       by locally responding to ARP requests without the need to send to other
+       hypervisors. One common case is when the inport is a logical port assoā€
+       ciated with a VIF and the broadcast is responded to on the local hyperā€
+       visor  rather  than broadcast across the whole network and responded to
+       by the destination VM. This behavior is proxy ARP.
+
+       ARP requests arrive from VMs from a logical switch inport of  type  deā€
+       fault.  For  this  case,  the logical switch proxy ARP rules can be for
+       other VMs or logical router ports. Logical switch proxy ARP  rules  may
+       be  programmed  both  for  mac binding of IP addresses on other logical
+       switch VIF ports (which are of the default logical  switch  port  type,
+       representing connectivity to VMs or containers), and for mac binding of
+       IP  addresses  on  logical switch router type ports, representing their
+       logical router port peers. In order to support proxy  ARP  for  logical
+       router  ports,  an  IP address must be configured on the logical switch
+       router type port, with the same value as the peer logical router  port.
+       The configured MAC addresses must match as well. When a VM sends an ARP
+       request  for  a  distributed logical router port and if the peer router
+       type port of the attached logical switch does not have  an  IP  address
+       configured,  the  ARP  request will be broadcast on the logical switch.
+       One of the copies of the ARP request will go through the logical switch
+       router type port to the logical  router  datapath,  where  the  logical
+       router  ARP  responder will generate a reply. The MAC binding of a disā€
+       tributed logical router, once learned by an associated VM, is used  for
+       all  that VMā€™s communication needing routing. Hence, the action of a VM
+       re-arping for the mac binding of the  logical  router  port  should  be
+       rare.
+
+       Logical  switch  ARP responder proxy ARP rules can also be hit when reā€
+       ceiving ARP requests externally on a L2 gateway port. In this case, the
+       hypervisor acting as an L2 gateway, responds to the ARP request on  beā€
+       half of a destination VM.
+
+       Note  that  ARP requests received from localnet logical inports can eiā€
+       ther go directly to VMs, in which case the VM responds or  can  hit  an
+       ARP  responder  for  a logical router port if the packet is used to reā€
+       solve a logical router port next hop address. In either  case,  logical
+       switch  ARP  responder rules will not be hit. It contains these logical
+       flows:
+
+              ā€¢      If the logical  switch  has  no  router  ports  with  opā€
+                     tions:arp_proxy  configured  add  a priority-100 flows to
+                     skip the ARP responder if inport is of type localnet  adā€
+                     vances  directly  to the next table. ARP requests sent to
+                     localnet ports can be received by  multiple  hypervisors.
+                     Now, because the same mac binding rules are downloaded to
+                     all  hypervisors,  each  of the multiple hypervisors will
+                     respond. This will confuse L2 learning on the  source  of
+                     the  ARP  requests. ARP requests received on an inport of
+                     type router are not expected to hit  any  logical  switch
+                     ARP responder flows. However, no skip flows are installed
+                     for these packets, as there would be some additional flow
+                     cost for this and the value appears limited.
+
+              ā€¢      If  inport V is of type virtual adds a priority-100 logiā€
+                     cal flows for each P configured in  the  options:virtual-
+                     parents column with the match
+
+                     inport == P &&&& &&&& ((arp.op == 1 &&&& arp.spa == VIP &&&& arp.tpa == VIP) || (arp.op == 2 &&&& arp.spa == VIP))
+                     inport == P &&&& &&&& ((nd_ns &&&& ip6.dst == {VIP, NS_MULTICAST_ADDR} &&&& nd.target == VIP) || (nd_na &&&& nd.target == VIP))
+
+
+                     and applies the action
+
+                     bind_vport(V, inport);
+
+
+                     and advances the packet to the next table.
+
+                     Where  VIP is the virtual ip configured in the column opā€ā€
+                     tions:virtual-ip and NS_MULTICAST_ADDR is  solicited-node
+                     multicast address corresponding to the VIP.
+
+              ā€¢      Priority-50  flows  that match ARP requests to each known
+                     IP address A of every logical switch  port,  and  respond
+                     with ARP replies directly with corresponding Ethernet adā€
+                     dress E:
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     arp.op = 2; /* ARP reply. */
+                     arp.tha = arp.sha;
+                     arp.sha = E;
+                     arp.tpa = arp.spa;
+                     arp.spa = A;
+                     outport = inport;
+                     flags.loopback = 1;
+                     output;
+
+
+                     These  flows  are  omitted  for logical ports (other than
+                     router ports or localport ports) that  are  down  (unless
+                     ignore_lsp_down  is  configured as true in options column
+                     of NB_Global table of the Northbound database), for logiā€
+                     cal ports of type virtual, for logical  ports  with  ā€™unā€
+                     knownā€™  address  set  and  for logical ports of a logical
+                     switch configured with other_config:vlan-passthru=true.
+
+                     The above ARP responder flows are added for the  list  of
+                     IPv4  addresses if defined in options:arp_proxy column of
+                     Logical_Switch_Port table for  logical  switch  ports  of
+                     type router.
+
+              ā€¢      Priority-50  flows  that match IPv6 ND neighbor solicitaā€
+                     tions to each known IP address A (and Aā€™s solicited  node
+                     address)  of  every  logical  switch  port except of type
+                     router, and respond with neighbor advertisements directly
+                     with corresponding Ethernet address E:
+
+                     nd_na {
+                         eth.src = E;
+                         ip6.src = A;
+                         nd.target = A;
+                         nd.tll = E;
+                         outport = inport;
+                         flags.loopback = 1;
+                         output;
+                     };
+
+
+                     Priority-50 flows that match IPv6 ND  neighbor  solicitaā€
+                     tions  to each known IP address A (and Aā€™s solicited node
+                     address) of logical switch port of type router,  and  reā€
+                     spond  with  neighbor advertisements directly with correā€
+                     sponding Ethernet address E:
+
+                     nd_na_router {
+                         eth.src = E;
+                         ip6.src = A;
+                         nd.target = A;
+                         nd.tll = E;
+                         outport = inport;
+                         flags.loopback = 1;
+                         output;
+                     };
+
+
+                     These flows are omitted for  logical  ports  (other  than
+                     router  ports  or  localport ports) that are down (unless
+                     ignore_lsp_down is configured as true in  options  column
+                     of NB_Global table of the Northbound database), for logiā€
+                     cal ports of type virtual and for logical ports with ā€™unā€
+                     knownā€™ address set.
+
+                     The  above  NDP responder flows are added for the list of
+                     IPv6 addresses if defined in options:arp_proxy column  of
+                     Logical_Switch_Port  table  for  logical  switch ports of
+                     type router.
+
+              ā€¢      Priority-100 flows with match criteria like the  ARP  and
+                     ND  flows above, except that they only match packets from
+                     the inport that owns the IP addresses in  question,  with
+                     action  next;.  These flows prevent OVN from replying to,
+                     for example, an ARP request emitted by a VM for  its  own
+                     IP  address.  A VM only makes this kind of request to atā€
+                     tempt to detect a duplicate  IP  address  assignment,  so
+                     sending a reply will prevent the VM from accepting the IP
+                     address that it owns.
+
+                     In  place  of  next;, it would be reasonable to use drop;
+                     for the flowsā€™ actions. If everything is working as it is
+                     configured, then this would produce  equivalent  results,
+                     since no host should reply to the request. But ARPing for
+                     oneā€™s  own  IP  address  is intended to detect situations
+                     where the network is not working as configured, so  dropā€
+                     ping the request would frustrate that intent.
+
+              ā€¢      For  each  SVC_MON_SRC_IP  defined  in  the  value of the
+                     ip_port_mappings:ENDPOINT_IP column of Load_Balancer  taā€
+                     ble,  priority-110  logical  flow is added with the match
+                     arp.tpa == SVC_MON_SRC_IP &&&& &&&& arp.op == 1  and  applies
+                     the action
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     arp.op = 2; /* ARP reply. */
+                     arp.tha = arp.sha;
+                     arp.sha = E;
+                     arp.tpa = arp.spa;
+                     arp.spa = A;
+                     outport = inport;
+                     flags.loopback = 1;
+                     output;
+
+
+                     where  E is the service monitor source mac defined in the
+                     options:svc_monitor_mac column in  the  NB_Global  table.
+                     This mac is used as the source mac in the service monitor
+                     packets for the load balancer endpoint IP health checks.
+
+                     SVC_MON_SRC_IP  is  used  as the source ip in the service
+                     monitor IPv4 packets for the load  balancer  endpoint  IP
+                     health checks.
+
+                     These  flows  are  required if an ARP request is sent for
+                     the IP SVC_MON_SRC_IP.
+
+                     For IPv6 the similar flow is added with the following acā€
+                     tion
+
+                     nd_na {
+                         eth.dst = eth.src;
+                         eth.src = E;
+                         ip6.src = A;
+                         nd.target = A;
+                         nd.tll = E;
+                         outport = inport;
+                         flags.loopback = 1;
+                         output;
+                     };
+
+
+              ā€¢      For each VIP configured in the table  Forwarding_Group  a
+                     priority-50  logical flow is added with the match arp.tpa
+                     == vip &&&& &&&& arp.op == 1
+                      and applies the action
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     arp.op = 2; /* ARP reply. */
+                     arp.tha = arp.sha;
+                     arp.sha = E;
+                     arp.tpa = arp.spa;
+                     arp.spa = A;
+                     outport = inport;
+                     flags.loopback = 1;
+                     output;
+
+
+                     where E is the forwarding  groupā€™s  mac  defined  in  the
+                     vmac.
+
+                     A is used as either the destination ip for load balancing
+                     traffic  to child ports or as nexthop to hosts behind the
+                     child ports.
+
+                     These flows are required to respond to an ARP request  if
+                     an ARP request is sent for the IP vip.
+
+              ā€¢      One priority-0 fallback flow that matches all packets and
+                     advances to the next table.
+
+     Ingress Table 22: DHCP option processing
+
+       This  table adds the DHCPv4 options to a DHCPv4 packet from the logical
+       ports configured with IPv4 address(es) and DHCPv4  options,  and  simiā€
+       larly  for  DHCPv6  options. This table also adds flows for the logical
+       ports of type external.
+
+              ā€¢      A priority-100 logical flow is added  for  these  logical
+                     ports which matches the IPv4 packet with udp.src = 68 and
+                     udp.dst = 67 and applies the action put_dhcp_opts and adā€
+                     vances the packet to the next table.
+
+                     reg0[3] = put_dhcp_opts(offer_ip = ip, options...);
+                     next;
+
+
+                     For  DHCPDISCOVER  and  DHCPREQUEST,  this transforms the
+                     packet into a DHCP reply, adds the DHCP offer IP  ip  and
+                     options  to  the  packet,  and stores 1 into reg0[3]. For
+                     other kinds of packets, it just stores  0  into  reg0[3].
+                     Either way, it continues to the next table.
+
+              ā€¢      A  priority-100  logical  flow is added for these logical
+                     ports which matches the IPv6 packet with  udp.src  =  546
+                     and  udp.dst = 547 and applies the action put_dhcpv6_opts
+                     and advances the packet to the next table.
+
+                     reg0[3] = put_dhcpv6_opts(ia_addr = ip, options...);
+                     next;
+
+
+                     For DHCPv6 Solicit/Request/Confirm packets,  this  transā€
+                     forms  the packet into a DHCPv6 Advertise/Reply, adds the
+                     DHCPv6 offer IP ip and options to the packet, and  stores
+                     1  into  reg0[3].  For  other  kinds  of packets, it just
+                     stores 0 into reg0[3]. Either way, it  continues  to  the
+                     next table.
+
+              ā€¢      A priority-0 flow that matches all packets to advances to
+                     table 16.
+
+     Ingress Table 23: DHCP responses
+
+       This  table implements DHCP responder for the DHCP replies generated by
+       the previous table.
+
+              ā€¢      A priority 100 logical flow  is  added  for  the  logical
+                     ports  configured  with DHCPv4 options which matches IPv4
+                     packets with udp.src == 68 &&&& udp.dst == 67 &&&& reg0[3] ==
+                     1 and responds back to the inport  after  applying  these
+                     actions. If reg0[3] is set to 1, it means that the action
+                     put_dhcp_opts was successful.
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     ip4.src = S;
+                     udp.src = 67;
+                     udp.dst = 68;
+                     outport = P;
+                     flags.loopback = 1;
+                     output;
+
+
+                     where  E  is  the  server MAC address and S is the server
+                     IPv4 address defined in the  DHCPv4  options.  Note  that
+                     ip4.dst field is handled by put_dhcp_opts.
+
+                     (This  terminates  ingress  packet processing; the packet
+                     does not go to the next ingress table.)
+
+              ā€¢      A priority 100 logical flow  is  added  for  the  logical
+                     ports  configured  with DHCPv6 options which matches IPv6
+                     packets with udp.src == 546 &&&& udp.dst == 547 &&&&  reg0[3]
+                     == 1 and responds back to the inport after applying these
+                     actions. If reg0[3] is set to 1, it means that the action
+                     put_dhcpv6_opts was successful.
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     ip6.dst = A;
+                     ip6.src = S;
+                     udp.src = 547;
+                     udp.dst = 546;
+                     outport = P;
+                     flags.loopback = 1;
+                     output;
+
+
+                     where  E  is  the  server MAC address and S is the server
+                     IPv6 LLA address generated from the server_id defined  in
+                     the  DHCPv6  options and A is the IPv6 address defined in
+                     the logical portā€™s addresses column.
+
+                     (This terminates packet processing; the packet  does  not
+                     go on the next ingress table.)
+
+              ā€¢      A priority-0 flow that matches all packets to advances to
+                     table 17.
+
+     Ingress Table 24 DNS Lookup
+
+       This  table  looks  up  and resolves the DNS names to the corresponding
+       configured IP address(es).
+
+              ā€¢      A priority-100 logical flow for each logical switch dataā€
+                     path if it is configured with DNS records, which  matches
+                     the  IPv4  and IPv6 packets with udp.dst = 53 and applies
+                     the action dns_lookup and advances the packet to the next
+                     table.
+
+                     reg0[4] = dns_lookup(); next;
+
+
+                     For valid DNS packets, this transforms the packet into  a
+                     DNS  reply  if the DNS name can be resolved, and stores 1
+                     into reg0[4]. For failed DNS resolution or other kinds of
+                     packets, it just stores 0 into reg0[4].  Either  way,  it
+                     continues to the next table.
+
+     Ingress Table 25 DNS Responses
+
+       This  table  implements  DNS responder for the DNS replies generated by
+       the previous table.
+
+              ā€¢      A priority-100 logical flow for each logical switch dataā€
+                     path if it is configured with DNS records, which  matches
+                     the IPv4 and IPv6 packets with udp.dst = 53 &&&& reg0[4] ==
+                     1  and  responds  back to the inport after applying these
+                     actions. If reg0[4] is set to 1, it means that the action
+                     dns_lookup was successful.
+
+                     eth.dst ->gt;>gt; eth.src;
+                     ip4.src ->gt;>gt; ip4.dst;
+                     udp.dst = udp.src;
+                     udp.src = 53;
+                     outport = P;
+                     flags.loopback = 1;
+                     output;
+
+
+                     (This terminates ingress packet  processing;  the  packet
+                     does not go to the next ingress table.)
+
+     Ingress table 26 External ports
+
+       Traffic  from  the  external  logical  ports enter the ingress datapath
+       pipeline via the localnet port. This table adds the below logical flows
+       to handle the traffic from these ports.
+
+              ā€¢      A priority-100 flow is added for  each  external  logical
+                     port  which  doesnā€™t  reside  on  a  chassis  to drop the
+                     ARP/IPv6 NS request to the router IP(s) (of  the  logical
+                     switch) which matches on the inport of the external logiā€
+                     cal  port and the valid eth.src address(es) of the exterā€ā€
+                     nal logical port.
+
+                     This flow guarantees  that  the  ARP/NS  request  to  the
+                     router IP address from the external ports is responded by
+                     only  the chassis which has claimed these external ports.
+                     All the other chassis, drops these packets.
+
+                     A priority-100 flow is added for  each  external  logical
+                     port which doesnā€™t reside on a chassis to drop any packet
+                     destined to the router mac - with the match inport == exā€
+                     ternal  &&&&  eth.src  ==  E  &&&&  eth.dst == R &&&& !is_chasā€ā€
+                     sis_resident("external") where E is the external port mac
+                     and R is the router port mac.
+
+              ā€¢      A priority-0 flow that matches all packets to advances to
+                     table 20.
+
+     Ingress Table 27 Destination Lookup
+
+       This table implements switching behavior.  It  contains  these  logical
+       flows:
+
+              ā€¢      A  priority-110  flow with the match eth.src == E for all
+                     logical switch datapaths  and  applies  the  action  hanā€ā€
+                     dle_svc_check(inport). Where E is the service monitor mac
+                     defined   in   the   options:svc_monitor_mac   column  of
+                     NB_Global table.
+
+              ā€¢      A priority-100 flow that punts all  IGMP/MLD  packets  to
+                     ovn-controller  if  multicast  snooping is enabled on the
+                     logical switch.
+
+              ā€¢      Priority-90 flows that forward  registered  IP  multicast
+                     traffic  to  their  corresponding  multicast group, which
+                     ovn-northd creates based on  learnt  IGMP_Group  entries.
+                     The  flows  also  forward packets to the MC_MROUTER_FLOOD
+                     multicast group, which ovn-nortdh populates with all  the
+                     logical  ports that are connected to logical routers with
+                     options:mcast_relay=ā€™trueā€™.
+
+              ā€¢      A priority-85 flow that forwards all IP multicast traffic
+                     destined to 224.0.0.X to the MC_FLOOD_L2 multicast group,
+                     which ovn-northd populates with  all  non-router  logical
+                     ports.
+
+              ā€¢      A priority-85 flow that forwards all IP multicast traffic
+                     destined  to reserved multicast IPv6 addresses (RFC 4291,
+                     2.7.1, e.g., Solicited-Node multicast)  to  the  MC_FLOOD
+                     multicast  group, which ovn-northd populates with all enā€
+                     abled logical ports.
+
+              ā€¢      A priority-80 flow that forwards all unregistered IP mulā€
+                     ticast traffic to the MC_STATIC  multicast  group,  which
+                     ovn-northd populates with all the logical ports that have
+                     options  :mcast_flood=ā€™ā€™trueā€™ā€™.  The flow also forwards unā€
+                     registered IP multicast traffic to  the  MC_MROUTER_FLOOD
+                     multicast  group, which ovn-northd populates with all the
+                     logical ports connected to logical routers that have  opā€ā€
+                     tions :mcast_relay=ā€™ā€™trueā€™ā€™.
+
+              ā€¢      A  priority-80 flow that drops all unregistered IP multiā€
+                     cast  traffic  if  other_config  :mcast_snoop=ā€™ā€™trueā€™ā€™  and
+                     other_config  :mcast_flood_unregistered=ā€™ā€™falseā€™ā€™  and  the
+                     switch is not connected to a logical router that has  opā€ā€
+                     tions :mcast_relay=ā€™ā€™trueā€™ā€™ and the switch doesnā€™t have any
+                     logical port with options :mcast_flood=ā€™ā€™trueā€™ā€™.
+
+              ā€¢      Priority-80  flows  for  each  IP address/VIP/NAT address
+                     owned by a router port connected  to  the  switch.  These
+                     flows  match ARP requests and ND packets for the specific
+                     IP addresses. Matched packets are forwarded only  to  the
+                     router  that  owns  the IP address and to the MC_FLOOD_L2
+                     multicast group which  contains  all  non-router  logical
+                     ports.
+
+              ā€¢      Priority-75  flows  for  each port connected to a logical
+                     router matching  self  originated  ARP  request/RARP  reā€
+                     quest/ND  packets.  These  packets  are  flooded  to  the
+                     MC_FLOOD_L2 which contains all non-router logical ports.
+
+              ā€¢      A priority-72 flow that outputs all ARP requests  and  ND
+                     packets  with  an Ethernet broadcast or multicast eth.dst
+                     to the MC_FLOOD_L2 multicast group if other_config:broadā€ā€
+                     cast-arps-to-all-routers=true.
+
+              ā€¢      A priority-70 flow that outputs all packets with an  Ethā€
+                     ernet broadcast or multicast eth.dst to the MC_FLOOD mulā€
+                     ticast group.
+
+              ā€¢      One priority-50 flow that matches each known Ethernet adā€
+                     dress  against  eth.dst.  Action of this flow outputs the
+                     packet to the single associated output port if it is  enā€
+                     abled. drop; action is applied if LSP is disabled.
+
+                     For the Ethernet address on a logical switch port of type
+                     router,  when that logical switch portā€™s addresses column
+                     is set to router and the connected  logical  router  port
+                     has a gateway chassis:
+
+                     ā€¢      The  flow  for the connected logical router portā€™s
+                            Ethernet address is only programmed on the gateway
+                            chassis.
+
+                     ā€¢      If the logical router has rules specified  in  nat
+                            with  external_mac,  then those addresses are also
+                            used to populate the switchā€™s  destination  lookup
+                            on the chassis where logical_port is resident.
+
+                     For the Ethernet address on a logical switch port of type
+                     router,  when that logical switch portā€™s addresses column
+                     is set to router and the connected  logical  router  port
+                     specifies  a  reside-on-redirect-chassis  and the logical
+                     router to which the connected logical router port belongs
+                     to has a distributed gateway LRP:
+
+                     ā€¢      The flow for the connected logical  router  portā€™s
+                            Ethernet address is only programmed on the gateway
+                            chassis.
+
+                     For  each  forwarding  group  configured  on  the logical
+                     switch datapath,  a  priority-50  flow  that  matches  on
+                     eth.dst == VIP
+                      with  an  action  of  fwd_group(childports=args ), where
+                     args contains comma separated logical switch child  ports
+                     to  load  balance to. If liveness is enabled, then action
+                     also includes  liveness=true.
+
+              ā€¢      One priority-0 fallback flow  that  matches  all  packets
+                     with  the  action  outport = get_fdb(eth.dst); next;. The
+                     action get_fdb gets the port for the eth.dst in  the  MAC
+                     learning  table  of the logical switch datapath. If there
+                     is no entry for eth.dst in the MAC learning  table,  then
+                     it stores none in the outport.
+
+     Ingress Table 28 Destination unknown
+
+       This  table  handles the packets whose destination was not found or and
+       looked up in the MAC learning table of the logical switch datapath.  It
+       contains the following flows.
+
+              ā€¢      Priority 50 flow with the match outport == P is added for
+                     each disabled Logical Switch Port P. This flow has action
+                     drop;.
+
+              ā€¢      If  the  logical  switch has logical ports with ā€™unknownā€™
+                     addresses set, then the below logical flow is added
+
+                     ā€¢      Priority 50 flow with the match outport ==  "none"
+                            then  outputs  them  to  the  MC_UNKNOWN multicast
+                            group, which ovn-northd populates with all enabled
+                            logical  ports  that  accept  unknown  destination
+                            packets.  As  a  small optimization, if no logical
+                            ports   accept   unknown   destination    packets,
+                            ovn-northd  omits this multicast group and logical
+                            flow.
+
+                     If the logical switch has no logical ports with ā€™unknownā€™
+                     address set, then the below logical flow is added
+
+                     ā€¢      Priority 50 flow with the match  outport  ==  none
+                            and drops the packets.
+
+              ā€¢      One  priority-0  fallback flow that outputs the packet to
+                     the egress stage with the outport learnt from get_fdb acā€
+                     tion.
+
+     Egress Table 0: to-lport Pre-ACLs
+
+       This is similar to ingress table Pre-ACLs except for to-lport traffic.
+
+       This table also has a priority-110 flow with the match eth.src == E for
+       all logical switch datapaths to move traffic to the next table. Where E
+       is the service monitor mac defined in the options:svc_monitor_mac  colā€
+       umn of NB_Global table.
+
+       This table also has a priority-110 flow with the match outport == I for
+       all logical switch datapaths to move traffic to the next table. Where I
+       is  the  peer  of a logical router port. This flow is added to skip the
+       connection tracking of packets which will be  entering  logical  router
+       datapath from logical switch datapath for routing.
+
+     Egress Table 1: Pre-LB
+
+       This table is similar to ingress table Pre-LB. It contains a priority-0
+       flow  that simply moves traffic to the next table. Moreover it contains
+       two priority-110 flows to move multicast, IPv6 Neighbor  Discovery  and
+       MLD  traffic  to  the next table. If any load balancing rules exist for
+       the datapath, a priority-100 flow is added with a match of ip  and  acā€
+       tion  of  reg0[2] = 1; next; to act as a hint for table Pre-stateful to
+       send IP packets to the connection tracker for  packet  de-fragmentation
+       and  possibly  DNAT  the destination VIP to one of the selected backend
+       for already committed load balanced traffic.
+
+       This table also has a priority-110 flow with the match eth.src == E for
+       all logical switch datapaths to move traffic to the next table. Where E
+       is the service monitor mac defined in the options:svc_monitor_mac  colā€
+       umn of NB_Global table.
+
+       This table also has a priority-110 flow with the match outport == I for
+       all logical switch datapaths to move traffic to the next table, and, if
+       there are no stateful_acl, clear the ct_state. Where I is the peer of a
+       logical router port. This flow is added to skip the connection tracking
+       of  packets which will be entering logical router datapath from logical
+       switch datapath for routing.
+
+     Egress Table 2: Pre-stateful
+
+       This is similar to ingress table Pre-stateful. This table adds the  beā€
+       low 3 logical flows.
+
+              ā€¢      A  Priority-120  flow that send the packets to connection
+                     tracker using ct_lb_mark; as the action so that  the  alā€
+                     ready established traffic gets unDNATted from the backend
+                     IP  to  the load balancer VIP based on a hint provided by
+                     the previous tables with a match for reg0[2] == 1. If the
+                     packet was not DNATted earlier, then ct_lb_mark functions
+                     like ct_next.
+
+              ā€¢      A priority-100  flow  sends  the  packets  to  connection
+                     tracker  based  on a hint provided by the previous tables
+                     (with a match for reg0[0] == 1) by using the ct_next; acā€
+                     tion.
+
+              ā€¢      A priority-0 flow that matches all packets to advance  to
+                     the next table.
+
+     Egress Table 3: from-lport ACL hints
+
+       This is similar to ingress table ACL hints.
+
+     Egress Table 4: to-lport ACL evaluation
+
+       This  is similar to ingress table ACL eval except for to-lport ACLs. As
+       a reminder, these flows use the following  register  bits  to  indicate
+       their  verdicts.  Allow-type ACLs set reg8[16], drop ACLs set reg8[17],
+       and reject ACLs set reg8[18].
+
+       Also like with ingress ACLs, egress ACLs can have a configured tier. If
+       a tier is configured,  then  the  current  tier  counter  is  evaluated
+       against  the  ACLā€™s configured tier in addition to the ACLā€™s match. The
+       current tier counter is stored in reg8[30..31].
+
+       Similar to ingress table, a priority-65532 flow is added to allow  IPv6
+       Neighbor  solicitation,  Neighbor discover, Router solicitation, Router
+       advertisement and MLD packets regardless of other ACLs defined.
+
+       In addition, the following flows are added.
+
+              ā€¢      A priority 34000 logical flow is added for  each  logical
+                     port which has DHCPv4 options defined to allow the DHCPv4
+                     reply  packet and which has DHCPv6 options defined to alā€
+                     low the DHCPv6 reply packet from the  Ingress  Table  18:
+                     DHCP  responses.  This  is indicated by setting the allow
+                     bit.
+
+              ā€¢      A priority 34000 logical flow is added for  each  logical
+                     switch  datapath  configured  with  DNS  records with the
+                     match udp.dst = 53 to allow the DNS reply packet from the
+                     Ingress Table 20: DNS responses.  This  is  indicated  by
+                     setting the allow bit.
+
+              ā€¢      A  priority  34000 logical flow is added for each logical
+                     switch datapath with the match eth.src = E to  allow  the
+                     service  monitor  request  packet  generated  by ovn-conā€ā€
+                     troller with the action next, where E is the service monā€
+                     itor mac defined in the options:svc_monitor_mac column of
+                     NB_Global table. This is indicated by setting  the  allow
+                     bit.
+
+     Egress Table 5: to-lport ACL action
+
+       This is similar to ingress table ACL action.
+
+     Egress Table 6: to-lport QoS Marking
+
+       This  is  similar  to  ingress  table  QoS marking except they apply to
+       to-lport QoS rules.
+
+     Egress Table 7: to-lport QoS Meter
+
+       This is similar to  ingress  table  QoS  meter  except  they  apply  to
+       to-lport QoS rules.
+
+     Egress Table 8: Stateful
+
+       This  is  similar  to  ingress  table Stateful except that there are no
+       rules added for load balancing new connections.
+
+     Egress Table 9: Egress Port Security - check
+
+       This is similar to the port security logic in table Ingress Port  Secuā€ā€
+       rity  check  except that action check_out_port_sec is used to check the
+       port security rules. This table adds the below logical flows.
+
+              ā€¢      A priority 100 flow which matches on the multicast  trafā€
+                     fic  and  applies  the  action REGBIT_PORT_SEC_DROP" = 0;
+                     next;" to skip the out port security checks.
+
+              ā€¢      A priority 0 logical flow is added which matches  on  all
+                     the  packets and applies the action REGBIT_PORT_SEC_DROP"
+                     =    check_out_port_sec();     next;".     The     action
+                     check_out_port_sec  applies the port security rules based
+                     on the addresses defined in the port_security  column  of
+                     Logical_Switch_Port table before delivering the packet to
+                     the outport.
+
+     Egress Table 10: Egress Port Security - Apply
+
+       This  is  similar to the ingress port security logic in ingress table A
+       Ingress Port Security - Apply. This table drops the packets if the port
+       security check failed in the previous stage i.e the register  bit  REGā€ā€
+       BIT_PORT_SEC_DROP is set to 1.
+
+       The following flows are added.
+
+              ā€¢      For  each  port  configured  with  egress  qos in the opā€ā€
+                     tions:qdisc_queue_id column of Logical_Switch_Port,  runā€
+                     ning a localnet port on the same logical switch, a priorā€
+                     ity  110 flow is added which matches on the localnet outā€ā€
+                     port and on  the  port  inport  and  applies  the  action
+                     set_queue(id); output;".
+
+              ā€¢      For  each localnet port configured with egress qos in the
+                     options:qdisc_queue_id column of  Logical_Switch_Port,  a
+                     priority  100 flow is added which matches on the localnet
+                     outport and applies the action set_queue(id); output;".
+
+                     Please remember to mark the corresponding physical interā€
+                     face with ovn-egress-iface set to true in external_ids.
+
+              ā€¢      A priority-50 flow that drops the packet if the  register
+                     bit REGBIT_PORT_SEC_DROP is set to 1.
+
+              ā€¢      A priority-0 flow that outputs the packet to the outport.
+
+   Logical Router Datapaths
+       Logical router datapaths will only exist for Logical_Router rows in the
+       OVN_Northbound database that do not have enabled set to false
+
+     Ingress Table 0: L2 Admission Control
+
+       This  table drops packets that the router shouldnā€™t see at all based on
+       their Ethernet headers. It contains the following flows:
+
+              ā€¢      Priority-100 flows to drop packets with VLAN tags or mulā€
+                     ticast Ethernet source addresses.
+
+              ā€¢      For each enabled router port P with Ethernet address E, a
+                     priority-50 flow that matches inport == P  &&&&  (eth.mcast
+                     || eth.dst == E), stores the router port ethernet address
+                     and  advances  to next table, with action xreg0[0..47]=E;
+                     next;.
+
+                     For the gateway port  on  a  distributed  logical  router
+                     (where  one of the logical router ports specifies a gateā€
+                     way chassis), the above flow matching  eth.dst  ==  E  is
+                     only programmed on the gateway port instance on the gateā€
+                     way  chassis. If LRPā€™s logical switch has attached LSP of
+                     vtep type, the is_chassis_resident() part is not added to
+                     lflow to allow traffic originated from logical switch  to
+                     reach LR services (LBs, NAT).
+
+                     For  a  distributed  logical router or for gateway router
+                     where the port is configured with options:gateway_mtu the
+                     action   of   the   above   flow   is   modified   adding
+                     check_pkt_larger in order to mark the packet setting REGā€ā€
+                     BIT_PKT_LARGER  if  the  size is greater than the MTU. If
+                     the port is also configured with  options:gateway_mtu_byā€ā€
+                     pass then another flow is added, with priority-55, to byā€
+                     pass  the check_pkt_larger flow. This is useful for trafā€
+                     fic that normally doesnā€™t need to be fragmented  and  for
+                     which  check_pkt_larger,  which might not be offloadable,
+                     is not really needed. One such example is TCP traffic.
+
+              ā€¢      For each dnat_and_snat NAT rule on a  distributed  router
+                     that  specifies  an external Ethernet address E, a priorā€
+                     ity-50 flow that matches inport == GW &&&&  eth.dst  ==  E,
+                     where  GW  is the logical router distributed gateway port
+                     corresponding to the NAT rule  (specified  or  inferred),
+                     with action xreg0[0..47]=E; next;.
+
+                     This flow is only programmed on the gateway port instance
+                     on  the  chassis  where the logical_port specified in the
+                     NAT rule resides.
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+       Other packets are implicitly dropped.
+
+     Ingress Table 1: Neighbor lookup
+
+       For  ARP and IPv6 Neighbor Discovery packets, this table looks into the
+       MAC_Binding records to determine if OVN needs to learn  the  mac  bindā€
+       ings. Following flows are added:
+
+              ā€¢      For  each router port P that owns IP address A, which beā€
+                     longs to subnet S with prefix length L, if the option alā€ā€
+                     ways_learn_from_arp_request is true for  this  router,  a
+                     priority-100  flow  is added which matches inport == P &&&&
+                     arp.spa == S/L &&&& arp.op == 1 (ARP request) with the folā€
+                     lowing actions:
+
+                     reg9[2] = lookup_arp(inport, arp.spa, arp.sha);
+                     next;
+
+
+                     If the option always_learn_from_arp_request is false, the
+                     following two flows are added.
+
+                     A priority-110 flow is added which matches inport == P &&&&
+                     arp.spa == S/L &&&& arp.tpa == A &&&& arp.op ==  1  (ARP  reā€
+                     quest) with the following actions:
+
+                     reg9[2] = lookup_arp(inport, arp.spa, arp.sha);
+                     reg9[3] = 1;
+                     next;
+
+
+                     A priority-100 flow is added which matches inport == P &&&&
+                     arp.spa == S/L &&&& arp.op == 1 (ARP request) with the folā€
+                     lowing actions:
+
+                     reg9[2] = lookup_arp(inport, arp.spa, arp.sha);
+                     reg9[3] = lookup_arp_ip(inport, arp.spa);
+                     next;
+
+
+                     If  the  logical  router  port P is a distributed gateway
+                     router port, additional  match  is_chassis_resident(cr-P)
+                     is added for all these flows.
+
+              ā€¢      A  priority-100  flow  which matches on ARP reply packets
+                     and   applies   the   actions   if   the    option    alā€ā€
+                     ways_learn_from_arp_request is true:
+
+                     reg9[2] = lookup_arp(inport, arp.spa, arp.sha);
+                     next;
+
+
+                     If the option always_learn_from_arp_request is false, the
+                     above actions will be:
+
+                     reg9[2] = lookup_arp(inport, arp.spa, arp.sha);
+                     reg9[3] = 1;
+                     next;
+
+
+              ā€¢      A  priority-100  flow which matches on IPv6 Neighbor Disā€
+                     covery advertisement packet and applies  the  actions  if
+                     the option always_learn_from_arp_request is true:
+
+                     reg9[2] = lookup_nd(inport, nd.target, nd.tll);
+                     next;
+
+
+                     If the option always_learn_from_arp_request is false, the
+                     above actions will be:
+
+                     reg9[2] = lookup_nd(inport, nd.target, nd.tll);
+                     reg9[3] = 1;
+                     next;
+
+
+              ā€¢      A  priority-100  flow which matches on IPv6 Neighbor Disā€
+                     covery solicitation packet and applies the actions if the
+                     option always_learn_from_arp_request is true:
+
+                     reg9[2] = lookup_nd(inport, ip6.src, nd.sll);
+                     next;
+
+
+                     If the option always_learn_from_arp_request is false, the
+                     above actions will be:
+
+                     reg9[2] = lookup_nd(inport, ip6.src, nd.sll);
+                     reg9[3] = lookup_nd_ip(inport, ip6.src);
+                     next;
+
+
+              ā€¢      A priority-0 fallback flow that matches all  packets  and
+                     applies  the  action  reg9[2]  =  1;  next; advancing the
+                     packet to the next table.
+
+     Ingress Table 2: Neighbor learning
+
+       This table adds flows to learn the mac bindings from the ARP  and  IPv6
+       Neighbor  Solicitation/Advertisement  packets if it is needed according
+       to the lookup results from the previous stage.
+
+       reg9[2] will be 1 if the lookup_arp/lookup_nd in the previous table was
+       successful or skipped, meaning no need to learn mac  binding  from  the
+       packet.
+
+       reg9[3] will be 1 if the lookup_arp_ip/lookup_nd_ip in the previous taā€
+       ble  was  successful  or skipped, meaning it is ok to learn mac binding
+       from the packet (if reg9[2] is 0).
+
+              ā€¢      A priority-100 flow  with  the  match  reg9[2]  ==  1  ||
+                     reg9[3] == 0 and advances the packet to the next table as
+                     there is no need to learn the neighbor.
+
+              ā€¢      A  priority-95 flow with the match nd_ns &&&& (ip6.src == 0
+                     || nd.sll == 0) and applies the action next;
+
+              ā€¢      A priority-90 flow with the match arp and applies the acā€
+                     tion put_arp(inport, arp.spa, arp.sha); next;
+
+              ā€¢      A priority-95 flow with the match nd_na  &&&& nd.tll  ==  0
+                     and   applies   the   action   put_nd(inport,  nd.target,
+                     eth.src); next;
+
+              ā€¢      A priority-90 flow with the match nd_na and  applies  the
+                     action put_nd(inport, nd.target, nd.tll); next;
+
+              ā€¢      A  priority-90  flow with the match nd_ns and applies the
+                     action put_nd(inport, ip6.src, nd.sll); next;
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+     Ingress Table 3: IP Input
+
+       This table is the core of the logical router datapath functionality. It
+       contains  the following flows to implement very basic IP host functionā€
+       ality.
+
+              ā€¢      For each dnat_and_snat NAT rule on a distributed  logical
+                     routers  or  gateway routers with gateway port configured
+                     with options:gateway_mtu to a valid integer  value  M,  a
+                     priority-160  flow  with  the match inport == LRP &&&& REGā€ā€
+                     BIT_PKT_LARGER &&&& REGBIT_EGRESS_LOOPBACK == 0, where  LRP
+                     is  the logical router port and applies the following acā€
+                     tion for ipv4 and ipv6 respectively:
+
+                     icmp4_error {
+                         icmp4.type = 3; /* Destination Unreachable. */
+                         icmp4.code = 4;  /* Frag Needed and DF was Set. */
+                         icmp4.frag_mtu = M;
+                         eth.dst = eth.src;
+                         eth.src = E;
+                         ip4.dst = ip4.src;
+                         ip4.src = I;
+                         ip.ttl = 255;
+                         REGBIT_EGRESS_LOOPBACK = 1;
+                         REGBIT_PKT_LARGER 0;
+                         outport = LRP;
+                         flags.loopback = 1;
+                         output;
+                     };
+                     icmp6_error {
+                         icmp6.type = 2;
+                         icmp6.code = 0;
+                         icmp6.frag_mtu = M;
+                         eth.dst = eth.src;
+                         eth.src = E;
+                         ip6.dst = ip6.src;
+                         ip6.src = I;
+                         ip.ttl = 255;
+                         REGBIT_EGRESS_LOOPBACK = 1;
+                         REGBIT_PKT_LARGER 0;
+                         outport = LRP;
+                         flags.loopback = 1;
+                         output;
+                     };
+
+
+                     where E and I are the NAT rule external mac  and  IP  reā€
+                     spectively.
+
+              ā€¢      For  distributed  logical routers or gateway routers with
+                     gateway port configured  with  options:gateway_mtu  to  a
+                     valid  integer  value, a priority-150 flow with the match
+                     inport == LRP &&&& REGBIT_PKT_LARGER &&&& REGBIT_EGRESS_LOOPā€ā€
+                     BACK == 0, where LRP is the logical router port  and  apā€
+                     plies  the  following  action  for  ipv4 and ipv6 respecā€
+                     tively:
+
+                     icmp4_error {
+                         icmp4.type = 3; /* Destination Unreachable. */
+                         icmp4.code = 4;  /* Frag Needed and DF was Set. */
+                         icmp4.frag_mtu = M;
+                         eth.dst = E;
+                         ip4.dst = ip4.src;
+                         ip4.src = I;
+                         ip.ttl = 255;
+                         REGBIT_EGRESS_LOOPBACK = 1;
+                         REGBIT_PKT_LARGER 0;
+                         next(pipeline=ingress, table=0);
+                     };
+                     icmp6_error {
+                         icmp6.type = 2;
+                         icmp6.code = 0;
+                         icmp6.frag_mtu = M;
+                         eth.dst = E;
+                         ip6.dst = ip6.src;
+                         ip6.src = I;
+                         ip.ttl = 255;
+                         REGBIT_EGRESS_LOOPBACK = 1;
+                         REGBIT_PKT_LARGER 0;
+                         next(pipeline=ingress, table=0);
+                     };
+
+
+              ā€¢      For each NAT entry of a distributed logical router  (with
+                     distributed  gateway router port(s)) of type snat, a priā€
+                     ority-120 flow with the match inport == P &&&& ip4.src == A
+                     advances the packet to the next pipeline, where P is  the
+                     distributed  logical router port corresponding to the NAT
+                     entry (specified or inferred) and A  is  the  external_ip
+                     set  in  the  NAT  entry.  If  A is an IPv6 address, then
+                     ip6.src is used for the match.
+
+                     The above flow is required to handle the routing  of  the
+                     East/west NAT traffic.
+
+              ā€¢      For  each  BFD  port the two following priority-110 flows
+                     are added to manage BFD traffic:
+
+                     ā€¢      if ip4.src or ip6.src is any IP address  owned  by
+                            the  router  port and udp.dst == 3784 , the packet
+                            is advanced to the next pipeline stage.
+
+                     ā€¢      if ip4.dst or ip6.dst is any IP address  owned  by
+                            the  router  port  and  udp.dst == 3784 , the hanā€ā€
+                            dle_bfd_msg action is executed.
+
+              ā€¢      L3 admission control: Priority-120 flows allows IGMP  and
+                     MLD packets if the router has logical ports that have opā€ā€
+                     tions :mcast_flood=ā€™ā€™trueā€™ā€™.
+
+              ā€¢      L3  admission  control: A priority-100 flow drops packets
+                     that match any of the following:
+
+                     ā€¢      ip4.src[28..31] == 0xe (multicast source)
+
+                     ā€¢      ip4.src == 255.255.255.255 (broadcast source)
+
+                     ā€¢      ip4.src == 127.0.0.0/8 || ip4.dst  ==  127.0.0.0/8
+                            (localhost source or destination)
+
+                     ā€¢      ip4.src == 0.0.0.0/8 || ip4.dst == 0.0.0.0/8 (zero
+                            network source or destination)
+
+                     ā€¢      ip4.src  or ip6.src is any IP address owned by the
+                            router, unless the packet was recirculated due  to
+                            egress    loopback    as    indicated    by   REGā€ā€
+                            BIT_EGRESS_LOOPBACK.
+
+                     ā€¢      ip4.src is the broadcast address of any IP network
+                            known to the router.
+
+              ā€¢      A priority-100 flow parses DHCPv6 replies from IPv6  preā€
+                     fix  delegation  routers  (udp.src  ==  547 &&&& udp.dst ==
+                     546). The handle_dhcpv6_reply is used to send IPv6 prefix
+                     delegation messages to the delegation router.
+
+              ā€¢      ICMP echo reply. These flows reply to ICMP echo  requests
+                     received  for the routerā€™s IP address. Let A be an IP adā€
+                     dress owned by a router port. Then, for each A that is an
+                     IPv4 address, a priority-90 flow matches on ip4.dst ==  A
+                     and  icmp4.type  ==  8  &&&& icmp4.code == 0 (ICMP echo reā€
+                     quest). For each A that is an IPv6 address, a priority-90
+                     flow matches on ip6.dst == A and  icmp6.type  ==  128  &&&&
+                     icmp6.code  ==  0  (ICMPv6 echo request). The port of the
+                     router that receives the echo request  does  not  matter.
+                     Also,  the  ip.ttl  of  the  echo  request  packet is not
+                     checked, so it complies with RFC 1812,  section  4.2.2.9.
+                     Flows for ICMPv4 echo requests use the following actions:
+
+                     ip4.dst ->gt;>gt; ip4.src;
+                     ip.ttl = 255;
+                     icmp4.type = 0;
+                     flags.loopback = 1;
+                     next;
+
+
+                     Flows for ICMPv6 echo requests use the following actions:
+
+                     ip6.dst ->gt;>gt; ip6.src;
+                     ip.ttl = 255;
+                     icmp6.type = 129;
+                     flags.loopback = 1;
+                     next;
+
+
+              ā€¢      Reply to ARP requests.
+
+                     These flows reply to ARP requests for the routerā€™s own IP
+                     address.  The  ARP  requests  are handled only if the reā€
+                     questorā€™s IP belongs to the same subnets of  the  logical
+                     router  port. For each router port P that owns IP address
+                     A, which belongs to subnet S with prefix  length  L,  and
+                     Ethernet  address E, a priority-90 flow matches inport ==
+                     P &&&& arp.spa == S/L &&&& arp.op == 1 &&&& arp.tpa ==  A  (ARP
+                     request) with the following actions:
+
+                     eth.dst = eth.src;
+                     eth.src = xreg0[0..47];
+                     arp.op = 2; /* ARP reply. */
+                     arp.tha = arp.sha;
+                     arp.sha = xreg0[0..47];
+                     arp.tpa = arp.spa;
+                     arp.spa = A;
+                     outport = inport;
+                     flags.loopback = 1;
+                     output;
+
+
+                     For  the  gateway  port  on  a distributed logical router
+                     (where one of the logical router ports specifies a  gateā€
+                     way  chassis), the above flows are only programmed on the
+                     gateway port instance on the gateway chassis. This behavā€
+                     ior avoids generation of multiple ARP responses from difā€
+                     ferent chassis, and allows upstream MAC learning to point
+                     to the gateway chassis.
+
+                     For  the  logical  router  port  with  the   option   reā€ā€
+                     side-on-redirect-chassis  set (which is centralized), the
+                     above flows are only programmed on the gateway  port  inā€
+                     stance  on the gateway chassis (if the logical router has
+                     a distributed gateway port). This behavior avoids generaā€
+                     tion of multiple ARP responses  from  different  chassis,
+                     and  allows upstream MAC learning to point to the gateway
+                     chassis.
+
+              ā€¢      Reply to IPv6 Neighbor Solicitations. These  flows  reply
+                     to  Neighbor  Solicitation  requests for the routerā€™s own
+                     IPv6 address and populate the logical routerā€™s mac  bindā€
+                     ing table.
+
+                     For  each  router  port  P  that owns IPv6 address A, soā€
+                     licited node address S, and Ethernet address E, a  priorā€
+                     ity-90  flow  matches  inport == P &&&& nd_ns &&&& ip6.dst ==
+                     {A, E} &&&& nd.target == A with the following actions:
+
+                     nd_na_router {
+                         eth.src = xreg0[0..47];
+                         ip6.src = A;
+                         nd.target = A;
+                         nd.tll = xreg0[0..47];
+                         outport = inport;
+                         flags.loopback = 1;
+                         output;
+                     };
+
+
+                     For the gateway port  on  a  distributed  logical  router
+                     (where  one of the logical router ports specifies a gateā€
+                     way chassis), the above flows replying to  IPv6  Neighbor
+                     Solicitations are only programmed on the gateway port inā€
+                     stance  on the gateway chassis. This behavior avoids genā€
+                     eration of multiple replies from different  chassis,  and
+                     allows  upstream  MAC  learning  to  point to the gateway
+                     chassis.
+
+              ā€¢      These flows reply to ARP requests or IPv6 neighbor solicā€
+                     itation for the virtual IP addresses  configured  in  the
+                     router for NAT (both DNAT and SNAT) or load balancing.
+
+                     IPv4:  For  a  configured NAT (both DNAT and SNAT) IP adā€
+                     dress or a load balancer IPv4 VIP A, for each router port
+                     P with Ethernet address E,  a  priority-90  flow  matches
+                     arp.op  ==  1 &&&& arp.tpa == A (ARP request) with the folā€
+                     lowing actions:
+
+                     eth.dst = eth.src;
+                     eth.src = xreg0[0..47];
+                     arp.op = 2; /* ARP reply. */
+                     arp.tha = arp.sha;
+                     arp.sha = xreg0[0..47];
+                     arp.tpa ->gt;>gt; arp.spa;
+                     outport = inport;
+                     flags.loopback = 1;
+                     output;
+
+
+                     IPv4: For a configured load balancer IPv4 VIP, a  similar
+                     flow  is  added  with the additional match inport == P if
+                     the VIP is reachable from any logical router port of  the
+                     logical router.
+
+                     If  the  router  port  P  is a distributed gateway router
+                     port, then the is_chassis_resident(P) is  also  added  in
+                     the match condition for the load balancer IPv4 VIP A.
+
+                     IPv6:  For  a  configured NAT (both DNAT and SNAT) IP adā€
+                     dress or a load balancer IPv6 VIP A (if the VIP is reachā€
+                     able from any logical router port of the logical router),
+                     solicited node address S, for each  router  port  P  with
+                     Ethernet  address E, a priority-90 flow matches inport ==
+                     P &&&& nd_ns &&&& ip6.dst == {A, S} &&&& nd.target  ==  A  with
+                     the following actions:
+
+                     eth.dst = eth.src;
+                     nd_na {
+                         eth.src = xreg0[0..47];
+                         nd.tll = xreg0[0..47];
+                         ip6.src = A;
+                         nd.target = A;
+                         outport = inport;
+                         flags.loopback = 1;
+                         output;
+                     }
+
+
+                     If  the  router  port  P  is a distributed gateway router
+                     port, then the is_chassis_resident(P) is  also  added  in
+                     the match condition for the load balancer IPv6 VIP A.
+
+                     For the gateway port on a distributed logical router with
+                     NAT  (where  one  of the logical router ports specifies a
+                     gateway chassis):
+
+                     ā€¢      If the corresponding NAT rule cannot be handled in
+                            a distributed manner, then a priority-92  flow  is
+                            programmed  on  the  gateway  port instance on the
+                            gateway chassis. A priority-91 drop flow  is  proā€
+                            grammed  on the other chassis when ARP requests/NS
+                            packets are received on the gateway port. This beā€
+                            havior avoids generation of multiple ARP responses
+                            from different chassis, and  allows  upstream  MAC
+                            learning to point to the gateway chassis.
+
+                     ā€¢      If  the corresponding NAT rule can be handled in a
+                            distributed manner, then this flow  is  only  proā€
+                            grammed  on  the  gateway  port instance where the
+                            logical_port specified in the NAT rule resides.
+
+                            Some of the actions are different for  this  case,
+                            using  the  external_mac specified in the NAT rule
+                            rather than the gateway portā€™s Ethernet address E:
+
+                            eth.src = external_mac;
+                            arp.sha = external_mac;
+
+
+                            or in the case of IPv6 neighbor solicition:
+
+                            eth.src = external_mac;
+                            nd.tll = external_mac;
+
+
+                            This behavior avoids generation  of  multiple  ARP
+                            responses  from  different chassis, and allows upā€
+                            stream MAC learning to point to the correct  chasā€
+                            sis.
+
+              ā€¢      Priority-85  flows  which drops the ARP and IPv6 Neighbor
+                     Discovery packets.
+
+              ā€¢      A priority-84 flow explicitly allows IPv6 multicast trafā€
+                     fic that is supposed to reach the router pipeline  (i.e.,
+                     router solicitation and router advertisement packets).
+
+              ā€¢      A  priority-83 flow explicitly drops IPv6 multicast trafā€
+                     fic that is destined to reserved multicast groups.
+
+              ā€¢      A priority-82 flow allows IP  multicast  traffic  if  opā€ā€
+                     tions:mcast_relay=ā€™trueā€™, otherwise drops it.
+
+              ā€¢      UDP  port  unreachable.  Priority-80  flows generate ICMP
+                     port unreachable messages in reply to UDP  datagrams  diā€
+                     rected  to the routerā€™s IP address, except in the special
+                     case of gateways, which  accept  traffic  directed  to  a
+                     router IP for load balancing and NAT purposes.
+
+                     These  flows  should  not match IP fragments with nonzero
+                     offset.
+
+              ā€¢      TCP reset. Priority-80 flows generate TCP reset  messages
+                     in reply to TCP datagrams directed to the routerā€™s IP adā€
+                     dress,  except in the special case of gateways, which acā€
+                     cept traffic directed to a router IP for  load  balancing
+                     and NAT purposes.
+
+                     These  flows  should  not match IP fragments with nonzero
+                     offset.
+
+              ā€¢      Protocol or address unreachable. Priority-70 flows generā€
+                     ate ICMP protocol or  address  unreachable  messages  for
+                     IPv4  and  IPv6 respectively in reply to packets directed
+                     to the routerā€™s IP address on  IP  protocols  other  than
+                     UDP,  TCP,  and ICMP, except in the special case of gateā€
+                     ways, which accept traffic directed to a  router  IP  for
+                     load balancing purposes.
+
+                     These  flows  should  not match IP fragments with nonzero
+                     offset.
+
+              ā€¢      Drop other IP traffic to this router.  These  flows  drop
+                     any  other  traffic  destined  to  an  IP address of this
+                     router that is not already handled by one  of  the  flows
+                     above,  which  amounts to ICMP (other than echo requests)
+                     and fragments with nonzero offsets. For each IP address A
+                     owned by the router, a priority-60 flow  matches  ip4.dst
+                     ==  A or ip6.dst == A and drops the traffic. An exception
+                     is made and the above flow is not  added  if  the  router
+                     portā€™s  own  IP  address  is used to SNAT packets passing
+                     through that router or if it is used as a  load  balancer
+                     VIP.
+
+       The flows above handle all of the traffic that might be directed to the
+       router  itself.  The following flows (with lower priorities) handle the
+       remaining traffic, potentially for forwarding:
+
+              ā€¢      Drop Ethernet local broadcast. A  priority-50  flow  with
+                     match  eth.bcast drops traffic destined to the local Ethā€
+                     ernet  broadcast  address.  By  definition  this  traffic
+                     should not be forwarded.
+
+              ā€¢      Avoid  ICMP  time  exceeded  for multicast. A priority-32
+                     flow with match ip.ttl == {0,  1}  &&&&  !ip.later_frag  &&&&
+                     (ip4.mcast  ||  ip6.mcast) and actions drop; drops multiā€
+                     cast packets whose TTL has expired without  sending  ICMP
+                     time exceeded.
+
+              ā€¢      ICMP  time exceeded. For each router port P, whose IP adā€
+                     dress is A, a priority-31 flow with match inport == P  &&&&
+                     ip.ttl  == {0, 1} &&&& !ip.later_frag matches packets whose
+                     TTL has expired, with the following actions  to  send  an
+                     ICMP time exceeded reply for IPv4 and IPv6 respectively:
+
+                     icmp4 {
+                         icmp4.type = 11; /* Time exceeded. */
+                         icmp4.code = 0;  /* TTL exceeded in transit. */
+                         ip4.dst = ip4.src;
+                         ip4.src = A;
+                         ip.ttl = 254;
+                         next;
+                     };
+                     icmp6 {
+                         icmp6.type = 3; /* Time exceeded. */
+                         icmp6.code = 0;  /* TTL exceeded in transit. */
+                         ip6.dst = ip6.src;
+                         ip6.src = A;
+                         ip.ttl = 254;
+                         next;
+                     };
+
+
+              ā€¢      TTL  discard. A priority-30 flow with match ip.ttl == {0,
+                     1} and actions drop; drops other packets  whose  TTL  has
+                     expired, that should not receive a ICMP error reply (i.e.
+                     fragments with nonzero offset).
+
+              ā€¢      Next  table.  A  priority-0  flows match all packets that
+                     arenā€™t already handled and uses  actions  next;  to  feed
+                     them to the next table.
+
+     Ingress Table 4: UNSNAT
+
+       This  is  for  already  established connectionsā€™ reverse traffic. i.e.,
+       SNAT has already been done in egress pipeline and now  the  packet  has
+       entered the ingress pipeline as part of a reply. It is unSNATted here.
+
+       Ingress Table 4: UNSNAT on Gateway and Distributed Routers
+
+              ā€¢      If the Router (Gateway or Distributed) is configured with
+                     load balancers, then below lflows are added:
+
+                     For each IPv4 address A defined as load balancer VIP with
+                     the  protocol  P  (and the protocol port T if defined) is
+                     also present as an external_ip in the NAT table, a priorā€
+                     ity-120 logical flow is  added  with  the  match  ip4  &&&&
+                     ip4.dst  ==  A  &&&& P with the action next; to advance the
+                     packet to the next table. If the load balancer has protoā€
+                     col port B defined, then the match also has P.dst == B.
+
+                     The above flows are also added for IPv6 load balancers.
+
+       Ingress Table 4: UNSNAT on Gateway Routers
+
+              ā€¢      If the Gateway router has been configured to  force  SNAT
+                     any  previously DNATted packets to B, a priority-110 flow
+                     matches ip &&&& ip4.dst == B or ip &&&& ip6.dst == B with  an
+                     action ct_snat; .
+
+                     If    the    Gateway    router    is    configured   with
+                     lb_force_snat_ip=router_ip then for every logical  router
+                     port  P attached to the Gateway router with the router ip
+                     B, a priority-110 flow is added with the match inport  ==
+                     P  &&&& ip4.dst == B or inport == P &&&& ip6.dst == B with an
+                     action ct_snat; .
+
+                     If the Gateway router has been configured to  force  SNAT
+                     any previously load-balanced packets to B, a priority-100
+                     flow  matches  ip  &&&&  ip4.dst == B or ip &&&& ip6.dst == B
+                     with an action ct_snat; .
+
+                     For each NAT configuration in the  OVN  Northbound  dataā€
+                     base,  that  asks  to  change  the source IP address of a
+                     packet from A to B, a  priority-90  flow  matches  ip  &&&&
+                     ip4.dst  ==  B  or  ip  &&&&  ip6.dst  ==  B with an action
+                     ct_snat; . If the NAT rule is of type  dnat_and_snat  and
+                     has  stateless=true in the options, then the action would
+                     be next;.
+
+                     A priority-0 logical flow with match 1 has actions next;.
+
+       Ingress Table 4: UNSNAT on Distributed Routers
+
+              ā€¢      For each configuration in the  OVN  Northbound  database,
+                     that  asks  to  change  the source IP address of a packet
+                     from A to B, two priority-100 flows are added.
+
+                     If the NAT rule cannot be handled in a  distributed  manā€
+                     ner,  then  the  below  priority-100  flows are only proā€
+                     grammed on the gateway chassis.
+
+                     ā€¢      The first flow matches ip &&&& ip4.dst == B  &&&&  inā€ā€
+                            port == GW
+                             or ip &&&& ip6.dst == B &&&& inport == GW where GW is
+                            the  distributed gateway port corresponding to the
+                            NAT rule (specified or inferred), with  an  action
+                            ct_snat;  to unSNAT in the common zone. If the NAT
+                            rule is  of  type  dnat_and_snat  and  has  stateā€ā€
+                            less=true in the options, then the action would be
+                            next;.
+
+                            If the NAT entry is of type snat, then there is an
+                            additional match is_chassis_resident(cr-GW)
+                             where cr-GW is the chassis resident port of GW.
+
+                     A priority-0 logical flow with match 1 has actions next;.
+
+     Ingress Table 5: DEFRAG
+
+       This  is to send packets to connection tracker for tracking and defragā€
+       mentation. It contains a priority-0 flow that simply moves  traffic  to
+       the next table.
+
+       For  all  load  balancing  rules  that are configured in OVN_Northbound
+       database for a Gateway router, a priority-100 flow is  added  for  each
+       configured virtual IP address VIP. For IPv4 VIPs the flow matches ip &&&&
+       ip4.dst  ==  VIP. For IPv6 VIPs, the flow matches ip &&&& ip6.dst == VIP.
+       The flow applies the action  ct_dnat; to send IP packets to the connecā€
+       tion tracker for packet de-fragmentation and to dnat the destination IP
+       for the committed connection before sending it to the next table.
+
+       If ECMP routes with symmetric reply are configured  in  the  OVN_Northā€ā€
+       bound  database  for a gateway router, a priority-100 flow is added for
+       each router port on which symmetric replies are configured. The  matchā€
+       ing  logic for these ports essentially reverses the configured logic of
+       the ECMP route. So for instance, a route  with  a  destination  routing
+       policy  will  instead match if the source IP address matches the static
+       routeā€™s prefix. The flow uses the actions chk_ecmp_nh_mac(); ct_next or
+       chk_ecmp_nh(); ct_next to send IP packets to table 76 or to table 77 in
+       order to check if source info are already stored by OVN and then to the
+       connection tracker for  packet  de-fragmentation  and  tracking  before
+       sending it to the next table.
+
+       If load balancing rules are configured in OVN_Northbound database for a
+       Gateway  router,  a priority 50 flow that matches icmp || icmp6 with an
+       action of ct_dnat;, this allows potentially  related  ICMP  traffic  to
+       pass through CT.
+
+     Ingress Table 6: Load balancing affinity check
+
+       Load  balancing  affinity  check  table  contains the following logical
+       flows:
+
+              ā€¢      For all the configured load balancing rules for a logical
+                     router where a positive affinity timeout is specified  in
+                     options  column, that includes a L4 port PORT of protocol
+                     P and IPv4 or IPv6 address VIP, a priority-100 flow  that
+                     matches on ct.new &&&& ip &&&& ip.dst == VIP &&&& P &&&& P.dst ==
+                     PORT (xxreg0 == VIP
+                      in  the  IPv6  case)  with  an  action of reg0 = ip.dst;
+                     reg9[16..31]  =  P.dst;  reg9[6]  =  chk_lb_aff();  next;
+                     (xxreg0 == ip6.dst  in the IPv6 case)
+
+              ā€¢      A  priority  0 flow is added which matches on all packets
+                     and applies the action next;.
+
+     Ingress Table 7: DNAT
+
+       Packets enter the pipeline with destination IP address that needs to be
+       DNATted from a virtual IP address to a real IP address. Packets in  the
+       reverse direction needs to be unDNATed.
+
+       Ingress Table 7: Load balancing DNAT rules
+
+       Following  load  balancing  DNAT  flows are added for Gateway router or
+       Router with gateway port. These flows are programmed only on the  gateā€
+       way  chassis. These flows do not get programmed for load balancers with
+       IPv6 VIPs.
+
+              ā€¢      For all the configured load balancing rules for a logical
+                     router where a positive affinity timeout is specified  in
+                     options  column, that includes a L4 port PORT of protocol
+                     P and IPv4 or IPv6 address VIP, a priority-150 flow  that
+                     matches  on reg9[6] == 1 &&&& ct.new &&&& ip &&&& ip.dst == VIP
+                     &&&& P &&&& P.dst ==  PORT with an action of ct_lb_mark(args)
+                     , where args contains comma separated IP  addresses  (and
+                     optional  port  numbers)  to load balance to. The address
+                     family of the IP addresses of args is the same as the adā€
+                     dress family of VIP.
+
+              ā€¢      If controller_event has been enabled for all the  configā€
+                     ured  load balancing rules for a Gateway router or Router
+                     with gateway port in OVN_Northbound  database  that  does
+                     not  have  configured  backends,  a  priority-130 flow is
+                     added to trigger ovn-controller events whenever the chasā€
+                     sis  receives  a  packet  for  that  particular  VIP.  If
+                     event-elb  meter  has been previously created, it will be
+                     associated to the empty_lb logical flow
+
+              ā€¢      For all the configured load balancing rules for a Gateway
+                     router or Router  with  gateway  port  in  OVN_Northbound
+                     database  that  includes a L4 port PORT of protocol P and
+                     IPv4 or  IPv6  address  VIP,  a  priority-120  flow  that
+                     matches  on ct.new &&&& !ct.rel &&&& ip &&&& ip.dst == VIP &&&& P
+                     &&&& P.dst ==
+                      PORT with an action of ct_lb_mark(args), where args conā€
+                     tains comma separated IPv4 or  IPv6  addresses  (and  opā€
+                     tional port numbers) to load balance to. If the router is
+                     configured  to  force SNAT any load-balanced packets, the
+                     above action will be replaced by  flags.force_snat_for_lb
+                     = 1; ct_lb_mark(args; force_snat);. If the load balancing
+                     rule  is configured with skip_snat set to true, the above
+                     action will be replaced by  flags.skip_snat_for_lb  =  1;
+                     ct_lb_mark(args; skip_snat);. If health check is enabled,
+                     then args will only contain those endpoints whose service
+                     monitor  status  entry in OVN_Southbound db is either onā€ā€
+                     line or empty.
+
+              ā€¢      For all the configured load balancing rules for a  router
+                     in  OVN_Northbound  database that includes just an IP adā€
+                     dress VIP to match on, a priority-110 flow  that  matches
+                     on  ct.new &&&& !ct.rel &&&& ip4 &&&& ip.dst == VIP with an acā€
+                     tion of ct_lb_mark(args), where args contains comma sepaā€
+                     rated IPv4 or IPv6 addresses. If the router is configured
+                     to force SNAT any load-balanced packets, the above action
+                     will  be  replaced  by   flags.force_snat_for_lb   =   1;
+                     ct_lb_mark(args; force_snat);. If the load balancing rule
+                     is  configured  with skip_snat set to true, the above acā€
+                     tion will be  replaced  by  flags.skip_snat_for_lb  =  1;
+                     ct_lb_mark(args; skip_snat);.
+
+                     The  previous  table  lr_in_defrag sets the register reg0
+                     (or xxreg0 for IPv6) and does ct_dnat. Hence  for  estabā€
+                     lished  traffic,  this  table just advances the packet to
+                     the next stage.
+
+              ā€¢      If the load balancer is created with --reject option  and
+                     it  has no active backends, a TCP reset segment (for tcp)
+                     or an ICMP port unreachable packet (for all other kind of
+                     traffic) will be sent whenever an incoming packet is  reā€
+                     ceived for this load-balancer. Please note using --reject
+                     option will disable empty_lb SB controller event for this
+                     load balancer.
+
+              ā€¢      For  the related traffic, a priority 50 flow that matches
+                     ct.rel &&&& !ct.est &&&& !ct.new  with an action  of  ct_comā€ā€
+                     mit_nat;, if the router has load balancer assigned to it.
+                     Along with two priority 70 flows that match skip_snat and
+                     force_snat flags, setting the flags.force_snat_for_lb = 1
+                     or flags.skip_snat_for_lb = 1 accordingly.
+
+              ā€¢      For  the  established  traffic,  a  priority 50 flow that
+                     matches ct.est &&&& !ct.rel &&&&  !ct.new  &&&&  ct_mark.natted
+                     with  an action of next;, if the router has load balancer
+                     assigned to it. Along with two  priority  70  flows  that
+                     match   skip_snat   and  force_snat  flags,  setting  the
+                     flags.force_snat_for_lb = 1 or flags.skip_snat_for_lb = 1
+                     accordingly.
+
+       Ingress Table 7: DNAT on Gateway Routers
+
+              ā€¢      For each configuration in the  OVN  Northbound  database,
+                     that  asks  to  change  the  destination  IP address of a
+                     packet from A to B, a priority-100  flow  matches  ip  &&&&
+                     ip4.dst  ==  A  or  ip  &&&&  ip6.dst  ==  A with an action
+                     flags.loopback = 1; ct_dnat(B);. If the Gateway router is
+                     configured to force SNAT any DNATed packet, the above acā€
+                     tion will be replaced by flags.force_snat_for_dnat  =  1;
+                     flags.loopback  =  1;  ct_dnat(B);. If the NAT rule is of
+                     type dnat_and_snat and has stateless=true in the options,
+                     then the action would be ip4/6.dst= (B).
+
+                     If the NAT  rule  has  allowed_ext_ips  configured,  then
+                     there is an additional match ip4.src == allowed_ext_ips .
+                     Similarly,  for  IPV6,  match  would  be  ip6.src  == alā€
+                     lowed_ext_ips.
+
+                     If the NAT rule has exempted_ext_ips set, then  there  is
+                     an  additional  flow configured at priority 101. The flow
+                     matches if source ip is an exempted_ext_ip and the action
+                     is next; . This flow is used to bypass the ct_dnat action
+                     for a packet originating from exempted_ext_ips.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+       Ingress Table 7: DNAT on Distributed Routers
+
+       On distributed routers, the DNAT table only handles packets with destiā€
+       nation IP address that needs to be DNATted from a virtual IP address to
+       a real IP address. The unDNAT processing in the  reverse  direction  is
+       handled in a separate table in the egress pipeline.
+
+              ā€¢      For  each  configuration  in the OVN Northbound database,
+                     that asks to change  the  destination  IP  address  of  a
+                     packet  from  A  to  B, a priority-100 flow matches ip &&&&
+                     ip4.dst == B &&&& inport == GW, where  GW  is  the  logical
+                     router gateway port corresponding to the NAT rule (speciā€
+                     fied  or inferred), with an action ct_dnat(B);. The match
+                     will include ip6.dst == B in the IPv6 case.  If  the  NAT
+                     rule  is  of type dnat_and_snat and has stateless=true in
+                     the options, then the action would be ip4/6.dst=(B).
+
+                     If the NAT rule cannot be handled in a  distributed  manā€
+                     ner,  then the priority-100 flow above is only programmed
+                     on the gateway chassis.
+
+                     If the NAT  rule  has  allowed_ext_ips  configured,  then
+                     there is an additional match ip4.src == allowed_ext_ips .
+                     Similarly,  for  IPV6,  match  would  be  ip6.src  == alā€
+                     lowed_ext_ips.
+
+                     If the NAT rule has exempted_ext_ips set, then  there  is
+                     an  additional  flow configured at priority 101. The flow
+                     matches if source ip is an exempted_ext_ip and the action
+                     is next; . This flow is used to bypass the ct_dnat action
+                     for a packet originating from exempted_ext_ips.
+
+                     A priority-0 logical flow with match 1 has actions next;.
+
+     Ingress Table 8: Load balancing affinity learn
+
+       Load balancing affinity learn  table  contains  the  following  logical
+       flows:
+
+              ā€¢      For all the configured load balancing rules for a logical
+                     router  where  a positive affinity timeout T is specified
+                     in options
+                      column, that includes a L4 port PORT of protocol  P  and
+                     IPv4  or  IPv6  address  VIP,  a  priority-100  flow that
+                     matches on reg9[6] == 0 &&&& ct.new &&&& ip &&&& reg0 == VIP &&&&
+                     P &&&& reg9[16..31] ==  PORT (xxreg0 == VIP   in  the  IPv6
+                     case)  with  an  action  of commit_lb_aff(vip = VIP:PORT,
+                     backend = backend ip: backend port, proto = P, timeout  =
+                     T);.
+
+              ā€¢      A  priority  0 flow is added which matches on all packets
+                     and applies the action next;.
+
+     Ingress Table 9: ECMP symmetric reply processing
+
+              ā€¢      If ECMP routes with symmetric reply are configured in the
+                     OVN_Northbound database for a gateway  router,  a  priorā€
+                     ity-100  flow is added for each router port on which symā€
+                     metric replies are configured.  The  matching  logic  for
+                     these  ports essentially reverses the configured logic of
+                     the ECMP route. So for instance, a route with a  destinaā€
+                     tion  routing  policy will instead match if the source IP
+                     address matches the static routeā€™s prefix. The flow  uses
+                     the   action   ct_commit   {   ct_label.ecmp_reply_eth  =
+                     eth.src;"   "   ct_mark.ecmp_reply_port   =   K;};   comā€ā€
+                     mit_ecmp_nh(); next;
+                      to  commit  the  connection  and storing eth.src and the
+                     ECMP reply port binding tunnel key K in the ct_label  and
+                     the traffic pattern to table 76 or 77.
+
+     Ingress Table 10: IPv6 ND RA option processing
+
+              ā€¢      A  priority-50  logical  flow  is  added for each logical
+                     router port configured with  IPv6  ND  RA  options  which
+                     matches  IPv6  ND  Router Solicitation packet and applies
+                     the action put_nd_ra_opts and advances the packet to  the
+                     next table.
+
+                     reg0[5] = put_nd_ra_opts(options);next;
+
+
+                     For a valid IPv6 ND RS packet, this transforms the packet
+                     into  an  IPv6 ND RA reply and sets the RA options to the
+                     packet and stores 1 into  reg0[5].  For  other  kinds  of
+                     packets,  it  just  stores 0 into reg0[5]. Either way, it
+                     continues to the next table.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Ingress Table 11: IPv6 ND RA responder
+
+       This table implements IPv6 ND RA responder for the IPv6 ND  RA  replies
+       generated by the previous table.
+
+              ā€¢      A  priority-50  logical  flow  is  added for each logical
+                     router port configured with  IPv6  ND  RA  options  which
+                     matches  IPv6 ND RA packets and reg0[5] == 1 and responds
+                     back to the  inport  after  applying  these  actions.  If
+                     reg0[5]   is   set   to  1,  it  means  that  the  action
+                     put_nd_ra_opts was successful.
+
+                     eth.dst = eth.src;
+                     eth.src = E;
+                     ip6.dst = ip6.src;
+                     ip6.src = I;
+                     outport = P;
+                     flags.loopback = 1;
+                     output;
+
+
+                     where E is the MAC address and I is the IPv6  link  local
+                     address of the logical router port.
+
+                     (This  terminates  packet processing in ingress pipeline;
+                     the packet does not go to the next ingress table.)
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Ingress Table 12: IP Routing Pre
+
+       If a packet arrived at this table from Logical Router Port P which  has
+       options:route_table  value set, a logical flow with match inport == "P"
+       with priority 100  and  action  setting  unique-generated  per-datapath
+       32-bit  value  (non-zero)  in  OVS register 7. This registerā€™s value is
+       checked in next table. If packet didnā€™t  match  any  configured  inport
+       (<lt;main>gt; route table), register 7 value is set to 0.
+
+       This table contains the following logical flows:
+
+              ā€¢      Priority-100  flow  with match inport == "LRP_NAME" value
+                     and action, which set route table identifier in reg7.
+
+                     A priority-0 logical flow with match 1 has actions reg7 =
+                     0; next;.
+
+     Ingress Table 13: IP Routing
+
+       A packet that arrives at this table is an  IP  packet  that  should  be
+       routed  to  the address in ip4.dst or ip6.dst. This table implements IP
+       routing, setting reg0 (or xxreg0 for IPv6) to the next-hop  IP  address
+       (leaving ip4.dst or ip6.dst, the packetā€™s final destination, unchanged)
+       and  advances  to  the next table for ARP resolution. It also sets reg1
+       (or xxreg1) to the  IP  address  owned  by  the  selected  router  port
+       (ingress  table  ARP  Request  will generate an ARP request, if needed,
+       with reg0 as the target protocol address and reg1 as the source  protoā€
+       col address).
+
+       For  ECMP routes, i.e. multiple static routes with same policy and preā€
+       fix but different nexthops, the above actions are deferred to next  taā€
+       ble.  This  table, instead, is responsible for determine the ECMP group
+       id and select a member id within the group based on 5-tuple hashing. It
+       stores group id in reg8[0..15] and member id in reg8[16..31]. This step
+       is skipped with a priority-10300 rule if the traffic going out the ECMP
+       route is reply traffic, and the ECMP route was configured to  use  symā€
+       metric  replies.  Instead,  the  stored  values in conntrack is used to
+       choose the destination. The ct_label.ecmp_reply_eth tells the  destinaā€
+       tion   MAC   address   to   which   the  packet  should  be  sent.  The
+       ct_mark.ecmp_reply_port tells the logical  router  port  on  which  the
+       packet  should be sent. These values saved to the conntrack fields when
+       the initial ingress traffic is received over the ECMP route and commitā€
+       ted to conntrack. If REGBIT_KNOWN_ECMP_NH is  set,  the  priority-10300
+       flows  in this stage set the outport, while the eth.dst is set by flows
+       at the ARP/ND Resolution stage.
+
+       This table contains the following logical flows:
+
+              ā€¢      Priority-10550 flow  that  drops  IPv6  Router  Solicitaā€
+                     tion/Advertisement  packets  that  were  not processed in
+                     previous tables.
+
+              ā€¢      Priority-10550 flows that drop IGMP and MLD packets  with
+                     source MAC address owned by the router. These are used to
+                     prevent looping statically forwarded IGMP and MLD packets
+                     for which TTL is not decremented (it is always 1).
+
+              ā€¢      Priority-10500 flows that match IP multicast traffic desā€
+                     tined  to  groups  registered  on  any  of  the  attached
+                     switches and sets outport  to  the  associated  multicast
+                     group  that  will eventually flood the traffic to all inā€
+                     terested attached logical switches. The flows also decreā€
+                     ment TTL.
+
+              ā€¢      Priority-10460 flows that  match  IGMP  and  MLD  control
+                     packets,  set  outport  to the MC_STATIC multicast group,
+                     which ovn-northd populates with the  logical  ports  that
+                     have  options :mcast_flood=ā€™ā€™trueā€™ā€™. If no router ports are
+                     configured to flood multicast  traffic  the  packets  are
+                     dropped.
+
+              ā€¢      Priority-10450  flow  that matches unregistered IP multiā€
+                     cast traffic decrements  TTL  and  sets  outport  to  the
+                     MC_STATIC  multicast  group,  which  ovn-northd populates
+                     with   the    logical    ports    that    have    options
+                     :mcast_flood=ā€™ā€™trueā€™ā€™. If no router ports are configured to
+                     flood multicast traffic the packets are dropped.
+
+              ā€¢      IPv4 routing table. For each route to IPv4 network N with
+                     netmask  M, on router port P with IP address A and Etherā€
+                     net address E, a logical flow with match ip4.dst ==  N/M,
+                     whose priority is the number of 1-bits in M, has the folā€
+                     lowing actions:
+
+                     ip.ttl--;
+                     reg8[0..15] = 0;
+                     reg0 = G;
+                     reg1 = A;
+                     eth.src = E;
+                     outport = P;
+                     flags.loopback = 1;
+                     next;
+
+
+                     (Ingress table 1 already verified that ip.ttl--; will not
+                     yield a TTL exceeded error.)
+
+                     If  the route has a gateway, G is the gateway IP address.
+                     Instead, if the route is from a configured static  route,
+                     G is the next hop IP address. Else it is ip4.dst.
+
+              ā€¢      IPv6 routing table. For each route to IPv6 network N with
+                     netmask  M, on router port P with IP address A and Etherā€
+                     net address E, a logical flow with match in CIDR notation
+                     ip6.dst == N/M, whose priority is the integer value of M,
+                     has the following actions:
+
+                     ip.ttl--;
+                     reg8[0..15] = 0;
+                     xxreg0 = G;
+                     xxreg1 = A;
+                     eth.src = E;
+                     outport = inport;
+                     flags.loopback = 1;
+                     next;
+
+
+                     (Ingress table 1 already verified that ip.ttl--; will not
+                     yield a TTL exceeded error.)
+
+                     If the route has a gateway, G is the gateway IP  address.
+                     Instead,  if the route is from a configured static route,
+                     G is the next hop IP address. Else it is ip6.dst.
+
+                     If the address A is in the link-local  scope,  the  route
+                     will be limited to sending on the ingress port.
+
+                     For  each  static  route the reg7 == id &&&& is prefixed in
+                     logical flow match portion. For routes  with  route_table
+                     value set a unique non-zero id is used. For routes within
+                     main>gt;>gt; route table (no route table set), this id value is
+                     0.
+
+                     For each connected route (route to the LRPā€™s subnet CIDR)
+                     the  logical flow match portion has no reg7 == id &&&& preā€
+                     fix to have route to LRPā€™s subnets in all routing tables.
+
+              ā€¢      For ECMP routes, they are grouped by policy  and  prefix.
+                     An  unique  id  (non-zero) is assigned to each group, and
+                     each member is also  assigned  an  unique  id  (non-zero)
+                     within each group.
+
+                     For  each IPv4/IPv6 ECMP group with group id GID and memā€
+                     ber ids MID1, MID2, ..., a logical  flow  with  match  in
+                     CIDR  notation  ip4.dst  == N/M, or ip6.dst == N/M, whose
+                     priority is the integer value of M, has the following acā€
+                     tions:
+
+                     ip.ttl--;
+                     flags.loopback = 1;
+                     reg8[0..15] = GID;
+                     select(reg8[16..31], MID1, MID2, ...);
+
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+     Ingress Table 14: IP_ROUTING_ECMP
+
+       This  table  implements  the  second part of IP routing for ECMP routes
+       following the previous table. If a packet matched a ECMP group  in  the
+       previous  table,  this  table matches the group id and member id stored
+       from the previous table, setting reg0 (or xxreg0 for IPv6) to the next-
+       hop IP address (leaving ip4.dst or ip6.dst, the packetā€™s final destinaā€
+       tion, unchanged) and advances to the next table for ARP resolution.  It
+       also  sets  reg1  (or  xxreg1)  to the IP address owned by the selected
+       router port (ingress table ARP Request will generate an ARP request, if
+       needed, with reg0 as the target protocol address and reg1 as the source
+       protocol address).
+
+       This processing is skipped for reply traffic being sent out of an  ECMP
+       route if the route was configured to use symmetric replies.
+
+       This table contains the following logical flows:
+
+              ā€¢      A  priority-150  flow  that matches reg8[0..15] == 0 with
+                     action  next;  directly  bypasses  packets  of   non-ECMP
+                     routes.
+
+              ā€¢      For  each  member  with ID MID in each ECMP group with ID
+                     GID, a priority-100 flow with match reg8[0..15] == GID &&&&
+                     reg8[16..31] == MID has following actions:
+
+                     [xx]reg0 = G;
+                     [xx]reg1 = A;
+                     eth.src = E;
+                     outport = P;
+
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+     Ingress Table 15: Router policies
+
+       This table adds flows for the logical router policies configured on the
+       logical   router.   Please   see   the  OVN_Northbound  database  Logiā€ā€
+       cal_Router_Policy table documentation in ovn-nb for supported actions.
+
+              ā€¢      For each router policy configured on the logical  router,
+                     a  logical  flow  is added with specified priority, match
+                     and actions.
+
+              ā€¢      If the policy action is reroute with 2 or  more  nexthops
+                     defined,  then the logical flow is added with the followā€
+                     ing actions:
+
+                     reg8[0..15] = GID;
+                     reg8[16..31] = select(1,..n);
+
+
+                     where GID is the ECMP group id  generated  by  ovn-northd
+                     for  this  policy and n is the number of nexthops. select
+                     action selects one of the nexthop member id, stores it in
+                     the register reg8[16..31] and advances the packet to  the
+                     next stage.
+
+              ā€¢      If  the  policy  action  is reroute with just one nexhop,
+                     then the logical flow is added  with  the  following  acā€
+                     tions:
+
+                     [xx]reg0 = H;
+                     eth.src = E;
+                     outport = P;
+                     reg8[0..15] = 0;
+                     flags.loopback = 1;
+                     next;
+
+
+                     where  H  is the nexthop  defined in the router policy, E
+                     is the ethernet address of the logical router  port  from
+                     which  the  nexthop  is  reachable  and  P is the logical
+                     router port from which the nexthop is reachable.
+
+              ā€¢      If a router policy has the option pkt_mark=m set  and  if
+                     the  action  is  not  drop, then the action also includes
+                     pkt.mark = m to mark the packet with the marker m.
+
+     Ingress Table 16: ECMP handling for router policies
+
+       This table handles the ECMP for the  router  policies  configured  with
+       multiple nexthops.
+
+              ā€¢      A priority-150 flow is added to advance the packet to the
+                     next  stage  if the ECMP group id register reg8[0..15] is
+                     0.
+
+              ā€¢      For each ECMP reroute router policy  with  multiple  nexā€
+                     thops,  a  priority-100  flow is added for each nexthop H
+                     with the match reg8[0..15] == GID &&&&  reg8[16..31]  ==  M
+                     where  GID  is  the  router  policy group id generated by
+                     ovn-northd and M is the member id of the nexthop H generā€
+                     ated by ovn-northd. The following actions  are  added  to
+                     the flow:
+
+                     [xx]reg0 = H;
+                     eth.src = E;
+                     outport = P
+                     "flags.loopback = 1; "
+                     "next;"
+
+
+                     where  H  is the nexthop  defined in the router policy, E
+                     is the ethernet address of the logical router  port  from
+                     which  the  nexthop  is  reachable  and  P is the logical
+                     router port from which the nexthop is reachable.
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+     Ingress Table 17: ARP/ND Resolution
+
+       Any  packet that reaches this table is an IP packet whose next-hop IPv4
+       address is in reg0 or IPv6 address is in xxreg0.  (ip4.dst  or  ip6.dst
+       contains  the final destination.) This table resolves the IP address in
+       reg0 (or xxreg0) into an output port in outport and an Ethernet address
+       in eth.dst, using the following flows:
+
+              ā€¢      A priority-500 flow that  matches  IP  multicast  traffic
+                     that  was  allowed in the routing pipeline. For this kind
+                     of traffic the outport was already set so the  flow  just
+                     advances to the next table.
+
+              ā€¢      Priority-200  flows that match ECMP reply traffic for the
+                     routes configured to use symmetric replies, with  actions
+                     push(xxreg1);    xxreg1    =    ct_label;    eth.dst    =
+                     xxreg1[32..79]; pop(xxreg1); next;. xxreg1 is  used  here
+                     to  avoid masked access to ct_label, to make the flow HW-
+                     offloading friendly.
+
+              ā€¢      Static MAC bindings. MAC bindings can be known statically
+                     based on data in the OVN_Northbound database. For  router
+                     ports  connected to logical switches, MAC bindings can be
+                     known statically from the addresses column in  the  Logiā€ā€
+                     cal_Switch_Port  table.  (Note: the flow is not installed
+                     for IPs of logical switch ports of type virtual, and  dyā€
+                     namic  MAC binding is used for those IPs instead, so that
+                     virtual parent failover does not depend on ovn-northd, to
+                     achieve better failover performance.)  For  router  ports
+                     connected  to  other logical routers, MAC bindings can be
+                     known statically from the mac and networks column in  the
+                     Logical_Router_Port  table.  (Note:  the  flow is NOT inā€
+                     stalled for the IP addresses that belong  to  a  neighbor
+                     logical  router  port  if  the current router has the opā€ā€
+                     tions:dynamic_neigh_routers set to true)
+
+                     For each IPv4 address A whose host is known to have  Ethā€
+                     ernet  address  E  on  router port P, a priority-100 flow
+                     with match outport === P &&&& reg0 == A has actions eth.dst
+                     = E; next;.
+
+                     For each IPv6 address A whose host is known to have  Ethā€
+                     ernet  address  E  on  router port P, a priority-100 flow
+                     with match outport === P  &&&&  xxreg0  ==  A  has  actions
+                     eth.dst = E; next;.
+
+                     For each logical router port with an IPv4 address A and a
+                     mac  address of E that is reachable via a different logiā€
+                     cal router port P, a priority-100 flow with match outport
+                     === P &&&& reg0 == A has actions eth.dst = E; next;.
+
+                     For each logical router port with an IPv6 address A and a
+                     mac address of E that is reachable via a different  logiā€
+                     cal router port P, a priority-100 flow with match outport
+                     === P &&&& xxreg0 == A has actions eth.dst = E; next;.
+
+              ā€¢      Static  MAC  bindings  from NAT entries. MAC bindings can
+                     also be known for the entries in  the  NAT  table.  Below
+                     flows  are programmed for distributed logical routers i.e
+                     with a distributed router port.
+
+                     For each row in the NAT table with IPv4 address A in  the
+                     external_ip column of NAT table, below two flows are proā€
+                     grammed:
+
+                     A  priority-100  flow with the match outport == P &&&& reg0
+                     == A has actions eth.dst = E; next;, where P is the  disā€
+                     tributed  logical  router port, E is the Ethernet address
+                     if set in the external_mac column of  NAT  table  for  of
+                     type dnat_and_snat, otherwise the Ethernet address of the
+                     distributed  logical router port. Note that if the exterā€ā€
+                     nal_ip is not within  a  subnet  on  the  owning  logical
+                     router, then OVN will only create ARP resolution flows if
+                     the  options:add_route  is set to true. Otherwise, no ARP
+                     resolution flows will be added.
+
+                     Corresponding to the above flow, a priority-150 flow with
+                     the match inport == P &&&& outport == P &&&& ip4.dst == A has
+                     actions drop; to exclude packets that have  gone  through
+                     DNAT/unSNAT  stage but failed to convert the destination,
+                     to avoid loop.
+
+                     For IPv6 NAT entries, same flows are added, but using the
+                     register xxreg0 and field ip6 for the match.
+
+              ā€¢      If the router datapath runs a port with redirect-type set
+                     to bridged, for each distributed NAT rule with  IP  A  in
+                     the  logical_ip  column  and  logical port P in the logiā€ā€
+                     cal_port column of NAT table, a priority-90 flow with the
+                     match outport == Q &&&& ip.src ===  A  &&&&  is_chassis_resiā€ā€
+                     dent(P),  where  Q is the distributed logical router port
+                     and action get_arp(outport, reg0);  next;  for  IPv4  and
+                     get_nd(outport, xxreg0); next; for IPv6.
+
+              ā€¢      Traffic  with  IP  destination  an  address  owned by the
+                     router  should  be  dropped.  Such  traffic  is  normally
+                     dropped in ingress table IP Input except for IPs that are
+                     also shared with SNAT rules. However, if there was no unā€
+                     SNAT  operation  that  happened  successfully  until this
+                     point in the pipeline  and  the  destination  IP  of  the
+                     packet  is  still  a  router owned IP, the packets can be
+                     safely dropped.
+
+                     A priority-2 logical  flow  with  match  ip4.dst  =  {..}
+                     matches  on  traffic  destined  to  router owned IPv4 adā€
+                     dresses which are also SNAT IPs.  This  flow  has  action
+                     drop;.
+
+                     A  priority-2  logical  flow  with  match  ip6.dst = {..}
+                     matches on traffic destined  to  router  owned  IPv6  adā€
+                     dresses  which  are  also  SNAT IPs. This flow has action
+                     drop;.
+
+                     A priority-0 logical that flow matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+              ā€¢      Dynamic MAC bindings. These flows resolve MAC-to-IP bindā€
+                     ings  that  have  become known dynamically through ARP or
+                     neighbor discovery. (The ingress table ARP  Request  will
+                     issue  an  ARP or neighbor solicitation request for cases
+                     where the binding is not yet known.)
+
+                     A priority-0 logical flow  with  match  ip4  has  actions
+                     get_arp(outport, reg0); next;.
+
+                     A  priority-0  logical  flow  with  match ip6 has actions
+                     get_nd(outport, xxreg0); next;.
+
+              ā€¢      For a distributed gateway LRP with redirect-type  set  to
+                     bridged,   a  priority-50  flow  will  match  outport  ==
+                     "ROUTER_PORT" and !is_chassis_resident ("cr-ROUTER_PORT")
+                     has actions eth.dst = E; next;, where E is  the  ethernet
+                     address of the logical router port.
+
+     Ingress Table 18: Check packet length
+
+       For  distributed  logical  routers or gateway routers with gateway port
+       configured with options:gateway_mtu to a valid integer value, this  taā€
+       ble  adds  a priority-50 logical flow with the match outport == GW_PORT
+       where GW_PORT is  the  gateway  router  port  and  applies  the  action
+       check_pkt_larger and advances the packet to the next table.
+
+       REGBIT_PKT_LARGER = check_pkt_larger(L); next;
+
+
+       where L is the packet length to check for. If the packet is larger than
+       L, it stores 1 in the register bit REGBIT_PKT_LARGER. The value of L is
+       taken from options:gateway_mtu column of Logical_Router_Port row.
+
+       If the port is also configured with options:gateway_mtu_bypass then anā€
+       other  flow  is added, with priority-55, to bypass the check_pkt_larger
+       flow.
+
+       This table adds one priority-0 fallback flow that matches  all  packets
+       and advances to the next table.
+
+     Ingress Table 19: Handle larger packets
+
+       For  distributed  logical  routers or gateway routers with gateway port
+       configured with options:gateway_mtu to a valid integer value, this  taā€
+       ble  adds  the  following  priority-150  logical  flow for each logical
+       router port with the match inport == LRP &&&& outport == GW_PORT &&&&  REGā€ā€
+       BIT_PKT_LARGER  &&&&  !REGBIT_EGRESS_LOOPBACK,  where  LRP is the logical
+       router port and GW_PORT is the gateway port and applies  the  following
+       action for ipv4 and ipv6 respectively:
+
+       icmp4 {
+           icmp4.type = 3; /* Destination Unreachable. */
+           icmp4.code = 4;  /* Frag Needed and DF was Set. */
+           icmp4.frag_mtu = M;
+           eth.dst = E;
+           ip4.dst = ip4.src;
+           ip4.src = I;
+           ip.ttl = 255;
+           REGBIT_EGRESS_LOOPBACK = 1;
+           REGBIT_PKT_LARGER = 0;
+           next(pipeline=ingress, table=0);
+       };
+       icmp6 {
+           icmp6.type = 2;
+           icmp6.code = 0;
+           icmp6.frag_mtu = M;
+           eth.dst = E;
+           ip6.dst = ip6.src;
+           ip6.src = I;
+           ip.ttl = 255;
+           REGBIT_EGRESS_LOOPBACK = 1;
+           REGBIT_PKT_LARGER = 0;
+           next(pipeline=ingress, table=0);
+       };
+
+
+              ā€¢      Where  M  is the (fragment MTU - 58) whose value is taken
+                     from options:gateway_mtu  column  of  Logical_Router_Port
+                     row.
+
+              ā€¢      E is the Ethernet address of the logical router port.
+
+              ā€¢      I is the IPv4/IPv6 address of the logical router port.
+
+       This  table  adds one priority-0 fallback flow that matches all packets
+       and advances to the next table.
+
+     Ingress Table 20: Gateway Redirect
+
+       For distributed logical routers where one or more of the logical router
+       ports specifies a gateway chassis, this table redirects certain packets
+       to the distributed gateway port instances  on  the  gateway  chassises.
+       This table has the following flows:
+
+              ā€¢      For each NAT rule in the OVN Northbound database that can
+                     be  handled in a distributed manner, a priority-100 logiā€
+                     cal flow with match ip4.src == B  &&&&  outport  ==  GW  &&
+                     is_chassis_resident(P), where GW is the distributed gateā€
+                     way port specified in the NAT rule and P is the NAT logiā€
+                     cal port. IP traffic matching the above rule will be manā€
+                     aged  locally setting reg1 to C and eth.src to D, where C
+                     is NAT external ip and D is NAT external mac.
+
+              ā€¢      For each dnat_and_snat NAT rule with  stateless=true  and
+                     allowed_ext_ips  configured,  a  priority-75 flow is proā€
+                     grammed with match ip4.dst == B and action outport =  CR;
+                     next;  where  B is the NAT rule external IP and CR is the
+                     chassisredirect port representing  the  instance  of  the
+                     logical  router  distributed  gateway port on the gateway
+                     chassis. Moreover a priority-70 flow is  programmed  with
+                     same  match  and action drop;. For each dnat_and_snat NAT
+                     rule with stateless=true and exempted_ext_ips configured,
+                     a priority-75 flow is programmed with match ip4.dst ==  B
+                     and  action  drop; where B is the NAT rule external IP. A
+                     similar flow is added for IPv6 traffic.
+
+              ā€¢      For each NAT rule in the OVN Northbound database that can
+                     be handled in a distributed manner, a priority-80 logical
+                     flow with drop action if the NAT logical port is  a  virā€
+                     tual port not claimed by any chassis yet.
+
+              ā€¢      A  priority-50  logical flow with match outport == GW has
+                     actions outport = CR; next;,  where  GW  is  the  logical
+                     router  distributed  gateway  port  and  CR  is the chasā€ā€
+                     sisredirect port representing the instance of the logical
+                     router distributed gateway port on the gateway chassis.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Ingress Table 21: ARP Request
+
+       In the common case where the Ethernet destination  has  been  resolved,
+       this  table outputs the packet. Otherwise, it composes and sends an ARP
+       or IPv6 Neighbor Solicitation request. It holds the following flows:
+
+              ā€¢      Unknown MAC address. A priority-100 flow for IPv4 packets
+                     with match eth.dst == 00:00:00:00:00:00 has the following
+                     actions:
+
+                     arp {
+                         eth.dst = ff:ff:ff:ff:ff:ff;
+                         arp.spa = reg1;
+                         arp.tpa = reg0;
+                         arp.op = 1;  /* ARP request. */
+                         output;
+                     };
+
+
+                     Unknown MAC address. For each IPv6 static  route  associā€
+                     ated  with  the  router  with the nexthop IP: G, a priorā€
+                     ity-200 flow for  IPv6  packets  with  match  eth.dst  ==
+                     00:00:00:00:00:00  &&&&  xxreg0 == G with the following acā€
+                     tions is added:
+
+                     nd_ns {
+                         eth.dst = E;
+                         ip6.dst = I
+                         nd.target = G;
+                         output;
+                     };
+
+
+                     Where E is the multicast mac derived from the Gateway IP,
+                     I is the solicited-node multicast  address  corresponding
+                     to the target address G.
+
+                     Unknown MAC address. A priority-100 flow for IPv6 packets
+                     with match eth.dst == 00:00:00:00:00:00 has the following
+                     actions:
+
+                     nd_ns {
+                         nd.target = xxreg0;
+                         output;
+                     };
+
+
+                     (Ingress  table  IP  Routing initialized reg1 with the IP
+                     address owned by outport and (xx)reg0 with  the  next-hop
+                     IP address)
+
+                     The  IP  packet  that triggers the ARP/IPv6 NS request is
+                     dropped.
+
+              ā€¢      Known MAC address. A priority-0 flow with match 1 has acā€
+                     tions output;.
+
+     Egress Table 0: Check DNAT local
+
+       This table checks if the packet  needs  to  be  DNATed  in  the  router
+       ingress  table  lr_in_dnat  after  it  is SNATed and looped back to the
+       ingress pipeline. This check is done only for routers  configured  with
+       distributed  gateway  ports and NAT entries. This check is done so that
+       SNAT and DNAT is done in different zones instead of a common zone.
+
+              ā€¢      A priority-0 logical flow with match 1 has  actions  REGā€ā€
+                     BIT_DST_NAT_IP_LOCAL = 0; next;.
+
+     Egress Table 1: UNDNAT
+
+       This  is  for  already  established connectionsā€™ reverse traffic. i.e.,
+       DNAT has already been done in ingress pipeline and now the  packet  has
+       entered  the  egress  pipeline as part of a reply. This traffic is unDā€
+       NATed here.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Egress Table 1: UNDNAT on Gateway Routers
+
+              ā€¢      For IPv6 Neighbor Discovery or Router Solicitation/Adverā€
+                     tisement traffic, a priority-100 flow with action next;.
+
+              ā€¢      For all IP packets, a priority-50  flow  with  an  action
+                     flags.loopback = 1; ct_dnat;.
+
+     Egress Table 1: UNDNAT on Distributed Routers
+
+              ā€¢      For  all the configured load balancing rules for a router
+                     with gateway port in  OVN_Northbound  database  that  inā€
+                     cludes  an  IPv4  address VIP, for every backend IPv4 adā€
+                     dress B defined for the VIP a priority-120 flow  is  proā€
+                     grammed  on gateway chassis that matches ip &&&& ip4.src ==
+                     B &&&& outport == GW, where GW is the logical router  gateā€
+                     way port with an action ct_dnat;. If the backend IPv4 adā€
+                     dress  B is also configured with L4 port PORT of protocol
+                     P, then the match also  includes  P.src  ==  PORT.  These
+                     flows are not added for load balancers with IPv6 VIPs.
+
+                     If  the  router is configured to force SNAT any load-balā€
+                     anced  packets,  above  action  will   be   replaced   by
+                     flags.force_snat_for_lb = 1; ct_dnat;.
+
+              ā€¢      For  each  configuration  in  the OVN Northbound database
+                     that asks to change  the  destination  IP  address  of  a
+                     packet  from an IP address of A to B, a priority-100 flow
+                     matches ip &&&& ip4.src == B &&&& outport == GW, where GW  is
+                     the logical router gateway port, with an action ct_dnat;.
+                     If  the  NAT rule is of type dnat_and_snat and has stateā€ā€
+                     less=true in the options, then the action would be next;.
+
+                     If the NAT rule cannot be handled in a  distributed  manā€
+                     ner,  then the priority-100 flow above is only programmed
+                     on the gateway chassis with the action ct_dnat.
+
+                     If the NAT rule can be handled in a  distributed  manner,
+                     then  there  is an additional action eth.src = EA;, where
+                     EA is the ethernet address associated with the IP address
+                     A in the NAT rule. This allows upstream MAC  learning  to
+                     point to the correct chassis.
+
+     Egress Table 2: Post UNDNAT
+
+              ā€¢      A  priority-50 logical flow is added that commits any unā€
+                     tracked flows from the previous table  lr_out_undnat  for
+                     Gateway  routers.  This flow matches on ct.new &&&& ip with
+                     action ct_commit { } ; next; .
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Egress Table 3: SNAT
+
+       Packets that are configured to be SNATed get their  source  IP  address
+       changed based on the configuration in the OVN Northbound database.
+
+              ā€¢      A  priority-120 flow to advance the IPv6 Neighbor soliciā€
+                     tation packet to next table to skip  SNAT.  In  the  case
+                     where  ovn-controller  injects an IPv6 Neighbor Solicitaā€
+                     tion packet (for nd_ns action) we donā€™t want  the  packet
+                     to go through conntrack.
+
+       Egress Table 3: SNAT on Gateway Routers
+
+              ā€¢      If  the Gateway router in the OVN Northbound database has
+                     been configured to force SNAT a  packet  (that  has  been
+                     previously  DNATted)  to  B,  a priority-100 flow matches
+                     flags.force_snat_for_dnat ==  1  &&&&  ip  with  an  action
+                     ct_snat(B);.
+
+              ā€¢      If  a  load balancer configured to skip snat has been apā€
+                     plied to the Gateway router pipeline, a priority-120 flow
+                     matches flags.skip_snat_for_lb == 1 &&&& ip with an  action
+                     next;.
+
+              ā€¢      If  the Gateway router in the OVN Northbound database has
+                     been configured to force SNAT a  packet  (that  has  been
+                     previously   load-balanced)  using  router  IP  (i.e  opā€ā€
+                     tions:lb_force_snat_ip=router_ip), then for each  logical
+                     router  port  P  attached to the Gateway router, a priorā€
+                     ity-110 flow matches flags.force_snat_for_lb == 1 &&&& outā€ā€
+                     port == P
+                      with an action ct_snat(R); where R is the IP  configured
+                     on  the  router  port.  If  R is an IPv4 address then the
+                     match will also include ip4 and if it is an IPv6 address,
+                     then the match will also include ip6.
+
+                     If the logical router port P is configured with  multiple
+                     IPv4 and multiple IPv6 addresses, only the first IPv4 and
+                     first IPv6 address is considered.
+
+              ā€¢      If  the Gateway router in the OVN Northbound database has
+                     been configured to force SNAT a  packet  (that  has  been
+                     previously  load-balanced)  to  B,  a  priority-100  flow
+                     matches flags.force_snat_for_lb == 1 &&&& ip with an action
+                     ct_snat(B);.
+
+              ā€¢      For each configuration in the  OVN  Northbound  database,
+                     that  asks  to  change  the source IP address of a packet
+                     from an IP address of A or to change the  source  IP  adā€
+                     dress  of a packet that belongs to network A to B, a flow
+                     matches ip &&&& ip4.src == A &&&& (!ct.trk ||  !ct.rpl)  with
+                     an action ct_snat(B);. The priority of the flow is calcuā€
+                     lated  based on the mask of A, with matches having larger
+                     masks getting higher priorities. If the NAT  rule  is  of
+                     type dnat_and_snat and has stateless=true in the options,
+                     then the action would be ip4/6.src= (B).
+
+              ā€¢      If  the  NAT  rule  has  allowed_ext_ips configured, then
+                     there is an additional match ip4.dst == allowed_ext_ips .
+                     Similarly, for  IPV6,  match  would  be  ip6.dst  ==  alā€
+                     lowed_ext_ips.
+
+              ā€¢      If  the  NAT rule has exempted_ext_ips set, then there is
+                     an additional flow configured at the priority + 1 of corā€
+                     responding NAT rule. The flow matches if  destination  ip
+                     is an exempted_ext_ip and the action is next; . This flow
+                     is  used  to bypass the ct_snat action for a packet which
+                     is destinted to exempted_ext_ips.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+       Egress Table 3: SNAT on Distributed Routers
+
+              ā€¢      For each configuration in the  OVN  Northbound  database,
+                     that  asks  to  change  the source IP address of a packet
+                     from an IP address of A or to change the  source  IP  adā€
+                     dress  of  a  packet  that belongs to network A to B, two
+                     flows are added. The priority P of these flows are calcuā€
+                     lated based on the mask of A, with matches having  larger
+                     masks getting higher priorities.
+
+                     If  the  NAT rule cannot be handled in a distributed manā€
+                     ner, then the below flows  are  only  programmed  on  the
+                     gateway  chassis increasing flow priority by 128 in order
+                     to be run first.
+
+                     ā€¢      The first flow is added with the calculated priorā€
+                            ity P and match ip &&&& ip4.src == A &&&&  outport  ==
+                            GW,  where  GW is the logical router gateway port,
+                            with an action ct_snat(B); to SNATed in the common
+                            zone. If the NAT rule is of type dnat_and_snat and
+                            has stateless=true in the options, then the action
+                            would be ip4/6.src=(B).
+
+                     If the NAT rule can be handled in a  distributed  manner,
+                     then  there  is an additional action (for both the flows)
+                     eth.src = EA;, where EA is the ethernet  address  associā€
+                     ated  with  the IP address A in the NAT rule. This allows
+                     upstream MAC learning to point to the correct chassis.
+
+                     If the NAT  rule  has  allowed_ext_ips  configured,  then
+                     there is an additional match ip4.dst == allowed_ext_ips .
+                     Similarly,  for  IPV6,  match  would  be  ip6.dst  == alā€
+                     lowed_ext_ips.
+
+                     If the NAT rule has exempted_ext_ips set, then  there  is
+                     an  additional  flow configured at the priority P + 2  of
+                     corresponding NAT rule. The flow matches  if  destination
+                     ip  is  an exempted_ext_ip and the action is next; . This
+                     flow is used to bypass the  ct_snat  action  for  a  flow
+                     which is destinted to exempted_ext_ips.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Egress Table 4: Post SNAT
+
+       Packets reaching this table are processed according to the flows below:
+
+              ā€¢      A  priority-0  logical  flow that matches all packets not
+                     already handled (match 1) and action next;.
+
+     Egress Table 5: Egress Loopback
+
+       For distributed logical routers where one of the logical  router  ports
+       specifies a gateway chassis.
+
+       While  UNDNAT  and SNAT processing have already occurred by this point,
+       this traffic needs to be forced through egress loopback  on  this  disā€
+       tributed gateway port instance, in order for UNSNAT and DNAT processing
+       to  be applied, and also for IP routing and ARP resolution after all of
+       the NAT processing, so that the packet can be forwarded to the destinaā€
+       tion.
+
+       This table has the following flows:
+
+              ā€¢      For each NAT rule in the OVN  Northbound  database  on  a
+                     distributed  router,  a  priority-100  logical  flow with
+                     match ip4.dst == E &&&& outport == GW  &&&&  is_chassis_resiā€ā€
+                     dent(P),  where E is the external IP address specified in
+                     the NAT rule, GW is the distributed gateway  port  correā€
+                     sponding  to  the  NAT  rule (specified or inferred). For
+                     dnat_and_snat NAT rule, P is the logical  port  specified
+                     in  the  NAT rule. If logical_port column of NAT table is
+                     NOT set, then P is the chassisredirect port  of  GW  with
+                     the following actions:
+
+                     clone {
+                         ct_clear;
+                         inport = outport;
+                         outport = "";
+                         flags = 0;
+                         flags.loopback = 1;
+                         reg0 = 0;
+                         reg1 = 0;
+                         ...
+                         reg9 = 0;
+                         REGBIT_EGRESS_LOOPBACK = 1;
+                         next(pipeline=ingress, table=0);
+                     };
+
+
+                     flags.loopback  is set since in_port is unchanged and the
+                     packet may return back to that port after NAT processing.
+                     REGBIT_EGRESS_LOOPBACK is set  to  indicate  that  egress
+                     loopback has occurred, in order to skip the source IP adā€
+                     dress check against the router address.
+
+              ā€¢      A priority-0 logical flow with match 1 has actions next;.
+
+     Egress Table 6: Delivery
+
+       Packets that reach this table are ready for delivery. It contains:
+
+              ā€¢      Priority-110  logical flows that match IP multicast packā€
+                     ets on each enabled logical router port  and  modify  the
+                     Ethernet  source  address  of the packets to the Ethernet
+                     address of the port and then execute action output;.
+
+              ā€¢      Priority-100 logical flows that match packets on each enā€
+                     abled logical router port, with action output;.
+
+              ā€¢      A priority-0 logical flow that matches  all  packets  not
+                     already handled (match 1) and drops them (action drop;).
+
+DROP SAMPLING
+       As  described  in  the previous section, there are several places where
+       ovn-northd might decided to drop a packet by explicitly creating a Logā€ā€
+       ical_Flow with the drop; action.
+
+       When debug drop-sampling has been cofigured in the OVN Northbound dataā€
+       base, the ovn-northd will replace all the drop;  actions  with  a  samā€ā€
+       ple(priority=65535,         collector_set=id,        obs_domain=obs_id,
+       obs_point=@cookie) action, where:
+
+              ā€¢      id is the value the debug_drop_collector_set option  conā€
+                     figured in the OVN Northbound.
+
+              ā€¢      obs_id  has  itā€™s  8  most  significant bits equal to the
+                     value of  the  debug_drop_domain_id  option  in  the  OVN
+                     Northbound  and  itā€™s  24 least significant bits equal to
+                     the datapathā€™s tunnel key.
+
+OVN 23.06.3                       ovn-northd                     ovn-northd(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-northd.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-northd.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..f4d2c3236d224d49c8c29059fabf4fe5e670ec18 GIT binary patch literal 196655 zcma%?LwK(}ySMAE+O}=mwr$%sR@+ru|Jt@~+qP}D>wBJk?EOvN$vaAN-8quUJvh(& z5;8?maXKb?R%o)(tGEJaGBPQ9cLx(AS1Sj5ZbC;RS4##97eYEkIzl>A6(Mmk<$qcc z2fKehSQ%T{TDf}3nz@_V^8K>_A)V9z&XZSA6jDjKtFxJr9kgfGvDUit<`|mas>ai1AXR;g z{Z)Bp_}YUi7aIvz>On>Fk#i83C^0AqE)c53Biu~s8G(yEgJ#=WhU|{Af1Mm_$F1{C z`zgD>5k1CKvB1gg@yUQ$Wt0JZ=toLMZz|5q$BnUk$KFTuTVWGcI1;70n@~m!7O62f>|UG8!zO!hjxO{ zCK`ZGzW3n=!?zRhp3p%?w!gPc4BQj_i{QEQZp@nQn2C$Y;gFvLtxRR~GRyuWX+pxI zX+W-pmR9W=Oy~Lu+9xNB-c3isDXLsJXZ>Z@=4|MDwY|UjWY+~Yuja~IC%snc37{j> zujBKwKE!lHH6I^ZHN||o+u!o>oT#q` zXVcfdv!G_<{F8aVNA8W{+wveZK6rF|EUL1#)q%guC*bww(r{2Q`Y>BF=5_uFHC|iKYVWa)nC=qw=|HiefB*5+!5JlD9k@*%P7J ziy0qLe+O1Gc>?pB=K|8}Z^H%~)o>!3ng&Z>X?kT6FBr{zsN3#w4gnQMDmLR_)SE)* zW|8U7!8+%1gL|uPV-p{W#`%XItO7W?W`I&z)}OWVNoEIBYO=U*Pi?NC(yr#(dk+?@ zPu@tA(#s{DjmL;ir}(vG&!$QINx8B|b+ODYidSlC)U`w~;R|7+fK%(v_GnQ00(^`_ ziG+N{&zH8T!M6;gj4VjfijWe58^ygZpqq z{jE?@|KOF8JC|WhL3V$n-A46#??na}?LnW%OEq+%^QZ#rbpOkyx5tQkN+t@YNCWRX zT3-Ld%batX1SlL9V4ax3M$e2oA!qix&Y+25gw33*?9f6a6ESQkBGR9r6Kv<#WJ771 zaUId;X~UQ9AlHZL%gtKvQSlHl?ZKI%-**^0Ev-W~xP>+O&0t?6)KSS~}>XxF%s1=s*AX0hkZ>KmM{ z-iu~ZM}gTA#TONxm~u2{+kztJl>`!{&sLnhDoqC-UG__!&*?F^-LBYZEjq*cfzM)v zU7TodYss3W91BNyNWb9upRk#37Y@`+n(Vk%joNTW6u43`v(EV<|js`|CgcTUvUU7UdL_mAh(%2mj^xONA?1s|rviOBdb0oRS`*2+)R+lqr#f!>Ngo4{fU#~&^&ft~OUm&dc@ zr|h&&Q*w&9{%x&+0`q~jNWL2?cTmRoKB*0}#F7_cg&p4^gxo?GyC6ugdjsF-5%vm! zlt)k#H-C}Ds)Z9Q4*Zd&5v4?a6!OLgAE~lbJv@V?qt3GC#?#!A@D8XSh&Dg;--~%e zlQAw&Lza?-xhmK6Wc(sYxCb)AAc*BaZf$}W*qcItK`HM=q4!5;8TdHXP`NMe>|1P2`ynjxo zL|LST)1q6bRiVz2okAEmxM$nNl;E9nh1NK)#i=%(M7eFy$+ez%9wyiACt^YT1!yYF z@lm(`Gc+1{?`Cwb1rs$p*^s^g{sBBR#mxGymSq1#iM+6t2%8Z9CqtAPC4zi6^_=Bh zNY|u57=(B-r40ob`DAlzOmxtuRU3)O&SSboJT*F#(Nm|i$fm`sa4QUxkSKwE|F2yR zK}y(8Z!JH!`q=_YDdyInzJ0k(JXC#uC_Aa z=7fINjX$;Yzb9ErehDa|e(z=+tYb7{3zlEVmycMaR`hu;Az9W+-Z3Vl&&*ENkG(?n z%zLsZ#URII=>z&5uTdh}LZbO4Kt6bNYxobBElSRhf0I$4

m=5IrzA z45DIqD**l$EEGd2>J}gzSGdR{QCkAFSgQ`d8lDivUf!Z8-k%^7Lhqe9LgmGhF}Imo zu6nsRLRa+NS~#5!!pqw^cNB-@Xk$CIUf4ib9Qc;tzKncwbmz~=7`?K}|^3nL+v>d8+>(Cts)}96lM5!$Gb)&w20}yl#W43#p(sP^bdgq-c1BWP;RU4Y2N%AsOHoWlRM! z7hY0PD;rNN&FDv$HCuM-HO}>hC?~hsH5pV91Y@`?&Oyw zXY`gpDvXR*p5>=xj8UPWKHJkNS+I{BuFojl*?UKZVR_AVWvNQYRHAOnlvHAM70FCO zbEOy6Zk$iwTdI_=-2VC?2C+|3JhQBG@Icwe8izqQ%x{7K zU#@i#V%e_ULI2=ZQTxD~+bMJlaBXh$qP~DgxKN;kvctnnow@LK$#03d$k>eWb^*1k zd4xNZTqv@wbq-!<#%|Ktv-XQ;hh8)l>((xZFso8-s;m;`jlEXxwMMdV#|J&#;WA1M zqxl`pEQGU`%s=I=!qkDcz9hpm96n^Qi|5bj2;YP7Bv-p_*Xqe=PQb60D1q^}v{YCY ztv-8tzC0A7C4uq0Ajh$VK^#vrFY0nx0qi}8#bn@iKkQ>6*Up^|7|Lj#Ae_)+-XnbY zgIgUg57Bn`$q_a}i8gHTaC{#Tk{BPhuDWVHR;SlSW3sGl@-No=g_TmG*DAy6-F&%klBotlQE$m=B&96`aX&34B%z zS;)it`8c<4Yr3e3et1gS4^Cii;y%x|wTT>jDFnwUd(Vm#xUxE_K`2Kq z(_}s07({x$b?`!eac8tEz(dR~>c@(w{rqXj%N#ex3lSlg(kEs;z!CgOtaefUq`H@i zjW>Pa6i<*DaYh=BeaI#)4EZg=+gCw5DyxKYN>!T@Z;Dshleg~8ldYqU zAfvy~Q*g&@^^_`;mr$M|S!|NuQnpe7YvFVUiRJ<`W-5>pZu>`N^Zes(-YV>a^P#IE z!{5d<7_C?PbK!OBmx{&N=I3D?NjUg%FUH}jv#$g@sWccc0?Kzco(sa)f~e%V`}L~o zhxRGB_k127ShbIj$34f_J4bj?6quR4>HjkPKfQms|6khww`E~uWQP9V8qkF z1=ZS{&YLU$TESkmp@gWTqlEbb;iSBHwQW1Hi3PP8FCtK4nNVQA80#n8`9Dt3`O*#q z8E@*58BJiC!1;M~xnbjQ#xdBEZnP-y&a$1oHga;*iZUX=b`Q{jlvO zX;8I7ae&AoJo<}oR`XhZ>cgo110!^=ea(5B^WkoYnun>-frn>JwW_f?8i>0vhx09GcBVmK@CdTaA*CxVkbgR@d1)1O9XniIyCa(j8a?&S6 z1V-{)P48H_;OJtUyKsC08$Bd+%^KdH_+Cd37t2WcfGv#mTQh#OKp{^bZEn}KH zOf5f~9&T){9{oLFfLBn)lbMG#Zi`p*o7*#o-r!ulvBde^+Z7#tBW^g;yX-vnHNQgC z?&FkX#nf5L`&$sFJ*im|#rphSu;!7D5bi{tpqND2Td`$lYEzn) zk0q(@axu!NI#^>-%v6Kf7NDmh(%R$-z&*YBl5CSm_FhvHO>XdNw}Y)`*QB@Ln(8D% zT@%;%#u;l;?)#o(g2I`4+evMZ-#pqJCT<0?9bG_j9a(X`N9|Utph2q_IxUnUnUs)v z_&wE#i8`mEOW8k-5vi%03G8}LMgo(9&b$Q=P7vOo4ikw%`Npy1L;j4Pv z2@<pQD^YGpCqXg_Xyq?dR8@|J$AmuPQ+h92D>qkMd#|EflFBYMOk z*TCXvVZ23gek!N(I!2L!lv+=m7GV(Ww(TpPc;{Q$*0^A&WR41%LrhwDkjlfWw{OD{ zdQ2U9l8+a%r=38@vN5$u_S%Z$m3nCf&67WgX1|}VLPBSglb}kE*Cd%am8U)az-|}m zr@>L}WP#rz)^V(Vgn+Ik-$PpL%Wg{j=R|BM+h)mzgl6NYr^uS}ayrbPxV0_DjjSo@ zG@Saugebpy^2?s+E73m58WazPljIseUdt_M?l z;V;{Y$QV<8+g~1A0V9AezhHQ5Z-ixWN$+sRzprf?bs5J=0VF!aQ0?)_d|R|3rsgW9 zjQ&@i`^HTl6{?lgfH5P{;O=NK*|qfi7bcbA>*TwokMN_5A)a2Ys(7Lq_%7c(&_FKH9re1)%CSGY z{cRF#b6-DvxWdta-k;mYt^3YYK~o9=*6caQ7alw?j3N-K+j-t$~Re<^O5pcFOU-uz@!oQ z`5J)X_;^x^zyfTrYv$9p&_lW{G!~xKuH&km+Z5t>^?{!)I#K|7pQ*~0KXC*FHd%?;g|&VWEK>2> zA6Pzn`F(`w8TxggS;@ee$MPfKX00dNtd=s+O_IsRpc12T=Zuz@*KD&HwpOoqYQWkq z&sql#r30p7Dc%=_orvR@QlzHH<^jVv*=oz<$~L7Cz}O@n9KfVLFn3 z*3yW`!qLRKz~Qd%m}(Wcy#~EqkA2HFnT+!p8%RsFxuN;0CN16cwU8NLGX0pwslhqC zaf5QY9-SA+MLF^<-hk}51Uv_5o> zP&}_gRzpHi^6#7#QIMdcuF6;mBBmyPIT8h~ zYlfp$HMhOoTZ*eJa}(5^ZM+?gR*1ZL1fJ|bqY z^J80p;&J{8%L}*aW=`pz?aA`o!@kccPAnM|@whm`g;(Drpl1%*7ula$GwyvCR=`t= zGAv6AeD2V2>dDL-8Av}ovr)Z+(qRhxVVj<7AOOtxvgas1W5oJuSM%b>PDLtVUD-_PzKXB(2oFef8ge_hf??}iuwJ-@tW zew{UH-B786)-s+=)pblyK9i6~?N<6yBprJ#y%d~5S%(`seRdt9K+&N_s#+7uD*B+0B8BnE@lU`%H2!Mg ze91K>SqKc_fRyJ~#(%Xa@YATZ#UdS7z_1H{ih=K(aE zYCv&BstfN7ONkoM&Y;F@gj`+(*FlJTZK)K)NFTZD@%$a)nLMY0(XjT}t5@blKL?gj zo(PI~cP|Cerx69_C`=u#0{j*Ub*Bqdw>aPw7j5;4mxBZw5_H)v!WPn~G~+rP+TQ+h zR-fhx(86y{fK82C$yiC50c25uLMB02!*C`hHLsN+fc>sikTcpH$Ck_lkD8KGP$a=> zB!Cgbo5%pB13%DH8!=OQHjoe3@dSm;$&07nVvoZCn!&r`7V!Cde(?QXI$8PHt8hr5 zR5M}#6ToXrZr`5e;h>(Yuh-@CeSR|iJdif_w14n5?OQ#hE34m<=$BiWO*b*I3@ltD zwweV|p*=4H)EIw_Al;)0Qd?|dssiC58PTMK46K((zfQ4@UR|zmFT~@=#df1oUS1x? z;>S~rYDqw#Eh#tLNu`N0D>wi{=iw{m<~@f~!siWkpM(!pO^8XZikd=aXb4MhYyF_> zfJ{}@&LI6I?b{{o?)82o2O~203PJ}?>1t8CtKS7U7BuW``ijbnCYUzs>R5RP?nruA zU0yfUArteYX%68~VwecPPyiuQeZ7qx7g~=%sH^KGNgqYN0N*!kZg9sh83hxK3_0 zhZ_2Bb2JfJJGx;)N_bW(6}jb-hx^00-C$||E0D>x#Eqx9QJ@oUCN@5&I1ERQS_nn91UsQc{2?y185Gmdk1{}J>0{GFRJ;V%srSYXY(X7qZ7f(I9!q~|x}Q#j$_ zE|w&DN@T|5)*SmOKZWucApCY1NvH1+dAtD@_d>w*84`|b-eeTtsK+HoLjGjYKr#ZH zSULFTCQlv4T&KG)UoD!(v*JDP2Y+}EdACabCn(@A_~uWT)_+*r|LEBNXd5dN=l|C> zuK&n#m>K_@FlSm@F6poZse87zZ(7wlOeAnmqr%tG*1=5W<;L5?mV)gPRHBG<1eGc& znU(vKJHYJ6q~l&ncp)11G=9VRI+Hk1{P6j574AnIBsUT0Z&~l@Wo003t$%010hLm~ z^y-m=hX%*n%J$dAi%GD+7G2E|p)|5M^33@5$Apc?KWWY&>7D*bxKXOJ=V49TLnff) zI!rA{VAp?Y3D)R{!YOs!gHquuUF^s{;MnhFVV30qf49WxLPCgi7iy?hpqpg(beg^P z{uRaDj1ftV3-5FQTen9iM`56kFx4_$qa&-5I(%AX37G&^mFV1V$}lA#`5(;OU*}rJ?}l}gv#?m zmtO5-385W}TVe)F7%ksE7jC;-lk|b`SGHB>F0S^ z8|%4|RHiRyP2qYyM%PHbR^Z9-$hDL9fuwWW#=`QbkrBrD@TtVXra201j#$?o7m_f~ zy<~-$tWT@#Bi|)8;+t@$%zbEa{hW$d29#~G+k zzoVR!fS2F-Bp!&$2(cqPd2b9Ojw&iKxnp#R{kb1^HJ@ODjoz!8APCZ7=zulmi%^a& zvW#HtPUx?GQp+GPm)F4Gb7|h!{7g)_kU506p_9GPZb+<=1k9v2R#*@`Kx@?SU4vL$CPWY_mJ)= zx`+uouP29F$i23MJzkgVkXd7l*qDK0A(at0%DN$GC0TO9y8uFxrnK_iW?W?n8#SbN z&r*3JH{I?mszBkh!JMz=q}t6OGJw?ND6GRb&U^GdlZ64mcF)D+EQ`UEzeotCd3WH; z#<1}PIp@Y3*-XeHTW{)RgG&}{Vd3P6`-~zs2)QgjC!43Mw~r$gI7SiDEB0u9G;m_@ zUBjOW2w$k#VA3aTCZxSwa`(hB>MnU%h3TinZW8E> zSnq4!p`G|IV!2^sJtP4;7FRpJ*j^!CK|%9c=X`}8hEIM2kiShZOzX}QDTk5y=coRGEiMN~5+ z$TQil7G^J1N1%p|w1%HEs5L!1G2CYG}^zLes%> zam6DU3XRYy~2q{PpbvPX1h425-# z+Cga66H6=gH{S7piO4Vel?>T-5x%H4RqmN}79dn-vn)vxQv$h-Y=gt(!mTeiQlUpL zVPrzNHtkH%ydR|eEB5H=Ti zefDn%%wkn?-U5a(-rElL$s)q>;3db7d0=5OsiT6z@UPYJDO3=KLvkGlTR~<4wt}Xa zQ?hmTGvHC%91y3lkM2_oS@(&LgtvY|bM>#XL~0kdX}&%@)#&;A-0mJ)qCM4LCJmc_ zFLOjn__t1)TREQ30m(EVsoA=Q<>InsW0|IF?<9m}5w*#?u&$jI@VX)SB6M9u5L977 z+^Q5mcKIL7<`$&FDvTO%TP`ZK;AXkD^$_BVIi)SP8(=}!s}qGfPAoNPkWvf^Z= z_itEqi+L^_I3b~H3jhVSA^E4Ep_6=EwQ2m^TXL=zH}I;&rTo}+{x~)2Xg-8?ayH1* zpCb6A;je(jLMARf^l0kJ!cS6}U*BeDl{L`A^RCnqA0jMAaijJpwpl?6_(g{qD(Tr{ zA*b6o$ElJ^QMp=ee$UUE+#7#xyIXg=yFXWHL!b#Iset4mdWCcit;`cGN0zr6aQiUjsYYLUZwFova%3&ap<HJd!hj^!$a)ts_AEw=Ax7Rz|PESI(YC1FPL2Fx zA4yF)z0J%lrk#%wqkpRA$Lbxrm?kmV5_4F5SA5Tr@7Tm8!LSQ2Um0PZ$`F@^U~**+ zaq5Fx%StFC0mZs4u|-clB3(r7SnVd|;pK8U2=kk;pY#Ck%TtJ~v*nX?)c)iN2rAi%uT z1U#&`dLh8b+T~dGOLp+XnYPz;{XTd;fQ6Eu8{H-77(KG@x?C(8GrLSZnna8^+xM$g zk;hOB3FJxQx(HKR0I!z0x3+Gd>Nu!o$}RU}3^p*9>PsG(2z_sfwGt$y#!x@cR_Qfj z#)C^*V^ceMq@>+@P}y)Xdfg{5LS~=zrMec86v6oPbWBn)y<^f3yDx)4)2`HRvzD4N z^Rt1f?q=L=VadZHI@x-PfsE4<{lbGQuU9fuxI;hO4EMr$Q>x{Jm!1z?1TT4dr! zbWyW8N$#DY+XRplwj6K+TEA3FTX+T!aH>brYpu z6h<@I5ae)3jrO0yAy_)&AXCefV%Yk+w6W2qcOQ+m> z4y}G3G<*J?EQk~L^A9a-2=3F>CNPS5?ObUaf>9kyr-hR)RNV4XTsrM0A``KiJS!7j zg+iwU2jJgF+o^_oAB{g#G1a&3x94SOQ zyey>zJGQH48bq(X-+~VXXMOpr#7f6trK5s8;*-hXXo@Sxb=EN9^U8#9Q9SRFE)!Xk z8cnKip;HZebSxv?&;<{- zq(_9+2F;rtf~_wNJ|*>(E-jp_gdNy`Dr%$agpm8lW(u#;UksDJsY;*@wY&C+`DR4H zL###txqeLJ_~ftZ2rhp{Nu}|4V`Zn`$11 z)PV)9SMmm#$(e3w>?{^KuD0>TY!hPX3SI(ge7%Q6ocRX=w;SJ{bt*ymeXwUOZkt=>p3fNHnl>6*X>aVVG&?0lABMyV{Y0K9&@f$` zP5Eho`;$frS52sV1S!zfG-e>biJ;?#HTZC)C|Tg_;%_|>GUtbIsNZJ^A3tK)AcrKg zMzo`v{S1P#kn`!=p$6Xau{(4RMEs2h1!Ia?TNb!~nY6=%B8Ug@pDEzM&iFleyeod|Q*#+wRjD(EAvH zY9&XIG&l)FCaLVA8S4VKqTfau^=F*e$(j&0N%{wrE1-ZQVSV|G{H@Qw>oE9@4k5(- z=X?WmN3uo1!5`{L`^u>afY1yHqz#-cTQ45tBA6M{>Z3*gkE&+KB5d3rx{*p!ahY%< zqf}c*7x$%K&VRUk45dmjOVYlZ3WV^)>X1g1hZlJfx0I!55U2E~0>1Hi6W!=H#&IK(NnVkQ%1&3b(O0Z%gjC2*dsW`WKK<4JoMn%b#h` zF7A0kK7@@y-oDSwzw?*X8gIW8=w;*&5w7(`Dr}F7D_SV&SnAOG-bpZWd$WNK2xJ-c0;g0ZHjwxxTzc7dpoN%Qz2d!{fLbbQejd4$xh7n%QRn zOe#*Qg=AWG3Z++0oi7lCAU8C*#0puXVPh}k=Es)H(Qq<-|DO_O1xaS@Bemkyx~4p? z*|CFjQg4iuTk|7qjmEAbt*mpl`i_rBw06{M`KtR5q)uv2L>7-PqNFA~>oiijdwXUD zXR}|&Vl~m_oiB^uHEA-;?xx$Yg| z5>BnDpywWM0o&IrGR_oIi?Iy`Ju?cw6f6{RI}7>v!$64?teyJ5`VpMxZ=DitaSEZy&9_U1h#i$;=IA6 z{z-_qcJCf-9LP`RI~iZW^}VrUb$t%k603|nH6tC}Pu`lw^rdfP-H0(=PiTS3b#uE{ zcylJnOqF#gZVX`faS!&-ZOlrYK>0f_WHKdA*DADKjYiEm%}QyjyT8&EouTiJlO4;F zb3iV&M7In9O@teJpe{D8809ZDU&(v2GmuWMR-#uA zL`r*XJz|XASQR;B&zA_%MHOt)V!G^s0~^Y3XM61-VQQ#jo#6Q02+Af?{`+J46A-Z7 z)$w!xef)ky$u2mx~x0PL;h?mepG+&pN5l#g>6 zZgRvC$b!hix~pL9bPq~EF~yo(s&}LS%1@Q$y(;=9pL=rm*Nv=?sbctO@WtX4X=KWj z{NeYy{`QNmZshcl_-cO_wrncSxa>(GLjs%qp(o_veufu~Up-AbTGak+9r_h)g**Qm%d!PSm6$nwoO8u1;G*rM)05=~x+e`Qx(qVa6hQ$r;TL{F z)W=%qI%1(F4qV304{c|#_ZN}-8H_vYBuA(DYScuqu96qg(d@Atz3^-QE(k0B`D{_w z(o@(^3Fzcu7YRe?E39MVY}T0*n;CvzVd1ZUHJ0uvJ8^M6Y%qJM&>@wFP1SQtj>q+o z8=)R_YyNSy3%GSS@xA}`$M|)8hp%f7_&4llR+&-Ybiua@K6ddI@JQNkSbF)R9{G3Wg(RdRTa8{S%MZuog^i(93|Kez09oCJsLhR)iSe0aRar#MWoL=u`6{6rrH{p z1SdD0X68W6R&eWw4@6!TE}3Wr5 zZ}2lyT%MZX^h)yss_Th*iwrDrmO7Nw3?WNTIX9NfBi|V%J+8pS#ZI%1>SXBzD;!6aNZ+TT@+CfkYy#L5u*2k!pzhW_Ip6<>=Yk@|0HTVWZS{QA+ za(MWdtKHYhOstk$Gc~j^3_}2)cSz&waq_Ve+{?=k>NR&e3m?CEpl3xbfv5fEX%6f| z>Gi18gGHKNJ$!F}O}?FM7mOdvG&8-Owe>1cG*c*3VD58Qq^6%}xaldC*K)S-l>3kR zxDovE{z<$zk%#(OIT$I^R|XK!q@`uBJAW(nGy6dKMD*zVRx}FqnKEeJX}P>eysdck zv`>4Ot81XBVz-)ZGJ9J}`zexg5Vcxzak)}@R`ClfUiV!BxX@tLr+ShvU=h{S_#iUU z=sQ1&s9H_!0?7QTCkFfaGW&v799O$6bt?v+k)wQOv$1(1zS_Y3fU62C6NIF6bC?7&P$*c%v&&dpRf})oYKbhWM>Ua9*SC!&Q2$%x9nDvfhM7DzALg z+86p6rbK2K&gyloSLJB$=n!8-50TcLAjYl8dtk4gYitsFa_?TCuz;c}lHGho71zTi-AsXI+#(E(U@l!)`I~^Q5)Hnhi;oh}7+ObT zQ?~%c$RtB_#A;igBSzHB*Xpss!Gqo=x?v=uNHsg~K*%fK^}`TxH6sAUS^`xLUwY1o zP)+NizWC-tM>uYf)MbssQRJTRr*vPe-@TqxYici3nhK-d*Ezbok80|Rh>3Qy3Efil z_PbIcRpk_3{B++r&NhP_9isyxvOf4NB4b)UpBUy}#Ws*J8T)Jjv?@$l&E$|F8r*Z? zVQA0#+BEWDHdw#2bX;qRbDXz93^(~SfAr033@XI8DbE8}%|w7K1JL{2-wu$V93)L4 z?T|YX_c~HYD90zee71sb-zzzyqy4I}F1U>OxC&!q4``(I=QTj>tLd8EJ$N3hElRhS zL1MCE<>DYb9`|F1!%ZD6melQtBi0Od_CY{_k$dQfvO!j9JyiWnGl%YQ=kzp(r- zR5Noj{{J|Nnd3j9n)APb>T0dYf8Q2uU($3mF(oH%oQ?Rn-&-mltB$za4mZY^mI&sN z5t9RB!)dPATJXH1{+P^M+w)2$G+Y(w(xVOgZ;iH}=4^fp`O>E={N0*0_B&|YOj4j2 z_)2Xj7|!f&<8IGW(- zqhYWlw@D}S@$tSnm5nIM`=@cL2FYl^1gpNX6XiA}&7aex)~Y!|1^+!k?-1ay+iNUv z>Xuu3_6h24#wpo`_cuvu1-?`8SL*?>qzHF}9$39rQIG2O4pIH)Uy~i1VvlKD1ZdwJ zh#pSUQ^$aAK2sA+M=Ia*6<4@UyGP;er^;o%OV!Sri!K%4U0WhY`!RaaDV0VikrB8S zv6VJR{H}2e^I{Q2f_v$KO3ATOZ?rp3#7>WJeg*Q^H- lv4>>88C#yJD-CX-?&e0wK8i8>xfFpQC@#_9(yz05|k5HCN2_B^v}WJ$*vx? z%OgEWf{RAwG6KpKVEetATitJq}>o0v)KfMOrzq@RHtxW`zU6UB?>Q#;sCz;RK z&CWCEu34fVECTo@>82-DJ%xy=aO_KRqfN{dJPMX@y!TYTK2=#&Uo|tZlkVTeG{}T4i^VVoA@&H{R)OEovI4GkvcY5$Wl6sbNX7C z;Y@(ZOerto?(r8tmg~DjlBIng6&XQaX{O#9bZk{IPu*~u(i36}9f5m^kGVm_&}l|` zy>zAcqDl^I+wH3Ls%^$ypA$DiL0`#Lb;0iqRY8|9=htu2JAMS&>C71G#~N#E2muZ| z70PP6a^GU~c#QEh0XFZ_qR9`h$q%?42wq zf-95}Rr$3o#FJab(t~>KW6-J64!3 z9Dt(>Q->bw65@M`7NLTXUU0zUfl6Fg8X_yv1Xon(>(BNv3?P8}Lbw1E_<0aW5Icfz zVz^rh-!l`QEE6JD-mYSbgFF^YMug2oz!z0;HAmkzO0AX%wndEsEvb$FKQR|HtpVCbjGVdqN^tA!A*7sorS`MfQ7hdU|ljQas2 zP&bZ@f=nx!XOM~&N zusARVi;v&#b4nW9BA=UYXyBCf=LWjWeAOx#j~xF|whg!NgqCgeK6?q;7_?Z_ilMTl zCBdMSq`1g9Nw%|Wf%vVUjf_d{x%nT`0)^oS0t}@N946|jqhM=jMx(2`el|r=-;hB= z#a3Q)=hWRCEbBNGhT4l!t&fdLgeCuvriR+mmd|T51=_R8J`A^{>+mN zYS8T3pbp&t(GR6LmRm+7!UGfdoB>-%^ITYO{?vcowiuWz+sZ@#-f%Uc*^LTY3ULpe>r+A3sq0c{k-qTn78J&|hOb_?Po~b0 zLu%EOSevZq*`DXiACI5s>s7=yU>YPY%gof9td2e~n4LG!rpYM8taEp&@98v%NfpbW zGgfTXR_oP43nxk0&vN#U%5!;L4bmf^)lK*k*i|1wtm)SpipwOn0RSR*)c2TsQmg_lSC`P3EgE=B0Hx%Djb?lS`loD&WXTuyXUAZ z$Ui}ZN-6AZBXd)sMrj9xiOZ6hGz7+hq`)^XJ4z7Y$cI*KCX_P0k;i&G{i!Et7Gogw zVbrEf7Sm6y`0D2eXl);T@3YSS9I?-|Kti&!j>zp^PupT(HYH_@{WU>wIZO!mxP|>C z@p=MNG&Dq%up6DQ55*|cjynR@dCnm{;lS1mkKyoWG&`iZz>l$tXuUhZ6V5Vmj#MQ^ zg`w;_`xYDX!+LXNcokAAkQGBG?x3pl%?0ayXkr12Mm2@Z|u(FilIQPw`|7MRN0m8SW{ zsqz}jCB$9dRDyIypH4C@1_s}mUREaQ-DV87d06_mTI4c8Yg@X~1fi0$=kFlQJbz5a zrl_Q}nfdFbw_CJ2SvM_Te}tV@0oE0f;)5$IICSZ*ZJqk;n6fx16}DMTfae@{1p0Y2 z7KbKMJstbEy9p1jY1-;n`+!uV2Z8sEQ;e%Fj2T%(e`#}giW=(L`6Go(O3D2wUhz5E zgl#GM`yn8pz6NA69lxD1tDl|$32GHDD=^>9JU2lmUDQv8&2@@2YKphL(kTg(+QBoX z=Y>6qd&tOo7gUyzq*K>tunp8$3HrIcK`xVZ4=;U0mRsuoTK=L@7 z+0SWFK#X7CMW-*#U;!(S#z>#yZVdNOTJ#q2Zb6tM9*EfN{ps=-@Ubf%-8b}A@gqAO zRT!orwrzP>fMHyF3|v<%8Z$i;Ci;$toc|#)7QOWE;C`q0`No)03n~9kZv2-A|A!md zm|6bsFqVbsKe&;F`M={vIhRdwUZPY&BsvuDTkLQ2_hLznSzMvRUiFtC+5FsQG4A}7{oFpT}%cy zUdv4tfE#>xUZKPUrcLq=4za z@GOIKYg}+9HxyKWumy!@X@EI$Nt5zLf6IXHK0J90%r_(2L`v?DDu`FJR;WOOj z4Rp&Hprni&*KC|!>?f!B_?D9-=R__^qjeZtK}TKPuAO#mGOhAs#p1EEVfj*4ZHW^w zTc<%T(wz37x^rxspmEh<=%=&wMB}c)QMKcG-0_vYqi9nv)=lf{?mQSfqt9}B`Z>P) z;)(tSoXQS4PFnpvGihbf#`Mt08k>a^WnJOR*qkdjPJJAtI7r*8-#?kAZxmEiKrSpW zP7D(i_Zz-!34sM{$>=OwBL#(C1c>#~{wYo=)oZ(ZgOjmRDsZ$4LPf(%gVk26#rkz} zyvNzQI=KHqO=qw%O0AcclKBXvt(1}IVO>ngvX7h8Q96DJ+m#(8h^r?;*kEnYX9BR9 z9)38$`fHTRJXj|6|1ow>%YsE)w%xXE+qP}nwr$(CZQHhO=eC`jH|s>)dO0uk4Kr5E z*~aL-E!TfV64SmQ%}aOOlCq5z+emVFs)z_HO;_38Yjj=B<591O9I*(;MwpH{HPin5 zQLLGu;Sj)?y}`uaL&}YzLivtP@bd zBj}ORG#-Qzu2Mip?;n2%t)uJquZ@p63V83PSEK$2tYFQwO{i1JZtG=l4XS(z-V|3@ z%nDF(B9yjcBcVW?k(EWX?4e{%IXOiFOq4wG)gU((Lc{BDjgSITcvz@I09Pvhi+48P zs_S-YCa#xdeG9fdycYmU0s0EoX;L`(kYypN29SJ4IUEgBxb^_T12UohL4IH&EpnR4 z=wM2rp!(ue^idB<66vt$UcZ6NpGgEVPiu^#lDfBa>d-?z=>oT{7;ElZU<-9ZsMLV~GRF;cE!2#U$;&_u zh3*beMq=D!#Mn|m11cYC0z-V??y+rm&IPVLdf*{_AsZPOF7HgmMzq7Y0Nk+@P#E%W zgb>BDj#YS-P+a9|VtI@h^p*R76kSa`t=xII3Aw!p3_Qr@a%3)7D~Wq>-!$RT6_iy9SSIbB0U&sDZQ#P@F!twCZR4}LtD^y)&-!pOJpQ<(123)H2pq~#LI861*N7FBq z0)-4IU!}%2{T*2FDFO;tt5&frs(xxyTkomR8QC(T+i73cExFO4VcWK`!v`0pt136h&m6&T2+6A;RJYV8kGewy|L`gmuV% zM;%5S#DKxM6p}2lK`2QE&|2rx+9u6J2YL4q7AFXwD+$lGe%cy>_?5@hIkK@P9zE&6)c)tD*LlS^HcR5PQh+?FTrX-BDLdj@M z{TR{14q0JwO5Eob2^bl>O^lwdE&W8V?%EBj zH|XeoRAULO`8wyLdRz1_;dU_6muwEY*p#u`W<&*h36xKgXhac;Wo8aE9)oacS4bmZ z;JB-*>oP>eoR_IhYW_5mc@C{Zn3zhPDWm4RDZ)SX*s&O-?}3d+l8}2=QHT)ohL;h9wi4%4<^t3=k_sEKh$D7fGhe z_6nddT`{5{QVleSTrL$L-`Jaj)ft}JN-blOcAy>Dxx)%&RSR0{KFt6J`&KR|YRo3> zB+FS&SbS|h7)%)`nJThS;QnNkQ0^JBoX1Fz>&tB|!EooIvqx<9Ve!~|n_3r( zyce%s_vPHvJc?p@+w!%TL4dilT1g5&eRd;h7j^3Ipw_DXnQC8Yg>>axo^-9vzA4|d z=s>>c1U;nNw^1`)>)G zaqLwtN&UUpWWV-C^Bb=^YQOEaZ+qe#L|?*dtbHkwu@?2EU;#S^YnIQOazL7t2ig{U zD`}BZtuPCuBk)sp#$0mqa`+lO2M~1lYv~f=CzB4?)_Ag1c)UbS#SCqZ-);27BZUNw zv_-!-%AjzFB|xNw<)T3~X z-qBqF;;poul6|zQChAU_h_fe;z-h@7@o$tE4SVtg!4r73!ZFb<*P#EtzK(7WZzle? zi|ga1)mXjRuZJ&KI#OL5AgYv0eqlE}QeulxnXkUxMwcBd+)AmuWyGRZWt=DU9Mf*P z?rg>gV8Dh8!nr4Y#NIU$bKJ(--Dj+!rcob|sD9{#pgaHg^8ZT4YY0$&hf%#(`WyFo{Zhcx6v#|fh>v})jlYQ~>um&+t zYSe10AiOp@lqQjGG@)^9Q!(bVL8Ax!tbfn3#OejzRU*w|E&%+%#~=W&FQyT>Ela8c z@WiIk4#|eKlDvHdS}F_G)Dr!y2?6~aU+!cTHmeQsB2Fn?vMioGDFf;fznym%oWklA zaMWOs?|C#{k`1Sl>9Hm3rP~2T{T{}-c*2L^(M}Q8CAw8Fb?csLXK@G<7T*>$z(UZ< zfX+&_pDt!-H!Vdb`jl6tbL5&f zXMEXZO3ZF5RTnOjbUjF|-?%~=IAt0y`)-=eBur2*f+Hz1c2*U1iBt)7Q&-V}uAqXx zXA4JVmUdFS_yiHOJ}y*`q=kI9Q7kXP##Bh~;yLaz%cN|h2^pJEDwmgu8o&rC^-~vK zpfpj0o2axA-3Q-D3&F*yut+VoBJM8lRps&8nr6dhV5aBa;!k@!yBR*^Dw2{|oTw}P zL^gedhTJTW`A%;4hB{LbJ8~Q*M|SjK3as5{3x&Q*T16X5{1iv$-TF@%S?Ssf4477^ zR11n8rU+Z8zrxG1Z`g@AbWWjin`b=aN-SS!KJhsXzK3i@DRUE4Pwdt?H$DtOK|{4Mbw~oD1L0Fp!dTLE^lBn_)PMj4JTNW4egn+CN1l zu=}?Md zfBv`qfcgJqKe*A7{vZDA`yc*H2v9vV(ev2+6MW4$|@h7=~U z$s8!(I|i?RYlqj{>$eQ!lt+$ubTvG^zK-v&AK5^Q%)|K&cX!hhjyY%S6NB7AM%|_4 zK9bxE-D@hRyoFht=jx74^&DqHa+B>xkzEUVcT~-Gb{EasN&Fg)PRU}QcM*FS$GdCM zzQf;`M;*hQ!$i)#zhmQgL**S!XK|K6_C_RauF-M7NX%ERi6)ATdiug3j@mm@^f_lL zl{0jGci%@k{f6kj7`tfSD9|{&6d)jbqqsq#*2I^~DzI*uAP`68hZn=;PE+7MAMcWw z`4PENWR1WsU!@zB9!TB$X3msGXuY-wS!?m|9f}JY+|rU%BZ%ZjPXod3qVSswh#IE% zgwmyQc}1E@MxOl0jhse{Dfd(w(RH>2@JHwCdj(Nj&0Jm?&|{P%&Ot+&GQ=WBMrqC> z9(a}#QRF8@w){72Cog}`QFN5XN$8^v5vU;M$1OTXTnBCL!RY$xqHLAf*~gkB5l(Z; zRmK;wz!GwmX0U87AT)x{K%x!w1)Yr%%9lD{M!8(7U9KfbGs39jW(aBpOQhTE^n=eP zo6e(U7x#$7su6~K42KW2C}2ZNG>f1WSF zXNPb%_uF<;5(i(VyM*~^SuguGS@W~hu!oJa{=k8Jo?<%_MdT@UawCF}u9e`U0)UMG zl&A_rZPWl64EK)_HIxVXG`p=Fyt*x~+aBZVT3+karmc@5V$wmIgUC5OBQ8FK`)j4NyHnBZb=!KOrJop%4L^}_gdB+&qys?qd%~+%g7OzJr z*n))LWK;{B5*;fIUh@ZpoE7zqksx5(__%kbL(YPdUs!XNsIPYG9fL3CH9O8AUkr}q z=EhK(Pq67G8fXWR9Kz{KpSH5B;F=~_gzvq{si}yPP4zU_#EzSDaQC1r^t5RM*D>{b z`1S)p6W~&x^Nvse@Y^y-TyOm)Gj5P^++|v<3)Z`@(n(mlE74Bc+3p%p!ea?) zw4{X71-5Pi(#JPGGOV;zh*Xiagthmu<$zafCgUei*w(yLoi;I*<9>Z5THH{Xw!*$k z9HK?0KwXH^xxz4~>%vEvMUu3VqoK_D2z(=67ak^cgpW3SDd5H?Cqh6i%MSNhYW1!S z7RTSziwRBwoIMoREhe|23AZhf@b4gtHRC`&Hy}uK76m?3$FxNLX8<6b`92t>Oblbg zq#HO{jSR^(o}pwE9dYtyK@Gh*#;9s{@crP}K@ZR`&llp0iQ!S)(9csD(c4Ru7SvBa z5H>Z#mlq08`Q$ah9|_G9q$Z+oXxGGXhn8hiMzhU}CWx<+X(EW<8Q06?riv73@Vb|Z zCJLWHZe7&O{0v(%=o1Unr@)U7YantpLh$(@H9r91^4JtwS$cn7|D^IMjKck}V4AX{?Ng@T1O8JgCsq8asU-KSKYH;%$?TbsPGe(V9mBOT z;gVt5!F2J}`U^SZ+eW8kJ{7^T_`mhQBE-Pv1N$`)bnJqz66N%2hbE4$)Ba!zMFWUT z)M4KO;%IYZy{DnH&6ozX4VV+Dxn-C!`&3XA@EMy@OI@Ccl;xB%s?y}AwaAq9ZAEKn zQ9`M`Y_)SWPulK2t9|EOE;c?lpUiu?yf)uv(8Ov7liy1RsQYTWb83U4^Fon?i0`bG z4T=~7r4|NZD`~ISu|!wV(;+0+!~t3it#v~TZL12H*6&$HH9LD4WN17ZevFqQ-kjq> zM>N@HNu~23`27??*qBYF+Eb{UR?~LY5&WfAie=!Y;~9*w1KEgIT)qnk;`i<{m57zC z6z{(wmJFg6EcK!hCsF#M6bCr*NE5B58$d61!dSJdYI^mJQA-ZRM4!%xb@d&B8EU_& ztG@;hcj}>;aX@=Do!X$Q6qoDAj@%;LB~_#EUU7&s~>FKU)SYiLraa56ZkX2s?CE>QJM4cf z!o@(=VmwZ|EttrpijK`#W2YHw`KiK?Z8-fXW)=9L{>1D9&xZwpq{Jg1o)`sJ;v|1u z98opWo=LVO2y_Kg*H*kF^7{5v&KT=hw*-T%mqe6)7d&LC zyXo5pQL1-K4_K6rPS5X?u~R?{$>7g!Opo;N&bQM+9->_>!qX7HU2%V*t&hGvH>HtR z!eV0#7{-%%NfleXUBsQ&?m?Y`!J2)kd1A;6ifZ+*RrRXis4(3CtLY}5Re^y;OP{ST z*S)JkvJ?Axz*6S8tjkkzhMXHnM}|x|OqkfLf@4M$K`97Mi~1s0ACd@kZ4Nd`d@*Eu z#(19MPsl*dlu1mrQVDztXuewJdr@`cs~aT0T^0r=!!A30`8F1v6Pf>@PM~L(xvBV8 z(oJ7~4WtgafRvSOse!{1R+Zq$Nf5{(O;cT3%r^Qh9rz|5V^v#Iv4I4*fm zqej8Aq9IckB$yyc9zXEx$YXQ>dnQi-unbTxX#O)eN$)J3Bu^5GGpjD32m_@Ad3%@X zy)AKa-XzH6U`Ha%c_A`1C!~*aMHJQ!G|W0uaSVH#hJQ{MP$!@qm*k}Jt>PUB50=Dh zLmx*<*%Bz6)CV@Z!6oMY?{4jXfPhI9H#tVj3ILIA!(w-82q+gV3upHFy6|gi#;>j9 zpwOE1or}{w3-<@)$BqQ&jfr`ZjKoVdqmZR>!{9p+%miA>=qEIqSqb+x$Ua0$20g-G zXTB?-@hZ6vL}g0FO}bf06<>i%Yj^yr0fEXI+(T((a;VE27SN{gopd70toHsA-O|Zi zJlf75!WP3!yJk0v0QoT+`u(B9^Ya6_#3(Wdp(H^uy~R^t2<`21toQ`Qm3-(;k8buK z^8W?I7!FPTZy@_0(E1OMF>^5dFOdDW*MQ~! zN#Jd2XE%vmyKI23jf7)~v@;R~VgYoMcHXW2QhvsNGxaS5NJ=v&yKXQ6s)(;ir`I=I zv!{vVls?D*Jah6+YzU9ur|bAh-Q-Wxe%*Z;CGBPf{O-p9xl3(KF-<&*y;>Dr(QDiF)2KgxVCPSF1IZliq>_GulYi2PjM3%S6}c-u z`VRWe-8-#{XeMF4Bl)pWyf)JM%^00blK!5!>+b#9VwYy!8({Buy0b|x zdnA*!XkV1C|NXwZ`f@WZDwdxn`uu&h?Y?feSgPleIO3_e1u9BkKb{)Zk@7QGy#@Cht4oR?)dic;Viw@~%Us_k}j z7Czjk*I3pnF$I&>uSRfoyDt2+F_i5D9n&2qrd71Oz*N5IfE1?}D; zKP%+KbE3JT{vq>n37A`Ra;u_7ogsh?7e3U6ddf`wYDS@wL$<^z+MI0{@x(F9*)9+H z!~$}qlH>RA+1Ac>WHh5PA9r#&<)N+?aowV62&Ed})f-Or>g}_fiI;owM9;3mD@g5P?|PfVYyF4(*oStq7eEcj?8^PfT-SW;R=g z`?hT^zin@fvi4M{2I1{;n!AU}Hn2K+tFO{lX=``2*oT*vm|E!APfMBkuhZ5f!$KlQL(gf&8Bu=4Q@OW^ToFP8ghyF6Qb8ib~b8Jm-?^!!{Bl_=kJ*OylK+ z7BN2+^VE5CGH7yaaqo#PC{|%X1IPvygA^T8PHvUOQVVSgd@)x805U5Vf0|JC9>RT} z?g8j;&~nx?p8mP1bi7D#j=5t?mGr}b<{Wg}nQ=%N)0jpPzdBIHfv>|2PDl>_RH#Z- z%8Jwgcf3TLetK!LCugEulQlnDka_Yb>)(tGQw*}$Ifron)9F|86CBaWPFz_5RNjP} zd2Xn9zfP}iU!V~9G1zsW%?YY+}xM$?Z^U8 zn??;QE#-G}KH2gfX!I7}A~cGi@v`j}f)mmXCJFZjrC}e0WW(wS(Oh<$3iE4En(#ci zIiI}%Ldr=S%VROCSPw6JLAn0qAXooAMz|7`fwRi9jTP={Hv#I?pQk$*3}`n zXRVEJ(aKm6(*eC!zj;XtC9J&$vSAgfN;KPtSN%3=BV?iuQYHF*kjLu6sb0MUFf;+J z9a`WZd*dmc~xu<0H@xpBK zy=^_~2))zK)?i&WBj6hB{Sqy?Yay62LF4reRG2nYqb%|gmSaV>OlL}GJUPIig+{K9 zfs5U2jfDyxY!hv)~$$vPevqMJ_Lj_b!9!( zEOE)TUg(N}+>;ZWp)((wcw(SPY>Scf?xRSuzxkE;+NCwbVn<{i1VRP`-bQ8Ws%J|U zAwrLIVPk+O!kJ!xAZ_%3<^&iieB?SI>)N3$8EO|rd?+{Qz}Z?F#MokH#U_;mlJ7Hd zTgAL`bCpKx34;X!y-v>1A6oZ(%<;2%NzR3(Lo$*xJ(ekbm*2FJ|@Q^h(%7$RXo*2i<|v0g}|)DF|qJLW^7=l zz1-yImRYLF2u_qoi+HnK{04#I)8T+D#|=P=m9D-jtW8kInYIg$&iHOPXd5Ufwu{y1 z2X34*@7s6ZcBIPfKT(ozCB!**2wQF4WoVpPvWG3}&W^d@^DRriG||YS7@;)p^p8tB zZiK(gRpq7J;Zf1mG(#>k10^Se8tu>5j;d$C4pLf`ug!{B(Rx`NQ?aO5JT+^>Q?|7j za1X~-D)%zFQ>rl9iJW_&XeX_;7R`ml?F4$=`M|Fh@Oogd9u&d4a=z*xPlorB@Gws- zh0|JtyDz7KKH(>dVioDWenqfvY1xNkB^cfsey!W<*XPO4BwDvT24-A?GT@g32yv+K zRZF=Q7r_d)FekLXfdl4lkzlv%rQ1G{@NQc1^N}P)O1EP()KJjNOk2~B>AUBw7yM>0 zTe?5yp(Jaf;Sxk=^sfA_Da7zRuQh;RzKL7Gd2_j(ot0ycZ* zoRoEW87^uN$Krm{+C!O|kf^O3`o3W8fkgvfi5ty`e!&(`M4|5k7su3`$%< zkLQB}d>MKtdLblhe8Mm<%y1Rwe2OB`L5-5w#KJ$6~ka1$is4&|cd zEf7$`-23rR-oF3!{9*4*h8-Q$cfok-2)V?hkDuYf>r>hEU33L41~x3BVxFN+rAi}y zHdCUw&6eBLDQIk}I9Ex_P^yf3l5nPV=a6q<+Qw^>(5BAoXWMNju47cKy5^FDt&-QI zt?|Ydn`V9@E1}CON8svv`~J*Q$!D55k5@5vfbyr)i2X&-=R*tr$|Dri|FhO}`XytD z228sPQeXB-k&2b#)}Z?8FUJb=KT|U))D>cmRA0FjFT@3c2%l)Ai{lEyzD803$>hlJ zy!1GT?aiN^4Uxa8O8nkGeV$?t^7A*aRLo z_-cxYq8|ktH!S{r=lJREZUNdb40rSd(k^Q{ZrEr366DR4?{M2_UQTRn- zEZhQJT5yFVu;@-(2O9&0Ya&|Xr1+V08F!~Z^_RL_msq!>x#_dsXB5YnrS+Vu(o+6J z*heTz1cc5ICjqWUCn?i+$FR(;LcgNTqbx>5Tuw9h))fmvvQ}=I9k6nrB%`i`*=MGs zfa7A=GDAHZkq>_EB1IED1*mHULka#lZLBqWG>gZNsH+Z);a8F6cAQ`2R5iPFpp0XB z5}hWD`Js9mg1ooC&u9sV_Ko z;5&NRgMxyH#s9${YyAh?nF%|3C=g~)TEa;+3oO<$o0Z$Mi1aLyN0WI(5r4_u_3c`q zob9d*(s_Dt@x!6J6Zqwhf5xljpoi(<8zi|xn?I=jslYj-Bu!bSGwvl5VZFl8zA*;13C z*RpIK^(UD1`9mqVccLJgC6g2EeRg$weC1lITMR4@Q(B4$7t&qVyIfc(gwq9N`IGc& zD`e2;b~byP2B*T)LMuU9L!&)<=)~3@$?yaIYbE8uQ_-M&E)p*bFJv{}8aRR}t&^HE z&klIz@)rVvAc(PBBNrR1kPV;urF4fN*1bUSIc>Mm&L$@r{dH>id0AW z`^|DYk}G$L`hvV&(ln9tHQ$b+Z30QLJVmiRM+HNQbZjis)WI2T#aSU)Wf)D^Hbt1E|pXW zBIF4@$bw9t=A#%|uq_lK+JVp2dE%_ZLCm)w;+B!b@i1FGpCFem{JBfm=zYZjMVlvE;8N zWr6g0fiPmq!VPW%bH!q(6%mh!jZD#WW>1Fn831od#ED_0FP{G0G+xAXGPQ1A#z4~g@SJw+qH z_ZJ9HUQ@+#J4p{#Zi^m7u{k3l63UHNYImf#(TI5g`=V~KeRfvdVBx!JBDvw@so=11 zI^T-?ZgcvJcdqN1?7?=>96ruuCYB)q#P9koc?~e6T`3t|jDxbt$EXkPO&2S*eY~uE^s=m+b zx1)hRQDjL3P1LEo zSEBnZy}f^k=ssr-W4S7T+-@D+(tFqKyF>GMz21Mp4s?u}vZZZ4LC7rV@#NJZ@h7D! zpDx+`oduEVn6rKULW4c|H ziF%!1_e!RkC*iV{Oxw#b*bn{qDjDVWbiVyBUutXu4|3@8jII`&thwH4OnJEcH)&$# zT1=U$a@^`x53D%NsS#9?Bxxk_)9m)9CB!sTY3k==8H_oBs2J4Y%T`@(N%qoJ;<0k* zT#3n4e#&NY*QZ%;_Nc8!8Z$jkl~e|3*G(HHGRd@IPj+uz>KXO@}wyL$Yb?xh7r74Lr7nz#3O6DCWF}?=1 zs-5^%Ab8Z-eN^lC$(KkAWvrw;TLz|^FhaN8-np?sTF--zc)eq@qJ@r}r zN$Vzf%A6gnkOK}eP=RPEm*z+(a#J% z#wA>Cb_+oT9#aA5?A?``rA2|74}uB?`tH8GeqSUU4#c-ix?sx)LcpZnWTcr~nWV}jvY2^3MSf5I0piu@Sh*>{b5sj^J~xC5+h zrUt7xKEQ-+-eb4t{=N-?1Du7-`4aF4{sPJxaAqpP>eZe$KE{vx>etpM!Et^o0Dq}1UQ{c+Lq;&0b!ShkWhCu$a|8G8Sa#Dn1y169G^dF zPG$f|!5kLYtedw5Xj>S3oFCa{p7!1f@j)tBA~Ow{XBdU&4}ueca~#2>DemNf#?3=j z@e)t%%yAB57SJeS(ENlv*&xpogPSIMP&&1O%RzdiC@|sC(f{tN4`b9^?~NAT1uhBT zL(L*xchCS*D;O+V4VR1*RHcXocuLZk75WK@;nt|wyb1InxB{}ZpY}@%6PgH^&z=Ky znFRGg8;rCn$3%lWf1XH|$rm6W);a|}Z-GxTA8-cB<`JtYZ=hsG6J9encp7=E0Z2!V zmcT!}?6~oq$%}FX!!|e0DWfWg;6m{n7y~$41F%QesX~qz{imKer!;$GgJcJrrxZpA z*%Fb81=ArCIBl~ypfVnn1fV!-{DlD^gXhzAoTV8F@xug=DEtB8%+=Tf2%v|~t`7n* zyZHbyt|Z2LfS@2tDJ3$^6$&_{c>!9Ynn)t(N3yO&Z$LAAwp_F7b{x_n)2Dxq>GXl~ zpV0|Y%x0dxRxvQkq!H@y#cE3i=Lc?MS)r3JMvIzCS9Nf7l^Db1Ixa%{dtKng1nJKN zp1;BnEfX_Jlf>mlWu$L6CzmtAbcVuV?8_NWG-Rm$N?Zhg06|_E4y&ez#va#oy-6}p zvdUE8kav8#Y{3{F8llev3;j@jG`l_#>SVYSOT1lZom-BU^$7rH8b)QdRy^os2g{Hj z=fdBt=Wwt*CLB+aG8cPR3zp+J3fmyj^%4f;+KC1+vAc0_CMcIYn zPX2D%Oh2pUpwH|4WAZ8i@+9zT`O*vxWT$+e&Imhzy*POQh4~PBUD+{}Ihcf3gxIS4 z#=thac|}jMx(vJOl(>YUyHESBQMT~{EPs;&z@ZN$00~q5>D5!hojf+Z^BU`t0kuhT z9X{)(c>~O0>R97sH-1^;>gDO1e*bvms&BhJdNDmAGY0deD+G2L5Zj@5)(F)skWgA8 z7h_r3C>Qy`3y!gQ%m6RQE05DEQj?GkmwVmn#_fI4NnFCi;t){r)@^oN{?D++OMcd8 z@vtM3wbf{iZ#dLOsr>!;1}z%+MaYrgLwFM=RW{u*j>DeXax$J;)~;A@vdlQuk%plH zTwv(#dSCEqj5InjSlG>rLEf8VOIaf{=2#Z2$=amwzHRLy%QOU`baCzoMfldJ`#L{x zag+k83x%$q~cad$i?1zAh&bO~g);=*JJ;U#)aJF8piXOnNpSs*03HFZN} zjFSu+`2zvcjL53f1(wb?6C&z>YU-V zf?L%a8JjQ~Iu}Uy3ZR-lZ{&6sJ{?kP%-0Zz=fijF?%mWR341bmGi}EDd;zRBxPQl? zn4_p}BSo9;eI376O;O*JQ6Tvrqz|uO{CK$IJzaOcf8B_Z`BNzQ6Zejn08^*Xw@ z*I|c$Lc($sVzn;KZpN%jC%mpE8-De043}^eKGBza*`?Yh_Gl_;EL{wt6G2Y3lUC>z zw|&yS_VQLzR@Xl+yuJ%_oFQ^Bd*-NcwJ`Ka6vd@$w0M!x3SpYV{x_P9!x=sK8n_Zs z5$r|bJUO_wLU zJ4QO!c79lr0o(f4z1l815i)A-v60?A`*7z4A5935Q0;1;mt-81k#!xMM_5?p_6#Dd z0?E^UmG#pWdz`xZpU`iu#9CKCcsCF=G!9QnC+Xq!bV@C}nPynYh}q>J@R&nH-~SOP zsN#mjV3=NpquISVi;Igi$6zVB)-4zn0vjkfIpfb@kNICvIY>;e!Mseil+o?g}|5K*TPyXTxNp{ zWNy}hQM%$R`ESIr!pcMqeCNPbU6)|j6xj+Hv_sNg4$I|$?;#vKHh@^(YwQ7=!!5pq zOf7WasL>{O^*HP+8FBUmC=O{q8%^i*+a6Ql)Ata=%A>u8IS#rT0!@+yrh7)U-nz&+ zd8}%LWJo8&YF+D=x>i(`*xV9VTcG*6OTsAo^cTwHg9W^lf3L&TPQ2&zPJe;i8P5u@ zlKw&OjTMhbYtR|!7&W0zpuDKcp<%xr<1v*kZU2O^M~$K(M_pS`GW?zI0dqRQ9~a0C zfT0n$QDjuQIXj^iKg&RCB0Y*|_EU<}ykyXc&KL}(Cvz-6n?`tM&|>LN@H0{cx&@EF zU_qhApJmjIS&*3psS|TZi{?{i_Ax$bNR4sO-*r#4l5ROpl8E6xeJag=0maED4mp2utTre2( zAZ;IJm~xUx(zH{jocv?6PDRIbDDU_7Ddk!C-rBdL{fGL00a#N$S^pbO|G#mDnT_Rt zjWaC&ZJc5GzZqx#{kLvs4AJ*Y{eX6Z%87?vXN-=2!YN5fDh)N<4UZxfsvFwLFc<*V zp!3LCFIE15zs&ms?fMRql&0`~{HMEpj(!5E^HEgtwfpA=IPcSu&-%=ys%^4W zw{02O{Xr!7EkYdJBy#kat8uqfXfZRLSz`75b-#-V)0jji^%=3W1)+;`yE6FfpVzj` zy~B9h*1B!`3-#;W%j}YBe!2ab9;wAIQ68VpT{u0#<$6KNN%fFQ1v8=``j0NQqe&f zlf_prP&Go!@mZ`#kec<(HDJmtp$*3HNvEWXf>`%nCiZxr_BPBBQ8frS3OH)k4LBKE+*BGx@ zWP-3+`#ZG}1oTr2xhZ<%T1Ox~K2qrA{+XH76od z&yXgPf~=~B`pvcG_1?Xb851qnY%JbC$>G8%Q=RPfN)QObXtOEs;EeJ7Zs&?Jf8+-* z)Fn(mPlp<7LKZ$goVOZVRuui0Y9ko55bB1c*{}{QvJDd3!?9+i)*9yrKvk+X%pr7f zk*ErFxZnL*#t|{ear`cnmOpNq9W(Y+0XmE04r3JX-NvxN8;fR84`*zW@aB?jby%W{G&U09zIQ!=B!4G5(WT{%MegSbSfS@Nc@QdF5Tr|{ zWcoXwyPer`XxryL5Ye!b(5V4o3Zi&?|9U;oZ44or6%4dyhCu08G$>f2X#s?8j<|(& z4%x6kOuMczcu>(xkBfx+kuDgFEgRP7ujn1zS2HVZA}!%K#=# zdZh}3X&5!6KHK*#1R3_bqG28c3Ztj*IM1UcnRI|4#SsW`g+4LN0cf7oh0x`A#I+tM zwA21@Uw6Ya7jiZ}>m-wO8g$uCiq!dKoB`?~%1?Fo|!m%Fe4Ub^AxEqGuaHg8x3 zs!r?evtw%L$;S!wJK!ux5il!F;v02ArL?7mKoLvPMt@iKdUpcR7$U&^WmJQmkm7cq zg_(K363sIwXoQJxGnga-c`PCEkkF#O-VkyoA9Oi5fV4^11WTa^BcloB=yR-F! zUra*GMl$^Quuo{z;Y|E8Rv>~9+=%&tMAsFYZ+Xlh|y`8KuuwG8mAmnBZ`X?a+}zl1`e zPF{~5Xt(YNaRvox;7_Q{7fUb8n0l%pw8LMe$hbF4YMDw8dup5l#D-4JJ2|xCaPLkh z7mz6Y@j;mg-JU&s81}9i3pak$4A@pfRMRz~y5$jl#vy`1BPh%-dG^QvX#LIGk~h&z zm%~mvim70CTV@~>xkU7+z;qJ;BJNY2ow7!ZW^L1AmF|Ek!-mbpAdF);^?>vUNkR_J zL@cL^!Fyg+r*`@=PWpZVp__G(y4icQHIZV>ZLCdL->L>f2=Rz1k0dY8##|>02J7CfZvNSL|%L9heITZQ3^;_UZb2T-H3bUR9-J#2If1{$*QO*^?i#XR27^)OLZtL zuDUT=3UeGtwil$S*bgzSFZ^opoHNjdu@-%uwKw3>*louG?RIe=`h&!zWk8+XT0QDk9J^l?og&;LF$x;h?SaWn3`$cJ<&a|?fnn9)Y?j_aXV`7n$haL#;ACYWiNi@#wq;rYmks$i^a}g_+qWQ1lj}iTnJ&fBtQ~CTYHTF5N--&?( zE+|mzQ)t1#&99T1{VR|Ei9>_3Bn_J_0%eCD#eo$eWR|5DOm$5TArI_S19tE|F6MCx z_aXlTArtM?0@_BdsN*w_NW4{M

P5R>05S03_JY9zB7>P6~==&cv47Zh*^w!})ol z3s>gTm^+80W=zhrU}6_VR0s=axD;Lb8Hh9b+40Q|ZetGTAW7JdRm3jB8;931{sEFe4|^+GBEg0}<(Phri5 zjQuZW6rsiL`is!2MRYB=YN#@91mX`!?Nj3@_@pnI4*OcO7O4E%c<>~mBc@Xx#Nac- z&m+CW6$22NLYHKN(@wJsYcyK<58YuYrh|S%sHdAEQ~x_O(oL4Ei@c@BIqU&L zGp?L=rP1Lv=)?F=G+in>izXhlHd^wxIXSg07_zL#L;M?VihR4Qrb3sSD7BV0*NK36 z|KZWHy#tC-r?0T7$k^|E5C3r&(g~a-exJy#W#}{+TEt00Spwu zJ?WS)^PeI&=?l2i0MoC9bL_Ou&Pw6r89Iz$HJ~ML;83NKvJW)1Fn{W=kI=ND@F&(v zQ3^+!OET}2>yrRUmm+pG4fDX-FtA7?m#9Q!cw0Ji25qmST?M_t%rfs*|5f%pHuAbv zLD|!HWY6#qD?xhXlaB zRHj#ZpW?_n?>JMYz9plkkd9W+a7=`K^Bs|>G?Jbuh1jjrO5wA*6hMhnh~RYub;qv< z%?+8yP6P?wXKJ$MEzLZAT($voPOnMo1@Qnmr41H~k@ICINjRgBP8+~VpS2iQf1 z_9&46;ijrc#AU6X4jIx-KIsem8e-E(;UBlb?nhY9W?H2PO2x&Q1xx-b@a}SH11& z(a-)s`u%_poDT2&r=tIF78o-pEBk-1{yy%{BqjtA z@Xz0NCUZ!P<&LZ&QR^MUg&!_*j=mjZ9$yqqI#<%$&O7+GrsEGFeleq3dacBrnQ%o6 zN!PRe{jxdSP0naSGLpA%*T5Muem(w)Y|2MEm}e;5qnn+5s1tQ?6os$URo}+h0MD4{ zm`DbxVJ%yDa^rl@Oat_4q8u(wZa?}P(6D^!viMR(s{3;=YOVg;!z*c;Uh7FpBBdJF z@5|(Y z;J;W3AZ@!i0^qNK^=!U3(+ed@t=Dj-?_?QzYBF0cZuzMwLCODFlU)`wqGouJZM+&V zIz@HXPk1e)_=tU|NTk{{k*=!9*=D95U9z5UevJ^2BV{_`!Z57qisC~xj&Hh^(Udx5 zpOc0>0O&O!5+|9%)4+1laf}@c~ zloI8;r^RXaIotPlXetKTl9eZCgtAjsj=nkO_yFl)cCHmr?zp4u7-0IRMO`s;*-zSq zsL7{<>-)2T0d%O?t(DqRa+)yc z=NK>K1sQZyOY9+Rcd77N);DanSy2htL{J{QLF|gQOtX0v?NbIQCHw-}=@PTwA5PZJ zBqdQ9*hVr?$J7R#ObVj*)x z(9RI?isl?+2SKCV0}BFipA@c#2P;lC$%aR#8msi)W<`iewPKb(Ne~EF;rj z$|fQJ58;qRL?TjplLwL?#Ss)i8f_3;a0IP2lb&UfX~UB43cSvNBJHz8bzx(k!X~gY zCa`W^yc5Ylr|z`}2N>|{E`!O1*dq&@J&o=IDOSP~Ph+Z$UN-41l!Ex6zecXz=)YEU zFzat!v@Ert>g(AjBKsSs5Hgtw%aFelq)_?wLtNiN{d++HRAqHs7{sOSw9r`vfVN3$ zi!2hLG%Vp2*h6}wACd2bpEsrBP1@6UIGLXcGN7%XM`d*3#bJy29Z|ckFct z4?v@mW<=)A9LXK0p+uebY^{)RV)im25&+|Ljn(!2ewn@e<)bzvkQ>sJ**f|7cGI1s zWI4e#SBioDqw-YPZ7Cy)nW!a>T7(%>5f&UUlX!8q|I02MK&*V#^autdTtr}?(DdH6 z6IkyALtlD;Aakg3(Pk+0B+%Y-CxR~6>|fE~r(yg&Z`>PN8(=o#JRN+z6eU0}o`RX) zh7X15xqW4)fwtU8LOq*1g|-4RT>gTxl=pxFMHD1sOOBFkf8J-CRVX5u=62WFaJ)d0 zEK4beb6n`d_VdW9tZ2`SNeom{9NSghwjzlSD1$hCqWI;9KV~*xpOG%xg zn@SV5d>NY%Q@IL!WaNXLw9Y)}v@sNg*rbj|oWe;acdnlEpI~V#5(s4XZ+Y8;f+71# z6;m6t&P!tDu}nb?0m5HB1QBAx8rcxcX995 zSA+ohrhbVP@?W?KuhQrH!%VpF(gy`Nm$GU&)fp98k=_SnI{YOw$m2a6Wrlm292SXq z4F`cKy2Aa~I$Avo;N}tz!|u1t{swkQL-RWT{D<{uT9d(Gy#zK}?X;i{%sk5udlxfw z7Wp!T&m0U`%pa`cyb!ekx&>>jhcz_-Xn}gobvFq9cgVK|0tWa2GVmpks8Pw#N%u$$ z5NY#OIQ^9yxRg8^Y)pGpT3X0a%H-4QCJl!Z`NKmRai5|M@Gb8s)=(e{*ojjdH~~DR z2M7WI2PT(g4Y+nM0F2(qMCG<%hOsdWko=j_Gk{@tR{u*)-WT(93^X(~=%{P0ML~Tx z1WDrv=VxjQ*KgO=B!1s7WP5b91~W7$`T2qRr8&}-WBTtbb1j=mR*EY6Nv*1=X7PH@ z+>HD$#U4(dm)8vRba9Kswj6VAYs~C`4ww5c$E8STv&S6!a4T?c73-F9^fxV;D#DSh zY%Z)7JdQuYMfl1Xr>P77KBk|#W0ObvO9j!a(2I2D?RHOA0TADpi(Wc6e=>k$arz(( zMl-|*c&{K<-sKbf9pNf*E-bOoePeJrwODR*p&g{ z!``CnnXMJu*-zi5RbaP&z-reZ)s(WPhE{ddS80Fzy?e74x-r{ev_YbD2Tx-^V-n+y z5DmI^QcsVae}+B8-wzk-bZ)SJ5|~D~s@I8A7^CpTjpD=O5=KTz?%}89jy}75z!&uC z95Ji2!3Oiqhf)pc$!MJeO?aOR6^1uJ2b7=DE=#EkLW2J^+N5$Tx$Y+s*TA7<&20rF zC>er-wN1J!O-e<=SFL34?ew+ z!sXNvikk(Qr37}p7>*HyA_Jp5kd47zi3nx$jLfeKihb^{GdL*D&GE?(gNKy4ibZ(1$+*1GPC)t$wz)Q|%bv-4?h5Fa&|S--?B#wfFWnjbzoO0i&Q5Ua4# zltI|#y{p0J!$HV__U&#>3McZc(&=`-_v#vTF} z^eu+W;p|m8;6~=NZA65~uUm-1nN15EG%I#ymhRVToxWU>Tv{|@hoLGq4SVFX$bQ$c zt^h_*$cwHs1E0atHShKnKSocNP_8-FbIv61gVZ~5iJmrS9S6(onWvukp)}d#&9sX+ z0or~@&X$X`kz((7ME%V`7A%Bgwphe1s5D!rc5)S)cq@H!*h)murKi0^%3P};-k~cu zfX4NDV%!oIO}20UMpI9et4BJea#NrTUG8Zf^_ZTwTe6W-9^d~tje*!U%+4IDXT}I# zn|cES_{R2^tM$x6=Vm;Kym(_{H-c9?JBN;G51;gD$prb^DE8y(m|V^jzKBh7oy9Vc zDL;Bx8g$Z{-eV31uu+s_N}Ge2=N!c)PwT1EA8{`4MOD4Ea{VDYQkm!JBIucaUxikQ zeIn0Yh1b4P_53uu(&wM|QibM6ogYLBoZ7+!zc}hC1EWRVdAmM1 z0)Kl)mvN$B_z$i2UmEPcY}zag|6i;9CpU}rf5*+z+O|DvLG5`}I-^R7VkJ&26t_u; zA~W}=WsAtdYHx@N;UV6fm@)sId?snXx_(l4jOGsdITYVpC*=!Z)6{q7Ccuq9e)@!s z@*9H|Xax9O^+r8wBy8t>+y8kk%lI~HnBnW?>g+44MKjCurM{1<>STUInkJbv)-YAO zZ1R5e_I>7s2spJI@Tie=Kd|&jeMSE^<>sNezm)5(sR5x2ufEve5&k7Hku_F*YxpKr zWj$VDduOUfh6|;eL49Al>6z)Vek(N%+>*bj1QA&7zKLovea=uEK zH}adtnJ~~T_LSLdDpGM3s48+E_b&pUnaCb-t;FMHHqO^T6G`HGzGd5V6PCYU?%#$8 zeQKb6@AakkZVt1;QRm4QzM3DaAqKc8$`WsbcFUyozd2gGMi*upybT>NPYczms|JlO z{yGVrCduRL`pHb+4A!`~D!5!syp5?dd8t^GQFlR0weO`loNIc?N{Avs z>ectGA78H-lbsva^<@tk$Too-_SP!4qA!=17pG1@^4@9zfO1L&nhp2r4f?-39F+Yf z^4*}6#6j$Wx5*6sH9Py(kyi9zumwnHSwDl{i)hJh8!VGoEgG!94yoIw>qV$1=hk&o znU+nr{Eh0%Ygv&4>*xS&tHiIYTf?MIj<=8P)w7${tTH|a4~Y84la~e)W|r3JT2|Rv z5X2M^6^14^mGhcg{0-W4datdkjsk3p-^H}SFqVRo5Ht4;zL6&*zsldf^sg`WVD%v2G|0SSuC_}_77hMgoMQuP}9Kn4vOyfvR{ z`q5w_uTjg3NKZS)c2XR>uHs+N-AY1Sja1|Gz3(qn_i~U1s)}wvf24c@r*&T1wqdZ< zZD|@sRK(4?CL0(;QK~5d84kHIB<$##Oxw2twc?Idl9LB;Z#vo2$l6GI+QXTl(pN0b zRgg^}CEQhFl7?oLgINqnA?uZgFE|v$CEXRu#)Y61M#lq<^>POfL=~!VvOlMfoh*pw z@&M2%3z4r*V&#((y~sUT-Nu+iH_TXcutq=sn#b9&y5-ER7 z`#wl~Fd6iGmDF80istN-qo2leXE=stJbg`w;bE45&he3e)p@6JVUnZ`F1?dguF3OQ zl0Q7OOTq>36C#V6+9mb6;zdRumUTI0-Ht zN;NPBh3O2Frh0+8UowJ)Olz?3{xcwv57PSbX0Kcdd4j_u?!s7OEVrEC4;r)Cw%*-6 zI(&pc1028X5`+PgfX|=%rVHVTHxh`DEfvhZ>%hR*KCB(^y63aTp21|GUO55AURLRI zR?@nk81{eW2DD~k$)U^x0HZ>x2S|3c3^Zxbr~@o$j+<`5+-Rc{#O$6gnNZ$0ErGUN z;jgjVyoLk#sgDqpgXT}Vf(qDw5EAxNKdWE~pY`!?5 ztDtCJiZ}xS&9CjEtbLpzSk`F@)zMh$h-NDULH8vFkNOQ|W1%X$pl<+`MCdcX58!@> zY+D3Q*oAZZA=*2iJO+7C?%#y6?YbsO4h4~qBuNpGg|o=>8e)Z?BA|aP*5*QFt;n}; zYxY5jbzrbeATf)@=0J=Sw0%tnde%qyD`r}K_g8Yy&3}r3lsXUgRR%s4IGn09hLVj zT)|>`En0!lmP4U3H$*uaXpZ8XlCM8p{uogo@Jg28|3qd$-itD3PT1*Xa5BX-H?$fFbK^X4^zd zF$kpCJPJA>0tM7KKN`A3r7R~uP*J95WpF?d^sqv3acl5)i$}2Xq$N&12Ap*Zo9^k+ zG$(SOQ_93Go=_R!%c#cr!CxEI!Jz3T#_O11DTVfGOO^N)^&b6e>YFzrn+{XwgEgm*;&v_ z$Ds>G-Pe2+GNl=L_D905!wR(%Z$ed3XD zG)JRX@w^D^Be9=hRhRdj=i zlya!rq;O)kp7+us2w}>lC3AB+T+Og|qkup%+2;;3S|7g&*UP^T4v@JCoaLGC@=xbL zYBu;pr)U>Go~pyIPU(&n?;uU&0Csw*n!kys2Uznj>i!Oh%U-dXR?-^Lg1dnqvd< zfq2tPQyAMbzW!^r)UMtc;c}hottxl0l-r&RR8-pp`=#3nI8~K4eYM=_G@>3X&=QUI z9e>zfdH*EP@P@1UiL|s3Pe@@RzHUJuQRUs2`vVl{z^YQNP!+hH$%Y`c$>&mLYADFu z-KXfrkSG>IX@u*@tDOJ8EZ>$i0YLLgs=_S^)V`bE2NNWk0=wUec1`qfqK_$(4sSXk z#C9i%?TX}wP-o{SO$>R3v{Ix*ttDpcT;q8G=~5@o4QvK&h-r7~H@nz#HG7>2a#w2j zigfnGZazQN>)e_E_GehEt}b4GIK0E^d?bB>_Z5{$my_9&TZBe;`099qbGW8;sDj6S-yHI>OpMqFaqH>5#x|2Ifv>fa;@O>vAaq; z70vKJ^U`W}Ke)`?Ex{Vvj>-5=^h2alot!!(N%J32uK_yHTbT2IyOOxIT-sd|-J1?# zoAUQt7dR(Bt$ob%i1wF@LCMR~c(B5-b59u3PO@ChF7hciQ$+N>iB_EKXg>ClNmyx% zB9oRmPmH!kg38>WViL?(NFwc0tAf_?e$c>HbNk&%7g~wAx8v5m2$+Y=_T7_1WR&9EQ$zy7>ka#8D(%T031oX zdnw8+!HEM`k3NCo>%LR$#zn@E09Y(N8O0d)6S^)Pfe_|38hfVUcSh{#}6c5D`t!drnR0blC_kLWGhwSYmOqr9Y(kG@0=py&u50_k15B5ZC{b{QQ<{EYX z^HL=b$((pbv-M2JnJ#yoTKkx+Pf&eGLxd67BftO!NB0WUOL0|`oLj}MkHRClPyZMp zLDg@MKz@w0HH+pib&lJ`2zu^+OIz*dFNCkyq2y=}xqI^YeoFDx1O8YH7`}>TqQ3gl z^i_dx=!OCv6dUPO#%_R26#U zUVD#c({WHQ*_ccvN1N1rB=jUn1 zZTEJy>K=m8rvhX{pBNNPY2!nFMyFab{DqSNZU#vjRLAAWa0PMS@#WQZn;yW;Me?2C zY)+tItB)tHB8k$#>U#kOnIYtQzS>hC*5eXxx#^+TnwR(Nv9CWfOx&1p&u;h1K#{YW&lUnL#nxq=wIeDgLP_pKl(DB)( zVv6VCV7pB*c%+l3XL7?TA%g2<-fvZKvAIpuZ>POUKBW{buZnmD zxSc>*chnQ$-6Ss)0OYr2QT3iu{4C8CqQDa1b6Dkho+N0nAsi^sljx0TIZ0LNpp0(a* zmHIf;niDisn`A%C&1O^&r<`vC{4CC}0SpyAMxP)YqBkM#7pwciP2Rz8Chn^hn(*`; zcbqbWTzh~9AjwqoL%Cu{j4@s%p$5d{e5|@>Q>OP;@4no zC=E+aA{II8HT{F~Z`21Cfj~S4iF78H?YMFcGZ3KT{^R))%+F9_N<+wRq<7U#46>8+ z<2*b|Z~blcBi6^s)mf-$W<^Y|d-}Y8{W-xWqDi}6o6^I1 zLknkQ3;AXXwk`Y9TUF~YN09U(4>c5bXcfJ!#MGi& z-8%oob&vJgdw>sWdU%|j_e$y&-xQT1wP#k&*c8t@`#04=^2xBA>)T|GUQ`vwsc&wr zZKvm3_`gp%?5^_PPf(FH!P9x+ZX^q&=i`g-_1$Y0A;ab1PQ)ykzXtHF&mXDVDT5y^ z7aE-=CX4kt?LYNY2Zab3v6Tg8$F74D+qD&prfoIq?RXciR;E7}w5LVwLSzmJzeVPU z_si-OzT=qOf-73%bB^Ux&>jtJLe3rDu)X`dmT67&P=4m+)1E5wu6Y~9qeebM>LS(>)T)Pg;GgeVcRYH6@a5#mk?? zBI|Myn;tttBueU#S;8QIF*Xn|VU2;^#j3?7W~OrvPn6_9n3H#j`*{G}f_G5x$-p0{ zJPO%$>dMv(L!j=b|JNl{Ofc6}0B}=v8Eka7u?i}e@n#1|5FK$OZB=*~Qx7w#UI&p} zsNDxzKq=ElOKxQoyJ@KOBFs|@DShqLjtAykVfUufB}8xkuEl86RbLHX+iWl_MlfMm=*4~Rfs-^!1*Nq4vLsPuJ}KMmc74@; zGi>tYA~9QN&;@Gq8N&>5%NbFpI<*1dNU~KhcvXq}z@xg0Fw9jrYww_sE|O$znA7I4 zQOlr1ND5V@^Q35dnMYrdfLxB88#X9cjO>T~RX;iWpf5X~*F3-kAq6kr^(#;Sg5~Jj z=5L|?Tt%esNF2&|Lk<{Xd-(jWR9IfBbGgy6`KLkpPRZ!Y>ZYT>>=n5l8tpsDip~T&uTQcryUHwlU-y5EP2ih%`?sU>*9U1LwysU2fbA zF%N<%yR66NnIVDT8#)0%Klc8U^$_~jA?8rk_mE61HrZ_5B7NrdqA0{3Nh&BFIY2u5 zG*?Ks7p7m$T{~dXNs8DkG?!3jp1A5)eG6jaVH%jhExy z(VYJFayz?)DLh(;&Rl9>k3~z~zXTe9kCtraj#IRZ={sl$K}h`{JfXHbgqbJcejxuJ zdtZ$H06hSxZy1Ow^&>_4BzB}@r2b+vQCm})EueM{0+1J;Luf_+VSF$)qOShC7jg3qB2CQhMClqn?t%h}aD=XzpX|Q|gXi{TbwflR; zx)t7l)ykmgP@q=GyQ=C^bff7AMf0prEM(aRVe!J3w1x3Wj(&d-HsaHl0~@NE z@?biLes3Eo(M-mF*}(z8F^|1NN4Ka+@6a#cA;t%s7XbVzgYrZK?2~3-Q`gU3pak_G zuP%$<^0Y%?{!-9lI(6R+Xyf=d17Y@Zu6EFKRX6!B@}~M|Gv^3Nk8+ zr9_+qYo-(e?Ptm2@xd{`3r-r+?iDaa@Twm@mYI^E`4dQ@Ac7m!a_M}lT3K6KOf|xX zQ!C(8ze8F`?yOAywO2H!Op7G{z4&o_+ApCc|L|0@35zmEjNoAnXtO6)w{QYQ4W|M9QP9)cV0{BlKo^1Rw*w}tP9Y>ELN@=KAe=nqIq07bxA zrR#^w6&fmN^gJ^WU;OkRo21gH;`P67SDk(hZf3hZ2I%=mow$l*HkGY6UYcVHC9kIr zB*`tFi9~?3ydi=DF^^26py=QwAM@}<`^tsfn;z9-GVJo9Sx3uC;p6@G83#>DeqieP z4M|I=OksUULPOcDRVwAXsle9*$Dq7WV(@_sn8f6z#p}W_`Q?<6z#MIGkKS}&T4DbB zXo#4q?6g-J^iu-CIf$rQ$*}{V*h6yMzuOg7VJ^@YrM=ayX)$fqd{=J03#7#6ycO2X zFJD-X-hUdl9;0=d_QEe~^NVO%1Mzc%(~;p!vnMnWlhDgk82x{npU}rJ+e*L6%irKY&U43`T?CC zrh0~xx6zapZP||0`dY52K++npPN2$0EM}~)G_PFOSnn<6M>P}~UkP%oykc)>DGDvL zJhMPLs0A*rZS9yZl}PT>Sac+nqWo(0Xp)E{J$5_VN|U9wN%8)=2hs&t%*{*>mWvKEg+;acz>p)naZm*`*ogX|^Zrh=!m1U4Y zc#5ha5zjF}g$Zv*Rfww*6DIo{I}R$sqb?bt^@8T+w*p|ad&Q4k7zz2OC12n8UmQRx zr|dFrr}=&vGdxzbYp#KnhttI0g!&flptMa&Y7$O%&~P|^PNZOEJh#Ywd$_OT}-Aceu;3X$ea8e_OzfKjPPn8(H>Lrn- zMsIbQCkA;S6&dak7Y0?hw`5;Ew51>7hI(aQpJ5*=?uD2aG-isxE465iFDA;fC#0o) zvU$9wT%TQm|KLy|i_qI(Q;VImjkBA4LY~f7DY@DyL6V3r@AEnVM`IME)}_5j0csMk zH1{HL(g-|r&ZYt-+hzqv0dd%3l3KiVS^uF6^j%Sce#1fP)AQo6p5Rl` z-JA)i1KN8Xm4mdg7JsuHTXa2%t71CmMhLr7?tgqVH_BidcUij0tq;-k@g0@R03vYG z67M5>p+?_9s&F$*pKZF#-xUIepZ!O?=IiZaK;=`<L-D?s;R4BUN`#7CmHpcOBGA zOs-%ZvHK@qwUi;3jxWi&LlXl#FJvXDtFT=7!mB(hv}gLP(rQ<{yOv9e@%U|Dc5%%_ zUX<+DnIHlbDJ!5G(lro-Qi7z#w=~GO>3kgv#b{-ume4D0z_#Uj{d3Z?4gYc(>)PF0 z)k5b03@|1?=_Qn;X0!4_v;XwkH3@BFmr{(XS>~_!ZSYJQ!I=>g7BAPJ#2f4xgr0G_ zClU)+V*TSt3Vk`NR(3>OPnZJ9XKw>m3@-!aBF_ry0e=r)Axqwe+X6b+;eFU<+{QejD`}i zjNoA!Gbwb;(Agw#A(<`wdIDSz%h&;nO_C}ko96o)3+f#xYc#%_CjOD#Y`lN$Rq*FV}U%GAA8v-ld=4!HzFCx&K zo}1sd%OHO|MKQ?$|JCl}wu%T|t#4c5$8WGvtG5`Rh7PU6GF7kVvq>br>Z{s`SaNZ6 zady)34V5__deyByvU=G7hic+rRha#?{sq()9{ zV5h(i?UoEL7E`62_oLauhm}0u2$A7SxX#M)CIbHi0$q18QS!&2-}Eqr z3p?@&daIzS%Cu03K2%K5;z8CjKNuJTq9Wp`>#KEdU2f{Sj~b3WH(uC)7Pwn#L(fj5 zW>V{0&V0NQ+uO|Dr_J3>Dd{$0)h5*?l;VnxaOFwCR8!>F0*yM-AH>6cNHm+K*k)1i zfAR=Ea$UHAhImf%?URwtMSvXKJ_BajlLpT72BaNDR9LbSb zyG-k!FBbl6uu7O7Nrs{^61eJ)e${=pc>T|d>ewFW$u7FM>?Yp=D>AL5mj^wZC=l|h zcHw|XGKG;r3Wd8XL?-z|w3O&=q(cr$L9`}PY#M3TO}1V!rOPXJJH0HigpD|08h=?# zoiHUUve#P!9J&pKG*>(4u7v$d(;1g;jEPvdqGZRi#*DGoa#U=D;YK}?oZ=H{?zxY* zTRoaKQ?{)X(fM8LMl+Jg2vZQBGn_V3-&2h}z&i)?jG+yL0i*#EabD{Y4Yy1#D+v%} z?`}u*Gy6!5%<4uI^pIkg1yk5vbdGc)^4UIi2^b!4Z_yB#S;w1N`b^j;lZFTugJ}BI zAhSaLc$x=hHCRB=M17Ceu$4`$h??M7Xo$8ZK7a1QW28n_#oU9niP&wosdCHZ{wjy8xEr*n%LqKeC{_ zX+eLleUfPn-4e{fhk+VLD>6bu9koseD}cf#sdq&ykfICYh2JBT`iAhc<_$4Lf9fdO zT+tK^6bPWS5%o$EE-Fcwy|W-%$dzw=Vil+d10nSVMtax91#Y=Hum;1(UQ`v#{^R}< zyAENWr}k`3KL&;(XB2zRm|0Wp?4^r_4Q)e4*Dv$-_VTNidt1?BL?5`z;tQY;y<I+CmOW{X@C2w^+Bu7D~Mv_NdA1?-PA*(7XzmR|0O&N8ea@}*`4 zJgq!xRZN0F1(~rcEafQf;nE=?DMz>X@)P<93SKJY2zcD2L>Bxbq1T;jMr3O_DxbiS z@R*(0NppZfQVpj8mMHlikDUZ}9d#M*tT>iz41$Bv?Xk3wKnAs>U2Ee12r?8Q-S#SC ze#bB7MCXcA{b=xrTYN;)xKCVkAzBVKUiwu_^g`q-CkXqrIj0fGkK)eT$hL+k0^tE> zp8jVBAb3Jj7%Ng)MjqEc9Ru;BieSc|b#}uwQ46KDh(0i)^o!<=pg|W1***7llY}^( z4Ynfd(GfzBz}a|#0uI+gz{IJyhb)Wlk0``+WoE9u`O7LuIzVwx4eT7v1Z9ia%)R#u z_aOTVEJ#WP=OJ$kuQ3F@@KYO>WF*DBIu`+(y^jyQmaa?(RK`ax^@FlgAWc}RCIuj? zUfoig01?%Q&J7mQA}ks{8a~0-R~HWa0lA97#$yX244Q(qw2uYE2vwjZDq}2rgemts zOipwC1eDEJk1fkfd5!FI+k&r(v%2r>CNsYQCrbfF;rqZbe_@ZcIZe&^7Vo>wUUYlPc2blN#0P^k#(Sv z0hVh~r((rUoy`kr0Yrzf8;1sgzIJX5^I4IRSOD3y$dRoWLU5eQs{P z*X+lMBLAA{kDEOY8X%SdwuM%sA>a|r2~_Qk1y;tD!6Yp(JUj93QJPbeR$^nZbiyz9 za5~eC9p3jbMfBMp7p_zIfkOc=?}bsZuh&zC5BZz3avQW0u;)cH8$>J+mv-yeWBomT zH{}^>YEa$qNWq-3j_le(F}}=BQMBDk5sJpDoVzlhjBP*bb!cwPI%BY79UX|_)i&2uMywr?% zUzb_H%J${!3U4xWStHuYCLZ^x`sy_75Ks!%HAtP!nr{G&?~}wfhzpP+>0Lv}VzjCP zR#^SG=kKw8aqbhbOIt$0FcwyNrBEq0nKh#je51ru!nZn13y!QKyj%_)R!>Tw?VB1_ zgc-8$pAbQ5C*G)EGT^l@M-4c=SO3^n*U*7@5k=$koE%N&RdaE9xu3mV%9QQFdZ2v!Or;-Rzr@pNHp-|&*9J)qY9kvqp^N&U*z(>ijR z2g`Bk8XQYq6Zqd(iTOD*DyVMMu&BV3{Ps@RzV*GL$h(aQ(DoQYCI}ZU!n2Wk{oi}m zpW!?CYDPZ9PVav;H)jMqpB`8{3&pMhThGWAvD7RbUteJ^@YPkJTZe?Ta7nScdPb+^XpF zYb>(5rlf&OUS%`h=Z80v>>p`>OGdkf0`T^?Dt$}7viHuf;~|Rg@az9fqbO65f1_k~ zCUVIKL7G4Pgplkv>~}YEH2ZWn9T=Kj>bCNtbfb|*NHC1nkSozhr7^y}nM;a76-&k9Eg@YEZ8n)8=M(dXYN&4?xvkVcmDw7O&yirs~E?uSl%xI>gm!5F=j2Z%? zWs}TcdR*#6>>x<-eMG>XCwMr{=obw^+fmweDf-IJP+#QkP8(QXcptBTZI7qA>2!Tx zGNg^}IZOTe=aEsEmkbtHhP!*-T48=|j4)Wo7wXZv3_@b)A3ai70c0Sklg}Qvy?8I> z_x1x%oLOqVC=2pylrS%~bM)sdB}hXUt#kp)@(I(0Vz2yX2onzbWmQ#v{rLZYzhXmt z|5MQX5ABDM<9}#BZ2w97Vf$awex#B%M-Y2%>(Y}zO2sjlgUWQcC|tGIlS!zVif~+Y zsAwSR5CZ@}{iSS%Igc;ClD|g1dExc_OYl`>&+9w;^h@!71H)Rvc zP~`K=M3vgFE%1}J`{zK%)HOaKZ%Ctb^^W1*2(jV$eWLSuVH5N-R`rqNxrkuF3h4Re z8~cT;PR>L0mVPY7fY`R@O^3*WbBU4(_S~u^vBC4v&dXJV`>^0=Z_|_`2HbZH*g&`0 z)Ca}FfRi1(l+P`-`^)o7_roHy}YCgKH^gdTBrGHDdo9)#lAi| zx`Bg%%JX*v^iRYcYE{(ix0;d@Nd!LFdOdyd$OyY`ZLp!6hnh8}@A!I8wU>I4#@*cP z0>u;F1ntf?Z=>Zm!3ADA_ z*tTukwr$(CZQHhO+vbXs6??@_Zq8eEPTi{gWmo@)?m3^H;~Dt(e$D3HV_sS1%<|;h z@w8Nqajec4+G2bR%Z(WucV4~7}-H8$EuDDus%@9ni2P@kj(bj-Jf~DzVGbVHus?k1(1}j@ z;EbFCUsJ^Ol`C;mm`M3$LjbXE>e=ZL;;!$yTSr^6yMpo|N~;2-0Rv}I3uO70l>E6+ zTBgXUZX`qq&|O7k`A{4XXB=sfv8*@K0_kC3`Ykr~04a;gcEx&NjaqjeG@Ic~)>?nA zySofh*bqJv;JybYKZ?}G)1H2fLU^%u3i9`L)@-J`!c@pxxApy|oRIDGE&-Xzwq*aB z6>xbo0^M5k)Vf&TWlS+?dE?c&(jFt@`IL7yD@TT3`#LvvXf$Mb|Fp zg@x=kW#VI zk0l>5;+0eeVic^(qvgO3W3(ZavE@{6o9$HzCx8H#2ayyK9GY0>oZQ(3C^+O$; z*%XkN2%y3~-yu}zkZ+DP6Q{UOuu2C2x1s^=B}b(3!&u$|9)~Yj+JwFM>aB@x?a-w` z?eUkFi1`KxRns0)@FtJ`(FYW*0DzH|_Kph;f zLYj(@!!P|!Qt4WYA?op~l%X1&6^4>Y9NYjteC5h_fUul?4PYxxE)(N;)lo?;qo9!Y z%ZXx)3;IJc(68(#HsxD;At=t~)D+2NHrHml-hR9T6v8AedXh__sqcgqSh^jHHE(MU zU}unQ(iL*#n{WR-mo|341xB?hJD-4&8!{%$nZR(w)(m-{*%bE($~(xU0EGx2Qr4#@ zfs#a#y1V65(}DslB#~WLBLPMnY@8-{yq?CHt}6Nu(>gRPzKLCY7ix4u_e)~@j7G$D zltr-LGLCd~?&eHB)srZ;8 z0aKwC5L(3Hslr1}q&%QaWGTJyIQQF2gc^tpuL~~+ILBJ9iXSC1A0$%rEjQYU@X9&Y z#{~{%fi@H_Z+Kt@GsAv_T2(pZFKG`I2n0X0i!xZlNFr?WaZ4@E=BO7iFsi5aB^p@a zUx)OU`gD~B`IV1~ioja0qO)6l{`D@iK%(H4y29B87@tEdNr`EsNPDeGva*i&Qo`))Hik#ny_q-9qt9Y*}=Q8^my@h z_Ti+&cL`iCs#*PY=e}YKORQw!;4pphMdQ%kDg6SkU5X~lVe~nq+G8(7T-c*^S}17 z;O#I7@KCmpEwXk=Bl26@*LF#fK^AAd*~2z4L&`3C!``a`0r&G|YK`6Du;{YCJ7~0$ zBj3@LE#%4y0yVBKW z5DzXX>?Bl>VS1TY10V_obQs`^tq{%Qzxlb!B}2Jm))#7FDdl{m&x{3YpSfZ*hzR; zp1Tf$#NEyhrQ{|LzQaUg;Y=$qpWbej+!xNf3`p$NUOVR!jk7)xrSF2~zY?H^ARH>O zNUNHPFwk2C>lc5_gI7b(L2@<@8MYJ}w|r^hU|h~6 zuKO5+DhDcK4(C<@@&l=}Vt~6a@5wPw$F_C@?ZOPoBVRlms^HQ_gKaF%r;JUd0#p2u z?iywn@dFeBUtC9504j7OdK2Wo9C=IVn zb({){qqA0Ox#G#U)7@_5wK3{*FQGy-PEr2~e1zf^L7FSIn27SVyb4u(1TTJdSzHKk z$;hCTr>KW*rhxdc1uZSwJJ_C3T_6rwiB}Z{QGu18#o4`dovheJgi=#)5`#IKa3NWs z`+k?+9|eVqtHc&*`bsSyA!#9$TUK#MxYKCf4}ap0Xl2ML4o0O6ab*PA;Jn z3XPRLK#fU#oT*?Oz%KW$9(F@_%acS!#|t8j*zO5w;Ww3 z$sUVIMH^f9lsVfcye`qu3=D$5 zWDo`twVPR3n-dt?m=TN<8`U-6;T6Wf)HbRws&xO!;vA(<`7`ow*jl^#1YIMNzw7zy z>RV2e9=m<1%spzyr5*tR$N5fp}>9b;B)yhk@+5EO@K>1i_g z620r#nLdFKi^REra&r;fx`o{{`E-Y|{K2d(4sn)Ew5LBWUm`6c=V2x6Pj!C_dXg;H)|5`G zECr;lXg01rIzJG6#P-a`-5Rzs&kPF8>_)6=e9=S|xz1CQOBJ3)(7)k3tk)Optwz`0 zFMy~R{wd=t`|k3sq77W_C4V_sK<`Zjtv*NYMh-l}x3BPZfA3QA7{#;N`hLH+ulM0; z`##T?dh$;=i&y;s;S8Tf?!0ICvEVjI(mYN6I*m*WhX2LY@P~*ac94fBa5Mc zB{D~2vBMr`X@=(j@$UVf0AC2mJZ>nFQE;(P`l_Ii15PImcr&>RDyD{59fMPM#?EcM zk<{LTbHbY#wC%0PqPztiKTFz_JyX%xQYQmj`}Z=m@w-1J$z+spjB3dgy~x|#D#$1c zc1GTdm`)$}X#qzgr8S84fRM8?LdC#t-g0OPOK}tU$DRU4yv0HOn!5jJ{|{gmT?@*8 zE{FeD9K*`=f6iF;|16GS|L=-pG-U0!*${ef>-T4!5=tedN+vM)IAj${9B|k-%D}rd zCc2wy#nMnDFGnD}E?D0v-{NtTh@K3&^F;%J0^z&SDl-pevf1N5un=Vs7yWlmFPy{{ z-macvvdSwyG<1u?qc?PJwQ9_`=Z$+CII=g=DWWi=iXmv}%mqDLdtZ@b2KYjU6(%9v zXx5qwGSE$T^lF~&=bTqHAvohgmE7QCjc72$quHDHNfOAn&N6ppLq~EPy2CS8)5Fg! zm28r9>i3Y+frMMU54(k$95Lt(NuIVW@SvLSKSZ_4pH)xODQAR)y4CghII*kcZMPr)CyI9iNL*;b1c(PP3_dTlct6>3fGg60Tm|qsjAtjBF}}) zO!L)0o;b#IsnN8QYiIvP@6YYQz0lD!C@8yIN0U9>_c7vvPg34S@WJ`7`!#4@@Oi!B z2(HRznpM}ztR;@PM1S{_SvAS!B9q>_<+8vI>(`noqg>R}3ffsi7d?v73+-|0e?Ou((9#Zf=+J| zRP#zt@6Q}_wSz9_A>yOph_=>d>H@_wrM}!T?Hh! zpnJe5t_Z(sE879TLY%N_++^c|Z|>G&43p{6j7WVSYMy=i!0sF^2#%-jJapn5bGnx~ zi0!U zcQ6BxdpgAv1H@-Vjh34_*f+M%W|39I5MX}VXe4Mr4BbK1c3^6{m>VvZ1F!w%4Fo$a zSyu>iY8Lcopa;W`dImi;)ygL?P-_--2jVxnE#1W{OqGi70I(v)8^ucE{2de7D#_r{ zENdKRQ6zJV?wPCuM;A0TyUkc)*9wvgR&a~oN(5Lrf^OYPYr301m>CK*EosZmKT3#e)^jjQeGta%qmx+GLX z>Xe$deVFH|3poEv2>UuGa_*uFu~P^KVdl%g4AN40Ld;TZXr+AI4pt{|aK-ULfwF1< z<@j@7+`TAV)KN>m-xBG+5=$Bnjhw)IOI6-0pEOKxly@zgOdFdBuI{PiQ9z#AZ@Wf#%2n=s=E1puhO21t<16VNh=sf9Ix0YSC~0m|=qzJu#7y*>IKs z6s`eCBw*%INzuOK*B7Wtkc?Yyv6^ho07K|1A6G||Zi2D4fvHt~3r+k~Mri~TUbXHn zmug9d%g~YPD==G^U2O_#i#O~~2tC!lzPwx3faHlvRVuooYYX9=+~I-?4&HV(jb3&& zU2I!HOz4PVQH1@Wm|$_ju-1BrAOkGOd_kZ~Y1v(T3M3|Q`2@^bFilYek-ltXzxD)IxmUZCVlK za3nr$(li%H*r3A4POh~hPe%qKUfc;IdEz4@SPTeDw4yYD#vr(dL1^s?`cdzaw!2lEu(a2;guNaqP$BKvHpk zZ35C#EFXxOz3mLPxw+1ush`O}5+BrJ*G$$c6a7pL`qI%rh|nL^FEX`*uuG_;G8yo+ zFELFdcsrAt>A~W{v=x{8qh}7TNosd@8|xqVQ;(9gZM5=W+&FeEu#_iEYd4`rfc_o( zEkG_IOMla|shd~a>j)gSz_}8eQa?j65s{GiZ+WSsyUSOOU>i7;I}<)3U85>bk2Py#H$L}FrK%76?GSV)h0jrwRcH10i zJ0H{?R?~sA5hZ!HCW$Uf!0brl$tX>ZV4$5+Zk9DkD3Ye*7&BIFJNZmM9H;k$l_ur+ z)q%hrIzQRv)zK8U`m$M7i6$FLt z8<9~i1UxauP$x^;HurSq{VU>3`<8#hcYVj3*vy~W&OUs8?J;SoPqK|uQfmgIalX$N ze#z}MdnTyXm%8!uCz3mOU&eRHLx@9T#D^KtgeOg7G%POsX9E8Q;*p~fg``>JyyW&H zT)mnh0cn&c;bzTqp%A+NRa6D z({!6ha46-KF-bFq`!0%Nl;d_X&@Im;z%^ZLRMq+SuCxqNU2E*!IjO0d2MtvT0qUG6 zZQqOPx-|b9<&hLhZ&%T|Z$+)HH+upAlHCJ?2fBY-y|p*>G3j8LL;L1|C~^^CS>^Qb zbyFp7SPNv$o53m35rs#)%dK=(xv$3P8Af=Hi-eLXUcw-o>wdqTy+U>^IKj{Q@FG&& zP;;lctG9gF^+A$)T%bKPNhvS>6Igr(!+Q+_{;1wX{|dvssoI)i;7(;!@|tLR>H?+J zNPp2G*AT(!_K3cwFjNR4(r{D7$F*_{BjF|WL>aT&OT_g^Z+;NW1-efeMqppRgbq8- z>e3P>LBJF%CWufdJ(Lh8q2?Yj7Y)a0Y&!D-`gir0&Z+Pem%46)>!)*QKwKtyK_DvW zq{7YU7~c`5F+kTVD`3z3df?e?Lja8NTWP7fpKqo!UZo_^fstH+W%QFa3v9tKizBv| zHS(8HC5AttSeP!l#U#64hR@UF82%f9;$09B4dn zEO4P*XW21psYKnK+#(WQvOmY26vhHKd;6ue0+U{nbw?r}Q-?8qJl_t25|!rk;Zb>E zSXu|ngS-q{{t?sdfZg8rf(FVlv1J|lYz7J?cC9_Srn2|e&DG_FM3Dox_JRxdCak2x z868)$c-2jXigT&Dum7qv10aX2CsULdES_*DI*M+T zh=8nDkRSpcT?i5e21HtGdGi|@3i)7)ePKG`pIR$be`3I^IN^F|z`~khv!4nt>N51T zm2&YTxzf^awpBhEFNigh&$edJu-oj91Qa=O>l-#w>|afmn!yYKMhRS$lYt;9wlcO@_#AD=5@l~dPF0oEFElTG z+rg1UVMip{^SxVB_5x!Q+;{?Q8l~1ty?#XnuBEB2-X%m#+3S)IOFagBHmk zD9@Fv>Wk@!8X?$H_ogXWkSu@@u9mvLw81)kIx2Iw&)&Su7ofEo+lpYcgdn+I*zEkW z*)|Trhr^aH7D%ggT}vh{PMPJ^Zw%GRbktkkmNnvNHDI;r)hj$Ca6B|h3tMY4lswT| z*lmNHpkYPF7h zblDB!u4@Y37QLW-asfo4l-fv_m)3|#Eg1SSHPBA}E<{%GX#q_pO06c%MEy~&)1Vq( zwmV4FBmJDE*&Bz^3D+?-IBf-YVv`t<#a;Df#)q;b$HX)V-okrlP47Qi4Bo^tzlSKZBQ8`Z_+Vi-e-ZF@AKU<{IvV+d^$e=X9G|7pW8sm7~+&%@bcURw#-3BE0!CXW=Uas zYWLyHeZ_87gWxT3z~qRq?rk%ym75Rt(|TLB$~$skz~1N=^V4W?$3n_NKG+^b#rI1x zq&!Nex>MWS+VuJ+Cg2xyJy<`kfSK~VJB%!6Jec4dZx%h6goUY*Ly&I=Kuz?HFp&U z#Nqw9ewiW#tZut`9=JP(Ru2ZxsXTt>I`fE3snR?0?JCy&VWQ6s3bj4I7oFt*xYt8P z<2H;cFtx2|kM>Czj%f4dL0s58Wx&A@f4I<*mUnxQH6FN{H#39TdhqA_dXO-vZDmJ6 zjg{WQ@>M~- zjhX8sl(*RDUCl(IXJ?t z^q*s%c-{$jCe*85nx8fSlTv})!GXRRMNoJ4-!JIfN|F<~cKhXPJ%+x3 zImQ4wCPwbQmsJF;j8J=>Ip1R|N09-DrDVSp8_IPUYYA`;I`RL6#Vnpo2(qu<_(x|% zSng+!4({DO@O!vGF#P9a`oBCX6C2b2@u=+o$)j@oS3K&d=Csq67~0MQwHInIUE?ae z3otJoEl(TI-HOcBL=3yq6liinLNPVL!b&bgxxsR<0h&`{=!w8GjLlAw{Hd%l2&1 zg*ZZRoC$!GK2$kvj0>@wyWXtw^Q8h(xRx!I5 zYbqt0$RE~`9^W6}cXzd2GwrYM2z@9R#g|cir^$Ciw*$+Xelcje+3dZqT_NqT@aJIl zRKGdLp$tDc$T&*F8`ETPb&AnOqi@l+O%3`X#C?#1=9l`tINuVe=8*RW!?Ks4hMKDT zhgsX?dPT(|yX0cJkB-^ge3?H4iWe~g2@z7_cF3nrSkHYiS-xvE(f23A{8^l`jDB!rBi=Fn5`R+DSi5R-jpY-AMOH4lq$jS|W;mGbYVDT9iTIIL-k zvE5w4=H@3ozJ4y1WrSYtqP&a}#yK!BelNH|{03@et50nc+J`=E7g1F?Hf;tP1Lz2z-P*gh|GKUhFqisUeRqG=4{n>!{bq^YZzg5@ z;Q>r=bBOp0tC|sy1vH>#JUAadI;mWbA@5=yY_3db4h%?6%i@|8=x`%>h0En2P zA35t=-iNIZNl6&tvj3I^H@eKr%aABor{nC`Yzay&QjXn{H}+}r<GIVpsu!%3ZPq2oYeoM7YS1`GuP3Brydu5UZmG0}%KpVkZ;dTOheKC@EW zehz4Ha8cL6<+WB$OwEN3oZA0!zimGGU>Zal`GM2|=Q7QlaTG!q1_T@=Cx{y@KYsWO zW)duBGl{pF(+AbDHc^u;Q*7DE+6(;p^iZ8~{`l=Zg;wr$EA5%&l9CU2H3V5PAY1W; zi(oKm?1kD0gIZ`+$XF4KstCx@o*zQe(O?v6j0&fD=pgUb3hqeq%5` zvp?Q{pxY~|W=~aTa~8DU6$jC3S9C+#2WFFn{2H$l`iNZMvAYLG+Hza(y8mRdi%)zq zJ6l1(8$-3Io*@$=8`Fl*u&>T(+(iwldDZ*DtoE;sH9ZZPEMq@_#u>kcPo82~)%OMw z1Z=O|;d;9n<+YC1{V|(;-bKmPB>aMk2|L|tOXVdo(KnA25GmZ%t;GsQ2Zm~kUBfTz z65H{$9c&6GK9k+NZ2WAevv;YIPUt@*`G>JjpVC=tOv#8D0ZgrJO!K$V#+OgQ3TdC# zO$~#r5rdLds!WMiLwP|Q_!vS9b_iyZH*#~P!|JLTgrxD7&2}#>648=Q;hLrWL$+}< zX6#=b2435F`8+I=6^^o5&w zvE&oP(5EUUBE1VaE(}inII&-sD&JsZDUdCwfbG)2aQZS!U(z^^shfPycsM#KD6MQx5IFF>|t>nOG5eyEX)IcDY z%+Z~J+EQ?kB}$pnx@C)cFnKToDmsE;5uwv&4HF#i(6?U-%0LqUR_X_(27_A;}1bZGia=0^*FhK)dKpeG1y@g zU~8~B<0T?b)0N};f^(Qd4|yc-kH4;!DZ7XUgGIvq+d;2Ry9tTxl*+r=&eb|EYm}A+ zbL0EFXwpQbmoqFnqdH>bqdBBV(4$3mtH$YgK%N9CRUouJ+-W?*E)6SP1_K$4m);Wr zVUQ6#Vj=g@A{6C3Po{V&f#8}2$n(J$0brOaw;^Uf-dHKTuzW*7AOczbkzkho`{0@h z<>4$6tgM_^D8q%(40+Gq+E8H_rr<5$+RR8+rXt?sY)6hV_!|sB|6Z%Mkfi`tc__TS zI+DdT;1I-zFqlbM>Ze?dn~r`Yt>!MPD<=2?U~J(uV2=PjA)3C^YsMf-!u*h{Nh>{K zRyojV_SL9tv}&aM)or6y7jyOgoZmfy!a&Z};nzN5m?G49N2JXFfRQke5uR~Hv*M69 z?ti(?Iah#On3eXNN3n(Xf~#v_?Wr?k9*W=~B?HB#FD%rKBoA8HB!y+++~AdxNpZjc z{Ux*_5@?!KXFy(&T8JIlM%6y!5R!?Dr<6z+;J9hi)*ltt2Vt(n?g8>w9B&Hn9M6!% z>^h9UOJE!NTg+4Pl?0jnFJVE!BPBef@2AihFG$(LWW~IJf@`06ntoptsT|n{qs>RA zoYsFr@@8zGf*965wfOsa@IL+nVMOO_%)Zxh!PO7KG8Nl-aPRyHNCtyLRo}aJVCN}F zuYf#|g9%;0c9+ks)`7D}j>7GUZSR|8LIwpQMtBg@gHjlS+>Ngy=Z_D~Rq`Q`dQm z4bAu0N1-e&hIrx*hny%_)2vms~f%Ku~{eAhPdr)@iS z?90lK1%ZqLF}CQ-6?yXG`oWADa7H4JoWbB>)R!x=Qd_m{*Q+{K$1iD3DA91BoMjGy zoUx2L372%iHf>ja4ED_B-1kk7C#X_rvF8&ISeqStMK!?Pc2){(x!>+mmnS1pC>`rsk5R38vY| zTYn_nG0OoY8A)uH&%5O}`>(N_BbDUgB(kkv2Ti)AN_(X~dQcEp)6GIrUH{gdwg!L7 zFShUNlKu7tW_4D^T)bigvmAo&jOj22%Jh!xV!G>M!BCfO%_93H+I6w8-O4(dzE4In z=1{{-5fCp$7x$nVKBS{qq0xLr&Ai>lVLi(QdCHXts0s@?{pPP#*6*w`T|{liXC|4_ zyMWJGxEP&F4@Ay!Fmt0y=&T$9M&FI6t4m0?5RERuJwp*^X#|ai`f?|GKbd2lWN`jK zR#{1MMK(TA022MjG)Y~01x;63eHv~@kW@jxx+t5L?<>Pd2p4Hu3U_pZ${-2p?@Zl$ zk*Mdg4c^p+9_AHP3jHId!K2&pzdXzVZ~hd}2>WQj5KOe^X~M$+c7m)CxC_(pt|E2M z1Zb7#G7g76p@u@9E|x7KaFNH$o^=N1gIJ__kTR1BwdPBH`t|4&=bgtL$N4Uej@z`e zglhBsGgoZHoclqg^|$XR##tPvq8%eemmRD2!D0zB5eDA@9CI*Z(S9}n!3*U5L=%oM z=XkVqEN!ZF_v8t>K9@j+fyftd0oOo~kz^rqDexxt@zs-s5k^N5M^3op(u^vxhSIpH zunj%PFZi*ake~SR@8#w^Oaqmu!RA|~Q_d^Je>33gEO59`wq9T?b11=K&oaH9W%&^o zy7gRux`M90k1G2IlIQ0SAfJwcHXQ?W19@2t({k;i>Mb9XI1(}-kp-3g{)2G=y zIM};12wV*^;Q@9r4~1$-7Y7ygK1)h(1i?kBT*R2- zloN4Zz8TnPNOjkJ3o8v|d`JSLILrVkfC0pu(aO^Juj@y_dfY8wGwlcxy2BF%3jrO{ z6o3i_EF2Zqbr^~gwH^sDbtuG?zv@x-tf>gXc!?T7%W1Z1_Tg94AG zb!B_$3W=9VR4=Eo*wkI)Z>+hY6jTK|i}gPS&GP4kf;zWQFh)kFBa={sUGy{($WuWJ z4-bCGM?q!tifQwxDPJX&{u#6&y_b~i_f-f@JR}i?hNZ@nhOU8^lY)Yl3K*m5mI|if z0C2e=97<7M^|(l6uET+d@w-3aS%ZsC26`39SB8sl)&4aZ`$>)4|DnQdJe8+_yt`FK z+F(u{@z)b}K;FCiCjmg6=kU3s1oe9hw8CR_?c&fBuASqL;NLSjCrMS-vMI+4VjSc$ovg?V?g zb1B%mjjp;l^d}5(bxoUE8{~|M&B4hfNG6bA1vw2oitPvy$aqBm=Oqs?eh;@Le|pgy zn7~8q%Qrvs1w*`RN?w8)5FZt~0@(boi@p@i63a8Y-_y`BgJbDZDJSho3rG-L0>TdB zPuTFM>4G>-Fy_7|6TBzW1FTsNsuY-w+t!ptt%}i@5mwTXaja?Us-`CDM4f`#YHGTw zKywVfH8piP3j`iCRrZ!7=V-&fYa7*-J>%+JAH_cms$Tu-wAzJ*V42CxZ)VJMrOL#N z`ZwhabO&mL2G7D5Uc1$Q5E1`K;WEPHs08#uM8Bae<&qI8QO=hq0jx7&o`0nj+Sl_J zxx0Ruu4_mS>V_hDnoQzE?Lt02lnQr)X|gKW2emQ3Dy3EXSRaPcqq$nUMk8V9LH7CH z8hAi^+n1A-E1we1<3r4Z7lIqxXiwtK7<*pYm=4tTxx-f{R4UoeQqU{3h{6G_WL^kZ z59Lqy%xB}Q*mMHj71fa#r+R-aPH1!dp1MHDhz{%80+wpJp%eRBXQ!NFc{gGY9j5## zRp~{BZK>-O7o3`GypqJ23+wbQE}>hX#F#HS(%6#bha^NPMU=+Y@5|VLP6qoJD2O-B zT;kM|qOHDp7#q0pNCD>g;>^0Qc$8-ujKo%Th&H;=F5BE`>9o8@es={svLFAg+~h=@ z<{NBzO577`UzT=ww)Q_C6ZF#A&)no=7RHeAF)t+NXy2aTv26PwUNZ6Vkd)+X5B>Ao ztf59{pHYehj-JqFHH)^wxZT}WUahPaCEF6%29R0*4~vaT>nN2H8HOzDeuP*R(g$}) z_pV|q9UZGcSAQ6aXiWAJQym?y_%@6=kWDL7x)z`Wt~dvoIqzO+=S23`j$GalVjvIO z*mfpeS;zY%Wo~XCJ0`W;r~k6qd-cS zsk6L{oLWM8vgFX=MHzxzq8$z}Jz`fjw9FwnEA0Iek10~(^>5bap7`?<7;t2q`9BAp z|AlLq{(o={$A7{#9RC$uGphN&Ds7oh10&^4L^Cj87#e2PHq!2tCECX^Nz`+rK#c^E z5YRP%G;7{d)!!yI_=Ox8%X(D$L8|%$UTi++|2ZhNe)ROh?=%@K_`xl@8B4Lr%F^JRYV>}t$ffI zraLWP!&vtGy)w0+gqBFA?E-@k>}a~Ha5 z2VcY=QiBN1_Mh_qug4t%^uA;hGW^k7HvUs3hO`AzBI)6nT@FQyH)@OMZp-Bj)Fm|iI z7cT=sqRQdL1vTvmpPFZPpOL-r7e*(8WWZ=fl(CpXk*aJVF70ax&;M6AUQt8P&rC`(W0&9i0w< zz0y@D!JqdkbXnsS+W>7ZgftJ6d~ATl@^21@7|FL=hmQe0JT&l^N{Fc5dPEtdhD2+JwNN91I{s@+s*g;-UhWz2nq zNO|UQVaaKh-d-5V-EEsWhqw~Ni5^GP_v`*0H8f-PLjvTW&^^Y@KixmFsupF27818cma!qQ5KE%gSQUGM+OCk*Qi!OP^yGEVG8PI zfUSR%Q#tWeHOd4Tt7poHxUrF-;6WXrL*ixsaysuzwY2LAH}*DzdZDFp zfVjzi3u}x}nTi`2QZtjO``WcfOB2Hfhe_%#d@vR%b2gYRrd|fIuujTY6oNsIfztw@ zKMLN5!z5{oo9(b^8al>fS1KgN6aN^!d2sx)dDL1)s?2=S!h< z6u;EJfQ^_z$TcjhN%ip*JEwVHXUj{{3f`mU{~9VMZb%$BBobO-4tV@ia;T zK*96RM9Y9m(ldi&&rG#5?-CxRv^Zmn34Dkgm1p8~S~wCVlAG29qwI@y1O~_b(L@?< zC^6cj!m=Em+$R!Bo$drTA=Gh90u%{sMjAsi~GGh%`4PI@_XYR zv@+m&M%SG6rp=W)4ND$!7&O<9&jwuddXE9-F{o@6z@ERy1Xg$fOex1tFmu^7l8uYam*8l(Fv_CM^1T*S8rxoWLIU z@m?NNxZ2OcD?6JO`$tU%(#{N&p{{2U5cxSDIA4?JOvUB8FIH3j5_*l8WjacDcX3GmGxdDdzZ z4cz4QGB3QQq@E=KY zV5y@a-hB!@uUx@-^q^k2@V#`aY&8?89))oiN5#?vftD+T9(*#jpLlvPweS$ zF&Sw`kpyL;+ zWd#GL6q{@sq&+E8-iCau!5{Yx8EX}@8@R}|`XhvSmoc z%!$lx-6Sv~c+vZNeBGR1s?Ucb$|jYhy>G{a%z|ejJx0v8OtSF0mMH$@0o(tv69bi1 zMZJ#MAaP5N93R5nxT?atFK9NFonT87TkddoUA9R)l*$P#C|_@5%^^*+)%Y7sIZ!~U zbQteG*J;U-#aWO}!28mNWkNfbftd$nb zPOqOK&n{F&3p7gYrclD}ItLfzD-nVO$v8VN0sv(HPdm(ja}tGoI}@9);4Ye1o_n_I zSfOfSt1G{B7|MG!$#W}kq4UEqL!~{Om3j=;iaEDRC0Yd(xkRX_atL0E=-5o=~nJeT8u*AUo-E0NJ9KD&_1v|E+{3|v1zpkoiiO?l`M+WOk3#8yNL2Mt6mZzs zB}CjsnVwcAoI>MY;JCVzy$rAt-zeKb{okthQ+_N#-zYv*4Pzm(!&|Oqu2XXLGDY1@^D=!veq@Ekf0-8#0IctE z9w3T!O7edqH*GV){_&hUTC1q1W{{VeDFPv(O2zhf@6q@B0K zkoqpwXJ+@)K#jrTGbN|OZH&|{r{QadobEI!t4bvJ*!M*xtyRySlMu*KIx3h&9oNcdJ4`NK$gnW}qnC*02bWFR*eeWt|umBvckWl|Hrcn|oN& zaJHA(jdxjt$C85;?hl0#z2D&N^ncf0uF>bme${z}O*2I}SGBju0l+!KFK|ToLamj& zJENJu;&_1PS>$xqYM?oD?EI~H#71#UEJZV$U9ikp1X&<*hGhnC6p7jk#o%#4GCE~R zb+1CTJ%7H*A1Yi3j{%5``C~PoX%UbdzBbqiD59Hl zK8o{&61cMNNaixcd$jmN*Q%_ytXPFG2$i0x9RP*Af!vcuV}9_iI;0ok(L6>1YV-vl zNOcTWQ{d5T9|(ZkXaPsC8an~BK;@$}JfLQb6&I3GDE^9&kd-9(blhWr|0R=gB)F2j z21bTck*?T_Jdn$RS@&&+g+xf8Lw@!?lVOTHtFeclfS*fR@md~~eO`AE@3(V7L7G6~ zliw=5?y^m2=Sx7Ukwl)pFtr9amIszAg=~(KjIG#LL1GwY<)~m`oE4zDzE;~@1{KS` zC#nh%w3{~L=upuc(fs=d)5eiO784}TTW^lpR~Z<<%T@d$uw{os)QWSsD)ho(pWsMK zkoNKfa~W@r5K`Vzz;-M~AK5`pC@VNis@>)0o;oZWk`H*j`Cm=e-dq!wI!2XA_nPPV3 zD2s1pP8mIs?A-FY8Lb1ffL`g!F$*sy6nOHYp8zL;Dr93w4AuH&A66JTJ{_HYk1_{$ zc|*8UQgntEu9R{sEea%w0u}^9I{;kVnl};$OZ+qK{?!SfgW11Qq9X!}xDX}!RK)leLtBr_tk=wg)+VlXMG|%zm6^v->2z1tbk}lnOi@iEvKiAb3In8`Bk?q zD^+0Y3VXCY|8$NB@Xk40EU6-oyn4#L;qn?(02x9ZQS)dwr#1a%E{*4g02 z>B%)0E0Q$e=FI3VGT?4|a8|wj$jAR5W9QH;O2BN{W81cE+qP}nwr$(CZJYPlwtY|E zejTrS@b%#Rff`j*Rl~m+{K`E#Dy#~sH04}9;nn}jN zRj+7tmNeJukB*y7=c93vCl(^gqlgUTh!RJ_M@*tZl2&yHQlW?mN{+b4|L$Rd%--hKci`nsXtkOc{iFm=nqlRA#cj&7qFdE41UC<~-(bNTVl_;EC< zhi8Hy5;CrU4$!gL2KsNRv~ zxt4`s(iM9bAU;0$#yDQcRAGvlF9bq@EhP2A{ITHbB^RkYfl(NQ<|)xI6K>&PNMAX@ zd->@W%d6dX0Zz7_PFQ-Bv8vIdg8I?L^TQ|;CMks$h}!6)#rfJrJ$x~8Dr{PJAf&xj zJpr+&VZKZe(GId+e zWtFSysa~f5g`v|9QTPqIyIiIH|Qop7;aOX=G zoYAwV{-POn9%mMna=R=L0C$E%o3#a18+Ao}R2vtx-VxBSURX?vWZ= zQ;pxQ;-6Xq9prT0=62m6Ok=fSvy#sE05)kOAg?wAN2=!#>m&CQotJH1^!f`peUK2SLW5%sb12@+NH zS*{|2oGjHLE2@I!VCfZET2qYL*RKG#PYyOfp5cRzAeH1|Wy^&HxOG+$cxr!zEI1%T zhQqwx<@Nv&CN7HRCEk~2YhC1fxQv->LSEYq50box7(+jk`}m>XN*Cld8#P&apg1MG zDrT7r@LU@EZn$x2(j=~thI4)}Y(F3W>aD&^Rm=*(>p90XqB$TN6Q~+O-fbOOqkxR( zkQ2jzOYO|)ZOfhJknur8`>h8Moa=!{mgT;|DBz*k#punoAkEE+-j19#l!CUH@nGnG zYs1nz{i*EiqgU@*kA&8gappfO)Z%#?0lk=jp6c}vC8Ue-0&nF^lXk-x7g1n%)Tyqt z{G&3fcewA&e%`br_Zp z?Gy41M$!l==Q{%M0Z$b}oJ*Y{)g$gQCl$vMk(GutK>z;tJX%Vgw%%Ua)gm#!64Yr`5}$#;;G7FKXM2Ca)U#{K{oyVMJg`*$prUKrPaL zeNi3Ip#v74=&{inf0lr`T(Pw-__tzkLQ#vm4{V)8e2Lz8|94qix^owLLW!NLlx^E0-8$2CbdRfJU@vZIJ#fxc;FIzsgt zPsRMs-*MYSaal*?epPpWeV||aX}wvR7n}6TH#54rr5@faLDA8PzVR{jn3JsS6xofs zg1QSMC&qYgxz)@D$?X+G_Jm+HFIvc5zBxY~Kuum`OsJa#VoS=@F-Lu`I>{A#oIy3_j1rIG&nZ?otZ4;v#lF=IAgcqvSj@^TFH@*=Y`2Fyj0<2Bjp zsj^N=^?chZG)E#9S0h`3xE}x!+QPUTpP?>E44PD!J#k6B*y*hh7O{Mpi_q-N`DgXF*Q^wU2%pUMiBmuK= zzczr9Vb?cJEgk5%mGr(?KNWIYIrItL)Cb0fZ(GFSwYo4K>i*b;ep&(tcHB z>IBe>>^pqe)hf&Me6`HIP8QXTc8Nz~BfZp~@=9E0Lbat=8rmBY_OP@K)Y(u}ZK6 zaCBrD%p=Mjq2l!MpbwlM4BZxN5?z|^NhdNH+`iB+yCsc`LCGsU&3W3*8hv3bN(mQ#`!;@+HSO_leWfCcjnbyJc$`t zZHloi3bg5HkHt$$sReYEV7vSWG$m#VmGfFs^{P~#H~**UeHpY|$dN}q=|m+^ckJ}8 z?e9R$GRMjGC!EabroZXpnyRmP%v!m$lc*})WRBzA=~ad1)lJ*1ZYxb&3Afshldzho z{&lpU@MLrzO?DT3)h3STj!pY)Ou33=qL}#hq5fb$chxMI@EJ|9684w;_HHJga^msk z5WDSai|TJ+1V;LRyG6`=8ah!im24*O^#cbETe)T4)}H#0Sau8bfC;kUm`#LXC`qJl zM7D5$I1j;mUgo+ET4|Ko)ZLR=4rx>qOY(<-TiI-w2!$GT#447N2HJT|l`whzg!I)& zzZJPvIddgJP^7chGuTW<#*{%ZA$BVwf@|{aTv`kh8Z)|Y7Y5GIJtRCexbo`zG9B=s zr0I2UCnjIcQqD&%A%8UK>Gen-34GNFmsTq?8KI#wChM2IOA9!+r;xLRsd>4hAe`gu z{FyKn3|S+RFIgiGS$b|;~AVaI^x?ruFsefd2_EHyZ z`x-CQ-WXC6i?gOHPHGy`5c#4mD|=`PnaY%niUi{3+rU-eR@`b#G{+^>4P!442ei}5 zD5&#Pfr8u#r#)jcdd~5XsaJXLaSll!0-y9o;Gn@hG(z)dI#p*k|ziuyQ)$7a^GNm4PKQ6434LDbn z#&e}1oY(Y#k<{8jeeUnRsU=a;ZdINg%WL^^tZ^t%WNwgw+1Mmo z>|ewGR=(NUqi)huo5xV{NK-x^%;%bI#TX+P=5GCzUKN9;op+Iw_H+cv;y)toI4*KC z$TplQJmFoWJ8x*@t;d=jsR@Ubt$-U!SKsnVs+@0;W zQULXh)Lboxk1^$d^~o{S^l#5O(;-fkW1?%dos7#|WFHhG%zuuJCd3A)`Tb%_b(3qgC|rO*g2Au&z!}S|uNGq-pA07m4x||bbg{Xp7NBHB&^&EU$aQL0Z87vj zD(f+Z!~J16q+^i>ak3p(gQtCgDY#`E zr~sX%oW=Cp;bN+n%{3m-dnZdn@nNalRw`>=ADmcRb_Q1#*r~V-Vq4;uWnpYj!ksh%(_bj$}=sB5e?UE z0BL<01Rhn^<>h7;zkRkA6Bx!@;Px@_80+`kmgL`xwET$YV<`vC^U!J2_<^N7^Nc0l zh4I||S`a-uLIIQHHhPk?GAi>3$ODV`*55b@uHuP75`S88P@arZg?f6USP}{*bb47F zq>#=@e#|!QcDgBaB>H(gq~0SRv5M3N_j@L&u*3pIE+?al!X=oJpQFlHkVVFKZN z9-&72e3vx`P(L?k3RJHB#946_82mfH@Ex&6*j!$$c3o{W;dg9C9E-tQO6=z8q&+$B z!$Fq{iM6(x{=6U|x{_Ep8O@4)TrmObP4?VJsbhWt9YHVUz;lH@{Qi(;l$yJNiM45P zu0ASZ`r}#B^-i_|c#6?78hj|K23D?P&o2WFox+rjmahM?qS}4<5UR>9G8(fU`6qPz?eawO;Rc z9tIiMSybUGp4(RjcpxyO){2}Oq}_L@GgbRlxB%wi_NK7Dat(ybOpzYZN(*?7ns$X; z^SSS;rCz1G+aD)Rt1!oka}gs4WS=3EfI6HEto$Ns6~#kvv)~XAF@mN6@}(#vURuW5 zCql#t5FDzvSVMk8Oh%_V!)sdDR*?^Lmq=X%V@h&m$m{9M>Pxo>Di))1zeDT4(4Jy{ z*b#Exe%O=KQp1gnA&9OeSPK8Bw7T9x{!tESAjp>+!aMKi)4^{;J{HC0ks)XlOm!GQ zx9>5U!I)d#fnIR@77bGgek=}1Z8K&S^v2#?cK~0sdiqI$Y^AH1SLM`iAKih&%D@CI z%zu+zS8Wdn+sh{0!O6^)1EwrEtfeP>-gam>gGLgdrU>J}q-bDd*o?84-yKpMG(q?o z(NV#m2pOw;oD>yPw>uCaE$icjN2U^T$81|k8@&X^@oBIA)QjKs$uziQPrW!vyl|oK z|5sZ5p^NfE7v+a8`b%FVkyR_s2~|JXLmJjdY+Kf8af%r!?^EDy#$FL7BEC z-83SZ3wZTcjNfUJ&j}@t36=YZa)K^Q_<7!%np3arJ1|9 zyMT+Sa%@Imfk%$_gul3*ueiK{owuso20O|*OJ@3#osyQek?d%;63t6R?;)~>YxxqN z=375UI z=iDAO7E#CO9_axx?h~LYcwc3Av=N7^3hc3SzzO#Pj5q#rQtJ9c@;2tqJl^aX`@{2CmI6i}oV zEj18)YVfq8JO0ly+w4M4SROT?lU{`8!ITIzLs3w?4nhFMG7{V*O&0tEb4dYBhC%^` zj92^B=p-lF(54!GkRFLKBqAU8c}OMa{5D%?>7jx&k>Px>xELtcR6Dh{Q9Eif)xg7cq^yG4!Ng=Z_XL9Ej}X%V zUez#33SK5d@)#FzXyf@3d_?G)N>fTJXB2!_GLa5ql83o#X^WB zjX{7DGT&D+p#0iR{dOB|7IH=Euc7k|`u7`~n^zY5Kej*r6=VKS++qB`I%dxQL?sy+ z{zt6js@9g>wiuG{x;o2a6OO>}b8NcXKKM9WlioX;WdiyJ0tH;D;SAybZtl!`WBsE1 zJ6_w@G_B`ap>wxq+diqNKuG$%Vr+P?2XY2H4V^PWCCNNQ-^UYALM^sjG58W`}>p4 zK+!-YYe4wIA4p;>L)6~N1<4D3S_bk>bW7%hA;vxPYUuu)@Oq`Me$^zcn_nX}ATY{* ztCLxBuh7w)JX*GxGk=WfM{5Xu@^!N3!Hl4I(5%GN`zpDyWMr$X+(vSuxaani1ywp^iwX-P50A?P$GIv0iF> z{ybgcPqngO(nyw&HYh~bHPvYlcW?@4H{CAQ*`hUMBV>TJpJ3JL?o^Yesd$BzSV&ex zkBAn`SVV)y3dwlD%(Hkm5O-Ha!TCbnPWb^#+c)#=6!S)NG`_ z#6FjV1u%y-GRTTr*-d>-cfI%i8U`hEpbQITK6+Fn4mnWlpbY!tD#i3Ra~$lehjT!~ zL&H50bcAb*?7a*(KQ?hbl3leH4?bzCTDl;>BuHh5insNFwg;$NAep%8P3)OKTnUNt z#(La)*AJspmBVVbk|-iYd2sv@z5guJmEebv3NE@@up)$@84@Kx7r4&U9O7g

^i z&~1lK0!(taovd01O4VW)<6u?_F@Ts7O zE0iF}FD4HO;>U?9u#fqAfh6BGA1IfZ!FRa+84@RJ4(Oe&@+Cty!2)RDe*g*)7XJP9 zB=C?ZcO!F7r1)L}Tt_*U7lNPs>WZr6>_13)fl`;+$4Wf9AMeDX~K=o0ZK@3!R)0$sTs zHbH6;H7Sy$-#Af7QONsU)M?CBnbx(7Np2{`NgFFjic$Tr8;oaMS(oXS zQ-%jSkwHr5f%8`LkSDrpNbI5@X_4djPvf8ur8K?7w`UH_y#^1-_rUu%dcabXL;3WeL1)C9D!st## z*vR%Of`V2WiT;E)z*-Q;{aD7uv-d|Ew zmX3KZ`9%?f+_H(&0zg_SDM`Cnj+9U(s`H6=D{-Ml6uj}cQfSyROAIo()1X4`lP%z( zMivzG?Ui1=Z8U@`p45RxrSe@dl~9E`LCdKGz5drm8oqAfY!njmn3n`ik z{a#!ZE?|rd@d5rE&Y0QwrSPVh9B5PmVpWWQc|m!ieY=@MlD(c!bBw{!Q4 z+aE5-Oz})J>q;r%mZiG%x)mW#FbPPmONyY%`0l<$w)B_A9+YkR-SJ1H61|BD5_Z6d z@Xkp>MzKjuMBj)fVxwaeCIfR*ZyeDClDc|gs$fVE6%sfA_Y$Rr0q^RDiv1mbRa-71Q-UmoptUvolwlTZtC$pzjmWt~trh2bZLAh}J_0w{}d1DS5 zj4O9Nn3cJWDV?-FWw^S@zVT9N$}XqDjISE6L>8}1Eyme%&+$#XjlL3#ucqoYrn{yu zSiRm~Q*JC(nU=b&vH3nT@_lZ)lLM^l6@U}%Y3~JFsUz)le=DM0EwJ>? z-vuE&iN0nNn9J3GRK>6b<4Z$gSENos3R0We65{``YVzDbYf51H8w4>h@P~y3ej$U5 zaExK7&cdFTP8rVCkQWFWtc2r00L4wBI0aWJMF7V}MZsjbcGsYkoZBf6$!FIH*Z=+d zctk5cE5}v1j0rrIQtq=a6V@8FzWXdFBUn&rAxMo0YdhRg7^=|!D_D$%$6WCN2C&M@8XJEjW zOp&t;jzk(q>3Arz`!OrRcqLd=qDb;BbAU4igKI8@qBPWt8xi(yGw0%7n&V#k@8;Q* zU^)j(&j;GH|qIwthDsIODNQ*ZtD&M1gfJvx0&swe$kw_(<#JdcE5L*65Hk z>QBd?Q3c0uy=BozVORB`Xfi^%3!KkY+Ts!wHLi(j%47-rpzkE5%8%m7Zv{jA08kWM z?Sf%ThLUz5uF?5tv$_Mv^E7On7{FBh3!XOc)P2J*MgX#f^6~G+cT<>sVz>uv=2rke zt@OePT?reQV4 z2A{v%x$D`h!g{dI4eQ1eK`8M>hCu)WZ zqy0C~5*VSzt0?cqPBSkHcmcl3E27o|On!F^GbnEVesvS75V#<;l4 zu|XU?qB#D+-v{Jx|Cu{}_Oo-{H9x?786HUO(!)u6mN-v^+h*L?OiaIVr4p_!d_2GG zn6|sY2>Gu!J%Iu3VMTW(!{=F-x#%BvV&nA4Vmj-$g%4bl1e_m!(tyc))PW-U&0pX5 zYdYq^qso=w!(UDhjmuqf5csUJC%pG}FMU}lI!2b;{wS~K>ifUv{C z*gYtLvLb?U$b0)8i}>@6ASEZ&WWmhIs+u{|)JoZbf3G}AG^4h@n6nVuh>$ObL0N$Y z99WnXRrC$u8*YaT^{4%a0FUr8Hy<5Rp}yp_=CEhtUFxN7(Kc)_8|Zg`=f!lp5%^^~ zPHf(%f#B`(hHuKZYLPKnfr=l4fiUA%g?7UDbGDAjt5cwk32>Ls`;1Pyv)in^X*b)1#8@621wzW zi~6X<+5*JAxp{;8szkE(9xN|xY*6=H%q~Vq(p=2ch%jOy6wX&i7rs&TKIgL0{7X9%Eou3JlZ`k89IE z!L7XXItLUX8SZ1ez1lzdQ4TG~n*N^}x_SNn9v|1X0->|9@c2E!?s$KJOX}3SvJFJ( z8)lcEoph&i8DJe5qH3buOu`t1$Hw4#jU@20RD)jj+LD-9AqHE66D=wIpa%KvKa#8s zEP*2g7af72LbOFAyQLm?c33zc8_~apDF8ARmJdgVKuRg$J_LQxnAlhTX4^O4^}Eu; zz^|*xK8_{eEnGz57jKmBEe?iBJU}fuI6Vy`P=)UXL4*Zu+GJd74}zxxC@as`i8u)% zG)~0ga;}^2by<^t52_hYreCzyhKsx#{I#=kYYf+LTCYu%Kx4zd*Z{*Fvv{`41#5?9 z4$f-DHcmRT%yj&86rLbce!3>E6bdaHd;4y80)`4Q&>WJga8hqL((1`~rhAR@s_6l4 z%0{twRWqubIS`~RC@3890tsd%2v?uF4Qp+EkLRR^8ZX^FQ7-L~_`jKMJ$V>k^XA-B zNrJ*dZ)Z%)!D#i1rFE)KX+OybfYC0p?QYDIBdP$8u2v`K@6YzcY3k_yBf9;cNcLaZ zjphGoZWtN;O!GT-Cu8^_82yX;TbPTtqd<>@|j z+|TtHf3o&r>E|R?eL9`|&oS-A(9f$#&q#hMhZ8pE<9)bxXa3}Gj9eq#OCXVqKz;fV zshz9px?Jn*_5Gt-oE^b-1*1+&eM3?ii6X|_Jw$6NpT5G0w2&rGe+UN7RC4IJD zvuTd))mK&CU{&*d1klRHs_PZ1ivS_ zb8V))--@4ekuGAlx?Ue|sH-+GQBbpOagyIFsY)AZM)N~iiM^ilf>ErWfey)?pBI?Ajs6BZc zU)y9S!Gnxux2HYK)6gEavv_)rgiZ(_F5b8!_TT5>Lx!T5g343*PV1sZx6OxJn$m#A zAsX&)kLoX<)2@>)%^p|#lF@Cs9+JiSLSN!0J2ktg99&vG`)CX_k4)%SU(FkYQhF@{ zc74M91BRS5GGbSC(@oS^CnYzoCpJhBQ#6cGJzXAb9GLypKe4I57oWaPUsqNrUoMmD zS@b$OKfPaPmZK}f+v*8mg_3;9a19X#Dz0FJ=OeXOWatj|K&^w_)ohs>`EdAc0O=X> zU%aZj?N+%p6uGoB(c4LRBI#?mTYuRxs3=^#%HW??HAZv@lF=1$8DHe(vh!eBg@f&a znevmRhv`wjD2X!}VaJsNuzVK+${k_#%xcR_h;t-aWoW`rEE-QbJ^z<92 z2fKd@Kv7OYs8etbuq#``rRZs|<~=nz-)glj_>e&Ku^E7OP$k7sCI};V@}@)`v+Pl8 zjD8(@I&++_Pe%dI;s9`R@uQl69md4q&9|1uKBf6+`6>;E3s+CKa=D@o^l`|}7<mA~rl~YT|96 z0$1hc70if9OT!)J+*b{o85a1bvgk=XV`QViA%HXVGM72!cO8F7SzP`Xqt# zVFdfn6~$M8&rP&8jy{_i8q&H+p2b9vW_{l4uH1`I z!}Ki6MMj--UByMzp;m-kFlS$6iz1GEbZ{by0HUrt2%w5135H&O(+QwPB@igbh1z(I zRdYz&s{U{_mqUCI4H$-w55&jdStBIesmQ_hjI+d3BF9@|A)Q#xLyAM;MnuFeGJE{e z1b9V-3oPke>KL+*oTk@IyJ@!Dk(Ug4fg+3+K9_nnE83r)${wGX0XuDNXDK1} zwwi1e6?5{hs;tcl7gjx-ORh{UxoTj8F6x}>K70D&n_Ui_SBDd=QHv=CTCcqNC#&yN zq=C?JPFw>e?VFz?~0Q;~TAhk%I za8)|{c|H6l<>?8!x5&BiTPAEz2zkx1?X^!^Im@jqvf?u-5tGwuut2r<^M;0qo$lWR zT0$8WAv@iMQipXxe$2atF<6v&E1m4cF$aMS@4$b?uJ)7j8pgxcg~7FHqJ07ygN>q_ z;rvsgC_F5X97LSO^biyx9~DyD;YKY8n?874p)^5y3J9nlJtoYTKC;l@?*DzTp#S*lpbR#R66G_mahN=nN1~n9-(H!fIxTc6SgHaZd&K7wr7ow6W%0mG zTSHj5jB*AKtl9Cn_l}44v*+LA5oOEoB2QkEHbfE4RJ$%im*bd41Gmy(dz$nvA@>X* zaqp@<*rV2cS`NE?SONYeoN*S|VDXAvsOx!MS8p~aSf-bi-lrcNUbA8}SD zS5qN)YNI_rGwaGYTn`Q&7m`}ms4O?9Frzg@euH{vr8q)}SiJ4TwCZwOan+6Q!d1rt z?EVHPm{Pf+uFtuxx9(IA>qQungoA3dkci9ZNH{Yhj}c}VoC(ooqIg9jyGa$xc73Iq zY|Ab+hvUeRs63wyPp6W1r$*|jL^d7}pK^>onEo~uIuM?;tysq`EMFFaGG6#+5k4LO zK<>ga4Je+=|Ei~>>)Wmac)(tM+YT&?2nQu#F$R_he&L2oh4DzUp;v-t33C=9CBe_v zlS2mvXuk$MRJSpk!YK~Q_{H44pIR;+#-c)9sN2S))&^bLbt=@TgQZ|Pnu)&Z7Au9v zlx?3omS!y!59)>~N`bnxCJQjgfxW6FR0&qnY`7elo9JSp4YF&<@#-LgWUTBIh9q;0 zy8!GB5f?>VYbjno>l*F*&QFJG0||t(^ismT_;1}56>(LU?d6RLj?^hT=wvLqx&?gp z8!2j{_1mcYP34nPBT7_8)&&3r82#B3VFH-$`iqSgXo!l-GF1Qqel?KhE;C3h?M-rC z3@2iP{YI#7U<~2wg84;PpiIQKcu5_|K_bef`I1LM*`$F?s65r{KcY8a%Hx;=mC=P1 z32Jfv_nE*E6#A~|YqV`kJ_Cj-jQpp7PbsTB-!`*}+4K&?YBKJ6GJF#F8a6niwoiy2 z*fYIrIv%N)#-QzJ6Ap1|5kT&y+8L!K$LTcTj5sU#r6A2+IeKTyu5l8}GnEwRpl$&) zUimqOd<^taIWg=QGJTAVDeUSCStj5Cu$6Xo>&G zqJzY3i$@evYTZb#R_d)yGJzbW(bOSv%$$NK2Q+>(a@D1ymB=M|GHN0R2gu9YR1fz& zCWDSpQoL+@0e$tGtz-9IM&KN#2-hmwRdXCi);qY5k@-x4jPKy9<3Fsu%C7BvYHQX)@62o6ililzHh7yz!Be z6W*#U$PDi)E2&5lsLhhcxusvHmU|Q0Zo+1&E?+Bd{w0mNZ8%-(1PGTlD01|+vz{PM z`&VhtBFw7pXShxG)W6E0n8(+vlYg1SS1-X#gH$bVOA{X)%eC*W2KtK*ZXNQ#U3o$kg&42Uf&& z>s;cZK!FpIC0@h*y9I!LvrdwTkUK5>EJOh>81hy48PHgn`7hVLddTYEoTJHP@G}6# z>ls!u}cA>~ji zRY*+)sb+k_WFT4yJR8RqBdIyg9?)%uoQ2@(4YLg6o(ejMhso_&z@hxlwQx5 z6PUy@N;j1Xd%ea=`t3HnRBis&PG&nNaa>Z=R0WbfJPYfIbgzxSd-1JJU4U1jk1PF# zmk%oqk7d8AlK=XiD|)XK zy`8fA!@*k~jD8>Ezu);cU;4rRe=_ZV8!VXF8UFA2B_qRsDl8Zo{zndr8%^zh9YAP) z`TB$9BETLP4`fM{kNdZFfi#;W*>Imm=wUobyqi-?B1yb2&iY&VOTQiAB@((k%YSMc zCxHIVjA<3a&L4B`bbmvPWE5=tKKHV-MPusF^U+55M1SgMVL!ckH8Pd2W)D}zE%j>Z z(Qb)@NJNvITlzFbUUr;*>=A&@Sj=Ro;mFrEh^o|7cU-n+di-7#-;go}m=-s433U!b zpjvk6i=HHM=@-47vq+$#H9Gz+K)!~#pLMl%%1S-`1?XXeBz{Nrl_oC??G2-{>ldR) zUuWr0DaTbv#F%(o@N;g5Y)J-n$XeLpq@9sc?4!CUyT0~}Ro2!=$!HhtUqsS~I23=( z7yGb}Gm(YhA8V@TiflIvvs<=op3q87Bi$}e%S*?!Apg}PTPv!%-xp0TU*p*>Q&B&` z)hkpX9N=P50aG0>V4R27Cg)yEh za1Irb-@5+iPf^jO74iaS8ic$+%CqD5tqWy`AZh$xw+B~6Q&CsmXfq;$#}LozC)phn z2ld#do@wl2yP^FM_vtCD@yemdoPcYZE=sD1J5+{=+1F<|VYImr0obN8Sa#x$h{GOIv#F^sST zUSa;Y@f0*%xfl#k*kmMRyK~7u7&VdiWg=TZG95G1SU$Ez3%h!1A2SFBcC;e(*3UmH z2%zf9qG0n3SDC(xwu^O>{y!UyaQ7u>Q@})2PnTU=a`k`{4rD*9dtBZ7lQCxjP{F$9 zi;|5dIhb~FbzD~z<|RWc54W*`qL!^d4y)b3*JF@sNuX}h)4pDNdKe-=??sn~QwzE( zdpa55jlxH_M*9Qb%eK32%_D>atc!fj(Qa1p2htOmc!!5*jlRPZ^X^BynF(5`r#P!+tKI~VziqFZs}Nx%Pv83VUYs*d-EY5mmgMPss!I0YQ{BkEC!DaU@vee z0w!T8sG&J%34_XgJn?dcVJvVu3!WP}Ody`984C#&rvJ$It@Xk-%5*m1Z5m`hYt5U| z==dSQQEOi@e-ZmnAWMT=@6;Vn{E*~EY;k{^<)_js05!3K`FpD0&M&JlixZUw3Fbv# zZ`0We<;RneJB7a*GI`v@m~bKA41|D#Ki$lFHbjkwfD|;k8(ERK z9d#P}Xx+{O)ILnlQwonkjn<=NxlAkQ3dL_jNfa^)&|)+Koh3jcmP1fU%CsiNn}AHf zo|AT=$KM4GGa!9K5D1urnmyToek>hhPzuydi4vZg6M|~rSHw?8qx-PU?E*4M`qt$w z7V5c6@-wHvY;ySa^Fv~+j?F*Bk&a+)=J~_ijXouI0jEh;q7J1ABmwskmGU zJL5CIB1kKTS4M61xh4JQ4WC2`h4U6H^G3uUk0~vgO7_xo=s!1>LwPy1;ed4n{K>;E zUNoVvrl5a^5d6>x{Pu_bX@SeHz-~t4YtI(SDEa7){oI-GBK6|j1sDmUWfa-7h*`+} zU_pLtqne6tvJRI{<0uW3!e1Na!8*u<*V~vwCnevlP)l|Bc7+66abjJ+TI@|z=}V0& zGTvrAPK!gl6yV8nGdgP+DgcyshRk*)1jw(Dab!CG*etKjj>cql#(31{iPHAqxzgGu zo~XLx*=FsX*;b7(v53GcxpCce-u&?}Q=&1^%4Z!LPLr7tFl19f7+`BhcICIb({A_F z#Pq&q;KwX0TufLt^y)DS-W7d9pr;%~RDw~G8Af+g{aWmRazp03Rx??m|09MHaS7EK zvzz+19IKRC=+aIdy1DrhPG1fx zQ*h(NWfWYJABK5Aj}85Hf7^qWm&s=J6BfkEj5EpV7l9fFEUYZ{CUG#AQJr+_d@T#{0yybD@rWT+S*dAAVZ?o1mYlrsV z^G{{fTRvbNdW)%#bk4Vv3=t2~9Nb)zt-5M|jg`224v2D$KSCU}s_8@fFaZ6?HL4D zo&RRT@`<5gRZyethH|B z(Mhoq?V3HAy@&x|BKHGqu5{UA7y)*sQ_kST43iqA(a8uqAg}q_E)?7wpsw3p$m{>q zpObE;oUH4%QmCy9>Zv3Ynp4ypZ4c-n(U?vIonTU_b!^zwmD9rvO~r`5X|QF9d^14O zfdTyfaZgsJDdhO;53pC3Ee1Tyz>eTWjU>L?x?l5hE(icZcpD~Fl5NP=jM1E+kltE2 z*W<0Rt~zZH+Gn5am~YQ^PUcNg2RWMaD}QvU#|?2mxgHX{PV;zqFUzJeU2Zm~h!;)# z7a~5AqY1GvLu`8~gp?`B&h>SHA`E3~8$g@FNV(3VJLqU3@vRS5Q?#SE5qP8chfQ(l}nt0Hjk+gMPMPMD0y^ zj23N_iT<|5d(%I%be~Y2Wi##5DN)w4q)u$m-hr`q!{m=z_LVoYlo3u89dUh7^kH3I zm}CMgY?eIfN(X?-%5Vhl-Dd#R6A%tYIz8YnSlAO7B-+prpZ-~_BXDW8YH`s-ia*mI z_9=5)CGS4j^m8(LHG_V^cGu2Tb$wmGwM0y|68c^}r@v4DN^qhe_pPK@Ca&4+8#2K5 z_Rn8astvPIYrzznG%iR2)|1*Gbm*FGQv`%*(@lDoGq8PSb_%(y-LhLx%|S2$)nqYmXXP28*pJ6|?3hELrmNJ$rN?Scq(r`CF^ z8<#M)%_=AGR5G;l6($-aPAFKRzUkP#J?DeGGk(BNh#r)2!wZAhc_HdX^;Ki%R6ipi zz9>5w&Y1ZE=X3fvlbwuDhFEn8CE8gnyEh-LPz^tAv6~N8pn7Mh1_)K3*s- zuv^_~2`XSGCDQ)XfD#{jSrrv%1>U*#XUpa0*nk*>Nzq$uKyq5sIs_Wae*jZTcaP<_ zTThbMeBi1rw8x^W)pcx_FeT8BZBS8+OPWs{6*y1?Y$g9}gcH zd5axCDz;j1rI7g8ylMv?L(V`e>nwJR;t%4g{8sMBS)#{cL1SLk!K9Gw`fmJ!Stdo9ru(1SXf$eREc-6;J`t@2W;!24l?lTC5u>qPBn&E%gECl%4~;JJwpw;3}c zT{%J=qjLMf6z@fJaHsvD3%1tmW?PQH6UoC0Lh$-9E*(s&W8vV}#9D)}$w)vhMVu^8 z4O80E>#@8SuhIuT(1w4LM z{C9CqG;(1%5({gA#uOLF3N6rMT*)txGaB=XU=Jt9)xp2-O*NM&VbKn|{4^Hez9Rt? zOd?l9L%TDuJJEmy#6QK4Xf3*0J`Zk;L)y6B2Z^5tkA$Ir`)JzLnBlDr)HKmJV346k z-En>WARcxh7f1cFI26kztqyMi3t%r0sRK@?RudkBD?gtmp3Yz(PcYa->rL4#{x5D(t2nd!?2r)0MGB?A_^Y*!Y@^}dT0?SpwYZ%Ur#i@78n z!yqGyE0W&IKqVR?^+lPF0R~H8eK}hCsFbIO1{o0FbvJP0Z`i^?oYTlYKCF)*B)PYc z=nozK$-|cWfDCdm#!G@*(?F%BiL90x`=xh{W!NiP)=&h>IxJI>BC{dxui+2@QR&$r z+rK|DLYDZMzUMr#SJQF^kO;25B%L?Nfu4D&S~%`l0Y+y0yO*ectnCG$U(7$`W6)!hWW4ESObc1Fu>IrXa zyYEAB8~^qQVEVks<@iJc8nB&N7rbL=+LK*dP~Vsegl&0Ehr(zVWsmEAjh z|K1gm2`jYWo=3H~tlT5JZ8q!EJ;lRj3~h~H=6`??x|Q>+`-ZM}sEc(l2PNZN(}JiX zb~b!Eym|6qDB_TPFM&gJPqyCZ>rbKQ`DfDeb#?gsJTIKDU=l|P&ChDO?QOiI+4uTr z`n*1#Jy>T+mX-zhsDf;?%*ok*rIf zhScMmh;Hb}K6vhDal`Ww9VCdYhD#%a3n6OU>f?SXd?4f$w8j%rVKlW(U-R{q(Ib0f z)7<~2Z8LHh+KS`{AK$No$mWhtxDh{%i23ZpFg>%PJ=-P9pzZj@yboM7N6re5{`5F}xqmwUxMm`i9;$2u zU}Zp#aH&-Wksv;XV~i^;`yvuZ80-$%A`&>Qi~J^1;VM&cMGwJ<4A)nm)Z?x`_3g1gm$oJ%CqiTmke_01}PQJqcb*)Eh)K4ruAb= z5)C2d)st|*?b^E;9EF9HeoAN8U?7HEckYt-I0hC$o-0RJyE;v}YP#zl6X8;?c^L6K zNDf;NEMz%N?ULBol(hHy=o?7);$Ys@za6PS6kk;9@h~ZRMAocTrU4B^J3Kl-3%X8! z-h0IDBHxzkjbAM>)KEzX)rA9jpg`$0&72dDQb=`SGrQ+Vuc;@}U?kRa!u?)Qhuvp9v)v^brL&n=ig- z^SECZ`zNpu=CF@`G*+)bKScyK1yvMWa%~S0yJ)TMSoO>+x5cnDC*`mBmZ{df#e4d5us;T5; z1vgIIs6#!sE{S?%_NkePACNhoy}45+ye8v=dlHPtfq*gw;{@Y>Gpl)xL~{9Yy0v)q z4y)`0>OYhuVmhJPClH0y4g9pB zQ>zv%9k5yE)9f$xec(EqC8kAC!;PNeq%l1s}x`xuV8D(RP z&1B|1JiAH*baaDyn3#aw60(`2%gnA;wgLDNKT+o#t`BAC7d9A#(&8OyhfGtZ8}_6& zh?pC;m*RF3(u@_`)(Uzz@S+%0Pp3sy=LUwEC|1?_{PJU>zY9&y@0gz2I<-u z=Ma=+=D5-ZfDwxmp0<~|7rVrZ!rASu-(n~5K$aAOPFMIEavwwXWV|f)b!m&( zeFgOpVV{A@M^ns`?NR(UT{W{llC^i?C|i|u0ZZ8F!IO<1Z!!iMO5+GeVk2zVWsmLJPqV<_aTnu=hVz3{TH;arP{Gs&Eb9U)UBfSpilqh@sV# z2n9_Hb?%fHUQ!HN;n+LWW)tF~G?Wzu`VvtY;y>FbH&W)n!F?g7QUXKqO@eJ3L3{NW zdaD$LdPcE5W4WzhCb!b)w@C2^!80oM+yEh`ah?jky%i8%&?i=YYxz_&qc`HaM(N%P zyXi)E8(`fo8LVqp1tqsLmO(ELRsI;SUe=@^znrPQeb(^6CTKp@;GIWQOY>=Ch>oP%yNKve@dld9zi-kcp=gN<@1II!c#3yP4(J-}~TH0{){P zgSz9;2AUZ-X=d`;Y|5*061@{ha9&qZ89UvM1GL z$B{rFN{aMUjXZyx%3I~35cW-K!&@u`eVz=_z!;euWQdpx(F0UNi$sg(-XiFnQ$}1Q z*Wvs25=DfcMy#+J4&@p89(sNQLj|-KMFuMC-j?mpv_WB?mazwD2>1Lk&T+)I9uKRZ zq1cFZ&3w~%DH!<^pu&uYYck_W^=$kPEI&j}Sb1ZQ^l1=n+Z`f8xf@bjeu$oYdu!;% zdS@CWIviy`u2fZLrxuZAEf1qq;cY!AqoO(`x-lQZbQ4Im30VpNINCmuqE@=l6Lz_^*I2kH>ECUQBjq0~gBo1L#RM zUFq{l3a@{Q=lVR1sfCLMxM`d)4DGB2&_t}Z5(z@I{*~5l^RT;!zbw`+4$^vb=6zNt z`k7`uKV2J}DzoABdkR-=@}ws!>AH=V1u8zP(U8CK84kn`u*By@120cTVm)WMDhSU6 zGN(J9ScltYJ^Gta(;e@^VBZT^4zVF3Nz-(bttB>m^+6fiSc=iksTfwJ#i#4g(T!h4 z_?{%z$ugDG8v+Ua19gZmm01g;K+HyZw7H~H*`sSl1mauT*QTfd`ap<%ocGi-^6#AE z?Sc|Oe!tgsF_QWaJX%fkMSA+S84ZMh-JgHp9P?G%E{97gPY`s}3=i(A=_m0!s{*K^ z`01VQH|&Q{Js;U_@?!F{g-$XcnbF`5mt2vj`hZQ~r*+{T*mhSmNeN;T{jCA3#%jDq z$lgOl^V%-ZWM7@@EPbVOYp4*DNaa^6;?vBC=$F)2ADMbm==T+RQmB5nKbd-!JFpXf zvTTX{P`O+`vEp3EY8lSPd9WX>YlJ{q_SI1zp?Dv~Xfb0`18AIxc6<1RrtWdDoQ*zT+9%Gjcj%Dy{cM|D$} z;{k?aOdwMqsS;hRqTgi!nNl1)kt}6-C+IDoJ zI0%fZ#+tyJ6B4)Kx4_<1h`3jNmQ}!*Etm?1Af8LBUI5))C>U3UluITGLb_#r1<`6& z1tV37@_O$xc>qBq+o%P!3BTah1jj2yUYLt!f&`5~z+_hJ&AHdbV%CohbWtZ`NqJ34 zdl@39EXGjo9B%V=DJ$8nSCa1he6gMbXIXWZ@2yPAHa0=`dnx;VgM}LJeJ~u8S>N`~ zmI0X5En8ifF| zO1M;*02UfXd(VDM$BHg^}hlg}y+J_@$*GHe@p3#20q{h?9Hgtm@TuC7wf9mTFd8Rg7V zzB1H#b^Y00t*EqoOoX&Dvl<^>#+Qn%v?Dp{pF&xRwoOQ)#w=Zko~ZQjWgT3`G+?|@ z&0xW;)5JuGCi|u4Emj1Osy&8mN6l9-*^kT$xm#=67gUj{K7-8^#4T3DFp6G%G{T~u33Ex99W+s;Fc_gmgEgcfAl z9$`gn4W8cWd<|))?}bw%*r{C7PDhB9xl(5VM%e7DDkJO3#+vMy3Fgm`Wh6r z^@|`*w@!c_$B-p;L`;PaKgN&*CLY)XR)|lTSN~YAWMU0zL`Xk}N8f6_ay()@;c3K?yhH2GYoUJLgGUfW{>P7afDwh~I}q;B~vy{~%_*eHrb2z@pE$ ztr>7$v|4a$E0RT~26Aa&J*h2&rm@wq7eG%ixa8()?HyX0FI7qKJt#|ayIc3lWU?&) ztM(_OOt&oBTe}(wvH0unBLUqG6+(*DJe&95SCr9=TO!IeKZM}m?(-5>9~gcYnl}2A zLjP*g&@11ZEC}`+RWS)*08=3@P^E@%_Dw&mh?Ng$OVigMPg$S)XVyIj6rSps%|os~ zQ*vPSu+EvqD1}lm5}dUk#bL#DUYWaP#9={feVeW5=n6Y5_id=H>uCqEI4QRJrQh$P zJD-#CKMnq7J2##DDj46ugAayp{rva=aXrcEv~UkVyX!tt{t5v<$n88gB~J!kx0zC*ccQ~p35rR4#={ZChU29sJ$b_QmaHYp$t72? zciwx^2nS$i>`S?SLh^n=PxFI-~kb(&;WsgfFuaJ$`TMt6!YM*^-uj;WGgh2&Rh9=#CFoAW!qJ6$R86O5bL?WsZ(O`%zz2qhI!~i zxS*z;OVM=6o^tn8SBm)k-(Zw_I|niMG@`mBQcukJX}|f1F}1of`-L`Nv|R$3q-JOF z27`~_|GwnCpz@GpEFt_*tl)09TzyySd`t7L$Y-4^*ZP5}rhIym)iG#&y0OhNXOh_i zzMh%SwI4sPuwBaeHdS|UR=5tL^%0iM3TY~=}m*rnP z2fWLM!e7biO=k*4W0$46M=ZX=C zEU3Cyu>3Kr7z+A5$HV-Ax$?no+PJPpy~LJp;cNTIl%=fz*K(ZhK+7-fxVO38-Bg>d z$Ti#^uhx1vt*XE^%7eT>Ii1d?rewQewnaHe;i=mm+-p~p35{a+2Y$m%mwvLk`S-eT zydiqIN)8XXXdvb4)HcPNwzW#4r=2R5#QCK~)$ZlkV)m*_f2bBbRm!9+%~S|L8bU1P zd}zxaaI; zJ1b*;^Jt?qtWyUZ8+#Gn9&C*^qv^csgaa;={TWTBkzliEl3A#pfDO(r({>DKz0lee=H2k` z3S#2a4+1p;12~AyLUSdf?w;b!D*1hkHh3 z&*x&HI2~;mdXOO5;rSlSTvAl&4izapUSJh9Y9>r-Msc0KmYb>0IuZy#;~E$ta}-!z zB{(< zFirt?*AuFa+(oF&gVzJ6Sh;e88HcK;UW7I3&@6IVTd`gI8kd4;j&ulXq{;s@ReHkK z&8CZgFOfptj8oW`QZ~ZphX7c3O!Q?Fx!P&y`8e&8K5D=IMxp^B58Ps1IWvs{M)BiX z;kFC|Pr$pPL$+oWDrqL0n3-=RhxqFDs{CGk7m_tYT^;4~Lo(I5Jm4hsT5DqHV~sz? zLzMwvD`j!h;K8K5e%zNAD@u+oj-q307Z&e3ef^q0Sl(A`LUB;%!lfD9=*Qmp6Oa1#|J|KZ@)e|fqH*LLa#ZWu??1Ls_gt$xNwpqEe$c(BVFVZ z=+^mT{q%8&CeRUtT#3Bg#T=Mwj)=z6M2d7Thr4+NF#Yldhl^=vQpJ^~yY@f9K|e3A zz3#%<=5%)7PS#a-znRUo3Y`SF&DqxBlLjIStpG(;mTD-xiOEbLQ(mw?$zfP6+< zQmd|^&oX75iwfp{15KvNcQ-2A0+afMekH}lJUql9)7<3>xiwSDL#$*-C(9>vCRQQ_ zeuTl>q=3N|LfbVyI;SeEZiD|90ACF#PgwYGQ%r|F;?~T0keBS;}{43>N`R;J$yiXE5gHv851& z=NHJ`-LwRsPPgAwg=+n~ue_ftUx%>W>8Td1x~i8QE3T-t-sXH*<=!=CZ3}_#H-zN9 z!keQ{X1Yi=EQ4>34>PjDc0I)#!^J3v&YgwMLRmEUr^W14-^NDSfZ8h{sSF>Tq-(3! zQ`KKTmR1o~Z~j7ft<-wfuOhcyyE6``Ex>&&g9cN@hOck0!oubfGD7-e;Aw|c!JoYG zzO#Hz@%ma2w}z{K01taHAQ&->i%RfFw@KJ@0QbHL&SOQBhA?)gk#KNCj&L3w zm(&5Iwq1Bc+O*}xoDt8g5CcLC13A>vEHYv%XvbE{R(&WGy z8isN^H_Nhv*?q}emNswcjq?L!W4K+oe*YH*Eg;|KRlT%mKT6Xo_V)v^Sy}#XTm4?o+CB^&Fr3`Rrdjv@U#&H(Un6jW4zvtvt ztMT+WXtaEW!tiML@p6lRc@mV(LHMKfvJW@^MsRI;5_y_H2?}^U0TyWh@Q|@uyNJ4L z<3cQLZOd|7-z~_X3NIZa=S=DPB`|8T7i6&EA#XZ?M7zV?Z)C6@_i>B_eyVf0H)I)> zQvWvmp1jdad{f#E3S&){Q0!6ALzb&bE}=w;%k@b2#Rij{XBY^tWoH7`hX$$ZuV%ocjc1F&Riyc*7a00M;pH1y@&T{|hmx6L`-K>y zB0~!fls*S{k6?A?AV|P6eB9%>l$TCNno19x-nIhTp0DANq|L&|m5W35L?SH5#|9^Ud ziIwGlY;KH9|AC%h`d`r#%bK$Gn;b~pAL_Ts<&bQ|eiA52PaxZCu<`vP2eMf0tHA=- zsaxw;sa%OR@^$Hpdggu;pQF`8!wAhAc;>;H27AG_kyL2>aiJ)9Ej8*88V24EwWR3UUE zG3oROiO1!ZorcXrEA-oE^Fd?f6U{Bg=_)KIm>D~`BTy>ugE3Mg0H1#vUsU<}xf>8t2W|9DvfXqM|HPfAy zFG9*JQp%MJw-M51F5_`sdApXcIn|@EF5ZkUjvu_fVE54AeeFi1gkMx`MB*{t60=FJ zs&2AdI!Ohj8!cgxyK#o92^SfRgbl?wRK`n$GfJ|}ShhPU7TJqaU4|@^TS$qs(E*4> z>%_^cDGCRuldLJHDsnIn|Cme+0X)NaC2jE&KxOS%?LkBPfGKfI-uzyYyZP;GSym;! z*Mi&O^qQ?)W@V3_?ts5;f`f0XE4u(yzk(879E}yw)Xs>GwwvmXaLB(% zoXICyby~@-^qY=nvvMxuW0z+fG=U6JQLD^YJLd^o=s>1zhS-}j_%b|VboZE`?WOhNZc$4TLIp^pj+wC(XW z{2uK_2VS2l2!iFT8^(4Z1yoAi*0u;SnA1!n6znu zDUiTWY9jGYpNKf1ag|Q>P8mJmE!lD~j%n@G$BmS6SaInG^PO0Q4_FhW)|J5LQ#77d zRRIznZaF*6y_?rYN;Qp#ixCej<#vQ~r~vV=#aEZ#n_a1U$DMtp(ugDoVZqsP%u zQ9<`K@Mf^qcz+QxQbl4QaTj-EE?t)2X97?nhxF*;U*6LWO#B$dvCh#fhtO|5mEfp5 zE+L&{Zfo(f!6%I7jL~YRPR3tf+l!Fs^80uvX=44Is@oat_u>RTbWu%nFYs5+Jf#Xi zKVK(&G6cJgME{(E$1vM6K+L{U-|u5jzHakgf{qA|I#d+%X`iwaj-0(-hSEBjgIw_48}SDXEgEHq~|O8$f)XwesJ{)Zvm#7_>d4^W%s?$2Q}6CA?OGZfEFQ6!}Ya&(g)!Rn%P7W?D{Lm|bAvZkd5 z2gX6`hxqm_FO?A&dMVdV&Y3fIR>M4YS-qkHJRv1n=C*#jtF`4m=a|OqAPt^!U-ok;7Gta zf|@h){PjL_+R;!yEp%YeC&5t8-r6*Kp@Bo$zZL!5p%*|CIfkA>Jk!upd%16DSurMb zzJAweQ{}@oA&>{I5x;wz1<)A6u=2+f1TvD5n87b}8-^j%iT57MHHGVF>=|-Q6n%_D z#@b5lTqW>dfz0tHZ2@L$Lt4j8bpAeB$kkT z(K9T9;I(+jnpz?2SF4Xtu_7sE99d`NFP_20L&de~?8vL?vPs>snH27mSx6lO<}Cn! zqDS@lL)9@Fs)P5d{Zf&%ObEYw<#R9RK$il8^*SZ5k555(qDFe&2H~k#z*L?z_ilOk za_*|U@~ABwRHA!-PX$_JA$2`FVJY4k}g?{EyWE}dB zG>R0zz%?w2_BVJYYI4$)ZjI)2$LLo$D|NVBpN@V1(8OCpWxIT}4B8SH9YQE;lio7vaV8HRyZQrE0PIk`yy(45K;VbRIu;dsxnYR*` z?^Sor4`ul7dmxd9cND1rsKpLWjmr-_OXzQQ?PIs6oXe$#xE!G@y&3&g z2Y52R|0xMCxE3PgKj;!ZWE!mzd3^ze3+|34XnV$KFaN^mFa(WzWHt$VE-$*lay?K- z%|w-Lvbj2fa&Z@JV8{{F*l@>69uwNqeIm4Y^CE9Bz6gAm)Q6EsF}Vd#IsR$_|1jVs zmAX|=>rPSYS7ThCu>dZiWh`+BMASUjS!==!Bn|IHzGi2|>H0;@rcK{h3nsmEpBwPB zcocm_{CwId)sVfnOyH6%KY^{xiR$WRkAZQ{b%skaLr;pJM9QD{vBu==_yBU^$(pTq z;#{G%K0$AKjyQp%U7YY5CScUVOek`2p}T))HRb(V-RSLu4tZVNjgeF^3Lb*iigs~s z`LLtf`RHXg<7n$wus5s$D1rontZp7pE#+4F;l}Nh8iB$4Em*VB%$A4jAc1~&B_wfEgLV7e@n(ocXE;@Vlg5&YIv|BV8_LU1$IIBH2SxL5)7xNluH|&hHOMiJ-Znbv^ZWTLv3QRuo(i2MJ4Fkg2xjZWO19T?mQwR8V;;If%Fgm zhro3BUHkrrlJ$QO7&eywI|gO`4+sqN{|bSb*3ymJXhZe=2mH2LL@}n}BaxPl3A0HC zqHJBdtV~Z9YdF}fsaZ?MlEg9lZmnF(ul=lgzmaMhm%+7Ypa{krkR+sqpX7SeapM0f z%4YaH_|d(r!O+zA?b?4X8~SNnO|U;vXZEq~X?s5o$HAXcSHC8fa}vB~A${0VUEtA~ z{Q(Z{^Ujp2h(_5?r>{-)Qe(I6)!aX@_nY$r%b3@(yxQKgluH>K`}9chk%&TAIrR3) z0tA`SINvaQJbrQC=Tsn=MbFL-l^7CS_rA&!wsTz4Fwx#xGbK&%ylv0n}rgRi^p?Vv#_~gQ1 zCOPrRCT#_>8p4`Ya^Um?mS~bpMnb@E6U3MO7=uXlUW!@EA+n~4+ z6;K#^?zLi%P+y8XJttiL8&qa)!5i6I!R)Qu@lBRTFlP1O+;E(*{7E7cM<$~B9F!Rj zkNW`D@*xFF00IT-uVH^GBpH=mOXX-U0u$KhC{W%FxdkHKFw>=-dM@Mj@t(-Z0E&RY z6>u`SdOj+Azhr}6ag~B7sW=X_3xak`g(-U!M*`}sG+k5V)<{tPlbz%E&utqy@NhS3 zrk*&Gut4)(S;1{&kT7X=bQ^jY#ZCV?QwtQcmI+RjqOloKyKcR9HOuy?^lZ>n*Q<3g~XhNPCSP|TK z57@?k^*xDV5f*8-_hHmBMoTFpG^bY@mLWoML^+1J(Qz0h^ zu+F1~AiM{(5t;#2cek%XF&*IP7!S{Fxjchf)8f&YVFl)ECWX~%9nl%u%V zNMY>*JM_(5b;Cw3KzIu}dKf!&8VZ#@2Nqr~-)T>!Z zHe`v-U_ra4{^6v(O!^kD(p1bo^s_k`Sww3W|I@C?r*mMX@O!eQw!fCprf(BoGlSPjr?SwAJCPVr-3Ub9G9R2isA)G0nPj z+{@dxv&PX^v5r5ECGA4zM4xX6zg>p0Scu2=G28zzTS$-*baq$0OTR*Ba5@mVi@a`J z{EPL;z_H4rIrh_5Vj4q(X((ZiE%$(?6-$9rIA_bV1c{z*Jq0-M35e z-o>edJkibEHi!f6s#H+HtyO^4jpYr7rlpk6v9MkxM7xlDdDe15$>3>cEeeA`i2#Rk zT%V#{;o}(>(dpe*- z$zL6kNFOYTpD4pnsf;PW*Hm-PobWm{Qpzn2Sr#O9vA~&5JvsD-KgSs$pz-Vx3iRxf zbzG;L*l|`scx_mK;bZ-mB1ZuU;0HQ;?w?{C+zBM=vz+oJ3XGfSo8iedtFK89jGuGh zK=}A8{9wa)J8?|Whv)e8GGsx9LjLSw3cQi9isfW?aw)xyDA@cxxpj{DNGR-y;V!uq zZh*l^J#zVN3|+<#)?K_{E@Y@84m0=`Zmpf@w;078jDBIMKZhhxEC_Cb&r z;Yxs);!w(ywDrkno3fkk)2N5%`-1`O+{Fi;Q zL_`wKOvm{mt{?>$ioQrZOPOaj>aYn)N9JC#Qv}m~}0$swb7(nIBgbAr%xoALV zcWit=*-zb->Eo)@YCm$G=Ulo-NGGl>g5SazLzrC@$haT5JdN=Ln~H{)J!uz5Vj`L< z*L4y961%sSq@09OIp;t2G#PqA-ROm%v>+Cb%A$H8cJNaDtLhf>4NE71931v4HMOHM z>~D*sxRsr0fh^4?VWo^=xUkq9a)*Pih-@4HYn{8vC_cRG;K)GZ-e3VgoG)X89Rw1` zmr+IsVRX@+kESxhiTi$kq%=U&D^QIR>Tws2lI^7?yDdcXPa4iN?{&ahPz??Kf#&lU zaj`m2Ev&SOTI1AL6Ep1s`2+vJR;_5et*pVa z8Z|#jkq;=V}GD~!y>xQIP{8i;vnc(_N zHewL^A2k+F%o!&p_jF{hpnq7(93uI&qYNXiyo%w0vOmiWn`s@^_Z&mBZRlrW z;$6tGNZ3X6Dl;Y8h6F!QQ-Wp8TN}22oIRL$J>dxM|M_6f?zv9CpM>ac{X_iL>$LeT@Q7o-I!eF}RIU`eDuHN4+*caCPwHJsi1y z`%dB^++XrS=htm>a6Sg?YCb??onyoUuQ}iCo&}}j3B^Ja`Fwp}U9m!PV5t9s6Hhzf zEmXrv%0YDGFFIf^>j2Z@khpJ!o<%w^x|68HEPC{-wdi5&5R&{ zALZ?|>OQ;Ed+>3FFLya|6a59zYc+6(dp!Jm?@<(Q0j20CKL6DV_7;RCMLyqIRr7HC zcf~17C6(fcE~`^g8n<$L(%LFcaNKKG8}Rcp!Gl41Uwt8WV6V70%BWLDIvTxSUMI{d zeH+9zTnj6l{Q%rti>5%D>(0RQegRyuFVw%-KpRBGl+G+U+6pv9(KusNT$W$a39LNG zInuh^7kUF(QQp~3PGJZrXu)Xr4q7*%=PJc>lp&d+>RU=Nl@&M4MM(lNTUH1A2MxmX zLgTG*45ugS+YKD_j5*GS=hq4N-{;uH!lBL6BerK#{LqC?^^CTHE#*H8X9?ZcA++Fc zZoR*5zdjbD`FJ(h5q;b|J5@>KQMwWnO+~VG2})EB&_oFV1K5CKj17RzmHasW@pC6IJSFGMNQqJcR(|Kr z!KU-<)%**^DA>_^+(&z-#?h(G(^piwe8NY4r+~hlI`-FJw^pyu(m8~dGV0EV{Gh@h z=caBA)30T(4}?{)ZRK=ERVNSQPJPp@(u?pjpIUr=zoJcenOz|&(;dRDzC`GzZaveR z#``ZU-?AODh9M&K=bTL*-w$YCZPzqaKpuX*bide8^{XtICifI&)u9*bI)i2I=SGgM zLpQUJ1)2?1>C)=!C-l>v0TCmu^S)0Xm&OXfU9(Y~{`>XHnuQgewQ@ydmxo^C*-?Gv z!z)hi16Wt5MY$0$@~i0Nl!4`IPKN!*5any3_NV9TA>^k$@_fE1%Y zJMX69tB$M$UMu4%yo`*%(V43MX@I*K|9uc+FcNt@bU+30Q6Rz2bU?M!j_GH{Zj$LFWF+J>F_(%U zxM9u}KA$oadR=16e*8-Z5m;$h{^^{PrcB<~Ge|FZs<``_q^Sy-glMVYAe)h4++Ec9 z5WFL{s?br~-ou#_cRqZ&4EbBz!^Y$o#Cd5J|f%4)PjMp%R=qzx#3MUR5fo3lKrRF>ZuPeD78vpi_HvYzoj(9$?RQ#PX{_l!iQ78mm&;$ICVVab6C@12{feEVT z$`b*CJg2+^1d;Fz)TZ-FcaeH@PE~xh3Fv)yL{|r?ADBLRWFiz5M|F7Rc6B6`1bdwH zvF^@Wg(*-poH^=qlLbYs-b+u&@k=#!G$o!*D`L-j(&uqa1Bo23S4 zGsxz=F!F7+d%*sLSYM(*g}Tg#g3Mp-7hX3VadGSJd;##hmhx&Ul7PyL;S$dyT09`z z))=VnFH>x>4O$62FTL7jXGVX?E=y|9G8__uRaKf<`$S{VDk&_tv=-SEYQVX^%;8MA zAUATLv^@%BRzeN(T-9AEsDEHfD74yNbX#Ji5xWdooit_21soQ5#O_5QRq<%q^iLZ= z_Y*U{K&=eteOk z7yJD6z5(d%xsL!@19)SbY-4};WFac$2Pf_(2C^Z9BkCZIf}H$8Gcr>s*Eu~`%vz5* z*`2Am=~(}}EiABAwSfe_AUrPbqV20@Xv`vT2Lz-2SRrJ_f5WhV=oiwZ4ECyM53Hr& zu?LkrSvBO^-=TpQGY`YzJ(FLnweJkk92mQna(u$ zXaVPvEhvCBj0@Ca1)QV{*C9t&{&&2_H8Gw8e3m1wL28CfVJz!r_t35E{ zQa%t~CZY59G%Nlt_W8>wJwdDjJ2ZifKeZ^EUM4u3K<2;k!C%3MW&q#7+!+UqJo0V; zLNeHI*1(Fs&{(tdkVpx-d8-7i;|@i9;YxlbPOCD*fvrN8DiJ}n!SOBjd6HZ{Aku8P zE0f$9sx1X%8xNNx1qc;Y95fm(!f}1p0~Qu?>q47lJ*%6Y^fL>Wn$rY@P1d0P8bn26 zHF?>fD=mU^do;1M(zWu8d7OvrO{NcBx5Zk{m=(|QhCKjDH#E)N7L#+T^-ds0;o^Ge zi?!~)!UTVw?t2Atvv0FFxvI7+_pRIu9YtzVNAs`w?1?X$R9LB_hT*2ZN0rqn&}vZI zi?^C>{)|>$?AkQI<;8YHg^+~!mgIF9*O80hL5yf<2{mu^I%nTZd^B*PfM+saIm{8b zlLSb_erzh;^V4jO9r6JW!6_|lrQsQlOlIEvuq-Z2v$0&WVPwFni0fJ+Qky*T^#=5M!L0*JYN6 zzv~PTQA3X9&MC6dC08RZ;BEc?URM6KM1W?lIg3-^5ovP3h*>yAqduOMny$PQD-V#6qgylW}PA^RDe`^rQCZpgOOZ(~YYs^AUYK3NC_1)U_n!RJxQq6VhW5|E zu4%44sa6^WBsrGWOy(oo*szRVzW(j+i?*I%ulI$dmJhF-EA}OD$ z-*Vg=6s#)_UrQ!C67zifbx2+?3MdnJ9~QJ-vfXXAU%U>Ciq zMgg#hDifC;qe?WnIc zE6xyqBOwbVYITxUrloz55|EWwJ|7NNBuxB&jJ@NQW?{Ew`-W}XwjCMHux;D6ZQHhO z+qP{pBeHVWscQSQR^N|(6Kl=!%+dSw#Jo z|9`PkW-exq{~qW616IoVKf+2+{?9o7MB`~Pr);7B3}W7_tvf!aIGKv(QAjJE20iRg zT8Q;u<9zz#tk#LrV_Zku9>7e@xly`8GC5rA*X_S?-u8$ikvzHhee9>&)r_ix|LZ3D zau4~dXfvU1&5Q=OrFOR0o#bKQ^K!adB*It(T5z?iNz|=P`!5K2fCKe`HX5*4HHTT0 z>x%2Qd(*&}UbliPcrF>U+GKQr5INV>_~(zcLjxs!>aiKF%oFj%;&imc%Tin2xSWZX zmhHnwfDcuA_$J3s8C{0Yxk@|by-nj`$F6uGbWd8EnsIl<1j32>SQip8l0oJda^8c8 z_&;TbOe3$!>w)kc2P8t|axW;&zPWl~7v5Fwb}~pu^;N2}&ey|dYaNI2^|;EK8r#Q7 zif$IUGJ`Bj#{6_{5`}VxhiDo2^c%OA-+$^+P!XEx&Y3B5# znKzF$=eD8O0P8NtrcT;66RnlaP8#wB-Q;S@rKRhs%br)8gmK~$+d?4;J_SB_d-fxY zGv!pW4!51P(QMo?wS*@}Mgd7Do=XibuF&J#m)?s{Q}1^U8KuWMTV^$ICg4~n-z}Nz z{69gC)wY)d*NE1(ZIHsy7IIDIug6Vu;!PM6rkE3IdNOe&QKWJvNO=^v!h-!%$z6b3 zvnzpQadNY%O~*fuslT`| z2RfV+qz`RM8c9(Y2O>`;3Lw1gW*C@i`X?=j%k>6CvZi1GKqtazVMDG{m!Z-|d4h*% zwuHvosa@-Je~b~|_NBP|;OJwx6dHg;NZ8mY$qUDdoa zyVvAObaam+lCI2Z?5TC2Zjz{Xhkv+`&b6-~`SE6QZc86$&`WY`y0|hR+(Dy?kVR#b zloW-x5Ul;QZTsW$orZY>3d-Qb@5}Te24q1|@ifX?rhmwra>`&VLc#*z_P)2io1%vqQsZ?;y* zaF9TvZo-pd2^uR7KVJ}oe92UNbA0XKBD1 zt0CN*K`O7p05PUCk92y*j)*11{Kaa4?iPeNaWvg2JBEjMcUcYrFDznwNKhVwZtEI$ z&*~Jg0*zACBQmitFNL2M7%iC1ZIH|c^ceD}cKXO_J~g|}*Ns6|DY!tE!FARYS$9#S zG_60g%{b0XHh5EI;I;q?IKwv+mF%`)HjRX`Pa&zn^+{~kF*OIyK%z1pEgA4@Y5Je0 zl%VuYeOVygeP*+yY~U&aY8=m&ZcbHpN~y&n6_Pl@zXB`z1%rNgT-W9cm`0Yg2~Q;< zEZGjiWu;5zdpxD)h)*nV4 zhqO`{R_nuK_?Jx9SZQrmsIbT?c!jq>e`6b96+rFzX0{Hl4HD|iSY%Kj$}HaEFXBum zfF9fB3JCsTBd5_I{U4nk@_^%9Hvw_e5tMQ0W%Psw5*!G{1Szs#Jq|#?DODsmW6Ds4 zr$42)R~g|$+i7y1ct|>7SyJSwnY^8={ApaIooBg-;Z>N1s=O+QMY>z=K)Dsd2bd>t z@JPC*#gdpNfYS0#e1Pj-OIB%*SgH^Y=~*KQenGL^Kf{-2H&C?WWoffGtaHIs;P7{c_SV z;NX#nHq9*fC#_}w26md#de!>x;Lmf+ywVS0!RdDOmi+-)6r(5zl<#2w6^}(X826=+nfO4;(Vn^0h48z zNUMTDBg(a|hSBSmIwmsqEbtj<nwcm8T{G*Y@ibVBz2;9+Cm$nubt zIP;|i8_PHD4e3Y};_Pc$yn4z#^pE40ssJ+<2_XA4@Jn;-2&8GL3*6yYVDd*_vt*K~ z4@~(45G5rf*kIMt+Qi-52y^SZTGMXXw$E4t7V~LZc!n|`Oq#^NpT8D)e$$S)hzHi@I7*e(qs|YL{#64m~qPVFg83*Q9IQND{F9Y%*=3Kc5 zPxf1EqBjex;1;9!c}LHvIQ83X3kE_;E|>T?-}z-B_7B`06LMS>_DE7y5f$+|V#!h9u9|VVLNQ z+TG80Q#7bx1T<=yTb>duOPpVfiAXVd?yZ)F7(%gf(l#vwAc-XK=6%eoz8S~5L-tm4 zH>w>cvHFZ7V(8dQPu&pTM# z=@zQo2^Bj!{GBxb(#hhiZKOA1zTp(|G_+(dv5Jz{W6@O4{OmS3zU1ebNpRS99t5By z#!Z;*xvok+_R`J(+Sdg%M`j$#jcHHT6hs|H!qQrayt3n#CX0gYtKh? z`wH<3EXJU%6TBPVUym=w6u$)?zc|$$=hXH^>SuG(YXL&6Zz|B}n5OR_(PISYF-9FY z!5)lJ1;!eK-EyVa;-RzqOjx8;S=xG-d&R^CjgX|0oB7QqFz`|% z%i15)+Jtr#G_Yf-@}(C}{>tIRPm(iR3vxgKMUBz;jKzaQ&&5P&ud%!%X%;`py3B~w zOmR%xvc7}nSL@~@2S>*ToJtnCn__|oAa;Fw>@SE8D_lq?T&|{3>K4}U+CTxYuWF2# zU#%>smFUG8eQV+>2heGz)K7;ccl@L-DVBH8*uvIs#fWR;*E2-Rbt}dG7lq(UM`AJg z)nN@5Qc}PLo+0b9H)0QL>m{`@sx7P}k#pvLX>7c;FA<36Sr17eW6Bu>M5OZzso{Qa zGjeqjapzo^863RVu56UM(C65xlO7xMX%cw^mALNcr*{N@olgKSH}N2D1oD4|RL>lw6ouQQW=mjhcE$<7aba>Q4 zH5dvL132=DOO_H7$bgti(T1$&8qE+LIb_)0Fiz)&ji5BTrhWm`>5Guf?$TMaMi3X9 z*TL}8ao4aQl}R8^O1Fh*pLdr_S*K_pxOWyypOGvEQ>2-0AhLFda;GzMkb;TOQ68gy zS^70?YV80X3`23 z41evO4~Zb$v+DNa)&f0-bk$77AVC&)L~fovtX$6aw|YcUDqumN0Z13X3R{QIT;*PU zqbYb%a}5ZN?Akg1{duFBdVk&pfBQoi^C*xX8hZKR|}w)w5?c5kJufKkpdKnbuxXJu3#q0SzSzZ~(CNVVTTpvibyPB#1Vx+!ILfz&{# zw>Jw6vxP-g0!1%n&(f&t+fskx{yS@^-BDov>|>iT7Z)}x`f-GpLl*UGJN|K)_A|EO zio?Z@-s19-Z!{yOp|t06x@5RDjMLly{E~5sp5XcgL06{7CxmQ5R~=wB@;!GMXX}_< z8UD^Dpp5h~&C8?vlikmw(`@VuXxy}%9^zGAP0qY?BzJ= z1US_Ap&}yz;fb`2_jxE!q$=dEpy4HLN~49oj77zl!BtR;)Kcg#;^vZ#AKr-${L?%i z1MKJ)Z)5rnl$yo~M@sqe?H2gUY$HC%O!=VeDJiwl4*bJ{OeXp6KsG%0*Whsxmz*R; zo4WMlGRIWC2apLY!yW8H7XjdPti01kid2K40XBy69L_4x=S+h!97u%j8Lr*`3p2~9 z-G__N5I9tCFWzodiYlJ&ILdf+R*UblE!%qUcy1zYN!s5guw4-hBPx#Wv+wa4VSeE4 zYS*uF#;Mnxmx-NqIvd;E**4S^_Vh;O433(Mb7cW?NoNR#Py3IryDdHbQ<EDbg%z!s&a}_E?5n-z;RPdcph8 zp=ioGudZvGFn>#HTHA0yl^%=cv+Y*B_uWM=yPrPKIIcA8^20q*1dd;QI9%%oNn~V& zsr>kIgaSk>{=Sy5Lc*?2l=5NGTeG?QP=v3XgyE2fz>4rZOVvxcOHbA2gTfRY(?4uteCB`jf@i>5<+=HEgsz=>hn1PlbKVWE3V*Lq`Wh1xou^aCCz(MOyiObIu zeXn<^y?khDtiU4A=^YL@8hq9~v`asdqdT*cz0IK89~jkTs90TgJkW$~s){0Z;M*4t zK-E0?N16m?zLx%2z7B=$2I>0b@asYeh0V_0-0@KoR?2aAL$!hKZYN%pSLP4v(M}8y zhm^}tQ;DIQ`93GWg9d$**)Db7N;zeuF9mZ`9I>Y}8T-`C0+AN*{)M(v&uR?uQrJUa zDhWGb9DGSO%PB)U)0d-6rWrs%XCinL1&y;~(``sc4Us~DehAqM$oFwi418qL6F&$e zsi?mVT-aA*IiK}ek>wl<*sGcQf%f|WQQU_p_btBXuurf#iZ?PaAe*fsIbuP8#EMv8N)-z!vb=iKy~;iK zZCCmxdAdgv_T!_69${5%#8uYyepY6F&`CnZApbG?(YdWnG0x zrIV56KH0dD@)?twnOFmx4!`b@!{Nsi{X4v;P2DPRXpqb=Xp+rf}@b(}Un<(!fLSMPWSRkpFfwq0 zw>FfYI!i_Q_H7G$bU$M9M7}MiA)1Bk2#SjN>d;7zQL@-Mm+(`{YON!mi*r)zgxq(- zx)W>eu=1{Gq#7`ES{OdnWrJqo7xD8cS%ZLijFn3tM&Rhx`JNR5W?qS8$-y+Y&$1oD z@z({bpS5ik1f{=>WSg9Hq68X*RdNMZrEI#P?ro*jw(`6I|F%eF1;ItBFr@!Qp+nQf zJ@B9x7m&9C?Q31s1&xqDFHjCmoGLMx?ehH7@`ltu`vt;jv(wU59*uu#>o1N=hfHiZ zixMryORY4Qnv=&$G(D0DeUsIWJtJCpg(Y)Dg$i5RHL0nGlirwojNXZ$qA#EN)qeL$ zt+}F8vd_XiT9A<*1gy!@^h>>DJY}a(L&VoMGjZ_9q6ENZ#szAA+GF*Pd0FHH&L(Aj z;r#5SQ(MsKpvyAZvBs_5<_{)Z)Ca~LxMl}dIvsX2_Fh;0hIFq-5DUB+_OlZvfSi-w zs`&)xe>Q+UTXpvuuCa-8$|jC!^XZxQ)*^ zsQ#CpIy3zaFa-?0Mt4tetV121=PCT}Wz{Zb@IAYt^SMSwlCkrK=mMB1{ zIN!Hz`_^?uOom4!%My|!h93@~=7PNji_G|^rBoc2dw?PRWHgyR{thqK*Vkhw?g@x4 z{9c{)0A?Wz^@EkG)7|kxVGN1Ff;!fy0>>bY#TH$V1G>dz-0?itWXpRUmz(pBw4FQJ z*d!RacXL^4e{?qgzE|k@_g8COm}fJOs(62$R&?3sI0B8K+KSKe-9JPcNLG;pB|^zRB^&C{HSUIhOo-XsD1xvMM7A{U6@EyDM=qBGv=`t*kV&m+{nn&p30Akkz8XbBQRT?#WM2*K2y)^`OR1CfzI_AnOo-%$&5 z-E`(sxnbmUxv`l}w^ZZ?z6|IXA=YaPoHv!>^B(=|E3S35&|7>uLTD{W#8NO)r4^C7 zp&*QTp)KCHG}dW*j@mmoM#?&G7U2qT$au1^DF8xdH5t~@8$xS$Y^!cpC%{vb7J(~K zq)g1v+*w5O;RPJj;7}RM16(Q@`Ur_CO~_CW&1G=NmA-#7rF1w>Po^s`PJJ>E$^H~X zvBu@C1#sbRemq-9LN7QfKvohB;7j*jf+uMhd^!tFNE2dS8~FX&F~uj{W~1tG6g1{L!rj=_pCeNQRaiU`e13%2B8t! z#Y6NCB5*1>RZACo2sv6bY0Y4PqOPh@3MCk0{S+96+9gN>PzlbPkH6v@1)+^;?-dX- zK8Z3B#Jg8{TA0m-XsEwEoX$B}r2s4FGxN1CqlC?mt{gWd{0)HUmo>agu5AQwa0wSe zQ6Cn+%2rnqKUUh}mdsj57xdBB?jxh3>mUVhb-NV;R(#2W@D9G`{+@}NL8B-B3P?SO z{RUp5#~!^^$`GREexhX?!LBg7TO@uytgM>6-?B-c;WtGpzH(`r6ar<6$7OOIE7X~k zWE_cV2=Gv7CXLMvKRxP7A!2PSpPup%r`qYS5a}e8Da)}E!J0%&hmJn!g8t(}H-&Pg zI27n_YakG*GmKzTVb4}UhhA%-`FST3nBzg-DVsJp+QJq}OR8#x<{8Ea)ak95tlYH` zVDJ#{!659dW|+u76KK+-OA=NeC?>tZOiF@KNib0{4q!)2PTKv^SLhjCtOZp_)oeeY zzg$_a3j-pft89#`5b+XVEtMul;lfx>BIG|E45Q_PA#yq`T!58@`J&6@0zoW>Mp%$m*}hCdW{=^ zt^6ou!#e?jhK7FiWPWdOSSa*wn4<(c8gw-qk&T%XS~Yyvjj`Po*Q~ znV!-3Bo*0fmcM>G`S>`k;k(_1%qaWvZM8{8=a-FLjbInEpSiC1Y8?)`-NjvACI^8! zPy8YOQMdJM%munZ0|WKFV%SYxvDr%=s-drB-WM$+tJkNCR%1%?!&|^u_`sxO4!^t> z@(5>hXOa*-(syrw=cdiyLLLJib4JUPSF^yddg0%)nPoR#@+{3AVI#&Y*ghd{o)DPtG z=cm*!gf)`iXLEOmfkhOmvL-ZgsJMf>@#ww`iU!wnQodtvbD;lFToE zoYoFemM0jmby-nlL;nbjBzcN4HruPfFO@`2D(^G7bQ!E;*)IfM2R1tFt;)NJ#$CSk zUgBHs59(|!gVa0xN*)r_$#=b*qZ#ZFCqh9D;Thyoct?qUlu)1y`jm$WTghQY6%kvJ z=?4R*FQ433c2UARv6Ao+3JEF?G$e-$LUM9aw=axLrAS3${@Ml$?IQyUo;-}Ig3M}} zwX_@WsHmatRrd^1$!>L7+!EKkp5lQJ;yvXSjdl5`gFuuwao6DQF+d#lI&IGiT@$}$ z2BVaulJ7rhcM_~A4%wf2$w7kro4kP%nyHG=K$>_Z?WV9ji&cz0Hx^HzVcKp}?ZhU0 z!aQC)-L0gbT-UztKPE!QkX|@mOtZ*OLCQjmXYe;b=&{ITk;tQ`H_}}K7xOFO7tMjh(aXK^CjrxWj&4Dx}tOOFNTj_{CScb zichp}#Q7J&qUT5PhgoK7q zU4DNeOE)h{*Fr$QE9!{(eW3rm zTeaYp=1v184%St{KU z+S2uQv9G}~S|B^?EA4dj0u7Up1Xh-uuLqB0;h{1t;DihqbU;8B&VxgJ?I5gm<~W=8 zn@)M1xSfcPFug}M_3Vy)+-wz_Qg?^gG_XhPuCC{6T5%pA-7^nB^&v<-Q8R`8q3#(3 zZ&tdHYT}{o(a#%G(}_nhPL!$3$4vRHCeNWBW$*36k>H>dC%HiECeaFH6LK-x!=23- zd*+CtPjaCE$ivm~&(Y-5{Sb-9fD`I;1L48b*b?}3b|wB6VoWxut&yu8@=!n3O_?ZP zz1V_gfX!Up_S|1l!q#rV_vG9G{X{%rogb0&=SREs89;oS)TruI(|1Ty{^f&{)AL!3 zrT8`OKLNGI_R2qxISKYc%O*g+%5)lIAdclf$8|hef6CsG@K`V6J0cYN%uv3>>e3KV z2ZL05=SGx~B!W2@xBzMwF^yOEvj;?6%iZCprTvZb^9RGbRd?<`Wd8rF!C>Ly{BI2g z>wnN-u>OxU7&lr|vHxGESD76cC%sgIf#2GkNI0UPKLNF)fR@y#-=N71(V(s0OS_>;z>(M2mGeo>D6(kLe|CxQv9b~KiKbgO@$lKR_;PrJv#qSb5W3SBq;)c|@% z$M(8ureU>5H8fE@VbL_QnI%-in$C@q{j}pbI5SH$%!Qunfh0hV(hV^F%4(ss<1l38I+dzZPvt;+ql6 zOfxgW!2inj39q$UT-$Q2UNgR)nhBiXln_DkshE|Jc=cI&nQ@mg7V344%2V@Gk*c7R zpEaVt=7;yCstjf9OJ;v?;Y!ruQeAt=rxU1P3XnET?UYe7+NSvxuKpODsdq)^@f!UH z3V(IT{O{&!SOpVR^$he?gfNS)l@|1ShC^eq^j$@K#-`FnVk34|E!mD~FBSUKHa0A~ zi-Jp+4vTK{$vYnWNkhLxrTz{7$k|LF3|5&3zKxg(r%e{`X~e#%Dyy#>%PL<7 zJw)TpBwNRSwG9RsP8eC$=sHVCW-ya5wrYEbZ^e_(91^9xip`Z%#}8p+D~RWAySKc? z&c`m@DqstR`ae09_(uWx#4+$7SUFS6K)^@x^o9u(yt}4Vi~*c|!(*46c68 z;v9Nt_l!<`7FdqP%JrMHG?C&>mWhhXH@0kBk4|y@o^~XqsvWHcIMdX=xkdIbSSnsw z&>jp$X!nH0>C=wk18_yc-&0dIEZRKk12v?Nw(1X467N=y(5lafZP;FrD(2b7+gPTN zxch?P)xl^$^@N$`!Vjp(X&&w3PA%xsAh_!(-({HH!0}u$9lQ_(=pF$6V|?!k^=yx( z)|WbTRp;$53#=HWuvlz$=VzG!Fh{K)c6Ehavwy|6C^trpN_nD8A^3&+L8A<4ZMq^v zi4Ur91>xv4dv*tmQBu(#z-Yg=#SdT@l9J)jAY5Vgw2x(&)Zx_f3sl{CMgnlz1jvu; z2Zz=cvpM|HMLO6T#R*(YpN`ACq4h3_QTPf$;8!3+lFvqD6m$b2?n*fXbzqzuxZMjwQJkAwQH|{k1Wt1n z2c{H?dk31n>Wk;ks>|ta#EAngBc zq8!gfSN0vgY8|2mFS|4k*jSYQ5Xu;zGd7Ydr%$;HxmfjL`b+*gPE_#7~WM?GAG5V z)fIYnTEpM-q4nxD4G|m?bI%|^8zkO4+BDZVe3I7Lg!5uJgaD%yxlwvr2QFnk_6u>O z4js3eKGAx%K{QuGPtgA_;}8&}IDPgD8$2n6yui^rDVB7X`J@%g`tdUFzt4$^jIU=6 z%LD*BgidiQiE)J)ON53Z9w>cOJ6v#|g|D`UjA4e;cC19y((UhOh(~(HDvWumPiv)& zeUtK2%eLtOw>a|4b}rTuRzirdjg9vo?npmj z{ULgo-%9vs>+LqL^7_KU(F!bQ?#ki%XQ9Ar#^??n+ML@#;ZJPMZ$AJ|NKa>$6}aVN zQ$}N#hzT;MD?mEsngGl0ZGmOJXn-Tt60ml4f;GMeI*(A1gntr}3n z(Mnj@A8w;irn6l6(aBU~ONCT>In4fZ*5ZPqV?(YHp>9y6Q$_}Q-_wS~YE!yemz*x;)DhX(F( zc)P7fb!5-y3Q-JTirMLczfKPzA=>WOasx)k`T+ZChq)t?+CVMxXDQg;quTBt zVSL@z21FKoLz*j@YZur`XkT}5ql2(~?&Db-hX5prf)Vl5OMbxg#7ZQp^sa)1%i>nj z?#ZvRvK^G+@R-gw$sV8}!V4!)-);-4iqp%<9B>JuHae(?wR^31vR@%}RMBzsk&5jRPV^v; zN5zK8Nd|I9OhQ|qP?Xf5d<8C$%Ry!#Mm@2QZ%&9+J;qG?UHpW?rSSY$wIMoIta3f~=esWjsqqP>4b3|G+aYo-QU zcU6@-8rYZ$+TLX?4-pybgh0R@zm)B3keUK=z~rw{OB@+XbHZZMv)4mr@E%i`poU;j zKKhm*ba#!kD1Q&FbELu3+uhS2=UhC$EZ(bf2aFCr58G)r!t4Ittn{p?pXD5W%P-+xnw{HnS@~{r=~2Duqmq&W zC<1gbwiwJrkjonx#25m3%>q#JnV7ag;$kDfI^H@i#&E)y>>=>}?5-sduo>?*H-%tX zM=7SgFD?<}k;D68X-9%oe*H2x{7ipxD$XrZU+&u z;p{rTv)zQr=fz0H2s9Ust#e>=z_J*HyzxYwI;#+e==A{j6Fkq-(I-yVRvc++X`>%p zd_g4nrqiXW7M9b)=iE7sto17Gsasrvg#F2nH#$ zWNW!T^m%lcyV zM5BJb=BOF0rWkUuDo2ymKUY3&iX5HBzC_DlIyhL>mZzi$6gqNj>=eWad0{NYy6cSR z#(`Me3~AdLSrI6NUzaEjl#>Q0R+5N$%GDDVeLF7;y1PHaH4_9q$p=R*DVGt1N0Wd{ zMLIA3oeK?>M5U|M0W5A*-uT9vkNe4qW2o(tS>{ceK1G|G@e1UloMN*TL&+^$`5HVU zQMs`VKf2n}Q97!uqEvKhA?L^6gLanMDYAO~b%d<|IJkE!hah1WHgJp7VqMb+h+`TX z1GrUBZw4=`0h+lkd7KN{XTGO4k;lp3eB4&jy6^&{cdu83s99BD7Y3*pbDaZA%j#w; z?FaHd+DEg_2AW0Y&6z%nL-;HV3d4`D@{0;$;2 zW~u&ODIF5J=!GA712$XNS{u5*u~TOD@04&5nn>TCbTa*Q93(`_wkZHnP`ER&$1CMz+rr+|>26r{%YAR^?Kvo`R{d07m(Tx-jGpL^!#A8>3`uZ#Ytr%aj(M4R%5ne zW9M44;3l004kh4=3fdBgg<&9XUo%kHX16=j8bb~478=+K`F^@SfZSvYteCP_16ZHg4Eh4MPHatY29BHH8udVNaj~r@!;*pMpMQ>f&7Q-pBk>= z=rH<%Zfa5J^i>Ml zM0$t)JT)`Fuz&mFYo@gR|BxO3uaAc1|F2MF`wu=Ew*Qfj=0;N{ZhI7|=dRBDT;IVz zhrMfpd}EW+|8Ts2G_^Sayz?3x<`&j0brqJ2nCmNnuuS_V@9=MWE`IguxM!*8 zIgZWmp)- z4qm7_A|oTw-9sz1H09wTx+qm;1bc}bCQg)X?|+cGNUevbas0+fZNhZ>(>0jn7J)g4 zpGcM16`=3|U9&}Yy+k|FC(7uwmF$n%CduU26pxQ5*JUGnz$j!vc#Xr^j<2`hhSp#V z=9w&ZBg4U z6_XBKJrRzVTxshWEV{;InV6R_C~E6)J?UDm$5i@PpIU^D0LyVALa!dlrOWD!0SHg@-pGI#=Jvjl882*VdWZ zYV$(j#9u{Ww?tUE&q>4mn_hT#H&7$OVJ<&z1F%a`CykwPNB~HLzf2`G^KfAD50&p({rMoh>JAt(<{A%U!CwN>P^I8UcUNb zZp>8-G5R*W#7j^UH-N^3w3k~+>iH6PKX1U_r9%XYS4(R5)dfv@5tht9IkN2rgLqP7(|j&c0rW;ZMD*SGag zcFX`(TfBcqTlu=>)p%!G5xz;*t;K<3RKZ3%vrkG@W>EhVXJHwB>Rc0d0U)q<88IA4 zxGZk08gI1m-N5C(FFWN2ab%haVJ)C-=(xW%!ZeYhuw&RWwCJ!zm?`cymd8!pCZDRr zounaDn@PeQz+^NTEa~j;yb+gRhbG6GIodY0;ZiQrHe+?!kFb@BsRDLWKnRK3@;RF^ zP42iB#c(Nl^Y_%I;-d$VK2zq@WitPX8Nr`B^#Kw|!eAD09;h%@lAj`WgUz}Z($NmU zvC~WOw?pfbeLywT4$_5C#K2Y+P(j<~iH9*wlo`WH_!Y@Y1|trd!U@$rI0sneIG_OE*x5r`2eP4@yiMuw~O{~Rp=tVRu+ z3_7-hf`Jf+{7LHHYdcYCDOquB>svOA3K~TXwX%QGrV%hsnt~R3NbLV>QFoFr?cU7m zA(nff+ST}F>^2Ci&tn`o&I7DQr{llyTI zdhVf5ftq;%Q{{VvT$&p=0B#9l3Ir1Ga5b=ctEiZ*6S(mYWxvuL$LcRx!Xs4qbn$~;_Nd}M{}*t znn;0`>Yr)N2UL*K zgOq;4sLftARofjL^tJIsi0x4=sR3|@TXS?_Ia23#$2TBbEK^_503;QnL2AEuRG6*{ zq7ld3g2S0qN;}Aitm|!&@Bum%_6!I6BIdxFSBC4CZgaiEZ+;-Z zH%ixOr1cuyB+vQL%(fv(cl>Yfa|kcbYdH=~ma@LumDje}%SYXC^3Tc_M@ z=@g8>-S!_#nn>ee(qnJ&>&lk;?NL3LTTm{c)?6KPl3w^(zz_GN`;ko_r;-CFyCjxLuKdI+6TqwC&n2H9v1h*wB~F@s+va0|*4zJI_S#4m`- z{o!Z#tG@o$yY-IQKA?0{whJrZg)u$oqj0u2FAH$&BrmZW6p*GY*>!noPeTgn>c-bR zjK3M!e&p3mVS%?Qn1~7`LPS$<)#mn$X}R6R`&byBXRR=+)#e75DuCLTn};E7qJ=I~ zI}~b@)RYm(F9iawY~0!Du({K9FBHY0|2{X4WjSy-paz{mxe#m5#UFhtxG5NvjC@iB zt-xA5nZG?AY`f3+INoQ1eT4BFI-mfh@`4>fjG{g33p0$@CVn6=W3%fcog3{{VNv9e z%JyZ!b9!sKFs7Me;lNcbw6p6|JkZu-`}UlMh?U3WV|_UjW_$Z|xBF)vN_tqw<{7KQ z{c>zyPd?TCv9Ldb(>k8h?7d8OSW23HdBHS-4Nb;N(Z7VyM;QRZY0aSbK8+T1T4DegzX zysQDpIv$*07?qj3{S-p`lsEl3RTdH=H9>nQBiCaS;7xZBD{dkI9Q# zDa83=_$6K_R$7Pg+b`_z4@mL%Ez$oQLH>8J_&-XT|E{dE{Rbrt+y6*O)1oQm^e=++ zKB-B65L-v$8kpWEOG0Rr;*lfQ%xldGIyMN)?W#*qOMakp7W;{&f=S-N(x{q%ie(e4!GFklIFZ zNhYQ!yGThqH6t;KqjhH|a>jfqU^7(-30e; zMkTd6byaTE{c1fG+luSZY2j}bsp%#vwiB68t=6wyA4Il@3#ppu*+yY~+WId)zgdf> zKla+pg`DQp$7r!HfvlmclCgPfqXY^381HA2>2^q=WD?`E;M80Zuw-81+^9SR2hWOY z_+#hFq(+1?wGoOh3nF4zkOqM8PItjDZglz(E#%=qH0T|{+hZODG_xYijt}WNfFS_U zEh$gVmmc8y0$1FaK_@i}hJFm9AA(}d`4;Gw)}gGDWRq1$gJqZ!3vVq<(a++;`t3PK zy^6DnTjNx2=bjj_BY|fYjIoY&mJnPs!5XyoOfY_^bh)-wZYd|MEk7YTWFN*_L!Db} zG>%G05o2grJXp6QmMcXUm#(3p$8-ssklSL;Y|$*W2CTEz@vh(A;9?%R8pAe8Ls*=_ z9YO3X(kV-j@P$R;KsHp0FPK%k)>)Py4XpW4o+tZCup$>1B<;o(`5J#HX@@R;`d2c- z@v`u9nL>NWr#bJB#(W19{qw^Ep~;0gJYNGb(IOcCP{v0l5ZQL&$2#N*OwQ|C1YpNo z7@>RP&aLjC$608<@S9f($-*Vbvf!A%eV*^W&Jw4GIvGtB*&Zt-6Sx?OKXICd*&b8x zr2PK&;MPP5k{RS|J~!r;8&rVv6%}V`i?Z}))(FJX#pdtYKknaX$YNGpwGKd5TLB1A zqDtItI_fmLtw3MXOnABU?K8m*DT9h?sRr4(yyu8Qsq2uy`8+*BGpfSrH1Q;v{xZ^U zB#oq7Sc;w)0nv_6gwYQ$Jx7fF&4sKIAiO%HZw#T2N^2PBk3^Uhd2PVRoKoiy36fWG zn(`LqK(udfcU7t2VA%9o!E+7SxTK?M!NGXa(em}Uwn5g zwb;(hd;Q~)?T^g}1g)y(4d6uvn!twDQ|Y^_1c5DMjZ_K>NvD$CU6T>Mt!%xFLPBYK zE%yGKyxg|`@UOc~7$?lnJBf|ePA%D+z%G=U*-o2Wj~%6ZK>|sU&{ZRe40-Ec-u4fX zFj-Sy0@jSXr3QWey})ruVLV~1G}&(;MuH?`EXC;D)mshU`s^!6F+um<0Fn`i#iL{Z zJ@1h5cROw+*o@tboD)~o<3+5&jm@9OTy(;8Et<`q2TLq`SMgW!50P*~0Gx}AjwDYe z8`oL?99g@TUVP zcj(RJvB#23b%MX#p>yWti7H`*1ENDL1}>0#y@dh2V0xUyg`c}ayGtyWw zUZ$l(@T4>G7626GRAFHo3G}+tLduWhcFr#!!FVX^c);lTzZiSR=1RkEZ8x@U+g8um zwr#s(+fK)}ZQHhHYHH!ueODh{Q<@<$3IGr?Z2AXas02~Xh12|`b8msR!fyKJ1~Cx zGfnD8K;lEhxwcdZUJ92ou|yc1k72{%6R)Z=TH_)j<9-4})saSXsU?^Egi&rJr>P+79 zs5Q|By6J2RDIuJD9HCT z2_DfNPOa+0Iam7wJ0Sp&?txjY@^r5ufd4@iPXOk78^sruFKlflJBOf{rqF?V$Tde? zF|0v8gSpI*a7srbt&cWLqftn&OM@4iUu^*iYpYM|U$gC9b8xKjCj&;bKy)Ch-N~rKZdp7R}g(_Ut$J$0B+64l7P*!JL*Vn~*SVz-Zr*}%g^#V=Ct*I{!cH|ljy;}US4r2hK7ILkZNG;@~Iuz;T9); zt$Ny&#!fVHy$*~V$-P;P6>dz4P@9o$kgpCPBnQO&fcRxL-^phVYc;cSPR-Lh($8Uz zXW8tIrYR4p4}Ie&kERU+ddB^0vpXNkSV9vY3Z)#u z??)DTa!fvn04v*G&tKsigSI{pjhPlxCzZmK;G}h#-_>T2W})*zkZ4j4ZR1DO)uAp9 zV(D~9RK2V07_M~^NL{_mK`!fD<%LX8J(tQSu(_PSW)ziEV7KXX-jOWZda2k!qpitd z+GP5)nIOJWsC}o34nUC)%Q!m0L9*($$qLlvRX9jeh1Bk_<E;>J>y^hz>@?IjWse6-lvop**4H=8%53r?b?COR`^-(t`2-O|GlS#G zNk0Glu82`}k7P}tImm!AZE}ny1ktYfHOeyQR;(d71+MaHDqW-mvqfR)psxP8Mgr}l zE{vgqHA3q>;Q5?VRI#!AJ9hF5DtBpcln3hs&jJTz`aYs2*B*S#(wVfO+j-)Us9j>i zr4=ssAXzHB%a{*AUmN?Jz{6jCo5o-uZy3Wh5PafhQIiF`B`eC5hET6Ia+bICuL9X! zLY*$}MM9im|7rN52sri*h;Fz?px;6lxWnewWMXq;x|(uYRbwW51y!0@@vTp0DV4N{ z3&nuu!F3~iA;T#&PE4{>TU7#U{sar~N&g5{2TgS9!J<9X-KNfrs+Dr$D^&3E4+Mxc zjeMuit|BJc%a4G;Y|Zt4hSp}+3p=CD9n#m6(DEMmj2O-4Q@K#i62w@5s*NoatKShv zFZa(S{^z=3s@L#vu5D&yAg+Wbq2(G<8_<0nqwVT&+Jht0CGimBdZ6p{p(~?6K$6A+ zxxgPSPAEBQv~HpNwylc(!7fCyUt*%)lkKJZGD-$ko2$AFH}Yr$<*+-@fC0k&<^j-Q zf0M6&R|4R|E1IdT_MA|st|DirH8 zw%9&GtfK16@u^l5gmPry%Cxv1A5kc6;S5uf8xbo=6rq&XG2K@mMjUhMQGsAYq9XWt zzr+`7{%2Bf+4@fq*pmuF)1UQ2MQzYZIynne?l`%1bkWK$YH$_^Pg`RMb5XN8Jo)cu zNp)r+T4a&B;F+pvlfXKHU5#RgbmK?Trk$MtC76bMUkZ-NYY&ukcDvx2;~5^wBCt~+ z#;_gQf*fx1(o5XKugJF*OFz-2UMPNXvWo zE;A1tvyy6aWw>20lL;ZaYHteWas#7qV7t)wWIfv2atCz>dJLZl%Q9pfIgPx2{ ze1N?J6@t#rESY>k2b*HP!rt+pi{RgVLldZ05al{?hvmfRgYAZPE4SY%IrpO9pBBG+R-4d<5;Nttg?{Bh`75(}rg z%=`Kswn+{@Pi7PSbq3wUUDinbX|8B<&QI(D1F@dNVCX45_D+nS!v&fju>6k7g5eKo znhh%>J~I!!n9|+0yg&VEXf>dFMoe1h{aT{0i^=V2c^OZ|a(b zg+N57i!6cZ5rmp8gFfNKe8;=n^&ONHiw2)hr~VH7xAfY^#7_Q)rT6~>H?ed7A39vl z{{U{{`d@*YZgl?jG$&C1^)%0yv*1d&y0d4;`H=Q&EaPB5GZ0dHtq?-etPoA3Q>EwV z*Y$b@N55Iszf4ldz3eHZ0*zQBen-w$UH)rodQap_{ny?*{%LThAkxJD_H$^ZeB@K- zZX!RO8XnN9mk;QZx*vQPj`EL63QeJio^bI%a34(JLr9!Rk;(KuRc#Ewkv`h$>X+Kis0mX&rpNLe> zbgC}{CF)KATt{rB45@=&bp$2XN5K-f&8VApEG?-ytNO^oxhYGp7#Yun_U`+&ZmP_w zqzp$K2M9Sc&@BPG2JI+mb@LxCwR^c&S2~6ixU)+P{HHOYpz$>aW4LYy_ipPc)fS3# zbJ7lo0=0Y%_0Z_VWK2Z>*T|Ujva9iTkX=?+Sh3Y!PblIC&>w?>zfFycu>VnN;z}N~ zwSWyZ?R?}kZ@39%$xUh&!(MScWt8H5eQZcK_(c#a;sMocED-%8@z7fdru9Lr&UiYa zh6#>?AiFu**Sl$7n9;x!pjf1w)l>)ntBigOoHfp*jA$Rs@XDCc?hM4eTt;+(1OGk9 zMrauEZUv=}QAOhr%*eRH!P~}VSYmLQwFT%14f>SwC75XFIGL#t%vGr+^1uCB@Tw5f~^$1V1#I~2e+b+49$LnL*crK`n0^V^k#~9=*wbAg&xyhvU55<`_pAM8i+O;e9ACOy0s+!aTBH&DKqsj8 zQozZon{XB~RTAMJa)ti+g6hG7g{@@U8{(`gn^ch+oc4^KH#{Kli{~T(5_(^9s5n@8 zQ-n_8xm5kx4xT1g##)9k*Kt{0iZ;cua3%bm(bvkP1Mc>A3s)9I)=0JyadLTb6*4t` zSS^!AavMh=GZ?a=DB~uQ>V;E2r3cS)P*h%J-L9CH=AC}4)gZNC&a<=0-@8Bv3@^h; z{NTyw*%h^mFVrkl4g!hU_A|o!Kxyys{5AaS-|xHgAgaIdAnL8+092BCXMFBJgg_*> zL4Pilt$|$n4aJzoo~DBCDj}w7P-n9?+mH2?pswJXX#RSNh`owbU)eD+AOE?ni8IKb zPJxn$}Sz2An7Q%t=@Y(MUYHfx21bhUPIW z5M~HkXdtwh4<%`kjr5wtsvF^R&GJ`#?kWx zV&eDEDA922=e?Qp&k`Z!$%L`ceRoVxzbh`M{Sw_9Z$|yA5d<1mg_jMD-k(7?8ps{ZXqW;bAO9zGKt zjx#L2QxGiu{&4u2go{H4-!9xs6*0(E{^y;)ZEs`EV2%S)&fDBo_8ebdS8%Kj1$m%) z7h{37qs+uu2>+u%Jzcn3Ka?0Zp>yu2`>fNZvr6(N*PA{9{0s4FDJYRYL2B1TI5IG6SjDPat7GNNg%soSxDXtdlNbQeka* z#=U6T8pboKMXNuB^EmIqeu8ly*~0t#@cON!T}XbjfMz**fO(BFJ7U;3XB2CpelD*$ zN-RG=SlTeGSQ~3>cv`PqhN{V#GE=H>juSS|4UHy@#D*wJO~!k5p2SL2d;;vC>TS9r|pt#Xj6YjbK;a zpL!iZ9i_+(ZO2#iGJhfKG;2WREwnp!S#ZGetw`rpKts3D!lmS7BQQ)`n;<7zKkl_JV_bNYE6K#l4I$Go?Q`tC-v@z9pe^;<4xvn~bgXy7bFrg(? ztwTe-rD&zHn2j0#+pN%)6DQ*e6H-n;TNVVr3TCu2XuoAqzuymz&#^--K>-`52i_ix zZP8%@=?|Org&u;zoF;vq)jN$#Xe!L8Lgt8LP)WETM*$k2F|9r36qW|*O^WdaBmM*& zWq=Fe4$#f(_5Y1Te<4QcZaHH(H;_7MD$gWK0RL2=bo-*-NPlT?=B+8Tj6^8A`!Yb+ z0n(7W1C3**5OI2mLSF!K?)DUlBb%iIC$frX@GtKJ+`MBnTHr37Cup1IfX8yOI+Xv% zD%kovWCEYAZh&nJ<=+w{YnYxH`t*yDVHIqmg}`iuWnc%`!qS#Ona(xjXN*D>#U)y6 z0~LniJ2tLkj39c}scg#!!2%ja+9bsffCxpG2-*D6h|D~Dd>u0~YBt2c00h%e*5(0) ztvHh=+qooV1sOCljR`+eJxUYBxeA5!_%i7s2u7%c>-}xQdg%hrvFm3?1kHfp`aM`b zK0uQ;daE0M0f~)jw#?%6hEKgiBQNvd`OI<0k2Ncj#B0Y|m(3VkCY(R8xq^996u_Zk zJZ-k%N3hF z5Gnd49@v+c%z~(CV%VAU%$^6zUgEs)G%WJ#fNtFcLC2q;q?Y9;5fy&xgOoYO&YE}d z@~1{+T&M->*A3}F`xEyqG8YG0x1j9q`CSYcR28k=5emu)AUH<+t+)+*`Ph z@v>;vct0FeK0+x;&e121EX%njYXuHUEQ{|-wlS**a zOkJwSXAzHOAGo~Bx^lPIbgt?K@i?GMVITvJ^}LN<#Ra}M88bg-ebh=GCg(`QKIYD0 z2oGn#EuEWyakuKhmnTL1lyCZ;4U5D;&SO&i3n%yurf2o^@_*0w|2?(;*HMd&m*fBU zEO7k?4hz@+io*ibmUrF$rzXDA+~+84V?Y22Cdp7kYVO{&YfF}+D$R6YR~xl=2wNC%+B~m7Nr)Zy0+}h7M(u&zTp#qeXtRXXC610c4mn`7ddSC zH>*qw_RU|zItQyJnOh*A&|)zNPj74g#GI_=eb>Gz6FCf}us~k?2Qe3Se0WcETz!Y_ zX5)$6Qv9S$i6wl;nu~nr&>0b_zuqo$jJAk*Sgm60zO{*uYt%pWxIulk_h+{xu+$bQW`^uyT3xHF@mV3*-$R_T zeL5s|+%3fNXI6F#d6%~i=*$h!`fG_5gTXFRTRi|)2K?nwVRgxTB?^!I66YVk-Sy9g zepN`X?6Gq*)mIB=uc7Y#uKgF&&%c*()!ENrHMecQY|{bXzEjTgXLZdk*HzU-`+4=7 z&)Cv=n~#ls=#SQvfv9hF%W)q05;$ZA-1_g9SJGnGITh=CF;>+dgG+5TTUCO8h0%+c zU=^j=a+1}yiXA=<{*64$b`L~14}BY{xuQuNEJZ6Kq{eWbNO1NSipe~!0eaK2!L0HE z1!wc9xa87KAPB?^^DQUs>ixoAi<QU0pp_`Ekf*u%{f&eUTdKx>)=m zXYU>J-E#sV=JzN9@mJ<8^D&B#a*!eu71uw)%DO7C!E;Dv==fqj4wUnxB@W)w-FN^B zotS|Vu-$i*GOW+=5Td)*ELiw0^d9TxF)j24U(0|c%KB73=^JOqou*gN;h7H*q_{ZE zYP?^UW?u!IJyrqlKj8!@W>^Pgn+dK))*3z57dXsmX8r-O5$gR~&!m3XwNZ4BltY@%!1MSWyLNm~-(z4}>gc`tR7@51?1(4$L9YsOb*0 z0zu*{1vCfAV33cGj8?zyl?Y_Vh0+tva*Ltwe@vDXLW2j$!UU`d?q+=o~u6*TZ&{{jp$5J?FJkL-!UilN^-VU7I(7Hcwq zV2I^Un@tc9NHO!uUV}YyIA3Q_O-8OuYl#dMQ;eG2D^1*b$LPXr5T0x^EXu6vV|{7_V~q=<9nJ4Nux6m1W3AgvkC0l(cUSuwcDvMx!JCozW;`9{CzPh2x4< z2CVi5&K+@p4F;z@#)2_;VO?w~rj(!e(%~|0ac@_FM6q-t(FI#D1rQZvkCvf9l7WS) zmSYANhbvT*Qqt<(Z~x{GinYE($8RN!-p>@)k1dU0^~Z(-C9}s!wU(f?pVphqZ&HKS zRZ*bI>4{VYt;1nEKQj~s>B{K;`lCTReRZm&xKbMUz+#oCj+7UuOI;XOI8w5d@@V@w zmN0ffyf>Q(CWj|EML+J-SFW`*1D=!pZUyMGi5^CRFt580t@38b|N7Dn=XK_^pvdp# zc`NSAL+J;(xwVT|Bj_GBNP-`sW5&{O9n#<22k1j^VD;;}u`uxXXt`HFo??QX%v{Bz zC=?GvfR{K)5{;XrHYOulD*LUG)3i{lx&}r^pc7!1nLAIVd45Qmoe2_@^UV3O_ST*v za8OPzRZP2WMAhOB^>gdg4lpn>b@^$l!PCQ;GU`ZRJVJ8aGVVc9!dzzm{Asi7;Gcul<*4m4Sg77ux!zP9*r|?1xf6B=3>|r_Qr{6Z^VRlvkHv;Ju zw`b=;Xwm1gB9Gj_nKbITUy|CCLv*z+XM>p7<+P8wbWyOkbzOJF(5;_hcI)g?a>O4# ztnSp~SB>~Jh#5sq1!F5D*C=UhSsg;xp~|0+Y>dR$FtRY@7v(l3JH@U@gp!Ib4I%|7 zq*k0hu{DYKhyJYWd3nsRj) zbwS&sN3-ge^U%&59uOmS(D%pm|k%y^lc4+y_HCn36*Y$2&4 ztzH{RVV14It!BHd>nW&+m&~Qqy?fqN2;PEdB-kf<&obg+Jb0L zFZY)2Wj`?LY@Vcm%uC~9*`BPQ7L-lX(#%~(rLGJMo4p`E&kfB8d3j}Su2(_mdcU@$ z@X}9(@~$&ZFVGOqE$aK7(CV7jO_Y~jFT34d%{NSBWI#5j%#51mV>&nI#EiW+*gLa2 zEhyXP%%((+vf~(0w+_lpf({#~j06s1f*0`v=F9rBwO%fkEAZ)l2rh#=UYODBcSk{R zL?`zmd+j7-)V^Y>396ni_^=L>y z-{}>SW41*Aq8GGo#cmOnVYl>7N@7U~?!#8_qnVx~jjSRx;zMTHN;6<~sbEVEnqxr) zDdkc{b=yoSH%RWMQGD#b42Or}dGJxFJP3^MVX$`(59%udwcZ4~b3{bS%4=Vn0$A5n z8&q0Tv6JL19c(R#c{KJ?VW^Wu>Qluec;HUUEE3S6%EWbu+QxHS<#&OqP$R`pnL z88AmfloV86E>9vK3iJ2W02k`Z;OmyEZKoGKghcdY%iT;252V{+<>^yQ!GWAY&$yHW z+=&pNphKO6@$T$Z33d46c}G>gD&)ly9ZrQV!n!&!^Fu_qvv4y%LzY6CMCc{|J)yhj zi(}R&>TN)vTN)O`5gqzUp%AXB?A(YND21lp89(S2*0nU?GmfsbD6o3;>8+lr-cX`izHs}NPgzUW!b2Jn@sWgGQPA$grk_xZv}622iT;8E{?d^b;@*;FxG@YBB_C1!juC$RM`gXb zS|NaaN>qN!Iksh?01b}MLv@w`Tq#pNADA9TGq*B^J-x|%|0u{^VDukK{r^1{{`UaM z$;SIXWPh&zQ0nLU-j`eM)~GQSQEK`E>E!F74;x)5FAPBxN+UOyu#?JI##)c6t9W*}a~0Qw;+I zz`2W0W;>;A8}SO${|nf?RF`-nHrd26&r%q9?B&uWC^Nr&=$rHztjMmNm~(oHTh;${ zBmdB4<5-30FKDU>3(xuy^F2Xf8nH`B5Am0ece3Q~so@`MiHaF#^FIrp`=e`jV=hB6 zIl9BrOtXvb^6j?a-GbT*Da=5tUp*A5QA3}H3_$LfSeaz@%$L=}uZz9eE zRR)xz>1x&6kn_%|dA(cB8VUKoSEv=hn+#4kF3^>1(?q-TnLWUrMSg)i8Nnv)A?$OV% zwO0K-)pL|ZwEp^|1t+se*B&jELHk~!urNglxl+)IAUNGQBlxcvVD39t9tlMm`FBpB zjFA>~wkC?Alpra!>fvi%+uV;TQNQ2mH{Ec}F4fjNf#H$|{{R4QhNqG%L>e2Kn)>k9 zCZA_5tlIF=VPiEjMJd*RZGs9_W>*KooPdRHV?jt3I)VmJB7ecJ$R8$-Alb4*Ru@I% z1G1UC`4Thc?Xorin`*+MQ2z~vf>~BpXWp>7`5h?1xFblU@Zm0oaKDaS%Y<@qJ$=n# zmm3kzu&5bn4Vf3342t>ugxaZtag`3@@0(TRQ`>%?@jpD%b4!kW((dpYf%Ba*wpv(+ zVr*sW;*t?z@C9(cwh3en6XxOT%*8}JYi*amy12q6|ElaWrpT<)YX9E@Bou8?C$(#m0%8G8*MPyjYNWC6_pcj73DoMB+UFT zjNAgjfZwoA9s7O2(@f(cPQp*Nh4E0L+XOwRL+SPMYmNHf zXm~x8c3n=EUA18=xul%I`lJCCAHs?qm#OW)tUX`Me%s4|g*pF=bUKbdff8`u84BS% z{)8W3P!}Uo1;Z#1?%A&_eu|8)#aPO9RS$3gm6QJ=E0zc)QNaSo`taoG0YEQGJ{G}x z4TV8cz?>cHL>8*>V5GqWd8)hhNk7ZJt>RtWb`6AL2K=N+?iToH+JZ18O-t{-<=d>! zKJgx-MqrDge=AVMSP+cqu#PBg>I$s#8*nC3)E-xD<|s zlj7Ask`e)M*r%l#l7z_Vv}0lVlL4R;NHCXEHfA4ZRvjT={X=LD3aPD2b`7NzasLnC zd5auMh$<4A*!6UhmH&rjE^}2zCT;reJbiUD4GJZ(q)jV0e?(Fj6h4BsVyu!9UX0Wz z^w3S)JOj|XD3DH;ADGKLffGbsGl8Nb;A?qN{bJKTA#^N+m&+s*zGGO1Hz3C^Z_wlO z0n8>&_Hf&?cW7}wLM&u(8FoNIVb&R5NamFcrMhsy_mK)OvIv2Cr@;Clk(YCk2XR!> zs8!s~!rT&fPpqEZ-D1?OXA`pHKRu+1yo_|IcB%F$vtWMYo z&0))%MIg8gn+3$&cxD$gb>Je@69*OrhSQfMVv?e-$7pSVl^zr^m#e!#Ifxf%yd3)&aart?`LMnqSn zJe|4mLbpcNuO?zkGbLkfn`_x+wbBp8;{c_I)Aj^;TRa?l2#3NF)*^w06EOZ^BviDn zBrB_5&e#ur=6p!uFAS{Xk0eO%6QD9;anw3o7%kNOoGO&pEKt(4XkOY`W1?e5Qi#~Q#N}7pjjWjZq4k7Yls*He{bK#vQ0zzk<4PD zI_o0zn^&s2+yZjWe@EObx3nc_Ve3)l((Ua&UAfK*c@~i2`3Xn$n4HB}MirMQA8rH- zdo&UV*j2@NKQc7JBIO^bZZ-5!=yk}2oXxW-MAGdEvaiAg=0&{NZrcyvYOf>*>&(V> zwP~CqSuFiMTUh4{O@>7Vb+l|rgf?eJ?>H25Hp-mTT0sr0*Mxl$_inQ`o_BjcBQa-} zjA_?j@&3WWO%L<4eiWL4fC|Ht%9Ub&=>+WpUBhDzF!tS9CxF+)VE#K(B z_v%Xh_-=(Qb^>rEI~Ui0E@zN#8$#1;Pai+Sf8wn#0O;A0RXtwrm`%pg{JUUXpzY5m zpVoP$sGnO6i(xgCHr$daF*;-T-Zrw1!!)>o?K~9{@4G@{25K;Ib@CdkO4>H=52X1O z(2?T2a8u0vap7faJ>0~*`xU1}-PY9LOqJrDl8V;QogJK8g|xd^;w14EDa$L1Ytw^D z5w;QD1&|EV{BY4jeVilDeOogy9@{(gYsp#b0h$9+$m%_xvL3LW)-DxQ|3!7 zue!@)Ff;ShCM@;vgS=Q%ZspgM5pnt+fUd|7XJA)`+&RdKL`iS}7t-5(wfjUwJG_Ft z_!t@YZc%JA2_c=w-{eR@PX4d(h(-gU<>xZ|%W`ExaE`RDQB@4{=62IPh7O3>RO`L? zTP@E6bHOQYC!mGt*=ham<-rI~8P}!O_FWsaE6zE@{Fs2qz_)NhOFbIa{V+ zA{)Ld^d0EW!?gu^S;J4x;ndwlm@M1tT2^4{L14(4Jy)5z<8XDyay&k9F$|N=ggv#dHibq4Ql*<%@9ZVhTj($AZg>ka@PNGM2ATc$ zOGP)fF`ND!2>3e9RRa)T8c2(rr?prPpBs7RQT7)i@4BHkQ*I1F8xP>*ib}>?nZ zd^0+$=jGMBykpj{qv;C%vj_R2O=m<A{N| z5~iziRP>BkEP2*5y%+#5Xrys~+}=_A?7Yn39hjceun%NJd*J&o7+jsb%ybHZyo0 zL)Ltf1MO=zo0T4rTv3{0W~oV9xF1M9gqAQ4Z8xdE24L_`ME+c7r$AdctqUl@XoDW4 zy?XaDcvTKLywuVY?18(dEk3_^u7a5*$#x9GKUyuSO%r;=*y;*eu|1skWsvY%b**u; zw97+w*JsHJ4)xcx{=<H%|s`^$VZw#b(m_1A6dWwZ6!h`7@G~alH#ZnUV8AaIUBFmG#v(XP5{ zE)8&fr8&qBRNC{|Ka%ZKTrdn|3h-k{U4wP-2W@6!HKSZ%Fzg>U%uhu z0Vs#MY2j^}jtvbFmR7R-U=st9SBA8`wcV`NAUUoy(VZHdqE}e{P{2&@7h~LYE@ah1 zViBEP1CY4=j{j_DxmPgh|Apf9YkFA1cJhB*#8!RF%=Bw`96z3Hg7vrR<@$Z{jU%UV zTfR%C9>@OU8l-txD*FWVeNrQU?WM4uHAx-dPd{s~Fl4pibJ>3WIa*(e9cbpkR=K=e z;7EX+o_KJ=(ib0H<$c5ImlsF1lrHN}sZb2?lcPY}+~p=9`0H9D`YH!yI|D}R_uHS^h5y>omYG|_>}6UFOK_@YwBWwyP$R_!9& zPq@F&d1`>Isaa^6s*fMO*0#rChp* z&MK^~7VvMOAY#v&C}*;UEKqXzNc+c?7?(JykvjqeVrf)dAR%^I|6sGDQ@N;g`z#ou zWY}7*(AEd;Ya*^SPX1<754)o+UA;94^Qqq}F05LSb-| zF`cOwDd9rN5P~swC4kQ=NQ^JyA6KBkx*T&1kZG)d4H*Kp@q=z0Dxp zs7M7tk`K^WOxcO4?ia}qZ;o|4o#DXCPF9Ljm(`H6sXbRq(^FAS)4vk zlFTfPS93mRrGblhmLxiNuAnJ_8bQM|jZA%s58EC0YMQu~E_@SS8ZITz6u(MN-dZUy zP}NOx+#LXjmH>LrVNYn5eL+lkbP^l(1~>8L4Hng|KqBUoJxaA@y`eDlx~M;y0;$CI z?sZ_8NsD6II1P+KDvXqphf=z7w`#>JY|b@449lmEOE`?aya@t-4YilNFp5>pTw$&p z=sW#yZ=>^<)rwUosk8`0-%ooO3kIzs`5kzkwN4tN*>bSr0uv}3d@j{mQ+(8Ok&bc^ zxGg#ACv1CY@*5q>bz|(y*y$_xW3mMbb$+j+fazJsyK2~KaP-nBThN-nvuyN%o!BSE z4%j}Ly8iyw@v-cRV-^e~M>C2X7N!@`Ulh3DJ;!a#L%i~utkaXUFzu>22)qa9*Tcwh z@n9S>_HZiagRMa>sV{}_G!Le#AmPgOcY)7W`c=H1Y_WmC^c$#M>%|@XmU@ow5O?4z zJfo1nkafJ9+hu8M7AZ4so?}~hL@LhKH}_Uxy>Qj9YT|ioFtDQaf_7T!FNs4e&5Tju zcwl%Nj7M~W(_l*03 zUk8h@WCsW;jUzo;o6hm6-dCojvbJLo8i~Ze7C}V8K8{QGxX+%h^k_{QKWPZYtJ;?m zIQh_~{=SpB)J9lfAp!1Q`=F9S9T{_Lx92r38*C^3`DuL(TAuY^gV5r4HV`HiWsx8E z${bG z=S&fa;w15LTKid4NQ?J@4xU?jb3Pm9775lOQ+=e9ItaDv7sQbX-S(Hy7;9TZvI$Op z;bOxLJ`q_^Wzs5*;d+@-c`;amr1>=MBC$&sSX6zF=l3=pd`EWT6iO$$S6n}5^qTQj zbwc3~ZZ-1(zc~X*S_`h}TH(6Xq*XYbnP4I@cpc*q#YU^mumaMIE38n~n%7;i3>KJ& zdcdK-s5P|2bB|k~e^V(Ad8ZOs{Frnj`+gr099EUrj5z&TsyV+7$IKUw09+_a;#LfuZ7#MFwtITKB3 zY+>Iik6mHACS;Ofd~&%NbhFe1kR6#zQ|uz6h~&no7#2zQ%fkWNuqta_UGN6ce9$e& z-#|M9krKr~sOwa(RSZ_PP(EzA(;vpGVXx)m1~0qBZT;4Lfhy_lRR~X1^AaoB)P)c0 z+sm8)lw&`$9>k%JNv$3T{H1%YIvWTfgq9kv6Frn6NrZS@KA|r;ilE<5#+(J*?W|0( zU=1sAh30KwJr zNvK&6KfY`rX`P$L)i$|BYxf|OXb)3=57?oV#RaWwwYr7e=F9Bs_g1&LsnS|y{shrN z97|Ej#gd2wC+cV}%tW2|)dd?t?9eXcS4IQ&Pge^EC*i|Omclp2%l2u?4s8@XJ(4-` ztNNGRJ#0^ZGP#{n{8Mno-A-CsKMNc zT?`2^tiJ++f8?Yi03Nk-E&G!`{+nN!o7cd0!?CKd%7E807m5QknzG}A0U;P9 z?;>PHzwq~xh^_gc3lHHbg7i@xMS_DI+L3CVB(`=#^l%weq^lH5?N6o4wxuDWS8=Vg zBM-*cq(_3XTIKVI-f5Tp^VjW46QAR?)8nZ?e)q4G zOvQ2fQP8Jl~6QA*@|gN+)^GSDQ|&**hV9Cm}Ls=yL6$$Z^oc|LYbFP z2(W>+IMy&MFJHfm4hWU|`t~!4F%8+S?C4?r2}%S+g=S&Dl>$0~9C(Vt(06N2d6ML! zO+$z7Dm_6EAcyT!dRVq$Z(B4sM-CXOxn-)>C>0juY)XVO4X5y@eIsTeKP3Y*^d!{xgdHp}p;`_aA z>^?K>SToC2_1Avj1|US<_Je!Xt6f2~yM3JoeeYDM?15o2fztumsk6rclkKEn%|?G_hqS`K;9Rq8&L8MrGM{rnt?E)6ZdT&^D^mbD?}p|!1Q zzi&ZH%vD$0vu(fl%sKlQjbMkV6$=ZpQ7eHV()@Mep)k9c1)1m*eM3_~3U=o*nrMDmaHg%HS5fBxc&jrt#nw84G zo(z8Bu_;>>k+GM{6)QHxH+J^fIZ z(u8iX`t&o*t4HYbrSo$}!@j@JiBG>!^_k8eIK=Fmm8EVGO*qo@Bjh-U@ZWF>CmKo{SM0wTRoJ7h$UqY`HXkpUmogeWR2B zCniiIAT_H$CadaU=r;&T;5ikXT^gDR|DKk5Y|w4M8#iSi*T!fEOX&*+ z>jjT%FCdxX)LqXM*>wE0%~_Eo(8D_=p(Em>WnDy<6$JtD(&M}@gPA^->*#dIMr(eX zxgI53vQoT}{~gcL$zjPUe}b`RAB-ixiYQ3-2U)lgq#TO#C3*IWHhR8&c28w6LXmZy zh?cRSOl4a~3U&ZJ^6G7gpc8s*xie9XcsU`5YEJOO)ebG!@lkw(#xUsnRy>*&E6Df!eZ{Nljz zL%iM`MGN;;Usf;wvg??))e*-cDb^Am$;T^c6`;adK!m7K?x3{|M+D~M2?edCxqACm zso&S<%unhPFna4)L($HmWLS+;&fj8IT&-1z&MM_pN{TVJ#$}cBOkp;jtO+o#CUQ@JabWwW*| zki-QwdPR2KK#b0H3f&fQb?;SLLy1+}M#pkFBaztfZ{{AQcEld|7yNLG)KSlT>TSE714ytgH6NcC(Ann%Ln>D}@&_{XGi)Qnwr$%+hHcxnZQIVUZ9Af3f3525YVGWc{R7s`Z0lk?bIhmr zrbrVojzm3ys9FcUPRF!hK4_ay@H3;s>~lhlv?C8Qb)^G&G9IdY32P=5@vu@i%_RU{ zc=-Hl-jf-C?RQ0f-9K;L#^)VAOglj_TfpF?DVscy!x$#OCP^|Ac54XqTFbp|}hX!XhSgF+3oz9jI5 z)ZSi{)uX#f`>DfIRIxF_nKO%E7vO8f)e?8MB$i+FVk+-?FdcE>s{Ics`YukLm({)Jf+JO zxJsPGV2b$M)~95sX)mMK_q$f}}KTcm@9O^l6a*$D=rD$9LP}8+9 z^=-ui6KAeYm*}6|IFBr@6g8RrS{A=Kx|CMDJ;Y=oRv`E{@@MkWQR?I(-rpzc<9&6V zwh6VrwX=X8Otg!L;su^iCCOu}z?gisN~&cBJlEMME-8@^hjbVKwZ&EsDi;GjBsNd1D;w>4lbOo5y4AOe|;~hLNa^a5JLSN zY*SfmS?&*yR8 zfU_*xw(AA)Q@l=8>+Y%zr2e1Wm*eL@Di(TjXE+@@+$fqRdh|$4IiYi<_k6W9IM?EU zQH#e|Rq1P`HCe3z2I%s9q@0A=EM1=D*;=F2*{tr_8{ZuMe{M!t(TduXtDvaECGk16 zR<_aMmo%{~GO(XbJ0swQ8pXn1KwU?0%x-P#E-h*)<4Ib$H& z*rUgcfjk=X)#c;Q7Xd|Ct7RC%oiF9I+U4HnU;qf55D+KuvPYw|%o~(V`k2$jTh~po z38xXDH+Mis2cn;+)u@Jmg4^U!ac3s@cr;KK{?_{(1Dt*7^Ks%(!?uE0vIP9_y0)fVjdj6UTL*;}v)^W9WSl?&=)BV)Szez3J8gL;+Ukg9JHScgHs|A4ac;l9y?xK8`}B2VfpaK^$Yv z=Bs#|6DeR;vEF!%#{1P)vEcwb&d%WQgoclo4XIkJNs5@MDc_orV-wem3xANQ183tN zUhH%5)vNlKsrEk~TYPosc>y1VD(dkeCfh^wy}xx}s~d_buz3yM++{5Pk-fW5e;f8}=`vnK}LdBNU$_)q?5CZcA^G%nB0$ude8-9vd335&UbUqJ=j) zqWJXm4(@!&u5u5J2#q)yle`BRn=r%p{)Uv+ciH zg8u(uV*CHV1B^`Utp7c+{SV*)_Wvz-;QyuVO^SnSug!7M2Vj*s<>ILiCDKrh5A(=T zptZu#B3%Pp0#J)24ihWx74HZZ?gs%KlHx^{64Y^8upS<7w~s5_AOBTNV)*`eUb>3R zom#y%UGxtBXjy{yYT?pMRi0Q{O<)UhukGY;q?1>oS32O(xSFni`h2}3AOu}DpKMd% zs8p+-sW+Kx+_dXpjmhbp(*ee4jn(L2VWz7!0;aj1sc%X1@Qn6mtteAcL)=|Pe1Aw$ zJt?VgqiQ*NMe1UP%>Rn2Q5ZYbcOAoGuq^;fIT}-T(R?y%t(ukY*la%jnUjL1ug*;Z zzCe18F*^K0@gC4csN4=%-}6{KE^b#GMBXrdJP!%nahVA=4ID?B^&S{fNafJP>SN%#mtb@*mv!~kuxCMdu zs)v0rHIYCy>m4Rh%ZGA0DPCZY-W^d~87n4%<~d;1?}LOyi0fAU%-1WiZ#<=O7O4+W9g zy3Lt#8_SotvBeGOZr|babHOOErNYb1`7Zj8cG~%T4@~L;n6yOA5uLgGnd7Qpe7=J} zhO#C*W{)HJ_dgcTtAk*|rK?oR8a+xMz`QN0i$w9OrKvF#hd<=jyX_=OtL%hE-Bd?z8h#eB^#c8v%P6 zEzB-%pU5j)Dva#{@@o3Hv&QzeQ2YvQV$xd@OwxS0eHD0RsocCMIKD7(B*c8&a#S&L z>HDj0r|CtZmks3IQ ze4!2?q+87}p0uQnHwZXWBVLJq*X;A(hA1f-OU!UB%YKS|UnfKCfr;I~WxBJ{5qQ|FFX zdZ}=H)a%wM^78>XXShK9E?z14JgK9FhmEjfzDu|Anw67r3x{d3W;?&>JX$;KxdkMQ zg41d({g4`60jSg$RFYWE6U)+GuJl6tpK9{YGRRf0+LilbhwZ4rE*7~VG`5De*rHc9 z9MpV*77p#lrgBIv%jl9y1-4UUu=4=Yd((XOek|y!IzF6t{5TH8Kb%fP;ZATh zF6iP6X`O42Mas<;NFQ}(z7kX9b$=xxBfB>ZkOQw8C)UWh8xy= z4<^Ffq}`ON_W>+{Ib9%~C)<<(a!gwNIiX*1l1$5wF9P=-Gg<(ZLyT}ciXsfOviC~} zaPtx}c?~krKi~~*mrkdde#&<;X(-HAl`k3XN;W zr4kyaS9;@sj`GD9bm-%#wSVCdvV|Ry6)_ZoWuz04I1p#3hqwaRIX1(mYm@fvau$@@*oqZH7 z)e;w@ids^0TNuwiN~yUxF=T0VfoFCI$PnLPydVE5B9EPwCk@|NS<|63-{wwQ!-WwzxikzLV z-HXX9po&g1Z4aRtuan&yF3KG&L zVjDBaSmQ{R6;o7ils|Tswa^ssTc%$Yz7|IfB~5RJ=s}I5m+W-3LE#{-Or|7mgf3ND zJ|Yzufe)(Ie-3xV1cX`Jw}c2`3SH^YfO%TkW!0+PQOBsaf9_5ThcxHBvNPCX`b5#` z_K3wp@zY!N@%{x&K%cazfEvKM=lLyp{Gr^j&W~Fu71T0o!0QF{?JUib%K}-Ihrj?f zm-*6Ojve~mz1huMazxA!(g~E!vyuMLK#4WkiG$mIF|lN8-wSpK@o5Fx!2>NP8SK|h z_ORQ~2#sC8tQsTFjj85)s zeT+g>td;}T^WD_!Q8HtY?wp_L#-nbU2cND7Z&>-m*c)WC3vIM8WX7PO^^y*r9vt1@ zrp&+$?!rT*mR#WNZ9gB>bC@T8x;1}1ja%s*T^t$wjd}Nis)@8#Zpy2!;Z)-YOv=l( z8VyV0qt5w-*nk*lB-`Dje{LC*s~$RQoAa-QDMe^zx(BFPWY7MK1p?W4@_s)pX2e#i zO|l@a&Yc;3Qq<6@c|mPb(FD1FE}F@gVSd!4lpk#*W2W&PC8#Cd@yJj8+nV~(8P)?!iz3&3EgF7ua+vWn|UI9S@^9t z({KEUFbrXFcr*^yaq}~Nkzoj;#{=AVd?{{vI*dJ~D+Z?4RKGob^nB5n*$@QtN#tMp zoI^#uTKllKhn*{QA|P0ck2-&{ntxV1QFr=Z3i`t_;=pX@t~dVDOTTmXKdI<|ke+R{vz3)_MV5Nd$=V|sOIwG3-APBu_nc_v)I^Fvki+F z$>7f4{F&9@+e7#0l!tt^RXkt@81<~#>|``z`C5hItwgj%oc?=7US}bBhVJN~Ik1Il zUQ41X{m|ydGBwN6d2aoortwzc{wBl9s7g4Ows?|eCJ^XM>a1_p_JYD1W!^AxG0 zBZGZc_OTMPKYY4fa-uafw|mHyK6$>|KBk%PdXc9=m+o>2w{Lq17W9zLglgG14@6p< z2;Y6ZZeqRezbw&Mx6iaN7_G}CD?4TP(=n&_t!>dsouOjF(FS0RUGC@jh@W!EVqH_Y zWGZLyI>xR6(Tspz_)~w$gVj6Qa;sVUjeh|Ny;LwKIyT%4-CfY#T>F5swlni~^L`<~n_`)QUi?DQHOVp*b+iaW!}>FLOd?(@!ZAab(Y$Nrc0ChnY(yRz#t8-qPC0Tmj*6~3x``0f<~tj2-01pBV^rV!f#=P&_#wiNMEl&31EO{^lbaY z`usO+$8%99A|G#89@{J4vVW6}RsYA{^F2f^?QLzyA8FCwnb}bxAN?CEbDD=;cAb{P z>z+r}Umm1*{nEDvW$r->(E;%Q=JMZX(Iy;7Z&?b=DlKU?(|xYa(!-7Pw!c>q}w zIHpjo0{(G~;By*P2@~&KzB_i+T+d;k$pL|BMUpb~%opMH_G8TL@}rSPxgvJ|WKTm7 zc<};!nDdm(A7a*7LzRR~d1AFe!5%ZtQrli$>8Y#NwVen@l@c3ofCX+cOC&uV5@0c@ zl=K;W2a&%PmNKN5RuQ?~-;c`1G8(Rbs@kv3{-~wzMw?9?+D)W30bI$SGy6e1Skm8% z|Ne=rvVPh#kfqrt65jD$!2l@731ob7K4c__Lb3S|u53_22~p#D@tFRe!HIABt5=fm z^&vAY6&-wRW*)f9Et$?SqhnG-ts%Y31&R4ast8-Pres`U?v;?U7g7xF-?ai_7wg3s z29V#B@1~ra($(aVwLwX?y6j&2lR)@bE!`{SbXMSDZMd1Y(mYL^NVW3OVA+h!>aImF+7_^OwMLsW^*s_tln# zz$}J&JX?1}w703T9a8V+iJ9{3+CxM*9VW%uI2^t+?W6k$C@pBZefv6H+m#9PL&-Sj z_J!uo+bmQj{P;T%t9nPx6q#Fjm#Vjv*W1g)4E`E+8q~K~mls+$Kg;=XnnJs6uoAGf z;Egh#)K`1*`AcqS36PidqUbe2n4Cuh`CL_um`s}GVtN!}3ZgNgN}_%+TuW#!l{FgU zjSrgzylY1yDOn(d{B{HdiN#bvyI^Q)J`e(~TwB5|n*?$cB=+Eq0mfnXS|VW9-qtA0 zbWa`wmdJwir07xRSfvEuUKsBqHF`6k4Jjw))|IYdjgk71Wi*})sr8m@ILI81t%jyuomkdT0mPf4$*w!oGS-5{LU z&MRTe*K+AX%evS*F&&Kok>uCbaS41hZ!Y?B0i9)07m3HYtIG810HGx140=GyD|3Oq z)IucWfO`oSK45oxy2P3=760xSzoSRZ)YDkOc1jLrR7mwQte(aoR!=x^e?yT3P|af zP|{=b71dsqaVkkB=qzuoxI$7i_j*-TLO1sNQX;AJ_Q-blc@B_paxQbUaeXU-hn~vv zVPe2R9EkcloE*T}DwvC}VPpIm(kiyh{zu4)0QBYC8A=_SqTlcDp!1?ALunSL4>klD zG+2dLiFD%!Dj;H+UZl7qtG8Kw0iMyK-L$SDW64S{3QkJXdgI3orChCcvWH2_Rt2-{ zX6OJxM4)?<>6OTh5tt^wan!7$j<$;Pd_lvbQ^%z0`03D?}LH9~Hn zjk`n0{)!+&Fx2|1!r=nFeIeC}yf}#$!IacZabZ~L@#qbi{#1CgW^IfWd!qP*`DBCa zrkz{y&g;MCQMr7}ob1Z&5J%Nbx#uM~71adV;{D)$xyZ>NrU)bgRarugeW(x`2<$HQ z_;T^V{<$HyhY;draNgi5xbBd>r~7_*RKHBqoa^EX-vnYxP;^Lf*KC`XJfcTG1-Q>a z#q+E9u9 z`nzKChQcJchZyf&;;^O-fQeqL-4vF)?K|=p6%@Rn$esL?w`v7GB+Ps)rTfi}#r0PF zz6UE>4#UO>3XC)VTHj@DQlOH%2_{EiOHgd}tDe@6B}vS=_P8`->B&V~za{`g`ZR>Q zq1Ob<2{BEyfk1Zq-~MrVsscNt5s!>qcI3VyF5~$q@>pa(P#A*R6QKsNngMOv6p^a4 z6Xyg3<&Nz~_`tqtG3 zS?e^r8Ki&xHaTcFLwUZs+_}6riTF_X;OY9DOI+2=@ap|<9;VjW`b~NTb7_r5ml1UF z9%SO%Z6^uAFB1H2d^1b;Y8XWWy`QhlsLV+57#7&j1sX!e{_bhDRXEe__MhaWAv}bW zPTijqLN(-6j2G$JG8@v7XrXQTC5pRp(afa`arjU}p3pT0)*}_!(VTirGRw6b`#oc0 zZ6CiY4;`%9(j=jo5e>?miC2V<4By2Wby|rQcGoBX)j}tw`vMe@hfJAB1;R6m4j$Cx zfhHbkQ)iQ4!eWTEQ^sZz-k7@)%l05znw-|IBvIoFo zK+6u3$^&H^31h1B8HV2)#V_MeU_kS#rYF&XYnvP`oWg}2nCu51o5!%BoLY#$!M=sO zr?^M^87*3yRDy);^Nj2bC-C!+57gyew4L)v+!3NqS&ACC?hID@FMITk)?(V8HVA|d zmn?7~?2Hw3s*!z<5jxvyfi=CF+zF6Rkb zt1fNfB2mUG=|`u|(Kk?=8X{+kL^<+U@3*(f=KFbryD>E5x{SF)yQs1MsRTI%zZl0o z?Y82^an_XYY#u+>?5f#YHL)oUUZ_$Cz|}L)bx%pcN%q~+lHm?$2y-yD-89jLR+=uA zrN`ZjB4`DMWMa$E7ePP~8=2x}|2*GPU{B0=OI>_FMha4LrmVm%+N5ds=R3OT7@8JXxCpl4zR8m~&xRV}MT) z?2>H`iXBNDY+Z>LW2iUTooHSzVl+dxpZ#J8M26<3mUkz|Ybzp;of6qK2y_L)qNlV^ z{|MAg`M~ptWRe-SC<^R_ZD}&-m75{QNqDv>H7g5UL}n6xUFN%gYKL$G`3%Hb1XLa#&JM~yHf}Ai~A0heiCJc{6I(u zOtTdM=L$aqU(v2%N<8L>i zgPRU~B!Thui(Uv>Fi;Q#a=YW5ko5}uKT5sr-1?C7PWwdcf9I*J?3tTCi?y^z94CsiE8u62#Vgg z_3v8zjgz(DQc~C9LgqyDnj>+beca`O1w`LH{C4qn+yT_>ps%2kDG{6iY7_7zgJCkK z3%UDOJhTh?0J;bo@NV#+gP5EzUKw;M0$8HEftDAK1qNtnH(c13g>BT@(7iNyViu*l=s#-ZH$73EK7)PaDkdXR||d5ehV=J zCO9DY;-?V@_=jB)d{$ccZ=H>-10(0VPpF0-NAaq$TX5)SsR z@lDSqKiDVI+G#nW$mH5R1NV6AX*O%N4cgn=65FV4esT@;;Z_!@c;QVe4DW#LKntyPPy24M zlojreJ>ahL%-zP$64}o|T2Z~ivYQjfR#McbtG4_E@;Y%&rAK1m`ip;qejJ22uZ!Wn1j^G4UwHdDMO&-&+rgg};l5Jx z{{BzxHU53*BLby?z2+jTI7GG5pm*%;PX7NWK??r?D^KOR{)nWca* zBJ(kW_>jM;B>~&HjlmJ{>m}NR$HMdi!R_05>c{9)pTMlj1%>=!>(CAceov>z*XW4i z47kz%{2Ok8IRz=>QWi&zQpoZo{)%*`@hg_;MY#D7kVYCghsp+xi-s86A~R!_2h`IB zk%?t0PD7u6V$b#o2rn%GFfs^KJK*OENLE-ROtPfYq<;-drb8V23++H|>>YxYW!+1V z{qoHfC)KEqf42);6bC;v=DRTCoNwu{kxx*y6>HLRF{>J~Zc_K-T2V&$wq`>&>P$s@ zi($qgGlVirY(RWxZQM3)eLGi7TF9gb5WZkp&N)ZF38bdtBlwrBaUKDZ8KSm$6lb^W z4!Wh40X4~#UE=GKK~7#qtk>6J#hdByB94>Rl!Vr60~4!Ji?}u6dEBB9)KU(o2I1`S zc+^c;b8Z6Gp1Zm{m5-Il-3+-(-6CR5ly-RpI0GaTkDm{I0wk>v`}@DT25>@mG7YRD z2^|nYP|NF9K)k2iLxDJ_6|9jNC6A6#{($==to_omVz)Sc?wV7QXQhfB8sq~Z>T zGh!GWAPq)Sbsl2O&|Qhm3LMKGck7hU@_5v?qqZ7+WnoAh$?kfSWH=n8$Zmg+%Uh+A+eDb7-&`h zUB~d+f;0%8B{+YWVx{u>WxKs>3<*_8aV4S&IIb`)zN|_vHecMxEPwM9@DIUO#WHvsWhI zV|V69E#F5!FK++FH}OIm_&62bs7A$YVYeWb+|XTtnZB=WfEG-pZ&LB%OuweyOgnpU zOROy=OW(*1dTu-9!z=j)v2B0{#yN8L4k`>F(%kuK0lLmp)m4*r8fbIq5@|lG2R$yF7y}GJz1vqaQz0CRGkbe5 zMyzNCq#O`3%`r+Ug+%kdH?(MvxOUXKGClWqm%H@KfZ5Rvkm?IlGJMbRcyT#XVTve5 z>~CeV9;%Lc#=zK}1;=Q|gPg7>7uqphcZCeSfX$d>iITAHnt76Y;DxjA+VMDRwbHx^KI2xuYx_;?fV7#$aJ$ia*XtZgq3ry-;RBE;-xk-xs2%I z(Ulp6-%+qE1O{(Mi+f_O|M>)_a!>CxIJ=uU{L#F<2ezntPfQD4&^5gX2%M^d!MXh4 za4CHd69sbqD(d`kF!S{Ih~xg`jK=#j_fcSm%^KV0$-*IoovS=L1FszD(KMd4h^E!_ z9zE0olK;lmfEpn|RmKqg0;lx7?sT3!|3lz8(Ai>8E;}W4n)rS^rdg(VSr=SbnP^zp zp={w89p*v1PD_UJHEFVqFE|*Dd*S8Q3;_RzW-D|m(YHVXshY0gH5OQ#h71dqLp^ka z>4l6ySnE|pPP99@qh(IY(}8XJ!3pU_uSbpCUJvD@%=%1x&6S_aoT9jpc)Zb#LBu+1 zq}W5`s&@rU$3TV}O}Msro;YkL6*AK&?bC!|HqTSm`-KP|E->6N!S%`g*k3lys-v4L z%P*+Q8Ky~S)YMLNbOaRQn|l)RNyX}D2g*$fT!%59HF#ri+`5JpPs*^;5IGRM_qytq zmGtJr)hz%f7z}%$!J7g527_7lIe*EcPE+tOd&`!+TRD+$O}HOG!F_nPZ73sa4J=F! zXQ|s>%5XQAnk`i(THxFX4kr* zUD)O5VtJ7p+03$i^(O9k_AQLPj23rIzmGs31<_z|H4}9ezEmy2Ci#|!b>5;gzR4WQ z)O%wY)YL__x64XN9T{9pPo@Cu0*`JD!fpzC_Htsf+`+-yzF9g&?RLbDoeRqLqM`0Pz|#KZ z!P*{uO{P;E7KyV%)KCs_FA?^QlNpd^NwsuxLx!5|y~c3pyvEoH@k>tpRt%J}_r!Oy zH_t08DHdu&W)8V=@~a=oRUs3SdTyLDi2+mp;}M(WRUN?fa3@$AxA5WfZM z2MToi-5Lx3I+4-eF2gSNZ4^aw+WAOF7a4#aO>yBv!%1sLhOkG3h)tMQf@sjk@jzlX zzz2hIaf#(%4sqWM0Jz`&=5ieRnvc znE3UFh3?CB8{)6~M!8?sgW!smsM&Vj_4ZqaH`|L}iiF}<5BGOa%dvmTjM>bDQ=a3$ zoL?(61ZOi*nw=oM#suw7{YprEyVyMSOr{B<`&Le|av_ZtSb zIA{!SXZt(TmwUQN?ScLOA&LGU<_jz1f4^(x_#c=r9RDlkOOeL5<3=-*_lmCHm|(x9 zGbF$t^fZznbNRG2VbsRK9=|X;cu$^exnw`+;5GlLu4X!C{=2T@Mf%Lhle7R!lheP~ z;P$d*oAyezpPUTV=i>YE6YEz-gYHc0SK`0#GtaxrGpn!ymB-Z;Udq3hoQ?m0w^9y{+-Z=IUaYbs9M&9f#HDBONR}UvDGx)3GK>hsNf^c4cO?jP;z^ zB&y=}O@uY}%rh|QbwAVT+vz&YonX@+CC$Iy{nf~%drwikM)7rmHSy!X+oTiBE5ULk ziLAwEI0~xkZ?#p!Cek+LKwpx5-32%{)bH)kU^qn#SXpqdZSMpY_rwCkvC&?XI`@o;Q87janV<#9QuX>Hhy z3$I+)zgWlVVp2gL1KRXLFs!=V!4N{2rZL|=l9?9mG2;iDP-`p&TGuv|IWJyyVPBR7 zg&=`3(ays4X|Zdl0LZBw;k%5CWn?Ze=9-oEcXM=JZ3CY;bzBAjVS2!AHD`y|$6MY% zd9|EYyuSk~;JW2}?TszSfKP_%02N}>flQr@n2Ph(_x>kiu2N7h5g9Z9xZ+M{_XNVhh#PDLW(a4 zxW9Ovgvf)?z0v`wr?}6OINH(NKt|lw0~yImh`)77M_l5dg_*dZ0>hh8k}3O7t5q2Nae%rNkN&*?4wlwS=SL(qNt`T|`h2_0{`*Q|{u~d_ zDN!G3QU;U%10&fb!Oe1=zCU&}$fK5eF=*D}S0?1`6)(qwv~&rvM-UP_S^z@1@!jqD zGyr5rI7lejZEPVZrUQ>VJ%RKvGZ{*T&c*-8*hqt#l;u4P?d5CHZ$e8NE?H?Z5l{P^ zd}E;?ZcLJsatIK-sT$n=jcASrF%bh{Wa0QKp;tijfs5`&7nF}QuTOQ-#yV>cmyMk3 zt467gEuxuYgWRsK!Y&BeHNBV|QSAImels&nwj!$ZZl5*bR6s{;O~ZkV2C`CDv5`74 zdMSs|-4!r}%S#Zq%aL#~MCBSimzYW!nmxU`_AB|?yu_CH>k>+{TUpqT4UCjwN;WSj zu1-;)oyL%g2LQpFe5++6qXrZkOJ!(bu4x67)DS&2PC$VZ(XUOm7|W1IW*vth=`~mf z|LDjF(#tX&`PFxZmv8J^Mo!uND*3_s42UljgZjpFRVk5b8x-uI$>=JgeGkek|zZNNESJg)!3=b+5-2N0GjDn^EGDJc!N9y+h`qPdv7pI*@$k-U`m&i}7jLnX~~MWJ@Axr>Q|7!-ET) zxN2L9JO_rJa`%A4G+s$IoZw@__P|#G=r*ZFCPJAA>Zy3chHe{goSOAdJ@awAIDc4W zAu3Fd>WyYi3g{!lVhK9-&3* z9L1$D7;lPp_z^{dp4$R>#s{5QfD3&hsTtc}$>GEaSgAk@ogVkBylff4zx&f}QeosTEp%P3%%b9RamT_^1wM{0`vTMFE zO!CM7SbbT0Sf1Y*{MQ0umBiajoAR)D;b~ME>C@7C14AEIA25@I`CR#bv;T`97l3af zQItQ6ZIjpANn2)rG`~twTC3E)9A9T}U;q0Z;doE@f$d@$gYy>LH%^6Aw584neprB18Xfnv*`=liJfG{ZOIGV_ShL+`8 z@*q`m9HM0Rt?5FwYpT5)+3CT!*gIc%45L z;cNnNvr3zZQKxGlYXDD^7T|lU-Y-ZcfEoiaOQA^(1k#w;N0%}-A>AX^X9f8QineSa z??BBoQP>WIoHR3<5hM_u!gWf>z(-P=;Yse`On@o?8ZL4?mqe9h%3%w|!eW*b`j)_! zmjL$Yc?8hv3D5!?BcTOWoGdqXnRu6(Ca{o7g1>o=Ntl6C4())i8->XoSQTZaCwsdN4Iyb^ zk%(E#)jUrc>tak|KUP_0^4Pm?0DGG+BQ-5nlrE3o>;+a@%uDzA6PvPidk3ZT7RTtc zd>9;pQL%5}^&Wf3h8}Fe9kZ0TV~g21F#hU@wCuSF7SB%!N88i~{*{f>}^c3i@#a@R8DizVUuPq+3$P zyHIDyTu^Q4R(Y38&|av7Sho$kS2eLos zdOr{iz+sAn0=rAgNwoxy)_R$G&LW}^6J}1DgQBO(#I>4?Q-1$!9&$iR(rUuv>?%>U zb)w&+|M(b+xp8H3S`SDTTA~T2Kz4MkS3*KeY^zZYWCt>{3JRSKb7^*$%SixY!aM*< z-L_Cxnk(Cm;ZK->C8i@}YCXcZ*e!J=bI@6;i5eAD{8c5z(x~FoE~P@0m;Y0pZOJ+p zCyc?n6qXh%CiN_S<#K+be`s5{DP_ixjY(|`%MgtWfx$PvE+agi`KSn(5d?;bP^7_7 zzFSo)<~GYLpl(iaDFsp*JKh2#dYvvcAX? z8L9r%nXaIcox-%`#fn;gukKtZ_n>tuX#v7Vff-IH2)LTV*lVp!OkS|pG8A;m-1 zQXW$9yZO>5v-}Il^6Eur`p-7v(yqd^Dl$>^S}34UN&MeB;Ow@W_<%y#|1j%^@_PGDfdqWdYM!; zFp?3vD=^x289v@1|MVAtUdA7Vt8COzwyT&=N8^}K#ft7)PKL^M{L)$UFbt0VE?+6M zvM~JVD0Pn&73a;+s#|rdHyv~s2No1$r4D!33HVXWRJ~!j!$FtizqsiP5K*>!XE?J_ z%T6m`ld74U2Iv`(UHt}a*4rGMGx2q-M)skM)mq!M4!GO1;2(2+;gkiNQWk4ciOLg* zrbU46IC%iKurQ5g(cUeM3tLbn6Sg}ITL@zQwa82fOiS{dh1DpQ)y}&F^o<#e;v+$Q zI-ytUF+TgM(Qf{5=7L`3Mu4r>i|r5)Hwdef=PYq6Rf@2>Cz)XuTLGLhQ?a53l{Z`+PS0$+W?xP00zl?y`UP1gPYY? zj_9LB5kCuOqE*r8sr3jyFn-#{@o0V%Jn;IN`FvR`$@pKDtCMETL0v-LSA1Wh=(ggX zQsC7V)KhHU;|ZM$UljW^AgA1_*nh8H$C7n{-kr53D8VDbc*O@@ch`09V`{`r+cu+o z1&z}CiCgC}web-7AKQ(@UINzZ9?WOo^^%EiPwIDo2ikY0-3Mx$#61#aR*hD|R?tdt zS_@6tsh{NE3#o_$`3H0a+o1r8B9~(Kk)VM^Npq#O^A`K0)M3U$V&(ucY5Ht_Kb3SB zd{9dn#rz-$I%uyD8}Ou}ud{I4=8cq{&`JB9pK>Da&hdBd)%D5$olO6eH~+IEWo7%RTrnN_{x>gDqcc~2%m%)GVOmyZH!VE`tijnvF+Q` zOV=+g8>lo$^B8~G%W%ImMnYmi#s-?)E>}5Db3d#2kVZQ6Kg7IeT%ku+V&q_K{FT_q zaT49CMlbPLqSXHDigyN45fbDTmLL}^CsDsf(|Km!_6EmaOIzGcAc{<-vf582J5g@K zmgfDj>3l)_5+2NtyUwB&%#0Xb84Yv29AT4kpipzfFNCJ(0>>ol(?!_x`;ch$?0Dt? z?H8h}?T0SKDp$KUaR=P7&1u=SC?_$;BS=I0^m`RCc01yEY9`Xt8t7b3wu3%T50B6D z)92aM$L8bfNQ^51EnUr4dsN~)QtJ)Hxqs(thBs-c*WLno_^;=aYtzncw3^XS`{%){ zF%Xfy==G;zs(ZT2susGZ*JkqjhJ39RN&I>CyP_1fDJb)V_y32tw*afE>(+*8kq~KV z1f*fJ=|;M{rMtU9kPhjR4go<@=?3XWknU~?=@PyTD39-XJl}sj*Y|sIZRT2Y%@}ix zd(AoSHOF4t!lT_X?nB)5i|-*|1)tC6NV5XT(@#I{U5Sh$&M1vsaf|ZMXobokkgUAj zWzCG-W3pn=9E>2f5|xiJk$Syvi39=5%^9;nN-^dl6h%+GO-km57s-H>@6?5wdvGih zC$P&u2}cz*O1j2u`w))OMVmyIhz!X>Ga4Qqaz%&~?)tRZkkn*;YQ;)PpC_ICqksd- z`+T&IV5FvgUxonaB*>21*U;<}4Ej=SozRGjpA0gPFcZ!3LclV}ONk^Wr->HrO^-Ry z-{U+|Vc*$5djCjZcnmy;yYlNWE7`_6NmABR#YFr~_Rmruk#jc@jCF@r<%?NJm`2{h zMDBhNi85FPy}fv8M894k#s-TVK+&B&5=^5p(@#sG*6-jjz*+qS#!y36rf3vP?)tOH zrSm);F6>g2f8B?Pn)jO-?&p9O)zRlh;#cp5!1+GWqn&ZWAs4v-J z6=RP=@#!{#Fl1bog=}o!<%}l`IBLpu`eQ9=A6Rb9c__?d#}=7v+fOU)9Kze@A{-ce zW3;L?dSPO3igV23q2{6qWLLsnzUwdSwgTmzFocABY7i4*51M{!$tfR3sMz+tt9>0& zF(C`*5}pfth)^_T3#pWBUuJ})Wp>EjrBerH$2t7$!22*_JCGJzAVg3D`|!J5=M%Ey zdS<338Yg6f`h~bcrJ0k8uf+Z+iDtQ|$eAAIIQ@z_*!^oYLC+NHYYuU|XyP*Yo8Ajx zHtl@0_=bPDGaXEiaSl_IM*@>yH_U4A{gKjn5%V;+hJ{SmX=jgiNG&B5eyYSq%91i@ z*SVZ&99{c}ZafD@);9*)edkLn!=>U7-Ovf5{Y-82i*36m%48E=Hp*;MncX<6!KB5` zqUQ}o;r&uxJy&!9B&|4Mt(swEgmAPuq9=yCy!INU%vt?xQLC@K@dUn%2#)ExZVzHw(I^Oa6<14N7 z4#%$_`5b6uJLEA&@GEdrD`z|qHC1_O)wUiQe@lSb8!c_mTflB19-#6mu1%E8@fblr z+qV5kVJ}Kr^T5FHA^;ea;9OcWX;yTAXX~uwr4tBFxidrBVvM#y8CGX{J^5@psa%?W zbjYO^_wxgVDL861I^$Pg$9XgX?x)@{4NfkC+zn?dn=Kc?PNkjMXAg7c28h0Ad!;d( zXiP)$+Uv=$JYn@4J|=Jt7jziV^I{tb@=#afvE0vn08dI0eBJ7E)G(s}7W=jGp+BK5 zBX9n*u^BFFQL(gt#8QWKlZ~gHtA}>@PnL*B&M1S=J?=Q>= zy1)fwkL+&ob49$WR;X!$&HccSndpD938vSNa=4h)1^T7x5`8+NEtPb+t;^w(A%n$r zFIHa*RDXN<5v@!#SZtkjXJmze+PxL1-1gIFqN^hhynW~TR(ofl5z*L+sQc^tA)p0~VF=g6BskZv9&h>~9LBZh12oSFyTg@tJ96Xlw4VPtUwZ_O(05-bVV2X) z5~@jM!#4x5mdWyAZ(JqIaOP@N(Zak1DiZUBv>e9_zPTmF>{UVF0k2>FCJej(62lCnkq05_ISIfsQBkb{4Cw+%3<hHR6X8H~3@)D^l6GiJc9>o1S8|Z+nKi}E# zGxCa)6QJN?Z2*wbF){#18t9wo@L4$%s@=T2ff-0o$ihai0SAz?ve&UUAfyA8vNf=@ zC%pMqlN>19z|P9SR?ol=)QF6&m7ctTy&6D9K!^~aVBl;IswZRxDh#|U&CLx5;0K+9 z>e~_CcrS8rpe&HIH@*$_z_*Qh!07dtLk@&%F(Q$ir}h*T175hI?K7BM-y94S&k> z_wdYcuZv&gxwqj@dHx=r8Si!Ri#+!>{2>qH-@`NGy)OQdhw*W!Sn5JxBRLfmcNH*mU~_Nqo3P1 zoc@PAe-F>Bzri!hy$yfZi}ml}ne{h#zWv(#uliyAdw6EO*Tp~fV!gNF5B;$HJv_7h z2G6%~DZlE6?eF24?OqrE=;!un~yjRFCTKYFR1pY;I|CSyC z@2&Y$OMj6d0_lGT?|)H5;9um3K>B-y{9-uzdu#sG(qE*Bz~Avi;J=6>kl`=F`*&0k z$Z&7XdoBG%c>j(q0vYbD`BS97$QOaXBaFa*F-9QcU!1*v#~Fc)|AO~lWR1Yz(MI6E zcq5SMFT(qG%n``+FL*QkMR@;?JOY{i1@FH|AA!H)kHCKsNZ?;&kig$jNFejS;Qbd# zB=C1E68J9~3H*yZ68JkJ3H%q61hV`^c>j(|0{=xOfq#)r0)Iy*f&b!@z`sZ+fxlyv zz<*In;9umFz~7Nd;J;WU@GsIz;O}@P@L$C8hD6;x=Lc;vf%dHkZ#S;&2m#_I`gVkB za5u}1+}(B(D7m>6Zn zcffAaALV`sedk4k@_&eZ=P%xz|0wrE@;i3~l>bBayM_1W{71PT;@{2dp!^>LxSPRl z&VQ8qF^0Pv1eE_{6n9XNgVP`cIoJ-MT|GvYU$^h>t@6Vt{5tkJ=2k{Ot#e0xLEDS= zI{Kh1g!FWGO8I32@E^khwx`PjX$>e zt^4vvecXB%e^%peOXr`}_+y*jEX!A2>xM}KeqbaBeg&4 z<@S-+A6EHe!vp_(p1XUb^JjwHK63f9Dt|uJ0dF5!{8=x5KH1$-{y*&HkD-4@ng6Vp zKcDb`e?H^gQNlkH?9b=CJ4*Fuz1&isKdbWR)7~9r_`_cQ-1>h$^WC|`eleHqo~?wo`+n2RWJypc|U$_5lkWA&`!aj*u0Uag+J; z!vxA>0(qK03*V&lEUX|08Ca*q?^?QnA!vj*;04`(zoz#f2Ic>h^rpv>tJqf z@c)J8U;MdyG>fSUiYxq_p+!N|*+lQZ!ugh-{|}~U(4F+_6#c8N?+|d8^S{OLT^r1| zj~#FSgV1z?yxY$&82%NFKk9(4-q`wPLi{mv-_6A!jNX*K#n2Dr-<;o+`&IhesTb7S zPptil-Cr?yb9{&FTjbu%@^>rEKghkAdVfLgO-nZt-K2M@Wdzl@nFntB2le^;KTx~> ziMiXy9Dx58bH6;|_*^kyOjH3af9K!M}r0A2tefFB?L5CjMTgaIM| zQGhr=0w4*H0!Ra70I~o%fIL6}pa@U`C<9ags(=>&9e|F7wSldjj-@^TYCRX|YYjX!X zfX&@9sjqAP%X$g01=s=X3@l9UM7A?<1a)g?;ta4e*ReAO*ja;y3$O>+8`~OyQYR~b z1Hi#jAEYQfD_aAABftsZ3~&Ls8rWJ<+(JUg#N2>^5P0{9@}G70F5?HBKxJ-53BrQC zfq((XQ!oJ8^;ZXhA0T01X=HCq$O>d*=H|Au2kFHE&N(^7#YIJa?0hE-I58zQh*C-V zDCot5f*0kk$!jhGXy~$runbTr{$Nji*}C9#Qc(z>Hxv4bK88|AR!dgvI4;Za!4Ig& zDKB3uNTKa_*?}ut8=I>?xlFy7CVLg3zgu6@upscka1BxAn)?O~QzMu7~BzwLgpi3QGZh8`_ zyOtR+gGsGkWt>F9E{lzgi^6f>^R7p!_fR_dY$`Tks;y*T{(Zv1UXrtoFA2LGF8US< z_67l2l8Xw;1}4+c)zYiW#l|=1*J{axu;HLDMOBJ%RtTnzhcAMc_RwZ71OWD}?&-23bi>H#c^F1L-ZHE9?M ze4t*dn=gk=^0*i^5oe%9tL`FHaf)-=I4|{6M-=fOjaGVHmT%z20V+~opD8`Q2;@P& z2#Re5*F|68D^=SYlmru{*19cj}9)#EzkB}&xef0H;6WClRYExV1*K~h8Au$Qj4IrZZ$owl}V(N;{vw2t8=zD!#)Mz zcP?6JB~&8~^UO!pke*fA1PTw0G4i>V$_qKZZ>hthi9MUy<%&YJK{Cv_=v2`y!>6kX zwj^{@0=OfNQ>NG(@1~O`1SbfwTk}ykPqInLMD%rbn@&!}qDcv2yb?S2LCi}->&@1GS^SBUf`)yzH@E^;s%V>T7C^K)Y2Js?ZOPa0Ti)vo33g+R$ zDn(s*Nb~|R?KD^iw|6qPi?T>5`Le=$odB=JdVd8o>64{g9zgZ$QTV}#7&l>!!cHzB z#2(SmTE1$oU~l%*hwiU?+|CZpGL3uPuJFy=qbS`3LoChR1YP1HPR^Gw=GsbINQ}K- zEO)+_PfS4UqlQmLifcMEkM9upV*JH>!kFFlWCXV}AiD88R=;m4##M-MB&~OYk~>tP z&@NdOfvsefC&8o=6D!HN(`y|D^{xuMvNg6B-StTpya!*tL@K zyD+ncS7N;A^G0QcY0B1FF%A{PDoi(5vSq4}+}nf?MEeXCCu<~<>j`LMfdQ@TyvZnAkM zXh_Ru&|43$B{Hg%$BCH($}F>~Ww81bp>lHCeC#8lFqLh`UuGPVq(_jw@WdeIK?7TR zTTS;k%4v%5f~kK*aQVUan7D+>B3&q+W?0RKDLH#Y^QvWO-0?~3h1J4Ms>_}^f-V>` z5eE}E>j*}c9)9CRO~nC30(ISP#DV>kvfwFGJQ1B=L9ka6O{vC%Madb%ac z9Sq7nu^9;j@Q@)5h=xR-3A6az-tDN4C zb&c11?kl}XD>ouvL1C!$8-ZI}NPAq2MK#IqhWQTDtd?Tc&wF~_v5qBU8WMJ3`B|yW z8zW9lSXIcv_99DUl*q~NSQ{4#Rr91Mcs|POWrQX#$Lbl}XxsCn`a>6u+P;N>jEb;3}k zqMZ;kUIu{~n+pd|iXdzteURT~rh9*-2H^YV_xllf2^xE8wjfo9g-{t5Fl8e|4{3ch zFGqV6Z-QB$r|#zC9njg-j&CMwV`!WEk$o~k6X|`}d3%3@Ony!Pt6^MDpwlkAy@*h1 z7p>&TS*T3BR$?~`DrQ}xy*{C30`L_=OV$A1h29hEaXydqxHyv{89Kj9(II37FDDDH z&+n!MS`i;6AbCt3`e71~`X!@`iiu}Z9m^Zm9V9ugdB-RjmdB3l5uA@h&z-Rh6gXM)Wmysate=-b@_#wM&5{ZPuO(naK>hGJYbN1)!XvG`w|2UQteVGS0M20@p}jS7hy@z+x}D5*rtBpUC%#kCl* z%@4IQaQK90{g~EZ%2pdQv?1EIu@{)NQX^a1wIpj(dvc+8;``9OsPz?MIwZ7@AkdLVFf#_E|n8d069pZe3vq(Kk7rTs;d9>76=l94m+ z8u8)Nhzz4At`8}Y$9xa}Iy!~rZf}uP>%MJ5Zz(Kg z0uu-=_KsCoPs~~G2&?_h57E;2XTJy zI?Ptqo+BAEJ38w53GXOxtOxokV5Ji+;nWnRupO*n55i&#i!t|ywV=S$jO6ae!q|t} zEb}Wn7tHLtBNt6#QJkqNd11#9vvCj;K?r7$b0f6S=+I4nZW&7x7p>KK@(jDst;AM% zl$`LD4-=;pv&y_?j0{bW^aDz8nQZ+4lM*kKkke|TKE}WT3ix;9tDr7jSpv z4WmGj;={jupT7R_5KT0lgfBHQ^_?7(eMS ze%wX@S&|1>go+91mW^y?S+8EiSI5nBN7sK_pfoq7v|!jM#cJDNe`R_qiFGy+%iZYM z=0fP{9mmshl5V_I8R$+#!uFin+hG04!|=Cm_KMQwgK+QPu5ty23q)QVp9!)cg}e?A z)zkg1`@tJkB0aN82M2|Sulc*rGztq?cN;Ce1XRLBR>mcj8_su6^cqlO8voM2SVG($4sW?Nv5GKEwnA6Re8shNE%K47={&{&Gx1 zcfQ1pJx_)&z8~S=<4MSs`CjFLt%GYMtyUb;{`+hd`9M}up|2C@9_8h^Wfejy@-bDyLIBUx~g*0u8w3gdj@0(j;e!0dE4CKK=4W5EFxA#2 z+s2zg?=i=uKhY6vgMD%!y3B^_#hC#6h%&-<*GM@VESc@(XDy%E5Y^*9U#2jqKR10uC0{u{crhX}_~A4mURBw8!e)+rsYGv!5 z*4kfpC(|0sg(`;x^#Z#r{BS#%(NzZ>tJIJ*F*vl-TZ{HZ=-P##TUUdv_|;>>?(h79 zxT)wV&b&SaWmyUaeCBnOk7PQs#ui9KSkxO0E#3rCeVt_)%qkY%I?Rrn7!4N2HlIVK zo|Y608kxL6V+e1B+F_pVGtqBY_0C^GuY7IubwO^QH=6?AJZFFj<$J67Lb^7^7!)Ns zWI*l$x!hJ_L90wL<|;SmIJh!nX}rrG-sH7_eg*&*N>=fkMGy_vDDGFbgKAYR%JUYE z7HPM{X=@2oWwuNg<5^7jh1SoXnHp=J@xfFDjq(TN71^Z|JmIrLPLhkbezVR@J$U^I zKQTdPN-&dfIb@X>SkZVe`0^|KH?2!J--fEsm_$~Q%pv}ImKl|@g!@js)B;cU!Ss0v zp4dRjStrA8(HaJ-*6-;vY@t%uj~g&2Rdd+Mi>22DBAdL0^{Zk(v*#P&Vj1Sc>2o&?29x-hut5_5e z6jOfiOPXMvnNz94dCl;e35jBzui2z#v~IThbCMemRGM7G3wxYG)C}Qcmn^=>+E8rA zr{xdi7VGSW2_-YX$jJ1(6dO}~qk64-#M^qMU?Wi=^XBoJYCM@^+9NBS9SsR9N7I)z z`2C+C2g}kwXYV;OeCstoCrXsqPYmIX^7b?_zRcqa=Id_mLy;{kdocmfBEWkL8wPou z*P2v}wtILL^6|-aZUDX?A6eB-QWHTc?q)(P)pWjEuKco(5a^kb}7#U9eOWpY-w@#(9c(a~psB}Ud?eXiWxCQAZ;q=N=9WFnQj}C*@UnQ44 zZ5G$O+qECd&_03kqFX0bA}?A$k)4xjIT3P4NHSp_dRh}hIS^_z94UIOBGdfT>8ZJ( zu)e;QD=!BAVF3K~PvM`YBryBKY@jn0%t_0) z070kbwDSbLPr#;rRBjv%X_fvUzd<~T(X8-Xa;U^A=p#WvA?mJoo0GkEqIe1Q&Uw~X z->B9PJ1+)jF_06lwJnsBp%GyH`|W4B+=TFlY0VLVLJ7x{h|K#YhUUbBd=LQ~Zj95m zwec=JRcpg5j&ZLizQz+VOB7L4ca33U#K4LpxEQ4SvZL!gf{zmO(fDxo%4S!$rCLbG zL0p!sDvWEuaO%+{3*+!u{E}`X_2Jez|%0-bckAuHhg1))I5a)U)^4kz96b~v(=&11Mt&1gMMAZ-uoUQmh3ivs_mNPdZV!8#{&uF~E10+z z;d=9_w{u|7N?*uf2>L*nnFA6*fwoBFne{!3nA z%vLM$(;(EP7GXXjVUj*(oT-6liOa#x>+syoZc!&IF%Ujr!&qV* zb_cxG{n|W0H_~UHjWCQ4 zLCmM<;)LN-i&ybQ7(B6+Z~Tdm`zMYUFC!LHaM&JmMr#}gm`rwXOByA14b%<8S-bj@ z!G$QUyhGcy(+e&BXgX=a|CN_RejOtAwf2!Q7vE950=uwfKZ{aa+_2Ij2l$9dM0MCS zcDe%8#Ed@s#%VsEPDzkNffoOE!Z_86rX0?f=TI_v=xh|m)aPO0u%{9udF`GUV5M)X zl+%KRS0LO-Ek(O5Ln-PNMk^x1XZZ-8KJf1>8b(QDTADg)rNthT!{^59^oY1!WQ^4Xcgg}ah1M0nm=#;N>Sux`d7oq&`*t$ODk_aN53j2a zKfI3NHeQd`@_d^j_+6Ehj1?L6+J%~1xIo^yo>GmLe=yKT3w6*}(MOnjcbh>qNieRc z%p*v$sYBDq2{tKwD94oeJ48$a3X<${WW;+y1REC%OS7Hl2bhJJ)Z69luFtpiL|*jv zfvd7jBorg7Womd51OfsJ-Z_&gDgsM%Hy9Zo)e=5nG?@{s>>$uIZy0^X&Y)kH;ieQV zpIr!M0rDVo;Oei)ni_lCKHHBw+v5+Iy)J!SV#@@bm{>-Ho@&jtcnm`jydV4~z(*uP zCeCc+M77Zbr@#W36oUPge}^u&cW!;*sIxgTy4Q8M$tzlP7&`nD?Rs-lO00PlkD;b& zihnvefss!C76m8tL4>McPv=&G-vl8X6p26nWEe&>-PN4*$&q)`un!mHK}3sT95nYk zqX#o?B!{tb`!DNodQ18Z3evFu~i@)rGyDUH;oy+I2M|L z@JTP7d|B=19rj^euX4%lBe8LQQE}=PTiF!P(@|p4z@_gU@*-RYz{1|z!;hA1nM*{b zU)OOEsIni@8u6age%*a~FgLJ_jIm==La}J>!99QudsL$y0ssC>hW$HdC`sp;fFs6I z{1>dGw$5DUYuXPU)JEWJ@;zX4)|nDR%}25w->b0zxD!gC5Ue-a24T9wr*~-w8MJ+B zZ?ND3e`WU$yQ>9HPW*DB^KA?!SU;GI!Z*F8fNV|i?*SUero6@OyD}0yZEmEm)Sg(j zQL&^S9Y&NFuO23RNIhx#2KHsX`f#I*O!LIO7DGLUWO+neTq5)&7ZP0@ED=0{&LDMJ z+dG_bRU2&ObW6;IAdB7m;;jQ1oRr>(J9r0=4(XxvLZPlE9k0E)w3sN}9(cq49^DD? z!d4T8sa0i1TdG%k1M|~e@!jUI&VwP3a~Rusg(~E!3yO6*=F6=C+vU)(mU3etf;*$i z;7Ps6LE>P479FwKh6e)B-Hiq%rjVzhl>U2wGcE)TviB}2$8ze~5Hbh2XlY8Qeuv10Vi zhMR3)I%_5MoPv1)w4y@&Fm;f$WVpm*F`q9(-Wl|VFSk|QgL3QZq_iLqViYxT(6KNH zVqsMavUWIzWlT&IB8auW7qj5OJp{@1Rs5!uqJ`M5e}ets7V3lpkz=f-6E z9Llm6#Kkfk{nbgBfzKk3GsL2n^^MPtQ;3vnn@}Iwyvi${&1Eqpw_{Y@l+bx277b3% zYg?Q_y@s^nLpAqNZ2$tB(!wc{{wvH$UInX$Q^YwLEdjpN%kp7%4)`X?2;HM*T;|nz zTI>}@;;8xB`%4A&47;dGD8FRGzzZerSRwiWg}XR8;<)!hrYu0N4We^gBFGgFyazC^}01 zF%X(1auQ&GxU1awzJzhJq3qQtmt`3@P{x4d91Is}gwUI>R%E+EWyAC=?qNCo4D*H2 zOhIsybwU_68+MswhfURUBjzRD?6?h-P_T;w4pEYBVQMJ^)dIlq+6r@w3S1Ak0Y&Hm z8sbovrNzq(hKkf)=j7n^Dd~yI$W)JWvnaePQ!waW@J@rKU~BfI$Y$*q?V*!J-HDm+ z2KX-CpIjM*Pwsejc)v1t4N<`-L-pqO_40c7HmXm7xbjR$xaHXZ{EHQ)CWCK+DAZ-# z`@{=mVO9v=1P=z}DBq~^PRbWAVje#$3-u@PgfFa)NGE)>yje zr_dNHU9O9aB2=eF60P}6)gZD?L_O*Ws=)`C{y9?7aUnl0REo8P+BA+PM^-C_WvK;s zhfv^P3W4et47kIR{d@!0)2G2if}+b>83m%-Z_#!&?G$29x^kylH6Ix4e|bZvGrvKu z2bJDBSTc}F0MqEX^_1Wu$>sZN23d;?XK^``=jd%0o2wg}*<13Bj@5KyE~OpG#LbZ? z+7*TjJs*kbo2u6}PIu5|%?v51GZOH&M8-lp9~RD*ug?>KFFwah^x?qi_p`Hn&K!4w zawaXLOPif`fLkZmE-XR1TpVwcR&Yuu#BqaTTJ{M`U9nFq`<&%{2ybPs`{j zT`~58-1KqqxWp3}7L?AD4hu(NJ(ik`Vz7tgWh-p6tJJLD&XB60XJ^kT7X3R`$cg>% ztgp1V0}iBQ$q`escZc!X;8r8B9r)fT$fb~qm1J{)0h(l*Mw%}(y!SaFKlK$7aMdt3 zV^NdB)SfM%s}qo{s8q%BORnFfjc)&?N|cwmDny8CmyWYov^td30hj_QI4gLY57;fQUB1f>v|N-a~g4 zT6wW|vM7E}PG#&GC!t+r4);F~Ea1$&O>pw7doWk-=rEIbZhnAnPM72U(QY)mD3hlO z?rqE5x+0fmToZa;V}1R#Snx@EG*+<=H|RMgbYR9)vwSvOs_PxP>rC1v%rp&Ju92gs z?d|h{t3^i1CRE94?13!qFTOlMBac08kHveh`fS)>m29~~e(%e&66=TM=2ta4#Hsu@VSaakDxhFc z8hX(8rPvri5k#!N2~+`P{u-!qd-_kH3g}&k|4pC@1Ka=8K$Ty^R6wCApkS2WMxfk9 zj{*MgfhfO=K>1hX$sY!t{FPvn--Mgo#C6L38gBASpy&TQ+=PXhiSb|ICN)=KUiD5} zGJZm+#X%M2lk94Ra)reG?|U=7(|h^jA4Wt#MLjQxqJu(#eZ1sI2IiV znS!J1lP3=_O0}^MVB9cYfA462NT%k`;{(PpuI(>5;w`8(0UWfOFCWwHHgEQCo3#Ek zRW>}-cQIqo^JW*V{oOMGUq3P$^;*}y8owqJ_-kC%b+o7_$QZSIc$dOrB4u>6q$JE6 zG6E9Twu{ZV4wyB5zR!doJi8qGe3iI;&CJ95xM)hx-4WK^shzEDS8P0`ip<1nzaeHg z9Wq0Et!(MRkTfnF8}25`D)tV>0{#Z_3f4CI()Q^>wiEY@lCtj_*9Ma-HJMaOFhwuw z4K0o@wnkrlv~Fon2f z1iBB3llPuEqENx|GzY1Oo}$(UDz;kcGJ%3i_`g0IMY#w(3Hsj3z6e&FYE8;b_y`3j zkiS((mwVwkH6gjT^gt_>0OU7HP%sH^>tlu>6uyg3RP%r7~V@F@ENP#*j>%i(( zPH#c$hxkpT)7B~vafp1KJ5i)c(=b@K@!c@ph7Ic_>$hL3MQ+>CM_qqw6h8sJ2+GR)sebHF`VtQnQwMiqmK!8JnX)<2BdkS#6$U z*WN9?fqIizNJ39q_M8h#k^`v7qsvmj_#p7_O;#A54I|s^Ba#B(jDnI>;WIu ztc`hRya!nx)xTYs+Cx2~xWoq6vc}yslJxZ!TOaD6&eNB4R%Hcub+I{x%+j;8l^3)bJt~GB zAvDg@P;3h$V0C)bg1WvtJ4{OZIJ%uqRl?zjQH-Y)c7=S7v{KR}n0q#}YZ{oJ%;xtm z2#xA55TxTN8eb-e+WGsN3?q5PRS<+q@q7%pj*(lh6GW!B0s>MfhcQh;JuRtGE*?g_ z`BK$M?{2q|iz+G6(qWV89PU#hung^x06_v?%t=FvFhRu4VthDo(CQ)62N`R~pHv~+ zQ=T47v}tJRcWNa9rfQ6bS;(7ehM8;o(sr-w8AkUrzzmqF=Y;wg6I4#iyJ>>KX2-OB za>7-wG6WZ2(g&T4a#UbOG%?CvRj1>y`<{sEr;nyz9f-c$5W=?_ZKWJ&3sIirow9k4 zef?PO;Adq|tEo+XbW`)Pk! zqj^S=&hdU_@)}~|Jc-+E&8Lr>w}+82>`h&y>QtxcIm{c6 z7Jt{(ClC76N)f&ddhf(6;Vbb_LETK1GqucjNnHZ*pv_tP*B=`Yvw0;!Ijd>rq zS^SFiBhJd>{JJ_)37=R=VMtU+K8>Zo`l1j4-Rf%7pjG{00oED{Clkr_EBliYxO5Xn zb{H39@WX%#9wc{1zci)d789#pp-*-&JFy)#T>S#CAkz^MPu!7As!sQv2J<|e=zkHeMF3SCS;khDowImhI=ydu5cDE+lgevi_ljl&QAG0+u zxqfTwWEv8c3j#Wv;$1((GtMF6lsH~=6ZpN2jbpwuS?lu=d5V z2jC}9yw+Tpx=1(im~zCo*)mV{t`0uS2tJx(<>$kwHK+Yb^c2y}phBR4R!%kzGL@-Y#`k9%9q1zkTXS zl?!wTDr=1_@>(R3JAW%s!z-B?OXoGrytcvwfz7V1J{%iWQf`k2+5s;~F-MC$QOuT@ zk)lG`Oi74JiC34vWP<1J$S5z4Ix-GP;lZTrUDnhP%5{zL?@})W*gtig&0tZMiujLz(Ekp3nD9LcvkFPDT4g!<+W3m zKzvh^TDE@D(6cb-p5UB{f-x3TldAbw6Z^Dc2VUwGihc)g`}izI#Ko9SOrF4F%BPui zlVl@(FMnFuLYgRCRx&g;GfHzcTvLgPB*70bj@qz?^oTwyQd+^^ zd`1b|{kb4s*pwGDwHFEJA^%dPkI^ZlQ4z~DOx!0`Stk`cbJdqKPiy>p{dFq3vgny; z7@#|O{kaS2KD}&x>{-1Q-lqSM{n)alLY&rHtyatTlgYd|n32<=;{aX67Y(LF+O@$_ z?ckU334`4=KDlPvb*#J36RDN96km=Z0+EY1=>5LHi54jpDi5s~1h4%WFx)fg;`-Q8spRSjDD-CHP4&k%K1-^IM8*^2CkTM2R=Ane z6T+iU%2nR;2tUCTb8DSz47J@|E@{N8;EVZnX&$PUY^TjO!R%`K8gH$29gSjNuhCb2qu0&TkSze)cwQh8(^km)a2k=0!W|Y&rWtaiy;`P1+*}2oH7QC_R9-7$FFm-%Xu}oA@K&n)#b~cmVzxq`g9F@ zDylVo$LQ*P%C7iy9^LygqeQba;MJPa;no4wHFI$v(FkfXNhpV2@5w>&VKAd)C&2MPwP=CYxR< z6M~*@#Yc!brcz0+?i@PmITvOPZ`>414?^XE3x>X5_a@vNOR08`y7RDvkk4?*I`1L- z;R3f012v-LDl^{akkQwj{y> zA}E#RO8MbM!p4|tT1eCIhjHt+R$<&&S{0PIm9(zlzKXtdxH4C5FncRmr3mekkk|OZ zmk72U3yh~ApWx`?S%7+ryZo6ZGgl6K0M6EO2Bn9Y{Sp4hXd&}!$go-Pkt6xof`GH? zFL`HsF(Z#0E_?QecvJj2%uzdut?+||lW|=E)q-(_WAW~H=S~nuno}BANas*M7_I6M63Sl7~4FGZ=h)9-CU%dI#_S<0VZ-U^=PkY2)gtnEt zrp9ibJeeX@n$crEAXV@CHi!OZ9cEpzKaFp*GT4cGi#jp@4IVBEu^4@0#8X+zAh)_~ zYZ!(nZTO?MmsPqo(zpO||4?j%dr4)%yXZL?Jri^McShg!R@0yi5b4p!nXe4ny3z!` zMYG2=t(!-t1zvJ?kPqpMxP;3Ax+R>-Y~^0FC6E=#U5hb@lgG2TbXUaq3ijeniOx|h zT3(fk?DY0fD@s57xRaW@?7=Pc1)7oJAW60N!GKrvo45)-B8@ja{4Y_I7EoS)MQJp?~x+9%md5 zw<|DWyOf>7hnWBkye3}+pZa-zZp0{S<_Ntkm5uN|sq6P9_RfZ34VOF(YtQZ;KXHGH z!4fLmbQzJAlEYzV7wU8tXAd|d{v-w@d<|CjR&h@|Riy+2=$?MK(F>o0uY#zvN>y1z z`|^sSH6F;J4R1-=LOL-l&?6z!8Ea2qxm@qUMe<=GFhw}O&I`aAg@Iy2!rK3k z^-JI@E3Pb$m#lC>9^9@FadsinleI^~?3-KSD>DpMDMs#a#}= zn3u!u`^iH1)0|$KTL@e-&%{7A!hjAlzczUx!=|@Z51eN< zB<98r+HQgGp>I~!-kv8Tz#0uo!MFSrLGTKK5GRDCVVy_t1R*)M0d_qOX17o2$#Ca6 zx|)~SD77o1o0qJ(os&ZlXN9*GhE-IYo|Cey>=2g9tMLgAT0+go1QB@I69ODU?qS@d zBU8)tWM-u=bhB}f=!u<0TEZ8oH{UhpZ~7V4s_=xjAmmeY$XyWDl8ayD#88%0P-@cK zGSC(%QOrn>HH9C{o^--IdTTK75N4_&T+n!upvTA{LYFWCp4(=f> zW41ZdDvv)sl{DW=SoP=$??dv@FVH0ChPu8CVEzJlgP50Uap3y!Z`x_OJs26sIl3TE zeLn3EDDBG2zIw2yxRWLBCkxjv+N}-&EkESqPKSj7p&|X~u46e+mg=mM=P+5MuJs z5escmQtl>LH8g}F44qNpkLA`_+}FyWWre7+Wc@Z2lT`Anc6C! z{Ei(k`@MHRJvUT-DK9eTe;yl8DoM1@>-g;zJ&kySWKhB=r(&7pC`?maO_q=9dLE6s zwA4AnXSPrwen2vVt+}6-m`r@&D@JbhY6*+-Zs+Ytn_99Zf{?z_Yp9c0TZU?YmaKjX zlpLFDS$B(4h+kh8gGn&>2gke~Wckf))qSq&vhSD!hPq5-v=pLG)KaF$)iq{@V-)a$ zaXJs8`j^FEjsz7ZXWSn>YwRu6>aSWFmVUa8NwU_NweiR{A~nu3eS1obpC2*u5icPf z7dNyU(87|#Q^ABY3PP{hH8=Z?L?6rrYAp|xiI8TCd{H-};86ur zM>_9)++c{$Bs)7jJ2sw&%F?ecrk7wAXHn~1*o+^mX913#G&m*za9i`00B| z1bA%~{A;;OuUH%|ci)oP#bkaVkU;3NuiSKL7%gB>3)hg33Ddj4hOSs8?UakP6|I1Z zQ*hC7ReTYe1*<%mRd%@iJ~b=Yr~aJ-qIdu3=F~ie#dYxK*3nnck9HgrFuzl)1R^Ge z`z^)CnKbWzdO|Bxgifmc-hkjk^a;4nj4NZCf zr?s~Li@FQ;fDr_w5kXQ|X^>d9mzEIeZUpJ>ZV(V9RYXKmLP1Kp1r!jFQbH6-X_4;y z{_FeRdv)=C_kQ1Vd3=19;mn+wGjrz5fA{SCesY~|>0P^~pAlb5GXGWyn*56Fllk}I zwy<7mqkH7@`CGh!0)3#**FvLuyEGK`S%qTY384oziv8#cTtC+ohDj!y0W~k_*y9l) zqM>Y|xe%oXiHSU&GR~R$MpkTz*&^`oWCm zx;+sP=we|KjlF=rAd8!aIQ?@77gHN=;A>sw4Pk9T-pd#H#BRkD!Z2lt!ZP> zBY`JK8$pRKJ$+d9^2T>thZIge6#F;R;Z30hhvUleVfLr;ERJ{82Nd6t6EBdqMMQYQ z@n)}tFc*@)kD`>$ADe-A+dr3wXs$?Vym)i{UBD~f%*tu%OhMgNN9s(l!p|(N8s2qj zDJV@zbXQXHbqWds&9$LRx>Yp?t@VBz0|Ig|pF22|Nww=Z#}9zFoMbLS1b=A1TAbCk z3sk?`ghQidx2trYP^U2%)fhg-!dL{p{lim5`zoF*NSmIEHVeHVA~5}yg_@?8z>`_9 zK*6>}!O&1MpoLgE_g-BgPp{p?;9SS8d&2#r-K4Uzy@PNQPurGS(W83?GHII019du* zeVty{G_EBpyNu0n8bbG(o{+LT-Kuf#C39;;YNz9uBA z$-&pTCwm8U=cEv)-=V;>0^~a~FVsQg=tYHf`ti6#KWi`7Pdwdbngb&rZ%I83xAPO? z$TEXLZN0pq%WFU1dF~rzdV;CB%d^9ur$4{rG)MGae5IuG$1`IUannwwoi`su?JIwr zuIy;m%pHjyLNA?kUnY-Ix!U(iVHQMizTJP-WOZGBrnY(hK|{Yc)wk@`x{R@gpuY6& zt9SG6Ivzckk&O&UZ6+AsU~~!&@XB2omVVRdbGi*(XCp^8&z{WHo3SC6eB7+)TnNSa z<%-GUhCM5d@>r&aceJ1NUhYrWj7@#|W5dbik@(mrao8a9-26p14|mFmHvzlky)-gj zK1So7dpB=>6_OOGH4b*mww(N+sQ0<}Eq(Rmks;rUh~y8+gDd70?9ZGxHz=0dpQ;9# zw}^=?2b+7jiaUw;(qwxg8n{5BLOiUm35BQ53zf&z@vs$7SEGaZJvwZTHiz#uH}5 zmFzerTDeGgI$d!7rc?j9hO7Z^yxSv2gxVV{?D4W-$TVxn^OCG*VF`2T)LJW($`#_n zd2Z4ILseND4y$i{%7xh#MK{b-hU@T`>EgecT_58|47M}zaQG1iLU!US<4|hH6 z;4$pvvkT)|(hFt@i+n%A-|g4yxOGo!H9=7fhT8uAT6~h6P#3eNTlIIC7(8j7#fTv%xnS&KgS9+mg)cC)lS!A)gdW7Q!2PD$rY`Th&MIi6Eb zYN!e>6+@DSNcRv9UzQkFX*ur^J&E8&eyn$0+tTSBZ5ev{^L@H$)oJzK`p<%_6SKq8 z)83t=_iuFqPVhX##stm#@smdT43a5O8JUJTe$i4vdlET!wbb zU%3y_O!wVjbxF4}o{YPu$lsU9>$~%zT*gehDvY>edph9j$vt&C!v~Wt)J)3M>G#l_ z5)U`Uf6BaNnPa8ZfEMoO&K-d!wed8)WSJaU_$wY;458>kj8jb3Or(e;{92vlHc>=i z2Q%sj4$+ri;kjmxbjN+3k2w`MqX+d^?izpA7gKw;657UOomU%2l>6TAZJqhhBecY+ zDo^Qw_lo}Igs_^_@&pBwBdO>dw>$CZk!ah-BpKV&Z;t*c730N2sv|??cENWzBuY)M zGH>Brr+;o*ymIy4GuGn@giMCpDzRu13b!{jbfY)!Vf5Go0vArQFr9a@Hp~*pbf_0q zb=p;Kc9*Gx?a<)nOWF%36 zM;4lGx9}pqwJ^;)c)Nai<2g7xbzGpkBIZRuW;X_PVryzNBU}|HtBs81H9D8!dgFR* z9p?`}jcSn*<>1Mn+x6he*NDd~h7XOO#_=cXJ)#nS5HSC7;NZ=`9nC;bwn=kvst~(_ zeE#L+IQ`eYje)OKB2$Vd{{H?#8xc=r5Bl3UA(vqZ-ofx>DW2){TDZ@3 zQs%D-du6gAicVmbsk=ur3HJX!feOUv@ex^bMwx)rdsh zye@@*)Oo;>pA%hs^cX)`#GxjB|1n-*hg-LJz|H}>)wog0jKyF?eH<>;nPl^H>0E7hSkoo&6#(3^HCRaD=T zUKDp%MmoqEk8sSczd&1)wkkHJhqB<<|LHDSifhWqT@n7;0-Hz*)~Xs1Rp$QfTkj6> z-i(FPQk6{U1ng|GTxD_d3W_o&QUZXuNf;&}Hh4reFVb(cW%pxu-msl#niJb2DN`+$AMw4t79p7FgrG9i+ItTClfc z!ZzIgcw}sIBCw41kxTn`!zS@KRIF9d2UY(R_lf$;v~a&*$>x(Hakf5Zo$c84xlsx6 z&8OvF><$-cp^}y-#tuap3pf z7yLrN=zqIk08LH*()~j3-zFL`0NeThUn>k#OuLJ}wYvE4E)x89h2X#KVDVf33hd4m z|1_ugw=cy%jVu0XNAZ8sgaY!b=gM!l0{$WVe{Mp7gbP9cxE0{-aY^^bg|^$I?JsD*$N48X&=l+z2P%SUFig*}QV4_aprc=%#32iI_RT`X{JA=p^;)qB|gy*b<036mj+;OPFhv3ei1kz9#7VLg^=YCbE%0RXM!2gi26|PEpG1 za?d@|iS6-1{qoN_))&g-*xBclZlQu(4mGnQG*6E*^6kHu#k1!qr^Pj0nAZ3N)%gC& zt%_MbcFtOrOjT7Z6|o(EczXCe_}232>c;u&g@%b$!hy=|U%Nf^f0QF<9A=!UW|+rQ zX&YtfE-}=@1^9vt-|n=ov5BxgV$<|`v0_ja&{ofqV%3-IZ!;dSekWo-di?bE`XGlQ z(KJ76j8DqQ4JEd!ORJPqtsZ8C>jD?AcY|2(@7_ymRWhS3P0>^C=G>vQzlUx$Hscpc z0(w%g4PV;4Pu7ZS##Z`ZM23%53b+YCagV>%jP%H5QOm`Fu-$U7qS*M9QxGjz#R=ZDGj;4>&8`%RE zuWo`i@fExMruw+vKQx`mFXa)08W+>kqE~jVtu{hnC$Z~^mvodDo}p~B_J)#-@k_2; zpkq|Kh=RUe-li}?mYG;Heo^J(zhFjKi!O0{i{fFTeVH=a(byJvv74Bj*qG9Rj5(bN zU2EMH!}I>d(Pze#3DkOfKJv}HrR0b647h?Z;tHx8kcGZ)%PuMHJdM!EH?5r(&(kj+ z6Sr!2m}?mck-8tQR^>Zn5S53zjXhyAS}=Q; z{CWn(YpRmD-F1Qz>=CBH5m}{gxA@B2Zg!iHg$L1`exyKBF0x6P>Zl*jx&!3=J!y7}Ov(EH{6g5CawK{c;4 zH}Vjqb6%KTos*Tck5F`O*&(@kg?~s7;Y{f z@Nlo?+fg}~x8Oh6!;Py?_#|E*T{mmX?NrQ#=RBxeZy*xZWa7_I>YI17yDo=cI}8T; zXqjIQ+-ECdn)0f&io8P_KpeX!dlruYbyl+>PS_N_Uu&C;Y;;GMLSDH67NYTVN^XhkjO6L?gbZp#0sXBUa zN1tcW`BQ<^siGtg)e+C|h-8}4O#$PZqsYg39xYiv^FQFw?mNCAx@|wmb%Hj%EmmD?xB1a)rsyUl%u?JEuyC--|%(a zyXZbL+hj6R$hZA%cl@PYj%6LMpB*8I?ZYi9n z*S8VKAR4Q2koM)gK*;#%vRni+`Djud$%Dn(;;vx?Du10>+xz&a^PE_*XpqMO=>h%L zW>~^q6LXVKk6%d=Fk4m$|Co^Dx$6~-x_mUgb$cPwaDI{wN1jSRw$S9GAG4iVOV8-q zno*pJ3pwe{lyX(hVMhX%bFew^#^`HP!;y`_>T|xJlDw+cxox8y7pR&M{WsLj_!5gj z(amhG>?;meubsO`%xXlqX7UlKJ_2+JKla#L^_`GzvAVJ{za^Q^ zH@Zdst%S?%YvEJKFKi4#KeF0q3+M-=Q;-Jb+(x-OLrR9nf^XZ*=1(4U7v>o`HQ0nr zUy@wu;3*UkSSdM)vb%fYl>K3W;G4L4W2wQ9eixEKEBK47e$c>1qd~7H_eF#6m#+r*9yd*TQ-4;cSQ*nt?(Nj-Z&BA@vuXpp|Q@o<~DWk#lvU=wku7}o+ zs0UuOa{o$}*skD0ii*J(PU^baCL2WtQI3-PP)m_3HQIvj$7WzUIeoA^uHjER`8NJ* zPRfv^y_VVy4ltcI4FS1;#uANAe|f=1!?_2pFIR)qG8eg1dwXT0pE~J;zPIDYmCaO| zZ}{8Hx=V&~Dt_PuywUniYOYQdbR`+SyfZg8FB z&4kT=Srbgt-?#cWqkWi-;MA4zl+$?cLMP9!o!df6`I0}g+n}+5OE0=FG`bpjRyjxcP^>E{mdfv!tYRU z_!hoy^Ou-*ycIse39me*zGR$~8Lp{`6#6yx#z)6j3r=Vg=qD*YJH57n`DH7-iypgF zC!(L6t6?9)L>JnU!?jvAoaq<#DQ}>lCW_sYSna_bV%J+HipSnbJ{s@G`OQk{ToM`N z?i1l8B>ItO2xYtu7~FlUT5p=1B(&TbA}QG|Tq2+o>H+#V{|Z8$naecTB8=xUze;ZI8o9^elNl4io3gFRnC8=+|L1cV?z<)jpzxzpyD9m1q_4 zoQ4uBd6i#svk`yqK5i?ai{gz7t3O;!YIJj!+{N2lf0x-zeE>$ZrloA;j!+H>`#-!A zvN1Zy=JTvJisrsmM>%;h2cB5@yPXx4bUtmGIzBxV-(dCH=|a!w=6Co-JEu3nFE55j z74?KfW)UbjR&CrA^@~oZR!G1Nw+Kjn{d0Jdo{s3)H~-!Phw}jt7e$5Sywaw!BWI+~ zrAcV_Q&T}a!{_5Y#NHi0GnsvQBJlZLSg*A6h^(%OH8589o@#18Jjf_I+-+CNtR`yQ zqDp0JPunPHE;9*F)(`j9;^s}$tth_GNK*C4mNT||ZZuvXP?Y|xnCiiNw?EjyJr zTA->AU9AmN$;$ZDw}US*lv`;lK;+0K22-Dm_Z-tdO_U@Vypd>JNRr55E7#bqD7a(h z^-&`A0&&Asd-c|{uQ6U>(#`xT8<{-A=wVqV_dNjapd@Kkv+||3jH%&d z7MlA!zrp8=f%{gfBmvuK4m~TiP(BD)ut-m5LjTsuPch~L%5ke|2Hx`Pta@dPjSaxJ z_(xJ62Fg4}phHb2kb@@!>xx?Q`)}q1GI)9q&6nP-iyK(n*Kcdb%^uTp;De2LUJjFu zHcY>Au@+3-6Lg7WRpql}+U~$8o;etn4#ham;KriQBYufuQyL#yM1RGD z=6Fe-pvQNK@I5JEsUV$$Uo)XXm{FQ}Ki%Msqxi5FF?3IbPg4)`=O_7Un2PU`IImn8 zsd3VUF_b^?CccaQ;XlP&6kBeX{Nh#-yD8tR+bku@Uu$jq24Ac3iVG-&;2B5dqD$f6ubzmAZyL0ihI5@!i*MO~}~0-aekNh^acvh-7s8dEXxLh+@6=ewIxSt7LJv z+pusE%?@$b`$LIsN{Vx`{)?yWNoj+N^I0!Tqxn@dFD~HDnmJpHy&B*qYCTtKkeZRi zoRJ`qK)mOcNd4hKJFB-s6b*tNw9k4`qFidkhyG>z?xc7}X7RiG+tn@dWkLm_d_u0kaU&b1 z-C`3!KvR7@DcDrXR@Jt#iwilrx%=~_;{<8iO9lp!55nj4wO>85B{N8Sq@hUWQ*2Rn zt*LI@(D-w3p69h^_g`c!+MFyyFHVdxIs~lId-c=@yM1SQqY~61WfITLYJ-2tk*b_v zYsl>Zo|f?a8#eumG{U9Ey}s_@O1_4V>J`JtZVMVeDXeYNla4MNs)Fo68sj#<+@u(I zm-T*N{-Qs-e8Z-RacPTq*X8)yoXkav+Q!@Efd-TBsNyKO7CyhiH8N>YV*+g~&?$x8 z<0nqM@PIh6d}QpriBp82x^{;DDrt)c>C;;q=N<1oqu$SeqqZb*HewHs(js5C<<~{5 z=q>jq^qWjd;#eQ}9P1zr+&gGT&@ox?|N8 ztJAC4o&WR54JWSAFF|*r-`LoBZ85U7VB3=i1hzwc`TR1_Y#8l$AD116zP-LV4{3HK zzM(r4)E+GU&LD zBqv9y!}+&Pfg9~d3MB_a@hU9oAB;&aw+7Vs9ei`N!IdRQF^6tFMd!GQw1@S%X9$P3YJv&ZB44xMt9Tzn3~~`3kLk@62)`nfwY>bbIpqyEJNVFDr!|h6l|?588)p=WILB$78>RBp)k`GBW4%?n)FMl+ z#0zSE9F=dgv|h7>&oH4LC$mOrN8n!ddJ0RSSmdsw5-$l6iBHraK=oCLhL;PlixCqa zu?R;5#WyDA5*n0urK>;DqKgz-uAcmkuIJV0v(^|j3$Fz+-b^doIHJG0cX-b2cqmMw zC4?&@$kR5suh3xpd6p8=pt(ho~7JP4I&+FOZ^WNwtxlqY+Qdm6`_ z>HLM$fonu9Cc>|JXO~S5x;D#N{XXDm>Ll*NkXL+ts;a)yYWqsm=x%V&9K2r6K;7vv+rcxGn^L=!y1vI%L)RR^o+|po z`CfTI(AF~=QI?u^ye){{aLrWrl<@V4=^C?fx7>q-4k@CS*;$RRF98i_c51euA2ZAF zQt^@Ys#gjG1bK=a6R2Ii9O5q*pUVfeFt5b%DZ5;V(Z4~iMX|ay<+_tX7nd@xagpV2 zdlA7*86IuW;g8^~^$FvT9%5ypTM-GUiEGbdAzv1*F<6^EJj|Mh4XxeU7gLk=vKnl= zTS#_&V18rrnn(EXp$ zC@mu`$m7_I5p;_Kl21;^Aw&~umgDc5p5%(B2oak;2(79s5m-CX`ySNV+}$SHux!Or zHsiOU(icI{i>Io%_;K#Z-7@pcq$8&x9_pAWPAgA)hjyt-P5Y#&wCgW=bWUx3M_Yq%MSjgBb8sV+x`Pjwi+(Rt@_~h7^3l$# z?N!;jPXZ1v9E4TVx%&9s?x%H~G;$<^qKxQE1BV{<8wS466&}y@Nq- zwLrZA-Yf?)bxC1k9-9O(f(MH44xKB9q^FrZ)W;cDJ~67e!5B>jsP~PL9c#s`U+=S` z^6ysD&>4(>CIX_9J#zpII7|UXT1`az)QS-!)}Y1&G@)xJ-uOWplDmdXnkF7 z;RJT1ma3k1JDohFNg^b=RCJfT0lP}!SZ-Y&B*Xp}Vo!0- zh+Z9wO26eH)V#hjqMQ*`BUirk$jyD|k;C}-%tGLgk59iw=2~Az`@&uxbPRi@^owlz z%$uf;Gx5+aTs|D%*_leK!db1*fs-ecE&JYIfb(%4sd|_#I(g09#5X6 zmQKCkX*-!Gi?Dk?erKDhg6i1gUOL(@Dw!mXhBjcX`DI7j3BPc|Gw$fw;f85nS~&$* zchk#_Nw(%>G0T>I`Y!iQ8dkJSugeL=q5U4x5+5wMR>m;)nRbdb@m^$9DX!Dm-6Li< zF^V+8;YxT=K1Xksi6fKs`Qu=&HG;ZC^2Sj(+OPv<$}i$toVO)YOm z-gqy{>APzVy^n5UvY5+R z6~3ciGb4!SU~oaqitvD8_@!!?l?UB1-p|cr^tm>zcko6^xU>+tstv|2?XgF*~XNi{b0 zWD$)9*02r=%~7>1i)$U616}Tn!lO$pso(FDgyYsKy`0_H*T}_vz)&=_;t;V+-jPjg zkV=M#@9ZkAQzpMXV1N>Cc*RYsUq>p<(0dK4AKO$X+^7t{5}Pi-B&-M{Zu}T>>6w9J zvm!Wo_VUo6k0^XB@<;W`y^c8LnJeQNjA`{IgeF)7xiSF1{#rEf2sZu9pQ?^#b! zgTgXOp&yag>0Ixh8_i6J{iMHd_!Jx#5gcpXnHLrmWOCA>($l5TK2Ydf+&0kNIh4;xesh#uJEkl;}_>xla-jVaiVJ8YHiodqfjFOHO9fOMul(O;`od+^`0{~?gZ8y zkcTmEcE_g^@Obr(8+{?iyZ_dak1kZgd}?IwoJ;KC@z?szOVf#2TH`BQF>JQ>yo0Gb z*Tl$ZaeVz=|@hhlgpideu^_Qc~vQ_GKnOJ#2*03qpe>LcFEq{w_(L@SbK(J-|{byuiO6cZ*zUqKBES(JSk3A-oZvAH)+z@9Hb?^Wca-vOk)sA*`F ztOM#ubTJa2NZnRT%iyua^H%mb(oiY$qDQ0w2l^`RGm$MI^~47mX_wr=VhsKiP2fsM zk<@Yro<$u>;##q$i~oX$yeI8;p7SKp9>X{JA7g_u21o0+j2E5lYnhq$wtB0eA3jI6 z-(}wn=-GZ7kwmw}oM+l+)v~@tUBVrL)(=;hk+W7E!A4Si;;9TMehbi zo=MGhpoZOGxmsV4TB`?xtr7ZsL5o{*G`8{MJGflFOl_)~~Js-OQxEnm4TXuMIh~9J%pt zcTdj`mZ1<#VR~&+lqv!g6IEtyahoQ?D!C<=OKP!L@I*>Bsif z7VJ$d%F2{aKH8JqHX|xnnvMMaD$3Y50(2r6!OfF<_JjC;kUf9@DE>b{KmQ9ZKu=le zKd=IX0086v{Fqi$!UsSu0KOX!GPAU{brR!R1zPrkY%RpNbm7WiWfy5n8{3}@?j5COD+5Wf(V4`k&AfM$3* zyV-+;1Q1++NH+^BVGWrZ{|W?t6XUY+@Nf|p6!iA?7Vw4&IJ;R33Zc4okQkSi>69_Z0 zshP8KqUl{-|LL35y!1%!selSW40u_d#g&{%) zqJmh107n5_(!by|{s*q#2K~n6?4|{HPTbnf*~$v!1;AZk7EDM00u=!NGubb;e@BT5 zVwUnZQ~#I7o4P0~|G%5>=!gj@%s62gXLCf9>fWGeF@y`nfTTEyPJD56Ii*fnz zTUc6|dOCP;iEBIk8g22<+Bw*Y|MTJ(pWuJV`pe4xA^{r)SY*Nf+>YYJp#P(v|2skd zm4kp*C1PCOm<)5KeaUa&QU9^4xc{3?#RJ^x!9+B$=9rk~mJ!D61uz7RfktJ zT);nI7_eRbhY|mVFZbU9oJU;z-`*-dZkAR6WDx`mC&q-;8g!XgTufWP|n|J!0TTa?|;&u5Db9!?=%2t@)!Q} zA2bvMEd+qC{y{?kFigOeu0Lo<7y^TJ{Ra&JMM3~nr9WwKBnBn$PZ|K5jV%uj`-N2h z`#3Nd3PED&3yGe;)_% z{<^O9Ck>6l0L%YQ!^r!Keke57ykOu2#Xws9&I^V>p?~oQ;;epfFbr#5FuZ5{0ic8d zsAGT30qBP~s~=nlh3yZ37XwlHhkj7NHY^%uN&liB6pFPjU??yWE3UwRdx2|-f6RfA z_ZR(O7*w`Db%7%gXXK$V*Bt*Chne*+`XPj{{Q*S_oskCv%)qh(BkwQzA+h5Wa1a#e z-SmepU?A!-Sogo%0mwuDML#qc%MJ`L97`84fYSCC{m^IiLxBIrdqzJv6am57GnlYH zs~?~=wm$$~46yp|wt)cvRRD|b4;n_^U-W}QvBm+s2qCPs0>e>IFjm|H@`V1PAM8vn z0eG=(17pqrta&l={-PfOg6$6k7>&8l`G>s-Ajq+3fIP@w^g|-CeF^Yl@O}T3hk#(` zFpRvv=y&Fv0WvWZjO`Bu`ivcbyuX|uNH830UBCb@wjE$31P#U7gBW>d^+Q6i{f6N^ zGY4=Q!O!~lFXspHjLu+y_e_pJ0rd!$9e{o?>|87aN5am;Gr)VsM<@uU()hzifIK(` z`SW+b0rJkA=Ri>e#~@z+J`Rim4(hY^A}|=WzmEgtA+h%nh8J5GFbZe`hm~^x{Sa_$ z8XSp+Vx0>BFB*)s_kjq9oXsx~B(^Vw;3)8!{RZ%2P%eMB1B`~Cu+LRMKjfKO3Jz3| zSZj*mJ#!wR;cx&<_>VaNc_{3-2lRvfg%>yp|KtS{6Y_8J&YYoe6#PssL8DOE@`QlW zQ3%WDfPQCkJD?u|JJv9~*f~)M*p=Apf{_Qu-h*&J7i=29dnOJ5OlYAq>jwn`-xBz9 zO@Sa%>7dwW8grJBsx&UeDOiqNOg|KTM3@-}H=R&}VjDdXrJ%)sUJb5N2;b;hU zF2V3($D|Mh$YR)YU~=}E{egx7-;(%qUI-X@MrR20FXuTFa%N8hOMfP>0la7Y0YN~| z?hh#BOic(>Vc2Jn5WtHa<3dm{kaV!@KmaujHVvp)&(uu-?^$^;8hq3jvy(IV%uA4Trr} z2+V1VH7~%6{Y(cu34zbV1|ScKy+453;>?}~s#EOq7sz10u{C^&Cix}wZ>F#0b=JD(8 R2+T5~QN$b^vZ^ inport; next(pipeline=egress,taā€ā€ + ble=5);} action for TCP connections,icmp4/icmp6 action + for UDP connections, and sctp_abort {output <-%gt; inā€ā€ + port; next(pipeline=egress,table=5);} action for SCTP asā€ + sociations. + + ā€¢ If any ACLs have tiers configured on them, then three + priority 500 flows are installed. If the current tier + counter is 0, 1, or 2, then the current tier counter is + incremented by one and the packet is sent back to the + previous table for re-evaluation. + + Ingress Table 10: from-lport QoS Marking + + Logical flows in this table closely reproduce those in the QoS table + with the action column set in the OVN_Northbound database for the + from-lport direction. + + ā€¢ For every qos_rules entry in a logical switch with DSCP + marking enabled, a flow will be added at the priority + mentioned in the QoS table. + + ā€¢ One priority-0 fallback flow that matches all packets and + advances to the next table. + + Ingress Table 11: from-lport QoS Meter + + Logical flows in this table closely reproduce those in the QoS table + with the bandwidth column set in the OVN_Northbound database for the + from-lport direction. + + ā€¢ For every qos_rules entry in a logical switch with meterā€ + ing enabled, a flow will be added at the priority menā€ + tioned in the QoS table. + + ā€¢ One priority-0 fallback flow that matches all packets and + advances to the next table. + + Ingress Table 12: Load balancing affinity check + + Load balancing affinity check table contains the following logical + flows: + + ā€¢ For all the configured load balancing rules for a switch + in OVN_Northbound database where a positive affinity + timeout is specified in options column, that includes a + L4 port PORT of protocol P and IP address VIP, a priorā€ + ity-100 flow is added. For IPv4 VIPs, the flow matches + ct.new && ip && ip4.dst == VIP && P.dst == PORT. For IPv6 + VIPs, the flow matches ct.new && ip && ip6.dst == VIP&& P + && P.dst == PORT. The flowā€™s action is reg9[6] = + chk_lb_aff(); next;. + + ā€¢ A priority 0 flow is added which matches on all packets + and applies the action next;. + + Ingress Table 13: LB + + ā€¢ For all the configured load balancing rules for a switch + in OVN_Northbound database where a positive affinity + timeout is specified in options column, that includes a + L4 port PORT of protocol P and IP address VIP, a priorā€ + ity-150 flow is added. For IPv4 VIPs, the flow matches + reg9[6] == 1 && ct.new && ip && ip4.dst == VIP && P.dst + == PORT . For IPv6 VIPs, the flow matches reg9[6] == 1 && + ct.new && ip && ip6.dst == VIP && P && P.dst == PORT. + The flowā€™s action is ct_lb_mark(args), where args conā€ + tains comma separated IP addresses (and optional port + numbers) to load balance to. The address family of the IP + addresses of args is the same as the address family of + VIP. + + ā€¢ For all the configured load balancing rules for a switch + in OVN_Northbound database that includes a L4 port PORT + of protocol P and IP address VIP, a priority-120 flow is + added. For IPv4 VIPs , the flow matches ct.new && ip && + ip4.dst == VIP && P.dst == PORT. For IPv6 VIPs, the flow + matches ct.new && ip && ip6.dst == VIP && P && P.dst == + PORT. The flowā€™s action is ct_lb_mark(args) , where args + contains comma separated IP addresses (and optional port + numbers) to load balance to. The address family of the IP + addresses of args is the same as the address family of + VIP. If health check is enabled, then args will only conā€ + tain those endpoints whose service monitor status entry + in OVN_Southbound db is either online or empty. For IPv4 + traffic the flow also loads the original destination IP + and transport port in registers reg1 and reg2. For IPv6 + traffic the flow also loads the original destination IP + and transport port in registers xxreg1 and reg2. The + above flow is created even if the load balancer is atā€ + tached to a logical router connected to the current logiā€ + cal switch and the install_ls_lb_from_router variable in + options is set to true. + + ā€¢ For all the configured load balancing rules for a switch + in OVN_Northbound database that includes just an IP adā€ + dress VIP to match on, OVN adds a priority-110 flow. For + IPv4 VIPs, the flow matches ct.new && ip && ip4.dst == + VIP. For IPv6 VIPs, the flow matches ct.new && ip && + ip6.dst == VIP. The action on this flow is + ct_lb_mark(args), where args contains comma separated IP + addresses of the same address family as VIP. For IPv4 + traffic the flow also loads the original destination IP + and transport port in registers reg1 and reg2. For IPv6 + traffic the flow also loads the original destination IP + and transport port in registers xxreg1 and reg2. The + above flow is created even if the load balancer is atā€ + tached to a logical router connected to the current logiā€ + cal switch and the install_ls_lb_from_router variable in + options is set to true. + + ā€¢ If the load balancer is created with --reject option and + it has no active backends, a TCP reset segment (for tcp) + or an ICMP port unreachable packet (for all other kind of + traffic) will be sent whenever an incoming packet is reā€ + ceived for this load-balancer. Please note using --reject + option will disable empty_lb SB controller event for this + load balancer. + + Ingress Table 14: Load balancing affinity learn + + Load balancing affinity learn table contains the following logical + flows: + + ā€¢ For all the configured load balancing rules for a switch + in OVN_Northbound database where a positive affinity + timeout T is specified in options column, that includes a + L4 port PORT of protocol P and IP address VIP, a priorā€ + ity-100 flow is added. For IPv4 VIPs, the flow matches + reg9[6] == 0 && ct.new && ip && ip4.dst == VIP && P.dst + == PORT. For IPv6 VIPs, the flow matches ct.new && ip && + ip6.dst == VIP && P && P.dst == PORT . The flowā€™s action + is commit_lb_aff(vip = VIP:PORT, backend = backend ip: + backend port, proto = P, timeout = T); . + + ā€¢ A priority 0 flow is added which matches on all packets + and applies the action next;. + + Ingress Table 15: Pre-Hairpin + + ā€¢ If the logical switch has load balancer(s) configured, + then a priority-100 flow is added with the match ip && + ct.trk to check if the packet needs to be hairpinned (if + after load balancing the destination IP matches the + source IP) or not by executing the actions reg0[6] = + chk_lb_hairpin(); and reg0[12] = chk_lb_hairpin_reply(); + and advances the packet to the next table. + + ā€¢ A priority-0 flow that simply moves traffic to the next + table. + + Ingress Table 16: Nat-Hairpin + + ā€¢ If the logical switch has load balancer(s) configured, + then a priority-100 flow is added with the match ip && + ct.new && ct.trk && reg0[6] == 1 which hairpins the trafā€ + fic by NATting source IP to the load balancer VIP by exeā€ + cuting the action ct_snat_to_vip and advances the packet + to the next table. + + ā€¢ If the logical switch has load balancer(s) configured, + then a priority-100 flow is added with the match ip && + ct.est && ct.trk && reg0[6] == 1 which hairpins the trafā€ + fic by NATting source IP to the load balancer VIP by exeā€ + cuting the action ct_snat and advances the packet to the + next table. + + ā€¢ If the logical switch has load balancer(s) configured, + then a priority-90 flow is added with the match ip && + reg0[12] == 1 which matches on the replies of hairpinned + traffic (i.e., destination IP is VIP, source IP is the + backend IP and source L4 port is backend port for L4 load + balancers) and executes ct_snat and advances the packet + to the next table. + + ā€¢ A priority-0 flow that simply moves traffic to the next + table. + + Ingress Table 17: Hairpin + + ā€¢ If logical switch has attached logical switch port of + vtep type, then for each distributed gateway router port + RP attached to this logical switch and has chassis rediā€ + rect port cr-RP, a priority-2000 flow is added with the + match .IP + reg0[14] == 1 && is_chassis_resident(cr-RP) + + and action next;. + + reg0[14] register bit is set in the ingress L2 port secuā€ + rity check table for traffic received from HW VTEP (ramp) + ports. + + ā€¢ If logical switch has attached logical switch port of + vtep type, then a priority-1000 flow that matches on + reg0[14] register bit for the traffic received from HW + VTEP (ramp) ports. This traffic is passed to ingress taā€ + ble ls_in_l2_lkup. + + ā€¢ A priority-1 flow that hairpins traffic matched by non- + default flows in the Pre-Hairpin table. Hairpinning is + done at L2, Ethernet addresses are swapped and the packā€ + ets are looped back on the input port. + + ā€¢ A priority-0 flow that simply moves traffic to the next + table. + + Ingress table 18: from-lport ACL evaluation after LB + + Logical flows in this table closely reproduce those in the ACL eval taā€ + ble in the OVN_Northbound database for the from-lport direction with + the option apply-after-lb set to true. The priority values from the ACL + table have a limited range and have 1000 added to them to leave room + for OVN default flows at both higher and lower priorities. The flows in + this table indicate the ACL verdict by setting reg8[16] for allow-type + ACLs, reg8[17] for drop ACLs, and reg8[17] for reject ACLs, and then + advancing the packet to the next table. These will be reffered to as + the allow bit, drop bit, and reject bit throughout the documentation + for this table and the next one. + + Like with ACLs that are evaluated before load balancers, if the ACL is + configured with a tier value, then the current tier counter, supplied + in reg8[30..31] is matched against the ACLā€™s configured tier in addiā€ + tion to the ACLā€™s match. + + ā€¢ allow apply-after-lb ACLs translate into logical flows + that set the allow bit. If there are any stateful ACLs + (including both before-lb and after-lb ACLs) on this + datapath, then allow ACLs also run ct_commit; next; + (which acts as a hint for an upcoming table to commit the + connection to conntrack). In case the ACL has a label + then reg3 is loaded with the label value and reg0[13] bit + is set to 1 (which acts as a hint for the next tables to + commit the label to conntrack). + + ā€¢ allow-related apply-after-lb ACLs translate into logical + flows that set the allow bit and run the ct_commit(ct_laā€ā€ + bel=0/1); next; actions for new connections and reg0[1] = + 1; next; for existing connections. In case the ACL has a + label then reg3 is loaded with the label value and + reg0[13] bit is set to 1 (which acts as a hint for the + next tables to commit the label to conntrack). + + ā€¢ allow-stateless apply-after-lb ACLs translate into logiā€ + cal flows that set the allow bit and advance to the next + table. + + ā€¢ reject apply-after-lb ACLs translate into logical flows + that set the reject bit and advance to the next table. + + ā€¢ pass apply-after-lb ACLs translate into logical flows + that do not set the allow, drop, or reject bit and adā€ + vance to the next table. + + ā€¢ Other apply-after-lb ACLs set the drop bit for new or unā€ + tracked connections and ct_commit(ct_label=1/1); for + known connections. Setting ct_label marks a connection as + one that was previously allowed, but should no longer be + allowed due to a policy change. + + ā€¢ One priority-65532 flow matching packets with reg0[17] + set (either replies to existing sessions or traffic reā€ + lated to existing sessions) and allows these by setting + the allow bit and advancing to the next table. + + ā€¢ One priority-0 fallback flow that matches all packets and + advances to the next table. + + Ingress Table 19: from-lport ACL action after LB + + Logical flows in this table decide how to proceed based on the values + of the allow, drop, and reject bits that may have been set in the preā€ + vious table. + + ā€¢ If no ACLs are configured, then a priority 0 flow is inā€ + stalled that matches everything and advances to the next + table. + + ā€¢ A priority 1000 flow is installed that will advance the + packet to the next table if the allow bit is set. + + ā€¢ A priority 1000 flow is installed that will run the drop; + action if the drop bit is set. + + ā€¢ A priority 1000 flow is installed that will run the + tcp_reset { output <-> inport; next(pipeline=egress,taā€ā€ + ble=5);} action for TCP connections,icmp4/icmp6 action + for UDP connections, and sctp_abort {output <-%gt; inā€ā€ + port; next(pipeline=egress,table=5);} action for SCTP asā€ + sociations. + + ā€¢ If any ACLs have tiers configured on them, then three + priority 500 flows are installed. If the current tier + counter is 0, 1, or 2, then the current tier counter is + incremented by one and the packet is sent back to the + previous table for re-evaluation. + + Ingress Table 20: Stateful + + ā€¢ A priority 100 flow is added which commits the packet to + the conntrack and sets the most significant 32-bits of + ct_label with the reg3 value based on the hint provided + by previous tables (with a match for reg0[1] == 1 && + reg0[13] == 1). This is used by the ACLs with label to + commit the label value to conntrack. + + ā€¢ For ACLs without label, a second priority-100 flow comā€ + mits packets to connection tracker using ct_commit; next; + action based on a hint provided by the previous tables + (with a match for reg0[1] == 1 && reg0[13] == 0). + + ā€¢ A priority-0 flow that simply moves traffic to the next + table. + + Ingress Table 21: ARP/ND responder + + This table implements ARP/ND responder in a logical switch for known + IPs. The advantage of the ARP responder flow is to limit ARP broadcasts + by locally responding to ARP requests without the need to send to other + hypervisors. One common case is when the inport is a logical port assoā€ + ciated with a VIF and the broadcast is responded to on the local hyperā€ + visor rather than broadcast across the whole network and responded to + by the destination VM. This behavior is proxy ARP. + + ARP requests arrive from VMs from a logical switch inport of type deā€ + fault. For this case, the logical switch proxy ARP rules can be for + other VMs or logical router ports. Logical switch proxy ARP rules may + be programmed both for mac binding of IP addresses on other logical + switch VIF ports (which are of the default logical switch port type, + representing connectivity to VMs or containers), and for mac binding of + IP addresses on logical switch router type ports, representing their + logical router port peers. In order to support proxy ARP for logical + router ports, an IP address must be configured on the logical switch + router type port, with the same value as the peer logical router port. + The configured MAC addresses must match as well. When a VM sends an ARP + request for a distributed logical router port and if the peer router + type port of the attached logical switch does not have an IP address + configured, the ARP request will be broadcast on the logical switch. + One of the copies of the ARP request will go through the logical switch + router type port to the logical router datapath, where the logical + router ARP responder will generate a reply. The MAC binding of a disā€ + tributed logical router, once learned by an associated VM, is used for + all that VMā€™s communication needing routing. Hence, the action of a VM + re-arping for the mac binding of the logical router port should be + rare. + + Logical switch ARP responder proxy ARP rules can also be hit when reā€ + ceiving ARP requests externally on a L2 gateway port. In this case, the + hypervisor acting as an L2 gateway, responds to the ARP request on beā€ + half of a destination VM. + + Note that ARP requests received from localnet logical inports can eiā€ + ther go directly to VMs, in which case the VM responds or can hit an + ARP responder for a logical router port if the packet is used to reā€ + solve a logical router port next hop address. In either case, logical + switch ARP responder rules will not be hit. It contains these logical + flows: + + ā€¢ If the logical switch has no router ports with opā€ + tions:arp_proxy configured add a priority-100 flows to + skip the ARP responder if inport is of type localnet adā€ + vances directly to the next table. ARP requests sent to + localnet ports can be received by multiple hypervisors. + Now, because the same mac binding rules are downloaded to + all hypervisors, each of the multiple hypervisors will + respond. This will confuse L2 learning on the source of + the ARP requests. ARP requests received on an inport of + type router are not expected to hit any logical switch + ARP responder flows. However, no skip flows are installed + for these packets, as there would be some additional flow + cost for this and the value appears limited. + + ā€¢ If inport V is of type virtual adds a priority-100 logiā€ + cal flows for each P configured in the options:virtual- + parents column with the match + + inport == P && && ((arp.op == 1 && arp.spa == VIP && arp.tpa == VIP) || (arp.op == 2 && arp.spa == VIP)) + inport == P && && ((nd_ns && ip6.dst == {VIP, NS_MULTICAST_ADDR} && nd.target == VIP) || (nd_na && nd.target == VIP)) + + + and applies the action + + bind_vport(V, inport); + + + and advances the packet to the next table. + + Where VIP is the virtual ip configured in the column opā€ā€ + tions:virtual-ip and NS_MULTICAST_ADDR is solicited-node + multicast address corresponding to the VIP. + + ā€¢ Priority-50 flows that match ARP requests to each known + IP address A of every logical switch port, and respond + with ARP replies directly with corresponding Ethernet adā€ + dress E: + + eth.dst = eth.src; + eth.src = E; + arp.op = 2; /* ARP reply. */ + arp.tha = arp.sha; + arp.sha = E; + arp.tpa = arp.spa; + arp.spa = A; + outport = inport; + flags.loopback = 1; + output; + + + These flows are omitted for logical ports (other than + router ports or localport ports) that are down (unless + ignore_lsp_down is configured as true in options column + of NB_Global table of the Northbound database), for logiā€ + cal ports of type virtual, for logical ports with ā€™unā€ + knownā€™ address set and for logical ports of a logical + switch configured with other_config:vlan-passthru=true. + + The above ARP responder flows are added for the list of + IPv4 addresses if defined in options:arp_proxy column of + Logical_Switch_Port table for logical switch ports of + type router. + + ā€¢ Priority-50 flows that match IPv6 ND neighbor solicitaā€ + tions to each known IP address A (and Aā€™s solicited node + address) of every logical switch port except of type + router, and respond with neighbor advertisements directly + with corresponding Ethernet address E: + + nd_na { + eth.src = E; + ip6.src = A; + nd.target = A; + nd.tll = E; + outport = inport; + flags.loopback = 1; + output; + }; + + + Priority-50 flows that match IPv6 ND neighbor solicitaā€ + tions to each known IP address A (and Aā€™s solicited node + address) of logical switch port of type router, and reā€ + spond with neighbor advertisements directly with correā€ + sponding Ethernet address E: + + nd_na_router { + eth.src = E; + ip6.src = A; + nd.target = A; + nd.tll = E; + outport = inport; + flags.loopback = 1; + output; + }; + + + These flows are omitted for logical ports (other than + router ports or localport ports) that are down (unless + ignore_lsp_down is configured as true in options column + of NB_Global table of the Northbound database), for logiā€ + cal ports of type virtual and for logical ports with ā€™unā€ + knownā€™ address set. + + The above NDP responder flows are added for the list of + IPv6 addresses if defined in options:arp_proxy column of + Logical_Switch_Port table for logical switch ports of + type router. + + ā€¢ Priority-100 flows with match criteria like the ARP and + ND flows above, except that they only match packets from + the inport that owns the IP addresses in question, with + action next;. These flows prevent OVN from replying to, + for example, an ARP request emitted by a VM for its own + IP address. A VM only makes this kind of request to atā€ + tempt to detect a duplicate IP address assignment, so + sending a reply will prevent the VM from accepting the IP + address that it owns. + + In place of next;, it would be reasonable to use drop; + for the flowsā€™ actions. If everything is working as it is + configured, then this would produce equivalent results, + since no host should reply to the request. But ARPing for + oneā€™s own IP address is intended to detect situations + where the network is not working as configured, so dropā€ + ping the request would frustrate that intent. + + ā€¢ For each SVC_MON_SRC_IP defined in the value of the + ip_port_mappings:ENDPOINT_IP column of Load_Balancer taā€ + ble, priority-110 logical flow is added with the match + arp.tpa == SVC_MON_SRC_IP && && arp.op == 1 and applies + the action + + eth.dst = eth.src; + eth.src = E; + arp.op = 2; /* ARP reply. */ + arp.tha = arp.sha; + arp.sha = E; + arp.tpa = arp.spa; + arp.spa = A; + outport = inport; + flags.loopback = 1; + output; + + + where E is the service monitor source mac defined in the + options:svc_monitor_mac column in the NB_Global table. + This mac is used as the source mac in the service monitor + packets for the load balancer endpoint IP health checks. + + SVC_MON_SRC_IP is used as the source ip in the service + monitor IPv4 packets for the load balancer endpoint IP + health checks. + + These flows are required if an ARP request is sent for + the IP SVC_MON_SRC_IP. + + For IPv6 the similar flow is added with the following acā€ + tion + + nd_na { + eth.dst = eth.src; + eth.src = E; + ip6.src = A; + nd.target = A; + nd.tll = E; + outport = inport; + flags.loopback = 1; + output; + }; + + + ā€¢ For each VIP configured in the table Forwarding_Group a + priority-50 logical flow is added with the match arp.tpa + == vip && && arp.op == 1 + and applies the action + + eth.dst = eth.src; + eth.src = E; + arp.op = 2; /* ARP reply. */ + arp.tha = arp.sha; + arp.sha = E; + arp.tpa = arp.spa; + arp.spa = A; + outport = inport; + flags.loopback = 1; + output; + + + where E is the forwarding groupā€™s mac defined in the + vmac. + + A is used as either the destination ip for load balancing + traffic to child ports or as nexthop to hosts behind the + child ports. + + These flows are required to respond to an ARP request if + an ARP request is sent for the IP vip. + + ā€¢ One priority-0 fallback flow that matches all packets and + advances to the next table. + + Ingress Table 22: DHCP option processing + + This table adds the DHCPv4 options to a DHCPv4 packet from the logical + ports configured with IPv4 address(es) and DHCPv4 options, and simiā€ + larly for DHCPv6 options. This table also adds flows for the logical + ports of type external. + + ā€¢ A priority-100 logical flow is added for these logical + ports which matches the IPv4 packet with udp.src = 68 and + udp.dst = 67 and applies the action put_dhcp_opts and adā€ + vances the packet to the next table. + + reg0[3] = put_dhcp_opts(offer_ip = ip, options...); + next; + + + For DHCPDISCOVER and DHCPREQUEST, this transforms the + packet into a DHCP reply, adds the DHCP offer IP ip and + options to the packet, and stores 1 into reg0[3]. For + other kinds of packets, it just stores 0 into reg0[3]. + Either way, it continues to the next table. + + ā€¢ A priority-100 logical flow is added for these logical + ports which matches the IPv6 packet with udp.src = 546 + and udp.dst = 547 and applies the action put_dhcpv6_opts + and advances the packet to the next table. + + reg0[3] = put_dhcpv6_opts(ia_addr = ip, options...); + next; + + + For DHCPv6 Solicit/Request/Confirm packets, this transā€ + forms the packet into a DHCPv6 Advertise/Reply, adds the + DHCPv6 offer IP ip and options to the packet, and stores + 1 into reg0[3]. For other kinds of packets, it just + stores 0 into reg0[3]. Either way, it continues to the + next table. + + ā€¢ A priority-0 flow that matches all packets to advances to + table 16. + + Ingress Table 23: DHCP responses + + This table implements DHCP responder for the DHCP replies generated by + the previous table. + + ā€¢ A priority 100 logical flow is added for the logical + ports configured with DHCPv4 options which matches IPv4 + packets with udp.src == 68 && udp.dst == 67 && reg0[3] == + 1 and responds back to the inport after applying these + actions. If reg0[3] is set to 1, it means that the action + put_dhcp_opts was successful. + + eth.dst = eth.src; + eth.src = E; + ip4.src = S; + udp.src = 67; + udp.dst = 68; + outport = P; + flags.loopback = 1; + output; + + + where E is the server MAC address and S is the server + IPv4 address defined in the DHCPv4 options. Note that + ip4.dst field is handled by put_dhcp_opts. + + (This terminates ingress packet processing; the packet + does not go to the next ingress table.) + + ā€¢ A priority 100 logical flow is added for the logical + ports configured with DHCPv6 options which matches IPv6 + packets with udp.src == 546 && udp.dst == 547 && reg0[3] + == 1 and responds back to the inport after applying these + actions. If reg0[3] is set to 1, it means that the action + put_dhcpv6_opts was successful. + + eth.dst = eth.src; + eth.src = E; + ip6.dst = A; + ip6.src = S; + udp.src = 547; + udp.dst = 546; + outport = P; + flags.loopback = 1; + output; + + + where E is the server MAC address and S is the server + IPv6 LLA address generated from the server_id defined in + the DHCPv6 options and A is the IPv6 address defined in + the logical portā€™s addresses column. + + (This terminates packet processing; the packet does not + go on the next ingress table.) + + ā€¢ A priority-0 flow that matches all packets to advances to + table 17. + + Ingress Table 24 DNS Lookup + + This table looks up and resolves the DNS names to the corresponding + configured IP address(es). + + ā€¢ A priority-100 logical flow for each logical switch dataā€ + path if it is configured with DNS records, which matches + the IPv4 and IPv6 packets with udp.dst = 53 and applies + the action dns_lookup and advances the packet to the next + table. + + reg0[4] = dns_lookup(); next; + + + For valid DNS packets, this transforms the packet into a + DNS reply if the DNS name can be resolved, and stores 1 + into reg0[4]. For failed DNS resolution or other kinds of + packets, it just stores 0 into reg0[4]. Either way, it + continues to the next table. + + Ingress Table 25 DNS Responses + + This table implements DNS responder for the DNS replies generated by + the previous table. + + ā€¢ A priority-100 logical flow for each logical switch dataā€ + path if it is configured with DNS records, which matches + the IPv4 and IPv6 packets with udp.dst = 53 && reg0[4] == + 1 and responds back to the inport after applying these + actions. If reg0[4] is set to 1, it means that the action + dns_lookup was successful. + + eth.dst <-> eth.src; + ip4.src <-> ip4.dst; + udp.dst = udp.src; + udp.src = 53; + outport = P; + flags.loopback = 1; + output; + + + (This terminates ingress packet processing; the packet + does not go to the next ingress table.) + + Ingress table 26 External ports + + Traffic from the external logical ports enter the ingress datapath + pipeline via the localnet port. This table adds the below logical flows + to handle the traffic from these ports. + + ā€¢ A priority-100 flow is added for each external logical + port which doesnā€™t reside on a chassis to drop the + ARP/IPv6 NS request to the router IP(s) (of the logical + switch) which matches on the inport of the external logiā€ + cal port and the valid eth.src address(es) of the exterā€ā€ + nal logical port. + + This flow guarantees that the ARP/NS request to the + router IP address from the external ports is responded by + only the chassis which has claimed these external ports. + All the other chassis, drops these packets. + + A priority-100 flow is added for each external logical + port which doesnā€™t reside on a chassis to drop any packet + destined to the router mac - with the match inport == exā€ + ternal && eth.src == E && eth.dst == R && !is_chasā€ā€ + sis_resident("external") where E is the external port mac + and R is the router port mac. + + ā€¢ A priority-0 flow that matches all packets to advances to + table 20. + + Ingress Table 27 Destination Lookup + + This table implements switching behavior. It contains these logical + flows: + + ā€¢ A priority-110 flow with the match eth.src == E for all + logical switch datapaths and applies the action hanā€ā€ + dle_svc_check(inport). Where E is the service monitor mac + defined in the options:svc_monitor_mac column of + NB_Global table. + + ā€¢ A priority-100 flow that punts all IGMP/MLD packets to + ovn-controller if multicast snooping is enabled on the + logical switch. + + ā€¢ Priority-90 flows that forward registered IP multicast + traffic to their corresponding multicast group, which + ovn-northd creates based on learnt IGMP_Group entries. + The flows also forward packets to the MC_MROUTER_FLOOD + multicast group, which ovn-nortdh populates with all the + logical ports that are connected to logical routers with + options:mcast_relay=ā€™trueā€™. + + ā€¢ A priority-85 flow that forwards all IP multicast traffic + destined to 224.0.0.X to the MC_FLOOD_L2 multicast group, + which ovn-northd populates with all non-router logical + ports. + + ā€¢ A priority-85 flow that forwards all IP multicast traffic + destined to reserved multicast IPv6 addresses (RFC 4291, + 2.7.1, e.g., Solicited-Node multicast) to the MC_FLOOD + multicast group, which ovn-northd populates with all enā€ + abled logical ports. + + ā€¢ A priority-80 flow that forwards all unregistered IP mulā€ + ticast traffic to the MC_STATIC multicast group, which + ovn-northd populates with all the logical ports that have + options :mcast_flood=ā€ā€™trueā€ā€™. The flow also forwards unā€ + registered IP multicast traffic to the MC_MROUTER_FLOOD + multicast group, which ovn-northd populates with all the + logical ports connected to logical routers that have opā€ā€ + tions :mcast_relay=ā€ā€™trueā€ā€™. + + ā€¢ A priority-80 flow that drops all unregistered IP multiā€ + cast traffic if other_config :mcast_snoop=ā€ā€™trueā€ā€™ and + other_config :mcast_flood_unregistered=ā€ā€™falseā€ā€™ and the + switch is not connected to a logical router that has opā€ā€ + tions :mcast_relay=ā€ā€™trueā€ā€™ and the switch doesnā€™t have any + logical port with options :mcast_flood=ā€ā€™trueā€ā€™. + + ā€¢ Priority-80 flows for each IP address/VIP/NAT address + owned by a router port connected to the switch. These + flows match ARP requests and ND packets for the specific + IP addresses. Matched packets are forwarded only to the + router that owns the IP address and to the MC_FLOOD_L2 + multicast group which contains all non-router logical + ports. + + ā€¢ Priority-75 flows for each port connected to a logical + router matching self originated ARP request/RARP reā€ + quest/ND packets. These packets are flooded to the + MC_FLOOD_L2 which contains all non-router logical ports. + + ā€¢ A priority-72 flow that outputs all ARP requests and ND + packets with an Ethernet broadcast or multicast eth.dst + to the MC_FLOOD_L2 multicast group if other_config:broadā€ā€ + cast-arps-to-all-routers=true. + + ā€¢ A priority-70 flow that outputs all packets with an Ethā€ + ernet broadcast or multicast eth.dst to the MC_FLOOD mulā€ + ticast group. + + ā€¢ One priority-50 flow that matches each known Ethernet adā€ + dress against eth.dst. Action of this flow outputs the + packet to the single associated output port if it is enā€ + abled. drop; action is applied if LSP is disabled. + + For the Ethernet address on a logical switch port of type + router, when that logical switch portā€™s addresses column + is set to router and the connected logical router port + has a gateway chassis: + + ā€¢ The flow for the connected logical router portā€™s + Ethernet address is only programmed on the gateway + chassis. + + ā€¢ If the logical router has rules specified in nat + with external_mac, then those addresses are also + used to populate the switchā€™s destination lookup + on the chassis where logical_port is resident. + + For the Ethernet address on a logical switch port of type + router, when that logical switch portā€™s addresses column + is set to router and the connected logical router port + specifies a reside-on-redirect-chassis and the logical + router to which the connected logical router port belongs + to has a distributed gateway LRP: + + ā€¢ The flow for the connected logical router portā€™s + Ethernet address is only programmed on the gateway + chassis. + + For each forwarding group configured on the logical + switch datapath, a priority-50 flow that matches on + eth.dst == VIP + with an action of fwd_group(childports=args ), where + args contains comma separated logical switch child ports + to load balance to. If liveness is enabled, then action + also includes liveness=true. + + ā€¢ One priority-0 fallback flow that matches all packets + with the action outport = get_fdb(eth.dst); next;. The + action get_fdb gets the port for the eth.dst in the MAC + learning table of the logical switch datapath. If there + is no entry for eth.dst in the MAC learning table, then + it stores none in the outport. + + Ingress Table 28 Destination unknown + + This table handles the packets whose destination was not found or and + looked up in the MAC learning table of the logical switch datapath. It + contains the following flows. + + ā€¢ Priority 50 flow with the match outport == P is added for + each disabled Logical Switch Port P. This flow has action + drop;. + + ā€¢ If the logical switch has logical ports with ā€™unknownā€™ + addresses set, then the below logical flow is added + + ā€¢ Priority 50 flow with the match outport == "none" + then outputs them to the MC_UNKNOWN multicast + group, which ovn-northd populates with all enabled + logical ports that accept unknown destination + packets. As a small optimization, if no logical + ports accept unknown destination packets, + ovn-northd omits this multicast group and logical + flow. + + If the logical switch has no logical ports with ā€™unknownā€™ + address set, then the below logical flow is added + + ā€¢ Priority 50 flow with the match outport == none + and drops the packets. + + ā€¢ One priority-0 fallback flow that outputs the packet to + the egress stage with the outport learnt from get_fdb acā€ + tion. + + Egress Table 0: to-lport Pre-ACLs + + This is similar to ingress table Pre-ACLs except for to-lport traffic. + + This table also has a priority-110 flow with the match eth.src == E for + all logical switch datapaths to move traffic to the next table. Where E + is the service monitor mac defined in the options:svc_monitor_mac colā€ + umn of NB_Global table. + + This table also has a priority-110 flow with the match outport == I for + all logical switch datapaths to move traffic to the next table. Where I + is the peer of a logical router port. This flow is added to skip the + connection tracking of packets which will be entering logical router + datapath from logical switch datapath for routing. + + Egress Table 1: Pre-LB + + This table is similar to ingress table Pre-LB. It contains a priority-0 + flow that simply moves traffic to the next table. Moreover it contains + two priority-110 flows to move multicast, IPv6 Neighbor Discovery and + MLD traffic to the next table. If any load balancing rules exist for + the datapath, a priority-100 flow is added with a match of ip and acā€ + tion of reg0[2] = 1; next; to act as a hint for table Pre-stateful to + send IP packets to the connection tracker for packet de-fragmentation + and possibly DNAT the destination VIP to one of the selected backend + for already committed load balanced traffic. + + This table also has a priority-110 flow with the match eth.src == E for + all logical switch datapaths to move traffic to the next table. Where E + is the service monitor mac defined in the options:svc_monitor_mac colā€ + umn of NB_Global table. + + This table also has a priority-110 flow with the match outport == I for + all logical switch datapaths to move traffic to the next table, and, if + there are no stateful_acl, clear the ct_state. Where I is the peer of a + logical router port. This flow is added to skip the connection tracking + of packets which will be entering logical router datapath from logical + switch datapath for routing. + + Egress Table 2: Pre-stateful + + This is similar to ingress table Pre-stateful. This table adds the beā€ + low 3 logical flows. + + ā€¢ A Priority-120 flow that send the packets to connection + tracker using ct_lb_mark; as the action so that the alā€ + ready established traffic gets unDNATted from the backend + IP to the load balancer VIP based on a hint provided by + the previous tables with a match for reg0[2] == 1. If the + packet was not DNATted earlier, then ct_lb_mark functions + like ct_next. + + ā€¢ A priority-100 flow sends the packets to connection + tracker based on a hint provided by the previous tables + (with a match for reg0[0] == 1) by using the ct_next; acā€ + tion. + + ā€¢ A priority-0 flow that matches all packets to advance to + the next table. + + Egress Table 3: from-lport ACL hints + + This is similar to ingress table ACL hints. + + Egress Table 4: to-lport ACL evaluation + + This is similar to ingress table ACL eval except for to-lport ACLs. As + a reminder, these flows use the following register bits to indicate + their verdicts. Allow-type ACLs set reg8[16], drop ACLs set reg8[17], + and reject ACLs set reg8[18]. + + Also like with ingress ACLs, egress ACLs can have a configured tier. If + a tier is configured, then the current tier counter is evaluated + against the ACLā€™s configured tier in addition to the ACLā€™s match. The + current tier counter is stored in reg8[30..31]. + + Similar to ingress table, a priority-65532 flow is added to allow IPv6 + Neighbor solicitation, Neighbor discover, Router solicitation, Router + advertisement and MLD packets regardless of other ACLs defined. + + In addition, the following flows are added. + + ā€¢ A priority 34000 logical flow is added for each logical + port which has DHCPv4 options defined to allow the DHCPv4 + reply packet and which has DHCPv6 options defined to alā€ + low the DHCPv6 reply packet from the Ingress Table 18: + DHCP responses. This is indicated by setting the allow + bit. + + ā€¢ A priority 34000 logical flow is added for each logical + switch datapath configured with DNS records with the + match udp.dst = 53 to allow the DNS reply packet from the + Ingress Table 20: DNS responses. This is indicated by + setting the allow bit. + + ā€¢ A priority 34000 logical flow is added for each logical + switch datapath with the match eth.src = E to allow the + service monitor request packet generated by ovn-conā€ā€ + troller with the action next, where E is the service monā€ + itor mac defined in the options:svc_monitor_mac column of + NB_Global table. This is indicated by setting the allow + bit. + + Egress Table 5: to-lport ACL action + + This is similar to ingress table ACL action. + + Egress Table 6: to-lport QoS Marking + + This is similar to ingress table QoS marking except they apply to + to-lport QoS rules. + + Egress Table 7: to-lport QoS Meter + + This is similar to ingress table QoS meter except they apply to + to-lport QoS rules. + + Egress Table 8: Stateful + + This is similar to ingress table Stateful except that there are no + rules added for load balancing new connections. + + Egress Table 9: Egress Port Security - check + + This is similar to the port security logic in table Ingress Port Secuā€ā€ + rity check except that action check_out_port_sec is used to check the + port security rules. This table adds the below logical flows. + + ā€¢ A priority 100 flow which matches on the multicast trafā€ + fic and applies the action REGBIT_PORT_SEC_DROP" = 0; + next;" to skip the out port security checks. + + ā€¢ A priority 0 logical flow is added which matches on all + the packets and applies the action REGBIT_PORT_SEC_DROP" + = check_out_port_sec(); next;". The action + check_out_port_sec applies the port security rules based + on the addresses defined in the port_security column of + Logical_Switch_Port table before delivering the packet to + the outport. + + Egress Table 10: Egress Port Security - Apply + + This is similar to the ingress port security logic in ingress table A + Ingress Port Security - Apply. This table drops the packets if the port + security check failed in the previous stage i.e the register bit REGā€ā€ + BIT_PORT_SEC_DROP is set to 1. + + The following flows are added. + + ā€¢ For each port configured with egress qos in the opā€ā€ + tions:qdisc_queue_id column of Logical_Switch_Port, runā€ + ning a localnet port on the same logical switch, a priorā€ + ity 110 flow is added which matches on the localnet outā€ā€ + port and on the port inport and applies the action + set_queue(id); output;". + + ā€¢ For each localnet port configured with egress qos in the + options:qdisc_queue_id column of Logical_Switch_Port, a + priority 100 flow is added which matches on the localnet + outport and applies the action set_queue(id); output;". + + Please remember to mark the corresponding physical interā€ + face with ovn-egress-iface set to true in external_ids. + + ā€¢ A priority-50 flow that drops the packet if the register + bit REGBIT_PORT_SEC_DROP is set to 1. + + ā€¢ A priority-0 flow that outputs the packet to the outport. + + Logical Router Datapaths + Logical router datapaths will only exist for Logical_Router rows in the + OVN_Northbound database that do not have enabled set to false + + Ingress Table 0: L2 Admission Control + + This table drops packets that the router shouldnā€™t see at all based on + their Ethernet headers. It contains the following flows: + + ā€¢ Priority-100 flows to drop packets with VLAN tags or mulā€ + ticast Ethernet source addresses. + + ā€¢ For each enabled router port P with Ethernet address E, a + priority-50 flow that matches inport == P && (eth.mcast + || eth.dst == E), stores the router port ethernet address + and advances to next table, with action xreg0[0..47]=E; + next;. + + For the gateway port on a distributed logical router + (where one of the logical router ports specifies a gateā€ + way chassis), the above flow matching eth.dst == E is + only programmed on the gateway port instance on the gateā€ + way chassis. If LRPā€™s logical switch has attached LSP of + vtep type, the is_chassis_resident() part is not added to + lflow to allow traffic originated from logical switch to + reach LR services (LBs, NAT). + + For a distributed logical router or for gateway router + where the port is configured with options:gateway_mtu the + action of the above flow is modified adding + check_pkt_larger in order to mark the packet setting REGā€ā€ + BIT_PKT_LARGER if the size is greater than the MTU. If + the port is also configured with options:gateway_mtu_byā€ā€ + pass then another flow is added, with priority-55, to byā€ + pass the check_pkt_larger flow. This is useful for trafā€ + fic that normally doesnā€™t need to be fragmented and for + which check_pkt_larger, which might not be offloadable, + is not really needed. One such example is TCP traffic. + + ā€¢ For each dnat_and_snat NAT rule on a distributed router + that specifies an external Ethernet address E, a priorā€ + ity-50 flow that matches inport == GW && eth.dst == E, + where GW is the logical router distributed gateway port + corresponding to the NAT rule (specified or inferred), + with action xreg0[0..47]=E; next;. + + This flow is only programmed on the gateway port instance + on the chassis where the logical_port specified in the + NAT rule resides. + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + + Other packets are implicitly dropped. + + Ingress Table 1: Neighbor lookup + + For ARP and IPv6 Neighbor Discovery packets, this table looks into the + MAC_Binding records to determine if OVN needs to learn the mac bindā€ + ings. Following flows are added: + + ā€¢ For each router port P that owns IP address A, which beā€ + longs to subnet S with prefix length L, if the option alā€ā€ + ways_learn_from_arp_request is true for this router, a + priority-100 flow is added which matches inport == P && + arp.spa == S/L && arp.op == 1 (ARP request) with the folā€ + lowing actions: + + reg9[2] = lookup_arp(inport, arp.spa, arp.sha); + next; + + + If the option always_learn_from_arp_request is false, the + following two flows are added. + + A priority-110 flow is added which matches inport == P && + arp.spa == S/L && arp.tpa == A && arp.op == 1 (ARP reā€ + quest) with the following actions: + + reg9[2] = lookup_arp(inport, arp.spa, arp.sha); + reg9[3] = 1; + next; + + + A priority-100 flow is added which matches inport == P && + arp.spa == S/L && arp.op == 1 (ARP request) with the folā€ + lowing actions: + + reg9[2] = lookup_arp(inport, arp.spa, arp.sha); + reg9[3] = lookup_arp_ip(inport, arp.spa); + next; + + + If the logical router port P is a distributed gateway + router port, additional match is_chassis_resident(cr-P) + is added for all these flows. + + ā€¢ A priority-100 flow which matches on ARP reply packets + and applies the actions if the option alā€ā€ + ways_learn_from_arp_request is true: + + reg9[2] = lookup_arp(inport, arp.spa, arp.sha); + next; + + + If the option always_learn_from_arp_request is false, the + above actions will be: + + reg9[2] = lookup_arp(inport, arp.spa, arp.sha); + reg9[3] = 1; + next; + + + ā€¢ A priority-100 flow which matches on IPv6 Neighbor Disā€ + covery advertisement packet and applies the actions if + the option always_learn_from_arp_request is true: + + reg9[2] = lookup_nd(inport, nd.target, nd.tll); + next; + + + If the option always_learn_from_arp_request is false, the + above actions will be: + + reg9[2] = lookup_nd(inport, nd.target, nd.tll); + reg9[3] = 1; + next; + + + ā€¢ A priority-100 flow which matches on IPv6 Neighbor Disā€ + covery solicitation packet and applies the actions if the + option always_learn_from_arp_request is true: + + reg9[2] = lookup_nd(inport, ip6.src, nd.sll); + next; + + + If the option always_learn_from_arp_request is false, the + above actions will be: + + reg9[2] = lookup_nd(inport, ip6.src, nd.sll); + reg9[3] = lookup_nd_ip(inport, ip6.src); + next; + + + ā€¢ A priority-0 fallback flow that matches all packets and + applies the action reg9[2] = 1; next; advancing the + packet to the next table. + + Ingress Table 2: Neighbor learning + + This table adds flows to learn the mac bindings from the ARP and IPv6 + Neighbor Solicitation/Advertisement packets if it is needed according + to the lookup results from the previous stage. + + reg9[2] will be 1 if the lookup_arp/lookup_nd in the previous table was + successful or skipped, meaning no need to learn mac binding from the + packet. + + reg9[3] will be 1 if the lookup_arp_ip/lookup_nd_ip in the previous taā€ + ble was successful or skipped, meaning it is ok to learn mac binding + from the packet (if reg9[2] is 0). + + ā€¢ A priority-100 flow with the match reg9[2] == 1 || + reg9[3] == 0 and advances the packet to the next table as + there is no need to learn the neighbor. + + ā€¢ A priority-95 flow with the match nd_ns && (ip6.src == 0 + || nd.sll == 0) and applies the action next; + + ā€¢ A priority-90 flow with the match arp and applies the acā€ + tion put_arp(inport, arp.spa, arp.sha); next; + + ā€¢ A priority-95 flow with the match nd_na && nd.tll == 0 + and applies the action put_nd(inport, nd.target, + eth.src); next; + + ā€¢ A priority-90 flow with the match nd_na and applies the + action put_nd(inport, nd.target, nd.tll); next; + + ā€¢ A priority-90 flow with the match nd_ns and applies the + action put_nd(inport, ip6.src, nd.sll); next; + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + + Ingress Table 3: IP Input + + This table is the core of the logical router datapath functionality. It + contains the following flows to implement very basic IP host functionā€ + ality. + + ā€¢ For each dnat_and_snat NAT rule on a distributed logical + routers or gateway routers with gateway port configured + with options:gateway_mtu to a valid integer value M, a + priority-160 flow with the match inport == LRP && REGā€ā€ + BIT_PKT_LARGER && REGBIT_EGRESS_LOOPBACK == 0, where LRP + is the logical router port and applies the following acā€ + tion for ipv4 and ipv6 respectively: + + icmp4_error { + icmp4.type = 3; /* Destination Unreachable. */ + icmp4.code = 4; /* Frag Needed and DF was Set. */ + icmp4.frag_mtu = M; + eth.dst = eth.src; + eth.src = E; + ip4.dst = ip4.src; + ip4.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER 0; + outport = LRP; + flags.loopback = 1; + output; + }; + icmp6_error { + icmp6.type = 2; + icmp6.code = 0; + icmp6.frag_mtu = M; + eth.dst = eth.src; + eth.src = E; + ip6.dst = ip6.src; + ip6.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER 0; + outport = LRP; + flags.loopback = 1; + output; + }; + + + where E and I are the NAT rule external mac and IP reā€ + spectively. + + ā€¢ For distributed logical routers or gateway routers with + gateway port configured with options:gateway_mtu to a + valid integer value, a priority-150 flow with the match + inport == LRP && REGBIT_PKT_LARGER && REGBIT_EGRESS_LOOPā€ā€ + BACK == 0, where LRP is the logical router port and apā€ + plies the following action for ipv4 and ipv6 respecā€ + tively: + + icmp4_error { + icmp4.type = 3; /* Destination Unreachable. */ + icmp4.code = 4; /* Frag Needed and DF was Set. */ + icmp4.frag_mtu = M; + eth.dst = E; + ip4.dst = ip4.src; + ip4.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER 0; + next(pipeline=ingress, table=0); + }; + icmp6_error { + icmp6.type = 2; + icmp6.code = 0; + icmp6.frag_mtu = M; + eth.dst = E; + ip6.dst = ip6.src; + ip6.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER 0; + next(pipeline=ingress, table=0); + }; + + + ā€¢ For each NAT entry of a distributed logical router (with + distributed gateway router port(s)) of type snat, a priā€ + ority-120 flow with the match inport == P && ip4.src == A + advances the packet to the next pipeline, where P is the + distributed logical router port corresponding to the NAT + entry (specified or inferred) and A is the external_ip + set in the NAT entry. If A is an IPv6 address, then + ip6.src is used for the match. + + The above flow is required to handle the routing of the + East/west NAT traffic. + + ā€¢ For each BFD port the two following priority-110 flows + are added to manage BFD traffic: + + ā€¢ if ip4.src or ip6.src is any IP address owned by + the router port and udp.dst == 3784 , the packet + is advanced to the next pipeline stage. + + ā€¢ if ip4.dst or ip6.dst is any IP address owned by + the router port and udp.dst == 3784 , the hanā€ā€ + dle_bfd_msg action is executed. + + ā€¢ L3 admission control: Priority-120 flows allows IGMP and + MLD packets if the router has logical ports that have opā€ā€ + tions :mcast_flood=ā€ā€™trueā€ā€™. + + ā€¢ L3 admission control: A priority-100 flow drops packets + that match any of the following: + + ā€¢ ip4.src[28..31] == 0xe (multicast source) + + ā€¢ ip4.src == 255.255.255.255 (broadcast source) + + ā€¢ ip4.src == 127.0.0.0/8 || ip4.dst == 127.0.0.0/8 + (localhost source or destination) + + ā€¢ ip4.src == 0.0.0.0/8 || ip4.dst == 0.0.0.0/8 (zero + network source or destination) + + ā€¢ ip4.src or ip6.src is any IP address owned by the + router, unless the packet was recirculated due to + egress loopback as indicated by REGā€ā€ + BIT_EGRESS_LOOPBACK. + + ā€¢ ip4.src is the broadcast address of any IP network + known to the router. + + ā€¢ A priority-100 flow parses DHCPv6 replies from IPv6 preā€ + fix delegation routers (udp.src == 547 && udp.dst == + 546). The handle_dhcpv6_reply is used to send IPv6 prefix + delegation messages to the delegation router. + + ā€¢ ICMP echo reply. These flows reply to ICMP echo requests + received for the routerā€™s IP address. Let A be an IP adā€ + dress owned by a router port. Then, for each A that is an + IPv4 address, a priority-90 flow matches on ip4.dst == A + and icmp4.type == 8 && icmp4.code == 0 (ICMP echo reā€ + quest). For each A that is an IPv6 address, a priority-90 + flow matches on ip6.dst == A and icmp6.type == 128 && + icmp6.code == 0 (ICMPv6 echo request). The port of the + router that receives the echo request does not matter. + Also, the ip.ttl of the echo request packet is not + checked, so it complies with RFC 1812, section 4.2.2.9. + Flows for ICMPv4 echo requests use the following actions: + + ip4.dst <-> ip4.src; + ip.ttl = 255; + icmp4.type = 0; + flags.loopback = 1; + next; + + + Flows for ICMPv6 echo requests use the following actions: + + ip6.dst <-> ip6.src; + ip.ttl = 255; + icmp6.type = 129; + flags.loopback = 1; + next; + + + ā€¢ Reply to ARP requests. + + These flows reply to ARP requests for the routerā€™s own IP + address. The ARP requests are handled only if the reā€ + questorā€™s IP belongs to the same subnets of the logical + router port. For each router port P that owns IP address + A, which belongs to subnet S with prefix length L, and + Ethernet address E, a priority-90 flow matches inport == + P && arp.spa == S/L && arp.op == 1 && arp.tpa == A (ARP + request) with the following actions: + + eth.dst = eth.src; + eth.src = xreg0[0..47]; + arp.op = 2; /* ARP reply. */ + arp.tha = arp.sha; + arp.sha = xreg0[0..47]; + arp.tpa = arp.spa; + arp.spa = A; + outport = inport; + flags.loopback = 1; + output; + + + For the gateway port on a distributed logical router + (where one of the logical router ports specifies a gateā€ + way chassis), the above flows are only programmed on the + gateway port instance on the gateway chassis. This behavā€ + ior avoids generation of multiple ARP responses from difā€ + ferent chassis, and allows upstream MAC learning to point + to the gateway chassis. + + For the logical router port with the option reā€ā€ + side-on-redirect-chassis set (which is centralized), the + above flows are only programmed on the gateway port inā€ + stance on the gateway chassis (if the logical router has + a distributed gateway port). This behavior avoids generaā€ + tion of multiple ARP responses from different chassis, + and allows upstream MAC learning to point to the gateway + chassis. + + ā€¢ Reply to IPv6 Neighbor Solicitations. These flows reply + to Neighbor Solicitation requests for the routerā€™s own + IPv6 address and populate the logical routerā€™s mac bindā€ + ing table. + + For each router port P that owns IPv6 address A, soā€ + licited node address S, and Ethernet address E, a priorā€ + ity-90 flow matches inport == P && nd_ns && ip6.dst == + {A, E} && nd.target == A with the following actions: + + nd_na_router { + eth.src = xreg0[0..47]; + ip6.src = A; + nd.target = A; + nd.tll = xreg0[0..47]; + outport = inport; + flags.loopback = 1; + output; + }; + + + For the gateway port on a distributed logical router + (where one of the logical router ports specifies a gateā€ + way chassis), the above flows replying to IPv6 Neighbor + Solicitations are only programmed on the gateway port inā€ + stance on the gateway chassis. This behavior avoids genā€ + eration of multiple replies from different chassis, and + allows upstream MAC learning to point to the gateway + chassis. + + ā€¢ These flows reply to ARP requests or IPv6 neighbor solicā€ + itation for the virtual IP addresses configured in the + router for NAT (both DNAT and SNAT) or load balancing. + + IPv4: For a configured NAT (both DNAT and SNAT) IP adā€ + dress or a load balancer IPv4 VIP A, for each router port + P with Ethernet address E, a priority-90 flow matches + arp.op == 1 && arp.tpa == A (ARP request) with the folā€ + lowing actions: + + eth.dst = eth.src; + eth.src = xreg0[0..47]; + arp.op = 2; /* ARP reply. */ + arp.tha = arp.sha; + arp.sha = xreg0[0..47]; + arp.tpa <-> arp.spa; + outport = inport; + flags.loopback = 1; + output; + + + IPv4: For a configured load balancer IPv4 VIP, a similar + flow is added with the additional match inport == P if + the VIP is reachable from any logical router port of the + logical router. + + If the router port P is a distributed gateway router + port, then the is_chassis_resident(P) is also added in + the match condition for the load balancer IPv4 VIP A. + + IPv6: For a configured NAT (both DNAT and SNAT) IP adā€ + dress or a load balancer IPv6 VIP A (if the VIP is reachā€ + able from any logical router port of the logical router), + solicited node address S, for each router port P with + Ethernet address E, a priority-90 flow matches inport == + P && nd_ns && ip6.dst == {A, S} && nd.target == A with + the following actions: + + eth.dst = eth.src; + nd_na { + eth.src = xreg0[0..47]; + nd.tll = xreg0[0..47]; + ip6.src = A; + nd.target = A; + outport = inport; + flags.loopback = 1; + output; + } + + + If the router port P is a distributed gateway router + port, then the is_chassis_resident(P) is also added in + the match condition for the load balancer IPv6 VIP A. + + For the gateway port on a distributed logical router with + NAT (where one of the logical router ports specifies a + gateway chassis): + + ā€¢ If the corresponding NAT rule cannot be handled in + a distributed manner, then a priority-92 flow is + programmed on the gateway port instance on the + gateway chassis. A priority-91 drop flow is proā€ + grammed on the other chassis when ARP requests/NS + packets are received on the gateway port. This beā€ + havior avoids generation of multiple ARP responses + from different chassis, and allows upstream MAC + learning to point to the gateway chassis. + + ā€¢ If the corresponding NAT rule can be handled in a + distributed manner, then this flow is only proā€ + grammed on the gateway port instance where the + logical_port specified in the NAT rule resides. + + Some of the actions are different for this case, + using the external_mac specified in the NAT rule + rather than the gateway portā€™s Ethernet address E: + + eth.src = external_mac; + arp.sha = external_mac; + + + or in the case of IPv6 neighbor solicition: + + eth.src = external_mac; + nd.tll = external_mac; + + + This behavior avoids generation of multiple ARP + responses from different chassis, and allows upā€ + stream MAC learning to point to the correct chasā€ + sis. + + ā€¢ Priority-85 flows which drops the ARP and IPv6 Neighbor + Discovery packets. + + ā€¢ A priority-84 flow explicitly allows IPv6 multicast trafā€ + fic that is supposed to reach the router pipeline (i.e., + router solicitation and router advertisement packets). + + ā€¢ A priority-83 flow explicitly drops IPv6 multicast trafā€ + fic that is destined to reserved multicast groups. + + ā€¢ A priority-82 flow allows IP multicast traffic if opā€ā€ + tions:mcast_relay=ā€™trueā€™, otherwise drops it. + + ā€¢ UDP port unreachable. Priority-80 flows generate ICMP + port unreachable messages in reply to UDP datagrams diā€ + rected to the routerā€™s IP address, except in the special + case of gateways, which accept traffic directed to a + router IP for load balancing and NAT purposes. + + These flows should not match IP fragments with nonzero + offset. + + ā€¢ TCP reset. Priority-80 flows generate TCP reset messages + in reply to TCP datagrams directed to the routerā€™s IP adā€ + dress, except in the special case of gateways, which acā€ + cept traffic directed to a router IP for load balancing + and NAT purposes. + + These flows should not match IP fragments with nonzero + offset. + + ā€¢ Protocol or address unreachable. Priority-70 flows generā€ + ate ICMP protocol or address unreachable messages for + IPv4 and IPv6 respectively in reply to packets directed + to the routerā€™s IP address on IP protocols other than + UDP, TCP, and ICMP, except in the special case of gateā€ + ways, which accept traffic directed to a router IP for + load balancing purposes. + + These flows should not match IP fragments with nonzero + offset. + + ā€¢ Drop other IP traffic to this router. These flows drop + any other traffic destined to an IP address of this + router that is not already handled by one of the flows + above, which amounts to ICMP (other than echo requests) + and fragments with nonzero offsets. For each IP address A + owned by the router, a priority-60 flow matches ip4.dst + == A or ip6.dst == A and drops the traffic. An exception + is made and the above flow is not added if the router + portā€™s own IP address is used to SNAT packets passing + through that router or if it is used as a load balancer + VIP. + + The flows above handle all of the traffic that might be directed to the + router itself. The following flows (with lower priorities) handle the + remaining traffic, potentially for forwarding: + + ā€¢ Drop Ethernet local broadcast. A priority-50 flow with + match eth.bcast drops traffic destined to the local Ethā€ + ernet broadcast address. By definition this traffic + should not be forwarded. + + ā€¢ Avoid ICMP time exceeded for multicast. A priority-32 + flow with match ip.ttl == {0, 1} && !ip.later_frag && + (ip4.mcast || ip6.mcast) and actions drop; drops multiā€ + cast packets whose TTL has expired without sending ICMP + time exceeded. + + ā€¢ ICMP time exceeded. For each router port P, whose IP adā€ + dress is A, a priority-31 flow with match inport == P && + ip.ttl == {0, 1} && !ip.later_frag matches packets whose + TTL has expired, with the following actions to send an + ICMP time exceeded reply for IPv4 and IPv6 respectively: + + icmp4 { + icmp4.type = 11; /* Time exceeded. */ + icmp4.code = 0; /* TTL exceeded in transit. */ + ip4.dst = ip4.src; + ip4.src = A; + ip.ttl = 254; + next; + }; + icmp6 { + icmp6.type = 3; /* Time exceeded. */ + icmp6.code = 0; /* TTL exceeded in transit. */ + ip6.dst = ip6.src; + ip6.src = A; + ip.ttl = 254; + next; + }; + + + ā€¢ TTL discard. A priority-30 flow with match ip.ttl == {0, + 1} and actions drop; drops other packets whose TTL has + expired, that should not receive a ICMP error reply (i.e. + fragments with nonzero offset). + + ā€¢ Next table. A priority-0 flows match all packets that + arenā€™t already handled and uses actions next; to feed + them to the next table. + + Ingress Table 4: UNSNAT + + This is for already established connectionsā€™ reverse traffic. i.e., + SNAT has already been done in egress pipeline and now the packet has + entered the ingress pipeline as part of a reply. It is unSNATted here. + + Ingress Table 4: UNSNAT on Gateway and Distributed Routers + + ā€¢ If the Router (Gateway or Distributed) is configured with + load balancers, then below lflows are added: + + For each IPv4 address A defined as load balancer VIP with + the protocol P (and the protocol port T if defined) is + also present as an external_ip in the NAT table, a priorā€ + ity-120 logical flow is added with the match ip4 && + ip4.dst == A && P with the action next; to advance the + packet to the next table. If the load balancer has protoā€ + col port B defined, then the match also has P.dst == B. + + The above flows are also added for IPv6 load balancers. + + Ingress Table 4: UNSNAT on Gateway Routers + + ā€¢ If the Gateway router has been configured to force SNAT + any previously DNATted packets to B, a priority-110 flow + matches ip && ip4.dst == B or ip && ip6.dst == B with an + action ct_snat; . + + If the Gateway router is configured with + lb_force_snat_ip=router_ip then for every logical router + port P attached to the Gateway router with the router ip + B, a priority-110 flow is added with the match inport == + P && ip4.dst == B or inport == P && ip6.dst == B with an + action ct_snat; . + + If the Gateway router has been configured to force SNAT + any previously load-balanced packets to B, a priority-100 + flow matches ip && ip4.dst == B or ip && ip6.dst == B + with an action ct_snat; . + + For each NAT configuration in the OVN Northbound dataā€ + base, that asks to change the source IP address of a + packet from A to B, a priority-90 flow matches ip && + ip4.dst == B or ip && ip6.dst == B with an action + ct_snat; . If the NAT rule is of type dnat_and_snat and + has stateless=true in the options, then the action would + be next;. + + A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 4: UNSNAT on Distributed Routers + + ā€¢ For each configuration in the OVN Northbound database, + that asks to change the source IP address of a packet + from A to B, two priority-100 flows are added. + + If the NAT rule cannot be handled in a distributed manā€ + ner, then the below priority-100 flows are only proā€ + grammed on the gateway chassis. + + ā€¢ The first flow matches ip && ip4.dst == B && inā€ā€ + port == GW + or ip && ip6.dst == B && inport == GW where GW is + the distributed gateway port corresponding to the + NAT rule (specified or inferred), with an action + ct_snat; to unSNAT in the common zone. If the NAT + rule is of type dnat_and_snat and has stateā€ā€ + less=true in the options, then the action would be + next;. + + If the NAT entry is of type snat, then there is an + additional match is_chassis_resident(cr-GW) + where cr-GW is the chassis resident port of GW. + + A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 5: DEFRAG + + This is to send packets to connection tracker for tracking and defragā€ + mentation. It contains a priority-0 flow that simply moves traffic to + the next table. + + For all load balancing rules that are configured in OVN_Northbound + database for a Gateway router, a priority-100 flow is added for each + configured virtual IP address VIP. For IPv4 VIPs the flow matches ip && + ip4.dst == VIP. For IPv6 VIPs, the flow matches ip && ip6.dst == VIP. + The flow applies the action ct_dnat; to send IP packets to the connecā€ + tion tracker for packet de-fragmentation and to dnat the destination IP + for the committed connection before sending it to the next table. + + If ECMP routes with symmetric reply are configured in the OVN_Northā€ā€ + bound database for a gateway router, a priority-100 flow is added for + each router port on which symmetric replies are configured. The matchā€ + ing logic for these ports essentially reverses the configured logic of + the ECMP route. So for instance, a route with a destination routing + policy will instead match if the source IP address matches the static + routeā€™s prefix. The flow uses the actions chk_ecmp_nh_mac(); ct_next or + chk_ecmp_nh(); ct_next to send IP packets to table 76 or to table 77 in + order to check if source info are already stored by OVN and then to the + connection tracker for packet de-fragmentation and tracking before + sending it to the next table. + + If load balancing rules are configured in OVN_Northbound database for a + Gateway router, a priority 50 flow that matches icmp || icmp6 with an + action of ct_dnat;, this allows potentially related ICMP traffic to + pass through CT. + + Ingress Table 6: Load balancing affinity check + + Load balancing affinity check table contains the following logical + flows: + + ā€¢ For all the configured load balancing rules for a logical + router where a positive affinity timeout is specified in + options column, that includes a L4 port PORT of protocol + P and IPv4 or IPv6 address VIP, a priority-100 flow that + matches on ct.new && ip && ip.dst == VIP && P && P.dst == + PORT (xxreg0 == VIP + in the IPv6 case) with an action of reg0 = ip.dst; + reg9[16..31] = P.dst; reg9[6] = chk_lb_aff(); next; + (xxreg0 == ip6.dst in the IPv6 case) + + ā€¢ A priority 0 flow is added which matches on all packets + and applies the action next;. + + Ingress Table 7: DNAT + + Packets enter the pipeline with destination IP address that needs to be + DNATted from a virtual IP address to a real IP address. Packets in the + reverse direction needs to be unDNATed. + + Ingress Table 7: Load balancing DNAT rules + + Following load balancing DNAT flows are added for Gateway router or + Router with gateway port. These flows are programmed only on the gateā€ + way chassis. These flows do not get programmed for load balancers with + IPv6 VIPs. + + ā€¢ For all the configured load balancing rules for a logical + router where a positive affinity timeout is specified in + options column, that includes a L4 port PORT of protocol + P and IPv4 or IPv6 address VIP, a priority-150 flow that + matches on reg9[6] == 1 && ct.new && ip && ip.dst == VIP + && P && P.dst == PORT with an action of ct_lb_mark(args) + , where args contains comma separated IP addresses (and + optional port numbers) to load balance to. The address + family of the IP addresses of args is the same as the adā€ + dress family of VIP. + + ā€¢ If controller_event has been enabled for all the configā€ + ured load balancing rules for a Gateway router or Router + with gateway port in OVN_Northbound database that does + not have configured backends, a priority-130 flow is + added to trigger ovn-controller events whenever the chasā€ + sis receives a packet for that particular VIP. If + event-elb meter has been previously created, it will be + associated to the empty_lb logical flow + + ā€¢ For all the configured load balancing rules for a Gateway + router or Router with gateway port in OVN_Northbound + database that includes a L4 port PORT of protocol P and + IPv4 or IPv6 address VIP, a priority-120 flow that + matches on ct.new && !ct.rel && ip && ip.dst == VIP && P + && P.dst == + PORT with an action of ct_lb_mark(args), where args conā€ + tains comma separated IPv4 or IPv6 addresses (and opā€ + tional port numbers) to load balance to. If the router is + configured to force SNAT any load-balanced packets, the + above action will be replaced by flags.force_snat_for_lb + = 1; ct_lb_mark(args; force_snat);. If the load balancing + rule is configured with skip_snat set to true, the above + action will be replaced by flags.skip_snat_for_lb = 1; + ct_lb_mark(args; skip_snat);. If health check is enabled, + then args will only contain those endpoints whose service + monitor status entry in OVN_Southbound db is either onā€ā€ + line or empty. + + ā€¢ For all the configured load balancing rules for a router + in OVN_Northbound database that includes just an IP adā€ + dress VIP to match on, a priority-110 flow that matches + on ct.new && !ct.rel && ip4 && ip.dst == VIP with an acā€ + tion of ct_lb_mark(args), where args contains comma sepaā€ + rated IPv4 or IPv6 addresses. If the router is configured + to force SNAT any load-balanced packets, the above action + will be replaced by flags.force_snat_for_lb = 1; + ct_lb_mark(args; force_snat);. If the load balancing rule + is configured with skip_snat set to true, the above acā€ + tion will be replaced by flags.skip_snat_for_lb = 1; + ct_lb_mark(args; skip_snat);. + + The previous table lr_in_defrag sets the register reg0 + (or xxreg0 for IPv6) and does ct_dnat. Hence for estabā€ + lished traffic, this table just advances the packet to + the next stage. + + ā€¢ If the load balancer is created with --reject option and + it has no active backends, a TCP reset segment (for tcp) + or an ICMP port unreachable packet (for all other kind of + traffic) will be sent whenever an incoming packet is reā€ + ceived for this load-balancer. Please note using --reject + option will disable empty_lb SB controller event for this + load balancer. + + ā€¢ For the related traffic, a priority 50 flow that matches + ct.rel && !ct.est && !ct.new with an action of ct_comā€ā€ + mit_nat;, if the router has load balancer assigned to it. + Along with two priority 70 flows that match skip_snat and + force_snat flags, setting the flags.force_snat_for_lb = 1 + or flags.skip_snat_for_lb = 1 accordingly. + + ā€¢ For the established traffic, a priority 50 flow that + matches ct.est && !ct.rel && !ct.new && ct_mark.natted + with an action of next;, if the router has load balancer + assigned to it. Along with two priority 70 flows that + match skip_snat and force_snat flags, setting the + flags.force_snat_for_lb = 1 or flags.skip_snat_for_lb = 1 + accordingly. + + Ingress Table 7: DNAT on Gateway Routers + + ā€¢ For each configuration in the OVN Northbound database, + that asks to change the destination IP address of a + packet from A to B, a priority-100 flow matches ip && + ip4.dst == A or ip && ip6.dst == A with an action + flags.loopback = 1; ct_dnat(B);. If the Gateway router is + configured to force SNAT any DNATed packet, the above acā€ + tion will be replaced by flags.force_snat_for_dnat = 1; + flags.loopback = 1; ct_dnat(B);. If the NAT rule is of + type dnat_and_snat and has stateless=true in the options, + then the action would be ip4/6.dst= (B). + + If the NAT rule has allowed_ext_ips configured, then + there is an additional match ip4.src == allowed_ext_ips . + Similarly, for IPV6, match would be ip6.src == alā€ + lowed_ext_ips. + + If the NAT rule has exempted_ext_ips set, then there is + an additional flow configured at priority 101. The flow + matches if source ip is an exempted_ext_ip and the action + is next; . This flow is used to bypass the ct_dnat action + for a packet originating from exempted_ext_ips. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 7: DNAT on Distributed Routers + + On distributed routers, the DNAT table only handles packets with destiā€ + nation IP address that needs to be DNATted from a virtual IP address to + a real IP address. The unDNAT processing in the reverse direction is + handled in a separate table in the egress pipeline. + + ā€¢ For each configuration in the OVN Northbound database, + that asks to change the destination IP address of a + packet from A to B, a priority-100 flow matches ip && + ip4.dst == B && inport == GW, where GW is the logical + router gateway port corresponding to the NAT rule (speciā€ + fied or inferred), with an action ct_dnat(B);. The match + will include ip6.dst == B in the IPv6 case. If the NAT + rule is of type dnat_and_snat and has stateless=true in + the options, then the action would be ip4/6.dst=(B). + + If the NAT rule cannot be handled in a distributed manā€ + ner, then the priority-100 flow above is only programmed + on the gateway chassis. + + If the NAT rule has allowed_ext_ips configured, then + there is an additional match ip4.src == allowed_ext_ips . + Similarly, for IPV6, match would be ip6.src == alā€ + lowed_ext_ips. + + If the NAT rule has exempted_ext_ips set, then there is + an additional flow configured at priority 101. The flow + matches if source ip is an exempted_ext_ip and the action + is next; . This flow is used to bypass the ct_dnat action + for a packet originating from exempted_ext_ips. + + A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 8: Load balancing affinity learn + + Load balancing affinity learn table contains the following logical + flows: + + ā€¢ For all the configured load balancing rules for a logical + router where a positive affinity timeout T is specified + in options + column, that includes a L4 port PORT of protocol P and + IPv4 or IPv6 address VIP, a priority-100 flow that + matches on reg9[6] == 0 && ct.new && ip && reg0 == VIP && + P && reg9[16..31] == PORT (xxreg0 == VIP in the IPv6 + case) with an action of commit_lb_aff(vip = VIP:PORT, + backend = backend ip: backend port, proto = P, timeout = + T);. + + ā€¢ A priority 0 flow is added which matches on all packets + and applies the action next;. + + Ingress Table 9: ECMP symmetric reply processing + + ā€¢ If ECMP routes with symmetric reply are configured in the + OVN_Northbound database for a gateway router, a priorā€ + ity-100 flow is added for each router port on which symā€ + metric replies are configured. The matching logic for + these ports essentially reverses the configured logic of + the ECMP route. So for instance, a route with a destinaā€ + tion routing policy will instead match if the source IP + address matches the static routeā€™s prefix. The flow uses + the action ct_commit { ct_label.ecmp_reply_eth = + eth.src;" " ct_mark.ecmp_reply_port = K;}; comā€ā€ + mit_ecmp_nh(); next; + to commit the connection and storing eth.src and the + ECMP reply port binding tunnel key K in the ct_label and + the traffic pattern to table 76 or 77. + + Ingress Table 10: IPv6 ND RA option processing + + ā€¢ A priority-50 logical flow is added for each logical + router port configured with IPv6 ND RA options which + matches IPv6 ND Router Solicitation packet and applies + the action put_nd_ra_opts and advances the packet to the + next table. + + reg0[5] = put_nd_ra_opts(options);next; + + + For a valid IPv6 ND RS packet, this transforms the packet + into an IPv6 ND RA reply and sets the RA options to the + packet and stores 1 into reg0[5]. For other kinds of + packets, it just stores 0 into reg0[5]. Either way, it + continues to the next table. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 11: IPv6 ND RA responder + + This table implements IPv6 ND RA responder for the IPv6 ND RA replies + generated by the previous table. + + ā€¢ A priority-50 logical flow is added for each logical + router port configured with IPv6 ND RA options which + matches IPv6 ND RA packets and reg0[5] == 1 and responds + back to the inport after applying these actions. If + reg0[5] is set to 1, it means that the action + put_nd_ra_opts was successful. + + eth.dst = eth.src; + eth.src = E; + ip6.dst = ip6.src; + ip6.src = I; + outport = P; + flags.loopback = 1; + output; + + + where E is the MAC address and I is the IPv6 link local + address of the logical router port. + + (This terminates packet processing in ingress pipeline; + the packet does not go to the next ingress table.) + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 12: IP Routing Pre + + If a packet arrived at this table from Logical Router Port P which has + options:route_table value set, a logical flow with match inport == "P" + with priority 100 and action setting unique-generated per-datapath + 32-bit value (non-zero) in OVS register 7. This registerā€™s value is + checked in next table. If packet didnā€™t match any configured inport + (
route table), register 7 value is set to 0. + + This table contains the following logical flows: + + ā€¢ Priority-100 flow with match inport == "LRP_NAME" value + and action, which set route table identifier in reg7. + + A priority-0 logical flow with match 1 has actions reg7 = + 0; next;. + + Ingress Table 13: IP Routing + + A packet that arrives at this table is an IP packet that should be + routed to the address in ip4.dst or ip6.dst. This table implements IP + routing, setting reg0 (or xxreg0 for IPv6) to the next-hop IP address + (leaving ip4.dst or ip6.dst, the packetā€™s final destination, unchanged) + and advances to the next table for ARP resolution. It also sets reg1 + (or xxreg1) to the IP address owned by the selected router port + (ingress table ARP Request will generate an ARP request, if needed, + with reg0 as the target protocol address and reg1 as the source protoā€ + col address). + + For ECMP routes, i.e. multiple static routes with same policy and preā€ + fix but different nexthops, the above actions are deferred to next taā€ + ble. This table, instead, is responsible for determine the ECMP group + id and select a member id within the group based on 5-tuple hashing. It + stores group id in reg8[0..15] and member id in reg8[16..31]. This step + is skipped with a priority-10300 rule if the traffic going out the ECMP + route is reply traffic, and the ECMP route was configured to use symā€ + metric replies. Instead, the stored values in conntrack is used to + choose the destination. The ct_label.ecmp_reply_eth tells the destinaā€ + tion MAC address to which the packet should be sent. The + ct_mark.ecmp_reply_port tells the logical router port on which the + packet should be sent. These values saved to the conntrack fields when + the initial ingress traffic is received over the ECMP route and commitā€ + ted to conntrack. If REGBIT_KNOWN_ECMP_NH is set, the priority-10300 + flows in this stage set the outport, while the eth.dst is set by flows + at the ARP/ND Resolution stage. + + This table contains the following logical flows: + + ā€¢ Priority-10550 flow that drops IPv6 Router Solicitaā€ + tion/Advertisement packets that were not processed in + previous tables. + + ā€¢ Priority-10550 flows that drop IGMP and MLD packets with + source MAC address owned by the router. These are used to + prevent looping statically forwarded IGMP and MLD packets + for which TTL is not decremented (it is always 1). + + ā€¢ Priority-10500 flows that match IP multicast traffic desā€ + tined to groups registered on any of the attached + switches and sets outport to the associated multicast + group that will eventually flood the traffic to all inā€ + terested attached logical switches. The flows also decreā€ + ment TTL. + + ā€¢ Priority-10460 flows that match IGMP and MLD control + packets, set outport to the MC_STATIC multicast group, + which ovn-northd populates with the logical ports that + have options :mcast_flood=ā€ā€™trueā€ā€™. If no router ports are + configured to flood multicast traffic the packets are + dropped. + + ā€¢ Priority-10450 flow that matches unregistered IP multiā€ + cast traffic decrements TTL and sets outport to the + MC_STATIC multicast group, which ovn-northd populates + with the logical ports that have options + :mcast_flood=ā€ā€™trueā€ā€™. If no router ports are configured to + flood multicast traffic the packets are dropped. + + ā€¢ IPv4 routing table. For each route to IPv4 network N with + netmask M, on router port P with IP address A and Etherā€ + net address E, a logical flow with match ip4.dst == N/M, + whose priority is the number of 1-bits in M, has the folā€ + lowing actions: + + ip.ttl--; + reg8[0..15] = 0; + reg0 = G; + reg1 = A; + eth.src = E; + outport = P; + flags.loopback = 1; + next; + + + (Ingress table 1 already verified that ip.ttl--; will not + yield a TTL exceeded error.) + + If the route has a gateway, G is the gateway IP address. + Instead, if the route is from a configured static route, + G is the next hop IP address. Else it is ip4.dst. + + ā€¢ IPv6 routing table. For each route to IPv6 network N with + netmask M, on router port P with IP address A and Etherā€ + net address E, a logical flow with match in CIDR notation + ip6.dst == N/M, whose priority is the integer value of M, + has the following actions: + + ip.ttl--; + reg8[0..15] = 0; + xxreg0 = G; + xxreg1 = A; + eth.src = E; + outport = inport; + flags.loopback = 1; + next; + + + (Ingress table 1 already verified that ip.ttl--; will not + yield a TTL exceeded error.) + + If the route has a gateway, G is the gateway IP address. + Instead, if the route is from a configured static route, + G is the next hop IP address. Else it is ip6.dst. + + If the address A is in the link-local scope, the route + will be limited to sending on the ingress port. + + For each static route the reg7 == id && is prefixed in + logical flow match portion. For routes with route_table + value set a unique non-zero id is used. For routes within +
route table (no route table set), this id value is + 0. + + For each connected route (route to the LRPā€™s subnet CIDR) + the logical flow match portion has no reg7 == id && preā€ + fix to have route to LRPā€™s subnets in all routing tables. + + ā€¢ For ECMP routes, they are grouped by policy and prefix. + An unique id (non-zero) is assigned to each group, and + each member is also assigned an unique id (non-zero) + within each group. + + For each IPv4/IPv6 ECMP group with group id GID and memā€ + ber ids MID1, MID2, ..., a logical flow with match in + CIDR notation ip4.dst == N/M, or ip6.dst == N/M, whose + priority is the integer value of M, has the following acā€ + tions: + + ip.ttl--; + flags.loopback = 1; + reg8[0..15] = GID; + select(reg8[16..31], MID1, MID2, ...); + + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + + Ingress Table 14: IP_ROUTING_ECMP + + This table implements the second part of IP routing for ECMP routes + following the previous table. If a packet matched a ECMP group in the + previous table, this table matches the group id and member id stored + from the previous table, setting reg0 (or xxreg0 for IPv6) to the next- + hop IP address (leaving ip4.dst or ip6.dst, the packetā€™s final destinaā€ + tion, unchanged) and advances to the next table for ARP resolution. It + also sets reg1 (or xxreg1) to the IP address owned by the selected + router port (ingress table ARP Request will generate an ARP request, if + needed, with reg0 as the target protocol address and reg1 as the source + protocol address). + + This processing is skipped for reply traffic being sent out of an ECMP + route if the route was configured to use symmetric replies. + + This table contains the following logical flows: + + ā€¢ A priority-150 flow that matches reg8[0..15] == 0 with + action next; directly bypasses packets of non-ECMP + routes. + + ā€¢ For each member with ID MID in each ECMP group with ID + GID, a priority-100 flow with match reg8[0..15] == GID && + reg8[16..31] == MID has following actions: + + [xx]reg0 = G; + [xx]reg1 = A; + eth.src = E; + outport = P; + + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + + Ingress Table 15: Router policies + + This table adds flows for the logical router policies configured on the + logical router. Please see the OVN_Northbound database Logiā€ā€ + cal_Router_Policy table documentation in ovn-nb for supported actions. + + ā€¢ For each router policy configured on the logical router, + a logical flow is added with specified priority, match + and actions. + + ā€¢ If the policy action is reroute with 2 or more nexthops + defined, then the logical flow is added with the followā€ + ing actions: + + reg8[0..15] = GID; + reg8[16..31] = select(1,..n); + + + where GID is the ECMP group id generated by ovn-northd + for this policy and n is the number of nexthops. select + action selects one of the nexthop member id, stores it in + the register reg8[16..31] and advances the packet to the + next stage. + + ā€¢ If the policy action is reroute with just one nexhop, + then the logical flow is added with the following acā€ + tions: + + [xx]reg0 = H; + eth.src = E; + outport = P; + reg8[0..15] = 0; + flags.loopback = 1; + next; + + + where H is the nexthop defined in the router policy, E + is the ethernet address of the logical router port from + which the nexthop is reachable and P is the logical + router port from which the nexthop is reachable. + + ā€¢ If a router policy has the option pkt_mark=m set and if + the action is not drop, then the action also includes + pkt.mark = m to mark the packet with the marker m. + + Ingress Table 16: ECMP handling for router policies + + This table handles the ECMP for the router policies configured with + multiple nexthops. + + ā€¢ A priority-150 flow is added to advance the packet to the + next stage if the ECMP group id register reg8[0..15] is + 0. + + ā€¢ For each ECMP reroute router policy with multiple nexā€ + thops, a priority-100 flow is added for each nexthop H + with the match reg8[0..15] == GID && reg8[16..31] == M + where GID is the router policy group id generated by + ovn-northd and M is the member id of the nexthop H generā€ + ated by ovn-northd. The following actions are added to + the flow: + + [xx]reg0 = H; + eth.src = E; + outport = P + "flags.loopback = 1; " + "next;" + + + where H is the nexthop defined in the router policy, E + is the ethernet address of the logical router port from + which the nexthop is reachable and P is the logical + router port from which the nexthop is reachable. + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + + Ingress Table 17: ARP/ND Resolution + + Any packet that reaches this table is an IP packet whose next-hop IPv4 + address is in reg0 or IPv6 address is in xxreg0. (ip4.dst or ip6.dst + contains the final destination.) This table resolves the IP address in + reg0 (or xxreg0) into an output port in outport and an Ethernet address + in eth.dst, using the following flows: + + ā€¢ A priority-500 flow that matches IP multicast traffic + that was allowed in the routing pipeline. For this kind + of traffic the outport was already set so the flow just + advances to the next table. + + ā€¢ Priority-200 flows that match ECMP reply traffic for the + routes configured to use symmetric replies, with actions + push(xxreg1); xxreg1 = ct_label; eth.dst = + xxreg1[32..79]; pop(xxreg1); next;. xxreg1 is used here + to avoid masked access to ct_label, to make the flow HW- + offloading friendly. + + ā€¢ Static MAC bindings. MAC bindings can be known statically + based on data in the OVN_Northbound database. For router + ports connected to logical switches, MAC bindings can be + known statically from the addresses column in the Logiā€ā€ + cal_Switch_Port table. (Note: the flow is not installed + for IPs of logical switch ports of type virtual, and dyā€ + namic MAC binding is used for those IPs instead, so that + virtual parent failover does not depend on ovn-northd, to + achieve better failover performance.) For router ports + connected to other logical routers, MAC bindings can be + known statically from the mac and networks column in the + Logical_Router_Port table. (Note: the flow is NOT inā€ + stalled for the IP addresses that belong to a neighbor + logical router port if the current router has the opā€ā€ + tions:dynamic_neigh_routers set to true) + + For each IPv4 address A whose host is known to have Ethā€ + ernet address E on router port P, a priority-100 flow + with match outport === P && reg0 == A has actions eth.dst + = E; next;. + + For each IPv6 address A whose host is known to have Ethā€ + ernet address E on router port P, a priority-100 flow + with match outport === P && xxreg0 == A has actions + eth.dst = E; next;. + + For each logical router port with an IPv4 address A and a + mac address of E that is reachable via a different logiā€ + cal router port P, a priority-100 flow with match outport + === P && reg0 == A has actions eth.dst = E; next;. + + For each logical router port with an IPv6 address A and a + mac address of E that is reachable via a different logiā€ + cal router port P, a priority-100 flow with match outport + === P && xxreg0 == A has actions eth.dst = E; next;. + + ā€¢ Static MAC bindings from NAT entries. MAC bindings can + also be known for the entries in the NAT table. Below + flows are programmed for distributed logical routers i.e + with a distributed router port. + + For each row in the NAT table with IPv4 address A in the + external_ip column of NAT table, below two flows are proā€ + grammed: + + A priority-100 flow with the match outport == P && reg0 + == A has actions eth.dst = E; next;, where P is the disā€ + tributed logical router port, E is the Ethernet address + if set in the external_mac column of NAT table for of + type dnat_and_snat, otherwise the Ethernet address of the + distributed logical router port. Note that if the exterā€ā€ + nal_ip is not within a subnet on the owning logical + router, then OVN will only create ARP resolution flows if + the options:add_route is set to true. Otherwise, no ARP + resolution flows will be added. + + Corresponding to the above flow, a priority-150 flow with + the match inport == P && outport == P && ip4.dst == A has + actions drop; to exclude packets that have gone through + DNAT/unSNAT stage but failed to convert the destination, + to avoid loop. + + For IPv6 NAT entries, same flows are added, but using the + register xxreg0 and field ip6 for the match. + + ā€¢ If the router datapath runs a port with redirect-type set + to bridged, for each distributed NAT rule with IP A in + the logical_ip column and logical port P in the logiā€ā€ + cal_port column of NAT table, a priority-90 flow with the + match outport == Q && ip.src === A && is_chassis_resiā€ā€ + dent(P), where Q is the distributed logical router port + and action get_arp(outport, reg0); next; for IPv4 and + get_nd(outport, xxreg0); next; for IPv6. + + ā€¢ Traffic with IP destination an address owned by the + router should be dropped. Such traffic is normally + dropped in ingress table IP Input except for IPs that are + also shared with SNAT rules. However, if there was no unā€ + SNAT operation that happened successfully until this + point in the pipeline and the destination IP of the + packet is still a router owned IP, the packets can be + safely dropped. + + A priority-2 logical flow with match ip4.dst = {..} + matches on traffic destined to router owned IPv4 adā€ + dresses which are also SNAT IPs. This flow has action + drop;. + + A priority-2 logical flow with match ip6.dst = {..} + matches on traffic destined to router owned IPv6 adā€ + dresses which are also SNAT IPs. This flow has action + drop;. + + A priority-0 logical that flow matches all packets not + already handled (match 1) and drops them (action drop;). + + ā€¢ Dynamic MAC bindings. These flows resolve MAC-to-IP bindā€ + ings that have become known dynamically through ARP or + neighbor discovery. (The ingress table ARP Request will + issue an ARP or neighbor solicitation request for cases + where the binding is not yet known.) + + A priority-0 logical flow with match ip4 has actions + get_arp(outport, reg0); next;. + + A priority-0 logical flow with match ip6 has actions + get_nd(outport, xxreg0); next;. + + ā€¢ For a distributed gateway LRP with redirect-type set to + bridged, a priority-50 flow will match outport == + "ROUTER_PORT" and !is_chassis_resident ("cr-ROUTER_PORT") + has actions eth.dst = E; next;, where E is the ethernet + address of the logical router port. + + Ingress Table 18: Check packet length + + For distributed logical routers or gateway routers with gateway port + configured with options:gateway_mtu to a valid integer value, this taā€ + ble adds a priority-50 logical flow with the match outport == GW_PORT + where GW_PORT is the gateway router port and applies the action + check_pkt_larger and advances the packet to the next table. + + REGBIT_PKT_LARGER = check_pkt_larger(L); next; + + + where L is the packet length to check for. If the packet is larger than + L, it stores 1 in the register bit REGBIT_PKT_LARGER. The value of L is + taken from options:gateway_mtu column of Logical_Router_Port row. + + If the port is also configured with options:gateway_mtu_bypass then anā€ + other flow is added, with priority-55, to bypass the check_pkt_larger + flow. + + This table adds one priority-0 fallback flow that matches all packets + and advances to the next table. + + Ingress Table 19: Handle larger packets + + For distributed logical routers or gateway routers with gateway port + configured with options:gateway_mtu to a valid integer value, this taā€ + ble adds the following priority-150 logical flow for each logical + router port with the match inport == LRP && outport == GW_PORT && REGā€ā€ + BIT_PKT_LARGER && !REGBIT_EGRESS_LOOPBACK, where LRP is the logical + router port and GW_PORT is the gateway port and applies the following + action for ipv4 and ipv6 respectively: + + icmp4 { + icmp4.type = 3; /* Destination Unreachable. */ + icmp4.code = 4; /* Frag Needed and DF was Set. */ + icmp4.frag_mtu = M; + eth.dst = E; + ip4.dst = ip4.src; + ip4.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER = 0; + next(pipeline=ingress, table=0); + }; + icmp6 { + icmp6.type = 2; + icmp6.code = 0; + icmp6.frag_mtu = M; + eth.dst = E; + ip6.dst = ip6.src; + ip6.src = I; + ip.ttl = 255; + REGBIT_EGRESS_LOOPBACK = 1; + REGBIT_PKT_LARGER = 0; + next(pipeline=ingress, table=0); + }; + + + ā€¢ Where M is the (fragment MTU - 58) whose value is taken + from options:gateway_mtu column of Logical_Router_Port + row. + + ā€¢ E is the Ethernet address of the logical router port. + + ā€¢ I is the IPv4/IPv6 address of the logical router port. + + This table adds one priority-0 fallback flow that matches all packets + and advances to the next table. + + Ingress Table 20: Gateway Redirect + + For distributed logical routers where one or more of the logical router + ports specifies a gateway chassis, this table redirects certain packets + to the distributed gateway port instances on the gateway chassises. + This table has the following flows: + + ā€¢ For each NAT rule in the OVN Northbound database that can + be handled in a distributed manner, a priority-100 logiā€ + cal flow with match ip4.src == B && outport == GW && + is_chassis_resident(P), where GW is the distributed gateā€ + way port specified in the NAT rule and P is the NAT logiā€ + cal port. IP traffic matching the above rule will be manā€ + aged locally setting reg1 to C and eth.src to D, where C + is NAT external ip and D is NAT external mac. + + ā€¢ For each dnat_and_snat NAT rule with stateless=true and + allowed_ext_ips configured, a priority-75 flow is proā€ + grammed with match ip4.dst == B and action outport = CR; + next; where B is the NAT rule external IP and CR is the + chassisredirect port representing the instance of the + logical router distributed gateway port on the gateway + chassis. Moreover a priority-70 flow is programmed with + same match and action drop;. For each dnat_and_snat NAT + rule with stateless=true and exempted_ext_ips configured, + a priority-75 flow is programmed with match ip4.dst == B + and action drop; where B is the NAT rule external IP. A + similar flow is added for IPv6 traffic. + + ā€¢ For each NAT rule in the OVN Northbound database that can + be handled in a distributed manner, a priority-80 logical + flow with drop action if the NAT logical port is a virā€ + tual port not claimed by any chassis yet. + + ā€¢ A priority-50 logical flow with match outport == GW has + actions outport = CR; next;, where GW is the logical + router distributed gateway port and CR is the chasā€ā€ + sisredirect port representing the instance of the logical + router distributed gateway port on the gateway chassis. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Ingress Table 21: ARP Request + + In the common case where the Ethernet destination has been resolved, + this table outputs the packet. Otherwise, it composes and sends an ARP + or IPv6 Neighbor Solicitation request. It holds the following flows: + + ā€¢ Unknown MAC address. A priority-100 flow for IPv4 packets + with match eth.dst == 00:00:00:00:00:00 has the following + actions: + + arp { + eth.dst = ff:ff:ff:ff:ff:ff; + arp.spa = reg1; + arp.tpa = reg0; + arp.op = 1; /* ARP request. */ + output; + }; + + + Unknown MAC address. For each IPv6 static route associā€ + ated with the router with the nexthop IP: G, a priorā€ + ity-200 flow for IPv6 packets with match eth.dst == + 00:00:00:00:00:00 && xxreg0 == G with the following acā€ + tions is added: + + nd_ns { + eth.dst = E; + ip6.dst = I + nd.target = G; + output; + }; + + + Where E is the multicast mac derived from the Gateway IP, + I is the solicited-node multicast address corresponding + to the target address G. + + Unknown MAC address. A priority-100 flow for IPv6 packets + with match eth.dst == 00:00:00:00:00:00 has the following + actions: + + nd_ns { + nd.target = xxreg0; + output; + }; + + + (Ingress table IP Routing initialized reg1 with the IP + address owned by outport and (xx)reg0 with the next-hop + IP address) + + The IP packet that triggers the ARP/IPv6 NS request is + dropped. + + ā€¢ Known MAC address. A priority-0 flow with match 1 has acā€ + tions output;. + + Egress Table 0: Check DNAT local + + This table checks if the packet needs to be DNATed in the router + ingress table lr_in_dnat after it is SNATed and looped back to the + ingress pipeline. This check is done only for routers configured with + distributed gateway ports and NAT entries. This check is done so that + SNAT and DNAT is done in different zones instead of a common zone. + + ā€¢ A priority-0 logical flow with match 1 has actions REGā€ā€ + BIT_DST_NAT_IP_LOCAL = 0; next;. + + Egress Table 1: UNDNAT + + This is for already established connectionsā€™ reverse traffic. i.e., + DNAT has already been done in ingress pipeline and now the packet has + entered the egress pipeline as part of a reply. This traffic is unDā€ + NATed here. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Egress Table 1: UNDNAT on Gateway Routers + + ā€¢ For IPv6 Neighbor Discovery or Router Solicitation/Adverā€ + tisement traffic, a priority-100 flow with action next;. + + ā€¢ For all IP packets, a priority-50 flow with an action + flags.loopback = 1; ct_dnat;. + + Egress Table 1: UNDNAT on Distributed Routers + + ā€¢ For all the configured load balancing rules for a router + with gateway port in OVN_Northbound database that inā€ + cludes an IPv4 address VIP, for every backend IPv4 adā€ + dress B defined for the VIP a priority-120 flow is proā€ + grammed on gateway chassis that matches ip && ip4.src == + B && outport == GW, where GW is the logical router gateā€ + way port with an action ct_dnat;. If the backend IPv4 adā€ + dress B is also configured with L4 port PORT of protocol + P, then the match also includes P.src == PORT. These + flows are not added for load balancers with IPv6 VIPs. + + If the router is configured to force SNAT any load-balā€ + anced packets, above action will be replaced by + flags.force_snat_for_lb = 1; ct_dnat;. + + ā€¢ For each configuration in the OVN Northbound database + that asks to change the destination IP address of a + packet from an IP address of A to B, a priority-100 flow + matches ip && ip4.src == B && outport == GW, where GW is + the logical router gateway port, with an action ct_dnat;. + If the NAT rule is of type dnat_and_snat and has stateā€ā€ + less=true in the options, then the action would be next;. + + If the NAT rule cannot be handled in a distributed manā€ + ner, then the priority-100 flow above is only programmed + on the gateway chassis with the action ct_dnat. + + If the NAT rule can be handled in a distributed manner, + then there is an additional action eth.src = EA;, where + EA is the ethernet address associated with the IP address + A in the NAT rule. This allows upstream MAC learning to + point to the correct chassis. + + Egress Table 2: Post UNDNAT + + ā€¢ A priority-50 logical flow is added that commits any unā€ + tracked flows from the previous table lr_out_undnat for + Gateway routers. This flow matches on ct.new && ip with + action ct_commit { } ; next; . + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Egress Table 3: SNAT + + Packets that are configured to be SNATed get their source IP address + changed based on the configuration in the OVN Northbound database. + + ā€¢ A priority-120 flow to advance the IPv6 Neighbor soliciā€ + tation packet to next table to skip SNAT. In the case + where ovn-controller injects an IPv6 Neighbor Solicitaā€ + tion packet (for nd_ns action) we donā€™t want the packet + to go through conntrack. + + Egress Table 3: SNAT on Gateway Routers + + ā€¢ If the Gateway router in the OVN Northbound database has + been configured to force SNAT a packet (that has been + previously DNATted) to B, a priority-100 flow matches + flags.force_snat_for_dnat == 1 && ip with an action + ct_snat(B);. + + ā€¢ If a load balancer configured to skip snat has been apā€ + plied to the Gateway router pipeline, a priority-120 flow + matches flags.skip_snat_for_lb == 1 && ip with an action + next;. + + ā€¢ If the Gateway router in the OVN Northbound database has + been configured to force SNAT a packet (that has been + previously load-balanced) using router IP (i.e opā€ā€ + tions:lb_force_snat_ip=router_ip), then for each logical + router port P attached to the Gateway router, a priorā€ + ity-110 flow matches flags.force_snat_for_lb == 1 && outā€ā€ + port == P + with an action ct_snat(R); where R is the IP configured + on the router port. If R is an IPv4 address then the + match will also include ip4 and if it is an IPv6 address, + then the match will also include ip6. + + If the logical router port P is configured with multiple + IPv4 and multiple IPv6 addresses, only the first IPv4 and + first IPv6 address is considered. + + ā€¢ If the Gateway router in the OVN Northbound database has + been configured to force SNAT a packet (that has been + previously load-balanced) to B, a priority-100 flow + matches flags.force_snat_for_lb == 1 && ip with an action + ct_snat(B);. + + ā€¢ For each configuration in the OVN Northbound database, + that asks to change the source IP address of a packet + from an IP address of A or to change the source IP adā€ + dress of a packet that belongs to network A to B, a flow + matches ip && ip4.src == A && (!ct.trk || !ct.rpl) with + an action ct_snat(B);. The priority of the flow is calcuā€ + lated based on the mask of A, with matches having larger + masks getting higher priorities. If the NAT rule is of + type dnat_and_snat and has stateless=true in the options, + then the action would be ip4/6.src= (B). + + ā€¢ If the NAT rule has allowed_ext_ips configured, then + there is an additional match ip4.dst == allowed_ext_ips . + Similarly, for IPV6, match would be ip6.dst == alā€ + lowed_ext_ips. + + ā€¢ If the NAT rule has exempted_ext_ips set, then there is + an additional flow configured at the priority + 1 of corā€ + responding NAT rule. The flow matches if destination ip + is an exempted_ext_ip and the action is next; . This flow + is used to bypass the ct_snat action for a packet which + is destinted to exempted_ext_ips. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Egress Table 3: SNAT on Distributed Routers + + ā€¢ For each configuration in the OVN Northbound database, + that asks to change the source IP address of a packet + from an IP address of A or to change the source IP adā€ + dress of a packet that belongs to network A to B, two + flows are added. The priority P of these flows are calcuā€ + lated based on the mask of A, with matches having larger + masks getting higher priorities. + + If the NAT rule cannot be handled in a distributed manā€ + ner, then the below flows are only programmed on the + gateway chassis increasing flow priority by 128 in order + to be run first. + + ā€¢ The first flow is added with the calculated priorā€ + ity P and match ip && ip4.src == A && outport == + GW, where GW is the logical router gateway port, + with an action ct_snat(B); to SNATed in the common + zone. If the NAT rule is of type dnat_and_snat and + has stateless=true in the options, then the action + would be ip4/6.src=(B). + + If the NAT rule can be handled in a distributed manner, + then there is an additional action (for both the flows) + eth.src = EA;, where EA is the ethernet address associā€ + ated with the IP address A in the NAT rule. This allows + upstream MAC learning to point to the correct chassis. + + If the NAT rule has allowed_ext_ips configured, then + there is an additional match ip4.dst == allowed_ext_ips . + Similarly, for IPV6, match would be ip6.dst == alā€ + lowed_ext_ips. + + If the NAT rule has exempted_ext_ips set, then there is + an additional flow configured at the priority P + 2 of + corresponding NAT rule. The flow matches if destination + ip is an exempted_ext_ip and the action is next; . This + flow is used to bypass the ct_snat action for a flow + which is destinted to exempted_ext_ips. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Egress Table 4: Post SNAT + + Packets reaching this table are processed according to the flows below: + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and action next;. + + Egress Table 5: Egress Loopback + + For distributed logical routers where one of the logical router ports + specifies a gateway chassis. + + While UNDNAT and SNAT processing have already occurred by this point, + this traffic needs to be forced through egress loopback on this disā€ + tributed gateway port instance, in order for UNSNAT and DNAT processing + to be applied, and also for IP routing and ARP resolution after all of + the NAT processing, so that the packet can be forwarded to the destinaā€ + tion. + + This table has the following flows: + + ā€¢ For each NAT rule in the OVN Northbound database on a + distributed router, a priority-100 logical flow with + match ip4.dst == E && outport == GW && is_chassis_resiā€ā€ + dent(P), where E is the external IP address specified in + the NAT rule, GW is the distributed gateway port correā€ + sponding to the NAT rule (specified or inferred). For + dnat_and_snat NAT rule, P is the logical port specified + in the NAT rule. If logical_port column of NAT table is + NOT set, then P is the chassisredirect port of GW with + the following actions: + + clone { + ct_clear; + inport = outport; + outport = ""; + flags = 0; + flags.loopback = 1; + reg0 = 0; + reg1 = 0; + ... + reg9 = 0; + REGBIT_EGRESS_LOOPBACK = 1; + next(pipeline=ingress, table=0); + }; + + + flags.loopback is set since in_port is unchanged and the + packet may return back to that port after NAT processing. + REGBIT_EGRESS_LOOPBACK is set to indicate that egress + loopback has occurred, in order to skip the source IP adā€ + dress check against the router address. + + ā€¢ A priority-0 logical flow with match 1 has actions next;. + + Egress Table 6: Delivery + + Packets that reach this table are ready for delivery. It contains: + + ā€¢ Priority-110 logical flows that match IP multicast packā€ + ets on each enabled logical router port and modify the + Ethernet source address of the packets to the Ethernet + address of the port and then execute action output;. + + ā€¢ Priority-100 logical flows that match packets on each enā€ + abled logical router port, with action output;. + + ā€¢ A priority-0 logical flow that matches all packets not + already handled (match 1) and drops them (action drop;). + +DROP SAMPLING + As described in the previous section, there are several places where + ovn-northd might decided to drop a packet by explicitly creating a Logā€ā€ + ical_Flow with the drop; action. + + When debug drop-sampling has been cofigured in the OVN Northbound dataā€ + base, the ovn-northd will replace all the drop; actions with a samā€ā€ + ple(priority=65535, collector_set=id, obs_domain=obs_id, + obs_point=@cookie) action, where: + + ā€¢ id is the value the debug_drop_collector_set option conā€ + figured in the OVN Northbound. + + ā€¢ obs_id has itā€™s 8 most significant bits equal to the + value of the debug_drop_domain_id option in the OVN + Northbound and itā€™s 24 least significant bits equal to + the datapathā€™s tunnel key. + +OVN 23.06.3 ovn-northd ovn-northd(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sb.5 b/src/static/support/dist-docs-branch-23.06/ovn-sb.5 new file mode 100644 index 00000000..edae70f6 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-sb.5 @@ -0,0 +1,3514 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-sb" 5 " DB Schema 20.27.2" "Open vSwitch 23.06.3" "Open vSwitch Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.SH NAME +ovn-sb \- OVN_Southbound database schema +.PP +.PP +.PP +.PP +This database holds logical and physical configuration and state for the Open Virtual Network (OVN) system to support virtual network abstraction\[char46] For an introduction to OVN, please see \fBovn\-architecture\fR(7)\[char46] +.PP +.PP +The OVN Southbound database sits at the center of the OVN architecture\[char46] It is the one component that speaks both southbound directly to all the hypervisors and gateways, via \fBovn\-controller\fR/\fBovn\-controller\-vtep\fR, and northbound to the Cloud Management System, via \fBovn\-northd\fR: +.SS "Database Structure" +.PP +.PP +The OVN Southbound database contains classes of data with different properties, as described in the sections below\[char46] +.ST "Physical network" +.PP +.PP +Physical network tables contain information about the chassis nodes in the system\[char46] This contains all the information necessary to wire the overlay, such as IP addresses, supported tunnel types, and security keys\[char46] +.PP +.PP +The amount of physical network data is small (O(n) in the number of chassis) and it changes infrequently, so it can be replicated to every chassis\[char46] +.PP +.PP +The \fBChassis\fR and \fBEncap\fR tables are the physical network tables\[char46] +.ST "Logical Network" +.PP +.PP +Logical network tables contain the topology of logical switches and routers, ACLs, firewall rules, and everything needed to describe how packets traverse a logical network, represented as logical datapath flows (see Logical Datapath Flows, below)\[char46] +.PP +.PP +Logical network data may be large (O(n) in the number of logical ports, ACL rules, etc\[char46])\[char46] Thus, to improve scaling, each chassis should receive only data related to logical networks in which that chassis participates\[char46] +.PP +.PP +The logical network data is ultimately controlled by the cloud management system (CMS) running northbound of OVN\[char46] That CMS determines the entire OVN logical configuration and therefore the logical network data at any given time is a deterministic function of the CMS\(cqs configuration, although that happens indirectly via the \fBOVN_Northbound\fR database and \fBovn\-northd\fR\[char46] +.PP +.PP +Logical network data is likely to change more quickly than physical network data\[char46] This is especially true in a container environment where containers are created and destroyed (and therefore added to and deleted from logical switches) quickly\[char46] +.PP +.PP +The \fBLogical_Flow\fR, \fBMulticast_Group\fR, \fBAddress_Group\fR, \fBDHCP_Options\fR, \fBDHCPv6_Options\fR, and \fBDNS\fR tables contain logical network data\[char46] +.ST "Logical-physical bindings" +.PP +.PP +These tables link logical and physical components\[char46] They show the current placement of logical components (such as VMs and VIFs) onto chassis, and map logical entities to the values that represent them in tunnel encapsulations\[char46] +.PP +.PP +These tables change frequently, at least every time a VM powers up or down or migrates, and especially quickly in a container environment\[char46] The amount of data per VM (or VIF) is small\[char46] +.PP +.PP +Each chassis is authoritative about the VMs and VIFs that it hosts at any given time and can efficiently flood that state to a central location, so the consistency needs are minimal\[char46] +.PP +.PP +The \fBPort_Binding\fR and \fBDatapath_Binding\fR tables contain binding data\[char46] +.ST "MAC bindings" +.PP +.PP +The \fBMAC_Binding\fR table tracks the bindings from IP addresses to Ethernet addresses that are dynamically discovered using ARP (for IPv4) and neighbor discovery (for IPv6)\[char46] Usually, IP-to-MAC bindings for virtual machines are statically populated into the \fBPort_Binding\fR table, so \fBMAC_Binding\fR is primarily used to discover bindings on physical networks\[char46] +.SS "Common Columns" +.PP +.PP +Some tables contain a special column named \fBexternal_ids\fR\[char46] This column has the same form and purpose each place that it appears, so we describe it here to save space later\[char46] +.RS +.TP +\fBexternal_ids\fR: map of string-string pairs +Key-value pairs for use by the software that manages the OVN Southbound database rather than by \fBovn\-controller\fR/\fBovn\-controller\-vtep\fR\[char46] In particular, \fBovn\-northd\fR can use key-value pairs in this column to relate entities in the southbound database to higher-level entities (such as entities in the OVN Northbound database)\[char46] Individual key-value pairs in this column may be documented in some cases to aid in understanding and troubleshooting, but the reader should not mistake such documentation as comprehensive\[char46] +.RE +.SH "TABLE SUMMARY" +.PP +The following list summarizes the purpose of each of the tables in the +\fBOVN_Southbound\fR database. Each table is described in more detail on a later +page. +.IP "Table" 1in +Purpose +.TQ 1in +\fBSB_Global\fR +Southbound configuration +.TQ 1in +\fBChassis\fR +Physical Network Hypervisor and Gateway Information +.TQ 1in +\fBChassis_Private\fR +Chassis Private +.TQ 1in +\fBEncap\fR +Encapsulation Types +.TQ 1in +\fBAddress_Set\fR +Address Sets +.TQ 1in +\fBPort_Group\fR +Port Groups +.TQ 1in +\fBLogical_Flow\fR +Logical Network Flows +.TQ 1in +\fBLogical_DP_Group\fR +Logical Datapath Groups +.TQ 1in +\fBMulticast_Group\fR +Logical Port Multicast Groups +.TQ 1in +\fBMirror\fR +Mirror Entry +.TQ 1in +\fBMeter\fR +Meter entry +.TQ 1in +\fBMeter_Band\fR +Band for meter entries +.TQ 1in +\fBDatapath_Binding\fR +Physical-Logical Datapath Bindings +.TQ 1in +\fBPort_Binding\fR +Physical-Logical Port Bindings +.TQ 1in +\fBMAC_Binding\fR +IP to MAC bindings +.TQ 1in +\fBDHCP_Options\fR +DHCP Options supported by native OVN DHCP +.TQ 1in +\fBDHCPv6_Options\fR +DHCPv6 Options supported by native OVN DHCPv6 +.TQ 1in +\fBConnection\fR +OVSDB client connections\[char46] +.TQ 1in +\fBSSL\fR +SSL configuration\[char46] +.TQ 1in +\fBDNS\fR +Native DNS resolution +.TQ 1in +\fBRBAC_Role\fR +RBAC_Role configuration\[char46] +.TQ 1in +\fBRBAC_Permission\fR +RBAC_Permission configuration\[char46] +.TQ 1in +\fBGateway_Chassis\fR +Gateway_Chassis configuration\[char46] +.TQ 1in +\fBHA_Chassis\fR +HA_Chassis configuration\[char46] +.TQ 1in +\fBHA_Chassis_Group\fR +HA_Chassis_Group configuration\[char46] +.TQ 1in +\fBController_Event\fR +Controller Event table +.TQ 1in +\fBIP_Multicast\fR +IP_Multicast configuration\[char46] +.TQ 1in +\fBIGMP_Group\fR +IGMP_Group configuration\[char46] +.TQ 1in +\fBService_Monitor\fR +Service_Monitor configuration\[char46] +.TQ 1in +\fBLoad_Balancer\fR +Load_Balancer configuration\[char46] +.TQ 1in +\fBBFD\fR +BFD configuration\[char46] +.TQ 1in +\fBFDB\fR +Port to MAC bindings +.TQ 1in +\fBStatic_MAC_Binding\fR +IP to MAC bindings +.TQ 1in +\fBChassis_Template_Var\fR +Chassis_Template_Var configuration\[char46] +.\" check if in troff mode (TTY) +.if t \{ +.bp +.SH "TABLE RELATIONSHIPS" +.PP +The following diagram shows the relationship among tables in the +database. Each node represents a table. Tables that are part of the +``root set'' are shown with double borders. Each edge leads from the +table that contains it and points to the table that its value +represents. Edges are labeled with their column names, followed by a +constraint on the number of allowed values: \fB?\fR for zero or one, +\fB*\fR for zero or more, \fB+\fR for one or more. Thick lines +represent strong references; thin lines represent weak references. +.RS -1in +.ps -3 +.PS +linethick = 1; +linethick = 0.500000; +box at 0.186591,0.119525 wid 0.201873 height 0.095620 "SB_Global" +box at 0.186591,0.119525 wid 0.146317 height 0.040064 +linethick = 1.000000; +box at 0.928317,0.191240 wid 0.207840 height 0.095620 "Connection" +linethick = 1.000000; +box at 0.928317,0.047810 wid 0.143430 height 0.095620 "SSL" +linethick = 0.500000; +box at 2.919470,2.348045 wid 0.152063 height 0.095620 "Chassis" +box at 2.919470,2.348045 wid 0.096507 height 0.040064 +linethick = 1.000000; +box at 3.282252,1.694597 wid 0.143430 height 0.095620 "Encap" +linethick = 0.500000; +box at 2.486502,2.204615 wid 0.273588 height 0.095620 "Chassis_Private" +box at 2.486502,2.204615 wid 0.218032 height 0.040064 +linethick = 0.500000; +box at 0.186591,2.236361 wid 0.223770 height 0.095620 "Address_Set" +box at 0.186591,2.236361 wid 0.168214 height 0.040064 +linethick = 0.500000; +box at 0.186591,2.664164 wid 0.213825 height 0.095620 "Port_Group" +box at 0.186591,2.664164 wid 0.158270 height 0.040064 +linethick = 0.500000; +box at 0.186591,0.533885 wid 0.247675 height 0.095620 "Logical_Flow" +box at 0.186591,0.533885 wid 0.192119 height 0.040064 +linethick = 0.500000; +box at 1.642140,0.964175 wid 0.305449 height 0.095620 "Datapath_Binding" +box at 1.642140,0.964175 wid 0.249893 height 0.040064 +linethick = 1.000000; +box at 0.928317,0.610897 wid 0.327365 height 0.095620 "Logical_DP_Group" +linethick = 0.500000; +box at 0.186591,1.949501 wid 0.289518 height 0.095620 "Multicast_Group" +box at 0.186591,1.949501 wid 0.233963 height 0.040064 +linethick = 0.500000; +box at 0.928317,1.949501 wid 0.237730 height 0.095620 "Port_Binding" +box at 0.928317,1.949501 wid 0.182175 height 0.040064 +linethick = 0.500000; +box at 1.642140,1.683983 wid 0.143430 height 0.095620 "Mirror" +box at 1.642140,1.683983 wid 0.087874 height 0.040064 +linethick = 0.500000; +box at 0.186591,2.948347 wid 0.143430 height 0.095620 "Meter" +box at 0.186591,2.948347 wid 0.087874 height 0.040064 +linethick = 1.000000; +box at 0.928317,2.948347 wid 0.223770 height 0.095620 "Meter_Band" +linethick = 1.000000; +box at 2.074763,2.470247 wid 0.297493 height 0.095620 "Gateway_Chassis" +linethick = 0.500000; +box at 1.642140,2.071703 wid 0.333350 height 0.095620 "HA_Chassis_Group" +box at 1.642140,2.071703 wid 0.277795 height 0.040064 +linethick = 0.500000; +box at 0.928317,0.334670 wid 0.257639 height 0.095620 "MAC_Binding" +box at 0.928317,0.334670 wid 0.202083 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.091777 wid 0.269591 height 0.095620 "DHCP_Options" +box at 0.186591,3.091777 wid 0.214035 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.235207 wid 0.305449 height 0.095620 "DHCPv6_Options" +box at 0.186591,3.235207 wid 0.249893 height 0.040064 +linethick = 0.500000; +box at 0.928317,1.174003 wid 0.143430 height 0.095620 "DNS" +box at 0.928317,1.174003 wid 0.087874 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.378637 wid 0.223770 height 0.095620 "RBAC_Role" +box at 0.186591,3.378637 wid 0.168214 height 0.040064 +linethick = 0.500000; +box at 0.928317,3.378637 wid 0.319390 height 0.095620 "RBAC_Permission" +box at 0.928317,3.378637 wid 0.263834 height 0.040064 +linethick = 1.000000; +box at 2.486502,2.348045 wid 0.223770 height 0.095620 "HA_Chassis" +linethick = 0.500000; +box at 2.486502,1.827413 wid 0.291507 height 0.095620 "Controller_Event" +box at 2.486502,1.827413 wid 0.235952 height 0.040064 +linethick = 0.500000; +box at 0.928317,1.030573 wid 0.229756 height 0.095620 "IP_Multicast" +box at 0.928317,1.030573 wid 0.174200 height 0.040064 +linethick = 0.500000; +box at 0.186591,1.806147 wid 0.243697 height 0.095620 "IGMP_Group" +box at 0.186591,1.806147 wid 0.188142 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.522067 wid 0.289518 height 0.095620 "Service_Monitor" +box at 0.186591,3.522067 wid 0.233963 height 0.040064 +linethick = 0.500000; +box at 0.186591,0.826042 wid 0.263624 height 0.095620 "Load_Balancer" +box at 0.186591,0.826042 wid 0.208069 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.665497 wid 0.143430 height 0.095620 "BFD" +box at 0.186591,3.665497 wid 0.087874 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.808927 wid 0.143430 height 0.095620 "FDB" +box at 0.186591,3.808927 wid 0.087874 height 0.040064 +linethick = 0.500000; +box at 0.928317,0.754327 wid 0.357255 height 0.095620 "Static_MAC_Binding" +box at 0.928317,0.754327 wid 0.301700 height 0.040064 +linethick = 0.500000; +box at 0.186591,3.952357 wid 0.373186 height 0.095620 "Chassis_Template_Var" +box at 0.186591,3.952357 wid 0.317630 height 0.040064 +linethick = 1.000000; +spline -> from 0.288562,0.129196 to 0.288562,0.129196 to 0.428320,0.142808 to 0.681732,0.167486 to 0.823193,0.181261 +"connections*" at 0.561442,0.188916 +linethick = 1.000000; +spline -> from 0.288466,0.108731 to 0.288466,0.108731 to 0.329468,0.104342 to 0.377508,0.099292 to 0.420996,0.094956 to 0.575977,0.079502 to 0.757903,0.062880 to 0.855417,0.054092 +"ssl?" at 0.561442,0.114545 +linethick = 1.000000; +spline -> from 2.948921,2.298896 to 2.948921,2.298896 to 3.015281,2.177459 to 3.186632,1.864437 to 3.252992,1.743382 +"encaps+" at 3.103060,2.138446 +linethick = 0.500000; +spline -> from 2.624195,2.243819 to 2.624195,2.243819 to 2.677742,2.260074 to 2.739895,2.279772 to 2.795546,2.299470 to 2.810846,2.305016 to 2.827292,2.311135 to 2.842783,2.317255 +"chassis?" at 2.737792,2.319167 +linethick = 1.000000; +spline -> from 0.311377,0.513403 to 0.311377,0.513403 to 0.488312,0.487356 to 0.825564,0.451403 to 1.106935,0.501336 to 1.256409,0.527861 to 1.310185,0.522716 to 1.427664,0.618872 to 1.527262,0.700397 to 1.592704,0.841800 to 1.621926,0.915829 +"logical_datapath?" at 0.928317,0.520938 +linethick = 1.000000; +spline -> from 0.311683,0.546679 to 0.311683,0.546679 to 0.435396,0.559626 to 0.627248,0.579687 to 0.763526,0.593953 +"logical_dp_group?" at 0.561442,0.605925 +linethick = 0.500000; +spline -> from 1.092688,0.618853 to 1.092688,0.618853 to 1.194791,0.630021 to 1.326116,0.656125 to 1.427664,0.716481 to 1.510337,0.765648 to 1.576621,0.858725 to 1.611828,0.915734 +"datapaths*" at 1.291195,0.736083 +linethick = 1.000000; +spline -> from 0.329124,1.900600 to 0.329124,1.900600 to 0.344328,1.893658 to 0.359302,1.886066 to 0.373186,1.877862 to 0.396995,1.863806 to 0.398257,1.853785 to 0.420996,1.838027 to 0.632565,1.691288 to 1.237017,1.437379 to 1.427664,1.264307 to 1.510299,1.189283 to 1.578935,1.076586 to 1.614104,1.012769 +"datapath" at 0.928317,1.668378 +linethick = 0.500000; +spline -> from 0.332107,1.949501 to 0.332107,1.949501 to 0.470967,1.949501 to 0.679323,1.949501 to 0.808639,1.949501 +"ports*" at 0.561442,1.968433 +linethick = 0.500000; +spline -> from 1.047555,1.932098 to 1.047555,1.932098 to 1.329194,1.894615 to 2.065201,1.824640 to 2.632227,2.018729 to 2.711209,2.045694 to 2.737792,2.051240 to 2.795546,2.111672 to 2.847946,2.166175 to 2.882943,2.247835 to 2.901302,2.299470 +"chassis?" at 2.074763,1.952560 +linethick = 0.500000; +spline -> from 0.930784,1.998267 to 0.930784,1.998267 to 0.932888,2.133473 to 0.956888,2.518631 to 1.154745,2.741043 to 1.257269,2.856361 to 1.324146,2.843739 to 1.475474,2.873955 to 1.792072,2.936873 to 2.582505,3.033831 to 2.795546,2.863245 to 2.868600,2.804917 to 2.902067,2.513659 to 2.912776,2.396811 +"additional_chassis*" at 2.074763,2.975121 +linethick = 0.500000; +spline -> from 0.929312,1.997884 to 0.929312,1.997884 to 0.927801,2.127927 to 0.943827,2.485546 to 1.154745,2.640259 to 1.301790,2.747928 to 2.644467,2.742190 to 2.795546,2.640259 to 2.877015,2.585182 to 2.903788,2.464319 to 2.912585,2.396428 +"requested_chassis?" at 2.074763,2.736071 +linethick = 0.500000; +spline -> from 0.954823,1.997693 to 0.954823,1.997693 to 0.990069,2.064627 to 1.062051,2.185108 to 1.154745,2.257779 to 1.419842,2.465084 to 1.526286,2.477514 to 1.856615,2.541962 to 2.195244,2.607940 to 2.296792,2.593406 to 2.632227,2.512702 to 2.708341,2.494343 to 2.728039,2.486120 to 2.795546,2.446342 to 2.819260,2.432190 to 2.843356,2.413831 to 2.863819,2.396620 +"requested_additional_chassis*" at 2.074763,2.600673 +linethick = 0.500000; +spline -> from 1.047613,1.914886 to 1.047613,1.914886 to 1.081902,1.905381 to 1.119653,1.895781 to 1.154745,1.888495 to 1.676142,1.780234 to 1.810048,1.762430 to 2.340778,1.717832 to 2.664929,1.690600 to 3.053912,1.691709 to 3.209963,1.693507 +"encap?" at 2.486502,1.737435 +linethick = 0.500000; +spline -> from 0.954402,1.901251 to 0.954402,1.901251 to 0.988711,1.836153 to 1.059068,1.721963 to 1.154745,1.665375 to 1.275112,1.594215 to 1.962122,1.561800 to 2.072085,1.561800 to 2.072085,1.561800 to 2.072085,1.561800 to 2.922147,1.561800 to 3.027329,1.561800 to 3.139778,1.613033 to 3.209963,1.651855 +"additional_encap*" at 2.486502,1.580713 +linethick = 1.000000; +spline -> from 0.941054,1.900715 to 0.941054,1.900715 to 0.962798,1.808212 to 1.023191,1.607678 to 1.154745,1.505346 to 1.252813,1.429079 to 1.331604,1.523705 to 1.427664,1.444933 to 1.565548,1.331853 to 1.616360,1.111104 to 1.632692,1.013094 +"datapath" at 1.291195,1.524948 +linethick = 0.500000; +spline -> from 0.964901,1.900715 to 0.964901,1.900715 to 1.004029,1.848717 to 1.073507,1.768894 to 1.154745,1.731124 to 1.291214,1.667670 to 1.472261,1.669659 to 1.569908,1.676773 +"mirror_rules*" at 1.291195,1.750707 +linethick = 1.000000; +spline -> from 1.007185,1.998267 to 1.007185,1.998267 to 1.049812,2.024658 to 1.104335,2.056977 to 1.154745,2.082412 to 1.427530,2.220105 to 1.760938,2.352634 to 1.941277,2.421290 +"gateway_chassis*" at 1.291195,2.228902 +linethick = 1.000000; +spline -> from 1.047957,1.969772 to 1.047957,1.969772 to 1.164307,1.989852 to 1.343824,2.020833 to 1.474594,2.043399 +"ha_chassis_group?" at 1.291195,2.053535 +linethick = 1.000000; +spline -> from 0.259188,2.948347 to 0.259188,2.948347 to 0.387720,2.948347 to 0.662341,2.948347 to 0.815925,2.948347 +"bands+" at 0.561442,2.967280 +linethick = 0.500000; +spline -> from 2.224312,2.468335 to 2.224312,2.468335 to 2.371185,2.463554 to 2.602394,2.447298 to 2.795546,2.395855 to 2.811228,2.391647 to 2.827675,2.385910 to 2.843356,2.380173 +"chassis?" at 2.486502,2.483825 +linethick = 0.500000; +spline -> from 1.809723,2.042061 to 1.809723,2.042061 to 2.011462,2.013183 to 2.359710,1.987749 to 2.632227,2.095034 to 2.739131,2.137107 to 2.832264,2.238847 to 2.880839,2.299661 +"ref_chassis*" at 2.486502,2.114541 +linethick = 1.000000; +spline -> from 1.793831,2.120852 to 1.793831,2.120852 to 1.960019,2.175546 to 2.225077,2.262752 to 2.373671,2.311709 +"ha_chassis*" at 2.074763,2.300617 +linethick = 1.000000; +spline -> from 1.057997,0.318587 to 1.057997,0.318587 to 1.167501,0.311855 to 1.323878,0.320289 to 1.427664,0.403057 to 1.591270,0.533579 to 1.628542,0.805044 to 1.637014,0.915676 +"datapath" at 1.291195,0.422660 +linethick = 1.000000; +spline -> from 1.001180,1.161668 to 1.001180,1.161668 to 1.098425,1.143653 to 1.278937,1.106801 to 1.427664,1.057136 to 1.464612,1.044801 to 1.503969,1.028450 to 1.538602,1.012922 +"datapaths+" at 1.291195,1.150423 +linethick = 0.500000; +spline -> from 0.299501,3.378637 to 0.299501,3.378637 to 0.423673,3.378637 to 0.626540,3.378637 to 0.767561,3.378637 +"permissions value*" at 0.561442,3.397570 +linethick = 0.500000; +spline -> from 2.599143,2.348045 to 2.599143,2.348045 to 2.676021,2.348045 to 2.776231,2.348045 to 2.843356,2.348045 +"chassis?" at 2.737792,2.366977 +linethick = 0.500000; +spline -> from 2.633184,1.817201 to 2.633184,1.817201 to 2.690173,1.820739 to 2.752135,1.835139 to 2.795546,1.874554 to 2.858656,1.931715 to 2.897286,2.189698 to 2.911055,2.298896 +"chassis?" at 2.737792,1.894137 +linethick = 0.500000; +spline -> from 1.044017,1.019979 to 1.044017,1.019979 to 1.164346,1.008695 to 1.355394,0.990795 to 1.488536,0.978307 +"datapath" at 1.291195,1.028240 +linethick = 0.500000; +spline -> from 0.309598,1.836707 to 0.309598,1.836707 to 0.332815,1.846862 to 0.355420,1.860249 to 0.373186,1.877862 to 0.413824,1.918137 to 0.395408,1.946249 to 0.420996,1.997311 to 0.613880,2.383042 to 0.494413,2.826145 to 0.925659,2.826145 to 0.925659,2.826145 to 0.925659,2.826145 to 2.489180,2.826145 to 2.637582,2.826145 to 2.694380,2.801857 to 2.795546,2.693233 to 2.874337,2.608705 to 2.902449,2.469865 to 2.912011,2.396620 +"chassis?" at 1.642140,2.845077 +linethick = 0.500000; +spline -> from 0.203747,1.757668 to 0.203747,1.757668 to 0.231496,1.673694 to 0.300285,1.501636 to 0.420996,1.413053 to 0.791275,1.141282 to 1.026940,1.403797 to 1.427664,1.179320 to 1.501750,1.137802 to 1.566887,1.062682 to 1.604752,1.013094 +"datapath?" at 0.928317,1.301828 +linethick = 0.500000; +spline -> from 0.309598,1.827394 to 0.309598,1.827394 to 0.413614,1.846001 to 0.567887,1.874190 to 0.701870,1.901117 to 0.736561,1.908078 to 0.774178,1.916034 to 0.808486,1.923492 +"ports*" at 0.561442,1.920623 +linethick = 1.000000; +spline -> from 0.319218,0.838434 to 0.319218,0.838434 to 0.587929,0.864022 to 1.203301,0.922618 to 1.488842,0.949813 +"datapaths*" at 0.928317,0.932620 +linethick = 1.000000; +spline -> from 0.319199,0.788081 to 0.319199,0.788081 to 0.443084,0.751898 to 0.630002,0.697280 to 0.763545,0.658267 +"datapath_group?" at 0.561442,0.775918 +linethick = 1.000000; +spline -> from 1.108140,0.759395 to 1.108140,0.759395 to 1.205137,0.766911 to 1.325943,0.784122 to 1.427664,0.822734 to 1.484711,0.844382 to 1.541815,0.883797 to 1.582320,0.915523 +"datapath" at 1.291195,0.842317 +.ps +3 +.PE +.RE\} +.bp +.SH "SB_Global TABLE" +.PP +.PP +.PP +Southbound configuration for an OVN system\[char46] This table must have exactly one row\[char46] +.SS "Summary: +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBnb_cfg\fR +integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.RE +.TQ .25in +\fICommon options:\fR +.RS .25in +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fIOptions for configuring BFD:\fR +.RS .25in +.TQ 2.50in +\fBoptions : bfd-min-rx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-decay-min-rx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-min-tx\fR +optional string +.TQ 2.50in +\fBoptions : bfd-mult\fR +optional string +.TQ 2.50in +\fBoptions : debug_drop_domain_id\fR +optional string +.TQ 2.50in +\fBoptions : debug_drop_collector_set\fR +optional string +.RE +.TQ .25in +\fIOptions for configuring Load Balancers:\fR +.RS .25in +.TQ 2.50in +\fBoptions : lb_hairpin_use_ct_mark\fR +optional string +.RE +.TQ .25in +\fIOptions for configuring ovn-sbctl:\fR +.RS .25in +.TQ 2.50in +\fBoptions : sbctl_probe_interval\fR +optional string +.RE +.RE +.TQ .25in +\fIConnection Options:\fR +.RS .25in +.TQ 2.75in +\fBconnections\fR +set of \fBConnection\fRs +.TQ 2.75in +\fBssl\fR +optional \fBSSL\fR +.RE +.TQ .25in +\fISecurity Configurations:\fR +.RS .25in +.TQ 2.75in +\fBipsec\fR +boolean +.RE +.SS "Details: +.ST "Status:" +.PP +This column allow a client to track the overall configuration state of the system\[char46] +.IP "\fBnb_cfg\fR: integer" +Sequence number for the configuration\[char46] When a CMS or \fBovn\-nbctl\fR updates the northbound database, it increments the \fBnb_cfg\fR column in the \fBNB_Global\fR table in the northbound database\[char46] In turn, when \fBovn\-northd\fR updates the southbound database to bring it up to date with these changes, it updates this column to the same value\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +.ST "Common options:" +.PP +.IP "\fBoptions\fR: map of string-string pairs" +This column provides general key/value settings\[char46] The supported options are described individually below\[char46] +.ST "Options for configuring BFD:" +.PP +.PP +.PP +These options apply when \fBovn\-controller\fR configures BFD on tunnels interfaces\[char46] +.IP "\fBoptions : bfd-min-rx\fR: optional string" +BFD option \fBmin\-rx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-decay-min-rx\fR: optional string" +BFD option \fBdecay\-min\-rx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-min-tx\fR: optional string" +BFD option \fBmin\-tx\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : bfd-mult\fR: optional string" +BFD option \fBmult\fR value to use when configuring BFD on tunnel interfaces\[char46] +.IP "\fBoptions : debug_drop_domain_id\fR: optional string" +If set to a 8-bit number and if \fBdebug_drop_collector_set\fR is also configured, \fBovn\-controller\fR will add a \fBsample\fR action to every flow that does not come from a logical flow that contains a \(cqdrop\(cq action\[char46] The 8 most significant bits of the observation_domain_id field will be those specified in the \fB debug_drop_domain_id\fR\[char46] The 24 least significant bits of the observation_domain_id field will be zero\[char46] +.IP +The observation_point_id will be set to the OpenFlow table number\[char46] +.IP "\fBoptions : debug_drop_collector_set\fR: optional string" +If set to a 32-bit number \fBovn\-controller\fR will add a \fBsample\fR action to every flow that does not come from a logical flow that contains a \(cqdrop\(cq action\[char46] The sample action will have the specified collector_set_id\[char46] The value must match that of the local OVS configuration as described in \fBovs\-actions\fR(7)\[char46] +.ST "Options for configuring Load Balancers:" +.PP +.PP +.PP +These options apply when \fBovn\-controller\fR configures load balancer related flows\[char46] +.IP "\fBoptions : lb_hairpin_use_ct_mark\fR: optional string" +By default this option is turned on (even if not present in the database) unless its value is explicitly set to \fBfalse\fR\[char46] This value is automatically set to \fBfalse\fR by \fBovn\-northd\fR when action \fBct_lb_mark\fR cannot be used for new load balancer sessions and action \fBct_lb\fR will be used instead\[char46] \fBovn\-controller\fR then knows that it should check \fBct_label\[char46]natted\fR to detect load balanced traffic\[char46] +.ST "Options for configuring ovn-sbctl:" +.PP +.PP +.PP +These options apply when \fBovn\-sbctl\fR connects to OVN Southbound database\[char46] +.IP "\fBoptions : sbctl_probe_interval\fR: optional string" +The inactivity probe interval of the connection to the OVN Southbound database from \fBovn\-sbctl\fR utility, in milliseconds\[char46] If the value is zero, it disables the connection keepalive feature\[char46] +.IP +If the value is nonzero, then it will be forced to a value of at least 1000 ms\[char46] +.IP +If the value is less than zero, then the default inactivity probe interval for \fBovn\-sbctl\fR would be left intact (120000 ms)\[char46] +.ST "Connection Options:" +.PP +.IP "\fBconnections\fR: set of \fBConnection\fRs" +Database clients to which the Open vSwitch database server should connect or on which it should listen, along with options for how these connections should be configured\[char46] See the \fBConnection\fR table for more information\[char46] +.IP "\fBssl\fR: optional \fBSSL\fR" +Global SSL configuration\[char46] +.ST "Security Configurations:" +.PP +.IP "\fBipsec\fR: boolean" +Tunnel encryption configuration\[char46] If this column is set to be true, all OVN tunnels will be encrypted with IPsec\[char46] +.bp +.SH "Chassis TABLE" +.PP +.PP +.PP +Each row in this table represents a hypervisor or gateway (a chassis) in the physical network\[char46] Each chassis, via \fBovn\-controller\fR/\fBovn\-controller\-vtep\fR, adds and updates its own row, and keeps a copy of the remaining rows to determine how to reach other hypervisors\[char46] +.PP +.PP +When a chassis shuts down gracefully, it should remove its own row\[char46] (This is not critical because resources hosted on the chassis are equally unreachable regardless of whether the row is present\[char46]) If a chassis shuts down permanently without removing its row, some kind of manual or automatic cleanup is eventually needed; we can devise a process for that as necessary\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBhostname\fR +string +.TQ 3.00in +\fBnb_cfg\fR +integer +.TQ 3.00in +\fBother_config : ovn-bridge-mappings\fR +optional string +.TQ 3.00in +\fBother_config : datapath-type\fR +optional string +.TQ 3.00in +\fBother_config : iface-types\fR +optional string +.TQ 3.00in +\fBother_config : ovn-cms-options\fR +optional string +.TQ 3.00in +\fBother_config : is-interconn\fR +optional string +.TQ 3.00in +\fBother_config : is-remote\fR +optional string +.TQ 3.00in +\fBtransport_zones\fR +set of strings +.TQ 3.00in +\fBother_config : ovn-chassis-mac-mappings\fR +optional string +.TQ 3.00in +\fBother_config : port-up-notif\fR +optional string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fIEncapsulation Configuration:\fR +.RS .25in +.TQ 2.75in +\fBencaps\fR +set of 1 or more \fBEncap\fRs +.RE +.TQ .25in +\fIGateway Configuration:\fR +.RS .25in +.TQ 2.75in +\fBvtep_logical_switches\fR +set of strings +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +OVN does not prescribe a particular format for chassis names\[char46] ovn-controller populates this column using \fBexternal_ids:system-id\fR in the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] ovn-controller-vtep populates this column with \fBname\fR in the hardware_vtep database\(cqs \fBPhysical_Switch\fR table\[char46] +.IP "\fBhostname\fR: string" +The hostname of the chassis, if applicable\[char46] ovn-controller will populate this column with the hostname of the host it is running on\[char46] ovn-controller-vtep will leave this column empty\[char46] +.IP "\fBnb_cfg\fR: integer" +Deprecated\[char46] This column is replaced by the \fBnb_cfg\fR column of the \fBChassis_Private\fR table\[char46] +.IP "\fBother_config : ovn-bridge-mappings\fR: optional string" +\fBovn\-controller\fR populates this key with the set of bridge mappings it has been configured to use\[char46] Other applications should treat this key as read-only\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : datapath-type\fR: optional string" +\fBovn\-controller\fR populates this key with the datapath type configured in the \fBdatapath_type\fR column of the Open_vSwitch database\(cqs \fBBridge\fR table\[char46] Other applications should treat this key as read-only\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : iface-types\fR: optional string" +\fBovn\-controller\fR populates this key with the interface types configured in the \fBiface_types\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] Other applications should treat this key as read-only\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : ovn-cms-options\fR: optional string" +\fBovn\-controller\fR populates this key with the set of options configured in the \fBexternal_ids:ovn-cms-options\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : is-interconn\fR: optional string" +\fBovn\-controller\fR populates this key with the setting configured in the \fBexternal_ids:ovn-is-interconn\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] If set to true, the chassis is used as an interconnection gateway\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : is-remote\fR: optional string" +\fBovn\-ic\fR set this key to true for remote interconnection gateway chassises learned from the interconnection southbound database\[char46] See \fBovn\-ic\fR(8) for more information\[char46] +.IP "\fBtransport_zones\fR: set of strings" +\fBovn\-controller\fR populates this key with the transport zones configured in the \fBexternal_ids:ovn-transport-zones\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : ovn-chassis-mac-mappings\fR: optional string" +\fBovn\-controller\fR populates this key with the set of options configured in the \fBexternal_ids:ovn-chassis-mac-mappings\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP "\fBother_config : port-up-notif\fR: optional string" +\fBovn\-controller\fR populates this key with \fBtrue\fR when it supports \fBPort_Binding\[char46]up\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.ST "Encapsulation Configuration:" +.PP +.PP +.PP +OVN uses encapsulation to transmit logical dataplane packets between chassis\[char46] +.IP "\fBencaps\fR: set of 1 or more \fBEncap\fRs" +Points to supported encapsulation configurations to transmit logical dataplane packets to this chassis\[char46] Each entry is a \fBEncap\fR record that describes the configuration\[char46] +.ST "Gateway Configuration:" +.PP +.PP +.PP +A \fIgateway\fR is a chassis that forwards traffic between the OVN-managed part of a logical network and a physical VLAN, extending a tunnel-based logical network into a physical network\[char46] Gateways are typically dedicated nodes that do not host VMs and will be controlled by \fBovn\-controller\-vtep\fR\[char46] +.IP "\fBvtep_logical_switches\fR: set of strings" +Stores all VTEP logical switch names connected by this gateway chassis\[char46] The \fBPort_Binding\fR table entry with \fBoptions\fR:\fBvtep\-physical\-switch\fR equal \fBChassis\fR \fBname\fR, and \fBoptions\fR:\fBvtep\-logical\-switch\fR value in \fBChassis\fR \fBvtep_logical_switches\fR, will be associated with this \fBChassis\fR\[char46] +.bp +.SH "Chassis_Private TABLE" +.PP +.PP +.PP +Each row in this table maintains per chassis private data that are accessed only by the owning chassis (write only) and ovn-northd, not by any other chassis\[char46] These data are stored in this separate table instead of the \fBChassis\fR table for performance considerations: the rows in this table can be conditionally monitored by chassises so that each chassis only get update notifications for its own row, to avoid unnecessary chassis private data update flooding in a large scale deployment\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 3.00in +\fBnb_cfg\fR +integer +.TQ 3.00in +\fBnb_cfg_timestamp\fR +integer +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +The name of the chassis that owns these chassis-private data\[char46] +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +The reference to \fBChassis\fR table for the chassis that owns these chassis-private data\[char46] +.IP "\fBnb_cfg\fR: integer" +Sequence number for the configuration\[char46] When \fBovn\-controller\fR updates the configuration of a chassis from the contents of the southbound database, it copies \fBnb_cfg\fR from the \fBSB_Global\fR table into this column\[char46] +.IP "\fBnb_cfg_timestamp\fR: integer" +The timestamp when \fBovn\-controller\fR finishes processing the change corresponding to \fBnb_cfg\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Encap TABLE" +.PP +.PP +.PP +The \fBencaps\fR column in the \fBChassis\fR table refers to rows in this table to identify how OVN may transmit logical dataplane packets to this chassis\[char46] Each chassis, via \fBovn\-controller\fR(8) or \fBovn\-controller\-vtep\fR(8), adds and updates its own rows and keeps a copy of the remaining rows to determine how to reach other chassis\[char46] +.SS "Summary: +.TQ 3.00in +\fBtype\fR +string, one of \fBgeneve\fR, \fBstt\fR, or \fBvxlan\fR +.TQ 3.00in +\fBoptions\fR +map of string-string pairs +.TQ 3.00in +\fBoptions : csum\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.TQ 3.00in +\fBoptions : dst_port\fR +optional string, containing an integer +.TQ 3.00in +\fBip\fR +string +.TQ 3.00in +\fBchassis_name\fR +string +.SS "Details: +.IP "\fBtype\fR: string, one of \fBgeneve\fR, \fBstt\fR, or \fBvxlan\fR" +The encapsulation to use to transmit packets to this chassis\[char46] Hypervisors and gateways must use one of: \fBgeneve\fR, \fBvxlan\fR, or \fBstt\fR\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Options for configuring the encapsulation, which may be \fBtype\fR specific\[char46] +.IP "\fBoptions : csum\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +\fBcsum\fR indicates whether this chassis can transmit and receive packets that include checksums with reasonable performance\[char46] It hints to senders transmitting data to this chassis that they should use checksums to protect OVN metadata\[char46] \fBovn\-controller\fR populates this key with the value defined in \fBexternal_ids:ovn-encap-csum\fR column of the Open_vSwitch database\(cqs \fBOpen_vSwitch\fR table\[char46] Other applications should treat this key as read-only\[char46] See \fBovn\-controller\fR(8) for more information\[char46] +.IP +In terms of performance, checksumming actually significantly increases throughput in most common cases when running on Linux based hosts without NICs supporting encapsulation hardware offload (around 60% for bulk traffic)\[char46] The reason is that generally all NICs are capable of offloading transmitted and received TCP/UDP checksums (viewed as ordinary data packets and not as tunnels)\[char46] The benefit comes on the receive side where the validated outer checksum can be used to additionally validate an inner checksum (such as TCP), which in turn allows aggregation of packets to be more efficiently handled by the rest of the stack\[char46] +.IP +Not all devices see such a benefit\[char46] The most notable exception is hardware VTEPs\[char46] These devices are designed to not buffer entire packets in their switching engines and are therefore unable to efficiently compute or validate full packet checksums\[char46] In addition certain versions of the Linux kernel are not able to fully take advantage of encapsulation NIC offloads in the presence of checksums\[char46] (This is actually a pretty narrow corner case though: earlier versions of Linux don\(cqt support encapsulation offloads at all and later versions support both offloads and checksums well\[char46]) +.IP +\fBcsum\fR defaults to \fBfalse\fR for hardware VTEPs and \fBtrue\fR for all other cases\[char46] +.IP +This option applies to \fBgeneve\fR and \fBvxlan\fR encapsulations\[char46] +.IP "\fBoptions : dst_port\fR: optional string, containing an integer" +If set, overrides the UDP (for \fBgeneve\fR and \fBvxlan\fR) or TCP (for \fBstt\fR) destination port\[char46] +.IP "\fBip\fR: string" +The IPv4 address of the encapsulation tunnel endpoint\[char46] +.IP "\fBchassis_name\fR: string" +The name of the chassis that created this encap\[char46] +.bp +.SH "Address_Set TABLE" +.PP +.PP +.PP +This table contains address sets synced from the \fBAddress_Set\fR table in the \fBOVN_Northbound\fR database and address sets generated from the \fBPort_Group\fR table in the \fBOVN_Northbound\fR database\[char46] +.PP +.PP +See the documentation for the \fBAddress_Set\fR table and \fBPort_Group\fR table in the \fBOVN_Northbound\fR database for details\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBaddresses\fR +set of strings +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +.IP "\fBaddresses\fR: set of strings" +.bp +.SH "Port_Group TABLE" +.PP +.PP +.PP +This table contains names for the logical switch ports in the \fBOVN_Northbound\fR database that belongs to the same group that is defined in \fBPort_Group\fR in the \fBOVN_Northbound\fR database\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBports\fR +set of strings +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +.IP "\fBports\fR: set of strings" +.bp +.SH "Logical_Flow TABLE" +.PP +.PP +.PP +Each row in this table represents one logical flow\[char46] \fBovn\-northd\fR populates this table with logical flows that implement the L2 and L3 topologies specified in the \fBOVN_Northbound\fR database\[char46] Each hypervisor, via \fBovn\-controller\fR, translates the logical flows into OpenFlow flows specific to its hypervisor and installs them into Open vSwitch\[char46] +.PP +.PP +Logical flows are expressed in an OVN-specific format, described here\[char46] A logical datapath flow is much like an OpenFlow flow, except that the flows are written in terms of logical ports and logical datapaths instead of physical ports and physical datapaths\[char46] Translation between logical and physical flows helps to ensure isolation between logical datapaths\[char46] (The logical flow abstraction also allows the OVN centralized components to do less work, since they do not have to separately compute and push out physical flows to each chassis\[char46]) +.PP +.PP +The default action when no flow matches is to drop packets\[char46] +.PP +\fBArchitectural Logical Life Cycle of a Packet\fR +.PP +.PP +This following description focuses on the life cycle of a packet through a logical datapath, ignoring physical details of the implementation\[char46] Please refer to \fBArchitectural Physical Life Cycle of a Packet\fR in \fBovn\-architecture\fR(7) for the physical information\[char46] +.PP +.PP +The description here is written as if OVN itself executes these steps, but in fact OVN (that is, \fBovn\-controller\fR) programs Open vSwitch, via OpenFlow and OVSDB, to execute them on its behalf\[char46] +.PP +.PP +At a high level, OVN passes each packet through the logical datapath\(cqs logical ingress pipeline, which may output the packet to one or more logical port or logical multicast groups\[char46] For each such logical output port, OVN passes the packet through the datapath\(cqs logical egress pipeline, which may either drop the packet or deliver it to the destination\[char46] Between the two pipelines, outputs to logical multicast groups are expanded into logical ports, so that the egress pipeline only processes a single logical output port at a time\[char46] Between the two pipelines is also where, when necessary, OVN encapsulates a packet in a tunnel (or tunnels) to transmit to remote hypervisors\[char46] +.PP +.PP +In more detail, to start, OVN searches the \fBLogical_Flow\fR table for a row with correct \fBlogical_datapath\fR or a \fBlogical_dp_group\fR, a \fBpipeline\fR of \fBingress\fR, a \fBtable_id\fR of 0, and a \fBmatch\fR that is true for the packet\[char46] If none is found, OVN drops the packet\[char46] If OVN finds more than one, it chooses the match with the highest \fBpriority\fR\[char46] Then OVN executes each of the actions specified in the row\(cqs \fBactions\fR column, in the order specified\[char46] Some actions, such as those to modify packet headers, require no further details\[char46] The \fBnext\fR and \fBoutput\fR actions are special\[char46] +.PP +.PP +The \fBnext\fR action causes the above process to be repeated recursively, except that OVN searches for \fBtable_id\fR of 1 instead of 0\[char46] Similarly, any \fBnext\fR action in a row found in that table would cause a further search for a \fBtable_id\fR of 2, and so on\[char46] When recursive processing completes, flow control returns to the action following \fBnext\fR\[char46] +.PP +.PP +The \fBoutput\fR action also introduces recursion\[char46] Its effect depends on the current value of the \fBoutport\fR field\[char46] Suppose \fBoutport\fR designates a logical port\[char46] First, OVN compares \fBinport\fR to \fBoutport\fR; if they are equal, it treats the \fBoutput\fR as a no-op by default\[char46] In the common case, where they are different, the packet enters the egress pipeline\[char46] This transition to the egress pipeline discards register data, e\[char46]g\[char46] \fBreg0\fR \[char46]\[char46]\[char46] \fBreg9\fR and connection tracking state, to achieve uniform behavior regardless of whether the egress pipeline is on a different hypervisor (because registers aren\(cqt preserve across tunnel encapsulation)\[char46] +.PP +.PP +To execute the egress pipeline, OVN again searches the \fBLogical_Flow\fR table for a row with correct \fBlogical_datapath\fR or a \fBlogical_dp_group\fR, a \fBtable_id\fR of 0, a \fBmatch\fR that is true for the packet, but now looking for a \fBpipeline\fR of \fBegress\fR\[char46] If no matching row is found, the output becomes a no-op\[char46] Otherwise, OVN executes the actions for the matching flow (which is chosen from multiple, if necessary, as already described)\[char46] +.PP +.PP +In the \fBegress\fR pipeline, the \fBnext\fR action acts as already described, except that it, of course, searches for \fBegress\fR flows\[char46] The \fBoutput\fR action, however, now directly outputs the packet to the output port (which is now fixed, because \fBoutport\fR is read-only within the egress pipeline)\[char46] +.PP +.PP +The description earlier assumed that \fBoutport\fR referred to a logical port\[char46] If it instead designates a logical multicast group, then the description above still applies, with the addition of fan-out from the logical multicast group to each logical port in the group\[char46] For each member of the group, OVN executes the logical pipeline as described, with the logical output port replaced by the group member\[char46] +.PP +\fBPipeline Stages\fR +.PP +.PP +\fBovn\-northd\fR populates the \fBLogical_Flow\fR table with the logical flows described in detail in \fBovn\-northd\fR(8)\[char46] +.SS "Summary: +.TQ 3.00in +\fBlogical_datapath\fR +optional \fBDatapath_Binding\fR +.TQ 3.00in +\fBlogical_dp_group\fR +optional \fBLogical_DP_Group\fR +.TQ 3.00in +\fBpipeline\fR +string, either \fBegress\fR or \fBingress\fR +.TQ 3.00in +\fBtable_id\fR +integer, in range 0 to 32 +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 65,535 +.TQ 3.00in +\fBmatch\fR +string +.TQ 3.00in +\fBactions\fR +string +.TQ 3.00in +\fBtags\fR +map of string-string pairs +.TQ 3.00in +\fBcontroller_meter\fR +optional string +.TQ 3.00in +\fBexternal_ids : stage-name\fR +optional string +.TQ 3.00in +\fBexternal_ids : stage-hint\fR +optional string, containing an uuid +.TQ 3.00in +\fBexternal_ids : source\fR +optional string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBlogical_datapath\fR: optional \fBDatapath_Binding\fR" +The logical datapath to which the logical flow belongs\[char46] +.IP "\fBlogical_dp_group\fR: optional \fBLogical_DP_Group\fR" +The group of logical datapaths to which the logical flow belongs\[char46] This means that the same logical flow belongs to all datapaths in a group\[char46] +.IP "\fBpipeline\fR: string, either \fBegress\fR or \fBingress\fR" +The primary flows used for deciding on a packet\(cqs destination are the \fBingress\fR flows\[char46] The \fBegress\fR flows implement ACLs\[char46] See \fBLogical Life Cycle of a Packet\fR, above, for details\[char46] +.IP "\fBtable_id\fR: integer, in range 0 to 32" +The stage in the logical pipeline, analogous to an OpenFlow table number\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 65,535" +The flow\(cqs priority\[char46] Flows with numerically higher priority take precedence over those with lower\[char46] If two logical datapath flows with the same priority both match, then the one actually applied to the packet is undefined\[char46] +.IP "\fBmatch\fR: string" +A matching expression\[char46] OVN provides a superset of OpenFlow matching capabilities, using a syntax similar to Boolean expressions in a programming language\[char46] +.IP +The most important components of match expression are \fIcomparisons\fR between \fIsymbols\fR and \fIconstants\fR, e\[char46]g\[char46] \fBip4\[char46]dst == 192\[char46]168\[char46]0\[char46]1\fR, \fBip\[char46]proto == 6\fR, \fBarp\[char46]op == 1\fR, \fBeth\[char46]type == +0x800\fR\[char46] The logical AND operator \fB&&\fR and logical OR operator \fB||\fR can combine comparisons into a larger expression\[char46] +.IP +Matching expressions also support parentheses for grouping, the logical NOT prefix operator \fB!\fR, and literals \fB0\fR and \fB1\fR to express ``false\(cq\(cq or ``true,\(cq\(cq respectively\[char46] The latter is useful by itself as a catch-all expression that matches every packet\[char46] +.IP +Match expressions also support a kind of function syntax\[char46] The following functions are supported: +.RS +.TP +\fBis_chassis_resident(\fIlport\fB)\fR +Evaluates to true on a chassis on which logical port \fIlport\fR (a quoted string) resides, and to false elsewhere\[char46] This function was introduced in OVN 2\[char46]7\[char46] +.RE +.IP +\fBSymbols\fR +.IP +\fBType\fR\[char46] Symbols have \fIinteger\fR or \fIstring\fR type\[char46] Integer symbols have a \fIwidth\fR in bits\[char46] +.IP +\fBKinds\fR\[char46] There are three kinds of symbols: +.RS +.IP \(bu +\fIFields\fR\[char46] A field symbol represents a packet header or metadata field\[char46] For example, a field named \fBvlan\[char46]tci\fR might represent the VLAN TCI field in a packet\[char46] +.IP +A field symbol can have integer or string type\[char46] Integer fields can be nominal or ordinal (see \fBLevel of Measurement\fR, below)\[char46] +.IP \(bu +\fISubfields\fR\[char46] A subfield represents a subset of bits from a larger field\[char46] For example, a field \fBvlan\[char46]vid\fR might be defined as an alias for \fBvlan\[char46]tci[0\[char46]\[char46]11]\fR\[char46] Subfields are provided for syntactic convenience, because it is always possible to instead refer to a subset of bits from a field directly\[char46] +.IP +Only ordinal fields (see \fBLevel of Measurement\fR, below) may have subfields\[char46] Subfields are always ordinal\[char46] +.IP \(bu +\fIPredicates\fR\[char46] A predicate is shorthand for a Boolean expression\[char46] Predicates may be used much like 1-bit fields\[char46] For example, \fBip4\fR might expand to \fBeth\[char46]type == +0x800\fR\[char46] Predicates are provided for syntactic convenience, because it is always possible to instead specify the underlying expression directly\[char46] +.IP +A predicate whose expansion refers to any nominal field or predicate (see \fBLevel of Measurement\fR, below) is nominal; other predicates have Boolean level of measurement\[char46] +.RE +.IP +\fBLevel of Measurement\fR\[char46] See http://en\[char46]wikipedia\[char46]org/wiki/Level_of_measurement for the statistical concept on which this classification is based\[char46] There are three levels: +.RS +.IP \(bu +\fIOrdinal\fR\[char46] In statistics, ordinal values can be ordered on a scale\[char46] OVN considers a field (or subfield) to be ordinal if its bits can be examined individually\[char46] This is true for the OpenFlow fields that OpenFlow or Open vSwitch makes ``maskable\[char46]\(cq\(cq +.IP +Any use of a ordinal field may specify a single bit or a range of bits, e\[char46]g\[char46] \fBvlan\[char46]tci[13\[char46]\[char46]15]\fR refers to the PCP field within the VLAN TCI, and \fBeth\[char46]dst[40]\fR refers to the multicast bit in the Ethernet destination address\[char46] +.IP +OVN supports all the usual arithmetic relations (\fB==\fR, \fB!=\fR, \fB<\fR, \fB<=\fR, \fB>\fR, and \fB>=\fR) on ordinal fields and their subfields, because OVN can implement these in OpenFlow and Open vSwitch as collections of bitwise tests\[char46] +.IP \(bu +\fINominal\fR\[char46] In statistics, nominal values cannot be usefully compared except for equality\[char46] This is true of OpenFlow port numbers, Ethernet types, and IP protocols are examples: all of these are just identifiers assigned arbitrarily with no deeper meaning\[char46] In OpenFlow and Open vSwitch, bits in these fields generally aren\(cqt individually addressable\[char46] +.IP +OVN only supports arithmetic tests for equality on nominal fields, because OpenFlow and Open vSwitch provide no way for a flow to efficiently implement other comparisons on them\[char46] (A test for inequality can be sort of built out of two flows with different priorities, but OVN matching expressions always generate flows with a single priority\[char46]) +.IP +String fields are always nominal\[char46] +.IP \(bu +\fIBoolean\fR\[char46] A nominal field that has only two values, 0 and 1, is somewhat exceptional, since it is easy to support both equality and inequality tests on such a field: either one can be implemented as a test for 0 or 1\[char46] +.IP +Only predicates (see above) have a Boolean level of measurement\[char46] +.IP +This isn\(cqt a standard level of measurement\[char46] +.RE +.IP +\fBPrerequisites\fR\[char46] Any symbol can have prerequisites, which are additional condition implied by the use of the symbol\[char46] For example, For example, \fBicmp4\[char46]type\fR symbol might have prerequisite \fBicmp4\fR, which would cause an expression \fBicmp4\[char46]type == +0\fR to be interpreted as \fBicmp4\[char46]type == 0 && +icmp4\fR, which would in turn expand to \fBicmp4\[char46]type == 0 +&& eth\[char46]type == 0x800 && ip4\[char46]proto == 1\fR (assuming \fBicmp4\fR is a predicate defined as suggested under \fBTypes\fR above)\[char46] +.IP +\fBRelational operators\fR +.IP +All of the standard relational operators \fB==\fR, \fB!=\fR, \fB<\fR, \fB<=\fR, \fB>\fR, and \fB>=\fR are supported\[char46] Nominal fields support only \fB==\fR and \fB!=\fR, and only in a positive sense when outer \fB!\fR are taken into account, e\[char46]g\[char46] given string field \fBinport\fR, \fBinport == +\(dqeth0\(dq\fR and \fB!(inport != \(dqeth0\(dq)\fR are acceptable, but not \fBinport != \(dqeth0\(dq\fR\[char46] +.IP +The implementation of \fB==\fR (or \fB!=\fR when it is negated), is more efficient than that of the other relational operators\[char46] +.IP +\fBConstants\fR +.IP +Integer constants may be expressed in decimal, hexadecimal prefixed by \fB0x\fR, or as dotted-quad IPv4 addresses, IPv6 addresses in their standard forms, or Ethernet addresses as colon-separated hex digits\[char46] A constant in any of these forms may be followed by a slash and a second constant (the mask) in the same form, to form a masked constant\[char46] IPv4 and IPv6 masks may be given as integers, to express CIDR prefixes\[char46] +.IP +String constants have the same syntax as quoted strings in JSON (thus, they are Unicode strings)\[char46] +.IP +Some operators support sets of constants written inside curly braces \fB{\fR \[char46]\[char46]\[char46] \fB}\fR\[char46] Commas between elements of a set, and after the last elements, are optional\[char46] With \fB==\fR, ``\fB\fIfield\fB == { \fIconstant1\fB, +\fIconstant2\fB,\fR \[char46]\[char46]\[char46] \fB}\fR\(cq\(cq is syntactic sugar for ``\fB\fIfield\fB == \fIconstant1\fB || +\fIfield\fB == \fIconstant2\fB || \fR\[char46]\[char46]\[char46]\fB\fR\[char46] Similarly, ``\fB\fIfield\fB != { \fIconstant1\fB, +\fIconstant2\fB, \fR\[char46]\[char46]\[char46]\fB }\fR\(cq\(cq is equivalent to ``\fB\fIfield\fB != \fIconstant1\fB && +\fIfield\fB != \fIconstant2\fB && +\fR\[char46]\[char46]\[char46]\fB\fR\(cq\(cq\[char46] +.IP +You may refer to a set of IPv4, IPv6, or MAC addresses stored in the \fBAddress_Set\fR table by its \fBname\fR\[char46] An \fBAddress_Set\fR with a name of \fBset1\fR can be referred to as \fB$set1\fR\[char46] +.IP +You may refer to a group of logical switch ports stored in the \fBPort_Group\fR table by its \fBname\fR\[char46] An \fBPort_Group\fR with a name of \fBport_group1\fR can be referred to as \fB@port_group1\fR\[char46] +.IP +Additionally, you may refer to the set of addresses belonging to a group of logical switch ports stored in the \fBPort_Group\fR table by its \fBname\fR followed by a suffix \(cq_ip4\(cq/\(cq_ip6\(cq\[char46] The IPv4 address set of a \fBPort_Group\fR with a name of \fBport_group1\fR can be referred to as \fB$port_group1_ip4\fR, and the IPv6 address set of the same \fBPort_Group\fR can be referred to as \fB$port_group1_ip6\fR +.IP +\fBMiscellaneous\fR +.IP +Comparisons may name the symbol or the constant first, e\[char46]g\[char46] \fBtcp\[char46]src == 80\fR and \fB80 == tcp\[char46]src\fR are both acceptable\[char46] +.IP +Tests for a range may be expressed using a syntax like \fB1024 <= +tcp\[char46]src <= 49151\fR, which is equivalent to \fB1024 <= +tcp\[char46]src && tcp\[char46]src <= 49151\fR\[char46] +.IP +For a one-bit field or predicate, a mention of its name is equivalent to \fB\fIsymobl\fB == 1\fR, e\[char46]g\[char46] \fBvlan\[char46]present\fR is equivalent to \fBvlan\[char46]present == 1\fR\[char46] The same is true for one-bit subfields, e\[char46]g\[char46] \fBvlan\[char46]tci[12]\fR\[char46] There is no technical limitation to implementing the same for ordinal fields of all widths, but the implementation is expensive enough that the syntax parser requires writing an explicit comparison against zero to make mistakes less likely, e\[char46]g\[char46] in \fBtcp\[char46]src != 0\fR the comparison against 0 is required\[char46] +.IP +\fBOperator precedence\fR is as shown below, from highest to lowest\[char46] There are two exceptions where parentheses are required even though the table would suggest that they are not: \fB&&\fR and \fB||\fR require parentheses when used together, and \fB!\fR requires parentheses when applied to a relational expression\[char46] Thus, in \fB(eth\[char46]type == 0x800 || eth\[char46]type == 0x86dd) +&& ip\[char46]proto == 6\fR or \fB!(arp\[char46]op == 1)\fR, the parentheses are mandatory\[char46] +.RS +.IP \(bu +\fB()\fR +.IP \(bu +\fB== != < <= > >=\fR +.IP \(bu +\fB!\fR +.IP \(bu +\fB&& ||\fR +.RE +.IP +\fBComments\fR may be introduced by \fB//\fR, which extends to the next new-line\[char46] Comments within a line may be bracketed by \fB/*\fR and \fB*/\fR\[char46] Multiline comments are not supported\[char46] +.IP +\fBSymbols\fR +.IP +Most of the symbols below have integer type\[char46] Only \fBinport\fR and \fBoutport\fR have string type\[char46] \fBinport\fR names a logical port\[char46] Thus, its value is a \fBlogical_port\fR name from the \fBPort_Binding\fR table\[char46] \fBoutport\fR may name a logical port, as \fBinport\fR, or a logical multicast group defined in the \fBMulticast_Group\fR table\[char46] For both symbols, only names within the flow\(cqs logical datapath may be used\[char46] +.IP +The \fBreg\fR\fIX\fR symbols are 32-bit integers\[char46] The \fBxxreg\fR\fIX\fR symbols are 128-bit integers, which overlay four of the 32-bit registers: \fBxxreg0\fR overlays \fBreg0\fR through \fBreg3\fR, with \fBreg0\fR supplying the most-significant bits of \fBxxreg0\fR and \fBreg3\fR the least-significant\[char46] \fBxxreg1\fR similarly overlays \fBreg4\fR through \fBreg7\fR\[char46] +.RS +.IP \(bu +\fBreg0\fR\[char46]\[char46]\[char46]\fBreg9\fR +.IP \(bu +\fBxxreg0\fR \fBxxreg1\fR +.IP \(bu +\fBinport\fR \fBoutport\fR +.IP \(bu +\fBflags\[char46]loopback\fR +.IP \(bu +\fBpkt\[char46]mark\fR +.IP \(bu +\fBeth\[char46]src\fR \fBeth\[char46]dst\fR \fBeth\[char46]type\fR +.IP \(bu +\fBvlan\[char46]tci\fR \fBvlan\[char46]vid\fR \fBvlan\[char46]pcp\fR \fBvlan\[char46]present\fR +.IP \(bu +\fBip\[char46]proto\fR \fBip\[char46]dscp\fR \fBip\[char46]ecn\fR \fBip\[char46]ttl\fR \fBip\[char46]frag\fR +.IP \(bu +\fBip4\[char46]src\fR \fBip4\[char46]dst\fR +.IP \(bu +\fBip6\[char46]src\fR \fBip6\[char46]dst\fR \fBip6\[char46]label\fR +.IP \(bu +\fBarp\[char46]op\fR \fBarp\[char46]spa\fR \fBarp\[char46]tpa\fR \fBarp\[char46]sha\fR \fBarp\[char46]tha\fR +.IP \(bu +\fBrarp\[char46]op\fR \fBrarp\[char46]spa\fR \fBrarp\[char46]tpa\fR \fBrarp\[char46]sha\fR \fBrarp\[char46]tha\fR +.IP \(bu +\fBtcp\[char46]src\fR \fBtcp\[char46]dst\fR \fBtcp\[char46]flags\fR +.IP \(bu +\fBudp\[char46]src\fR \fBudp\[char46]dst\fR +.IP \(bu +\fBsctp\[char46]src\fR \fBsctp\[char46]dst\fR +.IP \(bu +\fBicmp4\[char46]type\fR \fBicmp4\[char46]code\fR +.IP \(bu +\fBicmp6\[char46]type\fR \fBicmp6\[char46]code\fR +.IP \(bu +\fBnd\[char46]target\fR \fBnd\[char46]sll\fR \fBnd\[char46]tll\fR +.IP \(bu +\fBct_mark\fR \fBct_label\fR +.IP \(bu +\fBct_state\fR, which has several Boolean subfields\[char46] The \fBct_next\fR action initializes the following subfields: +.RS +.IP \(bu +\fBct\[char46]trk\fR: Always set to true by \fBct_next\fR to indicate that connection tracking has taken place\[char46] All other \fBct\fR subfields have \fBct\[char46]trk\fR as a prerequisite\[char46] +.IP \(bu +\fBct\[char46]new\fR: True for a new flow +.IP \(bu +\fBct\[char46]est\fR: True for an established flow +.IP \(bu +\fBct\[char46]rel\fR: True for a related flow +.IP \(bu +\fBct\[char46]rpl\fR: True for a reply flow +.IP \(bu +\fBct\[char46]inv\fR: True for a connection entry in a bad state +.RE +.IP +The \fBct_dnat\fR, \fBct_snat\fR, and \fBct_lb\fR actions initialize the following subfields: +.RS +.IP \(bu +\fBct\[char46]dnat\fR: True for a packet whose destination IP address has been changed\[char46] +.IP \(bu +\fBct\[char46]snat\fR: True for a packet whose source IP address has been changed\[char46] +.RE +.RE +.IP +The following predicates are supported: +.RS +.IP \(bu +\fBeth\[char46]bcast\fR expands to \fBeth\[char46]dst == ff:ff:ff:ff:ff:ff\fR +.IP \(bu +\fBeth\[char46]mcast\fR expands to \fBeth\[char46]dst[40]\fR +.IP \(bu +\fBvlan\[char46]present\fR expands to \fBvlan\[char46]tci[12]\fR +.IP \(bu +\fBip4\fR expands to \fBeth\[char46]type == 0x800\fR +.IP \(bu +\fBip4\[char46]src_mcast\fR expands to \fBip4\[char46]src[28\[char46]\[char46]31] == 0xe\fR +.IP \(bu +\fBip4\[char46]mcast\fR expands to \fBip4\[char46]dst[28\[char46]\[char46]31] == 0xe\fR +.IP \(bu +\fBip6\fR expands to \fBeth\[char46]type == 0x86dd\fR +.IP \(bu +\fBip\fR expands to \fBip4 || ip6\fR +.IP \(bu +\fBicmp4\fR expands to \fBip4 && ip\[char46]proto == 1\fR +.IP \(bu +\fBicmp6\fR expands to \fBip6 && ip\[char46]proto == 58\fR +.IP \(bu +\fBicmp\fR expands to \fBicmp4 || icmp6\fR +.IP \(bu +\fBip\[char46]is_frag\fR expands to \fBip\[char46]frag[0]\fR +.IP \(bu +\fBip\[char46]later_frag\fR expands to \fBip\[char46]frag[1]\fR +.IP \(bu +\fBip\[char46]first_frag\fR expands to \fBip\[char46]is_frag && !ip\[char46]later_frag\fR +.IP \(bu +\fBarp\fR expands to \fBeth\[char46]type == 0x806\fR +.IP \(bu +\fBrarp\fR expands to \fBeth\[char46]type == 0x8035\fR +.IP \(bu +\fBnd\fR expands to \fBicmp6\[char46]type == {135, 136} && icmp6\[char46]code == 0 && ip\[char46]ttl == 255\fR +.IP \(bu +\fBnd_ns\fR expands to \fBicmp6\[char46]type == 135 && icmp6\[char46]code == 0 && ip\[char46]ttl == 255\fR +.IP \(bu +\fBnd_na\fR expands to \fBicmp6\[char46]type == 136 && icmp6\[char46]code == 0 && ip\[char46]ttl == 255\fR +.IP \(bu +\fBnd_rs\fR expands to \fBicmp6\[char46]type == 133 && +icmp6\[char46]code == 0 && ip\[char46]ttl == 255\fR +.IP \(bu +\fBnd_ra\fR expands to \fBicmp6\[char46]type == 134 && +icmp6\[char46]code == 0 && ip\[char46]ttl == 255\fR +.IP \(bu +\fBtcp\fR expands to \fBip\[char46]proto == 6\fR +.IP \(bu +\fBudp\fR expands to \fBip\[char46]proto == 17\fR +.IP \(bu +\fBsctp\fR expands to \fBip\[char46]proto == 132\fR +.RE +.IP "\fBactions\fR: string" +Logical datapath actions, to be executed when the logical flow represented by this row is the highest-priority match\[char46] +.IP +Actions share lexical syntax with the \fBmatch\fR column\[char46] An empty set of actions (or one that contains just white space or comments), or a set of actions that consists of just \fBdrop;\fR, causes the matched packets to be dropped\[char46] Otherwise, the column should contain a sequence of actions, each terminated by a semicolon\[char46] +.IP +The following actions are defined: +.RS +.TP +\fBoutput;\fR +In the ingress pipeline, this action executes the \fBegress\fR pipeline as a subroutine\[char46] If \fBoutport\fR names a logical port, the egress pipeline executes once; if it is a multicast group, the egress pipeline runs once for each logical port in the group\[char46] +.IP +In the egress pipeline, this action performs the actual output to the \fBoutport\fR logical port\[char46] (In the egress pipeline, \fBoutport\fR never names a multicast group\[char46]) +.IP +By default, output to the input port is implicitly dropped, that is, \fBoutput\fR becomes a no-op if \fBoutport\fR == \fBinport\fR\[char46] Occasionally it may be useful to override this behavior, e\[char46]g\[char46] to send an ARP reply to an ARP request; to do so, use \fBflags\[char46]loopback = 1\fR to allow the packet to \(dqhair-pin\(dq back to the input port\[char46] +.TP +\fBnext;\fR +.TQ .5in +\fBnext(\fItable\fB);\fR +.TQ .5in +\fBnext(pipeline=\fIpipeline\fB, table=\fItable\fB);\fR +Executes the given logical datapath \fItable\fR in \fIpipeline\fR as a subroutine\[char46] The default \fItable\fR is just after the current one\[char46] If \fIpipeline\fR is specified, it may be \fBingress\fR or \fBegress\fR; the default \fIpipeline\fR is the one currently executing\[char46] Actions in the both ingress and egress pipeline can use \fBnext\fR to jump across the other pipeline\[char46] Actions in the ingress pipeline should use \fBnext\fR to jump into the specific table of egress pipeline only if it is certain that the packets are local and not tunnelled and wants to skip certain stages in the packet processing\[char46] +.TP +\fB\fIfield\fB = \fIconstant\fB;\fR +Sets data or metadata field \fIfield\fR to constant value \fIconstant\fR, e\[char46]g\[char46] \fBoutport = \(dqvif0\(dq;\fR to set the logical output port\[char46] To set only a subset of bits in a field, specify a subfield for \fIfield\fR or a masked \fIconstant\fR, e\[char46]g\[char46] one may use \fBvlan\[char46]pcp[2] = 1;\fR or \fBvlan\[char46]pcp = 4/4;\fR to set the most significant bit of the VLAN PCP\[char46] +.IP +Assigning to a field with prerequisites implicitly adds those prerequisites to \fBmatch\fR; thus, for example, a flow that sets \fBtcp\[char46]dst\fR applies only to TCP flows, regardless of whether its \fBmatch\fR mentions any TCP field\[char46] +.IP +Not all fields are modifiable (e\[char46]g\[char46] \fBeth\[char46]type\fR and \fBip\[char46]proto\fR are read-only), and not all modifiable fields may be partially modified (e\[char46]g\[char46] \fBip\[char46]ttl\fR must assigned as a whole)\[char46] The \fBoutport\fR field is modifiable in the \fBingress\fR pipeline but not in the \fBegress\fR pipeline\[char46] +.TP +\fB\fIovn_field\fB = \fIconstant\fB;\fR +Sets OVN field \fIovn_field\fR to constant value \fIconstant\fR\[char46] +.IP +\fBOVN\fR supports setting the values of certain fields which are not yet supported in OpenFlow to set or modify them\[char46] +.IP +Below are the supported \fBOVN fields\fR: +.RS +.IP \(bu +\fBicmp4\[char46]frag_mtu\fR \fBicmp6\[char46]frag_mtu\fR +.IP +This field sets the low-order 16 bits of the ICMP{4,6} header field that is labelled \(dqunused\(dq in the ICMP specification as defined in the RFC 1191 with the value specified in \fIconstant\fR\[char46] +.IP +Eg\[char46] icmp4\[char46]frag_mtu = 1500; +.RE +.TP +\fB\fIfield1\fB = \fIfield2\fB;\fR +Sets data or metadata field \fIfield1\fR to the value of data or metadata field \fIfield2\fR, e\[char46]g\[char46] \fBreg0 = +ip4\[char46]src;\fR copies \fBip4\[char46]src\fR into \fBreg0\fR\[char46] To modify only a subset of a field\(cqs bits, specify a subfield for \fIfield1\fR or \fIfield2\fR or both, e\[char46]g\[char46] \fBvlan\[char46]pcp += reg0[0\[char46]\[char46]2];\fR copies the least-significant bits of \fBreg0\fR into the VLAN PCP\[char46] +.IP +\fIfield1\fR and \fIfield2\fR must be the same type, either both string or both integer fields\[char46] If they are both integer fields, they must have the same width\[char46] +.IP +If \fIfield1\fR or \fIfield2\fR has prerequisites, they are added implicitly to \fBmatch\fR\[char46] It is possible to write an assignment with contradictory prerequisites, such as \fBip4\[char46]src = ip6\[char46]src[0\[char46]\[char46]31];\fR, but the contradiction means that a logical flow with such an assignment will never be matched\[char46] +.TP +\fB\fIfield1\fB <\-> \fIfield2\fB;\fR +Similar to \fB\fIfield1\fB = \fIfield2\fB;\fR except that the two values are exchanged instead of copied\[char46] Both \fIfield1\fR and \fIfield2\fR must modifiable\[char46] +.TP +\fBpush(\fIfield\fB);\fR +Push the value of \fIfield\fR to the stack top\[char46] +.TP +\fBpop(\fIfield\fB);\fR +Pop the stack top and store the value to \fIfield\fR, which must be modifiable\[char46] +.TP +\fBip\[char46]ttl\-\-;\fR +Decrements the IPv4 or IPv6 TTL\[char46] If this would make the TTL zero or negative, then processing of the packet halts; no further actions are processed\[char46] (To properly handle such cases, a higher-priority flow should match on \fBip\[char46]ttl == {0, 1};\fR\[char46]) +.IP +\fBPrerequisite:\fR \fBip\fR +.TP +\fBct_next;\fR +Apply connection tracking to the flow, initializing \fBct_state\fR for matching in later tables\[char46] Automatically moves on to the next table, as if followed by \fBnext\fR\[char46] +.IP +As a side effect, IP fragments will be reassembled for matching\[char46] If a fragmented packet is output, then it will be sent with any overlapping fragments squashed\[char46] The connection tracking state is scoped by the logical port when the action is used in a flow for a logical switch, so overlapping addresses may be used\[char46] To allow traffic related to the matched flow, execute \fBct_commit +\fR\[char46] Connection tracking state is scoped by the logical topology when the action is used in a flow for a router\[char46] +.IP +It is possible to have actions follow \fBct_next\fR, but they will not have access to any of its side-effects and is not generally useful\[char46] +.TP +\fBct_commit { };\fR +.TQ .5in +\fBct_commit { ct_mark=\fIvalue[/mask]\fB; };\fR +.TQ .5in +\fBct_commit { ct_label=\fIvalue[/mask]\fB; };\fR +.TQ .5in +\fBct_commit { ct_mark=\fIvalue[/mask]\fB; ct_label=\fIvalue[/mask]\fB; };\fR +Commit the flow to the connection tracking entry associated with it by a previous call to \fBct_next\fR\[char46] When \fBct_mark=\fIvalue[/mask]\fB\fR and/or \fBct_label=\fIvalue[/mask]\fB\fR are supplied, \fBct_mark\fR and/or \fBct_label\fR will be set to the values indicated by \fIvalue[/mask]\fR on the connection tracking entry\[char46] \fBct_mark\fR is a 32-bit field\[char46] \fBct_label\fR is a 128-bit field\[char46] The \fIvalue[/mask]\fR should be specified in hex string if more than 64bits are to be used\[char46] Registers and other named fields can be used for \fIvalue\fR\[char46] \fBct_mark\fR and \fBct_label\fR may be sub-addressed in order to have specific bits set\[char46] +.IP +Note that if you want processing to continue in the next table, you must execute the \fBnext\fR action after \fBct_commit\fR\[char46] You may also leave out \fBnext\fR which will commit connection tracking state, and then drop the packet\[char46] This could be useful for setting \fBct_mark\fR on a connection tracking entry before dropping a packet, for example\[char46] +.TP +\fBct_dnat;\fR +.TQ .5in +\fBct_dnat(\fIIP\fB);\fR +\fBct_dnat\fR sends the packet through the DNAT zone in connection tracking table to unDNAT any packet that was DNATed in the opposite direction\[char46] The packet is then automatically sent to to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.IP +\fBct_dnat(\fIIP\fB)\fR sends the packet through the DNAT zone to change the destination IP address of the packet to the one provided inside the parentheses and commits the connection\[char46] The packet is then automatically sent to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.TP +\fBct_snat;\fR +.TQ .5in +\fBct_snat(\fIIP\fB);\fR +\fBct_snat\fR sends the packet through the SNAT zone to unSNAT any packet that was SNATed in the opposite direction\[char46] The packet is automatically sent to the next tables as if followed by the \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.IP +\fBct_snat(\fIIP\fB)\fR sends the packet through the SNAT zone to change the source IP address of the packet to the one provided inside the parenthesis and commits the connection\[char46] The packet is then automatically sent to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.TP +\fBct_dnat_in_czone;\fR +.TQ .5in +\fBct_dnat_in_czone(\fIIP\fB);\fR +\fBct_dnat_in_czone\fR sends the packet through the common NAT zone (used for both DNAT and SNAT) in connection tracking table to unDNAT any packet that was DNATed in the opposite direction\[char46] The packet is then automatically sent to to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.IP +\fBct_dnat_in_czone(\fIIP\fB)\fR sends the packet through the common NAT zone to change the destination IP address of the packet to the one provided inside the parentheses and commits the connection\[char46] The packet is then automatically sent to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.TP +\fBct_snat_in_czone;\fR +.TQ .5in +\fBct_snat_in_czone(\fIIP\fB);\fR +\fBct_snat_in_czone\fR sends the packet through the common NAT zone to unSNAT any packet that was SNATed in the opposite direction\[char46] The packet is automatically sent to the next tables as if followed by the \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.IP +\fBct_snat_in_czone(\fIIP\fB)\fR sends the packet\e through the common NAT zone to change the source IP address of the packet to the one provided inside the parenthesis and commits the connection\[char46] The packet is then automatically sent to the next tables as if followed by \fBnext;\fR action\[char46] The next tables will see the changes in the packet caused by the connection tracker\[char46] +.TP +\fBct_clear;\fR +Clears connection tracking state\[char46] +.TP +\fBct_commit_nat;\fR +Applies NAT and commits the connection to the CT\[char46] Automatically moves on to the next table, as if followed by \fBnext\fR\[char46] This is very useful for connections that are in related state for already existing connections and allows the NAT to be applied to them as well\[char46] +.TP +\fBclone { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Makes a copy of the packet being processed and executes each \fBaction\fR on the copy\[char46] Actions following the \fIclone\fR action, if any, apply to the original, unmodified packet\[char46] This can be used as a way to ``save and restore\(cq\(cq the packet around a set of actions that may modify it and should not persist\[char46] +.TP +\fBarp { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv4 packet being processed by an ARP packet and executes each nested \fIaction\fR on the ARP packet\[char46] Actions following the \fIarp\fR action, if any, apply to the original, unmodified packet\[char46] +.IP +The ARP packet that this action operates on is initialized based on the IPv4 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change: +.RS +.IP \(bu +\fBeth\[char46]src\fR unchanged +.IP \(bu +\fBeth\[char46]dst\fR unchanged +.IP \(bu +\fBeth\[char46]type = 0x0806\fR +.IP \(bu +\fBarp\[char46]op = 1\fR (ARP request) +.IP \(bu +\fBarp\[char46]sha\fR copied from \fBeth\[char46]src\fR +.IP \(bu +\fBarp\[char46]spa\fR copied from \fBip4\[char46]src\fR +.IP \(bu +\fBarp\[char46]tha = 00:00:00:00:00:00\fR +.IP \(bu +\fBarp\[char46]tpa\fR copied from \fBip4\[char46]dst\fR +.RE +.IP +The ARP packet has the same VLAN header, if any, as the IP packet it replaces\[char46] +.IP +\fBPrerequisite:\fR \fBip4\fR +.TP +\fBget_arp(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 32-bit IP address field \fIA\fR\[char46] +.IP +Looks up \fIA\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores its Ethernet address in \fBeth\[char46]dst\fR, otherwise stores \fB00:00:00:00:00:00\fR in \fBeth\[char46]dst\fR\[char46] +.IP +\fBExample:\fR \fBget_arp(outport, ip4\[char46]dst);\fR +.TP +\fBput_arp(\fIP\fB, \fIA\fB, \fIE\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 32-bit IP address field \fIA\fR, 48-bit Ethernet address field \fIE\fR\[char46] +.IP +Adds or updates the entry for IP address \fIA\fR in logical port \fIP\fR\(cqs mac binding table, setting its Ethernet address to \fIE\fR\[char46] +.IP +\fBExample:\fR \fBput_arp(inport, arp\[char46]spa, arp\[char46]sha);\fR +.TP +\fB\fIR\fB = lookup_arp(\fIP\fB, \fIA\fB, \fIM\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 32-bit IP address field \fIA\fR, 48-bit MAC address field \fIM\fR\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Looks up \fIA\fR and \fIM\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores \fB1\fR in the 1-bit subfield \fIR\fR, else 0\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = lookup_arp(inport, arp\[char46]spa, arp\[char46]sha); +\fR +.TP +\fB\fIR\fB = lookup_arp_ip(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 32-bit IP address field \fIA\fR\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Looks up \fIA\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores \fB1\fR in the 1-bit subfield \fIR\fR, else 0\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = lookup_arp_ip(inport, arp\[char46]spa); +\fR +.TP +\fB\fIP\fB = get_fdb(\fIA\fB);\fR +\fBParameters\fR:48-bit MAC address field \fIA\fR\[char46] +.IP +Looks up \fIA\fR in fdb table\[char46] If an entry is found, stores the logical port key to the out parameter \fBP\fR\[char46] +.IP +\fBExample:\fR \fBoutport = get_fdb(eth\[char46]src);\fR +.TP +\fBput_fdb(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 48-bit MAC address field \fIA\fR\[char46] +.IP +Adds or updates the entry for Ethernet address \fIA\fR in fdb table, setting its logical port key to \fIP\fR\[char46] +.IP +\fBExample:\fR \fBput_fdb(inport, arp\[char46]spa);\fR +.TP +\fB\fIR\fB = lookup_fdb(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: 48-bit MAC address field \fIM\fR, logical port string field \fIP\fR\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Looks up \fIA\fR in fdb table\[char46] If an entry is found and the logical port key is \fIP\fR, \fBP\fR, stores \fB1\fR in the 1-bit subfield \fIR\fR, else 0\[char46] If \fBflags\[char46]localnet\fR is set then \fB1\fR is stored if an entry is found and the logical port key is \fIP\fR or if an entry is found and the entry port type is VIF\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = lookup_fdb(inport, eth\[char46]src); +\fR +.TP +\fBnd_ns { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv6 packet being processed by an IPv6 Neighbor Solicitation packet and executes each nested \fIaction\fR on the IPv6 NS packet\[char46] Actions following the \fInd_ns\fR action, if any, apply to the original, unmodified packet\[char46] +.IP +The IPv6 NS packet that this action operates on is initialized based on the IPv6 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change: +.RS +.IP \(bu +\fBeth\[char46]src\fR unchanged +.IP \(bu +\fBeth\[char46]dst\fR set to IPv6 multicast MAC address +.IP \(bu +\fBeth\[char46]type = 0x86dd\fR +.IP \(bu +\fBip6\[char46]src\fR copied from \fBip6\[char46]src\fR +.IP \(bu +\fBip6\[char46]dst\fR set to IPv6 Solicited-Node multicast address +.IP \(bu +\fBicmp6\[char46]type = 135\fR (Neighbor Solicitation) +.IP \(bu +\fBnd\[char46]target\fR copied from \fBip6\[char46]dst\fR +.RE +.IP +The IPv6 NS packet has the same VLAN header, if any, as the IP packet it replaces\[char46] +.IP +\fBPrerequisite:\fR \fBip6\fR +.TP +\fBnd_na { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv6 neighbor solicitation packet being processed by an IPv6 neighbor advertisement (NA) packet and executes each nested \fIaction\fR on the NA packet\[char46] Actions following the \fBnd_na\fR action, if any, apply to the original, unmodified packet\[char46] +.IP +The NA packet that this action operates on is initialized based on the IPv6 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change: +.RS +.IP \(bu +\fBeth\[char46]dst\fR exchanged with \fBeth\[char46]src\fR +.IP \(bu +\fBeth\[char46]type = 0x86dd\fR +.IP \(bu +\fBip6\[char46]dst\fR copied from \fBip6\[char46]src\fR +.IP \(bu +\fBip6\[char46]src\fR copied from \fBnd\[char46]target\fR +.IP \(bu +\fBicmp6\[char46]type = 136\fR (Neighbor Advertisement) +.IP \(bu +\fBnd\[char46]target\fR unchanged +.IP \(bu +\fBnd\[char46]sll = 00:00:00:00:00:00\fR +.IP \(bu +\fBnd\[char46]tll\fR copied from \fBeth\[char46]dst\fR +.RE +.IP +The ND packet has the same VLAN header, if any, as the IPv6 packet it replaces\[char46] +.IP +\fBPrerequisite:\fR \fBnd_ns\fR +.TP +\fBnd_na_router { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv6 neighbor solicitation packet being processed by an IPv6 neighbor advertisement (NA) packet, sets ND_NSO_ROUTER in the RSO flags and executes each nested \fIaction\fR on the NA packet\[char46] Actions following the \fBnd_na_router\fR action, if any, apply to the original, unmodified packet\[char46] +.IP +The NA packet that this action operates on is initialized based on the IPv6 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change: +.RS +.IP \(bu +\fBeth\[char46]dst\fR exchanged with \fBeth\[char46]src\fR +.IP \(bu +\fBeth\[char46]type = 0x86dd\fR +.IP \(bu +\fBip6\[char46]dst\fR copied from \fBip6\[char46]src\fR +.IP \(bu +\fBip6\[char46]src\fR copied from \fBnd\[char46]target\fR +.IP \(bu +\fBicmp6\[char46]type = 136\fR (Neighbor Advertisement) +.IP \(bu +\fBnd\[char46]target\fR unchanged +.IP \(bu +\fBnd\[char46]sll = 00:00:00:00:00:00\fR +.IP \(bu +\fBnd\[char46]tll\fR copied from \fBeth\[char46]dst\fR +.RE +.IP +The ND packet has the same VLAN header, if any, as the IPv6 packet it replaces\[char46] +.IP +\fBPrerequisite:\fR \fBnd_ns\fR +.TP +\fBget_nd(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 128-bit IPv6 address field \fIA\fR\[char46] +.IP +Looks up \fIA\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores its Ethernet address in \fBeth\[char46]dst\fR, otherwise stores \fB00:00:00:00:00:00\fR in \fBeth\[char46]dst\fR\[char46] +.IP +\fBExample:\fR \fBget_nd(outport, ip6\[char46]dst);\fR +.TP +\fBput_nd(\fIP\fB, \fIA\fB, \fIE\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 128-bit IPv6 address field \fIA\fR, 48-bit Ethernet address field \fIE\fR\[char46] +.IP +Adds or updates the entry for IPv6 address \fIA\fR in logical port \fIP\fR\(cqs mac binding table, setting its Ethernet address to \fIE\fR\[char46] +.IP +\fBExample:\fR \fBput_nd(inport, nd\[char46]target, nd\[char46]tll);\fR +.TP +\fB\fIR\fB = lookup_nd(\fIP\fB, \fIA\fB, \fIM\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 128-bit IP address field \fIA\fR, 48-bit MAC address field \fIM\fR\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Looks up \fIA\fR and \fIM\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores \fB1\fR in the 1-bit subfield \fIR\fR, else 0\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = lookup_nd(inport, ip6\[char46]src, eth\[char46]src); +\fR +.TP +\fB\fIR\fB = lookup_nd_ip(\fIP\fB, \fIA\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR, 128-bit IP address field \fIA\fR\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Looks up \fIA\fR in \fIP\fR\(cqs mac binding table\[char46] If an entry is found, stores \fB1\fR in the 1-bit subfield \fIR\fR, else 0\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = lookup_nd_ip(inport, ip6\[char46]src); +\fR +.TP +\fB\fIR\fB = put_dhcp_opts(\fID1\fB = \fIV1\fB, \fID2\fB = \fIV2\fB, \[char46]\[char46]\[char46], \fIDn\fB = \fIVn\fB);\fR +\fBParameters\fR: one or more DHCP option/value pairs, which must include an \fBofferip\fR option (with code 0)\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Valid only in the ingress pipeline\[char46] +.IP +When this action is applied to a DHCP request packet (DHCPDISCOVER or DHCPREQUEST), it changes the packet into a DHCP reply (DHCPOFFER or DHCPACK, respectively), replaces the options by those specified as parameters, and stores 1 in \fIR\fR\[char46] +.IP +When this action is applied to a non-DHCP packet or a DHCP packet that is not DHCPDISCOVER or DHCPREQUEST, it leaves the packet unchanged and stores 0 in \fIR\fR\[char46] +.IP +The contents of the \fBDHCP_Option\fR table control the DHCP option names and values that this action supports\[char46] +.IP +\fBExample:\fR \fB +reg0[0] = put_dhcp_opts(offerip = 10\[char46]0\[char46]0\[char46]2, router = 10\[char46]0\[char46]0\[char46]1, +netmask = 255\[char46]255\[char46]255\[char46]0, dns_server = {8\[char46]8\[char46]8\[char46]8, 7\[char46]7\[char46]7\[char46]7}); +\fR +.TP +\fB\fIR\fB = put_dhcpv6_opts(\fID1\fB = \fIV1\fB, \fID2\fB = \fIV2\fB, \[char46]\[char46]\[char46], \fIDn\fB = \fIVn\fB);\fR +\fBParameters\fR: one or more DHCPv6 option/value pairs\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Valid only in the ingress pipeline\[char46] +.IP +When this action is applied to a DHCPv6 request packet, it changes the packet into a DHCPv6 reply, replaces the options by those specified as parameters, and stores 1 in \fIR\fR\[char46] +.IP +When this action is applied to a non-DHCPv6 packet or an invalid DHCPv6 request packet , it leaves the packet unchanged and stores 0 in \fIR\fR\[char46] +.IP +The contents of the \fBDHCPv6_Options\fR table control the DHCPv6 option names and values that this action supports\[char46] +.IP +\fBExample:\fR \fB +reg0[3] = put_dhcpv6_opts(ia_addr = aef0::4, server_id = 00:00:00:00:10:02, +dns_server={ae70::1,ae70::2}); +\fR +.TP +\fBset_queue(\fIqueue_number\fB);\fR +\fBParameters\fR: Queue number \fIqueue_number\fR, in the range 0 to 61440\[char46] +.IP +This is a logical equivalent of the OpenFlow \fBset_queue\fR action\[char46] It affects packets that egress a hypervisor through a physical interface\[char46] For nonzero \fIqueue_number\fR, it configures packet queuing to match the settings configured for the \fBPort_Binding\fR with \fBoptions:qdisc_queue_id\fR matching \fIqueue_number\fR\[char46] When \fIqueue_number\fR is zero, it resets queuing to the default strategy\[char46] +.IP +\fBExample:\fR \fBset_queue(10);\fR +.TP +\fBct_lb;\fR +.TQ .5in +\fBct_lb(backends=\fIip\fB[:\fIport\fB][,\[char46]\[char46]\[char46]][; hash_fields=\fIfield1\fB,\fIfield2\fB,\[char46]\[char46]\[char46]][; ct_flag]);\fR +With arguments, \fBct_lb\fR commits the packet to the connection tracking table and DNATs the packet\(cqs destination IP address (and port) to the IP address or addresses (and optional ports) specified in the \fBbackends\fR\[char46] If multiple comma-separated IP addresses are specified, each is given equal weight for picking the DNAT address\[char46] By default, \fBdp_hash\fR is used as the OpenFlow group selection method, but if \fBhash_fields\fR is specified, \fBhash\fR is used as the selection method, and the fields listed are used as the hash fields\[char46] The \fBct_flag\fR field represents one of supported flag: \fBskip_snat\fR or \fBforce_snat\fR, this flag will be stored in \fBct_label\fR register\[char46] +.IP +Without arguments, \fBct_lb\fR sends the packet to the connection tracking table to NAT the packets\[char46] If the packet is part of an established connection that was previously committed to the connection tracker via \fBct_lb(\fR\[char46]\[char46]\[char46]\fB)\fR, it will automatically get DNATed to the same IP address as the first packet in that connection\[char46] +.IP +Processing automatically moves on to the next table, as if \fBnext;\fR were specified, and later tables act on the packet as modified by the connection tracker\[char46] Connection tracking state is scoped by the logical port when the action is used in a flow for a logical switch, so overlapping addresses may be used\[char46] Connection tracking state is scoped by the logical topology when the action is used in a flow for a router\[char46] +.TP +\fBct_lb_mark;\fR +.TQ .5in +\fBct_lb_mark(backends=\fIip\fB[:\fIport\fB][,\[char46]\[char46]\[char46]][; hash_fields=\fIfield1\fB,\fIfield2\fB,\[char46]\[char46]\[char46]][; ct_flag]);\fR +Same as \fBct_lb\fR, except that it internally uses ct_mark to store the NAT flag, while \fBct_lb\fR uses ct_label for the same purpose\[char46] +.TP +\fB\fIR\fB = dns_lookup();\fR +\fBParameters\fR: No parameters\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Valid only in the ingress pipeline\[char46] +.IP +When this action is applied to a valid DNS request (a UDP packet typically directed to port 53), it attempts to resolve the query using the contents of the \fBDNS\fR table\[char46] If it is successful, it changes the packet into a DNS reply and stores 1 in \fIR\fR\[char46] If the action is applied to a non-DNS packet, an invalid DNS request packet, or a valid DNS request for which the \fBDNS\fR table does not supply an answer, it leaves the packet unchanged and stores 0 in \fIR\fR\[char46] +.IP +Regardless of success, the action does not make any of the changes to the flow that are necessary to direct the packet back to the requester\[char46] The logical pipeline can implement this behavior with matches and actions in later tables\[char46] +.IP +\fBExample:\fR \fB +reg0[3] = dns_lookup(); +\fR +.IP +\fBPrerequisite:\fR \fBudp\fR +.TP +\fB\fIR\fB = put_nd_ra_opts(\fID1\fB = \fIV1\fB, \fID2\fB = \fIV2\fB, \[char46]\[char46]\[char46], \fIDn\fB = \fIVn\fB);\fR +\fBParameters\fR: The following IPv6 ND Router Advertisement option/value pairs as defined in RFC 4861\[char46] +.RS +.IP \(bu +\fBaddr_mode\fR +.IP +Mandatory parameter which specifies the address mode flag to be set in the RA flag options field\[char46] The value of this option is a string and the following values can be defined - \(dqslaac\(dq, \(dqdhcpv6_stateful\(dq and \(dqdhcpv6_stateless\(dq\[char46] +.IP \(bu +\fBslla\fR +.IP +Mandatory parameter which specifies the link-layer address of the interface from which the Router Advertisement is sent\[char46] +.IP \(bu +\fBmtu\fR +.IP +Optional parameter which specifies the MTU\[char46] +.IP \(bu +\fBprefix\fR +.IP +Optional parameter which should be specified if the addr_mode is \(dqslaac\(dq or \(dqdhcpv6_stateless\(dq\[char46] The value should be an IPv6 prefix which will be used for stateless IPv6 address configuration\[char46] This option can be defined multiple times\[char46] +.RE +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +Valid only in the ingress pipeline\[char46] +.IP +When this action is applied to an IPv6 Router solicitation request packet, it changes the packet into an IPv6 Router Advertisement reply and adds the options specified in the parameters, and stores 1 in \fIR\fR\[char46] +.IP +When this action is applied to a non-IPv6 Router solicitation packet or an invalid IPv6 request packet , it leaves the packet unchanged and stores 0 in \fIR\fR\[char46] +.IP +\fBExample:\fR \fB +reg0[3] = put_nd_ra_opts(addr_mode = \(dqslaac\(dq, +slla = 00:00:00:00:10:02, prefix = aef0::/64, mtu = 1450); +\fR +.TP +\fBset_meter(\fIrate\fB);\fR +.TQ .5in +\fBset_meter(\fIrate\fB, \fIburst\fB);\fR +\fBParameters\fR: rate limit int field \fIrate\fR in kbps, burst rate limits int field \fIburst\fR in kbps\[char46] +.IP +This action sets the rate limit for a flow\[char46] +.IP +\fBExample:\fR \fBset_meter(100, 1000);\fR +.TP +\fB\fIR\fB = check_pkt_larger(\fIL\fB)\fR +\fBParameters\fR: packet length \fIL\fR to check for in bytes\[char46] +.IP +\fBResult\fR: stored to a 1-bit subfield \fIR\fR\[char46] +.IP +This is a logical equivalent of the OpenFlow \fBcheck_pkt_larger\fR action\[char46] If the packet is larger than the length specified in \fIL\fR, it stores 1 in the subfield \fIR\fR\[char46] +.IP +\fBExample: \fR\fBreg0[6] = check_pkt_larger(1000);\fR +.RE +.RS +.TP +\fBlog(\fIkey\fB=\fIvalue\fB, \fR\[char46]\[char46]\[char46]\fB);\fR +Causes \fBovn\-controller\fR to log the packet on the chassis that processes it\[char46] Packet logging currently uses the same logging mechanism as other Open vSwitch and OVN messages, which means that whether and where log messages appear depends on the local logging configuration that can be configured with \fBovs\-appctl\fR, etc\[char46] +.IP +The \fBlog\fR action takes zero or more of the following key-value pair arguments that control what is logged: +.RS +.TP +\fBname=\fR\fIstring\fR +An optional name for the ACL\[char46] The \fIstring\fR is currently limited to 64 bytes\[char46] +.TP +\fBseverity=\fR\fIlevel\fR +Indicates the severity of the event\[char46] The \fIlevel\fR is one of following (from more to less serious): \fBalert\fR, \fBwarning\fR, \fBnotice\fR, \fBinfo\fR, or \fBdebug\fR\[char46] If a severity is not provided, the default is \fBinfo\fR\[char46] +.TP +\fBverdict=\fR\fIvalue\fR +The verdict for packets matching the flow\[char46] The value must be one of \fBallow\fR, \fBdeny\fR, or \fBreject\fR\[char46] +.TP +\fBmeter=\fR\fIstring\fR +An optional rate-limiting meter to be applied to the logs\[char46] The \fIstring\fR should reference a \fBname\fR entry from the \fBMeter\fR table\[char46] The only meter \fBaction\fR that is appropriate is \fBdrop\fR\[char46] +.RE +.TP +\fBfwd_group(liveness=\fIbool\fB, childports=\fIport\fB, \[char46]\[char46]\[char46]);\fR +\fBParameters\fR: optional \fBliveness\fR, either \fBtrue\fR or \fBfalse\fR, defaulting to false; \fBchildports\fR, a comma-delimited list of strings denoting logical ports to load balance across\[char46] +.IP +Load balance traffic to one or more child ports in a logical switch\[char46] \fBovn\-controller\fR translates the \fBfwd_group\fR into an OpenFlow group with one bucket for each child port\[char46] If \fBliveness=true\fR is specified, it also integrates the bucket selection with BFD status on the tunnel interface corresponding to child port\[char46] +.IP +\fBExample:\fR \fBfwd_group(liveness=true, childports=\(dqp1\(dq, +\(dqp2\(dq);\fR +.RE +.RS +.TP +\fBicmp4 { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +.TQ .5in +\fBicmp4_error { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv4 packet being processed by an ICMPv4 packet and executes each nested \fIaction\fR on the ICMPv4 packet\[char46] Actions following these actions, if any, apply to the original, unmodified packet\[char46] +.IP +The ICMPv4 packet that these actions operates on is initialized based on the IPv4 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change\[char46] Ethernet and IPv4 fields not listed here are not changed: +.RS +.IP \(bu +\fBip\[char46]proto = 1\fR (ICMPv4) +.IP \(bu +\fBip\[char46]frag = 0\fR (not a fragment) +.IP \(bu +\fBip\[char46]ttl = 255\fR +.IP \(bu +\fBicmp4\[char46]type = 3\fR (destination unreachable) +.IP \(bu +\fBicmp4\[char46]code = 1\fR (host unreachable) +.RE +.IP +\fBicmp4_error\fR action is expected to be used to generate an ICMPv4 packet in response to an error in original IP packet\[char46] When this action generates the ICMPv4 packet, it also copies the original IP datagram following the ICMPv4 header as per RFC 1122: 3\[char46]2\[char46]2\[char46] +.IP +\fBPrerequisite:\fR \fBip4\fR +.TP +\fBicmp6 { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +.TQ .5in +\fBicmp6_error { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +Temporarily replaces the IPv6 packet being processed by an ICMPv6 packet and executes each nested \fIaction\fR on the ICMPv6 packet\[char46] Actions following the \fIicmp6\fR action, if any, apply to the original, unmodified packet\[char46] +.IP +The ICMPv6 packet that this action operates on is initialized based on the IPv6 packet being processed, as follows\[char46] These are default values that the nested actions will probably want to change\[char46] Ethernet and IPv6 fields not listed here are not changed: +.RS +.IP \(bu +\fBip\[char46]proto = 58\fR (ICMPv6) +.IP \(bu +\fBip\[char46]ttl = 255\fR +.IP \(bu +\fBicmp6\[char46]type = 1\fR (destination unreachable) +.IP \(bu +\fBicmp6\[char46]code = 1\fR (administratively prohibited) +.RE +.IP +\fBicmp6_error\fR action is expected to be used to generate an ICMPv6 packet in response to an error in original IPv6 packet\[char46] +.IP +\fBPrerequisite:\fR \fBip6\fR +.TP +\fBtcp_reset;\fR +This action transforms the current TCP packet according to the following pseudocode: +.IP +.nf +\fB +.br +\fBif (tcp\[char46]ack) { +.br +\fB tcp\[char46]seq = tcp\[char46]ack; +.br +\fB} else { +.br +\fB tcp\[char46]ack = tcp\[char46]seq + length(tcp\[char46]payload); +.br +\fB tcp\[char46]seq = 0; +.br +\fB} +.br +\fBtcp\[char46]flags = RST; +.br +\fB\fR +.fi +.IP +Then, the action drops all TCP options and payload data, and updates the TCP checksum\[char46] IP ttl is set to 255\[char46] +.IP +\fBPrerequisite:\fR \fBtcp\fR +.TP +\fBreject { \fIaction\fB; \fR\[char46]\[char46]\[char46]\fB };\fR +If the original packet is IPv4 or IPv6 TCP packet, it replaces it with IPv4 or IPv6 TCP RST packet and executes the inner actions\[char46] Otherwise it replaces it with an ICMPv4 or ICMPv6 packet and executes the inner actions\[char46] +.IP +The inner actions should not attempt to swap eth source with eth destination and IP source with IP destination as this action implicitly does that\[char46] +.TP +\fBtrigger_event;\fR +This action is used to allow ovs-vswitchd to report CMS related events writing them in \fBController_Event\fR table\[char46] It is possible to associate a meter to a each event in order to not overload pinctrl thread under heavy load; each meter is identified though a defined naming convention\[char46] Supported events: +.RS +.IP \(bu +\fIempty_lb_backends\fR\[char46] This event is raised if a received packet is destined for a load balancer VIP that has no configured backend destinations\[char46] For this event, the event info includes the load balancer VIP, the load balancer UUID, and the transport protocol\[char46] Associated meter: \fBevent\-elb\fR +.RE +.TP +\fBigmp;\fR +This action sends the packet to \fBovn\-controller\fR for multicast snooping\[char46] +.IP +\fBPrerequisite:\fR \fBigmp\fR +.TP +\fBbind_vport(\fIV\fB, \fIP\fB);\fR +\fBParameters\fR: logical port string field \fIV\fR of type \fBvirtual\fR, logical port string field \fIP\fR\[char46] +.IP +Binds the virtual logical port \fIV\fR and sets the \fBchassis\fR column and \fBvirtual_parent\fR of the table \fBPort_Binding\fR\[char46] \fBvirtual_parent\fR is set to \fIP\fR\[char46] +.TP +\fBhandle_svc_check(\fIP\fB);\fR +\fBParameters\fR: logical port string field \fIP\fR\[char46] +.IP +Handles the service monitor reply received from the VIF of the logical port \fIP\fR\[char46] \fBovn\-controller\fR periodically sends out the service monitor packets for the services configured in the \fBService_Monitor\fR table and this action updates the status of those services\[char46] +.IP +\fBExample:\fR \fBhandle_svc_check(inport);\fR +.TP +\fBhandle_dhcpv6_reply;\fR +Handle DHCPv6 prefix delegation advertisements/replies from a IPv6 delegation server\[char46] \fBovn\-controller\fR will add an entry \fBipv6_ra_pd_list\fR in the \fBoptions\fR table for each prefix received from the delegation server +.TP +\fB\fIR\fB = select(\fIN1\fB[=\fIW1\fB], \fIN2\fB[=\fIW2\fB], \[char46]\[char46]\[char46]);\fR +\fBParameters\fR: Integer \fIN1\fR, \fIN2\fR\[char46]\[char46]\[char46], with optional weight \fIW1\fR, \fIW2\fR, \[char46]\[char46]\[char46] +.IP +\fBResult\fR: stored to a logical field or subfield \fIR\fR\[char46] +.IP +Select from a list of integers \fIN1\fR, \fIN2\fR\[char46]\[char46]\[char46], each within the range 0 ~ 65535, and store the selected one in the field \fIR\fR\[char46] There must be 2 or more integers listed, each with an optional weight, which is an integer within the range 1 ~ 65535\[char46] If weight is not specified, it defaults to 100\[char46] The selection method is based on the 5-tuple hash of packet header\[char46] +.IP +Processing automatically moves on to the next table, as if \fBnext;\fR were specified\[char46] The \fBselect\fR action must be put as the last action of the logical flow when there are multiple actions (actions put after \fBselect\fR will not take effect)\[char46] +.IP +\fBExample:\fR \fBreg8[16\[char46]\[char46]31] = select(1=20, 2=30, 3=50);\fR +.TP +\fBhandle_dhcpv6_reply;\fR +This action is used to parse DHCPv6 replies from IPv6 Delegation Router and managed IPv6 Prefix delegation state machine +.TP +\fB\fIR\fB = chk_lb_hairpin();\fR +This action checks if the packet under consideration was destined to a load balancer VIP and it is hairpinned, i\[char46]e\[char46], after load balancing the destination IP matches the source IP\[char46] If it is so, then the 1-bit destination register \fIR\fR is set to 1\[char46] +.TP +\fB\fIR\fB = chk_lb_hairpin_reply();\fR +This action checks if the packet under consideration is from one of the backend IP of a load balancer VIP and the destination IP is the load balancer VIP\[char46] If it is so, then the 1-bit destination register \fIR\fR is set to 1\[char46] +.TP +\fB\fIR\fB = ct_snat_to_vip;\fR +This action sends the packet through the SNAT zone to change the source IP address of the packet to the load balancer VIP if the original destination IP was load balancer VIP and commits the connection\[char46] This action applies successfully only for the hairpinned traffic i\[char46]e if the action \fBchk_lb_hairpin\fR returned success\[char46] This action doesn\(cqt take any arguments and it determines the SNAT IP internally\[char46] The packet is not automatically sent to the next table\[char46] The caller has to execute the \fBnext;\fR action explicitly after this action to advance the packet to the next stage\[char46] +.TP +\fB\fIR\fB = check_in_port_sec();\fR +This action checks if the packet under consideration passes the inport port security checks\[char46] If the packet fails the port security checks, then \fB1\fR is stored in the destination register \fIR\fR\[char46] Else 0 is stored\[char46] The port security values to check are retrieved from the the \fBinport\fR logical port\[char46] +.IP +This action should be used in the ingress logical switch pipeline\[char46] +.IP +\fBExample:\fR \fBreg8[0\[char46]\[char46]7] = check_in_port_sec();\fR +.TP +\fB\fIR\fB = check_out_port_sec();\fR +This action checks if the packet under consideration passes the outport port security checks\[char46] If the packet fails the port security checks, then \fB1\fR is stored in the destination register \fIR\fR\[char46] Else 0 is stored\[char46] The port security values to check are retrieved from the the \fBoutport\fR logical port\[char46] +.IP +This action should be used in the egress logical switch pipeline\[char46] +.IP +\fBExample:\fR \fBreg8[0\[char46]\[char46]7] = check_out_port_sec();\fR +.TP +\fBcommit_ecmp_nh(\fIipv6\fB);\fR +\fBParameters\fR: IPv4/IPv6 traffic\[char46] +.IP +This action translates to an openflow \(dqlearn\(dq action that inserts two new flows in tables 76 and 77\[char46] +.RS +.IP \(bu +Match on the the 5-tuple and the expected next-hop mac address in table 76: \fBnw_src=ip0\fR, \fBnw_dst=ip1\fR, \fBip_proto\fR,\fBtp_src=l4_port0\fR, \fBtp_dst=l4_port1\fR,\fBdl_src=ethaddr\fR and set \fBreg9[5]\fR\[char46] +.IP \(bu +Match on the 5-tuple in table 77: \fBnw_src=ip1\fR, \fBnw_dst=ip0\fR, \fBip_proto\fR, \fBtp_src=l4_port1\fR, \fBtp_dst=l4_port0\fR and set \fBreg9[5]\fR to 1 +.RE +.IP +This action is applied if the packet arrives via ECMP route or if it is routed via an ECMP route +.TP +\fB\fIR\fB = check_ecmp_nh_mac();\fR +This action checks if the packet under consideration matches any flow in table 76\[char46] If it is so, then the 1-bit destination register \fIR\fR is set to 1\[char46] +.TP +\fB\fIR\fB = check_ecmp_nh();\fR +This action checks if the packet under consideration matches the any flow in table 77\[char46] If it is so, then the 1-bit destination register \fIR\fR is set to 1\[char46] +.TP +\fB +commit_lb_aff(\fIvip\fB, \fIbackend\fB, +\fIproto\fB, \fItimeout\fB); +\fR +\fBParameters\fR: load-balancer virtual ip:port \fIvip\fR, load-balancer backend ip:port \fIbackend\fR, load-balancer protocol \fIproto\fR, affinity timeout \fItimeout\fR\[char46] +.IP +This action translates to an openflow \(dqlearn\(dq action that inserts a new flow in table 78\[char46] +.RS +.IP \(bu +Match on the 4-tuple in table 78: \fBnw_src=ip client\fR, \fBnw_dst=vip ip\fR, \fBip_proto\fR, \fBtp_dst=vip port\fR and set \fBreg9[6]\fR to 1, \fBreg4\fR and \fBreg8\fR to backend ip and port respectively\[char46] For IPv6 register \fBxxreg1\fR is used to store the backend ip\[char46] +.RE +.IP +This action is applied for new connections received by a specific load-balacer with affinity timeout configured\[char46] +.TP +\fB\fIR\fB = chk_lb_aff();\fR +This action checks if the packet under consideration matches any flow in table 78\[char46] If it is so, then the 1-bit destination register \fIR\fR is set to 1\[char46] +.TP +\fBsample(probability=\fIpackets\fB, \[char46]\[char46]\[char46])\fR +This action causes the matched traffic to be sampled using IPFIX protocol\[char46] More information about how per-flow IPFIX sampling works in OVS can be found in \fBovs\-actions\fR(7) and \fBovs\-vswitchd\[char46]conf\[char46]db\fR(5)\[char46] +.IP +In order to reliably identify each sampled packet when it is received by the IPFIX collector, this action sets the content of the \fBObservationDomainID\fR and \fBObservationPointID\fR IPFIX fields (see argument description below)\[char46] +.IP +The following key-value arguments are supported: +.RS +.TP +\fBprobability=\fR\fIpackets\fR +The number of sampled packets out of 65535\[char46] It must be greater or equal to 1\[char46] +.TP +\fBcollector_set=\fR\fIid\fR +The unsigned 32-bit integer identifier of the sample collector to send sampled packets to\[char46] It must match the value configured in the \fBFlow_Sample_Collector_Set\fR Table in OVS\[char46] Defaults to 0\[char46] +.TP +\fBobs_domain=\fR\fIid\fR +An unsigned 8-bit integer that identifies the sampling application\[char46] It will be placed in the 8 most significant bits of the \fBObservationDomainID\fR field of IPFIX samples\[char46] The 24 less significant bits will be automatically filled in with the datapath key\[char46] Defaults to 0\[char46] +.TP +\fBobs_point=\fR\fIid\fR +An unsigned 32-bit integer to be used as \fBObsservationPointID\fR or the string \fB@cookie\fR to indicate that the first 32 bits of the \fBLogical_Flow\fR\(cqs UUID shall be used instead\[char46] +.RE +.RE +.IP "\fBtags\fR: map of string-string pairs" +Key-value pairs that provide additional information to help ovn-controller processing the logical flow\[char46] Below are the tags used by ovn-controller\[char46] +.RS +.TP +in_out_port +In the logical flow\(cqs \(dqmatch\(dq column, if a logical port P is compared with \(dqinport\(dq and the logical flow is on a logical switch ingress pipeline, or if P is compared with \(dqoutport\(dq and the logical flow is on a logical switch egress pipeline, and the expression is combined with other expressions (if any) using the operator &&, then the port P should be added as the value in this tag\[char46] If there are multiple logical ports meeting this criteria, one of them can be added\[char46] ovn-controller uses this information to skip parsing flows that are not needed on the chassis\[char46] Failing to add the tag will affect efficiency, while adding wrong value will affect correctness\[char46] +.RE +.IP "\fBcontroller_meter\fR: optional string" +The name of the meter in table \fBMeter\fR to be used for all packets that the logical flow might send to \fBovn\-controller\fR\[char46] +.IP "\fBexternal_ids : stage-name\fR: optional string" +Human-readable name for this flow\(cqs stage in the pipeline\[char46] +.IP "\fBexternal_ids : stage-hint\fR: optional string, containing an uuid" +UUID of a \fBOVN_Northbound\fR record that caused this logical flow to be created\[char46] Currently used only for attribute of logical flows to northbound \fBACL\fR records\[char46] +.IP "\fBexternal_ids : source\fR: optional string" +Source file and line number of the code that added this flow to the pipeline\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Logical_DP_Group TABLE" +.PP +.PP +.PP +Each row in this table represents a group of logical datapaths referenced by the \fBlogical_dp_group\fR column in the \fBLogical_Flow\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBdatapaths\fR +set of weak reference to \fBDatapath_Binding\fRs +.SS "Details: +.IP "\fBdatapaths\fR: set of weak reference to \fBDatapath_Binding\fRs" +List of \fBDatapath_Binding\fR entries\[char46] +.bp +.SH "Multicast_Group TABLE" +.PP +.PP +.PP +The rows in this table define multicast groups of logical ports\[char46] Multicast groups allow a single packet transmitted over a tunnel to a hypervisor to be delivered to multiple VMs on that hypervisor, which uses bandwidth more efficiently\[char46] +.PP +.PP +Each row in this table defines a logical multicast group numbered \fBtunnel_key\fR within \fBdatapath\fR, whose logical ports are listed in the \fBports\fR column\[char46] +.SS "Summary: +.TQ 3.00in +\fBdatapath\fR +\fBDatapath_Binding\fR +.TQ 3.00in +\fBtunnel_key\fR +integer, in range 32,768 to 65,535 +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBports\fR +set of weak reference to \fBPort_Binding\fRs +.SS "Details: +.IP "\fBdatapath\fR: \fBDatapath_Binding\fR" +The logical datapath in which the multicast group resides\[char46] +.IP "\fBtunnel_key\fR: integer, in range 32,768 to 65,535" +The value used to designate this logical egress port in tunnel encapsulations\[char46] An index forces the key to be unique within the \fBdatapath\fR\[char46] The unusual range ensures that multicast group IDs do not overlap with logical port IDs\[char46] +.IP "\fBname\fR: string" +The logical multicast group\(cqs name\[char46] An index forces the name to be unique within the \fBdatapath\fR\[char46] Logical flows in the ingress pipeline may output to the group just as for individual logical ports, by assigning the group\(cqs name to \fBoutport\fR and executing an \fBoutput\fR action\[char46] +.IP +Multicast group names and logical port names share a single namespace and thus should not overlap (but the database schema cannot enforce this)\[char46] To try to avoid conflicts, \fBovn\-northd\fR uses names that begin with \fB_MC_\fR\[char46] +.IP "\fBports\fR: set of weak reference to \fBPort_Binding\fRs" +The logical ports included in the multicast group\[char46] All of these ports must be in the \fBdatapath\fR logical datapath (but the database schema cannot enforce this)\[char46] +.bp +.SH "Mirror TABLE" +.PP +.PP +.PP +Each row in this table represents a mirror that can be used for port mirroring\[char46] These mirrors are referenced by the \fBmirror_rules\fR column in the \fBPort_Binding\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBfilter\fR +string, one of \fBboth\fR, \fBfrom\-lport\fR, or \fBto\-lport\fR +.TQ 3.00in +\fBsink\fR +string +.TQ 3.00in +\fBtype\fR +string, one of \fBerspan\fR, \fBgre\fR, or \fBlocal\fR +.TQ 3.00in +\fBindex\fR +integer +.TQ 3.00in +\fBexternal_ids\fR +map of string-string pairs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Represents the name of the mirror\[char46] +.IP "\fBfilter\fR: string, one of \fBboth\fR, \fBfrom\-lport\fR, or \fBto\-lport\fR" +The value of this field represents selection criteria of the mirror\[char46] \fBto\-lport\fR mirrors the packets coming into logical port\[char46] \fBfrom\-lport\fR mirrors the packets going out of logical port\[char46] \fBboth\fR mirrors for both directions\[char46] +.IP "\fBsink\fR: string" +The value of this field represents the destination/sink of the mirror\[char46] If the \fItype\fR is \fBgre\fR or \fBerspan\fR, the value indicates the tunnel remote IP (either IPv4 or IPv6)\[char46] For a \fItype\fR of \fBlocal\fR, this field defines a local interface on the OVS integration bridge to be used as the mirror destination\[char46] The interface must possess external-ids:mirror-id that matches this string\[char46] +.IP "\fBtype\fR: string, one of \fBerspan\fR, \fBgre\fR, or \fBlocal\fR" +The value of this field specifies the mirror type - \fBgre\fR, \fBerspan\fR or \fBlocal\fR\[char46] +.IP "\fBindex\fR: integer" +The value of this field represents the tunnel ID\[char46] If the configured tunnel type is \fBgre\fR, this field represents the \fBGRE\fR key value and if the configured tunnel type is \fBerspan\fR it represents the \fBerspan_idx\fR value\[char46] It is ignored if the type is \fBlocal\fR\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Meter TABLE" +.PP +.PP +.PP +Each row in this table represents a meter that can be used for QoS or rate-limiting\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBunit\fR +string, either \fBkbps\fR or \fBpktps\fR +.TQ 3.00in +\fBbands\fR +set of 1 or more \fBMeter_Band\fRs +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +A name for this meter\[char46] +.IP +Names that begin with \(dq__\(dq (two underscores) are reserved for OVN internal use and should not be added manually\[char46] +.IP "\fBunit\fR: string, either \fBkbps\fR or \fBpktps\fR" +The unit for \fBrate\fR and \fBburst_rate\fR parameters in the \fBbands\fR entry\[char46] \fBkbps\fR specifies kilobits per second, and \fBpktps\fR specifies packets per second\[char46] +.IP "\fBbands\fR: set of 1 or more \fBMeter_Band\fRs" +The bands associated with this meter\[char46] Each band specifies a rate above which the band is to take the action \fBaction\fR\[char46] If multiple bands\(cq rates are exceeded, then the band with the highest rate among the exceeded bands is selected\[char46] +.bp +.SH "Meter_Band TABLE" +.PP +.PP +.PP +Each row in this table represents a meter band which specifies the rate above which the configured action should be applied\[char46] These bands are referenced by the \fBbands\fR column in the \fBMeter\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBaction\fR +string, must be \fBdrop\fR +.TQ 3.00in +\fBrate\fR +integer, in range 1 to 4,294,967,295 +.TQ 3.00in +\fBburst_size\fR +integer, in range 0 to 4,294,967,295 +.SS "Details: +.IP "\fBaction\fR: string, must be \fBdrop\fR" +The action to execute when this band matches\[char46] The only supported action is \fBdrop\fR\[char46] +.IP "\fBrate\fR: integer, in range 1 to 4,294,967,295" +The rate limit for this band, in kilobits per second or bits per second, depending on whether the parent \fBMeter\fR entry\(cqs \fBunit\fR column specified \fBkbps\fR or \fBpktps\fR\[char46] +.IP "\fBburst_size\fR: integer, in range 0 to 4,294,967,295" +The maximum burst allowed for the band in kilobits or packets, depending on whether \fBkbps\fR or \fBpktps\fR was selected in the parent \fBMeter\fR entry\(cqs \fBunit\fR column\[char46] If the size is zero, the switch is free to select some reasonable value depending on its configuration\[char46] +.bp +.SH "Datapath_Binding TABLE" +.PP +.PP +.PP +Each row in this table represents a logical datapath, which implements a logical pipeline among the ports in the \fBPort_Binding\fR table associated with it\[char46] In practice, the pipeline in a given logical datapath implements either a logical switch or a logical router\[char46] +.PP +.PP +The main purpose of a row in this table is provide a physical binding for a logical datapath\[char46] A logical datapath does not have a physical location, so its physical binding information is limited: just \fBtunnel_key\fR\[char46] The rest of the data in this table does not affect packet forwarding\[char46] +.SS "Summary: +.TQ 3.00in +\fBtunnel_key\fR +integer, in range 1 to 16,777,215 (must be unique within table) +.TQ 3.00in +\fBload_balancers\fR +set of uuids +.TQ .25in +\fIOVN_Northbound Relationship:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids : logical-switch\fR +optional string, containing an uuid +.TQ 2.75in +\fBexternal_ids : logical-router\fR +optional string, containing an uuid +.TQ 2.75in +\fBexternal_ids : interconn-ts\fR +optional string +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.50in +\fBexternal_ids : name\fR +optional string +.TQ 2.50in +\fBexternal_ids : name2\fR +optional string +.RE +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBtunnel_key\fR: integer, in range 1 to 16,777,215 (must be unique within table)" +The tunnel key value to which the logical datapath is bound\[char46] The \fBTunnel Encapsulation\fR section in \fBovn\-architecture\fR(7) describes how tunnel keys are constructed for each supported encapsulation\[char46] +.IP "\fBload_balancers\fR: set of uuids" +Not used anymore; kept for backwards compatibility of the schema\[char46] +.ST "OVN_Northbound Relationship:" +.PP +.PP +.PP +Each row in \fBDatapath_Binding\fR is associated with some logical datapath\[char46] \fBovn\-northd\fR uses these keys to track the association of a logical datapath with concepts in the \fBOVN_Northbound\fR database\[char46] +.IP "\fBexternal_ids : logical-switch\fR: optional string, containing an uuid" +For a logical datapath that represents a logical switch, \fBovn\-northd\fR stores in this key the UUID of the corresponding \fBLogical_Switch\fR row in the \fBOVN_Northbound\fR database\[char46] +.IP "\fBexternal_ids : logical-router\fR: optional string, containing an uuid" +For a logical datapath that represents a logical router, \fBovn\-northd\fR stores in this key the UUID of the corresponding \fBLogical_Router\fR row in the \fBOVN_Northbound\fR database\[char46] +.IP "\fBexternal_ids : interconn-ts\fR: optional string" +For a logical datapath that represents a logical switch that represents a transit switch for interconnection, \fBovn\-northd\fR stores in this key the value of the same \fBinterconn\-ts\fR key of the \fBexternal_ids\fR column of the corresponding \fBLogical_Switch\fR row in the \fBOVN_Northbound\fR database\[char46] +.ST "Naming:" +.PP +.PP +.PP +\fBovn\-northd\fR copies these from the name fields in the \fBOVN_Northbound\fR database, either from \fBname\fR and \fBexternal_ids:neutron:router_name\fR in the \fBLogical_Router\fR table or from \fBname\fR and \fBexternal_ids:neutron:network_name\fR in the \fBLogical_Switch\fR table\[char46] +.IP "\fBexternal_ids : name\fR: optional string" +A name for the logical datapath\[char46] +.IP "\fBexternal_ids : name2\fR: optional string" +Another name for the logical datapath\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "Port_Binding TABLE" +.PP +.PP +.PP +Each row in this table binds a logical port to a realization\[char46] For most logical ports, this means binding to some physical location, for example by binding a logical port to a VIF that belongs to a VM running on a particular hypervisor\[char46] Other logical ports, such as logical patch ports, can be realized without a specific physical location, but their bindings are still expressed through rows in this table\[char46] +.PP +.PP +For every \fBLogical_Switch_Port\fR record in \fBOVN_Northbound\fR database, \fBovn\-northd\fR creates a record in this table\[char46] \fBovn\-northd\fR populates and maintains every column except the \fBchassis\fR and \fBvirtual_parent\fR columns, which it leaves empty in new records\[char46] +.PP +.PP +\fBovn\-controller\fR/\fBovn\-controller\-vtep\fR populates the \fBchassis\fR column for the records that identify the logical ports that are located on its hypervisor/gateway, which \fBovn\-controller\fR/\fBovn\-controller\-vtep\fR in turn finds out by monitoring the local hypervisor\(cqs Open_vSwitch database, which identifies logical ports via the conventions described in \fBIntegrationGuide\[char46]rst\fR\[char46] (The exceptions are for \fBPort_Binding\fR records with \fBtype\fR of \fBl3gateway\fR, whose locations are identified by \fBovn\-northd\fR via the \fBoptions:l3gateway\-chassis\fR column in this table\[char46] \fBovn\-controller\fR is still responsible to populate the \fBchassis\fR column\[char46]) +.PP +.PP +\fBovn\-controller\fR also populates the \fBvirtual_parent\fR column of records whose \fBtype\fR is \fBvirtual\fR\[char46] +.PP +.PP +When a chassis shuts down gracefully, it should clean up the \fBchassis\fR column that it previously had populated\[char46] (This is not critical because resources hosted on the chassis are equally unreachable regardless of whether their rows are present\[char46]) To handle the case where a VM is shut down abruptly on one chassis, then brought up again on a different one, \fBovn\-controller\fR/\fBovn\-controller\-vtep\fR must overwrite the \fBchassis\fR column with new information\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBdatapath\fR +\fBDatapath_Binding\fR +.TQ 2.75in +\fBlogical_port\fR +string (must be unique within table) +.TQ 2.75in +\fBencap\fR +optional weak reference to \fBEncap\fR +.TQ 2.75in +\fBadditional_encap\fR +set of weak reference to \fBEncap\fRs +.TQ 2.75in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 2.75in +\fBadditional_chassis\fR +set of weak reference to \fBChassis\fR +.TQ 2.75in +\fBgateway_chassis\fR +set of \fBGateway_Chassis\fRes +.TQ 2.75in +\fBha_chassis_group\fR +optional \fBHA_Chassis_Group\fR +.TQ 2.75in +\fBup\fR +optional boolean +.TQ 2.75in +\fBtunnel_key\fR +integer, in range 1 to 32,767 +.TQ 2.75in +\fBmac\fR +set of strings +.TQ 2.75in +\fBport_security\fR +set of strings +.TQ 2.75in +\fBtype\fR +string +.TQ 2.75in +\fBrequested_chassis\fR +optional weak reference to \fBChassis\fR +.TQ 2.75in +\fBrequested_additional_chassis\fR +set of weak reference to \fBChassis\fR +.RE +.TQ 3.00in +\fBmirror_rules\fR +set of weak reference to \fBMirror\fRs +.TQ .25in +\fIPatch Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : peer\fR +optional string +.TQ 2.75in +\fBnat_addresses\fR +set of strings +.RE +.TQ .25in +\fIL3 Gateway Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : peer\fR +optional string +.TQ 2.75in +\fBoptions : l3gateway-chassis\fR +optional string +.TQ 2.75in +\fBnat_addresses\fR +set of strings +.RE +.TQ .25in +\fILocalnet Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : network_name\fR +optional string +.TQ 2.75in +\fBtag\fR +optional integer, in range 1 to 4,095 +.RE +.TQ .25in +\fIL2 Gateway Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : network_name\fR +optional string +.TQ 2.75in +\fBoptions : l2gateway-chassis\fR +optional string +.TQ 2.75in +\fBtag\fR +optional integer, in range 1 to 4,095 +.RE +.TQ .25in +\fIVTEP Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : vtep-physical-switch\fR +optional string +.TQ 2.75in +\fBoptions : vtep-logical-switch\fR +optional string +.RE +.TQ .25in +\fIVMI (or VIF) Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : requested-chassis\fR +optional string +.TQ 2.75in +\fBoptions : activation-strategy\fR +optional string +.TQ 2.75in +\fBoptions : additional-chassis-activated\fR +optional string +.TQ 2.75in +\fBoptions : iface-id-ver\fR +optional string +.TQ 2.75in +\fBoptions : qos_min_rate\fR +optional string +.TQ 2.75in +\fBoptions : qos_max_rate\fR +optional string +.TQ 2.75in +\fBoptions : qos_burst\fR +optional string +.TQ 2.75in +\fBoptions : qos_physical_network\fR +optional string +.TQ 2.75in +\fBoptions : qdisc_queue_id\fR +optional string, containing an integer, in range 1 to 61,440 +.RE +.TQ .25in +\fIDistributed Gateway Port Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : chassis-redirect-port\fR +optional string +.RE +.TQ .25in +\fIChassis Redirect Options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : distributed-port\fR +optional string +.TQ 2.75in +\fBoptions : redirect-type\fR +optional string +.TQ 2.75in +\fBoptions : always-redirect\fR +optional string +.RE +.TQ .25in +\fINested Containers:\fR +.RS .25in +.TQ 2.75in +\fBparent_port\fR +optional string +.TQ 2.75in +\fBtag\fR +optional integer, in range 1 to 4,095 +.RE +.TQ .25in +\fIVirtual ports:\fR +.RS .25in +.TQ 2.75in +\fBvirtual_parent\fR +optional string +.RE +.TQ .25in +\fINaming:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids : name\fR +optional string +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBdatapath\fR: \fBDatapath_Binding\fR" +The logical datapath to which the logical port belongs\[char46] +.IP "\fBlogical_port\fR: string (must be unique within table)" +A logical port\[char46] For a logical switch port, this is taken from \fBname\fR in the OVN_Northbound database\(cqs \fBLogical_Switch_Port\fR table\[char46] For a logical router port, this is taken from \fBname\fR in the OVN_Northbound database\(cqs \fBLogical_Router_port\fR table\[char46] (This means that logical switch ports and router port names must not share names in an OVN deployment\[char46]) OVN does not prescribe a particular format for the logical port ID\[char46] +.IP "\fBencap\fR: optional weak reference to \fBEncap\fR" +Points to preferred encapsulation configuration to transmit logical dataplane packets to this chassis\[char46] The entry is reference to a \fBEncap\fR record\[char46] +.IP "\fBadditional_encap\fR: set of weak reference to \fBEncap\fRs" +Points to preferred encapsulation configuration to transmit logical dataplane packets to this additional chassis\[char46] The entry is reference to a \fBEncap\fR record\[char46] See also \fBadditional_chassis\fR\[char46] +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +The meaning of this column depends on the value of the \fBtype\fR column\[char46] This is the meaning for each \fBtype\fR +.RS +.TP +(empty string) +The physical location of the logical port\[char46] To successfully identify a chassis, this column must be a \fBChassis\fR record\[char46] This is populated by \fBovn\-controller\fR\[char46] +.TP +vtep +The physical location of the hardware_vtep gateway\[char46] To successfully identify a chassis, this column must be a \fBChassis\fR record\[char46] This is populated by \fBovn\-controller\-vtep\fR\[char46] +.TP +localnet +Always empty\[char46] A localnet port is realized on every chassis that has connectivity to the corresponding physical network\[char46] +.TP +localport +Always empty\[char46] A localport port is present on every chassis\[char46] +.TP +l3gateway +The physical location of the L3 gateway\[char46] To successfully identify a chassis, this column must be a \fBChassis\fR record\[char46] This is populated by \fBovn\-controller\fR based on the value of the \fBoptions:l3gateway\-chassis\fR column in this table\[char46] +.TP +l2gateway +The physical location of this L2 gateway\[char46] To successfully identify a chassis, this column must be a \fBChassis\fR record\[char46] This is populated by \fBovn\-controller\fR based on the value of the \fBoptions:l2gateway\-chassis\fR column in this table\[char46] +.RE +.IP "\fBadditional_chassis\fR: set of weak reference to \fBChassis\fR" +The meaning of this column is the same as for the \fBchassis\fR\[char46] The column is used to track an additional physical location of the logical port\[char46] Used with regular (empty \fBtype\fR) port bindings\[char46] +.IP "\fBgateway_chassis\fR: set of \fBGateway_Chassis\fRes" +A list of \fBGateway_Chassis\fR\[char46] +.IP +This should only be populated for ports with \fBtype\fR set to \fBchassisredirect\fR\[char46] This column defines the list of chassis used as gateways where traffic will be redirected through\[char46] +.IP "\fBha_chassis_group\fR: optional \fBHA_Chassis_Group\fR" +This should only be populated for ports with \fBtype\fR set to \fBchassisredirect\fR\[char46] This column defines the HA chassis group with a list of HA chassis used as gateways where traffic will be redirected through\[char46] +.IP "\fBup\fR: optional boolean" +This is set to \fBtrue\fR whenever all OVS flows required by this Port_Binding have been installed\[char46] This is populated by \fBovn\-controller\fR\[char46] +.IP "\fBtunnel_key\fR: integer, in range 1 to 32,767" +A number that represents the logical port in the key (e\[char46]g\[char46] STT key or Geneve TLV) field carried within tunnel protocol packets\[char46] +.IP +The tunnel ID must be unique within the scope of a logical datapath\[char46] +.IP "\fBmac\fR: set of strings" +This column is a misnomer as it may contain MAC addresses and IP addresses\[char46] It is copied from the \fBaddresses\fR column in the \fBLogical_Switch_Port\fR table in the Northbound database\[char46] It follows the same format as that column\[char46] +.IP "\fBport_security\fR: set of strings" +This column controls the addresses from which the host attached to the logical port (``the host\(cq\(cq) is allowed to send packets and to which it is allowed to receive packets\[char46] If this column is empty, all addresses are permitted\[char46] +.IP +It is copied from the \fBport_security\fR column in the \fBLogical_Switch_Port\fR table in the Northbound database\[char46] It follows the same format as that column\[char46] +.IP "\fBtype\fR: string" +A type for this logical port\[char46] Logical ports can be used to model other types of connectivity into an OVN logical switch\[char46] The following types are defined: +.RS +.TP +(empty string) +VM (or VIF) interface\[char46] +.TP +\fBpatch\fR +One of a pair of logical ports that act as if connected by a patch cable\[char46] Useful for connecting two logical datapaths, e\[char46]g\[char46] to connect a logical router to a logical switch or to another logical router\[char46] +.TP +\fBl3gateway\fR +One of a pair of logical ports that act as if connected by a patch cable across multiple chassis\[char46] Useful for connecting a logical switch with a Gateway router (which is only resident on a particular chassis)\[char46] +.TP +\fBlocalnet\fR +A connection to a locally accessible network from \fBovn\-controller\fR instances that have a corresponding bridge mapping\[char46] A logical switch can have multiple \fBlocalnet\fR ports attached\[char46] This type is used to model direct connectivity to existing networks\[char46] In this case, each chassis should have a mapping for one of the physical networks only\[char46] Note: nothing said above implies that a chassis cannot be plugged to multiple physical networks as long as they belong to different switches\[char46] +.TP +\fBlocalport\fR +A connection to a local VIF\[char46] Traffic that arrives on a \fBlocalport\fR is never forwarded over a tunnel to another chassis\[char46] These ports are present on every chassis and have the same address in all of them\[char46] This is used to model connectivity to local services that run on every hypervisor\[char46] +.TP +\fBl2gateway\fR +An L2 connection to a physical network\[char46] The chassis this \fBPort_Binding\fR is bound to will serve as an L2 gateway to the network named by \fBoptions\fR:\fBnetwork_name\fR\[char46] +.TP +\fBvtep\fR +A port to a logical switch on a VTEP gateway chassis\[char46] In order to get this port correctly recognized by the OVN controller, the \fBoptions\fR:\fBvtep\-physical\-switch\fR and \fBoptions\fR:\fBvtep\-logical\-switch\fR must also be defined\[char46] +.TP +\fBchassisredirect\fR +A logical port that represents a particular instance, bound to a specific chassis, of an otherwise distributed parent port (e\[char46]g\[char46] of type \fBpatch\fR)\[char46] A \fBchassisredirect\fR port should never be used as an \fBinport\fR\[char46] When an ingress pipeline sets the \fBoutport\fR, it may set the value to a logical port of type \fBchassisredirect\fR\[char46] This will cause the packet to be directed to a specific chassis to carry out the egress pipeline\[char46] At the beginning of the egress pipeline, the \fBoutport\fR will be reset to the value of the distributed port\[char46] +.TP +\fBvirtual\fR +Represents a logical port with an \fBvirtual ip\fR\[char46] This \fBvirtual ip\fR can be configured on a logical port (which is referred as virtual parent)\[char46] +.RE +.IP "\fBrequested_chassis\fR: optional weak reference to \fBChassis\fR" +This column exists so that the ovn-controller can effectively monitor all \fBPort_Binding\fR records destined for it, and is a supplement to the \fBoptions:requested-chassis\fR option\[char46] The option is still required so that the ovn-controller can check the CMS intent when the chassis pointed to does not currently exist, which for example occurs when the ovn-controller is stopped without passing the \-restart argument\[char46] This column must be a \fBChassis\fR record\[char46] This is populated by \fBovn\-northd\fR when the \fBoptions:requested-chassis\fR is defined and contains a string matching the name or hostname of an existing chassis\[char46] See also \fBrequested_additional_chassis\fR\[char46] +.IP "\fBrequested_additional_chassis\fR: set of weak reference to \fBChassis\fR" +This column exists so that the ovn-controller can effectively monitor all \fBPort_Binding\fR records destined for it, and is a supplement to the \fBoptions:requested-chassis\fR option when multiple chassis are listed\[char46] This column must be a list of \fBChassis\fR records\[char46] This is populated by \fBovn\-northd\fR when the \fBoptions:requested-chassis\fR is defined as a list of chassis names or hostnames\[char46] See also \fBrequested_chassis\fR\[char46] +.IP "\fBmirror_rules\fR: set of weak reference to \fBMirror\fRs" +Mirror rules that apply to the port binding\[char46] Please see the \fBMirror\fR table\[char46] +.ST "Patch Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBpatch\fR\[char46] +.IP "\fBoptions : peer\fR: optional string" +The \fBlogical_port\fR in the \fBPort_Binding\fR record for the other side of the patch\[char46] The named \fBlogical_port\fR must specify this \fBlogical_port\fR in its own \fBpeer\fR option\[char46] That is, the two patch logical ports must have reversed \fBlogical_port\fR and \fBpeer\fR values\[char46] +.IP "\fBnat_addresses\fR: set of strings" +MAC address followed by a list of SNAT and DNAT external IP addresses, followed by \fBis_chassis_resident(\(dq\fIlport\fB\(dq)\fR, where \fIlport\fR is the name of a logical port on the same chassis where the corresponding NAT rules are applied\[char46] This is used to send gratuitous ARPs for SNAT and DNAT external IP addresses via \fBlocalnet\fR, from the chassis where \fIlport\fR resides\[char46] Example: \fB80:fa:5b:06:72:b7 158\[char46]36\[char46]44\[char46]22 +158\[char46]36\[char46]44\[char46]24 is_chassis_resident(\(dqfoo1\(dq)\fR\[char46] This would result in generation of gratuitous ARPs for IP addresses 158\[char46]36\[char46]44\[char46]22 and 158\[char46]36\[char46]44\[char46]24 with a MAC address of 80:fa:5b:06:72:b7 from the chassis where the logical port \(dqfoo1\(dq resides\[char46] +.ST "L3 Gateway Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBl3gateway\fR\[char46] +.IP "\fBoptions : peer\fR: optional string" +The \fBlogical_port\fR in the \fBPort_Binding\fR record for the other side of the \(cql3gateway\(cq port\[char46] The named \fBlogical_port\fR must specify this \fBlogical_port\fR in its own \fBpeer\fR option\[char46] That is, the two \(cql3gateway\(cq logical ports must have reversed \fBlogical_port\fR and \fBpeer\fR values\[char46] +.IP "\fBoptions : l3gateway-chassis\fR: optional string" +The \fBchassis\fR in which the port resides\[char46] +.IP "\fBnat_addresses\fR: set of strings" +MAC address of the \fBl3gateway\fR port followed by a list of SNAT and DNAT external IP addresses\[char46] This is used to send gratuitous ARPs for SNAT and DNAT external IP addresses via \fBlocalnet\fR\[char46] Example: \fB80:fa:5b:06:72:b7 158\[char46]36\[char46]44\[char46]22 158\[char46]36\[char46]44\[char46]24\fR\[char46] This would result in generation of gratuitous ARPs for IP addresses 158\[char46]36\[char46]44\[char46]22 and 158\[char46]36\[char46]44\[char46]24 with a MAC address of 80:fa:5b:06:72:b7\[char46] This is used in OVS version 2\[char46]8 and later versions\[char46] +.ST "Localnet Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBlocalnet\fR\[char46] +.IP "\fBoptions : network_name\fR: optional string" +Required\[char46] \fBovn\-controller\fR uses the configuration entry \fBovn\-bridge\-mappings\fR to determine how to connect to this network\[char46] \fBovn\-bridge\-mappings\fR is a list of network names mapped to a local OVS bridge that provides access to that network\[char46] An example of configuring \fBovn\-bridge\-mappings\fR would be: .IP +.nf +\fB$ ovs\-vsctl set open \[char46] external\-ids:ovn\-bridge\-mappings=physnet1:br\-eth0,physnet2:br\-eth1\fR +.fi +.IP +When a logical switch has a \fBlocalnet\fR port attached, every chassis that may have a local vif attached to that logical switch must have a bridge mapping configured to reach that \fBlocalnet\fR\[char46] Traffic that arrives on a \fBlocalnet\fR port is never forwarded over a tunnel to another chassis\[char46] If there are multiple \fBlocalnet\fR ports in a logical switch, each chassis should only have a single bridge mapping for one of the physical networks\[char46] Note: In case of multiple \fBlocalnet\fR ports, to provide interconnectivity between all VIFs located on different chassis with different fabric connectivity, the fabric should implement some form of routing between the segments\[char46] +.IP "\fBtag\fR: optional integer, in range 1 to 4,095" +If set, indicates that the port represents a connection to a specific VLAN on a locally accessible network\[char46] The VLAN ID is used to match incoming traffic and is also added to outgoing traffic\[char46] +.ST "L2 Gateway Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBl2gateway\fR\[char46] +.IP "\fBoptions : network_name\fR: optional string" +Required\[char46] \fBovn\-controller\fR uses the configuration entry \fBovn\-bridge\-mappings\fR to determine how to connect to this network\[char46] \fBovn\-bridge\-mappings\fR is a list of network names mapped to a local OVS bridge that provides access to that network\[char46] An example of configuring \fBovn\-bridge\-mappings\fR would be: .IP +.nf +\fB$ ovs\-vsctl set open \[char46] external\-ids:ovn\-bridge\-mappings=physnet1:br\-eth0,physnet2:br\-eth1\fR +.fi +.IP +When a logical switch has a \fBl2gateway\fR port attached, the chassis that the \fBl2gateway\fR port is bound to must have a bridge mapping configured to reach the network identified by \fBnetwork_name\fR\[char46] +.IP "\fBoptions : l2gateway-chassis\fR: optional string" +Required\[char46] The \fBchassis\fR in which the port resides\[char46] +.IP "\fBtag\fR: optional integer, in range 1 to 4,095" +If set, indicates that the gateway is connected to a specific VLAN on the physical network\[char46] The VLAN ID is used to match incoming traffic and is also added to outgoing traffic\[char46] +.ST "VTEP Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBvtep\fR\[char46] +.IP "\fBoptions : vtep-physical-switch\fR: optional string" +Required\[char46] The name of the VTEP gateway\[char46] +.IP "\fBoptions : vtep-logical-switch\fR: optional string" +Required\[char46] A logical switch name connected by the VTEP gateway\[char46] Must be set when \fBtype\fR is \fBvtep\fR\[char46] +.ST "VMI (or VIF) Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR having (empty string) +.IP "\fBoptions : requested-chassis\fR: optional string" +If set, identifies a specific chassis (by name or hostname) that is allowed to bind this port\[char46] Using this option will prevent thrashing between two chassis trying to bind the same port during a live migration\[char46] It can also prevent similar thrashing due to a mis-configuration, if a port is accidentally created on more than one chassis\[char46] +.IP +If set to a comma separated list, the first entry identifies the main chassis and the rest are one or more additional chassis that are allowed to bind the same port\[char46] +.IP +When multiple chassis are set for the port, and the logical switch is connected to an external network through a \fBlocalnet\fR port, tunneling is enforced for the port to guarantee delivery of packets directed to the port to all its locations\[char46] This has MTU implications because the network used for tunneling must have MTU larger than \fBlocalnet\fR for stable connectivity\[char46] +.IP "\fBoptions : activation-strategy\fR: optional string" +If used with multiple chassis set in \fBrequested-chassis\fR, specifies an activation strategy for all additional chassis\[char46] By default, no activation strategy is used, meaning additional port locations are immediately available for use\[char46] When set to \(dqrarp\(dq, the port is blocked for ingress and egress communication until a RARP packet is sent from a new location\[char46] The \(dqrarp\(dq strategy is useful in live migration scenarios for virtual machines\[char46] +.IP "\fBoptions : additional-chassis-activated\fR: optional string" +When \fBactivation-strategy\fR is set, this option indicates that the port was activated using the strategy specified\[char46] +.IP "\fBoptions : iface-id-ver\fR: optional string" +If set, this port will be bound by \fBovn\-controller\fR only if this same key and value is configured in the \fBexternal_ids\fR column in the Open_vSwitch database\(cqs \fBInterface\fR table\[char46] +.IP "\fBoptions : qos_min_rate\fR: optional string" +If set, indicates the minimum guaranteed rate available for data sent from this interface, in bit/s\[char46] +.IP "\fBoptions : qos_max_rate\fR: optional string" +If set, indicates the maximum rate for data sent from this interface, in bit/s\[char46] The traffic will be shaped according to this limit\[char46] +.IP "\fBoptions : qos_burst\fR: optional string" +If set, indicates the maximum burst size for data sent from this interface, in bits\[char46] +.IP "\fBoptions : qos_physical_network\fR: optional string" +If set, indicates the name of the egress network name where traffic shaping will be applied\[char46] +.IP "\fBoptions : qdisc_queue_id\fR: optional string, containing an integer, in range 1 to 61,440" +Indicates the queue number on the physical device\[char46] This is same as the \fBqueue_id\fR used in OpenFlow in \fBstruct +ofp_action_enqueue\fR\[char46] +.ST "Distributed Gateway Port Options:" +.PP +.PP +.PP +These options apply to the distributed parent ports of logical ports with \fBtype\fR of \fBchasssisredirect\fR\[char46] +.IP "\fBoptions : chassis-redirect-port\fR: optional string" +The name of the chassis redirect port derived from this port if this port is a distributed parent of a chassis redirect port\[char46] +.ST "Chassis Redirect Options:" +.PP +.PP +.PP +These options apply to logical ports with \fBtype\fR of \fBchassisredirect\fR\[char46] +.IP "\fBoptions : distributed-port\fR: optional string" +The name of the distributed port for which this \fBchassisredirect\fR port represents a particular instance\[char46] +.IP "\fBoptions : redirect-type\fR: optional string" +The value is copied from the column \fBoptions\fR in the OVN_Northbound database\(cqs \fBLogical_Router_Port\fR table for the distributed parent of this port\[char46] +.IP "\fBoptions : always-redirect\fR: optional string" +A boolean option that is set to true if the distributed parent of this chassis redirect port does not need distributed processing\[char46] +.ST "Nested Containers:" +.PP +.PP +.PP +These columns support containers nested within a VM\[char46] Specifically, they are used when \fBtype\fR is empty and \fBlogical_port\fR identifies the interface of a container spawned inside a VM\[char46] They are empty for containers or VMs that run directly on a hypervisor\[char46] +.IP "\fBparent_port\fR: optional string" +This is taken from \fBparent_name\fR in the OVN_Northbound database\(cqs \fBLogical_Switch_Port\fR table\[char46] +.IP "\fBtag\fR: optional integer, in range 1 to 4,095" +Identifies the VLAN tag in the network traffic associated with that container\(cqs network interface\[char46] +.IP +This column is used for a different purpose when \fBtype\fR is \fBlocalnet\fR (see \fBLocalnet Options\fR, above) or \fBl2gateway\fR (see \fBL2 Gateway Options\fR, above)\[char46] +.ST "Virtual ports:" +.PP +.IP "\fBvirtual_parent\fR: optional string" +This column is set by \fBovn\-controller\fR with one of the value from the \fBoptions:virtual-parents\fR in the OVN_Northbound database\(cqs \fBLogical_Switch_Port\fR table when the OVN action \fBbind_vport\fR is executed\[char46] \fBovn\-controller\fR also sets the \fBchassis\fR column when it executes this action with its chassis id\[char46] +.IP +\fBovn\-controller\fR sets this column only if the \fBtype\fR is \(dqvirtual\(dq\[char46] +.ST "Naming:" +.PP +.IP "\fBexternal_ids : name\fR: optional string" +For a logical switch port, \fBovn\-northd\fR copies this from \fBexternal_ids:neutron:port_name\fR in the \fBLogical_Switch_Port\fR table in the OVN_Northbound database, if it is a nonempty string\[char46] +.IP +For a logical switch port, \fBovn\-northd\fR does not currently set this key\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.IP +The \fBovn\-northd\fR program populates this column with all entries into the \fBexternal_ids\fR column of the \fBLogical_Switch_Port\fR and \fBLogical_Router_Port\fR tables of the \fBOVN_Northbound\fR database\[char46] +.bp +.SH "MAC_Binding TABLE" +.PP +.PP +.PP +Each row in this table specifies a binding from an IP address to an Ethernet address that has been discovered through ARP (for IPv4) or neighbor discovery (for IPv6)\[char46] This table is primarily used to discover bindings on physical networks, because IP-to-MAC bindings for virtual machines are usually populated statically into the \fBPort_Binding\fR table\[char46] +.PP +.PP +This table expresses a functional relationship: \fBMAC_Binding\fR(\fBlogical_port\fR, \fBip\fR) = \fBmac\fR\[char46] +.PP +.PP +In outline, the lifetime of a logical router\(cqs MAC binding looks like this: +.RS +.IP 1. .4in +On hypervisor 1, a logical router determines that a packet should be forwarded to IP address \fIA\fR on one of its router ports\[char46] It uses its logical flow table to determine that \fIA\fR lacks a static IP-to-MAC binding and the \fBget_arp\fR action to determine that it lacks a dynamic IP-to-MAC binding\[char46] +.IP 2. .4in +Using an OVN logical \fBarp\fR action, the logical router generates and sends a broadcast ARP request to the router port\[char46] It drops the IP packet\[char46] +.IP 3. .4in +The logical switch attached to the router port delivers the ARP request to all of its ports\[char46] (It might make sense to deliver it only to ports that have no static IP-to-MAC bindings, but this could also be surprising behavior\[char46]) +.IP 4. .4in +A host or VM on hypervisor 2 (which might be the same as hypervisor 1) attached to the logical switch owns the IP address in question\[char46] It composes an ARP reply and unicasts it to the logical router port\(cqs Ethernet address\[char46] +.IP 5. .4in +The logical switch delivers the ARP reply to the logical router port\[char46] +.IP 6. .4in +The logical router flow table executes a \fBput_arp\fR action\[char46] To record the IP-to-MAC binding, \fBovn\-controller\fR adds a row to the \fBMAC_Binding\fR table\[char46] +.IP 7. .4in +On hypervisor 1, \fBovn\-controller\fR receives the updated \fBMAC_Binding\fR table from the OVN southbound database\[char46] The next packet destined to \fIA\fR through the logical router is sent directly to the bound Ethernet address\[char46] +.RE +.SS "Summary: +.TQ 3.00in +\fBlogical_port\fR +string +.TQ 3.00in +\fBip\fR +string +.TQ 3.00in +\fBmac\fR +string +.TQ 3.00in +\fBtimestamp\fR +integer +.TQ 3.00in +\fBdatapath\fR +\fBDatapath_Binding\fR +.SS "Details: +.IP "\fBlogical_port\fR: string" +The logical port on which the binding was discovered\[char46] +.IP "\fBip\fR: string" +The bound IP address\[char46] +.IP "\fBmac\fR: string" +The Ethernet address to which the IP is bound\[char46] +.IP "\fBtimestamp\fR: integer" +The timestamp in msec when the MAC binding was added or updated\[char46] Records that existed before this column will have 0\[char46] +.IP "\fBdatapath\fR: \fBDatapath_Binding\fR" +The logical datapath to which the logical port belongs\[char46] +.bp +.SH "DHCP_Options TABLE" +.PP +.PP +.PP +Each row in this table stores the DHCP Options supported by native OVN DHCP\[char46] \fBovn\-northd\fR populates this table with the supported DHCP options\[char46] \fBovn\-controller\fR looks up this table to get the DHCP codes of the DHCP options defined in the \(dqput_dhcp_opts\(dq action\[char46] Please refer to the RFC 2132 \fB\(dqhttps://tools\[char46]ietf\[char46]org/html/rfc2132\(dq\fR for the possible list of DHCP options that can be defined here\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBcode\fR +integer, in range 0 to 254 +.TQ 3.00in +\fBtype\fR +string, one of \fBbool\fR, \fBdomains\fR, \fBhost_id\fR, \fBipv4\fR, \fBstatic_routes\fR, \fBstr\fR, \fBuint16\fR, \fBuint32\fR, or \fBuint8\fR +.SS "Details: +.IP "\fBname\fR: string" +Name of the DHCP option\[char46] +.IP +Example\[char46] name=\(dqrouter\(dq +.IP "\fBcode\fR: integer, in range 0 to 254" +DHCP option code for the DHCP option as defined in the RFC 2132\[char46] +.IP +Example\[char46] code=3 +.IP "\fBtype\fR: string, one of \fBbool\fR, \fBdomains\fR, \fBhost_id\fR, \fBipv4\fR, \fBstatic_routes\fR, \fBstr\fR, \fBuint16\fR, \fBuint32\fR, or \fBuint8\fR" +Data type of the DHCP option code\[char46] +.RS +.TP +\fBvalue: bool\fR +This indicates that the value of the DHCP option is a bool\[char46] +.IP +Example\[char46] \(dqname=ip_forward_enable\(dq, \(dqcode=19\(dq, \(dqtype=bool\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], ip_forward_enable = 1,\[char46]\[char46]\[char46]) +.TP +\fBvalue: uint8\fR +This indicates that the value of the DHCP option is an unsigned int8 (8 bits) +.IP +Example\[char46] \(dqname=default_ttl\(dq, \(dqcode=23\(dq, \(dqtype=uint8\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], default_ttl = 50,\[char46]\[char46]\[char46]) +.TP +\fBvalue: uint16\fR +This indicates that the value of the DHCP option is an unsigned int16 (16 bits)\[char46] +.IP +Example\[char46] \(dqname=mtu\(dq, \(dqcode=26\(dq, \(dqtype=uint16\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], mtu = 1450,\[char46]\[char46]\[char46]) +.TP +\fBvalue: uint32\fR +This indicates that the value of the DHCP option is an unsigned int32 (32 bits)\[char46] +.IP +Example\[char46] \(dqname=lease_time\(dq, \(dqcode=51\(dq, \(dqtype=uint32\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], lease_time = 86400,\[char46]\[char46]\[char46]) +.TP +\fBvalue: ipv4\fR +This indicates that the value of the DHCP option is an IPv4 address or addresses\[char46] +.IP +Example\[char46] \(dqname=router\(dq, \(dqcode=3\(dq, \(dqtype=ipv4\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], router = 10\[char46]0\[char46]0\[char46]1,\[char46]\[char46]\[char46]) +.IP +Example\[char46] \(dqname=dns_server\(dq, \(dqcode=6\(dq, \(dqtype=ipv4\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], dns_server = {8\[char46]8\[char46]8\[char46]8 7\[char46]7\[char46]7\[char46]7},\[char46]\[char46]\[char46]) +.TP +\fBvalue: static_routes\fR +This indicates that the value of the DHCP option contains a pair of IPv4 route and next hop addresses\[char46] +.IP +Example\[char46] \(dqname=classless_static_route\(dq, \(dqcode=121\(dq, \(dqtype=static_routes\(dq\[char46] +.IP +put_dhcp_opts(\[char46]\[char46]\[char46], classless_static_route = {30\[char46]0\[char46]0\[char46]0/24,10\[char46]0\[char46]0\[char46]4,0\[char46]0\[char46]0\[char46]0/0,10\[char46]0\[char46]0\[char46]1}\[char46]\[char46]\[char46]) +.TP +\fBvalue: str\fR +This indicates that the value of the DHCP option is a string\[char46] +.IP +Example\[char46] \(dqname=host_name\(dq, \(dqcode=12\(dq, \(dqtype=str\(dq\[char46] +.TP +\fBvalue: host_id\fR +This indicates that the value of the DHCP option is a host_id\[char46] It can either be a host_name or an IP address\[char46] +.IP +Example\[char46] \(dqname=tftp_server\(dq, \(dqcode=66\(dq, \(dqtype=host_id\(dq\[char46] +.TP +\fBvalue: domains\fR +This indicates that the value of the DHCP option is a domain name or a comma separated list of domain names\[char46] +.IP +Example\[char46] \(dqname=domain_search_list\(dq, \(dqcode=119\(dq, \(dqtype=domains\(dq\[char46] +.RE +.bp +.SH "DHCPv6_Options TABLE" +.PP +.PP +.PP +Each row in this table stores the DHCPv6 Options supported by native OVN DHCPv6\[char46] \fBovn\-northd\fR populates this table with the supported DHCPv6 options\[char46] \fBovn\-controller\fR looks up this table to get the DHCPv6 codes of the DHCPv6 options defined in the \fBput_dhcpv6_opts\fR action\[char46] Please refer to RFC 3315 and RFC 3646 for the list of DHCPv6 options that can be defined here\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBcode\fR +integer, in range 0 to 254 +.TQ 3.00in +\fBtype\fR +string, one of \fBipv6\fR, \fBmac\fR, or \fBstr\fR +.SS "Details: +.IP "\fBname\fR: string" +Name of the DHCPv6 option\[char46] +.IP +Example\[char46] name=\(dqia_addr\(dq +.IP "\fBcode\fR: integer, in range 0 to 254" +DHCPv6 option code for the DHCPv6 option as defined in the appropriate RFC\[char46] +.IP +Example\[char46] code=3 +.IP "\fBtype\fR: string, one of \fBipv6\fR, \fBmac\fR, or \fBstr\fR" +Data type of the DHCPv6 option code\[char46] +.RS +.TP +\fBvalue: ipv6\fR +This indicates that the value of the DHCPv6 option is an IPv6 address(es)\[char46] +.IP +Example\[char46] \(dqname=ia_addr\(dq, \(dqcode=5\(dq, \(dqtype=ipv6\(dq\[char46] +.IP +put_dhcpv6_opts(\[char46]\[char46]\[char46], ia_addr = ae70::4,\[char46]\[char46]\[char46]) +.TP +\fBvalue: str\fR +This indicates that the value of the DHCPv6 option is a string\[char46] +.IP +Example\[char46] \(dqname=domain_search\(dq, \(dqcode=24\(dq, \(dqtype=str\(dq\[char46] +.IP +put_dhcpv6_opts(\[char46]\[char46]\[char46], domain_search = ovn\[char46]domain,\[char46]\[char46]\[char46]) +.TP +\fBvalue: mac\fR +This indicates that the value of the DHCPv6 option is a MAC address\[char46] +.IP +Example\[char46] \(dqname=server_id\(dq, \(dqcode=2\(dq, \(dqtype=mac\(dq\[char46] +.IP +put_dhcpv6_opts(\[char46]\[char46]\[char46], server_id = 01:02:03:04L05:06,\[char46]\[char46]\[char46]) +.RE +.bp +.SH "Connection TABLE" +.PP +.PP +.PP +Configuration for a database connection to an Open vSwitch database (OVSDB) client\[char46] +.PP +.PP +This table primarily configures the Open vSwitch database server (\fBovsdb\-server\fR)\[char46] +.PP +.PP +The Open vSwitch database server can initiate and maintain active connections to remote clients\[char46] It can also listen for database connections\[char46] +.SS "Summary: +.TQ .25in +\fICore Features:\fR +.RS .25in +.TQ 2.75in +\fBtarget\fR +string (must be unique within table) +.TQ 2.75in +\fBread_only\fR +boolean +.TQ 2.75in +\fBrole\fR +string +.RE +.TQ .25in +\fIClient Failure Detection and Handling:\fR +.RS .25in +.TQ 2.75in +\fBmax_backoff\fR +optional integer, at least 1,000 +.TQ 2.75in +\fBinactivity_probe\fR +optional integer +.RE +.TQ .25in +\fIStatus:\fR +.RS .25in +.TQ 2.75in +\fBis_connected\fR +boolean +.TQ 2.75in +\fBstatus : last_error\fR +optional string +.TQ 2.75in +\fBstatus : state\fR +optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR +.TQ 2.75in +\fBstatus : sec_since_connect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : sec_since_disconnect\fR +optional string, containing an integer, at least 0 +.TQ 2.75in +\fBstatus : locks_held\fR +optional string +.TQ 2.75in +\fBstatus : locks_waiting\fR +optional string +.TQ 2.75in +\fBstatus : locks_lost\fR +optional string +.TQ 2.75in +\fBstatus : n_connections\fR +optional string, containing an integer, at least 2 +.TQ 2.75in +\fBstatus : bound_port\fR +optional string, containing an integer +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.TQ 2.75in +\fBother_config\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Core Features:" +.PP +.IP "\fBtarget\fR: string (must be unique within table)" +Connection methods for clients\[char46] +.IP +The following connection methods are currently supported: +.RS +.TP +\fBssl:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified SSL \fIport\fR on the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address\[char46] A valid SSL configuration must be provided when this form is used, this configuration can be specified via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBtcp:\fIhost\fB\fR[\fB:\fIport\fB\fR] +The specified TCP \fIport\fR on the given \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address (IPv4 or IPv6)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBtcp:[::1]:6640\fR\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.TP +\fBpssl:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for SSL connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap in square brackets, e\[char46]g\[char46] \fBpssl:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 (but not IPv6) addresses\[char46] A valid SSL configuration must be provided when this form is used, this can be specified either via command-line options or the \fBSSL\fR table\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.IP +SSL support is an optional feature that is not always built as part of Open vSwitch\[char46] +.TP +\fBptcp:\fR[\fIport\fR][\fB:\fIhost\fB\fR] +Listens for connections on the specified TCP \fIport\fR\[char46] Specify 0 for \fIport\fR to have the kernel automatically choose an available port\[char46] If \fIhost\fR, which can either be a DNS name (if built with unbound library) or an IP address, is specified, then connections are restricted to the resolved or specified local IP address (either IPv4 or IPv6 address)\[char46] If \fIhost\fR is an IPv6 address, wrap it in square brackets, e\[char46]g\[char46] \fBptcp:6640:[::1]\fR\[char46] If \fIhost\fR is not specified then it listens only on IPv4 addresses\[char46] +.IP +If \fIport\fR is not specified, it defaults to 6640\[char46] +.RE +.IP +When multiple clients are configured, the \fBtarget\fR values must be unique\[char46] Duplicate \fBtarget\fR values yield unspecified results\[char46] +.IP "\fBread_only\fR: boolean" +\fBtrue\fR to restrict these connections to read-only transactions, \fBfalse\fR to allow them to modify the database\[char46] +.IP "\fBrole\fR: string" +String containing role name for this connection entry\[char46] +.ST "Client Failure Detection and Handling:" +.PP +.IP "\fBmax_backoff\fR: optional integer, at least 1,000" +Maximum number of milliseconds to wait between connection attempts\[char46] Default is implementation-specific\[char46] +.IP "\fBinactivity_probe\fR: optional integer" +Maximum number of milliseconds of idle time on connection to the client before sending an inactivity probe message\[char46] If Open vSwitch does not communicate with the client for the specified number of seconds, it will send a probe\[char46] If a response is not received for the same additional amount of time, Open vSwitch assumes the connection has been broken and attempts to reconnect\[char46] Default is implementation-specific\[char46] A value of 0 disables inactivity probes\[char46] +.ST "Status:" +.PP +.PP +.PP +Key-value pair of \fBis_connected\fR is always updated\[char46] Other key-value pairs in the status columns may be updated depends on the \fBtarget\fR type\[char46] +.PP +.PP +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpunix:\fR), both \fBn_connections\fR and \fBis_connected\fR may also be updated while the remaining key-value pairs are omitted\[char46] +.PP +.PP +On the other hand, when \fBtarget\fR specifies an outbound connection, all key-value pairs may be updated, except the above-mentioned two key-value pairs associated with inbound connection targets\[char46] They are omitted\[char46] +.IP "\fBis_connected\fR: boolean" +\fBtrue\fR if currently connected to this client, \fBfalse\fR otherwise\[char46] +.IP "\fBstatus : last_error\fR: optional string" +A human-readable description of the last error on the connection to the manager; i\[char46]e\[char46] \fBstrerror(errno)\fR\[char46] This key will exist only if an error has occurred\[char46] +.IP "\fBstatus : state\fR: optional string, one of \fBACTIVE\fR, \fBBACKOFF\fR, \fBCONNECTING\fR, \fBIDLE\fR, or \fBVOID\fR" +The state of the connection to the manager: +.RS +.TP +\fBVOID\fR +Connection is disabled\[char46] +.TP +\fBBACKOFF\fR +Attempting to reconnect at an increasing period\[char46] +.TP +\fBCONNECTING\fR +Attempting to connect\[char46] +.TP +\fBACTIVE\fR +Connected, remote host responsive\[char46] +.TP +\fBIDLE\fR +Connection is idle\[char46] Waiting for response to keep-alive\[char46] +.RE +.IP +These values may change in the future\[char46] They are provided only for human consumption\[char46] +.IP "\fBstatus : sec_since_connect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last successfully connected to the database (in seconds)\[char46] Value is empty if client has never successfully been connected\[char46] +.IP "\fBstatus : sec_since_disconnect\fR: optional string, containing an integer, at least 0" +The amount of time since this client last disconnected from the database (in seconds)\[char46] Value is empty if client has never disconnected\[char46] +.IP "\fBstatus : locks_held\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection holds\[char46] Omitted if the connection does not hold any locks\[char46] +.IP "\fBstatus : locks_waiting\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection is currently waiting to acquire\[char46] Omitted if the connection is not waiting for any locks\[char46] +.IP "\fBstatus : locks_lost\fR: optional string" +Space-separated list of the names of OVSDB locks that the connection has had stolen by another OVSDB client\[char46] Omitted if no locks have been stolen from this connection\[char46] +.IP "\fBstatus : n_connections\fR: optional string, containing an integer, at least 2" +When \fBtarget\fR specifies a connection method that listens for inbound connections (e\[char46]g\[char46] \fBptcp:\fR or \fBpssl:\fR) and more than one connection is actually active, the value is the number of active connections\[char46] Otherwise, this key-value pair is omitted\[char46] +.IP "\fBstatus : bound_port\fR: optional string, containing an integer" +When \fBtarget\fR is \fBptcp:\fR or \fBpssl:\fR, this is the TCP port on which the OVSDB server is listening\[char46] (This is particularly useful when \fBtarget\fR specifies a port of 0, allowing the kernel to choose any available port\[char46]) +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.IP "\fBother_config\fR: map of string-string pairs" +.bp +.SH "SSL TABLE" +.PP +SSL configuration for ovn-sb database access\[char46] +.SS "Summary: +.TQ 3.00in +\fBprivate_key\fR +string +.TQ 3.00in +\fBcertificate\fR +string +.TQ 3.00in +\fBca_cert\fR +string +.TQ 3.00in +\fBbootstrap_ca_cert\fR +boolean +.TQ 3.00in +\fBssl_protocols\fR +string +.TQ 3.00in +\fBssl_ciphers\fR +string +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBprivate_key\fR: string" +Name of a PEM file containing the private key used as the switch\(cqs identity for SSL connections to the controller\[char46] +.IP "\fBcertificate\fR: string" +Name of a PEM file containing a certificate, signed by the certificate authority (CA) used by the controller and manager, that certifies the switch\(cqs private key, identifying a trustworthy switch\[char46] +.IP "\fBca_cert\fR: string" +Name of a PEM file containing the CA certificate used to verify that the switch is connected to a trustworthy controller\[char46] +.IP "\fBbootstrap_ca_cert\fR: boolean" +If set to \fBtrue\fR, then Open vSwitch will attempt to obtain the CA certificate from the controller on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] \fBThis option exposes the +SSL connection to a man\-in\-the\-middle attack obtaining the initial +CA certificate\[char46]\fR It may still be useful for bootstrapping\[char46] +.IP "\fBssl_protocols\fR: string" +List of SSL protocols to be enabled for SSL connections\[char46] The default when this option is omitted is \fBTLSv1,TLSv1\[char46]1,TLSv1\[char46]2\fR\[char46] +.IP "\fBssl_ciphers\fR: string" +List of ciphers (in OpenSSL cipher string format) to be supported for SSL connections\[char46] The default when this option is omitted is \fBHIGH:!aNULL:!MD5\fR\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "DNS TABLE" +.PP +.PP +.PP +Each row in this table stores the DNS records\[char46] The OVN action \fBdns_lookup\fR uses this table for DNS resolution\[char46] +.SS "Summary: +.TQ 3.00in +\fBrecords\fR +map of string-string pairs +.TQ 3.00in +\fBdatapaths\fR +set of 1 or more \fBDatapath_Binding\fRs +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBrecords\fR: map of string-string pairs" +Key-value pair of DNS records with \fBDNS query name\fR as the key and a string of IP address(es) separated by comma or space as the value\[char46] ovn-northd stores the DNS query name in all lowercase in order to facilitate case-insensitive lookups\[char46] +.IP +\fBExample: \fR \(dqvm1\[char46]ovn\[char46]org\(dq = \(dq10\[char46]0\[char46]0\[char46]4 aef0::4\(dq +.IP "\fBdatapaths\fR: set of 1 or more \fBDatapath_Binding\fRs" +The DNS records defined in the column \fBrecords\fR will be applied only to the DNS queries originating from the datapaths defined in this column\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "RBAC_Role TABLE" +.PP +Role table for role-based access controls\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBpermissions\fR +map of string-weak reference to \fBRBAC_Permission\fR pairs +.SS "Details: +.IP "\fBname\fR: string" +The role name, corresponding to the \fBrole\fR column in the \fBConnection\fR table\[char46] +.IP "\fBpermissions\fR: map of string-weak reference to \fBRBAC_Permission\fR pairs" +A mapping of table names to rows in the \fBRBAC_Permission\fR table\[char46] +.bp +.SH "RBAC_Permission TABLE" +.PP +Permissions table for role-based access controls\[char46] +.SS "Summary: +.TQ 3.00in +\fBtable\fR +string +.TQ 3.00in +\fBauthorization\fR +set of strings +.TQ 3.00in +\fBinsert_delete\fR +boolean +.TQ 3.00in +\fBupdate\fR +set of strings +.SS "Details: +.IP "\fBtable\fR: string" +Name of table to which this row applies\[char46] +.IP "\fBauthorization\fR: set of strings" +Set of strings identifying columns and column:key pairs to be compared with client ID\[char46] At least one match is required in order to be authorized\[char46] A zero-length string is treated as a special value indicating all clients should be considered authorized\[char46] +.IP "\fBinsert_delete\fR: boolean" +When \(dqtrue\(dq, row insertions and authorized row deletions are permitted\[char46] +.IP "\fBupdate\fR: set of strings" +Set of strings identifying columns and column:key pairs that authorized clients are allowed to modify\[char46] +.bp +.SH "Gateway_Chassis TABLE" +.PP +.PP +.PP +Association of \fBPort_Binding\fR rows of \fBtype\fR \fBchassisredirect\fR to a \fBChassis\fR\[char46] The traffic going out through a specific \fBchassisredirect\fR port will be redirected to a chassis, or a set of them in high availability configurations\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ 3.00in +\fBoptions\fR +map of string-string pairs +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Name of the \fBGateway_Chassis\fR\[char46] +.IP +A suggested, but not required naming convention is \fB${port_name}_${chassis_name}\fR\[char46] +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +The \fBChassis\fR to which we send the traffic\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +This is the priority the specific \fBChassis\fR among all Gateway_Chassis belonging to the same \fBPort_Binding\fR\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Reserved for future use\[char46] +.ST "Common Columns:" +.PP +The overall purpose of these columns is described under \fBCommon +Columns\fR at the beginning of this document\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +.bp +.SH "HA_Chassis TABLE" +.PP +.SS "Summary: +.TQ 3.00in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 3.00in +\fBpriority\fR +integer, in range 0 to 32,767 +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +The \fBChassis\fR which provides the HA functionality\[char46] +.IP "\fBpriority\fR: integer, in range 0 to 32,767" +Priority of the HA chassis\[char46] Chassis with highest priority will be the master in the HA chassis group\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "HA_Chassis_Group TABLE" +.PP +.PP +.PP +Table representing a group of chassis which can provide High availability services\[char46] Each chassis in the group is represented by the table \fBHA_Chassis\fR\[char46] The HA chassis with highest priority will be the master of this group\[char46] If the master chassis failover is detected, the HA chassis with the next higher priority takes over the responsibility of providing the HA\[char46] If \fBha_chassis_group\fR column of the table \fBPort_Binding\fR references this table, then this HA chassis group provides the gateway functionality and redirects the gateway traffic to the master of this group\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string (must be unique within table) +.TQ 3.00in +\fBha_chassis\fR +set of \fBHA_Chassis\fRes +.TQ 3.00in +\fBref_chassis\fR +set of weak reference to \fBChassis\fR +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string (must be unique within table)" +Name of the \fBHA_Chassis_Group\fR\[char46] Name should be unique\[char46] +.IP "\fBha_chassis\fR: set of \fBHA_Chassis\fRes" +A list of \fBHA_Chassis\fR which belongs to this group\[char46] +.IP "\fBref_chassis\fR: set of weak reference to \fBChassis\fR" +The set of \fBChassis\fR that reference this HA chassis group\[char46] To determine the correct \fBChassis\fR, find the \fBchassisredirect\fR type \fBPort_Binding\fR that references this \fBHA_Chassis_Group\fR\[char46] This \fBPort_Binding\fR is derived from some particular logical router\[char46] Starting from that LR, find the set of all logical switches and routers connected to it, directly or indirectly, across router ports that link one LRP to another or to a LSP\[char46] For each LSP in these logical switches, find the corresponding \fBPort_Binding\fR and add its bound \fBChassis\fR (if any) to \fBref_chassis\fR\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Controller_Event TABLE" +.PP +.PP +.PP +Database table used by \fBovn\-controller\fR to report CMS related events\[char46] Please note there is no guarantee a given event is written exactly once in the db\[char46] It is CMS responsibility to squash duplicated lines or to filter out duplicated events +.SS "Summary: +.TQ 3.00in +\fBevent_type\fR +string, must be \fBempty_lb_backends\fR +.TQ 3.00in +\fBevent_info\fR +map of string-string pairs +.TQ 3.00in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 3.00in +\fBseq_num\fR +integer +.SS "Details: +.IP "\fBevent_type\fR: string, must be \fBempty_lb_backends\fR" +Event type occurred +.IP "\fBevent_info\fR: map of string-string pairs" +Key-value pairs used to specify event info to the CMS\[char46] Possible values are: +.RS +.IP \(bu +\fBvip\fR: VIP reported for the \fBempty_lb_backends\fR event +.IP \(bu +\fBprotocol\fR: Transport protocol reported for the \fBempty_lb_backends\fR event +.IP \(bu +\fBload_balancer\fR: UUID of the load balancer reported for the \fBempty_lb_backends\fR event +.RE +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +This column is a \fBChassis\fR record to identify the chassis that has managed a given event\[char46] +.IP "\fBseq_num\fR: integer" +Event sequence number\[char46] Global counter for controller generated events\[char46] It can be used by the CMS to detect possible duplication of the same event\[char46] +.bp +.SH "IP_Multicast TABLE" +.PP +.PP +.PP +IP Multicast configuration options\[char46] For now only applicable to IGMP\[char46] +.SS "Summary: +.TQ 3.00in +\fBdatapath\fR +weak reference to \fBDatapath_Binding\fR (must be unique within table) +.TQ 3.00in +\fBenabled\fR +optional boolean +.TQ 3.00in +\fBquerier\fR +optional boolean +.TQ 3.00in +\fBtable_size\fR +optional integer +.TQ 3.00in +\fBidle_timeout\fR +optional integer +.TQ 3.00in +\fBquery_interval\fR +optional integer +.TQ 3.00in +\fBseq_no\fR +integer +.TQ .25in +\fIQuerier configuration options:\fR +.RS .25in +.TQ 2.75in +\fBeth_src\fR +string +.TQ 2.75in +\fBip4_src\fR +string +.TQ 2.75in +\fBip6_src\fR +string +.TQ 2.75in +\fBquery_max_resp\fR +optional integer +.RE +.SS "Details: +.IP "\fBdatapath\fR: weak reference to \fBDatapath_Binding\fR (must be unique within table)" +\fBDatapath_Binding\fR entry for which these configuration options are defined\[char46] +.IP "\fBenabled\fR: optional boolean" +Enables/disables multicast snooping\[char46] Default: disabled\[char46] +.IP "\fBquerier\fR: optional boolean" +Enables/disables multicast querying\[char46] If \fBenabled\fR then multicast querying is enabled by default\[char46] +.IP "\fBtable_size\fR: optional integer" +Limits the number of multicast groups that can be learned\[char46] Default: 2048 groups per datapath\[char46] +.IP "\fBidle_timeout\fR: optional integer" +Configures the idle timeout (in seconds) for IP multicast groups if multicast snooping is enabled\[char46] Default: 300 seconds\[char46] +.IP "\fBquery_interval\fR: optional integer" +Configures the interval (in seconds) for sending multicast queries if snooping and querier are enabled\[char46] Default: \fBidle_timeout\fR/2 seconds\[char46] +.IP "\fBseq_no\fR: integer" +\fBovn\-controller\fR reads this value and flushes all learned multicast groups when it detects that \fBseq_no\fR was changed\[char46] +.ST "Querier configuration options:" +.PP +The \fBovn\-controller\fR process that runs on OVN hypervisor nodes uses the following columns to determine field values in IGMP/MLD queries that it originates: +.IP "\fBeth_src\fR: string" +Source Ethernet address\[char46] +.IP "\fBip4_src\fR: string" +Source IPv4 address\[char46] +.IP "\fBip6_src\fR: string" +Source IPv6 address\[char46] +.IP "\fBquery_max_resp\fR: optional integer" +Value (in seconds) to be used as \(dqmax-response\(dq field in multicast queries\[char46] Default: 1 second\[char46] +.bp +.SH "IGMP_Group TABLE" +.PP +.PP +.PP +Contains learned IGMP groups indexed by address/datapath/chassis\[char46] +.SS "Summary: +.TQ 3.00in +\fBaddress\fR +string +.TQ 3.00in +\fBdatapath\fR +optional weak reference to \fBDatapath_Binding\fR +.TQ 3.00in +\fBchassis\fR +optional weak reference to \fBChassis\fR +.TQ 3.00in +\fBports\fR +set of weak reference to \fBPort_Binding\fRs +.SS "Details: +.IP "\fBaddress\fR: string" +Destination IPv4 address for the IGMP group\[char46] +.IP "\fBdatapath\fR: optional weak reference to \fBDatapath_Binding\fR" +Datapath to which this IGMP group belongs\[char46] +.IP "\fBchassis\fR: optional weak reference to \fBChassis\fR" +Chassis to which this IGMP group belongs\[char46] +.IP "\fBports\fR: set of weak reference to \fBPort_Binding\fRs" +The destination port bindings for this IGMP group\[char46] +.bp +.SH "Service_Monitor TABLE" +.PP +.PP +.PP +Each row in this table configures monitoring a service for its liveness\[char46] The service can be an IPv4 TCP or UDP service\[char46] \fBovn\-controller\fR periodically sends out service monitor packets and updates the status of the service\[char46] Service monitoring for IPv6 services is not supported\[char46] +.PP +.PP +\fBovn\-northd\fR uses this feature to implement the load balancer health check feature offered to the CMS through the northbound database\[char46] +.SS "Summary: +.TQ .25in +\fIConfiguration:\fR +.RS .25in +.TQ 2.75in +\fBip\fR +string +.TQ 2.75in +\fBprotocol\fR +optional string, either \fBtcp\fR or \fBudp\fR +.TQ 2.75in +\fBport\fR +integer, in range 0 to 65,535 +.TQ 2.75in +\fBlogical_port\fR +string +.TQ 2.75in +\fBsrc_mac\fR +string +.TQ 2.75in +\fBsrc_ip\fR +string +.TQ 2.75in +\fBoptions : interval\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : timeout\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : success_count\fR +optional string, containing an integer +.TQ 2.75in +\fBoptions : failure_count\fR +optional string, containing an integer +.RE +.TQ .25in +\fIStatus Reporting:\fR +.RS .25in +.TQ 2.75in +\fBstatus\fR +optional string, one of \fBerror\fR, \fBoffline\fR, or \fBonline\fR +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.ST "Configuration:" +.PP +.PP +.PP +\fBovn\-northd\fR sets these columns and values to configure the service monitor\[char46] +.IP "\fBip\fR: string" +IP of the service to be monitored\[char46] Only IPv4 is supported\[char46] +.IP "\fBprotocol\fR: optional string, either \fBtcp\fR or \fBudp\fR" +The protocol of the service\[char46] +.IP "\fBport\fR: integer, in range 0 to 65,535" +The TCP or UDP port of the service\[char46] +.IP "\fBlogical_port\fR: string" +The VIF of the logical port on which the service is running\[char46] The \fBovn\-controller\fR that binds this \fBlogical_port\fR monitors the service by sending periodic monitor packets\[char46] +.IP "\fBsrc_mac\fR: string" +Source Ethernet address to use in the service monitor packet\[char46] +.IP "\fBsrc_ip\fR: string" +Source IPv4 address to use in the service monitor packet\[char46] +.IP "\fBoptions : interval\fR: optional string, containing an integer" +The interval, in seconds, between service monitor checks\[char46] +.IP "\fBoptions : timeout\fR: optional string, containing an integer" +The time, in seconds, after which the service monitor check times out\[char46] +.IP "\fBoptions : success_count\fR: optional string, containing an integer" +The number of successful checks after which the service is considered \fBonline\fR\[char46] +.IP "\fBoptions : failure_count\fR: optional string, containing an integer" +The number of failure checks after which the service is considered \fBoffline\fR\[char46] +.ST "Status Reporting:" +.PP +.PP +.PP +The \fBovn\-controller\fR on the chassis that hosts the \fBlogical_port\fR updates this column to report the service\(cqs status\[char46] +.IP "\fBstatus\fR: optional string, one of \fBerror\fR, \fBoffline\fR, or \fBonline\fR" +For TCP service, \fBovn\-controller\fR sends a SYN to the service and expects an ACK response to consider the service to be \fBonline\fR\[char46] +.IP +For UDP service, \fBovn\-controller\fR sends a UDP packet to the service and doesn\(cqt expect any reply\[char46] If it receives an ICMP reply, then it considers the service to be \fBoffline\fR\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "Load_Balancer TABLE" +.PP +.PP +.PP +Each row represents a load balancer\[char46] +.SS "Summary: +.TQ 3.00in +\fBname\fR +string +.TQ 3.00in +\fBvips\fR +map of string-string pairs +.TQ 3.00in +\fBprotocol\fR +optional string, one of \fBsctp\fR, \fBtcp\fR, or \fBudp\fR +.TQ 3.00in +\fBdatapaths\fR +set of \fBDatapath_Binding\fRs +.TQ 3.00in +\fBdatapath_group\fR +optional \fBLogical_DP_Group\fR +.TQ .25in +\fILoad_Balancer options:\fR +.RS .25in +.TQ 2.75in +\fBoptions : hairpin_snat_ip\fR +optional string +.TQ 2.75in +\fBoptions : hairpin_orig_tuple\fR +optional string, either \fBtrue\fR or \fBfalse\fR +.RE +.TQ .25in +\fICommon Columns:\fR +.RS .25in +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.SS "Details: +.IP "\fBname\fR: string" +A name for the load balancer\[char46] This name has no special meaning or purpose other than to provide convenience for human interaction with the ovn-nb database\[char46] +.IP "\fBvips\fR: map of string-string pairs" +A map of virtual IP addresses (and an optional port number with \fB:\fR as a separator) associated with this load balancer and their corresponding endpoint IP addresses (and optional port numbers with \fB:\fR as separators) separated by commas\[char46] +.IP "\fBprotocol\fR: optional string, one of \fBsctp\fR, \fBtcp\fR, or \fBudp\fR" +Valid protocols are \fBtcp\fR, \fBudp\fR, or \fBsctp\fR\[char46] This column is useful when a port number is provided as part of the \fBvips\fR column\[char46] If this column is empty and a port number is provided as part of \fBvips\fR column, OVN assumes the protocol to be \fBtcp\fR\[char46] +.IP "\fBdatapaths\fR: set of \fBDatapath_Binding\fRs" +Datapaths to which this load balancer applies to\[char46] +.IP "\fBdatapath_group\fR: optional \fBLogical_DP_Group\fR" +The group of datapaths to which this load balancer applies to\[char46] This means that the same load balancer applies to all datapaths in a group\[char46] +.ST "Load_Balancer options:" +.PP +.IP "\fBoptions : hairpin_snat_ip\fR: optional string" +IP to be used as source IP for packets that have been hair-pinned after load balancing\[char46] This value is automatically populated by \fBovn\-northd\fR\[char46] +.IP "\fBoptions : hairpin_orig_tuple\fR: optional string, either \fBtrue\fR or \fBfalse\fR" +This value is automatically set to \fBtrue\fR by \fBovn\-northd\fR when original destination IP and transport port of the load balanced packets are stored in registers \fBreg1, reg2, xxreg1\fR\[char46] +.ST "Common Columns:" +.PP +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.bp +.SH "BFD TABLE" +.PP +.PP +.PP +Contains BFD parameter for ovn-controller bfd configuration\[char46] +.SS "Summary: +.TQ .25in +\fIConfiguration:\fR +.RS .25in +.TQ 2.75in +\fBsrc_port\fR +integer, in range 49,152 to 65,535 +.TQ 2.75in +\fBdisc\fR +integer +.TQ 2.75in +\fBlogical_port\fR +string +.TQ 2.75in +\fBdst_ip\fR +string +.TQ 2.75in +\fBmin_tx\fR +integer +.TQ 2.75in +\fBmin_rx\fR +integer +.TQ 2.75in +\fBdetect_mult\fR +integer +.TQ 2.75in +\fBoptions\fR +map of string-string pairs +.TQ 2.75in +\fBexternal_ids\fR +map of string-string pairs +.RE +.TQ .25in +\fIStatus Reporting:\fR +.RS .25in +.TQ 2.75in +\fBstatus\fR +string, one of \fBadmin_down\fR, \fBdown\fR, \fBinit\fR, or \fBup\fR +.RE +.SS "Details: +.ST "Configuration:" +.PP +.IP "\fBsrc_port\fR: integer, in range 49,152 to 65,535" +udp source port used in bfd control packets\[char46] The source port MUST be in the range 49152 through 65535 (RFC5881 section 4)\[char46] +.IP "\fBdisc\fR: integer" +A unique, nonzero discriminator value generated by the transmitting system, used to demultiplex multiple BFD sessions between the same pair of systems\[char46] +.IP "\fBlogical_port\fR: string" +OVN logical port when BFD engine is running\[char46] +.IP "\fBdst_ip\fR: string" +BFD peer IP address\[char46] +.IP "\fBmin_tx\fR: integer" +This is the minimum interval, in milliseconds, that the local system would like to use when transmitting BFD Control packets, less any jitter applied\[char46] The value zero is reserved\[char46] +.IP "\fBmin_rx\fR: integer" +This is the minimum interval, in milliseconds, between received BFD Control packets that this system is capable of supporting, less any jitter applied by the sender\[char46] If this value is zero, the transmitting system does not want the remote system to send any periodic BFD Control packets\[char46] +.IP "\fBdetect_mult\fR: integer" +Detection time multiplier\[char46] The negotiated transmit interval, multiplied by this value, provides the Detection Time for the receiving system in Asynchronous mode\[char46] +.IP "\fBoptions\fR: map of string-string pairs" +Reserved for future use\[char46] +.IP "\fBexternal_ids\fR: map of string-string pairs" +See \fBExternal IDs\fR at the beginning of this document\[char46] +.ST "Status Reporting:" +.PP +.IP "\fBstatus\fR: string, one of \fBadmin_down\fR, \fBdown\fR, \fBinit\fR, or \fBup\fR" +BFD port logical states\[char46] Possible values are: +.RS +.IP \(bu +\fBadmin_down\fR +.IP \(bu +\fBdown\fR +.IP \(bu +\fBinit\fR +.IP \(bu +\fBup\fR +.RE +.bp +.SH "FDB TABLE" +.PP +.PP +.PP +This table is primarily used to learn the MACs observed on a VIF (or a localnet port with \(cqlocalnet_learn_fdb\(cq enabled) which belongs to a \fBLogical_Switch_Port\fR record in \fBOVN_Northbound\fR whose port security is disabled and \(cqunknown\(cq address set\[char46] If port security is disabled on a \fBLogical_Switch_Port\fR record, OVN should allow traffic with any source mac from the VIF\[char46] This table will be used to deliver a packet to the VIF, If a packet\(cqs \fBeth\[char46]dst\fR is learnt\[char46] +.SS "Summary: +.TQ 3.00in +\fBmac\fR +string +.TQ 3.00in +\fBdp_key\fR +integer, in range 1 to 16,777,215 +.TQ 3.00in +\fBport_key\fR +integer, in range 1 to 16,777,215 +.SS "Details: +.IP "\fBmac\fR: string" +The learnt mac address\[char46] +.IP "\fBdp_key\fR: integer, in range 1 to 16,777,215" +The key of the datapath on which this FDB was learnt\[char46] +.IP "\fBport_key\fR: integer, in range 1 to 16,777,215" +The key of the port binding on which this FDB was learnt\[char46] +.bp +.SH "Static_MAC_Binding TABLE" +.PP +.PP +.PP +Each record represents a Static_MAC_Binding entry for a logical router\[char46] +.SS "Summary: +.TQ 3.00in +\fBlogical_port\fR +string +.TQ 3.00in +\fBip\fR +string +.TQ 3.00in +\fBmac\fR +string +.TQ 3.00in +\fBoverride_dynamic_mac\fR +boolean +.TQ 3.00in +\fBdatapath\fR +\fBDatapath_Binding\fR +.SS "Details: +.IP "\fBlogical_port\fR: string" +The logical router port for the binding\[char46] +.IP "\fBip\fR: string" +The bound IP address\[char46] +.IP "\fBmac\fR: string" +The Ethernet address to which the IP is bound\[char46] +.IP "\fBoverride_dynamic_mac\fR: boolean" +Override dynamically learnt MACs\[char46] +.IP "\fBdatapath\fR: \fBDatapath_Binding\fR" +The logical datapath to which the logical router port belongs\[char46] +.bp +.SH "Chassis_Template_Var TABLE" +.PP +.PP +.PP +Each record represents the set of template variable instantiations for a given chassis and is populated by \fBovn\-northd\fR from the contents of the \fBOVN_Northbound\[char46]Chassis_Template_Var\fR table\[char46] +.SS "Summary: +.TQ 3.00in +\fBchassis\fR +string (must be unique within table) +.TQ 3.00in +\fBvariables\fR +map of string-string pairs +.SS "Details: +.IP "\fBchassis\fR: string (must be unique within table)" +The chassis this set of variable values applies to\[char46] +.IP "\fBvariables\fR: map of string-string pairs" +The set of variable values for a given chassis\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sb.5.html b/src/static/support/dist-docs-branch-23.06/ovn-sb.5.html new file mode 100644 index 00000000..2cd471b8 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-sb.5.html @@ -0,0 +1,3974 @@ +
+ovn-sb(5)                     Open vSwitch Manual                    ovn-sb(5)
+
+NAME
+       ovn-sb - OVN_Southbound database schema
+
+       This  database  holds  logical and physical configuration and state for
+       the Open Virtual Network (OVN) system to support  virtual  network  abā€
+       straction. For an introduction to OVN, please see ovn-architecture(7).
+
+       The OVN Southbound database sits at the center of the OVN architecture.
+       It is the one component that speaks both southbound directly to all the
+       hypervisors  and  gateways, via ovn-controller/ovn-controller-vtep, and
+       northbound to the Cloud Management System, via ovn-northd:
+
+   Database Structure
+       The OVN Southbound database contains classes  of  data  with  different
+       properties, as described in the sections below.
+
+     Physical network
+
+       Physical  network tables contain information about the chassis nodes in
+       the system. This contains all the information  necessary  to  wire  the
+       overlay,  such  as  IP  addresses, supported tunnel types, and security
+       keys.
+
+       The amount of physical network data is small (O(n)  in  the  number  of
+       chassis)  and it changes infrequently, so it can be replicated to every
+       chassis.
+
+       The Chassis and Encap tables are the physical network tables.
+
+     Logical Network
+
+       Logical network tables contain the topology  of  logical  switches  and
+       routers,  ACLs,  firewall  rules, and everything needed to describe how
+       packets traverse a logical network,  represented  as  logical  datapath
+       flows (see Logical Datapath Flows, below).
+
+       Logical network data may be large (O(n) in the number of logical ports,
+       ACL rules, etc.). Thus, to improve scaling, each chassis should receive
+       only  data  related  to logical networks in which that chassis particiā€
+       pates.
+
+       The logical network data is ultimately controlled by the cloud  manageā€
+       ment  system  (CMS)  running northbound of OVN. That CMS determines the
+       entire OVN logical configuration and therefore the logical network data
+       at any given time is a deterministic function of the  CMSā€™s  configuraā€
+       tion,  although that happens indirectly via the OVN_Northbound database
+       and ovn-northd.
+
+       Logical network data is likely to change  more  quickly  than  physical
+       network  data. This is especially true in a container environment where
+       containers are created  and  destroyed  (and  therefore  added  to  and
+       deleted from logical switches) quickly.
+
+       The   Logical_Flow,   Multicast_Group,   Address_Group,   DHCP_Options,
+       DHCPv6_Options, and DNS tables contain logical network data.
+
+     Logical-physical bindings
+
+       These tables link logical and physical components. They show  the  curā€
+       rent  placement of logical components (such as VMs and VIFs) onto chasā€
+       sis, and map logical entities to the values that represent them in tunā€
+       nel encapsulations.
+
+       These tables change frequently, at least every time a VM powers  up  or
+       down  or  migrates,  and especially quickly in a container environment.
+       The amount of data per VM (or VIF) is small.
+
+       Each chassis is authoritative about the VMs and VIFs that it  hosts  at
+       any  given time and can efficiently flood that state to a central locaā€
+       tion, so the consistency needs are minimal.
+
+       The Port_Binding and Datapath_Binding tables contain binding data.
+
+     MAC bindings
+
+       The MAC_Binding table tracks the bindings from IP addresses to Ethernet
+       addresses that are dynamically discovered  using  ARP  (for  IPv4)  and
+       neighbor  discovery (for IPv6). Usually, IP-to-MAC bindings for virtual
+       machines are statically  populated  into  the  Port_Binding  table,  so
+       MAC_Binding  is  primarily  used  to discover bindings on physical netā€
+       works.
+
+   Common Columns
+       Some tables contain a special column named  external_ids.  This  column
+       has  the  same  form  and purpose each place that it appears, so we deā€
+       scribe it here to save space later.
+
+              external_ids: map of string-string pairs
+                     Key-value pairs for use by the software that manages  the
+                     OVN   Southbound   database   rather   than  by  ovn-conā€ā€
+                     troller/ovn-controller-vtep.  In  particular,  ovn-northd
+                     can use key-value pairs in this column to relate entities
+                     in the southbound database to higher-level entities (such
+                     as  entities  in the OVN Northbound database). Individual
+                     key-value pairs in this column may be documented in  some
+                     cases  to  aid  in understanding and troubleshooting, but
+                     the reader should not mistake such documentation as  comā€
+                     prehensive.
+
+TABLE SUMMARY
+       The  following list summarizes the purpose of each of the tables in the
+       OVN_Southbound database.  Each table is described in more detail  on  a
+       later page.
+
+       Table     Purpose
+       SB_Global Southbound configuration
+       Chassis   Physical Network Hypervisor and Gateway Information
+       Chassis_Private
+                 Chassis Private
+       Encap     Encapsulation Types
+       Address_Set
+                 Address Sets
+       Port_Group
+                 Port Groups
+       Logical_Flow
+                 Logical Network Flows
+       Logical_DP_Group
+                 Logical Datapath Groups
+       Multicast_Group
+                 Logical Port Multicast Groups
+       Mirror    Mirror Entry
+       Meter     Meter entry
+       Meter_Band
+                 Band for meter entries
+       Datapath_Binding
+                 Physical-Logical Datapath Bindings
+       Port_Binding
+                 Physical-Logical Port Bindings
+       MAC_Binding
+                 IP to MAC bindings
+       DHCP_Options
+                 DHCP Options supported by native OVN DHCP
+       DHCPv6_Options
+                 DHCPv6 Options supported by native OVN DHCPv6
+       Connection
+                 OVSDB client connections.
+       SSL       SSL configuration.
+       DNS       Native DNS resolution
+       RBAC_Role RBAC_Role configuration.
+       RBAC_Permission
+                 RBAC_Permission configuration.
+       Gateway_Chassis
+                 Gateway_Chassis configuration.
+       HA_Chassis
+                 HA_Chassis configuration.
+       HA_Chassis_Group
+                 HA_Chassis_Group configuration.
+       Controller_Event
+                 Controller Event table
+       IP_Multicast
+                 IP_Multicast configuration.
+       IGMP_Group
+                 IGMP_Group configuration.
+       Service_Monitor
+                 Service_Monitor configuration.
+       Load_Balancer
+                 Load_Balancer configuration.
+       BFD       BFD configuration.
+       FDB       Port to MAC bindings
+       Static_MAC_Binding
+                 IP to MAC bindings
+       Chassis_Template_Var
+                 Chassis_Template_Var configuration.
+
+SB_Global TABLE
+       Southbound  configuration  for  an OVN system. This table must have exā€
+       actly one row.
+
+   Summary:
+       Status:
+         nb_cfg                      integer
+       Common Columns:
+         external_ids                map of string-string pairs
+         options                     map of string-string pairs
+       Common options:
+         options                     map of string-string pairs
+         Options for configuring BFD:
+            options : bfd-min-rx     optional string
+            options : bfd-decay-min-rx
+                                     optional string
+            options : bfd-min-tx     optional string
+            options : bfd-mult       optional string
+            options : debug_drop_domain_id
+                                     optional string
+            options : debug_drop_collector_set
+                                     optional string
+         Options for configuring Load Balancers:
+            options : lb_hairpin_use_ct_mark
+                                     optional string
+         Options for configuring ovn-sbctl:
+            options : sbctl_probe_interval
+                                     optional string
+       Connection Options:
+         connections                 set of Connections
+         ssl                         optional SSL
+       Security Configurations:
+         ipsec                       boolean
+
+   Details:
+     Status:
+
+       This column allow a client to track the overall configuration state  of
+       the system.
+
+       nb_cfg: integer
+              Sequence  number  for the configuration. When a CMS or ovn-nbctl
+              updates the northbound database, it increments the nb_cfg column
+              in the NB_Global table in the northbound database. In turn, when
+              ovn-northd updates the southbound database to  bring  it  up  to
+              date  with  these  changes,  it  updates this column to the same
+              value.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+       options: map of string-string pairs
+
+     Common options:
+
+       options: map of string-string pairs
+              This column provides general key/value settings.  The  supported
+              options are described individually below.
+
+     Options for configuring BFD:
+
+       These  options  apply when ovn-controller configures BFD on tunnels inā€
+       terfaces.
+
+       options : bfd-min-rx: optional string
+              BFD option min-rx value to use when configuring  BFD  on  tunnel
+              interfaces.
+
+       options : bfd-decay-min-rx: optional string
+              BFD  option  decay-min-rx  value  to use when configuring BFD on
+              tunnel interfaces.
+
+       options : bfd-min-tx: optional string
+              BFD option min-tx value to use when configuring  BFD  on  tunnel
+              interfaces.
+
+       options : bfd-mult: optional string
+              BFD  option mult value to use when configuring BFD on tunnel inā€
+              terfaces.
+
+       options : debug_drop_domain_id: optional string
+              If set to a 8-bit number and if debug_drop_collector_set is also
+              configured, ovn-controller will add a  sample  action  to  every
+              flow  that  does  not  come  from a logical flow that contains a
+              ā€™dropā€™ action. The 8  most  significant  bits  of  the  observaā€
+              tion_domain_id  field  will  be  those  specified  in  the   deā€ā€
+              bug_drop_domain_id. The 24 least significant bits of the  obserā€
+              vation_domain_id field will be zero.
+
+              The  observation_point_id will be set to the OpenFlow table numā€
+              ber.
+
+       options : debug_drop_collector_set: optional string
+              If set to a 32-bit number ovn-controller will add a  sample  acā€
+              tion  to  every flow that does not come from a logical flow that
+              contains a ā€™dropā€™ action. The sample action will have the speciā€
+              fied collector_set_id. The value must match that  of  the  local
+              OVS configuration as described in ovs-actions(7).
+
+     Options for configuring Load Balancers:
+
+       These  options  apply  when ovn-controller configures load balancer reā€
+       lated flows.
+
+       options : lb_hairpin_use_ct_mark: optional string
+              By default this option is turned on (even if not present in  the
+              database)  unless  its  value  is  explicitly set to false. This
+              value is automatically set to false by  ovn-northd  when  action
+              ct_lb_mark cannot be used for new load balancer sessions and acā€
+              tion  ct_lb will be used instead. ovn-controller then knows that
+              it should check ct_label.natted to detect load balanced traffic.
+
+     Options for configuring ovn-sbctl:
+
+       These options apply when ovn-sbctl connects to OVN Southbound database.
+
+       options : sbctl_probe_interval: optional string
+              The inactivity probe interval  of  the  connection  to  the  OVN
+              Southbound  database from ovn-sbctl utility, in milliseconds. If
+              the value is zero, it disables the connection keepalive feature.
+
+              If the value is nonzero, then it will be forced to a value of at
+              least 1000 ms.
+
+              If the value is less than  zero,  then  the  default  inactivity
+              probe interval for ovn-sbctl would be left intact (120000 ms).
+
+     Connection Options:
+
+       connections: set of Connections
+              Database  clients  to  which  the  Open  vSwitch database server
+              should connect or on which it should listen, along with  options
+              for  how these connections should be configured. See the Connecā€ā€
+              tion table for more information.
+
+       ssl: optional SSL
+              Global SSL configuration.
+
+     Security Configurations:
+
+       ipsec: boolean
+              Tunnel encryption configuration. If this column  is  set  to  be
+              true, all OVN tunnels will be encrypted with IPsec.
+
+Chassis TABLE
+       Each  row  in this table represents a hypervisor or gateway (a chassis)
+       in the physical  network.  Each  chassis,  via  ovn-controller/ovn-conā€ā€
+       troller-vtep, adds and updates its own row, and keeps a copy of the reā€
+       maining rows to determine how to reach other hypervisors.
+
+       When  a  chassis  shuts  down gracefully, it should remove its own row.
+       (This is not critical because  resources  hosted  on  the  chassis  are
+       equally  unreachable  regardless  of  whether the row is present.) If a
+       chassis shuts down permanently without removing its row, some  kind  of
+       manual  or  automatic  cleanup  is  eventually  needed; we can devise a
+       process for that as necessary.
+
+   Summary:
+       name                          string (must be unique within table)
+       hostname                      string
+       nb_cfg                        integer
+       other_config : ovn-bridge-mappings
+                                     optional string
+       other_config : datapath-type  optional string
+       other_config : iface-types    optional string
+       other_config : ovn-cms-options
+                                     optional string
+       other_config : is-interconn   optional string
+       other_config : is-remote      optional string
+       transport_zones               set of strings
+       other_config : ovn-chassis-mac-mappings
+                                     optional string
+       other_config : port-up-notif  optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+       Encapsulation Configuration:
+         encaps                      set of 1 or more Encaps
+       Gateway Configuration:
+         vtep_logical_switches       set of strings
+
+   Details:
+       name: string (must be unique within table)
+              OVN does not prescribe a particular format  for  chassis  names.
+              ovn-controller  populates this column using external_ids:system-
+              id in the Open_vSwitch databaseā€™s Open_vSwitch  table.  ovn-conā€
+              troller-vtep  populates  this  column  with  name  in  the hardā€
+              ware_vtep databaseā€™s Physical_Switch table.
+
+       hostname: string
+              The hostname of the chassis, if applicable. ovn-controller  will
+              populate this column with the hostname of the host it is running
+              on. ovn-controller-vtep will leave this column empty.
+
+       nb_cfg: integer
+              Deprecated.  This column is replaced by the nb_cfg column of the
+              Chassis_Private table.
+
+       other_config : ovn-bridge-mappings: optional string
+              ovn-controller populates this key with the set  of  bridge  mapā€
+              pings  it  has been configured to use. Other applications should
+              treat this key as read-only. See ovn-controller(8) for more  inā€
+              formation.
+
+       other_config : datapath-type: optional string
+              ovn-controller populates this key with the datapath type configā€
+              ured  in the datapath_type column of the Open_vSwitch databaseā€™s
+              Bridge table. Other applications should treat this key as  read-
+              only. See ovn-controller(8) for more information.
+
+       other_config : iface-types: optional string
+              ovn-controller  populates this key with the interface types conā€
+              figured in the iface_types column of the Open_vSwitch databaseā€™s
+              Open_vSwitch table. Other applications should treat this key  as
+              read-only. See ovn-controller(8) for more information.
+
+       other_config : ovn-cms-options: optional string
+              ovn-controller  populates  this key with the set of options conā€
+              figured  in  the  external_ids:ovn-cms-options  column  of   the
+              Open_vSwitch   databaseā€™s   Open_vSwitch   table.  See  ovn-conā€ā€
+              troller(8) for more information.
+
+       other_config : is-interconn: optional string
+              ovn-controller populates this key with the setting configured in
+              the external_ids:ovn-is-interconn  column  of  the  Open_vSwitch
+              databaseā€™s  Open_vSwitch  table.  If set to true, the chassis is
+              used as an interconnection gateway.  See  ovn-controller(8)  for
+              more information.
+
+       other_config : is-remote: optional string
+              ovn-ic  set  this key to true for remote interconnection gateway
+              chassises learned from the interconnection southbound  database.
+              See ovn-ic(8) for more information.
+
+       transport_zones: set of strings
+              ovn-controller  populates this key with the transport zones conā€
+              figured in the external_ids:ovn-transport-zones  column  of  the
+              Open_vSwitch   databaseā€™s   Open_vSwitch   table.  See  ovn-conā€ā€
+              troller(8) for more information.
+
+       other_config : ovn-chassis-mac-mappings: optional string
+              ovn-controller populates this key with the set of  options  conā€
+              figured  in  the external_ids:ovn-chassis-mac-mappings column of
+              the Open_vSwitch databaseā€™s  Open_vSwitch  table.  See  ovn-conā€ā€
+              troller(8) for more information.
+
+       other_config : port-up-notif: optional string
+              ovn-controller  populates  this  key  with true when it supports
+              Port_Binding.up.
+
+     Common Columns:
+
+       The overall purpose of these columns is described under Common  Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+     Encapsulation Configuration:
+
+       OVN  uses  encapsulation  to transmit logical dataplane packets between
+       chassis.
+
+       encaps: set of 1 or more Encaps
+              Points to supported  encapsulation  configurations  to  transmit
+              logical dataplane packets to this chassis. Each entry is a Encap
+              record that describes the configuration.
+
+     Gateway Configuration:
+
+       A  gateway  is  a chassis that forwards traffic between the OVN-managed
+       part of a logical network and a physical VLAN, extending a tunnel-based
+       logical network into a physical network. Gateways are  typically  dediā€
+       cated  nodes  that  do  not host VMs and will be controlled by ovn-conā€ā€
+       troller-vtep.
+
+       vtep_logical_switches: set of strings
+              Stores all VTEP logical switch names connected by  this  gateway
+              chassis.  The  Port_Binding table entry with options:vtep-physiā€ā€
+              cal-switch equal Chassis name,  and  options:vtep-logical-switch
+              value  in Chassis vtep_logical_switches, will be associated with
+              this Chassis.
+
+Chassis_Private TABLE
+       Each row in this table maintains per chassis private data that are  acā€
+       cessed  only  by the owning chassis (write only) and ovn-northd, not by
+       any other chassis. These data are stored in this separate table instead
+       of the Chassis table for performance considerations: the rows  in  this
+       table  can be conditionally monitored by chassises so that each chassis
+       only get update notifications for its own  row,  to  avoid  unnecessary
+       chassis private data update flooding in a large scale deployment.
+
+   Summary:
+       name                          string (must be unique within table)
+       chassis                       optional weak reference to Chassis
+       nb_cfg                        integer
+       nb_cfg_timestamp              integer
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              The name of the chassis that owns these chassis-private data.
+
+       chassis: optional weak reference to Chassis
+              The  reference  to Chassis table for the chassis that owns these
+              chassis-private data.
+
+       nb_cfg: integer
+              Sequence number for the configuration. When  ovn-controller  upā€
+              dates  the  configuration  of a chassis from the contents of the
+              southbound database, it copies nb_cfg from the  SB_Global  table
+              into this column.
+
+       nb_cfg_timestamp: integer
+              The timestamp when ovn-controller finishes processing the change
+              corresponding to nb_cfg.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Encap TABLE
+       The encaps column in the Chassis table refers to rows in this table  to
+       identify  how  OVN may transmit logical dataplane packets to this chasā€
+       sis. Each chassis,  via  ovn-controller(8)  or  ovn-controller-vtep(8),
+       adds and updates its own rows and keeps a copy of the remaining rows to
+       determine how to reach other chassis.
+
+   Summary:
+       type                          string, one of geneve, stt, or vxlan
+       options                       map of string-string pairs
+       options : csum                optional string, either true or false
+       options : dst_port            optional string, containing an integer
+       ip                            string
+       chassis_name                  string
+
+   Details:
+       type: string, one of geneve, stt, or vxlan
+              The  encapsulation  to  use to transmit packets to this chassis.
+              Hypervisors and gateways must use one of: geneve, vxlan, or stt.
+
+       options: map of string-string pairs
+              Options for configuring the encapsulation,  which  may  be  type
+              specific.
+
+       options : csum: optional string, either true or false
+              csum  indicates  whether  this  chassis can transmit and receive
+              packets that include checksums with reasonable  performance.  It
+              hints  to  senders  transmitting  data to this chassis that they
+              should use checksums to  protect  OVN  metadata.  ovn-controller
+              populates  this  key with the value defined in external_ids:ovn-
+              encap-csum column of the  Open_vSwitch  databaseā€™s  Open_vSwitch
+              table.  Other  applications  should treat this key as read-only.
+              See ovn-controller(8) for more information.
+
+              In terms of performance, checksumming actually significantly inā€
+              creases throughput in most common cases when  running  on  Linux
+              based  hosts  without NICs supporting encapsulation hardware ofā€
+              fload (around 60% for bulk traffic). The reason is  that  generā€
+              ally all NICs are capable of offloading transmitted and received
+              TCP/UDP  checksums  (viewed  as ordinary data packets and not as
+              tunnels). The benefit comes on the receive side where the  valiā€
+              dated outer checksum can be used to additionally validate an inā€
+              ner  checksum (such as TCP), which in turn allows aggregation of
+              packets to be more efficiently handled by the rest of the stack.
+
+              Not all devices see such a benefit. The most  notable  exception
+              is  hardware VTEPs. These devices are designed to not buffer enā€
+              tire packets in their switching engines and are therefore unable
+              to efficiently compute or validate full packet checksums. In adā€
+              dition certain versions of the Linux  kernel  are  not  able  to
+              fully  take advantage of encapsulation NIC offloads in the presā€
+              ence of checksums. (This is actually a pretty narrow corner case
+              though: earlier versions of Linux  donā€™t  support  encapsulation
+              offloads  at  all  and  later versions support both offloads and
+              checksums well.)
+
+              csum defaults to false for hardware VTEPs and true for all other
+              cases.
+
+              This option applies to geneve and vxlan encapsulations.
+
+       options : dst_port: optional string, containing an integer
+              If set, overrides the UDP (for geneve and  vxlan)  or  TCP  (for
+              stt) destination port.
+
+       ip: string
+              The IPv4 address of the encapsulation tunnel endpoint.
+
+       chassis_name: string
+              The name of the chassis that created this encap.
+
+Address_Set TABLE
+       This  table  contains address sets synced from the Address_Set table in
+       the  OVN_Northbound  database  and  address  sets  generated  from  the
+       Port_Group table in the OVN_Northbound database.
+
+       See the documentation for the Address_Set table and Port_Group table in
+       the OVN_Northbound database for details.
+
+   Summary:
+       name                          string (must be unique within table)
+       addresses                     set of strings
+
+   Details:
+       name: string (must be unique within table)
+
+       addresses: set of strings
+Port_Group TABLE
+       This  table  contains  names  for  the  logical  switch  ports  in  the
+       OVN_Northbound database that belongs to the same group that is  defined
+       in Port_Group in the OVN_Northbound database.
+
+   Summary:
+       name                          string (must be unique within table)
+       ports                         set of strings
+
+   Details:
+       name: string (must be unique within table)
+
+       ports: set of strings
+Logical_Flow TABLE
+       Each  row  in  this table represents one logical flow. ovn-northd popuā€
+       lates this table with logical  flows  that  implement  the  L2  and  L3
+       topologies  specified  in the OVN_Northbound database. Each hypervisor,
+       via ovn-controller, translates the logical flows  into  OpenFlow  flows
+       specific to its hypervisor and installs them into Open vSwitch.
+
+       Logical  flows are expressed in an OVN-specific format, described here.
+       A logical datapath flow is much like an OpenFlow flow, except that  the
+       flows  are  written in terms of logical ports and logical datapaths inā€
+       stead of physical ports and  physical  datapaths.  Translation  between
+       logical  and  physical  flows helps to ensure isolation between logical
+       datapaths. (The logical flow abstraction also allows the  OVN  centralā€
+       ized  components  to do less work, since they do not have to separately
+       compute and push out physical flows to each chassis.)
+
+       The default action when no flow matches is to drop packets.
+
+       Architectural Logical Life Cycle of a Packet
+
+       This following description focuses  on  the  life  cycle  of  a  packet
+       through  a logical datapath, ignoring physical details of the implemenā€
+       tation. Please refer to Architectural Physical Life Cycle of  a  Packet
+       in ovn-architecture(7) for the physical information.
+
+       The  description here is written as if OVN itself executes these steps,
+       but in fact OVN (that is, ovn-controller) programs  Open  vSwitch,  via
+       OpenFlow and OVSDB, to execute them on its behalf.
+
+       At  a high level, OVN passes each packet through the logical datapathā€™s
+       logical ingress pipeline, which may output the packet to  one  or  more
+       logical  port or logical multicast groups. For each such logical output
+       port, OVN passes the  packet  through  the  datapathā€™s  logical  egress
+       pipeline,  which may either drop the packet or deliver it to the destiā€
+       nation. Between the two pipelines, outputs to logical multicast  groups
+       are  expanded  into  logical  ports,  so  that the egress pipeline only
+       processes a single logical output port  at  a  time.  Between  the  two
+       pipelines is also where, when necessary, OVN encapsulates a packet in a
+       tunnel (or tunnels) to transmit to remote hypervisors.
+
+       In more detail, to start, OVN searches the Logical_Flow table for a row
+       with  correct  logical_datapath  or  a  logical_dp_group, a pipeline of
+       ingress, a table_id of 0, and a match that is true for the  packet.  If
+       none  is  found,  OVN  drops the packet. If OVN finds more than one, it
+       chooses the match with the highest priority. Then OVN executes each  of
+       the  actions specified in the rowā€™s actions column, in the order speciā€
+       fied. Some actions, such as those to modify packet headers, require  no
+       further details. The next and output actions are special.
+
+       The  next  action  causes the above process to be repeated recursively,
+       except that OVN searches for table_id of 1 instead of 0. Similarly, any
+       next action in a row found in that table would cause a  further  search
+       for  a  table_id  of 2, and so on. When recursive processing completes,
+       flow control returns to the action following next.
+
+       The output action also introduces recursion. Its effect depends on  the
+       current  value of the outport field. Suppose outport designates a logiā€
+       cal port. First, OVN compares inport to outport; if they are equal,  it
+       treats the output as a no-op by default. In the common case, where they
+       are  different,  the packet enters the egress pipeline. This transition
+       to the egress pipeline discards register data, e.g. reg0 ...  reg9  and
+       connection  tracking  state,  to achieve uniform behavior regardless of
+       whether the egress pipeline is on a different hypervisor (because  regā€
+       isters arenā€™t preserve across tunnel encapsulation).
+
+       To execute the egress pipeline, OVN again searches the Logical_Flow taā€
+       ble  for  a  row with correct logical_datapath or a logical_dp_group, a
+       table_id of 0, a match that is true for the packet, but now looking for
+       a pipeline of egress. If no matching row is found, the output becomes a
+       no-op. Otherwise, OVN executes the actions for the matching flow (which
+       is chosen from multiple, if necessary, as already described).
+
+       In the egress pipeline, the next action acts as already described,  exā€
+       cept  that it, of course, searches for egress flows. The output action,
+       however, now directly outputs the packet to the output port  (which  is
+       now fixed, because outport is read-only within the egress pipeline).
+
+       The  description  earlier  assumed  that  outport referred to a logical
+       port. If it instead designates a logical multicast group, then the  deā€
+       scription  above  still  applies, with the addition of fan-out from the
+       logical multicast group to each logical port in  the  group.  For  each
+       member  of  the  group, OVN executes the logical pipeline as described,
+       with the logical output port replaced by the group member.
+
+       Pipeline Stages
+
+       ovn-northd populates the Logical_Flow table with the logical flows  deā€
+       scribed in detail in ovn-northd(8).
+
+   Summary:
+       logical_datapath              optional Datapath_Binding
+       logical_dp_group              optional Logical_DP_Group
+       pipeline                      string, either egress or ingress
+       table_id                      integer, in range 0 to 32
+       priority                      integer, in range 0 to 65,535
+       match                         string
+       actions                       string
+       tags                          map of string-string pairs
+       controller_meter              optional string
+       external_ids : stage-name     optional string
+       external_ids : stage-hint     optional string, containing an uuid
+       external_ids : source         optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       logical_datapath: optional Datapath_Binding
+              The logical datapath to which the logical flow belongs.
+
+       logical_dp_group: optional Logical_DP_Group
+              The  group  of  logical  datapaths to which the logical flow beā€
+              longs. This means that the same  logical  flow  belongs  to  all
+              datapaths in a group.
+
+       pipeline: string, either egress or ingress
+              The  primary  flows  used for deciding on a packetā€™s destination
+              are the ingress flows. The egress flows implement ACLs. See Logā€ā€
+              ical Life Cycle of a Packet, above, for details.
+
+       table_id: integer, in range 0 to 32
+              The stage in the logical pipeline, analogous to an OpenFlow  taā€
+              ble number.
+
+       priority: integer, in range 0 to 65,535
+              The flowā€™s priority. Flows with numerically higher priority take
+              precedence  over those with lower. If two logical datapath flows
+              with the same priority both match, then the one actually applied
+              to the packet is undefined.
+
+       match: string
+              A matching expression.  OVN  provides  a  superset  of  OpenFlow
+              matching capabilities, using a syntax similar to Boolean expresā€
+              sions in a programming language.
+
+              The  most  important  components of match expression are comparā€
+              isons  between  symbols   and   constants,   e.g.   ip4.dst   ==
+              192.168.0.1,  ip.proto == 6, arp.op == 1, eth.type == 0x800. The
+              logical AND operator &&&& and logical OR operator ||  can  combine
+              comparisons into a larger expression.
+
+              Matching  expressions also support parentheses for grouping, the
+              logical NOT prefix operator !, and literals 0 and 1  to  express
+              ``falseā€™ā€™ or ``true,ā€™ā€™ respectively. The latter is useful by itā€
+              self as a catch-all expression that matches every packet.
+
+              Match  expressions  also  support a kind of function syntax. The
+              following functions are supported:
+
+              is_chassis_resident(lport)
+                     Evaluates to true on a  chassis  on  which  logical  port
+                     lport  (a quoted string) resides, and to false elsewhere.
+                     This function was introduced in OVN 2.7.
+
+              Symbols
+
+              Type. Symbols have integer or string type. Integer symbols  have
+              a width in bits.
+
+              Kinds. There are three kinds of symbols:
+
+              ā€¢      Fields.  A  field  symbol  represents  a packet header or
+                     metadata field. For example, a field named vlan.tci might
+                     represent the VLAN TCI field in a packet.
+
+                     A field symbol can have integer or string  type.  Integer
+                     fields  can  be nominal or ordinal (see Level of Measureā€ā€
+                     ment, below).
+
+              ā€¢      Subfields. A subfield represents a subset of bits from  a
+                     larger  field. For example, a field vlan.vid might be deā€
+                     fined as an alias for vlan.tci[0..11]. Subfields are proā€
+                     vided for syntactic convenience,  because  it  is  always
+                     possible  to  instead  refer  to  a subset of bits from a
+                     field directly.
+
+                     Only ordinal fields (see Level of Measurement, below) may
+                     have subfields. Subfields are always ordinal.
+
+              ā€¢      Predicates. A predicate is shorthand for  a  Boolean  exā€
+                     pression.  Predicates may be used much like 1-bit fields.
+                     For example, ip4 might expand to eth.type == 0x800. Predā€
+                     icates are provided for syntactic convenience, because it
+                     is always possible to instead specify the underlying  exā€
+                     pression directly.
+
+                     A  predicate  whose expansion refers to any nominal field
+                     or predicate (see Level of Measurement, below)  is  nomiā€
+                     nal; other predicates have Boolean level of measurement.
+
+              Level              of              Measurement.              See
+              http://en.wikipedia.org/wiki/Level_of_measurement for  the  staā€
+              tistical  concept  on  which this classification is based. There
+              are three levels:
+
+              ā€¢      Ordinal. In statistics, ordinal values can be ordered  on
+                     a  scale. OVN considers a field (or subfield) to be ordiā€
+                     nal if its bits can be  examined  individually.  This  is
+                     true  for  the  OpenFlow  fields  that  OpenFlow  or Open
+                     vSwitch makes ``maskable.ā€™ā€™
+
+                     Any use of a ordinal field may specify a single bit or  a
+                     range  of  bits,  e.g. vlan.tci[13..15] refers to the PCP
+                     field within the VLAN TCI, and eth.dst[40] refers to  the
+                     multicast bit in the Ethernet destination address.
+
+                     OVN  supports all the usual arithmetic relations (==, !=,
+                     =, >gt;>gt;, and >gt;>gt;=) on ordinal fields and their  subfields,
+                     because  OVN  can  implement  these  in OpenFlow and Open
+                     vSwitch as collections of bitwise tests.
+
+              ā€¢      Nominal. In statistics, nominal values cannot be usefully
+                     compared except for equality. This is  true  of  OpenFlow
+                     port  numbers, Ethernet types, and IP protocols are examā€
+                     ples: all of these are just  identifiers  assigned  arbiā€
+                     trarily  with  no  deeper  meaning.  In OpenFlow and Open
+                     vSwitch, bits in these fields generally arenā€™t  individuā€
+                     ally addressable.
+
+                     OVN  only supports arithmetic tests for equality on nomiā€
+                     nal fields, because OpenFlow and Open vSwitch provide  no
+                     way for a flow to efficiently implement other comparisons
+                     on  them. (A test for inequality can be sort of built out
+                     of two flows with different priorities, but OVN  matching
+                     expressions  always  generate  flows with a single priorā€
+                     ity.)
+
+                     String fields are always nominal.
+
+              ā€¢      Boolean. A nominal field that has only two values, 0  and
+                     1,  is  somewhat exceptional, since it is easy to support
+                     both equality and inequality tests on such a  field:  eiā€
+                     ther one can be implemented as a test for 0 or 1.
+
+                     Only  predicates (see above) have a Boolean level of meaā€
+                     surement.
+
+                     This isnā€™t a standard level of measurement.
+
+              Prerequisites. Any symbol can have prerequisites, which are  adā€
+              ditional  condition  implied by the use of the symbol. For examā€
+              ple, For example,  icmp4.type  symbol  might  have  prerequisite
+              icmp4, which would cause an expression icmp4.type == 0 to be inā€
+              terpreted  as  icmp4.type == 0 &&&& icmp4, which would in turn exā€
+              pand to icmp4.type == 0 &&&& eth.type == 0x800 &&&& ip4.proto  ==  1
+              (assuming  icmp4 is a predicate defined as suggested under Types
+              above).
+
+              Relational operators
+
+              All of the standard relational operators ==, !=, =,  >gt;>gt;,  and
+              >gt;>gt;=  are  supported.  Nominal  fields support only == and !=, and
+              only in a positive sense when outer ! are  taken  into  account,
+              e.g. given string field inport, inport == "eth0" and !(inport !=
+              "eth0") are acceptable, but not inport != "eth0".
+
+              The implementation of == (or != when it is negated), is more efā€
+              ficient than that of the other relational operators.
+
+              Constants
+
+              Integer  constants may be expressed in decimal, hexadecimal preā€
+              fixed by 0x, or as dotted-quad IPv4 addresses, IPv6 addresses in
+              their standard forms, or Ethernet addresses  as  colon-separated
+              hex  digits. A constant in any of these forms may be followed by
+              a slash and a second constant (the mask) in the  same  form,  to
+              form  a masked constant. IPv4 and IPv6 masks may be given as inā€
+              tegers, to express CIDR prefixes.
+
+              String constants have the same syntax as quoted strings in  JSON
+              (thus, they are Unicode strings).
+
+              Some  operators  support  sets of constants written inside curly
+              braces { ... }. Commas between elements of a set, and after  the
+              last  elements,  are  optional. With ==, ``field == { constant1,
+              constant2, ... }ā€™ā€™ is syntactic sugar for ``field  ==  constant1
+              || field == constant2 || .... Similarly, ``field != { constant1,
+              constant2,  ...  }ā€™ā€™  is  equivalent  to ``field != constant1 &&&&
+              field != constant2 &&&& ...ā€™ā€™.
+
+              You may refer to a set of IPv4, IPv6, or MAC addresses stored in
+              the Address_Set table by its name. An Address_Set with a name of
+              set1 can be referred to as $set1.
+
+              You may refer to a group of logical switch ports stored  in  the
+              Port_Group  table  by  its  name.  An  Port_Group with a name of
+              port_group1 can be referred to as @port_group1.
+
+              Additionally, you may refer to the set of addresses belonging to
+              a group of logical switch ports stored in the  Port_Group  table
+              by its name followed by a suffix ā€™_ip4ā€™/ā€™_ip6ā€™. The IPv4 address
+              set  of  a Port_Group with a name of port_group1 can be referred
+              to as $port_group1_ip4, and the IPv6 address  set  of  the  same
+              Port_Group can be referred to as $port_group1_ip6
+
+              Miscellaneous
+
+              Comparisons  may  name  the  symbol  or the constant first, e.g.
+              tcp.src == 80 and 80 == tcp.src are both acceptable.
+
+              Tests for a range may be expressed using a syntax like  1024  =
+              tcp.src  =  49151,  which  is  equivalent to 1024 = tcp.src &&&&
+              tcp.src = 49151.
+
+              For a one-bit field or predicate,  a  mention  of  its  name  is
+              equivalent  to  symobl  == 1, e.g. vlan.present is equivalent to
+              vlan.present == 1. The same is true for one-bit subfields,  e.g.
+              vlan.tci[12].  There  is no technical limitation to implementing
+              the same for ordinal fields of all widths, but  the  implementaā€
+              tion is expensive enough that the syntax parser requires writing
+              an  explicit  comparison  against  zero  to  make  mistakes less
+              likely, e.g. in tcp.src != 0 the comparison  against  0  is  reā€
+              quired.
+
+              Operator  precedence  is as shown below, from highest to lowest.
+              There are two exceptions where  parentheses  are  required  even
+              though  the table would suggest that they are not: &&&& and || reā€
+              quire parentheses when used together, and ! requires parentheses
+              when applied to a relational expression. Thus, in  (eth.type  ==
+              0x800 || eth.type == 0x86dd) &&&& ip.proto == 6 or !(arp.op == 1),
+              the parentheses are mandatory.
+
+              ā€¢      ()
+
+              ā€¢      ==   !=   =   >gt;>gt;   >gt;>gt;=
+
+              ā€¢      !
+
+              ā€¢      &&&&   ||
+
+              Comments may be introduced by //, which extends to the next new-
+              line. Comments within a line may be bracketed by /* and */. Mulā€
+              tiline comments are not supported.
+
+              Symbols
+
+              Most  of  the  symbols  below have integer type. Only inport and
+              outport have string type. inport names a logical port. Thus, its
+              value is a logical_port name from the Port_Binding  table.  outā€ā€
+              port  may name a logical port, as inport, or a logical multicast
+              group defined in the Multicast_Group table.  For  both  symbols,
+              only names within the flowā€™s logical datapath may be used.
+
+              The  regX  symbols  are  32-bit integers. The xxregX symbols are
+              128-bit integers, which overlay four of  the  32-bit  registers:
+              xxreg0 overlays reg0 through reg3, with reg0 supplying the most-
+              significant  bits  of  xxreg0  and  reg3  the least-significant.
+              xxreg1 similarly overlays reg4 through reg7.
+
+              ā€¢      reg0...reg9
+
+              ā€¢      xxreg0 xxreg1
+
+              ā€¢      inport outport
+
+              ā€¢      flags.loopback
+
+              ā€¢      pkt.mark
+
+              ā€¢      eth.src eth.dst eth.type
+
+              ā€¢      vlan.tci vlan.vid vlan.pcp vlan.present
+
+              ā€¢      ip.proto ip.dscp ip.ecn ip.ttl ip.frag
+
+              ā€¢      ip4.src ip4.dst
+
+              ā€¢      ip6.src ip6.dst ip6.label
+
+              ā€¢      arp.op arp.spa arp.tpa arp.sha arp.tha
+
+              ā€¢      rarp.op rarp.spa rarp.tpa rarp.sha rarp.tha
+
+              ā€¢      tcp.src tcp.dst tcp.flags
+
+              ā€¢      udp.src udp.dst
+
+              ā€¢      sctp.src sctp.dst
+
+              ā€¢      icmp4.type icmp4.code
+
+              ā€¢      icmp6.type icmp6.code
+
+              ā€¢      nd.target nd.sll nd.tll
+
+              ā€¢      ct_mark ct_label
+
+              ā€¢      ct_state,  which  has  several  Boolean  subfields.   The
+                     ct_next action initializes the following subfields:
+
+                     ā€¢      ct.trk:  Always set to true by ct_next to indicate
+                            that connection  tracking  has  taken  place.  All
+                            other ct subfields have ct.trk as a prerequisite.
+
+                     ā€¢      ct.new: True for a new flow
+
+                     ā€¢      ct.est: True for an established flow
+
+                     ā€¢      ct.rel: True for a related flow
+
+                     ā€¢      ct.rpl: True for a reply flow
+
+                     ā€¢      ct.inv: True for a connection entry in a bad state
+
+                     The  ct_dnat,  ct_snat,  and ct_lb actions initialize the
+                     following subfields:
+
+                     ā€¢      ct.dnat: True for a packet  whose  destination  IP
+                            address has been changed.
+
+                     ā€¢      ct.snat: True for a packet whose source IP address
+                            has been changed.
+
+              The following predicates are supported:
+
+              ā€¢      eth.bcast expands to eth.dst == ff:ff:ff:ff:ff:ff
+
+              ā€¢      eth.mcast expands to eth.dst[40]
+
+              ā€¢      vlan.present expands to vlan.tci[12]
+
+              ā€¢      ip4 expands to eth.type == 0x800
+
+              ā€¢      ip4.src_mcast expands to ip4.src[28..31] == 0xe
+
+              ā€¢      ip4.mcast expands to ip4.dst[28..31] == 0xe
+
+              ā€¢      ip6 expands to eth.type == 0x86dd
+
+              ā€¢      ip expands to ip4 || ip6
+
+              ā€¢      icmp4 expands to ip4 &&&& ip.proto == 1
+
+              ā€¢      icmp6 expands to ip6 &&&& ip.proto == 58
+
+              ā€¢      icmp expands to icmp4 || icmp6
+
+              ā€¢      ip.is_frag expands to ip.frag[0]
+
+              ā€¢      ip.later_frag expands to ip.frag[1]
+
+              ā€¢      ip.first_frag expands to ip.is_frag &&&& !ip.later_frag
+
+              ā€¢      arp expands to eth.type == 0x806
+
+              ā€¢      rarp expands to eth.type == 0x8035
+
+              ā€¢      nd expands to icmp6.type == {135, 136} &&&& icmp6.code == 0
+                     &&&& ip.ttl == 255
+
+              ā€¢      nd_ns  expands to icmp6.type == 135 &&&& icmp6.code == 0 &&&&
+                     ip.ttl == 255
+
+              ā€¢      nd_na expands to icmp6.type == 136 &&&& icmp6.code == 0  &&&&
+                     ip.ttl == 255
+
+              ā€¢      nd_rs  expands to icmp6.type == 133 &&&& icmp6.code == 0 &&&&
+                     ip.ttl == 255
+
+              ā€¢      nd_ra expands to icmp6.type == 134 &&&& icmp6.code == 0  &&&&
+                     ip.ttl == 255
+
+              ā€¢      tcp expands to ip.proto == 6
+
+              ā€¢      udp expands to ip.proto == 17
+
+              ā€¢      sctp expands to ip.proto == 132
+
+       actions: string
+              Logical  datapath  actions, to be executed when the logical flow
+              represented by this row is the highest-priority match.
+
+              Actions share lexical syntax with the match column. An empty set
+              of actions (or one that contains just white space or  comments),
+              or  a  set  of  actions  that consists of just drop;, causes the
+              matched packets to be dropped. Otherwise, the column should conā€
+              tain a sequence of actions, each terminated by a semicolon.
+
+              The following actions are defined:
+
+              output;
+                     In the ingress pipeline, this action executes the  egress
+                     pipeline  as  a  subroutine.  If  outport names a logical
+                     port, the egress pipeline executes once; if it is a  mulā€
+                     ticast group, the egress pipeline runs once for each logā€
+                     ical port in the group.
+
+                     In  the  egress pipeline, this action performs the actual
+                     output to  the  outport  logical  port.  (In  the  egress
+                     pipeline, outport never names a multicast group.)
+
+                     By  default,  output  to  the  input  port  is implicitly
+                     dropped, that is, output becomes a no-op  if  outport  ==
+                     inport.  Occasionally  it  may be useful to override this
+                     behavior, e.g. to send an ARP reply to an ARP request; to
+                     do so, use flags.loopback = 1  to  allow  the  packet  to
+                     "hair-pin" back to the input port.
+
+              next;
+              next(table);
+              next(pipeline=pipeline, table=table);
+                   Executes  the given logical datapath table in pipeline as a
+                   subroutine. The default table is  just  after  the  current
+                   one. If pipeline is specified, it may be ingress or egress;
+                   the  default  pipeline  is the one currently executing. Acā€
+                   tions in the both ingress and egress pipeline can use  next
+                   to  jump  across the other pipeline. Actions in the ingress
+                   pipeline should use next to jump into the specific table of
+                   egress pipeline only if it is certain that the packets  are
+                   local and not tunnelled and wants to skip certain stages in
+                   the packet processing.
+
+              field = constant;
+                   Sets  data  or  metadata field field to constant value conā€
+                   stant, e.g. outport = "vif0"; to  set  the  logical  output
+                   port.  To  set  only a subset of bits in a field, specify a
+                   subfield for field or a masked constant, e.g. one  may  use
+                   vlan.pcp[2] = 1; or vlan.pcp = 4/4; to set the most signifā€
+                   icant bit of the VLAN PCP.
+
+                   Assigning  to  a  field  with prerequisites implicitly adds
+                   those prerequisites to match; thus,  for  example,  a  flow
+                   that  sets tcp.dst applies only to TCP flows, regardless of
+                   whether its match mentions any TCP field.
+
+                   Not all fields are modifiable (e.g. eth.type  and  ip.proto
+                   are  read-only),  and not all modifiable fields may be parā€
+                   tially modified (e.g. ip.ttl must assigned as a whole). The
+                   outport field is modifiable in the ingress pipeline but not
+                   in the egress pipeline.
+
+              ovn_field = constant;
+                   Sets OVN field ovn_field to constant value constant.
+
+                   OVN supports setting the values of certain fields which are
+                   not yet supported in OpenFlow to set or modify them.
+
+                   Below are the supported OVN fields:
+
+                   ā€¢      icmp4.frag_mtu icmp6.frag_mtu
+
+                          This  field  sets  the  low-order  16  bits  of  the
+                          ICMP{4,6}  header field that is labelled "unused" in
+                          the ICMP specification as defined in  the  RFC  1191
+                          with the value specified in constant.
+
+                          Eg. icmp4.frag_mtu = 1500;
+
+              field1 = field2;
+                   Sets  data or metadata field field1 to the value of data or
+                   metadata field field2, e.g. reg0 = ip4.src; copies  ip4.src
+                   into reg0. To modify only a subset of a fieldā€™s bits, specā€
+                   ify  a subfield for field1 or field2 or both, e.g. vlan.pcp
+                   = reg0[0..2]; copies the  least-significant  bits  of  reg0
+                   into the VLAN PCP.
+
+                   field1 and field2 must be the same type, either both string
+                   or  both  integer  fields. If they are both integer fields,
+                   they must have the same width.
+
+                   If field1 or field2 has prerequisites, they are  added  imā€
+                   plicitly  to  match.  It is possible to write an assignment
+                   with  contradictory  prerequisites,  such  as   ip4.src   =
+                   ip6.src[0..31];, but the contradiction means that a logical
+                   flow with such an assignment will never be matched.
+
+              field1 ->gt;>gt; field2;
+                   Similar  to field1 = field2; except that the two values are
+                   exchanged instead of copied. Both field1  and  field2  must
+                   modifiable.
+
+              push(field);
+                   Push the value of field to the stack top.
+
+              pop(field);
+                   Pop  the stack top and store the value to field, which must
+                   be modifiable.
+
+              ip.ttl--;
+                   Decrements the IPv4 or IPv6 TTL. If this would make the TTL
+                   zero or negative, then processing of the packet  halts;  no
+                   further  actions  are  processed.  (To properly handle such
+                   cases, a higher-priority flow should match on ip.ttl == {0,
+                   1};.)
+
+                   Prerequisite: ip
+
+              ct_next;
+                   Apply  connection  tracking  to  the   flow,   initializing
+                   ct_state  for matching in later tables. Automatically moves
+                   on to the next table, as if followed by next.
+
+                   As a side effect, IP  fragments  will  be  reassembled  for
+                   matching. If a fragmented packet is output, then it will be
+                   sent  with  any overlapping fragments squashed. The connecā€
+                   tion tracking state is scoped by the logical port when  the
+                   action  is used in a flow for a logical switch, so overlapā€
+                   ping addresses may be used. To allow traffic related to the
+                   matched flow, execute ct_commit . Connection tracking state
+                   is scoped by the logical topology when the action  is  used
+                   in a flow for a router.
+
+                   It  is  possible  to  have actions follow ct_next, but they
+                   will not have access to any of its side-effects and is  not
+                   generally useful.
+
+              ct_commit { };
+              ct_commit { ct_mark=value[/mask]; };
+              ct_commit { ct_label=value[/mask]; };
+              ct_commit { ct_mark=value[/mask]; ct_label=value[/mask]; };
+                   Commit the flow to the connection tracking entry associated
+                   with   it   by   a   previous   call   to   ct_next.   When
+                   ct_mark=value[/mask] and/or ct_label=value[/mask] are  supā€
+                   plied,  ct_mark  and/or  ct_label will be set to the values
+                   indicated by value[/mask] on the connection tracking entry.
+                   ct_mark is a 32-bit field. ct_label is a 128-bit field. The
+                   value[/mask] should be specified in hex string if more than
+                   64bits are to be used. Registers and other named fields can
+                   be used for value. ct_mark  and  ct_label  may  be  sub-adā€
+                   dressed in order to have specific bits set.
+
+                   Note  that  if  you want processing to continue in the next
+                   table, you must execute the next  action  after  ct_commit.
+                   You  may  also  leave out next which will commit connection
+                   tracking state, and then drop the  packet.  This  could  be
+                   useful  for  setting ct_mark on a connection tracking entry
+                   before dropping a packet, for example.
+
+              ct_dnat;
+              ct_dnat(IP);
+                   ct_dnat sends the packet through the DNAT zone  in  connecā€
+                   tion tracking table to unDNAT any packet that was DNATed in
+                   the  opposite  direction.  The packet is then automatically
+                   sent to to the next tables as if followed by next;  action.
+                   The  next  tables will see the changes in the packet caused
+                   by the connection tracker.
+
+                   ct_dnat(IP) sends the  packet  through  the  DNAT  zone  to
+                   change  the destination IP address of the packet to the one
+                   provided inside the parentheses and commits the connection.
+                   The packet is then automatically sent to the next tables as
+                   if followed by next; action. The next tables will  see  the
+                   changes in the packet caused by the connection tracker.
+
+              ct_snat;
+              ct_snat(IP);
+                   ct_snat  sends  the  packet through the SNAT zone to unSNAT
+                   any packet that was SNATed in the opposite  direction.  The
+                   packet  is automatically sent to the next tables as if folā€
+                   lowed by the next; action. The next  tables  will  see  the
+                   changes in the packet caused by the connection tracker.
+
+                   ct_snat(IP)  sends  the  packet  through  the  SNAT zone to
+                   change the source IP address of the packet to the one  proā€
+                   vided  inside  the  parenthesis and commits the connection.
+                   The packet is then automatically sent to the next tables as
+                   if followed by next; action. The next tables will  see  the
+                   changes in the packet caused by the connection tracker.
+
+              ct_dnat_in_czone;
+              ct_dnat_in_czone(IP);
+                   ct_dnat_in_czone  sends  the  packet through the common NAT
+                   zone (used for both DNAT and SNAT) in  connection  tracking
+                   table  to unDNAT any packet that was DNATed in the opposite
+                   direction. The packet is then automatically sent to to  the
+                   next tables as if followed by next; action. The next tables
+                   will see the changes in the packet caused by the connection
+                   tracker.
+
+                   ct_dnat_in_czone(IP)  sends  the  packet through the common
+                   NAT zone to change the destination IP address of the packet
+                   to the one provided inside the parentheses and commits  the
+                   connection.  The  packet  is then automatically sent to the
+                   next tables as if followed by next; action. The next tables
+                   will see the changes in the packet caused by the connection
+                   tracker.
+
+              ct_snat_in_czone;
+              ct_snat_in_czone(IP);
+                   ct_snat_in_czone sends the packet through  the  common  NAT
+                   zone  to  unSNAT any packet that was SNATed in the opposite
+                   direction. The packet is automatically sent to the next taā€
+                   bles as if followed by the next; action.  The  next  tables
+                   will see the changes in the packet caused by the connection
+                   tracker.
+
+                   ct_snat_in_czone(IP)  sends  the packet\ through the common
+                   NAT zone to change the source IP address of the  packet  to
+                   the  one  provided  inside  the parenthesis and commits the
+                   connection. The packet is then automatically  sent  to  the
+                   next tables as if followed by next; action. The next tables
+                   will see the changes in the packet caused by the connection
+                   tracker.
+
+              ct_clear;
+                   Clears connection tracking state.
+
+              ct_commit_nat;
+                   Applies NAT and commits the connection to the CT. Automatiā€
+                   cally  moves  on to the next table, as if followed by next.
+                   This is very useful for connections  that  are  in  related
+                   state  for  already existing connections and allows the NAT
+                   to be applied to them as well.
+
+              clone { action; ... };
+                   Makes a copy of the packet  being  processed  and  executes
+                   each  action  on  the copy. Actions following the clone acā€
+                   tion, if any, apply to  the  original,  unmodified  packet.
+                   This  can  be  used  as  a  way to ``save and restoreā€™ā€™ the
+                   packet around a set of  actions  that  may  modify  it  and
+                   should not persist.
+
+              arp { action; ... };
+                   Temporarily  replaces the IPv4 packet being processed by an
+                   ARP packet and executes  each  nested  action  on  the  ARP
+                   packet.  Actions following the arp action, if any, apply to
+                   the original, unmodified packet.
+
+                   The ARP packet that this action operates on is  initialized
+                   based on the IPv4 packet being processed, as follows. These
+                   are  default  values  that the nested actions will probably
+                   want to change:
+
+                   ā€¢      eth.src unchanged
+
+                   ā€¢      eth.dst unchanged
+
+                   ā€¢      eth.type = 0x0806
+
+                   ā€¢      arp.op = 1 (ARP request)
+
+                   ā€¢      arp.sha copied from eth.src
+
+                   ā€¢      arp.spa copied from ip4.src
+
+                   ā€¢      arp.tha = 00:00:00:00:00:00
+
+                   ā€¢      arp.tpa copied from ip4.dst
+
+                   The ARP packet has the same VLAN header, if any, as the  IP
+                   packet it replaces.
+
+                   Prerequisite: ip4
+
+              get_arp(P, A);
+                   Parameters:  logical port string field P, 32-bit IP address
+                   field A.
+
+                   Looks up A in Pā€™s mac binding table. If an entry is  found,
+                   stores  its  Ethernet  address in eth.dst, otherwise stores
+                   00:00:00:00:00:00 in eth.dst.
+
+                   Example: get_arp(outport, ip4.dst);
+
+              put_arp(P, A, E);
+                   Parameters: logical port string field P, 32-bit IP  address
+                   field A, 48-bit Ethernet address field E.
+
+                   Adds  or updates the entry for IP address A in logical port
+                   Pā€™s mac binding table, setting its Ethernet address to E.
+
+                   Example: put_arp(inport, arp.spa, arp.sha);
+
+              R = lookup_arp(P, A, M);
+                   Parameters: logical port string field P, 32-bit IP  address
+                   field A, 48-bit MAC address field M.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Looks  up  A and M in Pā€™s mac binding table. If an entry is
+                   found, stores 1 in the 1-bit subfield R, else 0.
+
+                   Example: reg0[0] = lookup_arp(inport, arp.spa, arp.sha);
+
+              R = lookup_arp_ip(P, A);
+                   Parameters: logical port string field P, 32-bit IP  address
+                   field A.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Looks  up A in Pā€™s mac binding table. If an entry is found,
+                   stores 1 in the 1-bit subfield R, else 0.
+
+                   Example: reg0[0] = lookup_arp_ip(inport, arp.spa);
+
+              P = get_fdb(A);
+                   Parameters:48-bit MAC address field A.
+
+                   Looks up A in fdb table. If an entry is found,  stores  the
+                   logical port key to the out parameter P.
+
+                   Example: outport = get_fdb(eth.src);
+
+              put_fdb(P, A);
+                   Parameters: logical port string field P, 48-bit MAC address
+                   field A.
+
+                   Adds or updates the entry for Ethernet address A in fdb taā€
+                   ble, setting its logical port key to P.
+
+                   Example: put_fdb(inport, arp.spa);
+
+              R = lookup_fdb(P, A);
+                   Parameters: 48-bit MAC address field M, logical port string
+                   field P.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Looks up A in fdb table. If an entry is found and the logiā€
+                   cal  port  key  is  P, P, stores 1 in the 1-bit subfield R,
+                   else 0. If flags.localnet is set then 1 is stored if an enā€
+                   try is found and the logical port key is P or if  an  entry
+                   is found and the entry port type is VIF.
+
+                   Example: reg0[0] = lookup_fdb(inport, eth.src);
+
+              nd_ns { action; ... };
+                   Temporarily  replaces the IPv6 packet being processed by an
+                   IPv6 Neighbor Solicitation packet and executes each  nested
+                   action  on  the IPv6 NS packet. Actions following the nd_ns
+                   action, if any, apply to the original, unmodified packet.
+
+                   The IPv6 NS packet that this action operates on is initialā€
+                   ized based on the IPv6 packet being processed, as  follows.
+                   These are default values that the nested actions will probā€
+                   ably want to change:
+
+                   ā€¢      eth.src unchanged
+
+                   ā€¢      eth.dst set to IPv6 multicast MAC address
+
+                   ā€¢      eth.type = 0x86dd
+
+                   ā€¢      ip6.src copied from ip6.src
+
+                   ā€¢      ip6.dst set to IPv6 Solicited-Node multicast address
+
+                   ā€¢      icmp6.type = 135 (Neighbor Solicitation)
+
+                   ā€¢      nd.target copied from ip6.dst
+
+                   The IPv6 NS packet has the same VLAN header, if any, as the
+                   IP packet it replaces.
+
+                   Prerequisite: ip6
+
+              nd_na { action; ... };
+                   Temporarily  replaces the IPv6 neighbor solicitation packet
+                   being processed by  an  IPv6  neighbor  advertisement  (NA)
+                   packet  and  executes  each nested action on the NA packet.
+                   Actions following the nd_na action, if any,  apply  to  the
+                   original, unmodified packet.
+
+                   The  NA  packet that this action operates on is initialized
+                   based on the IPv6 packet being processed, as follows. These
+                   are default values that the nested  actions  will  probably
+                   want to change:
+
+                   ā€¢      eth.dst exchanged with eth.src
+
+                   ā€¢      eth.type = 0x86dd
+
+                   ā€¢      ip6.dst copied from ip6.src
+
+                   ā€¢      ip6.src copied from nd.target
+
+                   ā€¢      icmp6.type = 136 (Neighbor Advertisement)
+
+                   ā€¢      nd.target unchanged
+
+                   ā€¢      nd.sll = 00:00:00:00:00:00
+
+                   ā€¢      nd.tll copied from eth.dst
+
+                   The ND packet has the same VLAN header, if any, as the IPv6
+                   packet it replaces.
+
+                   Prerequisite: nd_ns
+
+              nd_na_router { action; ... };
+                   Temporarily  replaces the IPv6 neighbor solicitation packet
+                   being processed by  an  IPv6  neighbor  advertisement  (NA)
+                   packet,  sets  ND_NSO_ROUTER  in the RSO flags and executes
+                   each nested action on the NA packet. Actions following  the
+                   nd_na_router action, if any, apply to the original, unmodiā€
+                   fied packet.
+
+                   The  NA  packet that this action operates on is initialized
+                   based on the IPv6 packet being processed, as follows. These
+                   are default values that the nested  actions  will  probably
+                   want to change:
+
+                   ā€¢      eth.dst exchanged with eth.src
+
+                   ā€¢      eth.type = 0x86dd
+
+                   ā€¢      ip6.dst copied from ip6.src
+
+                   ā€¢      ip6.src copied from nd.target
+
+                   ā€¢      icmp6.type = 136 (Neighbor Advertisement)
+
+                   ā€¢      nd.target unchanged
+
+                   ā€¢      nd.sll = 00:00:00:00:00:00
+
+                   ā€¢      nd.tll copied from eth.dst
+
+                   The ND packet has the same VLAN header, if any, as the IPv6
+                   packet it replaces.
+
+                   Prerequisite: nd_ns
+
+              get_nd(P, A);
+                   Parameters:  logical  port string field P, 128-bit IPv6 adā€
+                   dress field A.
+
+                   Looks up A in Pā€™s mac binding table. If an entry is  found,
+                   stores  its  Ethernet  address in eth.dst, otherwise stores
+                   00:00:00:00:00:00 in eth.dst.
+
+                   Example: get_nd(outport, ip6.dst);
+
+              put_nd(P, A, E);
+                   Parameters: logical port string field P, 128-bit  IPv6  adā€
+                   dress field A, 48-bit Ethernet address field E.
+
+                   Adds  or  updates  the  entry for IPv6 address A in logical
+                   port Pā€™s mac binding table, setting its Ethernet address to
+                   E.
+
+                   Example: put_nd(inport, nd.target, nd.tll);
+
+              R = lookup_nd(P, A, M);
+                   Parameters: logical port string field P, 128-bit IP address
+                   field A, 48-bit MAC address field M.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Looks up A and M in Pā€™s mac binding table. If an  entry  is
+                   found, stores 1 in the 1-bit subfield R, else 0.
+
+                   Example: reg0[0] = lookup_nd(inport, ip6.src, eth.src);
+
+              R = lookup_nd_ip(P, A);
+                   Parameters: logical port string field P, 128-bit IP address
+                   field A.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Looks  up A in Pā€™s mac binding table. If an entry is found,
+                   stores 1 in the 1-bit subfield R, else 0.
+
+                   Example: reg0[0] = lookup_nd_ip(inport, ip6.src);
+
+              R = put_dhcp_opts(D1 = V1, D2 = V2, ..., Dn = Vn);
+                   Parameters: one or more DHCP option/value pairs, which must
+                   include an offerip option (with code 0).
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Valid only in the ingress pipeline.
+
+                   When this action  is  applied  to  a  DHCP  request  packet
+                   (DHCPDISCOVER or DHCPREQUEST), it changes the packet into a
+                   DHCP  reply  (DHCPOFFER or DHCPACK, respectively), replaces
+                   the options by those specified as parameters, and stores  1
+                   in R.
+
+                   When  this action is applied to a non-DHCP packet or a DHCP
+                   packet that is not DHCPDISCOVER or DHCPREQUEST,  it  leaves
+                   the packet unchanged and stores 0 in R.
+
+                   The  contents of the DHCP_Option table control the DHCP opā€
+                   tion names and values that this action supports.
+
+                   Example: reg0[0] = put_dhcp_opts(offerip = 10.0.0.2, router
+                   = 10.0.0.1, netmask = 255.255.255.0, dns_server = {8.8.8.8,
+                   7.7.7.7});
+
+              R = put_dhcpv6_opts(D1 = V1, D2 = V2, ..., Dn = Vn);
+                   Parameters: one or more DHCPv6 option/value pairs.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Valid only in the ingress pipeline.
+
+                   When this action is applied to a DHCPv6 request packet,  it
+                   changes  the  packet  into a DHCPv6 reply, replaces the opā€
+                   tions by those specified as parameters, and stores 1 in R.
+
+                   When this action is applied to a non-DHCPv6  packet  or  an
+                   invalid  DHCPv6  request  packet , it leaves the packet unā€
+                   changed and stores 0 in R.
+
+                   The contents of the DHCPv6_Options table control the DHCPv6
+                   option names and values that this action supports.
+
+                   Example:  reg0[3]  =  put_dhcpv6_opts(ia_addr  =   aef0::4,
+                   server_id                =               00:00:00:00:10:02,
+                   dns_server={ae70::1,ae70::2});
+
+              set_queue(queue_number);
+                   Parameters: Queue number queue_number, in the  range  0  to
+                   61440.
+
+                   This  is a logical equivalent of the OpenFlow set_queue acā€
+                   tion. It affects packets that egress a hypervisor through a
+                   physical interface. For nonzero queue_number, it configures
+                   packet queuing to match the  settings  configured  for  the
+                   Port_Binding     with    options:qdisc_queue_id    matching
+                   queue_number. When queue_number is zero, it resets  queuing
+                   to the default strategy.
+
+                   Example: set_queue(10);
+
+              ct_lb;
+              ct_lb(backends=ip[:port][,...][;
+              hash_fields=field1,field2,...][; ct_flag]);
+                   With  arguments, ct_lb commits the packet to the connection
+                   tracking table and DNATs the packetā€™s  destination  IP  adā€
+                   dress  (and  port)  to the IP address or addresses (and opā€
+                   tional ports) specified in the backends. If multiple comma-
+                   separated IP addresses are specified, each is  given  equal
+                   weight for picking the DNAT address. By default, dp_hash is
+                   used  as  the  OpenFlow  group  selection  method,  but  if
+                   hash_fields is specified, hash is  used  as  the  selection
+                   method,  and the fields listed are used as the hash fields.
+                   The  ct_flag  field  represents  one  of  supported   flag:
+                   skip_snat or force_snat, this flag will be stored in ct_laā€ā€
+                   bel register.
+
+                   Without arguments, ct_lb sends the packet to the connection
+                   tracking table to NAT the packets. If the packet is part of
+                   an  established connection that was previously committed to
+                   the connection tracker via ct_lb(...),  it  will  automatiā€
+                   cally get DNATed to the same IP address as the first packet
+                   in that connection.
+
+                   Processing  automatically moves on to the next table, as if
+                   next; were specified, and later tables act on the packet as
+                   modified by the  connection  tracker.  Connection  tracking
+                   state is scoped by the logical port when the action is used
+                   in  a  flow  for a logical switch, so overlapping addresses
+                   may be used. Connection tracking state  is  scoped  by  the
+                   logical  topology  when  the action is used in a flow for a
+                   router.
+
+              ct_lb_mark;
+              ct_lb_mark(backends=ip[:port][,...][;
+              hash_fields=field1,field2,...][; ct_flag]);
+                   Same as ct_lb, except that it internally  uses  ct_mark  to
+                   store  the NAT flag, while ct_lb uses ct_label for the same
+                   purpose.
+
+              R = dns_lookup();
+                   Parameters: No parameters.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Valid only in the ingress pipeline.
+
+                   When this action is applied to a valid DNS request  (a  UDP
+                   packet  typically  directed to port 53), it attempts to reā€
+                   solve the query using the contents of the DNS table. If  it
+                   is  successful,  it changes the packet into a DNS reply and
+                   stores 1 in R. If  the  action  is  applied  to  a  non-DNS
+                   packet,  an  invalid DNS request packet, or a valid DNS reā€
+                   quest for which the DNS table does not supply an answer, it
+                   leaves the packet unchanged and stores 0 in R.
+
+                   Regardless of success, the action does not make any of  the
+                   changes to the flow that are necessary to direct the packet
+                   back  to  the requester. The logical pipeline can implement
+                   this behavior with matches and actions in later tables.
+
+                   Example: reg0[3] = dns_lookup();
+
+                   Prerequisite: udp
+
+              R = put_nd_ra_opts(D1 = V1, D2 = V2, ..., Dn = Vn);
+                   Parameters: The following IPv6 ND Router Advertisement  opā€
+                   tion/value pairs as defined in RFC 4861.
+
+                   ā€¢      addr_mode
+
+                          Mandatory parameter which specifies the address mode
+                          flag  to  be  set  in the RA flag options field. The
+                          value of this option is a string and  the  following
+                          values  can  be defined - "slaac", "dhcpv6_stateful"
+                          and "dhcpv6_stateless".
+
+                   ā€¢      slla
+
+                          Mandatory parameter which specifies  the  link-layer
+                          address  of  the interface from which the Router Adā€
+                          vertisement is sent.
+
+                   ā€¢      mtu
+
+                          Optional parameter which specifies the MTU.
+
+                   ā€¢      prefix
+
+                          Optional parameter which should be specified if  the
+                          addr_mode  is  "slaac"  or  "dhcpv6_stateless".  The
+                          value should be an IPv6 prefix which  will  be  used
+                          for  stateless  IPv6 address configuration. This opā€
+                          tion can be defined multiple times.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   Valid only in the ingress pipeline.
+
+                   When this action is applied to an IPv6 Router  solicitation
+                   request  packet,  it changes the packet into an IPv6 Router
+                   Advertisement reply and adds the options specified  in  the
+                   parameters, and stores 1 in R.
+
+                   When  this action is applied to a non-IPv6 Router solicitaā€
+                   tion packet or an invalid IPv6 request packet ,  it  leaves
+                   the packet unchanged and stores 0 in R.
+
+                   Example: reg0[3] = put_nd_ra_opts(addr_mode = "slaac", slla
+                   = 00:00:00:00:10:02, prefix = aef0::/64, mtu = 1450);
+
+              set_meter(rate);
+              set_meter(rate, burst);
+                   Parameters:  rate  limit int field rate in kbps, burst rate
+                   limits int field burst in kbps.
+
+                   This action sets the rate limit for a flow.
+
+                   Example: set_meter(100, 1000);
+
+              R = check_pkt_larger(L)
+                   Parameters: packet length L to check for in bytes.
+
+                   Result: stored to a 1-bit subfield R.
+
+                   This   is   a   logical   equivalent   of   the    OpenFlow
+                   check_pkt_larger  action.  If the packet is larger than the
+                   length specified in L, it stores 1 in the subfield R.
+
+                   Example: reg0[6] = check_pkt_larger(1000);
+
+              log(key=value, ...);
+                     Causes ovn-controller to log the packet  on  the  chassis
+                     that processes it. Packet logging currently uses the same
+                     logging mechanism as other Open vSwitch and OVN messages,
+                     which  means  that  whether and where log messages appear
+                     depends on the local logging configuration  that  can  be
+                     configured with ovs-appctl, etc.
+
+                     The  log  action takes zero or more of the following key-
+                     value pair arguments that control what is logged:
+
+                     name=string
+                            An optional name for the ACL. The string  is  curā€
+                            rently limited to 64 bytes.
+
+                     severity=level
+                            Indicates  the severity of the event. The level is
+                            one of following  (from  more  to  less  serious):
+                            alert,  warning,  notice,  info,  or  debug.  If a
+                            severity is not provided, the default is info.
+
+                     verdict=value
+                            The verdict for packets  matching  the  flow.  The
+                            value must be one of allow, deny, or reject.
+
+                     meter=string
+                            An  optional  rate-limiting meter to be applied to
+                            the logs. The string should reference a name entry
+                            from the Meter table. The only meter  action  that
+                            is appropriate is drop.
+
+              fwd_group(liveness=bool, childports=port, ...);
+                     Parameters:  optional liveness, either true or false, deā€
+                     faulting to false; childports, a comma-delimited list  of
+                     strings denoting logical ports to load balance across.
+
+                     Load balance traffic to one or more child ports in a logā€
+                     ical switch. ovn-controller translates the fwd_group into
+                     an OpenFlow group with one bucket for each child port. If
+                     liveness=true is specified, it also integrates the bucket
+                     selection  with BFD status on the tunnel interface correā€
+                     sponding to child port.
+
+                     Example: fwd_group(liveness=true, childports="p1", "p2");
+
+              icmp4 { action; ... };
+              icmp4_error { action; ... };
+                   Temporarily replaces the IPv4 packet being processed by  an
+                   ICMPv4 packet and executes each nested action on the ICMPv4
+                   packet.  Actions  following these actions, if any, apply to
+                   the original, unmodified packet.
+
+                   The ICMPv4 packet that these actions operates  on  is  iniā€
+                   tialized  based on the IPv4 packet being processed, as folā€
+                   lows. These are default values that the nested actions will
+                   probably want to  change.  Ethernet  and  IPv4  fields  not
+                   listed here are not changed:
+
+                   ā€¢      ip.proto = 1 (ICMPv4)
+
+                   ā€¢      ip.frag = 0 (not a fragment)
+
+                   ā€¢      ip.ttl = 255
+
+                   ā€¢      icmp4.type = 3 (destination unreachable)
+
+                   ā€¢      icmp4.code = 1 (host unreachable)
+
+                   icmp4_error  action  is  expected to be used to generate an
+                   ICMPv4 packet in  response  to  an  error  in  original  IP
+                   packet.  When  this  action generates the ICMPv4 packet, it
+                   also copies the original IP datagram following  the  ICMPv4
+                   header as per RFC 1122: 3.2.2.
+
+                   Prerequisite: ip4
+
+              icmp6 { action; ... };
+              icmp6_error { action; ... };
+                   Temporarily  replaces the IPv6 packet being processed by an
+                   ICMPv6 packet and executes each nested action on the ICMPv6
+                   packet. Actions following the icmp6 action, if  any,  apply
+                   to the original, unmodified packet.
+
+                   The  ICMPv6 packet that this action operates on is initialā€
+                   ized based on the IPv6 packet being processed, as  follows.
+                   These are default values that the nested actions will probā€
+                   ably  want  to  change. Ethernet and IPv6 fields not listed
+                   here are not changed:
+
+                   ā€¢      ip.proto = 58 (ICMPv6)
+
+                   ā€¢      ip.ttl = 255
+
+                   ā€¢      icmp6.type = 1 (destination unreachable)
+
+                   ā€¢      icmp6.code = 1 (administratively prohibited)
+
+                   icmp6_error action is expected to be used  to  generate  an
+                   ICMPv6  packet  in  response  to  an error in original IPv6
+                   packet.
+
+                   Prerequisite: ip6
+
+              tcp_reset;
+                   This action transforms the current TCP packet according  to
+                   the following pseudocode:
+
+                   if (tcp.ack) {
+                           tcp.seq = tcp.ack;
+                   } else {
+                           tcp.ack = tcp.seq + length(tcp.payload);
+                           tcp.seq = 0;
+                   }
+                   tcp.flags = RST;
+
+                   Then,  the  action  drops all TCP options and payload data,
+                   and updates the TCP checksum. IP ttl is set to 255.
+
+                   Prerequisite: tcp
+
+              reject { action; ... };
+                   If the original packet is IPv4 or IPv6 TCP packet,  it  reā€
+                   places it with IPv4 or IPv6 TCP RST packet and executes the
+                   inner  actions.  Otherwise it replaces it with an ICMPv4 or
+                   ICMPv6 packet and executes the inner actions.
+
+                   The inner actions should not attempt  to  swap  eth  source
+                   with  eth  destination and IP source with IP destination as
+                   this action implicitly does that.
+
+              trigger_event;
+                   This action is used to allow ovs-vswitchd to report CMS reā€
+                   lated events writing them in Controller_Event table. It  is
+                   possible  to  associate a meter to a each event in order to
+                   not overload pinctrl thread under heavy load; each meter is
+                   identified though a defined  naming  convention.  Supported
+                   events:
+
+                   ā€¢      empty_lb_backends.  This  event  is  raised if a reā€
+                          ceived packet is destined for a  load  balancer  VIP
+                          that  has  no  configured  backend destinations. For
+                          this event, the event info includes  the  load  balā€
+                          ancer VIP, the load balancer UUID, and the transport
+                          protocol. Associated meter: event-elb
+
+              igmp;
+                   This  action  sends the packet to ovn-controller for multiā€
+                   cast snooping.
+
+                   Prerequisite: igmp
+
+              bind_vport(V, P);
+                   Parameters: logical port string field V  of  type  virtual,
+                   logical port string field P.
+
+                   Binds  the virtual logical port V and sets the chassis colā€
+                   umn and virtual_parent  of  the  table  Port_Binding.  virā€ā€
+                   tual_parent is set to P.
+
+              handle_svc_check(P);
+                   Parameters: logical port string field P.
+
+                   Handles  the service monitor reply received from the VIF of
+                   the logical port P. ovn-controller periodically  sends  out
+                   the  service monitor packets for the services configured in
+                   the Service_Monitor table and this action updates the  staā€
+                   tus of those services.
+
+                   Example: handle_svc_check(inport);
+
+              handle_dhcpv6_reply;
+                   Handle DHCPv6 prefix delegation advertisements/replies from
+                   a  IPv6 delegation server. ovn-controller will add an entry
+                   ipv6_ra_pd_list in the options table for  each  prefix  reā€
+                   ceived from the delegation server
+
+              R = select(N1[=W1], N2[=W2], ...);
+                   Parameters: Integer N1, N2..., with optional weight W1, W2,
+                   ...
+
+                   Result: stored to a logical field or subfield R.
+
+                   Select  from  a list of integers N1, N2..., each within the
+                   range 0 ~ 65535, and store the selected one in the field R.
+                   There must be 2 or more integers listed, each with  an  opā€
+                   tional  weight,  which  is  an integer within the range 1 ~
+                   65535. If weight is not specified, it defaults to 100.  The
+                   selection  method  is  based  on the 5-tuple hash of packet
+                   header.
+
+                   Processing automatically moves on to the next table, as  if
+                   next;  were specified. The select action must be put as the
+                   last action of the logical flow when there are multiple acā€
+                   tions (actions put after select will not take effect).
+
+                   Example: reg8[16..31] = select(1=20, 2=30, 3=50);
+
+              handle_dhcpv6_reply;
+                   This action is used to parse DHCPv6 replies from IPv6 Deleā€
+                   gation Router and managed IPv6 Prefix delegation state  maā€
+                   chine
+
+              R = chk_lb_hairpin();
+                   This  action  checks  if the packet under consideration was
+                   destined to a load balancer VIP and it is hairpinned, i.e.,
+                   after load balancing the destination IP matches the  source
+                   IP.  If  it is so, then the 1-bit destination register R is
+                   set to 1.
+
+              R = chk_lb_hairpin_reply();
+                   This action checks if the  packet  under  consideration  is
+                   from  one  of the backend IP of a load balancer VIP and the
+                   destination IP is the load balancer VIP. If it is so,  then
+                   the 1-bit destination register R is set to 1.
+
+              R = ct_snat_to_vip;
+                   This  action  sends  the  packet  through  the SNAT zone to
+                   change the source IP address of the packet to the load balā€
+                   ancer VIP if the original destination IP was load  balancer
+                   VIP  and  commits  the connection. This action applies sucā€
+                   cessfully only for the hairpinned traffic i.e if the action
+                   chk_lb_hairpin returned success. This action  doesnā€™t  take
+                   any arguments and it determines the SNAT IP internally. The
+                   packet  is  not  automatically  sent to the next table. The
+                   caller has to execute the  next;  action  explicitly  after
+                   this action to advance the packet to the next stage.
+
+              R = check_in_port_sec();
+                   This action checks if the packet under consideration passes
+                   the  inport  port  security checks. If the packet fails the
+                   port security checks, then 1 is stored in  the  destination
+                   register  R.  Else 0 is stored. The port security values to
+                   check are retrieved from the the inport logical port.
+
+                   This action should be used in the  ingress  logical  switch
+                   pipeline.
+
+                   Example: reg8[0..7] = check_in_port_sec();
+
+              R = check_out_port_sec();
+                   This action checks if the packet under consideration passes
+                   the  outport  port security checks. If the packet fails the
+                   port security checks, then 1 is stored in  the  destination
+                   register  R.  Else 0 is stored. The port security values to
+                   check are retrieved from the the outport logical port.
+
+                   This action should be used in  the  egress  logical  switch
+                   pipeline.
+
+                   Example: reg8[0..7] = check_out_port_sec();
+
+              commit_ecmp_nh(ipv6);
+                   Parameters: IPv4/IPv6 traffic.
+
+                   This  action  translates to an openflow "learn" action that
+                   inserts two new flows in tables 76 and 77.
+
+                   ā€¢      Match on the the 5-tuple and the  expected  next-hop
+                          mac  address  in  table  76: nw_src=ip0, nw_dst=ip1,
+                          ip_proto,tp_src=l4_port0,
+                          tp_dst=l4_port1,dl_src=ethaddr and set reg9[5].
+
+                   ā€¢      Match  on  the  5-tuple  in  table  77:  nw_src=ip1,
+                          nw_dst=ip0,        ip_proto,        tp_src=l4_port1,
+                          tp_dst=l4_port0 and set reg9[5] to 1
+
+                   This action is applied if the packet arrives via ECMP route
+                   or if it is routed via an ECMP route
+
+              R = check_ecmp_nh_mac();
+                   This  action  checks  if  the  packet  under  consideration
+                   matches  any  flow in table 76. If it is so, then the 1-bit
+                   destination register R is set to 1.
+
+              R = check_ecmp_nh();
+                   This  action  checks  if  the  packet  under  consideration
+                   matches  the  any  flow  in table 77. If it is so, then the
+                   1-bit destination register R is set to 1.
+
+                   commit_lb_aff(vip, backend,  proto,  timeout);  Parameters:
+                   load-balancer  virtual  ip:port  vip, load-balancer backend
+                   ip:port backend,  load-balancer  protocol  proto,  affinity
+                   timeout timeout.
+
+                   This  action  translates to an openflow "learn" action that
+                   inserts a new flow in table 78.
+
+                   ā€¢      Match on the 4-tuple in table 78: nw_src=ip  client,
+                          nw_dst=vip  ip,  ip_proto,  tp_dst=vip  port and set
+                          reg9[6] to 1, reg4 and reg8 to backend ip  and  port
+                          respectively.  For  IPv6  register xxreg1 is used to
+                          store the backend ip.
+
+                   This action is applied for new connections  received  by  a
+                   specific load-balacer with affinity timeout configured.
+
+              R = chk_lb_aff();
+                   This  action  checks  if  the  packet  under  consideration
+                   matches any flow in table 78. If it is so, then  the  1-bit
+                   destination register R is set to 1.
+
+              sample(probability=packets, ...)
+                   This  action causes the matched traffic to be sampled using
+                   IPFIX protocol. More information about how  per-flow  IPFIX
+                   sampling  works  in  OVS can be found in ovs-actions(7) and
+                   ovs-vswitchd.conf.db(5).
+
+                   In order to reliably identify each sampled packet  when  it
+                   is  received  by  the IPFIX collector, this action sets the
+                   content of the ObservationDomainID  and  ObservationPointID
+                   IPFIX fields (see argument description below).
+
+                   The following key-value arguments are supported:
+
+                   probability=packets
+                          The  number of sampled packets out of 65535. It must
+                          be greater or equal to 1.
+
+                   collector_set=id
+                          The unsigned 32-bit integer identifier of the sample
+                          collector to send sampled packets to. It must  match
+                          the  value  configured  in  the  Flow_Sample_Collecā€ā€
+                          tor_Set Table in OVS. Defaults to 0.
+
+                   obs_domain=id
+                          An unsigned 8-bit integer that identifies  the  samā€
+                          pling  application.  It will be placed in the 8 most
+                          significant bits of the ObservationDomainID field of
+                          IPFIX samples. The 24 less significant bits will  be
+                          automatically  filled  in with the datapath key. Deā€
+                          faults to 0.
+
+                   obs_point=id
+                          An unsigned 32-bit integer to be used  as  Obsservaā€ā€
+                          tionPointID  or  the string @cookie to indicate that
+                          the first 32 bits of the Logical_Flowā€™s  UUID  shall
+                          be used instead.
+
+       tags: map of string-string pairs
+              Key-value pairs that provide additional information to help ovn-
+              controller  processing the logical flow. Below are the tags used
+              by ovn-controller.
+
+              in_out_port
+                     In the logical flowā€™s "match" column, if a logical port P
+                     is compared with "inport" and the logical flow  is  on  a
+                     logical switch ingress pipeline, or if P is compared with
+                     "outport"  and  the  logical  flow is on a logical switch
+                     egress pipeline, and  the  expression  is  combined  with
+                     other  expressions  (if  any) using the operator &&, then
+                     the port P should be added as the value in this  tag.  If
+                     there  are  multiple logical ports meeting this criteria,
+                     one of them can be added. ovn-controller uses this inforā€
+                     mation to skip parsing flows that are not needed  on  the
+                     chassis.  Failing  to add the tag will affect efficiency,
+                     while adding wrong value will affect correctness.
+
+       controller_meter: optional string
+              The name of the meter in table Meter to be used for all  packets
+              that the logical flow might send to ovn-controller.
+
+       external_ids : stage-name: optional string
+              Human-readable name for this flowā€™s stage in the pipeline.
+
+       external_ids : stage-hint: optional string, containing an uuid
+              UUID of a OVN_Northbound record that caused this logical flow to
+              be  created.  Currently used only for attribute of logical flows
+              to northbound ACL records.
+
+       external_ids : source: optional string
+              Source file and line number of the code that added this flow  to
+              the pipeline.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Logical_DP_Group TABLE
+       Each row in this table represents a group of logical  datapaths  referā€
+       enced by the logical_dp_group column in the Logical_Flow table.
+
+   Summary:
+       datapaths                     set  of  weak reference to Datapath_Bindā€ā€
+                                     ings
+
+   Details:
+       datapaths: set of weak reference to Datapath_Bindings
+              List of Datapath_Binding entries.
+
+Multicast_Group TABLE
+       The rows in this table define multicast groups of logical ports. Multiā€
+       cast groups allow a single packet transmitted over a tunnel to a hyperā€
+       visor to be delivered to multiple VMs on that  hypervisor,  which  uses
+       bandwidth more efficiently.
+
+       Each  row in this table defines a logical multicast group numbered tunā€ā€
+       nel_key within datapath, whose logical ports are listed  in  the  ports
+       column.
+
+   Summary:
+       datapath                      Datapath_Binding
+       tunnel_key                    integer, in range 32,768 to 65,535
+       name                          string
+       ports                         set of weak reference to Port_Bindings
+
+   Details:
+       datapath: Datapath_Binding
+              The logical datapath in which the multicast group resides.
+
+       tunnel_key: integer, in range 32,768 to 65,535
+              The  value  used to designate this logical egress port in tunnel
+              encapsulations. An index forces the key to be unique within  the
+              datapath.  The unusual range ensures that multicast group IDs do
+              not overlap with logical port IDs.
+
+       name: string
+              The logical multicast groupā€™s name. An index forces the name  to
+              be  unique  within  the  datapath.  Logical flows in the ingress
+              pipeline may output to the group just as for individual  logical
+              ports, by assigning the groupā€™s name to outport and executing an
+              output action.
+
+              Multicast  group  names  and  logical  port names share a single
+              namespace and thus should not overlap (but the  database  schema
+              cannot enforce this). To try to avoid conflicts, ovn-northd uses
+              names that begin with _MC_.
+
+       ports: set of weak reference to Port_Bindings
+              The  logical ports included in the multicast group. All of these
+              ports must be in the datapath logical datapath (but the database
+              schema cannot enforce this).
+
+Mirror TABLE
+       Each row in this table represents a mirror that can be  used  for  port
+       mirroring.  These  mirrors are referenced by the mirror_rules column in
+       the Port_Binding table.
+
+   Summary:
+       name                          string (must be unique within table)
+       filter                        string,  one  of  both,  from-lport,   or
+                                     to-lport
+       sink                          string
+       type                          string, one of erspan, gre, or local
+       index                         integer
+       external_ids                  map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Represents the name of the mirror.
+
+       filter: string, one of both, from-lport, or to-lport
+              The  value  of  this  field represents selection criteria of the
+              mirror. to-lport mirrors the packets coming into  logical  port.
+              from-lport  mirrors  the packets going out of logical port. both
+              mirrors for both directions.
+
+       sink: string
+              The value of this field represents the destination/sink  of  the
+              mirror.  If  the  type is gre or erspan, the value indicates the
+              tunnel remote IP (either IPv4 or IPv6). For  a  type  of  local,
+              this  field  defines  a  local  interface on the OVS integration
+              bridge to be used as the mirror destination. The interface  must
+              possess external-ids:mirror-id that matches this string.
+
+       type: string, one of erspan, gre, or local
+              The  value of this field specifies the mirror type - gre, erspan
+              or local.
+
+       index: integer
+              The value of this field represents the tunnel ID. If the configā€
+              ured tunnel type is gre, this field represents the GRE key value
+              and if the configured tunnel type is erspan  it  represents  the
+              erspan_idx value. It is ignored if the type is local.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Meter TABLE
+       Each  row  in this table represents a meter that can be used for QoS or
+       rate-limiting.
+
+   Summary:
+       name                          string (must be unique within table)
+       unit                          string, either kbps or pktps
+       bands                         set of 1 or more Meter_Bands
+
+   Details:
+       name: string (must be unique within table)
+              A name for this meter.
+
+              Names that begin with "__" (two underscores)  are  reserved  for
+              OVN internal use and should not be added manually.
+
+       unit: string, either kbps or pktps
+              The  unit for rate and burst_rate parameters in the bands entry.
+              kbps specifies kilobits per second, and pktps specifies  packets
+              per second.
+
+       bands: set of 1 or more Meter_Bands
+              The bands associated with this meter. Each band specifies a rate
+              above  which  the band is to take the action action. If multiple
+              bandsā€™ rates are exceeded, then the band with the  highest  rate
+              among the exceeded bands is selected.
+
+Meter_Band TABLE
+       Each row in this table represents a meter band which specifies the rate
+       above  which  the  configured action should be applied. These bands are
+       referenced by the bands column in the Meter table.
+
+   Summary:
+       action                        string, must be drop
+       rate                          integer, in range 1 to 4,294,967,295
+       burst_size                    integer, in range 0 to 4,294,967,295
+
+   Details:
+       action: string, must be drop
+              The action to execute when this band matches. The only supported
+              action is drop.
+
+       rate: integer, in range 1 to 4,294,967,295
+              The rate limit for this band, in kilobits per second or bits per
+              second, depending on whether the parent Meter entryā€™s unit  colā€
+              umn specified kbps or pktps.
+
+       burst_size: integer, in range 0 to 4,294,967,295
+              The  maximum  burst allowed for the band in kilobits or packets,
+              depending on whether kbps or pktps was selected  in  the  parent
+              Meter  entryā€™s  unit  column. If the size is zero, the switch is
+              free to select some reasonable value depending on its configuraā€
+              tion.
+Datapath_Binding TABLE
+       Each row in this table represents a logical datapath, which  implements
+       a logical pipeline among the ports in the Port_Binding table associated
+       with  it.  In practice, the pipeline in a given logical datapath impleā€
+       ments either a logical switch or a logical router.
+
+       The main purpose of a row in this table is provide a  physical  binding
+       for a logical datapath. A logical datapath does not have a physical loā€
+       cation,  so  its  physical  binding  information  is limited: just tunā€ā€
+       nel_key. The rest of the data in this table does not affect packet forā€
+       warding.
+
+   Summary:
+       tunnel_key                    integer, in range 1 to  16,777,215  (must
+                                     be unique within table)
+       load_balancers                set of uuids
+       OVN_Northbound Relationship:
+         external_ids : logical-switch
+                                     optional string, containing an uuid
+         external_ids : logical-router
+                                     optional string, containing an uuid
+         external_ids : interconn-ts
+                                     optional string
+         Naming:
+            external_ids : name      optional string
+            external_ids : name2     optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       tunnel_key: integer, in range 1 to 16,777,215 (must be unique within
+       table)
+              The tunnel key value to which the logical datapath is bound. The
+              Tunnel  Encapsulation  section  in ovn-architecture(7) describes
+              how tunnel keys are constructed for  each  supported  encapsulaā€
+              tion.
+
+       load_balancers: set of uuids
+              Not  used  anymore;  kept  for  backwards  compatibility  of the
+              schema.
+
+     OVN_Northbound Relationship:
+
+       Each row in Datapath_Binding is associated with some logical  datapath.
+       ovn-northd  uses these keys to track the association of a logical dataā€
+       path with concepts in the OVN_Northbound database.
+
+       external_ids : logical-switch: optional string, containing an uuid
+              For  a  logical  datapath  that  represents  a  logical  switch,
+              ovn-northd stores in this key the UUID of the corresponding Logā€ā€
+              ical_Switch row in the OVN_Northbound database.
+
+       external_ids : logical-router: optional string, containing an uuid
+              For  a  logical  datapath  that  represents  a  logical  router,
+              ovn-northd stores in this key the UUID of the corresponding Logā€ā€
+              ical_Router row in the OVN_Northbound database.
+
+       external_ids : interconn-ts: optional string
+              For a logical datapath that represents  a  logical  switch  that
+              represents  a  transit  switch  for  interconnection, ovn-northd
+              stores in this key the value of the same interconn-ts key of the
+              external_ids column of the corresponding Logical_Switch  row  in
+              the OVN_Northbound database.
+
+     Naming:
+
+       ovn-northd  copies  these  from  the  name fields in the OVN_Northbound
+       database, either from name and external_ids:neutron:router_name in  the
+       Logical_Router table or from name and external_ids:neutron:network_name
+       in the Logical_Switch table.
+
+       external_ids : name: optional string
+              A name for the logical datapath.
+
+       external_ids : name2: optional string
+              Another name for the logical datapath.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+Port_Binding TABLE
+       Each row in this table binds a logical port to a realization. For  most
+       logical  ports, this means binding to some physical location, for examā€
+       ple by binding a logical port to a VIF that belongs to a VM running  on
+       a  particular  hypervisor.  Other  logical ports, such as logical patch
+       ports, can be realized without a specific physical location, but  their
+       bindings are still expressed through rows in this table.
+
+       For   every  Logical_Switch_Port  record  in  OVN_Northbound  database,
+       ovn-northd creates a record in this  table.  ovn-northd  populates  and
+       maintains  every  column except the chassis and virtual_parent columns,
+       which it leaves empty in new records.
+
+       ovn-controller/ovn-controller-vtep populates the chassis column for the
+       records that identify the logical ports that are located on its  hyperā€
+       visor/gateway,  which  ovn-controller/ovn-controller-vtep in turn finds
+       out by monitoring the local hypervisorā€™s Open_vSwitch  database,  which
+       identifies  logical  ports  via  the  conventions described in Integraā€ā€
+       tionGuide.rst. (The exceptions are for Port_Binding records  with  type
+       of  l3gateway, whose locations are identified by ovn-northd via the opā€ā€
+       tions:l3gateway-chassis column in this table. ovn-controller  is  still
+       responsible to populate the chassis column.)
+
+       ovn-controller  also  populates  the  virtual_parent  column of records
+       whose type is virtual.
+
+       When a chassis shuts down gracefully, it should clean  up  the  chassis
+       column  that it previously had populated. (This is not critical because
+       resources hosted on the chassis are equally unreachable  regardless  of
+       whether  their rows are present.) To handle the case where a VM is shut
+       down abruptly on one chassis, then brought up again on a different one,
+       ovn-controller/ovn-controller-vtep must overwrite  the  chassis  column
+       with new information.
+
+   Summary:
+       Core Features:
+         datapath                    Datapath_Binding
+         logical_port                string (must be unique within table)
+         encap                       optional weak reference to Encap
+         additional_encap            set of weak reference to Encaps
+         chassis                     optional weak reference to Chassis
+         additional_chassis          set of weak reference to Chassis
+         gateway_chassis             set of Gateway_Chassises
+         ha_chassis_group            optional HA_Chassis_Group
+         up                          optional boolean
+         tunnel_key                  integer, in range 1 to 32,767
+         mac                         set of strings
+         port_security               set of strings
+         type                        string
+         requested_chassis           optional weak reference to Chassis
+         requested_additional_chassis
+                                     set of weak reference to Chassis
+       mirror_rules                  set of weak reference to Mirrors
+       Patch Options:
+         options : peer              optional string
+         nat_addresses               set of strings
+       L3 Gateway Options:
+         options : peer              optional string
+         options : l3gateway-chassis
+                                     optional string
+         nat_addresses               set of strings
+       Localnet Options:
+         options : network_name      optional string
+         tag                         optional integer, in range 1 to 4,095
+       L2 Gateway Options:
+         options : network_name      optional string
+         options : l2gateway-chassis
+                                     optional string
+         tag                         optional integer, in range 1 to 4,095
+       VTEP Options:
+         options : vtep-physical-switch
+                                     optional string
+         options : vtep-logical-switch
+                                     optional string
+       VMI (or VIF) Options:
+         options : requested-chassis
+                                     optional string
+         options : activation-strategy
+                                     optional string
+         options : additional-chassis-activated
+                                     optional string
+         options : iface-id-ver      optional string
+         options : qos_min_rate      optional string
+         options : qos_max_rate      optional string
+         options : qos_burst         optional string
+         options : qos_physical_network
+                                     optional string
+         options : qdisc_queue_id    optional  string,  containing an integer,
+                                     in range 1 to 61,440
+       Distributed Gateway Port Options:
+         options : chassis-redirect-port
+                                     optional string
+       Chassis Redirect Options:
+         options : distributed-port  optional string
+         options : redirect-type     optional string
+         options : always-redirect   optional string
+       Nested Containers:
+         parent_port                 optional string
+         tag                         optional integer, in range 1 to 4,095
+       Virtual ports:
+         virtual_parent              optional string
+       Naming:
+         external_ids : name         optional string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       datapath: Datapath_Binding
+              The logical datapath to which the logical port belongs.
+
+       logical_port: string (must be unique within table)
+              A logical port. For a logical switch port, this  is  taken  from
+              name in the OVN_Northbound databaseā€™s Logical_Switch_Port table.
+              For  a  logical  router  port,  this  is  taken from name in the
+              OVN_Northbound databaseā€™s Logical_Router_port table. (This means
+              that logical switch ports and router port names must  not  share
+              names in an OVN deployment.) OVN does not prescribe a particular
+              format for the logical port ID.
+
+       encap: optional weak reference to Encap
+              Points to preferred encapsulation configuration to transmit logā€
+              ical  dataplane  packets to this chassis. The entry is reference
+              to a Encap record.
+
+       additional_encap: set of weak reference to Encaps
+              Points to preferred encapsulation configuration to transmit logā€
+              ical dataplane packets to this additional chassis. The entry  is
+              reference to a Encap record. See also additional_chassis.
+
+       chassis: optional weak reference to Chassis
+              The meaning of this column depends on the value of the type colā€
+              umn. This is the meaning for each type
+
+              (empty string)
+                     The  physical  location  of the logical port. To successā€
+                     fully identify a chassis, this column must be  a  Chassis
+                     record. This is populated by ovn-controller.
+
+              vtep   The  physical  location  of the hardware_vtep gateway. To
+                     successfully identify a chassis, this column  must  be  a
+                     Chassis record. This is populated by ovn-controller-vtep.
+
+              localnet
+                     Always  empty. A localnet port is realized on every chasā€
+                     sis that has connectivity to the  corresponding  physical
+                     network.
+
+              localport
+                     Always  empty. A localport port is present on every chasā€
+                     sis.
+
+              l3gateway
+                     The physical location of the L3 gateway. To  successfully
+                     identify a chassis, this column must be a Chassis record.
+                     This is populated by ovn-controller based on the value of
+                     the options:l3gateway-chassis column in this table.
+
+              l2gateway
+                     The physical location of this L2 gateway. To successfully
+                     identify a chassis, this column must be a Chassis record.
+                     This is populated by ovn-controller based on the value of
+                     the options:l2gateway-chassis column in this table.
+
+       additional_chassis: set of weak reference to Chassis
+              The  meaning  of this column is the same as for the chassis. The
+              column is used to track an additional physical location  of  the
+              logical port. Used with regular (empty type) port bindings.
+
+       gateway_chassis: set of Gateway_Chassises
+              A list of Gateway_Chassis.
+
+              This  should  only be populated for ports with type set to chasā€ā€
+              sisredirect. This column defines the list  of  chassis  used  as
+              gateways where traffic will be redirected through.
+
+       ha_chassis_group: optional HA_Chassis_Group
+              This  should  only be populated for ports with type set to chasā€ā€
+              sisredirect. This column defines the HA  chassis  group  with  a
+              list  of HA chassis used as gateways where traffic will be rediā€
+              rected through.
+
+       up: optional boolean
+              This is set to true whenever all  OVS  flows  required  by  this
+              Port_Binding  have been installed. This is populated by ovn-conā€ā€
+              troller.
+
+       tunnel_key: integer, in range 1 to 32,767
+              A number that represents the logical port in the key  (e.g.  STT
+              key or Geneve TLV) field carried within tunnel protocol packets.
+
+              The tunnel ID must be unique within the scope of a logical dataā€
+              path.
+
+       mac: set of strings
+              This column is a misnomer as it may contain MAC addresses and IP
+              addresses.  It  is copied from the addresses column in the Logiā€ā€
+              cal_Switch_Port table in the Northbound database. It follows the
+              same format as that column.
+
+       port_security: set of strings
+              This column controls the addresses from which the host  attached
+              to  the  logical  port (``the hostā€™ā€™) is allowed to send packets
+              and to which it is allowed to receive packets. If this column is
+              empty, all addresses are permitted.
+
+              It  is  copied  from  the  port_security  column  in  the  Logiā€ā€
+              cal_Switch_Port table in the Northbound database. It follows the
+              same format as that column.
+
+       type: string
+              A type for this logical port. Logical ports can be used to model
+              other types of connectivity into an OVN logical switch. The folā€
+              lowing types are defined:
+
+              (empty string)
+                     VM (or VIF) interface.
+
+              patch  One  of  a pair of logical ports that act as if connected
+                     by a patch cable. Useful for connecting two logical dataā€
+                     paths, e.g. to connect a  logical  router  to  a  logical
+                     switch or to another logical router.
+
+              l3gateway
+                     One  of  a pair of logical ports that act as if connected
+                     by a patch cable across multiple chassis. Useful for conā€
+                     necting a logical switch with a Gateway router (which  is
+                     only resident on a particular chassis).
+
+              localnet
+                     A   connection  to  a  locally  accessible  network  from
+                     ovn-controller instances that have a corresponding bridge
+                     mapping. A logical  switch  can  have  multiple  localnet
+                     ports attached. This type is used to model direct connecā€
+                     tivity  to  existing networks. In this case, each chassis
+                     should have a mapping for one of  the  physical  networks
+                     only.  Note:  nothing  said  above implies that a chassis
+                     cannot be plugged to multiple physical networks  as  long
+                     as they belong to different switches.
+
+              localport
+                     A  connection  to  a local VIF. Traffic that arrives on a
+                     localport is never forwarded over  a  tunnel  to  another
+                     chassis.  These  ports  are  present on every chassis and
+                     have the same address in all of them.  This  is  used  to
+                     model  connectivity  to  local services that run on every
+                     hypervisor.
+
+              l2gateway
+                     An L2 connection to a physical network. The chassis  this
+                     Port_Binding  is  bound to will serve as an L2 gateway to
+                     the network named by options:network_name.
+
+              vtep   A port to a logical switch on a VTEP gateway chassis.  In
+                     order  to  get  this port correctly recognized by the OVN
+                     controller,  the  options:vtep-physical-switch  and   opā€ā€
+                     tions:vtep-logical-switch must also be defined.
+
+              chassisredirect
+                     A  logical  port  that  represents a particular instance,
+                     bound to a specific chassis, of an otherwise  distributed
+                     parent  port (e.g. of type patch). A chassisredirect port
+                     should never be  used  as  an  inport.  When  an  ingress
+                     pipeline sets the outport, it may set the value to a logā€
+                     ical  port  of  type chassisredirect. This will cause the
+                     packet to be directed to a specific chassis to carry  out
+                     the  egress  pipeline.  At  the  beginning  of the egress
+                     pipeline, the outport will be reset to the value  of  the
+                     distributed port.
+
+              virtual
+                     Represents  a  logical port with an virtual ip. This virā€ā€
+                     tual ip can be configured on a logical port (which is reā€
+                     ferred as virtual parent).
+
+       requested_chassis: optional weak reference to Chassis
+              This column exists so that the  ovn-controller  can  effectively
+              monitor  all Port_Binding records destined for it, and is a supā€
+              plement to the options:requested-chassis option. The  option  is
+              still  required so that the ovn-controller can check the CMS inā€
+              tent when the chassis pointed to does not currently exist, which
+              for example occurs when the ovn-controller  is  stopped  without
+              passing  the  -restart  argument.  This column must be a Chassis
+              record. This is populated by  ovn-northd  when  the  options:reā€ā€
+              quested-chassis  is  defined  and contains a string matching the
+              name or hostname of an existing chassis. See also  requested_adā€ā€
+              ditional_chassis.
+
+       requested_additional_chassis: set of weak reference to Chassis
+              This  column  exists  so that the ovn-controller can effectively
+              monitor all Port_Binding records destined for it, and is a  supā€
+              plement  to  the  options:requested-chassis option when multiple
+              chassis are listed. This  column  must  be  a  list  of  Chassis
+              records.  This  is  populated by ovn-northd when the options:reā€ā€
+              quested-chassis is defined as a list of chassis names  or  hostā€
+              names. See also requested_chassis.
+
+       mirror_rules: set of weak reference to Mirrors
+              Mirror rules that apply to the port binding. Please see the Mirā€ā€
+              ror table.
+
+     Patch Options:
+
+       These options apply to logical ports with type of patch.
+
+       options : peer: optional string
+              The  logical_port  in the Port_Binding record for the other side
+              of the patch. The named logical_port  must  specify  this  logiā€ā€
+              cal_port  in its own peer option. That is, the two patch logical
+              ports must have reversed logical_port and peer values.
+
+       nat_addresses: set of strings
+              MAC address followed by a list of SNAT and DNAT external IP  adā€
+              dresses,  followed  by is_chassis_resident("lport"), where lport
+              is the name of a logical port on the same chassis where the corā€
+              responding NAT rules are applied. This is used  to  send  gratuā€
+              itous ARPs for SNAT and DNAT external IP addresses via localnet,
+              from the chassis where lport resides. Example: 80:fa:5b:06:72:b7
+              158.36.44.22   158.36.44.24   is_chassis_resident("foo1").  This
+              would result in generation of gratuitous ARPs for  IP  addresses
+              158.36.44.22   and   158.36.44.24   with   a   MAC   address  of
+              80:fa:5b:06:72:b7 from the chassis where the logical port "foo1"
+              resides.
+
+     L3 Gateway Options:
+
+       These options apply to logical ports with type of l3gateway.
+
+       options : peer: optional string
+              The logical_port in the Port_Binding record for the  other  side
+              of  the  ā€™l3gatewayā€™  port.  The named logical_port must specify
+              this logical_port in its own  peer  option.  That  is,  the  two
+              ā€™l3gatewayā€™  logical  ports  must have reversed logical_port and
+              peer values.
+
+       options : l3gateway-chassis: optional string
+              The chassis in which the port resides.
+
+       nat_addresses: set of strings
+              MAC address of the l3gateway port followed by a list of SNAT and
+              DNAT external IP addresses. This is used to send gratuitous ARPs
+              for SNAT and DNAT external IP addresses via  localnet.  Example:
+              80:fa:5b:06:72:b7  158.36.44.22  158.36.44.24. This would result
+              in generation of gratuitous ARPs for IP  addresses  158.36.44.22
+              and  158.36.44.24  with a MAC address of 80:fa:5b:06:72:b7. This
+              is used in OVS version 2.8 and later versions.
+
+     Localnet Options:
+
+       These options apply to logical ports with type of localnet.
+
+       options : network_name: optional string
+              Required.   ovn-controller   uses   the   configuration    entry
+              ovn-bridge-mappings to determine how to connect to this network.
+              ovn-bridge-mappings is a list of network names mapped to a local
+              OVS  bridge  that provides access to that network. An example of
+              configuring ovn-bridge-mappings would be: .IP
+              $ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1
+
+              When a logical switch has a localnet port attached, every  chasā€
+              sis  that  may  have a local vif attached to that logical switch
+              must have a bridge mapping configured to  reach  that  localnet.
+              Traffic  that arrives on a localnet port is never forwarded over
+              a tunnel to another chassis.  If  there  are  multiple  localnet
+              ports  in a logical switch, each chassis should only have a sinā€
+              gle bridge mapping for one of the physical  networks.  Note:  In
+              case  of  multiple  localnet ports, to provide interconnectivity
+              between all VIFs located on  different  chassis  with  different
+              fabric  connectivity,  the  fabric should implement some form of
+              routing between the segments.
+
+       tag: optional integer, in range 1 to 4,095
+              If set, indicates that the port represents  a  connection  to  a
+              specific  VLAN  on  a locally accessible network. The VLAN ID is
+              used to match incoming traffic and is  also  added  to  outgoing
+              traffic.
+
+     L2 Gateway Options:
+
+       These options apply to logical ports with type of l2gateway.
+
+       options : network_name: optional string
+              Required.    ovn-controller   uses   the   configuration   entry
+              ovn-bridge-mappings to determine how to connect to this network.
+              ovn-bridge-mappings is a list of network names mapped to a local
+              OVS bridge that provides access to that network. An  example  of
+              configuring ovn-bridge-mappings would be: .IP
+              $ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1
+
+              When a logical switch has a l2gateway port attached, the chassis
+              that  the  l2gateway port is bound to must have a bridge mapping
+              configured to reach the network identified by network_name.
+
+       options : l2gateway-chassis: optional string
+              Required. The chassis in which the port resides.
+
+       tag: optional integer, in range 1 to 4,095
+              If set, indicates that the gateway is connected  to  a  specific
+              VLAN  on  the physical network. The VLAN ID is used to match inā€
+              coming traffic and is also added to outgoing traffic.
+
+     VTEP Options:
+
+       These options apply to logical ports with type of vtep.
+
+       options : vtep-physical-switch: optional string
+              Required. The name of the VTEP gateway.
+
+       options : vtep-logical-switch: optional string
+              Required. A logical switch name connected by the  VTEP  gateway.
+              Must be set when type is vtep.
+
+     VMI (or VIF) Options:
+
+       These options apply to logical ports with type having (empty string)
+
+       options : requested-chassis: optional string
+              If set, identifies a specific chassis (by name or hostname) that
+              is  allowed  to  bind  this port. Using this option will prevent
+              thrashing between two chassis trying to bind the same port  durā€
+              ing  a live migration. It can also prevent similar thrashing due
+              to a mis-configuration, if a port  is  accidentally  created  on
+              more than one chassis.
+
+              If set to a comma separated list, the first entry identifies the
+              main  chassis  and  the  rest are one or more additional chassis
+              that are allowed to bind the same port.
+
+              When multiple chassis are set for  the  port,  and  the  logical
+              switch  is  connected  to an external network through a localnet
+              port, tunneling is enforced for the port to  guarantee  delivery
+              of  packets  directed to the port to all its locations. This has
+              MTU implications because the network  used  for  tunneling  must
+              have MTU larger than localnet for stable connectivity.
+
+       options : activation-strategy: optional string
+              If  used  with multiple chassis set in requested-chassis, speciā€
+              fies an activation strategy for all additional chassis.  By  deā€
+              fault,  no  activation strategy is used, meaning additional port
+              locations are immediately available for use. When set to "rarp",
+              the port is blocked for ingress and egress communication until a
+              RARP packet is sent from a new location. The "rarp" strategy  is
+              useful in live migration scenarios for virtual machines.
+
+       options : additional-chassis-activated: optional string
+              When  activation-strategy is set, this option indicates that the
+              port was activated using the strategy specified.
+
+       options : iface-id-ver: optional string
+              If set, this port will be bound by ovn-controller only  if  this
+              same  key  and value is configured in the external_ids column in
+              the Open_vSwitch databaseā€™s Interface table.
+
+       options : qos_min_rate: optional string
+              If set, indicates the minimum guaranteed rate available for data
+              sent from this interface, in bit/s.
+
+       options : qos_max_rate: optional string
+              If set, indicates the maximum rate for data sent from  this  inā€
+              terface,  in bit/s. The traffic will be shaped according to this
+              limit.
+
+       options : qos_burst: optional string
+              If set, indicates the maximum burst size for data sent from this
+              interface, in bits.
+
+       options : qos_physical_network: optional string
+              If set, indicates the name of  the  egress  network  name  where
+              traffic shaping will be applied.
+
+       options : qdisc_queue_id: optional string, containing an integer, in
+       range 1 to 61,440
+              Indicates  the queue number on the physical device. This is same
+              as the queue_id used in OpenFlow in struct ofp_action_enqueue.
+
+     Distributed Gateway Port Options:
+
+       These options apply to the distributed parent ports  of  logical  ports
+       with type of chasssisredirect.
+
+       options : chassis-redirect-port: optional string
+              The  name of the chassis redirect port derived from this port if
+              this port is a distributed parent of a chassis redirect port.
+
+     Chassis Redirect Options:
+
+       These options apply to logical ports with type of chassisredirect.
+
+       options : distributed-port: optional string
+              The name of the distributed port for which this  chassisredirect
+              port represents a particular instance.
+
+       options : redirect-type: optional string
+              The  value  is  copied from the column options in the OVN_Northā€
+              bound databaseā€™s Logical_Router_Port table for  the  distributed
+              parent of this port.
+
+       options : always-redirect: optional string
+              A  boolean  option that is set to true if the distributed parent
+              of this chassis redirect port does not need distributed processā€
+              ing.
+
+     Nested Containers:
+
+       These columns support containers nested within a VM. Specifically, they
+       are used when type is empty and logical_port identifies  the  interface
+       of  a  container  spawned inside a VM. They are empty for containers or
+       VMs that run directly on a hypervisor.
+
+       parent_port: optional string
+              This is taken from parent_name in the OVN_Northbound  databaseā€™s
+              Logical_Switch_Port table.
+
+       tag: optional integer, in range 1 to 4,095
+              Identifies  the  VLAN tag in the network traffic associated with
+              that containerā€™s network interface.
+
+              This column is used for a different purpose when type is  localā€ā€
+              net  (see  Localnet Options, above) or l2gateway (see L2 Gateway
+              Options, above).
+
+     Virtual ports:
+
+       virtual_parent: optional string
+              This column is set by ovn-controller with one of the value  from
+              the  options:virtual-parents  in  the  OVN_Northbound databaseā€™s
+              Logical_Switch_Port table when the OVN action bind_vport is exeā€
+              cuted. ovn-controller also sets the chassis column when it  exeā€
+              cutes this action with its chassis id.
+
+              ovn-controller sets this column only if the type is "virtual".
+
+     Naming:
+
+       external_ids : name: optional string
+              For  a  logical  switch port, ovn-northd copies this from exterā€ā€
+              nal_ids:neutron:port_name in the  Logical_Switch_Port  table  in
+              the OVN_Northbound database, if it is a nonempty string.
+
+              For  a  logical  switch  port, ovn-northd does not currently set
+              this key.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+              The ovn-northd program populates this column  with  all  entries
+              into the external_ids column of the Logical_Switch_Port and Logā€ā€
+              ical_Router_Port tables of the OVN_Northbound database.
+
+MAC_Binding TABLE
+       Each  row  in  this  table specifies a binding from an IP address to an
+       Ethernet address that has been discovered through  ARP  (for  IPv4)  or
+       neighbor discovery (for IPv6). This table is primarily used to discover
+       bindings  on  physical networks, because IP-to-MAC bindings for virtual
+       machines are usually populated statically into the Port_Binding table.
+
+       This  table  expresses  a  functional  relationship:  MAC_Binding(logiā€ā€
+       cal_port, ip) = mac.
+
+       In  outline,  the lifetime of a logical routerā€™s MAC binding looks like
+       this:
+
+              1.  On hypervisor 1, a logical router determines that  a  packet
+                  should  be  forwarded  to  IP address A on one of its router
+                  ports. It uses its logical flow table to  determine  that  A
+                  lacks  a  static IP-to-MAC binding and the get_arp action to
+                  determine that it lacks a dynamic IP-to-MAC binding.
+
+              2.  Using an OVN logical arp action, the logical  router  generā€
+                  ates  and  sends a broadcast ARP request to the router port.
+                  It drops the IP packet.
+
+              3.  The logical switch attached to the router port delivers  the
+                  ARP request to all of its ports. (It might make sense to deā€
+                  liver  it  only to ports that have no static IP-to-MAC bindā€
+                  ings, but this could also be surprising behavior.)
+
+              4.  A host or VM on hypervisor 2 (which might be the same as hyā€
+                  pervisor 1) attached to the logical switch owns the  IP  adā€
+                  dress  in question. It composes an ARP reply and unicasts it
+                  to the logical router portā€™s Ethernet address.
+
+              5.  The logical switch delivers the ARP  reply  to  the  logical
+                  router port.
+
+              6.  The  logical router flow table executes a put_arp action. To
+                  record the IP-to-MAC binding, ovn-controller adds a  row  to
+                  the MAC_Binding table.
+
+              7.  On   hypervisor   1,  ovn-controller  receives  the  updated
+                  MAC_Binding table from the OVN southbound database. The next
+                  packet destined to A through the logical router is sent  diā€
+                  rectly to the bound Ethernet address.
+
+   Summary:
+       logical_port                  string
+       ip                            string
+       mac                           string
+       timestamp                     integer
+       datapath                      Datapath_Binding
+
+   Details:
+       logical_port: string
+              The logical port on which the binding was discovered.
+
+       ip: string
+              The bound IP address.
+
+       mac: string
+              The Ethernet address to which the IP is bound.
+
+       timestamp: integer
+              The timestamp in msec when the MAC binding was added or updated.
+              Records that existed before this column will have 0.
+
+       datapath: Datapath_Binding
+              The logical datapath to which the logical port belongs.
+
+DHCP_Options TABLE
+       Each  row in this table stores the DHCP Options supported by native OVN
+       DHCP. ovn-northd populates this table with the supported DHCP  options.
+       ovn-controller  looks  up  this table to get the DHCP codes of the DHCP
+       options defined in the "put_dhcp_opts" action. Please refer to the  RFC
+       2132  "https://tools.ietf.org/html/rfc2132"  for  the  possible list of
+       DHCP options that can be defined here.
+
+   Summary:
+       name                          string
+       code                          integer, in range 0 to 254
+       type                          string, one of  bool,  domains,  host_id,
+                                     ipv4, static_routes, str, uint16, uint32,
+                                     or uint8
+
+   Details:
+       name: string
+              Name of the DHCP option.
+
+              Example. name="router"
+
+       code: integer, in range 0 to 254
+              DHCP option code for the DHCP option as defined in the RFC 2132.
+
+              Example. code=3
+
+       type: string, one of bool, domains, host_id, ipv4, static_routes, str,
+       uint16, uint32, or uint8
+              Data type of the DHCP option code.
+
+              value: bool
+                     This  indicates  that  the  value of the DHCP option is a
+                     bool.
+
+                     Example.       "name=ip_forward_enable",       "code=19",
+                     "type=bool".
+
+                     put_dhcp_opts(..., ip_forward_enable = 1,...)
+
+              value: uint8
+                     This  indicates  that  the value of the DHCP option is an
+                     unsigned int8 (8 bits)
+
+                     Example. "name=default_ttl", "code=23", "type=uint8".
+
+                     put_dhcp_opts(..., default_ttl = 50,...)
+
+              value: uint16
+                     This indicates that the value of the DHCP  option  is  an
+                     unsigned int16 (16 bits).
+
+                     Example. "name=mtu", "code=26", "type=uint16".
+
+                     put_dhcp_opts(..., mtu = 1450,...)
+
+              value: uint32
+                     This  indicates  that  the value of the DHCP option is an
+                     unsigned int32 (32 bits).
+
+                     Example. "name=lease_time", "code=51", "type=uint32".
+
+                     put_dhcp_opts(..., lease_time = 86400,...)
+
+              value: ipv4
+                     This indicates that the value of the DHCP  option  is  an
+                     IPv4 address or addresses.
+
+                     Example. "name=router", "code=3", "type=ipv4".
+
+                     put_dhcp_opts(..., router = 10.0.0.1,...)
+
+                     Example. "name=dns_server", "code=6", "type=ipv4".
+
+                     put_dhcp_opts(..., dns_server = {8.8.8.8 7.7.7.7},...)
+
+              value: static_routes
+                     This indicates that the value of the DHCP option contains
+                     a pair of IPv4 route and next hop addresses.
+
+                     Example.    "name=classless_static_route",    "code=121",
+                     "type=static_routes".
+
+                     put_dhcp_opts(...,        classless_static_route        =
+                     {30.0.0.0/24,10.0.0.4,0.0.0.0/0,10.0.0.1}...)
+
+              value: str
+                     This  indicates  that  the  value of the DHCP option is a
+                     string.
+
+                     Example. "name=host_name", "code=12", "type=str".
+
+              value: host_id
+                     This indicates that the value of the  DHCP  option  is  a
+                     host_id. It can either be a host_name or an IP address.
+
+                     Example. "name=tftp_server", "code=66", "type=host_id".
+
+              value: domains
+                     This indicates that the value of the DHCP option is a doā€
+                     main name or a comma separated list of domain names.
+
+                     Example. "name=domain_search_list", "code=119", "type=doā€
+                     mains".
+DHCPv6_Options TABLE
+       Each  row  in  this table stores the DHCPv6 Options supported by native
+       OVN DHCPv6. ovn-northd populates this table with the  supported  DHCPv6
+       options.  ovn-controller looks up this table to get the DHCPv6 codes of
+       the DHCPv6 options defined in the put_dhcpv6_opts action. Please  refer
+       to RFC 3315 and RFC 3646 for the list of DHCPv6 options that can be deā€
+       fined here.
+
+   Summary:
+       name                          string
+       code                          integer, in range 0 to 254
+       type                          string, one of ipv6, mac, or str
+
+   Details:
+       name: string
+              Name of the DHCPv6 option.
+
+              Example. name="ia_addr"
+
+       code: integer, in range 0 to 254
+              DHCPv6  option  code for the DHCPv6 option as defined in the apā€
+              propriate RFC.
+
+              Example. code=3
+
+       type: string, one of ipv6, mac, or str
+              Data type of the DHCPv6 option code.
+
+              value: ipv6
+                     This indicates that the value of the DHCPv6 option is  an
+                     IPv6 address(es).
+
+                     Example. "name=ia_addr", "code=5", "type=ipv6".
+
+                     put_dhcpv6_opts(..., ia_addr = ae70::4,...)
+
+              value: str
+                     This  indicates  that the value of the DHCPv6 option is a
+                     string.
+
+                     Example. "name=domain_search", "code=24", "type=str".
+
+                     put_dhcpv6_opts(..., domain_search = ovn.domain,...)
+
+              value: mac
+                     This indicates that the value of the DHCPv6 option  is  a
+                     MAC address.
+
+                     Example. "name=server_id", "code=2", "type=mac".
+
+                     put_dhcpv6_opts(..., server_id = 01:02:03:04L05:06,...)
+Connection TABLE
+       Configuration  for  a  database  connection to an Open vSwitch database
+       (OVSDB) client.
+
+       This table  primarily  configures  the  Open  vSwitch  database  server
+       (ovsdb-server).
+
+       The  Open vSwitch database server can initiate and maintain active conā€
+       nections to remote clients. It can also  listen  for  database  connecā€
+       tions.
+
+   Summary:
+       Core Features:
+         target                      string (must be unique within table)
+         read_only                   boolean
+         role                        string
+       Client Failure Detection and Handling:
+         max_backoff                 optional integer, at least 1,000
+         inactivity_probe            optional integer
+       Status:
+         is_connected                boolean
+         status : last_error         optional string
+         status : state              optional  string, one of ACTIVE, BACKOFF,
+                                     CONNECTING, IDLE, or VOID
+         status : sec_since_connect  optional string, containing  an  integer,
+                                     at least 0
+         status : sec_since_disconnect
+                                     optional  string,  containing an integer,
+                                     at least 0
+         status : locks_held         optional string
+         status : locks_waiting      optional string
+         status : locks_lost         optional string
+         status : n_connections      optional string, containing  an  integer,
+                                     at least 2
+         status : bound_port         optional string, containing an integer
+       Common Columns:
+         external_ids                map of string-string pairs
+         other_config                map of string-string pairs
+
+   Details:
+     Core Features:
+
+       target: string (must be unique within table)
+              Connection methods for clients.
+
+              The following connection methods are currently supported:
+
+              ssl:host[:port]
+                     The  specified  SSL port on the given host, which can eiā€
+                     ther be a DNS name (if built with unbound library) or  an
+                     IP  address.  A  valid SSL configuration must be provided
+                     when this form is used, this configuration can be  speciā€
+                     fied via command-line options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              tcp:host[:port]
+                     The specified TCP port on the given host, which  can  eiā€
+                     ther  be a DNS name (if built with unbound library) or an
+                     IP address (IPv4 or IPv6). If host is  an  IPv6  address,
+                     wrap it in square brackets, e.g. tcp:[::1]:6640.
+
+                     If port is not specified, it defaults to 6640.
+
+              pssl:[port][:host]
+                     Listens  for  SSL  connections on the specified TCP port.
+                     Specify 0 for  port  to  have  the  kernel  automatically
+                     choose  an available port. If host, which can either be a
+                     DNS name (if built with unbound library)  or  an  IP  adā€
+                     dress,  is  specified, then connections are restricted to
+                     the resolved or specified local IP address  (either  IPv4
+                     or  IPv6  address).  If  host is an IPv6 address, wrap in
+                     square brackets, e.g. pssl:6640:[::1].  If  host  is  not
+                     specified then it listens only on IPv4 (but not IPv6) adā€
+                     dresses.  A valid SSL configuration must be provided when
+                     this form is used, this can be specified either via  comā€
+                     mand-line options or the SSL table.
+
+                     If port is not specified, it defaults to 6640.
+
+                     SSL  support  is  an  optional feature that is not always
+                     built as part of Open vSwitch.
+
+              ptcp:[port][:host]
+                     Listens for connections on the specified TCP port.  Specā€
+                     ify 0 for port to have the kernel automatically choose an
+                     available  port.  If host, which can either be a DNS name
+                     (if built with unbound library)  or  an  IP  address,  is
+                     specified,  then  connections  are  restricted to the reā€
+                     solved or specified local IP address (either IPv4 or IPv6
+                     address). If host is an IPv6 address, wrap it  in  square
+                     brackets,  e.g. ptcp:6640:[::1]. If host is not specified
+                     then it listens only on IPv4 addresses.
+
+                     If port is not specified, it defaults to 6640.
+
+              When multiple clients are configured, the target values must  be
+              unique. Duplicate target values yield unspecified results.
+
+       read_only: boolean
+              true  to  restrict  these connections to read-only transactions,
+              false to allow them to modify the database.
+
+       role: string
+              String containing role name for this connection entry.
+
+     Client Failure Detection and Handling:
+
+       max_backoff: optional integer, at least 1,000
+              Maximum number of milliseconds to wait  between  connection  atā€
+              tempts. Default is implementation-specific.
+
+       inactivity_probe: optional integer
+              Maximum number of milliseconds of idle time on connection to the
+              client  before  sending  an  inactivity  probe  message. If Open
+              vSwitch does not communicate with the client for  the  specified
+              number  of  seconds,  it will send a probe. If a response is not
+              received for the same additional amount of  time,  Open  vSwitch
+              assumes  the  connection  has been broken and attempts to reconā€
+              nect. Default is implementation-specific. A value of 0  disables
+              inactivity probes.
+
+     Status:
+
+       Key-value pair of is_connected is always updated. Other key-value pairs
+       in the status columns may be updated depends on the target type.
+
+       When target specifies a connection method that listens for inbound conā€
+       nections  (e.g.  ptcp:  or punix:), both n_connections and is_connected
+       may also be updated while the remaining key-value pairs are omitted.
+
+       On the other hand, when target specifies an  outbound  connection,  all
+       key-value  pairs  may  be  updated, except the above-mentioned two key-
+       value pairs associated with inbound connection targets. They are  omitā€
+       ted.
+
+       is_connected: boolean
+              true if currently connected to this client, false otherwise.
+
+       status : last_error: optional string
+              A human-readable description of the last error on the connection
+              to  the  manager; i.e. strerror(errno). This key will exist only
+              if an error has occurred.
+
+       status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING,
+       IDLE, or VOID
+              The state of the connection to the manager:
+
+              VOID   Connection is disabled.
+
+              BACKOFF
+                     Attempting to reconnect at an increasing period.
+
+              CONNECTING
+                     Attempting to connect.
+
+              ACTIVE Connected, remote host responsive.
+
+              IDLE   Connection is idle. Waiting for response to keep-alive.
+
+              These values may change in the future. They  are  provided  only
+              for human consumption.
+
+       status : sec_since_connect: optional string, containing an integer, at
+       least 0
+              The amount of time since this client last successfully connected
+              to the database (in seconds). Value is empty if client has never
+              successfully been connected.
+
+       status : sec_since_disconnect: optional string, containing an integer,
+       at least 0
+              The  amount of time since this client last disconnected from the
+              database (in seconds). Value is empty if client has  never  disā€
+              connected.
+
+       status : locks_held: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection holds. Omitted if  the  connection  does  not  hold  any
+              locks.
+
+       status : locks_waiting: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection is currently waiting to acquire. Omitted if the  connecā€
+              tion is not waiting for any locks.
+
+       status : locks_lost: optional string
+              Space-separated  list  of the names of OVSDB locks that the conā€
+              nection has had stolen by another OVSDB client.  Omitted  if  no
+              locks have been stolen from this connection.
+
+       status : n_connections: optional string, containing an integer, at
+       least 2
+              When  target  specifies a connection method that listens for inā€
+              bound connections (e.g. ptcp: or pssl:) and more than  one  conā€
+              nection  is  actually  active, the value is the number of active
+              connections. Otherwise, this key-value pair is omitted.
+
+       status : bound_port: optional string, containing an integer
+              When target is ptcp: or pssl:, this is the TCP port on which the
+              OVSDB server is listening. (This  is  particularly  useful  when
+              target  specifies a port of 0, allowing the kernel to choose any
+              available port.)
+
+     Common Columns:
+
+       The overall purpose of these columns is described under Common  Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+
+       other_config: map of string-string pairs
+SSL TABLE
+       SSL configuration for ovn-sb database access.
+
+   Summary:
+       private_key                   string
+       certificate                   string
+       ca_cert                       string
+       bootstrap_ca_cert             boolean
+       ssl_protocols                 string
+       ssl_ciphers                   string
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       private_key: string
+              Name  of  a  PEM  file  containing  the  private key used as the
+              switchā€™s identity for SSL connections to the controller.
+
+       certificate: string
+              Name of a PEM file containing a certificate, signed by the  cerā€
+              tificate authority (CA) used by the controller and manager, that
+              certifies  the  switchā€™s  private key, identifying a trustworthy
+              switch.
+
+       ca_cert: string
+              Name of a PEM file containing the CA certificate used to  verify
+              that the switch is connected to a trustworthy controller.
+
+       bootstrap_ca_cert: boolean
+              If  set to true, then Open vSwitch will attempt to obtain the CA
+              certificate from the controller on its first SSL connection  and
+              save  it to the named PEM file. If it is successful, it will imā€
+              mediately drop the connection and reconnect, and  from  then  on
+              all  SSL  connections  must  be  authenticated  by a certificate
+              signed by the CA certificate thus obtained. This option  exposes
+              the  SSL  connection to a man-in-the-middle attack obtaining the
+              initial CA certificate. It may still be  useful  for  bootstrapā€
+              ping.
+
+       ssl_protocols: string
+              List of SSL protocols to be enabled for SSL connections. The deā€
+              fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2.
+
+       ssl_ciphers: string
+              List  of  ciphers  (in  OpenSSL cipher string format) to be supā€
+              ported for SSL connections. The  default  when  this  option  is
+              omitted is HIGH:!aNULL:!MD5.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+DNS TABLE
+       Each row  in  this  table  stores  the  DNS  records.  The  OVN  action
+       dns_lookup uses this table for DNS resolution.
+
+   Summary:
+       records                       map of string-string pairs
+       datapaths                     set of 1 or more Datapath_Bindings
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       records: map of string-string pairs
+              Key-value pair of DNS records with DNS query name as the key and
+              a  string  of  IP address(es) separated by comma or space as the
+              value. ovn-northd stores the DNS query name in all lowercase  in
+              order to facilitate case-insensitive lookups.
+
+              Example:  "vm1.ovn.org" = "10.0.0.4 aef0::4"
+
+       datapaths: set of 1 or more Datapath_Bindings
+              The  DNS  records  defined in the column records will be applied
+              only to the DNS queries originating from the  datapaths  defined
+              in this column.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+RBAC_Role TABLE
+       Role table for role-based access controls.
+
+   Summary:
+       name                          string
+       permissions                   map of string-weak reference to RBAC_Perā€ā€
+                                     mission pairs
+
+   Details:
+       name: string
+              The  role  name, corresponding to the role column in the Connecā€ā€
+              tion table.
+
+       permissions: map of string-weak reference to RBAC_Permission pairs
+              A mapping of table names to rows in the RBAC_Permission table.
+
+RBAC_Permission TABLE
+       Permissions table for role-based access controls.
+
+   Summary:
+       table                         string
+       authorization                 set of strings
+       insert_delete                 boolean
+       update                        set of strings
+
+   Details:
+       table: string
+              Name of table to which this row applies.
+
+       authorization: set of strings
+              Set of strings identifying columns and column:key  pairs  to  be
+              compared with client ID. At least one match is required in order
+              to  be  authorized. A zero-length string is treated as a special
+              value indicating all clients should be considered authorized.
+
+       insert_delete: boolean
+              When "true", row insertions and  authorized  row  deletions  are
+              permitted.
+
+       update: set of strings
+              Set of strings identifying columns and column:key pairs that auā€
+              thorized clients are allowed to modify.
+
+Gateway_Chassis TABLE
+       Association  of Port_Binding rows of type chassisredirect to a Chassis.
+       The traffic going out through a specific chassisredirect port  will  be
+       redirected to a chassis, or a set of them in high availability configuā€
+       rations.
+
+   Summary:
+       name                          string (must be unique within table)
+       chassis                       optional weak reference to Chassis
+       priority                      integer, in range 0 to 32,767
+       options                       map of string-string pairs
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Name of the Gateway_Chassis.
+
+              A   suggested,   but   not   required   naming   convention   is
+              ${port_name}_${chassis_name}.
+
+       chassis: optional weak reference to Chassis
+              The Chassis to which we send the traffic.
+
+       priority: integer, in range 0 to 32,767
+              This is the  priority  the  specific  Chassis  among  all  Gateā€
+              way_Chassis belonging to the same Port_Binding.
+
+       options: map of string-string pairs
+              Reserved for future use.
+
+     Common Columns:
+
+       The  overall purpose of these columns is described under Common Columns
+       at the beginning of this document.
+
+       external_ids: map of string-string pairs
+HA_Chassis TABLE
+   Summary:
+       chassis                       optional weak reference to Chassis
+       priority                      integer, in range 0 to 32,767
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       chassis: optional weak reference to Chassis
+              The Chassis which provides the HA functionality.
+
+       priority: integer, in range 0 to 32,767
+              Priority of the HA chassis. Chassis with highest  priority  will
+              be the master in the HA chassis group.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+HA_Chassis_Group TABLE
+       Table representing a group of chassis which can provide High availabilā€
+       ity  services.  Each  chassis  in the group is represented by the table
+       HA_Chassis. The HA chassis with highest priority will be the master  of
+       this  group. If the master chassis failover is detected, the HA chassis
+       with the next higher priority takes over the responsibility of  providā€
+       ing the HA. If ha_chassis_group column of the table Port_Binding referā€
+       ences this table, then this HA chassis group provides the gateway funcā€
+       tionality  and  redirects  the  gateway  traffic  to the master of this
+       group.
+
+   Summary:
+       name                          string (must be unique within table)
+       ha_chassis                    set of HA_Chassises
+       ref_chassis                   set of weak reference to Chassis
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string (must be unique within table)
+              Name of the HA_Chassis_Group. Name should be unique.
+
+       ha_chassis: set of HA_Chassises
+              A list of HA_Chassis which belongs to this group.
+
+       ref_chassis: set of weak reference to Chassis
+              The set of Chassis that reference this HA chassis group. To  deā€
+              termine  the  correct  Chassis,  find  the  chassisredirect type
+              Port_Binding  that  references   this   HA_Chassis_Group.   This
+              Port_Binding  is  derived  from  some particular logical router.
+              Starting from that LR, find the set of all logical switches  and
+              routers  connected  to it, directly or indirectly, across router
+              ports that link one LRP to another or to a LSP. For each LSP  in
+              these  logical switches, find the corresponding Port_Binding and
+              add its bound Chassis (if any) to ref_chassis.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Controller_Event TABLE
+       Database table used by ovn-controller to  report  CMS  related  events.
+       Please note there is no guarantee a given event is written exactly once
+       in  the  db.  It is CMS responsibility to squash duplicated lines or to
+       filter out duplicated events
+
+   Summary:
+       event_type                    string, must be empty_lb_backends
+       event_info                    map of string-string pairs
+       chassis                       optional weak reference to Chassis
+       seq_num                       integer
+
+   Details:
+       event_type: string, must be empty_lb_backends
+              Event type occurred
+
+       event_info: map of string-string pairs
+              Key-value pairs used to specify event info to the CMS.  Possible
+              values are:
+
+              ā€¢      vip: VIP reported for the empty_lb_backends event
+
+              ā€¢      protocol:    Transport    protocol   reported   for   the
+                     empty_lb_backends event
+
+              ā€¢      load_balancer: UUID of the load balancer reported for the
+                     empty_lb_backends event
+
+       chassis: optional weak reference to Chassis
+              This column is a Chassis record to identify the chassis that has
+              managed a given event.
+
+       seq_num: integer
+              Event sequence number. Global counter for  controller  generated
+              events. It can be used by the CMS to detect possible duplication
+              of the same event.
+IP_Multicast TABLE
+       IP Multicast configuration options. For now only applicable to IGMP.
+
+   Summary:
+       datapath                      weak  reference to Datapath_Binding (must
+                                     be unique within table)
+       enabled                       optional boolean
+       querier                       optional boolean
+       table_size                    optional integer
+       idle_timeout                  optional integer
+       query_interval                optional integer
+       seq_no                        integer
+       Querier configuration options:
+         eth_src                     string
+         ip4_src                     string
+         ip6_src                     string
+         query_max_resp              optional integer
+
+   Details:
+       datapath: weak reference to Datapath_Binding (must be unique within taā€
+       ble)
+              Datapath_Binding entry for which these configuration options are
+              defined.
+
+       enabled: optional boolean
+              Enables/disables multicast snooping. Default: disabled.
+
+       querier: optional boolean
+              Enables/disables multicast querying. If enabled  then  multicast
+              querying is enabled by default.
+
+       table_size: optional integer
+              Limits  the  number of multicast groups that can be learned. Deā€
+              fault: 2048 groups per datapath.
+
+       idle_timeout: optional integer
+              Configures the idle timeout (in seconds) for IP multicast groups
+              if multicast snooping is enabled. Default: 300 seconds.
+
+       query_interval: optional integer
+              Configures the  interval  (in  seconds)  for  sending  multicast
+              queries if snooping and querier are enabled. Default: idle_timeā€ā€
+              out/2 seconds.
+
+       seq_no: integer
+              ovn-controller  reads  this value and flushes all learned multiā€
+              cast groups when it detects that seq_no was changed.
+
+     Querier configuration options:
+
+       The ovn-controller process that runs on OVN hypervisor nodes  uses  the
+       following columns to determine field values in IGMP/MLD queries that it
+       originates:
+
+       eth_src: string
+              Source Ethernet address.
+
+       ip4_src: string
+              Source IPv4 address.
+
+       ip6_src: string
+              Source IPv6 address.
+
+       query_max_resp: optional integer
+              Value  (in seconds) to be used as "max-response" field in multiā€
+              cast queries. Default: 1 second.
+
+IGMP_Group TABLE
+       Contains learned IGMP groups indexed by address/datapath/chassis.
+
+   Summary:
+       address                       string
+       datapath                      optional weak reference to Datapath_Bindā€ā€
+                                     ing
+       chassis                       optional weak reference to Chassis
+       ports                         set of weak reference to Port_Bindings
+
+   Details:
+       address: string
+              Destination IPv4 address for the IGMP group.
+
+       datapath: optional weak reference to Datapath_Binding
+              Datapath to which this IGMP group belongs.
+
+       chassis: optional weak reference to Chassis
+              Chassis to which this IGMP group belongs.
+
+       ports: set of weak reference to Port_Bindings
+              The destination port bindings for this IGMP group.
+
+Service_Monitor TABLE
+       Each row in this table configures monitoring a service  for  its  liveā€
+       ness. The service can be an IPv4 TCP or UDP service. ovn-controller peā€
+       riodically  sends out service monitor packets and updates the status of
+       the service. Service monitoring for IPv6 services is not supported.
+
+       ovn-northd uses this feature to  implement  the  load  balancer  health
+       check feature offered to the CMS through the northbound database.
+
+   Summary:
+       Configuration:
+         ip                          string
+         protocol                    optional string, either tcp or udp
+         port                        integer, in range 0 to 65,535
+         logical_port                string
+         src_mac                     string
+         src_ip                      string
+         options : interval          optional string, containing an integer
+         options : timeout           optional string, containing an integer
+         options : success_count     optional string, containing an integer
+         options : failure_count     optional string, containing an integer
+       Status Reporting:
+         status                      optional  string,  one of error, offline,
+                                     or online
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+     Configuration:
+
+       ovn-northd sets these columns and values to configure the service moniā€
+       tor.
+
+       ip: string
+              IP of the service to be monitored. Only IPv4 is supported.
+
+       protocol: optional string, either tcp or udp
+              The protocol of the service.
+
+       port: integer, in range 0 to 65,535
+              The TCP or UDP port of the service.
+
+       logical_port: string
+              The VIF of the logical port on which the service is running. The
+              ovn-controller that binds this logical_port monitors the service
+              by sending periodic monitor packets.
+
+       src_mac: string
+              Source Ethernet address to use in the service monitor packet.
+
+       src_ip: string
+              Source IPv4 address to use in the service monitor packet.
+
+       options : interval: optional string, containing an integer
+              The interval, in seconds, between service monitor checks.
+
+       options : timeout: optional string, containing an integer
+              The time, in seconds, after  which  the  service  monitor  check
+              times out.
+
+       options : success_count: optional string, containing an integer
+              The  number of successful checks after which the service is conā€
+              sidered online.
+
+       options : failure_count: optional string, containing an integer
+              The number of failure checks after which the service is  considā€
+              ered offline.
+
+     Status Reporting:
+
+       The  ovn-controller  on the chassis that hosts the logical_port updates
+       this column to report the serviceā€™s status.
+
+       status: optional string, one of error, offline, or online
+              For TCP service, ovn-controller sends a SYN to the  service  and
+              expects an ACK response to consider the service to be online.
+
+              For  UDP  service, ovn-controller sends a UDP packet to the serā€
+              vice and doesnā€™t expect any reply. If it receives an ICMP reply,
+              then it considers the service to be offline.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+Load_Balancer TABLE
+       Each row represents a load balancer.
+
+   Summary:
+       name                          string
+       vips                          map of string-string pairs
+       protocol                      optional string, one of sctp, tcp, or udp
+       datapaths                     set of Datapath_Bindings
+       datapath_group                optional Logical_DP_Group
+       Load_Balancer options:
+         options : hairpin_snat_ip   optional string
+         options : hairpin_orig_tuple
+                                     optional string, either true or false
+       Common Columns:
+         external_ids                map of string-string pairs
+
+   Details:
+       name: string
+              A name for the load balancer. This name has no  special  meaning
+              or  purpose other than to provide convenience for human interacā€
+              tion with the ovn-nb database.
+
+       vips: map of string-string pairs
+              A map of virtual IP addresses (and an optional port number  with
+              :  as  a separator) associated with this load balancer and their
+              corresponding endpoint IP addresses (and optional  port  numbers
+              with : as separators) separated by commas.
+
+       protocol: optional string, one of sctp, tcp, or udp
+              Valid  protocols  are  tcp,  udp, or sctp. This column is useful
+              when a port number is provided as part of the  vips  column.  If
+              this  column  is  empty and a port number is provided as part of
+              vips column, OVN assumes the protocol to be tcp.
+
+       datapaths: set of Datapath_Bindings
+              Datapaths to which this load balancer applies to.
+
+       datapath_group: optional Logical_DP_Group
+              The group of datapaths to which this load balancer  applies  to.
+              This  means that the same load balancer applies to all datapaths
+              in a group.
+
+     Load_Balancer options:
+
+       options : hairpin_snat_ip: optional string
+              IP to be used as source IP for  packets  that  have  been  hair-
+              pinned  after  load balancing. This value is automatically popuā€
+              lated by ovn-northd.
+
+       options : hairpin_orig_tuple: optional string, either true or false
+              This value is automatically set to true by ovn-northd when origā€
+              inal destination IP and transport  port  of  the  load  balanced
+              packets are stored in registers reg1, reg2, xxreg1.
+
+     Common Columns:
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+BFD TABLE
+       Contains BFD parameter for ovn-controller bfd configuration.
+
+   Summary:
+       Configuration:
+         src_port                    integer, in range 49,152 to 65,535
+         disc                        integer
+         logical_port                string
+         dst_ip                      string
+         min_tx                      integer
+         min_rx                      integer
+         detect_mult                 integer
+         options                     map of string-string pairs
+         external_ids                map of string-string pairs
+       Status Reporting:
+         status                      string, one of admin_down, down, init, or
+                                     up
+
+   Details:
+     Configuration:
+
+       src_port: integer, in range 49,152 to 65,535
+              udp  source  port  used  in bfd control packets. The source port
+              MUST be in the range 49152 through 65535 (RFC5881 section 4).
+
+       disc: integer
+              A unique, nonzero discriminator value generated by the transmitā€
+              ting system, used to demultiplex multiple BFD  sessions  between
+              the same pair of systems.
+
+       logical_port: string
+              OVN logical port when BFD engine is running.
+
+       dst_ip: string
+              BFD peer IP address.
+
+       min_tx: integer
+              This  is  the  minimum interval, in milliseconds, that the local
+              system would like to use when transmitting BFD Control  packets,
+              less any jitter applied. The value zero is reserved.
+
+       min_rx: integer
+              This  is the minimum interval, in milliseconds, between received
+              BFD Control packets that this system is capable  of  supporting,
+              less  any  jitter  applied by the sender. If this value is zero,
+              the transmitting system does not want the remote system to  send
+              any periodic BFD Control packets.
+
+       detect_mult: integer
+              Detection  time  multiplier.  The  negotiated transmit interval,
+              multiplied by this value, provides the Detection  Time  for  the
+              receiving system in Asynchronous mode.
+
+       options: map of string-string pairs
+              Reserved for future use.
+
+       external_ids: map of string-string pairs
+              See External IDs at the beginning of this document.
+
+     Status Reporting:
+
+       status: string, one of admin_down, down, init, or up
+              BFD port logical states. Possible values are:
+
+              ā€¢      admin_down
+
+              ā€¢      down
+
+              ā€¢      init
+
+              ā€¢      up
+FDB TABLE
+       This  table is primarily used to learn the MACs observed on a VIF (or a
+       localnet port with ā€™localnet_learn_fdbā€™ enabled)  which  belongs  to  a
+       Logical_Switch_Port  record  in  OVN_Northbound  whose port security is
+       disabled and ā€™unknownā€™ address set. If port security is disabled  on  a
+       Logical_Switch_Port  record,  OVN  should allow traffic with any source
+       mac from the VIF. This table will be used to deliver a  packet  to  the
+       VIF, If a packetā€™s eth.dst is learnt.
+
+   Summary:
+       mac                           string
+       dp_key                        integer, in range 1 to 16,777,215
+       port_key                      integer, in range 1 to 16,777,215
+
+   Details:
+       mac: string
+              The learnt mac address.
+
+       dp_key: integer, in range 1 to 16,777,215
+              The key of the datapath on which this FDB was learnt.
+
+       port_key: integer, in range 1 to 16,777,215
+              The key of the port binding on which this FDB was learnt.
+
+Static_MAC_Binding TABLE
+       Each record represents a Static_MAC_Binding entry for a logical router.
+
+   Summary:
+       logical_port                  string
+       ip                            string
+       mac                           string
+       override_dynamic_mac          boolean
+       datapath                      Datapath_Binding
+
+   Details:
+       logical_port: string
+              The logical router port for the binding.
+
+       ip: string
+              The bound IP address.
+
+       mac: string
+              The Ethernet address to which the IP is bound.
+
+       override_dynamic_mac: boolean
+              Override dynamically learnt MACs.
+
+       datapath: Datapath_Binding
+              The logical datapath to which the logical router port belongs.
+
+Chassis_Template_Var TABLE
+       Each  record represents the set of template variable instantiations for
+       a given chassis and is populated by ovn-northd from the contents of the
+       OVN_Northbound.Chassis_Template_Var table.
+
+   Summary:
+       chassis                       string (must be unique within table)
+       variables                     map of string-string pairs
+
+   Details:
+       chassis: string (must be unique within table)
+              The chassis this set of variable values applies to.
+
+       variables: map of string-string pairs
+              The set of variable values for a given chassis.
+
+Open vSwitch 23.06.3           DB Schema 20.27.2                     ovn-sb(5)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sb.5.pdf b/src/static/support/dist-docs-branch-23.06/ovn-sb.5.pdf new file mode 100644 index 0000000000000000000000000000000000000000..b4186f30b71ab38b623b05c236132ea09bb87570 GIT binary patch literal 209409 zcma&MQ;;UG+AZ9+ZQGi*ZM&!4Z`+!-ZQHhO+qR}{8~^N6-+#`z zEOJFrae8J3HW>2J%h&=Ka&jqKS36@vXA3)9ZX$a_XLCj~Cn9=9dLnug6(Mmk<$tA! zoz1@v3nL3_3ukv(fGfb7@81MO^bY?sPF_J#NKHlT-$-F0RS`)ddM8mabtw@sK6?|> zKaLj8fPWDuXA?UYXFh>{RRtGkdlzSM3v0lCn*XbnV15xX5!o48!tnAk$^vZ7oXv^Y z|3#D;|IOkIa3o?Bw>ESJhysl5OaT1+Fiy^n07DxXx2$6Ab;qp{bng?5J-IYANO5B; zB0CmxN@*!HV-_!D6&j?)L!u!dQo5`R-#CHcpEM`W!2z)t71!iLp})^pomoz{gS&XU z#xV*%rvj1N;Wt~kUOa~P8WKNBmsz>B@+(c}6`XHp8uExW*YZm;Q~Umdg=6g-*=^H* z&(8&z0$kEDL$q)VhnJ6ss#mw^`QFb~r@E%Qsniv;l01Cycr-#$Uq+(s)Mrk*%PhEL zP#F(B(it&%^#~?<*0^);J;rFYAD0^a_M26EpDDAIbId=0CzlYS42x5To80h+*C-rU z3`z7keXU*$>oLvp*&olk?^x8ur)>Ri#Q6WL(7BzL-hD?tF1&5Obw#i+PJ&$P<@$D8 zhxmAI!aa?wAA0*_{uwxns9rm&^wt0RYeK)PPYP2GmsM)y*-YQ*@YPbzo~`oh1rVhvs=Zh zMH^2zug)Gg1sf=Nf+SS(ODNzE=@kNBtXf&kY_?ft;Uy2{4IlwV>7~FWgD06K9U6oD z(Q-$-Hu%Kr6kipN-qNybzu%fm?v{TX!&qFBVjI~{$yH0EGZs}!F zgI&e5+64f%gJtI&Qd5&gjp^fiIjr}N>;~Hwj;*-T;gq4k9wDx(N)@TOddimli!2hw zMg7-ch#yBUCQn7+q;cqs7kxs|kk;e-`k{Cx7ZNDgYuZR}Md->ox9G_`YS70)4{NZ` zdTXE!x8)#U5uDv)jTByW_4m5?ZQ*4xK|#<7V4F)U`A_y~S>S0tsQ5-f(~UYX4CMpp zi+mGWuJ>l1&xdl}hNEEZX+%pGI<8-u*c!71inWAC0k5c#xgF91<4{-iQWhc zYEz&YDObY|ju5nYG<>9I{c@e0B(&e}y6l_a#^DC!ehl_|gC1Fq1M^UIv3g8$A@-UC zha{{h1GTVd1dJFM+ck?GLBU^OHpoH-GTTH{?05}Xyb||G@Gbt~%6|m$Jh2hY!1iNw zmI{z`Q(I9C5d?9;^;scI4Z|W<^S#g#3yNHSEpMp5DS=dJU6y0e)*!0_|jcKSW1llvgzE7q_on0@TlT znX0`;DVcyezU0lYXP&8~nHS!?4*Ke+60r6v=r2!`tg6Ceig}ddiE02a?rcmn)GZ4V`X`40} zL2tq)Os=KvrdW!JOU`=lEhz(bP87vn!~mdIyt8|V z>p+}=uflW_m8~ymAXKI7DQHAiC>1aS=R{OYo35a~BjK1Jv()iEnd*Kw4gvKBrP%o? zNu+e7?zJ7M(Kmq?C#boCYlHjF53PYqGz0LP;m=?}@!s#3u%Gw)5#E`^U-OC)71|@G z^T{9{f(GoH!3G7QQjw?42%&}mb=t71nnTX1zXcTy%yE`UzACY%S5$(Lo9u~~7KAjU zFk6ZN_8PSz5>WySq&N7iWjIAVc08J9^ED$-xY!gMO_9VoCxVRJhORgp=z7SWPz0Jb z{3ObkAwmp7Dj0>&q>kCc;w1A)btqYYG#*i1 zvdH;M59Gr=e!@Apddpi3hZ`bX!C`GAH!C_Jw2)5UYEhdD1h2G+4Y0bHmWenWQZ6!C zH-T7+3cZuDT$Bsy;ZB-93dkyo0B4jGc2#}M<7=9YFJwAWQbo7J>#ygVW_9MPFE$g^+B8IcfPO0^MP)Qa z^8>`KHTw4CkhGp%Kh&PM;$}c z;FbM~mPD>b(G#O3lUKe8SoarIx5vMGh~}}g9POIjU}x5(r%VkxZfomP6?*_*5D_0^S{c$at$ zJD^dGWErbYkXVk7mRr#?Zg>LmK#fE}I>nFvGm)}$_UU+i%$@LPaczC<;XabPxGB3X zs4)C3+$f;-anX(aVFwL%@o_EDp})|HjqR_uA#$1=dIaxKgx~bi|E^qDsE+x542`6K zg26&nH?$Zc1i9~CDU4fVg`z)MoV6Fl;g@!RnGL5Qxo-#6?F5Ns((bwYi zvCHR6YMN}7&?o;{R2!!-WGSs@@@0jS8mwcUIn@ZIHxO=MEr1sBFuOfdBQOcwfR?u7 zEIS*m{GLUSt89mTj?&!mGDLbICqrLo;Jm~#hcJ33G5up2dYaikLJLG$R@S&6X^={6 zN2ImZBtzANIg-+K3JEB1xC=i>PcT=&hu8k42*yzqRapm-*l?^m0T`hSg$L;s!L!sN z8$KH9I=`g%X5u4-trX@>67#(PyXV0ixGp3fX~s*`)hI|Zur1hED?4!#Y24kDE~Jy= z(I05M^h`+K=X4)Tlc@09hh|;s6)uj%W}Q^*JYi-_&VDu)4suw%NkK7)bc-|=#n_)zR96!mp|K_%UoQV4DzBauffm}{IctIY$>c%7cX+e5}AiJ=}rtg;)@uhG%0Ex)= zwPZ|oYIalFjF1guDgREFHQ39JEP@T#Tpr=$?CO&{F`6N3TV9M2_o#e7mMfE(lP=ll zYWbomEVO(X$4x1k6m1neBZSRjt-XIcNtZeI4)oBo3*Z6$#iVk&UKh-Z$1Od+sm};R z_o(|gIBZ;0D{ZB;V;lx_%eNk0TtV*Jl}G>;Tlf}aOY^-9e{Armr4-{r{o*!p)%_GY z-u+8*ORrF`>cg~pVz38iWYNM{kBC?5_=&jp2gK?qPl(L;I_LM-GEJY~3?-qSk=(#N z>ovkD4W<1Aa(;j`vbl*snN?JSy7h-qqp2Pa*pEc#y<1mZ*jv#pR5(U5eu1a^L`pKg zM6H_Z7~S{+z6`9QrA(H?>7ii$Eeb2r$=Q!)Oh-PZvlmaakR^IGg?wU*ID#Xi9%tqU zVVF_wt#$S(>*Va`@z0Q-@GUCiZ=sA4EL-E3?b(^)&s^jzznYaUpjc%BLq*qgw%70T z!`#=CUb+BrV}Py6|A?f2wf_jK|H!HTl&q}3e!=`tjQPJ+7xVv4c4@9V{_Q~aUe(y6 zH?a&N?&Gs-xtx+c5UWqpNnR*YtqZD8+jni3RO%t_b^Kw5_XCqsT6mJ3K&)WF*)DBe zg#V79lZ_+)&e)Y>sh`_CT!oJR5u2W+5Ne$qSCypaNQ`Cd;neiWERz9yLwkz}Oc@^< zdp^F`&jULYw%#<{^BZ#HVP3F!qlw|~3A(Z&VkVw`TXKME!Dnmcqh_5TMK{mP)(B3a9zF3w;*A`3R+ zQZI%#+sDH2^%);$R8~rjCTUNegx0wV@>W_T0wT#5$qq>;vCg5YE|%0Iw~RQUrJ5A& zsalb}fP}ia@WfoaU}t|{i-*s%Oi+@2US4Hnp48XiyaQrMd!qH*2_SU{vrH~gE0NrL zspG;F9!wv}4MCgHMMej(`(6C1^#)hw5rGeVno8L;c5eBSu^jhBAGiVF{z9P8eRiN? zM1y0)7!Zen3b`s@+|ybM<>y_^HPkscvnvoHV)c(7W-gK}R;C;pVVk4j*JA=3zaDs! z7wNsC&EbGQf~)L%sh1P>M)hU(m$%2-5U;S6+)gr@ZE>z`D2QNpnSxnFmVyHP8<@lg zx{6?*_mmq9Yra@j=DJC|${7b!AOircug#?UC0@dAvWl>2jlJuxz!4XDJXBc0sYb z@BhO~UueiDh$*D!TS{W@LLZKxfBoj!?4Xx^dm@-6j#)E5N_g zmDU1!PG|J_Hz$yrMMZM8AWiXArclO@&ndE&;+-XCh}M5{+?-F z#2v8&)n|k+M`r-dLd(*YN(!vkWqiv=uJ75$f-S4UMa*dE)_(s?p+sgzv(3D*Goq#{ zya%x>C^z0S3Vr~IwOI#U9U1LVQs@zdI7zA{m55aD9Xq`c>n@0r*+@dVuX*AcgC{Mh zYNpC+gSGJv9e(K`uWI3M=8Xf_FX|b+W$CrTOLn?$W(cpJ-PVq{V%Ltnw+%642wFw# z;EpUMb_hR}m*4I>M1LqSi(#9WLLM+?QSfGz7* z$AgE4-;8c93-cZ3L0Dl#Nb|H?QV&nGra4a!Xy@TwED@Gp&~Wbs26^n~pF;(ZJZ`Ns zQ-a0* z@Y4*2$j!FShKqiALS`ilI=&+G5?o-ZQ>d#8Sc^i)>-)x*mnl-v5w7$ulB=xxBL!0Q zg!0|F1v3-47prGD(F~<)^7!ZvzNcg-G^vxu97g1tdn5NA6wHr!d*hCW3oKL`Gm|u( zQT>UIX#mvcT0qRhn$^R3?BU?09|0#to^>Bg*nSTujxfvV-}ETSP&qi0+?m zrX3fbV8PTuCVqMY4aWU+ds_vflr$-v$w?dBfszq}vqhzj^rt~gXUL0GI({uwgU`+- zOMP4I>P0Uv7)A>h`6j(sBP@ea#IGO3?+MM>qrc*FV2pd{DiMP476ngcCTF3%8CFjM z$Ej<0h?i|WO$pCO?;rSVYA@6U>rB#&P1wqvY}ePx zaW9)!#2UZDkLc+PM1g4JyC*a6-qlXDxqh+AX@EOqKmG!pVu0{r#tM{D+dTFf+0IUrNIDUx{EArvFVQI9p}gc7qA6=SAgpp*`$E zKkGL`oqBf2NW^lcOT<>35JiF_%Bjp{{vTNoX(7q7iC}VHfs@EtF1s|PnDn1_R$Ami zna7aVeT)|g^@E{;xkl@d>zpXaOTwjaPIeI7;yQZd@)!RvSc<;L@+5~MKSRtgRl|q# z{La$XGIrH7gd>^)Su5*ZWOw3s@;(7}_oFjj93=}693G_ShnIqBb+_}1Y#q-90876R z##4hr$a#V@(+M8|O@EmxXAYCi|n&lO6g(;&4!1kR$;2!aGaYJ^?kQ%B%6bk20-y) zurTX;5A?+JW4V3+*=qv_21P+Fne%8ycaNO0hYaV23puweU9bcQiiEpa2$Y0@fGm(`jT(yxie{lH z3p`k%d&fpsn;iaJ+pQ;RY#b~sM$^MSKPLnYWUMTg(aqp2G0vruT;JZZ*R}+tg#H8Y zzIhywM5%z2bs9$ekY?l%7(bFiIKlh9=jDRj+b>AF6jHqZ0?hvb!hZn6#?JZwxXTq!Pr)wOgelKWsuKa4)1qVywiT~Q7UsIp3lN_O9tRK%(0E+$ zj%RhUn(p=<=Ney%FtD1dsk+{?%T;%zuTFcjKG)};&+d+H`$~O=Z`b|x4jkVaTMhl5 z9=CA4+FFM1v(X4by&tc9As@BDijpP|Z%+sJpZ(#BAG<`&-kzBHRueuwef{4%-Cm#2 z0$+=<-Z;9e)E64L8yiPm9$$9{_qz-az1^B$N88T`+upPnni3qN2!wjxUG5zoo$o$Q zFFuVTr6;toJ0Z=?ms4UEe<{E!?rKhW#>bhUo~T)Z3KjtreTJ-n<0)(*FWCu3tPDKEb2wrz53uWtx; zce-?JY;USx7LQA}pB-GBMiEwVJ$HC*R~hw=RacsWC+*l>8~(hkVtrj3ezbLadi=Iw zvz>0@zzn=npwJhY}o11>h7k!{WF#NGa8w(GBfP+ zMu_wU*_=S!=A4WT_EZX9Y`75CrBrd-k~r#Khuukm09{Mz|Lyp7l3HN#$H}afQ~!1Xf#CN` z-Ix1EU3cdO|F?c8ka5pnAHvqmpWlz##_x7|`k$569EZz{v6${p^F>zzn?HRZyLwB< zt9(IfQ}eZQS#L?J)GcafR)p3+h?|iby(A+JU@p|%HnM+~OIYeraEf0m8F#%pJAb4W zl3^_vsvKxnCTpux|6to`2e;I8J9p3R7*9s=7f4Ler&To;3o)5n?63_}%RCTQ!R}~B zz1U;7wA5bTT(@Y%Sv?$hu}SSO(3FH=-)Z}^!+hpLEly_R6~wt)I9MFn*k09pBv@JNOuuRc}n48e1#f=9s?2j_&k5ei+9x z1dyqhC&@Dw?l26(o39wuj(`QcK#e4TQ+(=jBYd8OdaMQEaKqCPF3-?wjdMm zNbgG$E!#FVNb|cs{&Kf7`szx2XwkW3z;11EaMaKIdbE9be4b9___Jynbp@{cP~w5Y z{U;}Py!eFfLL`_TJvvRujyQ*LkWX`-B6fTFksW_`RRC|BA+41nN751+#2R3{ItMV@ z&OV!1x=g~AmCT-cx%s2;d_QUy1TIq8Slc~^0D*F>nI$Gck-c&(CqKe^HnAD~a*4Pi z?&0fdj9fu+g=xC5WW89J{7c1$fQ4N{`BQi~tE<8Ek6nv)K$-pDC0hal6Ms0GhQ$eR zT^z}+wOvs`UNQ$N)2-h#d5ybyAF>l^${g_kaXb9;(~qk~*WMfqw$3MWRdM8(1b(sg z`NN#}R19#gjTzOkW5nTGFFCs&wn|UN9ljxJZGcmI-bcVmZlm7XWCs?iDJp0D&4(+g zn9=)a6gcMi(D3#Q<=gUUIz)j0X=~>0Fa@#LK?H%0;CofOA zJ@5O|`aAPhdQjE*eln@`d}z1%?6T0pw5u@HubHaRXHgTu%RMnRdaI%LUH}nrvo+*g zW!6C^`Tj>?_}+Q;mg&F%lDWA0Dqr{JxI9-5q|N!QhZTN$d{f-XC_biVyQX^Wpg4;X zVhT67L{EK3{^; zKGoYF+|5_R4|`AJsb1%3;aF#)l5J;>`Rn*y(-DA{+o9P3u$AhqlkQ^T}4{a|-qb=}~2!DCI zvDyZ|+ogn2>C>f;sWZB@x6+L^Ps{)1oOVfMu4V zOe-kp>KU9!C+55;GacB`mr`{@fQaZWH*aF2C7fc%5mx9IAy_KWSJv~>Qd}%R;s_4x zni%AoGM>y}CgJH{EI)4dk1aorKR!A$ON0B_v{F}A7ag;zCyOEcOD#5?!*Sx^=4Y0O zphd1;qq#k@s;;M-wJ1BMx0hYpS~Rh<@J4V#6)m6 zG5)+hvC7Q&uvb4>DDl-ou>IghZ(IB#`ZB!uzPn(|WrPemKu{f3KEyElmP_pVMGJBK zrUkO9ha#(pCA7>Yo2a3HYuw8*DC|J(wIB?gj1V4;rc11e6no{jXHBSkUv2_r&NGI@2?nT=g$_q_{?sM-}eIXyTa5d)eNkuw0#1S^#R}2S zL_yX@3%Q6xS`f8hk=r@jE4kRaJqC|dg4@==3}?vy?E`JJF=;K=b4C@lXVD=^YX`+^mr25mAj2yMe&Qh3ptFX3|hu>;l3)auq$`3B|ucq6}I<|^houPR&US>Upr}3#?PbX_iJ@9r7E`=)O z6gW53wq{^hjfJ~k#wY;Z79rZcSQ#~mSt zrssaYiD==~uq%wc*!~jnhGAy23RO0iHN=+WT@fs&9UX(8sl5YBw=SjC7Qa=$xdQ5} zHcd>UAeRwKI=Achh<$_%r(QZUuOt_#sQ-5fa~mFFv|Xuw5VxtMgi4uMl;KMzQaaQI zJQ_H+25Ma0>2ys(mnLvx`}OEtdp@-ivE$G2~9l66%>aHDhEMXEVA{3Mq9( zo;9>3B-mN0Bug({tGjO}l!`fo%3)U@Tr1vva&kmy1tHdNcL z`BqVV0j@?^w_y>y++VJYvF>1kEvVT0&sve=#)-#q<@E6qvgYbjrn50P%qs80rY~yc zzl(|HJs0Gxt&T2<#HzwIu&P{i_tfLr2@Y1!_OxkgK zj=pA*kP_*0n1jy4)4Y*IHUQT(?c(;UdR}&UVja8b|EbfK+zsv+*ABV8 zW-|O#80q$MjLA6)X*3v5fl-xvR*$vJ*1bU$Ew1HQE!{F}^f#(L5#dftCz1~i-*L;R zkQLDVOVuw;2@X}V+7-54(Mtl`b7hcWJ27~Sx@WDkKe6uT-C#aOLiSt+*KQH;abBJl z)k`%$ULXobK^Q}K4mnCZ1$qc^d05yKR?9M*2)o45<6eR6v~4l=fl+>U>9){zl2Va| z1;q|zy`TmH9A6qK3xgegsvjJi)1N1aY;L-WJ1vLY8qS=m&gVAPMhngn^wxDQ`0AHB zF&5Lz=4-I>4>q&uBch_*8By;?q;3rk6j^E6>~yY7#e6DT-gyz&Uxuxjg!}=HhQYMt zmrE#Oq3e$nIb4}^emh~+YoxQAGgAHHDk#iz;AtyHMW(%f6gYknC;Z+=UCZG1DOm@` z^xFf)NwVDgO)v}Mu*bFso^y)_iH6;&SMPN~)wl>Xl`$kmRt%w$0~&z4LfI|*z!Flu z&eFhp_&R8dZ7W^^8b>oloyjAE+-$jsKrlSRx7!mmK%i?zWp!6 z)G9$VQ9=?f2;|bmVbYAg1%J)}rE73@J6VaI6W3m1@C{F}mrfGsfrzsu^&oJ%PRD~~ zde*Mfh`bT%0*v5-&!aEkVd?=TYG}9wgM!Iwnht4mF=4-F z5UgN6S~lGc`#`6aWo_8hY@)o2+o8VoZmI;%too%RYB;+nCs&WhV|gVwGdE!8U6z+D z;>84Us4v3`jFYOQ`*mt}iY1KDn;mjNP!_XOKX&r4r5!LR&Ix-xN1gY?X*Cz9rJqtx zlM#77;m=j*bFb?-@GYdz<-LYWSq5YoB2&^RlBW5ERFZ>#4?*<6qjA=@3i-b?ua}df zZc9G4#R*l&6nT8v_hV4??;PC@&0LVDGRZA)b*yp0yW5(=>+bn2Svw2vY|=<5pwaze zAePuKnq%_UGh_FcPfmdKuFrzlWuy7DPNELi+xw|;O!4s(ZqVN!Wrm@+Z#Lto;y6S% z;_iVkWO098ugR3fJZ)X~qoH|%lh+X`Ks?O!E42Q}_hJ5vQaLS&vaLA?amDb`*jx8Q9S z*(xwyrb9qCTKLoS(-XWRz)23`=kt5<^KYPApP^wF0Sk~%bzp%&KUXfZ^u~lp*we?uz@%6R!_!{JDGFKTvVz8K z!}+@m;A2mDyZKKjg4*ZO%e48uF|9di5pg7cu_h0#7)VKQw_uPZK<4S$ds!y9fSB>I z&|pD;iqhn&g1R%11t7Z?IG{%@p$R*SL8LR=uR6SZ)4s(33u|9ynopDRaYg7J#z)K^N|Nz1qy2TZqn1C4$Q%)DEM>=hs2o zFat=k>7-U;?c@n!+!&;>aHJM&Zce054?5Y_M1R=zFoxtO5xRu?NsG%!9ps8)K@(1# zoMsg{bvpJMJEDL{QQWc1uR_@iv<40kp&BP)=B+SMx*%pQ18CkCx;{HZ0>nq$joO8x zGhs_*B*9L|oLOuh(AlN|wcjlD{YtQFeR4?ka}tMha(*@joFvrGX?qokN&&yELjw9C z9KuAXI30y>OyIYmRaOMwP!odQi7Zb{+21^8JI!H3<5YatS#fL(z9sb2yJg0;{2v+t<>P=MQ==S4xEc`W*ld?SzKhi;>* z$-98$>m*T0O%*Yt#_YvtQC% z-k#_nx8SVS6Y_NH4|*3H$swsh>%@vmohOlGt!rojRD~yzKE^>`gg01E+=vSiai|JT zG$EmZOZe1$Oq}`hmt^CJgKeHgqASV#(fJJHTMztI6!9?oJGC67LQoB?28;H>4o%oz z1^cD$A7L2Ml#jgt6+ab72>lok=jbU`{pJ#WmUTY| z*1lzqhO2Twf@bdV(B42rNyKM2X5+FR*Gb{(c6aODWB`V_3FX5(xZOp928+3R;}5s9=ychh}bl^h1t=b;rDl1HfZ9;4|Tc z7)`(4Nbr@SHvd8>s#}qA9+j1abg#sFO|*GQ4-9vG#?#nd^@MGP+N_9V4ct$#ut=*K zY|qn#O6Z@ux`{D?>H6u>fD^gC2<#kDS_VY%C^`enx-ZpqZOfW{({UM9z?fv%C>1eO z$}1L_w%SoIJV#RPVjI8I-^NFA#PVCN>H5`bZELzQKI4zL!|-6?#&ww zK7(SZwH$=0b4odUzQ?%Qk%7&Hai!1Oy;neFcA&};iz15W`cm)G(D|Upr9jp(!k0>U z^KxZN7rr^=(rK*!;cw!rW^s9J!T zB1f5S@ryZQP}5cL;$@ByRPa0(gH$4nDaZIqIS*K2AhBb*CH1ov{euq%qZYL!UTCpn zfL(0wi0pL$K$*NXQDQ+AxmaMAhC&EtaM@@61aovYwz0Tn<&||RVm%-U20Y|x`}XhbL|56knQCgQ#EAexqFON#|fHU#A@074sj zt=BFm2Ox6E9iTs)wU3&VU_0YJ#%(E}_XO{QQ9*9?-@sQwK1?*lyaRCfJPQ`cPQZtr z8Ey!&KV(pRCs_j4zTcwu<~3g`>NIXmR1D1u`Z1t#{PN!XR+s!Qc;V*&u-ecw*ENuU zFwqc)p1og`WaCrWB%6`PP_dd8KgZRgSsV`KNMUPcrIN6DXERvvGq{`>K?>OU)?1ju z6^Y(OK$0*p^if_%iAI}}t#@hGS25^^{;fMPjz1j}=Bdn z_AODFg(=%`aSecbO(UghSLJ(y3gak{y+P@HRykEeRy^VtP8Ay`X;Vy?rr5p|^OCWz zSV5^`JYr?e;!myEDwHMHJsBdVwse2LtfK}3JsBnCMi7|KERe;VPD`PeEi}cH7O+0(Y$+9{p7m% zJnF>-0e-W~1!9zE6!h#K?-k)t$#goU@1*r+QBZDLI2$^|!Ke6y)=-q$&GYKB? zCzP0J#Uz`FgBMCJAzvxyF<}``1F?H=S~}Wmj$~z;N(0q?Y+=nF*P1k)i)vsH!Gjb6vk>ZZE#^{Su&%x%_5dz zMySbuJw8Aw&CXV&rRCJBE;L;#Nn8(o;sJyi#bwzqo61-#oPh?uJ(M*Gk|mw)4J9YM zY4u(`%DB7W0Br`L4+jvCz5w- z^egF*mv=M`>g?Vaq&iwSz79H86=8GXIqX&JakJguB25dT(ek>2YKt@ePm;4|K={)q_>)CTNHht+1t}2TN%=C=}OK`ALEt zMXy7FWqtp<7b)wHrA&%agLJACiAjf$b!=m^YLn0sX<$r~GQ8G2Ki-Q-^l7D|Le2Ek z9@+@De3G1Cpp|Y~9a>^)7zLZdfDbZ##A3uxI6SM91=Z-B47h`x$9XVur^t$I+Q?#T zULd{7VX>o9u2H;HHd!?c9trTMU<9|)zfzL$2K|kQG$v&#Gnu4_v<#t;cW#x1GsKC- zA7~)L$<@CNYZ*c0&Zf!X<*KT1_f96%6y#kB{#seT%4Ctvw>?lng}kucd)!9E<76b2 z9j7BlRms$93$b<|LmKEQS!68ElET}2e18l(z$y=*H)M`Fqf^F?BKoCG+-DPy*11vr zy)aqC5mpLb-vTX`51yTH5ndoLn==DqA~EA-Nih%bDB6HYMU-_=l+Vk{5|qk_AExp zY*exwszYkV6nMa$q%u&d!Xal@HV}FF+sU+`_^y{o7%ztwMC^5#yt5=b?Y}bQp@N-< zSbH{bchP zXzx_H)2wo=k#j5DHa0zlIVcuw1is4bd6@a_sq3)40}f%_=o)eDFsEJ_Ip>Ls}!~U7fpEzn{c-`n;AC;QLf8 za-ff3`egHq&7mJkG6+xjKLoIZ?cL0+fV2g90743)W)F9w5uxfNmn!qL>k3|A9>q=2 z?pZ}9-ePrkvvgO=PpZnsPXe*LuV4h24O{UMFXD4G$`xGZ9mu9gPV|#b#fJs5_>`l0 zm{w1!Y6m z6r#DVQY{eUzb=M-L37YSum9Wc^B*J6fBZgN%uN5!@bljWG1mW;L9AJGJYka^sr!P~ zzNkVr4d|sEz$-sNy{S^KIxZw%E{KwVl}I!##`+%mIq_+Xvqxiz&6vI*MBXre>eJo5 zqG4hX0QY9mJLqhhcXfFYRaRQ|1*78JnRTXYi9Ms|>v$A-WV(V!GFCj+OxGl9rrnau z_ybH%bYi^t$OlW7GB1njfjy>CEAX~$fvMyAkfKSzZjDP%Xu4rG{mm=!!iA}v<%Yn% ztv;m)@-Zy(JDBIuKRkn6`E-dzdM|C2;6tboMT4$@q zSEj*_+??wL-a0L(^vm(%`|9)N=!SHes0MX|VEo(?)1)~}F)iG;)uq3J6V*HsJq+4e zpj8O59`9;4wv0CkU4dEq`T#|ZPLfmlqCuFagduKbbK%#y;^iC$wKcn@!w{k833Y#n zSsZg3T~z|;1ek=_itrhgO-i8msQI!5Vw=W7Kz{^I=!E_lg_c~2Tv)RRgrLIAZPqe>2aDl-Qq`KF6|Su@F$$+i^CPj~gR zUnknj8g-w&41_$+yQiw@8znWot{)fM4TayHJZtEXe!2Y&}~F+ zdNxBMu5Q#v$~I3RmKR0u?!}eyD`AjM2gaukqLr-|P>!3!J$A}*S`u0lM!**Q)Ay-e zY*PtAp=#bcQ5J=Mux2y`=0C> z0X`p0Tr>QeA@%EWVP;-Dwo<}^QAbdnzAf~@-M7OlVCf*$76k#?Yb>7e`xD0Gg5J_Y?v%=kpwbUO-${^^nuLOQod2fy(Ru*&0Ri79#%bfcR& zb>Z4DPRJ1%(=ko72GTk2W}PJ-USl-q}Oj z;ee+o`Fr-hD~3p0bzSWQ*+7FvM^xRp3XOn87h6ylu`4LrT;`N@K8`~?ksn}a8JAQ0!Os;g@&7S) zPHmcO+qO=l(pIHy+qU_oZQHhO+qP9{+qNt1Jag~oS^HefoAnRkB4YH`TfD6ePHX6# zf<|u;RyLqFt~CA4y@>ze8b|b?{X)GL*CYWWT#olAeoj&YsX4DoMSr1xi&W+iM znug*N_lc&iY5nqIv$a;ngg${z`O3M_Er)kk`=sYNWaU(Yus2ooDrNknBHhulbuiPn zlX`=08*8hq=4{{Fn^G-cl0E(PUtAr7w0mC-HZ;MR*I5vI6fjl*BKM7J7b0j#tN>1; zYw~abP2~He@Mt3F#axY3A`gp}bg}zCG0VKLDwB7i&%y?+m0)=CMZZ(k!Fw*vKR5!L zcN_-{+$U)>F+s-M%!4k zzOq<32(T{cdW}aPAVAW&*wR4CT(m?m_sbm8`{VKT)Uqce&30=VD#2t1c=aD*XZcne zW|<2ivL9fA9c~&c2ta2ZYot^GeK0~MbBn43xK^)5x1!0yJSO3R%L;;b6Hc_|e3>;Yy*e}B{;7jZ zGO{yr{s)3({x<~6{9i$^J%G)`&2}{Jyt@9ZisTSdfk3dYGZ(hwWE67lN}mR0WmM=G zOyy#=VpG?9xS6t7{6!$B9g+2&iltQiZmR=Fxx?%mh)3$bl*GN?i(fgow%(3@50`Mv zKT@52ji4Sq9e_*4tgDl-Jfkmzrmlu0%m~hip?GU}cHOV~jZd5?eQlv2f&@Y_>wBC! zO?IuX^RPS=cJ9)GdOZL|1wGh0&yG7j?_USe9emZ2FlMZIf}7Ac)Bd4rqj^)W`?hAT zvJyOJEG)BhvM!5R*aX+HOb5ai7Ya0ga&yQ0tTt^DbOM-ByUvmUEJ zP}~9&a?4P}=y*s}^t{!GC>SkP+b#%+D)A(2PS$jG` z8;rnl<5C~iOn3};*V?qS$*DOA^)mOsWJAl#yd3#c zYaxyFTzNUnYU)uKM>RpI0Tf++jnfVCHmjU-9Fe5PTLy=lI{tWAqC^yNq*s79e_7jmr$JUYlm!)OM`e+K6*Ye!XPUqxYDq#Y1yc)s4mJemaO=hr2g> z=Z8HW?QJgYxWP75$s46T*UCBFbI~qR3F9#4X#IAduIhNZL)y?c114D-Opx>BNtGY@ z@hK^JbMuU+#-%miBL5z6sx2F+Ao#Yy;ODGhvH|9g%z^QeiIe7IJ~?zAc?8(rK3gyn zI0XClZ||5~ZxizRbdF@yyU!lTKuAJ~Kaaa?UXr6GHB2fn-;~s!QwXK=;ZP3vwVW!4 zsQl%}=ViU73r&R@G#8RAcjWKQCk4{0b_c6TS=d}JeBzEny^DV_ow(%!Q#*s&LOWXZ z1WPQl>6FC@@w)1uQe8x(oy<`S#FvpL)WsoA+8_bfG4I2jB%20lN&f{iJQqZkgmttZLT=9}G_RR*@;E^`79Ps@u|es*iuOzB&$&bm zH+|jgiSqJaG^o>thDy+^rK?M3YpYiE^)hK{_!B6x^HMF<1u7dY)~XN*h4~NZ_B8Dl zg+I^^C&j!a+`)T3GrzT-0|y=U?~l`I>m(%M79Q~)sg+k!{p$VqfTmh8zG-jr3ZgAl zBzorYZhZVM-;ZyPTKU>OY<$FQIN7ui;bh{~b;+l8+{9`1-cc2Sv|P+`dC1uO8RK^k zl#`{4w7t=Vwk2#5atRsQEkqri!(c;dxNSlrrQ8xLc*u}%3(WHbZlJb%S9s0>`yF$B z&gU+9>N^fKScgBybiAJ6SA1xPEVa*7TS0H1eLp|su{wb@f{NW#PFpDwCZVL-Wp`fs zrHiYlt&rW94T|0M^LjNpZ@{EcV}wpTgvYg_hDsXGs}7~N>pkYrV6>S>FOynO2p~#g zEdW#9^%9;Zfm=7*c4)_+T>TDXq+~I3~2{hN| z{CkV1OZQ&|#h>q|y?4pOW)$Jxw{Bk!Aj~i&5?~KFU01^UF~JbEMa2Rzae%vw6b=en zxDPLmyeqi2b^4a}^&U2Pr2HRV)RyZ7W(ntF<|kLnUtV8TSQLqym99IxuxxJ?k>%HR zg!jgvePbMUi9F7C9Vlgq9^x!Gw@$RIy~0dQ4f59&asAh zhR?DIUJcgxU%&@9SZvU_wwsZV%aeOUGfliySsgk^-`hEu>E-Y`dsUaE6H{4(;efBa zY8DFHZt=biO)YRWX^!rPcJFeJvBq(5qobUvLe;gUY*U!z?V3;^f(Lnt^#0(v&cInL z&J;@)Q@l3AKM^O*94h2Fv+wgGoWM(;_WghriIde?q%K1*zi|6rW!NCejBM@nW;t}7 z@ZG$)f!xxYz%2?f*gJmco)seg;ZeKPN*O5g7x8U=P@8JdUR8DqJDyFwizIH=2jpY5 z>-+0_fd_U%#Bjx-Y^)M*V>!&C?40oA;=lzS`7#BsF7=g_Q*raIckO{eRw)r|RMX8u zIw@Z1?miOVo>x07UYfzac!TD&^3SvMU^-h>b$d}>AEYP8pGUO)01>D~7=GyppU@nX zyTmju=!c{P_fHRdJ!EbTF5@YIi0#+AzLFSeYldKC@cwjnypex@BKXa&YyVqr{>Or0 zVrBn73x=8fUzsarj{hcewG7yH-0Vd9C!@Dlt3WOS9DMxOaRcp7a2sC_NZ&aF?!hlufzWCZ`GZA*9f=;mM% zye$v;r)(=xeKHD4o^~=Stz~mo>~Q? zDZUNI=lN!Zx3fZ{cta`AgibA*8V2(oP>BF@Z);}BGt-nTc^&uXx&P}!csb4L-bwK` z3J#BJS;pR-_MwhfnX)XxYl@S{tYeT^u~5KWh$!Qrf%@H3$604N;g~3HAX;USzxVz8 z`XFzzPX=sgKODvi90g!X>!Ib3WfPp8?X30nVSEDWo&Fq25VpxvFZB?xW^ydzM^Xwt|Bg%X}tAd=< z3_32v&z&MxB{+-<4x#RB2=c-?8bvc11@~`AJ~4L9yt%@PCyb%?aee7JH*#=P6{0w_G16KKUp=YA!E(7L9~qk z9b|3=lttUH7Ttns^vh+cBYrfKk^*!ucS=~>EBwdE#_}#c z!uBO=I!ImhaB|O@bi`kK9wYrHv&2K}!&U`zB016oXry!9PVKCT3}|s9N8j8fJZqtX zIxkek$Q&h=loH=@DW{_lp6zT~BReQ&$zE*?D2w2u9||={u-#C*%#bXbu0eCaZu_y= zx@xENGlnwCCoJGL(?=_FMw5tXoTYeGfwSdAZKU(uvxz9CieO+?)GGW9OxEB*;Mpb0 z;8Aq`gVZ&BmbHJHJ9J03Ny^m7$y^<0F#z9o+`xtg^Nvovw&1sU))#>kMTY!D3u@*c z&TCf`cgobU0R-#~(v7_fmLQ?m(@jo|-&dmW{VBpBTI*F#rD4v~&9kCVNc~P)O9V*K zVGz*iXSgKo!VIWm?=$GZN!a;DS7dVK!Re$05Y9$41<2#Z-K)43t)br4`H22Wt*y95 zew5EXO|%5H#ao!K&SCRx;&a1@BpwvwFQ&*KjL?GHoBA8-Ntg>7cL1dF7(m7{{ur== z!jb|=XeLmHWq(aqDnb~; zilC!~K<_-{_65I;ZUk2XTS$r&)PV$c2@iabvWa3yy#xHYmq0|k5 z8;=o!X*E%<-H;yJE}pCMOJK0a(V|4`aM zPFMJwrL4@%%HT~C0>L$8%(FuHc$mL)HVF@Zd;RE7YoxVaMG62Fabh%3M-A6v8AN$)LZ+cx?dQQnBySH6&f@eC0*V+pp#|_YKK0d>2GgT?r@!8>A?1v4G=?QnBKG2JrbeMdf%sSanSr$) zU_0v%nA?a&V#kt>&on7gI5(#$W`L%6mK#oBxgh(?|h70m$dkm@%0~WmtS{Z&RJ|-oc#|$m8;S7nGv! zNZT2o$V@jnr8}#+Z)mRoDLNAlWw^^?r@6Z8+HA54D&}WPkF#_7w(1zF*y5-*1hY9Z z#Ua|4$#o+pS!q~pKtta5d55_J)d7_IXh8d`so6uyEj(ZO9q%Qs~Z+Zp4Wk!K;(FeYS5T)gO~@VAPFR| zd9zMfq07Ep)s-v)I}bk*z@}Z73G-cRc?C}%gO4n>#NvE4l~|J_KC{Oh48oqJf5(cf zcE#ro`b&trC}0)5f?zt3vwIAUIp@)F&0KNz@~Isk{P}W2n}p-MzzTW5gvJ{R4!#reV`rtrEdh3af@9&v$O;$E?-+|MHGiM6 zW%quoclvd{C0Ahw*L=dvW^bNS1kHr0AkzqK$X8-~J=~EQmokf5RbH_jf4iF;vAysC zdiBLJc6gG3{UD*wX*y#6fMW2c;v6Qmx8cW;=%c<~1zeJVliVmv~Wg&r@iqSRsnJ((`X?i1hWIa6xbpDk$N`4xu(%brHSKWCZY z!KT1zZc-W+2Pcdd7wtmP6xcy*-kOUpm$x6ww5$X!A5E~0?K>Qg?>f`MC}7Z0yBt3L za{&5-I57nj6#cwtoNE&;r_>Vm@bqPT308o;z;D)8ic$uPu!w1tAn!^_DcFWLUtp{$ zBU4Z(YZ5NQ@=4{Pv!&^Ir6XQsr`@q{@(W`b^ z2niE<>ql}$OreEPoEY=$bM+Pz2APP81ksrc11Sy-O8s$~`o32?%SI5)7yJ(x&jd?7 zhG>iG$@Tq#-Q5HKbAL18zoqW~NZ9|aqhSC4brdX&|B|{aO#hA4Z2@dLZi*rQQ%pRi z)lcgbH~@Q6*tT{lb)9->Y?P{dl>7^X5ZVekA6Oy!8Rwq*d-PG;fv_T~gf>mO6>91+ zo3HHS@s2u@QLy3r(Dx(@5N&I!XEywa-huxH(W5hi{$63i_wm=QfL}v*_DUKo0t|X& z&XGClqU-IxuO5o0jG;t|$=$FcQ*^noX954~wd>vvW=iRU(g1nXA~N*@@W?5}KRaKy zS-22~GR}y0)3EkW^PPpB>l^JmX_f1`CciT#KxmKkT=!!p- zB*KBn=zx!b+SqEzRTi)vJ-az7dVo6Aflk87)7VI@BeKj6)ogVlBKG8|!$MZgm&@`; zi0b^Mrmf3m1&#K?b`ss^FL##k9oPdR5rH9-@>Y?LA5@4DGWpO{$~JAaYJTgPf=|qE zwlV)Ut4K5|>aRC2$3&*7bbg_~W{?g^EFcneld3TF32Q|*Gfnx715D=y_LP{%8A@YG zXNRYQBI&D_+ocNw=Nzoi^t{_@fHWNwo4-K?CRB{4conY5jH5(oj4pZb>R6Bi%D<^^ z8c_!BFF}grMIDGnX$FEB9HW=Qu+TLsPynUXmMNkE_RmqP8_S7$2j(|*rFHpN>5I|6FC}r~D zu{iKnL?f{jC;AS|S&>8O2=+M)mIK(hI97`a^UswR zI8rS*#Io;B$AgAC3|)or6b!vI@KeJi!UWeK_MPwRtdzw&v0bKX-HnJQ?3!9bvXf0G zMM0=!J(vt1M4PREm#RepA+T)kkD|4J5Ze>j2_dOPsC%mf$1Ng%D3Zm{?pf`bj&aU; zRc`?llw)3s4l@QC97_XdrM-HE+34HiD}}8Ft8%&hGetu3cy{0)ABkyCtG&c{#fA!8 zsW7Ebwbo0&Scv12*`CyAJ28ycSep}61q5^ z^hjHGstKcIJJG320clV#BY!R-wwh!SLEJ`xymHyAm(jCl(S9f$d>fhwqanyYXEj4c2*Qz~LYJ#T-tW+S&q2rL|-XuB# zR4dGfoY~9UzH|PCwd0kpTI}1$KNpqexaLN_ju9q(n*eU81pAUer5O2!M{D`NC>xI1 zz4i0<)xof|0TOS;awrIu#7U!CaL^FKb=)_sz?8=Ep3SHJoO?pN8_wA+=)1mvyax$5gV|aF~zn!pO@7htMfhQqhTBctIGpOLXo+Y$Ja%c-k zNX5tF1*+tdUuTeKDttbSq4DD=T6t*L0PucoT0;+qXgc;=Fef2RQoracFua)A^7&6c zp%drDB?70Cz09bv=-iofUbw|E=<4rU_ah?DNu5|Y4-27NeT; znphIztRQ7l^L=2Q&lcpY%mrK2kv>CM+!J;c6>drz(0e_iTMRFjZM(`ZYPM zg}P&DmZ(`0e>TDD(Cit4V1KI>>%0yJ07LMkQ#E~mw*swh7r3@9uf6AH%H#t{J$(_p z+kjcw71I-){k5C4EMZ(m$0@PRjnp9*DrT z_dzw=TC*Z#F~=y16Syd=A$rng=DWq6ZfqTJj&*WJ%C~(0Dt*jI#s}TcG0b4rV0!>*(c!S4}=AYvmxZ$=>vS=APdZ$h~Uj&PKFC^ z`NFN)ihS)SycYMW7pP5}qw6I2a4wrP;I0G&<{W?LkJd%R(Xig&6v|$LLEw}wp&1iZ z1>gV5Xk5E#+WNu=EO1=3;Gc>{oUu1HE7)5 zOV)7BHTwo@5};$nk1#I|mm`8---PDTzPU1=p7tk65&V2i*Pu80Hk}_eJ7zxkH@3^} zzItfX?gB6smFgkV^Od1LE@!Q_+|J+9R`Hu@bHTN+>|J6wQD~i={QJs}vV!JT@=lby zH=TwXsesAFe$av6eMSZt;}!zGggCRW~O5&OCpn|Sq}BldNWk~Mn@S&7M5zxiDh zzJMr!&b{Bh+XTRIASxSUa&n)1A_8Vou@4`Sr3wT;y6VZd@1T0FhuC>U8veo|h)rts zJub;H>Z8HzGG{j`3$wFQS<4u#Ab^alX$=lYq~8N;es4^v%zYIY1Sd~$Y~A7i=!WVq zG#yws0tpZs*}2lelJ*8%^_yt?@o9q2V31|Z4!tZtsQOs2Z>JfW8~Q>7KCQ<th&x`(y3Km@H!|EA_P&w2e_KB=qUZTus8KWjN2(T}H#N?ooX$EG4$F7H3{%ecL zbZ%2ogMXQmn^&sk#eDtOqmxN;5ZEGa#aH62n7^t@wB9`@t<>}S`c(%nwmhGf3EnKw zkg1tq?Ots#x~`8ZraqiT9QIX$UK(7;i}G>4*BAzBHAQ!E7d$ zCnk&v079Z0 zdN9`^VVA<|XgK##)h~`#bU8$auyH0|M!V1xgbt(8``ITA9gX3Jm~mr5B+nbmVy!mo zJKrnGc+sLLqsgOzPa}9o{=lhB{`Qc0fpQ7QJO~z;C4jrbM z9BZ*XQo=SOQXH*4(&C+r0H?`%yviPo6X={+YibV3wwS93TjW@wf=$(m$m*teqvvo0 zk>?DtKJ4M1LfX^U-WM4Mi%A*H4fv#Tril?ell{y)Lux+;VCXCxOV|OGXDLdPecSXa zbg7d$*4XA6DqgZ(0rS`bf1(J_>d-cLC#t>zVv3MDnTEacnwVLzCC3&~2|$e9Z@VnV zhFs7!MO2oP2;^oKm{UKVnktGUTUgMVD?OTxnx9pNRpdbTex>>0*2%~^q)vJ%lpwTf z)1fAyaL@;nWe^`+8x0Tr}OOv%PR-b$P`vM z8!5E6fu@P2`%bhWv|AN>9>y8t9 z7M+iyn=nT*DZk+jJSD1PjPr$-p4aIbtIXmg4(~CzJwx7VZIgD@SZ{UWPK7Ow58euP zLePn&hkixU%b!7VtZxZ_v}gYGSg&R^^phf%L~DHtVEQW+{DnY+P_eva!)D-)!M$2# zdtR4Bj7l_|5TX@~5$k95qf!VALk)ios53Q%s}!TTF>K2a4LaFbM(Z+u7_iEcRpZ;GcqA4(Jx7CyFv_W!Sy{u5#7`|{ z?)F08{(&m6w3Piv!q6$Pj?&ufq?MX_*|l-QCura?yN6n*AY?3M=Z2bP|6vaT_XD-u zk1IV;)cCknyKS~P?~M^j#nFsqIK_Nk-I9E=l(!;Gf}F*@EdO%znH1X|yK9^i3_`9Fxf_y{c8)cdk50?xkbvEFaVA>Z^Iveq5KFhj50O?Y6GX&AAOJL`Hzkm|$tz}lzY)9Ts zwAW&6G_ZvBQNJ|ASsD35lDseix0 z2Ngc`tX%lC0nT~RNtIJlte0_Q^tLurE;_>PqdTKL9P^X`SMnA!-av|HAa^@?87OO& zC^yqOdOP3E%hYXMap*dNp)gH4S5C+Pw5cnRb)lDh*xneC5- zWF1GzGnWhcO1XNTmTU8!z$A3~hCXXlvzbq(Hd*1R9w+}>)B;`6NVZAcMw;B>Q`Eo_ZKrdE@x^DO%Q6x&P~$vXzgF#?PV47xAj@H3KQ*vqfUd2w z*p_L(CZluP-6^LJ!8lQW1B1%qK*C~oG~DOqWE3CCNjEZA$l>lLSsN8oNwO~?CdC=s z$TCO*;|TNo<@n6a_X7&nri=COvGkuFZbnv4mjCcuEdOSjS^q1hc^R;2yEXPdJ=~Ad z`f~aEiPK%Xjk=%?^#Jb6@m`4l!319BXwD-V`ot%MiLxvH6BWHNycvm09Re6ICK~g# ztJ+#FmkX8Y*(oQVlli!Bo!_-QtzGYL6KQ!&UsW9ScI@g_nk|&Iy>E;KkXhF$p5tcF zW|EkV)B6(^x9VAbMkv*jTLfbZh}3MyDT~z~+@6oqaTy-m4nq>WPeV&jh2b`Mwb@$a zojMIK;`4Kk{4v`E^OHOsd*6q`tf*ekFWp!VndmuMBR<`!7puNyiWA6BYcGGdrinBg z;fbyB8eI?<8*xr;l#j$)0Va5KNaQnmyhH`tw$nHpVW&6hFE zM{X_pIct%%X2O%5u78MEABNUE&Xz6E@Wxc#wNnbQ{+Se;ZTBl%G3I3;F9){i;2XhV zFUp9B*$h$BA%5=xxcB00&K`^Sl>y7wwVIRl5QN^jB_l4mlSZ{NH20Y)Z}Iq--AGsI z7pm&c(q>ySwuf6z%DLJgv8^v77QU1lre|ut z7tJoToubu6{l}Em&(YJpBQC$R+qNn7PlJfr?>l~6Ajyx=U0&&5f;i}CB#_zfnydpE z;d@Oz0M8RufGaWsHV;(~7CWhb+Q*dx5QjpzP83ggSbhPcdTWZ-x(0I`(5p3zqd1{y zL{>AtB<$R0UlXK_P1^51`NUsHdn?IdR);Fi$Z-I#GRLZvMWqK0JU!~Kq)Whw=Kht6_}-l&+xrO<)7n8`IoTRFf2onF}H!rPOL?u$?tq2thA;2#ry zZ?4wuyXa;1Q&VL&tGiQ?!yt{fWZ<#uZ4v4;Tvc2>hy!W46^pxyafCjQ(4or9xymV@VeMDT_KFe)6hE7;U{0BEzXiNSmbwb`U z+1ETr4=oW0rI2yF+|geGViyN+lqvT~Oo!$9y}Ip`ci%vs+1-BVssQ>@VqY(9R!zF0 zqw2L+Le)pkC>lK8CYpRlPQ|6mA#1>%XVax#@doRXiPT8ur*|Ee)u!vPfP9x?F9Qvd z+ce%Ynk9KeQ&&m%Q8*U6Tekv+{8$rzWT7Y3jP}6da7rkxx54~RhP0uf|2nB_Jy7!b zSX~w3z)!KzYeLwGQR(J`6uP1Y`9AI*lvHdbWtGsc`mmn(z&~<2YWZR^74j9E5ke|t z>O`b<+7r@sUWT42h2C1DEkT? zY;h=V6OQ`{jiekat0w|B@%xgW08lNqVy9@2vu4#IfnxrUuMa{R8>1d#zfdV<BI4=-gulARTk0Q4jJk{)a@~_L}-7=7q^n?Ztr!w6VJeg6Nl@!l>|&{ zG47U%3wkCkRt%B|7`Mx>bag_)Nx(94S1MkZzU~hjN~4prm#BZk0X^GOlJH&V#LHqC zA0%keK;#~xQ@f&zA^V{V5YeyNDD!LD6{@yLC4bDD@>W4aB`sJKEkY7|^!0RkH?*{D zXjYPjwW9RL$+$RX+|$ka+imT%ekqnjFEt*$mO`PFGbKBpA>>wJkyf;Fq~ zNOl8QAi`PqyKGw8H7acrX$#NGFHx>Xs{m?zep17atZ-|hdD{Je2d#}d&Bho(R(ldw zJ~8;Bc=j%@6If<&IW94F-&R8?0PbKehRKKxEB}-Z+R^z$V)qz&70r@8iPhVss(LJlO?@3DU_6A~<{ zjSNj5a+DJ=VVLtucp6Zd9y=%%{aR{@2ii|(t-Lg|Y-9t%DZGgZy4{;6ho8n{?=!1NU4~PEAP^_YbE7m9%tKt1&ma^|^c`=D>pA?S2zzA|Zvf zK<03TE0CErYecn1rICuw#<_OQ*(dua`E%t7Fvqk=(~3sb07|eB0}EKoEFd`Jl0iSD z-oESyO$;4Qg;0|hB_+|hLVCuI?eJPE0F^$gTtrv{sJe(M4r3Y+h!?{e@XYQ&3` zC`4cw0~rEiK7!Cox0$3>sHL!;LQGNV#ARPaM#P#1o|~sQnGEW6nu@Dx2O! z=-Fy0+o-;ZQZOiW4UL{#$DW_^9I02+Zd|&26Kpj7u%G69$I11I*e<=$lexKyKmvK-Rk5* zT|r@GaP>QjmQ-2gW&pJ_g}>$QLdW zAw4O#0Ha7KwIcFE&e7B21=tCB>8WS2$fs=}gb$2G+oLh|=O>_2?7(2sLI6}zuBhN1~#s$gRaf{Z5GNtd#i0&%tc}l#; z9@v5m%*Dx9CN?TMlg)0XQ)#=>1{^t+OW5c3h*1h8h@Zw*>eXpI?qP#Y{q*sgg_4b| z4kE}vZVMNt^;KqTqkMFPtJ;vemHm90Rh&K9stRP6>z&$EWbKytx+{35ZsndASRTKcs8XA86Hg*}M;RE= z$9zF!c`=f;B?$pZhxy9|)0eyT&yelgbX-Bo;wJSo$0$7h)@(J!pF&_l zt*yWJudmh@z>#gn-%iSLSxpV2PAH~(!!qfsgq}_I=z=p{w3eIp(;FxbDDKY`6Zgjz z`IlT08M;ca=WSY%FM}}9p0OPmZ-<7@_gl9k9Xc%(f3cR`%QiLi$OWfoUVWV2lz_!= z`DouW-~L`#HW!)8Cg#iKTasQuBcAH1&rfl*Di-&`ad6Y|Vnz4z*r%yv2{mg<5b!?S z4Eac?qC6Q=1xF1uFHOAG^Rx=Ab#yeCoZokaF=rJxoJcOIuff{Qz1+8sH@7i98T*Uy z5=)w`_e@GtTu7cxjKT2k<|BbH2SLdtsj+L+_|OY|;BfBxO!5UbAaD{JN^8f8Q;I*} zbM}%eKDatPA$)#f{BBt$`PTyRzl*{D_*%>iEdRGau>Ly$!unqYKx$Gp<+d0QLvJ5Y zoz8p0BjhEgaG_KxEDKDEb_7BiBhq9=k;j0CH{G(8+1D3{G;5lvYev6+-b{IX!QzPv;G``xrh+IJ3oKt%?eVIXiz{2{pUC%ff=d2P7jN!&By|%_H!D9kQSa zg&`9cE)j-k*jK_OQ2|ixM;}qJe*}v)k!kH1ui`0jD==3jpa#|tb ze*KMM<82oNpW_g^IcTuSE&C+*ZZcw@V`(C+U2$g*U3+J<#>y$VXc>azl8?&h;?u%?oO~&I#8EJ z#7Jpf#S~_0_8jdp(o#sJ-}5xD%&`GDqZS3dc?h7=yyJ%H@l=Z*C01W{$}u(;$iRp9 zr|Xl|&L}2sjoOTAv~+J{rv4IVAS{rTol9r=v}uh2TCDsPkm%DoOOED2^wu5 zcxrWHZ4mQ1Gf^FEPw?zD;ND%7P5$6+#dp`>tYMl*T{W=!gW8!9YG5}du$0Rk9(8un z|PC(|?3qRrT;3_!$g&RypYdy&~*CWT=C6rknf;2d0@*V_JJ-R|&8J{^~wC^SZ zK5j>K%+8KvSOIXyW!JsFLCbXPQ~&!D`46vjqyf*=f2kP4?BwaG>Qi*FssAsVcZ zAR^N3vbC{@)8z7$UwRQQ;kRbOM6~om=A-%YNjY4!ZBD5&Qp^cMK`^# zrSu|cA#ggyG1O>I(-pteZ+tbIflbB`DpBYS`dl1mMB+|V55Ak_0dFKSu7CA7Y11`2 zdkvCR#ei(Ph)+Atx(nP;d494s3Y`!5UteDlK7~xkqG;>c0O@YI@`{SKJFn%<=eTd68 z!7i(3r}u#-BBEq0NuE1}yiGR7G>WOms%oO8N}t(>^CII&uq^ht;Lk-W`rP`FkU0Fo87d)Anj-VwTP;xw8P21ehED)y zX?p=<8}j!|-y0)R_faLi-n9ZfvUZ$iJ^l6s3iY+F?P@K5sduf?#rY_xi!#as4kcng zkO>Sm&y!<&Qg*}1cH1<=W#PswJ!@hk;xX_`GLVt}!t>&L~(X8+sY!X zUf`)h-b=rUx8I6vAFghX-b~&ZnL+sc2A%k_a{l)V{2vsBjgk33FEHD`NffsKibToL z+_c@4X#JmG7qm+OQwC^&?mZq-v(5lmrkvb}`G>vVV9hFx?m`KciH!$up)+Mu{4*Oa zMhU6e1A_j;4N@-aX)P-|s(p|S!-47F>3-~CSsd=&Z(pGmyAUUN(}eDBZcfrgH*D;F z?_P5FTi3RaX&Uhl1oDe}H})v5@>N|wLnN5$Vvy08P`((AUU{g%;W}i&$>f7JNtB29oa3HKEqgz=oLSPvJ(T8@ghaGSres`uoxJ*Y zCZdl|g4%BRK3R4_$znNVkhhp>V{s#Rl*NB420Of3WRU+nPEN}X5~Z4&W_;Xf*Cleq zi6jJHx4-Xp^_{VLAg4gHOW#})VpfHTLGNiQ$vJ?qD^U3fXW_UQ-r! z^rYw{Z@0HabqrkpbN51v4*yNt!%(SYGR9zZK~g0}J3`#{-zAlzVY#yF!M|R9NjxzV zOegypVyf@$ZQA;>rZJ<1!6_5&Py1_QpfiyTOt1YxmD>>biTYQuxYH3Op+#Fueq%NY zZ7gHisx&hb1~PP40RC?_PPQ29tIzvm46Z9-H%ko2naJ|J5Kacy(dCm?G&v18reDc% zFONCZ(O^+Ei@9-)ewAUht2^}Vj=p%L01Mjg+^LzRj%!F4mp?XblrrgE5?yEQUhcMw zEk=EYqHC-%S1CCjB#9#OW^rWtX@xXbwqoq+cxY2OoUw*JXCL)-8v|S(=swya4%y^K zYn`~<;E>6Bt_CjdWMj!}Onq6zj<}5=r>Asyvs}#A7+A=2SZ0`HReyHc5Q9+RaKI!K zhy|aiH&irHlc-gomaiGqWQ%6(83@yX#p3tb0$e`VgTNpLROoxBS?7bXPi(Y^_$`|J~2f}@tp5cujKp(dO#ejmrK4BWdeUj^8!18VSDy}tc> zJy%FZb~!baH?e4q7hP<&$R<3h396`ysmXlR#@X;_@Q?^S;bvn`FxD)Bcuh7l!a_ge)D=Ce;*~D8H*MM>-#URKYyz|i67mlqn~EEbTmu@~ z*@V%~DQ~FjD=}>${7(g0%kRd4(A|#Adkqnf)J`5>%#q%W@{&r^vpaPo+2ZaN&`A9)@d0<=d~grq~CwFqB#KER7Yi%pl`z8`ZnL)&}PF z4x)I4ul+uNzC7o#j}ql^YjUR;ONgdxcDiOhI&ZiLSe|wgAm@oug8XB#2Dxp~jf_ih zCR98zmNOt0%QE!HY@ICPndQR@`-EsQFUld&yF0P{E4<(=pNrK zf?8;n5AVdZyO22;dJF#&H`eFu14JNrg(i3()oPSTuq{?oIH??vVFmMH?C?x&5s;5l zP>8bWQ2IzZ6!+?N(ZFL-&)?3+u7xuZ)5$#4^)RqEU5kf! zc{Iv)xJz;IR?YDPNhIW|7Ef^6-d6p1mgxGHTjPZ0ES8n)M;gm9gZvw5%KB8-MSH7a zLiYl}H^%aR86|CM_LakNvbOC~Zh)Q3LWaC|U;8Y_!6F+WifYUqOb-5*=$VhS_p580 zYdavelhJl8W4nB0W`kILDafmmlv0#Nog-eb%hW5-q0b@{jZRes+$d%pl_&P!PSkU~ zG-ZzrJ^HktmqoC(eIn<4)V_}uHtvEn`QicTGSx9U1TT}mN|5NC)me` zq=wMq5`X!|e3q}A$01AeC)Pp`DMrSM+We37^+3h2Ig1KVB@bVZ|1o!744PWS$CAzB z^nt-b3&9{Y0v+({KOF~zR&Wjrw#I}Jz0o&?5n|fBGlxTD$$tw61!us8i+6Hytcb5K z)o2HqTV5S0@LF*v(@^RAjec}99Ke!5sV%*gJBVC5Y`B(9SQ%dyTpr87EYM&7Amp=u zGDHs$$9e>Rz5#^orV6v=x#^ns|H_&a0}pOa8@LK8*L}S|t;iV`NUqlKP$|h~2ccJXVEk(E9Z5+`ybt*ZMKKfnUxtvr-3tp~iFov{aq?w4)R z%J52YOg`2JMSgG;foXNTVx~k27iZ8MV@}qX{T=x%Vx@T)YI0~@ZD#HL!p-$42zeDK zv%wq*zU?V1T_>AT#26%|6c z8>+1O9ER@Cj{v=Hn3?C@&n(Ogs26QQHG8FLVX)@CdL^RQ9l0S2?X9=|;lf+#y@Q{s zz{x8%k&>YeK#Ax#BouMLe;O}Rf?J=XW;-!d=4r{kPRdpKPfL0ucyh|He2A?n7tfFO z1h(Zx1Wv{-ykA;)h@_eO2BDC?h$JIxZwYEqCm3Z4rv!2$n&?o|PqsPhbrCl2@?~gB z6+hI9b8YP(asF~&a2AL&#ShNUDXC7O2*VDuOKdz3Jw4u3PK#!-J=&124KYi!XU za+oHW_pMQx#B8t2}>DRm|P=>_1kqE%Az*0DI%_)_05#3oO^GkvNN~pdf zAeax)w&i|hm27hOIIsjseJEXqq6Os?k)b%wSoXfzaiR$!YMg1`2D&x<%|AI1BZNGaiaLni+3{@|W~^b8#Sa1TEi%9qvEA2scaX<|PrB}cn3ah+vhfCbaXov}Y0G0sRREsH-F5tWs zs~F``tcajVb)~|*5Cagl#qe-1Dr>U(>IFsG9zEY0$oEqGVs|2_fAjK)P^y4rY z@%GmQHEmjw)iOV>r@Wg6Vshs&T$U0awJ`P>`)Mk7Eeesrqcu9&>MCj0e4ubq@4eIe zN={}CERnQrleCuVWC&W!KMLQSw!1DVIh~Q@WTjO*X^Fo?3;8Pu|ItyOAgr_=%`^~g z{<2eSk&x4~VptSrSu~b->F=i0QF_*ZII--b^%pAuaS73v>s1%nCzhN~)q??$!J-WD z+A-*MY_j5 z;=(4EWWw-C|J)SAJYM5ECRFI%#5!_dp6nVx}wHuW)@m%+_$;cd__sE^$e|gxHD@Wl~g>d+r$I! zmtChC2-xUdwi>xoH^gYX7e|&g?D}j<90~P)Qi615!Q0ojGD~sqpKFEwJwVGsKx|NC z2;+8mAjs{ZUvlq^F=#U2mNk*DM5B$HRxU8O*$di1UEp~gu)t8wXA*=cLFZs^2PzKfu45Ak8!)Wahx<&R z=ni_;7fH_rZpqXl>>8C1OnyaE6AB$J8KiV!J!jC?=lY5d8k0_2>?4gg^`J}7WdTia zM$hQ2+9(ne6AEr?qT;;pE_>}ybh`K$u|P6b$f7YGXAcH8n+=$5ZnyW1ts%-RSdyMV zR-6QmkT|pi>9*5~;$3f&P<{+vNtJjZlhsFFtBMgWPl;(a0f90MPzN`xDeKq2HRqZ9 zES_pp$ZvAw^kY{e?G2j1DwWeCqZ3h~LvdiHRu#TgH{5__;U*$WrJ&9YR$?sJ2Hmk* z1tv+coBX>x2uY{1r1DfkddT|O9Tud;CQ-iOzJ>Q3-tn5O^5l?6B9b6&c3-8u6bxmZ zqZ&lJN$gMBm3|MH&)%wkrReA|s+qP`o^dEtwpTJZ`NREZsj#dlm-vg)*Nc?Q0fXe+ zbm(8XEgVyS%jJViss&qUd=H@+_ZovND>vGs8Fi(RjB9;Vcxn}u^wi+3>R5vEbsOD1 zg&*)(g7C?uUgNJ!*dVC;mb%yy1cSK*&Rv3*lmu7jyLLbj;g?sOg>znbk%$?$fkRgR zwIPHnvM$p^h+C`quCMi_E^s?tr$OTs5YU_=$`^83S5{<+lu)(I#LU_b7lU-(RL$44SxBqZ z=;GvE60hsn1Drmkj?eg(govuNSb6AJ7IbJqaM9XYt%l4Kqu&H7a8XyUhXyYzuJGAcEpS zrp!L$KOb*~;KGNsJ>cn_hLT#qvuLQ!>^ir9>a4;vDmc`Oee?dkpCVelFjWJ-_?bWO_tF;bU|Qe3b>AC7r38%Ka;tC*39<0y)f6a))lfj3qaSg zrjBiW(L<4?iN@rBj$U&vZ?4Z+%|vgD#+>uE4AkQx2b}=9-T1v&HsMYg?eLK<%QAze z$W`q4CZf2h{eE6w?bjtkVX?guI|WTE4A0QrO2JaQc_`a9n zgO&V8h_V4$oU7b>PD{n6)7O$#=-SvVyWqMs%iyU_x-FzQ6$rc+-<3)~aqEhbbkoNb zoY*PB2gtxMXuu4f&+I3py9&tIF$|U8u zzJd6&D+3Z(;5v9K+XFqvlUN?)-Przw^8JE=_(&A|*YfLsw_5*m;9zEB{eOll*8c`~ zS^rPqZjZ+LKSB!SA0efzD|(fmWvb%9LJy}qA^>F9faQ?@)GicLVc zx5o%K*c zl1UVOr3>Rn%te$eM8zQyO0z+`DsZb3VTd|!HYfcr5F-8c06s-%da5$dXA71e;&;Qzsz44tWknZiU@N?9+*n zt-9Kz?%1k*45Iyn}p#%YUlu4 z7T08o9Gg#drX_m?(%fcHu6GC}0_8uRu8>AZH!RYNo;Q>BisoNDj90zYvp2FMk8&{0 zppx2tne*+sIHq)@g#w9iYVxhRDoi&FT;?uh@GChd&HA;D$A_~zb^If_3nc1SQ!(c$ z)RV;4x)~cMGx0_bcCQ1&w@jJWycCc?>-UMOEZ=0HTtP1d6^acqch&0U*l|KKoIbe6 zX3_SiHdUmX;G;k$?FSoX7i~vBx=s)9`$-=IUJeZhMOPXeyviXxC(>7AR5r^W?w|N; z5V4B)T2LMD8!cH?oM^0Kh|y=zL(F82+#I&)^565-7Xd0wQGah2uN^-=4u|#lY4f3H zvbQoYT37HM+|a%3^&{Acu_--NrI7O{&yEM8xc3I>-SFXzw9}Paoe0>WoGzxoZ74BA zl3EHCa5rdGNZb`{aO*Y3&^h>J>|s!&UM0%&34=%(LbE|9Ed>nA8v_5CLddFM2~#^O z4X0Vc^Z>WWGgeV07}9S9*VSzFV%+?yH7pu~YkdZqae^xD-6P|O`aTDHClW&?X9p~)j*I4c7UA>hHeX4)vlU;`x_M#->tJ&jH z+VIcr)A*mN47z^(RvAE>JXo<%CqMvKVInZC z@!LnLY5+abIiA$?^jk_J_w??n9?!42lmgF$t>F*-EUaSTajhYx4hPe44K%A_Qa)4Bw68RIevXN+o%mV0ua2o_x{&r#0=u+kIp4 zYiFdbt7g{EV~)IvT)50RK^Lj$13Pd@omGkBqH@K0eVkZCElDVfiDaqVwv@#&IzPEJ zY^HK2lE4X_AWcvnvc7dKS|x7)sqEj2yDqjbOHe~K40D#H^k!0F|IjgD1M84rP0~y- zQehSIdWbx#-!J1;_u&5ItuI`XDd6KRkBzG{1ZWQ07nU#$O9JzbHx!eo=TqT5HV&oC ziNXtojK^pJPZ*P^oGvRZA7J}Io_QR~ubNOnC9SOv@jxUM5u5zRRUGt6c>jR4sj}jC zH8zYBeR<}mlI_z-vfFuoC#`t*nw9F^mw}Y=or`loEp>=Aqp2XlV>RLP#Go-(Ob6d| zom)kmU=zon2+!g4@_+&61|pX(Pn)Rr&%7HEuI(7qtD9?Ady^f`>w_NSTPisJ-H-#1 zwW;{mtR^}R^kRpkBn4(oOsDnMq&=5R{Oy8398L?kifkX_ID|XQ_n2g4S)+n9JctlY) z;cXC%-c?D%0BhTYJA&|M0^UcRm_FD(A^hL=)ecQPUnCWrZ8;Q}%zwMEU_*uF z5){7MdJ|JT-+7FqC<24sVY_Kt7NQoAo77(`r4&M6WK8Qo(N)YO@YTvv99NpCop`QfrRa-}ti-RB6Fsy!X z`=+tROws%xh~A1d3=#k21WK{`p0X6VoZEp7HR#TDP6j?|n*Mzb7tE@dVV%wZUWudpABP4R0##22kK$JxMD0t$Gr_qAP_*LLu}_E1pLIZG@7 zk}ucBlfT0nJ;?sL$RJ@2#@Tl@w-_7-soVV*vt_Q$n)~1*Lf@~|-}lYnrC>mhT-ZY+ z^kIKd2oYKxSxIY+@7J500fuIuw!ox-hjuuodzEyqHSmJJsgp}(52o;y*~!7ZL>}|> zu1~9x-k3^F{N5JKmE##Oa9M~7UdC4q;Ct>$ix*%f;#t_%*>UwDW8Ld}9E7!4kT@`K zZR_B118Y=YDf@B;0TqQ2h3EJ9B|%%B?emA3Y6IA?TRDPOpN{g%k}5PMvx-q^8A9{o zy#+?TWNU|6B#iTce%w*|)cin)JOch=^zCiCnLcmhh_I->lcj-7cof$sfdPb8aB;0R zL$7v=R1xk=d6Z+Eak_=k>7iL?4x|*aTHzaQ6bTa62pn5)#P>i-#+Q+U3RHYeGYlb{ zJl5Sa(lbv4Qnq~4`OKX|HB7G`KoQ4wm-`8&x>t#&W*RL|RQu&i6b!k!c_~!Jl^Kg5 zAW`Sfmu2PfYpo@=yAMfkDgzI06FudfHFs*^nc6|(0D~P{-H}WLwwe6dmM?|kDnY%H z=o{qj4A9y+$uGnELDBh;x(`o1o7U}DLk2P&E1r-ZRk;RwvzijoZ67GOKL=f!<=JTG ziWmLUuP$>l2iw@S?&N;fsS_A!sTYfOvKE+U7<7;SAy6W8aw*1a(E8I%#cxd&s^O`P zynCJd0o7s=s&bl|<(2I|C zCC+X=68}kb4WQ6&DQaPHo!cy0d71(GP$7lI?S{{pE`p?Rjh0&N)&ku2sd)u0m$~N9 zJ|C@I{iwZeD^lmp-G#5P^6JaHBxtS<__B(Tul>pZn5CNoSMum4E&K=@_((1yKdJO z+g;f%*qO`!}HlPlknvRuEI1v$DxTzCc`b(tK%N(3>07S^$005Vj4AD z+)bv~Rbw7zi1j(%%SnY6tw9Oj4gJmLjqN`bD*b@%87Hn>SEz{IVz2v1VzGEbk`MD6 z@UQzboZmsEzKX62DTsPyP=3TkSgda2!0qu`?Z~q=6(f57Va0V}mMeBT?imhsC32Jw zexfAHCf}wl3-_5+Hk}h!^tuWVrV_lyguKzjUGfFhJqUSp+)b33G#|hixr~n zwz^%;=Ry5g6yo)I{OCA8AFoVus)o zH<4vv@|WQ(x!PuyU$)t(*`3w+{w?&g)U(%ZD7LS4M}m`Kasu@?AAHQB_|_K-h!b?o zwx4t9K1UNItgmG5{Z^%^K14E`xk@j^h5ZB#<7&0fhOOt|WC*KI_Vq=IugMBlWfXSy zZqh%A*BFlE_=Cs4dpS4_4%h75>dra1zUKf&=_JQrknxh3YXjA=Z_fmvkq<>!dFHxn zcYj%0n$#4G*5QOxFjXinM7g;C0Z=ShJLyO&lE|4xdDU&F#&m@|HXIUUt5P1mbSBVV zoe8JY6lrOVVZYw|Hd-Tt%1f`pQ`r4`s$(M4aKNSJ71I-3LFXqoC>oo3V(o$A8|XaW@|6A9i(XGkrc zptI>LrT$r}u@VLtj#Gq+l^LD_6`i}$$G)=P&<&9fWARUoX1)q1J*0`BX4T+vO zSMP_&*#a1jx$TQ2O`tDmG?VK1!a)1}PBBoK3!p0?zQ~9P9ZQ^Y#)(R!G^|FHJwp?EXwJNj zq{bGkg`1`|D%n9h|__(4GpV=k0`OL$Xs9M4GR)Cphm?Wy1X^nV6hRMkpaH1-m`Fo1}A5@owaKMolq!FKB1uAJWtiUA>Tn=Xz7e@ksc2ZRsw94J*o)+=H#&0O|KamjrP zVm8X@{^Rx=2l<+rN6*hx-!~7myBs!bfp}VV_Yead&N0g zp8_Ie;eEdVEm<-={MX8hX-t-7Qwp4%wRFyB|AG&-QNmiJvAEqdSbZd|4p6Z^QX0rcc&qwu{pE{Fw7WcBB!&$RLUA zz1v`|LJ~?Hhn3ak(N1-RGN1-bQ($=qqk*S!ZwL}pRd3uPY9(*xp{$QQ*#%|W@dNu9 zg5j6m{u3TNv0bxyyf&P!*1N4-?d7JL=BjrQ_Sp8X$+>*rrlz+3Tt4MNj0~(awCpqyuMQAZsA)1a$!Hm55jS&j( z2W4WUM+&Pn;`C7|ngwb7;;3z?1di^^J}5eV5j*|@WE5E5ndIuDpfTwuNHW~k*P#^_ znkI*L5kU9{6Q>tpj)%-IZYU3SC?!-jGDqYQLR;Vz`U~eNmVI`1Sy}VA;IdrV z&XgD8*A+inqTT@L`(<19KnGluLs?A|BZv}g2FvpLJs(r`aHuZyo zQ~M-BXu}+~NSjs>X`qC(Ojr+J8we4zMqixOte7R6iO0x|MT`20L^KE$bXWqM$ug<; zXeNLehSn(452x|*U&a5HM9fbt-nb++QVBeDBmAvPJn4Ai=w5jOg&qyHq$Q z4lpC6G#81w>3&oeN;iixhA^n`UY2f)g_eTT{m{9zkbl9z_0%*7j{{_HE7G*G^k`S2 zb;e&4OCiY+YK&+DqN)CoXQ%~-{cOJ^SNTI?!4MK+@)r}bXxCaEsJwn@%E7vU7o@nu zApf&)*N)P+%%psV=v|twWMNyOf;szy1D!3e)Brw72&;luY4DBNI;-oJfWpPriKFdO zOi6neH-6f_{JORj1bc~Fa!EedatAQ&+I?XfC_X{X<)a&eS%crRG|mU*giGBrGul}y zhgRP)ZP~jB@LofCfZ|_==nJAjbm!m;*p};!M`YxI0E5}nGgYPfsISDUba5l5+VbUt z&s+A}2zgjBaaTvqqp(`bS~Va?xKpi7XrIuz@Za4eIG|UJB`X(y1WFgz;+Kg~oXx<`+;F?eCTH8jj-aP-wv z`E{HX#CfJ~9#_z2&8M^UC23@5O`f~`WiVf3phCXKV$Ram)_yH3WS`_i1Wewu#_s8> zX0+Omx|{b)U2V!=xQW%pt5NO@YqT_^N=Icn>(&DE1!di7HxX#Z(JcvxfZ(>RSUI6l zRPh?}nl*k3Q`?@@ni&Mo9Y6G8qDq3IDL27m@l{CwfJ)x8J56U(`Xl}eYIAATa37{`y$1y^`OX53+1P53%pd$MBHR*Y6UU6km@5nBtP)uxPgedD2n%lJzRy zC4sbJKg}%!`0D3!&$XHW-<@CYcm1rG+Ny~?vP*}M+Ax6j)>-IQmk?L;Pi)xfqm)`W zd|v$exujB_iRdyre^WzTA z>6Y_4GEA*%O(-o(_|sn$Yfb)>6XA1NCmbDmG8KDBZA<}=IUV5TD|U^iBw6R3VfE zPS7jG8*d|WfbUVd9n%XS>(1f8qa-WnOIJJ}w6@WuOg=NGGyj;$YD<+>2;*y;b zt8tD+fF%h|k;N&|0Czy0$R!oV2n#}%6EYzh(^7Okk>Vr*mHS6latqCmEUtRaH%X`?G!kn}m-K|23ok@9h1*F(3{GhW{|)Z2uhtV*9_v zfHW`T{>|vWzJ9}<ueO;9I`;bFYn?vGc$*5e>2wIh)bf2-$sAB)^baXU0!aY&vy|&XAPx%{XAGl+i20u z^1O2ngC;kb9ubH*$U2gb{tffaZcUSZgM@dw5+UT!kapU%vx%-dyL&})y|mk_94Qmr zCXM+OiboGW)E%-*&(Yp3Ra)LTC>SUmJ~Yd8TRlB?p~IQp3N2xlL3B7$BN*PQYqP$E z@}h{3=?tIVv``Wu#7+t4ZfkFk*`aY&y?oYLt}Ge?P?-(Mo2!|_u4JQDcZN@ba+Hmm ztCOY*Ff1A?x0{|4mAOx0%au3aZ?gqDD_&LL@G?{bcB70U9bC7^MQR{M`4P$M;9Z@0 zXMoRYs4osKiyS;u-wnmw+&xu9&j+{LuB%L(DtL5E6HJU@&(Pm9tIwsFnYA^n#hc5Y zmS-=cg?&|i9E+l0pMQ7ys@jazSBvo~T{W)LjQuQA)QEV>vrkG;t_}Di^8Wp#D9qQh#cncLPLqEW|NVI7ziTd~D0?ul1CIpSzY zEL2Zr!&DhH^bZi?Wl71$YSHGlYRy4OQNZoCNzve2X#VM|wF@;x2Ies5ZK|Tr+z8qZ zP#p-wNa;}VWB1yAVd>CYr8$QUg4{ZT*N}+Heiw>niJy-)D~Xh*SKhT~I=v&_plIR> zcoGt;94_Q)9^|Mvk4#*C!!F6^a32ga)F`^wPNtxlWJGT^Hm&kq175Otl#|I+QgDPb zqsjCIa<{Lprp|M=Un9ctlcS{_tGh7B`LP80y9e0lJ|h5CvL#AayKPCgWeIz;?HN)y zu>K}_iKVP@8+u`?l$Vr+L1m#)Ov&-5_&Rj`FYPb3om$|T;6%gG2+gS=U}b<~4PlZ} z**-}MU||I$`6m}#K84Ci4J{yC*0rsY-KFcCJ_I?30)V(Oh)iBM9Y(G$+4d6Keh4=N z^RN&<%&WMU8xy>^u8mC(&GJsEd$yV?198NjjXim|6Z^6X(3v9-*Jw&B&e`AI90w7l z5swGo`928(IAxk2miFSgem$=ogp&)Xrl@(?UX(W}0QY(h8Kcq43Or&{j zLNI>~CIA_Qya!R#>dyy!gj<)1IshFU))~vH?JWmiGdMPYi=TVLKw#mUs?nxfH?osl zcz{{bM0APaQodn>R@-2|uc*}7@B-(xHH&VClRdti(deee z1!k-k?)b`Y(}p$Ybc3gT&pIN(hb!kSYM zs~uPTL{XZN;hwa;ZC`(W@TU*(ew1*&oqo`;0bKTpsU8jX;Vb>XBcgquz}u_RiGpcI zR9Nr=g)SrVG{f{SCZEK6um_}%C0f~&40hQR6IT-=ZsTU4Q=k^?D@%6%4*PDvs?)fT zx_v>CNMME>9$pdDSuAY5)}A`2B>oAQw(wt2xYu(2ByjTgu+~iY=J=cV>H1t;#C2nZ z=moOyz%II6{mb1CCZJb;cZZAb73v(X>G1HRTz!Qx=43T^v=CnUx%}Hv==)^UDUa+& zAXW`&9qW9Z$J7cyqY)WXB*8K+aKrvox#wZHK2paxC&(Vf-4la=EFn0Bb`9J92qtbco) z-0<*dNH8@i!u~-&PJ7*_3_MqI%-?tjGQy)^h+_$a>Y5%2hLS9@ zI$aMPA~8UE%oOh_X0}s8BX!}Bm32O@B(s#Mnt2WOIRmUVg5b&N`e5d96o}p4-r=pa z4DW~tq>2K9o6JPGyjA?krq;l=smb*BvXYN_H%hdS`*D`i^ z<5!S>1?n@O+BlHaBD=nSH-^p8-hNaX@p|8r?yCjIKwNXy#DSivQXmd6EAONIB*e7> z2tZCLo8s*2s5SQ^kYuxL`EKGFxqQav6h73|x)*dd|CKkK!K+2?gI%$6dR!pf7v(%s zzHgf+adWjufVGIM4W&xLqq3*n`$7?{qr2LfLs%9DA{$ohCH8!eQQoe>F1gfA~T5lOOrhh%GTj`m~#BS%fgLoCG!DEk;Idv z%K7*#4Wt+lEI#+y$^d3>V^KEq!EVggqoJ$#l+vVj`{CF1TDU$elfB8kL?T{UkMxi% zLa6jjFO);4ppn*bEOHlc9+AMN_~xDvhH&Ev`{z;8@zRD*h%JKBxKLmFxW= z)t^#?n3Ph0u@FvsfH3GWe;4jpSGL~3CKZqv!&`j4%d~B)e3pVkRX7N9MW~J)zLaj_ zPY?XQ|LlJH*paau0+NDn8O}fq8j5}POtUGHS&lK5+%oEsL`7lHksO^+caRslYJ-X0 z`D8n5F7#{SV#v+N2`6~|O-{T-LZz573KWN`jGG!=Gwci_cfVjaZmFwbgUp_Z%|0(3 z%zt=9oz1;RA17h;S5nGt=iuwKFkon2E%6q4QR%82-G2LXk-^=pXk9nXb_mB)=zgr} znGRFY&M5{DP&Wu|Owl5KyqY;6w=SLDC zVjdIWqSNsHi}wUs@q^&JGoX0!skn7HH(1gCz2sJ#j>-QVU-Okp}r1?lpy2rP#U)0q_Df@lx;fyG!K3LXJCZG^*|uW6gwnv5b~sp*X3 zyXBX%1<1OfqhIU-_aK*qLyQCAM}}oa8Z1Xy9?p24Bsst$EzNg0Kmb-9J_f(o4zb#=$F&NWJXRz;EC{c^0Rv=VDf`dAZ za`?*_+)7TWy0}^{3jvb8=Yy(+IsnV|qFIZ|ZquXQmRW9_X=5}x8qe^}ufeowz62uM z8%^ttzrT^*r4IiAFezR zSi}cSlrzwZe@nek*7^>pqKQuP&mVtNubI`*Fg}cVMWFEN>G~%Z{G1<7&Y9JGI+FYN ztXj4Zo%fqO@4U5;_s({ax^D`47C^iuGeZMksuB#5_g${%R(^i-f@^ZZ(EuKTiXzNU zf~T@d>NtXbaT5!FkJ`grB;X3`NRQP^0u|Ke`huVhDXI(jw8+;0wYG3?Il*)TXy3hK zisUgK)ZWH7GPyfF0z2G{GBJud|Ltr-DAi;}p<^#s6^sP41h_b&F#QjFji*Y2)^q8Z z^h&lACr-9dVq@?=6_*6?9+)m*hy>}ENrR^X-K8r-g*)+^qA*c#0fO2`FYeur3)><4 zh#F&uor}vESXC)kyaAzW4Ra~o?V06Q_SQ)1$-ZLTuEDO&c&A3qrEZ%(n`s&1*#*y+ zWSW$_0w^8$_N5Hq9gLHHUwn$a?_3OjPKf0RAcb0x_cLx<N@`(QJG1MlCQ19)yi5_nOP@9fiIfRlNVUz=!8cj8#;qBNB|m{t7>IS9 z=*L~FW*=Z?4E4TSR9T~X9O}Gs>via^G!CwD$}F=t(@E9d;unXtJ-0kUWq9a-W}N6d z2EH@`Kq!Snv6s*B$=s!&naZIH6jFEw;)!)WfgJSca1Nyo2%c0mn)?GQrhj|gCbv1R zgvvDlgbgU_?oxBSrX}JrKd!1hFy>YK5U8((rX!DcjBf1V3lYDfd%xOy;yovz%G|z# znh~iSUL-RK-xojW->KBeOAL?qL}sp0RmuJ&SddV(Mo5EwjKvyaED^D^V*1QM_6tl) z?3mdMx>FlH3$d=86SPGwGsJ=QCKe{n1*GM37s#hyi#MBlOBjIlLu#c6!0sczLqSFM z`MRX@8TTp<`-5MZh@@|Mj)%8{K<~(>-!@}U8E4pM#EjF#331)-MVYN@o3TF>L;HVr zl%Zx)y=shjK>#=X{qFp7XpZ>)5GiR*Gq_ld|1x&C>>3Sd#Tb>EB1?;BH}50-CP!( z-YBhV;~Tcr|7>1}f{3Ju3<9u;qpI`OwfhAY)YlEfka7oLYF(eGV%?U7>G`H;s4~J1 z_DlxB{xk@0JxzISLi_0!581wj0{psaau+b!7jUCio;`ccP=^C0P} z*u(GlMI;`fWEXFaE^-&>!bVB4zPw64!Pw}TVwHh_4VQ!2X|r3VAC5qb=fnzTkM=fP z_GE{9AwnMAqv5$b!-29F?j;2b&u@6uI8j+4&>->{Q%I@%?fKq}beclyDgnYGuaBeG zn9jGf5bu60rLM##s-g!X!;6H1EZ%tyWMvL_Kn`*_gNKPzJ=dXH&|4WA?ZsoFOVjjd znVQcHW7p?x*zn_f?1`hm6BS9Bwg#7#z;~Z|dmV9QnjB_7>9r%j%%^(H%}rEKRu+VA5?DsBgzp%#96)u}f-D%j5!npHuX6~Q@lUp`0u}yQMNJ%K z_|}@ej~IQ4>K)(3ygsk2=!C^_*{euOKm#p#49w7hL<1GwA4p{c*fBI8=unWg?C8`# z?|soduu59I`18|55QRJuV$_910BWXWvh83>7-Mg zWXg&F2?7qv!tqezb3R&mn90X_l=-yyyhi3|n&JdHL|wb!T~CX8n=Apq$wLU~B@D%E z8^MAzq)aPIV4{8+z#E++U7EPmY~1;nh)CyaOw`rohgLnM1*NNxS-wa@zR29zTEDI( zPAiD?aX9o)W`dETeYT-(aybT_FeH%i;X-zs1WOQk!-}fP+^acXE-Rvo5iMvOi{b#;Av@eww6R{u(bZr88PGht9F9Q%Z z6}!_jN7YK^;w6|PKKpzs!?zbIUPde%H6mWN3$N zp^O$H)7YExRFDE);Ck1YZatTi?5=RQi=5gGTOValMGYK!#8^{l;h@jS1v~E?QQx3^ z*TUnp_P=Egxyw6g7&BJE7>4g-Z7_`93ltloJpVq1ptsljWfB4DRBhNIJg8c8Yp=dE zE$htoB4++8?u~ry6XoR5r*rwlW$#F0RF%vbES-Og3#P9DRuZFGOL^EKq;GqqCp=py zmn)@UkbzqMd#`Q$A(q5?66UHgP@d*CC%1iEAy#KzO?>=?iK*e9 zZaMrj<8B@ZY6UBiiwdhSWL%xEkD=~lDtv}*$o^)x$<}GNTmD+8sS9O}eJgr*7SU=q zFOlvJQ;St@v?9-P7awxxw+gW&=fAt~6FR;JiO$U)G}pR)x~poJJ{N8UP?J)@YDdN; z`DmJ5M?ZD46)}`#@n|V3(dJVql(t_Ya|_*~?Jz(xJb#yZEw}Fdi4Jw)@VQtF%V5`J zO7L?4@6>V^D$}K`dozKv&8cQ_)0Ys%1{sf-T2_dKgqA8+RD5PD z5vQACa4x*Sn+BolVp4(INPQbssqCwW9kdxX!q1T&pY8!ISn@l)-n?|?qay^WR&dk&nV6Pg(RcFQ6<1V% z3#L=~_4oxw-bWo_y%eF0$^!4DGA5Wj>{oEEQgWcAlj_4!W;>#MS!b3fBY;h8>$F6q zT+$@6(#E5Iz@|nWUBVkda1PAbrQ%;WHRbgh#FEiKC*6ulH9K$}cqUIQSXC?xl#gcO zyuLfqTK4ro%MKP6({kKckzey?jXeFlid%HpMo>+#u!W9FM{AMtYyAW=xKB$X zU~L#N9Ni6G_T&Z>ONqEsw6FhLUH`}R@G#A2fRp01ye!4S2f#G#D^Py>qCL~a8p&h=dR4ys5rYFIF1<-RdUg(f0W82@7?)NDM)e%b)T%W<>+qEC_ z*>pKhee9=`@QRCrLVnjkb>+c-e6Y_2WFMkW@v|NO|<|6A_E{(qAD^k~S$ zZL-4me5%!_3Dd4n^F3wchk;xZh(tEW*zMrYNj_;t&`=Pz$j&`2S$*bl5tC@8*2L5+ zMC#}_pt3xkOlR%K|M)|chM(n~*fnM$ICFi{7o8|AeMz{Uy*swfRi%z!h4BG>>v!a? zr;$UULusSYxG|NrXVL8jAgH4m%oNRqpiDZS96@^&;eFqUE%oB)uQth5U>P2Gn0MrH ztj4`W_6_jj_An8OP6dNa1ktCw86E4cHse@SW7{^I?U61|=lG)G8#N(Wtbs^Hpr9QP z)JYvB8Sxa+V5H|)G3evXpjp8BMjBCK*|He5MzUr_go?+tV6d;iX_8%rSaA@oC{1C2 zBUhn(Hi|dz`F-^Cs_X_mK_1)9Fuow__S%1%ju*lz0YH`3%`tdsSpG?OsKep5$v$er z61EX3c*7|eslA?@SM;il%{V|NV252rtfk-zhNs%daFzc z^?Z)#fAiWPh?;5RS!$UNSK$kASI=aPWv!gNb5kh zS6lVhwLFReCpgIkv6`ob?l#-m826A?nsdb`o(EqpDlOM81rU!l-9N;Ss^V7Uk42Vk zQ$@-54yFb^ zTQVpy&^I=8VV{2<`XrnYwt)u=Nd|2h*ecyADj__#ltFi+CjG>f<)?ScO`#Q3f;t{w zHm^){=I>!G8w(J zKNQJ=JIJZA0=HY(vmGZiq!1#zz~Ac+4jqy1XS22mF@(Vz@YmE`$3fmeU1!+}qTXj@}ZCz<#zu#3otplar{SNZV z6j7-pL^y_bpfGjMo7Loh6fZ36M5tfQ6k2fw8l&RhGGWUOEfovjI$e@YI)*@8teLE$ zs+{o=?Ajp7woU*-RH1P{jTCY$x;JMt^7Sz7_E4~O9x_eyWnP$;=ZNYj{0YMWrs_!r zDL@*=T=w9)$*Dhe5Z#(hGSa$xg26MDu%6;C2Ne?OlJ&>=1_hPM5ir&;BoT<)Yz7aO z6awlBVqh(8)BjP2_Qk}s6eQ6k8v=wZ(Xb8p^5o?UD#L3oH*d9jx;XJ8fNe10oT{3plzu_gnsXbK?D*|&gIH$qgYhpaJQF`}k zZs6)+UC159x1X8A*%g-Dj5 zr*P9GD%AGsMOf2gyIcc%!(=~yJf=N$4_+6%E!nE3ScKwLTn7o zO`Nr)^;B=Y6Qt?1v~yarVa5@ePC4ymncka&wbOv3^zj7L!zst{PQLI^wF*E|`W1`q zdJT^+*%umSL{Uj)PZ@#mD{djmWiDVtT?;%kyil=cCann|abZ!QKsg3PH9jt<*MyIS z>brKPCtWEAWX(;sLh$hUO8^+bV=EBsVu8*Ej7AQ${ETvPl|o4zInMP()#L*RVMnn1 zL}luD0R9{@*5rD=(tl#Awt8NcQO(8HCzGBrTCoc;2v2%?v?bxFkkw;74gyZyT*68i z1g68DjCi_3PP(ML|7;eG+FLb9u1ZzMn`<&RRb$_P{qb&!JPfrKzXcSRL2G^|-Wmlb zQ}p;T2}_%EEeC>oC*GYekhe74=*^wc9W!YQ7xi)J_~QLcoyx7SsUlBRA;s-e$86oo zc{2&pwzuD?*9?w5H!P!u`5TnjvQIKNSJHd>?1OG1h<54yg3}XL#|fPn>%Hgfhr@q6QtWgftffd&=9$2offu7OSFjCB2-y#ozV2=^WylQCfM7 zdRhk#r`o;uS^dQ+CAPa!paXx;oY7D=JP8CtHDd+B>@C zY3|D5<>E`{mTnE_cWG*U`pDH)>WRuGk*I1{Q6s*ryYof#d#a~5fh8H9lS_#s8fZE^ z+BCcLjc-%uFY~t+ob*nqD4rTL=-Yi>=cT5|-|}~HFR5rbl4KmZ)Gt=QMe>qJ9ezOn zZo@Q5J5YiiXi^Hhzc6aHv^0qvRaGe091Q~$OL=X}rpozbha4hHc{AB;mTxYG=J89* zv5Rckt-DIITGub<;f1<-hbuF4b*L6N*d<9JtE!zXmpYy$q!pDtM`X61yIi9$&G+g) z1T2ZDW~mfIpgT&tVBsh=5=c?s-~#doC@HC(imnbvqV&PxC`A-6$L3Y-2-IZ-7Ty00 zSbFGUdTdx-koOu)TEAVR z3U{Ay>@JnTZ%QVo5`SG#v)dC6bM@DBAM*XVS&vRU0jCcfiSM-g%X5i8QvL6CPb$zJ6tR|0!>ukL}bYhy>5BKW2>b zNTJn)x;>Fo^CPB34AQV@A%U$!pJQ`zQ-6dypo|>(mm--XqCAq2W$1`0BP88{y3nqS zw&9bWBW2M4yjwYYi#kDX+7^@7c$0paVPnY*mkFgm(XCSMGi(&R;c^!0x_PaEvv2a7 z&9MK>5}Az7h_v%kBud|B>!;5V2q2fh$&x3;3{nyvTx2@^4MCfoqsAj1rmmW0$1fh) z$Dn2}q^CE2Zkcfa5|2l}?bP@&W}Je~8h_IqiQI*DGVgOKKx!hIiJAP?SzF#R*O7aX zm&@u;q(lbDQo^O>9X|>VNqoP$B=H?Z#8WkiPSZF^o>iGdq>3HO0tSG)t3QXjw4$hk zO66>U90)RkhDiAhm_PMkuiTzP;@Fn*@n@NMm~zN2{BX5|Uj&?aus45GT22z*+W|X! zMERTWQ_$HlV^6Tj(Jb>85g9o$MG!5I;AmA~h4Bs-0fk!SxDZ=3J32YybO4}rP#7mF z4vXEq7WL{(y-o&g$q#1UpvC*9L~_J9S97H-;^I3P)i5=r#8+Th#<5j0P()VMC_M%9 zj_e{^rU;bFpbN;+*7QXog>TNwt*B={rCgvdG!R;OufkjqS@3#yg312f95H^&fYk37 zV zT5b#XU2YT52dA2j%o+`5D!^jJd(U58x(Fo-76Y@WIm%t|bY>(PaUzM9T{JmMI;O1k;@ShvKtk$sE%_gH#}+3f`vq z2J(J9<`eG^?%Stpm(AK^7Pzu>@~1`e@cx=@{aCD$&zh!E=V9ilvUZrz9=|ITUQYbT z#^v9Nomx2vpz%nVy8Q9vX<<8HG1+(;nB3r$5)&4K3<0pza7FZpWLV=1H-@C)uW~-& zF4xMF-yCPSMGp7A-5s7*1%xJHlF=BC>~sQ#MbX4{Ga!C_fVN${t$hS_0`_f_Qu9Ig z?CAyb+WN7ZaqLvgfX$pl-D}i&Q-*r8w;h`=8U}3zgh)?rYin{;708eLc6+dp-;`Nw zC>j+h7k0u4MQ4+A3%USs7?xJh7W|y&Y?BDk09VBUdZ~T!Jlmoy+r)#iZRZN6E7iJ! zxaPPd#^*mBu3o4ht01j5iP;~W0;`Ju2r|D z%=Xa$yPB``*D#ck5ulZ++f=QnP3@Mt%IT(%ww<{$-c#o4v|Q87-x+B6{+?0^!Lf&* zMkxi9k0Q$Pp&)eqhV=PE$AuBHQ65Mr07Hh_sc;Wrg7j5*Ia(ntl+zO`K}(MnSS!we zJ_gv@sHGe{9iA+415!xO=Q~uGNHMdKrU{icDn$)%RH`{5GkG{MIb8V>wq;M}2A=mT z*R7{SGn~SGy}7a4jeM~VA)&rag!l|=ju@3`8vwOt(VYg zOeuB>qS5~?>J^8VSi>e>z=X{QN03as z!epUoH!pb+2#2>t*h4?4u+1cq&U5G2vrFKdsew+4YUf&LRY zKg&1qAz90LfJNLxb74Na&Cqs7Q}PE|`@X z?!^j{)HiLdTl^gwg%)|EBv4C=4IO-BXmu}!=@ z*&pxFxrkrlJShdYB`WsV4pr{k7p5iY=P|X&p$WEQ;ihbg_?^$D=E_-07hDEz0g9ZG z$c>pOzDi4)!{h4NGppVQNse-j2oAGGWsJ7&p9KSyezm?|s(g+H^w|AIDwEM8egi&5 znRMeB;fj=33aL7?ljS2yd4Ef!7@0r$OkV~|tk@B@DCPJH=P$G3!Zd}L9fHtsC@-fx zdzlrwrjjYF{j8{r2_wRA6RC=P2U+4J#0i5z(xUeK;eAS>z~w3;D(D5BRE|dQqO! zj>6;2a-X*sc)Onj-P7M_HVQm$GPLK>}9!h5fn zi=VeoBXq^7PYZ7JGjOxC`B`5101kE%q8HMHB6l{ARZKOuG!vbBIn}e0o8aUL@vXaT zlICPFI(SkP)0i`@%MltDuZCV*taR~+E>_pvHZFT2xJm^#n-2-ozY$Z9Wll&izLDEW z$sdsW&olm|yQb!62zKb_f%jU|g7BrncR3H`B>8iYX6Xs#+3HCHVwetX5)RwRO5vWz zIxRgHt(DX>jXdC+L|UEq_sBJaF?*CvRxO>d5f2N+8b%#l%_N5)f z&cw98`a=>TPV0CGbYl7z*rpWU?@s#G;-r*H6yh0+UQhI_{UMEsgUNc(n#)vCQ!whk z1dZhF;Z-{0gHrtJIYS4sR7lF;-&VY`l&j8^8m7!4kZHA{FQWw^e{wSs|M^<@SG@R4$Zs3)f~&pb#B+u+nr!V@yF`;C=wE7U4=T>u>i5VDFqoa4t57A3X}NOh_aGhzz&>#A!ZF03D4qs7vo8R>EZWV1S3U zL%LT!*~ZPLcdEetMgUZy!@(fWT*Aqx)4i$?%P=E}l=pj-3iaG(R`7Yl%rN6c{NyE5 zez*h*(CQQyo0`-Ll{Pa#i5UpbdnxEI!ycHF;wcvVJNu=}mpDEYfSlITb7&3>64kH*O;KowO9#78f@tXMm))@tyJ z%H7)Lk`?*=yy*q9RIB@DhU86%QAYFdPR@W{b=j`jTm{WgIAOqoCpyI+%uZcAz9U}3 zD9jOzDm7}hxhpx7LA?Q|z6PPIHDRkc_3Sne9os&ag5M~3ZfYNgTN_B0v)ATF7@wHu zU(QrOuFb>K{Vmv7{`|8s8;$(IxY4O}qsQzcrWK%cavS<&g8%ah$f3Y9a$=Utr)7q# z$g61f-Yq?jWHn~hDXZM^r2|BzTd`bHAZYAs2u>qVmO`^&Z?Z46aac!R_Vo_`@Q11TKO4~hCHKs1O#ipDfa5>OJ?DQ#?rSu+9Jf~g zXXsUSn;cxd(rvho)^Z)FE z+BJY;x3PBhp;=&vc;F~^8O?OgyvR-Ud48U9OBXhBY;ES&z&N!%txt%AHE8tfqN=4l(?$hb6BOAX3AdSvvy0*9I5;#xVlfsCOf=}EAsytWLK09&2J-XNI?vPhsp0WRG`l2_kVQZU%xptl+2I`>+xNX;L z^nMV?;e~mSHPHKa4rc1c-AW^Vpci>?*YEOXd!*d5z0stamadyn?vd zdno`kv2A`aT&|!-J1}r8d9dNA)O`Z%OsDCKXr(u1gnm%}9zWbhY29tIY;NXGEJ{Zm z^}H**)7tb~`||W8uYZ*yk!0ck3Aundm)j^JWZKb)erU zt>eN=UadbgX@_#lJ;~acSNbS4T?~%5@^GOO;kDb!0Y8Jo88$Com4TFJv#>MH-;>Ae zMDIg?WU}t~Q7u#P^uus#b%AsW>qN?~+gSe*IGwnmdB_VT(qQK|L@06f8kRC)^+)YN z(#U>FVt#Br|3n&eQ9I<$tZWDu)+|cWFmi(8*lkKhkR8r(rrS_hasDN4pclGfC9=4w-fbS%x)cKdk_Gr6RKz6l>-Ab?@&B#`>CA(SDkc z1YgBB5@p+!o41*AMfS;Rivy5;bT<6Zy^r1~VeRzs;b$C!1MRjvesZW@I6pp$>Y~o$ z5owY>sLn~s@^I_?vi_LrABpx?eO@NDOu=H~&O?OPVe|?nRdp|!LqNC!pnzL>;kFg! z(gZ}|0h^YRysogGS%BpgJg4c+PBMi|seP%T#a*<2CWzI5#La>E5gKLeoy8KtduT69 ztB-ElNb34XTsDUW;4NZs_kLexqN0t}!gwpjiEo(SIQxr^U7l4mw`Mbf(_So@#JjN7 zxq;!>C2WHQ4{))V;Q($_Ktd79c-UJtL*Y{6d|3zU6(52V_o3GIO83;1z}9Iy zSQlVV7r1Z73{{EGBvf@iD>d_2;b5 z^Q?3Z);*V+w}2g~butsXsmk_hC(6Q04N8mZ>tQq>jvAj?)Wg(r>h~-&1>XCBPMg;~ zn&hBzpYQct_cy9HtkQ-)D~&44ugd#CQX8Z&S$vM5u5`>(EJHkby-1pz6t6r>Y40Sm zTZ)yXGUf*`Wp};?Drf7b)8Gg&EGdxaN?*|PgHDhXsqz0RZfaeQvbE7HtzU^O-ryY?XPWd&@306v2#@qx*S0yL)_yA;_PPXFjdziF;mN?ryEO4 zBu+MAnTdpA=a$O1D7aYKd~HI9*b2V%mvG$4h}vIB4_Sxc9Q6WcOg|eI@N;{m0z_DiTXw*<2 z^%*i5=C@ytQ9fJTrgb``R(YPwuun3?p*)4%p2rYSvkdQ&z<~wU87<*iHF_=!fnuqW zm#{16iyU*esG78L!g&zRyHS}fV*HT*pvgO z9|R3iMdeD^fpEtCt!6K5T#)(mbMb~iFZ z{;XW4$3^8ECkH6t-NQn3K459btu@y~LfbTOCstMrKFFg{^1l=qie5VJwm97s<7DR= zun%)-Nhkf>&9HQ`r=-*&xQI4phazb!&NV>w(YrUCi$wZ}p0XnX2e7}kX+<;80YXDM zyeWQ7yzLb%B_6KG4Cb-{3Fae4>z+6>>*2#hnWbMoI;dO=_*E;GjS>HEH$2%6e|D$g z@ypi6yOah>hN*U+mPUSZV)R2Kgr@r``nXtfXM;(?1zfr9T2NFfJ0o`6dBWYYRk@m- za}tgtE7*`DSw%rzB#M|G-NqbRH4v#=;=@L0c=&Qu)YFdS+uGRcil7s5>bCkl5+s+y z$!S)ar+J+j;o#YUqa=+z}+;R2cd*?`V5@Zl)}*pYhbIixVx>xRdfC#Tx3H`YO7g5tJaXzblKo*;T0; zo{Ergm|A!njz5*Fs^?+%{A*y=w%nXUW>y>8^6R7kg-U47%HNHB_jK6Uh9YsiEW9)c z_2iB+g{D`C823w4s}wi9msTo~TN-3^WSt65t>SptmKjv&fW+eHNX{pP$?XZnRfD{% zH75Jj%EXbdT;-X8OJjd9@yj{pQ|d*(x3GKf%c5+m$-$l-C0>rA#-&Q~^6Z6U1trdj zsHlH`?4}+1HtA9-eosZZo?7s5S5n-U585VBIb|Tj-Kd^IX`K~jzp}I;>$qBx49->?$dsYQuiF?p#M{+rg)1_l$-lr=E=RID#kdMl0G@}?Pc;eKj)-;GKV zxoj0D!x{G@C}O%{bn&67G2M=En$#qJ`h?QvO}NGMLTpr3M)03td2XLz&TA&V-c&3T zgNgvYJlV(~iO9>B=y!A33=G10s^63eMAWX|6{x0X8qQJ6%z`2*pM|1mMaxU(%Q4QP z`Pj79S7!P>^60~I$D()NP=zrx>PbNzdT~3B8GV<=eVPRsw3wH|CvNnuAl}5YXjZxz zg}wCPh@1KgJQZM|VP-800Q`}-)1GshGf*p@ypra_n349M)?m^7B@0;zT$gn@Bt#;= zjPS=RR0*6-bUgC!MNz+VU2_x3K@`|i8HrAVwWRakh%~fRWJgP7 zQ%Fx=68G$WbfAw`ROY=Z!R11l=(+{$QVX2YfhxQ8xGI~TI*b(u4+{GV1o>nZgaqxs z^ix%RM`wMS&8KGn(Qf^}HtPTBX=WC-{|(`A{->Vi{IB$Mi>8#*_9$ZSliIY*da`S@ z#~cay#;gG4mO^n)0wv~fAW0%=y{^7QjW*|dCVoyXIo>Bi3I}P*xF(FJr{~A#$Cd7P zprf?B?Qd}2$&pIzZJloi(XA4SZ*tuE*2>Cat!9eaUbouoz~${^pKyGkxI?UJoSMdG zv-&r1bU#-RCUfRc5!1%%S-RHi~MIW8(qxAMR81vM^9`bNp|8Y@F)U9Nt=`?)@U zC*C_r(%U(ZL>=gaFep|>HKul}=g&~Y4eL#n=Uk^ZO9g$RCc_Fl>arhdckU*kdVInn zUp&=Za4qk&a zmFuclE3@EyLzC_*!F(?+;ZSF=Qf`inc0S8t&?6Qu3my%^y}-sA&!HF8OR$0Tn#FsU zXSIVOefD_Ke00#VW&j1Alm7WY0zziqfv}OAQXn@j<-LL~*Cvad)nv$ZO_)FS=<#M8 z^EU>m2>T|oF4JkHAIrZMnaIlgvybih7&(h2ECJp{RCr8pVvxE>2BNyWYgw?_BVtQ? zG=FzsEJPf!gBsV}W*0P!#}F8~1VDUw0>eSq7mti@>>I(dy{oh0PR!a(-FUBV;m77o z^%bG0EvBUgj%nyY2T-;p-+1?ouyogn(5X)O2ro$v7c0ubn>Zm7GLB@C+L^E%#?pBs z{!|{eZ27nh?#P_d?bq%UY_4rI=!r#Ep|WO?Pep>cegx`GXo%yP<2 zlZZ#lBSHs2C@7MFP6R)(fH&g;Rn#wZNZj8em=TA=2iUi%J)dvjqBCT|D_?oQ$8$TO z?vn#04$vmmHbxRU$wF8sHe6ZT0E-$hPG$OHF=RIFTY}V&H(;nkwWbh)Zr!xrT=oiH zd9o9=6@VNk_xLv>*>RdK_LE7InkN2mlb2gxOz>34sRIQD#i63n%qcC*?es74iPJ8TzgWy6|(X{A1mn?ywe{$||$4cYb%j1}r3Yx?!h2OYGRux#oak|CWT zx{r6v8Itc*t2?Pi03;laP9Rop)LRIENIX+t$5n%@xQf7KNL0}5=A`4|1KZG$kRu*J zxq?I|CjpG@VM`|-L?sba@~5zlNq;`f;w9|rI@^@v@IB26(3Z{|a5Q5j`-csXP$0Y$ zp13lWUkHbMF)AOCq)|6EgM5DJUg7cT0Qh(W{D}Mj83@B&aIiCbR-XlMUgR2wGW1rQ z5yyusEM=Hpbw`)N9@v8$6>3MMfWQWCtg`k+!v-(>9dumDUVv#Gq$4v=9!j1SB+m{z zpv}%SM8|&G0%dcxkW)vaM+KMpnjsNUJ|2QS&4hWIZ6PT5O=Kkzj&&Gq!GoHJMOk5X zc11zl&FWT}5Yz?+%YP1=^da^rc8R05&qc= z>z75j?yTT++6oM`mlfTCj*@W5)y&>kSP0!7FP1zX1{bv#g^cP&Dl4GwI?WIMYu1Vg zcTM2c1Y4*lE}~0^yyDNJ;DpWd2xG?a+ zUl**!9JqUDKtNuNKyX5PggOxDEiXTn5o&gohOB|S2}s_iyX(wbh_Kd;%a6jkdl>ey ztahzm2nOyxWVp@S8P~1~LWU)vAp!Zagv4~!wDk=^H-`A8XRBFRYr{nEHmH>TUI5d4 zE?{lo7tEEwss6R4V{|;pvZTFo1yFkoh?p`qU)4;}Tr92@ z7Wd&HegAc!$}q${wgOEc`-8irIy|(gF5p1pzAd}$dxQ4ESv7Zkgs4QFmH=g~&uHju z$Zs@+x#m=L>=9En)GJ`Dg8Ek6{_o+=lOm$fLCasWJQ63-P<44!r?|y*ubw`2#8E(^ zT?;R0Fab9-;uD74Sx@N>8oe+Y?`HNVZ5uW*@j`-?VvHgSBa6RkeRMK@Hvd+*Gv|hz zrkZC<%^^_K<7HmL9Cd)(hTGwPTfGt)XBo{EEBn$E>K73cTrz|1~-Bkw5sXIm~nF|)8+yw z$C!Q*2b-Ssg3nbIdZ&+sK+88ay`M`92YBx{xXo;mAKNU9=!9aoV+lyZss_hBI^?JbWj2Ly*{=%-YO^4ZNfUZ(R z$pa36lzN|k<$pswRc%3aENZL=d&x!?*kgZR?}CXWH@V;Eb#2_w6qVjAv~C7)UD2aI7_u97U99PE=`BTw z>fJtwhySW^1!^fRd4hPNFD}5u99zQJ*P(tMVZK0`t z61snaDH4k(At;e$fN29Rsu<{}BXqTQ^5muHl>SpNaorOh3tO_1$`$*fdZaJYi%)ya z*Lv|_*#!D;v2b$#ohksUiynH`N0UtEV5w~QSG;?XMx|8KgmJ>Vpn;C~#@X>s{!KU$ zfw}gdMHN}$nyRkk#1Y@6Ah0N0`GyTOo##%dj^ybz=ATs=e(s!1HC;(sdMx4nbGE(;r){`Df=DO_6>*-o_ z6Ls-V;|eF3ibDsKW+kBeV95Ojis)y@alXa)BQA}MZ^ zcs?5MdO5zq_{Iy<`jd?n(m@xRVBH_KhOc(v9Z?&2!>hg}pfiOLVo{p@8X|g7JPwJ7UvM2OZ*stQJ5LE^^ROWjiY073fjd;nl4|^jUmQZ zEjngb+Q&r=8B*~qV{$$+!@3!A_hyiYMuwdl$KlaujM>a~1oVWI+PlC|oX zXey9QYwjSfuMp#t$85K&X)lP`!jNaH_4U$PW0)`O z9i6Yx6oYzj*ECaTi3$1&7`1BdfiI4<+9AbZJ)-9LqDNpc))_uZ`qWtYhn{Gplt<|8*6luS z615ldKBiG{kPposQ~7hOB0xM!y62yJ9jsdouUjHMXQf%&hGI;(?w4!v^T2Vl!gm2J3*;KHgab zBSnK!^Bal4mf6P1DhkiEe4lM?U3nUhk)~C!cqtgdlc|+f&J`kh9e{qFM+^{@tnFlc zq~?l&d3B{ddL(@d8wN4As++;UJTSK_grc-JiuFSKtXsSVDuK5J-!2Yda1j8Uc|w6S z{@oq4c7;FmA=5=J?E9>bj5ZMUa;q~!(5bc2CXl-r)9pGRLV@U|TIg+j@+ zcwaAsyX(mWD{q$}Vo~2**^#4wlj-CZ(`6qcITm*QwXE+Jhp<-_ZI{=$hDpL)7iAME z?YTir38t%1*Z`z6g-pa72>qT8O1Tu+ zHet}CL4%BRCGd_SfPI3=iyG(Qu6Z!G$YN4=aur9*c!;PRk6ewV&$^;u5KdnbR?N~( zQ0^86S!L-Vf^@_vrTo(HAFLN>)=^V2kfYF1tC1j} z>Yg32xljahWI!yFKpzu@p^fo|Ak?sh??!zDc~F!OVI#cW_^9{YxC!Rd?(?>1VptN{ zyCn~WQg6lor#u^rP98!C#iADt6tK#7q@OL>E6nxbCHwLRZP0_U zkbtOTifR;*9A#xp$K}}0RCcqDCjhm1g+cBBhAOk=Qaw{}x(B;|#F{M2|$>@T#l`gH$Y{%~a^ zjH%V+s=Q1_GU`?Mw+gC-p~zDosGh@uUPIzQMXL#U z+ozH{RWw+mts2zzpU8T$X8yQG)|*f*&a;*AeR0Zk;T2oJw>Y_PBs>p3-+Uj!fm8#+ zk>jeuCKG|7BluWu-R6Tqw*3>B6d-Iasg73+x2-~ORH5USmB7d6CV4iOt)$?tO%w4Kl!d{ux4+I5xXhvX5|cC_;gM5I1Kb0gJQ~;m}Me0P>Q;nXeG9p z!24CHIFxAqGDSX-hy9&ZG{pOv$I31H!)(CrRZ<-4Nfjweqb0kV2lwUYihw?NljAPE zQy6sJ9(G4mS6VNiT;s~PFmem4p<2TeZEbh7DqXnwqEBT4%Kfj98k5QJX@Ou;CCk7c z0zR&1{GKluQ>wk$u|NKKet_wH34;H5g8#1=W8~oczj6GG4F5^S7#aR6Gq$3!XSX$u z=)0!ZU{?ZQ755o6^+E{Ws|!^up1rJkH^K|j+}ye$Uo5ET>MfG@;rX5Sr)%njUMZEX z9a@tk9M++O`Duood9RkY2mu)-Gw<}xk{Nno=lUsnT~6W2szrd0#tgd2vLn;Sjc_LD zT;C(<5uv!jr4Sohm?D?0Kxp7 z1G*O2fk*7Fjf;Is0>^+X%cMZ(-u^v(waV+6Zo*B%6piOC8p)m3R`*k~ESvncVb5*A zFcwn`8f}9V{giQJP=mZ!1MMh0n8fncBc>AN7SCXD>)ZHmrQ6T-NLuaL-dliHID!(UWHZ5XhBQ|iB%H*RRED*4&6FiV8+hDE zx{H*Y2cPw32rj+tB393ztD6CmSGnJ9<{6k+-@cd5Wt9-$l?~5ev~-i3+dDFyCaJ-7 zqg4}OLrgdL$S&s;V{@%!*2+t!nLDy;O2c{_6ET^?XfX|Sd5QW&5dT>FYl`A39aT9l z8PZZ=$~dzXBgTm2N4#Z`inVe&`M~gy*3BJhcUt@H0%wQ$D^SJ@Gnp&t)ms3m##^cmTN9m*NRdHj_LnNmhir>I1ni*C9+dCh_?!?d~sNHX8?&(%T74zZ=ni*=_eRMX zS5H@80FEx2MyKS}FqjQslWET%S1Ia{>2ga9+4_T~6E&Ns8gTAlCZ&e3Cn-L>&7yTn zwV*pLK*p4-%GIM#gaD`ra>vD4@)c^uqXcvJ3^)I5JuYb!RjOi`?UD28Ta)!nlacJm z{RMxJI+kkd6|?})z}q!JgAV4$0TmfN0xmTKasYsbq8V#hZO6u(8g%SLTlX~()q*jW zspt!A1Q0pkkju6wWp^A3<%LQUv4CziNUa_6_Z(gq%TkSH)*p zFmA#j@dFmV%7TxqwMmPwAWAcC`8}b30}{~-TfC$tOC5qWK{t?ISpQYJVuDM_x5(^5 z)Ev5ndAqqeMP518E*7{?(rVK7b0H;Wx3ON0YBYR)cf<4K=ZE< z#m5=^Nb<9^qzPfE?0*XMRPmuMIa;oAu#&PF#{{Z2tuYPhq=O`wbr(Sn#~ zRqVy{T;8-#b1O|sNN<@##5<$%eqjwnivw#uI;9t7(>%;8x-P1B;9vrs_0ot7=`tgwLgr&|+jk{^*|#5?$surS3sM(x-wSf4KhPPccc zSv}>h%}$*z9YlEMFKH|8W2~}3mPWU`Z_-&}=$TkFAy?ncuisVdlZ;7KPMwaJK^jj~9nAy=6~|G*!+({Od=8 zR)L~q*wAr>5hY^#IP<5$d|Z@RT-V32wv>ARVeDz@4WAxIq9SAD29+pR}DRd06un6hRdeJfk(Gf6{6vq z>m1JdPE&J+(_Wj4-heS*YBR|LNYkg#NKgay5WZi4I<>biWCF{^s7mfAO7ZMO`O}%c zJ=x!|zCX}p^V`G!QDFW5b<_Vm2Qo1;{NHmRBg23CKSqZC3IMKTX#K0OQ2qB_s84B? z31v=si=(*R*8n?35<7Jb^sYttlafd1M3_iS#(ZwBe$I0VIlCoNORTY*?Gdm^%x1s; zn2pni>qmyaTlj%*VG6)E(KBo6iQLrbNBOGHq@Gr&FnDjr~a#tMJI~ zgmT*96}<$<^Ye|Y(huVOxR{lj7W&L&gqqrR-C(C$F;~2s6X2tpPptY7?H2Xjgi>9! zhMwwPMVYpu%|jo*D^`qcx#|F>w$0&|%T-7zutYAX4#z)SmP0d7vu$Gd;ek@P1@D{T zx%QCmkX1f-udC_{BtxNYT0(+xzS^lbtxRnXjN!#hz+rZxOlOQpk#A-_W4e1uP=98R zCOEPzBC(*)v@t0%R}P5neW#~Oz*lxiEu@Kq>Wh>F@f%vR zms^XgY#L6{&fK{z;_xw_P5|o4bYKW$Rphjbo`|9emt2S3Rxfl(CCOM&fTm%6sgBLQ z5*;f;BChX?j@J{Wh+cJ)WGE2i{GqFuKgx!@Cozc4yXL=I&4nmY&QHKkDy$~CPU>GSUhOMVrQjc!pQD%>2M0t zV$oAidIB@WTg89&pi5j*b;d1thwy$`$$+yKN11@^8sTIjlc#>|v06_PH&E-6U{mJ0 zuuIpJ&;b2cfRslcecRv~Bt>^868V}@F0Vuf>u{33Q`L_TW0Q+Cb;uAmBu-%V)pDB+rPngu zOk1U^M-aQOIzZ`T3*!6n;1PLK*cSs8*3f=Sm_t?Pmd4OO^?=W9)fbrt8ZwEwRib20 zw8RyhU#M+6kJ&ma7x&qscD7_oURqj@d8t2>Nfb>L;F-e1>~AB_}b(($@|h{^tjwUp8{ zGPX3X6Zj8)<8>R-&EvyQC{>IPlNLQyr-J&v+a#IDc_8f9|mOQ}kG z9kiNZn^Z9%{p;XZKEx*iePhpk%MpmUH;`_drS#KgvSix?b@g(tz}WiIj;ufBDy(mq z0Q)M29IcuB_bmf`_M6_fO)mfU7T26>%ETwArB)y9Fe1w1jsS)ImmbL=bkuHM2x2M2 zk#KGpA{_0facsHoX^@bZ(JlVilXc6sZQHhO+qP}nR+nuXUAAr8*6BTG&E6ODUCb}Yl~)-N`92Y`e+6;r zu*o{;O7rmK59ldLIC3yMRs4Us?hAn1zW)&C@s{g_5$5F)T^$tKR0FE+|$YJlmjHoe31IA}rOBzMBXWCW^8Dnk7 z>}^ZdDXyKr&|#KVtvaJ%9nkR$Fax$eQ@(u%yf`+Fv8K+o>{8C5Jb}nQbqF9|h!l9% zho3TLTjp^ATR5bo8|TOl;}vC=artsZ;0j_$9Nu_@c&g@k2Pw}ar+R&6gj5zG)$Nua{MmD2}!Ty>%N{$ z1cK944f7GP=1=MR1ilHwtgMU6UImnujk+hyuP7K5Q#!WG^KYs%^cQ)k}B6lWc+56E|-s)bu z99(5Hh{!B^8h`h2W=JI?MS)e4e4=8hNa>f6d0|R#t8gx-gqbOWKT7+G+7aZx2C&s0 z-h)l>WYHk_+?djP=c7Gz&XMm517R<}^<+?Uotnw9_|1nK8O`utsqheyXXPaLb@cM% zcNipa$H__Rcp`P`% z;K!p2&AJWpX2FXtt&xsB_K1js3$lAILmp5wHkn|9?cYD(7ySpwl5#9PIm1lt?URl1 zn|rFtDVB=Wz1N+w;27PFjCiu&SNaZ|e>Jw*g@mJHcntR{VsT%^MJjA{4E=4aVe8IN z3syC|6`hKlxT?XnY%j9-Ot zBAi)hn{MMkXIk-z7Vf}DKL+BpJunDv?P?Tq#3JcpV9M7Zx6jKwTDykpT=&97b>yq1 znGu+*tvQ+w8Qh;LVZldN|HgfsVceZoNC@O{V$V;@DtXQRW%XdLAM4j!mJ(__r1r%c>qKG*pU@PlKUUlBJ$176-wn*=eb7!tWYd97OC-9Oz$>!?@#53=XK zp%W%X&i}i#&dBgTsS`%V{}p!fZ|TwL@ZZwosruAr5T#QL=GO5-@T=PT-|-!bPr(f% z!J`BbG?01#3Qfmj_?6$Bn+`(&DZRSGl&fV>=ks$u-;bw&{0Mo>`+I5sT^w`1^;y2@ zj4$f>T{iIt7gp_q@@2D^=`IlbYBy%q$i$Fj5}5G|j>n75_Y3`ch?q$W1QSaLVztdo zb=od$pQq`rsVO-NjEXWEnF@SS6Ib@f+J6gSa(e8AgZnhGmI-Huy*Lh^KecD<;1BWL zT*stvTx~JT8EF@m{&W9;6PC z-fQi7*J4U6MYPlcD@9IY$h6W22bL&Kyt|3da{>pW`9z;ZbXU>4vQkRu22x*Hr-!e) z*_{M6AFjw+a@pQ@j__e0erewMWNUbQe*fp6^-Ir;d79{q*TZP{V!PvRclxwP_^Lk5 zGRC#1&&=1C@ONb2B!v%&uAD{z%;$se3$I=RQF*rT?u}?UJX!m=Pqb8PZQxP$v~It5 zr?qVx+ygnDM@zGum+hv3bU;{T;FBf| z`5sicJx?p(x&W1(!@#*EpQ3nW_Osi#t*xOtS8|9OZ6C0{Q-t2`>G(o)+cpBv7E)dP zV8ejlLM4L6v&pxBLU-eUVSthWfy#Ikg}3BTpt4AoyJ(K`3oFWR+93dG!W-dh4vk@R zDmMh&yS}(s9O!n5B7#BkZ^C~eOXZEK%M;PYP_LFzzeo>7UsaVG%wkbE(6n*F{B+=YygEFWp;_tYOWO=~iF~ z+prue(ES>0G5nzjHO?3o@LMTnkud>nK-6rm%h8p$5i7gVU}x8YR0{b|w#A(&jY}nD zG$)H9vVOlo*VVQ=k!kC*4ZCRyX`a`I3Y;c|z27JMB{84FB`H(&p_3HepYt!@+l>EB zA5av@$x(lu*>1Hjt_{qa9wr$eZFbMibjG%HjbxK*6fgxxo!Ve!Cy)&tPTp^&Wbyj( zWQR{`A)_67hVAA(^0#CAuMsB8R=7$CO{b;E*(7p_Vkv(M8qb`>R?p3|0%$d+0Aty} zdL51dguPpyWO^}jRY)Ea3~QN&=`Gc!?4eny>yajy#S17gb=e!|?(S{@&y#jQ9(6F_qE@+IRvd6>x9+pdGti>5Vn9 z-1P$qO%U&w z*!V>t;&0W{Z+@vh3;px;jUOU~G*<_y007E(P)p66_ARH5RRc8IW+zimKw+zt`2a0B zQljnw^A;JSZs&|1Eqn})+^*yt5bD@oJdRU|Ct_S^Rt?IN79}9oh|-}tLPd9mi=Fq|25tL*Dw5Il#9Z;17)cRx@t4h1ulg5L6VHi8{2v+uSWejH9(&J37D#u5t~epIsZ zSO7U>QOFTPMyOB9D`3k63MTHslPO9GAZAZJD&b3%DzQg}sI3$2lWX5r&hFIkNKZEi zDhRr-0sto!zy9O2WEKPR7fZmiA{2GWnI98>@s<9{ALi#cSjUmgxRLntKrg-ThzQVn zUC8%TEQNwHiNj?h(hru>2}zj{Q4F|a0`T&}rCafY126n}FmSzWnNd!#d0>&hg{K#H zWls&FAoOp`TvYNLtAkfkQ;*mwrYn`|tqT?9TyqP=+>Q~}P+h-0Bebx7dNvFZE>k+G zao(8>2n%t6q~>k3tR9j9)nY%@iZnA;$#}ZPEHz=KE8S#QQhLb}e1UXpasbpuGC@*=qXLDc$fB)hM1Nfy6Uf7N=c`o#^ zdNcR>C7C3cIATh74m0aS@VG+q5ABARP&bdv9>*8r9S93tBmDq*1aMYq`WFlmL=f^OiB9T|ArPw^Wj>g4?4f6mrT&iY zKp^LPOKlfyP|>}~dofK3O!E=ThrcTr(pmtQhEpth^#QYf#Cmw&mK;1TtF7St5s_L! zU-5&Zt&UdC0!96jVEU;f65fBaRIm^<#$Z)jnB&wLk$n$DFb}&>xkCdPUYzD`3a~c1 z(VZz^7}%d)ULQFgW}1H$z;Fl6`5stZh5|Qp?LJ&Ri7jO3ZM?{$i0G@_tj;EK0*RmO74+RGe4EgCV?+c>%b!aI{@N0WX!@Iew8#d2MuW{H+ zUp5fLWw5nGjtS1lWRDco94?xxa%GlV1ET$=U-84BFya!yh5_!(m&;z2_tOTK=+2BA z=G|#Y>{GRb8cf)>^5ZCW(U7ZxU@XG2i6;YM2OzQ-UVwo&WPN$idKRnt*FuDuMB;FD zoZA5L9i&K8fPj~5`J{BDj>9Kz-ucCAu%(Um9F$9XwL4Td@Ab`ZC+lr6u82Ra$zfhV z6=WBuas-~_RY2tzWad*f9WTAuMn=8Fz?U+lAN6|(%P;FQbi6Hi3U9pZ;4XMZ;zYhF zrZh?{pP|Dk3Jr6(!mR5geW9o~>||I=lgkA=o~CK9Qzz)X@u4M4>lBh> z^`||7P?H($-Ek&h09X&yCV@3kVo}aVjeD;^TElqPSaVQOy||y^p=&SzQD;~QEaFuL zh{BVARa)`&yTA*snmoKp&<=|&>r^1okz=x>BD~Ab{J8|Ldy$8K<|dg|P_SIq3}p63 z8pLC!Lfy}*PIsAKxTS*AaR<|^Sz~W-o zb|Ss4=E3f8Ah@v{l*mPqY}!wo?$*uBJk;u7U%Htm4-sa&O1aktixu6}*JKWW-%M@q zx#}V_!|H2dZCUr0@fj6e;&(YhJNB9HBu$OAT;L3p-<6uZLidyKhU}KE&gE3=S(W9`z2LUkD!jT*&6iD4cEc0T@D#qv_J&&(9Wv^@+nRO;1EGKd zHqO;_V8Am2=>Xvrf=y%UXW1Fi3*RP0vJtj-r{%U3oQgJ)H!#G;^JP1ZQ3vR#V}OY$ z8}Y{|fgVuh=oOx>o8X@F-ruH}kiHWy~~i(A2li6rh9xIqqjgkytn2ovLVExo>qfTxJf z>uN{4*E+r?kn_p;UJTwY56;5S3+orI4_Az@38Op(PT0(d{CX)yuuYa>8wnZlyp9l(VT91)(w1^kO(pgd9`&z$_9m$k z^gUCb?Er>S)zn$~z9|%ah@u>ZuM5ACPf%j^XnN>ce$wrD4|zX5dNmI#Tzb8H@Hc}V z-3;j*kRXs+>6On=WxVvu-v9&-bVbU4)w0N!Ci^H=Cs_DBeDPP;0iAiC6Wa+)v&5HO zq0ajr=+Y0?sc0TK;e4rr?lI@UqqFXs*tcWgsyHff;duYr19YIftobcc8bl`34f0*a zr9M6cwbe}ZcD9ncbhQ%P(veWxG&K{d3B$=`CDaf^ds98s72uzp@|DxwgKk@Ucy)pf zPYz?1R~%~S;BB?&d1wDjPCoMwu+4BEss%A$e3*dlglZ{m=^d}Cd#mpD&d(#6eAf+s z*k{iNL!W95w@pTfCEf{>(Db9pl%!{~o0Mg3FAHZC@ghh5DWHj|=HnSKCkibHdL@!CU1dBN zQoaAK%B4l9wZAxdFnTwG3QrAq%nOKsh84gfoB<5UU&d?PnF^5>h=-|m$OYyhtcYGc zNHiFrJeAR4UI0Xhfm+{3UY4x6vCdJWC6H|)3BCnFP%7u?6K`j=;5Ex?CbisXlw&2~ zw>m1sLZQ|W5XQvlNOIa8^KB#B^;$MaMsTXt+Rg!(Y2wL!zi^t+$)EMb9hRF&2s2y* zmyd1&JH6nV9!DdHA7R6oxlm9yO~zdh7pQTNo` z!K;KWlWr-2<2a3`sBh)UUm^g)!BtWXEtza*}!>tk&Gq67^ob0b|EaJU#$s;YH31G)Ol&$HgTqY}ASuOQgEy3OJAw~~V zPvN?3o5K&Y4>SuGQ&mYdTkS3$!C^`Rg&W#A!{8wOi z{z(<>ic6}QJ5rNolmr?x#%ho_A3;u^My}yiX}jpV%vKIdL;raAKt3jgfrTRY3E_Kb zvk_+uFwnFPFgj3-RfP^z0F0Qfun0Ov+xGUEBc$7YyRjDh&tO8Z^q;`eu7^CVBv{KI=2F=esLglMnJ9n@8EgdvFszYvqK3$$ zM*hhI8wsq=ct+oUZ#Exx9*U5e!Eg+!ixu9bCrwrnt8KCk|JY}ss8`TX=LLo_UkKtB zz|a@IONGS|5k9PF?W2fB{ZNp_GVunw(I5}N53$_SQJBo1QH;H$xdM-hWd_&9=R}jB z)q3>^RvJ4qP9Y)&+8*I9$^)kK_LG;E7Z@rUbS*Of1DM#F1H6y40|1+pl2BVH!c;DU zwBOYcygy_j@wVZJIB$@lD91Dw4bb_V!-jthYQ=icYF;+sR27F?|7a1wQHuPIh$;+_ zTZ${X67Pcs+xki7iWZ;2K*mscq=3;(W=zmHDi8uFWzoFp(Hn4hWp2!M(`~G$zBxZ< zWH&OG5Nsa6Q(y_>mwP1Psc@!{sNqO{h}bAUp|_pIA=wRX1yt@tnIFf{P8w7njau(i zR@qK|tRewn0clItdT8K1G{w3WHD%&iuw>?U2^z-Lf~U}8zVFU%#N%9?Zq5M-j-i_U zCP_&Fe^kx_%f&92XrzIHKtjPf#ZyA4ECT|rZLO}(51=Q*Nx^=G1aoKVEWCPHiYHkI zu5QsE`ZH({&-=$-l0=McP2IB-JczA0XmL{^wYmt!Mtb#Jj<(|@sh`tKV@k6t*ko`7 zNKnKhON4z5$Qcw2SvPjN$Z~gYI_9y@N7Z70vLZbT5O}WwyEQTWh*r`}88&KwJ73KF zz7I}>!nzTy7$?a}50jt4RCQKHGyJ7eqSne)Rj8=j!R!(Uz>LF-E&r-RI@mBTlOAko z=kt5M=bVSP#~k}%-3Qa7g6-ag$4tr+KfXZ!U*Fhzp}Li=%zf|(PbYhW5!-65#~!fj zLm$@~nB86O{0e8TN)mmr-y4EQL(#cy=4lD$*w$Fbkml)kS&=+nUZQi)agzJE<9GwA z7+yg0G?uOjNB}VDgVz=ryvC0vEa_4Li7!P#-zC^N@TXTGw=Ppb^UUwP`$1T}Ytf&X ze1?+PSC(kQRFdcAUYP|;`~W-SEeAe31J(NQ z@_e6_)*gKZy1r#gvV6mE4->4*AdUYFyIFQ5+3fO_s?4Z=|Em{|sGPSUS3sM+dPiq? z85^@%EnC$intAwKa$b=UgsSe1tA&hP#UwQTX@;Gi{JA3 z-<3z+UA}7nB7lT+%T12ua%di(YmGj2SzyD~uT$6C3E?~o25f4iBwO#P%Z&jBm$iWV z)^JX=(zI_72Cp3F6F}dmTO6JyXUi1$EWq$A_DU?Bv#ZX@2b}!#S6c=a_voTDHbKX_ z<*|B?fY8hR69sA)>}kviOQ=s?n;pz%y#=$+r~5`e+w9+4Z!d%_*DL>;b6vi!&LCQ@ z=q9x?qfQP(5<|`5HuEVf29IG?tIpz=D%!l(?HQ>+BnUC=#>p<$`d!m9v}apLt=aOe za9wl-lgjzVR|OnV_R88$(Aq_wf#T~H@_4jU%e=(WAEmrZc|&6?(~zdSP2=91cv9m&zW-y-pyQBEUiN3yrGjtOSUTbDfW-) zZI6ztiCgZfy-`X;R8S zZh+-xz^?*R_ThQ4->81(SIxgCcXe}z=M$9~rG^{ad#zG!S5HqZw|NK_#&>}3yk_ok z^V#|$+Y`ZD%=g3mCkUVB*gnMj${iw&FC@=7P5I;I8gVaC5CX_|Bs@@tF(KlEt4aQv z^gporzo2kpuSfqu_x)eOgN60~T`w^HPsD?f@qfj5^k{7+ZL%Tx=GO_ln^w?55(?a< zrQkc&Jf!uEb5;6cmg%5?O2$ws5mqRYX@7#xlpW!>VWR^Tv&6YKr9K3gg%Ql1{mb%Q zoc)LhO-cUxpZq>}peKEA%e%{br)B(35WgGwwhgLYKHMa)Qu1ls-aJXi6z3ERB|P8L zS>U5x;u|7sq%TrTFauJrY<3lBKK~2z$1k^fbCnP;%VbPgVvHMmw?OTK-ll_mypv$* z%r%9ImS~`tgTim=mlg2FstP&LS?M}kW0*Z?nd`pe#VnS zXQoz^T?#KJ7vfa55&{h6!GND*%DLH!Lp@kq(@3SfW&przoa&req~;r$#d4ot=0_h^ zq~#;QU(>*(-w9!0Rda+JSarJpI{;(AV}gBuT-c9X1UWDVc1bwyYAbUe+Uz_-n+mb0 zTYw$fmy;zHVPMAY%^Bb>bv%e$tY#|YMnn+kKmJACCT|mu5Hx)e6MeT!RPHxO0(By2 zv3VIXbj$Q`i}!ibI@2|_kc|9MOa!a8!2_=tV2UII)+e8WkGz_Fc6db6X^QI!5w?}n zJXo`^;O-!G@Dp6K0@k>k#m+9jLGzSpvVa-CJXb}U-~q6RV16<@qA^VgO|0bnR}Sy4 z)b?3PV@2f8rJjboOv+S_!`X($hthk#E&)~F#~HJ| z5Dl|KLaZrgAh`%@bP>kB<$)!AwppGn1fYzTl-}8*JOt!lHe^Vl!VA{rI}+6uES<^= zZ~StRF$P2?9!NI|td>|Yq;vVk>K$Q^O0zI3v|*Nff=jBOWS$QAwB;aZ5Ni~e4T{*a zkdp@RP&^iilGt|05E)bMUkie_yJJU@OmVT-xY!*0Bff5VKZ4ouWI)A`l6I*MHz7p; zO7$M|quT1Gw7z7$R75;Q{+Vht6%W?4_a$sbS@DFGQ_uBNm`2u|6kmFt6=|27vXr>W z@drn~2gb6@S$lo7Q@xi(=y+_=n5e%y)goc5D%L;Cl^l5@{YQ%FT>x-jS`uIYS6v_70t zZn${=Y%Y`4RxCw%6?^Cv!?Ci38kTZbY8vAOQH^$ohy- z=vgc%i8h@hHXO!i)>y2478Hpd!1jCe^%fAQb3};gl~CNhF5Nqhb^?$cP0;dC3h6(M zYuuCKw?tdZ*#;#%Apce*f#AZs!)eM1N)yB=k!avwPKg2L{_2=&XlDx{7_Kr_00$%i zQHMs=Z~1Y#M?I`cpVb2l%@W4xS%X3DRXXvzfZ_8IpH{A9Ki&k-VlU*)=>|}2DL}$K z&7MX}I95aS`ba{Kn5j96$RvLOi#w)3yqCLsA1o+DYSb_ZyzH#7@qp|+f&e!g^VOIt zyyHspziB*n&DCPznd89HOc`U>XwdN2gLF2L;m)_W(kg(I&o7#5TRcc-GINNljU?kw8Tom=VH~{ z!mP>F5PEpmtf`E2L%QjDFHy3diG@JR^%#LHlg-B9U3%XsskfZ|OdG+SVJzvgOf&*j z&Qv=aLHtFOoLs+z#6yll>@nDYjNJkg zHFK<|&H?xfebRb0lfe6@lRPjo>~gT20InTK+$d7tGKB=7iy>cfH{6Q4O*$1uy94`J z7jQcUb=og_oXmH%r7Yix!B+@N&>v`F&^Wsc6O_q6Ls^PRDT@B98j?^bZa7jphGyoe zh0uRISV}Q%G*Bg*8j3GdkLi#T+5yOcMj*=I;7_#Qzd3lO8hjp_M^ekuH7ejX(AqI@5DlFRqAJmYzWzmc4hi#~ zDL(x$)r;fpdvkf0wC6{1RQXX$-sO+%K@KF5OCG0=_B&Fv~PGCp@b*^>)hRzY#kaFPgKoD}H_v(p>i<%k~!ROI%} zkk#ErX+ei;lUYG%Ah-2K&Sk~ae8b@vQ~ljatLB*(20;O>L~1oLm!QHeLjuJ6SqHCE zkL&jylt846*Cxi5QbPowm|15TpM3G4QPZ~E%<8;Yep76+g%1KtCBd)(&$+NEEF~LG zvx(|dSkiQ}t-~f9^YUGN*1ru-|0(=K?PlEKr++|JDU*GoraOJ5&$=ViqFw~UMHmDr z%RIs7#ug%bo%~36LdCka@l5BBeYiY$XlYD@Q_FWzCIMW$I&a!W>a8GA zYh=8T$3t+SwqBAIL4q)? zAI{JX|gEdcQG1l!n`r4Qqa^mw0#q2r`+WV+cixPN*kca(Pw) z(ZlCqclbfyV8{*u6FU;4(YTyIE&N0(J)d_gotU_QFf^$a?yC6-`ba}YZVoPi4w0lVD9GypO~9KT(`X-&DTr_t7vK!%O3l?c9PK9nt6^&*aBzI zr91>2eyJI!T^ANx^=s+`1!*U{xN9}vH>L)W?B_9|Z_sGUl*{$p9{C2TMtM6R+O(y= zU^|2K39!u?qPpKf5fljME78arB8=`^LbIlWn0qm+T`I1z;`Rl)IY9t9p(h37=4f%w z%2>2&G%<$}BLnLC3AdBMJZK;r1YbU|@l0@5^l%=PJde*GH~4qA{EyK_E&stc{Wn*~ z%*643M_(A3{sULX^uOZjhBajWPYqPhZC!?Te+c&o48vOjRd|MCWlG~jOtUJd0wpR0 zjJu&RAVkJ-mg9R$)mQ%a32=U~Fl7bD@DN>KW?tUSYMuVA_<^#R&-W?c^~1Efz45n^ds{;`MkHtCP{LIlc3nr`nlCu9M*0GQL^1-k+we$L z+jouM^YW(4+P}N|@!^UmP!&G|n21smy1foZb^(a0> z_sjTobsaHCIqk!T=jeGk`|@)xH-+To7!6(G=i2b2x{Ge}5X9dz96@{iDxg!5gxKp^ zam9)wVpBBVJwXX|W?zU#egW_u2l%}Kw!+JTGzLT(Ik5l+6Em0Aq;7&s*;F}Md3&6O z-=r(^FX@Ip{bO@mM(tUbYSopS3AcxnqYR&&#;RKLOV%*F&~##zDlG z-vF*zrM@44eR8^HB2U6sXv|`an6Ku*YdQ8+nA({X8t86I%IV^IwWr!Nol>$fOXF_> z+hkv#K`%KfrS-yiukD4NQG=s-Hjoq#>>e9Cs~GXF8U{`OW9ed7R_zw?7OJPO?e%$< zaZsrdg{)0Q zZfb|JXlbKwI_|ixvg$M_`qJxRKX>}GpWlI?S?HC-N-`S0{jZZK#^DzzB!!Z=uHQ(^ zzf0++_3xjNt`*KDF=Y8Hmx=hYM*37A!3nlzJbHs#XZ%EbS_!a0$h}nnO6*M32(kVi z9V5j#lDluf-;{-AKH-6nWqGqhwvn*E=E8S0C`FJ_4pVw=cQgkqP(Cl(Zzqdu3wLAi zh-WNJG{)V}ZcZbAf%!j|;xj-88f-hOsjI;IJ8Bwz0+yeBS^9A+4*raM)huCHbb(d5 zByRD=wCtl@3fz&D@Z`WTp$2Sg>aH;@O$%Fu1BI0vOq!B^`F(7#=O9;3q7(#LlKBl$ES(yS&)087#UVQ2N7M4VS5%kILt;R)Z4)(IA_y|?*!b+Wqj4j_p^+{whs*(lHAh0La&+HYI-e$;cCI5C!KAJqS z+S~do#49R?MmTpjW3p=gyL;bhGQ1HBDF- zNFw|JEwW+|Md+8( zo(5m98zsDoe1XY;Daf-z(fKbP8{{JhccpAQ1}$ec>ly>o89YCOGc-w?qe zMn-sE*25Pfq#|K)7G^_h6~z6S6qskFT>wm57PQxr?#e>Xbr!4D%OWpp#V~Eq%f&bO z@%86YYPZa7Gl7n+iiEJdDcRRWNYZ;ec0zq^4p>zBdt^LdvYnC$A~bDw$epsHHTi&` z`^~NxxBhG7Zi^qbw4~$(fwce{qNNUY*sq^8 z1%Ltb#NynDk8NCfjz{~*6spE=D1pXXxqI8K2$JA8A5Qx0r z%-Cw_L*R8O?Tzcr%lm=?k)2tK0%Z>m2KdIm?54KubT)+W_`n8pmc##a+hFo`oC=QOeG=^`g&S7&i&M8EY>d1DDKoP#X%;z??}C;f6eAUv`c>jf9vr-WyXJrhyQ}h z7+6{VyK9n>=|8|_O#dsmY+CF8ml^-sCTR^&IR~fqj0w`=+)UCl8*#(5Cczh4K#k1Z z5wC%)0i>lkkCLh$l)vy7dGY%JG$xu4R7zAt8$b*?%RZkkSD8OTLsAkEe%JbZ}zw7?~s9ue$M>k3PSS#lAv`gL(82Os<8Ic^5#1b{G<%2#Cy&v4xLv*Jr5;9>9 zU`H=&D(JSpzMT!rp7hFDqGXrRB>kU=)`JK7Cg|-Z=j*wE$|rX`BxtY3}Vv(wnpeWMAu3m|6MW3{5FlSR{nF2z zug1+y`m5)@IBlGznZ75xMlwsP;TfB9jg}9Q1(^}@IiEq0)Vh5Z-3KT}nIp=2DrRhm zO`Zg|@ybJX$bgn{;TvS{Y56WjW#N7Rm4cTd&wu~S*Uq>n-^@t`{zpwj?XV7s%ErTHy!I26OFvm|OZ>xvOVIt!2(wmFI9mNOJ%@xs1 zI%pYNJ%bfVXa3}J%HeaPu8xD9xA?1FXjDQ+Uy_4%i)p-JbD86ZX!m^H(A#d`6{=q zy5VDP>sK}z!$@Siry(BEjK#_deDf>tYDd9uYrPrL(^*7!iBIMyG zKXZ+(_(}pH*0)usTzUK1i!;G@?IHt1uVUT7p~x_^cA7U1cYBIBoXB7afk#`yMn;fC z4Gekk>G^;i9SDx_T>jMw8kePA3pdcTR(i0TqGI}?u?uj|75w-ghnc5fMiWDceKAEB zs+gZ>z?92qpUJrs6&Yis8E9%azm4aozdK(@ofL456A^Szm)kmsKFcE2da{ z%J!_b?&|pp)4cI3o(ZUFK5?`0-KMY6CeNWxRD@Z6l+^GWD9Xxjp$M2~;RtKG6{a3+ zG9}r?XJ*>i1qWMAc!g#Md1TS)<98)9=DYl;Nz2_1uOug!ns!yPULtUrw;}Rwf!Ws! zYh$;cJ$M`YHs-Pv?ppv|IvEg9_kpcD@l^kND1@u0yNxW_rQ4mCS}#%t=QvZHPoH1@ zEj)Ju^dlD?bq$h@;Rn&dit4wOHV$4=$$p8<9YDk9Fbn^9fj?<{4-i3J-}mFQFp!s` zuMfOZH~GdKLEbP!4(DHcCwSID;VwAw-h~1nJLB&!sFj!vwSU3g6rMzrZ{V@2(AJ6u zFlUF*r}Lzu)FFvynkh^x8|;i3qVsx~N$?2tkc^Nj4w3t*Nb(c?6i91p9%R}2L9EvqO;;SeUAf(DE^ zjQsxI3NX-6P8reJ;*kbQYl6VNXNfzrm8LJnDAS|rW&GQI0p`H65!pT`II=H~pMkQF z5sRc(kJG2s!kz^M*!lb7m9gM(!LVPR3;+`T3;u8aFZN_pJb4;qiAyCqNdYxn5x*L} zj;GgvG*pU7*@uk1S;a{O-%FMWAvb0eIT$5+|04dt5B-?&x^3jY6^zaJ$}Jo6SZ?WW z;ne(6znH?05PUN9CJx!&lASlCSH78MS`EO6l>zc{0PS#(=o1#-=>v`a$3d=kqh?a2sm$hiHg-TtDQ@Et?#prEBLU#e}*PlHB5g73psPpu&Q=k z)#2sX+M|_ll5*2oA!yyo!FoJeyK|bmy!Gj|P;KbuBI#B(EHst%Y&*Ad3RJeF0JJz* zhZDY2z(!mb7ZPDm=pYh1MvyuX5L2|r8{wmZ8gQ1DVm&z%{4m}v$yvViY3HOd=9t^- zg^%b;XUz2%*(i7g8BXVTVno+yjmAihtc2^9Aw3k2 zlliu7Y`(Qcb@Cnn;N71hEE~B(++c+3p)ynI6^Zn|M=oKI4<`h+O8x{#Dg_u{J6?$% zkY&SJ>hkoNQ}fCs%zqzRwr`1}+#0(h+HQb@J@bbNwKd&-z5BbMJ9QwxD0Rn(EEBiA zkM|}eBAA}H@a4PB23FeJ1a@0~!PrtP-o@@bD@_AkD&1ResfohnYI%l^z(C9~SnMIb zx`$XTO%VZaxsiZ5u{wEpC&}W=PtQY?sYU=HgPTUBLo=uG!5Fd!cj>di^f}4hbVBCa zyCA#l^dSR3imI-D(gkWYjN|Z2IIQ7w8dfhWv0ls@q<)%10J$CcV#OSc4X`|3HGw9N z`nj~b=-wcr_>n{!IHy~nDX5(D?Kn%56@go9yje@4z~a=-<2^7#{Zu;+l|Yoa)Qh@^ zBU`e9A1)XJ5X&WtD~J4NC2Sj)SEVcp&;Zp`XUm=>_)ad%$Hi$dlhM?4^6NPku_ zw7tYT1b}A)a$?rMZZ1Gho{q`j3d#W0wBiJo&9WnUkwrH>v>}NK(%DZ40PQ6Kq3#+x zf?e&O^9Bs8pZ2ccR`f9C6jl8W8j*s+CjoUy8E8Wy;j2OLnBw{u`obs~#D1+ey)FRg zS3juv9p+RnVKl;~8bQ`Af&Nk+RX1})cBw45WQ6gdd&EE!WBefOfo?Z~zNYK;_)wI! z{Xw=U37htN)Kb~aJOs2-#%I_5zM6(l3l$i!#;?z2+ME(>Eg^f*ryJu3;}^7UOo6BR z+YgQi=}6hC#TSnOKHGqmkO3f++=y^1_-!nTmWliH6BHXmzMylM7nV((-ATz#Ix~ly z!FM5QB!J^^Z}}qnxtq(FY^~i5{7+edEMRAW1^=ls9{+l~=FBcx=?15|shXr2OM`Ry>`@*>|FelJ*Cs7Cz z0i0*K+o$)h@8ahRy!}LD@IP3R{{}yq8JYfHqZreF06&@kSK#NgmbCrm1nSPGI?T<< zf+$NSc(`!sSYexNAc|}@*#>2xpt5mxi^xS%%60Ya%KI$uBN-*P8W1=I5J?;>k8|F? zwd+5A;vmW*Px!C)Exd$h4@a-aR({c2{L5(Htvs4%%99sI$KVzG8hSZv;S@~PB(NU{B)N8$j_54|>v`#%Q!Eu zvUd$*=kAnb2r&cr-Z2IJD(K1UX?4M=>NN^YoOBR0wpEqJy_`iqmT!EL@i(VaS+WfR zoxXifBOsWv3CO}KuW!p{%X`8a~(w)*>?i;h0atX9E#-2 zG;-%c8OFSVGsQRyT`%<2RUr^b=ZG&&5*VHJ*zD2ti$=cT6;^KqoYIVsKX<1JqVnDJz?WHnu5?Bw>~0zWt$s z$45Wz7{x5Rl(-%tt)}Z)B?x_s#Pk6OzastzH)|zy+US|ur=TVJY$F;@0^?2YYI)cG z?BWIBHwe7uHIqWFQXr&c^pRa#MU@vo*Cez9!xq9LiVE#2^d&?gZ{=bTVi>fZM>+}n zv4kNOD%r}VtZ6e`ExT)Rb8zA#p{%Qb(shF$1wE=8>4~FpB2+d$G(f`E*84zdKs^Am zPvT(=QWmFvcdZehK<8b8p?YN}UsZOK?k22xPbD8|zMQ!na4x`JPNYNP z;&6ufUU(1^-#+N^31_|gZuLNy>gE&cmjV`ISL3bj_EPK$SZ1F(~4P9u4go# zzt9KYaC8^pt-yCx*v{ix&%)ap$=u0(D&k3AGJQH40_X-6FrKQf32`rZbAk|Z!YKS2 zBqmI4ng|G(QIuqWe#~H@Jm~}IN?hW0UZ8!@TAM++Tqh?f=T3<{lriskuPO zVYO<#QZ}-}qDF+>mFyFjRPdKxzKkmj#7tBc+Ul!zvDom|`U!|nB(6;nv4~VV+)CL@ z!60W~4dPkSY}X}W{Ko8TMqht4To12q>o&g4VrNh{UKtl$o!151g!Q!SH3w>UDqx!- zc;u;w-}A{Q`D>Ec-H+Yc6zde+p}qlpU@06k>mWuRn7wSbeKneyivz$Os|n_B!fyp2 zl}ttpL8t?$JW>ckd5}m2@<$B@rEmsB?m1*EFvw!GGww2cV8}Gw!T+VDfsr_Ykbtdm z;NkfFU;vjlWD(*8W4 z(&!-YAd{b~^DkUL_)HfPd4eID;n>j7K_yncJOZI*+qNhB(#osr>W=qh8D@#V-+|kb zJze7`_N0tOA#UZu!2G8)Oo2@RVB;T-I2=O48P3OQ%qPA;ayw6RtnNJT=U3)X7y&C( z9)3x^-XGs&!lvg2u>#xbD?ZSK0R@PNwBVY13nn-u?(KirkM*5etrehwcUD&{$S$4x zplN!9+J1`^am?@rl47g6PSXosszOe6{!s;29sK*{HookN{8M!!R_|m0R=CJvyDPqWYNoX;hZtSGD84slI3Hmq~8@P3)!YYu% zlA5+C1c0rp-NM~WOTD*erOezJ*<71{UgeQP(`{bHj&QTtga-wtRIo==p}We>l%>Ne zFl6n;NRG|`hm06nx7p;v?;npj6%>7m0Z2_z-juUUermDM322r4ff?T=-ZEcu00PTx zgh2q9f{D>8DZ4*g6EvPZT;WIue*hDXKY?m&`H)?n5ko*3V|2#OqGcCo8W?B_B?V~c zR*nJ5fb>wM9yFTdEvC_43l@iO2?Dj?Hf~7DH>-eyWs0`-M*zF@&T#7No1uFN6k!ae zBy9W=nbS1S+okW2iKh6`mSc+NT_*z^0gxkMhB*!=$3qjKXg1knQ6{4}57Kcg<3^Gn zf7)VankM=1X>?XP8D%k@Vh*BwIwkp#2EPp<)fBB}gjeLJdDF&n`^XGNIZ}pss`28S z@^7B^G!YFC&rgEpXZFvdgLHWqF&&V5(^4(j1yax3Mb}HY)st`WRWnx0`epiV^*n60 z|4u2qMkx*977r4Ell25hu1~Ce^dZdLX9eS5I9(Cv{VjmguzA$e+-!JxpT&2@y~d49Mf9v|{ssEux9)F>JoiS5*k*wP1ZaNuzUhGzic zg+T4*gf}53EChW~W)T7yAt`3b% zJM%@BDwRp`l{!?xEUlR?W_*XknNPdN3_UhD(UdKAd}Zrd_)!~_UA{5B zGHicIc-$Jp*As>A3!0c5hK%FxgkT8W;rzq^IK%28dL$3 ze*Osa9K+)k_7Zz9jE^flwuEQaT|msvygDRy-Rc-l-MSNg^xijeX)&EVF5&$$erb}j z!tXBKUBQoKo6lR2%ZLtVvHZg*u)l~1>#ct8ld+$==J74~1dD|A1EtCDYH8qiA*gYb zz}$t7)K!Wjw7N`T1bbYM!INF;G&7PiUI5yUkG8&ptIH+m2wYR_#nv}iyn~QRpnM~W zd-BUTRYzA;L>b*FF$oBtK3!k(dU2ro6xl|y$r(%WSdQNoSp12t9$sl1OBr}LJJt?e z9|*j>sI3Fq4uu2`Qc{TweH`35VEx@z=98J?~Jb-^9LQkxpNEq31hnC zhW^EK{s)3yPy7Fx;r}H-aI*dn=fM0AzCh;x z$QRh6ab^2A-R|qA4C82&PE|yE=GF>BKj4~7XUWDjskTQDu#ADi(z+p4f>u)F!p$Df zWVhjT2F6T+Q*tvu#7_ckJmbURy5khi&qQ%dL&Wd7X(LDU^7(R=xz^9*xoD%|hJH5H zdDX<_d3u&pr@fn#`Ts2#?%K)${hK*`pZ5#o1=Rotov9x;?V>4P$nb$uW~`98>TT$x}tgqyGtTY=GYtV@(uVTgSyf-CGM9@0vHyZvMMT)}g z@T*B!kG<{k^9ugd&+MZXccXGU^m4RSx!TrtLvEB*Zv14vt|WH&HLFEDIAO}Aw}D%mhi_`LRNzT5o!=-fe(0L3E{)W&UfQ1aO{VUOGzzq?BS02^vn*2{dQy}a$& z-GviH5$Yx>4sZnv;qiA`3an~2a^{EvC`z7huC9BQX+rwS^ap{sLCUnJF4IhKx)s{% z(zpNn%}WnmkIS!?>FK~S!FFAZ{5Wjs+IbFILfA1ryOWvgYFr)gki(nz0RbgI)>Ai9Tch^4+*?B#k-eF5t-D%Gynb0S1cAMBV8 z^-^C)3moJH#(q@*agki&B!^puGu7q~BC(b(jsrwoDU~2Wj=mmMHtNFs5^@c|wL9)^ zIhM>qhSP+q1p}ocO1I;vETpE8x_({QQXs@9KtY2m*e|aE8JuIQ72l?FRd(6Nv4Jr= zA3a|X?dJI^SM`r@dOtFy+ z((OgmQ8+mv;w?Hamp*gU!&0{l3lxVW?Yx&1npVr|Iz6ie+7&ic9nz(e_9W&DY+#9X zvvfZKN8-bsC7VjWa*g{FDnD)EXh294W0{u*hpI3uQ(s~!C$IW{k=GcE(MvS&U%uF| zmp?&YG}y6n)~8v8wvsxTbi&-NnQ6*Kju!q%R%Hb9M+~?x(8^?I4%&uPg5sDRLl$53 zAzDW?Iq*s^a=@;?^|^-m5(sr)sc_B>;wt|xj8ndPxRrzfusrqEuY`4RiAj82`E}M! zSISYfO8#6F`($FpPr=XZBIb*e+1qQQ?@NTcsa z(}gqn18MadP0uS-PN5DDBDA2!IaM<MzpV-VHqzD2b=%kY}Q&dg~4ILL({PWPI};2aP${n2x$ z-9)Z?fh71ejr>Q-U976 zZ;CD`u9BJ}=gb40ztKZ#EHgZs#cJ(XaGFZ}n7tT+itMWh+N&fKPiKqbDuD)L7BO)dHL zKnFp(Z+I?Da~SV*1@03A<$EBGM%KVho~}_Bluqb?d=v=9IwkkjXkgYFR?PEiBj2WA zfT^e6ZfD~U#s{n}nTOtQ)Km>88Wqy%KnX>N(X5H`l=TcS-LR0X|DLV3>}p`9izbQgE-U8zoFu&}*jRpRTs(}X zEe0x7{wH>xk~i~e?$HYANtxlrx@<{*szktrwKTmGLBMUi`H=^o88SC=qoL8b{QSp-j)1G!bky+MCjy3gA7p^n`mkq0g zqPzyuqlGd-n4%S*rN;Z+4#bY(n?ZtnLndF0kp-)sPp!qW5_484 z^)C)2Y7R#b6n1*aVN<4Ysa1zRi4usq1QiF(AYegF(qbL%)ZI&4N@wTPJP|)X* zfCXOJdU3lBFeZ=;-UJO7FHfMx`=u9^H9y(=$wZc!Dz1K6@GLOm!ec5^c1mw>$IAJv^OyV4_aV za0(8XOhU5fm?57fVB5nle#}4~4-`h0@RmPaX^Viu@0Fgsarlt7KZz5;HGV)W2}EGS zzXvtF>chI{K9|X%eH@l!*airs&2lA$1h|acV+Os-rMLf z-M$7Is#z09lHN8G&&CT}=PaK2oj+Rfvt;Y4-)|&&GJ#)Edtj_rjEpk!$yb4B-@~7r z4oPv1o#-)YHu3A^e!=?v0Oio}3ID^7$iI!M z%#4ixBReqvgHe_FKQgN3#PiAzG9ZMy{X}Bt5Z2D(I}H5l4-7`AVULWLTx2VkTqJ4! z^u8Q2F%ZU+yMNevd&&u52Emi7HWB8y9M9NuhHglPrJu-WJ0%Mt=C254 zEqwMTaZR3o$O|;7aV&-XGIfp(mk&s@I#R36Kx!66b*6nqzb@Fee23(AOVwtMaWV64R`PA zCZR`DoCpK&X-CX*;9WJv!Cu!1JG>Npdw8FV{a<7DvrCu!DNs(;hrv6kqcH{HwD3k) zoQ(g?qOtq~^3L)fA@4aVleSp`DBBOHO~Ih-4?w1kRmaUrDU~(@wH4KnxogclIDHNG zFFnluhwZAUqPhfcxt#RZw-OW#LfdwpXf6WdWbQEOKWQ>?g=A4Y;kZ=vfl*mgu=ip5 zJVO#Al4PXg7X;RMg`en&1ad(Lnvx<%f4>jDcVg&lAHBJNGoqErQ0GVp-v}XY29D^6 z^xRq<>`Rpp)>VM|UhNota`W2RYA%1PwC?I!GEM za4*H(w{0f|RH}~Kmdogbz-ro|Hoszz5=sR`Q$z64R@LWcKOZ7c@ZvCEIs~XrnshK> zR$AneiDTqRFW}^@0 ztQ%LESNUA+TG3Df*EAV{^7*cRN^@q2o)+?}*#z4r8x!$lLzcEfN6rNH0&@^YW6B~1 zFZ>Og=-OUw`IAfUb7TFCg170>L)@;7>|+PMdeWb{OAne@z>7SzDvFuY37v*~VX4S= z(YW4CHj8qGZtZ7_OB{4UzLMt3V6yzP$`xkZjn@=@)HmEvJo$a(S+8=T@fGujgsy1i zMi!m9L?E*0;iA#4@l-lrfU;(Xq!42a9Z~zMwwYH(6Gwrn-->cH#}OZk$xrDPY2Pv& zf}KPXgk;}Q&^D^326i8XOAS?qsb+JD`}|9Ze+<@}%b z3zmNXC|Uj^fU@S-|Mj=8s_#wDtw0b01d@EBjn>v|-!EN{RCY(Vl@dTP8_Faw(HBke zljJr2q}%!vP+F2{bu96Wq1pOy`n)&yCWbp8?eE@Z;Hx8gX#40mywGCu-4lDX>Dbt> zvg!Fe_(Vc)hNbWiNm5B*jT(Dt&%ayrd?C^W_+&~}G-0?}zff!1Y~a%QJoLboDWg&U zo;Zval}fns5am~X@{s*@X+*U>)fh15vX0scEt5YjoPIS^@)cpd%4L`!qx^o=6^Fm_ zv;FP#jDWLazu#@BO*+$b)t^{8f-X8BQu?^ZW_{bh*;ZUG;YOjkkfCESzVofE;Rpj3 zKMICtEBPfb@s8L_HC|!cnVPV9jHaCWO`5uQ{3aC`WWm+$%XWpqgxEk65vDsa zpC|KeQj;;0tg_@+4`k|)*eH(GdcnY%=2_N_C1z=By@CXa?r8g&a% zDs8OXiM1G`CK#Ax%~DxMrIlDq7K*bHDVh*k&Yx%fpwjFT1kDYjrr{1fxT#$%6LEBK zbr#~*Z{9u-@&+>VV-HO@!jle{E1V3~9}M#neWTk>q)dj)Tb#U;O)d{2ZPuYCc^>FO z0dVMJrPav1?0aZPmNZpDErQ0rGw;-J19$X`J#{UtMd9(ZyIxhDuP!Owf>voFdlR8C z+M1t>$K*N&9&86-sK)beu8`jp_xSl8Dd{SWs;kj%$@CWEo&xQ z#tkBVmPapoIh|A2osp9Xc0WI?v*m0f9u{^#WFXxvNKRB7hNPHAGq}4-^KbsNc;YyK zx7$%-l*p749}!vI8b|0*SQIjz=#ePa$AOz9n6s=iEuZ0gb1|6*<%g8 zu|dK!l{eE$sn4N2f7(!KuERzq?npQifozNkclmi`1deG|m>|l?z}fKAsmp23ZZawP zTnXQYJ=K;o>~g#RF353We_lKE1B{Yr8$`#RAkVTlYJDbT+}O8M@NBv)($G0DCqrGo6_ z4e$E?0SFbAbi6~-*Bu_8JE9jtidb8{8zsd1y_DbH$4MvVV!LldF?9fviHzFmLFTfX z^A0yXOpC|O|BN89mhT~8Q;G@B0e{>&mlket5d$3mu%vx~xwH5TE4?ZFB*YsKR{Byj00It&Q|O^=b;xbU z?JPiJg4@GH@HYzpSeixHcmkY{Qpf2X`6IE)OAoY@CE(Eg5Nft!Xf6u zd%>6wWKx35N0)FM_j&IYF(=JvF3gUK!IC#r0V2H&eikDWwgj~DUAQ=$=C(%6)?G%Y z2AXCR)+tOZr9C%-2LKSr_l$p}%|j3`R$>;EP17>4TFM1a-fA>Qf?nNnMp*B+i^S=al>bh_QTfY(=j8!~XfXA8PS& zz1|t6c@x5f0X&>??=K|=YFRX+WciAs*PJv+3Qj!5QGg1V12-klIl54<8@u0KdS~Ku z4o1>NtC>3cDjY>Oih;ThZRwI{t8X7}l`3a^izR*`QXz~WBx@o`O5;^C`(cHJ6O+FD zu_BYcKt2UD^XR{Tli!)ejmL9*JR%d7`cX>#lGcp$xp2Xw=JO2#rTfn%==|*ojT$ON zjz|x0DhYq2ftOCjfN%`!LT}Azk$n3G2)PW9z#1h0iBNogV!iLxp-4!`^eK@MG(=4< zuRrQ_zQDhIK`;66HUFW}|C>u<}pYik`xFpv9h)Y`j)o**qhS2jt?Oq(fs!k#r zF;&xFI*g`corTfEF)WmTDXt@ZFXia^0RNWqZ4`z=Ii7e`td%d2AdD1&GtH4H_nw$#Xho>-Q-f~q)`g~cL=oZ#;G;8Vbzr< z^@G6K0WmDT4^Yn8W8Y8*mA2t0xP7P5QrCeWXy2j4reA& zzcZ&Z`UOMU&8tPRp$|ns5;?8=@YC0C{^x_@?4O#O8Fx1dRZq6a?{F$f}FepjOh z#&P$#)AzJ{8TmDyc@R+v<6P=b3oE9Pg^_)+8L1gm8CEokLJFoL|p67L6dXV4YnB>y) zr*>`hvW4MQl!DV`^qX{c#FtgCmVWZ(s~&dpCZwebdlkPY2hbk*X)brp10C}fpBgd# zM$uO@gd=!nGY2_JI5ci^0}1TpKDqL$v}xM8Y#5saEKmWrHyID5z)GZhJIq9Dbu*k+ z-d0y_0U)?|Vvm)(EL{|H+NBleokEEP_&Zehw=_?oKfi)1BNiCcWgw)n`pbF>p{AN^ z*)o+IP>&jcmyjffK9a70QAtUvC!WwaY-mun*U#8W9ZGlD!FY%5L_20nNh~fV4q!~t z515tmBa6YVE>l8QV93JjgVZ!tk~Zd=-wG;v5T?5-?3LRMpH@wDE0aJ3R2sZDIJ{Sc z=gIR29c!-2s*#Mmw2gEbK}rNSCqYL=tICsl@S6dxr6BFXmvV;(gB8rG^Q*fQu@eJM zsq$qvFXX$w^LRmuPhB^n@k37v3=*u;$T;P-T3X}DMH;#L_iEgFgT zlBo=mn2tBA(6LYV1}E+_Vk%Z~ZSoc%x;~#*Fd^$i(em2VKVuOoE1{Za$W&jpYyNd_PtCoOXEZJ2W|CE3}E?2`@Fmfks zkRC``)Nk`cCbutS&Jnh~8F&=B@^Uk%o0bSW!x9WQAYvC!v9IGY`uw30vMQDQ)WmA(wwNyf-T5CHpmf0PHw+(x8I{$ zd^~r7Skdi?4HfsS$vU2Go5IH%<0^z48^sm@^sD_UY7!+2zeAYml?I{l8EcowF7^QA zI~X z!&FdTx(zr4p*_K}9svD0IFTTR*kme)6J>bP%dOk~!__a_7>0eaLSGka|bF zHd`p^|tx>lKm;$@Kk z@zm|qRK}o($X^2Z((XO=Dm4FN`Y^Q9Z~l=|%URKy$VxRii(OC2OJU1Kj66~)REbbw z-Zt=?lIGi=KtIiB=0V0^v|$rOr?~C;Y&vbrtL)d%Atfp%nL~8ssjNNn5If;}vw99| znMR-oR|cZlt@D$1R-+KUv0Ho$E0_2PMY~DTrXL6^5oR1^h*S3H3JDS;2s*_<1Zx)@ zA4L(EN-$@CFf?L!*XtA0XV2>~1x>nGaz}X@QayZ6%%r_FqeI{!$?T|BUC=3)F(V|` zp&`do^gau*^ML9y7G{SH3f7XZf~JcYafBxLpvpqNlB;>uoM07h=LPs<$8Vuq%wk1F z<+hfJE-&xo3~6fA^icrj{*11Z^SM^X*XI?&66SBY*7Iglg-gf`HeeAkc0sSX5yG?c z(IBC@`pRpuIdW1LbS*!8T%4(wqTgarg%t*#|Df2@NVLX4W60e#-&!FkozG~zZWbL_ek}P zT+r+(XNIiXcn<*be~~%PojiXc!L`VGoG>Q^IS(z5%?P&SIw&YG5r1D7J}-mA1b6?gV%G3I ziSh_^a>v)ZCXueceLeMhY4nDuz>P@;x9q^D<0N^{wyY7>OJw z6jO)yiApZL5gnVA@sw6l@nK7g597|?WXc#&6H?2asV_B7)BSoHUt*6v9@O=0{MX^T z3m;SQGOhBEr>)VfYyr+bD`r86XMND;OPd0e;bYTuow`)UMyay=k`j1oL*uyV_F^>I zgp=ByVygA=XBu%yJeLBXWvNn;)L!3nSRcEU`XD`j+bCi8S5CAco)}81jyp@x3;J1Q zwF)(2IVNyTKv8rAO04@qp$=Ns?Cl41>eLg!KNP-y3lWTr?Ehck`v)O{^*<6KhSjC* z{uaL83-wzxs9%gklu|0TtOvqTAfiUwY@+$g3%bjmqVRUvyYcurgcYmT8?}nf6wmbl zoY|-ByV1Qwc?w4tyRUgEv2oYgb#Sa@=AV;N&M6$ZsZva*S7j1f<9hiZM}`9)G{Er^&v3Qfwq*cOB>^P82o#)Lugqw9I*(pORJ3v? z67DRKZ(@7oNxN#5f?GvXLxKZqU|u;w1U5A>_CikvC-zdmFeEO9 z(D0qo7Skd04l3EHWC>^pSfUT-mxXr<__k4@S}HA6%PM;;M)z3Ii5xOJ1@#LBIDU4vudo*;u+OaiT#4T1% zTPli1GYAwhW+@ruJB4{syqba8GfT&obMub?cCgb3{nbXDsx(zi@@-zqm+PPmsc{8L zMp@F$%0Ny0t4ZZGbYM(E?$04*iHMYsWku;9Au#1bWopMWfa1Uv$N|9o<*^#F3TPIe z?{d(Log;DSEj0d=?U#35Y<72U<~yEwN=#=Y#3$Ovnnk_TND~V2C$`(daPgptl0=&t zbxzEtZya<7N>kn923O%T8ww&IilGx{ZJ8iw;y7uyK!fz#OZc#L=BT+rwddC<)*Cp~ zM+`!I4@1zIemISz1__Yl^=!dHcLTUKIc&LprP2NP;sw%&)BjXae3BP&-03o1e5w3- zsg!>x^y*zGlCMG#5<>5~=|mO%Gm=ZE3j!>_mdNLW2NT5!Z~TRDDO)R86!TS4q)JXg z05H0LxyjygA2S}p*8~W0$j&0W{mhJ;-_3nv02hqa zO9pi!+$0ZpI0*)#5aF(x3i*k?UWSD&{rtcwB#ZvNK!B#Pf$a-e=MTb@`lFd-FUIlk z#zbOB1}ja5td8!H@p9H`o91oDlD2&++A|q&hpqo12l#W12$6$pGpF0HvJIS@&(LYx z7jPvKym1B&&feF-V7il?3~qWLEUL6n`qNq(6-6X4aHp z>!D)IRUx{YH@5CeW1BcHJfic)ZTbyl?*dYx%`7g!_Q)ER{pAb!=8$zS*R&~Jq628B z>h%&R1t8!DHbp)umz>0)UkE!{fq#i~9qU)>pSErssb;4FW}gWRJOY7aG*O#q#k@oU zte$zh5FalPwt9}%rf-m8`<>$T9_f||f}zTr+>vY0dLb}+T>+p=nFMz@2)r}~4q;B_ zqv#Nm-`WXoG^Opgj4jaF^u>~NI!$J)H3Fy`VNmeEl(r4YbiK0wpu1;5xP@C zo}ITgjQZ8gcZIcdPp)aME+%NJ;At`8a#4agD_TW{TU5%tLgCxadtHOjM5bD{QBUl^ znZ0l_tH{@${+#_0eK&P;urj4gqFikGe(i}g{w44aV`p7*+5CGi$o2A4HUCgO|E(c1 zGO_$m-Z0xgh=^?ek%+kccWvNiJ7({y@?PyybOVuyXxy zj06>t$?DCV`nuaCygvYZp?9VYy{q?r@X$WL_pV>z?;;Fjl&rjKH(feI=dRaYf@jKe z-(ynGF5T*>N|)Z({UiqZ6?W*h2m-+b38ZE^bVZ*w?H{PHKCTc#H|T8pmsAp@(d?q9FQRv>yE^H|2VHej&IC%+LM^mSP`A9BD7M|g-zLk9n;D{I ziHbm*#%)(ALY$IYRziEcYFjiKq&RT$bCD&c>uF~?E2baS+qylpm9mQ4g-=Su9Hx>; zJsuzXU-xF0eKiY=lmk`rHqgC# zsHtKa8^KgJYQ#R?0i>ZW;!w>vLZG=(iQIQR{JG$NNozhc_g%W1_40jOGM4fqi*0gcGEig>=!>rqM(+$X}Ray zo3(+EtWyh7Qq@?4h!hO4m zqlVFg$*ZNIp(aAs9;OzpK~-J2(w(KrUS6ryJS~jmeb{JgqFk zZTHy#0XZ3-VPCFnq;{sMwY&;?Y01BF#2l&%Wta)Aao1>?ak-~l;A7#My>tuJ1Tefu zXm#QQU`Q`!x)jwCuXnuVIX2i{Nq2{;h~)GNl1ezEDewn{G1Leb1GQ~S33Hnm2~Wb{_I&@wIz>o2;Z-c$s)LXD zjKrYPWE>49rv9lS3YM zuE$fq=N<6!`Zceg!)0-Z{mqN_Up8~(Jx%G>t;64rM8u;cs*%rh^FM3}5L4PFUDWYF zI-Uo$+DDlj;S~6{7d;(ABJIxr@$CX0IxPq_FwBh;=PaxUf3Dunrf+{?9gUBHPW%)> zfVq4<+3U6hy8p-kZkZUK)Sels4Fpzjj~x!EXjGKBO};jCfkzGul+BdVb9i?R&83;~)psKgb0=xJ@?=!aW&h#kHh~>SOm2 z#(c~j5hX>%@bS2WW#9}YuPftRtq zvq_aAEFmQ<#IJQey#qd>vaBUJp&`}sGj9eU5EN0<%2H*R`XqtaKn$4UR*JbOu~AU~ zrN2DA|24PKU<{v#deto-_@tP9oSXq|a%2k0CV-r=#CKV9)sEN*!(&ot*!>V zQmXKs1XI+9_TaUPyN28+$!ugY;ZUQ(Wncd{kEY@g?gfx}5>nPvTJ365!4FpB^(o9m>slkGT*tw+*nD~k>Q?@vL+9pxbb z{3g&~(>2Rt&MlSfd+tRe=GrD{kzAG}mGQtIEb~u9s$?TzBvV!WU11IU$Gm>2P$QO< zgq=-IP#xhfNBmr&}gdMTsdV4vF<{DKe6ra&O7XHX+D3}l4N+U8+t z%1Cf^U5T8a$udwqXk62FXaqY@WR+{*7bNEzhX56heY%HIR`{QwcWT@#cl7rfQIjrx&1<~__rg>TiIq|6i^$&*;XO2tT%9#E?-B2{`HYEf~Sft*s zU()Dkqz2pjLxo*|q4Ww@`tSQo14PavJ_v!9`@v>PcJF zjQNdu?vEX9xIltZ8|=9{a3DC}_mlEB0RD6=WMpg$kj8Cf&G>uYKD>J#a|-DbB(GON zO%o~DEwcWmlR10A1_y!c3&C~m`0TgtT=hu2JTpvyi9Jv*3qR3Nj4T1O#RJ;2jFXVL zpV!$8w>Qi>d%;Nel5)4{VHL6mrEK(jBJAPkBlV`wdvu(mNVb*YtlTa>iKG=M#c9ph z13VMxpt3%B>7BGjodTHg#g?9zFgoQje(;^%P+-{p^Gl3=FrEH0@^i=Demufxfj;eC zbQ&W=05Y1Bxk!hSx+F^DcxXqe9fqcWOQ5RC&AtH@EH$Ei2-MVFlw^V3DHmch4G|eL zq#imm1qO2#rFrAbYa|72qybdbo6OUElqQaj*XV;~+-FAH%^S}Fy`Izg_(Q&>lP;?6swPZ2$ffE6MYxGo-it1BrL3k2GAIq!V)?LjRnf%Go-zo&w`@ zJOE?}wp?_b!}`c|X8*~L#vg$wAL#qAY;%s9(LN8OcyoWss`h{>?tPd(=(mjLYZ=WS z?IwDmHhZUX=?fy}Q=y;vu4&{FPR3nKZ=W|uXuvKpq7M0-9ToKQ4?5$aOg5|1Vu`?! zP{l(F2g_bd_f?bSaS3L?{JY1`?5oCw(G>-T$|~uXO_GMHjz2_U-^p%Uq;oKxNGT#}0-BXgBJ31va~**8eY1Xm`nTIr|9h_d*R=RApAsu8(|J~@e#wmEU<348Pw_vl{XOh=9*$ z&@OTnI13-@uV^j3z>rBDiKl&Tb9 zBV?HHwa@Qsx2l|EOvW0U1*k~N(UEw??ioX~6tT(8L_>*ojhCQjUg)os^7gz;Rw|te z@_F`r~W%YKyZn{-=!i~6K zg{^b(^gAv*7vXiburoI^vv}5)J?CTpk}WFh8(V|ZI7wG*r5#>ih;!n7{LtB6dPShU%>&62F5sNjqoe4BSD;6kphG~#Oqx(?SB!$M9c3* zbh$(Lvl~Tf%EYAl(qvW^9dRET2qYoBP`t>ntC zml3KN;2x2n0klX)Ncj!nC*DDR!#^BlUGuOANTkCvG82*=LO?!kPP4pi8M7p}l#ok# z-#6Y~Xz|PIr_7c7q+fb(sXV_qvZ~7H?wiVf51&UxT`)f&kunlDARHNbov5-mMfn{f z@T9$Gmqqj;qfau|WwWcFSC#!PdA?dhFL+Ch9D*N+*S?(Xj?;a05Zk#juD~mkJbGyN zqnU%>@?Jx?=_RvkYMf*{FWAgwj9g9pZn<%ua9_xqHMgWuh$R1FQGuToghRD{m?+kc4b#AW`j=F^EIzQ)oBedYevI)Tj{(DvXEWuX^CMKi zy_3BZO)*eh>QdC?D-;eLZ z>u+J!YrK*Raj_S>iM)Ez)9wFVO{(swoKjW#^GI9K)u=+RN;=+Lw-QYa8W+sgJbB(a z)+MW!)Z(c$#CMFQ7?x9Q7g<^mve;+YRa<3SG7ni@LK)TLBOJM~ClEBf8lr52bzV-458&x^ z(o<(!@Z9Yn3#!vG*Wny6{5}`NTkWB>bV$2bs zA|=Mu-yxa@#s`f9fRSXY*id^9nJ&~9i}4+oF0|Kv{Ka({?yJ;?I?Xr>)g;Ofn<)gs zol64GA7boP;NEi4MmoflfDKaUMw-qI>zNlq`){t0xX>^0dzTd!QKw64biTs^S`Skz zE&+t+3~W$#(QQLpS^;8a1({6y{c%SqzG#$U3NA~{S@)Qc-8$%c0l<@#bw#Mexzl|` zpme}9hcp&p+wwpw{lm@cjUdZy$Isfn-9h3H&nex2mQuvU?1BDlF%@2J_P+!^bQ*xL zZVD|@lKZkL@r9(CQ0?HEEFZ5y^qT_`2M*87Tw9jfHQ5T1LXiFx9M(wsz8|<4XxgDt zk@CVLU^7GBh&M-aoK#gAj@%V?J!4VjFChHkCqchOcpzrE`LX`+^)HTkIzztnG*lNW zUvOokR@7H*d0HrykyLB?u#P9^kPiPcT%)QX!INTO<{R1*qRA-(ouIYf$JEInUpb~SXf4&4Da~3P1RLlfo`fBOM)gfqwiy_;YamMi{qC1s^ zu?I}FQbe_uH5qDT*V$S%%l#LdYJbVgq>0H~2u=mf@h$vat(smID`nDA548b{Ax(j0 zu4m#@Ei@*ZU=bD{^M<%RWl=rSSdW-PqI14DH1?qc852rllC(OU(kyJMk^$1l22u0- zcXEyPvSx1g^;zFFRdMJqJTEWuKS&TPigJCW3f)GZ?0y_R~Ru3UO$*%`K@~**9P!gZjn7xlwS&M|2l()zzfc(?CM{ z2I|q!y19vu%Q>@XStc;kIN~zt*%zZJdqO33p8vzxJGBcIu1U7bW-i;dZQHhU*|u%l zwr$(CZM(DTJbmh-_eK4R8Q*+k#4wF$t-(BBDv-z+p85m8J8yxUgcjmTYXpCRJTn-N zChGEJmo-$=lE2i@td`!v>xl8@LWZGK0kH{HlM_^Z)t`e}a^MESC-|VRgnoAViB1i& zv4u$gx9Ok#8jb(fDX)h6o(#jms-%J12e^F|zRof&QjfUf>QecYrgD=Y48 z9HGr0HkMG|Qk)_rM8k-#+qZ^9RenJ&n)wnArt8YJlKtU@1Q74!p<~kuj?-s~>zT1b z74mtAV*1f=%%LwX+g|f;l8}tdv+L$-%Nkt}~vN zrayz-h(J-vdHRHZWnFRA+olZl=7TU?RLg}951BTF_Z^}^6!lI{qZx##aM|%(@3mKQ+pF2V>yo)k2&(dj$0Y4xgQ3OIPH{hEYfyRT8+X0 zc4`&4&&tDaGpz-(0Xs3waDflfdXl(BG&E2BPg>g1C^*9$?m6E8E~GQQ!Ud2u z5!m}ez!FU*$k_3SP?NrxKyQYS^zWu1&W#MN{_->NxZ8V+*ZfVJ#*e!xZZ_?4PK}2F z?bzoQhJbT<+II`9?f8f({9-e1unj?a-$$#C(pe>a>EcEH@NQGxlac*iQ117TIFWuFsSGohS?fss8qvN7a#w~9vSy*7mktut?=l+@2|Vo z+$zh+)z;Z;rW*D2<6_S?#F`4p@&r%Liv`QhhNR5lQj8aRdZCN)!E$=q`q);FORZ<5 z!c#ofo~+f1aDTYPBu^9Xq72bV6V)2xe92%(7hJLX>LO^k^|OL)(|2G$rYna^H=_^v zt){=mI|lODK3{E{imnsRE>R?{w2z{rON0DUUR+@Pk&@Bb{N4$gy1z)A+aGM!@1EZt zaqyzFKlDU)l%i2~=hl%Oy9UBXD$fNsd6cESzzb*KQ+gh@&9Iw+O8!Fx8Uy)j-nfZ} zx$>vl)w_c_1D^sYh3jt!mYK039AHm>@ib#?@`Lc;`TU9|kf zahd*hEVtWbY7A_Z5N)^({@{=NR0U0IjE!;M%qssHfz_jp$vf-ozy;$3t^J!a zJ3T!T>Pgv*qPJ>CuX>|2ARJL6oDRmYgz`GM z0{-wPT}3J3aK6A;JNR#ZzuW@%#QQP+*^~R6Vomg;Cfg;Q>LR%&+KgLm43AZ8w0gKS z3&%5cMd}Pg91lkhm|{h$?aH0`36bHaEjCCa1tK<$3|D)5rt$fBcHF2=Q5JroLV|=X z2%Ews-HArqmL4Cirj^ekVSqKELPhugq=R=)tR4ebxmv;uhNC%zNg=sz$Yq|;G~{Di z@p%>LGbazj8*#a`PD~Y%(T!)(s}SWY6XVk=@0huqA2DChFiI(7DbJ*&OECf^KVz~H z#%lI5OuaP7?E3qZ1esBy?IEQj^PBO_u+J>$YUI@dJ@Y_;MiCaQYY+@WNS)6B?Pi%p znSx2UktCc2YHr-@TK2)6j7)t!)tS-#4ie7@(S`Zm??G3C6L*8v{oGo)vo*>&yR=a& zBOERBi&!6D;oRf{@ zfup98*r|dDxN`0DIzbV1LsIi70BC&sU=N~zuK1H{r9th`S@pP#mpLjZke`;rBv1D; z9U(|LmoWm_Ne?6Cyut59b@@(8cM^65nbH5(==ob1OE1=?C%Xap zG0DBN!bTQgTpe)5S2&PA#QJ*{dYk*nfV{GnEM}0fwvl6LOLq2g7|D-;vYr0Xr06ip z*krz}%da<_(yDWKoERO&KDBMlb-y?d+tt4+gaWa&e9;s1R2jsf_I02VKOqJ*zdp}) zphPw;>Tg2CPJLQ7BqH~A(Nt2`3#~)buge7D3i-2(yy%hZ@(dIV-4x}6c?Jk8vdJ>c z_te2}V91IJGjj`wGrb(0!)b2SeQVw2WPtlrq2=vX1z~Pk5nkr z#Rrayf?hTNj7aV^cuX==&3slm>7Bxk*~#e=YW&od&gsV|bF0C`2{sFVOh zk%7ffl>k=ZIGPv+=;g9%3sGSf>8bo;6*f_-0&ahsHJ|Rku4%n9ks^3OHe`B&fW zKGUihP1xy96AXiRsvKE$n5R@Hl8>)|3E;ZNZeF7FvZZrV?-Cm5T~nXx`!LBACVV6nkKj=G@0O1xV!*+vgYpZ_nP?DSb6zOGI}@J@}C&~PC0 zJuVx)B{{BBv@}pOjESUrq^C8Njv0R`vjS_A{^aLN3K*DbqFHBi#h8wUbsw4=wo8&L zn$ySRVz)3_`Ub8wVHZ|$?F2!QKaKBaex@kArZ-7)&mziIiI(bhOeTKOx5|8`Z2ls% zf?vBlw5R-=GEi?>y^hWF3(6dkksYi}p#wL^SL2q-3tn8Hkc)!tgK6(+jY__OvWcDy zQ(#W~UE3w3;+htNHA=dn;Ldd>^;wY4$t|E<2?!R~P>sjXf@3zB#T75MV3FH~_g`Gb zD}ib!Rn^Eqz`j4^%B~5p;J@#S3`ui|g?Q0`+k4u-3JCcM3@h2KF&zXHcw2QMLxvJa z=O8WDHl^@ZzQcP#hy)K@4e$E52KpwR6&}1no+N_@5Hh|RAmeDTCY?2-{38soU^a(A z_h;25AOKqPLW%&Vs{L76b}sDHr%r9IJk}z)c#T*VnhRy8uKeN&E-!=^Yku*b{5$Ib zOx!4*g|vQPsV>~Ra_+{36)SyGQFXlN-9X%N4VRB@FPpKjp)|&+m#T;%J=y6o46Z2w zAJ}lTTkUXj6`gC?NkFOS5&QDxxeio&LV#_qU~ZSP9iPs)3-~4b$aN6~aiTlJmJcLa z=h1}N*#+3VB-#LRIr<~_Y>nf&caL;<%R!X?;UoV4_nFu^{s*jP`wx94w*OV1>H5D6 zz-@^C48VPv<&@A;+HQ}T-I))Z$J3ma*F8~6jpz|X3?<^}MW&MPV5dr7v74}d_~Pax zhuKAx@D!UYtbhj#-XBlrC4BL5jDHU3KACoPf{Y#S&jZd&hknLfkCrbC!y8rKhh2M# z+3Pym>FF2}>=MK!R68T{+I6aaAS3&_qM+i7|Cm;-pb2ze)!3hP>NV_N2ThDcF{Urj zM~q$E5WXP@Gldg`I18?I-Nl*@RfNxOgf<32pm4CVb z@=i7||E;L_i}tJjz04&F;v&`9uc>?s3QsPzU!pJm{nkSFvJwmy&3t5a(+7jsU=K73 z`A>#nSGn=L4K$NMDuG(o(l#J7CW;p;Vz;+1tq-~j6s0gOXajzmgcC``g+4rpUpjzI z$j%uh{04F&!Yuo)5hgxzn)-&R8Z{3h{1;p9e&0WAD>RuJ1pdp`@Ho=t3z=R*5OlHu zQeSwgyypV|{mDfI?VI@~Fcpc>AybPkgbdd>DHIqUVVZm-QlgAVXNcLcwSaDv<*UoBW`I1d6UAGNI$UjOxnSg$+P1`BQ+cooyc(deN=H_($)7Rd zhw~$p3}CmT;rnn>I!IN{+`R%T>HOIJnn!opyLp5FG5AwX(M5WXv|d7FI=O>d^~u~) z(oXa}qU)1%9%L;j|bII8`KAWmC%8YRoWxCrXvMOrhUPxbt3c*G(WMn@oY|? z@mUNYcXk=CYSTm^4J@&ziw;VdH4WqgZM>_mUeFhEDN=oKUxt}=_qsubU5C(@q=_It zlxqNjy%dTKA+Lh@nZibgn0z-oyVxtB-I!P8CjJlKu3wI>$6w@~@9Dad`+U5z=Z+y* z73bq?Bc(;*Oc;Lmd3RPL29RhR06+k>E~+Il1OPS>ttEHBcX!$e{4CLA$CYs@(*9|m zk-hN6p-#c&w6Rb>jGArpL{|&&wu>>DMGGUj*AoJ_bd5^T9d82QJ=C9Q0q0JOsG6@e zaghOS$~{t6{mXlN@F4)GMAc)w@Crywck>6UpazK<;s|@c>EMhYT$Swah);fj4p2|J zG#?g7Rs=wrdXoceD{epowzVFb)&m*&?g*^Wee0AtVnpnN*zw@9?!r+wIvLG9!$K_MV%< zLv?}}*2sz&(2-7k3a!>~C=HMZv~$N}HeohF{H5Lha8xOhyN)c5b>M%O3#=w@@DgrF z1^w!!f4DRPSqQumL7<_|0AC)tkp#9M@hbTtbL9I}=G&A>xjBLeq$8y0NJ-4yfV+-Y zO{5LPelf(p_&T>097o_kuFdtmHBb}#i(VFA4wPUzH&hVO#jTjp*R?+KF3<=8ZVyoZ z5($Z@b>a1BDx5DC!0--210gVb_dR0n7?&3{8eaYlE}&{9%M9TP>KG#1`mSA;(0x|N z_rhx(UoKHv?#S)nKW98@)lr8z<=9R~D`oj=ld;1Pmf#IG4B`INa%(6@)yDKm=;8~)*U1)Z!95_7(lsu8# zjzExhH={&?Rq`Qm;gS-&T0$E=y=Ncf__G__*c#!K=_y16P_gbR6+)>hAXb`#6}pTk ze*a;SJ@sF1%zLVZw|SmfNG?Hy5?+p%&<@&)%Gi!yAQTsQ?AgVFp%Eq4yYa|{Y*?+p zeQ|ge;Xg|(9jT4=qm7aF=jM@h zxWpZoKPcX2iX8%HT1xh7YCB(hnA4#hUm&2{b;K(;?v1M`ISx76mAcm|@J}CCJ}%qk zU)9F8p)%IyoTbwE65mys6HZFdm;^HQ9E*D`qE4ux`J|5;@ z{esuai?5EYbi;x9NjFuU5vS( zH9ItIm+-HR-Hdt6ymst1rdQRIw*+y&V71n@nZW2E3jQ)c)=^k{@;DaMkOHh7Unb?; z+2k>EKCg8mv}3h6b72iQ4vy`iN*oT8Dr!feEm=-^JU_C1g)!f_@Lcj@_*z0I#ZUP} z2f%WtF(r&qr*`@A0FotBttY^$zzQWFy2n~tVzck}LU*5p@%^`hS7vu~cd=suW_YLo z3`m38Vs(N@d_q+na_#cu8zo!W>i~b5j+(o@8YBGmR?#nZ>{gxnyvY#l+ol%|tNEIO%oVbv!n+ z+fHEyPJXu_U`)bRa*LK#$fJ4{>7?>RfW=e;rVuQ1T;%5qH^b3D>X0%*m~dEo2l3D0 zg};A%>-&Hownze8NvIv7e7T+(t_T~gvZ{>n6kN7bN?CBybD$ z`T)LruCe$JG4}r!OBq>N|0l+>|A%5J`~Rv~daXI>ur-3R{Yd43CLI9`yzOQ|#wANh zvFSi9sv%E-#=dxjKLCK>M=<#B;w$o-=J**5X8I(4Wg=-3dBEIZyF1EpsypS08q5%R z7W?k$+7+=jxcphE{+*KE>mv5@JiVNvx_wpC^FdJxZ*x=oB*ZYuF_{>&ja?gXWAFGV zXBFUVLN2U9tZv`f3$=0WCWhzztYn@$Gf2FgJ0gMjZ>H2HrzW6P;KOB5_qn0?*gig( zkZqE%dGG#NiRT*b>a&7J1(t@hHEPtYiaz!`R@7YTY1H0|cbAkKN@SpgP|337RCnPI zZpj8vtAc-G!J5^x;S+UOW5dx&pn2IQc((u|$&N`OY1)TUDu#E7Xw2wG& zN9~+)9B1Z_T zTsU+q=X$M_fy#(8GpvBRHw_YtdrZ7GLqaU$r5Ep0v!;jW&51uHIU@!6SYj^REK1vK z6)F2WWy+;jaLeo~hsAbrm$O*`zj$|>eEX;n5y2$14fKCdp>im7Xxx>{=7tP1L{Q;! zLODzsa3^&79W~(+orHJ5TIM)poA-9A)FWZnA zKm`MX^H@(H0HmXot+-zKoW-E}z>IMT9Wn}#gh`Rx&h)@;z(cGtTLD~|gwte#m6tWn z=@Lv2C?~PNTHIt)mRHIh!yL| zd_{H8PuU)R&Srx7Rf((8U4E3eb`Lb)dYV4p?>`EXP;r1y zfHEZiZKI=1;B1Q?2nI>d7$AZksytKHOSiXSAaLvH#Fw-Ime5L|`26q@3Xj$a^yENr z`KMVq75IKtf&lDO+0lGr5^Ovt$w zL>QS<<7;w8*cAOjWGsM?CGH^4oy~I7mVmhGdzj9A+I{gwE#s@$$F?oJryqF zJ7I`GZgL$k<0_82T00F)BU_KLnw^OT{f38EJhICUl!2Q<%}ui$^F@5nB!7@{IGqS-V#91$Qk72x|J!(ZGi4bkZO^~2H+fYe4ZKXEhYqZCajME zfP-Cf5M!-dS z2L_!hp{c{0Jv5lO_!*b>ZdP22*xRt}(PXmcaE7Yo!#^?ue-V^6K{cWcUwers36|SF z4@K5XCt(gTeOZRj#V1#OL^cX;aaM0tvZ~6WIcOluk!XHNWY}XhTN7oiv|~P-gO2I% z%X%R)SFcvklLI(V02Kh;wzyy9R_wLw$0#A}+aL^s1mHc|x>nrLizwjOq;XI9^459! z0ocCmO`c7Lt5_yqEhFsoegLnv0^E{n6;mF7eEw`}+@ccxsLCDST)ozVA;|*&jR-P| z?5M?`A|~GwCN)e}q^7Na@AiVwqe+DaM?qfMhSdaK${`G~b8FofN7Eu^2fMU*R8@PK z)J~xbmYprHPa>suq(bZm_V)+*c$F_f&m#rWf^!lBO>{rTFet<|z(tkB4}7v}2uS^O z#r@9m`C>dGzQr+ff+Ugra&XIz(3YRp8w`ooZp8-J4?Z+f$|g;w=S;jb3nnK|e`iqp zS|BZubr-?@X7D;fX~xl+&}Lz=&V>7eRw+EFS8#rDtNFvgm?g?+Ny+Ph2k17VZYsSD z6LtLYB@*j+J$e@f*<4oDO^ZJh8SQH@4mq9c87rQnix32hQ8?q0JQSQ%K>B2wh3#NA z*1ol!gFxM(!b%N*qoVeh;A4NN+9r<<8EqI21|-#p3z$V1v+2^rAN)!6zS-WAE zK*H2BO46zDBOMc>SRK$t^tJiF+rxJ^VKvvC854!0b)fnaPtzYeLah-jWNXXd zmR>BV?9)yRlI}<@fk}mZ{NKBA0bVDwc$c}L=shz$XcW!wL?}`tjF&HBlC&gP;SsBb zMAFgj8Qs~1gFFlC(EA5lO7UvHIG2b``s&dYaLBnG!%u8FUEMygrD=}tI_=6aqHK&BB zIDDl~8Ewpcb%8LfQM?(oP+2nOA%C_R!=5o5Qlb&%lw8dX!4{~_q!4ws3)DJYD-Mg! z1C^1*>I%S69W+uudh99tKp&kOiI-Wu==u0lofb9`m<|1BC<0%Qbq5==YT76y{vSM zGjV5XE>k#zi_%={VM95imb=eChA7+r6gj2nOwquDi3iliNDWx!tW(F{yP)k?{d3-9 zoki;5$^ti+SGQ-RzbV$%XZf^oc{&~l>`WTWotexoQ|puVffNo`D6CbOj)mx_eUg`H z8SQ)~Vk3^`%9QANVWhkV;dH4pV|%4kOCI-Ck!f@UiA^kc-rz&pdYR!;V zb6tr&qJ|15u=Ui@;l3n<)Q#a`nyoB0XHd`i`A3)b*dE0{1=0RGw>2oTV1U_1r+M!a zbd2X$Pv?{Tj#dcW?F6Nrr)`L_b$^&Kf{Oyhf|*+s`rSN*GF*^Q9ru4K$qd)Qv`d2P z>W1Ck;Je-~RoM3UR`1{*w8#xjC9XQY;&>N8819b8m(*m43{tCU`#gHe518jw2qm$A z3u{z8+-96>lKgt4Yv7nuZd~83vFDa8CJqJ?I-VsTe+ha}mO6REcR~P#`*|>?hGcW9 zYIVl4A+lmV0QWfs2%02&20z#p$Y&bFloONm-WKKmCVNcjaOzg62o#dCRnE7w$3}eA zgtD&G-h9=}^94F3Ue?oggF$V;)9l^V@dd6EOKwND2mVa-s~$-}&}MC>KSs$4l~o-O zVaRw7oicGA4%EwLtwBcE=qOt&Ku|S-C>va4vvMW8vDzyIf_p%Fo{dQSdf9&X!yNVa zplN9|5y`gPDs6q;Hz!rNJJ4;ca3dVfYjF8SfK`0=tkB;u1^7CXTS9Z=o#NyS4(mV7WK-9Lst9jDXoIX9sTKS1L2BGJ76ivJ$zQXYcgv3#59ITj)(y0eK{S9nSp)V21&H_xtS0V;O3|du#iN4m-QgYFLWrokGFl2BS-Q`I+Cx30^##a(7!u6HY+71kP>4xcnn+)ExwjTG-G5K7E% z`Spi=cgD>WMokgK?N+T0K5CT~K7DaQ+pP}Dw$GN+wcUJfpj`j4NahCY3zHg8oIuXCQJ`g3R}Yf&5wMAG1q1zx^(rr3BHE@ zQvz7WV?0!%W4)mjwPWSX^p}}GOV%Dlb|`>nkv_tN(aNf(74x%fl7fgD9gw)}==VSd zsT(48&))8~jTznx#zLDE9PM)ToC|vn6IDO_8N)k-E4E)CS`i% z<1atI&1K@$A9b)6bi5aj4p`z2={_!!%<)5S;4Swj?~vjsS#CgDmeRO&h5GB0dT{Nwq`)Yqe2BIV?qiH#PPIKTR0HUWfbZN#A_1<*#>OZ_6_us2<<6>MX{HQ_F>{#3UifJHcdwe{YtW?$w zizPwfLHSPB5?0PxVEmyK%Ih3FWXmkZHU~xTi%jO>{f|Jbw*&juI+!mW?d^a^)xd$n zJeKT$k>YLxtuU(;U3&|#0IMC)+~P{ATdkw@fgP!=5O?Ew5M6k7R{aKFz}gKMy6U;n zuW&ZW(OJx)Q3mHP6uMx-^H7JU<_YdafO#f&M(Nm1HiG+gWu_pM;&m8d1K|kK9{_}( zsE8Q3v}NBl1czKn6VL`}WOuKF5>w$5@J~g*l|iE=JQ}3~7faLgE8)Ew4QI3r1r26! z7Y5MIw@GOFX!7J50+yNg-i?|hJu8EEe?^qkOAvTU3pf%W>H~#U7*%ppPmDq!3whC< zA75O z;|tSLQ^_|K_BG?1@;!@n@@;*cOqOa*{)B=(q*WC^HdFd^t*G4FFLfKttJ%sQ!W9tc zENDoQd~0|;OS1!J>`@zUnbr-AEJ}l-lg5YELd|jAK8^t;HXqIoqxnp8GWgEPZ-Q)L z?Z)^?m>xqP}=+DnZdLAz!j zv7J^`X&jUm+$_({B*-0enGliQOj>usU8Umn)RV}ftc2+j;pAdvcp}k8n8JT$^sI8Z@EFwc!W8hiXMtMh6C;o#L7%k z%x;yR(HbL$;RgK?VaIDYzLa&V+KOoh^}Jhjh;2-^pNoxKvA+Z;Dla4%`iH0!uey9RkmqRC6 zW%Cx}!;Z0ohA*=6fYW=yr$41`&^hEyX520iEwFp zns+l)Sz%G&8FBWnkh1n`D;oiEuAo;7a^MOAdKb>-(r5`BmS zhu@xYM?K=>kGtaFcx#(1Isz09iN%2RkWunpvu9kCaEq<7ATt-%D&q_HO0sU%5CY|$ z1HZPI4Ud|^^71Gn|8}@g36#a7a?(-RzP!nD0(Oo;c#RDi) z%P-xkTmWZFt(tZoXwoJp%$gEU778RgGG`}m!T^lEkSa2Z3KCN?Dr{UDmbB^4Nh_vc zR2xY>SoSOb^lC@cOJ=2^USbxAs5w`6h9`^iaQpcyrSn-WJ4d6DtD?xp((ri*f9 zMiu)6Ui0URGEDIn?d$;X6@DuhAujURSboVY)dc!^8whwPp26`Jpn4Is0@o;<>UBsJQTSiE!ERGvs^V{ zqnm`cpt-m`eAaUdgR_M}5}a|oP?zwG#m&WvQkV(=Dn)C`cz7cG^0R3$?8kxjk?0dq zH1t*_=FQOXSnhUocGBck1O|AXypcy+i!E`V>cb26bfpN$cVAi|P1N7+4*;jcyspylpXmXg9(#}m^mrg7Yu zu~S>1U2po?=kyS0-q+u0Qh}IPl0<$z6yPSzzKuM40+cJ$V+JC>IfM&y0H~@1A5`Cz zsZ!SEx+wWs`ie7KM)ih-__4cg8hFz_+$W92T72$pW2(Huj;L1-Iosm`jgJ$#1}720 zwo6|)`NEczTP-%o$8`UBs?C@5Nu)Pd*ELRZCCdElC|88xHoym-Y(UkDk0>RoM3D01 zr}9JP^^+uC{AE~vp&dBO%C=4y&xDR8=}IP%_);5-VhZGHaTL?v3HWB4{1k0Dq~j4C zGn%qLFC~Qg$_#4b9jxC$2HrE?)gI_qfL7m(Yk?u*<8JekNs$1`%y%!b+YrlpDv>EC zYW#JmZeBC3AQ3P`j;ZWOyQJ9%A2v*)m)ifRMU(nsRBYJbfy<=m=J_9C+LO<1Q?ENl zaIYcr634B%mx{KKMf1VeO`4DMWj!z|tf|^N{@QBRbD-g$3kzu?-^Hf1Q`No=to=Q7 z4TsjI--u38dbSo=5YuqdmkFqie-KIon%fw)AsN=X-@y*D7e33l7aDThbP3L4|?;zj56DP!( z|9^PR{a=)liJ9qtCiL0=153&AzhWtuHFRRPT2Q=q^#njbt7u%%<3CvEz`-S;(OeQY zkY4*~p{hf;3Qa{b#51<1eDCz`eXrVyMJ$*bcb3kDpn&U{3da6h0jS8=827K4gZJs$ z+zGY*adAqO|4#u}YcblRp-c03xuN6ZLq-%n#Z~Quq@QuTf!%a+TV-xXkM1{GrmkjB zLHUS5m0C?rpz+N1e16q7;{G~nG~Au?AS+a2AO&8nKNSDnZn|f;G9)FE`&hv=HQ1y7 zdo$FdjP=U-zYKu?PHWOoT`8NZJ#*wn;qKHy-aTO^V})rn1iPb(&Uu06Z>|P839zBOO8?%x>c?bcNTCOn}wlDZ!VCuG~_J|jPPUB@Z z?Y1hFn1L+Y#S}c*d_RxwRcj15r+BxCQn;lIsx*d9-BK8`BuW|3yWM82GRTE~Ehe%v z0vs@-!zRxli@5S$g+jOfiktSa_^${ux)u8HE@f-pFJ`#33?!$kW5?ab#HJC3=^6iEDCv(|tJSVt zEW+9OO@5neJ_MAeqoV;+QL&W4k*ir18l{bJC(XMJ1+o%PIOZJpggmk@!|ge1r3ZBw z1ZK>&4|0isL`8Xt6~Cm3fudMfHoi{~<93A^Nx9{KCLu z=`LgjJz^e2^AGJ-xVXFj=HjFWf?)0<)b*RFwzjq9xw-2D#N{R<7rq6y?$~efUR4a< zU8O=d2%8v!ojoaWcma~1TgoD{zmsa;v_*M0t{2pAQJoc{gx-ff91o+F4l(H;Tx-7? zxN3FXip%TD`h`#INYsWn?FD>u8Maw=9MSu+Td3xS6+ZLKlW@JmlYNOCt=f6bz4^3Q zQ=A0YE)TIU@d31>$RWR#d#(Tn^<%o3oqH(#2CM9Qx5vcx9Ma(Kz2+@9K-xJYI}tPY zMQ)tX`OAbYKZbQ-M*UX5<_f;FT!QVN--rQ? zE2nQe)uRRxO$Q5!xQ8jqUJadDgt%Nn$pz}#Tx$jzwO}6dLA0`sYhA*9W8h4HL!@Ux z$O}{?<(0~ADQBN{Z(jI3Juc#8fMl-`8h!-LiBu*{$9^eYq-07;n#V)eP1@o{L|=D0!Q*`@Oe(eGWo=66p(n@Zux?nV$WQ{CwJh zYMeVc*^$DkB|lrwqOaISUww!ePnC~-j3yrru|Jyj@meZfV1i%{8IUA9t~p2wT=Cpvw%81+HWn(i}s5Dw}f|8VZO{>^sW^hDXL^=R6V6uBq zPQcR&{Ki?_+R5U5S71}kQTUj;WcllZkQD=ipEA5(+l_C#6)3^26f(g6_-siU%Ap2yBT!kc zQsh>MLLs-^ixFRj>COXF zUcD3@i@)GZi@4rtM=6|SisSxiu_p_L*xwjCHN&Nt&W2t28k_kg*bs<(NZKn8)To}F<;{jn5EEy4QS_?|ABJuQ0P>r=NAg1k zb&I$;=QMNB0Mbn)8a)9+q)7tv&X&bP^T1#G!QdKiC5T!GB6n86{CXfm18|56@AdQQ zzbCA~6Qgj%CAJKte~ZC8|4=%CSeh#VVnjfKv(DXHyM9~wn3uu^y_H!vXHD@v6@)Z5 zA?;8^k)^X<41FdckGlon9=n8I%P&S1*6O|#8hX}tD*TnP7^?{9Ai2U-|4 zZ5%YUTgaJ*`M8*ekSdfO#`J@;|AoJtUblmcMiU!XNBUp|9-TS?xHHZAlyPL!Bs2h5 z?2_r4MVviW?ug#Nxt~%a}dUK@avQffkJ7?btiPAxF`E z%S;|s;xKnGcI8WI)gsfeAR23g(6MFLEq(b3%WdZBIF6u=Z6mQ}O7}}x+s58bMXO0X z>juq0chmRoD%-0Q`g$sR3k%BBT_M~OjL|Mq5)<6-ax1sHG<71()#DsNR4L(UeoUKo zH}%bGb-z}THIw@eAWSFU%k+Wr$ruyuEt6B4v?-}i29p7u9XvDi8gBA&3S|-aH{nYd z@T@?T8sQJIpqfDa2iGhy3@_NpF(51r4Y4^FSMrw1pv1Hf7OlJX7$_weRfxg0|RF!2W51x-qAzCS@ zPlt-n)Xoo8s#!=NNGI!DR$psNO=tbOx8uG^NX@wJmMl7${v^J)n#wAOCb_Ti-@o#5 zjWIJZQa7LHaX09sp5qOed z`fU=jem*#|&2mjj;j;{B>Z^R#CsSeOolfLGr9;7T``i9Ej^fPG-~Y0~be~-MVv4CH z;b=CW?&2@R+r|#x;0iaLtV)E6a#gLel8f`^<=)QfwjF@3iwUTX(>@TDBwb@h;D-8A zB*%O>goX^Cl(WS%*3AGd+(rCed!=f%h$-AW3O{7f5Ni2rxI{{L`Gmj79v<@gV{CCC2?x2)FqFH!@=>z~WY zx_k*j$`4=Q!Pjkq`W zL9u)0APj7w=j0L%cZUzvx`oVk;UNomNh&qoK4jMLa~(R6F+OcHYW zrdlm~qkt0YAp+UeJf${b`@&${>!OkV{=wtD_L&bgD}*vY=~~DtbwsYJ>%wd7u(1VfRKn@t@IQ8x592#aRkBa?sz(v7vhAIL0b> zgx-15KtQ|@KYeig=YECiH&Mkzi%#Q8B{Wb+u{Q-loGfb-M^IclR5>}6jNeeuV!=q3 zw;i1sow0yAd|NI2o6?ui99~rTP@j|jU_CyR1it(>a!3mPG)o^W=fRm z%hf#7W|8#Q03##^t1_1ps_a(%O)ESc#eGB>ISOn$2v?Nr$Z2AvPp)j}kAKp7e@t|4 zrKuzJgiLme#}+gkX~IN~#qOZMczLbMAi?FDT2d$Bpi{Ica3b31WBgX`BIhtvJqsmj zV{abd>V2L1!W`gz9NgRJ0j->E_d#BY+)afhaOC?$%GUDo{9WZ71mQJzUKtRuZp$>xBG@p#b;O4)a=MQPJT^af}dUIC1w+n3heFS7+=ZiXSgjlc8uR6c~bRg4I@3 z-;KhCJmc{`PYZ-u1ErJeLPV%55f$GI@E}ki#d{#`G(4qvZg8=3C`aeg-`qf}44=wi+s_ik|F6ye4#xG!cY zlvM~t*w(c4H%`6(OCtl*%60)YE6Zp+WaFWadfM8oC0%T))$^$2*az-1$T@s12B8Nm z2RaXG<nqW~zuvAoVUBL32(jBum3^CI@ zHd$qsJ9ea@*luri3UP1?lcQrzZcT^a5V?Fj636Q7W$&6rWYp;iIK0MwnTxb)-3n5D zN>`klPtoSs`P_U7LE-?bBr(((FmWqXWFba1kF?d{vCP0LmM7d2{Az58rTmHXyPb6R z&Q3llFzH3jb2-5$lo{|W{l2tV5~_1if%e^Zoqk~4Kk;ng{LSs*IwAU4mQPoWrI18K zR~aj#cB{S(yWNZ0C=y44)vagP9t?PgT3A!{UPAKjF&uAxiJK1Ga6_QSrAH@bnCfTK z#CcZOEW)?jGK%kL1%v}vq|vdQ&L(FVA*zX#CEz?#M%6p8l|A8LJW4~#WTy`L`J9R- zU41GUOX$K-uJ>btmF88C$TokW$TK*+R#8{JV%DbNF{n7CGs~rMsl`%Lw#9uIsF>@H zkL&vT{yZHOOxenHSwVe_?)rDI0Xn^qRMrhE`MCtBV~kMTb4a!^4@ngKZEC%<-!K&j z3yj;8i6%u4Ra#gzOwDh(l!jsq} zkLMY9`R7{R$rBAGxqqXQ6T9;p2B}K;6g4HELI+dd%53=|x~vzxxW;KBs)XUxt&B!J zm1$w>&o;!CB83lORxO+uqn1z&s|+|MCulrP4>71lYt$=Sylcx7lyyzdfa;Z6L4_#| zh5ziH#C#l}8@KLPKj(@yu#*!6(f5yObX2ai!2m*>CdKkQ0axmY$QLAoG|7*Lu_t%& zA8X#DM)UAshQuygtOrWV6%DtfOF4SSy2nz|H$nzOi5lE4TJWXk-qGDXxsb*OX0u~%0NBX)irazU>k}^Jpj+diAzeq2_Ilx=2!ixq42yGJT zqWsPBT#b6xpQ9`-rFuh>YqMcrMdk6n4*x*c(Gtx_(;_Hspi+eBY;i@Z zPW(AvKT`MrpFr5KtfdsDh<4P;m4{NL-Eyy^y`7pbt@?9DL`Us6P<{nJegaP$LJv6I zC)#rU<-HpRgv|r(yZe@frjH?-(e!4x>g?+lL~r+pgar)XVe-qszLII84!+LMGwQnA z4SZl5GE#9|{$*|GWOWsW*Gt({^g=3Y-y;o!ALbAqAXB)IGE7&zuBmnBX{?kRgVj$e zrGLQ+fx(MsY1xR-SUalOgAsf)hSH5nUv;)Hh9js=%-7BNZ-(|w=azHZ>4ysIyG}@S zKjr&1RD|lrC^{IbouWvCmv^~<#2$Bp)Vx7(oL-VX&O7;1TH_<98O-X<8lU_GBQ&X% zHBvj38#7OloJJk_rqz-NnGdinm&A{f>D2WCl>~uCV{Zk+@ts!hA?_P525=EG=P)GY zZ5^~3I=nCZtgfDu4_;xcpcsUXo*Jl+RNM+Zn42ZN7Ju`u1Y=LH_C3HK9M??zkE9X} zS;OZx-cGj1Ws~MU=cOTDl#k;Wy0Thpin?Ts?B6w-?Pg zmF180^xa9wU&oojBG#14tff?)C-()N&~vg;)~a+v{y~7gdnYZfpDCcu$4`=ZBn8`@ zciu1_2kx55V5Ba<8`Qkd!j_%Ea;+GCrA7N=$9;;HTC@NFm7?nCr>Hh9Zi-MVC7ssV zDy-O6l@bWpjAbe4_61~561J&Gj+k#Zpc#>$jtox{HEN)jptV!mr}k&BXD4 z`lUJlgAJPVzp_E+sBOk(Ng()~Qfql=(uBbI6!pioOKO^$H!@Su%b74@Y+ebm1M-Y} zt9&yqv%t2DB9kWI$LlP+aGt8T_z4n{QLyyhXRYdmyY8UJ!Tc27C#{~DUVx5JPj{oU zFJLUxn8PEIP$p&hrMRA(p zfYM;W9E0VRk`Cd<*+(zD3QzRvj0}xvzh8LOs_xQBTwPXDZ4942-4<;L8DNs%r*~6- zz&(F93b)t7H4AB}!k2Fi_=VJX%t#5*6yEFn%%PO=&LfP{kQCtp@paN~;?;YF))WcT z=4Trs74@|M&ZukZR&GD=TJm6K_ADX5x%fb%aMIMRGd1q+A5r0g+M05*_&Kyx-EIS#uj*!b8u= zVMv__C;one1jNhH3LDpX_i7!=KQUVQ>(v$|Lh`go9gC_2^)lEbzljR_Cm19ij*OS=h zofPEdVFWsCnA|p!_6$P@Jh)`LLeP!-4t)jAs=4keT*lHr6y2S*zIiZ@7G=)_X?5J& z(CjeBnNlk7bmQXI!+5M{O3i->zQ2vS*q~dHTp|36_5wQx-^##fDJ{4iM&2Z4gRs46 zBOnShWOs3>%U2j@-tdy8W~W&bmdOTAbp^ew^RH=8TvL^>yqR^fP^G(vp+6bOVqUrP z;QmYKA*@EmDMdLU&fj?$YB+;)#-x8MFN@Q~(ICD0b}IOXhrK2DtF>tT;$&zNLPSQ$IRFaH zpLlPnZ^klp764Bk*NTb42(ee)8Q#~e6?LSLWRZu_KRbBni0%5`x(d&mx^!hg%J42C^hAud!~6XJY7<2PFu z6^1@2Q8h7!88!Lo0yhbIbQ9gm8dE1NQ-gU}|6woNKQvzc^?GEhm=_hK!_pe9*p-^G z>N`(i8{sQMnH%OolU6MfJq@aPFGAM|xuZvKjA*pFcYKPj+Ff{Joz_{zlvWQXyp*n;Em!p|3Hn_(ucq2* zUw6+vXX8C*W2H3Kja3~rEsWzrc%)=X@YE?_{T#9Q-ccHbGJkD-VKEyg-o50j_&Z6P zd$pDhZ$Sc;_Z4(ipI>13Ti;A24NtLVmKfqwcq*P5ChPIzFP3X8?Yf~Ryl-*vWi4E2 zwl3~Or*az$I$V^q@rI0C5g`pvhOQeU8Gsrl4%u1Y5Ot8CF@rQ^!ZZ&mp$A~pH{1(L zM@{-vQwn%IF3T+(1Q1_E6IQ8V71L(9M^wSGpCz3_a4n!X{z+9mnt*Olv_iE35tIrU zn8JFVXd{HjoVYY9WMdkKn9Z4G5SH zc9fefRz9l4l>%`Ql#8GhP~t{-sEG?(Bj-Mc;0$GS{kFfPEp*a|M%xoygpOHN$Q7vu zWJWk4nRUtZP9{m01>t&fNHSGnw{k9R^;ubQeo4EB$8Gm;@v@6v(3EPzz%>k;NAbK= zdMm9!3jcM+*#XCKsVoP17LJjf&23Fq`|+{b^1HH@65;|mvaSy&D!VYfEjhH%n-lwX z>V8iTufIl1>#XY#d@{qygpG1d=@b*93a1CLvs%u40oJ!CYLbUt)LvB?OJ@Ex>$-yr zale{=PBEvDL1Ii@ZFjR;AcB=o9djg}0_d#Lj{}&3Rp-Ne*%?4w&#~xpVcZXML%mCE zUF2W!Uc@UjA%f}TTH8O;$SBW>S9+UkTD;_2D3wO1;DJxg0sQH+G#Y}}4F!AEStRC$9j}?xvnk3BdylUB2 zR;bLcyABk{C|Uq99lw*piJp_!lEI!tdYVJdQrC)*1#4}z(SOd0c21Ex-EnZprU*p) zR9tRb)_S=WKv?17g5+SJkKa_##csgM23rE158xnWJC$N#DDWcOt+8_@cfQD?`veLl zfU>B7WT}80ff-}{{<(6N8S5+=V^#G17$h>8sNtNM!fhoII0HgN9j6gM8Hk_v=9q?$ zH_UZt-%fK`FZ|^~#jmS*n|x=PWzluW#ymDs&Sp{7c&7QblJdrC;2l2~VqEsrrv+CjtzF85*xCJCay7=SvN@ z@-;F$NT$uvQvP7$FSyovi0n3I}=_V5{X1h1o(XNBl%%(B^>hcp>Gnuonu z$6P*3i#rJ&nb>D}b2tg&nq0 zH07i(0SS-3gwnc6?V!6or#mmzp8YD(MQJ1h&F71n&F8l+gmCv+q^U;EkNx4CjvzHW zSW|+-9^Qh-$-lzwH=DSD#qy}8=qOKc2g*Gj*4 zTPnObazLl|6tnFD%&Z{$$34E4 zmC?Y)4JRJR1i>^uqElxSF&*T)_4Bi-)%la+OD)U>WMO*IW=-Nh<}f!MH~vnc)tCM& zA^c$f=U8;gjj|{@&OBE~vpf;a{Iqtm&(%U07HB?@nHLVt(2EBNqPH9#utyx@2-xW| z{-&4M1XuFzexvM*F*kyMuTst+bwi5=$_}NS<@|RewKSWY(f(FF>#D7$1f@!R2A3MF z0LCR*c0`oI`Vht}M1?~%>IJC7(DulVK1Wq@QewC!bUcjEB%3Wq)0d9`@@DqMsNeR9 zfvDj#;-{mJ_Zm&|Ru4Ft>v=lRFiFa*tv9|VYx;bxooAB)`d)6XxOdF-lh^=L>Z7+g z^sI99%rX7tIdGuga_j-YqZMbb(lTu6`a$X^Kg4~t>8p4_>ZbZCVK?H8Il7tAzjSil z^gPDL#~fmweTRd4D(pu-eB{Pm&IoGUP=u!X-pa9Lk{uQ5Lk0<{6Z0aks!pS$~Ue+i45KWSXT$-=_Q8NaBe}9s$Z~G4)p2 zb>$BVq5N)qnU%#cbTunS*hx{o>v9Y=8zGwf?j~c%(2crI>8gq2Ex3sBy-}$UiPLQl zIXA7LX-yP(h(+3FF&RIWhQupdSJ31eOOGcIHWA3Quq~wzJ_cx{3T%SN7C31JqIu)y?EhlvXv z{T6IZuvsiqCt>Q)5w(K(E80~nU}sr(Z%n#3y9U(QIVRFa84qj9Rx7mFv2N_l<=vdd z=*IxGAB&U_yg<}pYLLVIInaB^-H8Tbgf}%5CXR_ri3ce|YT)wu0RQcszr}=N?cb#5 z|5ud%JpZtA{11o4#PIK~8YYJS%2ji$u^Ia}ZPVvf9lW?+V5x?OL`&G8YP1uZ|NZmy_9v;{iWdQ4XW$qPOZg zIH7YKAK9*#^f_-il}A_R#G+Y4c4qgZt-dWsC5z+lfk#>rZ8IY2+B|Bv4{|L;C7dDN zpg}`E+gWdCZ{dBje*IdxqEeL(cp{l7>NCRWy8IH;Bj*xj+G9^~f7NUX>uPs<)U271 zU-X<#YVHgnW71Gt;g=UlIh17c6le9KLczEWl|9|Kj=P2HG0)HUde-sf){v%F;xLT~ zLeweuE}zf4(aYt*Xs+8D<7q8y2pC&BI--b@iF;%|5F(UZ2zn@LDD^2{E@Xf9l7>1P zn7WWn^lG-kpYU2X2T2*{Bnzd?>bbjFG2|gJESqDx+1~?atnKdt3u8mD9ut2r!j%l= z%tC)-Z|lY{Q~BWjIH1MGeIKXrLQInc_Y;gn3USHAl^{kaw55EGJ|MHTzmtPjXFW6U zD=Do2*+0A`dm=z-UiK+bbie7F& zFZYlF%6W5YdOIDwo-I2-XSI)Qh5N39kL+Ml06dghm409S7ufTaT9A+URGXsJdvm> zEs5_6_=*EzYJk?P&WdIEa126cF1xhE95mr@A>bX;0^>W>k4ycI7DoaAdLM^7@TSL) z>t&hmy5JnS(<+zjag^!O5=sejAt+9|RtN}frq!JgDVhf#Ew3FBJL7onV!JPExz2BE zW0zt^Ss8^N%2Cx{eRf|ET(RV<>ZKl$E4age_N)z(3iAOSdg{1sXH(2hF6+2OfZ8I& zO^#|TYr&}<3C(R01hsWimK>+Pi=JRy5TQmwtxU6j?ul#hD5Mm`Nm~S3)Q~Zk2fHTy zpju%018C5OW~#1&?f{K3f)(dds9*_XI)x5CK;T7(M-AfyIKAn(|0LAv24P9k(u)xD zD^l!>RvTCPY)^?tM81eO>lCud$eqX#~fcUAP#Kaq>O&daJXH8Z9AsE@0?a{ z^&V<;-b$)J>6KZX6S0j0475dLg}Iq?c)ZfKwL-OoLtkiiM;$ojDZ5;Q-X&7_;3-50=%xdEuOU8Q@uH-421x`^*hyIL{BrP~E0G8(=KZy7WrW3cE3ul8?U7YDD zWK3$Dj`pxqs#->%HphQ!2x03ACBPasiPEW1*C=&_gx0#&Li4vhzmWEE>5SktG=%ci zB%|w`g?QYh41B) zhgVBM%7Zei8W8s^w99NXm}k`P_o*qyw%MtZO6Z@MX%sp=i`;YA_-_Wpt+5x3Q$lad z`7fg0R{DNEc7H1vBroXh0Pw@#=b^ju*u}o)zKb6WfUM!B*Y z24-UXuVCPknN|BdMDcrBJ1ubfb*URy}HTAvF7TYYZXzf%Dcb{X?L+dcvZvGkbLld*{Hi+<%XTFI1>6#q4gw#5ip4#J{)xIYcg3Eps;9dEvM*#6j4p%5400dG|JsE;h6Rzj+6nzJF(oU}n?G z${srT^ZVBF7Z5oX$S=Va3hX_pK-$$!Pq~z6<6dB(ZGd!VN2o3u@N8IavG>iWQHbZ} z8)(w7>FiLFNsWUELviL{0VB4GggMYthB`9jHH0uimC(pABE7x1M%y1z>vo$8 zqQ(CGTmI)4`VT?H#>DWi$|xqrf5&N<82>ArW?FsS?vM@TA9~6Iv%Q{Erx{~xkR+p! zmMO`S=xLY|NX*EnxurP4r0hNHTk5AFtr)Ft(P#rG1mDJ?o#%ARiT-#t+#oXiy=iyc zN@VWw>@j>pamkmI+8Hsf)J!!ydS?gBjK~+OT^0ot22?2Do%JDdn&TTZu&)Ec2`>al zZRmV#vh2Ai!_y1fr4yK@IIDzcNJI*yH@eG9ekX2Tw!-Omb|~M8U}y9iXjW%hwIteE z(8Q{hB^oY~F-l9wbxR${aeSMllp&t@0!;=KWIt%8<1S5>m-?=*@5UQEyJ-@tN6dkP zh<^;e`z>AVZk%7N-&!QRS81{)Q@Z#7l4qU2tZI4^2Hdm((}8^^eYr5xt6n1`G@#d+ zmxr;i7F)FOc~}hxLfoc%RJB-)r;e2hyJ*S2VL<|L1XuiX2TfGvJf)|%XuDOToVev7 z6Bt(nUHvZDj)n6gwWKf(qTDO|&$+P|%FcAO>Kp|@fY{NZaYaN&)1L(37SWC@tp0{w z{Ie9%_S_9(5Xc62s;7>|6-nu3jfZZWy{r&aV}soZB@RtFLo<{o1ATuU@F~dz_T}_Y zy#}2NEBadlOd=6+drg$y6$@RvAZw_n>Z}?aO&S^q#>Zm;IVN#BN+kky9$WHO(*UI} zFSxD7Eg3t^H7uT^bP(Kl$8DbCsA7=MffG;lyS`+++iTK{-&Immlo&o*R;t!2=j6JW zPp!LpL^J&YRPxh7gYf5QiLYGS36qaYLN{+dKL$IA*m3POCOIdv-E)%)ZW4LNyNx3;6|R1V!z9Zc&NIRU!~FJ!}WR1(~3*Ww^@!NI`x zmzZ!$f)y~9-3u`jsm~QncmM${W1Qz)!__;L>QDgO{hw39=+{BM!TI8o6I`=`9ih2j zSz0O5F$sVUzNr=9DW%KnZ_{!sHm$cB&U{=;uxD_UvyFIkI+1*sT_@F{kdSWyyF+T> zbJGwN z&->xnC;aY8?sPM74Gli%%TS+wE3I>BWxPp&+EZ2)MuY2oV+s~%PA6Oz;u-+rtclhp zkk3}YJYW_)8{S6dDE7y;pK^(F>u6w~$L}e`mA^fB%tO&@y`RKg`a5olF1rIJ5rm@cj34DHG#=buL}j{M+L^ z_K%2%Deb;wj;Qv%Qg-b|WYWm%Y7O56o$9}l1BgKYu>K1d_%G@Yap$>!VCa#JE9)wW zO6yIWX+1f7+q@rQ-V@<*{L`ma?DykeN1MSJza$?UHWFGN$6?&2)symkW9X!l+&(>7!-F z>^n}J5((e5>y9FteXf*?%AP8VkoW0te?7T=?mSO>*Y|WA{Kh=InW}pYQ_4`zDkO=l zR;@{`TrgSQR!0{(9>FYT-L&m|0CC!;w8jb9vGTZ!$(-Oa6Fg{noB2`-QM!pd>`T9ilKO)U6ph)Y1RFQ zd}|3l1pxs+j};s5DFPs6@JxcrE6PpTsuo2@=}_C4u`l>Ti9luU?p8z0N1x1M2kKAu ziDgcuR?zIKN!dbID8GmxMfN%1#TX!f0}5+C2n__Z3`EXv;N<-Ti&hpW54uLw(3Yi6 zpyKs%)nuJzG1wH<5Jng}fe2U&nvdU2mCYej%>ES?@O5C-*)Fm7c5vJf-;3?rOQh0& z6PPS{W-1zxw+0VL?6zul-A3-&_F8k*o(r-g!#`mB%c~y2o^zleQy9gj1A5htQ5MEu ziTAfJJ(J0%B&#o&rf&f~I)zn}O31=^zFg-(gxW*;Fa$PXhUbQeHD>M#SLz#uHDt2J zJgmAY96q<(+c zym*Y2l1(-iq@O|@Y5p{x9UYegG^R7;efiW)cwFG37AcRlHERAC5cZ%Jughn#cMDzD zoBo>%wdeKz>(fCrH5PhC3=d1s=l*_h>Z~unM>>OJ*T>zBvG?PyOfdt>5`%2KA}i~* zj;?O^dF&c@cFrvv8imDVDZJh)!2>_U$^nrb$4-ph%4~a4_ppn@yNA0Io&1Cq(x_Ry5 zip1}aMCPV8J}L|Mb;R!DL3O!Y`$w4FGm>^;jau$d0HVspH#5*uJrEE!06cNhyAkRNyA@ zdt+}#u7@Vl5~pz{ih;Qh8NR)MJ+WjG32d^HvcD`kTgQjUs+-OQRQVd)Xa__CAl^yJ zfxkhkf`;|xS03?IltdPQS9+y?A>INj$hkw+{H*2jnF;-s%7GYZ-&brgDyNF4k68;wr6)*X+klj_O_oI1I=eh-2N?u&Tp~osIuwYae z+Woi<2tj$(^~+8w)If4;_uEQe#RcL(W4I8A$9~PuuBSOoZ5Ma~LR`9!^aL`ESM2^u z8X@~3^L;0@Iw!ZK7^V5mUNfLkoaOxMr=|(JtZ5(E{3?p_i?`)%VQO*?;Yk^50c76Y zcE{MZb2*vub!fBr+z$IlQ#q@DC3ZvA%^AUtk6BB>)^VbJm3hfmgREjg3>n zWpuf)?p3~hol0nL;~JW1$n0bBa-8-TM-W??%Tdrp1MX#mZsxjvfdAKMG=hlAh&K#W zFq9YVE93=ubSqtWh^<7Ad|(Z&JEV+L-#}NEacWpDYpowt$hDF749TwfFmv^;F4yXs z?DKr24Cto;m?b`qIYs?^kf3EGO%)&?!b*MX7~YmOnz5N4{q|>T?k#B{{8HFBm{(Vnqwxl zisuCZHk{Lbc?7Ele<348Ojej5gCmD9gPv2q}hle&77i zw$tG<)gS^D+}g zQcf+VVStBs*_`H?wHQ)Dwzy+Z?Vr(BTE?}EbIkf7bSvf_i#)nmR*ipSfmLb@)Mbod zkpO;HN@&fg)>2X*#{4EiD2exeQYrr(9%`AG(KSe|Bi?wsB#5CP(F<8&L+K%jmnJCj zn+1wj@rc{e?KRfs@**y*2T>PpGtFl+A%bSw*-rH+h2$9#9-JH-CNlOoU76!`djMED zjXoO#oR1?rgTO0i4JGkHArqXs&$be;C#QtIh~`DpMp219?cCTQl{3VVUw#LcB=+ja z*T48Is+Lq&7U36GS`|S2jL(Ti;Jw`^F_P>bcbVqe6wo&zAGs-GfnmA^QE&ghPDEANh6 z5Hbjh0UO887fT}!?#p5sG4`T+c=hY%7tQjUv&_`Blb1ea$N5gCP5zE@3Lx+fi6ZMk zH?t{d{xDGa(Fy@V{}qAj*TrcCYB~sBV@6muSlj)Jq|;eW7Trt`p_u*LH_Q*9bSb%L zbm$?Nx?*O?3eppeN-iJ>{J;R&0B{2VQ)j&3*F{L2fAc)W-ZXWVAce1b4RHY@c2}w_ zDYWoO_;1E8!qqK;k6O9_#g;;VjSakuj+Ag$YmIyuV_ym6-J1`J?3sauhTlh^XzcwE z3QTp!5SdASg2RB*bBSe-4o+CQ@D@0vD~|}DNS?XE+9Kaf*`O?BW0$XP#YiO}Kr^o* z4h+!96K&IEsacRR)vkYEYTj|EZUsK9lwX%)Q8=HPPhd!38Bio{jDbO*Fvi82q0r0L zkPUTLk2c}7C2b=XgLYSji4{l@z9i!3LcEvFc{O0eU;*f@#uA(u+RS*=a!S?s!+QQW zcw__+fWh3EUoaIBI#15W7GP7wEuT>1vg9o;#f|0<7m)2nke$()05Y4rHqnF&VQEKG z$YoUm$!T&RgBnCAch}O5?Y+9zLF*!L!PkWnnWk3cEdcvRs*MtdbA$*r?av+i5Q2?- z*WQ(vf96Jy@}$SUj1PrAnQ`lR^XkdoGY8Ur3J>tYP~V1c58 znVze|VnH2AW(o^CW0C+QvE-b5WltJ`zrb1qWE;bkmwc$;bFn$$amREezy-ptdlR4XG=m9Ywli9_u>A|nN-3uDo8;d zQI-#&M0x2HQ>mGgw=)9+fjPj{#(yoeI2{E~j-ds92_aLxBpB*LT4N-h0K4|PAgdvQ zTeEOC=rD;mNqL6T=DY~YISa1XrvVlK5oTd4Oz~qgZw^ZCtJo3JlhrH?&Un6Tad9}A zLjq~@R8Rpl!I4#Pz1^-T!+4WBLjC?7Kyq2ys{Vju`W24`}i`Ny0D{f(D(RYA2BBB!iH(?Cbi4 zZaOd)t0US0fD)oft`^w}gt%G;xBqOD8bL9zPYs#=~Ql@tQ29 zzmK40^tDi@dZg^iwN(cO9YgOnR+y;{17TUQ)NXQ&Ry8&R!BN;kqB|!p1_ShuugICv zZXx(-QcSf%TWCAj#hTl=CyYUygpH?ac{uW=;C*cnC|37y#SV;Pa~3MevnzvbaAGkc zi%fwq&Nej(rGzeAM{6N)?(hm&HEbcgdZA^)Iz6B-_KsY%4!qUNraKue_<|E7+J^Af zv$*_*;LN9fbEe8w9XtXSc1t-8SaPFpZy0_2kkcr499S3R%ob|JH=Udhb_z$chrshQ ziDy5>Aprm?T6W=;cA+d>-hbX2ncRWN#Rw!V}|pB zc@I$sC$-1GEcu89>obOq|ITfnrNkax_!T6MBvLxd1z@@9nPqKL2+>aCSBL~HDDM#- z0lM7IXOR#_WX=vnv-5m?mwa11(L zCGu%Kfj!+ICbII<9=!gp^sgYshyt!tJ}nMA15P**2Sy(C+FISMs{Xh%2IV1O=@U-TL>lQ+WNHG>=28!GTh4UxXCKa8Q5hy86) zjywa)5x-3UWQ(MqK+u@6u^K_}Tf%ElC-A!ah#2 zXsQMoP|-8b0PyTcFe&2@2$tsWBSxs^KJE1?d|l0p7xsv-P5rux>;o+Rk_-Am^Z;3M ze6F(%RbHDmzNcwc7jE&&w>$`{2XZ3+&(AdA4?Wem@J_EBID7J6_L+iJv=R_`d1Qw0vkcUFFxMb$nfZ zKPSr{*PnhN zowb$(Du!*FJlV-R2fBY~Es zs;}zf@~nQKEav^^cb*69(OfUjyWkFm*@y)SL)ho4|1}g(eYrM7NGIV9+89)R3J2!xuH3N`+gPv7h1QAg{8F)kiEg=#>I7>uRuFOsqNcxQgzxM0rJ$~W zPyIMV_dVSYFTD5dMOog-kLEYi%9JJ6JC2Dx?Y_(ExYa7^GwwOo!o*fSA?6=o0hgT# znf=8ao2ZdKPn4PC<=^+X+FO zrZy&}E{!_+{xPbHl8v@1;JeGU6{`DZ#L+f+4@;3fX~YY6CIr(FP5@PndyJogp1qXB8C8-iJ-E)b-imy9!;_x;{YiWJ zwmVB6Ag@E(R-~q_Sr3WDN?AUTaMQTU2}~FbE-R*0FoB=zK^Rmr_st(XWk*=e z;0}?XQ~m?_))Fu3VUmY{CFvdT#cLebn=%Pna*gDmul3GS!k2}Vh}x`17BF@8p9VHl zQWKu_XDp|4qy3B3{*fOfjQJ||FYu(H2=M}RP%xEBcQI2K(cpYG8>OC*#DyS{RWV>x z$6Az*z>z5hVZ2QHqtIgs5F4$BW#tWcVT6!67+ndhWjX@1(?Ab{A&bl>MO8k9l@r_dPezHo;|zm=Qw|I3F#%7ncYLiZOcMf-nMhg#7l1r# zeHkk;u@HXyCY=qp7oI$faKFRHQI{;NmPsOAj2&!#7qv4K5IVKVlJ=yTu$G4#lx9}; zy_gbiUPSR+PIJYOP1#>vr7Q2k)m1!VvSmd4FxEt8sf{#TJq5fwS)+9(T-y`C4&s@n zHIqTIM&G!{NLKi}j6PE!W+X^no9O+4HJKdQsxWD_T?thilh&lp2@>rN#OuJrRh>g5 z?fzT+w`cwEWSMZQhg*Y<=$_8K%6>hbn(Y7l6@Gf1Ow}Ch|8Qr4BPpJB>dhqe**2%~ zl7V#w_*QAza4US2`O)@a;sM^txWxSC*mOv8?B+&{%WUE-gYA*i%Csukg-Mu#ouS?!lzrgW z(@%Uobb$k)ThDR>zq zckZe4MtUY(v56PIc>yM7acl=A z=AJFovLPf;Oc-Wcu&6Nk(Uz^`9B?PmZki@^MXNfJ8m5B#fuD|~F0yaHX9fn_xnd48 znr*nBAi*+rP8h{u{wNxQy|eY)O5@Th-DYXPd2gPekzHs!LT^l~y974f78!o~!{N4h z(Uf74kz%sDhbjA5-xkAKA~-`uyEyjEDVpJtU6IW}x=fEvB~+mEdh%zbnz#%QIc~SG z$IwT2c}6ieJb~Ev?=&LXw%DteYq)KrQnZj^mCMytN2O!ihCo2T1XekKfk~= z1W8olHjQdVy1n~Aw4?bmr>e$NjPRY2Gi<`@WeBy>;dOE2E&<`LY380sQ$%=c_7NUm z-$4caEeA_qF`~;5Y4SxE0H7UcDA?Nr-NuHt(VUV+gE(7QcYpM)|4!~c;D{{aqT{;%M$W{tl`;lG6P zsycyu0T-GOLe~ea1CuP5)c<4b9lJB_wyo{hww)`sZQD-8wr$(CZL6Y+ZL?zAskhc@ z&)(~8ZQmc(xAO;_bB-~4KSm!5Bj?GBcYm+RbIk_Zz#Z6JsjVN3ufWU;mpr7aKiPj z`Jik|;TU0Q(%$JcbakW$Sj6|5ok%;fT5L2Y2sCcwdybaJR+wTYZiq`3wAFeA#(J3# z3bWcwb@uEOt@b=HT2=5lIjTO&eiNt`5EnN*4DuK{ZlS)h-v}G8p`LHEQe>k5cH55N zZl54;F-)q>+>0os!UWOr-hjOdlIS;zFupo5)j_LS&!^FN3hJAv%(j6;xO2ej9v*R< z6i*;K-cKccdrIf}%=Iw5y!{fwA}d^bsR1U=uIa%pH2yjlaaG9fv0{Tz1^E#u zO-EElp}=mB#0!@OIZR^;wL|Bj1=PTzd_sT`ig&pY(Om&UQZa+x>2Xf{5M|4WuI$y9 zPyEJCNYEmpRD1b@(k;A^us3N75dSLUp+7h+rfJ?rMCQ_U=gXfstrlo zKzOs=K&XgGR@(x}zPiY9Myprn)}tl8`T5cnt%sw&LQ!4@kbxsB40vSNtpj=5Ed-HuNHFv#I6lpaih2${n`#AOKf z7-)8=cjRu$fop>+WUvR|0kSBFAaH2U99G>PJZC8t33W*YJc0yX5?^vihx)o_h=8Ex z{vhHvN>n{29M~zeVz&9{*Z9IGLqTXri$$guXt{UU*yz8%7@~rz6W$@y5=HkZ@~IMQ z%A;2Y{utNT*PJOPFmP12NdRw5<;V$s3juvCUTja%o*l}l@3ppGu5`rN60*hI{M_Fp z7c66e$Ac0XNv!OUOOHxO`K8!2cda~906Bxz5oFa0^&!PVuWc2GTq&{|pa%&`E}S2} zJ@b^AYR;GRci^WL7qX3ZT3$Vb+=Z>t%&t?)dPk+D82-5+0#|v6urer?yo<6N3<};e zlZuhCIJu(t;yey%0AF%cSkbb|N!#@75-Pm7djAfb@XU*PLSfP;aR-*7ni+?jntMPD zsdb01L)o882bx4}$dB;e3ZS&&)_Jp1T9~WY8PaFchaw;lK8#mT-~3~#Yi+~kF%GQX zUZOPdBOS)6O?DesR*;gatq1}B)ij2sUJfpX<}kipkb?>&zWRi!rZrx}FEyVC;Xg6g z%|Ky5ri{)oFBHm2Z{^Hr^SR^7jfq2*uf0EcpvztuODjKXS|0@`T2$P2JA!$t4qse# zhiXUfxvh2)5xON(312w@3R%PbRSPFVc6z&0*pqN5h+fqWb-3QuASfii$#qT=4p4_+ z#cBE-hT5gEwX#8N(Yt?BMxW~>O8p{54@r)sLM-d6OG|J6E&FF=yWIV@?li0;yE?9) zjL81ZgOfkwDIT)uHgb_x)m3&B3y_!Cj3DfdE6bKS&k>vHXJPIgYBE3;!wX?Bzrxm% z8cwVq6Ygm~2_(jY6cU^t<}5G{>ci)wSEzbc0{wK=y}O$yU`+U}Pd}UA>yIxxuizt6 z2>m^Tt1P=L%i8aM&t^GRVwwBpcB+*NC-{;d!Q3O7P&mDFe^yu^aK+Ok7=1)3mn?ECCI`LL;}pY?dK8zt>4WOYlH(PD!bi>zP4{PJ^d5obGUO{ znvQ(~`$#ag4OR~ZcA3>e@PnfbgzP0@9wO_==4lgghb&%gVCXtx{ud*PVDvdLtE}g3 zth11AQ5U}Aj=WH^-4&H{#*Cp3(2Z%}!#jGHtb32a80e`1bzte*1F0qq$kj#m@+HIT z8zOZaTjZrlO|C_9mwM z{4mZgPNs&oFdjL%>f=s_>`1*AG+jPL2*W@`9hKDK9+yKVnNlM)x|b=i0ODwDloY86 zoG%f6Zuo%cG-<%$f>7Jsw#V1ID~Emn3dE96*iDbVqKAGDZN?XRSba~}h0Q*0HSLd{ z54`MPn_dTbI3t8cq=aSIdQUwwe?z1e87ZWaNWthDO^=P6ys7!_*|Sr8ROBud0E+Ms zQq$L<_w8Ufxz7f*?UWWuA`!t<1)E3jU*oDT@JH#+_ym?7$syc!(!f=00UnC`6joj` zD=VN6im3xgAR=bH*ZtuRp~+O534ErPu-?B@?>qC$1q}_}cf=MVWF&I>K-~z&)_Bkv zC5!MuOi+pp#r>nVogtk!Mk;K2F+DSDw-^7lf3Tw zd;mSsWeEwVr*h?^Qyc)uD96gYg@bS!t}9Jr;fzc z@Bp$)=KnQiDH~)AzU%}$jRS2h^L5$Hur|?jMSmw-`T(;&S$oNGGCx18w_UjtVj8f% z8Y|+CMhhb~xKQY@GmUh0*R=$`Zqs^9t--qTi(C%<>8Qb|Kd{UQhpdaW?ws7g0o?rk(#gQ|wdbdpip|MK$2*=w-gmaxjYG(hhb~RNOis`e(7H45YnsE)2#wBt9Uyy75EY%2qyboES?M>-(yx z3UrLC5NrP7A=(w#sbH$$&n@m)QNQ060q=5WD986)f8#_McqnA8RFj$%_WhC&W%6GfvtBjM-h=onjDnSig%~)&_ zd$gBv=C0Sud7X;GyeNRorHa{=qliOYymgMFL7$lgZfGglQ!AAZ05Y=8;9BmY@m$(# zM3MH&?+;V4wcj=VhF>+k$5RTEMFN+QOT8 z%K0+ZK87dE+Y07>`*6m*!?ZJ_byTn3to#BV=BZsA-^e%C%!vn7p={O>v52+EBjoYt zs)R|GKME6Jmj90;oP5QbORWpaz=Aek3|@5LAsyovP03p zFPtH}Tr?Eks}SG@-0mOy*zS{BiiZuAw)65=j>EsL4&^k1IQw8A2TScm z5MY#g`VGF${RRl3(E5hiF9n3`OtWnr;fAWj7Zc1u$D`02@xqYeKCtV2#^w714dS06 z{=*gczuYL(|4&(D`3G*4<-g)ad(|fGHW`t6E@(Vb0;Bd-P@JQab)ztBZMTyO6w$cV zt(D>`hEI3hsm@JtxmpBaf!S;HX0B(Z78w48+Izp>6v04wA?Sl_^oo6HC>5Gwh|<&0 z1VyVIfUE;M=`M?V!FNK|! z)fY-dg+V$5k>k5tmYZ&f0aK|3Amvopf^~JH8>&X)s^_5Y`!8y}i&z_S=M*WJp=}uGt(N<>znaUs<}U1 z;JbXIvUwHb+QMYi^HYg<#y~PlROM;}D8`v`BY6$8LPDF#`s*o%s!@w^ws{V+%?%M7 zXHhWVdb2YsnDOqMvNO0p^ATXD?Ie?;;`K;a>|T}TdM1rXH}W$o!wQ%r+`r8EL1TT>-DaMqn=i@ z2xCZAD!$mj(rbx3AZ3&?B$a67#?60AQQ5Fv8M}+Do#9M10B?8WD_`CMHi7xf+{enk z4)8zWq-rn;c~LCheMcU!hD)}5sW&T*)!iL1@TTC0JGlWrfxGAd!ePNCxFkxi_x%ki z_2(fb`Ix9>umL6!4Q7;JX8YBmV>2@u@j*;<-yZlK+CI%f&&D;CRGd+UF<5b83$0ML ztEye=7Cvux@Vv(CAO8OT!Fbp?{xfmH`VSNj>wib_sLR-Iu_N_eXuvrwfS`*g7g4^M zt#Y-TlD2|B?tuYo6!qFXX-03+=KRPnB%tBKrI3WhZ<)mQV|lpCMkWmWTmA(WyKO*V z5C@F=!_+eLO+hupkUZ;);PiJT?J2K=9Z^BYg#gfKa!7839KQshg8aB54|!$giYtN| zVlP*+^>=?i*h!%lKL-d4MS8AlPwes31@s@q@`orp;sjzCTg10YH^| zvg2G2BHDA%Qh3sPR(y!AkmPo2e^4#;4BO1d6W+@LSP5vCx=|h zFKex4KkwtQ^Vw=ZwqJNXNO8$Nh+$n7bcZ8P`@zn%sJ~o`lv-cuPg!jegI9fF%ozTt zOb6~uR-n~r(X%d>wf#{Ni^^o>3@w5sQW;Z7e<__!JN>ZkV5E*T{&^qs8E(}wYsc%j zI^byDfWI}P$@`%u8J1{PO1Mli1a_EnaP!hSe==c^gq&D6!OJt++!aE`Tzu*6nyZBS zOT=96Xy3kM_2un~MS(HZF1OQvP=NCEeXihCO-Jr0!*?#^fTmYoqDNgKGQZF{#To;z zL7%RCGI+6Ba5Qu8Q;8iL35WNxG46iPx=w{EpU?b3`E>ry{me3>z( zMf2U0J-@LE(TmJQJMS+N$Yg6O&C55e>dKdDJaFA5q8EGAh9UJVRoC>cjCH4tX1?t~ z9~DA&M-p{4$WQL0G`Y}#Jga!)lK8R9^EV54mGH4TKktGk7SeDUh6A?EJp<6A;DD8& zPa~uE!v$t~EONxS)ee2vyVC%jdm=3b{f$Ij^fOV zj1lerj~%xBArpZFS95)fj5t{F+m^D^V`nywS@~Ahww7KVm8wqrJ_+wZ*F~6u_OK%> zv|Co1yWyf*#wh?jggG(X#AT?dXn2;}tq=47A21qnQ0{@s)WbV08nUY4pmXg~ z98latwr?@vK{8L)1bi=t{24lH?)#xr^nY)Fe;@3BJps5_nEsdJWBmtXjrG4W)@n62 z?KZ{#rI1~U5U7WCuG5S^WnY1TM?D_j%2B~ZY0KD%DIfoeLViU2oXuKg;F`vo779f(wDtfN|lW77Q)fOENZv7|folq*Qt~k`Zw#ek}nY{sW{;Q~aSg~J; zh&-wZoSq#NmPcZ>myngcdJ9bN9E^C&qswxtxLvA`J z)vXuoJNn|4=H651BGwaMo1bX(GtwSDvv~F^JRU=IT7ihZ~M_I zcYenSUy`AHXhPA;bQT&Q-A)7zq+b{5m3ZMmfqbbMneWCes8 zqn3Plem7+T*qjyHAqbhU_I3AwYx zvp7$PpUzs!Xt-Kh-$9$psckN0^ZHuA5h>jewR7v=OiR%`*Xc39zy3S`$ArZ7?U9f` z{R7;;lfCd8+My`JIU#KLY$PNoZ*PGB?i;~WJ0)P920?>!+Pc{U#$Ikcji9T&R!Wd_ zF^(PcEJ;SL1%vbEk{cy_m{5m%rX9i$90AG?`E>vrfuFR{q0qIn4@L}wkk+1ite4*yvss zx9IzXGwPK?kqMjNQ;wFt+yd)Uo7>?_16p{KyO`f^xf{}4fKKZ5$eoQ;UW#3Y3rKz) z2u5U(z3;;zH8&EDN4IO!Q3;gREqF>&feT8*WJ~xg1b$m15*#UmnBE@8g_~RfR|&cm ziX)r`!{k>A@5z-u>!B=v|2U3DujA1P7P#5*Im>SR;LWZVM&_S(*S0{mI8ac|V}0_} zdg82LPzWPN)YIMFc{=!2N4V`710l+lcX(QJpnmc5JtTq5A))pXi1%7~%{UICg?CpI z<%val5K0Nf4DGDjJcJTXDEUm)xm?;MEQyoc|J)(Sz?Zv9jY2(SK`@6ZjZ7I%?}HF+ zGT4%g+|?O9??tTodmbST@Y)6hx86dipVuR6fzq^Btr$Gfr8mxP)eeLg9A>Kox46vy z+r_!%kQ2!c6-R>H*zFhgJ&t=%>-vyRTRqV@`-;B5{@NCA9ogMc#oQkc&t(2P3HAJ^ zSO~cVx+YL60LxwuY78Ss(5)$ZD*Cz86~u!E+Xk#*e8WdE>K`4I%=>vJ=;0Frx73d^ zJ88wG2{<1&76_EZZ>ir5@;K!LE@lV@AAI405#dp8J?I5D2 zG4KVFIQDC@`*k>xDVaTa&4t0oLnQClsfIq{P`?VV|G*Msf!hgr2rty})7bn;6dC$y zv&Anti~@%)OBlMVR~!#*)4+59MBqY)7pfbyWK_Cou`3b%WB-ETMeXOmuI>LP!TkOD zx83pY%lhBK4hz?R@NCw9Fh1D+E90Y7ZTw%an!m!%u{ur!mfeQWBt(f=R9mB+JTfJ- zZDT8$L{jqc4bPI~4=|ycd`_7vsl8zU4KeCRaRy{jTsINoUS@{8h7G zmCjzcYl1y4T_gyB0fJN!&fzHv$*;KV13eMa*r6~i2caS`?S2h~i<=e|2o?8Tlp4gQ zd60L_BG(b_9DxeBdTTBO@2U{KIM%3nX0v5dEUy`8nY>h2plK{VdkZRP7`uNj(3>g3?>$c#862@{$hva82eUxyU8*kAgOimv!Jk3E%p zWo^9&MprFYPc&pXrx?e|m`oFE_O&Q>3m0Vc&PbN$QoI>AlQktr?-<%1lW=0)L&Xf(0@ z*(fEP(4Pf7&TAPoKJp@5B;Aw`J+ym8y7mu6c?2_<2$9Z3{;W_4Oe9P%W=bzL@wl;r z1cG@s1-io9s%4s;+o0@`mFL0NbqT=FFP3X7dglP9i}zT)r?%5SWF#+24-Pm>1IV4k&iW40jS^AsxKG(>NxY($b@|j>N*>+t302i` z!=pcivY7Q`rHrK~DJuD5S6>gE`TbUv<;CeBq5A~=xYWT@HOzV(j4?6xtJWTKwrY7x zlsb&RgyNqUhEVPCnyMzQ!sK_Zx<%hu?{!r93b%7#A=?{*i!@}NTM!k9Zi1)BS$Cne zHbP@Qdyi-^d;7^Z-^|M5ha*L0oh#ozsKy~hv#3%jDzDpGpB6-AfK}RSMq7C=D5?}=Bf9A<`_yn z(s&94ZZEriSe`46^bSy}O6nv^G9nCGVDc3#z|BVkMBjE;;$jeqCHwQ*uO8D+oC!d= z;(zU|Hf_|B>6?fAK<7kQ4b!VTgYmxP#OCcr^%#8gHPt7YP$20Lm$po6MQ}X%b038> z-FW0aX6P@Dgs~ibEid5Zmif^RejMp5?GbiJCNw#!<$_Ai;ruu%zx>WQt~?dOgOLr2 zs1YyrbE9b2v^Tw!-z6pn#e>ed{)>zAZvqq8FAtj~$VE>9s68R-4R}U@u7=l6ri+ z;RoA}t-<8wF5tJA&5VgOLbRBd&_szlYmrPa=vZ(U3=Q{7SZ5BqNaSzF+m@jsM7&3P zz5*B>vBUu_WI4|*n_`xFvH~~!$=LCCrNQp96++tsZ`pkM4nzt5!Th9xGm@yR2Tmmd zTb>FA>k*iyfDk?*ah&!cWjVHdVL-_1-LTLSWdK2U*)_~4S3xInD};C`pcNy~RY+pJ zAB#o8B0dsvUVVpKz@CFhwSr5KfKK%#&pcsFaF^gu71fJct(?MZCAf(vW{oMBd1JK8 zV-%1` zl6dWg4_yQmM{5Dgj!n!VD?}sgP5tF^M_G`?E6}%+HcT0rGh#9;uTNKg#}tbKw{Xqv z%TpCYmUfozgctmo9wr^qeDS#q(7Tl5#p{AuNCSuonmvFBd{wg^M!PsdC z?*cE*_IY#9T{%UUhX`MncA=AOx%=p(J;JRX9k3 z;lBP)0Z>+q47q|L337o#BFOa0#7;aDUI(L~Ed@|m2y{|{q}!^>sxtBVn5OQN@GHOr zWTC8IU`wzAk^Nun;u--499pQl#Bz{56gGW4mv-Zt@`r4U#l7~E;zPGHYawSQJI91U z0JN0HPV9$k7UcFPV=@-jt++sdlEw*wAO+aT!1;W?v!X;iqdD}H5wY^?5Rt3_+PHJQ zYr~Fhwr?i^5}{>Gzv&!ZIFLM*zezTQv0F~;s+3xPM8anX052?*e!bWTrI&Iv?jt+; zI>plBUaRA|#xd@f!PbngdzH;O{LI}Qd@B$@rMtM(?sVBTdVChaZ@i;IK>vH|Re z8TJdQI?t?d%8E8>D;}x3EOqyvpe>o#7UgqU(FjHY`@6qZ9cN_@$)>s*{g8#h_+B)( zVF6IOL*Y#)ysncmd3Oa0xP{3fqB!?02xVDfeY+B0i`QEbU|B_e^>3BPQVnENO_7^e zdrP3ld{NNCC zr)k%LnbO}O>BEtrFgFZ0d2g6W??c^K>}@kjdilNw@on95fe}Z+pf_i_)Y6)e@WyB- zKAoxuPH!ff&LBhe%c4hi9l|$)?9^~zgG3IRat5s+2<&CZQjtRx^A4t*mwIjDBxT5eq`_; z`!gcZ8k{kW2`0@vRW*N+ehQ!I;lYesy(Y8NmI#L3&kfo$j%vL=MGTMX|V-{mouv%m{tsZeA z@0Tv@K4`v1^_A^oQM-i#j4+-xmwHd~ysv|2$40=`-|OGtk~3qUn@_Nreij{*%FbOm zwat~M?O#rN*AddXH@}kyaf)p@&M{|dtvmL8g2wcB0 zkH+Z;kjKT_u8K{jXFkn43Czqhbjm(C9(ZTm9cS1g;N|O+pcBmLB&w6FgzJ+QgXuqH zulAv+#+LZWLh+6UR>#xgVaD)S4DkBem~NX^QXhi}H}LIF9B5)(gdgJRH{geBF{@c{ zAwK%Ay!@SQobvzi&3Ox@juDb|+c0a5a2<+*t0WCZ*eI$-)o$U86K+Lh2?{(43?1a$ z$SzP<^O)ZNtaX@e5D>sSdxx6_9A<7%0f){!3ln<1!#}X9NeM)vgIDJ`*tmM_7EtfuWHP%9FDLmBH}I*GD$84`!1!=Cf*yGjT(e<3YAafs?@P#dmD<%r?E z2p%p={NFUHQ7(9>w%~qcrH53_qg>B%0|WNkF>QyiYv$Pn<_%HD5_u>mC4P+}-U8dy zQ6&pyWQj^zCH2#C|52EGtJh{?qIkC^=FTZ%JVn4Ol64k;@-^=_=*I*c`zJ zC=2dWYC%9JckSV{7wMpaGbQ}4DgDxM8!OjoLeRV5{HH+wGPjn*nVozqFP@QU^0`+m zFEZDJTLprFl7E4&=r0<-!bDeBBmz+_@uLt7&N)@Tx*}S1Ca=T;)G>2N^fL6Srbs2D zkB*C2_uhH%V5mKzi~5w=ixz4ALwi#(#b)ON?T@;AI0qK~x#3<_lBh}h66mPyE^s%x z6r&CI{%j|rA0Q|NBIiFVu+xpNUp#vYG70*FE+n%p)YI&~V=-JFRy&k1!qk+;t~6~$ zCZ>oius*!jdjXI*O1n>XNrh~i%@V(Tl+u8*{;pn~!mE^6Q9#M{S|ngCNIXkz<-{og zK1z$A(b}w)$iBAige%^L4#K|^iHP>S5<y>)JKhLcASgs6Eg!F1YID74&1ZgEo=! zx7<|#C!_J0V3EIENk4bJlApSZV7@-Nw!Z&G@T$bc55iqGP_&?}Gj`t$YJ?EukJ?o0 zF0|bKTSLRMh0Su~D%?>*Rb@VMEEixe@V`5C?b~p%d^0BoX}@C@bg?{rvFW}4FkW+4 zS(Og-GfbN$Vz!RUh$1(9`_BzSu_ju(pqLxMdKdxowR2Wu&5qQqY8-^KL{*Nz-Fnnt zD9UK*h}AAf<9RlW>TUM+5laoxAD}|`mPZ;(~ zl2RLg`HMSEnlLu*IQWe9z&9Lakz0NyO5`LLUar)?3sZg<`LAj;9)eVJB z0|%zcWrT){(u5`zt`NGdxoUe(=)x9~QjDY=XaL7l1K=g37p7I$bykaHq6-7l^DiB+7_m(&(}{U< zyLb3ag);#+$!!ZMshrEdY1{@$Lzyfr<_Ny=P-PJnKi{1@bCFu|wiGJ9F_sA@>A15M z%&b;@xVYYaSBJh?DdQK7wI|+mS@h* zM(L~7D{&15v9fL`RxqP|GmBn$h?m`PJl5_mY(?!oI@U*jIR)2s(s~xL!}B#$;lZ98 z+q+cVmuQ!vtvHS?rDaa`cSM`TmABE=Od__gnko;=x?^Z!_B zhNH4rag-~%TV+nvUoanvRBW~QFx17?UR7+0p(=QNJq$@+McU>&F>9aZ4R0zB{=iKZkuF}lo%O|?z za93+1Fnva&r-_|_JY8vq+R9N|F+UYjB2&jgbgL%eX_q5`lI9J3^*4L?qD|2zp9*a$ zL1wLsf_iLZ`Y+{Aw^VkAhV62yrAt!oe5sI@#sO&+ij9OOO)%+g>kT2Q-bEB7O;s_s zVB3G^NIHCG&~$Ttk$e!8wH&s4eztoIZWOU#P70qoLEG+X4}Aq+;)ESSU1Hp+mzdt= z{snmm?Uxg$Y~;kd`n>kUdDx}oynM&7p4ZwtlcGO#GWoH8m_}opeInDqUKpp&l}YSF z0a8L&gqri7`3i;1g#`6Z9FVlxOA1>r8$sZMaYA~=Ha2dIlrL&)Jx;820-b{Vs_AaJ z*Q@UPj{LXXAjJB-Cw^Buoxeg* z5o?qQO!P7djUypHU+<{iTh%2qN#rX+myP-YgxzV{h|-Hg!X9J_CcaXOg+RVk153hp zz?p5ygf$r1-$1wW2-dfz8g&O8ZNY$A;6mYpFKjh^b(lo@0z zt~PVl+6D}FY6bB!hymvt1SuH7HY-6j1S0zmHXM77abbb2c9!o@y)-8M)O;CXi?WxdMQ-R^td4C zqrw|)qmQnqTx`=YFmFu{=i_pQvdj#?6Uizovu66hYL^V6dXy+Hs)hrDdcdPczj2b` z$YPd)wQ;#8wZfHem`ZUe&8`kFd;54~sWYtD5;< zA#;dKlvfI81B-o5AK6M5$P~j!OI4S}0@%ax%m(hr6tjUzWe}o=kK?u!NK~TmZGqN} zbQPC=^~%N0l!_?gsiksJLt~*D%&K~LuaAgz+`kVwd;m)ujG6&!4RY4a5oOg-=v>Jh`PP+JUv#OZYCH>@%KQn6RgDwdW^0K;*#%nt(IiYG z(PwMcde&cY6W@iOM4UE1E>|q=_GI|T6RSei17~$*L7q^>Rl+$eGXsr!fmjQ=V26vL zPVLq{0ignSaagW12wxgpm|+B0JnnD%1AH5ei4x;~&NAFfjAwftAim!UroU!>wo8-C zx-!h@hWW0b*F9xsLuh>{s+X*0|Cj?mze@zYxx?!P{bP=Fi9jjTBhvMF*q0HaeIrGq zjXUg0xPCsPg~Ym6k$<81FqCuEAJadB_8K){VYKpw-KAwWoE9uPR1j>V31hPwPCh%2 z!El@$fBQms;^(UOe{0phE6~3ce0C=0|21aW|G}7L|L=@hH96<(zY6{X&2t3en51NY zQ}v-NAlEEwWGhKtoV`iTIvAA9?%P+xXH$N&W!k|YY}?m<_g>u#EM3uIda(ynXEHSP z$zuMThPD0|1|ab$qsGE8)*ci!B28USl-K~t0bzcnsrf|d5nhN<0cAFscr=Ex?Q)6g z7{J<>YU?W4QBj-{K8y}h)N8uCdEf_@@6OG3#`+kE$!ckrdds^>abyI)O6{wRo9wcI zU95@0Zu)0Ubz2I*4DC=9Ci%c2a1Re}mc!EhdHLvRddQT2P#YT}FPHC%2uCWtLmz34 z5RgwV{-Zb^6ouA>vYK)Cjbpy(m4BKCFNH@hZsV>e_wkKC=b7?>S47o`!)1-2v zU%&b$;i7cLwQEk%Orl~5UdlYkGWeZwpphM)lRzGvMf=zc=0?V6Cz#;js;TFbT&GZG zEUn(TkW};PHBRLKMk$@`7l)R)r|}klLi!N!W6u_a-|0fy$Lk-DBxHYs;7ajLyQuc{ zg1b`#U^vZb7j-zdk6uh~vv8wu-qR=cbtsq**C2@>o$^tE(is&%sP;hmN=GZXRp8V8;ZZ&m$%Tj(6uc`>&z55e?<28FVXN z)d7Wl0gP~=aM?(0v(?MJ5j702pJ3izSWy3PVE!ivnuGa2AOrh9I9?q8mE+a>x3~L$ zAcGE7|As@SuKwo=Cw&5m(3a#?v@#Z2Ytoux$zb&Mr^pA@*XYdUz5IMTAQX5K>j~HM&Je+^d!aF0|l<%9#^h8(5KS=7?n?>iaOr6vFetHnRY*)s?bf7)lYTLv; z6Z2@-_YR5>=*oYz^96i8Zzws~dIi+l;w9j<3;R@tu zO0_dyc}7*vSuEQxtn$N+aJutMX~c$a${lfR z#sLw*WGUEOV?^`_WV~ay&dn6t({w^|i!U*`Q@=3~2WmBL(s6JMRWR*tgjDdFTDAz6 zgiY@NbigJ7oNHj6@{w_~u&{+{aly%x_a1Of_32(plfX~t)`!yR13Bwx3+dQG$fe_^ zsd#iru}b1DIJd&^>4}(F^@V&ju22gw4~R$(#L&^KvWG$#ZQ-R9tYi_9{7*q+P)K7C z<=zAhY2#IVVw^2WZUpH%t=Hl0jLo&{@r|T1Pa;7v{)7(%{Z8**&7E`?LL*h_7()|$NkvBm_OHaY zlQD@!U`*?Z^-0ONZusM*IZmh9bts!UJXXf4)UzcpbAvLpk&szNcg!tG;u}s^;koKw z{lEZ0!6t0|;+{g;s;DG-0u;_Izu3dD0O(B}8NLbYDb<{|(Um?pKSl7^a;?~%<8Amv z=BDnHKD^KPy?7c}?{9PlTna4NKF^+Cb7Jf;*jDGLdx|&*s+1O=5#61e_9!llF#J|P zPL;YQ*A4l;&?%3IvIINZySU;{rO5KxE)d`9K3Dd4i8X=h_Py+S!NLv&kXLizO%)L>NGfv><7RVAB!;}uEQStZwP_fl_bvAVp zzD88?I6dMab5#edIW8fwGf`;L7xy3x8Xuy%2>3gNI9<#m**;T$5ull%?t_Jb4ns*J zK)N~EYp+7@K-X5DBvmCnTrbp0qZg(&-Bd`8hkG~fnX+-anh(JM%kbGYXAIqa4AYb}%C9$xjl0~Pk%z3Nek zgJ_Ht5iOm6$SWrF$Rl3+PyX`Vn$EdbZB$0l$x}prxvFk>69&8HRSRCTdTRCMb=y3w zC?MTokNs!Bi0YP1W{iO{%VVZ!u3$OolmvaZ`U~GUhr8AzCp!F@H`XOk01NH%gX)!v zy$(UyHe^^(;%=Wr?{Vu0$Mfb<6{lAn#gQXuUJ>t7+toxz)FBy^;Ie}rf$iP&Sidvu z#?L+TM>`3TX7&c-JsTnX`O+W?IW}WFe7c4{*f@ZzUh<1f8Msrp?7k2pM@sL#rvri& zBoyTEumx*omei?3M+5d0@Aj(f$tcUu)E{l~iC#l43}zWswMpLl)w1PM5UPGvh~-%! zLm~+$uP9iX_r%k!D}?7_OV+LMh%UeD$XGU3^I*Jl@EZP-%PDp?eu~=Lz~NToh1~Fr z5%5~F7@YAgUc7y`6i?N@(ZL2KK79sdKte<@9QETU%KKPIuugNO7`*qio1qeMiv7Cv zWpvx&;~(sFj{nL|FIAh2%i%=Zen8&=FB!RmwRy2q z&Q0X5ms&7Eb}d3K+|rYUQ338s_8I=yCd*X_5kBrHR#FVfSN<8klh=E2WLad#*~hx9 zh=R>i8PP8d*4`=zKB}T6F?6-Z*IF0IUvjJfB{J+J;ew*bgJ*uK??4iya;6h)=m^Rc zC7Z?XWFD_i^>CX=G4?#=LdJ1sRiD@cM8{`hA^)ow*L~Haj7h4P*MN`e`X@!(xygl{ zR2@v0s2C+l6_pKtFgB9ACvegX*p&M%!bcIVttXGE64sJq&B6mQPI&?`ICIh(#oW+^ zldG5rlqs~r#R0nt9UVI*0hiWZK9O3sie9es66P8Y$<8>rRdO__671Mb`ZrD9O?zmf zk~EdK=3;3U5sp7AD;+~BQ(QC7wIYGOdyDPY9Tg%Hs+6|vDwY(BN_Qz{*kw4SDQ|lM zzMgTZbEq6aC>ZZ(GWG~1XOX}#8y5Dl%hpTT*L`(U>xB#$HefP^1oxo`E*peu){qjG zTXyZo8FR8m6CxKK9B$jiD0;pApev(ZD%C@$wknRdqy8{_% zsOO^sDMZXQViPRbZD;N9-%ZVObaCoCQh8qgX;AA!VnPVl_eZ<==`{FkGaUwtU6zCjq&^T7QbJ_!GoX#v?PCS zh%Uav;|d(n4&@c?Evap?){0fTd9SX0fBx1sxH`@`41BW()r>S_qTTy>;VK~I-_pb! zHXd})v+mBTl|kd)&|c1#7stS;xBa9~Q?@UjtTp#Kk<+k`wn|;`R^!;O>kKYkm>Klp7N z|CQgitU392$`E7wf~EntYC;qW#m5tKR8NI(nZ>h(8rOXSJh5RIPKuF?+};20F6);d zuzcms>nd7heMyYK=nu}9EzoZvyorcl|1Wc88$74A&ql*{jRk))@Xk$J8{JkJ_T4X( zgW&DOvdv-1)1(CFCK~oMZhQBi!N{7JDznj~2sCbIBh*)B@&AenW$zZ5_`0S#M0WMb zzs%!Up_u&BLN1`*G<-x0Q-S$BiPyXLdB-HxzBb<)ix%J5% z#Ha#&!@V-T&lBM(nDbh}zYelI6LS5`&#%EmZBjhVRs?K(-=yhAVdtIS6$_DegRm-h zg#a=K0*-bwAx%=}j|Vl3l7Hv&X!Ag&GMZB!(wNDO;^K;yXU1=l?2!|*7q03o>uy*j zcr(~4O)IpwO-Qzc#0U>XD*=1@A9F_c7soj;GSH+2WJZ~(U-fCE9vdiCU}gJi9Ej>>Z@f)CGnJ*@fGcTf5cr~s*D`$ zJ&l;Lx(bwpP$RMBZ0tiO za!rEs$wnB>OxSQ_&uSK(tO%_px0a{FhMX9lM)bpCB8glTczPzbFFDI}6^QrW6eJ61 z04Gx1`*9RgX(B`sP>m`(DNpKWMIza;sG`J^*wOZfZ}7zZhP4>Hz=yuX)C#d`D@Dm7 zOEjXQ)H8#>E5Fn4Edppyk@~T@w@Gr$639-eQz)vXimadtl)dPYw8~P0g!N&rly#>| z`+KmMuJsV6*cD>4_4KoudLRxi{si7W|L7M>pn=z$E;Rs~VykT!L~O|7xIegZkyJ2C zdZOk+e)|K)H4spHoMt;0$%>P@S#OjDzB}fWlB=1`E0d__(_^+pq2^>@zUyQn=vpd&yObhq>WoI#@@X2Ewv*uyyGXxZ^YSM?6?k$Hqp5oRSw=xlo{cjSZ zeW=!wMfYVVKIPiZr2J z#k1lMBHUEw@aE;KYZD$}pU@rOn1yj=efl8d`BvoO-tdbKA3~S$nzyFT*iXz?Z`}90 z@2I={&Z-M>cv>G@84>j5$vf7}icXvm6`pNxJVg|I;n{=PsoPon+`{E&v67~`nob@! zJ;%G6)XiOY;EZ^s;xQ;E;(QaEwHv1}nPh5a9A3d4@;i}(-ctFCCOirEUgxH(m!vow z{Juq&n?O)J+WXOPl=_6m=+-MChpxFhuN*!dGPHTv<3&!ppm{^y0IN=O{84 zmkh|`^`c9tzah9Bdlm&B9Eo>M6OT-I zKn}1Veb^M@?bk`KzHSIANrC|PYRFCdpV&K-4h7WA+t0>)v9120f6K$3^6h2HDKoEr+xAu)06wZ~Q`LF!&-{)a2Emvz*U??*2)wCE_|)@?AxfHg8uU zKF?K;XREIe%BBuT-npS2Zm7WSWv$69ZoPPO2hAUCFrQf9)g02M~&Z$Y+jj>_Ye9o`6;8bBo zyouqqXrwOtx;#=wHMUDcwt@!pKIyc6ryurQ?DFa24|v4LhA*w5?qiYJ>C$ZXPxcR& zEj`Hi3>#ZMO|#QK;v3HA%Z+|2>6?^8@#bScPMYKJ(#K^)ot4!`yBOqms1-26wJSE4 zT6R|1N`sj>aL`+7zS5WlxOd&F$_NmSupkk5%3nq%T&TIW zc|>2NNzM167V;gJO+Tk)9jCK+TDUsK8P$CYZHKHpjprF?rZ1!3E1_28<16OJY!hW$ zz>~>nW3TV8@=>o(o~<5H{jk^mB2Zk|a<2hz5zW+`q2_xB$RZJt^F@g%G*8UX3`ZUj zW-E9gC`}bdj#>jFw0dRct!3p49fkmlOiNyE2js5F>}Et8I^Y;jN<3x2%aKJ^bj($NYUl1d*@YjR!5*rfEU)|2@+V~8IJ!&a z-Fn;kTq9Uy}M=ych8yNf>sRbn4iSJ*?kr4Uhy|3zm zd=UqhE_pyNGg0ZTmON1~rIRR}fofa{dOyz=eYA~n>v z_fkR8Uj|>_dcrUQ=MKKt$TOqU3a%X_b>?{Q>D4ZKj2THquJaVvW&8G_(jv?Q-yV%d zrOB{Hq&WeTMrDFY(WjbiwNE`MtWE5}29>%=#NwKJGUtGs$@$o-P=Ptzy4lno?noHezr!S@Jm3U9qK0&=v*L)R}MA zeLOwQ4b~UcNJbM!MdHi(UgRqyXCL6S?H*Vh?mPWx9tNYkOYH{JOlITVr8tjU49beN zTDoMf5FXNTN}%h!{-$X};c}JI!P<9~lrlOh)(Ziyi1JeSpmhGC+(mqcDqq!@PX4g;jl)Jk|bgmPz~mGp2=C9zVbQFuRn@H2a!K|b_UP%5y2np zSjeQdx^hM8xy;8xHTd+~$30+93?R{SK4tT8I7w~n`*am~n~pGaU%MA+pGXHb;XDOZ zx1(d`uLi|qAMSbG!BU2gUu-DBf$w(d&wYAJ?pg4%$2Z|c2@f*zL8jMTWm$>2xv+N> z?)ZxJTQ66%*JD>DFefc1)!N}J@{5XVbj6IA6Fyk@{Hd!lS|kVGii@D9x8ZFMUAfP} zhxxBKA4w5~-#!7xQ&CH-cuk?C%HPQDymhM!50T)}=wyReGQ(z*noV#ZMaf$iI7EWd z^{KfWZc9_;^pa}W5q}G($X*WHyT>MKw-tlf^>)^sN6I!kIM>>HzKnsaNU#N44BW(T za$!`2&S7L~q6CnnfSDSq04w)7NwDI(z6!ZKq7iy=0*;=c;vZT^2|~nE+9e}_eb%Jn zkKRH2*ar5t*lzB7+kTE*FWv{b8u#r)Cxr^&_OYG!#?8t6Np1q26r;09>7P-1vpPSw z9+j3cK<*T4DqH@^BBlors*rv8uD#>ERVsaJI;Gm^OSij}0s_m5@ z2+6ZcNWe+?h>j523&#fkp;P_Pd4|J6xJNBLYQu>(vKLP^rB!dPT`S4KDGW?h$g9&UxUUBfv_1?5>0fI`-GhHz8 z4Di;Suf6JOeF^R##qck*_Z990fyrf}IynwXHBm~0sED}yiSf-R3gZ(_TkzDL-JB@- ztOAdvqtbAyG*H1MGp-;MXW<0s9qxPFLF;(yC0l4+KBI{yP1ijqe;f1Id*6hkI$%xx#&4x7YvX*1vk4p5`Yxbnyw)FLv zPSE0DS@c?;^KDTIf{-32@3gA!Lq(MYl+F(uAT)Q+$398guI?YbWU14C?Ad>a)M0s) zFdBlFbK|r%=nOEr@eWn*_I5Y*Se!am#x&T3`kpJ?$Fa|>E4PN0%x7vBNlf|U%wCO$ zSyXzcJ@w2z1D5mq=nzfL6rGt(cf2!2w61ML;kt)o%fjJ9>>6;C6Qrao-gIABH{spa zkChbc!`^gCw`iKs1J~*1d-l?Bn?=_?jxSBF?>!VZnvD8;0stM>p~gT?)_;7pI4)WL z=J>DHzZ1fFIb{*}^)f9v z+Saz>SF40*vD>wjS6}mt>p_Cjr6r%Su0 z-sL~6O(vPQotSgQQC>PuD;mDEsXK1AJ_L* z0zm80OIrBXf+>jgpS_FyHsVYMmaF5j~=b#Ap5IDqzD(48;#ylFKM$R zpM?-}jT8$DgSOYR_fFA|Qk}%zhh;1Mn)DR*bsOTt*w?yl9}vR%K(^#LT(jp!>2cY0 z7ajkUc_vxDNELH1Kqq0mR)gdko@11NCGwoKj#ILXS*zN)EeQj51sh3-l2eUh`1Tu* z;u5j7nyfla3?he&S5lb5cO=o6k9|_9(Z|=MO}ny!C1_lVYw@ah2sYWqlk+Rbmh10V zi#F4IXq)(<^L#1XzU5Utr$Pkl##7ij&dr9Q*shI*Fm{>^5_pXY zYWc*Hslk@+u|Y#E3G}M_NEaa*R-W_)EAPp^x^mV7$=(!gm2$)nqsjCL;a|dg3IGG@ z2ca@VH1+j2L6o3(Xv~dj99lstWmSUdCF{%>%LQ!$VQIAQZO7HN4}Dl$-edF2j-|!U z0Q$N7%!6cGo2-anR&U+8HL?4g>u#iYPmQfsT*-UpS8uA96fzE@{ghHDmP6Kv#rnMx z1o}QU5gH6LWV^>CND&KJt&{eGl~~h_$;%kO6yL!hvTO0xF9v?E=^jnJ3+%ubL;Py! zo3}e>r_MR&EbMzL$7!(&eeUj8b=A0ZFA_$9a{BEVf7P#2lCMc@wm%2c9l)o0wBp^_ zP!7i|T22ogH?v<8nUbOPs1oW*AHkJZR8W2(EB=8MK@tWz63yG*ggP&wEi?KtC+01X z?2L}-pwCDa2mEY2ECW#^H=7c_XuTR*YE{0HcNv#RcI8OrO)pjATeR%o0{u<=g&-rC zmvSnm};x-jmR+B37c1^^v{|9+1F2LS%TNt%#PQ zM3Z-zj>~Gr4+h~a*)e>Z2L=7jL{lG;=zk=pj(7CENm~koot1=~WkC2Y26)n7#nFaN}}?M;O9l%XyRL^qz2o!ACHC{$GS?~ zQ~H)M&4)Y=v*tNBF+SQ+)tS6CIh(ZmIS%FYrv8-L!gJJ;Q76Ft#~&DAF(nocu!&mM zG3qgXkd8;^icXp0!VyR`!x043HXXm}^zi#US?{|__P1JtYAfi#0c81yIdWdIip2R} zts*7-cAT=uM!-gbeLnWB(a$kf0^d#wM1noej!gVafai+n+iZzaQMqaRmab%#6B{^9=$`^ha%+0dIT&_`nG1=MB>#j#@D7LC?ylsCxhHl);5x($QZf! zDxtTyQP%=(vBI)8EpzZG8A@Lt_iNU&HGMrg)3N&{9m%Tvg5$$_kD`h=wH&)lz2UuN z66eY+`=W8Cdc(iIhi^|R)GH#^tUK6UE=-f=L+1-QI-%I%vnFeM(Jkci9>c1LT~I(9$VduTrh*<*WuX>i&p-Lu@zw(Z zi~fZvHF0Oyu6TXT{*QDblOAL->B*^dop=L0v1`&c*~jtxFv&JP5`S@2eXp3yFy+L#3)QLbJvj%`Jtk}H@8c6j zd~cPVIePC#WYGkDdq$F%h5dC99ZFXnW^1wLtN~;&)azBr)1)@M7&kX`1Ex_o{llz`Od`yS z6v=Saa2ny17Hw}*)v>T|4IRQw61QcJ>R$3}{91@%XZmNmC(cV2VmSY+g_wkYb_Jjz zW`XPmSDxOMW`f0X$JQqBSyYVLi&Ehf!r9crFiOhyi1;*-X_%Xz!>uM|F#vlL`EsV)J2=2e-~~XN|0Um()$eYD{qnJ<|s#cBbNGboryDoUy77 z@4pf*hCG)w&0G`UCKv)l*Rp`K>S$-5WG82GG16;`Yxk)j>^Y!d5(N?sw%^qNa**Dm z4oLm@D2l$N6-W2AUYl^%F$w9Mc%!pvGFp*_H)m|+@bL420+&SmUX-Ei7Cf1X?NOHeYo*!{cC zn6}!wN_F-C2k;H)TLpUq%l7CyC#`b#o9-$2rR0)wd`}hdmDkM|^pQw%tfrS5=1Uq9 z7DeBjg*nwi?44NMkS!P4xl!&>vCNW#z4HE>O-5~SYkFpK3sLMoBVdJ_yytPvbVH9! z%OXX6gcdD+_P)I6)O%BdFODrfcwyA$pI=2al^s1}#P8y+O$Vet{VEff7GVR%K1!O? zZ6>KybUJZ{1K0(oyii9 zF5Wr{&g~x(ocPTq1W0E>%(w2Rs0T3DFbA?oPp0kf-g+A!$I3lQoVUGK?iUmD28m#{ zxefzo_$`uPM9OH+F8z&}8sjLsO%eXCjOY4`NeT51H4164qTx-g(llT)wzttcFA|L> z(6^3Yz8|%qT=Ee8GEK6x{C3R!^<44r0F<9v8v^9P#)beHLjzN=pp`R;=J^B~;>JtD z&I!^+1}IwDLv~LkVS>c6HMF!RIUkx7A(sv9tQ>6h4ecPA$lF@!D;e5r0_257NdU@* z&i0UWqE?W|z>C(C<$D*@K|#Ycb|?oBID~ zG0^{PG3Ik4`#H4!S6d7UaOU6W`3F(Z9f|+!LFQlF^%~^)-4=hy^Scj!_7}_f6MjAI z!}1#||HuQ~vGLFLVYxmH!1B8-{*dQ)AO32e>%%kaC3uEzeDr7guwEaYS%0_1KkWnE zBIaN6TpylUFTpeP-S%%k0C3uFeTmMU*>%%k0C3uFK(f=jS z_2HTG5*RMgLPCAk*~$8pw1BqJd1myYUz4 zV7fj`1DP%XHIV6dPyQC^`d|$N{%(+e#(5yq@6P-s5`+a_*Gv)k4-xxAq<;wHZ;`GK z+(6*(2KiH@-@W-uB+xa&`ycZ4he-eM$loGeBfKx;h(PGqPXDC@u8}1IFQbXTzjz|> z8i^wCGNuUpiz))Ikt+h3FM~JqV-o-BxND?~kgZPs=J&wA2qR>zr(=k@krobL=wn;jqtvVN&^4llE7;ulfcW^B=9df z3FNp&cwa^+fqyYdAjdVr`!Y@m{EJiquaQ*(FQb*fzj!5(^BUoO8M6fbMJ*u?_t&Nb zK$lTV&|lONbdA&!bQ!e-{Y5Q7OxFi*&}GyT^cS@RT_d#wT}CZIe^E;i@cQ5lx{O+a zfd7+Pg07KTf-a+$pueak2y}hg8*~}91pP%VLDxtvL6=cW&|lONbdA&!bQ!e-{Y5Q7 z*GMfvmr+a5U(^zGjnoo!8MOrcMJ++sNG(B^QA^NY)DpyUjoSM%Y6<#_T7s^TT7oX4 zmY~0=CFmNdCFnA03Hpm#g07KTf-a+$pueak=o+ad=rU>v`iokEu8~@TE~A#9zo;eX z8mT4dGHMC>i&}!Nky?T-qn4n*s3qtcsU_$#Y6<#_T7s^TT7oX4mY~0=CFmNdCFnA0 z3Hpm#g07KTf-a+$pueak=o+ad=rU>v`iokgTcR(Vq#!Y){ z`Ft9zhz$IBI3J=Fk)ghNki$g?ItNrlhR(Ybk)d-P$l)RZbWB%7hK{3kJ68lh^bvkn(_p!4w0a(`Ci!ps0^#h>-KAk^pKi+C5*5fc7cj|-9n3ID9e1s#Bdf42X{ z#1|6&S&xe;-g)?Eem^_mVg>=Z{<9k{#>(^X&v-xUaiNMK*MHXILg}1`f5!V+j|)sI zB5RXCmg*cJ-mvVTKiyt`!|NxyguwP-b1UOtFuPa?fw<*DUZsZIAz@~^=(Rr_Xa7Mc zKoJOp^y@i@0E(Q*&~+VvB0DmaPyUhOJp9w~@4rg{rGHmTalWqor*q+N&r)Q7k^qSj z*xb&LkMHL?CDhmSSN0%QDWKERtEISd&7qUJE0qDAb6qXPm1_>2v0SMP=!D`*DWK#1 z)lys;?aLS1aY}itfV4;cBHo4MkT> za`oz8UD*MlhLEcXc6D`ku||ExQm$V8t7|+Ulqg?Ku&e7l;MJ8L5K08ECfL>09`NdV z4|sLOcd^EGwYpqg^Ze|6+~eYNcFV^uCDq(S66)(Hq@&L2DNcsEy>kY--V6vYNcFV^7o4x3VR>SAFasQj&?|dM6oaY1mLEb{=WM+b} zcn}F2WW+u{{yJxaRGuBOAMp8)8ES7kKRb`b39L~!Q~n?BLs}H_lCX%SzLkNgr7^_10kwAklpOTz z&tFMCH@E@+u>)M({)u4dJIlXP0?wiKJMhTVQoz#A^mka;)X2yX^4c=wJ!MUZ-HHid zWC}1chghVT0T!l~4tCoA6!8b%f1_7KNKjQs>L+>?tt`Nnf5G>>rixdGFB1t1)SAUa za^77~*!+a<@2-Vd(f+@}_Z$-EKL~iBwm3-lLb~ENSbu`|9FFIm356#Fd{EFsKmv^i zxd++*`qw=ukbb28^f!gHG|DVVH1yE+lri*+VS2Yyf*xa|1(&?G^~ob1*kIgk1bT!u}81 z{TucwavDnFGCyH20kKM&>iE1?(YZ|EabA-3ibRJ?|#yAGE{HJ0AkoUtM~B zJpcQ3{G}Ox<^zd&4n*kh4^aOJ&Wl_jIY2;r{;2)bx=>yG3+T|&AonkFgT{htYDj5N zU4HQ&66+7i{si)$fIL6Hfcg2^AMpGK#^-t%^81zQJg0N1E>iuh86@-zynkFdzY6(- zNb+ycolor*|1;?RnEC(T>CQjYCvS16t|1bj(gzPk-$p~37XFS(& zoDefJJ1dhmK-3&;Y)8U^3=pu>Ki_NuauKp~1lU^K@Eq(H!Sh1S@13Va23){Xz|z

KV`^sy8Csz5JJ+O;j3AQ=$UYS`00Dp?KnNfV5CMn+!~o&| z34jzp8XyCZ1;_#90g#piC<9agssMEW7y!1gHng<^TN(f$QxV8RXJ-Zg+XM6fdSF|C zo-J74@chZUIDh@+#HgLAplxAfT4{8 z*c@Q!tZxps02o0>DpN;8$Z!QPg6y;bFa{Xg8bWsBumzX^OrBbs7+L~M0Z#yC0CRx3 zp`9JT;$lPtSOP3fEe!!y04vCUYk>9nt{qTWpl277Kx$-aWdN`?cd!H4K=g;9oxLeU zFsNEF&@%_v0_*^Gh8Ct5^4b|XLJG4pbq3g(gY8TJcGi$u1MC6zCbou#@vewKlLFb&Ux)15U@8C zHiXOz3?be5=X5{_AZ=)AY;OV?95|Wy`0VTq&g@1o(sO(7SV0E#!C!w>h?N z6RvQsr4uidui~0~{!zVr?6I8pao?NbsH2;kXKjmTZC>FewE_>3Rr_=}Vu0IsRa56@ zJ3mIpq>0$gFxlfgF&0jX>{+^ev4#~}qr%Lo2S3NM8+~s2baU`A!m#oaP*}Oq-n3o@ zIl?&Zr>*Wti?5lm>f-X&o$-57`D&~!0C0Eyqj~c;twPVq78oc1-zcWPW+F-$1WSqg z=;XL{3z+&?%@Qn!ot=80xo4k!ic`XNu$P)u{k~zLFq-Pr>e%kov=Tawg}e4qZh9ep z>eEADt;o0gi#XVBOtbQfkd51?#mM>8*v}evP}t4wNBYW~w??TazW~}cv<~z3ismHf zU#(H*YwesaahlENC5S0((L7pWY!A^8>&ifrN6GZ=6I{Y5_2-i2R1nK->Qh*lX`CGjIUN`X6TuJ6GUxYD>0q1<=7irJa&eMhgDOJhgma^GrY z;`K?l`^JiNrJG0!2V_0UuPu zy?@r+$F4Z>!Sd7Rn$M>%tb^9);=Wjw6~w8-aI>Jwm?b(oRF2#K*be+Y$x*_Q&QZoa zk#L7M)p$NV<_JmyK(hCU$vJ%Bz~pNcYcK&w z+Fm}f{TUY?(^s1Ef|7SWcldI$nP2yRHqQ^_qG*mOkxh|A?vHGEGGb|u_hin4)9?&a zwa#|`Mv(57{WS6I-l>`!Y_+pTy3EOoNS1dHARGOSDYPMa-bl~Q->VBwiqdXg7I7A) z`jD2ZFi&9EjBQ``QL&WQ`zEhjdm<)c(wY4#V&Zn$l?_vYGM8@N6cLPt=>3lUBnKA+8y6$Vx}C^1-!`=s^}O- z5Vkfv5X?~|EovT6b58;*__A-m20FYJsU|C)XbvXsSS(wCe*uKuoz5p*C*yLplU(xq z{!U>s?mIe)l2p+e^OST0>4(SaI!Yr^YvLX%K$gS67fv{i>teXIm;)A`(Z@byiiEMG zBCg?fuCvyVFAd0jLBGAP<0qlZ?aU?c6|nR&`uQjuvyr?A(klVeEE^hB%7vyV0+s|C z-hg{6Ubr)9L%2r`f>k$eJ*yc>SJ9q*TrDkco0M$8${~a6+km&ySvgP9 zZ!ihgeZV^lR!tDNJ><558L!(tj~l&)gKbBm#gJ3U92y%Oi9Op9Y}m`C6Vlue7z?j) zuf_{sPXS!`HfK!jk&dcgH25WbVrYhF1tDTc&YEHj=L8B3G?=LU}5wCr`gxtv~UkRQ#b4fg;`!jA21qM&_CVm1*8vE_#c#9BNE*M{Xkk`&2r*P` zArgo8W-v?jyG(A-?#ak(NKl`=fBS=j#6M~Kh$UF^tx$zJ;c069KiionX;<)Ri-|aTzVQB(SuByj}+PJ?hn%NfO7dE#|KIhlPSI5w7V3UpXf8l%;z=xzWTtWVBuye zn8vQpu8~?0%%$d>Pypi#=JaGiaZx+QjhV{MY43{{>f||8Ggz@So{X)LkJwB5V1+RR z!f+0e9yarKM~bXDYoXn0@i1tg7n+jekEyiu7Z6_uto9QlgCk06a!g;(#x`g0~T)QI40 z?;h~%iFYz*gQRq8=PHdP!(f6w2VCx1X4#U_1O4XDhT9goUyubcW#RY3bSf;WH;wV! z$%{2&>^estjc-u&KS2GyoYb|wTkm5#E_Rzj5MK6OaTw+MGR>GJPK$)M_$@in#h*6f zg5#%04%Lzf94hj{ynrjT8K0kY^to8UJN3MMyFnY_zoB&hA!Y;f3RQ+H>kCuW4|Bcr zpDWHxKa5+i2ATlIADOm)RA@yE3&F_YB+0y^zPk0VMQ|FBLiVughpJBf_Z~0;edB}b7qIo zi_pxXcRlehgOGPbT$+9C=IpD>_%*|$g5YuRj_Yue98553=`3YsJQWnA@?M8iuktQg zR_{qyBr|6#d+UWuQX)-86TAyhflJ#q9H1DJ*BUHI!8D+0TWhCuQf>Rb%21tW6!thS zwXJ`pK8|2^&^wX7+fX${QA}Ayap;v;Xxps4kkMn&86xZZuKjfsH@N-CTHK`5eS(ilNH)EdJx_zXp?Y5qiR&$5@NTF-x&U8r$FsqZ z4wz;;T#>YvC2V5_;wM1+9Zaw0)i=YL>&~SFz&kb}ypLp)PW5x02|{KVU7G?MFq!Fl zGiI~tHtu$J-yEAV@jJ*Dd1sbkxQ&Ykr|~uPowSTIM`iu53O3|hzQN^jUsOFBx za})bjiT8wfSkI2{4p;|UvNSv<&>{aUCqx@6{yH8nHX%USWNeeCu*@_5&eQn%Myk1t zg|s(%)bbq1H+ETfn!iT5iD5kkWcY#X9B6LRDq*F8@$e*HfF9&Ys3fRh48G4363MKp zO8)Ukn8g6c0FQi1#%+ug#6-u!sD7UW^-*RoNU;QI*oTfi+T>d@vH~TDW!n*Tb{+@& zF3uw<`frkv^!kL7uSAgF2|Q5|joz_t-ajs}MR`!mm+G(%M%|!LNwphdj{U|`P0YMo z6ny&a>oY6AO#)lkmW79Pqa+jig!4&=vYT)G-`*xpo2IF0P~Gdl$Ka1=I_ynYz@azE zH<=mr7HI>o6u9Y8=2%DcZCG4j(RY7+is@6W5E4GdjNV0crx5d*3gO03NS=FSQ zb&=5Hp;)C?6Z}Jvm=GG07*<$E{cI~xMoBqGjPp>dkWVKmY%_ZPo_+xZm&Ug*SdJCB z6(xD9%9>Uyrk*#0Dk{)aGNdFmZ1Ga;+R8b^vP0rJ7NTInP`5*5cZE9NH%!*&Bx&TM z;?uFx!s$In@^RZ~$=3UbVOLq#$6MrTLYY`<@*pv+Ne-t0A01HY<|tym*RhLKa_Saq z_T2DTCn|PWrm4|uT%QA%YoRzW(1vNgcSxUsz}0%1?E^p6hdA}u!Qu(;O1eeTCQRmp zUdKFslh3ror~g6z{$@+!2n#Yv(ve@6+RX%a`Lqc=k+s2XD^S=?TwrB1=Nc(Sr>wF`|B=u7gEGAzO?ACAT>EoQaP3Up3(@aRA zzlz%uL;TDYhCPhPxZlW(WB88hy~+mAhPKe3lkOw3)vZzIoxn7a2U!I!MX>s1rK-Dt zqY8@?17ng2-U)^wfB#AdA*N7VV7}w3b+!U3 z-GJBuLb85qKG(F%ZSobz0Uyz$E)MI5uq)FIR(@xv>->{r1YaJXJgEi|vvQWP^zZU? z2))LMSl?_x%{UY_N+#N&HN_%7wx1bN*cB8~^k0}Z$#|W(b5i;uO=d@LI+9xJKDQeA z)4g$@v{z5XDkN9=HJ3x;)Y@0waew!Cicu(mo{q+ z^!1FHED9KlbH|IW*K9bBb-fqw9@euE+l?ye3sKeC>66BaqV1}YGRTR5_jK!pcZ1VE z`tYeJlO!Kho}AnmZYA1TESvQ7=+#ZI&9}wI@NF3`y}O#t2Qz#O#b@`Tre6#kc%q3= zu~EpW1XSL$e9t=QA)_#2CCaBg^I8(Kr$@LzhqQJN32k?$$Y*!2T>bD!Xv8fijbaO! zDgrK9qrUO^8Ex+iGfp^aLsGKm1Hy*ys4;}HyF1Vy{eKN_y>|!u66dAc-mB9xDp+{lLK6!V*%Y4&RNjxO_2=>4hjevrLpslBIEG9h=s^By5Ek#|g9M zifAv=6+Va)b1L8?CFM)Z1sflZjvO97A9ZhLwX3hhRvV`(e2~4RC|OJliVyG|EcWHi zUdK*X4@XU8)AzhO^tUyeKX(I-IZo}R~c4ZxUy&Ux0-J!_ARiEl4 zKTLim=3QU*4)lvDwJ}-dz~d$y3CQT&t3fUnUjOj{eII08?>yc{qcRsRH2KxU=10Io zXLL9nxetDPLP>o)4vF8NI6q5dwth3SDgsBgw{A;YvAd z|C$%?rkt1G_i{h6b@{Pf%aJl*UFWCi!M*=U4nIj*hcy8E2{^`q`cB&#YZBtWa-(8 zt85;9I%&5{VryBlD-`i=CU~7anPsiT#9X)a2nu|`**rS`IsbHj>XtmB&uw#ccs6G= z5B(Qdi6J`Gd!*}?G6#2M$cU>9#$9+GM&3O8qHYcYdKcA3pDJ0F`h$j!TYC9*uApfp zLxSX+tgZnADg)X(#SiC^s}Q7zvq-ajvUFh-s!^-N3cTc$jX0NSBb*ag5D5sDmhKTm z+CTN5?l#zr84L)meOs58=OwUgJTnnHcs%}6>N6NKX|%Jci0RF)2^#IVd@~P6mDg@( za2KK+4*|}q?E9k$PWI@+xVop?QOIY^VE(2#j;XorR1BqN|0tWveWybO!}7PK{a-a4 z;I##X+G`f)rxFooMjPk+z9dmOJY@&y6(CX>q=OLu=ZRQ%{BJ%Q;y0*d5Jz*+ywhEO}Q;yi8eEy&8I89X6v3m_{bSR$b@{3`1s!$qs6GyJCt0 zEHbe5zS|+WRWi6wMZa>W{nSlBjI8o_Q9N;}4Mr^!0$?k5x!p`nC zroTg>YK?ZUuA<>|Ge~O)11=~7#gl3_zA?pBH{7(|*Bkxf2%&KDR zT`N0LwVOMO8t+F`#;=r72Dce3e(3pDIKazF(Wg$a*VjlwOZF-Ts}3;goS+feG zb~AJc4G{ft(lkt3rC%`_(6qX3k4#dIzX3QI$6iDLhWnd`^cKl=1*X#`XXN1f&U4y+>`8=|4(0Bcv$(4p)@8&t{l~ z4OA3yGYA*pji=;$Y1q0X)04(6+?a0SUK}G75y)?{ADPX{1=U5p&!!Tpi|IA;p zJLO@|N?Y(3W;?jWg{s~5=FQ5=uWXHoo_vOi^bTCPvh>}OU*5N^Vhmu6_V=4CeW=PN z+$tlGL`23uIHKn*est{mR9t4GlVT*&FvUBdydTTzXqJ-EZ6cXoGAz*x@YN+i5-*+= zY)a}B&-4R~_f|5g;|y1Y2pyH13Uk1P&2MJ`m&Dymd@=QNmjEZTRM6KxEc=7C<4{fK zq*J2?38N>~3}V{eBZL*6G$vvGvF z>kPGRVkcf7;F=O|obqwa3*F>Ije9n|BZQMA?~EQ)%mkx8yQL+_UG+GdsAeN+yQh-A z+QF~IaJqbmTOW^G;%bi6J=?X1Wi2? zt4+enC(8;N3Z=eiz#n}gL7TXf?k+~rfxWXaW&G?MIxqxfB|<(E4T7__0kH7v)4P-rvfkM zz?4d&GkZOS;pWmnXWZOT9CFR&#+8@1Fz@7bB=_&Eos?JR%8jQ1~|Ne|Z$9(U{f6ks>p z@`*xYI$va}^#{UD^zH@*K5B0g)d&7#iIG5^mMN#4xW11%V^*JD5OJK^^}=*=dw}?8 z)UYuyh{?t~S&%gH9M~T7pJd7?;49-iq7VVLYT9tDG!}-`@fqysbT?XOo0!q6o^*bC zR$jPHbePGAKm#wX;j}ERgE!dM7;C?mvsQfeeZuzi@{N3Sbk_1rYq)0c--O|CSn%+)8=YCCbV`;q;J<0o2rJU@JnS)& zhv4?N*K6R_4tLMSDxAW1EIe!8$2NwRK4)AojWBF=wxC_9eJz@s?2gJDEtZZgFWD=n z+Yq@y&K*ja^IFk|+iM1}k4FzVaeSJLvdDxJ3Kr#b>g$zm%QlU#*O~W6P|pTX zvSxh~mRjQ7CJ4dSde8}=qxqaIZ1BO3nrQL9E?Za-m080Oofmu5a5S6>c~?4^(5Cj* z3UC0tm7rTcU~AZXR@blU)*aQbOlcfE*rGHKGOj7NTTM?S_jJPY`Y}1g>Yj-Eh0>@XRexPEd$9RsY_z;p z#QK3=XF=`g6J+xCPuzWL{!%>$)VNY|J8seiK%TscWlrjWTPTu#5cM?_sDHO7Dm+xJ~SA+<{vJbwLw;;`ObLY?4^Lw(?Rqg@7Ms*gKzY5c-jZ zo`1CB=fd-^tv1g+GX8Yw`A?1z|G}B;!V?1GW5@^sa*%LB-dSYh;P~4U0&?+BPY7u6 zA5RD%EJAe>+87 z<_+~CcjyU(mx|)v!^exUmeI(8=T-is0gO!v0 zPag@Fr)o-rm8YRz)#d#flp$1lSf!;ST$;HWxy;=#AavyComsCx2;Vj#MswAz< zD%14=d?tOm`9|HGi5WBXsUOov6ZJ2G%BZLe(}cxD)4CoPnjf?ezf~_jBZ#SHBy?YzEEt3~1LPolF0{-2pYW)JS!op-a1GTq+)LtpF`5XXPj8^1U(Nsg;3gr3Ik_xReo@IS z+X5;}T;dm4OXFWxp1CQ)HslENzwJ!HqX6S<2(2G<`OWyaI<6DlK~Bgg(U_Vf36f{RtD0FX z+=z$8wLbMVDnEGLa_bJRfni4~>r?*p2(B9(hU9L6!cAhn5x6-EwNBHkX6Qenvf;*P zQ>6r`cj{MfCFt$yurjbUWT#noPI>kxeHx2##4ct9R zbNTEirKb|^II=LZ(X%+=lE5^kn0RS;D| zOlpEZ*F=}a14il-SdiDjC&Y+B$KTmxU~lU!iv7U`d#hi3+QVe_gGk}s-iQ~Aj6MiI z#;|b|dSBMb5wzDJSw?u`e{hT2%jd7f2SlePhU!uvuan9=eIO3E$&;n!Ga-scP;w)^ zwf)sxZ6{orqJB``4Q!a=sFJs;H*FNP=}z&wyqLpr5iCeqh-YURI#M_A3h(?st-S?Q z)Xn!lPM0(Sf`CYe#4gM3g0zHyAl)I|U4k?S(hY(%(jZE=BHi7BfD+OY0)p^=^E{u= z=c~KVH~#1RI3CYB&b@Qz&YgSj%ntX(=}KC)hKlQhQ;%Y<_p{{9<`KMW#dmX>4og8~ z4fuk*(&b5`3)Y)~o@Dbt8v3yaJoLU_QK27n0F%i|nQz_CM^T_3CFzl>dP47d>ACb> z%0Qzt+3x zh~+Xoq!T;jdj?q^%`yBuGJPfP`$CjL3gu4fCw|Ms^5_VC6;r-9|B@x@V~>@O5ibJmprmq3+~d1^4OpKirypgk#Ceelx~?zrSK=F%KC zf)rn-TNN#Bi7sNGPb$M?AWoJUc38#`QGyZ6KXni?h5yX; zq47@*ze|r`x%E^!_8$Ye?b>pjiI}l91=~+V#>lJ<^PMXq3kFiJ)*lx0zEW^VjV-4P zpB~fAgteNrw2I4r)V}IYUcea)b)J+NX)e9J^)u+^Vbkqng;8ll_IwS?8k&u}jBC z&&)kJUVOpoX8CCsv*{Jr)i2#I=lH-WAXM8|gPGp|mWi9=#ck5evG$&sb6O|ZY<*{}M z{nlL*;=vX%okweVjC+#~f_p>nTYq`N(@|P69Ic-{zKg9@j z1#yc?Bs$lBxYB9e67J#X=It7&RG=hC-#cA$Y<++)7*Sy_2nNrn^G)<6yc|!cav4K~ zNvQcfCu;J$YcM&K@at{+(CIHsp{qcvSA?(ZP74@{rCeSG=j;m|Qoj4{ z^7ZG8q20=#UIvC)ht#=ZK7ETuBKm!_g;({?WIQzF=ZOS{rDQ23dxGw7nlz0)a|=&A zPfm(t+)>v0Vy@Q6_i30bNnuce@oQL4Qp z*zp<*zmSwnnWMk+6kAbRm?lG|Vq|^H5U)ipMKgOUh~Wv_JNJ*UWqrjjQ49|f7R7Cy zD39+PVbzVE1>KjEk3sP(gT&;yCE~=JGesnI>0mxy%+ycD?|FSx{W^B>)aZqNBSGPJ z_H>bu-lO`SWs1vB`vhL?47m!*WhfH#Dg}M<$$2-2tY5Owpr9l=iYLuFeiUqvx(zvP$3dRi7v)LzZomwY!;ozJ4 z$g2-O@d<=Ehz3yX4fhFy^sZT1F&mD%wJ9)y-uSs*!@OC!r{*rU8lm4=KoaV!!uECzAwtvS&f`2- z&YgAKblXyg>e|hEjcN%=NO44x82;3<%y`z!=L?l`$QAgzfAb#niS<|a2I{8=}_N6(UtAM|5P;vD=M*XW^q>) zou{2d&vbnI{?})UO7|6}Pb=wxcha6QQN26t$vDN*e`7E%uJS#2S5daNJ<#bqem}8M zl2t61(M11SBv*g$&^X&6`NfGcBg2!pN=U_o_zqra&SRN&G7gr_gFZ9qyB%>MCbDDJ zc&h}LW+Y-5mE%8de34|QLIaiO3b-2ef=$Uy(ZTBU55ue!zcqmz35V`?7w!z?##6XB zMP+Vf|Fr9Ch*LiImmPfGKNDadS4`)x*LcGBuvy6C&`BmtsQIN~qWz;HVhvP#{rvKu z>WCsJ^LjIo?-G9kfqq!)9WV#n!%OR<02m_|%l=SOupa3{PJ%vE^lzWD{)2V=D&0 z<>dj%YzbB(h@Lp<&GmO<2?Aoh)E(e3X)(N)Y+ef;S=A?HjLdu5zG|;EwYEy7wlB z9S5PAOuxH;P_D8r&LjVANbiF)ODdAZcvJV6JjS>S^8->2i~6{!>rLCNbEnT<1bV~$ zdZ@UXd$91Ht8tT=v-FdpG|Zjz!N~;)7F+y&e7$=|B%>evEE@eDCAQX`qv0pG(mu3~ zvY4k9C8RmNgki0ByJiwUP}$vF^2vtOtrH8>?tRXMMmWA8kJ1%TkJ>U!P80>h-^Tgj zk?GKnwq;Ya@o#^Kk|F(pLge@wv@D^Kk}Ktt8l1BK$>yLdG5IvQJ*oA>9hyG87?GQ4 z)dXeCBzr$N9$xG$;&eoRA9+y!!p?VQ$`e-)jX#W;vs=roj>?j~nzw2fat>!Qi3JymMdN{e(ax1N|#!DZCCd z1j6f^uh3~GL(wAM6i%Y6s;M3(loP0#Y#Wy{F7hrnw~?`a_k+Rb*V(4N&Pw*L&1oB; zKU|J*-z+kv*tt}8<=CAJUqosmuPklPZHi&WBsyD$vbbfXI0$t%BFAhl082> zJt|x?Qtxq!WoY6q%jU#tn&3W8I{R*E!_1fyt{!%GhrVo-%(*7?UO};n;;S;dZLgpl zx<&($qoMQN%NIR2ZQQJyodoJpDkeU@-2I3p-LCNRS9WWFY^M^9`w12U`itY#5LZUl z2Kc*J?oxTEgKlFT_eH`jUuSFS0=49US2u{8UVJH+=MMlsaj>g^xqqFX5FEkvDjPg5Czx_~#DkQSbaFAN zL=KwPvD0xpMn8C^A^Wv0%BaWlxr~WlP4Apbydlneix@~X5o8+oOaIeaHWy;JoEM8U z?INYuj!ftwjn5&EaU`AOowp=!45zO~9bj^Teb`>R275n~2{~|y#(#aj53!&r^Tft{ zKV9u^N>p+GHS?jyCN9rVl-vF>aXslvaa^{kcq#Z#bJv#(*jN}lP8R686lh=ZDVPTC zd%+ndV1qX>0+$Y6P<$qPCyIJX{dDoP*(1B|N^+H#-f*(?n+26e=Eq;IB^J7~i!4dv zE)l^29S%7b(~Y68>EHuFlsHKua%u5fNrMW`YEfwA(NGD~EYJy#-@W9ir|NG)1I-_$ zC&9H|+GvdLafX?oE369p)09QIe#t|TXyKAs%gMbH&Onnw9AN9vMsEj?bq2`&RkSSe$ zoIc$~^=f(hxvuir*hcq~Y`Y$-CNbn)x?zx;}Sq2w?Wx7Wj}Z75baYPS8ly1FB{ zx&)(AatI}$Ehm7<;_->$HS}NYC$F9lwXt6|Lz;1= z1T>e+TA=0m6PwmptDaCy;e?`6Slv8%yrHnyS;Mq?N5f#&v%9bFq%#iFZZ&&fyri$p zn5NN9(_2%lvppJBmbm@tzVF3eSIm|0Q2}9<`cI$YWzxr?nUvP$f~8+(CRy&%&ckrt zf<&c~ixVSUI$dRxZU-l6Pa2cyOO00se|xuJwf^&&oXyr5Etfj%17rMg#OIAJKWxGU znCfs0C_4aZ=?ncahZgoc8N2Uka<*=toDsQkEPp+zy(3*yFy|=NI(0KOn4|x04&!k2 z>X$TifrCjxJJHL+ZXII_@5@B1mxRn3LaMiO3!`*dDR-HdY+bX(@-@F5Hb^%Z;HsG_ zMyvFZy?7ExPBhg$E1{UzITAXqMN}wW__MOqdM<{RglvJ@g)Y`VohD2xa8W`PK0(d! zn36@I=R2{}7us~5(X{I5dEx}7SkYv0OYeijy56qI)~wv^$P}KXJHG~$9c1!Jardz~ zYzlU1N!7`ogo5>MW!6i@nNOFj4z^ijE~n-Xz$KT z%e;HRYr~~8H&t^pg6Mm9JZ@B-Rx?iwO+|TL#XMEsIn6vi$LZxAAKxeO7n;w=2SP$?s+=J?k;cjFw0+ zXBG;mf8>)C{9IDiP`(pa%%JF@PPY_&Nkh zvADxCAp-?`orI_%2O@pN0i#E>E=(B&8FE9j_V}&Mez=O5BT2zFDQ#hvf@#$&`d`Bf zK3(D%uSX{xXD&a_oqQp1n@f&m8HdI!XrP%!TTw-)9!?s28-1@$ma>mqW9obVPR*LM zn6IZdxz2E5Dr4UClmyEckSTci9>+`Cta#E_O0ULd^fbpO()B2ZWqQ8({fhQgwi@=u z<&XU)@t%Drvu*C|ep>rwb@?7c{lm=YO}y|&@-b`g4opfgGO&U)bURF>zTwq~ZCT$_ zS?gkvek!xyR1|8fF=m)B4Q);HK6=yf#xgLuwvytOy6*Vv>L$HLB30{(h0tC%KCJ-5 zNbW)$sB>l%ORm+Otoy!5F^ngzYUCAA_H@DaYDBtVt-VBm1P-z(*9=RRtAvAZH6 zC1Q0KgiR!Kr$E@*+73Hw^`cWW^Fu?*4L53ak_t6rW&X9XS&Ibxv&G!Z>Ux^<-7d!Z zivj$pB}@96fT$JlzG{hzzzgiQ-qt2fPakR*!BeV^;U9F^b-lWog;N!C?@ZL|LAAbQ zJVHK0zVGdx@OzA^$9%qHSk~ej(@nb53VtcH?M1E!pK_HqUF)DzNRdQ)yfp2-p>p-m z&f;*k5miy4V!^rO1^O1(ZLJs z)vn9e$EVC`6ot8sLAfg9xhAC;`XLP1taxrH8z|qhB_A0xDd2WTM6Iu`>uG_X+D|;^ z!cTcPz5!-rBYmmDMKi@BuOp}2$SJ=@#K0)k)GM7{Q#`9@U+!MxKPFU~tJ4LX6P}fO z*1TC4Gf`dj2}P&#=^lcgMdCgltMPCV^Ooyaw&ToOLx+%L!|s2+vNmvdqW@E=EI+bp zSI$^wY+>TD>B$G4rMh_5;}mLcnA;~hcUPQ-_idlIN6N#Tz8vwt812P9{HECEo!4CG z@?=Q}B|nKPh?zE<(p6S)tR!!Kq14Jqd$ZO-!BSgV-cDQFu6T@rV_jbEF!F%if-6%}6gp$W8hF**=8+VOj&$PQRzl&MT3{t123FXh9=!jv=`07u^@~&chpVTiC z2TR1n{VwdsLR-PyP=Kys?G^r#B+BQ=r{@X0Cs)4*Et<2eqe9#YR1&hsJg(l)O_*rO)|>Ko9}+!TX%19u@q}9&0D< z#)oXOk5=L^XJTE|$$%coBrV2e{rNyW2UZSI=-D3O;lqop*W z{RIcEqjBH5#LU|*3pZ4{@STnF*E@{7mG0yu<>b2jv|l&mB<78wb=Fq5xJS7La<=e` znudY}X9lIinw~JoH4-K~SpjZR65N-+_z?0Jl7~!!eZBCAgv_9-r8BS*AH5cN?&GnM z8n!TQE!Td9`Fp2ld@BMYr8SGLtPd<}IbBYQFSk%V!`7&A%Q4=flui}Uu6+F#!(n{* z0F{z!ubn>wbK$uevyZSsw>WxH?3DCuyc|urc79D+xbK{0HC}8s zyN<&T-!v|+rWB53Ktp15i-=~ka<}Tef+T#G-iN#9%&gSU{~~P6a0^gGX6BciAuiqsoU&9q*tKS&jw^`t%cj0#Ndu~>@2#eUX2C#s%S ztE+iE&u|kjO1f9Im|qONN6#$oT}|sRy%ZA?r-dSU+PpOxtpi3f>W#VkHy$`BMrG1@JZS~SX zzfdFIpYZhkNCSF1SJajoACJ_1&FX-byn8L$E?L1_xPz2|bA#j_cC~^#s@)blze?6_ zo4rmIQx(^W^dbzaC8Mq@OVrn%#w2IgfsrE<^}QV~80uN4XUyal z5s!XLU`%aZ(2$BX3vIe#4o{is(MLI!PZG3d4(=YGo1Hp-EoR75I*2;nnLXuUinn4a zh~c*Ii`SWUQray3+v6+l<_X|H5o?dq-8)R56fGSzCJgF! zN_t8rKQZOpjw5=vPjQ5Y=Y)N{BSraiOZn8U(K9$=nd}Enk%s2Fp6u2E#(Xc4@QJPB z0AxaPpOhmQ>+S+eSO=A|&o|hfXvvmvujr`meS8tr2eas5gH-Bh{Uo;+losL2^PcW& z>(7R{z7tV&Ngu3`NwHI5mwBdVHg)U1K{@cciW82@ElM=?6%wvyJXU|WbWu9d?N0gh zVmSocl~Ja%&Gv`T<`dp%5vuze&Dga$ZWvoB*p3S~Xm*^~?h1X2!~6X}*Xv7+Z?I ze9SHM*2>4cHisjVQa8a~4&5|YD~(hn*6XTw=jV9gS$B-40m@06U7Og4;w9f0>m!|2 zxEDdbE)5Ep~{0!s_63r))TZ{ zo|O~UmKwg_a^Y1^EGUl8UBRf#wrTDsP@h!0MfUMWlh4vGbUm-RnJ0Azoc(DEJJC(N z!Y#&cG8$b{#0BOmK{OsRhy5;I-Jhd^ex6E2u%gGVQ-VS$DuC?33xZ3^hLEU z?VKmX?Bc8_2_?@?@>6(vSud{2+^1bt(7YP(VOlKtLVC&_@J#E1>svd8Gi zGh1m$2#SfshnI1el!j$^X6DT(&$`8DpBgho9GlM!#Z%p{-SP67Dw{2>s$6Ygm+kdb zr5rNc@0!p$n-KNmb5jU}GqbyFx?V`9#bzdD#KopkX2z3nl005WP9jMVIF8x7I+4H9 z*}ke35-0B0FyA#usu6sqFf{kcZRObWHq-6=%9k^P2lZUQQyyJ1#(0K=x_sLhIr-12 z?`&oxr%z@H2LvDvZ6BrN3rIWqJ2Y0fjHyY)n?1d~wgjRH2@GV&;(pYstWJ^-HzQ+76a7p~6Aq zt&K>%^#qjSb77|#B;#p8=pq%{E-n)~=)jmGOK)DRcJn?Dw-e8FMUgOcsa z7qnaI*3_{&E%RGWYUCcuLA=R>Hts<3+Q;f)G2Q7fM-xra!tj&WJZe#i+ z+GHw!{99#MrEy=Ghb7*>-E;c6Ea5Qt?siJ6h)>DwSaO3JJ+p_C`KqBKy0)3B4gF;k zj}+Mo=VPX^TN{|YG{Af}pAabA_6mzxu^RHvQ6oC=AIs)=Jz8qnK#$g1V8#1WJe7Fj zym@`$HPM;Xu9V61g3S*OJ*-M!IZa(#)$Wn?A5>dM>6Fga2{S4fyyR51bcw9TE*9Ap zd0yB0afkCn*^xr;`(3YoE{~CHF&r>|S5(_GYVS`qbmg2UW2J9_(@4PmVLjVoVI6LK z5yKmYX7X%R)TB+mX&vW}U?lF&OK1@k_xNQi!r@Fp>7z5_e2Q%&yDU_s(`Se>f=;6S-K zzeor{%!8!|<~KyCJ4#KMD+O@Cbv@58)PFzc{XKW%XU$^wlE|6W*Co<8xjxak z#CkikxyT?RwUwdZPnKf4kM{)q>dp=WVv5>>d7w&FW`qJlv{!{RA5Mw?2<>j zk1e~5j14|G8`HXJ!n25JC<*UjVtDR|FO#$jeE<%8JtZdQ@&|K1o8enF@E0z6$-A$1 z+rsu6686tRvy@n|-$3-S4THw-hm(9S3+6CCP^RG9?T@`NU~{3P8^x84QB7PFPm&aj z;VEy*i3hbIyjhZ4{aqVvZ3}(+gZ7BsA*7O(H&CFBVaqR)JTcl{Lge@Q58?#LZ*fu8_`|Q4VU?$MlgX3Ma9Jf8+6QvGjL}8Mx zzv<*FwIx}UgbtHh8Z31@2^4pfn`NPUX#WXg5!F%>A5Z(ei1Aisq?Nx=tl^l_8vdzh zwj-aC1oJ1yWY5+R^(&^})WF)q)pRC$u3Gf~hF9%t{_?3!f$Hgjzm9NIc_>aa{3-GV zEq|o7V^?^)=H5^|4b*v|$o9q3?j`Px=K)RbFTU2nObc5Z=vtb6ZznPKYJ{Pt-n0Am z{ux$u{g1nob8`l>k#)BjTQWR94N+4^q{3~p1@7G92;?{UNqv|#SvFHJj%{O3^NDDQ zbgoMD9xF_T<&j$1bTf9(j%TM^e*Q1F$HmZ|V{Ohd5qcpbyUHo51*{xRhiQ}ISY0(~ z*$-^>s5ibw2QyRuLaS2394qUc+Ip+BRKmsG_`<`*x6rwCOy`NZ(j>(_ZHY4C3M{St zvoMRLXP1nubgp`qw#Vo&$Cv5UF&|CvQ7St%XQ$!~Gm=vDV>2FfN_R_*IX#yRtm19A zHO!yT(I^havyW;wIz*`~c*Mwq;cxJm>p}OdAKS=Dy}i*}d&a>Ab2k19R=c`Qf_c}c z6&WJ-rg6;})hHD$6Z$8pH*Yj@@lR1Z-l{J*P<=jB-XS$ck#u*#;pV4MxrW0fv?}rz zJCc>3dI8SUB=o_1t{kv$0iz{3WjasZZI*DM>AeQiSD2emuVG8v-5LrzPk36(4bR|t z5HTYXJ-z3c=ufI-h4&;!VR~BQp;^p#?cTvcN?W-(TScA+jvuz5ZUAKZ&h^)0m4g61rl z!f2zvDK&=>I1==X?B=9ipoL15jhLe6VDTBO%|+7%kG=!ADxxT#_kxmU;)TTJ(ID%&t!mhnVgcF({UZL! zcuGX;G@sO+8gn+|A8b4zfSjZXnO-_|`}GA)b}wuyH;MB(&I`GpxLHzspi{i1GTvm0 zY2>xcw}tD%E__N@F=%!ohRR5C%HyRM)H&SoeS6o}+*OPgXXhEpXCHW2%23CX_Qi&G zN?`=L4$evSC`FA5!hseuoC5bp@ZEOX_?d=9pKUEJSg9s9u7oq(qmi1>-1i&!(eqLA zL85_H&rS`RlC7)Ge!)h-6x&n*Q*H|887ILvF+~=QzWbtr&j^9HAj((_cu*AF-uZNc zV#{w8#Xpw|Ebn3iCPTM6XpW?O#d8lUMz5VeBDNn;ca$Ypf%JVI$8W-LIz47xW`3%M)8a(M@(LghI~E7vNfvHP zCXBqY+Se4v?J6F%9i@_b2?<)$-87tpJ#RkKoTR9;#*;47wnCd?@<|)Tn4qXxovkI> zzQOBaE%7U6dG~(8)9%!#@W8C3q~wAr>i{JS#|CsCM=4S77!How*&PF)IC?z?Xz9tf zM!wR#cU(B5G&e&i%6GzAytXXw(_9HK`}F6cH!$&tR;f)+=xQEM3X|v%Ivn1=$8Q{q zzxXLiy24QQAlf2A^=7JSJd*+|x9gSbHs0j3?~?N*hgG2^W?e*YZ?#$6b?g{nx@3+R z$7d3=QQkVdhZV6H?uW6_X>?=0W3VX;^dfHxT#v`yTyruJQqyES`hq`q+_ALq8(h!I z70=yq@}ACMYVGEBY2iRE+_CZLn4DNVyOK6<=sd^2|j z<*|3(o_`ONEEdMh zr!K^cC4DXtugc}n5KcC<<#@+b8MahkF#p8gwiozCo4gxL)iPvC;UyFHTx=LlvU}Xp zJpJ_SY^TQe^>k1kl64#NqmzwjlM&qKmo6RCyA>=J+!&ElqRsUP{c}q2yWZG7APEWv!-cvD?khSWDK@>RISbR z)avDJunetvCzy3Is3N_sQE{LQzhR`)Mj z^D!{CV|#hjo*NQ#JQaKQpM4#&BGJKf_^x}8{EQx#4|OmzL}NgH$Y$f$7CU_NCzrCS zi-&pwGaDr)s>xgVoaT+3>L*!0M$^SjQn8p&$-9~+tZR*jS_Op+{8y;RZgUj~{3`IT z{IGZ$q>}y1Rn;NHs#pUc!;}K`o z!89?8jU~4qt`>2f_vBFniRC@9yoZqEQmR<&FU#UDaq^iNVBS`1pGQrb8H+Dsuo>3r zjYZSwprPSj_l0~3=sycN;#RiO`txy%=5u>HH>?w`vD->HO%CKiUmCVcRQU9iy{8)M zeYEP=s|{&Z1K!yvWC&?+K?itbXrP#*jm~+u@FpKDs!97GB(B3{}=te zy$?C*u2RkRH)2iD`&_Z&qK$2q)+Zg;mk-jEhR=S4I!@(J$Rs?yG962uK3k^YeXO}M1wBbCwVFI4A+;~>$tk?uXwmddM*GOW>@ zc$zy!^qkhW`?lSmaFKd)F;9_-9r#}UeD#>_=b-Nc0=Mw?b6R0B!|!$<>}zx*$~w)n zzVET?&pvISjdR-L{`}dcW@z<9J*ylgY}~|0Y95p)fhd+xI#mOW^vNIohf5mm-`d^O%~lCA zFqs2);@%xh(xWpq)SkH~vNq&T>6M~vhPq>Yho3X!cPqFQ7p>}&YM>sJqo??u?~0C| zI&{;@(2)z{Q(H;w*P8^%9dFmStLm+sfA9;jzAV_JD`I_Cb^A;ERB+BW7b!=4GBa0u zu1J`qG3X0)#@a4vb16*xuA+RZMnv%l8v#d8q7lzIT_NQV*Vaah_u6O_kszwJa)C

RYYmcRV7xmp<%s)lyP= z82aM|+DO9*g`c!j(Wv!#M~&*N*`t3glp+26%xB#GC{WMB<*Q1Y<-)M{?I#4EZUi*M zwht@tZ$PM@=ZfWFzE)iSag*}wQ&M8pn7PG#Lst7U^YhZPv$dyuyS)OX(~;e@8QMlY zpF^kcHp)XD(KC|yR3=}(N$w6}V0Ven;!1d3s4n~JwzbWxv_tC3Aig)v2~_q(gn|ho zp*%tv9lCu?e7zS2^)VUU?1|PnCQ|srTP56REQ&Q@Uw@bf_=#uBiE_v@Z`@_hZNqt=vnh&yXK2Br{=U76jR~q8a zk8r>0B^(W0rRnS^)zau5CAGHSp|e*GFO}kN$W%KIu@GSV;62|%6-OAg-a2+XYRd=hK26<^!!XK{~nLxm=UZ|U{ghhB#CWZ3AZyeSp3H~O^}pFd4v zZc1EyPsjhCd$&r+KTsX?I5PTtwINgPNs=t}8{ke;wNQ5VKn$tji&-(9by` zTuHqWnO-isX1<4s21-vaqq#05f}KQGTby% z_@ID&*@VA$Y}TCw>M&yx#+e@58bQ=#&$}CJCkEe_U^UsDOt!;zvQ}u5PF_MChI=fwQd-xcIqn zGmSDoB*aoamLL?4cH{WoY#~gXGYmqok@T+@nFOytg z!8ZNFrRCgS?vwG_k#v_X3)OguEX|iuwS+M@J3!-30MFUTJ5W5^NL!vogSWylQu^Id+q_VAC(#Ds_oBa zQ3;zrcz=4@I5V%x(V?179U_K_k1LG%V1Hh=dD!9Mr=Sn==n zmy{Q`MfKBPB`dSq;~Loamp|_A`)<0ygR1d)khmVFe2w+8tQEf%d;g3DUVbN}TGV>y zz54_0yB~6Fk9MO#-g((3+MVEiYO&^<)lZ2S!0lk;k1(U!6;Pp5QBhpyqg&L& z9kE zUwv-h7v<|0QVbg}gK2YZ-r_)GrVK_0rD`+V?C#il@v`N%I2Y@ff$^A0^EJ>P28}Ks zxQh7_-Bez5e_S>0;DSRV^6EA`N(zlE6AzNCr&`NQCKHsJo@~hJgr7N@XT&KkBd5=he=PC^OX~D}ML*Ol{o0P0>GmGC@wU9ZVDA{E%EwWeQcd2Myz!Nybg`ro=SF?d4;|g-cs;>l4x_it zw1Owl)N|DiYeg(~mqb)OLOUa$l74JPWA|M&NVRTyE;*l0bL+Wb-cnJm>e7SdI-A|0 z$8r-KV9BPcN>#9?<`(9{bTrfu?dwie)0Euc85T41qSF(X8J)xz2N-xb4TahCr~5zY z*1B7jPWQjq+N#2q1=l#)~ma zM&*l$_hyg$EY72Pn}>HL({*d@<-N7i*iM-U1|sy!lF#36Mi6(2R)@#1jNk5vfaQ${ z?B%AQrb*}G)}KE2-qUutX{*zL zbvGAG$bwzCv;R8a{UVO{oMWW5&?wyoQNd~My8}7%C`y(TCuDuk1GfTC{i;-{ zFpiNJ|UG&Cg7FPDctb0xG zS?R4zg;_QE6?hdKADCHMJ@j%mQ}t3*Gx4%95in&H6~Pk{H8OQDHsg9~`8?rT@hc_?IxNrK_u> zAPw%4o9o$@n85sV>#qqb%|6l|B2f&99m>%#+ zP|4ZB)Xl`qS(sHu=@Gq*rGty>-)!kYyxhECZV)Tazb5v-j0Y(5pT!1N;9qhJ0eu7& z0Q4erPe}l=Km^PShH&wMxp?7fU_L>JfFKy8BgBKy30NqA>cL+?4*v_)Z=HUla&T4y zR!+pi*}>eL-W`BkxKov3JU-8^zH1f4eGj| zprnI|n;lR~K~_?j)y>VyRFKce3}kA~C%|QHW-h=50s(*V0zX`EGXY~WUIBhSK3>@W zbsbDi{v(H@o3rg-CTD8G17L1k59tCd1qcwt)I`wS!P(Bp6)<{7M*ywH=r1@6z#>>h zgn<8awF1yMME){paa-5FKiFDbo0g!hk-dd5>r*aMGjk(1TUS;Qb^E`1oBpjkTPu;j zKm0|<^IyFFL9>4~0UHKTGS7duqX-`T|D&J(cZ~ka2LUBagjqeVJq%J=li$AL{`an8 z`)@WCJMgvtwM7G_cx}^cl7iQJffs;l2lGJyXcrw`URK}_&<)rw|4Wa5nJ?Qv894iY zV8fp}o0$VxJb)qLU7Ob5KlD(3egNRsoc^yi5Ddh7jq85>LvR0g8z7dzHDuiHZ6Fvg z1cKPcFCcIY0Q7r5;4=u0z>k-g56TMw_x#=u0J#UmLTD3!K(B!@|Ln&P6v{(rg9Dob zVGIxq0!NY$28CaPx&Fxyz(Ypl2j%7EM;P~7=4-Iw-)Vtfa9)J@0{R18yF@B?U}07TWFZD2SAC_nUj8z3J9aa=&p0@u*bzxU$>gW*u5F@Oz(&<611 zN0J!|0t7_l$Ik~tSaV)5jF%5_%>jPM@`1pJ`{SDS8iDi=nfU;%BFqDj5Bd-C@m&LI zA<_yU>W`0C;2N&$_kP#>{y{!|B!2+V3Lwz(@&Q{0!G-{Suz!#b@Kt|~3(x|}LTrQb z1K?nY^1=Q=KG-!>@$d5hwmCl(X$%2~0J6Ox`xhuk;2OmHPksW(I)DKF9a%m&vV1@+ zKwJ+9U}}i+L10iY!aM-|2_WkaFc$m z^(Q|df*`bkU|{4u4Fw>25#|8|BVHt5$IlPDhQIrLjB9@XARqJ^TKD&UyZ|jfg6@G0 z1CamO4`=}WgZ|)%G3uID0C5b!4iNXzHNSt54=|2D$K?fR;fVVK3b;gsF#vvGWch&2 zg=iZ9Eut?593mg04zBqj(t@CTU204<2_-#JmLHhjjJ>lng_%QxHE891&yz_#yfYfFB=Ho&(S#=@bM9%om9t1W5-_ zU;`uWL4X!%&B1^M5p4qotU02cLZQg#RWJxxVgy;hKyHDkdl=w%5p@8-+X4kn|6C)0 z7SV?RP8^PSHU-ufcsGwg3xxuS4niA1ixj&7%RtQe0e(;bZT3%DpfKP7htLLu1w@|> z0s{dZc|D*=YXr0)?LmMR$rl5z^B?vv&=ElvD4+zyH3Dc6^C1wBHX-M0d@!VbPykmK z(e44-Yp~-#_7QM8M~dAr;CPNm3k7m-M7;pCNO}QOkLY)S^?)PUE?_Q5Imq?31>(4T zKpKl^2Y}l}vLPr8xPd{O8yq;mA+`ws7di-S06(NNA{3xSTq8aKqm;;F1i2Q(? zF~o79aNxcSp&vkt6aye2z)K+Xg8@MDh_pcVhj`us0klZ|9s+C-Wch$g6ofGVFNqXa z0a_%#aebykS`Q%gL6jNDm67}qK#O!&0O3cDDKH4~J_4#CgAw-!gr6TN&Ol)QaDIaT zmncZ{1rj@iHh>l}-vvS7K=y;s4+h~wiamh4LcAlprbXIYz|9TPSqR_u|G1ulpXbj1&W zBE?$Zwgf3oLj{1_Tx42gen8+tTuXo-(is9O060%XetNHG8g0ZtnTv@pPH zB905tBF%#zaGi+b0{jFJ_XjX6;&~bb&?4Ps05d~cBjB8ecy|M2Dqy5s6re?l3;aL` zK-4q94=IlTA_`)z3<5HKBp)WgkDRjtrx~O;4V(gy{Vo)S7>~ff^&jtVx^i_k0&vBh z@q~ovc~q^u%&xx>pyyF>aB!suR)}7Oo=4W++<_jTpjQEYr%{q#S4cwOfi&QJ00WTX z;}wVUN`U#qLDxG>KtdcW^#CUFzxU9`1B!FIxEeXT{`EBk7`V9u0dEtSr5;P;{eS7R B3a, and >=) on ordinal fields and their subfields, + because OVN can implement these in OpenFlow and Open + vSwitch as collections of bitwise tests. + + ā€¢ Nominal. In statistics, nominal values cannot be usefully + compared except for equality. This is true of OpenFlow + port numbers, Ethernet types, and IP protocols are examā€ + ples: all of these are just identifiers assigned arbiā€ + trarily with no deeper meaning. In OpenFlow and Open + vSwitch, bits in these fields generally arenā€™t individuā€ + ally addressable. + + OVN only supports arithmetic tests for equality on nomiā€ + nal fields, because OpenFlow and Open vSwitch provide no + way for a flow to efficiently implement other comparisons + on them. (A test for inequality can be sort of built out + of two flows with different priorities, but OVN matching + expressions always generate flows with a single priorā€ + ity.) + + String fields are always nominal. + + ā€¢ Boolean. A nominal field that has only two values, 0 and + 1, is somewhat exceptional, since it is easy to support + both equality and inequality tests on such a field: eiā€ + ther one can be implemented as a test for 0 or 1. + + Only predicates (see above) have a Boolean level of meaā€ + surement. + + This isnā€™t a standard level of measurement. + + Prerequisites. Any symbol can have prerequisites, which are adā€ + ditional condition implied by the use of the symbol. For examā€ + ple, For example, icmp4.type symbol might have prerequisite + icmp4, which would cause an expression icmp4.type == 0 to be inā€ + terpreted as icmp4.type == 0 && icmp4, which would in turn exā€ + pand to icmp4.type == 0 && eth.type == 0x800 && ip4.proto == 1 + (assuming icmp4 is a predicate defined as suggested under Types + above). + + Relational operators + + All of the standard relational operators ==, !=, <, <=, >, and + >= are supported. Nominal fields support only == and !=, and + only in a positive sense when outer ! are taken into account, + e.g. given string field inport, inport == "eth0" and !(inport != + "eth0") are acceptable, but not inport != "eth0". + + The implementation of == (or != when it is negated), is more efā€ + ficient than that of the other relational operators. + + Constants + + Integer constants may be expressed in decimal, hexadecimal preā€ + fixed by 0x, or as dotted-quad IPv4 addresses, IPv6 addresses in + their standard forms, or Ethernet addresses as colon-separated + hex digits. A constant in any of these forms may be followed by + a slash and a second constant (the mask) in the same form, to + form a masked constant. IPv4 and IPv6 masks may be given as inā€ + tegers, to express CIDR prefixes. + + String constants have the same syntax as quoted strings in JSON + (thus, they are Unicode strings). + + Some operators support sets of constants written inside curly + braces { ... }. Commas between elements of a set, and after the + last elements, are optional. With ==, ``field == { constant1, + constant2, ... }ā€™ā€™ is syntactic sugar for ``field == constant1 + || field == constant2 || .... Similarly, ``field != { constant1, + constant2, ... }ā€™ā€™ is equivalent to ``field != constant1 && + field != constant2 && ...ā€™ā€™. + + You may refer to a set of IPv4, IPv6, or MAC addresses stored in + the Address_Set table by its name. An Address_Set with a name of + set1 can be referred to as $set1. + + You may refer to a group of logical switch ports stored in the + Port_Group table by its name. An Port_Group with a name of + port_group1 can be referred to as @port_group1. + + Additionally, you may refer to the set of addresses belonging to + a group of logical switch ports stored in the Port_Group table + by its name followed by a suffix ā€™_ip4ā€™/ā€™_ip6ā€™. The IPv4 address + set of a Port_Group with a name of port_group1 can be referred + to as $port_group1_ip4, and the IPv6 address set of the same + Port_Group can be referred to as $port_group1_ip6 + + Miscellaneous + + Comparisons may name the symbol or the constant first, e.g. + tcp.src == 80 and 80 == tcp.src are both acceptable. + + Tests for a range may be expressed using a syntax like 1024 <= + tcp.src <= 49151, which is equivalent to 1024 <= tcp.src && + tcp.src <= 49151. + + For a one-bit field or predicate, a mention of its name is + equivalent to symobl == 1, e.g. vlan.present is equivalent to + vlan.present == 1. The same is true for one-bit subfields, e.g. + vlan.tci[12]. There is no technical limitation to implementing + the same for ordinal fields of all widths, but the implementaā€ + tion is expensive enough that the syntax parser requires writing + an explicit comparison against zero to make mistakes less + likely, e.g. in tcp.src != 0 the comparison against 0 is reā€ + quired. + + Operator precedence is as shown below, from highest to lowest. + There are two exceptions where parentheses are required even + though the table would suggest that they are not: && and || reā€ + quire parentheses when used together, and ! requires parentheses + when applied to a relational expression. Thus, in (eth.type == + 0x800 || eth.type == 0x86dd) && ip.proto == 6 or !(arp.op == 1), + the parentheses are mandatory. + + ā€¢ () + + ā€¢ == != < <= > >= + + ā€¢ ! + + ā€¢ && || + + Comments may be introduced by //, which extends to the next new- + line. Comments within a line may be bracketed by /* and */. Mulā€ + tiline comments are not supported. + + Symbols + + Most of the symbols below have integer type. Only inport and + outport have string type. inport names a logical port. Thus, its + value is a logical_port name from the Port_Binding table. outā€ā€ + port may name a logical port, as inport, or a logical multicast + group defined in the Multicast_Group table. For both symbols, + only names within the flowā€™s logical datapath may be used. + + The regX symbols are 32-bit integers. The xxregX symbols are + 128-bit integers, which overlay four of the 32-bit registers: + xxreg0 overlays reg0 through reg3, with reg0 supplying the most- + significant bits of xxreg0 and reg3 the least-significant. + xxreg1 similarly overlays reg4 through reg7. + + ā€¢ reg0...reg9 + + ā€¢ xxreg0 xxreg1 + + ā€¢ inport outport + + ā€¢ flags.loopback + + ā€¢ pkt.mark + + ā€¢ eth.src eth.dst eth.type + + ā€¢ vlan.tci vlan.vid vlan.pcp vlan.present + + ā€¢ ip.proto ip.dscp ip.ecn ip.ttl ip.frag + + ā€¢ ip4.src ip4.dst + + ā€¢ ip6.src ip6.dst ip6.label + + ā€¢ arp.op arp.spa arp.tpa arp.sha arp.tha + + ā€¢ rarp.op rarp.spa rarp.tpa rarp.sha rarp.tha + + ā€¢ tcp.src tcp.dst tcp.flags + + ā€¢ udp.src udp.dst + + ā€¢ sctp.src sctp.dst + + ā€¢ icmp4.type icmp4.code + + ā€¢ icmp6.type icmp6.code + + ā€¢ nd.target nd.sll nd.tll + + ā€¢ ct_mark ct_label + + ā€¢ ct_state, which has several Boolean subfields. The + ct_next action initializes the following subfields: + + ā€¢ ct.trk: Always set to true by ct_next to indicate + that connection tracking has taken place. All + other ct subfields have ct.trk as a prerequisite. + + ā€¢ ct.new: True for a new flow + + ā€¢ ct.est: True for an established flow + + ā€¢ ct.rel: True for a related flow + + ā€¢ ct.rpl: True for a reply flow + + ā€¢ ct.inv: True for a connection entry in a bad state + + The ct_dnat, ct_snat, and ct_lb actions initialize the + following subfields: + + ā€¢ ct.dnat: True for a packet whose destination IP + address has been changed. + + ā€¢ ct.snat: True for a packet whose source IP address + has been changed. + + The following predicates are supported: + + ā€¢ eth.bcast expands to eth.dst == ff:ff:ff:ff:ff:ff + + ā€¢ eth.mcast expands to eth.dst[40] + + ā€¢ vlan.present expands to vlan.tci[12] + + ā€¢ ip4 expands to eth.type == 0x800 + + ā€¢ ip4.src_mcast expands to ip4.src[28..31] == 0xe + + ā€¢ ip4.mcast expands to ip4.dst[28..31] == 0xe + + ā€¢ ip6 expands to eth.type == 0x86dd + + ā€¢ ip expands to ip4 || ip6 + + ā€¢ icmp4 expands to ip4 && ip.proto == 1 + + ā€¢ icmp6 expands to ip6 && ip.proto == 58 + + ā€¢ icmp expands to icmp4 || icmp6 + + ā€¢ ip.is_frag expands to ip.frag[0] + + ā€¢ ip.later_frag expands to ip.frag[1] + + ā€¢ ip.first_frag expands to ip.is_frag && !ip.later_frag + + ā€¢ arp expands to eth.type == 0x806 + + ā€¢ rarp expands to eth.type == 0x8035 + + ā€¢ nd expands to icmp6.type == {135, 136} && icmp6.code == 0 + && ip.ttl == 255 + + ā€¢ nd_ns expands to icmp6.type == 135 && icmp6.code == 0 && + ip.ttl == 255 + + ā€¢ nd_na expands to icmp6.type == 136 && icmp6.code == 0 && + ip.ttl == 255 + + ā€¢ nd_rs expands to icmp6.type == 133 && icmp6.code == 0 && + ip.ttl == 255 + + ā€¢ nd_ra expands to icmp6.type == 134 && icmp6.code == 0 && + ip.ttl == 255 + + ā€¢ tcp expands to ip.proto == 6 + + ā€¢ udp expands to ip.proto == 17 + + ā€¢ sctp expands to ip.proto == 132 + + actions: string + Logical datapath actions, to be executed when the logical flow + represented by this row is the highest-priority match. + + Actions share lexical syntax with the match column. An empty set + of actions (or one that contains just white space or comments), + or a set of actions that consists of just drop;, causes the + matched packets to be dropped. Otherwise, the column should conā€ + tain a sequence of actions, each terminated by a semicolon. + + The following actions are defined: + + output; + In the ingress pipeline, this action executes the egress + pipeline as a subroutine. If outport names a logical + port, the egress pipeline executes once; if it is a mulā€ + ticast group, the egress pipeline runs once for each logā€ + ical port in the group. + + In the egress pipeline, this action performs the actual + output to the outport logical port. (In the egress + pipeline, outport never names a multicast group.) + + By default, output to the input port is implicitly + dropped, that is, output becomes a no-op if outport == + inport. Occasionally it may be useful to override this + behavior, e.g. to send an ARP reply to an ARP request; to + do so, use flags.loopback = 1 to allow the packet to + "hair-pin" back to the input port. + + next; + next(table); + next(pipeline=pipeline, table=table); + Executes the given logical datapath table in pipeline as a + subroutine. The default table is just after the current + one. If pipeline is specified, it may be ingress or egress; + the default pipeline is the one currently executing. Acā€ + tions in the both ingress and egress pipeline can use next + to jump across the other pipeline. Actions in the ingress + pipeline should use next to jump into the specific table of + egress pipeline only if it is certain that the packets are + local and not tunnelled and wants to skip certain stages in + the packet processing. + + field = constant; + Sets data or metadata field field to constant value conā€ + stant, e.g. outport = "vif0"; to set the logical output + port. To set only a subset of bits in a field, specify a + subfield for field or a masked constant, e.g. one may use + vlan.pcp[2] = 1; or vlan.pcp = 4/4; to set the most signifā€ + icant bit of the VLAN PCP. + + Assigning to a field with prerequisites implicitly adds + those prerequisites to match; thus, for example, a flow + that sets tcp.dst applies only to TCP flows, regardless of + whether its match mentions any TCP field. + + Not all fields are modifiable (e.g. eth.type and ip.proto + are read-only), and not all modifiable fields may be parā€ + tially modified (e.g. ip.ttl must assigned as a whole). The + outport field is modifiable in the ingress pipeline but not + in the egress pipeline. + + ovn_field = constant; + Sets OVN field ovn_field to constant value constant. + + OVN supports setting the values of certain fields which are + not yet supported in OpenFlow to set or modify them. + + Below are the supported OVN fields: + + ā€¢ icmp4.frag_mtu icmp6.frag_mtu + + This field sets the low-order 16 bits of the + ICMP{4,6} header field that is labelled "unused" in + the ICMP specification as defined in the RFC 1191 + with the value specified in constant. + + Eg. icmp4.frag_mtu = 1500; + + field1 = field2; + Sets data or metadata field field1 to the value of data or + metadata field field2, e.g. reg0 = ip4.src; copies ip4.src + into reg0. To modify only a subset of a fieldā€™s bits, specā€ + ify a subfield for field1 or field2 or both, e.g. vlan.pcp + = reg0[0..2]; copies the least-significant bits of reg0 + into the VLAN PCP. + + field1 and field2 must be the same type, either both string + or both integer fields. If they are both integer fields, + they must have the same width. + + If field1 or field2 has prerequisites, they are added imā€ + plicitly to match. It is possible to write an assignment + with contradictory prerequisites, such as ip4.src = + ip6.src[0..31];, but the contradiction means that a logical + flow with such an assignment will never be matched. + + field1 <-> field2; + Similar to field1 = field2; except that the two values are + exchanged instead of copied. Both field1 and field2 must + modifiable. + + push(field); + Push the value of field to the stack top. + + pop(field); + Pop the stack top and store the value to field, which must + be modifiable. + + ip.ttl--; + Decrements the IPv4 or IPv6 TTL. If this would make the TTL + zero or negative, then processing of the packet halts; no + further actions are processed. (To properly handle such + cases, a higher-priority flow should match on ip.ttl == {0, + 1};.) + + Prerequisite: ip + + ct_next; + Apply connection tracking to the flow, initializing + ct_state for matching in later tables. Automatically moves + on to the next table, as if followed by next. + + As a side effect, IP fragments will be reassembled for + matching. If a fragmented packet is output, then it will be + sent with any overlapping fragments squashed. The connecā€ + tion tracking state is scoped by the logical port when the + action is used in a flow for a logical switch, so overlapā€ + ping addresses may be used. To allow traffic related to the + matched flow, execute ct_commit . Connection tracking state + is scoped by the logical topology when the action is used + in a flow for a router. + + It is possible to have actions follow ct_next, but they + will not have access to any of its side-effects and is not + generally useful. + + ct_commit { }; + ct_commit { ct_mark=value[/mask]; }; + ct_commit { ct_label=value[/mask]; }; + ct_commit { ct_mark=value[/mask]; ct_label=value[/mask]; }; + Commit the flow to the connection tracking entry associated + with it by a previous call to ct_next. When + ct_mark=value[/mask] and/or ct_label=value[/mask] are supā€ + plied, ct_mark and/or ct_label will be set to the values + indicated by value[/mask] on the connection tracking entry. + ct_mark is a 32-bit field. ct_label is a 128-bit field. The + value[/mask] should be specified in hex string if more than + 64bits are to be used. Registers and other named fields can + be used for value. ct_mark and ct_label may be sub-adā€ + dressed in order to have specific bits set. + + Note that if you want processing to continue in the next + table, you must execute the next action after ct_commit. + You may also leave out next which will commit connection + tracking state, and then drop the packet. This could be + useful for setting ct_mark on a connection tracking entry + before dropping a packet, for example. + + ct_dnat; + ct_dnat(IP); + ct_dnat sends the packet through the DNAT zone in connecā€ + tion tracking table to unDNAT any packet that was DNATed in + the opposite direction. The packet is then automatically + sent to to the next tables as if followed by next; action. + The next tables will see the changes in the packet caused + by the connection tracker. + + ct_dnat(IP) sends the packet through the DNAT zone to + change the destination IP address of the packet to the one + provided inside the parentheses and commits the connection. + The packet is then automatically sent to the next tables as + if followed by next; action. The next tables will see the + changes in the packet caused by the connection tracker. + + ct_snat; + ct_snat(IP); + ct_snat sends the packet through the SNAT zone to unSNAT + any packet that was SNATed in the opposite direction. The + packet is automatically sent to the next tables as if folā€ + lowed by the next; action. The next tables will see the + changes in the packet caused by the connection tracker. + + ct_snat(IP) sends the packet through the SNAT zone to + change the source IP address of the packet to the one proā€ + vided inside the parenthesis and commits the connection. + The packet is then automatically sent to the next tables as + if followed by next; action. The next tables will see the + changes in the packet caused by the connection tracker. + + ct_dnat_in_czone; + ct_dnat_in_czone(IP); + ct_dnat_in_czone sends the packet through the common NAT + zone (used for both DNAT and SNAT) in connection tracking + table to unDNAT any packet that was DNATed in the opposite + direction. The packet is then automatically sent to to the + next tables as if followed by next; action. The next tables + will see the changes in the packet caused by the connection + tracker. + + ct_dnat_in_czone(IP) sends the packet through the common + NAT zone to change the destination IP address of the packet + to the one provided inside the parentheses and commits the + connection. The packet is then automatically sent to the + next tables as if followed by next; action. The next tables + will see the changes in the packet caused by the connection + tracker. + + ct_snat_in_czone; + ct_snat_in_czone(IP); + ct_snat_in_czone sends the packet through the common NAT + zone to unSNAT any packet that was SNATed in the opposite + direction. The packet is automatically sent to the next taā€ + bles as if followed by the next; action. The next tables + will see the changes in the packet caused by the connection + tracker. + + ct_snat_in_czone(IP) sends the packet\ through the common + NAT zone to change the source IP address of the packet to + the one provided inside the parenthesis and commits the + connection. The packet is then automatically sent to the + next tables as if followed by next; action. The next tables + will see the changes in the packet caused by the connection + tracker. + + ct_clear; + Clears connection tracking state. + + ct_commit_nat; + Applies NAT and commits the connection to the CT. Automatiā€ + cally moves on to the next table, as if followed by next. + This is very useful for connections that are in related + state for already existing connections and allows the NAT + to be applied to them as well. + + clone { action; ... }; + Makes a copy of the packet being processed and executes + each action on the copy. Actions following the clone acā€ + tion, if any, apply to the original, unmodified packet. + This can be used as a way to ``save and restoreā€™ā€™ the + packet around a set of actions that may modify it and + should not persist. + + arp { action; ... }; + Temporarily replaces the IPv4 packet being processed by an + ARP packet and executes each nested action on the ARP + packet. Actions following the arp action, if any, apply to + the original, unmodified packet. + + The ARP packet that this action operates on is initialized + based on the IPv4 packet being processed, as follows. These + are default values that the nested actions will probably + want to change: + + ā€¢ eth.src unchanged + + ā€¢ eth.dst unchanged + + ā€¢ eth.type = 0x0806 + + ā€¢ arp.op = 1 (ARP request) + + ā€¢ arp.sha copied from eth.src + + ā€¢ arp.spa copied from ip4.src + + ā€¢ arp.tha = 00:00:00:00:00:00 + + ā€¢ arp.tpa copied from ip4.dst + + The ARP packet has the same VLAN header, if any, as the IP + packet it replaces. + + Prerequisite: ip4 + + get_arp(P, A); + Parameters: logical port string field P, 32-bit IP address + field A. + + Looks up A in Pā€™s mac binding table. If an entry is found, + stores its Ethernet address in eth.dst, otherwise stores + 00:00:00:00:00:00 in eth.dst. + + Example: get_arp(outport, ip4.dst); + + put_arp(P, A, E); + Parameters: logical port string field P, 32-bit IP address + field A, 48-bit Ethernet address field E. + + Adds or updates the entry for IP address A in logical port + Pā€™s mac binding table, setting its Ethernet address to E. + + Example: put_arp(inport, arp.spa, arp.sha); + + R = lookup_arp(P, A, M); + Parameters: logical port string field P, 32-bit IP address + field A, 48-bit MAC address field M. + + Result: stored to a 1-bit subfield R. + + Looks up A and M in Pā€™s mac binding table. If an entry is + found, stores 1 in the 1-bit subfield R, else 0. + + Example: reg0[0] = lookup_arp(inport, arp.spa, arp.sha); + + R = lookup_arp_ip(P, A); + Parameters: logical port string field P, 32-bit IP address + field A. + + Result: stored to a 1-bit subfield R. + + Looks up A in Pā€™s mac binding table. If an entry is found, + stores 1 in the 1-bit subfield R, else 0. + + Example: reg0[0] = lookup_arp_ip(inport, arp.spa); + + P = get_fdb(A); + Parameters:48-bit MAC address field A. + + Looks up A in fdb table. If an entry is found, stores the + logical port key to the out parameter P. + + Example: outport = get_fdb(eth.src); + + put_fdb(P, A); + Parameters: logical port string field P, 48-bit MAC address + field A. + + Adds or updates the entry for Ethernet address A in fdb taā€ + ble, setting its logical port key to P. + + Example: put_fdb(inport, arp.spa); + + R = lookup_fdb(P, A); + Parameters: 48-bit MAC address field M, logical port string + field P. + + Result: stored to a 1-bit subfield R. + + Looks up A in fdb table. If an entry is found and the logiā€ + cal port key is P, P, stores 1 in the 1-bit subfield R, + else 0. If flags.localnet is set then 1 is stored if an enā€ + try is found and the logical port key is P or if an entry + is found and the entry port type is VIF. + + Example: reg0[0] = lookup_fdb(inport, eth.src); + + nd_ns { action; ... }; + Temporarily replaces the IPv6 packet being processed by an + IPv6 Neighbor Solicitation packet and executes each nested + action on the IPv6 NS packet. Actions following the nd_ns + action, if any, apply to the original, unmodified packet. + + The IPv6 NS packet that this action operates on is initialā€ + ized based on the IPv6 packet being processed, as follows. + These are default values that the nested actions will probā€ + ably want to change: + + ā€¢ eth.src unchanged + + ā€¢ eth.dst set to IPv6 multicast MAC address + + ā€¢ eth.type = 0x86dd + + ā€¢ ip6.src copied from ip6.src + + ā€¢ ip6.dst set to IPv6 Solicited-Node multicast address + + ā€¢ icmp6.type = 135 (Neighbor Solicitation) + + ā€¢ nd.target copied from ip6.dst + + The IPv6 NS packet has the same VLAN header, if any, as the + IP packet it replaces. + + Prerequisite: ip6 + + nd_na { action; ... }; + Temporarily replaces the IPv6 neighbor solicitation packet + being processed by an IPv6 neighbor advertisement (NA) + packet and executes each nested action on the NA packet. + Actions following the nd_na action, if any, apply to the + original, unmodified packet. + + The NA packet that this action operates on is initialized + based on the IPv6 packet being processed, as follows. These + are default values that the nested actions will probably + want to change: + + ā€¢ eth.dst exchanged with eth.src + + ā€¢ eth.type = 0x86dd + + ā€¢ ip6.dst copied from ip6.src + + ā€¢ ip6.src copied from nd.target + + ā€¢ icmp6.type = 136 (Neighbor Advertisement) + + ā€¢ nd.target unchanged + + ā€¢ nd.sll = 00:00:00:00:00:00 + + ā€¢ nd.tll copied from eth.dst + + The ND packet has the same VLAN header, if any, as the IPv6 + packet it replaces. + + Prerequisite: nd_ns + + nd_na_router { action; ... }; + Temporarily replaces the IPv6 neighbor solicitation packet + being processed by an IPv6 neighbor advertisement (NA) + packet, sets ND_NSO_ROUTER in the RSO flags and executes + each nested action on the NA packet. Actions following the + nd_na_router action, if any, apply to the original, unmodiā€ + fied packet. + + The NA packet that this action operates on is initialized + based on the IPv6 packet being processed, as follows. These + are default values that the nested actions will probably + want to change: + + ā€¢ eth.dst exchanged with eth.src + + ā€¢ eth.type = 0x86dd + + ā€¢ ip6.dst copied from ip6.src + + ā€¢ ip6.src copied from nd.target + + ā€¢ icmp6.type = 136 (Neighbor Advertisement) + + ā€¢ nd.target unchanged + + ā€¢ nd.sll = 00:00:00:00:00:00 + + ā€¢ nd.tll copied from eth.dst + + The ND packet has the same VLAN header, if any, as the IPv6 + packet it replaces. + + Prerequisite: nd_ns + + get_nd(P, A); + Parameters: logical port string field P, 128-bit IPv6 adā€ + dress field A. + + Looks up A in Pā€™s mac binding table. If an entry is found, + stores its Ethernet address in eth.dst, otherwise stores + 00:00:00:00:00:00 in eth.dst. + + Example: get_nd(outport, ip6.dst); + + put_nd(P, A, E); + Parameters: logical port string field P, 128-bit IPv6 adā€ + dress field A, 48-bit Ethernet address field E. + + Adds or updates the entry for IPv6 address A in logical + port Pā€™s mac binding table, setting its Ethernet address to + E. + + Example: put_nd(inport, nd.target, nd.tll); + + R = lookup_nd(P, A, M); + Parameters: logical port string field P, 128-bit IP address + field A, 48-bit MAC address field M. + + Result: stored to a 1-bit subfield R. + + Looks up A and M in Pā€™s mac binding table. If an entry is + found, stores 1 in the 1-bit subfield R, else 0. + + Example: reg0[0] = lookup_nd(inport, ip6.src, eth.src); + + R = lookup_nd_ip(P, A); + Parameters: logical port string field P, 128-bit IP address + field A. + + Result: stored to a 1-bit subfield R. + + Looks up A in Pā€™s mac binding table. If an entry is found, + stores 1 in the 1-bit subfield R, else 0. + + Example: reg0[0] = lookup_nd_ip(inport, ip6.src); + + R = put_dhcp_opts(D1 = V1, D2 = V2, ..., Dn = Vn); + Parameters: one or more DHCP option/value pairs, which must + include an offerip option (with code 0). + + Result: stored to a 1-bit subfield R. + + Valid only in the ingress pipeline. + + When this action is applied to a DHCP request packet + (DHCPDISCOVER or DHCPREQUEST), it changes the packet into a + DHCP reply (DHCPOFFER or DHCPACK, respectively), replaces + the options by those specified as parameters, and stores 1 + in R. + + When this action is applied to a non-DHCP packet or a DHCP + packet that is not DHCPDISCOVER or DHCPREQUEST, it leaves + the packet unchanged and stores 0 in R. + + The contents of the DHCP_Option table control the DHCP opā€ + tion names and values that this action supports. + + Example: reg0[0] = put_dhcp_opts(offerip = 10.0.0.2, router + = 10.0.0.1, netmask = 255.255.255.0, dns_server = {8.8.8.8, + 7.7.7.7}); + + R = put_dhcpv6_opts(D1 = V1, D2 = V2, ..., Dn = Vn); + Parameters: one or more DHCPv6 option/value pairs. + + Result: stored to a 1-bit subfield R. + + Valid only in the ingress pipeline. + + When this action is applied to a DHCPv6 request packet, it + changes the packet into a DHCPv6 reply, replaces the opā€ + tions by those specified as parameters, and stores 1 in R. + + When this action is applied to a non-DHCPv6 packet or an + invalid DHCPv6 request packet , it leaves the packet unā€ + changed and stores 0 in R. + + The contents of the DHCPv6_Options table control the DHCPv6 + option names and values that this action supports. + + Example: reg0[3] = put_dhcpv6_opts(ia_addr = aef0::4, + server_id = 00:00:00:00:10:02, + dns_server={ae70::1,ae70::2}); + + set_queue(queue_number); + Parameters: Queue number queue_number, in the range 0 to + 61440. + + This is a logical equivalent of the OpenFlow set_queue acā€ + tion. It affects packets that egress a hypervisor through a + physical interface. For nonzero queue_number, it configures + packet queuing to match the settings configured for the + Port_Binding with options:qdisc_queue_id matching + queue_number. When queue_number is zero, it resets queuing + to the default strategy. + + Example: set_queue(10); + + ct_lb; + ct_lb(backends=ip[:port][,...][; + hash_fields=field1,field2,...][; ct_flag]); + With arguments, ct_lb commits the packet to the connection + tracking table and DNATs the packetā€™s destination IP adā€ + dress (and port) to the IP address or addresses (and opā€ + tional ports) specified in the backends. If multiple comma- + separated IP addresses are specified, each is given equal + weight for picking the DNAT address. By default, dp_hash is + used as the OpenFlow group selection method, but if + hash_fields is specified, hash is used as the selection + method, and the fields listed are used as the hash fields. + The ct_flag field represents one of supported flag: + skip_snat or force_snat, this flag will be stored in ct_laā€ā€ + bel register. + + Without arguments, ct_lb sends the packet to the connection + tracking table to NAT the packets. If the packet is part of + an established connection that was previously committed to + the connection tracker via ct_lb(...), it will automatiā€ + cally get DNATed to the same IP address as the first packet + in that connection. + + Processing automatically moves on to the next table, as if + next; were specified, and later tables act on the packet as + modified by the connection tracker. Connection tracking + state is scoped by the logical port when the action is used + in a flow for a logical switch, so overlapping addresses + may be used. Connection tracking state is scoped by the + logical topology when the action is used in a flow for a + router. + + ct_lb_mark; + ct_lb_mark(backends=ip[:port][,...][; + hash_fields=field1,field2,...][; ct_flag]); + Same as ct_lb, except that it internally uses ct_mark to + store the NAT flag, while ct_lb uses ct_label for the same + purpose. + + R = dns_lookup(); + Parameters: No parameters. + + Result: stored to a 1-bit subfield R. + + Valid only in the ingress pipeline. + + When this action is applied to a valid DNS request (a UDP + packet typically directed to port 53), it attempts to reā€ + solve the query using the contents of the DNS table. If it + is successful, it changes the packet into a DNS reply and + stores 1 in R. If the action is applied to a non-DNS + packet, an invalid DNS request packet, or a valid DNS reā€ + quest for which the DNS table does not supply an answer, it + leaves the packet unchanged and stores 0 in R. + + Regardless of success, the action does not make any of the + changes to the flow that are necessary to direct the packet + back to the requester. The logical pipeline can implement + this behavior with matches and actions in later tables. + + Example: reg0[3] = dns_lookup(); + + Prerequisite: udp + + R = put_nd_ra_opts(D1 = V1, D2 = V2, ..., Dn = Vn); + Parameters: The following IPv6 ND Router Advertisement opā€ + tion/value pairs as defined in RFC 4861. + + ā€¢ addr_mode + + Mandatory parameter which specifies the address mode + flag to be set in the RA flag options field. The + value of this option is a string and the following + values can be defined - "slaac", "dhcpv6_stateful" + and "dhcpv6_stateless". + + ā€¢ slla + + Mandatory parameter which specifies the link-layer + address of the interface from which the Router Adā€ + vertisement is sent. + + ā€¢ mtu + + Optional parameter which specifies the MTU. + + ā€¢ prefix + + Optional parameter which should be specified if the + addr_mode is "slaac" or "dhcpv6_stateless". The + value should be an IPv6 prefix which will be used + for stateless IPv6 address configuration. This opā€ + tion can be defined multiple times. + + Result: stored to a 1-bit subfield R. + + Valid only in the ingress pipeline. + + When this action is applied to an IPv6 Router solicitation + request packet, it changes the packet into an IPv6 Router + Advertisement reply and adds the options specified in the + parameters, and stores 1 in R. + + When this action is applied to a non-IPv6 Router solicitaā€ + tion packet or an invalid IPv6 request packet , it leaves + the packet unchanged and stores 0 in R. + + Example: reg0[3] = put_nd_ra_opts(addr_mode = "slaac", slla + = 00:00:00:00:10:02, prefix = aef0::/64, mtu = 1450); + + set_meter(rate); + set_meter(rate, burst); + Parameters: rate limit int field rate in kbps, burst rate + limits int field burst in kbps. + + This action sets the rate limit for a flow. + + Example: set_meter(100, 1000); + + R = check_pkt_larger(L) + Parameters: packet length L to check for in bytes. + + Result: stored to a 1-bit subfield R. + + This is a logical equivalent of the OpenFlow + check_pkt_larger action. If the packet is larger than the + length specified in L, it stores 1 in the subfield R. + + Example: reg0[6] = check_pkt_larger(1000); + + log(key=value, ...); + Causes ovn-controller to log the packet on the chassis + that processes it. Packet logging currently uses the same + logging mechanism as other Open vSwitch and OVN messages, + which means that whether and where log messages appear + depends on the local logging configuration that can be + configured with ovs-appctl, etc. + + The log action takes zero or more of the following key- + value pair arguments that control what is logged: + + name=string + An optional name for the ACL. The string is curā€ + rently limited to 64 bytes. + + severity=level + Indicates the severity of the event. The level is + one of following (from more to less serious): + alert, warning, notice, info, or debug. If a + severity is not provided, the default is info. + + verdict=value + The verdict for packets matching the flow. The + value must be one of allow, deny, or reject. + + meter=string + An optional rate-limiting meter to be applied to + the logs. The string should reference a name entry + from the Meter table. The only meter action that + is appropriate is drop. + + fwd_group(liveness=bool, childports=port, ...); + Parameters: optional liveness, either true or false, deā€ + faulting to false; childports, a comma-delimited list of + strings denoting logical ports to load balance across. + + Load balance traffic to one or more child ports in a logā€ + ical switch. ovn-controller translates the fwd_group into + an OpenFlow group with one bucket for each child port. If + liveness=true is specified, it also integrates the bucket + selection with BFD status on the tunnel interface correā€ + sponding to child port. + + Example: fwd_group(liveness=true, childports="p1", "p2"); + + icmp4 { action; ... }; + icmp4_error { action; ... }; + Temporarily replaces the IPv4 packet being processed by an + ICMPv4 packet and executes each nested action on the ICMPv4 + packet. Actions following these actions, if any, apply to + the original, unmodified packet. + + The ICMPv4 packet that these actions operates on is iniā€ + tialized based on the IPv4 packet being processed, as folā€ + lows. These are default values that the nested actions will + probably want to change. Ethernet and IPv4 fields not + listed here are not changed: + + ā€¢ ip.proto = 1 (ICMPv4) + + ā€¢ ip.frag = 0 (not a fragment) + + ā€¢ ip.ttl = 255 + + ā€¢ icmp4.type = 3 (destination unreachable) + + ā€¢ icmp4.code = 1 (host unreachable) + + icmp4_error action is expected to be used to generate an + ICMPv4 packet in response to an error in original IP + packet. When this action generates the ICMPv4 packet, it + also copies the original IP datagram following the ICMPv4 + header as per RFC 1122: 3.2.2. + + Prerequisite: ip4 + + icmp6 { action; ... }; + icmp6_error { action; ... }; + Temporarily replaces the IPv6 packet being processed by an + ICMPv6 packet and executes each nested action on the ICMPv6 + packet. Actions following the icmp6 action, if any, apply + to the original, unmodified packet. + + The ICMPv6 packet that this action operates on is initialā€ + ized based on the IPv6 packet being processed, as follows. + These are default values that the nested actions will probā€ + ably want to change. Ethernet and IPv6 fields not listed + here are not changed: + + ā€¢ ip.proto = 58 (ICMPv6) + + ā€¢ ip.ttl = 255 + + ā€¢ icmp6.type = 1 (destination unreachable) + + ā€¢ icmp6.code = 1 (administratively prohibited) + + icmp6_error action is expected to be used to generate an + ICMPv6 packet in response to an error in original IPv6 + packet. + + Prerequisite: ip6 + + tcp_reset; + This action transforms the current TCP packet according to + the following pseudocode: + + if (tcp.ack) { + tcp.seq = tcp.ack; + } else { + tcp.ack = tcp.seq + length(tcp.payload); + tcp.seq = 0; + } + tcp.flags = RST; + + Then, the action drops all TCP options and payload data, + and updates the TCP checksum. IP ttl is set to 255. + + Prerequisite: tcp + + reject { action; ... }; + If the original packet is IPv4 or IPv6 TCP packet, it reā€ + places it with IPv4 or IPv6 TCP RST packet and executes the + inner actions. Otherwise it replaces it with an ICMPv4 or + ICMPv6 packet and executes the inner actions. + + The inner actions should not attempt to swap eth source + with eth destination and IP source with IP destination as + this action implicitly does that. + + trigger_event; + This action is used to allow ovs-vswitchd to report CMS reā€ + lated events writing them in Controller_Event table. It is + possible to associate a meter to a each event in order to + not overload pinctrl thread under heavy load; each meter is + identified though a defined naming convention. Supported + events: + + ā€¢ empty_lb_backends. This event is raised if a reā€ + ceived packet is destined for a load balancer VIP + that has no configured backend destinations. For + this event, the event info includes the load balā€ + ancer VIP, the load balancer UUID, and the transport + protocol. Associated meter: event-elb + + igmp; + This action sends the packet to ovn-controller for multiā€ + cast snooping. + + Prerequisite: igmp + + bind_vport(V, P); + Parameters: logical port string field V of type virtual, + logical port string field P. + + Binds the virtual logical port V and sets the chassis colā€ + umn and virtual_parent of the table Port_Binding. virā€ā€ + tual_parent is set to P. + + handle_svc_check(P); + Parameters: logical port string field P. + + Handles the service monitor reply received from the VIF of + the logical port P. ovn-controller periodically sends out + the service monitor packets for the services configured in + the Service_Monitor table and this action updates the staā€ + tus of those services. + + Example: handle_svc_check(inport); + + handle_dhcpv6_reply; + Handle DHCPv6 prefix delegation advertisements/replies from + a IPv6 delegation server. ovn-controller will add an entry + ipv6_ra_pd_list in the options table for each prefix reā€ + ceived from the delegation server + + R = select(N1[=W1], N2[=W2], ...); + Parameters: Integer N1, N2..., with optional weight W1, W2, + ... + + Result: stored to a logical field or subfield R. + + Select from a list of integers N1, N2..., each within the + range 0 ~ 65535, and store the selected one in the field R. + There must be 2 or more integers listed, each with an opā€ + tional weight, which is an integer within the range 1 ~ + 65535. If weight is not specified, it defaults to 100. The + selection method is based on the 5-tuple hash of packet + header. + + Processing automatically moves on to the next table, as if + next; were specified. The select action must be put as the + last action of the logical flow when there are multiple acā€ + tions (actions put after select will not take effect). + + Example: reg8[16..31] = select(1=20, 2=30, 3=50); + + handle_dhcpv6_reply; + This action is used to parse DHCPv6 replies from IPv6 Deleā€ + gation Router and managed IPv6 Prefix delegation state maā€ + chine + + R = chk_lb_hairpin(); + This action checks if the packet under consideration was + destined to a load balancer VIP and it is hairpinned, i.e., + after load balancing the destination IP matches the source + IP. If it is so, then the 1-bit destination register R is + set to 1. + + R = chk_lb_hairpin_reply(); + This action checks if the packet under consideration is + from one of the backend IP of a load balancer VIP and the + destination IP is the load balancer VIP. If it is so, then + the 1-bit destination register R is set to 1. + + R = ct_snat_to_vip; + This action sends the packet through the SNAT zone to + change the source IP address of the packet to the load balā€ + ancer VIP if the original destination IP was load balancer + VIP and commits the connection. This action applies sucā€ + cessfully only for the hairpinned traffic i.e if the action + chk_lb_hairpin returned success. This action doesnā€™t take + any arguments and it determines the SNAT IP internally. The + packet is not automatically sent to the next table. The + caller has to execute the next; action explicitly after + this action to advance the packet to the next stage. + + R = check_in_port_sec(); + This action checks if the packet under consideration passes + the inport port security checks. If the packet fails the + port security checks, then 1 is stored in the destination + register R. Else 0 is stored. The port security values to + check are retrieved from the the inport logical port. + + This action should be used in the ingress logical switch + pipeline. + + Example: reg8[0..7] = check_in_port_sec(); + + R = check_out_port_sec(); + This action checks if the packet under consideration passes + the outport port security checks. If the packet fails the + port security checks, then 1 is stored in the destination + register R. Else 0 is stored. The port security values to + check are retrieved from the the outport logical port. + + This action should be used in the egress logical switch + pipeline. + + Example: reg8[0..7] = check_out_port_sec(); + + commit_ecmp_nh(ipv6); + Parameters: IPv4/IPv6 traffic. + + This action translates to an openflow "learn" action that + inserts two new flows in tables 76 and 77. + + ā€¢ Match on the the 5-tuple and the expected next-hop + mac address in table 76: nw_src=ip0, nw_dst=ip1, + ip_proto,tp_src=l4_port0, + tp_dst=l4_port1,dl_src=ethaddr and set reg9[5]. + + ā€¢ Match on the 5-tuple in table 77: nw_src=ip1, + nw_dst=ip0, ip_proto, tp_src=l4_port1, + tp_dst=l4_port0 and set reg9[5] to 1 + + This action is applied if the packet arrives via ECMP route + or if it is routed via an ECMP route + + R = check_ecmp_nh_mac(); + This action checks if the packet under consideration + matches any flow in table 76. If it is so, then the 1-bit + destination register R is set to 1. + + R = check_ecmp_nh(); + This action checks if the packet under consideration + matches the any flow in table 77. If it is so, then the + 1-bit destination register R is set to 1. + + commit_lb_aff(vip, backend, proto, timeout); Parameters: + load-balancer virtual ip:port vip, load-balancer backend + ip:port backend, load-balancer protocol proto, affinity + timeout timeout. + + This action translates to an openflow "learn" action that + inserts a new flow in table 78. + + ā€¢ Match on the 4-tuple in table 78: nw_src=ip client, + nw_dst=vip ip, ip_proto, tp_dst=vip port and set + reg9[6] to 1, reg4 and reg8 to backend ip and port + respectively. For IPv6 register xxreg1 is used to + store the backend ip. + + This action is applied for new connections received by a + specific load-balacer with affinity timeout configured. + + R = chk_lb_aff(); + This action checks if the packet under consideration + matches any flow in table 78. If it is so, then the 1-bit + destination register R is set to 1. + + sample(probability=packets, ...) + This action causes the matched traffic to be sampled using + IPFIX protocol. More information about how per-flow IPFIX + sampling works in OVS can be found in ovs-actions(7) and + ovs-vswitchd.conf.db(5). + + In order to reliably identify each sampled packet when it + is received by the IPFIX collector, this action sets the + content of the ObservationDomainID and ObservationPointID + IPFIX fields (see argument description below). + + The following key-value arguments are supported: + + probability=packets + The number of sampled packets out of 65535. It must + be greater or equal to 1. + + collector_set=id + The unsigned 32-bit integer identifier of the sample + collector to send sampled packets to. It must match + the value configured in the Flow_Sample_Collecā€ā€ + tor_Set Table in OVS. Defaults to 0. + + obs_domain=id + An unsigned 8-bit integer that identifies the samā€ + pling application. It will be placed in the 8 most + significant bits of the ObservationDomainID field of + IPFIX samples. The 24 less significant bits will be + automatically filled in with the datapath key. Deā€ + faults to 0. + + obs_point=id + An unsigned 32-bit integer to be used as Obsservaā€ā€ + tionPointID or the string @cookie to indicate that + the first 32 bits of the Logical_Flowā€™s UUID shall + be used instead. + + tags: map of string-string pairs + Key-value pairs that provide additional information to help ovn- + controller processing the logical flow. Below are the tags used + by ovn-controller. + + in_out_port + In the logical flowā€™s "match" column, if a logical port P + is compared with "inport" and the logical flow is on a + logical switch ingress pipeline, or if P is compared with + "outport" and the logical flow is on a logical switch + egress pipeline, and the expression is combined with + other expressions (if any) using the operator &&, then + the port P should be added as the value in this tag. If + there are multiple logical ports meeting this criteria, + one of them can be added. ovn-controller uses this inforā€ + mation to skip parsing flows that are not needed on the + chassis. Failing to add the tag will affect efficiency, + while adding wrong value will affect correctness. + + controller_meter: optional string + The name of the meter in table Meter to be used for all packets + that the logical flow might send to ovn-controller. + + external_ids : stage-name: optional string + Human-readable name for this flowā€™s stage in the pipeline. + + external_ids : stage-hint: optional string, containing an uuid + UUID of a OVN_Northbound record that caused this logical flow to + be created. Currently used only for attribute of logical flows + to northbound ACL records. + + external_ids : source: optional string + Source file and line number of the code that added this flow to + the pipeline. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs +Logical_DP_Group TABLE + Each row in this table represents a group of logical datapaths referā€ + enced by the logical_dp_group column in the Logical_Flow table. + + Summary: + datapaths set of weak reference to Datapath_Bindā€ā€ + ings + + Details: + datapaths: set of weak reference to Datapath_Bindings + List of Datapath_Binding entries. + +Multicast_Group TABLE + The rows in this table define multicast groups of logical ports. Multiā€ + cast groups allow a single packet transmitted over a tunnel to a hyperā€ + visor to be delivered to multiple VMs on that hypervisor, which uses + bandwidth more efficiently. + + Each row in this table defines a logical multicast group numbered tunā€ā€ + nel_key within datapath, whose logical ports are listed in the ports + column. + + Summary: + datapath Datapath_Binding + tunnel_key integer, in range 32,768 to 65,535 + name string + ports set of weak reference to Port_Bindings + + Details: + datapath: Datapath_Binding + The logical datapath in which the multicast group resides. + + tunnel_key: integer, in range 32,768 to 65,535 + The value used to designate this logical egress port in tunnel + encapsulations. An index forces the key to be unique within the + datapath. The unusual range ensures that multicast group IDs do + not overlap with logical port IDs. + + name: string + The logical multicast groupā€™s name. An index forces the name to + be unique within the datapath. Logical flows in the ingress + pipeline may output to the group just as for individual logical + ports, by assigning the groupā€™s name to outport and executing an + output action. + + Multicast group names and logical port names share a single + namespace and thus should not overlap (but the database schema + cannot enforce this). To try to avoid conflicts, ovn-northd uses + names that begin with _MC_. + + ports: set of weak reference to Port_Bindings + The logical ports included in the multicast group. All of these + ports must be in the datapath logical datapath (but the database + schema cannot enforce this). + +Mirror TABLE + Each row in this table represents a mirror that can be used for port + mirroring. These mirrors are referenced by the mirror_rules column in + the Port_Binding table. + + Summary: + name string (must be unique within table) + filter string, one of both, from-lport, or + to-lport + sink string + type string, one of erspan, gre, or local + index integer + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Represents the name of the mirror. + + filter: string, one of both, from-lport, or to-lport + The value of this field represents selection criteria of the + mirror. to-lport mirrors the packets coming into logical port. + from-lport mirrors the packets going out of logical port. both + mirrors for both directions. + + sink: string + The value of this field represents the destination/sink of the + mirror. If the type is gre or erspan, the value indicates the + tunnel remote IP (either IPv4 or IPv6). For a type of local, + this field defines a local interface on the OVS integration + bridge to be used as the mirror destination. The interface must + possess external-ids:mirror-id that matches this string. + + type: string, one of erspan, gre, or local + The value of this field specifies the mirror type - gre, erspan + or local. + + index: integer + The value of this field represents the tunnel ID. If the configā€ + ured tunnel type is gre, this field represents the GRE key value + and if the configured tunnel type is erspan it represents the + erspan_idx value. It is ignored if the type is local. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Meter TABLE + Each row in this table represents a meter that can be used for QoS or + rate-limiting. + + Summary: + name string (must be unique within table) + unit string, either kbps or pktps + bands set of 1 or more Meter_Bands + + Details: + name: string (must be unique within table) + A name for this meter. + + Names that begin with "__" (two underscores) are reserved for + OVN internal use and should not be added manually. + + unit: string, either kbps or pktps + The unit for rate and burst_rate parameters in the bands entry. + kbps specifies kilobits per second, and pktps specifies packets + per second. + + bands: set of 1 or more Meter_Bands + The bands associated with this meter. Each band specifies a rate + above which the band is to take the action action. If multiple + bandsā€™ rates are exceeded, then the band with the highest rate + among the exceeded bands is selected. + +Meter_Band TABLE + Each row in this table represents a meter band which specifies the rate + above which the configured action should be applied. These bands are + referenced by the bands column in the Meter table. + + Summary: + action string, must be drop + rate integer, in range 1 to 4,294,967,295 + burst_size integer, in range 0 to 4,294,967,295 + + Details: + action: string, must be drop + The action to execute when this band matches. The only supported + action is drop. + + rate: integer, in range 1 to 4,294,967,295 + The rate limit for this band, in kilobits per second or bits per + second, depending on whether the parent Meter entryā€™s unit colā€ + umn specified kbps or pktps. + + burst_size: integer, in range 0 to 4,294,967,295 + The maximum burst allowed for the band in kilobits or packets, + depending on whether kbps or pktps was selected in the parent + Meter entryā€™s unit column. If the size is zero, the switch is + free to select some reasonable value depending on its configuraā€ + tion. +Datapath_Binding TABLE + Each row in this table represents a logical datapath, which implements + a logical pipeline among the ports in the Port_Binding table associated + with it. In practice, the pipeline in a given logical datapath impleā€ + ments either a logical switch or a logical router. + + The main purpose of a row in this table is provide a physical binding + for a logical datapath. A logical datapath does not have a physical loā€ + cation, so its physical binding information is limited: just tunā€ā€ + nel_key. The rest of the data in this table does not affect packet forā€ + warding. + + Summary: + tunnel_key integer, in range 1 to 16,777,215 (must + be unique within table) + load_balancers set of uuids + OVN_Northbound Relationship: + external_ids : logical-switch + optional string, containing an uuid + external_ids : logical-router + optional string, containing an uuid + external_ids : interconn-ts + optional string + Naming: + external_ids : name optional string + external_ids : name2 optional string + Common Columns: + external_ids map of string-string pairs + + Details: + tunnel_key: integer, in range 1 to 16,777,215 (must be unique within + table) + The tunnel key value to which the logical datapath is bound. The + Tunnel Encapsulation section in ovn-architecture(7) describes + how tunnel keys are constructed for each supported encapsulaā€ + tion. + + load_balancers: set of uuids + Not used anymore; kept for backwards compatibility of the + schema. + + OVN_Northbound Relationship: + + Each row in Datapath_Binding is associated with some logical datapath. + ovn-northd uses these keys to track the association of a logical dataā€ + path with concepts in the OVN_Northbound database. + + external_ids : logical-switch: optional string, containing an uuid + For a logical datapath that represents a logical switch, + ovn-northd stores in this key the UUID of the corresponding Logā€ā€ + ical_Switch row in the OVN_Northbound database. + + external_ids : logical-router: optional string, containing an uuid + For a logical datapath that represents a logical router, + ovn-northd stores in this key the UUID of the corresponding Logā€ā€ + ical_Router row in the OVN_Northbound database. + + external_ids : interconn-ts: optional string + For a logical datapath that represents a logical switch that + represents a transit switch for interconnection, ovn-northd + stores in this key the value of the same interconn-ts key of the + external_ids column of the corresponding Logical_Switch row in + the OVN_Northbound database. + + Naming: + + ovn-northd copies these from the name fields in the OVN_Northbound + database, either from name and external_ids:neutron:router_name in the + Logical_Router table or from name and external_ids:neutron:network_name + in the Logical_Switch table. + + external_ids : name: optional string + A name for the logical datapath. + + external_ids : name2: optional string + Another name for the logical datapath. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs +Port_Binding TABLE + Each row in this table binds a logical port to a realization. For most + logical ports, this means binding to some physical location, for examā€ + ple by binding a logical port to a VIF that belongs to a VM running on + a particular hypervisor. Other logical ports, such as logical patch + ports, can be realized without a specific physical location, but their + bindings are still expressed through rows in this table. + + For every Logical_Switch_Port record in OVN_Northbound database, + ovn-northd creates a record in this table. ovn-northd populates and + maintains every column except the chassis and virtual_parent columns, + which it leaves empty in new records. + + ovn-controller/ovn-controller-vtep populates the chassis column for the + records that identify the logical ports that are located on its hyperā€ + visor/gateway, which ovn-controller/ovn-controller-vtep in turn finds + out by monitoring the local hypervisorā€™s Open_vSwitch database, which + identifies logical ports via the conventions described in Integraā€ā€ + tionGuide.rst. (The exceptions are for Port_Binding records with type + of l3gateway, whose locations are identified by ovn-northd via the opā€ā€ + tions:l3gateway-chassis column in this table. ovn-controller is still + responsible to populate the chassis column.) + + ovn-controller also populates the virtual_parent column of records + whose type is virtual. + + When a chassis shuts down gracefully, it should clean up the chassis + column that it previously had populated. (This is not critical because + resources hosted on the chassis are equally unreachable regardless of + whether their rows are present.) To handle the case where a VM is shut + down abruptly on one chassis, then brought up again on a different one, + ovn-controller/ovn-controller-vtep must overwrite the chassis column + with new information. + + Summary: + Core Features: + datapath Datapath_Binding + logical_port string (must be unique within table) + encap optional weak reference to Encap + additional_encap set of weak reference to Encaps + chassis optional weak reference to Chassis + additional_chassis set of weak reference to Chassis + gateway_chassis set of Gateway_Chassises + ha_chassis_group optional HA_Chassis_Group + up optional boolean + tunnel_key integer, in range 1 to 32,767 + mac set of strings + port_security set of strings + type string + requested_chassis optional weak reference to Chassis + requested_additional_chassis + set of weak reference to Chassis + mirror_rules set of weak reference to Mirrors + Patch Options: + options : peer optional string + nat_addresses set of strings + L3 Gateway Options: + options : peer optional string + options : l3gateway-chassis + optional string + nat_addresses set of strings + Localnet Options: + options : network_name optional string + tag optional integer, in range 1 to 4,095 + L2 Gateway Options: + options : network_name optional string + options : l2gateway-chassis + optional string + tag optional integer, in range 1 to 4,095 + VTEP Options: + options : vtep-physical-switch + optional string + options : vtep-logical-switch + optional string + VMI (or VIF) Options: + options : requested-chassis + optional string + options : activation-strategy + optional string + options : additional-chassis-activated + optional string + options : iface-id-ver optional string + options : qos_min_rate optional string + options : qos_max_rate optional string + options : qos_burst optional string + options : qos_physical_network + optional string + options : qdisc_queue_id optional string, containing an integer, + in range 1 to 61,440 + Distributed Gateway Port Options: + options : chassis-redirect-port + optional string + Chassis Redirect Options: + options : distributed-port optional string + options : redirect-type optional string + options : always-redirect optional string + Nested Containers: + parent_port optional string + tag optional integer, in range 1 to 4,095 + Virtual ports: + virtual_parent optional string + Naming: + external_ids : name optional string + Common Columns: + external_ids map of string-string pairs + + Details: + Core Features: + + datapath: Datapath_Binding + The logical datapath to which the logical port belongs. + + logical_port: string (must be unique within table) + A logical port. For a logical switch port, this is taken from + name in the OVN_Northbound databaseā€™s Logical_Switch_Port table. + For a logical router port, this is taken from name in the + OVN_Northbound databaseā€™s Logical_Router_port table. (This means + that logical switch ports and router port names must not share + names in an OVN deployment.) OVN does not prescribe a particular + format for the logical port ID. + + encap: optional weak reference to Encap + Points to preferred encapsulation configuration to transmit logā€ + ical dataplane packets to this chassis. The entry is reference + to a Encap record. + + additional_encap: set of weak reference to Encaps + Points to preferred encapsulation configuration to transmit logā€ + ical dataplane packets to this additional chassis. The entry is + reference to a Encap record. See also additional_chassis. + + chassis: optional weak reference to Chassis + The meaning of this column depends on the value of the type colā€ + umn. This is the meaning for each type + + (empty string) + The physical location of the logical port. To successā€ + fully identify a chassis, this column must be a Chassis + record. This is populated by ovn-controller. + + vtep The physical location of the hardware_vtep gateway. To + successfully identify a chassis, this column must be a + Chassis record. This is populated by ovn-controller-vtep. + + localnet + Always empty. A localnet port is realized on every chasā€ + sis that has connectivity to the corresponding physical + network. + + localport + Always empty. A localport port is present on every chasā€ + sis. + + l3gateway + The physical location of the L3 gateway. To successfully + identify a chassis, this column must be a Chassis record. + This is populated by ovn-controller based on the value of + the options:l3gateway-chassis column in this table. + + l2gateway + The physical location of this L2 gateway. To successfully + identify a chassis, this column must be a Chassis record. + This is populated by ovn-controller based on the value of + the options:l2gateway-chassis column in this table. + + additional_chassis: set of weak reference to Chassis + The meaning of this column is the same as for the chassis. The + column is used to track an additional physical location of the + logical port. Used with regular (empty type) port bindings. + + gateway_chassis: set of Gateway_Chassises + A list of Gateway_Chassis. + + This should only be populated for ports with type set to chasā€ā€ + sisredirect. This column defines the list of chassis used as + gateways where traffic will be redirected through. + + ha_chassis_group: optional HA_Chassis_Group + This should only be populated for ports with type set to chasā€ā€ + sisredirect. This column defines the HA chassis group with a + list of HA chassis used as gateways where traffic will be rediā€ + rected through. + + up: optional boolean + This is set to true whenever all OVS flows required by this + Port_Binding have been installed. This is populated by ovn-conā€ā€ + troller. + + tunnel_key: integer, in range 1 to 32,767 + A number that represents the logical port in the key (e.g. STT + key or Geneve TLV) field carried within tunnel protocol packets. + + The tunnel ID must be unique within the scope of a logical dataā€ + path. + + mac: set of strings + This column is a misnomer as it may contain MAC addresses and IP + addresses. It is copied from the addresses column in the Logiā€ā€ + cal_Switch_Port table in the Northbound database. It follows the + same format as that column. + + port_security: set of strings + This column controls the addresses from which the host attached + to the logical port (``the hostā€™ā€™) is allowed to send packets + and to which it is allowed to receive packets. If this column is + empty, all addresses are permitted. + + It is copied from the port_security column in the Logiā€ā€ + cal_Switch_Port table in the Northbound database. It follows the + same format as that column. + + type: string + A type for this logical port. Logical ports can be used to model + other types of connectivity into an OVN logical switch. The folā€ + lowing types are defined: + + (empty string) + VM (or VIF) interface. + + patch One of a pair of logical ports that act as if connected + by a patch cable. Useful for connecting two logical dataā€ + paths, e.g. to connect a logical router to a logical + switch or to another logical router. + + l3gateway + One of a pair of logical ports that act as if connected + by a patch cable across multiple chassis. Useful for conā€ + necting a logical switch with a Gateway router (which is + only resident on a particular chassis). + + localnet + A connection to a locally accessible network from + ovn-controller instances that have a corresponding bridge + mapping. A logical switch can have multiple localnet + ports attached. This type is used to model direct connecā€ + tivity to existing networks. In this case, each chassis + should have a mapping for one of the physical networks + only. Note: nothing said above implies that a chassis + cannot be plugged to multiple physical networks as long + as they belong to different switches. + + localport + A connection to a local VIF. Traffic that arrives on a + localport is never forwarded over a tunnel to another + chassis. These ports are present on every chassis and + have the same address in all of them. This is used to + model connectivity to local services that run on every + hypervisor. + + l2gateway + An L2 connection to a physical network. The chassis this + Port_Binding is bound to will serve as an L2 gateway to + the network named by options:network_name. + + vtep A port to a logical switch on a VTEP gateway chassis. In + order to get this port correctly recognized by the OVN + controller, the options:vtep-physical-switch and opā€ā€ + tions:vtep-logical-switch must also be defined. + + chassisredirect + A logical port that represents a particular instance, + bound to a specific chassis, of an otherwise distributed + parent port (e.g. of type patch). A chassisredirect port + should never be used as an inport. When an ingress + pipeline sets the outport, it may set the value to a logā€ + ical port of type chassisredirect. This will cause the + packet to be directed to a specific chassis to carry out + the egress pipeline. At the beginning of the egress + pipeline, the outport will be reset to the value of the + distributed port. + + virtual + Represents a logical port with an virtual ip. This virā€ā€ + tual ip can be configured on a logical port (which is reā€ + ferred as virtual parent). + + requested_chassis: optional weak reference to Chassis + This column exists so that the ovn-controller can effectively + monitor all Port_Binding records destined for it, and is a supā€ + plement to the options:requested-chassis option. The option is + still required so that the ovn-controller can check the CMS inā€ + tent when the chassis pointed to does not currently exist, which + for example occurs when the ovn-controller is stopped without + passing the -restart argument. This column must be a Chassis + record. This is populated by ovn-northd when the options:reā€ā€ + quested-chassis is defined and contains a string matching the + name or hostname of an existing chassis. See also requested_adā€ā€ + ditional_chassis. + + requested_additional_chassis: set of weak reference to Chassis + This column exists so that the ovn-controller can effectively + monitor all Port_Binding records destined for it, and is a supā€ + plement to the options:requested-chassis option when multiple + chassis are listed. This column must be a list of Chassis + records. This is populated by ovn-northd when the options:reā€ā€ + quested-chassis is defined as a list of chassis names or hostā€ + names. See also requested_chassis. + + mirror_rules: set of weak reference to Mirrors + Mirror rules that apply to the port binding. Please see the Mirā€ā€ + ror table. + + Patch Options: + + These options apply to logical ports with type of patch. + + options : peer: optional string + The logical_port in the Port_Binding record for the other side + of the patch. The named logical_port must specify this logiā€ā€ + cal_port in its own peer option. That is, the two patch logical + ports must have reversed logical_port and peer values. + + nat_addresses: set of strings + MAC address followed by a list of SNAT and DNAT external IP adā€ + dresses, followed by is_chassis_resident("lport"), where lport + is the name of a logical port on the same chassis where the corā€ + responding NAT rules are applied. This is used to send gratuā€ + itous ARPs for SNAT and DNAT external IP addresses via localnet, + from the chassis where lport resides. Example: 80:fa:5b:06:72:b7 + 158.36.44.22 158.36.44.24 is_chassis_resident("foo1"). This + would result in generation of gratuitous ARPs for IP addresses + 158.36.44.22 and 158.36.44.24 with a MAC address of + 80:fa:5b:06:72:b7 from the chassis where the logical port "foo1" + resides. + + L3 Gateway Options: + + These options apply to logical ports with type of l3gateway. + + options : peer: optional string + The logical_port in the Port_Binding record for the other side + of the ā€™l3gatewayā€™ port. The named logical_port must specify + this logical_port in its own peer option. That is, the two + ā€™l3gatewayā€™ logical ports must have reversed logical_port and + peer values. + + options : l3gateway-chassis: optional string + The chassis in which the port resides. + + nat_addresses: set of strings + MAC address of the l3gateway port followed by a list of SNAT and + DNAT external IP addresses. This is used to send gratuitous ARPs + for SNAT and DNAT external IP addresses via localnet. Example: + 80:fa:5b:06:72:b7 158.36.44.22 158.36.44.24. This would result + in generation of gratuitous ARPs for IP addresses 158.36.44.22 + and 158.36.44.24 with a MAC address of 80:fa:5b:06:72:b7. This + is used in OVS version 2.8 and later versions. + + Localnet Options: + + These options apply to logical ports with type of localnet. + + options : network_name: optional string + Required. ovn-controller uses the configuration entry + ovn-bridge-mappings to determine how to connect to this network. + ovn-bridge-mappings is a list of network names mapped to a local + OVS bridge that provides access to that network. An example of + configuring ovn-bridge-mappings would be: .IP + $ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1 + + When a logical switch has a localnet port attached, every chasā€ + sis that may have a local vif attached to that logical switch + must have a bridge mapping configured to reach that localnet. + Traffic that arrives on a localnet port is never forwarded over + a tunnel to another chassis. If there are multiple localnet + ports in a logical switch, each chassis should only have a sinā€ + gle bridge mapping for one of the physical networks. Note: In + case of multiple localnet ports, to provide interconnectivity + between all VIFs located on different chassis with different + fabric connectivity, the fabric should implement some form of + routing between the segments. + + tag: optional integer, in range 1 to 4,095 + If set, indicates that the port represents a connection to a + specific VLAN on a locally accessible network. The VLAN ID is + used to match incoming traffic and is also added to outgoing + traffic. + + L2 Gateway Options: + + These options apply to logical ports with type of l2gateway. + + options : network_name: optional string + Required. ovn-controller uses the configuration entry + ovn-bridge-mappings to determine how to connect to this network. + ovn-bridge-mappings is a list of network names mapped to a local + OVS bridge that provides access to that network. An example of + configuring ovn-bridge-mappings would be: .IP + $ ovs-vsctl set open . external-ids:ovn-bridge-mappings=physnet1:br-eth0,physnet2:br-eth1 + + When a logical switch has a l2gateway port attached, the chassis + that the l2gateway port is bound to must have a bridge mapping + configured to reach the network identified by network_name. + + options : l2gateway-chassis: optional string + Required. The chassis in which the port resides. + + tag: optional integer, in range 1 to 4,095 + If set, indicates that the gateway is connected to a specific + VLAN on the physical network. The VLAN ID is used to match inā€ + coming traffic and is also added to outgoing traffic. + + VTEP Options: + + These options apply to logical ports with type of vtep. + + options : vtep-physical-switch: optional string + Required. The name of the VTEP gateway. + + options : vtep-logical-switch: optional string + Required. A logical switch name connected by the VTEP gateway. + Must be set when type is vtep. + + VMI (or VIF) Options: + + These options apply to logical ports with type having (empty string) + + options : requested-chassis: optional string + If set, identifies a specific chassis (by name or hostname) that + is allowed to bind this port. Using this option will prevent + thrashing between two chassis trying to bind the same port durā€ + ing a live migration. It can also prevent similar thrashing due + to a mis-configuration, if a port is accidentally created on + more than one chassis. + + If set to a comma separated list, the first entry identifies the + main chassis and the rest are one or more additional chassis + that are allowed to bind the same port. + + When multiple chassis are set for the port, and the logical + switch is connected to an external network through a localnet + port, tunneling is enforced for the port to guarantee delivery + of packets directed to the port to all its locations. This has + MTU implications because the network used for tunneling must + have MTU larger than localnet for stable connectivity. + + options : activation-strategy: optional string + If used with multiple chassis set in requested-chassis, speciā€ + fies an activation strategy for all additional chassis. By deā€ + fault, no activation strategy is used, meaning additional port + locations are immediately available for use. When set to "rarp", + the port is blocked for ingress and egress communication until a + RARP packet is sent from a new location. The "rarp" strategy is + useful in live migration scenarios for virtual machines. + + options : additional-chassis-activated: optional string + When activation-strategy is set, this option indicates that the + port was activated using the strategy specified. + + options : iface-id-ver: optional string + If set, this port will be bound by ovn-controller only if this + same key and value is configured in the external_ids column in + the Open_vSwitch databaseā€™s Interface table. + + options : qos_min_rate: optional string + If set, indicates the minimum guaranteed rate available for data + sent from this interface, in bit/s. + + options : qos_max_rate: optional string + If set, indicates the maximum rate for data sent from this inā€ + terface, in bit/s. The traffic will be shaped according to this + limit. + + options : qos_burst: optional string + If set, indicates the maximum burst size for data sent from this + interface, in bits. + + options : qos_physical_network: optional string + If set, indicates the name of the egress network name where + traffic shaping will be applied. + + options : qdisc_queue_id: optional string, containing an integer, in + range 1 to 61,440 + Indicates the queue number on the physical device. This is same + as the queue_id used in OpenFlow in struct ofp_action_enqueue. + + Distributed Gateway Port Options: + + These options apply to the distributed parent ports of logical ports + with type of chasssisredirect. + + options : chassis-redirect-port: optional string + The name of the chassis redirect port derived from this port if + this port is a distributed parent of a chassis redirect port. + + Chassis Redirect Options: + + These options apply to logical ports with type of chassisredirect. + + options : distributed-port: optional string + The name of the distributed port for which this chassisredirect + port represents a particular instance. + + options : redirect-type: optional string + The value is copied from the column options in the OVN_Northā€ + bound databaseā€™s Logical_Router_Port table for the distributed + parent of this port. + + options : always-redirect: optional string + A boolean option that is set to true if the distributed parent + of this chassis redirect port does not need distributed processā€ + ing. + + Nested Containers: + + These columns support containers nested within a VM. Specifically, they + are used when type is empty and logical_port identifies the interface + of a container spawned inside a VM. They are empty for containers or + VMs that run directly on a hypervisor. + + parent_port: optional string + This is taken from parent_name in the OVN_Northbound databaseā€™s + Logical_Switch_Port table. + + tag: optional integer, in range 1 to 4,095 + Identifies the VLAN tag in the network traffic associated with + that containerā€™s network interface. + + This column is used for a different purpose when type is localā€ā€ + net (see Localnet Options, above) or l2gateway (see L2 Gateway + Options, above). + + Virtual ports: + + virtual_parent: optional string + This column is set by ovn-controller with one of the value from + the options:virtual-parents in the OVN_Northbound databaseā€™s + Logical_Switch_Port table when the OVN action bind_vport is exeā€ + cuted. ovn-controller also sets the chassis column when it exeā€ + cutes this action with its chassis id. + + ovn-controller sets this column only if the type is "virtual". + + Naming: + + external_ids : name: optional string + For a logical switch port, ovn-northd copies this from exterā€ā€ + nal_ids:neutron:port_name in the Logical_Switch_Port table in + the OVN_Northbound database, if it is a nonempty string. + + For a logical switch port, ovn-northd does not currently set + this key. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + The ovn-northd program populates this column with all entries + into the external_ids column of the Logical_Switch_Port and Logā€ā€ + ical_Router_Port tables of the OVN_Northbound database. + +MAC_Binding TABLE + Each row in this table specifies a binding from an IP address to an + Ethernet address that has been discovered through ARP (for IPv4) or + neighbor discovery (for IPv6). This table is primarily used to discover + bindings on physical networks, because IP-to-MAC bindings for virtual + machines are usually populated statically into the Port_Binding table. + + This table expresses a functional relationship: MAC_Binding(logiā€ā€ + cal_port, ip) = mac. + + In outline, the lifetime of a logical routerā€™s MAC binding looks like + this: + + 1. On hypervisor 1, a logical router determines that a packet + should be forwarded to IP address A on one of its router + ports. It uses its logical flow table to determine that A + lacks a static IP-to-MAC binding and the get_arp action to + determine that it lacks a dynamic IP-to-MAC binding. + + 2. Using an OVN logical arp action, the logical router generā€ + ates and sends a broadcast ARP request to the router port. + It drops the IP packet. + + 3. The logical switch attached to the router port delivers the + ARP request to all of its ports. (It might make sense to deā€ + liver it only to ports that have no static IP-to-MAC bindā€ + ings, but this could also be surprising behavior.) + + 4. A host or VM on hypervisor 2 (which might be the same as hyā€ + pervisor 1) attached to the logical switch owns the IP adā€ + dress in question. It composes an ARP reply and unicasts it + to the logical router portā€™s Ethernet address. + + 5. The logical switch delivers the ARP reply to the logical + router port. + + 6. The logical router flow table executes a put_arp action. To + record the IP-to-MAC binding, ovn-controller adds a row to + the MAC_Binding table. + + 7. On hypervisor 1, ovn-controller receives the updated + MAC_Binding table from the OVN southbound database. The next + packet destined to A through the logical router is sent diā€ + rectly to the bound Ethernet address. + + Summary: + logical_port string + ip string + mac string + timestamp integer + datapath Datapath_Binding + + Details: + logical_port: string + The logical port on which the binding was discovered. + + ip: string + The bound IP address. + + mac: string + The Ethernet address to which the IP is bound. + + timestamp: integer + The timestamp in msec when the MAC binding was added or updated. + Records that existed before this column will have 0. + + datapath: Datapath_Binding + The logical datapath to which the logical port belongs. + +DHCP_Options TABLE + Each row in this table stores the DHCP Options supported by native OVN + DHCP. ovn-northd populates this table with the supported DHCP options. + ovn-controller looks up this table to get the DHCP codes of the DHCP + options defined in the "put_dhcp_opts" action. Please refer to the RFC + 2132 "https://tools.ietf.org/html/rfc2132" for the possible list of + DHCP options that can be defined here. + + Summary: + name string + code integer, in range 0 to 254 + type string, one of bool, domains, host_id, + ipv4, static_routes, str, uint16, uint32, + or uint8 + + Details: + name: string + Name of the DHCP option. + + Example. name="router" + + code: integer, in range 0 to 254 + DHCP option code for the DHCP option as defined in the RFC 2132. + + Example. code=3 + + type: string, one of bool, domains, host_id, ipv4, static_routes, str, + uint16, uint32, or uint8 + Data type of the DHCP option code. + + value: bool + This indicates that the value of the DHCP option is a + bool. + + Example. "name=ip_forward_enable", "code=19", + "type=bool". + + put_dhcp_opts(..., ip_forward_enable = 1,...) + + value: uint8 + This indicates that the value of the DHCP option is an + unsigned int8 (8 bits) + + Example. "name=default_ttl", "code=23", "type=uint8". + + put_dhcp_opts(..., default_ttl = 50,...) + + value: uint16 + This indicates that the value of the DHCP option is an + unsigned int16 (16 bits). + + Example. "name=mtu", "code=26", "type=uint16". + + put_dhcp_opts(..., mtu = 1450,...) + + value: uint32 + This indicates that the value of the DHCP option is an + unsigned int32 (32 bits). + + Example. "name=lease_time", "code=51", "type=uint32". + + put_dhcp_opts(..., lease_time = 86400,...) + + value: ipv4 + This indicates that the value of the DHCP option is an + IPv4 address or addresses. + + Example. "name=router", "code=3", "type=ipv4". + + put_dhcp_opts(..., router = 10.0.0.1,...) + + Example. "name=dns_server", "code=6", "type=ipv4". + + put_dhcp_opts(..., dns_server = {8.8.8.8 7.7.7.7},...) + + value: static_routes + This indicates that the value of the DHCP option contains + a pair of IPv4 route and next hop addresses. + + Example. "name=classless_static_route", "code=121", + "type=static_routes". + + put_dhcp_opts(..., classless_static_route = + {30.0.0.0/24,10.0.0.4,0.0.0.0/0,10.0.0.1}...) + + value: str + This indicates that the value of the DHCP option is a + string. + + Example. "name=host_name", "code=12", "type=str". + + value: host_id + This indicates that the value of the DHCP option is a + host_id. It can either be a host_name or an IP address. + + Example. "name=tftp_server", "code=66", "type=host_id". + + value: domains + This indicates that the value of the DHCP option is a doā€ + main name or a comma separated list of domain names. + + Example. "name=domain_search_list", "code=119", "type=doā€ + mains". +DHCPv6_Options TABLE + Each row in this table stores the DHCPv6 Options supported by native + OVN DHCPv6. ovn-northd populates this table with the supported DHCPv6 + options. ovn-controller looks up this table to get the DHCPv6 codes of + the DHCPv6 options defined in the put_dhcpv6_opts action. Please refer + to RFC 3315 and RFC 3646 for the list of DHCPv6 options that can be deā€ + fined here. + + Summary: + name string + code integer, in range 0 to 254 + type string, one of ipv6, mac, or str + + Details: + name: string + Name of the DHCPv6 option. + + Example. name="ia_addr" + + code: integer, in range 0 to 254 + DHCPv6 option code for the DHCPv6 option as defined in the apā€ + propriate RFC. + + Example. code=3 + + type: string, one of ipv6, mac, or str + Data type of the DHCPv6 option code. + + value: ipv6 + This indicates that the value of the DHCPv6 option is an + IPv6 address(es). + + Example. "name=ia_addr", "code=5", "type=ipv6". + + put_dhcpv6_opts(..., ia_addr = ae70::4,...) + + value: str + This indicates that the value of the DHCPv6 option is a + string. + + Example. "name=domain_search", "code=24", "type=str". + + put_dhcpv6_opts(..., domain_search = ovn.domain,...) + + value: mac + This indicates that the value of the DHCPv6 option is a + MAC address. + + Example. "name=server_id", "code=2", "type=mac". + + put_dhcpv6_opts(..., server_id = 01:02:03:04L05:06,...) +Connection TABLE + Configuration for a database connection to an Open vSwitch database + (OVSDB) client. + + This table primarily configures the Open vSwitch database server + (ovsdb-server). + + The Open vSwitch database server can initiate and maintain active conā€ + nections to remote clients. It can also listen for database connecā€ + tions. + + Summary: + Core Features: + target string (must be unique within table) + read_only boolean + role string + Client Failure Detection and Handling: + max_backoff optional integer, at least 1,000 + inactivity_probe optional integer + Status: + is_connected boolean + status : last_error optional string + status : state optional string, one of ACTIVE, BACKOFF, + CONNECTING, IDLE, or VOID + status : sec_since_connect optional string, containing an integer, + at least 0 + status : sec_since_disconnect + optional string, containing an integer, + at least 0 + status : locks_held optional string + status : locks_waiting optional string + status : locks_lost optional string + status : n_connections optional string, containing an integer, + at least 2 + status : bound_port optional string, containing an integer + Common Columns: + external_ids map of string-string pairs + other_config map of string-string pairs + + Details: + Core Features: + + target: string (must be unique within table) + Connection methods for clients. + + The following connection methods are currently supported: + + ssl:host[:port] + The specified SSL port on the given host, which can eiā€ + ther be a DNS name (if built with unbound library) or an + IP address. A valid SSL configuration must be provided + when this form is used, this configuration can be speciā€ + fied via command-line options or the SSL table. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + tcp:host[:port] + The specified TCP port on the given host, which can eiā€ + ther be a DNS name (if built with unbound library) or an + IP address (IPv4 or IPv6). If host is an IPv6 address, + wrap it in square brackets, e.g. tcp:[::1]:6640. + + If port is not specified, it defaults to 6640. + + pssl:[port][:host] + Listens for SSL connections on the specified TCP port. + Specify 0 for port to have the kernel automatically + choose an available port. If host, which can either be a + DNS name (if built with unbound library) or an IP adā€ + dress, is specified, then connections are restricted to + the resolved or specified local IP address (either IPv4 + or IPv6 address). If host is an IPv6 address, wrap in + square brackets, e.g. pssl:6640:[::1]. If host is not + specified then it listens only on IPv4 (but not IPv6) adā€ + dresses. A valid SSL configuration must be provided when + this form is used, this can be specified either via comā€ + mand-line options or the SSL table. + + If port is not specified, it defaults to 6640. + + SSL support is an optional feature that is not always + built as part of Open vSwitch. + + ptcp:[port][:host] + Listens for connections on the specified TCP port. Specā€ + ify 0 for port to have the kernel automatically choose an + available port. If host, which can either be a DNS name + (if built with unbound library) or an IP address, is + specified, then connections are restricted to the reā€ + solved or specified local IP address (either IPv4 or IPv6 + address). If host is an IPv6 address, wrap it in square + brackets, e.g. ptcp:6640:[::1]. If host is not specified + then it listens only on IPv4 addresses. + + If port is not specified, it defaults to 6640. + + When multiple clients are configured, the target values must be + unique. Duplicate target values yield unspecified results. + + read_only: boolean + true to restrict these connections to read-only transactions, + false to allow them to modify the database. + + role: string + String containing role name for this connection entry. + + Client Failure Detection and Handling: + + max_backoff: optional integer, at least 1,000 + Maximum number of milliseconds to wait between connection atā€ + tempts. Default is implementation-specific. + + inactivity_probe: optional integer + Maximum number of milliseconds of idle time on connection to the + client before sending an inactivity probe message. If Open + vSwitch does not communicate with the client for the specified + number of seconds, it will send a probe. If a response is not + received for the same additional amount of time, Open vSwitch + assumes the connection has been broken and attempts to reconā€ + nect. Default is implementation-specific. A value of 0 disables + inactivity probes. + + Status: + + Key-value pair of is_connected is always updated. Other key-value pairs + in the status columns may be updated depends on the target type. + + When target specifies a connection method that listens for inbound conā€ + nections (e.g. ptcp: or punix:), both n_connections and is_connected + may also be updated while the remaining key-value pairs are omitted. + + On the other hand, when target specifies an outbound connection, all + key-value pairs may be updated, except the above-mentioned two key- + value pairs associated with inbound connection targets. They are omitā€ + ted. + + is_connected: boolean + true if currently connected to this client, false otherwise. + + status : last_error: optional string + A human-readable description of the last error on the connection + to the manager; i.e. strerror(errno). This key will exist only + if an error has occurred. + + status : state: optional string, one of ACTIVE, BACKOFF, CONNECTING, + IDLE, or VOID + The state of the connection to the manager: + + VOID Connection is disabled. + + BACKOFF + Attempting to reconnect at an increasing period. + + CONNECTING + Attempting to connect. + + ACTIVE Connected, remote host responsive. + + IDLE Connection is idle. Waiting for response to keep-alive. + + These values may change in the future. They are provided only + for human consumption. + + status : sec_since_connect: optional string, containing an integer, at + least 0 + The amount of time since this client last successfully connected + to the database (in seconds). Value is empty if client has never + successfully been connected. + + status : sec_since_disconnect: optional string, containing an integer, + at least 0 + The amount of time since this client last disconnected from the + database (in seconds). Value is empty if client has never disā€ + connected. + + status : locks_held: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection holds. Omitted if the connection does not hold any + locks. + + status : locks_waiting: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection is currently waiting to acquire. Omitted if the connecā€ + tion is not waiting for any locks. + + status : locks_lost: optional string + Space-separated list of the names of OVSDB locks that the conā€ + nection has had stolen by another OVSDB client. Omitted if no + locks have been stolen from this connection. + + status : n_connections: optional string, containing an integer, at + least 2 + When target specifies a connection method that listens for inā€ + bound connections (e.g. ptcp: or pssl:) and more than one conā€ + nection is actually active, the value is the number of active + connections. Otherwise, this key-value pair is omitted. + + status : bound_port: optional string, containing an integer + When target is ptcp: or pssl:, this is the TCP port on which the + OVSDB server is listening. (This is particularly useful when + target specifies a port of 0, allowing the kernel to choose any + available port.) + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs + + other_config: map of string-string pairs +SSL TABLE + SSL configuration for ovn-sb database access. + + Summary: + private_key string + certificate string + ca_cert string + bootstrap_ca_cert boolean + ssl_protocols string + ssl_ciphers string + Common Columns: + external_ids map of string-string pairs + + Details: + private_key: string + Name of a PEM file containing the private key used as the + switchā€™s identity for SSL connections to the controller. + + certificate: string + Name of a PEM file containing a certificate, signed by the cerā€ + tificate authority (CA) used by the controller and manager, that + certifies the switchā€™s private key, identifying a trustworthy + switch. + + ca_cert: string + Name of a PEM file containing the CA certificate used to verify + that the switch is connected to a trustworthy controller. + + bootstrap_ca_cert: boolean + If set to true, then Open vSwitch will attempt to obtain the CA + certificate from the controller on its first SSL connection and + save it to the named PEM file. If it is successful, it will imā€ + mediately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certificate + signed by the CA certificate thus obtained. This option exposes + the SSL connection to a man-in-the-middle attack obtaining the + initial CA certificate. It may still be useful for bootstrapā€ + ping. + + ssl_protocols: string + List of SSL protocols to be enabled for SSL connections. The deā€ + fault when this option is omitted is TLSv1,TLSv1.1,TLSv1.2. + + ssl_ciphers: string + List of ciphers (in OpenSSL cipher string format) to be supā€ + ported for SSL connections. The default when this option is + omitted is HIGH:!aNULL:!MD5. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs +DNS TABLE + Each row in this table stores the DNS records. The OVN action + dns_lookup uses this table for DNS resolution. + + Summary: + records map of string-string pairs + datapaths set of 1 or more Datapath_Bindings + Common Columns: + external_ids map of string-string pairs + + Details: + records: map of string-string pairs + Key-value pair of DNS records with DNS query name as the key and + a string of IP address(es) separated by comma or space as the + value. ovn-northd stores the DNS query name in all lowercase in + order to facilitate case-insensitive lookups. + + Example: "vm1.ovn.org" = "10.0.0.4 aef0::4" + + datapaths: set of 1 or more Datapath_Bindings + The DNS records defined in the column records will be applied + only to the DNS queries originating from the datapaths defined + in this column. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +RBAC_Role TABLE + Role table for role-based access controls. + + Summary: + name string + permissions map of string-weak reference to RBAC_Perā€ā€ + mission pairs + + Details: + name: string + The role name, corresponding to the role column in the Connecā€ā€ + tion table. + + permissions: map of string-weak reference to RBAC_Permission pairs + A mapping of table names to rows in the RBAC_Permission table. + +RBAC_Permission TABLE + Permissions table for role-based access controls. + + Summary: + table string + authorization set of strings + insert_delete boolean + update set of strings + + Details: + table: string + Name of table to which this row applies. + + authorization: set of strings + Set of strings identifying columns and column:key pairs to be + compared with client ID. At least one match is required in order + to be authorized. A zero-length string is treated as a special + value indicating all clients should be considered authorized. + + insert_delete: boolean + When "true", row insertions and authorized row deletions are + permitted. + + update: set of strings + Set of strings identifying columns and column:key pairs that auā€ + thorized clients are allowed to modify. + +Gateway_Chassis TABLE + Association of Port_Binding rows of type chassisredirect to a Chassis. + The traffic going out through a specific chassisredirect port will be + redirected to a chassis, or a set of them in high availability configuā€ + rations. + + Summary: + name string (must be unique within table) + chassis optional weak reference to Chassis + priority integer, in range 0 to 32,767 + options map of string-string pairs + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Name of the Gateway_Chassis. + + A suggested, but not required naming convention is + ${port_name}_${chassis_name}. + + chassis: optional weak reference to Chassis + The Chassis to which we send the traffic. + + priority: integer, in range 0 to 32,767 + This is the priority the specific Chassis among all Gateā€ + way_Chassis belonging to the same Port_Binding. + + options: map of string-string pairs + Reserved for future use. + + Common Columns: + + The overall purpose of these columns is described under Common Columns + at the beginning of this document. + + external_ids: map of string-string pairs +HA_Chassis TABLE + Summary: + chassis optional weak reference to Chassis + priority integer, in range 0 to 32,767 + Common Columns: + external_ids map of string-string pairs + + Details: + chassis: optional weak reference to Chassis + The Chassis which provides the HA functionality. + + priority: integer, in range 0 to 32,767 + Priority of the HA chassis. Chassis with highest priority will + be the master in the HA chassis group. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +HA_Chassis_Group TABLE + Table representing a group of chassis which can provide High availabilā€ + ity services. Each chassis in the group is represented by the table + HA_Chassis. The HA chassis with highest priority will be the master of + this group. If the master chassis failover is detected, the HA chassis + with the next higher priority takes over the responsibility of providā€ + ing the HA. If ha_chassis_group column of the table Port_Binding referā€ + ences this table, then this HA chassis group provides the gateway funcā€ + tionality and redirects the gateway traffic to the master of this + group. + + Summary: + name string (must be unique within table) + ha_chassis set of HA_Chassises + ref_chassis set of weak reference to Chassis + Common Columns: + external_ids map of string-string pairs + + Details: + name: string (must be unique within table) + Name of the HA_Chassis_Group. Name should be unique. + + ha_chassis: set of HA_Chassises + A list of HA_Chassis which belongs to this group. + + ref_chassis: set of weak reference to Chassis + The set of Chassis that reference this HA chassis group. To deā€ + termine the correct Chassis, find the chassisredirect type + Port_Binding that references this HA_Chassis_Group. This + Port_Binding is derived from some particular logical router. + Starting from that LR, find the set of all logical switches and + routers connected to it, directly or indirectly, across router + ports that link one LRP to another or to a LSP. For each LSP in + these logical switches, find the corresponding Port_Binding and + add its bound Chassis (if any) to ref_chassis. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Controller_Event TABLE + Database table used by ovn-controller to report CMS related events. + Please note there is no guarantee a given event is written exactly once + in the db. It is CMS responsibility to squash duplicated lines or to + filter out duplicated events + + Summary: + event_type string, must be empty_lb_backends + event_info map of string-string pairs + chassis optional weak reference to Chassis + seq_num integer + + Details: + event_type: string, must be empty_lb_backends + Event type occurred + + event_info: map of string-string pairs + Key-value pairs used to specify event info to the CMS. Possible + values are: + + ā€¢ vip: VIP reported for the empty_lb_backends event + + ā€¢ protocol: Transport protocol reported for the + empty_lb_backends event + + ā€¢ load_balancer: UUID of the load balancer reported for the + empty_lb_backends event + + chassis: optional weak reference to Chassis + This column is a Chassis record to identify the chassis that has + managed a given event. + + seq_num: integer + Event sequence number. Global counter for controller generated + events. It can be used by the CMS to detect possible duplication + of the same event. +IP_Multicast TABLE + IP Multicast configuration options. For now only applicable to IGMP. + + Summary: + datapath weak reference to Datapath_Binding (must + be unique within table) + enabled optional boolean + querier optional boolean + table_size optional integer + idle_timeout optional integer + query_interval optional integer + seq_no integer + Querier configuration options: + eth_src string + ip4_src string + ip6_src string + query_max_resp optional integer + + Details: + datapath: weak reference to Datapath_Binding (must be unique within taā€ + ble) + Datapath_Binding entry for which these configuration options are + defined. + + enabled: optional boolean + Enables/disables multicast snooping. Default: disabled. + + querier: optional boolean + Enables/disables multicast querying. If enabled then multicast + querying is enabled by default. + + table_size: optional integer + Limits the number of multicast groups that can be learned. Deā€ + fault: 2048 groups per datapath. + + idle_timeout: optional integer + Configures the idle timeout (in seconds) for IP multicast groups + if multicast snooping is enabled. Default: 300 seconds. + + query_interval: optional integer + Configures the interval (in seconds) for sending multicast + queries if snooping and querier are enabled. Default: idle_timeā€ā€ + out/2 seconds. + + seq_no: integer + ovn-controller reads this value and flushes all learned multiā€ + cast groups when it detects that seq_no was changed. + + Querier configuration options: + + The ovn-controller process that runs on OVN hypervisor nodes uses the + following columns to determine field values in IGMP/MLD queries that it + originates: + + eth_src: string + Source Ethernet address. + + ip4_src: string + Source IPv4 address. + + ip6_src: string + Source IPv6 address. + + query_max_resp: optional integer + Value (in seconds) to be used as "max-response" field in multiā€ + cast queries. Default: 1 second. + +IGMP_Group TABLE + Contains learned IGMP groups indexed by address/datapath/chassis. + + Summary: + address string + datapath optional weak reference to Datapath_Bindā€ā€ + ing + chassis optional weak reference to Chassis + ports set of weak reference to Port_Bindings + + Details: + address: string + Destination IPv4 address for the IGMP group. + + datapath: optional weak reference to Datapath_Binding + Datapath to which this IGMP group belongs. + + chassis: optional weak reference to Chassis + Chassis to which this IGMP group belongs. + + ports: set of weak reference to Port_Bindings + The destination port bindings for this IGMP group. + +Service_Monitor TABLE + Each row in this table configures monitoring a service for its liveā€ + ness. The service can be an IPv4 TCP or UDP service. ovn-controller peā€ + riodically sends out service monitor packets and updates the status of + the service. Service monitoring for IPv6 services is not supported. + + ovn-northd uses this feature to implement the load balancer health + check feature offered to the CMS through the northbound database. + + Summary: + Configuration: + ip string + protocol optional string, either tcp or udp + port integer, in range 0 to 65,535 + logical_port string + src_mac string + src_ip string + options : interval optional string, containing an integer + options : timeout optional string, containing an integer + options : success_count optional string, containing an integer + options : failure_count optional string, containing an integer + Status Reporting: + status optional string, one of error, offline, + or online + Common Columns: + external_ids map of string-string pairs + + Details: + Configuration: + + ovn-northd sets these columns and values to configure the service moniā€ + tor. + + ip: string + IP of the service to be monitored. Only IPv4 is supported. + + protocol: optional string, either tcp or udp + The protocol of the service. + + port: integer, in range 0 to 65,535 + The TCP or UDP port of the service. + + logical_port: string + The VIF of the logical port on which the service is running. The + ovn-controller that binds this logical_port monitors the service + by sending periodic monitor packets. + + src_mac: string + Source Ethernet address to use in the service monitor packet. + + src_ip: string + Source IPv4 address to use in the service monitor packet. + + options : interval: optional string, containing an integer + The interval, in seconds, between service monitor checks. + + options : timeout: optional string, containing an integer + The time, in seconds, after which the service monitor check + times out. + + options : success_count: optional string, containing an integer + The number of successful checks after which the service is conā€ + sidered online. + + options : failure_count: optional string, containing an integer + The number of failure checks after which the service is considā€ + ered offline. + + Status Reporting: + + The ovn-controller on the chassis that hosts the logical_port updates + this column to report the serviceā€™s status. + + status: optional string, one of error, offline, or online + For TCP service, ovn-controller sends a SYN to the service and + expects an ACK response to consider the service to be online. + + For UDP service, ovn-controller sends a UDP packet to the serā€ + vice and doesnā€™t expect any reply. If it receives an ICMP reply, + then it considers the service to be offline. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +Load_Balancer TABLE + Each row represents a load balancer. + + Summary: + name string + vips map of string-string pairs + protocol optional string, one of sctp, tcp, or udp + datapaths set of Datapath_Bindings + datapath_group optional Logical_DP_Group + Load_Balancer options: + options : hairpin_snat_ip optional string + options : hairpin_orig_tuple + optional string, either true or false + Common Columns: + external_ids map of string-string pairs + + Details: + name: string + A name for the load balancer. This name has no special meaning + or purpose other than to provide convenience for human interacā€ + tion with the ovn-nb database. + + vips: map of string-string pairs + A map of virtual IP addresses (and an optional port number with + : as a separator) associated with this load balancer and their + corresponding endpoint IP addresses (and optional port numbers + with : as separators) separated by commas. + + protocol: optional string, one of sctp, tcp, or udp + Valid protocols are tcp, udp, or sctp. This column is useful + when a port number is provided as part of the vips column. If + this column is empty and a port number is provided as part of + vips column, OVN assumes the protocol to be tcp. + + datapaths: set of Datapath_Bindings + Datapaths to which this load balancer applies to. + + datapath_group: optional Logical_DP_Group + The group of datapaths to which this load balancer applies to. + This means that the same load balancer applies to all datapaths + in a group. + + Load_Balancer options: + + options : hairpin_snat_ip: optional string + IP to be used as source IP for packets that have been hair- + pinned after load balancing. This value is automatically popuā€ + lated by ovn-northd. + + options : hairpin_orig_tuple: optional string, either true or false + This value is automatically set to true by ovn-northd when origā€ + inal destination IP and transport port of the load balanced + packets are stored in registers reg1, reg2, xxreg1. + + Common Columns: + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + +BFD TABLE + Contains BFD parameter for ovn-controller bfd configuration. + + Summary: + Configuration: + src_port integer, in range 49,152 to 65,535 + disc integer + logical_port string + dst_ip string + min_tx integer + min_rx integer + detect_mult integer + options map of string-string pairs + external_ids map of string-string pairs + Status Reporting: + status string, one of admin_down, down, init, or + up + + Details: + Configuration: + + src_port: integer, in range 49,152 to 65,535 + udp source port used in bfd control packets. The source port + MUST be in the range 49152 through 65535 (RFC5881 section 4). + + disc: integer + A unique, nonzero discriminator value generated by the transmitā€ + ting system, used to demultiplex multiple BFD sessions between + the same pair of systems. + + logical_port: string + OVN logical port when BFD engine is running. + + dst_ip: string + BFD peer IP address. + + min_tx: integer + This is the minimum interval, in milliseconds, that the local + system would like to use when transmitting BFD Control packets, + less any jitter applied. The value zero is reserved. + + min_rx: integer + This is the minimum interval, in milliseconds, between received + BFD Control packets that this system is capable of supporting, + less any jitter applied by the sender. If this value is zero, + the transmitting system does not want the remote system to send + any periodic BFD Control packets. + + detect_mult: integer + Detection time multiplier. The negotiated transmit interval, + multiplied by this value, provides the Detection Time for the + receiving system in Asynchronous mode. + + options: map of string-string pairs + Reserved for future use. + + external_ids: map of string-string pairs + See External IDs at the beginning of this document. + + Status Reporting: + + status: string, one of admin_down, down, init, or up + BFD port logical states. Possible values are: + + ā€¢ admin_down + + ā€¢ down + + ā€¢ init + + ā€¢ up +FDB TABLE + This table is primarily used to learn the MACs observed on a VIF (or a + localnet port with ā€™localnet_learn_fdbā€™ enabled) which belongs to a + Logical_Switch_Port record in OVN_Northbound whose port security is + disabled and ā€™unknownā€™ address set. If port security is disabled on a + Logical_Switch_Port record, OVN should allow traffic with any source + mac from the VIF. This table will be used to deliver a packet to the + VIF, If a packetā€™s eth.dst is learnt. + + Summary: + mac string + dp_key integer, in range 1 to 16,777,215 + port_key integer, in range 1 to 16,777,215 + + Details: + mac: string + The learnt mac address. + + dp_key: integer, in range 1 to 16,777,215 + The key of the datapath on which this FDB was learnt. + + port_key: integer, in range 1 to 16,777,215 + The key of the port binding on which this FDB was learnt. + +Static_MAC_Binding TABLE + Each record represents a Static_MAC_Binding entry for a logical router. + + Summary: + logical_port string + ip string + mac string + override_dynamic_mac boolean + datapath Datapath_Binding + + Details: + logical_port: string + The logical router port for the binding. + + ip: string + The bound IP address. + + mac: string + The Ethernet address to which the IP is bound. + + override_dynamic_mac: boolean + Override dynamically learnt MACs. + + datapath: Datapath_Binding + The logical datapath to which the logical router port belongs. + +Chassis_Template_Var TABLE + Each record represents the set of template variable instantiations for + a given chassis and is populated by ovn-northd from the contents of the + OVN_Northbound.Chassis_Template_Var table. + + Summary: + chassis string (must be unique within table) + variables map of string-string pairs + + Details: + chassis: string (must be unique within table) + The chassis this set of variable values applies to. + + variables: map of string-string pairs + The set of variable values for a given chassis. + +Open vSwitch 23.06.3 DB Schema 20.27.2 ovn-sb(5) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8 b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8 new file mode 100644 index 00000000..64bd47f5 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8 @@ -0,0 +1,658 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-sbctl" 8 "ovn-sbctl" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-sbctl \- Open Virtual Network southbound db management utility +.SH "SYNOPSIS" +.PP +\fBovn\-sbctl\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] +.SH "DESCRIPTION" +.PP +.PP +The \fBovn\-sbctl\fR program configures the \fBOVN_Southbound\fR database by providing a high-level interface to its configuration database\[char46] See \fBovn\-sb\fR(5) for comprehensive documentation of the database schema\[char46] +.PP +.PP +\fBovn\-sbctl\fR connects to an \fBovsdb\-server\fR process that maintains an OVN_Southbound configuration database\[char46] Using this connection, it queries and possibly applies changes to the database, depending on the supplied commands\[char46] +.PP +.PP +\fBovn\-sbctl\fR can perform any number of commands in a single run, implemented as a single atomic transaction against the database\[char46] +.PP +.PP +The \fBovn\-sbctl\fR command line begins with global options (see \fBOPTIONS\fR below for details)\[char46] The global options are followed by one or more commands\[char46] Each command should begin with \fB\-\-\fR by itself as a command-line argument, to separate it from the following commands\[char46] (The \fB\-\-\fR before the first command is optional\[char46]) The command itself starts with command-specific options, if any, followed by the command name and any arguments\[char46] +.SH "DAEMON MODE" +.PP +.PP +When it is invoked in the most ordinary way, \fBovn\-sbctl\fR connects to an OVSDB server that hosts the southbound database, retrieves a partial copy of the database that is complete enough to do its work, sends a transaction request to the server, and receives and processes the server\(cqs reply\[char46] In common interactive use, this is fine, but if the database is large, the step in which \fBovn\-sbctl\fR retrieves a partial copy of the database can take a long time, which yields poor performance overall\[char46] +.PP +.PP +To improve performance in such a case, \fBovn\-sbctl\fR offers a \(dqdaemon mode,\(dq in which the user first starts \fBovn\-sbctl\fR running in the background and afterward uses the daemon to execute operations\[char46] Over several \fBovn\-sbctl\fR command invocations, this performs better overall because it retrieves a copy of the database only once at the beginning, not once per program run\[char46] +.PP +.PP +Use the \fB\-\-detach\fR option to start an \fBovn\-sbctl\fR daemon\[char46] With this option, \fBovn\-sbctl\fR prints the name of a control socket to stdout\[char46] The client should save this name in environment variable \fBOVN_SB_DAEMON\fR\[char46] Under the Bourne shell this might be done like this: +.PP +.nf +\fL +.br +\fL export OVN_SB_DAEMON=$(ovn\-sbctl \-\-pidfile \-\-detach) +.br +\fL \fR +.fi +.PP +.PP +When \fBOVN_SB_DAEMON\fR is set, \fBovn\-sbctl\fR automatically and transparently uses the daemon to execute its commands\[char46] +.PP +.PP +When the daemon is no longer needed, kill it and unset the environment variable, e\[char46]g\[char46]: +.PP +.nf +\fL +.br +\fL kill $(cat $OVN_RUNDIR/ovn\-sbctl\[char46]pid) +.br +\fL unset OVN_SB_DAEMON +.br +\fL \fR +.fi +.PP +.PP +When using daemon mode, an alternative to the \fBOVN_SB_DAEMON\fR environment variable is to specify a path for the Unix socket\[char46] When starting the ovn-sbctl daemon, specify the \fB\-u\fR option with a full path to the location of the socket file\[char46] Here is an exmple: +.PP +.nf +\fL +.br +\fL ovn\-sbctl \-\-detach \-u /tmp/mysock\[char46]ctl +.br +\fL \fR +.fi +.PP +.PP +Then to connect to the running daemon, use the \fB\-u\fR option with the full path to the socket created when the daemon was started: +.PP +.nf +\fL +.br +\fL ovn\-sbctl \-u /tmp/mysock\[char46]ctl show +.br +\fL \fR +.fi +.ST "Daemon Commands" +.PP +.PP +Daemon mode is internally implemented using the same mechanism used by \fBovn\-appctl\fR\[char46] One may also use \fBovn\-appctl\fR directly with the following commands: +.RS +.TP +\fBrun\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] [\fB\-\-\fR [\fIoptions\fR] \fIcommand\fR [\fIarg\fR\[char46]\[char46]\[char46]] \[char46]\[char46]\[char46]] +Instructs the daemon process to run one or more \fBovn\-sbctl\fR commands described above and reply with the results of running these commands\[char46] Accepts the \fB\-\-no\-wait\fR, \fB\-\-wait\fR, \fB\-\-timeout\fR, \fB\-\-dry\-run\fR, \fB\-\-oneline\fR, and the options described under \fBTable Formatting Options\fR in addition to the the command-specific options\[char46] +.TP +\fBexit\fR +Causes \fBovn\-sbctl\fR to gracefully terminate\[char46] +.RE +.SH "OPTIONS" +.PP +.PP +The options listed below affect the behavior of \fBovn\-sbctl\fR as a whole\[char46] Some individual commands also accept their own options, which are given just before the command name\[char46] If the first command on the command line has options, then those options must be separated from the global options by \fB\-\-\fR\[char46] +.PP +.PP +\fBovn\-sbctl\fR also accepts options from the \fBOVN_SBCTL_OPTIONS\fR environment variable, in the same format as on the command line\[char46] Options from the command line override those in the environment\[char46] +.RS +.TP +\fB\-\-db\fR \fIdatabase\fR +The OVSDB database remote to contact\[char46] If the \fBOVN_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/ovnsb_db\[char46]sock\fR, but this default is unlikely to be useful outside of single-machine OVN test environments\[char46] +.TP +\fB\-\-leader\-only\fR +.TQ .5in +\fB\-\-no\-leader\-only\fR +By default, or with \fB\-\-leader\-only\fR, when the database server is a clustered database, \fBovn\-sbctl\fR will avoid servers other than the cluster leader\[char46] This ensures that any data that \fBovn\-sbctl\fR reads and reports is up-to-date\[char46] With \fB\-\-no\-leader\-only\fR, \fBovn\-sbctl\fR will use any server in the cluster, which means that for read-only transactions it can report and act on stale data (transactions that modify the database are always serialized even with \fB\-\-no\-leader\-only\fR)\[char46] Refer to \fBUnderstanding Cluster Consistency\fR in \fBovsdb\fR(7) for more information\[char46] +.TP +\fB\-\-shuffle\-remotes\fR +.TQ .5in +\fB\-\-no\-shuffle\-remotes\fR +By default, or with \fB\-\-shuffle\-remotes\fR, when there are multiple remotes specified in the OVSDB connection string specified by \fB\-\-db\fR or the \fBOVN_SB_DB\fR environment variable, the order of the remotes will be shuffled before the client tries to connect\[char46] The remotes will be shuffled only once to a new order before the first connection attempt\[char46] The following retries, if any, will follow the same new order\[char46] The default behavior is to make sure clients of a clustered database can distribute evenly to all members of the cluster\[char46] With \fB\-\-no\-shuffle\-remotes\fR, \fBovn\-sbctl\fR will use the original order specified in the connection string to connect\[char46] This allows user to specify the preferred order, which is particularly useful for testing\[char46] +.TP +\fB\-\-no\-syslog\fR +By default, \fBovn\-sbctl\fR logs its arguments and the details of any changes that it makes to the system log\[char46] This option disables this logging\[char46] +.IP +This option is equivalent to \fB\-\-verbose=sbctl:syslog:warn\fR\[char46] +.TP +\fB\-\-oneline\fR +Modifies the output format so that the output for each command is printed on a single line\[char46] New-line characters that would otherwise separate lines are printed as \efB\e\en\efR, and any instances of \efB\e\e\efR that would otherwise appear in the output are doubled\[char46] Prints a blank line for each command that has no output\[char46] This option does not affect the formatting of output from the \fBlist\fR or \fBfind\fR commands; see \fBTable Formatting Options\fR below\[char46] +.TP +\fB\-\-dry\-run\fR +Prevents \fBovn\-sbctl\fR from actually modifying the database\[char46] +.TP +\fB\-t \fIsecs\fB\fR +.TQ .5in +\fB\-\-timeout=\fIsecs\fB\fR +By default, or with a \fIsecs\fR of \fB0\fR, \fBovn\-sbctl\fR waits forever for a response from the database\[char46] This option limits runtime to approximately \fIsecs\fR seconds\[char46] If the timeout expires, \fBovn\-sbctl\fR will exit with a \fBSIGALRM\fR signal\[char46] (A timeout would normally happen only if the database cannot be contacted, or if the system is overloaded\[char46]) +.RE +.SS "Daemon Options" +.TP +\fB\-\-pidfile\fR[\fB=\fR\fIpidfile\fR] +Causes a file (by default, \fB\fIprogram\fB\[char46]pid\fR) to be created indicating the PID of the running process\[char46] If the \fIpidfile\fR argument is not specified, or if it does not begin with \fB/\fR, then it is created in \fB\fR\[char46] +.IP +If \fB\-\-pidfile\fR is not specified, no pidfile is created\[char46] +.TP +\fB\-\-overwrite\-pidfile\fR +By default, when \fB\-\-pidfile\fR is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start\[char46] Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead overwrite the pidfile\[char46] +.IP +When \fB\-\-pidfile\fR is not specified, this option has no effect\[char46] +.TP +\fB\-\-detach\fR +Runs this program as a background process\[char46] The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless \fB\-\-no\-chdir\fR is specified)\[char46] After the child completes its initialization, the parent exits\[char46] +.TP +\fB\-\-monitor\fR +Creates an additional process to monitor this program\[char46] If it dies due to a signal that indicates a programming error (\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR, \fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or \fBSIGXFSZ\fR) then the monitor process starts a new copy of it\[char46] If the daemon dies or exits for another reason, the monitor process exits\[char46] +.IP +This option is normally used with \fB\-\-detach\fR, but it also functions without it\[char46] +.TP +\fB\-\-no\-chdir\fR +By default, when \fB\-\-detach\fR is specified, the daemon changes its current working directory to the root directory after it detaches\[char46] Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory\[char46] +.IP +Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing the daemon from changing its current working directory\[char46] This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use\[char46] +.IP +This option has no effect when \fB\-\-detach\fR is not specified\[char46] +.TP +\fB\-\-no\-self\-confinement\fR +By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time\[char46] It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon\[char46] Note that in contrast to other access control implementations that are typically enforced from kernel-space (e\[char46]g\[char46] DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security\[char46] +.TP +\fB\-\-user=\fR\fIuser\fR\fB:\fR\fIgroup\fR +Causes this program to run as a different user specified in \fIuser\fR\fB:\fR\fIgroup\fR, thus dropping most of the root privileges\[char46] Short forms \fIuser\fR and \fB:\fR\fIgroup\fR are also allowed, with current user or group assumed, respectively\[char46] Only daemons started by the root user accepts this argument\[char46] +.IP +On Linux, daemons will be granted \fBCAP_IPC_LOCK\fR and \fBCAP_NET_BIND_SERVICES\fR before dropping root privileges\[char46] Daemons that interact with a datapath, such as \fBovs\-vswitchd\fR, will be granted three additional capabilities, namely \fBCAP_NET_ADMIN\fR, \fBCAP_NET_BROADCAST\fR and \fBCAP_NET_RAW\fR\[char46] The capability change will apply even if the new user is root\[char46] +.IP +On Windows, this option is not currently supported\[char46] For security reasons, specifying this option will cause the daemon process not to start\[char46] +.SS "Logging options" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SS "Table Formatting Options" +These options control the format of output from the \fBlist\fR and \fBfind\fR commands\[char46] +.RS +.TP +\fB\-f\fR \fIformat\fR +.TQ .5in +\fB\-\-format=\fR\fIformat\fR +Sets the type of table formatting\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBtable\fR +2-D text tables with aligned columns\[char46] +.TP +\fBlist\fR (default) +A list with one column per line and rows separated by a blank line\[char46] +.TP +\fBhtml\fR +HTML tables\[char46] +.TP +\fBcsv\fR +Comma-separated values as defined in RFC 4180\[char46] +.TP +\fBjson\fR +JSON format as defined in RFC 4627\[char46] The output is a sequence of JSON objects, each of which corresponds to one table\[char46] Each JSON object has the following members with the noted values: +.RS +.TP +\fBcaption\fR +The table\(cqs caption\[char46] This member is omitted if the table has no caption\[char46] +.TP +\fBheadings\fR +An array with one element per table column\[char46] Each array element is a string giving the corresponding column\(cqs heading\[char46] +.TP +\fBdata\fR +An array with one element per table row\[char46] Each element is also an array with one element per table column\[char46] The elements of this second-level array are the cells that constitute the table\[char46] Cells that represent OVSDB data or data types are expressed in the format described in the OVSDB specification; other cells are simply expressed as text strings\[char46] +.RE +.RE +.TP +\fB\-d\fR \fIformat\fR +.TQ .5in +\fB\-\-data=\fR\fIformat\fR +Sets the formatting for cells within output tables unless the table format is set to \fBjson\fR, in which case \fBjson\fR formatting is always used when formatting cells\[char46] The following types of \fIformat\fR are available: +.RS +.TP +\fBstring\fR (default) +The simple format described in the \fBDatabase Values\fR section of \fBovs\-vsctl\fR(8)\[char46] +.TP +\fBbare\fR +The simple format with punctuation stripped off: \fB[]\fR and \fB{}\fR are omitted around sets, maps, and empty columns, items within sets and maps are space-separated, and strings are never quoted\[char46] This format may be easier for scripts to parse\[char46] +.TP +\fBjson\fR +The RFC 4627 JSON format as described above\[char46] +.RE +.TP +\fB\-\-no\-headings\fR +This option suppresses the heading row that otherwise appears in the first row of table output\[char46] +.TP +\fB\-\-pretty\fR +By default, JSON in output is printed as compactly as possible\[char46] This option causes JSON in output to be printed in a more readable fashion\[char46] Members of objects and elements of arrays are printed one per line, with indentation\[char46] +.IP +This option does not affect JSON in tables, which is always printed compactly\[char46] +.TP +\fB\-\-bare\fR +Equivalent to \fB\-\-format=list \-\-data=bare \-\-no\-headings\fR\[char46] +.RE +.SS "PKI Options" +.PP +.PP +PKI configuration is required to use SSL for the connection to the database\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.RS +.TP +\fB\-\-bootstrap\-ca\-cert=\fR\fIcacert\[char46]pem\fR +When \fIcacert\[char46]pem\fR exists, this option has the same effect as \fB\-C\fR or \fB\-\-ca\-cert\fR\[char46] If it does not exist, then the executable will attempt to obtain the CA certificate from the SSL peer on its first SSL connection and save it to the named PEM file\[char46] If it is successful, it will immediately drop the connection and reconnect, and from then on all SSL connections must be authenticated by a certificate signed by the CA certificate thus obtained\[char46] +.IP +This option exposes the SSL connection to a man-in-the-middle attack obtaining the initial CA certificate, but it may be useful for bootstrapping\[char46] +.IP +This option is only useful if the SSL peer sends its CA certificate as part of the SSL certificate chain\[char46] The SSL protocol does not require the server to send the CA certificate\[char46] +.IP +This option is mutually exclusive with \fB\-C\fR and \fB\-\-ca\-cert\fR\[char46] +.RE +.SS "Other Options" +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] +.SH "COMMANDS" +.PP +.PP +The following sections describe the commands that \fBovn\-sbctl\fR supports\[char46] +.SS "OVN_Southbound Commands" +.PP +.PP +These commands work with an \fBOVN_Southbound\fR database as a whole\[char46] +.RS +.TP +\fBinit\fR +Initializes the database, if it is empty\[char46] If the database has already been initialized, this command has no effect\[char46] +.TP +\fBshow\fR +Prints a brief overview of the database contents\[char46] +.RE +.SS "Chassis Commands" +.PP +.PP +These commands manipulate \fBOVN_Southbound\fR chassis\[char46] +.RS +.TP +[\fB\-\-may\-exist\fR] \fBchassis\-add \fIchassis\fB \fIencap-type\fB \fIencap-ip\fB\fR +Creates a new chassis named \fIchassis\fR\[char46] \fIencap-type\fR is a comma-separated list of tunnel types\[char46] The chassis will have one encap entry for each specified tunnel type with \fIencap-ip\fR as the destination IP for each\[char46] +.IP +Without \fB\-\-may\-exist\fR, attempting to create a chassis that exists is an error\[char46] With \fB\-\-may\-exist\fR, this command does nothing if \fIchassis\fR already exists\[char46] +.TP +[\fB\-\-if\-exists\fR] \fIchassis-del \fIchassis\fI\fR +Deletes \fIchassis\fR and its \fIencaps\fR and \fIgateway_ports\fR\[char46] +.IP +Without \fB\-\-if\-exists\fR, attempting to delete a chassis that does not exist is an error\[char46] With \fB\-\-if\-exists\fR attempting to delete a chassis that does not exist has no effect\[char46] +.RE +.SS "Port Binding Commands" +.PP +.PP +These commands manipulate \fBOVN_Southbound\fR port bindings\[char46] +.RS +.TP +[\fB\-\-may\-exist\fR] \fBlsp\-bind \fIlogical-port\fB \fIchassis\fB\fR +Binds the logical port named \fIlogical-port\fR to \fIchassis\fR\[char46] +.IP +Without \fB\-\-may\-exist\fR, attempting to bind a logical port that has already been bound is an error\[char46] With \fB\-\-may\-exist\fR, this command does nothing if \fIlogical-port\fR has already been bound to a chassis\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBlsp\-unbind \fIlogical-port\fB\fR +Removes the binding of \fIlogical-port\fR\[char46] +.IP +Without \fB\-\-if\-exists\fR, attempting to unbind a logical port that is not bound is an error\[char46] With \fB\-\-if\-exists\fR, attempting to unbind logical port that is not bound has no effect\[char46] +.RE +.SS "Logical Flow Commands" +.TP +[\fB\-\-uuid\fR] [\fB\-\-ovs\fR[\fB=\fIremote\fB]\fR] [\fB\-\-stats\fR] [\fB\-\-vflows\fR] \fBlflow\-list\fR [\fIlogical-datapath\fR] [\fIlflow\fR\[char46]\[char46]\[char46]] +List logical flows\[char46] If \fIlogical-datapath\fR is specified, only list flows for that logical datapath\[char46] The \fIlogical-datapath\fR may be given as a UUID or as a datapath name (reporting an error if multiple datapaths have the same name)\[char46] +.IP +If at least one \fIlflow\fR is given, only matching logical flows, if any, are listed\[char46] Each \fIlflow\fR may be specified as a UUID or the first few characters of a UUID, optionally prefixed by \fB0x\fR\[char46] (Because \fBovn\-controller\fR sets OpenFlow flow cookies to the first 32 bits of the corresponding logical flow\(cqs UUID, this makes it easy to look up the logical flow that generated a particular OpenFlow flow\[char46]) +.IP +If \fB\-\-uuid\fR is specified, the output includes the first 32 bits of each logical flow\(cqs UUID\[char46] This makes it easier to find the OpenFlow flows that correspond to a given logical flow\[char46] +.IP +If \fB\-\-ovs\fR is included, \fBovn\-sbctl\fR attempts to obtain and display the OpenFlow flows that correspond to each OVN logical flow\[char46] To do so, \fBovn\-sbctl\fR connects to \fIremote\fR (by default, \fBunix:/br\-int\[char46]mgmt\fR) over OpenFlow and retrieves the flows\[char46] If \fIremote\fR is specified, it must be an active OpenFlow connection method described in \fBovsdb\fR(7)\[char46] Please see the discussion of the similar \fB\-\-ovs\fR option in \fBovn\-trace\fR(8) for more information about the OpenFlow flow output\[char46] +.IP +By default, OpenFlow flow output includes only match and actions\[char46] Add \fB\-\-stats\fR to include all OpenFlow information, such as packet and byte counters, duration, and timeouts\[char46] +.IP +If \fB\-\-vflows\fR is included, other southbound database records directly used for generating OpenFlow flows are also listed\[char46] This includes: \fIport-bindings\fR, \fImac-bindings\fR, \fImulticast-groups\fR, \fIchassis\fR\[char46] The \fB\-\-ovs\fR and \fB\-\-stats\fR can also be used in conjunction with \fB\-\-vflows\fR\[char46] +.TP +[\fB\-\-uuid\fR] \fBdump\-flows\fR [\fIlogical-datapath\fR] +Alias for \fBlflow\-list\fR\[char46] +.TP +\fBcount\-flows\fR [\fIlogical-datapath\fR] +prints numbers of logical flows per table and per datapath\[char46] +.SS "Remote Connectivity Commands" +.PP +.PP +These commands manipulate the \fBconnections\fR column in the \fBSB_Global\fR table and rows in the \fBConnection\fR table\[char46] When \fBovsdb\-server\fR is configured to use the \fBconnections\fR column for OVSDB connections, this allows the administrator to use \efBovn\e-sbctl\efR to configure database connections\[char46] +.RS +.TP +\fBget\-connection\fR +Prints the configured connection(s)\[char46] +.TP +\fBdel\-connection\fR +Deletes the configured connection(s)\[char46] +.TP +[\fB\-\-inactivity\-probe=\fR\fImsecs\fR] \fBset\-connection\fR \fItarget\fR\[char46]\[char46]\[char46] +Sets the configured manager target or targets\[char46] Use \fB\-\-inactivity\-probe=\fR\fImsecs\fR to override the default idle connection inactivity probe time\[char46] Use 0 to disable inactivity probes\[char46] +.RE +.SS "SSL Configuration Commands" +.PP +.PP +When \fBovsdb\-server\fR is configured to connect using SSL, the following parameters are required: +.RS +.TP +\fIprivate-key\fR +Specifies a PEM file containing the private key used for SSL connections\[char46] +.TP +\fIcertificate\fR +Specifies a PEM file containing a certificate, signed by the certificate authority (CA) used by the connection peers, that certifies the private key, identifying a trustworthy peer\[char46] +.TP +\fIca-cert\fR +Specifies a PEM file containing the CA certificate used to verify that the connection peers are trustworthy\[char46] +.RE +.PP +.PP +These SSL settings apply to all SSL connections made by the southbound database server\[char46] +.RS +.TP +\fBget\-ssl\fR +Prints the SSL configuration\[char46] +.TP +\fBdel\-ssl\fR +Deletes the current SSL configuration\[char46] +.TP +[\fB\-\-bootstrap\fR] \fBset\-ssl\fR \fIprivate-key\fR \fIcertificate\fR \fIca-cert\fR [\fIssl-protocol-list\fR [\fIssl-cipher-list\fR]] +Sets the SSL configuration\[char46] +.RE +.SS "Database Commands" +.PP +.PP +These commands query and modify the contents of \fBovsdb\fR tables\[char46] They are a slight abstraction of the \fBovsdb\fR interface and as such they operate at a lower level than other \fBovn\-sbctl\fR commands\[char46] +.PP +\fIIdentifying Tables, Records, and Columns\fR +.PP +.PP +Each of these commands has a \fItable\fR parameter to identify a table within the database\[char46] Many of them also take a \fIrecord\fR parameter that identifies a particular record within a table\[char46] The \fIrecord\fR parameter may be the UUID for a record, which may be abbreviated to its first 4 (or more) hex digits, as long as that is unique\[char46] Many tables offer additional ways to identify records\[char46] Some commands also take \fIcolumn\fR parameters that identify a particular field within the records in a table\[char46] +.PP +.PP +For a list of tables and their columns, see \fBovn\-sb\fR(5) or see the table listing from the \fB\-\-help\fR option\[char46] +.PP +.PP +Record names must be specified in full and with correct capitalization, except that UUIDs may be abbreviated to their first 4 (or more) hex digits, as long as that is unique within the table\[char46] Names of tables and columns are not case-sensitive, and \fB\-\fR and \fB_\fR are treated interchangeably\[char46] Unique abbreviations of table and column names are acceptable, e\[char46]g\[char46] \fBd\fR or \fBdhcp\fR is sufficient to identify the \fBDHCP_Options\fR table\[char46] +.PP +.PP +.PP +\fIDatabase Values\fR +.PP +.PP +Each column in the database accepts a fixed type of data\[char46] The currently defined basic types, and their representations, are: +.RS +.TP +integer +A decimal integer in the range \-2**63 to 2**63\-1, inclusive\[char46] +.TP +real +A floating-point number\[char46] +.TP +Boolean +True or false, written \fBtrue\fR or \fBfalse\fR, respectively\[char46] +.TP +string +An arbitrary Unicode string, except that null bytes are not allowed\[char46] Quotes are optional for most strings that begin with an English letter or underscore and consist only of letters, underscores, hyphens, and periods\[char46] However, \fBtrue\fR and \fBfalse\fR and strings that match the syntax of UUIDs (see below) must be enclosed in double quotes to distinguish them from other basic types\[char46] When double quotes are used, the syntax is that of strings in JSON, e\[char46]g\[char46] backslashes may be used to escape special characters\[char46] The empty string must be represented as a pair of double quotes (\fB\(dq\(dq\fR)\[char46] +.TP +UUID +Either a universally unique identifier in the style of RFC 4122, e\[char46]g\[char46] \fBf81d4fae\-7dec\-11d0\-a765\-00a0c91e6bf6\fR, or an \fB@\fR\fIname\fR defined by a \fBget\fR or \fBcreate\fR command within the same \fBovs\-vsctl\fR invocation\[char46] +.RE +.PP +.PP +Multiple values in a single column may be separated by spaces or a single comma\[char46] When multiple values are present, duplicates are not allowed, and order is not important\[char46] Conversely, some database columns can have an empty set of values, represented as \fB[]\fR, and square brackets may optionally enclose other non-empty sets or single values as well\[char46] +.PP +.PP +A few database columns are ``maps\(cq\(cq of key-value pairs, where the key and the value are each some fixed database type\[char46] These are specified in the form \fIkey\fR\fB=\fR\fIvalue\fR, where \fIkey\fR and \fIvalue\fR follow the syntax for the column\(cqs key type and value type, respectively\[char46] When multiple pairs are present (separated by spaces or a comma), duplicate keys are not allowed, and again the order is not important\[char46] Duplicate values are allowed\[char46] An empty map is represented as \fB{}\fR\[char46] Curly braces may optionally enclose non-empty maps as well (but use quotes to prevent the shell from expanding \fBother\-config={0=x,1=y}\fR into \fBother\-config=0=x +other\-config=1=y\fR, which may not have the desired effect)\[char46] +.PP +\fIDatabase Command Syntax\fR +.RS +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBlist\fR \fItable\fR [\fIrecord\fR]\[char46]\[char46]\[char46] +Lists the data in each specified \fIrecord\fR\[char46] If no records are specified, lists all the records in \fItable\fR\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise, all columns are listed, in alphabetical order by column name\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if any specified \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, the command ignores any \fIrecord\fR that does not exist, without producing any output\[char46] +.TP +[\fB\-\-columns=\fR\fIcolumn\fR[\fB,\fR\fIcolumn\fR]\[char46]\[char46]\[char46]] \fBfind\fR \fItable\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Lists the data in each record in \fItable\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] The following operators may be used where \fB=\fR is written in the syntax summary: +.RS +.TP +\fB= != < > <= >=\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] equals, does not equal, is less than, is greater than, is less than or equal to, or is greater than or equal to \fIvalue\fR, respectively\[char46] +.IP +Consider \fIcolumn\fR[\fB:\fR\fIkey\fR] and \fIvalue\fR as sets of elements\[char46] Identical sets are considered equal\[char46] Otherwise, if the sets have different numbers of elements, then the set with more elements is considered to be larger\[char46] Otherwise, consider a element from each set pairwise, in increasing order within each set\[char46] The first pair that differs determines the result\[char46] (For a column that contains key-value pairs, first all the keys are compared, and values are considered only if the two sets contain identical keys\[char46]) +.TP +\fB{=} {!=}\fR +Test for set equality or inequality, respectively\[char46] +.TP +\fB{<=}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<=}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 or both\[char46] +.TP +\fB{<}\fR +Selects records in which \fIcolumn\fR[\fB:\fR\fIkey\fR] is a proper subset of \fIvalue\fR\[char46] For example, \fBflood\-vlans{<}1,2\fR selects records in which the \fBflood\-vlans\fR column is the empty set or contains 1 or 2 but not both\[char46] +.TP +\fB{>=} {>}\fR +Same as \fB{<=}\fR and \fB{<}\fR, respectively, except that the relationship is reversed\[char46] For example, \fBflood\-vlans{>=}1,2\fR selects records in which the \fBflood\-vlans\fR column contains both 1 and 2\[char46] +.RE +.IP +The following operators are available only in Open vSwitch 2\[char46]16 and later: +.RS +.TP +\fB{in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is also in \fIvalue\fR\[char46] (This is the same as \fB{<=}\fR\[char46]) +.TP +\fB{not\-in}\fR +Selects records in which every element in \fIcolumn\fR[\fB:\fR\fIkey\fR] is not in \fIvalue\fR\[char46] +.RE +.IP +For arithmetic operators (\fB= != < > <= >=\fR), when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the record is always omitted from the results\[char46] Thus, the condition \fBother\-config:mtu!=1500\fR matches records that have a \fBmtu\fR key whose value is not 1500, but not those that lack an \fBmtu\fR key\[char46] +.IP +For the set operators, when \fIkey\fR is specified but a particular record\(cqs \fIcolumn\fR does not contain \fIkey\fR, the comparison is done against an empty set\[char46] Thus, the condition \fBother\-config:mtu{!=}1500\fR matches records that have a \fBmtu\fR key whose value is not 1500 and those that lack an \fBmtu\fR key\[char46] +.IP +Don\(cqt forget to escape \fB<\fR or \fB>\fR from interpretation by the shell\[char46] +.IP +If \fB\-\-columns\fR is specified, only the requested columns are listed, in the specified order\[char46] Otherwise all columns are listed, in alphabetical order by column name\[char46] +.IP +The UUIDs shown for rows created in the same \fBovs\-vsctl\fR invocation will be wrong\[char46] +.TP +[\fB\-\-if\-exists\fR] [\fB\-\-id=@\fR\fIname\fR] \fBget\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]]\[char46]\[char46]\[char46] +Prints the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in the column is printed, instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist or \fIkey\fR is specified, if \fIkey\fR does not exist in \fIrecord\fR\[char46] With \fB\-\-if\-exists\fR, a missing \fIrecord\fR yields no output and a missing \fIkey\fR prints a blank line\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for \fIrecord\fR may be referred to by that name later in the same \fBovs\-vsctl\fR invocation in contexts where a UUID is expected\[char46] +.IP +Both \fB\-\-id\fR and the \fIcolumn\fR arguments are optional, but usually at least one or the other should be specified\[char46] If both are omitted, then \fBget\fR has no effect except to verify that \fIrecord\fR exists in \fItable\fR\[char46] +.IP +\fB\-\-id\fR and \fB\-\-if\-exists\fR cannot be used together\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBset\fR \fItable record column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Sets the value of each specified \fIcolumn\fR in the given \fIrecord\fR in \fItable\fR to \fIvalue\fR\[char46] For map columns, a \fIkey\fR may optionally be specified, in which case the value associated with \fIkey\fR in that column is changed (or added, if none exists), instead of the entire map\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBadd\fR \fItable record column\fR [\fIkey\fR\fB=\fR]\fIvalue\fR\[char46]\[char46]\[char46] +Adds the specified value or key-value pair to \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] If \fIcolumn\fR is a map, then \fIkey\fR is required, otherwise it is prohibited\[char46] If \fIkey\fR already exists in a map column, then the current \fIvalue\fR is not replaced (use the \fBset\fR command to replace an existing value)\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column value\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\[char46]\[char46]\[char46] +.IP +[\fB\-\-if\-exists\fR] \fBremove\fR \fItable record column key\fR\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Removes the specified values or key-value pairs from \fIcolumn\fR in \fIrecord\fR in \fItable\fR\[char46] The first form applies to columns that are not maps: each specified \fIvalue\fR is removed from the column\[char46] The second and third forms apply to map columns: if only a \fIkey\fR is specified, then any key-value pair with the given \fIkey\fR is removed, regardless of its value; if a \fIvalue\fR is given then a pair is removed only if both key and value match\[char46] +.IP +It is not an error if the column does not contain the specified key or value or pair\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-if\-exists\fR] \fBclear\fR \fItable record column\fR\[char46]\[char46]\[char46] +Sets each \fIcolumn\fR in \fIrecord\fR in \fItable\fR to the empty set or empty map, as appropriate\[char46] This command applies only to columns that are allowed to be empty\[char46] +.IP +Without \fB\-\-if\-exists\fR, it is an error if \fIrecord\fR does not exist\[char46] With \fB\-\-if\-exists\fR, this command does nothing if \fIrecord\fR does not exist\[char46] +.TP +[\fB\-\-id=(@\fR\fIname\fR|\fIuuid\fR)] \fBcreate\fR \fItable column\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR\[char46]\[char46]\[char46] +Creates a new record in \fItable\fR and sets the initial values of each \fIcolumn\fR\[char46] Columns not explicitly set will receive their default values\[char46] Outputs the UUID of the new row\[char46] +.IP +If \fB@\fR\fIname\fR is specified, then the UUID for the new row may be referred to by that name elsewhere in the same \fB\e*(PN\fR invocation in contexts where a UUID is expected\[char46] Such references may precede or follow the \fBcreate\fR command\[char46] +.IP +If a valid \fIuuid\fR is specified, then it is used as the UUID of the new row\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Records in the Open vSwitch database are significant only when they can be reached directly or indirectly from the \fBOpen_vSwitch\fR table\[char46] Except for records in the \fBQoS\fR or \fBQueue\fR tables, records that are not reachable from the \fBOpen_vSwitch\fR table are automatically deleted from the database\[char46] This deletion happens immediately, without waiting for additional \fBovs\-vsctl\fR commands or other database activity\[char46] Thus, a \fBcreate\fR command must generally be accompanied by additional commands \fIwithin the same\fR \fBovs\-vsctl\fR \fIinvocation\fR to add a chain of references to the newly created record from the top-level \fBOpen_vSwitch\fR record\[char46] The \fBEXAMPLES\fR section gives some examples that show how to do this\[char46] +.RE +.TP +[\fB\-\-if\-exists\fR] \fBdestroy\fR \fItable record\fR\[char46]\[char46]\[char46] +Deletes each specified \fIrecord\fR from \fItable\fR\[char46] Unless \fB\-\-if\-exists\fR is specified, each \fIrecord\fRs must exist\[char46] +.TP +\fB\-\-all destroy\fR \fItable\fR +Deletes all records from the \fItable\fR\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +The \fBdestroy\fR command is only useful for records in the \fBQoS\fR or \fBQueue\fR tables\[char46] Records in other tables are automatically deleted from the database when they become unreachable from the \fBOpen_vSwitch\fR table\[char46] This means that deleting the last reference to a record is sufficient for deleting the record itself\[char46] For records in these tables, \fBdestroy\fR is silently ignored\[char46] See the \fBEXAMPLES\fR section below for more information\[char46] +.RE +.TP +\fBwait\-until\fR \fItable record\fR [\fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR]\[char46]\[char46]\[char46] +Waits until \fItable\fR contains a record named \fIrecord\fR whose \fIcolumn\fR equals \fIvalue\fR or, if \fIkey\fR is specified, whose \fIcolumn\fR contains a \fIkey\fR with the specified \fIvalue\fR\[char46] This command supports the same operators and semantics described for the \fBfind\fR command above\[char46] +.IP +If no \fIcolumn\fR[\fB:\fR\fIkey\fR]\fB=\fR\fIvalue\fR arguments are given, this command waits only until \fIrecord\fR exists\[char46] If more than one such argument is given, the command waits until all of them are satisfied\[char46] +.RS +.TP +Caution (ovs-vsctl as example) +Usually \fBwait\-until\fR should be placed at the beginning of a set of \fBovs\-vsctl\fR commands\[char46] For example, \fBwait\-until bridge br0 +\-\- get bridge br0 datapath_id\fR waits until a bridge named \fBbr0\fR is created, then prints its \fBdatapath_id\fR column, whereas \fBget bridge br0 datapath_id \-\- wait\-until bridge br0\fR will abort if no bridge named \fBbr0\fR exists when \fBovs\-vsctl\fR initially connects to the database\[char46] +.RE +.IP +Consider specifying \fB\-\-timeout=0\fR along with \fB\-\-wait\-until\fR, to prevent \fBovs\-vsctl\fR from terminating after waiting only at most 5 seconds\[char46] +.TP +\fBcomment\fR [\fIarg\fR]\[char46]\[char46]\[char46] +This command has no effect on behavior, but any database log record created by the command will include the command and its arguments\[char46] +.RE +.SH "ENVIRONMENT" +.TP +\fBOVN_SB_DAEMON\fR +If set, this should name the Unix domain socket for an \fBovn\-sbctl\fR server process\[char46] See \fBDaemon Mode\fR, above, for more information\[char46] +.TP +\fBOVN_SBCTL_OPTIONS\fR +If set, a set of options for \fBovn\-sbctl\fR to apply automatically, in the same form as on the command line\[char46] +.TP +\fBOVN_SB_DB\fR +If set, the default database to contact when the \fB\-\-db\fR option is not used\[char46] +.SH "EXIT STATUS" +.TP +0 +Successful program execution\[char46] +.TP +1 +Usage, syntax, or network error\[char46] +.SH "SEE ALSO" +\fBovn\-sb\fR(5), \fBovn\-appctl\fR(8)\[char46] diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.html b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.html new file mode 100644 index 00000000..0de872ac --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.html @@ -0,0 +1,979 @@ +

 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..9d0805f6cb6908995cd1362ec82443a8d5a7f699 GIT binary patch literal 74265 zcma&sLzFJSk|^r3ZQC~gvTbXZZF84vmu=g&ZQHhOz0-Z~yOW;uC^92+MNacu5#)-Z z;`Gc6Y%t`bSFr^!_0b!g;Yf(iRhh0#nh!l#P}Rc%-o$U zT}=Ozadt7WcXi*Be){_1fA6SP`L9q*8{NJJ++o zr^D8#f9s%bXg$!-J)?N-FwBK~=eMUn+4X#1I_hA@qRf@3rszqeJTfS*PWI_MFpqA{ zt|D$Qv?da{m|ufGE;eOeoV9MHyEhi=O#X$Sd=Bk~j|CeVkcb)TlY-qGiwU9hMFr-=)UgTVVSm`}~uG@3|`gNdt z9fnAH))=?{+#WA8uGZF+5?xB1`CYwPEQJKU-a~aM4K=bQy`<dWTFfX6!hZOirkv{h_rqyo*eB%q_$w!=og7e%wn z&2q*a2a}WAM9yH;*Z+O{SZ3s`tzkeU!glD=Do6bjnPtwx7^C#@=rIb2f$2PqE7i(J zwbTX)Pww*(qmM$5HxLi#@9lm~K&{RdZh!6>A8LT)JmEijR2-GK$>)r)<+SHoCDs zMmf!g-?fW$c|zMv{T|MzHwK10fn5HJf*eUz?~TgERruJ~tnLi7#aUIQ(8U?u_B2cI z*SxjO`%0BpA4r*1+HEk6R4p%iB;A?V$UXi*7T!>3q5XnNVS>O*8@RvX28lI7HHzzj zOk4}6xL;*L7fU>n?bI{PBZgQyF)38po@XM^Pt9@xnakrROO5Z-xO78$o)^<*(?!p< zb*Is(Q*RORw6Z~;Ci?JAbaq`h-{@>g7|W%6)0WW%W$#%)OL-0lt$t-HX10e{+S2zz z;2ibsMg~z2qn^?NWnBc)N~g$Z(e5f=0uaSktipWu*+bw_W$ysDW_zP5v*ilhSP^Q6 zPh`1v&1rk9AABuhd_@7Ge8B$k|68K)6x`Q_!JwMH`L0OVw_;=*|fhuobHy5vs)xmV;YtDa2ni z-r>!82xkHBh_gqUMo$fR7~{Z(KRaB~2LIL}g_F`jFun6X6dkqz0#n~*YwJ%;>83lS zeeJE%Vefn%7)&k(OBKIF!ukhnvUGEC?+61et4me5H5m{kS8)>`m#w{v>$G3&CIPKV zc)>hjYv?8_q<4lIT#tlpO9`8z9WhI7$=ghyj~;>Y-DAs<;o$Zde(#EyG&Jb8YY9SN zBaR{2n3yTV<0V$KHl@GBw=a47xfFPgAOsaBP{wp}s7D^+nG{p5>zqW*qxYL9RB}1l z(hAm`%Ft1rp^|##g)#nqB=Ksf6#{q` zB#uz}N!!Ik9T%jBf^rcFYJ#>lUd%?e|%`u8X_jDf#PfSWTgLdtAjuL4r0 zoQ_hw`QTptQUcFO&gu?crGLj8(*%UBTpr# zUqG={m+#O`-?1Sx}uimK_BRa1|mv;ngXbGE|=f_a-`s&ZufaGbd}NZmRbmC|0u* zh#%HON9?7m1ox!@H2)_4rLroMx;gOVK7#AmH=&X)AA9}O2Om8X-*HefPu;g}F+(;ghgpk>)oxfa8vDqH1$f%Vc4~SAEGP+-V z1`1L12y-JNMy|!}(c~dgLAif-5v7lhXB2QGi7_cOpqL09b7h$TIY^aQv`Ly1p@u+r zElWR0rtIU-RA+ox@qPEx?Qz;Ip=D)ut~TV6HNv^zu7K}b^>6eoUK!i51{lYCiV5j>w%^hYe4t0BvoSCy9qUv?C%vL^>pf=3t}b;wl=r1!9Zh zvurh9DDi{t+Sy^gW6B&)GxB$iCf5(P7Pa4AVn_w~o^60dBu7CLNEnigxJEtxF$bvm9cKhEGX4k8O0y=4V zWJ7SNn4bke`8@JVr99FzNeq(DOQp6PGfPFs-Xq+OkvYiG#d~PYS)H@H9rBKu^A#*t z4mI{GafG~go*<0p!_gk=QS%Mt@lEoZZeqU4I_3{sSIotTIHyZeL8-Ymwl>!7_K$Wb zMf>X%MJLy%D~8I06t-e(@wyQS_jS=A$jG7fu0UDp`C5=Itg#_WP6jQ`Od3CR1nk8! zL|EKuedgD*ZDVLy&ZU)@ND~)95)UVA<&J;5|1yV2@OwuAB6dsv?Sv%;QIC(LSo~+c zg}`}9!r7giL#Ln|Bx15kvk)6#mG7+uN9TGc@HEsY0D^_Trc$c-YJ_s-P@4u(~6++_w_rd9hz zJVD(>TV2h_kAIctg>=$|gs9-;Q8v5!`;Oo7zbt*2j~8}3t>sZ$&;^5TcJBq9_tVx} zLB>h)m$$ZRjMrst=2Y2}&y6~bj|4a1StIqLooBF?JEV|Y+rQ9lcexV%(|O9nWlBsU zzX;$Z0;Z5A6TK6#qJv*mThG%FAN*lNx31XB)pIR2LhN5h7U0=ygna}&cG)y}9ey|? za~`6(D~SrYb{CPGc0Z2RC*XygD%xx|@R3k{%hL2q2U*>aQ-R)aFmDn8Y48DaI zs%Gaz+i(`q+?s!A_7@k0@t%g{YC;q2Hyx50xA;ps7M>w^$L$KERLwx03VSDUGrn{$ zgU3Uar(JjQXO6EXP&5!)%S~mu=d8QaXMf2mQo&qV-q;Xe{qdCu+*NxLT`UAOV6TtPw*xZXQnw6pW?(O9f zjSmQ;+0T5CSOvJrJ2`m$On4cq%%NUZzWxRMBh#Tkb6slWzGdCHVuL#>@#51E&*xZmf>O_mdWnKFh4H#F00DU= zZOyy~z=wL&GwXeq*x&G2$$~$oU#_46$C(j^`HLhHj`gW?oDCOj`{m)}O5pAB?>)V; zm#Lk}|K-ttR{uq+|AN$iMOIceZkYd@W9IxH-eTtZ-+*gdd(-J~1lf00V=A*eiE9Mz zCUZi>EnAh_v^Gm`#4k=)hlo1~DF_HYt{~Z7^KZltbLnX)?0EC4r;Kj63JBBUqVLDk zIl<2q2!p2J@7mwm77bwUwvTt|vtE|Z+U1mPeckEv>fwuvNq1^KO`Do2iNNB7Vx=LB z%}T9Dm+m)CjDBx!#6dvh-H4Gdd*$i2Q*-UvdFriGr@yQx4#Yqg$w3;W)D*^O<@z^W zXRlf7Q;Q@jfkeG0<(xwA-^m{O3z2*cUUnG>O{x}yFGdV()+dU1I1j9P&om1a&p7do zq*|C}TdNk^m55|~+RJXM%Yup=t@dp-tIE4Dc3v0L@4lDV2-jit`f6=H4A*trdmx3> z*+XY2!)WMwOTQnYcHSYG`ptEfV1T@FV=%9L+C!HBLhm!}zqm<2L*<-f)UGv_2B5Lv z0>@S*O^U$8hM`Cw=tQ4MZ3uA5`5~v`4O{3h@gsu2)4ASZgRbvmHtO_Sw%uY`QPG~l zj3}Bk6>~JL*0_!F+~Mu|eRx19qH;n!B?AIoiJEg>y(z-Cqhm_>0ODrGti->G{*o;bv5!ge{NS<)FKZNNj9tp@s$gJfiO6o z>d(B#PSq@jkqb$`JNILO@fRXx)({2Z{!LU3P4?hAsCj&S_`D z?KDqIyS}Lm`eUpRp=MxsZtDwo!Tm8K@Wr_|$D)WrN*Fr8=SUxNwlK3^uHJBh)}~5{ z-qbd4h9XnQ9?ebKwI>(>R)9Q}Maf?s@~TqnG$d%Q;8o@FXv|kxNlE58ZVYeitx>l! z_hAK21Ve?T2Bck_9BU?hO8qg;F>jCjo;HCtdh6r8KAw8@U-tJe-94(~1B@pAo%dg$vVp8m3GgtS+2B}qZ2R;;2=64ErCFv=%I0PAgLc?JYP`4HW-`I17$ zME*BaPf1gbFr>_fv5JHy6c^f9igL7K!2cJ)ePyp6J)-sYu zmT&j`->xE{L>0#+Skpv$Ei3)sNf z65AH9$gm2nfyNuTLdGzuz(C~JEp}w^f#c^W14)*$KXIc>dIGQ{Bna6%L7>7am9lqo z=Z>MBpjxa4s6D8?F2+^E!g7Ych9?uYOH)8y8`KzS)*==|^n`R`SQ6&MptPvi3!l=Xnjho>D z;<4+RODXTOWxVWCy>_P!c)o7qW~rQ0@YsM@N_bu+4ar+TCU zC5oc;?t)E))#~T|%b=SaHqG0Ljw3OKgua00ZSJkl!Z<9{@5;L_z>zOf2YFV=nU1)~ z>s{J5G&HT)&>ghy_@&O<_lNmv=S#`%xM!SWU?I{T_c1?3f!qBvU0yWlangQm=Tbydn@&%=uaY99a=lhV9>loy?K#_~_Q)!k z$-IlM=mf=~)yBZn*8xwpfKFA0>z?q_f2~Z@_>zjI3O0Xc!GvXevQ3*1I9X?l@-2#L`d4#~mWjb8y55p`oB5uB#`q~TsE6ubC>eNRGKEC^d`M89ScQcRVv8;RQNc}7ySn)?p4*h3MXTaHpdqkjCikJzuG zz?$u-2(J4?Idt2}k%Hs7&lBm!sQU7~@X^V38o36We z24L6Zm$o>*l`hU9G!m6$CvkSfdo$`M#9*aQ%nd#1%t) zFm=X#px*JJj)vqiQ9)xE&3-sPl@9Y7M(L2!7|X|t8FA5%$b{C!TCq2T`MAc(3YBUl z5$@00(Wj#Ij2Ml_iutyraRH3C9t6g$EKfpSh*x#;j9`(O4Ag^n)|1`bUmvFSj3L4e zUKr)r^cPekO$tC#c+kY@zkM*zTwh_h+{+9S^Tf;KDj={CNI5?{b5gIjWs+ja`SkYU z`|c7KD=%bcxnV^dsWk-^(n0p#3q$GMObv2u(AA0=H`pWl8I13RP}Xawojk>0i2TB6 zsnSHe5?eNM&S&XXV(`jjHRN9+$T9700wF1@Iksr5b z^+ETVUB~$@M~0ge^mf5)+u{P0kxs0XwColwA(uXXnuw$QKV=Zu7vQ8A-w|RwNO8&| zgl^62{5V<9mRR4NX>?X!U8RQV*xd4+x$~~o68F_1t}|o9bo$dlth`D=;x{U;l_L+P zRa^5qBUw-j(qJi7%)i2reHxdBZ;bArPrs{h;ztEnZ{z+EJKRF9<&vU+3aEjzneG}3 z(q;5}>+mPBN6)$N%VYhGiw$Kjuwbe{W15Vip-+#+4$Gi+PnXIET=3^Ug{+U#)auDp z1o`LL*3C@@=cpAxpYRtP$}_%{%Y+tn=M4397Hp?hil{Y-e@)Hr=4DHcBvNgvB--SK zVpF~qvDF3m-c+3IKg{tqdrhc&EsRhLp8QkN_=0sz`M4B7JEel|QuOyEOWpU4?4irz z!*hA9b!|+~zlv;NDc96V#pRH)*f`DTIbBxdCJU;t>-2d_MXVtX7N)#F>X*eNf%XoKh)yuE)^Sx!{f~ElM-eh zHUcZ}_uY68k7z<2w4bl?Q8g1^!F%ZpvP-qd*kGpsI;50EmxSOHEH1K;`NoB(sd4jK zQt&7np6?@1whpbgSNr7+ZYSugA&A6)M^h@_xw9D27`r}Ete&0Nmc5;y;CW##)YwA7At1&5NE7?Y93Sdo+ z!6Cx`_>7*L@}+3O?98U|iM9TgqSWMsByyf!cXvsenXwF>Y8yN3|CTdrv(Q3+Rxoq$ zMS-_P+4f$F-Zo4Ck1jA@TV;~Wxhu;Zp-gA?IkfA7Lx{q1x{YCtS;O{oJj2rEgxgCG zvv~DoFR1KD%#nFXH!b-&0RR4n|Na|x{|!Jk zZkGQafGo`a1Ar_n{~G{SYfmR^jv)6uQlFSHH3u^X{i+@ljSCbfnNXu#w>4aXVgN~r z5`{ttDowF+#Wvig-Q-~Z0ZM2{XnU#CHJV%8Ui^Mu<@=<4)SUr*&G$Zj4;XI_*TTy0 zvV7C-HlAJ%!)R1L4zJ!C`PA*uEy-jJ2M!DMt$c=%3NWnxf)Up-xcUmnfoRq+eZ(V(&M7}vj}CX@1Ny~gVgsm})0dI@9C z{imGn`{lS%42hZP?0?`0r=Lr1GoZRU9ixaXzDy;!dH{H)dtQb5r8XXf+r0c`A2GH^ zbU&g8@<9rFhBJe;+nPK9h#n?Mwpt?_4ZLF|wAfu+{Ql|%Zs6*1!? z2IHa2%LLCsOZ`xPx=q&i=Oz@E`7b9w0I*eTj)i+C+|c{tJ$_N0;7zzyiE{JpSI40) zOYtLPRtPl_sK(2sBH$d`JQc}^?T69S-v&o`M>Mg|o`O-K^$`myYO8sWMNSzb@sH&f zrNBHk`2A90W|6Oqy?O^Xk9lzp059Sw}k$n$S36a&)2ys z{yJyjFJuiPE(PwJuB~JkIwC6PNq^j*BjwLBtsM5~t94SJ1UW=aWsD@NWG8p`n-8bi zyP;BGDD|+P+kFF_$to(?R~Qh|uQjSCIrSUjyd6bdB@-yzKL~2~I(joR(`8Gj5HelQ!>WB0!JmhPwIfK>3Ms(>_~Y5=zUHx*Fg$XMrPm~#XrqFY=Q zx@8igyfKa!X_;kDGCt#}8ZGz-)4}`m7ZkwZERGN}g)^bNl@6U@Oc*2`#RIkDj_leZ z9}GF(S=l8AO1vzBt5L4204r<=0B!=LWq>EqVR?Q1;VBn@`qe`PpIGDZ0k9= zqNq`|ZBZ=EzmA?0j6qSkli%7qwOaz6^K=~=nkrMDOY>JEM-D6=|AS{=(ONBDs1Ppz zF$j}i177uCRazceU*~BAQC-A!n}D*x?j5^Yd=iRDkFscSfEG8z?(Y4UIfCE^r|3JT z$-uWM%@aoPy6Ibz&{;UprOlqrM3?)iQfpwuUdcQea|8;^*^N3X@QhSAH`i^9Toi z$!TPsQab?HpPiiY0Ml0GkeCe;8AIgHh~NO@8%=$g2uaygf~K*JKpF!jH%}dWuXQ&? zaD`5q-FQq(L$xGXbTQ-yVr3;Za%65y84)Gdb>rxD#mVcGi%?aL331EPUBU(`+2mmP zmE%F>ck*4+X$%)pjG_j|S6@h-#mI7y@XhByP85kCVqgimBb|omLe+6Bic-S_=B5 zMPp+q!|cpt0oHD*#ODfw$bX7JI_*abF{!2vklsiW>Z_<|wm2)p>OgBPr4rM~#baC> z134oLNq%LK)iu+eLqU;50#nb>94|HY*bGFQ*rhiPEmLh_aRFSDwG?XzH{dTuD46Y! zkM5I#tHI4LeQ_rNxSk@E9-O=zP@KmUC$$TA{xodAD8NNi&QuCBvA5<{Kn8HViZC$m zH`lF?q#!lyNZGr-zsHptnBNi0cly2p@T0H0Jz2DZKi^Kkx4qv#rRn~&R&@_5dx|Sx zKqg;b2iLI~DWT&@^57z<3=(f3J=h~BMVqkjVkngAgU^rdx4(`uJPpmnW^peut_zU| z^%sy8l%yM>+?GxQMdRRLm(^Sztk{yf)UB6)hNfR1m^>|u-pwrukn)^AOm;R@Rct+Z ztSY7D1lVRWG!#1~^7rSCHy#DAG;1amR&jaYb-c)cJ&1*zV0Fna;Z&!$15GxbyVhEn ztWASsEKCv6%K(=p7#`yJ9&a{Qhax(x2|e`>`gM*1&7%SCu_>k_(Q~Sxai*@6>nCeR zO92Zd2|2oPMn}5$Xx6ouFt|3xjA=+Zi$i}y*FO9~0}Ys+Pbac z-rc#!5_*Ia@XoLRrGgrdguRo1c;GwD=xr7RGGolSe_ll;vIEsm*Hes5nd${eqUB7c zfB;kZYOs4+h5|dqhQ@Dlza$b<+KZr6aQT}p4QlOk#lVR0#T79`9AS)p1Gg6u&x@=S ziXxMza@+CjYY|-PQyc40!%h-=!4-Yo-YM1r-G;98z`+=OP%b?Soh*$mMoH%MS zKb3G2E4;Oi;G}B8dmIltSKUl_J%VKq+sn1D_B-J>2a&Z4UUSJqH>>%b2^JYT)YhRC z*Cx5ZNxi}L^1&|x-*so89iD@-q4_73Hq>Yk;z%((1TJyIYqpS3QlDH21&J5o`);8; zhtA}Kcl8^J&l049G=P`7N!ZXkn8CsMgIv~Mm6P@d2q#;^CqbLdkOZ?_vAi+y%*|fZ zEnEN2w9vpobwP8L7aL`7rOGM=nRD0sV>X=YXcgk9&O3(YeHCt@}kO1u| zioXb+XraDTb02fUJ4?A)G2OKw%U_B$4kmHlghpAip4BhAZ$oTa)i`wAQ|Sqxe`%%% zjbo9Poe$Bt&H-Q{xh+9^>qJoTMakzKY|3TXcjX6RXT$NwXV+sk;&jP-OpDZc?=|H} zo}1d%BbeehcpSy$-}$yKa>AeF0Cj#~fFiurWGqqDFWz7<)taT~t0JKjio&hYAk7EU zhk)>E_DyC%Yv-Ms zwL+wm8 ziYLtXAjlynbi=3=rGv;~*wXjDgi4#cGFne1aqQADo)@TQC zE(`c{y^k+M9`da?6bV3e3K2495eeuSyh?b)UVXqkcutJ|sv_&d)m3BoF8yW=_~^b| zd);%sy(9X+h57vtSp7Gc{!eF(h3)^r>VHl$viz?`8K zmI;~~^oob9xlsYN}64w z)~?H${X!7mbw)Ym6cc|LwQ${EEZ*4dXuMsoyOw}~LCdwx9w}&|&2zM&bPDm3sB>Q_9X)oYQByjr7fw}Oq4C8}@R*t?~7_TZ~Gq4!<5SR6!Stjk91FcqL z_0Ut*YEWttk9k>gGbW;?c2q-D$x-`hL_Ew|qKEOGgp1BFBjDHm<#B)fy*#`->Q%%q zS0MXMSNl3d#wMfu{9PUQxPN^$sgO#z8(i&hfA~NAa z|5?MO2H}L`ATF;(geR9shlIh9*+LZAvTifsCALv=K3+oaD3_rmz#@G!QGs-dzM%T) zr{r4)01`xd(bF|mYzkBrko#e8~?K2l0yM%?uBtJ;T?NXv0aAUa| zu=L*TfT5X4O}uf(ln}7bJlv2fk(Spagkg5fL}@bx_T8m(b~{dE@C+Kd>A^ z$oCG?N?-()qX~PV-s9LuLiDv5al(DsST?u45RsI>`Jn7Lu5>P zJS8P=J~s?4Vj5BWw??jNYvhs0%6FbuyaRpHZ_%&y7SRQGJfN9b;-0>(vOs=HM1B{j z;uXDBp76_)f+`#}M-@2-;-U{W1dx`|iEbECV;r-G2>fjtuca6iI06Ce&8LnwlG5M7 z#Wlo0QDvK7WnznVd6HP5E#-`JXmDsuqwM4`K$(a2)NRPStfQ4Fp!am}%FQsoBO$Xy z9ob*87D@M*Uq{WcCfjr^=>G2AM3DuTlRTJG%bW}y^-(1~p%ug16WoS^mYMG~+pJ~k z>CjBKFo1dfBt2$)UcM+xl)5X6Coq10rM&*QK=1hz9YhokO11UpBCP~SD7`WRXix(> zp0Q`SofFNh8z3YO?juTI%IVB!9*y4$Ffbd=v<5l7IMdB4srcDj)1OhrSIsf;_rI6Z zLMOpuI~BmY+vsYn&?L9}koBTwub-&5vEv4NREMHjV5=b~TPfCD*<5hR!$2kBN8X-l z3{L@n=CeRhi6R>|Ro@GnzyNI;u3Vx8{Hge08`vEtS3)`d*24HJ1JDjT{w`sb5GGJ_ zG~bV;Y@ii01olVF@J1>eVD?!9(AAUrEI0^4L;Y*WB?RM$amnj&y!r!OR{V2_ld;q~ z1)>Az2M8b+z33agEW)f1U@W*GkAyMa)90?S_*Ca$6lCe_tEQC5Oyg6r(TkTgh|FfS_4r9ih^1GD$8u6{^VPvNH)mf7cvv zT?}(TPazQoDEQ$GF?rj=y75GTXiyqoNlEBIb?jyRWhA>D_cCDsB)OWg;PThf9!won zI{(=&^$7>v*f{5xg3ez1>oFFtZ{PYIxlK}3@}gvwRNQ?UjD&#qpc_r|t}es&7nsCG zqOX@W8lUhKRg7@n`H2V8ic6h*7@e`ckk$><5eiF`S9~k%F~T1jpDdL>fPwcedQRU( zl0{2dspcEeFew<%+*m%avFu?UB$M!UU^91bt@N_ej$Vnf4o4Vj5 zO$(EN`$ja_sIpW^EM}7cc!pNN!Th``6NxY;`t!tNZMZReyqL2T)kEmB1F&>yq|!Os z7leChpY4h=lp>2;bKopQGjc1}TvBNAVHB?JqHdWxW=og-Z$N%S8?yjJd98o9S-T4i z-xK<*AwgEndy6J!^`VI-ez%?NC0)o%l1`|j#r@tBL0_?~>u>Yn9Ff1|!}}#zGW#0} zKdAl*dq+qRff-ya){1&FvR6>k9+Z~^8~mXvtG8G=LS*Zfbb&kAG%IKYD`6fdTCb!? z{h9{LV26F?1(qMECzS2%Up!dqcWj(2pAb4L>fq{;vdPV8{H}>-{as# z!GEC5k@)o!drN}{q%95=L4u=e5FoFq*b51tPT!t~-gA+X8Hi$-NmHq$G6Mo=SsqZ5nA}Zk z6^*wOYI=T|r_EWZ$X~y(V#h!C^!$P)Q~Uqd|qoI#$&dN)6^M|+{oO8-N@6ACCTd)!;UrBNm>L% znh8<5%$;L@aiz@SJkrzW(Qz~5fL%;6)V>XDJ7Wr3uy}bsEN}CAd2xSlY z5(wF&Cw1kWVfPW}M(*Bb^)=8cz*UBC`j9qFYdQz>)kpx7^Zo4PH+w-T*r+M)`3T#ud|yw^>Z=hlO;TEETeAsL}r}*mwt7# z*)Wk;#XJPgMe8_^Du|(9R}>HNhnm`NH>Gd`XoTEsp9yx|!BFY-^AVn2w-iB9HxYyBg6Pz(4$8Ok$&_3H>p(aS! z0V*wqdoNIZ+@PeojJHjxBz(sJYM|DxxCS7I5aLvOeP8wE4C}9ZAOJ{?vW6MCiNfZ% z-6rXf@SRNAv}GH>Q5T~7TH06)H}oP6gc?22aD8=9rhg5Pyk3>i(5opCiRJ>uu^shs$=jxkmP8_zkJRms0LCHeqtO0lNv3zJZr^V9xh={H$=tNW zQV&ejXAa$8xazBWS3){|d|7eVICc%?>eNykpWt=-Z1R$lq-b?*?dFVf4L`-sa_D2J zBCKlQt~wj5zh516c$~fP{Op@Nt}kz1`#Ar3W|jMOcE)iRzxO>l2?o~7MonD8^WJ~eV}>Y~~3V^nWA4RoEg3~2Oy@ESDq)PJ{Y>h`1lWR;nIQ=oHg z{y~*_r%jC*Vk=`@4XxdFYcqV>rHgot8SXl9#1-v(SrU)Z%q~NY5)mWO^EoT-cso7J z{KeAdKRxc>(d$fCxGj(Wcgi{oM9i^s^0DxGtwtc&a^^iW)QOc;X-lqc#Hz{%uN;FJ z==MVxlE4Ms`Mex3B;>T09f}C2qR@&6=^*YqdEI1(_)5+;si(wPcRTJnzx3#mbwFY% z?GRJ-6;|PBxnI$TDKZ_r&%`{{rPmIW-pL}sMRzg=r*(%vXv9vzFIYa3xNEHE$%OZ~ z)A9HZS?t$Q_LJmM(@^08OZk`=2+CS$|BBaNlAp#~=hR(o9{!eos4Eb~cif0laE|if z?yLqGeu|YjjxaL~ce_#0<#h;pNH|9$#mnHn9YcTOLKAIBs*H6pV4Q2DinnF1KZ?`@ zdCDq3iNcLGmEjR2l1sp9?kpYN?6l*`(MGWYHSM3$BgKKuX0tiT)~p*vu+x`?>q;7; z+jDv$tRT^1A8C64g)22YBqKEWIhW|M&1p;!Rj1Ll1?^=F0#Ap8@f{I8>bm^`DIVO~ z8h;ME01w51X<35T?%Cwy{$S183-hddWwcI|Lg7$P{rx?PG<(Ifut*ZNq)71Z@3Sb-;~?-I#pJ7weJSU*PQPxOVj;IW(w-e9@p1crLzv6f6Tk1#U8IZ zqubJ;!0C;;Hs#`=63jrKtWEVGVrJ8h8{Z4sLukTbwDaCn|K)Xuh0M^;Wb7MUJ$RVB zSpEcb#HeUthrKATywLrksL0-OsZjY)d}+3W50uRXAOD`c*s{E@H8$W`Gc z5G8{ZQ@zTqO?V!ny*cHtzrZiBdN;`L|Fr1;oATsfW&VE_<^CT{K31mxO_Q%!OV4?e z1H*T}Eu|gLg(gjDk3lT8xIwbbZ$M+2H=~miN7oe^Rzd zX=3_XiQwMB-j?%hNDopj%fX?*cjFp^k5lto!=DH0d4UM}ch6?cgEF;xj}QKSMD@!M zukiTbL^8N>tIoTP%fw~#G_VmzPSeB zIZv5x2B}BNar$ha*xCgz3KP0Eo1qEI;&HAztJl!6Ww&AJ?qwOY9!s{~3GN3+y_E)- zlXQgu%kC3*;S)KQ8B=Nrrp>lKxQLaW-$+z)bdz?r_Q$@)N~Zg zj>^<~4wA+c?=YW;xB9=CN!J{;I18=Axs?7Xx0C^t5EX*p>h$P`(k5GMq47?iB^{m| z)6zu9tyYd2uwvs(>C7mh^>ohI*c8qj8_4{MV{y!s68nQFaRAFJxL8)#9Z>2@dH=HQ z3&Fb}Bjf@o)2S*2gTW8xY0U%p3LOCb+~Agpxu(hDoaXaDF3Q5fuC&~4=K>3>q1@6w3lSfDzloo2p)4UDVZZoson-9#SD%R!TDx9Sc~&(QD$|>&TJXj|gT^ zb|E4vL;8jx4dxKedaxwA0H0iO*UjeWds4_lRm?e<z z3jMc_Fx1d2ATn94{VuNs^Ig9}l2mm45ZIp{*Gcc7&$FMP5`y4VZ2l&59}PA2j06VZ zh+_A~%8`e5`^H3Ulg`wo?E_brPZi<&#%ed9x9_TgNGETPa{~NNNL!FXoaWe;iY}gy zJnIpAxtj=r>bX?w=r61>IkDt?wHRa=a3~^}Ktg5JkK?|S{1_aEAqb20Ub{Qw2$Ttq z`gNRZom;1vhW1sbRon2~yn$;wi>fl;<2HgWEExQJ`j_J57^{%!kt2*b2#>Spz}_tz zOgG=satd4Z=a25+Y>i(=jrprfZOT_itJv%y>1!lRXn@0yot5*ZfvRtS8dO#KF$H}OxsnpRSun|yb8(E zIXF?{5%Bbc_O8k}XMs4YYIN(}C!@F!QMEw2d?A2yGz1V^1P;(O$2E3^pVLY_VBw#K zsQCH9k zPEThtc=-cXPqLHHP4M|%w>0XQUp35T%SHgtc7>Sa=y(g+KUBN!CPV8LrhMe;Qmk`( z0F5vEbtel_P!O{6^SQ|hBq`qY$jbgvY6>fQ8ocSwdO7J{wEv@UWMK;CWp+J__j1jP zDf{1H(PRCE9py@jC2C|g*Ob5lb26&T(!()o7HWXD_$~vrw z2{>jycd_LT9ox*Ru!4JBN4}#bGu|U%Y-P3fGZsA-dQvp%8$JcS+C$MMcG5bX&UL!FmlsSVF=xy))DehEf38SxJ(rOSzN_65}wyGhh_9n z@dSdkQ#9W)Jm%z|rloMYjKZ1MpU3Zc&)8_9#hP!*Gu=*vj0I*}QF;^VkuD|cO3?+0 zLh($YG2rDxX$|g-I$(UF_6qT&+U4Oi2YG_rvhv)v@)@JOm;gKDd}B7r(T>6wcU|?b z;E|fPo!2JK2{%wDm^3d+ z@MNdA4DXFw4r0BG|Jt-%$Sg1stSRmJi7jl9DWm^=UQc&>>XAh#5`#M}0DL2n&_*Ng zXgsQ8l7zvI5GAJm)FJWiKNRNrN}*te#qGNNDd;cegJR5GL?z< z1F&U%?7YU9Ude`0Wxf@KRxl&N66@)`fXWJwf>=gZ09LgUXQLFLY!$EX5Y;)OSj){V zV#m5Wj>oC3@)e;uQLT^$N~d_iEsc1VNo=Bx5-QS|E`WwQ+%@5gY-}rw+R;;n#LPkH zY}e|+1C+w3`2}WLYgJO5^v*a&3U9TTU8zN$OJ~W1Scn~?TYB|aLA1)w?6h-wn|t~w zDQa(W#^2Bop^}bIR&)i*de(!4PN7r3Ye#B(Qt7g+wTg8}(i-KC*uW@i3R^k(_rpm(+A zW*m0=e+gE1w%Yv>nQC|I2gUZ8 zk?dne0NRVPsL`sY*%b#qgnXt$qxhfxdNn>yogWQGAC&dK$E5F`of~@Vc%+zgy z7>WfY*aWLq%W7yVHmRxIKI09H>EW$UybJhU4X$6WYb#Oo>@ik%ckxISMc1=QIG1cG zxf;@_?4xtGk_w2n73pvc2urs#e??u4$dgI%S1?QYqK)OVy~>~13WXs{^ZypVXh@yt zDykRpO#yS*ATo`G%;HBIoY?5xEW182UCwv!$m%U8t6eT;pe(3+|`J~NLoUD5U3H%jk`mE-p*DZa(j>2MF;V6^4Uib2!39K6f3POmCO*^&l6pAf ziX>48wP83McR@o792G;!QJ0mZXlifX!X^8x6L;+ zQ$hO53f#{ZXABN@a9!~G(pZmkj2La`rYIQ13B!W3$w}>1chP;dD!w$iS0@wlwDZPC z_A?NSCzeqKzx(ejND2xG#WCihlb7)WG&u7nQiK_>#>$dXUn0`nZqCe`v@*47z#>{S z+gbY=FW5ILOA5K>M1`_kR1T`U7d1vT2eum*`2`dou&10TseKF(+A#e>e zte9m$bILXB9xdPc=8w_&Z1U_*F{6EW4@2Jg8Xo}E&8TiZ{04S;-xH;c@k!h$iIIQTk@t+@lt*3wWXIHR$)3(^ z8>7Es8YtkJ#({|$ud!3n_5zZEe%|+)KHTRtE(K)@UyPuKn6y3ND=(5Z?tiwXE3s9| zDU9TDggV=KlKes}WtjOO(jVn9DQOjSpw74vsPdv)Sv$hl7}M7=-Y1AM$%Oq_IDV}u z@95rvxR`5>8m{qxgS1(J0M*fUoh%%4r(uE0gT$+0%l8GU80qKgzXQ7(DOZ>!GBe3y!+kW6hfB;^W{h(*Lg++%qj9=$9m6&DY?5T6 zJUg%4F+?to{`ZDV8c}nD&NZYKvmwEFP9g@T&9}Dd|3tfrhY*fAk129Bp zG&qH?|BB6ouh?x-E?X;rjxMFv5#CfqZ9)ySb7N=VphxTw@k>!epN3-3cvWeWOq1Wf z%QMVcoT4JfGV8Q^%;Ag}F(c!2YI1{EU zU4x=H#>C}V5x}A`i*LiOv{q9vI%C+tbQL7PZzHY?g0!j^B&%oR^)Q|sfm0yNbvuu0 zUT0nhPd_T|Pw#hw8Z9MlnfM8jA5EYyl7O&FtO2}Rn|<(LMsV6$h_ztkjF(P>J^jS} zVSmmXo%3P10sMPUO!L~|boC8f)>Y4+5NcXJUJ02;@HxPelwKWdQ{P-s&%8Y;rsfqB zxOhQ^)Hxag`Ur z8c1W9E*X>7j_wI$>5O6tBN)E9^2xWlrp9!ecn22G!VndU>!DrNi5-!W%N{USlw6>+ zxM27)AsX7v34+Q4{ajYa%lw@QW(^D0H`qDR#}^PVwC*5}v<7vjfZ3jW;?`g7Bm+*p z{VMfns=k_Yp*7D#2(56PbZZI3);w7A%QInR2lR1G0EwrbnhzIulIJsQcqT#6%g0yp zsh}&wJVe>WeNJ{bt5}wJx1fUnx`rs*V@*^RPL!V-ORwVOPm?!`P7*7qu$?knNFp14 zSpe8*h6LYe;J6~-4jxzZbj$^@pWZhmY{*w4u<#vHB=K*n-<&jYfn>s$;lh!B3~(TW zl@L1h36(z}A?Ykh5S}=@1#HTKW&T?$uN!~VjfW?Ti>w>2t{SoF6|VG~KGW)2j?b-S znWjv^o(RV4UdG!i_ z*B3i>du3O{8z7%$nd0v47RoX03!0+qygN9Vw_kzCg07U`86~)g#bCQpaZh82p{qN& zUkcS=WQ!7xsVDeQ*}c%0Ee>O!EwY)f1TPNmA^eL#h)-)M^Jsxj>m_bY!7qeSx3(s` z*-`oU!LoC>7PwQEX=A$^F)zAXlO&1T%qq_YBhe5kO#NZcFH_@T7&kj&cm<2^ZH_@6 z{_|%);y9}hbk2Q{MK#OYo$UuR%-G)ex6Rr9_d&===f$Y=1N`d?JUx*!@IL|czrgap z0hE>V{{!fM8ve}xE5m?GkPe2mc2!0x75EV)rK6fwqB~l-9<8i3E zTvnE-_FgG}uk17+Pf7hFve{&erg&Mv~`lIhAnee##K&=)A)MC3GimPlYb zr=sf22ez zQ%g=3t90Ua<1Chk*lUUo;ZY=Il zXZ8?ljwy)m_~{kTa%k9+{^A7gDbilb=A_vQGdU@rI*Hy1Hl)fXZA&evfruo4;^?D3 zXjGQ1j&XO5#+(192RD5}KJsd^=lwfD2~^EH*pUtn629@vOkFq zvB0LF)gPkYzCTy0|9X8NtmeDxmNRqMsiKOq?u%W~(c4QBqff+|P-cnd>`D;3cZWr= z-Tke){v&njdkTId{6bdxutO&5$&vUdG}ks;Vb-~>;<~Aztg|mMmOPp*)cjha*L#c1 zQTKk`{qwzQwYjscvgst5i~SrPlwSvaV}Zl%jy%V8tazaMOx_TzMWAU3i+?$kXA{c$ z<>)G=C7>yyyH3-{);TVa1f%Te?oPFh;Xwe23x8y~g9oY=jCB!8>I52pq?!0jiH)j2 zefsB!`cEqakyE$jt4B8l?uGsmllIMc zY;yY4ztsV$MM9-U043nDu2O|nt~VLPMN9*cQ!z73L>DT_DZy*}g#8VxJF43DP1~N_ zil?cd4k#-Q!CtqEQ#v`X+v;okN5rK{KnLoIEO!<8-w!_?2V{cUv%u|Vlw=ob>7=`0 zhSG$ffoe+!3E)7koN2g|SSQS%8TL&g>*I_}BLoq&AJX^EIj)NfQ$+z{^pq1~>=fm% z9@47DZ$ZDAEJZe9JhJYH_(EZ!Opb62P`Gs`&Ip^`zrsV<;`_{uD?O>lM4K|3-(s2g zkJAdRmJ?<1xRV@z=Rt@9NnddqdQ;LZi=BJ~K-K>xJH|ZioDEygzHx;--_@9rubH$b z8%qSXl~p!EW7M;dAF1LW8iR>ew>`fL_o*1^WAdr_h_MG5L-(jK*b_xtU91 zNO3nAtS2fhMd-BctAG3I%vufxD#E`#8lh2~l+F0V@O% zSZ*dtrlq$RYj<28Y+Ip|Pbzc*YQ9o|Rp&WTi9b znH^JJy^dIrNn8RWcf26SEyF(nFo0!aLd9%h8z7LDfrNi8$9R%A4dlnAh%P%SP!S5y zsC;meW7|MYKC-Zx=>{G_P&^n&Y9zef*qf5HEx3(MHzkEi76QZK5R|Moy;4(#c7T1M zU}n_KC*U8V#jdy~;+aWoON`gpC{ceO7ezYdU)w3erJ#EOg&tGfMkR~@OiIaj@n`qP zA*AHBSystp(-g>|Wwr9zFJ&-Xw<+ZT7Q9@Z^#0i}6uF7?0UOU(zudf0h2RRAW-9HF zb(t;z)`i3&@O3^sy)ON3qiOB#(bp=VG-x|?o4++0mt$WHfsS?@(`!WGFK~geO5{xn zH@bv8dbfbj+yq#mxFtOOVWA8$z1lZ<@>5qZGQRm)t9e^#R2GL$t*k;S)&`Kl_w?tp zilcc_z&H#W`9}~MO7f99C;+uDfgIsLfxtkgfAH3H%$o?))>}1KVizqUq$P0apa_o- zDMLZCKW>sAN}P0aUq~A5#v8kI3WQ1{ad~c#VtSLd4darqtFL#*?xW0{1!%)Ssgz0w zPVrz`+(J61(KQ)WC-}qE5oI_uJXY2*u(sQyrErCp7;!1F*?{?d6h1I;0RWO}05&dQ zD1^Q|f7jsayWo5rR8IHZjp6Tt?qHS!&|q%)Vy%iIB>hY{Gvn#w>cJ0To;mM&s1^z# zmE%94Y?7-P`1<=c!WRGuWQ8$WLYM)Ln(~po8Om^eW4;|c?&`j)u>~Rw!n*|%_(CH% zG5|%GAxAk+o$m!^7)>T;A{g)TPfjRJBB?CHd#p}{c(}@zAXznhzg@SE`WJRnM~DAi zpo2dbC+x94Sw`G#g1S;J4Pk|HxvxKWaNon5SKAm(5v-wa0CN6<$}s}J29%AB{|bChm8f#V5qbT@Id z=m*llEaf5b82of5fn9Jl{aEC)o3&#}+3>%RiIW&V5R-7j5X+SK8Xt@p?QpX#dRb0? zI?Hf|2@MzgnmfFAxJ~P#`6ana0EfDr&y0(^w@)UM@PO5Fp8n;=+^IOi4X59#Hd*lC ztb*P7?PdbpX14nVvA!3J!XrkJP*d`3n!)N%sY zH+<}v$waxHCR_?LbA~}R=l7EQK@FYY5%9%cTc~~#?Tx8|el-_Qq)y)2>H5#U5t$cQ zQZ;HL4%A$M_r<|Uqc+YlKq)ytAfoo{a%n|W(cOA~DEA4}uR~F|G@7sKt=QR=A`hR1 zSr#Pf1IlydMPho-tvt(46GDM=Neo*xpp|^_p?9aqr-ayJ2j?=FjHHn9+&HS}%kmDa@7w$^BNWG>} z8|Zkho=A5m^L4QKR0^I{S9(mRSeYL}Jsp4Ubii2GRWpxPTY>vGE!-D68yAv=y#lZ@7{W#R)qBB7PdY0XnRlkKLTCQ+Pr^ z${MV|b>xW!z#}mZRDGr#{T#1|&)yTr(?$jIh1XqeSXaqZ;(m|5*srM%?%$SAVtB#= z4uC8z4E@?#1RSoED2tHSJp=)LNEIl)QA`AKA=;ca00ub79vSv+zGmuiUu$HhG@w-tZ^NpVwUF(rI?;Y3naLX zOFC8RU)=)jZsSHd@r8m_35Dzh1)?ZVHlw`ky$aF}UGfP%+41QO9eP`%Z;bvO`1=dY zB2RPjpY;7-RQ-R~zyH&(#qyteHOv1>uWr`b{Iki1mk@S5(I0zRQ|8s8S_0QG2hQW z5OG)MYw!K=8D1(id86J#HAM8F zD;6q}1dy*{Q`c*@S@l#uXx;6V4hQv+G2UnXhJY5v5+&5+)$?rCbLu3pzq3RWXMqv= zj;ZbWexrUTt^AOwcC+~xzQ}j*IGoienpVh)Aju;lkVY)0_v=`!Wn}9ZD3u%wU(L<^ z=vk9NMb0s*zJ_D%zgxdLv?AE!vb)dfo21l~6o3?MquR4 z7cqNJO@8)GG$(y89P#xS=$AYk$Lk%O1)5L_992^sn%#sSL8U1gK%d$mPUgk;^O7C6 z(r)^g%g=Kh8~fvU_=Rns=Bw4`=*y3Wr=j6uprAb#=EC}}WScy0|I+Z`tx4~v{rw0< zqs$$ZEH*O0A2xUIP!~o%a`{}ywQz@3XqjAc2+2jB4#S79+cVAeXH}MX(>IoFiG=ud zI0C*|32EN(6a4%tVPFT2O6ro>-zeqMUV}x6J{lvQ0VgU`JuPUzVXr-c%p4J!Ecl%r zAOkD=g12eH6b^4cJtm6-bZgHnVC=*z6U6KrAs0^6iwb%KzOob<6F|TevK5=D*>J_x zsTKSy(EQRh4Hb2~Z#L^+*~GdblCy^FTr#z{#=#;%?2HI+LH+C-$;HdGv!i%#u?^nK zF~C|vi6j#cTR^fgRudQ+mFEtP5Qsx2K?+AkNDq6yDIktMOn<1$ytH8QI21du8dOU0 zR%!X&BIBQDGr%L^ZxN5?xDqDqK2Ie(IBz;DnmU$yTES>bBZGo80qw_*3X_@wwkz@j zO7);(Nt!=~*J7El#tyx+BV*SWax)Q3F0;;;)$k_7s3V|9DV#zpY1_{*@6w3m30}ep zT|HDkpM$TLC*@^a9i6+bSl~F6Ozv(m%9$D>TXYwaZoqm$>BUJP?9npHU7p7MBo;{N z%54C6J0V^O8(w$m>+Hapaivd|Ja?Q1Rf)RFW0AH%WotK1^DU75#fau$=T1dlg1(Iy zH#~g}#UjpAkra<(<#M}7CUMISE*C`_fY-NPWzyD=B6%&xlw?7%)~W8wKwxQ%92NCA z*5||@!5n~+mIxwO6a+Y_aq=J}?!ZVu#xa%PZyZ%M%z0(h4N2QAU=x3AcTlX`0l|3F zLh2yp|43`D*{vw63qn3-*gq2X=qfz4ge*`TD|vw2srn~7CR1)2hmhiJB=fq^MT#5Pcu zj$a!=mm`giJ!H1=;TGe3ll=L?%6O!?S4-_H;c`OdH!{q27?$NV zeSt`-=uOBFo^)F#9sqVj5nwU^$TLnv0a0`zhB9c8#IT}P0p`M53`WovqNYi%>sU#x zi3AL6v?TOjmBAX%v<~1v-+F3D@`~H?P4GvHWq-Ry^F1XjaKuM8GsgtSAd>hIVE5=` zk4UT;6l`TD3a*dDsGWk-@tc@skikZce>C`CTo-9qMVkRD&DJ1*xmpx=o?T)g+|3WM zI%#_ALW-lLqXn`6B0)PUu2Wy9i3HqWh-zL6~E=S!IVg%nf^7B_?S9V%Aw# zPFlzOxI6>@8TRn&a6*LjGC4}9=0T!{H2c8ltToYtSKyu9fsjgn|8aSN3Xf#1D z2XIvbgb!ga>)8F2LT?@|*qmX9Lb?DSZAXl{<6sxyD5<9xYlR8L!FPYSHERLRJpX*5 zAn(w%2q#v?_RH#q&s^;BKeYYW{yC4|U`Y`d1G+NWjM$bjWM@1Xp|&36ky@c=Onk-k zumt0dsi4H25Q1PlDj#1!HwDxIi{#_?jag&z>cyckH@x8GGaQ-G&29@Ub@mbT7B@EQ z_C2IbU4rA>hZZEhT<@JhhdiU%8r}2T4dAnvT)tiD+oLeZ9*G2RlaD!S9+ebmp({3W z``T@z#%*afhc|xRx+S4fc(6*a8L5O9bq|nt=hnERxV&-+g7b1}PN7Z3`sPVqsaSh8 zU7>_^D=N>c#|})vuI4D^y(!?Vo%9R$x)|~zWMM-qzt#Ua#W(GqF`LFZGPg=U7-^ib z0u%qh!R54Jc*GnMUDN1hB9m_gSV2nW?1>bdp`r}PQhd0r<{<~)uOniG`pSOuwK6@V z3s^FR{~^d}-OA8rW<_R-B)2iaFLOi)qJQ-zR;`5daUU2Kkjv)m=Rjw+sQbf_GXhiD za=|KewIj4hGZblu#@FNj{f9&PKnAWVXlmXS2L)F;X`QDkyAR*gu4Nq+6#+0JxC2w( z$=mxCNr~$TuVPc1*DEA`XMgpuy!y<+hGPN?k#ot1zO(cT1|mci$KLg!z;R{xrCYl; z)a|(Jp&i@S!r&1#9Cp~pSCWI%!M-R}Ozq`(3fbs8zpmFU&;u7k#b?Q+_Dt~xcPR*T8cNP687 zE8x5cI!O7(JF2JA(I2>fR*kzMZSpVgu{=1#(=MNcV>+Y?Ry_ZC#+8T%FWa4zKlG5! zF~iXw59W*@e(4YA4_(sq?4Kf(SZsI9{u@vMEj9K9K8B^p-Pk9P>oR{Wym`ks?HTj?5> z$>8n|a|iX4-3bl=;~Wj*<@DS1GheSXtA?Z9(oLyXzKT)|&6T)6uF%35>;T zby&yG2+@AOR|lKwT`6ggwg@X{o{c8%HyKn?O=xN20_@Pxue3xH$ z00J7ZqRjm>dw)l1NM^4{I54j)!Ig0Vqbiw8}jjUD}ePUmVkQU{TVKBfK*! zUHmvHhoZF05-_-U=^rc*1l3)035R<6Q|9V;_t`bV=$4hbP#P%P94!MQfZ;idIT;=Y zcL$CUm(H63rFgLOsB`1czeReMU{J>Fsvf+cpKCE7SQz<4y=kVyLjR)OhluYoSWZfK zC_ejL;%&BnC{+@GZTLdtLngKV3~_Oa0`$knq2l;^Yw{$IYeKhsp0ajaSnUEGPLp`OkQ4yY%GX67w+USq)5xflkCpEgD;`c8-rArY-KI5Ub&qw-^IN2PYesP z<=StA`#Tm2-B&9@IgCmeGw~_plbo2`-idfMK{Sx_H3yX{jrgzu{{+Y~(B7EpteMPr z{+l-mubY{Lw%_o*I$-|0Cpds`z&FwHj;^^sN+0Kr^2Yk3+_YDCUwIxqFd!6&K{pHw zch~#bPA;T-(;Ic`8MK9s2Kt9-R4eHj6QBm*$_hFHf!)+?QCs|L{6~KHeyJi!|EQmi z?l<($7rbBQ(fxl+M*ltW{I?&?#P&a#be8}0qgnn}e)RJHOhy97!zxn22z$J$H5)^6 zRFb4GBbcM`#_B?na}m~&$&ywh8!A5rFUn8xo3Y%KmONQJw#WU*h#*+8H_meGZ-F7n zi3q=ozccLUgzfEb4*f^9BEQVL3AMF!bdF2QUkB0Zn0#$odSz)C;~e7$={mM_K__lb z&-DL->8LDGQ9NOY>e118Jy&LrezEes9;#=M9%79YCRPyANSP&&?H!#EJ7Djdke-o+ znyCvUa!ct7eBaNY@8wnQ#o5?uW!yG89G^x zZ-o?3+67B)qU&S&kgUwD16nEbM6j9_csk&ZB{?FLpxn_0jGpe#!S=X?hG=3N=q#|% z=kd1dso3+;sZW&+W|wUHj>l^7ohExAF8T@g+1BTprq>5jw3p` zM=X(e_6+gzSlMW1i!(E_?c~gWCl$?w90i=jX)%|vs8+_c`u@M!G+Ag>sw?v2+y5H= zr#_EuO0JA7Ws%y^xYx0cBb(wE*vn)#54C%{AsU?5W<` z>N-u|biTFzWz&?E+)TEY*xza&+{N8opAE^&He}Kj@x;y80YfUZ$W9`&8A@qd30rQr zrDBB6m>MI4CUx52?y|WSXvld=MEe^JAn|C>qbvUXc197ep)QSvvEE78EC+0n-xSD13nrZRMzIK!iE7cVV)<}c3>*&*-jb$k@Uc6>@6V0 zJehkT$js0PUL7yC*#RN{)yVb`S!gg_zRQ6Xvz8}gAzSC$1JP$wCRfLy!VkuBO32xy z8VK@uH$+RNi~u9EI1>d&iQb{Vg48PBVJrth*dGFDB)1i;ucpYs}INStG4)93{ zZg4M(VCkMfk5Zv*e~qhQJy4yXx}!QB*pFuJesbH3_B;3#=*Dti!HbE$RaL*H(m$vFN^R##nK9|b~S_AE&=R~`5Q z*DyLmAfOJEA5){@m~ql3ybNp(ebFkIA&IQHqgWD)yGN>sPG(JEbaFL;Yp~tbkSX~E zoRTNTx`Fl#EY|h~Y$&37;E1!h@!~>!U(7KXKr*8rKslxh0IV@N_{L$FX3)dicFYJS z^Ze`P+wq(~CfjPO5T3FsFvgU+sV{M#=x0Bh21In28TL~%H@aM72)38vjCwy2Aj1*T zI^j+BZSf`IG=MLr0wn%G>_caqQ&VlWvBE(XLg!N$o+nhB0Co$!x>mUhGBcae;)+uJDPjha)~h?Z~^7lOJ2>0Ppq)MkYydXA(Cc~ z?I>Gn6od40aB}$Zh~{<&fvMGx`7Sp$#nUaP89da@(VV1#L~NPIkUZlI?;!S(H% zAQ8->&f+bU~6i~vC0tE1J0hkxTLzLgnr!KevE5%yXmhMhVzLBTXHTL@uE&^E7;m;r; z*Xns58=A|lrk&)qmsUG80jbB(nKqaNkZ8IuqBTPWqb;mTuQt2T;vC0b+Y%_#gCuRp z&{BRotY!g9FbI+hdW`|3j3dUDn@UWybu|s*k4G|Epil&o%4z$FK8IjTLKEQ)WV=i3 zdCqDkv|cnI1~t0f0R0dXLIoTKkaL6;jaYy183bXkN**wtzSNNKM66BNAxS>03Wzu% zUp7<9SPg7MwOJ{`daaM(G=U5af{x{2;xLQa$cgNy2j4h|H_KrG>5-rl-XcvSkprhJ zj0nF#HigPi92wz`0AoFX9o&Nl*OGbj8p>-tfClC&Ytp$!?cnF$5Ou3e);9r;&twEb z417Wr7D!)6h*cA|1G|{06aivbbCe>Z&BAHE1VNDlwuLO$aq(E!>Jtmp`kOM>w15Q& zOYICaE(du??f34)l#R1*4Cc#2G`d5j?6F&nwgA|^?yXf?l6qmf(={D&Xq;Oj(uz4upc(lYS|H#} zQ^~>^Xa+s|MYyy}IKWZfXt4J=?m**Vj^wf=VX{+Ba4PsR_MMmm+!Qge9kt@8C>_)) zt$!Jp#6g>D1D$Y84WK|HPpsiA3axO7)$;0aX_Es2+_qeZKjt9^wG%DllE|EmLAVL(aw8C*o zD77|ZshD||GpH?4H($1$p`e&#Y~|uC+OWxLp})-iV=l|96z3_$Txm8VHQIt) z0T8SpG-*OiHJJl*@rACbwsyGd@n=V+&Y2dNIIjMLWv>E7=y6F<1{F^GiMJw~psa0u^|><;Qg2^GxpoM9 zX_YcMXGD1AyKYc98&I(8FNy|`h$MlRD5aP@pqW(-Nz~CrNl!9OK?+(~ro|FrCm7VZ zsl-J?E{v>OOtc`V9{_Y^b-bPDpBjgV{sINZp2d6( z%zZ_{2AvCU*a(l&A;6*pxj#gy%^)aEk&L zba!M_q>&6XPtQ4b{On}ARDH=5LL|)+!-}_%=^Dh#50NTbw?YD|)|2EBmqKoer6aWS4ee*#|x*pbTr0HQ_|K zX>kQhq{{-Jk__E=(TuZ*lNng(d8F_wznx3X*m76x@5ka8yeb36eyhpsqtemW>K#c? z&~8nyj?&_^*sZ)lKm{Uk&c|)}rL#YOPcQNhl;W3Oo&U@xPQW8i*lPDye46>-8Dw?- zxib%ejQsYGrBjd$kG!4(VSq~IS-%G|)XN68visDmP^v?(!ssLB1xGE+0w<|abjBkR z%t?hK>k9E84JJ8g(Da5#OJ=} zmOAfrEGzDD^myecQ0z6Vs(}}i=76q|mG*c7?RNn7zs>?reb0~PR(vMJM{AGjBE<3^ z3T}QyD9cS2T6DUIDfR%*c<6m_6)P&*`pO<(1^mVkXoJkJQvKyKE; zzPPm4hm|{~Wz^fR6<0qhti(kLRkQ(oJOT_G)DE4K&c96??S7sM4UT==kC8lkzP*PA z6J7L}G`&vq)iwP9&*Lg0?QQG3-e*`WWT4VmsF+#>dd9_0$0JM&D~ubJ7MbjXs>Pnu zHb1eB(@`jT zG0p*hBn3if_5PgP1rxog$%Ak;?X?J5kh@WW?G_uye)k)3cx)M7s*OW|MROyr>UHUc z^5)0LCI#s7e*GZoZf&2cLd2mtX#d%t*@LGez=rrLtEzJTw^#Z~35B7MTNGsTbpKtx~aFlVT zIq*Py=~D!_Ky86&(`G#(qjmm)(@k+WL2eyb8Sc|O?(nvVQl^vWqEdN&Dc0oL{}!m} z8k}HC#U7=T$7dxWbl3ml=?PTw*u8was#3x!qkZf^EA0kz^}kP8CF;{M<3={LqjH3Iygys#IAj-BQn|vhr0?aCG*_KNW^p za0K7*x4?g^!tNzB8&h`$y2`MxMWkU})%9Yj+{%wYQbsb!Kg>UEvoT~V+n1y8qt)ci zyq(m)gF|~y7k#p^)-S`ELVpBkVU4-9tKb!(K*@!)6L~gMON=C0?nEhhE>K=0Mo#>}d39eYb+E z$*!8O{z_4WWG|hhyZ-C2_`4C z_^E#HkJrco370>wxBET2F$)ip2Fv<<5S6p5U`Cu^Hs$pJ{-kXC7575wWQne8+vInL zR?YMw9DpR6wBf2ATh^v6?|o?$=$lX5q0<2^9H1nU_w(|-L!7;reuu+J{n&S?_g8mB zITl_kH-Z;1+u7~cVR8ZeG5{Y#w$&s*KurgyCabCVMF~0SkC7aKQC7nxftqM6|9STU z%)oT|vmO$(62Jz z9~S(8C$&G>o+I z#G8O!fOyTmvP%&);b*2bkY^k1Wl!{YEA?Be77)`@a{=wRQs-hwf)fMC-W3z)I1E}~ zks6p1qbIP+;!R}@h=LyWPJi>tFvS+im>g-wGz=e&i~64wcI^>QDcrxhhoLMp%;3nq zf!1q++esg8-l{Fcg(q#G)BYnM;|DQPf8}g60NEs8RC~$(O?)l##uqf;0)dgf!ZlJ2 zlq_u)aDCFY3idDu7!HkMpr(w46F_u+ht)<9VBY=QlRaT5FV|$YNEDRi57=^LkbAD1 zHj=vWDt0qOf*5N2!{~HW$$qH)GyO6>J|d zz>Fsge}=yAP2$lyYJf=JkNSNffeipUcKAXxvXpFO>PM7@mCqF?_P~9BTEG25gi?pv zaqNRfk?jB46;lrYkhK@3Cb-1exF=9oa#CKPwg-P;kVhVQMH`}7!mvJ{?3ju5uKN9J zz?KA0<@mMr2*zQ?er@tcWb(F?h7GyJnhTa#VNrU1?QmFrDHW(vDC4zr zFPuPbsIB2i!UCS4e&&1+!b0AdAwc7Vm;K#H=Vel_9SUq|OtZk%&|H=55gyP*ZkP7`VHBU|dJ^KST}zhYS)? z!HQauG4Ok@U%O#D_K7krA^6M7_q)wf8Qv+Y=#HVzWsd9%o2B%^+jo?KQ!#q~w$Xvy zl>o$jHwCoYYxk9_GE_6QZw(UzW>?LnKC1z?tb1}8L*L3hhJSs&;>VnP>L#L_w3Sn}SB?VZaPP ztfv!zg-@#oU7l-k;m&2r1*Zux9CA%AplvO#*cx9*OL86RWLzHeP;{a!26&fAnv2obCG9M5_^T>#%hAa3q%|TM)S1_3bHGrxK zXa9<m7^A78bMw34KnIz zHh8e*flyS+_anc(X{i0;-zW1$lHoj_SS~FSX3{|7Z$L;$^YX;O{vCPaG`Uwqf0s3W z$&hBX$TLV?1Eci-vf_6q2Be!7X|MixZVAz2-{TC{Xf@f}#nE6-Y;VR3-I|7hflyS_xe2Z|)gMXwRa2n-1W8;5_XzfkW@qn_hiBd^z( z$o8^7Dp|dd6m%1X{%PArxej=xf0hsp>TrTpXOBA%0!CK40DBS7pH$S8LI;$Z=H8az z&X&UAARJ^YK(3V!WE*UjpOrlA_Qnw^c^DFts6=AHd>(rv0Ed}MCm#E@SistQ?;)N> zi&sz+k>C8~r*z_gdHL7@gzBDVnHmF9%%oPu|XC_w8lWxPm3 zfJntdwl?P!Mq-2%9o&|b{N7lYv?L^$YVzP2x94%mTrLU-!L02_VdB8nw<_mfSu^i@ zRZ&jZX=mo;mwt>`;d*BvyQN?zgbOSw(>GC+@gbvOG0+?hKuxv4>_(R zL*nl&E)W;Z>U$B9cN7NkIT2fMl7rBfs07sLjE zoTb54>uPwd^jG5AVDNsFWfBaZBRgry)|I%GgIJ|KeWRZ_l$O1gygwgIbP!R>($Yf3)$W2!5nup3=b9g=nM1=cJFfd zO@^yKi}Jfapf+0UHyD=smxGBdj2iNyO}Ar8_-D1*v~}6s#@u7Fc;s&3R!6)^jDTMXyI{||3(0aaI%v;Hg9Qs3 zoM0iiO9<}n?ykY_fykTpo0)IT{P(}JSexBa)m>fvbaz$neR}f^1IG6xCY?8UhWWqD zU5u7Q??%taiGVvNtRPD_gm1WJLvZtcEiE~FKnX%^Urun^4#soE!2J?lz#Lj`bhcfc1(g9qX4<(SlhK#1BIv~!Plu})@c z28oO<_HcgigmhOMn|!GJq;Z#fmo(uShYF^!QXcvvIDtfGQ0mQc!gp-_G%07ellbKPJw0J&VPyYx^a9I29=*WwZymj`udy3B+lhYP zEW_~d61@m!vr{7UnbioI?J#*nqnP&|B!o(~@+UHR@`8BGEs`~*+emH`Ydrap8H+p+ z6dKTu5V3*vR|$u&m|ok63SoyFy|~%5_dt%W4`aiWe4s7&p{ZW$EeeBZa;j|jzGvi* zSfY%%K_Y@8jY8EuexW}xH&}WP7SQ5>jZQ2<)?lZk*|#I?QoqOc{j4G(3E!8385xh$b@8%a&WC4VpOjnJ_E$2Cvo~ zx2B8`D)y^qRaaoOv|<`1Jyo=DBW!CIAn#)?!K(#W-E^w53(x&kAt`O8F~Sk6+KgPB zCj$z&tU-?=EB4}w=X9J859&!?!HA6OQq({59o$pSmW!J)xs;+e-XZF`DJ;-iH=G{x z;xLIZ#+EU*xrxM^Fw%&b%YYB^%?lNg?5wEPjcKCE@3f5m%8ndx*GW%5aBehON)g%0 z@qF*t^Rnb6`30t~gVAM=DQU#rX&ql!)SW1FGUcX0uW`lV1gfGgBkvT=q&FyCw0qt+ z7{@nSg9jJ0pM&N%$|jA2P1jN+>|a4a4SCF88ZPpOTMYFLqE-zRr`+Z8UD~Bdc88(Y1_JuCXA2KgJ!E7JsPdx2mg+yhutDu3(v=x_ zzuQ3KB-k_lLE}|%i{y-DMRl+JiZ^|zG$7xLHc=c3%nB|TM-*XJ|HaZ zh)=rK)--EX$_hjSFRlHu$YotabITPgX;{>d-*?<;^yB$usx+Ri@EKN)@mOs{Hm62S zj+P8L#=DYWb{<}aqxQ01mq zk#aY-h=o)MW+g(!vdtTG#kjfk+%hFu^0W{Ee)#!%%cv)-NL@H16b&rWH|dn%can6`4T!t2c&14%IS%x?zR-pd&Sed|$wm+; zIfTKmiPJe-A)1oD(hcU<`A(c5#Atb_AmAJj<1rv`;~n;?lP+ahxZoTB*v43NBrMw^ zIUG4+W6r_(KD$^goec;`xC120de8&#RoQC%g8ls1EnYffUgc9>*U?-Mt7o{E3Rc8s zaU5ox-KC&0g;=kKDTlQO>56J)-w9!*oL}&gFznht0Dr`tkdFyQnkf3-9o^p`0I`zR zSGIUS=!FbX6R+F=W0zQ4qZ%`rI7Bf#Jt|o_WOB@la}yZSW9HLn_w4m4kE4~SC6@X< zuy5knCYI0Ip>tW>Usq^hsR%g7ZL3P!$YIn;eJZ*>;Bqz-xYE6gDuFQMizIUId1jKN z$uK6-{4!Q>P10TumYDf8Wc8tIEhAr$?m@BY0vB)e9CK9-O5om19xa^Q15_iAa*SI; z@Z4%-Tqm@xtWx3&@QpZS#xL_RlLnP=1CpqNG3)KvF~oE7p=|*$T)}WSBnpwHQ*h^)AR;K>q3xzD1e_B) z!rqk7rXoJx?`8wwAWpQO2SutHJ9Jx9HcFROXQ;(|Mm*E2#_?6W>UoYi{NCn*PqoFa zPM1ruWlSlGtHvV5$w}ipmxikm+EE@oL`Gex$;^-U#oKZ*|H^@PZb|R+gRJCa*1A54 zPLRVmPzoxslIk7V#}>9eZ!Pb$U##Nmixqq!s~~rxstF2KYfkVQW5701f7ZUbJ3*a% zFQO)ifStcCY+X((7G5!)sCg+k88G^PD0XgQDXKNT` ziBKF$iEci$?+h|VI=)^5AQ*$QF>WLxRFf1SpjbUy3~(r{J>l!5`$i8p8SfUpQJF6YuQ6))t5ciBx+KG$<+$M5U|E!<&6$m`|jR?zJ1VYaus6k{aXEe zF6b@4{B!`l1MT}1t*u`Afeu1^bQ2u4H43Dp`OVn&!S2r-5w)Hj*klo-%im!FFUBB9 zhCnS>{E$t)5vYC=!By@Hlm7~T8~}xtS>z(#jqXk=MEkC>HotI2pnW8%kwSJYg!Em1 z$n-1!3*UEY@eyTSk$E~&5tEW8q0cfY4e0238=ys1*QoPWcgGr7-zLV6paD8R*t)xN zgT^dVIXDv+HB{GqjfnavmM)manHMBLGSqg+otMV<1qn75^cDK~AwP`y+b)w2q~co0 z_C4v}Ws%afh?ZvSdKbEu669O&f?f2^34;(zO{~hP>Jbn*sVO@x(*o4-T5nJ}#dvB7 zyOsj?jzKMIcztQ52w%s*z%t_!af!>c@T{4NQmQ2zg6ZcbPtX}jdcrmcftnOiy|BIg z4&Accl$@lpheIgvDG?(>`E&WvM0KG-GsLaxyJ;zIg&F#=z0Bj5wdm#K8QE~VX{!am zq_Us{r6M6MMBQ3o$tpv-9)lTm4x!9<0lvlZ%?tldrfI`U6#R43@`&z<9y&Jco$Cvp zFCpR-H@2^pOk-+4U$(6>0Y652o3~TT?nNiJD~tscELw zZI%CJN64|2msvQhS%Y|&06#G|3AaHf1*QWw~okfeuUiYm9@kqRqkT5ZcLw4zU2F|HW^iiD_xwZU#B+Aq?k$}u*q z5w&TX-FvzkjeCq6<&9M@HU~HBJ2x$_aJ$}r#bg@|k_2J&dUr;V%=lWx_#u^4{ATjz z?n^8zno$fw|Ho4^gb5RK5WM{l{MLc=Y0w%+!nBqCWBk%NoGd+6&5NB`%t89>ru1lS zZx2e9ms=WeAbU79MGuOv@Iu`d+b8*g`W0KIAC=O%_a+4yLAKY zW~&(9^Lefz-en7FZ{Z@=0f%A=ydqPty?n90gaWJF?j;#a52;vuR9P3k0l$-CToH%t z$6DzHo9oP(Ey^qB#ls5>$$2k}dTmQ*7bm`C`28fP$>;rA<75rvs}}^X?ed?Jd>C)|?Jn`EymnIsIA{+X>F=sZj0hi5-d^_h|bY8&PZ(K3+^9 zG%$4;>2m{KWBm~Wk&Rn4(7Yb+-Ah_$FP&pmZq{*H)l}QM(UiB$X^!U;NAEcE;;O8+e^RRHs=Et*=^3Tlb+=z{ELt#3)umF?B!VrI#ZcVkyugFu zGfcEE7n`&5xedUV&B9!_-pcl@Z6qWkac*`m9_YGUmLe!2-pj7>K};FHRj(~N*xA`M z(!Latd0|Pjy2DpRm0H4)PrP1pKtvgx;fym-bc!P|oc$4cObzc$&0mqe4!r<$i1wu| zvt%EofyILlwFmnvCz5ypNavLifhvM{syI)pnGFW&N=P&?t~eUAjVn-j zuIkOe^AL3CH*Md}T>6X5$e`6)RYLcNPg*JNmgih<>|dgnaZIHzEQ|Y7=N^pEdgR+k zDnJkxjE`XtVbJs(ZKCk(b4RAgnCsH?9*TV0_BUT-)98|rn6FWfOF_Ajod=#RED2$f z7651QVSdUPoo}ZA+Y8=E6DCgEs@ll!d~u`o`v*o8kT>!uSIMW0&?F%cu{M!Kj)5Ww zr_XP~zzqXoXL-J~o@V7sHt%QaIG4fS8w;~fy0_Ul3&|#}=Dyh{nJAFZF-i*8oslN( z@CHTx;(JRP!Qu@a8v_0Hkd13@H{&DLk?-5Ss2;-hXQ)Xe!tcwM+4S)|boT&*2m6C< z&<5WZCRH#OTX`SABwxh@{-cZe>u?n&77qH~F6KWTuEO$f9j>wtJX{5Muy)g>!jg3X zJ`4n(Kkuv2urJ30h7{$qs@u+;+lHpFpKIbp1GD$O<6pl7o~{B#$oKBOrHw~zES!uG z5_|LF)c{B{iU^0^_tFQAy#cIR?i=^c^U~}Gg}pAs-U^5kbqte5FUg};doN?{6;fo< z5aQ2ssSxM$mRB#Pz$c8DpI0#ZqxX)h$$b_4nTa+nL8&#nFxl%nTC0DB`AnC72kw# zdpnqJlCpu?Ta$%TRd8xT2{WylWt>R&du!bHs*vW`PZi|5)HkR{&u8v;6&EVT+EgR1 zL6QZT+%&u#7pD%@UP>Z_qYKZCmaNQWLnPHH?kV|H(}C1PZNIcym-TF3||lb*XQjb#=D&U0>Lj z76M#Ubocd{5H_$na3n3jvqYLDM`)^cAbKN`@mdvnEFn`Lt~c6c4hKs+QzTT8XR%n_ zrVBy$rL84)EsBj2M}~^`D$x{q#w)CXg`UOc^|@6qP-Ph>vKEB<+gw>U3qx6+M1Dz8 z#~nZD8bY67y-d+YA-ZXhaD6|GMX#!`7(0L(LQyl7R-X*hP1t*mtje)NK zxnSb_7uRoHs8HOibjiIz@~c9bE9f)Bzdpl9LOV*=W$Aw(Co-T2k|QD^X=~jc^zrly z%wl2jP7BdX0BiPqQP%CpU{sNI!|(wlH-U~eh#UtFQ)DKBSB8SM`m%&QY0wlc6Va8( z##2~0LeQ_XCxq1vG?DyQO0I!e?R%xRW^pzvWw;DnNe_X9%d3_dk(-&io!^ zZC&HR&>kyz;EI2Gy%df&+alWL5 z+K{PzV0L8SJ>+}Nk#CV*n?2?QRc`&JF9B^p@ewPqJ6M3grDS}NLjDDKL)o~yoD`n2vD^XdBN_iwLi;Kkv z>XljwCo-sIEj}WdSpf(#K2gAv-8cLuTkATBPNx?|&>@M5B(?F|kUd$R%We<7Z@m;U`us`fs^2=My_M9nQNq&r<&3Pb3*7^3D@Y{&=Vj?E(mdfKmP*R z4Sns84-FdxdUL>Rm5r)~8FJKf?WOG;6;yQdNm;|yU9Snttnw&LQ*Zox>MM3vrz@pu zv)V#yzVn4YScuCs+U={$#(u~`!H+bIl~oqq$R_+mqA_{kt*C;0Ew2SH6`h9gz6gdY z4-I}GX8*tsD~us`Pul8N_D*g~)pA~1{6&>ZG{w^B5Onz`b*O^UA=>IeE4x0-;d~|w z$r&S4_2Tf&6}Roc2+_8&&?X)NM+W+jdczh0bRZEyrU2U1R?}7Qc5_eOcb`Zu!kE(6 zQp9Vv-kqDMAdvi4|u+9<@1uB!TC3LeTRre`FI#(gEUkkn$RVXYE zRa+P)xVWifP;@40k)**@_}X%Dn!Qj&ez*e}?hknB`a;}2EWFIL2lvyKY-pN)vo1r~ z8|^yY!tp8cWTEoyCF16S*W6^bstg%7-2>C|Xd9b{swDpS1v(dbxjU zeVU^g5#3oi>FdR~3}#k0_-(x<;>h<)7lRpS{l#mJCZ?4mRpU?cgni)OKzgz=Ck*8b z^IqJ&QGD$zd?6LmCGR{+1!uxuyjz{VwT*1Ll@%;j@3-p~b)7+g8n80-rqI(JHc?BQ z4IQI1q1BA~BVr_{i8vwZ7G|SY|K4WP8_huViD#5kBVbAx8MyM^ibm-S4U+j-)`-_1 zqX_YR-+97pAboR8@zUpfQO+C7Vo%v`q~x4qed;HmG}KXBTf2X9g9ASd-hF7!T&;?9 ztEysED<6?5ybINJ6~ZqMqm_@hVW(BAaGrVNy@F~=Y4AG3)+b_}zo{5R_?@RzRfMk% zryw^^B++wDXwPP>VEwg9-%|t}o~Z+NCxfXU?o^SW_+sB8lzrc$ zksIYQ`f_3p7D=p0$UTXxLt-{u%!)C;{hWDBB(*BeIg+<8a%5_&`pm2cQe0OF)o6o3 z)nx*yLr8|0wKl0l$kk}c+|BG2SqLs@59lS%h?Do~6{(bwv6uUnuSk?m-x1Cz?0p%I zEp9>$l(TA8v5l37`C*1N0gZ?1nHag>;Oo)hQe%v_l156Fh}0}ucAMbbf*}<*j2c&456!m*=!N>l?j`Y z$+@>kp+n#eyNfH`eBn2e>c0FIB$Q(F19xTe`BF_CH4rX-_x+SQS*xO8Gt}@e`uc$gcK8H$1ZMvZc2g)ySup>Pc<~R7=%3u^VupDv^XcTUHC6iC=TPKPO*98gp~H zzCytadw#t}d3wBJ>bZ6F-R|nXcU`8}B>_{0Vrc=7HMG|1nUkg}B#abo=t$P0j2;cC z-1~c&JV9F9sc;l%7m&t9660&ZUHV%w5E!5;s^^4zo5Ugpm-F^_GZbInCSUXswN*~t3gIqnxDo`24Yq|-zQRS;t4K*6 zv=$9m6{@DxEQqgqq9g<>d89mOr}tlEth|dhvb~~#>yKXStp>7L1Z zjxF5GN^}H9B_e0TiweDL75o9S4bguY7mSVx=c0leb1f$@fd0WF=>(fAoHS9d5(K$i(!^`}yS&ad80@-E55jvU(;)04XCwGd%$t zS3-@)7cyBH7zx=p7`0#l@-~iojz)y^Kq`A9Ye&Mzhja44WFrR~Cwl`U2Vfzx_BI9z zMvfW)Ss@WZfTEGBBalzT21v~C_+wFdSRNi&fFLjqPeVR&=}pVEHH!}!?#N5THz%ft9XnSWCcA4UIBz@z$qmLSi-1k3Qm0gz{4fMs|>3P7F% z_DLlGc{bQ5J^aD^nDLwW-{E*#ZT>Tk$2$Kbj;9&>KjZkD68@cbJk5IlQ5{e7(tpPB zAGiEzZ2w1fJdM8pjN?D<^Cw9CtV2N0!RXN{14s(UOA7E)10ij1W@P_lsRirBeurUEt%nTh(9W-EB=^q!F$G^Xa z{)+v`0mfl}QU2roCpD1bG4vz$SLmOY4$OZl@h`f+LVvH}2j#Ea|9Sssb^bx~vxR@8 z{Fd?0v_ES6U)uRZ^?#8MtPyBn3tJo57@Ap|5VHR0Fa;-l$46`aaZY6TYo2(@{fU4l zYyTG?;1LhMBPwRr{MHU;zvDt?#>PfKgCA(&YrsBswUwE*lY`b@vj|LYO?SlW*g|256e?)YEO3{>vl z(E4O^0R9zP|5y$FKckhI9$;(+Ft+@sxcy@a{XHQnsfmk8s{Vwnyp5Hf^*`YDv7Pe& z*`)Z0MPO&pKQ8+}{vJEz*Y(&LK&<}6_7m;DjoL>DJYGM`1uFkHMt@@V5rsdx?lI@7 zP9PwjsDL@_Kf}QI6J&mIKXN?b7s&IN_6ygK^*omG3wl4G`k3+rQeaE|yg#P@g4!=h zALEbV#}V^0?{{l|N%xrli|?`aU*X5Hf!t5}0!s1|YD`bs{i%VUn)v?-u&m5~1MHIx z_%8wbnEQV@y)tnC?3`>IjqJ@#OdVl4SbxMUjf@?ECLser-^tR_2pIfdVf}}_@*CDt z67o{2Vn1Om2DDAh4E`sspG?w!1J=w8zt{R7u>QN^f5iR{=6^=^W$k5&{cKuXW`&zPBm1JJJd zBjwTd1a2@=0{8&}03m=dKnx%SkOs&A;XmqBReNO zOMo%J6krCh09XR7e%LPnYk&>F7GV3hmH9ZneuSRJ9l#bi{%i~Z_5cTfgQcE>DZs&2 z&%g-a2yg;8SsNPJI~ds58v&dFE&x}68`YEkM9eIWn1D?HYFhp;%jhZoQ}aLy;JAL& zoTHJD5zt^W0&3w;LroAMX=H8UXiCV$%*@8a14_s=RT2oXEW`FmP8 zjw$aSZu4;BhYLxU(yOlk zB5o0!2FupNW?~uyxZEC&{abzvtKT%sURKtbTUl^_b^Sz&DKuR}!S6Ebu z=`#<3bB0Ekho(`?P19}Am!)UQ>HOh10%NSYnSLb6nlT;JWwH{2Qm}{o&5L^;wzLfv z-nbOV%=jKrPScC04XkQG7F~tWlJ)N(gGGtJjTsv;+x(SFo~M6XKCTgiWuTAVUPi=l z&MuEpc^#W#khQM@>9b5iQg4#K9H@R40C_KAfRGUQRo;?!7+a$3yti8yuFB`RKfJ0G zUK>h@ZROc|DujY2&#|q&{loTj?5k=>4wPpAg?1?OExA&aS!REHzhjPqB?d_{dd{Sl z?;4Xw7qX;omNYM+D=A;Qlen$Hif#23hG{^$VpyheL&8bxBfh7LI!fo!NZG1aCx?NE zY9DD$37a=|b+45?-}Cvt+mGAqz#!>@m>U{(Fv2F~7s1v!4}IaZr#8v`{rR@4a=KP(+j1aM z2&wg;FX!0EcE*a!W+k~YdK@~nYn66^Wj>u^_Jl*qWfyw6C-lSB`=nDfd_>m5rAkh9 zVc14+4?sjbO>hCd_{_VHePcQ6B}KXXnTp+{!TQad>BkXZ;dL(C7sGKR4E=Mt@6UVC z(V2?EoO>)r<2cSe@jY%mXCwSd*@6>##YYQIcHET1z+Fqs_J0bc^@5VQs>AJ&0JQWkBbSYy(4oT}Ln(mWN2 zVoBAFGS(eR828o?2HR%11folcR-bsWhLYn14S;t)jw#%Y7+Ez01W~MXfg{Hf2nlzq zH~aJ16kGR}eABgB)_1IG$XrzrF8q=&m|&Rt*}b{nQu4n@jW{CR`UrS93~LfN+Ad3E z?LbqWULYgdb#j@-jKq z@;SBM+$g~%{S#+bh1cfFgdH_j^L4S&t}Djuz)1@5^U+*QaNaW>lA+I~uVWkh$J~Q}sPFaZeD-G42G7B(#h`t^yZ&;b{?=`B0D4 z*D^4L>m$CI@`1;>QyYRP@tHGy+6Pl2a_UZO6|@YtuDMYn1GG^-;#|PnL~&(YVUjY7 zn#3-%{N?VUC{cUoueB1#cL=&H?BIuO^#gQmVaQ4BP6x0?8^C*a=w7E3brE{2cxg-&Z%GEVV==$czXJE72WtdAkOxUI204 zOaQ#ICJUpH!}e|8+(cn=nf5zz5>9{IJF(pbm$ab$vaq0%7l;geh0}XE??ZZSXbsv%_Z^c9-#e262Sg4&`0K~& zCht)`n`H@F__Sf0%W@5{`pVk_lpZH7W}%(7-QhZdW(0tI{dipW8-s}eY5LrU*#H%3 zA1~ zA07$3sR!q_S|o31I&1UGK{yz(ma6C+*jNIkK? ziBwy7=L9id)U&x6cDkC<9>%toS9}=X*)&D@?wk5} z7$^w4Y3$zblzv}r5Vs&v2#Js+WM%Yc7+BWOLC>gP;2yngQ}CbMf#Ji0J*KJyN3cNk zMWLF?c)^yYd54?!Rhz-P9^1{=YA!^Hg5XQ4(&^;XjRWM{FdE^9U=9#OR31V~WK;l0 z(sq3nXN!;bmLu2-qF3_U?!j?!Ax4#Rf-oEb3OCS z_ThMb;EIrH#;9Nrfr1lsgoz~iAs*dp1{{Klkv%~i6dG9`2EH^kd_RF}V)yP{cPtUN zb{j_JR)P10L`byh=qR^JQKLeH)&AG&p*=DQlR>qUJ233I9TquglhqBVu9tncoT#e0 zJ~!xz$WBzOSn-(hT$tF9V12=155gu+A_84RFW6?Zh0D_BCNEMx;FC|ElkBnGa$F$u z|MLB-@b3L$bgzmHi^Zdw zvr6R89SRKndR)}CFIvBubcmRt?~_2k@g4^&LvB^=2OgvjZ3y+Y%?Hr(8Aiq z2Xyi(+VXWD{ZB!9r!a4+?~T3l$n z98pbEGf_|!nVQ(C5xL-NII>3vn0W3PzObzQSeBg#(62DJ-!XqljmX?>?R#a%ck6Q$ zFkITuN^|V0ea@;q+bkImJ>XZ#OhZn`c%r)}CLJP8V99I8mCG%;8KVl?rPU`64~~Do zT>LpOyg4jqeZ20>LhO1PLO2P6@%EG#`1^fjv+i+EmyvfKpX~kgz<-UpUeX%xpm4`A=^dxB~+$=udB1@X22m0lWr? z0=;GlfaFilSr#DoInW`0+#>ktmK(VmSn62;z4OOi zS~F)O;8rcb82B&>U;;1!y1$POvnjyT&DPY&8tA^8KRNK0Mh*^tc=6U|)+9y$=TXDQUW$NG`7HIM5ud$gERY8(gQU6O_IxD z_}DzJz3#7Eh?8kxU)jx>qpBTu{XS1aUE-&mp7frw_87#XFK6l!R{tQGiZ zCe?}MK1Ym5;*4z&jT7!R_-Mp%ti3$!2h&q;aGgkk zyY`x`lVJ9X+HsJ*#O=fzs}M1eSBieGVgsBZJi48O_h9C6s{o!p9e!N_a=}@M0G)F4 z^W$9|kL#7AxW(YV1%*N!4nU%=|Ni9yR=`gf&;>r|t=|-XbOl8^8g2pj% zb4Zrh8JYep1lfv$fHAxsB$fnDN&HM!+0*=wVN6ssZ*hb}sCb-wncw3`1l6=MZLDco?qQq##p@wAXFaWAIye7W7#0fHR{`8P)Ubz+c;5;Djzp!cH%v_Z>=ch z)wtbLh$<%F9t`BVykl>+i%QeExUEmy<&F?=(TgcN50nF(l~GT7UnCr-tzw2RvMew+ zncX6yUJG4iRjho}udT6I*$Ih8tstMFNK13I7?~3@i=~rF1D@Jc3z6VI_ZWph>tE`eSzi} zT*CNq95Zs62YKP`YL;MJ@<)zrSP18tBKB^fLRppB>!rLBxGZ32!YZk8jfBdH!%_(n zh*Ja-8o8S1wMXpqtX>{DZz0{mf7kKzFxbCCDGzo4;q1QiZaY;`eGaF`@xG-FrmdQG zb=mKka{Ct4(nRSFf<=5#Dm0r7D^pv#ui5VYmF@}vj&4;6#Z!x@rnpFH^M!tp;+Oj} z^$MzB5R!&(X-LrN_xAUM1T1VvTd>V>J3Le-c=K{f)3nIrR{)W&V+YOxs5}Xa zb>-@lJ$g8dRvI2O`(fZd+d!BrqxbgiHlhFV;w`9x-b`<^uCjT!e(4xNOYaf2Sn%b6 zSRG%}mvZByy0b;HAZ67ymjmZ<4rQX6Sc`4}21+qh?9Hev*97SL0Cg3^u1U<0QJj;P zvJeV3bodwOBr?cI8XSUf7^9O-T>LyAHk~DJ+Ns zu)J6!uNdtl+D}&a22fI;`0$gHqTe#gsq6WhrSGd=*>&jJa6t`z17U|YUcp9sewOOI z^dMyJgbc;!yCHRu)C=B<2<@NHvIo;f$sXYHx&Bna;@ky0Q6&Am%3^>Ja*pR3-MD?s zNyp$mZRmTWoV?!oyq?fz;)vWcrtCa;5H+<0Iw7`^w*2uqHH`Q;wU;l8&*9O}-(r8+ z??gSSnd0^!(Z{J9lgCt^N#*i4KW4%#%CHMD2mGK3TdypB>RYh+WC#;} z_gr-2ZR&8VPU+Qmo6U1V1#|7o{HB}UR;ymGLD^a%y~kZ^sC_9Dr9~K^LCfR9>(xU` zDZ$z7EyhJ`j41;y!lb4EAl#S8v%1CXPKTZyxcf1=?Mk>qD9pTOcG)&HgU8?Z-yV-E zreQ~x#Rsr1l!8NG9CY3 z*^3vTgXbDU)%3&8MJD(LGp34!7fM9}W?onH*%Ik}8r(Pi`VIsh!Al5&IRXLl-eNW7 zK^ZNf&qxC^s-^yC;_dK|7b5}vjgcdt_r~nStUhs6ATy*!^lRNMBOHGGTtmAczdSE< zq)q0aD9LqStH{9{TawJTBCIHNTL(WI4y^xjQ+5(5(Fi(e8R%vTdpD^NHZ4p~u zIIF7NAdnCnuC2{Dlh?oLXiZ&w3P!9ki>u037Urh|Fagd4{ZyFNZL6R&o^I7)=gMb2Qou4pVOVBjv-mQPSjv%E0i z`cU~YSYd6+sm&PcO`xXWR&J=lxDuA0lqGH zM*cyBGxA>dhZhu-&`>cj$p}Qv&y05K$RLPPAH3bZ-jIbud1iVcdLORNgHgRGu?5-l zR4qnwZ6sK$zk7!I>g|h>S&x8&g#(^ru_z(AG*SsE2_bzqcc*GJIxi_-O^NKCoo9}! zZV!a219s5}pDR)%6kft_VoM9-0>+e@75Kj26!N+6$Bg6Ji}^MW(Xm$BYkcCOONv8l{)Be6L;X1##SD0iRbhl{y(#*4BQ^NIe4+5Z zToey)ke3Yaajwc*fMQNZa?QF;o$rZ> z^P6b9VT8WMiJ&o;Qa4rhCueSCt7g4=zhgWhW+;H6Ag2Q2_E|(My@v_Myc*l-N)19y z<48UF#CS_#{7RGQCFVzS1u+MrTB*!zTn9LZxLZHwkz9Y6HgwQoMZ zO^G=nIWKg`$E;MZbAS7Nr9EMKDxb6%g<&{EYFvcUbcUM#GStDTcQxPgHs%P4P>-9_SHKlai|U%w)kyp;Vo8~EG!te&2gDqf`F zM2!z75kZ(oa&nTQmO{qKT&e^)BgPxqyD{f)UaHKRuFQ$Q!&bxbsJn)P4V94SF<(;( z$z^u%@5-iA%B0C2UlXdc9>7jZkDUvbC~M!r@l+MR6{&Q1=|NsZGm6#q{0`XIGi4vX z;A<|FfbZJ?ddzH#rq){ny#jtlD#ay1X1q3+>Es3VFffKmjcPsQ_acW=$Vjv9&O)9a ztd$pRO6Xh#P;g1!s-~i$V_;)_=5=GyZ_p%e7aqPsEPBc75-~godyP*l+u2S6AtSLU zgyrk8R7iqQ)90nPuBJe3~I!Ftb zn@RfM6!JnIE5=F;dZEn`YX|)V;grrz4A3Zen70yeLVYV>I&Et@(hFE$5-Uc+a==lc zA+Vy9DIAG596#=lofn(vw8xrAwU3sc4dc1qFKZNEmWpzFFEaa2EJ{1{m-#;2c)qHy z3a=@;#2yG6Xx33;dEQBk= zV=Vy1bMZ!)1Di@+O5Ri79aJBIs-z9Bg;lF@#Z;-MP_v48y3oaF_sZf$b$OH}ZigDh zG=zmjtOfifmNmH)wC96tlm^pf;4`g~PjyNn_ECyMhb9`R!{m@Una6{3?reC4NUCy` z*Lyt1ltHX}V&h2pH8>84&Ms{$$^>kvX(nJ%!W1_jbn(Hm*Khcg&*} z#4PJ)U1|(ph95_dl)?8-oGFO^`c)!M40$>QX*GGIC3bE;EU7rHU#Hlg z%1|WpKrJu9P&ebkJV42(Go7bzUZOu&iocdQSEc* zB$XGIX?~mwVsiT6IF23gt!x<^#|z~|q={wOs&MAHgZ<{Wi2aF$`)V7GCcZ@mB*|pp zxpgsth6riF0hnLt>OTvPtU54mgSn;Z1QrtA7vH4|dj~Fvco|*dV&4W-qy!GLmA`5g z^Ti|(=4)|9MgkY?lFE_=-A>o22@5)m{Eo#lX>QOSZpM-y{3)tk;(O-1?8acSp&&%c z?fbqJyw3rM@wa*S4P_mMjPQV^w^vcP>ZB)?cNz^5%$fywjP>M2M7(>&$s$Qp$ofIL-Mf5>eN0lSS3nq|S7UDsE=# zNFV~+iD8airNm1uC&|Yed|Isuo79gcneqXP(dS-I52PvbZBrBLYaJcel;)y1LrIFN z!cS>l*&Q78&i=O8c`Iu)La#^F$~mUHJFqR_P+&~BKV5{-Af&ya0B8gRhC#WsO?i#X zM(aRKtqc(z<9@rH*yAwfrHJit&gGC_Fw&=l5qIhwo3>Sa(T+NJV$~yL z#!cd_99lWOIVi0Er?syD$}3yeMS^Q^hv4q;;}+cAB{&3kcXtwkd$8aTg1fuB6Fj)P zyq}pl=S-5h@19rnc2U&cy?d?hr4;*H-5+;ubd0>Yq_hYGSvPrDzqY!c^iUXwmT;)h z>xLc4H3}C7_H>JcsSMgfA+<0l&7Gy8yO5Ck`?N@&$=R8iMckPqe%clif-iH%TEN$e zNxEe|eYWg48H2bNg*}GJ7=8qvOTjIuyA?575m`7rh*zC;LMDBp`?L9`v`#R=aRh!l z_B41kXDd#Elbf)d#JaY`wOr-mYF}vj1nVhDNH}@%TYdGA?Ql=6$-E}s$+ANty=A3T zK{vLo9v1aT+(gHP#6liJsIfWe!V#&&Fb?~`PA7KM@YXPAQo&k~+zvyY;_kGzCj~bz za$os-n$o*1FQoGJ0KOK7W5NP#B!_*J@nC(Kq~>P?9_NNtl_Xj}h7g4A-dhsHBWu}u z^30_RvZ(DTe2>Lr%empr>v69OYcHFfnFoTEK9W(0A{GcENu`{N7<7ho!m2^93|ASwITJ}|?OB!rEi;&M7Kj0d2&&?V&O*EcI5||&WB_^JwK4MwCEE*7;6`XqHkJ($!cx|0 zwK(qAlg6q?*ez`0If!=k{n85?F4YTrpETWCLmH_of!_pjSxmDibH@wMCr->BN}-ib zD4S)(KS~Il&z~GV9pWP|D^`C1L^_*3bZB8~N!ol^Cnf?h`C&9otQ zVkyy}2|SC1K=y2PuiO!}a>3+ao`9a%;z`pj@}0uhRWwhqO|a74VO8{kvu*F!K~>NB z{H8rW*TZQLCJ*hniuJY4mqq(keWkadTEds%JLjEwZSR~_TAuidoTXJ6cQWRe%6 zDj0(MT5GrG-VU&GC~9C&UwL-d9)+ZqzBsS*`mAfMjSSB7gatZA4DKLewCu;~9PY&< zL4NYeY+(gOMp#S6)vI>2R})2qspT5?2T`*PVQs6B$uuCbm3kit^PgQAEs5l;JBsJ_ zqqiHB3iy4NkPKf}>{hN9ZytW?$8Dt)ey-VG!{^=u0d}-yV_ji!2=x z^=w>|6?wnodJENNhtX94Ey(9riB!J>Ne-Q8FIR`m-U1j#3x9}hrDk3~@#|ADFA&??kXR}pQ92od@Ik4W=I6B{M7BCUuhvL50e-10waBr2#Pt;SR1 z@7^`rgsT~VkZ9w?BA13{py3?XxfX52gK! zJ%2dnNYHt%4<+=C>f`BC`Sgh-qGgidFx6&I=eee5v~Ilp!Ilb+LJjl+qX#hxL4EtE zDf`p|n)|sj1(H&YDN^<#kc2wH)Y_?8gTjTQeKZ?k~$gTjP2*!Mb9_5QcVQZsxJjvTpj2OfJxh zUXz+i4Fn4pkx3p717(WYu^b`OSs8Q+$YcRunX-$E`)BOjq`0?BS2OW&h+$wA?{_gD z7xzqZ?>A9k2dc*PyTGu+Alxr#=sXw9D2Jm{LsxU7n4`F8ZMtqjP9aCsBw~bA4p2d7 zxMJ#?iBEj}@hq5|wqf9oq>=CRdbBj&S!en{d9^Pg;LUll5}$<%tM5#r%&RF!Ms}lQ zw|C|kvjPK4mvHkGX40{W z1BoSerwB%$SvMx4JL9>vGHLL*)iJSm>wDr{<6BOfhrAja6q_1x-^pjEp~GV^%r^k; z?qMF>H~sx5)P%5UsdI;Bsd{TYec&+X&cF%lE z_q;2KsOI^bIvW-}<5s^bD zl~E4N{he?o=bQ|*99xdA+p zHGK$D8xN}S%)%maTPm*gGSSgYeaF&t>|Xx7^PRm3no09cU(+GbjxIn#FkxX!?jt5? zZ+G2*9Bhp$L8a)SB<~@Q%Z{Pku5a?b0Hff|E&9lSbMv7Ymhe!NQag7|P|$EhLjG80 z4~HUG2ln^nnIxRm4OGB@r!$Sp76l1udw~J1LgP{qGI4`i`J{(HlWbnO7ro#zg z4@oz91d@k`?ZSnGV${}?21diHhMY+x@n8$to1{^?ukQZnCTodnc`zNBbwTn2_Ni(U z9y9Ocnk)yKme0H95F%ZXnRwYoWYwA-WkU@Qz#r~>%o}&LI`P|Ku-aiXFLWLW32EQj~_MkoI zH3p08qan&RE7tW5l>e_o7%Bal2oNMYp%_UW8|$IfIGVI4ov?t$tULDzt1*Gda1ak9 zr#deZEIUH&pi3VnLKVWV@h53NvXHjWd3zlMw*Y z_9S-T=rV>+XbB)_3q#N%bnd5=T)_#x-YZK+3B4v!8;m7n**K>odi7(n)$cy>X|`bH z1N7>1O=;u(OqbaH3bDs=uG(r+P0jrpk_YM96K~_U*&Ue+43@ERrjr?oRkq%$b&?0t zjsge9PB5DQx{qe}Goft(y4je7%^KdH?{V6D)+&n1)=jDqlN9*G{rSjj5MfmN9#N^C zr|IIcsvE*$6u4Bm4uz z|8ji$zd0!XKST-riSYv?$mp1XvD}=%;9>wP=kFLlQ22L@|BuK2VEivH|M9Rq6ASRo ze~IzGApDa5SB(E}`2J7eKJd)^|A^)P8GZshUjNUK{y(AkzoGa4Ie!1&1NVPM!Ms5C ze_;5395VP%n9N^zzLoi(UOD^++5hX*{{M#Q|BmYa5t{fnRR3>BKmMOkeYU@&`fhIO zO0zRhVSWy>>6-0k#O##;)umO_)YDuR)t{M>J`+)%^Mu64`jN&SkOq>H0&)EeQ{*lf zinI_-Q*L<=?iKgNiL1tYTfnu4_fFPo`KoQ^am=wFzxWj=@c8~r*Qns7CZQ*HYuCCU zoL2~=DwI&@PrhIONLz+~AyvB^*1PLnosCkvcg$ z?#4TZih3-#4FjIYsM|5lZtV)n15g^{@cU0ER4#KZ2M+W!IygEy+Hu;?(Kek>p|`?B zb}6KNMTzXqj>hj#rj#Z_%|#|#QjS=3_zf2#bFl#?M=A3sXK9J8J|Z^*3{@y5I<^tc z_XA#G_hIu=CcQ%h+oTRXJHn%OBgsjPCS_*yN%t_d@%OQbLo}N@8JK`ku5zc9YPU=` zTV8wKXgBRNew(M@TTH!fUG(O=jpET8?UtZtEF6<)F>ng_qXJ!ruRY-SX^a6)tXF&! zN`N{}4lb@Y%KQVuxLzIYarpA|2Z6y(e&5h-Beco?Sjdl$U}X92&7n!2ii1BSv8R z$RloiL4H7&*3$ClhNkh1-=N)b=x!X_#|njJPAXFhk|Pf~#2LiWtUHjfvi+z-bkr4JqAWsrMt~uLE8YGaPx)@zVy|OO=x!4Q>bnjtbAaZ%+F2K*cJmXf zBfW9|=(T}YMB9E#JZ@<<$bH`w$w3P6h2MqMU7SFlg+yuJU_9LP7#1A5Gudq4*pJCX zaV}@=V=2dYfrQl`@heAi3%QGpu^MVi14df?zkETpEStyqXVWw-1TWZ4-`f(g3n+uG%U7h9F?~YLZYMq<+vxxC-KyDs5aUV!Rj{X|ej&%uz?L zhRB%X81d%Q!~WQGqvu`IN5Q>XJ`99cR~(`cc4&-)Y`AL1I}#4QV4(;G8-4@G=Ynf6 zGh|1XtCfKFoB~SXj#y`7o>;ItKG=5;%>1?Q_pfv$_CZGBZa9&yZ!#qxFn~z~kDfq3 z+J5i;evsq!Q1i+oe8aHEj7%Ma{Au@qvwu zEyb$dL*TOahz)H)C-L~JP5YP`-wEkmg}+>Y&R5<(5$h7@kH`Be3OFZiLP4NbzJmVL z->i~*Z&w%je(Rg|E>45bdsO$ZV}i(hyt$^sEE_er%ywPCr3zsGnh7?9*0~#RF6u4H z!?^clN0ij^s;}wV;%2Y+4*%V&%7(FGU*T$@hp-9l6XHj$yourWD0hmpoTYi&hI)FV z5#0Sgcw?=QMDSUKA1wGeu+k1lbP)PT6uFY6Ys%!SQq-N~^j9cxW#tL&J8(YIikWp< zOCjUZ30GN{-Pvt=cJ>Q`em=b4+CHQt6_Hn!eKq%qd>BOHQM}KwOlv$5FIFLmLCt8Z zM+#MtSe$Oyj`W+69#pM3$K^qDd09=*@%Csgkqk!SeRf{Rz%m&IzNHJHs8Z3Z{F+j<9vWEQ9McH z8$S24vVp>2sb}L{K0UZmdh^#p-bHN84Vq3KlQC%f z!UvLz=be2VkLA4Ai~a<9&hc$9&@w=LU81qccEUIyTSBbk_BmpZ8~X6xex967r|}Tc zAWl%RtXZtXs4n(KNb60dmw-)I+^l%|RElOTi(2+hdOd5bb*EOE&`nV>yc*`02xS3? zP4{G`$u#pJkWI+dEGus-u@+eL$S#*{WfNavT~{H=laaZMN@;HbO@-i8$%xB~u%&>~ zw){fltitz}l#cE^E$sF?j-vNZ^q?JO1~#Y2sA8z*uofU$kmrVyR)tPvoFyWzag~EjCa@G2vgBU1K_5pKXRh0cm$V?#~GaeicNm)ZC9daVt zzgrkcrA_FLDl6ut-8_)RiZ;eC8K9}BUc%&y@{YR7rE~s-ulCkCtgyRnO=9BhBlqE& zGfoZ1IsnKl=x(v@k~~*N*b5%w4gzgy%p+w z4Ei|Ra3MC6h!J6k#)T-MzUuLBq;$e2>Miv1&7eW#d%)RLCt*+zt?QC@>Ay*&`-z5; zH4A?O3$kAg-U`Y~QIsD5pH_7+WqO>VXHqC;8np1whPtDfO)wi_02O^#Gmm4wpkm+p zme~WC79ETSl~I%Wj)?GSsFcfuk?RLtX!57phtJ2*-K7qVCuE-Y4h_0rya1fUVajxn zM)_YoGZEAyNluV>J)E{0jjz>n))km;Hc0(Tg?0tqGwy1|5e zDMh%ipxCJsOhlCAj)_nnYf_Isun0G>>3;E!B(2&;^slgqXjuCBu?__+>KOgUcqxtj z4+NH36Q)%Qz4skx2Q$=!3j*fMK5158OVnkWeR-;#CA8vcL^V3`<ZZ0HXxnxaK^Aq2S=Je6^>QEa34gVJQiThsm&CtJs3{s!^72%o;8C}Q+jkkfpN zN^y?5?57;Mg~O%Ce~!(W5tCFz&%SNi1e@jgENlv5B5Da83GR!HLrn#+j3FQ{f2 zL|iUkOsxpJA~GE6OICE&VGp^W;yme_fhd<7XhvD`DOm(rOtXwmrGRZ9RfzhtAJ(Sv z5h_{uWK|GKiU>Mu=1z)z#5qXv8?^l1+I*xX0xl%X49qcV0||}P>Te@$hFRW;_Esj- z{02(po#<&}_)OR>zS>8Z*reY4K0D`S%x=nsS)_w$+GItbO~LQQ4ukM1W(c51!otu3 z0}DJ~&BTSC8(|v}9v7P(t^;PcQZ(s5uskzuKnQ3AC{JT~Jh+g{W^+iUj^*%39)}}B zpEAIfGV>1W9iyboo{40@ljpILM|4l8tct&X4H`iqTbHmgCbVpq4xRk!C>T@6TFcJ6 z-sI!JrHhsEb)+L{vmhK>d5}mm5-&$RFdU3*qFaQgt5+Z4GP)T5Q3x%&uuP@ycGCV{ zg%{?Q!(O^+gF4@Yktlz0qKRB}Ln-O)WP@X1T)B#$P{RS*%o|Xr^rJ1P^L3*}Y;%(t zY(I$DWem4mkW!-03yP(Y+iw!a&z_uE@1NfHwTx}>jK7(Ci-y@Q(phG9YK$mPooAm+ zNg#n$CkonPs7|t<2bNZ|HxyvZn3w-4z*?z7Y9YT8EsuN%XT# z7z`qrqeyDt4G1N}F1NVs!DFIAsvM({NN?%KqHcuNL=`?JrpgaKU~!8?70!*7+<@=;G1SKef%NHa z4W%pkblk8m(9mmX+zUb*)QQTtm_ni{;_jMW6{@Q+3fZ*NC%Sxth@X|P*{>s^hK_%S z2J7^0dsolw2Rhi!Bo5!f&St?=;w#(0L2Wt&UAf~%ni)KbMuZnjqc=+z zhf75#WTY^=*`v1-50jVYZfU5fSgE;odY5NSRj>+bstZOs^ZrOafoKS_U>`JIOztlq zl6A!~Qa$kvtX-2{uNNpj3MgpQXpL;=5mlK~_GoSUJl340m}d}o#z_nqqf5!2hzWy~ z$*Te70X3C^+M};^(g6juGfBw3KmX7^EhA$p`!VqkSXTu=62fW`KPRyo}&rRWXu- zYzf3G7(yAu)WbBVzPK-YJivO))W*uv=BtbUWR`{wjXB8&djo=kx3}s}kg=;ZJH0oS zT;bYkx9mtWng?DK5TZBWJBms>@)iMw9Y%dOPpiM#GVYpF8gKFp?`_P-xn@;+&cl)xWeUM>0XmS?)Wl104 z*OX66ZZ)3epVz|nUJLLYt2vBR9z}I{ITr5BbAn=2OWaezyba?g9(8jUGdke!3c-Y_ zexsVAyO!B2W!xZIDJuu}#=cG4R-N&KfJ0M5o0D<(Is#NU;Tb zhR)Dqph8tTZ_ZUFk-AZa9u9MR8Z-EdJ-dng}}*Zm2o$I#X4ATy!!GVD`Iw)r?L zHcuvE4??ltJj-jAyk}ZQ(Why??n_$SsJs^2Y48z33byBNS^V;iQItr*OknU)r<=8M z{(@bHYHeC3n#w?^O61M+mr%!N*oMgRwOkXEe9~DXw(6-VR)FaY=_Kl!hJ;!|oY144 zY^_|TP=C3@a-zJq;}6q~qw^|QW5o|4c%k7UCKJugJX{NS$FD&Y;XW*BvToo5AB#a=&+K*pVdbZ6V~Q83f>^8W$7m#~-seyIGYZ zc!t6fz+eA@;KB0w>=BC(uy^3j?QozO5jt`>_-ao16aAnemq&6+~oV94cb()McqY10Y8rf`cC&QM+hG z+70pD%&O@8v_sZVv8n8gK3)*xE+GN9?6iSD;H8nDGxk zzZFmW98&G4BG1j#RlUKOj$`g)P@R!$JXseY3*(Y>>4@ge)H>uO)qsyQv!zk(MS4K$ zyQ2M`d3qL6*%{2ff;_<_kW^@cCh?XjihNS`22>(wn+qmNcu+uV8b(03L{f)BfGMy? zEAK*K94T)ujMd9u!33(A2TP)@P>jLm0!H>6W^G3|(gGetpNP$8ncxgGdkPA6!^m%_ zIrs3k*(iXFLD^RlI!dplE7PRe$I^!&*r&v>LqMvWWse$L9D=h**$p-&sAY$k{y{-Q z#b^fY9BrB!YWSN|b>2=ABS%n|h*jZdL$5{(7tlRn8^y_Zm7w@G$x)*%GSl!MVyr^z zkqa4%&1jI)j*K5PMN319DP|fMP7B7Yi-Ij(XP7Lj)98$$u?CI|#^T z3+0OsM}F)Au~*s!=QuRz-r9o{%&S^ifbT1hDHp_j#cFSKvBK47;)OVG$&m@WLz-7W zK{{IiJSsd@{Vku36b9M;mT+~Pp(xF*^(~!ILMye zTrzsE3qyGMYv)vHE*+RvUR9eZ(DaacVU^fe6ntd5-E0DfC8cLp-PMPV8>PLtRgIGz z-K$mwZjRc87`<$(jOaszh~d6SsV}duk|ePLM0r8n1(>hal?=>0E+RH;xHKp-zkZiU zF{#B9myF^2=H+xi?5hiA=6v1gqcKOg5X+YKu6V7iHDMy&oqr?Y0Q3g^LE*}HBR;>F zPRB)T_m#F^AwWZ!MtW;0ZS0U-S3M|OZl2c+YUimi;qE9~uJz~vqAd|54gc|=xw0?L zoK4Vbg6GIoH>y%5b>CS75K!B;f16QwuXs%^YICkX!DTKi0%7Y2n+|IxkU}k!l7)s5 z?i-1w8j3fq62144IJF@ybG7gQv^h775nTmyYMYhxWDk`lPsO){zIK*1wDdc9`}jv! zEq4*W4<1GR`Z%nY33HNy;2JcAeJBxUO3XJuB(OD-6^-B2`k4hfXs5fOb8;HkMVF|n ze;j6rVk4heCd~{j8YvXt9Vm=TF~1x65Lz{fe_Md&Z*3g0^ub2Oo@DY|IRs4~f|yF2 zq-yZYf`(R9jI6bO*^D(+a=5#D*(tI^m}ak+?y{tn$EfrBsYaSR+WDvyW4<@S>w>ts zA8yv3Y}po7nu|`Oy+ZVPblSVRWUYP@ zQP9QmZfqCKOh(+yr3m(_=y?OwE%^!(=I~VoXyZsW?luNaG$m>{F(^_gUR(8YcXLnp zSHG5ojVu^tiG4%-LgUE3(i*iX#6VW-rOh~JBGFhhstDCm3KwQC`E|S7oo1Lv<&$m#!KPD z8+=*Aqht4Z#t_8YvYQI8cl_8(ui2(F)E37Rwn9~@t2NQ}O2@(Ih~SjTwy%0d&Uqu* zBs%M~z>AM4)UQx+Q+8_~1%-7TBV+W?h{@r+B)N&@Zk$3g`>{Yx+XRf&cKU7!#KAZM z0$b`2;!BN9TViba+>VzX~m^ zdMH5-4&naIB8Y|#@xY1P9XO_;sIM+IOHWZG*qOd_y6%(TV@x<$KfV2iYbwo~`~J9U z%|&ir8P+pC&L;Be0~OMHw=WVN;0~TJ|$C|j5*Bg zkUYVt7tv_h?It(-Id@Ii=MlONBKSO5QM1Y-u%;7Hb8Cf9Vb#le1ygq?F(@zs#o$JQ zYW?Ei@k+>g^>M>$7R1frCR=Hi?J8 z23jd{A|=v^i!a%cA$luTzyKfH2iHrH6XYdyM0^f>zFn<|d{w!X*8m0jwE4#7*L&R3H~DzWwHwX8gx}9tw#f^0z=>-&Wmz{dm41!edqI`f`< zM^|14{)B`d5$@hq>7;KGclt3=_H3Cj-MveL4Ta?ueJn}uefcs0^lClBVV{`(#YMBx z*AN7yMUG%-;aC#y}L};wtUg*eO3Z4VE@Yf6H}rilN{V zD__n>k;e-%_>td@l&}4FME@nr-+u$>|4;c5|4M%c%pMO6+Xv==Wdx=HaV`2F_4zA|rsARm- zl1DH~ z0$cEvaP}9LP}rMcj$UKOmBFU8Oc>gu_N_vm>Oyulf%fBQRW zIR=c)2n?ID5qg@DD1LSEQRA^u+0QEw{R&bQDlXl7wVrq_p2%xh@H zGEx)uNA2Mxn9-hdix(X$-Z{UJ*Z+rd*2lzYl_hyq(@o2k7|zN|?P z?Y;$-`I!wM4oL^HHgN^@N69(yVrMnhQX(|lr~Lj~>}tWXmR=(LO5_=KQz?FEN%$rq zK}MK#!u(7&m7;5B@6P)z5(zS}xncY6vSiEH60ruqyxnyoUo4(CoZQXqFIT#PuN7@= zZtumNU>lc8!8&x&UtE6W8Y27M$d5-S+EsT!^AmIii5~W-tL>%aPItsZF(Kj-L~Va- zu8w;DtRx2o7p!v`mCnf#MiCK-UJ^tfxbfo-|KWrCh2h>!Q1%F_Z`!F@p=Z)lOQs#V ztgP!N=^cmYjz?*j!7o#(d2Jw$^kLWXl(TAJ;>!LLuw50E_Q`2ba2?a;@nnfQg(aNR-jJv((EM9|Ze(@Ua3goMh=IYWS z)J~VR!r?4^bo9LK76g&#Y7En^2jd&i5jWNdhk0$&SMdVI=*fX*+Z)PdJi|sSdA;|i zWF1s%nL4N&t6rXJLqu&vf|=rNWW0yZqlu91A<-bqi=;n2Nbg?)k^%eDMe zVYd-|XaoHO(iiYmUaJ&tDj`%pNNfLUbE6*EbFoYRO6Qkt9ycLXOkLwAK z+88NWygKo%7|KQgsQF2>LvCD}8$$&CAp?HgAT*_6<}bsl=!{?iQrq3n@X*ur-Aimx zU)kf?jS&v>qfJG_1vuU0<(2Vj+^pE36QHS3)B0>!Y$1yopaKDo8=d9nOm3ig7o#GrdEgH+50O2tkUk&9a0+;`qF)H4A$&o2#{qs$L(I zz=q5oi)%uCa5XO77|g1U*jJK>n&Uy*^kSx&sYbuWANd4r&(-x4QxMyZsB-BXYam%Y z>(w3zZLi=lK4jN{JZ8{n8PbE>f6WpECIYR$Ub9Z>!z2=_h6$Cps`&~jVwqcidOXVn zc5PcsD1zO?Ifh|!c(L!91um?^)=t0?w=!Z?w|lMg0FBmd{5U z$mX{Md3q7dyM?AGDJKVkwu5iiIKC)M(IJ!~Wn&6ZYaFpcX%ap_?>q;r0%n{c@JJeq z7a*qJM+yI!WT(8X)+~R$+wMnaHnG5FoTrWIIpV2$UU(t4#tZ_-$Qj9=$0nj>;6@Cs z;BJiO5b|{7h;r|a)ylkg;Ba%`4RdTO@rrj}<3OX`X{$a`uqj5|;@QcDasiY38bQ0~ zP#B;SPoGM70+vNSw*u!oyK~yH+OAT&Hn|2nPiBn)eOkt<`&NAzso0Y%3qqqCn-Zp3 z71n1vn308+y>YywSJR>0`R#Sp5m!v}LHNkg>_|6WrFlu4f*EzSy5C4y760pm@ka%B zyYquSoupd{6py5lfH)3x^t?Q-0ML_2lT3cDS86eBwNx%qlUuMUOH0ae!}*IgJen(? zf}A2kFmmY3y6+4*)vVKY{p5UPBy?+W{bG#<2aqhdA){IO>bk{jI#SbgJ*uG5{AQWQ zm2hWc557w(RDSlf&aT^-x)~>w)y;>b&)6gQ*3F&Y2u&EtvU|(uXUM8P1Zh<*P&^C9 z#yFM2W%*{!zAlJ=PuB15JGU1FjxW+HE5SkixK)BzM&HU>3N;iMxRm9SnldKR)$}Gs zXh6$xKH(^lns9?)G>Uce>TbBq_^Ph4Oj#WZv(%U8P@(uqmx1%Jj5S{JMd=;0gD4iM zN)+S7>*$08B=&r{%GjP;yTwZBDP2}7-h=EFSo{!iotZT!#LqjBRj)_hCK2^^hFu$#%Rd=1|(g;L@rcq7JzQbk%Rr<^Xr`o3|Wd%C~4ANNXfV_)azq z2Ee4ewOg-12hUU&=e+92N;jLcE3_gaekp&tFVg7m>(TBP$LRJpyG|-6i4ZXd!X}>E z;4@ib<>f{<@SLI2-Y`Pr#E&l@T8w-~iADNEo~Nm*Ag_}>E#AeI11Xm?UkdjHalctp zARHamP9=`V8G?H(!j|7ies*mrI`!SBNEj`MX~}qX>@hL62hsFZ-^N(2o0;O>YejK; zmDL0PVrAcNUk?y*E5LGc+S0OXIat}NA0&Q?O;5*$ z8Sal_^m4fj!4bfHEel!R(>X^>3na5TFM%p5m-9`$wz4GToJtMX73w$R)2!KTzOb=L zkC1twI{KlWBR5&4X)@~rp;RF>xT`IlaAD=10~YIUxMo`i$2Sc}p+uJ{#*ZC>jy1#E zAT)@9S}4wAbG_*M>I*)*Q_q`k;TCuwL(VG%M+Ird5iceh{7R6@(+{4WaPkJf6$?0} z6~1=cAFFSd8#x)Lb`3zSnjI8)L(ZXj0rkz@T)}CvEwgv+Q!(HMKV1x$+q)F_ceETs zbXHB?nGN&_j+w*4E4)DHwuJ|v~s_Nufu;FK0<&xr-h?KQqPbIhmDcHL~F}qQ- zsCT^GG-c+MW&#pEoc#jU7|Y#9jtnBoa<-!W)I zw=zjur!I2X7cb=pZ3ea=dg)Jh^F&nteXo(fZQf<|dGE{*6>jk+L`X$nUT&uL+jN6= z+xKm#!#85ku?K{N-uK<

zh;`910fKG`rAz8hUdzE155hHzR>8cTX%iHqq8_cN(b z(K?*#5rMe3P6z?ZbBFV-Z4ejQBjcjuenM6WB}phdpTZ(QlNpY%++4q(BNaYNR|I6% zA9sl`@n^gPm{-f8SZ0x^;<+VwjOZQ7@j?lq~vhGkotfcWmfx)JZp$W%+)w zux)9_zUvzfH8poTfbU$qKpZw{0;DS*sRXx`usUwb9PxHO4B$&Mw5Z0R0oD^AZO?XJ z;b7r*uuv5G)v%=eu~;hU969y-HHWQ)k8D0O!qX!pmbb$WZ zBAe+Li|3~D*We*tu_&r{r{;ECW17PGtC4n4?4sbZ#x=GEl5Gc|URgaVN)C>A+YbES z+LF!uVK6Jk^zYvE&MNO8LvHFp!mW7QS&*lY0l0XDs0pM+cUwiVb81ntkiT+tpi}`9 z1yd@!(U{_suI`eKp0_#8R<)?nYYlaUa(FD!t7%m~ zT6-t=g_K!Ez9(+Ps4^nGJ!(;66Y#-Rl%g;LwX)h8Y+0&>VI2;33U4Q*uY72PT34~| zw|?1(7VBHt8-(~V=E5=$Ci+=j)i5#loJ%RKS4;#lJ{Nd9b`&(YbmkQq0m5>x=)azi zHT9Mbz<;o>3MvSs=m;ynE2XzZ!|Tbqej8q6J6dJ!4Ci8wN8RWjK9_8F$&rehK0Gr% zSZRxvpEPV=qV_SPsa4~>%47J3EvWQfWQOy`W|c~^Ylq!jxJBa8a;s6PWI+#R{&&H$ z?$n|Yz;Wcc?bQ4``+);krM&Gd6|2elC};4*W}HewDJBHDPMNpM-``qMA&BtQSZlci zlsFuLm|5{U0m_&gC=G3iK?l~PM-o&-bFhkwyInZe$}ZXEWs&&!I3(1FwZ&JX&-tF! zRx+bg&{YrIL}5<}YZopM@t#~EUTa*>uS6g7MY3oRc(Jk#xPC+I3{s3Q(U%G!=<}6M z(D@i_k376AZR6q!IzvmaTMDO(xF$I~&}A1lxDsgMbIZ|TWi+m2hGvdLXl-|PqOsZE z#XLF^{G8@XQ+Wf=uNfmY^B#Ei+9YTy%YmbdxLG3VhxuhNPe$l5bPY$$o&S1=Ftncn8wQ`kl6nD=pVY7Ox7``agM5P_vUf`|noAx-dUqfqi!z%!k z4TgP=NK)J^PDH^r4dwwfWDMJ%r9m~bywnt^8I;TdeU&wq*f>7)UarPmuHL6U(GrKQ}O{u7D z-;Z}-IrxOb&kwv}L}&>KwXoa`i_u*TMGLR&I7J+KupD7hIIu-a>=g=%$FeveFj%KcGdX(yV@TFc7Ok{_AhF?|8N?p%Siu=(13{v@SjKs9)4Hg z=O(xTTRM|Jm=qj{fcz4?#BUX)MTuV&T)AAWY^{I{dql2QmevkjuDld~6yXBi zzla$qi2hJvqN^uX_S4Cd+#O!SNl|1$Iv0rbMVW^Q9m^kP`wz{bgumzemk zT5SJj{ikYxFM##10GkKA;{p=!8aWvn+w)S0$x9Q7nb|lv{#h*%6C*t%Gd&Xp!(R>i zU+e)p^Pk-Yj=*1j^8j_YWPr?LCT_yORGoaxjLfWbjLdY59LmfrT&$d2%*>iR48JG= z2MSo~?H|cK|CdsKQ~Fye8+&Eo$nlxl+nAUTIRnW!UOJ44o|%Q7@lRua6#GkyhvB6w z|JKz1vhn)1GBW@7=3804OsE$1}O+>^}N0^N0aBBPjTIfG-`*fvH*f{+Q5$mX3ekSem~~EiOxaYg1kd z;3*7a6MZL3M+!a_>p!%O{_HzTbG|=s{wT-rpSu2`Xa5iZ7YwkI8UDQ-`Cy6uKVAR- zD*DeJ1WfMBOX2de!~B-;_isU8|5{a)|HGo90)D1{nbE*Lf0@&i!dx$FfsvV!gPDbu z6Sxc*87Y82KsDfU`Cl~tn!c3(G{LF(`2Na9>}qdp0%RUy=Y)NkS$|$c>}+g6USboX zKV_`UoG%R0FBg&ZUorqQ8vw`#^plJgNOJU>jERvAh@JeT$H@3X0rZQEg`M$N8?0>X zK+3M4_1M{2fMJn8%UD@CIDs5*FW0~QW8+|cA!z+c#>xuZVt}qA?9jjH0k@$S>f2w- z{-(zSU}pcly-fe$9{}*HU0~VY`WZNqY`^vk(BVR z$MV86{F7Z^*%y}LpJl*JiYh#K`iSFDz`o`^OGUdHqX$Y``V`s|_{|zzc`gPj-ReDiDVKSq9uA zes2dW;P-a0vHmtES=kxce_claCYHbNVUG5|fA)>-VR?9n7?jN2je+|v5rd+Q4Uh)< z1tBG3kgztfAp#B{kVKk6LYPR4M^KoVlaWyvAR@>p2w)Q7

BS5oQq)

ER0&p@h h@%`@_Ixhs%4vzZvj(=?S0A>IS6D%2-h@2?w{{aKGPv!ss literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.txt new file mode 100644 index 00000000..7e87b34a --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-sbctl.8.txt @@ -0,0 +1,977 @@ +ovn-sbctl(8) OVN Manual ovn-sbctl(8) + +NAME + ovn-sbctl - Open Virtual Network southbound db management utility + +SYNOPSIS + ovn-sbctl [options] command [arg...] + +DESCRIPTION + The ovn-sbctl program configures the OVN_Southbound database by providā€ + ing a high-level interface to its configuration database. See ovn-sb(5) + for comprehensive documentation of the database schema. + + ovn-sbctl connects to an ovsdb-server process that maintains an + OVN_Southbound configuration database. Using this connection, it + queries and possibly applies changes to the database, depending on the + supplied commands. + + ovn-sbctl can perform any number of commands in a single run, impleā€ + mented as a single atomic transaction against the database. + + The ovn-sbctl command line begins with global options (see OPTIONS beā€ + low for details). The global options are followed by one or more comā€ + mands. Each command should begin with -- by itself as a command-line + argument, to separate it from the following commands. (The -- before + the first command is optional.) The command itself starts with command- + specific options, if any, followed by the command name and any arguā€ + ments. + +DAEMON MODE + When it is invoked in the most ordinary way, ovn-sbctl connects to an + OVSDB server that hosts the southbound database, retrieves a partial + copy of the database that is complete enough to do its work, sends a + transaction request to the server, and receives and processes the + serverā€™s reply. In common interactive use, this is fine, but if the + database is large, the step in which ovn-sbctl retrieves a partial copy + of the database can take a long time, which yields poor performance + overall. + + To improve performance in such a case, ovn-sbctl offers a "daemon + mode," in which the user first starts ovn-sbctl running in the backā€ + ground and afterward uses the daemon to execute operations. Over sevā€ + eral ovn-sbctl command invocations, this performs better overall beā€ + cause it retrieves a copy of the database only once at the beginning, + not once per program run. + + Use the --detach option to start an ovn-sbctl daemon. With this option, + ovn-sbctl prints the name of a control socket to stdout. The client + should save this name in environment variable OVN_SB_DAEMON. Under the + Bourne shell this might be done like this: + + export OVN_SB_DAEMON=$(ovn-sbctl --pidfile --detach) + + + When OVN_SB_DAEMON is set, ovn-sbctl automatically and transparently + uses the daemon to execute its commands. + + When the daemon is no longer needed, kill it and unset the environment + variable, e.g.: + + kill $(cat $OVN_RUNDIR/ovn-sbctl.pid) + unset OVN_SB_DAEMON + + + When using daemon mode, an alternative to the OVN_SB_DAEMON environment + variable is to specify a path for the Unix socket. When starting the + ovn-sbctl daemon, specify the -u option with a full path to the locaā€ + tion of the socket file. Here is an exmple: + + ovn-sbctl --detach -u /tmp/mysock.ctl + + + Then to connect to the running daemon, use the -u option with the full + path to the socket created when the daemon was started: + + ovn-sbctl -u /tmp/mysock.ctl show + + + Daemon Commands + + Daemon mode is internally implemented using the same mechanism used by + ovn-appctl. One may also use ovn-appctl directly with the following + commands: + + run [options] command [arg...] [-- [options] command [arg...] + ...] + Instructs the daemon process to run one or more ovn-sbctl + commands described above and reply with the results of + running these commands. Accepts the --no-wait, --wait, + --timeout, --dry-run, --oneline, and the options deā€ + scribed under Table Formatting Options in addition to the + the command-specific options. + + exit Causes ovn-sbctl to gracefully terminate. + +OPTIONS + The options listed below affect the behavior of ovn-sbctl as a whole. + Some individual commands also accept their own options, which are given + just before the command name. If the first command on the command line + has options, then those options must be separated from the global opā€ + tions by --. + + ovn-sbctl also accepts options from the OVN_SBCTL_OPTIONS environment + variable, in the same format as on the command line. Options from the + command line override those in the environment. + + --db database + The OVSDB database remote to contact. If the OVN_SB_DB + environment variable is set, its value is used as the deā€ + fault. Otherwise, the default is unix:/ovnsb_db.sock, but + this default is unlikely to be useful outside of single- + machine OVN test environments. + + --leader-only + --no-leader-only + By default, or with --leader-only, when the database server + is a clustered database, ovn-sbctl will avoid servers other + than the cluster leader. This ensures that any data that + ovn-sbctl reads and reports is up-to-date. With + --no-leader-only, ovn-sbctl will use any server in the + cluster, which means that for read-only transactions it can + report and act on stale data (transactions that modify the + database are always serialized even with --no-leader-only). + Refer to Understanding Cluster Consistency in ovsdb(7) for + more information. + + --shuffle-remotes + --no-shuffle-remotes + By default, or with --shuffle-remotes, when there are mulā€ + tiple remotes specified in the OVSDB connection string + specified by --db or the OVN_SB_DB environment variable, + the order of the remotes will be shuffled before the client + tries to connect. The remotes will be shuffled only once to + a new order before the first connection attempt. The folā€ + lowing retries, if any, will follow the same new order. The + default behavior is to make sure clients of a clustered + database can distribute evenly to all members of the clusā€ + ter. With --no-shuffle-remotes, ovn-sbctl will use the + original order specified in the connection string to conā€ + nect. This allows user to specify the preferred order, + which is particularly useful for testing. + + --no-syslog + By default, ovn-sbctl logs its arguments and the details of + any changes that it makes to the system log. This option + disables this logging. + + This option is equivalent to --verbose=sbctl:syslog:warn. + + --oneline + Modifies the output format so that the output for each comā€ + mand is printed on a single line. New-line characters that + would otherwise separate lines are printed as \fB\\n\fR, + and any instances of \fB\\\fR that would otherwise appear + in the output are doubled. Prints a blank line for each + command that has no output. This option does not affect the + formatting of output from the list or find commands; see + Table Formatting Options below. + + --dry-run + Prevents ovn-sbctl from actually modifying the database. + + -t secs + --timeout=secs + By default, or with a secs of 0, ovn-sbctl waits forever + for a response from the database. This option limits runā€ + time to approximately secs seconds. If the timeout expires, + ovn-sbctl will exit with a SIGALRM signal. (A timeout would + normally happen only if the database cannot be contacted, + or if the system is overloaded.) + + Daemon Options + --pidfile[=pidfile] + Causes a file (by default, program.pid) to be created indicating + the PID of the running process. If the pidfile argument is not + specified, or if it does not begin with /, then it is created in + . + + If --pidfile is not specified, no pidfile is created. + + --overwrite-pidfile + By default, when --pidfile is specified and the specified pidā€ + file already exists and is locked by a running process, the daeā€ + mon refuses to start. Specify --overwrite-pidfile to cause it to + instead overwrite the pidfile. + + When --pidfile is not specified, this option has no effect. + + --detach + Runs this program as a background process. The process forks, + and in the child it starts a new session, closes the standard + file descriptors (which has the side effect of disabling logging + to the console), and changes its current directory to the root + (unless --no-chdir is specified). After the child completes its + initialization, the parent exits. + + --monitor + Creates an additional process to monitor this program. If it + dies due to a signal that indicates a programming error (SIGAā€ā€ + BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, + or SIGXFSZ) then the monitor process starts a new copy of it. If + the daemon dies or exits for another reason, the monitor process + exits. + + This option is normally used with --detach, but it also funcā€ + tions without it. + + --no-chdir + By default, when --detach is specified, the daemon changes its + current working directory to the root directory after it deā€ + taches. Otherwise, invoking the daemon from a carelessly chosen + directory would prevent the administrator from unmounting the + file system that holds that directory. + + Specifying --no-chdir suppresses this behavior, preventing the + daemon from changing its current working directory. This may be + useful for collecting core files, since it is common behavior to + write core dumps into the current working directory and the root + directory is not a good directory to use. + + This option has no effect when --detach is not specified. + + --no-self-confinement + By default this daemon will try to self-confine itself to work + with files under well-known directories determined at build + time. It is better to stick with this default behavior and not + to use this flag unless some other Access Control is used to + confine daemon. Note that in contrast to other access control + implementations that are typically enforced from kernel-space + (e.g. DAC or MAC), self-confinement is imposed from the user- + space daemon itself and hence should not be considered as a full + confinement strategy, but instead should be viewed as an addiā€ + tional layer of security. + + --user=user:group + Causes this program to run as a different user specified in + user:group, thus dropping most of the root privileges. Short + forms user and :group are also allowed, with current user or + group assumed, respectively. Only daemons started by the root + user accepts this argument. + + On Linux, daemons will be granted CAP_IPC_LOCK and + CAP_NET_BIND_SERVICES before dropping root privileges. Daemons + that interact with a datapath, such as ovs-vswitchd, will be + granted three additional capabilities, namely CAP_NET_ADMIN, + CAP_NET_BROADCAST and CAP_NET_RAW. The capability change will + apply even if the new user is root. + + On Windows, this option is not currently supported. For security + reasons, specifying this option will cause the daemon process + not to start. + + Logging options + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + + Table Formatting Options + These options control the format of output from the list and find comā€ + mands. + + -f format + --format=format + Sets the type of table formatting. The following types of + format are available: + + table 2-D text tables with aligned columns. + + list (default) + A list with one column per line and rows separated + by a blank line. + + html HTML tables. + + csv Comma-separated values as defined in RFC 4180. + + json JSON format as defined in RFC 4627. The output is a + sequence of JSON objects, each of which corresponds + to one table. Each JSON object has the following + members with the noted values: + + caption + The tableā€™s caption. This member is omitted + if the table has no caption. + + headings + An array with one element per table column. + Each array element is a string giving the + corresponding columnā€™s heading. + + data An array with one element per table row. Each + element is also an array with one element per + table column. The elements of this second- + level array are the cells that constitute the + table. Cells that represent OVSDB data or + data types are expressed in the format deā€ + scribed in the OVSDB specification; other + cells are simply expressed as text strings. + + -d format + --data=format + Sets the formatting for cells within output tables unless + the table format is set to json, in which case json formatā€ + ting is always used when formatting cells. The following + types of format are available: + + string (default) + The simple format described in the Database Values + section of ovs-vsctl(8). + + bare The simple format with punctuation stripped off: [] + and {} are omitted around sets, maps, and empty + columns, items within sets and maps are space-sepaā€ + rated, and strings are never quoted. This format may + be easier for scripts to parse. + + json The RFC 4627 JSON format as described above. + + --no-headings + This option suppresses the heading row that otherwise apā€ + pears in the first row of table output. + + --pretty + By default, JSON in output is printed as compactly as posā€ + sible. This option causes JSON in output to be printed in a + more readable fashion. Members of objects and elements of + arrays are printed one per line, with indentation. + + This option does not affect JSON in tables, which is always + printed compactly. + + --bare + Equivalent to --format=list --data=bare --no-headings. + + PKI Options + PKI configuration is required to use SSL for the connection to the + database. + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + --bootstrap-ca-cert=cacert.pem + When cacert.pem exists, this option has the same effect + as -C or --ca-cert. If it does not exist, then the exeā€ + cutable will attempt to obtain the CA certificate from + the SSL peer on its first SSL connection and save it to + the named PEM file. If it is successful, it will immediā€ + ately drop the connection and reconnect, and from then on + all SSL connections must be authenticated by a certifiā€ + cate signed by the CA certificate thus obtained. + + This option exposes the SSL connection to a man-in-the- + middle attack obtaining the initial CA certificate, but + it may be useful for bootstrapping. + + This option is only useful if the SSL peer sends its CA + certificate as part of the SSL certificate chain. The SSL + protocol does not require the server to send the CA cerā€ + tificate. + + This option is mutually exclusive with -C and --ca-cert. + + Other Options + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +COMMANDS + The following sections describe the commands that ovn-sbctl supports. + + OVN_Southbound Commands + These commands work with an OVN_Southbound database as a whole. + + init Initializes the database, if it is empty. If the database + has already been initialized, this command has no effect. + + show Prints a brief overview of the database contents. + + Chassis Commands + These commands manipulate OVN_Southbound chassis. + + [--may-exist] chassis-add chassis encap-type encap-ip + Creates a new chassis named chassis. encap-type is a + comma-separated list of tunnel types. The chassis will + have one encap entry for each specified tunnel type with + encap-ip as the destination IP for each. + + Without --may-exist, attempting to create a chassis that + exists is an error. With --may-exist, this command does + nothing if chassis already exists. + + [--if-exists] chassis-del chassis + Deletes chassis and its encaps and gateway_ports. + + Without --if-exists, attempting to delete a chassis that + does not exist is an error. With --if-exists attempting + to delete a chassis that does not exist has no effect. + + Port Binding Commands + These commands manipulate OVN_Southbound port bindings. + + [--may-exist] lsp-bind logical-port chassis + Binds the logical port named logical-port to chassis. + + Without --may-exist, attempting to bind a logical port + that has already been bound is an error. With --may-exā€ā€ + ist, this command does nothing if logical-port has alā€ + ready been bound to a chassis. + + [--if-exists] lsp-unbind logical-port + Removes the binding of logical-port. + + Without --if-exists, attempting to unbind a logical port + that is not bound is an error. With --if-exists, attemptā€ + ing to unbind logical port that is not bound has no efā€ + fect. + + Logical Flow Commands + [--uuid] [--ovs[=remote]] [--stats] [--vflows] lflow-list [logical- + datapath] [lflow...] + List logical flows. If logical-datapath is specified, only list + flows for that logical datapath. The logical-datapath may be + given as a UUID or as a datapath name (reporting an error if + multiple datapaths have the same name). + + If at least one lflow is given, only matching logical flows, if + any, are listed. Each lflow may be specified as a UUID or the + first few characters of a UUID, optionally prefixed by 0x. (Beā€ + cause ovn-controller sets OpenFlow flow cookies to the first 32 + bits of the corresponding logical flowā€™s UUID, this makes it + easy to look up the logical flow that generated a particular + OpenFlow flow.) + + If --uuid is specified, the output includes the first 32 bits of + each logical flowā€™s UUID. This makes it easier to find the Openā€ + Flow flows that correspond to a given logical flow. + + If --ovs is included, ovn-sbctl attempts to obtain and display + the OpenFlow flows that correspond to each OVN logical flow. To + do so, ovn-sbctl connects to remote (by default, + unix:/br-int.mgmt) over OpenFlow and retrieves the flows. If reā€ + mote is specified, it must be an active OpenFlow connection + method described in ovsdb(7). Please see the discussion of the + similar --ovs option in ovn-trace(8) for more information about + the OpenFlow flow output. + + By default, OpenFlow flow output includes only match and acā€ + tions. Add --stats to include all OpenFlow information, such as + packet and byte counters, duration, and timeouts. + + If --vflows is included, other southbound database records diā€ + rectly used for generating OpenFlow flows are also listed. This + includes: port-bindings, mac-bindings, multicast-groups, chasā€ + sis. The --ovs and --stats can also be used in conjunction with + --vflows. + + [--uuid] dump-flows [logical-datapath] + Alias for lflow-list. + + count-flows [logical-datapath] + prints numbers of logical flows per table and per datapath. + + Remote Connectivity Commands + These commands manipulate the connections column in the SB_Global table + and rows in the Connection table. When ovsdb-server is configured to + use the connections column for OVSDB connections, this allows the adā€ + ministrator to use \fBovn\-sbctl\fR to configure database connections. + + get-connection + Prints the configured connection(s). + + del-connection + Deletes the configured connection(s). + + [--inactivity-probe=msecs] set-connection target... + Sets the configured manager target or targets. Use --inā€ā€ + activity-probe=msecs to override the default idle connecā€ + tion inactivity probe time. Use 0 to disable inactivity + probes. + + SSL Configuration Commands + When ovsdb-server is configured to connect using SSL, the following paā€ + rameters are required: + + private-key + Specifies a PEM file containing the private key used for + SSL connections. + + certificate + Specifies a PEM file containing a certificate, signed by + the certificate authority (CA) used by the connection + peers, that certifies the private key, identifying a + trustworthy peer. + + ca-cert + Specifies a PEM file containing the CA certificate used + to verify that the connection peers are trustworthy. + + These SSL settings apply to all SSL connections made by the southbound + database server. + + get-ssl + Prints the SSL configuration. + + del-ssl + Deletes the current SSL configuration. + + [--bootstrap] set-ssl private-key certificate ca-cert [ssl-proā€ + tocol-list [ssl-cipher-list]] + Sets the SSL configuration. + + Database Commands + These commands query and modify the contents of ovsdb tables. They are + a slight abstraction of the ovsdb interface and as such they operate at + a lower level than other ovn-sbctl commands. + + Identifying Tables, Records, and Columns + + Each of these commands has a table parameter to identify a table within + the database. Many of them also take a record parameter that identifies + a particular record within a table. The record parameter may be the + UUID for a record, which may be abbreviated to its first 4 (or more) + hex digits, as long as that is unique. Many tables offer additional + ways to identify records. Some commands also take column parameters + that identify a particular field within the records in a table. + + For a list of tables and their columns, see ovn-sb(5) or see the table + listing from the --help option. + + Record names must be specified in full and with correct capitalization, + except that UUIDs may be abbreviated to their first 4 (or more) hex + digits, as long as that is unique within the table. Names of tables and + columns are not case-sensitive, and - and _ are treated interchangeā€ + ably. Unique abbreviations of table and column names are acceptable, + e.g. d or dhcp is sufficient to identify the DHCP_Options table. + + Database Values + + Each column in the database accepts a fixed type of data. The currently + defined basic types, and their representations, are: + + integer + A decimal integer in the range -2**63 to 2**63-1, incluā€ + sive. + + real A floating-point number. + + Boolean + True or false, written true or false, respectively. + + string An arbitrary Unicode string, except that null bytes are + not allowed. Quotes are optional for most strings that + begin with an English letter or underscore and consist + only of letters, underscores, hyphens, and periods. Howā€ + ever, true and false and strings that match the syntax of + UUIDs (see below) must be enclosed in double quotes to + distinguish them from other basic types. When double + quotes are used, the syntax is that of strings in JSON, + e.g. backslashes may be used to escape special characā€ + ters. The empty string must be represented as a pair of + double quotes (""). + + UUID Either a universally unique identifier in the style of + RFC 4122, e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or + an @name defined by a get or create command within the + same ovs-vsctl invocation. + + Multiple values in a single column may be separated by spaces or a sinā€ + gle comma. When multiple values are present, duplicates are not alā€ + lowed, and order is not important. Conversely, some database columns + can have an empty set of values, represented as [], and square brackets + may optionally enclose other non-empty sets or single values as well. + + A few database columns are ``mapsā€™ā€™ of key-value pairs, where the key + and the value are each some fixed database type. These are specified in + the form key=value, where key and value follow the syntax for the colā€ + umnā€™s key type and value type, respectively. When multiple pairs are + present (separated by spaces or a comma), duplicate keys are not alā€ + lowed, and again the order is not important. Duplicate values are alā€ + lowed. An empty map is represented as {}. Curly braces may optionally + enclose non-empty maps as well (but use quotes to prevent the shell + from expanding other-config={0=x,1=y} into other-config=0=x other-conā€ā€ + fig=1=y, which may not have the desired effect). + + Database Command Syntax + + [--if-exists] [--columns=column[,column]...] list table + [record]... + Lists the data in each specified record. If no records + are specified, lists all the records in table. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise, all columns + are listed, in alphabetical order by column name. + + Without --if-exists, it is an error if any specified + record does not exist. With --if-exists, the command igā€ + nores any record that does not exist, without producing + any output. + + [--columns=column[,column]...] find table [colā€ + umn[:key]=value]... + Lists the data in each record in table whose column + equals value or, if key is specified, whose column conā€ + tains a key with the specified value. The following operā€ + ators may be used where = is written in the syntax sumā€ + mary: + + = != < > <= >= + Selects records in which column[:key] equals, does + not equal, is less than, is greater than, is less + than or equal to, or is greater than or equal to + value, respectively. + + Consider column[:key] and value as sets of eleā€ + ments. Identical sets are considered equal. Otherā€ + wise, if the sets have different numbers of eleā€ + ments, then the set with more elements is considā€ + ered to be larger. Otherwise, consider a element + from each set pairwise, in increasing order within + each set. The first pair that differs determines + the result. (For a column that contains key-value + pairs, first all the keys are compared, and values + are considered only if the two sets contain idenā€ + tical keys.) + + {=} {!=} + Test for set equality or inequality, respectively. + + {<=} Selects records in which column[:key] is a subset + of value. For example, flood-vlans{<=}1,2 selects + records in which the flood-vlans column is the + empty set or contains 1 or 2 or both. + + {<} Selects records in which column[:key] is a proper + subset of value. For example, flood-vlans{<}1,2 + selects records in which the flood-vlans column is + the empty set or contains 1 or 2 but not both. + + {>=} {>} + Same as {<=} and {<}, respectively, except that + the relationship is reversed. For example, + flood-vlans{>=}1,2 selects records in which the + flood-vlans column contains both 1 and 2. + + The following operators are available only in Open + vSwitch 2.16 and later: + + {in} Selects records in which every element in colā€ + umn[:key] is also in value. (This is the same as + {<=}.) + + {not-in} + Selects records in which every element in colā€ + umn[:key] is not in value. + + For arithmetic operators (= != < > <= >=), when key is + specified but a particular recordā€™s column does not conā€ + tain key, the record is always omitted from the results. + Thus, the condition other-config:mtu!=1500 matches + records that have a mtu key whose value is not 1500, but + not those that lack an mtu key. + + For the set operators, when key is specified but a parā€ + ticular recordā€™s column does not contain key, the comparā€ + ison is done against an empty set. Thus, the condition + other-config:mtu{!=}1500 matches records that have a mtu + key whose value is not 1500 and those that lack an mtu + key. + + Donā€™t forget to escape < or > from interpretation by the + shell. + + If --columns is specified, only the requested columns are + listed, in the specified order. Otherwise all columns are + listed, in alphabetical order by column name. + + The UUIDs shown for rows created in the same ovs-vsctl + invocation will be wrong. + + [--if-exists] [--id=@name] get table record [column[:key]]... + Prints the value of each specified column in the given + record in table. For map columns, a key may optionally be + specified, in which case the value associated with key in + the column is printed, instead of the entire map. + + Without --if-exists, it is an error if record does not + exist or key is specified, if key does not exist in + record. With --if-exists, a missing record yields no outā€ + put and a missing key prints a blank line. + + If @name is specified, then the UUID for record may be + referred to by that name later in the same ovs-vsctl inā€ + vocation in contexts where a UUID is expected. + + Both --id and the column arguments are optional, but usuā€ + ally at least one or the other should be specified. If + both are omitted, then get has no effect except to verify + that record exists in table. + + --id and --if-exists cannot be used together. + + [--if-exists] set table record column[:key]=value... + Sets the value of each specified column in the given + record in table to value. For map columns, a key may opā€ + tionally be specified, in which case the value associated + with key in that column is changed (or added, if none exā€ + ists), instead of the entire map. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] add table record column [key=]value... + Adds the specified value or key-value pair to column in + record in table. If column is a map, then key is reā€ + quired, otherwise it is prohibited. If key already exists + in a map column, then the current value is not replaced + (use the set command to replace an existing value). + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] remove table record column value... + + [--if-exists] remove table record column key... + + [--if-exists] remove table record column key=value... + Removes the specified values or key-value pairs from colā€ + umn in record in table. The first form applies to columns + that are not maps: each specified value is removed from + the column. The second and third forms apply to map + columns: if only a key is specified, then any key-value + pair with the given key is removed, regardless of its + value; if a value is given then a pair is removed only if + both key and value match. + + It is not an error if the column does not contain the + specified key or value or pair. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--if-exists] clear table record column... + Sets each column in record in table to the empty set or + empty map, as appropriate. This command applies only to + columns that are allowed to be empty. + + Without --if-exists, it is an error if record does not + exist. With --if-exists, this command does nothing if + record does not exist. + + [--id=(@name|uuid)] create table column[:key]=value... + Creates a new record in table and sets the initial values + of each column. Columns not explicitly set will receive + their default values. Outputs the UUID of the new row. + + If @name is specified, then the UUID for the new row may + be referred to by that name elsewhere in the same \*(PN + invocation in contexts where a UUID is expected. Such + references may precede or follow the create command. + + If a valid uuid is specified, then it is used as the UUID + of the new row. + + Caution (ovs-vsctl as example) + Records in the Open vSwitch database are signifiā€ + cant only when they can be reached directly or inā€ + directly from the Open_vSwitch table. Except for + records in the QoS or Queue tables, records that + are not reachable from the Open_vSwitch table are + automatically deleted from the database. This + deletion happens immediately, without waiting for + additional ovs-vsctl commands or other database + activity. Thus, a create command must generally be + accompanied by additional commands within the same + ovs-vsctl invocation to add a chain of references + to the newly created record from the top-level + Open_vSwitch record. The EXAMPLES section gives + some examples that show how to do this. + + [--if-exists] destroy table record... + Deletes each specified record from table. Unless --if-exā€ā€ + ists is specified, each records must exist. + + --all destroy table + Deletes all records from the table. + + Caution (ovs-vsctl as example) + The destroy command is only useful for records in + the QoS or Queue tables. Records in other tables + are automatically deleted from the database when + they become unreachable from the Open_vSwitch taā€ + ble. This means that deleting the last reference + to a record is sufficient for deleting the record + itself. For records in these tables, destroy is + silently ignored. See the EXAMPLES section below + for more information. + + wait-until table record [column[:key]=value]... + Waits until table contains a record named record whose + column equals value or, if key is specified, whose column + contains a key with the specified value. This command + supports the same operators and semantics described for + the find command above. + + If no column[:key]=value arguments are given, this comā€ + mand waits only until record exists. If more than one + such argument is given, the command waits until all of + them are satisfied. + + Caution (ovs-vsctl as example) + Usually wait-until should be placed at the beginā€ + ning of a set of ovs-vsctl commands. For example, + wait-until bridge br0 -- get bridge br0 dataā€ā€ + path_id waits until a bridge named br0 is created, + then prints its datapath_id column, whereas get + bridge br0 datapath_id -- wait-until bridge br0 + will abort if no bridge named br0 exists when + ovs-vsctl initially connects to the database. + + Consider specifying --timeout=0 along with --wait-until, + to prevent ovs-vsctl from terminating after waiting only + at most 5 seconds. + + comment [arg]... + This command has no effect on behavior, but any database + log record created by the command will include the comā€ + mand and its arguments. + +ENVIRONMENT + OVN_SB_DAEMON + If set, this should name the Unix domain socket for an ovn-sbctl + server process. See Daemon Mode, above, for more information. + + OVN_SBCTL_OPTIONS + If set, a set of options for ovn-sbctl to apply automatically, + in the same form as on the command line. + + OVN_SB_DB + If set, the default database to contact when the --db option is + not used. + +EXIT STATUS + 0 Successful program execution. + + 1 Usage, syntax, or network error. + +SEE ALSO + ovn-sb(5), ovn-appctl(8). + +OVN 23.06.3 ovn-sbctl ovn-sbctl(8) diff --git a/src/static/support/dist-docs-branch-23.06/ovn-trace.8 b/src/static/support/dist-docs-branch-23.06/ovn-trace.8 new file mode 100644 index 00000000..c1c37b2c --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-trace.8 @@ -0,0 +1,418 @@ +'\" p +.\" -*- nroff -*- +.TH "ovn-trace" 8 "ovn-trace" "OVN 23\[char46]06\[char46]3" "OVN Manual" +.fp 5 L CR \\" Make fixed-width font available as \\fL. +.de TQ +. br +. ns +. TP "\\$1" +.. +.de ST +. PP +. RS -0.15in +. I "\\$1" +. RE +.. +.de SU +. PP +. I "\\$1" +.. +.PP +.SH "NAME" +.PP +.PP +ovn-trace \- Open Virtual Network logical network tracing utility +.SH "SYNOPSIS" +.PP +\fBovn\-trace\fR [\fIoptions\fR] \fI[datapath]\fR \fImicroflow\fR +.PP +\fBovn\-trace\fR [\fIoptions\fR] \fB\-\-detach\fR +.SH "DESCRIPTION" +.PP +.PP +This utility simulates packet forwarding within an OVN logical network\[char46] It can be used to run through ``what-if\(cq\(cq scenarios: if a packet originates at a logical port, what will happen to it and where will it ultimately end up? Users already familiar with the Open vSwitch \fBofproto/trace\fR command described in \fBovs\-vswitch\fR(8) will find \fBovn\-trace\fR to be a similar tool for logical networks\[char46] +.PP +.PP +\fBovn\-trace\fR works by reading the \fBLogical_Flow\fR and other tables from the OVN southbound database (see \fBovn\-sb\fR(5))\[char46] It simulates a packet\(cqs path through logical networks by repeatedly looking it up in the logical flow table, following the entire tree of possibilities\[char46] +.PP +.PP +\fBovn\-trace\fR simulates only the OVN logical network\[char46] It does not simulate the physical elements on which the logical network is layered\[char46] This means that, for example, it is unimportant how VMs are distributed among hypervisors, or whether their hypervisors are functioning and reachable, so \fBovn\-trace\fR will yield the same results regardless\[char46] There is one important exception: \fBovn\-northd\fR, the daemon that generates the logical flows that \fBovn\-trace\fR simulates, treats logical ports differently based on whether they are up or down\[char46] Thus, if you see surprising results, ensure that the ports involved in a simulation are up\[char46] +.PP +.PP +The simplest way to use \fBovn\-trace\fR is to provide the \fImicroflow\fR (and optional \fIdatapath\fR) arguments on the command line\[char46] In this case, it simulates the behavior of a single packet and exits\[char46] For an alternate usage model, see \fBDaemon Mode\fR below\[char46] +.PP +.PP +The optional \fIdatapath\fR argument specifies the name of a logical datapath\[char46] Acceptable names are the \fBname\fR from the northbound \fBLogical_Switch\fR or \fBLogical_Router\fR table, the UUID of a record from one of those tables, or the UUID of a record from the southbound \fBDatapath_Binding\fR table\[char46] (The \fBdatapath\fR is optional because \fBovn\-trace\fR can figure it out from the \fIinport\fR that the \fImicroflow\fR matches\[char46]) +.PP +.PP +The \fImicroflow\fR argument describes the packet whose forwarding is to be simulated, in the syntax of an OVN logical expression, as described in \fBovn\-sb\fR(5), to express constraints\[char46] The parser understands prerequisites; for example, if the expression refers to \fBip4\[char46]src\fR, there is no need to explicitly state \fBip4\fR or \fBeth\[char46]type == 0x800\fR\[char46] +.PP +.PP +For reasonable L2 behavior, the microflow should include at least \fBinport\fR and \fBeth\[char46]dst\fR, plus \fBeth\[char46]src\fR if port security is enabled\[char46] For example: +.PP +.nf +\fB +.br +\fB inport == \(dqlp11\(dq && eth\[char46]src == 00:01:02:03:04:05 && eth\[char46]dst == ff:ff:ff:ff:ff:ff +.br +\fB \fR +.fi +.PP +.PP +For reasonable L3 behavior, \fImicroflow\fR should also include \fBip4\[char46]src\fR and \fBip4\[char46]dst\fR (or \fBip6\[char46]src\fR and \fBip6\[char46]dst\fR) and \fBip\[char46]ttl\fR\[char46] For example: +.PP +.nf +\fB +.br +\fB inport == \(dqlp111\(dq && eth\[char46]src == f0:00:00:00:01:11 && eth\[char46]dst == 00:00:00:00:ff:11 +.br +\fB && ip4\[char46]src == 192\[char46]168\[char46]11\[char46]1 && ip4\[char46]dst == 192\[char46]168\[char46]22\[char46]2 && ip\[char46]ttl == 64 +.br +\fB \fR +.fi +.PP +.PP +Here\(cqs an ARP microflow example: +.PP +.nf +\fB +.br +\fB inport == \(dqlp123\(dq +.br +\fB && eth\[char46]dst == ff:ff:ff:ff:ff:ff && eth\[char46]src == f0:00:00:00:01:11 +.br +\fB && arp\[char46]op == 1 && arp\[char46]sha == f0:00:00:00:01:11 && arp\[char46]spa == 192\[char46]168\[char46]1\[char46]11 +.br +\fB && arp\[char46]tha == ff:ff:ff:ff:ff:ff && arp\[char46]tpa == 192\[char46]168\[char46]2\[char46]22 +.br +\fB \fR +.fi +.PP +.PP +\fBovn\-trace\fR will reject erroneous microflow expressions, which beyond syntax errors fall into two categories\[char46] First, they can be ambiguous\[char46] For example, \fBtcp\[char46]src == 80\fR is ambiguous because it does not state IPv4 or IPv6 as the Ethernet type\[char46] \fBip4 +&& tcp\[char46]src > 1024\fR is also ambiguous because it does not constrain bits of \fBtcp\[char46]src\fR to particular values\[char46] Second, they can be contradictory, e\[char46]g\[char46] \fBip4 && ip6\fR\[char46] +.SH "OUTPUT" +.PP +.PP +\fBovn\-trace\fR supports the three different forms of output, each described in a separate section below\[char46] Regardless of the selected output format, \fBovn\-trace\fR starts the output with a line that shows the microflow being traced in OpenFlow syntax\[char46] +.SS "Detailed Output" +.PP +.PP +The detailed form of output is also the default form\[char46] This form groups output into sections headed up by the ingress or egress pipeline being traversed\[char46] Each pipeline lists each table that was visited (by number and name), the \fBovn\-northd\fR source file and line number of the code that added the flow, the match expression and priority of the logical flow that was matched, and the actions that were executed\[char46] +.PP +.PP +The execution of OVN logical actions naturally forms a ``control stack\(cq\(cq that resembles that of a program in conventional programming languages such as C or Java\[char46] Because the \fBnext\fR action that calls into another logical flow table for a lookup is a recursive construct, OVN ``programs\(cq\(cq in practice tend to form deep control stacks that, displayed in the obvious way using additional indentation for each level, quickly use up the horizontal space on all but the widest displays\[char46] To make detailed output more readable, without loss of generality, \fBovn\-trace\fR omits indentation for ``tail recursion,\(cq\(cq that is, when \fBnext\fR is the last action in a logical flow, it does not indent details of the next table lookup more deeply\[char46] Output still uses indentation when it is needed for clarity\[char46] +.PP +.PP +OVN ``programs\(cq\(cq traces also tend to encounter long strings of logical flows with match expression \fB1\fR (which matches every packet) and the single action \fBnext;\fR\[char46] These are uninteresting and merely clutter output, so \fBovn\-trace\fR omits them entirely even from detailed output\[char46] +.PP +.PP +The following excerpt from detailed \fBovn\-trace\fR output shows a section for a packet traversing the ingress pipeline of logical datapath \fBls1\fR with ingress logical port \fBlp111\fR\[char46] The packet matches a logical flow in table 0 (aka \fBls_in_port_sec_l2\fR) with priority 50 and executes \fBnext(1);\fR to pass to table 1\[char46] Tables 1 through 11 are trivial and omitted\[char46] In table 19 (aka \fBls_in_l2_lkup\fR), the packet matches a flow with priority 50 based on its Ethernet destination address and the flow\(cqs actions output the packet to the \fBlrp11\-attachement\fR logical port\[char46] +.PP +.nf +\fL +.br +\fL ingress(dp=\(dqls1\(dq, inport=\(dqlp111\(dq) +.br +\fL \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- +.br +\fL 0\[char46] ls_in_port_sec_l2: inport == \(dqlp111\(dq, priority 50 +.br +\fL next(1); +.br +\fL 19\[char46] ls_in_l2_lkup: eth\[char46]dst == 00:00:00:00:ff:11, priority 50 +.br +\fL outport = \(dqlrp11\-attachment\(dq; +.br +\fL output; +.br +\fL \fR +.fi +.SS "Summary Output" +.PP +.PP +Summary output includes the logical pipelines visited by a packet and the logical actions executed on it\[char46] Compared to the detailed output, however, it removes details of tables and logical flows traversed by a packet\[char46] It uses a format closer to that of a programming language and does not attempt to avoid indentation\[char46] The summary output equivalent to the above detailed output fragment is: +.PP +.nf +\fL +.br +\fL ingress(dp=\(dqls1\(dq, inport=\(dqlp111\(dq) { +.br +\fL outport = \(dqlrp11\-attachment\(dq; +.br +\fL output; +.br +\fL \[char46]\[char46]\[char46] +.br +\fL }; +.br +\fL \fR +.fi +.SS "Minimal Output" +.PP +.PP +Minimal output includes only actions that modify packet data (not including OVN registers or metadata such as \fBoutport\fR) and \fBoutput\fR actions that actually deliver a packet to a logical port (excluding patch ports)\[char46] The operands of actions that modify packet data are displayed reduced to constants, e\[char46]g\[char46] \fBip4\[char46]dst = +reg0;\fR might be show as \fBip4\[char46]dst = 192\[char46]168\[char46]0\[char46]1;\fR if that was the value actually loaded\[char46] This yields output even simpler than the summary format\[char46] (Users familiar with Open vSwitch may recognize this as similar in spirit to the datapath actions listed at the bottom of \fBofproto/trace\fR output\[char46]) +.PP +.PP +The minimal output format reflects the externally seen behavior of the logical networks more than it does the implementation\[char46] This makes this output format the most suitable for use in regression tests, because it is least likely to change when logical flow tables are rearranged without semantic change\[char46] +.SH "STATEFUL ACTIONS" +.PP +.PP +Some OVN logical actions use or update state that is not available in the southbound database\[char46] \fBovn\-trace\fR handles these actions as described below: +.RS +.TP +\fBct_next\fR +By default \fBovn\-trace\fR treats flows as ``tracked\(cq\(cq and ``established\[char46]\(cq\(cq See the description of the \fB\-\-ct\fR option for a way to override this behavior\[char46] +.TP +\fBct_dnat\fR (without an argument) +Forks the pipeline\[char46] In one fork, advances to the next table as if \fBnext;\fR were executed\[char46] The packet is not changed, on the assumption that no NAT state was available\[char46] In the other fork, the pipeline continues without change after the \fBct_dnat\fR action\[char46] +.TP +\fBct_snat\fR (without an argument) +This action distinguishes between gateway routers and distributed routers\[char46] A gateway router is defined as a logical datapath that contains an \fBl3gateway\fR port; any other logical datapath is a distributed router\[char46] On a gateway router, \fBct_snat;\fR is treated as a no-op\[char46] On a distributed router, it is treated the same way as \fBct_dnat;\fR\[char46] +.TP +\fBct_dnat(\fIip\fB)\fR +.TQ .5in +\fBct_snat(\fIip\fB)\fR +Forks the pipeline\[char46] In one fork, sets \fBip4\[char46]dst\fR (or \fBip4\[char46]src\fR) to \fIip\fR and \fBct\[char46]dnat\fR (or \fBct\[char46]snat\fR) to 1 and advances to the next table as if \fBnext;\fR were executed\[char46] In the other fork, the pipeline continues without change after the \fBct_dnat\fR (or \fBct_snat\fR) action\[char46] +.TP +\fBct_lb;\fR +.TQ .5in +\fBct_lb(\fIip\fB\fR[\fB:\fIport\fB\fR]\[char46]\[char46]\[char46]\fB);\fR +Forks the pipeline\[char46] In one fork, sets \fBip4\[char46]dst\fR (or \fBip6\[char46]dst\fR) to one of the load-balancer addresses and the destination port to its associated port, if any, and sets \fBct\[char46]dnat\fR to 1\[char46] With one or more arguments, gives preference to the address specified on \fB\-\-lb\-dst\fR, if any; without arguments, uses the address and port specified on \fB\-\-lb\-dst\fR\[char46] In the other fork, the pipeline continues without change after the \fBct_lb\fR action\[char46] +.TP +\fBct_commit\fR +.TQ .5in +\fBput_arp\fR +.TQ .5in +\fBput_nd\fR +These actions are treated as no-ops\[char46] +.RE +.SH "DAEMON MODE" +.PP +.PP +If \fBovn\-trace\fR is invoked with the \fB\-\-detach\fR option (see \fBDaemon Options\fR, below), it runs in the background as a daemon and accepts commands from \fBovs\-appctl\fR (or another JSON-RPC client) indefinitely\[char46] The currently supported commands are described below\[char46] +.PP +.PP +.RS +.TP +\fBtrace\fR [\fIoptions\fR] [\fIdatapath\fR] \fImicroflow\fR +Traces \fImicroflow\fR through \fIdatapath\fR and replies with the results of the trace\[char46] Accepts the \fIoptions\fR described under \fBTrace Options\fR below\[char46] +.TP +\fBexit\fR +Causes \fBovn\-trace\fR to gracefully terminate\[char46] +.RE +.SH "OPTIONS" +.SS "Trace Options" +.TP +\fB\-\-detailed\fR +.TQ .5in +\fB\-\-summary\fR +.TQ .5in +\fB\-\-minimal\fR +These options control the form and level of detail in \fBovn\-trace\fR output\[char46] If more than one of these options is specified, all of the selected forms are output, in the order listed above, each headed by a banner line\[char46] If none of these options is given, \fB\-\-detailed\fR is the default\[char46] See \fBOutput\fR, above, for a description of each kind of output\[char46] +.TP +\fB\-\-all\fR +Selects all three forms of output\[char46] +.TP +\fB\-\-ovs\fR[\fB=\fR\fIremote\fR] +Makes \fBovn\-trace\fR attempt to obtain and display the OpenFlow flows that correspond to each OVN logical flow\[char46] To do so, \fBovn\-trace\fR connects to \fIremote\fR (by default, \fBunix:/br\-int\[char46]mgmt\fR) over OpenFlow and retrieves the flows\[char46] If \fIremote\fR is specified, it must be an active OpenFlow connection method described in \fBovsdb\fR(7)\[char46] +.IP +To make the best use of the output, it is important to understand the relationship between logical flows and OpenFlow flows\[char46] \fBovn\-architecture\fR(7), under \fBArchitectural Physical Life +Cycle of a Packet\fR, describes this relationship\[char46] Keep in mind the following points: +.RS +.IP \(bu +\fBovn\-trace\fR currently shows all the OpenFlow flows to which a logical flow corresponds, even though an actual packet ordinarily matches only one of these\[char46] +.IP \(bu +Some logical flows can map to the Open vSwitch ``conjunctive match\(cq\(cq extension (see \fBovs\-fields\fR(7))\[char46] Currently \fBovn\-trace\fR cannot display the flows with \fBconjunction\fR actions that effectively produce the \fBconj_id\fR match\[char46] +.IP \(bu +Some logical flows may not be represented in the OpenFlow tables on a given hypervisor, if they could not be used on that hypervisor\[char46] +.IP \(bu +Some OpenFlow flows do not correspond to logical flows, such as OpenFlow flows that map between physical and logical ports\[char46] These flows will never show up in a trace\[char46] +.IP \(bu +When \fBovn\-trace\fR omits uninteresting logical flows from output, it does not look up the corresponding OpenFlow flows\[char46] +.RE +.TP +\fB\-\-ct=\fIflags\fB\fR +This option sets the \fBct_state\fR flags that a \fBct_next\fR logical action will report\[char46] The \fIflags\fR must be a comma- or space-separated list of the following connection tracking flags: +.RS +.IP \(bu +\fBtrk\fR: Include to indicate connection tracking has taken place\[char46] (This bit is set automatically even if not listed in \fIflags\fR\[char46] +.IP \(bu +\fBnew\fR: Include to indicate a new flow\[char46] +.IP \(bu +\fBest\fR: Include to indicate an established flow\[char46] +.IP \(bu +\fBrel\fR: Include to indicate a related flow\[char46] +.IP \(bu +\fBrpl\fR: Include to indicate a reply flow\[char46] +.IP \(bu +\fBinv\fR: Include to indicate a connection entry in a bad state\[char46] +.IP \(bu +\fBdnat\fR: Include to indicate a packet whose destination IP address has been changed\[char46] +.IP \(bu +\fBsnat\fR: Include to indicate a packet whose source IP address has been changed\[char46] +.RE +.IP +The \fBct_next\fR action is used to implement the OVN distributed firewall\[char46] For testing, useful flag combinations include: +.RS +.IP \(bu +\fBtrk,new\fR: A packet in a flow in either direction through a firewall that has not yet been committed (with \fBct_commit\fR)\[char46] +.IP \(bu +\fBtrk,est\fR: A packet in an established flow going out through a firewall\[char46] +.IP \(bu +\fBtrk,rpl\fR: A packet coming in through a firewall in reply to an established flow\[char46] +.IP \(bu +\fBtrk,inv\fR: An invalid packet in either direction\[char46] +.RE +.IP +A packet might pass through the connection tracker twice in one trip through OVN: once following egress from a VM as it passes outward through a firewall, and once preceding ingress to a second VM as it passes inward through a firewall\[char46] Use multiple \fB\-\-ct\fR options to specify the flags for multiple \fBct_next\fR actions\[char46] +.IP +When \fB\-\-ct\fR is unspecified, or when there are fewer \fB\-\-ct\fR options than \fBct_next\fR actions, the \fIflags\fR default to \fBtrk,est\fR\[char46] +.TP +\fB\-\-lb\-dst=\fR\fIip\fR[\fB:\fIport\fB\fR] +Sets the IP from VIP pool to use as destination of the packet\[char46] \fB\-\-lb\-dst\fR is not available in daemon mode\[char46] +.TP +\fB\-\-select\-id=\fR\fIid\fR +Specify the \fIid\fR to be selected by the \fBselect\fR action\[char46] \fIid\fR must be one of the values listed in the \fBselect\fR action\[char46] Otherwise, a random id is selected from the list, as if \fB\-\-select\-id\fR were not specified\[char46] \fB\-\-select\-id\fR is not available in daemon mode\[char46] +.TP +\fB\-\-friendly\-names\fR +.TQ .5in +\fB\-\-no\-friendly\-names\fR +When cloud management systems such as OpenStack are layered on top of OVN, they often use long, human-unfriendly names for ports and datapaths, for example, ones that include entire UUIDs\[char46] They do usually include friendlier names, but the long, hard-to-read names are the ones that appear in matches and actions\[char46] By default, or with \fB\-\-friendly\-names\fR, \fBovn\-trace\fR substitutes these friendlier names for the long names in its output\[char46] Use \fB\-\-no\-friendly\-names\fR to disable this behavior; this option might be useful, for example, if a program is going to parse \fBovn\-trace\fR output\[char46] +.SS "Daemon Options" +.TP +\fB\-\-pidfile\fR[\fB=\fR\fIpidfile\fR] +Causes a file (by default, \fB\fIprogram\fB\[char46]pid\fR) to be created indicating the PID of the running process\[char46] If the \fIpidfile\fR argument is not specified, or if it does not begin with \fB/\fR, then it is created in \fB\fR\[char46] +.IP +If \fB\-\-pidfile\fR is not specified, no pidfile is created\[char46] +.TP +\fB\-\-overwrite\-pidfile\fR +By default, when \fB\-\-pidfile\fR is specified and the specified pidfile already exists and is locked by a running process, the daemon refuses to start\[char46] Specify \fB\-\-overwrite\-pidfile\fR to cause it to instead overwrite the pidfile\[char46] +.IP +When \fB\-\-pidfile\fR is not specified, this option has no effect\[char46] +.TP +\fB\-\-detach\fR +Runs this program as a background process\[char46] The process forks, and in the child it starts a new session, closes the standard file descriptors (which has the side effect of disabling logging to the console), and changes its current directory to the root (unless \fB\-\-no\-chdir\fR is specified)\[char46] After the child completes its initialization, the parent exits\[char46] +.TP +\fB\-\-monitor\fR +Creates an additional process to monitor this program\[char46] If it dies due to a signal that indicates a programming error (\fBSIGABRT\fR, \fBSIGALRM\fR, \fBSIGBUS\fR, \fBSIGFPE\fR, \fBSIGILL\fR, \fBSIGPIPE\fR, \fBSIGSEGV\fR, \fBSIGXCPU\fR, or \fBSIGXFSZ\fR) then the monitor process starts a new copy of it\[char46] If the daemon dies or exits for another reason, the monitor process exits\[char46] +.IP +This option is normally used with \fB\-\-detach\fR, but it also functions without it\[char46] +.TP +\fB\-\-no\-chdir\fR +By default, when \fB\-\-detach\fR is specified, the daemon changes its current working directory to the root directory after it detaches\[char46] Otherwise, invoking the daemon from a carelessly chosen directory would prevent the administrator from unmounting the file system that holds that directory\[char46] +.IP +Specifying \fB\-\-no\-chdir\fR suppresses this behavior, preventing the daemon from changing its current working directory\[char46] This may be useful for collecting core files, since it is common behavior to write core dumps into the current working directory and the root directory is not a good directory to use\[char46] +.IP +This option has no effect when \fB\-\-detach\fR is not specified\[char46] +.TP +\fB\-\-no\-self\-confinement\fR +By default this daemon will try to self-confine itself to work with files under well-known directories determined at build time\[char46] It is better to stick with this default behavior and not to use this flag unless some other Access Control is used to confine daemon\[char46] Note that in contrast to other access control implementations that are typically enforced from kernel-space (e\[char46]g\[char46] DAC or MAC), self-confinement is imposed from the user-space daemon itself and hence should not be considered as a full confinement strategy, but instead should be viewed as an additional layer of security\[char46] +.TP +\fB\-\-user=\fR\fIuser\fR\fB:\fR\fIgroup\fR +Causes this program to run as a different user specified in \fIuser\fR\fB:\fR\fIgroup\fR, thus dropping most of the root privileges\[char46] Short forms \fIuser\fR and \fB:\fR\fIgroup\fR are also allowed, with current user or group assumed, respectively\[char46] Only daemons started by the root user accepts this argument\[char46] +.IP +On Linux, daemons will be granted \fBCAP_IPC_LOCK\fR and \fBCAP_NET_BIND_SERVICES\fR before dropping root privileges\[char46] Daemons that interact with a datapath, such as \fBovs\-vswitchd\fR, will be granted three additional capabilities, namely \fBCAP_NET_ADMIN\fR, \fBCAP_NET_BROADCAST\fR and \fBCAP_NET_RAW\fR\[char46] The capability change will apply even if the new user is root\[char46] +.IP +On Windows, this option is not currently supported\[char46] For security reasons, specifying this option will cause the daemon process not to start\[char46] +.SS "Logging Options" +.TP +\fB\-v\fR[\fIspec\fR] +.TQ .5in +\fB\-\-verbose=\fR[\fIspec\fR] +Sets logging levels\[char46] Without any \fIspec\fR, sets the log level for every module and destination to \fBdbg\fR\[char46] Otherwise, \fIspec\fR is a list of words separated by spaces or commas or colons, up to one from each category below: +.RS +.IP \(bu +A valid module name, as displayed by the \fBvlog/list\fR command on \fBovs\-appctl\fR(8), limits the log level change to the specified module\[char46] +.IP \(bu +\fBsyslog\fR, \fBconsole\fR, or \fBfile\fR, to limit the log level change to only to the system log, to the console, or to a file, respectively\[char46] (If \fB\-\-detach\fR is specified, the daemon closes its standard file descriptors, so logging to the console will have no effect\[char46]) +.IP +On Windows platform, \fBsyslog\fR is accepted as a word and is only useful along with the \fB\-\-syslog\-target\fR option (the word has no effect otherwise)\[char46] +.IP \(bu +\fBoff\fR, \fBemer\fR, \fBerr\fR, \fBwarn\fR, \fBinfo\fR, or \fBdbg\fR, to control the log level\[char46] Messages of the given severity or higher will be logged, and messages of lower severity will be filtered out\[char46] \fBoff\fR filters out all messages\[char46] See \fBovs\-appctl\fR(8) for a definition of each log level\[char46] +.RE +.IP +Case is not significant within \fIspec\fR\[char46] +.IP +Regardless of the log levels set for \fBfile\fR, logging to a file will not take place unless \fB\-\-log\-file\fR is also specified (see below)\[char46] +.IP +For compatibility with older versions of OVS, \fBany\fR is accepted as a word but has no effect\[char46] +.TP +\fB\-v\fR +.TQ .5in +\fB\-\-verbose\fR +Sets the maximum logging verbosity level, equivalent to \fB\-\-verbose=dbg\fR\[char46] +.TP +\fB\-vPATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +.TQ .5in +\fB\-\-verbose=PATTERN:\fR\fIdestination\fR\fB:\fR\fIpattern\fR +Sets the log pattern for \fIdestination\fR to \fIpattern\fR\[char46] Refer to \fBovs\-appctl\fR(8) for a description of the valid syntax for \fIpattern\fR\[char46] +.TP +\fB\-vFACILITY:\fR\fIfacility\fR +.TQ .5in +\fB\-\-verbose=FACILITY:\fR\fIfacility\fR +Sets the RFC5424 facility of the log message\[char46] \fIfacility\fR can be one of \fBkern\fR, \fBuser\fR, \fBmail\fR, \fBdaemon\fR, \fBauth\fR, \fBsyslog\fR, \fBlpr\fR, \fBnews\fR, \fBuucp\fR, \fBclock\fR, \fBftp\fR, \fBntp\fR, \fBaudit\fR, \fBalert\fR, \fBclock2\fR, \fBlocal0\fR, \fBlocal1\fR, \fBlocal2\fR, \fBlocal3\fR, \fBlocal4\fR, \fBlocal5\fR, \fBlocal6\fR or \fBlocal7\fR\[char46] If this option is not specified, \fBdaemon\fR is used as the default for the local system syslog and \fBlocal0\fR is used while sending a message to the target provided via the \fB\-\-syslog\-target\fR option\[char46] +.TP +\fB\-\-log\-file\fR[\fB=\fR\fIfile\fR] +Enables logging to a file\[char46] If \fIfile\fR is specified, then it is used as the exact name for the log file\[char46] The default log file name used if \fIfile\fR is omitted is \fB/usr/local/var/log/ovn/\fIprogram\fB\[char46]log\fR\[char46] +.TP +\fB\-\-syslog\-target=\fR\fIhost\fR\fB:\fR\fIport\fR +Send syslog messages to UDP \fIport\fR on \fIhost\fR, in addition to the system syslog\[char46] The \fIhost\fR must be a numerical IP address, not a hostname\[char46] +.TP +\fB\-\-syslog\-method=\fR\fImethod\fR +Specify \fImethod\fR as how syslog messages should be sent to syslog daemon\[char46] The following forms are supported: +.RS +.IP \(bu +\fBlibc\fR, to use the libc \fBsyslog()\fR function\[char46] Downside of using this options is that libc adds fixed prefix to every message before it is actually sent to the syslog daemon over \fB/dev/log\fR UNIX domain socket\[char46] +.IP \(bu +\fBunix:\fIfile\fB\fR, to use a UNIX domain socket directly\[char46] It is possible to specify arbitrary message format with this option\[char46] However, \fBrsyslogd 8\[char46]9\fR and older versions use hard coded parser function anyway that limits UNIX domain socket use\[char46] If you want to use arbitrary message format with older \fBrsyslogd\fR versions, then use UDP socket to localhost IP address instead\[char46] +.IP \(bu +\fBudp:\fIip\fB:\fIport\fB\fR, to use a UDP socket\[char46] With this method it is possible to use arbitrary message format also with older \fBrsyslogd\fR\[char46] When sending syslog messages over UDP socket extra precaution needs to be taken into account, for example, syslog daemon needs to be configured to listen on the specified UDP port, accidental iptables rules could be interfering with local syslog traffic and there are some security considerations that apply to UDP sockets, but do not apply to UNIX domain sockets\[char46] +.IP \(bu +\fBnull\fR, to discard all messages logged to syslog\[char46] +.RE +.IP +The default is taken from the \fBOVS_SYSLOG_METHOD\fR environment variable; if it is unset, the default is \fBlibc\fR\[char46] +.SS "PKI Options" +.PP +.PP +PKI configuration is required to use SSL for the connection to the database (and the switch, if \fB\-\-ovs\fR is specified)\[char46] +.RS +.TP +\fB\-p\fR \fIprivkey\[char46]pem\fR +.TQ .5in +\fB\-\-private\-key=\fR\fIprivkey\[char46]pem\fR +Specifies a PEM file containing the private key used as identity for outgoing SSL connections\[char46] +.TP +\fB\-c\fR \fIcert\[char46]pem\fR +.TQ .5in +\fB\-\-certificate=\fR\fIcert\[char46]pem\fR +Specifies a PEM file containing a certificate that certifies the private key specified on \fB\-p\fR or \fB\-\-private\-key\fR to be trustworthy\[char46] The certificate must be signed by the certificate authority (CA) that the peer in SSL connections will use to verify it\[char46] +.TP +\fB\-C\fR \fIcacert\[char46]pem\fR +.TQ .5in +\fB\-\-ca\-cert=\fR\fIcacert\[char46]pem\fR +Specifies a PEM file containing the CA certificate for verifying certificates presented to this program by SSL peers\[char46] (This may be the same certificate that SSL peers use to verify the certificate specified on \fB\-c\fR or \fB\-\-certificate\fR, or it may be a different one, depending on the PKI design in use\[char46]) +.TP +\fB\-C none\fR +.TQ .5in +\fB\-\-ca\-cert=none\fR +Disables verification of certificates presented by SSL peers\[char46] This introduces a security risk, because it means that certificates cannot be verified to be those of known trusted hosts\[char46] +.RE +.SS "Other Options" +.TP +\fB\-\-db\fR \fIdatabase\fR +The OVSDB database remote to contact\[char46] If the \fBOVN_SB_DB\fR environment variable is set, its value is used as the default\[char46] Otherwise, the default is \fBunix:/db\[char46]sock\fR, but this default is unlikely to be useful outside of single-machine OVN test environments\[char46] +.RS +.TP +\fB\-h\fR +.TQ .5in +\fB\-\-help\fR +Prints a brief help message to the console\[char46] +.TP +\fB\-V\fR +.TQ .5in +\fB\-\-version\fR +Prints version information to the console\[char46] +.RE diff --git a/src/static/support/dist-docs-branch-23.06/ovn-trace.8.html b/src/static/support/dist-docs-branch-23.06/ovn-trace.8.html new file mode 100644 index 00000000..b7f84819 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-trace.8.html @@ -0,0 +1,572 @@ +

+ovn-trace(8)                      OVN Manual                      ovn-trace(8)
+
+NAME
+       ovn-trace - Open Virtual Network logical network tracing utility
+
+SYNOPSIS
+       ovn-trace [options] [datapath] microflow
+
+       ovn-trace [options] --detach
+
+DESCRIPTION
+       This utility simulates packet forwarding within an OVN logical network.
+       It can be used to run through ``what-ifā€™ā€™ scenarios: if a packet origiā€
+       nates at a logical port, what will happen to it and where will it ultiā€
+       mately  end  up?  Users  already  familiar  with  the  Open vSwitch ofā€ā€
+       proto/trace command described in ovs-vswitch(8) will find ovn-trace  to
+       be a similar tool for logical networks.
+
+       ovn-trace  works  by reading the Logical_Flow and other tables from the
+       OVN southbound database (see ovn-sb(5)). It simulates a  packetā€™s  path
+       through  logical  networks  by  repeatedly looking it up in the logical
+       flow table, following the entire tree of possibilities.
+
+       ovn-trace simulates only the OVN logical network. It does not  simulate
+       the  physical  elements  on  which the logical network is layered. This
+       means that, for example, it is  unimportant  how  VMs  are  distributed
+       among  hypervisors,  or  whether  their hypervisors are functioning and
+       reachable, so ovn-trace will yield the same results  regardless.  There
+       is  one  important exception: ovn-northd, the daemon that generates the
+       logical flows that ovn-trace simulates, treats  logical  ports  differā€
+       ently based on whether they are up or down. Thus, if you see surprising
+       results, ensure that the ports involved in a simulation are up.
+
+       The  simplest way to use ovn-trace is to provide the microflow (and opā€
+       tional datapath) arguments on the command line. In this case, it  simuā€
+       lates the behavior of a single packet and exits. For an alternate usage
+       model, see Daemon Mode below.
+
+       The  optional  datapath  argument specifies the name of a logical dataā€
+       path. Acceptable names are the name from the northbound  Logical_Switch
+       or Logical_Router table, the UUID of a record from one of those tables,
+       or  the  UUID  of  a record from the southbound Datapath_Binding table.
+       (The datapath is optional because ovn-trace can figure it out from  the
+       inport that the microflow matches.)
+
+       The  microflow  argument describes the packet whose forwarding is to be
+       simulated, in the syntax of an OVN logical expression, as described  in
+       ovn-sb(5),  to  express  constraints.  The parser understands prerequiā€
+       sites; for example, if the expression refers to ip4.src,  there  is  no
+       need to explicitly state ip4 or eth.type == 0x800.
+
+       For  reasonable  L2 behavior, the microflow should include at least inā€ā€
+       port and eth.dst, plus eth.src if port security is enabled.  For  examā€
+       ple:
+
+           inport == "lp11" &&&& eth.src == 00:01:02:03:04:05 &&&& eth.dst == ff:ff:ff:ff:ff:ff
+
+
+       For  reasonable  L3 behavior, microflow should also include ip4.src and
+       ip4.dst (or ip6.src and ip6.dst) and ip.ttl. For example:
+
+           inport == "lp111" &&&& eth.src == f0:00:00:00:01:11 &&&& eth.dst == 00:00:00:00:ff:11
+           &&&& ip4.src == 192.168.11.1 &&&& ip4.dst == 192.168.22.2 &&&& ip.ttl == 64
+
+
+       Hereā€™s an ARP microflow example:
+
+           inport == "lp123"
+           &&&& eth.dst == ff:ff:ff:ff:ff:ff &&&& eth.src == f0:00:00:00:01:11
+           &&&& arp.op == 1 &&&& arp.sha == f0:00:00:00:01:11 &&&& arp.spa == 192.168.1.11
+           &&&& arp.tha == ff:ff:ff:ff:ff:ff &&&& arp.tpa == 192.168.2.22
+
+
+       ovn-trace will reject erroneous  microflow  expressions,  which  beyond
+       syntax  errors  fall into two categories. First, they can be ambiguous.
+       For example, tcp.src == 80 is ambiguous because it does not state  IPv4
+       or  IPv6  as the Ethernet type. ip4 &&&& tcp.src >gt;>gt; 1024 is also ambiguous
+       because it does not constrain bits of  tcp.src  to  particular  values.
+       Second, they can be contradictory, e.g. ip4 &&&& ip6.
+
+OUTPUT
+       ovn-trace  supports the three different forms of output, each described
+       in a separate section below. Regardless of the selected output  format,
+       ovn-trace  starts the output with a line that shows the microflow being
+       traced in OpenFlow syntax.
+
+   Detailed Output
+       The detailed form of output is also the default form. This form  groups
+       output  into sections headed up by the ingress or egress pipeline being
+       traversed. Each pipeline lists each table that was visited  (by  number
+       and  name), the ovn-northd source file and line number of the code that
+       added the flow, the match expression and priority of the  logical  flow
+       that was matched, and the actions that were executed.
+
+       The  execution  of  OVN  logical  actions  naturally  forms a ``control
+       stackā€™ā€™ that resembles that of a program  in  conventional  programming
+       languages  such  as  C or Java. Because the next action that calls into
+       another logical flow table for a lookup is a recursive  construct,  OVN
+       ``programsā€™ā€™  in  practice  tend to form deep control stacks that, disā€
+       played in the obvious way using additional indentation for each  level,
+       quickly  use up the horizontal space on all but the widest displays. To
+       make  detailed  output  more  readable,  without  loss  of  generality,
+       ovn-trace  omits indentation for ``tail recursion,ā€™ā€™ that is, when next
+       is the last action in a logical flow, it does not indent details of the
+       next table lookup more deeply. Output still uses indentation when it is
+       needed for clarity.
+
+       OVN ``programsā€™ā€™ traces also tend to encounter long strings of  logical
+       flows with match expression 1 (which matches every packet) and the sinā€
+       gle action next;. These are uninteresting and merely clutter output, so
+       ovn-trace omits them entirely even from detailed output.
+
+       The  following  excerpt  from detailed ovn-trace output shows a section
+       for a packet traversing the ingress pipeline of  logical  datapath  ls1
+       with  ingress  logical port lp111. The packet matches a logical flow in
+       table 0 (aka ls_in_port_sec_l2) with priority 50 and executes  next(1);
+       to pass to table 1. Tables 1 through 11 are trivial and omitted. In taā€
+       ble  19 (aka ls_in_l2_lkup), the packet matches a flow with priority 50
+       based on its Ethernet destination address and the flowā€™s actions output
+       the packet to the lrp11-attachement logical port.
+
+           ingress(dp="ls1", inport="lp111")
+           ---------------------------------
+           0. ls_in_port_sec_l2: inport == "lp111", priority 50
+           next(1);
+           19. ls_in_l2_lkup: eth.dst == 00:00:00:00:ff:11, priority 50
+           outport = "lrp11-attachment";
+           output;
+
+
+   Summary Output
+       Summary output includes the logical pipelines visited by a  packet  and
+       the  logical  actions  executed on it. Compared to the detailed output,
+       however, it removes details of tables and logical flows traversed by  a
+       packet.  It  uses a format closer to that of a programming language and
+       does not attempt to avoid indentation. The summary output equivalent to
+       the above detailed output fragment is:
+
+           ingress(dp="ls1", inport="lp111") {
+           outport = "lrp11-attachment";
+           output;
+           ...
+           };
+
+
+   Minimal Output
+       Minimal output includes only actions that modify packet data  (not  inā€
+       cluding  OVN  registers or metadata such as outport) and output actions
+       that actually deliver a packet  to  a  logical  port  (excluding  patch
+       ports).  The  operands of actions that modify packet data are displayed
+       reduced to constants, e.g. ip4.dst = reg0; might be show as  ip4.dst  =
+       192.168.0.1;  if that was the value actually loaded. This yields output
+       even simpler than the summary format. (Users familiar with Open vSwitch
+       may recognize this as similar in spirit to the datapath actions  listed
+       at the bottom of ofproto/trace output.)
+
+       The  minimal output format reflects the externally seen behavior of the
+       logical networks more than it does the implementation. This makes  this
+       output format the most suitable for use in regression tests, because it
+       is least likely to change when logical flow tables are rearranged withā€
+       out semantic change.
+
+STATEFUL ACTIONS
+       Some  OVN  logical actions use or update state that is not available in
+       the southbound database. ovn-trace handles these actions  as  described
+       below:
+
+              ct_next
+                     By  default  ovn-trace  treats  flows  as ``trackedā€™ā€™ and
+                     ``established.ā€™ā€™ See the description of the  --ct  option
+                     for a way to override this behavior.
+
+              ct_dnat (without an argument)
+                     Forks the pipeline. In one fork, advances to the next taā€
+                     ble as if next; were executed. The packet is not changed,
+                     on the assumption that no NAT state was available. In the
+                     other  fork,  the pipeline continues without change after
+                     the ct_dnat action.
+
+              ct_snat (without an argument)
+                     This action distinguishes  between  gateway  routers  and
+                     distributed  routers.  A  gateway  router is defined as a
+                     logical datapath that contains  an  l3gateway  port;  any
+                     other  logical  datapath  is  a  distributed router. On a
+                     gateway router, ct_snat; is treated as a no-op. On a disā€
+                     tributed router, it is treated the same way as ct_dnat;.
+
+              ct_dnat(ip)
+              ct_snat(ip)
+                   Forks the pipeline. In one fork, sets ip4.dst (or  ip4.src)
+                   to  ip  and  ct.dnat  (or ct.snat) to 1 and advances to the
+                   next table as if next; were executed. In  the  other  fork,
+                   the pipeline continues without change after the ct_dnat (or
+                   ct_snat) action.
+
+              ct_lb;
+              ct_lb(ip[:port]...);
+                   Forks  the pipeline. In one fork, sets ip4.dst (or ip6.dst)
+                   to one of the load-balancer addresses and  the  destination
+                   port to its associated port, if any, and sets ct.dnat to 1.
+                   With one or more arguments, gives preference to the address
+                   specified  on --lb-dst, if any; without arguments, uses the
+                   address and port specified on --lb-dst. In the other  fork,
+                   the  pipeline  continues without change after the ct_lb acā€
+                   tion.
+
+              ct_commit
+              put_arp
+              put_nd
+                   These actions are treated as no-ops.
+
+DAEMON MODE
+       If ovn-trace is invoked with the --detach option (see  Daemon  Options,
+       below), it runs in the background as a daemon and accepts commands from
+       ovs-appctl  (or  another  JSON-RPC  client) indefinitely. The currently
+       supported commands are described below.
+
+              trace [options] [datapath] microflow
+                     Traces microflow through datapath and  replies  with  the
+                     results of the trace. Accepts the options described under
+                     Trace Options below.
+
+              exit   Causes ovn-trace to gracefully terminate.
+
+OPTIONS
+   Trace Options
+       --detailed
+       --summary
+       --minimal
+            These  options  control  the form and level of detail in ovn-trace
+            output. If more than one of these options is specified, all of the
+            selected forms are output, in the order listed above, each  headed
+            by a banner line. If none of these options is given, --detailed is
+            the  default. See Output, above, for a description of each kind of
+            output.
+
+       --all
+            Selects all three forms of output.
+
+       --ovs[=remote]
+            Makes ovn-trace attempt to obtain and display the  OpenFlow  flows
+            that correspond to each OVN logical flow. To do so, ovn-trace conā€
+            nects  to remote (by default, unix:/br-int.mgmt) over OpenFlow and
+            retrieves the flows. If remote is specified, it must be an  active
+            OpenFlow connection method described in ovsdb(7).
+
+            To  make the best use of the output, it is important to understand
+            the relationship between logical flows and OpenFlow flows. ovn-arā€ā€
+            chitecture(7),  under  Architectural  Physical  Life  Cycle  of  a
+            Packet,  describes  this  relationship. Keep in mind the following
+            points:
+
+            ā€¢      ovn-trace currently shows all the OpenFlow flows to which a
+                   logical flow corresponds, even though an actual packet  orā€
+                   dinarily matches only one of these.
+
+            ā€¢      Some  logical  flows can map to the Open vSwitch ``conjuncā€
+                   tive  matchā€™ā€™  extension  (see  ovs-fields(7)).   Currently
+                   ovn-trace cannot display the flows with conjunction actions
+                   that effectively produce the conj_id match.
+
+            ā€¢      Some  logical  flows may not be represented in the OpenFlow
+                   tables on a given hypervisor, if they could not be used  on
+                   that hypervisor.
+
+            ā€¢      Some  OpenFlow  flows  do  not correspond to logical flows,
+                   such as OpenFlow flows that map between physical and  logiā€
+                   cal ports. These flows will never show up in a trace.
+
+            ā€¢      When  ovn-trace omits uninteresting logical flows from outā€
+                   put, it does not look up the corresponding OpenFlow flows.
+
+       --ct=flags
+            This option sets the ct_state flags that a ct_next logical  action
+            will report. The flags must be a comma- or space-separated list of
+            the following connection tracking flags:
+
+            ā€¢      trk:  Include  to  indicate  connection  tracking has taken
+                   place. (This bit is set automatically even if not listed in
+                   flags.
+
+            ā€¢      new: Include to indicate a new flow.
+
+            ā€¢      est: Include to indicate an established flow.
+
+            ā€¢      rel: Include to indicate a related flow.
+
+            ā€¢      rpl: Include to indicate a reply flow.
+
+            ā€¢      inv: Include to indicate a connection entry in a bad state.
+
+            ā€¢      dnat: Include to indicate a packet whose destination IP adā€
+                   dress has been changed.
+
+            ā€¢      snat: Include to indicate a packet whose source IP  address
+                   has been changed.
+
+            The  ct_next action is used to implement the OVN distributed fireā€
+            wall. For testing, useful flag combinations include:
+
+            ā€¢      trk,new: A packet in a flow in either direction  through  a
+                   firewall that has not yet been committed (with ct_commit).
+
+            ā€¢      trk,est:  A packet in an established flow going out through
+                   a firewall.
+
+            ā€¢      trk,rpl: A packet coming in through a firewall in reply  to
+                   an established flow.
+
+            ā€¢      trk,inv: An invalid packet in either direction.
+
+            A  packet  might  pass through the connection tracker twice in one
+            trip through OVN: once following egress from a  VM  as  it  passes
+            outward through a firewall, and once preceding ingress to a second
+            VM  as  it passes inward through a firewall. Use multiple --ct opā€
+            tions to specify the flags for multiple ct_next actions.
+
+            When --ct is unspecified, or when there  are  fewer  --ct  options
+            than ct_next actions, the flags default to trk,est.
+
+       --lb-dst=ip[:port]
+            Sets  the  IP  from  VIP pool to use as destination of the packet.
+            --lb-dst is not available in daemon mode.
+
+       --select-id=id
+            Specify the id to be selected by the select action. id must be one
+            of the values listed in the select action. Otherwise, a random  id
+            is  selected  from the list, as if --select-id were not specified.
+            --select-id is not available in daemon mode.
+
+       --friendly-names
+       --no-friendly-names
+            When cloud management systems such as OpenStack are layered on top
+            of OVN, they often use long, human-unfriendly names for ports  and
+            datapaths,  for  example,  ones that include entire UUIDs. They do
+            usually include friendlier names, but the long, hard-to-read names
+            are the ones that appear in matches and actions.  By  default,  or
+            with  --friendly-names,  ovn-trace  substitutes  these  friendlier
+            names for the long names in its output. Use --no-friendly-names to
+            disable this behavior; this option might be useful,  for  example,
+            if a program is going to parse ovn-trace output.
+
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the  PID  of the running process. If the pidfile argument is not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By default, when --pidfile is specified and the  specified  pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs  this  program  as a background process. The process forks,
+              and in the child it starts a new session,  closes  the  standard
+              file descriptors (which has the side effect of disabling logging
+              to  the  console), and changes its current directory to the root
+              (unless --no-chdir is specified). After the child completes  its
+              initialization, the parent exits.
+
+       --monitor
+              Creates  an  additional  process  to monitor this program. If it
+              dies due to a signal that indicates a programming  error  (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This  option  is  normally used with --detach, but it also funcā€
+              tions without it.
+
+       --no-chdir
+              By default, when --detach is specified, the daemon  changes  its
+              current  working  directory  to  the root directory after it deā€
+              taches. Otherwise, invoking the daemon from a carelessly  chosen
+              directory  would  prevent  the administrator from unmounting the
+              file system that holds that directory.
+
+              Specifying --no-chdir suppresses this behavior,  preventing  the
+              daemon  from changing its current working directory. This may be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By default this daemon will try to self-confine itself  to  work
+              with  files  under  well-known  directories  determined at build
+              time. It is better to stick with this default behavior  and  not
+              to  use  this  flag  unless some other Access Control is used to
+              confine daemon. Note that in contrast to  other  access  control
+              implementations  that  are  typically enforced from kernel-space
+              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
+              space daemon itself and hence should not be considered as a full
+              confinement  strategy,  but instead should be viewed as an addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes this program to run as  a  different  user  specified  in
+              user:group,  thus  dropping  most  of the root privileges. Short
+              forms user and :group are also allowed,  with  current  user  or
+              group  assumed,  respectively.  Only daemons started by the root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
+              that interact with a datapath, such  as  ovs-vswitchd,  will  be
+              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
+              CAP_NET_BROADCAST and CAP_NET_RAW. The  capability  change  will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons,  specifying  this  option will cause the daemon process
+              not to start.
+
+   Logging Options
+       -v[spec]
+       --verbose=[spec]
+            Sets logging levels. Without any spec,  sets  the  log  level  for
+            every  module and destination to dbg. Otherwise, spec is a list of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A valid module name, as displayed by the vlog/list  command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog,  console, or file, to limit the log level change to
+                   only to the system log, to the console, or to a  file,  reā€
+                   spectively.  (If  --detach  is specified, the daemon closes
+                   its standard file descriptors, so logging  to  the  console
+                   will have no effect.)
+
+                   On  Windows  platform,  syslog is accepted as a word and is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off, emer, err, warn, info, or  dbg,  to  control  the  log
+                   level.  Messages  of  the  given severity or higher will be
+                   logged, and messages of lower  severity  will  be  filtered
+                   out.  off filters out all messages. See ovs-appctl(8) for a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless of the log levels set for file, logging to a file  will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets  the  maximum  logging  verbosity level, equivalent to --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets the log pattern for destination to pattern. Refer to  ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets  the RFC5424 facility of the log message. facility can be one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp, ntp, audit, alert, clock2, local0,  local1,  local2,  local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon  is used as the default for the local system syslog and loā€ā€
+            cal0 is used while sending a message to the  target  provided  via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables  logging  to a file. If file is specified, then it is used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send syslog messages to UDP port on host, in addition to the  sysā€
+            tem  syslog.  The host must be a numerical IP address, not a hostā€
+            name.
+
+       --syslog-method=method
+            Specify method as how syslog messages should  be  sent  to  syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc,  to use the libc syslog() function. Downside of using
+                   this options is that libc adds fixed prefix to  every  mesā€
+                   sage  before  it is actually sent to the syslog daemon over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However, rsyslogd 8.9 and older  versions  use  hard  coded
+                   parser  function anyway that limits UNIX domain socket use.
+                   If you want to use  arbitrary  message  format  with  older
+                   rsyslogd  versions, then use UDP socket to localhost IP adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port, to use a UDP socket. With this  method  it  is
+                   possible  to  use  arbitrary message format also with older
+                   rsyslogd. When sending syslog messages over UDP socket  exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified  UDP  port, accidental iptables rules could be interā€
+                   fering with local syslog traffic and there are  some  secuā€
+                   rity  considerations  that apply to UDP sockets, but do not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The default is taken from the OVS_SYSLOG_METHOD environment  variā€
+            able; if it is unset, the default is libc.
+
+   PKI Options
+       PKI  configuration  is  required  to  use SSL for the connection to the
+       database (and the switch, if --ovs is specified).
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies a PEM file containing the  private  key  used  as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies  a  PEM file containing a certificate that certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate authority (CA) that the peer in SSL  connections  will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This  may  be  the  same certificate that SSL peers use to
+                   verify the certificate specified on -c or --certificate, or
+                   it may be a different one, depending on the PKI  design  in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables  verification  of  certificates  presented  by SSL
+                   peers. This introduces a security risk,  because  it  means
+                   that  certificates  cannot be verified to be those of known
+                   trusted hosts.
+
+   Other Options
+       --db database
+              The OVSDB database remote to contact. If the OVN_SB_DB  environā€
+              ment  variable  is set, its value is used as the default. Otherā€
+              wise, the default is unix:/db.sock, but this default is unlikely
+              to be useful outside of single-machine OVN test environments.
+
+              -h
+              --help
+                   Prints a brief help message to the console.
+
+              -V
+              --version
+                   Prints version information to the console.
+
+OVN 23.06.3                        ovn-trace                      ovn-trace(8)
+
diff --git a/src/static/support/dist-docs-branch-23.06/ovn-trace.8.pdf b/src/static/support/dist-docs-branch-23.06/ovn-trace.8.pdf new file mode 100644 index 0000000000000000000000000000000000000000..f95854ffc2f9d408eb04320b90e0f0babcdb61ff GIT binary patch literal 56115 zcma&MLzF1NwrE?nZQHhO+qR8ewr$(Ct9IG8ZQF0(Gv0r{aXPmZD_6#d=tShoIp!i& z5D}wgq+@|19leSxgd!!Cv~#mJHgvJHx8ovkFm$n?H+LqWRiGuHHBlB66IJ>*3ftTM zdtqs0X=CZ)DP!tpYQy_)0Rmdb|2t1kUO`Y*S@hpbAwd;k2?APY5m7ZsVNqTO6Ek-w zOBd6B8D|$0dsi1;{(qsotBZrHiHj?buXciBC14=1H?o4_;h~o?wKI3IAYl8K zQKJ91ii@ce0lk=wp^K@AsjQ zlfK6$_tPEejf65s1hNLL!K1}C`tDQFE_y7l9|ewqdd14!w?`*R!zabS(+h@~2DUL{ zt={MZ5(r{@OtOa%bp1_YPn;poa(1tuAqbo**(*<)aE%Mv4i5?^w5|sswcDUqC-s({ z%|{OS2c2Ty?KpBGq6uYnW z`Elu7kc{N>X+OR0KhG!YS;9$^>K42#{8T=*s`mU6>*wReZW!S6CMVR-a~_PrO&F8W z=Oaes7*V>6cD{G5uIqWi+@>YFo!k}Qh$*R>7)OC2 zv4}r)m6`)^E|2_wG*pch?XpEj!m@>>_Q!s&lh}VfzOR;#o6_jb4zyk!j|fQDQ~WwA zz>x`e6zpGR8P$T?s3-DfP4`GM^ka59FK@4YqkKgjUDe~VI-euaC~@{R(ZrLR!S5;h z;EW?j`@Pw`NY(V!cYMp$cGf(7T<}FBQQE57gIP> zb*SLu+c!}T8}+>7B$ON5r#ch}pq&mo#RrqiX~GZFt)k z(@{bi($&bFSf}QnpJlhDq)~}?7`SdbeRVuYP^uSMc1qV2k%SkqCO1&=RDDWv_p^MM zSEMtnbqHXD5AgswB$NGGIf^@8sk*y%zqdbq%e}JKpHv$w}Dl7&RAb+yTa>ZbxpYQ4hlyG8{}4ZK5^ZHfbpvD?=OW>h?!Ec>~ZU z8Dt!0$Qg{^9Jnbc;f+`i1kIGAIFE%kZdTn~59Tn=au|K9X}*3`dLQ-~gDnLy71`@A z*IZ#q2ZWoK8F)a*5kti-?>OI>t{F+~2ox5d7P{;r%@G~2&rk{$6yis^dS5BTDC800 zm~A8%30go;xl88bK`whYE9<%AFa!GMu1BX`+sY&W zDfH2Wk9!`&D!FV+cwp1tRD3XN%^{%r)Bl2?5G@rT^>O>T(-E2jwNN%ak{FORB+Mf5 zip0-vmJo?EvA8D{aMGY<)>D}zO0IFiKx}XU(~dt#5)qPKR4coo25Sxcl=ng9AD-)Ji#fdZ_P%-{0^ne5)RWQoVD3k6T71W04s^E-A5^FaKes*4Jr4pM$3tZS1W}lnWky=AfSkz z5GI%!l7z}!+Ch2@$snyjQ=H*f*0`UXb_f%J`whrm#No6FtU;rRP><@6KRFFXGK@ta zL4N#$MQ15a0GCphA_Ry%tR%xArBup;Y@wZ`;Jw;MuhT4BG=*kR+M|b9OiZiB$ zY-t750PFHll25g@A=~TGu`cXXKlf>OTcG1L*t`4uEbv}P>;$+s(w6cN3Bp~Gacn3A zh11yIAMLlvInrEeWjCAf+t`-OA~%oQh*v0YcIjJo=`S!Q@*ezNY-xiP9;pZX2bQ2G z6$$lq$ZOzHz9XxN!C-y<=X>$SjTVoRGhU0sVb$H@g-|H>z3sWOF*p08F&U$9zlmV2 zQF+O&KBq8=rrdqZgPSydOPs8{azTzg69`v1iMJGeIR-MyEIGE{5{oYzootg?mfb+4 zN!8CdCTU(pu&BL87dcndPQ(yCq4Gy8>7~?;8b#I%_=F1ax$#KmIj!)#b3?)q1Q>J{ zNx33@PSZ!5xVEb$I`yTrqEs&-B0iItt0GY^UvlWv3*?KpMQ>p83^2;9+RG{*foM1e z4$1jIP|T)Fb(w|&-He2-kZfe7+a6Vkcl2V=LlVM=rc_s5wv0B10xJdNy?IjCfEJce ziE37Eio9ZG{z3%=fTVPK3&H^>uOM&}tmMqJ2=dL{3j8G=d|LwDd$5-3QoqGrt5SC1 z18jAQG2qozvLvXoLZ_7KM)(E45#?X?nVS%XOhXjzk!32Q6RUh|VbM=Tm%KIiHW%PB zgE8QWVi*7DB7p{Bj$eCjvbE?m1YERv#NriQo^2IeH%;9wSWI+^jZ};;-u3&v(l)K@ zrRwr6(L$yA`{uOeawa_@gwCXZ%SbtGB#KrskbrXfG9~jKP68)lfQu(Jrp9$msBV0TThZ8 zEx4Ntl6*fv4BMKtXfob@MWLteI#Rt>x|mD5{pdkY^t0ORSyM7bBhu3~w6xK|5TT!9 zu_^0aF%{t9U%x)!AWQ^L=sFBIaEUSwp`oC3as0Rz`DhR#=JRCc0MK)7$sOV85~OkJ zF0>jY#kL}&i+W3be=wqqDqjFaeOLoDgQ&hM!C?i8-%64b%53(Q$j)80X}q|yTDzJL zTUVPQa%lk36_z>duJ`EJQ3wX<u9AKXbyB~2f_>+p}v zMB<^;o)DmHT(dkVT>mclz`X8yfOyYKw9+0$y$;Tdl70Dvk32hO_>EMji)lM~oTZ%c z9t3XW#7q=8;7oSEl3Fpwcj3C@PsrFKzGQ>&|svs7UYzp&8I4D4B_OBJVxI}xXvoTJFCd-BA| zpJQ}{eTI(oN1XBDj!yp~>CAC957Dqy5-Asz#38>a`4Ue!uXqGpm|_I3F$suTd`JZ4 z=kPy*@`;+Nx(o4%SZkEyzY!nbV~Ejgj&|mu2Rd_4Jn-Kym%#Hz!dCiyPE`r>^hJEb zt$$Orqf0mOFZVS~9L2s@C4VFDpuGlvLFPCa@5Vv}fXdPRs6djVoY98d)_g<@{q3Aj zZUgPea}F}6%%$GiKm9ed-p0UyJZot8# zfD^lmnM{EXm^bJxzO>Bx6qIfRQ4}oBB!g z;JZH%M<-m+JmQboUYqz?0-cz+`U^Rs2z*CsHPdO?sAh7$d+O? zl;bEwl;$nH4@?8Uu2Y*IGTo)EBTyyrPiC>YROUfbN-FFTg_zOrc0TjFl=u;D6((yr z2W$;qQoa542eZo!rp;ZP(P9&HmWTCdJ27`-a>&)m{l@nD0q46*9jS1=yR$r^DeqZ_-`mO6m0wodYM%G2FbA&QW`06C05u-TVyYh2RNl9%^Nk#}*AYoB zsaooBVCDY8bwO8ZNZcr4dpXTt+dIsZqAQl#jnu#bA4zj;nbA-c)^x^2RmXmnsD>gs zlElM2JM^)rzT0%G;;uyN^RvW(X`(@D3tSOHA)`5@1yIh(K_^~0H9X)POX zvXDI@$5P&{sowFuzP}mj?AtpW;>Fz*J&Bt7UX``K=%tWE&q^pJ$Aazc0+hLCT zpO{N=+r>MN0LxelL^Gah22I&%9}WD=Nmg1{t`%`TPpK%*QwLMQpHQbe9cdI2%s`sV zOv|x7FVnTX%j-F5TjcC$lFvjJOPLVPZmwZ%Ph6h`{J7$MYV6N&&BR?*%W$7Lu~#Pv zsjIn7*51ffOpNov*5I%;0n6Ben#!pO@5>FGD_o`QC;(vMT_*Je^2mBavD!D602+-j z?WP!)xaPYGBk!b}W+0(1XmS^&E$yCbDj=E7;Y(vTSq+5o`r;ho?p#|-z{=Y*YXnS^ zkbL+QZG5*&1-(1jpF#Z7VJxQ&<(2ZM!r*cpo3z5whpC`Sf7jaHS2y35b5TP z{h8K}uA8@4fXlH$!hN4DZ6}yU36LIKa<~mDZr9*ABr=g4a+S|N$vRen#LofB2i|Ed z^Pj|`NcD4Bq^Jh^G>c&}d~mY-EQ>`=ZP%~UYAq{bS<->6uN5d7qIsJVSr~;>LqyY* zp&RvH?zOza($vsO$ae9}RqFXvPzo{3zr^X0t>gqjS;BzLhM7i$`%QIv^^M6q)47@- ztTnPn@cKG-OgN-;NR^EQB!hcHeCj?^G^obalf%qL!s!nyB~bGt;lpjAtLpctnpP)Vi@;m3QJ%!=nsCUv@wp za}yvK9ypj^THZ8!N96Aodd!us1aV)O7Bq;4CGc{#AV`-enXIVwqd^ zfVm`o&H4GhWV74SEH8VUXwz{C?$tZt$!H#{Y(`NKzW%4Xm?iujl+WMw5K$_4fTcgy zl2*BthtelGqU+pK#b)E8AmArEn_Dc|eX{jwEmel1XD{YMSOW}6vEz@zZK{1pBVVPv zVXdm@Icf?jshR+e7s5Tjwg3d*sux@yz>t{p&1Egv^7;@WC_Oa&egQ%0sH~h3J?eZ1 z{4g>i6lp4npH8q4#L2>HH%C)r$-hJT1_B=%K#lQ`3U|g-ciXKiY88$+gIc>9c>7d2 zABAq%g1Xl#Qth@fv=x0fue)6n4mDgDUL}98qB-HDr-1c@;j=|$Fp!vbBbF+<1`P_R zt4pRwLE?rA5n{%c(;O`AKOTsFhQ17=hp8=pUCMM%tCPLqLI4q~98@hxMpqsjGVnlTVL; z5!=|Uz*I*p)ZeNq3?Xp?l&2{rI`M=0eO@&k#r&XT*%e?l^K!cz8k=0ZsohZF=Q&Vn zC>RDaaiZ1`32jVjxMk@#S?bz$Ex%nni3|b%1-G+^2qBRFSwU0cEA^@^_jn#kh1OlI zvqCSTuOWe$U+geMn0f{xqi;pktihCafZ00SfRA~0zdfQt z0|?f+8$4?n5BT6ft{M+&5%2Ljn@a|jG27gg6e{*+<#MH zJ$7kesB3O81;}4OV6(X>vJU{MwE%2LBB))9TLcbSBt6S|NVqTZqmy-yIFhBUJm`Ek z4@i-LWxLG;P|kSX9S7;3ay1#ax*a-4lk~3?;GeK9tAG&Kh$<3J3t8$WR|qmjTyFM? zw$aX`g$s$m9|^~YeBXb!;>B9%3=Z>a;q+(!MwL0yQOT2sTw2)5E;2(fl`b$t9G7v4 zMVvCk^s2QD-v!$i#y|i)Cz~=1AXX$m_P)YCc$Ja4sw{3(DTfe@ zalQ~Ot{bJjUxSSTXoP|QVxXeFQZQV3<>W;LRr^VEHvf$Eg( zR4flz=Bs&aSdX&HzJ`81g86$aN)3`)aHq-n$5WVV_3iKkHx&t?^+MB6{fRBy`#hsr zv1yc25gbg}U0jd7L@7IKC?lIFyvhD9apqRL5)MFQ z=$J|pHPCu54QbWDqoppNZboPr#7*lzn>FnW&dgyd+&E4#>5$c38H=uVyNR-#9B0l(wVd=*U zhHP|3%AdlZ3@&ZA1IQIES!yW*kIb*aYn-QlZJ?u;f(Wt4&RW1IY+GU5I88^->=eVi zOjak`;Q)rMNY*i5(dQx&lxf&Fc(>@<%+sw`VNN^`j~W{5CnMR7{_URrX`&Vny@^}h z_Js3d`cUUZ0j-2&j^j^lnf7IF=a@trudtp;;rx>qpLyb_+&P4T^JDZ;#B}n_<&Oi% z;T6rFRiPss+zv4@F?LYCu(YYjP85k!?^nZ*A%St^u4{u&(qerYn_9{JaRV%&8j=(E z3*o-4&b@mrpLf=@DZZP(Lv*^}^d4q~SWmj4DbFmN7644lY9-JqWs#sFU)_2Q6!n7! zOhghU+LNLYPqC-HZ78kjL38Ab`IO#=AURuc@#9=BRglL<9_4Wd*s{eEJ{(qmACyI$ zJ5ujy++A;a;bZs1%hyA;3qsTqgq*5JHj3p(O*5DH^R{4S;AoA{(RBQ*Uf;Nz~^9Ox83Kbp7HFgBP;jm193srw0=tZ-g zKOS!76PMg&S8)J_P9>z!{`Rl;)RR^83PU%wgK<1{ov>NJpZ|nSP&PBV1Yyd~O$L`s zFW&yG_K+j6)V}=pgFT>UG|aTYPVB|u)8y*EXvvwxa${RJhwSZcLcT?v5eSqC5|iy% zjo4t?dLdAunsb|4%T86Cp!0#&yjjx{uOsuxw|4{rqH)YekIbwcgO)o4Pwqq70Q^dy zua%PDYvhT#cdb7k%r&EyHh{2(D1wAAWL?FxRQN2gCPOYEbl4NMtte0PWc&RbI*X+| z#zf&%@dUYre+f8Mz$>PMW7Vs# z4=}iS7R2+2qg(`)P6wM``3KK?>C>ZRG8P~uf$VWRX{iYvy~X4&O9_%=A(miy|4#?Qg8(| z>?NLdrLgFp(y^rgDOL|CM>Qg#_eC{ zZ~@<;hyrq!0Ra+buX3a_s~Wt-PG~mx?M3~EIo@EsyR53FzQf&LAk>I;um8f%|M290 zxRZ^M@&DsaCdU8rwMg$A5Hc=6i64S8`KAz$a zKw$(61OpJc!atN(=(ly#VF-}em_w_+o(eGYbo_MA%=?w}mW+u1d*=7Jog#lz_tS0k z&?fSmbUWr=RYls{GEvw2&N>2KHJ$Q-K+H()h!DSgGhvO7R`vUr=uS^6L?Q`bM*~&8 zO|J>36BN3Kh93P^oqvF-LNAn@#gtE-zL6nc5Gir_exmC!u?w_g096x52{GgXSD)|u zn)aR38cs82RzBvCj|SyZ{_EF`()dUX@U;SBOiAQnpq^GT0d}1ayOm@ztkTv?N&Q;^ zjRYHlPp@ro?na_(VAk)E+L+9ru`C-?dSe=oMzY(@q7SoE+52xWSP}2F;Tk?zrR~Ar zGDLD|w0V)x@R4Zabh{o@jQXlftF&bipKzNEJMdE1<1!|EFH0jx#(ciRtxt|*-K6Db z;`7Ny!b_(tNnsBJg;X&v(E475OMVqw@Y-?Ji1MRFXVn{fQ;n+aUOIPEW)lomDYZ=~wFy2NrOZ+uscxj0uwB{j zzi~Gkz69R|SdFf_2f$8eh67;PsoctpOm*KI$*LSE8Yf_#f7He6vU3;7ZR- z3nxJ%My9s9X7&2IJ_>qa73x9&VW~%Z4?dEy+7KlXGi7R^$)VxmXiQWtN^wCUl!K!e zZD&IAOb`a@X1Za}Xh#~b+78%>&6Al06VGx>0T{BvL(_>Rl=**+2EE%7a~Uqcy~_IG zm3!8!mMwrhuu2LBPA~C)zvUmS06{a!B+q>Myqq6jwqc4WVLcEU81o9Cu4-Ouw^I}* z34_56LYJ-o8d`xJMtg1uv!)c|-`NYmh~=_e3!uOhEObO;qeI3B>yGXSpP+C^+XNJW zM#@%d2>}xLznu}fZMu3}KxuYgR;w3aN0?ME_$%UNn<61MpGcxsNB2YwD+z3UljI13 zE~qRawUct#WY2mjCHw5CT8~|KR&RpB_Z+ryb+4cya(YgM?Pfh3GHk1I3=bV@bpC7; z)6k8FjV1$LVi@3F>?bZV#_TWZUp7HlCJ&`9fC11TOp!l{HB2gYeuOg3`dj277_NJi}L*j{mOQO%0KBrWwF5 zW{Fn%wgmH!G#S$CCb-?=+AE+$h_3W1qajUH*?378o4%6{=a&6rhZLa0X8r>Jv1D_} z%X{2J<0M9GoeCyb^&&twIX3TPK;~J>Iy_+FND>HzTotx3jwheJv+Am%1LSKWV`CvfNu;Ra$%mOH!P0^t+#FG8_a_Fbhm??L^bB*1IckxmfEP zyhA7nM4)AR;tSj`FQAbxc-)gsN(<1qKW>q6K{?tu_)~c)GUQveY8Hlv5pTH#yl#m0( zw?p&?(^^G0SYtKzEZhaOoVNig@}UmwnFGVZH4OE-5e$J=GbE=yV=xdJD-+k+5xx|! zY1ERfgdPn2vlUzK!WG0w%Z~*9ebbA||Bs447bZO;LqUImGN*96%;8 z7r-SupL&2=m}C)5;K3F?pB;K%cv7~9OgSP!4Uh*D`Czh%xz-Pn-e%z@#WLVlHxGd} z93nrq0inUmOouwZ9clOFXzo<%2(YH;grUQ3!?dgH2&_`dQGCo2sWF2jYY6V6pT|wB zLOkMdy~bUa*25nGeJB4Hy0IO9gg|PZ*;fFY?AW|jIFUsQ+{ zNn5B)1f^6!z0BuhM%jME9IfJ|N!93zwzuIgP5@}>Lg@U_nTcV5q>+A0vt>eTEEtE# zkHp(-IAE>e9VYEunlL}Q2@t19N@K zhs_0km@}`uF?Q%ZO!{2#dj;XO8`c(vy3svNyO|ZDSC0-Xddk-TO#70PC$qJu{?N7bIk2PWufz8Gd) zuA)QzpKJ!;vSdmML(sy}S=}0ZRI<3O#=$o(_Ny%7U$# z*5qu{JYVjj%5mYVy(X{7Y~YO7+=UL|J!c}C)oofmJtJm_ObMKu?kO`$bHB7{08k37 zTw`X0iUH?k*b)XLiI%u2Bp}QE;!a|4CFsvws&Iw32+B@3qCY^Nluv40(01#FMrt&x znlUYK;yXqa6Cl%=rM|<%GTnRLlfMxJLS?Z05hjn!UWX&o; zCZb-ACS^D{@X=1+qt*uiI0orXSro>=Ha=vSbL>F+#d-T$60M$~G^WX4;$Vnqr+*K8 z)~IA57$Jc8@W4c>%WT3UTa_2pc*KVYJ#}Wz-tK&NezI&&t`UqyObrhKqt}JcTe7!1H<PH!HyBM&7+|QPmX1Kx?lIEOv zbF4Mz1QfHg9a9#=!DlSqd`S-b}CPbH=GvrLt5;>jpmq;tk#PGUC$6+vR=fb*n{ zGJ@Y9k6t`Y$kX2Q?x?<^ONh(BQRuIFjKsoW-Qw-8OE7c8bTt+y(uh4e9VlFX2J+Dv47TB#@9Q zt*#)&zJUUdzdXBO^$P(?G6^tpZKx}`xt)U%An-x04Q-;#R3m7aU_egxO3iyO@HYbb5^f%F&V`(y=GxiX^_b*Q@rgLtE`p=em2rM+W=v3 zF9R-xu9hCQ>IN{|f5&9Faz|AAD;I)Z2Px8)IX>5JBgz1TW3ry5+DumWhd!2%_5&TD zbuqh^*1D`}E=p)05qbl6&O-t_>VyO>k^Cycc*{NB=54I$s}xoU6(l;Ud} zq$g-BUpn8I5t7dmCBMEWcT-QkQ<98`nM`#h?5`r2-d{lks{6NY)oxFAutZ<`yQGqy z`kM~aspXPd9?q~48liRO%tY5=-7`VlS1IOqIgpf3{Y+af`A52-FxtP1)N6h2p8+ta zZiCT8mJ>*UmO7ZQp*d6hYc7HAee&N06OKiE+qhg_?%SLF1xS^C3-~V}{152;2MAdi zIQ}0H{o=qP^c|kH&3vof zujtj$rL|mJdfy(({zt)=NP|ijh3j6^b)VQdK6A4TbZ)^9@^HcEFKK9LnE_otp`+=ZuUNYvB&~+yRl%1u&0`DX3n8SrW%83l5 z9}Fccx;weuYwk0cdD%;0tws=>)wroX%=?Fay{o6XuLf&F=FL)q{2pYrA&u9UDHf^0 z3+?mXKlg;gGj33}qowguycAob0=u>(7nbsy09QhMBiZ=I6S93_P?qd+i~j ze^T|fyHg|h1EKTKNz3h)t!Fs-3_`z01z}R6H;oBT(DmGG0PVLLgTqh*Mk{dRhDr@u9spq*ma5%3>CCIz7jT<$y{cVo?cL~2KV zXyqSFLh#E0rN{0ojkdJQ2l1?C@Zogo;y2Cx&`6{8eW2&16M?@q+pLDCFX9==|D9?sa=?gfuFtRj0v;4;ePI zf;^s-$n6uak?jWj=u5*7!~LwDW!zMrv3^hCZ$tu%=~{KzP1xQ&h^~5fpjB$|JDxu( zIlP0VHutGyNkiA~tY2#g!5wHPl5=*nc%{USv1XTMA!cHWV~3^bh2BeYxovkVk?`Tq zA2_x@G|Rl117&aj z9~L^O$n?}L8>i!%qD>y*p;jzA&`iw7ZH5FY<9Wa4P$}%Du_yXC_tmQ4L`g2|LuC_Z z3*GtBjPPOcL^1Ov?f}}Hx$ciD+ljJDgN5nYiS1!gPNtYAf~S~5gTyEvH1*MoTuF9_ z8#U-!`nxQuEQc3Ne577uBlx_E?GjIY1?w=C_x@%>n!TCG<it5F8m2x+Mj0BQXe`Y)PPTxf(EYuz{Q72 zVTE(0nRH?7>ZFo#$_gD zVMDbCs8yG57l#R7x!Gn5+pMVow-8$EtzR>i?V`Laq}~6}ov&*HP*OhRm$l`rOzH&_ zi#{SfW&sWr1$>RbSn}j&=jMEwRe)Q^QoD-eMa+(&?)rS!IIwuhngQXE(unrx6Xg8% zEkAXI$z*6ACEIgU9ugaZy(eschTpz|#x12$V+d_WZ{7b8idANjy0&&9?s>-VsphuI zK21O5jx5rqg|?8P)VmsSD<^k7bXNyO;UuGsNC_F2=0wCBFei;#Q5$HbR@wCv1r zqT%(%rYVe_OO8)0=fn%m9e~uTRy-3h)sp#{Ms3ljD{b6E{s)e-Eq?H=06@uNUR(R5 zJZ-dkR6^3c#BvJKI!rq1RFeaSZHv{Bl0~J+_?^>bzSV7q)5fFL)VIF$n_Z388=y`s z5D!ybEUu#Q=#3R1H1;+)Fm;BCOm`dKUfCHP& zF@#JC&6WqVAk@>L2C^iH3d_U+3La8~pySnPt@JY@3nP4oBXPtQ=gF8_g#`G~hg{T| zo~yjZI^mdmXNj)hmFnBwp_$6g{qz!fos&gaRy#cW7y|bvZqh>{=5EP}`ehNaDg9RK z-)@3b)Kb|~L?KqUB7ZTamr$3BG$lDx5g=Q#9|8bA4jjOa-$X9gW3J=^ps+h^nLS74 zPStkq0q}sDJKE?C!C?KmJI}z^0jQ8-r+JNZcRdZZoT>r1O+;}#em5pQw$327@H(=6 zQCq|v&!99B&QD6$Q+&W(VS2~|vU8VqlVjTvg!!fEp`<0)ZJV&!X|ljrgeWywr^VgY zHf8i4c+sPG~(Pd8#6CB@3vN{++ATz^yaj!Wz2Eg~Bp z_)tk=>`sj(vWJ98qe5O_;#@GhiMF@TGOWlghaSu8O&Ha>m^ObSYwdOxl)D4hI&dxX z*?v{F+%i`qJ=uYA$k*%5X@Ae~mn&JMt{T`TIyWwg1$70rDylO(gNsJto6LED@JCUE#y`N11C($Uq!VQRI8-AZM}>Z^D$=BU?(ymWEd635W4QNGqE zlUi*B+j?@*?r4O3C81p1EbL9erv47|N|h&-0F`SvBR&;sn|d?7GO_)P8KxBff>3GfQhY|GTXb{v_f&8kK|ROKtEoXB`ivc zudz-0Oi2_15b>sBriabr;?NyAfX($xY3g7ZDR(wnkuHW^3x#9Qhldf&*C8r5r>Igf z7e;I$z)_~fK|Dj1b(PK_*MVsu8WA+vpc6b+2apqtlX5x~$INI`ZmvigI8OvngNnPU z7WbO`E6y?&khCO~-gNW26r6%}Dpd9Ey-xj9Q3H}_R(qHnP3;}|27WsP5>A#M1Ofo| z{6PstY^9(}v|h)ILqsaApICs>?i_-8z={Qv4nkLtSC-##`@$s>7kLqGUXb{;-g!_7s=Y<## zw#@WoHhX6;rp0#Oq8$^UuU4EVGw%H?tjK}@ReudiKp?3T2x5P`(yDv}4%GV>c)DK7 z2QgD0@8eKNHILyX((Mt13zP__cy^T#(IT{_QkvCUNqwDI$f<}~09#~EG_Q3f4bkw1 zya0m^`SNy*IpyL%b|2dNns{ z@7t`NA!wSZa}=^myaC-GKj06%_T)Qz&(5cR0boo&B7V2&kE8#nCXcd2j+03phxFlz zMCJM2hcZ5zNF@z{ zf$ra#lbg^Od5|oEYw$+;-n*sFCu3grJ-?{BV_nwb?$Q47j1CqAaPraT{OLi(M=vc5 zH#0n%K^%9!Q_9pSI=%2sO6DjtOkhI(^t-o4t9}_|x{Ds6VcD-58kuDX<}bV}goQpn z#%;?8aV`@@{2<84Oo-lQ;!OzlZ{>f%Uop}cp#VnN&_4UyUkYG@Dhef6%(7}|cf+qb z_*OO?Kn!7M7^{?bVn1$?3LfA&d3`{8R?_tm*0KLSth`DO2M}w>@bsLA;sA{$0?1qd zZIMp3*Mmw7BoLpqYO?As{($Gp>8cCdK)eXBhb;lhSg9SGLAous<8yEf&VnOGNlSDX zg^{*zLY);l*##Zn${OK1=SIBGb!`|p4hxN?#lYuKm#uljyK(m^7T-yViauJa zdKxMia ztUtf<$ZF+`49~j`m~e-ZBVu}B$Yy`yGNBD0KNwOLlRQ)Ntlsqwgh&NqZ42qIK%9EDk$_SxFU5z!`**PSM<7nZjQZ1OJRKua zVhLKGc}LXI4Dz7odJbE8wEq=+Jm4l4Lyk)5Z;pf}O%%?K{B0K-8}>2~1ft=oiqO@M zYPHJcYx$x8TaWC&O!KI?PF43i#V2rGpL|dV0Q)4P%(AN-OKAH;A6ppm#tWzs8{b*M zW00$tBl776QkVc+zb}t)2IUVnR0Og@b?ss7$ zk=`ll(~CWTy2qK4z*6XGa*rldr|x0h>DEUU2HCwWQ^QG@FiOgOwlek?7!W|nK-~A> z5YUT2FFte-WC7vgDql4uJMPQF3ZPSgyAd)jKD{x6N{|4@weAno>;?sz%=^>L_Vg++ zsrE21q6y9L;y^{ls(D`JB?TA)>TqS2iN6VqKlH=ckO2TGXc;5@>S&c{9b7xvE7LyW zgS5?_K10b;siJCHB*Jag^qQ^L05vY|6z-0HmgRV#vqPr^YE5k@BVU^7Nrz6XD0H5~GILtXQmPEg6kB zRB6#qg-TOodXcD-FSU3F7~kPZ2sfSxm4(bPAP2?KtB@pl;tZ~{G~xAhO!fKO_NC&b zuvr9G*2b6m>&ZKB(WqiI53m?im{v>ghby{rOZM=1LRS;yJ?L;yFX2#;rmnd^ls(Qv zEr2S!)N_VcfZF2e^iLa`l=!XuND z$f}UraxdG5cnbS-?pbKoE?d#=XS`P36G6UrVR15ts`I3X?V`9aVuBoP*Ey04W)ot_ z4#wY?D?B`okX^}~$W4`UxyE`aT-~*&gUBc0HDaM$AWnl2f{>xuJH8{^%CVyvej5n2 zV3F9J4BRY|B}|koX$VTsuQf5V3Pogo zwy0+R9<*q zJ@qrN6douRGB|OBYokt*3~C&Lq-+^?9=wn>XZN&HkNqZr>Z*~)TaiKdqO#g)h8Vbw z2kC6QnzApBH)4+Y_{(-UN0NEYH}h;w>7`>rL=1gNX^%9gJU>{Q_nYY ztoYolkGPb#bh_41M;fO=x~}U3;?mY%r3&$+dERW_L5TE!9p>-zbKZtvuvux-Z32~M zx{;x^*j$`lp^FEj8IsOe@qXOi8tOT(D_H8;3Ge3naclO?FXDIy*Zpq9?HCi%_sd&Z z6+chMboKhv4fU!OOQA3xVSUM-ZB=V~eNbtZ0hz*N+8+t;Jd!X+KNEKN+%@i$=gHNj z2zBmro5Yw^uJn1jm2|wV{$c>L8R30Vc5)ZGG}zWRdF)rByXIOnFCw>EMh>qRqcXZ_ zzg?osca?-bs{O@8Tr>N9ZcNa^yrKxl9uY`grDAyW`{i-^Ayz|Tp*5<(oHqo1U;Q{C zMU;lBvm*+HV#ElvZ6g%>l(nm_278wXw_ZS^iMv?Z`=?{dAANl9RrvWeq#NzlMVlKl zYOkdz%*M!g?DBMJTbQ>cWmU$2p^El=hAE&iWWEp(VjlNF5Ft8FKfWIMM6jO$&k=Hk zemuxMd*K(+h? zJXKIUZE$z11{AzPH6uT%SgH@KJGv}YYBgMMpx3jez<5R_66t0xkVd8o1zz&7qa ze}Mu;v>n_`AEXK9EWw)s$1^qL9l`GVn)Wq_u?3RpR~lA1lpZ=O-#FK@Z|=hAmYa1I zp7mITHy)Ac*zSsb+hypr$IXMVA$lMsQb-7rLQT{L?X3%skFMgoUl|jrwkR$h$w!SH zg0HrASrRbC$LLv$M_cx+iD^7lq!}@nDoDr=>yG2P9pDXnf+mfJe!}C$l?amD{Keu?!eJpIc3?V_~gkg9wE6G6| zfide#po!yEYHy>Iboh~%?u85mT1#_j^WJoc)uYizggTvD(jTK7l$8zqH(PdJlyLVbOOzak$GVy{ClUwP;` z(a3_aps6?P+kX49J6|axnUmUy@00`<4EUSdeXBP{Z$8A2vFrzs)p9!DQ=uI<-OtJ& zSGZ}m4bj{_C~%DhWouMkpL;@^O7^=YM+|Ua`0sH08qnW|bex|ka3Ja`RuG&OKB{4+ z=N|Q-kfQ<^Qu-qOQlYUOZGX7i(}#bdbD1QIQs!AyZTqs4l-V#GCabJ{S6f=%-qv{A zOY#ktc$voQ7L#vzYJK{`yT!6&{o!%uRt-I~p)6U<`Y^my%ex{y6_dLXH~+HzLz1cX zrcd1}d%U>4d_P(iYxC`0!*Y^FJKb&Wa)L`ueeKug)K0BgSyV4|wO3^Tjv(XAD-5(Y zYR}ezi~S)TDvEkdq%xYqn1hoBni09vb_IeB@MqB`a@aD6BbU@00H0%|lGN z;b`{evzg`Q>4+n_Q(eV1wVBWSbS6? z11g)Wfy*@uT^CC28d`KBn(yfFZ)_DeJlqz6*3%;g1iqX)i3#;8H|>U&RE;!sEOQyY zQrCFd=hRDxGptw)(aYQS645(>yc^2FmK%pRk)RNv0si<960?}|N+sYfM}q-7aG^`D zGOcK}8D7Bzm)Dja5P(jXuXcOSCOtgR!Nl|!8t|aVK$aVT`bry01nNR)#q9VZf#etr zA!dGZ`|^!u7ROQJz#Y!98+Jur4Qx?I9k;>G9JGY6(6w$+Zq-&uD#d`-XX$l+pxYR; z%~Gh$(ua}e5%vUz!^&+25chI30!>tjOPHb{Fe2FsJMGOa4$ji@Ei;_RSX7~V%=92- zMYEeI%)uAgYq-S6h(%xbmE|+W-Qp!7tnk7zI+j5z7R*}c_Zu24{g61-yEzbr0T%|9 z9M^-e5OfXjByNjI-;+#6!zybp&HGO?oS3h)DzHADU=!9fPmlL=+Q^ovHrG6Mb7ZbyuZ zJax$K9&BH008ON8Ubl>a#^O_A#W|+Fg3s%!jy1nW-t4gWh0pC{zk>$9hB*%=*pY|0 zhSWi^|H6wX1-aYuL*#0XE4;yLOUH{6DjTmsVjk=jQbOp$tH%uRkgrDw8!jruQZzgYz6L_@nftEb+cjK>eAlpQKnRk!v`y`Y@U# zQdf@JnFUO1TvV(W_7d@s7qX~ea{1T?%{Sqb^+TuGxTw6g)e>T|=ow6(m0_F_-SG3b z8(%33w>iH+5rWeyF*I-IfGy;42j8LOL*YS|Zut%sH;B&2h{s@K72ZXM!d3o}n)beK zcUvvf76!S6R9WHVZ9fz!ck`6`@#u=Y5s@QW$S5T<3Kc4aGPZzT+C9h@shj00%@O~rS@@NO}er&i@q)lu+KUSv3=3Zbm2;u~Av;8LxAm?Z58S>S=#sG#V>-!cVT zk}&iOII6Z>d>yo}^VAJt9r~bcWJ)S%$nTWv9!M32lalhnf(q2STlP>Da80TIo>Qt6 z7t}^Ko#a#BoI=eN&s4>!!X%Um2zdfs)Je_D=`ab9II8>W&>@K#IEeD{)=)CKUNFOFWw zZ-x$Z*&H47qUP%=^CCfx4v`n^K<&%m7L7A5`7V~v*6%~C#1yp@Dfam`r6&lf_nlmz zvW-$WQP3J!Tlo+P$h!!~kXg-ISJ&~dG8i0k7_uEy`ZTw9Btqae@d9YA?=eh9rxTD|xFdTD$HgB>gWi~inD4r#kkA;?-J*+Lk^K;% zlzG^}g1|YDty@xsu$NDQ(3(%X@`2i*ZuSo+uM8;N8u4`O68uJdZrWT_tX6`+co*O~ z<};6eUNiL;iY%@`BJU-idz>c>9Db8}HBK(InkvjfGbW$g@M<`@hFr}^vA{ZS@Rc$C zXP-T_1*ld>Iyun7IMLkva;6MyA+>TF{ZN0X_EH@i!DY=t~8RClhPP^<`7Dwq9v!7 zko_<5KbkPV4Gq06t=^XVkslc#Y(1x?{-2$46 z&Xumdjm6MMPjEz-(q6$YOQIVv8iA68XU7?ixUkG=kfRk6>Gaz#%-`-*D>ACBKoeRw z@-J>Xuwnah>C2v@M&Zd_t{G~62WQITgb|#&I7KQiG004(Bdx;0Q6x$ZF`OPM*Ohkj zE4kjt2sj1b@zA!rD9HEv;ytw*ASW5pT zjZM|NGjuLcr_@2{j0jSSVc6)oh5YH_PJSK3x=&~@iQ;pMR{F83W} z&RVTZDn~;96m5IW`J$@FjC)*YC)@f9i}m6+Iw&$H1FUFzb~$_bbJ+QZ*(uHFVBir3 z$rn{iENq)jYiSHhu1@&vy{M_EjKD>$(^2?uG*7ACq_ z5k8oBK3ONR1*AF`vm6=-aUfdxcuIu02x3w<$(45-o-)y?q`_9z3!- zL_w5kYEffqzLL1#e4k|AkdmBu(d1*WO7AItuX9ZO!I*KF13t=sDS}fEMo1oo0S~fh z^T8ruD?4)byfF9G77w3{u+iC&BHndRg#6ga$yDD>{catVvyn@)rjJ0VOp}Dfykc)B zfKFl2z8k%Ef1+nOe|&=&{q{31r!RD33Wo#lP0t~Ru4l9vf4nf)Qn+4t4jjZ4#a+YF z0ehP4*KgcIrZGdM&|%EZ&}-+7xK3r)rs`2vU=dR*EK8}H{lh`dpiYccAdAe}?@w*Q ztq$kZ@Kl%u&pS^>U-H0p#S#ig$|{QmFN2!ORSl~!6`y?BAG(^dE>+w&A2ui)K#PG~ zuPCx>wgCsw^f_};=^y0xz4IZQ4u!VhQ_xrSs`sjPfU1e%rCV;{U2__vmc){Ij{qH) z(l9X{%wyVoMCDelV#1eWa|U>Q)sG2tyaZu6>7{oEvmzWX-)njh^7V(B6NJwr z)4Ml$kuIZ@G8LV6PG0Xv3!OChJYL@Kt<<3nugIo6JZzSJb$gkjY0CBTv4jSB)UZAnJ4l@enUA%-@3uTeV(X6zn6Yd)&X8kwK$>fTmBRy$wtX z3BxH>N+p-YohE9&gCXRt2W+a}2LKcQ5UqgZHuBAex`Ebt61lUUP7K z|CPN*w}{f|B)$*7EImNr{j56WkFKmAppOV8N&jlgKiTNdwmcWxpSzVT9RF&|bN(G$ zzC!cYu{p!q)zn8wEKQVKFC~cD?Hhm5o%1mzijuhSecl_j#k!cK_deXl!0pO6D%xj_U*=KND@yCak6FB{ zwX#Z*u?9E?)>FzqmtmN(G$F{OM;t>-WuWJK4CZ(dI_xPjTWrV^5inxxxdCl33z?wWnK=^t#I5MS$Xq#2GV!x_Y_mjUO*7of;j=hplFJYF4 zRTK4IYICt1!XIRB2UyTee7?j`ND=4Vl+xR?8xa|-(0k(D>!8fV#m(;DghuqRhOe8; z%TkRw`p_I?m4*oF1ZNhfy;RIHM$(#$=mu}WGf@Z%Q;&U_HDpC*`w`t_`Qi*a_f=Zm zB&bd;RX%a}f$B6@g9ZSL7pjhm>MDJrwb(Vjh|Lr#m?Zk$fWDqXg?IB^GD-u8U?a>VHE3~0Ve;><| zERl>QT{O)UBIjF|94F%Ua z=4hXYwkQ$a+)6J#Fvj5uNhjXMCy4WAD$-e8X-{yZ-08m|GS$6W9e0{^B_)GfA_#R2 zOY*>&7Mu?|tt@McND`TJXi|RFO4V1Rm3s)oz*JWrO`t}CV|J5#8HzRG|c^jBo{And#0XfvL z&@A*S@>|`=MFRd;Zb7UctX|eyl=eed`pkw0k71E94OK%gz1Jqd?-n&UT{4}2v?v&i z^aFv>-O0}OcU{Dz2WNG|hm+*siI#}b|6G-|GfOnwGF+GxjuS@14cP1i4UeWYOcJz* zs#g~kX!m-sS8`jdwHz2%?U)Or5iiZ)-Z-ynH(-icY#cEMyafw!H<_;pw*{a4BC@H{ zLM7Up8ZF*P0uF`En6%mL&H17~z9@dHB#ti|bsu=5XcL!}$cc~(hA|3F3RhP9yYn2@ zYC0_33u_JV&!eeeMr0$(c|FaB7J_n8rDaRttnHS)?JCzAG)$0Ibmr`B!p+f2F0g@! zwS?o|D-mwW8Ompw;4tBW^(p5^I~ovtxOa2@!KbJvT#Zd>;7Hv5p#+EMGS)8$$4b)4 z62#1~E#6GpT1}wNdrJb(>~hB!rxDC0B-0cMjcuu|lKSG$s(vJ?j3Za-Hms6YLwg76 z$_5RZ2B-7>by~}J-_~UQwFIsbH3C_FkWO~qP#DO8K63w*Z=`DK&Hr{aPg z2R@*08D9#2@hf!vJ2UVl1se78?b3eh)_}3Rz_BgA@*nw@LO}^^skgS|I` zZ=7Ge^zg&lzR8ZQ2;igec^hy=eBDR_bUs`1qO6FA1n@jyL_n@ZQXy4~F z@4rU^1GDM$aoM)}qk3~ux~gtV!pzz?`;+e)BW?tCSA4s$ChA}|{sAjA=-GEh&~&0l zTm%T*MfgG{94(42+YbakDk2iVNyR!K$-jOLSbZCq)vv7frX7Zi;=mnp1bnO(OgFD~H%+}i$6|t5T8`h8VCAK^-#SXC$LtiL7DqG3lE|?Wp!}zm0Y4l=; zz$6@%l9dwOpqJofTEG&Ep`{&Dt&VK^lLw{oW)sj;&e{w#AAfLt0bwH5+C21$Jzh58 zN`TWyup>{P?f&LWAld%wkB6PcDz%liH{UKCiP^=?N@84U{U-P4TrF-Zmvg~Y#c(`7 zlhs6g7Rt2ozlCJFQlBgzNh!qdrh*ME1s4;~`)-|=Y<41H8=EHXi9f&++5c_W-@lrg z0_o;tY<9Cv>Bm=@*pI@)^=F@YKpaeRx;ga9FtaWrDaa|-hlV&@*TJo|6=k&#o55+4 zst>rw=}5pFDw=uvQsaVWND69bS)!xyuPHd;ibQ5J%rU|zKQgiU$5-+&-mH19@tAy7 zJ(ep(PCehMv`6UJ#lyG6>BgY$8yKd_m{x2?eVl_D&f|3@6>Y*f;KNrDs>9$8z+d7W zL@22YP~??MdHr2NG}~5$1N=7c!=f1_#Gsg+9mu6P4VyjMHMexCT`x0kG+ycE)E^gpp{ak%xh5UAnf(h<>mDC$=3er z+d5^IAL=S?agGSqSE3u0P+k}X>oK|{Rr<2?V4uX=EKbB}F@VE9iiWQRVoMK9V1Vkp z45i<$#J2J+=87HwO@@pc{CfhC7@k+c?niq;7z290eS(v8<`|9fb`H<8Q{G@bcRcCr zta|Elnk>^;Jq|-f>d;L^sMgG#sQ4`w-WN)Prj?fC@v&7!O_(cknPJr8R^X$^QL*HH zGf11kRn{v4mELi*HSNBEZgeaG38@H!VL%#E78s~3H|WRGYbdv zb=z=SZePm{(iMk8&%(8nB6X3^=68FChV#XV4t^{yDG1wTC7Jhj5aQmB>zvF~M0=+w zR0(>%{$yKU%A{Qj9DkACU28nz6eK08qwCCIN$#DzLfq6iN)o!~yHZ|_IGj!BS!F>B zY=uV`dRC@}xo@rrc4fU-a7yvG#(^_p#qX{B(L^U#ox6u$XKjJ?|Cot*&s%_Clty<- zf?80v#oM3MW!mWGO%t$u)MGgr2bCG_5ZJ*UtJVpBZNk4uzJ6@`y;6>~)pCvL4) zy{zs{C(uUl6VT86R~z9;_kXq#7@7V&T9fr(k2qoddq`m`yDkADT60rP~sjSwY;R7i6RepJ^Jf=Lok)PVrtuD^k;rK zkB5io_oNq8JXeqEju}Qdj@+krtuL_EH}6@DQAwoABJ#1xEZ3NVMMx1NaSrsGXKDO) zte~W@uIP>4me{Y=vNHLeVRXhYK0t6^B3k5m|3rm9r8+d-P@_r%wpGpkm?E zErgvNe^;K;TVjP{EwG9YA|2Sc-BOID*ugXH?gfR`7|fQP%VKV)<7vSx8fD^9;zHJj zRr%}&Zju+82*y!rlKl3?n#o}mq#_r7aAb*{JXwAPQoR{>*nyTSn!h<%q@!o z;!GqJ#AO0{B{X;~0V;i(`iq%3tG5#a20EA-Bkvjfow)c7Gx{1ik}(;R{e%v^%5>6Yt14{h{1LSeI5b|$ro2RDXsecv z(LqB^++XYoqFOo_DYNImTwws{oew!GLG!1}TVAOldG0M0x$a&N;QKkPa=sMupbMVi zf*A)DpJ&O)Wl=}Uh)a;YFyZjzi>r5jT`XskP3)xsqFW964KCXt?*oFqN+4+v^*gB1 z05it}1sH*XotfggEx2={HBd<_={ZFLvYyh9If{(}Uo$sYmHn4bm?;YF3GT7w9NpBN zauxJYTr5C_qvlxG3E_;Snw&%QV}AWtqEU9)feySQM@$Xm%^eRdwsg$T+BRju)9!nD#imEh&Os5i8MjXaR+)t?z<);RH8 zOTE6Yan6(EtjL2=ESY-o)myewfHDJVv`QwM6f8?|ErIa687+3cn%4 zGyo}bX@*XaJiF}85}-R=YsBr3YrcqhS6%XznNwDxi|Ur%oSIrrxbyQXZyJoZJ?i(Y zfGuX*q!udhyuv^XvY@X&UP0-Ye@UQ~d!-Zt;_0YOz`?76aM>R9*fSidOcWgLjg?KEwE@7JcZdKgrtZ!_I&pho zVy2&|fj8CwM1X!Ey%W*XA7zzbfI&cBpBQ8MUu5U$N7~P2|HaPp3Bteg!~9hLC&vEY zi--B&i0Aoasej<-e@{NlPs>98Bp>E~ZZGCvlg0mg`LH}qLI2FppKbUDepsF+rT?Aw zV);`Rf8po(XEDFG7t61|2mCL{=TBMu#?PN^_=kL0|M&3B`fu?3tVaBUeEw`M;8+11 zeu$pOA15NfD@zk6B5jx_xGVh}6_j9}J0tM*Gw>ODN-)nY4tzcTzaHkfeo8R9L_it1 z0LL88-^Z3e%le}z5kqG~8+-F#W&Sak$(lMFngC;n*q#-f-!phh@dvn+fXBZvJtGpJ z#0B##dVmrK%(J|I8_u30{-of5VS0`S{5|650pU;Lzf;_Em;E16Ja?-98O0Oq|7R5c zAcVhDk7wxokIHx!>>m`uhEAqW6AnO8QdCV#k`{;rM@v)3=SfJ^)XCV<(!tr@k%;N% z8u#<0_mmtsOIbQPIg3~rIufxk17r;Ua5HhR0Mso_oGqNRVb~d;=fmgkC)Y3E&v4*O z`B(gN+9&@%#{Ew5TWTUkm|yw*hxdOI56lag;;$T^T>tL*x1qn)>vx*pdHp?aVEBK- z&Hqh2kOQE`AZ7==-Okd^oQU;jGby_mIX|fjR|k8J{iEHVTk;nj;0XnPdeklL zgzTIw|MZJmnwgmbH5j1Eq7CenEC5?eI~OP2zw&+V+W(9vQ6)tgaXDHQOIuSXdSQDT zlYfEKPm}0>1Sw{=Co!|JJ$0+659jk7!UFt$dY(d_Qarhz-pm}FFl@l4{X5TJd9ZN+ zDS*#Yvv2@UEMaHocz*wK1JAM~;^5$Xepoo4y6cngDHRth>(7+Ha-UNDq-SGe|A#!7 z7=bK3W%et>pH+Eg6IkRkvp^D7U}jIGPwyw@euV=o_0tcGdvZUC;3*w29_H!I_>%(2 z*fZ77nCG&7iQ!jyKdbng4@mp#^E0RaD#afu{|jsbh4>HH{5kIbCv5&U?)`tpCMzSr z%<|tt^tasq9Py;(l!Ro({y?aby{)0$zd-bD$7 zr*fWh`1Q>Q^W=NRB#`6Z-%sJcYVnK9C;yZCsbl;R_h(Ii@%0q{i|&cXU+$;8|CHVz z=wf;9_J4*x$3JoY2TK173_jER7x8TDtiNOQxf~_Hf57N-?EmHX$-)JA?P3qSnAFnT z!Wo8({in~y)XW)%iG>MZWNS5(pK*5MbnJXl(k_6@I#&y9mG-U~F$=ZwLIgwKW8o089a< zuU!mn0A|3U-qjRf4zK`N0;~Zx0NbB>3BV3uXK7~&um{)!za0P$Pm3?lnLfLIX6gX! zfA%In`<{uB4ZsoL1aLC7wftF>lLL?sfHT0^%^u(aaIrHnb#yYecQggK13UnprjGX1 z&k}yRrub=01h$3JU&_$4|Btr$c?I$BHxL8m^t)~*^6ScC7DjfUqW0(I#F^@rD$27s zZOD#JrV2y03W81(T1Y*@6APuPmSXjE5HG=l!o&nkJ_!0TN=ib71alD&BPp09(TrMv zpigj;T+B?g5*slE8Dx=|bTh-?buBahnS81cq!fxG*&72(qE3WC?t|q-R^kfWltP3*;ZzQ2YBj&Nu zQSgtkF&bp?%v&fZxO-g>Ar~)*bJqJm&2dP;Bmd}NfeNS&kDABE#RMS8#DPNu+aN9@ zV<2NUI83aQ*Dc`Vtt{?koVCANc=>?^sw-UMRXHg;(${YBuHfs0Ihku@yKb1SObw}W z5`I$NkT2ahUGdcvHX$W}Az1PUlrm6GMkH&}tzzDC8c3|jf*L5iT_M$dpHO;5F($^e zdw96*hMM$9z48z?`TH@x~fm^E$UY$q+w(y49t zjG8;^`-Vs9mJZTxyw4%eDb9Hg>Yxu;vV#!oF&<)$7vYDRDW?$EC=Y_W#PT^s-e;62 zSz_I)q2fT1^eAacJ5oO)6vf~)l$I)$N*e@Z2edjk>Gwd4gIb}v#I=PMoElIDF&lxu zyWp+;;B4Zv=n6n^j+V>W| z`oN?PzF-W8^=d>t%XPHq}$Gjx+aj-<97^ya-17|nho3i(EpZ?8q+3w;BB27HwvPtMaoI@;U1gVxpb{#k10w+{fh+UV9zwj zV7cQZHLAgQDpPd7Ql%2MVKz`cRZ``md{dMB?Nv#5Lr_y(+XI~kwIFo~_E#wsQp(#L zspe?#Veh7WT4;KR{Li%Un+?`VFG)#!G&^R`vgsL0IUvDtU|DP9OuRcqk(pil?#B}g z5c2XUl6~54lH<+4e9_IV8l)W(givKrEiyGdR_qt;G`d2w7xej1aYF{C%Bb^6wOqOs zjio9FtM^m7>*ql`{r)VOmvu);S8#9z@wuADIuX|q6B~|Fx7W9k`$oJr_afX5<9a-u zR1$JI-i{NRS;wOFi{uV=$Ej1Ke%5O*wJb^-KG7X^?P$mr8f#(>tugK7-wL5~ZO*Vz zb{nh5HB!;jDkDsmur}0}GYT|j%Q#owhSZ`ffaxlN4&(T%i`n>sWXEiI12Equ(YGC( zf4@y_ejkptecnr;*M55Br-eQ@`GsTrW?e%)sns^YjQ1L<7b*wVc@=YaPCGFt!hD<) zYz#5R0)-?No9w2-z8tG3+b@uzAM|5h^o=945MWvhQY$uX5}D10Y>j6eW>iqkdxeR% z5KGM@&U33~{#sgAtSiw1hftOTenFbW!Ws-3cFx8ZnoEnvJ01L6zmI&31;d_%Ty@qP z6-@mOVFL|C@pe1Zl<#hwku{5&IgG_UMOO5XuhZU=)(UqO$&GLCC8k9Y6n^}Wi!;?M zQ~H&BY%q2}G`-Qi7w~f0dDeeT;GNz5{^OUJ5iuFPT&2n#Px^C7K_25uO3I-cU%lje z|H@6DAIV&WG5q5wVq=SampmPB674#KD0bfCVujxLo5HzkB}u;JcQNyxr9D3u;h4kvz(}lp4}+ zV-pgKLDBZBW(V8b2d#J<8=akmsk86i!S-#W33HA5&Swo?GVjRSU2=yLrN|!HSC&%K z*etYkY!Y#TTXD(1>UxjymXBW2fanUhg?Zra=pjmP5yj_Ttg7Y>_zgz2yFuM($dSXl z>hWxaehILC%Lp~SNdL*u{9va!>n`*V0l_Hh0x?2!Tb(9&hk_Fa9-Tmp6Xm`Tr&=Kg zf3k%aKGn1`n}md@T9Q$&%SPTXN%$kdRR?e$6VXiEb0ooi5per}&TRwHD`U=M1I~%y zO)A>#iJ^=RsdtOR^NC`}tY7nk&YJ{|5)A{GG8v0WC-sKl!!^6k5>;6&n<)F>W-s96bzwPgR2mGY8v{HH&n?Gn6$c)L za+{2i(*y-45Z?+qOPfFyC92SWpXy@I__}E~_j(}&-d_OLiNz1j1Z)hgYFF^b)+;a_ zfAIWmb2KwFvmF|c#3W+b@MB4SpPRvU)VAS~DjtFtl8Pr&5DqWW3_46e*GF30RtFN> z->P?@m?A)Lyv-jdp^h~q4$YYxYz2I6o%K5H9f^Nr!QtvHoT;6%@~DQDLxB_*g?QO0 zPGC5_89S3C5=@c?hE2_Tv+eFwWQTWbV!rAl8aX7%X{Xu@2Vt)^4;hTqgzNe-R}oLVhECWl()1J3U&54} zIlJIcViixGz5ndHX5l?EDrjoQZ$1v?8!;xGC_Po{=yZlY%x1D+6uh_+A$gbBZ_{Wb zkICMke!_cz=*G!#6jN@3xoQR9_=vC3taUF&43|O-L+VPX z*riD6<#7S8qtsvnW`;5Wzt|Ev2X~G8VUIlKlP{e{0MsUlBT}|UBQhvNOe;Jzr+i@h z4^1crHGMnoN=w@cZa8is>spFj>g)xu@|5wm6(ST1oJj6=E;_Ib`CsEv~0{oN6R?@am^ zcK`Ef<76*a>zSVG;1CpJH!*)Q8eMvNfHHIr;HAQ6caUMhZvb|uJwN-1|<^RehG1ah*bm#&Yt zo^7Qxbg5v0Olk_|d&>kG3RJKnqT`O(>rX(j6jLv%;D77# zw5j`#x3&T|lK-BS_wScle;RshKtqq2k)4Q(lZl9(i}jbG$NHC{2i)EM-OzjT{%Pm| zDgT3^$HWRW0cC%;=74Jfz>I!bb3y=NfCxYoAO;WzNC1G!9pDu}1|SQN1IPmu0Kg>{ zfC@krpaxI}XaF<;T0ra1&=zQwIT_lS0F3^f(f4GA{$~39wEoP1yA?na(A?1!xYOjE`(ZbObXe<7+rRWN9`}fx3^FHWr z*5Yp)M1S8}WangI{M}k~_s~$Dy}S%f$xtp(k&3232(7bdSg>mNFj`j}a^5eK(iceV zk7NclZ}<)b8i@!r0b2-3p=KrrK~=l&@{5)P27nN5&v)hWseG0q;_V@ndlBq_gy}KcTcUiC>OL*-TuessK}>B@6oyT27}T%XTaxbZy9PilnAWhJ;1_n^vRV_Fc)2V(d%8ALp1qoXUQ5 zj8KO;t{}OX7=NFTW$I(MkF{5|311}WASIr#FPeOlOk?1d9c&{XWA4!3KK@|%vI|ih zFO0W!FVk(OLUVtnU9iLAbf5oKQv2z4?UsE-O3m4!CK_A#f=ETKnezK-o@qQQzy$+a za+<_p(YEqSD&Qd_4Sw9B^!W(N62+0zBzsg1p;|KddF;wn%G$-`(`r`K4UwL27vv7J zlN67p9jz!YFdD+OgboYUlnAC5r_rov*dlYOp~(yMa?^@mtB_qVZwa>vR}@hwpi-+# zOSVbZOp{qL_vDEtq&Vif#_cH@ml*5;uO~Ift@D-1n$jr}FDf!_j6B?GImx>gfHDHl z{LZT-p>J%)LaDEHKKbRf&;~=a8@4{*qu0*HXtbX1{?>YO)<+w+Z$9L^iG8T86wdO_ zS)99rZX>Qf#2NH5zAmR_Z3pQ#oL(+*hDu}k(G=m7fDAfJS)@bMpwO6Nt!dKtRQyx~ z8MQXjg9-A5NALHzRM~6~>X#K(jbMe%<{Z-&t+wYsXlN29sJS3f7(vVug<%-n^lQ$q zPbX|(8*yE0eB%o`g`5tdc|~_|jO`_g1hCN8MGjb3Y^5M214tB26zpPg@fJ$d$Mo_C zFJW>fA9v}Bn%PYrI@Ilh#RP!o#|KF?$-&|#R59&&VNvCGa64OmA*iw#BMLn^5NXvH zx-w5R+x5ZbmE8AcVew|hhA`3IT@{Xmc40CoR1^x$Y0W_9udHfRVU;;7j+zJbaMjBd zN+C?e^_0|;GA@Fnd@);Gq+^JIwcAeE&c;fJNpkPvW8-4dLjHh+5yraRN}}SwML% z;)0gTBe9vN)DFIyHM==Wc5w8(@{6^)tTDoFV~krupFYZxX8pl$eXeS%my&@1eya;z zURpYwj@-m%hlK&p>KWWSQF|^Au1P{X6VBB_D9F zf=duz+>ZC|?p5aN5NDHxX>0qFZ;G(A41(fqqxr^|96K}dlqtf5L(@()^bZ2v!mC+| z8^oILTS;C^i`YSw8tg?Dw4s!}x9?f$|906bUciOsx(*O?=g(~9r+-+ci)$mS_})VP zZOa1@drs`LZF?QYxO z{0z#7I2I(BeeCQv1shiuK8JYEn%wj{89IOv1-uHRai9x|Gu*Al>nz^-{D_$`o`Bo% zONJQSiNFKIl0on7&fEYCr=5MEiiXdu|L(yV>tYD92=12-^};xb&b5 zdgAu&yD-mgIPJ^T0e9huov+o!@9Y|;qY@EtqgUr3YUeflIed2nk&-M^;a?n~<7V08 zl;ojS3v_5Qf=|}bGYV7*uT&mSMmIfT>L(2Ixv~nsyn4lRe7w23RXtH+g|dV$2tG_) zfd%rYA-$kW-=n@6fXmfj^#E-~mU$T(x&rX$JyQPAsq^~w>rHh9eq7;aRon@fdd}A# zO>V`rr<`ux?$$J8+;VeWLOjQq0WacZ2T^P&b_iV!&K0Eh3T?zkedMkLi3GHeYWSGA zIR|NX4bHT>o62bJ@?%865HBFr4BlA=7S+69!vKdgmLBsg6ENEk z<`26g)o+r>HFaiK1sOr0&NjzQx+B0jHQW77y1cx-*7R30nJ6dj(zo&9lHQ*Qr={p~~igxd6IJ@8`R zbet)aJ#v>&$i#`@*EL^g7Hx9b^)PMx4K?;mhJpw%-T*M~*=AGTcVwlC5r&4Xv=3E% z0LZML`*x{AWne=!3vusmb@C^cAOEO%`=VOlTQ(QccNT@DBW)$5$(t*9^s84`nAbEH z#@7{DZixAE4ngO}n4fVze%h!2vA+V78D{jAX}N+}YFl>NJJ$I_>-d=t~g1Pax?QI?Fj8U5n2$7;WmD;6#v3F{AUWAG?( zU*O3f&1K!o%B>8RDDDu}%&NMvYSz)mPhZ%pc{+ubD!KXlllAvXIe(2M8!_X7m^g#J=x zye*X++qDUOVrZ1`(WvRO^J7?d<`Ih)jC~?w7wPP)5YezV=1Tm~VW=AO@Ij%f&EZkm z3^VCRTk&~6=!yg;XC5XrB~TR2e|gb$uKh|SD4TXRCUiYUoHSe`9VG+13R-S|s6=&H>FcnK*jB%a-n6cu>kQTI z)JIRHJ1@an*H>jN5kTapL?9D}kl^lg7w$rI-keogn}@YaFCBI^b%T?CXOlSH*wIbn~E z%Z#p__bw7McbaHzd?QJhr5VzZQgMov^x{1-y748-B;KxHa5jjSB{xnx`x1m|_+vwJ z`jbzwPTE~OK6yXJbvxwic_3WmU?{r*koCQ8LQ%VJ8OoWxk5?Rb2l_*`ZClqUw z4>;)>YaM;GVtYfX92iJW0!1=sI+Ei`Gh?T+%rLE`xZ<3cNl6^YqELjeETQvG^@u$l zRpb^Myb~;(gX7t>Yb8K$c*@tHmQ5hsGBnDl1_dpR@}&l#hlYf3HmkMd54PMGNurgt z<~DQ7yXe4N!3uUEnr7Hj;OWJTVD&1pgB@X-F7^WU&ljthDE~cWPqM#!s=Vs&<1|C(LS*W^&T&iQ76Y4}OByM7La7aK! zMa4i*T^3p?O(oCN8$S4@Ksq5*iEV!EvS&W((Q<3M{Uy)HWp8j|x4p`uS+zOK5cBuP z;eG)6_o8FOYnRe7Ql^ls2RK-v=1ZOfXF4)2L5d(4?~r#Q*9_WI>ef~w!xu^T8i56| zJZ`r=^>C44(UJDs4^~wHv}Cpar?sz)iYwc;#tH837Tnz(g1fuByL*5T+$~secXuba zTX1)mU|*%X@4elfe(&8MUkwK1)MEQy`xJHNT5~D{RkXufA2RfE=)X^^EL0v9vs=sI4S8+p`$~fgnk+$M`+JD zgHr?@hnjl|#kcw8Yfgu(;)4F!p*uWGQ)=!J^X@J!IP6q&!b--X?UX5(gH*sE#AAQK z1BvNlK&8R*L^=CMnSs$dL&|P2A>SW)bC=)4IA_c`eSDrKnRskorFkHwvS|Fnqu1>` z>_v~RR`wL?UOhireI%3Zq;04<9tmr0nXt!qehn(2g2aq4_ckO2$=V=(Xi}$ZN><7Y z{O~2$A~W>8OL-;&tLl$T;(U#J|IHqA3T%%NJ7fW*d%4#SjG2vc@h#m^YxH=ce(MvX zW8PT_nK$J)l-!$RPTEog$2u{J;o}UeytozFcDqStNZ$egX#t?I@9A@ija0|FoGx#~ zVSL*cO}Y3fTnZtn%0(BTl+IdoM*yl6M(Z^c+`N=3@tDam=+P;{SEUzJRWfRob@dd+ zDy~{3O#4fDE-(36E3j8unYC&BnHVbJypRIpL?2SPISk)G{LZYK%Snlf%GWS{_?`Y2%k@(GqV3 z!cQd<2lDl%4ZFzP>ZC)jrJf9J+|M^q*S^Rz!HKr+_+RcHtr#|IooFZQB&w0-tHC$4 zXPn^Sh>gtoTn%S$I>}msKHPMMweJ?JG*olEYu$WQ7t1*G=E+iLyW)Suc-QfDLa%pC zQ3n&o$aX8)f$;9Wi)U2dll`I#lGqjqlwKnI4EbZq62hRCI|0fe8AMe-@nTw*<)qJ0 z*J2qi~=^wRFV04jb>}b*{M$TOH~iKSR7*9Vf32e z-J|w^9+WemMe$nmXpz&F%Y`p#$uoSJ8}Z@mGL^bgl19?KKQIDz!O;rLQz^gIVdqCa z1AmPhB44#Yf@Sd#Dwo&yrhP&4r?TPq<8!$;ZFM{l&a33s!Y-mK7&d$<%ZXGGk?|DB zy)|qk18e!O<*VN#uxKmB*2_K~8mp#a-y9lmy3z%t_v`k>n{P_Q%Q-uADf9U5Mu`%k zZ6=vpw701;7ir_6AcjQ|zG2UeafrEls+p>ny(P3G2zR5cy?8!^4thPA?n$lQQr{dA z&(hdhR2)AxAY!eM_Iz8wmb=x-3iMQz6J=-a0bo*pvN=|NlYvIiKGw=!jDuNa|Gba%kR4BK3 z^QJ^sv`f`@;}+DXcQKPgL@wGXib{&Q%JPcZbd>Dqs@aZv%4K9UALtP7+P2;vzemXI zr;*i{=YKz-Vk9`W(NbTZl-H}Azo>mVJ@xS+!s~#a!(k=pckTQzI{2xFMR?8VW9{UH zP`TL-_AJ*?cG)us&encCUA=U&}a37HW!OS>QiZ(Jn_xu5!leNw&;^d znnnUn8d-a)LaxRST1B)&Vw@DbI*Cai_4+G6HOaU~2ineIsr(Rt6akG(MB?&VqPYo= zTQ&Sn2ny2DeTDZ$k%V4WG}REGu8L=)ms34yK~YE;^nq(O-1oV@dQXhfh+uzW3Cwhj zUmuI-#I5G^n6Rwm~pn4&6s458P#t z?*a?Dxws`7KRf#9sb$=iolj^2vq}88QYFF?j zct$F$KMl4oc62pmij&5&3(>Sr%I@Hitn|K{;G`QK-%)VeQ!#de9w{NYpb-4yk8*w*A8VXJXrtGOavOxW zu@UjrYqo`BLIBVIPzFYPh~*h@W1PyQTCJp`JSwz&$l3SLdO-|R{Bj64dFi7sc*56J z*PhYfd>_Ns%8_}jzIE%EGcrHT$S~Y((jMPVko6qlskLs=%i0L)B+g?indA>ITUnx# zsgm}S77oX%f842mI@j?uW?;Q#y^XMxRZX~wjg3Mt5%;c6@d*ZZi7odHn7XP{M-3N} zxe{A{Ez&Z_bXm}(t7qD{%HX{*5F&`}idt@IaPskLd?FvflZk7xZ+yFjV_3gva|AJvro9+C9QPLsFU(F9$~8dEvVnbbld{WJ5jL2E4)Dt&+~&%1y&X zH0jrmOwR+qDPbP&@;JF1Amao4c43@$=%eFk)w48oOu0^+5+$H{Yjn-()LDP2iNJ`} zC}_$LG_+_pgfP=-2a7X2F5}MX)n49wc9Tk<1>fZkM&n8Kw)bFE>D9ptQ^7QKv#W1q zoq1pUT}2Au9iSEr85dx2sFF>XV*5N4J4oA@)gG${VH8I=ExKUlf@9<>u)J)EX z!e^M7!4DRC-~oAUKJ7Vpj6HgC8j5pVnW}|}dj%Fs;es%BpU=;1Yn*l0<^w!%?n(oL zNP&SZE8Ey#Pba5m+8jTC?rR<(8WP_03Gh6Ipz~SHCYtukb|;&+OXtB4_Pw64xq5r@J0+NT^R2VkCgJf(EjvO61dQ|f4 zGg$Qyvy+UNw5GD7B(7l;Rb>|lWs$kMveV-#=d~@5-WF!Q&CF1=r++%izJbB|WT|x6 z(9tO=HiiK{e-a%v1trC(9aUqJGVy?A7(Wr7fyE0q6cu|e=BoQ32fU#z`#X1gqykO{ z$9JY^fkk5$OHR(PzGJq-x^FiIgEluGo-19V8O{$b`!*0I^z{wRZ#)Y$CLQxi4|!*! zmlIvO(V+6DDBvF{5P}J~YuNgdM-in`Ic%G^NA`K#_LD9n>a3XAQh5JJ#} zc|})6A))p62s&a`z?%lMiX+PYh~(>W?R+|1s?>4S#IRuVGQ|lg#teqi74Fr00&SWS zVb*&x+=F2(L~GJadp`Zes+!u@YbBRAqAvx(lP6RkZm%Z;XM+@xulF^+N*aiXV}hL9 z#J9^NAZD=rCL9IJ2U6V}=_Vj1ngAMo%g;M`F5ZVt^qKU>mTz6=()o5RKV89=vVUJA zYYh`RV|VpcjIf%}mo6&zL-CZyZ{wZ%x)I8zVHDab#stVLG8gM+!|FX&AM?LXp>sMI zfKjNIt)g|lGT^t)qeP3Uk8Z%p4Ktec1Q+rnaOCeoN8AaE)j6GeL8p<0AQJPF3T zD#H#%b3={rjFmG39ai_pKhV~+%hPs<+*-5rN^(;T#xcl0e={Gy*c8Me@~A~q0yB?+mk za&L8!EyW5`3~u!BU@u$1qt4E||Ewhu*+*5uPyqz=T*flgV;AFf#tFlOc3%ycPfT!y zBj&RmwWBM9MDz7G)LVX_X>o9-e}FlEhTi@+!L0v7y#DVvCm>;imI)Bd$_YquW8>iX z2b`0G<1aYp&$s`%L*2Kx#0uW*QTU`2Y1N%>e`rjjC|AT`5D@OKD z_~*Yt&tHRNe@i(06YTk?Owa!w_GD+|EWTRw9s-F70})&TplX%rDayC zQtHx&g_a6wqPXV)9}@!>Cr}f|5CR55I(iKo81@Ned`^?RPSsMJ_mnfS;l6B4Bjd@3 z`ryU0(`(}V)xqxq()j%4%*}o6-eV07-GDhnzgnGnwI?qKCAqmz401sI?JdkfpAn{j z!LHgZH^r}vz^%^Yf%zRn5S;0vG9BV-jghx$Z-iY>f<`c0M7?ci;U%aW#soq#jYbOz z8yzhX4-1XO=22qlJPoX**29kxp}~#5i^-Ib^KE{`z&yk4+#sVk_>ba{WaM-i-seKe z8iFk*x<F5QH5))yKKd5N?sK||CQcG{=dlfEcOL*o5T+>moq>V#Ak zu{A8Q&(;vFI&@LWTl$1#9`Px>J{aW^%E4b<9G7$+c|wCMWj0sWX8}9M5k~Mu!s#nOfD2gY!y*pIAqx(C4kSqaMhr-YGS3V zrns@bIbS!+s^?_vTL*Cc8g)>$#;D>n- z67jAG%fJ{QvBpA0aK;3}#fZT*FsEwk8*pH#>qQC;D!BG*W114TyI_%J2Ys}e-591a zqRy6E5IIH5)|af8i`$Hsir8>K*^Q@XEs>jHi1gg_b6A-wx_N1RjHYa!SHh&bMZKIZ z7RuB$0&))0-60XcmOP~yyBW_XC&A7N>~+9?3k#|V-tkaL#U%xfrJ?0QT_WaVzqsl) z3nv#qLr|9%El-1hTlh@(t~k9JEw_^x*f@t(yAHa!(pM{WJ28j^Bb{=;?S@z$PP$-u z9GC;ox9bH)b8$}vA4-HLCW#0}Z6Byu(@>@hi+NXpkP04C%(m(a%zEgPEnf|$-OiXS6g$Qq0}L3M{Hke9VSSAOvbHO0b>Rnr|kk(S$x)vb5cFtvSn+Q3{K zD?=%cdL)0>G{K_$AejAR8{nT{0$TSD%w@sWtT%sM+aoHF~^VRHk9ps%l2A+Uw(gbN)l@)&h%7%lx z=L==gcDA6{bw}tVn?|)-GrPqX?KRhcVZQ$KJxC$t+4_r*1mCAU0Tb|M6%tC-_3TZm z5naqF1zPS+pu)FzHXFnoR{Qq^%|FOn9$~~NLgsnNXl7_LlLZf1!Luc@g z-9MO&LodIQYLBxxrO~;LqFoH^LmOrtV#x_lY*16x0Q>s zzBcrZV29uFTn7dbc(N|rB@6%Z6DN%Z=z$TkwzO4!1t3yOopnNgfC5LBAy0nS zldYCqQQm5W^ZvHjAWa$ADv2K?*(T@Y6GSBW(4^*z&FgUA$D|dswLu67LuOzkifT8c zRggJtwl<)^30-}ePAUFwFcxenUf?bcPixFooO*$UPk2mQ7MgeR+$?WPd~ePysgi7w zB3+-sF(aR?HUjG%KU72m>>OF#mc!bQjE|Y#)~j`al0Vz>KJ=5$j6J8+WgP=Zi)z*; zy#SZwZm~Rv1f%iziyskL4=lWEYMiYkhFupOeVVgIq1EK1efQhOm8|4TxO9tXxL4zx zw9Qnw)ZD!}CMbr2Ug@{K0lCWv_Zq735DhIGw>#`rdoz59X&d*5c+mBl#JCY_lL`WP9 z_n|W4XWSFXpqDyJzHYiqZ89DzHuoG!REXs(P3=#5IO-^M?at`13YR}i3p;v?sWNSZ zgdJ7F=-*2nq4~hx^}@p(pBr6lVXp9Cu%!=|gCpntpo0tA5Zwt^iYI#+O-nOnzWo8c zEp2gzh7pZAZ8}TyRSdPCX^aiqBRgVpTTdrd`r<1Z^+6~WH_Y)jg(fRhwG&uzi67>> zqDM+B&sgQMg%!KlCSB=b$k2UM{e~9WjtQjLlY=BHvhOyGZaPx9@~P0Qye$&sY_M-y z7M65W^(M{%0vvL?#pCK+ux3&o@kO;Y@4gO{eRUa-ww?SWrE*{X#fl&SGwZ0z&n$SB z-4Fhp7WuG6yVTDRrgpf;aLd6lRzRd-C(T&koiUY0)Cs8Z4qc$9sD&-%USb+N+1qjPTOeL}p+pY1bQ!ezA8ki`~XQTn#*E~Cb>}&Byk7|}@9)%a#`x*D3E7U(bbrBlqdR~s(GSWzYIaK-K)WsY$ao~>58>+lZm{F5b zCYCg8yG98J4}E2xd?=4a?MLgz>>7UvL`Dd86*S6Y;%Y8#%)7Yw-0y9ZvUN!?pp;`l zhE{Q7MJPrZ7BS|Hojo--D&lqN#bb}iK|lE55ENVz-|ohT_MBP;h!Mh=&=@VrVge-; z7_AFX2d;b*pUaACB+H^@Xcl=e@L6LO2vr=j9{vVCqxx$M;&U|iC8%v zZ@EXhbNq)PYJuA$b<;+7pd(PAl zS+I0Eogra1**9uu$e1MnDXXcw%v5bGL5FZDq2BLpZY9*I*leC=1Fmsn zQhb<}^wAqRm7K2*jnPhB@Uw-5FKFp2mUO?74%6tcGPMA_Z7WT$zkhQ;^YaI>Cg)0( zG&GB=0Q|{JPmLI$@~?qfTd=BQ!nA`|uXrr`uh>H!izb|N?-%8EcYFGU8_b8%;A6g# zFKt7L8R06kUmHoaRJ`|+c-$7UvNhK0NL1`sz9)8B5c?i|k9b30?K_ci7r4JhU;I<%i zM2|oxyah(U8z{y3QQRg|ty@JNMXSctG0ctOZLQlfh_n_f&iY~E@)mdJ6MD8=?0QWS z+P)50uk1R(8@v>~T@#R%duL}qk5em+{SQN(L1cl@Wmx}!x~QRRzOipWY490jt%^Lg z$kQlsaXmfH(>z@Y8)`_)C#;B<$O3GbRu8*n?bzNN$^LFaW+O@7z z>FO%lZ0s&7i9?1|4(@ZTL%(9$f@6lRZWwtB5g1OxlTs4k4 z@byoKedGmSCBHUvwj~&cprV-92znB`gqnGSz02Vhd-n6aC_3vy>@00=19uLv68CJ} zC6WbR&`B?XH0hdN*43MhwNkYZBtKweU1(%WS??<)t)0f8p7 zFoGRtl(kwb%bnV>3~x}N_d|wLbB<4TGaYZsXFGW2hXA8GE9=E6P(gOTz0Taw=6#KO zu}#5M4XpQ3t-2aTuW=tcW(frM**PHJ<8zIKCR60oNyo*UCUr;D!XNTPq94PzR8nvY zFd&7CmoTk}M!}$(y4pV#MbgAau&a+*r$Bs>%_jI^9-rc}$$ zFJg}Nso>~Y?|~gFMi?#2BhqXLJuP3Gb;)JZ*D`l7Ho571chpW4Bl6&HeRxA-lWI^2 zfLUP~juk7-zAK=!G(c~$gjt9~=@?~}4azBk9LI-O-^)bCq}m~fL{OsXh6PK%Yz-Ye z!H@J|;+lAcX$u{e-dXc*Ub6&KaTHckQ86-7RDsoP8V~1=qlGe(HApj}Q=&IZz>qp>qr{~NbxzqjR6h^;lWHYds|0_|-2 zjDt4Ut6+w@%ynE1Y`wkD7$~@0pDco8<2T<}uwI=G#&LHkTp*Eyn03mxne~jO)5;9g zj%OTf*1vWot%6yU2)!RiH-d;qD^M#?iMUOvi<_Q~CuxnRySY!8pNHYnEU^t5tb38F zyrg}j;&kUW_T}sj3{gk$Nae)2Vv20SNzJ`R)y<%qDMgH^AVRaRJ?&Fb3}9QCkC}^6 z(SWC<_3mbs6(F;F!%O#P_` zv@G%8$_gFp2FVyT=!kXe(5}g_+Xq^%kC}bIQ799ZN!S+@xHz?+um%DbJRc@}@0wZ@ zF-3$NMJy!eIzp4(p-)u73dIK>&!U&1aRcOJR*UPI7jpuFN|bX_mJn&UBtOycIpJ`I2`# z@-CKZiwa#HB2pnpMOmu)Axxk6i(+d;KcwS<1Qm{7Zx1%Vz6-Pb2i>9Km;m({qUd;$ zynYmGI!zG2&rJX^0%;z7%DG1K>i|Ke+-|zGkXeg1oZIq`N8!K~;lWU&_Qys+28g8z z4$O2=Zeh39s9YL;<%Kv<@292W4dm}9t1>~BbGLeWmXA8FTm|mcLN>z@Ws0?p71fTl z<(L#I1hflU1be+piYxQCP_yY(`pPk~(hX&l+t`@&EJ42WV2X5G3|3n6 zouK(GW@fokwyohk1T>A_J{>|PXde^7CVQ$!14mXy0UzIBb$}=f6l*j0+omMEZaz@K zy{X&DfU0ttC88-JLMoy;)Tp!Iy!44`KM3i@YJDBqHc_D(?E#3$H;ZP!DklMja7n&bqA-SukM0l8vRZ{KE9x|LGj~n` z$#Q*G7}I2*TXv7j|E^s4B*ff;2adki0sh0-aGYsB8F+*+aC`qfaE5R3iKIzp_Nt1Rdk(`Uw7;~d~8J$t7@y{^C&k~LM^UY1-9jt zvxlNS!#N-zIWtCc+&TDRSK4^nJY!w=pVKt8roY&Y%8r-M$E#J3F&ljMH3*m3j8*BW z=m9D1_NE2W6wo>q?fYox_0WBJPgB-yX3Y^cc*2%-5FC>iWz~ZY%7T{7nMvT&ShUbc z=Rq;8KJeY0w}Ir$cZ>EA^aA-=;i~S{vbVk|%S5a1byDvoUryiwp+%S>NjnU4;y5%1cN4NO?FQw?WxoLM z^$w;hxgzjqwW4-tm~Z2c_bRup^x`?pdoAR&qvRR%llxySYqebu`1fQx7R`C_en4^M z*-_RvQuKcFB%2m#-XFf%z#V%IY>c2uq*2S=SfU?8{*9_A7m9jfWz={IfRVv_vnclEcX2M(EYaC0ZN>Z1;UN5`1dT&tsH z-1A~zUXK0FjjXgzpYdcH@s(U^4XDmyc#(V|yNQ-dY2CBi3tGy_mT-xaOXr|F6!Rf0 z1`Ha-hyjgEC zaKQW+;a(1CL;D=~f>EJ!{O0D4`!Oq6=?m0*32$$7 zS32Cr^Sb7$DG^(ULx|gK*3Bi&IbZLs zcD+j*FL9{v+hz#a>5c1+Atl}f%eSiyF;{X_b}XS&p^xzre*9`vT^zznSXuCSuo z>@6>QseD3O{)Yix9BE?oxMCGdbgD1Jaw@aav=cntp~^#(f>kNHj^@V&v!8oP%zcez zYWScgs|_WDE(ErE3*C+6A>>jSSaLKn$4r&)wnfy>yvs z4>UR=QgYL*o`r;sjfa7m^QkMnIb^vdzdiO@xnpGBp3ui2aB_DDDZMD|cFP8OHi0b* zfK-&^DIgy0d3$+6zCWfML^yk1d;!;XXejD7L{?5>Jzgn~D1`51T2GyAvad@yh)b z&u*I^#oN30NXIk0)c2`Iuj<{6Z}`>og?%S!Z<~3%F~Q7Yd~Y_S-iYm&B>bnm1BGK;G-mgjxV4AOnCtii7!| zfM({u0?mN8{{fmA{wL-nMu1-QKP1$u|3SdS!t#@k>0jBk|0|Mg^czdk?|`xOZv;vI z&Win=C&?B-jsze^`ke#mH|nE5z+4ylpAfFcU+9f~BVqj$a{DLpvHu>qWoBn!|1)x% zquOlP5ugin2`OLDiuUXlzBH1p;e4v;&jIAo38*uQnz zY`2eCh50f15~NDLKKO43wANbJ^7&lc1liv;BKTxpxc5v4e-4&DkkH4vRyRo4&6Erl zo*9>me+XT~eel;`;R;d!{ZKonM{psA4N)wSGPryHpxJIC6OCW8s&`QccX$v&E_yCZ zxjoJ_a`KHuNamT+j06tV-*s9RXP92Y-*-p$dSGMvM}txFgrCpR4v_%c0*(qq%P4Wd zU2bx-ca|@A9y_n*;#W?NWuzBV$zT|!hMEXXP91iG{V@*rpzjnzz~BQsOYvBx3Ow$C z+OBNJcli;#`{Uts?d;Ad+9YpDjLq7{F)&fC7&aOzd~c^LB^0GqT#zxX{Xu4YM~{Zj zphrVHA0`w81|XuVqVadDoH{;nf8(PycdKvC^~^>B5r)eBq~Lh!*nhkXSHR0992Gy? zwYvB4{YXGd=|S@bdoIVWx)Bt4JSbwL)P5s=Xp12863P44qu=YKYVcyvKJ7KU0&_IFr5&|++dh*9Ss@2fJSiuD5~Ohh z>%kxpbgua|91CDR1T35}gUU3aex=vJoT=0X=aW!(8%$;T2?v`_stQ3(fZ6Xtr-GAuwYLxu=R)Iv;1v=pH zAVmNfRa*(8yX*3H;0Wpsb&QLjW}1Pnsa$1bNpXAdw11f?lXIsx>y2b@i7!>^K5n+nMo`E7bPrTQX>UUB85H2%Y8_R^A*k9un zG4KwWUO+SM>8HAe$0Ifvmel6Risue@)3}5q#AeMeH2k4XWQCbkE0L4QwKh?1f?rAc z5xQ(3*z{dAF(ZBQaz@48uWEcQ)WYv?sa?laAl?SZ|)JAjjAPkEYs zPXYRYMv(`otEdO~A*I$GJJz+ccOO%O!HZPv%W7$k%khfS*%U=XI2}JzSFY1FWu z&74Mgpx9JIp|e1*+dlG*#L$HnksMSHU@FO*jgls4&UBO1VkvvCE}V7({P# z!=~&YxMK9$u0(IVz)9ol^=w0^>-_7kab+PE1Nt>Y%u=modGjK|>z6o&6w5Q#v?iTd z;a?vBDTPh}*5rhZ2~pZF)*Gd@`$b>Ya*~Jy8rU^p*+R!`3(7npBOC2xYHj`8Sf*JU z8u{^fBNV52>UNslm^xGWzI(k)FuodTXX+DJ$XUPQ+V)i`);u!E#x!>uD}YWLL!H3j z`Pcr~lrDLRKL|B50JlAMHL9i^lPuYu;CP0O0nLn`GC38cj-w?hkq0K6(yqg`5u2#M z8u2*4s_yX9E%>|yPg@iTMWE{PIRpRoBH>-Rzfz#Ccr7xjQD^r4tG}+Ew&Dus%|iS| zfRs}1*%#s1vnOf-6TgLV&I?Xu-A_TC0#W+6rq!nOgpKHMUo2eN!G9Fl(t9`D?ptjn z*^5j!gYt%d5vQIER9jo}+zvYKJ@2FzQfyM6eA^XYkOQu%m(U_nMUNm;R*=X!66Fl% z48PJ^ihjzji46MUo2BDMX6rA5=H2hLc?PXvsbNZoh)whAS^4esQellN8DloKyrfFI zLSZiHMlI6UW0$~wJM4h!IR=Kat%Z+{*qzt@FsHcI-x_+6MqO?|c8Nw7r%Iod#pX0N zsi9X?hualx=ngf4^zjpK9Qe)_rig+r&T}rBDV~L;6l?~kJ18B8-kk&TTc-x&(`UlW zL7?;%MYScxdHJw(-23N|kQFVm{gR@wM=J0l;2-`(x#?LS&+lXGbUmNEQrxe7sk^4Qt#?2`rSDwKW2cb3{=xi99J0 zq(*+8_wIIw{9K_^hP#)*%eD_w2~&#u81AE&1^FZ*>kjOQ%M??)ES`$AI$hwRFrty<*Zoqc>?*M>O;UU^5bvZ8|KV#tf=@@U`3 zYnHR70$Wr+fWm!==?uB5Z(7xMd&aO&bKuWcW&($;*ugX74Ps6XQJ5LgF}JBPMWF?U z1_*H;;NhIKb5h3Dl7l5er#A5rpC4M=ou3t-mVGs3`!W>q{wnfB@nmBwlBK){N8Gn+ zLrW{qRo(||JXC^r3I(4j`1NZz|Iw-$q-XYGwbhhmxk4!YYBcXKn_f#r%o?)QP*Z9D zks{aZyyOdhYZN0F4ZIW6n@eA3Y1az}@Iv%W$epXLH6_wjB+d`b1YSzv?7Z!Vv6SzT z3gZ{I97VxSU>4Lg=vZre4J|&va(R^@jvfv*jhQU}dk6`d(=mY#QPCn<*7(wREW?s_EjELNNCathpIlJs1H)Ud z?hKF4bY>&g?BhZ61AnkP8y^z16770HzP1UBH}I6uYpi0*EWR3o#)fZ|pV8y^JM)Xb z^-VgfCsbNu^p|WJ#a7wQ_|G1u5;wEO#h2g6qi=zj)a?cqS(Z?hAr#Z0FBCA` z&n5>tF2uO{z-a5;xh1BfV2rJtj#;Xak6^P`ItX3q?aaIpGL z>eoe{49E`D>YhIeT+R4?#WU>f2o+7Y?>n4F?P6sTrWLrBK=?(n4Am;KX_#wS>%4iw zx$|3SI<88H$tU&rr;;eY+wOY?BN1nC-HjhlU>yfU9CpvsDumY2X|VSmvRW61mf&p3 zV^+7C-|ONXn1=fghSwKK1Chb!CF!*LgSgM69TgxD_+_r(KaNu20Ab1<^uM(Usin~x z7BT>@1*T$f*aJa;6$KWqbcF!KQV$q=IAk$CM?4+#gU1~mIa-LjxasY`u7Rp#B18Mh z%GXy}9T`ZFRQk+ELaqeWnxXW)fsBP02L1X}fc5VrTmMot`43aCx{UO{XnGkL*;)Vn zJ(h>x9q_#w5Wr1nXkunz%S(RV+DT4mVa!Xe#wx=gV=ruCZt=m>(L~8pR@unY%81jL zoSzSxhu;7o-ef}SZeUMqYGDnat#Tp+@GA2X3oA;C5&taU&gE`nZvzlkA#}H~wsqoi z=OzEG3K!t|r`nK<&2i_1$BiksUxIse`)AtM7F z0}~x1IsG3K`#<^vEapEC8?Xa^jGG5ghD!z@p<(JF0w5COV`5-pp=DsAW#CX|V&-Du zI9mVaa>hpV0K)H| zT{;1_f)OwfVXMoe&+XGna4Svf_0C)sB9}nP<&K7{&3BKPPTF~10_X}%_ zpRUDaZD4E0OYTlX;50Y89ZfaCIil=#DaDgMd9Df#&R5ZQ8fG%@|j?#~SU)3bhm z5wfwe0u;kc34gaSv9qxOl7xP~2yOqcv9hrLWLp1=jftK0=k5HjHa5WM|7K%gVC4A4 z#=-!gO8jeGW(LNeDq4SOkA;(&{g-|@Sr`CP8GkLu$jbTmx=bAGKXthNQjVF0krSX2 z@E02sJNr-VxWC%iSbv!>0}BKD-^UEF{IXU|9E?8|zy8u5fN=h&yvJW`fPUG3?H7J^*Zzf33?1=;H4-fYQP*{W1Zbng4z50d;@b4@MSFmS4ug&cX5bc`&hYvj5!% zsLS??jf3f@P}bk(%lYg0*niz~fVZ&yvgb^I-Tbw^U&qJ(Pj#6Y{=TM6tjwIh%$I}V zAI8V>4|Q1>|2|(PwqMtjiG$&n@i8+p{Ibr>ENs8{0SgnuFaFHJ$qqP?e_K-yz=8X_ zjq@Mo%gM>{_cdi^VEtt*tUqr%|7p+J(Ey;j;0REdB&1ie@H7G3HwXbjn|1)f%%3t0 zg!B@&rgnsY3IHKIdI=FiEgryeHk%^U6OjwXXkc~l*k%>(ZaK71@`2Oz_ dIzMIYoSY3DoqxMov9bU@{GiFmMCHVw{~xYPpK$;H literal 0 HcmV?d00001 diff --git a/src/static/support/dist-docs-branch-23.06/ovn-trace.8.txt b/src/static/support/dist-docs-branch-23.06/ovn-trace.8.txt new file mode 100644 index 00000000..d18a27d4 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/ovn-trace.8.txt @@ -0,0 +1,570 @@ +ovn-trace(8) OVN Manual ovn-trace(8) + +NAME + ovn-trace - Open Virtual Network logical network tracing utility + +SYNOPSIS + ovn-trace [options] [datapath] microflow + + ovn-trace [options] --detach + +DESCRIPTION + This utility simulates packet forwarding within an OVN logical network. + It can be used to run through ``what-ifā€™ā€™ scenarios: if a packet origiā€ + nates at a logical port, what will happen to it and where will it ultiā€ + mately end up? Users already familiar with the Open vSwitch ofā€ā€ + proto/trace command described in ovs-vswitch(8) will find ovn-trace to + be a similar tool for logical networks. + + ovn-trace works by reading the Logical_Flow and other tables from the + OVN southbound database (see ovn-sb(5)). It simulates a packetā€™s path + through logical networks by repeatedly looking it up in the logical + flow table, following the entire tree of possibilities. + + ovn-trace simulates only the OVN logical network. It does not simulate + the physical elements on which the logical network is layered. This + means that, for example, it is unimportant how VMs are distributed + among hypervisors, or whether their hypervisors are functioning and + reachable, so ovn-trace will yield the same results regardless. There + is one important exception: ovn-northd, the daemon that generates the + logical flows that ovn-trace simulates, treats logical ports differā€ + ently based on whether they are up or down. Thus, if you see surprising + results, ensure that the ports involved in a simulation are up. + + The simplest way to use ovn-trace is to provide the microflow (and opā€ + tional datapath) arguments on the command line. In this case, it simuā€ + lates the behavior of a single packet and exits. For an alternate usage + model, see Daemon Mode below. + + The optional datapath argument specifies the name of a logical dataā€ + path. Acceptable names are the name from the northbound Logical_Switch + or Logical_Router table, the UUID of a record from one of those tables, + or the UUID of a record from the southbound Datapath_Binding table. + (The datapath is optional because ovn-trace can figure it out from the + inport that the microflow matches.) + + The microflow argument describes the packet whose forwarding is to be + simulated, in the syntax of an OVN logical expression, as described in + ovn-sb(5), to express constraints. The parser understands prerequiā€ + sites; for example, if the expression refers to ip4.src, there is no + need to explicitly state ip4 or eth.type == 0x800. + + For reasonable L2 behavior, the microflow should include at least inā€ā€ + port and eth.dst, plus eth.src if port security is enabled. For examā€ + ple: + + inport == "lp11" && eth.src == 00:01:02:03:04:05 && eth.dst == ff:ff:ff:ff:ff:ff + + + For reasonable L3 behavior, microflow should also include ip4.src and + ip4.dst (or ip6.src and ip6.dst) and ip.ttl. For example: + + inport == "lp111" && eth.src == f0:00:00:00:01:11 && eth.dst == 00:00:00:00:ff:11 + && ip4.src == 192.168.11.1 && ip4.dst == 192.168.22.2 && ip.ttl == 64 + + + Hereā€™s an ARP microflow example: + + inport == "lp123" + && eth.dst == ff:ff:ff:ff:ff:ff && eth.src == f0:00:00:00:01:11 + && arp.op == 1 && arp.sha == f0:00:00:00:01:11 && arp.spa == 192.168.1.11 + && arp.tha == ff:ff:ff:ff:ff:ff && arp.tpa == 192.168.2.22 + + + ovn-trace will reject erroneous microflow expressions, which beyond + syntax errors fall into two categories. First, they can be ambiguous. + For example, tcp.src == 80 is ambiguous because it does not state IPv4 + or IPv6 as the Ethernet type. ip4 && tcp.src > 1024 is also ambiguous + because it does not constrain bits of tcp.src to particular values. + Second, they can be contradictory, e.g. ip4 && ip6. + +OUTPUT + ovn-trace supports the three different forms of output, each described + in a separate section below. Regardless of the selected output format, + ovn-trace starts the output with a line that shows the microflow being + traced in OpenFlow syntax. + + Detailed Output + The detailed form of output is also the default form. This form groups + output into sections headed up by the ingress or egress pipeline being + traversed. Each pipeline lists each table that was visited (by number + and name), the ovn-northd source file and line number of the code that + added the flow, the match expression and priority of the logical flow + that was matched, and the actions that were executed. + + The execution of OVN logical actions naturally forms a ``control + stackā€™ā€™ that resembles that of a program in conventional programming + languages such as C or Java. Because the next action that calls into + another logical flow table for a lookup is a recursive construct, OVN + ``programsā€™ā€™ in practice tend to form deep control stacks that, disā€ + played in the obvious way using additional indentation for each level, + quickly use up the horizontal space on all but the widest displays. To + make detailed output more readable, without loss of generality, + ovn-trace omits indentation for ``tail recursion,ā€™ā€™ that is, when next + is the last action in a logical flow, it does not indent details of the + next table lookup more deeply. Output still uses indentation when it is + needed for clarity. + + OVN ``programsā€™ā€™ traces also tend to encounter long strings of logical + flows with match expression 1 (which matches every packet) and the sinā€ + gle action next;. These are uninteresting and merely clutter output, so + ovn-trace omits them entirely even from detailed output. + + The following excerpt from detailed ovn-trace output shows a section + for a packet traversing the ingress pipeline of logical datapath ls1 + with ingress logical port lp111. The packet matches a logical flow in + table 0 (aka ls_in_port_sec_l2) with priority 50 and executes next(1); + to pass to table 1. Tables 1 through 11 are trivial and omitted. In taā€ + ble 19 (aka ls_in_l2_lkup), the packet matches a flow with priority 50 + based on its Ethernet destination address and the flowā€™s actions output + the packet to the lrp11-attachement logical port. + + ingress(dp="ls1", inport="lp111") + --------------------------------- + 0. ls_in_port_sec_l2: inport == "lp111", priority 50 + next(1); + 19. ls_in_l2_lkup: eth.dst == 00:00:00:00:ff:11, priority 50 + outport = "lrp11-attachment"; + output; + + + Summary Output + Summary output includes the logical pipelines visited by a packet and + the logical actions executed on it. Compared to the detailed output, + however, it removes details of tables and logical flows traversed by a + packet. It uses a format closer to that of a programming language and + does not attempt to avoid indentation. The summary output equivalent to + the above detailed output fragment is: + + ingress(dp="ls1", inport="lp111") { + outport = "lrp11-attachment"; + output; + ... + }; + + + Minimal Output + Minimal output includes only actions that modify packet data (not inā€ + cluding OVN registers or metadata such as outport) and output actions + that actually deliver a packet to a logical port (excluding patch + ports). The operands of actions that modify packet data are displayed + reduced to constants, e.g. ip4.dst = reg0; might be show as ip4.dst = + 192.168.0.1; if that was the value actually loaded. This yields output + even simpler than the summary format. (Users familiar with Open vSwitch + may recognize this as similar in spirit to the datapath actions listed + at the bottom of ofproto/trace output.) + + The minimal output format reflects the externally seen behavior of the + logical networks more than it does the implementation. This makes this + output format the most suitable for use in regression tests, because it + is least likely to change when logical flow tables are rearranged withā€ + out semantic change. + +STATEFUL ACTIONS + Some OVN logical actions use or update state that is not available in + the southbound database. ovn-trace handles these actions as described + below: + + ct_next + By default ovn-trace treats flows as ``trackedā€™ā€™ and + ``established.ā€™ā€™ See the description of the --ct option + for a way to override this behavior. + + ct_dnat (without an argument) + Forks the pipeline. In one fork, advances to the next taā€ + ble as if next; were executed. The packet is not changed, + on the assumption that no NAT state was available. In the + other fork, the pipeline continues without change after + the ct_dnat action. + + ct_snat (without an argument) + This action distinguishes between gateway routers and + distributed routers. A gateway router is defined as a + logical datapath that contains an l3gateway port; any + other logical datapath is a distributed router. On a + gateway router, ct_snat; is treated as a no-op. On a disā€ + tributed router, it is treated the same way as ct_dnat;. + + ct_dnat(ip) + ct_snat(ip) + Forks the pipeline. In one fork, sets ip4.dst (or ip4.src) + to ip and ct.dnat (or ct.snat) to 1 and advances to the + next table as if next; were executed. In the other fork, + the pipeline continues without change after the ct_dnat (or + ct_snat) action. + + ct_lb; + ct_lb(ip[:port]...); + Forks the pipeline. In one fork, sets ip4.dst (or ip6.dst) + to one of the load-balancer addresses and the destination + port to its associated port, if any, and sets ct.dnat to 1. + With one or more arguments, gives preference to the address + specified on --lb-dst, if any; without arguments, uses the + address and port specified on --lb-dst. In the other fork, + the pipeline continues without change after the ct_lb acā€ + tion. + + ct_commit + put_arp + put_nd + These actions are treated as no-ops. + +DAEMON MODE + If ovn-trace is invoked with the --detach option (see Daemon Options, + below), it runs in the background as a daemon and accepts commands from + ovs-appctl (or another JSON-RPC client) indefinitely. The currently + supported commands are described below. + + trace [options] [datapath] microflow + Traces microflow through datapath and replies with the + results of the trace. Accepts the options described under + Trace Options below. + + exit Causes ovn-trace to gracefully terminate. + +OPTIONS + Trace Options + --detailed + --summary + --minimal + These options control the form and level of detail in ovn-trace + output. If more than one of these options is specified, all of the + selected forms are output, in the order listed above, each headed + by a banner line. If none of these options is given, --detailed is + the default. See Output, above, for a description of each kind of + output. + + --all + Selects all three forms of output. + + --ovs[=remote] + Makes ovn-trace attempt to obtain and display the OpenFlow flows + that correspond to each OVN logical flow. To do so, ovn-trace conā€ + nects to remote (by default, unix:/br-int.mgmt) over OpenFlow and + retrieves the flows. If remote is specified, it must be an active + OpenFlow connection method described in ovsdb(7). + + To make the best use of the output, it is important to understand + the relationship between logical flows and OpenFlow flows. ovn-arā€ā€ + chitecture(7), under Architectural Physical Life Cycle of a + Packet, describes this relationship. Keep in mind the following + points: + + ā€¢ ovn-trace currently shows all the OpenFlow flows to which a + logical flow corresponds, even though an actual packet orā€ + dinarily matches only one of these. + + ā€¢ Some logical flows can map to the Open vSwitch ``conjuncā€ + tive matchā€™ā€™ extension (see ovs-fields(7)). Currently + ovn-trace cannot display the flows with conjunction actions + that effectively produce the conj_id match. + + ā€¢ Some logical flows may not be represented in the OpenFlow + tables on a given hypervisor, if they could not be used on + that hypervisor. + + ā€¢ Some OpenFlow flows do not correspond to logical flows, + such as OpenFlow flows that map between physical and logiā€ + cal ports. These flows will never show up in a trace. + + ā€¢ When ovn-trace omits uninteresting logical flows from outā€ + put, it does not look up the corresponding OpenFlow flows. + + --ct=flags + This option sets the ct_state flags that a ct_next logical action + will report. The flags must be a comma- or space-separated list of + the following connection tracking flags: + + ā€¢ trk: Include to indicate connection tracking has taken + place. (This bit is set automatically even if not listed in + flags. + + ā€¢ new: Include to indicate a new flow. + + ā€¢ est: Include to indicate an established flow. + + ā€¢ rel: Include to indicate a related flow. + + ā€¢ rpl: Include to indicate a reply flow. + + ā€¢ inv: Include to indicate a connection entry in a bad state. + + ā€¢ dnat: Include to indicate a packet whose destination IP adā€ + dress has been changed. + + ā€¢ snat: Include to indicate a packet whose source IP address + has been changed. + + The ct_next action is used to implement the OVN distributed fireā€ + wall. For testing, useful flag combinations include: + + ā€¢ trk,new: A packet in a flow in either direction through a + firewall that has not yet been committed (with ct_commit). + + ā€¢ trk,est: A packet in an established flow going out through + a firewall. + + ā€¢ trk,rpl: A packet coming in through a firewall in reply to + an established flow. + + ā€¢ trk,inv: An invalid packet in either direction. + + A packet might pass through the connection tracker twice in one + trip through OVN: once following egress from a VM as it passes + outward through a firewall, and once preceding ingress to a second + VM as it passes inward through a firewall. Use multiple --ct opā€ + tions to specify the flags for multiple ct_next actions. + + When --ct is unspecified, or when there are fewer --ct options + than ct_next actions, the flags default to trk,est. + + --lb-dst=ip[:port] + Sets the IP from VIP pool to use as destination of the packet. + --lb-dst is not available in daemon mode. + + --select-id=id + Specify the id to be selected by the select action. id must be one + of the values listed in the select action. Otherwise, a random id + is selected from the list, as if --select-id were not specified. + --select-id is not available in daemon mode. + + --friendly-names + --no-friendly-names + When cloud management systems such as OpenStack are layered on top + of OVN, they often use long, human-unfriendly names for ports and + datapaths, for example, ones that include entire UUIDs. They do + usually include friendlier names, but the long, hard-to-read names + are the ones that appear in matches and actions. By default, or + with --friendly-names, ovn-trace substitutes these friendlier + names for the long names in its output. Use --no-friendly-names to + disable this behavior; this option might be useful, for example, + if a program is going to parse ovn-trace output. + + Daemon Options + --pidfile[=pidfile] + Causes a file (by default, program.pid) to be created indicating + the PID of the running process. If the pidfile argument is not + specified, or if it does not begin with /, then it is created in + . + + If --pidfile is not specified, no pidfile is created. + + --overwrite-pidfile + By default, when --pidfile is specified and the specified pidā€ + file already exists and is locked by a running process, the daeā€ + mon refuses to start. Specify --overwrite-pidfile to cause it to + instead overwrite the pidfile. + + When --pidfile is not specified, this option has no effect. + + --detach + Runs this program as a background process. The process forks, + and in the child it starts a new session, closes the standard + file descriptors (which has the side effect of disabling logging + to the console), and changes its current directory to the root + (unless --no-chdir is specified). After the child completes its + initialization, the parent exits. + + --monitor + Creates an additional process to monitor this program. If it + dies due to a signal that indicates a programming error (SIGAā€ā€ + BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU, + or SIGXFSZ) then the monitor process starts a new copy of it. If + the daemon dies or exits for another reason, the monitor process + exits. + + This option is normally used with --detach, but it also funcā€ + tions without it. + + --no-chdir + By default, when --detach is specified, the daemon changes its + current working directory to the root directory after it deā€ + taches. Otherwise, invoking the daemon from a carelessly chosen + directory would prevent the administrator from unmounting the + file system that holds that directory. + + Specifying --no-chdir suppresses this behavior, preventing the + daemon from changing its current working directory. This may be + useful for collecting core files, since it is common behavior to + write core dumps into the current working directory and the root + directory is not a good directory to use. + + This option has no effect when --detach is not specified. + + --no-self-confinement + By default this daemon will try to self-confine itself to work + with files under well-known directories determined at build + time. It is better to stick with this default behavior and not + to use this flag unless some other Access Control is used to + confine daemon. Note that in contrast to other access control + implementations that are typically enforced from kernel-space + (e.g. DAC or MAC), self-confinement is imposed from the user- + space daemon itself and hence should not be considered as a full + confinement strategy, but instead should be viewed as an addiā€ + tional layer of security. + + --user=user:group + Causes this program to run as a different user specified in + user:group, thus dropping most of the root privileges. Short + forms user and :group are also allowed, with current user or + group assumed, respectively. Only daemons started by the root + user accepts this argument. + + On Linux, daemons will be granted CAP_IPC_LOCK and + CAP_NET_BIND_SERVICES before dropping root privileges. Daemons + that interact with a datapath, such as ovs-vswitchd, will be + granted three additional capabilities, namely CAP_NET_ADMIN, + CAP_NET_BROADCAST and CAP_NET_RAW. The capability change will + apply even if the new user is root. + + On Windows, this option is not currently supported. For security + reasons, specifying this option will cause the daemon process + not to start. + + Logging Options + -v[spec] + --verbose=[spec] + Sets logging levels. Without any spec, sets the log level for + every module and destination to dbg. Otherwise, spec is a list of + words separated by spaces or commas or colons, up to one from each + category below: + + ā€¢ A valid module name, as displayed by the vlog/list command + on ovs-appctl(8), limits the log level change to the speciā€ + fied module. + + ā€¢ syslog, console, or file, to limit the log level change to + only to the system log, to the console, or to a file, reā€ + spectively. (If --detach is specified, the daemon closes + its standard file descriptors, so logging to the console + will have no effect.) + + On Windows platform, syslog is accepted as a word and is + only useful along with the --syslog-target option (the word + has no effect otherwise). + + ā€¢ off, emer, err, warn, info, or dbg, to control the log + level. Messages of the given severity or higher will be + logged, and messages of lower severity will be filtered + out. off filters out all messages. See ovs-appctl(8) for a + definition of each log level. + + Case is not significant within spec. + + Regardless of the log levels set for file, logging to a file will + not take place unless --log-file is also specified (see below). + + For compatibility with older versions of OVS, any is accepted as a + word but has no effect. + + -v + --verbose + Sets the maximum logging verbosity level, equivalent to --verā€ā€ + bose=dbg. + + -vPATTERN:destination:pattern + --verbose=PATTERN:destination:pattern + Sets the log pattern for destination to pattern. Refer to ovs-apā€ā€ + pctl(8) for a description of the valid syntax for pattern. + + -vFACILITY:facility + --verbose=FACILITY:facility + Sets the RFC5424 facility of the log message. facility can be one + of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock, + ftp, ntp, audit, alert, clock2, local0, local1, local2, local3, + local4, local5, local6 or local7. If this option is not specified, + daemon is used as the default for the local system syslog and loā€ā€ + cal0 is used while sending a message to the target provided via + the --syslog-target option. + + --log-file[=file] + Enables logging to a file. If file is specified, then it is used + as the exact name for the log file. The default log file name used + if file is omitted is /usr/local/var/log/ovn/program.log. + + --syslog-target=host:port + Send syslog messages to UDP port on host, in addition to the sysā€ + tem syslog. The host must be a numerical IP address, not a hostā€ + name. + + --syslog-method=method + Specify method as how syslog messages should be sent to syslog + daemon. The following forms are supported: + + ā€¢ libc, to use the libc syslog() function. Downside of using + this options is that libc adds fixed prefix to every mesā€ + sage before it is actually sent to the syslog daemon over + /dev/log UNIX domain socket. + + ā€¢ unix:file, to use a UNIX domain socket directly. It is posā€ + sible to specify arbitrary message format with this option. + However, rsyslogd 8.9 and older versions use hard coded + parser function anyway that limits UNIX domain socket use. + If you want to use arbitrary message format with older + rsyslogd versions, then use UDP socket to localhost IP adā€ + dress instead. + + ā€¢ udp:ip:port, to use a UDP socket. With this method it is + possible to use arbitrary message format also with older + rsyslogd. When sending syslog messages over UDP socket exā€ + tra precaution needs to be taken into account, for example, + syslog daemon needs to be configured to listen on the specā€ + ified UDP port, accidental iptables rules could be interā€ + fering with local syslog traffic and there are some secuā€ + rity considerations that apply to UDP sockets, but do not + apply to UNIX domain sockets. + + ā€¢ null, to discard all messages logged to syslog. + + The default is taken from the OVS_SYSLOG_METHOD environment variā€ + able; if it is unset, the default is libc. + + PKI Options + PKI configuration is required to use SSL for the connection to the + database (and the switch, if --ovs is specified). + + -p privkey.pem + --private-key=privkey.pem + Specifies a PEM file containing the private key used as + identity for outgoing SSL connections. + + -c cert.pem + --certificate=cert.pem + Specifies a PEM file containing a certificate that certiā€ + fies the private key specified on -p or --private-key to be + trustworthy. The certificate must be signed by the certifiā€ + cate authority (CA) that the peer in SSL connections will + use to verify it. + + -C cacert.pem + --ca-cert=cacert.pem + Specifies a PEM file containing the CA certificate for verā€ + ifying certificates presented to this program by SSL peers. + (This may be the same certificate that SSL peers use to + verify the certificate specified on -c or --certificate, or + it may be a different one, depending on the PKI design in + use.) + + -C none + --ca-cert=none + Disables verification of certificates presented by SSL + peers. This introduces a security risk, because it means + that certificates cannot be verified to be those of known + trusted hosts. + + Other Options + --db database + The OVSDB database remote to contact. If the OVN_SB_DB environā€ + ment variable is set, its value is used as the default. Otherā€ + wise, the default is unix:/db.sock, but this default is unlikely + to be useful outside of single-machine OVN test environments. + + -h + --help + Prints a brief help message to the console. + + -V + --version + Prints version information to the console. + +OVN 23.06.3 ovn-trace ovn-trace(8) diff --git a/src/static/support/dist-docs-branch-23.06/style.css b/src/static/support/dist-docs-branch-23.06/style.css new file mode 100644 index 00000000..8a065186 --- /dev/null +++ b/src/static/support/dist-docs-branch-23.06/style.css @@ -0,0 +1,25 @@ +div { vertical-align:top; } +p { + vertical-align:baseline; +} +a { + text-decoration: none; + font-weight: 700; +} +a:hover { + color:#444; +} +a:visited { + color:#447099; +} +a:link { + color:#447099; +} + +body { + font-family: Arial,Helvetica,sans-serif; + font-size: 14px; + line-height: 1.5em; + color: #444; + background-color:#f5f5f5; +} 
+ovn-sbctl(8)                      OVN Manual                      ovn-sbctl(8)
+
+NAME
+       ovn-sbctl - Open Virtual Network southbound db management utility
+
+SYNOPSIS
+       ovn-sbctl [options] command [arg...]
+
+DESCRIPTION
+       The ovn-sbctl program configures the OVN_Southbound database by providā€
+       ing a high-level interface to its configuration database. See ovn-sb(5)
+       for comprehensive documentation of the database schema.
+
+       ovn-sbctl  connects  to  an  ovsdb-server  process  that  maintains  an
+       OVN_Southbound  configuration  database.  Using  this  connection,   it
+       queries  and possibly applies changes to the database, depending on the
+       supplied commands.
+
+       ovn-sbctl can perform any number of commands in a  single  run,  impleā€
+       mented as a single atomic transaction against the database.
+
+       The  ovn-sbctl command line begins with global options (see OPTIONS beā€
+       low for details). The global options are followed by one or  more  comā€
+       mands.  Each  command  should begin with -- by itself as a command-line
+       argument, to separate it from the following commands.  (The  --  before
+       the first command is optional.) The command itself starts with command-
+       specific  options,  if  any, followed by the command name and any arguā€
+       ments.
+
+DAEMON MODE
+       When it is invoked in the most ordinary way, ovn-sbctl connects  to  an
+       OVSDB  server  that  hosts the southbound database, retrieves a partial
+       copy of the database that is complete enough to do its  work,  sends  a
+       transaction  request  to  the  server,  and  receives and processes the
+       serverā€™s reply. In common interactive use, this is  fine,  but  if  the
+       database is large, the step in which ovn-sbctl retrieves a partial copy
+       of  the  database  can  take a long time, which yields poor performance
+       overall.
+
+       To improve performance in such  a  case,  ovn-sbctl  offers  a  "daemon
+       mode,"  in  which  the user first starts ovn-sbctl running in the backā€
+       ground and afterward uses the daemon to execute operations.  Over  sevā€
+       eral  ovn-sbctl  command  invocations, this performs better overall beā€
+       cause it retrieves a copy of the database only once at  the  beginning,
+       not once per program run.
+
+       Use the --detach option to start an ovn-sbctl daemon. With this option,
+       ovn-sbctl  prints  the  name  of a control socket to stdout. The client
+       should save this name in environment variable OVN_SB_DAEMON. Under  the
+       Bourne shell this might be done like this:
+
+             export OVN_SB_DAEMON=$(ovn-sbctl --pidfile --detach)
+
+
+       When  OVN_SB_DAEMON  is  set, ovn-sbctl automatically and transparently
+       uses the daemon to execute its commands.
+
+       When the daemon is no longer needed, kill it and unset the  environment
+       variable, e.g.:
+
+             kill $(cat $OVN_RUNDIR/ovn-sbctl.pid)
+             unset OVN_SB_DAEMON
+
+
+       When using daemon mode, an alternative to the OVN_SB_DAEMON environment
+       variable  is  to  specify a path for the Unix socket. When starting the
+       ovn-sbctl daemon, specify the -u option with a full path to  the  locaā€
+       tion of the socket file. Here is an exmple:
+
+             ovn-sbctl --detach -u /tmp/mysock.ctl
+
+
+       Then  to connect to the running daemon, use the -u option with the full
+       path to the socket created when the daemon was started:
+
+             ovn-sbctl -u /tmp/mysock.ctl show
+
+
+     Daemon Commands
+
+       Daemon mode is internally implemented using the same mechanism used  by
+       ovn-appctl.  One  may  also  use ovn-appctl directly with the following
+       commands:
+
+              run [options] command [arg...] [-- [options] command [arg...]
+              ...]
+                     Instructs the daemon process to run one or more ovn-sbctl
+                     commands described above and reply with  the  results  of
+                     running  these  commands.  Accepts the --no-wait, --wait,
+                     --timeout, --dry-run,  --oneline,  and  the  options  deā€
+                     scribed under Table Formatting Options in addition to the
+                     the command-specific options.
+
+              exit   Causes ovn-sbctl to gracefully terminate.
+
+OPTIONS
+       The  options  listed below affect the behavior of ovn-sbctl as a whole.
+       Some individual commands also accept their own options, which are given
+       just before the command name. If the first command on the command  line
+       has  options,  then those options must be separated from the global opā€
+       tions by --.
+
+       ovn-sbctl also accepts options from the  OVN_SBCTL_OPTIONS  environment
+       variable,  in  the same format as on the command line. Options from the
+       command line override those in the environment.
+
+              --db database
+                     The OVSDB database remote to contact.  If  the  OVN_SB_DB
+                     environment variable is set, its value is used as the deā€
+                     fault. Otherwise, the default is unix:/ovnsb_db.sock, but
+                     this  default is unlikely to be useful outside of single-
+                     machine OVN test environments.
+
+              --leader-only
+              --no-leader-only
+                   By default, or with --leader-only, when the database server
+                   is a clustered database, ovn-sbctl will avoid servers other
+                   than the cluster leader. This ensures that  any  data  that
+                   ovn-sbctl   reads   and   reports   is   up-to-date.   With
+                   --no-leader-only, ovn-sbctl will  use  any  server  in  the
+                   cluster, which means that for read-only transactions it can
+                   report  and act on stale data (transactions that modify the
+                   database are always serialized even with --no-leader-only).
+                   Refer to Understanding Cluster Consistency in ovsdb(7)  for
+                   more information.
+
+              --shuffle-remotes
+              --no-shuffle-remotes
+                   By  default, or with --shuffle-remotes, when there are mulā€
+                   tiple remotes specified  in  the  OVSDB  connection  string
+                   specified  by  --db  or the OVN_SB_DB environment variable,
+                   the order of the remotes will be shuffled before the client
+                   tries to connect. The remotes will be shuffled only once to
+                   a new order before the first connection attempt.  The  folā€
+                   lowing retries, if any, will follow the same new order. The
+                   default  behavior  is  to  make sure clients of a clustered
+                   database can distribute evenly to all members of the  clusā€
+                   ter.  With  --no-shuffle-remotes,  ovn-sbctl  will  use the
+                   original order specified in the connection string  to  conā€
+                   nect.  This  allows  user  to  specify the preferred order,
+                   which is particularly useful for testing.
+
+              --no-syslog
+                   By default, ovn-sbctl logs its arguments and the details of
+                   any changes that it makes to the system  log.  This  option
+                   disables this logging.
+
+                   This option is equivalent to --verbose=sbctl:syslog:warn.
+
+              --oneline
+                   Modifies the output format so that the output for each comā€
+                   mand  is printed on a single line. New-line characters that
+                   would otherwise separate lines are  printed  as  \fB\\n\fR,
+                   and  any  instances of \fB\\\fR that would otherwise appear
+                   in the output are doubled. Prints a  blank  line  for  each
+                   command that has no output. This option does not affect the
+                   formatting  of  output  from the list or find commands; see
+                   Table Formatting Options below.
+
+              --dry-run
+                   Prevents ovn-sbctl from actually modifying the database.
+
+              -t secs
+              --timeout=secs
+                   By default, or with a secs of 0,  ovn-sbctl  waits  forever
+                   for  a  response from the database. This option limits runā€
+                   time to approximately secs seconds. If the timeout expires,
+                   ovn-sbctl will exit with a SIGALRM signal. (A timeout would
+                   normally happen only if the database cannot  be  contacted,
+                   or if the system is overloaded.)
+
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the  PID  of the running process. If the pidfile argument is not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By default, when --pidfile is specified and the  specified  pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs  this  program  as a background process. The process forks,
+              and in the child it starts a new session,  closes  the  standard
+              file descriptors (which has the side effect of disabling logging
+              to  the  console), and changes its current directory to the root
+              (unless --no-chdir is specified). After the child completes  its
+              initialization, the parent exits.
+
+       --monitor
+              Creates  an  additional  process  to monitor this program. If it
+              dies due to a signal that indicates a programming  error  (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This  option  is  normally used with --detach, but it also funcā€
+              tions without it.
+
+       --no-chdir
+              By default, when --detach is specified, the daemon  changes  its
+              current  working  directory  to  the root directory after it deā€
+              taches. Otherwise, invoking the daemon from a carelessly  chosen
+              directory  would  prevent  the administrator from unmounting the
+              file system that holds that directory.
+
+              Specifying --no-chdir suppresses this behavior,  preventing  the
+              daemon  from changing its current working directory. This may be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By default this daemon will try to self-confine itself  to  work
+              with  files  under  well-known  directories  determined at build
+              time. It is better to stick with this default behavior  and  not
+              to  use  this  flag  unless some other Access Control is used to
+              confine daemon. Note that in contrast to  other  access  control
+              implementations  that  are  typically enforced from kernel-space
+              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
+              space daemon itself and hence should not be considered as a full
+              confinement  strategy,  but instead should be viewed as an addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes this program to run as  a  different  user  specified  in
+              user:group,  thus  dropping  most  of the root privileges. Short
+              forms user and :group are also allowed,  with  current  user  or
+              group  assumed,  respectively.  Only daemons started by the root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
+              that interact with a datapath, such  as  ovs-vswitchd,  will  be
+              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
+              CAP_NET_BROADCAST and CAP_NET_RAW. The  capability  change  will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons,  specifying  this  option will cause the daemon process
+              not to start.
+
+   Logging options
+       -v[spec]
+       --verbose=[spec]
+            Sets logging levels. Without any spec,  sets  the  log  level  for
+            every  module and destination to dbg. Otherwise, spec is a list of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A valid module name, as displayed by the vlog/list  command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog,  console, or file, to limit the log level change to
+                   only to the system log, to the console, or to a  file,  reā€
+                   spectively.  (If  --detach  is specified, the daemon closes
+                   its standard file descriptors, so logging  to  the  console
+                   will have no effect.)
+
+                   On  Windows  platform,  syslog is accepted as a word and is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off, emer, err, warn, info, or  dbg,  to  control  the  log
+                   level.  Messages  of  the  given severity or higher will be
+                   logged, and messages of lower  severity  will  be  filtered
+                   out.  off filters out all messages. See ovs-appctl(8) for a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless of the log levels set for file, logging to a file  will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets  the  maximum  logging  verbosity level, equivalent to --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets the log pattern for destination to pattern. Refer to  ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets  the RFC5424 facility of the log message. facility can be one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp, ntp, audit, alert, clock2, local0,  local1,  local2,  local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon  is used as the default for the local system syslog and loā€ā€
+            cal0 is used while sending a message to the  target  provided  via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables  logging  to a file. If file is specified, then it is used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send syslog messages to UDP port on host, in addition to the  sysā€
+            tem  syslog.  The host must be a numerical IP address, not a hostā€
+            name.
+
+       --syslog-method=method
+            Specify method as how syslog messages should  be  sent  to  syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc,  to use the libc syslog() function. Downside of using
+                   this options is that libc adds fixed prefix to  every  mesā€
+                   sage  before  it is actually sent to the syslog daemon over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However, rsyslogd 8.9 and older  versions  use  hard  coded
+                   parser  function anyway that limits UNIX domain socket use.
+                   If you want to use  arbitrary  message  format  with  older
+                   rsyslogd  versions, then use UDP socket to localhost IP adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port, to use a UDP socket. With this  method  it  is
+                   possible  to  use  arbitrary message format also with older
+                   rsyslogd. When sending syslog messages over UDP socket  exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified  UDP  port, accidental iptables rules could be interā€
+                   fering with local syslog traffic and there are  some  secuā€
+                   rity  considerations  that apply to UDP sockets, but do not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The default is taken from the OVS_SYSLOG_METHOD environment  variā€
+            able; if it is unset, the default is libc.
+
+   Table Formatting Options
+       These  options control the format of output from the list and find comā€
+       mands.
+
+              -f format
+              --format=format
+                   Sets the type of table formatting. The following  types  of
+                   format are available:
+
+                   table  2-D text tables with aligned columns.
+
+                   list (default)
+                          A  list  with one column per line and rows separated
+                          by a blank line.
+
+                   html   HTML tables.
+
+                   csv    Comma-separated values as defined in RFC 4180.
+
+                   json   JSON format as defined in RFC 4627. The output is  a
+                          sequence  of JSON objects, each of which corresponds
+                          to one table. Each JSON  object  has  the  following
+                          members with the noted values:
+
+                          caption
+                                 The  tableā€™s  caption. This member is omitted
+                                 if the table has no caption.
+
+                          headings
+                                 An array with one element per  table  column.
+                                 Each  array  element  is  a string giving the
+                                 corresponding columnā€™s heading.
+
+                          data   An array with one element per table row. Each
+                                 element is also an array with one element per
+                                 table column. The elements  of  this  second-
+                                 level array are the cells that constitute the
+                                 table.  Cells  that  represent  OVSDB data or
+                                 data types are expressed in  the  format  deā€
+                                 scribed  in  the  OVSDB  specification; other
+                                 cells are simply expressed as text strings.
+
+              -d format
+              --data=format
+                   Sets the formatting for cells within output  tables  unless
+                   the table format is set to json, in which case json formatā€
+                   ting  is  always  used when formatting cells. The following
+                   types of format are available:
+
+                   string (default)
+                          The simple format described in the  Database  Values
+                          section of ovs-vsctl(8).
+
+                   bare   The  simple format with punctuation stripped off: []
+                          and {} are omitted  around  sets,  maps,  and  empty
+                          columns,  items within sets and maps are space-sepaā€
+                          rated, and strings are never quoted. This format may
+                          be easier for scripts to parse.
+
+                   json   The RFC 4627 JSON format as described above.
+
+              --no-headings
+                   This option suppresses the heading row that  otherwise  apā€
+                   pears in the first row of table output.
+
+              --pretty
+                   By  default, JSON in output is printed as compactly as posā€
+                   sible. This option causes JSON in output to be printed in a
+                   more readable fashion. Members of objects and  elements  of
+                   arrays are printed one per line, with indentation.
+
+                   This option does not affect JSON in tables, which is always
+                   printed compactly.
+
+              --bare
+                   Equivalent to --format=list --data=bare --no-headings.
+
+   PKI Options
+       PKI  configuration  is  required  to  use SSL for the connection to the
+       database.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies a PEM file containing the  private  key  used  as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies  a  PEM file containing a certificate that certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate authority (CA) that the peer in SSL  connections  will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This  may  be  the  same certificate that SSL peers use to
+                   verify the certificate specified on -c or --certificate, or
+                   it may be a different one, depending on the PKI  design  in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables  verification  of  certificates  presented  by SSL
+                   peers. This introduces a security risk,  because  it  means
+                   that  certificates  cannot be verified to be those of known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When cacert.pem exists, this option has the  same  effect
+                     as  -C  or --ca-cert. If it does not exist, then the exeā€
+                     cutable will attempt to obtain the  CA  certificate  from
+                     the  SSL  peer on its first SSL connection and save it to
+                     the named PEM file. If it is successful, it will  immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all  SSL  connections must be authenticated by a certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This option exposes the SSL connection to  a  man-in-the-
+                     middle  attack  obtaining the initial CA certificate, but
+                     it may be useful for bootstrapping.
+
+                     This option is only useful if the SSL peer sends  its  CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol  does not require the server to send the CA cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+   Other Options
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+COMMANDS
+       The following sections describe the commands that ovn-sbctl supports.
+
+   OVN_Southbound Commands
+       These commands work with an OVN_Southbound database as a whole.
+
+              init   Initializes the database, if it is empty. If the database
+                     has already been initialized, this command has no effect.
+
+              show   Prints a brief overview of the database contents.
+
+   Chassis Commands
+       These commands manipulate OVN_Southbound chassis.
+
+              [--may-exist] chassis-add chassis encap-type encap-ip
+                     Creates a new chassis  named  chassis.  encap-type  is  a
+                     comma-separated  list  of  tunnel types. The chassis will
+                     have one encap entry for each specified tunnel type  with
+                     encap-ip as the destination IP for each.
+
+                     Without  --may-exist, attempting to create a chassis that
+                     exists is an error. With --may-exist, this  command  does
+                     nothing if chassis already exists.
+
+              [--if-exists] chassis-del chassis
+                     Deletes chassis and its encaps and gateway_ports.
+
+                     Without  --if-exists, attempting to delete a chassis that
+                     does not exist is an error. With  --if-exists  attempting
+                     to delete a chassis that does not exist has no effect.
+
+   Port Binding Commands
+       These commands manipulate OVN_Southbound port bindings.
+
+              [--may-exist] lsp-bind logical-port chassis
+                     Binds the logical port named logical-port to chassis.
+
+                     Without  --may-exist,  attempting  to bind a logical port
+                     that has already been bound is an error.  With  --may-exā€ā€
+                     ist,  this  command  does nothing if logical-port has alā€
+                     ready been bound to a chassis.
+
+              [--if-exists] lsp-unbind logical-port
+                     Removes the binding of logical-port.
+
+                     Without --if-exists, attempting to unbind a logical  port
+                     that is not bound is an error. With --if-exists, attemptā€
+                     ing  to  unbind logical port that is not bound has no efā€
+                     fect.
+
+   Logical Flow Commands
+       [--uuid] [--ovs[=remote]] [--stats] [--vflows] lflow-list [logical-
+       datapath] [lflow...]
+              List logical flows. If logical-datapath is specified, only  list
+              flows  for  that  logical  datapath. The logical-datapath may be
+              given as a UUID or as a datapath name  (reporting  an  error  if
+              multiple datapaths have the same name).
+
+              If  at least one lflow is given, only matching logical flows, if
+              any, are listed. Each lflow may be specified as a  UUID  or  the
+              first  few characters of a UUID, optionally prefixed by 0x. (Beā€
+              cause ovn-controller sets OpenFlow flow cookies to the first  32
+              bits  of  the  corresponding  logical flowā€™s UUID, this makes it
+              easy to look up the logical flow  that  generated  a  particular
+              OpenFlow flow.)
+
+              If --uuid is specified, the output includes the first 32 bits of
+              each logical flowā€™s UUID. This makes it easier to find the Openā€
+              Flow flows that correspond to a given logical flow.
+
+              If  --ovs  is included, ovn-sbctl attempts to obtain and display
+              the OpenFlow flows that correspond to each OVN logical flow.  To
+              do    so,    ovn-sbctl   connects   to   remote   (by   default,
+              unix:/br-int.mgmt) over OpenFlow and retrieves the flows. If reā€
+              mote is specified, it must  be  an  active  OpenFlow  connection
+              method  described  in ovsdb(7). Please see the discussion of the
+              similar --ovs option in ovn-trace(8) for more information  about
+              the OpenFlow flow output.
+
+              By  default,  OpenFlow  flow  output includes only match and acā€
+              tions. Add --stats to include all OpenFlow information, such  as
+              packet and byte counters, duration, and timeouts.
+
+              If  --vflows  is included, other southbound database records diā€
+              rectly used for generating OpenFlow flows are also listed.  This
+              includes:  port-bindings,  mac-bindings, multicast-groups, chasā€
+              sis. The --ovs and --stats can also be used in conjunction  with
+              --vflows.
+
+       [--uuid] dump-flows [logical-datapath]
+              Alias for lflow-list.
+
+       count-flows [logical-datapath]
+              prints numbers of logical flows per table and per datapath.
+
+   Remote Connectivity Commands
+       These commands manipulate the connections column in the SB_Global table
+       and  rows  in  the Connection table. When ovsdb-server is configured to
+       use the connections column for OVSDB connections, this allows  the  adā€
+       ministrator to use \fBovn\-sbctl\fR to configure database connections.
+
+              get-connection
+                     Prints the configured connection(s).
+
+              del-connection
+                     Deletes the configured connection(s).
+
+              [--inactivity-probe=msecs] set-connection target...
+                     Sets  the configured manager target or targets. Use --inā€ā€
+                     activity-probe=msecs to override the default idle connecā€
+                     tion inactivity probe time. Use 0 to  disable  inactivity
+                     probes.
+
+   SSL Configuration Commands
+       When ovsdb-server is configured to connect using SSL, the following paā€
+       rameters are required:
+
+              private-key
+                     Specifies  a PEM file containing the private key used for
+                     SSL connections.
+
+              certificate
+                     Specifies a PEM file containing a certificate, signed  by
+                     the  certificate  authority  (CA)  used by the connection
+                     peers, that certifies  the  private  key,  identifying  a
+                     trustworthy peer.
+
+              ca-cert
+                     Specifies  a  PEM file containing the CA certificate used
+                     to verify that the connection peers are trustworthy.
+
+       These SSL settings apply to all SSL connections made by the  southbound
+       database server.
+
+              get-ssl
+                     Prints the SSL configuration.
+
+              del-ssl
+                     Deletes the current SSL configuration.
+
+              [--bootstrap] set-ssl private-key certificate ca-cert [ssl-proā€
+              tocol-list [ssl-cipher-list]]
+                     Sets the SSL configuration.
+
+   Database Commands
+       These  commands query and modify the contents of ovsdb tables. They are
+       a slight abstraction of the ovsdb interface and as such they operate at
+       a lower level than other ovn-sbctl commands.
+
+       Identifying Tables, Records, and Columns
+
+       Each of these commands has a table parameter to identify a table within
+       the database. Many of them also take a record parameter that identifies
+       a particular record within a table. The record  parameter  may  be  the
+       UUID  for  a  record, which may be abbreviated to its first 4 (or more)
+       hex digits, as long as that is unique.  Many  tables  offer  additional
+       ways  to  identify  records.  Some commands also take column parameters
+       that identify a particular field within the records in a table.
+
+       For a list of tables and their columns, see ovn-sb(5) or see the  table
+       listing from the --help option.
+
+       Record names must be specified in full and with correct capitalization,
+       except  that  UUIDs  may  be abbreviated to their first 4 (or more) hex
+       digits, as long as that is unique within the table. Names of tables and
+       columns are not case-sensitive, and - and _  are  treated  interchangeā€
+       ably.  Unique  abbreviations  of table and column names are acceptable,
+       e.g. d or dhcp is sufficient to identify the DHCP_Options table.
+
+       Database Values
+
+       Each column in the database accepts a fixed type of data. The currently
+       defined basic types, and their representations, are:
+
+              integer
+                     A decimal integer in the range -2**63 to 2**63-1,  incluā€
+                     sive.
+
+              real   A floating-point number.
+
+              Boolean
+                     True or false, written true or false, respectively.
+
+              string An  arbitrary  Unicode string, except that null bytes are
+                     not allowed. Quotes are optional for  most  strings  that
+                     begin  with  an  English letter or underscore and consist
+                     only of letters, underscores, hyphens, and periods.  Howā€
+                     ever, true and false and strings that match the syntax of
+                     UUIDs  (see  below)  must be enclosed in double quotes to
+                     distinguish them from  other  basic  types.  When  double
+                     quotes  are  used, the syntax is that of strings in JSON,
+                     e.g. backslashes may be used to  escape  special  characā€
+                     ters.  The  empty string must be represented as a pair of
+                     double quotes ("").
+
+              UUID   Either a universally unique identifier in  the  style  of
+                     RFC  4122,  e.g. f81d4fae-7dec-11d0-a765-00a0c91e6bf6, or
+                     an @name defined by a get or create  command  within  the
+                     same ovs-vsctl invocation.
+
+       Multiple values in a single column may be separated by spaces or a sinā€
+       gle  comma.  When  multiple  values are present, duplicates are not alā€
+       lowed, and order is not important. Conversely,  some  database  columns
+       can have an empty set of values, represented as [], and square brackets
+       may optionally enclose other non-empty sets or single values as well.
+
+       A  few  database columns are ``mapsā€™ā€™ of key-value pairs, where the key
+       and the value are each some fixed database type. These are specified in
+       the form key=value, where key and value follow the syntax for the  colā€
+       umnā€™s  key  type  and value type, respectively. When multiple pairs are
+       present (separated by spaces or a comma), duplicate keys  are  not  alā€
+       lowed,  and  again the order is not important. Duplicate values are alā€
+       lowed. An empty map is represented as {}. Curly braces  may  optionally
+       enclose  non-empty  maps  as  well (but use quotes to prevent the shell
+       from expanding other-config={0=x,1=y} into other-config=0=x  other-conā€ā€
+       fig=1=y, which may not have the desired effect).
+
+       Database Command Syntax
+
+              [--if-exists] [--columns=column[,column]...] list table
+              [record]...
+                     Lists  the  data  in each specified record. If no records
+                     are specified, lists all the records in table.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order.  Otherwise,  all  columns
+                     are listed, in alphabetical order by column name.
+
+                     Without  --if-exists,  it  is  an  error if any specified
+                     record does not exist. With --if-exists, the command  igā€
+                     nores  any  record that does not exist, without producing
+                     any output.
+
+              [--columns=column[,column]...] find table [colā€
+              umn[:key]=value]...
+                     Lists the data in  each  record  in  table  whose  column
+                     equals  value  or, if key is specified, whose column conā€
+                     tains a key with the specified value. The following operā€
+                     ators may be used where = is written in the  syntax  sumā€
+                     mary:
+
+                     = != gt;>gt; = >gt;>gt;=
+                            Selects records in which column[:key] equals, does
+                            not  equal, is less than, is greater than, is less
+                            than or equal to, or is greater than or  equal  to
+                            value, respectively.
+
+                            Consider  column[:key]  and  value as sets of eleā€
+                            ments. Identical sets are considered equal. Otherā€
+                            wise, if the sets have different numbers  of  eleā€
+                            ments,  then the set with more elements is considā€
+                            ered to be larger. Otherwise, consider  a  element
+                            from each set pairwise, in increasing order within
+                            each  set.  The first pair that differs determines
+                            the result. (For a column that contains  key-value
+                            pairs, first all the keys are compared, and values
+                            are  considered only if the two sets contain idenā€
+                            tical keys.)
+
+                     {=} {!=}
+                            Test for set equality or inequality, respectively.
+
+                     {=}   Selects records in which column[:key] is a  subset
+                            of  value. For example, flood-vlans{=}1,2 selects
+                            records in which the  flood-vlans  column  is  the
+                            empty set or contains 1 or 2 or both.
+
+                     {}    Selects  records in which column[:key] is a proper
+                            subset of value.  For  example,  flood-vlans{}1,2
+                            selects records in which the flood-vlans column is
+                            the empty set or contains 1 or 2 but not both.
+
+                     {>gt;>gt;=} {>gt;>gt;}
+                            Same  as  {=}  and {}, respectively, except that
+                            the  relationship  is   reversed.   For   example,
+                            flood-vlans{>gt;>gt;=}1,2  selects  records  in which the
+                            flood-vlans column contains both 1 and 2.
+
+                     The  following  operators  are  available  only  in  Open
+                     vSwitch 2.16 and later:
+
+                     {in}   Selects  records  in  which  every element in colā€
+                            umn[:key] is also in value. (This is the  same  as
+                            {=}.)
+
+                     {not-in}
+                            Selects  records  in  which  every element in colā€
+                            umn[:key] is not in value.
+
+                     For arithmetic operators (= != gt;>gt; = >gt;>gt;=),  when  key  is
+                     specified  but a particular recordā€™s column does not conā€
+                     tain key, the record is always omitted from the  results.
+                     Thus,   the   condition   other-config:mtu!=1500  matches
+                     records that have a mtu key whose value is not 1500,  but
+                     not those that lack an mtu key.
+
+                     For  the  set operators, when key is specified but a parā€
+                     ticular recordā€™s column does not contain key, the comparā€
+                     ison is done against an empty set.  Thus,  the  condition
+                     other-config:mtu{!=}1500  matches records that have a mtu
+                     key whose value is not 1500 and those that  lack  an  mtu
+                     key.
+
+                     Donā€™t  forget to escape gt;>gt; from interpretation by the
+                     shell.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order. Otherwise all columns are
+                     listed, in alphabetical order by column name.
+
+                     The UUIDs shown for rows created in  the  same  ovs-vsctl
+                     invocation will be wrong.
+
+              [--if-exists] [--id=@name] get table record [column[:key]]...
+                     Prints  the  value  of each specified column in the given
+                     record in table. For map columns, a key may optionally be
+                     specified, in which case the value associated with key in
+                     the column is printed, instead of the entire map.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist  or  key  is  specified,  if  key does not exist in
+                     record. With --if-exists, a missing record yields no outā€
+                     put and a missing key prints a blank line.
+
+                     If @name is specified, then the UUID for  record  may  be
+                     referred  to by that name later in the same ovs-vsctl inā€
+                     vocation in contexts where a UUID is expected.
+
+                     Both --id and the column arguments are optional, but usuā€
+                     ally at least one or the other should  be  specified.  If
+                     both are omitted, then get has no effect except to verify
+                     that record exists in table.
+
+                     --id and --if-exists cannot be used together.
+
+              [--if-exists] set table record column[:key]=value...
+                     Sets  the  value  of  each  specified column in the given
+                     record in table to value. For map columns, a key may  opā€
+                     tionally be specified, in which case the value associated
+                     with key in that column is changed (or added, if none exā€
+                     ists), instead of the entire map.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--if-exists] add table record column [key=]value...
+                     Adds  the  specified value or key-value pair to column in
+                     record in table. If column is a  map,  then  key  is  reā€
+                     quired, otherwise it is prohibited. If key already exists
+                     in  a  map column, then the current value is not replaced
+                     (use the set command to replace an existing value).
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] remove table record column value...
+
+                     [--if-exists] remove table record column key...
+
+                     [--if-exists] remove  table  record  column  key=value...
+                     Removes the specified values or key-value pairs from colā€
+                     umn in record in table. The first form applies to columns
+                     that  are  not maps: each specified value is removed from
+                     the column. The second  and  third  forms  apply  to  map
+                     columns:  if  only a key is specified, then any key-value
+                     pair with the given key is  removed,  regardless  of  its
+                     value; if a value is given then a pair is removed only if
+                     both key and value match.
+
+                     It  is  not  an  error if the column does not contain the
+                     specified key or value or pair.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] clear table record column...
+                     Sets each column in record in table to the empty  set  or
+                     empty  map,  as appropriate. This command applies only to
+                     columns that are allowed to be empty.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--id=(@name|uuid)] create table column[:key]=value...
+                     Creates a new record in table and sets the initial values
+                     of each column. Columns not explicitly set  will  receive
+                     their default values. Outputs the UUID of the new row.
+
+                     If  @name is specified, then the UUID for the new row may
+                     be referred to by that name elsewhere in the  same  \*(PN
+                     invocation  in  contexts  where  a UUID is expected. Such
+                     references may precede or follow the create command.
+
+                     If a valid uuid is specified, then it is used as the UUID
+                     of the new row.
+
+                     Caution (ovs-vsctl as example)
+                            Records in the Open vSwitch database are  signifiā€
+                            cant only when they can be reached directly or inā€
+                            directly  from  the Open_vSwitch table. Except for
+                            records in the QoS or Queue tables,  records  that
+                            are  not reachable from the Open_vSwitch table are
+                            automatically  deleted  from  the  database.  This
+                            deletion  happens immediately, without waiting for
+                            additional ovs-vsctl commands  or  other  database
+                            activity. Thus, a create command must generally be
+                            accompanied by additional commands within the same
+                            ovs-vsctl  invocation to add a chain of references
+                            to the newly created  record  from  the  top-level
+                            Open_vSwitch  record.  The  EXAMPLES section gives
+                            some examples that show how to do this.
+
+              [--if-exists] destroy table record...
+                     Deletes each specified record from table. Unless --if-exā€ā€
+                     ists is specified, each records must exist.
+
+              --all destroy table
+                     Deletes all records from the table.
+
+                     Caution (ovs-vsctl as example)
+                            The destroy command is only useful for records  in
+                            the  QoS  or Queue tables. Records in other tables
+                            are automatically deleted from the  database  when
+                            they  become unreachable from the Open_vSwitch taā€
+                            ble. This means that deleting the  last  reference
+                            to  a record is sufficient for deleting the record
+                            itself. For records in these  tables,  destroy  is
+                            silently  ignored.  See the EXAMPLES section below
+                            for more information.
+
+              wait-until table record [column[:key]=value]...
+                     Waits until table contains a record  named  record  whose
+                     column equals value or, if key is specified, whose column
+                     contains  a  key  with  the specified value. This command
+                     supports the same operators and semantics  described  for
+                     the find command above.
+
+                     If  no  column[:key]=value arguments are given, this comā€
+                     mand waits only until record exists.  If  more  than  one
+                     such  argument  is  given, the command waits until all of
+                     them are satisfied.
+
+                     Caution (ovs-vsctl as example)
+                            Usually wait-until should be placed at the  beginā€
+                            ning  of a set of ovs-vsctl commands. For example,
+                            wait-until bridge br0  --  get  bridge  br0  dataā€ā€
+                            path_id waits until a bridge named br0 is created,
+                            then  prints  its  datapath_id column, whereas get
+                            bridge br0 datapath_id --  wait-until  bridge  br0
+                            will  abort  if  no  bridge  named br0 exists when
+                            ovs-vsctl initially connects to the database.
+
+                     Consider specifying --timeout=0 along with  --wait-until,
+                     to  prevent ovs-vsctl from terminating after waiting only
+                     at most 5 seconds.
+
+              comment [arg]...
+                     This command has no effect on behavior, but any  database
+                     log  record  created by the command will include the comā€
+                     mand and its arguments.
+
+ENVIRONMENT
+       OVN_SB_DAEMON
+              If set, this should name the Unix domain socket for an ovn-sbctl
+              server process. See Daemon Mode, above, for more information.
+
+       OVN_SBCTL_OPTIONS
+              If set, a set of options for ovn-sbctl to  apply  automatically,
+              in the same form as on the command line.
+
+       OVN_SB_DB
+              If  set, the default database to contact when the --db option is
+              not used.
+
+EXIT STATUS
+       0      Successful program execution.
+
+       1      Usage, syntax, or network error.
+
+SEE ALSO
+       ovn-sb(5), ovn-appctl(8).
+
+OVN 23.06.3                        ovn-sbctl                      ovn-sbctl(8)
+

+ovn-nbctl(8)                      OVN Manual                      ovn-nbctl(8)
+
+NAME
+       ovn-nbctl - Open Virtual Network northbound db management utility
+
+SYNOPSIS
+       ovn-nbctl [options] command [arg...]
+
+DESCRIPTION
+       The ovn-nbctl program configures the OVN_Northbound database by providā€
+       ing a high-level interface to its configuration database. See ovn-nb(5)
+       for comprehensive documentation of the database schema.
+
+       ovn-nbctl  connects  to  an  ovsdb-server  process  that  maintains  an
+       OVN_Northbound  configuration  database.  Using  this  connection,   it
+       queries  and possibly applies changes to the database, depending on the
+       supplied commands.
+
+       ovn-nbctl can perform any number of commands in a  single  run,  impleā€
+       mented as a single atomic transaction against the database.
+
+       The  ovn-nbctl command line begins with global options (see OPTIONS beā€
+       low for details). The global options are followed by one or  more  comā€
+       mands.  Each  command  should begin with -- by itself as a command-line
+       argument, to separate it from the following commands.  (The  --  before
+       the first command is optional.) The command itself starts with command-
+       specific  options,  if  any, followed by the command name and any arguā€
+       ments.
+
+DAEMON MODE
+       When it is invoked in the most ordinary way, ovn-nbctl connects  to  an
+       OVSDB  server  that  hosts the northbound database, retrieves a partial
+       copy of the database that is complete enough to do its  work,  sends  a
+       transaction  request  to  the  server,  and  receives and processes the
+       serverā€™s reply. In common interactive use, this is  fine,  but  if  the
+       database is large, the step in which ovn-nbctl retrieves a partial copy
+       of  the  database  can  take a long time, which yields poor performance
+       overall.
+
+       To improve performance in such  a  case,  ovn-nbctl  offers  a  "daemon
+       mode,"  in  which  the user first starts ovn-nbctl running in the backā€
+       ground and afterward uses the daemon to execute operations.  Over  sevā€
+       eral  ovn-nbctl  command  invocations, this performs better overall beā€
+       cause it retrieves a copy of the database only once at  the  beginning,
+       not once per program run.
+
+       Use the --detach option to start an ovn-nbctl daemon. With this option,
+       ovn-nbctl  prints  the  name  of a control socket to stdout. The client
+       should save this name in environment variable OVN_NB_DAEMON. Under  the
+       Bourne shell this might be done like this:
+
+             export OVN_NB_DAEMON=$(ovn-nbctl --pidfile --detach)
+
+
+       When  OVN_NB_DAEMON  is  set, ovn-nbctl automatically and transparently
+       uses the daemon to execute its commands.
+
+       When the daemon is no longer needed, kill it and unset the  environment
+       variable, e.g.:
+
+             kill $(cat $OVN_RUNDIR/ovn-nbctl.pid)
+             unset OVN_NB_DAEMON
+
+
+       When using daemon mode, an alternative to the OVN_NB_DAEMON environment
+       variable  is  to  specify a path for the Unix socket. When starting the
+       ovn-nbctl daemon, specify the -u option with a full path to  the  locaā€
+       tion of the socket file. Here is an exmple:
+
+             ovn-nbctl --detach -u /tmp/mysock.ctl
+
+
+       Then  to connect to the running daemon, use the -u option with the full
+       path to the socket created when the daemon was started:
+
+             ovn-nbctl -u /tmp/mysock.ctl show
+
+
+     Daemon Commands
+
+       Daemon mode is internally implemented using the same mechanism used  by
+       ovn-appctl.  One  may  also  use ovn-appctl directly with the following
+       commands:
+
+              run [options] command [arg...] [-- [options] command [arg...]
+              ...]
+                     Instructs the daemon process to run one or more ovn-nbctl
+                     commands described above and reply with  the  results  of
+                     running  these  commands.  Accepts the --no-wait, --wait,
+                     --timeout, --dry-run,  --oneline,  and  the  options  deā€
+                     scribed under Table Formatting Options in addition to the
+                     the command-specific options.
+
+              exit   Causes ovn-nbctl to gracefully terminate.
+
+OPTIONS
+       The  options  listed below affect the behavior of ovn-nbctl as a whole.
+       Some individual commands also accept their own options, which are given
+       just before the command name. If the first command on the command  line
+       has  options,  then those options must be separated from the global opā€
+       tions by --.
+
+       ovn-nbctl also accepts options from the  OVN_NBCTL_OPTIONS  environment
+       variable,  in  the same format as on the command line. Options from the
+       command line override those in the environment.
+
+              --no-wait | --wait=none
+              --wait=sb
+              --wait=hv
+                   These options control whether and how ovn-nbctl  waits  for
+                   the OVN system to become up-to-date with changes made in an
+                   ovn-nbctl invocation.
+
+                   By default, or if --no-wait or --wait=none, ovn-nbctl exits
+                   immediately after confirming that changes have been commitā€
+                   ted to the northbound database, without waiting.
+
+                   With  --wait=sb,  before  ovn-nbctl  exits,  it  waits  for
+                   ovn-northd to bring the southbound database up-to-date with
+                   the northbound database updates.
+
+                   With --wait=hv, before  ovn-nbctl  exits,  it  additionally
+                   waits for all OVN chassis (hypervisors and gateways) to beā€
+                   come up-to-date with the northbound database updates. (This
+                   can  become  an  indefinite wait if any chassis is malfuncā€
+                   tioning.)
+
+                   Ordinarily, --wait=sb or --wait=hv only waits  for  changes
+                   by  the  current  ovn-nbctl invocation to take effect. This
+                   means that, if none of the commands supplied  to  ovn-nbctl
+                   change the database, then the command does not wait at all.
+                   Use the sync command to override this behavior.
+
+              --db database
+                   The  OVSDB database remote to contact. If the OVN_NB_DB enā€
+                   vironment variable is set, its value is  used  as  the  deā€
+                   fault.  Otherwise,  the default is unix:/ovnnb_db.sock, but
+                   this default is unlikely to be useful outside of single-maā€
+                   chine OVN test environments.
+
+              --leader-only
+              --no-leader-only
+                   By default, or with --leader-only, when the database server
+                   is a clustered database, ovn-nbctl will avoid servers other
+                   than the cluster leader. This ensures that  any  data  that
+                   ovn-nbctl   reads   and   reports   is   up-to-date.   With
+                   --no-leader-only, ovn-nbctl will  use  any  server  in  the
+                   cluster, which means that for read-only transactions it can
+                   report  and act on stale data (transactions that modify the
+                   database are always serialized even with --no-leader-only).
+                   Refer to Understanding Cluster Consistency in ovsdb(7)  for
+                   more information.
+
+              --shuffle-remotes
+              --no-shuffle-remotes
+                   By  default, or with --shuffle-remotes, when there are mulā€
+                   tiple remotes specified  in  the  OVSDB  connection  string
+                   specified  by  --db  or the OVN_NB_DB environment variable,
+                   the order of the remotes will be shuffled before the client
+                   tries to connect. The remotes will be shuffled only once to
+                   a new order before the first connection attempt.  The  folā€
+                   lowing retries, if any, will follow the same new order. The
+                   default  behavior  is  to  make sure clients of a clustered
+                   database can distribute evenly to all members of the  clusā€
+                   ter.  With  --no-shuffle-remotes,  ovn-nbctl  will  use the
+                   original order specified in the connection string  to  conā€
+                   nect.  This  allows  user  to  specify the preferred order,
+                   which is particularly useful for testing.
+
+              --no-syslog
+                   By default, ovn-nbctl logs its arguments and the details of
+                   any changes that it makes to the system  log.  This  option
+                   disables this logging.
+
+                   This option is equivalent to --verbose=nbctl:syslog:warn.
+
+              --oneline
+                   Modifies the output format so that the output for each comā€
+                   mand  is printed on a single line. New-line characters that
+                   would otherwise separate lines are  printed  as  \fB\\n\fR,
+                   and  any  instances of \fB\\\fR that would otherwise appear
+                   in the output are doubled. Prints a  blank  line  for  each
+                   command that has no output. This option does not affect the
+                   formatting  of  output  from the list or find commands; see
+                   Table Formatting Options below.
+
+              --dry-run
+                   Prevents ovn-nbctl from actually modifying the database.
+
+              -t secs
+              --timeout=secs
+                   By default, or with a secs of 0,  ovn-nbctl  waits  forever
+                   for  a  response from the database. This option limits runā€
+                   time to approximately secs seconds. If the timeout expires,
+                   ovn-nbctl will exit with a SIGALRM signal. (A timeout would
+                   normally happen only if the database cannot  be  contacted,
+                   or if the system is overloaded.)
+
+              --print-wait-time
+                   When  --wait is specified, the option --print-wait-time can
+                   be used to print the time spent on  waiting,  depending  on
+                   the  value  specified  in   --wait  option. If --wait=sb is
+                   specified, it prints "ovn-northd delay before  processing",
+                   which  is  the time between the Northbound DB update by the
+                   command and the moment when  ovn-northd  starts  processing
+                   the  update, and "ovn-northd completion", which is the time
+                   between the  Northbound  DB  update  and  the  moment  when
+                   ovn-northd  completes  the  Southbound DB updating successā€
+                   fully. If --wait=hv is specified, in addition to the  above
+                   information, it also prints "ovn-controller(s) completion",
+                   which  is the time between the Northbound DB update and the
+                   moment when the slowest hypervisor finishes processing  the
+                   update.
+
+   Daemon Options
+       --pidfile[=pidfile]
+              Causes a file (by default, program.pid) to be created indicating
+              the  PID  of the running process. If the pidfile argument is not
+              specified, or if it does not begin with /, then it is created in
+              .
+
+              If --pidfile is not specified, no pidfile is created.
+
+       --overwrite-pidfile
+              By default, when --pidfile is specified and the  specified  pidā€
+              file already exists and is locked by a running process, the daeā€
+              mon refuses to start. Specify --overwrite-pidfile to cause it to
+              instead overwrite the pidfile.
+
+              When --pidfile is not specified, this option has no effect.
+
+       --detach
+              Runs  this  program  as a background process. The process forks,
+              and in the child it starts a new session,  closes  the  standard
+              file descriptors (which has the side effect of disabling logging
+              to  the  console), and changes its current directory to the root
+              (unless --no-chdir is specified). After the child completes  its
+              initialization, the parent exits.
+
+       --monitor
+              Creates  an  additional  process  to monitor this program. If it
+              dies due to a signal that indicates a programming  error  (SIGAā€ā€
+              BRT, SIGALRM, SIGBUS, SIGFPE, SIGILL, SIGPIPE, SIGSEGV, SIGXCPU,
+              or SIGXFSZ) then the monitor process starts a new copy of it. If
+              the daemon dies or exits for another reason, the monitor process
+              exits.
+
+              This  option  is  normally used with --detach, but it also funcā€
+              tions without it.
+
+       --no-chdir
+              By default, when --detach is specified, the daemon  changes  its
+              current  working  directory  to  the root directory after it deā€
+              taches. Otherwise, invoking the daemon from a carelessly  chosen
+              directory  would  prevent  the administrator from unmounting the
+              file system that holds that directory.
+
+              Specifying --no-chdir suppresses this behavior,  preventing  the
+              daemon  from changing its current working directory. This may be
+              useful for collecting core files, since it is common behavior to
+              write core dumps into the current working directory and the root
+              directory is not a good directory to use.
+
+              This option has no effect when --detach is not specified.
+
+       --no-self-confinement
+              By default this daemon will try to self-confine itself  to  work
+              with  files  under  well-known  directories  determined at build
+              time. It is better to stick with this default behavior  and  not
+              to  use  this  flag  unless some other Access Control is used to
+              confine daemon. Note that in contrast to  other  access  control
+              implementations  that  are  typically enforced from kernel-space
+              (e.g. DAC or MAC), self-confinement is imposed  from  the  user-
+              space daemon itself and hence should not be considered as a full
+              confinement  strategy,  but instead should be viewed as an addiā€
+              tional layer of security.
+
+       --user=user:group
+              Causes this program to run as  a  different  user  specified  in
+              user:group,  thus  dropping  most  of the root privileges. Short
+              forms user and :group are also allowed,  with  current  user  or
+              group  assumed,  respectively.  Only daemons started by the root
+              user accepts this argument.
+
+              On   Linux,   daemons   will   be   granted   CAP_IPC_LOCK   and
+              CAP_NET_BIND_SERVICES  before  dropping root privileges. Daemons
+              that interact with a datapath, such  as  ovs-vswitchd,  will  be
+              granted  three  additional  capabilities,  namely CAP_NET_ADMIN,
+              CAP_NET_BROADCAST and CAP_NET_RAW. The  capability  change  will
+              apply even if the new user is root.
+
+              On Windows, this option is not currently supported. For security
+              reasons,  specifying  this  option will cause the daemon process
+              not to start.
+
+   Logging options
+       -v[spec]
+       --verbose=[spec]
+            Sets logging levels. Without any spec,  sets  the  log  level  for
+            every  module and destination to dbg. Otherwise, spec is a list of
+            words separated by spaces or commas or colons, up to one from each
+            category below:
+
+            ā€¢      A valid module name, as displayed by the vlog/list  command
+                   on ovs-appctl(8), limits the log level change to the speciā€
+                   fied module.
+
+            ā€¢      syslog,  console, or file, to limit the log level change to
+                   only to the system log, to the console, or to a  file,  reā€
+                   spectively.  (If  --detach  is specified, the daemon closes
+                   its standard file descriptors, so logging  to  the  console
+                   will have no effect.)
+
+                   On  Windows  platform,  syslog is accepted as a word and is
+                   only useful along with the --syslog-target option (the word
+                   has no effect otherwise).
+
+            ā€¢      off, emer, err, warn, info, or  dbg,  to  control  the  log
+                   level.  Messages  of  the  given severity or higher will be
+                   logged, and messages of lower  severity  will  be  filtered
+                   out.  off filters out all messages. See ovs-appctl(8) for a
+                   definition of each log level.
+
+            Case is not significant within spec.
+
+            Regardless of the log levels set for file, logging to a file  will
+            not take place unless --log-file is also specified (see below).
+
+            For compatibility with older versions of OVS, any is accepted as a
+            word but has no effect.
+
+       -v
+       --verbose
+            Sets  the  maximum  logging  verbosity level, equivalent to --verā€ā€
+            bose=dbg.
+
+       -vPATTERN:destination:pattern
+       --verbose=PATTERN:destination:pattern
+            Sets the log pattern for destination to pattern. Refer to  ovs-apā€ā€
+            pctl(8) for a description of the valid syntax for pattern.
+
+       -vFACILITY:facility
+       --verbose=FACILITY:facility
+            Sets  the RFC5424 facility of the log message. facility can be one
+            of kern, user, mail, daemon, auth, syslog, lpr, news, uucp, clock,
+            ftp, ntp, audit, alert, clock2, local0,  local1,  local2,  local3,
+            local4, local5, local6 or local7. If this option is not specified,
+            daemon  is used as the default for the local system syslog and loā€ā€
+            cal0 is used while sending a message to the  target  provided  via
+            the --syslog-target option.
+
+       --log-file[=file]
+            Enables  logging  to a file. If file is specified, then it is used
+            as the exact name for the log file. The default log file name used
+            if file is omitted is /usr/local/var/log/ovn/program.log.
+
+       --syslog-target=host:port
+            Send syslog messages to UDP port on host, in addition to the  sysā€
+            tem  syslog.  The host must be a numerical IP address, not a hostā€
+            name.
+
+       --syslog-method=method
+            Specify method as how syslog messages should  be  sent  to  syslog
+            daemon. The following forms are supported:
+
+            ā€¢      libc,  to use the libc syslog() function. Downside of using
+                   this options is that libc adds fixed prefix to  every  mesā€
+                   sage  before  it is actually sent to the syslog daemon over
+                   /dev/log UNIX domain socket.
+
+            ā€¢      unix:file, to use a UNIX domain socket directly. It is posā€
+                   sible to specify arbitrary message format with this option.
+                   However, rsyslogd 8.9 and older  versions  use  hard  coded
+                   parser  function anyway that limits UNIX domain socket use.
+                   If you want to use  arbitrary  message  format  with  older
+                   rsyslogd  versions, then use UDP socket to localhost IP adā€
+                   dress instead.
+
+            ā€¢      udp:ip:port, to use a UDP socket. With this  method  it  is
+                   possible  to  use  arbitrary message format also with older
+                   rsyslogd. When sending syslog messages over UDP socket  exā€
+                   tra precaution needs to be taken into account, for example,
+                   syslog daemon needs to be configured to listen on the specā€
+                   ified  UDP  port, accidental iptables rules could be interā€
+                   fering with local syslog traffic and there are  some  secuā€
+                   rity  considerations  that apply to UDP sockets, but do not
+                   apply to UNIX domain sockets.
+
+            ā€¢      null, to discard all messages logged to syslog.
+
+            The default is taken from the OVS_SYSLOG_METHOD environment  variā€
+            able; if it is unset, the default is libc.
+
+   Table Formatting Options
+       These  options control the format of output from the list and find comā€
+       mands.
+
+              -f format
+              --format=format
+                   Sets the type of table formatting. The following  types  of
+                   format are available:
+
+                   table  2-D text tables with aligned columns.
+
+                   list (default)
+                          A  list  with one column per line and rows separated
+                          by a blank line.
+
+                   html   HTML tables.
+
+                   csv    Comma-separated values as defined in RFC 4180.
+
+                   json   JSON format as defined in RFC 4627. The output is  a
+                          sequence  of JSON objects, each of which corresponds
+                          to one table. Each JSON  object  has  the  following
+                          members with the noted values:
+
+                          caption
+                                 The  tableā€™s  caption. This member is omitted
+                                 if the table has no caption.
+
+                          headings
+                                 An array with one element per  table  column.
+                                 Each  array  element  is  a string giving the
+                                 corresponding columnā€™s heading.
+
+                          data   An array with one element per table row. Each
+                                 element is also an array with one element per
+                                 table column. The elements  of  this  second-
+                                 level array are the cells that constitute the
+                                 table.  Cells  that  represent  OVSDB data or
+                                 data types are expressed in  the  format  deā€
+                                 scribed  in  the  OVSDB  specification; other
+                                 cells are simply expressed as text strings.
+
+              -d format
+              --data=format
+                   Sets the formatting for cells within output  tables  unless
+                   the table format is set to json, in which case json formatā€
+                   ting  is  always  used when formatting cells. The following
+                   types of format are available:
+
+                   string (default)
+                          The simple format described in the  Database  Values
+                          section of ovs-vsctl(8).
+
+                   bare   The  simple format with punctuation stripped off: []
+                          and {} are omitted  around  sets,  maps,  and  empty
+                          columns,  items within sets and maps are space-sepaā€
+                          rated, and strings are never quoted. This format may
+                          be easier for scripts to parse.
+
+                   json   The RFC 4627 JSON format as described above.
+
+              --no-headings
+                   This option suppresses the heading row that  otherwise  apā€
+                   pears in the first row of table output.
+
+              --pretty
+                   By  default, JSON in output is printed as compactly as posā€
+                   sible. This option causes JSON in output to be printed in a
+                   more readable fashion. Members of objects and  elements  of
+                   arrays are printed one per line, with indentation.
+
+                   This option does not affect JSON in tables, which is always
+                   printed compactly.
+
+              --bare
+                   Equivalent to --format=list --data=bare --no-headings.
+
+   PKI Options
+       PKI  configuration  is  required  to  use SSL for the connection to the
+       database.
+
+              -p privkey.pem
+              --private-key=privkey.pem
+                   Specifies a PEM file containing the  private  key  used  as
+                   identity for outgoing SSL connections.
+
+              -c cert.pem
+              --certificate=cert.pem
+                   Specifies  a  PEM file containing a certificate that certiā€
+                   fies the private key specified on -p or --private-key to be
+                   trustworthy. The certificate must be signed by the certifiā€
+                   cate authority (CA) that the peer in SSL  connections  will
+                   use to verify it.
+
+              -C cacert.pem
+              --ca-cert=cacert.pem
+                   Specifies a PEM file containing the CA certificate for verā€
+                   ifying certificates presented to this program by SSL peers.
+                   (This  may  be  the  same certificate that SSL peers use to
+                   verify the certificate specified on -c or --certificate, or
+                   it may be a different one, depending on the PKI  design  in
+                   use.)
+
+              -C none
+              --ca-cert=none
+                   Disables  verification  of  certificates  presented  by SSL
+                   peers. This introduces a security risk,  because  it  means
+                   that  certificates  cannot be verified to be those of known
+                   trusted hosts.
+
+              --bootstrap-ca-cert=cacert.pem
+                     When cacert.pem exists, this option has the  same  effect
+                     as  -C  or --ca-cert. If it does not exist, then the exeā€
+                     cutable will attempt to obtain the  CA  certificate  from
+                     the  SSL  peer on its first SSL connection and save it to
+                     the named PEM file. If it is successful, it will  immediā€
+                     ately drop the connection and reconnect, and from then on
+                     all  SSL  connections must be authenticated by a certifiā€
+                     cate signed by the CA certificate thus obtained.
+
+                     This option exposes the SSL connection to  a  man-in-the-
+                     middle  attack  obtaining the initial CA certificate, but
+                     it may be useful for bootstrapping.
+
+                     This option is only useful if the SSL peer sends  its  CA
+                     certificate as part of the SSL certificate chain. The SSL
+                     protocol  does not require the server to send the CA cerā€
+                     tificate.
+
+                     This option is mutually exclusive with -C and --ca-cert.
+
+   Other Options
+       -h
+       --help
+            Prints a brief help message to the console.
+
+       -V
+       --version
+            Prints version information to the console.
+
+COMMANDS
+       The following sections describe the commands that ovn-nbctl supports.
+
+   General Commands
+       init   Initializes the database, if it is empty. If  the  database  has
+              already been initialized, this command has no effect.
+
+       show [switch | router]
+              Prints  a  brief overview of the database contents. If switch is
+              provided, only records related to that logical switch are shown.
+              If router is provided, only  records  related  to  that  logical
+              router are shown.
+
+   Logical Switch Commands
+       ls-add Creates  a  new,  unnamed logical switch, which initially has no
+              ports. The switch does not have a name, other commands must  reā€
+              fer to this switch by its UUID.
+
+       [--may-exist | --add-duplicate] ls-add switch
+              Creates  a  new logical switch named switch, which initially has
+              no ports.
+
+              The OVN northbound database  schema  does  not  require  logical
+              switch  names  to be unique, but the whole point to the names is
+              to provide an easy way for humans to refer to the switches, makā€
+              ing duplicate names unhelpful. Thus, without any  options,  this
+              command  regards  it  as an error if switch is a duplicate name.
+              With --may-exist, adding a duplicate name succeeds but does  not
+              create  a  new logical switch. With --add-duplicate, the command
+              really creates a new logical switch with a duplicate name. It is
+              an error to specify both options. If there are multiple  logical
+              switches  with  a duplicate name, configure the logical switches
+              using the UUID instead of the switch name.
+
+       [--if-exists] ls-del switch
+              Deletes switch. It is an error if switch does not exist,  unless
+              --if-exists is specified.
+
+       ls-list
+              Lists all existing switches on standard output, one per line.
+
+   ACL Commands
+       These  commands  operates on ACL objects for a given entity. The entity
+       can be either a logical switch or a port group. The entity can be specā€
+       ified as uuid or name. The --type option can be  used  to  specify  the
+       type of the entity, in case both a logical switch and a port groups exā€
+       ist with the same name specified for entity. type must be either switch
+       or port-group.
+
+              [--type={switch | port-group}] [--log] [--meter=meter] [--severā€ā€
+              ity=severity] [--name=name] [--label=label] [--may-exist] [--apā€ā€
+              ply-after-lb] [--tier] acl-add entity direction priority match
+              verdict
+                     Adds  the  specified ACL to entity. direction must be eiā€
+                     ther from-lport or to-lport. priority must be  between  0
+                     and  32767,  inclusive.  A full description of the fields
+                     are in ovn-nb(5). If --may-exist is specified,  adding  a
+                     duplicated  ACL  succeeds  but the ACL is not really creā€
+                     ated. Without --may-exist, adding a  duplicated  ACL  reā€
+                     sults in error.
+
+                     The  --log option enables packet logging for the ACL. The
+                     options --severity and  --name  specify  a  severity  and
+                     name, respectively, for log entries (and also enable logā€
+                     ging).  The  severity  must be one of alert, warning, noā€ā€
+                     tice, info, or debug. If a severity is not specified, the
+                     default is info. The  --meter=meter  option  is  used  to
+                     rate-limit packet logging. The meter argument names a meā€
+                     ter configured by meter-add.
+
+                     The  --apply-after-lb  option sets apply-after-lb=true in
+                     the options column of the ACL table. As the  option  name
+                     suggests,  the  ACL  will  be  applied  after the logical
+                     switch load balancer stage.
+
+                     The --tier option sets the ACLā€™s tier  to  the  specified
+                     value. For more information about ACL tiers, see the docā€
+                     umentation for the ovn-nb(5) database.
+
+              [--type={switch | port-group}] [--tier] acl-del entity [direcā€
+              tion [priority match]]
+                     Deletes ACLs from entity. If only entity is supplied, all
+                     the  ACLs  from  the  entity are deleted. If direction is
+                     also specified, then all the flows in that direction will
+                     be deleted from the entity. If all the fields are  given,
+                     then  a  single  flow that matches all the fields will be
+                     deleted.
+
+                     If the --tier option is provided, then only ACLs  of  the
+                     given tier value will be deleted, in addition to whatever
+                     other criteria have been provided.
+
+              [--type={switch | port-group}] acl-list entity
+                     Lists the ACLs on entity.
+
+   Logical Switch QoS Rule Commands
+       [--may-exist] qos-add switch direction priority match [dscp=dscp]
+       [rate=rate [burst=burst]]
+              Adds QoS marking and metering rules to switch. direction must be
+              either  from-lport  or  to-lport. priority must be between 0 and
+              32767, inclusive.
+
+              If dscp=dscp is specified, then matching packets will have  DSCP
+              marking  applied.  dscp  must be between 0 and 63, inclusive. If
+              rate=rate is specified then matching packets will have  metering
+              applied   at   rate   kbps.  If  metering  is  configured,  then
+              burst=burst specifies the burst rate  limit  in  kilobits.  dscp
+              and/or rate are required arguments.
+
+              If  --may-exist  is specified, adding a duplicated QoS rule sucā€
+              ceeds but the QoS rule is not really created. Without  --may-exā€ā€
+              ist, adding a duplicated QoS rule results in error.
+
+       qos-del switch [direction [priority match]]
+              Deletes  QoS  rules from switch. If only switch is supplied, all
+              the QoS rules from the logical switch are deleted. If  direction
+              is  also specified, then all the flows in that direction will be
+              deleted from the logical switch. If all the fields are supplied,
+              then a single  flow  that  matches  the  given  fields  will  be
+              deleted.
+
+              If  switch  and uuid are supplied, then the QoS rule with speciā€
+              fied uuid is deleted.
+
+       qos-list switch
+              Lists the QoS rules on switch.
+
+   Meter Commands
+       meter-add name action rate unit [burst]
+              Adds the specified meter. name must be a unique name to identify
+              this meter. The action argument  specifies  what  should  happen
+              when this meter is exceeded. The only supported action is drop.
+
+              The  unit specifies the unit for the rate argument; valid values
+              are kbps and pktps for kilobits per second and packets per  secā€
+              ond, respectively. The burst option configures the maximum burst
+              allowed for the band in kilobits or packets depending on whether
+              the  unit  chosen was kbps or pktps, respectively. If a burst is
+              not supplied, the switch is free to select some reasonable value
+              depending on its configuration.
+
+              ovn-nbctl only supports adding a meter with a single  band,  but
+              the other commands support meters with multiple bands.
+
+              Names  that  start  with "__" (two underscores) are reserved for
+              internal use by OVN, so ovn-nbctl does not allow adding them.
+
+       meter-del [name]
+              Deletes meters. By default, all meters are deleted. If  name  is
+              supplied, only the meter with that name will be deleted.
+
+       meter-list
+              Lists all meters.
+
+   Logical Switch Port Commands
+       [--may-exist] lsp-add switch port
+              Creates on lswitch a new logical switch port named port.
+
+              It  is an error if a logical port named port already exists, unā€
+              less --may-exist is specified. Regardless of --may-exist, it  is
+              an  error  if  the existing port is in some logical switch other
+              than switch or if it has a parent port.
+
+       [--may-exist] lsp-add switch port parent tag_request
+              Creates on switch a logical switch port named  port  that  is  a
+              child  of  parent  that  is identified with VLAN ID tag_request,
+              which must be between 0 and 4095, inclusive. If  tag_request  is
+              0,  ovn-northd  generates  a  tag that is unique in the scope of
+              parent. This is useful in cases such  as  virtualized  container
+              environments  where  Open vSwitch does not have a direct connecā€
+              tion to the containerā€™s port and it must be shared with the virā€
+              tual machineā€™s port.
+
+              It is an error if a logical port named port already exists,  unā€
+              less  --may-exist is specified. Regardless of --may-exist, it is
+              an error if the existing port is not in switch or if it does not
+              have the specified parent and tag_request.
+
+       [--if-exists] lsp-del port
+              Deletes port. It is an error if  port  does  not  exist,  unless
+              --if-exists is specified.
+
+       lsp-list switch
+              Lists  all  the  logical  switch ports within switch on standard
+              output, one per line.
+
+       lsp-get-parent port
+              If set, get the parent port of port. If not set, print nothing.
+
+       lsp-get-tag port
+              If set, get the tag for port traffic. If not set, print nothing.
+
+       lsp-set-addresses port [address]...
+              Sets the addresses associated with port to address. Each address
+              should be one of the following:
+
+              an Ethernet address, optionally followed by a space and one or
+              more IP addresses
+                     OVN delivers packets for the  Ethernet  address  to  this
+                     port.
+
+              unknown
+                     OVN  delivers  unicast Ethernet packets whose destination
+                     MAC address is not in any logical portā€™s addresses column
+                     to ports with address unknown.
+
+              dynamic
+                     Use this keyword to make ovn-northd generate  a  globally
+                     unique MAC address and choose an unused IPv4 address with
+                     the  logical  portā€™s  subnet and store them in the portā€™s
+                     dynamic_addresses column.
+
+              router Accepted only when the type of the logical switch port is
+                     router. This indicates that the Ethernet, IPv4, and  IPv6
+                     addresses for this logical switch port should be obtained
+                     from  the  connected logical router port, as specified by
+                     router-port in lsp-set-options.
+
+              Multiple addresses may be set. If no address argument is  given,
+              port will have no addresses associated with it.
+
+       lsp-get-addresses port
+              Lists all the addresses associated with port on standard output,
+              one per line.
+
+       lsp-set-port-security port [addrs]...
+              Sets  the port security addresses associated with port to addrs.
+              Multiple sets of addresses may be set by  using  multiple  addrs
+              arguments.  If  no  addrs  argument is given, port will not have
+              port security enabled.
+
+              Port security limits the addresses from which a logical port may
+              send packets and to  which  it  may  receive  packets.  See  the
+              ovn-nb(5) documentation for the port_security column in the Logā€ā€
+              ical_Switch_Port table for details.
+
+       lsp-get-port-security port
+              Lists  all  the  port security addresses associated with port on
+              standard output, one per line.
+
+       lsp-get-up port
+              Prints the state of port, either up or down.
+
+       lsp-set-enabled port state
+              Set the administrative state of port,  either  enabled  or  disā€ā€
+              abled.  When  a  port is disabled, no traffic is allowed into or
+              out of the port.
+
+       lsp-get-enabled port
+              Prints the administrative state of port, either enabled or  disā€ā€
+              abled.
+
+       lsp-set-type port type
+              Set  the  type for the logical port. The type must be one of the
+              following:
+
+              (empty string)
+                     A VM (or VIF) interface.
+
+              router A connection to a logical router.
+
+              localnet
+                     A connection to a locally accessible  network  from  each
+                     ovn-controller instance. A logical switch can only have a
+                     single  localnet port attached. This is used to model diā€
+                     rect connectivity to an existing network.
+
+              localport
+                     A connection to a local VIF. Traffic that  arrives  on  a
+                     localport  is  never  forwarded  over a tunnel to another
+                     chassis. These ports are present  on  every  chassis  and
+                     have  the  same  address  in all of them. This is used to
+                     model connectivity to local services that  run  on  every
+                     hypervisor.
+
+              l2gateway
+                     A connection to a physical network.
+
+              vtep   A port to a logical switch on a VTEP gateway.
+
+       lsp-get-type port
+              Get the type for the logical port.
+
+       lsp-set-options port [key=value]...
+              Set type-specific key-value options for the logical port.
+
+       lsp-get-options port
+              Get the type-specific options for the logical port.
+
+       lsp-set-dhcpv4-options port dhcp_options
+              Set the DHCPv4 options for the logical port. The dhcp_options is
+              a  UUID  referring  to a set of DHCP options in the DHCP_Options
+              table.
+
+       lsp-get-dhcpv4-options port
+              Get the configured DHCPv4 options for the logical port.
+
+       lsp-set-dhcpv6-options port dhcp_options
+              Set the DHCPv6 options for the logical port. The dhcp_options is
+              a UUID referring to a set of DHCP options  in  the  DHCP_Options
+              table.
+
+       lsp-get-dhcpv6-options port
+              Get the configured DHCPv6 options for the logical port.
+
+       lsp-get-ls port
+              Get the logical switch which the port belongs to.
+
+       lsp-attach-mirror port m
+              Attaches the mirror m to the logical port port.
+
+       lsp-detach-mirror port m
+              Detaches the mirror m from the logical port port.
+
+   Forwarding Group Commands
+       [--liveness]fwd-group-add group switch vip vmac ports
+              Creates  a new forwarding group named group as the name with the
+              provided vip and vmac. vip should be a virtual  IP  address  and
+              vmac  should  be  a virtual MAC address to access the forwarding
+              group. ports are the logical switch port names that are  put  in
+              the forwarding group. Example for ports is lsp1 lsp2 ... Traffic
+              destined to virtual IP of the forwarding group will be load balā€
+              anced to all the child ports.
+
+              When --liveness is specified then child ports are expected to be
+              bound to external devices like routers. BFD should be configured
+              between hypervisors and the external devices. The child port seā€
+              lection  will  become  dependent on BFD status with its external
+              device.
+
+       [--if-exists] fwd-group-del group
+               Deletes group. It is an error if group does not  exist,  unless
+              --if-exists is specified.
+
+       fwd-group-list [switch]
+              Lists  all  existing  forwarding  groups, If switch is specified
+              then only the forwarding groups configured for  switch  will  be
+              listed.
+
+   Logical Router Commands
+       lr-add Creates  a  new,  unnamed logical router, which initially has no
+              ports. The router does not have a name, other commands must  reā€
+              fer to this router by its UUID.
+
+       [--may-exist | --add-duplicate] lr-add router
+              Creates  a  new logical router named router, which initially has
+              no ports.
+
+              The OVN northbound database  schema  does  not  require  logical
+              router  names  to be unique, but the whole point to the names is
+              to provide an easy way for humans to refer to the routers,  makā€
+              ing  duplicate  names unhelpful. Thus, without any options, this
+              command regards it as an error if router is  a  duplicate  name.
+              With  --may-exist, adding a duplicate name succeeds but does not
+              create a new logical router. With --add-duplicate,  the  command
+              really creates a new logical router with a duplicate name. It is
+              an  error to specify both options. If there are multiple logical
+              routers with a duplicate name, configure the logical routers usā€
+              ing the UUID instead of the router name.
+
+       [--if-exists] lr-del router
+              Deletes router. It is an error if router does not exist,  unless
+              --if-exists is specified.
+
+       lr-list
+              Lists all existing routers on standard output, one per line.
+
+   Logical Router Port Commands
+       [--may-exist] lrp-add router port mac network... [peer=peer]
+              Creates on router a new logical router port named port with Ethā€
+              ernet  address  mac  and one or more IP address/netmask for each
+              network.
+
+              The optional argument peer identifies a logical router port that
+              connects to this one. The following example adds a  router  port
+              with an IPv4 and IPv6 address with peer lr1:
+
+              lrp-add lr0 lrp0 00:11:22:33:44:55 192.168.0.1/24 2001:db8::1/64
+              peer=lr1
+
+              It  is  an error if a logical router port named port already exā€
+              ists, unless --may-exist is specified. Regardless  of  --may-exā€ā€
+              ist, it is an error if the existing router port is in some logiā€
+              cal router other than router.
+
+       [--if-exists] lrp-del port
+              Deletes  port.  It  is  an  error if port does not exist, unless
+              --if-exists is specified.
+
+       lrp-list router
+              Lists all the logical router ports  within  router  on  standard
+              output, one per line.
+
+       lrp-set-enabled port state
+              Set  the  administrative  state  of port, either enabled or disā€ā€
+              abled. When a port is disabled, no traffic is  allowed  into  or
+              out of the port.
+
+       lrp-get-enabled port
+              Prints  the administrative state of port, either enabled or disā€ā€
+              abled.
+
+       lrp-set-gateway-chassis port chassis [priority]
+              Set gateway chassis for port. chassis is the name of  the  chasā€
+              sis. This creates a gateway chassis entry in Gateway_Chassis taā€
+              ble.  It  wonā€™t check if chassis really exists in OVN_Southbound
+              database. Priority will be set to 0 if priority is not  provided
+              by user. priority must be between 0 and 32767, inclusive.
+
+       lrp-del-gateway-chassis port chassis
+              Deletes  gateway  chassis  from  port. It is an error if gateway
+              chassis with chassis for port does not exist.
+
+       lrp-get-gateway-chassis port
+              Lists all the gateway chassis with priority within port on stanā€
+              dard output, one per line, ordered based on priority.
+
+   Logical Router Static Route Commands
+       [--may-exist] [--policy=POLICY] [--ecmp] [--ecmp-symmetric-reply]
+       [--bfd[=UUID]] lr-route-add router prefix nexthop [port]
+              Adds the specified route to router. prefix describes an IPv4  or
+              IPv6  prefix  for  this route, such as 192.168.100.0/24. nexthop
+              specifies the gateway to use for this route, which should be the
+              IP address of one of router logical router ports or the  IP  adā€
+              dress  of  a  logical  port.  If port is specified, packets that
+              match this route will be sent out that port. When port is  omitā€
+              ted, OVN infers the output port based on nexthop. Nexthop can be
+              set to discard for dropping packets which match the given route.
+
+              --policy  describes  the  policy used to make routing decisions.
+              This should be one of "dst-ip" or "src-ip".  If  not  specified,
+              the default is "dst-ip".
+
+              The  --ecmp option allows for multiple routes with the same preā€
+              fix POLICY but different nexthop and port to be added.
+
+              The --ecmp-symmetric-reply option makes it so that traffic  that
+              arrives  over an ECMP route will have its reply traffic sent out
+              over that same  route.  Setting  --ecmp-symmetric-reply  implies
+              --ecmp so it is not necessary to set both.
+
+              --bfd  option is used to link a BFD session to the OVN route. If
+              the BFD session UUID is provided, it will be used  for  the  OVN
+              route otherwise the next-hop will be used to perform a lookup in
+              the  OVN BFD table. If the lookup fails and port is specified, a
+              new entry in the BFD table will be created using the nexthop  as
+              dst_ip and port as logical_port.
+
+              It is an error if a route with prefix and POLICY already exists,
+              unless  --may-exist, --ecmp, or --ecmp-symmetric-reply is speciā€
+              fied. If --may-exist is specified but not --ecmp or  --ecmp-symā€ā€
+              metric-reply,  the  existed  route  will be updated with the new
+              nexthop and port. If --ecmp or --ecmp-symmetric-reply is  speciā€
+              fied,  a  new  route  will  be  added, regardless of the existed
+              route., which is useful when adding  ECMP  routes,  i.e.  routes
+              with same POLICY and prefix but different nexthop and port.
+
+       [--if-exists] [--policy=POLICY] lr-route-del router [prefix [nexthop
+       [port]]]
+              Deletes  routes from router. If only router is supplied, all the
+              routes from the logical router are deleted. If  POLICY,  prefix,
+              nexthop and/or port are also specified, then all the routes that
+              match the conditions will be deleted from the logical router.
+
+              It  is  an  error  if  there  is no matching route entry, unless
+              --if-exists is specified.
+
+       lr-route-list router
+              Lists the routes on router.
+
+   Logical Router Policy Commands
+       [--may-exist]lr-policy-add router priority match action [nexthop[,nexā€
+       thop,...]] [options key=value]]
+              Add Policy to router which provides  a  way  to  configure  perā€
+              mit/deny  and  reroute policies on the router. Permit/deny poliā€
+              cies are similar to OVN ACLs, but exist on  the  logical-router.
+              Reroute  policies  are needed for service-insertion and service-
+              chaining. nexthop is an optional parameter. It needs to be  proā€
+              vided  only  when  action  is  reroute. Multiple nexthops can be
+              specified for ECMP routing. A policy is uniquely  identified  by
+              priority  and  match. Multiple policies can have the same priorā€
+              ity. options sets the router policy options as  key-value  pair.
+              The supported option is : pkt_mark.
+
+              If  --may-exist is specified, adding a duplicated routing policy
+              with the same priority and match string is not  really  created.
+              Without  --may-exist, adding a duplicated routing policy results
+              in error.
+
+              The following example shows a policy to  lr1,  which  will  drop
+              packets from192.168.100.0/24.
+
+              lr-policy-add lr1 100 ip4.src == 192.168.100.0/24 drop.
+
+                 lr-policy-add  lr1  100  ip4.src  ==  192.168.100.0/24  allow
+              pkt_mark=100 .
+
+       [--if-exists] lr-policy-del router [{priority | uuid} [match]]
+              Deletes polices from router. If only router is supplied, all the
+              polices from the logical router are deleted. If priority  and/or
+              match  are  also  specified, then all the polices that match the
+              conditions will be deleted from the logical router.
+
+              If router and uuid are supplied, then the policy with  specified
+              uuid  is  deleted. It is an error if uuid does not exist, unless
+              --if-exists is specified.
+
+       lr-policy-list router
+              Lists the polices on router.
+
+   NAT Commands
+       [--may-exist] [--stateless] [--gateway-port=GATEWAY_PORT] lr-nat-add
+       router type external_ip logical_ip [logical_port external_mac]
+              Adds the specified NAT to router. The type must be one of  snat,
+              dnat,  or dnat_and_snat. The external_ip is an IPv4 address. The
+              logical_ip is an IPv4 network (e.g 192.168.1.0/24)  or  an  IPv4
+              address.  The  logical_port  and  external_mac are only accepted
+              when router is a  distributed  router  (rather  than  a  gateway
+              router)  and type is dnat_and_snat. The logical_port is the name
+              of an existing logical switch port where the logical_ip resides.
+              The external_mac is an Ethernet address.
+
+              When --stateless is specified then it implies that  we  will  be
+              not  use connection tracker, i.e internal ip and external ip are
+              1:1 mapped. This implies that --stateless is applicable only  to
+              dnat_and_snat  type  NAT  rules. An external ip with --stateless
+              NAT cannot be shared with any other NAT rule.
+
+              --gateway-port option allows specifying the distributed  gateway
+              port  of  router  where  the NAT rule needs to be applied. GATEā€
+              WAY_PORT should reference a Logical_Router_Port row  that  is  a
+              distributed  gateway  port  of  router. When router has multiple
+              distributed gateway ports and the  gateway  port  for  this  NAT
+              canā€™t  be  inferred  from the external_ip, it is an error to not
+              specify the GATEWAY_PORT.
+
+              When type is dnat, the externally visible IP address external_ip
+              is DNATted to the IP address logical_ip in the logical space.
+
+              When type is snat, IP packets with their source IP address  that
+              either matches the IP address in logical_ip or is in the network
+              provided  by  logical_ip is SNATed into the IP address in exterā€
+              nal_ip.
+
+              When type is dnat_and_snat, the externally  visible  IP  address
+              external_ip is DNATted to the IP address logical_ip in the logiā€
+              cal  space.  In  addition, IP packets with the source IP address
+              that matches logical_ip is SNATed into the IP address in  exterā€
+              nal_ip.
+
+              When  the  logical_port  and external_mac are specified, the NAT
+              rule will be programmed on the chassis  where  the  logical_port
+              resides.  This  includes  ARP replies for the external_ip, which
+              return the value of external_mac. All packets  transmitted  with
+              source  IP  address  equal to external_ip will be sent using the
+              external_mac.
+
+              It is an error if a NAT already exists with the same  values  of
+              router,  type, external_ip, logical_ip and GATEWAY_PORT (in case
+              of multiple distributed gateway ports),  unless  --may-exist  is
+              specified.  When --may-exist, logical_port, and external_mac are
+              all specified, the existing values of  logical_port  and  exterā€
+              nal_mac are overwritten.
+
+       [--if-exists] lr-nat-del router [type [ip] [gateway_port]]
+              Deletes  NATs  from  router. If only router is supplied, all the
+              NATs from the logical router are deleted. If type is also speciā€
+              fied, then all the NATs that match the type will be deleted from
+              the logical router. If ip is also specified  without  specifying
+              gateway_port,  then all the NATs that match the type and ip will
+              be deleted from the logical router. If gateway_port is specified
+              without specifying ip, then all the NATs that match the type and
+              gateway_port will be deleted from the logical router. If all the
+              fields are given, then a single NAT rule that  matches  all  the
+              fields will be deleted. When type is snat, the ip should be logā€
+              ical_ip.  When  type  is dnat or dnat_and_snat, the ip should be
+              external_ip.
+
+              It is an error if both ip and  gateway_port  are  specified  and
+              there is no matching NAT entry, unless --if-exists is specified.
+
+       lr-nat-list router
+              Lists the NATs on router.
+
+   Load Balancer Commands
+       [--may-exist | --add-duplicate | --reject | --event] lb-add lb vip ips
+       [protocol]
+              Creates  a  new load balancer named lb with the provided vip and
+              ips or adds the vip to an existing lb. vip should be  a  virtual
+              IP address (or an IP address and a port number with : as a sepaā€
+              rator).   Examples   for   vip  are  192.168.1.4,  fd0f::1,  and
+              192.168.1.5:8080. ips should be comma separated IP endpoints (or
+              comma separated IP addresses and port numbers with : as a  sepaā€
+              rator). ips must be the same address family as vip. Examples for
+              ips are 10.0.0.1,10.0.0.2or [fdef::1]:8800,[fdef::2]:8800.
+
+              The  optional argument protocol must be either tcp, udp or sctp.
+              This argument is useful when a port number is provided  as  part
+              of  the vip. If the protocol is unspecified and a port number is
+              provided as part of the vip, OVN assumes the protocol to be tcp.
+
+              It is an error if the vip already exists in  the  load  balancer
+              named lb, unless --may-exist is specified. With --add-duplicate,
+              the  command really creates a new load balancer with a duplicate
+              name.
+
+              If the load balancer is created with --reject option and it  has
+              no  active  backends,  a  TCP reset segment (for tcp) or an ICMP
+              port unreachable packet (for all other kind of traffic) will  be
+              sent  whenever an incoming packet is received for this load-balā€
+              ancer. Please note using --reject option will  disable  empty_lb
+              SB controller event for this load balancer.
+
+              If  the  load balancer is created with --event option and it has
+              no active backends, whenever the lb receives traffic, the  event
+              is  reported  in the Controller_Event table in the SB db. Please
+              note --event option canā€™t be specified with --reject one.
+
+              The following example adds a load balancer.
+
+              lb-add                     lb0                      30.0.0.10:80
+              192.168.10.10:80,192.168.10.20:80,192.168.10.30:80 udp
+
+       [--if-exists] lb-del lb [vip]
+              Deletes  lb or the vip from lb. If vip is supplied, only the vip
+              will be deleted from the lb. If only the lb is supplied, the  lb
+              will be deleted. It is an error if vip does not already exist in
+              lb, unless --if-exists is specified.
+
+       lb-list [lb]
+              Lists  the LBs. If lb is also specified, then only the specified
+              lb will be listed.
+
+       [--may-exist] ls-lb-add switch lb
+              Adds the specified lb to switch. It is an error if a  load  balā€
+              ancer  named lb already exists in the switch, unless --may-exist
+              is specified.
+
+       [--if-exists] ls-lb-del switch [lb]
+              Removes lb from switch. If only switch is supplied, all the  LBs
+              from  the  logical  switch are removed. If lb is also specified,
+              then only the lb will be removed from the logical switch. It  is
+              an  error if lb does not exist in the switch, unless --if-exists
+              is specified.
+
+       ls-lb-list switch
+              Lists the LBs for the given switch.
+
+       [--may-exist] lr-lb-add router lb
+              Adds the specified lb to router. It is an error if a  load  balā€
+              ancer  named lb already exists in the router, unless --may-exist
+              is specified.
+
+       [--if-exists] lr-lb-del router [lb]
+              Removes lb from router. If only router is supplied, all the  LBs
+              from  the  logical  router are removed. If lb is also specified,
+              then only the lb will be removed from the logical router. It  is
+              an  error if lb does not exist in the router, unless --if-exists
+              is specified.
+
+       lr-lb-list router
+              Lists the LBs for the given router.
+
+   DHCP Options commands
+       dhcp-options-create cidr [key=value]
+              Creates a new DHCP Options entry in the DHCP_Options table  with
+              the specified cidr and optional external-ids.
+
+       dhcp-options-list
+              Lists the DHCP Options entries.
+
+       dhcp-options-del dhcp-option
+              Deletes the DHCP Options entry referred by dhcp-option UUID.
+
+       dhcp-options-set-options dhcp-option [key=value]...
+              Set the DHCP Options for the dhcp-option UUID.
+
+       dhcp-options-get-options dhcp-option
+              Lists the DHCP Options for the dhcp-option UUID.
+
+   Port Group commands
+       pg-add group [port]...
+              Creates  a  new  port  group in the Port_Group table named group
+              with optional ports added to the group.
+
+       pg-set-ports group port...
+              Sets ports on the port group named group.  It  is  an  error  if
+              group does not exist.
+
+       pg-del group
+              Deletes  port  group group. It is an error if group does not exā€
+              ist.
+
+   HA Chassis Group commands
+       ha-chassis-group-add group
+              Creates a new HA chassis group  in  the  HA_Chassis_Group  table
+              named group.
+
+       ha-chassis-group-del group
+              Deletes the HA chassis group group. It is an error if group does
+              not exist.
+
+       ha-chassis-group-list
+              Lists  the  HA  chassis group group along with the HA chassis if
+              any associated with it.
+
+       ha-chassis-group-add-chassis group chassis priority
+              Adds a new HA chassis chassis to the HA Chassis group group with
+              the specified priority. If the chassis already exists, then  the
+              priority is updated. The chassis should be the name of the chasā€
+              sis in the OVN_Southbound.
+
+       ha-chassis-group-remove-chassis group chassis
+              Removes  the HA chassis chassis from the HA chassis group group.
+              It is an error if chassis does not exist.
+
+   Control Plane Protection Policy commands
+       These commands manage meters configured in Copp table linking  them  to
+       logical  datapaths  through  copp  column  in  Logical_Switch  or Logiā€ā€
+       cal_Router tables. Protocol packets for which  CoPP  is  enforced  when
+       sending packets to ovn-controller (if configured):
+
+              ā€¢      ARP
+
+              ā€¢      ND_NS
+
+              ā€¢      ND_NA
+
+              ā€¢      ND_RA
+
+              ā€¢      ND
+
+              ā€¢      DNS
+
+              ā€¢      IGMP
+
+              ā€¢      packets that require ARP resolution before forwarding
+
+              ā€¢      packets that require ND_NS before forwarding
+
+              ā€¢      packets that need to be replied to with ICMP Errors
+
+              ā€¢      packets that need to be replied to with TCP RST
+
+              ā€¢      packets that need to be replied to with DHCP_OPTS
+
+              ā€¢      packets that trigger a reject action
+
+              ā€¢      packets that trigger a SCTP abort action
+
+              ā€¢      controller_events
+
+              ā€¢      BFD
+
+              copp-add name proto meter
+                     Adds  the  control  proto to meter mapping to the control
+                     plane protection policy name. If no policy exists yet, it
+                     creates one. If a mapping already existed for proto, this
+                     will overwrite it.
+
+              copp-del name [proto]
+                     Removes the control proto mapping for  the  name  control
+                     plane  protection  policy. If proto is not specified, the
+                     whole control plane protection policy is destroyed.
+
+              copp-list name
+                     Display the current control plane protection  policy  for
+                     name.
+
+              ls-copp-add name switch
+                     Adds the control plane protection policy name to the logā€
+                     ical switch switch.
+
+              lr-copp-add name router
+                     Adds the control plane protection policy name to the logā€
+                     ical router router.
+
+   Mirror commands
+       mirror-add m type [index] filter dest
+              Creates  a  new  mirror in the Mirror table with the name m with
+              the below mandatory arguments.
+
+              type specifies the mirror type - gre , erspan or local.
+
+              index specifies the tunnel index value (which is an integer)  if
+              the type is gre or erspan.
+
+              filter specifies the mirror source selection. Can be from-lport,
+              to-lport or both.
+
+              dest  specifies the mirror destination IP (v4 or v6) if the type
+              is gre or erspan. For a type of local, this field defines a  loā€
+              cal  interface  on  the OVS integration bridge to be used as the
+              mirror destination. The interface must possess external-ids:mirā€
+              ror-id that matches this string.
+
+       mirror-del m
+              Deletes the mirror m.
+
+       mirror-list
+              Lists the mirrors.
+
+   Synchronization Commands
+       sync   Ordinarily, --wait=sb or --wait=hv only waits for changes by the
+              current ovn-nbctl invocation to take effect. This means that, if
+              none of the commands supplied to ovn-nbctl change the  database,
+              then  the  command  does not wait at all. With the sync command,
+              however, ovn-nbctl waits even for earlier changes to  the  dataā€
+              base  to propagate down to the southbound database or all of the
+              OVN chassis, according to the argument to --wait.
+
+   Remote Connectivity Commands
+       These commands manipulate the connections column in the NB_Global table
+       and rows in the Connection table. When ovsdb-server  is  configured  to
+       use  the  connections column for OVSDB connections, this allows the adā€
+       ministrator to use ovn-nbctl to configure database connections.
+
+              get-connection
+                     Prints the configured connection(s).
+
+              del-connection
+                     Deletes the configured connection(s).
+
+              [--inactivity-probe=msecs] set-connection target...
+                     Sets the configured manager target or targets. Use  --inā€ā€
+                     activity-probe=msecs to override the default idle connecā€
+                     tion  inactivity  probe time. Use 0 to disable inactivity
+                     probes.
+
+   SSL Configuration Commands
+       get-ssl
+              Prints the SSL configuration.
+
+       del-ssl
+              Deletes the current SSL configuration.
+
+       [--bootstrap] set-ssl private-key certificate ca-cert [ssl-protocol-
+       list [ssl-cipher-list]]
+              Sets the SSL configuration.
+
+   Database Commands
+       These commands query and modify the contents of ovsdb tables. They  are
+       a slight abstraction of the ovsdb interface and as such they operate at
+       a lower level than other ovn-nbctl commands.
+
+       Identifying Tables, Records, and Columns
+
+       Each of these commands has a table parameter to identify a table within
+       the database. Many of them also take a record parameter that identifies
+       a  particular  record  within  a table. The record parameter may be the
+       UUID for a record, which may be abbreviated to its first  4  (or  more)
+       hex  digits,  as  long  as that is unique. Many tables offer additional
+       ways to identify records. Some commands  also  take  column  parameters
+       that identify a particular field within the records in a table.
+
+       For  a list of tables and their columns, see ovn-nb(5) or see the table
+       listing from the --help option.
+
+       Record names must be specified in full and with correct capitalization,
+       except that UUIDs may be abbreviated to their first  4  (or  more)  hex
+       digits, as long as that is unique within the table. Names of tables and
+       columns  are  not  case-sensitive, and - and _ are treated interchangeā€
+       ably. Unique abbreviations of table and column  names  are  acceptable,
+       e.g. d or dhcp is sufficient to identify the DHCP_Options table.
+
+       Database Values
+
+       Each column in the database accepts a fixed type of data. The currently
+       defined basic types, and their representations, are:
+
+              integer
+                     A  decimal integer in the range -2**63 to 2**63-1, incluā€
+                     sive.
+
+              real   A floating-point number.
+
+              Boolean
+                     True or false, written true or false, respectively.
+
+              string An arbitrary Unicode string, except that null  bytes  are
+                     not  allowed.  Quotes  are optional for most strings that
+                     begin with an English letter or  underscore  and  consist
+                     only  of letters, underscores, hyphens, and periods. Howā€
+                     ever, true and false and strings that match the syntax of
+                     UUIDs (see below) must be enclosed in  double  quotes  to
+                     distinguish  them  from  other  basic  types. When double
+                     quotes are used, the syntax is that of strings  in  JSON,
+                     e.g.  backslashes  may  be used to escape special characā€
+                     ters. The empty string must be represented as a  pair  of
+                     double quotes ("").
+
+              UUID   Either  a  universally  unique identifier in the style of
+                     RFC 4122, e.g.  f81d4fae-7dec-11d0-a765-00a0c91e6bf6,  or
+                     an  @name  defined  by a get or create command within the
+                     same ovs-vsctl invocation.
+
+       Multiple values in a single column may be separated by spaces or a sinā€
+       gle comma. When multiple values are present,  duplicates  are  not  alā€
+       lowed,  and  order  is not important. Conversely, some database columns
+       can have an empty set of values, represented as [], and square brackets
+       may optionally enclose other non-empty sets or single values as well.
+
+       A few database columns are ``mapsā€™ā€™ of key-value pairs, where  the  key
+       and the value are each some fixed database type. These are specified in
+       the  form key=value, where key and value follow the syntax for the colā€
+       umnā€™s key type and value type, respectively. When  multiple  pairs  are
+       present  (separated  by  spaces or a comma), duplicate keys are not alā€
+       lowed, and again the order is not important. Duplicate values  are  alā€
+       lowed.  An  empty map is represented as {}. Curly braces may optionally
+       enclose non-empty maps as well (but use quotes  to  prevent  the  shell
+       from  expanding other-config={0=x,1=y} into other-config=0=x other-conā€ā€
+       fig=1=y, which may not have the desired effect).
+
+       Database Command Syntax
+
+              [--if-exists] [--columns=column[,column]...] list table
+              [record]...
+                     Lists the data in each specified record.  If  no  records
+                     are specified, lists all the records in table.
+
+                     If --columns is specified, only the requested columns are
+                     listed,  in  the  specified order. Otherwise, all columns
+                     are listed, in alphabetical order by column name.
+
+                     Without --if-exists, it is  an  error  if  any  specified
+                     record  does not exist. With --if-exists, the command igā€
+                     nores any record that does not exist,  without  producing
+                     any output.
+
+              [--columns=column[,column]...] find table [colā€
+              umn[:key]=value]...
+                     Lists  the  data  in  each  record  in table whose column
+                     equals value or, if key is specified, whose  column  conā€
+                     tains a key with the specified value. The following operā€
+                     ators  may  be used where = is written in the syntax sumā€
+                     mary:
+
+                     = != gt;>gt; = >gt;>gt;=
+                            Selects records in which column[:key] equals, does
+                            not equal, is less than, is greater than, is  less
+                            than  or  equal to, or is greater than or equal to
+                            value, respectively.
+
+                            Consider column[:key] and value as  sets  of  eleā€
+                            ments. Identical sets are considered equal. Otherā€
+                            wise,  if  the sets have different numbers of eleā€
+                            ments, then the set with more elements is  considā€
+                            ered  to  be larger. Otherwise, consider a element
+                            from each set pairwise, in increasing order within
+                            each set. The first pair that  differs  determines
+                            the  result. (For a column that contains key-value
+                            pairs, first all the keys are compared, and values
+                            are considered only if the two sets contain  idenā€
+                            tical keys.)
+
+                     {=} {!=}
+                            Test for set equality or inequality, respectively.
+
+                     {=}   Selects  records in which column[:key] is a subset
+                            of value. For example, flood-vlans{=}1,2  selects
+                            records  in  which  the  flood-vlans column is the
+                            empty set or contains 1 or 2 or both.
+
+                     {}    Selects records in which column[:key] is a  proper
+                            subset  of  value.  For example, flood-vlans{}1,2
+                            selects records in which the flood-vlans column is
+                            the empty set or contains 1 or 2 but not both.
+
+                     {>gt;>gt;=} {>gt;>gt;}
+                            Same as {=} and {},  respectively,  except  that
+                            the   relationship   is   reversed.  For  example,
+                            flood-vlans{>gt;>gt;=}1,2 selects records  in  which  the
+                            flood-vlans column contains both 1 and 2.
+
+                     The  following  operators  are  available  only  in  Open
+                     vSwitch 2.16 and later:
+
+                     {in}   Selects records in which  every  element  in  colā€
+                            umn[:key]  is  also in value. (This is the same as
+                            {=}.)
+
+                     {not-in}
+                            Selects records in which  every  element  in  colā€
+                            umn[:key] is not in value.
+
+                     For  arithmetic  operators  (= != gt;>gt; = >gt;>gt;=), when key is
+                     specified but a particular recordā€™s column does not  conā€
+                     tain  key, the record is always omitted from the results.
+                     Thus,  the   condition   other-config:mtu!=1500   matches
+                     records  that have a mtu key whose value is not 1500, but
+                     not those that lack an mtu key.
+
+                     For the set operators, when key is specified but  a  parā€
+                     ticular recordā€™s column does not contain key, the comparā€
+                     ison  is  done  against an empty set. Thus, the condition
+                     other-config:mtu{!=}1500 matches records that have a  mtu
+                     key  whose  value  is not 1500 and those that lack an mtu
+                     key.
+
+                     Donā€™t forget to escape gt;>gt; from interpretation by  the
+                     shell.
+
+                     If --columns is specified, only the requested columns are
+                     listed, in the specified order. Otherwise all columns are
+                     listed, in alphabetical order by column name.
+
+                     The  UUIDs  shown  for rows created in the same ovs-vsctl
+                     invocation will be wrong.
+
+              [--if-exists] [--id=@name] get table record [column[:key]]...
+                     Prints the value of each specified column  in  the  given
+                     record in table. For map columns, a key may optionally be
+                     specified, in which case the value associated with key in
+                     the column is printed, instead of the entire map.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist or key is specified,  if  key  does  not  exist  in
+                     record. With --if-exists, a missing record yields no outā€
+                     put and a missing key prints a blank line.
+
+                     If  @name  is  specified, then the UUID for record may be
+                     referred to by that name later in the same ovs-vsctl  inā€
+                     vocation in contexts where a UUID is expected.
+
+                     Both --id and the column arguments are optional, but usuā€
+                     ally  at  least  one or the other should be specified. If
+                     both are omitted, then get has no effect except to verify
+                     that record exists in table.
+
+                     --id and --if-exists cannot be used together.
+
+              [--if-exists] set table record column[:key]=value...
+                     Sets the value of each  specified  column  in  the  given
+                     record  in table to value. For map columns, a key may opā€
+                     tionally be specified, in which case the value associated
+                     with key in that column is changed (or added, if none exā€
+                     ists), instead of the entire map.
+
+                     Without --if-exists, it is an error if  record  does  not
+                     exist.  With  --if-exists,  this  command does nothing if
+                     record does not exist.
+
+              [--if-exists] add table record column [key=]value...
+                     Adds the specified value or key-value pair to  column  in
+                     record  in  table.  If  column  is a map, then key is reā€
+                     quired, otherwise it is prohibited. If key already exists
+                     in a map column, then the current value is  not  replaced
+                     (use the set command to replace an existing value).
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--if-exists] remove table record column value...
+
+                     [--if-exists] remove table record column key...
+
+                     [--if-exists]  remove  table  record  column key=value...
+                     Removes the specified values or key-value pairs from colā€
+                     umn in record in table. The first form applies to columns
+                     that are not maps: each specified value is  removed  from
+                     the  column.  The  second  and  third  forms apply to map
+                     columns: if only a key is specified, then  any  key-value
+                     pair  with  the  given  key is removed, regardless of its
+                     value; if a value is given then a pair is removed only if
+                     both key and value match.
+
+                     It is not an error if the column  does  not  contain  the
+                     specified key or value or pair.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--if-exists] clear table record column...
+                     Sets  each  column in record in table to the empty set or
+                     empty map, as appropriate. This command applies  only  to
+                     columns that are allowed to be empty.
+
+                     Without  --if-exists,  it  is an error if record does not
+                     exist. With --if-exists, this  command  does  nothing  if
+                     record does not exist.
+
+              [--id=(@name|uuid)] create table column[:key]=value...
+                     Creates a new record in table and sets the initial values
+                     of  each  column. Columns not explicitly set will receive
+                     their default values. Outputs the UUID of the new row.
+
+                     If @name is specified, then the UUID for the new row  may
+                     be  referred  to by that name elsewhere in the same \*(PN
+                     invocation in contexts where a  UUID  is  expected.  Such
+                     references may precede or follow the create command.
+
+                     If a valid uuid is specified, then it is used as the UUID
+                     of the new row.
+
+                     Caution (ovs-vsctl as example)
+                            Records  in the Open vSwitch database are signifiā€
+                            cant only when they can be reached directly or inā€
+                            directly from the Open_vSwitch table.  Except  for
+                            records  in  the QoS or Queue tables, records that
+                            are not reachable from the Open_vSwitch table  are
+                            automatically  deleted  from  the  database.  This
+                            deletion happens immediately, without waiting  for
+                            additional  ovs-vsctl  commands  or other database
+                            activity. Thus, a create command must generally be
+                            accompanied by additional commands within the same
+                            ovs-vsctl invocation to add a chain of  references
+                            to  the  newly  created  record from the top-level
+                            Open_vSwitch record. The  EXAMPLES  section  gives
+                            some examples that show how to do this.
+
+              [--if-exists] destroy table record...
+                     Deletes each specified record from table. Unless --if-exā€ā€
+                     ists is specified, each records must exist.
+
+              --all destroy table
+                     Deletes all records from the table.
+
+                     Caution (ovs-vsctl as example)
+                            The  destroy command is only useful for records in
+                            the QoS or Queue tables. Records in  other  tables
+                            are  automatically  deleted from the database when
+                            they become unreachable from the Open_vSwitch  taā€
+                            ble.  This  means that deleting the last reference
+                            to a record is sufficient for deleting the  record
+                            itself.  For  records  in these tables, destroy is
+                            silently ignored. See the EXAMPLES  section  below
+                            for more information.
+
+              wait-until table record [column[:key]=value]...
+                     Waits  until  table  contains a record named record whose
+                     column equals value or, if key is specified, whose column
+                     contains a key with the  specified  value.  This  command
+                     supports  the  same operators and semantics described for
+                     the find command above.
+
+                     If no column[:key]=value arguments are given,  this  comā€
+                     mand  waits  only  until  record exists. If more than one
+                     such argument is given, the command waits  until  all  of
+                     them are satisfied.
+
+                     Caution (ovs-vsctl as example)
+                            Usually  wait-until should be placed at the beginā€
+                            ning of a set of ovs-vsctl commands. For  example,
+                            wait-until  bridge  br0  --  get  bridge br0 dataā€ā€
+                            path_id waits until a bridge named br0 is created,
+                            then prints its datapath_id  column,  whereas  get
+                            bridge  br0  datapath_id  -- wait-until bridge br0
+                            will abort if no  bridge  named  br0  exists  when
+                            ovs-vsctl initially connects to the database.
+
+                     Consider  specifying --timeout=0 along with --wait-until,
+                     to prevent ovs-vsctl from terminating after waiting  only
+                     at most 5 seconds.
+
+              comment [arg]...
+                     This  command has no effect on behavior, but any database
+                     log record created by the command will include  the  comā€
+                     mand and its arguments.
+
+ENVIRONMENT
+       OVN_NB_DAEMON
+              If set, this should name the Unix domain socket for an ovn-nbctl
+              server process. See Daemon Mode, above, for more information.
+
+       OVN_NBCTL_OPTIONS
+              If  set,  a set of options for ovn-nbctl to apply automatically,
+              in the same form as on the command line.
+
+       OVN_NB_DB
+              If set, the default database to contact when the --db option  is
+              not used.
+
+EXIT STATUS
+       0      Successful program execution.
+
+       1      Usage, syntax, or network error.
+
+SEE ALSO
+       ovn-nb(5), ovn-appctl(8).
+
+OVN 23.06.3                        ovn-nbctl                      ovn-nbctl(8)
+